Technical Information
Modifies file system
Creates the following files
- <Current directory>\wolfteam ost hack.exe
- %TEMP%\resc.tmp
- %TEMP%\vbcb.tmp
- %TEMP%\qftv0u0e.out
- %TEMP%\qftv0u0e.cmdline
- %TEMP%\qftv0u0e.0.vb
- <Current directory>\37tawr4t5w581861l8jp.res
- <Current directory>\37tawr4t5w581861l8jp.exe
- %TEMP%\res7.tmp
- %TEMP%\vbc6.tmp
- %TEMP%\bj4aedmb.out
- %TEMP%\bj4aedmb.cmdline
- %TEMP%\bj4aedmb.0.vb
- <Current directory>\res.ini
- <Current directory>\res.log
- <Current directory>\z25u6ן5649a1rqd6jr7s.exe
- %TEMP%\res2.tmp
- %TEMP%\vbc1.tmp
- %TEMP%\0wziidzc.out
- %TEMP%\0wziidzc.cmdline
- %TEMP%\0wziidzc.0.vb
- <Current directory>\res.exe
- <Current directory>\70f5fec60e126cl648re.exe
- <Current directory>\70f5fec60e126cl648re.res
Deletes the following files
- %TEMP%\res2.tmp
- %TEMP%\qftv0u0e.out
- %TEMP%\qftv0u0e.cmdline
- %TEMP%\qftv0u0e.0.vb
- %TEMP%\vbcb.tmp
- %TEMP%\resc.tmp
- <Current directory>\37tawr4t5w581861l8jp.res
- <Current directory>\37tawr4t5w581861l8jp.exe
- %TEMP%\bj4aedmb.0.vb
- %TEMP%\bj4aedmb.out
- <Current directory>\70f5fec60e126cl648re.exe
- %TEMP%\bj4aedmb.cmdline
- %TEMP%\res7.tmp
- <Current directory>\res.ini
- <Current directory>\res.log
- <Current directory>\res.exe
- <Current directory>\z25u6ן5649a1rqd6jr7s.exe
- %TEMP%\0wziidzc.out
- %TEMP%\0wziidzc.0.vb
- %TEMP%\0wziidzc.cmdline
- %TEMP%\vbc1.tmp
- %TEMP%\vbc6.tmp
- <Current directory>\70f5fec60e126cl648re.res
Substitutes the following files
- <Current directory>\res.exe
- <Current directory>\res.log
- <Current directory>\res.ini
Deletes itself.
Miscellaneous
Searches for the following windows
- ClassName: 'MS_WINHELP' WindowName: ''
Creates and executes the following
- '<Current directory>\res.exe' -extract <Current directory>\Z25U6ן5649A1RQD6JR7S.exe,<Current directory>\Z25U6ן5649A1RQD6JR7S.res,VERSIONINFO,,
- '<Current directory>\res.exe' -delete <Current directory>\Wolfteam OST Hack.exe,<Current directory>\res.exe,VERSIONINFO,,
- '<Current directory>\res.exe' -addoverwrite <Current directory>\Wolfteam OST Hack.exe,<Current directory>\Wolfteam OST Hack.exe,<Current directory>\Z25U6ן5649A1RQD6JR7S.res,VERSIONINFO,1,
- '<Current directory>\wolfteam ost hack.exe'
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\0wziidzc.cmdline"' (with hidden window)
- '<Current directory>\res.exe' -addoverwrite <Current directory>\Wolfteam OST Hack.exe,<Current directory>\Wolfteam OST Hack.exe,<Current directory>\70F5FEC60E126CL648RE.res,VERSIONINFO,1,' (with hidden window)
- '<Current directory>\res.exe' -extract <Current directory>\70F5FEC60E126CL648RE.exe,<Current directory>\70F5FEC60E126CL648RE.res,VERSIONINFO,,' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESC.tmp" "%TEMP%\vbcB.tmp"' (with hidden window)
- '<Current directory>\res.exe' -extract <Current directory>\37TAWR4T5W581861L8JP.exe,<Current directory>\37TAWR4T5W581861L8JP.res,VERSIONINFO,,' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\qftv0u0e.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES7.tmp" "%TEMP%\vbc6.tmp"' (with hidden window)
- '<Current directory>\res.exe' -addoverwrite <Current directory>\Wolfteam OST Hack.exe,<Current directory>\Wolfteam OST Hack.exe,<Current directory>\37TAWR4T5W581861L8JP.res,VERSIONINFO,1,' (with hidden window)
- '<Current directory>\res.exe' -addoverwrite <Current directory>\Wolfteam OST Hack.exe,<Current directory>\Wolfteam OST Hack.exe,<Current directory>\Z25U6ן5649A1RQD6JR7S.res,VERSIONINFO,1,' (with hidden window)
- '<Current directory>\res.exe' -delete <Current directory>\Wolfteam OST Hack.exe,<Current directory>\res.exe,VERSIONINFO,,' (with hidden window)
- '<Current directory>\res.exe' -extract <Current directory>\Z25U6ן5649A1RQD6JR7S.exe,<Current directory>\Z25U6ן5649A1RQD6JR7S.res,VERSIONINFO,,' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES2.tmp" "%TEMP%\vbc1.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\bj4aedmb.cmdline"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C choice /C Y /N /D Y /T 5 & Del "<Full path to file>"' (with hidden window)
Executes the following
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\0wziidzc.cmdline"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES2.tmp" "%TEMP%\vbc1.tmp"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\bj4aedmb.cmdline"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES7.tmp" "%TEMP%\vbc6.tmp"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\qftv0u0e.cmdline"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESC.tmp" "%TEMP%\vbcB.tmp"
- '<SYSTEM32>\cmd.exe' /C choice /C Y /N /D Y /T 5 & Del "<Full path to file>"
