Technical Information
- [<HKLM>\SYSTEM\ControlSet001\Services\fjrhcbc] 'Start' = '00000002'
- [<HKLM>\SYSTEM\ControlSet001\Services\fjrhcbc] 'ImagePath' = '%WINDIR%\temp\fjrhcbc.sys'
- %WINDIR%\Temp\fjrhcbc.sys
- %WINDIR%\twa1n.ini
- %WINDIR%\Temp\First.html
- %WINDIR%\twein.ini
- %WINDIR%\Temp\ico888.ini
- %WINDIR%\Temp\fjrhcbc.sys
- '22#.#87.239.189':20001
- '11#.#93.184.220':80
- '22#.#87.239.189':20000
- 'tj.##999.top':80
- http:///ico888.ini via 11#.#93.184.220
- http://tj.##999.top/tongji.php?us#################################
- DNS ASK tj.##999.top