Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\RunOnce] '<File name>.exe' = '"%TEMP%\_<File name>.exe_\<File name>.exe" -ER -RA -Ds -Es -PR -DR -RD -ID'
Modifies file system:
Creates the following files:
- %TEMP%\_<File name>.exe_\Microsoft.VC90.CRT.manifest
- %TEMP%\_<File name>.exe_\msvcm80.dll
- %TEMP%\_<File name>.exe_\msvcm90.dll
- %TEMP%\_<File name>.exe_\Microsoft.VC80.CRT.manifest
- %TEMP%\_<File name>.exe_\Microsoft.VC80.MFC.manifest
- %TEMP%\_<File name>.exe_\Microsoft.VC80.OpenMP.manifest
- %TEMP%\_<File name>.exe_\msvcp80.dll
- %TEMP%\_<File name>.exe_\NotDPIAware.dll
- %TEMP%\_<File name>.exe_\other.ini
- %TEMP%\_<File name>.exe_\PE.dll
- %TEMP%\_<File name>.exe_\msvcp90.dll
- %TEMP%\_<File name>.exe_\msvcr80.dll
- %TEMP%\_<File name>.exe_\msvcr90.dll
- %TEMP%\_<File name>.exe_\lang\bg.txt
- %TEMP%\_<File name>.exe_\lang\en.txt
- %TEMP%\_<File name>.exe_\lang\fr.txt
- %TEMP%\_<File name>.exe_\FuncLogic.dll
- %TEMP%\_<File name>.exe_\GptBcd.dll
- %TEMP%\_<File name>.exe_\ImgFile.dll
- %TEMP%\_<File name>.exe_\Ldm.dll
- %TEMP%\_<File name>.exe_\mfc80u.dll
- %TEMP%\_<File name>.exe_\mfcm80.dll
- %TEMP%\_<File name>.exe_\mfcm80u.dll
- %TEMP%\_<File name>.exe_\libeay32.dll
- %TEMP%\_<File name>.exe_\LoadDrv.exe
- %TEMP%\_<File name>.exe_\mfc80.dll
- %TEMP%\_<File name>.exe_\plugins\imageformats\qgif4.dll
- %TEMP%\_<File name>.exe_\vss\amd64\vssvis\VSSCOM.exe
- %TEMP%\_<File name>.exe_\vss\amd64\vssxp\VSSCOM.exe
- %TEMP%\_<File name>.exe_\vss\win32\vss03\vss.dll
- %TEMP%\_<File name>.exe_\Version.ini
- %TEMP%\_<File name>.exe_\vss.dll
- %TEMP%\_<File name>.exe_\vss\amd64\vss03\VSSCOM.exe
- %TEMP%\_<File name>.exe_\vss\win32\vssvis\vss.dll
- %TEMP%\_<File name>.exe_\zz_Delete.cmd
- %TEMP%\_<File name>.exe_\z5_Control.cmd
- %TEMP%\_<File name>.exe_\z5_Control_OLD.cmd
- %TEMP%\_<File name>.exe_\vss\win32\vssxp\vss.dll
- %TEMP%\_<File name>.exe_\vsscom.exe
- %TEMP%\_<File name>.exe_\winpeshl.ini
- %TEMP%\_<File name>.exe_\SFX-Exec.exe
- %TEMP%\_<File name>.exe_\ShowPage.exe
- %TEMP%\_<File name>.exe_\ssleay32.dll
- %TEMP%\_<File name>.exe_\QtCore4.dll
- %TEMP%\_<File name>.exe_\QtGui4.dll
- %TEMP%\_<File name>.exe_\QtXml4.dll
- %TEMP%\_<File name>.exe_\Sync.dll
- %TEMP%\_<File name>.exe_\UserManual.pdf
- %TEMP%\_<File name>.exe_\ValidCheck.exe
- %TEMP%\_<File name>.exe_\vcomp.dll
- %TEMP%\_<File name>.exe_\TFTP.dll
- %TEMP%\_<File name>.exe_\TipInfo.exe
- %TEMP%\_<File name>.exe_\UiLogic.dll
- %TEMP%\_<File name>.exe_\FlBackup.dll
- %TEMP%\_<File name>.exe_\AmCore.dll
- %TEMP%\_<File name>.exe_\amldr
- %TEMP%\_<File name>.exe_\amldr.mbr
- %TEMP%\_<File name>.exe_\ABUserPass.exe
- %TEMP%\_<File name>.exe_\adi.ico
- %TEMP%\_<File name>.exe_\AMBackup.exe
- %TEMP%\_<File name>.exe_\AomeiBr\BackupRecovery.ini
- %TEMP%\_<File name>.exe_\BackupRecovery.ini
- %TEMP%\_<File name>.exe_\botva2.dll
