Technical Information
Modifies file system
Creates the following files
- %TEMP%\is-7vpkt.tmp\is-vjf76.tmp
- %ProgramFiles(x86)%\regspacer629\skins\blue\is-1usfb.tmp
- %ProgramFiles(x86)%\regspacer629\skins\blue\is-2d2on.tmp
- %ProgramFiles(x86)%\regspacer629\skins\blue\is-ashdf.tmp
- %ProgramFiles(x86)%\regspacer629\skins\blue\is-q23g8.tmp
- %ProgramFiles(x86)%\regspacer629\skins\blue\is-2f78s.tmp
- %ProgramFiles(x86)%\regspacer629\skins\blue\is-9tn38.tmp
- %ProgramFiles(x86)%\regspacer629\skins\blue\is-0gl8v.tmp
- %ProgramFiles(x86)%\regspacer629\skins\blue\is-jmpvv.tmp
- %ProgramFiles(x86)%\regspacer629\skins\blue\is-k71lb.tmp
- %ProgramFiles(x86)%\regspacer629\skins\blue\is-mpjnk.tmp
- %ProgramFiles(x86)%\regspacer629\skins\blue\is-doc83.tmp
- %ProgramFiles(x86)%\regspacer629\skins\blue\is-vsrpv.tmp
- %ProgramFiles(x86)%\regspacer629\skins\blue\is-posn7.tmp
- %ProgramFiles(x86)%\regspacer629\skins\blue\is-ragk3.tmp
- %ProgramFiles(x86)%\regspacer629\skins\blue\is-tv2f4.tmp
- %ProgramFiles(x86)%\regspacer629\skins\blue\is-jjg5j.tmp
- %ProgramFiles(x86)%\regspacer629\skins\blue\is-lb04h.tmp
- %ProgramFiles(x86)%\regspacer629\skins\blue\is-72aov.tmp
- %ProgramFiles(x86)%\regspacer629\skins\blue\is-fqstd.tmp
- %ProgramFiles(x86)%\regspacer629\skins\blue\is-n84a9.tmp
- %ProgramFiles(x86)%\regspacer629\skins\blue\is-3dff6.tmp
- %ProgramFiles(x86)%\regspacer629\unins000.dat
- %ProgramFiles(x86)%\regspacer629\is-hltut.tmp
- %ProgramFiles(x86)%\regspacer629\is-r9kcu.tmp
- %ProgramFiles(x86)%\regspacer629\skins\blue\is-j99m6.tmp
- %ProgramFiles(x86)%\regspacer629\skins\blue\is-6rolg.tmp
- %ProgramFiles(x86)%\regspacer629\skins\blue\is-m8qtq.tmp
- %ProgramFiles(x86)%\regspacer629\skins\blue\is-oq7mu.tmp
- %ProgramFiles(x86)%\regspacer629\skins\blue\is-tadmd.tmp
- %ProgramFiles(x86)%\regspacer629\skins\blue\is-7r3no.tmp
- %ProgramFiles(x86)%\regspacer629\skins\blue\is-8afqs.tmp
- %ProgramFiles(x86)%\regspacer629\skins\blue\is-dj43o.tmp
- %ProgramFiles(x86)%\regspacer629\skins\blue\is-bvhqc.tmp
- %ProgramFiles(x86)%\regspacer629\skins\blue\is-ssbtu.tmp
- %ProgramFiles(x86)%\regspacer629\skins\blue\is-aco2a.tmp
- %ProgramFiles(x86)%\regspacer629\skins\blue\is-jj72k.tmp
- %ProgramFiles(x86)%\regspacer629\skins\blue\is-9s0ob.tmp
- %ProgramFiles(x86)%\regspacer629\skins\blue\is-0hhpb.tmp
- %ProgramFiles(x86)%\regspacer629\skins\blue\is-u1i4c.tmp
- %ProgramFiles(x86)%\regspacer629\skins\blue\is-jlemr.tmp
- %ProgramFiles(x86)%\regspacer629\skins\blue\is-6vj6a.tmp
- %ProgramFiles(x86)%\regspacer629\skins\blue\is-ogffu.tmp
- %ProgramFiles(x86)%\regspacer629\skins\blue\is-s5qu1.tmp
- %ProgramFiles(x86)%\regspacer629\skins\blue\is-61cnk.tmp
