Technical Information
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'List Logon Secondary' = 'C:\kzlxvzrjyhhjrx\jyszmzyy.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\Extensible Registrar Tracking] 'ImagePath' = 'C:\kzlxvzrjyhhjrx\jyszmzyy.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\Extensible Registrar Tracking] 'Start' = '00000002'
- 'C:\kzlxvzrjyhhjrx\awbusiyise.exe' "c:\kzlxvzrjyhhjrx\jyszmzyy.exe"
- 'C:\kzlxvzrjyhhjrx\jyszmzyy.exe'
- 'C:\kzlxvzrjyhhjrx\nuln2nt7srzpeiauylnu.exe'
- C:\kzlxvzrjyhhjrx\jyszmzyy.exe
- C:\kzlxvzrjyhhjrx\awbusiyise.exe
- C:\kzlxvzrjyhhjrx\nuln2nt7srzpeiauylnu.exe
- %WINDIR%\kzlxvzrjyhhjrx\tsstoo
- C:\kzlxvzrjyhhjrx\tsstoo
- C:\kzlxvzrjyhhjrx\awbusiyise.exe
- C:\kzlxvzrjyhhjrx\jyszmzyy.exe
- C:\kzlxvzrjyhhjrx\nuln2nt7srzpeiauylnu.exe
- %WINDIR%\kzlxvzrjyhhjrx\tsstoo
- %WINDIR%\kzlxvzrjyhhjrx\tsstoo
- 'an###rspace.net':80
- 'gl###space.net':80
- 'de###eclose.net':80
- 'fo####dclose.net':80
- 'an####yellow.net':80
- 'gl###yellow.net':80
- 'an####travel.net':80
- 'gl###travel.net':80
- 'fo####dyellow.net':80
- 're####childhood.net':80
- 'de###espace.net':80
- 're####object.net':80
- 'va#####childhood.net':80
- 'fo####dtravel.net':80
- 'de####yellow.net':80
- 'fo####dspace.net':80
- 'de####travel.net':80
- 'an###rclose.net':80
- 'pl####nttravel.net':80
- 'ne####arytravel.net':80
- 'pl####ntspace.net':80
- 'ne####aryspace.net':80
- 'pl####ntclose.net':80
- 'ne####aryclose.net':80
- 'pl####ntyellow.net':80
- 'ne####aryyellow.net':80
- 'he###close.net':80
- 'he###space.net':80
- 'di####ulttravel.net':80
- 'gl###close.net':80
- 'di####ultspace.net':80
- 'he###yellow.net':80
- 'di####ultclose.net':80
- 'he###travel.net':80
- 'di####ultyellow.net':80
- 're####eobject.net':80
- 'or####hildhood.net':80
- 're####ethird.net':80
- 'or###object.net':80
- 'he####station.net':80
- 'le###rthird.net':80
- 're#####childhood.net':80
- 'le####station.net':80
- 'or###third.net':80
- 'pl####ntobject.net':80
- 'ne####aryobject.net':80
- 'pl####ntthird.net':80
- 'ne####arythird.net':80
- 'or####tation.net':80
- 're####estation.net':80
- 'pl#####tchildhood.net':80
- 'ne#####rychildhood.net':80
- 'he###nthird.net':80
- 'ge####childhood.net':80
- 'va####sstation.net':80
- 'ge####object.net':80
- 'he####hildhood.net':80
- 're###nthird.net':80
- 'va####sobject.net':80
- 're####station.net':80
- 'va####sthird.net':80
- 'he###object.net':80
- 'le####childhood.net':80
- 'he####childhood.net':80
- 'le####object.net':80
- 'he####object.net':80
- 'he###third.net':80
- 'ge###ethird.net':80
- 'he####tation.net':80
- 'ge####station.net':80
- http://an###rspace.net/index.php
- http://gl###space.net/index.php
- http://de###eclose.net/index.php
- http://fo####dclose.net/index.php
- http://an####yellow.net/index.php
- http://gl###yellow.net/index.php
- http://an####travel.net/index.php
- http://gl###travel.net/index.php
- http://fo####dyellow.net/index.php
- http://re####childhood.net/index.php
- http://de###espace.net/index.php
- http://re####object.net/index.php
- http://va#####childhood.net/index.php
- http://fo####dtravel.net/index.php
- http://de####yellow.net/index.php
- http://fo####dspace.net/index.php
- http://de####travel.net/index.php
- http://an###rclose.net/index.php
- http://pl####nttravel.net/index.php
- http://ne####arytravel.net/index.php
- http://pl####ntspace.net/index.php
- http://ne####aryspace.net/index.php
- http://pl####ntclose.net/index.php
- http://ne####aryclose.net/index.php
- http://pl####ntyellow.net/index.php
- http://ne####aryyellow.net/index.php
- http://he###close.net/index.php
