Technical Information
To ensure autorun and distribution
Creates the following services
- [<HKLM>\System\CurrentControlSet\Services\Invoker] 'ImagePath' = '%WINDIR%\SysWOW64\Drivers\Invoker.sys'
- [<HKLM>\System\CurrentControlSet\Services\FlexBios] 'ImagePath' = '%WINDIR%\SysWOW64\Drivers\FlexBios.sys'
- [<HKLM>\System\CurrentControlSet\Services\EBIOS32] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\EBIOS32] 'ImagePath' = 'System32\Drivers\EBIOS32.SYS'
Modifies file system
Creates the following files
- %TEMP%\extb8c8.tmp
- %TEMP%\{107254a0-0adf-11d4-9397-00d0b7020b38}\dialc923.rra
- %TEMP%\{107254a0-0adf-11d4-9397-00d0b7020b38}\ebioc923.rra
- %TEMP%\{107254a0-0adf-11d4-9397-00d0b7020b38}\ebioc932.rra
- %TEMP%\{107254a0-0adf-11d4-9397-00d0b7020b38}\etknc942.rra
- %TEMP%\{107254a0-0adf-11d4-9397-00d0b7020b38}\flexc952.rra
- %TEMP%\{107254a0-0adf-11d4-9397-00d0b7020b38}\flexc961.rra
- %TEMP%\{107254a0-0adf-11d4-9397-00d0b7020b38}\flexc971.rra
- %TEMP%\{107254a0-0adf-11d4-9397-00d0b7020b38}\invoc981.rra
- %TEMP%\{107254a0-0adf-11d4-9397-00d0b7020b38}\invoc990.rra
- %TEMP%\{107254a0-0adf-11d4-9397-00d0b7020b38}\licec904.rra
- %TEMP%\{107254a0-0adf-11d4-9397-00d0b7020b38}\backc913.rra
- %TEMP%\{107254a0-0adf-11d4-9397-00d0b7020b38}\ismbc990.rra
- %TEMP%\{107254a0-0adf-11d4-9397-00d0b7020b38}\_isuc9a0.rra
- %TEMP%\{107254a0-0adf-11d4-9397-00d0b7020b38}\valuc9cf.rra
- %TEMP%\{107254a0-0adf-11d4-9397-00d0b7020b38}\vssvc9cf.rra
- %TEMP%\{107254a0-0adf-11d4-9397-00d0b7020b38}\isrtc9ee.rra
- %TEMP%\{107254a0-0adf-11d4-9397-00d0b7020b38}\defaca0d.rra
- %TEMP%\{107254a0-0adf-11d4-9397-00d0b7020b38}\_isrca4c.rra
- C:\ebudlltmpdir\flexeng.dll
- %WINDIR%\syswow64\drivers\invoker.sys
- %WINDIR%\temp\uddd43f.tmp
- %TEMP%\{107254a0-0adf-11d4-9397-00d0b7020b38}\ismbc9a0.rra
- %TEMP%\{107254a0-0adf-11d4-9397-00d0b7020b38}\readc9a0.rra
- %TEMP%\{107254a0-0adf-11d4-9397-00d0b7020b38}\setuc8f4.rra
- %CommonProgramFiles(x86)%\installshield\iscript\iscrc683.rra
- %CommonProgramFiles(x86)%\installshield\engine\6\intel 32\iusec55a.rra
- %TEMP%\pftb985.tmp\pftw1.pkg
- %TEMP%\pftb985.tmp\biosupdate.bio
- %TEMP%\pftb985.tmp\data1.cab
- %TEMP%\pftb985.tmp\data1.hdr
- %TEMP%\pftb985.tmp\data2.cab
- %TEMP%\pftb985.tmp\efivar.dll
- %TEMP%\pftb985.tmp\fwupdlcl.exe
- %TEMP%\pftb985.tmp\ikernel.ex_
- %TEMP%\pftb985.tmp\intelebu.pfw
- %TEMP%\pftb985.tmp\layout.bin
- %TEMP%\plfb8c7.tmp
- %TEMP%\pftb985.tmp\meupd.bin
- %TEMP%\pftb985.tmp\setup.ini
- %TEMP%\pftb985.tmp\setup.inx
- %TEMP%\pftb985.tmp\setup.iss
- %TEMP%\pftb985.tmp\variable.sys
