Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Super Optimizer' = '%ProgramFiles(x86)%\Super Optimizer\SupOptLauncher.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows] 'AppInit_DLLs' = ' '
- [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Windows] 'LoadAppInit_DLLs' = '00000001'
Creates or modifies the following files
- %APPDATA%\microsoft\windows\start menu\programs\startup\<File name>.lnk
Sets the following service settings
- [<HKLM>\System\CurrentControlSet\Services\cae99edb] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\cae99edb] 'ImagePath' = '"<SYSTEM32>\rundll32.exe" "%ProgramFiles(x86)%\Super Optimizer\SupOptStats.dll",ENT'
Creates the following services
- 'cae99edb' "<SYSTEM32>\rundll32.exe" "%ProgramFiles(x86)%\Super Optimizer\SupOptStats.dll",ENT
Modifies file system
Creates the following files
- %ALLUSERSPROFILE%\{46acef56-56ce-2f35-46ac-cef5656cbd59}\<File name>.exe
- %ProgramFiles(x86)%\super optimizer\is-mrha1.tmp
- %ProgramFiles(x86)%\super optimizer\is-fo7ai.tmp
- %ProgramFiles(x86)%\super optimizer\is-kacnf.tmp
- %ProgramFiles(x86)%\super optimizer\is-p54ba.tmp
- %ProgramFiles(x86)%\super optimizer\is-r5heo.tmp
- %ProgramFiles(x86)%\super optimizer\is-hle15.tmp
- %HOMEPATH%\desktop\super optimizer.lnk
- %ProgramFiles(x86)%\super optimizer\unins000.dat
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\super optimizer\super optimizer.lnk
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\super optimizer\help.lnk
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\super optimizer\super optimizer on the web.lnk
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\super optimizer\check updates.lnk
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\super optimizer\uninstall super optimizer.lnk
- %ProgramFiles(x86)%\super optimizer\unins000.msg
- %ProgramFiles(x86)%\super optimizer\is-huve5.tmp
- %ProgramFiles(x86)%\super optimizer\is-gjc3d.tmp
- %ProgramFiles(x86)%\super optimizer\is-pf331.tmp
- %TEMP%\is-eh79n.tmp\supoptstats.dll
- %ALLUSERSPROFILE%\{46acef56-56ce-2f35-46ac-cef5656cbd59}\<File name>.dat
- %TEMP%\supoptsetup.exe
- %TEMP%\is-6k9vt.tmp\supoptsetup.tmp
- %TEMP%\is-eh79n.tmp\_isetup\_setup64.tmp
- %TEMP%\is-eh79n.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-eh79n.tmp\supopthelper.dll
- %ProgramFiles(x86)%\super optimizer\is-2ruc0.tmp
- %ProgramFiles(x86)%\super optimizer\is-qnipe.tmp
- %ProgramFiles(x86)%\super optimizer\is-vkddo.tmp
- %ProgramFiles(x86)%\super optimizer\is-orb5k.tmp
- %ProgramFiles(x86)%\super optimizer\is-rk498.tmp
- %ProgramFiles(x86)%\super optimizer\is-livoo.tmp
- %ProgramFiles(x86)%\super optimizer\is-316oc.tmp
- %ProgramFiles(x86)%\super optimizer\is-k65hr.tmp
- %ProgramFiles(x86)%\super optimizer\is-ept8l.tmp
- %ProgramFiles(x86)%\super optimizer\supoptstats.dll
Deletes the following files
- %TEMP%\is-eh79n.tmp\supopthelper.dll
- %TEMP%\is-eh79n.tmp\supoptstats.dll
- %TEMP%\is-eh79n.tmp\_isetup\_setup64.tmp
- %TEMP%\is-eh79n.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-6k9vt.tmp\supoptsetup.tmp
