Technical Information
- <SYSTEM32>\msiexec.exe /V
- <SYSTEM32>\msiexec.exe -Embedding 1B24FCC7B7E9A456515124B2270EC92C
- <SYSTEM32>\msiexec.exe /i ""<LS_APPDATA>\hta.txt"" /quiet
- <SYSTEM32>\mshta.exe vbscript:createobject("wscript.shell").run("""iexplore""http://cn##.sjt8.com/info.access/?st#########",0)(window.close)
- %PROGRAM_FILES%\Internet Explorer\IEXPLORE.EXE http://cn##.sjt8.com/info.access/?st#########
- <LS_APPDATA>\sta.txt
- <LS_APPDATA>\Client.ini
- <LS_APPDATA>\hta.txt
- %WINDIR%\Installer\MSI2.tmp
- %WINDIR%\Installer\2389a.msi
- <LS_APPDATA>\kInstall.exe
- %TEMP%\~1.bat
- <LS_APPDATA>\sqlite3.txt
- <LS_APPDATA>\yClient.ini
- <LS_APPDATA>\dClient.ini
- %TEMP%\~1.bat
- 'cn##.sjt8.com':80
- 'localhost':1037
- cn##.sjt8.com/info.access/?st#########
- DNS ASK cn##.sjt8.com
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: '' WindowName: ''
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebcheckMonitor' WindowName: ''