Technical Information
Modifies file system
Creates the following files
- %LOCALAPPDATA%\microsoft\windows\history\history.ie5\mshist012022091620220917\index.dat
Modifies the following files
Network activity
Connects to
- 'ha##42.com':80
- 'ha##23.com':443
- 'gs##.#dstatic.com':443
- 'sc#.##o123img.com':443
- 'ss#.#aidu.com':443
- 'ha#######atic.cdn.bcebos.com':443
- 'hm.##idu.com':443
- 'hm###.baidu.com':443
- 'oc##.#igicert.cn':80
- 'fy###.#dn.bcebos.com':443
- 'pa####rt.baidu.com':443
- 'cr#.#igicert.cn':80
- 'cp##.##idustatic.com':443
- 'pi#.###.bdstatic.com':443
- 'lu###.#dn.bcebos.com':443
- 'st#####.##gitalcertvalidation.com':80
TCP
HTTP GET requests
- http://ha##42.com/?r=###########
- http://oc##.#igicert.cn/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAUfDH7dyI268AxQ4oX0ImU%3D
- http://oc##.#igicert.cn/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSs4qvpyL%2F1h8IM3CR%2F4ZfFi8oOlAQUe6P6%2F%2FXVCV0e%2BSr%2FhVPtr0eo13oCEAPOHMw%2FeB3YNgRw9p0qvjY%3D
- http://cr#.#igicert.cn/DigiCertSecureSiteProCNCAG3.crl
- http://st#####.##gitalcertvalidation.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRJrF0xYA49jC3D83fgDGesaUkzIQQUf9OZ86BHDjEAVlYijrfMnt3KAYoCEAIazakKjI1uispKpqEH70g%3D
Other
- 'ha##23.com':443
- 'ec####.baidu.com':443
- 'po#.#aidu.com':443
- 'f7.##idu.com':443
- 'pi#.###.bdstatic.com':443
- 'cp##.##idustatic.com':443
- 'as#.#.hao123.com':443
- 'ba##u.com':443
- 'pa####rt.baidu.com':443
- 'fy###.#dn.bcebos.com':443
- 'hm###.baidu.com':443
- 'hm.##idu.com':443
- 'ha#######atic.cdn.bcebos.com':443
- 'ds##.#dstatic.com':443
- 'sc#.##o123img.com':443
- 'dg###.bdstatic.com':443
- 'wn.###.baidu.com':443
- 'lu###.#dn.bcebos.com':443
UDP
- DNS ASK ha##42.com
- DNS ASK lu###.#dn.bcebos.com
- DNS ASK wn.###.baidu.com
- DNS ASK ec####.baidu.com
- DNS ASK po#.#aidu.com
- DNS ASK cp##.##idustatic.com
- DNS ASK as#.#.hao123.com
- DNS ASK f7.##idu.com
- DNS ASK pi#.###.bdstatic.com
- DNS ASK dg###.baidu.com
- DNS ASK ba##u.com
- DNS ASK cr#.#igicert.cn
- DNS ASK sh####.hao123.com
- DNS ASK pa####rt.baidu.com
- DNS ASK fy###.#dn.bcebos.com
- DNS ASK oc##.#igicert.cn
- DNS ASK hm###.baidu.com
- DNS ASK hm.##idu.com
- DNS ASK ss#.#aidu.com
- DNS ASK gs##.#dstatic.com
- DNS ASK ds##.#dstatic.com
- DNS ASK ha#######atic.cdn.bcebos.com
- DNS ASK sc#.##o123img.com
- DNS ASK dg###.bdstatic.com
- DNS ASK microsoft.com
- DNS ASK ha##23.com
- DNS ASK st#####.##gitalcertvalidation.com
- DNS ASK public-trust.com
Miscellaneous
Searches for the following windows
- ClassName: 'Static' WindowName: ''
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebCheckMonitor' WindowName: ''
