Technical Information
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Foundation Telephony Now Provider Problem' = '<SYSTEM32>\xdhnndr.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\Adaptive Coordinator Presentation Telephony] 'ImagePath' = '<SYSTEM32>\xdhnndr.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\Adaptive Coordinator Presentation Telephony] 'Start' = '00000002'
- Windows Security Center
- '<SYSTEM32>\msdjncdnaxgz.exe' "<SYSTEM32>\xdhnndr.exe"
- '%WINDIR%\Temp\ta6vl0w2yi7fn.exe' -r 25311 tcp
- '%TEMP%\ta6vl0w2uc1fnukmkz8m.exe'
- '<SYSTEM32>\xdhnndr.exe'
- <SYSTEM32>\wdsltkqbflnx\run
- <SYSTEM32>\wdsltkqbflnx\rng
- %WINDIR%\Temp\ta6vl0w2yi7fn.exe
- <SYSTEM32>\wdsltkqbflnx\cfg
- <SYSTEM32>\msdjncdnaxgz.exe
- %TEMP%\ta6vl0w2uc1fnukmkz8m.exe
- <SYSTEM32>\wdsltkqbflnx\tst
- <SYSTEM32>\xdhnndr.exe
- <SYSTEM32>\wdsltkqbflnx\etc
- <SYSTEM32>\msdjncdnaxgz.exe
- <SYSTEM32>\xdhnndr.exe
- %WINDIR%\Temp\ta6vl0w2yi7fn.exe
- <DRIVERS>\etc\hosts
- %TEMP%\ta6vl0w2uc1fnukmkz8m.exe
- 'ju###ule.net':80
- 'mo###ear.net':80
- 'mo###ule.net':80
- 'mo###unt.net':80
- 'ju###unt.net':80
- 'hi###unt.net':80
- 'wh###unt.net':80
- 'wh###how.net':80
- 'ju###ear.net':80
- 'hi###how.net':80
- 'si###unt.net':80
- 'ro###ule.net':80
- 'ro###unt.net':80
- 'ro###how.net':80
- 'si###how.net':80
- 'mo###how.net':80
- 'ju###how.net':80
- 'si###ear.net':80
- 'si###ule.net':80
- 'ro###ear.net':80
- 'th###hunt.net':80
- 'th###rule.net':80
- 'th###show.net':80
- 'fe###ear.net':80
- 'lo###ear.net':80
- 'dr###hunt.net':80
- 'wi###unt.net':80
- 'wi###how.net':80
- 'th###hear.net':80
- 'dr###show.net':80
- 'wh###ear.net':80
- 'fe###how.net':80
- 'hi###ear.net':80
- 'hi###ule.net':80
- 'wh###ule.net':80
- 'fe###ule.net':80
- 'lo###ule.net':80
- 'lo###unt.net':80
- 'lo###how.net':80
- 'fe###unt.net':80
- 'so###ear.net':80
- 'th###shoe.net':80
- 'th####ctober.net':80
- 'lo###uter.net':80
- 'lo###oon.net':80
- 'fe###uter.net':80
- 'wi###hoe.net':80
- 'dr####ctober.net':80
- 'dr###shoe.net':80
- 'th###moon.net':80
- 'th###outer.net':80
- 'de###lxc.com':80
- 'wh###uter.net':80
- 'be##lxc.com':80
- 'ri###nstorm.net':80
- 'af###sllc.com':80
- 'lo###ctober.net':80
- 'fe###oon.net':80
- 'fe###ctober.net':80
- 'fe###hoe.net':80
- 'lo###hoe.net':80
- 'pi###how.net':80
- 'so###how.net':80
- 'ab###ear.net':80
- 'ab###ule.net':80
- 'kn###ear.net':80
- 'so###ule.net':80
- 'pi###ear.net':80
- 'pi###ule.net':80
- 'pi###unt.net':80
- 'so###unt.net':80
- 'dr###outer.net':80
- 'wi###uter.net':80
- 'wi###oon.net':80
- 'wi###ctober.net':80
- 'dr###moon.net':80
- 'ab###unt.net':80
- 'kn###ule.net':80
- 'kn###unt.net':80
- 'kn###how.net':80
- 'ab###how.net':80
- http://ju###ule.net/index.php
- http://mo###ear.net/index.php
- http://mo###ule.net/index.php
- http://mo###unt.net/index.php
- http://ju###unt.net/index.php
- http://hi###unt.net/index.php
- http://wh###unt.net/index.php
- http://wh###how.net/index.php
- http://ju###ear.net/index.php
- http://hi###how.net/index.php
- http://si###unt.net/index.php
- http://ro###ule.net/index.php
- http://ro###unt.net/index.php
- http://ro###how.net/index.php
- http://si###how.net/index.php
- http://mo###how.net/index.php
- http://ju###how.net/index.php
- http://si###ear.net/index.php
- http://si###ule.net/index.php
- http://ro###ear.net/index.php
- http://th###hunt.net/index.php
- http://th###rule.net/index.php
- http://th###show.net/index.php
- http://fe###ear.net/index.php
- http://lo###ear.net/index.php
- http://dr###hunt.net/index.php
- http://wi###unt.net/index.php
- http://wi###how.net/index.php
- http://th###hear.net/index.php
