Technical Information
Modifies file system
Creates the following files
- %TEMP%\is-usa56.tmp\is-lnr06.tmp
- %ProgramFiles(x86)%\word repair toolbox\unins000.dat
- %ProgramFiles(x86)%\word repair toolbox\is-jk4ij.tmp
- %ProgramFiles(x86)%\word repair toolbox\is-vvthe.tmp
- %ProgramFiles(x86)%\word repair toolbox\is-ctar2.tmp
- %ProgramFiles(x86)%\word repair toolbox\is-nlnpq.tmp
- %ProgramFiles(x86)%\word repair toolbox\is-5egjq.tmp
- %ProgramFiles(x86)%\word repair toolbox\is-fd3u9.tmp
- %ProgramFiles(x86)%\word repair toolbox\is-r9oe7.tmp
- %ProgramFiles(x86)%\word repair toolbox\is-vk4lf.tmp
- %ProgramFiles(x86)%\word repair toolbox\is-u3veo.tmp
- %ProgramFiles(x86)%\word repair toolbox\is-l5q08.tmp
- %ProgramFiles(x86)%\word repair toolbox\is-n8df7.tmp
- %ProgramFiles(x86)%\word repair toolbox\wordrepairtoolboxlauncher.exe
- %ProgramFiles(x86)%\word repair toolbox\is-ebu3r.tmp
- %ProgramFiles(x86)%\word repair toolbox\is-ev2jk.tmp
- %ProgramFiles(x86)%\word repair toolbox\is-9f8t9.tmp
- %ProgramFiles(x86)%\word repair toolbox\is-n52b9.tmp
- %ProgramFiles(x86)%\word repair toolbox\is-3s6qn.tmp
- %ProgramFiles(x86)%\word repair toolbox\is-e7rol.tmp
- %ProgramFiles(x86)%\word repair toolbox\is-2f2bm.tmp
- %ProgramFiles(x86)%\word repair toolbox\is-lv7lu.tmp
- %TEMP%\is-hid28.tmp\_isetup\_iscrypt.dll
- %TEMP%\is-hid28.tmp\_isetup\_isdecmp.dll
- %TEMP%\is-hid28.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-hid28.tmp\_isetup\_setup64.tmp
- %TEMP%\is-hid28.tmp\_isetup\_regdll.tmp
- %ProgramFiles(x86)%\word repair toolbox\is-l27gk.tmp
- %TEMP%\authrootstl.cab
Moves the following files
- from %ProgramFiles(x86)%\word repair toolbox\is-lv7lu.tmp to %ProgramFiles(x86)%\word repair toolbox\unins000.exe
- from %ProgramFiles(x86)%\word repair toolbox\is-ctar2.tmp to %ProgramFiles(x86)%\word repair toolbox\wmfdist.exe
- from %ProgramFiles(x86)%\word repair toolbox\is-nlnpq.tmp to %ProgramFiles(x86)%\word repair toolbox\ssleay32.dll
- from %ProgramFiles(x86)%\word repair toolbox\is-5egjq.tmp to %ProgramFiles(x86)%\word repair toolbox\libeay32.dll
- from %ProgramFiles(x86)%\word repair toolbox\is-fd3u9.tmp to %ProgramFiles(x86)%\word repair toolbox\word repair toolbox license.txt
- from %ProgramFiles(x86)%\word repair toolbox\is-r9oe7.tmp to %ProgramFiles(x86)%\word repair toolbox\wordrepairtoolbox.trk
- from %ProgramFiles(x86)%\word repair toolbox\is-vk4lf.tmp to %ProgramFiles(x86)%\word repair toolbox\wordrepairtoolbox.rus
- from %ProgramFiles(x86)%\word repair toolbox\is-u3veo.tmp to %ProgramFiles(x86)%\word repair toolbox\wordrepairtoolbox.ptb
- from %ProgramFiles(x86)%\word repair toolbox\is-l5q08.tmp to %ProgramFiles(x86)%\word repair toolbox\wordrepairtoolbox.plk
- from %ProgramFiles(x86)%\word repair toolbox\is-n8df7.tmp to %ProgramFiles(x86)%\word repair toolbox\wordrepairtoolbox.nld
- from %ProgramFiles(x86)%\word repair toolbox\is-ebu3r.tmp to %ProgramFiles(x86)%\word repair toolbox\wordrepairtoolbox.kor
- from %ProgramFiles(x86)%\word repair toolbox\is-l27gk.tmp to %ProgramFiles(x86)%\word repair toolbox\wordrepairtoolbox.jpn
- from %ProgramFiles(x86)%\word repair toolbox\is-ev2jk.tmp to %ProgramFiles(x86)%\word repair toolbox\wordrepairtoolbox.ita
- from %ProgramFiles(x86)%\word repair toolbox\is-9f8t9.tmp to %ProgramFiles(x86)%\word repair toolbox\wordrepairtoolbox.fra
- from %ProgramFiles(x86)%\word repair toolbox\is-n52b9.tmp to %ProgramFiles(x86)%\word repair toolbox\wordrepairtoolbox.esn
- from %ProgramFiles(x86)%\word repair toolbox\is-3s6qn.tmp to %ProgramFiles(x86)%\word repair toolbox\wordrepairtoolbox.deu
- from %ProgramFiles(x86)%\word repair toolbox\is-e7rol.tmp to %ProgramFiles(x86)%\word repair toolbox\wordrepairtoolbox.chs
- from %ProgramFiles(x86)%\word repair toolbox\is-2f2bm.tmp to %ProgramFiles(x86)%\word repair toolbox\wordrepairtoolbox.ara
- from %ProgramFiles(x86)%\word repair toolbox\is-vvthe.tmp to %ProgramFiles(x86)%\word repair toolbox\wordrepairtoolboxlauncher.exe
- from %ProgramFiles(x86)%\word repair toolbox\is-jk4ij.tmp to %ProgramFiles(x86)%\word repair toolbox\settings.bin
Network activity
Connects to
- 'pe###igold.xyz':80
TCP
HTTP GET requests
- http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?eb##############
HTTP POST requests
- http://pe###igold.xyz/new/net_api
UDP
- DNS ASK pe###igold.xyz
Miscellaneous
Searches for the following windows
- ClassName: 'WordRepairTBA1' WindowName: ''
Creates and executes the following
- '%TEMP%\is-usa56.tmp\is-lnr06.tmp' /SL4 $B022E "<Full path to file>" 9145125 52736
- '%ProgramFiles(x86)%\word repair toolbox\wordrepairtoolboxlauncher.exe'
- '%ProgramFiles(x86)%\word repair toolbox\wmfdist.exe' /Q:A /R:N
- '%ProgramFiles(x86)%\word repair toolbox\wordrepairtoolboxlauncher.exe' 16dd7c22b89d2bb6ade19c332ffbc158
