Technical Information
Modifies file system
Creates the following files
- %TEMP%\is-l4afm.tmp\<File name>.tmp
- %LOCALAPPDATA%\ng screen 3.2.33\is-9vids.tmp
- %LOCALAPPDATA%\ng screen 3.2.33\is-1ile9.tmp
- %LOCALAPPDATA%\ng screen 3.2.33\is-6cl47.tmp
- %LOCALAPPDATA%\ng screen 3.2.33\is-3bs7r.tmp
- %LOCALAPPDATA%\ng screen 3.2.33\is-rj6er.tmp
- %LOCALAPPDATA%\ng screen 3.2.33\is-3dt4m.tmp
- %LOCALAPPDATA%\ng screen 3.2.33\is-blbsg.tmp
- %LOCALAPPDATA%\ng screen 3.2.33\is-ughqt.tmp
- %LOCALAPPDATA%\ng screen 3.2.33\is-erab8.tmp
- %LOCALAPPDATA%\ng screen 3.2.33\is-96omv.tmp
- %LOCALAPPDATA%\ng screen 3.2.33\is-n0pab.tmp
- %LOCALAPPDATA%\ng screen 3.2.33\is-alolf.tmp
- %LOCALAPPDATA%\ng screen 3.2.33\is-1sgcb.tmp
- %LOCALAPPDATA%\ng screen 3.2.33\is-bqtdc.tmp
- %LOCALAPPDATA%\ng screen 3.2.33\is-iqj91.tmp
- %TEMP%\is-rv09q.tmp\_isetup\_iscrypt.dll
- %TEMP%\is-rv09q.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-rv09q.tmp\_isetup\_setup64.tmp
- %TEMP%\is-rv09q.tmp\_isetup\_regdll.tmp
- %LOCALAPPDATA%\ng screen 3.2.33\unins000.dat
- %LOCALAPPDATA%\ng screen 3.2.33\ngscreen3264.exe
Moves the following files
- from %LOCALAPPDATA%\ng screen 3.2.33\is-iqj91.tmp to %LOCALAPPDATA%\ng screen 3.2.33\unins000.exe
- from %LOCALAPPDATA%\ng screen 3.2.33\is-bqtdc.tmp to %LOCALAPPDATA%\ng screen 3.2.33\avdevice-59.dll
- from %LOCALAPPDATA%\ng screen 3.2.33\is-1sgcb.tmp to %LOCALAPPDATA%\ng screen 3.2.33\avfilter-8.dll
- from %LOCALAPPDATA%\ng screen 3.2.33\is-alolf.tmp to %LOCALAPPDATA%\ng screen 3.2.33\avformat-59.dll
- from %LOCALAPPDATA%\ng screen 3.2.33\is-n0pab.tmp to %LOCALAPPDATA%\ng screen 3.2.33\avutil-57.dll
- from %LOCALAPPDATA%\ng screen 3.2.33\is-96omv.tmp to %LOCALAPPDATA%\ng screen 3.2.33\betterdp.dll
- from %LOCALAPPDATA%\ng screen 3.2.33\is-erab8.tmp to %LOCALAPPDATA%\ng screen 3.2.33\colorsetkit.dll
- from %LOCALAPPDATA%\ng screen 3.2.33\is-ughqt.tmp to %LOCALAPPDATA%\ng screen 3.2.33\concrt140.dll
- from %LOCALAPPDATA%\ng screen 3.2.33\is-blbsg.tmp to %LOCALAPPDATA%\ng screen 3.2.33\devkit.dll
- from %LOCALAPPDATA%\ng screen 3.2.33\is-3dt4m.tmp to %LOCALAPPDATA%\ng screen 3.2.33\functionalsharp.dll
- from %LOCALAPPDATA%\ng screen 3.2.33\is-rj6er.tmp to %LOCALAPPDATA%\ng screen 3.2.33\heic-net.dll
- from %LOCALAPPDATA%\ng screen 3.2.33\is-3bs7r.tmp to %LOCALAPPDATA%\ng screen 3.2.33\heic_dll_v142.dll
- from %LOCALAPPDATA%\ng screen 3.2.33\is-6cl47.tmp to %LOCALAPPDATA%\ng screen 3.2.33\heic_swig_dll_v142.dll
- from %LOCALAPPDATA%\ng screen 3.2.33\is-1ile9.tmp to %LOCALAPPDATA%\ng screen 3.2.33\isobmff_dll_v142.dll
- from %LOCALAPPDATA%\ng screen 3.2.33\is-9vids.tmp to %LOCALAPPDATA%\ng screen 3.2.33\ngscreen3264.exe
Network activity
Connects to
- 'st###7345724.ru':80
TCP
HTTP POST requests
- http://st###7345724.ru/new/net_api
UDP
- DNS ASK st###7345724.ru
Miscellaneous
Searches for the following windows
- ClassName: 'L%x_ngScreenBox_1173cba925' WindowName: ''
Creates and executes the following
- '%TEMP%\is-l4afm.tmp\<File name>.tmp' /SL5="$7015A,7507022,54272,<Full path to file>"
- '%LOCALAPPDATA%\ng screen 3.2.33\ngscreen3264.exe' e1bf70986351313506ed93e16f671bf4
Executes the following
- '%WINDIR%\syswow64\schtasks.exe' /Delete /F /TN "ng_screen_1173"
