Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'PalmInputStartUp' = '"%ProgramFiles(x86)%\PalmInput\3.1.0.1010\PalmInputStartUp.exe"'
Modifies file system
Creates the following files
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\desktop.ini
- %ProgramFiles(x86)%\palminput\extensions\popwndblocker\1.0.0.1001\360util.dll
- %ProgramFiles(x86)%\palminput\extensions\popwndblocker\1.0.0.1001\360netbase.dll
- %ProgramFiles(x86)%\palminput\extensions\popwndblocker\1.0.0.1001\360conf.dll
- %ProgramFiles(x86)%\palminput\extensions\popwndblocker\1.0.0.1001\360common.dll
- %ProgramFiles(x86)%\palminput\extensions\popwndblocker\1.0.0.1001\360base.dll
- %ProgramFiles(x86)%\palminput\extensions\popwndblocker.palminput.extension.ini
- %ProgramFiles(x86)%\palminput\extensions\kittip\3.0.0.2241\kittip.dll
- %ProgramFiles(x86)%\palminput\extensions\snap\1.0.0.1\palminputsnap.exe
- %LOCALAPPDATA%low\palminput\extensions\palminput-extensions-install.ini
- %ProgramFiles(x86)%\palminput\extensions\guard\2.6.0.49\palminputguard.exe
- %ProgramFiles(x86)%\palminput\3.1.0.1010\spmode\203.ini
- %ProgramFiles(x86)%\palminput\3.1.0.1010\spmode\202.ini
- %ProgramFiles(x86)%\palminput\3.1.0.1010\spmode\201.ini
- %ProgramFiles(x86)%\palminput\3.1.0.1010\skin\fe7b5ab10c0c499f9512c9087bc93be9.piskn
- %ProgramFiles(x86)%\palminput\3.1.0.1010\skin\df5e85c046344a13855ee366c3340a49.piskn
- %ProgramFiles(x86)%\palminput\3.1.0.1010\skin\ca8da17be7544d29a161167fb119448c.piskn
- %ProgramFiles(x86)%\palminput\3.1.0.1010\skin\90122bf90de043bcaab94c657da11e0a.piskn
- %ProgramFiles(x86)%\palminput\3.1.0.1010\skin\63728f13cf6f41d5a5985c733a12cf28.piskn
- %ProgramFiles(x86)%\palminput\3.1.0.1010\skin\55dd4aeb874449b2b9e02f5b0c23f860.piskn
- %ProgramFiles(x86)%\palminput\3.1.0.1010\skin\3a33e23bfe464d58a1cae02ee87b92d7.piskn
- %ProgramFiles(x86)%\palminput\3.1.0.1010\skin\2fb9a56416f8459d9c24d20bfa340d9a.piskn
- %ProgramFiles(x86)%\palminput\3.1.0.1010\skin\1c4c578570e8473dada4631141964125.piskn
- %ProgramFiles(x86)%\palminput\3.1.0.1010\skin\26409521a2ac4be8a3464d757e2d337a.piskn
- %ProgramFiles(x86)%\palminput\extensions\popwndblocker\1.0.0.1001\config\newui\themes\default\admgr\pwlog_theme.ui
- %ProgramFiles(x86)%\palminput\extensions\popwndblocker\1.0.0.1001\config\newui\themes\default\popwndtracker\newui\360pw_theme.ui
- %LOCALAPPDATA%low\palminput\dict\palminput-fixedtop-v3.1.0.1010.pidic
- %LOCALAPPDATA%low\palminput\dict\palminput-mail-v3.1.0.1010.pidic
- %LOCALAPPDATA%low\palminput\dict\palminput-website-v3.1.0.1010.pidic
- %LOCALAPPDATA%low\palminput\dict\palminput-specphrase-v3.1.0.1010.pidic
- %LOCALAPPDATA%low\palminput\dict\palminput-pyuser-v3.1.0.1010.pidic
- %LOCALAPPDATA%low\palminput\skin\palminput-skin-list.xml
- %LOCALAPPDATA%low\palminput\dict\cate\cate-c931f0345b6843269d0dc347a8a59aee-v2899.pidic
- %LOCALAPPDATA%low\palminput\dict\cate\palminput-cate-list.xml
- %ProgramFiles(x86)%\palminput\extensions\popwndblocker\1.0.0.1001\siteuiproxy.dll
- %ProgramFiles(x86)%\palminput\extensions\popwndblocker\1.0.0.1001\sites.dll
- %ProgramFiles(x86)%\palminput\extensions\popwndblocker\1.0.0.1001\safemon\sdplugin\popwndinit.dat
- %ProgramFiles(x86)%\palminput\3.1.0.1010\dict\haninfo.pidic
- %ProgramFiles(x86)%\palminput\extensions\popwndblocker\1.0.0.1001\safemon\sdplugin\popwndconfig.dat
- %ProgramFiles(x86)%\palminput\extensions\popwndblocker\1.0.0.1001\safemon\sdplugin\mpopwndconfig.dat
- %ProgramFiles(x86)%\palminput\extensions\popwndblocker\1.0.0.1001\safemon\sdplugin\adpopwnd.dll
