Technical Information
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Offline Ordering Sharing Group Search CNG' = 'C:\qffesdbxzahe\hyoquvz0j0wpj.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\Cryptographic Identity Connections] 'ImagePath' = 'C:\qffesdbxzahe\hyoquvz0j0wpj.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\Cryptographic Identity Connections] 'Start' = '00000002'
- 'C:\qffesdbxzahe\ugs1zyqbze.exe' "c:\qffesdbxzahe\hyoquvz0j0wpj.exe"
- 'C:\qffesdbxzahe\hyoquvz0j0wpj.exe'
- 'C:\qffesdbxzahe\tbyx4h2lkhyzyocw1g3svr.exe'
- C:\qffesdbxzahe\hyoquvz0j0wpj.exe
- C:\qffesdbxzahe\ugs1zyqbze.exe
- C:\qffesdbxzahe\bmjaaazv
- %WINDIR%\qffesdbxzahe\kltt78j
- C:\qffesdbxzahe\kltt78j
- C:\qffesdbxzahe\tbyx4h2lkhyzyocw1g3svr.exe
- C:\qffesdbxzahe\ugs1zyqbze.exe
- C:\qffesdbxzahe\hyoquvz0j0wpj.exe
- C:\qffesdbxzahe\tbyx4h2lkhyzyocw1g3svr.exe
- %WINDIR%\qffesdbxzahe\kltt78j
- 'ma######asummerfield.net':80
- 'al######asummerfield.net':80
- 'al#####rawinchester.net':80
- 'al######amottershead.net':80
- 'ma#####nawinchester.net':80
- 'ce######emottershead.net':80
- 'am#####newinchester.net':80
- 'am######emottershead.net':80
- 'ma#####nachristison.net':80
- 'al#####rachristison.net':80
- 'ka#####newinchester.net':80
- 'al#####erwinchester.net':80
- 'al######rmottershead.net':80
- 'ch#####anautenberry.net':80
- 'ka######emottershead.net':80
- 'al#####erchristison.net':80
- 'ma######amottershead.net':80
- 'ka#####nechristison.net':80
- 'ka######esummerfield.net':80
- 'al######rsummerfield.net':80
- 'ce#####newinchester.net':80
- 'za######hmottershead.net':80
- 'ar#####ldwinchester.net':80
- 'ar######dmottershead.net':80
- 'ch#####nechristison.net':80
- 'sh#####lechristison.net':80
- 'ar#####ldchristison.net':80
- 'za#####ahchristison.net':80
- 'za######hsummerfield.net':80
- 'za#####ahwinchester.net':80
- 'ar######dsummerfield.net':80
- 'ce#####nechristison.net':80
- 'ch######emottershead.net':80
- 'am#####nechristison.net':80
- 'am######esummerfield.net':80
- 'ce######esummerfield.net':80
- 'ch######esummerfield.net':80
- 'sh######esummerfield.net':80
- 'sh#####lewinchester.net':80
- 'sh######emottershead.net':80
- 'ch#####newinchester.net':80
- 'za######hchristianson.net':80
- 'ar#####ldmichaelson.net':80
- 'ar######dchristianson.net':80
- 'ch#####neautenberry.net':80
- 'sh#####leautenberry.net':80
- 'ar#####ldautenberry.net':80
- 'za#####ahautenberry.net':80
- 'za######hpaternoster.net':80
- 'za#####ahmichaelson.net':80
- 'ar######dpaternoster.net':80
- 'ce#####neautenberry.net':80
- 'ch######echristianson.net':80
- 'am#####neautenberry.net':80
- 'am######epaternoster.net':80
- 'ce######epaternoster.net':80
- 'ch######epaternoster.net':80
- 'sh######epaternoster.net':80
- 'sh#####lemichaelson.net':80
- 'sh######echristianson.net':80
- 'ch#####nemichaelson.net':80
- 'ge######achristianson.net':80
- 'gw######echristianson.net':80
- 'ch######nchristianson.net':80
- 'gu#####enautenberry.net':80
- 'gu######npaternoster.net':80
- 'an#####leautenberry.net':80
- 'ch######npaternoster.net':80
- 'gw#####reautenberry.net':80
- 'gw######epaternoster.net':80
- 'gw#####remichaelson.net':80
- 'ch#####anmichaelson.net':80
- 'ge#####naautenberry.net':80
- 'ch#####leautenberry.net':80
- 'ge######apaternoster.net':80
- 'ge#####namichaelson.net':80
