Trojan.MulDrop24.41852

Technical Information

To ensure autorun and distribution

Creates or modifies the following files

<SYSTEM32>\tasks\wdna_lg
<SYSTEM32>\tasks\wdna

Modifies file system

Creates the following files

%TEMP%\is-di0df.tmp\<File name>.tmp
%LOCALAPPDATA%\vtt\v2519\lang\is-arkhb.tmp
%LOCALAPPDATA%\vtt\v2519\lang\is-dm0ln.tmp
%LOCALAPPDATA%\vtt\v2519\lang\is-389fr.tmp
%LOCALAPPDATA%\vtt\v2519\lang\is-8nq7k.tmp
%LOCALAPPDATA%\vtt\v2519\lang\is-i7d8p.tmp
%LOCALAPPDATA%\vtt\v2519\lang\is-lhh1s.tmp
%LOCALAPPDATA%\vtt\v2519\lang\is-lc2vi.tmp
%LOCALAPPDATA%\vtt\v2519\lang\is-40vl7.tmp
%LOCALAPPDATA%\vtt\v2519\lang\is-5v81m.tmp
%LOCALAPPDATA%\vtt\v2519\lang\is-j367n.tmp
%LOCALAPPDATA%\vtt\v2519\lang\is-lg7b5.tmp
%LOCALAPPDATA%\vtt\v2519\lang\is-ac7u8.tmp
%LOCALAPPDATA%\vtt\v2519\lang\is-0rbvu.tmp
%LOCALAPPDATA%\vtt\v2519\lang\is-v0djl.tmp
%LOCALAPPDATA%\vtt\v2519\lang\is-7c0ed.tmp
%LOCALAPPDATA%\vtt\v2519\lang\is-g1sdg.tmp
%LOCALAPPDATA%\vtt\v2519\lang\is-0s575.tmp
%LOCALAPPDATA%\vtt\v2519\lang\is-f69up.tmp
%LOCALAPPDATA%\vtt\v2519\lang\is-cq048.tmp
%LOCALAPPDATA%\vtt\v2519\lang\is-eapun.tmp
%LOCALAPPDATA%\vtt\v2519\lang\is-st33j.tmp
%LOCALAPPDATA%\vtt\v2519\lang\is-tq592.tmp
%LOCALAPPDATA%\vtt\v2519\lang\is-h0mnq.tmp
%LOCALAPPDATA%\vtt\v2519\lang\is-gqq17.tmp
%LOCALAPPDATA%\vtt\v2519\lang\is-stfkj.tmp
%LOCALAPPDATA%\vtt\v2519\lang\is-175nm.tmp
%LOCALAPPDATA%\vtt\v2519\lang\is-efeie.tmp
%LOCALAPPDATA%\vtt\v2519\lang\is-136gb.tmp
%LOCALAPPDATA%\vtt\v2519\lang\is-nq0v7.tmp
%LOCALAPPDATA%\vtt\v2519\lang\is-phr7q.tmp
%LOCALAPPDATA%\vtt\v2519\lang\is-bbk9u.tmp
%LOCALAPPDATA%\vtt\v2519\lang\is-ip68s.tmp
%LOCALAPPDATA%\vtt\v2519\lang\is-cof8p.tmp
%LOCALAPPDATA%\vtt\v2519\lang\is-vbg2l.tmp
%LOCALAPPDATA%\vtt\v2519\lang\is-1tv79.tmp
%LOCALAPPDATA%\vtt\v2519\lang\is-d6aeh.tmp
%LOCALAPPDATA%\vtt\v2519\lang\is-h4842.tmp
%LOCALAPPDATA%\vtt\v2519\lang\is-9o062.tmp
%LOCALAPPDATA%\vtt\v2519\lang\is-rfiv6.tmp
%LOCALAPPDATA%\vtt\v2519\lang\is-34t92.tmp
%LOCALAPPDATA%\vtt\v2519\lang\is-j6rjm.tmp
%LOCALAPPDATA%\vtt\v2519\lang\is-qbpok.tmp
%LOCALAPPDATA%\vtt\v2519\lang\is-a7nqd.tmp
%LOCALAPPDATA%\vtt\v2519\ext\is-7h0fq.tmp
%LOCALAPPDATA%\vtt\v2519\lang\is-tf0n5.tmp
%LOCALAPPDATA%\vtt\v2519\lang\is-2h35f.tmp
%LOCALAPPDATA%\vtt\v2519\lang\is-43anh.tmp
%LOCALAPPDATA%\vtt\v2519\lang\is-r298j.tmp
%LOCALAPPDATA%\vtt\v2519\lang\is-vmki7.tmp
%LOCALAPPDATA%\vtt\v2519\lang\is-qoi7j.tmp
%LOCALAPPDATA%\vtt\v2519\lang\is-js8cl.tmp
%LOCALAPPDATA%\vtt\v2519\lang\is-aj896.tmp
%LOCALAPPDATA%\vtt\v2519\lib\enchant\is-28584.tmp
%LOCALAPPDATA%\vtt\v2519\lib\enchant\is-8ihk4.tmp
%LOCALAPPDATA%\vtt\v2519\lang\is-5fq5n.tmp
%LOCALAPPDATA%\vtt\v2519\sasl2\is-p9169.tmp
%LOCALAPPDATA%\vtt\v2519\sasl2\is-0s1eu.tmp
%LOCALAPPDATA%\vtt\v2519\sasl2\is-ddn53.tmp
%LOCALAPPDATA%\vtt\v2519\sasl2\is-3mn66.tmp
%LOCALAPPDATA%\vtt\v2519\sasl2\is-ih16r.tmp
%LOCALAPPDATA%\vtt\v2519\sasl2\is-iqcic.tmp
%LOCALAPPDATA%\vtt\v2519\sasl2\is-8mbl9.tmp
%LOCALAPPDATA%\vtt\v2519\sasl2\is-vlei3.tmp
%LOCALAPPDATA%\vtt\v2519\lang\is-7fkpr.tmp
%LOCALAPPDATA%\vtt\v2519\lang\is-prq96.tmp
%LOCALAPPDATA%\vtt\v2519\lang\is-2g3op.tmp
%LOCALAPPDATA%\vtt\v2519\lang\is-qkekt.tmp
%LOCALAPPDATA%\vtt\v2519\lang\is-q8tu3.tmp
%LOCALAPPDATA%\vtt\v2519\lang\is-vonur.tmp
%LOCALAPPDATA%\vtt\v2519\lang\is-ep3dl.tmp
%LOCALAPPDATA%\vtt\v2519\lang\is-pcet8.tmp
%LOCALAPPDATA%\vtt\v2519\lang\is-k23ng.tmp
%LOCALAPPDATA%\vtt\v2519\lang\is-1asnu.tmp
%LOCALAPPDATA%\vtt\v2519\lang\is-damce.tmp
%LOCALAPPDATA%\vtt\v2519\lang\is-c7de4.tmp
%LOCALAPPDATA%\vtt\v2519\lang\is-requq.tmp
%LOCALAPPDATA%\vtt\v2519\lang\is-pqla6.tmp
%LOCALAPPDATA%\vtt\v2519\lang\is-lr9rg.tmp
%LOCALAPPDATA%\vtt\v2519\lang\is-jp900.tmp
%LOCALAPPDATA%\vtt\v2519\lang\is-cpll2.tmp
%LOCALAPPDATA%\vtt\v2519\lang\is-e8271.tmp
%LOCALAPPDATA%\vtt\v2519\lang\is-bgptp.tmp
%LOCALAPPDATA%\vtt\v2519\lang\is-5h82r.tmp
%LOCALAPPDATA%\vtt\v2519\lang\is-cmcsb.tmp
%LOCALAPPDATA%\vtt\v2519\lang\is-c72t7.tmp
%LOCALAPPDATA%\vtt\v2519\lang\is-7mf7r.tmp
%LOCALAPPDATA%\vtt\v2519\lang\is-etbs6.tmp