- %ProgramFiles(x86)%\regspacer629\skins\blue\is-nq3rp.tmp
- %ProgramFiles(x86)%\regspacer629\is-u7mne.tmp
- %ProgramFiles(x86)%\regspacer629\skins\blue\is-6e49f.tmp
- %ProgramFiles(x86)%\regspacer629\skins\blue\is-b7498.tmp
- %ProgramFiles(x86)%\regspacer629\skins\blue\is-1q83l.tmp
- %ProgramFiles(x86)%\regspacer629\config\is-ejfn6.tmp
- %ProgramFiles(x86)%\regspacer629\config\is-rb9ao.tmp
- %ProgramFiles(x86)%\regspacer629\config\is-t69ls.tmp
- %ProgramFiles(x86)%\regspacer629\config\is-ils6k.tmp
- %ProgramFiles(x86)%\regspacer629\config\is-hagqe.tmp
- %ProgramFiles(x86)%\regspacer629\is-3a263.tmp
- %ProgramFiles(x86)%\regspacer629\skins\blue\is-kf0p7.tmp
- %ProgramFiles(x86)%\regspacer629\is-2hrv9.tmp
- %ProgramFiles(x86)%\regspacer629\is-qfr8p.tmp
- %ProgramFiles(x86)%\regspacer629\is-olcqt.tmp
- %ProgramFiles(x86)%\regspacer629\is-rleej.tmp
- %TEMP%\is-d1j6c.tmp\_isetup\_iscrypt.dll
- %TEMP%\is-d1j6c.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-d1j6c.tmp\_isetup\_setup64.tmp
- %TEMP%\is-d1j6c.tmp\_isetup\_regdll.tmp
- %ProgramFiles(x86)%\regspacer629\regspacer629.exe
- %ProgramFiles(x86)%\regspacer629\skins\blue\is-tb5aj.tmp
- %ProgramFiles(x86)%\regspacer629\skins\blue\is-bhoc1.tmp
- %ProgramFiles(x86)%\regspacer629\skins\blue\is-p9549.tmp
- %ProgramFiles(x86)%\regspacer629\skins\blue\is-6ubvn.tmp
- %ProgramFiles(x86)%\regspacer629\skins\blue\is-8maps.tmp
- %ProgramFiles(x86)%\regspacer629\skins\blue\is-q1mih.tmp
- %ProgramFiles(x86)%\regspacer629\skins\blue\is-5v66n.tmp
- %ProgramFiles(x86)%\regspacer629\skins\blue\is-a71dq.tmp
- %ProgramFiles(x86)%\regspacer629\skins\blue\is-4s8q2.tmp
- %ProgramFiles(x86)%\regspacer629\skins\blue\is-d3e6c.tmp
- %ProgramFiles(x86)%\regspacer629\skins\blue\is-hg0c3.tmp
- %ProgramFiles(x86)%\regspacer629\skins\blue\is-8lik9.tmp
- %ProgramFiles(x86)%\regspacer629\skins\blue\is-7r1r5.tmp
- %ProgramFiles(x86)%\regspacer629\skins\blue\is-h6ngp.tmp
- %ProgramFiles(x86)%\regspacer629\skins\blue\is-2uh5v.tmp
- %ProgramFiles(x86)%\regspacer629\skins\blue\is-eqq8f.tmp
- %ProgramFiles(x86)%\regspacer629\skins\blue\is-2a1ld.tmp
- %ProgramFiles(x86)%\regspacer629\skins\blue\is-hcct1.tmp
- %ProgramFiles(x86)%\regspacer629\skins\blue\is-is2mk.tmp
- %ProgramFiles(x86)%\regspacer629\skins\blue\is-e2onj.tmp
- %ProgramFiles(x86)%\regspacer629\skins\blue\is-t4d51.tmp
- %ProgramFiles(x86)%\regspacer629\skins\blue\is-057ac.tmp
- %ProgramFiles(x86)%\regspacer629\skins\blue\is-5bm2t.tmp
- %APPDATA%\{846ee340-7039-11de-9d20-806e6f6e6963}\obp84kvtife.exe
Deletes the following files
- %ProgramFiles(x86)%\regspacer629\readme.txt
Moves the following files
- from %ProgramFiles(x86)%\regspacer629\is-rleej.tmp to %ProgramFiles(x86)%\regspacer629\unins000.exe
