Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce] 'wextract_cleanup0' = 'rundll32.exe <SYSTEM32>\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP000.TMP\"'
Изменения в файловой системе:
Создает следующие файлы:
- %ALLUSERSPROFILE%\Application Data\AgoraNet\ModelTalker\test.dat
- %ALLUSERSPROFILE%\Application Data\AgoraNet\ModelTalker\syll.xp
- %ALLUSERSPROFILE%\Application Data\AgoraNet\ModelTalker\rewr.xp
- %ALLUSERSPROFILE%\Application Data\AgoraNet\ModelTalker\test.idx
- %ALLUSERSPROFILE%\Application Data\AgoraNet\ModelTalker\verb.xp
- %ALLUSERSPROFILE%\Application Data\AgoraNet\ModelTalker\test.vdm
- %ALLUSERSPROFILE%\Application Data\AgoraNet\ModelTalker\test.sta
- %ALLUSERSPROFILE%\Application Data\AgoraNet\ModelTalker\phph.xp
- %ALLUSERSPROFILE%\Application Data\AgoraNet\ModelTalker\phon.xp
- %ALLUSERSPROFILE%\Application Data\AgoraNet\ModelTalker\noun.xp
- %ALLUSERSPROFILE%\Application Data\AgoraNet\ModelTalker\pph.xp
- %ALLUSERSPROFILE%\Application Data\AgoraNet\ModelTalker\reg.xp
- %ALLUSERSPROFILE%\Application Data\AgoraNet\ModelTalker\rcmp.xp
- %ALLUSERSPROFILE%\Application Data\AgoraNet\ModelTalker\pre.xp
- %TEMP%\IXP000.TMP\vcredis1.cab
- %TEMP%\IXP000.TMP\vcredist.msi
- %TEMP%\vcredist_x86.exe
- %TEMP%\vcredist_x86.log
- %WINDIR%\Installer\MSI2.tmp
- %TEMP%\~DFC0E9.tmp
- %WINDIR%\Installer\43bce.ipi
- <SYSTEM32>\cudll.dll
- <SYSTEM32>\cdspdll.dll
- %ALLUSERSPROFILE%\Application Data\AgoraNet\ModelTalker\xcept.xp
- <SYSTEM32>\cwavwdll.dll
- <SYSTEM32>\portaudio_x86.dll
- <SYSTEM32>\MTTtsEng.dll
- <SYSTEM32>\libtts.dll
- %ALLUSERSPROFILE%\Application Data\AgoraNet\ModelTalker\newtts.xcp
- %ALLUSERSPROFILE%\Application Data\AgoraNet\ModelTalker\acc.xp
- %ProgramFiles%\ModelTalker\ModelTalker\README1ST.TXT
- %ProgramFiles%\ModelTalker\ModelTalker\grandfather.txt
- %ALLUSERSPROFILE%\Application Data\AgoraNet\ModelTalker\adj.xp
- %ALLUSERSPROFILE%\Application Data\AgoraNet\ModelTalker\cfilt.xp
- %ALLUSERSPROFILE%\Application Data\AgoraNet\ModelTalker\cdur.xp
- %ALLUSERSPROFILE%\Application Data\AgoraNet\ModelTalker\adv.xp
- %ProgramFiles%\ModelTalker\ModelTalker\ModelTalker.hlp
- %ProgramFiles%\ModelTalker\ModelTalker\MT_Manual.html
- %ProgramFiles%\ModelTalker\ModelTalker\rainbow.txt
- %ALLUSERSPROFILE%\Start Menu\Programs\ModelTalker\ModelTalker\Help.lnk
- %ALLUSERSPROFILE%\Desktop\ModelTalker.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\ModelTalker\ModelTalker\ModelTalker.lnk
- %ProgramFiles%\ModelTalker\ModelTalker\ModelTalker.exe
- %ALLUSERSPROFILE%\Application Data\AgoraNet\ModelTalker\lcmp.xp
- %ALLUSERSPROFILE%\Application Data\AgoraNet\ModelTalker\infl2.xp
- %ALLUSERSPROFILE%\Application Data\AgoraNet\ModelTalker\infl.xp
- %ALLUSERSPROFILE%\Application Data\AgoraNet\ModelTalker\lev1.xp
- %ALLUSERSPROFILE%\Application Data\AgoraNet\ModelTalker\newtts.mac
- %ALLUSERSPROFILE%\Application Data\AgoraNet\ModelTalker\mdur.xp
- %ALLUSERSPROFILE%\Application Data\AgoraNet\ModelTalker\lev2.xp
- %ALLUSERSPROFILE%\Application Data\AgoraNet\ModelTalker\ctxt3.xp
- %ALLUSERSPROFILE%\Application Data\AgoraNet\ModelTalker\ctxt2.xp
- %ALLUSERSPROFILE%\Application Data\AgoraNet\ModelTalker\ctxt1.xp
- %ALLUSERSPROFILE%\Application Data\AgoraNet\ModelTalker\ctxt4.xp
- %ALLUSERSPROFILE%\Application Data\AgoraNet\ModelTalker\idur.xp
- %ALLUSERSPROFILE%\Application Data\AgoraNet\ModelTalker\hom.xp
- %ALLUSERSPROFILE%\Application Data\AgoraNet\ModelTalker\func.xp
Удаляет следующие файлы:
- %WINDIR%\Installer\MSI2.tmp
Другое:
Создает и запускает на исполнение:
- '%TEMP%\vcredist_x86.exe' /q:a /c:"msiexec /i vcredist.msi /qb! /l*v %TEMP%\vcredist_x86.log"
Запускает на исполнение:
- '<SYSTEM32>\msiexec.exe' -Embedding 63F55C81D9DBC064B6DCA55127A32216
- '<SYSTEM32>\msiexec.exe' /V
- '<SYSTEM32>\msiexec.exe' /i vcredist.msi /qb! /l*v %TEMP%\vcredist_x86.log
