Technical Information
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Ordering Source Registry Store' = '<SYSTEM32>\urnxcarlgut.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\PNRP Enumerator Publication Layer] 'ImagePath' = '<SYSTEM32>\urnxcarlgut.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\PNRP Enumerator Publication Layer] 'Start' = '00000002'
- Windows Security Center
- '<SYSTEM32>\dxzyhekfank.exe' "<SYSTEM32>\urnxcarlgut.exe"
- '%WINDIR%\Temp\pass1l2vgtxjdz.exe' -r 31066 tcp
- '%TEMP%\pass1l2r45xjdznqptky.exe'
- '<SYSTEM32>\urnxcarlgut.exe'
- <SYSTEM32>\usuduoxx\run
- <SYSTEM32>\usuduoxx\rng
- %WINDIR%\Temp\pass1l2vgtxjdz.exe
- <SYSTEM32>\usuduoxx\cfg
- <SYSTEM32>\dxzyhekfank.exe
- %TEMP%\pass1l2r45xjdznqptky.exe
- <SYSTEM32>\usuduoxx\tst
- <SYSTEM32>\urnxcarlgut.exe
- <SYSTEM32>\usuduoxx\etc
- <SYSTEM32>\dxzyhekfank.exe
- <SYSTEM32>\urnxcarlgut.exe
- %WINDIR%\Temp\pass1l2vgtxjdz.exe
- <DRIVERS>\etc\hosts
- %TEMP%\pass1l2r45xjdznqptky.exe
- 'ga###aise.net':80
- 'bo###each.net':80
- 'bo###aise.net':80
- 'bo###roud.net':80
- 'ga###roud.net':80
- 'le###croud.net':80
- 'fa###roud.net':80
- 'fa###rice.net':80
- 'ga###each.net':80
- 'le###price.net':80
- 'ga###rice.net':80
- 'fi###croud.net':80
- 'qu###croud.net':80
- 'qu###price.net':80
- 'na###orn.net':80
- 'fi###price.net':80
- 'qu###reach.net':80
- 'bo###rice.net':80
- 'fi###reach.net':80
- 'fi###raise.net':80
- 'qu###raise.net':80
- 'st###croud.net':80
- 'we###roud.net':80
- 'we###rice.net':80
- 'wa###each.net':80
- 'st###price.net':80
- 'we###each.net':80
- 'af###price.net':80
- 'st###reach.net':80
- 'st###raise.net':80
- 'we###aise.net':80
- 'mo###reach.net':80
- 'fa###each.net':80
- 'mo###price.net':80
- 'le###reach.net':80
- 'le###raise.net':80
- 'fa###aise.net':80
- 'mo###raise.net':80
- 'wa###aise.net':80
- 'wa###roud.net':80
- 'wa###rice.net':80
- 'mo###croud.net':80
- 'we###aid.net':80
- 'st###august.net':80
- 'st###paid.net':80
- 'st###cloth.net':80
- 'we###loth.net':80
- 'af###cloth.net':80
- 'fo###cloth.net':80
- 'we###orn.net':80
- 'we###ugust.net':80
- 'st###born.net':80
- 'be##lxc.com':80
- 'mi###hown.net':80
- 'ab###ell.net':80
- 'mo###ugust.net':80
- 'cr#####onaraminta.net':80
- 'le###form.net':80
- 'al###being.net':80
- 'ri###nstorm.net':80
- 'ca####nbring.net':80
- 'mo###olor.net':80
- 'pr####tbottom.net':80
- 'dr###cloth.net':80
- 'na###loth.net':80
- 'we####dayborn.net':80
- 'we####dayaugust.net':80
- 'se###orn.net':80
- 'na###ugust.net':80
- 'dr###born.net':80
- 'dr###august.net':80
- 'dr###paid.net':80
- 'na###aid.net':80
- 'se###ugust.net':80
- 'fo###august.net':80
- 'af###born.net':80
- 'af###august.net':80
- 'af###paid.net':80
- 'fo###paid.net':80
- 'se###aid.net':80
- 'we####daypaid.net':80
- 'we####daycloth.net':80
- 'fo###born.net':80
- 'se###loth.net':80
- http://ga###aise.net/index.php
- http://bo###each.net/index.php
- http://bo###aise.net/index.php
- http://bo###roud.net/index.php
- http://ga###roud.net/index.php
- http://le###croud.net/index.php
- http://fa###roud.net/index.php
- http://fa###rice.net/index.php
- http://ga###each.net/index.php
- http://le###price.net/index.php
- http://ga###rice.net/index.php
- http://fi###croud.net/index.php
- http://qu###croud.net/index.php
- http://qu###price.net/index.php
- http://na###orn.net/index.php
- http://fi###price.net/index.php
- http://qu###reach.net/index.php
- http://bo###rice.net/index.php
- http://fi###reach.net/index.php
- http://fi###raise.net/index.php
- http://qu###raise.net/index.php
- http://st###croud.net/index.php
- http://we###roud.net/index.php
- http://we###rice.net/index.php
- http://wa###each.net/index.php
- http://st###price.net/index.php
- http://we###each.net/index.php
- http://af###price.net/index.php
- http://st###reach.net/index.php
- http://st###raise.net/index.php
- http://we###aise.net/index.php
- http://mo###reach.net/index.php
