Technical Information
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'AuthIP Agent WinHTTP Transfer Cryptographic' = 'C:\zifvdbrdyasy\axiozerowxht.exe'
- %WINDIR%\zifvdbrdyasy\yqkx2j
- C:\zifvdbrdyasy\yqkx2j
- C:\zifvdbrdyasy\gc2x6gltsxfshsrq.exe
- C:\zifvdbrdyasy\axiozerowxht.exe
- C:\zifvdbrdyasy\sycrzpqvor.exe
- C:\zifvdbrdyasy\hs9jsatdp
- C:\zifvdbrdyasy\axiozerowxht.exe
- C:\zifvdbrdyasy\sycrzpqvor.exe
- %WINDIR%\zifvdbrdyasy\yqkx2j
- C:\zifvdbrdyasy\gc2x6gltsxfshsrq.exe
- %WINDIR%\zifvdbrdyasy\yqkx2j
- 'ma####alhappen.net':80
- 'wi####between.net':80
- 'pe####sproduce.net':80
- 'wi####produce.net':80
- 'pe####sstudent.net':80
- 'wi####student.net':80
- 'su####tsucceed.net':80
- 'su####tbetween.net':80
- 'su####tproduce.net':80
- 'su####tstudent.net':80
- 'fi####succeed.net':80
- 'le####ucceed.net':80
- 'fi####between.net':80
- 'le####etween.net':80
- 'fi####produce.net':80
- 'le####roduce.net':80
- 'fi####student.net':80
- 'le####tudent.net':80
- 'sw####ucceed.net':80
- 'pr####lysucceed.net':80
- 'sw####etween.net':80
- 'pr####lybetween.net':80
- 'sw####roduce.net':80
- 'pr####lyproduce.net':80
- 'sw####tudent.net':80
- 'pr####lystudent.net':80
- 'se####lsucceed.net':80
- 'ma####alsucceed.net':80
- 'pe####sbetween.net':80
- 'se####lbetween.net':80
- 'wi####succeed.net':80
- 'po####lestudent.net':80
- 'se####lshake.net':80
- 'ma####alshake.net':80
- 'se####lshare.net':80
- 'ma####alshare.net':80
- 'se####succeed.net':80
- 'la####ucceed.net':80
- 'se####between.net':80
- 'la####etween.net':80
- 'se####produce.net':80
- 'la####roduce.net':80
- 'se####student.net':80
- 'la####tudent.net':80
- 'si####succeed.net':80
- 'mo####succeed.net':80
- 'si####between.net':80
- 'mo####between.net':80
- 'si####produce.net':80
- 'mo####produce.net':80
- 'si####student.net':80
- 'mo####student.net':80
- 'mo####insucceed.net':80
- 'po####lesucceed.net':80
- 'mo####inbetween.net':80
- 'po####lebetween.net':80
- 'mo####inproduce.net':80
- 'po####leproduce.net':80
- 'mo####instudent.net':80
- 'pe####ssucceed.net':80
- 'ma####albetween.net':80
- http://ma####alhappen.net/index.php
- http://wi####between.net/index.php
- http://pe####sproduce.net/index.php
- http://wi####produce.net/index.php
- http://pe####sstudent.net/index.php
- http://wi####student.net/index.php
- http://su####tsucceed.net/index.php
- http://su####tbetween.net/index.php
- http://su####tproduce.net/index.php
- http://su####tstudent.net/index.php
- http://fi####succeed.net/index.php
- http://le####ucceed.net/index.php
- http://fi####between.net/index.php
- http://le####etween.net/index.php
- http://fi####produce.net/index.php
- http://le####roduce.net/index.php
- http://fi####student.net/index.php
- http://le####tudent.net/index.php
- http://sw####ucceed.net/index.php
- http://pr####lysucceed.net/index.php
- http://sw####etween.net/index.php
- http://pr####lybetween.net/index.php
- http://sw####roduce.net/index.php
- http://pr####lyproduce.net/index.php
- http://sw####tudent.net/index.php
- http://pr####lystudent.net/index.php
- http://se####lsucceed.net/index.php
- http://ma####alsucceed.net/index.php
