Technical Information
- %APPDATA%\microsoft\windows\start menu\programs\startup\svchostsw.exe
- %TEMP%\s.bat
- %TEMP%\<File name>.exe.pid
- http://17#.##1.14.125:8888/bots/knock?wo######################################
- http://aj###iani.com/etc/phpmyadmin/
- http://al#.com/etc/phpmyadmin/
- http://ko###akorea.com/etc/phpmyadmin/
- http://ef###orts.com/etc/phpmyadmin/
- http://5m#####bookkeeping.com/etc/phpmyadmin/
- http://cu####pcreview.com/etc/phpmyadmin/
- http://ch####cheese.com/etc/phpmyadmin/
- http://en#####isetimes.co.uk/etc/phpmyadmin/
- http://ca###ocpa.com/etc/phpmyadmin/
- http://ac###ncoach.com/etc/phpmyadmin/
- http://da####ekirapa.com/etc/phpmyadmin/
- http://br###ord.com/etc/phpmyadmin/
- http://bl##spy.com/etc/phpmyadmin/
- http://ch####tubmaker.com/etc/phpmyadmin/
- http://ar###ands.com/etc/phpmyadmin/
- http://ap####oodseed.com/etc/phpmyadmin/
- http://cu######ptilehabitats.com/etc/phpmyadmin/
- http://co###rcehub.com/etc/phpmyadmin/
- http://al###cess.com/etc/phpmyadmin/
- http://bo###ainc.com/etc/phpmyadmin/
- http://fk###mwear.com/etc/phpmyadmin/
- http://bo###rush.com/etc/phpmyadmin/
- http://bl##.##ntsplysirona.com/etc/phpmyadmin/
- http://ar##s.com/etc/phpmyadmin/
- http://ad##a.com/etc/phpmyadmin/
- http://as#####oneycoach.com/etc/phpmyadmin/
- http://ai###dia.com/etc/phpmyadmin/
- http://vi##ek.com/etc/phpmyadmin/
- http://ko##on.shop/etc/phpmyadmin/
- http://ab###.spud.com/etc/phpmyadmin/
- http://5d####rs1hour.com/etc/phpmyadmin/
- http://ki###lara.com/etc/phpmyadmin/
- http://ad#####encounter.com/etc/phpmyadmin/
- http://ar#####.concealedcarry.com/etc/phpmyadmin/
- http://ki##aku.com/etc/phpmyadmin/
- http://se##e.com/etc/phpmyadmin/
- http://at##a.com/etc/phpmyadmin/
- http://da######hauntedhouse.com/etc/phpmyadmin/
- http://ca####alcorp.com/etc/phpmyadmin/
- http://el####nsions.com/etc/phpmyadmin/
- http://bl#####rnrestaurant.com/etc/phpmyadmin/
- http://aw######ingofworksheets.com/etc/phpmyadmin/
- http://be######ingaidreviews.com/etc/phpmyadmin/
- http://br#####andballoons.com/etc/phpmyadmin/
- http://jo##an.com/etc/phpmyadmin/
- http://dr###travel.com/etc/phpmyadmin/
- http://cu###eaf.com/etc/phpmyadmin/
- http://co######enterconcrete.com/etc/phpmyadmin/
- http://co#####arymagazine.com/etc/phpmyadmin/
- http://fi##re.com/etc/phpmyadmin/
- http://fl###dfield.com/etc/phpmyadmin/
- http://be#######tersciencedegrees.com/etc/phpmyadmin/
- http://jb##eam.com/etc/phpmyadmin/
- http://dr###hiayin.com/etc/phpmyadmin/
- http://fa####nrecovery.com/etc/phpmyadmin/
- http://ed######n.storyblocks.com/etc/phpmyadmin/
- http://fu##x.com/etc/phpmyadmin/
- http://de####sleysmith.com/etc/phpmyadmin/
- http://ea###clubig.com/etc/phpmyadmin/
- http://cu###vitae.com/etc/phpmyadmin/
- http://ic##han.com/etc/phpmyadmin/
- http://fo####enwife.com/etc/phpmyadmin/
