Technical Information
To ensure autorun and distribution
Sets the following service settings
- [<HKLM>\SYSTEM\ControlSet001\Services\fltsrv] 'ImagePath' = 'System32\DRIVERS\fltsrv.sys'
- [<HKLM>\SYSTEM\ControlSet001\Services\fltsrv] 'Start' = '00000000'
- [<HKLM>\System\CurrentControlSet\Services\fltsrv] 'Start' = '00000000'
- [<HKLM>\System\CurrentControlSet\Services\fltsrv] 'ImagePath' = 'System32\DRIVERS\fltsrv.sys'
- [<HKLM>\SYSTEM\ControlSet001\Services\snapman] 'ImagePath' = 'System32\DRIVERS\snapman.sys'
- [<HKLM>\SYSTEM\ControlSet001\Services\snapman] 'Start' = '00000000'
- [<HKLM>\System\CurrentControlSet\Services\snapman] 'Start' = '00000000'
- [<HKLM>\System\CurrentControlSet\Services\snapman] 'ImagePath' = 'System32\DRIVERS\snapman.sys'
Creates the following services
- 'fltsrv' System32\DRIVERS\fltsrv.sys
- 'snapman' System32\DRIVERS\snapman.sys
Modifies file system
Creates the following files
- %TEMP%\7zipsfx.000\install.cmd
- %TEMP%\7zipsfx.000\vccorlib120.dll
- %TEMP%\7zipsfx.000\ulxmlrpcpp.dll
- %TEMP%\7zipsfx.000\trueimage.exe
- %TEMP%\7zipsfx.000\tib_mounter.dll
- %TEMP%\7zipsfx.000\tib_api.dll
- %TEMP%\7zipsfx.000\thread_pool.dll
- %TEMP%\7zipsfx.000\snapman.sys
- %TEMP%\7zipsfx.000\snapapi.dll
- %TEMP%\7zipsfx.000\rpc_client.dll
- %TEMP%\7zipsfx.000\resource.dll
- <DRIVERS>\snapman.sys
- %TEMP%\7zipsfx.000\oem_doc_source.dll
- %TEMP%\7zipsfx.000\msvcp120.dll
- %TEMP%\7zipsfx.000\logging.dll
- %TEMP%\7zipsfx.000\libssl10.dll
- %TEMP%\7zipsfx.000\libcrypto10.dll
- %TEMP%\7zipsfx.000\kb_link.dll
- %TEMP%\7zipsfx.000\icudt38.dll
- %TEMP%\7zipsfx.000\icu38.dll
- %TEMP%\7zipsfx.000\fox.dll
- %TEMP%\7zipsfx.000\fltsrv.sys
- %TEMP%\7zipsfx.000\expat.dll
- %TEMP%\7zipsfx.000\msvcr120.dll
- <DRIVERS>\fltsrv.sys
Miscellaneous
Searches for the following windows
- ClassName: 'TRUEIMAGE_DUMMY_APPLICATION_WINDOW' WindowName: ''
Creates and executes the following
- '%TEMP%\7zipsfx.000\trueimage.exe'
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\7ZipSfx.000\install.cmd" "' (with hidden window)
Executes the following
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\7ZipSfx.000\install.cmd" "
- '<SYSTEM32>\reg.exe' ADD HKLM\SOFTWARE\Acronis\CommonComponents /f /v "rpc_client.dll" /T REG_SZ /D "%TEMP%\7ZipSfx.000\rpc_client.dll"
- '<SYSTEM32>\reg.exe' ADD HKLM\SOFTWARE\Acronis\CommonComponents /f /v "resource.dll" /T REG_SZ /D "%TEMP%\7ZipSfx.000\resource.dll"
- '<SYSTEM32>\reg.exe' ADD HKLM\SOFTWARE\Acronis\CommonComponents /f /v "thread_pool.dll" /T REG_SZ /D "%TEMP%\7ZipSfx.000\thread_pool.dll"
- '<SYSTEM32>\reg.exe' ADD HKLM\SOFTWARE\Acronis\CommonComponents /f /v "libcrypto10.dll" /T REG_SZ /D "%TEMP%\7ZipSfx.000\libcrypto10.dll"
- '<SYSTEM32>\reg.exe' ADD HKLM\SOFTWARE\Acronis\CommonComponents /f /v "libssl10.dll" /T REG_SZ /D "%TEMP%\7ZipSfx.000\libssl10.dll"
- '<SYSTEM32>\reg.exe' Add HKLM\Software\Acronis\TrueImage /v "standard" /t REG_SZ /d " 12 98 20109108109 19 3120 23 15 96108 25 25109103120 27 96 24 96 96 30 7 4120 20 99 12 22 23 4 24 30120 18103108 4102 16 ...
