Technical Information
- [<HKLM>\SYSTEM\ControlSet001\Services\bandac] 'ImagePath' = '%APPDATA%\119015\bandac.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\bandac] 'Start' = '00000002'
- '<SYSTEM32>\net.exe' start bandac
- '%APPDATA%\119015\bandac.exe' -i
- '<SYSTEM32>\net1.exe' start bandac
- '%APPDATA%\119015\RIBridage.exe' BootDoThings
- '%APPDATA%\119015\bandac.exe'
- '<SYSTEM32>\regsvr32.exe' /s "%APPDATA%\119015\RLDataView.dll"
- '%TEMP%\is-73D79.tmp\<File name>.tmp' /SL5="$30092,1093130,56832,<Full path to file>"
- '<SYSTEM32>\regsvr32.exe' /s "%APPDATA%\119015\RLDataView64.dll"
- '%APPDATA%\119015\bandac.exe' -u
- '%APPDATA%\119015\awde.exe' <Full path to file>
- %APPDATA%\119015\resource\is-UGKE3.tmp
- %APPDATA%\119015\resource\is-J6A43.tmp
- %APPDATA%\119015\resource\is-RQGTO.tmp
- %APPDATA%\119015\resource\is-EGUAU.tmp
- %APPDATA%\119015\resource\is-06HP4.tmp
- %APPDATA%\119015\resource\is-0LP6A.tmp
- %APPDATA%\119015\resource\is-3L2HF.tmp
- %APPDATA%\119015\resource\is-2I0GH.tmp
- %APPDATA%\119015\resource\is-8MAR5.tmp
- %APPDATA%\119015\extensions\int2\ccikkllbpgbmnpajbjkjipmopnhfonnp\4.0.2_0\_locales\zh_CN\is-IB0RK.tmp
- %APPDATA%\119015\extensions\int2\ccikkllbpgbmnpajbjkjipmopnhfonnp\4.0.2_0\_metadata\is-O39JJ.tmp
- %APPDATA%\119015\extensions\int2\ccikkllbpgbmnpajbjkjipmopnhfonnp\4.0.2_0\res\is-V4LI2.tmp
- %APPDATA%\119015\extensions\int2\ccikkllbpgbmnpajbjkjipmopnhfonnp\4.0.2_0\_locales\en\is-475I9.tmp
- %APPDATA%\119015\resource\is-PF217.tmp
- %APPDATA%\119015\resource\is-NN0UG.tmp
- %APPDATA%\119015\extensions\int2\ccikkllbpgbmnpajbjkjipmopnhfonnp\4.0.2_0\_metadata\is-E6UPN.tmp
- %APPDATA%\119015\resource\is-N2VVJ.tmp
- %APPDATA%\119015\resource\is-NMRJH.tmp
- %APPDATA%\119015\resource\DirectUI\is-K02J4.tmp
- %APPDATA%\119015\xmlconfig\is-0M24S.tmp
- %APPDATA%\119015\resource\DirectUI\is-OR0EF.tmp
- %APPDATA%\119015\resource\DirectUI\is-PCUI1.tmp
- %APPDATA%\119015\is-GKBM0.tmp
- %ALLUSERSPROFILE%\Desktop\јтФјИХАъ.lnk
- %APPDATA%\119015\xmlconfig\is-280QQ.tmp
- %APPDATA%\119015\is-6R6QQ.tmp
- %APPDATA%\119015\resource\DirectUI\is-EJCI7.tmp
- %APPDATA%\119015\resource\is-ERENH.tmp
- %APPDATA%\119015\resource\is-KV5GL.tmp
- %APPDATA%\119015\resource\is-EO2DP.tmp
- %APPDATA%\119015\resource\is-C9IAC.tmp
- %APPDATA%\119015\resource\is-D39HH.tmp
- %APPDATA%\119015\resource\is-SRI9J.tmp
- %APPDATA%\119015\resource\is-64B2E.tmp
- %APPDATA%\119015\resource\is-4NH0I.tmp
- %APPDATA%\119015\is-MEGN5.tmp
- %APPDATA%\119015\extensions\is-2JMHP.tmp
- %APPDATA%\119015\is-T4E5H.tmp
- %APPDATA%\119015\is-VKFS3.tmp
- %APPDATA%\119015\extensions\is-Q1V50.tmp
- %APPDATA%\119015\extensions\chrome\ccikkllbpgbmnpajbjkjipmopnhfonnp\4.0.2_0\is-A0FTS.tmp
