Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\rss feed ptx
- <SYSTEM32>\tasks\rss feed ptx ud
- <SYSTEM32>\tasks\rss feed ptx lg
Modifies file system
Creates the following files
- %TEMP%\is-q9i9n.tmp\<File name>.tmp
- %LOCALAPPDATA%\packages\pxt\v2-0\ext\is-p9gim.tmp
- %LOCALAPPDATA%\packages\pxt\v2-0\ext\is-n36ee.tmp
- %LOCALAPPDATA%\packages\pxt\v2-0\ext\is-6q2d2.tmp
- %LOCALAPPDATA%\packages\pxt\v2-0\ext\is-kbk2e.tmp
- %LOCALAPPDATA%\packages\pxt\v2-0\ext\is-nacsu.tmp
- %LOCALAPPDATA%\packages\pxt\v2-0\ext\is-5flpt.tmp
- %LOCALAPPDATA%\packages\pxt\v2-0\ext\is-o1f35.tmp
- %LOCALAPPDATA%\packages\pxt\v2-0\ext\is-2itl1.tmp
- %LOCALAPPDATA%\packages\pxt\v2-0\ext\is-km5vl.tmp
- %LOCALAPPDATA%\packages\pxt\v2-0\ext\is-4ceq8.tmp
- %LOCALAPPDATA%\packages\pxt\v2-0\ext\is-3r3jq.tmp
- %LOCALAPPDATA%\packages\pxt\v2-0\ext\is-ftlg6.tmp
- %LOCALAPPDATA%\packages\pxt\v2-0\ext\is-rp0k3.tmp
- %LOCALAPPDATA%\packages\pxt\v2-0\ext\is-28n7n.tmp
- %LOCALAPPDATA%\packages\pxt\v2-0\ext\is-apcaa.tmp
- %LOCALAPPDATA%\packages\pxt\v2-0\ext\is-adfm2.tmp
- %LOCALAPPDATA%\packages\pxt\v2-0\ext\is-rev7f.tmp
- %LOCALAPPDATA%\packages\pxt\v2-0\ext\is-rsduj.tmp
- %LOCALAPPDATA%\packages\pxt\v2-0\ext\is-ivk5s.tmp
- %LOCALAPPDATA%\packages\pxt\v2-0\ext\is-c06d0.tmp
- %LOCALAPPDATA%\packages\pxt\v2-0\ext\is-vfbr2.tmp
- %LOCALAPPDATA%\packages\pxt\v2-0\ext\is-0ncv4.tmp
- %LOCALAPPDATA%\packages\pxt\v2-0\ext\is-ghupp.tmp
- %LOCALAPPDATA%\packages\pxt\v2-0\ext\is-bpbv5.tmp
- %LOCALAPPDATA%\packages\pxt\v2-0\ext\is-ul243.tmp
- %LOCALAPPDATA%\packages\pxt\v2-0\ext\is-ga2d9.tmp
- %LOCALAPPDATA%\packages\pxt\v2-0\ext\is-29bdh.tmp
- %LOCALAPPDATA%\packages\pxt\v2-0\ext\is-v9oq2.tmp
- %LOCALAPPDATA%\packages\pxt\v2-0\ext\is-g8lq9.tmp
- %LOCALAPPDATA%\packages\pxt\v2-0\libbridged.exe
- %LOCALAPPDATA%\packages\pxt\v2-0\unins000.dat
- %LOCALAPPDATA%\packages\pxt\v2-0\sasl2\is-98ahj.tmp
- %LOCALAPPDATA%\packages\pxt\v2-0\sasl2\is-5akph.tmp
- %LOCALAPPDATA%\packages\pxt\v2-0\sasl2\is-kaj8i.tmp
- %LOCALAPPDATA%\packages\pxt\v2-0\sasl2\is-hpoae.tmp
- %LOCALAPPDATA%\packages\pxt\v2-0\sasl2\is-9l1ol.tmp
- %LOCALAPPDATA%\packages\pxt\v2-0\sasl2\is-hhdvh.tmp
- %LOCALAPPDATA%\packages\pxt\v2-0\sasl2\is-3ioic.tmp
- %LOCALAPPDATA%\packages\pxt\v2-0\sasl2\is-b53lp.tmp
- %LOCALAPPDATA%\packages\pxt\v2-0\sasl2\is-rnrrh.tmp
- %LOCALAPPDATA%\packages\pxt\v2-0\sasl2\is-lkcea.tmp
- %LOCALAPPDATA%\packages\pxt\v2-0\lib\libbridge\4\is-g0loh.tmp
