Technical Information
Modifies file system:
Creates the following files:
- %TEMP%\7zS1.tmp\CryptoPreventBulkSetupMSI.msi
- <SYSTEM32>\ChilkatAx-9.5.0-win32.dll
- %ProgramFiles%\Foolish IT\CryptoPrevent\unins000.dat
- %ALLUSERSPROFILE%\Start Menu\Programs\CryptoPrevent\CryptoPrevent.lnk
- %ProgramFiles%\Foolish IT\CryptoPrevent\is-1LJKO.tmp
- %ProgramFiles%\Foolish IT\CryptoPrevent\is-EAMFQ.tmp
- %ProgramFiles%\Foolish IT\CryptoPrevent\is-JI3SS.tmp
- %ProgramFiles%\Foolish IT\CryptoPrevent\is-58BCH.tmp
- %ProgramFiles%\Foolish IT\CryptoPrevent\is-2BG2T.tmp
- %ProgramFiles%\Foolish IT\CryptoPrevent\is-E6U4R.tmp
- %ProgramFiles%\Foolish IT\CryptoPrevent\is-79C79.tmp
- %TEMP%\is-NONC1.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-SN3B1.tmp\CryptoPreventBulkSetup.tmp
- %TEMP%\7zS1.tmp\CryptoPreventBulkSetup.exe
- %TEMP%\7zS1.tmp\CryptoPrevent.exe
- %TEMP%\7zS1.tmp\CryptoPreventSilentInstall.bat
- %ProgramFiles%\Foolish IT\CryptoPrevent\T3R2Y - 0H6YK - HK6A0 - HU18N - 64354.txt
- %TEMP%\_iu14D2N.tmp
Deletes the following files:
- %ProgramFiles%\Foolish IT\CryptoPrevent\T3R2Y - 0H6YK - HK6A0 - HU18N - 64354.txt
- %TEMP%\is-NONC1.tmp\_isetup\_shfoldr.dll
Moves the following files:
- from %ProgramFiles%\Foolish IT\CryptoPrevent\is-79C79.tmp to %ProgramFiles%\Foolish IT\CryptoPrevent\unins000.exe
- from %ProgramFiles%\Foolish IT\CryptoPrevent\is-E6U4R.tmp to %ProgramFiles%\Foolish IT\CryptoPrevent\Bulk.ini
- from %ProgramFiles%\Foolish IT\CryptoPrevent\is-2BG2T.tmp to %ProgramFiles%\Foolish IT\CryptoPrevent\CryptoPrevent.exe
- from %ProgramFiles%\Foolish IT\CryptoPrevent\is-58BCH.tmp to %ProgramFiles%\Foolish IT\CryptoPrevent\CryptoPreventEventSvc.exe
- from %ProgramFiles%\Foolish IT\CryptoPrevent\is-JI3SS.tmp to %ProgramFiles%\Foolish IT\CryptoPrevent\CryptoPreventFilterMod.CryptoPreventEXEC
- from %ProgramFiles%\Foolish IT\CryptoPrevent\is-EAMFQ.tmp to %ProgramFiles%\Foolish IT\CryptoPrevent\FoolishEventLogMsgHelper.dll
- from %ProgramFiles%\Foolish IT\CryptoPrevent\is-1LJKO.tmp to %ProgramFiles%\Foolish IT\CryptoPrevent\ChilkatAx-9.5.0-win32.dll
Substitutes the following files:
- %ProgramFiles%\Foolish IT\CryptoPrevent\T3R2Y - 0H6YK - HK6A0 - HU18N - 64354.txt
Network activity:
Connects to:
- 'cp#####r.foolishit.com':80
- 'cp#####r.foolishit.com':21
TCP:
HTTP GET requests:
- http://cp#####r.foolishit.com/Bulk/T3R2Y%20-%200H6YK%20-%20HK6A0%20-%20HU18N%20-%2064354.txt
UDP:
- DNS ASK cp#####r.foolishit.com
Miscellaneous:
Creates and executes the following:
- '%TEMP%\7zS1.tmp\CryptoPreventBulkSetup.exe' /VERYSILENT /NORESTART /SUPPRESSMSGBOXES
- '%TEMP%\is-SN3B1.tmp\CryptoPreventBulkSetup.tmp' /SL5="$400DE,2454607,189952,%TEMP%\7zS1.tmp\CryptoPreventBulkSetup.exe" /VERYSILENT /NORESTART /SUPPRESSMSGBOXES
- '%ProgramFiles%\Foolish IT\CryptoPrevent\CryptoPrevent.exe'
- '%ProgramFiles%\Foolish IT\CryptoPrevent\unins000.exe' /verysilent
- '%TEMP%\_iu14D2N.tmp' /SECONDPHASE="%ProgramFiles%\Foolish IT\CryptoPrevent\unins000.exe" /FIRSTPHASEWND=$10152 /verysilent
- '%ProgramFiles%\Foolish IT\CryptoPrevent\CryptoPrevent.exe' /bulkuninstaller
Executes the following:
- '<SYSTEM32>\cmd.exe' /c .\CryptoPreventSilentInstall.bat
- '<SYSTEM32>\regsvr32.exe' /s "<SYSTEM32>\ChilkatAx-9.5.0-win32.dll"
- '<SYSTEM32>\reg.exe' delete "HKLM\Software\Foolish IT\CryptoPrevent" /v ProductKey /f
