Technical Information
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Task Endpoint TP Human' = '<SYSTEM32>\gimckwkmolaj.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\Source Filtering Device Base Themes List] 'Start' = '00000002'
- Windows Security Center
- '<SYSTEM32>\iigbwsk.exe' "<SYSTEM32>\gimckwkmolaj.exe"
- '%WINDIR%\Temp\vhs1vzbu3n4hn5kqj.exe' -r 29416 tcp
- '%TEMP%\vhs1vzbu3b15n5kqja7nycws.exe'
- '<SYSTEM32>\gimckwkmolaj.exe'
- <SYSTEM32>\wqqmsqtmyqsg\run
- <SYSTEM32>\wqqmsqtmyqsg\rng
- %WINDIR%\Temp\vhs1vzbu3n4hn5kqj.exe
- <SYSTEM32>\wqqmsqtmyqsg\cfg
- <SYSTEM32>\iigbwsk.exe
- %TEMP%\vhs1vzbu3b15n5kqja7nycws.exe
- <SYSTEM32>\wqqmsqtmyqsg\tst
- <SYSTEM32>\gimckwkmolaj.exe
- <SYSTEM32>\wqqmsqtmyqsg\etc
- <SYSTEM32>\iigbwsk.exe
- <SYSTEM32>\gimckwkmolaj.exe
- %WINDIR%\Temp\vhs1vzbu3n4hn5kqj.exe
- <DRIVERS>\etc\hosts
- %TEMP%\vhs1vzbu3b15n5kqja7nycws.exe
- 'eq###neck.net':80
- 'gr###neck.net':80
- 'ta###meet.net':80
- 'ta###food.net':80
- 'gl###eet.net':80
- 'eq###shown.net':80
- 'eq###meet.net':80
- 'gr###meet.net':80
- 'gr###food.net':80
- 'gr###shown.net':80
- 'eq###food.net':80
- 'sa###ood.net':80
- 'sp###eet.net':80
- 'sp###ood.net':80
- 'sp###hown.net':80
- 'sa###hown.net':80
- 'sa###eet.net':80
- 'ta###shown.net':80
- 'gl###ood.net':80
- 'gl###hown.net':80
- 'gl###eck.net':80
- 'ta###neck.net':80
- 'wa###meet.net':80
- 'fa###eet.net':80
- 'fa###ood.net':80
- 'fa###hown.net':80
- 'wa###food.net':80
- 'dr###neck.net':80
- 'dr###food.net':80
- 'th###ood.net':80
- 'th###hown.net':80
- 'th###eck.net':80
- 'dr###shown.net':80
- 'vi###shown.net':80
- 'sp###food.net':80
- 'sp###shown.net':80
- 'sp###neck.net':80
- 'vi###neck.net':80
- 'vi###food.net':80
- 'fa###eck.net':80
- 'wa###shown.net':80
- 'wa###neck.net':80
- 'sp###meet.net':80
- 'vi###meet.net':80
- 'sa###eck.net':80
- 'fa###roud.net':80
- 'wa###raise.net':80
- 'wa###croud.net':80
- 'wa###price.net':80
- 'fa###rice.net':80
- 'fa###aise.net':80
- 'th###rice.net':80
- 'dr###croud.net':80
- 'dr###price.net':80
- 'wa###reach.net':80
- 'fa###each.net':80
- 'de###lxc.com':80
- 'vi###price.net':80
- 'be##lxc.com':80
- 'ri###nstorm.net':80
- 'af###sllc.com':80
- 'sp###croud.net':80
- 'sp###reach.net':80
- 'vi###reach.net':80
- 'vi###raise.net':80
- 'vi###croud.net':80
- 'sp###raise.net':80
- 'wh###neck.net':80
- 'up###hown.net':80
- 'up###eck.net':80
- 'ar###meet.net':80
- 'so###meet.net':80
- 'wh###shown.net':80
- 'wh###meet.net':80
- 'sp###eck.net':80
- 'up###eet.net':80
- 'up###ood.net':80
- 'wh###food.net':80
- 'dr###reach.net':80
- 'th###each.net':80
- 'th###aise.net':80
- 'th###roud.net':80
- 'dr###raise.net':80
- 'ar###neck.net':80
- 'ar###food.net':80
- 'so###food.net':80
- 'so###shown.net':80
- 'so###neck.net':80
- 'ar###shown.net':80
- http://eq###neck.net/index.php
- http://gr###neck.net/index.php
- http://ta###meet.net/index.php
- http://ta###food.net/index.php
- http://gl###eet.net/index.php
- http://eq###shown.net/index.php
- http://eq###meet.net/index.php
- http://gr###meet.net/index.php
- http://gr###food.net/index.php
- http://gr###shown.net/index.php
- http://eq###food.net/index.php
- http://sa###ood.net/index.php
- http://sp###eet.net/index.php
- http://sp###ood.net/index.php
- http://sp###hown.net/index.php
- http://sa###hown.net/index.php
- http://sa###eet.net/index.php
- http://ta###shown.net/index.php
- http://gl###ood.net/index.php
- http://gl###hown.net/index.php
- http://gl###eck.net/index.php
- http://ta###neck.net/index.php
- http://wa###meet.net/index.php
- http://fa###eet.net/index.php
- http://fa###ood.net/index.php
- http://fa###hown.net/index.php
- http://wa###food.net/index.php
- http://dr###neck.net/index.php
- http://dr###food.net/index.php
- http://th###ood.net/index.php
- http://th###hown.net/index.php
- http://th###eck.net/index.php
- http://dr###shown.net/index.php
- http://vi###shown.net/index.php
- http://sp###food.net/index.php
- http://sp###shown.net/index.php
