Technical Information
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Machine AutoConnect Base Source NGEN Tracking' = '<SYSTEM32>\qyhbgdgjfw.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\Background RPC Debugger Credential] 'ImagePath' = '<SYSTEM32>\qyhbgdgjfw.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\Background RPC Debugger Credential] 'Start' = '00000002'
- Windows Security Center
- '<SYSTEM32>\dqtjsirrg.exe' "<SYSTEM32>\qyhbgdgjfw.exe"
- '%WINDIR%\Temp\kbkzo1922v3tlm.exe' -r 24264 tcp
- '%TEMP%\kbkzo1922kbclmmcqvxek.exe'
- '<SYSTEM32>\qyhbgdgjfw.exe'
- <SYSTEM32>\vhowsqgc\run
- <SYSTEM32>\vhowsqgc\rng
- %WINDIR%\Temp\kbkzo1922v3tlm.exe
- <SYSTEM32>\vhowsqgc\cfg
- <SYSTEM32>\dqtjsirrg.exe
- %TEMP%\kbkzo1922kbclmmcqvxek.exe
- <SYSTEM32>\vhowsqgc\tst
- <SYSTEM32>\qyhbgdgjfw.exe
- <SYSTEM32>\vhowsqgc\etc
- <SYSTEM32>\dqtjsirrg.exe
- <SYSTEM32>\qyhbgdgjfw.exe
- %WINDIR%\Temp\kbkzo1922v3tlm.exe
- <DRIVERS>\etc\hosts
- %TEMP%\kbkzo1922kbclmmcqvxek.exe
- 'we###sual.net':80
- 'st###could.net':80
- 'wa###rave.net':80
- 'st###usual.net':80
- 'we###ould.net':80
- 'st###grave.net':80
- 'we###rave.net':80
- 'st###teach.net':80
- 'we###each.net':80
- 'mo###grave.net':80
- 'fa###rave.net':80
- 'mo###usual.net':80
- 'fa###each.net':80
- 'le###grave.net':80
- 'wa###sual.net':80
- 'mo###teach.net':80
- 'wa###each.net':80
- 'mo###could.net':80
- 'wa###ould.net':80
- 'af###usual.net':80
- 'we####dayteach.net':80
- 'se###rave.net':80
- 'we####daycould.net':80
- 'se###each.net':80
- 'we####daygrave.net':80
- 'dr###could.net':80
- 'na###ould.net':80
- 'dr###usual.net':80
- 'na###sual.net':80
- 'se###ould.net':80
- 'fo###could.net':80
- 'af###teach.net':80
- 'fo###usual.net':80
- 'af###could.net':80
- 'fo###teach.net':80
- 'se###sual.net':80
- 'we####dayusual.net':80
- 'af###grave.net':80
- 'fo###grave.net':80
- 'dr###cross.net':80
- 'na###ross.net':80
- 'dr###threw.net':80
- 'na###hrew.net':80
- 'dr###shade.net':80
- 'na###loor.net':80
- 'fi###usual.net':80
- 'na###hade.net':80
- 'dr###floor.net':80
- 'we####dayfloor.net':80
- 'be##lxc.com':80
- 'de###lxc.com':80
- 'ri###nstorm.net':80
- 'af###sllc.com':80
- 'se###ross.net':80
- 'we####dayshade.net':80
- 'se###loor.net':80
- 'we####daycross.net':80
- 'se###hade.net':80
- 'qu###usual.net':80
- 'bo###rave.net':80
- 'ga###rave.net':80
- 'bo###each.net':80
- 'ga###each.net':80
- 'le###usual.net':80
- 'fa###ould.net':80
- 'le###teach.net':80
- 'fa###sual.net':80
- 'le###could.net':80
- 'ga###ould.net':80
- 'fi###teach.net':80
- 'qu###teach.net':80
- 'fi###could.net':80
- 'qu###could.net':80
- 'fi###grave.net':80
- 'ga###sual.net':80
- 'bo###ould.net':80
- 'qu###grave.net':80
- 'bo###sual.net':80
- http://we###sual.net/index.php
- http://st###could.net/index.php
- http://wa###rave.net/index.php
- http://st###usual.net/index.php
- http://we###ould.net/index.php
- http://st###grave.net/index.php
- http://we###rave.net/index.php
- http://st###teach.net/index.php
- http://we###each.net/index.php
- http://mo###grave.net/index.php
- http://fa###rave.net/index.php
- http://mo###usual.net/index.php
- http://fa###each.net/index.php
- http://le###grave.net/index.php
- http://wa###sual.net/index.php
- http://mo###teach.net/index.php
- http://wa###each.net/index.php
- http://mo###could.net/index.php
- http://wa###ould.net/index.php
- http://af###usual.net/index.php
- http://we####dayteach.net/index.php
- http://se###rave.net/index.php
- http://we####daycould.net/index.php
- http://se###each.net/index.php
- http://we####daygrave.net/index.php
- http://dr###could.net/index.php
- http://na###ould.net/index.php
- http://dr###usual.net/index.php
- http://na###sual.net/index.php
