Technical Information
Modifies file system
Creates the following files
- %TEMP%\is-cjlb1.tmp\<File name>.tmp
- %ProgramFiles(x86)%\dodisk defrag\help\ru\is-b445i.tmp
- %ProgramFiles(x86)%\dodisk defrag\help\ru\is-huc1m.tmp
- %ProgramFiles(x86)%\dodisk defrag\help\ru\is-rekem.tmp
- %ProgramFiles(x86)%\dodisk defrag\help\ru\is-l9bgt.tmp
- %ProgramFiles(x86)%\dodisk defrag\help\ru\is-c7828.tmp
- %ProgramFiles(x86)%\dodisk defrag\help\en\is-v4co6.tmp
- %ProgramFiles(x86)%\dodisk defrag\help\en\is-83q22.tmp
- %ProgramFiles(x86)%\dodisk defrag\help\en\is-v9i0n.tmp
- %ProgramFiles(x86)%\dodisk defrag\help\ru\is-9j2r7.tmp
- %ProgramFiles(x86)%\dodisk defrag\help\ru\is-3dlgi.tmp
- %ProgramFiles(x86)%\dodisk defrag\help\en\is-t6ss7.tmp
- %ProgramFiles(x86)%\dodisk defrag\help\en\is-1g8am.tmp
- %ProgramFiles(x86)%\dodisk defrag\help\en\is-kfn96.tmp
- %ProgramFiles(x86)%\dodisk defrag\help\en\is-5ikor.tmp
- %ProgramFiles(x86)%\dodisk defrag\help\en\is-jsdre.tmp
- %ProgramFiles(x86)%\dodisk defrag\help\en\is-lhfdl.tmp
- %ProgramFiles(x86)%\dodisk defrag\is-tsk2u.tmp
- %ProgramFiles(x86)%\dodisk defrag\is-303gi.tmp
- %ProgramFiles(x86)%\dodisk defrag\unins000.dat
- %ProgramFiles(x86)%\dodisk defrag\help\en\is-u6qgv.tmp
- %ProgramFiles(x86)%\dodisk defrag\help\en\is-2rrh2.tmp
- %ProgramFiles(x86)%\dodisk defrag\help\ru\is-pfrkq.tmp
- %ProgramFiles(x86)%\dodisk defrag\help\ru\is-2hmkc.tmp
- %ProgramFiles(x86)%\dodisk defrag\help\ru\is-33s8u.tmp
- %TEMP%\is-6qipo.tmp\_isetup\_setup64.tmp
- %TEMP%\is-6qipo.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-6qipo.tmp\_isetup\_iscrypt.dll
- %ProgramFiles(x86)%\dodisk defrag\is-rkm50.tmp
- %ProgramFiles(x86)%\dodisk defrag\is-b2jme.tmp
- %ProgramFiles(x86)%\dodisk defrag\is-n2fbq.tmp
- %ProgramFiles(x86)%\dodisk defrag\is-nb9e0.tmp
- %ProgramFiles(x86)%\dodisk defrag\is-962d8.tmp
- %ProgramFiles(x86)%\dodisk defrag\is-3hoeo.tmp
- %TEMP%\is-6qipo.tmp\_isetup\_regdll.tmp
- %ProgramFiles(x86)%\dodisk defrag\is-vmcge.tmp
- %ProgramFiles(x86)%\dodisk defrag\is-el66l.tmp
- %ProgramFiles(x86)%\dodisk defrag\is-ej7cp.tmp
- %ProgramFiles(x86)%\dodisk defrag\is-ga31i.tmp
- %ProgramFiles(x86)%\dodisk defrag\languages\is-iu1oo.tmp
- %ProgramFiles(x86)%\dodisk defrag\languages\is-q19ov.tmp
- %ProgramFiles(x86)%\dodisk defrag\data\is-u31n8.tmp
- %ProgramFiles(x86)%\dodisk defrag\data\is-m8h0v.tmp
- %ProgramFiles(x86)%\dodisk defrag\skins\is-gdrco.tmp
- %ProgramFiles(x86)%\dodisk defrag\help\ru\is-6tcft.tmp
- %ProgramFiles(x86)%\dodisk defrag\is-a2ls3.tmp
- %ProgramFiles(x86)%\dodisk defrag\diskdefrag63.exe
- %TEMP%\jdegg.txt
Moves the following files
