Technical Information
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Group Trap COM Now Notification' = 'C:\gqipahabiwtz\mb66rsol.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\Internet Multimedia Window Acquisition] 'Start' = '00000002'
- [<HKLM>\SYSTEM\ControlSet001\Services\Internet Multimedia Window Acquisition] 'ImagePath' = 'C:\gqipahabiwtz\mb66rsol.exe'
- %WINDIR%\gqipahabiwtz\lopnb7flrgn
- C:\gqipahabiwtz\lopnb7flrgn
- C:\gqipahabiwtz\kqjkem2p2shuommkllci.exe
- C:\gqipahabiwtz\mb66rsol.exe
- C:\gqipahabiwtz\htz4uqzhknf.exe
- C:\gqipahabiwtz\jnnaaw
- C:\gqipahabiwtz\mb66rsol.exe
- C:\gqipahabiwtz\htz4uqzhknf.exe
- %WINDIR%\gqipahabiwtz\lopnb7flrgn
- C:\gqipahabiwtz\kqjkem2p2shuommkllci.exe
- %WINDIR%\gqipahabiwtz\lopnb7flrgn
- 'se#####ancharlize.net':80
- 'pr#####lasheenagh.net':80
- 'ma#####ansheenagh.net':80
- 'pr#####lasherilyn.net':80
- 'ma#####ansherilyn.net':80
- 'pr#####lacharlize.net':80
- 'ma#####ancharlize.net':80
- 'ch#####taaraminta.net':80
- 'pr#####laaraminta.net':80
- 'ka#####rasheenagh.net':80
- 'ch#####tasheenagh.net':80
- 'ka#####rasherilyn.net':80
- 'ch#####tasherilyn.net':80
- 'ka#####racharlize.net':80
- 'ch#####tacharlize.net':80
- 'ma#####anaraminta.net':80
- 'ka#####raaraminta.net':80
- 'de#####staraminta.net':80
- 'se#####anbroadbent.net':80
- 'ch#####nebroadbent.net':80
- 'se#####anharrelson.net':80
- 'ch#####naharrelson.net':80
- 'se#####anbannerman.net':80
- 'ch#####nabannerman.net':80
- 'se#####ansanderson.net':80
- 'de#####stcharlize.net':80
- 'la#####iaaraminta.net':80
- 'ch#####nabroadbent.net':80
- 'la#####iasheenagh.net':80
- 'de#####stsheenagh.net':80
- 'la#####iasherilyn.net':80
- 'de#####stsherilyn.net':80
- 'la#####iacharlize.net':80
- 'ch#####nasanderson.net':80
- 'co#####cesheenagh.net':80
- 'ha#####tasheenagh.net':80
- 'co#####cesherilyn.net':80
- 'cr#####onaraminta.net':80
- 'cl#####ndsheenagh.net':80
- 'ch#####nesheenagh.net':80
- 'cl#####ndsherilyn.net':80
- 'ch#####nesherilyn.net':80
- 'cr#####oncharlize.net':80
- 'cl#####ndcharlize.net':80
- 'cl#####ndaraminta.net':80
- 'ch#####nearaminta.net':80
- 'se#####ansheenagh.net':80
- 'ch#####nasheenagh.net':80
- 'se#####ansherilyn.net':80
- 'ch#####nasherilyn.net':80
- 'ch#####necharlize.net':80
- 'ja#####yncharlize.net':80
- 'ja#####ynaraminta.net':80
- 'cr#####onsherilyn.net':80
- 'ha#####tasherilyn.net':80
- 'ja#####tasherilyn.net':80
- 'co#####cecharlize.net':80
- 'ha#####tacharlize.net':80
- 'co#####cearaminta.net':80
- 'ha#####taaraminta.net':80
- 'ja#####tasheenagh.net':80
- 'ro#####nesheenagh.net':80
- 'ro#####nesherilyn.net':80
- 'ja#####ynsherilyn.net':80
- 'ja#####tacharlize.net':80
- 'ro#####necharlize.net':80
- 'ja#####taaraminta.net':80
- 'ro#####nearaminta.net':80
- 'ja#####ynsheenagh.net':80
