Technical Information
To ensure autorun and distribution
Sets the following service settings
- [HKLM\System\CurrentControlSet\Services\TWIEventCollectionSvc 3.33.195.66] 'Start' = '00000002'
- [HKLM\System\CurrentControlSet\Services\TWIEventCollectionSvc 3.33.195.66] 'ImagePath' = '%ALLUSERSPROFILE%\TWIEventCollectionSvc 3.33.195.66\TWIEventCollectionSvc 3.33.195.66.exe'
Creates the following services
- 'TWIEventCollectionSvc 3.33.195.66' %ALLUSERSPROFILE%\TWIEventCollectionSvc 3.33.195.66\TWIEventCollectionSvc 3.33.195.66.exe
Modifies file system
Creates the following files
- %TEMP%\is-ugpra.tmp\<File name>.tmp
- %LOCALAPPDATA%\disk settings\unins000.dat
- %LOCALAPPDATA%\disk settings\is-l399g.tmp
- %LOCALAPPDATA%\disk settings\is-uapba.tmp
- %LOCALAPPDATA%\disk settings\is-mbjrh.tmp
- %LOCALAPPDATA%\disk settings\is-bogmd.tmp
- %LOCALAPPDATA%\disk settings\is-9icor.tmp
- %LOCALAPPDATA%\disk settings\is-njim6.tmp
- %LOCALAPPDATA%\disk settings\is-pjr9g.tmp
- %LOCALAPPDATA%\disk settings\is-e5np0.tmp
- %LOCALAPPDATA%\disk settings\is-o4lmo.tmp
- %TEMP%\is-3ljdi.tmp\_isetup\_iscrypt.dll
- %TEMP%\is-3ljdi.tmp\_isetup\_isdecmp.dll
- %TEMP%\is-3ljdi.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-3ljdi.tmp\_isetup\_setup64.tmp
- %TEMP%\is-3ljdi.tmp\_isetup\_regdll.tmp
- %LOCALAPPDATA%\disk settings\disksettings.exe
- %ALLUSERSPROFILE%\twieventcollectionsvc 3.33.195.66\twieventcollectionsvc 3.33.195.66.exe
Moves the following files
- from %LOCALAPPDATA%\disk settings\is-o4lmo.tmp to %LOCALAPPDATA%\disk settings\unins000.exe
- from %LOCALAPPDATA%\disk settings\is-e5np0.tmp to %LOCALAPPDATA%\disk settings\libeay32.dll
- from %LOCALAPPDATA%\disk settings\is-pjr9g.tmp to %LOCALAPPDATA%\disk settings\ssleay32.dll
- from %LOCALAPPDATA%\disk settings\is-njim6.tmp to %LOCALAPPDATA%\disk settings\libcrypto-1_1.dll
- from %LOCALAPPDATA%\disk settings\is-9icor.tmp to %LOCALAPPDATA%\disk settings\libssl-1_1.dll
- from %LOCALAPPDATA%\disk settings\is-bogmd.tmp to %LOCALAPPDATA%\disk settings\vk_swiftshader_icd.json
- from %LOCALAPPDATA%\disk settings\is-mbjrh.tmp to %LOCALAPPDATA%\disk settings\snapshot_blob.bin
- from %LOCALAPPDATA%\disk settings\is-uapba.tmp to %LOCALAPPDATA%\disk settings\v8_context_snapshot.bin
- from %LOCALAPPDATA%\disk settings\is-l399g.tmp to %LOCALAPPDATA%\disk settings\disksettings.exe
Miscellaneous
Searches for the following windows
- ClassName: 'b8b301_Flash453FixClass_b8b301' WindowName: ''
Creates and executes the following
- '%TEMP%\is-ugpra.tmp\<File name>.tmp' /SL5="$F0258,4005319,54272,<Full path to file>"
- '%LOCALAPPDATA%\disk settings\disksettings.exe' -i
- '%LOCALAPPDATA%\disk settings\disksettings.exe' -s
