Technical Information
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Shell Control User-mode Grouping Discovery' = 'C:\dydzxqggrimsa\alw1hxxbxbu.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\Awareness Computer VC User Workstation Reports] 'ImagePath' = 'C:\dydzxqggrimsa\alw1hxxbxbu.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\Awareness Computer VC User Workstation Reports] 'Start' = '00000002'
- 'C:\dydzxqggrimsa\znhqjmt.exe' "c:\dydzxqggrimsa\alw1hxxbxbu.exe"
- 'C:\dydzxqggrimsa\alw1hxxbxbu.exe'
- 'C:\dydzxqggrimsa\ydzglbs2n73fdwhc2u3ocpk.exe'
- C:\dydzxqggrimsa\alw1hxxbxbu.exe
- C:\dydzxqggrimsa\znhqjmt.exe
- C:\dydzxqggrimsa\kgutwjy
- %WINDIR%\dydzxqggrimsa\okiz9z
- C:\dydzxqggrimsa\okiz9z
- C:\dydzxqggrimsa\ydzglbs2n73fdwhc2u3ocpk.exe
- C:\dydzxqggrimsa\znhqjmt.exe
- C:\dydzxqggrimsa\alw1hxxbxbu.exe
- C:\dydzxqggrimsa\ydzglbs2n73fdwhc2u3ocpk.exe
- %WINDIR%\dydzxqggrimsa\okiz9z
- 'ga#####laphilander.net':80
- 'br#####iaphilander.net':80
- 'ga#####lafrederica.net':80
- 'br#####iabertrand.net':80
- 'ga#####lepleasance.net':80
- 'an#####lapleasance.net':80
- 'ga#####labertrand.net':80
- 'br#####iafrederica.net':80
- 'sh#####lephilander.net':80
- 'gr#####orphilander.net':80
- 'sh#####lefrederica.net':80
- 'gr#####orbertrand.net':80
- 'ga#####lapleasance.net':80
- 'br#####iapleasance.net':80
- 'sh#####lebertrand.net':80
- 'an#####lafrederica.net':80
- 'gr#####leelisabeth.net':80
- 'si#####erelisabeth.net':80
- 'gr#####legloriana.net':80
- 'si#####ercheyanne.net':80
- 'kr#####leeglantine.net':80
- 'he#####oneglantine.net':80
- 'gr#####lecheyanne.net':80
- 'si#####ergloriana.net':80
- 'ga#####lephilander.net':80
- 'an#####laphilander.net':80
- 'ga#####lefrederica.net':80
- 'an#####labertrand.net':80
- 'gr#####leeglantine.net':80
- 'si#####ereglantine.net':80
- 'ga#####lebertrand.net':80
- 'th#####nabertrand.net':80
- 'ce#####nephilander.net':80
- 'th#####naphilander.net':80
- 'ce#####nebertrand.net':80
- 'je#####onfrederica.net':80
- 'br#####tepleasance.net':80
- 'je#####onpleasance.net':80
- 'ce#####nefrederica.net':80
- 'he#####onbertrand.net':80
- 'kr#####lephilander.net':80
- 'he#####onphilander.net':80
- 'kr#####lebertrand.net':80
- 'th#####nafrederica.net':80
- 'ce#####nepleasance.net':80
- 'th#####napleasance.net':80
- 'br#####tefrederica.net':80
- 'he#####tabertrand.net':80
- 'ge#####nephilander.net':80
- 'he#####taphilander.net':80
- 'ge#####nebertrand.net':80
- 'gr#####orfrederica.net':80
- 'sh#####lepleasance.net':80
- 'gr#####orpleasance.net':80
- 'ge#####nefrederica.net':80
- 'je#####onbertrand.net':80
- 'br#####tephilander.net':80
- 'je#####onphilander.net':80
- 'br#####tebertrand.net':80
- 'he#####tafrederica.net':80
- 'ge#####nepleasance.net':80
- 'he#####tapleasance.net':80
- http://ga#####laphilander.net/index.php
- http://br#####iaphilander.net/index.php
- http://ga#####lafrederica.net/index.php
- http://br#####iabertrand.net/index.php
- http://ga#####lepleasance.net/index.php
- http://an#####lapleasance.net/index.php
- http://ga#####labertrand.net/index.php
- http://br#####iafrederica.net/index.php
- http://sh#####lephilander.net/index.php
- http://gr#####orphilander.net/index.php
- http://sh#####lefrederica.net/index.php
- http://gr#####orbertrand.net/index.php
- http://ga#####lapleasance.net/index.php
- http://br#####iapleasance.net/index.php
- http://sh#####lebertrand.net/index.php
- http://an#####lafrederica.net/index.php
- http://gr#####leelisabeth.net/index.php
- http://si#####erelisabeth.net/index.php
- http://gr#####legloriana.net/index.php
- http://si#####ercheyanne.net/index.php
- http://kr#####leeglantine.net/index.php
- http://he#####oneglantine.net/index.php
- http://gr#####lecheyanne.net/index.php
