Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'ANIWZCS2Service' = '%ProgramFiles%\ANI\ANIWZCS2 Service\WZCSLDR2.exe'
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\ANIWZCSdService] 'Start' = '00000002'
- [<HKLM>\SYSTEM\ControlSet001\Services\ANIWZCSdService] 'ImagePath' = '%ProgramFiles%\ANI\ANIWZCS2 Service\ANIWZCSdS.exe'
Modifies file system:
Creates the following files:
- %TEMP%\ext2.tmp
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING.VER
- %ProgramFiles%\InstallShield Installation Information\{4C590030-7469-453E-8589-D15DA9D03F52}\data7881.rra
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\INDEX.MAP
- %ProgramFiles%\InstallShield Installation Information\{4C590030-7469-453E-8589-D15DA9D03F52}\layo7872.rra
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\INDEX.BTR
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\$WinMgmt.CFG
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING1.MAP
- %ProgramFiles%\InstallShield Installation Information\{4C590030-7469-453E-8589-D15DA9D03F52}\data78a1.rra
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SAM
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SYSTEM
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SOFTWARE
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SECURITY
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_.DEFAULT
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-21-2052111302-484763869-725345543-1003
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\domain.txt
- %CommonProgramFiles%\InstallShield\Engine\6\Intel 32\iuse2c94.rra
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING2.MAP
- <SYSTEM32>\ANIC7ce6.rra
- <SYSTEM32>\aIPH7ca8.rra
- <SYSTEM32>\wnic7c5a.rra
- <SYSTEM32>\wlan7c0c.rra
- <SYSTEM32>\odSu7b21.rra
- <SYSTEM32>\JJAK7b02.rra
- %ProgramFiles%\ANI\ANIWZCS2 Service\ANIW7ae3.rra
- %ProgramFiles%\ANI\ANIWZCS2 Service\WZCS7ab4.rra
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\OBJECTS.MAP
- %ProgramFiles%\ANI\ANIWZCS2 Service\Ctrl7aa4.rra
- %ProgramFiles%\ANI\ANIWZCS2 Service\ANIW79e9.rra
- %ProgramFiles%\InstallShield Installation Information\{4C590030-7469-453E-8589-D15DA9D03F52}\Setup.ini
- %ProgramFiles%\InstallShield Installation Information\{4C590030-7469-453E-8589-D15DA9D03F52}\setu792d.rra
- %ProgramFiles%\InstallShield Installation Information\{4C590030-7469-453E-8589-D15DA9D03F52}\Setu790e.rra
- %ProgramFiles%\InstallShield Installation Information\{4C590030-7469-453E-8589-D15DA9D03F52}\Setu78ef.rra
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-21-2052111302-484763869-725345543-1003
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\ComDb.Dat
