Technical Information
Modifies file system
Creates the following files
- %TEMP%\7zs7e7.tmp\setup.exe
- %ProgramFiles(x86)%\dr.batcher\templates\is-a5ep9.tmp
- %ProgramFiles(x86)%\dr.batcher\templates\is-9vkls.tmp
- %ProgramFiles(x86)%\dr.batcher\templates\is-cddtr.tmp
- %ProgramFiles(x86)%\dr.batcher\is-t4m69.tmp
- %ProgramFiles(x86)%\dr.batcher\examples\complex\is-33kak.tmp
- %ProgramFiles(x86)%\dr.batcher\examples\complex\is-vsvnh.tmp
- %ProgramFiles(x86)%\dr.batcher\examples\complex\is-h5jd5.tmp
- %ProgramFiles(x86)%\dr.batcher\examples\complex\is-f7evh.tmp
- %ProgramFiles(x86)%\dr.batcher\examples\more complex\is-slig9.tmp
- %ProgramFiles(x86)%\dr.batcher\examples\more complex\is-ivu0f.tmp
- %ProgramFiles(x86)%\dr.batcher\examples\more complex\is-ua3dv.tmp
- %ProgramFiles(x86)%\dr.batcher\examples\simple\is-0pqin.tmp
- %ProgramFiles(x86)%\dr.batcher\examples\simple\is-5pdhg.tmp
- %ProgramFiles(x86)%\dr.batcher\examples\simple\is-5a1ut.tmp
- %ProgramFiles(x86)%\dr.batcher\templates\is-a4j9e.tmp
- %ProgramFiles(x86)%\dr.batcher\templates\is-1dl80.tmp
- %ProgramFiles(x86)%\dr.batcher\templates\is-ebm9i.tmp
- %ProgramFiles(x86)%\dr.batcher\templates\is-0bj2l.tmp
- %ProgramFiles(x86)%\dr.batcher\templates\is-nnpan.tmp
- %ProgramFiles(x86)%\dr.batcher\templates\is-kpkh7.tmp
- %ProgramFiles(x86)%\dr.batcher\templates\is-d1g91.tmp
- %PROGRAMDATA%\microsoft\windows\start menu\programs\dr.batcher\uninstall dr.batcher.lnk
- %PROGRAMDATA%\microsoft\windows\start menu\programs\dr.batcher\dr.batcher.lnk
- %ProgramFiles(x86)%\dr.batcher\is-9nodr.tmp
- %ProgramFiles(x86)%\dr.batcher\is-0ucvp.tmp
- %APPDATA%\is-vk5b7.tmp
- %ProgramFiles(x86)%\dr.batcher\language\is-gla3i.tmp
- %ProgramFiles(x86)%\dr.batcher\is-c64a9.tmp
- %ProgramFiles(x86)%\dr.batcher\examples\more complex\is-hg06s.tmp
- %ProgramFiles(x86)%\dr.batcher\examples\more complex\is-ebhb4.tmp
- %ProgramFiles(x86)%\dr.batcher\examples\more complex\is-vtci1.tmp
- %ProgramFiles(x86)%\dr.batcher\examples\more complex\is-r132p.tmp
- %ProgramFiles(x86)%\dr.batcher\examples\more complex\is-3sq9v.tmp
- %ProgramFiles(x86)%\dr.batcher\examples\more complex\is-epa82.tmp
- %ProgramFiles(x86)%\dr.batcher\examples\complex\is-jt8va.tmp
- %ProgramFiles(x86)%\dr.batcher\examples\simple\is-qtvqk.tmp
- %ProgramFiles(x86)%\dr.batcher\examples\simple\is-8lf3b.tmp
- %ProgramFiles(x86)%\dr.batcher\templates\is-qldih.tmp
- %ProgramFiles(x86)%\dr.batcher\templates\is-815kd.tmp
- %HOMEPATH%\desktop\dr.batcher.lnk
- %ProgramFiles(x86)%\dr.batcher\templates\is-5rq54.tmp
- %ProgramFiles(x86)%\dr.batcher\templates\is-20tss.tmp
- %ProgramFiles(x86)%\dr.batcher\templates\is-tqsbm.tmp
- %ProgramFiles(x86)%\dr.batcher\examples\is-fovm1.tmp