- http://he###space.net/index.php
- http://di####ulttravel.net/index.php
- http://gl###close.net/index.php
- http://di####ultspace.net/index.php
- http://he###yellow.net/index.php
- http://di####ultclose.net/index.php
- http://he###travel.net/index.php
- http://di####ultyellow.net/index.php
- http://re####eobject.net/index.php
- http://or####hildhood.net/index.php
- http://re####ethird.net/index.php
- http://or###object.net/index.php
- http://he####station.net/index.php
- http://le###rthird.net/index.php
- http://re#####childhood.net/index.php
- http://le####station.net/index.php
- http://or###third.net/index.php
- http://pl####ntobject.net/index.php
- http://ne####aryobject.net/index.php
- http://pl####ntthird.net/index.php
- http://ne####arythird.net/index.php
- http://or####tation.net/index.php
- http://re####estation.net/index.php
- http://pl#####tchildhood.net/index.php
- http://ne#####rychildhood.net/index.php
- http://he###nthird.net/index.php
- http://ge####childhood.net/index.php
- http://va####sstation.net/index.php
- http://ge####object.net/index.php
- http://he####hildhood.net/index.php
- http://re###nthird.net/index.php
- http://va####sobject.net/index.php
- http://re####station.net/index.php
- http://va####sthird.net/index.php
- http://he###object.net/index.php
- http://le####childhood.net/index.php
- http://he####childhood.net/index.php
- http://le####object.net/index.php
- http://he####object.net/index.php
- http://he###third.net/index.php
- http://ge###ethird.net/index.php
- http://he####tation.net/index.php
- http://ge####station.net/index.php
- DNS ASK gl###space.net
- DNS ASK an####travel.net
- DNS ASK fo####dclose.net
- DNS ASK an###rspace.net
- DNS ASK gl###yellow.net
- DNS ASK an###rclose.net
- DNS ASK gl###travel.net
- DNS ASK an####yellow.net
- DNS ASK de###eclose.net
- DNS ASK de###espace.net
- DNS ASK fo####dspace.net
- DNS ASK va#####childhood.net
- DNS ASK re####childhood.net
- DNS ASK de####yellow.net
- DNS ASK fo####dyellow.net
- DNS ASK de####travel.net
- DNS ASK fo####dtravel.net
- DNS ASK gl###close.net
- DNS ASK ne####arytravel.net
- DNS ASK pl####ntyellow.net
- DNS ASK ne####aryspace.net
- DNS ASK pl####nttravel.net
- DNS ASK ne####aryclose.net
- DNS ASK or###space.net
- DNS ASK ne####aryyellow.net
- DNS ASK pl####ntclose.net
- DNS ASK pl####ntspace.net
- DNS ASK di####ulttravel.net
- DNS ASK he###travel.net
- DNS ASK di####ultspace.net
- DNS ASK he###space.net
- DNS ASK di####ultclose.net
- DNS ASK he###close.net
- DNS ASK di####ultyellow.net
- DNS ASK he###yellow.net
- DNS ASK re####object.net
- DNS ASK re####eobject.net
- DNS ASK or####hildhood.net
- DNS ASK re####ethird.net
- DNS ASK or###object.net
- DNS ASK he####station.net
- DNS ASK le###rthird.net
- DNS ASK re#####childhood.net
- DNS ASK le####station.net
- DNS ASK or###third.net
- DNS ASK pl####ntobject.net
- DNS ASK ne####aryobject.net
- DNS ASK pl####ntthird.net
- DNS ASK ne####arythird.net
- DNS ASK or####tation.net
- DNS ASK re####estation.net
- DNS ASK pl#####tchildhood.net
- DNS ASK ne#####rychildhood.net
- DNS ASK he###nthird.net
- DNS ASK ge####childhood.net
- DNS ASK va####sstation.net
- DNS ASK ge####object.net
- DNS ASK he####hildhood.net
- DNS ASK re###nthird.net
- DNS ASK va####sobject.net
- DNS ASK re####station.net
- DNS ASK va####sthird.net
- DNS ASK he###object.net
- DNS ASK le####childhood.net
- DNS ASK he####childhood.net
- DNS ASK le####object.net
- DNS ASK he####object.net
- DNS ASK he###third.net
- DNS ASK ge###ethird.net
- DNS ASK he####tation.net
- DNS ASK ge####station.net