Technical Information
Modifies file system
Creates the following files
- %TEMP%\is-02n55.tmp\is-261eh.tmp
- %ProgramFiles(x86)%\verc keys\lang\is-kv1u0.tmp
- %ProgramFiles(x86)%\verc keys\lang\is-6kotf.tmp
- %ProgramFiles(x86)%\verc keys\lang\is-5ut12.tmp
- %ProgramFiles(x86)%\verc keys\lang\is-0jfi8.tmp
- %ProgramFiles(x86)%\verc keys\lang\is-dba4c.tmp
- %ProgramFiles(x86)%\verc keys\lang\is-grcc9.tmp
- %ProgramFiles(x86)%\verc keys\lang\is-tiepc.tmp
- %ProgramFiles(x86)%\verc keys\lang\is-9jr4o.tmp
- %ProgramFiles(x86)%\verc keys\lang\is-jtim1.tmp
- %ProgramFiles(x86)%\verc keys\lang\is-ghc58.tmp
- %ProgramFiles(x86)%\verc keys\lang\is-71se0.tmp
- %ProgramFiles(x86)%\verc keys\lang\is-pc8gt.tmp
- %ProgramFiles(x86)%\verc keys\is-3mijo.tmp
- %ProgramFiles(x86)%\verc keys\is-6mh77.tmp
- %ProgramFiles(x86)%\verc keys\unins000.dat
- %ProgramFiles(x86)%\verc keys\lang\is-sc1i1.tmp
- %ProgramFiles(x86)%\verc keys\lang\is-ip0mc.tmp
- %ProgramFiles(x86)%\verc keys\lang\is-1jqe4.tmp
- %ProgramFiles(x86)%\verc keys\lang\is-4m87h.tmp
- %ProgramFiles(x86)%\verc keys\lang\is-8afgs.tmp
- %TEMP%\is-bv8ga.tmp\_isetup\_setup64.tmp
- %TEMP%\is-bv8ga.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-bv8ga.tmp\_isetup\_iscrypt.dll
- %ProgramFiles(x86)%\verc keys\is-kdeo8.tmp
- %ProgramFiles(x86)%\verc keys\is-onr35.tmp
- %ProgramFiles(x86)%\verc keys\is-l829v.tmp
- %ProgramFiles(x86)%\verc keys\lang\is-3uttb.tmp
- %TEMP%\is-bv8ga.tmp\_isetup\_regdll.tmp
- %ProgramFiles(x86)%\verc keys\lang\is-b75kc.tmp
- %ProgramFiles(x86)%\verc keys\lang\is-coef9.tmp
- %ProgramFiles(x86)%\verc keys\lang\is-rn36q.tmp
- %ProgramFiles(x86)%\verc keys\lang\is-keaep.tmp
- %ProgramFiles(x86)%\verc keys\lang\is-bikhq.tmp
- %ProgramFiles(x86)%\verc keys\lang\is-tsc97.tmp
- %ProgramFiles(x86)%\verc keys\lang\is-4257g.tmp
- %ProgramFiles(x86)%\verc keys\lang\is-npld6.tmp
- %ProgramFiles(x86)%\verc keys\lang\is-rs8mq.tmp
- %ProgramFiles(x86)%\verc keys\verckeys.exe
- %TEMP%\authrootstl.cab
Moves the following files
- from %ProgramFiles(x86)%\verc keys\is-kdeo8.tmp to %ProgramFiles(x86)%\verc keys\unins000.exe
- from %ProgramFiles(x86)%\verc keys\lang\is-pc8gt.tmp to %ProgramFiles(x86)%\verc keys\lang\ukrainian.xml
- from %ProgramFiles(x86)%\verc keys\lang\is-71se0.tmp to %ProgramFiles(x86)%\verc keys\lang\turkish.xml
- from %ProgramFiles(x86)%\verc keys\lang\is-ghc58.tmp to %ProgramFiles(x86)%\verc keys\lang\swedish.xml
- from %ProgramFiles(x86)%\verc keys\lang\is-ip0mc.tmp to %ProgramFiles(x86)%\verc keys\lang\spanish.xml
- from %ProgramFiles(x86)%\verc keys\lang\is-sc1i1.tmp to %ProgramFiles(x86)%\verc keys\lang\russian.xml
- from %ProgramFiles(x86)%\verc keys\lang\is-jtim1.tmp to %ProgramFiles(x86)%\verc keys\lang\romanian.xml
- from %ProgramFiles(x86)%\verc keys\lang\is-grcc9.tmp to %ProgramFiles(x86)%\verc keys\lang\portuguese_portugal.xml
- from %ProgramFiles(x86)%\verc keys\lang\is-dba4c.tmp to %ProgramFiles(x86)%\verc keys\lang\portuguese_brazil.xml
