Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKLM>\SOFTWARE\Classes\R-Drive Image.CommandFile\shell\open\command] '' = 'r-driveimagecl.exe cmd="%1"'
- [<HKLM>\SOFTWARE\Classes\R-Drive Image.File\shell\open\command] '' = '"%TEMP%\R-Drive7010\App\RDI\R-DriveImage.exe" restore -a=\"%1\"'
Sets the following service settings
- [<HKLM>\System\CurrentControlSet\Services\R-ImageDisk] 'ImagePath' = '%TEMP%\R-Drive7010\App\RDI\R-ImageDisk64.sys'
Creates the following services
- 'R-ImageDisk' %TEMP%\R-Drive7010\App\RDI\R-ImageDisk64.sys
Modifies file system
Creates the following files
- %TEMP%\r-drive7010\app\appinfo\appicon.ico
- %TEMP%\r-drive7010\app\rdi\r-imagedisk64.sys
- %TEMP%\r-drive7010\app\rdi\rdrvmpuninstall32.exe
- %TEMP%\r-drive7010\app\rdi\rdrvmpuninstall64.exe
- %TEMP%\r-drive7010\app\rdi\rhelper.exe
- %TEMP%\r-drive7010\app\rdi\rsm.exe
- %TEMP%\r-drive7010\app\rdi\rvss64.exe
- %TEMP%\r-drive7010\app\rdi\w32\libeay32.dll
- %TEMP%\r-drive7010\app\rdi\w32\ssleay32.dll
- %TEMP%\nsx53fa.tmp
- %TEMP%\nsc541a.tmp\runtimedata.ini
- %TEMP%\nsc541a.tmp\system.dll
- %TEMP%\nsc541a.tmp\launcher.ini
- %TEMP%\r-drive7010\data\settings\r-driveimage.reg
- %TEMP%\nsc541a.tmp\registry.dll
- %TEMP%\nsc541a.tmp\nsexec.dll
- %TEMP%\r-drive7010\data\settings\r-driveimageportablesettings.ini
- %TEMP%\nsc541a.tmp\newtextreplace.dll
- %TEMP%\r-drive7010\data\portableapps.comlauncherruntimedata-r-driveimageportable.ini
- %TEMP%\r-drive7010\app\rdi\r-imagedisk.sys
- %TEMP%\r-drive7010\r-driveimageportable.exe
- %TEMP%\r-drive7010\app\rdi\r-driveimagecl.exe
- %TEMP%\r-drive7010\app\rdi\plugins\bartpe\r-drive image\rdi_nu2menu.xml
- %TEMP%\r-drive7010\app\appinfo\appinfo.ini
- %TEMP%\r-drive7010\app\appinfo\launcher\custom.nsh
- %TEMP%\r-drive7010\app\appinfo\launcher\r-driveimageportable.ini
- %TEMP%\r-drive7010\app\defaultdata\settings\r-driveimage.reg
- %TEMP%\r-drive7010\app\rdi\eula.txt
- %TEMP%\r-drive7010\app\rdi\lrdiboot.bin
- %TEMP%\r-drive7010\app\rdi\plugins\bartpe\r-drive image\rdi.htm
- %TEMP%\r-drive7010\app\rdi\plugins\bartpe\r-drive image\rdi.inf
- %TEMP%\r-drive7010\app\rdi\rdicpe.bin
- %TEMP%\r-drive7010\app\rdi\i386\rdrvmp.sys
- %TEMP%\r-drive7010\app\rdi\rdrive.bin
- %TEMP%\r-drive7010\app\rdi\rdrvmp.cat
- %TEMP%\r-drive7010\app\rdi\rdrvmp.inf
- %TEMP%\r-drive7010\app\rdi\amd64\rdrvmp.sys
- %TEMP%\r-drive7010\app\rdi\cdrecord.exe
- %TEMP%\r-drive7010\app\rdi\drvsnsht.sys
- %TEMP%\r-drive7010\app\rdi\drvsnsht64.sys
- %TEMP%\r-drive7010\app\rdi\hhe.exe
- %TEMP%\r-drive7010\app\rdi\r-driveimage.exe
- %WINDIR%\temp\udd8d70.tmp
Deletes the following files
- %TEMP%\r-drive7010\app\rdi\rdicpe.bin
- %WINDIR%\temp\udd8d70.tmp
Substitutes the following files
- %TEMP%\r-drive7010\app\rdi\rdicpe.bin
Network activity
Connects to
- 'se###e.r-tt.com':443
TCP
Other
- 'se###e.r-tt.com':443
UDP
- DNS ASK se###e.r-tt.com
Miscellaneous
Creates and executes the following
- '%TEMP%\r-drive7010\r-driveimageportable.exe'
- '%TEMP%\r-drive7010\app\rdi\r-driveimage.exe'
- '<SYSTEM32>\net.exe' start RdrVmpUninstall' (with hidden window)
- '<SYSTEM32>\pnputil.exe' /remove-device ROOT\SCSIADAPTER\0000' (with hidden window)
- '<SYSTEM32>\pnputil.exe' /delete-driver /uninstall /force' (with hidden window)
- '<SYSTEM32>\sc.exe' delete RdrVmp' (with hidden window)
Executes the following
- '<SYSTEM32>\net.exe' start RdrVmpUninstall
- '<SYSTEM32>\net1.exe' start RdrVmpUninstall
- '<SYSTEM32>\pnputil.exe' /remove-device ROOT\SCSIADAPTER\0000
- '<SYSTEM32>\pnputil.exe' /delete-driver /uninstall /force
- '<SYSTEM32>\sc.exe' delete RdrVmp
