Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\microsoft\windows\multimedia\updatemedia
- <SYSTEM32>\tasks\microsoft\windows\diskdiagnostic\disk performance
Modifies file system
Creates the following files
- %TEMP%\ãëà ç.òâ\lws.log
- %WINDIR%\temp\{ff8edb2e-40bd-41b6-b1ff-3950f76692e1}\.ba\mbapreq.dll
- %WINDIR%\temp\{ff8edb2e-40bd-41b6-b1ff-3950f76692e1}\.ba\mbapreq.thm
- %WINDIR%\temp\{ff8edb2e-40bd-41b6-b1ff-3950f76692e1}\.ba\mbapreq.png
- %WINDIR%\temp\{ff8edb2e-40bd-41b6-b1ff-3950f76692e1}\.ba\1028\mbapreq.wxl
- %WINDIR%\temp\{ff8edb2e-40bd-41b6-b1ff-3950f76692e1}\.ba\1029\mbapreq.wxl
- %WINDIR%\temp\{ff8edb2e-40bd-41b6-b1ff-3950f76692e1}\.ba\1030\mbapreq.wxl
- %WINDIR%\temp\{ff8edb2e-40bd-41b6-b1ff-3950f76692e1}\.ba\1031\mbapreq.wxl
- %WINDIR%\temp\{ff8edb2e-40bd-41b6-b1ff-3950f76692e1}\.ba\1032\mbapreq.wxl
- %WINDIR%\temp\{ff8edb2e-40bd-41b6-b1ff-3950f76692e1}\.ba\1035\mbapreq.wxl
- %WINDIR%\temp\{ff8edb2e-40bd-41b6-b1ff-3950f76692e1}\.ba\1036\mbapreq.wxl
- %WINDIR%\temp\{ff8edb2e-40bd-41b6-b1ff-3950f76692e1}\.ba\1038\mbapreq.wxl
- %WINDIR%\temp\{ff8edb2e-40bd-41b6-b1ff-3950f76692e1}\.ba\1040\mbapreq.wxl
- %WINDIR%\temp\{ff8edb2e-40bd-41b6-b1ff-3950f76692e1}\.ba\1042\mbapreq.wxl
- %WINDIR%\temp\{ff8edb2e-40bd-41b6-b1ff-3950f76692e1}\.ba\bootstrapperapplicationdata.xml
- %WINDIR%\temp\{ff8edb2e-40bd-41b6-b1ff-3950f76692e1}\.ba\1043\mbapreq.wxl
- %WINDIR%\temp\{ff8edb2e-40bd-41b6-b1ff-3950f76692e1}\.ba\1044\mbapreq.wxl
- %WINDIR%\temp\{ff8edb2e-40bd-41b6-b1ff-3950f76692e1}\.ba\1045\mbapreq.wxl
- %WINDIR%\temp\{ff8edb2e-40bd-41b6-b1ff-3950f76692e1}\.ba\1046\mbapreq.wxl
- %WINDIR%\temp\{ff8edb2e-40bd-41b6-b1ff-3950f76692e1}\.ba\1049\mbapreq.wxl
- %WINDIR%\temp\{ff8edb2e-40bd-41b6-b1ff-3950f76692e1}\.ba\1051\mbapreq.wxl
- %WINDIR%\temp\{ff8edb2e-40bd-41b6-b1ff-3950f76692e1}\.ba\1053\mbapreq.wxl
- %WINDIR%\temp\{ff8edb2e-40bd-41b6-b1ff-3950f76692e1}\.ba\1055\mbapreq.wxl
- %WINDIR%\temp\{ff8edb2e-40bd-41b6-b1ff-3950f76692e1}\.ba\1060\mbapreq.wxl
- %WINDIR%\temp\{ff8edb2e-40bd-41b6-b1ff-3950f76692e1}\.ba\2052\mbapreq.wxl
- %WINDIR%\temp\{ff8edb2e-40bd-41b6-b1ff-3950f76692e1}\.ba\2070\mbapreq.wxl
- %WINDIR%\temp\{ff8edb2e-40bd-41b6-b1ff-3950f76692e1}\.ba\3082\mbapreq.wxl
- %WINDIR%\temp\{ff8edb2e-40bd-41b6-b1ff-3950f76692e1}\.ba\microsoft.deployment.windowsinstaller.dll
- %WINDIR%\temp\{ff8edb2e-40bd-41b6-b1ff-3950f76692e1}\.ba\1041\mbapreq.wxl
- %WINDIR%\temp\{ff8edb2e-40bd-41b6-b1ff-3950f76692e1}\.ba\system.configuration.install.dll
- %WINDIR%\temp\{ff8edb2e-40bd-41b6-b1ff-3950f76692e1}\.ba\wixinstaller.dll
- %TEMP%\fc507me\sv7c\ftest.exe
- %TEMP%\fcea32sc\ncsef.exe
- %TEMP%\jtab75aa6igty5j\mel7nru6.exe
- %TEMP%\ãëà ç.òâ\uninstall.exe
- %TEMP%\ãëà ç.òâ\uninstall.ini
- %WINDIR%\temp\{474ddee3-ad64-4f33-9bce-67100c9f678a}\.cr\mel7nru6.exe
- %WINDIR%\media\update\updatem.exe
- %WINDIR%\media\update\setup.bat
- %WINDIR%\media\update\syslog.xml
