Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- %APPDATA%\microsoft\windows\start menu\programs\startup\<File name>.exe
Modifies file system
Creates the following files
- %TEMP%\dcd.exe
- %TEMP%\944942fcc5cca81ab4907dd5c3\vs_bootstrapper_d15\zh-hans\vs_setup_bootstrapper.resources.dll
- %TEMP%\944942fcc5cca81ab4907dd5c3\vs_bootstrapper_d15\es\vs_setup_bootstrapper.resources.dll
- %TEMP%\944942fcc5cca81ab4907dd5c3\vs_bootstrapper_d15\ja\vs_setup_bootstrapper.resources.dll
- %TEMP%\944942fcc5cca81ab4907dd5c3\vs_bootstrapper_d15\ru\vs_setup_bootstrapper.resources.dll
- %TEMP%\944942fcc5cca81ab4907dd5c3\vs_bootstrapper_d15\it\vs_setup_bootstrapper.resources.dll
- %TEMP%\944942fcc5cca81ab4907dd5c3\vs_bootstrapper_d15\pl\vs_setup_bootstrapper.resources.dll
- %TEMP%\944942fcc5cca81ab4907dd5c3\vs_bootstrapper_d15\de\vs_setup_bootstrapper.resources.dll
- %TEMP%\944942fcc5cca81ab4907dd5c3\vs_bootstrapper_d15\fr\vs_setup_bootstrapper.resources.dll
- %TEMP%\944942fcc5cca81ab4907dd5c3\vs_bootstrapper_d15\ko\vs_setup_bootstrapper.resources.dll
- %TEMP%\944942fcc5cca81ab4907dd5c3\vs_bootstrapper_d15\zh-hant\vs_setup_bootstrapper.resources.dll
- %TEMP%\944942fcc5cca81ab4907dd5c3\vs_bootstrapper_d15\tr\vs_setup_bootstrapper.resources.dll
- %TEMP%\944942fcc5cca81ab4907dd5c3\vs_bootstrapper_d15\cs\vs_setup_bootstrapper.resources.dll
- %TEMP%\944942fcc5cca81ab4907dd5c3\vs_bootstrapper_d15\pt-br\vs_setup_bootstrapper.resources.dll
- %TEMP%\944942fcc5cca81ab4907dd5c3\vs_bootstrapper_d15\vs_setup_bootstrapper.config
- %TEMP%\944942fcc5cca81ab4907dd5c3\vs_bootstrapper_d15\vs_setup_bootstrapper.exe.config
- %TEMP%\944942fcc5cca81ab4907dd5c3\vs_bootstrapper_d15\detection.json
- %TEMP%\944942fcc5cca81ab4907dd5c3\vs_bootstrapper_d15\vs_setup_bootstrapper.json
- %TEMP%\dd_bootstrapper_20200328222143.log
- %PROGRAMDATA%\microsoft\visualstudio\packages\_bootstrapper\vs_setup_bootstrapper_202003282221455751.json
- %PROGRAMDATA%\microsoft visual studio\machinestorage.dat
- %PROGRAMDATA%\microsoft visual studio\machinestorage.dat.bak
- %TEMP%\944942fcc5cca81ab4907dd5c3\vs_bootstrapper_d15\newtonsoft.json.dll
- %TEMP%\vsremotecontrol\9652f9101fd04a38ad5ee5d450356022
- %TEMP%\944942fcc5cca81ab4907dd5c3\vs_bootstrapper_d15\microsoft.visualstudio.utilities.internal.dll
- %TEMP%\944942fcc5cca81ab4907dd5c3\vs_bootstrapper_d15\microsoft.visualstudio.setup.download.dll
- %TEMP%\1.exe
- %TEMP%\dd_1_decompression_log.txt
- %TEMP%\944942fcc5cca81ab4907dd5c3\vs_bootstrapper_d15\helpfile\1028\help.html
- %TEMP%\944942fcc5cca81ab4907dd5c3\vs_bootstrapper_d15\helpfile\2052\help.html
- %TEMP%\944942fcc5cca81ab4907dd5c3\vs_bootstrapper_d15\helpfile\1055\help.html
- %TEMP%\944942fcc5cca81ab4907dd5c3\vs_bootstrapper_d15\helpfile\1046\help.html
- %TEMP%\944942fcc5cca81ab4907dd5c3\vs_bootstrapper_d15\helpfile\1042\help.html
- %TEMP%\944942fcc5cca81ab4907dd5c3\vs_bootstrapper_d15\helpfile\1029\help.html
- %TEMP%\944942fcc5cca81ab4907dd5c3\vs_bootstrapper_d15\helpfile\1036\help.html
- %TEMP%\944942fcc5cca81ab4907dd5c3\vs_bootstrapper_d15\helpfile\3082\help.html
- %TEMP%\944942fcc5cca81ab4907dd5c3\vs_bootstrapper_d15\helpfile\1040\help.html
- %TEMP%\944942fcc5cca81ab4907dd5c3\vs_bootstrapper_d15\helpfile\1031\help.html
- %TEMP%\944942fcc5cca81ab4907dd5c3\vs_bootstrapper_d15\helpfile\1045\help.html
- %TEMP%\944942fcc5cca81ab4907dd5c3\vs_bootstrapper_d15\helpfile\1041\help.html
- %TEMP%\944942fcc5cca81ab4907dd5c3\vs_bootstrapper_d15\helpfile\1049\help.html
- %TEMP%\944942fcc5cca81ab4907dd5c3\vs_bootstrapper_d15\helpfile\1033\help.html
- %TEMP%\944942fcc5cca81ab4907dd5c3\vs_bootstrapper_d15\vs_setup_bootstrapper.exe
- %TEMP%\944942fcc5cca81ab4907dd5c3\vs_bootstrapper_d15\microsoft.diagnostics.tracing.eventsource.dll
- %TEMP%\944942fcc5cca81ab4907dd5c3\vs_bootstrapper_d15\microsoft.visualstudio.remotecontrol.dll
- %TEMP%\944942fcc5cca81ab4907dd5c3\vs_bootstrapper_d15\microsoft.visualstudio.setup.common.dll
- %TEMP%\944942fcc5cca81ab4907dd5c3\vs_bootstrapper_d15\microsoft.visualstudio.setup.dll
- %TEMP%\944942fcc5cca81ab4907dd5c3\vs_bootstrapper_d15\microsoft.visualstudio.telemetry.dll
- %TEMP%\vsremotecontrol\260afd229c7c479696dd184409555181
Deletes the following files
- %TEMP%\dcd.exe
Network activity
Connects to
- 'az#####4.vo.msecnd.net':443
TCP
- 'az#####2.vo.msecnd.net':443
UDP
- DNS ASK az#####2.vo.msecnd.net
- DNS ASK az#####4.vo.msecnd.net
Miscellaneous
Creates and executes the following
- '%TEMP%\dcd.exe' -path=%LOCALAPPDATA%\Growtopia\save.dat
- '%TEMP%\1.exe'
- '%TEMP%\944942fcc5cca81ab4907dd5c3\vs_bootstrapper_d15\vs_setup_bootstrapper.exe' --env "_SFX_CAB_EXE_PACKAGE:%TEMP%\1.exe _SFX_CAB_EXE_ORIGINALWORKINGDIR:<Current directory>"
- '<SYSTEM32>\wisptis.exe' /ManualLaunch;' (with hidden window)
Executes the following
- '<SYSTEM32>\getmac.exe'
- '<SYSTEM32>\wisptis.exe' /ManualLaunch;
