Technical Information
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'xcdbyksf' = '%APPDATA%\xcdbyksf.exe'
- %APPDATA%\xcdbyksf.exe
- nul
- %APPDATA%\svchost.exe
- 'un####dstories.com':80
- http://21#.#.117.48/j537djjlhg763/taskhost.exe?nl##
- http://21#.#.117.48/j537djjlhg763/update.php?nl##
- http://21#.#.117.48/j537djjlhg763/svchost.exe
- http://21#.#.117.48/j537djjlhg763/1.php?i=#######################
- http://my##ep.be/xmlrpc.php
- http://fc#####unities.co.uk/xmlrpc.php
- http://ga###ci.dole.si/xmlrpc.php
- http://de###nsales.net/xmlrpc.php
- http://da####iggins.com/xmlrpc.php
- http://mo###ebush.com/xmlrpc.php
- http://pu###avanow.com/xmlrpc.php
- http://mo###tel.com/xmlrpc.php
- http://ih####geekshow.com/xmlrpc.php
- http://bl####lloweo.com/xmlrpc.php
- http://st#######nnectedinitiative.org/xmlrpc.php
- http://www.ca###et-ask.com/xmlrpc.php
- http://ch###er4oil.com/xmlrpc.php
- http://le####letter.net/xmlrpc.php
- http://mi#####tersproject.org/xmlrpc.php
- http://so###lity.biz/xmlrpc.php
- http://de#######wranchandcabins.com/xmlrpc.php
- http://b4#.#tem9.com/xmlrpc.php
- http://mo####ilbonds.com/xmlrpc.php
- http://nk##ngh.in/xmlrpc.php
- http://ta###tspace.pl/xmlrpc.php
- http://in####thailand.com/xmlrpc.php
- http://ni####oup-it.com/xmlrpc.php
- http://an####a-bali.com/xmlrpc.php
- http://ga##by.com/xmlrpc.php
- http://lo#####chitecture.ch/xmlrpc.php
- http://do####advideo.com/xmlrpc.php
- http://ju####lassus.com/xmlrpc.php
- http://pu#####aranormal.com/xmlrpc.php
- http://ha##.###.native-service.net/xmlrpc.php
- http://ru#####nglertreff.de/xmlrpc.php
- http://sp######technologies.com/xmlrpc.php
- http://ti###ronk.dk/xmlrpc.php
- http://gr####agcity.com/xmlrpc.php
- http://ph###zeum.com/xmlrpc.php
- http://st##.ulyssis.be/xmlrpc.php
- http://ga####toflove.org/xmlrpc.php
- http://www.at######ogranadajoven.es/wp/xmlrpc.php
- http://wi###rbasis.nl/xmlrpc.php
- http://in######ionalboysday.org/xmlrpc.php
- http://ok###ght.com/xmlrpc.php
- http://fl###maniac.net/xmlrpc.php
- http://pa###umat.org/xmlrpc.php
- http://ph#####yschoolsanz.org/xmlrpc.php
- http://vi#####pcservices.be/xmlrpc.php
- http://cl.###strufy.com/xmlrpc.php
- http://www.st#####ievasseur.com/xmlrpc.php
- http://wo###tgirl.com/xmlrpc.php
- http://vv###sparen.nl/xmlrpc.php
- http://da##i.od.ua/xmlrpc.php
- http://ma####olesti.com/xmlrpc.php
- http://ch######nbibleinstitute.net/xmlrpc.php
- http://ar#####inhomecare.com/xmlrpc.php
- http://gr####trentals.com/xmlrpc.php
- http://cr######craltreatment.co.uk/xmlrpc.php
- http://ma##tino.se/xmlrpc.php
- http://www.br##rch.com/xmlrpc.php
- http://ar##60.ro/xmlrpc.php
- http://xk###rygfum.cf/xmlrpc.php
- http://ba###cdiap.cat/xmlrpc.php
- http://vo#####alviosbeltrum.nl/xmlrpc.php
- http://su###sstv.com/xmlrpc.php
- http://www.g-###taku.jp/xmlrpc.php
- http://qu##tay.pro/xmlrpc.php
- http://ro###ldies.net/xmlrpc.php
- http://ch###projekt.cz/xmlrpc.php
- http://do####playsatl.org/xmlrpc.php
