Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\softwareupdater
Modifies file system
Creates the following files
- %TEMP%\is-tonyaoxmng.tmp\<File name>.tmp
- %TEMP%\is-crg8f5sxce.tmp\_isetup\_setup64.tmp
- %LOCALAPPDATA%\microsoft\windowsapps\microsoft.pythonapp_tik10jdw20t2i\is-2n1kprrycz.tmp
- %LOCALAPPDATA%\microsoft\windowsapps\microsoft.pythonapp_tik10jdw20t2i\is-a2jj0hfwk6.tmp
- %LOCALAPPDATA%\microsoft\windowsapps\microsoft.pythonapp_tik10jdw20t2i\is-ozal7q2csc.tmp
- %LOCALAPPDATA%\microsoft\windowsapps\microsoft.pythonapp_tik10jdw20t2i\is-y07dn3gtlb.tmp
- %LOCALAPPDATA%\microsoft\windowsapps\microsoft.pythonapp_tik10jdw20t2i\is-ll5ptq14ct.tmp
- %LOCALAPPDATA%\microsoft\windowsapps\microsoft.pythonapp_tik10jdw20t2i\is-iwkgojvcsg.tmp
- %LOCALAPPDATA%\microsoft\windowsapps\microsoft.pythonapp_tik10jdw20t2i\is-rf6ey909zi.tmp
- %LOCALAPPDATA%\microsoft\windowsapps\microsoft.pythonapp_tik10jdw20t2i\is-48hg6polxj.tmp
- %LOCALAPPDATA%\microsoft\windowsapps\microsoft.pythonapp_tik10jdw20t2i\is-as3vgwrxf6.tmp
- %LOCALAPPDATA%\microsoft\windowsapps\microsoft.pythonapp_tik10jdw20t2i\is-eccut7ubp5.tmp
- %LOCALAPPDATA%\microsoft\windowsapps\microsoft.pythonapp_tik10jdw20t2i\is-7n4jh7qnbo.tmp
- %LOCALAPPDATA%\microsoft\windowsapps\microsoft.pythonapp_tik10jdw20t2i\is-u0gj4k5dp5.tmp
- %LOCALAPPDATA%\microsoft\windowsapps\microsoft.pythonapp_tik10jdw20t2i\is-mot7uwpk2d.tmp
- %LOCALAPPDATA%\microsoft\windowsapps\microsoft.pythonapp_tik10jdw20t2i\is-jcjh73ktgp.tmp
- %LOCALAPPDATA%\microsoft\windowsapps\microsoft.pythonapp_tik10jdw20t2i\is-po7ldylmis.tmp
- %LOCALAPPDATA%\microsoft\windowsapps\microsoft.pythonapp_tik10jdw20t2i\is-ia17eap6rk.tmp
- %LOCALAPPDATA%\microsoft\windowsapps\microsoft.pythonapp_tik10jdw20t2i\is-ah1s725iuv.tmp
- %LOCALAPPDATA%\microsoft\windowsapps\microsoft.pythonapp_tik10jdw20t2i\is-u7dhtmhsiu.tmp
- %LOCALAPPDATA%\microsoft\windowsapps\microsoft.pythonapp_tik10jdw20t2i\is-q3z0m277n0.tmp
- %LOCALAPPDATA%\microsoft\windowsapps\microsoft.pythonapp_tik10jdw20t2i\is-dhaels7n1n.tmp
- %LOCALAPPDATA%\microsoft\windowsapps\microsoft.pythonapp_tik10jdw20t2i\is-iilx4faheu.tmp
- %LOCALAPPDATA%\microsoft\windowsapps\microsoft.pythonapp_tik10jdw20t2i\is-e4xqh5yhvs.tmp
- %LOCALAPPDATA%\microsoft\windowsapps\microsoft.pythonapp_tik10jdw20t2i\is-u4a5dk2za7.tmp
- %LOCALAPPDATA%\microsoft\windowsapps\microsoft.pythonapp_tik10jdw20t2i\is-5kc150dg5y.tmp
- %LOCALAPPDATA%\microsoft\windowsapps\microsoft.pythonapp_tik10jdw20t2i\is-6xnosr4y6h.tmp
