Technical Information
Modifies file system
Creates the following files
- %TEMP%\e32d.tmp
- %TEMP%\f3e1.tmp
- %TEMP%\f372.tmp
- %TEMP%\f2b4.tmp
- %TEMP%\f265.tmp
- %TEMP%\f225.tmp
- %TEMP%\f1e6.tmp
- %TEMP%\f187.tmp
- %TEMP%\f119.tmp
- %TEMP%\f0ca.tmp
- %TEMP%\f08b.tmp
- %TEMP%\f04b.tmp
- %TEMP%\efdd.tmp
- %TEMP%\ef8e.tmp
- %TEMP%\ef4f.tmp
- %TEMP%\ef0f.tmp
- %TEMP%\eeb1.tmp
- %TEMP%\ee52.tmp
- %TEMP%\ee13.tmp
- %TEMP%\ed95.tmp
- %TEMP%\ec2d.tmp
- %TEMP%\ea68.tmp
- %TEMP%\e9fa.tmp
- %TEMP%\e8d0.tmp
- %TEMP%\e891.tmp
- %TEMP%\e67d.tmp
- %TEMP%\e5f0.tmp
- %TEMP%\e591.tmp
- %TEMP%\e523.tmp
- %TEMP%\e4c4.tmp
- %TEMP%\f46f.tmp
- %TEMP%\f4be.tmp
Deletes the following files
- %TEMP%\e4c4.tmp
- %TEMP%\e523.tmp
- %TEMP%\e591.tmp
- %TEMP%\e5f0.tmp
- %TEMP%\e67d.tmp
- %TEMP%\e891.tmp
- %TEMP%\e8d0.tmp
- %TEMP%\e9fa.tmp
- %TEMP%\ea68.tmp
- %TEMP%\ec2d.tmp
- %TEMP%\ed95.tmp
- %TEMP%\f2b4.tmp
- %TEMP%\f372.tmp
- %TEMP%\f3e1.tmp
- %TEMP%\f46f.tmp
- %TEMP%\f4be.tmp
Deletes itself.
Network activity
UDP
- DNS ASK fu###g52.top
- DNS ASK sa###s07.top
Miscellaneous
Creates and executes the following
- '%WINDIR%\syswow64\cmd.exe' /c timeout -t 5 && del "<Full path to file>"' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c timeout -t 5 && del "<Full path to file>"
- '%WINDIR%\syswow64\timeout.exe' -t 5
