Technical Information
To ensure autorun and distribution
Sets the following service settings
- [<HKLM>\System\CurrentControlSet\Services\ISODrive] 'Start' = '00000001'
- [<HKLM>\System\CurrentControlSet\Services\ISODrive] 'ImagePath' = '%TEMP%\07JVj3mhy0\ISOCmd\ISODrv64.sys'
Creates the following services
- 'ISODrive' %TEMP%\07JVj3mhy0\ISOCmd\ISODrv64.sys
Modifies file system
Creates the following files
- %TEMP%\07jvj3mhy0\7z.exe
- %TEMP%\07jvj3mhy0\nt6dismx86\api-ms-win-downlevel-advapi32-l2-1-0.dll
- %TEMP%\07jvj3mhy0\nt6dismx64\api-ms-win-downlevel-advapi32-l2-1-0.dll
- %TEMP%\07jvj3mhy0\nt6dismx86\api-ms-win-downlevel-advapi32-l2-1-1.dll
- %TEMP%\07jvj3mhy0\nt6dismx64\api-ms-win-downlevel-advapi32-l2-1-1.dll
- %TEMP%\07jvj3mhy0\nt6dismx86\api-ms-win-downlevel-advapi32-l3-1-0.dll
- %TEMP%\07jvj3mhy0\nt6dismx64\api-ms-win-downlevel-advapi32-l3-1-0.dll
- %TEMP%\07jvj3mhy0\nt6dismx86\api-ms-win-downlevel-advapi32-l4-1-0.dll
- %TEMP%\07jvj3mhy0\nt6dismx64\api-ms-win-downlevel-advapi32-l4-1-0.dll
- %TEMP%\07jvj3mhy0\nt6dismx86\api-ms-win-downlevel-kernel32-l1-1-0.dll
- %TEMP%\07jvj3mhy0\nt6dismx64\api-ms-win-downlevel-kernel32-l1-1-0.dll
- %TEMP%\07jvj3mhy0\nt6dismx86\api-ms-win-downlevel-kernel32-l2-1-0.dll
- %TEMP%\07jvj3mhy0\nt6dismx64\api-ms-win-downlevel-kernel32-l2-1-0.dll
- %TEMP%\07jvj3mhy0\nt6dismx86\api-ms-win-downlevel-ole32-l1-1-0.dll
- %TEMP%\07jvj3mhy0\nt6dismx64\api-ms-win-downlevel-ole32-l1-1-0.dll
- %TEMP%\07jvj3mhy0\nt6dismx86\api-ms-win-downlevel-ole32-l1-1-1.dll
- %TEMP%\07jvj3mhy0\nt6dismx64\api-ms-win-downlevel-ole32-l1-1-1.dll
- %TEMP%\07jvj3mhy0\nt6dismx86\api-ms-win-downlevel-shlwapi-l1-1-0.dll
- %TEMP%\07jvj3mhy0\nt6dismx64\api-ms-win-downlevel-shlwapi-l1-1-0.dll
- %TEMP%\07jvj3mhy0\nt6dismx86\api-ms-win-downlevel-shlwapi-l1-1-1.dll
- %TEMP%\07jvj3mhy0\nt6dismx64\api-ms-win-downlevel-shlwapi-l1-1-1.dll
- %TEMP%\07jvj3mhy0\nt6dismx86\api-ms-win-downlevel-user32-l1-1-0.dll
- %TEMP%\07jvj3mhy0\nt6dismx64\api-ms-win-downlevel-advapi32-l1-1-1.dll
- %TEMP%\07jvj3mhy0\nt6dismx64\api-ms-win-downlevel-user32-l1-1-0.dll
- D:\laoyou\此目录为重要文件请勿删除.txt
- %TEMP%\07jvj3mhy0\nt6dismx64\api-ms-win-downlevel-advapi32-l1-1-0.dll
- %TEMP%\07jvj3mhy0\tools\fbinst.exe
- %TEMP%\07jvj3mhy0\tools\ghost32.exe
- %TEMP%\07jvj3mhy0\nt6dismx64\imagex.exe
