Trojan.Siggen32.27302

Technical Information

To ensure autorun and distribution

Creates or modifies the following files

<SYSTEM32>\tasks\software updater skipuac(user)
<SYSTEM32>\tasks\software updater scheduler
<SYSTEM32>\tasks\su_autoupdate

Malicious functions

Executes the following

'%WINDIR%\syswow64\taskkill.exe' -f -im SoftwareUpdater.exe
'%WINDIR%\syswow64\taskkill.exe' -f -im SUInit.exe

Injects code into

the following system processes:

%WINDIR%\explorer.exe

Patches code

in dll

softwareupdater.exe process, vcl120.bpl module
carescan.exe process, vcl120.bpl module

Modifies file system

Creates the following files

%TEMP%\aut6bc5.tmp
%TEMP%\ghost\banner.jpg
%TEMP%\ghost\setup.exe
%TEMP%\is-ablqj.tmp\setup.tmp
%TEMP%\is-tsbbl.tmp\_isetup\_setup64.tmp
%TEMP%\is-tsbbl.tmp\_isetup\_shfoldr.dll
%TEMP%\is-tsbbl.tmp\rdzone.dll
%TEMP%\is-tsbbl.tmp\inno_english.lng
%TEMP%\is-tsbbl.tmp\suinit.exe
%TEMP%\is-tsbbl.tmp\suinstaller\suinitrun.exe
%ALLUSERSPROFILE%\iobit\install.ini
%APPDATA%\iobit\software updater\main.ini
%APPDATA%\iobit\software updater\log\2026-03-01.dbg
%ProgramFiles(x86)%\iobit\software updater\is-soqvo.tmp
%ProgramFiles(x86)%\iobit\software updater\is-l962d.tmp
%ProgramFiles(x86)%\iobit\software updater\is-5am71.tmp
%ProgramFiles(x86)%\iobit\software updater\is-50aia.tmp
%ProgramFiles(x86)%\iobit\software updater\is-cfafu.tmp
%ProgramFiles(x86)%\iobit\software updater\is-ilkud.tmp
%ProgramFiles(x86)%\iobit\software updater\is-v079v.tmp
%ProgramFiles(x86)%\iobit\software updater\database\is-kn1k3.tmp
%ProgramFiles(x86)%\iobit\software updater\database\is-cb5nr.tmp
%ProgramFiles(x86)%\iobit\software updater\database\is-vj50t.tmp
%ProgramFiles(x86)%\iobit\software updater\icons\is-m9utg.tmp
%ProgramFiles(x86)%\iobit\software updater\icons\is-otroo.tmp
%ProgramFiles(x86)%\iobit\software updater\language\is-6usu6.tmp
%ProgramFiles(x86)%\iobit\software updater\language\is-jsvbm.tmp
%ProgramFiles(x86)%\iobit\software updater\language\is-9a2ac.tmp
%ProgramFiles(x86)%\iobit\software updater\language\is-20bc2.tmp
%ProgramFiles(x86)%\iobit\software updater\language\is-883to.tmp
%ProgramFiles(x86)%\iobit\software updater\language\is-5pv4f.tmp
%ProgramFiles(x86)%\iobit\software updater\language\is-40hda.tmp
%ProgramFiles(x86)%\iobit\software updater\language\is-kj7tp.tmp
%ProgramFiles(x86)%\iobit\software updater\language\is-am859.tmp
%ProgramFiles(x86)%\iobit\software updater\language\is-1tvl1.tmp
%ProgramFiles(x86)%\iobit\software updater\language\is-6icn3.tmp
%ProgramFiles(x86)%\iobit\software updater\language\is-eoc1j.tmp
%ProgramFiles(x86)%\iobit\software updater\language\is-eu6nf.tmp
%ProgramFiles(x86)%\iobit\software updater\language\is-ncab3.tmp
%ProgramFiles(x86)%\iobit\software updater\language\is-flrce.tmp
%ProgramFiles(x86)%\iobit\software updater\language\is-1rjfb.tmp
%ProgramFiles(x86)%\iobit\software updater\language\is-rb2b5.tmp
%ProgramFiles(x86)%\iobit\software updater\language\is-bb4oe.tmp
%ProgramFiles(x86)%\iobit\software updater\language\is-cjh63.tmp
%ProgramFiles(x86)%\iobit\software updater\language\is-8op2n.tmp
%ProgramFiles(x86)%\iobit\software updater\language\is-8rpb1.tmp
%ProgramFiles(x86)%\iobit\software updater\language\is-fnuip.tmp
%ProgramFiles(x86)%\iobit\software updater\language\is-ockgr.tmp
%ProgramFiles(x86)%\iobit\software updater\language\is-9qkrf.tmp
%ProgramFiles(x86)%\iobit\software updater\language\is-atrlr.tmp
%ProgramFiles(x86)%\iobit\software updater\language\is-0cvjt.tmp
%ProgramFiles(x86)%\iobit\software updater\language\is-rm4de.tmp
%ProgramFiles(x86)%\iobit\software updater\language\is-s2ptc.tmp
%ProgramFiles(x86)%\iobit\software updater\language\is-7l0uc.tmp
%ProgramFiles(x86)%\iobit\software updater\language\is-i7lph.tmp
%ProgramFiles(x86)%\iobit\software updater\language\is-6ougj.tmp
%ProgramFiles(x86)%\iobit\software updater\language\is-fakg6.tmp
%ProgramFiles(x86)%\iobit\software updater\language\is-tvubb.tmp
%ProgramFiles(x86)%\iobit\software updater\language\is-8035e.tmp
