Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKLM>\SYSTEM\CurrentControlSet\Control\Session Manager] 'BootExecute' = ''
- [<HKLM>\Software\Classes\Applications\Bred3.exe\shell\open\command] '' = '"%ProgramFiles%\Bred3\Bred3.exe" %1'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\notepad.exe] 'Debugger' = '"%ProgramFiles%\Notepad2\Notepad2.exe" /z'
- [<HKLM>\Software\Classes\Applications\Notepad2.exe\shell\open\command] '' = '"%ProgramFiles%\Notepad2\Notepad2.exe" %1'
Malicious functions
To complicate detection of its presence in the operating system,
forces the system hide from view:
- hidden files
- file extensions
blocks the following features:
- Windows Action Center
Terminates or attempts to terminate
the following system processes:
- <SYSTEM32>\cmd.exe
Modifies settings of Windows Internet Explorer
- [<HKCU>\Software\Microsoft\Internet Explorer\Download] 'CheckExeSignatures' = 'no'
- [<HKCU>\Software\Microsoft\Internet Explorer\Download] 'RunInvalidSignatures' = '00000001'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Attachments] 'SaveZoneInformation' = '00000002'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Associations] 'LowRiskFileTypes' = '.zip;.rar;.nfo;.txt;.exe;.bat;.com;.cmd;.reg;.msi;.htm;.html;.gif;.bmp;.jpg;.avi;.mpg;.mpeg;.mov;....
Modifies file system
Creates the following files
- %TEMP%\1.tmp\final settings.cmd
- %ProgramFiles%\bred3\plugins\colorer5\hrc\scripts\hrc.hrc
- %ProgramFiles%\bred3\plugins\colorer5\hrc\scripts\hrd.hrc
- %ProgramFiles%\bred3\plugins\colorer5\hrc\scripts\iss.hrc
- %ProgramFiles%\bred3\plugins\colorer5\hrc\scripts\javaprop.hrc
- %ProgramFiles%\bred3\plugins\colorer5\hrc\scripts\lex.hrc
- %ProgramFiles%\bred3\plugins\colorer5\hrc\scripts\makefile.hrc
- %ProgramFiles%\bred3\plugins\colorer5\hrc\scripts\nsi.hrc
- %ProgramFiles%\bred3\plugins\colorer5\hrc\scripts\rarscrpt.hrc
- %ProgramFiles%\bred3\plugins\colorer5\hrc\scripts\reg.hrc
- %ProgramFiles%\bred3\plugins\colorer5\hrc\scripts\resrc.hrc
- %ProgramFiles%\bred3\plugins\colorer5\hrc\scripts\rul.hrc
- %ProgramFiles%\bred3\plugins\colorer5\hrd\rgb\black.hrd
- %ProgramFiles%\bred3\plugins\colorer5\hrc\scripts\dfm.hrc
- %ProgramFiles%\bred3\plugins\colorer5\hrc\scripts\dcl.hrc
- %ProgramFiles%\bred3\plugins\colorer5\hrc\scripts\yacc.hrc
- %ProgramFiles%\bred3\plugins\colorer5\hrc\xml\dtd.hrc
- %ProgramFiles%\bred3\plugins\colorer5\hrc\xml\relaxng.hrc
- %ProgramFiles%\bred3\plugins\colorer5\hrc\xml\wsc.hrc
- %ProgramFiles%\bred3\plugins\colorer5\hrc\xml\wsf.hrc
- %ProgramFiles%\bred3\plugins\colorer5\hrc\xml\xinclude.hrc
- %ProgramFiles%\bred3\plugins\colorer5\hrc\xml\xlink.hrc
- %ProgramFiles%\bred3\plugins\colorer5\hrc\xml\xml.hrc
- %ProgramFiles%\bred3\plugins\colorer5\hrc\xml\xml.internal.hrc
