Technical Information
Modifies file system
Creates the following files
- %TEMP%\tmp6769.tmp
- D:\996m2\gameclient45576\mod_launcher\stab\scripts\logic\loadinglayer_launcher.lua
- D:\996m2\gameclient45576\mod_launcher\stab\scripts\logic\loadingbarmanager_launcher.lua
- D:\996m2\gameclient45576\mod_launcher\stab\scripts\logic\loadingbarlayer_launcher.lua
- D:\996m2\gameclient45576\mod_launcher\stab\scripts\logic\hotupdategminitassets_launcher.lua
- D:\996m2\gameclient45576\mod_launcher\stab\scripts\logic\hotupdategmassets_launcher.lua
- D:\996m2\gameclient45576\mod_launcher\stab\scripts\logic\gamelayermanager_launcher.lua
- D:\996m2\gameclient45576\mod_launcher\stab\scripts\logic\gameenvmanager_launcher.lua
- D:\996m2\gameclient45576\mod_launcher\stab\scripts\logic\datareport_launcher.lua
- D:\996m2\gameclient45576\mod_launcher\stab\scripts\logic\commontipsmanager_launcher.lua
- D:\996m2\gameclient45576\mod_launcher\stab\scripts\logic\commontipslayer_launcher.lua
- D:\996m2\gameclient45576\mod_launcher\stab\scripts\lockbox\util\stream.lua
- D:\996m2\gameclient45576\mod_launcher\stab\scripts\lockbox\util\queue.lua
- D:\996m2\gameclient45576\mod_launcher\stab\scripts\lockbox\util\bit.lua
- D:\996m2\gameclient45576\mod_launcher\stab\scripts\lockbox\util\base64.lua
- D:\996m2\gameclient45576\mod_launcher\stab\scripts\logic\loadingmanager_launcher.lua
- D:\996m2\gameclient45576\mod_launcher\stab\scripts\lockbox\util\array.lua
- D:\996m2\gameclient45576\mod_launcher\stab\scripts\lockbox\cipher\mode\ecb.lua
- D:\996m2\gameclient45576\mod_launcher\stab\scripts\lockbox\cipher\des.lua
- D:\996m2\gameclient45576\mod_launcher\stab\scripts\init\util_launcher.lua
- D:\996m2\gameclient45576\mod_launcher\stab\scripts\init\init_launcher.lua
- D:\996m2\gameclient45576\mod_launcher\stab\scripts\init\functions_launcher.lua
- D:\996m2\gameclient45576\mod_launcher\stab\scripts\init\richtexthelp_launcher.lua
- D:\996m2\gameclient45576\mod_launcher\stab\scripts\init\cocos2dconstants_launcher.lua
- D:\996m2\gameclient45576\mod_launcher\stab\scripts\export\server\server_cell_launcher.lua
- D:\996m2\gameclient45576\mod_launcher\stab\scripts\export\server\module_cell_launcher.lua
- D:\996m2\gameclient45576\mod_launcher\stab\scripts\export\server\module_announce_launcher.lua
- D:\996m2\gameclient45576\mod_launcher\stab\scripts\export\server\module_announce_cell_launcher.lua
- D:\996m2\gameclient45576\mod_launcher\stab\scripts\export\server\group_cell_launcher.lua
- D:\996m2\gameclient45576\mod_launcher\stab\scripts\export\server\all_modules_launcher.lua
- D:\996m2\gameclient45576\mod_launcher\stab\scripts\export\server\agreement_launcher.lua
- D:\996m2\gameclient45576\mod_launcher\stab\scripts\lockbox\padding\zero.lua
- D:\996m2\gameclient45576\mod_launcher\stab\scripts\logic\modulechooselayer_launcher.lua
- D:\996m2\gameclient45576\mod_launcher\stab\scripts\logic\modulechoosemanager_launcher.lua
- D:\996m2\gameclient45576\mod_launcher\stab\scripts\logic\modulemanager_launcher.lua
- D:\996m2\gameclient45576\msvcp120d.dll
- D:\996m2\gameclient45576\msvcp140.dll
- D:\996m2\gameclient45576\msvcp140d.dll
- D:\996m2\gameclient45576\msvcr100.dll
- D:\996m2\gameclient45576\msvcr110.dll
- D:\996m2\gameclient45576\msvcr120.dll
- D:\996m2\gameclient45576\sqlite3.dll
- D:\996m2\gameclient45576\zlib1.dll
- D:\996m2\gameclient45576\ucrtbased.dll
- D:\996m2\gameclient45576\vccorlib140.dll
- D:\996m2\gameclient45576\vccorlib140d.dll
