Technical Information
To ensure autorun and distribution
Creates the following services
- [<HKLM>\System\CurrentControlSet\Services\entryprotectdrv] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\entryprotectdrv] 'ImagePath' = '%ProgramFiles(x86)%\SentryBay\EntryProtect\entryprotect.sys'
- [<HKLM>\System\CurrentControlSet\Services\epinject6] 'Start' = '00000001'
- [<HKLM>\System\CurrentControlSet\Services\epinject6] 'ImagePath' = '%ProgramFiles(x86)%\SentryBay\EntryProtect\epinject.sys'
Modifies file system
Creates the following files
- %TEMP%\nsg34df.tmp
- %WINDIR%\temp\udd5f02.tmp
- %WINDIR%\temp\udd5730.tmp
- %WINDIR%\temp\udd4f5e.tmp
- %ProgramFiles(x86)%\sentrybay\entryprotect\uninstall_.exe
- %WINDIR%\temp\udd47ac.tmp
- %WINDIR%\temp\udd472e.tmp
- <SYSTEM32>\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\epinject.cat
- %ProgramFiles(x86)%\sentrybay\entryprotect\inject.exe
- %ProgramFiles(x86)%\sentrybay\entryprotect\epinject.cat.19.10.0.0.new
- %ProgramFiles(x86)%\sentrybay\entryprotect\epinject.sys.19.10.0.0.new
- <SYSTEM32>\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\1.cat
- %TEMP%\nsm3500.tmp\service.dll
- %ProgramFiles(x86)%\sentrybay\entryprotect\entryprotect.cat.19.10.0.0.new
- %ProgramFiles(x86)%\sentrybay\entryprotect\entryprotect.sys.19.10.0.0.new
- %ProgramFiles(x86)%\sentrybay\entryprotect\epclient64.dll.19.10.0.0.new
- %ProgramFiles(x86)%\sentrybay\entryprotect\epclient32.dll.19.10.0.0.new
- %TEMP%\nsm3500.tmp\system.dll
- %WINDIR%\temp\udd66d4.tmp
- %WINDIR%\temp\udd6ea6.tmp
Sets the 'hidden' attribute to the following files
- <SYSTEM32>\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\1.cat
- <SYSTEM32>\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\epinject.cat
Deletes the following files
- %TEMP%\nsm3500.tmp\service.dll
- %TEMP%\nsm3500.tmp\system.dll
- %WINDIR%\temp\udd472e.tmp
- %WINDIR%\temp\udd47ac.tmp
- %WINDIR%\temp\udd4f5e.tmp
- %WINDIR%\temp\udd5730.tmp
- %WINDIR%\temp\udd5f02.tmp
- %WINDIR%\temp\udd66d4.tmp
- %WINDIR%\temp\udd6ea6.tmp
Moves the following files
- from %ProgramFiles(x86)%\sentrybay\entryprotect\epclient32.dll.19.10.0.0.new to %ProgramFiles(x86)%\sentrybay\entryprotect\epclient32.dll
- from %ProgramFiles(x86)%\sentrybay\entryprotect\epclient64.dll.19.10.0.0.new to %ProgramFiles(x86)%\sentrybay\entryprotect\epclient64.dll
- from %ProgramFiles(x86)%\sentrybay\entryprotect\entryprotect.sys.19.10.0.0.new to %ProgramFiles(x86)%\sentrybay\entryprotect\entryprotect.sys
- from %ProgramFiles(x86)%\sentrybay\entryprotect\entryprotect.cat.19.10.0.0.new to %ProgramFiles(x86)%\sentrybay\entryprotect\entryprotect.cat
- from %ProgramFiles(x86)%\sentrybay\entryprotect\epinject.sys.19.10.0.0.new to %ProgramFiles(x86)%\sentrybay\entryprotect\epinject.sys
- from %ProgramFiles(x86)%\sentrybay\entryprotect\epinject.cat.19.10.0.0.new to %ProgramFiles(x86)%\sentrybay\entryprotect\epinject.cat
Miscellaneous
Creates and executes the following
- '%ProgramFiles(x86)%\sentrybay\entryprotect\inject.exe' install "%ProgramFiles(x86)%\SentryBay\EntryProtect\epinject.sys" "%ProgramFiles(x86)%\SentryBay\EntryProtect\epinject.cat"
