Technical Information
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Studio Launcher Engine User-mode Video Quality' = '<SYSTEM32>\nfrxubhnsbv.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\Themes Transfer Plug Protected Level] 'Start' = '00000002'
- Windows Security Center
- '<SYSTEM32>\ttwivmpfyhu.exe' "<SYSTEM32>\nfrxubhnsbv.exe"
- '%WINDIR%\Temp\mjrzjobifq2pse.exe' -r 44515 tcp
- '%TEMP%\mjrzjofk7apsseldgvp3.exe'
- '<SYSTEM32>\nfrxubhnsbv.exe'
- <SYSTEM32>\cniegkzaevi\run
- <SYSTEM32>\cniegkzaevi\rng
- %WINDIR%\Temp\mjrzjobifq2pse.exe
- <SYSTEM32>\cniegkzaevi\cfg
- %TEMP%\mjrzjofk7apsseldgvp3.exe
- <SYSTEM32>\cniegkzaevi\tst
- <SYSTEM32>\ttwivmpfyhu.exe
- <SYSTEM32>\nfrxubhnsbv.exe
- <SYSTEM32>\ttwivmpfyhu.exe
- <SYSTEM32>\nfrxubhnsbv.exe
- %WINDIR%\Temp\mjrzjobifq2pse.exe
- %TEMP%\mjrzjofk7apsseldgvp3.exe
- 'li###arth.net':80
- 'th###allow.net':80
- 'th###earth.net':80
- 'th###taste.net':80
- 'li###aste.net':80
- 'li###llow.net':80
- 'we###aste.net':80
- 'fe###arth.net':80
- 'fe###aste.net':80
- 'th###gives.net':80
- 'li###ives.net':80
- 'so###taste.net':80
- 'fi###taste.net':80
- 'fa###guess.net':80
- 'fa###first.net':80
- 'ri###uess.net':80
- 'so###earth.net':80
- 'so###gives.net':80
- 'fi###gives.net':80
- 'fi###allow.net':80
- 'fi###earth.net':80
- 'so###allow.net':80
- 'ca###aste.net':80
- 'po###earth.net':80
- 'po###taste.net':80
- 'ta###gives.net':80
- 'le###ives.net':80
- 'ca###arth.net':80
- 'ca###ives.net':80
- 'no###aste.net':80
- 'po###gives.net':80
- 'po###allow.net':80
- 'ca###llow.net':80
- 'fe###ives.net':80
- 'we###ives.net':80
- 'we###llow.net':80
- 'we###arth.net':80
- 'fe###llow.net':80
- 'ta###taste.net':80
- 'ta###allow.net':80
- 'le###llow.net':80
- 'le###arth.net':80
- 'le###aste.net':80
- 'ta###earth.net':80
- 'le###ill.net':80
- 'ta###first.net':80
- 'ta###kill.net':80
- 'th###while.net':80
- 'le###tood.net':80
- 'le###irst.net':80
- 'ca###tood.net':80
- 'po###kill.net':80
- 'po###stood.net':80
- 'ta###guess.net':80
- 'le###uess.net':80
- 'se####strong.net':80
- 'si######edwerryhouse.net':80
- 'de####promise.net':80
- 'or###thrown.net':80
- 'jo####ymeasure.net':80
- 'mo####gduring.net':80
- 'ri###nstorm.net':80
- 'ef###tbuilt.net':80
- 'of####urprise.net':80
- 'ch####nother.net':80
- 'gw#####ynhuddleston.net':80
- 'we###ill.net':80
- 'we###irst.net':80
- 'we###tood.net':80
- 'no###uess.net':80
- 'li###uess.net':80
- 'we###uess.net':80
- 'fa###kill.net':80
- 'ri###irst.net':80
- 'ri###ill.net':80
- 'ri###tood.net':80
- 'fa###stood.net':80
- 'po###guess.net':80
- 'ca###uess.net':80
- 'ca###irst.net':80
- 'ca###ill.net':80
- 'po###first.net':80
- 'no###tood.net':80
- 'no###irst.net':80
- 'li###irst.net':80
- 'li###ill.net':80
- 'li###tood.net':80
- 'no###ill.net':80
- http://li###arth.net/index.php
- http://th###allow.net/index.php
- http://th###earth.net/index.php
- http://th###taste.net/index.php
- http://li###aste.net/index.php
- http://li###llow.net/index.php
- http://we###aste.net/index.php
- http://fe###arth.net/index.php
- http://fe###aste.net/index.php
- http://th###gives.net/index.php
- http://li###ives.net/index.php
- http://so###taste.net/index.php
- http://fi###taste.net/index.php
- http://fa###guess.net/index.php
- http://fa###first.net/index.php
- http://ri###uess.net/index.php
- http://so###earth.net/index.php
- http://so###gives.net/index.php
- http://fi###gives.net/index.php
- http://fi###allow.net/index.php
- http://fi###earth.net/index.php
- http://so###allow.net/index.php
- http://ca###aste.net/index.php
- http://po###earth.net/index.php
- http://po###taste.net/index.php
- http://ta###gives.net/index.php
- http://le###ives.net/index.php
- http://ca###arth.net/index.php
- http://ca###ives.net/index.php
- http://no###aste.net/index.php
- http://po###gives.net/index.php
- http://po###allow.net/index.php
- http://ca###llow.net/index.php
- http://fe###ives.net/index.php
- http://we###ives.net/index.php
- http://we###llow.net/index.php