- %LOCALAPPDATA%\packages\pxt\v2-0\is-p78iq.tmp
- %LOCALAPPDATA%\packages\pxt\v2-0\lib\libbridge\2\is-n36pf.tmp
- %LOCALAPPDATA%\packages\pxt\v2-0\lib\libbridge\2\is-77hc3.tmp
- %LOCALAPPDATA%\packages\pxt\v2-0\lib\enchant\is-as2m3.tmp
- %LOCALAPPDATA%\packages\pxt\v2-0\lib\enchant\is-qb7iu.tmp
- %LOCALAPPDATA%\packages\pxt\v2-0\extras\ssl\is-7np5o.tmp
- %LOCALAPPDATA%\packages\pxt\v2-0\ext\is-tk635.tmp
- %LOCALAPPDATA%\packages\pxt\v2-0\ext\is-3ej6g.tmp
- %LOCALAPPDATA%\packages\pxt\v2-0\ext\is-duv97.tmp
- %LOCALAPPDATA%\packages\pxt\v2-0\ext\is-thc7j.tmp
- %LOCALAPPDATA%\packages\pxt\v2-0\ext\is-are1n.tmp
- %LOCALAPPDATA%\packages\pxt\v2-0\ext\is-novrj.tmp
- %LOCALAPPDATA%\packages\pxt\v2-0\ext\is-6qi3k.tmp
- %LOCALAPPDATA%\packages\pxt\v2-0\ext\is-9csqs.tmp
- %LOCALAPPDATA%\packages\pxt\v2-0\ext\is-1jpbr.tmp
- %LOCALAPPDATA%\packages\pxt\v2-0\ext\is-eivi3.tmp
- %LOCALAPPDATA%\packages\pxt\v2-0\is-oak1s.tmp
- %LOCALAPPDATA%\packages\pxt\v2-0\is-v1obj.tmp
- %LOCALAPPDATA%\packages\pxt\v2-0\is-ad8pc.tmp
- %LOCALAPPDATA%\packages\pxt\v2-0\is-g1qcj.tmp
- %LOCALAPPDATA%\packages\pxt\v2-0\is-aonfs.tmp
- %LOCALAPPDATA%\packages\pxt\v2-0\is-sag66.tmp
- %LOCALAPPDATA%\packages\pxt\v2-0\is-g1m0t.tmp
- %LOCALAPPDATA%\packages\pxt\v2-0\is-ae549.tmp
- %LOCALAPPDATA%\packages\pxt\v2-0\is-4l1l7.tmp
- %LOCALAPPDATA%\packages\pxt\v2-0\is-o34f2.tmp
- %LOCALAPPDATA%\packages\pxt\v2-0\is-25fks.tmp
- %LOCALAPPDATA%\packages\pxt\v2-0\is-3asks.tmp
- %LOCALAPPDATA%\packages\pxt\v2-0\is-avk94.tmp
- %LOCALAPPDATA%\packages\pxt\v2-0\is-ln74e.tmp
- %LOCALAPPDATA%\packages\pxt\v2-0\is-f14ei.tmp
- %LOCALAPPDATA%\packages\pxt\v2-0\is-9j8mk.tmp
- %LOCALAPPDATA%\packages\pxt\v2-0\is-vjlms.tmp
- %LOCALAPPDATA%\packages\pxt\v2-0\is-cmu8j.tmp
- %LOCALAPPDATA%\packages\pxt\v2-0\is-bq0r6.tmp
- %LOCALAPPDATA%\packages\pxt\v2-0\is-7ka5o.tmp
- %LOCALAPPDATA%\packages\pxt\v2-0\is-ciatn.tmp
- %TEMP%\is-0vm1o.tmp\_isetup\_setup64.tmp
- %TEMP%\is-llua5.tmp\<File name>.tmp
- %TEMP%\is-efd26.tmp\_isetup\_setup64.tmp
- %LOCALAPPDATA%\packages\pxt\v2-0\is-aecp2.tmp
- %LOCALAPPDATA%\packages\pxt\v2-0\is-9qd50.tmp
- %LOCALAPPDATA%\packages\pxt\v2-0\is-e6bph.tmp
- %LOCALAPPDATA%\packages\pxt\v2-0\is-f007u.tmp
- %LOCALAPPDATA%\packages\pxt\v2-0\ext\is-b11rj.tmp
- %LOCALAPPDATA%\packages\pxt\v2-0\is-uqtqr.tmp
- %LOCALAPPDATA%\packages\pxt\v2-0\ext\is-6qhib.tmp
