Technical Information
Modifies file system
Modifies the following files
Network activity
Connects to
- 'xf##01.com':80
- 'hh##01.com':80
- 'yy##01.com':80
- 'qq.com':80
- 'cd#.##enjquery.org':443
- 'qq.com':443
- 'hm.##idu.com':443
- 'js.##ers.51.la':443
- 'mi##o3.tv':8443
- 'microsoft.com':80
TCP
HTTP GET requests
- http://www.xf##01.com/
- http://www.hh##01.com/dnf1.htm
- http://www.hh##01.com/dnf3.htm
- http://www.yy##01.com/dnf1.htm
- http://www.xf##01.com/common.js
- http://www.hh##01.com/common.js
- http://www.hh##01.com/tj.js
- http://www.qq.com/404/search_children.js
- http://www.xf##01.com/tj.js
- http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt
Other
- 'cd#.##enjquery.org':443
- 'qq.com':443
- 'hm.##idu.com':443
- 'js.##ers.51.la':443
- 'mi##o3.tv':8443
UDP
- DNS ASK xf##01.com
- DNS ASK hh##01.com
- DNS ASK yy##01.com
- DNS ASK qq.com
- DNS ASK cd#.##enjquery.org
- DNS ASK hm.##idu.com
- DNS ASK mi##o3.tv
- DNS ASK js.##ers.51.la
- DNS ASK microsoft.com
Miscellaneous
Searches for the following windows
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebCheckMonitor' WindowName: ''
Executes the following
- '<SYSTEM32>\rundll32.exe' <SYSTEM32>\FirewallControlPanel.dll,ShowNotificationDialog /configure /ETOnly 0 /OnProfiles 6 /OtherAllowed 0 /OtherBlocked 0 /OtherEdgeAllowed 0 /NewBlocked 4 "<Full path to file>"
