Technical Information
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Registry UserMode Virtual File' = 'C:\sinohjongls\edzmypuokssp.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\Instrumentation Engine Credential] 'ImagePath' = 'C:\sinohjongls\edzmypuokssp.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\Instrumentation Engine Credential] 'Start' = '00000002'
- 'C:\sinohjongls\rpyiyql.exe' "c:\sinohjongls\edzmypuokssp.exe"
- 'C:\sinohjongls\edzmypuokssp.exe'
- 'C:\sinohjongls\n8v2jjkoqvtffxzhi.exe'
- C:\sinohjongls\edzmypuokssp.exe
- C:\sinohjongls\rpyiyql.exe
- C:\sinohjongls\jefsqsy
- %WINDIR%\sinohjongls\qynf7mwdkq
- C:\sinohjongls\qynf7mwdkq
- C:\sinohjongls\n8v2jjkoqvtffxzhi.exe
- C:\sinohjongls\rpyiyql.exe
- C:\sinohjongls\edzmypuokssp.exe
- C:\sinohjongls\n8v2jjkoqvtffxzhi.exe
- %WINDIR%\sinohjongls\qynf7mwdkq
- %WINDIR%\sinohjongls\qynf7mwdkq
- 'po#####estraight.net':80
- 'mo####inguard.net':80
- 'po#####eairplane.net':80
- 'mo#####nstraight.net':80
- 'po####lefence.net':80
- 'pe####sairplane.net':80
- 'po####leguard.net':80
- 'mo####infence.net':80
- 'mo####straight.net':80
- 'si###eguard.net':80
- 'mo####airplane.net':80
- 'si####straight.net':80
- 'mo###rfence.net':80
- 'mo#####nairplane.net':80
- 'mo###rguard.net':80
- 'si###efence.net':80
- 'wi####airplane.net':80
- 'wi###rfence.net':80
- 'su####tfence.net':80
- 'wi###rguard.net':80
- 'su####tguard.net':80
- 'fi####straight.net':80
- 'le####traight.net':80
- 'fi####airplane.net':80
- 'le####irplane.net':80
- 'pe####sguard.net':80
- 'wi###wguard.net':80
- 'pe####sstraight.net':80
- 'wi####straight.net':80
- 'su####tairplane.net':80
- 'su####tstraight.net':80
- 'pe####sfence.net':80
- 'wi###wfence.net':80
- 'sw###spring.net':80
- 'pr####lyspring.net':80
- 'sw###found.net':80
- 'pr####lyfound.net':80
- 'sw###banker.net':80
- 'pr####lybanker.net':80
- 'sw####uccess.net':80
- 'pr####lysuccess.net':80
- 'fi####spring.net':80
- 'le###spring.net':80
- 'fi###hfound.net':80
- 'le###found.net':80
- 'fi####banker.net':80
- 'le###banker.net':80
- 'fi####success.net':80
- 'le####uccess.net':80
- 'se####lfound.net':80
- 'la####traight.net':80
- 'se###aguard.net':80
- 'la####irplane.net':80
- 'se####straight.net':80
- 'la###fence.net':80
- 'si####airplane.net':80
- 'la###guard.net':80
- 'se###afence.net':80
- 'ma####alspring.net':80
- 'se####lsuccess.net':80
- 'ma####alfound.net':80
- 'se####lspring.net':80
- 'ma####albanker.net':80
- 'se####airplane.net':80
- 'ma####alsuccess.net':80
- 'se####lbanker.net':80
- http://po#####estraight.net/index.php?me########
- http://mo####inguard.net/index.php?me########
- http://po#####eairplane.net/index.php?me########
- http://mo#####nstraight.net/index.php?me########
- http://po####lefence.net/index.php?me########
- http://pe####sairplane.net/index.php?me########
- http://po####leguard.net/index.php?me########
- http://mo####infence.net/index.php?me########
- http://mo####straight.net/index.php?me########
- http://si###eguard.net/index.php?me########
- http://mo####airplane.net/index.php?me########
- http://si####straight.net/index.php?me########
- http://mo###rfence.net/index.php?me########
- http://mo#####nairplane.net/index.php?me########
- http://mo###rguard.net/index.php?me########
- http://si###efence.net/index.php?me########
- http://wi####airplane.net/index.php?me########
- http://wi###rfence.net/index.php?me########
- http://su####tfence.net/index.php?me########
- http://wi###rguard.net/index.php?me########
- http://su####tguard.net/index.php?me########
- http://fi####straight.net/index.php?me########
- http://le####traight.net/index.php?me########
- http://fi####airplane.net/index.php?me########
- http://le####irplane.net/index.php?me########
- http://pe####sguard.net/index.php?me########
