Technical Information
- [<HKLM>\SYSTEM\ControlSet001\Services\msvyiran] 'ImagePath' = '%APPDATA%\1163282386\msvyiran.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\msvyiran] 'Start' = '00000002'
- '%APPDATA%\1163282386\msvyiran.exe'
- '%APPDATA%\1163282386\msvyiran.exe' -i
- '%TEMP%\is-6HDAL.tmp\<File name>.tmp' /SL5="$30092,1000000,56832,<Full path to file>"
- '<SYSTEM32>\net.exe' start msvyiran
- '<SYSTEM32>\net1.exe' start msvyiran
- '<SYSTEM32>\sc.exe' delete msvyiran
- '<SYSTEM32>\regsvr32.exe' /s "%APPDATA%\1163282386\DataView.dll"
- '<SYSTEM32>\sc.exe' stop msvyiran
- %APPDATA%\1163282386\resource\is-SVE6L.tmp
- %APPDATA%\1163282386\resource\is-22O5O.tmp
- %APPDATA%\1163282386\resource\is-7E0L5.tmp
- %APPDATA%\1163282386\resource\is-P52KM.tmp
- %APPDATA%\1163282386\resource\is-H6O8M.tmp
- %APPDATA%\1163282386\resource\is-FPQET.tmp
- %APPDATA%\1163282386\resource\is-UU2RD.tmp
- %APPDATA%\1163282386\resource\is-MUSAT.tmp
- %APPDATA%\1163282386\resource\is-AB009.tmp
- %APPDATA%\1163282386\extensions\int2\faihpblmbndeljifkdhmkegbololnfmb\4.0.2_0\_locales\zh_CN\is-MCCV1.tmp
- %APPDATA%\1163282386\extensions\int2\faihpblmbndeljifkdhmkegbololnfmb\4.0.2_0\_metadata\is-GTM49.tmp
- %APPDATA%\1163282386\extensions\int2\faihpblmbndeljifkdhmkegbololnfmb\4.0.2_0\res\is-G7J9G.tmp
- %APPDATA%\1163282386\extensions\int2\faihpblmbndeljifkdhmkegbololnfmb\4.0.2_0\_locales\en\is-SQ1T7.tmp
- %APPDATA%\1163282386\resource\is-QCS6A.tmp
- %APPDATA%\1163282386\resource\is-SAERP.tmp
- %APPDATA%\1163282386\extensions\int2\faihpblmbndeljifkdhmkegbololnfmb\4.0.2_0\_metadata\is-D45BQ.tmp
- %APPDATA%\1163282386\resource\is-IA0JM.tmp
- %APPDATA%\1163282386\resource\is-DCU45.tmp
- %APPDATA%\1163282386\resource\DirectUI\is-L8TJ0.tmp
- %APPDATA%\1163282386\xmlconfig\is-2UHT0.tmp
- %APPDATA%\1163282386\resource\DirectUI\is-65SR4.tmp
- %APPDATA%\1163282386\resource\DirectUI\is-AKC82.tmp
- %APPDATA%\1163282386\is-GL6VB.tmp
- %ALLUSERSPROFILE%\Desktop\јтФјИХАъ.lnk
- %APPDATA%\1163282386\xmlconfig\is-6GJF7.tmp
- %APPDATA%\1163282386\is-KGFBH.tmp
- %APPDATA%\1163282386\resource\DirectUI\is-TQKG0.tmp
- %APPDATA%\1163282386\resource\is-BJ12G.tmp
- %APPDATA%\1163282386\resource\is-O7DH6.tmp
- %APPDATA%\1163282386\resource\is-BDJTM.tmp
- %APPDATA%\1163282386\resource\is-QDQ9K.tmp
- %APPDATA%\1163282386\resource\is-4V9RA.tmp
- %APPDATA%\1163282386\resource\is-HKU87.tmp
- %APPDATA%\1163282386\resource\is-AB8LQ.tmp
- %APPDATA%\1163282386\resource\is-FN8L6.tmp
- %APPDATA%\1163282386\is-K6TO1.tmp
- %APPDATA%\1163282386\extensions\is-9SKJP.tmp
- %APPDATA%\1163282386\is-I55R3.tmp
- %APPDATA%\1163282386\is-U60BN.tmp
- %APPDATA%\1163282386\extensions\is-UITIR.tmp
- %APPDATA%\1163282386\extensions\chrome\faihpblmbndeljifkdhmkegbololnfmb\4.0.2_0\is-HJ94T.tmp