- D:\996m2\gameclient45576\vcruntime140.dll
- D:\996m2\gameclient45576\vcruntime140d.dll
- D:\996m2\gameclient45576\websockets.dll
- D:\996m2\gameclient45576\msvcp120.dll
- D:\996m2\gameclient45576\msvcp110.dll
- D:\996m2\gameclient45576\msvcp100.dll
- D:\996m2\gameclient45576\mod_launcher\stab\scripts\sha1\pure_lua_ops.lua
- D:\996m2\gameclient45576\mod_launcher\stab\scripts\sha1\init.lua
- D:\996m2\gameclient45576\mod_launcher\stab\scripts\sha1\common.lua
- D:\996m2\gameclient45576\mod_launcher\stab\scripts\sha1\bit_ops.lua
- D:\996m2\gameclient45576\mod_launcher\stab\scripts\sha1\bit32_ops.lua
- D:\996m2\gameclient45576\mod_launcher\stab\scripts\res_check\assets_manager_launcher.lua
- D:\996m2\gameclient45576\mod_launcher\stab\scripts\pbc\protobuf.lua
- D:\996m2\gameclient45576\mod_launcher\stab\scripts\pbc\protobuf_launcher.lua
- D:\996m2\gameclient45576\mod_launcher\stab\scripts\pb_message\datareport.pb
- D:\996m2\gameclient45576\mod_launcher\stab\scripts\main.lua
- D:\996m2\gameclient45576\mod_launcher\stab\scripts\logic\systemtipsmanager_launcher.lua
- D:\996m2\gameclient45576\mod_launcher\stab\scripts\logic\systemtipslayer_launcher.lua
- D:\996m2\gameclient45576\mod_launcher\stab\scripts\logic\nativebridgemanager_launcher.lua
- D:\996m2\gameclient45576\mod_launcher\stab\scripts\logic\module_launcher.lua
- D:\996m2\gameclient45576\mod_launcher\stab\scripts\export\loading\res_sync_launcher.lua
- D:\996m2\gameclient45576\msvcr120d.dll
- D:\996m2\gameclient45576\mod_launcher\stab\scripts\config\global_launcher.lua
- D:\996m2\gameclient45576\mod_launcher\stab\res\private\server\fuguchuanqi.apk_000873.png
- D:\996m2\gameclient45576\mod_launcher\stab\res\private\loading\bg_loading_01.jpg
- D:\996m2\gameclient45576\mod_launcher\stab\mod_launcher_version.manifest
- D:\996m2\gameclient45576\mod_launcher\stab\mod_launcher_project.manifest
- D:\996m2\gameclient45576\mod_launcher\stab\fonts\font2.ttf
- D:\996m2\gameclient45576\mod_launcher\stab\fonts\font.ttf
- D:\996m2\gameclient45576\mod_launcher\stab\default\imagefile.png
- D:\996m2\gameclient45576\lua51.dll
- D:\996m2\gameclient45576\libvorbisfile.dll
- D:\996m2\gameclient45576\libvorbis.dll
- D:\996m2\gameclient45576\libtiff.dll
- D:\996m2\gameclient45576\libssl-1_1.dll
- D:\996m2\gameclient45576\libogg.dll
- D:\996m2\gameclient45576\libmpg123.dll
- D:\996m2\gameclient45576\libcurl.dll
- D:\996m2\gameclient45576\mod_launcher\stab\res\private\loading\bg_loading_02.png
- D:\996m2\gameclient45576\libcrypto-1_1.dll
- D:\996m2\gameclient45576\iconv.dll
- D:\996m2\gameclient45576\glew32.dll
- D:\996m2\gameclient45576\concrt140d.dll
- D:\996m2\gameclient45576\concrt140.dll
- D:\996m2\gameclient45576\pcdevicenumber.txt
- D:\996m2\gameclient45576\openal32.dll
- %LOCALAPPDATA%\microsoft\internet explorer\msimgsiz.dat
- D:\996m2\gameclient45576\mod_fgcq.zip
- %HOMEPATH%\desktop\áúµû´«ëµ.lnk
- D:\996m2\gameclient45576\áúµû´«ëµ.exe
- %TEMP%\tmp7dd6.tmp
- %TEMP%\áúµû´«ëµ.ini
- %TEMP%\6551bcdd95ee417481de1936cab5851e.bat
- D:\996m2\<File name>.exe
- D:\996m2\gameclient45576\libcocos2d.dll
- D:\996m2\gameclient45576\mod_launcher\stab\res\private\loading\bg_loading_03.png
- D:\996m2\gameclient45576\mod_launcher\stab\res\private\server\1900000550.png
- D:\996m2\gameclient45576\mod_launcher\stab\res\private\server\1900000551.png
- D:\996m2\gameclient45576\mod_launcher\stab\res\private\server\fuguchuanqi.apk_000853.png
- D:\996m2\gameclient45576\mod_launcher\stab\res\private\server\fuguchuanqi.apk_000857.png