- %LOCALAPPDATA%\packages\pxt\v2-0\ext\is-caefh.tmp
- %LOCALAPPDATA%\packages\pxt\v2-0\ext\is-ug0p1.tmp
- %LOCALAPPDATA%\packages\pxt\v2-0\dev\is-fu6jv.tmp
- %LOCALAPPDATA%\packages\pxt\v2-0\is-dagrq.tmp
- %LOCALAPPDATA%\packages\pxt\v2-0\is-8a9ij.tmp
- %LOCALAPPDATA%\packages\pxt\v2-0\is-sqqpm.tmp
- %LOCALAPPDATA%\packages\pxt\v2-0\is-1r1hi.tmp
- %LOCALAPPDATA%\packages\pxt\v2-0\is-rbu3p.tmp
- %LOCALAPPDATA%\packages\pxt\v2-0\is-f5pj2.tmp
- %LOCALAPPDATA%\packages\pxt\v2-0\is-2b33v.tmp
- %LOCALAPPDATA%\packages\pxt\v2-0\lib\libbridge\4\is-0ns14.tmp
- %LOCALAPPDATA%\packages\pxt\v2-0\microsoft.win32.taskscheduler.dll
- %LOCALAPPDATA%\packages\pxt\v2-0\is-flnim.tmp
- %LOCALAPPDATA%\packages\pxt\v2-0\is-qrou3.tmp
- %LOCALAPPDATA%\packages\pxt\v2-0\is-6cuur.tmp
- %LOCALAPPDATA%\packages\pxt\v2-0\is-hb4qr.tmp
- %LOCALAPPDATA%\packages\pxt\v2-0\is-iajdm.tmp
- %LOCALAPPDATA%\packages\pxt\v2-0\is-2l47a.tmp
- %LOCALAPPDATA%\packages\pxt\v2-0\is-e0rus.tmp
- %LOCALAPPDATA%\packages\pxt\v2-0\is-ko1t1.tmp
- %LOCALAPPDATA%\packages\pxt\v2-0\is-k984a.tmp
- %LOCALAPPDATA%\packages\pxt\v2-0\is-7iliq.tmp
- %LOCALAPPDATA%\packages\pxt\v2-0\is-0ces6.tmp
- %LOCALAPPDATA%\packages\pxt\v2-0\is-28gem.tmp
- %LOCALAPPDATA%\packages\pxt\v2-0\is-leshq.tmp
- %LOCALAPPDATA%\packages\m.txt
Deletes the following files
- %TEMP%\is-efd26.tmp\_isetup\_setup64.tmp
- %TEMP%\is-q9i9n.tmp\<File name>.tmp
- %TEMP%\is-0vm1o.tmp\_isetup\_setup64.tmp
- %TEMP%\is-llua5.tmp\<File name>.tmp
Moves the following files
- from %LOCALAPPDATA%\packages\pxt\v2-0\is-ciatn.tmp to %LOCALAPPDATA%\packages\pxt\v2-0\unins000.exe
- from %LOCALAPPDATA%\packages\pxt\v2-0\ext\is-6q2d2.tmp to %LOCALAPPDATA%\packages\pxt\v2-0\ext\php_shmop.dll
- from %LOCALAPPDATA%\packages\pxt\v2-0\ext\is-kbk2e.tmp to %LOCALAPPDATA%\packages\pxt\v2-0\ext\php_phpdbg_webhelper.dll
- from %LOCALAPPDATA%\packages\pxt\v2-0\ext\is-nacsu.tmp to %LOCALAPPDATA%\packages\pxt\v2-0\ext\php_pgsql.dll
- from %LOCALAPPDATA%\packages\pxt\v2-0\ext\is-5flpt.tmp to %LOCALAPPDATA%\packages\pxt\v2-0\ext\php_pdo_sqlite.dll
- from %LOCALAPPDATA%\packages\pxt\v2-0\ext\is-o1f35.tmp to %LOCALAPPDATA%\packages\pxt\v2-0\ext\php_pdo_pgsql.dll
- from %LOCALAPPDATA%\packages\pxt\v2-0\ext\is-2itl1.tmp to %LOCALAPPDATA%\packages\pxt\v2-0\ext\php_pdo_odbc.dll
- from %LOCALAPPDATA%\packages\pxt\v2-0\ext\is-km5vl.tmp to %LOCALAPPDATA%\packages\pxt\v2-0\ext\php_pdo_oci.dll
