Technical Information
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Tools Access Virtual Drive Services SNMP' = 'C:\qgikdtociazet\wqjphghqpd.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\Installer Internet DCOM Access Thread] 'ImagePath' = 'C:\qgikdtociazet\wqjphghqpd.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\Installer Internet DCOM Access Thread] 'Start' = '00000002'
- 'C:\qgikdtociazet\keymacdbjyii.exe' "c:\qgikdtociazet\wqjphghqpd.exe"
- 'C:\qgikdtociazet\wqjphghqpd.exe'
- 'C:\qgikdtociazet\vo2qx7fkajcngln9.exe'
- C:\qgikdtociazet\wqjphghqpd.exe
- C:\qgikdtociazet\keymacdbjyii.exe
- C:\qgikdtociazet\vo2qx7fkajcngln9.exe
- %WINDIR%\qgikdtociazet\qkoczxdoxj
- C:\qgikdtociazet\qkoczxdoxj
- C:\qgikdtociazet\keymacdbjyii.exe
- C:\qgikdtociazet\wqjphghqpd.exe
- C:\qgikdtociazet\vo2qx7fkajcngln9.exe
- %WINDIR%\qgikdtociazet\qkoczxdoxj
- 'fi###early.net':80
- 'pa###safety.net':80
- 'fi###smell.net':80
- 'pa###early.net':80
- 'fi###future.net':80
- 'fr####eparate.net':80
- 'fi###safety.net':80
- 'pa###future.net':80
- 'pa###smell.net':80
- 'wo###early.net':80
- 'sm###early.net':80
- 'wo###smell.net':80
- 'sm###smell.net':80
- 'wo###future.net':80
- 'sm###future.net':80
- 'wo###safety.net':80
- 'sm###safety.net':80
- 'ex#####nceseparate.net':80
- 'al####yclothes.net':80
- 'ge#####andistant.net':80
- 'al####yhealth.net':80
- 'ge#####anclothes.net':80
- 'me####separate.net':80
- 'fo####health.net':80
- 'al####ydistant.net':80
- 'fo####separate.net':80
- 'ge####manhealth.net':80
- 'fr####lothes.net':80
- 'ex#####nceclothes.net':80
- 'fr###health.net':80
- 'ex#####ncehealth.net':80
- 'ge#####anseparate.net':80
- 'al####yseparate.net':80
- 'fr####istant.net':80
- 'ex#####ncedistant.net':80
- 'wa###future.net':80
- 'me####future.net':80
- 'be###smell.net':80
- 'me####safety.net':80
- 'fo####future.net':80
- 'kn###early.net':80
- 'be###safety.net':80
- 'kn###smell.net':80
- 'be###early.net':80
- 'fo####safety.net':80
- 'ge####manfuture.net':80
- 'al####yfuture.net':80
- 'ge####mansafety.net':80
- 'al####ysafety.net':80
- 'fo###wearly.net':80
- 'me###rearly.net':80
- 'fo###wsmell.net':80
- 'me###rsmell.net':80
- 'kn###safety.net':80
- 'wa###smell.net':80
- 'th####tearly.net':80
- 'cr###future.net':80
- 'th####tsmell.net':80
- 'wa###safety.net':80
- 'th####tfuture.net':80
- 'wa###early.net':80
- 'th####tsafety.net':80
- 'su####future.net':80
- 'su###rsmell.net':80
- 'cr###smell.net':80
- 'be###future.net':80
- 'kn###future.net':80
- 'su####safety.net':80
- 'cr###safety.net':80
- 'su###rearly.net':80
- 'cr###early.net':80
- http://fi###early.net/index.php
- http://pa###safety.net/index.php
- http://fi###smell.net/index.php
- http://pa###early.net/index.php
- http://fi###future.net/index.php
- http://fr####eparate.net/index.php
- http://fi###safety.net/index.php
- http://pa###future.net/index.php
- http://pa###smell.net/index.php
- http://wo###early.net/index.php
- http://sm###early.net/index.php
- http://wo###smell.net/index.php
- http://sm###smell.net/index.php
- http://wo###future.net/index.php
- http://sm###future.net/index.php
- http://wo###safety.net/index.php
- http://sm###safety.net/index.php
- http://ex#####nceseparate.net/index.php
- http://al####yclothes.net/index.php
- http://ge#####andistant.net/index.php
- http://al####yhealth.net/index.php
- http://ge#####anclothes.net/index.php
- http://me####separate.net/index.php
- http://fo####health.net/index.php
- http://al####ydistant.net/index.php
- http://fo####separate.net/index.php
- http://ge####manhealth.net/index.php
