Technical Information
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Config COM Microsoft WinHTTP' = '<SYSTEM32>\oadlpzufk.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\PnP-X Intelligent Procedure Host Defragmenter] 'Start' = '00000002'
- Windows Security Center
- '<SYSTEM32>\jqsziptvuew.exe' "<SYSTEM32>\oadlpzufk.exe"
- '%WINDIR%\Temp\kwdehab2vw0hub.exe' -r 51857 tcp
- '%TEMP%\kwdehab2pcchubr9cyni.exe'
- '<SYSTEM32>\oadlpzufk.exe'
- <SYSTEM32>\uczjmzy\run
- <SYSTEM32>\uczjmzy\rng
- %WINDIR%\Temp\kwdehab2vw0hub.exe
- <SYSTEM32>\uczjmzy\cfg
- <SYSTEM32>\jqsziptvuew.exe
- %TEMP%\kwdehab2pcchubr9cyni.exe
- <SYSTEM32>\uczjmzy\tst
- <SYSTEM32>\oadlpzufk.exe
- <SYSTEM32>\uczjmzy\etc
- <SYSTEM32>\jqsziptvuew.exe
- <SYSTEM32>\oadlpzufk.exe
- %WINDIR%\Temp\kwdehab2vw0hub.exe
- <DRIVERS>\etc\hosts
- %TEMP%\kwdehab2pcchubr9cyni.exe
- 'vi###food.net':80
- 'sp###meet.net':80
- 'vi###shown.net':80
- 'sp###food.net':80
- 'vi###meet.net':80
- 'wa###shown.net':80
- 'fa###hown.net':80
- 'wa###neck.net':80
- 'fa###eck.net':80
- 'sp###shown.net':80
- 'gr###shown.net':80
- 'eq###food.net':80
- 'gr###neck.net':80
- 'eq###shown.net':80
- 'gr###food.net':80
- 'sp###neck.net':80
- 'vi###neck.net':80
- 'eq###meet.net':80
- 'gr###meet.net':80
- 'wa###food.net':80
- 'so###some.net':80
- 'ar###seven.net':80
- 'th###eet.net':80
- 'ar###some.net':80
- 'so###seven.net':80
- 'ar###such.net':80
- 'so###such.net':80
- 'ar###today.net':80
- 'so###today.net':80
- 'dr###meet.net':80
- 'fa###eet.net':80
- 'dr###neck.net':80
- 'fa###ood.net':80
- 'wa###meet.net':80
- 'th###eck.net':80
- 'dr###food.net':80
- 'th###ood.net':80
- 'dr###shown.net':80
- 'th###hown.net':80
- 'eq###neck.net':80
- 'so###food.net':80
- 'ar###meet.net':80
- 'so###shown.net':80
- 'ar###food.net':80
- 'so###meet.net':80
- 'up###hown.net':80
- 'wh###shown.net':80
- 'up###eck.net':80
- 'wh###neck.net':80
- 'ar###shown.net':80
- 'be##lxc.com':80
- 'de###lxc.com':80
- 'ri###nstorm.net':80
- 'af###sllc.com':80
- 'th###aise.net':80
- 'ar###neck.net':80
- 'so###neck.net':80
- 'dr###reach.net':80
- 'th###each.net':80
- 'up###ood.net':80
- 'ta###neck.net':80
- 'gl###hown.net':80
- 'sa###eet.net':80
- 'gl###eck.net':80
- 'ta###shown.net':80
- 'gl###eet.net':80
- 'ta###meet.net':80
- 'gl###ood.net':80
- 'ta###food.net':80
- 'sp###eet.net':80
- 'wh###meet.net':80
- 'sp###eck.net':80
- 'wh###food.net':80
- 'up###eet.net':80
- 'sa###eck.net':80
- 'sp###ood.net':80
- 'sa###ood.net':80
- 'sp###hown.net':80
- 'sa###hown.net':80
- http://vi###food.net/index.php
- http://sp###meet.net/index.php
- http://vi###shown.net/index.php
- http://sp###food.net/index.php
- http://vi###meet.net/index.php
- http://wa###shown.net/index.php
- http://fa###hown.net/index.php
- http://wa###neck.net/index.php
- http://fa###eck.net/index.php
- http://sp###shown.net/index.php
- http://gr###shown.net/index.php
- http://eq###food.net/index.php
- http://gr###neck.net/index.php
- http://eq###shown.net/index.php
- http://gr###food.net/index.php
- http://sp###neck.net/index.php
- http://vi###neck.net/index.php
- http://eq###meet.net/index.php
- http://gr###meet.net/index.php
- http://wa###food.net/index.php
- http://so###some.net/index.php
- http://ar###seven.net/index.php
- http://th###eet.net/index.php
- http://ar###some.net/index.php
- http://so###seven.net/index.php
- http://ar###such.net/index.php
- http://so###such.net/index.php
- http://ar###today.net/index.php
- http://so###today.net/index.php
- http://dr###meet.net/index.php
