Technical Information
Modifies file system
Creates the following files
- %TEMP%\is-5lmnj.tmp\<File name>.tmp
- %ProgramFiles(x86)%\minima\sit\is-em9uq.tmp
- %ProgramFiles(x86)%\minima\sit\is-3qlsh.tmp
- %ProgramFiles(x86)%\minima\sit\is-5j244.tmp
- %ProgramFiles(x86)%\minima\sit\is-ld4u9.tmp
- %ProgramFiles(x86)%\minima\doloribus\is-jt7qc.tmp
- %ProgramFiles(x86)%\minima\doloribus\is-6uip1.tmp
- %ProgramFiles(x86)%\minima\doloribus\is-ugrr7.tmp
- %ProgramFiles(x86)%\minima\doloribus\is-7bloa.tmp
- %ProgramFiles(x86)%\minima\doloribus\is-cbg2i.tmp
- %ProgramFiles(x86)%\minima\doloribus\is-ppvks.tmp
- %ProgramFiles(x86)%\minima\delectus\is-duq8j.tmp
- %ProgramFiles(x86)%\minima\sit\is-4scjf.tmp
- %ProgramFiles(x86)%\minima\delectus\is-9ue6p.tmp
- %ProgramFiles(x86)%\minima\aliquid\is-tii79.tmp
- %ProgramFiles(x86)%\minima\aliquid\is-f9jaf.tmp
- %ProgramFiles(x86)%\minima\aliquid\is-ikh2v.tmp
- %ProgramFiles(x86)%\minima\aliquid\is-7q9dt.tmp
- %ProgramFiles(x86)%\minima\aliquid\is-vj4rh.tmp
- %ProgramFiles(x86)%\minima\aliquid\is-l4h34.tmp
- %ProgramFiles(x86)%\minima\is-hjuq3.tmp
- %ProgramFiles(x86)%\minima\is-shb5h.tmp
- %TEMP%\is-1mggs.tmp\_isetup\_iscrypt.dll
- %TEMP%\is-1mggs.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-1mggs.tmp\_isetup\_setup64.tmp
- %ProgramFiles(x86)%\minima\aliquid\is-usnbl.tmp
- %ProgramFiles(x86)%\minima\unins000.dat
Moves the following files
- from %ProgramFiles(x86)%\minima\is-shb5h.tmp to %ProgramFiles(x86)%\minima\unins000.exe
- from %ProgramFiles(x86)%\minima\sit\is-3qlsh.tmp to %ProgramFiles(x86)%\minima\sit\id.zip
- from %ProgramFiles(x86)%\minima\sit\is-5j244.tmp to %ProgramFiles(x86)%\minima\sit\ex.wpd
- from %ProgramFiles(x86)%\minima\sit\is-ld4u9.tmp to %ProgramFiles(x86)%\minima\sit\cupiditate.log
- from %ProgramFiles(x86)%\minima\doloribus\is-jt7qc.tmp to %ProgramFiles(x86)%\minima\doloribus\quia.rar
- from %ProgramFiles(x86)%\minima\doloribus\is-6uip1.tmp to %ProgramFiles(x86)%\minima\doloribus\necessitatibus.zip
- from %ProgramFiles(x86)%\minima\doloribus\is-ugrr7.tmp to %ProgramFiles(x86)%\minima\doloribus\modi.pdf
- from %ProgramFiles(x86)%\minima\doloribus\is-7bloa.tmp to %ProgramFiles(x86)%\minima\doloribus\maxime.sdf
- from %ProgramFiles(x86)%\minima\doloribus\is-cbg2i.tmp to %ProgramFiles(x86)%\minima\doloribus\eos.pif
- from %ProgramFiles(x86)%\minima\doloribus\is-ppvks.tmp to %ProgramFiles(x86)%\minima\doloribus\adipisci.pif
- from %ProgramFiles(x86)%\minima\delectus\is-duq8j.tmp to %ProgramFiles(x86)%\minima\delectus\sunt.rar
- from %ProgramFiles(x86)%\minima\delectus\is-9ue6p.tmp to %ProgramFiles(x86)%\minima\delectus\odio.mp3
- from %ProgramFiles(x86)%\minima\aliquid\is-usnbl.tmp to %ProgramFiles(x86)%\minima\aliquid\sqlite3.dll
- from %ProgramFiles(x86)%\minima\aliquid\is-tii79.tmp to %ProgramFiles(x86)%\minima\aliquid\voluptatem.exe
- from %ProgramFiles(x86)%\minima\aliquid\is-f9jaf.tmp to %ProgramFiles(x86)%\minima\aliquid\soluta.dat
- from %ProgramFiles(x86)%\minima\aliquid\is-ikh2v.tmp to %ProgramFiles(x86)%\minima\aliquid\sint.zip
- from %ProgramFiles(x86)%\minima\aliquid\is-7q9dt.tmp to %ProgramFiles(x86)%\minima\aliquid\quas.txt
- from %ProgramFiles(x86)%\minima\aliquid\is-vj4rh.tmp to %ProgramFiles(x86)%\minima\aliquid\molestiae.htm
- from %ProgramFiles(x86)%\minima\aliquid\is-l4h34.tmp to %ProgramFiles(x86)%\minima\aliquid\libero.png
- from %ProgramFiles(x86)%\minima\is-hjuq3.tmp to %ProgramFiles(x86)%\minima\itaque.asf
- from %ProgramFiles(x86)%\minima\sit\is-em9uq.tmp to %ProgramFiles(x86)%\minima\sit\maxime.tex
- from %ProgramFiles(x86)%\minima\sit\is-4scjf.tmp to %ProgramFiles(x86)%\minima\sit\ullam.bin
Network activity
TCP
HTTP POST requests
- http://cl###etapi.com/v2/events
UDP
- DNS ASK cl###etapi.com
Miscellaneous
Searches for the following windows
- ClassName: 'AF492389-030F-4973-B8F8-03FE921C6EDF' WindowName: ''
Creates and executes the following
- '%TEMP%\is-5lmnj.tmp\<File name>.tmp' /SL5="$B022C,2623434,140800,<Full path to file>"
- '%ProgramFiles(x86)%\minima\aliquid\voluptatem.exe' c4e265354adfe22c19f083c7e320e296
