Technical Information
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Disk Log Net.Tcp UserMode Process' = 'C:\edxhmqqkmdje5\fpiufq7.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\TPM Adaptive Redirector Workstation Auto-Discovery] 'Start' = '00000002'
- [<HKLM>\SYSTEM\ControlSet001\Services\TPM Adaptive Redirector Workstation Auto-Discovery] 'ImagePath' = 'C:\edxhmqqkmdje5\fpiufq7.exe'
- %WINDIR%\edxhmqqkmdje5\zxswu7s
- C:\edxhmqqkmdje5\zxswu7s
- C:\edxhmqqkmdje5\oaeui1jb2wfzyezpuzybhcz.exe
- C:\edxhmqqkmdje5\fpiufq7.exe
- C:\edxhmqqkmdje5\pwvowdgjh6i.exe
- C:\edxhmqqkmdje5\spr5vni
- C:\edxhmqqkmdje5\fpiufq7.exe
- C:\edxhmqqkmdje5\pwvowdgjh6i.exe
- %WINDIR%\edxhmqqkmdje5\zxswu7s
- C:\edxhmqqkmdje5\oaeui1jb2wfzyezpuzybhcz.exe
- %WINDIR%\edxhmqqkmdje5\zxswu7s
- 'ma#####anfleurette.net':80
- 'cr######nchristinsen.net':80
- 'ja######nchristinsen.net':80
- 'cr#####ongabrielson.net':80
- 'ja#####yngabrielson.net':80
- 'cr######ncollingwood.net':80
- 'ja######ncollingwood.net':80
- 'cr#####onstephenson.net':80
- 'ja#####ynstephenson.net':80
- 'ro######echristinsen.net':80
- 'ja######achristinsen.net':80
- 'ro#####negabrielson.net':80
- 'ja#####tagabrielson.net':80
- 'ro######ecollingwood.net':80
- 'ja######acollingwood.net':80
- 'ro#####nestephenson.net':80
- 'ja#####tastephenson.net':80
- 'ha######achristinsen.net':80
- 'co######echristinsen.net':80
- 'ha#####tagabrielson.net':80
- 'co#####cegabrielson.net':80
- 'ha######acollingwood.net':80
- 'co######ecollingwood.net':80
- 'ha#####tastephenson.net':80
- 'co#####cestephenson.net':80
- 'ka######achristinsen.net':80
- 'ch#####tagabrielson.net':80
- 'ka#####ragabrielson.net':80
- 'cl#####ndstephenson.net':80
- 'ka######acollingwood.net':80
- 'ch#####nestephenson.net':80
- 'ch######ecollingwood.net':80
- 'pr#####lafleurette.net':80
- 'ma#####anwinthrop.net':80
- 'pr#####lawinthrop.net':80
- 'ma#####anmackenzie.net':80
- 'pr#####lamackenzie.net':80
- 'ma#####anjermaine.net':80
- 'pr#####lajermaine.net':80
- 'de#####stfleurette.net':80
- 'la#####iafleurette.net':80
- 'de#####stwinthrop.net':80
- 'la#####iawinthrop.net':80
- 'de#####stmackenzie.net':80
- 'la#####iamackenzie.net':80
- 'de#####stjermaine.net':80
- 'la#####iajermaine.net':80
- 'ch######achristinsen.net':80
- 'se######nchristinsen.net':80
- 'ch#####nagabrielson.net':80
- 'se#####angabrielson.net':80
- 'ch######acollingwood.net':80
- 'se######ncollingwood.net':80
- 'ch#####nastephenson.net':80
- 'se#####anstephenson.net':80
- 'ch######echristinsen.net':80
- 'cl######dchristinsen.net':80
- 'ch#####negabrielson.net':80
- 'cl#####ndgabrielson.net':80
- 'cl######dcollingwood.net':80
- 'ch#####tastephenson.net':80
- http://ma#####anfleurette.net/index.php
- http://cr######nchristinsen.net/index.php
- http://ja######nchristinsen.net/index.php
- http://cr#####ongabrielson.net/index.php
- http://ja#####yngabrielson.net/index.php
- http://cr######ncollingwood.net/index.php
- http://ja######ncollingwood.net/index.php
- http://cr#####onstephenson.net/index.php
- http://ja#####ynstephenson.net/index.php
- http://ro######echristinsen.net/index.php
- http://ja######achristinsen.net/index.php
- http://ro#####negabrielson.net/index.php
- http://ja#####tagabrielson.net/index.php
- http://ro######ecollingwood.net/index.php
- http://ja######acollingwood.net/index.php
- http://ro#####nestephenson.net/index.php
- http://ja#####tastephenson.net/index.php
- http://ha######achristinsen.net/index.php
- http://co######echristinsen.net/index.php
- http://ha#####tagabrielson.net/index.php
- http://co#####cegabrielson.net/index.php
- http://ha######acollingwood.net/index.php
- http://co######ecollingwood.net/index.php
- http://ha#####tastephenson.net/index.php
- http://co#####cestephenson.net/index.php