- %TEMP%\07jvj3mhy0\nt6dismx86\imagex.exe
- %TEMP%\07jvj3mhy0\isocmd\isocmd.exe
- %TEMP%\07jvj3mhy0\download\minithunderplatform.exe
- %TEMP%\07jvj3mhy0\download\minitpfw.exe
- %TEMP%\07jvj3mhy0\tools\msdnloader.exe
- %TEMP%\07jvj3mhy0\nt6dismx64\pkgmgr.exe
- %TEMP%\07jvj3mhy0\nt6dismx86\pkgmgr.exe
- %TEMP%\07jvj3mhy0\download\thunderfw.exe
- %TEMP%\07jvj3mhy0\tools\wimlib-imagex.exe
- %TEMP%\07jvj3mhy0\nt6dismx64\wimmountadksetupamd64.exe
- %TEMP%\07jvj3mhy0\nt6dismx86\wimmountadksetupx86.exe
- %TEMP%\07jvj3mhy0\nt6dismx64\wimserv.exe
- %TEMP%\07jvj3mhy0\nt6dismx86\wimserv.exe
- %TEMP%\07jvj3mhy0\download\xlbugreport.exe
- %TEMP%\07jvj3mhy0\nt6dismx86\api-ms-win-core-apiquery-l1-1-0.dll
- D:\laoyou\softinfo.ini
- %TEMP%\07jvj3mhy0\nt6dismx64\api-ms-win-core-apiquery-l1-1-0.dll
- %TEMP%\07jvj3mhy0\nt6dismx86\api-ms-win-downlevel-advapi32-l1-1-0.dll
- %TEMP%\07jvj3mhy0\nt6dismx86\api-ms-win-downlevel-advapi32-l1-1-1.dll
- %TEMP%\07jvj3mhy0\tools\libwim-15.dll
- %TEMP%\07jvj3mhy0\nt6dismx86\wofadk.sys
- %TEMP%\07jvj3mhy0\nt6dismx86\api-ms-win-downlevel-version-l1-1-0.dll
- %TEMP%\07jvj3mhy0\nt6dismx64\microsoft.dism.powershell.dll
- %TEMP%\07jvj3mhy0\nt6dismx86\microsoft.dism.powershell.dll
- %TEMP%\07jvj3mhy0\download\minizip.dll
- %TEMP%\07jvj3mhy0\download\msvcp71.dll
- %TEMP%\07jvj3mhy0\download\msvcr71.dll
- %TEMP%\07jvj3mhy0\nt6dismx64\ssshim.dll
- %TEMP%\07jvj3mhy0\nt6dismx86\ssshim.dll
- %TEMP%\07jvj3mhy0\nt6dismx64\vhdprovider.dll
- %TEMP%\07jvj3mhy0\nt6dismx86\vhdprovider.dll
- %TEMP%\07jvj3mhy0\nt6dismx64\wimgapi.dll
- %TEMP%\07jvj3mhy0\nt6dismx86\wimgapi.dll
- %TEMP%\07jvj3mhy0\nt6dismx64\wimprovider.dll
- %TEMP%\07jvj3mhy0\nt6dismx86\wimprovider.dll
- %TEMP%\07jvj3mhy0\download\xlbughandler.dll
- %TEMP%\07jvj3mhy0\xldl.dll
- %TEMP%\07jvj3mhy0\download\zlib1.dll
- %TEMP%\07jvj3mhy0\isocmd\isodrive.sys
- %TEMP%\07jvj3mhy0\isocmd\isodrv64.sys
- %TEMP%\07jvj3mhy0\nt6dismx64\wimmount.sys
- %TEMP%\07jvj3mhy0\nt6dismx86\wimmount.sys
- %TEMP%\07jvj3mhy0\nt6dismx64\wofadk.sys
- %TEMP%\07jvj3mhy0\nt6dismx86\logprovider.dll
- %TEMP%\07jvj3mhy0\tools\drvloader.exe
- %TEMP%\07jvj3mhy0\nt6dismx64\logprovider.dll
- %TEMP%\07jvj3mhy0\nt6dismx86\imagingprovider.dll
- %TEMP%\07jvj3mhy0\nt6dismx64\api-ms-win-downlevel-version-l1-1-0.dll
