Technical Information
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Registrar DNS Compatibility Computer Access' = '<SYSTEM32>\lofwaispmiz.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\BranchCache Problem Background] 'Start' = '00000002'
- Windows Security Center
- '<SYSTEM32>\sqrgmtivok.exe' "<SYSTEM32>\lofwaispmiz.exe"
- '%WINDIR%\Temp\b0bkbsf2whap0y3v.exe' -r 31392 tcp
- '%TEMP%\b0bkbsf2r1jp0y3vhspnevge.exe'
- '<SYSTEM32>\lofwaispmiz.exe'
- <SYSTEM32>\ufncinnvgenm\run
- <SYSTEM32>\ufncinnvgenm\rng
- %WINDIR%\Temp\b0bkbsf2whap0y3v.exe
- <SYSTEM32>\ufncinnvgenm\cfg
- <SYSTEM32>\sqrgmtivok.exe
- %TEMP%\b0bkbsf2r1jp0y3vhspnevge.exe
- <SYSTEM32>\ufncinnvgenm\tst
- <SYSTEM32>\lofwaispmiz.exe
- <SYSTEM32>\ufncinnvgenm\etc
- <SYSTEM32>\sqrgmtivok.exe
- <SYSTEM32>\lofwaispmiz.exe
- %WINDIR%\Temp\b0bkbsf2whap0y3v.exe
- %TEMP%\b0bkbsf2r1jp0y3vhspnevge.exe
- <DRIVERS>\etc\hosts
- 'we###rain.net':80
- 'we###ver.net':80
- 'we###ome.net':80
- 'fa###home.net':80
- 'ri###ome.net':80
- 'we###old.net':80
- 'li###old.net':80
- 'li###ver.net':80
- 'no###ver.net':80
- 'li###ome.net':80
- 'no###old.net':80
- 'li###rain.net':80
- 'no###rain.net':80
- 'ri###ver.net':80
- 'tr###talk.net':80
- 'yo###elow.net':80
- 'tr###below.net':80
- 'yo###hirt.net':80
- 'tr###shirt.net':80
- 'yo###alk.net':80
- 'yo###ash.net':80
- 'fa###grain.net':80
- 'ri###rain.net':80
- 'fa###over.net':80
- 'tr###wash.net':80
- 'fa###gold.net':80
- 'ri###old.net':80
- 'th####hcountry.net':80
- 'li####appear.net':80
- 're####erpaint.net':80
- 'ta###over.net':80
- 'le###ome.net':80
- 'ta###home.net':80
- 'ne####arydress.net':80
- 'mi####lossary.net':80
- 'ta###fruit.net':80
- 'st###march.net':80
- 'gl###health.net':80
- 'ge####friend.net':80
- 're####eneither.net':80
- 'le###ver.net':80
- 'ca###rain.net':80
- 'po###grain.net':80
- 'ca###ver.net':80
- 'no###ome.net':80
- 'ca###old.net':80
- 'po###gold.net':80
- 'po###over.net':80
- 'ta###gold.net':80
- 'le###rain.net':80
- 'ta###grain.net':80
- 'ca###ome.net':80
- 'po###home.net':80
- 'le###old.net':80
- we###rain.net/forum/search.php?me#########################################
- we###ver.net/forum/search.php?me#########################################
- we###ome.net/forum/search.php?me#########################################
- fa###home.net/forum/search.php?me#########################################
- ri###ome.net/forum/search.php?me#########################################
- we###old.net/forum/search.php?me#########################################
- li###old.net/forum/search.php?me#########################################
- li###ver.net/forum/search.php?me#########################################
- no###ver.net/forum/search.php?me#########################################
- li###ome.net/forum/search.php?me#########################################
- no###old.net/forum/search.php?me#########################################
- li###rain.net/forum/search.php?me#########################################
- no###rain.net/forum/search.php?me#########################################
- ri###ver.net/forum/search.php?me#########################################
- tr###talk.net/forum/search.php?me#########################################
- yo###elow.net/forum/search.php?me#########################################
- tr###below.net/forum/search.php?me#########################################
- yo###hirt.net/forum/search.php?me#########################################
- tr###shirt.net/forum/search.php?me#########################################
- yo###alk.net/forum/search.php?me#########################################
- yo###ash.net/forum/search.php?me#########################################
- fa###grain.net/forum/search.php?me#########################################
- ri###rain.net/forum/search.php?me#########################################
