Technical Information
To ensure autorun and distribution
Sets the following service settings
- [<HKLM>\SYSTEM\CurrentControlSet\Services\fltsrv] 'ImagePath' = 'System32\drivers\fltsrv.sys'
- [<HKLM>\SYSTEM\CurrentControlSet\Services\fltsrv] 'Start' = '00000000'
- [<HKLM>\SYSTEM\CurrentControlSet\Services\snapman] 'ImagePath' = 'System32\drivers\snapman.sys'
- [<HKLM>\SYSTEM\CurrentControlSet\Services\snapman] 'Start' = '00000000'
- [<HKLM>\SYSTEM\CurrentControlSet\Services\volume_tracker] 'ImagePath' = 'System32\drivers\volume_tracker.sys'
- [<HKLM>\SYSTEM\CurrentControlSet\Services\volume_tracker] 'Start' = '00000000'
Creates the following services
- 'fltsrv' System32\drivers\fltsrv.sys
- 'snapman' System32\drivers\snapman.sys
- 'volume_tracker' System32\drivers\volume_tracker.sys
Modifies file system
Creates the following files
- %TEMP%\rarsfx0\mouse.com
- %TEMP%\rarsfx0\system32\volume_tracker_driver_api.dll
- %TEMP%\rarsfx0\winpthreads4.dll
- %TEMP%\rarsfx0\wnaspi32.dll
- %TEMP%\rarsfx0\zstd.dll
- %TEMP%\rarsfx0\atilauncher.exe
- %TEMP%\rarsfx0\backup_worker.exe
- %TEMP%\rarsfx0\cdrecord2.exe
- %TEMP%\rarsfx0\growisofs.exe
- %TEMP%\rarsfx0\readcd.exe
- %TEMP%\rarsfx0\trueimage.exe
- %TEMP%\rarsfx0\system32\drivers\fltsrv.sys
- %TEMP%\rarsfx0\system32\drivers\snapman.sys
- %TEMP%\rarsfx0\system32\drivers\volume_tracker.sys
- %TEMP%\eb76.tmp\eb77.tmp\eb78.bat
- <DRIVERS>\fltsrv.sys
- <DRIVERS>\snapman.sys
- <SYSTEM32>\snapapi.dll
- <DRIVERS>\volume_tracker.sys
- <SYSTEM32>\volume_tracker_driver_api.dll
- %WINDIR%\temp\uddf48b.tmp
- %WINDIR%\temp\uddf49b.tmp
- %WINDIR%\temp\uddf49c.tmp
- %ALLUSERSPROFILE%\acronis\trueimagehome\gadatabase\timers.db-journal
- %ALLUSERSPROFILE%\acronis\trueimagehome\gadatabase\timers.db
- %ALLUSERSPROFILE%\acronis\trueimagehome\gadatabase\timers.db-shm
- %ALLUSERSPROFILE%\acronis\trueimagehome\gadatabase\timers.db-wal
- %ALLUSERSPROFILE%\acronis\snapapilogs\snapapi-20210313-234450-976.0.log
- %TEMP%\rarsfx0\vccorlib120.dll
- %ALLUSERSPROFILE%\acronis\trueimagehome\database\archives.db-journal
- %TEMP%\rarsfx0\ulxmlrpcpp.dll
- %TEMP%\rarsfx0\tib_api.dll
- %TEMP%\rarsfx0\archive3.dll
- %TEMP%\rarsfx0\archive3_adapter.dll
- %TEMP%\rarsfx0\astor_client.dll
- %TEMP%\rarsfx0\boot_assist.dll
- %TEMP%\rarsfx0\curl.dll
- %TEMP%\rarsfx0\disk_backup.dll
- %TEMP%\rarsfx0\expat.dll
- %TEMP%\rarsfx0\file_backup.dll
- %TEMP%\rarsfx0\fox.dll
- %TEMP%\rarsfx0\icu38.dll
- %TEMP%\rarsfx0\icudt38.dll
- %TEMP%\rarsfx0\kb_link.dll
- %TEMP%\rarsfx0\libcrypto10.dll
- %TEMP%\rarsfx0\libqrencode.dll
- %TEMP%\rarsfx0\libssl10.dll
- %TEMP%\rarsfx0\logging.dll
- %TEMP%\rarsfx0\mspack.dll
- %TEMP%\rarsfx0\msvcp120.dll
- %TEMP%\rarsfx0\msvcr120.dll
- %TEMP%\rarsfx0\oem_doc_source.dll
- %TEMP%\rarsfx0\onig.dll
- %TEMP%\rarsfx0\pcs_io.dll
