Technical Information
Modifies file system
Creates the following files
- %TEMP%\is-qn7r7.tmp\<File name>.tmp
- %ProgramFiles(x86)%\ortam mp3\is-002b8.tmp
- %ProgramFiles(x86)%\ortam mp3\is-26v8d.tmp
- %ProgramFiles(x86)%\ortam mp3\is-usa3e.tmp
- %ProgramFiles(x86)%\ortam mp3\is-tmbos.tmp
- %ProgramFiles(x86)%\ortam mp3\is-2rlba.tmp
- %ProgramFiles(x86)%\ortam mp3\is-gkjbn.tmp
- %ProgramFiles(x86)%\ortam mp3\is-saepo.tmp
- %ProgramFiles(x86)%\ortam mp3\is-502df.tmp
- %ProgramFiles(x86)%\ortam mp3\is-flo32.tmp
- %ProgramFiles(x86)%\ortam mp3\is-bs6n6.tmp
- %ProgramFiles(x86)%\ortam mp3\is-a5mrd.tmp
- %ProgramFiles(x86)%\ortam mp3\is-ifgmo.tmp
- %ProgramFiles(x86)%\ortam mp3\is-3i7um.tmp
- %ProgramFiles(x86)%\ortam mp3\is-7vi2i.tmp
- %ProgramFiles(x86)%\ortam mp3\unins000.dat
- %ProgramFiles(x86)%\ortam mp3\is-5f122.tmp
- %ProgramFiles(x86)%\ortam mp3\is-n1cg6.tmp
- %ProgramFiles(x86)%\ortam mp3\is-vp2pf.tmp
- %ProgramFiles(x86)%\ortam mp3\is-lu9v8.tmp
- %ProgramFiles(x86)%\ortam mp3\is-kfkm2.tmp
- %TEMP%\is-qs7ji.tmp\_isetup\_setup64.tmp
- %TEMP%\is-qs7ji.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-qs7ji.tmp\_isetup\_isdecmp.dll
- %TEMP%\is-qs7ji.tmp\_isetup\_iscrypt.dll
- %ProgramFiles(x86)%\ortam mp3\is-t6c2f.tmp
- %ProgramFiles(x86)%\ortam mp3\is-nmmo8.tmp
- %ProgramFiles(x86)%\ortam mp3\is-qfptg.tmp
- %TEMP%\is-qs7ji.tmp\_isetup\_regdll.tmp
- %ProgramFiles(x86)%\ortam mp3\is-9imgu.tmp
- %ProgramFiles(x86)%\ortam mp3\plugins\is-n6g4g.tmp
- %ProgramFiles(x86)%\ortam mp3\plugins\is-dkjto.tmp
- %ProgramFiles(x86)%\ortam mp3\plugins\is-3r018.tmp
- %ProgramFiles(x86)%\ortam mp3\plugins\is-372cu.tmp
- %ProgramFiles(x86)%\ortam mp3\images\is-m2jaj.tmp
- %ProgramFiles(x86)%\ortam mp3\images\is-uj9f5.tmp
- %ProgramFiles(x86)%\ortam mp3\images\is-i27n9.tmp
- %ProgramFiles(x86)%\ortam mp3\plugins\is-ktdga.tmp
- %ProgramFiles(x86)%\ortam mp3\zmmspro10193.exe
- %TEMP%\license.txt
Moves the following files
- from %ProgramFiles(x86)%\ortam mp3\is-t6c2f.tmp to %ProgramFiles(x86)%\ortam mp3\unins000.exe
- from %ProgramFiles(x86)%\ortam mp3\is-ifgmo.tmp to %ProgramFiles(x86)%\ortam mp3\msvcr100.dll
- from %ProgramFiles(x86)%\ortam mp3\is-a5mrd.tmp to %ProgramFiles(x86)%\ortam mp3\d3dx9_43.dll
- from %ProgramFiles(x86)%\ortam mp3\is-bs6n6.tmp to %ProgramFiles(x86)%\ortam mp3\redx.gif
- from %ProgramFiles(x86)%\ortam mp3\is-n1cg6.tmp to %ProgramFiles(x86)%\ortam mp3\greenok.gif
- from %ProgramFiles(x86)%\ortam mp3\is-5f122.tmp to %ProgramFiles(x86)%\ortam mp3\armaccess.dll
- from %ProgramFiles(x86)%\ortam mp3\is-flo32.tmp to %ProgramFiles(x86)%\ortam mp3\akrip32.dll
- from %ProgramFiles(x86)%\ortam mp3\is-gkjbn.tmp to %ProgramFiles(x86)%\ortam mp3\wnaspi32.dll
- from %ProgramFiles(x86)%\ortam mp3\is-2rlba.tmp to %ProgramFiles(x86)%\ortam mp3\curl.exe
- from %ProgramFiles(x86)%\ortam mp3\is-tmbos.tmp to %ProgramFiles(x86)%\ortam mp3\soundstretch.exe