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-20
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-20
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-19
- %TEMP%\pft3~tmp\Disk1\Setup.exe
- %TEMP%\233d.rra
- %CommonProgramFiles%\InstallShield\Engine\6\Intel 32\temp.000
- %TEMP%\IEC4.tmp
- %TEMP%\pft3~tmp\Disk1\setup.iss
- %TEMP%\pft3~tmp\Disk1\setup.inx
- %TEMP%\pft3~tmp\Disk1\Setup.ini
- %TEMP%\pft3~tmp\Disk1\layout.bin
- %CommonProgramFiles%\InstallShield\Engine\6\Intel 32\ctor2a61.rra
- %TEMP%\pft3~tmp\Disk1\ikernel.ex_
- %TEMP%\pft3~tmp\Disk1\data2.cab
- %TEMP%\pft3~tmp\Disk1\data1.hdr
- %TEMP%\pft3~tmp\Disk1\data1.cab
- %TEMP%\pft3~tmp\pftw1.pkg
- %TEMP%\plf1.tmp
- <SYSTEM32>\ANIW7d06.rra
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\OBJECTS.DATA
- %CommonProgramFiles%\InstallShield\Engine\6\Intel 32\obje2c46.rra
- %TEMP%\{4C590030-7469-453E-8589-D15DA9D03F52}\setu36e5.rra
- %CommonProgramFiles%\InstallShield\Engine\6\Intel 32\core29d5.rra
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-19
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-18
- %TEMP%\pft3~tmp\Disk1\setup.log
- %TEMP%\{a53045e4-f5aa-4aa0-9d28-4c2a427982d4}\_IsR46d3.rra
- %TEMP%\{a53045e4-f5aa-4aa0-9d28-4c2a427982d4}\valu3c44.rra
- %TEMP%\{a53045e4-f5aa-4aa0-9d28-4c2a427982d4}\valu3c15.rra
- %TEMP%\{a53045e4-f5aa-4aa0-9d28-4c2a427982d4}\setu3b2a.rra
- %TEMP%\{4C590030-7469-453E-8589-D15DA9D03F52}\_IsR3a7e.rra
- %TEMP%\{a53045e4-f5aa-4aa0-9d28-4c2a427982d4}\_IsR3a30.rra
- %TEMP%\{4C590030-7469-453E-8589-D15DA9D03F52}\defa39a4.rra
- %TEMP%\{a53045e4-f5aa-4aa0-9d28-4c2a427982d4}\defa3984.rra
- %TEMP%\{4C590030-7469-453E-8589-D15DA9D03F52}\isrt3927.rra
- %TEMP%\{a53045e4-f5aa-4aa0-9d28-4c2a427982d4}\isrt38b9.rra
- %TEMP%\{4C590030-7469-453E-8589-D15DA9D03F52}\valu381d.rra
- %CommonProgramFiles%\InstallShield\IScript\iscr2ef5.rra
- <SYSTEM32>\AQCK7d83.rra
Deletes the following files:
- %TEMP%\ext2.tmp
- %TEMP%\pft3~tmp\Disk1\setup.inx
- %TEMP%\pft3~tmp\Disk1\Setup.ini
- %TEMP%\pft3~tmp\Disk1\Setup.exe
- %TEMP%\pft3~tmp\Disk1\layout.bin
- %TEMP%\pft3~tmp\Disk1\ikernel.ex_
- %TEMP%\pft3~tmp\Disk1\data2.cab
- %TEMP%\pft3~tmp\Disk1\data1.hdr
- %TEMP%\pft3~tmp\Disk1\data1.cab
- %TEMP%\plf1.tmp
- %TEMP%\{4C590030-7469-453E-8589-D15DA9D03F52}\setup.inx
- %TEMP%\pft3~tmp\Disk1\setup.iss
- %TEMP%\{a53045e4-f5aa-4aa0-9d28-4c2a427982d4}\setup.inx
- %TEMP%\{a53045e4-f5aa-4aa0-9d28-4c2a427982d4}\value.shl
- %TEMP%\{4C590030-7469-453E-8589-D15DA9D03F52}\isrt.dll
- %TEMP%\{4C590030-7469-453E-8589-D15DA9D03F52}\default.pal
- %TEMP%\{a53045e4-f5aa-4aa0-9d28-4c2a427982d4}\isrt.dll
- %TEMP%\{a53045e4-f5aa-4aa0-9d28-4c2a427982d4}\default.pal