- http://co####sos-secca.com/xmlrpc.php
- http://th###ult.com/xmlrpc.php
- http://sp####ut-leman.ch/xmlrpc.php
- http://im###ss-ev.de/xmlrpc.php
- http://sw###tone.ch/xmlrpc.php
- DNS ASK bd#s.by
- DNS ASK pu###avanow.com
- DNS ASK ts####test50.com
- DNS ASK ks##atou.be
- DNS ASK mo###ebush.com
- DNS ASK da####iggins.com
- DNS ASK st####stucson.com
- DNS ASK de###nsales.net
- DNS ASK sa#####agencyinc.com
- DNS ASK ga###ci.dole.si
- DNS ASK st#######nnectedinitiative.org
- DNS ASK do####advideo.com
- DNS ASK b4#.#tem9.com
- DNS ASK en#####isemarine.com.au
- DNS ASK fc#####unities.co.uk
- DNS ASK ge###wijzer.nl
- DNS ASK is######chielkestudio.com
- DNS ASK go######kopen-amsterdam.nl
- DNS ASK ma###raozon.net
- DNS ASK ha##.###.native-service.net
- DNS ASK ve##elux.md
- DNS ASK me###ish.com
- DNS ASK sh###agari.com
- DNS ASK ih####geekshow.com
- DNS ASK ri###antas.lt
- DNS ASK sa####ng-vip.net
- DNS ASK fa##k.org
- DNS ASK mu#####tsystems.co.za
- DNS ASK co###oof.com
- DNS ASK al####wtents.com
- DNS ASK ha##pijn.nl
- DNS ASK ho###ticure.jp
- DNS ASK de#######wranchandcabins.com
- DNS ASK st##.ulyssis.be
- DNS ASK mi#####tersproject.org
- DNS ASK lo#####chitecture.ch
- DNS ASK we#####zine.moyais.com
- DNS ASK di####huatanejo.com
- DNS ASK at###terra.com
- DNS ASK pa#####.minute-fruitee.fr
- DNS ASK ch###er4oil.com
- DNS ASK ca###et-ask.com
- DNS ASK th###abri.org
- DNS ASK so###lity.biz
- DNS ASK ki####crodney.co.nz
- DNS ASK bl####lloweo.com
- DNS ASK of####factory.at
- DNS ASK ga####toflove.org
- DNS ASK le####letter.net
- DNS ASK il###ellaio.com
- DNS ASK ti###ronk.dk
- DNS ASK sp######technologies.com
- DNS ASK bn###abella.eu
- DNS ASK ta###tspace.pl
- DNS ASK so##io.be
- DNS ASK sw###tone.ch
- DNS ASK im###ss-ev.de
- DNS ASK th#####utedubonheur.com
- DNS ASK gh##co.cn
- DNS ASK st####remen.info
- DNS ASK fa###eport.com
- DNS ASK al#####eyerphoto.com
- DNS ASK dr####pelosi.com
- DNS ASK nt#.rs
- DNS ASK je####rclub.info
- DNS ASK bl####ndwhite.nl
- DNS ASK st#####egalezizzi.it
- DNS ASK po###der.media
- DNS ASK un####dstories.com
- DNS ASK po###s852.com
- DNS ASK cc#.sk
- DNS ASK ce#.#ng.ua.edu
- DNS ASK si###sp.org.br
- DNS ASK on####courses.co.il
- DNS ASK ed###thouse.pl
- DNS ASK ah##zc.com
- DNS ASK it###athome.it
- DNS ASK gr####agcity.com
- DNS ASK us###oyacim.com
- DNS ASK fl####nguenet.fr
- DNS ASK ru#####nglertreff.de
- DNS ASK mo####ilbonds.com
- DNS ASK po#######mientowebsevilla.net
- DNS ASK ou####dquotes.com
- DNS ASK pu#####aranormal.com
- DNS ASK ch####ian-bosch.com
- DNS ASK ju####lassus.com
- DNS ASK su#####baratpost.com
- DNS ASK yo####ftfrom.com
- DNS ASK ga##by.com
- DNS ASK ba##two.com
- DNS ASK ai#####ueflorida.com
- DNS ASK th###lesty.com
- DNS ASK tw###sstore.com
- DNS ASK za###ncraft.com
- DNS ASK an####a-bali.com
- DNS ASK vi###xtile.net
- DNS ASK me#####tawesterbork.nl
- DNS ASK in####thailand.com
- DNS ASK ni####oup-it.com
- DNS ASK nk##ngh.in
- DNS ASK fr####rset.co.uk
- DNS ASK sm#####emicalnews.com
