Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\intelsoftwareupdaterv4
Modifies file system
Creates the following files
- %TEMP%\is-5osiios56f.tmp\<File name>.tmp
- %TEMP%\is-sxvola7ale.tmp\_isetup\_setup64.tmp
- %LOCALAPPDATA%\microsoft\windowsapps\microsoft.pythonapp_nj7xx9mo20t2i\is-apkxij6a8e.tmp
- %LOCALAPPDATA%\microsoft\windowsapps\microsoft.pythonapp_nj7xx9mo20t2i\is-l96rtsxshr.tmp
- %LOCALAPPDATA%\microsoft\windowsapps\microsoft.pythonapp_nj7xx9mo20t2i\is-iu2kmz27zi.tmp
- %LOCALAPPDATA%\microsoft\windowsapps\microsoft.pythonapp_nj7xx9mo20t2i\is-h01e0xpjqi.tmp
- %LOCALAPPDATA%\microsoft\windowsapps\microsoft.pythonapp_nj7xx9mo20t2i\is-9rx7bvw18u.tmp
- %LOCALAPPDATA%\microsoft\windowsapps\microsoft.pythonapp_nj7xx9mo20t2i\is-qlxccfg6b5.tmp
- %LOCALAPPDATA%\microsoft\windowsapps\microsoft.pythonapp_nj7xx9mo20t2i\is-dh3f9fan3g.tmp
- %LOCALAPPDATA%\microsoft\windowsapps\microsoft.pythonapp_nj7xx9mo20t2i\is-x3w0d6aho0.tmp
- %LOCALAPPDATA%\microsoft\windowsapps\microsoft.pythonapp_nj7xx9mo20t2i\is-fekuii8o23.tmp
- %LOCALAPPDATA%\microsoft\windowsapps\microsoft.pythonapp_nj7xx9mo20t2i\is-oz2drmwpur.tmp
- %LOCALAPPDATA%\microsoft\windowsapps\microsoft.pythonapp_nj7xx9mo20t2i\is-382wk64x8c.tmp
- %LOCALAPPDATA%\microsoft\windowsapps\microsoft.pythonapp_nj7xx9mo20t2i\is-c0la7zi30q.tmp
- %LOCALAPPDATA%\microsoft\windowsapps\microsoft.pythonapp_nj7xx9mo20t2i\is-g9ni6fsysz.tmp
- %LOCALAPPDATA%\microsoft\windowsapps\microsoft.pythonapp_nj7xx9mo20t2i\is-xkxmyhu2uh.tmp
- %LOCALAPPDATA%\microsoft\windowsapps\microsoft.pythonapp_nj7xx9mo20t2i\is-mnt54dpueo.tmp
- %LOCALAPPDATA%\microsoft\windowsapps\microsoft.pythonapp_nj7xx9mo20t2i\is-4n717h848d.tmp
- %LOCALAPPDATA%\microsoft\windowsapps\microsoft.pythonapp_nj7xx9mo20t2i\is-5qiws56um0.tmp
- %LOCALAPPDATA%\microsoft\windowsapps\microsoft.pythonapp_nj7xx9mo20t2i\is-onbdx0k294.tmp
- %LOCALAPPDATA%\microsoft\windowsapps\microsoft.pythonapp_nj7xx9mo20t2i\is-nzvx66ld1v.tmp
- %LOCALAPPDATA%\microsoft\windowsapps\microsoft.pythonapp_nj7xx9mo20t2i\is-h8h101uobf.tmp
- %LOCALAPPDATA%\microsoft\windowsapps\microsoft.pythonapp_nj7xx9mo20t2i\is-puzojuin1v.tmp
- %LOCALAPPDATA%\microsoft\windowsapps\microsoft.pythonapp_nj7xx9mo20t2i\is-mandqwj4dj.tmp
- %LOCALAPPDATA%\microsoft\windowsapps\microsoft.pythonapp_nj7xx9mo20t2i\is-nisfllznp4.tmp
- %LOCALAPPDATA%\microsoft\windowsapps\microsoft.pythonapp_nj7xx9mo20t2i\is-y1x958j6ck.tmp
- %LOCALAPPDATA%\microsoft\windowsapps\microsoft.pythonapp_nj7xx9mo20t2i\is-2sj6fpo7rp.tmp
- %LOCALAPPDATA%\microsoft\windowsapps\microsoft.pythonapp_nj7xx9mo20t2i\is-ehq4aqvuyh.tmp
