Technical Information
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Certificate Enumerator SPP IP Media Disk' = 'C:\gdqgtbydbnqygw\jaomwtgqzlw.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\Server Controls Logon Search] 'ImagePath' = 'C:\gdqgtbydbnqygw\jaomwtgqzlw.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\Server Controls Logon Search] 'Start' = '00000002'
- C:\gdqgtbydbnqygw\jaomwtgqzlw.exe
- C:\gdqgtbydbnqygw\muvzvlhonoh.exe
- C:\gdqgtbydbnqygw\rtp35jqmpj
- %WINDIR%\gdqgtbydbnqygw\hviigp6yctn1
- C:\gdqgtbydbnqygw\hviigp6yctn1
- C:\gdqgtbydbnqygw\fpcdk2i00qbqpxtr3hw.exe
- C:\gdqgtbydbnqygw\muvzvlhonoh.exe
- C:\gdqgtbydbnqygw\jaomwtgqzlw.exe
- C:\gdqgtbydbnqygw\fpcdk2i00qbqpxtr3hw.exe
- %WINDIR%\gdqgtbydbnqygw\hviigp6yctn1
- %WINDIR%\gdqgtbydbnqygw\hviigp6yctn1
- 'ex####public.net':80
- 'be####epublic.net':80
- 'ex####eearly.net':80
- 'be####eeearly.net':80
- 'ex###tdress.net':80
- 'ma####ecatch.net':80
- 'pe####eearly.net':80
- 'be####edress.net':80
- 'pe###ncatch.net':80
- 'en####hhealth.net':80
- 'ei####clothes.net':80
- 'en####hseparate.net':80
- 'ei####health.net':80
- 'en####hclothes.net':80
- 'ex###tcatch.net':80
- 'be####ecatch.net':80
- 'ei####distant.net':80
- 'en####hdistant.net':80
- 'su###ndress.net':80
- 'fo####ndress.net':80
- 'su####public.net':80
- 'fo####npublic.net':80
- 'wh####rcatch.net':80
- 'ri###eearly.net':80
- 'wh####rpublic.net':80
- 'ri###catch.net':80
- 'wh####reearly.net':80
- 'ma####epublic.net':80
- 'pe###ndress.net':80
- 'ma####eeearly.net':80
- 'pe####public.net':80
- 'ma####edress.net':80
- 'su####eearly.net':80
- 'fo####neearly.net':80
- 'su###ncatch.net':80
- 'fo####ncatch.net':80
- 'fi####separate.net':80
- 'th####separate.net':80
- 'wh####rdistant.net':80
- 'ri####istant.net':80
- 'fi####health.net':80
- 'th####clothes.net':80
- 'fi####distant.net':80
- 'th####health.net':80
- 'fi####clothes.net':80
- 'fo####ndistant.net':80
- 'wh####rseparate.net':80
- 'fo####nclothes.net':80
- 'su####distant.net':80
- 'ri####eparate.net':80
- 'wh####rclothes.net':80
- 'ri####lothes.net':80
- 'wh####rhealth.net':80
- 'ri###health.net':80
- 'ch####enhealth.net':80
- 'fa####health.net':80
- 'ch#####nseparate.net':80
- 'fa####separate.net':80
- 'ch####enclothes.net':80
- 'fa####distant.net':80
- 'ei####separate.net':80
- 'fa####clothes.net':80
- 'ch####endistant.net':80
- 'ci#####teseparate.net':80
- 'pi####ehealth.net':80
- 'th####distant.net':80
- 'pi####eseparate.net':80
- 'ci####ttehealth.net':80
- 'pi####edistant.net':80
- 'ci#####tedistant.net':80
- 'pi####eclothes.net':80
- 'ci#####teclothes.net':80
- http://ex####public.net/index.php?me########
- http://be####epublic.net/index.php?me########
- http://ex####eearly.net/index.php?me########
- http://be####eeearly.net/index.php?me########
- http://ex###tdress.net/index.php?me########
- http://ma####ecatch.net/index.php?me########
- http://pe####eearly.net/index.php?me########
- http://be####edress.net/index.php?me########
- http://pe###ncatch.net/index.php?me########
- http://en####hhealth.net/index.php?me########
- http://ei####clothes.net/index.php?me########
- http://en####hseparate.net/index.php?me########
- http://ei####health.net/index.php?me########
- http://en####hclothes.net/index.php?me########
- http://ex###tcatch.net/index.php?me########
- http://be####ecatch.net/index.php?me########
- http://ei####distant.net/index.php?me########
- http://en####hdistant.net/index.php?me########
- http://su###ndress.net/index.php?me########
- http://fo####ndress.net/index.php?me########
- http://su####public.net/index.php?me########
- http://fo####npublic.net/index.php?me########
- http://wh####rcatch.net/index.php?me########
- http://ri###eearly.net/index.php?me########
- http://wh####rpublic.net/index.php?me########
- http://ri###catch.net/index.php?me########
- http://wh####reearly.net/index.php?me########
- http://ma####epublic.net/index.php?me########
- http://pe###ndress.net/index.php?me########
- http://ma####eeearly.net/index.php?me########
- http://pe####public.net/index.php?me########
- http://ma####edress.net/index.php?me########