- %CommonProgramFiles(x86)%\installshield\engine\6\intel 32\temp.000
- %CommonProgramFiles(x86)%\installshield\engine\6\intel 32\ilogc422.rra
- %TEMP%\c318.rra
- %CommonProgramFiles(x86)%\installshield\engine\6\intel 32\corec49f.rra
- %CommonProgramFiles(x86)%\installshield\engine\6\intel 32\ctorc4be.rra
- %CommonProgramFiles(x86)%\installshield\engine\6\intel 32\objec54a.rra
- %TEMP%\pftb985.tmp\setup.exe
- %WINDIR%\syswow64\drivers\flexbios.sys
- %WINDIR%\syswow64\drivers\ebios32.sys
Deletes the following files
- %TEMP%\extb8c8.tmp
- %TEMP%\pftb985.tmp\pftw1.pkg
- %WINDIR%\syswow64\drivers\flexbios.sys
- %WINDIR%\syswow64\drivers\invoker.sys
- %WINDIR%\temp\uddd43f.tmp
Moves the following files
- from %CommonProgramFiles(x86)%\installshield\engine\6\intel 32\temp.000 to %CommonProgramFiles(x86)%\installshield\engine\6\intel 32\ikernel.exe
- from %TEMP%\{107254a0-0adf-11d4-9397-00d0b7020b38}\isrtc9ee.rra to %TEMP%\{107254a0-0adf-11d4-9397-00d0b7020b38}\isrt.dll
- from %TEMP%\{107254a0-0adf-11d4-9397-00d0b7020b38}\vssvc9cf.rra to %TEMP%\{107254a0-0adf-11d4-9397-00d0b7020b38}\vssver.scc
- from %TEMP%\{107254a0-0adf-11d4-9397-00d0b7020b38}\valuc9cf.rra to %TEMP%\{107254a0-0adf-11d4-9397-00d0b7020b38}\value.shl
- from %TEMP%\{107254a0-0adf-11d4-9397-00d0b7020b38}\_isuc9a0.rra to %TEMP%\{107254a0-0adf-11d4-9397-00d0b7020b38}\_isuser.dll
- from %TEMP%\{107254a0-0adf-11d4-9397-00d0b7020b38}\readc9a0.rra to %TEMP%\{107254a0-0adf-11d4-9397-00d0b7020b38}\readme.txt
- from %TEMP%\{107254a0-0adf-11d4-9397-00d0b7020b38}\ismbc9a0.rra to %TEMP%\{107254a0-0adf-11d4-9397-00d0b7020b38}\ismbios.vxd
- from %TEMP%\{107254a0-0adf-11d4-9397-00d0b7020b38}\ismbc990.rra to %TEMP%\{107254a0-0adf-11d4-9397-00d0b7020b38}\ismbios.sys
- from %TEMP%\{107254a0-0adf-11d4-9397-00d0b7020b38}\invoc990.rra to %TEMP%\{107254a0-0adf-11d4-9397-00d0b7020b38}\invoker64.sys
- from %TEMP%\{107254a0-0adf-11d4-9397-00d0b7020b38}\invoc981.rra to %TEMP%\{107254a0-0adf-11d4-9397-00d0b7020b38}\invoker.sys
- from %TEMP%\{107254a0-0adf-11d4-9397-00d0b7020b38}\flexc971.rra to %TEMP%\{107254a0-0adf-11d4-9397-00d0b7020b38}\flexbiosdll.dll
- from %TEMP%\{107254a0-0adf-11d4-9397-00d0b7020b38}\flexc961.rra to %TEMP%\{107254a0-0adf-11d4-9397-00d0b7020b38}\flexbios64.sys
- from %TEMP%\{107254a0-0adf-11d4-9397-00d0b7020b38}\flexc952.rra to %TEMP%\{107254a0-0adf-11d4-9397-00d0b7020b38}\flexbios.sys
- from %TEMP%\{107254a0-0adf-11d4-9397-00d0b7020b38}\etknc942.rra to %TEMP%\{107254a0-0adf-11d4-9397-00d0b7020b38}\etknvram.dll