%LOCALAPPDATA%\vtt\v2519\lang\is-9fkp7.tmp
%LOCALAPPDATA%\vtt\v2519\lang\is-gmddj.tmp
%LOCALAPPDATA%\vtt\v2519\lang\is-8gl4h.tmp
%LOCALAPPDATA%\vtt\v2519\lang\is-umaro.tmp
%LOCALAPPDATA%\vtt\v2519\lang\is-21n5t.tmp
%LOCALAPPDATA%\vtt\v2519\lang\is-9dpkp.tmp
%LOCALAPPDATA%\vtt\v2519\is-cqdfq.tmp
%LOCALAPPDATA%\vtt\v2519\is-i4at0.tmp
%LOCALAPPDATA%\vtt\v2519\is-b4vv4.tmp
%LOCALAPPDATA%\vtt\v2519\is-6rrb4.tmp
%LOCALAPPDATA%\vtt\v2519\is-hp6dc.tmp
%LOCALAPPDATA%\vtt\v2519\is-mhgnr.tmp
%LOCALAPPDATA%\vtt\v2519\is-reb8c.tmp
%LOCALAPPDATA%\vtt\v2519\is-siq8a.tmp
%LOCALAPPDATA%\vtt\v2519\is-p41a7.tmp
%LOCALAPPDATA%\vtt\v2519\is-saov0.tmp
%LOCALAPPDATA%\vtt\v2519\dev\is-6isv8.tmp
%LOCALAPPDATA%\vtt\v2519\ext\is-6rtpm.tmp
%LOCALAPPDATA%\vtt\v2519\ext\is-3c9s2.tmp
%LOCALAPPDATA%\vtt\v2519\ext\is-3klv8.tmp
%LOCALAPPDATA%\vtt\v2519\ext\is-oe93g.tmp
%LOCALAPPDATA%\vtt\v2519\ext\is-gp1u0.tmp
%LOCALAPPDATA%\vtt\v2519\ext\is-ei3sm.tmp
%LOCALAPPDATA%\vtt\v2519\is-3h7ln.tmp
%LOCALAPPDATA%\vtt\v2519\is-9stmd.tmp
%LOCALAPPDATA%\vtt\v2519\is-vdmne.tmp
%LOCALAPPDATA%\vtt\v2519\is-avkvo.tmp
%LOCALAPPDATA%\vtt\v2519\is-mb0aj.tmp
%LOCALAPPDATA%\vtt\v2519\is-6cgb6.tmp
%TEMP%\is-164dl.tmp\<File name>.tmp
%TEMP%\is-7db4v.tmp\_isetup\_setup64.tmp
%LOCALAPPDATA%\vtt\v2519\is-kgacq.tmp
%LOCALAPPDATA%\vtt\v2519\is-r9lc6.tmp
%LOCALAPPDATA%\vtt\v2519\is-2su2d.tmp
%LOCALAPPDATA%\vtt\v2519\is-45afm.tmp
%LOCALAPPDATA%\vtt\v2519\is-ltl9e.tmp
%LOCALAPPDATA%\vtt\v2519\is-vuiub.tmp
%LOCALAPPDATA%\vtt\v2519\ext\is-s1ipb.tmp
%LOCALAPPDATA%\vtt\v2519\sasl2\is-s7a9d.tmp
%LOCALAPPDATA%\vtt\v2519\is-83lc3.tmp
%LOCALAPPDATA%\vtt\v2519\is-9c8jk.tmp
%LOCALAPPDATA%\vtt\v2519\is-ilplg.tmp
%LOCALAPPDATA%\vtt\v2519\is-batl6.tmp
%LOCALAPPDATA%\vtt\v2519\is-2e32t.tmp
%LOCALAPPDATA%\vtt\v2519\is-lktjp.tmp
%LOCALAPPDATA%\vtt\v2519\is-3u75b.tmp
%LOCALAPPDATA%\vtt\v2519\is-8lnff.tmp
%LOCALAPPDATA%\vtt\v2519\is-9ijt9.tmp
%TEMP%\is-rhu67.tmp\_isetup\_setup64.tmp
%LOCALAPPDATA%\vtt\v2519\is-m899s.tmp
%LOCALAPPDATA%\vtt\v2519\sasl2\is-e4fgb.tmp
%LOCALAPPDATA%\vtt\v2519\ext\is-mkuot.tmp
%LOCALAPPDATA%\vtt\v2519\ext\is-vl677.tmp
%LOCALAPPDATA%\vtt\v2519\ext\is-qdrst.tmp
%LOCALAPPDATA%\vtt\v2519\ext\is-61qf6.tmp
%LOCALAPPDATA%\vtt\v2519\ext\is-2ebdq.tmp
%LOCALAPPDATA%\vtt\v2519\ext\is-b40n7.tmp
%LOCALAPPDATA%\vtt\v2519\ext\is-grlni.tmp
%LOCALAPPDATA%\vtt\v2519\extras\ssl\is-13rfe.tmp
%LOCALAPPDATA%\vtt\v2519\lang\is-b4fm3.tmp
%LOCALAPPDATA%\vtt\v2519\is-nc47q.tmp
%LOCALAPPDATA%\vtt\v2519\lang\is-jli3l.tmp
%LOCALAPPDATA%\vtt\v2519\lang\is-7narv.tmp
%LOCALAPPDATA%\vtt\v2519\lang\is-cekbn.tmp
%LOCALAPPDATA%\vtt\v2519\lang\is-qb02n.tmp
%LOCALAPPDATA%\vtt\v2519\lang\is-ngfuv.tmp
%LOCALAPPDATA%\vtt\v2519\lang\is-ijhqg.tmp
%LOCALAPPDATA%\vtt\v2519\lang\is-cuvbd.tmp
%LOCALAPPDATA%\vtt\v2519\lang\is-ek045.tmp
%LOCALAPPDATA%\vtt\v2519\lang\is-hktl7.tmp
%LOCALAPPDATA%\vtt\v2519\ext\is-h6gpe.tmp
%LOCALAPPDATA%\vtt\v2519\lang\is-s4p4l.tmp
%LOCALAPPDATA%\vtt\v2519\ext\is-j8rhm.tmp
%LOCALAPPDATA%\vtt\v2519\ext\is-2ssa3.tmp
%LOCALAPPDATA%\vtt\v2519\ext\is-mc5du.tmp
%LOCALAPPDATA%\vtt\v2519\ext\is-1dpba.tmp
%LOCALAPPDATA%\vtt\v2519\ext\is-8snug.tmp
%LOCALAPPDATA%\vtt\v2519\ext\is-to857.tmp
%LOCALAPPDATA%\vtt\v2519\ext\is-l8n20.tmp
%LOCALAPPDATA%\vtt\v2519\ext\is-40uq5.tmp
%LOCALAPPDATA%\vtt\v2519\ext\is-l7vs6.tmp
%LOCALAPPDATA%\vtt\v2519\ext\is-81gkk.tmp
%LOCALAPPDATA%\vtt\v2519\ext\is-j75m2.tmp
%LOCALAPPDATA%\vtt\v2519\ext\is-5ca81.tmp
%LOCALAPPDATA%\vtt\v2519\ext\is-9gt1f.tmp
%LOCALAPPDATA%\vtt\v2519\ext\is-kap9q.tmp
%LOCALAPPDATA%\vtt\v2519\ext\is-ts31q.tmp
%LOCALAPPDATA%\vtt\v2519\ext\is-fg8gu.tmp
%LOCALAPPDATA%\vtt\v2519\ext\is-jrns5.tmp
%LOCALAPPDATA%\vtt\v2519\ext\is-gmdqg.tmp
%LOCALAPPDATA%\vtt\v2519\ext\is-nghhe.tmp
%LOCALAPPDATA%\vtt\v2519\ext\is-k1q0a.tmp
%LOCALAPPDATA%\vtt\v2519\ext\is-t5pnv.tmp
%LOCALAPPDATA%\vtt\v2519\ext\is-5jbgf.tmp
%LOCALAPPDATA%\vtt\v2519\ext\is-9hp20.tmp
%LOCALAPPDATA%\vtt\v2519\ext\is-f1bm7.tmp
%LOCALAPPDATA%\vtt\v2519\ext\is-eqeeu.tmp
%LOCALAPPDATA%\vtt\v2519\unins000.dat

