Technical Information
Modifies file system
Creates the following files
- %TEMP%\is-1hur6.tmp\is-sb19q.tmp
- %ProgramFiles(x86)%\zipgenius 6\skins\is-4olqs.tmp
- %ProgramFiles(x86)%\zipgenius 6\skins\is-fhbck.tmp
- %ProgramFiles(x86)%\zipgenius 6\skins\is-dis6j.tmp
- %ProgramFiles(x86)%\zipgenius 6\skins\is-72hem.tmp
- %ProgramFiles(x86)%\zipgenius 6\skins\is-279mc.tmp
- %ProgramFiles(x86)%\zipgenius 6\skins\is-lmgp0.tmp
- %ProgramFiles(x86)%\zipgenius 6\is-vs1jd.tmp
- %ProgramFiles(x86)%\zipgenius 6\is-dc0pl.tmp
- %ProgramFiles(x86)%\zipgenius 6\is-7bs45.tmp
- %ProgramFiles(x86)%\zipgenius 6\is-oe9h0.tmp
- %ProgramFiles(x86)%\zipgenius 6\is-qacac.tmp
- %ProgramFiles(x86)%\zipgenius 6\is-qokh1.tmp
- %ProgramFiles(x86)%\zipgenius 6\zipgenius.exe
- %ProgramFiles(x86)%\zipgenius 6\is-ooikc.tmp
- %ProgramFiles(x86)%\zipgenius 6\lang\is-ql5ab.tmp
- %ProgramFiles(x86)%\zipgenius 6\lang\is-l1nic.tmp
- %ProgramFiles(x86)%\zipgenius 6\lang\is-0n2to.tmp
- %ProgramFiles(x86)%\zipgenius 6\lang\is-8tk6t.tmp
- %ProgramFiles(x86)%\zipgenius 6\is-41d60.tmp
- %ProgramFiles(x86)%\zipgenius 6\is-dsunk.tmp
- %ProgramFiles(x86)%\zipgenius 6\is-pg5v1.tmp
- %ProgramFiles(x86)%\zipgenius 6\is-9mvgb.tmp
- %ProgramFiles(x86)%\zipgenius 6\is-fei43.tmp
- %ProgramFiles(x86)%\zipgenius 6\unins000.dat
- %ProgramFiles(x86)%\zipgenius 6\is-4amh0.tmp
- %ProgramFiles(x86)%\zipgenius 6\is-f817k.tmp
- %ProgramFiles(x86)%\zipgenius 6\is-4lkp8.tmp
- %ProgramFiles(x86)%\zipgenius 6\is-qgp3e.tmp
- %TEMP%\is-3b7ro.tmp\_isetup\_regdll.tmp
- %TEMP%\is-3b7ro.tmp\_isetup\_setup64.tmp
- %TEMP%\is-3b7ro.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-3b7ro.tmp\_isetup\_iscrypt.dll
- %ProgramFiles(x86)%\zipgenius 6\is-ivjbd.tmp
- %ProgramFiles(x86)%\zipgenius 6\is-3rp4u.tmp
- %ProgramFiles(x86)%\zipgenius 6\is-hbrsu.tmp
- %ProgramFiles(x86)%\zipgenius 6\is-kcee4.tmp
- %ProgramFiles(x86)%\zipgenius 6\is-j1b28.tmp
- %ProgramFiles(x86)%\zipgenius 6\is-sa1u6.tmp
- %ProgramFiles(x86)%\zipgenius 6\is-dm2u6.tmp
- %ProgramFiles(x86)%\zipgenius 6\is-is5ns.tmp
- %ProgramFiles(x86)%\zipgenius 6\is-u1rp0.tmp
- %ProgramFiles(x86)%\zipgenius 6\is-1l219.tmp
- %ProgramFiles(x86)%\zipgenius 6\is-8s90j.tmp
- %ProgramFiles(x86)%\zipgenius 6\is-dejef.tmp
- %ProgramFiles(x86)%\zipgenius 6\is-jala0.tmp
- %ProgramFiles(x86)%\zipgenius 6\is-4fubt.tmp
- %ProgramFiles(x86)%\zipgenius 6\is-8t6lu.tmp
- %ProgramFiles(x86)%\zipgenius 6\is-qvvqd.tmp
- %ProgramFiles(x86)%\zipgenius 6\is-7ajbu.tmp
- %ProgramFiles(x86)%\zipgenius 6\is-3iabr.tmp
- %ProgramFiles(x86)%\zipgenius 6\is-b6fkk.tmp
- %ProgramFiles(x86)%\zipgenius 6\is-50deq.tmp
- %ProgramFiles(x86)%\zipgenius 6\is-7n9g5.tmp
- %TEMP%\ska.cab
Deletes the following files
