Technical Information
Modifies file system
Creates the following files
- %TEMP%\is-duek5.tmp\<File name>.tmp
- %ProgramFiles(x86)%\wshareae\disk manager\unins000.dat
- %ProgramFiles(x86)%\wshareae\disk manager\order.url
- %ProgramFiles(x86)%\wshareae\disk manager\homepage.url
- %ProgramFiles(x86)%\wshareae\disk manager\is-0hic6.tmp
- %ProgramFiles(x86)%\wshareae\disk manager\is-g1003.tmp
- %ProgramFiles(x86)%\wshareae\disk manager\is-74n3n.tmp
- %ProgramFiles(x86)%\wshareae\disk manager\is-ksima.tmp
- %ProgramFiles(x86)%\wshareae\disk manager\is-klai2.tmp
- %ProgramFiles(x86)%\wshareae\disk manager\is-0e4jf.tmp
- %ProgramFiles(x86)%\wshareae\disk manager\is-19rqj.tmp
- %ProgramFiles(x86)%\wshareae\disk manager\is-opghs.tmp
- %ProgramFiles(x86)%\wshareae\disk manager\is-2iv90.tmp
- %WINDIR%\syswow64\drivers\is-ign72.tmp
- %ProgramFiles(x86)%\wshareae\disk manager\is-658r4.tmp
- %ProgramFiles(x86)%\wshareae\disk manager\is-55h5p.tmp
- %ProgramFiles(x86)%\wshareae\disk manager\is-ou2r5.tmp
- %ProgramFiles(x86)%\wshareae\disk manager\is-ejjg3.tmp
- %ProgramFiles(x86)%\wshareae\disk manager\is-aml9h.tmp
- %ProgramFiles(x86)%\wshareae\disk manager\is-kaap9.tmp
- %ProgramFiles(x86)%\wshareae\disk manager\is-6qhms.tmp
- %ProgramFiles(x86)%\wshareae\disk manager\is-6qgnr.tmp
- %ProgramFiles(x86)%\wshareae\disk manager\is-oene3.tmp
- %ProgramFiles(x86)%\wshareae\disk manager\is-4h07j.tmp
- %TEMP%\is-lo4eb.tmp\_isetup\_iscrypt.dll
- %TEMP%\is-lo4eb.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-lo4eb.tmp\_isetup\_setup64.tmp
- %TEMP%\is-lo4eb.tmp\_isetup\_regdll.tmp
- %ProgramFiles(x86)%\wshareae\disk manager\diskmanagergui.exe
- %TEMP%\version.txt
Moves the following files
- from %ProgramFiles(x86)%\wshareae\disk manager\is-4h07j.tmp to %ProgramFiles(x86)%\wshareae\disk manager\unins000.exe
- from %ProgramFiles(x86)%\wshareae\disk manager\is-74n3n.tmp to %ProgramFiles(x86)%\wshareae\disk manager\wsconfig.ini
- from %ProgramFiles(x86)%\wshareae\disk manager\is-ksima.tmp to %ProgramFiles(x86)%\wshareae\disk manager\liveupdate.exe
- from %ProgramFiles(x86)%\wshareae\disk manager\is-klai2.tmp to %ProgramFiles(x86)%\wshareae\disk manager\outproc.dll
- from %ProgramFiles(x86)%\wshareae\disk manager\is-0e4jf.tmp to %ProgramFiles(x86)%\wshareae\disk manager\qtstartup.ini
- from %ProgramFiles(x86)%\wshareae\disk manager\is-19rqj.tmp to %ProgramFiles(x86)%\wshareae\disk manager\diskmanagergui.exe
- from %ProgramFiles(x86)%\wshareae\disk manager\is-opghs.tmp to %ProgramFiles(x86)%\wshareae\disk manager\turbosearch.exe
- from %ProgramFiles(x86)%\wshareae\disk manager\is-2iv90.tmp to %ProgramFiles(x86)%\wshareae\disk manager\wsdiskmanagerlib.dll
- from %WINDIR%\syswow64\drivers\is-ign72.tmp to %WINDIR%\syswow64\drivers\sfilter.inf
- from %ProgramFiles(x86)%\wshareae\disk manager\is-658r4.tmp to %ProgramFiles(x86)%\wshareae\disk manager\ws_saleprocess.dll
- from %ProgramFiles(x86)%\wshareae\disk manager\is-55h5p.tmp to %ProgramFiles(x86)%\wshareae\disk manager\ws_log.dll
- from %ProgramFiles(x86)%\wshareae\disk manager\is-ou2r5.tmp to %ProgramFiles(x86)%\wshareae\disk manager\ws_agentprocess.dll
- from %ProgramFiles(x86)%\wshareae\disk manager\is-ejjg3.tmp to %ProgramFiles(x86)%\wshareae\disk manager\qtgui4.dll
- from %ProgramFiles(x86)%\wshareae\disk manager\is-aml9h.tmp to %ProgramFiles(x86)%\wshareae\disk manager\qtcore4.dll
- from %ProgramFiles(x86)%\wshareae\disk manager\is-kaap9.tmp to %ProgramFiles(x86)%\wshareae\disk manager\msvcr90.dll
- from %ProgramFiles(x86)%\wshareae\disk manager\is-6qhms.tmp to %ProgramFiles(x86)%\wshareae\disk manager\msvcp90.dll
- from %ProgramFiles(x86)%\wshareae\disk manager\is-6qgnr.tmp to %ProgramFiles(x86)%\wshareae\disk manager\msvcm90.dll
- from %ProgramFiles(x86)%\wshareae\disk manager\is-oene3.tmp to %ProgramFiles(x86)%\wshareae\disk manager\microsoft.vc90.crt.manifest
- from %ProgramFiles(x86)%\wshareae\disk manager\is-g1003.tmp to %ProgramFiles(x86)%\wshareae\disk manager\liveupdate.ini
- from %ProgramFiles(x86)%\wshareae\disk manager\is-0hic6.tmp to %ProgramFiles(x86)%\wshareae\disk manager\language_en.qm
Network activity
Connects to
- 'jo####rdmust.sbs':80
TCP
HTTP GET requests
- http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?64########
HTTP POST requests
- http://jo####rdmust.sbs/new/net_api
UDP
- DNS ASK jo####rdmust.sbs
Miscellaneous
Searches for the following windows
- ClassName: '{6527e11423273A6b16821D45A6793b6e}' WindowName: ''
Creates and executes the following
- '%TEMP%\is-duek5.tmp\<File name>.tmp' /SL5="$11022C,8409506,54272,<Full path to file>"
- '%ProgramFiles(x86)%\wshareae\disk manager\diskmanagergui.exe'
- '%ProgramFiles(x86)%\wshareae\disk manager\diskmanagergui.exe' 9a13a832d9b7935a97da1e250cb2c8fb
Executes the following
- '%WINDIR%\syswow64\net.exe' helpmsg 51
- '%WINDIR%\syswow64\net1.exe' helpmsg 51
- '%WINDIR%\syswow64\net.exe' pause diskmanagergui
- '%WINDIR%\syswow64\net1.exe' pause diskmanagergui
