Technical Information
Modifies file system
Creates the following files
- %TEMP%\jy6xkwargyzdmkbu.exe
- %LOCALAPPDATA%\6efb0af7\tor\data\cached-certs.tmp
- %LOCALAPPDATA%\6efb0af7\tor\data\unverified-microdesc-consensus.tmp
- %LOCALAPPDATA%\6efb0af7\tor\data\state.tmp
- %LOCALAPPDATA%\6efb0af7\tor\torrc
- %LOCALAPPDATA%\6efb0af7\tor\zlib1.dll
- %LOCALAPPDATA%\6efb0af7\tor\winasxp.exe
- %LOCALAPPDATA%\6efb0af7\tor\libwinpthread-1.dll
- %LOCALAPPDATA%\6efb0af7\tor\data\cached-microdesc-consensus.tmp
- %LOCALAPPDATA%\6efb0af7\tor\libssp-0.dll
- %LOCALAPPDATA%\6efb0af7\tor\libgcc_s_sjlj-1.dll
- %LOCALAPPDATA%\6efb0af7\tor\libevent-2-1-6.dll
- %LOCALAPPDATA%\6efb0af7\tor\libcrypto-1_1.dll
- %TEMP%\is64.fil
- %TEMP%\is64.bat
- %TEMP%\is64.txt
- %TEMP%\muiy6rme4obvvh7y.exe
- %LOCALAPPDATA%\6efb0af7\tor\libssl-1_1.dll
- %LOCALAPPDATA%\6efb0af7\tor\data\cached-microdescs.new
Deletes the following files
- %LOCALAPPDATA%\6efb0af7\tor\data\unverified-microdesc-consensus
- %LOCALAPPDATA%\6efb0af7\tor\data\cached-microdescs.new
- %LOCALAPPDATA%\6efb0af7\tor\data\state
Moves the following files
- from %LOCALAPPDATA%\6efb0af7\tor\data\state.tmp to %LOCALAPPDATA%\6efb0af7\tor\data\state
- from %LOCALAPPDATA%\6efb0af7\tor\data\unverified-microdesc-consensus.tmp to %LOCALAPPDATA%\6efb0af7\tor\data\unverified-microdesc-consensus
- from %LOCALAPPDATA%\6efb0af7\tor\data\cached-certs.tmp to %LOCALAPPDATA%\6efb0af7\tor\data\cached-certs
- from %LOCALAPPDATA%\6efb0af7\tor\data\cached-microdesc-consensus.tmp to %LOCALAPPDATA%\6efb0af7\tor\data\cached-microdesc-consensus
Substitutes the following files
- %LOCALAPPDATA%\6efb0af7\tor\data\state
Network activity
Connects to
- 'localhost':49175
- '5.###.169.190':8080
- '19#.#60.102.166':9001
- '10#.#99.56.138':443
- '15#.#0.183.30':9001
- '93.##6.197.181':443
- 'localhost':45808
TCP
Other
- '5.###.169.190':8080
- '19#.#60.102.166':9001
- '93.##6.197.181':443
- '15#.#0.183.30':9001
- 'localhost':45808
- 'localhost':49182
- '10#.#99.56.138':443
- 'localhost':49184
Miscellaneous
Creates and executes the following
- '%TEMP%\jy6xkwargyzdmkbu.exe'
- '%TEMP%\muiy6rme4obvvh7y.exe'
- '%LOCALAPPDATA%\6efb0af7\tor\winasxp.exe' -f torrc
- '%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\is64.bat" "' (with hidden window)
- '%LOCALAPPDATA%\6efb0af7\tor\winasxp.exe' -f torrc' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\is64.bat" "
