Technical Information
Modifies file system
Creates the following files
- %TEMP%\is-7gog2.tmp\<File name>.tmp
- %ProgramFiles(x86)%\kddeskvis\shiboken2\is-ieleo.tmp
- %ProgramFiles(x86)%\kddeskvis\pywin32_system32\is-jlq1l.tmp
- %ProgramFiles(x86)%\kddeskvis\pywin32_system32\is-r6t83.tmp
- %ProgramFiles(x86)%\kddeskvis\phonon_backend\is-8sl27.tmp
- %ProgramFiles(x86)%\kddeskvis\phonon_backend\is-1tvdn.tmp
- %ProgramFiles(x86)%\kddeskvis\imageformats\is-t8iu2.tmp
- %ProgramFiles(x86)%\kddeskvis\imageformats\is-o4nec.tmp
- %ProgramFiles(x86)%\kddeskvis\imageformats\is-akbb9.tmp
- %ProgramFiles(x86)%\kddeskvis\imageformats\is-dtg84.tmp
- %ProgramFiles(x86)%\kddeskvis\imageformats\is-kbamb.tmp
- %ProgramFiles(x86)%\kddeskvis\imageformats\is-jlna7.tmp
- %ProgramFiles(x86)%\kddeskvis\imageformats\is-kslrr.tmp
- %ProgramFiles(x86)%\kddeskvis\imageformats\is-9pa77.tmp
- %ProgramFiles(x86)%\kddeskvis\imageformats\is-it6io.tmp
- %ProgramFiles(x86)%\kddeskvis\imageformats\is-ep2mt.tmp
- %ProgramFiles(x86)%\kddeskvis\imageformats\is-ga58a.tmp
- %ProgramFiles(x86)%\kddeskvis\imageformats\is-mmk66.tmp
- %ProgramFiles(x86)%\kddeskvis\shiboken2\is-f7vie.tmp
- %ProgramFiles(x86)%\kddeskvis\shiboken2\is-l1vg5.tmp
- %ProgramFiles(x86)%\kddeskvis\unins000.dat
- %ProgramFiles(x86)%\kddeskvis\is-gu4uu.tmp
- %ProgramFiles(x86)%\kddeskvis\win32com\shell\is-k898e.tmp
- %ProgramFiles(x86)%\kddeskvis\websockets-10.4.dist-info\is-n09e0.tmp
- %ProgramFiles(x86)%\kddeskvis\websockets-10.4.dist-info\is-7801o.tmp
- %ProgramFiles(x86)%\kddeskvis\websockets-10.4.dist-info\is-v2t85.tmp
- %ProgramFiles(x86)%\kddeskvis\websockets-10.4.dist-info\is-n9s63.tmp
- %ProgramFiles(x86)%\kddeskvis\websockets-10.4.dist-info\is-fs7i7.tmp
- %ProgramFiles(x86)%\kddeskvis\is-uf9ur.tmp
- %ProgramFiles(x86)%\kddeskvis\websockets\is-odppl.tmp
- %ProgramFiles(x86)%\kddeskvis\sqldrivers\is-5et26.tmp
- %ProgramFiles(x86)%\kddeskvis\sqldrivers\is-mopfi.tmp
- %ProgramFiles(x86)%\kddeskvis\sqldrivers\is-uunj9.tmp
- %ProgramFiles(x86)%\kddeskvis\sqldrivers\is-48hhl.tmp
- %ProgramFiles(x86)%\kddeskvis\sqldrivers\is-75rm0.tmp
- %ProgramFiles(x86)%\kddeskvis\sqldrivers\is-c09st.tmp
- %ProgramFiles(x86)%\kddeskvis\imageformats\is-3bsvi.tmp
- %ProgramFiles(x86)%\kddeskvis\imageformats\is-upm3m.tmp
- %ProgramFiles(x86)%\kddeskvis\certifi\is-hcosi.tmp
- %ProgramFiles(x86)%\kddeskvis\is-n37vt.tmp
- %ProgramFiles(x86)%\kddeskvis\is-1rt50.tmp
- %ProgramFiles(x86)%\kddeskvis\is-6q27f.tmp