- from %ProgramFiles(x86)%\verc keys\lang\is-0jfi8.tmp to %ProgramFiles(x86)%\verc keys\lang\polish.xml
- from %ProgramFiles(x86)%\verc keys\lang\is-5ut12.tmp to %ProgramFiles(x86)%\verc keys\lang\norwegian.xml
- from %ProgramFiles(x86)%\verc keys\lang\is-6kotf.tmp to %ProgramFiles(x86)%\verc keys\lang\korean.xml
- from %ProgramFiles(x86)%\verc keys\lang\is-kv1u0.tmp to %ProgramFiles(x86)%\verc keys\lang\japanese.xml
- from %ProgramFiles(x86)%\verc keys\lang\is-9jr4o.tmp to %ProgramFiles(x86)%\verc keys\lang\italian.xml
- from %ProgramFiles(x86)%\verc keys\lang\is-tiepc.tmp to %ProgramFiles(x86)%\verc keys\lang\indonesian.xml
- from %ProgramFiles(x86)%\verc keys\lang\is-1jqe4.tmp to %ProgramFiles(x86)%\verc keys\lang\hungarian.xml
- from %ProgramFiles(x86)%\verc keys\lang\is-4m87h.tmp to %ProgramFiles(x86)%\verc keys\lang\greek.xml
- from %ProgramFiles(x86)%\verc keys\lang\is-8afgs.tmp to %ProgramFiles(x86)%\verc keys\lang\german.xml
- from %ProgramFiles(x86)%\verc keys\lang\is-npld6.tmp to %ProgramFiles(x86)%\verc keys\lang\georgian.xml
- from %ProgramFiles(x86)%\verc keys\lang\is-4257g.tmp to %ProgramFiles(x86)%\verc keys\lang\french.xml
- from %ProgramFiles(x86)%\verc keys\lang\is-tsc97.tmp to %ProgramFiles(x86)%\verc keys\lang\finnish.xml
- from %ProgramFiles(x86)%\verc keys\lang\is-bikhq.tmp to %ProgramFiles(x86)%\verc keys\lang\english.xml
- from %ProgramFiles(x86)%\verc keys\lang\is-keaep.tmp to %ProgramFiles(x86)%\verc keys\lang\dutch.xml
- from %ProgramFiles(x86)%\verc keys\lang\is-rn36q.tmp to %ProgramFiles(x86)%\verc keys\lang\danish.xml
- from %ProgramFiles(x86)%\verc keys\lang\is-coef9.tmp to %ProgramFiles(x86)%\verc keys\lang\czech.xml
- from %ProgramFiles(x86)%\verc keys\lang\is-rs8mq.tmp to %ProgramFiles(x86)%\verc keys\lang\chinese_traditional.xml
- from %ProgramFiles(x86)%\verc keys\lang\is-b75kc.tmp to %ProgramFiles(x86)%\verc keys\lang\chinese_simplified.xml
- from %ProgramFiles(x86)%\verc keys\lang\is-3uttb.tmp to %ProgramFiles(x86)%\verc keys\lang\arabic.xml
- from %ProgramFiles(x86)%\verc keys\is-l829v.tmp to %ProgramFiles(x86)%\verc keys\isssurvey.ini
- from %ProgramFiles(x86)%\verc keys\is-onr35.tmp to %ProgramFiles(x86)%\verc keys\isssurvey.dll
- from %ProgramFiles(x86)%\verc keys\is-3mijo.tmp to %ProgramFiles(x86)%\verc keys\verckeys.exe
- from %ProgramFiles(x86)%\verc keys\is-6mh77.tmp to %ProgramFiles(x86)%\verc keys\wmfdist.exe
Network activity
Connects to
- 'pe###igold.xyz':80
TCP
HTTP GET requests
- http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?eb##############
HTTP POST requests
- http://pe###igold.xyz/new/net_api
UDP
- DNS ASK pe###igold.xyz
Miscellaneous
Searches for the following windows
- ClassName: 'GurdiganPlus2' WindowName: ''
Creates and executes the following
- '%TEMP%\is-02n55.tmp\is-261eh.tmp' /SL4 $12015A "<Full path to file>" 8020815 336384
- '%ProgramFiles(x86)%\verc keys\verckeys.exe'
- '%ProgramFiles(x86)%\verc keys\wmfdist.exe' /Q:A /R:N
- '%ProgramFiles(x86)%\verc keys\verckeys.exe' c8ccd49d7203c4a62921e167b22ebb25
