Technical Information
Modifies file system
Creates the following files
- %TEMP%\tmp222f.tmp
- D:\996m2\gameclient54656\mod_launcher\stab\scripts\logic\hotupdategmassets_launcher.lua
- D:\996m2\gameclient54656\mod_launcher\stab\scripts\logic\gamelayermanager_launcher.lua
- D:\996m2\gameclient54656\mod_launcher\stab\scripts\logic\gameenvmanager_launcher.lua
- D:\996m2\gameclient54656\mod_launcher\stab\scripts\logic\datareport_launcher.lua
- D:\996m2\gameclient54656\mod_launcher\stab\scripts\logic\commontipsmanager_launcher.lua
- D:\996m2\gameclient54656\mod_launcher\stab\scripts\logic\commontipslayer_launcher.lua
- D:\996m2\gameclient54656\mod_launcher\stab\scripts\lockbox\util\stream.lua
- D:\996m2\gameclient54656\mod_launcher\stab\scripts\lockbox\util\queue.lua
- D:\996m2\gameclient54656\mod_launcher\stab\scripts\lockbox\util\bit.lua
- D:\996m2\gameclient54656\mod_launcher\stab\scripts\lockbox\util\base64.lua
- D:\996m2\gameclient54656\mod_launcher\stab\scripts\lockbox\util\array.lua
- D:\996m2\gameclient54656\mod_launcher\stab\scripts\lockbox\padding\zero.lua
- D:\996m2\gameclient54656\mod_launcher\stab\scripts\lockbox\cipher\mode\ecb.lua
- D:\996m2\gameclient54656\mod_launcher\stab\scripts\lockbox\cipher\des.lua
- D:\996m2\gameclient54656\mod_launcher\stab\scripts\init\util_launcher.lua
- D:\996m2\gameclient54656\mod_launcher\stab\scripts\init\init_launcher.lua
- D:\996m2\gameclient54656\mod_launcher\stab\scripts\init\functions_launcher.lua
- D:\996m2\gameclient54656\mod_launcher\stab\scripts\init\richtexthelp_launcher.lua
- D:\996m2\gameclient54656\mod_launcher\stab\scripts\init\cocos2dconstants_launcher.lua
- D:\996m2\gameclient54656\mod_launcher\stab\scripts\export\server\server_cell_launcher.lua
- D:\996m2\gameclient54656\mod_launcher\stab\scripts\export\server\module_cell_launcher.lua
- D:\996m2\gameclient54656\mod_launcher\stab\scripts\export\server\module_announce_launcher.lua
- D:\996m2\gameclient54656\mod_launcher\stab\scripts\export\server\module_announce_cell_launcher.lua
- D:\996m2\gameclient54656\mod_launcher\stab\scripts\export\server\group_cell_launcher.lua
- D:\996m2\gameclient54656\mod_launcher\stab\scripts\export\server\all_modules_launcher.lua
- D:\996m2\gameclient54656\mod_launcher\stab\scripts\export\server\agreement_launcher.lua
- D:\996m2\gameclient54656\mod_launcher\stab\scripts\export\loading\res_sync_launcher.lua
- D:\996m2\gameclient54656\mod_launcher\stab\scripts\config\global_launcher.lua
- D:\996m2\gameclient54656\mod_launcher\stab\scripts\luaextend.lua
- D:\996m2\gameclient54656\mod_launcher\stab\scripts\logic\hotupdategminitassets_launcher.lua
- D:\996m2\gameclient54656\mod_launcher\stab\scripts\logic\loadingbarmanager_launcher.lua
- D:\996m2\gameclient54656\zlib1.dll
- D:\996m2\gameclient54656\mod_launcher\stab\scripts\logic\loadinglayer_launcher.lua
- D:\996m2\gameclient54656\websockets.dll
- D:\996m2\gameclient54656\vcruntime140.dll
- D:\996m2\gameclient54656\vccorlib140.dll
- D:\996m2\gameclient54656\sqlite3.dll
- D:\996m2\gameclient54656\msvcr120.dll
- D:\996m2\gameclient54656\msvcr110.dll
- D:\996m2\gameclient54656\msvcr100.dll
- D:\996m2\gameclient54656\msvcp140.dll
- D:\996m2\gameclient54656\msvcp120.dll
- D:\996m2\gameclient54656\msvcp110.dll
- D:\996m2\gameclient54656\msvcp100.dll
