Technical Information
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Base Modules Grouping Experience Now' = '<SYSTEM32>\fztuumwqhb.exe'
- Windows Security Center
- '<SYSTEM32>\ywkfohymshw.exe' "<SYSTEM32>\fztuumwqhb.exe"
- '%TEMP%\qi2mjdx35xkiqxsg.exe' -r 29482 tcp
- '%TEMP%\qi2mjdx3164iqxsgqlr9gs.exe'
- '<SYSTEM32>\fztuumwqhb.exe'
- <SYSTEM32>\mnabztosskdy\run
- <SYSTEM32>\mnabztosskdy\rng
- %TEMP%\qi2mjdx35xkiqxsg.exe
- <SYSTEM32>\mnabztosskdy\cfg
- <SYSTEM32>\ywkfohymshw.exe
- %TEMP%\qi2mjdx3164iqxsgqlr9gs.exe
- <SYSTEM32>\mnabztosskdy\tst
- <SYSTEM32>\fztuumwqhb.exe
- <SYSTEM32>\mnabztosskdy\etc
- <SYSTEM32>\ywkfohymshw.exe
- <SYSTEM32>\fztuumwqhb.exe
- %TEMP%\qi2mjdx35xkiqxsg.exe
- <DRIVERS>\etc\hosts
- %TEMP%\qi2mjdx3164iqxsgqlr9gs.exe
- 'gl###edge.net':80
- 'ta###wedge.net':80
- 'gl####sterday.net':80
- 'ta####esterday.net':80
- 'eq###feet.net':80
- 'gr###each.net':80
- 'eq####esterday.net':80
- 'gr###feet.net':80
- 'eq###each.net':80
- 'ta###each.net':80
- 'sp####sterday.net':80
- 'sa####sterday.net':80
- 'sp###ach.net':80
- 'sa###ach.net':80
- 'sp###edge.net':80
- 'ta###feet.net':80
- 'gl###ach.net':80
- 'sa###edge.net':80
- 'gl###eet.net':80
- 'fa###eet.net':80
- 'wa###each.net':80
- 'vi###wedge.net':80
- 'wa###feet.net':80
- 'fa###ach.net':80
- 'wa###wedge.net':80
- 'fa###edge.net':80
- 'wa####esterday.net':80
- 'fa####sterday.net':80
- 'sp###wedge.net':80
- 'gr###wedge.net':80
- 'sp###feet.net':80
- 'gr####esterday.net':80
- 'eq###wedge.net':80
- 'vi###feet.net':80
- 'sp####esterday.net':80
- 'vi####esterday.net':80
- 'sp###each.net':80
- 'vi###each.net':80
- 'sa###eet.net':80
- 'fa###new.net':80
- 'dr###fifth.net':80
- 'be##lxc.com':80
- 'wa###knew.net':80
- 'th###ifth.net':80
- 'dr###done.net':80
- 'th###one.net':80
- 'dr###shine.net':80
- 'th###hine.net':80
- 'ri###nstorm.net':80
- 'mo###ugust.net':80
- 'mi###hown.net':80
- 'cr#####onaraminta.net':80
- 'le###form.net':80
- 'ab###ell.net':80
- 'ca####nbring.net':80
- 'al###being.net':80
- 'mo###olor.net':80
- 'pr####tbottom.net':80
- 'up###ach.net':80
- 'wh###each.net':80
- 'up###eet.net':80
- 'wh###feet.net':80
- 'up####sterday.net':80
- 'wh###wedge.net':80
- 'sp###eet.net':80
- 'wh####esterday.net':80
- 'up###edge.net':80
- 'so###wedge.net':80
- 'ar###feet.net':80
- 'so###feet.net':80
- 'dr###knew.net':80
- 'th###new.net':80
- 'ar###each.net':80
- 'so####esterday.net':80
- 'ar###wedge.net':80
- 'so###each.net':80
- 'ar####esterday.net':80
- http://gl###edge.net/index.php
- http://ta###wedge.net/index.php
- http://gl####sterday.net/index.php
- http://ta####esterday.net/index.php
- http://eq###feet.net/index.php
- http://gr###each.net/index.php
- http://eq####esterday.net/index.php
- http://gr###feet.net/index.php
- http://eq###each.net/index.php
- http://ta###each.net/index.php
- http://sp####sterday.net/index.php
- http://sa####sterday.net/index.php
- http://sp###ach.net/index.php
- http://sa###ach.net/index.php
- http://sp###edge.net/index.php
- http://ta###feet.net/index.php
- http://gl###ach.net/index.php
- http://sa###edge.net/index.php
- http://gl###eet.net/index.php
- http://fa###eet.net/index.php
- http://wa###each.net/index.php
- http://vi###wedge.net/index.php
- http://wa###feet.net/index.php
- http://fa###ach.net/index.php
- http://wa###wedge.net/index.php
- http://fa###edge.net/index.php
- http://wa####esterday.net/index.php
- http://fa####sterday.net/index.php
- http://sp###wedge.net/index.php
- http://gr###wedge.net/index.php
- http://sp###feet.net/index.php
