Technical Information
Modifies file system
Creates the following files
- %WINDIR%\ry9dhi3n3.exe
- %TEMP%\content\3984-484-ry9dhi3n3.exe-11-26-20-432.dump
Moves the following files
- from %WINDIR%\ry9dhi3n3.exe to %TEMP%\907562\....\temporaryfile
Network activity
Connects to
- 'st##mcom.cn':443
- 'x1.#.lencr.org':80
TCP
HTTP GET requests
- http://x1.#.lencr.org/
Other
- 'st##mcom.cn':443
UDP
- DNS ASK st##mcom.cn
- DNS ASK x1.#.lencr.org
Miscellaneous
Creates and executes the following
- '%WINDIR%\ry9dhi3n3.exe'