- http://dr###show.net/index.php
- http://wh###ear.net/index.php
- http://fe###how.net/index.php
- http://hi###ear.net/index.php
- http://hi###ule.net/index.php
- http://wh###ule.net/index.php
- http://fe###ule.net/index.php
- http://lo###ule.net/index.php
- http://lo###unt.net/index.php
- http://lo###how.net/index.php
- http://fe###unt.net/index.php
- http://so###ear.net/index.php
- http://th###shoe.net/index.php
- http://th####ctober.net/index.php
- http://lo###uter.net/index.php
- http://lo###oon.net/index.php
- http://fe###uter.net/index.php
- http://wi###hoe.net/index.php
- http://dr####ctober.net/index.php
- http://dr###shoe.net/index.php
- http://th###moon.net/index.php
- http://th###outer.net/index.php
- http://de###lxc.com/index.php
- http://wh###uter.net/index.php
- http://be##lxc.com/index.php
- http://ri###nstorm.net/index.php
- http://af###sllc.com/index.php
- http://lo###ctober.net/index.php
- http://fe###oon.net/index.php
- http://fe###ctober.net/index.php
- http://fe###hoe.net/index.php
- http://lo###hoe.net/index.php
- http://pi###how.net/index.php
- http://so###how.net/index.php
- http://ab###ear.net/index.php
- http://ab###ule.net/index.php
- http://kn###ear.net/index.php
- http://so###ule.net/index.php
- http://pi###ear.net/index.php
- http://pi###ule.net/index.php
- http://pi###unt.net/index.php
- http://so###unt.net/index.php
- http://dr###outer.net/index.php
- http://wi###uter.net/index.php
- http://wi###oon.net/index.php
- http://wi###ctober.net/index.php
- http://dr###moon.net/index.php
- http://ab###unt.net/index.php
- http://kn###ule.net/index.php
- http://kn###unt.net/index.php
- http://kn###how.net/index.php
- http://ab###how.net/index.php
- DNS ASK mo###ule.net
- DNS ASK ju###ule.net
- DNS ASK ju###unt.net
- DNS ASK ju###how.net
- DNS ASK mo###unt.net
- DNS ASK wh###how.net
- DNS ASK hi###unt.net
- DNS ASK hi###how.net
- DNS ASK mo###ear.net
- DNS ASK ju###ear.net
- DNS ASK ro###unt.net
- DNS ASK si###unt.net
- DNS ASK si###how.net
- DNS ASK so###ear.net
- DNS ASK ro###how.net
- DNS ASK si###ear.net
- DNS ASK mo###how.net
- DNS ASK ro###ear.net
- DNS ASK ro###ule.net
- DNS ASK si###ule.net
- DNS ASK wh###unt.net
- DNS ASK th###hunt.net
- DNS ASK th###rule.net
- DNS ASK th###show.net
- DNS ASK fe###ear.net
- DNS ASK lo###ear.net
- DNS ASK dr###hunt.net
- DNS ASK wi###unt.net
- DNS ASK wi###how.net
- DNS ASK th###hear.net
- DNS ASK dr###show.net
- DNS ASK wh###ear.net
- DNS ASK fe###how.net
- DNS ASK hi###ear.net
- DNS ASK hi###ule.net
- DNS ASK wh###ule.net
- DNS ASK fe###ule.net
- DNS ASK lo###ule.net
- DNS ASK lo###unt.net
- DNS ASK lo###how.net
- DNS ASK fe###unt.net
- DNS ASK th###shoe.net
- DNS ASK th####ctober.net
- DNS ASK lo###uter.net
- DNS ASK lo###oon.net
- DNS ASK fe###uter.net
- DNS ASK wi###hoe.net
- DNS ASK dr####ctober.net
- DNS ASK dr###shoe.net
- DNS ASK th###moon.net
- DNS ASK th###outer.net
- DNS ASK de###lxc.com
- DNS ASK wh###uter.net
- DNS ASK be##lxc.com
- DNS ASK ri###nstorm.net
- DNS ASK af###sllc.com
- DNS ASK lo###ctober.net
- DNS ASK fe###oon.net
- DNS ASK fe###ctober.net
- DNS ASK fe###hoe.net
- DNS ASK lo###hoe.net
- DNS ASK pi###how.net
- DNS ASK so###how.net
- DNS ASK ab###ear.net
- DNS ASK ab###ule.net
- DNS ASK kn###ear.net
- DNS ASK so###ule.net
- DNS ASK pi###ear.net
- DNS ASK pi###ule.net
- DNS ASK pi###unt.net
- DNS ASK so###unt.net
- DNS ASK dr###outer.net
- DNS ASK wi###uter.net
- DNS ASK wi###oon.net
- DNS ASK wi###ctober.net
- DNS ASK dr###moon.net
- DNS ASK ab###unt.net
- DNS ASK kn###ule.net
- DNS ASK kn###unt.net
- DNS ASK kn###how.net
- DNS ASK ab###how.net
- '23#.#55.255.250':1900