- %ProgramFiles(x86)%\palminput\extensions\popwndblocker\1.0.0.1001\safemon\popwndtracker.exe
- %ProgramFiles(x86)%\palminput\extensions\popwndblocker\1.0.0.1001\safemon\popwndlog.exe
- %ProgramFiles(x86)%\palminput\extensions\popwndblocker\1.0.0.1001\safemon\adpopblocker.tpi
- %ProgramFiles(x86)%\palminput\extensions\popwndblocker\1.0.0.1001\dumpuper.exe
- %ProgramFiles(x86)%\palminput\extensions\popwndblocker\1.0.0.1001\deepscan\heavygate.dll
- %ProgramFiles(x86)%\palminput\extensions\popwndblocker\1.0.0.1001\deepscan\cloudcom2.dll
- %ProgramFiles(x86)%\palminput\extensions\popwndblocker\1.0.0.1001\crashreport.dll
- %ProgramFiles(x86)%\palminput\3.1.0.1010\skin\1a940de1af7b4991b16d9d40ec8336bb.piskn
- %ProgramFiles(x86)%\palminput\3.1.0.1010\dict\dicdiff.pidic
- %ProgramFiles(x86)%\palminput\3.1.0.1010\dict\website.pidic
- %WINDIR%\syswow64\palminputime.ime
- %WINDIR%\syswow64\palminputtsf.dll
- <SYSTEM32>\palminputime.ime
- <SYSTEM32>\palminputtsf.dll
- %LOCALAPPDATA%low\palminput\config\palminput-config.ini
- %LOCALAPPDATA%\heuactivation\marketsetup_323601.exe
- %LOCALAPPDATA%\kmsactivation\list.txt
- %LOCALAPPDATA%\heuactivation\9fqfy.tmp
- %LOCALAPPDATA%\heuactivation\wmj4rtg7n46uzt22iy.tmp
- %TEMP%\622c.tmp
- %LOCALAPPDATA%\microsoft\windows\history\low\history.ie5\index.dat
- %APPDATA%\microsoft\windows\cookies\low\index.dat
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\3lgt996f\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\qgzlqycr\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\snhijt5d\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\10wi2f2v\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\index.dat
- %LOCALAPPDATA%\microsoft\windows\history\low\history.ie5\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\history\low\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\desktop.ini
- %ProgramFiles(x86)%\palminput\3.1.0.1010\360netbase.dll
- %ProgramFiles(x86)%\palminput\3.1.0.1010\360util.dll
- %ProgramFiles(x86)%\palminput\3.1.0.1010\360base.dll
- %ProgramFiles(x86)%\palminput\3.1.0.1010\palminputbootup.exe
- %ProgramFiles(x86)%\palminput\3.1.0.1010\dict\specphrase.pidic
- %ProgramFiles(x86)%\palminput\3.1.0.1010\palminputconfig.exe
- %ProgramFiles(x86)%\palminput\3.1.0.1010\dict\specdefault.pidic
- %ProgramFiles(x86)%\palminput\3.1.0.1010\dict\spassist.pidic
- %ProgramFiles(x86)%\palminput\3.1.0.1010\dict\pyuser.pidic
- %ProgramFiles(x86)%\palminput\3.1.0.1010\dict\pyname.pidic
- %ProgramFiles(x86)%\palminput\3.1.0.1010\dict\pygram.pidic
- %ProgramFiles(x86)%\palminput\3.1.0.1010\dict\pyfuzzy.pidic
- %ProgramFiles(x86)%\palminput\3.1.0.1010\dict\pycore.pidic
- %ProgramFiles(x86)%\palminput\3.1.0.1010\dict\pychaizi.pidic
- %ProgramFiles(x86)%\palminput\3.1.0.1010\dict\pybase.pidic
- %ProgramFiles(x86)%\palminput\extensions\popwndblocker\1.0.0.1001\safemon\sdplugin\popwndtracker.dat
- %LOCALAPPDATA%low\palminput\dict\palminput-pyfuzzy-v3.1.0.1010.pidic
- %ProgramFiles(x86)%\palminput\3.1.0.1010\dict\fixedtop.pidic
- %ProgramFiles(x86)%\palminput\3.1.0.1010\palminputskinfile.ico
- %ProgramFiles(x86)%\palminput\3.1.0.1010\palminput.ico
- %ProgramFiles(x86)%\palminput\3.1.0.1010\uninst.exe
- %ProgramFiles(x86)%\palminput\3.1.0.1010\palminputwizard.exe
- %ProgramFiles(x86)%\palminput\3.1.0.1010\palminputsymbol.exe
- %ProgramFiles(x86)%\palminput\3.1.0.1010\palminputstartup.exe
- %ProgramFiles(x86)%\palminput\3.1.0.1010\palminputskin.exe
- %ProgramFiles(x86)%\palminput\3.1.0.1010\palminputservice.exe
- %ProgramFiles(x86)%\palminput\3.1.0.1010\palminputrepair.exe
