Technical Information
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Connection Information Portable Key Human File' = '<SYSTEM32>\fluruixwpli.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\List Certificate Network Biometric] 'ImagePath' = '<SYSTEM32>\fluruixwpli.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\List Certificate Network Biometric] 'Start' = '00000002'
- Windows Security Center
- '<SYSTEM32>\adejwmg.exe' "<SYSTEM32>\fluruixwpli.exe"
- '%WINDIR%\Temp\dzcgmw3jnxamecu.exe' -r 49802 tcp
- '%TEMP%\dzcgmw3bfhamecut3lmfnr.exe'
- '<SYSTEM32>\fluruixwpli.exe'
- <SYSTEM32>\xeoplkfszov\run
- <SYSTEM32>\xeoplkfszov\rng
- %WINDIR%\Temp\dzcgmw3jnxamecu.exe
- <SYSTEM32>\xeoplkfszov\cfg
- <SYSTEM32>\adejwmg.exe
- %TEMP%\dzcgmw3bfhamecut3lmfnr.exe
- <SYSTEM32>\xeoplkfszov\tst
- <SYSTEM32>\fluruixwpli.exe
- <SYSTEM32>\xeoplkfszov\etc
- <SYSTEM32>\adejwmg.exe
- <SYSTEM32>\fluruixwpli.exe
- %WINDIR%\Temp\dzcgmw3jnxamecu.exe
- <DRIVERS>\etc\hosts
- %TEMP%\dzcgmw3bfhamecut3lmfnr.exe
- 'li###oise.net':80
- 'th###pull.net':80
- 'th###noise.net':80
- 'th###rise.net':80
- 'li###ise.net':80
- 'li###ull.net':80
- 'we###ise.net':80
- 'fe###oise.net':80
- 'fe###ise.net':80
- 'fe###ruit.net':80
- 'we###ruit.net':80
- 'li###ruit.net':80
- 'fi###fruit.net':80
- 'so###rise.net':80
- 'so###fruit.net':80
- 'wa###ont.net':80
- 'ta###ont.net':80
- 'fi###rise.net':80
- 'fi###pull.net':80
- 'th###fruit.net':80
- 'so###pull.net':80
- 'so###noise.net':80
- 'fi###noise.net':80
- 'po###noise.net':80
- 'ca###oise.net':80
- 'ca###ise.net':80
- 'ca###ruit.net':80
- 'po###rise.net':80
- 'po###pull.net':80
- 'no###oise.net':80
- 'no###ull.net':80
- 'no###ise.net':80
- 'ca###ull.net':80
- 'no###ruit.net':80
- 'po###fruit.net':80
- 'ta###fruit.net':80
- 'le###ruit.net':80
- 'we###ull.net':80
- 'we###oise.net':80
- 'fe###ull.net':80
- 'ta###rise.net':80
- 'ta###pull.net':80
- 'le###ull.net':80
- 'le###oise.net':80
- 'le###ise.net':80
- 'ta###noise.net':80
- 'ta###reat.net':80
- 'se###dont.net':80
- 'le###dont.net':80
- 'le###great.net':80
- 'le###scene.net':80
- 'se###great.net':80
- 'to###unt.net':80
- 'to###reat.net':80
- 'fa###reat.net':80
- 'fa###cene.net':80
- 'fa###unt.net':80
- 'to###cene.net':80
- 'se###scene.net':80
- 'mi###hown.net':80
- 'ab###ell.net':80
- 'mo###ugust.net':80
- 'cr#####onaraminta.net':80
- 'le###form.net':80
- 'mo###olor.net':80
- 'ri###nstorm.net':80
- 'be##lxc.com':80
- 'al###being.net':80
- 'pr####tbottom.net':80
- 'ca####nbring.net':80
- 'mu###reat.net':80
- 'pi###dont.net':80
- 'pi###great.net':80
- 'pi###scene.net':80
- 'mu###cene.net':80
- 'mu###ont.net':80
- 'ta###cene.net':80
- 'wa###reat.net':80
- 'wa###cene.net':80
- 'wa###unt.net':80
- 'ta###unt.net':80
- 'mu###unt.net':80
- 've###unt.net':80
- 'we###cene.net':80
- 'we###unt.net':80
- 'to###ont.net':80
- 'fa###ont.net':80
- 've###cene.net':80
- 've###ont.net':80
- 'pi###aunt.net':80
- 'we###ont.net':80
- 'we###reat.net':80
- 've###reat.net':80
- http://li###oise.net/index.php
- http://th###pull.net/index.php
- http://th###noise.net/index.php
- http://th###rise.net/index.php
- http://li###ise.net/index.php
- http://li###ull.net/index.php
- http://we###ise.net/index.php
- http://fe###oise.net/index.php
- http://fe###ise.net/index.php
- http://fe###ruit.net/index.php
- http://we###ruit.net/index.php
- http://li###ruit.net/index.php
- http://fi###fruit.net/index.php
- http://so###rise.net/index.php
- http://so###fruit.net/index.php
- http://wa###ont.net/index.php
- http://ta###ont.net/index.php
- http://fi###rise.net/index.php
- http://fi###pull.net/index.php
- http://th###fruit.net/index.php
- http://so###pull.net/index.php
- http://so###noise.net/index.php
- http://fi###noise.net/index.php
- http://po###noise.net/index.php
- http://ca###oise.net/index.php
- http://ca###ise.net/index.php
- http://ca###ruit.net/index.php
- http://po###rise.net/index.php
- http://po###pull.net/index.php
- http://no###oise.net/index.php
- http://no###ull.net/index.php
- http://no###ise.net/index.php
- http://ca###ull.net/index.php
- http://no###ruit.net/index.php
- http://po###fruit.net/index.php
- http://ta###fruit.net/index.php