- %APPDATA%\119015\extensions\is-AO3N4.tmp
- %APPDATA%\119015\extensions\is-0ATJ2.tmp
- %APPDATA%\119015\is-JAM59.tmp
- %TEMP%\is-6RK7H.tmp\ISTask.dll
- %APPDATA%\119015\is-98EAB.tmp
- %TEMP%\is-73D79.tmp\<File name>.tmp
- %TEMP%\is-6RK7H.tmp\_isetup\_shfoldr.dll
- %APPDATA%\119015\is-6533R.tmp
- %APPDATA%\119015\is-1RDIS.tmp
- %APPDATA%\119015\is-BUHJJ.tmp
- %APPDATA%\119015\is-QUEA3.tmp
- %APPDATA%\119015\extensions\chrome\ccikkllbpgbmnpajbjkjipmopnhfonnp\4.0.2_0\is-2OOMJ.tmp
- %APPDATA%\119015\extensions\int2\ccikkllbpgbmnpajbjkjipmopnhfonnp\4.0.2_0\is-72SHT.tmp
- %APPDATA%\119015\extensions\int2\ccikkllbpgbmnpajbjkjipmopnhfonnp\4.0.2_0\is-U2EKU.tmp
- %APPDATA%\119015\extensions\chrome\ccikkllbpgbmnpajbjkjipmopnhfonnp\4.0.2_0\_metadata\is-3UID1.tmp
- %APPDATA%\119015\extensions\int2\ccikkllbpgbmnpajbjkjipmopnhfonnp\4.0.2_0\is-BJMR5.tmp
- %APPDATA%\119015\extensions\int2\ccikkllbpgbmnpajbjkjipmopnhfonnp\4.0.2_0\is-EA16E.tmp
- %APPDATA%\119015\extensions\int2\ccikkllbpgbmnpajbjkjipmopnhfonnp\4.0.2_0\res\is-03MAM.tmp
- %APPDATA%\119015\extensions\int2\ccikkllbpgbmnpajbjkjipmopnhfonnp\4.0.2_0\is-FRSQE.tmp
- %APPDATA%\119015\extensions\int2\ccikkllbpgbmnpajbjkjipmopnhfonnp\4.0.2_0\is-H3E52.tmp
- %APPDATA%\119015\extensions\chrome\ccikkllbpgbmnpajbjkjipmopnhfonnp\4.0.2_0\_metadata\is-3Q3NL.tmp
- %APPDATA%\119015\extensions\chrome\ccikkllbpgbmnpajbjkjipmopnhfonnp\4.0.2_0\is-LNC2A.tmp
- %APPDATA%\119015\extensions\chrome\ccikkllbpgbmnpajbjkjipmopnhfonnp\4.0.2_0\is-GMLVN.tmp
- %APPDATA%\119015\extensions\chrome\ccikkllbpgbmnpajbjkjipmopnhfonnp\4.0.2_0\is-0KKVF.tmp
- %APPDATA%\119015\extensions\chrome\ccikkllbpgbmnpajbjkjipmopnhfonnp\4.0.2_0\is-I1SE2.tmp
- %APPDATA%\119015\extensions\chrome\ccikkllbpgbmnpajbjkjipmopnhfonnp\4.0.2_0\_locales\en\is-QK7BQ.tmp
- %APPDATA%\119015\extensions\chrome\ccikkllbpgbmnpajbjkjipmopnhfonnp\4.0.2_0\_locales\zh_CN\is-I21I8.tmp
- %APPDATA%\119015\extensions\chrome\ccikkllbpgbmnpajbjkjipmopnhfonnp\4.0.2_0\res\is-QMQC3.tmp
- %APPDATA%\119015\extensions\chrome\ccikkllbpgbmnpajbjkjipmopnhfonnp\4.0.2_0\res\is-SAM86.tmp
- %APPDATA%\119015\RLDataView64.dll
- %APPDATA%\119015\RLDataView.dll
- from %APPDATA%\119015\resource\is-EGUAU.tmp to %APPDATA%\119015\resource\btn_alpha.png
- from %APPDATA%\119015\resource\is-UGKE3.tmp to %APPDATA%\119015\resource\btn_cancel.png
- from %APPDATA%\119015\resource\is-8MAR5.tmp to %APPDATA%\119015\resource\browser.png
- from %APPDATA%\119015\resource\is-RQGTO.tmp to %APPDATA%\119015\resource\btnBK.png
- from %APPDATA%\119015\resource\is-2I0GH.tmp to %APPDATA%\119015\resource\btn_ok.png
- from %APPDATA%\119015\resource\is-06HP4.tmp to %APPDATA%\119015\resource\btn_today.png
