Technical Information
Modifies file system
Creates the following files
- %TEMP%\e14.tmp\driver_daruma_s700.bat
- %TEMP%\{4ab75936-7fb1-4e97-60be-1f30658f7f29}\i386\set2570.tmp
- %TEMP%\{4ab75936-7fb1-4e97-60be-1f30658f7f29}\set2485.tmp
- %TEMP%\{4ab75936-7fb1-4e97-60be-1f30658f7f29}\set2408.tmp
- %TEMP%\{4ab75936-7fb1-4e97-60be-1f30658f7f29}\amd64\set232c.tmp
- %TEMP%\{4ab75936-7fb1-4e97-60be-1f30658f7f29}\amd64\set229f.tmp
- %TEMP%\{4ab75936-7fb1-4e97-60be-1f30658f7f29}\amd64\set2156.tmp
- %TEMP%\{4ab75936-7fb1-4e97-60be-1f30658f7f29}\amd64\set20c9.tmp
- %TEMP%\e14.tmp\padrao\static\i386\ftd2xx.lib
- %TEMP%\e14.tmp\padrao\static\amd64\ftd2xx.lib
- %TEMP%\e14.tmp\padrao\pnputil.exe
- %TEMP%\e14.tmp\padrao\i386\ftserui2.dll
- %TEMP%\e14.tmp\padrao\i386\ftser2k.sys
- %TEMP%\e14.tmp\padrao\i386\ftlang.dll
- %TEMP%\e14.tmp\padrao\i386\ftdibus.sys
- %TEMP%\e14.tmp\padrao\i386\ftd2xx.lib
- %TEMP%\e14.tmp\padrao\i386\ftd2xx.dll
- %TEMP%\e14.tmp\padrao\i386\ftcserco.dll
- <SYSTEM32>\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\oem2.cat
- %TEMP%\{285bc817-fdd0-0dde-fcf8-db417c59283a}\amd64\set3fae.tmp
- %TEMP%\{285bc817-fdd0-0dde-fcf8-db417c59283a}\amd64\set401c.tmp
- %TEMP%\{285bc817-fdd0-0dde-fcf8-db417c59283a}\amd64\set40aa.tmp
- %TEMP%\e14.tmp\amd64\ftser2k.sys
- %TEMP%\e14.tmp\amd64\ftlang.dll
- %TEMP%\e14.tmp\amd64\ftdibus.sys
- %TEMP%\e14.tmp\amd64\ftd2xx64.dll
- %TEMP%\e14.tmp\amd64\ftd2xx.lib
- %TEMP%\e14.tmp\amd64\ftcserco.dll
- %TEMP%\e14.tmp\amd64\ftbusui.dll
- %TEMP%\e14.tmp\i386\ftserui2.dll
- %TEMP%\e14.tmp\i386\ftlang.dll
- %TEMP%\e14.tmp\i386\ftser2k.sys
- %TEMP%\e14.tmp\i386\ftdibus.sys
- %TEMP%\e14.tmp\i386\ftd2xx.lib
- %TEMP%\e14.tmp\i386\ftd2xx.dll
- %TEMP%\e14.tmp\i386\ftcserco.dll
- %TEMP%\e14.tmp\i386\ftbusui.dll
- <SYSTEM32>\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\oem3.cat
- %TEMP%\{285bc817-fdd0-0dde-fcf8-db417c59283a}\set4148.tmp
- %TEMP%\{285bc817-fdd0-0dde-fcf8-db417c59283a}\set4108.tmp
- %TEMP%\e14.tmp\amd64\ftserui2.dll
- %TEMP%\e14.tmp\padrao\i386\ftbusui.dll
- %TEMP%\e14.tmp\padrao\ftdiport.inf
- %TEMP%\e14.tmp\padrao\ftdiport.cat
- %TEMP%\e14.tmp\informations.txt
- %TEMP%\e14.tmp\informacoes.txt
- %TEMP%\e14.tmp\i386.rar
- %TEMP%\e14.tmp\ftdiport.inf
- %TEMP%\e14.tmp\ftdiport.cat
- %TEMP%\e14.tmp\ftdibus.inf
- %TEMP%\e14.tmp\ftdibus.cat
