Technical Information
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Defragmenter Base Services Copy Server DNS' = '<SYSTEM32>\yjpqpkme.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\Topology VC Adapter Input Resolution] 'Start' = '00000002'
- Windows Security Center
- '<SYSTEM32>\zuofpfdyrai.exe' "<SYSTEM32>\yjpqpkme.exe"
- '%WINDIR%\Temp\qulu1eom2t4mqjkz.exe' -r 39719 tcp
- '%TEMP%\qulu1eom2m5rqjkzdkmeyfb.exe'
- '<SYSTEM32>\yjpqpkme.exe'
- <SYSTEM32>\wxqwgsoj\run
- <SYSTEM32>\wxqwgsoj\rng
- %WINDIR%\Temp\qulu1eom2t4mqjkz.exe
- <SYSTEM32>\wxqwgsoj\cfg
- <SYSTEM32>\zuofpfdyrai.exe
- %TEMP%\qulu1eom2m5rqjkzdkmeyfb.exe
- <SYSTEM32>\wxqwgsoj\tst
- <SYSTEM32>\yjpqpkme.exe
- <SYSTEM32>\wxqwgsoj\etc
- <SYSTEM32>\zuofpfdyrai.exe
- <SYSTEM32>\yjpqpkme.exe
- %WINDIR%\Temp\qulu1eom2t4mqjkz.exe
- <DRIVERS>\etc\hosts
- %TEMP%\qulu1eom2m5rqjkzdkmeyfb.exe
- 'up###even.net':80
- 'wh###seven.net':80
- 'wh###some.net':80
- 'so###such.net':80
- 'up###ome.net':80
- 'up###oday.net':80
- 'sp###ome.net':80
- 'sa###ome.net':80
- 'wh###such.net':80
- 'wh###today.net':80
- 'up###uch.net':80
- 'th###eet.net':80
- 'ar###some.net':80
- 'dr###meet.net':80
- 'dr###food.net':80
- 'th###ood.net':80
- 'so###some.net':80
- 'so###today.net':80
- 'ar###such.net':80
- 'ar###today.net':80
- 'ar###seven.net':80
- 'so###seven.net':80
- 'eq###some.net':80
- 'gr###some.net':80
- 'ta###such.net':80
- 'ta###today.net':80
- 'gl###uch.net':80
- 'eq###seven.net':80
- 'eq###such.net':80
- 'gr###such.net':80
- 'gr###today.net':80
- 'gr###seven.net':80
- 'eq###today.net':80
- 'sa###oday.net':80
- 'sp###uch.net':80
- 'sp###oday.net':80
- 'sp###even.net':80
- 'sa###even.net':80
- 'sa###uch.net':80
- 'ta###seven.net':80
- 'gl###oday.net':80
- 'gl###even.net':80
- 'gl###ome.net':80
- 'ta###some.net':80
- 'th###hown.net':80
- 'ta###food.net':80
- 'gl###eet.net':80
- 'gl###ood.net':80
- 'gl###hown.net':80
- 'ta###shown.net':80
- 'ta###meet.net':80
- 'gr###shown.net':80
- 'eq###food.net':80
- 'eq###shown.net':80
- 'eq###neck.net':80
- 'gr###neck.net':80
- 'de###lxc.com':80
- 'sa###hown.net':80
- 'be##lxc.com':80
- 'ri###nstorm.net':80
- 'af###sllc.com':80
- 'sp###ood.net':80
- 'gl###eck.net':80
- 'ta###neck.net':80
- 'sa###eet.net':80
- 'sa###ood.net':80
- 'sp###eet.net':80
- 'fa###hown.net':80
- 'wa###food.net':80
- 'wa###shown.net':80
- 'wa###neck.net':80
- 'fa###eck.net':80
- 'fa###ood.net':80
- 'th###eck.net':80
- 'dr###shown.net':80
- 'dr###neck.net':80
- 'wa###meet.net':80
- 'fa###eet.net':80
- 'sp###neck.net':80
- 'vi###neck.net':80
- 'gr###meet.net':80
- 'gr###food.net':80
- 'eq###meet.net':80
- 'sp###shown.net':80
- 'sp###meet.net':80
- 'vi###meet.net':80
- 'vi###food.net':80
- 'vi###shown.net':80
- 'sp###food.net':80
- http://up###even.net/index.php
- http://wh###seven.net/index.php
- http://wh###some.net/index.php
- http://so###such.net/index.php
- http://up###ome.net/index.php
- http://up###oday.net/index.php
- http://sp###ome.net/index.php
- http://sa###ome.net/index.php
- http://wh###such.net/index.php
- http://wh###today.net/index.php
- http://up###uch.net/index.php
- http://th###eet.net/index.php
- http://ar###some.net/index.php
- http://dr###meet.net/index.php
- http://dr###food.net/index.php
- http://th###ood.net/index.php
- http://so###some.net/index.php
- http://so###today.net/index.php
- http://ar###such.net/index.php
- http://ar###today.net/index.php
- http://ar###seven.net/index.php
- http://so###seven.net/index.php
- http://eq###some.net/index.php
- http://gr###some.net/index.php
- http://ta###such.net/index.php
- http://ta###today.net/index.php
- http://gl###uch.net/index.php
- http://eq###seven.net/index.php
- http://eq###such.net/index.php
- http://gr###such.net/index.php
- http://gr###today.net/index.php
- http://gr###seven.net/index.php
- http://eq###today.net/index.php
- http://sa###oday.net/index.php
- http://sp###uch.net/index.php
- http://sp###oday.net/index.php