- %LOCALAPPDATA%\microsoft\windowsapps\microsoft.pythonapp_tik10jdw20t2i\is-8g1wqwlp5g.tmp
- %LOCALAPPDATA%\microsoft\windowsapps\microsoft.pythonapp_tik10jdw20t2i\is-os739klwnv.tmp
- %LOCALAPPDATA%\microsoft\windowsapps\microsoft.pythonapp_tik10jdw20t2i\is-bkzseoqmz7.tmp
- %LOCALAPPDATA%\microsoft\windowsapps\microsoft.pythonapp_tik10jdw20t2i\is-frkxhgkmll.tmp
- %LOCALAPPDATA%\microsoft\windowsapps\microsoft.pythonapp_tik10jdw20t2i\is-n77h6vz0hh.tmp
- %LOCALAPPDATA%\microsoft\windowsapps\microsoft.pythonapp_tik10jdw20t2i\is-2khzzupsxd.tmp
- %LOCALAPPDATA%\microsoft\windowsapps\microsoft.pythonapp_tik10jdw20t2i\is-t50kqlxlru.tmp
- %LOCALAPPDATA%\microsoft\windowsapps\microsoft.pythonapp_tik10jdw20t2i\is-9t8zh955w3.tmp
- %LOCALAPPDATA%\microsoft\windowsapps\microsoft.pythonapp_tik10jdw20t2i\is-5n1rw3hi93.tmp
- %LOCALAPPDATA%\microsoft\windowsapps\microsoft.pythonapp_tik10jdw20t2i\is-jxk66fz059.tmp
- %TEMP%\mq749pkh
- %TEMP%\t.xml
Deletes following files that it created itself
- %TEMP%\is-crg8f5sxce.tmp\_isetup\_setup64.tmp
- %TEMP%\is-tonyaoxmng.tmp\<File name>.tmp
- %TEMP%\mq749pkh
- %TEMP%\t.xml
Moves the following files
- from %LOCALAPPDATA%\microsoft\windowsapps\microsoft.pythonapp_tik10jdw20t2i\is-2n1kprrycz.tmp to %LOCALAPPDATA%\microsoft\windowsapps\microsoft.pythonapp_tik10jdw20t2i\libcrypto-3.dll
- from %LOCALAPPDATA%\microsoft\windowsapps\microsoft.pythonapp_tik10jdw20t2i\is-a2jj0hfwk6.tmp to %LOCALAPPDATA%\microsoft\windowsapps\microsoft.pythonapp_tik10jdw20t2i\libffi-8.dll
- from %LOCALAPPDATA%\microsoft\windowsapps\microsoft.pythonapp_tik10jdw20t2i\is-ozal7q2csc.tmp to %LOCALAPPDATA%\microsoft\windowsapps\microsoft.pythonapp_tik10jdw20t2i\libssl-3.dll
- from %LOCALAPPDATA%\microsoft\windowsapps\microsoft.pythonapp_tik10jdw20t2i\is-y07dn3gtlb.tmp to %LOCALAPPDATA%\microsoft\windowsapps\microsoft.pythonapp_tik10jdw20t2i\license.txt
- from %LOCALAPPDATA%\microsoft\windowsapps\microsoft.pythonapp_tik10jdw20t2i\is-ll5ptq14ct.tmp to %LOCALAPPDATA%\microsoft\windowsapps\microsoft.pythonapp_tik10jdw20t2i\pyexpat.pyd
- from %LOCALAPPDATA%\microsoft\windowsapps\microsoft.pythonapp_tik10jdw20t2i\is-iwkgojvcsg.tmp to %LOCALAPPDATA%\microsoft\windowsapps\microsoft.pythonapp_tik10jdw20t2i\python.cat
- from %LOCALAPPDATA%\microsoft\windowsapps\microsoft.pythonapp_tik10jdw20t2i\is-rf6ey909zi.tmp to %LOCALAPPDATA%\microsoft\windowsapps\microsoft.pythonapp_tik10jdw20t2i\python.exe
