Technical Information
Modifies file system
Creates the following files
- %TEMP%\is-pdvu64ecns.tmp\<File name>.tmp
- %TEMP%\is-gavkh04o9y.tmp\_isetup\_setup64.tmp
- C:\programlog\windows\csdemo\is-f4jtabetfn.tmp
- C:\programlog\windows\appdata\local\microsoft\log\is-mp9ta735k3.tmp
- C:\programlog\windows\appdata\local\microsoft\log\is-cww2uebulp.tmp
- C:\programlog\windows\appdata\local\microsoft\log\is-c35s8yhk02.tmp
- C:\programlog\windows\appdata\local\microsoft\log\is-6yci1vvw7y.tmp
- C:\programlog\windows\appdata\local\microsoft\log\is-zr9i3nh7ha.tmp
- C:\programlog\windows\appdata\local\microsoft\log\is-9drxnps8hj.tmp
- C:\programlog\windows\appdata\local\microsoft\log\is-nf07iqtbv8.tmp
- C:\programlog\windows\appdata\local\microsoft\log\is-m0619mob6i.tmp
- C:\programlog\windows\appdata\local\microsoft\log\is-jfvkdu3dtx.tmp
- C:\programlog\windows\appdata\local\microsoft\log\is-02x0dlfjpa.tmp
- C:\programlog\windows\appdata\local\microsoft\log\is-pmogmq9itj.tmp
- C:\programlog\windows\appdata\local\microsoft\log\is-90pugm8179.tmp
- %APPDATA%\microsoft\windows\start menu\programs\(default)\卸载.lnk
- C:\programlog\windows\csdemo\unins000.dat
Deletes following files that it created itself
- %TEMP%\is-gavkh04o9y.tmp\_isetup\_setup64.tmp
- %TEMP%\is-pdvu64ecns.tmp\<File name>.tmp
Moves the following files
- from C:\programlog\windows\csdemo\is-f4jtabetfn.tmp to C:\programlog\windows\csdemo\unins000.exe
- from C:\programlog\windows\appdata\local\microsoft\log\is-mp9ta735k3.tmp to C:\programlog\windows\appdata\local\microsoft\log\tgfile.exe
- from C:\programlog\windows\appdata\local\microsoft\log\is-cww2uebulp.tmp to C:\programlog\windows\appdata\local\microsoft\log\setting.lua
- from C:\programlog\windows\appdata\local\microsoft\log\is-c35s8yhk02.tmp to C:\programlog\windows\appdata\local\microsoft\log\libepsbase.dll
- from C:\programlog\windows\appdata\local\microsoft\log\is-6yci1vvw7y.tmp to C:\programlog\windows\appdata\local\microsoft\log\lua51.dll
- from C:\programlog\windows\appdata\local\microsoft\log\is-zr9i3nh7ha.tmp to C:\programlog\windows\appdata\local\microsoft\log\msvcr100.dll
- from C:\programlog\windows\appdata\local\microsoft\log\is-9drxnps8hj.tmp to C:\programlog\windows\appdata\local\microsoft\log\log.s
- from C:\programlog\windows\appdata\local\microsoft\log\is-nf07iqtbv8.tmp to C:\programlog\windows\appdata\local\microsoft\log\vcruntime140.dll
- from C:\programlog\windows\appdata\local\microsoft\log\is-m0619mob6i.tmp to C:\programlog\windows\appdata\local\microsoft\log\auto_update.exe
- from C:\programlog\windows\appdata\local\microsoft\log\is-jfvkdu3dtx.tmp to C:\programlog\windows\appdata\local\microsoft\log\gameoverlayui.exe
- from C:\programlog\windows\appdata\local\microsoft\log\is-02x0dlfjpa.tmp to C:\programlog\windows\appdata\local\microsoft\log\vcruntime.dll
- from C:\programlog\windows\appdata\local\microsoft\log\is-pmogmq9itj.tmp to C:\programlog\windows\appdata\local\microsoft\log\ksolaunch.exe
- from C:\programlog\windows\appdata\local\microsoft\log\is-90pugm8179.tmp to C:\programlog\windows\appdata\local\microsoft\log\msoobeplugins.dll
Network activity
Connects to
- '23.##8.202.170':6667
TCP
Other
- '23.##8.202.170':6667
Miscellaneous
Creates and executes the following
- '%TEMP%\is-pdvu64ecns.tmp\<File name>.tmp' /SL5="$F02E2,2878560,893952,<Full path to file>"
- 'C:\programlog\windows\appdata\local\microsoft\log\ksolaunch.exe'
- 'C:\programlog\windows\appdata\local\microsoft\log\auto_update.exe'
- 'C:\programlog\windows\appdata\local\microsoft\log\tgfile.exe'
- 'C:\programlog\windows\appdata\local\microsoft\log\tgfile.exe' "C:\ProgramLog\Windows\AppData\Local\Microsoft\Log\Setting.lua"
Executes the following
- 'C:\programlog\windows\appdata\local\microsoft\log\tgfile.exe' ' (with hidden window)
- 'C:\programlog\windows\appdata\local\microsoft\log\tgfile.exe' "C:\ProgramLog\Windows\AppData\Local\Microsoft\Log\Setting.lua"' (with hidden window)
