Technical Information
Modifies file system
Creates the following files
- %LOCALAPPDATA%\microsoft\windows\history\history.ie5\mshist012023021120230212\index.dat
Modifies the following files
Network activity
Connects to
- 'ys###jia.com':88
- 'im#.##baojia.com':80
TCP
HTTP GET requests
- http://www.ys###jia.com:88/web/xiaomishu.html?pi###### via ys###jia.com
- http://www.ys###jia.com:88/web/images/Toolbar/foot_bg.gif via ys###jia.com
- http://www.ys###jia.com:88/web/images/Toolbar/ysbaojia.gif via ys###jia.com
- http://www.ys###jia.com:88/web/images/Toolbar/menu_bg_space.gif via ys###jia.com
- http://www.ys###jia.com:88/web/images/Toolbar/new.gif via ys###jia.com
- http://www.ys###jia.com:88/web/images/Toolbar/QYQQ.gif via ys###jia.com
- http://www.ys###jia.com:88/web/images/Toolbar/fav.gif via ys###jia.com
- http://www.ys###jia.com:88/web/images/text-bg.gif via ys###jia.com
- http://www.ys###jia.com:88/api/main.asp?pi############################################ via ys###jia.com
- http://www.ys###jia.com:88/api/common.asp?ac############################# via ys###jia.com
- http://www.ys###jia.com:88/web/items/main.html via ys###jia.com
- http://www.ys###jia.com:88/web/left-1.html via ys###jia.com
- http://www.ys###jia.com:88/web/left-2.html via ys###jia.com
- http://www.ys###jia.com:88/web/JavaScript/leftitems.js?+M############ via ys###jia.com
- http://www.ys###jia.com:88/web/images/ilist/shumakuaiyin.gif via ys###jia.com
- http://im#.##baojia.com/UpLoadFile/web/239416/2020121141864813.jpg
- http://www.ys###jia.com:88/web/JavaScript/initcity.v2.js via ys###jia.com
- http://www.ys###jia.com:88/web/css/mainx1.css via ys###jia.com
- http://www.ys###jia.com:88/web/css/Pitem.css via ys###jia.com
- http://www.ys###jia.com:88/web/JavaScript/langSub.js via ys###jia.com
- http://www.ys###jia.com:88/web/JavaScript/mainIndex.js?+M############ via ys###jia.com
- http://www.ys###jia.com:88/web/images/logo/kuaiyin.gif via ys###jia.com
- http://www.ys###jia.com:88/web/images/logo/huache.gif via ys###jia.com
- http://www.ys###jia.com:88/web/images/logo/danzhang.gif via ys###jia.com
- http://www.ys###jia.com:88/api/getBoom.asp?t=########## via ys###jia.com
- http://www.ys###jia.com:88/web/images/main0.jpg via ys###jia.com
- http://www.ys###jia.com:88/web/images/ilist/zbhuace.gif via ys###jia.com
- http://www.ys###jia.com:88/web/images/tabs-list.gif via ys###jia.com
- http://www.ys###jia.com:88/api/news.asp?pi######################### via ys###jia.com
- http://www.ys###jia.com:88/web/images/tab-close.gif via ys###jia.com
- http://www.ys###jia.com:88/web/images/Toolbar/wx.jpg via ys###jia.com
- http://www.ys###jia.com:88/web/css/chromestyle.css via ys###jia.com
- http://www.ys###jia.com:88/web/css/help.css via ys###jia.com
- http://www.ys###jia.com:88/web/JavaScript/myJSFrame.js via ys###jia.com
- http://www.ys###jia.com:88/web/JavaScript/Toolbar.js via ys###jia.com
- http://www.ys###jia.com:88/web/JavaScript/public.js?+M############ via ys###jia.com
- http://www.ys###jia.com:88/web/JavaScript/main.js?+M############ via ys###jia.com
- http://www.ys###jia.com:88/web/JavaScript/checklogin.js via ys###jia.com
- http://www.ys###jia.com:88/web/JavaScript/zDialog.js via ys###jia.com
- http://www.ys###jia.com:88/web/JavaScript/index.js via ys###jia.com
- http://www.ys###jia.com:88/web/JavaScript/ad_right.js via ys###jia.com
- http://www.ys###jia.com:88/web/JavaScript/ad_right1.js via ys###jia.com
- http://www.ys###jia.com:88/web/images/Toolbar/menu_bg.gif via ys###jia.com
- http://www.ys###jia.com:88/web/images/Toolbar/app.jpg via ys###jia.com
- http://www.ys###jia.com:88/web/images/handle.gif via ys###jia.com
- http://www.ys###jia.com:88/web/images/Toolbar/menu_bg_over_right.gif via ys###jia.com
- http://www.ys###jia.com:88/web/images/Toolbar/utilities.gif via ys###jia.com
- http://www.ys###jia.com:88/web/images/left_close.gif via ys###jia.com
- http://www.ys###jia.com:88/web/images/Toolbar/menu_bg_over_bg.gif via ys###jia.com
- http://www.ys###jia.com:88/web/images/favDrop.gif via ys###jia.com
- http://www.ys###jia.com:88/web/images/favMan.gif via ys###jia.com
- http://www.ys###jia.com:88/web/images/Toolbar/menu_bg_over_left.gif via ys###jia.com
- http://www.ys###jia.com:88/web/images/xiaomishu/00.gif via ys###jia.com
- http://www.ys###jia.com:88/web/images/tab-strip-bg.gif via ys###jia.com
- http://www.ys###jia.com:88/web/JavaScript/lang.js via ys###jia.com
- http://www.ys###jia.com:88/web/images/panel-title-light-bg.gif via ys###jia.com
- http://www.ys###jia.com:88/web/images/tabs-sprite.gif via ys###jia.com
- http://www.ys###jia.com:88/web/images/e-handle.gif via ys###jia.com
- http://www.ys###jia.com:88/web/images/ilist/zbdanzhang.gif via ys###jia.com
UDP
- DNS ASK ys###jia.com
- DNS ASK im#.##baojia.com
- 'localhost':55504
- 'localhost':52543
Miscellaneous
Searches for the following windows
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebCheckMonitor' WindowName: ''