- from %ProgramFiles(x86)%\dodisk defrag\is-rkm50.tmp to %ProgramFiles(x86)%\dodisk defrag\unins000.exe
- from %ProgramFiles(x86)%\dodisk defrag\help\ru\is-huc1m.tmp to %ProgramFiles(x86)%\dodisk defrag\help\ru\rate.url
- from %ProgramFiles(x86)%\dodisk defrag\help\ru\is-rekem.tmp to %ProgramFiles(x86)%\dodisk defrag\help\ru\support.url
- from %ProgramFiles(x86)%\dodisk defrag\help\ru\is-l9bgt.tmp to %ProgramFiles(x86)%\dodisk defrag\help\ru\update.url
- from %ProgramFiles(x86)%\dodisk defrag\help\ru\is-c7828.tmp to %ProgramFiles(x86)%\dodisk defrag\help\ru\vkontakte.url
- from %ProgramFiles(x86)%\dodisk defrag\help\en\is-v4co6.tmp to %ProgramFiles(x86)%\dodisk defrag\help\en\about.url
- from %ProgramFiles(x86)%\dodisk defrag\help\en\is-83q22.tmp to %ProgramFiles(x86)%\dodisk defrag\help\en\bug.url
- from %ProgramFiles(x86)%\dodisk defrag\help\ru\is-3dlgi.tmp to %ProgramFiles(x86)%\dodisk defrag\help\ru\mail.url
- from %ProgramFiles(x86)%\dodisk defrag\help\ru\is-b445i.tmp to %ProgramFiles(x86)%\dodisk defrag\help\ru\product.url
- from %ProgramFiles(x86)%\dodisk defrag\help\en\is-v9i0n.tmp to %ProgramFiles(x86)%\dodisk defrag\help\en\contact.url
- from %ProgramFiles(x86)%\dodisk defrag\help\en\is-2rrh2.tmp to %ProgramFiles(x86)%\dodisk defrag\help\en\home.url
- from %ProgramFiles(x86)%\dodisk defrag\help\en\is-1g8am.tmp to %ProgramFiles(x86)%\dodisk defrag\help\en\product.url
- from %ProgramFiles(x86)%\dodisk defrag\help\en\is-kfn96.tmp to %ProgramFiles(x86)%\dodisk defrag\help\en\rate.url
- from %ProgramFiles(x86)%\dodisk defrag\help\en\is-5ikor.tmp to %ProgramFiles(x86)%\dodisk defrag\help\en\support.url
- from %ProgramFiles(x86)%\dodisk defrag\help\en\is-jsdre.tmp to %ProgramFiles(x86)%\dodisk defrag\help\en\twitter.url
- from %ProgramFiles(x86)%\dodisk defrag\help\en\is-lhfdl.tmp to %ProgramFiles(x86)%\dodisk defrag\help\en\update.url
- from %ProgramFiles(x86)%\dodisk defrag\help\en\is-t6ss7.tmp to %ProgramFiles(x86)%\dodisk defrag\help\en\facebook.url
- from %ProgramFiles(x86)%\dodisk defrag\help\en\is-u6qgv.tmp to %ProgramFiles(x86)%\dodisk defrag\help\en\feedback.url
- from %ProgramFiles(x86)%\dodisk defrag\help\ru\is-9j2r7.tmp to %ProgramFiles(x86)%\dodisk defrag\help\ru\home.url
- from %ProgramFiles(x86)%\dodisk defrag\help\ru\is-pfrkq.tmp to %ProgramFiles(x86)%\dodisk defrag\help\ru\feedback.url
- from %ProgramFiles(x86)%\dodisk defrag\help\ru\is-2hmkc.tmp to %ProgramFiles(x86)%\dodisk defrag\help\ru\contact.url
- from %ProgramFiles(x86)%\dodisk defrag\is-n2fbq.tmp to %ProgramFiles(x86)%\dodisk defrag\vcl70.bpl
- from %ProgramFiles(x86)%\dodisk defrag\is-nb9e0.tmp to %ProgramFiles(x86)%\dodisk defrag\loc.dll
