Technical Information
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Search Extensible Configuration Block' = 'C:\iajuufohd\xtcjbriimeew.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\Socket Scheduler Server Host] 'ImagePath' = 'C:\iajuufohd\xtcjbriimeew.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\Socket Scheduler Server Host] 'Start' = '00000002'
- 'C:\iajuufohd\udimfrjxo.exe' "c:\iajuufohd\xtcjbriimeew.exe"
- 'C:\iajuufohd\xtcjbriimeew.exe'
- 'C:\iajuufohd\lpimf3cqsx8cu1nmlectn.exe'
- C:\iajuufohd\xtcjbriimeew.exe
- C:\iajuufohd\udimfrjxo.exe
- C:\iajuufohd\lpimf3cqsx8cu1nmlectn.exe
- %WINDIR%\iajuufohd\i4hsn3pf8jtd
- C:\iajuufohd\i4hsn3pf8jtd
- C:\iajuufohd\udimfrjxo.exe
- C:\iajuufohd\xtcjbriimeew.exe
- C:\iajuufohd\lpimf3cqsx8cu1nmlectn.exe
- %WINDIR%\iajuufohd\i4hsn3pf8jtd
- 'wa###corner.net':80
- 'wo###flower.net':80
- 'wa####pecial.net':80
- 'th####tcorner.net':80
- 'sm###flower.net':80
- 'wo####pecial.net':80
- 'sm####pecial.net':80
- 'wo###minute.net':80
- 'sm###minute.net':80
- 'su####corner.net':80
- 'cr###corner.net':80
- 'su####special.net':80
- 'cr####pecial.net':80
- 'th####tflower.net':80
- 'wa###minute.net':80
- 'th####tspecial.net':80
- 'wa###flower.net':80
- 'th####tminute.net':80
- 'wo###corner.net':80
- 'fr####tranger.net':80
- 'ex#####ncestranger.net':80
- 'fr####dvance.net':80
- 'ex#####nceadvance.net':80
- 'fr####oodbye.net':80
- 'ex#####ncefortieth.net':80
- 'ge#####anadvance.net':80
- 'ex#####ncegoodbye.net':80
- 'fr####ortieth.net':80
- 'fi###flower.net':80
- 'pa###minute.net':80
- 'sm###corner.net':80
- 'pa###flower.net':80
- 'fi###minute.net':80
- 'pa###corner.net':80
- 'fi###corner.net':80
- 'pa####pecial.net':80
- 'fi####pecial.net':80
- 'cr###minute.net':80
- 'al####yflower.net':80
- 'ge####manminute.net':80
- 'ex#####ncecorner.net':80
- 'ge####manflower.net':80
- 'al####yminute.net':80
- 'ge####mancorner.net':80
- 'al####ycorner.net':80
- 'ge#####anspecial.net':80
- 'al####yspecial.net':80
- 'fr###flower.net':80
- 'ex#####nceflower.net':80
- 'pa###bottom.net':80
- 'fi###bottom.net':80
- 'fr###minute.net':80
- 'ex#####ncespecial.net':80
- 'fr###corner.net':80
- 'ex#####nceminute.net':80
- 'fr####pecial.net':80
- 'fo####flower.net':80
- 'be####pecial.net':80
- 'kn####pecial.net':80
- 'be###minute.net':80
- 'kn###minute.net':80
- 'be###corner.net':80
- 'cr###flower.net':80
- 'su####minute.net':80
- 'kn###corner.net':80
- 'su####flower.net':80
- 'me####minute.net':80
- 'fo####special.net':80
- 'me####flower.net':80
- 'fo####minute.net':80
- 'me####special.net':80
- 'be###flower.net':80
- 'kn###flower.net':80
- 'fo####corner.net':80
- 'me####corner.net':80
- http://wa###corner.net/index.php
- http://wo###flower.net/index.php
- http://wa####pecial.net/index.php
- http://th####tcorner.net/index.php
- http://sm###flower.net/index.php
- http://wo####pecial.net/index.php
- http://sm####pecial.net/index.php
- http://wo###minute.net/index.php
- http://sm###minute.net/index.php
- http://su####corner.net/index.php
- http://cr###corner.net/index.php
- http://su####special.net/index.php
- http://cr####pecial.net/index.php
- http://th####tflower.net/index.php
- http://wa###minute.net/index.php
- http://th####tspecial.net/index.php
- http://wa###flower.net/index.php
- http://th####tminute.net/index.php
- http://wo###corner.net/index.php
- http://fr####tranger.net/index.php
- http://ex#####ncestranger.net/index.php
- http://fr####dvance.net/index.php
- http://ex#####nceadvance.net/index.php
- http://fr####oodbye.net/index.php
- http://ex#####ncefortieth.net/index.php
- http://ge#####anadvance.net/index.php
- http://ex#####ncegoodbye.net/index.php
- http://fr####ortieth.net/index.php
- http://fi###flower.net/index.php
- http://pa###minute.net/index.php