- from %ProgramFiles(x86)%\ortam mp3\is-usa3e.tmp to %ProgramFiles(x86)%\ortam mp3\mp3gain.exe
- from %ProgramFiles(x86)%\ortam mp3\is-26v8d.tmp to %ProgramFiles(x86)%\ortam mp3\lame_enc.dll
- from %ProgramFiles(x86)%\ortam mp3\is-002b8.tmp to %ProgramFiles(x86)%\ortam mp3\lame.exe
- from %ProgramFiles(x86)%\ortam mp3\is-502df.tmp to %ProgramFiles(x86)%\ortam mp3\discid.dll
- from %ProgramFiles(x86)%\ortam mp3\is-3i7um.tmp to %ProgramFiles(x86)%\ortam mp3\msvcp100.dll
- from %ProgramFiles(x86)%\ortam mp3\is-saepo.tmp to %ProgramFiles(x86)%\ortam mp3\discid.exe
- from %ProgramFiles(x86)%\ortam mp3\is-lu9v8.tmp to %ProgramFiles(x86)%\ortam mp3\its.txt
- from %ProgramFiles(x86)%\ortam mp3\is-kfkm2.tmp to %ProgramFiles(x86)%\ortam mp3\mms.ico
- from %ProgramFiles(x86)%\ortam mp3\images\is-i27n9.tmp to %ProgramFiles(x86)%\ortam mp3\images\5.jpg
- from %ProgramFiles(x86)%\ortam mp3\images\is-uj9f5.tmp to %ProgramFiles(x86)%\ortam mp3\images\3.jpg
- from %ProgramFiles(x86)%\ortam mp3\images\is-m2jaj.tmp to %ProgramFiles(x86)%\ortam mp3\images\2.jpg
- from %ProgramFiles(x86)%\ortam mp3\plugins\is-372cu.tmp to %ProgramFiles(x86)%\ortam mp3\plugins\syntheticone.dll
- from %ProgramFiles(x86)%\ortam mp3\plugins\is-3r018.tmp to %ProgramFiles(x86)%\ortam mp3\plugins\rawcolor.dll
- from %ProgramFiles(x86)%\ortam mp3\plugins\is-dkjto.tmp to %ProgramFiles(x86)%\ortam mp3\plugins\defvis.dll
- from %ProgramFiles(x86)%\ortam mp3\plugins\is-n6g4g.tmp to %ProgramFiles(x86)%\ortam mp3\plugins\dancingfigures.dll
- from %ProgramFiles(x86)%\ortam mp3\plugins\is-ktdga.tmp to %ProgramFiles(x86)%\ortam mp3\plugins\colorflow.dll
- from %ProgramFiles(x86)%\ortam mp3\is-9imgu.tmp to %ProgramFiles(x86)%\ortam mp3\id3lib.dll
- from %ProgramFiles(x86)%\ortam mp3\is-qfptg.tmp to %ProgramFiles(x86)%\ortam mp3\zplayer.exe
- from %ProgramFiles(x86)%\ortam mp3\is-nmmo8.tmp to %ProgramFiles(x86)%\ortam mp3\tag.dll
- from %ProgramFiles(x86)%\ortam mp3\is-vp2pf.tmp to %ProgramFiles(x86)%\ortam mp3\mp3ctrl.dll
- from %ProgramFiles(x86)%\ortam mp3\is-7vi2i.tmp to %ProgramFiles(x86)%\ortam mp3\zmmspro10193.exe
Network activity
Connects to
- 'mi####njobs.works':80
TCP
HTTP GET requests
- http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?43######
HTTP POST requests
- http://mi####njobs.works/new/net_api
UDP
- DNS ASK mi####njobs.works
Miscellaneous
Searches for the following windows
- ClassName: 'Pf929_iTesk1018Class_Pf929' WindowName: ''
Creates and executes the following
- '%TEMP%\is-qn7r7.tmp\<File name>.tmp' /SL5="$90248,7646826,55808,<Full path to file>"
- '%ProgramFiles(x86)%\ortam mp3\zmmspro10193.exe'
- '%ProgramFiles(x86)%\ortam mp3\zmmspro10193.exe' 64fcd45325e9a071fdb4900f9b547c70
Executes the following
- '%WINDIR%\syswow64\schtasks.exe' /Delete /F /TN "ZMM1019-3"
- '%WINDIR%\syswow64\schtasks.exe' /Query