- %TEMP%\{4C590030-7469-453E-8589-D15DA9D03F52}\_IsRes.dll
- %TEMP%\{a53045e4-f5aa-4aa0-9d28-4c2a427982d4}\_IsRes.dll
- %TEMP%\{a53045e4-f5aa-4aa0-9d28-4c2a427982d4}\valu3c15.rra
- %TEMP%\IEC4.tmp
- %TEMP%\pft3~tmp\pftw1.pkg
- %TEMP%\{4C590030-7469-453E-8589-D15DA9D03F52}\value.shl
- %TEMP%\pft3~tmp\Disk1\setup.log
Moves the following files:
- from %CommonProgramFiles%\InstallShield\Engine\6\Intel 32\temp.000 to %CommonProgramFiles%\InstallShield\Engine\6\Intel 32\IKernel.exe
- from %ProgramFiles%\InstallShield Installation Information\{4C590030-7469-453E-8589-D15DA9D03F52}\Setu790e.rra to %ProgramFiles%\InstallShield Installation Information\{4C590030-7469-453E-8589-D15DA9D03F52}\Setup.ini
- from %ProgramFiles%\InstallShield Installation Information\{4C590030-7469-453E-8589-D15DA9D03F52}\setu792d.rra to %ProgramFiles%\InstallShield Installation Information\{4C590030-7469-453E-8589-D15DA9D03F52}\setup.inx
- from %ProgramFiles%\ANI\ANIWZCS2 Service\ANIW79e9.rra to %ProgramFiles%\ANI\ANIWZCS2 Service\ANIWZCSd.dll
- from %ProgramFiles%\ANI\ANIWZCS2 Service\Ctrl7aa4.rra to %ProgramFiles%\ANI\ANIWZCS2 Service\CtrlSrv.exe
- from %ProgramFiles%\ANI\ANIWZCS2 Service\WZCS7ab4.rra to %ProgramFiles%\ANI\ANIWZCS2 Service\WZCSLDR2.exe
- from %ProgramFiles%\InstallShield Installation Information\{4C590030-7469-453E-8589-D15DA9D03F52}\data78a1.rra to %ProgramFiles%\InstallShield Installation Information\{4C590030-7469-453E-8589-D15DA9D03F52}\data1.cab
- from %ProgramFiles%\InstallShield Installation Information\{4C590030-7469-453E-8589-D15DA9D03F52}\Setu78ef.rra to %ProgramFiles%\InstallShield Installation Information\{4C590030-7469-453E-8589-D15DA9D03F52}\Setup.exe
- from %ProgramFiles%\ANI\ANIWZCS2 Service\ANIW7ae3.rra to %ProgramFiles%\ANI\ANIWZCS2 Service\ANIWZCSdS.exe
- from <SYSTEM32>\wlan7c0c.rra to <SYSTEM32>\wlanapp.dll
- from <SYSTEM32>\wnic7c5a.rra to <SYSTEM32>\wnicapi.dll
- from <SYSTEM32>\aIPH7ca8.rra to <SYSTEM32>\aIPH.dll
- from <SYSTEM32>\ANIC7ce6.rra to <SYSTEM32>\ANICtl.dll
- from <SYSTEM32>\ANIW7d06.rra to <SYSTEM32>\ANIWZCS2.dll
- from <SYSTEM32>\JJAK7b02.rra to <SYSTEM32>\JJAKEn.dll
- from <SYSTEM32>\odSu7b21.rra to <SYSTEM32>\odSupp_M.dll
- from %ProgramFiles%\InstallShield Installation Information\{4C590030-7469-453E-8589-D15DA9D03F52}\data7881.rra to %ProgramFiles%\InstallShield Installation Information\{4C590030-7469-453E-8589-D15DA9D03F52}\data1.hdr
- from %ProgramFiles%\InstallShield Installation Information\{4C590030-7469-453E-8589-D15DA9D03F52}\layo7872.rra to %ProgramFiles%\InstallShield Installation Information\{4C590030-7469-453E-8589-D15DA9D03F52}\layout.bin
