Technical Information
Modifies file system
Creates the following files
- %TEMP%\is-k6d28.tmp\<File name>.tmp
- %ProgramFiles(x86)%\daa recorder\pf\is-hu2os.tmp
- %ProgramFiles(x86)%\daa recorder\pf\is-itgar.tmp
- %ProgramFiles(x86)%\daa recorder\pf\is-mg23m.tmp
- %ProgramFiles(x86)%\daa recorder\pf\is-fq5pm.tmp
- %ProgramFiles(x86)%\daa recorder\pf\is-pp4uu.tmp
- %ProgramFiles(x86)%\daa recorder\is-71v1e.tmp
- %ProgramFiles(x86)%\daa recorder\lang\is-c9ohj.tmp
- %ProgramFiles(x86)%\daa recorder\lang\is-g1j9s.tmp
- %ProgramFiles(x86)%\daa recorder\lang\is-o7jmp.tmp
- %ProgramFiles(x86)%\daa recorder\lang\is-3n0i1.tmp
- %ProgramFiles(x86)%\daa recorder\lang\is-n107t.tmp
- %ProgramFiles(x86)%\daa recorder\pf\is-r5vib.tmp
- %ProgramFiles(x86)%\daa recorder\lang\is-s80i5.tmp
- %ProgramFiles(x86)%\daa recorder\lang\is-8t8dp.tmp
- %ProgramFiles(x86)%\daa recorder\lang\is-knems.tmp
- %ProgramFiles(x86)%\daa recorder\lang\is-jumlo.tmp
- %ProgramFiles(x86)%\daa recorder\lang\is-53doo.tmp
- %ProgramFiles(x86)%\daa recorder\lang\is-orjq0.tmp
- %ProgramFiles(x86)%\daa recorder\lang\is-i2ein.tmp
- %ProgramFiles(x86)%\daa recorder\lang\is-pt9bt.tmp
- %ProgramFiles(x86)%\daa recorder\lang\is-saerd.tmp
- %ProgramFiles(x86)%\daa recorder\lang\is-f0jfu.tmp
- %ProgramFiles(x86)%\daa recorder\lang\is-1o1jm.tmp
- %ProgramFiles(x86)%\daa recorder\lang\is-6ngvt.tmp
- %ProgramFiles(x86)%\daa recorder\lang\is-65oml.tmp
- %ProgramFiles(x86)%\daa recorder\audiences\is-lcq18.tmp
- %ProgramFiles(x86)%\daa recorder\daarecorder.exe
- %ProgramFiles(x86)%\daa recorder\pf\is-r81ia.tmp
- %ProgramFiles(x86)%\daa recorder\unins000.dat
- %ProgramFiles(x86)%\daa recorder\is-6k827.tmp
- %ProgramFiles(x86)%\daa recorder\audiences\is-lki05.tmp
- %ProgramFiles(x86)%\daa recorder\audiences\is-euf1j.tmp
- %ProgramFiles(x86)%\daa recorder\audiences\is-ijm3h.tmp
- %ProgramFiles(x86)%\daa recorder\audiences\is-121m5.tmp
- %ProgramFiles(x86)%\daa recorder\audiences\is-1jvab.tmp
- %ProgramFiles(x86)%\daa recorder\audiences\is-crkk7.tmp
- %ProgramFiles(x86)%\daa recorder\audiences\is-k7di8.tmp
- %ProgramFiles(x86)%\daa recorder\audiences\is-t8ara.tmp
- %ProgramFiles(x86)%\daa recorder\audiences\is-a4er6.tmp
- %ProgramFiles(x86)%\daa recorder\lang\is-imc0p.tmp
- %ProgramFiles(x86)%\daa recorder\audiences\is-21ro6.tmp
- %ProgramFiles(x86)%\daa recorder\audiences\is-1sbmt.tmp
- %ProgramFiles(x86)%\daa recorder\audiences\is-pnq6t.tmp
- %ProgramFiles(x86)%\daa recorder\audiences\is-mkr4o.tmp
- %ProgramFiles(x86)%\daa recorder\pf\is-9sueo.tmp
- %ProgramFiles(x86)%\daa recorder\pf\is-dsg27.tmp
