Technical Information
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Protection Parental HomeGroup' = 'C:\wesutpfoixa\ltjxpgaxw.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\Access Acquisition Block] 'ImagePath' = 'C:\wesutpfoixa\ltjxpgaxw.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\Access Acquisition Block] 'Start' = '00000002'
- 'C:\wesutpfoixa\xmqctdmfrk.exe' "c:\wesutpfoixa\ltjxpgaxw.exe"
- 'C:\wesutpfoixa\ltjxpgaxw.exe'
- 'C:\wesutpfoixa\ws3133qirplpbhjjk.exe'
- C:\wesutpfoixa\ltjxpgaxw.exe
- C:\wesutpfoixa\xmqctdmfrk.exe
- C:\wesutpfoixa\ws3133qirplpbhjjk.exe
- %WINDIR%\wesutpfoixa\j9kqamm
- C:\wesutpfoixa\j9kqamm
- C:\wesutpfoixa\xmqctdmfrk.exe
- C:\wesutpfoixa\ltjxpgaxw.exe
- C:\wesutpfoixa\ws3133qirplpbhjjk.exe
- %WINDIR%\wesutpfoixa\j9kqamm
- 'be#####ectricity.net':80
- 'kn#####ectricity.net':80
- 'be###train.net':80
- 'kn###train.net':80
- 'be####elight.net':80
- 'cr###borrow.net':80
- 'su###rtrain.net':80
- 'kn####elight.net':80
- 'su####borrow.net':80
- 'kn###borrow.net':80
- 'fo###wtrain.net':80
- 'me###rtrain.net':80
- 'fo####borrow.net':80
- 'me####borrow.net':80
- 'fo#####lectricity.net':80
- 'me####delight.net':80
- 'be###borrow.net':80
- 'me#####lectricity.net':80
- 'fo####delight.net':80
- 'cr###train.net':80
- 'wo###borrow.net':80
- 'sm###borrow.net':80
- 'th####tdelight.net':80
- 'wa####elight.net':80
- 'wo###train.net':80
- 'sm#####ectricity.net':80
- 'wo####elight.net':80
- 'sm###train.net':80
- 'wo#####ectricity.net':80
- 'wa#####ectricity.net':80
- 'su####delight.net':80
- 'cr####elight.net':80
- 'su#####lectricity.net':80
- 'cr#####ectricity.net':80
- 'th####tborrow.net':80
- 'wa###train.net':80
- 'th#####electricity.net':80
- 'wa###borrow.net':80
- 'th####ttrain.net':80
- 'sm###twenty.net':80
- 'wo####nderstood.net':80
- 'sm####eeting.net':80
- 'wo###twenty.net':80
- 'sm####nderstood.net':80
- 'pa####eeting.net':80
- 'fi####eeting.net':80
- 'pa###chance.net':80
- 'fi###chance.net':80
- 'wo####eeting.net':80
- 'wa####eeting.net':80
- 'th####ttwenty.net':80
- 'wa###chance.net':80
- 'th####tmeeting.net':80
- 'wa###twenty.net':80
- 'wo###chance.net':80
- 'sm###chance.net':80
- 'th#####understood.net':80
- 'wa####nderstood.net':80
- 'pa###twenty.net':80
- 'al####yborrow.net':80
- 'ge####mantrain.net':80
- 'ex#####ncedelight.net':80
- 'ge####manborrow.net':80
- 'al####ytrain.net':80
- 'ge#####andelight.net':80
- 'al####ydelight.net':80
- 'ge######nelectricity.net':80
- 'al#####electricity.net':80
- 'fr####elight.net':80
- 'fi####nderstood.net':80
- 'fr###borrow.net':80
- 'fi###twenty.net':80
- 'pa####nderstood.net':80
- 'ex#####nceborrow.net':80
- 'fr#####ectricity.net':80
- 'ex######ceelectricity.net':80
- 'fr###train.net':80
- 'ex####encetrain.net':80
- http://be#####ectricity.net/index.php
- http://kn#####ectricity.net/index.php
- http://be###train.net/index.php
- http://kn###train.net/index.php
- http://be####elight.net/index.php
- http://cr###borrow.net/index.php
- http://su###rtrain.net/index.php
- http://kn####elight.net/index.php
- http://su####borrow.net/index.php
- http://kn###borrow.net/index.php
- http://fo###wtrain.net/index.php
- http://me###rtrain.net/index.php
- http://fo####borrow.net/index.php
- http://me####borrow.net/index.php
- http://fo#####lectricity.net/index.php
- http://me####delight.net/index.php
- http://be###borrow.net/index.php
- http://me#####lectricity.net/index.php
- http://fo####delight.net/index.php
- http://cr###train.net/index.php
- http://wo###borrow.net/index.php
- http://sm###borrow.net/index.php
- http://th####tdelight.net/index.php
- http://wa####elight.net/index.php
- http://wo###train.net/index.php
- http://sm#####ectricity.net/index.php
- http://wo####elight.net/index.php
- http://sm###train.net/index.php
- http://wo#####ectricity.net/index.php
- http://wa#####ectricity.net/index.php
- http://su####delight.net/index.php
- http://cr####elight.net/index.php
- http://su#####lectricity.net/index.php