- %APPDATA%\1163282386\extensions\is-252LR.tmp
- %APPDATA%\1163282386\extensions\is-TPRKF.tmp
- %APPDATA%\1163282386\is-MUF9E.tmp
- %TEMP%\is-BQ6C3.tmp\ISTask.dll
- %APPDATA%\1163282386\is-4J84F.tmp
- %TEMP%\is-6HDAL.tmp\<File name>.tmp
- %TEMP%\is-BQ6C3.tmp\_isetup\_shfoldr.dll
- %APPDATA%\1163282386\is-TH38B.tmp
- %APPDATA%\1163282386\is-UFH85.tmp
- %APPDATA%\1163282386\is-22HC3.tmp
- %APPDATA%\1163282386\is-T5UHE.tmp
- %APPDATA%\1163282386\extensions\chrome\faihpblmbndeljifkdhmkegbololnfmb\4.0.2_0\is-S6K2E.tmp
- %APPDATA%\1163282386\extensions\int2\faihpblmbndeljifkdhmkegbololnfmb\4.0.2_0\is-CE96L.tmp
- %APPDATA%\1163282386\extensions\int2\faihpblmbndeljifkdhmkegbololnfmb\4.0.2_0\is-581KE.tmp
- %APPDATA%\1163282386\extensions\chrome\faihpblmbndeljifkdhmkegbololnfmb\4.0.2_0\_metadata\is-8874H.tmp
- %APPDATA%\1163282386\extensions\int2\faihpblmbndeljifkdhmkegbololnfmb\4.0.2_0\is-S5VUB.tmp
- %APPDATA%\1163282386\extensions\int2\faihpblmbndeljifkdhmkegbololnfmb\4.0.2_0\is-QR1I1.tmp
- %APPDATA%\1163282386\extensions\int2\faihpblmbndeljifkdhmkegbololnfmb\4.0.2_0\res\is-J9B0D.tmp
- %APPDATA%\1163282386\extensions\int2\faihpblmbndeljifkdhmkegbololnfmb\4.0.2_0\is-P6MEL.tmp
- %APPDATA%\1163282386\extensions\int2\faihpblmbndeljifkdhmkegbololnfmb\4.0.2_0\is-OIBS1.tmp
- %APPDATA%\1163282386\extensions\chrome\faihpblmbndeljifkdhmkegbololnfmb\4.0.2_0\_metadata\is-3NT8K.tmp
- %APPDATA%\1163282386\extensions\chrome\faihpblmbndeljifkdhmkegbololnfmb\4.0.2_0\is-VRQQH.tmp
- %APPDATA%\1163282386\extensions\chrome\faihpblmbndeljifkdhmkegbololnfmb\4.0.2_0\is-0UNLJ.tmp
- %APPDATA%\1163282386\extensions\chrome\faihpblmbndeljifkdhmkegbololnfmb\4.0.2_0\is-JA86C.tmp
- %APPDATA%\1163282386\extensions\chrome\faihpblmbndeljifkdhmkegbololnfmb\4.0.2_0\is-338BC.tmp
- %APPDATA%\1163282386\extensions\chrome\faihpblmbndeljifkdhmkegbololnfmb\4.0.2_0\_locales\en\is-MABME.tmp
- %APPDATA%\1163282386\extensions\chrome\faihpblmbndeljifkdhmkegbololnfmb\4.0.2_0\_locales\zh_CN\is-OBFO3.tmp
- %APPDATA%\1163282386\extensions\chrome\faihpblmbndeljifkdhmkegbololnfmb\4.0.2_0\res\is-0CI96.tmp
- %APPDATA%\1163282386\extensions\chrome\faihpblmbndeljifkdhmkegbololnfmb\4.0.2_0\res\is-Q2J8B.tmp
- %APPDATA%\1163282386\DataView.dll
- from %APPDATA%\1163282386\resource\is-P52KM.tmp to %APPDATA%\1163282386\resource\btn_alpha.png
- from %APPDATA%\1163282386\resource\is-SVE6L.tmp to %APPDATA%\1163282386\resource\btn_cancel.png
- from %APPDATA%\1163282386\resource\is-AB009.tmp to %APPDATA%\1163282386\resource\browser.png
- from %APPDATA%\1163282386\resource\is-7E0L5.tmp to %APPDATA%\1163282386\resource\btnBK.png
- from %APPDATA%\1163282386\resource\is-MUSAT.tmp to %APPDATA%\1163282386\resource\btn_ok.png