Moves the following files
- from %ProgramFiles(x86)%\super optimizer\is-2ruc0.tmp to %ProgramFiles(x86)%\super optimizer\unins000.exe
- from %ProgramFiles(x86)%\super optimizer\is-r5heo.tmp to %ProgramFiles(x86)%\super optimizer\superoptimizer.chm
- from %ProgramFiles(x86)%\super optimizer\is-p54ba.tmp to %ProgramFiles(x86)%\super optimizer\english.ini
- from %ProgramFiles(x86)%\super optimizer\is-kacnf.tmp to %ProgramFiles(x86)%\super optimizer\supoptuninstaller.exe
- from %ProgramFiles(x86)%\super optimizer\is-fo7ai.tmp to %ProgramFiles(x86)%\super optimizer\supoptlauncher.exe
- from %ProgramFiles(x86)%\super optimizer\is-mrha1.tmp to %ProgramFiles(x86)%\super optimizer\supoptschedule.exe
- from %ProgramFiles(x86)%\super optimizer\is-huve5.tmp to %ProgramFiles(x86)%\super optimizer\supoptguard.exe
- from %ProgramFiles(x86)%\super optimizer\is-pf331.tmp to %ProgramFiles(x86)%\super optimizer\supoptsmartscan.exe
- from %ProgramFiles(x86)%\super optimizer\is-ept8l.tmp to %ProgramFiles(x86)%\super optimizer\supoptreminder.exe
- from %ProgramFiles(x86)%\super optimizer\is-qnipe.tmp to %ProgramFiles(x86)%\super optimizer\supoptstart.exe
- from %ProgramFiles(x86)%\super optimizer\is-k65hr.tmp to %ProgramFiles(x86)%\super optimizer\cookiesexception.txt
- from %ProgramFiles(x86)%\super optimizer\is-316oc.tmp to %ProgramFiles(x86)%\super optimizer\startuplist.txt
- from %ProgramFiles(x86)%\super optimizer\is-livoo.tmp to %ProgramFiles(x86)%\super optimizer\scan.gif
- from %ProgramFiles(x86)%\super optimizer\is-rk498.tmp to %ProgramFiles(x86)%\super optimizer\sqlite3.dll
- from %ProgramFiles(x86)%\super optimizer\is-orb5k.tmp to %ProgramFiles(x86)%\super optimizer\supopthelper.dll
- from %ProgramFiles(x86)%\super optimizer\is-vkddo.tmp to %ProgramFiles(x86)%\super optimizer\superoptimizer.exe
- from %ProgramFiles(x86)%\super optimizer\is-hle15.tmp to %ProgramFiles(x86)%\super optimizer\file_id.diz
- from %ProgramFiles(x86)%\super optimizer\is-gjc3d.tmp to %ProgramFiles(x86)%\super optimizer\homepage.url
Network activity
Connects to
- 'google.com':80
- 'is###ropt.com':80
- 'su####ptimizeit.com':80
- 'ed###on.cnn.com':80
- 'bi.####rpcdownload.net':80
TCP
HTTP GET requests
- http://is###ropt.com/inst?si#################################################
- http://is###ropt.com/inst?si##########################################################
UDP
- DNS ASK google.com
- DNS ASK is###ropt.com
- DNS ASK su####ptimizeit.com
- DNS ASK ed###on.cnn.com
- DNS ASK bi.####rpcdownload.net
Miscellaneous
Creates and executes the following
- '%TEMP%\supoptsetup.exe' /VERYSILENT /insid=4261344550388745361
- '%TEMP%\is-6k9vt.tmp\supoptsetup.tmp' /SL5="$120228,4926977,221184,%TEMP%\supoptsetup.exe" /VERYSILENT /insid=4261344550388745361
- '%ProgramFiles(x86)%\super optimizer\supoptstart.exe'
Executes the following
- '%WINDIR%\syswow64\rundll32.exe' "%ProgramFiles(x86)%\Super Optimizer\SupOptStats.dll",ENT -install
- '<SYSTEM32>\rundll32.exe' "%ProgramFiles(x86)%\Super Optimizer\SupOptStats.dll",ENT
