Adware.OpenCandy.158

Technical Information

To ensure autorun and distribution

Modifies the following registry keys

[<HKLM>\Software\Classes\CDBurnerXPOpen\shell\open\command] '' = '"%ProgramFiles%\CDBurnerXP\cdbxpp.exe" /od "%1"'
[<HKLM>\Software\Classes\CDBurnerXPAudio\shell\open\command] '' = '"%ProgramFiles%\CDBurnerXP\cdbxpp.exe" /oa "%1"'
[<HKLM>\Software\Classes\CDBurnerXPOpenIso\shell\open\command] '' = '"%ProgramFiles%\CDBurnerXP\cdbxpp.exe" /oi "%1"'
[<HKLM>\Software\Classes\dxp-file\Shell\Open\Command] '' = '"%ProgramFiles%\CDBurnerXP\cdbxpp.exe" /od "%1"'
[<HKLM>\Software\Classes\axp-file\Shell\Open\Command] '' = '"%ProgramFiles%\CDBurnerXP\cdbxpp.exe" /oa "%1"'

Malicious functions

Executes the following

'<SYSTEM32>\net.exe' STOP "NMSAccessU"

Modifies file system

Creates the following files

%TEMP%\7zipsfx.000\cdbxp-setup-4.3.8.2513.exe
%ProgramFiles%\cdburnerxp\pt-pt\is-2aejp.tmp
%ProgramFiles%\cdburnerxp\pt-br\is-2dgoi.tmp
%ProgramFiles%\cdburnerxp\pl-pl\is-5vu9c.tmp
%ProgramFiles%\cdburnerxp\nb-no\is-7mju0.tmp
%ProgramFiles%\cdburnerxp\nl-nl\is-1eioo.tmp
%ProgramFiles%\cdburnerxp\lt-lt\is-pfski.tmp
%ProgramFiles%\cdburnerxp\lv-lv\is-2b5dv.tmp
%ProgramFiles%\cdburnerxp\kk-kz\is-cn6un.tmp
%ProgramFiles%\cdburnerxp\es-es\is-upl8n.tmp
%ProgramFiles%\cdburnerxp\ko-kr\is-jdjma.tmp
%ProgramFiles%\cdburnerxp\it-it\is-dm8i9.tmp
%ProgramFiles%\cdburnerxp\id-id\is-4kl2i.tmp
%ProgramFiles%\cdburnerxp\hu-hu\is-ih4nm.tmp
%ProgramFiles%\cdburnerxp\hr-hr\is-r6qqb.tmp
%ProgramFiles%\cdburnerxp\he-il\is-gl93h.tmp
%ProgramFiles%\cdburnerxp\fr-fr\is-0og5q.tmp
%ProgramFiles%\cdburnerxp\fi-fi\is-nj7s4.tmp
%ProgramFiles%\cdburnerxp\da-dk\is-f41ck.tmp
%ProgramFiles%\cdburnerxp\ja-jp\is-ifqv2.tmp
%ProgramFiles%\cdburnerxp\es-mx\is-13030.tmp
%ProgramFiles%\cdburnerxp\ro-ro\is-vfj85.tmp
%ProgramFiles%\cdburnerxp\is-7u6js.tmp
%TEMP%\_ir_sf_temp_0\irimg2.jpg
%TEMP%\_ir_sf_temp_0\irimg1.jpg
%TEMP%\_ir_sf_temp_0\irsetup.dat
%TEMP%\_ir_sf_temp_0\irsetup.exe
%ProgramFiles%\cdburnerxp\unins000.dat
C:\users\public\desktop\cdburnerxp.lnk
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\cdburnerxp.lnk
%ProgramFiles%\cdburnerxp\resources\is-9v870.tmp
%ProgramFiles%\cdburnerxp\sk-sk\is-akccr.tmp
%ProgramFiles%\cdburnerxp\ru-ru\is-53vb7.tmp
%ProgramFiles%\cdburnerxp\is-dpn16.tmp
%ProgramFiles%\cdburnerxp\is-hvj1a.tmp
%ProgramFiles%\cdburnerxp\zh-cht\is-h57g6.tmp
%ProgramFiles%\cdburnerxp\zh-chs\is-tisaj.tmp
