Technical Information
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Information Parental Program Key' = '<SYSTEM32>\dtknemyoexjs.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\WLAN Services VC Logon Studio Isolation] 'Start' = '00000002'
- Windows Security Center
- '<SYSTEM32>\wgvkmet.exe' "<SYSTEM32>\dtknemyoexjs.exe"
- '%WINDIR%\Temp\xnhaaf27gxr0qgpq.exe' -r 48862 tcp
- '%TEMP%\xnhaaf9tpn30qgpqhyhurb.exe'
- '<SYSTEM32>\dtknemyoexjs.exe'
- <SYSTEM32>\kdmhhuxeibbpwm\run
- <SYSTEM32>\kdmhhuxeibbpwm\rng
- %WINDIR%\Temp\xnhaaf27gxr0qgpq.exe
- <SYSTEM32>\kdmhhuxeibbpwm\cfg
- %TEMP%\xnhaaf9tpn30qgpqhyhurb.exe
- <SYSTEM32>\kdmhhuxeibbpwm\tst
- <SYSTEM32>\wgvkmet.exe
- <SYSTEM32>\dtknemyoexjs.exe
- <SYSTEM32>\wgvkmet.exe
- <SYSTEM32>\dtknemyoexjs.exe
- %WINDIR%\Temp\xnhaaf27gxr0qgpq.exe
- %TEMP%\xnhaaf9tpn30qgpqhyhurb.exe
- 'we###elow.net':80
- 've###elow.net':80
- 'we###ash.net':80
- 've###ash.net':80
- 'we###alk.net':80
- 've###hirt.net':80
- 'pi###wash.net':80
- 've###alk.net':80
- 'we###hirt.net':80
- 'fa###ash.net':80
- 'to###elow.net':80
- 'le###shirt.net':80
- 'to###ash.net':80
- 'fa###elow.net':80
- 'to###hirt.net':80
- 'fa###hirt.net':80
- 'to###alk.net':80
- 'fa###alk.net':80
- 'mu###ash.net':80
- 'ta###alk.net':80
- 'wa###hirt.net':80
- 'ta###elow.net':80
- 'wa###alk.net':80
- 'ta###hirt.net':80
- 'tr###cause.net':80
- 'yo###ause.net':80
- 'tr###sure.net':80
- 'yo###ure.net':80
- 'pi###talk.net':80
- 'mu###alk.net':80
- 'pi###below.net':80
- 'mu###elow.net':80
- 'pi###shirt.net':80
- 'ta###ash.net':80
- 'wa###elow.net':80
- 'mu###hirt.net':80
- 'wa###ash.net':80
- 'se###shirt.net':80
- 'th###while.net':80
- 'yo###alk.net':80
- 'ri###nstorm.net':80
- 'ef###tbuilt.net':80
- 'tr###shirt.net':80
- 'vi###ash.net':80
- 'lr###below.net':80
- 'yo###hirt.net':80
- 'lr###wash.net':80
- 'de####promise.net':80
- 'se####strong.net':80
- 'or###thrown.net':80
- 'jo####ymeasure.net':80
- 'si######edwerryhouse.net':80
- 'gw#####ynhuddleston.net':80
- 'of####urprise.net':80
- 'mo####gduring.net':80
- 'ch####nother.net':80
- 'vi###elow.net':80
- 'fi###hirt.net':80
- 'se###wash.net':80
- 'fi###alk.net':80
- 'pl###shirt.net':80
- 'le###wash.net':80
- 'se###talk.net':80
- 'le###talk.net':80
- 'se###below.net':80
- 'le###below.net':80
- 'lr###shirt.net':80
- 'vi###hirt.net':80
- 'lr###talk.net':80
- 'vi###alk.net':80
- 'pl###wash.net':80
- 'fi###elow.net':80
- 'pl###talk.net':80
- 'fi###ash.net':80
- 'pl###below.net':80
- http://we###elow.net/index.php
- http://ve###elow.net/index.php
- http://we###ash.net/index.php
- http://ve###ash.net/index.php
- http://we###alk.net/index.php
- http://ve###hirt.net/index.php
- http://pi###wash.net/index.php
- http://ve###alk.net/index.php
- http://we###hirt.net/index.php
- http://fa###ash.net/index.php
- http://to###elow.net/index.php
- http://le###shirt.net/index.php
- http://to###ash.net/index.php
- http://fa###elow.net/index.php
- http://to###hirt.net/index.php
- http://fa###hirt.net/index.php
- http://to###alk.net/index.php
- http://fa###alk.net/index.php
- http://mu###ash.net/index.php
- http://ta###alk.net/index.php
- http://wa###hirt.net/index.php
- http://ta###elow.net/index.php
- http://wa###alk.net/index.php
- http://ta###hirt.net/index.php
- http://tr###cause.net/index.php
- http://yo###ause.net/index.php
- http://tr###sure.net/index.php
- http://yo###ure.net/index.php
- http://pi###talk.net/index.php
- http://mu###alk.net/index.php