- '<SYSTEM32>\reg.exe' ADD HKLM\SOFTWARE\Acronis\CommonComponents /f /v "icu38.dll" /T REG_SZ /D "%TEMP%\7ZipSfx.000\icu38.dll"
- '<SYSTEM32>\reg.exe' ADD HKLM\SOFTWARE\Acronis\CommonComponents /f /v "auto_reactivate.bin" /T REG_SZ /D "%TEMP%\7ZipSfx.000\auto_reactivate.bin"
- '<SYSTEM32>\reg.exe' ADD HKLM\SOFTWARE\Acronis\CommonComponents /f /v "ulxmlrpcpp.dll" /T REG_SZ /D "%TEMP%\7ZipSfx.000\ulxmlrpcpp.dll"
- '<SYSTEM32>\reg.exe' ADD HKLM\SOFTWARE\Acronis\CommonComponents /f /v "expat.dll" /T REG_SZ /D "%TEMP%\7ZipSfx.000\expat.dll"
- '<SYSTEM32>\reg.exe' ADD HKLM\SOFTWARE\Acronis\CommonComponents /f /v "mspack.dll" /T REG_SZ /D "%TEMP%\7ZipSfx.000\mspack.dll"
- '<SYSTEM32>\reg.exe' ADD HKLM\SOFTWARE\Acronis\CommonComponents /f /v "tib_api.dll" /T REG_SZ /D "%TEMP%\7ZipSfx.000\tib_api.dll"
- '<SYSTEM32>\reg.exe' ADD HKLM\SOFTWARE\Acronis\CommonComponents /f /v "tib_mounter.dll" /T REG_SZ /D "%TEMP%\7ZipSfx.000\tib_mounter.dll"
- '<SYSTEM32>\reg.exe' ADD HKLM\SOFTWARE\Acronis\CommonComponents /f /v "auto_reactivate64.bin" /T REG_SZ /D "%TEMP%\7ZipSfx.000\auto_reactivate64.bin"
- '<SYSTEM32>\reg.exe' ADD HKLM\SOFTWARE\Acronis\CommonComponents /f /v "kb_link.dll" /T REG_SZ /D "%TEMP%\7ZipSfx.000\kb_link.dll"
- '<SYSTEM32>\net1.exe' start snapman
- '<SYSTEM32>\net.exe' start snapman
- '<SYSTEM32>\sc.exe' create snapman type= kernel start= boot binpath= "System32\DRIVERS\snapman.sys"
- '<SYSTEM32>\reg.exe' ADD HKLM\SYSTEM\ControlSet001\Services\fltsrv /f /v "DisplayName" /T REG_SZ /D "Acronis Storage Filter Management"
- '<SYSTEM32>\reg.exe' ADD HKLM\SYSTEM\ControlSet001\Services\fltsrv /f /v "Group" /T REG_SZ /D "Filter"
- '<SYSTEM32>\reg.exe' ADD HKLM\SYSTEM\ControlSet001\Services\fltsrv /f /v "ImagePath" /T REG_SZ /D "System32\DRIVERS\fltsrv.sys"
- '<SYSTEM32>\reg.exe' ADD HKLM\SYSTEM\ControlSet001\Services\fltsrv /f /v "Start" /T REG_DWORD /D "0"
- '<SYSTEM32>\reg.exe' ADD HKLM\SYSTEM\ControlSet001\Services\fltsrv /f /v "Type" /T REG_DWORD /D "1"
- '<SYSTEM32>\reg.exe' ADD HKLM\SYSTEM\ControlSet001\Services\fltsrv /f /v "Tag" /T REG_DWORD /D "2"
- '<SYSTEM32>\reg.exe' ADD HKLM\SYSTEM\ControlSet001\Services\fltsrv /f /v "ErrorControl" /T REG_DWORD /D "0"
- '<SYSTEM32>\sc.exe' create fltsrv type= kernel start= boot binpath= "System32\DRIVERS\fltsrv.sys"
- '<SYSTEM32>\net1.exe' start fltsrv
- '<SYSTEM32>\reg.exe' ADD HKLM\SYSTEM\ControlSet001\Services\snapman /f /v "DisplayName" /T REG_SZ /D "Acronis Snapshots Manager"
- '<SYSTEM32>\reg.exe' ADD HKLM\SYSTEM\ControlSet001\Services\snapman /f /v "ErrorControl" /T REG_DWORD /D "1"
- '<SYSTEM32>\reg.exe' ADD HKLM\SYSTEM\ControlSet001\Services\snapman /f /v "ImagePath" /T REG_SZ /D "System32\DRIVERS\snapman.sys"
- '<SYSTEM32>\reg.exe' ADD HKLM\SYSTEM\ControlSet001\Services\snapman /f /v "Start" /T REG_DWORD /D "0"
- '<SYSTEM32>\reg.exe' ADD HKLM\SYSTEM\ControlSet001\Services\snapman /f /v "Type" /T REG_DWORD /D "1"
- '<SYSTEM32>\net.exe' start fltsrv
- '<SYSTEM32>\reg.exe' ADD HKLM\SOFTWARE\Acronis\CommonComponents /f /v "oem_doc_source.dll" /T REG_SZ /D "%TEMP%\7ZipSfx.000\oem_doc_source.dll"
- '<SYSTEM32>\reg.exe' ADD HKLM\SOFTWARE\Acronis\TrueImageHome\Settings /f /v "ServiceDir" /T REG_SZ /D "%TEMP%\7ZipSfx.000\
