Technical Information
Modifies file system
Creates the following files
- <Current directory>\bg.bmp
- <Current directory>\bg.jpg
- <Current directory>\cmdow.exe
- <Current directory>\d3d9.dll
- <Current directory>\game2.exe
- <Current directory>\hider.exe
- <Current directory>\irotate.exe
- <Current directory>\nircmd.exe
- <Current directory>\nomousy.exe
- <Current directory>\raiden4.sdb
- %TEMP%\bt3152.bat
- %TEMP%\wallpaper.bmp.bak
- %APPDATA%\irotate.ini
- nul
Sets the 'hidden' attribute to the following files
- %TEMP%\bt3152.bat
Deletes the following files
- %WINDIR%\apppatch\custom\{6328a0ae-5673-4d8a-92aa-30beadf21e52}.sdb
- %TEMP%\wallpaper.bmp.bak
- %TEMP%\bt3152.bat
- <Current directory>\bg.bmp
- <Current directory>\bg.jpg
- <Current directory>\cmdow.exe
- <Current directory>\d3d9.dll
- <Current directory>\game2.exe
- <Current directory>\hider.exe
- <Current directory>\irotate.exe
- <Current directory>\nircmd.exe
- <Current directory>\nomousy.exe
- <Current directory>\raiden4.sdb
Moves the following files
- from <Current directory>\game2.exe to <Current directory>\game.exe
Substitutes the following files
- <Current directory>\game2.exe
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: '<SYSTEM32>\cmd.exe ...
- ClassName: 'TASKBARHIDER' WindowName: 'TaskBar Hider'
- ClassName: 'Button' WindowName: 'Start'
- ClassName: 'iRotate' WindowName: 'iRotate'
- ClassName: 'WPCtrlWClass' WindowName: ''
- ClassName: 'nocur2' WindowName: 'frzmouse'
Creates and executes the following
- '<Current directory>\nomousy.exe' /hide
- '<Current directory>\nircmd.exe' win show class progman
- '<Current directory>\hider.exe' -show -exit
- '<Current directory>\irotate.exe' /rotate=0 /exit
- '<Current directory>\nomousy.exe'
- '<Current directory>\nircmd.exe' waitprocess game.exe
- '<Current directory>\nircmd.exe' win center alltop
- '<Current directory>\nircmd.exe' win setsize class "JJ11X" 0 0 1152 864
- '<Current directory>\nircmd.exe' win -style class "JJ11X" 0x00CF0000
- '<Current directory>\cmdow.exe' /UW
- '<Current directory>\nircmd.exe' setdisplay 1152 864 32
- '<Current directory>\cmdow.exe' /p
- '<Current directory>\irotate.exe' /rotate=90 /exit
- '<Current directory>\nircmd.exe' win hide class "Button"
- '<Current directory>\nircmd.exe' win hide class progman
- '<Current directory>\hider.exe' -hide -exit
- '<Current directory>\cmdow.exe' /MA
- '<Current directory>\cmdow.exe' @ /HID
- '<Current directory>\nircmd.exe' win show class "Button"
- '%WINDIR%\syswow64\cmd.exe' /c %TEMP%\bt3152.bat' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c %TEMP%\bt3152.bat
- '%WINDIR%\syswow64\cmd.exe' /c REG query "HKEY_CURRENT_USER\Control Panel\Desktop" /v Wallpaper | find "REG_SZ"
- '%WINDIR%\syswow64\reg.exe' query "HKEY_CURRENT_USER\Control Panel\Desktop" /v Wallpaper
- '%WINDIR%\syswow64\find.exe' "REG_SZ"
- '%WINDIR%\syswow64\cmd.exe' /c Reg Query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /V ProductName|Find "REG_SZ"
- '%WINDIR%\syswow64\reg.exe' Query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /V ProductName
- '%WINDIR%\syswow64\cmd.exe' /c Echo Windows 7 Enterprise
- '%WINDIR%\syswow64\cmd.exe' /c cmdow /p
- '%WINDIR%\syswow64\sdbinst.exe' -q raiden4.sdb
- '%WINDIR%\syswow64\ping.exe' -n 6 localhost
- '%WINDIR%\syswow64\sdbinst.exe' -u -q raiden4.sdb
