Technical Information
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Foundation Telephony Now Provider Problem' = '<SYSTEM32>\xdhnndr.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\Adaptive Coordinator Presentation Telephony] 'ImagePath' = '<SYSTEM32>\xdhnndr.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\Adaptive Coordinator Presentation Telephony] 'Start' = '00000002'
- Windows Security Center
- '<SYSTEM32>\msdjncdnaxgz.exe' "<SYSTEM32>\xdhnndr.exe"
- '%WINDIR%\Temp\zeahof2mm9ahp2.exe' -r 41264 tcp
- '%TEMP%\zeahof2hypahp2kewmbleo.exe'
- '<SYSTEM32>\xdhnndr.exe'
- <SYSTEM32>\wdsltkqbflnx\run
- <SYSTEM32>\wdsltkqbflnx\rng
- %WINDIR%\Temp\zeahof2mm9ahp2.exe
- <SYSTEM32>\wdsltkqbflnx\cfg
- <SYSTEM32>\msdjncdnaxgz.exe
- %TEMP%\zeahof2hypahp2kewmbleo.exe
- <SYSTEM32>\wdsltkqbflnx\tst
- <SYSTEM32>\xdhnndr.exe
- <SYSTEM32>\wdsltkqbflnx\etc
- <SYSTEM32>\msdjncdnaxgz.exe
- <SYSTEM32>\xdhnndr.exe
- %WINDIR%\Temp\zeahof2mm9ahp2.exe
- <DRIVERS>\etc\hosts
- %TEMP%\zeahof2hypahp2kewmbleo.exe
- 'si###how.net':80
- 'ro###unt.net':80
- 'ro###how.net':80
- 'pi###ear.net':80
- 'so###ear.net':80
- 'ro###ear.net':80
- 'si###ear.net':80
- 'si###ule.net':80
- 'si###unt.net':80
- 'ro###ule.net':80
- 'ab###ear.net':80
- 'pi###how.net':80
- 'kn###ear.net':80
- 'kn###ule.net':80
- 'ab###ule.net':80
- 'pi###ule.net':80
- 'so###ule.net':80
- 'so###unt.net':80
- 'so###how.net':80
- 'pi###unt.net':80
- 'wh###ule.net':80
- 'hi###ear.net':80
- 'hi###ule.net':80
- 'hi###unt.net':80
- 'wh###unt.net':80
- 'fe###unt.net':80
- 'lo###unt.net':80
- 'lo###how.net':80
- 'wh###ear.net':80
- 'fe###how.net':80
- 'ju###unt.net':80
- 'mo###ule.net':80
- 'mo###unt.net':80
- 'mo###how.net':80
- 'ju###how.net':80
- 'hi###how.net':80
- 'wh###how.net':80
- 'ju###ear.net':80
- 'ju###ule.net':80
- 'mo###ear.net':80
- 'ab###unt.net':80
- 'hi###oon.net':80
- 'wh###oon.net':80
- 'wh###ctober.net':80
- 'be##lxc.com':80
- 'hi###ctober.net':80
- 'lo###hoe.net':80
- 'fe###ctober.net':80
- 'fe###hoe.net':80
- 'hi###uter.net':80
- 'wh###uter.net':80
- 'mi###hown.net':80
- 'ab###ell.net':80
- 'mo###ugust.net':80
- 'cr#####onaraminta.net':80
- 'le###form.net':80
- 'al###being.net':80
- 'ri###nstorm.net':80
- 'ca####nbring.net':80
- 'mo###olor.net':80
- 'pr####tbottom.net':80
- 'dr###moon.net':80
- 'wi###oon.net':80
- 'wi###ctober.net':80
- 'wi###hoe.net':80
- 'dr####ctober.net':80
- 'ab###how.net':80
- 'kn###unt.net':80
- 'kn###how.net':80
- 'dr###outer.net':80
- 'wi###uter.net':80
- 'fe###uter.net':80
- 'lo###uter.net':80
- 'lo###oon.net':80
- 'lo###ctober.net':80
- 'fe###oon.net':80
- 'th###outer.net':80
- 'dr###shoe.net':80
- 'th###moon.net':80
- 'th###shoe.net':80
- 'th####ctober.net':80
- http://si###how.net/index.php
- http://ro###unt.net/index.php
- http://ro###how.net/index.php
- http://pi###ear.net/index.php
- http://so###ear.net/index.php
- http://ro###ear.net/index.php
- http://si###ear.net/index.php
- http://si###ule.net/index.php
- http://si###unt.net/index.php
- http://ro###ule.net/index.php
- http://ab###ear.net/index.php
- http://pi###how.net/index.php
- http://kn###ear.net/index.php
- http://kn###ule.net/index.php
- http://ab###ule.net/index.php
- http://pi###ule.net/index.php
- http://so###ule.net/index.php
- http://so###unt.net/index.php
- http://so###how.net/index.php
- http://pi###unt.net/index.php
- http://wh###ule.net/index.php
- http://hi###ear.net/index.php
- http://hi###ule.net/index.php
- http://hi###unt.net/index.php
- http://wh###unt.net/index.php
- http://fe###unt.net/index.php
- http://lo###unt.net/index.php
- http://lo###how.net/index.php
- http://wh###ear.net/index.php
- http://fe###how.net/index.php