- %TEMP%\e14.tmp\dpinst-x86-multi.exe
- %TEMP%\e14.tmp\dpinst-x64-multi.exe
- %TEMP%\e14.tmp\dpinst.xml
- %TEMP%\e14.tmp\devcon-x86-multi.exe
- %TEMP%\e14.tmp\devcon-x64-multi.exe
- %TEMP%\e14.tmp\detalhes.txt
- %TEMP%\e14.tmp\darumaframework.exe
- %TEMP%\e14.tmp\darumaframework.dll
- %TEMP%\e14.tmp\certmgr64.exe
- %TEMP%\e14.tmp\certmgr32.exe
- %TEMP%\e14.tmp\logo.ico
- %TEMP%\e14.tmp\logo_daruma.bmp
- %TEMP%\e14.tmp\logo1.ico
- %TEMP%\e14.tmp\padrao.rar
- %TEMP%\e14.tmp\padrao\ftdibus.cat
- %TEMP%\e14.tmp\padrao\ftd2xx.h
- %TEMP%\e14.tmp\padrao\amd64\ftserui2.dll
- %TEMP%\e14.tmp\padrao\amd64\ftser2k.sys
- %TEMP%\e14.tmp\padrao\amd64\ftlang.dll
- %TEMP%\e14.tmp\padrao\amd64\ftdibus.sys
- %TEMP%\e14.tmp\padrao\amd64\ftd2xx64.dll
- %TEMP%\e14.tmp\padrao\amd64\ftd2xx.lib
- %TEMP%\e14.tmp\padrao\amd64\ftbusui.dll
- %TEMP%\e14.tmp\padrao\amd64\ftcserco.dll
- C:\darumaframework\darumaframework.exe
- C:\darumaframework\darumaframework.dll
- %TEMP%\e14.tmp\amd64.rar
- %TEMP%\e14.tmp\magua_daruma.bmp
- %TEMP%\e14.tmp\usbfixaporta.reg
- %TEMP%\e14.tmp\unrar32.exe
- %TEMP%\e14.tmp\unrar.exe
- %TEMP%\e14.tmp\pnputil.exe
- %TEMP%\e14.tmp\padrao\ftdibus.inf
- %WINDIR%\dpinst.log
Sets the 'hidden' attribute to the following files
- <SYSTEM32>\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\oem2.cat
- <SYSTEM32>\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\oem3.cat
Deletes the following files
- %TEMP%\{4ab75936-7fb1-4e97-60be-1f30658f7f29}\amd64\ftbusui.dll
- %TEMP%\{4ab75936-7fb1-4e97-60be-1f30658f7f29}\amd64\ftd2xx64.dll
- %TEMP%\{4ab75936-7fb1-4e97-60be-1f30658f7f29}\amd64\ftdibus.sys
- %TEMP%\{4ab75936-7fb1-4e97-60be-1f30658f7f29}\amd64\ftlang.dll
- %TEMP%\{4ab75936-7fb1-4e97-60be-1f30658f7f29}\ftdibus.cat
- %TEMP%\{4ab75936-7fb1-4e97-60be-1f30658f7f29}\ftdibus.inf
- %TEMP%\{4ab75936-7fb1-4e97-60be-1f30658f7f29}\i386\ftd2xx.dll
- %TEMP%\{285bc817-fdd0-0dde-fcf8-db417c59283a}\amd64\ftcserco.dll
- %TEMP%\{285bc817-fdd0-0dde-fcf8-db417c59283a}\amd64\ftser2k.sys
- %TEMP%\{285bc817-fdd0-0dde-fcf8-db417c59283a}\amd64\ftserui2.dll
- %TEMP%\{285bc817-fdd0-0dde-fcf8-db417c59283a}\ftdiport.cat
- %TEMP%\{285bc817-fdd0-0dde-fcf8-db417c59283a}\ftdiport.inf
Moves the following files
- from %TEMP%\{4ab75936-7fb1-4e97-60be-1f30658f7f29}\amd64\set20c9.tmp to %TEMP%\{4ab75936-7fb1-4e97-60be-1f30658f7f29}\amd64\ftlang.dll
