Technical Information
Modifies file system
Creates the following files
- %TEMP%\is-p5dqn.tmp\is-jc3lv.tmp
- %ProgramFiles(x86)%\cover keys\lang\is-q4cni.tmp
- %ProgramFiles(x86)%\cover keys\lang\is-pm7k8.tmp
- %ProgramFiles(x86)%\cover keys\lang\is-2v25t.tmp
- %ProgramFiles(x86)%\cover keys\lang\is-53j9e.tmp
- %ProgramFiles(x86)%\cover keys\lang\is-u7eje.tmp
- %ProgramFiles(x86)%\cover keys\lang\is-5sruk.tmp
- %ProgramFiles(x86)%\cover keys\lang\is-7ggs2.tmp
- %ProgramFiles(x86)%\cover keys\lang\is-7ar19.tmp
- %ProgramFiles(x86)%\cover keys\lang\is-gjuko.tmp
- %ProgramFiles(x86)%\cover keys\lang\is-s2obu.tmp
- %ProgramFiles(x86)%\cover keys\lang\is-aei2c.tmp
- %ProgramFiles(x86)%\cover keys\lang\is-mbflp.tmp
- %ProgramFiles(x86)%\cover keys\is-qgt73.tmp
- %ProgramFiles(x86)%\cover keys\is-8c8ev.tmp
- %ProgramFiles(x86)%\cover keys\unins000.dat
- %ProgramFiles(x86)%\cover keys\lang\is-u9jqm.tmp
- %ProgramFiles(x86)%\cover keys\lang\is-e0ccm.tmp
- %ProgramFiles(x86)%\cover keys\lang\is-l6ne2.tmp
- %ProgramFiles(x86)%\cover keys\lang\is-iqapa.tmp
- %ProgramFiles(x86)%\cover keys\lang\is-5qgle.tmp
- %TEMP%\is-v7bke.tmp\_isetup\_setup64.tmp
- %TEMP%\is-v7bke.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-v7bke.tmp\_isetup\_iscrypt.dll
- %ProgramFiles(x86)%\cover keys\is-9vlfs.tmp
- %ProgramFiles(x86)%\cover keys\is-p6g8b.tmp
- %ProgramFiles(x86)%\cover keys\is-h2dev.tmp
- %ProgramFiles(x86)%\cover keys\lang\is-b2sd9.tmp
- %TEMP%\is-v7bke.tmp\_isetup\_regdll.tmp
- %ProgramFiles(x86)%\cover keys\lang\is-8ivn5.tmp
- %ProgramFiles(x86)%\cover keys\lang\is-nfaap.tmp
- %ProgramFiles(x86)%\cover keys\lang\is-solnb.tmp
- %ProgramFiles(x86)%\cover keys\lang\is-h9b4e.tmp
- %ProgramFiles(x86)%\cover keys\lang\is-8scd5.tmp
- %ProgramFiles(x86)%\cover keys\lang\is-599t0.tmp
- %ProgramFiles(x86)%\cover keys\lang\is-iqp1c.tmp
- %ProgramFiles(x86)%\cover keys\lang\is-p3n1g.tmp
- %ProgramFiles(x86)%\cover keys\lang\is-k2j3n.tmp
- %ProgramFiles(x86)%\cover keys\coverkeys.exe
- %TEMP%\authrootstl.cab
Moves the following files
- from %ProgramFiles(x86)%\cover keys\is-9vlfs.tmp to %ProgramFiles(x86)%\cover keys\unins000.exe
- from %ProgramFiles(x86)%\cover keys\lang\is-mbflp.tmp to %ProgramFiles(x86)%\cover keys\lang\ukrainian.xml
- from %ProgramFiles(x86)%\cover keys\lang\is-aei2c.tmp to %ProgramFiles(x86)%\cover keys\lang\turkish.xml
- from %ProgramFiles(x86)%\cover keys\lang\is-s2obu.tmp to %ProgramFiles(x86)%\cover keys\lang\swedish.xml
- from %ProgramFiles(x86)%\cover keys\lang\is-e0ccm.tmp to %ProgramFiles(x86)%\cover keys\lang\spanish.xml
- from %ProgramFiles(x86)%\cover keys\lang\is-u9jqm.tmp to %ProgramFiles(x86)%\cover keys\lang\russian.xml
- from %ProgramFiles(x86)%\cover keys\lang\is-gjuko.tmp to %ProgramFiles(x86)%\cover keys\lang\romanian.xml
- from %ProgramFiles(x86)%\cover keys\lang\is-5sruk.tmp to %ProgramFiles(x86)%\cover keys\lang\portuguese_portugal.xml
- from %ProgramFiles(x86)%\cover keys\lang\is-u7eje.tmp to %ProgramFiles(x86)%\cover keys\lang\portuguese_brazil.xml