- http://ad#####irstgrade.com/etc/phpmyadmin/
- http://ad####esmedia.com/etc/phpmyadmin/
- http://ea##wp.com/etc/phpmyadmin/
- http://ch######todaymontessori.com/etc/phpmyadmin/
- http://5c####hatlanta.com/etc/phpmyadmin/
- http://ma##et.com/etc/phpmyadmin/
- http://ed###uce.com/etc/phpmyadmin/
- http://im#####asantehniki.com/etc/phpmyadmin/
- http://de####nteriors.com/etc/phpmyadmin/
- http://fi###akeriq.com/etc/phpmyadmin/
- http://fa###yskier.com/etc/phpmyadmin/
- http://ea###hero.com/etc/phpmyadmin/
- http://ka###walker.com/etc/phpmyadmin/
- http://cb####tomshops.com/etc/phpmyadmin/
- http://ca###erica.com/etc/phpmyadmin/
- http://ir###ubg.com/etc/phpmyadmin/
- http://bl##.tmp.com/etc/phpmyadmin/
- http://da###arthub.com/etc/phpmyadmin/
- http://kh####zihemmati.com/etc/phpmyadmin/
- http://di####scueintl.com/etc/phpmyadmin/
- http://jc#.com/etc/phpmyadmin/
- http://bl##.##neerouleau.com/etc/phpmyadmin/
- http://yu###h-card.com/etc/phpmyadmin/
- http://in####ailing.co.uk/etc/phpmyadmin/
- http://fa###ase.com/etc/phpmyadmin/
- http://ex##le.com/etc/phpmyadmin/
- http://ir###ayban.com/etc/phpmyadmin/
- http://fa####dprinting.com/etc/phpmyadmin/
- http://ir###ebshop.com/etc/phpmyadmin/
- http://af####estaysfit.com/etc/phpmyadmin/
- http://em####nknives.com/etc/phpmyadmin/
- http://ju###lus.com/etc/phpmyadmin/
- http://8b##mag.com/etc/phpmyadmin/
- http://www.da####bridal.com/etc/phpmyadmin/
- http://ki###armall.com/etc/phpmyadmin/
- http://an###rfirst.com/etc/phpmyadmin/
- http://ge####imitive.com/etc/phpmyadmin/
- http://wo#.com/etc/phpmyadmin/
- http://ke####ogistics.com/etc/phpmyadmin/
- http://is###syria.com/etc/phpmyadmin/
- http://jo##la.com/etc/phpmyadmin/
- http://ke###cinta.com/etc/phpmyadmin/
- http://fi####xstove.com/etc/phpmyadmin/
- http://kt#.com/etc/phpmyadmin/
- http://is#.com/etc/phpmyadmin/
- http://eb##7.com/etc/phpmyadmin/
- http://jo#####instruments.com/etc/phpmyadmin/
- http://ke###rusa.com/etc/phpmyadmin/
- http://br##ers.com/etc/phpmyadmin/
- http://kf##.com/etc/phpmyadmin/
- http://kn###india.com/etc/phpmyadmin/
- http://me###euca.com/etc/phpmyadmin/
- http://ka##dom.com/etc/phpmyadmin/
- http://ka####layurveda.com/etc/phpmyadmin/
- http://in##r.com/etc/phpmyadmin/
- http://ka##pcb.com/etc/phpmyadmin/
- http://so#####ediadaily.com/etc/phpmyadmin/
- http://ev#####yeyecandy.com/etc/phpmyadmin/
- http://ir###ewalt.com/etc/phpmyadmin/
- http://in#####tretailer.com/etc/phpmyadmin/
- http://ko##n.com/etc/phpmyadmin/
- http://17#.##1.14.125:8888/bots/chkVersion?cu####################
- http://17#.##1.14.125:8888/gw?wo############
- http://17#.##1.14.125:8888/gw?wo#####################
- http://ir###tus.com/etc/phpmyadmin/
- http://in#####tipujucich.com/etc/phpmyadmin/
- http://in##lex.com/etc/phpmyadmin/
- http://ja####ponline.com/etc/phpmyadmin/
- http://is###nix.com/etc/phpmyadmin/
