Техническая информация
- [<HKLM>\SYSTEM\ControlSet001\Services\bandac] 'ImagePath' = '%APPDATA%\119015\bandac.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\bandac] 'Start' = '00000002'
- '<SYSTEM32>\net.exe' start bandac
- '%APPDATA%\119015\bandac.exe' -i
- '<SYSTEM32>\net1.exe' start bandac
- '%APPDATA%\119015\RIBridage.exe' BootDoThings
- '%APPDATA%\119015\bandac.exe'
- '<SYSTEM32>\regsvr32.exe' /s "%APPDATA%\119015\RLDataView.dll"
- '%TEMP%\is-73D79.tmp\<Имя файла>.tmp' /SL5="$30092,1093130,56832,<Полный путь к файлу>"
- '<SYSTEM32>\regsvr32.exe' /s "%APPDATA%\119015\RLDataView64.dll"
- '%APPDATA%\119015\bandac.exe' -u
- '%APPDATA%\119015\awde.exe' <Полный путь к файлу>
- %APPDATA%\119015\resource\is-UGKE3.tmp
- %APPDATA%\119015\resource\is-J6A43.tmp
- %APPDATA%\119015\resource\is-RQGTO.tmp
- %APPDATA%\119015\resource\is-EGUAU.tmp
- %APPDATA%\119015\resource\is-06HP4.tmp
- %APPDATA%\119015\resource\is-0LP6A.tmp
- %APPDATA%\119015\resource\is-3L2HF.tmp
- %APPDATA%\119015\resource\is-2I0GH.tmp
- %APPDATA%\119015\resource\is-8MAR5.tmp
- %APPDATA%\119015\extensions\int2\ccikkllbpgbmnpajbjkjipmopnhfonnp\4.0.2_0\_locales\zh_CN\is-IB0RK.tmp
- %APPDATA%\119015\extensions\int2\ccikkllbpgbmnpajbjkjipmopnhfonnp\4.0.2_0\_metadata\is-O39JJ.tmp
- %APPDATA%\119015\extensions\int2\ccikkllbpgbmnpajbjkjipmopnhfonnp\4.0.2_0\res\is-V4LI2.tmp
- %APPDATA%\119015\extensions\int2\ccikkllbpgbmnpajbjkjipmopnhfonnp\4.0.2_0\_locales\en\is-475I9.tmp
- %APPDATA%\119015\resource\is-PF217.tmp
- %APPDATA%\119015\resource\is-NN0UG.tmp
- %APPDATA%\119015\extensions\int2\ccikkllbpgbmnpajbjkjipmopnhfonnp\4.0.2_0\_metadata\is-E6UPN.tmp
- %APPDATA%\119015\resource\is-N2VVJ.tmp
- %APPDATA%\119015\resource\is-NMRJH.tmp
- %APPDATA%\119015\resource\DirectUI\is-K02J4.tmp
- %APPDATA%\119015\xmlconfig\is-0M24S.tmp
- %APPDATA%\119015\resource\DirectUI\is-OR0EF.tmp
- %APPDATA%\119015\resource\DirectUI\is-PCUI1.tmp
- %APPDATA%\119015\is-GKBM0.tmp
- %ALLUSERSPROFILE%\Desktop\јтФјИХАъ.lnk
- %APPDATA%\119015\xmlconfig\is-280QQ.tmp
- %APPDATA%\119015\is-6R6QQ.tmp
- %APPDATA%\119015\resource\DirectUI\is-EJCI7.tmp
- %APPDATA%\119015\resource\is-ERENH.tmp
- %APPDATA%\119015\resource\is-KV5GL.tmp
- %APPDATA%\119015\resource\is-EO2DP.tmp
- %APPDATA%\119015\resource\is-C9IAC.tmp
- %APPDATA%\119015\resource\is-D39HH.tmp
- %APPDATA%\119015\resource\is-SRI9J.tmp
- %APPDATA%\119015\resource\is-64B2E.tmp
- %APPDATA%\119015\resource\is-4NH0I.tmp
- %APPDATA%\119015\is-MEGN5.tmp
- %APPDATA%\119015\extensions\is-2JMHP.tmp
- %APPDATA%\119015\is-T4E5H.tmp
- %APPDATA%\119015\is-VKFS3.tmp
- %APPDATA%\119015\extensions\is-Q1V50.tmp