- %ProgramFiles(x86)%\dr.batcher\templates\is-ac2a5.tmp
- %ProgramFiles(x86)%\dr.batcher\templates\is-62gf1.tmp
- %ProgramFiles(x86)%\dr.batcher\templates\is-0uj4l.tmp
- %ProgramFiles(x86)%\dr.batcher\templates\is-1fn5e.tmp
- %ProgramFiles(x86)%\dr.batcher\language\is-si6dr.tmp
- %ProgramFiles(x86)%\dr.batcher\language\is-4qq4c.tmp
- %ProgramFiles(x86)%\dr.batcher\language\is-sc3ko.tmp
- %ProgramFiles(x86)%\dr.batcher\language\is-l9ul8.tmp
- %ProgramFiles(x86)%\dr.batcher\language\is-5da1k.tmp
- %ProgramFiles(x86)%\dr.batcher\is-7f6po.tmp
- %ProgramFiles(x86)%\dr.batcher\is-r8g80.tmp
- %ProgramFiles(x86)%\dr.batcher\is-dnnln.tmp
- %ProgramFiles(x86)%\dr.batcher\is-chi8n.tmp
- %TEMP%\is-1ss9b.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-1ss9b.tmp\_isetup\_setup64.tmp
- %TEMP%\is-ktpbl.tmp\setup.tmp
- %ProgramFiles(x86)%\dr.batcher\examples\is-6nf6i.tmp
- %ProgramFiles(x86)%\dr.batcher\examples\simple\is-b2k3f.tmp
- %ProgramFiles(x86)%\dr.batcher\examples\simple\is-ua97a.tmp
- %ProgramFiles(x86)%\dr.batcher\examples\simple\is-lr9qo.tmp
- %ProgramFiles(x86)%\dr.batcher\templates\is-r139b.tmp
- %ProgramFiles(x86)%\dr.batcher\language\is-gsdph.tmp
- %ProgramFiles(x86)%\dr.batcher\examples\more complex\is-k2ge1.tmp
- %ProgramFiles(x86)%\dr.batcher\examples\more complex\is-bjff5.tmp
- %ProgramFiles(x86)%\dr.batcher\examples\more complex\is-keq5r.tmp
- %ProgramFiles(x86)%\dr.batcher\examples\more complex\is-di74k.tmp
- %ProgramFiles(x86)%\dr.batcher\examples\more complex\is-san38.tmp
- %ProgramFiles(x86)%\dr.batcher\examples\more complex\is-l8an7.tmp
- %ProgramFiles(x86)%\dr.batcher\examples\more complex\is-jkhne.tmp
- %ProgramFiles(x86)%\dr.batcher\examples\more complex\is-h1dor.tmp
- %ProgramFiles(x86)%\dr.batcher\examples\simple\is-73t3j.tmp
- %ProgramFiles(x86)%\dr.batcher\examples\simple\is-igtb3.tmp
- %ProgramFiles(x86)%\dr.batcher\examples\simple\is-dch4k.tmp
- %ProgramFiles(x86)%\dr.batcher\examples\simple\is-h32v6.tmp
- %ProgramFiles(x86)%\dr.batcher\examples\simple\is-p6obb.tmp
- %ProgramFiles(x86)%\dr.batcher\examples\simple\is-s3ta1.tmp
- %ProgramFiles(x86)%\dr.batcher\examples\simple\is-nbdfd.tmp
- %ProgramFiles(x86)%\dr.batcher\examples\simple\is-re7t5.tmp
- %ProgramFiles(x86)%\dr.batcher\templates\is-d647m.tmp
- %ProgramFiles(x86)%\dr.batcher\unins000.dat
Sets the 'hidden' attribute to the following files
- %ProgramFiles(x86)%\dr.batcher\ser.reg
- %ProgramFiles(x86)%\dr.batcher\reg.exe
Deletes the following files
- %ProgramFiles(x86)%\dr.batcher\examples\simple\find_desktop.bat
- %ProgramFiles(x86)%\dr.batcher\examples\more complex\file_sender.bat
- %TEMP%\is-1ss9b.tmp\_isetup\_setup64.tmp