- http://ju###unt.net/index.php
- http://mo###ule.net/index.php
- http://mo###unt.net/index.php
- http://mo###how.net/index.php
- http://ju###how.net/index.php
- http://hi###how.net/index.php
- http://wh###how.net/index.php
- http://ju###ear.net/index.php
- http://ju###ule.net/index.php
- http://mo###ear.net/index.php
- http://ab###unt.net/index.php
- http://hi###oon.net/index.php
- http://wh###oon.net/index.php
- http://wh###ctober.net/index.php
- http://be##lxc.com/index.php
- http://hi###ctober.net/index.php
- http://lo###hoe.net/index.php
- http://fe###ctober.net/index.php
- http://fe###hoe.net/index.php
- http://hi###uter.net/index.php
- http://wh###uter.net/index.php
- http://mi###hown.net/index.php
- http://ab###ell.net/index.php
- http://mo###ugust.net/index.php
- http://cr#####onaraminta.net/index.php
- http://le###form.net/index.php
- http://al###being.net/index.php
- http://ri###nstorm.net/index.php
- http://ca####nbring.net/index.php
- http://mo###olor.net/index.php
- http://pr####tbottom.net/index.php
- http://dr###moon.net/index.php
- http://wi###oon.net/index.php
- http://wi###ctober.net/index.php
- http://wi###hoe.net/index.php
- http://dr####ctober.net/index.php
- http://ab###how.net/index.php
- http://kn###unt.net/index.php
- http://kn###how.net/index.php
- http://dr###outer.net/index.php
- http://wi###uter.net/index.php
- http://fe###uter.net/index.php
- http://lo###uter.net/index.php
- http://lo###oon.net/index.php
- http://lo###ctober.net/index.php
- http://fe###oon.net/index.php
- http://th###outer.net/index.php
- http://dr###shoe.net/index.php
- http://th###moon.net/index.php
- http://th###shoe.net/index.php
- http://th####ctober.net/index.php
- DNS ASK si###how.net
- DNS ASK ro###unt.net
- DNS ASK ro###how.net
- DNS ASK pi###ear.net
- DNS ASK so###ear.net
- DNS ASK ro###ear.net
- DNS ASK si###ear.net
- DNS ASK si###ule.net
- DNS ASK si###unt.net
- DNS ASK ro###ule.net
- DNS ASK ab###ear.net
- DNS ASK pi###how.net
- DNS ASK kn###ear.net
- DNS ASK kn###ule.net
- DNS ASK ab###ule.net
- DNS ASK pi###ule.net
- DNS ASK so###ule.net
- DNS ASK so###unt.net
- DNS ASK so###how.net
- DNS ASK pi###unt.net
- DNS ASK mo###how.net
- DNS ASK hi###ear.net
- DNS ASK wh###ear.net
- DNS ASK wh###ule.net
- DNS ASK wh###unt.net
- DNS ASK hi###ule.net
- DNS ASK lo###unt.net
- DNS ASK fe###ule.net
- DNS ASK fe###unt.net
- DNS ASK fe###how.net
- DNS ASK lo###how.net
- DNS ASK mo###ule.net
- DNS ASK ju###ule.net
- DNS ASK ju###unt.net
- DNS ASK ju###how.net
- DNS ASK mo###unt.net
- DNS ASK wh###how.net
- DNS ASK hi###unt.net
- DNS ASK hi###how.net
- DNS ASK mo###ear.net
- DNS ASK ju###ear.net
- DNS ASK ab###unt.net
- DNS ASK hi###oon.net
- DNS ASK wh###oon.net
- DNS ASK wh###ctober.net
- DNS ASK be##lxc.com
- DNS ASK hi###ctober.net
- DNS ASK lo###hoe.net
- DNS ASK fe###ctober.net
- DNS ASK fe###hoe.net
- DNS ASK hi###uter.net
- DNS ASK wh###uter.net
- DNS ASK mi###hown.net
- DNS ASK ab###ell.net
- DNS ASK mo###ugust.net
- DNS ASK cr#####onaraminta.net
- DNS ASK le###form.net
- DNS ASK al###being.net
- DNS ASK ri###nstorm.net
- DNS ASK ca####nbring.net
- DNS ASK mo###olor.net
- DNS ASK pr####tbottom.net
- DNS ASK dr###moon.net
- DNS ASK wi###oon.net
- DNS ASK wi###ctober.net
- DNS ASK wi###hoe.net
- DNS ASK dr####ctober.net
- DNS ASK ab###how.net
- DNS ASK kn###unt.net
- DNS ASK kn###how.net
- DNS ASK dr###outer.net
- DNS ASK wi###uter.net
- DNS ASK fe###uter.net
- DNS ASK lo###uter.net
- DNS ASK lo###oon.net
- DNS ASK lo###ctober.net
- DNS ASK fe###oon.net
- DNS ASK th###outer.net
- DNS ASK dr###shoe.net
- DNS ASK th###moon.net
- DNS ASK th###shoe.net
- DNS ASK th####ctober.net
- '23#.#55.255.250':1900