- http://sp###even.net/index.php
- http://sa###even.net/index.php
- http://sa###uch.net/index.php
- http://ta###seven.net/index.php
- http://gl###oday.net/index.php
- http://gl###even.net/index.php
- http://gl###ome.net/index.php
- http://ta###some.net/index.php
- http://th###hown.net/index.php
- http://ta###food.net/index.php
- http://gl###eet.net/index.php
- http://gl###ood.net/index.php
- http://gl###hown.net/index.php
- http://ta###shown.net/index.php
- http://ta###meet.net/index.php
- http://gr###shown.net/index.php
- http://eq###food.net/index.php
- http://eq###shown.net/index.php
- http://eq###neck.net/index.php
- http://gr###neck.net/index.php
- http://de###lxc.com/index.php
- http://sa###hown.net/index.php
- http://be##lxc.com/index.php
- http://ri###nstorm.net/index.php
- http://af###sllc.com/index.php
- http://sp###ood.net/index.php
- http://gl###eck.net/index.php
- http://ta###neck.net/index.php
- http://sa###eet.net/index.php
- http://sa###ood.net/index.php
- http://sp###eet.net/index.php
- http://fa###hown.net/index.php
- http://wa###food.net/index.php
- http://wa###shown.net/index.php
- http://wa###neck.net/index.php
- http://fa###eck.net/index.php
- http://fa###ood.net/index.php
- http://th###eck.net/index.php
- http://dr###shown.net/index.php
- http://dr###neck.net/index.php
- http://wa###meet.net/index.php
- http://fa###eet.net/index.php
- http://sp###neck.net/index.php
- http://vi###neck.net/index.php
- http://gr###meet.net/index.php
- http://gr###food.net/index.php
- http://eq###meet.net/index.php
- http://sp###shown.net/index.php
- http://sp###meet.net/index.php
- http://vi###meet.net/index.php
- http://vi###food.net/index.php
- http://vi###shown.net/index.php
- http://sp###food.net/index.php
- DNS ASK wh###some.net
- DNS ASK up###even.net
- DNS ASK up###ome.net
- DNS ASK ar###such.net
- DNS ASK so###such.net
- DNS ASK wh###seven.net
- DNS ASK wh###such.net
- DNS ASK sp###ome.net
- DNS ASK up###uch.net
- DNS ASK up###oday.net
- DNS ASK wh###today.net
- DNS ASK dr###meet.net
- DNS ASK th###eet.net
- DNS ASK th###ood.net
- DNS ASK th###hown.net
- DNS ASK dr###food.net
- DNS ASK ar###some.net
- DNS ASK ar###today.net
- DNS ASK so###today.net
- DNS ASK so###seven.net
- DNS ASK so###some.net
- DNS ASK ar###seven.net
- DNS ASK sa###ome.net
- DNS ASK eq###some.net
- DNS ASK gr###some.net
- DNS ASK ta###such.net
- DNS ASK ta###today.net
- DNS ASK gl###uch.net
- DNS ASK eq###seven.net
- DNS ASK eq###such.net
- DNS ASK gr###such.net
- DNS ASK gr###today.net
- DNS ASK gr###seven.net
- DNS ASK eq###today.net
- DNS ASK sa###oday.net
- DNS ASK sp###uch.net
- DNS ASK sp###oday.net
- DNS ASK sp###even.net
- DNS ASK sa###even.net
- DNS ASK sa###uch.net
- DNS ASK ta###seven.net
- DNS ASK gl###oday.net
- DNS ASK gl###even.net
- DNS ASK gl###ome.net
- DNS ASK ta###some.net
- DNS ASK ta###food.net
- DNS ASK gl###eet.net
- DNS ASK gl###ood.net
- DNS ASK gl###hown.net
- DNS ASK ta###shown.net
- DNS ASK ta###meet.net
- DNS ASK gr###shown.net
- DNS ASK eq###food.net
- DNS ASK eq###shown.net
- DNS ASK eq###neck.net
- DNS ASK gr###neck.net
- DNS ASK de###lxc.com
- DNS ASK sa###hown.net
- DNS ASK be##lxc.com
- DNS ASK ri###nstorm.net
- DNS ASK af###sllc.com
- DNS ASK sp###ood.net
- DNS ASK gl###eck.net
- DNS ASK ta###neck.net
- DNS ASK sa###eet.net
- DNS ASK sa###ood.net
- DNS ASK sp###eet.net
- DNS ASK fa###hown.net
- DNS ASK wa###food.net
- DNS ASK wa###shown.net
- DNS ASK wa###neck.net
- DNS ASK fa###eck.net
- DNS ASK fa###ood.net
- DNS ASK th###eck.net
- DNS ASK dr###shown.net
- DNS ASK dr###neck.net
- DNS ASK wa###meet.net
- DNS ASK fa###eet.net
- DNS ASK sp###neck.net
- DNS ASK vi###neck.net
- DNS ASK gr###meet.net
- DNS ASK gr###food.net
- DNS ASK eq###meet.net
- DNS ASK sp###shown.net
- DNS ASK sp###meet.net
- DNS ASK vi###meet.net
- DNS ASK vi###food.net
- DNS ASK vi###shown.net
- DNS ASK sp###food.net
- '23#.#55.255.250':1900