- %ProgramFiles(x86)%\zipgenius 6\license.rtf
Moves the following files
- from %ProgramFiles(x86)%\zipgenius 6\is-ivjbd.tmp to %ProgramFiles(x86)%\zipgenius 6\unins000.exe
- from %ProgramFiles(x86)%\zipgenius 6\skins\is-72hem.tmp to %ProgramFiles(x86)%\zipgenius 6\skins\default.zsk
- from %ProgramFiles(x86)%\zipgenius 6\skins\is-279mc.tmp to %ProgramFiles(x86)%\zipgenius 6\skins\default blue.zsk
- from %ProgramFiles(x86)%\zipgenius 6\skins\is-lmgp0.tmp to %ProgramFiles(x86)%\zipgenius 6\skins\default win7.zsk
- from %ProgramFiles(x86)%\zipgenius 6\is-vs1jd.tmp to %ProgramFiles(x86)%\zipgenius 6\italiano.bin
- from %ProgramFiles(x86)%\zipgenius 6\is-dc0pl.tmp to %ProgramFiles(x86)%\zipgenius 6\clstub.bin
- from %ProgramFiles(x86)%\zipgenius 6\is-7bs45.tmp to %ProgramFiles(x86)%\zipgenius 6\english.bin
- from %ProgramFiles(x86)%\zipgenius 6\is-oe9h0.tmp to %ProgramFiles(x86)%\zipgenius 6\ffbak.bin
- from %ProgramFiles(x86)%\zipgenius 6\is-qacac.tmp to %ProgramFiles(x86)%\zipgenius 6\tbbak.bin
- from %ProgramFiles(x86)%\zipgenius 6\is-jala0.tmp to %ProgramFiles(x86)%\zipgenius 6\usrlgo.bmp
- from %ProgramFiles(x86)%\zipgenius 6\is-f817k.tmp to %ProgramFiles(x86)%\zipgenius 6\7zc.sfx
- from %ProgramFiles(x86)%\zipgenius 6\is-ooikc.tmp to %ProgramFiles(x86)%\zipgenius 6\ncz2stub.exe
- from %ProgramFiles(x86)%\zipgenius 6\lang\is-ql5ab.tmp to %ProgramFiles(x86)%\zipgenius 6\lang\eng.dll
- from %ProgramFiles(x86)%\zipgenius 6\lang\is-l1nic.tmp to %ProgramFiles(x86)%\zipgenius 6\lang\en_shell.lng
- from %ProgramFiles(x86)%\zipgenius 6\lang\is-0n2to.tmp to %ProgramFiles(x86)%\zipgenius 6\lang\ita.dll
- from %ProgramFiles(x86)%\zipgenius 6\lang\is-8tk6t.tmp to %ProgramFiles(x86)%\zipgenius 6\lang\it_shell.lng
- from %ProgramFiles(x86)%\zipgenius 6\is-41d60.tmp to %ProgramFiles(x86)%\zipgenius 6\add_path.exe
- from %ProgramFiles(x86)%\zipgenius 6\is-dsunk.tmp to %ProgramFiles(x86)%\zipgenius 6\7z.dll
- from %ProgramFiles(x86)%\zipgenius 6\is-pg5v1.tmp to %ProgramFiles(x86)%\zipgenius 6\turbosearch.exe
- from %ProgramFiles(x86)%\zipgenius 6\skins\is-fhbck.tmp to %ProgramFiles(x86)%\zipgenius 6\skins\default_w2k.zt6
- from %ProgramFiles(x86)%\zipgenius 6\skins\is-dis6j.tmp to %ProgramFiles(x86)%\zipgenius 6\skins\windows 7 default.zt6
- from %ProgramFiles(x86)%\zipgenius 6\skins\is-4olqs.tmp to %ProgramFiles(x86)%\zipgenius 6\skins\default.zt6
- from %ProgramFiles(x86)%\zipgenius 6\is-4amh0.tmp to %ProgramFiles(x86)%\zipgenius 6\yz1.dll
- from %ProgramFiles(x86)%\zipgenius 6\is-4lkp8.tmp to %ProgramFiles(x86)%\zipgenius 6\sqx.dll
- from %ProgramFiles(x86)%\zipgenius 6\is-hbrsu.tmp to %ProgramFiles(x86)%\zipgenius 6\profcheck.exe
