Technical Information
To ensure autorun and distribution
Sets the following service settings
- [HKLM\System\CurrentControlSet\Services\Eurofighter Typhoon Game 10.8.45] 'Start' = '00000002'
- [HKLM\System\CurrentControlSet\Services\Eurofighter Typhoon Game 10.8.45] 'ImagePath' = '%ALLUSERSPROFILE%\Eurofighter Typhoon Game 10.8.45\Eurofighter Typhoon Game 10.8.45.exe'
Creates the following services
- 'Eurofighter Typhoon Game 10.8.45' %ALLUSERSPROFILE%\Eurofighter Typhoon Game 10.8.45\Eurofighter Typhoon Game 10.8.45.exe
Modifies file system
Creates the following files
- %TEMP%\is-1bnk3.tmp\is-mttl6.tmp
- %LOCALAPPDATA%\raff txt to sub\is-4jjta.tmp
- %LOCALAPPDATA%\raff txt to sub\is-bqce6.tmp
- %LOCALAPPDATA%\raff txt to sub\is-4h6ps.tmp
- %LOCALAPPDATA%\raff txt to sub\is-ibh8k.tmp
- %LOCALAPPDATA%\raff txt to sub\is-hkenk.tmp
- %LOCALAPPDATA%\raff txt to sub\is-j8nsq.tmp
- %LOCALAPPDATA%\raff txt to sub\is-sh7jk.tmp
- %LOCALAPPDATA%\raff txt to sub\is-krq6c.tmp
- %LOCALAPPDATA%\raff txt to sub\is-9mqpv.tmp
- %LOCALAPPDATA%\raff txt to sub\is-2lvnu.tmp
- %LOCALAPPDATA%\raff txt to sub\is-7rt8k.tmp
- %LOCALAPPDATA%\raff txt to sub\uninstall\unins000.dat
- %LOCALAPPDATA%\raff txt to sub\txttosub.exe
- %ALLUSERSPROFILE%\eurofighter typhoon game 10.8.45\eurofighter typhoon game 10.8.45.exe
- %ALLUSERSPROFILE%\eu108it45.dat
- %LOCALAPPDATA%\raff txt to sub\is-djqs1.tmp
- %LOCALAPPDATA%\raff txt to sub\is-9dqnl.tmp
- %LOCALAPPDATA%\raff txt to sub\is-4a3eb.tmp
- %LOCALAPPDATA%\raff txt to sub\is-njmlu.tmp
- %LOCALAPPDATA%\raff txt to sub\is-iomhg.tmp
- %TEMP%\is-uj1rj.tmp\_isetup\_setup64.tmp
- %TEMP%\is-uj1rj.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-uj1rj.tmp\_isetup\_iscrypt.dll
- %LOCALAPPDATA%\raff txt to sub\uninstall\is-flbpt.tmp
- %LOCALAPPDATA%\raff txt to sub\is-j9bpn.tmp
- %LOCALAPPDATA%\raff txt to sub\is-77r21.tmp
- %LOCALAPPDATA%\raff txt to sub\is-0lrps.tmp
- %TEMP%\is-uj1rj.tmp\_isetup\_regdll.tmp
- %LOCALAPPDATA%\raff txt to sub\is-iudob.tmp
- %LOCALAPPDATA%\raff txt to sub\is-fpmp2.tmp
- %LOCALAPPDATA%\raff txt to sub\is-qc1nu.tmp
- %LOCALAPPDATA%\raff txt to sub\is-k8k5k.tmp
- %LOCALAPPDATA%\raff txt to sub\is-hn2a8.tmp
- %LOCALAPPDATA%\raff txt to sub\is-75b2o.tmp
- %LOCALAPPDATA%\raff txt to sub\is-kk93g.tmp
- %LOCALAPPDATA%\raff txt to sub\is-vj26f.tmp
- %LOCALAPPDATA%\raff txt to sub\is-n4mku.tmp
- %ALLUSERSPROFILE%\eu108resa.dat
- %ALLUSERSPROFILE%\eu108resb.dat
Moves the following files
- from %LOCALAPPDATA%\raff txt to sub\uninstall\is-flbpt.tmp to %LOCALAPPDATA%\raff txt to sub\uninstall\unins000.exe
- from %LOCALAPPDATA%\raff txt to sub\is-9dqnl.tmp to %LOCALAPPDATA%\raff txt to sub\libwinpthread-1.dll
- from %LOCALAPPDATA%\raff txt to sub\is-djqs1.tmp to %LOCALAPPDATA%\raff txt to sub\libtiff-5.dll
- from %LOCALAPPDATA%\raff txt to sub\is-9mqpv.tmp to %LOCALAPPDATA%\raff txt to sub\libsigc-2.0-0.dll
