Trojan.MulDrop24.41853

Technical Information

To ensure autorun and distribution

Creates or modifies the following files

<SYSTEM32>\tasks\wdna_lg
<SYSTEM32>\tasks\wdna

Modifies file system

Creates the following files

%TEMP%\is-at1rt.tmp\<File name>.tmp
%LOCALAPPDATA%\vtt\v2519\lang\is-kp95m.tmp
%LOCALAPPDATA%\vtt\v2519\lang\is-n9sdq.tmp
%LOCALAPPDATA%\vtt\v2519\lang\is-qcb4n.tmp
%LOCALAPPDATA%\vtt\v2519\lang\is-qs4ug.tmp
%LOCALAPPDATA%\vtt\v2519\lang\is-ubv3k.tmp
%LOCALAPPDATA%\vtt\v2519\lang\is-mb7ii.tmp
%LOCALAPPDATA%\vtt\v2519\lang\is-tlm7g.tmp
%LOCALAPPDATA%\vtt\v2519\lang\is-22t3g.tmp
%LOCALAPPDATA%\vtt\v2519\lang\is-mjnn1.tmp
%LOCALAPPDATA%\vtt\v2519\lang\is-rsrfn.tmp
%LOCALAPPDATA%\vtt\v2519\lang\is-scfbr.tmp
%LOCALAPPDATA%\vtt\v2519\lang\is-q6s03.tmp
%LOCALAPPDATA%\vtt\v2519\lang\is-5hs1m.tmp
%LOCALAPPDATA%\vtt\v2519\lang\is-eg8mu.tmp
%LOCALAPPDATA%\vtt\v2519\lang\is-q2e3d.tmp
%LOCALAPPDATA%\vtt\v2519\lang\is-qafd1.tmp
%LOCALAPPDATA%\vtt\v2519\lang\is-17tla.tmp
%LOCALAPPDATA%\vtt\v2519\lang\is-45jo2.tmp
%LOCALAPPDATA%\vtt\v2519\lang\is-i0ilm.tmp
%LOCALAPPDATA%\vtt\v2519\lang\is-stica.tmp
%LOCALAPPDATA%\vtt\v2519\lang\is-fu7e1.tmp
%LOCALAPPDATA%\vtt\v2519\lang\is-gfk41.tmp
%LOCALAPPDATA%\vtt\v2519\lang\is-9eas6.tmp
%LOCALAPPDATA%\vtt\v2519\lang\is-5ss9n.tmp
%LOCALAPPDATA%\vtt\v2519\lang\is-in0th.tmp
%LOCALAPPDATA%\vtt\v2519\lang\is-p19sp.tmp
%LOCALAPPDATA%\vtt\v2519\lang\is-9uo6a.tmp
%LOCALAPPDATA%\vtt\v2519\lang\is-npeo6.tmp
%LOCALAPPDATA%\vtt\v2519\lang\is-geisq.tmp
%LOCALAPPDATA%\vtt\v2519\lang\is-vpgc9.tmp
%LOCALAPPDATA%\vtt\v2519\lang\is-lmnip.tmp
%LOCALAPPDATA%\vtt\v2519\lang\is-ib6hl.tmp
%LOCALAPPDATA%\vtt\v2519\lang\is-q3g36.tmp
%LOCALAPPDATA%\vtt\v2519\lang\is-5m1f5.tmp
%LOCALAPPDATA%\vtt\v2519\lang\is-hc8g8.tmp
%LOCALAPPDATA%\vtt\v2519\lang\is-e84ft.tmp
%LOCALAPPDATA%\vtt\v2519\lang\is-1lkhd.tmp
%LOCALAPPDATA%\vtt\v2519\lang\is-df196.tmp
%LOCALAPPDATA%\vtt\v2519\lang\is-ejnhd.tmp
%LOCALAPPDATA%\vtt\v2519\lang\is-f0vgl.tmp
%LOCALAPPDATA%\vtt\v2519\lang\is-dvt24.tmp
%LOCALAPPDATA%\vtt\v2519\lang\is-6fl0t.tmp
%LOCALAPPDATA%\vtt\v2519\lang\is-glut0.tmp
%LOCALAPPDATA%\vtt\v2519\ext\is-5ue0q.tmp
%LOCALAPPDATA%\vtt\v2519\lang\is-d1qab.tmp
%LOCALAPPDATA%\vtt\v2519\lang\is-j79fl.tmp
%LOCALAPPDATA%\vtt\v2519\lang\is-0p7nc.tmp
%LOCALAPPDATA%\vtt\v2519\lang\is-ervqb.tmp
%LOCALAPPDATA%\vtt\v2519\lang\is-omh7c.tmp
%LOCALAPPDATA%\vtt\v2519\lang\is-m1cvs.tmp
%LOCALAPPDATA%\vtt\v2519\lang\is-llneh.tmp
%LOCALAPPDATA%\vtt\v2519\lang\is-cdht1.tmp
%LOCALAPPDATA%\vtt\v2519\lib\enchant\is-ocsvs.tmp
%LOCALAPPDATA%\vtt\v2519\lib\enchant\is-skuha.tmp
%LOCALAPPDATA%\vtt\v2519\lang\is-t42g4.tmp
%LOCALAPPDATA%\vtt\v2519\sasl2\is-t10oq.tmp
%LOCALAPPDATA%\vtt\v2519\sasl2\is-01lms.tmp
%LOCALAPPDATA%\vtt\v2519\sasl2\is-unhbb.tmp
%LOCALAPPDATA%\vtt\v2519\sasl2\is-0qitv.tmp
%LOCALAPPDATA%\vtt\v2519\sasl2\is-uano9.tmp
%LOCALAPPDATA%\vtt\v2519\sasl2\is-v58e5.tmp
%LOCALAPPDATA%\vtt\v2519\sasl2\is-kkumn.tmp
%LOCALAPPDATA%\vtt\v2519\sasl2\is-8u49p.tmp
%LOCALAPPDATA%\vtt\v2519\lang\is-qubkj.tmp
%LOCALAPPDATA%\vtt\v2519\lang\is-f6bfk.tmp
%LOCALAPPDATA%\vtt\v2519\lang\is-3io28.tmp
%LOCALAPPDATA%\vtt\v2519\lang\is-fj9nm.tmp
%LOCALAPPDATA%\vtt\v2519\lang\is-ohiuu.tmp
%LOCALAPPDATA%\vtt\v2519\lang\is-17r7c.tmp
%LOCALAPPDATA%\vtt\v2519\lang\is-5074g.tmp
%LOCALAPPDATA%\vtt\v2519\lang\is-qamht.tmp
%LOCALAPPDATA%\vtt\v2519\lang\is-hh3b9.tmp
%LOCALAPPDATA%\vtt\v2519\lang\is-u99p9.tmp
%LOCALAPPDATA%\vtt\v2519\lang\is-3iibh.tmp
%LOCALAPPDATA%\vtt\v2519\lang\is-i6f45.tmp
%LOCALAPPDATA%\vtt\v2519\lang\is-3b0hd.tmp
%LOCALAPPDATA%\vtt\v2519\lang\is-du6oh.tmp
%LOCALAPPDATA%\vtt\v2519\lang\is-p17f0.tmp
%LOCALAPPDATA%\vtt\v2519\lang\is-2nlc0.tmp
%LOCALAPPDATA%\vtt\v2519\lang\is-sjv1i.tmp
%LOCALAPPDATA%\vtt\v2519\lang\is-45dsq.tmp
%LOCALAPPDATA%\vtt\v2519\lang\is-pfeja.tmp
%LOCALAPPDATA%\vtt\v2519\lang\is-nu2ov.tmp
%LOCALAPPDATA%\vtt\v2519\lang\is-dj2vg.tmp
%LOCALAPPDATA%\vtt\v2519\lang\is-m9kjf.tmp
%LOCALAPPDATA%\vtt\v2519\lang\is-7p7nh.tmp
%LOCALAPPDATA%\vtt\v2519\lang\is-s9md2.tmp