- %ProgramFiles%\bred3\plugins\colorer5\hrc\xml\xmlschema.hrc
- %ProgramFiles%\bred3\plugins\colorer5\hrc\xml\xslt.hrc
- %ProgramFiles%\bred3\plugins\colorer5\hrc\scripts\sh.hrc
- %ProgramFiles%\bred3\plugins\colorer5\hrc\scripts\vrml.hrc
- %ProgramFiles%\bred3\plugins\colorer5\hrc\rare\ada.hrc
- %ProgramFiles%\bred3\plugins\colorer5\hrc\scripts\tex.hrc
- %ProgramFiles%\bred3\plugins\colorer5\hrc\rare\ocaml.hrc
- %ProgramFiles%\bred3\plugins\colorer5\hrc\rare\asm80.hrc
- %ProgramFiles%\bred3\plugins\colorer5\hrc\rare\autoit.hrc
- %ProgramFiles%\bred3\plugins\colorer5\hrc\rare\awk.hrc
- %ProgramFiles%\bred3\plugins\colorer5\hrc\rare\baan.hrc
- %ProgramFiles%\bred3\plugins\colorer5\hrc\rare\cache.hrc
- %ProgramFiles%\bred3\plugins\colorer5\hrc\rare\cobol.hrc
- %ProgramFiles%\bred3\plugins\colorer5\hrc\rare\dssp.hrc
- %ProgramFiles%\bred3\plugins\colorer5\hrc\rare\eiffel.hrc
- %ProgramFiles%\bred3\plugins\colorer5\hrc\rare\icon.hrc
- %ProgramFiles%\bred3\plugins\colorer5\hrc\rare\lisp.hrc
- %ProgramFiles%\bred3\plugins\colorer5\hrc\rare\matlab.hrc
- %ProgramFiles%\bred3\plugins\colorer5\hrc\scripts\apache.hrc
- %ProgramFiles%\bred3\plugins\colorer5\hrc\scripts\config.hrc
- %ProgramFiles%\bred3\plugins\colorer5\hrc\scripts\batch.hrc
- %ProgramFiles%\bred3\plugins\colorer5\hrc\rare\picasm.hrc
- %ProgramFiles%\bred3\plugins\colorer5\hrc\rare\python.hrc
- %ProgramFiles%\bred3\plugins\colorer5\hrc\rare\rexx.hrc
- %ProgramFiles%\bred3\plugins\colorer5\hrc\rare\ruby.hrc
- %ProgramFiles%\bred3\plugins\colorer5\hrc\rare\sml.hrc
- %ProgramFiles%\bred3\plugins\colorer5\hrc\rare\sprolog.hrc
- %ProgramFiles%\bred3\plugins\colorer5\hrc\rare\tcltk.hrc
- %ProgramFiles%\bred3\plugins\colorer5\hrc\rare\tprolog.hrc
- %ProgramFiles%\bred3\plugins\colorer5\hrc\rare\verilog.hrc
- %ProgramFiles%\bred3\plugins\colorer5\hrc\rare\vhdl.hrc
- %ProgramFiles%\bred3\plugins\colorer5\hrc\rare\z80.hrc
- %ProgramFiles%\bred3\plugins\colorer5\hrc\rare\modula.hrc
- %ProgramFiles%\bred3\plugins\colorer5\hrc\rare\olextend.hrc
- %ProgramFiles%\bred3\plugins\colorer5\hrc\rare\adsp.hrc
- %ProgramFiles%\bred3\plugins\colorer5\hrd\rgb\contrib\bred3.hrd
- %ProgramFiles%\bred3\plugins\colorer5\hrd\rgb\hs.hrd
- %ALLUSERSPROFILE%\desktop\driverpack solution.exe
- %ALLUSERSPROFILE%\desktop\snappy drivers installer.exe
- %ALLUSERSPROFILE%\desktop\vanadiy post-installer.exe
- %TEMP%\personalizationpanel\killduplicate.cmd
- %TEMP%\personalizationpanel\packico.ico
- %TEMP%\personalizationpanel\personalization.inf
- %TEMP%\personalizationpanel\personalizationpanel.cmd
- %TEMP%\personalizationpanel\postuninst.cmd
- %TEMP%\personalizationpanel\slc_x64\windows\system32\en-us\sl2.dll.mui
- %TEMP%\personalizationpanel\slc_x64\windows\system32\ru-ru\sl2.dll.mui
