Technical Information
Malicious functions:
Creates and executes the following:
- '%TEMP%\ip_15.tmp'
- '%TEMP%\ip_27.tmp'
- '%TEMP%\ip_14.tmp'
- '%TEMP%\ip_17.tmp'
- '%TEMP%\ip_26.tmp'
- '%TEMP%\ip_16.tmp'
- '%TEMP%\ip_13.tmp'
- '%TEMP%\ip_29.tmp'
- '%TEMP%\ip_10.tmp'
- '%TEMP%\ip_F.tmp'
- '%TEMP%\ip_28.tmp'
- '%TEMP%\ip_12.tmp'
- '%TEMP%\ip_11.tmp'
- '%TEMP%\ip_18.tmp'
- '%TEMP%\ip_22.tmp'
- '%TEMP%\ip_1E.tmp'
- '%TEMP%\ip_1D.tmp'
- '%TEMP%\ip_21.tmp'
- '%TEMP%\ip_20.tmp'
- '%TEMP%\ip_1F.tmp'
- '%TEMP%\ip_23.tmp'
- '%TEMP%\ip_1A.tmp'
- '%TEMP%\ip_19.tmp'
- '%TEMP%\ip_25.tmp'
- '%TEMP%\ip_1C.tmp'
- '%TEMP%\ip_1B.tmp'
- '%TEMP%\ip_24.tmp'
- '%TEMP%\ip_2A.tmp'
- '%TEMP%\ip_1.tmp'
- '%TEMP%\ip_7.tmp'
- '%TEMP%\ip_2E.tmp'
- '%TEMP%\ip_9.tmp'
- '%TEMP%\ip_2D.tmp'
- '%TEMP%\ip_8.tmp'
- '%TEMP%\ip_6.tmp'
- '%TEMP%\ip_3.tmp'
- '%TEMP%\ip_30.tmp'
- '%TEMP%\ip_2.tmp'
- '%TEMP%\ip_5.tmp'
- '%TEMP%\ip_2F.tmp'
- '%TEMP%\ip_4.tmp'
- '%TEMP%\ip_2B.tmp'
- '%TEMP%\ip_E.tmp'
- '%TEMP%\ip_D.tmp'
- '%TEMP%\ip_C.tmp'
- '%TEMP%\ip_B.tmp'
- '%TEMP%\ip_2C.tmp'
- '%TEMP%\ip_A.tmp'
- '%TEMP%\ip_22.tmp' (downloaded from the Internet)
- '%TEMP%\ip_2F.tmp' (downloaded from the Internet)
- '%TEMP%\ip_25.tmp' (downloaded from the Internet)
- '%TEMP%\ip_29.tmp' (downloaded from the Internet)
- '%TEMP%\ip_21.tmp' (downloaded from the Internet)
- '%TEMP%\ip_30.tmp' (downloaded from the Internet)
- '%TEMP%\ip_2A.tmp' (downloaded from the Internet)
- '%TEMP%\ip_27.tmp' (downloaded from the Internet)
- '%TEMP%\ip_2D.tmp' (downloaded from the Internet)
- '%TEMP%\ip_26.tmp' (downloaded from the Internet)
- '%TEMP%\ip_2C.tmp' (downloaded from the Internet)
- '%TEMP%\ip_2B.tmp' (downloaded from the Internet)
- '%TEMP%\ip_28.tmp' (downloaded from the Internet)
- '%TEMP%\ip_23.tmp' (downloaded from the Internet)
- '%TEMP%\ip_24.tmp' (downloaded from the Internet)
- '%TEMP%\ip_2E.tmp' (downloaded from the Internet)
- '%TEMP%\ip_B.tmp' (downloaded from the Internet)
- '%TEMP%\ip_C.tmp' (downloaded from the Internet)
- '%TEMP%\ip_9.tmp' (downloaded from the Internet)
- '%TEMP%\ip_A.tmp' (downloaded from the Internet)
- '%TEMP%\ip_F.tmp' (downloaded from the Internet)
- '%TEMP%\ip_10.tmp' (downloaded from the Internet)
- '%TEMP%\ip_D.tmp' (downloaded from the Internet)
- '%TEMP%\ip_E.tmp' (downloaded from the Internet)