%ProgramFiles(x86)%\iobit\software updater\language\is-77533.tmp
%ProgramFiles(x86)%\iobit\software updater\language\is-ud7vk.tmp
%ProgramFiles(x86)%\iobit\software updater\skin\is-v9snh.tmp
%ProgramFiles(x86)%\iobit\software updater\skin\is-81btb.tmp
%ProgramFiles(x86)%\iobit\software updater\is-2m51l.tmp
%ProgramFiles(x86)%\iobit\software updater\is-racre.tmp
%ProgramFiles(x86)%\iobit\software updater\is-9pehl.tmp
%ProgramFiles(x86)%\iobit\software updater\is-mj4b1.tmp
%ProgramFiles(x86)%\iobit\software updater\is-8drt1.tmp
%ProgramFiles(x86)%\iobit\software updater\is-ciend.tmp
%ProgramFiles(x86)%\iobit\software updater\is-pc5sg.tmp
%ProgramFiles(x86)%\iobit\software updater\is-03us7.tmp
%ProgramFiles(x86)%\iobit\software updater\is-istq1.tmp
%ProgramFiles(x86)%\iobit\software updater\is-rbab9.tmp
%ProgramFiles(x86)%\iobit\software updater\is-cfaeq.tmp
%ProgramFiles(x86)%\iobit\software updater\is-74q2m.tmp
%ProgramFiles(x86)%\iobit\software updater\is-r1rha.tmp
%ProgramFiles(x86)%\iobit\software updater\is-pubip.tmp
%ProgramFiles(x86)%\iobit\software updater\is-25fj9.tmp
%ProgramFiles(x86)%\iobit\software updater\is-h5ek5.tmp
%ProgramFiles(x86)%\iobit\software updater\is-6p8fm.tmp
%ProgramFiles(x86)%\iobit\software updater\is-hvbdl.tmp
%ProgramFiles(x86)%\iobit\software updater\is-v9a8o.tmp
%ProgramFiles(x86)%\iobit\software updater\is-m1tad.tmp
%ProgramFiles(x86)%\iobit\software updater\is-410lt.tmp
%ProgramFiles(x86)%\iobit\software updater\is-hsdvm.tmp
%ProgramFiles(x86)%\iobit\software updater\is-ft71t.tmp
%ProgramFiles(x86)%\iobit\software updater\is-tgt35.tmp
%ProgramFiles(x86)%\iobit\software updater\is-a0eom.tmp
%ProgramFiles(x86)%\iobit\software updater\is-p70gk.tmp
%ProgramFiles(x86)%\iobit\software updater\is-2o05g.tmp
%ProgramFiles(x86)%\iobit\software updater\update\is-u3906.tmp
%ProgramFiles(x86)%\iobit\software updater\taskbarpin\is-25i0q.tmp
%ProgramFiles(x86)%\iobit\software updater\taskbarpin\is-b5nc6.tmp
%ProgramFiles(x86)%\iobit\software updater\taskbarpin\is-3ujea.tmp
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\iobit software updater\iobit software updater.lnk
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\iobit software updater\uninstall iobit software updater.lnk
C:\users\public\desktop\iobit software updater.lnk
%ProgramFiles(x86)%\iobit\software updater\unins000.msg
%ProgramFiles(x86)%\iobit\software updater\unins000.dat
%ALLUSERSPROFILE%\pdinst.ini
%APPDATA%\microsoft\internet explorer\quick launch\user pinned\taskbar\iobit software updater.lnk
%ALLUSERSPROFILE%\iobit\iobitrtt\surtt.ept
%LOCALAPPDATA%low\iobit\ac.ini
%TEMP%\st.dbd
%ALLUSERSPROFILE%\productdata3\statcache3.db
%ALLUSERSPROFILE%\productdata3\isu\isu8stat3.ini
%ALLUSERSPROFILE%\productdata3\statcache3.po
%TEMP%\su.cfg.ini
%ProgramFiles(x86)%\iobit\software updater\scandata\config.ini
%LOCALAPPDATA%low\iobit\aupdate.ini
%ProgramFiles(x86)%\iobit\software updater\database\opt.dbd
%ProgramFiles(x86)%\iobit\software updater\database\reg.dbd
%ProgramFiles(x86)%\iobit\software updater\database\pritemp.dbd
%TEMP%\temp\zlb1592.tmp
%ProgramFiles(x86)%\iobit\software updater\update\update.ini.tmp
%APPDATA%\iobit\software updater\autolog\2026-03-01.dbg
%ProgramFiles(x86)%\iobit\software updater\update\update.ini
%TEMP%\smarinfotemp.dbd
%ProgramFiles(x86)%\iobit\software updater\update\temp\update\expslist.dat
%ProgramFiles(x86)%\iobit\software updater\database\smarupdateinfo.dbd
%TEMP%\smarupdateinfo.dbd
%TEMP%\aut3a42.tmp
%TEMP%\ghost\version.dll
%ProgramFiles(x86)%\iobit\software updater\version.dll
%ProgramFiles(x86)%\iobit\software updater\regdemoscan.log
%TEMP%\zlb5115.tmp
%TEMP%\zlb5136.tmp
%TEMP%\zlb5156.tmp
%TEMP%\zlb5157.tmp
%ProgramFiles(x86)%\iobit\software updater\regrunlog.log
%TEMP%\ascsr.del
%ProgramFiles(x86)%\iobit\software updater\zlb7664.tmp
%ProgramFiles(x86)%\iobit\software updater\zlb7675.tmp
%ProgramFiles(x86)%\iobit\software updater\zlb7676.tmp
%TEMP%\temp\zlb7b78.tmp
%APPDATA%\thunderbird\profiles\gbmwccb6.default-release\places.sqlite-shm

