Technical Information
Modifies file system
Creates the following files
- <Current directory>\cryptbase.cab
- %WINDIR%\syswow64\sysprep\$dpx$.tmp\bc15c71dbc939d488f4f00e12b16c3f5.tmp
- %CommonProgramFiles(x86)%\microsoft shared\windowsupdate\ms12027_dll.dll
- %CommonProgramFiles(x86)%\microsoft shared\windowsupdate\svchos.exe
- %CommonProgramFiles(x86)%\microsoft shared\windowsupdate\svc.exe
- %WINDIR%\syswow64\sysprep\$dpx$.tmp\c16429439b2b8e4e9dee6328c05d9807.tmp
Sets the 'hidden' attribute to the following files
- <Full path to file>
Deletes the following files
- <Current directory>\cryptbase.cab
Moves the following files
- from %WINDIR%\syswow64\sysprep\$dpx$.tmp\bc15c71dbc939d488f4f00e12b16c3f5.tmp to %WINDIR%\syswow64\sysprep\cryptbase.dll
- from %WINDIR%\syswow64\sysprep\$dpx$.tmp\c16429439b2b8e4e9dee6328c05d9807.tmp to %WINDIR%\syswow64\sysprep\cryptbase.dll
Substitutes the following files
- <Current directory>\cryptbase.cab
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: ''
Creates and executes the following
- '%WINDIR%\syswow64\cmd.exe' /c wusa.exe <Current directory>\cryptbase.cab /extract:<SYSTEM32>\sysprep\ /quiet' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c <SYSTEM32>\sysprep\sysprep.exe "<Full path to file>" "-s -install -bncc"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c <SYSTEM32>\sysprep\sysprep.exe "<Full path to file>" "-s -start -bncc"' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c wusa.exe <Current directory>\cryptbase.cab /extract:<SYSTEM32>\sysprep\ /quiet
- '%WINDIR%\syswow64\wusa.exe' <Current directory>\cryptbase.cab /extract:<SYSTEM32>\sysprep\ /quiet
- '%WINDIR%\syswow64\cmd.exe' /c <SYSTEM32>\sysprep\sysprep.exe "<Full path to file>" "-s -install -bncc"
- '%WINDIR%\syswow64\cmd.exe' /c <SYSTEM32>\sysprep\sysprep.exe "<Full path to file>" "-s -start -bncc"
