Technical Information
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'AutoConnect User-mode Center Connectivity' = '<SYSTEM32>\khwxbhjvhrf.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\Controls Remote Shadow Program AutoConnect] 'Start' = '00000002'
- Windows Security Center
- '<SYSTEM32>\aprrfowt.exe' "<SYSTEM32>\khwxbhjvhrf.exe"
- '%WINDIR%\Temp\ztdfqacb3dllkz.exe' -r 43369 tcp
- '%TEMP%\ztdfqacb37eykzrgism9t.exe'
- '<SYSTEM32>\khwxbhjvhrf.exe'
- <SYSTEM32>\yzpjbptis\run
- <SYSTEM32>\yzpjbptis\rng
- %WINDIR%\Temp\ztdfqacb3dllkz.exe
- <SYSTEM32>\yzpjbptis\cfg
- <SYSTEM32>\aprrfowt.exe
- %TEMP%\ztdfqacb37eykzrgism9t.exe
- <SYSTEM32>\yzpjbptis\tst
- <SYSTEM32>\khwxbhjvhrf.exe
- <SYSTEM32>\yzpjbptis\etc
- <SYSTEM32>\aprrfowt.exe
- <SYSTEM32>\khwxbhjvhrf.exe
- %WINDIR%\Temp\ztdfqacb3dllkz.exe
- <DRIVERS>\etc\hosts
- %TEMP%\ztdfqacb37eykzrgism9t.exe
- 'qu###throw.net':80
- 'th###hrow.net':80
- 'th###tock.net':80
- 'he###hole.net':80
- 'qu###stock.net':80
- 'qu###reply.net':80
- 'su###ystock.net':80
- 'mo###tock.net':80
- 'th###hole.net':80
- 'th###eply.net':80
- 'qu###whole.net':80
- 'si###whole.net':80
- 'ca###tock.net':80
- 'th###whole.net':80
- 'th###reply.net':80
- 'si###reply.net':80
- 'he###tock.net':80
- 'he###eply.net':80
- 'ca###hole.net':80
- 'ca###eply.net':80
- 'ca###hrow.net':80
- 'he###hrow.net':80
- 'cl###stock.net':80
- 'da###tock.net':80
- 'si###hole.net':80
- 'si###eply.net':80
- 'me###hole.net':80
- 'cl###throw.net':80
- 'cl###whole.net':80
- 'da###hole.net':80
- 'da###eply.net':80
- 'da###hrow.net':80
- 'cl###reply.net':80
- 'mo###eply.net':80
- 'su###ywhole.net':80
- 'su###yreply.net':80
- 'su###ythrow.net':80
- 'mo###hrow.net':80
- 'mo###hole.net':80
- 'si###hrow.net':80
- 'me###eply.net':80
- 'me###hrow.net':80
- 'me###tock.net':80
- 'si###tock.net':80
- 'si###throw.net':80
- 'si###oud.net':80
- 'me###ree.net':80
- 'me###oud.net':80
- 'me####ousand.net':80
- 'si####ousand.net':80
- 'si###ree.net':80
- 'da####ousand.net':80
- 'cl###loud.net':80
- 'cl####housand.net':80
- 'cl####aturday.net':80
- 'da####turday.net':80
- 'de###lxc.com':80
- 'mo####ousand.net':80
- 'be##lxc.com':80
- 'ri###nstorm.net':80
- 'af###sllc.com':80
- 'su###yloud.net':80
- 'me####turday.net':80
- 'si####turday.net':80
- 'mo###ree.net':80
- 'mo###oud.net':80
- 'su###ytree.net':80
- 'du###hrow.net':80
- 'wi###eply.net':80
- 'wi###hrow.net':80
- 'wi###tock.net':80
- 'du###tock.net':80
- 'du###eply.net':80
- 'si###stock.net':80
- 'th###throw.net':80
- 'th###stock.net':80
- 'wi###hole.net':80
- 'du###hole.net':80
- 'mi###tock.net':80
- 'tr###stock.net':80
- 'da###ree.net':80
- 'da###oud.net':80
- 'cl###tree.net':80
- 'mi###hrow.net':80
- 'mi###hole.net':80
- 'tr###whole.net':80
- 'tr###reply.net':80
- 'tr###throw.net':80
- 'mi###eply.net':80
- http://qu###throw.net/index.php
- http://th###hrow.net/index.php
- http://th###tock.net/index.php
- http://he###hole.net/index.php
- http://qu###stock.net/index.php
- http://qu###reply.net/index.php
- http://su###ystock.net/index.php
- http://mo###tock.net/index.php
- http://th###hole.net/index.php
- http://th###eply.net/index.php
- http://qu###whole.net/index.php
- http://si###whole.net/index.php
- http://ca###tock.net/index.php
- http://th###whole.net/index.php
- http://th###reply.net/index.php
- http://si###reply.net/index.php
- http://he###tock.net/index.php
- http://he###eply.net/index.php
- http://ca###hole.net/index.php
- http://ca###eply.net/index.php
- http://ca###hrow.net/index.php
- http://he###hrow.net/index.php
- http://cl###stock.net/index.php
- http://da###tock.net/index.php
- http://si###hole.net/index.php
- http://si###eply.net/index.php
- http://me###hole.net/index.php
- http://cl###throw.net/index.php
- http://cl###whole.net/index.php
- http://da###hole.net/index.php
- http://da###eply.net/index.php
- http://da###hrow.net/index.php
- http://cl###reply.net/index.php
- http://mo###eply.net/index.php
- http://su###ywhole.net/index.php
- http://su###yreply.net/index.php