- DNS ASK si####simburda.com
- DNS ASK dn###ood.com
- DNS ASK pa##uk.tech
- DNS ASK eu###empest.net
- DNS ASK ma####olesti.com
- DNS ASK go##ora.com
- DNS ASK e-##an.com
- DNS ASK ph#####yschoolsanz.org
- DNS ASK he#####cbdbenefits.com
- DNS ASK fl###maniac.net
- DNS ASK ka###emajet.com
- DNS ASK re####symphony.com
- DNS ASK hb##ans.nl
- DNS ASK em##dsr.org
- DNS ASK ok###ght.com
- DNS ASK ba####chauau.com
- DNS ASK la####dersports.com
- DNS ASK ri###daily.com
- DNS ASK at######ogranadajoven.es
- DNS ASK sa###olto.com
- DNS ASK zi####we.misa.org
- DNS ASK to###ogic.com
- DNS ASK ma###mmini.vn
- DNS ASK tr#####ifecleaners.com
- DNS ASK vi#####pcservices.be
- DNS ASK lu###droese.de
- DNS ASK en####ectric.com
- DNS ASK no#r.nl
- DNS ASK 2c####ructions.com
- DNS ASK my##ep.be
- DNS ASK fr######struwwelpeter.net
- DNS ASK me####s-sonores.ch
- DNS ASK e-###tuva.lt
- DNS ASK ki#####pvangrolde.nl
- DNS ASK da##i.od.ua
- DNS ASK lh####rdusommeil.fr
- DNS ASK ac###etout.com
- DNS ASK gl###lprep.gr
- DNS ASK ib#.pl
- DNS ASK wo###tgirl.com
- DNS ASK st#####ievasseur.com
- DNS ASK in######ionalboysday.org
- DNS ASK co###izz.com
- DNS ASK ge######ontractorgroup.com
- DNS ASK cl.###strufy.com
- DNS ASK ko###sportv.com
- DNS ASK in###limarq.com
- DNS ASK k6###847.lib
- DNS ASK vv###sparen.nl
- DNS ASK gr####trentals.com
- DNS ASK ca####whispers.com
- DNS ASK wi###rbasis.nl
- DNS ASK ag#.agr.br
- DNS ASK no######tparkburlington.com
- DNS ASK cr####016.inria.fr
- DNS ASK ma##tino.se
- DNS ASK in#######mondial-consulting.ch
- DNS ASK vo#####alviosbeltrum.nl
- DNS ASK ma####edreams.com
- DNS ASK bf###heer.com
- DNS ASK be###eca.com
- DNS ASK 10##er.com
- DNS ASK ba###cdiap.cat
- DNS ASK ha#####hirecare.co.uk
- DNS ASK br##rch.com
- DNS ASK vi##toen.fi
- DNS ASK fl###chool.com
- DNS ASK wi####toluxury.com
- DNS ASK cr######craltreatment.co.uk
- DNS ASK ar##60.ro
- DNS ASK xk###rygfum.cf
- DNS ASK un##erst.ro
- DNS ASK ph###zeum.com
- DNS ASK mo###tel.com
- DNS ASK su###sstv.com
- DNS ASK sp###ory.com
- DNS ASK re#####hmypast.co.uk
- DNS ASK he#######raxis-filderklinik.de
- DNS ASK ar#####inhomecare.com
- DNS ASK ch######nbibleinstitute.net
- DNS ASK pa###umat.org
- DNS ASK zu##t.eu
- DNS ASK ol####thgolf.com
- DNS ASK qu##tay.pro
- DNS ASK th###ult.com
- DNS ASK ge##tech.fr
- DNS ASK ru####numbers.org
- DNS ASK de####recroacia.com
- DNS ASK zw#####reiundvierzig.de
- DNS ASK re##nd.com
- DNS ASK do####playsatl.org
- DNS ASK g-###taku.jp
- DNS ASK sp####ut-leman.ch
- DNS ASK co####sos-secca.com
- DNS ASK om###chau.de
- DNS ASK ch###projekt.cz
- DNS ASK nu####family.org
- DNS ASK pu#####isappeared.org
- DNS ASK ro###ldies.net
- DNS ASK ge###mbia.org
- DNS ASK gr###dedpgh.org
- DNS ASK ja###-eg.com
- '%APPDATA%\xcdbyksf.exe'
- '%APPDATA%\svchost.exe'
- '%WINDIR%\syswow64\cmd.exe' /C ping 1.1.1.1 -n 1 -w -n 1 -w3000 > Nul & Del /f /q "<Full path to file>"/f /q "(null)"
- '%WINDIR%\syswow64\ping.exe' 1.1.1.1 -n 1 -w -n 1 -w3000