Technical Information
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Panel AutoConnect Sharing' = '<SYSTEM32>\gtzolnws.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\Manager IP Task RPC Connectivity Encrypting] 'ImagePath' = '<SYSTEM32>\gtzolnws.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\Manager IP Task RPC Connectivity Encrypting] 'Start' = '00000002'
- Windows Security Center
- '<SYSTEM32>\zqwddnaneuvs.exe' "<SYSTEM32>\gtzolnws.exe"
- '%WINDIR%\Temp\liyhojc2omabg0.exe' -r 44850 tcp
- '%TEMP%\liyhojc2jybbg0rla2rpx.exe'
- '<SYSTEM32>\gtzolnws.exe'
- <SYSTEM32>\yscnrxca\run
- <SYSTEM32>\yscnrxca\rng
- %WINDIR%\Temp\liyhojc2omabg0.exe
- <SYSTEM32>\yscnrxca\cfg
- <SYSTEM32>\zqwddnaneuvs.exe
- %TEMP%\liyhojc2jybbg0rla2rpx.exe
- <SYSTEM32>\yscnrxca\tst
- <SYSTEM32>\gtzolnws.exe
- <SYSTEM32>\yscnrxca\etc
- <SYSTEM32>\zqwddnaneuvs.exe
- <SYSTEM32>\gtzolnws.exe
- %WINDIR%\Temp\liyhojc2omabg0.exe
- <DRIVERS>\etc\hosts
- %TEMP%\liyhojc2jybbg0rla2rpx.exe
- 'de###uide.net':80
- 'sh###late.net':80
- 'sh###guide.net':80
- 'sh###name.net':80
- 'de###ame.net':80
- 'de###ate.net':80
- 'fr###yname.net':80
- 'pu###uide.net':80
- 'pu###ame.net':80
- 'pu###alf.net':80
- 'fr###yhalf.net':80
- 'mo###name.net':80
- 'ti###ame.net':80
- 'ti###alf.net':80
- 'li###ate.net':80
- 'mo###half.net':80
- 'mo###guide.net':80
- 'sh###half.net':80
- 'de###alf.net':80
- 'ti###ate.net':80
- 'ti###uide.net':80
- 'mo###late.net':80
- 'so###ast.net':80
- 'lo###ady.net':80
- 'lo###ast.net':80
- 'lo###ing.net':80
- 'so###ing.net':80
- 'so###ady.net':80
- 'sa###ing.net':80
- 'wh###past.net':80
- 'wh###wing.net':80
- 'lo###ish.net':80
- 'so###ish.net':80
- 'al###half.net':80
- 'de####erhalf.net':80
- 'fr###ylate.net':80
- 'fr###yguide.net':80
- 'pu###ate.net':80
- 'al###name.net':80
- 'al###late.net':80
- 'de####erlate.net':80
- 'de####erguide.net':80
- 'de####ername.net':80
- 'al###guide.net':80
- 'so###alf.net':80
- 'lo###ame.net':80
- 'lo###alf.net':80
- 'al###only.net':80
- 'de####eronly.net':80
- 'so###ame.net':80
- 'so###ate.net':80
- 'wh###half.net':80
- 'lo###ate.net':80
- 'lo###uide.net':80
- 'so###uide.net':80
- 'mi###hown.net':80
- 'ab###ell.net':80
- 'mo###ugust.net':80
- 'cr#####onaraminta.net':80
- 'le###form.net':80
- 'mo###olor.net':80
- 'ri###nstorm.net':80
- 'be##lxc.com':80
- 'al###being.net':80
- 'pr####tbottom.net':80
- 'ca####nbring.net':80
- 'ba###ate.net':80
- 'en###half.net':80
- 'st###late.net':80
- 'st###guide.net':80
- 'ba###uide.net':80
- 'li###alf.net':80
- 'li###uide.net':80
- 'en###late.net':80
- 'en###guide.net':80
- 'en###name.net':80
- 'li###ame.net':80
- 'wh###guide.net':80
- 'sa###uide.net':80
- 'sa###ame.net':80
- 'sa###alf.net':80
- 'wh###name.net':80
- 'wh###late.net':80
- 'st###name.net':80
- 'ba###ame.net':80
- 'ba###alf.net':80
- 'sa###ate.net':80
- 'st###half.net':80
- http://de###uide.net/index.php
- http://sh###late.net/index.php
- http://sh###guide.net/index.php
- http://sh###name.net/index.php
- http://de###ame.net/index.php
- http://de###ate.net/index.php
- http://fr###yname.net/index.php
- http://pu###uide.net/index.php
- http://pu###ame.net/index.php
- http://pu###alf.net/index.php
- http://fr###yhalf.net/index.php
- http://mo###name.net/index.php
- http://ti###ame.net/index.php
- http://ti###alf.net/index.php
- http://li###ate.net/index.php
- http://mo###half.net/index.php
- http://mo###guide.net/index.php
- http://sh###half.net/index.php
- http://de###alf.net/index.php
- http://ti###ate.net/index.php
- http://ti###uide.net/index.php
- http://mo###late.net/index.php
- http://so###ast.net/index.php
- http://lo###ady.net/index.php
- http://lo###ast.net/index.php
- http://lo###ing.net/index.php
- http://so###ing.net/index.php
- http://so###ady.net/index.php
- http://sa###ing.net/index.php
- http://wh###past.net/index.php
- http://wh###wing.net/index.php
- http://lo###ish.net/index.php
- http://so###ish.net/index.php
- http://al###half.net/index.php