- %TEMP%\is-1ss9b.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-ktpbl.tmp\setup.tmp
- %TEMP%\7zs7e7.tmp\setup.exe
Moves the following files
- from %ProgramFiles(x86)%\dr.batcher\is-chi8n.tmp to %ProgramFiles(x86)%\dr.batcher\unins000.exe
- from %ProgramFiles(x86)%\dr.batcher\is-t4m69.tmp to %ProgramFiles(x86)%\dr.batcher\batstub.sfx
- from %ProgramFiles(x86)%\dr.batcher\examples\complex\is-33kak.tmp to %ProgramFiles(x86)%\dr.batcher\examples\complex\utf2ansi.bat
- from %ProgramFiles(x86)%\dr.batcher\examples\complex\is-vsvnh.tmp to %ProgramFiles(x86)%\dr.batcher\examples\complex\labyrinth.bat
- from %ProgramFiles(x86)%\dr.batcher\examples\complex\is-h5jd5.tmp to %ProgramFiles(x86)%\dr.batcher\examples\complex\input.txt
- from %ProgramFiles(x86)%\dr.batcher\examples\complex\is-f7evh.tmp to %ProgramFiles(x86)%\dr.batcher\examples\complex\clear_different_system_trash.bat
- from %ProgramFiles(x86)%\dr.batcher\examples\more complex\is-slig9.tmp to %ProgramFiles(x86)%\dr.batcher\examples\more complex\io_errors_redirection.bat
- from %ProgramFiles(x86)%\dr.batcher\examples\more complex\is-ivu0f.tmp to %ProgramFiles(x86)%\dr.batcher\examples\more complex\string_length_calculator.bat
- from %ProgramFiles(x86)%\dr.batcher\examples\more complex\is-ua3dv.tmp to %ProgramFiles(x86)%\dr.batcher\examples\more complex\file_sender.bat
- from %ProgramFiles(x86)%\dr.batcher\examples\simple\is-0pqin.tmp to %ProgramFiles(x86)%\dr.batcher\examples\simple\find_desktop.bat
- from %ProgramFiles(x86)%\dr.batcher\examples\simple\is-5pdhg.tmp to %ProgramFiles(x86)%\dr.batcher\examples\simple\thumbnail_cache_cleaner.bat
- from %ProgramFiles(x86)%\dr.batcher\examples\simple\is-5a1ut.tmp to %ProgramFiles(x86)%\dr.batcher\examples\simple\vpn_connect.bat
- from %ProgramFiles(x86)%\dr.batcher\templates\is-a4j9e.tmp to %ProgramFiles(x86)%\dr.batcher\templates\uninstall activex or com library.tpl
- from %ProgramFiles(x86)%\dr.batcher\templates\is-1dl80.tmp to %ProgramFiles(x86)%\dr.batcher\templates\uninstall activex or com library.ico
- from %ProgramFiles(x86)%\dr.batcher\templates\is-ebm9i.tmp to %ProgramFiles(x86)%\dr.batcher\templates\remove temporary files.tpl
- from %ProgramFiles(x86)%\dr.batcher\templates\is-5rq54.tmp to %ProgramFiles(x86)%\dr.batcher\templates\remove temporary files.ico
- from %ProgramFiles(x86)%\dr.batcher\templates\is-cddtr.tmp to %ProgramFiles(x86)%\dr.batcher\templates\rename files.bat
- from %ProgramFiles(x86)%\dr.batcher\templates\is-a5ep9.tmp to %ProgramFiles(x86)%\dr.batcher\templates\rename files.tpl
- from %ProgramFiles(x86)%\dr.batcher\is-0ucvp.tmp to %ProgramFiles(x86)%\dr.batcher\ser.reg
- from %ProgramFiles(x86)%\dr.batcher\templates\is-0bj2l.tmp to %ProgramFiles(x86)%\dr.batcher\templates\run many programs at once.bat
