Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Easy Driver Pro' = '%ProgramFiles(x86)%\Probit Software\Easy Driver Pro\EDPTray.exe'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'EasySpeedCheck' = '%ProgramFiles(x86)%\Easy Speed Check\easyspeedcheck.exe'
Creates or modifies the following files
- <SYSTEM32>\tasks\easy driver pro schedule
Modifies file system
Creates the following files
- %TEMP%\nsm9727.tmp\system.dll
- %TEMP%\nseb667.tmp\start_install.txt
- %TEMP%\nseb667.tmp\7za.exe
- %ProgramFiles(x86)%\easy speed check\esc.ico
- %ProgramFiles(x86)%\easy speed check\uninstall.exe
- %TEMP%\nseb667.tmp\easyspeedcheck.data
- %TEMP%\nseb667.tmp\nsexec.dll
- %ProgramFiles(x86)%\easy speed check\cwebpage.dll
- %ProgramFiles(x86)%\easy speed check\libgcc_s_dw2-1.dll
- %ProgramFiles(x86)%\easy speed check\zlib1.dll
- %ProgramFiles(x86)%\easy speed check\libidn-11.dll
- %ProgramFiles(x86)%\easy speed check\libcurl.dll
- %ProgramFiles(x86)%\probit software\easy driver pro\base\devices.ini
- %ProgramFiles(x86)%\easy speed check\libstdc++-6.dll
- %ProgramFiles(x86)%\easy speed check\libeay32.dll
- %ProgramFiles(x86)%\easy speed check\easyspeedcheck.exe
- %TEMP%\nseb667.tmp\temp.txt
- %TEMP%\nsm9727.tmp\temp.txt
- %ProgramFiles(x86)%\probit software\easy driver pro\base\pcinfo.ini
- %ProgramFiles(x86)%\probit software\easy driver pro\base\drivers.7z
- %ProgramFiles(x86)%\probit software\easy driver pro\base\drivers.db
- %ProgramFiles(x86)%\probit software\easy driver pro\base\drivers.db-journal
- %TEMP%\etilqs_pbjsp46unhzvlgg
- %TEMP%\nseb667.tmp\inetc.dll
- %ProgramFiles(x86)%\easy speed check\ssleay32.dll
- %TEMP%\nseb667.tmp\system.dll
- %TEMP%\nsm9727.tmp\easydriverpro.data
- %TEMP%\nsm9727.tmp\inetc.dll
- %TEMP%\nsm9727.tmp\start_install.txt
- %TEMP%\nsm9727.tmp\7za.exe
- %ProgramFiles(x86)%\probit software\easy driver pro\easydriverpro.chm
- %ProgramFiles(x86)%\probit software\easy driver pro\english.ini
- %ProgramFiles(x86)%\probit software\easy driver pro\scan.gif
- %ProgramFiles(x86)%\probit software\easy driver pro\file_id.diz
- %ProgramFiles(x86)%\probit software\easy driver pro\homepage.url
- %ProgramFiles(x86)%\probit software\easy driver pro\edp.ico
- %ProgramFiles(x86)%\probit software\easy driver pro\uninstall.exe
- %TEMP%\nsm9727.tmp\nsexec.dll
- %APPDATA%\microsoft\windows\start menu\programs\easy driver pro on the web.lnk
- %ProgramFiles(x86)%\probit software\easy driver pro\base\exclusions.txt
- %ProgramFiles(x86)%\probit software\easy driver pro\base\vendors.txt
- %ProgramFiles(x86)%\probit software\easy driver pro\sqlite3.dll
- %ProgramFiles(x86)%\probit software\easy driver pro\edptray.exe
- %ProgramFiles(x86)%\probit software\easy driver pro\7z.dll
- %ProgramFiles(x86)%\probit software\easy driver pro\easydriverpro.exe
- %TEMP%\nsm9727.tmp\md5dll.dll
- %APPDATA%\microsoft\windows\start menu\programs\easy driver pro.lnk
- %APPDATA%\microsoft\windows\start menu\programs\uninstall.lnk
- %APPDATA%\microsoft\windows\start menu\programs\help.lnk
- %TEMP%\nsm9727.tmp\easyspeedchecksetup.exe
- %ProgramFiles(x86)%\probit software\easy driver pro\base\scan.ini
Deletes the following files
- %TEMP%\nseb667.tmp\7za.exe
- %TEMP%\nsm9727.tmp\system.dll
- %TEMP%\nsm9727.tmp\start_install.txt
- %TEMP%\nsm9727.tmp\nsexec.dll
