Technical Information
To ensure autorun and distribution
Sets the following service settings
- [HKLM\System\CurrentControlSet\Services\E_MountLite_66] 'Start' = '00000002'
- [HKLM\System\CurrentControlSet\Services\E_MountLite_66] 'ImagePath' = '%ALLUSERSPROFILE%\E_MountLite_66\E_MountLite_66.exe'
Creates the following services
- 'E_MountLite_66' %ALLUSERSPROFILE%\E_MountLite_66\E_MountLite_66.exe
Modifies file system
Creates the following files
- %TEMP%\is-s4sa2.tmp\<File name>.tmp
- %LOCALAPPDATA%\express cd burn extension\unins000.dat
- %LOCALAPPDATA%\express cd burn extension\is-seair.tmp
- %LOCALAPPDATA%\express cd burn extension\languages\is-4vj91.tmp
- %LOCALAPPDATA%\express cd burn extension\is-h3nen.tmp
- %LOCALAPPDATA%\express cd burn extension\is-nq2mg.tmp
- %LOCALAPPDATA%\express cd burn extension\is-82gug.tmp
- %LOCALAPPDATA%\express cd burn extension\is-uocti.tmp
- %LOCALAPPDATA%\express cd burn extension\is-556ik.tmp
- %LOCALAPPDATA%\express cd burn extension\is-6701g.tmp
- %LOCALAPPDATA%\express cd burn extension\is-qptbn.tmp
- %LOCALAPPDATA%\express cd burn extension\is-tdj8q.tmp
- %LOCALAPPDATA%\express cd burn extension\is-40k4m.tmp
- %LOCALAPPDATA%\express cd burn extension\is-tkqva.tmp
- %LOCALAPPDATA%\express cd burn extension\is-a0kcm.tmp
- %LOCALAPPDATA%\express cd burn extension\is-36v80.tmp
- %LOCALAPPDATA%\express cd burn extension\is-td3h4.tmp
- %LOCALAPPDATA%\express cd burn extension\is-imov6.tmp
- %LOCALAPPDATA%\express cd burn extension\is-418nl.tmp
- %LOCALAPPDATA%\express cd burn extension\is-mkpcd.tmp
- %TEMP%\is-jlr86.tmp\_isetup\_iscrypt.dll
- %TEMP%\is-jlr86.tmp\_isetup\_isdecmp.dll
- %TEMP%\is-jlr86.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-jlr86.tmp\_isetup\_setup64.tmp
- %LOCALAPPDATA%\express cd burn extension\expresscdburnext.exe
- %ALLUSERSPROFILE%\e_mountlite_66\e_mountlite_66.exe
Deletes the following files
- %LOCALAPPDATA%\express cd burn extension\libgcc_s_dw2-1.dll
Moves the following files
- from %LOCALAPPDATA%\express cd burn extension\is-mkpcd.tmp to %LOCALAPPDATA%\express cd burn extension\unins000.exe
- from %LOCALAPPDATA%\express cd burn extension\is-h3nen.tmp to %LOCALAPPDATA%\express cd burn extension\setting.ini
- from %LOCALAPPDATA%\express cd burn extension\is-nq2mg.tmp to %LOCALAPPDATA%\express cd burn extension\sdl2.dll
- from %LOCALAPPDATA%\express cd burn extension\is-82gug.tmp to %LOCALAPPDATA%\express cd burn extension\swresample-3.dll
- from %LOCALAPPDATA%\express cd burn extension\is-uocti.tmp to %LOCALAPPDATA%\express cd burn extension\zlib1.dll
- from %LOCALAPPDATA%\express cd burn extension\is-556ik.tmp to %LOCALAPPDATA%\express cd burn extension\libbz2-1.dll
- from %LOCALAPPDATA%\express cd burn extension\is-6701g.tmp to %LOCALAPPDATA%\express cd burn extension\libwinpthread-1.dll
- from %LOCALAPPDATA%\express cd burn extension\languages\is-4vj91.tmp to %LOCALAPPDATA%\express cd burn extension\languages\turkish.ini
- from %LOCALAPPDATA%\express cd burn extension\is-qptbn.tmp to %LOCALAPPDATA%\express cd burn extension\libvorbisenc-2.dll
- from %LOCALAPPDATA%\express cd burn extension\is-40k4m.tmp to %LOCALAPPDATA%\express cd burn extension\libogg-0.dll
- from %LOCALAPPDATA%\express cd burn extension\is-tkqva.tmp to %LOCALAPPDATA%\express cd burn extension\libiconv-2.dll
- from %LOCALAPPDATA%\express cd burn extension\is-36v80.tmp to %LOCALAPPDATA%\express cd burn extension\avutil-56.dll
- from %LOCALAPPDATA%\express cd burn extension\is-td3h4.tmp to %LOCALAPPDATA%\express cd burn extension\libgcc_s_dw2-1.dll
- from %LOCALAPPDATA%\express cd burn extension\is-imov6.tmp to %LOCALAPPDATA%\express cd burn extension\avformat-58.dll
- from %LOCALAPPDATA%\express cd burn extension\is-418nl.tmp to %LOCALAPPDATA%\express cd burn extension\avcodec-58.dll
- from %LOCALAPPDATA%\express cd burn extension\is-tdj8q.tmp to %LOCALAPPDATA%\express cd burn extension\libvorbis-0.dll
- from %LOCALAPPDATA%\express cd burn extension\is-seair.tmp to %LOCALAPPDATA%\express cd burn extension\expresscdburnext.exe
Substitutes the following files
- %LOCALAPPDATA%\express cd burn extension\libgcc_s_dw2-1.dll
Miscellaneous
Searches for the following windows
- ClassName: 'T281ad_ECDBE2132FlashFixClass_T281ad' WindowName: ''
Creates and executes the following
- '%TEMP%\is-s4sa2.tmp\<File name>.tmp' /SL5="$B019C,7728502,54272,<Full path to file>"
- '%LOCALAPPDATA%\express cd burn extension\expresscdburnext.exe' -i
- '%LOCALAPPDATA%\express cd burn extension\expresscdburnext.exe' -s
