Technical Information
To ensure autorun and distribution:
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\WinFirewall2] 'Start' = '00000002'
- [<HKLM>\SYSTEM\ControlSet001\Services\WinFirewall2] 'ImagePath' = '"c:\prime\nssm.exe"'
Modifies file system:
Creates the following files:
- <Current directory>\kit.exe
- C:\prime\blocks\index\000003.log
- C:\prime\chainstate\LOG
- C:\prime\chainstate\000002.dbtmp
- C:\prime\chainstate\MANIFEST-000002
- C:\prime\chainstate\000001.dbtmp
- C:\prime\chainstate\MANIFEST-000001
- C:\prime\blocks\index\LOG
- C:\prime\blocks\index\000002.dbtmp
- C:\prime\blocks\index\MANIFEST-000002
- C:\prime\blocks\index\000001.dbtmp
- C:\prime\blocks\index\MANIFEST-000001
- C:\prime\peers.dat.333f
- C:\prime\__db.80000001.3405dc37
- C:\prime\__db.80000002.1811fb85
- C:\prime\db.log
- C:\prime\debug.log
- C:\prime\wallet.dat
- C:\prime\primecoind.exe
- C:\prime\primecoin.conf
- C:\prime\prime.bat
- C:\prime\nssm.exe
- C:\prime\install.bat
- <Current directory>\winrar-64Bit-400.exe
- <Current directory>\winrar-32Bit-400.exe
- <Current directory>\ReadMe.txt
- <Current directory>\rarreg.key
- C:\prime\database\log.0000000001
- C:\prime\blocks\blk00000.dat
Deletes the following files:
- C:\prime\database\log.0000000001
- C:\prime\blocks\index\CURRENT
- C:\prime\blocks\index\MANIFEST-000001
- C:\prime\chainstate\CURRENT
- C:\prime\chainstate\MANIFEST-000001
Moves the following files:
- from C:\prime\wallet.dat to C:\prime\wallet.1529089374.bak
- from C:\prime\wallet.dat to C:\prime\wallet.dat.del.0486265758
- from C:\prime\peers.dat.333f to C:\prime\peers.dat
- from C:\prime\blocks\index\000001.dbtmp to C:\prime\blocks\index\CURRENT
- from C:\prime\blocks\index\000002.dbtmp to C:\prime\blocks\index\CURRENT
- from C:\prime\chainstate\000001.dbtmp to C:\prime\chainstate\CURRENT
- from C:\prime\chainstate\000002.dbtmp to C:\prime\chainstate\CURRENT
Substitutes the following files:
- C:\prime\wallet.dat
- C:\prime\blocks\index\CURRENT
- C:\prime\chainstate\CURRENT
- C:\prime\database\log.0000000001
Network activity:
Connects to:
- 'se##.ppcoin.net':9911
- 'dn#####.xpm.altcointech.net':9911
- 'dn#####.#pm2.altcointech.net':9911
UDP:
- DNS ASK se##.ppcoin.net
- DNS ASK pr###coin.net
- DNS ASK dn#####.xpm.altcointech.net
- DNS ASK xp#.##tcointech.net
- DNS ASK dn#####.#pm2.altcointech.net
- DNS ASK xp##.##tcointech.net
Miscellaneous:
Searches for the following windows:
- ClassName: 'EDIT' WindowName: ''
Creates and executes the following:
- '<Current directory>\kit.exe'
- 'C:\prime\nssm.exe' install WinFirewall2 c:\prime\prime.bat"
- 'C:\prime\nssm.exe'
- 'C:\prime\primecoind.exe' -datadir=c:\prime -reindex -rescan -listen=0
Executes the following:
- '<SYSTEM32>\cmd.exe' /c ""c:\prime\install.bat" "
- '<SYSTEM32>\sc.exe' start WinFirewall2
- '<SYSTEM32>\cmd.exe' /c ""c:\prime\prime.bat" "
