Technical Information
Modifies file system
Creates the following files
- %TEMP%\is-0tu9i.tmp\<File name>.tmp
- %TEMP%\is-f2nhh.tmp\_isetup\_setup64.tmp
- %TEMP%\is-f2nhh.tmp\idp.dll
- %TEMP%\is-f2nhh.tmp\rk_setup.exe
Network activity
Connects to
- 'dp#.###urestudies.com':443
- 'x.##2.us':80
- 'o.##2.us':80
- 's.##2.us':80
- 'oc##.###tg2.amazontrust.com':80
- 'oc##.####ca1.amazontrust.com':80
TCP
HTTP GET requests
- http://x.##2.us/x.cer
- http://o.##2.us//MEowSDBGMEQwQjAJBgUrDgMCGgUABBSLwZ6EW5gdYc9UaSEaaLjjETNtkAQUv1%2B30c7dH4b0W1Ws3NcQwg6piOcCCQCnDkpMNIK3fw%3D%3D
- http://s.##2.us/r.crl
- http://oc##.###tg2.amazontrust.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBSIfaREXmfqfJR3TkMYnD7O5MhzEgQUnF8A36oB1zArOIiiuG1KnPIRkYMCEwZ%2FlEoqJ83z%2BsKuKwH5CO65xMY%3D
- http://oc##.####ca1.amazontrust.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPWaOUU8%2B5VZ5%2Fa9jFTaU9pkK3FAQUhBjMhTTsvAyUlC4IWZzHshBOCggCEwdzEjgLnWaIozse2b%2BczaaODg8%3D
Other
- 'dp#.###urestudies.com':443
UDP
- DNS ASK dp#.###urestudies.com
- DNS ASK x.##2.us
- DNS ASK o.##2.us
- DNS ASK s.##2.us
- DNS ASK oc##.###tg2.amazontrust.com
- DNS ASK oc##.####ca1.amazontrust.com
Miscellaneous
Creates and executes the following
- '%TEMP%\is-0tu9i.tmp\<File name>.tmp' /SL5="$C0164,1153595,832512,<Full path to file>"
