Technical Information
Modifies file system
Creates the following files
- %TEMP%\~nsua.tmp\un_a.exe
- %TEMP%\nsd1abe.tmp\system.dll
- %TEMP%\nsd1abe.tmp\findprocdll.dll
- %TEMP%\nsd1abe.tmp\nsexec.dll
- %TEMP%\nsd1abe.tmp\stdutils.dll
- %LOCALAPPDATA%\microsoft\windows\history\history.ie5\mshist012020061220200613\index.dat
Deletes the following files
- %TEMP%\nsd1abe.tmp\findprocdll.dll
- %TEMP%\nsd1abe.tmp\nsexec.dll
- %TEMP%\nsd1abe.tmp\stdutils.dll
- %TEMP%\nsd1abe.tmp\system.dll
Deletes itself.
Network activity
TCP
HTTP GET requests
- http://tj.##hfrj.com/redirect/ver1/xunjiecadeditor/uninstall/1.9.5.0/Un_A.exe/%7Bmachineid%7D
- http://www.xu###ecad.com/wp-content/themes/project-v2.2.6/assets/images/ico-complete.png
- http://www.xu###ecad.com/wp-content/themes/project-v2.2.6/assets/images/xunjiecad_scan.png
- http://www.xu###ecad.com/wp-content/themes/project-v2.2.6/assets/images/footer-contact-img2.png
- http://www.xu###ecad.com/wp-content/themes/project-v2.2.6/assets/images/footer-contact-img1.png
- http://www.xu###ecad.com/wp-content/themes/project-v2.2.6/assets/images/product-code-i.png
- http://www.xu###ecad.com/
- http://www.xu###ecad.com/wp-content/themes/project-v2.2.6/assets/images/rec.png
- http://www.xu###ecad.com/wp-content/themes/project-v2.2.6/assets/images/videos-modal-close.png
- http://www.xu###ecad.com/wp-content/themes/project-v2.2.6/assets/images/icon-scan.png
- http://www.xu###ecad.com/wp-content/themes/project-v2.2.6/assets/images/loding.gif
- http://www.xu###ecad.com/wp-content/themes/project-v2.2.6/assets/images/icon-close.png
- http://www.xu###ecad.com/wp-content/themes/project-v2.2.6/assets/images/buy-converter2.png
- http://www.xu###ecad.com/wp-content/themes/project-v2.2.6/assets/images/icon-car.png
- http://www.xu###ecad.com/wp-content/themes/project-v2.2.6/assets/images/down-bg-03.png
- http://www.xu###ecad.com/wp-content/themes/project-v2.2.6/assets/images/product-payment-alipay.png
- http://www.xu###ecad.com/wp-content/themes/project-v2.2.6/assets/images/product-payment-weixin.png
- http://www.xu###ecad.com/wp-content/themes/project-v2.2.6/assets/images/hot.png
- http://www.xu###ecad.com/wp-content/themes/project-v2.2.6/assets/images/majors-pic-01.png
- http://www.xu###ecad.com/wp-content/themes/project-v2.2.6/assets/images/icon-tags.png
- http://www.xu###ecad.com/wp-content/themes/project-v2.2.6/assets/js/main-mobile.js
- http://www.xu###ecad.com/wp-content/themes/project-v2.2.6/assets/js/index-mobile.js
- http://www.xu###ecad.com/wp-content/themes/project-v2.2.6/assets/images/weixin-icon.png
- http://www.xu###ecad.com/wp-content/themes/project-v2.2.6/assets/images/ico-dcyanzheng.png
- http://www.xu###ecad.com/wp-content/themes/project-v2.2.6/assets/images/ico-yanzheng.png
- http://www.xu###ecad.com/wp-content/themes/project-v2.2.6/assets/images/loading.gif
- http://www.xu###ecad.com/wp-content/themes/project-v2.2.6/assets/images/ico-shouji.png
- http://www.xu###ecad.com/wp-content/themes/project-v2.2.6/assets/images/close2.png
- http://www.xu###ecad.com/wp-content/themes/project-v2.2.6/assets/images/service-wrap-icon2.png
- http://www.xu###ecad.com/wp-content/themes/project-v2.2.6/assets/images/service-wrap-icon1.png
- http://hm.##idu.com/hm.js?80##############################
- http://www.xu###ecad.com/wp-content/themes/project-v2.2.6/assets/images/buy-gjx1.png
- http://www.xu###ecad.com/wp-content/themes/project-v2.2.6/assets/images/pub-services3.png
- http://www.xu###ecad.com/wp-content/themes/project-v2.2.6/assets/images/pub-services2.png
- http://www.xu###ecad.com/wp-content/themes/project-v2.2.6/assets/images/service-wrap-icon3.png
- http://www.xu###ecad.com/wp-content/themes/project-v2.2.6/assets/images/pub-services1.png
- http://ap#.##oujihuifu.com/wap_pay/Public/images/beian.png
- http://www.xu###ecad.com/wp-content/themes/project-v2.2.6/assets/js/logingRegister.js
- http://www.xu###ecad.com/wp-content/themes/project-v2.2.6/assets/images/logo-2.png
- http://www.xu###ecad.com/wp-content/themes/project-v2.2.6/assets/js/help-mobile.js
- http://www.xu###ecad.com/wp-content/themes/project-v2.2.6/assets/images/standard-pic-01.png
