Technical Information
- [<HKLM>\SYSTEM\ControlSet001\Services\prvdisk] 'Start' = '00000001'
- [<HKLM>\SYSTEM\ControlSet001\Services\ianoSvrup] 'Start' = '00000002'
- [<HKLM>\SYSTEM\ControlSet001\Services\PolicyAgent] 'Start' = '00000002'
- %TEMP%\nsc2.tmp\nsC.tmp tdohfowp.exe -p Pass1 -r Pass1 -f 125.39.100.74+0 -n PASS -x
- %TEMP%\nsu7.tmp\nsB.tmp sc create prvdisk binpath= <SYSTEM32>\PrvMon\prvdisk.sys type= kernel start= system group= Base tag= yes
- %CommonProgramFiles%\Intel\ianotife.exe
- %TEMP%\nsc2.tmp\nsD.tmp tdohfowp.exe -p Pass2 -r Pass2 -f 220.181.126.15+0 -n PASS -x
- %TEMP%\~nsu.tmp\Au_.exe _?=%PROGRAM_FILES%\ahjlgtbx\
- %PROGRAM_FILES%\ahjlgtbx\un0519223201511.exe
- %TEMP%\nsc2.tmp\nsE.tmp tdohfowp.exe -p Pass3 -r Pass3 -f 220.181.126.7+0 -n PASS -x
- %TEMP%\nsu7.tmp\nsA.tmp sc start ianoSvrup
- %PROGRAM_FILES%\ahjlgtbx\tdohfowp.exe -p Pass2 -r Pass2 -f 220.181.126.15+0 -n PASS -x -p Pass3 -r Pass3 -f 220.181.126.7+0 -n PASS -x -file 5ah7rv6.txt -p Pass1 -r Pass1 -f 125.39.100.74+0 -n PASS -x
- %TEMP%\nsc2.tmp\ns4.tmp "tdohfowp.exe" -file 5ah7rv6.txt
- %TEMP%\nsc2.tmp\ns3.tmp sc start PolicyAgent
- %TEMP%\nsc2.tmp\ns5.tmp sc config PolicyAgent start= auto
- %TEMP%\nsu7.tmp\ns9.tmp sc description ianoSvrup "К№УГIanno Web CahceјјКхМṩЅшРР»ҐБЄНшдЇААФ¤¶БјУЛЩ·юОсЎЈИз№ыНЈЦ№ёГ·юОсЈ¬ФтјЖЛг»ъЅ«І»ѕЯ±ёХвР©јјКхМṩµДјУЛЩ№¦ДЬЎЈ"
- %TEMP%\nsu7.tmp\ns8.tmp sc create ianoSvrup binpath= "%CommonProgramFiles%\Intel\ianotife.exe" type= share start= auto displayname= "Ianno Web Cache Services"
- %PROGRAM_FILES%\ahjlgtbx\mysetup.exe
- <SYSTEM32>\sc.exe start ianoSvrup
- <SYSTEM32>\sc.exe create prvdisk binpath= <SYSTEM32>\PrvMon\prvdisk.sys type= kernel start= system group= Base tag= yes
- <SYSTEM32>\wscript.exe "%CommonProgramFiles%\Intel\note.vbs"
- <SYSTEM32>\sc.exe description ianoSvrup "К№УГIanno Web CahceјјКхМṩЅшРР»ҐБЄНшдЇААФ¤¶БјУЛЩ·юОсЎЈИз№ыНЈЦ№ёГ·юОсЈ¬ФтјЖЛг»ъЅ«І»ѕЯ±ёХвР©јјКхМṩµДјУЛЩ№¦ДЬЎЈ"
- <SYSTEM32>\sc.exe start PolicyAgent
- <SYSTEM32>\sc.exe config PolicyAgent start= auto
- <SYSTEM32>\sc.exe create ianoSvrup binpath= "%CommonProgramFiles%\Intel\ianotife.exe" type= share start= auto displayname= "Ianno Web Cache Services"
- %TEMP%\nsu7.tmp\System.dll
- %TEMP%\nsu7.tmp\AccessControl.dll
- %TEMP%\nsu7.tmp\nsExec.dll
- %TEMP%\nsu7.tmp\ns9.tmp
- %TEMP%\nsu7.tmp\ns8.tmp
- %CommonProgramFiles%\Intel\config-n.xml
- %CommonProgramFiles%\Intel\ianotife.exe
- %CommonProgramFiles%\Intel\vison.txt
- %CommonProgramFiles%\Intel\suject.db
- %CommonProgramFiles%\Intel\config-s.xml
- %CommonProgramFiles%\Intel\prvdisk.sys
- %TEMP%\nsu7.tmp\nsA.tmp
- %TEMP%\nsc2.tmp\nsD.tmp
- %TEMP%\nsc2.tmp\nsC.tmp
- %TEMP%\nsc2.tmp\nsE.tmp