- from %ProgramFiles(x86)%\regspacer629\skins\blue\is-ashdf.tmp to %ProgramFiles(x86)%\regspacer629\skins\blue\label.jpg
- from %ProgramFiles(x86)%\regspacer629\skins\blue\is-q23g8.tmp to %ProgramFiles(x86)%\regspacer629\skins\blue\info_usual.jpg
- from %ProgramFiles(x86)%\regspacer629\skins\blue\is-2f78s.tmp to %ProgramFiles(x86)%\regspacer629\skins\blue\info_hover.jpg
- from %ProgramFiles(x86)%\regspacer629\skins\blue\is-9tn38.tmp to %ProgramFiles(x86)%\regspacer629\skins\blue\info_disabled.jpg
- from %ProgramFiles(x86)%\regspacer629\skins\blue\is-0gl8v.tmp to %ProgramFiles(x86)%\regspacer629\skins\blue\hvost.jpg
- from %ProgramFiles(x86)%\regspacer629\skins\blue\is-jmpvv.tmp to %ProgramFiles(x86)%\regspacer629\skins\blue\gradient_vert.jpg
- from %ProgramFiles(x86)%\regspacer629\skins\blue\is-fqstd.tmp to %ProgramFiles(x86)%\regspacer629\skins\blue\gradient_horiz.jpg
- from %ProgramFiles(x86)%\regspacer629\skins\blue\is-2d2on.tmp to %ProgramFiles(x86)%\regspacer629\skins\blue\label_a_1.jpg
- from %ProgramFiles(x86)%\regspacer629\skins\blue\is-ogffu.tmp to %ProgramFiles(x86)%\regspacer629\skins\blue\fon_statistic_hover.jpg
- from %ProgramFiles(x86)%\regspacer629\skins\blue\is-vsrpv.tmp to %ProgramFiles(x86)%\regspacer629\skins\blue\fon.jpg
- from %ProgramFiles(x86)%\regspacer629\skins\blue\is-posn7.tmp to %ProgramFiles(x86)%\regspacer629\skins\blue\edit_usual.jpg
- from %ProgramFiles(x86)%\regspacer629\skins\blue\is-ragk3.tmp to %ProgramFiles(x86)%\regspacer629\skins\blue\edit_hover.jpg
- from %ProgramFiles(x86)%\regspacer629\skins\blue\is-tv2f4.tmp to %ProgramFiles(x86)%\regspacer629\skins\blue\edit_disabled.jpg
- from %ProgramFiles(x86)%\regspacer629\skins\blue\is-jjg5j.tmp to %ProgramFiles(x86)%\regspacer629\skins\blue\delete_usual.jpg
- from %ProgramFiles(x86)%\regspacer629\skins\blue\is-lb04h.tmp to %ProgramFiles(x86)%\regspacer629\skins\blue\delete_hover.jpg
- from %ProgramFiles(x86)%\regspacer629\skins\blue\is-72aov.tmp to %ProgramFiles(x86)%\regspacer629\skins\blue\delete_disabled.jpg
- from %ProgramFiles(x86)%\regspacer629\skins\blue\is-doc83.tmp to %ProgramFiles(x86)%\regspacer629\skins\blue\fon_statistic.jpg
- from %ProgramFiles(x86)%\regspacer629\skins\blue\is-1usfb.tmp to %ProgramFiles(x86)%\regspacer629\skins\blue\label_a_2.jpg
- from %ProgramFiles(x86)%\regspacer629\skins\blue\is-mpjnk.tmp to %ProgramFiles(x86)%\regspacer629\skins\blue\label_sel.jpg
- from %ProgramFiles(x86)%\regspacer629\skins\blue\is-k71lb.tmp to %ProgramFiles(x86)%\regspacer629\skins\blue\leftandright.jpg
- from %ProgramFiles(x86)%\regspacer629\skins\blue\is-6rolg.tmp to %ProgramFiles(x86)%\regspacer629\skins\blue\unselect_disabled.jpg
