Technical Information
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] '6ca0d' = '%APPDATA%\6ca0d\71e8dfe56c.exe'
- '<SYSTEM32>\svchost.exe'
- <SYSTEM32>\svchost.exe
- %APPDATA%\6ca0d\71e8dfe56c.exe
- 'th####utythesis.com':80
- 'av###inc.com':80
- 'it####shkino.org':80
- 'it###ft.asia':80
- http://th####utythesis.com/UaEigq.php?r=############
- DNS ASK th####utythesis.com
- DNS ASK av###inc.com
- DNS ASK it####shkino.org
- DNS ASK it###ft.asia
- ClassName: 'Indicator' WindowName: ''