Technical Information
Modifies file system
Creates the following files
- D:\áû·å¸´¹å80kh_com\<File name>.exe
- D:\áû·å¸´¹å80kh_com\dianfeng\更新日志.txt
- D:\áû·å¸´¹å80kh_com\dianfeng\txmon.txt
- D:\áû·å¸´¹å80kh_com\dianfeng\graphics\diymonlist.dat
- D:\áû·å¸´¹å80kh_com\dianfeng\graphics\client\20024.ini
- D:\áû·å¸´¹å80kh_com\dianfeng\graphics\client\20023.ini
- D:\áû·å¸´¹å80kh_com\dianfeng\graphics\client\20022.ini
- D:\áû·å¸´¹å80kh_com\dianfeng\graphics\client\20021.ini
- D:\áû·å¸´¹å80kh_com\dianfeng\graphics\client\10005.ini
- D:\áû·å¸´¹å80kh_com\dianfeng\graphics\client\10001.ini
- D:\áû·å¸´¹å80kh_com\dianfeng\graphics\client\10000.ini
- D:\áû·å¸´¹å80kh_com\dianfeng\data\monicons.dat
- D:\áû·å¸´¹å80kh_com\down\93d299bd13d2bd26\45bb07b3288fb794dd1ed7a3e8f536fe.down
- D:\áû·å¸´¹å80kh_com\dianfeng\data\itemrandomset.dat
- D:\áû·å¸´¹å80kh_com\dianfeng\data\diyskill.dat
- D:\áû·å¸´¹å80kh_com\dianfeng\data\diykuaijie.dat
- D:\áû·å¸´¹å80kh_com\down\93d299bd13d2bd26\b9f2fd336ee9ce38d08cb9b03de8f3ee.down
- D:\áû·å¸´¹å80kh_com\dianfeng\93d299bd13d2bd26.xml
- %HOMEPATH%\desktop\áû·å¸´¹å80kh_com.lnk
- D:\áû·å¸´¹å80kh_com\dianfeng\ui\ui_sd.xml
- D:\áû·å¸´¹å80kh_com\dianfeng\data\prguse.pak
- D:\áû·å¸´¹å80kh_com\dianfeng\jmconfig.txt
- D:\áû·å¸´¹å80kh_com\dianfeng\ark×êô´°ü.zip
- D:\áû·å¸´¹å80kh_com\dianfeng\data\logo.inc
- D:\áû·å¸´¹å80kh_com\áû·å¸´¹å.dat
- D:\áû·å¸´¹å80kh_com\dianfeng\data\diy_itemdesc.dat
- D:\áû·å¸´¹å80kh_com\dianfeng\data\mon158.pak
Deletes the following files
- D:\áû·å¸´¹å80kh_com\dianfeng\ark×êô´°ü.zip
- D:\áû·å¸´¹å80kh_com\down\93d299bd13d2bd26\b9f2fd336ee9ce38d08cb9b03de8f3ee.down
- D:\áû·å¸´¹å80kh_com\down\93d299bd13d2bd26\45bb07b3288fb794dd1ed7a3e8f536fe.down
Modifies the following files
Deletes itself.
Network activity
Connects to
- 'zh####.###-cn-shenzhen.aliyuncs.com':80
- 'di#########51455378.file.myqcloud.com':80
- 'bb#.#75m2.com':80
- 'localhost':443
- 'do##.80kh.com':80
- 'xv##.#odepay.com':443
- 'microsoft.com':80
TCP
HTTP GET requests
- http://zh####.###-cn-shenzhen.aliyuncs.com/rx.txt
- http://zh####.###-cn-shenzhen.aliyuncs.com/link/linkfg.html
- http://zh####.###-cn-shenzhen.aliyuncs.com/link/80kh-1.png
- http://di#########51455378.file.myqcloud.com/0922t1.rar
- http://zh####.###-cn-shenzhen.aliyuncs.com/link/80kh-2.png
- http://zh####.###-cn-shenzhen.aliyuncs.com/link/80kh-3.png
- http://zh####.###-cn-shenzhen.aliyuncs.com/link/80kh-4.png
- http://zh####.###-cn-shenzhen.aliyuncs.com/link/Link_06.jpg
- http://bb#.#75m2.com/api.php?mo############
- http://zh####.###-cn-shenzhen.aliyuncs.com/gx/Mon15808101.rar
- http://do##.80kh.com/Mon1600715.rar
Other
- 'xv##.#odepay.com':443
UDP
- DNS ASK zh####.###-cn-shenzhen.aliyuncs.com
- DNS ASK di#########51455378.file.myqcloud.com
- DNS ASK bb#.#75m2.com
- DNS ASK mi####rl.27tj.com
- DNS ASK do##.80kh.com
- DNS ASK xv##.#odepay.com
- DNS ASK microsoft.com
Miscellaneous
Searches for the following windows
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebCheckMonitor' WindowName: ''
Creates and executes the following
- 'D:\áû·å¸´¹å80kh_com\<File name>.exe' <Full path to file>