- from %LOCALAPPDATA%\raff txt to sub\is-j8nsq.tmp to %LOCALAPPDATA%\raff txt to sub\librsvg-2-2.dll
- from %LOCALAPPDATA%\raff txt to sub\is-hkenk.tmp to %LOCALAPPDATA%\raff txt to sub\libpng16-16.dll
- from %LOCALAPPDATA%\raff txt to sub\is-ibh8k.tmp to %LOCALAPPDATA%\raff txt to sub\libpixman-1-0.dll
- from %LOCALAPPDATA%\raff txt to sub\is-4h6ps.tmp to %LOCALAPPDATA%\raff txt to sub\libpcre-1.dll
- from %LOCALAPPDATA%\raff txt to sub\is-bqce6.tmp to %LOCALAPPDATA%\raff txt to sub\libpangowin32-1.0-0.dll
- from %LOCALAPPDATA%\raff txt to sub\is-4jjta.tmp to %LOCALAPPDATA%\raff txt to sub\libpangomm-1.4-1.dll
- from %LOCALAPPDATA%\raff txt to sub\is-krq6c.tmp to %LOCALAPPDATA%\raff txt to sub\libpangoft2-1.0-0.dll
- from %LOCALAPPDATA%\raff txt to sub\is-sh7jk.tmp to %LOCALAPPDATA%\raff txt to sub\libpangocairo-1.0-0.dll
- from %LOCALAPPDATA%\raff txt to sub\is-4a3eb.tmp to %LOCALAPPDATA%\raff txt to sub\libpango-1.0-0.dll
- from %LOCALAPPDATA%\raff txt to sub\is-2lvnu.tmp to %LOCALAPPDATA%\raff txt to sub\zlib1.dll
- from %LOCALAPPDATA%\raff txt to sub\is-njmlu.tmp to %LOCALAPPDATA%\raff txt to sub\liblzma-5.dll
- from %LOCALAPPDATA%\raff txt to sub\is-vj26f.tmp to %LOCALAPPDATA%\raff txt to sub\libjpeg-8.dll
- from %LOCALAPPDATA%\raff txt to sub\is-kk93g.tmp to %LOCALAPPDATA%\raff txt to sub\libintl-8.dll
- from %LOCALAPPDATA%\raff txt to sub\is-75b2o.tmp to %LOCALAPPDATA%\raff txt to sub\libharfbuzz-0.dll
- from %LOCALAPPDATA%\raff txt to sub\is-hn2a8.tmp to %LOCALAPPDATA%\raff txt to sub\libgraphite2.dll
- from %LOCALAPPDATA%\raff txt to sub\is-k8k5k.tmp to %LOCALAPPDATA%\raff txt to sub\libgomp-1.dll
- from %LOCALAPPDATA%\raff txt to sub\is-qc1nu.tmp to %LOCALAPPDATA%\raff txt to sub\libgobject-2.0-0.dll
- from %LOCALAPPDATA%\raff txt to sub\is-fpmp2.tmp to %LOCALAPPDATA%\raff txt to sub\libgmodule-2.0-0.dll
- from %LOCALAPPDATA%\raff txt to sub\is-n4mku.tmp to %LOCALAPPDATA%\raff txt to sub\libglibmm-2.4-1.dll
- from %LOCALAPPDATA%\raff txt to sub\is-iudob.tmp to %LOCALAPPDATA%\raff txt to sub\libgdk_pixbuf-2.0-0.dll
- from %LOCALAPPDATA%\raff txt to sub\is-0lrps.tmp to %LOCALAPPDATA%\raff txt to sub\libgdkmm-2.4-1.dll
- from %LOCALAPPDATA%\raff txt to sub\is-77r21.tmp to %LOCALAPPDATA%\raff txt to sub\libgdk-win32-2.0-0.dll
- from %LOCALAPPDATA%\raff txt to sub\is-j9bpn.tmp to %LOCALAPPDATA%\raff txt to sub\libgcc_s_dw2-1.dll
- from %LOCALAPPDATA%\raff txt to sub\is-iomhg.tmp to %LOCALAPPDATA%\raff txt to sub\liblcms2-2.dll
- from %LOCALAPPDATA%\raff txt to sub\is-7rt8k.tmp to %LOCALAPPDATA%\raff txt to sub\txttosub.exe
Miscellaneous
Searches for the following windows
- ClassName: 'Pe1929_euBox1081_Pe1929' WindowName: ''
Creates and executes the following
- '%TEMP%\is-1bnk3.tmp\is-mttl6.tmp' /SL4 $90178 "<Full path to file>" 3807541 52224
- '%LOCALAPPDATA%\raff txt to sub\txttosub.exe' -i
