Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKLM>\System\CurrentControlSet\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000001] 'LibraryPath' = '<SYSTEM32>\NLAapi.dll'
- [<HKLM>\System\CurrentControlSet\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000002] 'LibraryPath' = '<SYSTEM32>\napinsp.dll'
- [<HKLM>\System\CurrentControlSet\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000003] 'LibraryPath' = '<SYSTEM32>\pnrpnsp.dll'
- [<HKLM>\System\CurrentControlSet\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000004] 'LibraryPath' = '<SYSTEM32>\pnrpnsp.dll'
- [<HKLM>\System\CurrentControlSet\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000005] 'LibraryPath' = '<SYSTEM32>\mswsock.dll'
- [<HKLM>\System\CurrentControlSet\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000006] 'LibraryPath' = '<SYSTEM32>\winrnr.dll'
- [<HKLM>\System\CurrentControlSet\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000007] 'LibraryPath' = '%WINDIR%\sysWOW64\pfnsp.dll'
Sets the following service settings
- [<HKLM>\System\CurrentControlSet\Services\TopsecPF] 'Start' = '00000001'
- [<HKLM>\System\CurrentControlSet\Services\TopsecPF] 'ImagePath' = '%WINDIR%\sysWOW64\drivers\topsecpf.sys'
- [<HKLM>\System\CurrentControlSet\Services\TopNpf] 'Start' = '00000001'
- [<HKLM>\System\CurrentControlSet\Services\TopNpf] 'ImagePath' = '%WINDIR%\sysWOW64\drivers\topnpf.sys'
Creates the following services
- 'TopsecPF' %WINDIR%\sysWOW64\drivers\topsecpf.sys
- 'TopNpf' %WINDIR%\sysWOW64\drivers\topnpf.sys
Modifies file system
Creates the following files
- %TEMP%\nsmf595.tmp
- %TEMP%\nscf5a6.tmp\simplesc.dll
- %ProgramFiles(x86)%\vone\topsecsv\svpfuninst.exe
- %TEMP%\nscf5a6.tmp\ns4d4.tmp
- %TEMP%\nscf5a6.tmp\nsfc2c.tmp
- %TEMP%\nscf5a6.tmp\nsexec.dll
- %WINDIR%\syswow64\topnpf.sys
- %WINDIR%\syswow64\toppack.dll
- %WINDIR%\syswow64\topcap.dll
- %WINDIR%\syswow64\pfnsp.dll
- %WINDIR%\syswow64\pftool.exe
- %WINDIR%\syswow64\drivers\topsecpf_x64.sys
- %WINDIR%\temp\uddf2c.tmp
- %WINDIR%\syswow64\drivers\topnpf_x64.sys
- %ProgramFiles(x86)%\vone\topsecsv\toppack.dll
- %ProgramFiles(x86)%\vone\topsecsv\topcap.dll
- %WINDIR%\syswow64\bhosimp.dll
- %ProgramFiles(x86)%\vone\topsecsv\vonepf.dll
- %ProgramFiles(x86)%\vone\topsecsv\pf_client.exe
- %ProgramFiles(x86)%\vone\topsecsv\tdiserviceinstall.exe
- %ProgramFiles(x86)%\vone\topsecsv\pftool.exe
- %ProgramFiles(x86)%\vone\topsecsv\pfnsp.dll
- %TEMP%\nscf5a6.tmp\killproc.dll
- %ProgramFiles(x86)%\vone\topsecsv\svclientpfversion.ini
- %TEMP%\nscf5a6.tmp\system.dll
- %ProgramFiles(x86)%\vone\topsecsv\topnpf.sys
- %WINDIR%\temp\uddfd9.tmp
Deletes the following files
- %TEMP%\nscf5a6.tmp\nsfc2c.tmp
- %TEMP%\nscf5a6.tmp\ns4d4.tmp
- %TEMP%\nscf5a6.tmp\killproc.dll
- %TEMP%\nscf5a6.tmp\nsexec.dll
- %TEMP%\nscf5a6.tmp\simplesc.dll
- %TEMP%\nscf5a6.tmp\system.dll
- %WINDIR%\temp\uddf2c.tmp
- %WINDIR%\temp\uddfd9.tmp
Moves the following files
- from %WINDIR%\syswow64\drivers\topnpf_x64.sys to %WINDIR%\syswow64\drivers\topnpf.sys
- from %WINDIR%\syswow64\drivers\topsecpf_x64.sys to %WINDIR%\syswow64\drivers\topsecpf.sys
Miscellaneous
Creates and executes the following
- '%TEMP%\nscf5a6.tmp\nsfc2c.tmp' "%WINDIR%\sysWOW64\pftool.exe" nspinstall "%WINDIR%\sysWOW64\pfnsp.dll"
- '%WINDIR%\syswow64\pftool.exe' nspinstall "%WINDIR%\sysWOW64\pfnsp.dll"
- '%TEMP%\nscf5a6.tmp\ns4d4.tmp' "%ProgramFiles(x86)%\VONE\TopSecSV\TdiServiceInstall.exe" -install "%WINDIR%\sysWOW64\drivers"
- '%ProgramFiles(x86)%\vone\topsecsv\tdiserviceinstall.exe' -install "%WINDIR%\sysWOW64\drivers"
- '%TEMP%\nscf5a6.tmp\nsfc2c.tmp' "%WINDIR%\sysWOW64\pftool.exe" nspinstall "%WINDIR%\sysWOW64\pfnsp.dll"' (with hidden window)
- '%TEMP%\nscf5a6.tmp\ns4d4.tmp' "%ProgramFiles(x86)%\VONE\TopSecSV\TdiServiceInstall.exe" -install "%WINDIR%\sysWOW64\drivers"' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\regsvr32.exe' /s "%WINDIR%\sysWOW64\BhoSimp.dll"