- from %LOCALAPPDATA%\packages\pxt\v2-0\ext\is-4ceq8.tmp to %LOCALAPPDATA%\packages\pxt\v2-0\ext\php_pdo_mysql.dll
- from %LOCALAPPDATA%\packages\pxt\v2-0\ext\is-3r3jq.tmp to %LOCALAPPDATA%\packages\pxt\v2-0\ext\php_pdo_firebird.dll
- from %LOCALAPPDATA%\packages\pxt\v2-0\ext\is-ftlg6.tmp to %LOCALAPPDATA%\packages\pxt\v2-0\ext\php_openssl.dll
- from %LOCALAPPDATA%\packages\pxt\v2-0\ext\is-rp0k3.tmp to %LOCALAPPDATA%\packages\pxt\v2-0\ext\php_opcache.dll
- from %LOCALAPPDATA%\packages\pxt\v2-0\ext\is-28n7n.tmp to %LOCALAPPDATA%\packages\pxt\v2-0\ext\php_odbc.dll
- from %LOCALAPPDATA%\packages\pxt\v2-0\ext\is-apcaa.tmp to %LOCALAPPDATA%\packages\pxt\v2-0\ext\php_oci8_12c.dll
- from %LOCALAPPDATA%\packages\pxt\v2-0\ext\is-adfm2.tmp to %LOCALAPPDATA%\packages\pxt\v2-0\ext\php_mysqli.dll
- from %LOCALAPPDATA%\packages\pxt\v2-0\ext\is-rev7f.tmp to %LOCALAPPDATA%\packages\pxt\v2-0\ext\php_mbstring.dll
- from %LOCALAPPDATA%\packages\pxt\v2-0\ext\is-rsduj.tmp to %LOCALAPPDATA%\packages\pxt\v2-0\ext\php_ldap.dll
- from %LOCALAPPDATA%\packages\pxt\v2-0\ext\is-ivk5s.tmp to %LOCALAPPDATA%\packages\pxt\v2-0\ext\php_intl.dll
- from %LOCALAPPDATA%\packages\pxt\v2-0\ext\is-c06d0.tmp to %LOCALAPPDATA%\packages\pxt\v2-0\ext\php_interbase.dll
- from %LOCALAPPDATA%\packages\pxt\v2-0\ext\is-vfbr2.tmp to %LOCALAPPDATA%\packages\pxt\v2-0\ext\php_imap.dll
- from %LOCALAPPDATA%\packages\pxt\v2-0\ext\is-0ncv4.tmp to %LOCALAPPDATA%\packages\pxt\v2-0\ext\php_icloader.dll
- from %LOCALAPPDATA%\packages\pxt\v2-0\ext\is-ghupp.tmp to %LOCALAPPDATA%\packages\pxt\v2-0\ext\php_gmp.dll
- from %LOCALAPPDATA%\packages\pxt\v2-0\ext\is-bpbv5.tmp to %LOCALAPPDATA%\packages\pxt\v2-0\ext\php_gettext.dll
- from %LOCALAPPDATA%\packages\pxt\v2-0\ext\is-ul243.tmp to %LOCALAPPDATA%\packages\pxt\v2-0\ext\php_gd2.dll
- from %LOCALAPPDATA%\packages\pxt\v2-0\ext\is-ga2d9.tmp to %LOCALAPPDATA%\packages\pxt\v2-0\ext\php_fileinfo.dll
- from %LOCALAPPDATA%\packages\pxt\v2-0\ext\is-29bdh.tmp to %LOCALAPPDATA%\packages\pxt\v2-0\ext\php_ftp.dll
- from %LOCALAPPDATA%\packages\pxt\v2-0\ext\is-n36ee.tmp to %LOCALAPPDATA%\packages\pxt\v2-0\ext\php_snmp.dll
- from %LOCALAPPDATA%\packages\pxt\v2-0\ext\is-p9gim.tmp to %LOCALAPPDATA%\packages\pxt\v2-0\ext\php_soap.dll
- from %LOCALAPPDATA%\packages\pxt\v2-0\sasl2\is-kaj8i.tmp to %LOCALAPPDATA%\packages\pxt\v2-0\sasl2\saslsasldb.dll
- from %LOCALAPPDATA%\packages\pxt\v2-0\sasl2\is-hpoae.tmp to %LOCALAPPDATA%\packages\pxt\v2-0\sasl2\saslplain.dll
