Technical Information
To ensure autorun and distribution
Sets the following service settings
- [HKLM\System\CurrentControlSet\Services\AFI CIO PrintDrv 6.26.41] 'Start' = '00000002'
- [HKLM\System\CurrentControlSet\Services\AFI CIO PrintDrv 6.26.41] 'ImagePath' = '%ALLUSERSPROFILE%\AFI CIO PrintDrv 6.26.41\AFI CIO PrintDrv 6.26.41.exe'
Creates the following services
- 'AFI CIO PrintDrv 6.26.41' %ALLUSERSPROFILE%\AFI CIO PrintDrv 6.26.41\AFI CIO PrintDrv 6.26.41.exe
Modifies file system
Creates the following files
- %TEMP%\is-veeh4.tmp\<File name>.tmp
- %ALLUSERSPROFILE%\afit_41.dat
- %ALLUSERSPROFILE%\afi cio printdrv 6.26.41\afi cio printdrv 6.26.41.exe
- %LOCALAPPDATA%\direct wav mp3 splitter\directwavmp3splitter.exe
- %LOCALAPPDATA%\direct wav mp3 splitter\unins000.dat
- %LOCALAPPDATA%\direct wav mp3 splitter\is-d1i9d.tmp
- %LOCALAPPDATA%\direct wav mp3 splitter\is-dci4h.tmp
- %LOCALAPPDATA%\direct wav mp3 splitter\is-pp4oq.tmp
- %LOCALAPPDATA%\direct wav mp3 splitter\is-kv47h.tmp
- %LOCALAPPDATA%\direct wav mp3 splitter\is-9fshn.tmp
- %LOCALAPPDATA%\direct wav mp3 splitter\is-na78d.tmp
- %LOCALAPPDATA%\direct wav mp3 splitter\is-ste30.tmp
- %LOCALAPPDATA%\direct wav mp3 splitter\is-ak0mv.tmp
- %LOCALAPPDATA%\direct wav mp3 splitter\is-dnpfq.tmp
- %LOCALAPPDATA%\direct wav mp3 splitter\is-7lmq7.tmp
- %LOCALAPPDATA%\direct wav mp3 splitter\is-1h3pi.tmp
- %LOCALAPPDATA%\direct wav mp3 splitter\is-5qlif.tmp
- %LOCALAPPDATA%\direct wav mp3 splitter\is-0v4pt.tmp
- %LOCALAPPDATA%\direct wav mp3 splitter\is-5nub8.tmp
- %LOCALAPPDATA%\direct wav mp3 splitter\is-pttco.tmp
- %LOCALAPPDATA%\direct wav mp3 splitter\is-hp5ta.tmp
- %LOCALAPPDATA%\direct wav mp3 splitter\is-t0aa9.tmp
- %LOCALAPPDATA%\direct wav mp3 splitter\is-3d50n.tmp
- %LOCALAPPDATA%\direct wav mp3 splitter\is-2a7gr.tmp
- %TEMP%\is-lgven.tmp\_isetup\_iscrypt.dll
- %TEMP%\is-lgven.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-lgven.tmp\_isetup\_setup64.tmp
- %TEMP%\is-lgven.tmp\_isetup\_regdll.tmp
- %ALLUSERSPROFILE%\afres-a.dat
- %ALLUSERSPROFILE%\afres-b.dat
Moves the following files
- from %LOCALAPPDATA%\direct wav mp3 splitter\is-2a7gr.tmp to %LOCALAPPDATA%\direct wav mp3 splitter\unins000.exe
- from %LOCALAPPDATA%\direct wav mp3 splitter\is-pp4oq.tmp to %LOCALAPPDATA%\direct wav mp3 splitter\proportions.txt
- from %LOCALAPPDATA%\direct wav mp3 splitter\is-kv47h.tmp to %LOCALAPPDATA%\direct wav mp3 splitter\openh264_license.txt
- from %LOCALAPPDATA%\direct wav mp3 splitter\is-9fshn.tmp to %LOCALAPPDATA%\direct wav mp3 splitter\qtavwidgets1.dll
- from %LOCALAPPDATA%\direct wav mp3 splitter\is-na78d.tmp to %LOCALAPPDATA%\direct wav mp3 splitter\qt5xml.dll
- from %LOCALAPPDATA%\direct wav mp3 splitter\is-ste30.tmp to %LOCALAPPDATA%\direct wav mp3 splitter\qt5winextras.dll
- from %LOCALAPPDATA%\direct wav mp3 splitter\is-ak0mv.tmp to %LOCALAPPDATA%\direct wav mp3 splitter\qt5svg.dll
- from %LOCALAPPDATA%\direct wav mp3 splitter\is-dnpfq.tmp to %LOCALAPPDATA%\direct wav mp3 splitter\qt5opengl.dll
- from %LOCALAPPDATA%\direct wav mp3 splitter\is-dci4h.tmp to %LOCALAPPDATA%\direct wav mp3 splitter\libeay32.dll
- from %LOCALAPPDATA%\direct wav mp3 splitter\is-7lmq7.tmp to %LOCALAPPDATA%\direct wav mp3 splitter\openh264.dll
- from %LOCALAPPDATA%\direct wav mp3 splitter\is-5qlif.tmp to %LOCALAPPDATA%\direct wav mp3 splitter\msvcp140_1.dll
- from %LOCALAPPDATA%\direct wav mp3 splitter\is-0v4pt.tmp to %LOCALAPPDATA%\direct wav mp3 splitter\msvcp140.dll
- from %LOCALAPPDATA%\direct wav mp3 splitter\is-5nub8.tmp to %LOCALAPPDATA%\direct wav mp3 splitter\msvcp120.dll
- from %LOCALAPPDATA%\direct wav mp3 splitter\is-pttco.tmp to %LOCALAPPDATA%\direct wav mp3 splitter\mousehelper.dll
- from %LOCALAPPDATA%\direct wav mp3 splitter\is-hp5ta.tmp to %LOCALAPPDATA%\direct wav mp3 splitter\libmp3lame.dll
- from %LOCALAPPDATA%\direct wav mp3 splitter\is-t0aa9.tmp to %LOCALAPPDATA%\direct wav mp3 splitter\libcurl.dll
- from %LOCALAPPDATA%\direct wav mp3 splitter\is-3d50n.tmp to %LOCALAPPDATA%\direct wav mp3 splitter\avdevice-58.dll
- from %LOCALAPPDATA%\direct wav mp3 splitter\is-1h3pi.tmp to %LOCALAPPDATA%\direct wav mp3 splitter\msvcr120.dll
- from %LOCALAPPDATA%\direct wav mp3 splitter\is-d1i9d.tmp to %LOCALAPPDATA%\direct wav mp3 splitter\directwavmp3splitter.exe
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: 'D5219d_Flash6271FixClass_D5219d'
Creates and executes the following
- '%TEMP%\is-veeh4.tmp\<File name>.tmp' /SL5="$50250,4230221,54272,<Full path to file>"
- '%LOCALAPPDATA%\direct wav mp3 splitter\directwavmp3splitter.exe' -i
- '%LOCALAPPDATA%\direct wav mp3 splitter\directwavmp3splitter.exe' -s