- from %APPDATA%\119015\resource\is-J6A43.tmp to %APPDATA%\119015\resource\btn_close.png
- from %APPDATA%\119015\resource\is-3L2HF.tmp to %APPDATA%\119015\resource\btn_min.png
- from %APPDATA%\119015\extensions\int2\ccikkllbpgbmnpajbjkjipmopnhfonnp\4.0.2_0\_locales\zh_CN\is-IB0RK.tmp to %APPDATA%\119015\extensions\int2\ccikkllbpgbmnpajbjkjipmopnhfonnp\4.0.2_0\_locales\zh_CN\messages.json
- from %APPDATA%\119015\extensions\int2\ccikkllbpgbmnpajbjkjipmopnhfonnp\4.0.2_0\_metadata\is-O39JJ.tmp to %APPDATA%\119015\extensions\int2\ccikkllbpgbmnpajbjkjipmopnhfonnp\4.0.2_0\_metadata\computed_hashes.json
- from %APPDATA%\119015\extensions\int2\ccikkllbpgbmnpajbjkjipmopnhfonnp\4.0.2_0\res\is-V4LI2.tmp to %APPDATA%\119015\extensions\int2\ccikkllbpgbmnpajbjkjipmopnhfonnp\4.0.2_0\res\icon.gif
- from %APPDATA%\119015\extensions\int2\ccikkllbpgbmnpajbjkjipmopnhfonnp\4.0.2_0\_locales\en\is-475I9.tmp to %APPDATA%\119015\extensions\int2\ccikkllbpgbmnpajbjkjipmopnhfonnp\4.0.2_0\_locales\en\messages.json
- from %APPDATA%\119015\resource\is-PF217.tmp to %APPDATA%\119015\resource\arrow_right.png
- from %APPDATA%\119015\resource\is-NN0UG.tmp to %APPDATA%\119015\resource\box_check.png
- from %APPDATA%\119015\extensions\int2\ccikkllbpgbmnpajbjkjipmopnhfonnp\4.0.2_0\_metadata\is-E6UPN.tmp to %APPDATA%\119015\extensions\int2\ccikkllbpgbmnpajbjkjipmopnhfonnp\4.0.2_0\_metadata\verified_contents.json
- from %APPDATA%\119015\resource\is-N2VVJ.tmp to %APPDATA%\119015\resource\arrow_left.png
- from %APPDATA%\119015\resource\DirectUI\is-EJCI7.tmp to %APPDATA%\119015\resource\DirectUI\scrollArrowDown.bmp
- from %APPDATA%\119015\resource\DirectUI\is-OR0EF.tmp to %APPDATA%\119015\resource\DirectUI\scrollArrowUp.bmp
- from %APPDATA%\119015\resource\is-D39HH.tmp to %APPDATA%\119015\resource\return.png
- from %APPDATA%\119015\resource\is-SRI9J.tmp to %APPDATA%\119015\resource\wtl.exe.manifest
- from %APPDATA%\119015\xmlconfig\is-0M24S.tmp to %APPDATA%\119015\xmlconfig\install.xml
- from %APPDATA%\119015\xmlconfig\is-280QQ.tmp to %APPDATA%\119015\xmlconfig\riliclient.xml
- from %APPDATA%\119015\resource\DirectUI\is-PCUI1.tmp to %APPDATA%\119015\resource\DirectUI\scrollBar.bmp
- from %APPDATA%\119015\resource\DirectUI\is-K02J4.tmp to %APPDATA%\119015\resource\DirectUI\srollBk.bmp
- from %APPDATA%\119015\resource\is-EO2DP.tmp to %APPDATA%\119015\resource\License.txt
- from %APPDATA%\119015\resource\is-C9IAC.tmp to %APPDATA%\119015\resource\logo.png
- from %APPDATA%\119015\resource\is-0LP6A.tmp to %APPDATA%\119015\resource\Calendar.ico
- from %APPDATA%\119015\resource\is-NMRJH.tmp to %APPDATA%\119015\resource\comboxBk.png
