Technical Information
- [<HKLM>\SYSTEM\ControlSet001\Services\LRfLZk\Parameters] 'ServiceDll' = '%APPDATA%\KHwWVE\p3aMbL.dll'
- [<HKLM>\SYSTEM\ControlSet001\Services\LRfLZk] 'ImagePath' = '<SYSTEM32>\svchost.exe -k LRfLZk'
- '<SYSTEM32>\svchost.exe' -k LRfLZk
- <SYSTEM32>\svchost.exe
- %APPDATA%\KHwWVE\p3aMbL.dll
- 'pa####.b0.upaiyun.com':80
- '12#.#3.100.163':9111
- '12#.#9.75.182':4001
- http://pa####.b0.upaiyun.com/abs/free028.dat
- DNS ASK pa####.b0.upaiyun.com
- '<L###LNET>.0.83':12385
- '<L###LNET>.0.82':12385
- '<L###LNET>.0.85':12385
- '<L###LNET>.0.84':12385
- '<L###LNET>.0.79':12385
- '<L###LNET>.0.78':12385
- '<L###LNET>.0.81':12385
- '<L###LNET>.0.80':12385
- '<L###LNET>.0.91':12385
- '<L###LNET>.0.90':12385
- '<L###LNET>.0.93':12385
- '<L###LNET>.0.92':12385
- '<L###LNET>.0.87':12385
- '<L###LNET>.0.86':12385
- '<L###LNET>.0.89':12385
- '<L###LNET>.0.88':12385
- '<L###LNET>.0.67':12385
- '<L###LNET>.0.66':12385
- '<L###LNET>.0.69':12385
- '<L###LNET>.0.68':12385
- '<L###LNET>.0.63':12385
- '<L###LNET>.0.62':12385
- '<L###LNET>.0.65':12385
- '<L###LNET>.0.64':12385
- '<L###LNET>.0.75':12385
- '<L###LNET>.0.74':12385
- '<L###LNET>.0.77':12385
- '<L###LNET>.0.76':12385
- '<L###LNET>.0.71':12385
- '<L###LNET>.0.70':12385
- '<L###LNET>.0.73':12385
- '<L###LNET>.0.72':12385
- '<L####NET>.0.115':12385
- '<L####NET>.0.114':12385
- '<L####NET>.0.117':12385
- '<L####NET>.0.116':12385
- '<L####NET>.0.111':12385
- '<L####NET>.0.110':12385
- '<L####NET>.0.113':12385
- '<L####NET>.0.112':12385
- '<L####NET>.0.123':12385
- '<L####NET>.0.122':12385
- '<L####NET>.0.125':12385
- '<L####NET>.0.124':12385
- '<L####NET>.0.119':12385
- '<L####NET>.0.118':12385
- '<L####NET>.0.121':12385
- '<L####NET>.0.120':12385
- '<L###LNET>.0.99':12385
- '<L###LNET>.0.98':12385
- '<L####NET>.0.101':12385
- '<L####NET>.0.100':12385
- '<L###LNET>.0.95':12385
- '<L###LNET>.0.94':12385
- '<L###LNET>.0.97':12385
- '<L###LNET>.0.96':12385
- '<L####NET>.0.107':12385
- '<L####NET>.0.106':12385
- '<L####NET>.0.109':12385
- '<L####NET>.0.108':12385
- '<L####NET>.0.103':12385
- '<L####NET>.0.102':12385
- '<L####NET>.0.105':12385
- '<L####NET>.0.104':12385
- '<L###LNET>.0.19':12385
- '<L###LNET>.0.18':12385
- '<L###LNET>.0.21':12385
- '<L###LNET>.0.20':12385
- '<L###LNET>.0.15':12385
- '<L###LNET>.0.14':12385
- '<L###LNET>.0.17':12385
- '<L###LNET>.0.16':12385
- '<L###LNET>.0.27':12385
- '<L###LNET>.0.26':12385
- '<L###LNET>.0.29':12385
- '<L###LNET>.0.28':12385
- '<L###LNET>.0.23':12385
- '<L###LNET>.0.22':12385
- '<L###LNET>.0.25':12385
- '<L###LNET>.0.24':12385
- '<L###LNET>.0.3':12385
- '<L####NET_GATEWAY>':12385
- '<L###LNET>.0.5':12385
- '<L###LNET>.0.4':12385
- 'localhost':51411
- '<L####NET>.0.254':12385
- '<L####NET>.0.254':51411
- '<L####NET>.0.253':51411
- '<L###LNET>.0.11':12385
- '<L###LNET>.0.10':12385
- '<L###LNET>.0.13':12385
- '<L###LNET>.0.12':12385
- '<L###LNET>.0.7':12385
- '<L###LNET>.0.6':12385
- '<L###LNET>.0.9':12385
- '<L###LNET>.0.8':12385
- '<L###LNET>.0.51':12385
- '<L###LNET>.0.50':12385
- '<L###LNET>.0.53':12385
- '<L###LNET>.0.52':12385
- '<L###LNET>.0.47':12385
- '<L###LNET>.0.46':12385
- '<L###LNET>.0.49':12385
- '<L###LNET>.0.48':12385
- '<L###LNET>.0.59':12385
- '<L###LNET>.0.58':12385
- '<L###LNET>.0.61':12385
- '<L###LNET>.0.60':12385
- '<L###LNET>.0.55':12385
- '<L###LNET>.0.54':12385
- '<L###LNET>.0.57':12385
- '<L###LNET>.0.56':12385
- '<L###LNET>.0.35':12385
- '<L###LNET>.0.34':12385
- '<L###LNET>.0.37':12385
- '<L###LNET>.0.36':12385
- '<L###LNET>.0.31':12385
- '<L###LNET>.0.30':12385
- '<L###LNET>.0.33':12385
- '<L###LNET>.0.32':12385
- '<L###LNET>.0.43':12385
