Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKLM>\Software\Classes\Direct WAV MP3 Splitter\shell\open\command] '' = '"%ProgramFiles(x86)%\Direct WAV MP3 Splitter\Splitter.exe" "%1"'
Modifies file system
Creates the following files
- %TEMP%\is-ue4fl.tmp\<File name>.tmp
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\direct wav mp3 splitter\direct wav mp3 splitter.lnk
- %ProgramFiles(x86)%\direct wav mp3 splitter\images\is-7love.tmp
- %ProgramFiles(x86)%\direct wav mp3 splitter\images\is-5c57d.tmp
- %ProgramFiles(x86)%\direct wav mp3 splitter\images\is-hi98e.tmp
- %ProgramFiles(x86)%\direct wav mp3 splitter\images\is-14uhg.tmp
- %ProgramFiles(x86)%\direct wav mp3 splitter\images\is-3mofv.tmp
- %ProgramFiles(x86)%\direct wav mp3 splitter\images\is-s3jk3.tmp
- %ProgramFiles(x86)%\direct wav mp3 splitter\images\is-e70up.tmp
- %ProgramFiles(x86)%\direct wav mp3 splitter\images\is-9m8nc.tmp
- %ProgramFiles(x86)%\direct wav mp3 splitter\images\is-e0ssu.tmp
- %ProgramFiles(x86)%\direct wav mp3 splitter\images\is-8dd9m.tmp
- %ProgramFiles(x86)%\direct wav mp3 splitter\is-fqdjm.tmp
- %ProgramFiles(x86)%\direct wav mp3 splitter\is-233po.tmp
- %ProgramFiles(x86)%\direct wav mp3 splitter\is-iisvk.tmp
- %ProgramFiles(x86)%\direct wav mp3 splitter\is-gm20e.tmp
- %ProgramFiles(x86)%\direct wav mp3 splitter\is-1ntie.tmp
- %ProgramFiles(x86)%\direct wav mp3 splitter\is-eutqt.tmp
- %TEMP%\is-kcd58.tmp\_isetup\_iscrypt.dll
- %TEMP%\is-kcd58.tmp\_isetup\_setup64.tmp
- %ProgramFiles(x86)%\direct wav mp3 splitter\splitter.url
- %ProgramFiles(x86)%\direct wav mp3 splitter\unins000.dat
Moves the following files
- from %ProgramFiles(x86)%\direct wav mp3 splitter\is-eutqt.tmp to %ProgramFiles(x86)%\direct wav mp3 splitter\unins000.exe
- from %ProgramFiles(x86)%\direct wav mp3 splitter\is-1ntie.tmp to %ProgramFiles(x86)%\direct wav mp3 splitter\splitter.exe
- from %ProgramFiles(x86)%\direct wav mp3 splitter\is-gm20e.tmp to %ProgramFiles(x86)%\direct wav mp3 splitter\readme.txt
- from %ProgramFiles(x86)%\direct wav mp3 splitter\is-iisvk.tmp to %ProgramFiles(x86)%\direct wav mp3 splitter\splithelp.chm
- from %ProgramFiles(x86)%\direct wav mp3 splitter\is-233po.tmp to %ProgramFiles(x86)%\direct wav mp3 splitter\bass.dll
- from %ProgramFiles(x86)%\direct wav mp3 splitter\is-fqdjm.tmp to %ProgramFiles(x86)%\direct wav mp3 splitter\bass_fx.dll
- from %ProgramFiles(x86)%\direct wav mp3 splitter\images\is-8dd9m.tmp to %ProgramFiles(x86)%\direct wav mp3 splitter\images\button_big_buy_the_full_version_now-trans.png
- from %ProgramFiles(x86)%\direct wav mp3 splitter\images\is-e0ssu.tmp to %ProgramFiles(x86)%\direct wav mp3 splitter\images\buy.gif
- from %ProgramFiles(x86)%\direct wav mp3 splitter\images\is-9m8nc.tmp to %ProgramFiles(x86)%\direct wav mp3 splitter\images\buynow_sm.gif
- from %ProgramFiles(x86)%\direct wav mp3 splitter\images\is-e70up.tmp to %ProgramFiles(x86)%\direct wav mp3 splitter\images\buy_full_version.gif
- from %ProgramFiles(x86)%\direct wav mp3 splitter\images\is-s3jk3.tmp to %ProgramFiles(x86)%\direct wav mp3 splitter\images\cancel_sm.gif
- from %ProgramFiles(x86)%\direct wav mp3 splitter\images\is-3mofv.tmp to %ProgramFiles(x86)%\direct wav mp3 splitter\images\continue_free_trial.gif
- from %ProgramFiles(x86)%\direct wav mp3 splitter\images\is-14uhg.tmp to %ProgramFiles(x86)%\direct wav mp3 splitter\images\customersvc_sm.gif
- from %ProgramFiles(x86)%\direct wav mp3 splitter\images\is-hi98e.tmp to %ProgramFiles(x86)%\direct wav mp3 splitter\images\register_sm.gif
- from %ProgramFiles(x86)%\direct wav mp3 splitter\images\is-5c57d.tmp to %ProgramFiles(x86)%\direct wav mp3 splitter\images\reissuekey_sm.gif
- from %ProgramFiles(x86)%\direct wav mp3 splitter\images\is-7love.tmp to %ProgramFiles(x86)%\direct wav mp3 splitter\images\security_lock_text.gif
Network activity
Connects to
- 'sy###ee.info':80
TCP
HTTP POST requests
- http://sy###ee.info/v2/events
UDP
- DNS ASK sy###ee.info
Miscellaneous
Creates and executes the following
- '%TEMP%\is-ue4fl.tmp\<File name>.tmp' /SL5="$120228,9329914,54784,<Full path to file>"
- '%ProgramFiles(x86)%\direct wav mp3 splitter\splitter.exe' <File name>.exe
