Technical Information
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Backup Discovery Support Identity AutoConfig' = '<SYSTEM32>\cgtuynbjacq.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\Quality COM Ordering Interface] 'Start' = '00000002'
- Windows Security Center
- '<SYSTEM32>\imjuyazekn.exe' "<SYSTEM32>\cgtuynbjacq.exe"
- '%WINDIR%\Temp\o0jf3l3vwwfzs.exe' -r 21172 tcp
- '%TEMP%\o0jf3l3sr6fzsctenopxd.exe'
- '<SYSTEM32>\cgtuynbjacq.exe'
- <SYSTEM32>\xfisnognw\run
- <SYSTEM32>\xfisnognw\rng
- <SYSTEM32>\xfisnognw\cfg
- <SYSTEM32>\xfisnognw\por
- %WINDIR%\Temp\o0jf3l3vwwfzs.exe
- %TEMP%\o0jf3l3sr6fzsctenopxd.exe
- <SYSTEM32>\xfisnognw\tst
- <SYSTEM32>\xfisnognw\etc
- <SYSTEM32>\imjuyazekn.exe
- <SYSTEM32>\cgtuynbjacq.exe
- <SYSTEM32>\imjuyazekn.exe
- <SYSTEM32>\cgtuynbjacq.exe
- %WINDIR%\Temp\o0jf3l3vwwfzs.exe
- %TEMP%\o0jf3l3sr6fzsctenopxd.exe
- <DRIVERS>\etc\hosts
- 'we####dayhurry.net':80
- 'se###urry.net':80
- 'na###ope.net':80
- 'dr###hope.net':80
- 'we####dayleft.net':80
- 'se###eft.net':80
- 'we#####aythirteen.net':80
- 'se####irteen.net':80
- 'na###urry.net':80
- 'dr###hurry.net':80
- 'qu###wild.net':80
- 'fi###wild.net':80
- 'na###eft.net':80
- 'dr###left.net':80
- 'na####irteen.net':80
- 'dr####hirteen.net':80
- 'we####dayhope.net':80
- 'st###march.net':80
- 'ta###fruit.net':80
- 'af###hope.net':80
- 'we###urry.net':80
- 'fr###secas.com':80
- 'do####n4guia.com':80
- 'da###ekilai.com':80
- 'la###onea.com':80
- 'af###hurry.net':80
- 'fo####hirteen.net':80
- 'se###ope.net':80
- 'fo###hurry.net':80
- 'af###left.net':80
- 'fo###hope.net':80
- 'af####hirteen.net':80
- 'fo###left.net':80
- we####dayhurry.net/forum/search.php?me#########################################
- se###urry.net/forum/search.php?me#########################################
- na###ope.net/forum/search.php?me#########################################
- dr###hope.net/forum/search.php?me#########################################
- we####dayleft.net/forum/search.php?me#########################################
- se###eft.net/forum/search.php?me#########################################
- we#####aythirteen.net/forum/search.php?me#########################################
- se####irteen.net/forum/search.php?me#########################################
- na###urry.net/forum/search.php?me#########################################
- dr###hurry.net/forum/search.php?me#########################################
- qu###wild.net/forum/search.php?me#########################################
- fi###wild.net/forum/search.php?me#########################################
- na###eft.net/forum/search.php?me#########################################
- dr###left.net/forum/search.php?me#########################################
- na####irteen.net/forum/search.php?me#########################################
- dr####hirteen.net/forum/search.php?me#########################################
- we####dayhope.net/forum/search.php?me#########################################
- st###march.net/forum/search.php?me#########################################
- ta###fruit.net/forum/search.php?me#########################################
- af###hope.net/forum/search.php?me#########################################
- we###urry.net/forum/search.php?me#########################################
- fr###secas.com/forum/search.php?me#########################################
- do####n4guia.com/forum/search.php?me#########################################
- da###ekilai.com/forum/search.php?me#########################################
- la###onea.com/forum/search.php?me#########################################
- af###hurry.net/forum/search.php?me#########################################
- fo####hirteen.net/forum/search.php?me#########################################
- se###ope.net/forum/search.php?me#########################################
- fo###hurry.net/forum/search.php?me#########################################
- af###left.net/forum/search.php?me#########################################
- fo###hope.net/forum/search.php?me#########################################
- af####hirteen.net/forum/search.php?me#########################################
- fo###left.net/forum/search.php?me#########################################
- DNS ASK se###urry.net
- DNS ASK we#####aythirteen.net
- DNS ASK dr###hope.net
- DNS ASK we####dayhurry.net
- DNS ASK se###eft.net
- DNS ASK we####dayhope.net
- DNS ASK se####irteen.net
- DNS ASK we####dayleft.net
- DNS ASK na###ope.net
- DNS ASK na###urry.net
- DNS ASK dr###hurry.net
- DNS ASK qu###wild.net
- DNS ASK fi###wild.net
- DNS ASK na###eft.net
- DNS ASK dr###left.net
- DNS ASK na####irteen.net
- DNS ASK dr####hirteen.net
- DNS ASK st###march.net
- DNS ASK ta###fruit.net
- DNS ASK af###hope.net
- DNS ASK we###urry.net
- DNS ASK fr###secas.com
- DNS ASK do####n4guia.com
- DNS ASK da###ekilai.com
- DNS ASK la###onea.com
- DNS ASK af###hurry.net
- DNS ASK fo####hirteen.net
- DNS ASK se###ope.net
- DNS ASK fo###hurry.net
- DNS ASK af###left.net
- DNS ASK fo###hope.net
- DNS ASK af####hirteen.net
- DNS ASK fo###left.net
- '23#.#55.255.250':1900