Deletes following files that it created itself

%TEMP%\aut6bc5.tmp
%TEMP%\is-tsbbl.tmp\inno_english.lng
%TEMP%\is-tsbbl.tmp\rdzone.dll
%TEMP%\is-tsbbl.tmp\suinit.exe
%TEMP%\is-tsbbl.tmp\suinstaller\suinitrun.exe
%TEMP%\is-tsbbl.tmp\_isetup\_setup64.tmp
%TEMP%\is-tsbbl.tmp\_isetup\_shfoldr.dll
%TEMP%\is-ablqj.tmp\setup.tmp
%ALLUSERSPROFILE%\productdata3\statcache3.po
%TEMP%\temp\zlb1592.tmp
%ProgramFiles(x86)%\iobit\software updater\update\update.ini.tmp
%TEMP%\smarinfotemp.dbd
%TEMP%\aut3a42.tmp
%TEMP%\zlb5115.tmp
%TEMP%\zlb5136.tmp
%TEMP%\zlb5156.tmp
%TEMP%\zlb5157.tmp
%TEMP%\ascsr.del
%ProgramFiles(x86)%\iobit\software updater\zlb7664.tmp
%ProgramFiles(x86)%\iobit\software updater\zlb7675.tmp
%ProgramFiles(x86)%\iobit\software updater\zlb7676.tmp
%TEMP%\temp\zlb7b78.tmp
%APPDATA%\thunderbird\profiles\gbmwccb6.default-release\places.sqlite-shm

