Technical Information
To ensure autorun and distribution
Sets the following service settings
- [HKLM\System\CurrentControlSet\Services\AGP BUS Driver 6.28.66] 'Start' = '00000002'
- [HKLM\System\CurrentControlSet\Services\AGP BUS Driver 6.28.66] 'ImagePath' = '%ALLUSERSPROFILE%\AGP BUS Driver 6.28.66\AGP BUS Driver 6.28.66.exe'
Creates the following services
- 'AGP BUS Driver 6.28.66' %ALLUSERSPROFILE%\AGP BUS Driver 6.28.66\AGP BUS Driver 6.28.66.exe
Modifies file system
Creates the following files
- %TEMP%\is-373rb.tmp\<File name>.tmp
- %LOCALAPPDATA%\vk free audio saver\unins000.dat
- %LOCALAPPDATA%\vk free audio saver\is-979e1.tmp
- %LOCALAPPDATA%\vk free audio saver\is-cpb8n.tmp
- %LOCALAPPDATA%\vk free audio saver\is-jcu73.tmp
- %LOCALAPPDATA%\vk free audio saver\is-a2jfk.tmp
- %LOCALAPPDATA%\vk free audio saver\is-m7016.tmp
- %LOCALAPPDATA%\vk free audio saver\is-0gtfi.tmp
- %LOCALAPPDATA%\vk free audio saver\is-9rc92.tmp
- %LOCALAPPDATA%\vk free audio saver\is-k8e4k.tmp
- %LOCALAPPDATA%\vk free audio saver\is-qhtap.tmp
- %LOCALAPPDATA%\vk free audio saver\is-44eh9.tmp
- %LOCALAPPDATA%\vk free audio saver\vkfreeaudiosaver.exe
- %LOCALAPPDATA%\vk free audio saver\is-6epjk.tmp
- %LOCALAPPDATA%\vk free audio saver\is-m9t43.tmp
- %LOCALAPPDATA%\vk free audio saver\is-87f64.tmp
- %LOCALAPPDATA%\vk free audio saver\is-dk1i0.tmp
- %LOCALAPPDATA%\vk free audio saver\is-4mjcd.tmp
- %LOCALAPPDATA%\vk free audio saver\is-o88qb.tmp
- %LOCALAPPDATA%\vk free audio saver\is-tnpac.tmp
- %LOCALAPPDATA%\vk free audio saver\is-sse3e.tmp
- %TEMP%\is-k027m.tmp\_isetup\_iscrypt.dll
- %TEMP%\is-k027m.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-k027m.tmp\_isetup\_setup64.tmp
- %TEMP%\is-k027m.tmp\_isetup\_regdll.tmp
- %LOCALAPPDATA%\vk free audio saver\is-0tro4.tmp
- %ALLUSERSPROFILE%\agp bus driver 6.28.66\agp bus driver 6.28.66.exe
Moves the following files
- from %LOCALAPPDATA%\vk free audio saver\is-sse3e.tmp to %LOCALAPPDATA%\vk free audio saver\unins000.exe
- from %LOCALAPPDATA%\vk free audio saver\is-jcu73.tmp to %LOCALAPPDATA%\vk free audio saver\proportions.txt
- from %LOCALAPPDATA%\vk free audio saver\is-a2jfk.tmp to %LOCALAPPDATA%\vk free audio saver\openh264_license.txt
- from %LOCALAPPDATA%\vk free audio saver\is-m7016.tmp to %LOCALAPPDATA%\vk free audio saver\qtavwidgets1.dll
- from %LOCALAPPDATA%\vk free audio saver\is-0gtfi.tmp to %LOCALAPPDATA%\vk free audio saver\qt5xml.dll
- from %LOCALAPPDATA%\vk free audio saver\is-9rc92.tmp to %LOCALAPPDATA%\vk free audio saver\qt5winextras.dll
- from %LOCALAPPDATA%\vk free audio saver\is-k8e4k.tmp to %LOCALAPPDATA%\vk free audio saver\qt5svg.dll
- from %LOCALAPPDATA%\vk free audio saver\is-qhtap.tmp to %LOCALAPPDATA%\vk free audio saver\qt5opengl.dll
- from %LOCALAPPDATA%\vk free audio saver\is-cpb8n.tmp to %LOCALAPPDATA%\vk free audio saver\libeay32.dll
- from %LOCALAPPDATA%\vk free audio saver\is-44eh9.tmp to %LOCALAPPDATA%\vk free audio saver\openh264.dll
- from %LOCALAPPDATA%\vk free audio saver\is-0tro4.tmp to %LOCALAPPDATA%\vk free audio saver\msvcp140_1.dll
- from %LOCALAPPDATA%\vk free audio saver\is-m9t43.tmp to %LOCALAPPDATA%\vk free audio saver\msvcp140.dll
- from %LOCALAPPDATA%\vk free audio saver\is-87f64.tmp to %LOCALAPPDATA%\vk free audio saver\msvcp120.dll
- from %LOCALAPPDATA%\vk free audio saver\is-dk1i0.tmp to %LOCALAPPDATA%\vk free audio saver\mousehelper.dll
- from %LOCALAPPDATA%\vk free audio saver\is-4mjcd.tmp to %LOCALAPPDATA%\vk free audio saver\libmp3lame.dll
- from %LOCALAPPDATA%\vk free audio saver\is-o88qb.tmp to %LOCALAPPDATA%\vk free audio saver\libcurl.dll
- from %LOCALAPPDATA%\vk free audio saver\is-tnpac.tmp to %LOCALAPPDATA%\vk free audio saver\avdevice-58.dll
- from %LOCALAPPDATA%\vk free audio saver\is-6epjk.tmp to %LOCALAPPDATA%\vk free audio saver\msvcr120.dll
- from %LOCALAPPDATA%\vk free audio saver\is-979e1.tmp to %LOCALAPPDATA%\vk free audio saver\vkfreeaudiosaver.exe
Miscellaneous
Searches for the following windows
- ClassName: 'z7ad19_Flash6291FixClass_z7ad19' WindowName: ''
Creates and executes the following
- '%TEMP%\is-373rb.tmp\<File name>.tmp' /SL5="$8024E,4892726,54272,<Full path to file>"
- '%LOCALAPPDATA%\vk free audio saver\vkfreeaudiosaver.exe' -i
- '%LOCALAPPDATA%\vk free audio saver\vkfreeaudiosaver.exe' -s
