Technical Information
Network activity
Connects to
- 'sw##ini.in':80
- 'sw##ini.in':443
- 'x1.#.lencr.org':80
TCP
HTTP GET requests
- http://sw##ini.in/wp-content/uploads/wpr-addons/forms/balokarat2.1.exe
- http://x1.#.lencr.org/
Other
- 'sw##ini.in':443
UDP
- DNS ASK sw##ini.in
- DNS ASK x1.#.lencr.org
Miscellaneous
Executes the following
- '%CommonProgramFiles%\microsoft shared\equation\eqnedt32.exe' -Embedding
