Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce] 'wextract_cleanup0' = 'rundll32.exe <SYSTEM32>\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP000.TMP\"'
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\NPWService] 'Start' = '00000002'
- [<HKLM>\SYSTEM\ControlSet001\Services\NPWService] 'ImagePath' = '%ProgramFiles%\Generic\USB Server\NPW\NPWService.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\EST_BusEnum] 'ImagePath' = 'system32\DRIVERS\GenBus.sys'
- [<HKLM>\SYSTEM\ControlSet001\Services\NUS_Bus] 'ImagePath' = 'system32\DRIVERS\NUS_Bus.sys'
Malicious functions:
To bypass firewall, removes or modifies the following registry keys:
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%ProgramFiles%\Generic\USB Server\NPW\NPWService.exe' = '%ProgramFiles...
Modifies file system:
Creates the following files:
- %WINDIR%\Installer\{47CD5F8A-010C-4DBC-8D49-D23FE667A0A6}\1033.MST
- %WINDIR%\Installer\{47CD5F8A-010C-4DBC-8D49-D23FE667A0A6}\NetworkPrinterWiza_B75866F076DE4736899595701807BE8A.exe
- %ProgramFiles%\InstallShield Installation Information\{47CD5F8A-010C-4DBC-8D49-D23FE667A0A6}\ISSef274.rra
- %ProgramFiles%\InstallShield Installation Information\{47CD5F8A-010C-4DBC-8D49-D23FE667A0A6}\setuf216.rra
- %WINDIR%\Installer\{47CD5F8A-010C-4DBC-8D49-D23FE667A0A6}\NetworkPrinterWiza_88F0CF48B6F64115A97503804CB894F8.exe
- %WINDIR%\Installer\{47CD5F8A-010C-4DBC-8D49-D23FE667A0A6}\ARPPRODUCTICON.exe
- %WINDIR%\Installer\2b5dd.msi
- %WINDIR%\Installer\{47CD5F8A-010C-4DBC-8D49-D23FE667A0A6}\USBServer.exe1_A1FF9A2BB70D4036BB33D6A1CCE9AF7E.exe
- %WINDIR%\Installer\{47CD5F8A-010C-4DBC-8D49-D23FE667A0A6}\USBServer.exe_7E04ABDDC6E14EE6963B1D5726CD5D85.exe
- %ProgramFiles%\InstallShield Installation Information\{47CD5F8A-010C-4DBC-8D49-D23FE667A0A6}\1033f64d.rra
- %ProgramFiles%\InstallShield Installation Information\{47CD5F8A-010C-4DBC-8D49-D23FE667A0A6}\0x04f62d.rra
- %ProgramFiles%\InstallShield Installation Information\{47CD5F8A-010C-4DBC-8D49-D23FE667A0A6}\1036.mst
- %ProgramFiles%\InstallShield Installation Information\{47CD5F8A-010C-4DBC-8D49-D23FE667A0A6}\0x04f66c.rra
- %ProgramFiles%\InstallShield Installation Information\{47CD5F8A-010C-4DBC-8D49-D23FE667A0A6}\1028.mst
- %ProgramFiles%\InstallShield Installation Information\{47CD5F8A-010C-4DBC-8D49-D23FE667A0A6}\0x08f459.rra
- %ProgramFiles%\InstallShield Installation Information\{47CD5F8A-010C-4DBC-8D49-D23FE667A0A6}\setuf41a.rra
- %ProgramFiles%\InstallShield Installation Information\{47CD5F8A-010C-4DBC-8D49-D23FE667A0A6}\0x04f533.rra
- %ProgramFiles%\InstallShield Installation Information\{47CD5F8A-010C-4DBC-8D49-D23FE667A0A6}\2052.mst
- %ALLUSERSPROFILE%\Desktop\Launch Network Printer Wizard.lnk
- %ProgramFiles%\Generic\USB Server\DCPDLL.dll
- <SYSTEM32>\NPWxfer.dll
- %ProgramFiles%\Generic\USB Server\NPW\NetworkPrinterWizard.exe
- %ProgramFiles%\Generic\USB Server\Driver\DIFxCmd.exe
- %ProgramFiles%\Generic\USB Server\Driver\NUServer.inf
- %ProgramFiles%\Generic\USB Server\Driver\GenBus.sys
- %ProgramFiles%\Generic\USB Server\Driver\GenBus.cat
- %ProgramFiles%\Generic\USB Server\Driver\NUServer.cat
