Technical Information
To ensure autorun and distribution
Sets the following service settings
- [<HKLM>\System\CurrentControlSet\Services\ChkProofAuto] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\ChkProofAuto] 'ImagePath' = 'C:\ChkProof_LinJian\ChkProofRun.exe'
Creates the following services
- 'ChkProofAuto' C:\ChkProof_LinJian\ChkProofRun.exe
Modifies file system
Creates the following files
- %TEMP%\{3f6b8166-4e32-44c0-9fbb-ca07f25bc3a1}\linjiansetup.exe
- C:\chkproof_linjian\msvcr80.dll
- C:\chkproof_linjian\msvcr71.dll
- C:\chkproof_linjian\mfc42.dll
- C:\chkproof_linjian\hivereader.dll
- C:\chkproof_linjian\hiveproxy64.exe
- C:\chkproof_linjian\hiveproxy.exe
- C:\chkproof_linjian\hidapi.dll
- C:\chkproof_linjian\dbghelp.dll
- C:\chkproof_linjian\api209x_dll_m.dll
- C:\chkproof_linjian\zhpex.exe
- C:\chkproof_linjian\zfulib.dll
- C:\chkproof_linjian\zfuncompress.dll
- C:\chkproof_linjian\zfhookpolicy.dll
- C:\chkproof_linjian\netclient.dll
- C:\chkproof_linjian\zfhookctrlext.dll
- C:\chkproof_linjian\zfgetfiletext.dll
- C:\chkproof_linjian\zffilewatch.dll
- C:\chkproof_linjian\zfchkpro.exe
- C:\chkproof_linjian\zfchkdeeppro.exe
- C:\chkproof_linjian\zlib1.dll
- C:\chkproof_linjian\zfnetcommon.dll
- C:\chkproof_linjian\zfchkpass64.exe
- C:\chkproof_linjian\zfchkpass.exe
- C:\chkproof_linjian\xmlparser.dll
- C:\chkproof_linjian\wpsjude.dll
- C:\chkproof_linjian\whitefiles.db
- C:\chkproof_linjian\verifysign.dll
- C:\chkproof_linjian\uninstall.dll
- C:\chkproof_linjian\zfhookctrl.dll
- C:\chkproof_linjian\data\win2000pack.txt
- %TEMP%\nsb9fc8.tmp\system.dll
- C:\chkproof_linjian\sensitive_sqlitereport.dll
- %TEMP%\nsb9fc8.tmp\services.dll
- C:\chkproof_linjian\organization.txt
- C:\chkproof_linjian\zfchkproofsetting.ini
- C:\chkproof_linjian\uninst.exe
- C:\chkproof_linjian\skin\background1.jpg
- C:\chkproof_linjian\skin\login.jpg
- C:\chkproof_linjian\linjianprogress.exe
- C:\chkproof_linjian\chkregister.exe
- C:\chkproof_linjian\chkproof_linjian.exe
- C:\chkproof_linjian\chkproofrun.exe
- C:\chkproof_linjian\ppp\dialupass.exe
- C:\chkproof_linjian\log\dbgview.exe
- C:\chkproof_linjian\data\zfchkpoof64.reg
- C:\chkproof_linjian\systemser.txt
- C:\chkproof_linjian\data\zfchkpoof32.reg
- C:\chkproof_linjian\data\secpolx64.exe
- C:\chkproof_linjian\data\databasesoftwarelist.ini
- C:\chkproof_linjian\config\osrun.config
- C:\chkproof_linjian\config\os.config
- C:\chkproof_linjian\zfhid.dll
- C:\chkproof_linjian\zfgetkeyinfo.exe
- C:\chkproof_linjian\vid.ids
- C:\chkproof_linjian\usbinfo.xml
- C:\chkproof_linjian\unrar.dll
- C:\chkproof_linjian\tableconfig.xml
- C:\chkproof_linjian\super64.sys
- C:\chkproof_linjian\super.sys
- C:\chkproof_linjian\sqlite3.dll
- C:\chkproof_linjian\nlhtml.dll
- C:\chkproof_linjian\psapi.dll
- C:\chkproof_linjian\systemsecurity.dll
- C:\chkproof_linjian\ksofficefiletohtml.exe
- C:\chkproof_linjian\hddcompany.ini
- C:\chkproof_linjian\getfilefromsector.dll
