BIOCs

Network action type = incoming , outgoing , failed AND remote ip = 198.135.184.22

Network action type = outgoing , failed AND remote host = *dynamic-dns.net , *epac.to , *longmusic.com , *compress.to , *wikaba.com , *zzux.com , *dumb1.com , *1dumb.com , *onedumb.com , *wha.la , *youdontcare.com , *yourtrap.com , *2waky.com , *sexidude.com , *mefound.com , *organiccrap.com , *toythieves.com , *justdied.com , *jungleheart.com , *mrbasic.com , *mrbonus.com , *x24hr.com , *dns04.com , *dns05.com , *zyns.com , *my03.com , *fartit.com , *itemdb.com , *instanthq.com , *xxuz.com , *jkub.com , *itsaol.com , *faqserv.com , *jetos.com , *qpoe.com , *qhigh.com , *vizvaz.com , *mrface.com , *isasecret.com , *mrslove.com , *otzo.com , *sellclassics.com , *americanunfinished.com , *serveusers.com , *serveuser.com , *freetcp.com , *ddns.info , *ns01.info , *ns02.info , *myftp.info , *mydad.info , *mymom.info , *mypicture.info , *myz.info , *squirly.info , *toh.info , *xxxy.info , *freewww.info , *freeddns.com , *myddns.com , *dynamicdns.biz , *ns01.biz , *ns02.biz , *xxxy.biz , *sexxxy.biz , *freewww.biz , *www1.biz , *dhcp.biz , *edns.biz , *ftp1.biz , *mywww.biz , *gr8domain.biz , *gr8name.biz , *ftpserver.biz , *wwwhost.biz , *moneyhome.biz , *port25.biz , *esmtp.biz , *sixth.biz , *ninth.biz , *got-game.org , *bigmoney.biz , *dns2.us , *dns1.us , *ns02.us , *ns01.us , *almostmy.com , *ocry.com , *ourhobby.com , *pcanywhere.net , *ygto.com , *ddns.me.uk , *ddns.ms , *dynamicdns.me.uk , *dynamicdns.org.uk , *ddns.us , *gettrials.com , *4mydomain.com , *25u.com , *4dq.com , *4pu.com , *3-a.net , *dsmtp.com , *mynumber.org , *ns1.name , *ns2.name , *ns3.name , *changeip.name , *ddns.name , *rebatesrule.net , *ezua.com , *sendsmtp.com , *trickip.net , *trickip.org , *dnsrd.com , *lflinkup.com , *lflinkup.net , *lflinkup.org , *lflink.com , *dns-dns.com , *proxydns.com , *myftp.name , *dyndns.pro , *changeip.net , *mysecondarydns.com , *changeip.org , *dns-stuff.com , *dynssl.com , *mylftv.com , *mynetav.net , *mynetav.org , *dynamicdns.co.uk , *ikwb.com , *acmetoy.com , *ddns.mobi , *dnset.com , *authorizeddns.net , *authorizeddns.org , *authorizeddns.us , *cleansite.biz , *cleansite.info , *cleansite.us , *https443.net , *https443.org , *mypop3.net , *mypop3.org , *ssl443.org , *iownyour.biz , *iownyour.org , *onmypc.biz , *onmypc.info , *onmypc.net , *onmypc.org , *onmypc.us , *duckdns.org , *3utilities.com , *blogsyte.com , *bounceme.net , *brasilia.me , *cable-modem.org , *ciscofreak.com , *collegefan.org , *couchpotatofries.org , *damnserver.com , *ddns.me , *ddns.net , *ddnsking.com , *ditchyourip.com , *dnsfor.me , *dnsiskinky.com , *dvrcam.info , *dynns.com , *eating-organic.net , *fantasyleague.cc , *geekgalaxy.com , *golffan.us , *health-carereform.com , *homesecuritymac.com , *homesecuritypc.com , *hopto.me , *ilovecollege.info , *ilovecollege.info , *loginto.me , *mlbfan.org , *mmafan.biz , *myactivedirectory.com , *mydissent.net , *myeffect.net , *myftp.biz , *myftp.org , *mymediapc.net , *mypsx.net , *mysecuritycamera.com , *mysecuritycamera.net , *mysecuritycamera.org , *myvnc.com , *net-freaks.com , *nflfan.org , *nhlfan.net , *no-ip.biz , *no-ip.ca , *no-ip.co.uk , *no-ip.info , *noip.me , *no-ip.net , *no-ip.org , *noip.us , *noip.com , *onthewifi.com , *pgafan.net , *point2this.com , *pointto.us , *privatizehealthinsurance.net , *quicksytes.com , *read-books.org , *redirectme.net , *securitytactics.com , *servebeer.com , *serveblog.net , *servecounterstrike.com , *serveexchange.com , *serveftp.com , *servegame.com , *servehalflife.com , *servehttp.com , *servehumour.com , *serveminecraft.net , *servemp3.com , *servep2p.com , *servepics.com , *servequake.com , *servesarcasm.com , *stufftoread.com , *ufcfan.org , *unusualperson.com , *webhop.me , *workisboring.com , *zapto.org , *at-band-camp.net , *barrel-of-knowledge.info , *barrell-of-knowledge.info , *better-than.tv , *blogdns.com , *blogdns.net , *blogdns.org , *blogsite.org , *boldlygoingnowhere.org , *broke-it.net , *buyshouses.net , *cechire.com , *dnsalias.com , *dnsalias.net , *dnsalias.org , *dnsdojo.com , *dnsdojo.net , *dnsdojo.org , *does-it.net , *doesntexist.com , *doesntexist.org , *dontexist.com , *dontexist.net , *dontexist.org , *doomdns.com , *doomdns.org , *dvrdns.org , *dyn-o-saur.com , *dynalias.com , *dynalias.net , *dynalias.org , *dynathome.net , *dyndns-at-home.com , *dyndns-at-work.com , *dyndns-blog.com , *dyndns-free.com , *dyndns-home.com , *dyndns-ip.com , *dyndns-mail.com , *dyndns-office.com , *dyndns-pics.com , *dyndns-remote.com , *dyndns-server.com , *dyndns-web.com , *dyndns-wiki.com , *dyndns-work.com , *dyndns.biz , *dyndns.info , *dyndns.org , *dyndns.tv , *dyndns.ws , *endofinternet.net , *endofinternet.org , *endoftheinternet.org , *est-a-la-maison.com , *est-a-la-masion.com , *est-le-patron.com , *est-mon-blogueur.com , *for-better.biz , *for-more.biz , *for-our.info , *for-some.biz , *for-the.biz , *forgot.her.name , *forgot.his.name , *from-ak.com , *from-al.com , *from-ar.com , *from-az.net , *from-ca.com , *from-co.net , *from-ct.com , *from-dc.com , *from-de.com , *from-fl.com , *from-ga.com , *from-hi.com , *from-ia.com , *from-id.com , *from-il.com , *from-in.com , *from-ks.com , *from-ky.com , *from-la.net , *from-ma.com , *from-md.com , *from-me.org , *from-mi.com , *from-mn.com , *from-mo.com , *from-ms.com , *from-mt.com , *from-nc.com , *from-nd.com , *from-ne.com , *from-nh.com , *from-nj.com , *from-nm.com , *from-nv.com , *from-ny.net , *from-oh.com , *from-ok.com , *from-or.com , *from-pa.com , *from-pr.com , *from-ri.com , *from-sc.com , *from-sd.com , *from-tn.com , *from-tx.com , *from-ut.com , *from-va.com , *from-vt.com , *from-wa.com , *from-wi.com , *from-wv.com , *from-wy.com , *ftpaccess.cc , *fuettertdasnetz.de , *game-host.org , *game-server.cc , *getmyip.com , *gets-it.net , *go.dyndns.org , *gotdns.com , *gotdns.org , *groks-the.info , *groks-this.info , *ham-radio-op.net , *here-for-more.info , *hobby-site.com , *hobby-site.org , *home.dyndns.org , *homedns.org , *homeftp.net , *homeftp.org , *homeip.net , *homelinux.com , *homelinux.net , *homelinux.org , *homeunix.com , *homeunix.net , *homeunix.org , *iamallama.com , *in-the-band.net , *is-a-anarchist.com , *is-a-blogger.com , *is-a-bookkeeper.com , *is-a-bruinsfan.org , *is-a-bulls-fan.com , *is-a-candidate.org , *is-a-caterer.com , *is-a-celticsfan.org , *is-a-chef.com , *is-a-chef.net , *is-a-chef.org , *is-a-conservative.com , *is-a-cpa.com , *is-a-cubicle-slave.com , *is-a-democrat.com , *is-a-designer.com , *is-a-doctor.com , *is-a-financialadvisor.com , *is-a-geek.com , *is-a-geek.net , *is-a-geek.org , *is-a-green.com , *is-a-guru.com , *is-a-hard-worker.com , *is-a-hunter.com , *is-a-knight.org , *is-a-landscaper.com , *is-a-lawyer.com , *is-a-liberal.com , *is-a-libertarian.com , *is-a-linux-user.org , *is-a-llama.com , *is-a-musician.com , *is-a-nascarfan.com , *is-a-nurse.com , *is-a-painter.com , *is-a-patsfan.org , *is-a-personaltrainer.com , *is-a-photographer.com , *is-a-player.com , *is-a-republican.com , *is-a-rockstar.com , *is-a-socialist.com , *is-a-soxfan.org , *is-a-student.com , *is-a-teacher.com , *is-a-techie.com , *is-a-therapist.com , *is-an-accountant.com , *is-an-actor.com , *is-an-actress.com , *is-an-anarchist.com , *is-an-artist.com , *is-an-engineer.com , *is-an-entertainer.com , *is-by.us , *is-certified.com , *is-found.org , *is-gone.com , *is-into-anime.com , *is-into-cars.com , *is-into-cartoons.com , *is-into-games.com , *is-leet.com , *is-lost.org , *is-not-certified.com , *is-saved.org , *is-slick.com , *is-uberleet.com , *is-very-bad.org , *is-very-evil.org , *is-very-good.org , *is-very-nice.org , *is-very-sweet.org , *is-with-theband.com , *isa-geek.com , *isa-geek.net , *isa-geek.org , *isa-hockeynut.com , *issmarterthanyou.com , *isteingeek.de , *istmein.de , *kicks-ass.net , *kicks-ass.org , *knowsitall.info , *land-4-sale.us , *lebtimnetz.de , *leitungsen.de , *likes-pie.com , *likescandy.com , *merseine.nu , *mine.nu , *misconfused.org , *mypets.ws , *myphotos.cc , *neat-url.com , *office-on-the.net , *on-the-web.tv , *podzone.net , *podzone.org , *readmyblog.org , *saves-the-whales.com , *scrapper-site.net , *scrapping.cc , *selfip.biz , *selfip.com , *selfip.info , *selfip.net , *selfip.org , *sells-for-less.com , *sells-for-u.com , *sells-it.net , *sellsyourhome.org , *servebbs.com , *servebbs.net , *servebbs.org , *serveftp.net , *serveftp.org , *servegame.org , *shacknet.nu , *simple-url.com , *space-to-rent.com , *stuff-4-sale.org , *stuff-4-sale.us , *teaches-yoga.com , *thruhere.net , *traeumtgerade.de , *webhop.biz , *webhop.info , *webhop.net , *webhop.org , *worse-than.tv , *writesthisblog.com , *publicvm.com , *linkpc.net

File action type = create , write AND file path =~ (\\inetpub\\wwwroot\\aspnet_client\\|\\frontend\\httpproxy\\owa\\auth\\|\\frontend\\httpproxy\\ecp\\auth\\).*\.aspx Process initiated by = UMWorkerProcess.exe , w3wp.exe

Image Load module sha256 = 32519b85c0b422e4656de6e6c41878e95fd95026267daab4215ee59c107d6c77 , dab758bf98d9b36fa057a66cd0284737abf89857b73ca89280267ee7caf62f3b , eb6fab5a2964c5817fb239a7a5079cabca0a00464fb3e07155f28b0a57a2c0ed , c09040d35630d75dfef0f804f320f8b3d16a481071076918e9b236a321c1ea77 , ac1b2b89e60707a20e9eb1ca480bc3410ead40643b386d624c5d21b47c02917c , 019085a76ba7126fff22770d71bd901c325fc68ac55aa743327984e89f4b0134 , ce77d116a074dab7a22a0fd4f2c1ab475f16eec42e1ded3c0b0aa8211fe858d6 , a25cadd48d70f6ea0c4a241d99c5241269e6faccb4054e62d16784640f8e53bc , D3c6785e18fba3749fb785bc313cf8346182f532c59172b69adfb31b96a5d0af Process initiated by = *businesslayerhost* , cgo name = *businesslayerhost* , os parent name = *businesslayerhost* Host host os = windows