Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Classes\TeraCopy.SFVFile\Shell\Open\command] '' = '"%PROGRAM_FILES%\TeraCopy\TeraCopy.exe" Check "%1"'
- [<HKLM>\SOFTWARE\Classes\TeraCopy.MD5File\Shell\Open\command] '' = '"%PROGRAM_FILES%\TeraCopy\TeraCopy.exe" Check "%1"'
Malicious functions:
Creates and executes the following:
- '%TEMP%\is-L4HD4.tmp\teracopy222.tmp' /SL5="$300DC,2411868,54272,%TEMP%\7ZipSfx.000\teracopy222.exe" /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-
- '%TEMP%\7ZipSfx.000\teracopy222.exe' /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-
Modifies file system :
Creates the following files:
- %PROGRAM_FILES%\TeraCopy\locale\id\LC_MESSAGES\is-8Q3O4.tmp
- %PROGRAM_FILES%\TeraCopy\locale\it\LC_MESSAGES\is-AI28P.tmp
- %PROGRAM_FILES%\TeraCopy\locale\fr\LC_MESSAGES\is-U1K9K.tmp
- %PROGRAM_FILES%\TeraCopy\locale\he_IL\LC_MESSAGES\is-0VPSR.tmp
- %PROGRAM_FILES%\TeraCopy\locale\ja\LC_MESSAGES\is-I055A.tmp
- %PROGRAM_FILES%\TeraCopy\locale\nb\LC_MESSAGES\is-ELTM3.tmp
- %PROGRAM_FILES%\TeraCopy\locale\nl\LC_MESSAGES\is-0INMU.tmp
- %PROGRAM_FILES%\TeraCopy\locale\kbd\LC_MESSAGES\is-O7F28.tmp
- %PROGRAM_FILES%\TeraCopy\locale\ko\LC_MESSAGES\is-A6HQ6.tmp
- %PROGRAM_FILES%\TeraCopy\locale\de\LC_MESSAGES\is-3T38A.tmp
- %PROGRAM_FILES%\TeraCopy\locale\el_GR\LC_MESSAGES\is-BO3JF.tmp
- %PROGRAM_FILES%\TeraCopy\locale\cs\LC_MESSAGES\is-GJJ04.tmp
- %PROGRAM_FILES%\TeraCopy\locale\da\LC_MESSAGES\is-Q47D4.tmp
- %PROGRAM_FILES%\TeraCopy\locale\en\LC_MESSAGES\is-I3MRH.tmp
- %PROGRAM_FILES%\TeraCopy\locale\fa_IR\LC_MESSAGES\is-V6NA4.tmp
- %PROGRAM_FILES%\TeraCopy\locale\fi_FI\LC_MESSAGES\is-KA1FR.tmp
- %PROGRAM_FILES%\TeraCopy\locale\es\LC_MESSAGES\is-JCML5.tmp
- %PROGRAM_FILES%\TeraCopy\locale\es_AR\LC_MESSAGES\is-5TRBE.tmp
- %PROGRAM_FILES%\TeraCopy\locale\pl_PL\LC_MESSAGES\is-BFR5E.tmp
- %ALLUSERSPROFILE%\Start Menu\Programs\TeraCopy\TeraCopy.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\TeraCopy\TeraCopy on the Web.lnk
- %PROGRAM_FILES%\TeraCopy\locale\zh_Hans\LC_MESSAGES\is-M3FHU.tmp
- %PROGRAM_FILES%\TeraCopy\locale\zh_Hant\LC_MESSAGES\is-4J8F2.tmp
- %ALLUSERSPROFILE%\Start Menu\Programs\TeraCopy\Uninstall TeraCopy.lnk
- %PROGRAM_FILES%\TeraCopy\unins000.msg
- %PROGRAM_FILES%\TeraCopy\unins000.dat
- %ALLUSERSPROFILE%\Start Menu\Programs\TeraCopy\TeraCopy Help.lnk
- %PROGRAM_FILES%\TeraCopy\TeraCopy.url
