Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- %APPDATA%\microsoft\windows\start menu\programs\startup\opmstart.eu.url
Modifies file system
Creates the following files
- %PROGRAMDATA%\activationacronisti(h).exe
- %TEMP%\7zipsfx.000\19.0.0.5586\libcrypto10.dll
- %TEMP%\7zipsfx.000\19.0.0.5576\libcrypto10.dll
- %TEMP%\7zipsfx.000\19.0.0.5518\libcrypto10.dll
- %TEMP%\7zipsfx.000\18.0.0.6615\libcrypto10.dll
- %TEMP%\7zipsfx.000\18.0.0.6613\libcrypto10.dll
- %TEMP%\7zipsfx.000\18.0.0.6525\libcrypto10.dll
- %TEMP%\7zipsfx.000\18.0.0.6055\libcrypto10.dll
- %TEMP%\7zipsfx.000\18.0.0.5539\libcrypto10.dll
- %TEMP%\7zipsfx.000\17.0.0.6688\libcrypto10.dll
- %TEMP%\7zipsfx.000\17.0.0.6673\libcrypto10.dll
- %TEMP%\7zipsfx.000\17.0.0.6614\libcrypto10.dll
- %TEMP%\7zipsfx.000\17.0.0.5560\libcrypto10.dll
- %TEMP%\7zipsfx.000\16.0.0.6528\libcrypto10.dll
- %TEMP%\7zipsfx.000\16.0.0.6514\libcrypto10.dll
- %TEMP%\7zipsfx.000\16.0.0.5587\libcrypto10.dll
- %TEMP%\7zipsfx.000\15.0.0.7133\libcrypto10.dll
- %TEMP%\7zipsfx.000\15.0.0.6131\libcrypto10.dll
- %TEMP%\7zipsfx.000\16.0.0.5551\libcrypto10.dll
- %TEMP%\7zipsfx.000\acronis_x86.reg
- %TEMP%\7zipsfx.000\acronis_x64.reg
- %TEMP%\7zipsfx.000\version.vbs
- %TEMP%\7zipsfx.000\activation_en.cmd
- %TEMP%\7zipsfx.000\activation_de.cmd
- %TEMP%\7zipsfx.000\activation.cmd
- %PROGRAMDATA%\opmstart\opmstart.exe
- %TEMP%\7zipsfx.000\19.0.0.5620\libcrypto10.dll
- nul
Miscellaneous
Creates and executes the following
- '%PROGRAMDATA%\activationacronisti(h).exe'
- '%PROGRAMDATA%\opmstart\opmstart.exe'
Executes the following
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\7ZipSfx.000\Activation.cmd" "
- '<SYSTEM32>\cmd.exe' /c REG QUERY "HKLM\SYSTEM\CurrentControlSet\Control\Nls\Language" /v InstallLanguage
- '<SYSTEM32>\reg.exe' QUERY "HKLM\SYSTEM\CurrentControlSet\Control\Nls\Language" /v InstallLanguage
- '<SYSTEM32>\mode.com' con:cols=80 lines=36
- '<SYSTEM32>\cmd.exe' /c REG QUERY "HKLM\SOFTWARE\Wow6432Node\Acronis\TrueImageHome\Settings" /v LicenseActivatorExePath 2>NUL
- '<SYSTEM32>\reg.exe' QUERY "HKLM\SOFTWARE\Wow6432Node\Acronis\TrueImageHome\Settings" /v LicenseActivatorExePath
- '<SYSTEM32>\cmd.exe' /c REG QUERY "HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows Script Host\Settings" /v Enabled 2>NUL
- '<SYSTEM32>\reg.exe' QUERY "HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows Script Host\Settings" /v Enabled
- '<SYSTEM32>\cmd.exe' /c REG QUERY "HKLM\SOFTWARE\Microsoft\Windows Script Host\Settings" /v Enabled 2>NUL
- '<SYSTEM32>\reg.exe' QUERY "HKLM\SOFTWARE\Microsoft\Windows Script Host\Settings" /v Enabled
