Technical Information
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Font Device Mapper Logs Media Compatibility' = 'C:\dmkbcjbepscd\ttrzmoo.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\Adapter AutoConfig Topology Encrypting PC] 'Start' = '00000002'
- [<HKLM>\SYSTEM\ControlSet001\Services\Adapter AutoConfig Topology Encrypting PC] 'ImagePath' = 'C:\dmkbcjbepscd\ttrzmoo.exe'
- %WINDIR%\dmkbcjbepscd\pbcozut
- C:\dmkbcjbepscd\pbcozut
- C:\dmkbcjbepscd\vgin2l7guda8lwxen.exe
- C:\dmkbcjbepscd\ttrzmoo.exe
- C:\dmkbcjbepscd\oukogfgxgwj.exe
- C:\dmkbcjbepscd\cgbahf
- C:\dmkbcjbepscd\ttrzmoo.exe
- C:\dmkbcjbepscd\oukogfgxgwj.exe
- %WINDIR%\dmkbcjbepscd\pbcozut
- C:\dmkbcjbepscd\vgin2l7guda8lwxen.exe
- %WINDIR%\dmkbcjbepscd\pbcozut
- 'mo#####nneighbor.net':80
- 'si####garden.net':80
- 'mo####beauty.net':80
- 'si####beauty.net':80
- 'mo####report.net':80
- 'si####report.net':80
- 'mo####market.net':80
- 'si####market.net':80
- 'la###garden.net':80
- 'se####garden.net':80
- 'la###beauty.net':80
- 'se####beauty.net':80
- 'la###report.net':80
- 'se####report.net':80
- 'la###market.net':80
- 'se####market.net':80
- 'mo####garden.net':80
- 'mo####inmarket.net':80
- 'po####lemarket.net':80
- 'mo####inreport.net':80
- 'su####tbeauty.net':80
- 'su####treport.net':80
- 'su####tmarket.net':80
- 'wi####garden.net':80
- 'pe####sgarden.net':80
- 'wi####beauty.net':80
- 'pe####sbeauty.net':80
- 'pe####sreport.net':80
- 'wi####report.net':80
- 'wi####market.net':80
- 'pe####smarket.net':80
- 'po####legarden.net':80
- 'mo####ingarden.net':80
- 'po####lebeauty.net':80
- 'mo####inbeauty.net':80
- 'po####lereport.net':80
- 'su####tgarden.net':80
- 'ma####alspread.net':80
- 'se####lspread.net':80
- 'ma#####lneighbor.net':80
- 'su####tspread.net':80
- 'su####tneighbor.net':80
- 'su####tsquare.net':80
- 'su####tattempt.net':80
- 'wi####spread.net':80
- 'pe####sspread.net':80
- 'wi####neighbor.net':80
- 'pe####sneighbor.net':80
- 'wi####square.net':80
- 'pe####ssquare.net':80
- 'wi####attempt.net':80
- 'pe####sattempt.net':80
- 'po####lespread.net':80
- 'mo####inspread.net':80
- 'po#####eneighbor.net':80
- 'fi####attempt.net':80
- 'le####ttempt.net':80
- 'fi####square.net':80
- 'le###square.net':80
- 'ma####alsquare.net':80
- 'se####lsquare.net':80
- 'ma####alattempt.net':80
- 'se####lattempt.net':80
- 'pr####lyspread.net':80
- 'sw###spread.net':80
- 'pr#####yneighbor.net':80
- 'pr####lysquare.net':80
- 'sw####eighbor.net':80
- 'sw###square.net':80
- 'pr####lyattempt.net':80
- 'sw####ttempt.net':80
- 'le###spread.net':80
- 'fi####spread.net':80
- 'le####eighbor.net':80
- 'fi####neighbor.net':80
- 'se####lneighbor.net':80
- 'fi####market.net':80
- http://mo#####nneighbor.net/index.php
- http://si####garden.net/index.php
- http://mo####beauty.net/index.php
- http://si####beauty.net/index.php
- http://mo####report.net/index.php
- http://si####report.net/index.php
- http://mo####market.net/index.php
- http://si####market.net/index.php
- http://la###garden.net/index.php
- http://se####garden.net/index.php
- http://la###beauty.net/index.php
- http://se####beauty.net/index.php
- http://la###report.net/index.php
- http://se####report.net/index.php
- http://la###market.net/index.php
- http://se####market.net/index.php
- http://mo####garden.net/index.php
- http://mo####inmarket.net/index.php
- http://po####lemarket.net/index.php
- http://mo####inreport.net/index.php
- http://su####tbeauty.net/index.php
- http://su####treport.net/index.php
- http://su####tmarket.net/index.php
- http://wi####garden.net/index.php
- http://pe####sgarden.net/index.php
- http://wi####beauty.net/index.php
- http://pe####sbeauty.net/index.php
- http://pe####sreport.net/index.php
- http://wi####report.net/index.php
- http://wi####market.net/index.php
- http://pe####smarket.net/index.php
- http://po####legarden.net/index.php
- http://mo####ingarden.net/index.php
- http://po####lebeauty.net/index.php
