Technical Information
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Disk CNG Video Routing BranchCache' = 'C:\wbhjscpllwzk\aoonmdtrnlhl.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\Experience User DNS Credential Visual Service] 'ImagePath' = 'C:\wbhjscpllwzk\aoonmdtrnlhl.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\Experience User DNS Credential Visual Service] 'Start' = '00000002'
- 'C:\wbhjscpllwzk\dkirzwb.exe' "c:\wbhjscpllwzk\aoonmdtrnlhl.exe"
- 'C:\wbhjscpllwzk\aoonmdtrnlhl.exe'
- 'C:\wbhjscpllwzk\mx2htxjiiwf2bius.exe'
- C:\wbhjscpllwzk\aoonmdtrnlhl.exe
- C:\wbhjscpllwzk\dkirzwb.exe
- C:\wbhjscpllwzk\mx2htxjiiwf2bius.exe
- %WINDIR%\wbhjscpllwzk\cgrbtz9d
- C:\wbhjscpllwzk\cgrbtz9d
- C:\wbhjscpllwzk\dkirzwb.exe
- C:\wbhjscpllwzk\aoonmdtrnlhl.exe
- C:\wbhjscpllwzk\mx2htxjiiwf2bius.exe
- %WINDIR%\wbhjscpllwzk\cgrbtz9d
- %WINDIR%\wbhjscpllwzk\cgrbtz9d
- 'ra####written.net':80
- 'mo####gwritten.net':80
- 'ra###rshore.net':80
- 'mo####gshore.net':80
- 'ra####dollar.net':80
- 'mo####grealize.net':80
- 'st####eshore.net':80
- 'mo####gdollar.net':80
- 'ra####realize.net':80
- 'tw###eshore.net':80
- 'mi####written.net':80
- 'al####ealize.net':80
- 'mi###eshore.net':80
- 'tw####written.net':80
- 'mi####realize.net':80
- 'tw####realize.net':80
- 'mi####dollar.net':80
- 'tw####dollar.net':80
- 'am####dollar.net':80
- 'we####rdollar.net':80
- 'am####written.net':80
- 'we####rwritten.net':80
- 'am####realize.net':80
- 'cl####ritten.net':80
- 'cl###dollar.net':80
- 'we####rrealize.net':80
- 'cl###shore.net':80
- 'hi####ywritten.net':80
- 'st####edollar.net':80
- 'hi####yshore.net':80
- 'st####ewritten.net':80
- 'hi####ydollar.net':80
- 'am###tshore.net':80
- 'we####rshore.net':80
- 'st####erealize.net':80
- 'hi####yrealize.net':80
- 'of####ealize.net':80
- 'se####shoulder.net':80
- 'qu###finger.net':80
- 'se###nabove.net':80
- 'qu####houlder.net':80
- 'se####finger.net':80
- 'th####ritten.net':80
- 'pr####twritten.net':80
- 'th###shore.net':80
- 'pr####tshore.net':80
- 'fl####houlder.net':80
- 'br####houlder.net':80
- 'fl###above.net':80
- 'br###above.net':80
- 'fl###finger.net':80
- 'se###nuntil.net':80
- 'qu###above.net':80
- 'br###finger.net':80
- 'qu###until.net':80
- 'co####erealize.net':80
- 'of###shore.net':80
- 'co####edollar.net':80
- 'ch####ealize.net':80
- 'al###shore.net':80
- 'of###dollar.net':80
- 'al###dollar.net':80
- 'of####ritten.net':80
- 'al####ritten.net':80
- 'th####ealize.net':80
- 'pr####trealize.net':80
- 'th###dollar.net':80
- 'pr####tdollar.net':80
- 'ch###shore.net':80
- 'co####ewritten.net':80
- 'ch###dollar.net':80
- 'co####eshore.net':80
- 'ch####ritten.net':80
- http://ra####written.net/index.php
- http://mo####gwritten.net/index.php
- http://ra###rshore.net/index.php
- http://mo####gshore.net/index.php
- http://ra####dollar.net/index.php
- http://mo####grealize.net/index.php
- http://st####eshore.net/index.php
- http://mo####gdollar.net/index.php
- http://ra####realize.net/index.php
- http://tw###eshore.net/index.php
- http://mi####written.net/index.php
- http://al####ealize.net/index.php
- http://mi###eshore.net/index.php
- http://tw####written.net/index.php
- http://mi####realize.net/index.php
- http://tw####realize.net/index.php
- http://mi####dollar.net/index.php
- http://tw####dollar.net/index.php
- http://am####dollar.net/index.php
- http://we####rdollar.net/index.php
- http://am####written.net/index.php
- http://we####rwritten.net/index.php
- http://am####realize.net/index.php
- http://cl####ritten.net/index.php
- http://cl###dollar.net/index.php
- http://we####rrealize.net/index.php
- http://cl###shore.net/index.php
