Technical Information
- %WINDIR%\Uti999g.exe
- %WINDIR%\addins\2.exe
- <SYSTEM32>\cmd.exe /c %WINDIR%\Uer.bat
- %WINDIR%\Uer.bat
- %WINDIR%\Uti999g.exe
- %WINDIR%\addins\2.exe
- %WINDIR%\addins\2.exe
- 'http://di####oxiangzi.net/ip.txt':8000
- DNS ASK http://di####oxiangzi.net/ip.txt
- '<Private IP address>':1035
- ClassName: 'Shell_TrayWnd' WindowName: ''