Technical Information
Modifies file system
Creates the following files
- %TEMP%\is-ero0f.tmp\is-615h9.tmp
- %ProgramFiles(x86)%\ver keys\lang\is-g5lr0.tmp
- %ProgramFiles(x86)%\ver keys\lang\is-amfd8.tmp
- %ProgramFiles(x86)%\ver keys\lang\is-4149n.tmp
- %ProgramFiles(x86)%\ver keys\lang\is-kgtua.tmp
- %ProgramFiles(x86)%\ver keys\lang\is-ris4g.tmp
- %ProgramFiles(x86)%\ver keys\lang\is-n2gvk.tmp
- %ProgramFiles(x86)%\ver keys\lang\is-d88uc.tmp
- %ProgramFiles(x86)%\ver keys\lang\is-qgvak.tmp
- %ProgramFiles(x86)%\ver keys\lang\is-nimkh.tmp
- %ProgramFiles(x86)%\ver keys\lang\is-buqtk.tmp
- %ProgramFiles(x86)%\ver keys\lang\is-3tn9g.tmp
- %ProgramFiles(x86)%\ver keys\lang\is-rbs38.tmp
- %ProgramFiles(x86)%\ver keys\is-7rer5.tmp
- %ProgramFiles(x86)%\ver keys\is-0kq70.tmp
- %ProgramFiles(x86)%\ver keys\unins000.dat
- %ProgramFiles(x86)%\ver keys\lang\is-c2dv9.tmp
- %ProgramFiles(x86)%\ver keys\lang\is-dli09.tmp
- %ProgramFiles(x86)%\ver keys\lang\is-vhmap.tmp
- %ProgramFiles(x86)%\ver keys\lang\is-rsab4.tmp
- %ProgramFiles(x86)%\ver keys\lang\is-r0vie.tmp
- %TEMP%\is-fp50q.tmp\_isetup\_setup64.tmp
- %TEMP%\is-fp50q.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-fp50q.tmp\_isetup\_iscrypt.dll
- %ProgramFiles(x86)%\ver keys\is-jmngi.tmp
- %ProgramFiles(x86)%\ver keys\is-eb1pg.tmp
- %ProgramFiles(x86)%\ver keys\is-2l29d.tmp
- %ProgramFiles(x86)%\ver keys\lang\is-o8e97.tmp
- %TEMP%\is-fp50q.tmp\_isetup\_regdll.tmp
- %ProgramFiles(x86)%\ver keys\lang\is-i81pj.tmp
- %ProgramFiles(x86)%\ver keys\lang\is-iapp2.tmp
- %ProgramFiles(x86)%\ver keys\lang\is-kbbqh.tmp
- %ProgramFiles(x86)%\ver keys\lang\is-u8tv2.tmp
- %ProgramFiles(x86)%\ver keys\lang\is-o7o81.tmp
- %ProgramFiles(x86)%\ver keys\lang\is-pj1g2.tmp
- %ProgramFiles(x86)%\ver keys\lang\is-j4l0f.tmp
- %ProgramFiles(x86)%\ver keys\lang\is-2aoro.tmp
- %ProgramFiles(x86)%\ver keys\lang\is-mp11k.tmp
- %ProgramFiles(x86)%\ver keys\verkeys.exe
- %TEMP%\authrootstl.cab
Moves the following files
- from %ProgramFiles(x86)%\ver keys\is-jmngi.tmp to %ProgramFiles(x86)%\ver keys\unins000.exe
- from %ProgramFiles(x86)%\ver keys\lang\is-rbs38.tmp to %ProgramFiles(x86)%\ver keys\lang\ukrainian.xml
- from %ProgramFiles(x86)%\ver keys\lang\is-3tn9g.tmp to %ProgramFiles(x86)%\ver keys\lang\turkish.xml
- from %ProgramFiles(x86)%\ver keys\lang\is-buqtk.tmp to %ProgramFiles(x86)%\ver keys\lang\swedish.xml
- from %ProgramFiles(x86)%\ver keys\lang\is-dli09.tmp to %ProgramFiles(x86)%\ver keys\lang\spanish.xml
- from %ProgramFiles(x86)%\ver keys\lang\is-c2dv9.tmp to %ProgramFiles(x86)%\ver keys\lang\russian.xml
- from %ProgramFiles(x86)%\ver keys\lang\is-nimkh.tmp to %ProgramFiles(x86)%\ver keys\lang\romanian.xml
- from %ProgramFiles(x86)%\ver keys\lang\is-n2gvk.tmp to %ProgramFiles(x86)%\ver keys\lang\portuguese_portugal.xml
- from %ProgramFiles(x86)%\ver keys\lang\is-ris4g.tmp to %ProgramFiles(x86)%\ver keys\lang\portuguese_brazil.xml
