Trojan.Proxy.25558

Technical Information

To ensure autorun and distribution:

Modifies the following registry keys:

[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Nyunz' = '%APPDATA%\Roaming\Evtuti\nyunz.exe'

Malicious functions:

Creates and executes the following:

'%APPDATA%\Roaming\Evtuti\nyunz.exe'

Executes the following:

'<SYSTEM32>\rundll32.exe' <SYSTEM32>\FirewallControlPanel.dll,ShowNotificationDialog /ETOnly 0 /OnProfiles 6 /OtherAllowed 0 /OtherBlocked 0 /OtherEdgeAllowed 0 /NewBlocked 4 "<SYSTEM32>\taskhost.exe"

Injects code into

the following system processes:

<SYSTEM32>\cmd.exe

Modifies file system :

Creates the following files:

<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\hexombyjnfemyroydpfwkmcubqx_org[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\cmgydxrwuoqkivvculjsclnr_info[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\dimbgqofailnwcqdttbycmvxs_biz[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\pjkffmifalxkdifyrkxhawcgaeuhe_net[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\dsgugihdaywkfcafqzjbdlj_com[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\lyhytdztnbknsclcqfbupznrai_info[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\wxtojbhuvsqwgaqsnzxmveixh_org[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\hqpjnibdtoljhaaurizypxsvkdh_ru[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\lhmnfibficydmhgehdqrsnmnhx_com[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\aiqwijqklnjnqckzsskhortcgmaylf_ru[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\mrpvuwoxepfmrhqvoibmrkfby_com[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\fqxwqstntkqwovnjrgizzhhedp_ru[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\kvuclbinzwsqkxbeflnxcvwl_biz[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\cydmypvugnjttcuomjcuxsarg_info[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\jnbigmxmzdtbqqwlfaqfyxkug_com[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\luszlwohiscuemdyhalnjxk_net[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\vswpbizqctpbonkreyzptgevczx_com[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\hdmzldqtmnbuzteqcqsozpuw_biz[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\jfaicuhzqgzmjzljnxprruwcq_org[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\xbmzdtbetolzhonpiihaaipg_net[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\xkguuogiwgciojbuxfmlvgcyx_com[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\ugmzldpgevstylkfmwm_ru[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\oblypeqdydukrgdyytdmroqm_biz[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\swfunrmrhqnzhudqeyvbahlr_net[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\lblrpzxpjxgjrlvdzpdqgtbmhi_com[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\aifulrhyxguknwonxxwkrhabed_info[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\llnayttgyskfynjofydtnfge_com[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\wcswpzguvclfuxbatshufurdh_biz[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\lrbeugmbleapvwnzlrweutrcdm_org[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\biobcahqdqbmukbedfemjf_info[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\amnbyhqhedaamshavvoxkrgy_com[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\krvaepjeixpzijhawcsgvtuckvoj_net[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\pcurkpvptoqocmbewclpvjbueq_biz[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\tczdxpxgrkprmljawomzpx_ru[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\rhmrocyulvhibadirttmniz_org[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\dojtodkbrpozvphhaxjfifxk_ru[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\skvkwklmfxslfztrwhkbnbord_com[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\pfivpzaygesodgakzpvsprrozvotk_biz[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\xjvcalkjjrdsvsojxobmpdq_com[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\ytztptwgqlvstsqmvgafecyx_net[1]
<LS_APPDATA>\Microsoft\Windows Mail\edb.log
%TEMP%\BNR8BE5.bat
<LS_APPDATA>\Microsoft\Windows Mail\Local Folders\Drafts\winmail.fol
<LS_APPDATA>\Microsoft\Windows Mail\Local Folders\Junk E-mail\winmail.fol
<LS_APPDATA>\Microsoft\Windows Mail\Local Folders\Inbox\6E9C25DC-00000001.eml
%TEMP%\Tar3C45.tmp
%TEMP%\ppcrlui_240_2
<LS_APPDATA>\Microsoft\Windows Mail\Local Folders\Inbox\6E9C25DC-00000001.eml:OECustomProperty
%TEMP%\Cab3C44.tmp
<LS_APPDATA>\Microsoft\Windows Mail\Local Folders\Deleted Items\winmail.fol
<LS_APPDATA>\Microsoft\Windows Mail\Backup\temp\WindowsMail.MSMessageStore
<LS_APPDATA>\Microsoft\Windows Mail\edbtmp.log
%APPDATA%\Roaming\Evtuti\nyunz.exe
<LS_APPDATA>\Microsoft\Windows Mail\tmp.edb
<LS_APPDATA>\Microsoft\Windows Mail\Backup\temp\edb00002.log
<LS_APPDATA>\Microsoft\Windows Mail\Local Folders\Outbox\winmail.fol
<LS_APPDATA>\Microsoft\Windows Mail\Local Folders\Sent Items\winmail.fol
<LS_APPDATA>\Microsoft\Windows Mail\Backup\temp\WindowsMail.pat
<LS_APPDATA>\Microsoft\Windows Mail\Local Folders\Inbox\winmail.fol
<LS_APPDATA>Low\Microsoft\CryptnetUrlCache\MetaData\E6024EAC88E6B6165D49FE3C95ADD735
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\wojjzpjmpqwcecihqpbdqyxayfu_com[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\kbhmrditgevwxogkhqztmfgylv_info[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\heuocistuwbahyhywcayrw_biz[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\zgdcuonsotkwshembayxtbagq_ru[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\ltguscytkdqpvtcqmztbydskeymz_org[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\adwkpytpndmvorfayhpvnzqsws_ru[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\fyiryptuciraitsvgutypdy_com[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\cizmzmwohikzuwppscqsoae_biz[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\bqvgyhgithecqfmoqytjvrgzx_com[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\qzlucxbqvbyvwdwsvxwzphya_info[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\eaxuwdmgqbmnfuonjgitklguvkmbv_org[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\decqdmjlgekrzlfedapydlhbizh_net[1]
<LS_APPDATA>Low\Microsoft\CryptnetUrlCache\Content\E6024EAC88E6B6165D49FE3C95ADD735
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\dqgaglvdphrogimzttganzlrpv_info[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\hqcxgbahgirkemhmjfubipn_com[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\qfytkupdxcumrhewpzpbmgyae_net[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\wovvkfypvwmvbaorydmcirgob_org[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\nfonnvrsqgcmvogillnfeiqcscxwei_ru[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\bxyxyxwswgedqnvqumjyxrdy_com[1]

