Technical Information
- [<HKLM>\System\CurrentControlSet\Services\cJz223312] 'ImagePath' = '<Current directory>\cJz223312.sys'
- [<HKLM>\System\CurrentControlSet\Services\IKEEXT] 'Start' = '00000002'
- 'cJz223312' <Current directory>\cJz223312.sys
- [<HKLM>\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile] 'EnableFirewall' = '00000000'
- [<HKLM>\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] 'EnableFirewall' = '00000000'
- <Current directory>\nuebfs.exe
- <Current directory>\cjz223312.sys
- <Current directory>\clean.vbs
- <Current directory>\nuebfs.exe
- <Current directory>\clean.vbs
- http://21#.##0.218.154:808/xjg.bin via 21#.#50.218.154
- DNS ASK te##ent.com
- DNS ASK re#####.fkchuanw.club
- DNS ASK cl####.fkchuanw.club
- 're#####.fkchuanw.club':23002
- '255.255.255.255':21240
- '<Current directory>\nuebfs.exe'
- '%WINDIR%\syswow64\wscript.exe' "<Current directory>\clean.vbs"
- '%WINDIR%\syswow64\wscript.exe' "<Current directory>\clean.vbs"' (with hidden window)