Deletes the following files

%TEMP%\is-rhu67.tmp\_isetup\_setup64.tmp
%TEMP%\is-di0df.tmp\<File name>.tmp
%TEMP%\is-7db4v.tmp\_isetup\_setup64.tmp
%TEMP%\is-164dl.tmp\<File name>.tmp

Moves the following files

from %LOCALAPPDATA%\vtt\v2519\is-kgacq.tmp to %LOCALAPPDATA%\vtt\v2519\unins000.exe
from %LOCALAPPDATA%\vtt\v2519\lang\is-dm0ln.tmp to %LOCALAPPDATA%\vtt\v2519\lang\ja.txt
from %LOCALAPPDATA%\vtt\v2519\lang\is-389fr.tmp to %LOCALAPPDATA%\vtt\v2519\lang\ka.txt
from %LOCALAPPDATA%\vtt\v2519\lang\is-8nq7k.tmp to %LOCALAPPDATA%\vtt\v2519\lang\kaa.txt
from %LOCALAPPDATA%\vtt\v2519\lang\is-i7d8p.tmp to %LOCALAPPDATA%\vtt\v2519\lang\kab.txt
from %LOCALAPPDATA%\vtt\v2519\lang\is-lhh1s.tmp to %LOCALAPPDATA%\vtt\v2519\lang\kk.txt
from %LOCALAPPDATA%\vtt\v2519\lang\is-lc2vi.tmp to %LOCALAPPDATA%\vtt\v2519\lang\ko.txt
from %LOCALAPPDATA%\vtt\v2519\lang\is-40vl7.tmp to %LOCALAPPDATA%\vtt\v2519\lang\ku-ckb.txt
from %LOCALAPPDATA%\vtt\v2519\lang\is-eapun.tmp to %LOCALAPPDATA%\vtt\v2519\lang\is.txt
from %LOCALAPPDATA%\vtt\v2519\lang\is-arkhb.tmp to %LOCALAPPDATA%\vtt\v2519\lang\it.txt
from %LOCALAPPDATA%\vtt\v2519\lang\is-j367n.tmp to %LOCALAPPDATA%\vtt\v2519\lang\ku.txt
from %LOCALAPPDATA%\vtt\v2519\lang\is-ac7u8.tmp to %LOCALAPPDATA%\vtt\v2519\lang\lt.txt
from %LOCALAPPDATA%\vtt\v2519\lang\is-0rbvu.tmp to %LOCALAPPDATA%\vtt\v2519\lang\lv.txt
from %LOCALAPPDATA%\vtt\v2519\lang\is-v0djl.tmp to %LOCALAPPDATA%\vtt\v2519\lang\mk.txt
from %LOCALAPPDATA%\vtt\v2519\lang\is-7c0ed.tmp to %LOCALAPPDATA%\vtt\v2519\lang\mn.txt
from %LOCALAPPDATA%\vtt\v2519\lang\is-g1sdg.tmp to %LOCALAPPDATA%\vtt\v2519\lang\mng.txt
from %LOCALAPPDATA%\vtt\v2519\lang\is-0s575.tmp to %LOCALAPPDATA%\vtt\v2519\lang\mng2.txt
from %LOCALAPPDATA%\vtt\v2519\lang\is-f69up.tmp to %LOCALAPPDATA%\vtt\v2519\lang\mr.txt
from %LOCALAPPDATA%\vtt\v2519\lang\is-st33j.tmp to %LOCALAPPDATA%\vtt\v2519\lang\ky.txt
from %LOCALAPPDATA%\vtt\v2519\lang\is-lg7b5.tmp to %LOCALAPPDATA%\vtt\v2519\lang\lij.txt
from %LOCALAPPDATA%\vtt\v2519\lang\is-cq048.tmp to %LOCALAPPDATA%\vtt\v2519\lang\io.txt
from %LOCALAPPDATA%\vtt\v2519\lang\is-a7nqd.tmp to %LOCALAPPDATA%\vtt\v2519\lang\id.txt
from %LOCALAPPDATA%\vtt\v2519\lang\is-j6rjm.tmp to %LOCALAPPDATA%\vtt\v2519\lang\hy.txt
from %LOCALAPPDATA%\vtt\v2519\lang\is-gqq17.tmp to %LOCALAPPDATA%\vtt\v2519\lang\en.ttt
from %LOCALAPPDATA%\vtt\v2519\lang\is-stfkj.tmp to %LOCALAPPDATA%\vtt\v2519\lang\eo.txt
from %LOCALAPPDATA%\vtt\v2519\lang\is-175nm.tmp to %LOCALAPPDATA%\vtt\v2519\lang\es.txt
from %LOCALAPPDATA%\vtt\v2519\lang\is-efeie.tmp to %LOCALAPPDATA%\vtt\v2519\lang\et.txt
from %LOCALAPPDATA%\vtt\v2519\lang\is-136gb.tmp to %LOCALAPPDATA%\vtt\v2519\lang\eu.txt
from %LOCALAPPDATA%\vtt\v2519\lang\is-nq0v7.tmp to %LOCALAPPDATA%\vtt\v2519\lang\ext.txt
from %LOCALAPPDATA%\vtt\v2519\lang\is-phr7q.tmp to %LOCALAPPDATA%\vtt\v2519\lang\fa.txt
from %LOCALAPPDATA%\vtt\v2519\lang\is-bbk9u.tmp to %LOCALAPPDATA%\vtt\v2519\lang\fi.txt
from %LOCALAPPDATA%\vtt\v2519\lang\is-jp900.tmp to %LOCALAPPDATA%\vtt\v2519\lang\el.txt
from %LOCALAPPDATA%\vtt\v2519\lang\is-ip68s.tmp to %LOCALAPPDATA%\vtt\v2519\lang\fr.txt
from %LOCALAPPDATA%\vtt\v2519\lang\is-vbg2l.tmp to %LOCALAPPDATA%\vtt\v2519\lang\fy.txt
from %LOCALAPPDATA%\vtt\v2519\lang\is-1tv79.tmp to %LOCALAPPDATA%\vtt\v2519\lang\ga.txt