- %ProgramFiles%\Generic\USB Server\Driver\GenHC.sys
- %ALLUSERSPROFILE%\Start Menu\Programs\Generic\USB Server\Launch USB Server.lnk
- %ProgramFiles%\Generic\USB Server\NPW\NPWprint.dll
- %ALLUSERSPROFILE%\Desktop\Launch USB Server.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\Generic\USB Server\Launch Network Printer Wizard.lnk
- %ProgramFiles%\Generic\USB Server\NPW\NPWdcp.dll
- %ProgramFiles%\Generic\USB Server\NPW\NPWuntp.dll
- %ProgramFiles%\Generic\USB Server\NPW\NPWService.exe
- %ProgramFiles%\Generic\USB Server\NPW\NPWlog.dll
- %ProgramFiles%\Generic\USB Server\NPW\NPWpsm.dll
- %ProgramFiles%\InstallShield Installation Information\{47CD5F8A-010C-4DBC-8D49-D23FE667A0A6}\0x04f737.rra
- %WINDIR%\inf\oem3.PNF
- %WINDIR%\inf\oem3.inf
- %WINDIR%\LastGood\TMPC.tmp
- <SYSTEM32>\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\nus_bus.CAT
- <SYSTEM32>\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\oem3.CAT
- %WINDIR%\Temp\OLD8.tmp
- %WINDIR%\LastGood\TMP7.tmp
- %WINDIR%\inf\genbus.PNF
- <DRIVERS>\SET9.tmp
- <SYSTEM32>\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\oem4.CAT
- <SYSTEM32>\DRVSTORE\NUServer_A679E6DC5D9CC31CB182E04274B90E1891713B36\NUServer.sys
- %WINDIR%\inf\oem4.PNF
- %WINDIR%\inf\oem4.inf
- <SYSTEM32>\DRVSTORE\NUServer_A679E6DC5D9CC31CB182E04274B90E1891713B36\NUServer.cat
- <DRIVERS>\SETE.tmp
- %WINDIR%\Temp\OLDD.tmp
- <SYSTEM32>\DRVSTORE\NUServer_A679E6DC5D9CC31CB182E04274B90E1891713B36\NUServer.inf
- %WINDIR%\inf\nus_bus.PNF
- <SYSTEM32>\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\genbus.CAT
- %ProgramFiles%\InstallShield Installation Information\{47CD5F8A-010C-4DBC-8D49-D23FE667A0A6}\1045.mst
- %ProgramFiles%\InstallShield Installation Information\{47CD5F8A-010C-4DBC-8D49-D23FE667A0A6}\0x04f9d7.rra
- %ProgramFiles%\InstallShield Installation Information\{47CD5F8A-010C-4DBC-8D49-D23FE667A0A6}\2070.mst
- %ProgramFiles%\InstallShield Installation Information\{47CD5F8A-010C-4DBC-8D49-D23FE667A0A6}\0x08fac1.rra
- %ProgramFiles%\InstallShield Installation Information\{47CD5F8A-010C-4DBC-8D49-D23FE667A0A6}\1041.mst
- %ProgramFiles%\InstallShield Installation Information\{47CD5F8A-010C-4DBC-8D49-D23FE667A0A6}\0x04f821.rra
- %ProgramFiles%\InstallShield Installation Information\{47CD5F8A-010C-4DBC-8D49-D23FE667A0A6}\1031.mst
- %ProgramFiles%\InstallShield Installation Information\{47CD5F8A-010C-4DBC-8D49-D23FE667A0A6}\0x04f90c.rra
- %ProgramFiles%\InstallShield Installation Information\{47CD5F8A-010C-4DBC-8D49-D23FE667A0A6}\1040.mst
- <SYSTEM32>\DRVSTORE\GenHC_AF3BDE5753269D005AA19F53855B02E88913C467\GenHC.inf
- %TEMP%\271cc.mst
- <SYSTEM32>\DRVSTORE\GenHC_AF3BDE5753269D005AA19F53855B02E88913C467\GenHC.sys
- <SYSTEM32>\DRVSTORE\GenHC_AF3BDE5753269D005AA19F53855B02E88913C467\GenHC.cat
- %ProgramFiles%\InstallShield Installation Information\{47CD5F8A-010C-4DBC-8D49-D23FE667A0A6}\setup.ini
- %ProgramFiles%\InstallShield Installation Information\{47CD5F8A-010C-4DBC-8D49-D23FE667A0A6}\1049.mst
- %ProgramFiles%\InstallShield Installation Information\{47CD5F8A-010C-4DBC-8D49-D23FE667A0A6}\0x04fbbb.rra
- %ProgramFiles%\InstallShield Installation Information\{47CD5F8A-010C-4DBC-8D49-D23FE667A0A6}\1034.mst