- from %TEMP%\{a53045e4-f5aa-4aa0-9d28-4c2a427982d4}\_IsR46d3.rra to %TEMP%\{a53045e4-f5aa-4aa0-9d28-4c2a427982d4}\_IsRes.dll
- from %CommonProgramFiles%\InstallShield\Engine\6\Intel 32\ctor2a61.rra to %CommonProgramFiles%\InstallShield\Engine\6\Intel 32\ctor.dll
- from %CommonProgramFiles%\InstallShield\Engine\6\Intel 32\obje2c46.rra to %CommonProgramFiles%\InstallShield\Engine\6\Intel 32\objectps.dll
- from %CommonProgramFiles%\InstallShield\Engine\6\Intel 32\iuse2c94.rra to %CommonProgramFiles%\InstallShield\Engine\6\Intel 32\iuser.dll
- from %CommonProgramFiles%\InstallShield\IScript\iscr2ef5.rra to %CommonProgramFiles%\InstallShield\IScript\iscript.dll
- from %TEMP%\{4C590030-7469-453E-8589-D15DA9D03F52}\setu36e5.rra to %TEMP%\{4C590030-7469-453E-8589-D15DA9D03F52}\setup.inx
- from %TEMP%\{4C590030-7469-453E-8589-D15DA9D03F52}\valu381d.rra to %TEMP%\{4C590030-7469-453E-8589-D15DA9D03F52}\value.shl
- from %CommonProgramFiles%\InstallShield\Engine\6\Intel 32\core29d5.rra to %CommonProgramFiles%\InstallShield\Engine\6\Intel 32\corecomp.ini
- from %TEMP%\{4C590030-7469-453E-8589-D15DA9D03F52}\isrt3927.rra to %TEMP%\{4C590030-7469-453E-8589-D15DA9D03F52}\isrt.dll
- from %TEMP%\{4C590030-7469-453E-8589-D15DA9D03F52}\defa39a4.rra to %TEMP%\{4C590030-7469-453E-8589-D15DA9D03F52}\default.pal
- from %TEMP%\{4C590030-7469-453E-8589-D15DA9D03F52}\_IsR3a7e.rra to %TEMP%\{4C590030-7469-453E-8589-D15DA9D03F52}\_IsRes.dll
- from %TEMP%\{a53045e4-f5aa-4aa0-9d28-4c2a427982d4}\setu3b2a.rra to %TEMP%\{a53045e4-f5aa-4aa0-9d28-4c2a427982d4}\setup.inx
- from %TEMP%\{a53045e4-f5aa-4aa0-9d28-4c2a427982d4}\valu3c44.rra to %TEMP%\{a53045e4-f5aa-4aa0-9d28-4c2a427982d4}\value.shl
- from %TEMP%\{a53045e4-f5aa-4aa0-9d28-4c2a427982d4}\isrt38b9.rra to %TEMP%\{a53045e4-f5aa-4aa0-9d28-4c2a427982d4}\isrt.dll
- from %TEMP%\{a53045e4-f5aa-4aa0-9d28-4c2a427982d4}\defa3975.rra to %TEMP%\{a53045e4-f5aa-4aa0-9d28-4c2a427982d4}\default.pal
- from %TEMP%\{a53045e4-f5aa-4aa0-9d28-4c2a427982d4}\defa3984.rra to %TEMP%\{a53045e4-f5aa-4aa0-9d28-4c2a427982d4}\defa3975.rra
- from <SYSTEM32>\AQCK7d83.rra to <SYSTEM32>\AQCKGen.dll
- from %TEMP%\233d.rra to %ProgramFiles%\InstallShield Installation Information\{4C590030-7469-453E-8589-D15DA9D03F52}\setup.ilg
Substitutes the following files:
- %TEMP%\{a53045e4-f5aa-4aa0-9d28-4c2a427982d4}\_IsRes.dll
Miscellaneous:
Creates and executes the following:
- '%TEMP%\pft3~tmp\Disk1\Setup.exe' /s
- '%CommonProgramFiles%\InstallShield\Engine\6\Intel 32\IKernel.exe' -RegServer
- '%CommonProgramFiles%\InstallShield\Engine\6\Intel 32\IKernel.exe' 32\IKernel.exe -Embedding
- '%CommonProgramFiles%\InstallShield\Engine\6\Intel 32\IKernel.exe' /REGSERVER