- from %APPDATA%\1163282386\resource\is-H6O8M.tmp to %APPDATA%\1163282386\resource\btn_today.png
- from %APPDATA%\1163282386\resource\is-22O5O.tmp to %APPDATA%\1163282386\resource\btn_close.png
- from %APPDATA%\1163282386\resource\is-UU2RD.tmp to %APPDATA%\1163282386\resource\btn_min.png
- from %APPDATA%\1163282386\extensions\int2\faihpblmbndeljifkdhmkegbololnfmb\4.0.2_0\_locales\zh_CN\is-MCCV1.tmp to %APPDATA%\1163282386\extensions\int2\faihpblmbndeljifkdhmkegbololnfmb\4.0.2_0\_locales\zh_CN\messages.json
- from %APPDATA%\1163282386\extensions\int2\faihpblmbndeljifkdhmkegbololnfmb\4.0.2_0\_metadata\is-GTM49.tmp to %APPDATA%\1163282386\extensions\int2\faihpblmbndeljifkdhmkegbololnfmb\4.0.2_0\_metadata\computed_hashes.json
- from %APPDATA%\1163282386\extensions\int2\faihpblmbndeljifkdhmkegbololnfmb\4.0.2_0\res\is-G7J9G.tmp to %APPDATA%\1163282386\extensions\int2\faihpblmbndeljifkdhmkegbololnfmb\4.0.2_0\res\icon.gif
- from %APPDATA%\1163282386\extensions\int2\faihpblmbndeljifkdhmkegbololnfmb\4.0.2_0\_locales\en\is-SQ1T7.tmp to %APPDATA%\1163282386\extensions\int2\faihpblmbndeljifkdhmkegbololnfmb\4.0.2_0\_locales\en\messages.json
- from %APPDATA%\1163282386\resource\is-QCS6A.tmp to %APPDATA%\1163282386\resource\arrow_right.png
- from %APPDATA%\1163282386\resource\is-SAERP.tmp to %APPDATA%\1163282386\resource\box_check.png
- from %APPDATA%\1163282386\extensions\int2\faihpblmbndeljifkdhmkegbololnfmb\4.0.2_0\_metadata\is-D45BQ.tmp to %APPDATA%\1163282386\extensions\int2\faihpblmbndeljifkdhmkegbololnfmb\4.0.2_0\_metadata\verified_contents.json
- from %APPDATA%\1163282386\resource\is-IA0JM.tmp to %APPDATA%\1163282386\resource\arrow_left.png
- from %APPDATA%\1163282386\resource\DirectUI\is-TQKG0.tmp to %APPDATA%\1163282386\resource\DirectUI\scrollArrowDown.bmp
- from %APPDATA%\1163282386\resource\DirectUI\is-65SR4.tmp to %APPDATA%\1163282386\resource\DirectUI\scrollArrowUp.bmp
- from %APPDATA%\1163282386\resource\is-4V9RA.tmp to %APPDATA%\1163282386\resource\return.png
- from %APPDATA%\1163282386\resource\is-HKU87.tmp to %APPDATA%\1163282386\resource\wtl.exe.manifest
- from %APPDATA%\1163282386\xmlconfig\is-2UHT0.tmp to %APPDATA%\1163282386\xmlconfig\install.xml
- from %APPDATA%\1163282386\xmlconfig\is-6GJF7.tmp to %APPDATA%\1163282386\xmlconfig\riliclient.xml
- from %APPDATA%\1163282386\resource\DirectUI\is-AKC82.tmp to %APPDATA%\1163282386\resource\DirectUI\scrollBar.bmp
- from %APPDATA%\1163282386\resource\DirectUI\is-L8TJ0.tmp to %APPDATA%\1163282386\resource\DirectUI\srollBk.bmp
- from %APPDATA%\1163282386\resource\is-BDJTM.tmp to %APPDATA%\1163282386\resource\License.txt
- from %APPDATA%\1163282386\resource\is-QDQ9K.tmp to %APPDATA%\1163282386\resource\logo.png
- from %APPDATA%\1163282386\resource\is-FPQET.tmp to %APPDATA%\1163282386\resource\Calendar.ico