- from %ProgramFiles(x86)%\zipgenius 6\is-kcee4.tmp to %ProgramFiles(x86)%\zipgenius 6\s_setup.exe
- from %ProgramFiles(x86)%\zipgenius 6\is-j1b28.tmp to %ProgramFiles(x86)%\zipgenius 6\msend.exe
- from %ProgramFiles(x86)%\zipgenius 6\is-sa1u6.tmp to %ProgramFiles(x86)%\zipgenius 6\tips.ini
- from %ProgramFiles(x86)%\zipgenius 6\is-dm2u6.tmp to %ProgramFiles(x86)%\zipgenius 6\readme.txt
- from %ProgramFiles(x86)%\zipgenius 6\is-qgp3e.tmp to %ProgramFiles(x86)%\zipgenius 6\license.rtf
- from %ProgramFiles(x86)%\zipgenius 6\is-1l219.tmp to %ProgramFiles(x86)%\zipgenius 6\zgres.dll
- from %ProgramFiles(x86)%\zipgenius 6\is-8s90j.tmp to %ProgramFiles(x86)%\zipgenius 6\notify.wav
- from %ProgramFiles(x86)%\zipgenius 6\is-9mvgb.tmp to %ProgramFiles(x86)%\zipgenius 6\zipgenius.exe
- from %ProgramFiles(x86)%\zipgenius 6\is-qokh1.tmp to %ProgramFiles(x86)%\zipgenius 6\cz2stub.exe
- from %ProgramFiles(x86)%\zipgenius 6\is-dejef.tmp to %ProgramFiles(x86)%\zipgenius 6\7za.exe
- from %ProgramFiles(x86)%\zipgenius 6\is-8t6lu.tmp to %ProgramFiles(x86)%\zipgenius 6\unrar.dll
- from %ProgramFiles(x86)%\zipgenius 6\is-qvvqd.tmp to %ProgramFiles(x86)%\zipgenius 6\unacev2.dll
- from %ProgramFiles(x86)%\zipgenius 6\is-7ajbu.tmp to %ProgramFiles(x86)%\zipgenius 6\unarj32j.dll
- from %ProgramFiles(x86)%\zipgenius 6\is-3iabr.tmp to %ProgramFiles(x86)%\zipgenius 6\unlha32.dll
- from %ProgramFiles(x86)%\zipgenius 6\is-b6fkk.tmp to %ProgramFiles(x86)%\zipgenius 6\cab32.dll
- from %ProgramFiles(x86)%\zipgenius 6\is-50deq.tmp to %ProgramFiles(x86)%\zipgenius 6\bz2lib.dll
- from %ProgramFiles(x86)%\zipgenius 6\is-u1rp0.tmp to %ProgramFiles(x86)%\zipgenius 6\tar32.dll
- from %ProgramFiles(x86)%\zipgenius 6\is-7n9g5.tmp to %ProgramFiles(x86)%\zipgenius 6\7-zip32.dll
- from %ProgramFiles(x86)%\zipgenius 6\is-3rp4u.tmp to %ProgramFiles(x86)%\zipgenius 6\zgsetupfileass.exe
- from %ProgramFiles(x86)%\zipgenius 6\is-4fubt.tmp to %ProgramFiles(x86)%\zipgenius 6\zipgenius.ini
- from %ProgramFiles(x86)%\zipgenius 6\is-fei43.tmp to %ProgramFiles(x86)%\zipgenius 6\sqlite3.dll
Substitutes the following files
- %ProgramFiles(x86)%\zipgenius 6\license.rtf
Network activity
TCP
HTTP GET requests
- http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?eb##############
UDP
- DNS ASK pe###igold.xyz
Miscellaneous
Searches for the following windows
- ClassName: 'WindowsName' WindowName: ''
Creates and executes the following
- '%TEMP%\is-1hur6.tmp\is-sb19q.tmp' /SL4 $B00A2 "<Full path to file>" 9345726 78336
- '%ProgramFiles(x86)%\zipgenius 6\zipgenius.exe'
- '%ProgramFiles(x86)%\zipgenius 6\zipgenius.exe' d06cd1f3cc5a57e05e8e1a605b0a19b4
Executes the following
- '%WINDIR%\syswow64\schtasks.exe' /Query
