Technical Information
- <Full path to virus>
- <Current directory>\SkinH_EL.dll
- <Current directory>\RCX2.tmp
- <SYSTEM32>\Past8w9fK.sys
- <Full path to virus>{F565C34C-F25D-4aeb-A929-D7F9138F8743}
- <Current directory>\SkinH_EL.dll
- <Full path to virus>{F565C34C-F25D-4aeb-A929-D7F9138F8743}
- <SYSTEM32>\Past8w9fK.sys
- from <Current directory>\RCX2.tmp to <Full path to virus>{F565C34C-F25D-4aeb-A929-D7F9138F8743}
- from <Full path to virus> to %TEMP%\_@1.tmp
- '12#.#25.114.144':80
- http://hi.##idu.com/lxbjcazicwagloe/item/f508f3cf429b986147d5c00b via 12#.#25.114.144
- http://hi.##idu.com/sqresxyrqmbmsyd/item/ee43b39708e3d7bf5814618b via 12#.#25.114.144
- http://hi.##idu.com/sqresxyrqmbmsyd/item/d373243d27651cf71b96960c via 12#.#25.114.144
- DNS ASK hi.##idu.com
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: '' WindowName: 'YyFangYu.exe'
- ClassName: '' WindowName: 'yybox.exe'