- C:\chkproof_linjian\geteveryfiles.dll
- C:\chkproof_linjian\getdisktime.dll
- C:\chkproof_linjian\function.dll
- C:\chkproof_linjian\findibw.dll
- C:\chkproof_linjian\fileoperate.dll
- C:\chkproof_linjian\fileinfocheck.dll
- C:\chkproof_linjian\filerecordcheck.dll
- C:\chkproof_linjian\eventidlist.xml
- C:\chkproof_linjian\diskdirectory.dll
- C:\chkproof_linjian\deepcheckbuffersend.dll
- C:\chkproof_linjian\deepcheck.dll
- C:\chkproof_linjian\hookhide.dll
- C:\chkproof_linjian\connecteddevice.dll
- C:\chkproof_linjian\commfunction.dll
- C:\chkproof_linjian\chkfornetclient.dll
- C:\chkproof_linjian\checksupport.dll
- C:\chkproof_linjian\cardverify.dll
- C:\chkproof_linjian\blackdata.txt
- C:\chkproof_linjian\allfiles.dll
- C:\chkproof_linjian\7zg.exe
- C:\chkproof_linjian\7z.dll
- %TEMP%\{3f6b8166-4e32-44c0-9fbb-ca07f25bc3a1}\hidapi.dll
- %TEMP%\{3f6b8166-4e32-44c0-9fbb-ca07f25bc3a1}\uninstall.dll
- %TEMP%\{3f6b8166-4e32-44c0-9fbb-ca07f25bc3a1}\linjianprogress.exe
- %TEMP%\{3f6b8166-4e32-44c0-9fbb-ca07f25bc3a1}\zfchkproofsetting.ini
- %TEMP%\{3f6b8166-4e32-44c0-9fbb-ca07f25bc3a1}\organization.txt
- C:\chkproof_linjian\computerinfo.dll
- C:\chkproof_linjian\pdfimgextract.dll
- C:\chkproof_linjian\screensaver.ini
- C:\chkproof_linjian\limitpointcheck.exe
- C:\chkproof_linjian\systempolicy.dll
- C:\chkproof_linjian\softwarehivereader.dll
- C:\chkproof_linjian\softwarehiveproxy64.exe
- C:\chkproof_linjian\softwarehiveproxy.exe
- C:\chkproof_linjian\secpolicygroup.ini
- C:\chkproof_linjian\secpol.ini
- C:\chkproof_linjian\rockey2.dll
- C:\chkproof_linjian\reportdll.dll
- C:\chkproof_linjian\pubfunction.dll
- C:\chkproof_linjian\picfilepro.exe
- C:\chkproof_linjian\privatexp.dll
- C:\chkproof_linjian\privatewin7.dll
- C:\chkproof_linjian\policy.ini
- C:\chkproof_linjian\skinmagic.dll
- C:\chkproof_linjian\pdfreader.dll
- C:\chkproof_linjian\osjude.dll
- C:\chkproof_linjian\offfiltx.dll
- C:\chkproof_linjian\offfilt.dll
- C:\chkproof_linjian\newpsp.sys
- C:\chkproof_linjian\newcheck.dll
- C:\chkproof_linjian\netstreamdll.dll
- C:\chkproof_linjian\netsoftwarelist.ini
- C:\chkproof_linjian\netconnectcheck.dll
- C:\chkproof_linjian\ntreg.dll
- C:\chkproof_linjian\netsoftsurportver.ini
- C:\chkproof_linjian\netrecordparse.dll
- C:\chkproof_linjian\msofficefiletohtml.exe
- C:\chkproof_linjian\mfc71.dll
- C:\chkproof_linjian\iconsource.dll
- C:\chkproof_linjian\log\zf_service_log.txt
Deletes the following files
- C:\chkproof_linjian\linjianprogress.exe
- %TEMP%\nsb9fc8.tmp\services.dll
- %TEMP%\nsb9fc8.tmp\system.dll
Network activity
Connects to
- '10.##.132.121':8086
Miscellaneous
Creates and executes the following
- '%TEMP%\{3f6b8166-4e32-44c0-9fbb-ca07f25bc3a1}\linjiansetup.exe' install
- '%TEMP%\{3f6b8166-4e32-44c0-9fbb-ca07f25bc3a1}\linjianprogress.exe'
- 'C:\chkproof_linjian\chkproofrun.exe' /install
- 'C:\chkproof_linjian\chkproofrun.exe'
- 'C:\chkproof_linjian\chkproof_linjian.exe'
