Technical Information
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Browser Card Experience Certificate' = '<SYSTEM32>\hyncxszty.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\Host Installer Registry Image DNS Helper] 'ImagePath' = '<SYSTEM32>\hyncxszty.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\Host Installer Registry Image DNS Helper] 'Start' = '00000002'
- Windows Security Center
- '<SYSTEM32>\tplocmp.exe' "<SYSTEM32>\hyncxszty.exe"
- '%WINDIR%\Temp\w2kbbjp2rigbbyi.exe' -r 27670 tcp
- '%TEMP%\w2kbbjp2ndlbbyicx2y2b.exe'
- '<SYSTEM32>\hyncxszty.exe'
- <SYSTEM32>\ohtbpqap\run
- <SYSTEM32>\ohtbpqap\rng
- %WINDIR%\Temp\w2kbbjp2rigbbyi.exe
- <SYSTEM32>\ohtbpqap\cfg
- <SYSTEM32>\tplocmp.exe
- %TEMP%\w2kbbjp2ndlbbyicx2y2b.exe
- <SYSTEM32>\ohtbpqap\tst
- <SYSTEM32>\hyncxszty.exe
- <SYSTEM32>\ohtbpqap\etc
- <SYSTEM32>\tplocmp.exe
- <SYSTEM32>\hyncxszty.exe
- %WINDIR%\Temp\w2kbbjp2rigbbyi.exe
- <DRIVERS>\etc\hosts
- %TEMP%\w2kbbjp2ndlbbyicx2y2b.exe
- 'wi###ift.net':80
- 'dr###green.net':80
- 'dr###lift.net':80
- 'th###sound.net':80
- 'th###hand.net':80
- 'dr###hand.net':80
- 'wi###and.net':80
- 'wi###ound.net':80
- 'wi###reen.net':80
- 'dr###sound.net':80
- 'th###green.net':80
- 'fe###reen.net':80
- 'lo###reen.net':80
- 'lo###ift.net':80
- 'wh###and.net':80
- 'fe###ift.net':80
- 'lo###and.net':80
- 'th###lift.net':80
- 'fe###and.net':80
- 'fe###ound.net':80
- 'lo###ound.net':80
- 'pi###age.net':80
- 'so###age.net':80
- 'so###ince.net':80
- 'so###eat.net':80
- 'pi###ince.net':80
- 'si###eat.net':80
- 'ro###ince.net':80
- 'ro###eat.net':80
- 'ro###appy.net':80
- 'si###appy.net':80
- 'pi###eat.net':80
- 'ab###eat.net':80
- 'kn###ince.net':80
- 'kn###eat.net':80
- 'kn###appy.net':80
- 'ab###appy.net':80
- 'pi###appy.net':80
- 'so###appy.net':80
- 'ab###age.net':80
- 'ab###ince.net':80
- 'kn###age.net':80
- 'hi###and.net':80
- 'pi###reen.net':80
- 'so###reen.net':80
- 'so###ift.net':80
- 'ab###and.net':80
- 'pi###ift.net':80
- 'so###and.net':80
- 'ro###ift.net':80
- 'pi###and.net':80
- 'pi###ound.net':80
- 'so###ound.net':80
- 'kn###and.net':80
- 'de###lxc.com':80
- 'kn###ift.net':80
- 'be##lxc.com':80
- 'ri###nstorm.net':80
- 'af###sllc.com':80
- 'kn###ound.net':80
- 'ab###ound.net':80
- 'ab###reen.net':80
- 'ab###ift.net':80
- 'kn###reen.net':80
- 'ju###and.net':80
- 'hi###ift.net':80
- 'mo###and.net':80
- 'mo###ound.net':80
- 'ju###ound.net':80
- 'hi###ound.net':80
- 'wh###ound.net':80
- 'wh###reen.net':80
- 'wh###ift.net':80
- 'hi###reen.net':80
- 'ju###reen.net':80
- 'ro###ound.net':80
- 'si###ound.net':80
- 'si###reen.net':80
- 'si###ift.net':80
- 'ro###reen.net':80
- 'ju###ift.net':80
- 'mo###reen.net':80
- 'mo###ift.net':80
- 'ro###and.net':80
- 'si###and.net':80
- http://wi###ift.net/index.php
- http://dr###green.net/index.php
- http://dr###lift.net/index.php
- http://th###sound.net/index.php
- http://th###hand.net/index.php
- http://dr###hand.net/index.php
- http://wi###and.net/index.php
- http://wi###ound.net/index.php
- http://wi###reen.net/index.php
- http://dr###sound.net/index.php
- http://th###green.net/index.php
- http://fe###reen.net/index.php
- http://lo###reen.net/index.php
- http://lo###ift.net/index.php
- http://wh###and.net/index.php
- http://fe###ift.net/index.php
- http://lo###and.net/index.php
- http://th###lift.net/index.php
- http://fe###and.net/index.php
- http://fe###ound.net/index.php
- http://lo###ound.net/index.php
- http://pi###age.net/index.php
- http://so###age.net/index.php
- http://so###ince.net/index.php
- http://so###eat.net/index.php
- http://pi###ince.net/index.php
- http://si###eat.net/index.php
- http://ro###ince.net/index.php
- http://ro###eat.net/index.php
- http://ro###appy.net/index.php
- http://si###appy.net/index.php
- http://pi###eat.net/index.php