- %ProgramFiles(x86)%\kddeskvis\is-oq0h7.tmp
- %ProgramFiles(x86)%\kddeskvis\is-olh87.tmp
- %ProgramFiles(x86)%\kddeskvis\is-4bdef.tmp
- %ProgramFiles(x86)%\kddeskvis\is-029l5.tmp
- %ProgramFiles(x86)%\kddeskvis\is-sdbq5.tmp
- %ProgramFiles(x86)%\kddeskvis\is-654qj.tmp
- %ProgramFiles(x86)%\kddeskvis\is-3899u.tmp
- %TEMP%\is-718g2.tmp\_isetup\_iscrypt.dll
- %TEMP%\is-718g2.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-718g2.tmp\_isetup\_setup64.tmp
- %TEMP%\is-718g2.tmp\_isetup\_regdll.tmp
- %ProgramFiles(x86)%\kddeskvis\is-iclln.tmp
- %ProgramFiles(x86)%\kddeskvis\is-dl1n9.tmp
- %ProgramFiles(x86)%\kddeskvis\is-6dral.tmp
- %ProgramFiles(x86)%\kddeskvis\is-9ofid.tmp
- %ProgramFiles(x86)%\kddeskvis\is-2und1.tmp
- %ProgramFiles(x86)%\kddeskvis\is-i4kq8.tmp
- %ProgramFiles(x86)%\kddeskvis\is-29ujp.tmp
- %ProgramFiles(x86)%\kddeskvis\is-9gj55.tmp
- %ProgramFiles(x86)%\kddeskvis\is-rm699.tmp
- %ProgramFiles(x86)%\kddeskvis\is-sqkfc.tmp
- %ProgramFiles(x86)%\kddeskvis\is-e4jue.tmp
- %ProgramFiles(x86)%\kddeskvis\is-bhhia.tmp
- %ProgramFiles(x86)%\kddeskvis\websockets-10.4.dist-info\is-ljatb.tmp
- %ProgramFiles(x86)%\kddeskvis\kddeskvis.exe
- %ProgramFiles(x86)%\kddeskvis\is-p2ieu.tmp
- %ProgramFiles(x86)%\kddeskvis\is-o43a6.tmp
- %ProgramFiles(x86)%\kddeskvis\is-pfv53.tmp
- %ProgramFiles(x86)%\kddeskvis\is-dt6nn.tmp
- %ProgramFiles(x86)%\kddeskvis\is-kll4g.tmp
- %ProgramFiles(x86)%\kddeskvis\is-l2ij4.tmp
- %ProgramFiles(x86)%\kddeskvis\is-bgn2m.tmp
- %ProgramFiles(x86)%\kddeskvis\is-4l27n.tmp
- %TEMP%\license.txt
Moves the following files
- from %ProgramFiles(x86)%\kddeskvis\is-3899u.tmp to %ProgramFiles(x86)%\kddeskvis\unins000.exe
- from %ProgramFiles(x86)%\kddeskvis\imageformats\is-it6io.tmp to %ProgramFiles(x86)%\kddeskvis\imageformats\qjpegd4.dll
- from %ProgramFiles(x86)%\kddeskvis\imageformats\is-9pa77.tmp to %ProgramFiles(x86)%\kddeskvis\imageformats\qmng4.dll
- from %ProgramFiles(x86)%\kddeskvis\imageformats\is-kslrr.tmp to %ProgramFiles(x86)%\kddeskvis\imageformats\qmngd4.dll
- from %ProgramFiles(x86)%\kddeskvis\imageformats\is-jlna7.tmp to %ProgramFiles(x86)%\kddeskvis\imageformats\qsvg4.dll
- from %ProgramFiles(x86)%\kddeskvis\imageformats\is-kbamb.tmp to %ProgramFiles(x86)%\kddeskvis\imageformats\qsvgd4.dll
- from %ProgramFiles(x86)%\kddeskvis\imageformats\is-dtg84.tmp to %ProgramFiles(x86)%\kddeskvis\imageformats\qtga4.dll
- from %ProgramFiles(x86)%\kddeskvis\imageformats\is-akbb9.tmp to %ProgramFiles(x86)%\kddeskvis\imageformats\qtgad4.dll
