Technical Information
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Foundation Manager Notification Logon' = '<SYSTEM32>\wovxjqu.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\Program Driver Desktop SPP Device] 'Start' = '00000002'
- Windows Security Center
- '<SYSTEM32>\kadhdmwn.exe' "<SYSTEM32>\wovxjqu.exe"
- '%WINDIR%\Temp\zmvbxp3hutb256.exe' -r 30600 tcp
- '%TEMP%\zmvbxp3cfxb256gvilpfu.exe'
- '<SYSTEM32>\wovxjqu.exe'
- <SYSTEM32>\utlsswfskujml\run
- <SYSTEM32>\utlsswfskujml\rng
- %WINDIR%\Temp\zmvbxp3hutb256.exe
- <SYSTEM32>\utlsswfskujml\cfg
- <SYSTEM32>\kadhdmwn.exe
- %TEMP%\zmvbxp3cfxb256gvilpfu.exe
- <SYSTEM32>\utlsswfskujml\tst
- <SYSTEM32>\wovxjqu.exe
- <SYSTEM32>\utlsswfskujml\etc
- <SYSTEM32>\kadhdmwn.exe
- <SYSTEM32>\wovxjqu.exe
- %WINDIR%\Temp\zmvbxp3hutb256.exe
- <DRIVERS>\etc\hosts
- %TEMP%\zmvbxp3cfxb256gvilpfu.exe
- 'we###orse.net':80
- 'fe###orse.net':80
- 'le###orld.net':80
- 'ta###world.net':80
- 'we###njoy.net':80
- 'fe###njoy.net':80
- 'we###ctover.net':80
- 'fe###ctover.net':80
- 'ta###enjoy.net':80
- 'po###world.net':80
- 'le###orse.net':80
- 'po###enjoy.net':80
- 'ca###orld.net':80
- 'ta####ctover.net':80
- 'le###njoy.net':80
- 'ta###horse.net':80
- 'le###ctover.net':80
- 'st###march.net':80
- 'ta###fruit.net':80
- 'th###world.net':80
- 'fi###horse.net':80
- 'fr###secas.com':80
- 'do####n4guia.com':80
- 'da###ekilai.com':80
- 'la###onea.com':80
- 'li###orld.net':80
- 'li###orse.net':80
- 'th###horse.net':80
- 'we###orld.net':80
- 'fe###orld.net':80
- 'li###njoy.net':80
- 'th###enjoy.net':80
- 'li###ctover.net':80
- 'th####ctover.net':80
- http://we###orse.net/forum/search.php?me#########################################
- http://fe###orse.net/forum/search.php?me#########################################
- http://le###orld.net/forum/search.php?me#########################################
- http://ta###world.net/forum/search.php?me#########################################
- http://we###njoy.net/forum/search.php?me#########################################
- http://fe###njoy.net/forum/search.php?me#########################################
- http://we###ctover.net/forum/search.php?me#########################################
- http://fe###ctover.net/forum/search.php?me#########################################
- http://ta###enjoy.net/forum/search.php?me#########################################
- http://po###world.net/forum/search.php?me#########################################
- http://le###orse.net/forum/search.php?me#########################################
- http://po###enjoy.net/forum/search.php?me#########################################
- http://ca###orld.net/forum/search.php?me#########################################
- http://ta####ctover.net/forum/search.php?me#########################################
- http://le###njoy.net/forum/search.php?me#########################################
- http://ta###horse.net/forum/search.php?me#########################################
- http://le###ctover.net/forum/search.php?me#########################################
- http://st###march.net/forum/search.php?me#########################################
- http://ta###fruit.net/forum/search.php?me#########################################
- http://th###world.net/forum/search.php?me#########################################
- http://fi###horse.net/forum/search.php?me#########################################
- http://fr###secas.com/forum/search.php?me#########################################
- http://do####n4guia.com/forum/search.php?me#########################################
- http://da###ekilai.com/forum/search.php?me#########################################
- http://la###onea.com/forum/search.php?me#########################################
- http://li###orld.net/forum/search.php?me#########################################
- http://li###orse.net/forum/search.php?me#########################################
- http://th###horse.net/forum/search.php?me#########################################
- http://we###orld.net/forum/search.php?me#########################################
- http://fe###orld.net/forum/search.php?me#########################################
- http://li###njoy.net/forum/search.php?me#########################################
- http://th###enjoy.net/forum/search.php?me#########################################
- http://li###ctover.net/forum/search.php?me#########################################
- http://th####ctover.net/forum/search.php?me#########################################
- DNS ASK ta###world.net
- DNS ASK we###orse.net
- DNS ASK ta###enjoy.net
- DNS ASK le###orld.net
- DNS ASK fe###orse.net
- DNS ASK we###njoy.net
- DNS ASK fe###njoy.net
- DNS ASK we###ctover.net
- DNS ASK fe###ctover.net
- DNS ASK ca###orld.net
- DNS ASK po###world.net
- DNS ASK ca###njoy.net
- DNS ASK po###enjoy.net
- DNS ASK le###orse.net
- DNS ASK ta####ctover.net
- DNS ASK le###njoy.net
- DNS ASK ta###horse.net
- DNS ASK le###ctover.net
- DNS ASK st###march.net
- DNS ASK ta###fruit.net
- DNS ASK th###world.net
- DNS ASK fi###horse.net
- DNS ASK fr###secas.com
- DNS ASK do####n4guia.com
- DNS ASK da###ekilai.com
- DNS ASK la###onea.com
- DNS ASK li###orld.net
- DNS ASK li###orse.net
- DNS ASK th###horse.net
- DNS ASK we###orld.net
- DNS ASK fe###orld.net
- DNS ASK li###njoy.net
- DNS ASK th###enjoy.net
- DNS ASK li###ctover.net
- DNS ASK th####ctover.net
- '23#.#55.255.250':1900