Technical Information
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'SSDP Authentication CNG Framework' = 'C:\mtlablgeb\npifhvea4wa.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\Parental DNS File Propagation Awareness] 'Start' = '00000002'
- [<HKLM>\SYSTEM\ControlSet001\Services\Parental DNS File Propagation Awareness] 'ImagePath' = 'C:\mtlablgeb\npifhvea4wa.exe'
- %WINDIR%\mtlablgeb\dgqijqtosclp
- C:\mtlablgeb\dgqijqtosclp
- C:\mtlablgeb\lveaado32f9bleaezdfl9ni.exe
- C:\mtlablgeb\npifhvea4wa.exe
- C:\mtlablgeb\oumybcbpoek.exe
- C:\mtlablgeb\q2qelry0on
- C:\mtlablgeb\npifhvea4wa.exe
- C:\mtlablgeb\oumybcbpoek.exe
- %WINDIR%\mtlablgeb\dgqijqtosclp
- C:\mtlablgeb\lveaado32f9bleaezdfl9ni.exe
- %WINDIR%\mtlablgeb\dgqijqtosclp
- 'za#####ahethelbert.net':80
- 'al#####erkingsley.net':80
- 'ka#####neanastasia.net':80
- 'al#####eranastasia.net':80
- 'ka#####neandriana.net':80
- 'al#####erandriana.net':80
- 'ma#####nacharnette.net':80
- 'al#####racharnette.net':80
- 'ma#####nakingsley.net':80
- 'al#####rakingsley.net':80
- 'ma#####naanastasia.net':80
- 'al#####raanastasia.net':80
- 'ma#####naandriana.net':80
- 'al#####raandriana.net':80
- 'am#####necharnette.net':80
- 'ce#####necharnette.net':80
- 'am#####nekingsley.net':80
- 'ce#####nekingsley.net':80
- 'am#####neanastasia.net':80
- 'ce#####neanastasia.net':80
- 'am#####neandriana.net':80
- 'ce#####neandriana.net':80
- 'ch#####necharnette.net':80
- 'sh#####lecharnette.net':80
- 'ch#####nekingsley.net':80
- 'sh#####lekingsley.net':80
- 'ch#####neanastasia.net':80
- 'sh#####leanastasia.net':80
- 'ch#####neandriana.net':80
- 'sh#####leandriana.net':80
- 'ka#####nekingsley.net':80
- 'ar#####ldcharnette.net':80
- 'al#####ercharnette.net':80
- 'ch#####antatianna.net':80
- 'ar#####ldsherwood.net':80
- 'za#####ahsherwood.net':80
- 'ar#####ldmichelyne.net':80
- 'za#####ahmichelyne.net':80
- 'ar#####ldtatianna.net':80
- 'za#####ahtatianna.net':80
- 'ge#####naethelbert.net':80
- 'ch#####leethelbert.net':80
- 'ge#####nasherwood.net':80
- 'ch#####lesherwood.net':80
- 'ge#####namichelyne.net':80
- 'ch#####lemichelyne.net':80
- 'ge#####natatianna.net':80
- 'ch#####letatianna.net':80
- 'an#####leethelbert.net':80
- 'gu#####enethelbert.net':80
- 'an#####lesherwood.net':80
- 'gu#####ensherwood.net':80
- 'an#####lemichelyne.net':80
- 'gu#####enmichelyne.net':80
- 'an#####letatianna.net':80
- 'gu#####entatianna.net':80
- 'gw#####reethelbert.net':80
- 'ch#####anethelbert.net':80
- 'gw#####resherwood.net':80
- 'ch#####ansherwood.net':80
- 'gw#####remichelyne.net':80
- 'ch#####anmichelyne.net':80
- 'gw#####retatianna.net':80
- 'ka#####necharnette.net':80
- 'za#####ahcharnette.net':80
- http://za#####ahethelbert.net/index.php
- http://al#####erkingsley.net/index.php
- http://ka#####neanastasia.net/index.php
- http://al#####eranastasia.net/index.php
- http://ka#####neandriana.net/index.php
- http://al#####erandriana.net/index.php
- http://ma#####nacharnette.net/index.php
- http://al#####racharnette.net/index.php
- http://ma#####nakingsley.net/index.php
- http://al#####rakingsley.net/index.php
- http://ma#####naanastasia.net/index.php
- http://al#####raanastasia.net/index.php
- http://ma#####naandriana.net/index.php
- http://al#####raandriana.net/index.php
- http://am#####necharnette.net/index.php
- http://ce#####necharnette.net/index.php
- http://am#####nekingsley.net/index.php
- http://ce#####nekingsley.net/index.php
- http://am#####neanastasia.net/index.php
- http://ce#####neanastasia.net/index.php
- http://am#####neandriana.net/index.php
- http://ce#####neandriana.net/index.php
- http://ch#####necharnette.net/index.php
- http://sh#####lecharnette.net/index.php
- http://ch#####nekingsley.net/index.php