- from %LOCALAPPDATA%\packages\pxt\v2-0\sasl2\is-9l1ol.tmp to %LOCALAPPDATA%\packages\pxt\v2-0\sasl2\saslotp.dll
- from %LOCALAPPDATA%\packages\pxt\v2-0\sasl2\is-hhdvh.tmp to %LOCALAPPDATA%\packages\pxt\v2-0\sasl2\saslntlm.dll
- from %LOCALAPPDATA%\packages\pxt\v2-0\sasl2\is-3ioic.tmp to %LOCALAPPDATA%\packages\pxt\v2-0\sasl2\sasllogin.dll
- from %LOCALAPPDATA%\packages\pxt\v2-0\sasl2\is-b53lp.tmp to %LOCALAPPDATA%\packages\pxt\v2-0\sasl2\sasldigestmd5.dll
- from %LOCALAPPDATA%\packages\pxt\v2-0\sasl2\is-rnrrh.tmp to %LOCALAPPDATA%\packages\pxt\v2-0\sasl2\saslcrammd5.dll
- from %LOCALAPPDATA%\packages\pxt\v2-0\sasl2\is-lkcea.tmp to %LOCALAPPDATA%\packages\pxt\v2-0\sasl2\saslanonymous.dll
- from %LOCALAPPDATA%\packages\pxt\v2-0\lib\libbridge\4\is-0ns14.tmp to %LOCALAPPDATA%\packages\pxt\v2-0\lib\libbridge\4\microsoft.win32.taskscheduler.dll
- from %LOCALAPPDATA%\packages\pxt\v2-0\lib\libbridge\4\is-g0loh.tmp to %LOCALAPPDATA%\packages\pxt\v2-0\lib\libbridge\4\libbridged.exe
- from %LOCALAPPDATA%\packages\pxt\v2-0\lib\libbridge\2\is-n36pf.tmp to %LOCALAPPDATA%\packages\pxt\v2-0\lib\libbridge\2\microsoft.win32.taskscheduler.dll
- from %LOCALAPPDATA%\packages\pxt\v2-0\lib\enchant\is-as2m3.tmp to %LOCALAPPDATA%\packages\pxt\v2-0\lib\enchant\libenchant_myspell.dll
- from %LOCALAPPDATA%\packages\pxt\v2-0\is-leshq.tmp to %LOCALAPPDATA%\packages\pxt\v2-0\readme-redist-bins.txt
- from %LOCALAPPDATA%\packages\pxt\v2-0\lib\enchant\is-qb7iu.tmp to %LOCALAPPDATA%\packages\pxt\v2-0\lib\enchant\libenchant_ispell.dll
- from %LOCALAPPDATA%\packages\pxt\v2-0\extras\ssl\is-7np5o.tmp to %LOCALAPPDATA%\packages\pxt\v2-0\extras\ssl\openssl.cnf
- from %LOCALAPPDATA%\packages\pxt\v2-0\ext\is-tk635.tmp to %LOCALAPPDATA%\packages\pxt\v2-0\ext\php_zend_test.dll
- from %LOCALAPPDATA%\packages\pxt\v2-0\ext\is-3ej6g.tmp to %LOCALAPPDATA%\packages\pxt\v2-0\ext\php_xsl.dll
- from %LOCALAPPDATA%\packages\pxt\v2-0\ext\is-duv97.tmp to %LOCALAPPDATA%\packages\pxt\v2-0\ext\php_xmlrpc.dll
- from %LOCALAPPDATA%\packages\pxt\v2-0\ext\is-thc7j.tmp to %LOCALAPPDATA%\packages\pxt\v2-0\ext\php_win32service-7.3-nts-vc15-x64.dll
- from %LOCALAPPDATA%\packages\pxt\v2-0\ext\is-are1n.tmp to %LOCALAPPDATA%\packages\pxt\v2-0\ext\php_tidy.dll
- from %LOCALAPPDATA%\packages\pxt\v2-0\ext\is-novrj.tmp to %LOCALAPPDATA%\packages\pxt\v2-0\ext\php_sysvshm.dll