- from %ProgramFiles(x86)%\regspacer629\skins\blue\is-m8qtq.tmp to %ProgramFiles(x86)%\regspacer629\skins\blue\ugol_left_top.jpg
- from %ProgramFiles(x86)%\regspacer629\skins\blue\is-oq7mu.tmp to %ProgramFiles(x86)%\regspacer629\skins\blue\ugol2_right_top.jpg
- from %ProgramFiles(x86)%\regspacer629\skins\blue\is-tadmd.tmp to %ProgramFiles(x86)%\regspacer629\skins\blue\ugol2_right_bottom.jpg
- from %ProgramFiles(x86)%\regspacer629\skins\blue\is-7r3no.tmp to %ProgramFiles(x86)%\regspacer629\skins\blue\ugol2_left_top.jpg
- from %ProgramFiles(x86)%\regspacer629\skins\blue\is-8afqs.tmp to %ProgramFiles(x86)%\regspacer629\skins\blue\ugol2_left_bottom.jpg
- from %ProgramFiles(x86)%\regspacer629\skins\blue\is-dj43o.tmp to %ProgramFiles(x86)%\regspacer629\skins\blue\topanddown2.jpg
- from %ProgramFiles(x86)%\regspacer629\skins\blue\is-bvhqc.tmp to %ProgramFiles(x86)%\regspacer629\skins\blue\topanddown.jpg
- from %ProgramFiles(x86)%\regspacer629\skins\blue\is-ssbtu.tmp to %ProgramFiles(x86)%\regspacer629\skins\blue\select_usual.jpg
- from %ProgramFiles(x86)%\regspacer629\skins\blue\is-aco2a.tmp to %ProgramFiles(x86)%\regspacer629\skins\blue\select_hover.jpg
- from %ProgramFiles(x86)%\regspacer629\skins\blue\is-jj72k.tmp to %ProgramFiles(x86)%\regspacer629\skins\blue\select_disabled.jpg
- from %ProgramFiles(x86)%\regspacer629\skins\blue\is-9s0ob.tmp to %ProgramFiles(x86)%\regspacer629\skins\blue\progress.jpg
- from %ProgramFiles(x86)%\regspacer629\skins\blue\is-0hhpb.tmp to %ProgramFiles(x86)%\regspacer629\skins\blue\point3.jpg
- from %ProgramFiles(x86)%\regspacer629\skins\blue\is-u1i4c.tmp to %ProgramFiles(x86)%\regspacer629\skins\blue\point2.jpg
- from %ProgramFiles(x86)%\regspacer629\skins\blue\is-jlemr.tmp to %ProgramFiles(x86)%\regspacer629\skins\blue\point.jpg
- from %ProgramFiles(x86)%\regspacer629\skins\blue\is-tb5aj.tmp to %ProgramFiles(x86)%\regspacer629\skins\blue\logo.jpg
- from %ProgramFiles(x86)%\regspacer629\skins\blue\is-3dff6.tmp to %ProgramFiles(x86)%\regspacer629\skins\blue\leftandright2.jpg
- from %ProgramFiles(x86)%\regspacer629\skins\blue\is-6vj6a.tmp to %ProgramFiles(x86)%\regspacer629\skins\blue\btn_ok_usual.jpg
- from %ProgramFiles(x86)%\regspacer629\skins\blue\is-j99m6.tmp to %ProgramFiles(x86)%\regspacer629\skins\blue\unselect_hover.jpg
- from %ProgramFiles(x86)%\regspacer629\skins\blue\is-s5qu1.tmp to %ProgramFiles(x86)%\regspacer629\skins\blue\btn_ok_hover.jpg
- from %ProgramFiles(x86)%\regspacer629\skins\blue\is-nq3rp.tmp to %ProgramFiles(x86)%\regspacer629\skins\blue\btn_cancel_hover.jpg
- from %ProgramFiles(x86)%\regspacer629\skins\blue\is-bhoc1.tmp to %ProgramFiles(x86)%\regspacer629\skins\blue\btncleanstop_hover.jpg
