Technical Information
- [<HKLM>\System\CurrentControlSet\Services\dcd7JJ17] 'ImagePath' = '<Current directory>\dcd7JJ17.sys'
- [<HKLM>\System\CurrentControlSet\Services\IKEEXT] 'Start' = '00000002'
- 'dcd7JJ17' <Current directory>\dcd7JJ17.sys
- [<HKLM>\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile] 'EnableFirewall' = '00000000'
- [<HKLM>\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] 'EnableFirewall' = '00000000'
- <Current directory>\hangzhoubd.exe
- <Current directory>\dcd7jj17.sys
- <Current directory>\clean.vbs
- <Current directory>\hangzhoubd.exe
- <Current directory>\clean.vbs
- http://be###ngxia.com/hangzhoubd.exe
- DNS ASK be###ngxia.com
- DNS ASK 16##.com
- DNS ASK re#####.fkchuanw.club
- DNS ASK cl####.fkchuanw.club
- 're#####.fkchuanw.club':23002
- '255.255.255.255':21215
- '<Current directory>\hangzhoubd.exe'
- '%WINDIR%\syswow64\wscript.exe' "<Current directory>\clean.vbs"
- '%WINDIR%\syswow64\wscript.exe' "<Current directory>\clean.vbs"' (with hidden window)