Техническая информация
Для обеспечения автозапуска и распространения
Устанавливает следующие настройки сервисов
- [<HKLM>\SYSTEM\CurrentControlSet\Services\fltsrv] 'ImagePath' = 'System32\drivers\fltsrv.sys'
- [<HKLM>\SYSTEM\CurrentControlSet\Services\fltsrv] 'Start' = '00000000'
Создает следующие сервисы
- 'fltsrv' System32\drivers\fltsrv.sys
Изменения в файловой системе
Создает следующие файлы
- %TEMP%\ati2021\archive3.dll
- %TEMP%\ati2021\resource.dll
- %TEMP%\ati2021\rpc_client.dll
- %TEMP%\ati2021\system32\drivers\fltsrv.sys
- %TEMP%\ati2021\system32\drivers\snapman.sys
- %TEMP%\ati2021\system32\drivers\volume_tracker.sys
- %TEMP%\ati2021\system32\snapapi.dll
- %TEMP%\ati2021\pcs_io.dll
- %TEMP%\ati2021\re2.dll
- %TEMP%\ati2021\system32\volume_tracker_driver_api.dll
- %TEMP%\ati2021\tib_mounter.dll
- %TEMP%\ati2021\trueimage.exe
- %TEMP%\ati2021\ulxmlrpcpp.dll
- %TEMP%\ati2021\vccorlib120.dll
- %TEMP%\ati2021\winpthreads4.dll
- %TEMP%\ati2021\zstd.dll
- %TEMP%\ati2021\thread_pool.dll
- %TEMP%\ati2021\tib_api.dll
- %TEMP%\ati2021\onig.dll
- %TEMP%\ati2021\oem_doc_source.dll
- %TEMP%\ati2021\msvcr120.dll
- %TEMP%\ati2021\astor_client.dll
- %TEMP%\ati2021\atilauncher.exe
- %TEMP%\ati2021\backup_worker.exe
- %TEMP%\ati2021\boot_assist.dll
- %TEMP%\ati2021\disk_backup.dll
- %TEMP%\ati2021\expat.dll
- %TEMP%\ati2021\file_backup.dll
- %TEMP%\ati2021\archive3_adapter.dll
- %TEMP%\ati2021\fox.dll
- %TEMP%\ati2021\icudt38.dll
- %TEMP%\ati2021\kb_link.dll
- %TEMP%\ati2021\libcrypto10.dll
- %TEMP%\ati2021\libssl10.dll
- %TEMP%\ati2021\logging.dll
- %TEMP%\ati2021\mspack.dll
- %TEMP%\ati2021\msvcp120.dll
- %TEMP%\ati2021\icu38.dll
- %TEMP%\abb9.tmp\atilauncher.bat
- %WINDIR%\syswow64\drivers\fltsrv.sys
Удаляет следующие файлы
- %TEMP%\abb9.tmp\atilauncher.bat
- %TEMP%\ati2021\onig.dll
- %TEMP%\ati2021\pcs_io.dll
- %TEMP%\ati2021\re2.dll
- %TEMP%\ati2021\resource.dll
- %TEMP%\ati2021\rpc_client.dll
- %TEMP%\ati2021\system32\drivers\fltsrv.sys
- %TEMP%\ati2021\system32\drivers\snapman.sys
- %TEMP%\ati2021\system32\snapapi.dll
- %TEMP%\ati2021\winpthreads4.dll
- %TEMP%\ati2021\system32\volume_tracker_driver_api.dll
- %TEMP%\ati2021\thread_pool.dll
- %TEMP%\ati2021\tib_api.dll
- %TEMP%\ati2021\tib_mounter.dll
- %TEMP%\ati2021\trueimage.exe
- %TEMP%\ati2021\ulxmlrpcpp.dll
- %TEMP%\ati2021\vccorlib120.dll
- %TEMP%\ati2021\oem_doc_source.dll
- %TEMP%\ati2021\system32\drivers\volume_tracker.sys
- %TEMP%\ati2021\msvcr120.dll
- %TEMP%\ati2021\expat.dll
- %TEMP%\ati2021\archive3.dll
- %TEMP%\ati2021\archive3_adapter.dll
- %TEMP%\ati2021\astor_client.dll
- %TEMP%\ati2021\atilauncher.exe
- %TEMP%\ati2021\backup_worker.exe
- %TEMP%\ati2021\boot_assist.dll
- %TEMP%\ati2021\disk_backup.dll
- %TEMP%\ati2021\file_backup.dll
- %TEMP%\ati2021\mspack.dll
- %TEMP%\ati2021\fox.dll
- %TEMP%\ati2021\icu38.dll
- %TEMP%\ati2021\icudt38.dll
- %TEMP%\ati2021\kb_link.dll
- %TEMP%\ati2021\libcrypto10.dll
- %TEMP%\ati2021\libssl10.dll
- %TEMP%\ati2021\logging.dll
- %TEMP%\ati2021\msvcp120.dll
- %TEMP%\ati2021\zstd.dll
Другое
Создает и запускает на исполнение
- '%TEMP%\ati2021\atilauncher.exe'
- '%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\ABB9.tmp\ATILauncher.bat" "%TEMP%\ATI2021\ATILauncher.exe""' (со скрытым окном)
Запускает на исполнение
- '%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\ABB9.tmp\ATILauncher.bat" "%TEMP%\ATI2021\ATILauncher.exe""
- '%WINDIR%\syswow64\sc.exe' query fltsrv
- '%WINDIR%\syswow64\reg.exe' add HKLM\SYSTEM\CurrentControlSet\Services\fltsrv /f /v DisplayName /t REG_SZ /d "Acronis Storage Filter Management"
- '%WINDIR%\syswow64\reg.exe' add HKLM\SYSTEM\CurrentControlSet\Services\fltsrv /f /v ImagePath /t REG_EXPAND_SZ /d System32\drivers\fltsrv.sys
- '%WINDIR%\syswow64\reg.exe' add HKLM\SYSTEM\CurrentControlSet\Services\fltsrv /f /v ErrorControl /t REG_DWORD /d 1
- '%WINDIR%\syswow64\reg.exe' add HKLM\SYSTEM\CurrentControlSet\Services\fltsrv /f /v Start /t REG_DWORD /d 0
- '%WINDIR%\syswow64\reg.exe' add HKLM\SYSTEM\CurrentControlSet\Services\fltsrv /f /v Type /t REG_DWORD /d 1
- '%WINDIR%\syswow64\reg.exe' add HKLM\SYSTEM\CurrentControlSet\Services\fltsrv /f /v Group /t REG_SZ /d "PnP Filter"
- '%WINDIR%\syswow64\reg.exe' add HKLM\SYSTEM\CurrentControlSet\Services\fltsrv /f /v Tag /t REG_DWORD /d 8
- '%WINDIR%\syswow64\sc.exe' create fltsrv type= kernel start= boot binpath= System32\drivers\fltsrv.sys
- '%WINDIR%\syswow64\sc.exe' start fltsrv
