Technical Information
Modifies file system
Creates the following files
- %TEMP%\is-u2n0s.tmp\is-m152q.tmp
- %ProgramFiles(x86)%\personal video database\is-jrqhl.tmp
- %ProgramFiles(x86)%\personal video database\is-4ojuv.tmp
- %ProgramFiles(x86)%\personal video database\is-1tc4o.tmp
- %ProgramFiles(x86)%\personal video database\is-f8ahu.tmp
- %ProgramFiles(x86)%\personal video database\is-ln656.tmp
- %ProgramFiles(x86)%\personal video database\is-hj9rj.tmp
- %ProgramFiles(x86)%\personal video database\is-qn4qt.tmp
- %ProgramFiles(x86)%\personal video database\is-tgj2d.tmp
- %ProgramFiles(x86)%\personal video database\is-8lu3o.tmp
- %ProgramFiles(x86)%\personal video database\is-hi7eg.tmp
- %ProgramFiles(x86)%\personal video database\is-lcsgd.tmp
- %ProgramFiles(x86)%\personal video database\scripts\is-v1726.tmp
- %ProgramFiles(x86)%\personal video database\scripts\is-d2a4b.tmp
- %ProgramFiles(x86)%\personal video database\is-k28td.tmp
- %ProgramFiles(x86)%\personal video database\is-sso1v.tmp
- %ProgramFiles(x86)%\personal video database\unins000.dat
- %ProgramFiles(x86)%\personal video database\is-coo55.tmp
- %ProgramFiles(x86)%\personal video database\is-clh11.tmp
- %ProgramFiles(x86)%\personal video database\skins\people\is-3cbmr.tmp
- %ProgramFiles(x86)%\personal video database\skins\people\is-bqgbr.tmp
- %ProgramFiles(x86)%\personal video database\skins\movies\is-f0d99.tmp
- %TEMP%\is-40cii.tmp\_isetup\_setup64.tmp
- %TEMP%\is-40cii.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-40cii.tmp\_isetup\_iscrypt.dll
- %ProgramFiles(x86)%\personal video database\is-r24ch.tmp
- %ProgramFiles(x86)%\personal video database\is-sjdlk.tmp
- %ProgramFiles(x86)%\personal video database\is-p3v7b.tmp
- %ProgramFiles(x86)%\personal video database\is-r5el3.tmp
- %ProgramFiles(x86)%\personal video database\viddb.exe
- %ProgramFiles(x86)%\personal video database\is-iu0d5.tmp
- %ProgramFiles(x86)%\personal video database\is-7jq43.tmp
- %ProgramFiles(x86)%\personal video database\is-p69i9.tmp
- %ProgramFiles(x86)%\personal video database\is-l9ih5.tmp
- %ProgramFiles(x86)%\personal video database\skins\images\is-kg6ao.tmp
- %ProgramFiles(x86)%\personal video database\skins\images\is-87k6t.tmp
- %ProgramFiles(x86)%\personal video database\skins\images\is-cgo0v.tmp
- %ProgramFiles(x86)%\personal video database\skins\images\is-9nb5g.tmp
- %ProgramFiles(x86)%\personal video database\skins\movies\is-8vj7d.tmp
- %TEMP%\is-40cii.tmp\_isetup\_regdll.tmp
- %ProgramFiles(x86)%\personal video database\is-84lq5.tmp
- %TEMP%\lohkos.cab
Moves the following files
- from %ProgramFiles(x86)%\personal video database\is-r24ch.tmp to %ProgramFiles(x86)%\personal video database\unins000.exe
- from %ProgramFiles(x86)%\personal video database\is-clh11.tmp to %ProgramFiles(x86)%\personal video database\fbclient.dll
- from %ProgramFiles(x86)%\personal video database\is-jrqhl.tmp to %ProgramFiles(x86)%\personal video database\firebird.conf
- from %ProgramFiles(x86)%\personal video database\is-4ojuv.tmp to %ProgramFiles(x86)%\personal video database\firebird.msg
- from %ProgramFiles(x86)%\personal video database\is-1tc4o.tmp to %ProgramFiles(x86)%\personal video database\ib_util.dll
- from %ProgramFiles(x86)%\personal video database\is-f8ahu.tmp to %ProgramFiles(x86)%\personal video database\icudt30.dll
- from %ProgramFiles(x86)%\personal video database\is-ln656.tmp to %ProgramFiles(x86)%\personal video database\icuin30.dll
- from %ProgramFiles(x86)%\personal video database\is-qn4qt.tmp to %ProgramFiles(x86)%\personal video database\msvcp71.dll
- from %ProgramFiles(x86)%\personal video database\is-l9ih5.tmp to %ProgramFiles(x86)%\personal video database\sqlite3.dll
- from %ProgramFiles(x86)%\personal video database\is-8lu3o.tmp to %ProgramFiles(x86)%\personal video database\msvcr71.dll
- from %ProgramFiles(x86)%\personal video database\is-iu0d5.tmp to %ProgramFiles(x86)%\personal video database\msvcp80.dll