- %APPDATA%\119015\extensions\chrome\ccikkllbpgbmnpajbjkjipmopnhfonnp\4.0.2_0\is-A0FTS.tmp
- %APPDATA%\119015\extensions\is-AO3N4.tmp
- %APPDATA%\119015\extensions\is-0ATJ2.tmp
- %APPDATA%\119015\is-JAM59.tmp
- %TEMP%\is-6RK7H.tmp\ISTask.dll
- %APPDATA%\119015\is-98EAB.tmp
- %TEMP%\is-73D79.tmp\<Имя файла>.tmp
- %TEMP%\is-6RK7H.tmp\_isetup\_shfoldr.dll
- %APPDATA%\119015\is-6533R.tmp
- %APPDATA%\119015\is-1RDIS.tmp
- %APPDATA%\119015\is-BUHJJ.tmp
- %APPDATA%\119015\is-QUEA3.tmp
- %APPDATA%\119015\extensions\chrome\ccikkllbpgbmnpajbjkjipmopnhfonnp\4.0.2_0\is-2OOMJ.tmp
- %APPDATA%\119015\extensions\int2\ccikkllbpgbmnpajbjkjipmopnhfonnp\4.0.2_0\is-72SHT.tmp
- %APPDATA%\119015\extensions\int2\ccikkllbpgbmnpajbjkjipmopnhfonnp\4.0.2_0\is-U2EKU.tmp
- %APPDATA%\119015\extensions\chrome\ccikkllbpgbmnpajbjkjipmopnhfonnp\4.0.2_0\_metadata\is-3UID1.tmp
- %APPDATA%\119015\extensions\int2\ccikkllbpgbmnpajbjkjipmopnhfonnp\4.0.2_0\is-BJMR5.tmp
- %APPDATA%\119015\extensions\int2\ccikkllbpgbmnpajbjkjipmopnhfonnp\4.0.2_0\is-EA16E.tmp
- %APPDATA%\119015\extensions\int2\ccikkllbpgbmnpajbjkjipmopnhfonnp\4.0.2_0\res\is-03MAM.tmp
- %APPDATA%\119015\extensions\int2\ccikkllbpgbmnpajbjkjipmopnhfonnp\4.0.2_0\is-FRSQE.tmp
- %APPDATA%\119015\extensions\int2\ccikkllbpgbmnpajbjkjipmopnhfonnp\4.0.2_0\is-H3E52.tmp
- %APPDATA%\119015\extensions\chrome\ccikkllbpgbmnpajbjkjipmopnhfonnp\4.0.2_0\_metadata\is-3Q3NL.tmp
- %APPDATA%\119015\extensions\chrome\ccikkllbpgbmnpajbjkjipmopnhfonnp\4.0.2_0\is-LNC2A.tmp
- %APPDATA%\119015\extensions\chrome\ccikkllbpgbmnpajbjkjipmopnhfonnp\4.0.2_0\is-GMLVN.tmp
- %APPDATA%\119015\extensions\chrome\ccikkllbpgbmnpajbjkjipmopnhfonnp\4.0.2_0\is-0KKVF.tmp
- %APPDATA%\119015\extensions\chrome\ccikkllbpgbmnpajbjkjipmopnhfonnp\4.0.2_0\is-I1SE2.tmp
- %APPDATA%\119015\extensions\chrome\ccikkllbpgbmnpajbjkjipmopnhfonnp\4.0.2_0\_locales\en\is-QK7BQ.tmp
- %APPDATA%\119015\extensions\chrome\ccikkllbpgbmnpajbjkjipmopnhfonnp\4.0.2_0\_locales\zh_CN\is-I21I8.tmp
- %APPDATA%\119015\extensions\chrome\ccikkllbpgbmnpajbjkjipmopnhfonnp\4.0.2_0\res\is-QMQC3.tmp
- %APPDATA%\119015\extensions\chrome\ccikkllbpgbmnpajbjkjipmopnhfonnp\4.0.2_0\res\is-SAM86.tmp
- %APPDATA%\119015\RLDataView64.dll
- %APPDATA%\119015\RLDataView.dll
- %APPDATA%\119015\resource\is-EGUAU.tmp в %APPDATA%\119015\resource\btn_alpha.png
- %APPDATA%\119015\resource\is-UGKE3.tmp в %APPDATA%\119015\resource\btn_cancel.png
- %APPDATA%\119015\resource\is-8MAR5.tmp в %APPDATA%\119015\resource\browser.png
- %APPDATA%\119015\resource\is-RQGTO.tmp в %APPDATA%\119015\resource\btnBK.png
