Technical Information
- <SYSTEM32>\ping.exe 127.1 -n 3
- <SYSTEM32>\cmd.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\sj[1].asp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\cfwg2[1].htm
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\338mu[1]
- C:\fw.bat
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\vpn[1].htm
- %TEMP%\ava071.ime
- <Current directory>\FindPic.dll
- <SYSTEM32>\ava071.ime
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\cfwg1[1].htm
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\cfwg[1].htm
- <SYSTEM32>\cmd.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\sj[1].asp
- 'localhost':1041
- '21#.#3.161.144':9999
- 'sf.##xixz.com':80
- 'localhost':1036
- '33##u.com':80
- sf.##xixz.com/3/sj.asp
- 33##u.com/
- 33##u.com/cf/vpn.htm
- 33##u.com/cf/cfwg.htm
- 33##u.com/cf/cfwg1.htm
- 33##u.com/cf/cfwg2.htm
- DNS ASK sf.##xixz.com
- DNS ASK 33##u.com
- ClassName: 'MS_WebcheckMonitor' WindowName: ''
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''