%ProgramFiles%\cdburnerxp\uk-ua\is-d5mn4.tmp
%ProgramFiles%\cdburnerxp\tr-tr\is-0joe9.tmp
%ProgramFiles%\cdburnerxp\sv-se\is-6738v.tmp
%ProgramFiles%\cdburnerxp\sl-si\is-rl8g5.tmp
%ProgramFiles%\cdburnerxp\resources\is-op6hg.tmp
%ProgramFiles%\cdburnerxp\el-gr\is-o67mt.tmp
%ProgramFiles%\cdburnerxp\et-ee\is-jds06.tmp
%ProgramFiles%\cdburnerxp\de-de\is-c185t.tmp
%ProgramFiles%\cdburnerxp\is-88hfs.tmp
%ProgramFiles%\cdburnerxp\is-bm3sh.tmp
%ProgramFiles%\cdburnerxp\is-jgchh.tmp
%ProgramFiles%\cdburnerxp\is-030rv.tmp
%ProgramFiles%\cdburnerxp\is-h15ot.tmp
%ProgramFiles%\cdburnerxp\is-aeluu.tmp
%ProgramFiles%\cdburnerxp\is-k8a06.tmp
%ProgramFiles%\cdburnerxp\is-63263.tmp
%ProgramFiles%\cdburnerxp\is-6kong.tmp
%ProgramFiles%\cdburnerxp\is-ula8u.tmp
%ProgramFiles%\cdburnerxp\is-jdr0d.tmp
%ProgramFiles%\cdburnerxp\is-mrcpo.tmp
%TEMP%\is-5ohks.tmp\ocsetuphlp.dll
%TEMP%\is-5ohks.tmp\_isetup\_shfoldr.dll
%TEMP%\is-5ohks.tmp\_isetup\_setup64.tmp
%TEMP%\is-cu5ja.tmp\cdbxp-setup-4.3.8.2513.tmp
%TEMP%\7zipsfx.000\cracks.exe
%ProgramFiles%\cdburnerxp\is-827nq.tmp
%ProgramFiles%\cdburnerxp\is-o69qf.tmp
%ProgramFiles%\cdburnerxp\is-2lpts.tmp
%ProgramFiles%\cdburnerxp\is-lefog.tmp
%ProgramFiles%\cdburnerxp\cs-cz\is-gsefg.tmp
%ProgramFiles%\cdburnerxp\is-9o0pn.tmp
%ProgramFiles%\cdburnerxp\ca\is-31hf8.tmp
%ProgramFiles%\cdburnerxp\bg-bg\is-p4i38.tmp
%ProgramFiles%\cdburnerxp\ar-jo\is-k67lg.tmp
%ProgramFiles%\cdburnerxp\is-srl2d.tmp
%ProgramFiles%\cdburnerxp\is-13f0e.tmp
%ProgramFiles%\cdburnerxp\is-pln83.tmp
%ProgramFiles%\cdburnerxp\is-f6qf3.tmp
%ProgramFiles%\cdburnerxp\is-rajdn.tmp
%ProgramFiles%\cdburnerxp\is-agt4v.tmp
%ProgramFiles%\cdburnerxp\is-hfk80.tmp
%ProgramFiles%\cdburnerxp\is-kds3r.tmp
%ProgramFiles%\cdburnerxp\is-7071m.tmp
%ProgramFiles%\cdburnerxp\is-0knua.tmp
%ProgramFiles%\cdburnerxp\is-cd5k2.tmp
%ProgramFiles%\cdburnerxp\is-nghp2.tmp
%ProgramFiles%\cdburnerxp\is-kr2ih.tmp
%ProgramFiles%\cdburnerxp\is-rpg5f.tmp
%ProgramFiles%\cdburnerxp\is-2fkjn.tmp
%WINDIR%\your product setup log.txt
C:\users\public\desktop\Г±Г Г©ГІ Г±ГЎГ®Г°ГЄГЁ wpi.url

Deletes the following files

%TEMP%\is-5ohks.tmp\ocsetuphlp.dll
%TEMP%\is-5ohks.tmp\_isetup\_setup64.tmp
%TEMP%\is-5ohks.tmp\_isetup\_shfoldr.dll
%TEMP%\is-cu5ja.tmp\cdbxp-setup-4.3.8.2513.tmp
%TEMP%\_ir_sf_temp_0\irsetup.dat
%TEMP%\_ir_sf_temp_0\irimg1.jpg
%TEMP%\_ir_sf_temp_0\irimg2.jpg
%TEMP%\_ir_sf_temp_0\irsetup.exe
%TEMP%\7zipsfx.000\cdbxp-setup-4.3.8.2513.exe
%TEMP%\7zipsfx.000\cracks.exe

