Technical Information
To ensure autorun and distribution
Sets the following service settings
- [HKLM\System\CurrentControlSet\Services\IPTV Channel Browser 6.6] 'Start' = '00000002'
- [HKLM\System\CurrentControlSet\Services\IPTV Channel Browser 6.6] 'ImagePath' = '%ALLUSERSPROFILE%\IPTV Channel Browser 6.6\IPTV Channel Browser 6.6.exe'
Creates the following services
- 'IPTV Channel Browser 6.6' %ALLUSERSPROFILE%\IPTV Channel Browser 6.6\IPTV Channel Browser 6.6.exe
Modifies file system
Creates the following files
- %TEMP%\is-1tdll.tmp\<File name>.tmp
- %LOCALAPPDATA%\rsa encode module\pf\common audio\is-v06am.tmp
- %LOCALAPPDATA%\rsa encode module\pf\common audio\is-joock.tmp
- %LOCALAPPDATA%\rsa encode module\pf\common audio\is-3i1rh.tmp
- %LOCALAPPDATA%\rsa encode module\pf\common audio\is-2m50d.tmp
- %LOCALAPPDATA%\rsa encode module\pf\common audio\is-18vs1.tmp
- %LOCALAPPDATA%\rsa encode module\pf\common audio\is-ba5m9.tmp
- %LOCALAPPDATA%\rsa encode module\pf\common audio\is-6n8aq.tmp
- %LOCALAPPDATA%\rsa encode module\pf\common audio\is-8lp7q.tmp
- %LOCALAPPDATA%\rsa encode module\pf\common audio\is-cu87u.tmp
- %LOCALAPPDATA%\rsa encode module\pf\common audio\is-4evkq.tmp
- %LOCALAPPDATA%\rsa encode module\pf\common audio\is-1mqii.tmp
- %LOCALAPPDATA%\rsa encode module\microsoft.vc90.crt\is-4mrtv.tmp
- %LOCALAPPDATA%\rsa encode module\microsoft.vc90.crt\is-voq1i.tmp
- %LOCALAPPDATA%\rsa encode module\pf\common audio\is-h86pe.tmp
- %LOCALAPPDATA%\rsa encode module\pf\common audio\is-bandf.tmp
- %LOCALAPPDATA%\rsa encode module\pf\common audio\is-k1vr3.tmp
- %LOCALAPPDATA%\rsa encode module\pf\common audio\is-cnh6f.tmp
- %LOCALAPPDATA%\rsa encode module\pf\common audio\is-bok3j.tmp
- %LOCALAPPDATA%\rsa encode module\lang\is-dl7ac.tmp
- %LOCALAPPDATA%\rsa encode module\lang\is-6l6mh.tmp
- %LOCALAPPDATA%\rsa encode module\lang\is-us86k.tmp
- %LOCALAPPDATA%\rsa encode module\lang\is-buena.tmp
- %LOCALAPPDATA%\rsa encode module\lang\is-kcibv.tmp
- %LOCALAPPDATA%\rsa encode module\is-qbrpf.tmp
- %LOCALAPPDATA%\rsa encode module\unins000.dat
- %LOCALAPPDATA%\rsa encode module\pf\common audio\is-dc7n5.tmp
- %LOCALAPPDATA%\rsa encode module\pf\common audio\is-l57k0.tmp
- %LOCALAPPDATA%\rsa encode module\microsoft.vc90.crt\is-sndg3.tmp
- %LOCALAPPDATA%\rsa encode module\microsoft.vc90.crt\is-d5nv6.tmp
- %LOCALAPPDATA%\rsa encode module\lang\is-v8sde.tmp
- %TEMP%\is-ub6cu.tmp\_isetup\_setup64.tmp
- %TEMP%\is-ub6cu.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-ub6cu.tmp\_isetup\_iscrypt.dll
- %LOCALAPPDATA%\rsa encode module\is-1iv2i.tmp