- %ProgramFiles(x86)%\daa recorder\pf\is-tk25o.tmp
- %ProgramFiles(x86)%\daa recorder\pf\is-hhu54.tmp
- %ProgramFiles(x86)%\daa recorder\pf\is-a21t1.tmp
- %ProgramFiles(x86)%\daa recorder\pf\is-76haf.tmp
- %ProgramFiles(x86)%\daa recorder\pf\is-ehgk0.tmp
- %ProgramFiles(x86)%\daa recorder\pf\is-l2uoi.tmp
- %ProgramFiles(x86)%\daa recorder\pf\is-o1qht.tmp
- %ProgramFiles(x86)%\daa recorder\pf\is-0r0gu.tmp
- %ProgramFiles(x86)%\daa recorder\lang\is-g0lsq.tmp
- %ProgramFiles(x86)%\daa recorder\is-sa6ql.tmp
- %ProgramFiles(x86)%\daa recorder\is-ksi5i.tmp
- %ProgramFiles(x86)%\daa recorder\is-7lcs6.tmp
- %ProgramFiles(x86)%\daa recorder\is-82i15.tmp
- %ProgramFiles(x86)%\daa recorder\is-6nsud.tmp
- %ProgramFiles(x86)%\daa recorder\is-it5t3.tmp
- %ProgramFiles(x86)%\daa recorder\is-maufs.tmp
- %ProgramFiles(x86)%\daa recorder\is-sbqr9.tmp
- %ProgramFiles(x86)%\daa recorder\is-fb8nd.tmp
- %ProgramFiles(x86)%\daa recorder\is-2q19t.tmp
- %ProgramFiles(x86)%\daa recorder\is-0pob1.tmp
- %ProgramFiles(x86)%\daa recorder\is-cqsda.tmp
- %ProgramFiles(x86)%\daa recorder\is-8nfvm.tmp
- %ProgramFiles(x86)%\daa recorder\is-v0ii1.tmp
- %ProgramFiles(x86)%\daa recorder\is-6u2mt.tmp
- %ProgramFiles(x86)%\daa recorder\is-j59vg.tmp
- %ProgramFiles(x86)%\daa recorder\is-5em9f.tmp
- %ProgramFiles(x86)%\daa recorder\is-vt10a.tmp
- %ProgramFiles(x86)%\daa recorder\is-trrgn.tmp
- %ProgramFiles(x86)%\daa recorder\is-fe7u2.tmp
- %TEMP%\is-ub6cv.tmp\_isetup\_iscrypt.dll
- %TEMP%\is-ub6cv.tmp\_isetup\_isdecmp.dll
- %TEMP%\is-ub6cv.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-ub6cv.tmp\_isetup\_setup64.tmp
- %TEMP%\is-ub6cv.tmp\_isetup\_regdll.tmp
- %ProgramFiles(x86)%\daa recorder\is-9hlq7.tmp
- %ProgramFiles(x86)%\daa recorder\is-v1bb2.tmp
- %ProgramFiles(x86)%\daa recorder\lang\is-oo4gv.tmp
- %ProgramFiles(x86)%\daa recorder\is-8gep1.tmp
- %ProgramFiles(x86)%\daa recorder\lang\is-1crf7.tmp
- %ProgramFiles(x86)%\daa recorder\lang\is-51h1t.tmp
- %ProgramFiles(x86)%\daa recorder\lang\is-qc7q3.tmp
- %ProgramFiles(x86)%\daa recorder\lang\is-ngjic.tmp
- %ProgramFiles(x86)%\daa recorder\is-47bgs.tmp
- %ProgramFiles(x86)%\daa recorder\is-t2cke.tmp
- %ProgramFiles(x86)%\daa recorder\is-te440.tmp
- %ProgramFiles(x86)%\daa recorder\microsoft.vc90.crt\is-9e0bc.tmp
- %ProgramFiles(x86)%\daa recorder\microsoft.vc90.crt\is-jtkk3.tmp
- %ProgramFiles(x86)%\daa recorder\microsoft.vc90.crt\is-mhbtm.tmp
- %ProgramFiles(x86)%\daa recorder\microsoft.vc90.crt\is-eq9s2.tmp
- %ProgramFiles(x86)%\daa recorder\lang\is-5l2m2.tmp
- %ProgramFiles(x86)%\daa recorder\is-22pn6.tmp
- %ProgramFiles(x86)%\daa recorder\is-rtnqs.tmp