- %TEMP%\nsm9727.tmp\md5dll.dll
- %TEMP%\nsm9727.tmp\inetc.dll
- %TEMP%\nsm9727.tmp\easyspeedchecksetup.exe
- %TEMP%\nsm9727.tmp\temp.txt
- %TEMP%\nsm9727.tmp\easydriverpro.data
- %TEMP%\nseb667.tmp\temp.txt
- %TEMP%\nseb667.tmp\system.dll
- %TEMP%\nseb667.tmp\start_install.txt
- %TEMP%\nseb667.tmp\nsexec.dll
- %TEMP%\nseb667.tmp\inetc.dll
- %TEMP%\nseb667.tmp\easyspeedcheck.data
- %TEMP%\nsm9727.tmp\7za.exe
- %ProgramFiles(x86)%\probit software\easy driver pro\base\drivers.db-journal
Network activity
Connects to
- 'ea####iverpro.com':80
TCP
HTTP GET requests
- http://www.ea####iverpro.com/easyinstallprolib/easyinstallprolog/log-install.php?in#############################################
- http://do######.easydriverpro.com/easydriverpro820.data
- http://do######.easyspeedcheck.com/publishers/3/815/EasySpeedCheckSetup.exe
- http://www.ea####eedcheck.com/easyinstallprolib/easyinstallprolog/log-install.php?in#############################################
- http://do######.easyspeedcheck.com/easyspeedcheck_1_1_3.data
- http://www.ea####eedcheck.com/easyinstallprolib/easyinstallprolog/log-install.php?in################################################################
- http://www.ea####iverpro.com/easyinstallprolib/easyinstallprolog/log-install.php?in#####################################################################
- http://se#####.smartpcupdate.com/rpc/getdatabasezx?ar##########
- http://d2.####tpcupdate.com/dbs/current_7_64_zx.7z
- http://se#####.smartpcupdate.com/rpc/sendinstall?pa################################
- http://www.ea####eedcheck.com/applib/appmsg/appmsg.php
HTTP POST requests
- http://www.ea####eedcheck.com/applib/appmsg/appmsg.php
UDP
- DNS ASK ea####iverpro.com
- DNS ASK do######.easydriverpro.com
- DNS ASK do######.easyspeedcheck.com
- DNS ASK ea####eedcheck.com
- DNS ASK se#####.smartpcupdate.com
- DNS ASK d2.####tpcupdate.com
Miscellaneous
Searches for the following windows
- ClassName: 'EasySpeedCheckMainWindow123msfd8712ins1' WindowName: ''
- ClassName: '' WindowName: 'Easy Speed PC'
- ClassName: 'EasySpeedCheckMainWindow123msfd8712ins1' WindowName: 'EasySpeedCheckMainWindow123msfd8712ins1'
Creates and executes the following
- '%TEMP%\nsm9727.tmp\7za.exe' x -y -o"%ProgramFiles(x86)%\Probit Software\Easy Driver Pro" %TEMP%\nsm9727.tmp\easydriverpro.data
- '%TEMP%\nsm9727.tmp\easyspeedchecksetup.exe'
- '%TEMP%\nseb667.tmp\7za.exe' e -y -o"%ProgramFiles(x86)%\Easy Speed Check" %TEMP%\nseB667.tmp\easyspeedcheck.data
- '%ProgramFiles(x86)%\easy speed check\easyspeedcheck.exe'
- '%ProgramFiles(x86)%\probit software\easy driver pro\easydriverpro.exe' /START
- '%TEMP%\nsm9727.tmp\7za.exe' x -y -o"%ProgramFiles(x86)%\Probit Software\Easy Driver Pro" %TEMP%\nsm9727.tmp\easydriverpro.data' (with hidden window)
- '%TEMP%\nseb667.tmp\7za.exe' e -y -o"%ProgramFiles(x86)%\Easy Speed Check" %TEMP%\nseB667.tmp\easyspeedcheck.data' (with hidden window)
- '%WINDIR%\syswow64\schtasks.exe' /Create /TN "Easy Driver Pro Schedule" /TR "\"%ProgramFiles(x86)%\Probit Software\Easy Driver Pro\EDPTray.exe\"" /SC ONLOGON /RL HIGHEST /F' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\schtasks.exe' /Create /TN "Easy Driver Pro Schedule" /TR "\"%ProgramFiles(x86)%\Probit Software\Easy Driver Pro\EDPTray.exe\"" /SC ONLOGON /RL HIGHEST /F