- %WINDIR%\media\update\update.vbs
- %WINDIR%\temp\{ff8edb2e-40bd-41b6-b1ff-3950f76692e1}\.ba\mbahost.dll
- %WINDIR%\temp\{ff8edb2e-40bd-41b6-b1ff-3950f76692e1}\.ba\bootstrappercore.config
- %WINDIR%\temp\{ff8edb2e-40bd-41b6-b1ff-3950f76692e1}\.ba\bootstrappercore.dll
- %WINDIR%\temp\sew.bat
- %WINDIR%\temp\{ff8edb2e-40bd-41b6-b1ff-3950f76692e1}\.ba\mbapreq.wxl
- %WINDIR%\temp\{ff8edb2e-40bd-41b6-b1ff-3950f76692e1}\.ba\dotnetzip.dll
- %WINDIR%\temp\{ff8edb2e-40bd-41b6-b1ff-3950f76692e1}\.ba\galasoft.mvvmlight.dll
- %WINDIR%\temp\{ff8edb2e-40bd-41b6-b1ff-3950f76692e1}\.ba\galasoft.mvvmlight.extras.dll
- %WINDIR%\temp\{ff8edb2e-40bd-41b6-b1ff-3950f76692e1}\.ba\microsoft.practices.servicelocation.dll
- %WINDIR%\temp\{ff8edb2e-40bd-41b6-b1ff-3950f76692e1}\.ba\microsoft.windowsapicodepack.dll
- %WINDIR%\temp\{ff8edb2e-40bd-41b6-b1ff-3950f76692e1}\.ba\microsoft.windowsapicodepack.shell.dll
- %WINDIR%\temp\{ff8edb2e-40bd-41b6-b1ff-3950f76692e1}\.ba\fontawesome.wpf.dll
- %WINDIR%\temp\sew.vbs
- %WINDIR%\temp\wbc.xml
- %WINDIR%\temp\diskperf.exe
- %WINDIR%\temp\{ff8edb2e-40bd-41b6-b1ff-3950f76692e1}\.ba\release.zip
- %WINDIR%\temp\{ff8edb2e-40bd-41b6-b1ff-3950f76692e1}\.ba\system.serviceprocess.dll
- %TEMP%\glaz.tv_20221016162902.log
Deletes the following files
- %WINDIR%\media\update\update.vbs
- %WINDIR%\media\update\syslog.xml
- %WINDIR%\temp\sew.vbs
- %WINDIR%\temp\wbc.xml
Miscellaneous
Searches for the following windows
- ClassName: 'EDIT' WindowName: ''
Creates and executes the following
- '%TEMP%\fc507me\sv7c\ftest.exe' -psystem
- '%TEMP%\jtab75aa6igty5j\mel7nru6.exe'
- '%TEMP%\fcea32sc\ncsef.exe' -psystem
- '%WINDIR%\syswow64\wscript.exe' "%WINDIR%\Media\Update\update.vbs"
- '%WINDIR%\temp\{474ddee3-ad64-4f33-9bce-67100c9f678a}\.cr\mel7nru6.exe' -burn.clean.room="%TEMP%\jtab75aa6igty5j\mel7nru6.exe" -burn.filehandle.attached=192 -burn.filehandle.self=200
- '%WINDIR%\syswow64\wscript.exe' "%WINDIR%\Temp\sew.vbs"
- '%TEMP%\fc507me\sv7c\ftest.exe' -psystem' (with hidden window)
- '%TEMP%\fcea32sc\ncsef.exe' -psystem' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c ""%WINDIR%\Temp\sew.bat" "' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c ""%WINDIR%\Media\Update\setup.bat" "' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c ""%WINDIR%\Temp\sew.bat" "
- '%WINDIR%\syswow64\cmd.exe' /c ""%WINDIR%\Media\Update\setup.bat" "
- '%WINDIR%\syswow64\attrib.exe' +h "%WINDIR%\media\Update"
- '%WINDIR%\syswow64\reg.exe' add "hkey_current_user\software\sysinternals\psexec" /v EulaAccepted /t reg_dword /d 00000001 /f
- '%WINDIR%\syswow64\schtasks.exe' /create /f /tn "\Microsoft\Windows\Multimedia\UpdateMedia" /xml "%WINDIR%\Media\Update\syslog.xml"
- '%WINDIR%\syswow64\schtasks.exe' /Create /F /TN "\Microsoft\Windows\DiskDiagnostic\Disk Performance" /xml "%WINDIR%\Temp\wbc.xml"
- '%WINDIR%\syswow64\timeout.exe' /t 7
- '%WINDIR%\syswow64\timeout.exe' /T 10