- %ProgramFiles(x86)%\daa recorder\is-m9ceg.tmp
- %ProgramFiles(x86)%\daa recorder\is-nll52.tmp
- %ProgramFiles(x86)%\daa recorder\is-tqic1.tmp
- %ProgramFiles(x86)%\daa recorder\is-5n8t9.tmp
- %ProgramFiles(x86)%\daa recorder\is-t02bi.tmp
- %ProgramFiles(x86)%\daa recorder\is-m58o9.tmp
- %ProgramFiles(x86)%\daa recorder\is-5lch9.tmp
- %ProgramFiles(x86)%\daa recorder\is-saha4.tmp
- %ProgramFiles(x86)%\daa recorder\is-jr77h.tmp
- %ProgramFiles(x86)%\daa recorder\is-eh582.tmp
- %ProgramFiles(x86)%\daa recorder\is-74tql.tmp
- %TEMP%\license.txt
Deletes the following files
- %ProgramFiles(x86)%\daa recorder\microsoft.vc90.crt.manifest
- %ProgramFiles(x86)%\daa recorder\msvcm90.dll
- %ProgramFiles(x86)%\daa recorder\wait.gif
Moves the following files
- from %ProgramFiles(x86)%\daa recorder\is-fe7u2.tmp to %ProgramFiles(x86)%\daa recorder\unins000.exe
- from %ProgramFiles(x86)%\daa recorder\pf\is-hu2os.tmp to %ProgramFiles(x86)%\daa recorder\pf\au.pf
- from %ProgramFiles(x86)%\daa recorder\pf\is-itgar.tmp to %ProgramFiles(x86)%\daa recorder\pf\amr.pf
- from %ProgramFiles(x86)%\daa recorder\pf\is-mg23m.tmp to %ProgramFiles(x86)%\daa recorder\pf\aiff.pf
- from %ProgramFiles(x86)%\daa recorder\pf\is-fq5pm.tmp to %ProgramFiles(x86)%\daa recorder\pf\ac3.pf
- from %ProgramFiles(x86)%\daa recorder\pf\is-pp4uu.tmp to %ProgramFiles(x86)%\daa recorder\pf\aac.pf
- from %ProgramFiles(x86)%\daa recorder\lang\is-c9ohj.tmp to %ProgramFiles(x86)%\daa recorder\lang\index.ini
- from %ProgramFiles(x86)%\daa recorder\lang\is-g1j9s.tmp to %ProgramFiles(x86)%\daa recorder\lang\waverec_spanish.dat
- from %ProgramFiles(x86)%\daa recorder\lang\is-o7jmp.tmp to %ProgramFiles(x86)%\daa recorder\lang\waverec_russian.dat
- from %ProgramFiles(x86)%\daa recorder\lang\is-3n0i1.tmp to %ProgramFiles(x86)%\daa recorder\lang\waverec_portugues.dat
- from %ProgramFiles(x86)%\daa recorder\lang\is-n107t.tmp to %ProgramFiles(x86)%\daa recorder\lang\waverec_frence.dat
- from %ProgramFiles(x86)%\daa recorder\lang\is-s80i5.tmp to %ProgramFiles(x86)%\daa recorder\lang\waverec_italian.dat
- from %ProgramFiles(x86)%\daa recorder\lang\is-65oml.tmp to %ProgramFiles(x86)%\daa recorder\lang\waverec_english.dat
- from %ProgramFiles(x86)%\daa recorder\lang\is-8t8dp.tmp to %ProgramFiles(x86)%\daa recorder\lang\waverec_chinese(traditional).dat
- from %ProgramFiles(x86)%\daa recorder\lang\is-knems.tmp to %ProgramFiles(x86)%\daa recorder\lang\waverec_japanese.dat
- from %ProgramFiles(x86)%\daa recorder\lang\is-jumlo.tmp to %ProgramFiles(x86)%\daa recorder\lang\autosettings_spanish.dat
