Technical Information
Modifies file system:
Creates the following files:
- %TEMP%\is-T4CSL.tmp\<File name>.tmp
- %TEMP%\nsq3.tmp\g\gtb\toolbar_1049.html
- %TEMP%\nsq3.tmp\g\gtb\toolbar_1050.html
- %TEMP%\nsq3.tmp\g\gtb\toolbar_1051.html
- %TEMP%\nsq3.tmp\g\gtb\toolbar_1053.html
- %TEMP%\nsq3.tmp\g\gtb\toolbar_1054.html
- %TEMP%\nsq3.tmp\g\gtb\toolbar_1055.html
- %TEMP%\nsq3.tmp\g\gtb\toolbar_1057.html
- %TEMP%\nsq3.tmp\g\gtb\toolbar_1058.html
- %TEMP%\nsq3.tmp\g\gtb\toolbar_1060.html
- %TEMP%\nsq3.tmp\g\gtb\toolbar_1061.html
- %TEMP%\nsq3.tmp\g\gtb\toolbar_1062.html
- %TEMP%\nsq3.tmp\g\gtb\toolbar_1029.html
- %TEMP%\nsq3.tmp\g\gtb\toolbar_1066.html
- %TEMP%\nsq3.tmp\g\gtb\toolbar_2052.html
- %TEMP%\nsq3.tmp\g\gtb\toolbar_2070.html
- %TEMP%\nsq3.tmp\g\gtb\toolbar_3098.html
- %TEMP%\nsq3.tmp\g\gtb\toolbar-offer.png
- %TEMP%\nsq3.tmp\g\pfWWW.dll
- %TEMP%\nsq3.tmp\ui\pfUI.dll
- %TEMP%\nsq3.tmp\p\pfWWW.dll
- %TEMP%\nsq3.tmp\p\pfAP.dll
- %TEMP%\nsq3.tmp\nsExec.dll
- %TEMP%\nsq3.tmp\ns4.tmp
- %TEMP%\nsq3.tmp\p\=1045
- %TEMP%\nsq3.tmp\g\gtb\toolbar_1046.html
- %TEMP%\nsq3.tmp\g\gtb\toolbar_1048.html
- %TEMP%\nsq3.tmp\g\gtb\toolbar_1045.html
- %TEMP%\nsq3.tmp\g\gtb\toolbar_1044.html
- %TEMP%\nsq3.tmp\g\gtb\toolbar_1043.html
- %TEMP%\is-GQHOE.tmp\host.cmd
- %TEMP%\is-GQHOE.tmp\ccsetup542.exe
- %TEMP%\nsv2.tmp
- %TEMP%\nsq3.tmp\System.dll
- %TEMP%\nsq3.tmp\UserInfo.dll
- %TEMP%\nsq3.tmp\p\pfBL.dll
- %TEMP%\nsq3.tmp\g\gtapi_signed.dll
- %TEMP%\nsq3.tmp\g\gcapi_dll.dll
- %TEMP%\nsq3.tmp\g\gtb\toolbar_1025.html
- %TEMP%\nsq3.tmp\g\gtb\toolbar_1026.html
- %TEMP%\nsq3.tmp\g\gtb\toolbar_1027.html
- %TEMP%\nsq3.tmp\nsProcess.dll
- %TEMP%\nsq3.tmp\g\gtb\toolbar_1102.html
- %TEMP%\nsq3.tmp\g\gtb\toolbar_1028.html
- %TEMP%\nsq3.tmp\g\gtb\toolbar_1031.html
- %TEMP%\nsq3.tmp\g\gtb\toolbar_1032.html
- %TEMP%\nsq3.tmp\g\gtb\toolbar_1033.html
- %TEMP%\nsq3.tmp\g\gtb\toolbar_1034.html
- %TEMP%\nsq3.tmp\g\gtb\toolbar_1035.html
- %TEMP%\nsq3.tmp\g\gtb\toolbar_1036.html
- %TEMP%\nsq3.tmp\g\gtb\toolbar_1037.html
- %TEMP%\nsq3.tmp\g\gtb\toolbar_1038.html
- %TEMP%\nsq3.tmp\g\gtb\toolbar_1040.html
- %TEMP%\nsq3.tmp\g\gtb\toolbar_1041.html
- %TEMP%\nsq3.tmp\g\gtb\toolbar_1042.html
- %TEMP%\is-GQHOE.tmp\BASS.dll
- %TEMP%\nsq3.tmp\g\gtb\toolbar_1030.html
- %TEMP%\nsq3.tmp\inetc.dll
Deletes the following files:
- %TEMP%\nsq3.tmp\ns4.tmp
Modifies the HOSTS file.
Network activity:
Connects to:
- 'cc###ner.com':443
- 'se#####.piriform.com':80
TCP:
HTTP GET requests:
- http://se#####.piriform.com/installcheck.aspx?p=#################################################################################################################################################...
UDP:
- DNS ASK www.cc###ner.com
- DNS ASK se#####.piriform.com
Miscellaneous:
Searches for the following windows:
- ClassName: 'PiriformRegistration' WindowName: ''
- ClassName: '#32770' WindowName: 'CCleaner'
- ClassName: '#32770' WindowName: 'Piriform CCleaner'
- ClassName: 'ThunderRT6FormDC' WindowName: 'CCleaner'
- ClassName: 'PiriformCCleaner' WindowName: ''
- ClassName: '#32770' WindowName: ''
Creates and executes the following:
- '%TEMP%\is-T4CSL.tmp\<File name>.tmp' /SL5="$40036,18104973,157184,<Full path to file>"
- '%TEMP%\is-GQHOE.tmp\ccsetup542.exe' /S /L=1045
- '%TEMP%\nsq3.tmp\ns4.tmp' ping -n 1 -w 1000 www.cc###ner.com
Executes the following:
- '<SYSTEM32>\cmd.exe' /C ""%TEMP%\is-GQHOE.tmp\host.cmd" /s"
- '<SYSTEM32>\ipconfig.exe' -flushdns
- '<SYSTEM32>\ping.exe' -n 1 -w 1000 www.cc###ner.com