- 'ch#####lemichaelson.net':80
- 'gu#####enmichaelson.net':80
- 'an######epaternoster.net':80
- 'an#####lemichaelson.net':80
- 'an######echristianson.net':80
- 'gu######nchristianson.net':80
- http://ma######asummerfield.net/index.php
- http://al######asummerfield.net/index.php
- http://al#####rawinchester.net/index.php
- http://al######amottershead.net/index.php
- http://ma#####nawinchester.net/index.php
- http://ce######emottershead.net/index.php
- http://am#####newinchester.net/index.php
- http://am######emottershead.net/index.php
- http://ma#####nachristison.net/index.php
- http://al#####rachristison.net/index.php
- http://ka#####newinchester.net/index.php
- http://al#####erwinchester.net/index.php
- http://al######rmottershead.net/index.php
- http://ch#####anautenberry.net/index.php
- http://ka######emottershead.net/index.php
- http://al#####erchristison.net/index.php
- http://ma######amottershead.net/index.php
- http://ka#####nechristison.net/index.php
- http://ka######esummerfield.net/index.php
- http://al######rsummerfield.net/index.php
- http://ce#####newinchester.net/index.php
- http://za######hmottershead.net/index.php
- http://ar#####ldwinchester.net/index.php
- http://ar######dmottershead.net/index.php
- http://ch#####nechristison.net/index.php
- http://sh#####lechristison.net/index.php
- http://ar#####ldchristison.net/index.php
- http://za#####ahchristison.net/index.php
- http://za######hsummerfield.net/index.php
- http://za#####ahwinchester.net/index.php
- http://ar######dsummerfield.net/index.php
- http://ce#####nechristison.net/index.php
- http://ch######emottershead.net/index.php
- http://am#####nechristison.net/index.php
- http://am######esummerfield.net/index.php
- http://ce######esummerfield.net/index.php
- http://ch######esummerfield.net/index.php
- http://sh######esummerfield.net/index.php
- http://sh#####lewinchester.net/index.php
- http://sh######emottershead.net/index.php
- http://ch#####newinchester.net/index.php
- http://za######hchristianson.net/index.php
- http://ar#####ldmichaelson.net/index.php
- http://ar######dchristianson.net/index.php
- http://ch#####neautenberry.net/index.php
- http://sh#####leautenberry.net/index.php
- http://ar#####ldautenberry.net/index.php
- http://za#####ahautenberry.net/index.php
- http://za######hpaternoster.net/index.php
- http://za#####ahmichaelson.net/index.php
- http://ar######dpaternoster.net/index.php
- http://ce#####neautenberry.net/index.php
- http://ch######echristianson.net/index.php
- http://am#####neautenberry.net/index.php
- http://am######epaternoster.net/index.php
- http://ce######epaternoster.net/index.php
- http://ch######epaternoster.net/index.php
- http://sh######epaternoster.net/index.php
- http://sh#####lemichaelson.net/index.php
- http://sh######echristianson.net/index.php
- http://ch#####nemichaelson.net/index.php
- http://ge######achristianson.net/index.php
- http://gw######echristianson.net/index.php
- http://ch######nchristianson.net/index.php
- http://gu#####enautenberry.net/index.php
- http://gu######npaternoster.net/index.php
- http://an#####leautenberry.net/index.php
- http://ch######npaternoster.net/index.php
- http://gw#####reautenberry.net/index.php
- http://gw######epaternoster.net/index.php
- http://gw#####remichaelson.net/index.php
- http://ch#####anmichaelson.net/index.php
