Technical Information
Modifies file system
Creates the following files
- %TEMP%\mz_etilqs_rwnk1dwwqhhz0se
Network activity
Connects to
- 'pa#####.#oogleadservices.com':80
- 'go#####a###ytics.com':80
- '34.##0.144.191':443
- 'bd###.#hare.baidu.com':80
- 'ap#.##are.baidu.com':80
- 'v3.##athis.com':80
- 'z3##.net':80
- 'wi####.weibo.com':80
- 'fe########alog-cdn.prod.mozaws.net':443
- 'tj#.##s.sinajs.cn':80
- 'wi####.weibo.com':443
- 'ns####k.baidu.com':80
- 'oc##.dcocsp.cn':80
- 'im#.#.sinajs.cn':443
- 'tv##.sinaimg.cn':443
- 'wx#.#inaimg.cn':443
TCP
HTTP GET requests
- http://pa#####.#oogleadservices.com/gampad/google_service.js
- http://oc##.dcocsp.cn/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAoEcNCWvIoSyJCm34Ju7Es%3D
- http://bd###.#hare.baidu.com/static/images/pi.gif?cd#################
- http://wi####.weibo.com/weiboshow/index.php?la###################################################################################################################################################...
- http://tj#.##s.sinajs.cn/open/widget/js/widget/comment.js
- http://wi####.weibo.com/distribution/comments.php?wi########################################################################################################
- http://z3##.net/c.js
- http://v3.##athis.com/code_mini/jia.js?ui#####
- http://ap#.##are.baidu.com/getnum?ur######################################################################################################
- http://bd###.#hare.baidu.com/static/images/sc.png?cd#################
- http://bd###.#hare.baidu.com/static/images/is.png?cd#################
- http://bd###.#hare.baidu.com/static/css/bdsstyle.css?cd#################
- http://bd###.#hare.baidu.com/static/js/bds_s_v2.js?cd###############
- http://bd###.#hare.baidu.com/static/js/logger.js?cd###############
- http://bd###.#hare.baidu.com/static/js/shell_v2.js?cd###########
- http://www.go#####a###ytics.com/ga.js
- http://oc##.dcocsp.cn/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSmVYFXwi%2FRq9wx3PKhB8lC%2FFYUyAQUkZ9eMRWuEJ%2BtYMH3wcyqSDQvDCYCEAsQSzCtQeYiaKdTTzFcI7I%3D
- http://oc##.dcocsp.cn/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSmVYFXwi%2FRq9wx3PKhB8lC%2FFYUyAQUkZ9eMRWuEJ%2BtYMH3wcyqSDQvDCYCEA79wG2x6%2FqfgMAZhskI%2BLg%3D
Other
- '34.##0.144.191':443
- 'wi####.weibo.com':443
- 'tj#.##s.sinajs.cn':443
- 'oc##.dcocsp.cn':443
UDP
- DNS ASK pa#####.#oogleadservices.com
- DNS ASK go#####a###ytics.com
- DNS ASK bd###.#hare.baidu.com
- DNS ASK ap#.##are.baidu.com
- DNS ASK v3.##athis.com
- DNS ASK z3##.net
- DNS ASK wi####.weibo.com
- DNS ASK tj#.##s.sinajs.cn
- DNS ASK fe########alog-cdn.prod.mozaws.net
- DNS ASK ns####k.baidu.com
- DNS ASK oc##.dcocsp.cn
- DNS ASK js.#.sinajs.cn
- DNS ASK im#.#.sinajs.cn
- DNS ASK tv##.sinaimg.cn
- DNS ASK wx#.#inaimg.cn
Miscellaneous
Searches for the following windows
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebCheckMonitor' WindowName: ''