- D:\996m2\gameclient45576\mod_launcher\stab\res\private\server\fuguchuanqi.apk_000858.png
- D:\996m2\gameclient45576\mod_launcher\stab\res\private\server\fuguchuanqi.apk_000870.png
- D:\996m2\gameclient45576\mod_launcher\stab\res\private\server\fuguchuanqi.apk_000871.png
- D:\996m2\gameclient45576\mod_launcher\stab\res\private\server\fuguchuanqi.apk_000872.png
- D:\996m2\gameclient45576\mod_launcher\stab\res\private\server\logo_1.png
- D:\996m2\gameclient45576\mod_launcher\stab\res\public\bg_load_1.png
- D:\996m2\gameclient45576\mod_launcher\stab\res\private\server\open_door\00.png
- D:\996m2\gameclient45576\mod_launcher\stab\res\private\server\tips_16.png
- D:\996m2\gameclient45576\mod_launcher\stab\res\private\start_game\00.png
- D:\996m2\gameclient45576\mod_launcher\stab\res\public\1900000600.png
- D:\996m2\gameclient45576\mod_launcher\stab\res\public\1900001022.png
- D:\996m2\gameclient45576\mod_launcher\stab\res\public\1900001023.png
- D:\996m2\gameclient45576\mod_launcher\stab\res\private\server\fuguchuanqi.apk_000850.png
- D:\996m2\gameclient45576\mod_launcher\stab\res\private\server\btn_jryx_03_1.png
- D:\996m2\gameclient45576\mod_launcher\stab\res\private\server\btn_jryx_03.png
- D:\996m2\gameclient45576\mod_launcher\stab\res\private\server\btn_jryx_02_1.png
- D:\996m2\gameclient45576\mod_launcher\stab\res\private\server\btn_jryx_02.png
- D:\996m2\gameclient45576\mod_launcher\stab\res\private\server\btn_jryx_01_1.png
- D:\996m2\gameclient45576\mod_launcher\stab\res\private\server\btn_jryx_01.png
- D:\996m2\gameclient45576\mod_launcher\stab\res\private\server\announce\word_hefubq_04.png
- D:\996m2\gameclient45576\mod_launcher\stab\res\private\server\announce\word_hefubq_03.png
- D:\996m2\gameclient45576\mod_launcher\stab\res\private\server\announce\word_hefubq_02.png
- D:\996m2\gameclient45576\mod_launcher\stab\res\private\server\announce\word_hefubq_01.png
- D:\996m2\gameclient45576\mod_launcher\stab\res\private\server\announce\bg_hefubq_01.jpg
- D:\996m2\gameclient45576\mod_launcher\stab\res\private\server\announce\1900000663.png
- D:\996m2\gameclient45576\mod_launcher\stab\res\private\server\announce\1900000662.png
- D:\996m2\gameclient45576\mod_launcher\stab\res\private\server\announce\1900000511.png
- D:\996m2\gameclient45576\mod_launcher\stab\res\private\server\announce\1900000510.png
- D:\996m2\gameclient45576\mod_launcher\stab\res\private\server\1900008055.png
- D:\996m2\gameclient45576\mod_launcher\stab\scripts\luaextend.lua
- D:\996m2\gameclient45576\热血合击.exe
Deletes the following files
- %TEMP%\tmp6769.tmp
Moves the following files
- from D:\996m2\gameclient45576\concrt140.dll to D:\996m2\gameclient45576\concrt140.dll
- from D:\996m2\gameclient45576\msvcr100.dll to D:\996m2\gameclient45576\msvcr100.dll
- from D:\996m2\gameclient45576\msvcr110.dll to D:\996m2\gameclient45576\msvcr110.dll
- from D:\996m2\gameclient45576\msvcr120.dll to D:\996m2\gameclient45576\msvcr120.dll
- from D:\996m2\gameclient45576\msvcr120d.dll to D:\996m2\gameclient45576\msvcr120d.dll
- from D:\996m2\gameclient45576\openal32.dll to D:\996m2\gameclient45576\openal32.dll
- from D:\996m2\gameclient45576\msvcp140.dll to D:\996m2\gameclient45576\msvcp140.dll
- from D:\996m2\gameclient45576\msvcp140d.dll to D:\996m2\gameclient45576\msvcp140d.dll
- from D:\996m2\gameclient45576\pcdevicenumber.txt to D:\996m2\gameclient45576\pcdevicenumber.txt
