Technical Information
Modifies file system
Creates the following files
- %LOCALAPPDATA%\kohfile\kfcfg.data
- %LOCALAPPDATA%\chrome\user data\default\bookmarks
- %LOCALAPPDATA%\rnwebfast\chrome\user data\default\bookmarks
- %LOCALAPPDATA%\google\chrome\user data\default\bookmarks
- %LOCALAPPDATA%\rnwebfast\chrome\user data\default\secure preferences
- %LOCALAPPDATA%\rnwebfast\chrome\user data\default\preferences
- %LOCALAPPDATA%\rnwebfast\user data\default\bookmarks
- %LOCALAPPDATA%\chromium\user data\default\bookmarks
- %TEMP%\etilqs_1ik1fhw2gzusckm
- %LOCALAPPDATA%\tisnet\tpknet\background.js
- %LOCALAPPDATA%\tisnet\tpknet\48.png
- %LOCALAPPDATA%\sissou\tikseo\manifest.json
- %LOCALAPPDATA%\sissou\tikseo\48.png
- %LOCALAPPDATA%\nisntp\hpkntp\tab.html
- %LOCALAPPDATA%\nisntp\hpkntp\manifest.json
- %LOCALAPPDATA%\nisntp\hpkntp\48.png
- %APPDATA%\tnkdata\tnk.ini
- %LOCALAPPDATA%\tisnet\tpknet\manifest.json
- %TEMP%\etilqs_hmvuqafgtblocbk
Network activity
Connects to
- 'pb##.#####n-beijing.aliyuncs.com':443
- 'ds##.#dstatic.com':443
- 'ha#######atic.cdn.bcebos.com':443
- 'co##.#dstatic.com':443
- 'dg###.bdstatic.com':443
- 'ps#.##static.com':443
- 'ha##23.com':443
- 'z3.#nzz.com':443
- 'sc#.##o123img.com':443
- 'c.##zz.com':443
- 's4.#nzz.com':443
- 'ss#.#static.com':443
- 'clients4.google.com':443
- 'clients2.google.com':443
- 'tr######e.googleapis.com':443
- 'we##oe.com':443
- 'xi###inet.com':443
- 'hm.##idu.com':443
- 'fy###.#dn.bcebos.com':443
TCP
Other
- 'pb##.#####n-beijing.aliyuncs.com':443
- 'google.com':443
- 'ha#######atic.cdn.bcebos.com':443
- 'co##.#dstatic.com':443
- 'dg###.bdstatic.com':443
- 'ps#.##static.com':443
- 'ba##u.com':443
- 'ha##23.com':443
- 'z3.#nzz.com':443
- 'hm.##idu.com':443
- 's4.#nzz.com':443
- 'ss#.#static.com':443
- 'clients4.google.com':443
- 'clients3.google.com':443
- 'tr######e.googleapis.com':443
- 'we##oe.com':443
- 'ds##.#dstatic.com':443
- 'sc#.##o123img.com':443
UDP
- DNS ASK pb##.#####n-beijing.aliyuncs.com
- DNS ASK ss#.#aidu.com
- DNS ASK sc#.##o123img.com
- DNS ASK he#####tatic.baidu.com
- DNS ASK sp#.#aidu.com
- DNS ASK ds##.#dstatic.com
- DNS ASK ha#######atic.cdn.bcebos.com
- DNS ASK ps#.##static.com
- DNS ASK dg###.bdstatic.com
- DNS ASK co##.#dstatic.com
- DNS ASK ba##u.com
- DNS ASK ha##23.com
- DNS ASK c.##zz.com
- DNS ASK z3.#nzz.com
- DNS ASK hm.##idu.com
- DNS ASK s4.#nzz.com
- DNS ASK ss#.#static.com
- DNS ASK clients2.google.com
- DNS ASK clients3.google.com
- DNS ASK clients4.google.com
- DNS ASK tr######e.googleapis.com
- DNS ASK we##oe.com
- DNS ASK google.com
- DNS ASK xi###inet.com
- DNS ASK fy###.#dn.bcebos.com
- DNS ASK hm###.baidu.com
Miscellaneous
Searches for the following windows
- ClassName: 'Chrome_MessageWindow' WindowName: '%LOCALAPPDATA%\Google\Chrome\User Data'