- %LOCALAPPDATA%\microsoft\windowsapps\microsoft.pythonapp_nj7xx9mo20t2i\is-a5nlfaygma.tmp
- %LOCALAPPDATA%\microsoft\windowsapps\microsoft.pythonapp_nj7xx9mo20t2i\is-tmvilctc5j.tmp
- %LOCALAPPDATA%\microsoft\windowsapps\microsoft.pythonapp_nj7xx9mo20t2i\is-g31kqgrk87.tmp
- %LOCALAPPDATA%\microsoft\windowsapps\microsoft.pythonapp_nj7xx9mo20t2i\is-d6r4vzbcmb.tmp
- %LOCALAPPDATA%\microsoft\windowsapps\microsoft.pythonapp_nj7xx9mo20t2i\is-dmmu0aej16.tmp
- %LOCALAPPDATA%\microsoft\windowsapps\microsoft.pythonapp_nj7xx9mo20t2i\is-w4g7negtw1.tmp
- %LOCALAPPDATA%\microsoft\windowsapps\microsoft.pythonapp_nj7xx9mo20t2i\is-ibv4w7bpan.tmp
- %LOCALAPPDATA%\microsoft\windowsapps\microsoft.pythonapp_nj7xx9mo20t2i\is-evvh52lx6c.tmp
- %LOCALAPPDATA%\microsoft\windowsapps\microsoft.pythonapp_nj7xx9mo20t2i\is-ym9ph67awq.tmp
- %TEMP%\pypxrq82
- %TEMP%\t.xml
Deletes following files that it created itself
- %TEMP%\is-sxvola7ale.tmp\_isetup\_setup64.tmp
- %TEMP%\is-5osiios56f.tmp\<File name>.tmp
- %TEMP%\pypxrq82
- %TEMP%\t.xml
Moves the following files
- from %LOCALAPPDATA%\microsoft\windowsapps\microsoft.pythonapp_nj7xx9mo20t2i\is-apkxij6a8e.tmp to %LOCALAPPDATA%\microsoft\windowsapps\microsoft.pythonapp_nj7xx9mo20t2i\libcrypto-3.dll
- from %LOCALAPPDATA%\microsoft\windowsapps\microsoft.pythonapp_nj7xx9mo20t2i\is-l96rtsxshr.tmp to %LOCALAPPDATA%\microsoft\windowsapps\microsoft.pythonapp_nj7xx9mo20t2i\libffi-8.dll
- from %LOCALAPPDATA%\microsoft\windowsapps\microsoft.pythonapp_nj7xx9mo20t2i\is-iu2kmz27zi.tmp to %LOCALAPPDATA%\microsoft\windowsapps\microsoft.pythonapp_nj7xx9mo20t2i\libssl-3.dll
- from %LOCALAPPDATA%\microsoft\windowsapps\microsoft.pythonapp_nj7xx9mo20t2i\is-h01e0xpjqi.tmp to %LOCALAPPDATA%\microsoft\windowsapps\microsoft.pythonapp_nj7xx9mo20t2i\license.txt
- from %LOCALAPPDATA%\microsoft\windowsapps\microsoft.pythonapp_nj7xx9mo20t2i\is-9rx7bvw18u.tmp to %LOCALAPPDATA%\microsoft\windowsapps\microsoft.pythonapp_nj7xx9mo20t2i\pyexpat.pyd
- from %LOCALAPPDATA%\microsoft\windowsapps\microsoft.pythonapp_nj7xx9mo20t2i\is-qlxccfg6b5.tmp to %LOCALAPPDATA%\microsoft\windowsapps\microsoft.pythonapp_nj7xx9mo20t2i\python.cat
- from %LOCALAPPDATA%\microsoft\windowsapps\microsoft.pythonapp_nj7xx9mo20t2i\is-dh3f9fan3g.tmp to %LOCALAPPDATA%\microsoft\windowsapps\microsoft.pythonapp_nj7xx9mo20t2i\python.exe
- from %LOCALAPPDATA%\microsoft\windowsapps\microsoft.pythonapp_nj7xx9mo20t2i\is-x3w0d6aho0.tmp to %LOCALAPPDATA%\microsoft\windowsapps\microsoft.pythonapp_nj7xx9mo20t2i\python3.dll