- from %LOCALAPPDATA%\microsoft\windowsapps\microsoft.pythonapp_tik10jdw20t2i\is-48hg6polxj.tmp to %LOCALAPPDATA%\microsoft\windowsapps\microsoft.pythonapp_tik10jdw20t2i\python3.dll
- from %LOCALAPPDATA%\microsoft\windowsapps\microsoft.pythonapp_tik10jdw20t2i\is-as3vgwrxf6.tmp to %LOCALAPPDATA%\microsoft\windowsapps\microsoft.pythonapp_tik10jdw20t2i\python311.dll
- from %LOCALAPPDATA%\microsoft\windowsapps\microsoft.pythonapp_tik10jdw20t2i\is-eccut7ubp5.tmp to %LOCALAPPDATA%\microsoft\windowsapps\microsoft.pythonapp_tik10jdw20t2i\python311.zip
- from %LOCALAPPDATA%\microsoft\windowsapps\microsoft.pythonapp_tik10jdw20t2i\is-7n4jh7qnbo.tmp to %LOCALAPPDATA%\microsoft\windowsapps\microsoft.pythonapp_tik10jdw20t2i\python311._pth
- from %LOCALAPPDATA%\microsoft\windowsapps\microsoft.pythonapp_tik10jdw20t2i\is-u0gj4k5dp5.tmp to %LOCALAPPDATA%\microsoft\windowsapps\microsoft.pythonapp_tik10jdw20t2i\pythonw.exe
- from %LOCALAPPDATA%\microsoft\windowsapps\microsoft.pythonapp_tik10jdw20t2i\is-mot7uwpk2d.tmp to %LOCALAPPDATA%\microsoft\windowsapps\microsoft.pythonapp_tik10jdw20t2i\run.pyw
- from %LOCALAPPDATA%\microsoft\windowsapps\microsoft.pythonapp_tik10jdw20t2i\is-jcjh73ktgp.tmp to %LOCALAPPDATA%\microsoft\windowsapps\microsoft.pythonapp_tik10jdw20t2i\select.pyd
- from %LOCALAPPDATA%\microsoft\windowsapps\microsoft.pythonapp_tik10jdw20t2i\is-po7ldylmis.tmp to %LOCALAPPDATA%\microsoft\windowsapps\microsoft.pythonapp_tik10jdw20t2i\sqlite3.dll
- from %LOCALAPPDATA%\microsoft\windowsapps\microsoft.pythonapp_tik10jdw20t2i\is-ia17eap6rk.tmp to %LOCALAPPDATA%\microsoft\windowsapps\microsoft.pythonapp_tik10jdw20t2i\unicodedata.pyd
- from %LOCALAPPDATA%\microsoft\windowsapps\microsoft.pythonapp_tik10jdw20t2i\is-ah1s725iuv.tmp to %LOCALAPPDATA%\microsoft\windowsapps\microsoft.pythonapp_tik10jdw20t2i\vcruntime140.dll
- from %LOCALAPPDATA%\microsoft\windowsapps\microsoft.pythonapp_tik10jdw20t2i\is-u7dhtmhsiu.tmp to %LOCALAPPDATA%\microsoft\windowsapps\microsoft.pythonapp_tik10jdw20t2i\vcruntime140_1.dll
- from %LOCALAPPDATA%\microsoft\windowsapps\microsoft.pythonapp_tik10jdw20t2i\is-q3z0m277n0.tmp to %LOCALAPPDATA%\microsoft\windowsapps\microsoft.pythonapp_tik10jdw20t2i\winsound.pyd
- from %LOCALAPPDATA%\microsoft\windowsapps\microsoft.pythonapp_tik10jdw20t2i\is-dhaels7n1n.tmp to %LOCALAPPDATA%\microsoft\windowsapps\microsoft.pythonapp_tik10jdw20t2i\_asyncio.pyd
- from %LOCALAPPDATA%\microsoft\windowsapps\microsoft.pythonapp_tik10jdw20t2i\is-iilx4faheu.tmp to %LOCALAPPDATA%\microsoft\windowsapps\microsoft.pythonapp_tik10jdw20t2i\_bz2.pyd
