Technical Information
To ensure autorun and distribution
Sets the following service settings
- [<HKLM>\System\CurrentControlSet\Services\Experience Certificate Tablet Installer] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\Experience Certificate Tablet Installer] 'ImagePath' = 'C:\yuefhdbny\qdpitbkarmry.exe'
Creates the following services
- 'Experience Certificate Tablet Installer' C:\yuefhdbny\qdpitbkarmry.exe
Modifies file system
Creates the following files
- %WINDIR%\yuefhdbny\bpqbt8avz
- C:\yuefhdbny\bpqbt8avz
- C:\yuefhdbny\aolps3odlzuwydeuno.exe
- C:\yuefhdbny\qdpitbkarmry.exe
- C:\yuefhdbny\mjrxkidkhsvl.exe
Sets the 'hidden' attribute to the following files
- C:\yuefhdbny\qdpitbkarmry.exe
- C:\yuefhdbny\mjrxkidkhsvl.exe
Deletes the following files
- %WINDIR%\yuefhdbny\bpqbt8avz
- C:\yuefhdbny\aolps3odlzuwydeuno.exe
Substitutes the following files
- %WINDIR%\yuefhdbny\bpqbt8avz
Network activity
TCP
HTTP GET requests
- http://pr####eheart.net/index.php
- http://pr####emayor.net/index.php
- http://st####thheart.net/index.php
- http://st####thbattle.net/index.php
- http://ma####ealmost.net/index.php
- http://ri###reason.net/index.php
- http://wh####rorderly.net/index.php
- http://ri####rderly.net/index.php
- http://fa###yvalue.net/index.php
- http://pe####chance.net/index.php
- http://su#####nderstood.net/index.php
- http://ri###chance.net/index.php
- http://fa####meeting.net/index.php
UDP
- DNS ASK pr####eheart.net
- DNS ASK ri###twenty.net
- DNS ASK wh#####understood.net
- DNS ASK ri####nderstood.net
- DNS ASK fi####chance.net
- DNS ASK th####chance.net
- DNS ASK fi####meeting.net
- DNS ASK th####meeting.net
- DNS ASK pi#####understood.net
- DNS ASK fi####twenty.net
- DNS ASK fi#####nderstood.net
- DNS ASK th#####nderstood.net
- DNS ASK pi####echance.net
- DNS ASK ci####ttechance.net
- DNS ASK pi####emeeting.net
- DNS ASK ci#####temeeting.net
- DNS ASK pi####etwenty.net
- DNS ASK ri####eeting.net
- DNS ASK wh####rtwenty.net
- DNS ASK th####twenty.net
- DNS ASK ci####ttetwenty.net
- DNS ASK wh####rchance.net
- DNS ASK ma####echance.net
- DNS ASK pe####meeting.net
- DNS ASK ma####emeeting.net
- DNS ASK pe####twenty.net
- DNS ASK ma####etwenty.net
- DNS ASK pe#####nderstood.net
- DNS ASK ma#####understood.net
- DNS ASK su####chance.net
- DNS ASK fo####nchance.net
- DNS ASK su####meeting.net
- DNS ASK fo####nmeeting.net
- DNS ASK su####twenty.net
- DNS ASK fo####ntwenty.net
- DNS ASK su#####nderstood.net
- DNS ASK fo#####understood.net
- DNS ASK ri###chance.net
- DNS ASK be#####understood.net
- DNS ASK wh####rmeeting.net
- DNS ASK th####orderly.net
- DNS ASK ci#####teunderstood.net
- DNS ASK be####edelight.net
- DNS ASK ma####eborrow.net
- DNS ASK pe###ntrain.net
- DNS ASK ma####etrain.net
- DNS ASK pe#####lectricity.net
- DNS ASK ma#####electricity.net
- DNS ASK pe####delight.net
- DNS ASK ma####edelight.net
- DNS ASK ch####enchance.net
- DNS ASK su####borrow.net
- DNS ASK su###ntrain.net
- DNS ASK fo####ntrain.net
- DNS ASK su#####lectricity.net
- DNS ASK fo#####electricity.net
- DNS ASK su####delight.net
- DNS ASK fo####ndelight.net
- DNS ASK ex####delight.net
- DNS ASK be#####electricity.net
- DNS ASK pe####borrow.net
