Technical Information
Modifies file system
Creates the following files
- %TEMP%\is-gdt3l.tmp\is-086v0.tmp
- %ProgramFiles(x86)%\personal video database\is-rpuk4.tmp
- %ProgramFiles(x86)%\personal video database\is-0lp4r.tmp
- %ProgramFiles(x86)%\personal video database\is-kpa1m.tmp
- %ProgramFiles(x86)%\personal video database\is-dm406.tmp
- %ProgramFiles(x86)%\personal video database\is-7k8vu.tmp
- %ProgramFiles(x86)%\personal video database\is-r0q2u.tmp
- %ProgramFiles(x86)%\personal video database\is-kog73.tmp
- %ProgramFiles(x86)%\personal video database\is-ajv06.tmp
- %ProgramFiles(x86)%\personal video database\is-r9a64.tmp
- %ProgramFiles(x86)%\personal video database\is-0f3t5.tmp
- %ProgramFiles(x86)%\personal video database\is-jgn96.tmp
- %ProgramFiles(x86)%\personal video database\scripts\is-bkrbi.tmp
- %ProgramFiles(x86)%\personal video database\scripts\is-e47mq.tmp
- %ProgramFiles(x86)%\personal video database\is-mu5b8.tmp
- %ProgramFiles(x86)%\personal video database\is-h50un.tmp
- %ProgramFiles(x86)%\personal video database\unins000.dat
- %ProgramFiles(x86)%\personal video database\is-8qom9.tmp
- %ProgramFiles(x86)%\personal video database\is-i6kc1.tmp
- %ProgramFiles(x86)%\personal video database\skins\people\is-553f5.tmp
- %ProgramFiles(x86)%\personal video database\skins\people\is-dh60d.tmp
- %ProgramFiles(x86)%\personal video database\skins\movies\is-e44vt.tmp
- %TEMP%\is-u26f7.tmp\_isetup\_setup64.tmp
- %TEMP%\is-u26f7.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-u26f7.tmp\_isetup\_iscrypt.dll
- %ProgramFiles(x86)%\personal video database\is-4dkda.tmp
- %ProgramFiles(x86)%\personal video database\is-6qmh2.tmp
- %ProgramFiles(x86)%\personal video database\is-tkn61.tmp
- %ProgramFiles(x86)%\personal video database\is-1sgq5.tmp
- %ProgramFiles(x86)%\personal video database\viddb.exe
- %ProgramFiles(x86)%\personal video database\is-ijckj.tmp
- %ProgramFiles(x86)%\personal video database\is-7j8mu.tmp
- %ProgramFiles(x86)%\personal video database\is-hjp25.tmp
- %ProgramFiles(x86)%\personal video database\is-ih51v.tmp
- %ProgramFiles(x86)%\personal video database\skins\images\is-ksc68.tmp
- %ProgramFiles(x86)%\personal video database\skins\images\is-prfm0.tmp
- %ProgramFiles(x86)%\personal video database\skins\images\is-es880.tmp
- %ProgramFiles(x86)%\personal video database\skins\images\is-35ei4.tmp
- %ProgramFiles(x86)%\personal video database\skins\movies\is-06fm1.tmp
- %TEMP%\is-u26f7.tmp\_isetup\_regdll.tmp
- %ProgramFiles(x86)%\personal video database\is-63gcl.tmp
- %TEMP%\lohkos.cab
Moves the following files
- from %ProgramFiles(x86)%\personal video database\is-4dkda.tmp to %ProgramFiles(x86)%\personal video database\unins000.exe
- from %ProgramFiles(x86)%\personal video database\is-i6kc1.tmp to %ProgramFiles(x86)%\personal video database\fbclient.dll
- from %ProgramFiles(x86)%\personal video database\is-rpuk4.tmp to %ProgramFiles(x86)%\personal video database\firebird.conf
- from %ProgramFiles(x86)%\personal video database\is-0lp4r.tmp to %ProgramFiles(x86)%\personal video database\firebird.msg
- from %ProgramFiles(x86)%\personal video database\is-kpa1m.tmp to %ProgramFiles(x86)%\personal video database\ib_util.dll
- from %ProgramFiles(x86)%\personal video database\is-dm406.tmp to %ProgramFiles(x86)%\personal video database\icudt30.dll
- from %ProgramFiles(x86)%\personal video database\is-7k8vu.tmp to %ProgramFiles(x86)%\personal video database\icuin30.dll
- from %ProgramFiles(x86)%\personal video database\is-kog73.tmp to %ProgramFiles(x86)%\personal video database\msvcp71.dll
- from %ProgramFiles(x86)%\personal video database\is-ih51v.tmp to %ProgramFiles(x86)%\personal video database\sqlite3.dll
- from %ProgramFiles(x86)%\personal video database\is-r9a64.tmp to %ProgramFiles(x86)%\personal video database\msvcr71.dll
- from %ProgramFiles(x86)%\personal video database\is-ijckj.tmp to %ProgramFiles(x86)%\personal video database\msvcp80.dll