- from %ProgramFiles(x86)%\daa recorder\lang\is-53doo.tmp to %ProgramFiles(x86)%\daa recorder\lang\autosettings_russian.dat
- from %ProgramFiles(x86)%\daa recorder\lang\is-orjq0.tmp to %ProgramFiles(x86)%\daa recorder\lang\autosettings_portugues.dat
- from %ProgramFiles(x86)%\daa recorder\lang\is-i2ein.tmp to %ProgramFiles(x86)%\daa recorder\lang\autosettings_frence.dat
- from %ProgramFiles(x86)%\daa recorder\lang\is-pt9bt.tmp to %ProgramFiles(x86)%\daa recorder\lang\autosettings_italian.dat
- from %ProgramFiles(x86)%\daa recorder\lang\is-saerd.tmp to %ProgramFiles(x86)%\daa recorder\lang\autosettings_english.dat
- from %ProgramFiles(x86)%\daa recorder\lang\is-f0jfu.tmp to %ProgramFiles(x86)%\daa recorder\lang\autosettings_chinese(traditional).dat
- from %ProgramFiles(x86)%\daa recorder\pf\is-r5vib.tmp to %ProgramFiles(x86)%\daa recorder\pf\flac.pf
- from %ProgramFiles(x86)%\daa recorder\pf\is-0r0gu.tmp to %ProgramFiles(x86)%\daa recorder\pf\m4b.pf
- from %ProgramFiles(x86)%\daa recorder\audiences\is-lki05.tmp to %ProgramFiles(x86)%\daa recorder\audiences\2m surround stereo (vbr).rpad
- from %ProgramFiles(x86)%\daa recorder\pf\is-r81ia.tmp to %ProgramFiles(x86)%\daa recorder\pf\m4r.pf
- from %ProgramFiles(x86)%\daa recorder\audiences\is-euf1j.tmp to %ProgramFiles(x86)%\daa recorder\audiences\2m multichannel (vbr).rpad
- from %ProgramFiles(x86)%\daa recorder\audiences\is-ijm3h.tmp to %ProgramFiles(x86)%\daa recorder\audiences\2m download (vbr).rpad
- from %ProgramFiles(x86)%\daa recorder\audiences\is-121m5.tmp to %ProgramFiles(x86)%\daa recorder\audiences\28k dial-up.rpad
- from %ProgramFiles(x86)%\daa recorder\audiences\is-1jvab.tmp to %ProgramFiles(x86)%\daa recorder\audiences\26k substream for 56k dial-up.rpad
- from %ProgramFiles(x86)%\daa recorder\audiences\is-crkk7.tmp to %ProgramFiles(x86)%\daa recorder\audiences\256k dsl or cable.rpad
- from %ProgramFiles(x86)%\daa recorder\audiences\is-k7di8.tmp to %ProgramFiles(x86)%\daa recorder\audiences\1m surround stereo (vbr).rpad
- from %ProgramFiles(x86)%\daa recorder\audiences\is-t8ara.tmp to %ProgramFiles(x86)%\daa recorder\audiences\1m multichannel (vbr).rpad
- from %ProgramFiles(x86)%\daa recorder\audiences\is-a4er6.tmp to %ProgramFiles(x86)%\daa recorder\audiences\1m download (vbr).rpad
- from %ProgramFiles(x86)%\daa recorder\audiences\is-21ro6.tmp to %ProgramFiles(x86)%\daa recorder\audiences\16k substream for 28k dial-up.rpad
- from %ProgramFiles(x86)%\daa recorder\audiences\is-lcq18.tmp to %ProgramFiles(x86)%\daa recorder\audiences\150k lan.rpad