- from %LOCALAPPDATA%\microsoft\windowsapps\microsoft.pythonapp_nj7xx9mo20t2i\is-fekuii8o23.tmp to %LOCALAPPDATA%\microsoft\windowsapps\microsoft.pythonapp_nj7xx9mo20t2i\python311.dll
- from %LOCALAPPDATA%\microsoft\windowsapps\microsoft.pythonapp_nj7xx9mo20t2i\is-oz2drmwpur.tmp to %LOCALAPPDATA%\microsoft\windowsapps\microsoft.pythonapp_nj7xx9mo20t2i\python311.zip
- from %LOCALAPPDATA%\microsoft\windowsapps\microsoft.pythonapp_nj7xx9mo20t2i\is-382wk64x8c.tmp to %LOCALAPPDATA%\microsoft\windowsapps\microsoft.pythonapp_nj7xx9mo20t2i\python311._pth
- from %LOCALAPPDATA%\microsoft\windowsapps\microsoft.pythonapp_nj7xx9mo20t2i\is-c0la7zi30q.tmp to %LOCALAPPDATA%\microsoft\windowsapps\microsoft.pythonapp_nj7xx9mo20t2i\pythonw.exe
- from %LOCALAPPDATA%\microsoft\windowsapps\microsoft.pythonapp_nj7xx9mo20t2i\is-g9ni6fsysz.tmp to %LOCALAPPDATA%\microsoft\windowsapps\microsoft.pythonapp_nj7xx9mo20t2i\run.pyw
- from %LOCALAPPDATA%\microsoft\windowsapps\microsoft.pythonapp_nj7xx9mo20t2i\is-xkxmyhu2uh.tmp to %LOCALAPPDATA%\microsoft\windowsapps\microsoft.pythonapp_nj7xx9mo20t2i\select.pyd
- from %LOCALAPPDATA%\microsoft\windowsapps\microsoft.pythonapp_nj7xx9mo20t2i\is-mnt54dpueo.tmp to %LOCALAPPDATA%\microsoft\windowsapps\microsoft.pythonapp_nj7xx9mo20t2i\sqlite3.dll
- from %LOCALAPPDATA%\microsoft\windowsapps\microsoft.pythonapp_nj7xx9mo20t2i\is-4n717h848d.tmp to %LOCALAPPDATA%\microsoft\windowsapps\microsoft.pythonapp_nj7xx9mo20t2i\unicodedata.pyd
- from %LOCALAPPDATA%\microsoft\windowsapps\microsoft.pythonapp_nj7xx9mo20t2i\is-5qiws56um0.tmp to %LOCALAPPDATA%\microsoft\windowsapps\microsoft.pythonapp_nj7xx9mo20t2i\vcruntime140.dll
- from %LOCALAPPDATA%\microsoft\windowsapps\microsoft.pythonapp_nj7xx9mo20t2i\is-onbdx0k294.tmp to %LOCALAPPDATA%\microsoft\windowsapps\microsoft.pythonapp_nj7xx9mo20t2i\vcruntime140_1.dll
- from %LOCALAPPDATA%\microsoft\windowsapps\microsoft.pythonapp_nj7xx9mo20t2i\is-nzvx66ld1v.tmp to %LOCALAPPDATA%\microsoft\windowsapps\microsoft.pythonapp_nj7xx9mo20t2i\winsound.pyd
- from %LOCALAPPDATA%\microsoft\windowsapps\microsoft.pythonapp_nj7xx9mo20t2i\is-h8h101uobf.tmp to %LOCALAPPDATA%\microsoft\windowsapps\microsoft.pythonapp_nj7xx9mo20t2i\_asyncio.pyd
- from %LOCALAPPDATA%\microsoft\windowsapps\microsoft.pythonapp_nj7xx9mo20t2i\is-puzojuin1v.tmp to %LOCALAPPDATA%\microsoft\windowsapps\microsoft.pythonapp_nj7xx9mo20t2i\_bz2.pyd
- from %LOCALAPPDATA%\microsoft\windowsapps\microsoft.pythonapp_nj7xx9mo20t2i\is-mandqwj4dj.tmp to %LOCALAPPDATA%\microsoft\windowsapps\microsoft.pythonapp_nj7xx9mo20t2i\_ctypes.pyd