- %ProgramFiles(x86)%\palminput\3.1.0.1010\dict\mail.pidic
- %LOCALAPPDATA%low\palminput\skin\palminput-skin-default.ini
Sets the 'hidden' attribute to the following files
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\10wi2f2v\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\snhijt5d\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\qgzlqycr\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\3lgt996f\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\history\low\history.ie5\desktop.ini
- %LOCALAPPDATA%\heuactivation\wmj4rtg7n46uzt22iy.tmp
- %LOCALAPPDATA%\microsoft\windows\history\low\desktop.ini
- %LOCALAPPDATA%\heuactivation\9fqfy.tmp
- %LOCALAPPDATA%\kmsactivation\list.txt
Deletes the following files
- %TEMP%\622c.tmp
- %LOCALAPPDATA%\heuactivation\9fqfy.tmp
- %ProgramFiles(x86)%\palminput\extensions\popwndblocker.palminput.extension.ini
- %LOCALAPPDATA%low\palminput\dict\cate\palminput-cate-list.xml
Network activity
Connects to
- 'qf###.tyd28.com':80
- 'js.##ers.51.la':80
- 'ia.#1.la':80
- 'pv.#ohu.com':80
- 'dl.##0safe.com':443
- 'oc##.#tartssl.com':80
- 'oc##.thawte.com':80
- 's.##0.cn':80
TCP
HTTP GET requests
- http://qf###.tyd28.com/0406jh/info_online_mh.txt
- http://xz###.ha123a.com/xiazai/0406jh/qflc.html
- http://js.##ers.51.la/21295571.js
- http://ia.#1.la/go1?id###########################################################################################################################################################################...
- http://pv.#ohu.com/cityjson
- http://oc##.#tartssl.com/sub/class2/code/ca/MEMwQTA%2FMD0wOzAJBgUrDgMCGgUABBQSOgrhRCSnWfKxoWTjWxhk8hga9AQU0E4PQJlsuEsZbzsouODjiAc0qrcCAhAV
- http://oc##.thawte.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQwF4prw9S7mCbCEHD%2Fyl6nWPkczAQUe1tFz6%2FOy3r9MZIaarbzRutXSFACEEeXTXhzpbyrDS%2BzcBkvzl4%3D
Other
- 'dl.##0safe.com':443
UDP
- DNS ASK ti####w.nist.gov
- DNS ASK ti###a.nist.gov
- DNS ASK xz###.ha123a.com
- DNS ASK qf###.tyd28.com
- DNS ASK js.##ers.51.la
- DNS ASK ia.#1.la
- DNS ASK pv.#ohu.com
- DNS ASK dl.##0safe.com
- DNS ASK st####.rapidssl.com
- DNS ASK public-trust.com
- DNS ASK oc##.#tartssl.com
- DNS ASK oc##.thawte.com
- DNS ASK s.##0.cn
- 'ti####w.nist.gov':123
- 'ti###a.nist.gov':123
Miscellaneous
Searches for the following windows
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebCheckMonitor' WindowName: ''
Creates and executes the following
- '%LOCALAPPDATA%\heuactivation\marketsetup_323601.exe' /S /C 323601
- '%ProgramFiles(x86)%\palminput\3.1.0.1010\palminputstartup.exe'
- '%ProgramFiles(x86)%\palminput\extensions\guard\2.6.0.49\palminputguard.exe'
- '%ProgramFiles(x86)%\palminput\3.1.0.1010\palminputservice.exe'
- '%ProgramFiles(x86)%\palminput\3.1.0.1010\palminputservice.exe' -extension_host
- '%ProgramFiles(x86)%\palminput\3.1.0.1010\palminputservice.exe' -repair
- '%WINDIR%\syswow64\cmd.exe' /c Start "" /w "%LOCALAPPDATA%\HEUactivation\MarketSetup_323601.exe" /S /C 323601' (with hidden window)
- '%ProgramFiles(x86)%\palminput\3.1.0.1010\palminputstartup.exe' ' (with hidden window)
- '%ProgramFiles(x86)%\palminput\3.1.0.1010\palminputservice.exe' -extension_host' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\rundll32.exe' "%WINDIR%\syswow64\WININET.dll",DispatchAPICall 1
- '%WINDIR%\syswow64\cmd.exe' /c Start "" /w "%LOCALAPPDATA%\HEUactivation\MarketSetup_323601.exe" /S /C 323601
- '<SYSTEM32>\taskeng.exe' {534EBD7F-E580-4F95-8282-46DD8BA6C696} S-1-5-21-1960123792-2022915161-3775307078-1001:pebxpodk\user:Interactive:[1]