Moves the following files

from %ProgramFiles(x86)%\iobit\software updater\is-soqvo.tmp to %ProgramFiles(x86)%\iobit\software updater\unins000.exe
from %ProgramFiles(x86)%\iobit\software updater\is-l962d.tmp to %ProgramFiles(x86)%\iobit\software updater\madbasic_.bpl
from %ProgramFiles(x86)%\iobit\software updater\is-5am71.tmp to %ProgramFiles(x86)%\iobit\software updater\maddisasm_.bpl
from %ProgramFiles(x86)%\iobit\software updater\is-50aia.tmp to %ProgramFiles(x86)%\iobit\software updater\madexcept_.bpl
from %ProgramFiles(x86)%\iobit\software updater\is-cfafu.tmp to %ProgramFiles(x86)%\iobit\software updater\rtl120.bpl
from %ProgramFiles(x86)%\iobit\software updater\is-ilkud.tmp to %ProgramFiles(x86)%\iobit\software updater\vcl120.bpl
from %ProgramFiles(x86)%\iobit\software updater\is-v079v.tmp to %ProgramFiles(x86)%\iobit\software updater\vclx120.bpl
from %ProgramFiles(x86)%\iobit\software updater\database\is-kn1k3.tmp to %ProgramFiles(x86)%\iobit\software updater\database\smarupdateicon.dbd
from %ProgramFiles(x86)%\iobit\software updater\database\is-cb5nr.tmp to %ProgramFiles(x86)%\iobit\software updater\database\smarupdateinfo.dbd
from %ProgramFiles(x86)%\iobit\software updater\database\is-vj50t.tmp to %ProgramFiles(x86)%\iobit\software updater\database\st.dbd
from %ProgramFiles(x86)%\iobit\software updater\icons\is-m9utg.tmp to %ProgramFiles(x86)%\iobit\software updater\icons\0.ico
from %ProgramFiles(x86)%\iobit\software updater\icons\is-otroo.tmp to %ProgramFiles(x86)%\iobit\software updater\icons\3+.ico
from %ProgramFiles(x86)%\iobit\software updater\language\is-6usu6.tmp to %ProgramFiles(x86)%\iobit\software updater\language\arabic.lng
from %ProgramFiles(x86)%\iobit\software updater\language\is-jsvbm.tmp to %ProgramFiles(x86)%\iobit\software updater\language\chinesesimp.lng
from %ProgramFiles(x86)%\iobit\software updater\language\is-9a2ac.tmp to %ProgramFiles(x86)%\iobit\software updater\language\chinesetrad.lng
from %ProgramFiles(x86)%\iobit\software updater\language\is-20bc2.tmp to %ProgramFiles(x86)%\iobit\software updater\language\croatian.lng
from %ProgramFiles(x86)%\iobit\software updater\language\is-883to.tmp to %ProgramFiles(x86)%\iobit\software updater\language\czech.lng
from %ProgramFiles(x86)%\iobit\software updater\language\is-5pv4f.tmp to %ProgramFiles(x86)%\iobit\software updater\language\danish.lng
from %ProgramFiles(x86)%\iobit\software updater\language\is-40hda.tmp to %ProgramFiles(x86)%\iobit\software updater\language\dutch.lng
from %ProgramFiles(x86)%\iobit\software updater\language\is-kj7tp.tmp to %ProgramFiles(x86)%\iobit\software updater\language\english.lng
from %ProgramFiles(x86)%\iobit\software updater\language\is-am859.tmp to %ProgramFiles(x86)%\iobit\software updater\language\finnish.lng
from %ProgramFiles(x86)%\iobit\software updater\language\is-1tvl1.tmp to %ProgramFiles(x86)%\iobit\software updater\language\flemish.lng
from %ProgramFiles(x86)%\iobit\software updater\language\is-6icn3.tmp to %ProgramFiles(x86)%\iobit\software updater\language\french.lng
from %ProgramFiles(x86)%\iobit\software updater\language\is-eoc1j.tmp to %ProgramFiles(x86)%\iobit\software updater\language\georgian.lng
from %ProgramFiles(x86)%\iobit\software updater\language\is-eu6nf.tmp to %ProgramFiles(x86)%\iobit\software updater\language\german.lng
from %ProgramFiles(x86)%\iobit\software updater\language\is-ncab3.tmp to %ProgramFiles(x86)%\iobit\software updater\language\greek.lng
from %ProgramFiles(x86)%\iobit\software updater\language\is-flrce.tmp to %ProgramFiles(x86)%\iobit\software updater\language\hebrew.lng
