Technical Information
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Filtering Trap Engine Socket Profile' = '<SYSTEM32>\jlmdvthlnfs.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\Software Receiver Extender Call Initiator] 'ImagePath' = '<SYSTEM32>\jlmdvthlnfs.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\Software Receiver Extender Call Initiator] 'Start' = '00000002'
- Windows Security Center
- '<SYSTEM32>\awniedk.exe' "<SYSTEM32>\jlmdvthlnfs.exe"
- '%WINDIR%\Temp\fbfjgnpl30s8da.exe' -r 32792 tcp
- '%TEMP%\fbfjgnpl2rdodazgyqxt.exe'
- '<SYSTEM32>\jlmdvthlnfs.exe'
- <SYSTEM32>\omtpmmchhfvm\run
- <SYSTEM32>\omtpmmchhfvm\rng
- %WINDIR%\Temp\fbfjgnpl30s8da.exe
- <SYSTEM32>\omtpmmchhfvm\cfg
- <SYSTEM32>\awniedk.exe
- %TEMP%\fbfjgnpl2rdodazgyqxt.exe
- <SYSTEM32>\omtpmmchhfvm\tst
- <SYSTEM32>\jlmdvthlnfs.exe
- <SYSTEM32>\omtpmmchhfvm\etc
- <SYSTEM32>\awniedk.exe
- <SYSTEM32>\jlmdvthlnfs.exe
- %WINDIR%\Temp\fbfjgnpl30s8da.exe
- <DRIVERS>\etc\hosts
- %TEMP%\fbfjgnpl2rdodazgyqxt.exe
- 'se####bereach.net':80
- 'se#####eryesterday.net':80
- 'se####berfeet.net':80
- 'fr###wedge.net':80
- 'of###wedge.net':80
- 'jo###ach.net':80
- 'wi###ach.net':80
- 'wi###eet.net':80
- 'se####berwedge.net':80
- 'jo###eet.net':80
- 'of####esterday.net':80
- 'we###edge.net':80
- 'sp###wedge.net':80
- 'sp####esterday.net':80
- 'sp###each.net':80
- 'we####sterday.net':80
- 'of###each.net':80
- 'fr####esterday.net':80
- 'fr###each.net':80
- 'fr###feet.net':80
- 'of###feet.net':80
- 'wr###each.net':80
- 'ma###ach.net':80
- 'ma###eet.net':80
- 'ro###edge.net':80
- 'wr###feet.net':80
- 'ma###edge.net':80
- 'hu###gray.net':80
- 'wr###wedge.net':80
- 'wr####esterday.net':80
- 'ma####sterday.net':80
- 'de###edge.net':80
- 'wi###edge.net':80
- 'de###eet.net':80
- 'jo###edge.net':80
- 'jo####sterday.net':80
- 'wi####sterday.net':80
- 'de####sterday.net':80
- 'ro####sterday.net':80
- 'ro###ach.net':80
- 'ro###eet.net':80
- 'de###ach.net':80
- 'we###ach.net':80
- 'de###new.net':80
- 'ro###new.net':80
- 'ro###one.net':80
- 'ro###hine.net':80
- 'de###one.net':80
- 'ma###hine.net':80
- 'wr###done.net':80
- 'wr###shine.net':80
- 'wr###fifth.net':80
- 'ma###ifth.net':80
- 'de###hine.net':80
- 'de###lxc.com':80
- 'jo###one.net':80
- 'be##lxc.com':80
- 'ri###nstorm.net':80
- 'af###sllc.com':80
- 'de###ifth.net':80
- 'ro###ifth.net':80
- 'wi###new.net':80
- 'wi###one.net':80
- 'jo###new.net':80
- 'mu###each.net':80
- 'ya####sterday.net':80
- 'ya###ach.net':80
- 'ya###eet.net':80
- 'mu###feet.net':80
- 'we###eet.net':80
- 'sp###feet.net':80
- 'mu###wedge.net':80
- 'mu####esterday.net':80
- 'ya###edge.net':80
- 'ha###edge.net':80
- 'hu###feet.net':80
- 'ha###eet.net':80
- 'ma###new.net':80
- 'ma###one.net':80
- 'wr###knew.net':80
- 'ha####sterday.net':80
- 'hu###wedge.net':80
- 'hu####esterday.net':80
- 'hu###each.net':80
- 'ha###ach.net':80
- http://se####bereach.net/index.php
- http://se#####eryesterday.net/index.php
- http://se####berfeet.net/index.php
- http://fr###wedge.net/index.php
- http://of###wedge.net/index.php
- http://jo###ach.net/index.php
- http://wi###ach.net/index.php
- http://wi###eet.net/index.php
- http://se####berwedge.net/index.php
- http://jo###eet.net/index.php
- http://of####esterday.net/index.php
- http://we###edge.net/index.php
- http://sp###wedge.net/index.php
- http://sp####esterday.net/index.php
- http://sp###each.net/index.php
- http://we####sterday.net/index.php
- http://of###each.net/index.php
- http://fr####esterday.net/index.php
- http://fr###each.net/index.php
- http://fr###feet.net/index.php
- http://of###feet.net/index.php
- http://wr###each.net/index.php
- http://ma###ach.net/index.php
- http://ma###eet.net/index.php
- http://ro###edge.net/index.php
- http://wr###feet.net/index.php
- http://ma###edge.net/index.php
- http://hu###gray.net/index.php
- http://wr###wedge.net/index.php
- http://wr####esterday.net/index.php
- http://ma####sterday.net/index.php