- %TEMP%\rarsfx0\re2.dll
- %TEMP%\rarsfx0\resource.dll
- %TEMP%\rarsfx0\rpc_client.dll
- %TEMP%\rarsfx0\system32\snapapi.dll
- %TEMP%\rarsfx0\thread_pool.dll
- %TEMP%\rarsfx0\tib_mounter.dll
- %ALLUSERSPROFILE%\acronis\trueimagehome\database\archives.db
Deletes the following files
- %WINDIR%\temp\uddf48b.tmp
- %WINDIR%\temp\uddf49b.tmp
- %WINDIR%\temp\uddf49c.tmp
- %TEMP%\eb76.tmp\eb77.tmp\eb78.bat
- %ALLUSERSPROFILE%\acronis\trueimagehome\gadatabase\timers.db-journal
- %ALLUSERSPROFILE%\acronis\trueimagehome\database\archives.db-journal
Substitutes the following files
- %ALLUSERSPROFILE%\acronis\trueimagehome\database\archives.db-journal
Miscellaneous
Searches for the following windows
- ClassName: 'EDIT' WindowName: ''
- ClassName: 'TRUEIMAGE_DUMMY_APPLICATION_WINDOW' WindowName: ''
Creates and executes the following
- '%TEMP%\rarsfx0\atilauncher.exe'
- '%TEMP%\rarsfx0\trueimage.exe'
- '<SYSTEM32>\cmd.exe' /c "%TEMP%\EB76.tmp\EB77.tmp\EB78.bat %TEMP%\RarSFX0\ATILauncher.exe"' (with hidden window)
Executes the following
- '<SYSTEM32>\cmd.exe' /c "%TEMP%\EB76.tmp\EB77.tmp\EB78.bat %TEMP%\RarSFX0\ATILauncher.exe"
- '<SYSTEM32>\cmd.exe' /S /D /c" echo "" "
- '<SYSTEM32>\reg.exe' add HKLM\SYSTEM\CurrentControlSet\Control\Class\{71a27cdd-812a-11d0-bec7-08002be2092f} /f /v UpperFilters /t REG_MULTI_SZ /d "fltsrv"
- '<SYSTEM32>\reg.exe' add HKLM\SOFTWARE\Acronis\TrueImage /f /v standard /t REG_SZ /d " 19109 19 30 18 27108108120 6 31 96 30 20 25 7 97120109108 16 30 18 23 31108120103 4 29 97 27 29 13 97120 30 2...
- '<SYSTEM32>\reg.exe' add HKLM\SOFTWARE\Acronis\TrueImageHome\Settings /f /v ServiceDir /t REG_SZ /d "
- '<SYSTEM32>\reg.exe' add HKLM\SOFTWARE\Acronis\GlobalComponents /f /v snapapi.dll /t REG_SZ /d "<SYSTEM32>\snapapi.dll"
- '<SYSTEM32>\reg.exe' add HKLM\SOFTWARE\Acronis\GlobalComponents /f /v volume_tracker_driver_api.dll /t REG_SZ /d "<SYSTEM32>\volume_tracker_driver_api.dll"
- '<SYSTEM32>\reg.exe' add HKLM\SOFTWARE\Acronis\CommonComponents /f /v archive3.dll /t REG_SZ /d "archive3.dll"
- '<SYSTEM32>\reg.exe' add HKLM\SOFTWARE\Acronis\CommonComponents /f /v archive3_adapter.dll /t REG_SZ /d "archive3_adapter.dll"
- '<SYSTEM32>\reg.exe' add HKLM\SOFTWARE\Acronis\CommonComponents /f /v astor_client.dll /t REG_SZ /d "astor_client.dll"
- '<SYSTEM32>\reg.exe' add HKLM\SOFTWARE\Acronis\CommonComponents /f /v boot_assist.dll /t REG_SZ /d "boot_assist.dll"
- '<SYSTEM32>\reg.exe' add HKLM\SOFTWARE\Acronis\CommonComponents /f /v disk_backup.dll /t REG_SZ /d "disk_backup.dll"
- '<SYSTEM32>\reg.exe' add HKLM\SOFTWARE\Acronis\CommonComponents /f /v expat.dll /t REG_SZ /d "expat.dll"
- '<SYSTEM32>\reg.exe' add HKLM\SOFTWARE\Acronis\CommonComponents /f /v file_backup.dll /t REG_SZ /d "file_backup.dll"
