Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKLM\Software\Classes\UPDFReader\shell\open\command] '' = '"%ProgramFiles(x86)%\PDF Unshare\updfreader.exe" "%1" %*'
Modifies file system
Creates the following files
- %TEMP%\aut41ef.tmp
- %ProgramFiles(x86)%\pdf unshare\data\is-4jaml.tmp
- %ProgramFiles(x86)%\pdf unshare\data\is-ghdcm.tmp
- %ProgramFiles(x86)%\pdf unshare\data\is-umeh6.tmp
- %ProgramFiles(x86)%\pdf unshare\data\is-fmumq.tmp
- %ProgramFiles(x86)%\pdf unshare\data\is-5lbv6.tmp
- %ProgramFiles(x86)%\pdf unshare\data\is-4d46e.tmp
- %ProgramFiles(x86)%\pdf unshare\data\is-q7isq.tmp
- %ProgramFiles(x86)%\pdf unshare\is-k1ubo.tmp
- %ProgramFiles(x86)%\pdf unshare\data\is-vog81.tmp
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\pdf unshare\pdf unshare.lnk
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\pdf unshare\pdf unshare on the web.url
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\pdf unshare\uninstall pdf unshare.lnk
- C:\users\public\desktop\pdf unshare.lnk
- C:\users\public\desktop\updf reader.lnk
- %APPDATA%\microsoft\internet explorer\quick launch\pdf unshare.lnk
- %ProgramFiles(x86)%\pdf unshare\unins000.dat
- %ProgramFiles(x86)%\pdf unshare\data\is-f6efp.tmp
- %ProgramFiles(x86)%\pdf unshare\data\is-elr8t.tmp
- %ProgramFiles(x86)%\pdf unshare\data\is-jchbd.tmp
- %ProgramFiles(x86)%\pdf unshare\is-ngp30.tmp
- %ALLUSERSPROFILE%\puverify\is-cgdli.tmp
- %TEMP%\is-vh3dv.tmp\~wxeiqwv.tmp
- %TEMP%\is-js4vr.tmp\_isetup\_setup64.tmp
- %TEMP%\is-js4vr.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-js4vr.tmp\isxdl.dll
- %ProgramFiles(x86)%\pdf unshare\is-ggi9t.tmp
- %ProgramFiles(x86)%\pdf unshare\is-58mfh.tmp
- %ProgramFiles(x86)%\pdf unshare\is-hmrbs.tmp
- %TEMP%\aut566a.tmp
- %ProgramFiles(x86)%\pdf unshare\data\is-ofe8c.tmp
- %ProgramFiles(x86)%\pdf unshare\is-rhbqq.tmp
- %ProgramFiles(x86)%\pdf unshare\is-obkvb.tmp
- %ProgramFiles(x86)%\pdf unshare\is-tjqb7.tmp
- %ProgramFiles(x86)%\pdf unshare\is-g1f8q.tmp
- %ProgramFiles(x86)%\pdf unshare\is-58282.tmp
- %TEMP%\is-js4vr.tmp\is-m7ssf.tmp
- %APPDATA%\is-61krr.tmp
- %APPDATA%\is-r8imu.tmp
- %CommonProgramFiles(x86)%\~wxeiqwv.tmp
- %ProgramFiles(x86)%\pdf unshare\is-tv3vk.tmp
- %ProgramFiles(x86)%\pdf unshare\pdfunshare.exe
Sets the 'hidden' attribute to the following files
- %CommonProgramFiles(x86)%\~wxeiqwv.tmp
Deletes the following files
- %TEMP%\aut41ef.tmp
- %TEMP%\is-js4vr.tmp\check1.txt
- %TEMP%\is-js4vr.tmp\isxdl.dll
- %TEMP%\is-js4vr.tmp\_isetup\_setup64.tmp
- %TEMP%\is-js4vr.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-vh3dv.tmp\~wxeiqwv.tmp
- %TEMP%\aut566a.tmp
- %CommonProgramFiles(x86)%\~wxeiqwv.tmp
Moves the following files
- from %ProgramFiles(x86)%\pdf unshare\is-ggi9t.tmp to %ProgramFiles(x86)%\pdf unshare\unins000.exe
- from %ProgramFiles(x86)%\pdf unshare\data\is-q7isq.tmp to %ProgramFiles(x86)%\pdf unshare\data\qpdf17.dll