- D:\996m2\gameclient54656\mod_launcher\stab\scripts\sha1\pure_lua_ops.lua
- D:\996m2\gameclient54656\mod_launcher\stab\scripts\sha1\init.lua
- D:\996m2\gameclient54656\mod_launcher\stab\scripts\sha1\common.lua
- D:\996m2\gameclient54656\mod_launcher\stab\scripts\sha1\bit_ops.lua
- D:\996m2\gameclient54656\mod_launcher\stab\scripts\sha1\bit32_ops.lua
- D:\996m2\gameclient54656\mod_launcher\stab\scripts\res_check\assets_manager_launcher.lua
- D:\996m2\gameclient54656\mod_launcher\stab\scripts\pbc\protobuf.lua
- D:\996m2\gameclient54656\mod_launcher\stab\scripts\pbc\protobuf_launcher.lua
- D:\996m2\gameclient54656\mod_launcher\stab\scripts\pb_message\datareport.pb
- D:\996m2\gameclient54656\mod_launcher\stab\scripts\main.lua
- D:\996m2\gameclient54656\mod_launcher\stab\scripts\logic\systemtipsmanager_launcher.lua
- D:\996m2\gameclient54656\mod_launcher\stab\scripts\logic\systemtipslayer_launcher.lua
- D:\996m2\gameclient54656\mod_launcher\stab\scripts\logic\nativebridgemanager_launcher.lua
- D:\996m2\gameclient54656\mod_launcher\stab\scripts\logic\module_launcher.lua
- D:\996m2\gameclient54656\mod_launcher\stab\scripts\logic\modulemanager_launcher.lua
- D:\996m2\gameclient54656\mod_launcher\stab\scripts\logic\modulechoosemanager_launcher.lua
- D:\996m2\gameclient54656\mod_launcher\stab\scripts\logic\modulechooselayer_launcher.lua
- D:\996m2\gameclient54656\mod_launcher\stab\scripts\logic\loadingmanager_launcher.lua
- D:\996m2\gameclient54656\mod_launcher\stab\res\public\bg_load_1.png
- D:\996m2\gameclient54656\mod_launcher\stab\scripts\logic\loadingbarlayer_launcher.lua
- D:\996m2\gameclient54656\mod_launcher\stab\res\public\1900001023.png
- D:\996m2\gameclient54656\mod_launcher\stab\res\private\loading\bg_loading_02.png
- D:\996m2\gameclient54656\mod_launcher\stab\mod_launcher_version.manifest
- D:\996m2\gameclient54656\mod_launcher\stab\mod_launcher_project.manifest
- D:\996m2\gameclient54656\mod_launcher\stab\fonts\font2.ttf
- D:\996m2\gameclient54656\mod_launcher\stab\fonts\font.ttf
- D:\996m2\gameclient54656\mod_launcher\stab\default\imagefile.png
- D:\996m2\gameclient54656\lua51.dll
- D:\996m2\gameclient54656\libvorbisfile.dll
- D:\996m2\gameclient54656\libvorbis.dll
- D:\996m2\gameclient54656\libtiff.dll
- D:\996m2\gameclient54656\libssl-1_1.dll
- D:\996m2\gameclient54656\libogg.dll
- D:\996m2\gameclient54656\libmpg123.dll
- D:\996m2\gameclient54656\libcurl.dll
- D:\996m2\gameclient54656\libcrypto-1_1.dll
- D:\996m2\gameclient54656\libcocos2d.dll
- D:\996m2\gameclient54656\iconv.dll
- D:\996m2\gameclient54656\glew32.dll
- D:\996m2\gameclient54656\openal32.dll
- D:\996m2\gameclient54656\npgamedll.dll
- D:\996m2\gameclient54656\gameguard.des
- D:\996m2\gameclient54656\996cn.ini
- D:\996m2\gameclient54656\mod_fgcq_np.zip
- %HOMEPATH%\desktop\ôæóî´«ææ.lnk
- %TEMP%\ôæóî´«ææ.txt
- D:\996m2\gameclient54656\ôæóî´«ææ.exe
- %TEMP%\tmp43d3.tmp
- %TEMP%\ôæóî´«ææ.ini
- %TEMP%\d7f24480edbf43f8ab5bf5412228ecb0.bat
- D:\996m2\<File name>.exe
- D:\996m2\gameclient54656\mod_launcher\stab\res\private\loading\bg_loading_01.jpg
- D:\996m2\gameclient54656\mod_launcher\stab\res\private\loading\bg_loading_03.png
- D:\996m2\gameclient54656\mod_launcher\stab\res\public\1900000600.png
- D:\996m2\gameclient54656\mod_launcher\stab\res\private\server\1900000550.png
