Technical Information
- [<HKLM>\System\CurrentControlSet\Services\c3131cz] 'ImagePath' = '<Current directory>\c3131cz.sys'
- [<HKLM>\System\CurrentControlSet\Services\IKEEXT] 'Start' = '00000002'
- 'c3131cz' <Current directory>\c3131cz.sys
- [<HKLM>\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile] 'EnableFirewall' = '00000000'
- [<HKLM>\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] 'EnableFirewall' = '00000000'
- <Current directory>\steamwa.exe
- <Current directory>\c3131cz.sys
- <Current directory>\clean.vbs
- <Current directory>\steamwa.exe
- <Current directory>\steamwa.exe
- <Current directory>\clean.vbs
- http://21#.##0.218.154:808/pass.bin via 21#.#50.218.154
- DNS ASK 16##.com
- DNS ASK re#####.fkchuanw.club
- DNS ASK cl####.fkchuanw.club
- 're#####.fkchuanw.club':23002
- '255.255.255.255':21215
- '<Current directory>\steamwa.exe'
- '%WINDIR%\syswow64\wscript.exe' "<Current directory>\clean.vbs"
- '%WINDIR%\syswow64\wscript.exe' "<Current directory>\clean.vbs"' (with hidden window)