- fa###over.net/forum/search.php?me#########################################
- tr###wash.net/forum/search.php?me#########################################
- fa###gold.net/forum/search.php?me#########################################
- ri###old.net/forum/search.php?me#########################################
- th####hcountry.net/forum/search.php?me#########################################
- li####appear.net/forum/search.php?me#########################################
- re####erpaint.net/forum/search.php?me#########################################
- ta###over.net/forum/search.php?me#########################################
- le###ome.net/forum/search.php?me#########################################
- ta###home.net/forum/search.php?me#########################################
- ne####arydress.net/forum/search.php?me#########################################
- mi####lossary.net/forum/search.php?me#########################################
- ta###fruit.net/forum/search.php?me#########################################
- st###march.net/forum/search.php?me#########################################
- gl###health.net/forum/search.php?me#########################################
- ge####friend.net/forum/search.php?me#########################################
- re####eneither.net/forum/search.php?me#########################################
- le###ver.net/forum/search.php?me#########################################
- ca###rain.net/forum/search.php?me#########################################
- po###grain.net/forum/search.php?me#########################################
- ca###ver.net/forum/search.php?me#########################################
- no###ome.net/forum/search.php?me#########################################
- ca###old.net/forum/search.php?me#########################################
- po###gold.net/forum/search.php?me#########################################
- po###over.net/forum/search.php?me#########################################
- ta###gold.net/forum/search.php?me#########################################
- le###rain.net/forum/search.php?me#########################################
- ta###grain.net/forum/search.php?me#########################################
- ca###ome.net/forum/search.php?me#########################################
- po###home.net/forum/search.php?me#########################################
- le###old.net/forum/search.php?me#########################################
- DNS ASK we###rain.net
- DNS ASK we###ver.net
- DNS ASK we###ome.net
- DNS ASK we###old.net
- DNS ASK ri###ver.net
- DNS ASK fa###home.net
- DNS ASK ri###ome.net
- DNS ASK li###ver.net
- DNS ASK no###ver.net
- DNS ASK li###ome.net
- DNS ASK no###rain.net
- DNS ASK li###old.net
- DNS ASK no###old.net
- DNS ASK li###rain.net
- DNS ASK tr###talk.net
- DNS ASK yo###elow.net
- DNS ASK tr###below.net
- DNS ASK yo###alk.net
- DNS ASK lr###wash.net
- DNS ASK yo###hirt.net
- DNS ASK tr###shirt.net
- DNS ASK fa###grain.net
- DNS ASK ri###rain.net
- DNS ASK fa###over.net
- DNS ASK ri###old.net
- DNS ASK yo###ash.net
- DNS ASK tr###wash.net
- DNS ASK fa###gold.net
- DNS ASK th####hcountry.net
- DNS ASK li####appear.net
- DNS ASK re####erpaint.net
- DNS ASK ta###over.net
- DNS ASK le###ome.net
- DNS ASK ta###home.net
- DNS ASK ne####arydress.net
- DNS ASK mi####lossary.net
- DNS ASK ta###fruit.net
- DNS ASK st###march.net
- DNS ASK gl###health.net
- DNS ASK ge####friend.net
- DNS ASK re####eneither.net
- DNS ASK le###ver.net
- DNS ASK ca###rain.net
- DNS ASK po###grain.net
- DNS ASK ca###ver.net
- DNS ASK no###ome.net
- DNS ASK ca###old.net
- DNS ASK po###gold.net
- DNS ASK po###over.net
- DNS ASK ta###gold.net
- DNS ASK le###rain.net
- DNS ASK ta###grain.net
- DNS ASK ca###ome.net
- DNS ASK po###home.net
- DNS ASK le###old.net
- '23#.#55.255.250':1900