- http://si#####ergloriana.net/index.php
- http://ga#####lephilander.net/index.php
- http://an#####laphilander.net/index.php
- http://ga#####lefrederica.net/index.php
- http://an#####labertrand.net/index.php
- http://gr#####leeglantine.net/index.php
- http://si#####ereglantine.net/index.php
- http://ga#####lebertrand.net/index.php
- http://th#####nabertrand.net/index.php
- http://ce#####nephilander.net/index.php
- http://th#####naphilander.net/index.php
- http://ce#####nebertrand.net/index.php
- http://je#####onfrederica.net/index.php
- http://br#####tepleasance.net/index.php
- http://je#####onpleasance.net/index.php
- http://ce#####nefrederica.net/index.php
- http://he#####onbertrand.net/index.php
- http://kr#####lephilander.net/index.php
- http://he#####onphilander.net/index.php
- http://kr#####lebertrand.net/index.php
- http://th#####nafrederica.net/index.php
- http://ce#####nepleasance.net/index.php
- http://th#####napleasance.net/index.php
- http://br#####tefrederica.net/index.php
- http://he#####tabertrand.net/index.php
- http://ge#####nephilander.net/index.php
- http://he#####taphilander.net/index.php
- http://ge#####nebertrand.net/index.php
- http://gr#####orfrederica.net/index.php
- http://sh#####lepleasance.net/index.php
- http://gr#####orpleasance.net/index.php
- http://ge#####nefrederica.net/index.php
- http://je#####onbertrand.net/index.php
- http://br#####tephilander.net/index.php
- http://je#####onphilander.net/index.php
- http://br#####tebertrand.net/index.php
- http://he#####tafrederica.net/index.php
- http://ge#####nepleasance.net/index.php
- http://he#####tapleasance.net/index.php
- DNS ASK br#####iabertrand.net
- DNS ASK ga#####laphilander.net
- DNS ASK br#####iaphilander.net
- DNS ASK ga#####labertrand.net
- DNS ASK an#####lafrederica.net
- DNS ASK ga#####lepleasance.net
- DNS ASK an#####lapleasance.net
- DNS ASK ga#####lafrederica.net
- DNS ASK gr#####orbertrand.net
- DNS ASK sh#####lephilander.net
- DNS ASK gr#####orphilander.net
- DNS ASK sh#####lebertrand.net
- DNS ASK br#####iafrederica.net
- DNS ASK ga#####lapleasance.net
- DNS ASK br#####iapleasance.net
- DNS ASK ga#####lefrederica.net
- DNS ASK si#####ercheyanne.net
- DNS ASK gr#####leelisabeth.net
- DNS ASK si#####erelisabeth.net
- DNS ASK gr#####lecheyanne.net
- DNS ASK he#####ongloriana.net
- DNS ASK kr#####leeglantine.net
- DNS ASK he#####oneglantine.net
- DNS ASK gr#####legloriana.net
- DNS ASK an#####labertrand.net
- DNS ASK ga#####lephilander.net
- DNS ASK an#####laphilander.net
- DNS ASK ga#####lebertrand.net
- DNS ASK si#####ergloriana.net
- DNS ASK gr#####leeglantine.net
- DNS ASK si#####ereglantine.net
- DNS ASK sh#####lefrederica.net
- DNS ASK th#####nabertrand.net
- DNS ASK ce#####nephilander.net
- DNS ASK th#####naphilander.net
- DNS ASK ce#####nebertrand.net
- DNS ASK je#####onfrederica.net
- DNS ASK br#####tepleasance.net
- DNS ASK je#####onpleasance.net
- DNS ASK ce#####nefrederica.net
- DNS ASK he#####onbertrand.net
- DNS ASK kr#####lephilander.net
- DNS ASK he#####onphilander.net
- DNS ASK kr#####lebertrand.net
- DNS ASK th#####nafrederica.net
- DNS ASK ce#####nepleasance.net
- DNS ASK th#####napleasance.net
- DNS ASK br#####tefrederica.net
- DNS ASK he#####tabertrand.net
- DNS ASK ge#####nephilander.net
- DNS ASK he#####taphilander.net
- DNS ASK ge#####nebertrand.net
- DNS ASK gr#####orfrederica.net
- DNS ASK sh#####lepleasance.net
- DNS ASK gr#####orpleasance.net
- DNS ASK ge#####nefrederica.net
- DNS ASK je#####onbertrand.net
- DNS ASK br#####tephilander.net
- DNS ASK je#####onphilander.net
- DNS ASK br#####tebertrand.net
- DNS ASK he#####tafrederica.net
- DNS ASK ge#####nepleasance.net
- DNS ASK he#####tapleasance.net