- http://de###edge.net/index.php
- http://wi###edge.net/index.php
- http://de###eet.net/index.php
- http://jo###edge.net/index.php
- http://jo####sterday.net/index.php
- http://wi####sterday.net/index.php
- http://de####sterday.net/index.php
- http://ro####sterday.net/index.php
- http://ro###ach.net/index.php
- http://ro###eet.net/index.php
- http://de###ach.net/index.php
- http://we###ach.net/index.php
- http://de###new.net/index.php
- http://ro###new.net/index.php
- http://ro###one.net/index.php
- http://ro###hine.net/index.php
- http://de###one.net/index.php
- http://ma###hine.net/index.php
- http://wr###done.net/index.php
- http://wr###shine.net/index.php
- http://wr###fifth.net/index.php
- http://ma###ifth.net/index.php
- http://de###hine.net/index.php
- http://de###lxc.com/index.php
- http://jo###one.net/index.php
- http://be##lxc.com/index.php
- http://ri###nstorm.net/index.php
- http://af###sllc.com/index.php
- http://de###ifth.net/index.php
- http://ro###ifth.net/index.php
- http://wi###new.net/index.php
- http://wi###one.net/index.php
- http://jo###new.net/index.php
- http://mu###each.net/index.php
- http://ya####sterday.net/index.php
- http://ya###ach.net/index.php
- http://ya###eet.net/index.php
- http://mu###feet.net/index.php
- http://we###eet.net/index.php
- http://sp###feet.net/index.php
- http://mu###wedge.net/index.php
- http://mu####esterday.net/index.php
- http://ya###edge.net/index.php
- http://ha###edge.net/index.php
- http://hu###feet.net/index.php
- http://ha###eet.net/index.php
- http://ma###new.net/index.php
- http://ma###one.net/index.php
- http://wr###knew.net/index.php
- http://ha####sterday.net/index.php
- http://hu###wedge.net/index.php
- http://hu####esterday.net/index.php
- http://hu###each.net/index.php
- http://ha###ach.net/index.php
- DNS ASK se####berfeet.net
- DNS ASK se####bereach.net
- DNS ASK of###wedge.net
- DNS ASK of####esterday.net
- DNS ASK fr###wedge.net
- DNS ASK wi###eet.net
- DNS ASK jo###ach.net
- DNS ASK jo###eet.net
- DNS ASK se#####eryesterday.net
- DNS ASK se####berwedge.net
- DNS ASK fr####esterday.net
- DNS ASK sp####esterday.net
- DNS ASK we###edge.net
- DNS ASK we####sterday.net
- DNS ASK we###ach.net
- DNS ASK sp###each.net
- DNS ASK fr###each.net
- DNS ASK of###each.net
- DNS ASK of###feet.net
- DNS ASK sp###wedge.net
- DNS ASK fr###feet.net
- DNS ASK wi###ach.net
- DNS ASK wr###each.net
- DNS ASK ma###ach.net
- DNS ASK ma###eet.net
- DNS ASK ro###edge.net
- DNS ASK wr###feet.net
- DNS ASK ma###edge.net
- DNS ASK hu###gray.net
- DNS ASK wr###wedge.net
- DNS ASK wr####esterday.net
- DNS ASK ma####sterday.net
- DNS ASK de###edge.net
- DNS ASK wi###edge.net
- DNS ASK de###eet.net
- DNS ASK jo###edge.net
- DNS ASK jo####sterday.net
- DNS ASK wi####sterday.net
- DNS ASK de####sterday.net
- DNS ASK ro####sterday.net
- DNS ASK ro###ach.net
- DNS ASK ro###eet.net
- DNS ASK de###ach.net
- DNS ASK de###new.net
- DNS ASK ro###new.net
- DNS ASK ro###one.net
- DNS ASK ro###hine.net
- DNS ASK de###one.net
- DNS ASK ma###hine.net
- DNS ASK wr###done.net
- DNS ASK wr###shine.net
- DNS ASK wr###fifth.net
- DNS ASK ma###ifth.net
- DNS ASK de###hine.net
- DNS ASK de###lxc.com
- DNS ASK jo###one.net
- DNS ASK be##lxc.com
- DNS ASK ri###nstorm.net
- DNS ASK af###sllc.com
- DNS ASK de###ifth.net
- DNS ASK ro###ifth.net
- DNS ASK wi###new.net
- DNS ASK wi###one.net
- DNS ASK jo###new.net
- DNS ASK mu###each.net
- DNS ASK ya####sterday.net
- DNS ASK ya###ach.net
- DNS ASK ya###eet.net
- DNS ASK mu###feet.net
- DNS ASK we###eet.net
- DNS ASK sp###feet.net
- DNS ASK mu###wedge.net
- DNS ASK mu####esterday.net
- DNS ASK ya###edge.net
- DNS ASK ha###edge.net
- DNS ASK hu###feet.net
- DNS ASK ha###eet.net
- DNS ASK ma###new.net
- DNS ASK ma###one.net
- DNS ASK wr###knew.net
- DNS ASK ha####sterday.net
- DNS ASK hu###wedge.net
- DNS ASK hu####esterday.net
- DNS ASK hu###each.net
- DNS ASK ha###ach.net
- '23#.#55.255.250':1900