Technical Information
- [<HKLM>\SYSTEM\ControlSet001\Services\msvyiran] 'ImagePath' = '%APPDATA%\1292187979\msvyiran.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\msvyiran] 'Start' = '00000002'
- '%APPDATA%\1292187979\msvyiran.exe'
- '%APPDATA%\1292187979\msvyiran.exe' -i
- '%TEMP%\is-GIMRC.tmp\<File name>.tmp' /SL5="$30092,1000213,56832,<Full path to file>"
- '<SYSTEM32>\net.exe' start msvyiran
- '<SYSTEM32>\net1.exe' start msvyiran
- '<SYSTEM32>\sc.exe' delete msvyiran
- '<SYSTEM32>\regsvr32.exe' /s "%APPDATA%\1292187979\DataView.dll"
- '<SYSTEM32>\sc.exe' stop msvyiran
- %APPDATA%\1292187979\resource\is-4R4GH.tmp
- %APPDATA%\1292187979\resource\is-HG61J.tmp
- %APPDATA%\1292187979\resource\is-FH6IA.tmp
- %APPDATA%\1292187979\resource\is-H6BKV.tmp
- %APPDATA%\1292187979\resource\is-FEB37.tmp
- %APPDATA%\1292187979\resource\is-6K3LV.tmp
- %APPDATA%\1292187979\resource\is-5AFR4.tmp
- %APPDATA%\1292187979\resource\is-PFJG3.tmp
- %APPDATA%\1292187979\resource\is-AMUQ1.tmp
- %APPDATA%\1292187979\extensions\int2\faihpblmbndeljifkdhmkegbololnfmb\4.0.2_0\_locales\zh_CN\is-ODU9Q.tmp
- %APPDATA%\1292187979\extensions\int2\faihpblmbndeljifkdhmkegbololnfmb\4.0.2_0\_metadata\is-5TMIN.tmp
- %APPDATA%\1292187979\extensions\int2\faihpblmbndeljifkdhmkegbololnfmb\4.0.2_0\res\is-FAE2C.tmp
- %APPDATA%\1292187979\extensions\int2\faihpblmbndeljifkdhmkegbololnfmb\4.0.2_0\_locales\en\is-BR862.tmp
- %APPDATA%\1292187979\resource\is-242NP.tmp
- %APPDATA%\1292187979\resource\is-KF73K.tmp
- %APPDATA%\1292187979\extensions\int2\faihpblmbndeljifkdhmkegbololnfmb\4.0.2_0\_metadata\is-M68EH.tmp
- %APPDATA%\1292187979\resource\is-3945S.tmp
- %APPDATA%\1292187979\resource\is-J8JK3.tmp
- %APPDATA%\1292187979\resource\DirectUI\is-97N1B.tmp
- %APPDATA%\1292187979\xmlconfig\is-DSQB6.tmp
- %APPDATA%\1292187979\resource\DirectUI\is-9M8RB.tmp
- %APPDATA%\1292187979\resource\DirectUI\is-LQHJK.tmp
- %APPDATA%\1292187979\is-VJ1GC.tmp
- %ALLUSERSPROFILE%\Desktop\јтФјИХАъ.lnk
- %APPDATA%\1292187979\xmlconfig\is-OJRMJ.tmp
- %APPDATA%\1292187979\is-UCUIR.tmp
- %APPDATA%\1292187979\resource\DirectUI\is-2VBKN.tmp
- %APPDATA%\1292187979\resource\is-H7JRV.tmp
- %APPDATA%\1292187979\resource\is-A0MKV.tmp
- %APPDATA%\1292187979\resource\is-7DKBU.tmp
- %APPDATA%\1292187979\resource\is-R8L9D.tmp
- %APPDATA%\1292187979\resource\is-8RFC8.tmp
- %APPDATA%\1292187979\resource\is-SNCPF.tmp
- %APPDATA%\1292187979\resource\is-6PTV8.tmp
- %APPDATA%\1292187979\resource\is-LO9KS.tmp
- %APPDATA%\1292187979\is-BPFPA.tmp
- %APPDATA%\1292187979\extensions\is-PQCMO.tmp
- %APPDATA%\1292187979\is-ABB2K.tmp
- %APPDATA%\1292187979\is-UDK1S.tmp
- %APPDATA%\1292187979\extensions\is-DBA58.tmp
- %APPDATA%\1292187979\extensions\chrome\faihpblmbndeljifkdhmkegbololnfmb\4.0.2_0\is-IV1LF.tmp