%LOCALAPPDATA%\vtt\v2519\lang\is-4h1b7.tmp
%LOCALAPPDATA%\vtt\v2519\lang\is-6ndus.tmp
%LOCALAPPDATA%\vtt\v2519\lang\is-7n8vi.tmp
%LOCALAPPDATA%\vtt\v2519\lang\is-1bmgh.tmp
%LOCALAPPDATA%\vtt\v2519\lang\is-9crp5.tmp
%LOCALAPPDATA%\vtt\v2519\lang\is-nh5su.tmp
%LOCALAPPDATA%\vtt\v2519\is-gq6aj.tmp
%LOCALAPPDATA%\vtt\v2519\is-g42dc.tmp
%LOCALAPPDATA%\vtt\v2519\is-12e5h.tmp
%LOCALAPPDATA%\vtt\v2519\is-9ddhk.tmp
%LOCALAPPDATA%\vtt\v2519\is-0v9ea.tmp
%LOCALAPPDATA%\vtt\v2519\is-v7nuv.tmp
%LOCALAPPDATA%\vtt\v2519\is-p6nof.tmp
%LOCALAPPDATA%\vtt\v2519\is-9ninb.tmp
%LOCALAPPDATA%\vtt\v2519\is-l0ddt.tmp
%LOCALAPPDATA%\vtt\v2519\is-snuc0.tmp
%LOCALAPPDATA%\vtt\v2519\dev\is-srk4m.tmp
%LOCALAPPDATA%\vtt\v2519\ext\is-3uebd.tmp
%LOCALAPPDATA%\vtt\v2519\ext\is-khs55.tmp
%LOCALAPPDATA%\vtt\v2519\ext\is-gduv8.tmp
%LOCALAPPDATA%\vtt\v2519\ext\is-j29vt.tmp
%LOCALAPPDATA%\vtt\v2519\ext\is-jlpqh.tmp
%LOCALAPPDATA%\vtt\v2519\ext\is-rrcjq.tmp
%LOCALAPPDATA%\vtt\v2519\is-5600f.tmp
%LOCALAPPDATA%\vtt\v2519\is-61825.tmp
%LOCALAPPDATA%\vtt\v2519\is-6v81f.tmp
%LOCALAPPDATA%\vtt\v2519\is-bp9b0.tmp
%LOCALAPPDATA%\vtt\v2519\is-89d8e.tmp
%LOCALAPPDATA%\vtt\v2519\is-l6ojk.tmp
%TEMP%\is-j1m29.tmp\<File name>.tmp
%TEMP%\is-fib3v.tmp\_isetup\_setup64.tmp
%LOCALAPPDATA%\vtt\v2519\is-mdt2b.tmp
%LOCALAPPDATA%\vtt\v2519\is-nv0se.tmp
%LOCALAPPDATA%\vtt\v2519\is-c3ea6.tmp
%LOCALAPPDATA%\vtt\v2519\is-8mt73.tmp
%LOCALAPPDATA%\vtt\v2519\is-nbagv.tmp
%LOCALAPPDATA%\vtt\v2519\is-ei30i.tmp
%LOCALAPPDATA%\vtt\v2519\ext\is-q84ne.tmp
%LOCALAPPDATA%\vtt\v2519\sasl2\is-t1nib.tmp
%LOCALAPPDATA%\vtt\v2519\is-0tj5m.tmp
%LOCALAPPDATA%\vtt\v2519\is-eqafd.tmp
%LOCALAPPDATA%\vtt\v2519\is-2cr71.tmp
%LOCALAPPDATA%\vtt\v2519\is-78ed9.tmp
%LOCALAPPDATA%\vtt\v2519\is-25jtq.tmp
%LOCALAPPDATA%\vtt\v2519\is-0gj6q.tmp
%LOCALAPPDATA%\vtt\v2519\is-d3a2u.tmp
%LOCALAPPDATA%\vtt\v2519\is-i38rq.tmp
%LOCALAPPDATA%\vtt\v2519\is-638li.tmp
%TEMP%\is-3c8mn.tmp\_isetup\_setup64.tmp
%LOCALAPPDATA%\vtt\v2519\is-1v2uh.tmp
%LOCALAPPDATA%\vtt\v2519\sasl2\is-58ofe.tmp
%LOCALAPPDATA%\vtt\v2519\ext\is-h983t.tmp
%LOCALAPPDATA%\vtt\v2519\ext\is-cajed.tmp
%LOCALAPPDATA%\vtt\v2519\ext\is-kba4b.tmp
%LOCALAPPDATA%\vtt\v2519\ext\is-mngsv.tmp
%LOCALAPPDATA%\vtt\v2519\ext\is-0vntb.tmp
%LOCALAPPDATA%\vtt\v2519\ext\is-adspd.tmp
%LOCALAPPDATA%\vtt\v2519\ext\is-8g68u.tmp
%LOCALAPPDATA%\vtt\v2519\extras\ssl\is-hgj6s.tmp
%LOCALAPPDATA%\vtt\v2519\lang\is-djfds.tmp
%LOCALAPPDATA%\vtt\v2519\is-0taq3.tmp
%LOCALAPPDATA%\vtt\v2519\lang\is-5ve71.tmp
%LOCALAPPDATA%\vtt\v2519\lang\is-o3n1m.tmp
%LOCALAPPDATA%\vtt\v2519\lang\is-lur2r.tmp
%LOCALAPPDATA%\vtt\v2519\lang\is-c22qu.tmp
%LOCALAPPDATA%\vtt\v2519\lang\is-8mjej.tmp
%LOCALAPPDATA%\vtt\v2519\lang\is-nlvp4.tmp
%LOCALAPPDATA%\vtt\v2519\lang\is-6v3n1.tmp
%LOCALAPPDATA%\vtt\v2519\lang\is-cquqr.tmp
%LOCALAPPDATA%\vtt\v2519\lang\is-33jl5.tmp
%LOCALAPPDATA%\vtt\v2519\ext\is-ol3s7.tmp
%LOCALAPPDATA%\vtt\v2519\lang\is-7d8k3.tmp
%LOCALAPPDATA%\vtt\v2519\ext\is-7rcg9.tmp
%LOCALAPPDATA%\vtt\v2519\ext\is-kivah.tmp
%LOCALAPPDATA%\vtt\v2519\ext\is-7jmhj.tmp
%LOCALAPPDATA%\vtt\v2519\ext\is-5gfdu.tmp
%LOCALAPPDATA%\vtt\v2519\ext\is-9sn10.tmp
%LOCALAPPDATA%\vtt\v2519\ext\is-ef4a8.tmp
%LOCALAPPDATA%\vtt\v2519\ext\is-4mnlm.tmp
%LOCALAPPDATA%\vtt\v2519\ext\is-irl16.tmp
%LOCALAPPDATA%\vtt\v2519\ext\is-78uls.tmp
%LOCALAPPDATA%\vtt\v2519\ext\is-nm95i.tmp
%LOCALAPPDATA%\vtt\v2519\ext\is-3v8t8.tmp
%LOCALAPPDATA%\vtt\v2519\ext\is-8nn5f.tmp
%LOCALAPPDATA%\vtt\v2519\ext\is-ct81v.tmp
%LOCALAPPDATA%\vtt\v2519\ext\is-8o0tj.tmp
%LOCALAPPDATA%\vtt\v2519\ext\is-6c6v9.tmp
%LOCALAPPDATA%\vtt\v2519\ext\is-3t7qh.tmp
%LOCALAPPDATA%\vtt\v2519\ext\is-m45ij.tmp
%LOCALAPPDATA%\vtt\v2519\ext\is-8sob3.tmp
%LOCALAPPDATA%\vtt\v2519\ext\is-vdk6v.tmp
%LOCALAPPDATA%\vtt\v2519\ext\is-uotoj.tmp
%LOCALAPPDATA%\vtt\v2519\ext\is-dicfu.tmp
%LOCALAPPDATA%\vtt\v2519\ext\is-3tp0r.tmp
%LOCALAPPDATA%\vtt\v2519\ext\is-h9i7b.tmp
%LOCALAPPDATA%\vtt\v2519\ext\is-kne2l.tmp
%LOCALAPPDATA%\vtt\v2519\ext\is-s4jcp.tmp
%LOCALAPPDATA%\vtt\v2519\unins000.dat

