Technical Information
- 'bi#o.cn':80
- http://www.bi#o.cn/Union/zz.htm
- http://www.bi#o.cn/union/softfy.asp?ne################################
- http://www.bi#o.cn/ie/union/softfy.asp?ne################################
- http://www.bi#o.cn/mysoft/cd/ver.asp
- DNS ASK bi#o.cn
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebCheckMonitor' WindowName: ''
- '%WINDIR%\syswow64\cmd.exe' /c rmdir /s/q "%LOCALAPPDATA%\Tempsmd#\' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c rmdir /s/q "%LOCALAPPDATA%\Temp$2312\' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c rmdir /s/q "%LOCALAPPDATA%\Tempsmd#\
- '%WINDIR%\syswow64\cmd.exe' /c rmdir /s/q "%LOCALAPPDATA%\Temp$2312\