Technical Information
To ensure autorun and distribution
Sets the following service settings
- [<HKLM>\System\CurrentControlSet\Services\PSMounterEx] 'ImagePath' = '%TEMP%\7ZipSfx.000\psmounterex.sys'
Creates the following services
- 'PSMounterEx' %TEMP%\7ZipSfx.000\psmounterex.sys
Modifies file system
Creates the following files
- %TEMP%\7zipsfx.000\ko.xml
- C:\logs\cancel16.png
- C:\logs\wrning16.png
- C:\logs\delete16.png
- C:\logs\info16.png
- %WINDIR%\temp\uddf94c.tmp
- C:\logs\ok.bmp
- C:\logs\ok16.bmp
- C:\logs\delete16.bmp
- %TEMP%\_te24d0.tmp
- C:\logs\cancel.bmp
- C:\logs\cancel16.bmp
- C:\logs\wrning.bmp
- C:\logs\wrning16.bmp
- C:\logs\xmlfiles.dat
- %ALLUSERSPROFILE%\macrium\reflect\sql\sqlfiles.dat
- %TEMP%\_te24a1.tmp
- C:\logs\ok16.png
- C:\logs\delete.bmp
- C:\logs\info.png
- %TEMP%\7zipsfx.000\psmounterex.sys
- %TEMP%\7zipsfx.000\license.rtf
- %TEMP%\7zipsfx.000\reflect-등록키.txt
- %TEMP%\7zipsfx.000\aesdll.dll
- %TEMP%\7zipsfx.000\le5.dll
- %TEMP%\7zipsfx.000\macrium.exe
- %TEMP%\7zipsfx.000\oledlg.dll
- %TEMP%\7zipsfx.000\primoburner64.dll
- %TEMP%\7zipsfx.000\reflectbin.exe
- C:\logs\wrning.png
- %TEMP%\7zipsfx.000\reflecttheme.dll
- %TEMP%\7zipsfx.000\start.exe
- %TEMP%\7zipsfx.000\vsssvr.dll
- %TEMP%\c2c2.tmp\c2c3.tmp\c2d3.bat
- %TEMP%\c65a.tmp\c66b.tmp\c66c.bat
- C:\logs\ok.png
- C:\logs\cancel.png
- C:\logs\delete.png
- unc\ajyywqmv*\mailslot\net\netlogon
Deletes the following files
- %TEMP%\c2c2.tmp\c2c3.tmp\c2d3.bat
- %TEMP%\c65a.tmp\c66b.tmp\c66c.bat
- %WINDIR%\temp\uddf94c.tmp
Network activity
UDP
- 'localhost':1434
Miscellaneous
Creates and executes the following
- '%TEMP%\7zipsfx.000\start.exe'
- '%TEMP%\7zipsfx.000\macrium.exe'
- '%TEMP%\7zipsfx.000\reflectbin.exe'
- '<SYSTEM32>\cmd.exe' /c "%TEMP%\C2C2.tmp\C2C3.tmp\C2D3.bat %TEMP%\7ZipSfx.000\start.exe"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "%TEMP%\C65A.tmp\C66B.tmp\C66C.bat %TEMP%\7ZipSfx.000\Macrium.exe"' (with hidden window)
Executes the following
- '<SYSTEM32>\cmd.exe' /c "%TEMP%\C2C2.tmp\C2C3.tmp\C2D3.bat %TEMP%\7ZipSfx.000\start.exe"
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Macrium\reflect" /v "v7LicenceData" /t REG_BINARY /d "dab17a94dd22170bdf8dbfa95d80b0220ece2103e651df3fa7802e09b5a291923f2897ad2613ad285e03f1762eb709763214329c6fdc8384beea2357...