Deletes the following files

%TEMP%\is-3c8mn.tmp\_isetup\_setup64.tmp
%TEMP%\is-at1rt.tmp\<File name>.tmp
%TEMP%\is-fib3v.tmp\_isetup\_setup64.tmp
%TEMP%\is-j1m29.tmp\<File name>.tmp

Moves the following files

from %LOCALAPPDATA%\vtt\v2519\is-mdt2b.tmp to %LOCALAPPDATA%\vtt\v2519\unins000.exe
from %LOCALAPPDATA%\vtt\v2519\lang\is-n9sdq.tmp to %LOCALAPPDATA%\vtt\v2519\lang\ja.txt
from %LOCALAPPDATA%\vtt\v2519\lang\is-qcb4n.tmp to %LOCALAPPDATA%\vtt\v2519\lang\ka.txt
from %LOCALAPPDATA%\vtt\v2519\lang\is-qs4ug.tmp to %LOCALAPPDATA%\vtt\v2519\lang\kaa.txt
from %LOCALAPPDATA%\vtt\v2519\lang\is-ubv3k.tmp to %LOCALAPPDATA%\vtt\v2519\lang\kab.txt
from %LOCALAPPDATA%\vtt\v2519\lang\is-mb7ii.tmp to %LOCALAPPDATA%\vtt\v2519\lang\kk.txt
from %LOCALAPPDATA%\vtt\v2519\lang\is-tlm7g.tmp to %LOCALAPPDATA%\vtt\v2519\lang\ko.txt
from %LOCALAPPDATA%\vtt\v2519\lang\is-22t3g.tmp to %LOCALAPPDATA%\vtt\v2519\lang\ku-ckb.txt
from %LOCALAPPDATA%\vtt\v2519\lang\is-stica.tmp to %LOCALAPPDATA%\vtt\v2519\lang\is.txt
from %LOCALAPPDATA%\vtt\v2519\lang\is-kp95m.tmp to %LOCALAPPDATA%\vtt\v2519\lang\it.txt
from %LOCALAPPDATA%\vtt\v2519\lang\is-rsrfn.tmp to %LOCALAPPDATA%\vtt\v2519\lang\ku.txt
from %LOCALAPPDATA%\vtt\v2519\lang\is-q6s03.tmp to %LOCALAPPDATA%\vtt\v2519\lang\lt.txt
from %LOCALAPPDATA%\vtt\v2519\lang\is-5hs1m.tmp to %LOCALAPPDATA%\vtt\v2519\lang\lv.txt
from %LOCALAPPDATA%\vtt\v2519\lang\is-eg8mu.tmp to %LOCALAPPDATA%\vtt\v2519\lang\mk.txt
from %LOCALAPPDATA%\vtt\v2519\lang\is-q2e3d.tmp to %LOCALAPPDATA%\vtt\v2519\lang\mn.txt
from %LOCALAPPDATA%\vtt\v2519\lang\is-qafd1.tmp to %LOCALAPPDATA%\vtt\v2519\lang\mng.txt
from %LOCALAPPDATA%\vtt\v2519\lang\is-17tla.tmp to %LOCALAPPDATA%\vtt\v2519\lang\mng2.txt
from %LOCALAPPDATA%\vtt\v2519\lang\is-45jo2.tmp to %LOCALAPPDATA%\vtt\v2519\lang\mr.txt
from %LOCALAPPDATA%\vtt\v2519\lang\is-fu7e1.tmp to %LOCALAPPDATA%\vtt\v2519\lang\ky.txt
from %LOCALAPPDATA%\vtt\v2519\lang\is-scfbr.tmp to %LOCALAPPDATA%\vtt\v2519\lang\lij.txt
from %LOCALAPPDATA%\vtt\v2519\lang\is-i0ilm.tmp to %LOCALAPPDATA%\vtt\v2519\lang\io.txt
from %LOCALAPPDATA%\vtt\v2519\lang\is-glut0.tmp to %LOCALAPPDATA%\vtt\v2519\lang\id.txt
from %LOCALAPPDATA%\vtt\v2519\lang\is-dvt24.tmp to %LOCALAPPDATA%\vtt\v2519\lang\hy.txt
from %LOCALAPPDATA%\vtt\v2519\lang\is-5ss9n.tmp to %LOCALAPPDATA%\vtt\v2519\lang\en.ttt
from %LOCALAPPDATA%\vtt\v2519\lang\is-in0th.tmp to %LOCALAPPDATA%\vtt\v2519\lang\eo.txt
from %LOCALAPPDATA%\vtt\v2519\lang\is-p19sp.tmp to %LOCALAPPDATA%\vtt\v2519\lang\es.txt
from %LOCALAPPDATA%\vtt\v2519\lang\is-9uo6a.tmp to %LOCALAPPDATA%\vtt\v2519\lang\et.txt
from %LOCALAPPDATA%\vtt\v2519\lang\is-npeo6.tmp to %LOCALAPPDATA%\vtt\v2519\lang\eu.txt
from %LOCALAPPDATA%\vtt\v2519\lang\is-geisq.tmp to %LOCALAPPDATA%\vtt\v2519\lang\ext.txt
from %LOCALAPPDATA%\vtt\v2519\lang\is-vpgc9.tmp to %LOCALAPPDATA%\vtt\v2519\lang\fa.txt
from %LOCALAPPDATA%\vtt\v2519\lang\is-lmnip.tmp to %LOCALAPPDATA%\vtt\v2519\lang\fi.txt
from %LOCALAPPDATA%\vtt\v2519\lang\is-2nlc0.tmp to %LOCALAPPDATA%\vtt\v2519\lang\el.txt
from %LOCALAPPDATA%\vtt\v2519\lang\is-ib6hl.tmp to %LOCALAPPDATA%\vtt\v2519\lang\fr.txt
from %LOCALAPPDATA%\vtt\v2519\lang\is-5m1f5.tmp to %LOCALAPPDATA%\vtt\v2519\lang\fy.txt
from %LOCALAPPDATA%\vtt\v2519\lang\is-hc8g8.tmp to %LOCALAPPDATA%\vtt\v2519\lang\ga.txt