- %LOCALAPPDATA%\rsa encode module\is-r7quv.tmp
- %LOCALAPPDATA%\rsa encode module\is-vegua.tmp
- %LOCALAPPDATA%\rsa encode module\is-o0rh6.tmp
- %LOCALAPPDATA%\rsa encode module\is-rf7ur.tmp
- %LOCALAPPDATA%\rsa encode module\is-ic3fd.tmp
- %LOCALAPPDATA%\rsa encode module\is-ep7vd.tmp
- %LOCALAPPDATA%\rsa encode module\is-qgd1n.tmp
- %LOCALAPPDATA%\rsa encode module\is-e9n8f.tmp
- %TEMP%\is-ub6cu.tmp\_isetup\_regdll.tmp
- %LOCALAPPDATA%\rsa encode module\is-f76if.tmp
- %LOCALAPPDATA%\rsa encode module\is-b2448.tmp
- %LOCALAPPDATA%\rsa encode module\is-v9is5.tmp
- %LOCALAPPDATA%\rsa encode module\is-qhpnt.tmp
- %LOCALAPPDATA%\rsa encode module\is-mllnv.tmp
- %LOCALAPPDATA%\rsa encode module\is-9ca2h.tmp
- %LOCALAPPDATA%\rsa encode module\is-s01al.tmp
- %LOCALAPPDATA%\rsa encode module\is-raljg.tmp
- %LOCALAPPDATA%\rsa encode module\is-7g30u.tmp
- %LOCALAPPDATA%\rsa encode module\lang\is-f5mac.tmp
- %LOCALAPPDATA%\rsa encode module\lang\is-64foo.tmp
- %LOCALAPPDATA%\rsa encode module\lang\is-o3jsv.tmp
- %LOCALAPPDATA%\rsa encode module\lang\is-it8vb.tmp
- %LOCALAPPDATA%\rsa encode module\is-i58dn.tmp
- %LOCALAPPDATA%\rsa encode module\rsaencmodule.exe
- %ALLUSERSPROFILE%\iptv channel browser 6.6\iptv channel browser 6.6.exe
Deletes the following files
- %LOCALAPPDATA%\rsa encode module\lang\audioconverterripper.dat
- %LOCALAPPDATA%\rsa encode module\lang\audioconverterripper.txt
- %LOCALAPPDATA%\rsa encode module\lang\feedback.dat
- %LOCALAPPDATA%\rsa encode module\lang\musictype.txt
- %LOCALAPPDATA%\rsa encode module\lang\update.log
Moves the following files
- from %LOCALAPPDATA%\rsa encode module\is-1iv2i.tmp to %LOCALAPPDATA%\rsa encode module\unins000.exe
- from %LOCALAPPDATA%\rsa encode module\microsoft.vc90.crt\is-sndg3.tmp to %LOCALAPPDATA%\rsa encode module\microsoft.vc90.crt\msvcm90.dll
- from %LOCALAPPDATA%\rsa encode module\microsoft.vc90.crt\is-4mrtv.tmp to %LOCALAPPDATA%\rsa encode module\microsoft.vc90.crt\msvcp90.dll
- from %LOCALAPPDATA%\rsa encode module\microsoft.vc90.crt\is-voq1i.tmp to %LOCALAPPDATA%\rsa encode module\microsoft.vc90.crt\msvcr90.dll
- from %LOCALAPPDATA%\rsa encode module\pf\common audio\is-v06am.tmp to %LOCALAPPDATA%\rsa encode module\pf\common audio\aac.pf
- from %LOCALAPPDATA%\rsa encode module\pf\common audio\is-joock.tmp to %LOCALAPPDATA%\rsa encode module\pf\common audio\ac3.pf
- from %LOCALAPPDATA%\rsa encode module\pf\common audio\is-3i1rh.tmp to %LOCALAPPDATA%\rsa encode module\pf\common audio\aiff.pf
- from %LOCALAPPDATA%\rsa encode module\pf\common audio\is-2m50d.tmp to %LOCALAPPDATA%\rsa encode module\pf\common audio\amr.pf
