Technical Information
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Device Profile AutoConnect' = '<SYSTEM32>\uxjhasnm.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\Adapter AuthIP Color Peer Human] 'ImagePath' = '<SYSTEM32>\uxjhasnm.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\Adapter AuthIP Color Peer Human] 'Start' = '00000002'
- Windows Security Center
- '<SYSTEM32>\aouymnqfyrj.exe' "<SYSTEM32>\uxjhasnm.exe"
- '%WINDIR%\Temp\cy9mggt2ka1tzuo.exe' -r 34069 tcp
- '%TEMP%\cy9mggt2g7stzuopyzikd9z.exe'
- '<SYSTEM32>\uxjhasnm.exe'
- <SYSTEM32>\bqgjsywmh\run
- <SYSTEM32>\bqgjsywmh\rng
- %WINDIR%\Temp\cy9mggt2ka1tzuo.exe
- <SYSTEM32>\bqgjsywmh\cfg
- <SYSTEM32>\aouymnqfyrj.exe
- %TEMP%\cy9mggt2g7stzuopyzikd9z.exe
- <SYSTEM32>\bqgjsywmh\tst
- <SYSTEM32>\uxjhasnm.exe
- <SYSTEM32>\bqgjsywmh\etc
- <SYSTEM32>\aouymnqfyrj.exe
- <SYSTEM32>\uxjhasnm.exe
- %WINDIR%\Temp\cy9mggt2ka1tzuo.exe
- <DRIVERS>\etc\hosts
- %TEMP%\cy9mggt2g7stzuopyzikd9z.exe
- 'pi###road.net':80
- 'mu###oad.net':80
- 've###here.net':80
- 've###ore.net':80
- 'we###here.net':80
- 'pi###mail.net':80
- 'pi###where.net':80
- 'mu###here.net':80
- 'mu###ore.net':80
- 'mu###ail.net':80
- 'pi###wore.net':80
- 'we###ore.net':80
- 'to###ore.net':80
- 'fa###ore.net':80
- 'fa###ail.net':80
- 'fa###oad.net':80
- 'to###ail.net':80
- 'to###here.net':80
- 'we###ail.net':80
- 've###ail.net':80
- 've###oad.net':80
- 'fa###here.net':80
- 'we###oad.net':80
- 'wa###oad.net':80
- 'lr###lift.net':80
- 'vi###ift.net':80
- 'yo###and.net':80
- 'yo###ound.net':80
- 'tr###hand.net':80
- 'lr###green.net':80
- 'lr###hand.net':80
- 'vi###and.net':80
- 'vi###ound.net':80
- 'vi###reen.net':80
- 'lr###sound.net':80
- 'tr###sound.net':80
- 'wa###ore.net':80
- 'ta###ore.net':80
- 'ta###ail.net':80
- 'ta###oad.net':80
- 'wa###ail.net':80
- 'wa###here.net':80
- 'tr###green.net':80
- 'yo###reen.net':80
- 'yo###ift.net':80
- 'ta###here.net':80
- 'tr###lift.net':80
- 'yo###oad.net':80
- 'tr###mail.net':80
- 'tr###road.net':80
- 'wa###one.net':80
- 'ta###one.net':80
- 'yo###ail.net':80
- 'yo###here.net':80
- 'lr###road.net':80
- 'tr###where.net':80
- 'tr###wore.net':80
- 'yo###ore.net':80
- 'ta###ight.net':80
- 'mi###hown.net':80
- 'ab###ell.net':80
- 'mo###ugust.net':80
- 'cr#####onaraminta.net':80
- 'le###form.net':80
- 'mo###olor.net':80
- 'ri###nstorm.net':80
- 'be##lxc.com':80
- 'al###being.net':80
- 'pr####tbottom.net':80
- 'ca####nbring.net':80
- 'vi###oad.net':80
- 'le###road.net':80
- 'se###mail.net':80
- 'se###road.net':80
- 'pl###where.net':80
- 'fi###here.net':80
- 'le###mail.net':80
- 'le###where.net':80
- 'to###oad.net':80
- 'se###where.net':80
- 'se###wore.net':80
- 'le###wore.net':80
- 'fi###ore.net':80
- 'vi###ore.net':80
- 'lr###where.net':80
- 'lr###wore.net':80
- 'lr###mail.net':80
- 'vi###ail.net':80
- 'vi###here.net':80
- 'fi###ail.net':80
- 'pl###wore.net':80
- 'pl###mail.net':80
- 'pl###road.net':80
- 'fi###oad.net':80
- http://pi###road.net/index.php
- http://mu###oad.net/index.php
- http://ve###here.net/index.php
- http://ve###ore.net/index.php
- http://we###here.net/index.php
- http://pi###mail.net/index.php
- http://pi###where.net/index.php
- http://mu###here.net/index.php
- http://mu###ore.net/index.php
- http://mu###ail.net/index.php
- http://pi###wore.net/index.php
- http://we###ore.net/index.php
- http://to###ore.net/index.php
- http://fa###ore.net/index.php
- http://fa###ail.net/index.php
- http://fa###oad.net/index.php
- http://to###ail.net/index.php
- http://to###here.net/index.php
- http://we###ail.net/index.php
- http://ve###ail.net/index.php
- http://ve###oad.net/index.php
- http://fa###here.net/index.php
- http://we###oad.net/index.php
- http://wa###oad.net/index.php
- http://lr###lift.net/index.php
- http://vi###ift.net/index.php
- http://yo###and.net/index.php
- http://yo###ound.net/index.php
- http://tr###hand.net/index.php
- http://lr###green.net/index.php
- http://lr###hand.net/index.php
- http://vi###and.net/index.php
- http://vi###ound.net/index.php
- http://vi###reen.net/index.php
- http://lr###sound.net/index.php
- http://tr###sound.net/index.php
- http://wa###ore.net/index.php
- http://ta###ore.net/index.php