- %APPDATA%\1292187979\extensions\is-MB0J6.tmp
- %APPDATA%\1292187979\extensions\is-LBSFL.tmp
- %APPDATA%\1292187979\is-UIQ6E.tmp
- %TEMP%\is-B7U2C.tmp\ISTask.dll
- %APPDATA%\1292187979\is-GBSMT.tmp
- %TEMP%\is-GIMRC.tmp\<File name>.tmp
- %TEMP%\is-B7U2C.tmp\_isetup\_shfoldr.dll
- %APPDATA%\1292187979\is-GQ2I3.tmp
- %APPDATA%\1292187979\is-E3OJE.tmp
- %APPDATA%\1292187979\is-SSAKP.tmp
- %APPDATA%\1292187979\is-9S8R9.tmp
- %APPDATA%\1292187979\extensions\chrome\faihpblmbndeljifkdhmkegbololnfmb\4.0.2_0\is-EUURN.tmp
- %APPDATA%\1292187979\extensions\int2\faihpblmbndeljifkdhmkegbololnfmb\4.0.2_0\is-60J4F.tmp
- %APPDATA%\1292187979\extensions\int2\faihpblmbndeljifkdhmkegbololnfmb\4.0.2_0\is-BNDHV.tmp
- %APPDATA%\1292187979\extensions\chrome\faihpblmbndeljifkdhmkegbololnfmb\4.0.2_0\_metadata\is-F58P1.tmp
- %APPDATA%\1292187979\extensions\int2\faihpblmbndeljifkdhmkegbololnfmb\4.0.2_0\is-F2D1D.tmp
- %APPDATA%\1292187979\extensions\int2\faihpblmbndeljifkdhmkegbololnfmb\4.0.2_0\is-60DG9.tmp
- %APPDATA%\1292187979\extensions\int2\faihpblmbndeljifkdhmkegbololnfmb\4.0.2_0\res\is-R26O3.tmp
- %APPDATA%\1292187979\extensions\int2\faihpblmbndeljifkdhmkegbololnfmb\4.0.2_0\is-5F5CP.tmp
- %APPDATA%\1292187979\extensions\int2\faihpblmbndeljifkdhmkegbololnfmb\4.0.2_0\is-N1775.tmp
- %APPDATA%\1292187979\extensions\chrome\faihpblmbndeljifkdhmkegbololnfmb\4.0.2_0\_metadata\is-5UL2K.tmp
- %APPDATA%\1292187979\extensions\chrome\faihpblmbndeljifkdhmkegbololnfmb\4.0.2_0\is-T5RM9.tmp
- %APPDATA%\1292187979\extensions\chrome\faihpblmbndeljifkdhmkegbololnfmb\4.0.2_0\is-6CAUT.tmp
- %APPDATA%\1292187979\extensions\chrome\faihpblmbndeljifkdhmkegbololnfmb\4.0.2_0\is-BDV57.tmp
- %APPDATA%\1292187979\extensions\chrome\faihpblmbndeljifkdhmkegbololnfmb\4.0.2_0\is-8OG81.tmp
- %APPDATA%\1292187979\extensions\chrome\faihpblmbndeljifkdhmkegbololnfmb\4.0.2_0\_locales\en\is-E9UH1.tmp
- %APPDATA%\1292187979\extensions\chrome\faihpblmbndeljifkdhmkegbololnfmb\4.0.2_0\_locales\zh_CN\is-1AFJJ.tmp
- %APPDATA%\1292187979\extensions\chrome\faihpblmbndeljifkdhmkegbololnfmb\4.0.2_0\res\is-F8DG9.tmp
- %APPDATA%\1292187979\extensions\chrome\faihpblmbndeljifkdhmkegbololnfmb\4.0.2_0\res\is-2DH6C.tmp
- %APPDATA%\1292187979\DataView.dll
- from %APPDATA%\1292187979\resource\is-H6BKV.tmp to %APPDATA%\1292187979\resource\btn_alpha.png
- from %APPDATA%\1292187979\resource\is-4R4GH.tmp to %APPDATA%\1292187979\resource\btn_cancel.png
- from %APPDATA%\1292187979\resource\is-AMUQ1.tmp to %APPDATA%\1292187979\resource\browser.png
- from %APPDATA%\1292187979\resource\is-FH6IA.tmp to %APPDATA%\1292187979\resource\btnBK.png
- from %APPDATA%\1292187979\resource\is-PFJG3.tmp to %APPDATA%\1292187979\resource\btn_ok.png