- from %ProgramFiles(x86)%\cover keys\lang\is-53j9e.tmp to %ProgramFiles(x86)%\cover keys\lang\polish.xml
- from %ProgramFiles(x86)%\cover keys\lang\is-2v25t.tmp to %ProgramFiles(x86)%\cover keys\lang\norwegian.xml
- from %ProgramFiles(x86)%\cover keys\lang\is-pm7k8.tmp to %ProgramFiles(x86)%\cover keys\lang\korean.xml
- from %ProgramFiles(x86)%\cover keys\lang\is-q4cni.tmp to %ProgramFiles(x86)%\cover keys\lang\japanese.xml
- from %ProgramFiles(x86)%\cover keys\lang\is-7ar19.tmp to %ProgramFiles(x86)%\cover keys\lang\italian.xml
- from %ProgramFiles(x86)%\cover keys\lang\is-7ggs2.tmp to %ProgramFiles(x86)%\cover keys\lang\indonesian.xml
- from %ProgramFiles(x86)%\cover keys\lang\is-l6ne2.tmp to %ProgramFiles(x86)%\cover keys\lang\hungarian.xml
- from %ProgramFiles(x86)%\cover keys\lang\is-iqapa.tmp to %ProgramFiles(x86)%\cover keys\lang\greek.xml
- from %ProgramFiles(x86)%\cover keys\lang\is-5qgle.tmp to %ProgramFiles(x86)%\cover keys\lang\german.xml
- from %ProgramFiles(x86)%\cover keys\lang\is-p3n1g.tmp to %ProgramFiles(x86)%\cover keys\lang\georgian.xml
- from %ProgramFiles(x86)%\cover keys\lang\is-iqp1c.tmp to %ProgramFiles(x86)%\cover keys\lang\french.xml
- from %ProgramFiles(x86)%\cover keys\lang\is-599t0.tmp to %ProgramFiles(x86)%\cover keys\lang\finnish.xml
- from %ProgramFiles(x86)%\cover keys\lang\is-8scd5.tmp to %ProgramFiles(x86)%\cover keys\lang\english.xml
- from %ProgramFiles(x86)%\cover keys\lang\is-h9b4e.tmp to %ProgramFiles(x86)%\cover keys\lang\dutch.xml
- from %ProgramFiles(x86)%\cover keys\lang\is-solnb.tmp to %ProgramFiles(x86)%\cover keys\lang\danish.xml
- from %ProgramFiles(x86)%\cover keys\lang\is-nfaap.tmp to %ProgramFiles(x86)%\cover keys\lang\czech.xml
- from %ProgramFiles(x86)%\cover keys\lang\is-k2j3n.tmp to %ProgramFiles(x86)%\cover keys\lang\chinese_traditional.xml
- from %ProgramFiles(x86)%\cover keys\lang\is-8ivn5.tmp to %ProgramFiles(x86)%\cover keys\lang\chinese_simplified.xml
- from %ProgramFiles(x86)%\cover keys\lang\is-b2sd9.tmp to %ProgramFiles(x86)%\cover keys\lang\arabic.xml
- from %ProgramFiles(x86)%\cover keys\is-h2dev.tmp to %ProgramFiles(x86)%\cover keys\isssurvey.ini
- from %ProgramFiles(x86)%\cover keys\is-p6g8b.tmp to %ProgramFiles(x86)%\cover keys\isssurvey.dll
- from %ProgramFiles(x86)%\cover keys\is-qgt73.tmp to %ProgramFiles(x86)%\cover keys\coverkeys.exe
- from %ProgramFiles(x86)%\cover keys\is-8c8ev.tmp to %ProgramFiles(x86)%\cover keys\wmfdist.exe
Network activity
Connects to
- 'pe###igold.xyz':80
TCP
HTTP GET requests
- http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?eb##############
HTTP POST requests
- http://pe###igold.xyz/new/net_api
UDP
- DNS ASK pe###igold.xyz
Miscellaneous
Searches for the following windows
- ClassName: 'CardiganPlus' WindowName: ''
Creates and executes the following
- '%TEMP%\is-p5dqn.tmp\is-jc3lv.tmp' /SL4 $B00A4 "<Full path to file>" 7958836 336384
- '%ProgramFiles(x86)%\cover keys\coverkeys.exe'
- '%ProgramFiles(x86)%\cover keys\wmfdist.exe' /Q:A /R:N
- '%ProgramFiles(x86)%\cover keys\coverkeys.exe' c6a9d60f8d49876ceb912e09d98435f1