from %LOCALAPPDATA%\vtt\v2519\lang\is-d6aeh.tmp to %LOCALAPPDATA%\vtt\v2519\lang\gl.txt
from %LOCALAPPDATA%\vtt\v2519\lang\is-h4842.tmp to %LOCALAPPDATA%\vtt\v2519\lang\gu.txt
from %LOCALAPPDATA%\vtt\v2519\lang\is-9o062.tmp to %LOCALAPPDATA%\vtt\v2519\lang\he.txt
from %LOCALAPPDATA%\vtt\v2519\lang\is-rfiv6.tmp to %LOCALAPPDATA%\vtt\v2519\lang\hi.txt
from %LOCALAPPDATA%\vtt\v2519\lang\is-34t92.tmp to %LOCALAPPDATA%\vtt\v2519\lang\hr.txt
from %LOCALAPPDATA%\vtt\v2519\lang\is-h0mnq.tmp to %LOCALAPPDATA%\vtt\v2519\lang\hu.txt
from %LOCALAPPDATA%\vtt\v2519\lang\is-cof8p.tmp to %LOCALAPPDATA%\vtt\v2519\lang\fur.txt
from %LOCALAPPDATA%\vtt\v2519\lang\is-tq592.tmp to %LOCALAPPDATA%\vtt\v2519\lang\ms.txt
from %LOCALAPPDATA%\vtt\v2519\lang\is-5v81m.tmp to %LOCALAPPDATA%\vtt\v2519\lang\nb.txt
from %LOCALAPPDATA%\vtt\v2519\lang\is-tf0n5.tmp to %LOCALAPPDATA%\vtt\v2519\lang\ne.txt
from %LOCALAPPDATA%\vtt\v2519\lang\is-5fq5n.tmp to %LOCALAPPDATA%\vtt\v2519\lang\nl.txt
from %LOCALAPPDATA%\vtt\v2519\lang\is-7fkpr.tmp to %LOCALAPPDATA%\vtt\v2519\lang\ug.txt
from %LOCALAPPDATA%\vtt\v2519\lang\is-2h35f.tmp to %LOCALAPPDATA%\vtt\v2519\lang\uk.txt
from %LOCALAPPDATA%\vtt\v2519\lang\is-2g3op.tmp to %LOCALAPPDATA%\vtt\v2519\lang\uz-cyrl.txt
from %LOCALAPPDATA%\vtt\v2519\lang\is-43anh.tmp to %LOCALAPPDATA%\vtt\v2519\lang\uz.txt
from %LOCALAPPDATA%\vtt\v2519\lang\is-r298j.tmp to %LOCALAPPDATA%\vtt\v2519\lang\va.txt
from %LOCALAPPDATA%\vtt\v2519\lang\is-vmki7.tmp to %LOCALAPPDATA%\vtt\v2519\lang\vi.txt
from %LOCALAPPDATA%\vtt\v2519\lang\is-qoi7j.tmp to %LOCALAPPDATA%\vtt\v2519\lang\yo.txt
from %LOCALAPPDATA%\vtt\v2519\lang\is-js8cl.tmp to %LOCALAPPDATA%\vtt\v2519\lang\zh-cn.txt
from %LOCALAPPDATA%\vtt\v2519\lang\is-aj896.tmp to %LOCALAPPDATA%\vtt\v2519\lang\zh-tw.txt
from %LOCALAPPDATA%\vtt\v2519\lib\enchant\is-28584.tmp to %LOCALAPPDATA%\vtt\v2519\lib\enchant\libenchant_ispell.dll
from %LOCALAPPDATA%\vtt\v2519\lib\enchant\is-8ihk4.tmp to %LOCALAPPDATA%\vtt\v2519\lib\enchant\libenchant_myspell.dll
from %LOCALAPPDATA%\vtt\v2519\sasl2\is-p9169.tmp to %LOCALAPPDATA%\vtt\v2519\sasl2\saslanonymous.dll
from %LOCALAPPDATA%\vtt\v2519\sasl2\is-e4fgb.tmp to %LOCALAPPDATA%\vtt\v2519\sasl2\saslcrammd5.dll
from %LOCALAPPDATA%\vtt\v2519\sasl2\is-0s1eu.tmp to %LOCALAPPDATA%\vtt\v2519\sasl2\sasldigestmd5.dll
from %LOCALAPPDATA%\vtt\v2519\sasl2\is-ddn53.tmp to %LOCALAPPDATA%\vtt\v2519\sasl2\sasllogin.dll
from %LOCALAPPDATA%\vtt\v2519\sasl2\is-3mn66.tmp to %LOCALAPPDATA%\vtt\v2519\sasl2\saslntlm.dll
from %LOCALAPPDATA%\vtt\v2519\sasl2\is-ih16r.tmp to %LOCALAPPDATA%\vtt\v2519\sasl2\saslotp.dll
from %LOCALAPPDATA%\vtt\v2519\sasl2\is-iqcic.tmp to %LOCALAPPDATA%\vtt\v2519\sasl2\saslplain.dll
from %LOCALAPPDATA%\vtt\v2519\sasl2\is-8mbl9.tmp to %LOCALAPPDATA%\vtt\v2519\sasl2\saslsasldb.dll
from %LOCALAPPDATA%\vtt\v2519\lang\is-prq96.tmp to %LOCALAPPDATA%\vtt\v2519\lang\tt.txt
from %LOCALAPPDATA%\vtt\v2519\lang\is-q8tu3.tmp to %LOCALAPPDATA%\vtt\v2519\lang\tk.txt
from %LOCALAPPDATA%\vtt\v2519\lang\is-qkekt.tmp to %LOCALAPPDATA%\vtt\v2519\lang\tr.txt
from %LOCALAPPDATA%\vtt\v2519\lang\is-etbs6.tmp to %LOCALAPPDATA%\vtt\v2519\lang\th.txt
from %LOCALAPPDATA%\vtt\v2519\lang\is-vonur.tmp to %LOCALAPPDATA%\vtt\v2519\lang\nn.txt
from %LOCALAPPDATA%\vtt\v2519\lang\is-gmddj.tmp to %LOCALAPPDATA%\vtt\v2519\lang\pa-in.txt