- %TEMP%\personalizationpanel\slc_x64\windows\system32\sl2.dll
- %ProgramFiles%\vanadiy assistant\links.exe
- %ProgramFiles%\vanadiy assistant\uninst.exe
- %TEMP%\personalizationpanel\slc_x64\windows\system32\slc.dll
- %TEMP%\personalizationpanel\slc_x64\windows\syswow64\sl2.dll
- %TEMP%\personalizationpanel\slc_x64\windows\syswow64\slc.dll
- %TEMP%\personalizationpanel\slc_x86\windows\system32\en-us\sl2.dll.mui
- %TEMP%\personalizationpanel\slc_x86\windows\system32\ru-ru\sl2.dll.mui
- %TEMP%\personalizationpanel\slc_x86\windows\system32\ru-ru\udwm.dll.mui
- %TEMP%\personalizationpanel\slc_x86\windows\system32\sl2.dll
- %TEMP%\personalizationpanel\slc_x86\windows\system32\slc.dll
- %TEMP%\personalizationpanel\slc_x86\windows\system32\udwm.dll
- %TEMP%\personalizationpanel\uninststring.reg
- %TEMP%\personalizationpanel\ver.ini
- %TEMP%\personalizationpanel\w7patcher_x64.exe
- %TEMP%\personalizationpanel\slc_x64\windows\syswow64\en-us\sl2.dll.mui
- %TEMP%\personalizationpanel\slc_x64\windows\syswow64\ru-ru\sl2.dll.mui
- %ProgramFiles%\bred3\plugins\colorer5\hrd\rgb\eclipse.hrd
- %ProgramFiles%\bred3\plugins\colorer5\hrd\rgb\contrib\fmx.hrd
- %TEMP%\vanadiy assistant1\vanadiy assistant_x64.exe
- %ProgramFiles%\bred3\plugins\colorer5\hrd\rgb\navy.hrd
- %ProgramFiles%\bred3\plugins\colorer5\hrd\rgb\neo.hrd
- %ProgramFiles%\bred3\plugins\colorer5\hrd\rgb\white.hrd
- %ProgramFiles%\bred3\readme.txt
- %ProgramFiles%\bred3\bred3.exe
- %ProgramFiles%\bred3\plugins\colorer5\icolore.dll
- %ProgramFiles%\bred3\uninstall.exe
- %TEMP%\notepad2\killduplicate.cmd
- %TEMP%\notepad2\notepad2_x64.exe
- %TEMP%\notepad2\notepad2_x86.exe
- %TEMP%\vanadiy assistant1\vanadiy assistant_x86.exe
- %ProgramFiles%\bred3\plugins\colorer5\hrd\rgb\grayscale.hrd
- %ProgramFiles%\vanadiy assistant\vanadiy assistant_x86.reg
- %TEMP%\notepad2_x86\killduplicate.cmd
- %TEMP%\notepad2_x86\notepad2.txt
- %TEMP%\notepad2_x86\notepad2.exe
- %ProgramFiles%\notepad2\set8.tmp
- %ProgramFiles%\notepad2\set9.tmp
- %ProgramFiles%\notepad2\seta.tmp
- %ProgramFiles%\notepad2\setb.tmp
- %APPDATA%\setc.tmp
- %APPDATA%\notepad2.ini
- %ProgramFiles%\notepad2\notepad2.ini
- %TEMP%\vanadiy assistant1\killduplicate.cmd
- %TEMP%\notepad2_x86\license.txt
- %TEMP%\notepad2_x86\notepad2.inf
- %TEMP%\notepad2_x86\notepad2.ini
- %ProgramFiles%\bred3\plugins\colorer5\hrc\rare\abap4.hrc
- %ProgramFiles%\bred3\plugins\colorer5\hrc\rare\1c.hrc
- %ProgramFiles%\bred3\plugins\colorer5\hrc\misc\text.hrc
- %ProgramFiles%\bred3\plugins\colorer5\hrc\auto\gen\taglib.hrc
- %ProgramFiles%\bred3\plugins\colorer5\hrc\auto\gen\web-app.hrc
- %ProgramFiles%\bred3\plugins\colorer5\hrc\auto\gen\xsd2hrc.custom.hrc
- %ProgramFiles%\bred3\plugins\colorer5\hrc\auto\gen\xslfo.hrc
- %ProgramFiles%\bred3\plugins\colorer5\hrc\auto\litestep.hrc