- http://www.xu###ecad.com/wp-content/themes/project-v2.2.6/assets/js/pay-majors.js
- http://www.xu###ecad.com/wp-content/themes/project-v2.2.6/assets/images/converter-pic.png
- http://www.xu###ecad.com/wp-content/themes/project-v2.2.6/assets/js/html5shiv.min.js
- http://www.xu###ecad.com/wp-content/themes/project-v2.2.6/assets/js/jquery.cookie.js
- http://www.xu###ecad.com/wp-content/themes/project-v2.2.6/assets/css/uploaderpaper.css
- http://www.xu###ecad.com/wp-content/themes/project-v2.2.6/style.css
- http://www.xu###ecad.com/wp-content/themes/project-v2.2.6/assets/js/appInfo.js
- http://www.xu###ecad.com/wp-content/themes/project-v2.2.6/assets/js/formSetting.js
- http://www.xu###ecad.com/wp-content/themes/project-v2.2.6/assets/js/webuploader.min.js
- http://www.xu###ecad.com/wp-content/themes/project-v2.2.6/assets/js/md5.js
- http://www.xu###ecad.com/wp-content/themes/project-v2.2.6/assets/js/main.js
- http://www.xu###ecad.com/wp-content/themes/project-v2.2.6/assets/js/respond.min.js
- http://www.xu###ecad.com/wp-content/themes/project-v2.2.6/assets/js/jquery.pagination.js
- http://www.xu###ecad.com/wp-content/themes/project-v2.2.6/assets/js/jquery.min.js
- http://www.xu###ecad.com/wp-content/themes/project-v2.2.6/assets/css/animate.css
- http://www.xu###ecad.com/wp-content/themes/project-v2.2.6/assets/css/index-mobile.css
- http://www.xu###ecad.com/wp-content/themes/project-v2.2.6/assets/css/normalize.css
- http://www.xu###ecad.com/buy.html
- http://www.xu###ecad.com/wp-content/themes/project-v2.2.6/assets/images/touxiang.png
- http://www.xu###ecad.com/wp-content/themes/project-v2.2.6/assets/images/touxiang2.png
- http://www.xu###ecad.com/wp-content/themes/project-v2.2.6/assets/images/logo.png
- http://www.xu###ecad.com/wp-content/themes/project-v2.2.6/assets/images/buy-setmeal1.png
- http://www.xu###ecad.com/wp-content/themes/project-v2.2.6/assets/images/majors-pic-02.png
- http://www.xu###ecad.com/wp-content/themes/project-v2.2.6/assets/images/buy-setmeal2.png
- http://www.xu###ecad.com/wp-content/themes/project-v2.2.6/assets/images/icon-18.png
- http://www.xu###ecad.com/wp-content/themes/project-v2.2.6/assets/images/icon-17.png
- http://www.xu###ecad.com/wp-content/themes/project-v2.2.6/assets/images/icon-16.png
- http://www.xu###ecad.com/wp-content/themes/project-v2.2.6/assets/images/standard-pic-02.png
- http://www.xu###ecad.com/wp-content/themes/project-v2.2.6/assets/images/logo-6.png
- http://www.xu###ecad.com/wp-content/themes/project-v2.2.6/assets/images/logo-5.png
- http://www.xu###ecad.com/wp-content/themes/project-v2.2.6/assets/images/wechat-content-banner.png
- http://www.xu###ecad.com/favicon.ico
- http://www.xu###ecad.com/wp-content/themes/project-v2.2.6/assets/images/qq-icon.png
- http://www.xu###ecad.com/wp-content/themes/project-v2.2.6/assets/images/buy-course2.jpg
- http://www.xu###ecad.com/wp-content/themes/project-v2.2.6/assets/images/buy-course1.jpg
- http://www.xu###ecad.com/wp-content/themes/project-v2.2.6/assets/images/buy-converter3.png
- http://www.xu###ecad.com/wp-content/themes/project-v2.2.6/assets/images/buy-converter1.png
- http://www.xu###ecad.com/wp-content/themes/project-v2.2.6/assets/images/buy-majors3.png
- http://www.xu###ecad.com/wp-content/themes/project-v2.2.6/assets/images/buy-majors2.png
- http://www.xu###ecad.com/wp-content/themes/project-v2.2.6/assets/images/buy-majors1.png
- http://www.xu###ecad.com/wp-content/themes/project-v2.2.6/assets/images/buy-setmeal3.png
- http://www.xu###ecad.com/wp-content/themes/project-v2.2.6/assets/images/buy-holdall1.png
- http://www.xu###ecad.com/wp-content/themes/project-v2.2.6/assets/images/ico-mima.png
UDP
- DNS ASK tj.##hfrj.com
- DNS ASK xu###ecad.com
- DNS ASK ap#.##oujihuifu.com
- DNS ASK hm.##idu.com
Miscellaneous
Searches for the following windows
- ClassName: 'DDEMLMom' WindowName: ''
- ClassName: 'IEFrame' WindowName: ''
- ClassName: 'Static' WindowName: ''
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebCheckMonitor' WindowName: ''
Creates and executes the following
- '%TEMP%\~nsua.tmp\un_a.exe' _?=<Current directory>\
Executes the following
- '%WINDIR%\syswow64\regsvr32.exe' /u /s "<Current directory>\xjcadeditmenu64.dll"