from %LOCALAPPDATA%\vtt\v2519\lang\is-e84ft.tmp to %LOCALAPPDATA%\vtt\v2519\lang\gl.txt
from %LOCALAPPDATA%\vtt\v2519\lang\is-1lkhd.tmp to %LOCALAPPDATA%\vtt\v2519\lang\gu.txt
from %LOCALAPPDATA%\vtt\v2519\lang\is-df196.tmp to %LOCALAPPDATA%\vtt\v2519\lang\he.txt
from %LOCALAPPDATA%\vtt\v2519\lang\is-ejnhd.tmp to %LOCALAPPDATA%\vtt\v2519\lang\hi.txt
from %LOCALAPPDATA%\vtt\v2519\lang\is-f0vgl.tmp to %LOCALAPPDATA%\vtt\v2519\lang\hr.txt
from %LOCALAPPDATA%\vtt\v2519\lang\is-9eas6.tmp to %LOCALAPPDATA%\vtt\v2519\lang\hu.txt
from %LOCALAPPDATA%\vtt\v2519\lang\is-q3g36.tmp to %LOCALAPPDATA%\vtt\v2519\lang\fur.txt
from %LOCALAPPDATA%\vtt\v2519\lang\is-gfk41.tmp to %LOCALAPPDATA%\vtt\v2519\lang\ms.txt
from %LOCALAPPDATA%\vtt\v2519\lang\is-mjnn1.tmp to %LOCALAPPDATA%\vtt\v2519\lang\nb.txt
from %LOCALAPPDATA%\vtt\v2519\lang\is-d1qab.tmp to %LOCALAPPDATA%\vtt\v2519\lang\ne.txt
from %LOCALAPPDATA%\vtt\v2519\lang\is-t42g4.tmp to %LOCALAPPDATA%\vtt\v2519\lang\nl.txt
from %LOCALAPPDATA%\vtt\v2519\lang\is-qubkj.tmp to %LOCALAPPDATA%\vtt\v2519\lang\ug.txt
from %LOCALAPPDATA%\vtt\v2519\lang\is-j79fl.tmp to %LOCALAPPDATA%\vtt\v2519\lang\uk.txt
from %LOCALAPPDATA%\vtt\v2519\lang\is-3io28.tmp to %LOCALAPPDATA%\vtt\v2519\lang\uz-cyrl.txt
from %LOCALAPPDATA%\vtt\v2519\lang\is-0p7nc.tmp to %LOCALAPPDATA%\vtt\v2519\lang\uz.txt
from %LOCALAPPDATA%\vtt\v2519\lang\is-ervqb.tmp to %LOCALAPPDATA%\vtt\v2519\lang\va.txt
from %LOCALAPPDATA%\vtt\v2519\lang\is-omh7c.tmp to %LOCALAPPDATA%\vtt\v2519\lang\vi.txt
from %LOCALAPPDATA%\vtt\v2519\lang\is-m1cvs.tmp to %LOCALAPPDATA%\vtt\v2519\lang\yo.txt
from %LOCALAPPDATA%\vtt\v2519\lang\is-llneh.tmp to %LOCALAPPDATA%\vtt\v2519\lang\zh-cn.txt
from %LOCALAPPDATA%\vtt\v2519\lang\is-cdht1.tmp to %LOCALAPPDATA%\vtt\v2519\lang\zh-tw.txt
from %LOCALAPPDATA%\vtt\v2519\lib\enchant\is-ocsvs.tmp to %LOCALAPPDATA%\vtt\v2519\lib\enchant\libenchant_ispell.dll
from %LOCALAPPDATA%\vtt\v2519\lib\enchant\is-skuha.tmp to %LOCALAPPDATA%\vtt\v2519\lib\enchant\libenchant_myspell.dll
from %LOCALAPPDATA%\vtt\v2519\sasl2\is-t10oq.tmp to %LOCALAPPDATA%\vtt\v2519\sasl2\saslanonymous.dll
from %LOCALAPPDATA%\vtt\v2519\sasl2\is-58ofe.tmp to %LOCALAPPDATA%\vtt\v2519\sasl2\saslcrammd5.dll
from %LOCALAPPDATA%\vtt\v2519\sasl2\is-01lms.tmp to %LOCALAPPDATA%\vtt\v2519\sasl2\sasldigestmd5.dll
from %LOCALAPPDATA%\vtt\v2519\sasl2\is-unhbb.tmp to %LOCALAPPDATA%\vtt\v2519\sasl2\sasllogin.dll
from %LOCALAPPDATA%\vtt\v2519\sasl2\is-0qitv.tmp to %LOCALAPPDATA%\vtt\v2519\sasl2\saslntlm.dll
from %LOCALAPPDATA%\vtt\v2519\sasl2\is-uano9.tmp to %LOCALAPPDATA%\vtt\v2519\sasl2\saslotp.dll
from %LOCALAPPDATA%\vtt\v2519\sasl2\is-v58e5.tmp to %LOCALAPPDATA%\vtt\v2519\sasl2\saslplain.dll
from %LOCALAPPDATA%\vtt\v2519\sasl2\is-kkumn.tmp to %LOCALAPPDATA%\vtt\v2519\sasl2\saslsasldb.dll
from %LOCALAPPDATA%\vtt\v2519\lang\is-f6bfk.tmp to %LOCALAPPDATA%\vtt\v2519\lang\tt.txt
from %LOCALAPPDATA%\vtt\v2519\lang\is-ohiuu.tmp to %LOCALAPPDATA%\vtt\v2519\lang\tk.txt
from %LOCALAPPDATA%\vtt\v2519\lang\is-fj9nm.tmp to %LOCALAPPDATA%\vtt\v2519\lang\tr.txt
from %LOCALAPPDATA%\vtt\v2519\lang\is-s9md2.tmp to %LOCALAPPDATA%\vtt\v2519\lang\th.txt
from %LOCALAPPDATA%\vtt\v2519\lang\is-17r7c.tmp to %LOCALAPPDATA%\vtt\v2519\lang\nn.txt
from %LOCALAPPDATA%\vtt\v2519\lang\is-6ndus.tmp to %LOCALAPPDATA%\vtt\v2519\lang\pa-in.txt