- from %ProgramFiles(x86)%\personal video database\is-0f3t5.tmp to %ProgramFiles(x86)%\personal video database\msvcr80.dll
- from %ProgramFiles(x86)%\personal video database\is-jgn96.tmp to %ProgramFiles(x86)%\personal video database\microsoft.vc80.crt.manifest
- from %ProgramFiles(x86)%\personal video database\scripts\is-bkrbi.tmp to %ProgramFiles(x86)%\personal video database\scripts\adultdvdempire.psf
- from %ProgramFiles(x86)%\personal video database\scripts\is-e47mq.tmp to %ProgramFiles(x86)%\personal video database\scripts\allrovi.psf
- from %ProgramFiles(x86)%\personal video database\is-8qom9.tmp to %ProgramFiles(x86)%\personal video database\fbembed.dll
- from %ProgramFiles(x86)%\personal video database\skins\people\is-553f5.tmp to %ProgramFiles(x86)%\personal video database\skins\people\skinimg_person_classic.png
- from %ProgramFiles(x86)%\personal video database\skins\people\is-dh60d.tmp to %ProgramFiles(x86)%\personal video database\skins\people\pvd_classic_person.xml
- from %ProgramFiles(x86)%\personal video database\skins\movies\is-e44vt.tmp to %ProgramFiles(x86)%\personal video database\skins\movies\skinimg_movie_classic.png
- from %ProgramFiles(x86)%\personal video database\skins\movies\is-06fm1.tmp to %ProgramFiles(x86)%\personal video database\skins\movies\pvd_classic_movie.xml
- from %ProgramFiles(x86)%\personal video database\skins\images\is-35ei4.tmp to %ProgramFiles(x86)%\personal video database\skins\images\tree.bmp
- from %ProgramFiles(x86)%\personal video database\skins\images\is-es880.tmp to %ProgramFiles(x86)%\personal video database\skins\images\toolbar.bmp
- from %ProgramFiles(x86)%\personal video database\skins\images\is-prfm0.tmp to %ProgramFiles(x86)%\personal video database\skins\images\stars.bmp
- from %ProgramFiles(x86)%\personal video database\skins\images\is-ksc68.tmp to %ProgramFiles(x86)%\personal video database\skins\images\buttons.bmp
- from %ProgramFiles(x86)%\personal video database\is-r0q2u.tmp to %ProgramFiles(x86)%\personal video database\icuuc30.dll
- from %ProgramFiles(x86)%\personal video database\is-hjp25.tmp to %ProgramFiles(x86)%\personal video database\debug.bat
- from %ProgramFiles(x86)%\personal video database\is-63gcl.tmp to %ProgramFiles(x86)%\personal video database\portable.bat
- from %ProgramFiles(x86)%\personal video database\is-ajv06.tmp to %ProgramFiles(x86)%\personal video database\delzip179.dll
- from %ProgramFiles(x86)%\personal video database\is-7j8mu.tmp to %ProgramFiles(x86)%\personal video database\pvdinst.exe
- from %ProgramFiles(x86)%\personal video database\is-1sgq5.tmp to %ProgramFiles(x86)%\personal video database\pcre3.dll
- from %ProgramFiles(x86)%\personal video database\is-tkn61.tmp to %ProgramFiles(x86)%\personal video database\mediainfo.dll
- from %ProgramFiles(x86)%\personal video database\is-6qmh2.tmp to %ProgramFiles(x86)%\personal video database\lang.dll
- from %ProgramFiles(x86)%\personal video database\is-mu5b8.tmp to %ProgramFiles(x86)%\personal video database\turbosearch.exe
- from %ProgramFiles(x86)%\personal video database\is-h50un.tmp to %ProgramFiles(x86)%\personal video database\viddb.exe
Network activity
Connects to
- 'so###como.gq':80
TCP
HTTP GET requests
- http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?08######
HTTP POST requests
- http://so###como.gq/new/net_api
UDP
- DNS ASK so###como.gq
Miscellaneous
Searches for the following windows
- ClassName: '{D5B112D4-26A4-44F5-A48B-0FAC83A919ED}' WindowName: ''
Creates and executes the following
- '%TEMP%\is-gdt3l.tmp\is-086v0.tmp' /SL4 $A0232 "<Full path to file>" 9959446 134656
- '%ProgramFiles(x86)%\personal video database\viddb.exe'
- '%ProgramFiles(x86)%\personal video database\viddb.exe' 64e644c098b01904c41f9aeabf1c8048
Executes the following
- '%WINDIR%\syswow64\schtasks.exe' /Query
- '%WINDIR%\syswow64\schtasks.exe' /Delete /F /TN "viddb 2"