- %ProgramFiles%\bred3\plugins\colorer5\hrc\auto\mason.hrc
- %ProgramFiles%\bred3\plugins\colorer5\hrc\auto\qrm.hrc
- %ProgramFiles%\bred3\plugins\colorer5\hrc\auto\qrm\atl.hrc
- %ProgramFiles%\bred3\plugins\colorer5\hrc\auto\qrm\dii.hrc
- %ProgramFiles%\bred3\plugins\colorer5\hrc\auto\qrm\rpt.hrc
- %ProgramFiles%\bred3\plugins\colorer5\hrc\auto\rare-scripts.hrc
- %ProgramFiles%\bred3\plugins\colorer5\hrc\auto\gen\esc.hrc
- %ProgramFiles%\bred3\plugins\colorer5\hrc\auto\types\litestep.hrc
- %ProgramFiles%\bred3\plugins\colorer5\hrc\auto\gen\docbook.hrc
- %ProgramFiles%\bred3\plugins\colorer5\hrc\auto\types\cppsql.hrc
- %ProgramFiles%\bred3\plugins\colorer5\hrc\auto\types\csql.hrc
- %ProgramFiles%\bred3\plugins\colorer5\hrc\auto\types\edif.hrc
- %ProgramFiles%\bred3\plugins\colorer5\hrc\auto\types\farhelp.hrc
- %ProgramFiles%\bred3\plugins\colorer5\hrc\auto\types\farmailscript.hrc
- %ProgramFiles%\bred3\plugins\colorer5\hrc\auto\types\farmsg.hrc
- %ProgramFiles%\bred3\plugins\colorer5\hrc\auto\types\flex.hrc
- %ProgramFiles%\bred3\plugins\colorer5\hrc\auto\types\gpss.hrc
- %ProgramFiles%\bred3\plugins\colorer5\hrc\auto\types\irclog.hrc
- %ProgramFiles%\bred3\plugins\colorer5\hrc\auto\types\kixtart.hrc
- %ProgramFiles%\bred3\plugins\colorer5\hrc\auto\types\linkdef.hrc
- %ProgramFiles%\bred3\plugins\colorer5\hrc\auto\types\adm.hrc
- %ProgramFiles%\bred3\plugins\colorer5\hrc\auto\types\aditor.hrc
- %ProgramFiles%\bred3\plugins\colorer5\hrc\auto\types\cobolsql.hrc
- %ProgramFiles%\bred3\plugins\colorer5\hrc\auto\gen\calcset.hrc
- %TEMP%\bred3\killduplicate.cmd
- %TEMP%\1.tmp\notepad2.exe
- %TEMP%\1.tmp\personalizationpanel.exe
- %TEMP%\1.tmp\preactivator.exe
- %TEMP%\1.tmp\settings.exe
- %TEMP%\1.tmp\vanadiyassistant.exe
- %TEMP%\1.tmp\addshow.exe
- %TEMP%\2.tmp\3.tmp\4.bat
- %TEMP%\2.tmp\tweak.reg
- %TEMP%\addshowhide\addshowhide.cmd
- %TEMP%\addshowhide\addshowhide.reg
- %TEMP%\addshowhide\killduplicate.cmd
- %ProgramFiles%\bred3\plugins\colorer5\hrc\auto\gen\colorer5catalog.hrc
- %ProgramFiles%\bred3\plugins\colorer5\hrc\auto\types\m4.hrc
- %TEMP%\1.tmp\bred3.exe
- %TEMP%\bred3\bred3_x64.exe
- %TEMP%\bred3\bred3_x86.exe
- %ProgramFiles%\bred3\bred3.url
- %ProgramFiles%\bred3\bred3_x86.reg
- %ProgramFiles%\bred3\license.txt
- %ProgramFiles%\bred3\plugins\colorer5\catalog.xml
- %ProgramFiles%\bred3\plugins\colorer5\hrc\auto\ccsql.hrc
- %ProgramFiles%\bred3\plugins\colorer5\hrc\auto\farmanager.hrc
- %ProgramFiles%\bred3\plugins\colorer5\hrc\auto\gen.hrc
- %ProgramFiles%\bred3\plugins\colorer5\hrc\auto\gen\.empty
- %ProgramFiles%\bred3\plugins\colorer5\hrc\auto\gen\ant.hrc
- %WINDIR%\showhidesysextonoff.vbs
- %TEMP%\addshowhide\showhidesysextonoff.vbs
- %ProgramFiles%\bred3\plugins\colorer5\hrc\auto\gen\mathml.hrc