- from %APPDATA%\119015\resource\is-64B2E.tmp to %APPDATA%\119015\resource\now_start.png
- from %APPDATA%\119015\resource\is-4NH0I.tmp to %APPDATA%\119015\resource\radio.png
- from %APPDATA%\119015\resource\is-ERENH.tmp to %APPDATA%\119015\resource\mainBk.png
- from %APPDATA%\119015\resource\is-KV5GL.tmp to %APPDATA%\119015\resource\menuButton.png
- from %APPDATA%\119015\extensions\is-AO3N4.tmp to %APPDATA%\119015\extensions\jySougou.sext
- from %APPDATA%\119015\extensions\is-0ATJ2.tmp to %APPDATA%\119015\extensions\sec_setting.json
- from %APPDATA%\119015\is-MEGN5.tmp to %APPDATA%\119015\RLDataView64.dll
- from %APPDATA%\119015\extensions\is-2JMHP.tmp to %APPDATA%\119015\extensions\jychromeex.crx
- from %APPDATA%\119015\extensions\chrome\ccikkllbpgbmnpajbjkjipmopnhfonnp\4.0.2_0\is-2OOMJ.tmp to %APPDATA%\119015\extensions\chrome\ccikkllbpgbmnpajbjkjipmopnhfonnp\4.0.2_0\background.js
- from %APPDATA%\119015\extensions\chrome\ccikkllbpgbmnpajbjkjipmopnhfonnp\4.0.2_0\is-0KKVF.tmp to %APPDATA%\119015\extensions\chrome\ccikkllbpgbmnpajbjkjipmopnhfonnp\4.0.2_0\calmath.js
- from %APPDATA%\119015\extensions\is-Q1V50.tmp to %APPDATA%\119015\extensions\setting.json
- from %APPDATA%\119015\extensions\chrome\ccikkllbpgbmnpajbjkjipmopnhfonnp\4.0.2_0\is-A0FTS.tmp to %APPDATA%\119015\extensions\chrome\ccikkllbpgbmnpajbjkjipmopnhfonnp\4.0.2_0\background.html
- from %APPDATA%\119015\is-QUEA3.tmp to %APPDATA%\119015\fixfunction.dll
- from %APPDATA%\119015\is-6533R.tmp to %APPDATA%\119015\istask.dll
- from %APPDATA%\119015\is-98EAB.tmp to %APPDATA%\119015\awde.exe
- from %APPDATA%\119015\is-BUHJJ.tmp to %APPDATA%\119015\bandac.exe
- from %APPDATA%\119015\is-T4E5H.tmp to %APPDATA%\119015\RIBridage.exe
- from %APPDATA%\119015\is-VKFS3.tmp to %APPDATA%\119015\RLDataView.dll
- from %APPDATA%\119015\is-1RDIS.tmp to %APPDATA%\119015\jywebHelper.dll
- from %APPDATA%\119015\is-JAM59.tmp to %APPDATA%\119015\mainClient.exe
- from %APPDATA%\119015\extensions\int2\ccikkllbpgbmnpajbjkjipmopnhfonnp\4.0.2_0\is-72SHT.tmp to %APPDATA%\119015\extensions\int2\ccikkllbpgbmnpajbjkjipmopnhfonnp\4.0.2_0\background.js
- from %APPDATA%\119015\extensions\int2\ccikkllbpgbmnpajbjkjipmopnhfonnp\4.0.2_0\is-U2EKU.tmp to %APPDATA%\119015\extensions\int2\ccikkllbpgbmnpajbjkjipmopnhfonnp\4.0.2_0\calmath.js
- from %APPDATA%\119015\extensions\chrome\ccikkllbpgbmnpajbjkjipmopnhfonnp\4.0.2_0\_metadata\is-3UID1.tmp to %APPDATA%\119015\extensions\chrome\ccikkllbpgbmnpajbjkjipmopnhfonnp\4.0.2_0\_metadata\verified_contents.json
- from %APPDATA%\119015\extensions\int2\ccikkllbpgbmnpajbjkjipmopnhfonnp\4.0.2_0\is-BJMR5.tmp to %APPDATA%\119015\extensions\int2\ccikkllbpgbmnpajbjkjipmopnhfonnp\4.0.2_0\background.html