- '<SYSTEM32>\reg.exe' add HKLM\SOFTWARE\Acronis\CommonComponents /f /v icu38.dll /t REG_SZ /d "icu38.dll"
- '<SYSTEM32>\reg.exe' add HKLM\SOFTWARE\Acronis\CommonComponents /f /v libcrypto10.dll /t REG_SZ /d "libcrypto10.dll"
- '<SYSTEM32>\reg.exe' add HKLM\SOFTWARE\Acronis\CommonComponents /f /v zstd.dll /t REG_SZ /d "zstd.dll"
- '<SYSTEM32>\reg.exe' add HKLM\SOFTWARE\Acronis\CommonComponents /f /v libssl10.dll /t REG_SZ /d "libssl10.dll"
- '<SYSTEM32>\reg.exe' add HKLM\SOFTWARE\Acronis\CommonComponents /f /v logging.dll /t REG_SZ /d "logging.dll"
- '<SYSTEM32>\reg.exe' add HKLM\SOFTWARE\Acronis\CommonComponents /f /v mspack.dll /t REG_SZ /d "mspack.dll"
- '<SYSTEM32>\reg.exe' add HKLM\SOFTWARE\Acronis\CommonComponents /f /v oem_doc_source.dll /t REG_SZ /d "oem_doc_source.dll"
- '<SYSTEM32>\reg.exe' add HKLM\SOFTWARE\Acronis\CommonComponents /f /v onig.dll /t REG_SZ /d "onig.dll"
- '<SYSTEM32>\reg.exe' add HKLM\SOFTWARE\Acronis\CommonComponents /f /v pcs_io.dll /t REG_SZ /d "pcs_io.dll"
- '<SYSTEM32>\reg.exe' add HKLM\SOFTWARE\Acronis\CommonComponents /f /v re2.dll /t REG_SZ /d "re2.dll"
- '<SYSTEM32>\reg.exe' add HKLM\SOFTWARE\Acronis\CommonComponents /f /v resource.dll /t REG_SZ /d "resource.dll"
- '<SYSTEM32>\reg.exe' add HKLM\SOFTWARE\Acronis\CommonComponents /f /v rpc_client.dll /t REG_SZ /d "rpc_client.dll"
- '<SYSTEM32>\reg.exe' add HKLM\SOFTWARE\Acronis\CommonComponents /f /v thread_pool.dll /t REG_SZ /d "thread_pool.dll"
- '<SYSTEM32>\reg.exe' add HKLM\SOFTWARE\Acronis\CommonComponents /f /v tib_api.dll /t REG_SZ /d "tib_api.dll"
- '<SYSTEM32>\reg.exe' add HKLM\SOFTWARE\Acronis\CommonComponents /f /v tib_mounter.dll /t REG_SZ /d "tib_mounter.dll"
- '<SYSTEM32>\reg.exe' add HKLM\SOFTWARE\Acronis\CommonComponents /f /v ulxmlrpcpp.dll /t REG_SZ /d "ulxmlrpcpp.dll"
- '<SYSTEM32>\reg.exe' add HKLM\SOFTWARE\Acronis\CommonComponents /f /v winpthreads4.dll /t REG_SZ /d "winpthreads4.dll"
- '<SYSTEM32>\reg.exe' query HKLM\SYSTEM\CurrentControlSet\Control\Class\{71a27cdd-812a-11d0-bec7-08002be2092f} /v UpperFilters
- '<SYSTEM32>\reg.exe' add HKLM\SOFTWARE\Acronis\CommonComponents /f /v kb_link.dll /t REG_SZ /d "kb_link.dll"
- '<SYSTEM32>\cmd.exe' /c reg query HKLM\SYSTEM\CurrentControlSet\Control\Class\{71a27cdd-812a-11d0-bec7-08002be2092f} /v UpperFilters
- '<SYSTEM32>\reg.exe' add HKLM\SYSTEM\CurrentControlSet\Services\snapman /f /v Start /t REG_DWORD /d 0
- '<SYSTEM32>\sc.exe' query fltsrv
- '<SYSTEM32>\reg.exe' add HKLM\SYSTEM\CurrentControlSet\Services\fltsrv /f /v DisplayName /t REG_SZ /d "Acronis Storage Filter Management"
- '<SYSTEM32>\reg.exe' add HKLM\SYSTEM\CurrentControlSet\Services\fltsrv /f /v ImagePath /t REG_EXPAND_SZ /d System32\drivers\fltsrv.sys
- '<SYSTEM32>\reg.exe' add HKLM\SYSTEM\CurrentControlSet\Services\fltsrv /f /v ErrorControl /t REG_DWORD /d 1