- http://ab###eat.net/index.php
- http://kn###ince.net/index.php
- http://kn###eat.net/index.php
- http://kn###appy.net/index.php
- http://ab###appy.net/index.php
- http://pi###appy.net/index.php
- http://so###appy.net/index.php
- http://ab###age.net/index.php
- http://ab###ince.net/index.php
- http://kn###age.net/index.php
- http://hi###and.net/index.php
- http://pi###reen.net/index.php
- http://so###reen.net/index.php
- http://so###ift.net/index.php
- http://ab###and.net/index.php
- http://pi###ift.net/index.php
- http://so###and.net/index.php
- http://ro###ift.net/index.php
- http://pi###and.net/index.php
- http://pi###ound.net/index.php
- http://so###ound.net/index.php
- http://kn###and.net/index.php
- http://de###lxc.com/index.php
- http://kn###ift.net/index.php
- http://be##lxc.com/index.php
- http://ri###nstorm.net/index.php
- http://af###sllc.com/index.php
- http://kn###ound.net/index.php
- http://ab###ound.net/index.php
- http://ab###reen.net/index.php
- http://ab###ift.net/index.php
- http://kn###reen.net/index.php
- http://ju###and.net/index.php
- http://hi###ift.net/index.php
- http://mo###and.net/index.php
- http://mo###ound.net/index.php
- http://ju###ound.net/index.php
- http://hi###ound.net/index.php
- http://wh###ound.net/index.php
- http://wh###reen.net/index.php
- http://wh###ift.net/index.php
- http://hi###reen.net/index.php
- http://ju###reen.net/index.php
- http://ro###ound.net/index.php
- http://si###ound.net/index.php
- http://si###reen.net/index.php
- http://si###ift.net/index.php
- http://ro###reen.net/index.php
- http://ju###ift.net/index.php
- http://mo###reen.net/index.php
- http://mo###ift.net/index.php
- http://ro###and.net/index.php
- http://si###and.net/index.php
- DNS ASK dr###lift.net
- DNS ASK wi###ift.net
- DNS ASK th###hand.net
- DNS ASK th###green.net
- DNS ASK th###sound.net
- DNS ASK wi###ound.net
- DNS ASK dr###hand.net
- DNS ASK dr###sound.net
- DNS ASK dr###green.net
- DNS ASK wi###reen.net
- DNS ASK th###lift.net
- DNS ASK lo###ift.net
- DNS ASK fe###reen.net
- DNS ASK fe###ift.net
- DNS ASK hi###and.net
- DNS ASK wh###and.net
- DNS ASK fe###and.net
- DNS ASK lo###and.net
- DNS ASK lo###ound.net
- DNS ASK lo###reen.net
- DNS ASK fe###ound.net
- DNS ASK wi###and.net
- DNS ASK pi###age.net
- DNS ASK so###age.net
- DNS ASK so###ince.net
- DNS ASK so###eat.net
- DNS ASK pi###ince.net
- DNS ASK si###eat.net
- DNS ASK ro###ince.net
- DNS ASK ro###eat.net
- DNS ASK ro###appy.net
- DNS ASK si###appy.net
- DNS ASK pi###eat.net
- DNS ASK ab###eat.net
- DNS ASK kn###ince.net
- DNS ASK kn###eat.net
- DNS ASK kn###appy.net
- DNS ASK ab###appy.net
- DNS ASK pi###appy.net
- DNS ASK so###appy.net
- DNS ASK ab###age.net
- DNS ASK ab###ince.net
- DNS ASK kn###age.net
- DNS ASK pi###reen.net
- DNS ASK so###reen.net
- DNS ASK so###ift.net
- DNS ASK ab###and.net
- DNS ASK pi###ift.net
- DNS ASK so###and.net
- DNS ASK ro###ift.net
- DNS ASK pi###and.net
- DNS ASK pi###ound.net
- DNS ASK so###ound.net
- DNS ASK kn###and.net
- DNS ASK de###lxc.com
- DNS ASK kn###ift.net
- DNS ASK be##lxc.com
- DNS ASK ri###nstorm.net
- DNS ASK af###sllc.com
- DNS ASK kn###ound.net
- DNS ASK ab###ound.net
- DNS ASK ab###reen.net
- DNS ASK ab###ift.net
- DNS ASK kn###reen.net
- DNS ASK ju###and.net
- DNS ASK hi###ift.net
- DNS ASK mo###and.net
- DNS ASK mo###ound.net
- DNS ASK ju###ound.net
- DNS ASK hi###ound.net
- DNS ASK wh###ound.net
- DNS ASK wh###reen.net
- DNS ASK wh###ift.net
- DNS ASK hi###reen.net
- DNS ASK ju###reen.net
- DNS ASK ro###ound.net
- DNS ASK si###ound.net
- DNS ASK si###reen.net
- DNS ASK si###ift.net
- DNS ASK ro###reen.net
- DNS ASK ju###ift.net
- DNS ASK mo###reen.net
- DNS ASK mo###ift.net
- DNS ASK ro###and.net
- DNS ASK si###and.net
- '23#.#55.255.250':1900