- from D:\996m2\gameclient45576\vccorlib140.dll to D:\996m2\gameclient45576\vccorlib140.dll
- from D:\996m2\gameclient45576\vccorlib140d.dll to D:\996m2\gameclient45576\vccorlib140d.dll
- from D:\996m2\gameclient45576\vcruntime140.dll to D:\996m2\gameclient45576\vcruntime140.dll
- from D:\996m2\gameclient45576\vcruntime140d.dll to D:\996m2\gameclient45576\vcruntime140d.dll
- from D:\996m2\gameclient45576\websockets.dll to D:\996m2\gameclient45576\websockets.dll
- from D:\996m2\gameclient45576\sqlite3.dll to D:\996m2\gameclient45576\sqlite3.dll
- from D:\996m2\gameclient45576\ucrtbased.dll to D:\996m2\gameclient45576\ucrtbased.dll
- from D:\996m2\gameclient45576\msvcp120d.dll to D:\996m2\gameclient45576\msvcp120d.dll
- from D:\996m2\gameclient45576\msvcp120.dll to D:\996m2\gameclient45576\msvcp120.dll
- from D:\996m2\gameclient45576\msvcp110.dll to D:\996m2\gameclient45576\msvcp110.dll
- from D:\996m2\gameclient45576\glew32.dll to D:\996m2\gameclient45576\glew32.dll
- from D:\996m2\gameclient45576\iconv.dll to D:\996m2\gameclient45576\iconv.dll
- from D:\996m2\gameclient45576\libcocos2d.dll to D:\996m2\gameclient45576\libcocos2d.dll
- from D:\996m2\gameclient45576\libcrypto-1_1.dll to D:\996m2\gameclient45576\libcrypto-1_1.dll
- from D:\996m2\gameclient45576\libcurl.dll to D:\996m2\gameclient45576\libcurl.dll
- from D:\996m2\gameclient45576\libmpg123.dll to D:\996m2\gameclient45576\libmpg123.dll
- from D:\996m2\gameclient45576\concrt140d.dll to D:\996m2\gameclient45576\concrt140d.dll
- from D:\996m2\gameclient45576\libogg.dll to D:\996m2\gameclient45576\libogg.dll
- from D:\996m2\gameclient45576\libtiff.dll to D:\996m2\gameclient45576\libtiff.dll
- from D:\996m2\gameclient45576\libvorbis.dll to D:\996m2\gameclient45576\libvorbis.dll
- from D:\996m2\gameclient45576\libvorbisfile.dll to D:\996m2\gameclient45576\libvorbisfile.dll
- from D:\996m2\gameclient45576\lua51.dll to D:\996m2\gameclient45576\lua51.dll
- from D:\996m2\gameclient45576\mod_fgcq.zip to D:\996m2\gameclient45576\mod_fgcq.zip
- from D:\996m2\gameclient45576\msvcp100.dll to D:\996m2\gameclient45576\msvcp100.dll
- from D:\996m2\gameclient45576\libssl-1_1.dll to D:\996m2\gameclient45576\libssl-1_1.dll
- from D:\996m2\gameclient45576\zlib1.dll to D:\996m2\gameclient45576\zlib1.dll
- from D:\996m2\gameclient45576\热血合击.exe to D:\996m2\gameclient45576\????.exe
Deletes itself.
Network activity
Connects to
- 'li######.dhsf.xqhuyu.com':80
- 'st####.dhsf.xqhuyu.com':80
- '56##u.com':80
TCP
HTTP GET requests
- http://li######.dhsf.xqhuyu.com/modlist/modlist_45576.txt
- http://li######.dhsf.xqhuyu.com/serverlist/45576/serverlist.txt
- http://st####.dhsf.xqhuyu.com/game_mubao/20220126/mod_fgcq_version.txt
- http://st####.dhsf.xqhuyu.com/game_mubao/20220126/mod_fgcq.zip?v=##############
- http://www.56##u.com/link.html
- http://www.56##u.com/link/images/IOS.png
- http://www.56##u.com/link/images/title.png
- http://www.56##u.com/link/images/bg.jpg
- http://www.56##u.com/link/images/rqcode_bg.png
- http://www.56##u.com/link/images/gzh.jpg
UDP
- DNS ASK li######.dhsf.xqhuyu.com
- DNS ASK st####.dhsf.xqhuyu.com
- DNS ASK 56##u.com
Miscellaneous
Searches for the following windows
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebCheckMonitor' WindowName: ''
Creates and executes the following
- 'D:\996m2\<File name>.exe'
- '%WINDIR%\syswow64\cmd.exe' /c %TEMP%\6551BCDD95EE417481DE1936CAB5851E.bat' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c %TEMP%\6551BCDD95EE417481DE1936CAB5851E.bat