Technical Information
To ensure autorun and distribution:
Creates or modifies the following files:
- %ALLUSERSPROFILE%\Start Menu\Programs\Startup\EVAS Control Console.lnk
Modifies file system:
Creates the following files:
- C:\CONSOLE_ROOT_UPDATE_12_3\CONSOLE_12_3.msi
- %ProgramFiles%\EVAS\EVAS Control Console\EVAScontrolConsole.mht
- %ProgramFiles%\EVAS\EVAS Control Console\Interop.IasHelperLib.dll
- %ProgramFiles%\EVAS\EVAS Control Console\EVAS Control Console.exe
- %ProgramFiles%\EVAS\EVAS Control Console\EVAS Control Console.exe.config
- %ProgramFiles%\EVAS\EVAS Control Console\iKeyBoardCore.dll
- %ProgramFiles%\EVAS\EVAS Control Console\EVAS Control Console.mht
- %ProgramFiles%\EVAS\EVAS Control Console\Interop.SpeechLib.dll
- %ProgramFiles%\EVAS\EVAS Control Console\custom.xml
- %ProgramFiles%\EVAS\EVAS Control Console\The EVAS Control Console License Agreement.rtf
- %ProgramFiles%\EVAS\EVAS Control Console\The EVAS Control Console License Agreement.mht
- %ProgramFiles%\EVAS\EVAS Control Console\The EVAS Control Console License Agreement.doc
- %ProgramFiles%\EVAS\EVAS Control Console\Customize.ico
- %ProgramFiles%\EVAS\EVAS Control Console\EVAS Control Console.doc
- %WINDIR%\Installer\{295DF773-FADE-4680-B1A7-2A21B832D836}\_A939C67D77EFA0BA32C561.exe
- %ALLUSERSPROFILE%\Start Menu\Programs\EVAS Utility Programs\The EVAS Control Console License Agreement.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\EVAS Utility Programs\EVAS Control Console.lnk
- %ALLUSERSPROFILE%\Desktop\EVAS Control Console.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\EVAS Utility Programs\About The EVAS Control Console.lnk
- %WINDIR%\Installer\MSI6.tmp
- %ProgramFiles%\EVAS\EVAS Control Console\EVAS Control Console.InstallState
- %WINDIR%\Installer\28b23.msi
- %WINDIR%\Installer\{295DF773-FADE-4680-B1A7-2A21B832D836}\_6FEFF9B68218417F98F549.exe
- %WINDIR%\Installer\{295DF773-FADE-4680-B1A7-2A21B832D836}\_978D96180B5BFEFD537D76.exe
- %WINDIR%\Installer\{295DF773-FADE-4680-B1A7-2A21B832D836}\_2500615784883837CB440B.exe
- %WINDIR%\Installer\{295DF773-FADE-4680-B1A7-2A21B832D836}\_F405745AD193DE64C4767A.exe
- %WINDIR%\Installer\{295DF773-FADE-4680-B1A7-2A21B832D836}\_FA39D36EFA8E977DDE2ECB.exe
- %ProgramFiles%\EVAS\EVAS Control Console\Connect.ico
- %ProgramFiles%\EVAS\EVAS Control Console\updater.exe
- C:\Config.Msi\28b22.rbs
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SECURITY
- %WINDIR%\Installer\28b1f.msi
- %WINDIR%\Installer\MSI1.tmp
- %TEMP%\CFG2.tmp
- %WINDIR%\Installer\MSI3.tmp
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-18
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-19
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-19
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-20
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-20
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-21-2052111302-484763869-725345543-1003
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-21-2052111302-484763869-725345543-1003
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_.DEFAULT
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SOFTWARE
- %WINDIR%\Installer\MSI4.tmp
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SYSTEM
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SAM
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\ComDb.Dat
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\domain.txt
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\$WinMgmt.CFG
- %WINDIR%\Installer\28b21.ipi
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\INDEX.BTR
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\INDEX.MAP
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING.VER
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING1.MAP
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING2.MAP
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\OBJECTS.DATA
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\OBJECTS.MAP
- %WINDIR%\Installer\MSI7.tmp
Deletes the following files:
- %WINDIR%\Installer\MSI1.tmp
- %WINDIR%\Installer\MSI3.tmp
- %WINDIR%\Installer\MSI6.tmp
- %WINDIR%\Installer\MSI4.tmp
- %WINDIR%\Installer\MSI7.tmp
- C:\Config.Msi\28b22.rbs
Miscellaneous:
Executes the following:
- '<SYSTEM32>\msiexec.exe' /i "C:\CONSOLE_ROOT_UPDATE_12_3\CONSOLE_12_3.msi" /qb+
- '<SYSTEM32>\msiexec.exe' /V
- '<SYSTEM32>\msiexec.exe' -Embedding E95127B7D0B6DB0F1BC78581D9B13C18
- '<SYSTEM32>\msiexec.exe' -Embedding D0C0867C84038E08A7465EDE9FA45624 M Global\MSI0000