from %LOCALAPPDATA%\vtt\v2519\lang\is-5074g.tmp to %LOCALAPPDATA%\vtt\v2519\lang\pl.txt
from %LOCALAPPDATA%\vtt\v2519\lang\is-qamht.tmp to %LOCALAPPDATA%\vtt\v2519\lang\ps.txt
from %LOCALAPPDATA%\vtt\v2519\lang\is-hh3b9.tmp to %LOCALAPPDATA%\vtt\v2519\lang\pt-br.txt
from %LOCALAPPDATA%\vtt\v2519\lang\is-u99p9.tmp to %LOCALAPPDATA%\vtt\v2519\lang\pt.txt
from %LOCALAPPDATA%\vtt\v2519\lang\is-3iibh.tmp to %LOCALAPPDATA%\vtt\v2519\lang\ro.txt
from %LOCALAPPDATA%\vtt\v2519\lang\is-i6f45.tmp to %LOCALAPPDATA%\vtt\v2519\lang\ru.txt
from %LOCALAPPDATA%\vtt\v2519\lang\is-3b0hd.tmp to %LOCALAPPDATA%\vtt\v2519\lang\sa.txt
from %LOCALAPPDATA%\vtt\v2519\lang\is-p17f0.tmp to %LOCALAPPDATA%\vtt\v2519\lang\si.txt
from %LOCALAPPDATA%\vtt\v2519\lang\is-4h1b7.tmp to %LOCALAPPDATA%\vtt\v2519\lang\sk.txt
from %LOCALAPPDATA%\vtt\v2519\lang\is-sjv1i.tmp to %LOCALAPPDATA%\vtt\v2519\lang\sl.txt
from %LOCALAPPDATA%\vtt\v2519\lang\is-7n8vi.tmp to %LOCALAPPDATA%\vtt\v2519\lang\sq.txt
from %LOCALAPPDATA%\vtt\v2519\lang\is-45dsq.tmp to %LOCALAPPDATA%\vtt\v2519\lang\sr-spc.txt
from %LOCALAPPDATA%\vtt\v2519\lang\is-pfeja.tmp to %LOCALAPPDATA%\vtt\v2519\lang\sr-spl.txt
from %LOCALAPPDATA%\vtt\v2519\lang\is-nu2ov.tmp to %LOCALAPPDATA%\vtt\v2519\lang\sv.txt
from %LOCALAPPDATA%\vtt\v2519\lang\is-dj2vg.tmp to %LOCALAPPDATA%\vtt\v2519\lang\sw.txt
from %LOCALAPPDATA%\vtt\v2519\lang\is-m9kjf.tmp to %LOCALAPPDATA%\vtt\v2519\lang\ta.txt
from %LOCALAPPDATA%\vtt\v2519\lang\is-7p7nh.tmp to %LOCALAPPDATA%\vtt\v2519\lang\tg.txt
from %LOCALAPPDATA%\vtt\v2519\sasl2\is-8u49p.tmp to %LOCALAPPDATA%\vtt\v2519\sasl2\saslscram.dll
from %LOCALAPPDATA%\vtt\v2519\lang\is-6fl0t.tmp to %LOCALAPPDATA%\vtt\v2519\lang\de.txt
from %LOCALAPPDATA%\vtt\v2519\lang\is-du6oh.tmp to %LOCALAPPDATA%\vtt\v2519\lang\da.txt
from %LOCALAPPDATA%\vtt\v2519\lang\is-1bmgh.tmp to %LOCALAPPDATA%\vtt\v2519\lang\cy.txt
from %LOCALAPPDATA%\vtt\v2519\is-12e5h.tmp to %LOCALAPPDATA%\vtt\v2519\php7.dll
from %LOCALAPPDATA%\vtt\v2519\is-9ddhk.tmp to %LOCALAPPDATA%\vtt\v2519\php7embed.lib
from %LOCALAPPDATA%\vtt\v2519\is-0v9ea.tmp to %LOCALAPPDATA%\vtt\v2519\php7phpdbg.dll
from %LOCALAPPDATA%\vtt\v2519\is-v7nuv.tmp to %LOCALAPPDATA%\vtt\v2519\rhc.exe
from %LOCALAPPDATA%\vtt\v2519\is-p6nof.tmp to %LOCALAPPDATA%\vtt\v2519\tag
from %LOCALAPPDATA%\vtt\v2519\is-9ninb.tmp to %LOCALAPPDATA%\vtt\v2519\time.ps1
from %LOCALAPPDATA%\vtt\v2519\is-l0ddt.tmp to %LOCALAPPDATA%\vtt\v2519\vcruntime140.dll
from %LOCALAPPDATA%\vtt\v2519\is-gq6aj.tmp to %LOCALAPPDATA%\vtt\v2519\php.gif
from %LOCALAPPDATA%\vtt\v2519\is-g42dc.tmp to %LOCALAPPDATA%\vtt\v2519\php.ini
from %LOCALAPPDATA%\vtt\v2519\is-snuc0.tmp to %LOCALAPPDATA%\vtt\v2519\version.php
from %LOCALAPPDATA%\vtt\v2519\ext\is-khs55.tmp to %LOCALAPPDATA%\vtt\v2519\ext\php_com_dotnet.dll
from %LOCALAPPDATA%\vtt\v2519\ext\is-gduv8.tmp to %LOCALAPPDATA%\vtt\v2519\ext\php_curl.dll
from %LOCALAPPDATA%\vtt\v2519\ext\is-j29vt.tmp to %LOCALAPPDATA%\vtt\v2519\ext\php_dba.dll
from %LOCALAPPDATA%\vtt\v2519\ext\is-jlpqh.tmp to %LOCALAPPDATA%\vtt\v2519\ext\php_enchant.dll
from %LOCALAPPDATA%\vtt\v2519\ext\is-rrcjq.tmp to %LOCALAPPDATA%\vtt\v2519\ext\php_exif.dll
from %LOCALAPPDATA%\vtt\v2519\ext\is-q84ne.tmp to %LOCALAPPDATA%\vtt\v2519\ext\php_fileinfo.dll