- from %ProgramFiles(x86)%\personal video database\is-hi7eg.tmp to %ProgramFiles(x86)%\personal video database\msvcr80.dll
- from %ProgramFiles(x86)%\personal video database\is-lcsgd.tmp to %ProgramFiles(x86)%\personal video database\microsoft.vc80.crt.manifest
- from %ProgramFiles(x86)%\personal video database\scripts\is-v1726.tmp to %ProgramFiles(x86)%\personal video database\scripts\adultdvdempire.psf
- from %ProgramFiles(x86)%\personal video database\scripts\is-d2a4b.tmp to %ProgramFiles(x86)%\personal video database\scripts\allrovi.psf
- from %ProgramFiles(x86)%\personal video database\is-coo55.tmp to %ProgramFiles(x86)%\personal video database\fbembed.dll
- from %ProgramFiles(x86)%\personal video database\skins\people\is-3cbmr.tmp to %ProgramFiles(x86)%\personal video database\skins\people\skinimg_person_classic.png
- from %ProgramFiles(x86)%\personal video database\skins\people\is-bqgbr.tmp to %ProgramFiles(x86)%\personal video database\skins\people\pvd_classic_person.xml
- from %ProgramFiles(x86)%\personal video database\skins\movies\is-f0d99.tmp to %ProgramFiles(x86)%\personal video database\skins\movies\skinimg_movie_classic.png
- from %ProgramFiles(x86)%\personal video database\skins\movies\is-8vj7d.tmp to %ProgramFiles(x86)%\personal video database\skins\movies\pvd_classic_movie.xml
- from %ProgramFiles(x86)%\personal video database\skins\images\is-9nb5g.tmp to %ProgramFiles(x86)%\personal video database\skins\images\tree.bmp
- from %ProgramFiles(x86)%\personal video database\skins\images\is-cgo0v.tmp to %ProgramFiles(x86)%\personal video database\skins\images\toolbar.bmp
- from %ProgramFiles(x86)%\personal video database\skins\images\is-87k6t.tmp to %ProgramFiles(x86)%\personal video database\skins\images\stars.bmp
- from %ProgramFiles(x86)%\personal video database\skins\images\is-kg6ao.tmp to %ProgramFiles(x86)%\personal video database\skins\images\buttons.bmp
- from %ProgramFiles(x86)%\personal video database\is-hj9rj.tmp to %ProgramFiles(x86)%\personal video database\icuuc30.dll
- from %ProgramFiles(x86)%\personal video database\is-p69i9.tmp to %ProgramFiles(x86)%\personal video database\debug.bat
- from %ProgramFiles(x86)%\personal video database\is-84lq5.tmp to %ProgramFiles(x86)%\personal video database\portable.bat
- from %ProgramFiles(x86)%\personal video database\is-tgj2d.tmp to %ProgramFiles(x86)%\personal video database\delzip179.dll
- from %ProgramFiles(x86)%\personal video database\is-7jq43.tmp to %ProgramFiles(x86)%\personal video database\pvdinst.exe
- from %ProgramFiles(x86)%\personal video database\is-r5el3.tmp to %ProgramFiles(x86)%\personal video database\pcre3.dll
- from %ProgramFiles(x86)%\personal video database\is-p3v7b.tmp to %ProgramFiles(x86)%\personal video database\mediainfo.dll
- from %ProgramFiles(x86)%\personal video database\is-sjdlk.tmp to %ProgramFiles(x86)%\personal video database\lang.dll
- from %ProgramFiles(x86)%\personal video database\is-k28td.tmp to %ProgramFiles(x86)%\personal video database\turbosearch.exe
- from %ProgramFiles(x86)%\personal video database\is-sso1v.tmp to %ProgramFiles(x86)%\personal video database\viddb.exe
Network activity
Connects to
- 'so###como.gq':80
TCP
HTTP GET requests
- http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?08######
HTTP POST requests
- http://so###como.gq/new/net_api
UDP
- DNS ASK so###como.gq
Miscellaneous
Searches for the following windows
- ClassName: '{D5B112D4-26A4-44F5-A48B-FAC830A919ED}' WindowName: ''
Creates and executes the following
- '%TEMP%\is-u2n0s.tmp\is-m152q.tmp' /SL4 $B0232 "<Full path to file>" 9514880 134656
- '%ProgramFiles(x86)%\personal video database\viddb.exe'
- '%ProgramFiles(x86)%\personal video database\viddb.exe' b7e607529e80c3dfa98dccc066609e2b
Executes the following
- '%WINDIR%\syswow64\schtasks.exe' /Query
- '%WINDIR%\syswow64\schtasks.exe' /Delete /F /TN "viddb 2"
