Technical Information
Modifies file system
Modifies the following files
Network activity
Connects to
- 'da###ngce.com':80
- 's9.#nzz.com':80
- 'hm.##idu.com':80
- 'hm.##idu.com':443
- 'microsoft.com':80
TCP
HTTP GET requests
- http://www.da###ngce.com/move/news3.html
- http://www.da###ngce.com/template/default/image/header_bg.gif
- http://www.da###ngce.com/template/default/image/thumb20bg.gif
- http://www.da###ngce.com/template/default/image/appSidebar_bg.gif
- http://www.da###ngce.com/template/default/image/appSidebar_top_bg.gif
- http://www.da###ngce.com/template/default/image/48_avatar_bg.gif
- http://www.da###ngce.com/ucenter/images/noavatar_small.gif
- http://www.da###ngce.com/template/default/image/share.gif
- http://www.da###ying.com/attachment/201307/23/1_1374551609L24p.jpg
- http://www.da###ying.com/attachment/201307/23/1_1374551609uANI.jpg
- http://www.da###ngce.com/image/top.gif
- http://www.da###ngce.com/template/default/image/appSidebar_bottom_bg.gif
- http://s9.#nzz.com/stat.php?id#######################
- http://www.da###ying.com/attachment/201307/23/1_1374551610LnL6.jpg
- http://www.da###ying.com/attachment/201307/23/1_1374551611PGg7.jpg
- http://www.da###ying.com/attachment/201307/23/1_1374551611wSRE.jpg
- http://hm.##idu.com/hm.js?fb##############################
- http://hm.##idu.com/h.js?2e##############################
- http://www.da###ngce.com/source/script_calendar.js
- http://www.da###ngce.com/do.php?ac#########################
- http://www.da###ngce.com/ucenter/data/avatar/000/00/00/01_avatar_small.jpg
- http://www.da###ngce.com/template/default/image/logo.gif
- http://www.da###ngce.com/space-1-do-blog-id-941.html
- http://www.da###ngce.com/news3.html
- http://www.da###ying.com/move/get2.php?un#################################
- http://www.da###ying.com/move/add.php?un################################################
- http://www.da###ying.com/move/logo309.php?un#################################
- http://www.da###ngce.com/js.php?ad#####
- http://www.da###ngce.com/source/script_cookie.js
- http://www.da###ngce.com/source/script_common.js
- http://www.da###ngce.com/source/script_menu.js
- http://www.da###ngce.com/source/script_ajax.js
- http://www.da###ngce.com/source/script_face.js
- http://www.da###ngce.com/source/script_manage.js
- http://www.da###ngce.com/template/default/style.css
- http://www.da###ngce.com/template/default/blog.css
- http://www.da###ying.com/attachment/202111/20/1_1637402829un07.png
- http://www.da###ying.com/qq.gif
- http://www.da###ngce.com/attachment/201404/12/1_1397265925XlAx.jpg
- http://www.da###ngce.com/ucenter/data/avatar/000/00/00/00_avatar_small.jpg
- http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt
Other
- 'hm.##idu.com':443
UDP
- DNS ASK da###ngce.com
- DNS ASK da###ying.com
- DNS ASK s9.#nzz.com
- DNS ASK hm.##idu.com
- DNS ASK microsoft.com
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: ''
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebCheckMonitor' WindowName: ''