- %TEMP%\07jvj3mhy0\download\atl71.dll
- %TEMP%\07jvj3mhy0\nt6dismx64\compatprovider.dll
- %TEMP%\07jvj3mhy0\nt6dismx86\compatprovider.dll
- %TEMP%\07jvj3mhy0\nt6dismx64\dismapi.dll
- %TEMP%\07jvj3mhy0\nt6dismx86\dismapi.dll
- %TEMP%\07jvj3mhy0\nt6dismx64\dismcore.dll
- %TEMP%\07jvj3mhy0\nt6dismx86\dismcore.dll
- %TEMP%\07jvj3mhy0\nt6dismx64\dismcoreps.dll
- %TEMP%\07jvj3mhy0\nt6dismx86\dismcoreps.dll
- %TEMP%\07jvj3mhy0\nt6dismx64\dismprov.dll
- %TEMP%\07jvj3mhy0\nt6dismx86\dismprov.dll
- %TEMP%\07jvj3mhy0\download\dl_peer_id.dll
- %TEMP%\07jvj3mhy0\download\download_engine.dll
- %TEMP%\07jvj3mhy0\nt6dismx86\ext-ms-win-advapi32-encryptedfile-l1-1-0.dll
- %TEMP%\07jvj3mhy0\nt6dismx64\ext-ms-win-advapi32-encryptedfile-l1-1-0.dll
- %TEMP%\07jvj3mhy0\nt6dismx64\ffuprovider.dll
- %TEMP%\07jvj3mhy0\nt6dismx86\ffuprovider.dll
- %TEMP%\07jvj3mhy0\nt6dismx64\folderprovider.dll
- %TEMP%\07jvj3mhy0\nt6dismx86\folderprovider.dll
- %TEMP%\07jvj3mhy0\nt6dismx64\imagingprovider.dll
- %TEMP%\07jvj3mhy0\nt6dismx86\api-ms-win-downlevel-user32-l1-1-1.dll
- %TEMP%\07jvj3mhy0\nt6dismx64\api-ms-win-downlevel-user32-l1-1-1.dll
- %TEMP%\07jvj3mhy0\nt6dismx86\dism.exe
- %TEMP%\07jvj3mhy0\nt6dismx86\zh-cn\dismcore.dll.mui
- %TEMP%\07jvj3mhy0\tools\format_nt61.com
- %TEMP%\07jvj3mhy0\tools\format_nt62.com
- %TEMP%\07jvj3mhy0\tools\format_nt63.com
- %TEMP%\07jvj3mhy0\tools\ntdetect.com
- %TEMP%\07jvj3mhy0\download\id.dat
- %TEMP%\07jvj3mhy0\tools\bootmgfw.efi
- %TEMP%\07jvj3mhy0\tools\bootmgfw.efi.mui
- %TEMP%\07jvj3mhy0\tools\bootmgr.exe.mui
- %TEMP%\07jvj3mhy0\nt6dismx64\en-us\compatprovider.dll.mui
- %TEMP%\07jvj3mhy0\nt6dismx86\en-us\compatprovider.dll.mui
- %TEMP%\07jvj3mhy0\nt6dismx64\zh-cn\compatprovider.dll.mui
- %TEMP%\07jvj3mhy0\nt6dismx86\zh-cn\compatprovider.dll.mui
- %TEMP%\07jvj3mhy0\nt6dismx64\en-us\dism.exe.mui
- %TEMP%\07jvj3mhy0\nt6dismx86\en-us\dism.exe.mui
- %TEMP%\07jvj3mhy0\nt6dismx64\zh-cn\dism.exe.mui
- %TEMP%\07jvj3mhy0\nt6dismx86\zh-cn\dism.exe.mui
- %TEMP%\07jvj3mhy0\nt6dismx64\en-us\dismapi.dll.mui
- %TEMP%\07jvj3mhy0\nt6dismx86\en-us\dismapi.dll.mui
- %TEMP%\07jvj3mhy0\nt6dismx64\zh-cn\dismapi.dll.mui
- %TEMP%\07jvj3mhy0\nt6dismx86\zh-cn\dismapi.dll.mui
- %TEMP%\07jvj3mhy0\nt6dismx64\en-us\dismcore.dll.mui
- %TEMP%\07jvj3mhy0\tools\format_nt5.com