- %PROGRAM_FILES%\TeraCopy\locale\ro_RO\LC_MESSAGES\is-4CQ19.tmp
- %PROGRAM_FILES%\TeraCopy\locale\ru\LC_MESSAGES\is-SKSK4.tmp
- %PROGRAM_FILES%\TeraCopy\locale\pt_BR\LC_MESSAGES\is-8KR12.tmp
- %PROGRAM_FILES%\TeraCopy\locale\pt_PT\LC_MESSAGES\is-HABBI.tmp
- %PROGRAM_FILES%\TeraCopy\locale\sl_SI\LC_MESSAGES\is-LMFHI.tmp
- %PROGRAM_FILES%\TeraCopy\locale\tr_TR\LC_MESSAGES\is-8EU03.tmp
- %PROGRAM_FILES%\TeraCopy\locale\vi_VN\LC_MESSAGES\is-PES4B.tmp
- %PROGRAM_FILES%\TeraCopy\locale\sv_SE\LC_MESSAGES\is-B3K0U.tmp
- %PROGRAM_FILES%\TeraCopy\locale\th_TH\LC_MESSAGES\is-L3FR3.tmp
- %PROGRAM_FILES%\TeraCopy\is-QQM6Q.tmp
- %PROGRAM_FILES%\TeraCopy\is-K2HR1.tmp
- %PROGRAM_FILES%\TeraCopy\is-33R68.tmp
- %PROGRAM_FILES%\TeraCopy\is-2IAIK.tmp
- %PROGRAM_FILES%\TeraCopy\is-MNBCD.tmp
- %PROGRAM_FILES%\TeraCopy\is-9L93D.tmp
- %PROGRAM_FILES%\TeraCopy\is-K2E97.tmp
- %PROGRAM_FILES%\TeraCopy\is-PN00F.tmp
- %PROGRAM_FILES%\TeraCopy\is-RGNN3.tmp
- %TEMP%\is-LAALA.tmp\_isetup\_RegDLL.tmp
- %TEMP%\is-LAALA.tmp\_isetup\_shfoldr.dll
- %TEMP%\7ZipSfx.000\teracopy222.exe
- %TEMP%\is-L4HD4.tmp\teracopy222.tmp
- %PROGRAM_FILES%\TeraCopy\is-BGA5I.tmp
- %PROGRAM_FILES%\TeraCopy\is-THE6Q.tmp
- %PROGRAM_FILES%\TeraCopy\is-TGIK0.tmp
- %PROGRAM_FILES%\TeraCopy\is-URVAV.tmp
- %PROGRAM_FILES%\TeraCopy\is-5N7B7.tmp
- %PROGRAM_FILES%\TeraCopy\is-L4NFH.tmp
- %PROGRAM_FILES%\TeraCopy\Images\is-JBCRE.tmp
- %PROGRAM_FILES%\TeraCopy\Images\is-2M29R.tmp
- %PROGRAM_FILES%\TeraCopy\Images\is-7LV7V.tmp
- %PROGRAM_FILES%\TeraCopy\Images\is-HONP0.tmp
- %PROGRAM_FILES%\TeraCopy\Images\is-6OHT4.tmp
- %PROGRAM_FILES%\TeraCopy\Images\is-F63HM.tmp
- %PROGRAM_FILES%\TeraCopy\locale\ar\LC_MESSAGES\is-7VABC.tmp
- %PROGRAM_FILES%\TeraCopy\Images\is-JPTLS.tmp
- %PROGRAM_FILES%\TeraCopy\Images\is-A9LAQ.tmp
- %PROGRAM_FILES%\TeraCopy\is-147CE.tmp
- %PROGRAM_FILES%\TeraCopy\is-1UQEI.tmp
- %PROGRAM_FILES%\TeraCopy\is-83PTC.tmp
- %PROGRAM_FILES%\TeraCopy\is-HNK9R.tmp
- %PROGRAM_FILES%\TeraCopy\is-6B43E.tmp
- %PROGRAM_FILES%\TeraCopy\Images\is-70208.tmp
- %PROGRAM_FILES%\TeraCopy\Images\is-07BN0.tmp
- %PROGRAM_FILES%\TeraCopy\Images\is-LVFV4.tmp
- %PROGRAM_FILES%\TeraCopy\Images\is-7IT9O.tmp
Deletes the following files:
- %TEMP%\is-L4HD4.tmp\teracopy222.tmp
- %TEMP%\7ZipSfx.000\teracopy222.exe
- %TEMP%\is-LAALA.tmp\_isetup\_RegDLL.tmp
- %TEMP%\is-LAALA.tmp\_isetup\_shfoldr.dll
