Technical Information
To ensure autorun and distribution:
Creates or modifies the following files:
- %HOMEPATH%\Start Menu\Programs\Startup\explorer.dll.lnk
Modifies file system:
Creates the following files:
- C:\ProgramLocal\Temp\System_boot\DataC++.vbs
- C:\ProgramLocal\Temp\System_boot\desktop.ini
- C:\ProgramLocal\Temp\System_boot\DataC++.bat
- C:\ProgramLocal\Temp\System_boot\Data1i1.bin
- C:\ProgramLocal\Temp\System_boot\Data2.bin
- C:\ProgramLocal\Temp\System_boot\null
- C:\ProgramLocal\Temp\System_boot\OpenCL.dll
- C:\ProgramLocal\Temp\System_boot\msvcr110.dll
- C:\ProgramLocal\Temp\System_boot\libeay32.dll
- C:\ProgramLocal\Temp\System_boot\msvcp110.dll
- C:\ProgramLocal\Temp\System_boot\Data1a1.bin
- C:\ProgramLocal\Temp\System_boot\Data1b1.bin
- C:\ProgramLocal\Temp\System_boot\Data.bin
- C:\ProgramLocal\Temp\System_boot\cudart64_60.dll
- C:\ProgramLocal\Temp\System_boot\cudart64_80.dll
- C:\ProgramLocal\Temp\System_boot\Data1g1.bin
- C:\ProgramLocal\Temp\System_boot\Data1h1.bin
- C:\ProgramLocal\Temp\System_boot\Data1e1.bin
- C:\ProgramLocal\Temp\System_boot\Data1c1.bin
- C:\ProgramLocal\Temp\System_boot\Data1d1.bin
- C:\ProgramLocal\Temp\System_boot\vccorlib110.dll
- C:\ProgramLocal\Temp\TelephonyInteractiveUserRes.dll
- C:\ProgramLocal\Temp\System_boot\systemLogx64.exe
- C:\ProgramLocal\Temp\System_boot\sysmatic.exe
- C:\ProgramLocal\Temp\System_boot\systemLogx32.exe
- C:\ProgramLocal\Temp\wmerror.dll
- C:\ProgramLocal\wmerror.dll
- C:\ProgramLocal\Temp\UevCustomActionTypes.tlb
- C:\ProgramLocal\Temp\tier2punctuations.dll
- C:\ProgramLocal\Temp\tzres.dll
- C:\ProgramLocal\Temp\System_boot\Qt5Core.dll
- C:\ProgramLocal\Temp\System_boot\Qt5Network.dll
- C:\ProgramLocal\Temp\System_boot\platforms\qwindows.dll
- C:\ProgramLocal\Temp\System_boot\OpenCLdl.bat
- C:\ProgramLocal\Temp\System_boot\platforms\desktop.ini
- C:\ProgramLocal\Temp\System_boot\svchostx64.bat
- C:\ProgramLocal\Temp\System_boot\svchostx86.vbs
- C:\ProgramLocal\Temp\System_boot\svchostx32.bat
- C:\ProgramLocal\Temp\System_boot\Qt5WebSockets.dll
- C:\ProgramLocal\Temp\System_boot\ssleay32.dll
- C:\ProgramLocal\Temp\System_boot\cudart32_80.dll
- C:\ProgramLocal\Temp\blbres.dll
- C:\ProgramLocal\Temp\bootstr.dll
- C:\ProgramLocal\Temp\AppxProvisioning.xml
- C:\ProgramLocal\msprivs.dll
- C:\ProgramLocal\msxml3r.dll
- C:\ProgramLocal\Temp\edgehtmlpluginpolicy.bin
- C:\ProgramLocal\Temp\icmp.dll
- C:\ProgramLocal\Temp\dmdskres2.dll
- C:\ProgramLocal\Temp\bridgeres.dll
- C:\ProgramLocal\Temp\DMAppsRes.dll
- %TEMP%\$inst\0001.tmp
- %ProgramFiles%\vsnwx32.bat
- %ProgramFiles%\system.exe
- %TEMP%\$inst\2.tmp
- %TEMP%\$inst\temp_0.tmp
- C:\ProgramLocal\Microsoft-WindowsPhone-SEManagementProvider.dll
- C:\ProgramLocal\msafd.dll
- C:\ProgramLocal\MapControlStringsRes.dll
- %ProgramFiles%\aim_3_0.exe
- %TEMP%\$inst\0002.tmp
- C:\ProgramLocal\Temp\PhoneServiceRes.dll
- C:\ProgramLocal\Temp\PhoneutilRes.dll
- C:\ProgramLocal\Temp\netmsg.dll
- C:\ProgramLocal\Temp\msxml6r.dll