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Macrium\reflect" /v "SupportData" /t REG_BINARY /d "020000000000000000" /f
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Macrium\reflect\Defaults" /v "LiveUpdate" /t REG_DWORD /d "0" /f
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Macrium\reflect\Defaults" /v "PatchAutoRestart" /t REG_DWORD /d "0" /f
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Macrium\reflect\Defaults" /v "UpdateCheckOnLoad" /t REG_DWORD /d "0" /f
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Macrium\reflect\Defaults" /v "UpdateCheckSendEmail" /t REG_DWORD /d "0" /f
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Macrium\reflect\Defaults" /v "UpdateCheckEmail" /t REG_SZ /d "" /f
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Macrium\reflect\Install" /v "Firstname" /t REG_SZ /d "Norton" /f
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Macrium\reflect\Install" /v "Lastname" /t REG_SZ /d "Fam" /f
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Macrium\reflect\Install" /v "Company" /t REG_SZ /d "Google" /f
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Macrium\reflect\Install" /v "Email" /t REG_SZ /d "noname.clubs@mail.ru" /f
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Macrium\reflect\Install" /v "URC" /t REG_SZ /d "273Q-7VUJ" /f
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Macrium\reflect\MacriumService" /f
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Macrium\reflect\MIG" /v "VolumesAutoProtected" /t REG_DWORD /d "0" /f
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Macrium\reflect\MIG\Verified\2DC4CD968D01F65D43FDBD7BD9F3F6F3" /v "Protected" /t REG_DWORD /d "1" /f
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Macrium\reflect\MIG\Verified\73379F12EC068627C68A0E5A9EA6EEBD" /v "Protected" /t REG_DWORD /d "1" /f
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Macrium\reflect\MIG\Verified\A94C30A6119CD0C8573CD3FCF7D5C41D" /v "Protected" /t REG_DWORD /d "1" /f
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Macrium\reflect\MIG\Verified\D4CFA01919F16077FA0213BF505E05CF" /v "Protected" /t REG_DWORD /d "1" /f
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Macrium\reflect\ReflectDL" /f
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Macrium\reflect\ReflectUI" /f
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Macrium\reflect\Security" /v "App Path" /t REG_SZ /d "%ProgramFiles%\Macrium\Reflect\ReflectBin.exe" /f
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Macrium\reflect" /v "Licensee" /t REG_SZ /d "JUNLAJUBALAM" /f
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Macrium\reflect\Settings" /v "Language" /t REG_DWORD /d "1042" /f
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Macrium\reflect" /v "Hash" /t REG_BINARY /d "66a6fd084adbf8975d0cedffb6f0da5f" /f
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Macrium\Macrium Service" /v "UserRegistryPermissionsUpdated" /t REG_DWORD /d "1" /f
- '<SYSTEM32>\timeout.exe' 02
- '<SYSTEM32>\cmd.exe' /c "%TEMP%\C65A.tmp\C66B.tmp\C66C.bat %TEMP%\7ZipSfx.000\Macrium.exe"
- '<SYSTEM32>\reg.exe' query "HKU\S-1-5-19\Environment"
- '<SYSTEM32>\reg.exe' add "HKCU\SOFTWARE\Macrium\Common" /f
- '<SYSTEM32>\reg.exe' add "HKCU\SOFTWARE\Macrium\reflect" /v "REGDETAILS" /t REG_SZ /d "EMPTY" /f
- '<SYSTEM32>\reg.exe' add "HKCU\SOFTWARE\Macrium\reflect" /v "REGISTER" /t REG_SZ /d "" /f
- '<SYSTEM32>\reg.exe' add "HKCU\SOFTWARE\Macrium\reflect" /v "License" /t REG_SZ /d "69-T2KH-XAM5-4J69-NSYF-GQYZ-35CKN69" /f
- '<SYSTEM32>\reg.exe' add "HKCU\SOFTWARE\Macrium\reflect" /v "newmsi" /t REG_SZ /d "%WINDIR%\Installer\reflect_setupv8.0.6635-x64-25.msi" /f
- '<SYSTEM32>\reg.exe' add "HKCU\SOFTWARE\Macrium\reflect\Defaults" /f
- '<SYSTEM32>\reg.exe' add "HKCU\SOFTWARE\Macrium\reflect\Install" /v "InstallRunning" /t REG_DWORD /d "0" /f
- '<SYSTEM32>\reg.exe' add "HKCU\SOFTWARE\Macrium\reflect\ReflectDL" /f
- '<SYSTEM32>\reg.exe' add "HKCU\SOFTWARE\Macrium\reflect\ReflectMonitor" /v "TrayIcon" /t REG_BINARY /d "0e3181bc46b4da41a54596f16924fed1" /f
- '<SYSTEM32>\reg.exe' add "HKCU\SOFTWARE\Macrium\reflect\ReflectMonitor" /v "Error" /t REG_SZ /d "" /f
- '<SYSTEM32>\reg.exe' add "HKCU\SOFTWARE\Macrium\reflect\ReflectUI" /f
- '<SYSTEM32>\reg.exe' add "HKCU\SOFTWARE\Macrium\reflect\Settings" /f
- '<SYSTEM32>\reg.exe' add "HKCU\SOFTWARE\Macrium\reflect\VSS" /f
- '<SYSTEM32>\reg.exe' add "HKCU\SOFTWARE\Macrium\reflectmonitor\ReflectMonitor" /f
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Macrium\Common\Shared\Files" /v "macriumservice.exe" /t REG_SZ /d "%ProgramFiles%\Macrium\Common\MacriumService.exe" /f
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Macrium\Common\Shared\Files" /v "reflectui.exe" /t REG_SZ /d "%ProgramFiles%\Macrium\Common\ReflectUI.exe" /f
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Macrium\Common\Shared\Folders" /v "Common" /t REG_SZ /d "%ProgramFiles%\Macrium\Common\\" /f
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Macrium\Macrium Service" /v "RegistryPermissionsUpdated" /t REG_DWORD /d "1" /f
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Macrium\reflect" /v "v8LicenceData" /t REG_BINARY /d "f7f677d81ffba1afc48dfe8d1a733d5a6d9526d7164e1b785f3a3a32c24cc6834e3a3b512c5e26ae8c556003af3407c27ea1664b7ea4600b69eab3e2...
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Macrium\RescuePE" /v "InstallDir" /t REG_SZ /d "c:\boot" /f