from %ProgramFiles(x86)%\iobit\software updater\language\is-1rjfb.tmp to %ProgramFiles(x86)%\iobit\software updater\language\hungarian.lng
from %ProgramFiles(x86)%\iobit\software updater\language\is-rb2b5.tmp to %ProgramFiles(x86)%\iobit\software updater\language\indonesian.lng
from %ProgramFiles(x86)%\iobit\software updater\language\is-bb4oe.tmp to %ProgramFiles(x86)%\iobit\software updater\language\italian.lng
from %ProgramFiles(x86)%\iobit\software updater\language\is-cjh63.tmp to %ProgramFiles(x86)%\iobit\software updater\language\japanese.lng
from %ProgramFiles(x86)%\iobit\software updater\language\is-8op2n.tmp to %ProgramFiles(x86)%\iobit\software updater\language\korean.lng
from %ProgramFiles(x86)%\iobit\software updater\language\is-8rpb1.tmp to %ProgramFiles(x86)%\iobit\software updater\language\malay.lng
from %ProgramFiles(x86)%\iobit\software updater\language\is-fnuip.tmp to %ProgramFiles(x86)%\iobit\software updater\language\norwegian.lng
from %ProgramFiles(x86)%\iobit\software updater\language\is-ockgr.tmp to %ProgramFiles(x86)%\iobit\software updater\language\polish.lng
from %ProgramFiles(x86)%\iobit\software updater\language\is-9qkrf.tmp to %ProgramFiles(x86)%\iobit\software updater\language\portuguese(pt-br).lng
from %ProgramFiles(x86)%\iobit\software updater\language\is-atrlr.tmp to %ProgramFiles(x86)%\iobit\software updater\language\portuguese(pt-pt).lng
from %ProgramFiles(x86)%\iobit\software updater\language\is-0cvjt.tmp to %ProgramFiles(x86)%\iobit\software updater\language\romanian.lng
from %ProgramFiles(x86)%\iobit\software updater\language\is-rm4de.tmp to %ProgramFiles(x86)%\iobit\software updater\language\russian.lng
from %ProgramFiles(x86)%\iobit\software updater\language\is-s2ptc.tmp to %ProgramFiles(x86)%\iobit\software updater\language\serbian(cyrillic).lng
from %ProgramFiles(x86)%\iobit\software updater\language\is-7l0uc.tmp to %ProgramFiles(x86)%\iobit\software updater\language\serbian(latin).lng
from %ProgramFiles(x86)%\iobit\software updater\language\is-i7lph.tmp to %ProgramFiles(x86)%\iobit\software updater\language\slovak.lng
from %ProgramFiles(x86)%\iobit\software updater\language\is-6ougj.tmp to %ProgramFiles(x86)%\iobit\software updater\language\slovenian.lng
from %ProgramFiles(x86)%\iobit\software updater\language\is-fakg6.tmp to %ProgramFiles(x86)%\iobit\software updater\language\spanish.lng
from %ProgramFiles(x86)%\iobit\software updater\language\is-tvubb.tmp to %ProgramFiles(x86)%\iobit\software updater\language\swedish.lng
from %ProgramFiles(x86)%\iobit\software updater\language\is-8035e.tmp to %ProgramFiles(x86)%\iobit\software updater\language\turkish.lng
from %ProgramFiles(x86)%\iobit\software updater\language\is-77533.tmp to %ProgramFiles(x86)%\iobit\software updater\language\ukrainian.lng
from %ProgramFiles(x86)%\iobit\software updater\language\is-ud7vk.tmp to %ProgramFiles(x86)%\iobit\software updater\language\vietnamese.lng
from %ProgramFiles(x86)%\iobit\software updater\skin\is-v9snh.tmp to %ProgramFiles(x86)%\iobit\software updater\skin\classic.rcc
from %ProgramFiles(x86)%\iobit\software updater\skin\is-81btb.tmp to %ProgramFiles(x86)%\iobit\software updater\skin\public.rcc
from %ProgramFiles(x86)%\iobit\software updater\is-2m51l.tmp to %ProgramFiles(x86)%\iobit\software updater\autoupdate.exe
from %ProgramFiles(x86)%\iobit\software updater\is-racre.tmp to %ProgramFiles(x86)%\iobit\software updater\carescan.exe