- http://hi####ywritten.net/index.php
- http://st####edollar.net/index.php
- http://hi####yshore.net/index.php
- http://st####ewritten.net/index.php
- http://hi####ydollar.net/index.php
- http://am###tshore.net/index.php
- http://we####rshore.net/index.php
- http://st####erealize.net/index.php
- http://hi####yrealize.net/index.php
- http://of####ealize.net/index.php
- http://se####shoulder.net/index.php
- http://qu###finger.net/index.php
- http://se###nabove.net/index.php
- http://qu####houlder.net/index.php
- http://se####finger.net/index.php
- http://th####ritten.net/index.php
- http://pr####twritten.net/index.php
- http://th###shore.net/index.php
- http://pr####tshore.net/index.php
- http://fl####houlder.net/index.php
- http://br####houlder.net/index.php
- http://fl###above.net/index.php
- http://br###above.net/index.php
- http://fl###finger.net/index.php
- http://se###nuntil.net/index.php
- http://qu###above.net/index.php
- http://br###finger.net/index.php
- http://qu###until.net/index.php
- http://co####erealize.net/index.php
- http://of###shore.net/index.php
- http://co####edollar.net/index.php
- http://ch####ealize.net/index.php
- http://al###shore.net/index.php
- http://of###dollar.net/index.php
- http://al###dollar.net/index.php
- http://of####ritten.net/index.php
- http://al####ritten.net/index.php
- http://th####ealize.net/index.php
- http://pr####trealize.net/index.php
- http://th###dollar.net/index.php
- http://pr####tdollar.net/index.php
- http://ch###shore.net/index.php
- http://co####ewritten.net/index.php
- http://ch###dollar.net/index.php
- http://co####eshore.net/index.php
- http://ch####ritten.net/index.php
- DNS ASK ra####written.net
- DNS ASK mo####gwritten.net
- DNS ASK ra###rshore.net
- DNS ASK mo####gshore.net
- DNS ASK ra####dollar.net
- DNS ASK mo####grealize.net
- DNS ASK st####eshore.net
- DNS ASK mo####gdollar.net
- DNS ASK ra####realize.net
- DNS ASK tw###eshore.net
- DNS ASK mi####written.net
- DNS ASK al####ealize.net
- DNS ASK mi###eshore.net
- DNS ASK tw####written.net
- DNS ASK mi####realize.net
- DNS ASK tw####realize.net
- DNS ASK mi####dollar.net
- DNS ASK tw####dollar.net
- DNS ASK am####dollar.net
- DNS ASK we####rdollar.net
- DNS ASK am####written.net
- DNS ASK we####rwritten.net
- DNS ASK am####realize.net
- DNS ASK cl####ritten.net
- DNS ASK cl###dollar.net
- DNS ASK we####rrealize.net
- DNS ASK cl###shore.net
- DNS ASK hi####ywritten.net
- DNS ASK st####edollar.net
- DNS ASK hi####yshore.net
- DNS ASK st####ewritten.net
- DNS ASK hi####ydollar.net
- DNS ASK am###tshore.net
- DNS ASK we####rshore.net
- DNS ASK st####erealize.net
- DNS ASK hi####yrealize.net
- DNS ASK of####ealize.net
- DNS ASK se####shoulder.net
- DNS ASK qu###finger.net
- DNS ASK se###nabove.net
- DNS ASK qu####houlder.net
- DNS ASK se####finger.net
- DNS ASK th####ritten.net
- DNS ASK pr####twritten.net
- DNS ASK th###shore.net
- DNS ASK pr####tshore.net
- DNS ASK fl####houlder.net
- DNS ASK br####houlder.net
- DNS ASK fl###above.net
- DNS ASK br###above.net
- DNS ASK fl###finger.net
- DNS ASK se###nuntil.net
- DNS ASK qu###above.net
- DNS ASK br###finger.net
- DNS ASK qu###until.net
- DNS ASK co####erealize.net
- DNS ASK of###shore.net
- DNS ASK co####edollar.net
- DNS ASK ch####ealize.net
- DNS ASK al###shore.net
- DNS ASK of###dollar.net
- DNS ASK al###dollar.net
- DNS ASK of####ritten.net
- DNS ASK al####ritten.net
- DNS ASK th####ealize.net
- DNS ASK pr####trealize.net
- DNS ASK th###dollar.net
- DNS ASK pr####tdollar.net
- DNS ASK ch###shore.net
- DNS ASK co####ewritten.net
- DNS ASK ch###dollar.net
- DNS ASK co####eshore.net
- DNS ASK ch####ritten.net