Technical Information
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Auto-Discovery Call SPP Input List Secondary DNS' = '<SYSTEM32>\wsdkljtigz.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\Reporting DCOM Launcher Health] 'Start' = '00000002'
- Windows Security Center
- '<SYSTEM32>\yfgtjgdq.exe' "<SYSTEM32>\wsdkljtigz.exe"
- '%WINDIR%\Temp\yojt9q2q75uavou.exe' -r 33349 tcp
- '%TEMP%\yojt9q2g61uavouymtcovxm.exe'
- '<SYSTEM32>\wsdkljtigz.exe'
- <SYSTEM32>\gfglhmlmhzb\run
- <SYSTEM32>\gfglhmlmhzb\rng
- <SYSTEM32>\gfglhmlmhzb\cfg
- <SYSTEM32>\gfglhmlmhzb\por
- %WINDIR%\Temp\yojt9q2q75uavou.exe
- %TEMP%\yojt9q2g61uavouymtcovxm.exe
- <SYSTEM32>\gfglhmlmhzb\tst
- <SYSTEM32>\gfglhmlmhzb\etc
- <SYSTEM32>\yfgtjgdq.exe
- <SYSTEM32>\wsdkljtigz.exe
- <SYSTEM32>\yfgtjgdq.exe
- <SYSTEM32>\wsdkljtigz.exe
- <SYSTEM32>\PerfStringBackup.TMP
- %WINDIR%\Temp\yojt9q2q75uavou.exe
- <SYSTEM32>\wbem\Performance\WmiApRpl.ini
- %TEMP%\yojt9q2g61uavouymtcovxm.exe
- <DRIVERS>\etc\hosts
- 'fa###press.net':80
- 'ri###est.net':80
- 'ri###ress.net':80
- 'ri###oat.net':80
- 'fa###boat.net':80
- 'so###told.net':80
- 'fi###told.net':80
- 'fa###open.net':80
- 'fa###rest.net':80
- 'ri###pen.net':80
- 'ca###est.net':80
- 'po###open.net':80
- 'po###rest.net':80
- 'po###press.net':80
- 'ca###ress.net':80
- 'no###est.net':80
- 'no###pen.net':80
- 'no###ress.net':80
- 'ca###pen.net':80
- 'no###oat.net':80
- 'li###urt.net':80
- 'fe###old.net':80
- 'th###hurt.net':80
- 'th###wear.net':80
- 'li###ear.net':80
- 'fe###ear.net':80
- 'we###ear.net':80
- 'we###ind.net':80
- 'we###old.net':80
- 'fe###ind.net':80
- 'fi###wear.net':80
- 'so###hurt.net':80
- 'so###wear.net':80
- 'so###find.net':80
- 'fi###find.net':80
- 'th###find.net':80
- 'li###ind.net':80
- 'li###old.net':80
- 'fi###hurt.net':80
- 'th###told.net':80
- 'fi###open.net':80
- 'th###boat.net':80
- 'so###open.net':80
- 'so###rest.net':80
- 'fi###rest.net':80
- 'th###rest.net':80
- 'li###est.net':80
- 'li###ress.net':80
- 'li###oat.net':80
- 'th###press.net':80
- 'st###march.net':80
- 'ta###fruit.net':80
- 'ju###ray.net':80
- 'ka####ndertu.com':80
- 'fr###secas.com':80
- 'so###press.net':80
- 'fi###press.net':80
- 'fi###boat.net':80
- 'da###ekilai.com':80
- 'la###onea.com':80
- 'le###ress.net':80
- 'ta###rest.net':80
- 'ta###press.net':80
- 'ta###boat.net':80
- 'le###oat.net':80
- 'po###boat.net':80
- 'ca###oat.net':80
- 'le###pen.net':80
- 'le###est.net':80
- 'ta###open.net':80
- 'we###oat.net':80
- 'fe###ress.net':80
- 'fe###oat.net':80
- 'th###open.net':80
- 'li###pen.net':80
- 'fe###pen.net':80
- 'we###pen.net':80
- 'we###est.net':80
- 'we###ress.net':80
- 'fe###est.net':80
- fa###press.net/forum/search.php?me#########################################
- ri###est.net/forum/search.php?me#########################################
- ri###ress.net/forum/search.php?me#########################################
- ri###oat.net/forum/search.php?me#########################################
- fa###boat.net/forum/search.php?me#########################################
- so###told.net/forum/search.php?me#########################################
- fi###told.net/forum/search.php?me#########################################
- fa###open.net/forum/search.php?me#########################################
- fa###rest.net/forum/search.php?me#########################################
- ri###pen.net/forum/search.php?me#########################################
- ca###est.net/forum/search.php?me#########################################
- po###open.net/forum/search.php?me#########################################
- po###rest.net/forum/search.php?me#########################################
- po###press.net/forum/search.php?me#########################################
- ca###ress.net/forum/search.php?me#########################################
- no###est.net/forum/search.php?me#########################################
- no###pen.net/forum/search.php?me#########################################
- no###ress.net/forum/search.php?me#########################################
- ca###pen.net/forum/search.php?me#########################################
- no###oat.net/forum/search.php?me#########################################
- li###urt.net/forum/search.php?me#########################################
- fe###old.net/forum/search.php?me#########################################
- th###hurt.net/forum/search.php?me#########################################
- th###wear.net/forum/search.php?me#########################################
- li###ear.net/forum/search.php?me#########################################
- fe###ear.net/forum/search.php?me#########################################
- we###ear.net/forum/search.php?me#########################################
- we###ind.net/forum/search.php?me#########################################
- we###old.net/forum/search.php?me#########################################
- fe###ind.net/forum/search.php?me#########################################
- fi###wear.net/forum/search.php?me#########################################
- so###hurt.net/forum/search.php?me#########################################
- so###wear.net/forum/search.php?me#########################################
- so###find.net/forum/search.php?me#########################################
- fi###find.net/forum/search.php?me#########################################