from %ProgramFiles(x86)%\iobit\software updater\is-9pehl.tmp to %ProgramFiles(x86)%\iobit\software updater\feedback.exe
from %ProgramFiles(x86)%\iobit\software updater\is-mj4b1.tmp to %ProgramFiles(x86)%\iobit\software updater\history.txt
from %ProgramFiles(x86)%\iobit\software updater\is-8drt1.tmp to %ProgramFiles(x86)%\iobit\software updater\infohelp.dll
from %ProgramFiles(x86)%\iobit\software updater\is-ciend.tmp to %ProgramFiles(x86)%\iobit\software updater\iobitdownloader.exe
from %ProgramFiles(x86)%\iobit\software updater\is-pc5sg.tmp to %ProgramFiles(x86)%\iobit\software updater\isutip.exe
from %ProgramFiles(x86)%\iobit\software updater\is-03us7.tmp to %ProgramFiles(x86)%\iobit\software updater\lang.dat
from %ProgramFiles(x86)%\iobit\software updater\is-istq1.tmp to %ProgramFiles(x86)%\iobit\software updater\libcrypto-1_1.dll
from %ProgramFiles(x86)%\iobit\software updater\is-rbab9.tmp to %ProgramFiles(x86)%\iobit\software updater\libssl-1_1.dll
from %ProgramFiles(x86)%\iobit\software updater\is-cfaeq.tmp to %ProgramFiles(x86)%\iobit\software updater\locallang.exe
from %ProgramFiles(x86)%\iobit\software updater\is-74q2m.tmp to %ProgramFiles(x86)%\iobit\software updater\productnews2.dll
from %ProgramFiles(x86)%\iobit\software updater\is-r1rha.tmp to %ProgramFiles(x86)%\iobit\software updater\productstat3.exe
from %ProgramFiles(x86)%\iobit\software updater\is-pubip.tmp to %ProgramFiles(x86)%\iobit\software updater\productstatistics3.dll
from %ProgramFiles(x86)%\iobit\software updater\is-25fj9.tmp to %ProgramFiles(x86)%\iobit\software updater\registercom.dll
from %ProgramFiles(x86)%\iobit\software updater\is-h5ek5.tmp to %ProgramFiles(x86)%\iobit\software updater\restore.exe
from %ProgramFiles(x86)%\iobit\software updater\is-6p8fm.tmp to %ProgramFiles(x86)%\iobit\software updater\scn.dll
from %ProgramFiles(x86)%\iobit\software updater\is-hvbdl.tmp to %ProgramFiles(x86)%\iobit\software updater\sendbugreportnew.exe
from %ProgramFiles(x86)%\iobit\software updater\is-v9a8o.tmp to %ProgramFiles(x86)%\iobit\software updater\setup.exe
from %ProgramFiles(x86)%\iobit\software updater\is-m1tad.tmp to %ProgramFiles(x86)%\iobit\software updater\softwareupdater.exe
from %ProgramFiles(x86)%\iobit\software updater\is-410lt.tmp to %ProgramFiles(x86)%\iobit\software updater\sqlite3.dll
from %ProgramFiles(x86)%\iobit\software updater\is-hsdvm.tmp to %ProgramFiles(x86)%\iobit\software updater\sufeature.exe
from %ProgramFiles(x86)%\iobit\software updater\is-ft71t.tmp to %ProgramFiles(x86)%\iobit\software updater\suinit.exe
from %ProgramFiles(x86)%\iobit\software updater\is-tgt35.tmp to %ProgramFiles(x86)%\iobit\software updater\sysrest.dll
from %ProgramFiles(x86)%\iobit\software updater\is-a0eom.tmp to %ProgramFiles(x86)%\iobit\software updater\uninstallpromote.exe
from %ProgramFiles(x86)%\iobit\software updater\is-p70gk.tmp to %ProgramFiles(x86)%\iobit\software updater\webres.dll
from %ProgramFiles(x86)%\iobit\software updater\is-2o05g.tmp to %ProgramFiles(x86)%\iobit\software updater\winid.dat
from %ProgramFiles(x86)%\iobit\software updater\update\is-u3906.tmp to %ProgramFiles(x86)%\iobit\software updater\update\update.ini
from %ProgramFiles(x86)%\iobit\software updater\taskbarpin\is-25i0q.tmp to %ProgramFiles(x86)%\iobit\software updater\taskbarpin\iconpin32.dll
from %ProgramFiles(x86)%\iobit\software updater\taskbarpin\is-b5nc6.tmp to %ProgramFiles(x86)%\iobit\software updater\taskbarpin\iconpin32.exe
from %ProgramFiles(x86)%\iobit\software updater\taskbarpin\is-3ujea.tmp to %ProgramFiles(x86)%\iobit\software updater\taskbarpin\iconpin64.exe