- http://we###arth.net/index.php
- http://fe###llow.net/index.php
- http://ta###taste.net/index.php
- http://ta###allow.net/index.php
- http://le###llow.net/index.php
- http://le###arth.net/index.php
- http://le###aste.net/index.php
- http://ta###earth.net/index.php
- http://le###ill.net/index.php
- http://ta###first.net/index.php
- http://ta###kill.net/index.php
- http://th###while.net/index.php
- http://le###tood.net/index.php
- http://le###irst.net/index.php
- http://ca###tood.net/index.php
- http://po###kill.net/index.php
- http://po###stood.net/index.php
- http://ta###guess.net/index.php
- http://le###uess.net/index.php
- http://se####strong.net/index.php
- http://si######edwerryhouse.net/index.php
- http://de####promise.net/index.php
- http://or###thrown.net/index.php
- http://jo####ymeasure.net/index.php
- http://mo####gduring.net/index.php
- http://ri###nstorm.net/index.php
- http://ef###tbuilt.net/index.php
- http://of####urprise.net/index.php
- http://ch####nother.net/index.php
- http://gw#####ynhuddleston.net/index.php
- http://we###ill.net/index.php
- http://we###irst.net/index.php
- http://we###tood.net/index.php
- http://no###uess.net/index.php
- http://li###uess.net/index.php
- http://we###uess.net/index.php
- http://fa###kill.net/index.php
- http://ri###irst.net/index.php
- http://ri###ill.net/index.php
- http://ri###tood.net/index.php
- http://fa###stood.net/index.php
- http://po###guess.net/index.php
- http://ca###uess.net/index.php
- http://ca###irst.net/index.php
- http://ca###ill.net/index.php
- http://po###first.net/index.php
- http://no###tood.net/index.php
- http://no###irst.net/index.php
- http://li###irst.net/index.php
- http://li###ill.net/index.php
- http://li###tood.net/index.php
- http://no###ill.net/index.php
- DNS ASK li###arth.net
- DNS ASK th###allow.net
- DNS ASK th###earth.net
- DNS ASK th###taste.net
- DNS ASK li###aste.net
- DNS ASK li###llow.net
- DNS ASK we###aste.net
- DNS ASK fe###arth.net
- DNS ASK fe###aste.net
- DNS ASK th###gives.net
- DNS ASK li###ives.net
- DNS ASK so###taste.net
- DNS ASK fi###taste.net
- DNS ASK fa###guess.net
- DNS ASK fa###first.net
- DNS ASK ri###uess.net
- DNS ASK so###earth.net
- DNS ASK so###gives.net
- DNS ASK fi###gives.net
- DNS ASK fi###allow.net
- DNS ASK fi###earth.net
- DNS ASK so###allow.net
- DNS ASK ca###aste.net
- DNS ASK po###earth.net
- DNS ASK po###taste.net
- DNS ASK ta###gives.net
- DNS ASK le###ives.net
- DNS ASK ca###arth.net
- DNS ASK ca###ives.net
- DNS ASK no###aste.net
- DNS ASK po###gives.net
- DNS ASK po###allow.net
- DNS ASK ca###llow.net
- DNS ASK fe###ives.net
- DNS ASK we###ives.net
- DNS ASK we###llow.net
- DNS ASK we###arth.net
- DNS ASK fe###llow.net
- DNS ASK ta###taste.net
- DNS ASK ta###allow.net
- DNS ASK le###llow.net
- DNS ASK le###arth.net
- DNS ASK le###aste.net
- DNS ASK ta###earth.net
- DNS ASK ri###irst.net
- DNS ASK le###ill.net
- DNS ASK ta###first.net
- DNS ASK ta###kill.net
- DNS ASK th###while.net
- DNS ASK le###tood.net
- DNS ASK po###stood.net
- DNS ASK ca###tood.net
- DNS ASK le###uess.net
- DNS ASK le###irst.net
- DNS ASK ta###guess.net
- DNS ASK ef###tbuilt.net
- DNS ASK se####strong.net
- DNS ASK si######edwerryhouse.net
- DNS ASK de####promise.net
- DNS ASK or###thrown.net
- DNS ASK jo####ymeasure.net
- DNS ASK of####urprise.net
- DNS ASK ri###nstorm.net
- DNS ASK gw#####ynhuddleston.net
- DNS ASK mo####gduring.net
- DNS ASK ch####nother.net
- DNS ASK po###kill.net
- DNS ASK we###ill.net
- DNS ASK we###irst.net
- DNS ASK we###tood.net
- DNS ASK no###uess.net
- DNS ASK li###uess.net
- DNS ASK ri###ill.net
- DNS ASK fa###kill.net
- DNS ASK fa###stood.net
- DNS ASK we###uess.net
- DNS ASK ri###tood.net
- DNS ASK li###irst.net
- DNS ASK po###guess.net
- DNS ASK ca###uess.net
- DNS ASK ca###irst.net
- DNS ASK ca###ill.net
- DNS ASK po###first.net
- DNS ASK li###ill.net
- DNS ASK no###irst.net
- DNS ASK no###ill.net
- DNS ASK no###tood.net
- DNS ASK li###tood.net
- '23#.#55.255.250':1900