Technical Information
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Removal Extensible Port Drive' = '<SYSTEM32>\iufwmsxh.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\Quality UPnP IKE Base Error] 'Start' = '00000002'
- Windows Security Center
- '<SYSTEM32>\mgagjnj.exe' "<SYSTEM32>\iufwmsxh.exe"
- '%WINDIR%\Temp\ngf3gju39puquf.exe' -r 31993 tcp
- '%TEMP%\ngf3gju328bqufb2f8kt.exe'
- '<SYSTEM32>\iufwmsxh.exe'
- <SYSTEM32>\hgdpnts\run
- <SYSTEM32>\hgdpnts\rng
- %WINDIR%\Temp\ngf3gju39puquf.exe
- <SYSTEM32>\hgdpnts\cfg
- <SYSTEM32>\mgagjnj.exe
- %TEMP%\ngf3gju328bqufb2f8kt.exe
- <SYSTEM32>\hgdpnts\tst
- <SYSTEM32>\iufwmsxh.exe
- <SYSTEM32>\hgdpnts\etc
- <SYSTEM32>\mgagjnj.exe
- <SYSTEM32>\iufwmsxh.exe
- %WINDIR%\Temp\ngf3gju39puquf.exe
- <DRIVERS>\etc\hosts
- %TEMP%\ngf3gju328bqufb2f8kt.exe
- 'he###ark.net':80
- 'ca###ews.net':80
- 'he###roke.net':80
- 'ca###ark.net':80
- 'he###ews.net':80
- 'qu###broke.net':80
- 'th###roke.net':80
- 'qu###state.net':80
- 'th###tate.net':80
- 'th###mark.net':80
- 'si###mark.net':80
- 'th###broke.net':80
- 'si###broke.net':80
- 'th###news.net':80
- 'he###tate.net':80
- 'ca###roke.net':80
- 'si###news.net':80
- 'ca###tate.net':80
- 'qu###mark.net':80
- 'me###tate.net':80
- 'si###tate.net':80
- 'su###ynews.net':80
- 'mo###ews.net':80
- 'me###roke.net':80
- 'si###ark.net':80
- 'me###ews.net':80
- 'si###roke.net':80
- 'me###ark.net':80
- 'th###ews.net':80
- 'su###ystate.net':80
- 'th###ark.net':80
- 'qu###news.net':80
- 'mo###tate.net':80
- 'su###ymark.net':80
- 'mo###ark.net':80
- 'su###ybroke.net':80
- 'mo###roke.net':80
- 'si###state.net':80
- 'si###rave.net':80
- 'cl###usual.net':80
- 'ri###nstorm.net':80
- 'be##lxc.com':80
- 'da###sual.net':80
- 'cl###teach.net':80
- 'da###each.net':80
- 'cl###could.net':80
- 'da###ould.net':80
- 'mo###ugust.net':80
- 'mi###hown.net':80
- 'cr#####onaraminta.net':80
- 'le###form.net':80
- 'ab###ell.net':80
- 'ca####nbring.net':80
- 'al###being.net':80
- 'mo###olor.net':80
- 'pr####tbottom.net':80
- 'cl###grave.net':80
- 'wi###roke.net':80
- 'du###roke.net':80
- 'wi###tate.net':80
- 'du###tate.net':80
- 'wi###ark.net':80
- 'du###ews.net':80
- 'th###state.net':80
- 'du###ark.net':80
- 'wi###ews.net':80
- 'tr###state.net':80
- 'mi###roke.net':80
- 'da###rave.net':80
- 'mi###tate.net':80
- 'tr###broke.net':80
- 'mi###ews.net':80
- 'tr###news.net':80
- 'mi###ark.net':80
- 'tr###mark.net':80
- http://he###ark.net/index.php
- http://ca###ews.net/index.php
- http://he###roke.net/index.php
- http://ca###ark.net/index.php
- http://he###ews.net/index.php
- http://qu###broke.net/index.php
- http://th###roke.net/index.php
- http://qu###state.net/index.php
- http://th###tate.net/index.php
- http://th###mark.net/index.php
- http://si###mark.net/index.php
- http://th###broke.net/index.php
- http://si###broke.net/index.php
- http://th###news.net/index.php
- http://he###tate.net/index.php
- http://ca###roke.net/index.php
- http://si###news.net/index.php
- http://ca###tate.net/index.php
- http://qu###mark.net/index.php
- http://me###tate.net/index.php
- http://si###tate.net/index.php
- http://su###ynews.net/index.php
- http://mo###ews.net/index.php
- http://me###roke.net/index.php
- http://si###ark.net/index.php
- http://me###ews.net/index.php
- http://si###roke.net/index.php
- http://me###ark.net/index.php
- http://th###ews.net/index.php
- http://su###ystate.net/index.php
