Technical Information
Modifies file system
Creates the following files
- %TEMP%\auta384.tmp
- %ALLUSERSPROFILE%\grub2win\<File name>.exe.26082017454418\xxcleanup.txt
- %ALLUSERSPROFILE%\grub2win\<File name>.exe.26082017454418\inet.work.internet.txt
- %ALLUSERSPROFILE%\grub2win\<File name>.exe.26082017454418\commands\mountvol.getletter.output.txt
- %ALLUSERSPROFILE%\grub2win\<File name>.exe.26082017454418\commands\mountvol.mount.output.txt
- %ALLUSERSPROFILE%\grub2win\<File name>.exe.26082017454418\licenseworkfile.txt
- %ALLUSERSPROFILE%\grub2winstats\stats.grub2win.3.diag.txt
- %ALLUSERSPROFILE%\grub2win\warningpostrun.txt
- %ALLUSERSPROFILE%\grub2winstats\stats.grub2win.1.stamp.txt
- %ALLUSERSPROFILE%\grub2winstats\stats.grub2win.2.main.txt
- %ALLUSERSPROFILE%\grub2winstats\stats.grub2win.6.partlist.txt
- %ALLUSERSPROFILE%\grub2winstats\stats.grub2win.4.geo.txt
- %ALLUSERSPROFILE%\grub2win\postrun.listmod.exe
- %TEMP%\aut5724.tmp
- %ALLUSERSPROFILE%\grub2win\postrun.listmod.exe.26082003492144\xxcleanup.txt
- %ALLUSERSPROFILE%\grub2winstats\stats.grub2win.5.listmod.txt
- %ALLUSERSPROFILE%\grub2winstats\260820-064916-user-grub2win.restrict.legacy.txt
- %TEMP%\cleanup.grub2win.26082003492144.directory.postrunstatsput.bat
- nul
Deletes following files that it created itself
- %TEMP%\auta384.tmp
- %ALLUSERSPROFILE%\grub2win\<File name>.exe.26082017454418\xxcleanup.txt
- %ALLUSERSPROFILE%\grub2win\<File name>.exe.26082017454418\licenseworkfile.txt
- %ALLUSERSPROFILE%\grub2win\warningpostrun.txt
- %ALLUSERSPROFILE%\grub2win\<File name>.exe.26082017454418\inet.work.internet.txt
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\ie\twcgg8li\line[1].txt
- %TEMP%\aut5724.tmp
- %ALLUSERSPROFILE%\grub2win\postrun.listmod.exe.26082003492144\xxcleanup.txt
- %ALLUSERSPROFILE%\grub2win\postrun.listmod.exe
Substitutes the following files
- %ALLUSERSPROFILE%\grub2win\<File name>.exe.26082017454418\inet.work.internet.txt
Deletes itself.
Network activity
Connects to
- 'ip##pi.com':80
- 'dr#####dp.synology.me':21
- 'dr#####dp.synology.me':55611
- 'dr#####dp.synology.me':55620
- 'dr#####dp.synology.me':55619
- 'dr#####dp.synology.me':55542
TCP
HTTP GET requests
Other
- 'dr#####dp.synology.me':21
- 'dr#####dp.synology.me':55620
- 'dr#####dp.synology.me':55542
UDP
- DNS ASK ip##pi.com
- DNS ASK dr#####dp.synology.me
- DNS ASK 0.###l.ntp.org
- DNS ASK 1.###l.ntp.org
- '0.###l.ntp.org':123
- '1.###l.ntp.org':123
Miscellaneous
Creates and executes the following
- '%ALLUSERSPROFILE%\grub2win\postrun.listmod.exe'
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c %WINDIR%\sysnative\mountvol.exe > %ALLUSERSPROFILE%\Grub2Win\<File name>.exe.26082017454418\commands\mountvol.getletter.output.txt
- '<SYSTEM32>\mountvol.exe'
- '%WINDIR%\syswow64\cmd.exe' /c %WINDIR%\sysnative\mountvol.exe M: /S > %ALLUSERSPROFILE%\Grub2Win\<File name>.exe.26082017454418\commands\mountvol.mount.output.txt
- '<SYSTEM32>\mountvol.exe' M: /S
- '%WINDIR%\syswow64\cmd.exe' /c %TEMP%\Cleanup.Grub2Win.26082003492144.directory.PostRunStatsPut.bat
- '%WINDIR%\syswow64\ping.exe' -n 3 127.0.0.1
- '%WINDIR%\syswow64\cmd.exe' /S /D /c" ver "
- '%WINDIR%\syswow64\find.exe' "5.1"
- '%WINDIR%\syswow64\net.exe' session
- '%WINDIR%\syswow64\net1.exe' session
- '%WINDIR%\syswow64\cmd.exe' /c dir /b /a:d "%ALLUSERSPROFILE%\Grub2Win"\*.*
- '%WINDIR%\syswow64\ping.exe' -n 2 127.0.0.1
- '%WINDIR%\syswow64\cmd.exe' /c %WINDIR%\sysnative\mountvol.exe > %ALLUSERSPROFILE%\Grub2Win\<File name>.exe.26082017454418\commands\mountvol.getletter.output.txt' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c %WINDIR%\sysnative\mountvol.exe M: /S > %ALLUSERSPROFILE%\Grub2Win\<File name>.exe.26082017454418\commands\mountvol.mount.output.txt' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c %TEMP%\Cleanup.Grub2Win.26082003492144.directory.PostRunStatsPut.bat' (with hidden window)