- from %ProgramFiles(x86)%\daa recorder\audiences\is-1sbmt.tmp to %ProgramFiles(x86)%\daa recorder\audiences\12k substream for 28k dial-up.rpad
- from %ProgramFiles(x86)%\daa recorder\audiences\is-pnq6t.tmp to %ProgramFiles(x86)%\daa recorder\audiences\128k dual isdn.rpad
- from %ProgramFiles(x86)%\daa recorder\audiences\is-mkr4o.tmp to %ProgramFiles(x86)%\daa recorder\audiences\100% quality download (vbr).rpad
- from %ProgramFiles(x86)%\daa recorder\pf\is-9sueo.tmp to %ProgramFiles(x86)%\daa recorder\pf\wma.pf
- from %ProgramFiles(x86)%\daa recorder\pf\is-dsg27.tmp to %ProgramFiles(x86)%\daa recorder\pf\wav.pf
- from %ProgramFiles(x86)%\daa recorder\pf\is-tk25o.tmp to %ProgramFiles(x86)%\daa recorder\pf\voc.pf
- from %ProgramFiles(x86)%\daa recorder\pf\is-hhu54.tmp to %ProgramFiles(x86)%\daa recorder\pf\ra.pf
- from %ProgramFiles(x86)%\daa recorder\pf\is-a21t1.tmp to %ProgramFiles(x86)%\daa recorder\pf\ogg.pf
- from %ProgramFiles(x86)%\daa recorder\pf\is-76haf.tmp to %ProgramFiles(x86)%\daa recorder\pf\mp3.pf
- from %ProgramFiles(x86)%\daa recorder\pf\is-ehgk0.tmp to %ProgramFiles(x86)%\daa recorder\pf\mp2.pf
- from %ProgramFiles(x86)%\daa recorder\pf\is-l2uoi.tmp to %ProgramFiles(x86)%\daa recorder\pf\mka.pf
- from %ProgramFiles(x86)%\daa recorder\lang\is-1o1jm.tmp to %ProgramFiles(x86)%\daa recorder\lang\autosettings_japanese.dat
- from %ProgramFiles(x86)%\daa recorder\pf\is-o1qht.tmp to %ProgramFiles(x86)%\daa recorder\pf\m4a.pf
- from %ProgramFiles(x86)%\daa recorder\lang\is-6ngvt.tmp to %ProgramFiles(x86)%\daa recorder\lang\audiorecorder.dat
- from %ProgramFiles(x86)%\daa recorder\is-eh582.tmp to %ProgramFiles(x86)%\daa recorder\rmvbencodesync.dll
- from %ProgramFiles(x86)%\daa recorder\is-sa6ql.tmp to %ProgramFiles(x86)%\daa recorder\recordaudio.dll
- from %ProgramFiles(x86)%\daa recorder\is-74tql.tmp to %ProgramFiles(x86)%\daa recorder\recodeaudiokernel_old.dll
- from %ProgramFiles(x86)%\daa recorder\is-8nfvm.tmp to %ProgramFiles(x86)%\daa recorder\recodeaudiokernel.dll
- from %ProgramFiles(x86)%\daa recorder\is-ksi5i.tmp to %ProgramFiles(x86)%\daa recorder\pthreadvc2.dll
- from %ProgramFiles(x86)%\daa recorder\is-7lcs6.tmp to %ProgramFiles(x86)%\daa recorder\pthreadgc2.dll
- from %ProgramFiles(x86)%\daa recorder\is-82i15.tmp to %ProgramFiles(x86)%\daa recorder\postproc-52.dll
- from %ProgramFiles(x86)%\daa recorder\is-6nsud.tmp to %ProgramFiles(x86)%\daa recorder\msvcm90.dll
- from %ProgramFiles(x86)%\daa recorder\is-it5t3.tmp to %ProgramFiles(x86)%\daa recorder\mp3player.dll
- from %ProgramFiles(x86)%\daa recorder\is-maufs.tmp to %ProgramFiles(x86)%\daa recorder\mp3infp.dll