- http://su####eearly.net/index.php?me########
- http://fo####neearly.net/index.php?me########
- http://su###ncatch.net/index.php?me########
- http://fo####ncatch.net/index.php?me########
- http://fi####separate.net/index.php?me########
- http://th####separate.net/index.php?me########
- http://wh####rdistant.net/index.php?me########
- http://ri####istant.net/index.php?me########
- http://fi####health.net/index.php?me########
- http://th####clothes.net/index.php?me########
- http://fi####distant.net/index.php?me########
- http://th####health.net/index.php?me########
- http://fi####clothes.net/index.php?me########
- http://fo####ndistant.net/index.php?me########
- http://wh####rseparate.net/index.php?me########
- http://fo####nclothes.net/index.php?me########
- http://su####distant.net/index.php?me########
- http://ri####eparate.net/index.php?me########
- http://wh####rclothes.net/index.php?me########
- http://ri####lothes.net/index.php?me########
- http://wh####rhealth.net/index.php?me########
- http://ri###health.net/index.php?me########
- http://ch####enhealth.net/index.php?me########
- http://fa####health.net/index.php?me########
- http://ch#####nseparate.net/index.php?me########
- http://fa####separate.net/index.php?me########
- http://ch####enclothes.net/index.php?me########
- http://fa####distant.net/index.php?me########
- http://ei####separate.net/index.php?me########
- http://fa####clothes.net/index.php?me########
- http://ch####endistant.net/index.php?me########
- http://ci#####teseparate.net/index.php?me########
- http://pi####ehealth.net/index.php?me########
- http://th####distant.net/index.php?me########
- http://pi####eseparate.net/index.php?me########
- http://ci####ttehealth.net/index.php?me########
- http://pi####edistant.net/index.php?me########
- http://ci#####tedistant.net/index.php?me########
- http://pi####eclothes.net/index.php?me########
- http://ci#####teclothes.net/index.php?me########
- DNS ASK ex####public.net
- DNS ASK be####epublic.net
- DNS ASK ex####eearly.net
- DNS ASK be####eeearly.net
- DNS ASK ex###tdress.net
- DNS ASK ma####ecatch.net
- DNS ASK pe####eearly.net
- DNS ASK be####edress.net
- DNS ASK pe###ncatch.net
- DNS ASK en####hhealth.net
- DNS ASK ei####clothes.net
- DNS ASK en####hseparate.net
- DNS ASK ei####health.net
- DNS ASK en####hclothes.net
- DNS ASK ex###tcatch.net
- DNS ASK be####ecatch.net
- DNS ASK ei####distant.net
- DNS ASK en####hdistant.net
- DNS ASK su###ndress.net
- DNS ASK fo####ndress.net
- DNS ASK su####public.net
- DNS ASK fo####npublic.net
- DNS ASK wh####rcatch.net
- DNS ASK ri###eearly.net
- DNS ASK wh####rpublic.net
- DNS ASK ri###catch.net
- DNS ASK wh####reearly.net
- DNS ASK ma####epublic.net
- DNS ASK pe###ndress.net
- DNS ASK ma####eeearly.net
- DNS ASK pe####public.net
- DNS ASK ma####edress.net
- DNS ASK su####eearly.net
- DNS ASK fo####neearly.net
- DNS ASK su###ncatch.net
- DNS ASK fo####ncatch.net
- DNS ASK fi####separate.net
- DNS ASK th####separate.net
- DNS ASK wh####rdistant.net
- DNS ASK ri####istant.net
- DNS ASK fi####health.net
- DNS ASK th####clothes.net
- DNS ASK fi####distant.net
- DNS ASK th####health.net
- DNS ASK fi####clothes.net
- DNS ASK fo####ndistant.net
- DNS ASK wh####rseparate.net
- DNS ASK fo####nclothes.net
- DNS ASK su####distant.net
- DNS ASK ri####eparate.net
- DNS ASK wh####rclothes.net
- DNS ASK ri####lothes.net
- DNS ASK wh####rhealth.net
- DNS ASK ri###health.net
- DNS ASK ch####enhealth.net
- DNS ASK fa####health.net
- DNS ASK ch#####nseparate.net
- DNS ASK fa####separate.net
- DNS ASK ch####enclothes.net
- DNS ASK fa####distant.net
- DNS ASK ei####separate.net
- DNS ASK fa####clothes.net
- DNS ASK ch####endistant.net
- DNS ASK ci#####teseparate.net
- DNS ASK pi####ehealth.net
- DNS ASK th####distant.net
- DNS ASK pi####eseparate.net
- DNS ASK ci####ttehealth.net
- DNS ASK pi####edistant.net
- DNS ASK ci#####tedistant.net
- DNS ASK pi####eclothes.net
- DNS ASK ci#####teclothes.net
- 'C:\gdqgtbydbnqygw\muvzvlhonoh.exe' "c:\gdqgtbydbnqygw\jaomwtgqzlw.exe"
- 'C:\gdqgtbydbnqygw\jaomwtgqzlw.exe'
- 'C:\gdqgtbydbnqygw\fpcdk2i00qbqpxtr3hw.exe'