- from %APPDATA%\is-vk5b7.tmp to %APPDATA%\mwcs.dr_batcher.settings.xml
- from %ProgramFiles(x86)%\dr.batcher\language\is-gla3i.tmp to %ProgramFiles(x86)%\dr.batcher\language\uae.ico
- from %ProgramFiles(x86)%\dr.batcher\is-c64a9.tmp to %ProgramFiles(x86)%\dr.batcher\borlndmm.dll
- from %ProgramFiles(x86)%\dr.batcher\examples\more complex\is-hg06s.tmp to %ProgramFiles(x86)%\dr.batcher\examples\more complex\rar_extract.bat
- from %ProgramFiles(x86)%\dr.batcher\examples\more complex\is-vtci1.tmp to %ProgramFiles(x86)%\dr.batcher\examples\more complex\tomorrow_date.bat
- from %ProgramFiles(x86)%\dr.batcher\examples\more complex\is-ebhb4.tmp to %ProgramFiles(x86)%\dr.batcher\examples\more complex\add_line_to_text_file.bat
- from %ProgramFiles(x86)%\dr.batcher\examples\more complex\is-r132p.tmp to %ProgramFiles(x86)%\dr.batcher\examples\more complex\file_size_calculator_2.bat
- from %ProgramFiles(x86)%\dr.batcher\examples\more complex\is-3sq9v.tmp to %ProgramFiles(x86)%\dr.batcher\examples\more complex\file_size_calculator.bat
- from %ProgramFiles(x86)%\dr.batcher\examples\complex\is-jt8va.tmp to %ProgramFiles(x86)%\dr.batcher\examples\complex\copy_images.bat
- from %ProgramFiles(x86)%\dr.batcher\examples\simple\is-qtvqk.tmp to %ProgramFiles(x86)%\dr.batcher\examples\simple\reg_export.bat
- from %ProgramFiles(x86)%\dr.batcher\templates\is-qldih.tmp to %ProgramFiles(x86)%\dr.batcher\templates\stop many services.tpl
- from %ProgramFiles(x86)%\dr.batcher\templates\is-815kd.tmp to %ProgramFiles(x86)%\dr.batcher\templates\stop many services.ico
- from %ProgramFiles(x86)%\dr.batcher\templates\is-d1g91.tmp to %ProgramFiles(x86)%\dr.batcher\templates\stop many services.bat
- from %ProgramFiles(x86)%\dr.batcher\templates\is-kpkh7.tmp to %ProgramFiles(x86)%\dr.batcher\templates\run many programs at once.tpl
- from %ProgramFiles(x86)%\dr.batcher\templates\is-nnpan.tmp to %ProgramFiles(x86)%\dr.batcher\templates\run many programs at once.ico
- from %ProgramFiles(x86)%\dr.batcher\templates\is-20tss.tmp to %ProgramFiles(x86)%\dr.batcher\templates\install activex or com library.tpl
- from %ProgramFiles(x86)%\dr.batcher\templates\is-9vkls.tmp to %ProgramFiles(x86)%\dr.batcher\templates\rename files.ico
- from %ProgramFiles(x86)%\dr.batcher\templates\is-tqsbm.tmp to %ProgramFiles(x86)%\dr.batcher\templates\install activex or com library.ico
- from %ProgramFiles(x86)%\dr.batcher\examples\simple\is-lr9qo.tmp to %ProgramFiles(x86)%\dr.batcher\examples\simple\clean_temp.bat
- from %ProgramFiles(x86)%\dr.batcher\examples\simple\is-b2k3f.tmp to %ProgramFiles(x86)%\dr.batcher\examples\simple\advanced_files_compare.bat