- from %LOCALAPPDATA%\rsa encode module\pf\common audio\is-18vs1.tmp to %LOCALAPPDATA%\rsa encode module\pf\common audio\ape.pf
- from %LOCALAPPDATA%\rsa encode module\pf\common audio\is-ba5m9.tmp to %LOCALAPPDATA%\rsa encode module\pf\common audio\au.pf
- from %LOCALAPPDATA%\rsa encode module\pf\common audio\is-8lp7q.tmp to %LOCALAPPDATA%\rsa encode module\pf\common audio\m4a.pf
- from %LOCALAPPDATA%\rsa encode module\pf\common audio\is-bok3j.tmp to %LOCALAPPDATA%\rsa encode module\pf\common audio\wma.pf
- from %LOCALAPPDATA%\rsa encode module\pf\common audio\is-cu87u.tmp to %LOCALAPPDATA%\rsa encode module\pf\common audio\m4b.pf
- from %LOCALAPPDATA%\rsa encode module\pf\common audio\is-4evkq.tmp to %LOCALAPPDATA%\rsa encode module\pf\common audio\m4r.pf
- from %LOCALAPPDATA%\rsa encode module\pf\common audio\is-1mqii.tmp to %LOCALAPPDATA%\rsa encode module\pf\common audio\mka.pf
- from %LOCALAPPDATA%\rsa encode module\pf\common audio\is-h86pe.tmp to %LOCALAPPDATA%\rsa encode module\pf\common audio\mp2.pf
- from %LOCALAPPDATA%\rsa encode module\pf\common audio\is-dc7n5.tmp to %LOCALAPPDATA%\rsa encode module\pf\common audio\mp3.pf
- from %LOCALAPPDATA%\rsa encode module\pf\common audio\is-l57k0.tmp to %LOCALAPPDATA%\rsa encode module\pf\common audio\ogg.pf
- from %LOCALAPPDATA%\rsa encode module\pf\common audio\is-bandf.tmp to %LOCALAPPDATA%\rsa encode module\pf\common audio\ra.pf
- from %LOCALAPPDATA%\rsa encode module\pf\common audio\is-k1vr3.tmp to %LOCALAPPDATA%\rsa encode module\pf\common audio\voc.pf
- from %LOCALAPPDATA%\rsa encode module\pf\common audio\is-cnh6f.tmp to %LOCALAPPDATA%\rsa encode module\pf\common audio\wav.pf
- from %LOCALAPPDATA%\rsa encode module\microsoft.vc90.crt\is-d5nv6.tmp to %LOCALAPPDATA%\rsa encode module\microsoft.vc90.crt\microsoft.vc90.crt.manifest
- from %LOCALAPPDATA%\rsa encode module\pf\common audio\is-6n8aq.tmp to %LOCALAPPDATA%\rsa encode module\pf\common audio\flac.pf
- from %LOCALAPPDATA%\rsa encode module\lang\is-v8sde.tmp to %LOCALAPPDATA%\rsa encode module\lang\update.log
- from %LOCALAPPDATA%\rsa encode module\is-i58dn.tmp to %LOCALAPPDATA%\rsa encode module\soundtouch.dll
- from %LOCALAPPDATA%\rsa encode module\is-r7quv.tmp to %LOCALAPPDATA%\rsa encode module\msvcp60.dll
- from %LOCALAPPDATA%\rsa encode module\is-vegua.tmp to %LOCALAPPDATA%\rsa encode module\msvcr71.dll
- from %LOCALAPPDATA%\rsa encode module\is-o0rh6.tmp to %LOCALAPPDATA%\rsa encode module\postproc-52.dll
- from %LOCALAPPDATA%\rsa encode module\is-rf7ur.tmp to %LOCALAPPDATA%\rsa encode module\pthreadgc2.dll
