Technical Information
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] '6ca0d' = '%APPDATA%\6ca0d\71e8dfe56c.exe'
- '<SYSTEM32>\svchost.exe'
- <SYSTEM32>\svchost.exe
- %APPDATA%\6ca0d\71e8dfe56c.exe
- 'jl###tect.ca':80
- 'ac##.edu.np':80
- 'th######shirtsonline.com':80
- 'mo#####alvador.com.ar':80
- 'as#####esigns.com.au':80
- http://as#####esigns.com.au/0rTVlG.php?h=############
- DNS ASK jl###tect.ca
- DNS ASK ac##.edu.np
- DNS ASK th######shirtsonline.com
- DNS ASK mo#####alvador.com.ar
- DNS ASK as#####esigns.com.au
- ClassName: 'Indicator' WindowName: ''