- from %ProgramFiles(x86)%\dr.batcher\examples\is-6nf6i.tmp to %ProgramFiles(x86)%\dr.batcher\examples\read this file before looking through examples!.txt
- from %ProgramFiles(x86)%\dr.batcher\examples\is-fovm1.tmp to %ProgramFiles(x86)%\dr.batcher\examples\examples - legal notice.txt
- from %ProgramFiles(x86)%\dr.batcher\templates\is-ac2a5.tmp to %ProgramFiles(x86)%\dr.batcher\templates\uninstall activex or com library.bat
- from %ProgramFiles(x86)%\dr.batcher\templates\is-62gf1.tmp to %ProgramFiles(x86)%\dr.batcher\templates\remove temporary files.bat
- from %ProgramFiles(x86)%\dr.batcher\templates\is-0uj4l.tmp to %ProgramFiles(x86)%\dr.batcher\templates\install activex or com library.bat
- from %ProgramFiles(x86)%\dr.batcher\templates\is-1fn5e.tmp to %ProgramFiles(x86)%\dr.batcher\templates\empty batch file.bat
- from %ProgramFiles(x86)%\dr.batcher\language\is-si6dr.tmp to %ProgramFiles(x86)%\dr.batcher\language\default.ico
- from %ProgramFiles(x86)%\dr.batcher\language\is-4qq4c.tmp to %ProgramFiles(x86)%\dr.batcher\language\ext.ico
- from %ProgramFiles(x86)%\dr.batcher\language\is-sc3ko.tmp to %ProgramFiles(x86)%\dr.batcher\language\extcmds.xml
- from %ProgramFiles(x86)%\dr.batcher\language\is-l9ul8.tmp to %ProgramFiles(x86)%\dr.batcher\language\dr_batch.english.lng
- from %ProgramFiles(x86)%\dr.batcher\language\is-5da1k.tmp to %ProgramFiles(x86)%\dr.batcher\language\commands.xml
- from %ProgramFiles(x86)%\dr.batcher\is-7f6po.tmp to %ProgramFiles(x86)%\dr.batcher\help.chm
- from %ProgramFiles(x86)%\dr.batcher\is-r8g80.tmp to %ProgramFiles(x86)%\dr.batcher\langutils.dll
- from %ProgramFiles(x86)%\dr.batcher\is-dnnln.tmp to %ProgramFiles(x86)%\dr.batcher\dr_batch.exe
- from %ProgramFiles(x86)%\dr.batcher\examples\simple\is-ua97a.tmp to %ProgramFiles(x86)%\dr.batcher\examples\simple\check_nt_os.bat
- from %ProgramFiles(x86)%\dr.batcher\examples\simple\is-re7t5.tmp to %ProgramFiles(x86)%\dr.batcher\examples\simple\clear_dns_cache.bat
- from %ProgramFiles(x86)%\dr.batcher\templates\is-r139b.tmp to %ProgramFiles(x86)%\dr.batcher\templates\empty batch file.ico
- from %ProgramFiles(x86)%\dr.batcher\examples\simple\is-nbdfd.tmp to %ProgramFiles(x86)%\dr.batcher\examples\simple\delay.bat
- from %ProgramFiles(x86)%\dr.batcher\language\is-gsdph.tmp to %ProgramFiles(x86)%\dr.batcher\language\dr_batch.arabic.lng
- from %ProgramFiles(x86)%\dr.batcher\examples\more complex\is-k2ge1.tmp to %ProgramFiles(x86)%\dr.batcher\examples\more complex\size_alert.bat
- from %ProgramFiles(x86)%\dr.batcher\examples\more complex\is-bjff5.tmp to %ProgramFiles(x86)%\dr.batcher\examples\more complex\rename_files_and_folders.cmd