- D:\996m2\gameclient54656\mod_launcher\stab\res\private\start_game\00.png
- D:\996m2\gameclient54656\mod_launcher\stab\res\private\server\tips_16.png
- D:\996m2\gameclient54656\mod_launcher\stab\res\private\server\open_door\00.png
- D:\996m2\gameclient54656\mod_launcher\stab\res\private\server\logo_1.png
- D:\996m2\gameclient54656\mod_launcher\stab\res\private\server\fuguchuanqi.apk_000873.png
- D:\996m2\gameclient54656\mod_launcher\stab\res\private\server\fuguchuanqi.apk_000872.png
- D:\996m2\gameclient54656\mod_launcher\stab\res\private\server\fuguchuanqi.apk_000871.png
- D:\996m2\gameclient54656\mod_launcher\stab\res\private\server\fuguchuanqi.apk_000870.png
- D:\996m2\gameclient54656\mod_launcher\stab\res\private\server\fuguchuanqi.apk_000858.png
- D:\996m2\gameclient54656\mod_launcher\stab\res\private\server\fuguchuanqi.apk_000857.png
- D:\996m2\gameclient54656\mod_launcher\stab\res\private\server\fuguchuanqi.apk_000853.png
- D:\996m2\gameclient54656\mod_launcher\stab\res\private\server\fuguchuanqi.apk_000850.png
- D:\996m2\gameclient54656\mod_launcher\stab\res\private\server\btn_jryx_03_1.png
- D:\996m2\gameclient54656\mod_launcher\stab\res\private\server\btn_jryx_03.png
- D:\996m2\gameclient54656\mod_launcher\stab\res\private\server\btn_jryx_02_1.png
- D:\996m2\gameclient54656\mod_launcher\stab\res\private\server\btn_jryx_02.png
- D:\996m2\gameclient54656\mod_launcher\stab\res\private\server\btn_jryx_01_1.png
- D:\996m2\gameclient54656\mod_launcher\stab\res\private\server\btn_jryx_01.png
- D:\996m2\gameclient54656\mod_launcher\stab\res\private\server\announce\word_hefubq_04.png
- D:\996m2\gameclient54656\mod_launcher\stab\res\private\server\announce\word_hefubq_03.png
- D:\996m2\gameclient54656\mod_launcher\stab\res\private\server\announce\word_hefubq_02.png
- D:\996m2\gameclient54656\mod_launcher\stab\res\private\server\announce\word_hefubq_01.png
- D:\996m2\gameclient54656\mod_launcher\stab\res\private\server\announce\bg_hefubq_01.jpg
- D:\996m2\gameclient54656\mod_launcher\stab\res\private\server\announce\1900000663.png
- D:\996m2\gameclient54656\mod_launcher\stab\res\private\server\announce\1900000662.png
- D:\996m2\gameclient54656\mod_launcher\stab\res\private\server\announce\1900000511.png
- D:\996m2\gameclient54656\mod_launcher\stab\res\private\server\announce\1900000510.png
- D:\996m2\gameclient54656\mod_launcher\stab\res\private\server\1900008055.png
- D:\996m2\gameclient54656\mod_launcher\stab\res\private\server\1900000551.png
- D:\996m2\gameclient54656\mod_launcher\stab\res\public\1900001022.png
- D:\996m2\gameclient54656\热血合击.exe
Deletes the following files
- %TEMP%\tmp222f.tmp
Moves the following files
- from D:\996m2\gameclient54656\996cn.ini to D:\996m2\gameclient54656\996cn.ini
- from D:\996m2\gameclient54656\websockets.dll to D:\996m2\gameclient54656\websockets.dll
- from D:\996m2\gameclient54656\vcruntime140.dll to D:\996m2\gameclient54656\vcruntime140.dll
- from D:\996m2\gameclient54656\vccorlib140.dll to D:\996m2\gameclient54656\vccorlib140.dll
- from D:\996m2\gameclient54656\sqlite3.dll to D:\996m2\gameclient54656\sqlite3.dll
- from D:\996m2\gameclient54656\openal32.dll to D:\996m2\gameclient54656\openal32.dll
- from D:\996m2\gameclient54656\npgamedll.dll to D:\996m2\gameclient54656\npgamedll.dll