- %ProgramFiles%\bred3\plugins\colorer5\hrc\auto\types\mancolor.hrc
- %ProgramFiles%\bred3\plugins\colorer5\hrc\colorer.hrc
- %ProgramFiles%\bred3\plugins\colorer5\hrc\db\clipper.hrc
- %ProgramFiles%\bred3\plugins\colorer5\hrc\db\foxpro.hrc
- %ProgramFiles%\bred3\plugins\colorer5\hrc\db\paradox.hrc
- %ProgramFiles%\bred3\plugins\colorer5\hrc\db\sql.hrc
- %ProgramFiles%\bred3\plugins\colorer5\hrc\db\sqlj.hrc
- %ProgramFiles%\bred3\plugins\colorer5\hrc\default.hrc
- %ProgramFiles%\bred3\plugins\colorer5\hrc\hrc.xsl
- %ProgramFiles%\bred3\plugins\colorer5\hrc\inet\actionscript.hrc
- %ProgramFiles%\bred3\plugins\colorer5\hrc\inet\asp.js.hrc
- %ProgramFiles%\bred3\plugins\colorer5\hrc\inet\asp.ps.hrc
- %ProgramFiles%\bred3\plugins\colorer5\hrc\changes.txt
- %ProgramFiles%\bred3\plugins\colorer5\hrc\base\vb.net.hrc
- %ProgramFiles%\bred3\plugins\colorer5\hrc\db\clarion.hrc
- %ProgramFiles%\bred3\plugins\colorer5\hrc\inet\asp.vb.hrc
- %ProgramFiles%\bred3\plugins\colorer5\hrc\inet\jsp.hrc
- %ProgramFiles%\bred3\plugins\colorer5\hrc\inet\php.hrc
- %ProgramFiles%\bred3\plugins\colorer5\hrc\inet\vbscript.hrc
- %ProgramFiles%\bred3\plugins\colorer5\hrc\inet\xhtml-frameset.hrc
- %ProgramFiles%\bred3\plugins\colorer5\hrc\inet\xhtml-strict.hrc
- %ProgramFiles%\bred3\plugins\colorer5\hrc\inet\xhtml-trans.hrc
- %ProgramFiles%\bred3\plugins\colorer5\hrc\lib\regexp.hrc
- %ProgramFiles%\bred3\plugins\colorer5\hrc\misc\diff.hrc
- %ProgramFiles%\bred3\plugins\colorer5\hrc\misc\filesbbs.hrc
- %ProgramFiles%\bred3\plugins\colorer5\hrc\misc\messages.hrc
- %ProgramFiles%\bred3\plugins\colorer5\hrc\inet\css.hrc
- %ProgramFiles%\bred3\plugins\colorer5\hrc\inet\html.hrc
- %ProgramFiles%\bred3\plugins\colorer5\hrc\inet\jscript.hrc
- %ProgramFiles%\bred3\plugins\colorer5\hrc\base\vbasic.hrc
- %ProgramFiles%\bred3\plugins\colorer5\hrc\base\perl.hrc
- %ProgramFiles%\bred3\plugins\colorer5\hrc\auto\types\mason.hrc
- %ProgramFiles%\bred3\plugins\colorer5\hrc\auto\types\micqlog.hrc
- %ProgramFiles%\bred3\plugins\colorer5\hrc\auto\types\ppwizard.hrc
- %ProgramFiles%\bred3\plugins\colorer5\hrc\auto\types\pvwave.hrc
- %ProgramFiles%\bred3\plugins\colorer5\hrc\auto\types\rib.hrc
- %ProgramFiles%\bred3\plugins\colorer5\hrc\auto\types\rsmac.hrc
- %ProgramFiles%\bred3\plugins\colorer5\hrc\auto\types\rtf.hrc
- %ProgramFiles%\bred3\plugins\colorer5\hrc\auto\types\scn.hrc
- %ProgramFiles%\bred3\plugins\colorer5\hrc\auto\types\sdml.hrc
- %ProgramFiles%\bred3\plugins\colorer5\hrc\auto\types\sl.hrc
- %ProgramFiles%\bred3\plugins\colorer5\hrc\auto\types\spt.hrc
- %ProgramFiles%\bred3\plugins\colorer5\hrc\auto\types\tgs.hrc
- %ProgramFiles%\bred3\plugins\colorer5\hrc\auto\types\truemac.hrc
- %ProgramFiles%\bred3\plugins\colorer5\hrc\auto\types\mel.hrc