- from %ProgramFiles(x86)%\dodisk defrag\is-962d8.tmp to %ProgramFiles(x86)%\dodisk defrag\sys.dll
- from %ProgramFiles(x86)%\dodisk defrag\is-3hoeo.tmp to %ProgramFiles(x86)%\dodisk defrag\doc.dll
- from %ProgramFiles(x86)%\dodisk defrag\is-vmcge.tmp to %ProgramFiles(x86)%\dodisk defrag\diskutils.dll
- from %ProgramFiles(x86)%\dodisk defrag\is-a2ls3.tmp to %ProgramFiles(x86)%\dodisk defrag\diskdefrag.dll
- from %ProgramFiles(x86)%\dodisk defrag\is-el66l.tmp to %ProgramFiles(x86)%\dodisk defrag\xml.dll
- from %ProgramFiles(x86)%\dodisk defrag\is-b2jme.tmp to %ProgramFiles(x86)%\dodisk defrag\rtl70.bpl
- from %ProgramFiles(x86)%\dodisk defrag\is-ej7cp.tmp to %ProgramFiles(x86)%\dodisk defrag\borlndmm.dll
- from %ProgramFiles(x86)%\dodisk defrag\languages\is-iu1oo.tmp to %ProgramFiles(x86)%\dodisk defrag\languages\1033.lng
- from %ProgramFiles(x86)%\dodisk defrag\languages\is-q19ov.tmp to %ProgramFiles(x86)%\dodisk defrag\languages\1049.lng
- from %ProgramFiles(x86)%\dodisk defrag\data\is-u31n8.tmp to %ProgramFiles(x86)%\dodisk defrag\data\config.ini
- from %ProgramFiles(x86)%\dodisk defrag\data\is-m8h0v.tmp to %ProgramFiles(x86)%\dodisk defrag\data\logo.png
- from %ProgramFiles(x86)%\dodisk defrag\skins\is-gdrco.tmp to %ProgramFiles(x86)%\dodisk defrag\skins\wlm.asz
- from %ProgramFiles(x86)%\dodisk defrag\help\ru\is-6tcft.tmp to %ProgramFiles(x86)%\dodisk defrag\help\ru\about.url
- from %ProgramFiles(x86)%\dodisk defrag\help\ru\is-33s8u.tmp to %ProgramFiles(x86)%\dodisk defrag\help\ru\bug.url
- from %ProgramFiles(x86)%\dodisk defrag\is-ga31i.tmp to %ProgramFiles(x86)%\dodisk defrag\fastmm_fulldebugmode.dll
- from %ProgramFiles(x86)%\dodisk defrag\is-tsk2u.tmp to %ProgramFiles(x86)%\dodisk defrag\turbosearch.exe
- from %ProgramFiles(x86)%\dodisk defrag\is-303gi.tmp to %ProgramFiles(x86)%\dodisk defrag\diskdefrag63.exe
Network activity
Connects to
- 'ro##mili.ml':80
TCP
HTTP GET requests
- http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?69########
HTTP POST requests
- http://ro##mili.ml/new/net_api
UDP
- DNS ASK ro##mili.ml
Miscellaneous
Searches for the following windows
- ClassName: '{b204a1c3-89b9-46c6-8509-f0478ba471ea}' WindowName: ''
Creates and executes the following
- '%TEMP%\is-cjlb1.tmp\<File name>.tmp' /SL5="$B0238,7069622,50688,<Full path to file>"
- '%ProgramFiles(x86)%\dodisk defrag\diskdefrag63.exe'
- '%ProgramFiles(x86)%\dodisk defrag\diskdefrag63.exe' e983a4d41728eeebf15e258cdb56cbca
Executes the following
- '%WINDIR%\syswow64\schtasks.exe' /Query
- '%WINDIR%\syswow64\schtasks.exe' /Delete /F /TN "doDisk63"