from %LOCALAPPDATA%\vtt\v2519\ext\is-h983t.tmp to %LOCALAPPDATA%\vtt\v2519\ext\php_ftp.dll
from %LOCALAPPDATA%\vtt\v2519\dev\is-srk4m.tmp to %LOCALAPPDATA%\vtt\v2519\dev\php7.lib
from %LOCALAPPDATA%\vtt\v2519\ext\is-3uebd.tmp to %LOCALAPPDATA%\vtt\v2519\ext\php_bz2.dll
from %LOCALAPPDATA%\vtt\v2519\is-6v81f.tmp to %LOCALAPPDATA%\vtt\v2519\php.exe
from %LOCALAPPDATA%\vtt\v2519\is-0taq3.tmp to %LOCALAPPDATA%\vtt\v2519\pharcommand.phar
from %LOCALAPPDATA%\vtt\v2519\is-5600f.tmp to %LOCALAPPDATA%\vtt\v2519\phar.phar.bat
from %LOCALAPPDATA%\vtt\v2519\is-c3ea6.tmp to %LOCALAPPDATA%\vtt\v2519\descript.ion
from %LOCALAPPDATA%\vtt\v2519\is-8mt73.tmp to %LOCALAPPDATA%\vtt\v2519\glib-2.dll
from %LOCALAPPDATA%\vtt\v2519\is-nbagv.tmp to %LOCALAPPDATA%\vtt\v2519\gmodule-2.dll
from %LOCALAPPDATA%\vtt\v2519\is-ei30i.tmp to %LOCALAPPDATA%\vtt\v2519\icuin60.dll
from %LOCALAPPDATA%\vtt\v2519\is-0tj5m.tmp to %LOCALAPPDATA%\vtt\v2519\icuio60.dll
from %LOCALAPPDATA%\vtt\v2519\is-l6ojk.tmp to %LOCALAPPDATA%\vtt\v2519\icutu60.dll
from %LOCALAPPDATA%\vtt\v2519\is-1v2uh.tmp to %LOCALAPPDATA%\vtt\v2519\icuuc60.dll
from %LOCALAPPDATA%\vtt\v2519\is-eqafd.tmp to %LOCALAPPDATA%\vtt\v2519\include.php
from %LOCALAPPDATA%\vtt\v2519\is-nv0se.tmp to %LOCALAPPDATA%\vtt\v2519\cdma.ps1
from %LOCALAPPDATA%\vtt\v2519\is-2cr71.tmp to %LOCALAPPDATA%\vtt\v2519\index.php
from %LOCALAPPDATA%\vtt\v2519\is-25jtq.tmp to %LOCALAPPDATA%\vtt\v2519\libenchant.dll
from %LOCALAPPDATA%\vtt\v2519\is-0gj6q.tmp to %LOCALAPPDATA%\vtt\v2519\libpq.dll
from %LOCALAPPDATA%\vtt\v2519\is-d3a2u.tmp to %LOCALAPPDATA%\vtt\v2519\libsasl.dll
from %LOCALAPPDATA%\vtt\v2519\is-i38rq.tmp to %LOCALAPPDATA%\vtt\v2519\libsodium.dll
from %LOCALAPPDATA%\vtt\v2519\is-638li.tmp to %LOCALAPPDATA%\vtt\v2519\libssh2.dll
from %LOCALAPPDATA%\vtt\v2519\is-89d8e.tmp to %LOCALAPPDATA%\vtt\v2519\libssl-1_1-x64.dll
from %LOCALAPPDATA%\vtt\v2519\is-61825.tmp to %LOCALAPPDATA%\vtt\v2519\news.txt
from %LOCALAPPDATA%\vtt\v2519\is-bp9b0.tmp to %LOCALAPPDATA%\vtt\v2519\nghttp2.dll
from %LOCALAPPDATA%\vtt\v2519\is-78ed9.tmp to %LOCALAPPDATA%\vtt\v2519\libcrypto-1_1-x64.dll
from %LOCALAPPDATA%\vtt\v2519\ext\is-8nn5f.tmp to %LOCALAPPDATA%\vtt\v2519\ext\php_gd2.dll
from %LOCALAPPDATA%\vtt\v2519\ext\is-8o0tj.tmp to %LOCALAPPDATA%\vtt\v2519\ext\php_gettext.dll
from %LOCALAPPDATA%\vtt\v2519\ext\is-h9i7b.tmp to %LOCALAPPDATA%\vtt\v2519\ext\php_gmp.dll
from %LOCALAPPDATA%\vtt\v2519\ext\is-cajed.tmp to %LOCALAPPDATA%\vtt\v2519\ext\php_imap.dll
from %LOCALAPPDATA%\vtt\v2519\ext\is-7rcg9.tmp to %LOCALAPPDATA%\vtt\v2519\ext\php_sqlite3.dll
from %LOCALAPPDATA%\vtt\v2519\ext\is-kba4b.tmp to %LOCALAPPDATA%\vtt\v2519\ext\php_sysvshm.dll
from %LOCALAPPDATA%\vtt\v2519\ext\is-mngsv.tmp to %LOCALAPPDATA%\vtt\v2519\ext\php_tidy.dll
from %LOCALAPPDATA%\vtt\v2519\ext\is-0vntb.tmp to %LOCALAPPDATA%\vtt\v2519\ext\php_xmlrpc.dll
from %LOCALAPPDATA%\vtt\v2519\ext\is-adspd.tmp to %LOCALAPPDATA%\vtt\v2519\ext\php_xsl.dll
from %LOCALAPPDATA%\vtt\v2519\ext\is-8g68u.tmp to %LOCALAPPDATA%\vtt\v2519\ext\php_zend_test.dll
from %LOCALAPPDATA%\vtt\v2519\extras\ssl\is-hgj6s.tmp to %LOCALAPPDATA%\vtt\v2519\extras\ssl\openssl.cnf
from %LOCALAPPDATA%\vtt\v2519\lang\is-djfds.tmp to %LOCALAPPDATA%\vtt\v2519\lang\af.txt
from %LOCALAPPDATA%\vtt\v2519\lang\is-5ve71.tmp to %LOCALAPPDATA%\vtt\v2519\lang\an.txt
