Technical Information
- %HOMEPATH%\Start Menu\Programs\Startup\winlogon.exe
- %HOMEPATH%\Start Menu\Programs\Startup\svhost.vbs
- %WINDIR%\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
- %TEMP%\站我去线想城木我家市.Bat
- %TEMP%\ZnxDpnFw.txt
- %TEMP%\dw.log
- %TEMP%\217E3.dmp
- <SYSTEM32>\rundll64.exe
- %TEMP%\zqefcxlv.0.vb
- %TEMP%\zqefcxlv.cmdline
- %TEMP%\zqefcxlv.out
- %TEMP%\vbc1.tmp
- %TEMP%\vbc2.tmp
- %TEMP%\RES3.tmp
- 'localhost':333
- '89.##3.248.130':333
- '89.##3.248.130':1933
- '%TEMP%\站我去线想城木我家市.Bat'
- '<SYSTEM32>\rundll64.exe'
- '%WINDIR%\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe'
- '%CommonProgramFiles%\Microsoft Shared\DW\DW20.EXE' -x -s 388
- '%WINDIR%\Microsoft.NET\Framework\v4.0.30319\vbc.exe' /noconfig @"%TEMP%\zqefcxlv.cmdline"
- '%WINDIR%\Microsoft.NET\Framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES3.tmp" "%TEMP%\vbc2.tmp"