- http://sp###neck.net/index.php
- http://vi###neck.net/index.php
- http://vi###food.net/index.php
- http://fa###eck.net/index.php
- http://wa###shown.net/index.php
- http://wa###neck.net/index.php
- http://sp###meet.net/index.php
- http://vi###meet.net/index.php
- http://sa###eck.net/index.php
- http://fa###roud.net/index.php
- http://wa###raise.net/index.php
- http://wa###croud.net/index.php
- http://wa###price.net/index.php
- http://fa###rice.net/index.php
- http://fa###aise.net/index.php
- http://th###rice.net/index.php
- http://dr###croud.net/index.php
- http://dr###price.net/index.php
- http://wa###reach.net/index.php
- http://fa###each.net/index.php
- http://de###lxc.com/index.php
- http://vi###price.net/index.php
- http://be##lxc.com/index.php
- http://ri###nstorm.net/index.php
- http://af###sllc.com/index.php
- http://sp###croud.net/index.php
- http://sp###reach.net/index.php
- http://vi###reach.net/index.php
- http://vi###raise.net/index.php
- http://vi###croud.net/index.php
- http://sp###raise.net/index.php
- http://wh###neck.net/index.php
- http://up###hown.net/index.php
- http://up###eck.net/index.php
- http://ar###meet.net/index.php
- http://so###meet.net/index.php
- http://wh###shown.net/index.php
- http://wh###meet.net/index.php
- http://sp###eck.net/index.php
- http://up###eet.net/index.php
- http://up###ood.net/index.php
- http://wh###food.net/index.php
- http://dr###reach.net/index.php
- http://th###each.net/index.php
- http://th###aise.net/index.php
- http://th###roud.net/index.php
- http://dr###raise.net/index.php
- http://ar###neck.net/index.php
- http://ar###food.net/index.php
- http://so###food.net/index.php
- http://so###shown.net/index.php
- http://so###neck.net/index.php
- http://ar###shown.net/index.php
- DNS ASK ta###meet.net
- DNS ASK eq###neck.net
- DNS ASK gl###eet.net
- DNS ASK gl###ood.net
- DNS ASK ta###food.net
- DNS ASK gr###neck.net
- DNS ASK gr###food.net
- DNS ASK eq###meet.net
- DNS ASK eq###food.net
- DNS ASK eq###shown.net
- DNS ASK gr###shown.net
- DNS ASK sp###ood.net
- DNS ASK sa###ood.net
- DNS ASK sa###hown.net
- DNS ASK sa###eck.net
- DNS ASK sp###hown.net
- DNS ASK sp###eet.net
- DNS ASK gl###hown.net
- DNS ASK ta###shown.net
- DNS ASK ta###neck.net
- DNS ASK sa###eet.net
- DNS ASK gl###eck.net
- DNS ASK gr###meet.net
- DNS ASK wa###meet.net
- DNS ASK fa###eet.net
- DNS ASK fa###ood.net
- DNS ASK fa###hown.net
- DNS ASK wa###food.net
- DNS ASK dr###neck.net
- DNS ASK dr###food.net
- DNS ASK th###ood.net
- DNS ASK th###hown.net
- DNS ASK th###eck.net
- DNS ASK dr###shown.net
- DNS ASK vi###shown.net
- DNS ASK sp###food.net
- DNS ASK sp###shown.net
- DNS ASK sp###neck.net
- DNS ASK vi###neck.net
- DNS ASK vi###food.net
- DNS ASK fa###eck.net
- DNS ASK wa###shown.net
- DNS ASK wa###neck.net
- DNS ASK sp###meet.net
- DNS ASK vi###meet.net
- DNS ASK fa###roud.net
- DNS ASK wa###raise.net
- DNS ASK wa###croud.net
- DNS ASK wa###price.net
- DNS ASK fa###rice.net
- DNS ASK fa###aise.net
- DNS ASK th###rice.net
- DNS ASK dr###croud.net
- DNS ASK dr###price.net
- DNS ASK wa###reach.net
- DNS ASK fa###each.net
- DNS ASK de###lxc.com
- DNS ASK vi###price.net
- DNS ASK be##lxc.com
- DNS ASK ri###nstorm.net
- DNS ASK af###sllc.com
- DNS ASK sp###croud.net
- DNS ASK sp###reach.net
- DNS ASK vi###reach.net
- DNS ASK vi###raise.net
- DNS ASK vi###croud.net
- DNS ASK sp###raise.net
- DNS ASK wh###neck.net
- DNS ASK up###hown.net
- DNS ASK up###eck.net
- DNS ASK ar###meet.net
- DNS ASK so###meet.net
- DNS ASK wh###shown.net
- DNS ASK wh###meet.net
- DNS ASK sp###eck.net
- DNS ASK up###eet.net
- DNS ASK up###ood.net
- DNS ASK wh###food.net
- DNS ASK dr###reach.net
- DNS ASK th###each.net
- DNS ASK th###aise.net
- DNS ASK th###roud.net
- DNS ASK dr###raise.net
- DNS ASK ar###neck.net
- DNS ASK ar###food.net
- DNS ASK so###food.net
- DNS ASK so###shown.net
- DNS ASK so###neck.net
- DNS ASK ar###shown.net
- '23#.#55.255.250':1900