- http://th###ark.net/index.php
- http://qu###news.net/index.php
- http://mo###tate.net/index.php
- http://su###ymark.net/index.php
- http://mo###ark.net/index.php
- http://su###ybroke.net/index.php
- http://mo###roke.net/index.php
- http://si###state.net/index.php
- http://si###rave.net/index.php
- http://cl###usual.net/index.php
- http://ri###nstorm.net/index.php
- http://be##lxc.com/index.php
- http://da###sual.net/index.php
- http://cl###teach.net/index.php
- http://da###each.net/index.php
- http://cl###could.net/index.php
- http://da###ould.net/index.php
- http://mo###ugust.net/index.php
- http://mi###hown.net/index.php
- http://cr#####onaraminta.net/index.php
- http://le###form.net/index.php
- http://ab###ell.net/index.php
- http://ca####nbring.net/index.php
- http://al###being.net/index.php
- http://mo###olor.net/index.php
- http://pr####tbottom.net/index.php
- http://cl###grave.net/index.php
- http://wi###roke.net/index.php
- http://du###roke.net/index.php
- http://wi###tate.net/index.php
- http://du###tate.net/index.php
- http://wi###ark.net/index.php
- http://du###ews.net/index.php
- http://th###state.net/index.php
- http://du###ark.net/index.php
- http://wi###ews.net/index.php
- http://tr###state.net/index.php
- http://mi###roke.net/index.php
- http://da###rave.net/index.php
- http://mi###tate.net/index.php
- http://tr###broke.net/index.php
- http://mi###ews.net/index.php
- http://tr###news.net/index.php
- http://mi###ark.net/index.php
- http://tr###mark.net/index.php
- DNS ASK ca###ews.net
- DNS ASK he###ews.net
- DNS ASK ca###ark.net
- DNS ASK he###ark.net
- DNS ASK qu###state.net
- DNS ASK th###roke.net
- DNS ASK qu###mark.net
- DNS ASK th###tate.net
- DNS ASK qu###broke.net
- DNS ASK he###roke.net
- DNS ASK th###mark.net
- DNS ASK si###mark.net
- DNS ASK th###broke.net
- DNS ASK si###broke.net
- DNS ASK th###news.net
- DNS ASK he###tate.net
- DNS ASK ca###roke.net
- DNS ASK si###news.net
- DNS ASK ca###tate.net
- DNS ASK si###tate.net
- DNS ASK me###roke.net
- DNS ASK mo###ews.net
- DNS ASK me###tate.net
- DNS ASK si###roke.net
- DNS ASK me###ews.net
- DNS ASK si###ews.net
- DNS ASK me###ark.net
- DNS ASK si###ark.net
- DNS ASK su###ynews.net
- DNS ASK th###ews.net
- DNS ASK su###ystate.net
- DNS ASK th###ark.net
- DNS ASK qu###news.net
- DNS ASK mo###tate.net
- DNS ASK su###ymark.net
- DNS ASK mo###ark.net
- DNS ASK su###ybroke.net
- DNS ASK mo###roke.net
- DNS ASK si###state.net
- DNS ASK si###rave.net
- DNS ASK cl###usual.net
- DNS ASK ri###nstorm.net
- DNS ASK be##lxc.com
- DNS ASK da###sual.net
- DNS ASK cl###teach.net
- DNS ASK da###each.net
- DNS ASK cl###could.net
- DNS ASK da###ould.net
- DNS ASK mo###ugust.net
- DNS ASK mi###hown.net
- DNS ASK cr#####onaraminta.net
- DNS ASK le###form.net
- DNS ASK ab###ell.net
- DNS ASK ca####nbring.net
- DNS ASK al###being.net
- DNS ASK mo###olor.net
- DNS ASK pr####tbottom.net
- DNS ASK cl###grave.net
- DNS ASK wi###roke.net
- DNS ASK du###roke.net
- DNS ASK wi###tate.net
- DNS ASK du###tate.net
- DNS ASK wi###ark.net
- DNS ASK du###ews.net
- DNS ASK th###state.net
- DNS ASK du###ark.net
- DNS ASK wi###ews.net
- DNS ASK tr###state.net
- DNS ASK mi###roke.net
- DNS ASK da###rave.net
- DNS ASK mi###tate.net
- DNS ASK tr###broke.net
- DNS ASK mi###ews.net
- DNS ASK tr###news.net
- DNS ASK mi###ark.net
- DNS ASK tr###mark.net
- '23#.#55.255.250':1900