- http://ju#####ivehealth.com/etc/phpmyadmin/
- http://17#.##1.14.125:8888/project/active
- http://in###edia.com/etc/phpmyadmin/
- http://in#####iasroboto.com/etc/phpmyadmin/
- http://io##net.com/etc/phpmyadmin/
- http://ir#####ailacademy.com/etc/phpmyadmin/
- http://cl##ist.com/etc/phpmyadmin/
- http://cr####-addicts.com/etc/phpmyadmin/
- http://irkaspersky.com/etc/phpmyadmin/
- http://ki###reds.com/etc/phpmyadmin/
- http://ja###a-hair.com/etc/phpmyadmin/
- http://io##ood.com/etc/phpmyadmin/
- http://ka###hid.com/etc/phpmyadmin/
- http://in###asw.com/etc/phpmyadmin/
- http://ea##acc.com/etc/phpmyadmin/
- http://jo###shop.com/etc/phpmyadmin/
- http://st###.#apsofworld.com/etc/phpmyadmin/
- http://ke###web.com/etc/phpmyadmin/
- http://gy###vapes.com/etc/phpmyadmin/
- http://ma##in.com/etc/phpmyadmin/
- http://10####challenge.com/etc/phpmyadmin/
- http://sp##tan.com/etc/phpmyadmin/
- http://ti##its.com/etc/phpmyadmin/
- http://je##cjh.com/etc/phpmyadmin/
- http://da##on.com/etc/phpmyadmin/
- http://js##ng.com/etc/phpmyadmin/
- http://cl##com.com/etc/phpmyadmin/
- http://ny#.com/etc/phpmyadmin/
- http://jk##my.com/etc/phpmyadmin/
- http://na##.com/etc/phpmyadmin/
- http://mi#######tomotivedesigns.com/etc/phpmyadmin/
- http://ne##ar.com/etc/phpmyadmin/
- http://ge###tore.com/etc/phpmyadmin/
- http://or#####-creations.com/etc/phpmyadmin/
- http://99###fume.com/etc/phpmyadmin/
- http://kl##uu.com/etc/phpmyadmin/
- http://pa##ers.com/etc/phpmyadmin/
- http://ki####unnypony.com/etc/phpmyadmin/
- http://16###aily.com/etc/phpmyadmin/
- http://na####sflavors.com/etc/phpmyadmin/
- http://al#####fensegear.com/etc/phpmyadmin/
- http://me###ood.com/etc/phpmyadmin/
- http://ho##sun.com/etc/phpmyadmin/
- http://da####bridal.com/etc/phpmyadmin/
- http://en####solutions.com/etc/phpmyadmin/
- http://te###nify.com/etc/phpmyadmin/
- http://sn###erdon.com/etc/phpmyadmin/
- http://climbing.com/etc/phpmyadmin/
- http://nu###cargo.com/etc/phpmyadmin/
- http://em###ademy.com/etc/phpmyadmin/
- http://li##or.com/etc/phpmyadmin/
- http://br###ore.com/etc/phpmyadmin/
- http://cm#.com/etc/phpmyadmin/
- http://ca###dio.com/etc/phpmyadmin/
- http://pr###rom.com/etc/phpmyadmin/
- http://ki##tp.com/etc/phpmyadmin/
- http://in###etsa.com/etc/phpmyadmin/
- http://iw#####-i-collect.com/etc/phpmyadmin/
- http://su####avermama.com/etc/phpmyadmin/
- http://vt#.com/etc/phpmyadmin/
- http://jw####aldwaa.com/etc/phpmyadmin/
- http://in##cos.com/etc/phpmyadmin/
- http://ce#####oviejackets.com/etc/phpmyadmin/
- http://cu#####lyexploring.com/etc/phpmyadmin/
- http://ev######ngfinanceblog.com/etc/phpmyadmin/
- DNS ASK ic##han.com
- DNS ASK br###ord.com
- DNS ASK bo###ainc.com
- DNS ASK ch####cheese.com
- DNS ASK cl##ist.com
- DNS ASK da######hauntedhouse.com
- DNS ASK co######enterconcrete.com
- DNS ASK de####sleysmith.com
