Technical Information
Modifies file system
Creates the following files
- %LOCALAPPDATA%\microsoft\internet explorer\msimgsiz.dat
- %LOCALAPPDATA%\microsoft\windows\history\history.ie5\mshist012023112820231129\index.dat
Network activity
Connects to
- 'yi##i.com':80
- 'js.##66sr.com':80
- 'd1.##na.com.cn':80
- 'si##.#atianxia.net':80
- 'v.##uku.com':443
- 'v.##uku.com':80
- '96#6.cn':80
- 'gd##j.com':80
- 's.##si.cn':80
- 'cy##88.cn':80
- 'hu###omains.com':443
- 'yi##i.com':443
- 'fi####e.sina.com.cn':80
- 'bl##.#ina.com.cn':80
- 'cl#.#gcjq.com':80
- '10###a.com.cn':80
- 'dd#.#8vr.com':80
- 'bl##.#ina.com.cn':443
- 'oc##.dcocsp.cn':80
TCP
HTTP GET requests
- http://www.yi##i.com/video/index.html
- http://cs#.#666sr.com/sr/js/lib/jquery.autocomplete/jquery.autocomplete.css?ve###############
- http://cs#.#666sr.com/sr/css/common/reset2015.css?ve###############
- http://cs#.#666sr.com/sr/css/common/2015/common.css?ve###############
- http://s.##si.cn/js/chameleon/chameleon.min.1701150.js
- http://js.##66sr.com/sr/js/lib/jquery/jquery.1.8.3.min.js?ve###############
- http://www.10###a.com.cn/stat.js
- http://si##.#atianxia.net/zjlx/
- http://si##.#atianxia.net/dhqa/
- http://si##.#atianxia.net/rdts/
- http://si##.#atianxia.net/ggtx/
- http://si##.#atianxia.net/dpbbd/
- http://i3.##naimg.cn/cj/HKstock2007/IO.Script_1_0_1.js?s=#
- http://si##.#atianxia.net/cy/
- http://si##.#atianxia.net/nc/
- http://www.96#6.cn/
- http://fi####e.sina.com.cn/globaltimezone.js?s=#
- http://v.##uku.com/v_show/id_XMTkyNTc3NzA4.html
- http://www.96#6.cn/cowboycms/more.html
- http://www.cy##88.cn/article/list.php?ca#######
- http://www.10###a.com.cn/flash/
- http://bl##.#ina.com.cn/lm/finance/index.html
- http://cl#.#gcjq.com/sfqy/sfsd.html
- http://fi####e.sina.com.cn/money/globalindex/index.shtml
- http://oc##.dcocsp.cn/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAoEcNCWvIoSyJCm34Ju7Es%3D
- http://oc##.dcocsp.cn/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSmVYFXwi%2FRq9wx3PKhB8lC%2FFYUyAQUkZ9eMRWuEJ%2BtYMH3wcyqSDQvDCYCEAvz8sjOaqbdLvdA3SkIGGg%3D
Other
- 'yi##i.com':443
- 'hu###omains.com':443
- 'bl##.#ina.com.cn':443
- 'v.##uku.com':443
UDP
- DNS ASK zh###ting88.com
- DNS ASK ac#.9666.cn
- DNS ASK js.##66sr.com
- DNS ASK cs#.#666sr.com
- DNS ASK d1.##na.com.cn
- DNS ASK i1.##naimg.cn
- DNS ASK n.###aimg.cn
- DNS ASK i3.##naimg.cn
- DNS ASK v.##uku.com
- DNS ASK 96#6.cn
- DNS ASK s.##si.cn
- DNS ASK hu###omains.com
- DNS ASK gd##j.com
- DNS ASK si##.#atianxia.net
- DNS ASK cl#.#gcjq.com
- DNS ASK bl##.#ina.com.cn
- DNS ASK 10###a.com.cn
- DNS ASK dd#.#8vr.com
- DNS ASK in###.gw.com.cn
- DNS ASK yi##i.com
- DNS ASK fi####e.sina.com.cn
- DNS ASK cy##88.cn
- DNS ASK oc##.dcocsp.cn
Miscellaneous
Searches for the following windows
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebCheckMonitor' WindowName: ''