- http://sm###corner.net/index.php
- http://pa###flower.net/index.php
- http://fi###minute.net/index.php
- http://pa###corner.net/index.php
- http://fi###corner.net/index.php
- http://pa####pecial.net/index.php
- http://fi####pecial.net/index.php
- http://cr###minute.net/index.php
- http://al####yflower.net/index.php
- http://ge####manminute.net/index.php
- http://ex#####ncecorner.net/index.php
- http://ge####manflower.net/index.php
- http://al####yminute.net/index.php
- http://ge####mancorner.net/index.php
- http://al####ycorner.net/index.php
- http://ge#####anspecial.net/index.php
- http://al####yspecial.net/index.php
- http://fr###flower.net/index.php
- http://ex#####nceflower.net/index.php
- http://pa###bottom.net/index.php
- http://fi###bottom.net/index.php
- http://fr###minute.net/index.php
- http://ex#####ncespecial.net/index.php
- http://fr###corner.net/index.php
- http://ex#####nceminute.net/index.php
- http://fr####pecial.net/index.php
- http://fo####flower.net/index.php
- http://be####pecial.net/index.php
- http://kn####pecial.net/index.php
- http://be###minute.net/index.php
- http://kn###minute.net/index.php
- http://be###corner.net/index.php
- http://cr###flower.net/index.php
- http://su####minute.net/index.php
- http://kn###corner.net/index.php
- http://su####flower.net/index.php
- http://me####minute.net/index.php
- http://fo####special.net/index.php
- http://me####flower.net/index.php
- http://fo####minute.net/index.php
- http://me####special.net/index.php
- http://be###flower.net/index.php
- http://kn###flower.net/index.php
- http://fo####corner.net/index.php
- http://me####corner.net/index.php
- DNS ASK wo###flower.net
- DNS ASK sm###flower.net
- DNS ASK th####tcorner.net
- DNS ASK wa###corner.net
- DNS ASK wo###minute.net
- DNS ASK sm####pecial.net
- DNS ASK wo###corner.net
- DNS ASK sm###minute.net
- DNS ASK wo####pecial.net
- DNS ASK wa####pecial.net
- DNS ASK su####corner.net
- DNS ASK cr###corner.net
- DNS ASK su####special.net
- DNS ASK cr####pecial.net
- DNS ASK th####tflower.net
- DNS ASK wa###minute.net
- DNS ASK th####tspecial.net
- DNS ASK wa###flower.net
- DNS ASK th####tminute.net
- DNS ASK ex#####ncestranger.net
- DNS ASK fr####oodbye.net
- DNS ASK ex#####nceadvance.net
- DNS ASK fr####tranger.net
- DNS ASK ex#####ncegoodbye.net
- DNS ASK ge#####anadvance.net
- DNS ASK al####yadvance.net
- DNS ASK fr####ortieth.net
- DNS ASK ex#####ncefortieth.net
- DNS ASK fr####dvance.net
- DNS ASK fi###flower.net
- DNS ASK pa###minute.net
- DNS ASK sm###corner.net
- DNS ASK pa###flower.net
- DNS ASK fi###minute.net
- DNS ASK pa###corner.net
- DNS ASK fi###corner.net
- DNS ASK pa####pecial.net
- DNS ASK fi####pecial.net
- DNS ASK ge####manminute.net
- DNS ASK al####yminute.net
- DNS ASK ge####manflower.net
- DNS ASK al####yflower.net
- DNS ASK ge#####anspecial.net
- DNS ASK al####ycorner.net
- DNS ASK fo####flower.net
- DNS ASK al####yspecial.net
- DNS ASK ge####mancorner.net
- DNS ASK ex#####ncecorner.net
- DNS ASK fr###flower.net
- DNS ASK ex#####nceflower.net
- DNS ASK pa###bottom.net
- DNS ASK fi###bottom.net
- DNS ASK fr###minute.net
- DNS ASK ex#####ncespecial.net
- DNS ASK fr###corner.net
- DNS ASK ex#####nceminute.net
- DNS ASK fr####pecial.net
- DNS ASK kn####pecial.net
- DNS ASK be###corner.net
- DNS ASK kn###minute.net
- DNS ASK be####pecial.net
- DNS ASK kn###corner.net
- DNS ASK su####minute.net
- DNS ASK cr###minute.net
- DNS ASK su####flower.net
- DNS ASK cr###flower.net
- DNS ASK be###minute.net
- DNS ASK me####minute.net
- DNS ASK fo####special.net
- DNS ASK me####flower.net
- DNS ASK fo####minute.net
- DNS ASK me####special.net
- DNS ASK be###flower.net
- DNS ASK kn###flower.net
- DNS ASK fo####corner.net
- DNS ASK me####corner.net
- ClassName: 'Shell_TrayWnd' WindowName: ''