- %ProgramFiles%\InstallShield Installation Information\{47CD5F8A-010C-4DBC-8D49-D23FE667A0A6}\0x04fe4b.rra
- %ProgramFiles%\Generic\USB Server\Driver\GenHC.inf
- %TEMP%\{56964B04-612B-400A-B8F6-5C13430A4F7D}\String1033.txt
- %TEMP%\{56964B04-612B-400A-B8F6-5C13430A4F7D}\_isres.dll
- %TEMP%\MSI2.tmp
- %TEMP%\{56964B04-612B-400A-B8F6-5C13430A4F7D}\_isuser.dll
- %TEMP%\{56964B04-612B-400A-B8F6-5C13430A4F7D}\setup.exe
- %TEMP%\{AFDE6D41-2100-46C1-B4F9-FB3D962CF67E}\ISSetup.dll
- %TEMP%\{AFDE6D41-2100-46C1-B4F9-FB3D962CF67E}\USB Server.msi
- %TEMP%\{56964B04-612B-400A-B8F6-5C13430A4F7D}\ISRT.dll
- %TEMP%\{56964B04-612B-400A-B8F6-5C13430A4F7D}\setup.inx
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-21-2052111302-484763869-725345543-1003
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-20
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_.DEFAULT
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-21-2052111302-484763869-725345543-1003
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-20
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-18
- %TEMP%\75d2.rra
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-19
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-19
- %TEMP%\{AFDE6D41-2100-46C1-B4F9-FB3D962CF67E}\1033.MST
- %TEMP%\{AFDE6D41-2100-46C1-B4F9-FB3D962CF67E}\0x0804.ini
- %TEMP%\{AFDE6D41-2100-46C1-B4F9-FB3D962CF67E}\_ISMSIDEL.INI
- %TEMP%\{AFDE6D41-2100-46C1-B4F9-FB3D962CF67E}\0x0409.ini
- %TEMP%\{AFDE6D41-2100-46C1-B4F9-FB3D962CF67E}\0x0404.ini
- %TEMP%\{AFDE6D41-2100-46C1-B4F9-FB3D962CF67E}\Setup.INI
- %TEMP%\IXP000.TMP\VS64_Setup.exe
- %TEMP%\IXP000.TMP\Install.exe
- %TEMP%\IXP000.TMP\XP_VS_Setup.exe
- %TEMP%\IXP000.TMP\XP64_Setup.exe
- %TEMP%\{AFDE6D41-2100-46C1-B4F9-FB3D962CF67E}\0x0419.ini
- %TEMP%\{AFDE6D41-2100-46C1-B4F9-FB3D962CF67E}\0x0816.ini
- %TEMP%\~1.tmp
- %TEMP%\{AFDE6D41-2100-46C1-B4F9-FB3D962CF67E}\0x040a.ini
- %TEMP%\{AFDE6D41-2100-46C1-B4F9-FB3D962CF67E}\0x0415.ini
- %TEMP%\{AFDE6D41-2100-46C1-B4F9-FB3D962CF67E}\0x0407.ini
- %TEMP%\{AFDE6D41-2100-46C1-B4F9-FB3D962CF67E}\0x040c.ini
- %TEMP%\{AFDE6D41-2100-46C1-B4F9-FB3D962CF67E}\0x0411.ini
- %TEMP%\{AFDE6D41-2100-46C1-B4F9-FB3D962CF67E}\0x0410.ini
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SECURITY
- %WINDIR%\inf\GenBus.cat
- %WINDIR%\inf\GenBus.inf
- %WINDIR%\inf\NUS_Bus.inf
- %WINDIR%\inf\NUS_Bus.cat
- <DRIVERS>\NUS_Bus.sys
- %ProgramFiles%\Generic\USB Server\USBServer.exe
- <SYSTEM32>\DIFxAPI.dll
- <DRIVERS>\GenBus.sys
- %ProgramFiles%\Generic\USB Server\PSMDLL.dll
- %ProgramFiles%\Generic\USB Server\Driver\NUServer.sys
- %ProgramFiles%\Generic\USB Server\Driver\NUS_Bus.inf
- %ProgramFiles%\Generic\USB Server\Driver\NUS_Bus.cat
- %ProgramFiles%\Generic\USB Server\Driver\GenBus.inf
- %ProgramFiles%\Generic\USB Server\Driver\NUS_Bus.sys
- %ProgramFiles%\Generic\USB Server\UNTPDLL.dll
- %ProgramFiles%\Generic\USB Server\Driver\DrvSetup.exe
- %ProgramFiles%\Generic\USB Server\Driver\GenHC.cat
- %ProgramFiles%\Generic\USB Server\ESTLogDLL.dll
- C:\Config.Msi\2b5dc.rbs
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\INDEX.BTR