- from %LOCALAPPDATA%\microsoft\windowsapps\microsoft.pythonapp_tik10jdw20t2i\is-e4xqh5yhvs.tmp to %LOCALAPPDATA%\microsoft\windowsapps\microsoft.pythonapp_tik10jdw20t2i\_ctypes.pyd
- from %LOCALAPPDATA%\microsoft\windowsapps\microsoft.pythonapp_tik10jdw20t2i\is-u4a5dk2za7.tmp to %LOCALAPPDATA%\microsoft\windowsapps\microsoft.pythonapp_tik10jdw20t2i\_decimal.pyd
- from %LOCALAPPDATA%\microsoft\windowsapps\microsoft.pythonapp_tik10jdw20t2i\is-5kc150dg5y.tmp to %LOCALAPPDATA%\microsoft\windowsapps\microsoft.pythonapp_tik10jdw20t2i\_elementtree.pyd
- from %LOCALAPPDATA%\microsoft\windowsapps\microsoft.pythonapp_tik10jdw20t2i\is-6xnosr4y6h.tmp to %LOCALAPPDATA%\microsoft\windowsapps\microsoft.pythonapp_tik10jdw20t2i\_hashlib.pyd
- from %LOCALAPPDATA%\microsoft\windowsapps\microsoft.pythonapp_tik10jdw20t2i\is-8g1wqwlp5g.tmp to %LOCALAPPDATA%\microsoft\windowsapps\microsoft.pythonapp_tik10jdw20t2i\_lzma.pyd
- from %LOCALAPPDATA%\microsoft\windowsapps\microsoft.pythonapp_tik10jdw20t2i\is-os739klwnv.tmp to %LOCALAPPDATA%\microsoft\windowsapps\microsoft.pythonapp_tik10jdw20t2i\_msi.pyd
- from %LOCALAPPDATA%\microsoft\windowsapps\microsoft.pythonapp_tik10jdw20t2i\is-bkzseoqmz7.tmp to %LOCALAPPDATA%\microsoft\windowsapps\microsoft.pythonapp_tik10jdw20t2i\_multiprocessing.pyd
- from %LOCALAPPDATA%\microsoft\windowsapps\microsoft.pythonapp_tik10jdw20t2i\is-frkxhgkmll.tmp to %LOCALAPPDATA%\microsoft\windowsapps\microsoft.pythonapp_tik10jdw20t2i\_overlapped.pyd
- from %LOCALAPPDATA%\microsoft\windowsapps\microsoft.pythonapp_tik10jdw20t2i\is-n77h6vz0hh.tmp to %LOCALAPPDATA%\microsoft\windowsapps\microsoft.pythonapp_tik10jdw20t2i\_queue.pyd
- from %LOCALAPPDATA%\microsoft\windowsapps\microsoft.pythonapp_tik10jdw20t2i\is-2khzzupsxd.tmp to %LOCALAPPDATA%\microsoft\windowsapps\microsoft.pythonapp_tik10jdw20t2i\_socket.pyd
- from %LOCALAPPDATA%\microsoft\windowsapps\microsoft.pythonapp_tik10jdw20t2i\is-t50kqlxlru.tmp to %LOCALAPPDATA%\microsoft\windowsapps\microsoft.pythonapp_tik10jdw20t2i\_sqlite3.pyd
- from %LOCALAPPDATA%\microsoft\windowsapps\microsoft.pythonapp_tik10jdw20t2i\is-9t8zh955w3.tmp to %LOCALAPPDATA%\microsoft\windowsapps\microsoft.pythonapp_tik10jdw20t2i\_ssl.pyd
- from %LOCALAPPDATA%\microsoft\windowsapps\microsoft.pythonapp_tik10jdw20t2i\is-5n1rw3hi93.tmp to %LOCALAPPDATA%\microsoft\windowsapps\microsoft.pythonapp_tik10jdw20t2i\_uuid.pyd
