Technical Information
Modifies file system
Creates the following files
- %TEMP%\ec83.tmp\ec84.tmp\ec85.bat
- <SYSTEM32>\windowspowershell\v1.0\devcon.exe
- <SYSTEM32>\windowspowershell\v1.0\findstr.ps1
- <SYSTEM32>\windowspowershell\v1.0\getwlanhwids.exe
- <SYSTEM32>\windowspowershell\v1.0\libiconv2.dll
- <SYSTEM32>\windowspowershell\v1.0\libintl3.dll
- <SYSTEM32>\windowspowershell\v1.0\showusbnumber.exe
- <SYSTEM32>\windowspowershell\v1.0\test.exe
- <SYSTEM32>\windowspowershell\v1.0\usbview.exe
- %TEMP%\__psscriptpolicytest_wbngeh35.cre.ps1
- %TEMP%\__psscriptpolicytest_vtrk2dz1.n5f.psm1
- %TEMP%\content\2808-4036-getwlanhwids.exe-21-01-31-655.dump
- %TEMP%\content\2808-4036-getwlanhwids.exe-21-01-33-132.dump
- %LOCALAPPDATA%\microsoft\clr_v4.0\usagelogs\getwlanhwids.exe.log
- %TEMP%\__psscriptpolicytest_0kitd0nu.0rx.ps1
- %TEMP%\__psscriptpolicytest_0zwfam3i.xys.psm1
- %TEMP%\content\2080-1088-getwlanhwids.exe-21-01-35-348.dump
- %TEMP%\content\2080-1088-getwlanhwids.exe-21-01-36-397.dump
- %TEMP%\__psscriptpolicytest_2wnctetx.5p5.ps1
- %TEMP%\__psscriptpolicytest_pfpupwr3.kii.psm1
- %TEMP%\content\1960-4076-getwlanhwids.exe-21-01-39-461.dump
- %TEMP%\content\1960-4076-getwlanhwids.exe-21-01-40-546.dump
- %TEMP%\__psscriptpolicytest_nw1habpf.2tj.ps1
- %TEMP%\__psscriptpolicytest_didclled.rzn.psm1
- %TEMP%\content\3772-2884-getwlanhwids.exe-21-01-43-498.dump
- %TEMP%\content\3772-2884-getwlanhwids.exe-21-01-44-626.dump
- %TEMP%\__psscriptpolicytest_5swstu1w.os5.ps1
- %TEMP%\__psscriptpolicytest_qwqdr2y2.rfo.psm1
- %TEMP%\content\3784-2704-getwlanhwids.exe-21-01-47-452.dump
- %TEMP%\content\3784-2704-getwlanhwids.exe-21-01-48-591.dump
- %TEMP%\__psscriptpolicytest_i0kfndrk.rbg.ps1
- %TEMP%\__psscriptpolicytest_0moxk3if.xne.psm1
- %TEMP%\content\4404-1416-getwlanhwids.exe-21-01-51-992.dump
- %TEMP%\content\4404-1416-getwlanhwids.exe-21-01-53-568.dump
- %TEMP%\__psscriptpolicytest_wa1mku4z.kvo.ps1
- %TEMP%\__psscriptpolicytest_ebeo0wzl.i31.psm1
- %TEMP%\content\3688-1144-getwlanhwids.exe-21-01-56-683.dump
- %TEMP%\content\3688-1144-getwlanhwids.exe-21-01-57-981.dump
- %TEMP%\__psscriptpolicytest_3qqw5gjt.uzz.ps1
- %TEMP%\__psscriptpolicytest_x51lchrn.me4.psm1
- %TEMP%\content\3244-4140-getwlanhwids.exe-21-02-00-705.dump
- %TEMP%\content\3244-4140-getwlanhwids.exe-21-02-02-529.dump
- %TEMP%\__psscriptpolicytest_skb1r4ga.ix4.ps1
- %TEMP%\__psscriptpolicytest_dcvhpywe.pkw.psm1
- %TEMP%\content\408-816-getwlanhwids.exe-21-02-05-665.dump
- %TEMP%\content\408-816-getwlanhwids.exe-21-02-07-526.dump
- %TEMP%\__psscriptpolicytest_3xwpoldv.4fv.ps1
- %TEMP%\__psscriptpolicytest_10il5rjg.rkn.psm1
- %TEMP%\content\4388-3752-getwlanhwids.exe-21-02-10-930.dump
- %TEMP%\content\4388-3752-getwlanhwids.exe-21-02-12-246.dump
- %TEMP%\__psscriptpolicytest_5rfndc1a.55l.ps1
- %TEMP%\__psscriptpolicytest_sjwjjtqd.gjj.psm1
- %TEMP%\content\3792-3908-getwlanhwids.exe-21-02-15-670.dump
- %TEMP%\content\3792-3908-getwlanhwids.exe-21-02-17-497.dump
- %TEMP%\__psscriptpolicytest_bmllamlc.ovk.ps1
- %TEMP%\__psscriptpolicytest_wbakoxid.ywc.psm1
- %TEMP%\content\4016-1376-getwlanhwids.exe-21-02-24-909.dump
- %TEMP%\content\4016-1376-getwlanhwids.exe-21-02-27-425.dump
- %TEMP%\__psscriptpolicytest_2fhcoo2y.xay.ps1
- %TEMP%\__psscriptpolicytest_tosbvq5o.jsr.psm1
- %TEMP%\content\1020-1648-getwlanhwids.exe-21-02-31-110.dump
- %TEMP%\content\1020-1648-getwlanhwids.exe-21-02-32-605.dump