- %APPDATA%\119015\resource\is-2I0GH.tmp в %APPDATA%\119015\resource\btn_ok.png
- %APPDATA%\119015\resource\is-06HP4.tmp в %APPDATA%\119015\resource\btn_today.png
- %APPDATA%\119015\resource\is-J6A43.tmp в %APPDATA%\119015\resource\btn_close.png
- %APPDATA%\119015\resource\is-3L2HF.tmp в %APPDATA%\119015\resource\btn_min.png
- %APPDATA%\119015\extensions\int2\ccikkllbpgbmnpajbjkjipmopnhfonnp\4.0.2_0\_locales\zh_CN\is-IB0RK.tmp в %APPDATA%\119015\extensions\int2\ccikkllbpgbmnpajbjkjipmopnhfonnp\4.0.2_0\_locales\zh_CN\messages.json
- %APPDATA%\119015\extensions\int2\ccikkllbpgbmnpajbjkjipmopnhfonnp\4.0.2_0\_metadata\is-O39JJ.tmp в %APPDATA%\119015\extensions\int2\ccikkllbpgbmnpajbjkjipmopnhfonnp\4.0.2_0\_metadata\computed_hashes.json
- %APPDATA%\119015\extensions\int2\ccikkllbpgbmnpajbjkjipmopnhfonnp\4.0.2_0\res\is-V4LI2.tmp в %APPDATA%\119015\extensions\int2\ccikkllbpgbmnpajbjkjipmopnhfonnp\4.0.2_0\res\icon.gif
- %APPDATA%\119015\extensions\int2\ccikkllbpgbmnpajbjkjipmopnhfonnp\4.0.2_0\_locales\en\is-475I9.tmp в %APPDATA%\119015\extensions\int2\ccikkllbpgbmnpajbjkjipmopnhfonnp\4.0.2_0\_locales\en\messages.json
- %APPDATA%\119015\resource\is-PF217.tmp в %APPDATA%\119015\resource\arrow_right.png
- %APPDATA%\119015\resource\is-NN0UG.tmp в %APPDATA%\119015\resource\box_check.png
- %APPDATA%\119015\extensions\int2\ccikkllbpgbmnpajbjkjipmopnhfonnp\4.0.2_0\_metadata\is-E6UPN.tmp в %APPDATA%\119015\extensions\int2\ccikkllbpgbmnpajbjkjipmopnhfonnp\4.0.2_0\_metadata\verified_contents.json
- %APPDATA%\119015\resource\is-N2VVJ.tmp в %APPDATA%\119015\resource\arrow_left.png
- %APPDATA%\119015\resource\DirectUI\is-EJCI7.tmp в %APPDATA%\119015\resource\DirectUI\scrollArrowDown.bmp
- %APPDATA%\119015\resource\DirectUI\is-OR0EF.tmp в %APPDATA%\119015\resource\DirectUI\scrollArrowUp.bmp
- %APPDATA%\119015\resource\is-D39HH.tmp в %APPDATA%\119015\resource\return.png
- %APPDATA%\119015\resource\is-SRI9J.tmp в %APPDATA%\119015\resource\wtl.exe.manifest
- %APPDATA%\119015\xmlconfig\is-0M24S.tmp в %APPDATA%\119015\xmlconfig\install.xml
- %APPDATA%\119015\xmlconfig\is-280QQ.tmp в %APPDATA%\119015\xmlconfig\riliclient.xml
- %APPDATA%\119015\resource\DirectUI\is-PCUI1.tmp в %APPDATA%\119015\resource\DirectUI\scrollBar.bmp
- %APPDATA%\119015\resource\DirectUI\is-K02J4.tmp в %APPDATA%\119015\resource\DirectUI\srollBk.bmp
- %APPDATA%\119015\resource\is-EO2DP.tmp в %APPDATA%\119015\resource\License.txt
- %APPDATA%\119015\resource\is-C9IAC.tmp в %APPDATA%\119015\resource\logo.png
- %APPDATA%\119015\resource\is-0LP6A.tmp в %APPDATA%\119015\resource\Calendar.ico
- %APPDATA%\119015\resource\is-NMRJH.tmp в %APPDATA%\119015\resource\comboxBk.png
