Technical Information
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Shadow Enumerator Telephony Installer' = '<SYSTEM32>\zmblunl.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\Distributed Connectivity] 'ImagePath' = '<SYSTEM32>\zmblunl.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\Distributed Connectivity] 'Start' = '00000002'
- Windows Security Center
- '<SYSTEM32>\yvfpceusnpn.exe' "<SYSTEM32>\zmblunl.exe"
- '%WINDIR%\Temp\dnz3hi152t6dclqk.exe' -r 50925 tcp
- '%TEMP%\dnz3hi152jheclqksonmfp.exe'
- '<SYSTEM32>\zmblunl.exe'
- <SYSTEM32>\ogxymomc\run
- <SYSTEM32>\ogxymomc\rng
- %WINDIR%\Temp\dnz3hi152t6dclqk.exe
- <SYSTEM32>\ogxymomc\cfg
- <SYSTEM32>\yvfpceusnpn.exe
- %TEMP%\dnz3hi152jheclqksonmfp.exe
- <SYSTEM32>\ogxymomc\tst
- <SYSTEM32>\zmblunl.exe
- <SYSTEM32>\ogxymomc\etc
- <SYSTEM32>\yvfpceusnpn.exe
- <SYSTEM32>\zmblunl.exe
- %WINDIR%\Temp\dnz3hi152t6dclqk.exe
- <DRIVERS>\etc\hosts
- %TEMP%\dnz3hi152jheclqksonmfp.exe
- 'fi###born.net':80
- 'qu###born.net':80
- 'qu###august.net':80
- 'qu###paid.net':80
- 'fi###august.net':80
- 'bo###loth.net':80
- 'bo###ugust.net':80
- 'ga###ugust.net':80
- 'ga###aid.net':80
- 'ga###loth.net':80
- 'bo###aid.net':80
- 'fi###paid.net':80
- 'al###past.net':80
- 'de####erpast.net':80
- 'de####erwing.net':80
- 'fr###yfish.net':80
- 'al###wing.net':80
- 'al###lady.net':80
- 'fi###cloth.net':80
- 'qu###cloth.net':80
- 'de####erfish.net':80
- 'de####erlady.net':80
- 'al###fish.net':80
- 'wa###ugust.net':80
- 'mo###born.net':80
- 'mo###august.net':80
- 'mo###paid.net':80
- 'wa###aid.net':80
- 'wa###orn.net':80
- 'we###aid.net':80
- 'st###august.net':80
- 'st###paid.net':80
- 'st###cloth.net':80
- 'we###loth.net':80
- 'wa###loth.net':80
- 'fa###loth.net':80
- 'le###paid.net':80
- 'le###cloth.net':80
- 'bo###orn.net':80
- 'ga###orn.net':80
- 'fa###aid.net':80
- 'fa###orn.net':80
- 'mo###cloth.net':80
- 'le###born.net':80
- 'le###august.net':80
- 'fa###ugust.net':80
- 'en###wing.net':80
- 'li###ing.net':80
- 'ba###ish.net':80
- 'ri###nstorm.net':80
- 'st###fish.net':80
- 'en###past.net':80
- 'en###fish.net':80
- 'li###ish.net':80
- 'li###ady.net':80
- 'li###ast.net':80
- 'en###lady.net':80
- 'al###being.net':80
- 'cr#####onaraminta.net':80
- 'le###form.net':80
- 'jo####ymeasure.net':80
- 'ef###tbuilt.net':80
- 'th###while.net':80
- 'mo###ugust.net':80
- 'pr####tbottom.net':80
- 'ca####nbring.net':80
- 'mo###olor.net':80
- 'mi###hown.net':80
- 'ab###ell.net':80
- 'de###ish.net':80
- 'pu###ing.net':80
- 'sh###fish.net':80
- 'sh###lady.net':80
- 'de###ady.net':80
- 'fr###ywing.net':80
- 'fr###ylady.net':80
- 'pu###ish.net':80
- 'pu###ady.net':80
- 'pu###ast.net':80
- 'fr###ypast.net':80
- 'de###ast.net':80
- 'ti###ast.net':80
- 'mo###lady.net':80
- 'mo###past.net':80
- 'mo###wing.net':80
- 'ti###ing.net':80
- 'ti###ady.net':80
- 'de###ing.net':80
- 'sh###past.net':80
- 'sh###wing.net':80
- 'mo###fish.net':80
- 'ti###ish.net':80
- http://fi###born.net/index.php
- http://qu###born.net/index.php
- http://qu###august.net/index.php
- http://qu###paid.net/index.php
- http://fi###august.net/index.php
- http://bo###loth.net/index.php
- http://bo###ugust.net/index.php
- http://ga###ugust.net/index.php
- http://ga###aid.net/index.php
- http://ga###loth.net/index.php
- http://bo###aid.net/index.php
- http://fi###paid.net/index.php
- http://al###past.net/index.php
- http://de####erpast.net/index.php
- http://de####erwing.net/index.php
- http://fr###yfish.net/index.php
- http://al###wing.net/index.php
- http://al###lady.net/index.php
- http://fi###cloth.net/index.php
- http://qu###cloth.net/index.php
- http://de####erfish.net/index.php
- http://de####erlady.net/index.php
- http://al###fish.net/index.php
- http://wa###ugust.net/index.php
- http://mo###born.net/index.php
- http://mo###august.net/index.php
- http://mo###paid.net/index.php
- http://wa###aid.net/index.php
- http://wa###orn.net/index.php
- http://we###aid.net/index.php
- http://st###august.net/index.php
- http://st###paid.net/index.php
- http://st###cloth.net/index.php
- http://we###loth.net/index.php
- http://wa###loth.net/index.php
- http://fa###loth.net/index.php