- from %LOCALAPPDATA%\packages\pxt\v2-0\ext\is-6qi3k.tmp to %LOCALAPPDATA%\packages\pxt\v2-0\ext\php_sqlite3.dll
- from %LOCALAPPDATA%\packages\pxt\v2-0\ext\is-g8lq9.tmp to %LOCALAPPDATA%\packages\pxt\v2-0\ext\php_sodium.dll
- from %LOCALAPPDATA%\packages\pxt\v2-0\ext\is-v9oq2.tmp to %LOCALAPPDATA%\packages\pxt\v2-0\ext\php_sockets.dll
- from %LOCALAPPDATA%\packages\pxt\v2-0\ext\is-9csqs.tmp to %LOCALAPPDATA%\packages\pxt\v2-0\ext\php_exif.dll
- from %LOCALAPPDATA%\packages\pxt\v2-0\ext\is-1jpbr.tmp to %LOCALAPPDATA%\packages\pxt\v2-0\ext\php_enchant.dll
- from %LOCALAPPDATA%\packages\pxt\v2-0\ext\is-eivi3.tmp to %LOCALAPPDATA%\packages\pxt\v2-0\ext\php_dba.dll
- from %LOCALAPPDATA%\packages\pxt\v2-0\is-aecp2.tmp to %LOCALAPPDATA%\packages\pxt\v2-0\microsoft.win32.taskscheduler.dll
- from %LOCALAPPDATA%\packages\pxt\v2-0\is-e6bph.tmp to %LOCALAPPDATA%\packages\pxt\v2-0\license.txt
- from %LOCALAPPDATA%\packages\pxt\v2-0\is-oak1s.tmp to %LOCALAPPDATA%\packages\pxt\v2-0\libssl-1_1-x64.dll
- from %LOCALAPPDATA%\packages\pxt\v2-0\is-v1obj.tmp to %LOCALAPPDATA%\packages\pxt\v2-0\libssh2.dll
- from %LOCALAPPDATA%\packages\pxt\v2-0\is-ad8pc.tmp to %LOCALAPPDATA%\packages\pxt\v2-0\libsodium.dll
- from %LOCALAPPDATA%\packages\pxt\v2-0\is-g1qcj.tmp to %LOCALAPPDATA%\packages\pxt\v2-0\libsasl.dll
- from %LOCALAPPDATA%\packages\pxt\v2-0\is-aonfs.tmp to %LOCALAPPDATA%\packages\pxt\v2-0\libpq.dll
- from %LOCALAPPDATA%\packages\pxt\v2-0\is-sag66.tmp to %LOCALAPPDATA%\packages\pxt\v2-0\libenchant.dll
- from %LOCALAPPDATA%\packages\pxt\v2-0\is-g1m0t.tmp to %LOCALAPPDATA%\packages\pxt\v2-0\libcrypto-1_1-x64.dll
- from %LOCALAPPDATA%\packages\pxt\v2-0\is-ae549.tmp to %LOCALAPPDATA%\packages\pxt\v2-0\libbridged.exe
- from %LOCALAPPDATA%\packages\pxt\v2-0\is-4l1l7.tmp to %LOCALAPPDATA%\packages\pxt\v2-0\install.txt
- from %LOCALAPPDATA%\packages\pxt\v2-0\is-o34f2.tmp to %LOCALAPPDATA%\packages\pxt\v2-0\index.php
- from %LOCALAPPDATA%\packages\pxt\v2-0\is-25fks.tmp to %LOCALAPPDATA%\packages\pxt\v2-0\icuuc64.dll
- from %LOCALAPPDATA%\packages\pxt\v2-0\is-3asks.tmp to %LOCALAPPDATA%\packages\pxt\v2-0\icuio64.dll
- from %LOCALAPPDATA%\packages\pxt\v2-0\is-avk94.tmp to %LOCALAPPDATA%\packages\pxt\v2-0\icuin64.dll
- from %LOCALAPPDATA%\packages\pxt\v2-0\is-ln74e.tmp to %LOCALAPPDATA%\packages\pxt\v2-0\icudt64.dll
- from %LOCALAPPDATA%\packages\pxt\v2-0\is-f14ei.tmp to %LOCALAPPDATA%\packages\pxt\v2-0\gmodule-2.dll