Deletes the following files:

<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\xbmzdtbetolzhonpiihaaipg_net[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\wxtojbhuvsqwgaqsnzxmveixh_org[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\lyhytdztnbknsclcqfbupznrai_info[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\pcurkpvptoqocmbewclpvjbueq_biz[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\krvaepjeixpzijhawcsgvtuckvoj_net[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\amnbyhqhedaamshavvoxkrgy_com[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\tczdxpxgrkprmljawomzpx_ru[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\lhmnfibficydmhgehdqrsnmnhx_com[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\pjkffmifalxkdifyrkxhawcgaeuhe_net[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\dimbgqofailnwcqdttbycmvxs_biz[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\aiqwijqklnjnqckzsskhortcgmaylf_ru[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\hexombyjnfemyroydpfwkmcubqx_org[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\hqpjnibdtoljhaaurizypxsvkdh_ru[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\dsgugihdaywkfcafqzjbdlj_com[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\cmgydxrwuoqkivvculjsclnr_info[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\lblrpzxpjxgjrlvdzpdqgtbmhi_com[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\ugmzldpgevstylkfmwm_ru[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\xkguuogiwgciojbuxfmlvgcyx_com[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\wcswpzguvclfuxbatshufurdh_biz[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\llnayttgyskfynjofydtnfge_com[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\aifulrhyxguknwonxxwkrhabed_info[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\lrbeugmbleapvwnzlrweutrcdm_org[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\swfunrmrhqnzhudqeyvbahlr_net[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\xjvcalkjjrdsvsojxobmpdq_com[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\pfivpzaygesodgakzpvsprrozvotk_biz[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\rhmrocyulvhibadirttmniz_org[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\dojtodkbrpozvphhaxjfifxk_ru[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\oblypeqdydukrgdyytdmroqm_biz[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\biobcahqdqbmukbedfemjf_info[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\skvkwklmfxslfztrwhkbnbord_com[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\qzlucxbqvbyvwdwsvxwzphya_info[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\wovvkfypvwmvbaorydmcirgob_org[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\qfytkupdxcumrhewpzpbmgyae_net[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\heuocistuwbahyhywcayrw_biz[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\kbhmrditgevwxogkhqztmfgylv_info[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\wojjzpjmpqwcecihqpbdqyxayfu_com[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\zgdcuonsotkwshembayxtbagq_ru[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\bxyxyxwswgedqnvqumjyxrdy_com[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\dqgaglvdphrogimzttganzlrpv_info[1]
%TEMP%\Tar3C45.tmp
%TEMP%\Cab3C44.tmp
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\eaxuwdmgqbmnfuonjgitklguvkmbv_org[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\nfonnvrsqgcmvogillnfeiqcscxwei_ru[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\hqcxgbahgirkemhmjfubipn_com[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\decqdmjlgekrzlfedapydlhbizh_net[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\jnbigmxmzdtbqqwlfaqfyxkug_com[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\fqxwqstntkqwovnjrgizzhhedp_ru[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\mrpvuwoxepfmrhqvoibmrkfby_com[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\hdmzldqtmnbuzteqcqsozpuw_biz[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\vswpbizqctpbonkreyzptgevczx_com[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\luszlwohiscuemdyhalnjxk_net[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\jfaicuhzqgzmjzljnxprruwcq_org[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\cydmypvugnjttcuomjcuxsarg_info[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\bqvgyhgithecqfmoqytjvrgzx_com[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\cizmzmwohikzuwppscqsoae_biz[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\ltguscytkdqpvtcqmztbydskeymz_org[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\adwkpytpndmvorfayhpvnzqsws_ru[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\kvuclbinzwsqkxbeflnxcvwl_biz[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\ytztptwgqlvstsqmvgafecyx_net[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\fyiryptuciraitsvgutypdy_com[1]