- '<L###LNET>.0.42':12385
- '<L###LNET>.0.45':12385
- '<L###LNET>.0.44':12385
- '<L###LNET>.0.39':12385
- '<L###LNET>.0.38':12385
- '<L###LNET>.0.41':12385
- '<L###LNET>.0.40':12385
- '<L####NET>.0.126':12385
- '<L####NET>.0.212':12385
- '<L####NET>.0.211':12385
- '<L####NET>.0.214':12385
- '<L####NET>.0.213':12385
- '<L####NET>.0.208':12385
- '<L####NET>.0.207':12385
- '<L####NET>.0.210':12385
- '<L####NET>.0.209':12385
- '<L####NET>.0.220':12385
- '<L####NET>.0.219':12385
- '<L####NET>.0.222':12385
- '<L####NET>.0.221':12385
- '<L####NET>.0.216':12385
- '<L####NET>.0.215':12385
- '<L####NET>.0.218':12385
- '<L####NET>.0.217':12385
- '<L####NET>.0.196':12385
- '<L####NET>.0.195':12385
- '<L####NET>.0.198':12385
- '<L####NET>.0.197':12385
- '<L####NET>.0.192':12385
- '<L####NET>.0.191':12385
- '<L####NET>.0.194':12385
- '<L####NET>.0.193':12385
- '<L####NET>.0.204':12385
- '<L####NET>.0.203':12385
- '<L####NET>.0.206':12385
- '<L####NET>.0.205':12385
- '<L####NET>.0.200':12385
- '<L####NET>.0.199':12385
- '<L####NET>.0.202':12385
- '<L####NET>.0.201':12385
- '<L####NET>.0.244':12385
- '<L####NET>.0.243':12385
- '<L####NET>.0.246':12385
- '<L####NET>.0.245':12385
- '<L####NET>.0.240':12385
- '<L####NET>.0.239':12385
- '<L####NET>.0.242':12385
- '<L####NET>.0.241':12385
- '<L####NET>.0.252':12385
- '<L####NET>.0.251':12385
- 'localhost':12385
- '<L####NET>.0.253':12385
- '<L####NET>.0.248':12385
- '<L####NET>.0.247':12385
- '<L####NET>.0.250':12385
- '<L####NET>.0.249':12385
- '<L####NET>.0.228':12385
- '<L####NET>.0.227':12385
- '<L####NET>.0.230':12385
- '<L####NET>.0.229':12385
- '<L####NET>.0.224':12385
- '<L####NET>.0.223':12385
- '<L####NET>.0.226':12385
- '<L####NET>.0.225':12385
- '<L####NET>.0.236':12385
- '<L####NET>.0.235':12385
- '<L####NET>.0.238':12385
- '<L####NET>.0.237':12385
- '<L####NET>.0.232':12385
- '<L####NET>.0.231':12385
- '<L####NET>.0.234':12385
- '<L####NET>.0.233':12385
- '<L####NET>.0.148':12385
- '<L####NET>.0.147':12385
- '<L####NET>.0.150':12385
- '<L####NET>.0.149':12385
- '<L####NET>.0.144':12385
- '<L####NET>.0.143':12385
- '<L####NET>.0.146':12385
- '<L####NET>.0.145':12385
- '<L####NET>.0.156':12385
- '<L####NET>.0.155':12385
- '<L####NET>.0.158':12385
- '<L####NET>.0.157':12385
- '<L####NET>.0.152':12385
- '<L####NET>.0.151':12385
- '<L####NET>.0.154':12385
- '<L####NET>.0.153':12385
- '<L####NET>.0.132':12385
- '<L####NET>.0.131':12385
- '<L####NET>.0.134':12385
- '<L####NET>.0.133':12385
- '<L####NET>.0.128':12385
- '<L####NET>.0.127':12385
- '<L####NET>.0.130':12385
- '<L####NET>.0.129':12385
- '<L####NET>.0.140':12385
- '<L####NET>.0.139':12385
- '<L####NET>.0.142':12385
- '<L####NET>.0.141':12385
- '<L####NET>.0.136':12385
- '<L####NET>.0.135':12385
- '<L####NET>.0.138':12385
- '<L####NET>.0.137':12385
- '<L####NET>.0.180':12385
- '<L####NET>.0.179':12385
- '<L####NET>.0.182':12385
- '<L####NET>.0.181':12385
- '<L####NET>.0.176':12385
- '<L####NET>.0.175':12385
- '<L####NET>.0.178':12385
- '<L####NET>.0.177':12385
- '<L####NET>.0.188':12385
- '<L####NET>.0.187':12385
- '<L####NET>.0.190':12385
- '<L####NET>.0.189':12385
- '<L####NET>.0.184':12385
- '<L####NET>.0.183':12385
- '<L####NET>.0.186':12385
- '<L####NET>.0.185':12385
- '<L####NET>.0.164':12385
- '<L####NET>.0.163':12385
- '<L####NET>.0.166':12385
- '<L####NET>.0.165':12385
- '<L####NET>.0.160':12385
- '<L####NET>.0.159':12385
- '<L####NET>.0.162':12385
- '<L####NET>.0.161':12385
- '<L####NET>.0.172':12385
- '<L####NET>.0.171':12385
- '<L####NET>.0.174':12385
- '<L####NET>.0.173':12385
- '<L####NET>.0.168':12385
- '<L####NET>.0.167':12385
- '<L####NET>.0.170':12385
- '<L####NET>.0.169':12385