- http://se###ould.net/index.php
- http://fo###could.net/index.php
- http://af###teach.net/index.php
- http://fo###usual.net/index.php
- http://af###could.net/index.php
- http://fo###teach.net/index.php
- http://se###sual.net/index.php
- http://we####dayusual.net/index.php
- http://af###grave.net/index.php
- http://fo###grave.net/index.php
- http://dr###cross.net/index.php
- http://na###ross.net/index.php
- http://dr###threw.net/index.php
- http://na###hrew.net/index.php
- http://dr###shade.net/index.php
- http://na###loor.net/index.php
- http://fi###usual.net/index.php
- http://na###hade.net/index.php
- http://dr###floor.net/index.php
- http://we####dayfloor.net/index.php
- http://be##lxc.com/index.php
- http://de###lxc.com/index.php
- http://ri###nstorm.net/index.php
- http://af###sllc.com/index.php
- http://se###ross.net/index.php
- http://we####dayshade.net/index.php
- http://se###loor.net/index.php
- http://we####daycross.net/index.php
- http://se###hade.net/index.php
- http://qu###usual.net/index.php
- http://bo###rave.net/index.php
- http://ga###rave.net/index.php
- http://bo###each.net/index.php
- http://ga###each.net/index.php
- http://le###usual.net/index.php
- http://fa###ould.net/index.php
- http://le###teach.net/index.php
- http://fa###sual.net/index.php
- http://le###could.net/index.php
- http://ga###ould.net/index.php
- http://fi###teach.net/index.php
- http://qu###teach.net/index.php
- http://fi###could.net/index.php
- http://qu###could.net/index.php
- http://fi###grave.net/index.php
- http://ga###sual.net/index.php
- http://bo###ould.net/index.php
- http://qu###grave.net/index.php
- http://bo###sual.net/index.php
- DNS ASK st###could.net
- DNS ASK we###ould.net
- DNS ASK we###sual.net
- DNS ASK wa###rave.net
- DNS ASK st###usual.net
- DNS ASK we###rave.net
- DNS ASK af###usual.net
- DNS ASK st###grave.net
- DNS ASK st###teach.net
- DNS ASK we###each.net
- DNS ASK mo###usual.net
- DNS ASK wa###sual.net
- DNS ASK fa###rave.net
- DNS ASK fa###each.net
- DNS ASK le###grave.net
- DNS ASK wa###each.net
- DNS ASK mo###grave.net
- DNS ASK mo###teach.net
- DNS ASK mo###could.net
- DNS ASK wa###ould.net
- DNS ASK se###rave.net
- DNS ASK we####daygrave.net
- DNS ASK we####dayteach.net
- DNS ASK we####daycould.net
- DNS ASK se###each.net
- DNS ASK na###ould.net
- DNS ASK dr###teach.net
- DNS ASK dr###could.net
- DNS ASK dr###usual.net
- DNS ASK na###sual.net
- DNS ASK af###teach.net
- DNS ASK fo###teach.net
- DNS ASK fo###could.net
- DNS ASK fo###usual.net
- DNS ASK af###could.net
- DNS ASK we####dayusual.net
- DNS ASK se###ould.net
- DNS ASK se###sual.net
- DNS ASK af###grave.net
- DNS ASK fo###grave.net
- DNS ASK dr###cross.net
- DNS ASK na###ross.net
- DNS ASK dr###threw.net
- DNS ASK na###hrew.net
- DNS ASK dr###shade.net
- DNS ASK na###loor.net
- DNS ASK fi###usual.net
- DNS ASK na###hade.net
- DNS ASK dr###floor.net
- DNS ASK we####dayfloor.net
- DNS ASK be##lxc.com
- DNS ASK de###lxc.com
- DNS ASK ri###nstorm.net
- DNS ASK af###sllc.com
- DNS ASK se###ross.net
- DNS ASK we####dayshade.net
- DNS ASK se###loor.net
- DNS ASK we####daycross.net
- DNS ASK se###hade.net
- DNS ASK qu###usual.net
- DNS ASK bo###rave.net
- DNS ASK ga###rave.net
- DNS ASK bo###each.net
- DNS ASK ga###each.net
- DNS ASK le###usual.net
- DNS ASK fa###ould.net
- DNS ASK le###teach.net
- DNS ASK fa###sual.net
- DNS ASK le###could.net
- DNS ASK ga###ould.net
- DNS ASK fi###teach.net
- DNS ASK qu###teach.net
- DNS ASK fi###could.net
- DNS ASK qu###could.net
- DNS ASK fi###grave.net
- DNS ASK ga###sual.net
- DNS ASK bo###ould.net
- DNS ASK qu###grave.net
- DNS ASK bo###sual.net
- '23#.#55.255.250':1900