- %TEMP%\__psscriptpolicytest_p5midcas.nsq.ps1
- %TEMP%\__psscriptpolicytest_t0d4f41s.zqz.psm1
- %TEMP%\content\3272-1100-getwlanhwids.exe-21-02-35-659.dump
- %TEMP%\content\3272-1100-getwlanhwids.exe-21-02-37-091.dump
- %TEMP%\__psscriptpolicytest_4odkyj1f.hl0.ps1
- %TEMP%\__psscriptpolicytest_d15pkaot.dhb.psm1
- %TEMP%\content\4404-3252-getwlanhwids.exe-21-02-48-341.dump
- %TEMP%\content\4404-3252-getwlanhwids.exe-21-02-52-022.dump
- %TEMP%\__psscriptpolicytest_buc3lr1y.i4o.ps1
- %TEMP%\__psscriptpolicytest_evugvpbg.22x.psm1
- %TEMP%\content\3688-4020-getwlanhwids.exe-21-02-58-718.dump
- %TEMP%\content\3688-4020-getwlanhwids.exe-21-03-01-259.dump
- %TEMP%\__psscriptpolicytest_jp43f0na.pa2.ps1
- %TEMP%\__psscriptpolicytest_i1bzndlj.wxc.psm1
- %TEMP%\content\3512-2076-getwlanhwids.exe-21-03-05-615.dump
Deletes following files that it created itself
- %TEMP%\__psscriptpolicytest_wbngeh35.cre.ps1
- %TEMP%\__psscriptpolicytest_vtrk2dz1.n5f.psm1
- %TEMP%\__psscriptpolicytest_0kitd0nu.0rx.ps1
- %TEMP%\__psscriptpolicytest_0zwfam3i.xys.psm1
- %TEMP%\__psscriptpolicytest_2wnctetx.5p5.ps1
- %TEMP%\__psscriptpolicytest_pfpupwr3.kii.psm1
- %TEMP%\__psscriptpolicytest_nw1habpf.2tj.ps1
- %TEMP%\__psscriptpolicytest_didclled.rzn.psm1
- %TEMP%\__psscriptpolicytest_5swstu1w.os5.ps1
- %TEMP%\__psscriptpolicytest_qwqdr2y2.rfo.psm1
- %TEMP%\__psscriptpolicytest_i0kfndrk.rbg.ps1
- %TEMP%\__psscriptpolicytest_0moxk3if.xne.psm1
- %TEMP%\__psscriptpolicytest_wa1mku4z.kvo.ps1
- %TEMP%\__psscriptpolicytest_ebeo0wzl.i31.psm1
- %TEMP%\__psscriptpolicytest_3qqw5gjt.uzz.ps1
- %TEMP%\__psscriptpolicytest_x51lchrn.me4.psm1
- %TEMP%\__psscriptpolicytest_skb1r4ga.ix4.ps1
- %TEMP%\__psscriptpolicytest_dcvhpywe.pkw.psm1
- %TEMP%\__psscriptpolicytest_3xwpoldv.4fv.ps1
- %TEMP%\__psscriptpolicytest_10il5rjg.rkn.psm1
- %TEMP%\__psscriptpolicytest_5rfndc1a.55l.ps1
- %TEMP%\__psscriptpolicytest_sjwjjtqd.gjj.psm1
- %TEMP%\__psscriptpolicytest_bmllamlc.ovk.ps1
- %TEMP%\__psscriptpolicytest_wbakoxid.ywc.psm1
- %TEMP%\__psscriptpolicytest_2fhcoo2y.xay.ps1
- %TEMP%\__psscriptpolicytest_tosbvq5o.jsr.psm1
- %TEMP%\__psscriptpolicytest_p5midcas.nsq.ps1
- %TEMP%\__psscriptpolicytest_t0d4f41s.zqz.psm1
- %TEMP%\__psscriptpolicytest_4odkyj1f.hl0.ps1
- %TEMP%\__psscriptpolicytest_d15pkaot.dhb.psm1
- %TEMP%\__psscriptpolicytest_buc3lr1y.i4o.ps1
- %TEMP%\__psscriptpolicytest_evugvpbg.22x.psm1
- %TEMP%\__psscriptpolicytest_jp43f0na.pa2.ps1
- %TEMP%\__psscriptpolicytest_i1bzndlj.wxc.psm1
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\windowspowershell\v1.0\getwlanhwids.exe'
Executes the following
- '<SYSTEM32>\cmd.exe' /c "%TEMP%\EC83.tmp\EC84.tmp\EC85.bat <Full path to file>"
- '<SYSTEM32>\attrib.exe' +S +H "<Current directory>\findstr.ps1"
- '<SYSTEM32>\attrib.exe' +S +H "<Current directory>\libiconv2.dll"
- '<SYSTEM32>\attrib.exe' +S +H "<Current directory>\libintl3.dll"
- '<SYSTEM32>\attrib.exe' +S +H "<Current directory>\usbview.exe"
- '<SYSTEM32>\attrib.exe' +S +H "<Current directory>\TEST.exe"
- '<SYSTEM32>\attrib.exe' +S +H "<Current directory>\showusbnumber.exe"
- '<SYSTEM32>\attrib.exe' +S +H "<Current directory>\devcon.exe"
- '<SYSTEM32>\attrib.exe' +S +H "<Current directory>\getwlanhwids.exe"
- '<SYSTEM32>\netsh.exe' wlan show interfaces
- '<SYSTEM32>\timeout.exe' 1
- '<SYSTEM32>\cmd.exe' /c "%TEMP%\EC83.tmp\EC84.tmp\EC85.bat <Full path to file>"' (with hidden window)