from %LOCALAPPDATA%\vtt\v2519\lang\is-ep3dl.tmp to %LOCALAPPDATA%\vtt\v2519\lang\pl.txt
from %LOCALAPPDATA%\vtt\v2519\lang\is-pcet8.tmp to %LOCALAPPDATA%\vtt\v2519\lang\ps.txt
from %LOCALAPPDATA%\vtt\v2519\lang\is-k23ng.tmp to %LOCALAPPDATA%\vtt\v2519\lang\pt-br.txt
from %LOCALAPPDATA%\vtt\v2519\lang\is-1asnu.tmp to %LOCALAPPDATA%\vtt\v2519\lang\pt.txt
from %LOCALAPPDATA%\vtt\v2519\lang\is-damce.tmp to %LOCALAPPDATA%\vtt\v2519\lang\ro.txt
from %LOCALAPPDATA%\vtt\v2519\lang\is-c7de4.tmp to %LOCALAPPDATA%\vtt\v2519\lang\ru.txt
from %LOCALAPPDATA%\vtt\v2519\lang\is-requq.tmp to %LOCALAPPDATA%\vtt\v2519\lang\sa.txt
from %LOCALAPPDATA%\vtt\v2519\lang\is-lr9rg.tmp to %LOCALAPPDATA%\vtt\v2519\lang\si.txt
from %LOCALAPPDATA%\vtt\v2519\lang\is-9fkp7.tmp to %LOCALAPPDATA%\vtt\v2519\lang\sk.txt
from %LOCALAPPDATA%\vtt\v2519\lang\is-cpll2.tmp to %LOCALAPPDATA%\vtt\v2519\lang\sl.txt
from %LOCALAPPDATA%\vtt\v2519\lang\is-8gl4h.tmp to %LOCALAPPDATA%\vtt\v2519\lang\sq.txt
from %LOCALAPPDATA%\vtt\v2519\lang\is-e8271.tmp to %LOCALAPPDATA%\vtt\v2519\lang\sr-spc.txt
from %LOCALAPPDATA%\vtt\v2519\lang\is-bgptp.tmp to %LOCALAPPDATA%\vtt\v2519\lang\sr-spl.txt
from %LOCALAPPDATA%\vtt\v2519\lang\is-5h82r.tmp to %LOCALAPPDATA%\vtt\v2519\lang\sv.txt
from %LOCALAPPDATA%\vtt\v2519\lang\is-cmcsb.tmp to %LOCALAPPDATA%\vtt\v2519\lang\sw.txt
from %LOCALAPPDATA%\vtt\v2519\lang\is-c72t7.tmp to %LOCALAPPDATA%\vtt\v2519\lang\ta.txt
from %LOCALAPPDATA%\vtt\v2519\lang\is-7mf7r.tmp to %LOCALAPPDATA%\vtt\v2519\lang\tg.txt
from %LOCALAPPDATA%\vtt\v2519\sasl2\is-vlei3.tmp to %LOCALAPPDATA%\vtt\v2519\sasl2\saslscram.dll
from %LOCALAPPDATA%\vtt\v2519\lang\is-qbpok.tmp to %LOCALAPPDATA%\vtt\v2519\lang\de.txt
from %LOCALAPPDATA%\vtt\v2519\lang\is-pqla6.tmp to %LOCALAPPDATA%\vtt\v2519\lang\da.txt
from %LOCALAPPDATA%\vtt\v2519\lang\is-umaro.tmp to %LOCALAPPDATA%\vtt\v2519\lang\cy.txt
from %LOCALAPPDATA%\vtt\v2519\is-b4vv4.tmp to %LOCALAPPDATA%\vtt\v2519\php7.dll
from %LOCALAPPDATA%\vtt\v2519\is-6rrb4.tmp to %LOCALAPPDATA%\vtt\v2519\php7embed.lib
from %LOCALAPPDATA%\vtt\v2519\is-hp6dc.tmp to %LOCALAPPDATA%\vtt\v2519\php7phpdbg.dll
from %LOCALAPPDATA%\vtt\v2519\is-mhgnr.tmp to %LOCALAPPDATA%\vtt\v2519\rhc.exe
from %LOCALAPPDATA%\vtt\v2519\is-reb8c.tmp to %LOCALAPPDATA%\vtt\v2519\tag
from %LOCALAPPDATA%\vtt\v2519\is-siq8a.tmp to %LOCALAPPDATA%\vtt\v2519\time.ps1
from %LOCALAPPDATA%\vtt\v2519\is-p41a7.tmp to %LOCALAPPDATA%\vtt\v2519\vcruntime140.dll
from %LOCALAPPDATA%\vtt\v2519\is-cqdfq.tmp to %LOCALAPPDATA%\vtt\v2519\php.gif
from %LOCALAPPDATA%\vtt\v2519\is-i4at0.tmp to %LOCALAPPDATA%\vtt\v2519\php.ini
from %LOCALAPPDATA%\vtt\v2519\is-saov0.tmp to %LOCALAPPDATA%\vtt\v2519\version.php
from %LOCALAPPDATA%\vtt\v2519\ext\is-3c9s2.tmp to %LOCALAPPDATA%\vtt\v2519\ext\php_com_dotnet.dll
from %LOCALAPPDATA%\vtt\v2519\ext\is-3klv8.tmp to %LOCALAPPDATA%\vtt\v2519\ext\php_curl.dll
from %LOCALAPPDATA%\vtt\v2519\ext\is-oe93g.tmp to %LOCALAPPDATA%\vtt\v2519\ext\php_dba.dll
from %LOCALAPPDATA%\vtt\v2519\ext\is-gp1u0.tmp to %LOCALAPPDATA%\vtt\v2519\ext\php_enchant.dll
from %LOCALAPPDATA%\vtt\v2519\ext\is-ei3sm.tmp to %LOCALAPPDATA%\vtt\v2519\ext\php_exif.dll
from %LOCALAPPDATA%\vtt\v2519\ext\is-s1ipb.tmp to %LOCALAPPDATA%\vtt\v2519\ext\php_fileinfo.dll