- http://ta###ail.net/index.php
- http://ta###oad.net/index.php
- http://wa###ail.net/index.php
- http://wa###here.net/index.php
- http://tr###green.net/index.php
- http://yo###reen.net/index.php
- http://yo###ift.net/index.php
- http://ta###here.net/index.php
- http://tr###lift.net/index.php
- http://yo###oad.net/index.php
- http://tr###mail.net/index.php
- http://tr###road.net/index.php
- http://wa###one.net/index.php
- http://ta###one.net/index.php
- http://yo###ail.net/index.php
- http://yo###here.net/index.php
- http://lr###road.net/index.php
- http://tr###where.net/index.php
- http://tr###wore.net/index.php
- http://yo###ore.net/index.php
- http://ta###ight.net/index.php
- http://mi###hown.net/index.php
- http://ab###ell.net/index.php
- http://mo###ugust.net/index.php
- http://cr#####onaraminta.net/index.php
- http://le###form.net/index.php
- http://mo###olor.net/index.php
- http://ri###nstorm.net/index.php
- http://be##lxc.com/index.php
- http://al###being.net/index.php
- http://pr####tbottom.net/index.php
- http://ca####nbring.net/index.php
- http://vi###oad.net/index.php
- http://le###road.net/index.php
- http://se###mail.net/index.php
- http://se###road.net/index.php
- http://pl###where.net/index.php
- http://fi###here.net/index.php
- http://le###mail.net/index.php
- http://le###where.net/index.php
- http://to###oad.net/index.php
- http://se###where.net/index.php
- http://se###wore.net/index.php
- http://le###wore.net/index.php
- http://fi###ore.net/index.php
- http://vi###ore.net/index.php
- http://lr###where.net/index.php
- http://lr###wore.net/index.php
- http://lr###mail.net/index.php
- http://vi###ail.net/index.php
- http://vi###here.net/index.php
- http://fi###ail.net/index.php
- http://pl###wore.net/index.php
- http://pl###mail.net/index.php
- http://pl###road.net/index.php
- http://fi###oad.net/index.php
- DNS ASK pi###road.net
- DNS ASK mu###oad.net
- DNS ASK pi###mail.net
- DNS ASK ve###ore.net
- DNS ASK we###here.net
- DNS ASK ve###here.net
- DNS ASK pi###where.net
- DNS ASK mu###here.net
- DNS ASK wa###oad.net
- DNS ASK mu###ail.net
- DNS ASK pi###wore.net
- DNS ASK mu###ore.net
- DNS ASK to###ore.net
- DNS ASK fa###ore.net
- DNS ASK to###here.net
- DNS ASK fa###oad.net
- DNS ASK to###ail.net
- DNS ASK fa###ail.net
- DNS ASK we###ail.net
- DNS ASK ve###ail.net
- DNS ASK we###ore.net
- DNS ASK fa###here.net
- DNS ASK we###oad.net
- DNS ASK ve###oad.net
- DNS ASK lr###lift.net
- DNS ASK vi###ift.net
- DNS ASK lr###green.net
- DNS ASK yo###ound.net
- DNS ASK tr###hand.net
- DNS ASK yo###and.net
- DNS ASK lr###hand.net
- DNS ASK vi###and.net
- DNS ASK pl###lift.net
- DNS ASK vi###reen.net
- DNS ASK lr###sound.net
- DNS ASK vi###ound.net
- DNS ASK wa###ore.net
- DNS ASK ta###ore.net
- DNS ASK wa###here.net
- DNS ASK ta###oad.net
- DNS ASK wa###ail.net
- DNS ASK ta###ail.net
- DNS ASK tr###green.net
- DNS ASK yo###reen.net
- DNS ASK tr###sound.net
- DNS ASK ta###here.net
- DNS ASK tr###lift.net
- DNS ASK yo###ift.net
- DNS ASK yo###oad.net
- DNS ASK tr###mail.net
- DNS ASK tr###road.net
- DNS ASK wa###one.net
- DNS ASK ta###one.net
- DNS ASK yo###ail.net
- DNS ASK yo###here.net
- DNS ASK lr###road.net
- DNS ASK tr###where.net
- DNS ASK tr###wore.net
- DNS ASK yo###ore.net
- DNS ASK ta###ight.net
- DNS ASK mi###hown.net
- DNS ASK ab###ell.net
- DNS ASK mo###ugust.net
- DNS ASK cr#####onaraminta.net
- DNS ASK le###form.net
- DNS ASK mo###olor.net
- DNS ASK ri###nstorm.net
- DNS ASK be##lxc.com
- DNS ASK al###being.net
- DNS ASK pr####tbottom.net
- DNS ASK ca####nbring.net
- DNS ASK vi###oad.net
- DNS ASK le###road.net
- DNS ASK se###mail.net
- DNS ASK se###road.net
- DNS ASK pl###where.net
- DNS ASK fi###here.net
- DNS ASK le###mail.net
- DNS ASK le###where.net
- DNS ASK to###oad.net
- DNS ASK se###where.net
- DNS ASK se###wore.net
- DNS ASK le###wore.net
- DNS ASK fi###ore.net
- DNS ASK vi###ore.net
- DNS ASK lr###where.net
- DNS ASK lr###wore.net
- DNS ASK lr###mail.net
- DNS ASK vi###ail.net
- DNS ASK vi###here.net
- DNS ASK fi###ail.net
- DNS ASK pl###wore.net
- DNS ASK pl###mail.net
- DNS ASK pl###road.net
- DNS ASK fi###oad.net
- '23#.#55.255.250':1900