- http://gr####esterday.net/index.php
- http://eq###wedge.net/index.php
- http://vi###feet.net/index.php
- http://sp####esterday.net/index.php
- http://vi####esterday.net/index.php
- http://sp###each.net/index.php
- http://vi###each.net/index.php
- http://sa###eet.net/index.php
- http://fa###new.net/index.php
- http://dr###fifth.net/index.php
- http://be##lxc.com/index.php
- http://wa###knew.net/index.php
- http://th###ifth.net/index.php
- http://dr###done.net/index.php
- http://th###one.net/index.php
- http://dr###shine.net/index.php
- http://th###hine.net/index.php
- http://ri###nstorm.net/index.php
- http://mo###ugust.net/index.php
- http://mi###hown.net/index.php
- http://cr#####onaraminta.net/index.php
- http://le###form.net/index.php
- http://ab###ell.net/index.php
- http://ca####nbring.net/index.php
- http://al###being.net/index.php
- http://mo###olor.net/index.php
- http://pr####tbottom.net/index.php
- http://up###ach.net/index.php
- http://wh###each.net/index.php
- http://up###eet.net/index.php
- http://wh###feet.net/index.php
- http://up####sterday.net/index.php
- http://wh###wedge.net/index.php
- http://sp###eet.net/index.php
- http://wh####esterday.net/index.php
- http://up###edge.net/index.php
- http://so###wedge.net/index.php
- http://ar###feet.net/index.php
- http://so###feet.net/index.php
- http://dr###knew.net/index.php
- http://th###new.net/index.php
- http://ar###each.net/index.php
- http://so####esterday.net/index.php
- http://ar###wedge.net/index.php
- http://so###each.net/index.php
- http://ar####esterday.net/index.php
- DNS ASK gl###edge.net
- DNS ASK ta###wedge.net
- DNS ASK gl####sterday.net
- DNS ASK ta####esterday.net
- DNS ASK eq###feet.net
- DNS ASK gr###each.net
- DNS ASK eq####esterday.net
- DNS ASK gr###feet.net
- DNS ASK eq###each.net
- DNS ASK ta###each.net
- DNS ASK sp####sterday.net
- DNS ASK sa####sterday.net
- DNS ASK sp###ach.net
- DNS ASK sa###ach.net
- DNS ASK sp###edge.net
- DNS ASK ta###feet.net
- DNS ASK gl###ach.net
- DNS ASK sa###edge.net
- DNS ASK gl###eet.net
- DNS ASK gr####esterday.net
- DNS ASK wa###each.net
- DNS ASK fa###ach.net
- DNS ASK wa###feet.net
- DNS ASK fa###eet.net
- DNS ASK wa####esterday.net
- DNS ASK fa###edge.net
- DNS ASK dr###feet.net
- DNS ASK fa####sterday.net
- DNS ASK wa###wedge.net
- DNS ASK vi###wedge.net
- DNS ASK sp###feet.net
- DNS ASK vi###feet.net
- DNS ASK eq###wedge.net
- DNS ASK gr###wedge.net
- DNS ASK sp###each.net
- DNS ASK vi####esterday.net
- DNS ASK sp###wedge.net
- DNS ASK vi###each.net
- DNS ASK sp####esterday.net
- DNS ASK sa###eet.net
- DNS ASK fa###new.net
- DNS ASK dr###fifth.net
- DNS ASK be##lxc.com
- DNS ASK wa###knew.net
- DNS ASK th###ifth.net
- DNS ASK dr###done.net
- DNS ASK th###one.net
- DNS ASK dr###shine.net
- DNS ASK th###hine.net
- DNS ASK ri###nstorm.net
- DNS ASK mo###ugust.net
- DNS ASK mi###hown.net
- DNS ASK cr#####onaraminta.net
- DNS ASK le###form.net
- DNS ASK ab###ell.net
- DNS ASK ca####nbring.net
- DNS ASK al###being.net
- DNS ASK mo###olor.net
- DNS ASK pr####tbottom.net
- DNS ASK up###ach.net
- DNS ASK wh###each.net
- DNS ASK up###eet.net
- DNS ASK wh###feet.net
- DNS ASK up####sterday.net
- DNS ASK wh###wedge.net
- DNS ASK sp###eet.net
- DNS ASK wh####esterday.net
- DNS ASK up###edge.net
- DNS ASK so###wedge.net
- DNS ASK ar###feet.net
- DNS ASK so###feet.net
- DNS ASK dr###knew.net
- DNS ASK th###new.net
- DNS ASK ar###each.net
- DNS ASK so####esterday.net
- DNS ASK ar###wedge.net
- DNS ASK so###each.net
- DNS ASK ar####esterday.net
- '23#.#55.255.250':1900