- http://de####erhalf.net/index.php
- http://fr###ylate.net/index.php
- http://fr###yguide.net/index.php
- http://pu###ate.net/index.php
- http://al###name.net/index.php
- http://al###late.net/index.php
- http://de####erlate.net/index.php
- http://de####erguide.net/index.php
- http://de####ername.net/index.php
- http://al###guide.net/index.php
- http://so###alf.net/index.php
- http://lo###ame.net/index.php
- http://lo###alf.net/index.php
- http://al###only.net/index.php
- http://de####eronly.net/index.php
- http://so###ame.net/index.php
- http://so###ate.net/index.php
- http://wh###half.net/index.php
- http://lo###ate.net/index.php
- http://lo###uide.net/index.php
- http://so###uide.net/index.php
- http://mi###hown.net/index.php
- http://ab###ell.net/index.php
- http://mo###ugust.net/index.php
- http://cr#####onaraminta.net/index.php
- http://le###form.net/index.php
- http://mo###olor.net/index.php
- http://ri###nstorm.net/index.php
- http://be##lxc.com/index.php
- http://al###being.net/index.php
- http://pr####tbottom.net/index.php
- http://ca####nbring.net/index.php
- http://ba###ate.net/index.php
- http://en###half.net/index.php
- http://st###late.net/index.php
- http://st###guide.net/index.php
- http://ba###uide.net/index.php
- http://li###alf.net/index.php
- http://li###uide.net/index.php
- http://en###late.net/index.php
- http://en###guide.net/index.php
- http://en###name.net/index.php
- http://li###ame.net/index.php
- http://wh###guide.net/index.php
- http://sa###uide.net/index.php
- http://sa###ame.net/index.php
- http://sa###alf.net/index.php
- http://wh###name.net/index.php
- http://wh###late.net/index.php
- http://st###name.net/index.php
- http://ba###ame.net/index.php
- http://ba###alf.net/index.php
- http://sa###ate.net/index.php
- http://st###half.net/index.php
- DNS ASK de###uide.net
- DNS ASK sh###late.net
- DNS ASK sh###guide.net
- DNS ASK sh###name.net
- DNS ASK de###ame.net
- DNS ASK de###ate.net
- DNS ASK fr###yname.net
- DNS ASK pu###uide.net
- DNS ASK pu###ame.net
- DNS ASK pu###alf.net
- DNS ASK fr###yhalf.net
- DNS ASK mo###name.net
- DNS ASK ti###ame.net
- DNS ASK ti###alf.net
- DNS ASK li###ate.net
- DNS ASK mo###half.net
- DNS ASK mo###guide.net
- DNS ASK sh###half.net
- DNS ASK de###alf.net
- DNS ASK ti###ate.net
- DNS ASK ti###uide.net
- DNS ASK mo###late.net
- DNS ASK fr###yguide.net
- DNS ASK lo###ady.net
- DNS ASK so###ady.net
- DNS ASK so###ast.net
- DNS ASK so###ing.net
- DNS ASK lo###ast.net
- DNS ASK lo###ish.net
- DNS ASK wh###past.net
- DNS ASK sa###ast.net
- DNS ASK sa###ing.net
- DNS ASK so###ish.net
- DNS ASK wh###wing.net
- DNS ASK de####erhalf.net
- DNS ASK al###name.net
- DNS ASK al###half.net
- DNS ASK pu###ate.net
- DNS ASK fr###ylate.net
- DNS ASK de####ername.net
- DNS ASK de####erlate.net
- DNS ASK lo###ing.net
- DNS ASK al###late.net
- DNS ASK al###guide.net
- DNS ASK de####erguide.net
- DNS ASK so###alf.net
- DNS ASK lo###ame.net
- DNS ASK lo###alf.net
- DNS ASK al###only.net
- DNS ASK de####eronly.net
- DNS ASK so###ame.net
- DNS ASK so###ate.net
- DNS ASK wh###half.net
- DNS ASK lo###ate.net
- DNS ASK lo###uide.net
- DNS ASK so###uide.net
- DNS ASK mi###hown.net
- DNS ASK ab###ell.net
- DNS ASK mo###ugust.net
- DNS ASK cr#####onaraminta.net
- DNS ASK le###form.net
- DNS ASK mo###olor.net
- DNS ASK ri###nstorm.net
- DNS ASK be##lxc.com
- DNS ASK al###being.net
- DNS ASK pr####tbottom.net
- DNS ASK ca####nbring.net
- DNS ASK ba###ate.net
- DNS ASK en###half.net
- DNS ASK st###late.net
- DNS ASK st###guide.net
- DNS ASK ba###uide.net
- DNS ASK li###alf.net
- DNS ASK li###uide.net
- DNS ASK en###late.net
- DNS ASK en###guide.net
- DNS ASK en###name.net
- DNS ASK li###ame.net
- DNS ASK wh###guide.net
- DNS ASK sa###uide.net
- DNS ASK sa###ame.net
- DNS ASK sa###alf.net
- DNS ASK wh###name.net
- DNS ASK wh###late.net
- DNS ASK st###name.net
- DNS ASK ba###ame.net
- DNS ASK ba###alf.net
- DNS ASK sa###ate.net
- DNS ASK st###half.net
- '23#.#55.255.250':1900