Modifies the following files

Substitutes the following files

%TEMP%\ascsr.del

Network activity

Connects to

'io##t.com':443
'10#.#1.38.38':80
'oc##.###tg2.amazontrust.com':80
'oc##.####ca1.amazontrust.com':80
'oc##.###04.amazontrust.com':80
'x1.#.lencr.org':80
'r1#.#.lencr.org':80
'st###.iobit.com':443
'up####.iobit.com':443

TCP

HTTP GET requests

http://oc##.###tg2.amazontrust.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBSIfaREXmfqfJR3TkMYnD7O5MhzEgQUnF8A36oB1zArOIiiuG1KnPIRkYMCEwZ%2FlEoqJ83z%2BsKuKwH5CO65xMY%3D
http://oc##.####ca1.amazontrust.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPWaOUU8%2B5VZ5%2Fa9jFTaU9pkK3FAQUhBjMhTTsvAyUlC4IWZzHshBOCggCEwdzEk8qlS4%2B0YpYvbhdG8DOXyc%3D
http://oc##.###04.amazontrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTihuFvpmFDw5hOcIp918Jm5B3CQgQUH1KSYVaCVH%2BBZtgdPQqqMlyH3QgCEA2%2Fjqs4vs4AHyDmFazy8O0%3D
http://x1.#.lencr.org/
http://r1#.#.lencr.org/49.crl

Other

'io##t.com':443
'cd#.#obit.com':443
'st###.iobit.com':443
'up####.iobit.com':443

UDP

DNS ASK io##t.com
DNS ASK oc##.###tg2.amazontrust.com
DNS ASK oc##.####ca1.amazontrust.com
DNS ASK oc##.###04.amazontrust.com
DNS ASK cd#.#obit.com
DNS ASK x1.#.lencr.org
DNS ASK r1#.#.lencr.org
DNS ASK st###.iobit.com
DNS ASK up####.iobit.com

Miscellaneous

Searches for the following windows

ClassName: '' WindowName: ''
ClassName: 'Progman' WindowName: ''
ClassName: 'BUTTON' WindowName: ''