- %APPDATA%\119015\resource\is-64B2E.tmp в %APPDATA%\119015\resource\now_start.png
- %APPDATA%\119015\resource\is-4NH0I.tmp в %APPDATA%\119015\resource\radio.png
- %APPDATA%\119015\resource\is-ERENH.tmp в %APPDATA%\119015\resource\mainBk.png
- %APPDATA%\119015\resource\is-KV5GL.tmp в %APPDATA%\119015\resource\menuButton.png
- %APPDATA%\119015\extensions\is-AO3N4.tmp в %APPDATA%\119015\extensions\jySougou.sext
- %APPDATA%\119015\extensions\is-0ATJ2.tmp в %APPDATA%\119015\extensions\sec_setting.json
- %APPDATA%\119015\is-MEGN5.tmp в %APPDATA%\119015\RLDataView64.dll
- %APPDATA%\119015\extensions\is-2JMHP.tmp в %APPDATA%\119015\extensions\jychromeex.crx
- %APPDATA%\119015\extensions\chrome\ccikkllbpgbmnpajbjkjipmopnhfonnp\4.0.2_0\is-2OOMJ.tmp в %APPDATA%\119015\extensions\chrome\ccikkllbpgbmnpajbjkjipmopnhfonnp\4.0.2_0\background.js
- %APPDATA%\119015\extensions\chrome\ccikkllbpgbmnpajbjkjipmopnhfonnp\4.0.2_0\is-0KKVF.tmp в %APPDATA%\119015\extensions\chrome\ccikkllbpgbmnpajbjkjipmopnhfonnp\4.0.2_0\calmath.js
- %APPDATA%\119015\extensions\is-Q1V50.tmp в %APPDATA%\119015\extensions\setting.json
- %APPDATA%\119015\extensions\chrome\ccikkllbpgbmnpajbjkjipmopnhfonnp\4.0.2_0\is-A0FTS.tmp в %APPDATA%\119015\extensions\chrome\ccikkllbpgbmnpajbjkjipmopnhfonnp\4.0.2_0\background.html
- %APPDATA%\119015\is-QUEA3.tmp в %APPDATA%\119015\fixfunction.dll
- %APPDATA%\119015\is-6533R.tmp в %APPDATA%\119015\istask.dll
- %APPDATA%\119015\is-98EAB.tmp в %APPDATA%\119015\awde.exe
- %APPDATA%\119015\is-BUHJJ.tmp в %APPDATA%\119015\bandac.exe
- %APPDATA%\119015\is-T4E5H.tmp в %APPDATA%\119015\RIBridage.exe
- %APPDATA%\119015\is-VKFS3.tmp в %APPDATA%\119015\RLDataView.dll
- %APPDATA%\119015\is-1RDIS.tmp в %APPDATA%\119015\jywebHelper.dll
- %APPDATA%\119015\is-JAM59.tmp в %APPDATA%\119015\mainClient.exe
- %APPDATA%\119015\extensions\int2\ccikkllbpgbmnpajbjkjipmopnhfonnp\4.0.2_0\is-72SHT.tmp в %APPDATA%\119015\extensions\int2\ccikkllbpgbmnpajbjkjipmopnhfonnp\4.0.2_0\background.js
- %APPDATA%\119015\extensions\int2\ccikkllbpgbmnpajbjkjipmopnhfonnp\4.0.2_0\is-U2EKU.tmp в %APPDATA%\119015\extensions\int2\ccikkllbpgbmnpajbjkjipmopnhfonnp\4.0.2_0\calmath.js
- %APPDATA%\119015\extensions\chrome\ccikkllbpgbmnpajbjkjipmopnhfonnp\4.0.2_0\_metadata\is-3UID1.tmp в %APPDATA%\119015\extensions\chrome\ccikkllbpgbmnpajbjkjipmopnhfonnp\4.0.2_0\_metadata\verified_contents.json
- %APPDATA%\119015\extensions\int2\ccikkllbpgbmnpajbjkjipmopnhfonnp\4.0.2_0\is-BJMR5.tmp в %APPDATA%\119015\extensions\int2\ccikkllbpgbmnpajbjkjipmopnhfonnp\4.0.2_0\background.html