- from %LOCALAPPDATA%\microsoft\windowsapps\microsoft.pythonapp_tik10jdw20t2i\is-jxk66fz059.tmp to %LOCALAPPDATA%\microsoft\windowsapps\microsoft.pythonapp_tik10jdw20t2i\_zoneinfo.pyd
Network activity
Connects to
- 'et#######ia.public.blastapi.io':443
- 'se####a.drpc.org':443
- 'rp##.#epolia.org':443
- 'et########epolia-rpc.publicnode.com':443
- 'se#####.gateway.tenderly.co':443
- 'po###on-rpc.com':443
- 'po########innet.public.blastapi.io':443
- 'po####n.drpc.org':443
- 'po####n.meowrpc.com':443
- 'po#######or-rpc.publicnode.com':443
- '1r#c.io':443
- 'po#####.blockpi.network':443
- 'et#.#erkle.io':443
- 'rp#.##h.gateway.fm':443
- 'et#.##amarpc.com':443
TCP
Other
- 'et#######et.public.blastapi.io':443
- 'et#.#rpc.org':443
- 'rp#.#epolia.org':443
- 'et######-rpc.publicnode.com':443
- 'ga####y.tenderly.co':443
- 'po###on-rpc.com':443
- 'po####n.meowrpc.com':443
- '1r#c.io':443
- 'po#####.blockpi.network':443
- 'et#.#erkle.io':443
- 'rp#.##h.gateway.fm':443
- 'et#.##amarpc.com':443
UDP
- DNS ASK et#######ia.public.blastapi.io
- DNS ASK se####a.drpc.org
- DNS ASK rp##.#epolia.org
- DNS ASK et########epolia-rpc.publicnode.com
- DNS ASK et#########polia.rpc.subquery.network
- DNS ASK se#####.gateway.tenderly.co
- DNS ASK rp#.#epolia.org
- DNS ASK ga####y.tenderly.co
- DNS ASK po###on-rpc.com
- DNS ASK po########innet.public.blastapi.io
- DNS ASK po####n.drpc.org
- DNS ASK po####n.meowrpc.com
- DNS ASK po#####.#pc.subquery.network
- DNS ASK po#######or-rpc.publicnode.com
- DNS ASK 1r#c.io
- DNS ASK po#####.blockpi.network
- DNS ASK et#.#erkle.io
- DNS ASK et#######et.public.blastapi.io
- DNS ASK rp#.##h.gateway.fm
- DNS ASK et#.#rpc.org
- DNS ASK et######.rpc.subquery.network
- DNS ASK et######-rpc.publicnode.com
- DNS ASK et#.##amarpc.com
- DNS ASK 1c6c4cdd560f963e.microsoft.com
Miscellaneous
Creates and executes the following
- '%TEMP%\is-tonyaoxmng.tmp\<File name>.tmp' /SL5="$D01F2,10195912,893952,<Full path to file>"
- '%LOCALAPPDATA%\microsoft\windowsapps\microsoft.pythonapp_tik10jdw20t2i\pythonw.exe' "%LOCALAPPDATA%\Microsoft\WindowsApps\Microsoft.PythonApp_tik10jdw20t2i\run.pyw"
Executes the following
- '<SYSTEM32>\schtasks.exe' /Create /F /TN SoftwareUpdater /XML %TEMP%\t.xml
- '<SYSTEM32>\cmd.exe' /c "ver"
- '%LOCALAPPDATA%\microsoft\windowsapps\microsoft.pythonapp_tik10jdw20t2i\pythonw.exe' "%LOCALAPPDATA%\Microsoft\WindowsApps\Microsoft.PythonApp_tik10jdw20t2i\run.pyw"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "ver"' (with hidden window)