- from %ProgramFiles(x86)%\kddeskvis\imageformats\is-o4nec.tmp to %ProgramFiles(x86)%\kddeskvis\imageformats\qtiff4.dll
- from %ProgramFiles(x86)%\kddeskvis\imageformats\is-t8iu2.tmp to %ProgramFiles(x86)%\kddeskvis\imageformats\qtiffd4.dll
- from %ProgramFiles(x86)%\kddeskvis\phonon_backend\is-1tvdn.tmp to %ProgramFiles(x86)%\kddeskvis\phonon_backend\phonon_ds94.dll
- from %ProgramFiles(x86)%\kddeskvis\phonon_backend\is-8sl27.tmp to %ProgramFiles(x86)%\kddeskvis\phonon_backend\phonon_ds9d4.dll
- from %ProgramFiles(x86)%\kddeskvis\pywin32_system32\is-r6t83.tmp to %ProgramFiles(x86)%\kddeskvis\pywin32_system32\pythoncom38.dll
- from %ProgramFiles(x86)%\kddeskvis\pywin32_system32\is-jlq1l.tmp to %ProgramFiles(x86)%\kddeskvis\pywin32_system32\pywintypes38.dll
- from %ProgramFiles(x86)%\kddeskvis\imageformats\is-mmk66.tmp to %ProgramFiles(x86)%\kddeskvis\imageformats\qicod4.dll
- from %ProgramFiles(x86)%\kddeskvis\imageformats\is-ep2mt.tmp to %ProgramFiles(x86)%\kddeskvis\imageformats\qjpeg4.dll
- from %ProgramFiles(x86)%\kddeskvis\shiboken2\is-ieleo.tmp to %ProgramFiles(x86)%\kddeskvis\shiboken2\msvcp140.dll
- from %ProgramFiles(x86)%\kddeskvis\shiboken2\is-f7vie.tmp to %ProgramFiles(x86)%\kddeskvis\shiboken2\shiboken2.abi3.dll
- from %ProgramFiles(x86)%\kddeskvis\websockets-10.4.dist-info\is-n09e0.tmp to %ProgramFiles(x86)%\kddeskvis\websockets-10.4.dist-info\wheel
- from %ProgramFiles(x86)%\kddeskvis\websockets-10.4.dist-info\is-7801o.tmp to %ProgramFiles(x86)%\kddeskvis\websockets-10.4.dist-info\top_level.txt
- from %ProgramFiles(x86)%\kddeskvis\websockets-10.4.dist-info\is-v2t85.tmp to %ProgramFiles(x86)%\kddeskvis\websockets-10.4.dist-info\record
- from %ProgramFiles(x86)%\kddeskvis\websockets-10.4.dist-info\is-n9s63.tmp to %ProgramFiles(x86)%\kddeskvis\websockets-10.4.dist-info\metadata
- from %ProgramFiles(x86)%\kddeskvis\websockets-10.4.dist-info\is-ljatb.tmp to %ProgramFiles(x86)%\kddeskvis\websockets-10.4.dist-info\license
- from %ProgramFiles(x86)%\kddeskvis\is-bhhia.tmp to %ProgramFiles(x86)%\kddeskvis\_overlapped.pyd
- from %ProgramFiles(x86)%\kddeskvis\websockets-10.4.dist-info\is-fs7i7.tmp to %ProgramFiles(x86)%\kddeskvis\websockets-10.4.dist-info\installer
- from %ProgramFiles(x86)%\kddeskvis\sqldrivers\is-5et26.tmp to %ProgramFiles(x86)%\kddeskvis\sqldrivers\qsqlpsqld4.dll
- from %ProgramFiles(x86)%\kddeskvis\sqldrivers\is-mopfi.tmp to %ProgramFiles(x86)%\kddeskvis\sqldrivers\qsqlpsql4.dll