from %LOCALAPPDATA%\vtt\v2519\ext\is-mkuot.tmp to %LOCALAPPDATA%\vtt\v2519\ext\php_ftp.dll
from %LOCALAPPDATA%\vtt\v2519\dev\is-6isv8.tmp to %LOCALAPPDATA%\vtt\v2519\dev\php7.lib
from %LOCALAPPDATA%\vtt\v2519\ext\is-6rtpm.tmp to %LOCALAPPDATA%\vtt\v2519\ext\php_bz2.dll
from %LOCALAPPDATA%\vtt\v2519\is-vdmne.tmp to %LOCALAPPDATA%\vtt\v2519\php.exe
from %LOCALAPPDATA%\vtt\v2519\is-nc47q.tmp to %LOCALAPPDATA%\vtt\v2519\pharcommand.phar
from %LOCALAPPDATA%\vtt\v2519\is-3h7ln.tmp to %LOCALAPPDATA%\vtt\v2519\phar.phar.bat
from %LOCALAPPDATA%\vtt\v2519\is-2su2d.tmp to %LOCALAPPDATA%\vtt\v2519\descript.ion
from %LOCALAPPDATA%\vtt\v2519\is-45afm.tmp to %LOCALAPPDATA%\vtt\v2519\glib-2.dll
from %LOCALAPPDATA%\vtt\v2519\is-ltl9e.tmp to %LOCALAPPDATA%\vtt\v2519\gmodule-2.dll
from %LOCALAPPDATA%\vtt\v2519\is-vuiub.tmp to %LOCALAPPDATA%\vtt\v2519\icuin60.dll
from %LOCALAPPDATA%\vtt\v2519\is-83lc3.tmp to %LOCALAPPDATA%\vtt\v2519\icuio60.dll
from %LOCALAPPDATA%\vtt\v2519\is-6cgb6.tmp to %LOCALAPPDATA%\vtt\v2519\icutu60.dll
from %LOCALAPPDATA%\vtt\v2519\is-m899s.tmp to %LOCALAPPDATA%\vtt\v2519\icuuc60.dll
from %LOCALAPPDATA%\vtt\v2519\is-9c8jk.tmp to %LOCALAPPDATA%\vtt\v2519\include.php
from %LOCALAPPDATA%\vtt\v2519\is-r9lc6.tmp to %LOCALAPPDATA%\vtt\v2519\cdma.ps1
from %LOCALAPPDATA%\vtt\v2519\is-ilplg.tmp to %LOCALAPPDATA%\vtt\v2519\index.php
from %LOCALAPPDATA%\vtt\v2519\is-2e32t.tmp to %LOCALAPPDATA%\vtt\v2519\libenchant.dll
from %LOCALAPPDATA%\vtt\v2519\is-lktjp.tmp to %LOCALAPPDATA%\vtt\v2519\libpq.dll
from %LOCALAPPDATA%\vtt\v2519\is-3u75b.tmp to %LOCALAPPDATA%\vtt\v2519\libsasl.dll
from %LOCALAPPDATA%\vtt\v2519\is-8lnff.tmp to %LOCALAPPDATA%\vtt\v2519\libsodium.dll
from %LOCALAPPDATA%\vtt\v2519\is-9ijt9.tmp to %LOCALAPPDATA%\vtt\v2519\libssh2.dll
from %LOCALAPPDATA%\vtt\v2519\is-mb0aj.tmp to %LOCALAPPDATA%\vtt\v2519\libssl-1_1-x64.dll
from %LOCALAPPDATA%\vtt\v2519\is-9stmd.tmp to %LOCALAPPDATA%\vtt\v2519\news.txt
from %LOCALAPPDATA%\vtt\v2519\is-avkvo.tmp to %LOCALAPPDATA%\vtt\v2519\nghttp2.dll
from %LOCALAPPDATA%\vtt\v2519\is-batl6.tmp to %LOCALAPPDATA%\vtt\v2519\libcrypto-1_1-x64.dll
from %LOCALAPPDATA%\vtt\v2519\ext\is-5ca81.tmp to %LOCALAPPDATA%\vtt\v2519\ext\php_gd2.dll
from %LOCALAPPDATA%\vtt\v2519\ext\is-kap9q.tmp to %LOCALAPPDATA%\vtt\v2519\ext\php_gettext.dll
from %LOCALAPPDATA%\vtt\v2519\ext\is-9hp20.tmp to %LOCALAPPDATA%\vtt\v2519\ext\php_gmp.dll
from %LOCALAPPDATA%\vtt\v2519\ext\is-vl677.tmp to %LOCALAPPDATA%\vtt\v2519\ext\php_imap.dll
from %LOCALAPPDATA%\vtt\v2519\ext\is-j8rhm.tmp to %LOCALAPPDATA%\vtt\v2519\ext\php_sqlite3.dll
from %LOCALAPPDATA%\vtt\v2519\ext\is-qdrst.tmp to %LOCALAPPDATA%\vtt\v2519\ext\php_sysvshm.dll
from %LOCALAPPDATA%\vtt\v2519\ext\is-61qf6.tmp to %LOCALAPPDATA%\vtt\v2519\ext\php_tidy.dll
from %LOCALAPPDATA%\vtt\v2519\ext\is-2ebdq.tmp to %LOCALAPPDATA%\vtt\v2519\ext\php_xmlrpc.dll
from %LOCALAPPDATA%\vtt\v2519\ext\is-b40n7.tmp to %LOCALAPPDATA%\vtt\v2519\ext\php_xsl.dll
from %LOCALAPPDATA%\vtt\v2519\ext\is-grlni.tmp to %LOCALAPPDATA%\vtt\v2519\ext\php_zend_test.dll
from %LOCALAPPDATA%\vtt\v2519\extras\ssl\is-13rfe.tmp to %LOCALAPPDATA%\vtt\v2519\extras\ssl\openssl.cnf
from %LOCALAPPDATA%\vtt\v2519\lang\is-b4fm3.tmp to %LOCALAPPDATA%\vtt\v2519\lang\af.txt
from %LOCALAPPDATA%\vtt\v2519\lang\is-jli3l.tmp to %LOCALAPPDATA%\vtt\v2519\lang\an.txt