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\$WinMgmt.CFG
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING.VER
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\INDEX.MAP
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\domain.txt
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SYSTEM
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SOFTWARE
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\ComDb.Dat
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SAM
- %WINDIR%\Installer\MSI3.tmp
- %WINDIR%\Installer\2b5da.mst
- %WINDIR%\Installer\MSI4.tmp
- %WINDIR%\Installer\2b5db.ipi
- %WINDIR%\Installer\2b5d9.msi
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING2.MAP
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING1.MAP
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\OBJECTS.MAP
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\OBJECTS.DATA
Sets the 'hidden' attribute to the following files:
- <SYSTEM32>\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\nus_bus.CAT
- <SYSTEM32>\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\oem4.CAT
- <SYSTEM32>\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\genbus.CAT
- <SYSTEM32>\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\oem3.CAT
Deletes the following files:
- %WINDIR%\Installer\2b5db.ipi
- %WINDIR%\Installer\2b5d9.msi
- %WINDIR%\Installer\2b5da.mst
- <DRIVERS>\GenBus.sys
- %WINDIR%\Temp\OLDD.tmp
- <DRIVERS>\NUS_Bus.sys
- %WINDIR%\Temp\OLD8.tmp
- C:\Config.Msi\2b5dc.rbs
- %TEMP%\IXP000.TMP\VS64_Setup.exe
- %TEMP%\IXP000.TMP\XP64_Setup.exe
- %TEMP%\~1.tmp
- %TEMP%\IXP000.TMP\Install.exe
- %WINDIR%\Installer\MSI4.tmp
- %WINDIR%\Installer\MSI3.tmp
- %TEMP%\MSI2.tmp
Moves the following files:
- from %ProgramFiles%\InstallShield Installation Information\{47CD5F8A-010C-4DBC-8D49-D23FE667A0A6}\0x04f9d7.rra to %ProgramFiles%\InstallShield Installation Information\{47CD5F8A-010C-4DBC-8D49-D23FE667A0A6}\0x0415.ini
- from %ProgramFiles%\InstallShield Installation Information\{47CD5F8A-010C-4DBC-8D49-D23FE667A0A6}\0x08fac1.rra to %ProgramFiles%\InstallShield Installation Information\{47CD5F8A-010C-4DBC-8D49-D23FE667A0A6}\0x0816.ini
- from %ProgramFiles%\InstallShield Installation Information\{47CD5F8A-010C-4DBC-8D49-D23FE667A0A6}\0x04f821.rra to %ProgramFiles%\InstallShield Installation Information\{47CD5F8A-010C-4DBC-8D49-D23FE667A0A6}\0x0410.ini
- from %ProgramFiles%\InstallShield Installation Information\{47CD5F8A-010C-4DBC-8D49-D23FE667A0A6}\0x04f90c.rra to %ProgramFiles%\InstallShield Installation Information\{47CD5F8A-010C-4DBC-8D49-D23FE667A0A6}\0x0411.ini
- from %WINDIR%\LastGood\TMP7.tmp to %WINDIR%\LastGood\system32\DRIVERS\GenBus.sys
- from %WINDIR%\LastGood\TMPC.tmp to %WINDIR%\LastGood\system32\DRIVERS\NUS_Bus.sys
- from %ProgramFiles%\InstallShield Installation Information\{47CD5F8A-010C-4DBC-8D49-D23FE667A0A6}\0x04fbbb.rra to %ProgramFiles%\InstallShield Installation Information\{47CD5F8A-010C-4DBC-8D49-D23FE667A0A6}\0x0419.ini
- from %ProgramFiles%\InstallShield Installation Information\{47CD5F8A-010C-4DBC-8D49-D23FE667A0A6}\0x04fe4b.rra to %ProgramFiles%\InstallShield Installation Information\{47CD5F8A-010C-4DBC-8D49-D23FE667A0A6}\0x040a.ini