- th###find.net/forum/search.php?me#########################################
- li###ind.net/forum/search.php?me#########################################
- li###old.net/forum/search.php?me#########################################
- fi###hurt.net/forum/search.php?me#########################################
- th###told.net/forum/search.php?me#########################################
- fi###open.net/forum/search.php?me#########################################
- th###boat.net/forum/search.php?me#########################################
- so###open.net/forum/search.php?me#########################################
- so###rest.net/forum/search.php?me#########################################
- fi###rest.net/forum/search.php?me#########################################
- th###rest.net/forum/search.php?me#########################################
- li###est.net/forum/search.php?me#########################################
- li###ress.net/forum/search.php?me#########################################
- li###oat.net/forum/search.php?me#########################################
- th###press.net/forum/search.php?me#########################################
- st###march.net/forum/search.php?me#########################################
- ta###fruit.net/forum/search.php?me#########################################
- ju###ray.net/forum/search.php?me#########################################
- ka####ndertu.com/forum/search.php?me#########################################
- fr###secas.com/forum/search.php?me#########################################
- so###press.net/forum/search.php?me#########################################
- fi###press.net/forum/search.php?me#########################################
- fi###boat.net/forum/search.php?me#########################################
- da###ekilai.com/forum/search.php?me#########################################
- la###onea.com/forum/search.php?me#########################################
- le###ress.net/forum/search.php?me#########################################
- ta###rest.net/forum/search.php?me#########################################
- ta###press.net/forum/search.php?me#########################################
- ta###boat.net/forum/search.php?me#########################################
- le###oat.net/forum/search.php?me#########################################
- po###boat.net/forum/search.php?me#########################################
- ca###oat.net/forum/search.php?me#########################################
- le###pen.net/forum/search.php?me#########################################
- le###est.net/forum/search.php?me#########################################
- ta###open.net/forum/search.php?me#########################################
- we###oat.net/forum/search.php?me#########################################
- fe###ress.net/forum/search.php?me#########################################
- fe###oat.net/forum/search.php?me#########################################
- th###open.net/forum/search.php?me#########################################
- li###pen.net/forum/search.php?me#########################################
- fe###pen.net/forum/search.php?me#########################################
- we###pen.net/forum/search.php?me#########################################
- we###est.net/forum/search.php?me#########################################
- we###ress.net/forum/search.php?me#########################################
- fe###est.net/forum/search.php?me#########################################
- DNS ASK fa###press.net
- DNS ASK ri###est.net
- DNS ASK ri###ress.net
- DNS ASK ri###oat.net
- DNS ASK fa###boat.net
- DNS ASK so###told.net
- DNS ASK fi###told.net
- DNS ASK fa###open.net
- DNS ASK fa###rest.net
- DNS ASK ri###pen.net
- DNS ASK ca###est.net
- DNS ASK po###open.net
- DNS ASK po###rest.net
- DNS ASK po###press.net
- DNS ASK ca###ress.net
- DNS ASK no###est.net
- DNS ASK no###pen.net
- DNS ASK no###ress.net
- DNS ASK ca###pen.net
- DNS ASK no###oat.net
- DNS ASK li###urt.net
- DNS ASK fe###old.net
- DNS ASK th###hurt.net
- DNS ASK th###wear.net
- DNS ASK li###ear.net
- DNS ASK fe###ear.net
- DNS ASK we###ear.net
- DNS ASK we###ind.net
- DNS ASK we###old.net
- DNS ASK fe###ind.net
- DNS ASK fi###wear.net
- DNS ASK so###hurt.net
- DNS ASK so###wear.net
- DNS ASK so###find.net
- DNS ASK fi###find.net
- DNS ASK th###find.net
- DNS ASK li###ind.net
- DNS ASK li###old.net
- DNS ASK fi###hurt.net
- DNS ASK th###told.net
- DNS ASK ca###oat.net
- DNS ASK so###open.net
- DNS ASK fi###open.net
- DNS ASK so###rest.net
- DNS ASK fi###rest.net
- DNS ASK th###boat.net
- DNS ASK li###ress.net
- DNS ASK th###rest.net
- DNS ASK li###oat.net
- DNS ASK th###press.net
- DNS ASK fi###press.net
- DNS ASK ju###ray.net
- DNS ASK st###march.net
- DNS ASK ka####ndertu.com
- DNS ASK fr###secas.com
- DNS ASK ta###fruit.net
- DNS ASK fi###boat.net
- DNS ASK so###press.net
- DNS ASK da###ekilai.com
- DNS ASK la###onea.com
- DNS ASK li###est.net
- DNS ASK ta###press.net
- DNS ASK le###ress.net
- DNS ASK ta###boat.net
- DNS ASK le###oat.net
- DNS ASK ta###rest.net
- DNS ASK le###pen.net
- DNS ASK po###boat.net
- DNS ASK le###est.net
- DNS ASK ta###open.net
- DNS ASK we###pen.net
- DNS ASK fe###oat.net
- DNS ASK we###oat.net
- DNS ASK th###open.net
- DNS ASK li###pen.net
- DNS ASK fe###ress.net
- DNS ASK we###est.net
- DNS ASK fe###pen.net
- DNS ASK we###ress.net
- DNS ASK fe###est.net
- '23#.#55.255.250':1900