- DNS ASK co#####arymagazine.com
- DNS ASK co###rcehub.com
- DNS ASK cu#####lyexploring.com
- DNS ASK bl##.##neerouleau.com
- DNS ASK cb####tomshops.com
- DNS ASK cr####-addicts.com
- DNS ASK cu######ptilehabitats.com
- DNS ASK dr###travel.com
- DNS ASK da###arthub.com
- DNS ASK ea###clubig.com
- DNS ASK da####ekirapa.com
- DNS ASK cu###vitae.com
- DNS ASK ef###orts.com
- DNS ASK el####nsions.com
- DNS ASK cu####pcreview.com
- DNS ASK br#####andballoons.com
- DNS ASK bl##.tmp.com
- DNS ASK be#######tersciencedegrees.com
- DNS ASK ca####alcorp.com
- DNS ASK fa##il.com
- DNS ASK ad#####encounter.com
- DNS ASK ar##s.com
- DNS ASK 99###fume.com
- DNS ASK ap####oodseed.com
- DNS ASK al#.com
- DNS ASK ac###ncoach.com
- DNS ASK al###cess.com
- DNS ASK ar###ands.com
- DNS ASK 5d####rs1hour.com
- DNS ASK en#####isetimes.co.uk
- DNS ASK aj###iani.com
- DNS ASK cu###eaf.com
- DNS ASK at##a.com
- DNS ASK aw######ingofworksheets.com
- DNS ASK ar#####.concealedcarry.com
- DNS ASK ca###erica.com
- DNS ASK bo###rush.com
- DNS ASK be######ingaidreviews.com
- DNS ASK ch####tubmaker.com
- DNS ASK bl##.#vehome.com
- DNS ASK bl##.##ntsplysirona.com
- DNS ASK ca###ocpa.com
- DNS ASK bl#####rnrestaurant.com
- DNS ASK bl##spy.com
- DNS ASK as#####oneycoach.com
- DNS ASK eb##7.com
- DNS ASK de####nteriors.com
- DNS ASK ma##et.com
- DNS ASK ch######todaymontessori.com
- DNS ASK af####estaysfit.com
- DNS ASK io##.com
- DNS ASK im#####asantehniki.com
- DNS ASK ad###curity.com
- DNS ASK ah#.com
- DNS ASK ad#####luewilldo.com
- DNS ASK ae####apcorp.com
- DNS ASK ai##ot.com
- DNS ASK an####ribeca.com
- DNS ASK ir###ebshop.com
- DNS ASK ai###dia.com
- DNS ASK ad####esmedia.com
- DNS ASK al##ork.com
- DNS ASK aq###ights.com
- DNS ASK ml#.com
- DNS ASK ar##g.com
- DNS ASK am#####nwineschool.com
- DNS ASK la####.joomla.org
- DNS ASK al####plants.com
- DNS ASK as#####aboutclothes.com
- DNS ASK av###ity.com
- DNS ASK ar###hjoy.com
- DNS ASK ad###ate.com
- DNS ASK ap#####hianmagazine.com
- DNS ASK an###rfirst.com
- DNS ASK 5c####hatlanta.com
- DNS ASK fi##re.com
- DNS ASK ex##le.com
- DNS ASK fl###dfield.com
- DNS ASK dr###hiayin.com
- DNS ASK ed#.##e3doodler.com
- DNS ASK ea###hero.com
- DNS ASK em###ademy.com
- DNS ASK fa####dprinting.com
- DNS ASK fk###mwear.com
- DNS ASK fa###yskier.com
- DNS ASK fo####enwife.com
- DNS ASK ea##wp.com
- DNS ASK di####scueintl.com
- DNS ASK em####nknives.com
- DNS ASK ev#####yeyecandy.com
- DNS ASK fa####nrecovery.com
- DNS ASK fa###ase.com
- DNS ASK ev######ngfinanceblog.com
- DNS ASK ed###uce.com
- DNS ASK fu##x.com
- DNS ASK fu#####emaleleader.com
- DNS ASK 8b##mag.com
- DNS ASK 91.com
- DNS ASK ad#####irstgrade.com
- DNS ASK fi###akeriq.com
- DNS ASK ed######n.storyblocks.com
- DNS ASK ad##a.com
- DNS ASK al#####fensegear.com
- DNS ASK ad#####res.polaris.com
