Technical Information
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Access Modules Protection Storage' = '<SYSTEM32>\bwqayuwwqee.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\Foundation Auto-Discovery Tracking Browser Web] 'ImagePath' = '<SYSTEM32>\bwqayuwwqee.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\Foundation Auto-Discovery Tracking Browser Web] 'Start' = '00000002'
- Windows Security Center
- '<SYSTEM32>\oilkelckreo.exe' "<SYSTEM32>\bwqayuwwqee.exe"
- '%WINDIR%\Temp\wflf5h33nyud.exe' -r 32690 tcp
- '%TEMP%\wflf5h2znfudffcmgj.exe'
- '<SYSTEM32>\bwqayuwwqee.exe'
- <SYSTEM32>\sdquyaomjz\run
- <SYSTEM32>\sdquyaomjz\rng
- %WINDIR%\Temp\wflf5h33nyud.exe
- <SYSTEM32>\sdquyaomjz\cfg
- <SYSTEM32>\oilkelckreo.exe
- %TEMP%\wflf5h2znfudffcmgj.exe
- <SYSTEM32>\sdquyaomjz\tst
- <SYSTEM32>\bwqayuwwqee.exe
- <SYSTEM32>\sdquyaomjz\etc
- <SYSTEM32>\oilkelckreo.exe
- <SYSTEM32>\bwqayuwwqee.exe
- %WINDIR%\Temp\wflf5h33nyud.exe
- <DRIVERS>\etc\hosts
- %TEMP%\wflf5h2znfudffcmgj.exe
- 'wi###one.net':80
- 'de###oes.net':80
- 'jo###one.net':80
- 'jo###ight.net':80
- 'wi###ight.net':80
- 'de###ight.net':80
- 'ro###ight.net':80
- 'ro###ool.net':80
- 'ro###oes.net':80
- 'de###ool.net':80
- 'se####berfool.net':80
- 'se####berlight.net':80
- 'se####bergoes.net':80
- 'fr###gone.net':80
- 'of###gone.net':80
- 'jo###ool.net':80
- 'wi###ool.net':80
- 'wi###oes.net':80
- 'se####bergone.net':80
- 'jo###oes.net':80
- 'ha###ail.net':80
- 'hu###wore.net':80
- 'hu###mail.net':80
- 'hu###road.net':80
- 'ha###oad.net':80
- 'ya###oad.net':80
- 'mu###road.net':80
- 'ha###here.net':80
- 'ha###ore.net':80
- 'hu###where.net':80
- 'ma###oes.net':80
- 'wr###fool.net':80
- 'wr###goes.net':80
- 'de###one.net':80
- 'ro###one.net':80
- 'wr###gone.net':80
- 'ma###one.net':80
- 'ma###ight.net':80
- 'ma###ool.net':80
- 'wr###light.net':80
- 'of###light.net':80
- 'hu###fool.net':80
- 'ha###ool.net':80
- 'ha###oes.net':80
- 'be##lxc.com':80
- 'hu###goes.net':80
- 'ha###one.net':80
- 'ya###oes.net':80
- 'hu###gone.net':80
- 'hu###light.net':80
- 'ha###ight.net':80
- 'mi###hown.net':80
- 'ab###ell.net':80
- 'mo###ugust.net':80
- 'cr#####onaraminta.net':80
- 'le###form.net':80
- 'al###being.net':80
- 'ri###nstorm.net':80
- 'ca####nbring.net':80
- 'mo###olor.net':80
- 'pr####tbottom.net':80
- 'we###one.net':80
- 'sp###gone.net':80
- 'sp###light.net':80
- 'sp###fool.net':80
- 'we###ight.net':80
- 'of###fool.net':80
- 'fr###light.net':80
- 'fr###fool.net':80
- 'fr###goes.net':80
- 'of###goes.net':80
- 'ya###ight.net':80
- 'mu###light.net':80
- 'mu###fool.net':80
- 'mu###goes.net':80
- 'ya###ool.net':80
- 'sp###goes.net':80
- 'we###ool.net':80
- 'we###oes.net':80
- 'ya###one.net':80
- 'mu###gone.net':80
- http://wi###one.net/index.php
- http://de###oes.net/index.php
- http://jo###one.net/index.php
- http://jo###ight.net/index.php
- http://wi###ight.net/index.php
- http://de###ight.net/index.php
- http://ro###ight.net/index.php
- http://ro###ool.net/index.php
- http://ro###oes.net/index.php
- http://de###ool.net/index.php
- http://se####berfool.net/index.php
- http://se####berlight.net/index.php
- http://se####bergoes.net/index.php
- http://fr###gone.net/index.php
- http://of###gone.net/index.php
- http://jo###ool.net/index.php
- http://wi###ool.net/index.php
- http://wi###oes.net/index.php
- http://se####bergone.net/index.php
- http://jo###oes.net/index.php
- http://ha###ail.net/index.php
- http://hu###wore.net/index.php
- http://hu###mail.net/index.php
- http://hu###road.net/index.php
- http://ha###oad.net/index.php
- http://ya###oad.net/index.php
- http://mu###road.net/index.php
- http://ha###here.net/index.php
- http://ha###ore.net/index.php
- http://hu###where.net/index.php
