Technical Information
To ensure autorun and distribution
Sets the following service settings
- [HKLM\System\CurrentControlSet\Services\AFI CIO PrintDrv 6.26.66] 'Start' = '00000002'
- [HKLM\System\CurrentControlSet\Services\AFI CIO PrintDrv 6.26.66] 'ImagePath' = '%ALLUSERSPROFILE%\AFI CIO PrintDrv 6.26.66\AFI CIO PrintDrv 6.26.66.exe'
Creates the following services
- 'AFI CIO PrintDrv 6.26.66' %ALLUSERSPROFILE%\AFI CIO PrintDrv 6.26.66\AFI CIO PrintDrv 6.26.66.exe
Modifies file system
Creates the following files
- %TEMP%\is-mp9mn.tmp\<File name>.tmp
- %LOCALAPPDATA%\direct wav mp3 splitter\unins000.dat
- %LOCALAPPDATA%\direct wav mp3 splitter\is-a6lnl.tmp
- %LOCALAPPDATA%\direct wav mp3 splitter\is-sa21b.tmp
- %LOCALAPPDATA%\direct wav mp3 splitter\is-dhivu.tmp
- %LOCALAPPDATA%\direct wav mp3 splitter\is-101tm.tmp
- %LOCALAPPDATA%\direct wav mp3 splitter\is-cridg.tmp
- %LOCALAPPDATA%\direct wav mp3 splitter\is-m6a0n.tmp
- %LOCALAPPDATA%\direct wav mp3 splitter\is-rbjod.tmp
- %LOCALAPPDATA%\direct wav mp3 splitter\is-q5h8p.tmp
- %LOCALAPPDATA%\direct wav mp3 splitter\is-evppt.tmp
- %LOCALAPPDATA%\direct wav mp3 splitter\is-u9dkj.tmp
- %LOCALAPPDATA%\direct wav mp3 splitter\wavmp3splitter32.exe
- %LOCALAPPDATA%\direct wav mp3 splitter\is-5hbuj.tmp
- %LOCALAPPDATA%\direct wav mp3 splitter\is-94m85.tmp
- %LOCALAPPDATA%\direct wav mp3 splitter\is-vr6v8.tmp
- %LOCALAPPDATA%\direct wav mp3 splitter\is-njbvn.tmp
- %LOCALAPPDATA%\direct wav mp3 splitter\is-8t06l.tmp
- %LOCALAPPDATA%\direct wav mp3 splitter\is-djgng.tmp
- %LOCALAPPDATA%\direct wav mp3 splitter\is-2qm6t.tmp
- %LOCALAPPDATA%\direct wav mp3 splitter\is-msbt1.tmp
- %TEMP%\is-j54lt.tmp\_isetup\_iscrypt.dll
- %TEMP%\is-j54lt.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-j54lt.tmp\_isetup\_setup64.tmp
- %TEMP%\is-j54lt.tmp\_isetup\_regdll.tmp
- %LOCALAPPDATA%\direct wav mp3 splitter\is-vikd1.tmp
- %ALLUSERSPROFILE%\afi cio printdrv 6.26.66\afi cio printdrv 6.26.66.exe
Moves the following files
- from %LOCALAPPDATA%\direct wav mp3 splitter\is-msbt1.tmp to %LOCALAPPDATA%\direct wav mp3 splitter\unins000.exe
- from %LOCALAPPDATA%\direct wav mp3 splitter\is-dhivu.tmp to %LOCALAPPDATA%\direct wav mp3 splitter\proportions.txt
- from %LOCALAPPDATA%\direct wav mp3 splitter\is-101tm.tmp to %LOCALAPPDATA%\direct wav mp3 splitter\openh264_license.txt
- from %LOCALAPPDATA%\direct wav mp3 splitter\is-cridg.tmp to %LOCALAPPDATA%\direct wav mp3 splitter\qtavwidgets1.dll
- from %LOCALAPPDATA%\direct wav mp3 splitter\is-m6a0n.tmp to %LOCALAPPDATA%\direct wav mp3 splitter\qt5xml.dll
- from %LOCALAPPDATA%\direct wav mp3 splitter\is-rbjod.tmp to %LOCALAPPDATA%\direct wav mp3 splitter\qt5winextras.dll
- from %LOCALAPPDATA%\direct wav mp3 splitter\is-q5h8p.tmp to %LOCALAPPDATA%\direct wav mp3 splitter\qt5svg.dll
- from %LOCALAPPDATA%\direct wav mp3 splitter\is-evppt.tmp to %LOCALAPPDATA%\direct wav mp3 splitter\qt5opengl.dll
- from %LOCALAPPDATA%\direct wav mp3 splitter\is-sa21b.tmp to %LOCALAPPDATA%\direct wav mp3 splitter\libeay32.dll
- from %LOCALAPPDATA%\direct wav mp3 splitter\is-u9dkj.tmp to %LOCALAPPDATA%\direct wav mp3 splitter\openh264.dll
- from %LOCALAPPDATA%\direct wav mp3 splitter\is-vikd1.tmp to %LOCALAPPDATA%\direct wav mp3 splitter\msvcp140_1.dll
- from %LOCALAPPDATA%\direct wav mp3 splitter\is-94m85.tmp to %LOCALAPPDATA%\direct wav mp3 splitter\msvcp140.dll
- from %LOCALAPPDATA%\direct wav mp3 splitter\is-vr6v8.tmp to %LOCALAPPDATA%\direct wav mp3 splitter\msvcp120.dll
- from %LOCALAPPDATA%\direct wav mp3 splitter\is-njbvn.tmp to %LOCALAPPDATA%\direct wav mp3 splitter\mousehelper.dll
- from %LOCALAPPDATA%\direct wav mp3 splitter\is-8t06l.tmp to %LOCALAPPDATA%\direct wav mp3 splitter\libmp3lame.dll
- from %LOCALAPPDATA%\direct wav mp3 splitter\is-djgng.tmp to %LOCALAPPDATA%\direct wav mp3 splitter\libcurl.dll
- from %LOCALAPPDATA%\direct wav mp3 splitter\is-2qm6t.tmp to %LOCALAPPDATA%\direct wav mp3 splitter\avdevice-58.dll
- from %LOCALAPPDATA%\direct wav mp3 splitter\is-5hbuj.tmp to %LOCALAPPDATA%\direct wav mp3 splitter\msvcr120.dll
- from %LOCALAPPDATA%\direct wav mp3 splitter\is-a6lnl.tmp to %LOCALAPPDATA%\direct wav mp3 splitter\wavmp3splitter32.exe
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: 'b4cc75_Flash6273FixClass_b4cc75'
Creates and executes the following
- '%TEMP%\is-mp9mn.tmp\<File name>.tmp' /SL5="$E024C,4952733,54272,<Full path to file>"
- '%LOCALAPPDATA%\direct wav mp3 splitter\wavmp3splitter32.exe' -i
- '%LOCALAPPDATA%\direct wav mp3 splitter\wavmp3splitter32.exe' -s