- http://mo####inbeauty.net/index.php
- http://po####lereport.net/index.php
- http://su####tgarden.net/index.php
- http://ma####alspread.net/index.php
- http://se####lspread.net/index.php
- http://ma#####lneighbor.net/index.php
- http://su####tspread.net/index.php
- http://su####tneighbor.net/index.php
- http://su####tsquare.net/index.php
- http://su####tattempt.net/index.php
- http://wi####spread.net/index.php
- http://pe####sspread.net/index.php
- http://wi####neighbor.net/index.php
- http://pe####sneighbor.net/index.php
- http://wi####square.net/index.php
- http://pe####ssquare.net/index.php
- http://wi####attempt.net/index.php
- http://pe####sattempt.net/index.php
- http://po####lespread.net/index.php
- http://mo####inspread.net/index.php
- http://po#####eneighbor.net/index.php
- http://fi####attempt.net/index.php
- http://le####ttempt.net/index.php
- http://fi####square.net/index.php
- http://le###square.net/index.php
- http://ma####alsquare.net/index.php
- http://se####lsquare.net/index.php
- http://ma####alattempt.net/index.php
- http://se####lattempt.net/index.php
- http://pr####lyspread.net/index.php
- http://sw###spread.net/index.php
- http://pr#####yneighbor.net/index.php
- http://pr####lysquare.net/index.php
- http://sw####eighbor.net/index.php
- http://sw###square.net/index.php
- http://pr####lyattempt.net/index.php
- http://sw####ttempt.net/index.php
- http://le###spread.net/index.php
- http://fi####spread.net/index.php
- http://le####eighbor.net/index.php
- http://fi####neighbor.net/index.php
- http://se####lneighbor.net/index.php
- http://fi####market.net/index.php
- DNS ASK mo#####nneighbor.net
- DNS ASK si####garden.net
- DNS ASK mo####beauty.net
- DNS ASK si####beauty.net
- DNS ASK mo####report.net
- DNS ASK si####report.net
- DNS ASK mo####market.net
- DNS ASK si####market.net
- DNS ASK la###garden.net
- DNS ASK se####garden.net
- DNS ASK la###beauty.net
- DNS ASK se####beauty.net
- DNS ASK la###report.net
- DNS ASK se####report.net
- DNS ASK la###market.net
- DNS ASK se####market.net
- DNS ASK mo####garden.net
- DNS ASK mo####inmarket.net
- DNS ASK po####lemarket.net
- DNS ASK mo####inreport.net
- DNS ASK su####tbeauty.net
- DNS ASK su####treport.net
- DNS ASK su####tmarket.net
- DNS ASK wi####garden.net
- DNS ASK pe####sgarden.net
- DNS ASK wi####beauty.net
- DNS ASK pe####sbeauty.net
- DNS ASK pe####sreport.net
- DNS ASK wi####report.net
- DNS ASK wi####market.net
- DNS ASK pe####smarket.net
- DNS ASK po####legarden.net
- DNS ASK mo####ingarden.net
- DNS ASK po####lebeauty.net
- DNS ASK mo####inbeauty.net
- DNS ASK po####lereport.net
- DNS ASK su####tgarden.net
- DNS ASK ma####alspread.net
- DNS ASK se####lspread.net
- DNS ASK ma#####lneighbor.net
- DNS ASK su####tspread.net
- DNS ASK su####tneighbor.net
- DNS ASK su####tsquare.net
- DNS ASK su####tattempt.net
- DNS ASK wi####spread.net
- DNS ASK pe####sspread.net
- DNS ASK wi####neighbor.net
- DNS ASK pe####sneighbor.net
- DNS ASK wi####square.net
- DNS ASK pe####ssquare.net
- DNS ASK wi####attempt.net
- DNS ASK pe####sattempt.net
- DNS ASK po####lespread.net
- DNS ASK mo####inspread.net
- DNS ASK po#####eneighbor.net
- DNS ASK fi####attempt.net
- DNS ASK le####ttempt.net
- DNS ASK fi####square.net
- DNS ASK le###square.net
- DNS ASK ma####alsquare.net
- DNS ASK se####lsquare.net
- DNS ASK ma####alattempt.net
- DNS ASK se####lattempt.net
- DNS ASK pr####lyspread.net
- DNS ASK sw###spread.net
- DNS ASK pr#####yneighbor.net
- DNS ASK pr####lysquare.net
- DNS ASK sw####eighbor.net
- DNS ASK sw###square.net
- DNS ASK pr####lyattempt.net
- DNS ASK sw####ttempt.net
- DNS ASK le###spread.net
- DNS ASK fi####spread.net
- DNS ASK le####eighbor.net
- DNS ASK fi####neighbor.net
- DNS ASK se####lneighbor.net
- DNS ASK fi####market.net
- 'C:\dmkbcjbepscd\vgin2l7guda8lwxen.exe'
- 'C:\dmkbcjbepscd\ttrzmoo.exe'
- 'C:\dmkbcjbepscd\oukogfgxgwj.exe' "c:\dmkbcjbepscd\ttrzmoo.exe"