- 'cr#####onsheenagh.net':80
- 'cl#####ndbroadbent.net':80
- 'ch#####nesanderson.net':80
- http://se#####ancharlize.net/index.php
- http://pr#####lasheenagh.net/index.php
- http://ma#####ansheenagh.net/index.php
- http://pr#####lasherilyn.net/index.php
- http://ma#####ansherilyn.net/index.php
- http://pr#####lacharlize.net/index.php
- http://ma#####ancharlize.net/index.php
- http://ch#####taaraminta.net/index.php
- http://pr#####laaraminta.net/index.php
- http://ka#####rasheenagh.net/index.php
- http://ch#####tasheenagh.net/index.php
- http://ka#####rasherilyn.net/index.php
- http://ch#####tasherilyn.net/index.php
- http://ka#####racharlize.net/index.php
- http://ch#####tacharlize.net/index.php
- http://ma#####anaraminta.net/index.php
- http://ka#####raaraminta.net/index.php
- http://de#####staraminta.net/index.php
- http://se#####anbroadbent.net/index.php
- http://ch#####nebroadbent.net/index.php
- http://se#####anharrelson.net/index.php
- http://ch#####naharrelson.net/index.php
- http://se#####anbannerman.net/index.php
- http://ch#####nabannerman.net/index.php
- http://se#####ansanderson.net/index.php
- http://de#####stcharlize.net/index.php
- http://la#####iaaraminta.net/index.php
- http://ch#####nabroadbent.net/index.php
- http://la#####iasheenagh.net/index.php
- http://de#####stsheenagh.net/index.php
- http://la#####iasherilyn.net/index.php
- http://de#####stsherilyn.net/index.php
- http://la#####iacharlize.net/index.php
- http://ch#####nasanderson.net/index.php
- http://co#####cesheenagh.net/index.php
- http://ha#####tasheenagh.net/index.php
- http://co#####cesherilyn.net/index.php
- http://cr#####onaraminta.net/index.php
- http://cl#####ndsheenagh.net/index.php
- http://ch#####nesheenagh.net/index.php
- http://cl#####ndsherilyn.net/index.php
- http://ch#####nesherilyn.net/index.php
- http://cr#####oncharlize.net/index.php
- http://cl#####ndcharlize.net/index.php
- http://cl#####ndaraminta.net/index.php
- http://ch#####nearaminta.net/index.php
- http://se#####ansheenagh.net/index.php
- http://ch#####nasheenagh.net/index.php
- http://se#####ansherilyn.net/index.php
- http://ch#####nasherilyn.net/index.php
- http://ch#####necharlize.net/index.php
- http://ja#####yncharlize.net/index.php
- http://ja#####ynaraminta.net/index.php
- http://cr#####onsherilyn.net/index.php
- http://ha#####tasherilyn.net/index.php
- http://ja#####tasherilyn.net/index.php
- http://co#####cecharlize.net/index.php
- http://ha#####tacharlize.net/index.php
- http://co#####cearaminta.net/index.php
- http://ha#####taaraminta.net/index.php
- http://ja#####tasheenagh.net/index.php
- http://ro#####nesheenagh.net/index.php
- http://ro#####nesherilyn.net/index.php
- http://ja#####ynsherilyn.net/index.php
- http://ja#####tacharlize.net/index.php
