Technical Information
To ensure autorun and distribution
Sets the following service settings
- [<HKLM>\System\CurrentControlSet\Services\IObitUnlocker] 'ImagePath' = '%TEMP%\RarSFX0\App\IObitUnlocker\IObitUnlocker.sys'
Creates the following services
- 'IObitUnlocker' %TEMP%\RarSFX0\App\IObitUnlocker\IObitUnlocker.sys
Modifies file system
Creates the following files
- %TEMP%\rarsfx0\other\help\images\donation_button.png
- %TEMP%\rarsfx0\app\iobitunlocker\iobitunlockerextension.dll
- %TEMP%\rarsfx0\app\iobitunlocker\specialdir.ini
- %TEMP%\rarsfx0\app\iobitunlocker\syslegacy32\iobitunlocker.sys
- %TEMP%\rarsfx0\app\iobitunlocker\syslegacy32\iobitunlockerextension.dll
- %TEMP%\rarsfx0\app\iobitunlocker\syslegacy64\iobitunlocker.sys
- %TEMP%\rarsfx0\app\iobitunlocker\syslegacy64\iobitunlockerextension.dll
- %TEMP%\rarsfx0\app\iobitunlocker\sysmodern32\iobitunlocker.sys
- %TEMP%\rarsfx0\app\iobitunlocker\sysmodern32\iobitunlockerextension.dll
- %TEMP%\rarsfx0\app\iobitunlocker\sysmodern64\iobitunlocker.sys
- %TEMP%\rarsfx0\app\iobitunlocker\sysmodern64\iobitunlockerextension.dll
- %TEMP%\rarsfx0\app\iobitunlocker\update.ini
- %TEMP%\rarsfx0\app\readme.txt
- %TEMP%\rarsfx0\data\portableapps.cominstaller\license.ini
- %TEMP%\nsr38cc.tmp
- %TEMP%\nsh38dd.tmp\system.dll
- %TEMP%\nsh38dd.tmp\launcher.ini
- %TEMP%\nsh38dd.tmp\registry.dll
- %TEMP%\rarsfx0\data\settings\iobitunlockerportablesettings.ini
- %TEMP%\rarsfx0\data\portableapps.comlauncherruntimedata-iobitunlockerportable.ini
- %TEMP%\nsh38dd.tmp\runtimedata.ini
- %PROGRAMDATA%\iobit\iobit unlocker\iobitunlocker.ini
- %TEMP%\rarsfx0\app\iobitunlocker\iobitunlocker.sys
- %WINDIR%\temp\udd4115.tmp
- %TEMP%\rarsfx0\app\iobitunlocker\iobitunlocker.exe
- %TEMP%\rarsfx0\app\iobitunlocker\fav.ico
- %TEMP%\rarsfx0\other\help\images\favicon.ico
- %TEMP%\rarsfx0\other\help\images\help_background_footer.png
- %TEMP%\rarsfx0\other\help\images\help_background_header.png
- %TEMP%\rarsfx0\other\help\images\help_logo_top.png
- %TEMP%\rarsfx0\other\help\images\onenote table of contents.onetoc2
- %TEMP%\rarsfx0\other\source\appnameportable.ini
- %TEMP%\rarsfx0\other\source\launcherlicense.txt
- %TEMP%\rarsfx0\other\source\plugins\accesscontrol.dll
- %TEMP%\rarsfx0\other\source\plugins\accesscontrol.zip
- %TEMP%\rarsfx0\other\source\readme.txt
- %TEMP%\rarsfx0\help.html
- %TEMP%\rarsfx0\iobitunlockerportable.exe
- %TEMP%\rarsfx0\app\appinfo\appicon.ico
- %TEMP%\rarsfx0\app\appinfo\appicon_128.png
- %TEMP%\rarsfx0\app\appinfo\appicon_16.png
- %TEMP%\rarsfx0\app\appinfo\appicon_32.png
- %TEMP%\rarsfx0\app\appinfo\appinfo.ini
- %TEMP%\rarsfx0\app\appinfo\eula.txt
- %TEMP%\rarsfx0\app\appinfo\launcher\custom.nsh
- %TEMP%\rarsfx0\app\appinfo\launcher\iobitunlockerportable.ini
- %TEMP%\rarsfx0\app\iobitunlocker\eula.rtf
- %TEMP%\rarsfx0\app\iobitunlocker\iobitunlocker.dll
- %PROGRAMDATA%\iobit\iobit unlocker\main.ini
Deletes the following files
- %TEMP%\rarsfx0\app\iobitunlocker\iobitunlocker.sys
- %TEMP%\rarsfx0\app\iobitunlocker\iobitunlockerextension.dll
- %WINDIR%\temp\udd4115.tmp
Substitutes the following files
- %TEMP%\rarsfx0\app\iobitunlocker\iobitunlocker.sys
- %TEMP%\rarsfx0\app\iobitunlocker\iobitunlockerextension.dll
Network activity
TCP
HTTP POST requests
- http://up####.iobit.com/infofiles/iobitunlocker.upt
UDP
- DNS ASK up####.iobit.com
Miscellaneous
Searches for the following windows
- ClassName: 'EDIT' WindowName: ''
Creates and executes the following
- '%TEMP%\rarsfx0\iobitunlockerportable.exe'
- '%TEMP%\rarsfx0\app\iobitunlocker\iobitunlocker.exe'
