Technical Information
Modifies file system
Creates the following files
- %TEMP%\ad-mymacro9.xml
- %APPDATA%\mymacro\cfgdll.dll
- %APPDATA%\mymacro\qdisp.dll
- %ALLUSERSPROFILE%\boost_interprocess_qm\oxzdn_be1z_q
- %ALLUSERSPROFILE%\boost_interprocess_qm\oxzdn_be1z_
- %ALLUSERSPROFILE%\boost_interprocess_qm\wxwg4crvsvig
- %ALLUSERSPROFILE%\boost_interprocess_qm\7jrdl1zyrf3q
- %ALLUSERSPROFILE%\boost_interprocess_qm\hypbe5skqs7u
- %APPDATA%\mymacro\binding.exe
- %TEMP%\qmlog\20230211.log
- %TEMP%\947fe6a.tmp
- %ALLUSERSPROFILE%\boost_interprocess_qm\rnczk9m6ogby
- %TEMP%\809149.tmp
- %APPDATA%\mymacro\plugin\file.ini
- C:\jx3key\bmp\cur1.cur
- C:\jx3key\bmp\×¼ðç.bmp
- C:\jx3key\bmp\×¼ðç2.bmp
- C:\jx3key\bmp\ts.dll
- %ALLUSERSPROFILE%\boost_interprocess_qm\or3zap7rpkvs
- %TEMP%\91e8d.tmp
- %APPDATA%\mymacro\updatemacro.dat
- %APPDATA%\mymacro\mt.exe
- %TEMP%\mt.zip
- %TEMP%\mac905c.tmp
- %TEMP%\plugin.zip
- %APPDATA%\mymacro\plugin\sys.dll
- %APPDATA%\mymacro\plugin\window.dll
- %APPDATA%\mymacro\plugin\media.dll
- %APPDATA%\mymacro\plugin\msg.dll
- %APPDATA%\mymacro\plugin\file.dll
- %APPDATA%\mymacro\plugin\meminfo.dll
- %TEMP%\adcon\mm\tmpad.xml
- %APPDATA%\mymacro\plugin\getsysinfo.dll
- %TEMP%\mymacro.zip
- %TEMP%\background.bmp
- %TEMP%\rkey.zip
- %APPDATA%\mymacro\rkey.dat
- %TEMP%\runner.zip
- %TEMP%\ad-mymacro9.xml.tmp
- %APPDATA%\mymacro\runner.exe
- %APPDATA%\mymacro\wqm.exe
- %APPDATA%\mymacro\plugin\web.dll
- C:\jx3key\bmp\ò»¼ü.bmp
- %APPDATA%\mymacro\plugin\web.ini
Deletes the following files
- %TEMP%\adcon\mm\tmpad.xml
- %TEMP%\plugin.zip
- %TEMP%\mymacro.zip
- %TEMP%\rkey.zip
- %TEMP%\runner.zip
- %TEMP%\mt.zip
- %APPDATA%\mymacro\updatemacro.dat
- %ALLUSERSPROFILE%\boost_interprocess_qm\7jrdl1zyrf3q
- %ALLUSERSPROFILE%\boost_interprocess_qm\hypbe5skqs7u
- %ALLUSERSPROFILE%\boost_interprocess_qm\or3zap7rpkvs
- %ALLUSERSPROFILE%\boost_interprocess_qm\rnczk9m6ogby
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\bzjx5bke\ad-mymacro[1].xml
Moves the following files
- from %TEMP%\ad-mymacro9.xml.tmp to %TEMP%\ad-mymacro9.xml
- from %TEMP%\background.bmp to %TEMP%\a74background.bmp
Network activity
Connects to
- 'so##.anjian.com':80
- 'hm.##idu.com':80
- 'hm.##idu.com':443
- 'hu####nad.icoc.me':80
- 'microsoft.com':80
TCP
HTTP GET requests
- http://do##.#rbrothers.com/qmacro/up_mymacro/liveupdate8.dat
- http://so##.anjian.com/V2014V2/Config/ad-mymacro.xml
- http://so##.anjian.com/Include/BuildPage/AnJianBindingInstallPC.html
- http://hm.##idu.com/h.js?82##############################
- http://hu####nad.icoc.me/
- http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt
- http://lo#.##.baidu.com/hm.gif?cc#############################################################################################################################################
- http://lo#.##.baidu.com/hm.gif?cc########################################################################################################################################################
- http://lo#.##.baidu.com/hm.gif?cc###########################################################################################################################################
HTTP POST requests
- http://so##.anjian.com/Include/BuildPage/ExitAdXJL.shtml
- http://so##.anjian.com/Interface/GetIP.aspx
- http://so##.anjian.com/Interface/BindingPC/BindingUpdate.aspx
Other
- 'hm.##idu.com':443
UDP
- DNS ASK do##.#rbrothers.com
- DNS ASK so##.anjian.com
- DNS ASK ba##u.com
- DNS ASK hm.##idu.com
- DNS ASK hi.###rothers.com
- DNS ASK hu####nad.icoc.me
- DNS ASK microsoft.com
- DNS ASK lo#.##.baidu.com
Miscellaneous
Searches for the following windows
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebCheckMonitor' WindowName: ''
Creates and executes the following
- '%APPDATA%\mymacro\binding.exe'
- '%APPDATA%\mymacro\runner.exe' --host_id 3 --verify_key Dg9K5uEWvhax --product "<Full path to file>" --runner_md5 Rjg4N0Q0MjY2MkI0RUM3RTU3N0VBOTI0RUVDOEM3ODcA --version 2014.06.19549
- '%WINDIR%\syswow64\ping.exe' www.ba##u.com -n 2' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\ping.exe' www.ba##u.com -n 2