- from %ProgramFiles(x86)%\daa recorder\is-sbqr9.tmp to %ProgramFiles(x86)%\daa recorder\microsoft.vc90.crt.manifest
- from %ProgramFiles(x86)%\daa recorder\is-fb8nd.tmp to %ProgramFiles(x86)%\daa recorder\mediaencoderimp.dll
- from %ProgramFiles(x86)%\daa recorder\is-2q19t.tmp to %ProgramFiles(x86)%\daa recorder\magicskin.dll
- from %ProgramFiles(x86)%\daa recorder\is-0pob1.tmp to %ProgramFiles(x86)%\daa recorder\loadernonelevator64.exe
- from %ProgramFiles(x86)%\daa recorder\is-cqsda.tmp to %ProgramFiles(x86)%\daa recorder\loadernonelevator32.exe
- from %ProgramFiles(x86)%\daa recorder\is-v0ii1.tmp to %ProgramFiles(x86)%\daa recorder\istask.dll
- from %ProgramFiles(x86)%\daa recorder\is-9hlq7.tmp to %ProgramFiles(x86)%\daa recorder\intelhw.dll
- from %ProgramFiles(x86)%\daa recorder\is-6u2mt.tmp to %ProgramFiles(x86)%\daa recorder\installhelp.dll
- from %ProgramFiles(x86)%\daa recorder\is-j59vg.tmp to %ProgramFiles(x86)%\daa recorder\gsdownload.dll
- from %ProgramFiles(x86)%\daa recorder\is-5em9f.tmp to %ProgramFiles(x86)%\daa recorder\gsarservice.exe
- from %ProgramFiles(x86)%\daa recorder\is-vt10a.tmp to %ProgramFiles(x86)%\daa recorder\avutil-52.dll
- from %ProgramFiles(x86)%\daa recorder\is-trrgn.tmp to %ProgramFiles(x86)%\daa recorder\avdevice-55.dll
- from %ProgramFiles(x86)%\daa recorder\is-8gep1.tmp to %ProgramFiles(x86)%\daa recorder\recwin7.dll
- from %ProgramFiles(x86)%\daa recorder\is-jr77h.tmp to %ProgramFiles(x86)%\daa recorder\screenhook.dll
- from %ProgramFiles(x86)%\daa recorder\lang\is-g0lsq.tmp to %ProgramFiles(x86)%\daa recorder\lang\russian.dat
- from %ProgramFiles(x86)%\daa recorder\is-saha4.tmp to %ProgramFiles(x86)%\daa recorder\servicectrl.dll
- from %ProgramFiles(x86)%\daa recorder\lang\is-5l2m2.tmp to %ProgramFiles(x86)%\daa recorder\lang\portugues.dat
- from %ProgramFiles(x86)%\daa recorder\lang\is-oo4gv.tmp to %ProgramFiles(x86)%\daa recorder\lang\frence.dat
- from %ProgramFiles(x86)%\daa recorder\lang\is-1crf7.tmp to %ProgramFiles(x86)%\daa recorder\lang\italian.dat
- from %ProgramFiles(x86)%\daa recorder\lang\is-51h1t.tmp to %ProgramFiles(x86)%\daa recorder\lang\english.dat
- from %ProgramFiles(x86)%\daa recorder\lang\is-qc7q3.tmp to %ProgramFiles(x86)%\daa recorder\lang\chinese(traditional).dat
- from %ProgramFiles(x86)%\daa recorder\lang\is-ngjic.tmp to %ProgramFiles(x86)%\daa recorder\lang\japanese.dat
- from %ProgramFiles(x86)%\daa recorder\is-47bgs.tmp to %ProgramFiles(x86)%\daa recorder\notips.mp3
- from %ProgramFiles(x86)%\daa recorder\microsoft.vc90.crt\is-9e0bc.tmp to %ProgramFiles(x86)%\daa recorder\microsoft.vc90.crt\msvcr90.dll