- http://pe####sbetween.net/index.php
- http://se####lbetween.net/index.php
- http://wi####succeed.net/index.php
- http://po####lestudent.net/index.php
- http://se####lshake.net/index.php
- http://ma####alshake.net/index.php
- http://se####lshare.net/index.php
- http://ma####alshare.net/index.php
- http://se####succeed.net/index.php
- http://la####ucceed.net/index.php
- http://se####between.net/index.php
- http://la####etween.net/index.php
- http://se####produce.net/index.php
- http://la####roduce.net/index.php
- http://se####student.net/index.php
- http://la####tudent.net/index.php
- http://si####succeed.net/index.php
- http://mo####succeed.net/index.php
- http://si####between.net/index.php
- http://mo####between.net/index.php
- http://si####produce.net/index.php
- http://mo####produce.net/index.php
- http://si####student.net/index.php
- http://mo####student.net/index.php
- http://mo####insucceed.net/index.php
- http://po####lesucceed.net/index.php
- http://mo####inbetween.net/index.php
- http://po####lebetween.net/index.php
- http://mo####inproduce.net/index.php
- http://po####leproduce.net/index.php
- http://mo####instudent.net/index.php
- http://pe####ssucceed.net/index.php
- http://ma####albetween.net/index.php
- DNS ASK ma####alhappen.net
- DNS ASK wi####between.net
- DNS ASK pe####sproduce.net
- DNS ASK wi####produce.net
- DNS ASK pe####sstudent.net
- DNS ASK wi####student.net
- DNS ASK su####tsucceed.net
- DNS ASK su####tbetween.net
- DNS ASK su####tproduce.net
- DNS ASK su####tstudent.net
- DNS ASK fi####succeed.net
- DNS ASK le####ucceed.net
- DNS ASK fi####between.net
- DNS ASK le####etween.net
- DNS ASK fi####produce.net
- DNS ASK le####roduce.net
- DNS ASK fi####student.net
- DNS ASK le####tudent.net
- DNS ASK sw####ucceed.net
- DNS ASK pr####lysucceed.net
- DNS ASK sw####etween.net
- DNS ASK pr####lybetween.net
- DNS ASK sw####roduce.net
- DNS ASK pr####lyproduce.net
- DNS ASK sw####tudent.net
- DNS ASK pr####lystudent.net
- DNS ASK se####lsucceed.net
- DNS ASK ma####alsucceed.net
- DNS ASK pe####sbetween.net
- DNS ASK se####lbetween.net
- DNS ASK wi####succeed.net
- DNS ASK po####lestudent.net
- DNS ASK se####lshake.net
- DNS ASK ma####alshake.net
- DNS ASK se####lshare.net
- DNS ASK ma####alshare.net
- DNS ASK se####succeed.net
- DNS ASK la####ucceed.net
- DNS ASK se####between.net
- DNS ASK la####etween.net
- DNS ASK se####produce.net
- DNS ASK la####roduce.net
- DNS ASK se####student.net
- DNS ASK la####tudent.net
- DNS ASK si####succeed.net
- DNS ASK mo####succeed.net
- DNS ASK si####between.net
- DNS ASK mo####between.net
- DNS ASK si####produce.net
- DNS ASK mo####produce.net
- DNS ASK si####student.net
- DNS ASK mo####student.net
- DNS ASK mo####insucceed.net
- DNS ASK po####lesucceed.net
- DNS ASK mo####inbetween.net
- DNS ASK po####lebetween.net
- DNS ASK mo####inproduce.net
- DNS ASK po####leproduce.net
- DNS ASK mo####instudent.net
- DNS ASK pe####ssucceed.net
- DNS ASK ma####albetween.net
- 'C:\zifvdbrdyasy\gc2x6gltsxfshsrq.exe'
- 'C:\zifvdbrdyasy\axiozerowxht.exe'
- 'C:\zifvdbrdyasy\sycrzpqvor.exe' "c:\zifvdbrdyasy\axiozerowxht.exe"