- from D:\996m2\gameclient54656\msvcr120.dll to D:\996m2\gameclient54656\msvcr120.dll
- from D:\996m2\gameclient54656\msvcr110.dll to D:\996m2\gameclient54656\msvcr110.dll
- from D:\996m2\gameclient54656\msvcr100.dll to D:\996m2\gameclient54656\msvcr100.dll
- from D:\996m2\gameclient54656\msvcp140.dll to D:\996m2\gameclient54656\msvcp140.dll
- from D:\996m2\gameclient54656\msvcp120.dll to D:\996m2\gameclient54656\msvcp120.dll
- from D:\996m2\gameclient54656\msvcp110.dll to D:\996m2\gameclient54656\msvcp110.dll
- from D:\996m2\gameclient54656\msvcp100.dll to D:\996m2\gameclient54656\msvcp100.dll
- from D:\996m2\gameclient54656\mod_fgcq_np.zip to D:\996m2\gameclient54656\mod_fgcq_np.zip
- from D:\996m2\gameclient54656\lua51.dll to D:\996m2\gameclient54656\lua51.dll
- from D:\996m2\gameclient54656\libvorbisfile.dll to D:\996m2\gameclient54656\libvorbisfile.dll
- from D:\996m2\gameclient54656\libvorbis.dll to D:\996m2\gameclient54656\libvorbis.dll
- from D:\996m2\gameclient54656\libtiff.dll to D:\996m2\gameclient54656\libtiff.dll
- from D:\996m2\gameclient54656\libssl-1_1.dll to D:\996m2\gameclient54656\libssl-1_1.dll
- from D:\996m2\gameclient54656\libogg.dll to D:\996m2\gameclient54656\libogg.dll
- from D:\996m2\gameclient54656\libmpg123.dll to D:\996m2\gameclient54656\libmpg123.dll
- from D:\996m2\gameclient54656\libcurl.dll to D:\996m2\gameclient54656\libcurl.dll
- from D:\996m2\gameclient54656\libcrypto-1_1.dll to D:\996m2\gameclient54656\libcrypto-1_1.dll
- from D:\996m2\gameclient54656\libcocos2d.dll to D:\996m2\gameclient54656\libcocos2d.dll
- from D:\996m2\gameclient54656\iconv.dll to D:\996m2\gameclient54656\iconv.dll
- from D:\996m2\gameclient54656\glew32.dll to D:\996m2\gameclient54656\glew32.dll
- from D:\996m2\gameclient54656\gameguard.des to D:\996m2\gameclient54656\gameguard.des
- from D:\996m2\gameclient54656\zlib1.dll to D:\996m2\gameclient54656\zlib1.dll
- from D:\996m2\gameclient54656\热血合击.exe to D:\996m2\gameclient54656\????.exe
Deletes itself.
Network activity
Connects to
- 'li######.dhsf.xqhuyu.com':80
- 'gs#.#rawjy.com':80
- 'gs#.#fljy.com':80
- 'st####.dhsf.xqhuyu.com':80
TCP
HTTP GET requests
- http://li######.dhsf.xqhuyu.com/modlist/modlist_54656.txt?ti################################################################
- http://gs#.#rawjy.com/gsl/init/modlist/modlist_54656.txt?ti###################################################################################################################################
- http://gs#.#fljy.com/gsl/main/modlist/modlist_54656.txt?ti###################################################
- http://gs#.#fljy.com/gsl/main/serverlist/54656/serverlist.txt?ti###################################################
- http://st####.dhsf.xqhuyu.com/game_mubao/20220126/mod_fgcq_version.txt
- http://st####.dhsf.xqhuyu.com/game_mubao/20220126/mod_fgcq_np.zip?v=##############
UDP
- DNS ASK li######.dhsf.xqhuyu.com
- DNS ASK gs#.#rawjy.com
- DNS ASK gs#.#fljy.com
- DNS ASK st####.dhsf.xqhuyu.com
Miscellaneous
Creates and executes the following
- 'D:\996m2\<File name>.exe'
- '%WINDIR%\syswow64\cmd.exe' /c %TEMP%\D7F24480EDBF43F8AB5BF5412228ECB0.bat' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c %TEMP%\D7F24480EDBF43F8AB5BF5412228ECB0.bat
