Technical Information
Modifies file system
Creates the following files
- %APPDATA%\.womplay\state\serials.json.tmp
- %APPDATA%\.womplay\updates\womlauncher-0.2.14.exe.part
- %LOCALAPPDATA%\microsoft\clr_v4.0\usagelogs\<File name>.exe.log
- %LOCALAPPDATA%\wom-play\state\d3f1.bin
Deletes following files that it created itself
- %APPDATA%\.womplay\updates\womlauncher-0.2.14.exe
Moves the following files
- from %APPDATA%\.womplay\state\serials.json.tmp to %APPDATA%\.womplay\state\serials.json
- from %APPDATA%\.womplay\updates\womlauncher-0.2.14.exe.part to %APPDATA%\.womplay\updates\womlauncher-0.2.14.exe
Substitutes the following executable files
- <Full path to file>
Moves itself
- from <Full path to file> to <Full path to file>.old
Deletes itself.
Network activity
Connects to
- '51#####182-160.sslip.io':443
- '5-#####-216.sslip.io':443
- 'x1.#.lencr.org':80
TCP
HTTP GET requests
Other
- '51#####182-160.sslip.io':443
- '5-#####-216.sslip.io':443
UDP
- DNS ASK 5-#####-216.sslip.io
- DNS ASK 51#####182-160.sslip.io
- DNS ASK x1.#.lencr.org
Miscellaneous
Restarts the analyzed sample