- from %APPDATA%\1292187979\resource\is-FEB37.tmp to %APPDATA%\1292187979\resource\btn_today.png
- from %APPDATA%\1292187979\resource\is-HG61J.tmp to %APPDATA%\1292187979\resource\btn_close.png
- from %APPDATA%\1292187979\resource\is-5AFR4.tmp to %APPDATA%\1292187979\resource\btn_min.png
- from %APPDATA%\1292187979\extensions\int2\faihpblmbndeljifkdhmkegbololnfmb\4.0.2_0\_locales\zh_CN\is-ODU9Q.tmp to %APPDATA%\1292187979\extensions\int2\faihpblmbndeljifkdhmkegbololnfmb\4.0.2_0\_locales\zh_CN\messages.json
- from %APPDATA%\1292187979\extensions\int2\faihpblmbndeljifkdhmkegbololnfmb\4.0.2_0\_metadata\is-5TMIN.tmp to %APPDATA%\1292187979\extensions\int2\faihpblmbndeljifkdhmkegbololnfmb\4.0.2_0\_metadata\computed_hashes.json
- from %APPDATA%\1292187979\extensions\int2\faihpblmbndeljifkdhmkegbololnfmb\4.0.2_0\res\is-FAE2C.tmp to %APPDATA%\1292187979\extensions\int2\faihpblmbndeljifkdhmkegbololnfmb\4.0.2_0\res\icon.gif
- from %APPDATA%\1292187979\extensions\int2\faihpblmbndeljifkdhmkegbololnfmb\4.0.2_0\_locales\en\is-BR862.tmp to %APPDATA%\1292187979\extensions\int2\faihpblmbndeljifkdhmkegbololnfmb\4.0.2_0\_locales\en\messages.json
- from %APPDATA%\1292187979\resource\is-242NP.tmp to %APPDATA%\1292187979\resource\arrow_right.png
- from %APPDATA%\1292187979\resource\is-KF73K.tmp to %APPDATA%\1292187979\resource\box_check.png
- from %APPDATA%\1292187979\extensions\int2\faihpblmbndeljifkdhmkegbololnfmb\4.0.2_0\_metadata\is-M68EH.tmp to %APPDATA%\1292187979\extensions\int2\faihpblmbndeljifkdhmkegbololnfmb\4.0.2_0\_metadata\verified_contents.json
- from %APPDATA%\1292187979\resource\is-3945S.tmp to %APPDATA%\1292187979\resource\arrow_left.png
- from %APPDATA%\1292187979\resource\DirectUI\is-2VBKN.tmp to %APPDATA%\1292187979\resource\DirectUI\scrollArrowDown.bmp
- from %APPDATA%\1292187979\resource\DirectUI\is-9M8RB.tmp to %APPDATA%\1292187979\resource\DirectUI\scrollArrowUp.bmp
- from %APPDATA%\1292187979\resource\is-8RFC8.tmp to %APPDATA%\1292187979\resource\return.png
- from %APPDATA%\1292187979\resource\is-SNCPF.tmp to %APPDATA%\1292187979\resource\wtl.exe.manifest
- from %APPDATA%\1292187979\xmlconfig\is-DSQB6.tmp to %APPDATA%\1292187979\xmlconfig\install.xml
- from %APPDATA%\1292187979\xmlconfig\is-OJRMJ.tmp to %APPDATA%\1292187979\xmlconfig\riliclient.xml
- from %APPDATA%\1292187979\resource\DirectUI\is-LQHJK.tmp to %APPDATA%\1292187979\resource\DirectUI\scrollBar.bmp
- from %APPDATA%\1292187979\resource\DirectUI\is-97N1B.tmp to %APPDATA%\1292187979\resource\DirectUI\srollBk.bmp
- from %APPDATA%\1292187979\resource\is-7DKBU.tmp to %APPDATA%\1292187979\resource\License.txt
- from %APPDATA%\1292187979\resource\is-R8L9D.tmp to %APPDATA%\1292187979\resource\logo.png
- from %APPDATA%\1292187979\resource\is-6K3LV.tmp to %APPDATA%\1292187979\resource\Calendar.ico