- %TEMP%\07jvj3mhy0\nt6dismx86\en-us\dismcore.dll.mui
- %TEMP%\07jvj3mhy0\tools\format64_nt63.com
- %TEMP%\07jvj3mhy0\tools\format64_nt61.com
- %TEMP%\07jvj3mhy0\7z.dll
- %TEMP%\07jvj3mhy0\init.log
- %TEMP%\07jvj3mhy0\tools\bcd
- %TEMP%\07jvj3mhy0\tools\bootmgr
- %TEMP%\07jvj3mhy0\tools\ntldr
- %TEMP%\07jvj3mhy0\tools\waldr
- %TEMP%\07jvj3mhy0\tools\bootfont.bin
- C:\users\public\desktop\一键安装系统.lnk
- %ALLUSERSPROFILE%\microsoft\windows\start menu\一键安装系统.lnk
- %TEMP%\07jvj3mhy0\tools\oem_unattend_win10x64.xml
- %TEMP%\07jvj3mhy0\tools\oem_unattend_win10x86.xml
- %TEMP%\07jvj3mhy0\tools\oem_unattend_win7x64.xml
- %TEMP%\07jvj3mhy0\tools\oem_unattend_win7x86.xml
- %TEMP%\07jvj3mhy0\tools\oem_unattend_win8x64.xml
- %TEMP%\07jvj3mhy0\tools\oem_unattend_win8x86.xml
- %TEMP%\07jvj3mhy0\tools\unattend_win10x64.xml
- %TEMP%\07jvj3mhy0\tools\unattend_win10x86.xml
- %TEMP%\07jvj3mhy0\tools\unattend_win7x64.xml
- %TEMP%\07jvj3mhy0\tools\unattend_win7x86.xml
- %TEMP%\07jvj3mhy0\tools\unattend_win8x64.xml
- %TEMP%\07jvj3mhy0\tools\unattend_win8x86.xml
- %TEMP%\07jvj3mhy0\tools\format64_nt62.com
- %TEMP%\07jvj3mhy0\nt6dismx86\zh-cn\vhdprovider.dll.mui
- %TEMP%\07jvj3mhy0\tools\devconnt6x86.exe
- %TEMP%\07jvj3mhy0\nt6dismx64\en-us\dismprov.dll.mui
- %TEMP%\07jvj3mhy0\nt6dismx64\zh-cn\wimgapi.dll.mui
- %TEMP%\07jvj3mhy0\nt6dismx86\zh-cn\wimgapi.dll.mui
- %TEMP%\07jvj3mhy0\nt6dismx64\en-us\wimprovider.dll.mui
- %TEMP%\07jvj3mhy0\nt6dismx86\en-us\wimprovider.dll.mui
- %TEMP%\07jvj3mhy0\nt6dismx64\zh-cn\wimprovider.dll.mui
- %TEMP%\07jvj3mhy0\nt6dismx86\zh-cn\wimprovider.dll.mui
- %TEMP%\07jvj3mhy0\nt6dismx86\dism.format.ps1xml
- %TEMP%\07jvj3mhy0\nt6dismx64\dism.format.ps1xml
- %TEMP%\07jvj3mhy0\nt6dismx86\dism.types.ps1xml
- %TEMP%\07jvj3mhy0\nt6dismx64\dism.types.ps1xml
- %TEMP%\07jvj3mhy0\nt6dismx86\dism.psd1
- %TEMP%\07jvj3mhy0\nt6dismx64\dism.psd1
- %TEMP%\07jvj3mhy0\nt6dismx86\dism.psm1
- %TEMP%\07jvj3mhy0\nt6dismx64\dism.psm1
- %TEMP%\07jvj3mhy0\tools\boot.sdi
- %TEMP%\07jvj3mhy0\tools\winnt.sif
- %TEMP%\07jvj3mhy0\tools\bcdboot.exe
- %TEMP%\07jvj3mhy0\tools\bcdedit.exe
- %TEMP%\07jvj3mhy0\tools\bootice.exe
- %TEMP%\07jvj3mhy0\tools\bootsect.exe
- %TEMP%\07jvj3mhy0\tools\devconnt6x64.exe
- %TEMP%\07jvj3mhy0\nt6dismx86\en-us\wimgapi.dll.mui
