Technical Information
- %WINDIR%\wxehbf.dll
- %WINDIR%\natvarol.dll
- %PROGRAM_FILES%\Internet Explorer\iexplore.exe
- %APPDATA%\YnJrFVS\CshXTPRNDFBDzpehcYUKMILG
- <Current directory>\EAdfixGPfUQSV\Kzpeac
- %WINDIR%\koshrh.dll
- <Current directory>\EAdfixGPfUQSV\Kzpeac.tmp
- %APPDATA%\YnJrFVS\CshXTPRNDFBDzpehcYUKMILG.tmp
- from %PROGRAM_FILES%\Internet Explorer\iexplore.exe.new to %PROGRAM_FILES%\Internet Explorer\iexplore.exe
- from <Current directory>\EAdfixGPfUQSV\Kzpeac to <Current directory>\EAdfixGPfUQSV\Kzpeac.tmp
- from %APPDATA%\YnJrFVS\CshXTPRNDFBDzpehcYUKMILG to %APPDATA%\YnJrFVS\CshXTPRNDFBDzpehcYUKMILG.tmp
- 've#.#1tyx.cn':443
- 've#.#1tyx.cn':80
- 've#.#1tyx.cn':8181
- 'www.16#.com':80
- 'pi#.#f120.com':8100
- 'pp.##push.cn':8383
- www.16#.com/404.html
- DNS ASK ud#.#1tyx.cn
- DNS ASK ve#.#1tyx.cn
- DNS ASK pp.##push.cn
- DNS ASK www.16#.com
- DNS ASK pi#.#f120.com
- ClassName: 'SysListView32' WindowName: '(null)'
- ClassName: 'SHELLDLL_DefView' WindowName: '(null)'
- ClassName: 'Progman' WindowName: '(null)'