- http://ro#####necharlize.net/index.php
- http://ja#####taaraminta.net/index.php
- http://ro#####nearaminta.net/index.php
- http://ja#####ynsheenagh.net/index.php
- http://cr#####onsheenagh.net/index.php
- http://cl#####ndbroadbent.net/index.php
- http://ch#####nesanderson.net/index.php
- DNS ASK se#####ancharlize.net
- DNS ASK ma#####ansheenagh.net
- DNS ASK pr#####lasherilyn.net
- DNS ASK ma#####ansherilyn.net
- DNS ASK pr#####lacharlize.net
- DNS ASK ma#####ancharlize.net
- DNS ASK pr#####laaraminta.net
- DNS ASK pr#####lasheenagh.net
- DNS ASK ma#####anaraminta.net
- DNS ASK ch#####tasheenagh.net
- DNS ASK ka#####rasherilyn.net
- DNS ASK ch#####tasherilyn.net
- DNS ASK ka#####racharlize.net
- DNS ASK ch#####tacharlize.net
- DNS ASK ka#####raaraminta.net
- DNS ASK ka#####rasheenagh.net
- DNS ASK de#####staraminta.net
- DNS ASK la#####iaaraminta.net
- DNS ASK de#####stcharlize.net
- DNS ASK cl#####ndbroadbent.net
- DNS ASK ch#####nebroadbent.net
- DNS ASK se#####anharrelson.net
- DNS ASK ch#####naharrelson.net
- DNS ASK se#####anbannerman.net
- DNS ASK ch#####nabannerman.net
- DNS ASK se#####ansanderson.net
- DNS ASK ch#####nasanderson.net
- DNS ASK se#####anbroadbent.net
- DNS ASK ch#####nabroadbent.net
- DNS ASK la#####iasheenagh.net
- DNS ASK de#####stsheenagh.net
- DNS ASK la#####iasherilyn.net
- DNS ASK de#####stsherilyn.net
- DNS ASK la#####iacharlize.net
- DNS ASK ch#####taaraminta.net
- DNS ASK ch#####nesanderson.net
- DNS ASK co#####cesheenagh.net
- DNS ASK co#####cesherilyn.net
- DNS ASK ja#####ynaraminta.net
- DNS ASK cr#####onaraminta.net
- DNS ASK cl#####ndsheenagh.net
- DNS ASK ch#####nesheenagh.net
- DNS ASK cl#####ndsherilyn.net
- DNS ASK ch#####nesherilyn.net
- DNS ASK cr#####oncharlize.net
- DNS ASK cl#####ndcharlize.net
- DNS ASK cl#####ndaraminta.net
- DNS ASK ch#####nearaminta.net
- DNS ASK se#####ansheenagh.net
- DNS ASK ch#####nasheenagh.net
- DNS ASK se#####ansherilyn.net
- DNS ASK ch#####nasherilyn.net
- DNS ASK ch#####necharlize.net
- DNS ASK ja#####yncharlize.net
- DNS ASK cr#####onsherilyn.net
- DNS ASK ja#####ynsherilyn.net
- DNS ASK ha#####tasherilyn.net
- DNS ASK co#####cecharlize.net
- DNS ASK ha#####tacharlize.net
- DNS ASK co#####cearaminta.net
- DNS ASK ha#####taaraminta.net
- DNS ASK ja#####tasheenagh.net
- DNS ASK ro#####nesheenagh.net
- DNS ASK ja#####tasherilyn.net
- DNS ASK ro#####nesherilyn.net
- DNS ASK ja#####tacharlize.net
- DNS ASK ro#####necharlize.net
- DNS ASK ja#####taaraminta.net
- DNS ASK ro#####nearaminta.net
- DNS ASK ja#####ynsheenagh.net
- DNS ASK cr#####onsheenagh.net
- DNS ASK ha#####tasheenagh.net
- DNS ASK cl#####ndsanderson.net
- 'C:\gqipahabiwtz\kqjkem2p2shuommkllci.exe'
- 'C:\gqipahabiwtz\mb66rsol.exe'
- 'C:\gqipahabiwtz\htz4uqzhknf.exe' "c:\gqipahabiwtz\mb66rsol.exe"