- from %TEMP%\{4ab75936-7fb1-4e97-60be-1f30658f7f29}\amd64\set2156.tmp to %TEMP%\{4ab75936-7fb1-4e97-60be-1f30658f7f29}\amd64\ftd2xx64.dll
- from %TEMP%\{4ab75936-7fb1-4e97-60be-1f30658f7f29}\amd64\set229f.tmp to %TEMP%\{4ab75936-7fb1-4e97-60be-1f30658f7f29}\amd64\ftbusui.dll
- from %TEMP%\{4ab75936-7fb1-4e97-60be-1f30658f7f29}\amd64\set232c.tmp to %TEMP%\{4ab75936-7fb1-4e97-60be-1f30658f7f29}\amd64\ftdibus.sys
- from %TEMP%\{4ab75936-7fb1-4e97-60be-1f30658f7f29}\set2408.tmp to %TEMP%\{4ab75936-7fb1-4e97-60be-1f30658f7f29}\ftdibus.cat
- from %TEMP%\{4ab75936-7fb1-4e97-60be-1f30658f7f29}\set2485.tmp to %TEMP%\{4ab75936-7fb1-4e97-60be-1f30658f7f29}\ftdibus.inf
- from %TEMP%\{4ab75936-7fb1-4e97-60be-1f30658f7f29}\i386\set2570.tmp to %TEMP%\{4ab75936-7fb1-4e97-60be-1f30658f7f29}\i386\ftd2xx.dll
- from %TEMP%\{285bc817-fdd0-0dde-fcf8-db417c59283a}\amd64\set3fae.tmp to %TEMP%\{285bc817-fdd0-0dde-fcf8-db417c59283a}\amd64\ftser2k.sys
- from %TEMP%\{285bc817-fdd0-0dde-fcf8-db417c59283a}\amd64\set401c.tmp to %TEMP%\{285bc817-fdd0-0dde-fcf8-db417c59283a}\amd64\ftserui2.dll
- from %TEMP%\{285bc817-fdd0-0dde-fcf8-db417c59283a}\amd64\set40aa.tmp to %TEMP%\{285bc817-fdd0-0dde-fcf8-db417c59283a}\amd64\ftcserco.dll
- from %TEMP%\{285bc817-fdd0-0dde-fcf8-db417c59283a}\set4108.tmp to %TEMP%\{285bc817-fdd0-0dde-fcf8-db417c59283a}\ftdiport.cat
- from %TEMP%\{285bc817-fdd0-0dde-fcf8-db417c59283a}\set4148.tmp to %TEMP%\{285bc817-fdd0-0dde-fcf8-db417c59283a}\ftdiport.inf
Miscellaneous
Searches for the following windows
- ClassName: 'RegEdit_RegEdit' WindowName: ''
Creates and executes the following
- '%TEMP%\e14.tmp\unrar.exe' x -y "%TEMP%\E14.tmp\\padrao.rar"
- '%TEMP%\e14.tmp\pnputil.exe' -a "%TEMP%\E14.tmp\\padrao\ftdibus.inf"
- '%TEMP%\e14.tmp\pnputil.exe' -a "%TEMP%\E14.tmp\\padrao\ftdiport.inf"
- '%TEMP%\e14.tmp\unrar.exe' x -y "%TEMP%\E14.tmp\\i386.rar"
- '%TEMP%\e14.tmp\unrar.exe' x -y "%TEMP%\E14.tmp\\amd64.rar"
- '%TEMP%\e14.tmp\dpinst-x64-multi.exe' /lm /f /d
- '%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\E14.tmp\Driver_Daruma_S700.bat" "' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\E14.tmp\Driver_Daruma_S700.bat" "
- '%WINDIR%\syswow64\cmd.exe' /c ver
- '%WINDIR%\syswow64\regedit.exe' /s "%TEMP%\E14.tmp\\usbfixaporta.reg"