- http://cr#####ectricity.net/index.php
- http://th####tborrow.net/index.php
- http://wa###train.net/index.php
- http://th#####electricity.net/index.php
- http://wa###borrow.net/index.php
- http://th####ttrain.net/index.php
- http://sm###twenty.net/index.php
- http://wo####nderstood.net/index.php
- http://sm####eeting.net/index.php
- http://wo###twenty.net/index.php
- http://sm####nderstood.net/index.php
- http://pa####eeting.net/index.php
- http://fi####eeting.net/index.php
- http://pa###chance.net/index.php
- http://fi###chance.net/index.php
- http://wo####eeting.net/index.php
- http://wa####eeting.net/index.php
- http://th####ttwenty.net/index.php
- http://wa###chance.net/index.php
- http://th####tmeeting.net/index.php
- http://wa###twenty.net/index.php
- http://wo###chance.net/index.php
- http://sm###chance.net/index.php
- http://th#####understood.net/index.php
- http://wa####nderstood.net/index.php
- http://pa###twenty.net/index.php
- http://al####yborrow.net/index.php
- http://ge####mantrain.net/index.php
- http://ex#####ncedelight.net/index.php
- http://ge####manborrow.net/index.php
- http://al####ytrain.net/index.php
- http://ge#####andelight.net/index.php
- http://al####ydelight.net/index.php
- http://ge######nelectricity.net/index.php
- http://al#####electricity.net/index.php
- http://fr####elight.net/index.php
- http://fi####nderstood.net/index.php
- http://fr###borrow.net/index.php
- http://fi###twenty.net/index.php
- http://pa####nderstood.net/index.php
- http://ex#####nceborrow.net/index.php
- http://fr#####ectricity.net/index.php
- http://ex######ceelectricity.net/index.php
- http://fr###train.net/index.php
- http://ex####encetrain.net/index.php
- DNS ASK kn#####ectricity.net
- DNS ASK be####elight.net
- DNS ASK kn###train.net
- DNS ASK be#####ectricity.net
- DNS ASK kn####elight.net
- DNS ASK su###rtrain.net
- DNS ASK cr###train.net
- DNS ASK su####borrow.net
- DNS ASK cr###borrow.net
- DNS ASK be###train.net
- DNS ASK me###rtrain.net
- DNS ASK fo#####lectricity.net
- DNS ASK me####borrow.net
- DNS ASK fo###wtrain.net
- DNS ASK me#####lectricity.net
- DNS ASK be###borrow.net
- DNS ASK kn###borrow.net
- DNS ASK fo####delight.net
- DNS ASK me####delight.net
- DNS ASK su#####lectricity.net
- DNS ASK sm###borrow.net
- DNS ASK wo###train.net
- DNS ASK wa####elight.net
- DNS ASK wo###borrow.net
- DNS ASK sm###train.net
- DNS ASK wo####elight.net
- DNS ASK sm####elight.net
- DNS ASK wo#####ectricity.net
- DNS ASK sm#####ectricity.net
- DNS ASK th####tdelight.net
- DNS ASK cr####elight.net
- DNS ASK th####tborrow.net
- DNS ASK cr#####ectricity.net
- DNS ASK su####delight.net
- DNS ASK wa###borrow.net
- DNS ASK th#####electricity.net
- DNS ASK wa#####ectricity.net
- DNS ASK th####ttrain.net
- DNS ASK wa###train.net
- DNS ASK fo####borrow.net
- DNS ASK sm###twenty.net
- DNS ASK wo####nderstood.net
- DNS ASK sm####eeting.net
- DNS ASK wo###twenty.net
- DNS ASK sm####nderstood.net
- DNS ASK pa####eeting.net
- DNS ASK fi####eeting.net
- DNS ASK pa###chance.net
- DNS ASK fi###chance.net
- DNS ASK wo####eeting.net
- DNS ASK wa####eeting.net
- DNS ASK th####ttwenty.net
- DNS ASK wa###chance.net
- DNS ASK th####tmeeting.net
- DNS ASK wa###twenty.net
- DNS ASK wo###chance.net
- DNS ASK sm###chance.net
- DNS ASK th#####understood.net
- DNS ASK wa####nderstood.net
- DNS ASK pa###twenty.net
- DNS ASK al####yborrow.net
- DNS ASK ge####mantrain.net
- DNS ASK ex#####ncedelight.net
- DNS ASK ge####manborrow.net
- DNS ASK al####ytrain.net
- DNS ASK ge#####andelight.net
- DNS ASK al####ydelight.net
- DNS ASK ge######nelectricity.net
- DNS ASK al#####electricity.net
- DNS ASK fr####elight.net
- DNS ASK fi####nderstood.net
- DNS ASK fr###borrow.net
- DNS ASK fi###twenty.net
- DNS ASK pa####nderstood.net
- DNS ASK ex#####nceborrow.net
- DNS ASK fr#####ectricity.net
- DNS ASK ex######ceelectricity.net
- DNS ASK fr###train.net
- DNS ASK ex####encetrain.net
- ClassName: 'Shell_TrayWnd' WindowName: ''