- from %LOCALAPPDATA%\microsoft\windowsapps\microsoft.pythonapp_nj7xx9mo20t2i\is-nisfllznp4.tmp to %LOCALAPPDATA%\microsoft\windowsapps\microsoft.pythonapp_nj7xx9mo20t2i\_decimal.pyd
- from %LOCALAPPDATA%\microsoft\windowsapps\microsoft.pythonapp_nj7xx9mo20t2i\is-y1x958j6ck.tmp to %LOCALAPPDATA%\microsoft\windowsapps\microsoft.pythonapp_nj7xx9mo20t2i\_elementtree.pyd
- from %LOCALAPPDATA%\microsoft\windowsapps\microsoft.pythonapp_nj7xx9mo20t2i\is-2sj6fpo7rp.tmp to %LOCALAPPDATA%\microsoft\windowsapps\microsoft.pythonapp_nj7xx9mo20t2i\_hashlib.pyd
- from %LOCALAPPDATA%\microsoft\windowsapps\microsoft.pythonapp_nj7xx9mo20t2i\is-ehq4aqvuyh.tmp to %LOCALAPPDATA%\microsoft\windowsapps\microsoft.pythonapp_nj7xx9mo20t2i\_lzma.pyd
- from %LOCALAPPDATA%\microsoft\windowsapps\microsoft.pythonapp_nj7xx9mo20t2i\is-a5nlfaygma.tmp to %LOCALAPPDATA%\microsoft\windowsapps\microsoft.pythonapp_nj7xx9mo20t2i\_msi.pyd
- from %LOCALAPPDATA%\microsoft\windowsapps\microsoft.pythonapp_nj7xx9mo20t2i\is-tmvilctc5j.tmp to %LOCALAPPDATA%\microsoft\windowsapps\microsoft.pythonapp_nj7xx9mo20t2i\_multiprocessing.pyd
- from %LOCALAPPDATA%\microsoft\windowsapps\microsoft.pythonapp_nj7xx9mo20t2i\is-g31kqgrk87.tmp to %LOCALAPPDATA%\microsoft\windowsapps\microsoft.pythonapp_nj7xx9mo20t2i\_overlapped.pyd
- from %LOCALAPPDATA%\microsoft\windowsapps\microsoft.pythonapp_nj7xx9mo20t2i\is-d6r4vzbcmb.tmp to %LOCALAPPDATA%\microsoft\windowsapps\microsoft.pythonapp_nj7xx9mo20t2i\_queue.pyd
- from %LOCALAPPDATA%\microsoft\windowsapps\microsoft.pythonapp_nj7xx9mo20t2i\is-dmmu0aej16.tmp to %LOCALAPPDATA%\microsoft\windowsapps\microsoft.pythonapp_nj7xx9mo20t2i\_socket.pyd
- from %LOCALAPPDATA%\microsoft\windowsapps\microsoft.pythonapp_nj7xx9mo20t2i\is-w4g7negtw1.tmp to %LOCALAPPDATA%\microsoft\windowsapps\microsoft.pythonapp_nj7xx9mo20t2i\_sqlite3.pyd
- from %LOCALAPPDATA%\microsoft\windowsapps\microsoft.pythonapp_nj7xx9mo20t2i\is-ibv4w7bpan.tmp to %LOCALAPPDATA%\microsoft\windowsapps\microsoft.pythonapp_nj7xx9mo20t2i\_ssl.pyd
- from %LOCALAPPDATA%\microsoft\windowsapps\microsoft.pythonapp_nj7xx9mo20t2i\is-evvh52lx6c.tmp to %LOCALAPPDATA%\microsoft\windowsapps\microsoft.pythonapp_nj7xx9mo20t2i\_uuid.pyd
- from %LOCALAPPDATA%\microsoft\windowsapps\microsoft.pythonapp_nj7xx9mo20t2i\is-ym9ph67awq.tmp to %LOCALAPPDATA%\microsoft\windowsapps\microsoft.pythonapp_nj7xx9mo20t2i\_zoneinfo.pyd
Network activity
Connects to
- 'et#.###.onfinality.io':443
- 'et#######et.public.blastapi.io':443
- 'et#.#erkle.io':443
- 'ga####y.tenderly.co':443
- 'rp#.##h.gateway.fm':443
- 'et######-rpc.publicnode.com':443