- from %ProgramFiles(x86)%\dr.batcher\examples\more complex\is-keq5r.tmp to %ProgramFiles(x86)%\dr.batcher\examples\more complex\merger.bat
- from %ProgramFiles(x86)%\dr.batcher\examples\more complex\is-di74k.tmp to %ProgramFiles(x86)%\dr.batcher\examples\more complex\matrix.bat
- from %ProgramFiles(x86)%\dr.batcher\examples\more complex\is-san38.tmp to %ProgramFiles(x86)%\dr.batcher\examples\more complex\factorial.bat
- from %ProgramFiles(x86)%\dr.batcher\examples\more complex\is-l8an7.tmp to %ProgramFiles(x86)%\dr.batcher\examples\more complex\create_playlists.bat
- from %ProgramFiles(x86)%\dr.batcher\examples\more complex\is-h1dor.tmp to %ProgramFiles(x86)%\dr.batcher\examples\more complex\cab_archiver.bat
- from %ProgramFiles(x86)%\dr.batcher\examples\more complex\is-jkhne.tmp to %ProgramFiles(x86)%\dr.batcher\examples\more complex\beep_maker.bat
- from %ProgramFiles(x86)%\dr.batcher\examples\simple\is-73t3j.tmp to %ProgramFiles(x86)%\dr.batcher\examples\simple\simple_backup.bat
- from %ProgramFiles(x86)%\dr.batcher\examples\simple\is-igtb3.tmp to %ProgramFiles(x86)%\dr.batcher\examples\simple\self_deleting_script.cmd
- from %ProgramFiles(x86)%\dr.batcher\examples\simple\is-dch4k.tmp to %ProgramFiles(x86)%\dr.batcher\examples\simple\numbers_compare.bat
- from %ProgramFiles(x86)%\dr.batcher\examples\simple\is-h32v6.tmp to %ProgramFiles(x86)%\dr.batcher\examples\simple\merge_files.bat
- from %ProgramFiles(x86)%\dr.batcher\examples\simple\is-p6obb.tmp to %ProgramFiles(x86)%\dr.batcher\examples\simple\file_existence_checker.bat
- from %ProgramFiles(x86)%\dr.batcher\examples\simple\is-s3ta1.tmp to %ProgramFiles(x86)%\dr.batcher\examples\simple\delete_files_from_specified_list.bat
- from %ProgramFiles(x86)%\dr.batcher\templates\is-d647m.tmp to %ProgramFiles(x86)%\dr.batcher\templates\empty batch file.tpl
- from %ProgramFiles(x86)%\dr.batcher\is-9nodr.tmp to %ProgramFiles(x86)%\dr.batcher\reg.exe
Substitutes the following files
- %ProgramFiles(x86)%\dr.batcher\examples\simple\find_desktop.bat
- %ProgramFiles(x86)%\dr.batcher\examples\more complex\file_sender.bat
Network activity
TCP
HTTP GET requests
- http://www.dr###cher.com/_news_incl.php
UDP
- DNS ASK dr###cher.com
- DNS ASK ww#.##batcher.com
Miscellaneous
Searches for the following windows
- ClassName: 'RegEdit_RegEdit' WindowName: ''
Creates and executes the following
- '%TEMP%\7zs7e7.tmp\setup.exe' /VERYSILENT /NORESTART
- '%TEMP%\is-ktpbl.tmp\setup.tmp' /SL5="$A0220,5372344,140800,%TEMP%\7zS7E7.tmp\setup.exe" /VERYSILENT /NORESTART
- '%ProgramFiles(x86)%\dr.batcher\reg.exe'
- '%ProgramFiles(x86)%\dr.batcher\dr_batch.exe'
- '%ProgramFiles(x86)%\dr.batcher\reg.exe' ' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\regedit.exe' /s ser.reg