- http://pi###below.net/index.php
- http://mu###elow.net/index.php
- http://pi###shirt.net/index.php
- http://ta###ash.net/index.php
- http://wa###elow.net/index.php
- http://mu###hirt.net/index.php
- http://wa###ash.net/index.php
- http://se###shirt.net/index.php
- http://th###while.net/index.php
- http://yo###alk.net/index.php
- http://ri###nstorm.net/index.php
- http://ef###tbuilt.net/index.php
- http://tr###shirt.net/index.php
- http://vi###ash.net/index.php
- http://lr###below.net/index.php
- http://yo###hirt.net/index.php
- http://lr###wash.net/index.php
- http://de####promise.net/index.php
- http://se####strong.net/index.php
- http://or###thrown.net/index.php
- http://jo####ymeasure.net/index.php
- http://si######edwerryhouse.net/index.php
- http://gw#####ynhuddleston.net/index.php
- http://of####urprise.net/index.php
- http://mo####gduring.net/index.php
- http://ch####nother.net/index.php
- http://vi###elow.net/index.php
- http://fi###hirt.net/index.php
- http://se###wash.net/index.php
- http://fi###alk.net/index.php
- http://pl###shirt.net/index.php
- http://le###wash.net/index.php
- http://se###talk.net/index.php
- http://le###talk.net/index.php
- http://se###below.net/index.php
- http://le###below.net/index.php
- http://lr###shirt.net/index.php
- http://vi###hirt.net/index.php
- http://lr###talk.net/index.php
- http://vi###alk.net/index.php
- http://pl###wash.net/index.php
- http://fi###elow.net/index.php
- http://pl###talk.net/index.php
- http://fi###ash.net/index.php
- http://pl###below.net/index.php
- DNS ASK ve###elow.net
- DNS ASK we###alk.net
- DNS ASK ve###ash.net
- DNS ASK we###elow.net
- DNS ASK ve###alk.net
- DNS ASK pi###wash.net
- DNS ASK mu###ash.net
- DNS ASK we###hirt.net
- DNS ASK ve###hirt.net
- DNS ASK we###ash.net
- DNS ASK fa###ash.net
- DNS ASK to###elow.net
- DNS ASK le###shirt.net
- DNS ASK to###ash.net
- DNS ASK fa###elow.net
- DNS ASK to###hirt.net
- DNS ASK fa###hirt.net
- DNS ASK to###alk.net
- DNS ASK fa###alk.net
- DNS ASK wa###hirt.net
- DNS ASK ta###hirt.net
- DNS ASK wa###alk.net
- DNS ASK ta###alk.net
- DNS ASK tr###sure.net
- DNS ASK yo###ause.net
- DNS ASK tr###shot.net
- DNS ASK yo###ure.net
- DNS ASK tr###cause.net
- DNS ASK ta###elow.net
- DNS ASK pi###talk.net
- DNS ASK mu###alk.net
- DNS ASK pi###below.net
- DNS ASK mu###elow.net
- DNS ASK pi###shirt.net
- DNS ASK ta###ash.net
- DNS ASK wa###elow.net
- DNS ASK mu###hirt.net
- DNS ASK wa###ash.net
- DNS ASK se###shirt.net
- DNS ASK th###while.net
- DNS ASK yo###alk.net
- DNS ASK ri###nstorm.net
- DNS ASK ef###tbuilt.net
- DNS ASK tr###shirt.net
- DNS ASK vi###ash.net
- DNS ASK lr###below.net
- DNS ASK yo###hirt.net
- DNS ASK lr###wash.net
- DNS ASK de####promise.net
- DNS ASK se####strong.net
- DNS ASK or###thrown.net
- DNS ASK jo####ymeasure.net
- DNS ASK si######edwerryhouse.net
- DNS ASK gw#####ynhuddleston.net
- DNS ASK of####urprise.net
- DNS ASK mo####gduring.net
- DNS ASK ch####nother.net
- DNS ASK vi###elow.net
- DNS ASK fi###hirt.net
- DNS ASK se###wash.net
- DNS ASK fi###alk.net
- DNS ASK pl###shirt.net
- DNS ASK le###wash.net
- DNS ASK se###talk.net
- DNS ASK le###talk.net
- DNS ASK se###below.net
- DNS ASK le###below.net
- DNS ASK lr###shirt.net
- DNS ASK vi###hirt.net
- DNS ASK lr###talk.net
- DNS ASK vi###alk.net
- DNS ASK pl###wash.net
- DNS ASK fi###elow.net
- DNS ASK pl###talk.net
- DNS ASK fi###ash.net
- DNS ASK pl###below.net
- '23#.#55.255.250':1900