- 'et#.#rpc.org':443
- 'et#.##amarpc.com':443
- 'rp#.#entio.xyz':443
- 'rp#.#epolia.org':443
- 'et########epolia-rpc.publicnode.com':443
- 'se####a.drpc.org':443
- 'rp##.#epolia.org':443
- 'et#######ia.public.blastapi.io':443
- 'po####n.drpc.org':443
- 'po#####.blockpi.network':443
- 'po########innet.public.blastapi.io':443
- 'po####n.meowrpc.com':443
- 'po#######or-rpc.publicnode.com':443
- 'po###on-rpc.com':443
- '1r#c.io':443
TCP
Other
- 'et#.###.onfinality.io':443
- 'et#######et.public.blastapi.io':443
- 'ga####y.tenderly.co':443
- 'rp#.##h.gateway.fm':443
- 'et#.##amarpc.com':443
- 'rp#.#epolia.org':443
- 'po###on-rpc.com':443
- '1r#c.io':443
UDP
- DNS ASK et#.###.onfinality.io
- DNS ASK et#######et.public.blastapi.io
- DNS ASK et#.#erkle.io
- DNS ASK ga####y.tenderly.co
- DNS ASK rp#.##h.gateway.fm
- DNS ASK et######-rpc.publicnode.com
- DNS ASK et#.#rpc.org
- DNS ASK et######.rpc.subquery.network
- DNS ASK et#.##amarpc.com
- DNS ASK rp#.#entio.xyz
- DNS ASK rp#.#epolia.org
- DNS ASK et########epolia-rpc.publicnode.com
- DNS ASK se####a.drpc.org
- DNS ASK rp##.#epolia.org
- DNS ASK se#####.gateway.tenderly.co
- DNS ASK et#######ia.public.blastapi.io
- DNS ASK po####n.drpc.org
- DNS ASK po#####.blockpi.network
- DNS ASK po########innet.public.blastapi.io
- DNS ASK po#####.#pc.subquery.network
- DNS ASK po####n.meowrpc.com
- DNS ASK po#######or-rpc.publicnode.com
- DNS ASK po###on-rpc.com
- DNS ASK 1r#c.io
- DNS ASK 099b1d7c2581d65bbe06.microsoft.com
Miscellaneous
Creates and executes the following
- '%TEMP%\is-5osiios56f.tmp\<File name>.tmp' /SL5="$1301E6,10202502,893952,<Full path to file>"
- '%LOCALAPPDATA%\microsoft\windowsapps\microsoft.pythonapp_nj7xx9mo20t2i\pythonw.exe' "%LOCALAPPDATA%\Microsoft\WindowsApps\Microsoft.PythonApp_nj7xx9mo20t2i\run.pyw"
Executes the following
- '<SYSTEM32>\schtasks.exe' /Create /F /TN IntelSoftwareUpdaterV4 /XML %TEMP%\t.xml
- '<SYSTEM32>\wbem\wmic.exe' process where name='pythonw.exe' get processid,commandline
- '<SYSTEM32>\cmd.exe' /c "ver"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -NonInteractive -Command "(Get-CimInstance Win32_OperatingSystem).Caption"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -NonInteractive -Command "(Get-CimInstance -Namespace root/SecurityCenter2 -ClassName AntiVirusProduct).displayName"
- '%LOCALAPPDATA%\microsoft\windowsapps\microsoft.pythonapp_nj7xx9mo20t2i\pythonw.exe' "%LOCALAPPDATA%\Microsoft\WindowsApps\Microsoft.PythonApp_nj7xx9mo20t2i\run.pyw"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "ver"' (with hidden window)