Moves the following files:
- from %PROGRAM_FILES%\TeraCopy\locale\fr\LC_MESSAGES\is-U1K9K.tmp to %PROGRAM_FILES%\TeraCopy\locale\fr\LC_MESSAGES\default.mo
- from %PROGRAM_FILES%\TeraCopy\locale\fi_FI\LC_MESSAGES\is-KA1FR.tmp to %PROGRAM_FILES%\TeraCopy\locale\fi_FI\LC_MESSAGES\default.mo
- from %PROGRAM_FILES%\TeraCopy\locale\fa_IR\LC_MESSAGES\is-V6NA4.tmp to %PROGRAM_FILES%\TeraCopy\locale\fa_IR\LC_MESSAGES\default.mo
- from %PROGRAM_FILES%\TeraCopy\locale\he_IL\LC_MESSAGES\is-0VPSR.tmp to %PROGRAM_FILES%\TeraCopy\locale\he_IL\LC_MESSAGES\default.mo
- from %PROGRAM_FILES%\TeraCopy\locale\ja\LC_MESSAGES\is-I055A.tmp to %PROGRAM_FILES%\TeraCopy\locale\ja\LC_MESSAGES\default.mo
- from %PROGRAM_FILES%\TeraCopy\locale\it\LC_MESSAGES\is-AI28P.tmp to %PROGRAM_FILES%\TeraCopy\locale\it\LC_MESSAGES\default.mo
- from %PROGRAM_FILES%\TeraCopy\locale\id\LC_MESSAGES\is-8Q3O4.tmp to %PROGRAM_FILES%\TeraCopy\locale\id\LC_MESSAGES\default.mo
- from %PROGRAM_FILES%\TeraCopy\locale\es_AR\LC_MESSAGES\is-5TRBE.tmp to %PROGRAM_FILES%\TeraCopy\locale\es_AR\LC_MESSAGES\default.mo
- from %PROGRAM_FILES%\TeraCopy\locale\da\LC_MESSAGES\is-Q47D4.tmp to %PROGRAM_FILES%\TeraCopy\locale\da\LC_MESSAGES\default.mo
- from %PROGRAM_FILES%\TeraCopy\locale\cs\LC_MESSAGES\is-GJJ04.tmp to %PROGRAM_FILES%\TeraCopy\locale\cs\LC_MESSAGES\default.mo
- from %PROGRAM_FILES%\TeraCopy\locale\ar\LC_MESSAGES\is-7VABC.tmp to %PROGRAM_FILES%\TeraCopy\locale\ar\LC_MESSAGES\default.mo
- from %PROGRAM_FILES%\TeraCopy\locale\de\LC_MESSAGES\is-3T38A.tmp to %PROGRAM_FILES%\TeraCopy\locale\de\LC_MESSAGES\default.mo
- from %PROGRAM_FILES%\TeraCopy\locale\es\LC_MESSAGES\is-JCML5.tmp to %PROGRAM_FILES%\TeraCopy\locale\es\LC_MESSAGES\default.mo
- from %PROGRAM_FILES%\TeraCopy\locale\en\LC_MESSAGES\is-I3MRH.tmp to %PROGRAM_FILES%\TeraCopy\locale\en\LC_MESSAGES\default.mo
- from %PROGRAM_FILES%\TeraCopy\locale\el_GR\LC_MESSAGES\is-BO3JF.tmp to %PROGRAM_FILES%\TeraCopy\locale\el_GR\LC_MESSAGES\default.mo
- from %PROGRAM_FILES%\TeraCopy\locale\kbd\LC_MESSAGES\is-O7F28.tmp to %PROGRAM_FILES%\TeraCopy\locale\kbd\LC_MESSAGES\default.mo
- from %PROGRAM_FILES%\TeraCopy\locale\th_TH\LC_MESSAGES\is-L3FR3.tmp to %PROGRAM_FILES%\TeraCopy\locale\th_TH\LC_MESSAGES\default.mo
- from %PROGRAM_FILES%\TeraCopy\locale\sv_SE\LC_MESSAGES\is-B3K0U.tmp to %PROGRAM_FILES%\TeraCopy\locale\sv_SE\LC_MESSAGES\default.mo