- http://fr####lothes.net/index.php
- http://ex#####nceclothes.net/index.php
- http://fr###health.net/index.php
- http://ex#####ncehealth.net/index.php
- http://ge#####anseparate.net/index.php
- http://al####yseparate.net/index.php
- http://fr####istant.net/index.php
- http://ex#####ncedistant.net/index.php
- http://wa###future.net/index.php
- http://me####future.net/index.php
- http://be###smell.net/index.php
- http://me####safety.net/index.php
- http://fo####future.net/index.php
- http://kn###early.net/index.php
- http://be###safety.net/index.php
- http://kn###smell.net/index.php
- http://be###early.net/index.php
- http://fo####safety.net/index.php
- http://ge####manfuture.net/index.php
- http://al####yfuture.net/index.php
- http://ge####mansafety.net/index.php
- http://al####ysafety.net/index.php
- http://fo###wearly.net/index.php
- http://me###rearly.net/index.php
- http://fo###wsmell.net/index.php
- http://me###rsmell.net/index.php
- http://kn###safety.net/index.php
- http://wa###smell.net/index.php
- http://th####tearly.net/index.php
- http://cr###future.net/index.php
- http://th####tsmell.net/index.php
- http://wa###safety.net/index.php
- http://th####tfuture.net/index.php
- http://wa###early.net/index.php
- http://th####tsafety.net/index.php
- http://su####future.net/index.php
- http://su###rsmell.net/index.php
- http://cr###smell.net/index.php
- http://be###future.net/index.php
- http://kn###future.net/index.php
- http://su####safety.net/index.php
- http://cr###safety.net/index.php
- http://su###rearly.net/index.php
- http://cr###early.net/index.php
- DNS ASK fi###early.net
- DNS ASK pa###safety.net
- DNS ASK fi###smell.net
- DNS ASK pa###early.net
- DNS ASK fi###safety.net
- DNS ASK fr####eparate.net
- DNS ASK ex#####nceseparate.net
- DNS ASK pa###future.net
- DNS ASK fi###future.net
- DNS ASK wo###early.net
- DNS ASK sm###early.net
- DNS ASK wo###smell.net
- DNS ASK sm###smell.net
- DNS ASK wo###safety.net
- DNS ASK sm###future.net
- DNS ASK pa###smell.net
- DNS ASK sm###safety.net
- DNS ASK wo###future.net
- DNS ASK al####yclothes.net
- DNS ASK ge#####andistant.net
- DNS ASK al####yhealth.net
- DNS ASK ge#####anclothes.net
- DNS ASK al####ydistant.net
- DNS ASK fo####health.net
- DNS ASK me####health.net
- DNS ASK fo####separate.net
- DNS ASK me####separate.net
- DNS ASK fr####lothes.net
- DNS ASK ex#####nceclothes.net
- DNS ASK fr###health.net
- DNS ASK ex#####ncehealth.net
- DNS ASK fr####istant.net
- DNS ASK al####yseparate.net
- DNS ASK ge####manhealth.net
- DNS ASK ex#####ncedistant.net
- DNS ASK ge#####anseparate.net
- DNS ASK me####future.net
- DNS ASK be###smell.net
- DNS ASK me####safety.net
- DNS ASK fo####future.net
- DNS ASK kn###smell.net
- DNS ASK be###safety.net
- DNS ASK kn###safety.net
- DNS ASK be###early.net
- DNS ASK kn###early.net
- DNS ASK ge####manfuture.net
- DNS ASK al####yfuture.net
- DNS ASK ge####mansafety.net
- DNS ASK al####ysafety.net
- DNS ASK fo###wsmell.net
- DNS ASK me###rearly.net
- DNS ASK fo####safety.net
- DNS ASK me###rsmell.net
- DNS ASK fo###wearly.net
- DNS ASK wa###smell.net
- DNS ASK th####tearly.net
- DNS ASK cr###future.net
- DNS ASK th####tsmell.net
- DNS ASK wa###early.net
- DNS ASK th####tfuture.net
- DNS ASK wa###future.net
- DNS ASK th####tsafety.net
- DNS ASK wa###safety.net
- DNS ASK su###rsmell.net
- DNS ASK cr###smell.net
- DNS ASK be###future.net
- DNS ASK kn###future.net
- DNS ASK su###rearly.net
- DNS ASK cr###safety.net
- DNS ASK su####future.net
- DNS ASK cr###early.net
- DNS ASK su####safety.net
- ClassName: 'Shell_TrayWnd' WindowName: ''