- from %ProgramFiles(x86)%\ver keys\lang\is-kgtua.tmp to %ProgramFiles(x86)%\ver keys\lang\polish.xml
- from %ProgramFiles(x86)%\ver keys\lang\is-4149n.tmp to %ProgramFiles(x86)%\ver keys\lang\norwegian.xml
- from %ProgramFiles(x86)%\ver keys\lang\is-amfd8.tmp to %ProgramFiles(x86)%\ver keys\lang\korean.xml
- from %ProgramFiles(x86)%\ver keys\lang\is-g5lr0.tmp to %ProgramFiles(x86)%\ver keys\lang\japanese.xml
- from %ProgramFiles(x86)%\ver keys\lang\is-qgvak.tmp to %ProgramFiles(x86)%\ver keys\lang\italian.xml
- from %ProgramFiles(x86)%\ver keys\lang\is-d88uc.tmp to %ProgramFiles(x86)%\ver keys\lang\indonesian.xml
- from %ProgramFiles(x86)%\ver keys\lang\is-vhmap.tmp to %ProgramFiles(x86)%\ver keys\lang\hungarian.xml
- from %ProgramFiles(x86)%\ver keys\lang\is-rsab4.tmp to %ProgramFiles(x86)%\ver keys\lang\greek.xml
- from %ProgramFiles(x86)%\ver keys\lang\is-r0vie.tmp to %ProgramFiles(x86)%\ver keys\lang\german.xml
- from %ProgramFiles(x86)%\ver keys\lang\is-2aoro.tmp to %ProgramFiles(x86)%\ver keys\lang\georgian.xml
- from %ProgramFiles(x86)%\ver keys\lang\is-j4l0f.tmp to %ProgramFiles(x86)%\ver keys\lang\french.xml
- from %ProgramFiles(x86)%\ver keys\lang\is-pj1g2.tmp to %ProgramFiles(x86)%\ver keys\lang\finnish.xml
- from %ProgramFiles(x86)%\ver keys\lang\is-o7o81.tmp to %ProgramFiles(x86)%\ver keys\lang\english.xml
- from %ProgramFiles(x86)%\ver keys\lang\is-u8tv2.tmp to %ProgramFiles(x86)%\ver keys\lang\dutch.xml
- from %ProgramFiles(x86)%\ver keys\lang\is-kbbqh.tmp to %ProgramFiles(x86)%\ver keys\lang\danish.xml
- from %ProgramFiles(x86)%\ver keys\lang\is-iapp2.tmp to %ProgramFiles(x86)%\ver keys\lang\czech.xml
- from %ProgramFiles(x86)%\ver keys\lang\is-mp11k.tmp to %ProgramFiles(x86)%\ver keys\lang\chinese_traditional.xml
- from %ProgramFiles(x86)%\ver keys\lang\is-i81pj.tmp to %ProgramFiles(x86)%\ver keys\lang\chinese_simplified.xml
- from %ProgramFiles(x86)%\ver keys\lang\is-o8e97.tmp to %ProgramFiles(x86)%\ver keys\lang\arabic.xml
- from %ProgramFiles(x86)%\ver keys\is-2l29d.tmp to %ProgramFiles(x86)%\ver keys\isssurvey.ini
- from %ProgramFiles(x86)%\ver keys\is-eb1pg.tmp to %ProgramFiles(x86)%\ver keys\isssurvey.dll
- from %ProgramFiles(x86)%\ver keys\is-7rer5.tmp to %ProgramFiles(x86)%\ver keys\verkeys.exe
- from %ProgramFiles(x86)%\ver keys\is-0kq70.tmp to %ProgramFiles(x86)%\ver keys\wmfdist.exe
Network activity
Connects to
- 'pe###igold.xyz':80
TCP
HTTP GET requests
- http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?eb##############
HTTP POST requests
- http://pe###igold.xyz/new/net_api
UDP
- DNS ASK pe###igold.xyz
Miscellaneous
Searches for the following windows
- ClassName: 'GurdiganPlus1' WindowName: ''
Creates and executes the following
- '%TEMP%\is-ero0f.tmp\is-615h9.tmp' /SL4 $C013C "<Full path to file>" 8031776 336384
- '%ProgramFiles(x86)%\ver keys\verkeys.exe'
- '%ProgramFiles(x86)%\ver keys\wmfdist.exe' /Q:A /R:N
- '%ProgramFiles(x86)%\ver keys\verkeys.exe' a0f6a7745b8eea36c1d607bc005bf410