- from %APPDATA%\1163282386\resource\is-DCU45.tmp to %APPDATA%\1163282386\resource\comboxBk.png
- from %APPDATA%\1163282386\resource\is-AB8LQ.tmp to %APPDATA%\1163282386\resource\now_start.png
- from %APPDATA%\1163282386\resource\is-FN8L6.tmp to %APPDATA%\1163282386\resource\radio.png
- from %APPDATA%\1163282386\resource\is-BJ12G.tmp to %APPDATA%\1163282386\resource\mainBk.png
- from %APPDATA%\1163282386\resource\is-O7DH6.tmp to %APPDATA%\1163282386\resource\menuButton.png
- from %APPDATA%\1163282386\extensions\is-252LR.tmp to %APPDATA%\1163282386\extensions\jySougou.sext
- from %APPDATA%\1163282386\extensions\is-TPRKF.tmp to %APPDATA%\1163282386\extensions\sec_setting.json
- from %APPDATA%\1163282386\is-K6TO1.tmp to %APPDATA%\1163282386\msvyiran.exe
- from %APPDATA%\1163282386\extensions\is-9SKJP.tmp to %APPDATA%\1163282386\extensions\jychromeex.crx
- from %APPDATA%\1163282386\extensions\chrome\faihpblmbndeljifkdhmkegbololnfmb\4.0.2_0\is-S6K2E.tmp to %APPDATA%\1163282386\extensions\chrome\faihpblmbndeljifkdhmkegbololnfmb\4.0.2_0\background.js
- from %APPDATA%\1163282386\extensions\chrome\faihpblmbndeljifkdhmkegbololnfmb\4.0.2_0\is-JA86C.tmp to %APPDATA%\1163282386\extensions\chrome\faihpblmbndeljifkdhmkegbololnfmb\4.0.2_0\calmath.js
- from %APPDATA%\1163282386\extensions\is-UITIR.tmp to %APPDATA%\1163282386\extensions\setting.json
- from %APPDATA%\1163282386\extensions\chrome\faihpblmbndeljifkdhmkegbololnfmb\4.0.2_0\is-HJ94T.tmp to %APPDATA%\1163282386\extensions\chrome\faihpblmbndeljifkdhmkegbololnfmb\4.0.2_0\background.html
- from %APPDATA%\1163282386\is-T5UHE.tmp to %APPDATA%\1163282386\DataView64.dll
- from %APPDATA%\1163282386\is-TH38B.tmp to %APPDATA%\1163282386\fixfunction.dll
- from %APPDATA%\1163282386\is-4J84F.tmp to %APPDATA%\1163282386\config.ini
- from %APPDATA%\1163282386\is-22HC3.tmp to %APPDATA%\1163282386\DataView.dll
- from %APPDATA%\1163282386\is-I55R3.tmp to %APPDATA%\1163282386\kan.exe
- from %APPDATA%\1163282386\is-U60BN.tmp to %APPDATA%\1163282386\msvcssist.exe
- from %APPDATA%\1163282386\is-UFH85.tmp to %APPDATA%\1163282386\istask.dll
- from %APPDATA%\1163282386\is-MUF9E.tmp to %APPDATA%\1163282386\jywebHelper.dll
- from %APPDATA%\1163282386\extensions\int2\faihpblmbndeljifkdhmkegbololnfmb\4.0.2_0\is-CE96L.tmp to %APPDATA%\1163282386\extensions\int2\faihpblmbndeljifkdhmkegbololnfmb\4.0.2_0\background.js
- from %APPDATA%\1163282386\extensions\int2\faihpblmbndeljifkdhmkegbololnfmb\4.0.2_0\is-581KE.tmp to %APPDATA%\1163282386\extensions\int2\faihpblmbndeljifkdhmkegbololnfmb\4.0.2_0\calmath.js
- from %APPDATA%\1163282386\extensions\chrome\faihpblmbndeljifkdhmkegbololnfmb\4.0.2_0\_metadata\is-8874H.tmp to %APPDATA%\1163282386\extensions\chrome\faihpblmbndeljifkdhmkegbololnfmb\4.0.2_0\_metadata\verified_contents.json