- %TEMP%\07jvj3mhy0\nt6dismx64\dism.exe
- %TEMP%\07jvj3mhy0\nt6dismx64\en-us\wimgapi.dll.mui
- %TEMP%\07jvj3mhy0\nt6dismx64\zh-cn\vhdprovider.dll.mui
- %TEMP%\07jvj3mhy0\nt6dismx86\en-us\dismprov.dll.mui
- %TEMP%\07jvj3mhy0\nt6dismx64\zh-cn\dismprov.dll.mui
- %TEMP%\07jvj3mhy0\nt6dismx86\zh-cn\dismprov.dll.mui
- %TEMP%\07jvj3mhy0\nt6dismx64\en-us\ffuprovider.dll.mui
- %TEMP%\07jvj3mhy0\nt6dismx86\en-us\ffuprovider.dll.mui
- %TEMP%\07jvj3mhy0\nt6dismx64\zh-cn\ffuprovider.dll.mui
- %TEMP%\07jvj3mhy0\nt6dismx86\zh-cn\ffuprovider.dll.mui
- %TEMP%\07jvj3mhy0\nt6dismx64\en-us\folderprovider.dll.mui
- %TEMP%\07jvj3mhy0\nt6dismx86\en-us\folderprovider.dll.mui
- %TEMP%\07jvj3mhy0\nt6dismx64\zh-cn\folderprovider.dll.mui
- %TEMP%\07jvj3mhy0\nt6dismx86\zh-cn\folderprovider.dll.mui
- %TEMP%\07jvj3mhy0\nt6dismx64\en-us\imagingprovider.dll.mui
- %TEMP%\07jvj3mhy0\nt6dismx86\en-us\imagingprovider.dll.mui
- %TEMP%\07jvj3mhy0\nt6dismx64\zh-cn\imagingprovider.dll.mui
- %TEMP%\07jvj3mhy0\nt6dismx86\zh-cn\imagingprovider.dll.mui
- %TEMP%\07jvj3mhy0\nt6dismx64\en-us\logprovider.dll.mui
- %TEMP%\07jvj3mhy0\nt6dismx86\en-us\logprovider.dll.mui
- %TEMP%\07jvj3mhy0\nt6dismx64\zh-cn\logprovider.dll.mui
- %TEMP%\07jvj3mhy0\nt6dismx86\zh-cn\logprovider.dll.mui
- %TEMP%\07jvj3mhy0\nt6dismx64\en-us\vhdprovider.dll.mui
- %TEMP%\07jvj3mhy0\nt6dismx86\en-us\vhdprovider.dll.mui
- %TEMP%\07jvj3mhy0\nt6dismx64\zh-cn\dismcore.dll.mui
- %WINDIR%\temp\udddaf3.tmp
Sets the 'hidden' attribute to the following files
- %TEMP%\07jvj3mhy0\tools\ntldr
- %TEMP%\07jvj3mhy0\tools\ntdetect.com
- D:\laoyou\softinfo.ini
Deletes the following files
- %WINDIR%\temp\udddaf3.tmp
Network activity
UDP
- DNS ASK zh#####i.newxitong.cn
- DNS ASK be#####.newxitong.cn
Miscellaneous
Creates and executes the following
- '%TEMP%\07jvj3mhy0\isocmd\isocmd.exe' -Install
- '%TEMP%\07jvj3mhy0\isocmd\isocmd.exe' -Number 1
- '%TEMP%\07jvj3mhy0\isocmd\isocmd.exe' -Print
- '%WINDIR%\syswow64\cmd.exe' /C ISOCmd -Install' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C ISOCmd -Number 1' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C ISOCmd -Print' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /C ISOCmd -Install
- '%WINDIR%\syswow64\cmd.exe' /C ISOCmd -Number 1
- '%WINDIR%\syswow64\cmd.exe' /C ISOCmd -Print