- from %ProgramFiles(x86)%\kddeskvis\sqldrivers\is-uunj9.tmp to %ProgramFiles(x86)%\kddeskvis\sqldrivers\qsqlodbcd4.dll
- from %ProgramFiles(x86)%\kddeskvis\sqldrivers\is-48hhl.tmp to %ProgramFiles(x86)%\kddeskvis\sqldrivers\qsqlodbc4.dll
- from %ProgramFiles(x86)%\kddeskvis\sqldrivers\is-75rm0.tmp to %ProgramFiles(x86)%\kddeskvis\sqldrivers\qsqlited4.dll
- from %ProgramFiles(x86)%\kddeskvis\sqldrivers\is-c09st.tmp to %ProgramFiles(x86)%\kddeskvis\sqldrivers\qsqlite4.dll
- from %ProgramFiles(x86)%\kddeskvis\shiboken2\is-l1vg5.tmp to %ProgramFiles(x86)%\kddeskvis\shiboken2\shiboken2.pyd
- from %ProgramFiles(x86)%\kddeskvis\imageformats\is-ga58a.tmp to %ProgramFiles(x86)%\kddeskvis\imageformats\qico4.dll
- from %ProgramFiles(x86)%\kddeskvis\imageformats\is-3bsvi.tmp to %ProgramFiles(x86)%\kddeskvis\imageformats\qgifd4.dll
- from %ProgramFiles(x86)%\kddeskvis\imageformats\is-upm3m.tmp to %ProgramFiles(x86)%\kddeskvis\imageformats\qgif4.dll
- from %ProgramFiles(x86)%\kddeskvis\is-sdbq5.tmp to %ProgramFiles(x86)%\kddeskvis\libffi-7.dll
- from %ProgramFiles(x86)%\kddeskvis\is-029l5.tmp to %ProgramFiles(x86)%\kddeskvis\libssl-1_1.dll
- from %ProgramFiles(x86)%\kddeskvis\is-4bdef.tmp to %ProgramFiles(x86)%\kddeskvis\pyexpat.pyd
- from %ProgramFiles(x86)%\kddeskvis\is-olh87.tmp to %ProgramFiles(x86)%\kddeskvis\python3.dll
- from %ProgramFiles(x86)%\kddeskvis\is-oq0h7.tmp to %ProgramFiles(x86)%\kddeskvis\pythoncom38.dll
- from %ProgramFiles(x86)%\kddeskvis\is-6q27f.tmp to %ProgramFiles(x86)%\kddeskvis\pywintypes38.dll
- from %ProgramFiles(x86)%\kddeskvis\is-1rt50.tmp to %ProgramFiles(x86)%\kddeskvis\select.pyd
- from %ProgramFiles(x86)%\kddeskvis\is-n37vt.tmp to %ProgramFiles(x86)%\kddeskvis\tagging.pyd
- from %ProgramFiles(x86)%\kddeskvis\is-6dral.tmp to %ProgramFiles(x86)%\kddeskvis\vcruntime140.dll
- from %ProgramFiles(x86)%\kddeskvis\is-iclln.tmp to %ProgramFiles(x86)%\kddeskvis\win32api.pyd
- from %ProgramFiles(x86)%\kddeskvis\is-dl1n9.tmp to %ProgramFiles(x86)%\kddeskvis\win32evtlog.pyd
- from %ProgramFiles(x86)%\kddeskvis\is-9ofid.tmp to %ProgramFiles(x86)%\kddeskvis\win32trace.pyd
- from %ProgramFiles(x86)%\kddeskvis\is-i4kq8.tmp to %ProgramFiles(x86)%\kddeskvis\win32wnet.pyd
- from %ProgramFiles(x86)%\kddeskvis\is-bgn2m.tmp to %ProgramFiles(x86)%\kddeskvis\_asyncio.pyd
- from %ProgramFiles(x86)%\kddeskvis\is-654qj.tmp to %ProgramFiles(x86)%\kddeskvis\kscol
- from %ProgramFiles(x86)%\kddeskvis\is-l2ij4.tmp to %ProgramFiles(x86)%\kddeskvis\_brotli.cp38-win32.pyd