- http://le###ruit.net/index.php
- http://we###ull.net/index.php
- http://we###oise.net/index.php
- http://fe###ull.net/index.php
- http://ta###rise.net/index.php
- http://ta###pull.net/index.php
- http://le###ull.net/index.php
- http://le###oise.net/index.php
- http://le###ise.net/index.php
- http://ta###noise.net/index.php
- http://ta###reat.net/index.php
- http://se###dont.net/index.php
- http://le###dont.net/index.php
- http://le###great.net/index.php
- http://le###scene.net/index.php
- http://se###great.net/index.php
- http://to###unt.net/index.php
- http://to###reat.net/index.php
- http://fa###reat.net/index.php
- http://fa###cene.net/index.php
- http://fa###unt.net/index.php
- http://to###cene.net/index.php
- http://se###scene.net/index.php
- http://mi###hown.net/index.php
- http://ab###ell.net/index.php
- http://mo###ugust.net/index.php
- http://cr#####onaraminta.net/index.php
- http://le###form.net/index.php
- http://mo###olor.net/index.php
- http://ri###nstorm.net/index.php
- http://be##lxc.com/index.php
- http://al###being.net/index.php
- http://pr####tbottom.net/index.php
- http://ca####nbring.net/index.php
- http://mu###reat.net/index.php
- http://pi###dont.net/index.php
- http://pi###great.net/index.php
- http://pi###scene.net/index.php
- http://mu###cene.net/index.php
- http://mu###ont.net/index.php
- http://ta###cene.net/index.php
- http://wa###reat.net/index.php
- http://wa###cene.net/index.php
- http://wa###unt.net/index.php
- http://ta###unt.net/index.php
- http://mu###unt.net/index.php
- http://ve###unt.net/index.php
- http://we###cene.net/index.php
- http://we###unt.net/index.php
- http://to###ont.net/index.php
- http://fa###ont.net/index.php
- http://ve###cene.net/index.php
- http://ve###ont.net/index.php
- http://pi###aunt.net/index.php
- http://we###ont.net/index.php
- http://we###reat.net/index.php
- http://ve###reat.net/index.php
- DNS ASK th###noise.net
- DNS ASK li###oise.net
- DNS ASK li###ise.net
- DNS ASK li###ruit.net
- DNS ASK th###rise.net
- DNS ASK th###pull.net
- DNS ASK fe###ise.net
- DNS ASK we###ise.net
- DNS ASK we###ruit.net
- DNS ASK li###ull.net
- DNS ASK fe###ruit.net
- DNS ASK th###fruit.net
- DNS ASK so###fruit.net
- DNS ASK fi###fruit.net
- DNS ASK ta###ont.net
- DNS ASK ta###reat.net
- DNS ASK wa###ont.net
- DNS ASK so###rise.net
- DNS ASK so###pull.net
- DNS ASK fi###pull.net
- DNS ASK fi###noise.net
- DNS ASK fi###rise.net
- DNS ASK so###noise.net
- DNS ASK fe###oise.net
- DNS ASK po###noise.net
- DNS ASK ca###oise.net
- DNS ASK ca###ise.net
- DNS ASK ca###ruit.net
- DNS ASK po###rise.net
- DNS ASK po###pull.net
- DNS ASK no###oise.net
- DNS ASK no###ull.net
- DNS ASK no###ise.net
- DNS ASK ca###ull.net
- DNS ASK no###ruit.net
- DNS ASK po###fruit.net
- DNS ASK ta###fruit.net
- DNS ASK le###ruit.net
- DNS ASK we###ull.net
- DNS ASK we###oise.net
- DNS ASK fe###ull.net
- DNS ASK ta###rise.net
- DNS ASK ta###pull.net
- DNS ASK le###ull.net
- DNS ASK le###oise.net
- DNS ASK le###ise.net
- DNS ASK ta###noise.net
- DNS ASK se###dont.net
- DNS ASK le###dont.net
- DNS ASK le###great.net
- DNS ASK le###scene.net
- DNS ASK se###great.net
- DNS ASK to###unt.net
- DNS ASK to###reat.net
- DNS ASK fa###reat.net
- DNS ASK fa###cene.net
- DNS ASK fa###unt.net
- DNS ASK to###cene.net
- DNS ASK se###scene.net
- DNS ASK mi###hown.net
- DNS ASK ab###ell.net
- DNS ASK mo###ugust.net
- DNS ASK cr#####onaraminta.net
- DNS ASK le###form.net
- DNS ASK mo###olor.net
- DNS ASK ri###nstorm.net
- DNS ASK be##lxc.com
- DNS ASK al###being.net
- DNS ASK pr####tbottom.net
- DNS ASK ca####nbring.net
- DNS ASK mu###reat.net
- DNS ASK pi###dont.net
- DNS ASK pi###great.net
- DNS ASK pi###scene.net
- DNS ASK mu###cene.net
- DNS ASK mu###ont.net
- DNS ASK ta###cene.net
- DNS ASK wa###reat.net
- DNS ASK wa###cene.net
- DNS ASK wa###unt.net
- DNS ASK ta###unt.net
- DNS ASK mu###unt.net
- DNS ASK ve###unt.net
- DNS ASK we###cene.net
- DNS ASK we###unt.net
- DNS ASK to###ont.net
- DNS ASK fa###ont.net
- DNS ASK ve###cene.net
- DNS ASK ve###ont.net
- DNS ASK pi###aunt.net
- DNS ASK we###ont.net
- DNS ASK we###reat.net
- DNS ASK ve###reat.net
- '23#.#55.255.250':1900