Technical Information
Malicious functions
Installs hooks to intercept notifications
on window messages:
- Handler for all processes: %TEMP%\CSM4C6A.tmp
Modifies file system
Creates the following files
- %TEMP%\is-l18j9.tmp\<File name>.tmp
- %TEMP%\is-tn75i.tmp\_isetup\_regdll.tmp
- %TEMP%\is-tn75i.tmp\_isetup\_setup64.tmp
- %TEMP%\is-tn75i.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-tn75i.tmp\rkinstaller.exe
- %TEMP%\is-tn75i.tmp\rkverify.exe
- %TEMP%\is-tn75i.tmp\license_comscore.rtf
- %TEMP%\csm4c6a.tmp
- %TEMP%\is-tn75i.tmp\rk-trees-banner-rev.bmp
Miscellaneous
Creates and executes the following
- '%TEMP%\is-l18j9.tmp\<File name>.tmp' /SL5="$90196,2280988,53248,<Full path to file>"
- '%TEMP%\is-tn75i.tmp\rkverify.exe'
- '%TEMP%\is-tn75i.tmp\rkverify.exe' ' (with hidden window)