from %LOCALAPPDATA%\vtt\v2519\lang\is-7d8k3.tmp to %LOCALAPPDATA%\vtt\v2519\lang\ar.txt
from %LOCALAPPDATA%\vtt\v2519\lang\is-o3n1m.tmp to %LOCALAPPDATA%\vtt\v2519\lang\ast.txt
from %LOCALAPPDATA%\vtt\v2519\lang\is-lur2r.tmp to %LOCALAPPDATA%\vtt\v2519\lang\az.txt
from %LOCALAPPDATA%\vtt\v2519\lang\is-c22qu.tmp to %LOCALAPPDATA%\vtt\v2519\lang\ba.txt
from %LOCALAPPDATA%\vtt\v2519\lang\is-8mjej.tmp to %LOCALAPPDATA%\vtt\v2519\lang\be.txt
from %LOCALAPPDATA%\vtt\v2519\lang\is-nlvp4.tmp to %LOCALAPPDATA%\vtt\v2519\lang\bg.txt
from %LOCALAPPDATA%\vtt\v2519\lang\is-6v3n1.tmp to %LOCALAPPDATA%\vtt\v2519\lang\bn.txt
from %LOCALAPPDATA%\vtt\v2519\lang\is-cquqr.tmp to %LOCALAPPDATA%\vtt\v2519\lang\br.txt
from %LOCALAPPDATA%\vtt\v2519\lang\is-33jl5.tmp to %LOCALAPPDATA%\vtt\v2519\lang\ca.txt
from %LOCALAPPDATA%\vtt\v2519\lang\is-nh5su.tmp to %LOCALAPPDATA%\vtt\v2519\lang\co.txt
from %LOCALAPPDATA%\vtt\v2519\ext\is-kivah.tmp to %LOCALAPPDATA%\vtt\v2519\ext\php_sodium.dll
from %LOCALAPPDATA%\vtt\v2519\ext\is-7jmhj.tmp to %LOCALAPPDATA%\vtt\v2519\ext\php_soap.dll
from %LOCALAPPDATA%\vtt\v2519\ext\is-ol3s7.tmp to %LOCALAPPDATA%\vtt\v2519\ext\php_sockets.dll
from %LOCALAPPDATA%\vtt\v2519\ext\is-5gfdu.tmp to %LOCALAPPDATA%\vtt\v2519\ext\php_snmp.dll
from %LOCALAPPDATA%\vtt\v2519\ext\is-9sn10.tmp to %LOCALAPPDATA%\vtt\v2519\ext\php_interbase.dll
from %LOCALAPPDATA%\vtt\v2519\ext\is-ef4a8.tmp to %LOCALAPPDATA%\vtt\v2519\ext\php_intl.dll
from %LOCALAPPDATA%\vtt\v2519\ext\is-4mnlm.tmp to %LOCALAPPDATA%\vtt\v2519\ext\php_ioncube.dll
from %LOCALAPPDATA%\vtt\v2519\ext\is-irl16.tmp to %LOCALAPPDATA%\vtt\v2519\ext\php_ldap.dll
from %LOCALAPPDATA%\vtt\v2519\ext\is-78uls.tmp to %LOCALAPPDATA%\vtt\v2519\ext\php_mbstring.dll
from %LOCALAPPDATA%\vtt\v2519\ext\is-nm95i.tmp to %LOCALAPPDATA%\vtt\v2519\ext\php_mysqli.dll
from %LOCALAPPDATA%\vtt\v2519\ext\is-3v8t8.tmp to %LOCALAPPDATA%\vtt\v2519\ext\php_oci8_12c.dll
from %LOCALAPPDATA%\vtt\v2519\ext\is-ct81v.tmp to %LOCALAPPDATA%\vtt\v2519\ext\php_odbc.dll
from %LOCALAPPDATA%\vtt\v2519\ext\is-5ue0q.tmp to %LOCALAPPDATA%\vtt\v2519\ext\php_opcache.dll
from %LOCALAPPDATA%\vtt\v2519\ext\is-6c6v9.tmp to %LOCALAPPDATA%\vtt\v2519\ext\php_openssl.dll
from %LOCALAPPDATA%\vtt\v2519\ext\is-s4jcp.tmp to %LOCALAPPDATA%\vtt\v2519\ext\php_pdo_firebird.dll
from %LOCALAPPDATA%\vtt\v2519\ext\is-3t7qh.tmp to %LOCALAPPDATA%\vtt\v2519\ext\php_pdo_mysql.dll
from %LOCALAPPDATA%\vtt\v2519\ext\is-m45ij.tmp to %LOCALAPPDATA%\vtt\v2519\ext\php_pdo_oci.dll
from %LOCALAPPDATA%\vtt\v2519\ext\is-8sob3.tmp to %LOCALAPPDATA%\vtt\v2519\ext\php_pdo_odbc.dll
from %LOCALAPPDATA%\vtt\v2519\ext\is-vdk6v.tmp to %LOCALAPPDATA%\vtt\v2519\ext\php_pdo_pgsql.dll
from %LOCALAPPDATA%\vtt\v2519\ext\is-uotoj.tmp to %LOCALAPPDATA%\vtt\v2519\ext\php_pdo_sqlite.dll
from %LOCALAPPDATA%\vtt\v2519\ext\is-dicfu.tmp to %LOCALAPPDATA%\vtt\v2519\ext\php_pgsql.dll
from %LOCALAPPDATA%\vtt\v2519\ext\is-3tp0r.tmp to %LOCALAPPDATA%\vtt\v2519\ext\php_phpdbg_webhelper.dll
from %LOCALAPPDATA%\vtt\v2519\ext\is-kne2l.tmp to %LOCALAPPDATA%\vtt\v2519\ext\php_shmop.dll
from %LOCALAPPDATA%\vtt\v2519\lang\is-9crp5.tmp to %LOCALAPPDATA%\vtt\v2519\lang\cs.txt
from %LOCALAPPDATA%\vtt\v2519\sasl2\is-t1nib.tmp to %LOCALAPPDATA%\vtt\v2519\sasl2\saslsqlite.dll

