Technical Information
Modifies file system
Creates the following files
- %TEMP%\is-8hfhg.tmp\is-1ol70.tmp
- %ProgramFiles(x86)%\powerpoint repair toolbox\unins000.dat
- %ProgramFiles(x86)%\powerpoint repair toolbox\is-t9kb5.tmp
- %ProgramFiles(x86)%\powerpoint repair toolbox\is-aoi7p.tmp
- %ProgramFiles(x86)%\powerpoint repair toolbox\is-8doic.tmp
- %ProgramFiles(x86)%\powerpoint repair toolbox\is-79bgb.tmp
- %ProgramFiles(x86)%\powerpoint repair toolbox\is-7a5mp.tmp
- %ProgramFiles(x86)%\powerpoint repair toolbox\is-2t114.tmp
- %ProgramFiles(x86)%\powerpoint repair toolbox\is-e4bs1.tmp
- %ProgramFiles(x86)%\powerpoint repair toolbox\is-rbc7l.tmp
- %ProgramFiles(x86)%\powerpoint repair toolbox\is-40go1.tmp
- %ProgramFiles(x86)%\powerpoint repair toolbox\is-aasep.tmp
- %ProgramFiles(x86)%\powerpoint repair toolbox\is-phmcv.tmp
- %ProgramFiles(x86)%\powerpoint repair toolbox\is-lgbgf.tmp
- %ProgramFiles(x86)%\powerpoint repair toolbox\is-i4ij7.tmp
- %ProgramFiles(x86)%\powerpoint repair toolbox\is-7a8o0.tmp
- %ProgramFiles(x86)%\powerpoint repair toolbox\is-npajd.tmp
- %ProgramFiles(x86)%\powerpoint repair toolbox\is-7ruju.tmp
- %ProgramFiles(x86)%\powerpoint repair toolbox\is-6q7gg.tmp
- %ProgramFiles(x86)%\powerpoint repair toolbox\is-u1mo2.tmp
- %ProgramFiles(x86)%\powerpoint repair toolbox\is-rtn1k.tmp
- %ProgramFiles(x86)%\powerpoint repair toolbox\is-0k0fc.tmp
- %ProgramFiles(x86)%\powerpoint repair toolbox\is-lbcs6.tmp
- %ProgramFiles(x86)%\powerpoint repair toolbox\is-6ktu6.tmp
- %TEMP%\is-pcodr.tmp\_isetup\_iscrypt.dll
- %TEMP%\is-pcodr.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-pcodr.tmp\_isetup\_setup64.tmp
- %TEMP%\is-pcodr.tmp\_isetup\_regdll.tmp
- %ProgramFiles(x86)%\powerpoint repair toolbox\powerpointrepairtoolboxlauncher.exe
- %TEMP%\authrootstl.cab
Moves the following files
- from %ProgramFiles(x86)%\powerpoint repair toolbox\is-6ktu6.tmp to %ProgramFiles(x86)%\powerpoint repair toolbox\unins000.exe
- from %ProgramFiles(x86)%\powerpoint repair toolbox\is-8doic.tmp to %ProgramFiles(x86)%\powerpoint repair toolbox\sqlite3.dll
- from %ProgramFiles(x86)%\powerpoint repair toolbox\is-79bgb.tmp to %ProgramFiles(x86)%\powerpoint repair toolbox\wmfdist.exe
- from %ProgramFiles(x86)%\powerpoint repair toolbox\is-7a5mp.tmp to %ProgramFiles(x86)%\powerpoint repair toolbox\ssleay32.dll
- from %ProgramFiles(x86)%\powerpoint repair toolbox\is-2t114.tmp to %ProgramFiles(x86)%\powerpoint repair toolbox\libeay32.dll
- from %ProgramFiles(x86)%\powerpoint repair toolbox\is-e4bs1.tmp to %ProgramFiles(x86)%\powerpoint repair toolbox\powerpoint repair toolbox license.txt
- from %ProgramFiles(x86)%\powerpoint repair toolbox\is-rbc7l.tmp to %ProgramFiles(x86)%\powerpoint repair toolbox\powerpointrepairtoolbox.trk