- from %LOCALAPPDATA%\rsa encode module\is-ic3fd.tmp to %LOCALAPPDATA%\rsa encode module\pthreadvc2.dll
- from %LOCALAPPDATA%\rsa encode module\is-ep7vd.tmp to %LOCALAPPDATA%\rsa encode module\realquickjoin.dll
- from %LOCALAPPDATA%\rsa encode module\is-qgd1n.tmp to %LOCALAPPDATA%\rsa encode module\rmvbencode.dll
- from %LOCALAPPDATA%\rsa encode module\is-e9n8f.tmp to %LOCALAPPDATA%\rsa encode module\rmvbencodesync.dll
- from %LOCALAPPDATA%\rsa encode module\is-f76if.tmp to %LOCALAPPDATA%\rsa encode module\simage.dll
- from %LOCALAPPDATA%\rsa encode module\is-b2448.tmp to %LOCALAPPDATA%\rsa encode module\ssleay32.dll
- from %LOCALAPPDATA%\rsa encode module\lang\is-o3jsv.tmp to %LOCALAPPDATA%\rsa encode module\lang\feedback.dat
- from %LOCALAPPDATA%\rsa encode module\is-v9is5.tmp to %LOCALAPPDATA%\rsa encode module\swresample-0.dll
- from %LOCALAPPDATA%\rsa encode module\is-qhpnt.tmp to %LOCALAPPDATA%\rsa encode module\uitoolkit.dll.intermediate.manifest
- from %LOCALAPPDATA%\rsa encode module\is-mllnv.tmp to %LOCALAPPDATA%\rsa encode module\ve32.dll
- from %LOCALAPPDATA%\rsa encode module\is-9ca2h.tmp to %LOCALAPPDATA%\rsa encode module\ve64.dll
- from %LOCALAPPDATA%\rsa encode module\is-s01al.tmp to %LOCALAPPDATA%\rsa encode module\wait.gif
- from %LOCALAPPDATA%\rsa encode module\is-raljg.tmp to %LOCALAPPDATA%\rsa encode module\webrtc.dll
- from %LOCALAPPDATA%\rsa encode module\is-7g30u.tmp to %LOCALAPPDATA%\rsa encode module\wmadecode.dll
- from %LOCALAPPDATA%\rsa encode module\lang\is-f5mac.tmp to %LOCALAPPDATA%\rsa encode module\lang\audioconverterripper.dat
- from %LOCALAPPDATA%\rsa encode module\lang\is-64foo.tmp to %LOCALAPPDATA%\rsa encode module\lang\audioconverterripper.txt
- from %LOCALAPPDATA%\rsa encode module\lang\is-it8vb.tmp to %LOCALAPPDATA%\rsa encode module\lang\musictype.txt
- from %LOCALAPPDATA%\rsa encode module\is-qbrpf.tmp to %LOCALAPPDATA%\rsa encode module\rsaencmodule.exe
Substitutes the following files
- %LOCALAPPDATA%\rsa encode module\lang\audioconverterripper.dat
- %LOCALAPPDATA%\rsa encode module\lang\audioconverterripper.txt
- %LOCALAPPDATA%\rsa encode module\lang\feedback.dat
- %LOCALAPPDATA%\rsa encode module\lang\musictype.txt
- %LOCALAPPDATA%\rsa encode module\lang\update.log
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: 'ba76f5_RSAEM1245FlashFixClass_ba76f5'
Creates and executes the following
- '%TEMP%\is-1tdll.tmp\<File name>.tmp' /SL5="$1B023E,3049490,54272,<Full path to file>"
- '%LOCALAPPDATA%\rsa encode module\rsaencmodule.exe' -i
- '%LOCALAPPDATA%\rsa encode module\rsaencmodule.exe' -s