from %LOCALAPPDATA%\vtt\v2519\lang\is-s4p4l.tmp to %LOCALAPPDATA%\vtt\v2519\lang\ar.txt
from %LOCALAPPDATA%\vtt\v2519\lang\is-7narv.tmp to %LOCALAPPDATA%\vtt\v2519\lang\ast.txt
from %LOCALAPPDATA%\vtt\v2519\lang\is-cekbn.tmp to %LOCALAPPDATA%\vtt\v2519\lang\az.txt
from %LOCALAPPDATA%\vtt\v2519\lang\is-qb02n.tmp to %LOCALAPPDATA%\vtt\v2519\lang\ba.txt
from %LOCALAPPDATA%\vtt\v2519\lang\is-ngfuv.tmp to %LOCALAPPDATA%\vtt\v2519\lang\be.txt
from %LOCALAPPDATA%\vtt\v2519\lang\is-ijhqg.tmp to %LOCALAPPDATA%\vtt\v2519\lang\bg.txt
from %LOCALAPPDATA%\vtt\v2519\lang\is-cuvbd.tmp to %LOCALAPPDATA%\vtt\v2519\lang\bn.txt
from %LOCALAPPDATA%\vtt\v2519\lang\is-ek045.tmp to %LOCALAPPDATA%\vtt\v2519\lang\br.txt
from %LOCALAPPDATA%\vtt\v2519\lang\is-hktl7.tmp to %LOCALAPPDATA%\vtt\v2519\lang\ca.txt
from %LOCALAPPDATA%\vtt\v2519\lang\is-9dpkp.tmp to %LOCALAPPDATA%\vtt\v2519\lang\co.txt
from %LOCALAPPDATA%\vtt\v2519\ext\is-2ssa3.tmp to %LOCALAPPDATA%\vtt\v2519\ext\php_sodium.dll
from %LOCALAPPDATA%\vtt\v2519\ext\is-mc5du.tmp to %LOCALAPPDATA%\vtt\v2519\ext\php_soap.dll
from %LOCALAPPDATA%\vtt\v2519\ext\is-h6gpe.tmp to %LOCALAPPDATA%\vtt\v2519\ext\php_sockets.dll
from %LOCALAPPDATA%\vtt\v2519\ext\is-1dpba.tmp to %LOCALAPPDATA%\vtt\v2519\ext\php_snmp.dll
from %LOCALAPPDATA%\vtt\v2519\ext\is-8snug.tmp to %LOCALAPPDATA%\vtt\v2519\ext\php_interbase.dll
from %LOCALAPPDATA%\vtt\v2519\ext\is-to857.tmp to %LOCALAPPDATA%\vtt\v2519\ext\php_intl.dll
from %LOCALAPPDATA%\vtt\v2519\ext\is-l8n20.tmp to %LOCALAPPDATA%\vtt\v2519\ext\php_ioncube.dll
from %LOCALAPPDATA%\vtt\v2519\ext\is-40uq5.tmp to %LOCALAPPDATA%\vtt\v2519\ext\php_ldap.dll
from %LOCALAPPDATA%\vtt\v2519\ext\is-l7vs6.tmp to %LOCALAPPDATA%\vtt\v2519\ext\php_mbstring.dll
from %LOCALAPPDATA%\vtt\v2519\ext\is-81gkk.tmp to %LOCALAPPDATA%\vtt\v2519\ext\php_mysqli.dll
from %LOCALAPPDATA%\vtt\v2519\ext\is-j75m2.tmp to %LOCALAPPDATA%\vtt\v2519\ext\php_oci8_12c.dll
from %LOCALAPPDATA%\vtt\v2519\ext\is-9gt1f.tmp to %LOCALAPPDATA%\vtt\v2519\ext\php_odbc.dll
from %LOCALAPPDATA%\vtt\v2519\ext\is-7h0fq.tmp to %LOCALAPPDATA%\vtt\v2519\ext\php_opcache.dll
from %LOCALAPPDATA%\vtt\v2519\ext\is-ts31q.tmp to %LOCALAPPDATA%\vtt\v2519\ext\php_openssl.dll
from %LOCALAPPDATA%\vtt\v2519\ext\is-eqeeu.tmp to %LOCALAPPDATA%\vtt\v2519\ext\php_pdo_firebird.dll
from %LOCALAPPDATA%\vtt\v2519\ext\is-fg8gu.tmp to %LOCALAPPDATA%\vtt\v2519\ext\php_pdo_mysql.dll
from %LOCALAPPDATA%\vtt\v2519\ext\is-jrns5.tmp to %LOCALAPPDATA%\vtt\v2519\ext\php_pdo_oci.dll
from %LOCALAPPDATA%\vtt\v2519\ext\is-gmdqg.tmp to %LOCALAPPDATA%\vtt\v2519\ext\php_pdo_odbc.dll
from %LOCALAPPDATA%\vtt\v2519\ext\is-nghhe.tmp to %LOCALAPPDATA%\vtt\v2519\ext\php_pdo_pgsql.dll
from %LOCALAPPDATA%\vtt\v2519\ext\is-k1q0a.tmp to %LOCALAPPDATA%\vtt\v2519\ext\php_pdo_sqlite.dll
from %LOCALAPPDATA%\vtt\v2519\ext\is-t5pnv.tmp to %LOCALAPPDATA%\vtt\v2519\ext\php_pgsql.dll
from %LOCALAPPDATA%\vtt\v2519\ext\is-5jbgf.tmp to %LOCALAPPDATA%\vtt\v2519\ext\php_phpdbg_webhelper.dll
from %LOCALAPPDATA%\vtt\v2519\ext\is-f1bm7.tmp to %LOCALAPPDATA%\vtt\v2519\ext\php_shmop.dll
from %LOCALAPPDATA%\vtt\v2519\lang\is-21n5t.tmp to %LOCALAPPDATA%\vtt\v2519\lang\cs.txt
from %LOCALAPPDATA%\vtt\v2519\sasl2\is-s7a9d.tmp to %LOCALAPPDATA%\vtt\v2519\sasl2\saslsqlite.dll