- from %ProgramFiles%\InstallShield Installation Information\{47CD5F8A-010C-4DBC-8D49-D23FE667A0A6}\0x04f737.rra to %ProgramFiles%\InstallShield Installation Information\{47CD5F8A-010C-4DBC-8D49-D23FE667A0A6}\0x0407.ini
- from %ProgramFiles%\InstallShield Installation Information\{47CD5F8A-010C-4DBC-8D49-D23FE667A0A6}\setuf41a.rra to %ProgramFiles%\InstallShield Installation Information\{47CD5F8A-010C-4DBC-8D49-D23FE667A0A6}\setup.ini
- from %ProgramFiles%\InstallShield Installation Information\{47CD5F8A-010C-4DBC-8D49-D23FE667A0A6}\0x08f459.rra to %ProgramFiles%\InstallShield Installation Information\{47CD5F8A-010C-4DBC-8D49-D23FE667A0A6}\0x0804.ini
- from %ProgramFiles%\InstallShield Installation Information\{47CD5F8A-010C-4DBC-8D49-D23FE667A0A6}\setuf216.rra to %ProgramFiles%\InstallShield Installation Information\{47CD5F8A-010C-4DBC-8D49-D23FE667A0A6}\setup.exe
- from %ProgramFiles%\InstallShield Installation Information\{47CD5F8A-010C-4DBC-8D49-D23FE667A0A6}\ISSef274.rra to %ProgramFiles%\InstallShield Installation Information\{47CD5F8A-010C-4DBC-8D49-D23FE667A0A6}\ISSetup.dll
- from %ProgramFiles%\InstallShield Installation Information\{47CD5F8A-010C-4DBC-8D49-D23FE667A0A6}\1033f64d.rra to %ProgramFiles%\InstallShield Installation Information\{47CD5F8A-010C-4DBC-8D49-D23FE667A0A6}\1033.mst
- from %ProgramFiles%\InstallShield Installation Information\{47CD5F8A-010C-4DBC-8D49-D23FE667A0A6}\0x04f66c.rra to %ProgramFiles%\InstallShield Installation Information\{47CD5F8A-010C-4DBC-8D49-D23FE667A0A6}\0x040c.ini
- from %ProgramFiles%\InstallShield Installation Information\{47CD5F8A-010C-4DBC-8D49-D23FE667A0A6}\0x04f533.rra to %ProgramFiles%\InstallShield Installation Information\{47CD5F8A-010C-4DBC-8D49-D23FE667A0A6}\0x0404.ini
- from %ProgramFiles%\InstallShield Installation Information\{47CD5F8A-010C-4DBC-8D49-D23FE667A0A6}\0x04f62d.rra to %ProgramFiles%\InstallShield Installation Information\{47CD5F8A-010C-4DBC-8D49-D23FE667A0A6}\0x0409.ini
Substitutes the following files:
- <DRIVERS>\NUS_Bus.sys
- <DRIVERS>\GenBus.sys
Network activity:
UDP:
- '25#.#55.255.255':52330
Miscellaneous:
Creates and executes the following:
- '%ProgramFiles%\Generic\USB Server\Driver\DIFxCmd.exe' /p Driver\NUServer.inf 16
- '%ProgramFiles%\Generic\USB Server\Driver\DrvSetup.exe' install Driver\NUS_Bus.inf root\NUS_Bus 16
- '%ProgramFiles%\Generic\USB Server\Driver\DIFxCmd.exe' /i Driver\NUServer.inf 16
- '%ProgramFiles%\Generic\USB Server\NPW\NPWService.exe'
- '%ProgramFiles%\Generic\USB Server\NPW\NPWService.exe' -Install
- '%TEMP%\IXP000.TMP\XP_VS_Setup.exe'
- '%TEMP%\IXP000.TMP\Install.exe'
- '%ProgramFiles%\Generic\USB Server\Driver\DrvSetup.exe' install Driver\GenBus.inf root\EST_Bus
- '%ProgramFiles%\Generic\USB Server\Driver\DIFxCmd.exe' /i Driver\GenHC.inf 16
- '%ProgramFiles%\Generic\USB Server\Driver\DIFxCmd.exe' /p Driver\GenHC.inf 16
Executes the following:
- '<SYSTEM32>\msiexec.exe' -Embedding 32A4B381798120E9B2170524A457CFC0
- '<SYSTEM32>\runonce.exe' -r
- '<SYSTEM32>\msiexec.exe' /V
- '<SYSTEM32>\msiexec.exe' -Embedding B7D059DF15DCA1E1A3C11C3133855E00 C