- from %ProgramFiles(x86)%\powerpoint repair toolbox\is-40go1.tmp to %ProgramFiles(x86)%\powerpoint repair toolbox\powerpointrepairtoolbox.rus
- from %ProgramFiles(x86)%\powerpoint repair toolbox\is-aasep.tmp to %ProgramFiles(x86)%\powerpoint repair toolbox\powerpointrepairtoolbox.ptb
- from %ProgramFiles(x86)%\powerpoint repair toolbox\is-phmcv.tmp to %ProgramFiles(x86)%\powerpoint repair toolbox\powerpointrepairtoolbox.plk
- from %ProgramFiles(x86)%\powerpoint repair toolbox\is-lgbgf.tmp to %ProgramFiles(x86)%\powerpoint repair toolbox\powerpointrepairtoolbox.nld
- from %ProgramFiles(x86)%\powerpoint repair toolbox\is-i4ij7.tmp to %ProgramFiles(x86)%\powerpoint repair toolbox\powerpointrepairtoolbox.kor
- from %ProgramFiles(x86)%\powerpoint repair toolbox\is-7a8o0.tmp to %ProgramFiles(x86)%\powerpoint repair toolbox\powerpointrepairtoolbox.jpn
- from %ProgramFiles(x86)%\powerpoint repair toolbox\is-npajd.tmp to %ProgramFiles(x86)%\powerpoint repair toolbox\powerpointrepairtoolbox.ita
- from %ProgramFiles(x86)%\powerpoint repair toolbox\is-7ruju.tmp to %ProgramFiles(x86)%\powerpoint repair toolbox\powerpointrepairtoolbox.fra
- from %ProgramFiles(x86)%\powerpoint repair toolbox\is-6q7gg.tmp to %ProgramFiles(x86)%\powerpoint repair toolbox\powerpointrepairtoolbox.esn
- from %ProgramFiles(x86)%\powerpoint repair toolbox\is-u1mo2.tmp to %ProgramFiles(x86)%\powerpoint repair toolbox\powerpointrepairtoolbox.deu
- from %ProgramFiles(x86)%\powerpoint repair toolbox\is-rtn1k.tmp to %ProgramFiles(x86)%\powerpoint repair toolbox\powerpointrepairtoolbox.chs
- from %ProgramFiles(x86)%\powerpoint repair toolbox\is-0k0fc.tmp to %ProgramFiles(x86)%\powerpoint repair toolbox\powerpointrepairtoolbox.ara
- from %ProgramFiles(x86)%\powerpoint repair toolbox\is-lbcs6.tmp to %ProgramFiles(x86)%\powerpoint repair toolbox\powerpointrepairtoolbox.exe
- from %ProgramFiles(x86)%\powerpoint repair toolbox\is-aoi7p.tmp to %ProgramFiles(x86)%\powerpoint repair toolbox\powerpointrepairtoolboxlauncher.exe
- from %ProgramFiles(x86)%\powerpoint repair toolbox\is-t9kb5.tmp to %ProgramFiles(x86)%\powerpoint repair toolbox\settings.bin
Network activity
Connects to
- 'pe###igold.xyz':80
TCP
HTTP GET requests
- http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?eb##############
HTTP POST requests
- http://pe###igold.xyz/new/net_api
UDP
- DNS ASK pe###igold.xyz
Miscellaneous
Searches for the following windows
- ClassName: 'PowerPointRTBClassTRE1' WindowName: ''
Creates and executes the following
- '%TEMP%\is-8hfhg.tmp\is-1ol70.tmp' /SL4 $F0148 "<Full path to file>" 10321403 95232
- '%ProgramFiles(x86)%\powerpoint repair toolbox\powerpointrepairtoolboxlauncher.exe'
- '%ProgramFiles(x86)%\powerpoint repair toolbox\wmfdist.exe' /Q:A /R:N
- '%ProgramFiles(x86)%\powerpoint repair toolbox\powerpointrepairtoolboxlauncher.exe' 8e0b0ce30d42d997e9fee7484f9937cd