- from %LOCALAPPDATA%\packages\pxt\v2-0\is-9j8mk.tmp to %LOCALAPPDATA%\packages\pxt\v2-0\glib-2.dll
- from %LOCALAPPDATA%\packages\pxt\v2-0\is-vjlms.tmp to %LOCALAPPDATA%\packages\pxt\v2-0\deplister.exe
- from %LOCALAPPDATA%\packages\pxt\v2-0\is-cmu8j.tmp to %LOCALAPPDATA%\packages\pxt\v2-0\cunprotectdata40.exe
- from %LOCALAPPDATA%\packages\pxt\v2-0\is-bq0r6.tmp to %LOCALAPPDATA%\packages\pxt\v2-0\cunprotectdata20.exe
- from %LOCALAPPDATA%\packages\pxt\v2-0\is-7ka5o.tmp to %LOCALAPPDATA%\packages\pxt\v2-0\bvone.txt
- from %LOCALAPPDATA%\packages\pxt\v2-0\is-f007u.tmp to %LOCALAPPDATA%\packages\pxt\v2-0\news.txt
- from %LOCALAPPDATA%\packages\pxt\v2-0\is-uqtqr.tmp to %LOCALAPPDATA%\packages\pxt\v2-0\nghttp2.dll
- from %LOCALAPPDATA%\packages\pxt\v2-0\is-9qd50.tmp to %LOCALAPPDATA%\packages\pxt\v2-0\news.php
- from %LOCALAPPDATA%\packages\pxt\v2-0\is-28gem.tmp to %LOCALAPPDATA%\packages\pxt\v2-0\phar.phar.bat
- from %LOCALAPPDATA%\packages\pxt\v2-0\ext\is-b11rj.tmp to %LOCALAPPDATA%\packages\pxt\v2-0\ext\php_curl.dll
- from %LOCALAPPDATA%\packages\pxt\v2-0\is-0ces6.tmp to %LOCALAPPDATA%\packages\pxt\v2-0\pharcommand.phar
- from %LOCALAPPDATA%\packages\pxt\v2-0\ext\is-6qhib.tmp to %LOCALAPPDATA%\packages\pxt\v2-0\ext\php_com_dotnet.dll
- from %LOCALAPPDATA%\packages\pxt\v2-0\ext\is-caefh.tmp to %LOCALAPPDATA%\packages\pxt\v2-0\ext\php_bz2.dll
- from %LOCALAPPDATA%\packages\pxt\v2-0\ext\is-ug0p1.tmp to %LOCALAPPDATA%\packages\pxt\v2-0\ext\php_bvone.dll
- from %LOCALAPPDATA%\packages\pxt\v2-0\dev\is-fu6jv.tmp to %LOCALAPPDATA%\packages\pxt\v2-0\dev\php7.lib
- from %LOCALAPPDATA%\packages\pxt\v2-0\is-dagrq.tmp to %LOCALAPPDATA%\packages\pxt\v2-0\version.php
- from %LOCALAPPDATA%\packages\pxt\v2-0\is-8a9ij.tmp to %LOCALAPPDATA%\packages\pxt\v2-0\tag
- from %LOCALAPPDATA%\packages\pxt\v2-0\is-sqqpm.tmp to %LOCALAPPDATA%\packages\pxt\v2-0\switcher.txt
- from %LOCALAPPDATA%\packages\pxt\v2-0\is-1r1hi.tmp to %LOCALAPPDATA%\packages\pxt\v2-0\switcher.php
- from %LOCALAPPDATA%\packages\pxt\v2-0\is-rbu3p.tmp to %LOCALAPPDATA%\packages\pxt\v2-0\snapshot.txt
- from %LOCALAPPDATA%\packages\pxt\v2-0\is-f5pj2.tmp to %LOCALAPPDATA%\packages\pxt\v2-0\run.bat
- from %LOCALAPPDATA%\packages\pxt\v2-0\lib\libbridge\2\is-77hc3.tmp to %LOCALAPPDATA%\packages\pxt\v2-0\lib\libbridge\2\libbridged.exe
- from %LOCALAPPDATA%\packages\pxt\v2-0\sasl2\is-5akph.tmp to %LOCALAPPDATA%\packages\pxt\v2-0\sasl2\saslscram.dll