Moves the following files:

from <LS_APPDATA>\Microsoft\Windows Mail\edbtmp.log to <LS_APPDATA>\Microsoft\Windows Mail\edb.log

Deletes itself.

Network activity:

Connects to:

'xb#######olzhonpiihaaipg.net':80
'wx#######sqwgaqsnzxmveixh.org':80
'ly#######bknsclcqfbupznrai.info':80
'pc#######oqocmbewclpvjbueq.biz':80
'kr########pzijhawcsgvtuckvoj.net':80
'am#######daamshavvoxkrgy.com':80
'tc######rkprmljawomzpx.ru':80
'lh#######cydmhgehdqrsnmnhx.com':80
'pj########xkdifyrkxhawcgaeuhe.net':80
'di#######ilnwcqdttbycmvxs.biz':80
'ai########jnqckzsskhortcgmaylf.ru':80
'he#######femyroydpfwkmcubqx.org':80
'hq#######oljhaaurizypxsvkdh.ru':80
'ds######aywkfcafqzjbdlj.com':80
'cm#######oqkivvculjsclnr.info':80
'lb#######xgjrlvdzpdqgtbmhi.com':80
'ug#####gevstylkfmwm.ru':80
'xk#######gciojbuxfmlvgcyx.com':80
'wc#######clfuxbatshufurdh.biz':80
'll#######skfynjofydtnfge.com':80
'ai#######guknwonxxwkrhabed.info':80
'lr#######eapvwnzlrweutrcdm.org':80
'sw#######qnzhudqeyvbahlr.net':80
'xj######jrdsvsojxobmpdq.com':80
'pf########sodgakzpvsprrozvotk.biz':80
'rh######lvhibadirttmniz.org':80
'do######rpozvphhaxjfifxk.ru':80
'ob#######dukrgdyytdmroqm.biz':80
'bi######dqbmukbedfemjf.info':80
'sk#######xslfztrwhkbnbord.com':80
'vs#######tpbonkreyzptgevczx.com':80
'wo#######wmvbaorydmcirgob.org':80
'qf#######cumrhewpzpbmgyae.net':80
'bx#######gedqnvqumjyxrdy.com':80
'qz#######byvwdwsvxwzphya.info':80
'wo#######qwcecihqpbdqyxayfu.com':80
'zg#######tkwshembayxtbagq.ru':80
'he######uwbahyhywcayrw.biz':80
'nf########cmvogillnfeiqcscxwei.ru':80
'www.bing.com':80
'74.##5.232.51':80
'20#.#6.232.182':80
'dq#######hrogimzttganzlrpv.info':80
'hq######girkemhmjfubipn.com':80
'de#######ekrzlfedapydlhbizh.net':80
'ea########mnfuonjgitklguvkmbv.org':80
'fq#######kqwovnjrgizzhhedp.ru':80
'mr#######pfmrhqvoibmrkfby.com':80
'cy#######njttcuomjcuxsarg.info':80
'jn#######dtbqqwlfaqfyxkug.com':80
'lu######iscuemdyhalnjxk.net':80
'jf#######gzmjzljnxprruwcq.org':80
'hd#######nbuzteqcqsozpuw.biz':80
'kv#######wsqkxbeflnxcvwl.biz':80
'ci######hikzuwppscqsoae.biz':80
'lt########qpvtcqmztbydskeymz.org':80
'kb#######evwxogkhqztmfgylv.info':80
'bq#######hecqfmoqytjvrgzx.com':80
'yt#######lvstsqmvgafecyx.net':80
'fy######ciraitsvgutypdy.com':80
'ad#######dmvorfayhpvnzqsws.ru':80