- DNS ASK ex#####lectricity.net
- DNS ASK be####etrain.net
- DNS ASK fa####chance.net
- DNS ASK fa####meeting.net
- DNS ASK ch####entwenty.net
- DNS ASK fa####twenty.net
- DNS ASK ch#####nunderstood.net
- DNS ASK fa#####nderstood.net
- DNS ASK ei####chance.net
- DNS ASK ex#####nderstood.net
- DNS ASK en####hchance.net
- DNS ASK pe####chance.net
- DNS ASK en####hmeeting.net
- DNS ASK en####htwenty.net
- DNS ASK ei#####nderstood.net
- DNS ASK en#####understood.net
- DNS ASK ex####borrow.net
- DNS ASK be####eborrow.net
- DNS ASK ex###ttrain.net
- DNS ASK ei####meeting.net
- DNS ASK ch####enmeeting.net
- DNS ASK ei####twenty.net
- DNS ASK be####etwenty.net
- DNS ASK ex####twenty.net
- DNS ASK be####emeeting.net
- DNS ASK ma####ealmost.net
- DNS ASK pe####reason.net
- DNS ASK ma####ereason.net
- DNS ASK pe####orderly.net
- DNS ASK ma####eorderly.net
- DNS ASK pe###nvalue.net
- DNS ASK ma####evalue.net
- DNS ASK su####almost.net
- DNS ASK fo####nalmost.net
- DNS ASK su####reason.net
- DNS ASK fo####nreason.net
- DNS ASK su####orderly.net
- DNS ASK fo####norderly.net
- DNS ASK su###nvalue.net
- DNS ASK fo####nvalue.net
- DNS ASK ex###tvalue.net
- DNS ASK ex####orderly.net
- DNS ASK pe####almost.net
- DNS ASK be####eorderly.net
- DNS ASK be####ereason.net
- DNS ASK st####thperfect.net
- DNS ASK pr####eperfect.net
- DNS ASK de####perfect.net
- DNS ASK pr####emayor.net
- DNS ASK de###emayor.net
- DNS ASK pr####ebattle.net
- DNS ASK de####battle.net
- DNS ASK st####thheart.net
- DNS ASK wh####ralmost.net
- DNS ASK wh####rborrow.net
- DNS ASK st###heart.net
- DNS ASK st####thmayor.net
- DNS ASK st###mayor.net
- DNS ASK st####thbattle.net
- DNS ASK st###battle.net
- DNS ASK ex####almost.net
- DNS ASK be####ealmost.net
- DNS ASK ex####reason.net
- DNS ASK de###eheart.net
- DNS ASK st####erfect.net
- DNS ASK fo####nborrow.net
- DNS ASK ri###almost.net
- DNS ASK ri####rderly.net
- DNS ASK ch####enorderly.net
- DNS ASK fa####orderly.net
- DNS ASK ch####envalue.net
- DNS ASK fa###yvalue.net
- DNS ASK ei####almost.net
- DNS ASK en####halmost.net
- DNS ASK be####evalue.net
- DNS ASK ei####reason.net
- DNS ASK ei####orderly.net
- DNS ASK en####horderly.net
- DNS ASK ei###rvalue.net
- DNS ASK en####hvalue.net
- DNS ASK ex####chance.net
- DNS ASK be####echance.net
- DNS ASK ex####meeting.net
- DNS ASK fa####almost.net
- DNS ASK en####hreason.net
- DNS ASK fa####reason.net
- DNS ASK ch####enreason.net
- DNS ASK ch####enalmost.net
- DNS ASK ci####ttevalue.net
- DNS ASK wh####rvalue.net
- DNS ASK ri###value.net
- DNS ASK fi####almost.net
- DNS ASK th####almost.net
- DNS ASK fi####reason.net
- DNS ASK th####reason.net
- DNS ASK wh####rreason.net
- DNS ASK fi####orderly.net
- DNS ASK ri###reason.net
- DNS ASK fi###evalue.net
- DNS ASK pi####ealmost.net
- DNS ASK ci####ttealmost.net
- DNS ASK pi####ereason.net
- DNS ASK ci####ttereason.net
- DNS ASK pi####eorderly.net
- DNS ASK ci#####teorderly.net
- DNS ASK wh####rorderly.net
- DNS ASK pi####evalue.net
- DNS ASK th###hvalue.net
- DNS ASK ri###borrow.net
Miscellaneous
Creates and executes the following
- 'C:\yuefhdbny\aolps3odlzuwydeuno.exe'
- 'C:\yuefhdbny\qdpitbkarmry.exe'
- 'C:\yuefhdbny\mjrxkidkhsvl.exe' "c:\yuefhdbny\qdpitbkarmry.exe"