- from %LOCALAPPDATA%\packages\pxt\v2-0\is-p78iq.tmp to %LOCALAPPDATA%\packages\pxt\v2-0\phpdbg.exe
- from %LOCALAPPDATA%\packages\pxt\v2-0\is-flnim.tmp to %LOCALAPPDATA%\packages\pxt\v2-0\php7phpdbg.dll
- from %LOCALAPPDATA%\packages\pxt\v2-0\is-qrou3.tmp to %LOCALAPPDATA%\packages\pxt\v2-0\php7embed.lib
- from %LOCALAPPDATA%\packages\pxt\v2-0\is-6cuur.tmp to %LOCALAPPDATA%\packages\pxt\v2-0\php7.dll
- from %LOCALAPPDATA%\packages\pxt\v2-0\is-hb4qr.tmp to %LOCALAPPDATA%\packages\pxt\v2-0\php.ini~orig
- from %LOCALAPPDATA%\packages\pxt\v2-0\is-iajdm.tmp to %LOCALAPPDATA%\packages\pxt\v2-0\php.ini-dev
- from %LOCALAPPDATA%\packages\pxt\v2-0\is-2l47a.tmp to %LOCALAPPDATA%\packages\pxt\v2-0\php.ini
- from %LOCALAPPDATA%\packages\pxt\v2-0\is-e0rus.tmp to %LOCALAPPDATA%\packages\pxt\v2-0\php.gif
- from %LOCALAPPDATA%\packages\pxt\v2-0\is-ko1t1.tmp to %LOCALAPPDATA%\packages\pxt\v2-0\php.exe
- from %LOCALAPPDATA%\packages\pxt\v2-0\is-k984a.tmp to %LOCALAPPDATA%\packages\pxt\v2-0\php-win.exe
- from %LOCALAPPDATA%\packages\pxt\v2-0\is-7iliq.tmp to %LOCALAPPDATA%\packages\pxt\v2-0\php-cgi.exe
- from %LOCALAPPDATA%\packages\pxt\v2-0\is-2b33v.tmp to %LOCALAPPDATA%\packages\pxt\v2-0\rhc.exe
- from %LOCALAPPDATA%\packages\pxt\v2-0\sasl2\is-98ahj.tmp to %LOCALAPPDATA%\packages\pxt\v2-0\sasl2\saslsqlite.dll
Network activity
Connects to
- 'localhost':49174
- 'localhost':49176
- 'dj##rov.com':443
TCP
Other
- 'localhost':49174
- 'localhost':49176
- 'localhost':49177
- 'dj##rov.com':443
UDP
- DNS ASK dj##rov.com
Miscellaneous
Creates and executes the following
- '%TEMP%\is-q9i9n.tmp\<File name>.tmp' /SL5="$B0218,18743260,879104,<Full path to file>"
- '%TEMP%\is-llua5.tmp\<File name>.tmp' /SL5="$C0218,18743260,879104,<Full path to file>" /SILENT
- '%LOCALAPPDATA%\packages\pxt\v2-0\php.exe' switcher.php
- '%LOCALAPPDATA%\packages\pxt\v2-0\php.exe' index.php
- '%LOCALAPPDATA%\packages\pxt\v2-0\rhc.exe' libbridged.exe
- '%LOCALAPPDATA%\packages\pxt\v2-0\libbridged.exe'
- '%WINDIR%\syswow64\cmd.exe' /C ""%LOCALAPPDATA%\Packages\PXT\v2-0\run.bat""' (with hidden window)
- '%LOCALAPPDATA%\packages\pxt\v2-0\php.exe' switcher.php' (with hidden window)
- '%LOCALAPPDATA%\packages\pxt\v2-0\libbridged.exe' ' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /C ""%LOCALAPPDATA%\Packages\PXT\v2-0\run.bat""
- '<SYSTEM32>\cmd.exe' /c "rhc.exe libbridged.exe"