- DNS ASK js##ng.com
- DNS ASK ju###lus.com
- DNS ASK ju#####ivehealth.com
- DNS ASK jw####aldwaa.com
- DNS ASK jy####istics.com
- DNS ASK ka###hid.com
- DNS ASK ka##dom.com
- DNS ASK ka##pcb.com
- DNS ASK ka###walker.com
- DNS ASK jo###shop.com
- DNS ASK ir#####ailacademy.com
- DNS ASK jo#####instruments.com
- DNS ASK ka####layurveda.com
- DNS ASK ke####ogistics.com
- DNS ASK kf##.com
- DNS ASK kh####zihemmati.com
- DNS ASK ki##tp.com
- DNS ASK ki###lara.com
- DNS ASK ki###armall.com
- DNS ASK ki##aku.com
- DNS ASK ki###reds.com
- DNS ASK ki####unnypony.com
- DNS ASK ke###rusa.com
- DNS ASK ke###cinta.com
- DNS ASK ke###web.com
- DNS ASK ay###asca.com
- DNS ASK kl##uu.com
- DNS ASK jc#.com
- DNS ASK in####ailing.co.uk
- DNS ASK in#####iasroboto.com
- DNS ASK in#####tipujucich.com
- DNS ASK in###edia.com
- DNS ASK in##cos.com
- DNS ASK in###etsa.com
- DNS ASK in##lex.com
- DNS ASK in#####tretailer.com
- DNS ASK in####olegolf.com
- DNS ASK io##net.com
- DNS ASK je##cjh.com
- DNS ASK jk##my.com
- DNS ASK io##ood.com
- DNS ASK ir###tus.com
- DNS ASK ir###ewalt.com
- DNS ASK ir###ayban.com
- DNS ASK irkaspersky.com
- DNS ASK is###syria.com
- DNS ASK is###nix.com
- DNS ASK iw#####-i-collect.com
- DNS ASK ja###a-hair.com
- DNS ASK ja####ponline.com
- DNS ASK jb##eam.com
- DNS ASK in###asw.com
- DNS ASK ir###ubg.com
- DNS ASK ar##er.com
- DNS ASK kn###india.com
- DNS ASK ko###akorea.com
- DNS ASK climbing.com
- DNS ASK da####bridal.com
- DNS ASK da##on.com
- DNS ASK ea##acc.com
- DNS ASK ge###tore.com
- DNS ASK ge####imitive.com
- DNS ASK jo##an.com
- DNS ASK ma##in.com
- DNS ASK me###ood.com
- DNS ASK na##.com
- DNS ASK ko##on.shop
- DNS ASK ca###dio.com
- DNS ASK br###ore.com
- DNS ASK ol#.##mlevitz.com
- DNS ASK or#####-creations.com
- DNS ASK pa##ers.com
- DNS ASK se##e.com
- DNS ASK ti##its.com
- DNS ASK vi##ek.com
- DNS ASK 10####challenge.com
- DNS ASK 5m#####bookkeeping.com
- DNS ASK 16###aily.com
- DNS ASK ab###.spud.com
- DNS ASK ne##ar.com
- DNS ASK ny#.com
- DNS ASK ko##n.com
- DNS ASK na####sflavors.com
- DNS ASK jo##la.com
- DNS ASK kt#.com
- DNS ASK en####solutions.com
- DNS ASK fi####xstove.com
- DNS ASK gy###vapes.com
- DNS ASK pr###rom.com
- DNS ASK su####avermama.com
- DNS ASK wo#.com
- DNS ASK br##ers.com
- DNS ASK ce#####oviejackets.com
- DNS ASK cl##com.com
- DNS ASK vt#.com
- DNS ASK yu###h-card.com
- DNS ASK sp##tan.com
- DNS ASK in##r.com
- DNS ASK is#.com
- DNS ASK li##or.com
- DNS ASK me###euca.com
- DNS ASK mi#######tomotivedesigns.com
- DNS ASK nu###cargo.com
- DNS ASK so#####ediadaily.com
- DNS ASK sn###erdon.com
- DNS ASK st###.#apsofworld.com
- DNS ASK te###nify.com
- DNS ASK cm#.com
- DNS ASK ho##sun.com
- DNS ASK as##ct.com
- '%WINDIR%\syswow64\cmd.exe' /Q /C <LS_APPDATA>\Temp/s.bat' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /Q /C <LS_APPDATA>\Temp/s.bat