- %TEMP%\_<File name>.exe_\BrFat.dll
- %TEMP%\_<File name>.exe_\Backup.dll
- %TEMP%\_<File name>.exe_\Backupper.exe
- %TEMP%\_<File name>.exe_\Backupper_RU_config.txt
- %TEMP%\_<File name>.exe_\7zSFX\7zsdrc.exe
- %TEMP%\_<File name>.exe_\7zSFX\7zsd_LZMA2_SRC.sfx
- %TEMP%\_<File name>.exe_\7zSFX\Backupper.txt
- %TEMP%\_<File name>.exe_\2Gpt_BCD
- %TEMP%\_<File name>.exe_\2Mbr_BCD
- %TEMP%\_<File name>.exe_\7zSFX\7zr.exe
- %TEMP%\_<File name>.exe_\7zSFX\Backupper_Exec.txt
- %TEMP%\_<File name>.exe_\ABSchedhlp.exe
- %TEMP%\_<File name>.exe_\ABService.exe
- %TEMP%\_<File name>.exe_\ABSync.exe
- %TEMP%\_<File name>.exe_\7zSFX\z_Pack_EXE_Local.CMD
- %TEMP%\_<File name>.exe_\ABCore.exe
- %TEMP%\_<File name>.exe_\ABEventBackup.exe
- %TEMP%\_<File name>.exe_\BrLog.dll
- %TEMP%\_<File name>.exe_\driver\amd64\amwrtdrv.sys
- %TEMP%\_<File name>.exe_\driver\amd64\msahci.sys
- %TEMP%\_<File name>.exe_\driver\i386\ambakdrv.sys
- %TEMP%\_<File name>.exe_\Download.dll
- %TEMP%\_<File name>.exe_\driver\amd64\ambakdrv.sys
- %TEMP%\_<File name>.exe_\driver\amd64\ammntdrv.sys
- %TEMP%\_<File name>.exe_\driver\i386\ammntdrv.sys
- %TEMP%\_<File name>.exe_\driver\LoadDrv_x64.exe
- %TEMP%\_<File name>.exe_\Encrypt.dll
- %TEMP%\_<File name>.exe_\EnumFolder.dll
- %TEMP%\_<File name>.exe_\driver\i386\amwrtdrv.sys
- %TEMP%\_<File name>.exe_\driver\i386\msahci.sys
- %TEMP%\_<File name>.exe_\driver\LoadDrv_Win32.exe
- %TEMP%\_<File name>.exe_\cfg.ini
- %TEMP%\_<File name>.exe_\Clone.dll
- %TEMP%\_<File name>.exe_\Color.xml
- %TEMP%\_<File name>.exe_\BrNtfs.dll
- %TEMP%\_<File name>.exe_\BrVol.dll
- %TEMP%\_<File name>.exe_\CallbackCtrl.dll
- %TEMP%\_<File name>.exe_\Comn.dll
- %TEMP%\_<File name>.exe_\Device.dll
- %TEMP%\_<File name>.exe_\DeviceMgr.dll
- %TEMP%\_<File name>.exe_\DiskMgr.dll
- %TEMP%\_<File name>.exe_\Compress.dll
- %TEMP%\_<File name>.exe_\Crash.dmp
- %TEMP%\_<File name>.exe_\Dev.dat
Deletes the following files:
- %TEMP%\_<File name>.exe_\vsscom.exe
Moves the following files:
- from %TEMP%\_<File name>.exe_\SFX-Exec.exe to %TEMP%\_<File name>.exe_\<File name>.exe
Miscellaneous:
Creates and executes the following:
- '%TEMP%\_<File name>.exe_\<File name>.exe' -Er -RA -DS -ES -PR -DR -RD -ID
Executes the following:
- '<SYSTEM32>\reg.exe' ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "<File name>.exe" /d "\"%TEMP%\_<File name>.exe_\<File name>.exe\" -ER -RA -Ds -Es -PR -DR -RD -ID" /f
- '<SYSTEM32>\reg.exe' ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers" /v "%TEMP%\_<File name>.exe_\Backupper.exe" /d RUNASADMIN /f
- '<SYSTEM32>\cmd.exe' /c z5_Control.cmd -Er -RA -DS -ES -PR -DR -RD -ID
- '<SYSTEM32>\cmd.exe' /c Echo "<File name>.exe" -ER -Ra -Ds -Es -Pr -DR -RD -IE>zz_Delete.cmd
- '<SYSTEM32>\cmd.exe' /c "ren SFX-Exec.exe "<File name>.exe"&start "" "<File name>.exe" -Er -RA -DS -ES -PR -DR -RD -ID"