Moves the following files

from %ProgramFiles%\cdburnerxp\is-mrcpo.tmp to %ProgramFiles%\cdburnerxp\unins000.exe
from %ProgramFiles%\cdburnerxp\kk-kz\is-cn6un.tmp to %ProgramFiles%\cdburnerxp\kk-kz\cdbxpp.resources.dll
from %ProgramFiles%\cdburnerxp\ko-kr\is-jdjma.tmp to %ProgramFiles%\cdburnerxp\ko-kr\cdbxpp.resources.dll
from %ProgramFiles%\cdburnerxp\ja-jp\is-ifqv2.tmp to %ProgramFiles%\cdburnerxp\ja-jp\cdbxpp.resources.dll
from %ProgramFiles%\cdburnerxp\it-it\is-dm8i9.tmp to %ProgramFiles%\cdburnerxp\it-it\cdbxpp.resources.dll
from %ProgramFiles%\cdburnerxp\id-id\is-4kl2i.tmp to %ProgramFiles%\cdburnerxp\id-id\cdbxpp.resources.dll
from %ProgramFiles%\cdburnerxp\hu-hu\is-ih4nm.tmp to %ProgramFiles%\cdburnerxp\hu-hu\cdbxpp.resources.dll
from %ProgramFiles%\cdburnerxp\lv-lv\is-2b5dv.tmp to %ProgramFiles%\cdburnerxp\lv-lv\cdbxpp.resources.dll
from %ProgramFiles%\cdburnerxp\hr-hr\is-r6qqb.tmp to %ProgramFiles%\cdburnerxp\hr-hr\cdbxpp.resources.dll
from %ProgramFiles%\cdburnerxp\fr-fr\is-0og5q.tmp to %ProgramFiles%\cdburnerxp\fr-fr\cdbxpp.resources.dll
from %ProgramFiles%\cdburnerxp\fi-fi\is-nj7s4.tmp to %ProgramFiles%\cdburnerxp\fi-fi\cdbxpp.resources.dll
from %ProgramFiles%\cdburnerxp\da-dk\is-f41ck.tmp to %ProgramFiles%\cdburnerxp\da-dk\cdbxpp.resources.dll
from %ProgramFiles%\cdburnerxp\es-mx\is-13030.tmp to %ProgramFiles%\cdburnerxp\es-mx\cdbxpp.resources.dll
from %ProgramFiles%\cdburnerxp\es-es\is-upl8n.tmp to %ProgramFiles%\cdburnerxp\es-es\cdbxpp.resources.dll
from %ProgramFiles%\cdburnerxp\el-gr\is-o67mt.tmp to %ProgramFiles%\cdburnerxp\el-gr\cdbxpp.resources.dll
from %ProgramFiles%\cdburnerxp\he-il\is-gl93h.tmp to %ProgramFiles%\cdburnerxp\he-il\cdbxpp.resources.dll
from %ProgramFiles%\cdburnerxp\lt-lt\is-pfski.tmp to %ProgramFiles%\cdburnerxp\lt-lt\cdbxpp.resources.dll
from %ProgramFiles%\cdburnerxp\nl-nl\is-1eioo.tmp to %ProgramFiles%\cdburnerxp\nl-nl\cdbxpp.resources.dll
from %ProgramFiles%\cdburnerxp\nb-no\is-7mju0.tmp to %ProgramFiles%\cdburnerxp\nb-no\cdbxpp.resources.dll
from %ProgramFiles%\cdburnerxp\is-7u6js.tmp to %ProgramFiles%\cdburnerxp\iso.ico
from %ProgramFiles%\cdburnerxp\is-dpn16.tmp to %ProgramFiles%\cdburnerxp\audio.ico
from %ProgramFiles%\cdburnerxp\is-hvj1a.tmp to %ProgramFiles%\cdburnerxp\data.ico
from %ProgramFiles%\cdburnerxp\zh-cht\is-h57g6.tmp to %ProgramFiles%\cdburnerxp\zh-cht\cdbxpp.resources.dll
from %ProgramFiles%\cdburnerxp\zh-chs\is-tisaj.tmp to %ProgramFiles%\cdburnerxp\zh-chs\cdbxpp.resources.dll
from %ProgramFiles%\cdburnerxp\uk-ua\is-d5mn4.tmp to %ProgramFiles%\cdburnerxp\uk-ua\cdbxpp.resources.dll
from %ProgramFiles%\cdburnerxp\tr-tr\is-0joe9.tmp to %ProgramFiles%\cdburnerxp\tr-tr\cdbxpp.resources.dll
from %ProgramFiles%\cdburnerxp\sv-se\is-6738v.tmp to %ProgramFiles%\cdburnerxp\sv-se\cdbxpp.resources.dll
from %ProgramFiles%\cdburnerxp\sl-si\is-rl8g5.tmp to %ProgramFiles%\cdburnerxp\sl-si\cdbxpp.resources.dll
from %ProgramFiles%\cdburnerxp\sk-sk\is-akccr.tmp to %ProgramFiles%\cdburnerxp\sk-sk\cdbxpp.resources.dll
from %ProgramFiles%\cdburnerxp\ru-ru\is-53vb7.tmp to %ProgramFiles%\cdburnerxp\ru-ru\cdbxpp.resources.dll
from %ProgramFiles%\cdburnerxp\ro-ro\is-vfj85.tmp to %ProgramFiles%\cdburnerxp\ro-ro\cdbxpp.resources.dll
from %ProgramFiles%\cdburnerxp\pt-pt\is-2aejp.tmp to %ProgramFiles%\cdburnerxp\pt-pt\cdbxpp.resources.dll
from %ProgramFiles%\cdburnerxp\pt-br\is-2dgoi.tmp to %ProgramFiles%\cdburnerxp\pt-br\cdbxpp.resources.dll
from %ProgramFiles%\cdburnerxp\pl-pl\is-5vu9c.tmp to %ProgramFiles%\cdburnerxp\pl-pl\cdbxpp.resources.dll