- %CommonProgramFiles%\Intel\suject.db-journal
- %TEMP%\~nsu.tmp\Au_.exe
- C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\CJCTQ25G\ol[1].asp
- %WINDIR%\tudouva.pac
- %CommonProgramFiles%\Intel\pro.txt
- <SYSTEM32>\PrvMon\prvdisk.sys
- %CommonProgramFiles%\Intel\note.vbs
- %TEMP%\nsu7.tmp\nsB.tmp
- %CommonProgramFiles%\Intel\note.txt
- %TEMP%\nsc2.tmp\nsRandom.dll
- %PROGRAM_FILES%\ahjlgtbx\un0519223201511.exe
- %TEMP%\nsc2.tmp\InetLoad.dll
- %TEMP%\nsc2.tmp\nsplugin.dll
- %TEMP%\nsc2.tmp\Internet.dll
- %PROGRAM_FILES%\ahjlgtbx\temp0519223201511.ini
- %PROGRAM_FILES%\ahjlgtbx\s0001.xml
- %PROGRAM_FILES%\ahjlgtbx\menu.xml
- %PROGRAM_FILES%\ahjlgtbx\reginfo.xml
- %TEMP%\nsc2.tmp\System.dll
- %PROGRAM_FILES%\ahjlgtbx\ser000.xml
- <Current directory>\op.ini
- %TEMP%\nsc2.tmp\ns5.tmp
- %PROGRAM_FILES%\ahjlgtbx\info.reg
- %PROGRAM_FILES%\ahjlgtbx\mysetup.exe
- %CommonProgramFiles%\Intel\ypac.txt
- %CommonProgramFiles%\Intel\sqlite3.dll
- %TEMP%\nsc2.tmp\ns4.tmp
- <Current directory>\tx.ini
- %PROGRAM_FILES%\ahjlgtbx\tdohfowp.exe
- %PROGRAM_FILES%\ahjlgtbx\5ah7rv6.txt
- %TEMP%\nsc2.tmp\ns3.tmp
- %TEMP%\nsc2.tmp\nsExec.dll
- <Current directory>\op.ini
- <Current directory>\tx.ini
- %TEMP%\nsc2.tmp\Internet.dll
- %TEMP%\nsc2.tmp\InetLoad.dll
- %TEMP%\nsc2.tmp\nsD.tmp
- %TEMP%\nsc2.tmp\nsC.tmp
- %PROGRAM_FILES%\ahjlgtbx\tdohfowp.exe
- %TEMP%\nsc2.tmp\nsE.tmp
- %TEMP%\nsc2.tmp\nsExec.dll
- %PROGRAM_FILES%\ahjlgtbx\temp0519223201511.ini
- %PROGRAM_FILES%\ahjlgtbx\un0519223201511.exe
- %CommonProgramFiles%\Intel\suject.db-journal
- %PROGRAM_FILES%\ahjlgtbx\5ah7rv6.txt
- %TEMP%\nsc2.tmp\nsRandom.dll
- %TEMP%\nsc2.tmp\nsplugin.dll
- %CommonProgramFiles%\Intel\note.vbs
- %TEMP%\nsc2.tmp\System.dll
- %TEMP%\nsu7.tmp\nsA.tmp
- %TEMP%\nsu7.tmp\ns9.tmp
- %CommonProgramFiles%\Intel\prvdisk.sys
- %TEMP%\nsu7.tmp\nsB.tmp
- %TEMP%\nsc2.tmp\ns4.tmp
- %TEMP%\nsc2.tmp\ns3.tmp
- %TEMP%\nsu7.tmp\ns8.tmp
- %TEMP%\nsc2.tmp\ns5.tmp
- %TEMP%\nsu7.tmp\AccessControl.dll
- %PROGRAM_FILES%\ahjlgtbx\menu.xml
- %PROGRAM_FILES%\ahjlgtbx\s0001.xml
- %PROGRAM_FILES%\ahjlgtbx\info.reg
- %PROGRAM_FILES%\ahjlgtbx\reginfo.xml
- %TEMP%\nsu7.tmp\System.dll
- %TEMP%\nsu7.tmp\nsExec.dll
- %PROGRAM_FILES%\ahjlgtbx\ser000.xml
- %PROGRAM_FILES%\ahjlgtbx\mysetup.exe
- 'localhost':1041
- 'tj.###mitogu.com':80
- 'm.###nong.com':888
- 'tj.##nzhuan.co':80
- tj.###mitogu.com/ps.txt
- tj.###mitogu.com/wl.txt
- tj.##nzhuan.co/svr.asp?c=########################################
- tj.###mitogu.com/ol.asp?c=###########################
- DNS ASK tj.##nzhuan.co
- DNS ASK tj.###mitogu.com
- DNS ASK m.###nong.com
- '<Private IP address>':1037
- ClassName: 'Shell_TrayWnd' WindowName: ''