- %ProgramFiles%\bred3\plugins\colorer5\hrc\auto\types\urq.hrc
- %ProgramFiles%\bred3\plugins\colorer5\hrc\auto\types\vismod.hrc
- %ProgramFiles%\bred3\plugins\colorer5\hrc\auto\vim.hrc
- %ProgramFiles%\bred3\plugins\colorer5\hrc\base\asm.hrc
- %ProgramFiles%\bred3\plugins\colorer5\hrc\base\c.hrc
- %ProgramFiles%\bred3\plugins\colorer5\hrc\base\cpp.hrc
- %ProgramFiles%\bred3\plugins\colorer5\hrc\base\csharp.hrc
- %ProgramFiles%\bred3\plugins\colorer5\hrc\base\forth.hrc
- %ProgramFiles%\bred3\plugins\colorer5\hrc\base\fortran.hrc
- %ProgramFiles%\bred3\plugins\colorer5\hrc\base\idl.hrc
- %ProgramFiles%\bred3\plugins\colorer5\hrc\base\java.hrc
- %ProgramFiles%\bred3\plugins\colorer5\hrc\base\js.net.hrc
- %ProgramFiles%\bred3\plugins\colorer5\hrc\base\pascal.hrc
- %ProgramFiles%\bred3\plugins\colorer5\hrc\auto\types\vim.hrc
- %TEMP%\personalizationpanel\w7patcher_x86.exe
- %TEMP%\rarsfx0\wloader.exe
Sets the 'hidden' attribute to the following files
- %TEMP%\addshowhide\killduplicate.cmd
- %TEMP%\bred3\killduplicate.cmd
- %TEMP%\notepad2\killduplicate.cmd
- %TEMP%\notepad2_x86\killduplicate.cmd
- %TEMP%\vanadiy assistant1\killduplicate.cmd
- %TEMP%\personalizationpanel\killduplicate.cmd
Deletes the following files
- %TEMP%\2.tmp\tweak.reg
- %TEMP%\personalizationpanel\slc_x64\windows\system32\sl2.dll
- %TEMP%\personalizationpanel\slc_x64\windows\system32\slc.dll
- %TEMP%\personalizationpanel\slc_x64\windows\syswow64\en-us\sl2.dll.mui
- %TEMP%\personalizationpanel\slc_x64\windows\syswow64\ru-ru\sl2.dll.mui
- %TEMP%\personalizationpanel\slc_x64\windows\syswow64\sl2.dll
- %TEMP%\personalizationpanel\slc_x64\windows\syswow64\slc.dll
- %TEMP%\personalizationpanel\slc_x86\windows\system32\en-us\sl2.dll.mui
- %TEMP%\personalizationpanel\slc_x86\windows\system32\ru-ru\sl2.dll.mui
- %TEMP%\personalizationpanel\slc_x86\windows\system32\ru-ru\udwm.dll.mui
- %TEMP%\personalizationpanel\slc_x86\windows\system32\sl2.dll
- %TEMP%\personalizationpanel\slc_x86\windows\system32\slc.dll
- %TEMP%\personalizationpanel\slc_x86\windows\system32\udwm.dll
- %TEMP%\personalizationpanel\uninststring.reg
- %TEMP%\personalizationpanel\ver.ini
- %TEMP%\personalizationpanel\w7patcher_x64.exe
- %TEMP%\personalizationpanel\w7patcher_x86.exe
- %TEMP%\rarsfx0\wloader.exe
- %TEMP%\1.tmp\bred3.exe
- %TEMP%\1.tmp\notepad2.exe
- %TEMP%\1.tmp\personalizationpanel.exe
- %TEMP%\1.tmp\preactivator.exe
- %TEMP%\1.tmp\settings.exe
- %TEMP%\1.tmp\vanadiyassistant.exe
- %TEMP%\personalizationpanel\slc_x64\windows\system32\ru-ru\sl2.dll.mui
- %TEMP%\1.tmp\addshow.exe
- %TEMP%\personalizationpanel\slc_x64\windows\system32\en-us\sl2.dll.mui
- %TEMP%\personalizationpanel\personalizationpanel.cmd
- %TEMP%\2.tmp\3.tmp\4.bat
- %TEMP%\addshowhide\addshowhide.cmd