- '<SYSTEM32>\reg.exe' add HKLM\SYSTEM\CurrentControlSet\Services\fltsrv /f /v Start /t REG_DWORD /d 0
- '<SYSTEM32>\reg.exe' add HKLM\SYSTEM\CurrentControlSet\Services\fltsrv /f /v Type /t REG_DWORD /d 1
- '<SYSTEM32>\reg.exe' add HKLM\SYSTEM\CurrentControlSet\Services\fltsrv /f /v Group /t REG_SZ /d "PnP Filter"
- '<SYSTEM32>\reg.exe' add HKLM\SYSTEM\CurrentControlSet\Services\fltsrv /f /v Tag /t REG_DWORD /d 8
- '<SYSTEM32>\sc.exe' create fltsrv type= kernel start= boot binpath= System32\drivers\fltsrv.sys
- '<SYSTEM32>\sc.exe' start fltsrv
- '<SYSTEM32>\sc.exe' query snapman
- '<SYSTEM32>\reg.exe' add HKLM\SYSTEM\CurrentControlSet\Services\snapman /f /v DisplayName /t REG_SZ /d "Acronis Snapshot Manager"
- '<SYSTEM32>\reg.exe' add HKLM\SYSTEM\CurrentControlSet\Services\snapman /f /v ImagePath /t REG_EXPAND_SZ /d System32\drivers\snapman.sys
- '<SYSTEM32>\reg.exe' add HKLM\SYSTEM\CurrentControlSet\Services\snapman /f /v ErrorControl /t REG_DWORD /d 1
- '<SYSTEM32>\reg.exe' add HKLM\SYSTEM\CurrentControlSet\Services\snapman /f /v Type /t REG_DWORD /d 1
- '<SYSTEM32>\findstr.exe' /i fltsrv
- '<SYSTEM32>\sc.exe' create snapman type= kernel start= boot binpath= System32\drivers\snapman.sys
- '<SYSTEM32>\sc.exe' start snapman
- '<SYSTEM32>\sc.exe' query volume_tracker
- '<SYSTEM32>\reg.exe' add HKLM\SYSTEM\CurrentControlSet\Services\volume_tracker /f /v DisplayName /t REG_SZ /d "Acronis Volume Tracker"
- '<SYSTEM32>\reg.exe' add HKLM\SYSTEM\CurrentControlSet\Services\volume_tracker /f /v ImagePath /t REG_EXPAND_SZ /d System32\drivers\volume_tracker.sys
- '<SYSTEM32>\reg.exe' add HKLM\SYSTEM\CurrentControlSet\Services\volume_tracker /f /v ErrorControl /t REG_DWORD /d 1
- '<SYSTEM32>\reg.exe' add HKLM\SYSTEM\CurrentControlSet\Services\volume_tracker /f /v Start /t REG_DWORD /d 0
- '<SYSTEM32>\reg.exe' add HKLM\SYSTEM\CurrentControlSet\Services\volume_tracker /f /v Type /t REG_DWORD /d 1
- '<SYSTEM32>\reg.exe' add HKLM\SYSTEM\CurrentControlSet\Services\volume_tracker /f /v Group /t REG_SZ /d "PnP Filter"
- '<SYSTEM32>\sc.exe' create volume_tracker type= kernel start= boot binpath= System32\drivers\volume_tracker.sys
- '<SYSTEM32>\sc.exe' start volume_tracker
- '<SYSTEM32>\cmd.exe' /c reg query HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e967-e325-11ce-bfc1-08002be10318} /v UpperFilters
- '<SYSTEM32>\reg.exe' query HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e967-e325-11ce-bfc1-08002be10318} /v UpperFilters
- '<SYSTEM32>\cmd.exe' /S /D /c" echo "PartMgr" "
- '<SYSTEM32>\reg.exe' add HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e967-e325-11ce-bfc1-08002be10318} /f /v UpperFilters /t REG_MULTI_SZ /d "PartMgr\0fltsrv"
- '<SYSTEM32>\reg.exe' add HKLM\SOFTWARE\Acronis\CommonComponents /f /v backup_worker.exe /t REG_SZ /d "backup_worker.exe"