Miscellaneous

Creates and executes the following

'%TEMP%\is-at1rt.tmp\<File name>.tmp' /SL5="$F0240,11867160,1146880,<Full path to file>"
'%TEMP%\is-j1m29.tmp\<File name>.tmp' /SL5="$170016,11867160,1146880,<Full path to file>" /SILENT
'%LOCALAPPDATA%\vtt\v2519\rhc.exe' php.exe include.php
'%LOCALAPPDATA%\vtt\v2519\rhc.exe' php.exe index.php
'%LOCALAPPDATA%\vtt\v2519\php.exe' include.php
'%LOCALAPPDATA%\vtt\v2519\php.exe' index.php
'%LOCALAPPDATA%\vtt\v2519\rhc.exe' php.exe include.php' (with hidden window)
'%LOCALAPPDATA%\vtt\v2519\rhc.exe' php.exe index.php' (with hidden window)
'%LOCALAPPDATA%\vtt\v2519\php.exe' include.php' (with hidden window)
'%LOCALAPPDATA%\vtt\v2519\php.exe' index.php' (with hidden window)

Restarts the analyzed sample

Executes the following

'<SYSTEM32>\cmd.exe' /c "wmic path win32_VideoController get name"
'<SYSTEM32>\wbem\wmic.exe' path win32_VideoController get name
'<SYSTEM32>\cmd.exe' /c "PowerShell -executionpolicy bypass -File time.ps1"
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -executionpolicy bypass -File time.ps1
'<SYSTEM32>\cmd.exe' /c "wmic CPU get NAME"
'<SYSTEM32>\wbem\wmic.exe' CPU get NAME
'<SYSTEM32>\taskeng.exe' {0031E0D8-F695-4555-AE06-96FFAB4B106E} S-1-5-21-3150914307-1777937420-491476919-1000:phuugsdeqwhj\user:Interactive:[1]

Технологии

Термины

Обучение и просвещение

Мифы

Technical Information

Рекомендации по лечению

Демо бесплатно на 14 дней