- %TEMP%\addshowhide\addshowhide.reg
- %TEMP%\addshowhide\killduplicate.cmd
- %TEMP%\addshowhide\showhidesysextonoff.vbs
- %TEMP%\bred3\bred3_x64.exe
- %TEMP%\bred3\bred3_x86.exe
- %TEMP%\bred3\killduplicate.cmd
- %TEMP%\notepad2_x86\killduplicate.cmd
- %TEMP%\notepad2_x86\license.txt
- %TEMP%\notepad2_x86\notepad2.exe
- %TEMP%\notepad2_x86\notepad2.inf
- %TEMP%\notepad2_x86\notepad2.ini
- %TEMP%\notepad2_x86\notepad2.txt
- %TEMP%\notepad2\killduplicate.cmd
- %TEMP%\notepad2\notepad2_x64.exe
- %TEMP%\notepad2\notepad2_x86.exe
- %TEMP%\vanadiy assistant1\killduplicate.cmd
- %TEMP%\vanadiy assistant1\vanadiy assistant_x64.exe
- %TEMP%\vanadiy assistant1\vanadiy assistant_x86.exe
- %TEMP%\personalizationpanel\killduplicate.cmd
- %TEMP%\personalizationpanel\packico.ico
- %TEMP%\personalizationpanel\personalization.inf
- %TEMP%\personalizationpanel\postuninst.cmd
- %TEMP%\1.tmp\final settings.cmd
Moves the following files
- from %ProgramFiles%\notepad2\set8.tmp to %ProgramFiles%\notepad2\license.txt
- from %ProgramFiles%\notepad2\set9.tmp to %ProgramFiles%\notepad2\notepad2.exe
- from %ProgramFiles%\notepad2\seta.tmp to %ProgramFiles%\notepad2\notepad2.inf
- from %ProgramFiles%\notepad2\setb.tmp to %ProgramFiles%\notepad2\notepad2.txt
- from %APPDATA%\setc.tmp to %APPDATA%\notepad2.ini
Miscellaneous
Searches for the following windows
- ClassName: 'RegEdit_RegEdit' WindowName: ''
- ClassName: 'EDIT' WindowName: ''
- ClassName: 'STATIC' WindowName: 'q3TDgcZ4p2up0Z77amQP 00000778'
Creates and executes the following
- '%TEMP%\1.tmp\settings.exe'
- '%TEMP%\1.tmp\preactivator.exe'
- '%TEMP%\1.tmp\personalizationpanel.exe'
- '%ProgramFiles%\vanadiy assistant\links.exe'
- '%TEMP%\1.tmp\vanadiyassistant.exe'
- '%TEMP%\rarsfx0\wloader.exe' /silent /preactivate
- '%TEMP%\vanadiy assistant1\vanadiy assistant_x86.exe'
- '%TEMP%\1.tmp\notepad2.exe'
- '%TEMP%\bred3\bred3_x86.exe'
- '%TEMP%\1.tmp\addshow.exe'
- '%TEMP%\1.tmp\bred3.exe'
- '%TEMP%\notepad2\notepad2_x86.exe'
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\AddShowHide\KillDuplicate.cmd" "%TEMP%\AddShowHide" "AddShow.exe""' (with hidden window)
- '%TEMP%\bred3\bred3_x86.exe' ' (with hidden window)
- '%TEMP%\vanadiy assistant1\vanadiy assistant_x86.exe' ' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\PersonalizationPanel\KillDuplicate.cmd" "%TEMP%\PersonalizationPanel" "PersonalizationPanel.exe""' (with hidden window)
- '%ProgramFiles%\vanadiy assistant\links.exe' ' (with hidden window)
- '%WINDIR%\regedit.exe' /s "Vanadiy Assistant_x86.reg"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\Notepad2\KillDuplicate.cmd" "%TEMP%\Notepad2" "Notepad2.exe""' (with hidden window)
- '%WINDIR%\regedit.exe' /s "Bred3_x86.reg"' (with hidden window)