- http://ge#####naautenberry.net/index.php
- http://ch#####leautenberry.net/index.php
- http://ge######apaternoster.net/index.php
- http://ge#####namichaelson.net/index.php
- http://ch#####lemichaelson.net/index.php
- http://gu#####enmichaelson.net/index.php
- http://an######epaternoster.net/index.php
- http://an#####lemichaelson.net/index.php
- http://an######echristianson.net/index.php
- http://gu######nchristianson.net/index.php
- DNS ASK al######asummerfield.net
- DNS ASK ma#####nachristison.net
- DNS ASK ma######asummerfield.net
- DNS ASK ma#####nawinchester.net
- DNS ASK al#####rawinchester.net
- DNS ASK am#####newinchester.net
- DNS ASK ce#####newinchester.net
- DNS ASK ce######emottershead.net
- DNS ASK al#####rachristison.net
- DNS ASK am######emottershead.net
- DNS ASK al#####erwinchester.net
- DNS ASK ka######esummerfield.net
- DNS ASK ka#####newinchester.net
- DNS ASK ka######emottershead.net
- DNS ASK al######rmottershead.net
- DNS ASK ma######amottershead.net
- DNS ASK al######amottershead.net
- DNS ASK al#####erchristison.net
- DNS ASK al######rsummerfield.net
- DNS ASK ka#####nechristison.net
- DNS ASK am######esummerfield.net
- DNS ASK ar#####ldwinchester.net
- DNS ASK za#####ahwinchester.net
- DNS ASK za######hmottershead.net
- DNS ASK sh#####lechristison.net
- DNS ASK ar######dmottershead.net
- DNS ASK za#####ahchristison.net
- DNS ASK ge######amottershead.net
- DNS ASK ar#####ldchristison.net
- DNS ASK ar######dsummerfield.net
- DNS ASK za######hsummerfield.net
- DNS ASK ch######emottershead.net
- DNS ASK sh######emottershead.net
- DNS ASK ce#####nechristison.net
- DNS ASK ce######esummerfield.net
- DNS ASK am#####nechristison.net
- DNS ASK sh######esummerfield.net
- DNS ASK ch#####nechristison.net
- DNS ASK ch######esummerfield.net
- DNS ASK ch#####newinchester.net
- DNS ASK sh#####lewinchester.net
- DNS ASK ch#####anautenberry.net
- DNS ASK za######hchristianson.net
- DNS ASK ar#####ldmichaelson.net
- DNS ASK ar######dchristianson.net
- DNS ASK ch#####neautenberry.net
- DNS ASK sh#####leautenberry.net
- DNS ASK ar#####ldautenberry.net
- DNS ASK za#####ahautenberry.net
- DNS ASK za######hpaternoster.net
- DNS ASK za#####ahmichaelson.net
- DNS ASK ar######dpaternoster.net
- DNS ASK ce#####neautenberry.net
- DNS ASK ch######echristianson.net
- DNS ASK am#####neautenberry.net
- DNS ASK am######epaternoster.net
- DNS ASK ce######epaternoster.net
- DNS ASK ch######epaternoster.net
- DNS ASK sh######epaternoster.net
- DNS ASK sh#####lemichaelson.net
- DNS ASK sh######echristianson.net
- DNS ASK ch#####nemichaelson.net
- DNS ASK ge######achristianson.net
- DNS ASK gw######echristianson.net
- DNS ASK ch######nchristianson.net
- DNS ASK gu#####enautenberry.net
- DNS ASK gu######npaternoster.net
- DNS ASK an#####leautenberry.net
- DNS ASK ch######npaternoster.net
- DNS ASK gw#####reautenberry.net
- DNS ASK gw######epaternoster.net
- DNS ASK gw#####remichaelson.net
- DNS ASK ch#####anmichaelson.net
- DNS ASK ge#####naautenberry.net
- DNS ASK ch#####leautenberry.net
- DNS ASK ge######apaternoster.net
- DNS ASK ge#####namichaelson.net
- DNS ASK ch#####lemichaelson.net
- DNS ASK gu#####enmichaelson.net
- DNS ASK an######epaternoster.net
- DNS ASK an#####lemichaelson.net
- DNS ASK an######echristianson.net
- DNS ASK gu######nchristianson.net