from %ProgramFiles%\cdburnerxp\et-ee\is-jds06.tmp to %ProgramFiles%\cdburnerxp\et-ee\cdbxpp.resources.dll
from %ProgramFiles%\cdburnerxp\resources\is-op6hg.tmp to %ProgramFiles%\cdburnerxp\resources\audio_cover.jpg
from %ProgramFiles%\cdburnerxp\de-de\is-c185t.tmp to %ProgramFiles%\cdburnerxp\de-de\cdbxpp.resources.dll
from %ProgramFiles%\cdburnerxp\ca\is-31hf8.tmp to %ProgramFiles%\cdburnerxp\ca\cdbxpp.resources.dll
from %ProgramFiles%\cdburnerxp\is-o69qf.tmp to %ProgramFiles%\cdburnerxp\interop.nmsdvdxlib.dll
from %ProgramFiles%\cdburnerxp\is-63263.tmp to %ProgramFiles%\cdburnerxp\nmsdvdxu.dll
from %ProgramFiles%\cdburnerxp\is-2lpts.tmp to %ProgramFiles%\cdburnerxp\logicnp.shcombobox.dll
from %ProgramFiles%\cdburnerxp\is-88hfs.tmp to %ProgramFiles%\cdburnerxp\logicnp.folderview.dll
from %ProgramFiles%\cdburnerxp\is-bm3sh.tmp to %ProgramFiles%\cdburnerxp\logicnp.fileview.dll
from %ProgramFiles%\cdburnerxp\is-jgchh.tmp to %ProgramFiles%\cdburnerxp\bass.net.dll
from %ProgramFiles%\cdburnerxp\is-lefog.tmp to %ProgramFiles%\cdburnerxp\starburnx12.dll
from %ProgramFiles%\cdburnerxp\is-030rv.tmp to %ProgramFiles%\cdburnerxp\basswv.dll
from %ProgramFiles%\cdburnerxp\is-aeluu.tmp to %ProgramFiles%\cdburnerxp\bass_ape.dll
from %ProgramFiles%\cdburnerxp\is-k8a06.tmp to %ProgramFiles%\cdburnerxp\basscd.dll
from %ProgramFiles%\cdburnerxp\is-6kong.tmp to %ProgramFiles%\cdburnerxp\bassflac.dll
from %ProgramFiles%\cdburnerxp\is-827nq.tmp to %ProgramFiles%\cdburnerxp\bassmix.dll
from %ProgramFiles%\cdburnerxp\is-ula8u.tmp to %ProgramFiles%\cdburnerxp\basswma.dll
from %ProgramFiles%\cdburnerxp\is-jdr0d.tmp to %ProgramFiles%\cdburnerxp\bass.dll
from %ProgramFiles%\cdburnerxp\is-h15ot.tmp to %ProgramFiles%\cdburnerxp\bass_mpc.dll
from %ProgramFiles%\cdburnerxp\is-hfk80.tmp to %ProgramFiles%\cdburnerxp\starburn.dll
from %ProgramFiles%\cdburnerxp\is-2fkjn.tmp to %ProgramFiles%\cdburnerxp\vorbis.dll
from %ProgramFiles%\cdburnerxp\is-rpg5f.tmp to %ProgramFiles%\cdburnerxp\vorbisfile.dll
from %ProgramFiles%\cdburnerxp\bg-bg\is-p4i38.tmp to %ProgramFiles%\cdburnerxp\bg-bg\cdbxpp.resources.dll
from %ProgramFiles%\cdburnerxp\ar-jo\is-k67lg.tmp to %ProgramFiles%\cdburnerxp\ar-jo\cdbxpp.resources.dll
from %ProgramFiles%\cdburnerxp\is-srl2d.tmp to %ProgramFiles%\cdburnerxp\cdbxp.dll
from %ProgramFiles%\cdburnerxp\is-13f0e.tmp to %ProgramFiles%\cdburnerxp\cdbxpp.exe
from %ProgramFiles%\cdburnerxp\is-pln83.tmp to %ProgramFiles%\cdburnerxp\cdbxpcmd.exe.config
from %ProgramFiles%\cdburnerxp\is-f6qf3.tmp to %ProgramFiles%\cdburnerxp\cdbxpcmd.exe.manifest
from %ProgramFiles%\cdburnerxp\is-rajdn.tmp to %ProgramFiles%\cdburnerxp\cdbxpcmd.exe
from %ProgramFiles%\cdburnerxp\is-9o0pn.tmp to %ProgramFiles%\cdburnerxp\updater.exe
from %ProgramFiles%\cdburnerxp\is-agt4v.tmp to %ProgramFiles%\cdburnerxp\native.cslib.manifest
from %ProgramFiles%\cdburnerxp\is-kds3r.tmp to %ProgramFiles%\cdburnerxp\native.cdbxp.manifest
from %ProgramFiles%\cdburnerxp\is-7071m.tmp to %ProgramFiles%\cdburnerxp\cdbxpp.exe.config
from %ProgramFiles%\cdburnerxp\is-0knua.tmp to %ProgramFiles%\cdburnerxp\cdbxpp.exe.manifest
from %ProgramFiles%\cdburnerxp\is-cd5k2.tmp to %ProgramFiles%\cdburnerxp\cslib.dll
from %ProgramFiles%\cdburnerxp\is-nghp2.tmp to %ProgramFiles%\cdburnerxp\interop.rocketdivision.starburnx.dll
from %ProgramFiles%\cdburnerxp\is-kr2ih.tmp to %ProgramFiles%\cdburnerxp\ogg.dll
from %ProgramFiles%\cdburnerxp\cs-cz\is-gsefg.tmp to %ProgramFiles%\cdburnerxp\cs-cz\cdbxpp.resources.dll
from %ProgramFiles%\cdburnerxp\resources\is-9v870.tmp to %ProgramFiles%\cdburnerxp\resources\data_cover.jpg