- C:\ProgramLocal\Temp\neth.dll
- C:\ProgramLocal\Temp\SyncRes.dll
- C:\ProgramLocal\Temp\sysprint.sep
- C:\ProgramLocal\Temp\sfc.dll
- C:\ProgramLocal\Temp\rnr20.dll
- C:\ProgramLocal\Temp\SecurityAndMaintenance_Alert.png
- C:\ProgramLocal\Temp\lpk.dll
- C:\ProgramLocal\Temp\lz32.dll
- C:\ProgramLocal\Temp\lltdres.dll
- C:\ProgramLocal\Temp\ieuinit.inf
- C:\ProgramLocal\Temp\iologmsg.dll
- C:\ProgramLocal\Temp\msprivs.dll
- C:\ProgramLocal\Temp\msxml3r.dll
- C:\ProgramLocal\Temp\msafd.dll
- C:\ProgramLocal\Temp\MapControlStringsRes.dll
- C:\ProgramLocal\Temp\Microsoft-WindowsPhone-SEManagementProvider.dll
Sets the 'hidden' attribute to the following files:
- C:\ProgramLocal\Temp\System_boot\platforms\qwindows.dll
- C:\ProgramLocal\Temp\System_boot\platforms\desktop.ini
- C:\ProgramLocal\Temp\System_boot\Qt5Network.dll
- C:\ProgramLocal\Temp\System_boot\Qt5Core.dll
- C:\ProgramLocal\Temp\System_boot\null
- C:\ProgramLocal\Temp\System_boot\msvcr110.dll
- C:\ProgramLocal\Temp\System_boot\OpenCLdl.bat
- C:\ProgramLocal\Temp\System_boot\OpenCL.dll
- C:\ProgramLocal\Temp\System_boot\Qt5WebSockets.dll
- C:\ProgramLocal\Temp\System_boot\systemLogx32.exe
- C:\ProgramLocal\Temp\System_boot\sysmatic.exe
- C:\ProgramLocal\Temp\System_boot\vccorlib110.dll
- C:\ProgramLocal\Temp\System_boot\systemLogx64.exe
- C:\ProgramLocal\Temp\System_boot\svchostx32.bat
- C:\ProgramLocal\Temp\System_boot\ssleay32.dll
- C:\ProgramLocal\Temp\System_boot\svchostx86.vbs
- C:\ProgramLocal\Temp\System_boot\svchostx64.bat
- C:\ProgramLocal\Temp\System_boot\msvcp110.dll
- C:\ProgramLocal\Temp\System_boot\Data1b1.bin
- C:\ProgramLocal\Temp\System_boot\Data1a1.bin
- C:\ProgramLocal\Temp\System_boot\Data1d1.bin
- C:\ProgramLocal\Temp\System_boot\Data1c1.bin
- C:\ProgramLocal\Temp\System_boot\cudart64_60.dll
- C:\ProgramLocal\Temp\System_boot\cudart32_80.dll
- C:\ProgramLocal\Temp\System_boot\Data.bin
- C:\ProgramLocal\Temp\System_boot\cudart64_80.dll
- C:\ProgramLocal\Temp\System_boot\Data1e1.bin
- C:\ProgramLocal\Temp\System_boot\DataC++.vbs
- C:\ProgramLocal\Temp\System_boot\DataC++.bat
- C:\ProgramLocal\Temp\System_boot\libeay32.dll
- C:\ProgramLocal\Temp\System_boot\desktop.ini
- C:\ProgramLocal\Temp\System_boot\Data1h1.bin
- C:\ProgramLocal\Temp\System_boot\Data1g1.bin
- C:\ProgramLocal\Temp\System_boot\Data2.bin
- C:\ProgramLocal\Temp\System_boot\Data1i1.bin
Deletes the following files:
- %TEMP%\$inst\0002.tmp
- %TEMP%\$inst\2.tmp
- %TEMP%\$inst\temp_0.tmp
- %TEMP%\$inst\0001.tmp
Substitutes the following files:
- %TEMP%\$inst\0001.tmp
- %TEMP%\$inst\temp_0.tmp
- %TEMP%\$inst\2.tmp
Miscellaneous:
Creates and executes the following:
- '<SYSTEM32>\wscript.exe' "C:\ProgramLocal\Temp\System_boot\DataC++.vbs"
- '%ProgramFiles%\aim_3_0.exe'
- '%ProgramFiles%\system.exe'
Executes the following:
- '<SYSTEM32>\attrib.exe' +h C:\ProgramLocal
- '<SYSTEM32>\cmd.exe' /c ""C:\ProgramLocal\Temp\System_boot\DataC++.bat" "
- '<SYSTEM32>\cmd.exe' /c ""%ProgramFiles%\vsnwx32.bat" "