- %APPDATA%\119015\extensions\int2\ccikkllbpgbmnpajbjkjipmopnhfonnp\4.0.2_0\is-EA16E.tmp в %APPDATA%\119015\extensions\int2\ccikkllbpgbmnpajbjkjipmopnhfonnp\4.0.2_0\popup.html
- %APPDATA%\119015\extensions\int2\ccikkllbpgbmnpajbjkjipmopnhfonnp\4.0.2_0\res\is-03MAM.tmp в %APPDATA%\119015\extensions\int2\ccikkllbpgbmnpajbjkjipmopnhfonnp\4.0.2_0\res\crx.png
- %APPDATA%\119015\extensions\int2\ccikkllbpgbmnpajbjkjipmopnhfonnp\4.0.2_0\is-FRSQE.tmp в %APPDATA%\119015\extensions\int2\ccikkllbpgbmnpajbjkjipmopnhfonnp\4.0.2_0\contentscript.js
- %APPDATA%\119015\extensions\int2\ccikkllbpgbmnpajbjkjipmopnhfonnp\4.0.2_0\is-H3E52.tmp в %APPDATA%\119015\extensions\int2\ccikkllbpgbmnpajbjkjipmopnhfonnp\4.0.2_0\manifest.json
- %APPDATA%\119015\extensions\chrome\ccikkllbpgbmnpajbjkjipmopnhfonnp\4.0.2_0\is-GMLVN.tmp в %APPDATA%\119015\extensions\chrome\ccikkllbpgbmnpajbjkjipmopnhfonnp\4.0.2_0\popup.html
- %APPDATA%\119015\extensions\chrome\ccikkllbpgbmnpajbjkjipmopnhfonnp\4.0.2_0\res\is-QMQC3.tmp в %APPDATA%\119015\extensions\chrome\ccikkllbpgbmnpajbjkjipmopnhfonnp\4.0.2_0\res\crx.png
- %APPDATA%\119015\extensions\chrome\ccikkllbpgbmnpajbjkjipmopnhfonnp\4.0.2_0\is-I1SE2.tmp в %APPDATA%\119015\extensions\chrome\ccikkllbpgbmnpajbjkjipmopnhfonnp\4.0.2_0\contentscript.js
- %APPDATA%\119015\extensions\chrome\ccikkllbpgbmnpajbjkjipmopnhfonnp\4.0.2_0\is-LNC2A.tmp в %APPDATA%\119015\extensions\chrome\ccikkllbpgbmnpajbjkjipmopnhfonnp\4.0.2_0\manifest.json
- %APPDATA%\119015\extensions\chrome\ccikkllbpgbmnpajbjkjipmopnhfonnp\4.0.2_0\_locales\zh_CN\is-I21I8.tmp в %APPDATA%\119015\extensions\chrome\ccikkllbpgbmnpajbjkjipmopnhfonnp\4.0.2_0\_locales\zh_CN\messages.json
- %APPDATA%\119015\extensions\chrome\ccikkllbpgbmnpajbjkjipmopnhfonnp\4.0.2_0\_metadata\is-3Q3NL.tmp в %APPDATA%\119015\extensions\chrome\ccikkllbpgbmnpajbjkjipmopnhfonnp\4.0.2_0\_metadata\computed_hashes.json
- %APPDATA%\119015\extensions\chrome\ccikkllbpgbmnpajbjkjipmopnhfonnp\4.0.2_0\res\is-SAM86.tmp в %APPDATA%\119015\extensions\chrome\ccikkllbpgbmnpajbjkjipmopnhfonnp\4.0.2_0\res\icon.gif
- %APPDATA%\119015\extensions\chrome\ccikkllbpgbmnpajbjkjipmopnhfonnp\4.0.2_0\_locales\en\is-QK7BQ.tmp в %APPDATA%\119015\extensions\chrome\ccikkllbpgbmnpajbjkjipmopnhfonnp\4.0.2_0\_locales\en\messages.json
- %APPDATA%\119015\RLDataView64.dll
- %APPDATA%\119015\RLDataView.dll
- 'www.jy##li.com':80
- http://www.jy##li.com/client.do/?&m##############################################################################################################################################################...
- DNS ASK www.jy##li.com
- ClassName: 'Shell_TrayWnd' WindowName: ''