Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKLM\SOFTWARE\Classes\NCH.PicoPDF.pdf\shell\open\command] '' = '"%ProgramFiles(x86)%\NCH Software\PicoPDF\picopdf.exe" "%L"'
- [HKLM\SOFTWARE\Classes\Applications\picopdf.exe\shell\open\command] '' = '"%ProgramFiles(x86)%\NCH Software\PicoPDF\picopdf.exe" "%L"'
- [HKCU\Software\Classes\cdofile\shell\open\command] '' = '"%ProgramFiles(x86)%\NCH Software\PicoPDF\picopdf.exe" -extfind Crescendo "%L"'
- [HKCU\Software\Classes\dfxfile\shell\open\command] '' = '"%ProgramFiles(x86)%\NCH Software\PicoPDF\picopdf.exe" -extfind DeskFX "%L"'
- [HKCU\Software\Classes\deprojfile\shell\open\command] '' = '"%ProgramFiles(x86)%\NCH Software\PicoPDF\picopdf.exe" -extfind Disketch "%L"'
- [HKCU\Software\Classes\drpfile\shell\open\command] '' = '"%ProgramFiles(x86)%\NCH Software\PicoPDF\picopdf.exe" -extfind DrawPad "%L"'
- [HKCU\Software\Classes\ddpfile\shell\open\command] '' = '"%ProgramFiles(x86)%\NCH Software\PicoPDF\picopdf.exe" -extfind DreamPlan "%L"'
- [HKCU\Software\Classes\apjfile\shell\open\command] '' = '"%ProgramFiles(x86)%\NCH Software\PicoPDF\picopdf.exe" -extfind ExpressAnimate "%L"'
- [HKCU\Software\Classes\nppfile\shell\open\command] '' = '"%ProgramFiles(x86)%\NCH Software\PicoPDF\picopdf.exe" -extfind ExpressPoints "%L"'
- [HKCU\Software\Classes\mpdpfile\shell\open\command] '' = '"%ProgramFiles(x86)%\NCH Software\PicoPDF\picopdf.exe" -extfind MixPad "%L"'
- [HKCU\Software\Classes\dctfile\shell\open\command] '' = '"%ProgramFiles(x86)%\NCH Software\PicoPDF\picopdf.exe" -extfind Scribe "%L"'
- [HKCU\Software\Classes\dssfile\shell\open\command] '' = '"%ProgramFiles(x86)%\NCH Software\PicoPDF\picopdf.exe" -extfind Scribe "%L"'
- [HKCU\Software\Classes\ds2file\shell\open\command] '' = '"%ProgramFiles(x86)%\NCH Software\PicoPDF\picopdf.exe" -extfind Scribe "%L"'
- [HKCU\Software\Classes\vpjfile\shell\open\command] '' = '"%ProgramFiles(x86)%\NCH Software\PicoPDF\picopdf.exe" -extfind VideoPad "%L"'
- [HKCU\Software\Classes\spjfile\shell\open\command] '' = '"%ProgramFiles(x86)%\NCH Software\PicoPDF\picopdf.exe" -extfind PhotoStage "%L"'
Creates or modifies the following files
- <SYSTEM32>\tasks\nch software\picopdfsevendays
Modifies file system
Creates the following files
- %TEMP%\aut738a.tmp
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\nch software suite\invoice software.lnk
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\nch software suite\video file converter.lnk
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\nch software suite\slideshow software.lnk
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\nch software suite\multitrack recording software.lnk
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\nch software suite\accounting software.lnk
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\nch software suite\transcription software.lnk
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\nch software suite\express burn cd, dvd or blu-ray.lnk
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\nch software suite\photo editing software.lnk
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\nch software suite\house design software.lnk
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\nch software suite\doxillion document converter.lnk
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\nch software suite\zip program.lnk
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\nch software suite\text expander software.lnk
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\nch software suite\classic ftp software.lnk
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\nch software suite\image file converter.lnk
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\nch software suite\diagram and flowchart software.lnk
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\nch software suite\audio file converter.lnk
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\nch software suite\video capture software.lnk
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\nch software suite\audio editing software.lnk
- %TEMP%\aut8066.tmp
- %TEMP%\softtrack\setup.exe
- %TEMP%\n1s\nchsetup.cab
- %TEMP%\n1s\nchsetup.exe
- %TEMP%\n1s\nchdata.cab
- %TEMP%\n1s\nchdata.dat
- %TEMP%\softtrack\vidbanner.mp4
- %ProgramFiles(x86)%\nch software\picopdf\picopdf.exe
- %ProgramFiles(x86)%\nch software\picopdf\shellmenua.msix
- %ProgramFiles(x86)%\nch software\picopdf\shellmenub.msix
- C:\users\public\desktop\nch suite.lnk
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\picopdf pdf editor.lnk
- C:\users\public\desktop\picopdf pdf editor.lnk
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\nch software suite\video editing software.lnk
- %ProgramFiles(x86)%\nch software\picopdf\shellmenu.dll
- %HOMEPATH%\favorites\nch software download site.lnk
- %ProgramFiles(x86)%\nch software\picopdf\picopdfsetup_v6.16.exe
Deletes the following files
- %TEMP%\aut738a.tmp
- %TEMP%\aut8066.tmp
- %TEMP%\n1s\nchdata.cab
- %TEMP%\n1s\nchsetup.exe
- %TEMP%\n1s\nchdata.dat
- %TEMP%\n1s\nchsetup.cab
- %TEMP%\softtrack\setup.exe
- %TEMP%\softtrack\vidbanner.mp4
Modifies the following files
- %LOCALAPPDATA%\microsoft\media player\currentdatabase_372.wmdb
Modifies the HOSTS file.
Network activity
Connects to
- 'localhost':443
Miscellaneous
Searches for the following windows
- ClassName: 'WMPlayerApp' WindowName: ''
- ClassName: 'NCHSoftware_InstanceWindow' WindowName: 'PicoPDF'
- ClassName: 'NCHSoftware_InstanceChain' WindowName: 'PicoPDF'
- ClassName: 'NCHSoftware_InstanceInst' WindowName: 'PicoPDF'
- ClassName: 'NCHSoftware_InstanceBoot' WindowName: 'PicoPDF'
- ClassName: 'BUTTON' WindowName: ''
Creates and executes the following
- '%TEMP%\softtrack\setup.exe' -LQUIET
- '%TEMP%\n1s\nchsetup.exe' -installer "%TEMP%\softtrack\setup.exe" -instdata "%TEMP%\n1s\nchdata.dat"
- '%ProgramFiles(x86)%\nch software\picopdf\picopdf.exe' -installsched