Creates and executes the following

'%TEMP%\ghost\setup.exe' /sp- /verysilent /suppressmsgboxes /install_start
'%TEMP%\is-ablqj.tmp\setup.tmp' /SL5="$701DA,19933390,137216,%TEMP%\Ghost\Setup.exe" /sp- /verysilent /suppressmsgboxes /install_start
'%TEMP%\is-tsbbl.tmp\suinstaller\suinitrun.exe' /update_init
'%ProgramFiles(x86)%\iobit\software updater\locallang.exe'
'%ProgramFiles(x86)%\iobit\software updater\suinit.exe' /INSTALL /CreateTaskbar /update
'%ProgramFiles(x86)%\iobit\software updater\setup.exe' /SilenceCall
'%ProgramFiles(x86)%\iobit\software updater\taskbarpin\iconpin64.exe' Pin "%ProgramFiles(x86)%\IObit\Software Updater\SoftwareUpdater.exe"
'%ProgramFiles(x86)%\iobit\software updater\softwareupdater.exe' /INSTALL /CreateTaskbar /update
'%ProgramFiles(x86)%\iobit\software updater\setup.exe' /ScriptCall
'%ProgramFiles(x86)%\iobit\software updater\uninstallpromote.exe' /install su8
'%ProgramFiles(x86)%\iobit\software updater\productstat3.exe' /postspcache "%ALLUSERSPROFILE%\ProductData3\StatSpCache.dat"
'%ProgramFiles(x86)%\iobit\software updater\sufeature.exe' /su /user
'%ProgramFiles(x86)%\iobit\software updater\sufeature.exe' /u https://stats.iobit.com/active_month.php /a su8 /p iobit /v 8.#.0.12 /t 1 /d 7
'%ProgramFiles(x86)%\iobit\software updater\carescan.exe' /susilentscan
'%ProgramFiles(x86)%\iobit\software updater\autoupdate.exe' /Nomal

Executes the following

'%WINDIR%\syswow64\cmd.exe' /c Schtasks.exe /change /enable /tn "Software Updater SkipUAC(user)"
'%WINDIR%\syswow64\schtasks.exe' /change /enable /tn "Software Updater SkipUAC(user)"
'%TEMP%\is-tsbbl.tmp\suinstaller\suinitrun.exe' /update_init' (with hidden window)
'%WINDIR%\syswow64\taskkill.exe' -f -im SoftwareUpdater.exe' (with hidden window)
'%WINDIR%\syswow64\taskkill.exe' -f -im SUInit.exe' (with hidden window)
'%ProgramFiles(x86)%\iobit\software updater\locallang.exe' ' (with hidden window)
'%ProgramFiles(x86)%\iobit\software updater\suinit.exe' /INSTALL /CreateTaskbar /update' (with hidden window)
'%ProgramFiles(x86)%\iobit\software updater\setup.exe' /SilenceCall' (with hidden window)
'%ProgramFiles(x86)%\iobit\software updater\taskbarpin\iconpin64.exe' Pin "%ProgramFiles(x86)%\IObit\Software Updater\SoftwareUpdater.exe"' (with hidden window)
'%ProgramFiles(x86)%\iobit\software updater\setup.exe' /ScriptCall' (with hidden window)
'%ProgramFiles(x86)%\iobit\software updater\uninstallpromote.exe' /install su8' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c Schtasks.exe /change /enable /tn "Software Updater SkipUAC(user)"' (with hidden window)
'%ProgramFiles(x86)%\iobit\software updater\productstat3.exe' /postspcache "%ALLUSERSPROFILE%\ProductData3\StatSpCache.dat"' (with hidden window)
'%ProgramFiles(x86)%\iobit\software updater\sufeature.exe' /su /user' (with hidden window)
'%ProgramFiles(x86)%\iobit\software updater\sufeature.exe' /u https://stats.iobit.com/active_month.php /a su8 /p iobit /v 8.#.0.12 /t 1 /d 7' (with hidden window)
'%ProgramFiles(x86)%\iobit\software updater\carescan.exe' /susilentscan' (with hidden window)
'%ProgramFiles(x86)%\iobit\software updater\autoupdate.exe' /Nomal' (with hidden window)

技术

术语

教育培训

误区

Technical Information

Curing recommendations

Free trial