- http://ka######achristinsen.net/index.php
- http://ch#####tagabrielson.net/index.php
- http://ka#####ragabrielson.net/index.php
- http://cl#####ndstephenson.net/index.php
- http://ka######acollingwood.net/index.php
- http://ch#####nestephenson.net/index.php
- http://ch######ecollingwood.net/index.php
- http://pr#####lafleurette.net/index.php
- http://ma#####anwinthrop.net/index.php
- http://pr#####lawinthrop.net/index.php
- http://ma#####anmackenzie.net/index.php
- http://pr#####lamackenzie.net/index.php
- http://ma#####anjermaine.net/index.php
- http://pr#####lajermaine.net/index.php
- http://de#####stfleurette.net/index.php
- http://la#####iafleurette.net/index.php
- http://de#####stwinthrop.net/index.php
- http://la#####iawinthrop.net/index.php
- http://de#####stmackenzie.net/index.php
- http://la#####iamackenzie.net/index.php
- http://de#####stjermaine.net/index.php
- http://la#####iajermaine.net/index.php
- http://ch######achristinsen.net/index.php
- http://se######nchristinsen.net/index.php
- http://ch#####nagabrielson.net/index.php
- http://se#####angabrielson.net/index.php
- http://ch######acollingwood.net/index.php
- http://se######ncollingwood.net/index.php
- http://ch#####nastephenson.net/index.php
- http://se#####anstephenson.net/index.php
- http://ch######echristinsen.net/index.php
- http://cl######dchristinsen.net/index.php
- http://ch#####negabrielson.net/index.php
- http://cl#####ndgabrielson.net/index.php
- http://cl######dcollingwood.net/index.php
- http://ch#####tastephenson.net/index.php
- DNS ASK ma#####anfleurette.net
- DNS ASK cr#####ongabrielson.net
- DNS ASK ja#####yngabrielson.net
- DNS ASK cr######ncollingwood.net
- DNS ASK ja######ncollingwood.net
- DNS ASK cr#####onstephenson.net
- DNS ASK ja#####ynstephenson.net
- DNS ASK ro######echristinsen.net
- DNS ASK ja######achristinsen.net
- DNS ASK ro#####negabrielson.net
- DNS ASK ja#####tagabrielson.net
- DNS ASK ro######ecollingwood.net
- DNS ASK ja######acollingwood.net
- DNS ASK la#####iajermaine.net
- DNS ASK ro#####nestephenson.net
- DNS ASK ha######achristinsen.net
- DNS ASK co######echristinsen.net
- DNS ASK ha#####tagabrielson.net
- DNS ASK co#####cegabrielson.net
- DNS ASK ha######acollingwood.net
- DNS ASK co######ecollingwood.net
- DNS ASK ha#####tastephenson.net
- DNS ASK co#####cestephenson.net
- DNS ASK ka######achristinsen.net
- DNS ASK ch#####tagabrielson.net
- DNS ASK ka#####ragabrielson.net
- DNS ASK ka######acollingwood.net
- DNS ASK cr######nchristinsen.net
- DNS ASK ja######nchristinsen.net
- DNS ASK cl#####ndstephenson.net
- DNS ASK ch#####nestephenson.net
- DNS ASK cl######dcollingwood.net
- DNS ASK ma#####anwinthrop.net
- DNS ASK pr#####lawinthrop.net
- DNS ASK ma#####anmackenzie.net
- DNS ASK pr#####lamackenzie.net
- DNS ASK ma#####anjermaine.net
- DNS ASK pr#####lajermaine.net
- DNS ASK de#####stfleurette.net
- DNS ASK la#####iafleurette.net
- DNS ASK de#####stwinthrop.net
- DNS ASK la#####iawinthrop.net
- DNS ASK de#####stmackenzie.net
- DNS ASK la#####iamackenzie.net
- DNS ASK ch#####tastephenson.net
- DNS ASK ja#####tastephenson.net
- DNS ASK de#####stjermaine.net
- DNS ASK se######nchristinsen.net
- DNS ASK ch#####nagabrielson.net
- DNS ASK se#####angabrielson.net
- DNS ASK ch######acollingwood.net
- DNS ASK se######ncollingwood.net
- DNS ASK ch#####nastephenson.net
- DNS ASK se#####anstephenson.net
- DNS ASK ch######echristinsen.net
- DNS ASK cl######dchristinsen.net
- DNS ASK ch#####negabrielson.net
- DNS ASK cl#####ndgabrielson.net
- DNS ASK ch######ecollingwood.net
- DNS ASK pr#####lafleurette.net
- DNS ASK ch######achristinsen.net
- DNS ASK ka#####rastephenson.net
- 'C:\edxhmqqkmdje5\oaeui1jb2wfzyezpuzybhcz.exe'
- 'C:\edxhmqqkmdje5\fpiufq7.exe'
- 'C:\edxhmqqkmdje5\pwvowdgjh6i.exe' "c:\edxhmqqkmdje5\fpiufq7.exe"