- http://su###ythrow.net/index.php
- http://mo###hrow.net/index.php
- http://mo###hole.net/index.php
- http://si###hrow.net/index.php
- http://me###eply.net/index.php
- http://me###hrow.net/index.php
- http://me###tock.net/index.php
- http://si###tock.net/index.php
- http://si###throw.net/index.php
- http://si###oud.net/index.php
- http://me###ree.net/index.php
- http://me###oud.net/index.php
- http://me####ousand.net/index.php
- http://si####ousand.net/index.php
- http://si###ree.net/index.php
- http://da####ousand.net/index.php
- http://cl###loud.net/index.php
- http://cl####housand.net/index.php
- http://cl####aturday.net/index.php
- http://da####turday.net/index.php
- http://de###lxc.com/index.php
- http://mo####ousand.net/index.php
- http://be##lxc.com/index.php
- http://ri###nstorm.net/index.php
- http://af###sllc.com/index.php
- http://su###yloud.net/index.php
- http://me####turday.net/index.php
- http://si####turday.net/index.php
- http://mo###ree.net/index.php
- http://mo###oud.net/index.php
- http://su###ytree.net/index.php
- http://du###hrow.net/index.php
- http://wi###eply.net/index.php
- http://wi###hrow.net/index.php
- http://wi###tock.net/index.php
- http://du###tock.net/index.php
- http://du###eply.net/index.php
- http://si###stock.net/index.php
- http://th###throw.net/index.php
- http://th###stock.net/index.php
- http://wi###hole.net/index.php
- http://du###hole.net/index.php
- http://mi###tock.net/index.php
- http://tr###stock.net/index.php
- http://da###ree.net/index.php
- http://da###oud.net/index.php
- http://cl###tree.net/index.php
- http://mi###hrow.net/index.php
- http://mi###hole.net/index.php
- http://tr###whole.net/index.php
- http://tr###reply.net/index.php
- http://tr###throw.net/index.php
- http://mi###eply.net/index.php
- DNS ASK th###tock.net
- DNS ASK qu###throw.net
- DNS ASK qu###stock.net
- DNS ASK ca###hole.net
- DNS ASK he###hole.net
- DNS ASK th###hrow.net
- DNS ASK th###hole.net
- DNS ASK su###ystock.net
- DNS ASK qu###whole.net
- DNS ASK qu###reply.net
- DNS ASK th###eply.net
- DNS ASK th###whole.net
- DNS ASK si###whole.net
- DNS ASK si###reply.net
- DNS ASK si###throw.net
- DNS ASK th###reply.net
- DNS ASK ca###tock.net
- DNS ASK ca###eply.net
- DNS ASK he###eply.net
- DNS ASK he###hrow.net
- DNS ASK he###tock.net
- DNS ASK ca###hrow.net
- DNS ASK mo###tock.net
- DNS ASK cl###stock.net
- DNS ASK da###tock.net
- DNS ASK si###hole.net
- DNS ASK si###eply.net
- DNS ASK me###hole.net
- DNS ASK cl###throw.net
- DNS ASK cl###whole.net
- DNS ASK da###hole.net
- DNS ASK da###eply.net
- DNS ASK da###hrow.net
- DNS ASK cl###reply.net
- DNS ASK mo###eply.net
- DNS ASK su###ywhole.net
- DNS ASK su###yreply.net
- DNS ASK su###ythrow.net
- DNS ASK mo###hrow.net
- DNS ASK mo###hole.net
- DNS ASK si###hrow.net
- DNS ASK me###eply.net
- DNS ASK me###hrow.net
- DNS ASK me###tock.net
- DNS ASK si###tock.net
- DNS ASK si###oud.net
- DNS ASK me###ree.net
- DNS ASK me###oud.net
- DNS ASK me####ousand.net
- DNS ASK si####ousand.net
- DNS ASK si###ree.net
- DNS ASK da####ousand.net
- DNS ASK cl###loud.net
- DNS ASK cl####housand.net
- DNS ASK cl####aturday.net
- DNS ASK da####turday.net
- DNS ASK de###lxc.com
- DNS ASK mo####ousand.net
- DNS ASK be##lxc.com
- DNS ASK ri###nstorm.net
- DNS ASK af###sllc.com
- DNS ASK su###yloud.net
- DNS ASK me####turday.net
- DNS ASK si####turday.net
- DNS ASK mo###ree.net
- DNS ASK mo###oud.net
- DNS ASK su###ytree.net
- DNS ASK du###hrow.net
- DNS ASK wi###eply.net
- DNS ASK wi###hrow.net
- DNS ASK wi###tock.net
- DNS ASK du###tock.net
- DNS ASK du###eply.net
- DNS ASK si###stock.net
- DNS ASK th###throw.net
- DNS ASK th###stock.net
- DNS ASK wi###hole.net
- DNS ASK du###hole.net
- DNS ASK mi###tock.net
- DNS ASK tr###stock.net
- DNS ASK da###ree.net
- DNS ASK da###oud.net
- DNS ASK cl###tree.net
- DNS ASK mi###hrow.net
- DNS ASK mi###hole.net
- DNS ASK tr###whole.net
- DNS ASK tr###reply.net
- DNS ASK tr###throw.net
- DNS ASK mi###eply.net
- '23#.#55.255.250':1900