- from %APPDATA%\1292187979\resource\is-J8JK3.tmp to %APPDATA%\1292187979\resource\comboxBk.png
- from %APPDATA%\1292187979\resource\is-6PTV8.tmp to %APPDATA%\1292187979\resource\now_start.png
- from %APPDATA%\1292187979\resource\is-LO9KS.tmp to %APPDATA%\1292187979\resource\radio.png
- from %APPDATA%\1292187979\resource\is-H7JRV.tmp to %APPDATA%\1292187979\resource\mainBk.png
- from %APPDATA%\1292187979\resource\is-A0MKV.tmp to %APPDATA%\1292187979\resource\menuButton.png
- from %APPDATA%\1292187979\extensions\is-MB0J6.tmp to %APPDATA%\1292187979\extensions\jySougou.sext
- from %APPDATA%\1292187979\extensions\is-LBSFL.tmp to %APPDATA%\1292187979\extensions\sec_setting.json
- from %APPDATA%\1292187979\is-BPFPA.tmp to %APPDATA%\1292187979\msvyiran.exe
- from %APPDATA%\1292187979\extensions\is-PQCMO.tmp to %APPDATA%\1292187979\extensions\jychromeex.crx
- from %APPDATA%\1292187979\extensions\chrome\faihpblmbndeljifkdhmkegbololnfmb\4.0.2_0\is-EUURN.tmp to %APPDATA%\1292187979\extensions\chrome\faihpblmbndeljifkdhmkegbololnfmb\4.0.2_0\background.js
- from %APPDATA%\1292187979\extensions\chrome\faihpblmbndeljifkdhmkegbololnfmb\4.0.2_0\is-BDV57.tmp to %APPDATA%\1292187979\extensions\chrome\faihpblmbndeljifkdhmkegbololnfmb\4.0.2_0\calmath.js
- from %APPDATA%\1292187979\extensions\is-DBA58.tmp to %APPDATA%\1292187979\extensions\setting.json
- from %APPDATA%\1292187979\extensions\chrome\faihpblmbndeljifkdhmkegbololnfmb\4.0.2_0\is-IV1LF.tmp to %APPDATA%\1292187979\extensions\chrome\faihpblmbndeljifkdhmkegbololnfmb\4.0.2_0\background.html
- from %APPDATA%\1292187979\is-9S8R9.tmp to %APPDATA%\1292187979\DataView64.dll
- from %APPDATA%\1292187979\is-GQ2I3.tmp to %APPDATA%\1292187979\fixfunction.dll
- from %APPDATA%\1292187979\is-GBSMT.tmp to %APPDATA%\1292187979\config.ini
- from %APPDATA%\1292187979\is-SSAKP.tmp to %APPDATA%\1292187979\DataView.dll
- from %APPDATA%\1292187979\is-ABB2K.tmp to %APPDATA%\1292187979\kan.exe
- from %APPDATA%\1292187979\is-UDK1S.tmp to %APPDATA%\1292187979\msvcssist.exe
- from %APPDATA%\1292187979\is-E3OJE.tmp to %APPDATA%\1292187979\istask.dll
- from %APPDATA%\1292187979\is-UIQ6E.tmp to %APPDATA%\1292187979\jywebHelper.dll
- from %APPDATA%\1292187979\extensions\int2\faihpblmbndeljifkdhmkegbololnfmb\4.0.2_0\is-60J4F.tmp to %APPDATA%\1292187979\extensions\int2\faihpblmbndeljifkdhmkegbololnfmb\4.0.2_0\background.js
- from %APPDATA%\1292187979\extensions\int2\faihpblmbndeljifkdhmkegbololnfmb\4.0.2_0\is-BNDHV.tmp to %APPDATA%\1292187979\extensions\int2\faihpblmbndeljifkdhmkegbololnfmb\4.0.2_0\calmath.js
- from %APPDATA%\1292187979\extensions\chrome\faihpblmbndeljifkdhmkegbololnfmb\4.0.2_0\_metadata\is-F58P1.tmp to %APPDATA%\1292187979\extensions\chrome\faihpblmbndeljifkdhmkegbololnfmb\4.0.2_0\_metadata\verified_contents.json