TCP:

HTTP GET requests:

xb#######olzhonpiihaaipg.net/
wx#######sqwgaqsnzxmveixh.org/
ly#######bknsclcqfbupznrai.info/
pc#######oqocmbewclpvjbueq.biz/
kr########pzijhawcsgvtuckvoj.net/
am#######daamshavvoxkrgy.com/
tc######rkprmljawomzpx.ru/
lh#######cydmhgehdqrsnmnhx.com/
pj########xkdifyrkxhawcgaeuhe.net/
di#######ilnwcqdttbycmvxs.biz/
ai########jnqckzsskhortcgmaylf.ru/
he#######femyroydpfwkmcubqx.org/
hq#######oljhaaurizypxsvkdh.ru/
ds######aywkfcafqzjbdlj.com/
cm#######oqkivvculjsclnr.info/
lb#######xgjrlvdzpdqgtbmhi.com/
ug#####gevstylkfmwm.ru/
xk#######gciojbuxfmlvgcyx.com/
wc#######clfuxbatshufurdh.biz/
ll#######skfynjofydtnfge.com/
ai#######guknwonxxwkrhabed.info/
lr#######eapvwnzlrweutrcdm.org/
sw#######qnzhudqeyvbahlr.net/
xj######jrdsvsojxobmpdq.com/
pf########sodgakzpvsprrozvotk.biz/
rh######lvhibadirttmniz.org/
do######rpozvphhaxjfifxk.ru/
ob#######dukrgdyytdmroqm.biz/
bi######dqbmukbedfemjf.info/
sk#######xslfztrwhkbnbord.com/
vs#######tpbonkreyzptgevczx.com/
wo#######wmvbaorydmcirgob.org/
qf#######cumrhewpzpbmgyae.net/
bx#######gedqnvqumjyxrdy.com/
qz#######byvwdwsvxwzphya.info/
wo#######qwcecihqpbdqyxayfu.com/
zg#######tkwshembayxtbagq.ru/
he######uwbahyhywcayrw.biz/
nf########cmvogillnfeiqcscxwei.ru/
www.bing.com/
74.##5.232.51/
20#.#6.232.182/pki/crl/products/CodeSignPCA.crl
dq#######hrogimzttganzlrpv.info/
hq######girkemhmjfubipn.com/
de#######ekrzlfedapydlhbizh.net/
ea########mnfuonjgitklguvkmbv.org/
fq#######kqwovnjrgizzhhedp.ru/
mr#######pfmrhqvoibmrkfby.com/
cy#######njttcuomjcuxsarg.info/
jn#######dtbqqwlfaqfyxkug.com/
lu######iscuemdyhalnjxk.net/
jf#######gzmjzljnxprruwcq.org/
hd#######nbuzteqcqsozpuw.biz/
kv#######wsqkxbeflnxcvwl.biz/
ci######hikzuwppscqsoae.biz/
lt########qpvtcqmztbydskeymz.org/
kb#######evwxogkhqztmfgylv.info/
bq#######hecqfmoqytjvrgzx.com/
yt#######lvstsqmvgafecyx.net/
fy######ciraitsvgutypdy.com/
ad#######dmvorfayhpvnzqsws.ru/

UDP:

DNS ASK pj########xkdifyrkxhawcgaeuhe.net
DNS ASK he#######femyroydpfwkmcubqx.org
DNS ASK ai########jnqckzsskhortcgmaylf.ru
DNS ASK di#######ilnwcqdttbycmvxs.biz
DNS ASK cm#######oqkivvculjsclnr.info
DNS ASK lh#######cydmhgehdqrsnmnhx.com
DNS ASK ly#######bknsclcqfbupznrai.info
DNS ASK ds######aywkfcafqzjbdlj.com
DNS ASK hq#######oljhaaurizypxsvkdh.ru
DNS ASK vs#######tpbonkreyzptgevczx.com
DNS ASK cy#######njttcuomjcuxsarg.info
DNS ASK mr#######pfmrhqvoibmrkfby.com
DNS ASK yt#######lvstsqmvgafecyx.net
DNS ASK kv#######wsqkxbeflnxcvwl.biz
DNS ASK fq#######kqwovnjrgizzhhedp.ru
DNS ASK jf#######gzmjzljnxprruwcq.org
DNS ASK lu######iscuemdyhalnjxk.net
DNS ASK jn#######dtbqqwlfaqfyxkug.com
DNS ASK hd#######nbuzteqcqsozpuw.biz
DNS ASK wx#######sqwgaqsnzxmveixh.org
DNS ASK sw#######qnzhudqeyvbahlr.net
DNS ASK xk#######gciojbuxfmlvgcyx.com
DNS ASK bi######dqbmukbedfemjf.info
DNS ASK ob#######dukrgdyytdmroqm.biz
DNS ASK ug#####gevstylkfmwm.ru
DNS ASK lr#######eapvwnzlrweutrcdm.org
DNS ASK ai#######guknwonxxwkrhabed.info
DNS ASK lb#######xgjrlvdzpdqgtbmhi.com
DNS ASK wc#######clfuxbatshufurdh.biz
DNS ASK sk#######xslfztrwhkbnbord.com
DNS ASK tc######rkprmljawomzpx.ru
DNS ASK am#######daamshavvoxkrgy.com
DNS ASK xb#######olzhonpiihaaipg.net
DNS ASK pc#######oqocmbewclpvjbueq.biz
DNS ASK kr########pzijhawcsgvtuckvoj.net
DNS ASK xj######jrdsvsojxobmpdq.com
DNS ASK do######rpozvphhaxjfifxk.ru
DNS ASK rh######lvhibadirttmniz.org
DNS ASK pf########sodgakzpvsprrozvotk.biz
DNS ASK ll#######skfynjofydtnfge.com
DNS ASK de#######ekrzlfedapydlhbizh.net
DNS ASK ea########mnfuonjgitklguvkmbv.org
DNS ASK hq######girkemhmjfubipn.com
DNS ASK bx#######gedqnvqumjyxrdy.com
DNS ASK nf########cmvogillnfeiqcscxwei.ru
DNS ASK fy######ciraitsvgutypdy.com
DNS ASK crl.microsoft.com
DNS ASK www.google.com
DNS ASK dq#######hrogimzttganzlrpv.info
DNS ASK www.bing.com
DNS ASK qf#######cumrhewpzpbmgyae.net
DNS ASK lt########qpvtcqmztbydskeymz.org
DNS ASK kb#######evwxogkhqztmfgylv.info
DNS ASK ci######hikzuwppscqsoae.biz
DNS ASK ad#######dmvorfayhpvnzqsws.ru
DNS ASK bq#######hecqfmoqytjvrgzx.com
DNS ASK qz#######byvwdwsvxwzphya.info
DNS ASK wo#######wmvbaorydmcirgob.org
DNS ASK he######uwbahyhywcayrw.biz
DNS ASK wo#######qwcecihqpbdqyxayfu.com
DNS ASK zg#######tkwshembayxtbagq.ru
'99.##6.158.19':16292
'93.##6.38.211':11692
'67.##0.85.16':13375
'41.##3.170.85':12952
'21#.#13.137.50':22142
'18#.#9.228.111':12208
'19#.#39.109.160':18300
'37.##.165.186':16708
'99.##.61.142':18994
'22#.#46.38.109':7243
'18#.#1.30.252':25023
'71.##.167.82':4598
'20#.#15.110.218':443
'10#.#17.117.139':8593
'99.#20.1.3':16809
'20#.#53.236.237':8114
'18#.#47.56.198':4294
'17#.#38.233.29':9710
'46.##.150.70':25357

Miscellaneous:

Searches for the following windows:

ClassName: 'OleMainThreadWndClass' WindowName: '(null)'
ClassName: 'OutlookExpressHiddenWindow' WindowName: '(null)'
ClassName: 'Indicator' WindowName: '(null)'

Technologies

Terminology

Training and education

Myths

Technical Information

Curing recommendations

Free trial