- http://fa###each.net/index.php
- http://mo###price.net/index.php
- http://le###reach.net/index.php
- http://le###raise.net/index.php
- http://fa###aise.net/index.php
- http://mo###raise.net/index.php
- http://wa###aise.net/index.php
- http://wa###roud.net/index.php
- http://wa###rice.net/index.php
- http://mo###croud.net/index.php
- http://we###aid.net/index.php
- http://st###august.net/index.php
- http://st###paid.net/index.php
- http://st###cloth.net/index.php
- http://we###loth.net/index.php
- http://af###cloth.net/index.php
- http://fo###cloth.net/index.php
- http://we###orn.net/index.php
- http://we###ugust.net/index.php
- http://st###born.net/index.php
- http://be##lxc.com/index.php
- http://mi###hown.net/index.php
- http://ab###ell.net/index.php
- http://mo###ugust.net/index.php
- http://cr#####onaraminta.net/index.php
- http://le###form.net/index.php
- http://al###being.net/index.php
- http://ri###nstorm.net/index.php
- http://ca####nbring.net/index.php
- http://mo###olor.net/index.php
- http://pr####tbottom.net/index.php
- http://dr###cloth.net/index.php
- http://na###loth.net/index.php
- http://we####dayborn.net/index.php
- http://we####dayaugust.net/index.php
- http://se###orn.net/index.php
- http://na###ugust.net/index.php
- http://dr###born.net/index.php
- http://dr###august.net/index.php
- http://dr###paid.net/index.php
- http://na###aid.net/index.php
- http://se###ugust.net/index.php
- http://fo###august.net/index.php
- http://af###born.net/index.php
- http://af###august.net/index.php
- http://af###paid.net/index.php
- http://fo###paid.net/index.php
- http://se###aid.net/index.php
- http://we####daypaid.net/index.php
- http://we####daycloth.net/index.php
- http://fo###born.net/index.php
- http://se###loth.net/index.php
- DNS ASK ga###aise.net
- DNS ASK bo###each.net
- DNS ASK bo###aise.net
- DNS ASK bo###roud.net
- DNS ASK ga###roud.net
- DNS ASK le###croud.net
- DNS ASK fa###roud.net
- DNS ASK fa###rice.net
- DNS ASK ga###each.net
- DNS ASK le###price.net
- DNS ASK ga###rice.net
- DNS ASK fi###croud.net
- DNS ASK qu###croud.net
- DNS ASK qu###price.net
- DNS ASK na###orn.net
- DNS ASK fi###price.net
- DNS ASK qu###reach.net
- DNS ASK bo###rice.net
- DNS ASK fi###reach.net
- DNS ASK fi###raise.net
- DNS ASK qu###raise.net
- DNS ASK st###croud.net
- DNS ASK we###roud.net
- DNS ASK we###rice.net
- DNS ASK wa###each.net
- DNS ASK st###price.net
- DNS ASK we###each.net
- DNS ASK af###price.net
- DNS ASK st###reach.net
- DNS ASK st###raise.net
- DNS ASK we###aise.net
- DNS ASK mo###reach.net
- DNS ASK fa###each.net
- DNS ASK mo###price.net
- DNS ASK le###reach.net
- DNS ASK le###raise.net
- DNS ASK fa###aise.net
- DNS ASK mo###raise.net
- DNS ASK wa###aise.net
- DNS ASK wa###roud.net
- DNS ASK wa###rice.net
- DNS ASK mo###croud.net
- DNS ASK dr###born.net
- DNS ASK st###paid.net
- DNS ASK we###aid.net
- DNS ASK we###loth.net
- DNS ASK be##lxc.com
- DNS ASK st###cloth.net
- DNS ASK we###orn.net
- DNS ASK af###cloth.net
- DNS ASK st###born.net
- DNS ASK st###august.net
- DNS ASK we###ugust.net
- DNS ASK mi###hown.net
- DNS ASK ab###ell.net
- DNS ASK mo###ugust.net
- DNS ASK cr#####onaraminta.net
- DNS ASK le###form.net
- DNS ASK al###being.net
- DNS ASK ri###nstorm.net
- DNS ASK ca####nbring.net
- DNS ASK mo###olor.net
- DNS ASK pr####tbottom.net
- DNS ASK fo###cloth.net
- DNS ASK we####dayborn.net
- DNS ASK dr###cloth.net
- DNS ASK se###orn.net
- DNS ASK se###ugust.net
- DNS ASK we####dayaugust.net
- DNS ASK dr###august.net
- DNS ASK na###ugust.net
- DNS ASK na###aid.net
- DNS ASK na###loth.net
- DNS ASK dr###paid.net
- DNS ASK fo###august.net
- DNS ASK af###born.net
- DNS ASK af###august.net
- DNS ASK af###paid.net
- DNS ASK fo###paid.net
- DNS ASK se###aid.net
- DNS ASK we####daypaid.net
- DNS ASK we####daycloth.net
- DNS ASK fo###born.net
- DNS ASK se###loth.net
- '23#.#55.255.250':1900