- from %ProgramFiles(x86)%\regspacer629\skins\blue\is-kf0p7.tmp to %ProgramFiles(x86)%\regspacer629\skins\blue\btnabout_usual.jpg
- from %ProgramFiles(x86)%\regspacer629\skins\blue\is-6ubvn.tmp to %ProgramFiles(x86)%\regspacer629\skins\blue\btnabout_hover.jpg
- from %ProgramFiles(x86)%\regspacer629\skins\blue\is-6e49f.tmp to %ProgramFiles(x86)%\regspacer629\skins\blue\btnabout_disabled.jpg
- from %ProgramFiles(x86)%\regspacer629\skins\blue\is-b7498.tmp to %ProgramFiles(x86)%\regspacer629\skins\blue\add_usual.jpg
- from %ProgramFiles(x86)%\regspacer629\skins\blue\is-1q83l.tmp to %ProgramFiles(x86)%\regspacer629\skins\blue\add_hover.jpg
- from %ProgramFiles(x86)%\regspacer629\config\is-ejfn6.tmp to %ProgramFiles(x86)%\regspacer629\config\usrtempdirs.dat
- from %ProgramFiles(x86)%\regspacer629\skins\blue\is-n84a9.tmp to %ProgramFiles(x86)%\regspacer629\skins\blue\btncleanstop_usual.jpg
- from %ProgramFiles(x86)%\regspacer629\config\is-rb9ao.tmp to %ProgramFiles(x86)%\regspacer629\config\settings.dat
- from %ProgramFiles(x86)%\regspacer629\config\is-ils6k.tmp to %ProgramFiles(x86)%\regspacer629\config\exclusions.dat
- from %ProgramFiles(x86)%\regspacer629\config\is-hagqe.tmp to %ProgramFiles(x86)%\regspacer629\config\exclusiondirs.dat
- from %ProgramFiles(x86)%\regspacer629\is-u7mne.tmp to %ProgramFiles(x86)%\regspacer629\readme.txt
- from %ProgramFiles(x86)%\regspacer629\is-3a263.tmp to %ProgramFiles(x86)%\regspacer629\notify.wav
- from %ProgramFiles(x86)%\regspacer629\is-2hrv9.tmp to %ProgramFiles(x86)%\regspacer629\history.txt
- from %ProgramFiles(x86)%\regspacer629\is-qfr8p.tmp to %ProgramFiles(x86)%\regspacer629\backup_u.dll
- from %ProgramFiles(x86)%\regspacer629\is-olcqt.tmp to %ProgramFiles(x86)%\regspacer629\backup_c.dll
- from %ProgramFiles(x86)%\regspacer629\config\is-t69ls.tmp to %ProgramFiles(x86)%\regspacer629\config\filemask.dat
- from %ProgramFiles(x86)%\regspacer629\skins\blue\is-5bm2t.tmp to %ProgramFiles(x86)%\regspacer629\skins\blue\btnclean_disabled.jpg
- from %ProgramFiles(x86)%\regspacer629\skins\blue\is-p9549.tmp to %ProgramFiles(x86)%\regspacer629\skins\blue\btnclean_hover.jpg
- from %ProgramFiles(x86)%\regspacer629\skins\blue\is-057ac.tmp to %ProgramFiles(x86)%\regspacer629\skins\blue\btnclean_usual.jpg
- from %ProgramFiles(x86)%\regspacer629\skins\blue\is-8maps.tmp to %ProgramFiles(x86)%\regspacer629\skins\blue\btnstop_usual.jpg
- from %ProgramFiles(x86)%\regspacer629\skins\blue\is-q1mih.tmp to %ProgramFiles(x86)%\regspacer629\skins\blue\btnstop_hover.jpg
- from %ProgramFiles(x86)%\regspacer629\skins\blue\is-5v66n.tmp to %ProgramFiles(x86)%\regspacer629\skins\blue\btnstatistic_usual.jpg