- from %ProgramFiles(x86)%\kddeskvis\certifi\is-hcosi.tmp to %ProgramFiles(x86)%\kddeskvis\certifi\cacert.pem
- from %ProgramFiles(x86)%\kddeskvis\is-kll4g.tmp to %ProgramFiles(x86)%\kddeskvis\_bz2.pyd
- from %ProgramFiles(x86)%\kddeskvis\is-dt6nn.tmp to %ProgramFiles(x86)%\kddeskvis\_ctypes.pyd
- from %ProgramFiles(x86)%\kddeskvis\is-pfv53.tmp to %ProgramFiles(x86)%\kddeskvis\_decimal.pyd
- from %ProgramFiles(x86)%\kddeskvis\is-o43a6.tmp to %ProgramFiles(x86)%\kddeskvis\_elementtree.pyd
- from %ProgramFiles(x86)%\kddeskvis\is-p2ieu.tmp to %ProgramFiles(x86)%\kddeskvis\_hashlib.pyd
- from %ProgramFiles(x86)%\kddeskvis\is-uf9ur.tmp to %ProgramFiles(x86)%\kddeskvis\_lzma.pyd
- from %ProgramFiles(x86)%\kddeskvis\websockets\is-odppl.tmp to %ProgramFiles(x86)%\kddeskvis\websockets\speedups.cp38-win32.pyd
- from %ProgramFiles(x86)%\kddeskvis\is-4l27n.tmp to %ProgramFiles(x86)%\kddeskvis\_multiprocessing.pyd
- from %ProgramFiles(x86)%\kddeskvis\win32com\shell\is-k898e.tmp to %ProgramFiles(x86)%\kddeskvis\win32com\shell\shell.pyd
- from %ProgramFiles(x86)%\kddeskvis\is-sqkfc.tmp to %ProgramFiles(x86)%\kddeskvis\_socket.pyd
- from %ProgramFiles(x86)%\kddeskvis\is-rm699.tmp to %ProgramFiles(x86)%\kddeskvis\_sqlite3.pyd
- from %ProgramFiles(x86)%\kddeskvis\is-9gj55.tmp to %ProgramFiles(x86)%\kddeskvis\_ssl.pyd
- from %ProgramFiles(x86)%\kddeskvis\is-29ujp.tmp to %ProgramFiles(x86)%\kddeskvis\_testcapi.pyd
- from %ProgramFiles(x86)%\kddeskvis\is-2und1.tmp to %ProgramFiles(x86)%\kddeskvis\_win32sysloader.pyd
- from %ProgramFiles(x86)%\kddeskvis\is-e4jue.tmp to %ProgramFiles(x86)%\kddeskvis\_queue.pyd
- from %ProgramFiles(x86)%\kddeskvis\is-gu4uu.tmp to %ProgramFiles(x86)%\kddeskvis\kddeskvis.exe
Network activity
Connects to
- 'mi####njobs.works':80
TCP
HTTP GET requests
- http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?43######
HTTP POST requests
- http://mi####njobs.works/new/net_api
UDP
- DNS ASK mi####njobs.works
Miscellaneous
Searches for the following windows
- ClassName: 'H88421_kddv1141Class_H88421' WindowName: ''
Creates and executes the following
- '%TEMP%\is-7gog2.tmp\<File name>.tmp' /SL5="$50238,8362933,52224,<Full path to file>"
- '%ProgramFiles(x86)%\kddeskvis\kddeskvis.exe'
- '%ProgramFiles(x86)%\kddeskvis\kddeskvis.exe' 6e64c83546fe4dc417d686570b497a5b
Executes the following
- '%WINDIR%\syswow64\schtasks.exe' /Delete /F /TN "KDDV1104-2"
- '%WINDIR%\syswow64\schtasks.exe' /Query
