Technical Information
Modifies file system
Creates the following files
- %TEMP%\is-44f9b.tmp\is-lgfjd.tmp
- %ProgramFiles(x86)%\verc keys\lang\is-u0tb7.tmp
- %ProgramFiles(x86)%\verc keys\lang\is-kqdoo.tmp
- %ProgramFiles(x86)%\verc keys\lang\is-aa87l.tmp
- %ProgramFiles(x86)%\verc keys\lang\is-etuah.tmp
- %ProgramFiles(x86)%\verc keys\lang\is-hndi3.tmp
- %ProgramFiles(x86)%\verc keys\lang\is-8b5m3.tmp
- %ProgramFiles(x86)%\verc keys\lang\is-n48f0.tmp
- %ProgramFiles(x86)%\verc keys\lang\is-vo6s5.tmp
- %ProgramFiles(x86)%\verc keys\lang\is-iq21d.tmp
- %ProgramFiles(x86)%\verc keys\lang\is-7qva7.tmp
- %ProgramFiles(x86)%\verc keys\lang\is-rsct0.tmp
- %ProgramFiles(x86)%\verc keys\lang\is-e3mb6.tmp
- %ProgramFiles(x86)%\verc keys\is-9193e.tmp
- %ProgramFiles(x86)%\verc keys\is-nc0ir.tmp
- %ProgramFiles(x86)%\verc keys\unins000.dat
- %ProgramFiles(x86)%\verc keys\lang\is-l0ae9.tmp
- %ProgramFiles(x86)%\verc keys\lang\is-o71jt.tmp
- %ProgramFiles(x86)%\verc keys\lang\is-8tnod.tmp
- %ProgramFiles(x86)%\verc keys\lang\is-6c90h.tmp
- %ProgramFiles(x86)%\verc keys\lang\is-blk3d.tmp
- %TEMP%\is-6mt27.tmp\_isetup\_setup64.tmp
- %TEMP%\is-6mt27.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-6mt27.tmp\_isetup\_iscrypt.dll
- %ProgramFiles(x86)%\verc keys\is-88142.tmp
- %ProgramFiles(x86)%\verc keys\is-4copi.tmp
- %ProgramFiles(x86)%\verc keys\is-b4828.tmp
- %ProgramFiles(x86)%\verc keys\lang\is-otp00.tmp
- %TEMP%\is-6mt27.tmp\_isetup\_regdll.tmp
- %ProgramFiles(x86)%\verc keys\lang\is-lccfu.tmp
- %ProgramFiles(x86)%\verc keys\lang\is-vdm8q.tmp
- %ProgramFiles(x86)%\verc keys\lang\is-82srp.tmp
- %ProgramFiles(x86)%\verc keys\lang\is-peg1s.tmp
- %ProgramFiles(x86)%\verc keys\lang\is-rvj4j.tmp
- %ProgramFiles(x86)%\verc keys\lang\is-ekq7b.tmp
- %ProgramFiles(x86)%\verc keys\lang\is-aqrvb.tmp
- %ProgramFiles(x86)%\verc keys\lang\is-un4al.tmp
- %ProgramFiles(x86)%\verc keys\lang\is-73g7s.tmp
- %ProgramFiles(x86)%\verc keys\verckeys.exe
- %TEMP%\authrootstl.cab
Moves the following files
- from %ProgramFiles(x86)%\verc keys\is-88142.tmp to %ProgramFiles(x86)%\verc keys\unins000.exe
- from %ProgramFiles(x86)%\verc keys\lang\is-e3mb6.tmp to %ProgramFiles(x86)%\verc keys\lang\ukrainian.xml
- from %ProgramFiles(x86)%\verc keys\lang\is-rsct0.tmp to %ProgramFiles(x86)%\verc keys\lang\turkish.xml
- from %ProgramFiles(x86)%\verc keys\lang\is-7qva7.tmp to %ProgramFiles(x86)%\verc keys\lang\swedish.xml
- from %ProgramFiles(x86)%\verc keys\lang\is-o71jt.tmp to %ProgramFiles(x86)%\verc keys\lang\spanish.xml
- from %ProgramFiles(x86)%\verc keys\lang\is-l0ae9.tmp to %ProgramFiles(x86)%\verc keys\lang\russian.xml
- from %ProgramFiles(x86)%\verc keys\lang\is-iq21d.tmp to %ProgramFiles(x86)%\verc keys\lang\romanian.xml
- from %ProgramFiles(x86)%\verc keys\lang\is-8b5m3.tmp to %ProgramFiles(x86)%\verc keys\lang\portuguese_portugal.xml
- from %ProgramFiles(x86)%\verc keys\lang\is-hndi3.tmp to %ProgramFiles(x86)%\verc keys\lang\portuguese_brazil.xml
