Technical Information
To ensure autorun and distribution
Sets the following service settings
- [HKLM\System\CurrentControlSet\Services\E_MountLite_66] 'Start' = '00000002'
- [HKLM\System\CurrentControlSet\Services\E_MountLite_66] 'ImagePath' = '%ALLUSERSPROFILE%\E_MountLite_66\E_MountLite_66.exe'
Creates the following services
- 'E_MountLite_66' %ALLUSERSPROFILE%\E_MountLite_66\E_MountLite_66.exe
Modifies file system
Creates the following files
- %TEMP%\is-pj5uc.tmp\<File name>.tmp
- %LOCALAPPDATA%\cd dvd slim drive\unins000.dat
- %LOCALAPPDATA%\cd dvd slim drive\is-0vp4k.tmp
- %LOCALAPPDATA%\cd dvd slim drive\languages\is-kuj4g.tmp
- %LOCALAPPDATA%\cd dvd slim drive\is-9s5ha.tmp
- %LOCALAPPDATA%\cd dvd slim drive\is-2joau.tmp
- %LOCALAPPDATA%\cd dvd slim drive\is-hne5a.tmp
- %LOCALAPPDATA%\cd dvd slim drive\is-jmpl7.tmp
- %LOCALAPPDATA%\cd dvd slim drive\is-2urp8.tmp
- %LOCALAPPDATA%\cd dvd slim drive\is-naf1t.tmp
- %LOCALAPPDATA%\cd dvd slim drive\is-86703.tmp
- %LOCALAPPDATA%\cd dvd slim drive\is-i3bkp.tmp
- %LOCALAPPDATA%\cd dvd slim drive\is-1op0v.tmp
- %LOCALAPPDATA%\cd dvd slim drive\is-ae48r.tmp
- %LOCALAPPDATA%\cd dvd slim drive\is-p5d19.tmp
- %LOCALAPPDATA%\cd dvd slim drive\is-fnsid.tmp
- %LOCALAPPDATA%\cd dvd slim drive\is-ie5um.tmp
- %LOCALAPPDATA%\cd dvd slim drive\is-s0uh0.tmp
- %LOCALAPPDATA%\cd dvd slim drive\is-atcp4.tmp
- %LOCALAPPDATA%\cd dvd slim drive\is-570hc.tmp
- %TEMP%\is-i2bcm.tmp\_isetup\_iscrypt.dll
- %TEMP%\is-i2bcm.tmp\_isetup\_isdecmp.dll
- %TEMP%\is-i2bcm.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-i2bcm.tmp\_isetup\_setup64.tmp
- %LOCALAPPDATA%\cd dvd slim drive\cddvdslimdrive.exe
- %ALLUSERSPROFILE%\e_mountlite_66\e_mountlite_66.exe
Deletes the following files
- %LOCALAPPDATA%\cd dvd slim drive\libgcc_s_dw2-1.dll
Moves the following files
- from %LOCALAPPDATA%\cd dvd slim drive\is-570hc.tmp to %LOCALAPPDATA%\cd dvd slim drive\unins000.exe
- from %LOCALAPPDATA%\cd dvd slim drive\is-9s5ha.tmp to %LOCALAPPDATA%\cd dvd slim drive\setting.ini
- from %LOCALAPPDATA%\cd dvd slim drive\is-2joau.tmp to %LOCALAPPDATA%\cd dvd slim drive\sdl2.dll
- from %LOCALAPPDATA%\cd dvd slim drive\is-hne5a.tmp to %LOCALAPPDATA%\cd dvd slim drive\swresample-3.dll
- from %LOCALAPPDATA%\cd dvd slim drive\is-jmpl7.tmp to %LOCALAPPDATA%\cd dvd slim drive\zlib1.dll
- from %LOCALAPPDATA%\cd dvd slim drive\is-2urp8.tmp to %LOCALAPPDATA%\cd dvd slim drive\libbz2-1.dll
- from %LOCALAPPDATA%\cd dvd slim drive\is-naf1t.tmp to %LOCALAPPDATA%\cd dvd slim drive\libwinpthread-1.dll
- from %LOCALAPPDATA%\cd dvd slim drive\languages\is-kuj4g.tmp to %LOCALAPPDATA%\cd dvd slim drive\languages\turkish.ini
- from %LOCALAPPDATA%\cd dvd slim drive\is-86703.tmp to %LOCALAPPDATA%\cd dvd slim drive\libvorbisenc-2.dll
- from %LOCALAPPDATA%\cd dvd slim drive\is-1op0v.tmp to %LOCALAPPDATA%\cd dvd slim drive\libogg-0.dll
- from %LOCALAPPDATA%\cd dvd slim drive\is-ae48r.tmp to %LOCALAPPDATA%\cd dvd slim drive\libiconv-2.dll
- from %LOCALAPPDATA%\cd dvd slim drive\is-fnsid.tmp to %LOCALAPPDATA%\cd dvd slim drive\avutil-56.dll
- from %LOCALAPPDATA%\cd dvd slim drive\is-ie5um.tmp to %LOCALAPPDATA%\cd dvd slim drive\libgcc_s_dw2-1.dll
- from %LOCALAPPDATA%\cd dvd slim drive\is-s0uh0.tmp to %LOCALAPPDATA%\cd dvd slim drive\avformat-58.dll
- from %LOCALAPPDATA%\cd dvd slim drive\is-atcp4.tmp to %LOCALAPPDATA%\cd dvd slim drive\avcodec-58.dll
- from %LOCALAPPDATA%\cd dvd slim drive\is-i3bkp.tmp to %LOCALAPPDATA%\cd dvd slim drive\libvorbis-0.dll
- from %LOCALAPPDATA%\cd dvd slim drive\is-0vp4k.tmp to %LOCALAPPDATA%\cd dvd slim drive\cddvdslimdrive.exe
Substitutes the following files
- %LOCALAPPDATA%\cd dvd slim drive\libgcc_s_dw2-1.dll
Miscellaneous
Searches for the following windows
- ClassName: 'X8a031_SLIM2161FlashFixClass_X8a031' WindowName: ''
Creates and executes the following
- '%TEMP%\is-pj5uc.tmp\<File name>.tmp' /SL5="$B0250,7127622,54272,<Full path to file>"
- '%LOCALAPPDATA%\cd dvd slim drive\cddvdslimdrive.exe' -i
- '%LOCALAPPDATA%\cd dvd slim drive\cddvdslimdrive.exe' -s