- http://fa###eet.net/index.php
- http://dr###neck.net/index.php
- http://fa###ood.net/index.php
- http://wa###meet.net/index.php
- http://th###eck.net/index.php
- http://dr###food.net/index.php
- http://th###ood.net/index.php
- http://dr###shown.net/index.php
- http://th###hown.net/index.php
- http://eq###neck.net/index.php
- http://so###food.net/index.php
- http://ar###meet.net/index.php
- http://so###shown.net/index.php
- http://ar###food.net/index.php
- http://so###meet.net/index.php
- http://up###hown.net/index.php
- http://wh###shown.net/index.php
- http://up###eck.net/index.php
- http://wh###neck.net/index.php
- http://ar###shown.net/index.php
- http://be##lxc.com/index.php
- http://de###lxc.com/index.php
- http://ri###nstorm.net/index.php
- http://af###sllc.com/index.php
- http://th###aise.net/index.php
- http://ar###neck.net/index.php
- http://so###neck.net/index.php
- http://dr###reach.net/index.php
- http://th###each.net/index.php
- http://up###ood.net/index.php
- http://ta###neck.net/index.php
- http://gl###hown.net/index.php
- http://sa###eet.net/index.php
- http://gl###eck.net/index.php
- http://ta###shown.net/index.php
- http://gl###eet.net/index.php
- http://ta###meet.net/index.php
- http://gl###ood.net/index.php
- http://ta###food.net/index.php
- http://sp###eet.net/index.php
- http://wh###meet.net/index.php
- http://sp###eck.net/index.php
- http://wh###food.net/index.php
- http://up###eet.net/index.php
- http://sa###eck.net/index.php
- http://sp###ood.net/index.php
- http://sa###ood.net/index.php
- http://sp###hown.net/index.php
- http://sa###hown.net/index.php
- DNS ASK vi###food.net
- DNS ASK sp###meet.net
- DNS ASK sp###food.net
- DNS ASK sp###shown.net
- DNS ASK vi###shown.net
- DNS ASK wa###shown.net
- DNS ASK fa###hown.net
- DNS ASK fa###eck.net
- DNS ASK vi###meet.net
- DNS ASK wa###neck.net
- DNS ASK gr###shown.net
- DNS ASK eq###food.net
- DNS ASK eq###shown.net
- DNS ASK eq###neck.net
- DNS ASK gr###neck.net
- DNS ASK sp###neck.net
- DNS ASK vi###neck.net
- DNS ASK gr###meet.net
- DNS ASK gr###food.net
- DNS ASK eq###meet.net
- DNS ASK so###some.net
- DNS ASK ar###seven.net
- DNS ASK ar###some.net
- DNS ASK dr###meet.net
- DNS ASK th###eet.net
- DNS ASK ar###such.net
- DNS ASK so###such.net
- DNS ASK so###today.net
- DNS ASK so###seven.net
- DNS ASK ar###today.net
- DNS ASK fa###eet.net
- DNS ASK dr###neck.net
- DNS ASK wa###meet.net
- DNS ASK wa###food.net
- DNS ASK fa###ood.net
- DNS ASK dr###food.net
- DNS ASK th###ood.net
- DNS ASK th###hown.net
- DNS ASK th###eck.net
- DNS ASK dr###shown.net
- DNS ASK so###food.net
- DNS ASK ar###meet.net
- DNS ASK so###shown.net
- DNS ASK ar###food.net
- DNS ASK so###meet.net
- DNS ASK up###hown.net
- DNS ASK wh###shown.net
- DNS ASK up###eck.net
- DNS ASK wh###neck.net
- DNS ASK ar###shown.net
- DNS ASK be##lxc.com
- DNS ASK de###lxc.com
- DNS ASK ri###nstorm.net
- DNS ASK af###sllc.com
- DNS ASK th###aise.net
- DNS ASK ar###neck.net
- DNS ASK so###neck.net
- DNS ASK dr###reach.net
- DNS ASK th###each.net
- DNS ASK up###ood.net
- DNS ASK ta###neck.net
- DNS ASK gl###hown.net
- DNS ASK sa###eet.net
- DNS ASK gl###eck.net
- DNS ASK ta###shown.net
- DNS ASK gl###eet.net
- DNS ASK ta###meet.net
- DNS ASK gl###ood.net
- DNS ASK ta###food.net
- DNS ASK sp###eet.net
- DNS ASK wh###meet.net
- DNS ASK sp###eck.net
- DNS ASK wh###food.net
- DNS ASK up###eet.net
- DNS ASK sa###eck.net
- DNS ASK sp###ood.net
- DNS ASK sa###ood.net
- DNS ASK sp###hown.net
- DNS ASK sa###hown.net
- '23#.#55.255.250':1900