- http://wi###wguard.net/index.php?me########
- http://pe####sstraight.net/index.php?me########
- http://wi####straight.net/index.php?me########
- http://su####tairplane.net/index.php?me########
- http://su####tstraight.net/index.php?me########
- http://pe####sfence.net/index.php?me########
- http://wi###wfence.net/index.php?me########
- http://sw###spring.net/index.php?me########
- http://pr####lyspring.net/index.php?me########
- http://sw###found.net/index.php?me########
- http://pr####lyfound.net/index.php?me########
- http://sw###banker.net/index.php?me########
- http://pr####lybanker.net/index.php?me########
- http://sw####uccess.net/index.php?me########
- http://pr####lysuccess.net/index.php?me########
- http://fi####spring.net/index.php?me########
- http://le###spring.net/index.php?me########
- http://fi###hfound.net/index.php?me########
- http://le###found.net/index.php?me########
- http://fi####banker.net/index.php?me########
- http://le###banker.net/index.php?me########
- http://fi####success.net/index.php?me########
- http://le####uccess.net/index.php?me########
- http://se####lfound.net/index.php?me########
- http://la####traight.net/index.php?me########
- http://se###aguard.net/index.php?me########
- http://la####irplane.net/index.php?me########
- http://se####straight.net/index.php?me########
- http://la###fence.net/index.php?me########
- http://si####airplane.net/index.php?me########
- http://la###guard.net/index.php?me########
- http://se###afence.net/index.php?me########
- http://ma####alspring.net/index.php?me########
- http://se####lsuccess.net/index.php?me########
- http://ma####alfound.net/index.php?me########
- http://se####lspring.net/index.php?me########
- http://ma####albanker.net/index.php?me########
- http://se####airplane.net/index.php?me########
- http://ma####alsuccess.net/index.php?me########
- http://se####lbanker.net/index.php?me########
- DNS ASK mo####inguard.net
- DNS ASK po####leguard.net
- DNS ASK mo#####nstraight.net
- DNS ASK po#####estraight.net
- DNS ASK pe####sairplane.net
- DNS ASK wi####airplane.net
- DNS ASK mo####infence.net
- DNS ASK po####lefence.net
- DNS ASK si###eguard.net
- DNS ASK mo###rguard.net
- DNS ASK si####straight.net
- DNS ASK mo####straight.net
- DNS ASK mo#####nairplane.net
- DNS ASK po#####eairplane.net
- DNS ASK si###efence.net
- DNS ASK mo###rfence.net
- DNS ASK pe####sstraight.net
- DNS ASK su####tfence.net
- DNS ASK fi####airplane.net
- DNS ASK su####tguard.net
- DNS ASK wi###rfence.net
- DNS ASK le####traight.net
- DNS ASK fi###hguard.net
- DNS ASK le####irplane.net
- DNS ASK fi####straight.net
- DNS ASK wi###wguard.net
- DNS ASK pe####sfence.net
- DNS ASK wi####straight.net
- DNS ASK pe####sguard.net
- DNS ASK su####tstraight.net
- DNS ASK wi###rguard.net
- DNS ASK wi###wfence.net
- DNS ASK su####tairplane.net
- DNS ASK mo####airplane.net
- DNS ASK sw###spring.net
- DNS ASK pr####lyspring.net
- DNS ASK sw###found.net
- DNS ASK pr####lyfound.net
- DNS ASK sw###banker.net
- DNS ASK pr####lybanker.net
- DNS ASK sw####uccess.net
- DNS ASK pr####lysuccess.net
- DNS ASK fi####spring.net
- DNS ASK le###spring.net
- DNS ASK fi###hfound.net
- DNS ASK le###found.net
- DNS ASK fi####banker.net
- DNS ASK le###banker.net
- DNS ASK fi####success.net
- DNS ASK le####uccess.net
- DNS ASK se####lfound.net
- DNS ASK la####traight.net
- DNS ASK se###aguard.net
- DNS ASK la####irplane.net
- DNS ASK se####straight.net
- DNS ASK la###fence.net
- DNS ASK si####airplane.net
- DNS ASK la###guard.net
- DNS ASK se###afence.net
- DNS ASK ma####alspring.net
- DNS ASK se####lsuccess.net
- DNS ASK ma####alfound.net
- DNS ASK se####lspring.net
- DNS ASK ma####albanker.net
- DNS ASK se####airplane.net
- DNS ASK ma####alsuccess.net
- DNS ASK se####lbanker.net