- from %ProgramFiles(x86)%\regspacer629\skins\blue\is-a71dq.tmp to %ProgramFiles(x86)%\regspacer629\skins\blue\btnstatistic_hover.jpg
- from %ProgramFiles(x86)%\regspacer629\skins\blue\is-4s8q2.tmp to %ProgramFiles(x86)%\regspacer629\skins\blue\btnstatistic_disabled.jpg
- from %ProgramFiles(x86)%\regspacer629\skins\blue\is-d3e6c.tmp to %ProgramFiles(x86)%\regspacer629\skins\blue\btnsettings_usual.jpg
- from %ProgramFiles(x86)%\regspacer629\skins\blue\is-hg0c3.tmp to %ProgramFiles(x86)%\regspacer629\skins\blue\btnsettings_hover.jpg
- from %ProgramFiles(x86)%\regspacer629\skins\blue\is-8lik9.tmp to %ProgramFiles(x86)%\regspacer629\skins\blue\btnsettings_disabled.jpg
- from %ProgramFiles(x86)%\regspacer629\skins\blue\is-7r1r5.tmp to %ProgramFiles(x86)%\regspacer629\skins\blue\btnsearch_usual.jpg
- from %ProgramFiles(x86)%\regspacer629\skins\blue\is-h6ngp.tmp to %ProgramFiles(x86)%\regspacer629\skins\blue\btnsearch_hover.jpg
- from %ProgramFiles(x86)%\regspacer629\skins\blue\is-2uh5v.tmp to %ProgramFiles(x86)%\regspacer629\skins\blue\btnsearch_disabled.jpg
- from %ProgramFiles(x86)%\regspacer629\skins\blue\is-eqq8f.tmp to %ProgramFiles(x86)%\regspacer629\skins\blue\btnexit_usual.jpg
- from %ProgramFiles(x86)%\regspacer629\skins\blue\is-2a1ld.tmp to %ProgramFiles(x86)%\regspacer629\skins\blue\btnexit_hover.jpg
- from %ProgramFiles(x86)%\regspacer629\skins\blue\is-hcct1.tmp to %ProgramFiles(x86)%\regspacer629\skins\blue\btnexclus_usual.jpg
- from %ProgramFiles(x86)%\regspacer629\skins\blue\is-is2mk.tmp to %ProgramFiles(x86)%\regspacer629\skins\blue\btnexclus_hover.jpg
- from %ProgramFiles(x86)%\regspacer629\skins\blue\is-e2onj.tmp to %ProgramFiles(x86)%\regspacer629\skins\blue\btnclose_usual.jpg
- from %ProgramFiles(x86)%\regspacer629\skins\blue\is-t4d51.tmp to %ProgramFiles(x86)%\regspacer629\skins\blue\btnclose_hover.jpg
- from %ProgramFiles(x86)%\regspacer629\skins\blue\is-61cnk.tmp to %ProgramFiles(x86)%\regspacer629\skins\blue\btn_cancel_usual.jpg
- from %ProgramFiles(x86)%\regspacer629\is-hltut.tmp to %ProgramFiles(x86)%\regspacer629\regspacer629.exe
Substitutes the following files
- %ProgramFiles(x86)%\regspacer629\readme.txt
Network activity
Connects to
- '45.##.253.56':80
Miscellaneous
Searches for the following windows
- ClassName: 'z7fb59_RegSpacer629Class_z7fb59' WindowName: ''
Creates and executes the following
- '%TEMP%\is-7vpkt.tmp\is-vjf76.tmp' /SL4 $B0236 "<Full path to file>" 1098632 54784
- '%ProgramFiles(x86)%\regspacer629\regspacer629.exe'
- '%APPDATA%\{846ee340-7039-11de-9d20-806e6f6e6963}\obp84kvtife.exe'
Executes the following
- '%WINDIR%\syswow64\net.exe' helpmsg 29
- '%WINDIR%\syswow64\net1.exe' helpmsg 29