Technical Information
To ensure autorun and distribution
Creates the following files on removable media
- <Drive name for removable media>:\usb\mocrosofr.exe
- <Drive name for removable media>:\correct.avi
- <Drive name for removable media>:\correct.avi.exe
- <Drive name for removable media>:\archer.avi
- <Drive name for removable media>:\archer.avi.exe
- <Drive name for removable media>:\join.avi
- <Drive name for removable media>:\join.avi.exe
- <Drive name for removable media>:\split.avi
- <Drive name for removable media>:\dashborder_96.bmp
- <Drive name for removable media>:\dashborder_192.bmp
Modifies file system
Creates the following files
- %PROGRAMDATA%\usb\correct.ico
- %TEMP%\htclarvd.cmdline
- %TEMP%\htclarvd.0.vb
- %PROGRAMDATA%\usb\split.ico
- %TEMP%\res920d.tmp
- %TEMP%\vbc920c.tmp
- %TEMP%\5assembg.out
- %TEMP%\5assembg.cmdline
- %TEMP%\5assembg.0.vb
- %PROGRAMDATA%\usb\join.ico
- %TEMP%\htclarvd.out
- %TEMP%\res8dd6.tmp
- %TEMP%\dcc8q2o5.out
- %TEMP%\dcc8q2o5.cmdline
- %TEMP%\dcc8q2o5.0.vb
- %PROGRAMDATA%\usb\archer.ico
- %TEMP%\res2401.tmp
- %TEMP%\vbc2400.tmp
- %TEMP%\2k1fnivb.out
- %TEMP%\2k1fnivb.cmdline
- %TEMP%\2k1fnivb.0.vb
- %TEMP%\vbc8dd5.tmp
- %TEMP%\vbc13ce.tmp
Sets the 'hidden' attribute to the following files
- <Drive name for removable media>:\usb\mocrosofr.exe
Deletes the following files
- %TEMP%\res2401.tmp
- %TEMP%\htclarvd.0.vb
- %TEMP%\vbc13ce.tmp
- %TEMP%\5assembg.cmdline
- %TEMP%\5assembg.out
- %TEMP%\5assembg.0.vb
- %TEMP%\vbc920c.tmp
- %TEMP%\res920d.tmp
- %TEMP%\htclarvd.out
- %TEMP%\dcc8q2o5.0.vb
- %TEMP%\dcc8q2o5.cmdline
- %TEMP%\vbc8dd5.tmp
- %TEMP%\res8dd6.tmp
- %TEMP%\2k1fnivb.cmdline
- %TEMP%\2k1fnivb.out
- %TEMP%\2k1fnivb.0.vb
- %TEMP%\vbc2400.tmp
- %TEMP%\dcc8q2o5.out
- %TEMP%\htclarvd.cmdline
Network activity
Connects to
- 'ra#####hmed.ddns.net':333
UDP
- DNS ASK ra#####hmed.ddns.net
Miscellaneous
Creates and executes the following
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\2k1fnivb.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES2401.tmp" "%TEMP%\vbc2400.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\dcc8q2o5.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES8DD6.tmp" "%TEMP%\vbc8DD5.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\5assembg.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES920D.tmp" "%TEMP%\vbc920C.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\htclarvd.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES13DF.tmp" "%TEMP%\vbc13CE.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\aq_urocl.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESA6B9.tmp" "%TEMP%\vbcA6B8.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\kw_cknft.cmdline"' (with hidden window)
Executes the following
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\2k1fnivb.cmdline"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES2401.tmp" "%TEMP%\vbc2400.tmp"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\dcc8q2o5.cmdline"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES8DD6.tmp" "%TEMP%\vbc8DD5.tmp"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\5assembg.cmdline"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES920D.tmp" "%TEMP%\vbc920C.tmp"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\htclarvd.cmdline"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES13DF.tmp" "%TEMP%\vbc13CE.tmp"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\aq_urocl.cmdline"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESA6B9.tmp" "%TEMP%\vbcA6B8.tmp"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\kw_cknft.cmdline"