Miscellaneous

Searches for the following windows

ClassName: 'MS_WINHELP' WindowName: ''

Creates and executes the following

'%TEMP%\7zipsfx.000\cdbxp-setup-4.3.8.2513.exe' /VERYSILENT
'%TEMP%\is-cu5ja.tmp\cdbxp-setup-4.3.8.2513.tmp' /SL5="$50236,4232274,525312,%TEMP%\7ZipSfx.000\cdbxp-setup-4.3.8.2513.exe" /VERYSILENT
'%TEMP%\7zipsfx.000\cracks.exe'
'%TEMP%\_ir_sf_temp_0\irsetup.exe' __IRAOFF:652322 "__IRAFN:%TEMP%\7ZipSfx.000\crackS.exe" "__IRCT:1" "__IRTSS:0" "__IRSID:S-1-5-21-1960123792-2022915161-3775307078-1001"
'<SYSTEM32>\reg.exe' Copy HKCU\SOFTWARE\CDBurnerXP "HKCU\SOFTWARE\Canneverbe Limited\CDBurnerXP" /s /f' (with hidden window)
'<SYSTEM32>\reg.exe' Delete HKCU\SOFTWARE\CDBurnerXP /f' (with hidden window)
'<SYSTEM32>\net.exe' STOP "NMSAccessU"' (with hidden window)

Executes the following

'<SYSTEM32>\regsvr32.exe' /s "%ProgramFiles%\CDBurnerXP\NMSDVDXU.dll"
'<SYSTEM32>\regsvr32.exe' /s "%ProgramFiles%\CDBurnerXP\StarBurnX12.dll"
'<SYSTEM32>\reg.exe' Copy HKCU\SOFTWARE\CDBurnerXP "HKCU\SOFTWARE\Canneverbe Limited\CDBurnerXP" /s /f
'<SYSTEM32>\reg.exe' Delete HKCU\SOFTWARE\CDBurnerXP /f
'<SYSTEM32>\net1.exe' STOP "NMSAccessU"

TECHNOLOGIES

TERMINOLOGIE

COURS ET EDU

MYTHES

Technical Information

Recommandations pour le traitement

Free trial