- http://le###paid.net/index.php
- http://le###cloth.net/index.php
- http://bo###orn.net/index.php
- http://ga###orn.net/index.php
- http://fa###aid.net/index.php
- http://fa###orn.net/index.php
- http://mo###cloth.net/index.php
- http://le###born.net/index.php
- http://le###august.net/index.php
- http://fa###ugust.net/index.php
- http://en###wing.net/index.php
- http://li###ing.net/index.php
- http://ba###ish.net/index.php
- http://ri###nstorm.net/index.php
- http://st###fish.net/index.php
- http://en###past.net/index.php
- http://en###fish.net/index.php
- http://li###ish.net/index.php
- http://li###ady.net/index.php
- http://li###ast.net/index.php
- http://en###lady.net/index.php
- http://al###being.net/index.php
- http://cr#####onaraminta.net/index.php
- http://le###form.net/index.php
- http://jo####ymeasure.net/index.php
- http://ef###tbuilt.net/index.php
- http://th###while.net/index.php
- http://mo###ugust.net/index.php
- http://pr####tbottom.net/index.php
- http://ca####nbring.net/index.php
- http://mo###olor.net/index.php
- http://mi###hown.net/index.php
- http://ab###ell.net/index.php
- http://de###ish.net/index.php
- http://pu###ing.net/index.php
- http://sh###fish.net/index.php
- http://sh###lady.net/index.php
- http://de###ady.net/index.php
- http://fr###ywing.net/index.php
- http://fr###ylady.net/index.php
- http://pu###ish.net/index.php
- http://pu###ady.net/index.php
- http://pu###ast.net/index.php
- http://fr###ypast.net/index.php
- http://de###ast.net/index.php
- http://ti###ast.net/index.php
- http://mo###lady.net/index.php
- http://mo###past.net/index.php
- http://mo###wing.net/index.php
- http://ti###ing.net/index.php
- http://ti###ady.net/index.php
- http://de###ing.net/index.php
- http://sh###past.net/index.php
- http://sh###wing.net/index.php
- http://mo###fish.net/index.php
- http://ti###ish.net/index.php
- DNS ASK fi###born.net
- DNS ASK qu###born.net
- DNS ASK qu###august.net
- DNS ASK qu###paid.net
- DNS ASK fi###august.net
- DNS ASK bo###loth.net
- DNS ASK bo###ugust.net
- DNS ASK ga###ugust.net
- DNS ASK ga###aid.net
- DNS ASK ga###loth.net
- DNS ASK bo###aid.net
- DNS ASK fi###paid.net
- DNS ASK al###past.net
- DNS ASK de####erpast.net
- DNS ASK de####erwing.net
- DNS ASK fr###yfish.net
- DNS ASK al###wing.net
- DNS ASK al###lady.net
- DNS ASK fi###cloth.net
- DNS ASK qu###cloth.net
- DNS ASK de####erfish.net
- DNS ASK de####erlady.net
- DNS ASK al###fish.net
- DNS ASK bo###orn.net
- DNS ASK mo###born.net
- DNS ASK wa###orn.net
- DNS ASK wa###ugust.net
- DNS ASK wa###aid.net
- DNS ASK mo###august.net
- DNS ASK st###cloth.net
- DNS ASK st###august.net
- DNS ASK we###ugust.net
- DNS ASK we###aid.net
- DNS ASK we###loth.net
- DNS ASK st###paid.net
- DNS ASK mo###paid.net
- DNS ASK le###paid.net
- DNS ASK fa###aid.net
- DNS ASK fa###loth.net
- DNS ASK ga###orn.net
- DNS ASK le###cloth.net
- DNS ASK le###august.net
- DNS ASK mo###cloth.net
- DNS ASK wa###loth.net
- DNS ASK fa###orn.net
- DNS ASK fa###ugust.net
- DNS ASK le###born.net
- DNS ASK en###wing.net
- DNS ASK li###ing.net
- DNS ASK ba###ish.net
- DNS ASK ri###nstorm.net
- DNS ASK st###fish.net
- DNS ASK en###past.net
- DNS ASK en###fish.net
- DNS ASK li###ish.net
- DNS ASK li###ady.net
- DNS ASK li###ast.net
- DNS ASK en###lady.net
- DNS ASK al###being.net
- DNS ASK cr#####onaraminta.net
- DNS ASK le###form.net
- DNS ASK jo####ymeasure.net
- DNS ASK ef###tbuilt.net
- DNS ASK th###while.net
- DNS ASK mo###ugust.net
- DNS ASK pr####tbottom.net
- DNS ASK ca####nbring.net
- DNS ASK mo###olor.net
- DNS ASK mi###hown.net
- DNS ASK ab###ell.net
- DNS ASK de###ish.net
- DNS ASK pu###ing.net
- DNS ASK sh###fish.net
- DNS ASK sh###lady.net
- DNS ASK de###ady.net
- DNS ASK fr###ywing.net
- DNS ASK fr###ylady.net
- DNS ASK pu###ish.net
- DNS ASK pu###ady.net
- DNS ASK pu###ast.net
- DNS ASK fr###ypast.net
- DNS ASK de###ast.net
- DNS ASK ti###ast.net
- DNS ASK mo###lady.net
- DNS ASK mo###past.net
- DNS ASK mo###wing.net
- DNS ASK ti###ing.net
- DNS ASK ti###ady.net
- DNS ASK de###ing.net
- DNS ASK sh###past.net
- DNS ASK sh###wing.net
- DNS ASK mo###fish.net
- DNS ASK ti###ish.net
- '23#.#55.255.250':1900