Technical Information
Modifies file system
Creates the following files
- %TEMP%\116c.tmp
- %TEMP%\11ab.tmp
- %TEMP%\11bc.tmp
- %TEMP%\11cc.tmp
- %TEMP%\11dd.tmp
- %TEMP%\11ee.tmp
- %TEMP%\11ef.tmp
- %TEMP%\11ff.tmp
- %TEMP%\1210.tmp
- <Full path to file>{36af124f-305b-4d86-8065-88266e9258ba}
- <Current directory>\rcx127f.tmp
Deletes following files that it created itself
- %TEMP%\116c.tmp
- %TEMP%\11ab.tmp
- %TEMP%\11bc.tmp
- %TEMP%\11cc.tmp
- %TEMP%\11dd.tmp
- %TEMP%\11ee.tmp
- %TEMP%\11ef.tmp
- %TEMP%\11ff.tmp
- %TEMP%\1210.tmp
- <Full path to file>{36af124f-305b-4d86-8065-88266e9258ba}
Moves the following files
- from <Current directory>\rcx127f.tmp to <Full path to file>{36af124f-305b-4d86-8065-88266e9258ba}
Substitutes the following executable files
- <Full path to file>
Moves itself
- from <Full path to file> to %TEMP%\_@126f.tmp
Network activity
Connects to
- 'cf#####i.blog.163.com':80
TCP
HTTP GET requests
- http://cf#####i.blog.163.com/blog/static/21795512620156505533625/
UDP
- DNS ASK cf#####i.blog.163.com