- from %TEMP%\{107254a0-0adf-11d4-9397-00d0b7020b38}\ebioc932.rra to %TEMP%\{107254a0-0adf-11d4-9397-00d0b7020b38}\ebiosres.dll
- from %TEMP%\{107254a0-0adf-11d4-9397-00d0b7020b38}\ebioc923.rra to %TEMP%\{107254a0-0adf-11d4-9397-00d0b7020b38}\ebios32.sys
- from %TEMP%\{107254a0-0adf-11d4-9397-00d0b7020b38}\dialc923.rra to %TEMP%\{107254a0-0adf-11d4-9397-00d0b7020b38}\dialoggraphic.bmp
- from %TEMP%\{107254a0-0adf-11d4-9397-00d0b7020b38}\backc913.rra to %TEMP%\{107254a0-0adf-11d4-9397-00d0b7020b38}\background.bmp
- from %TEMP%\{107254a0-0adf-11d4-9397-00d0b7020b38}\licec904.rra to %TEMP%\{107254a0-0adf-11d4-9397-00d0b7020b38}\license.txt
- from %TEMP%\{107254a0-0adf-11d4-9397-00d0b7020b38}\setuc8f4.rra to %TEMP%\{107254a0-0adf-11d4-9397-00d0b7020b38}\setup.inx
- from %CommonProgramFiles(x86)%\installshield\iscript\iscrc683.rra to %CommonProgramFiles(x86)%\installshield\iscript\iscript.dll
- from %CommonProgramFiles(x86)%\installshield\engine\6\intel 32\iusec55a.rra to %CommonProgramFiles(x86)%\installshield\engine\6\intel 32\iuser.dll
- from %CommonProgramFiles(x86)%\installshield\engine\6\intel 32\objec54a.rra to %CommonProgramFiles(x86)%\installshield\engine\6\intel 32\objectps.dll
- from %CommonProgramFiles(x86)%\installshield\engine\6\intel 32\ctorc4be.rra to %CommonProgramFiles(x86)%\installshield\engine\6\intel 32\ctor.dll
- from %CommonProgramFiles(x86)%\installshield\engine\6\intel 32\corec49f.rra to %CommonProgramFiles(x86)%\installshield\engine\6\intel 32\corecomp.ini
- from %CommonProgramFiles(x86)%\installshield\engine\6\intel 32\ilogc422.rra to %CommonProgramFiles(x86)%\installshield\engine\6\intel 32\ilog.dll
- from %TEMP%\{107254a0-0adf-11d4-9397-00d0b7020b38}\defaca0d.rra to %TEMP%\{107254a0-0adf-11d4-9397-00d0b7020b38}\default.pal
- from %TEMP%\{107254a0-0adf-11d4-9397-00d0b7020b38}\_isrca4c.rra to %TEMP%\{107254a0-0adf-11d4-9397-00d0b7020b38}\_isres.dll
Substitutes the following files
- %TEMP%\{107254a0-0adf-11d4-9397-00d0b7020b38}\ebioc923.rra
- %TEMP%\{107254a0-0adf-11d4-9397-00d0b7020b38}\ebioc932.rra
- %TEMP%\{107254a0-0adf-11d4-9397-00d0b7020b38}\flexc952.rra
- %TEMP%\{107254a0-0adf-11d4-9397-00d0b7020b38}\flexc971.rra
- %TEMP%\{107254a0-0adf-11d4-9397-00d0b7020b38}\invoc981.rra
- %TEMP%\{107254a0-0adf-11d4-9397-00d0b7020b38}\invoc990.rra
- %TEMP%\{107254a0-0adf-11d4-9397-00d0b7020b38}\ismbc9a0.rra
Miscellaneous
Creates and executes the following
- '%TEMP%\pftb985.tmp\setup.exe' /SMS
- '%CommonProgramFiles(x86)%\installshield\engine\6\intel 32\ikernel.exe' -RegServer
- '%CommonProgramFiles(x86)%\installshield\engine\6\intel 32\ikernel.exe' /REGSERVER