- from %PROGRAM_FILES%\TeraCopy\locale\sl_SI\LC_MESSAGES\is-LMFHI.tmp to %PROGRAM_FILES%\TeraCopy\locale\sl_SI\LC_MESSAGES\default.mo
- from %PROGRAM_FILES%\TeraCopy\locale\tr_TR\LC_MESSAGES\is-8EU03.tmp to %PROGRAM_FILES%\TeraCopy\locale\tr_TR\LC_MESSAGES\default.mo
- from %PROGRAM_FILES%\TeraCopy\locale\zh_Hant\LC_MESSAGES\is-4J8F2.tmp to %PROGRAM_FILES%\TeraCopy\locale\zh_Hant\LC_MESSAGES\default.mo
- from %PROGRAM_FILES%\TeraCopy\locale\zh_Hans\LC_MESSAGES\is-M3FHU.tmp to %PROGRAM_FILES%\TeraCopy\locale\zh_Hans\LC_MESSAGES\default.mo
- from %PROGRAM_FILES%\TeraCopy\locale\vi_VN\LC_MESSAGES\is-PES4B.tmp to %PROGRAM_FILES%\TeraCopy\locale\vi_VN\LC_MESSAGES\default.mo
- from %PROGRAM_FILES%\TeraCopy\locale\ru\LC_MESSAGES\is-SKSK4.tmp to %PROGRAM_FILES%\TeraCopy\locale\ru\LC_MESSAGES\default.mo
- from %PROGRAM_FILES%\TeraCopy\locale\nl\LC_MESSAGES\is-0INMU.tmp to %PROGRAM_FILES%\TeraCopy\locale\nl\LC_MESSAGES\default.mo
- from %PROGRAM_FILES%\TeraCopy\locale\nb\LC_MESSAGES\is-ELTM3.tmp to %PROGRAM_FILES%\TeraCopy\locale\nb\LC_MESSAGES\default.mo
- from %PROGRAM_FILES%\TeraCopy\locale\ko\LC_MESSAGES\is-A6HQ6.tmp to %PROGRAM_FILES%\TeraCopy\locale\ko\LC_MESSAGES\default.mo
- from %PROGRAM_FILES%\TeraCopy\locale\pl_PL\LC_MESSAGES\is-BFR5E.tmp to %PROGRAM_FILES%\TeraCopy\locale\pl_PL\LC_MESSAGES\default.mo
- from %PROGRAM_FILES%\TeraCopy\locale\ro_RO\LC_MESSAGES\is-4CQ19.tmp to %PROGRAM_FILES%\TeraCopy\locale\ro_RO\LC_MESSAGES\default.mo
- from %PROGRAM_FILES%\TeraCopy\locale\pt_PT\LC_MESSAGES\is-HABBI.tmp to %PROGRAM_FILES%\TeraCopy\locale\pt_PT\LC_MESSAGES\default.mo
- from %PROGRAM_FILES%\TeraCopy\locale\pt_BR\LC_MESSAGES\is-8KR12.tmp to %PROGRAM_FILES%\TeraCopy\locale\pt_BR\LC_MESSAGES\default.mo
- from %PROGRAM_FILES%\TeraCopy\Images\is-F63HM.tmp to %PROGRAM_FILES%\TeraCopy\Images\TC.png
- from %PROGRAM_FILES%\TeraCopy\is-PN00F.tmp to %PROGRAM_FILES%\TeraCopy\sorttable.js
- from %PROGRAM_FILES%\TeraCopy\is-MNBCD.tmp to %PROGRAM_FILES%\TeraCopy\Readme.txt
- from %PROGRAM_FILES%\TeraCopy\is-K2HR1.tmp to %PROGRAM_FILES%\TeraCopy\PowerOff.cmd
- from %PROGRAM_FILES%\TeraCopy\is-RGNN3.tmp to %PROGRAM_FILES%\TeraCopy\tclinks.exe
- from %PROGRAM_FILES%\TeraCopy\is-L4NFH.tmp to %PROGRAM_FILES%\TeraCopy\TeraCopy.dll
- from %PROGRAM_FILES%\TeraCopy\is-K2E97.tmp to %PROGRAM_FILES%\TeraCopy\TeraCopy Help.chm