- http://ma###oes.net/index.php
- http://wr###fool.net/index.php
- http://wr###goes.net/index.php
- http://de###one.net/index.php
- http://ro###one.net/index.php
- http://wr###gone.net/index.php
- http://ma###one.net/index.php
- http://ma###ight.net/index.php
- http://ma###ool.net/index.php
- http://wr###light.net/index.php
- http://of###light.net/index.php
- http://hu###fool.net/index.php
- http://ha###ool.net/index.php
- http://ha###oes.net/index.php
- http://be##lxc.com/index.php
- http://hu###goes.net/index.php
- http://ha###one.net/index.php
- http://ya###oes.net/index.php
- http://hu###gone.net/index.php
- http://hu###light.net/index.php
- http://ha###ight.net/index.php
- http://mi###hown.net/index.php
- http://ab###ell.net/index.php
- http://mo###ugust.net/index.php
- http://cr#####onaraminta.net/index.php
- http://le###form.net/index.php
- http://al###being.net/index.php
- http://ri###nstorm.net/index.php
- http://ca####nbring.net/index.php
- http://mo###olor.net/index.php
- http://pr####tbottom.net/index.php
- http://we###one.net/index.php
- http://sp###gone.net/index.php
- http://sp###light.net/index.php
- http://sp###fool.net/index.php
- http://we###ight.net/index.php
- http://of###fool.net/index.php
- http://fr###light.net/index.php
- http://fr###fool.net/index.php
- http://fr###goes.net/index.php
- http://of###goes.net/index.php
- http://ya###ight.net/index.php
- http://mu###light.net/index.php
- http://mu###fool.net/index.php
- http://mu###goes.net/index.php
- http://ya###ool.net/index.php
- http://sp###goes.net/index.php
- http://we###ool.net/index.php
- http://we###oes.net/index.php
- http://ya###one.net/index.php
- http://mu###gone.net/index.php
- DNS ASK wi###one.net
- DNS ASK de###oes.net
- DNS ASK jo###one.net
- DNS ASK jo###ight.net
- DNS ASK wi###ight.net
- DNS ASK de###ight.net
- DNS ASK ro###ight.net
- DNS ASK ro###ool.net
- DNS ASK ro###oes.net
- DNS ASK de###ool.net
- DNS ASK se####berfool.net
- DNS ASK se####berlight.net
- DNS ASK se####bergoes.net
- DNS ASK fr###gone.net
- DNS ASK of###gone.net
- DNS ASK jo###ool.net
- DNS ASK wi###ool.net
- DNS ASK wi###oes.net
- DNS ASK se####bergone.net
- DNS ASK jo###oes.net
- DNS ASK de###one.net
- DNS ASK hu###wore.net
- DNS ASK ha###ore.net
- DNS ASK ha###ail.net
- DNS ASK ha###oad.net
- DNS ASK hu###mail.net
- DNS ASK mu###road.net
- DNS ASK ya###ail.net
- DNS ASK ya###oad.net
- DNS ASK hu###where.net
- DNS ASK ha###here.net
- DNS ASK wr###fool.net
- DNS ASK ma###ool.net
- DNS ASK ma###oes.net
- DNS ASK ro###one.net
- DNS ASK wr###goes.net
- DNS ASK ma###one.net
- DNS ASK hu###road.net
- DNS ASK wr###gone.net
- DNS ASK wr###light.net
- DNS ASK ma###ight.net
- DNS ASK of###light.net
- DNS ASK hu###fool.net
- DNS ASK ha###ool.net
- DNS ASK ha###oes.net
- DNS ASK be##lxc.com
- DNS ASK hu###goes.net
- DNS ASK ha###one.net
- DNS ASK ya###oes.net
- DNS ASK hu###gone.net
- DNS ASK hu###light.net
- DNS ASK ha###ight.net
- DNS ASK mi###hown.net
- DNS ASK ab###ell.net
- DNS ASK mo###ugust.net
- DNS ASK cr#####onaraminta.net
- DNS ASK le###form.net
- DNS ASK al###being.net
- DNS ASK ri###nstorm.net
- DNS ASK ca####nbring.net
- DNS ASK mo###olor.net
- DNS ASK pr####tbottom.net
- DNS ASK we###one.net
- DNS ASK sp###gone.net
- DNS ASK sp###light.net
- DNS ASK sp###fool.net
- DNS ASK we###ight.net
- DNS ASK of###fool.net
- DNS ASK fr###light.net
- DNS ASK fr###fool.net
- DNS ASK fr###goes.net
- DNS ASK of###goes.net
- DNS ASK ya###ight.net
- DNS ASK mu###light.net
- DNS ASK mu###fool.net
- DNS ASK mu###goes.net
- DNS ASK ya###ool.net
- DNS ASK sp###goes.net
- DNS ASK we###ool.net
- DNS ASK we###oes.net
- DNS ASK ya###one.net
- DNS ASK mu###gone.net
- '23#.#55.255.250':1900