- '%TEMP%\ip_3.tmp' (downloaded from the Internet)
- '%TEMP%\ip_4.tmp' (downloaded from the Internet)
- '%TEMP%\ip_1.tmp' (downloaded from the Internet)
- '%TEMP%\ip_2.tmp' (downloaded from the Internet)
- '%TEMP%\ip_7.tmp' (downloaded from the Internet)
- '%TEMP%\ip_8.tmp' (downloaded from the Internet)
- '%TEMP%\ip_5.tmp' (downloaded from the Internet)
- '%TEMP%\ip_6.tmp' (downloaded from the Internet)
- '%TEMP%\ip_1B.tmp' (downloaded from the Internet)
- '%TEMP%\ip_1C.tmp' (downloaded from the Internet)
- '%TEMP%\ip_19.tmp' (downloaded from the Internet)
- '%TEMP%\ip_1A.tmp' (downloaded from the Internet)
- '%TEMP%\ip_1F.tmp' (downloaded from the Internet)
- '%TEMP%\ip_20.tmp' (downloaded from the Internet)
- '%TEMP%\ip_1D.tmp' (downloaded from the Internet)
- '%TEMP%\ip_1E.tmp' (downloaded from the Internet)
- '%TEMP%\ip_13.tmp' (downloaded from the Internet)
- '%TEMP%\ip_14.tmp' (downloaded from the Internet)
- '%TEMP%\ip_11.tmp' (downloaded from the Internet)
- '%TEMP%\ip_12.tmp' (downloaded from the Internet)
- '%TEMP%\ip_17.tmp' (downloaded from the Internet)
- '%TEMP%\ip_18.tmp' (downloaded from the Internet)
- '%TEMP%\ip_15.tmp' (downloaded from the Internet)
- '%TEMP%\ip_16.tmp' (downloaded from the Internet)
Modifies file system :
Creates the following files:
- %TEMP%\ip_21.tmp
- %TEMP%\ip_20.tmp
- %TEMP%\ip_1F.tmp
- %TEMP%\ip_24.tmp
- %TEMP%\ip_23.tmp
- %TEMP%\ip_22.tmp
- %TEMP%\ip_1B.tmp
- %TEMP%\ip_1A.tmp
- %TEMP%\ip_19.tmp
- %TEMP%\ip_1E.tmp
- %TEMP%\ip_1D.tmp
- %TEMP%\ip_1C.tmp
- %TEMP%\ip_2D.tmp
- %TEMP%\ip_2C.tmp
- %TEMP%\ip_2B.tmp
- %TEMP%\ip_30.tmp
- %TEMP%\ip_2F.tmp
- %TEMP%\ip_2E.tmp
- %TEMP%\ip_27.tmp
- %TEMP%\ip_26.tmp
- %TEMP%\ip_25.tmp
- %TEMP%\ip_2A.tmp
- %TEMP%\ip_29.tmp
- %TEMP%\ip_28.tmp
- %TEMP%\ip_9.tmp
- %TEMP%\ip_8.tmp
- %TEMP%\ip_7.tmp
- %TEMP%\ip_C.tmp
- %TEMP%\ip_B.tmp
- %TEMP%\ip_A.tmp
- %TEMP%\ip_3.tmp
- %TEMP%\ip_2.tmp
- %TEMP%\ip_1.tmp
- %TEMP%\ip_6.tmp
- %TEMP%\ip_5.tmp
- %TEMP%\ip_4.tmp
- %TEMP%\ip_15.tmp
- %TEMP%\ip_14.tmp
- %TEMP%\ip_13.tmp
- %TEMP%\ip_18.tmp
- %TEMP%\ip_17.tmp
- %TEMP%\ip_16.tmp
- %TEMP%\ip_F.tmp
- %TEMP%\ip_E.tmp
- %TEMP%\ip_D.tmp
- %TEMP%\ip_12.tmp
- %TEMP%\ip_11.tmp
- %TEMP%\ip_10.tmp
Network activity:
Connects to:
- '11#.#8.32.12':80
TCP:
HTTP GET requests:
- 11#.#8.32.12//6/?r=##########