- from %PROGRAM_FILES%\TeraCopy\is-9L93D.tmp to %PROGRAM_FILES%\TeraCopy\tcm.exe
- from %PROGRAM_FILES%\TeraCopy\is-QQM6Q.tmp to %PROGRAM_FILES%\TeraCopy\License.txt
- from %PROGRAM_FILES%\TeraCopy\is-5N7B7.tmp to %PROGRAM_FILES%\TeraCopy\DefaultHandler.reg
- from %PROGRAM_FILES%\TeraCopy\is-URVAV.tmp to %PROGRAM_FILES%\TeraCopy\Complete.wav
- from %PROGRAM_FILES%\TeraCopy\is-BGA5I.tmp to %PROGRAM_FILES%\TeraCopy\unins000.exe
- from %PROGRAM_FILES%\TeraCopy\is-THE6Q.tmp to %PROGRAM_FILES%\TeraCopy\DefaultHandlerOff.reg
- from %PROGRAM_FILES%\TeraCopy\is-2IAIK.tmp to %PROGRAM_FILES%\TeraCopy\Error.wav
- from %PROGRAM_FILES%\TeraCopy\is-33R68.tmp to %PROGRAM_FILES%\TeraCopy\EnterKey.exe
- from %PROGRAM_FILES%\TeraCopy\is-TGIK0.tmp to %PROGRAM_FILES%\TeraCopy\Directory Opus.txt
- from %PROGRAM_FILES%\TeraCopy\is-83PTC.tmp to %PROGRAM_FILES%\TeraCopy\TeraCopy.exe
- from %PROGRAM_FILES%\TeraCopy\Images\is-JBCRE.tmp to %PROGRAM_FILES%\TeraCopy\Images\Last.png
- from %PROGRAM_FILES%\TeraCopy\Images\is-HONP0.tmp to %PROGRAM_FILES%\TeraCopy\Images\Favorite.png
- from %PROGRAM_FILES%\TeraCopy\Images\is-7LV7V.tmp to %PROGRAM_FILES%\TeraCopy\Images\Explorer.png
- from %PROGRAM_FILES%\TeraCopy\Images\is-2M29R.tmp to %PROGRAM_FILES%\TeraCopy\Images\MarkFavorite.png
- from %PROGRAM_FILES%\TeraCopy\Images\is-A9LAQ.tmp to %PROGRAM_FILES%\TeraCopy\Images\Star.png
- from %PROGRAM_FILES%\TeraCopy\Images\is-JPTLS.tmp to %PROGRAM_FILES%\TeraCopy\Images\Remove.png
- from %PROGRAM_FILES%\TeraCopy\Images\is-6OHT4.tmp to %PROGRAM_FILES%\TeraCopy\Images\Move.png
- from %PROGRAM_FILES%\TeraCopy\Images\is-07BN0.tmp to %PROGRAM_FILES%\TeraCopy\Images\DOpus.png
- from %PROGRAM_FILES%\TeraCopy\is-1UQEI.tmp to %PROGRAM_FILES%\TeraCopy\TeraCopyExt64.dll
- from %PROGRAM_FILES%\TeraCopy\is-147CE.tmp to %PROGRAM_FILES%\TeraCopy\TeraCopyExt.dll
- from %PROGRAM_FILES%\TeraCopy\is-HNK9R.tmp to %PROGRAM_FILES%\TeraCopy\TeraCopy64.dll
- from %PROGRAM_FILES%\TeraCopy\is-6B43E.tmp to %PROGRAM_FILES%\TeraCopy\Whatsnew.txt
- from %PROGRAM_FILES%\TeraCopy\Images\is-70208.tmp to %PROGRAM_FILES%\TeraCopy\Images\Copy.png
- from %PROGRAM_FILES%\TeraCopy\Images\is-7IT9O.tmp to %PROGRAM_FILES%\TeraCopy\Images\Center.png
- from %PROGRAM_FILES%\TeraCopy\Images\is-LVFV4.tmp to %PROGRAM_FILES%\TeraCopy\Images\Browse.png
Miscellaneous:
Searches for the following windows:
- ClassName: 'Shell_TrayWnd' WindowName: ''