- from %ProgramFiles(x86)%\pdf unshare\data\is-4d46e.tmp to %ProgramFiles(x86)%\pdf unshare\data\qpdf.exe
- from %ProgramFiles(x86)%\pdf unshare\data\is-5lbv6.tmp to %ProgramFiles(x86)%\pdf unshare\data\pdftoxpd.dll
- from %ProgramFiles(x86)%\pdf unshare\data\is-fmumq.tmp to %ProgramFiles(x86)%\pdf unshare\data\pdftk.exe
- from %ProgramFiles(x86)%\pdf unshare\data\is-umeh6.tmp to %ProgramFiles(x86)%\pdf unshare\data\libstdc++-6.dll
- from %ProgramFiles(x86)%\pdf unshare\data\is-ghdcm.tmp to %ProgramFiles(x86)%\pdf unshare\data\libgcc_s_dw2-1.dll
- from %ProgramFiles(x86)%\pdf unshare\data\is-4jaml.tmp to %ProgramFiles(x86)%\pdf unshare\data\gsdll32.lib
- from %ProgramFiles(x86)%\pdf unshare\data\is-elr8t.tmp to %ProgramFiles(x86)%\pdf unshare\data\gsdll32.dll
- from %ProgramFiles(x86)%\pdf unshare\data\is-f6efp.tmp to %ProgramFiles(x86)%\pdf unshare\data\gs.exe
- from %ProgramFiles(x86)%\pdf unshare\data\is-jchbd.tmp to %ProgramFiles(x86)%\pdf unshare\data\fix-qdf
- from %ProgramFiles(x86)%\pdf unshare\is-ngp30.tmp to %ProgramFiles(x86)%\pdf unshare\ionic.zip.dll
- from %ProgramFiles(x86)%\pdf unshare\data\is-vog81.tmp to %ProgramFiles(x86)%\pdf unshare\data\qpdf3.dll
- from %ALLUSERSPROFILE%\puverify\is-cgdli.tmp to %ALLUSERSPROFILE%\puverify\check1.txt
- from %APPDATA%\is-61krr.tmp to %APPDATA%\pusound.dll
- from %TEMP%\is-js4vr.tmp\is-m7ssf.tmp to %TEMP%\is-js4vr.tmp\check1.txt
- from %ProgramFiles(x86)%\pdf unshare\is-58282.tmp to %ProgramFiles(x86)%\pdf unshare\create.dat
- from %ProgramFiles(x86)%\pdf unshare\is-g1f8q.tmp to %ProgramFiles(x86)%\pdf unshare\updf.ico
- from %ProgramFiles(x86)%\pdf unshare\is-tjqb7.tmp to %ProgramFiles(x86)%\pdf unshare\updfreader.exe.config
- from %ProgramFiles(x86)%\pdf unshare\is-obkvb.tmp to %ProgramFiles(x86)%\pdf unshare\updfreader.exe
- from %ProgramFiles(x86)%\pdf unshare\is-tv3vk.tmp to %ProgramFiles(x86)%\pdf unshare\pdfunshare.exe.config
- from %ProgramFiles(x86)%\pdf unshare\is-k1ubo.tmp to %ProgramFiles(x86)%\pdf unshare\pdftoxpd.dll
- from %ProgramFiles(x86)%\pdf unshare\is-rhbqq.tmp to %ProgramFiles(x86)%\pdf unshare\itextsharp.dll
- from %ProgramFiles(x86)%\pdf unshare\is-hmrbs.tmp to %ProgramFiles(x86)%\pdf unshare\itextsharp.xtra.dll
- from %ProgramFiles(x86)%\pdf unshare\is-58mfh.tmp to %ProgramFiles(x86)%\pdf unshare\pdfunshare.exe
- from %APPDATA%\is-r8imu.tmp to %APPDATA%\pulan.ini
- from %ProgramFiles(x86)%\pdf unshare\data\is-ofe8c.tmp to %ProgramFiles(x86)%\pdf unshare\data\zlib-flate.exe
Miscellaneous
Creates and executes the following
- '%CommonProgramFiles(x86)%\~wxeiqwv.tmp' /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-
- '%TEMP%\is-vh3dv.tmp\~wxeiqwv.tmp' /SL5="$40240,14396966,498688,%CommonProgramFiles(x86)%\~wxeiqwv.tmp" /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-