- from %ProgramFiles(x86)%\verc keys\lang\is-etuah.tmp to %ProgramFiles(x86)%\verc keys\lang\polish.xml
- from %ProgramFiles(x86)%\verc keys\lang\is-aa87l.tmp to %ProgramFiles(x86)%\verc keys\lang\norwegian.xml
- from %ProgramFiles(x86)%\verc keys\lang\is-kqdoo.tmp to %ProgramFiles(x86)%\verc keys\lang\korean.xml
- from %ProgramFiles(x86)%\verc keys\lang\is-u0tb7.tmp to %ProgramFiles(x86)%\verc keys\lang\japanese.xml
- from %ProgramFiles(x86)%\verc keys\lang\is-vo6s5.tmp to %ProgramFiles(x86)%\verc keys\lang\italian.xml
- from %ProgramFiles(x86)%\verc keys\lang\is-n48f0.tmp to %ProgramFiles(x86)%\verc keys\lang\indonesian.xml
- from %ProgramFiles(x86)%\verc keys\lang\is-8tnod.tmp to %ProgramFiles(x86)%\verc keys\lang\hungarian.xml
- from %ProgramFiles(x86)%\verc keys\lang\is-6c90h.tmp to %ProgramFiles(x86)%\verc keys\lang\greek.xml
- from %ProgramFiles(x86)%\verc keys\lang\is-blk3d.tmp to %ProgramFiles(x86)%\verc keys\lang\german.xml
- from %ProgramFiles(x86)%\verc keys\lang\is-un4al.tmp to %ProgramFiles(x86)%\verc keys\lang\georgian.xml
- from %ProgramFiles(x86)%\verc keys\lang\is-aqrvb.tmp to %ProgramFiles(x86)%\verc keys\lang\french.xml
- from %ProgramFiles(x86)%\verc keys\lang\is-ekq7b.tmp to %ProgramFiles(x86)%\verc keys\lang\finnish.xml
- from %ProgramFiles(x86)%\verc keys\lang\is-rvj4j.tmp to %ProgramFiles(x86)%\verc keys\lang\english.xml
- from %ProgramFiles(x86)%\verc keys\lang\is-peg1s.tmp to %ProgramFiles(x86)%\verc keys\lang\dutch.xml
- from %ProgramFiles(x86)%\verc keys\lang\is-82srp.tmp to %ProgramFiles(x86)%\verc keys\lang\danish.xml
- from %ProgramFiles(x86)%\verc keys\lang\is-vdm8q.tmp to %ProgramFiles(x86)%\verc keys\lang\czech.xml
- from %ProgramFiles(x86)%\verc keys\lang\is-73g7s.tmp to %ProgramFiles(x86)%\verc keys\lang\chinese_traditional.xml
- from %ProgramFiles(x86)%\verc keys\lang\is-lccfu.tmp to %ProgramFiles(x86)%\verc keys\lang\chinese_simplified.xml
- from %ProgramFiles(x86)%\verc keys\lang\is-otp00.tmp to %ProgramFiles(x86)%\verc keys\lang\arabic.xml
- from %ProgramFiles(x86)%\verc keys\is-b4828.tmp to %ProgramFiles(x86)%\verc keys\isssurvey.ini
- from %ProgramFiles(x86)%\verc keys\is-4copi.tmp to %ProgramFiles(x86)%\verc keys\isssurvey.dll
- from %ProgramFiles(x86)%\verc keys\is-9193e.tmp to %ProgramFiles(x86)%\verc keys\verckeys.exe
- from %ProgramFiles(x86)%\verc keys\is-nc0ir.tmp to %ProgramFiles(x86)%\verc keys\wmfdist.exe
Network activity
Connects to
- 'pe###igold.xyz':80
TCP
HTTP GET requests
- http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?eb##############
HTTP POST requests
- http://pe###igold.xyz/new/net_api
UDP
- DNS ASK pe###igold.xyz
Miscellaneous
Searches for the following windows
- ClassName: 'GurdiganPlus2' WindowName: ''
Creates and executes the following
- '%TEMP%\is-44f9b.tmp\is-lgfjd.tmp' /SL4 $A0212 "<Full path to file>" 8013740 336384
- '%ProgramFiles(x86)%\verc keys\verckeys.exe'
- '%ProgramFiles(x86)%\verc keys\wmfdist.exe' /Q:A /R:N
- '%ProgramFiles(x86)%\verc keys\verckeys.exe' b30489e5dfdb74f2a12cf9744df659b3