Miscellaneous

Creates and executes the following

'%TEMP%\is-di0df.tmp\<File name>.tmp' /SL5="$C0176,11867160,1146880,<Full path to file>"
'%TEMP%\is-164dl.tmp\<File name>.tmp' /SL5="$D0176,11867160,1146880,<Full path to file>" /SILENT
'%LOCALAPPDATA%\vtt\v2519\rhc.exe' php.exe include.php
'%LOCALAPPDATA%\vtt\v2519\rhc.exe' php.exe index.php
'%LOCALAPPDATA%\vtt\v2519\php.exe' index.php
'%LOCALAPPDATA%\vtt\v2519\php.exe' include.php
'%LOCALAPPDATA%\vtt\v2519\rhc.exe' php.exe include.php' (with hidden window)
'%LOCALAPPDATA%\vtt\v2519\rhc.exe' php.exe index.php' (with hidden window)
'%LOCALAPPDATA%\vtt\v2519\php.exe' index.php' (with hidden window)
'%LOCALAPPDATA%\vtt\v2519\php.exe' include.php' (with hidden window)

Restarts the analyzed sample

Executes the following

'<SYSTEM32>\cmd.exe' /c "wmic path win32_VideoController get name"
'<SYSTEM32>\wbem\wmic.exe' path win32_VideoController get name
'<SYSTEM32>\cmd.exe' /c "PowerShell -executionpolicy bypass -File time.ps1"
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -executionpolicy bypass -File time.ps1
'<SYSTEM32>\cmd.exe' /c "wmic CPU get NAME"
'<SYSTEM32>\wbem\wmic.exe' CPU get NAME

Технологии

Термины

Обучение и просвещение

Мифы

Technical Information

Рекомендации по лечению

Демо бесплатно на 14 дней