- from %APPDATA%\119015\extensions\int2\ccikkllbpgbmnpajbjkjipmopnhfonnp\4.0.2_0\is-EA16E.tmp to %APPDATA%\119015\extensions\int2\ccikkllbpgbmnpajbjkjipmopnhfonnp\4.0.2_0\popup.html
- from %APPDATA%\119015\extensions\int2\ccikkllbpgbmnpajbjkjipmopnhfonnp\4.0.2_0\res\is-03MAM.tmp to %APPDATA%\119015\extensions\int2\ccikkllbpgbmnpajbjkjipmopnhfonnp\4.0.2_0\res\crx.png
- from %APPDATA%\119015\extensions\int2\ccikkllbpgbmnpajbjkjipmopnhfonnp\4.0.2_0\is-FRSQE.tmp to %APPDATA%\119015\extensions\int2\ccikkllbpgbmnpajbjkjipmopnhfonnp\4.0.2_0\contentscript.js
- from %APPDATA%\119015\extensions\int2\ccikkllbpgbmnpajbjkjipmopnhfonnp\4.0.2_0\is-H3E52.tmp to %APPDATA%\119015\extensions\int2\ccikkllbpgbmnpajbjkjipmopnhfonnp\4.0.2_0\manifest.json
- from %APPDATA%\119015\extensions\chrome\ccikkllbpgbmnpajbjkjipmopnhfonnp\4.0.2_0\is-GMLVN.tmp to %APPDATA%\119015\extensions\chrome\ccikkllbpgbmnpajbjkjipmopnhfonnp\4.0.2_0\popup.html
- from %APPDATA%\119015\extensions\chrome\ccikkllbpgbmnpajbjkjipmopnhfonnp\4.0.2_0\res\is-QMQC3.tmp to %APPDATA%\119015\extensions\chrome\ccikkllbpgbmnpajbjkjipmopnhfonnp\4.0.2_0\res\crx.png
- from %APPDATA%\119015\extensions\chrome\ccikkllbpgbmnpajbjkjipmopnhfonnp\4.0.2_0\is-I1SE2.tmp to %APPDATA%\119015\extensions\chrome\ccikkllbpgbmnpajbjkjipmopnhfonnp\4.0.2_0\contentscript.js
- from %APPDATA%\119015\extensions\chrome\ccikkllbpgbmnpajbjkjipmopnhfonnp\4.0.2_0\is-LNC2A.tmp to %APPDATA%\119015\extensions\chrome\ccikkllbpgbmnpajbjkjipmopnhfonnp\4.0.2_0\manifest.json
- from %APPDATA%\119015\extensions\chrome\ccikkllbpgbmnpajbjkjipmopnhfonnp\4.0.2_0\_locales\zh_CN\is-I21I8.tmp to %APPDATA%\119015\extensions\chrome\ccikkllbpgbmnpajbjkjipmopnhfonnp\4.0.2_0\_locales\zh_CN\messages.json
- from %APPDATA%\119015\extensions\chrome\ccikkllbpgbmnpajbjkjipmopnhfonnp\4.0.2_0\_metadata\is-3Q3NL.tmp to %APPDATA%\119015\extensions\chrome\ccikkllbpgbmnpajbjkjipmopnhfonnp\4.0.2_0\_metadata\computed_hashes.json
- from %APPDATA%\119015\extensions\chrome\ccikkllbpgbmnpajbjkjipmopnhfonnp\4.0.2_0\res\is-SAM86.tmp to %APPDATA%\119015\extensions\chrome\ccikkllbpgbmnpajbjkjipmopnhfonnp\4.0.2_0\res\icon.gif
- from %APPDATA%\119015\extensions\chrome\ccikkllbpgbmnpajbjkjipmopnhfonnp\4.0.2_0\_locales\en\is-QK7BQ.tmp to %APPDATA%\119015\extensions\chrome\ccikkllbpgbmnpajbjkjipmopnhfonnp\4.0.2_0\_locales\en\messages.json
- %APPDATA%\119015\RLDataView64.dll
- %APPDATA%\119015\RLDataView.dll
- 'www.jy##li.com':80
- http://www.jy##li.com/client.do/?&m##############################################################################################################################################################...
- DNS ASK www.jy##li.com
- ClassName: 'Shell_TrayWnd' WindowName: ''