- '<SYSTEM32>\rundll32.exe' advpack.dll,LaunchINFSectionEx %TEMP%\Notepad2_x86\Notepad2.inf,DefaultInstall,,4,N' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\Bred3\KillDuplicate.cmd" "%TEMP%\Bred3" "Bred3.exe""' (with hidden window)
- '%TEMP%\notepad2\notepad2_x86.exe' ' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\AddShowHide\AddShowHide.cmd" "' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\Vanadiy Assistant1\KillDuplicate.cmd" "%TEMP%\Vanadiy Assistant1" "VanadiyAssistant.exe""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\PersonalizationPanel\PersonalizationPanel.cmd" "' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\Notepad2_x86\KillDuplicate.cmd" "%TEMP%\Notepad2_x86" "Notepad2_x86.exe""' (with hidden window)
Executes the following
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\1.tmp\Final Settings.cmd" <Current directory>\"
- '<SYSTEM32>\cmd.exe' /c reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v EditionID
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\PersonalizationPanel\PersonalizationPanel.cmd" "
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\PersonalizationPanel\KillDuplicate.cmd" "%TEMP%\PersonalizationPanel" "PersonalizationPanel.exe""
- '%WINDIR%\regedit.exe' /s "Vanadiy Assistant_x86.reg"
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\Vanadiy Assistant1\KillDuplicate.cmd" "%TEMP%\Vanadiy Assistant1" "VanadiyAssistant.exe""
- '<SYSTEM32>\rundll32.exe' advpack.dll,LaunchINFSectionEx %TEMP%\Notepad2_x86\Notepad2.inf,DefaultInstall,,4,N
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\Notepad2_x86\KillDuplicate.cmd" "%TEMP%\Notepad2_x86" "Notepad2_x86.exe""
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\Notepad2\KillDuplicate.cmd" "%TEMP%\Notepad2" "Notepad2.exe""
- '%WINDIR%\regedit.exe' /s "Bred3_x86.reg"
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\Bred3\KillDuplicate.cmd" "%TEMP%\Bred3" "Bred3.exe""
- '<SYSTEM32>\xcopy.exe' /h /y ShowHideSysExtOnOff.vbs "%WINDIR%"
- '%WINDIR%\regedit.exe' /s AddShowHide.reg
- '<SYSTEM32>\mode.com' con cols=30 lines=4
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\AddShowHide\AddShowHide.cmd" "
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\AddShowHide\KillDuplicate.cmd" "%TEMP%\AddShowHide" "AddShow.exe""
- '%WINDIR%\regedit.exe' /s tweak.reg
- '<SYSTEM32>\mode.com' con cols=40 lines=2
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\2.tmp\3.tmp\4.bat" "%TEMP%\1.tmp\Settings.exe""
- '<SYSTEM32>\mode.com' con cols=40 lines=5
- '<SYSTEM32>\reg.exe' query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v EditionID
- '<SYSTEM32>\shutdown.exe' /r /f /t 05 /c "ä½∩ ВєГЎГіГ‘αΦÑ¡¿∩ πГџΓá¡«ó¬¿ ¬«¼»∞εΓГ‘α ГπГ±Г‘Γ В»Г‘αѺáúαπªÑ¡!"
Attempts to shut down the Windows operating system.