- from %ProgramFiles(x86)%\daa recorder\microsoft.vc90.crt\is-jtkk3.tmp to %ProgramFiles(x86)%\daa recorder\microsoft.vc90.crt\msvcp90.dll
- from %ProgramFiles(x86)%\daa recorder\microsoft.vc90.crt\is-mhbtm.tmp to %ProgramFiles(x86)%\daa recorder\microsoft.vc90.crt\msvcm90.dll
- from %ProgramFiles(x86)%\daa recorder\microsoft.vc90.crt\is-eq9s2.tmp to %ProgramFiles(x86)%\daa recorder\microsoft.vc90.crt\microsoft.vc90.crt.manifest
- from %ProgramFiles(x86)%\daa recorder\is-22pn6.tmp to %ProgramFiles(x86)%\daa recorder\xvidcore.dll
- from %ProgramFiles(x86)%\daa recorder\is-v1bb2.tmp to %ProgramFiles(x86)%\daa recorder\wmadecode.dll
- from %ProgramFiles(x86)%\daa recorder\is-rtnqs.tmp to %ProgramFiles(x86)%\daa recorder\webrtc.dll
- from %ProgramFiles(x86)%\daa recorder\is-m9ceg.tmp to %ProgramFiles(x86)%\daa recorder\waverec.dll
- from %ProgramFiles(x86)%\daa recorder\is-nll52.tmp to %ProgramFiles(x86)%\daa recorder\wait.gif
- from %ProgramFiles(x86)%\daa recorder\is-tqic1.tmp to %ProgramFiles(x86)%\daa recorder\verify.dll
- from %ProgramFiles(x86)%\daa recorder\is-5n8t9.tmp to %ProgramFiles(x86)%\daa recorder\ve64.dll
- from %ProgramFiles(x86)%\daa recorder\is-t02bi.tmp to %ProgramFiles(x86)%\daa recorder\ve32.dll
- from %ProgramFiles(x86)%\daa recorder\is-m58o9.tmp to %ProgramFiles(x86)%\daa recorder\swscale-2.dll
- from %ProgramFiles(x86)%\daa recorder\is-5lch9.tmp to %ProgramFiles(x86)%\daa recorder\swresample-0.dll
- from %ProgramFiles(x86)%\daa recorder\lang\is-imc0p.tmp to %ProgramFiles(x86)%\daa recorder\lang\spanish.dat
- from %ProgramFiles(x86)%\daa recorder\is-6k827.tmp to %ProgramFiles(x86)%\daa recorder\daarecorder.exe
Substitutes the following files
- %ProgramFiles(x86)%\daa recorder\microsoft.vc90.crt.manifest
- %ProgramFiles(x86)%\daa recorder\msvcm90.dll
- %ProgramFiles(x86)%\daa recorder\wait.gif
Network activity
Connects to
- 'mi####njobs.works':80
TCP
HTTP GET requests
- http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?43######
HTTP POST requests
- http://mi####njobs.works/new/net_api
UDP
- DNS ASK mi####njobs.works
Miscellaneous
Searches for the following windows
- ClassName: 'Ld7265_daa10251Class_Ld7265' WindowName: ''
Creates and executes the following
- '%TEMP%\is-k6d28.tmp\<File name>.tmp' /SL5="$70258,6976030,319488,<Full path to file>"
- '%ProgramFiles(x86)%\daa recorder\daarecorder.exe'
- '%ProgramFiles(x86)%\daa recorder\daarecorder.exe' bbf9ecd2a2065eff96e0e5d4b9b4e2fa
Executes the following
- '%WINDIR%\syswow64\schtasks.exe' /Delete /F /TN "DAAREC1025-1"
- '%WINDIR%\syswow64\schtasks.exe' /Query
