Technical Information
Modifies file system
Creates the following files
- %WINDIR%\ucyequ3nologc1fa.bat
- %WINDIR%\temp\tar6f55.tmp
- %WINDIR%\temp\cab6fb3.tmp
- %WINDIR%\temp\tar6fb4.tmp
- %WINDIR%\temp\cab8519.tmp
- %WINDIR%\temp\tar851a.tmp
- %WINDIR%\temp\tar59d0.tmp
- %WINDIR%\temp\cab6f54.tmp
- %WINDIR%\temp\cab92c1.tmp
- %WINDIR%\temp\tara828.tmp
- %WINDIR%\temp\caba877.tmp
- %WINDIR%\temp\tara878.tmp
- %WINDIR%\temp\cabbdbd.tmp
- %WINDIR%\temp\tarbdbe.tmp
- %WINDIR%\temp\tar92c2.tmp
- %WINDIR%\temp\caba827.tmp
- %WINDIR%\temp\cab59cf.tmp
- %WINDIR%\temp\tar5980.tmp
- %WINDIR%\temp\cab597f.tmp
- %WINDIR%\zdm6pvdikgizehuw.exe
- %WINDIR%\ucrtbased.dll
- %WINDIR%\vcruntime140d.dll
- %WINDIR%\s5yar3fixazbajwr.sys
- %WINDIR%\temp\cab2d18.tmp
- %WINDIR%\temp\tar2d19.tmp
- %WINDIR%\0mvwxgrizg4ew5mna.exe
- %WINDIR%\temp\cab4339.tmp
- %WINDIR%\temp\cab4389.tmp
- %WINDIR%\temp\tar438a.tmp
- %WINDIR%\temp\cab58df.tmp
- %WINDIR%\temp\tar58e0.tmp
- %WINDIR%\temp\cab593e.tmp
- %WINDIR%\temp\tar593f.tmp
- %WINDIR%\temp\tar433a.tmp
- %WINDIR%\temp\cabffaf.tmp
- %WINDIR%\temp\tarffb0.tmp
Sets the 'hidden' attribute to the following files
- %WINDIR%\ucyequ3nologc1fa.bat
- %WINDIR%\0mvwxgrizg4ew5mna.exe
- %WINDIR%\zdm6pvdikgizehuw.exe
- %WINDIR%\ucrtbased.dll
- %WINDIR%\vcruntime140d.dll
- %WINDIR%\s5yar3fixazbajwr.sys
Deletes the following files
- %WINDIR%\temp\cab2d18.tmp
- %WINDIR%\temp\tarbdbe.tmp
- %WINDIR%\temp\cabbdbd.tmp
- %WINDIR%\temp\tara878.tmp
- %WINDIR%\temp\caba877.tmp
- %WINDIR%\temp\tara828.tmp
- %WINDIR%\temp\caba827.tmp
- %WINDIR%\temp\tar92c2.tmp
- %WINDIR%\temp\cab92c1.tmp
- %WINDIR%\temp\tar851a.tmp
- %WINDIR%\temp\cab8519.tmp
- %WINDIR%\temp\tar6fb4.tmp
- %WINDIR%\temp\cab6fb3.tmp
- %WINDIR%\temp\tar6f55.tmp
- %WINDIR%\temp\cab6f54.tmp
- %WINDIR%\temp\tar59d0.tmp
- %WINDIR%\temp\cab59cf.tmp
- %WINDIR%\temp\tar5980.tmp
- %WINDIR%\temp\cab597f.tmp
- %WINDIR%\temp\tar593f.tmp
- %WINDIR%\temp\cab593e.tmp
- %WINDIR%\temp\tar58e0.tmp
- %WINDIR%\temp\cab58df.tmp
- %WINDIR%\temp\tar438a.tmp
- %WINDIR%\temp\cab4389.tmp
- %WINDIR%\temp\tar433a.tmp
- %WINDIR%\temp\cab4339.tmp
- %WINDIR%\temp\tar2d19.tmp
- %WINDIR%\temp\cabffaf.tmp
- %WINDIR%\temp\tarffb0.tmp
Network activity
Connects to
- 'localhost':49185
- 'localhost':49187
- 'ke##uth.win':443
- 'x1.#.lencr.org':80
- 'x2.#.lencr.org':80
TCP
HTTP GET requests
- http://x1.#.lencr.org/
- http://x2.#.lencr.org/
Other
- 'localhost':49185
- 'localhost':49187
- 'localhost':49188
- 'ke##uth.win':443
UDP
- DNS ASK ke##uth.win
- DNS ASK x1.#.lencr.org
- DNS ASK x2.#.lencr.org
Miscellaneous
Searches for the following windows
- ClassName: 'EDIT' WindowName: ''
- ClassName: 'UnityWndClass' WindowName: ''
Creates and executes the following
- '%WINDIR%\zdm6pvdikgizehuw.exe'
Executes the following
- '<SYSTEM32>\cmd.exe' /c certutil -hashfile "%WINDIR%\Zdm6PVDikGiZEhuw.exe" MD5 | find /i /v "md5" | find /i /v "certutil"
- '<SYSTEM32>\certutil.exe' -hashfile "%WINDIR%\Zdm6PVDikGiZEhuw.exe" MD5
- '<SYSTEM32>\find.exe' /i /v "md5"
- '<SYSTEM32>\find.exe' /i /v "certutil"
- '<SYSTEM32>\cmd.exe' /c start cmd /C "color b && title Error && echo SSL connect error && timeout /t 5"
- '<SYSTEM32>\cmd.exe' /C "color b && title Error && echo SSL connect error && timeout /t 5"
- '<SYSTEM32>\timeout.exe' /t 5