- from %APPDATA%\1292187979\extensions\int2\faihpblmbndeljifkdhmkegbololnfmb\4.0.2_0\is-F2D1D.tmp to %APPDATA%\1292187979\extensions\int2\faihpblmbndeljifkdhmkegbololnfmb\4.0.2_0\background.html
- from %APPDATA%\1292187979\extensions\int2\faihpblmbndeljifkdhmkegbololnfmb\4.0.2_0\is-60DG9.tmp to %APPDATA%\1292187979\extensions\int2\faihpblmbndeljifkdhmkegbololnfmb\4.0.2_0\popup.html
- from %APPDATA%\1292187979\extensions\int2\faihpblmbndeljifkdhmkegbololnfmb\4.0.2_0\res\is-R26O3.tmp to %APPDATA%\1292187979\extensions\int2\faihpblmbndeljifkdhmkegbololnfmb\4.0.2_0\res\crx.png
- from %APPDATA%\1292187979\extensions\int2\faihpblmbndeljifkdhmkegbololnfmb\4.0.2_0\is-5F5CP.tmp to %APPDATA%\1292187979\extensions\int2\faihpblmbndeljifkdhmkegbololnfmb\4.0.2_0\contentscript.js
- from %APPDATA%\1292187979\extensions\int2\faihpblmbndeljifkdhmkegbololnfmb\4.0.2_0\is-N1775.tmp to %APPDATA%\1292187979\extensions\int2\faihpblmbndeljifkdhmkegbololnfmb\4.0.2_0\manifest.json
- from %APPDATA%\1292187979\extensions\chrome\faihpblmbndeljifkdhmkegbololnfmb\4.0.2_0\is-6CAUT.tmp to %APPDATA%\1292187979\extensions\chrome\faihpblmbndeljifkdhmkegbololnfmb\4.0.2_0\popup.html
- from %APPDATA%\1292187979\extensions\chrome\faihpblmbndeljifkdhmkegbololnfmb\4.0.2_0\res\is-F8DG9.tmp to %APPDATA%\1292187979\extensions\chrome\faihpblmbndeljifkdhmkegbololnfmb\4.0.2_0\res\crx.png
- from %APPDATA%\1292187979\extensions\chrome\faihpblmbndeljifkdhmkegbololnfmb\4.0.2_0\is-8OG81.tmp to %APPDATA%\1292187979\extensions\chrome\faihpblmbndeljifkdhmkegbololnfmb\4.0.2_0\contentscript.js
- from %APPDATA%\1292187979\extensions\chrome\faihpblmbndeljifkdhmkegbololnfmb\4.0.2_0\is-T5RM9.tmp to %APPDATA%\1292187979\extensions\chrome\faihpblmbndeljifkdhmkegbololnfmb\4.0.2_0\manifest.json
- from %APPDATA%\1292187979\extensions\chrome\faihpblmbndeljifkdhmkegbololnfmb\4.0.2_0\_locales\zh_CN\is-1AFJJ.tmp to %APPDATA%\1292187979\extensions\chrome\faihpblmbndeljifkdhmkegbololnfmb\4.0.2_0\_locales\zh_CN\messages.json
- from %APPDATA%\1292187979\extensions\chrome\faihpblmbndeljifkdhmkegbololnfmb\4.0.2_0\_metadata\is-5UL2K.tmp to %APPDATA%\1292187979\extensions\chrome\faihpblmbndeljifkdhmkegbololnfmb\4.0.2_0\_metadata\computed_hashes.json
- from %APPDATA%\1292187979\extensions\chrome\faihpblmbndeljifkdhmkegbololnfmb\4.0.2_0\res\is-2DH6C.tmp to %APPDATA%\1292187979\extensions\chrome\faihpblmbndeljifkdhmkegbololnfmb\4.0.2_0\res\icon.gif
- from %APPDATA%\1292187979\extensions\chrome\faihpblmbndeljifkdhmkegbololnfmb\4.0.2_0\_locales\en\is-E9UH1.tmp to %APPDATA%\1292187979\extensions\chrome\faihpblmbndeljifkdhmkegbololnfmb\4.0.2_0\_locales\en\messages.json
- %APPDATA%\1292187979\DataView.dll