- from %APPDATA%\1163282386\extensions\int2\faihpblmbndeljifkdhmkegbololnfmb\4.0.2_0\is-S5VUB.tmp to %APPDATA%\1163282386\extensions\int2\faihpblmbndeljifkdhmkegbololnfmb\4.0.2_0\background.html
- from %APPDATA%\1163282386\extensions\int2\faihpblmbndeljifkdhmkegbololnfmb\4.0.2_0\is-QR1I1.tmp to %APPDATA%\1163282386\extensions\int2\faihpblmbndeljifkdhmkegbololnfmb\4.0.2_0\popup.html
- from %APPDATA%\1163282386\extensions\int2\faihpblmbndeljifkdhmkegbololnfmb\4.0.2_0\res\is-J9B0D.tmp to %APPDATA%\1163282386\extensions\int2\faihpblmbndeljifkdhmkegbololnfmb\4.0.2_0\res\crx.png
- from %APPDATA%\1163282386\extensions\int2\faihpblmbndeljifkdhmkegbololnfmb\4.0.2_0\is-P6MEL.tmp to %APPDATA%\1163282386\extensions\int2\faihpblmbndeljifkdhmkegbololnfmb\4.0.2_0\contentscript.js
- from %APPDATA%\1163282386\extensions\int2\faihpblmbndeljifkdhmkegbololnfmb\4.0.2_0\is-OIBS1.tmp to %APPDATA%\1163282386\extensions\int2\faihpblmbndeljifkdhmkegbololnfmb\4.0.2_0\manifest.json
- from %APPDATA%\1163282386\extensions\chrome\faihpblmbndeljifkdhmkegbololnfmb\4.0.2_0\is-0UNLJ.tmp to %APPDATA%\1163282386\extensions\chrome\faihpblmbndeljifkdhmkegbololnfmb\4.0.2_0\popup.html
- from %APPDATA%\1163282386\extensions\chrome\faihpblmbndeljifkdhmkegbololnfmb\4.0.2_0\res\is-0CI96.tmp to %APPDATA%\1163282386\extensions\chrome\faihpblmbndeljifkdhmkegbololnfmb\4.0.2_0\res\crx.png
- from %APPDATA%\1163282386\extensions\chrome\faihpblmbndeljifkdhmkegbololnfmb\4.0.2_0\is-338BC.tmp to %APPDATA%\1163282386\extensions\chrome\faihpblmbndeljifkdhmkegbololnfmb\4.0.2_0\contentscript.js
- from %APPDATA%\1163282386\extensions\chrome\faihpblmbndeljifkdhmkegbololnfmb\4.0.2_0\is-VRQQH.tmp to %APPDATA%\1163282386\extensions\chrome\faihpblmbndeljifkdhmkegbololnfmb\4.0.2_0\manifest.json
- from %APPDATA%\1163282386\extensions\chrome\faihpblmbndeljifkdhmkegbololnfmb\4.0.2_0\_locales\zh_CN\is-OBFO3.tmp to %APPDATA%\1163282386\extensions\chrome\faihpblmbndeljifkdhmkegbololnfmb\4.0.2_0\_locales\zh_CN\messages.json
- from %APPDATA%\1163282386\extensions\chrome\faihpblmbndeljifkdhmkegbololnfmb\4.0.2_0\_metadata\is-3NT8K.tmp to %APPDATA%\1163282386\extensions\chrome\faihpblmbndeljifkdhmkegbololnfmb\4.0.2_0\_metadata\computed_hashes.json
- from %APPDATA%\1163282386\extensions\chrome\faihpblmbndeljifkdhmkegbololnfmb\4.0.2_0\res\is-Q2J8B.tmp to %APPDATA%\1163282386\extensions\chrome\faihpblmbndeljifkdhmkegbololnfmb\4.0.2_0\res\icon.gif
- from %APPDATA%\1163282386\extensions\chrome\faihpblmbndeljifkdhmkegbololnfmb\4.0.2_0\_locales\en\is-MABME.tmp to %APPDATA%\1163282386\extensions\chrome\faihpblmbndeljifkdhmkegbololnfmb\4.0.2_0\_locales\en\messages.json
- %APPDATA%\1163282386\DataView.dll