- http://sh#####lekingsley.net/index.php
- http://ch#####neanastasia.net/index.php
- http://sh#####leanastasia.net/index.php
- http://ch#####neandriana.net/index.php
- http://sh#####leandriana.net/index.php
- http://ka#####nekingsley.net/index.php
- http://ar#####ldcharnette.net/index.php
- http://al#####ercharnette.net/index.php
- http://ch#####antatianna.net/index.php
- http://ar#####ldsherwood.net/index.php
- http://za#####ahsherwood.net/index.php
- http://ar#####ldmichelyne.net/index.php
- http://za#####ahmichelyne.net/index.php
- http://ar#####ldtatianna.net/index.php
- http://za#####ahtatianna.net/index.php
- http://ge#####naethelbert.net/index.php
- http://ch#####leethelbert.net/index.php
- http://ge#####nasherwood.net/index.php
- http://ch#####lesherwood.net/index.php
- http://ge#####namichelyne.net/index.php
- http://ch#####lemichelyne.net/index.php
- http://ge#####natatianna.net/index.php
- http://ch#####letatianna.net/index.php
- http://an#####leethelbert.net/index.php
- http://gu#####enethelbert.net/index.php
- http://an#####lesherwood.net/index.php
- http://gu#####ensherwood.net/index.php
- http://an#####lemichelyne.net/index.php
- http://gu#####enmichelyne.net/index.php
- http://an#####letatianna.net/index.php
- http://gu#####entatianna.net/index.php
- http://gw#####reethelbert.net/index.php
- http://ch#####anethelbert.net/index.php
- http://gw#####resherwood.net/index.php
- http://ch#####ansherwood.net/index.php
- http://gw#####remichelyne.net/index.php
- http://ch#####anmichelyne.net/index.php
- http://gw#####retatianna.net/index.php
- http://ka#####necharnette.net/index.php
- http://za#####ahcharnette.net/index.php
- DNS ASK za#####ahethelbert.net
- DNS ASK al#####eranastasia.net
- DNS ASK ka#####neandriana.net
- DNS ASK al#####erandriana.net
- DNS ASK ma#####nacharnette.net
- DNS ASK al#####racharnette.net
- DNS ASK ma#####nakingsley.net
- DNS ASK al#####rakingsley.net
- DNS ASK ma#####naanastasia.net
- DNS ASK al#####raanastasia.net
- DNS ASK ma#####naandriana.net
- DNS ASK al#####raandriana.net
- DNS ASK am#####necharnette.net
- DNS ASK ce#####necharnette.net
- DNS ASK gu#####enethelbert.net
- DNS ASK am#####nekingsley.net
- DNS ASK am#####neanastasia.net
- DNS ASK ce#####neanastasia.net
- DNS ASK am#####neandriana.net
- DNS ASK ce#####neandriana.net
- DNS ASK ch#####necharnette.net
- DNS ASK sh#####lecharnette.net
- DNS ASK ch#####nekingsley.net
- DNS ASK sh#####lekingsley.net
- DNS ASK ch#####neanastasia.net
- DNS ASK sh#####leanastasia.net
- DNS ASK ch#####neandriana.net
- DNS ASK sh#####leandriana.net
- DNS ASK ar#####ldcharnette.net
- DNS ASK al#####erkingsley.net
- DNS ASK ka#####neanastasia.net
- DNS ASK ka#####nekingsley.net
- DNS ASK al#####ercharnette.net
- DNS ASK ka#####necharnette.net
- DNS ASK za#####ahsherwood.net
- DNS ASK ar#####ldmichelyne.net
- DNS ASK za#####ahmichelyne.net
- DNS ASK ar#####ldtatianna.net
- DNS ASK za#####ahtatianna.net
- DNS ASK ge#####naethelbert.net
- DNS ASK ch#####leethelbert.net
- DNS ASK ge#####nasherwood.net
- DNS ASK ch#####lesherwood.net
- DNS ASK ge#####namichelyne.net
- DNS ASK ch#####lemichelyne.net
- DNS ASK ge#####natatianna.net
- DNS ASK ch#####letatianna.net
- DNS ASK za#####ahcharnette.net
- DNS ASK ce#####nekingsley.net
- DNS ASK an#####leethelbert.net
- DNS ASK gu#####ensherwood.net
- DNS ASK an#####lemichelyne.net
- DNS ASK gu#####enmichelyne.net
- DNS ASK an#####letatianna.net
- DNS ASK gu#####entatianna.net
- DNS ASK gw#####reethelbert.net
- DNS ASK ch#####anethelbert.net
- DNS ASK gw#####resherwood.net
- DNS ASK ch#####ansherwood.net
- DNS ASK gw#####remichelyne.net
- DNS ASK ch#####anmichelyne.net
- DNS ASK gw#####retatianna.net
- DNS ASK ch#####antatianna.net
- DNS ASK ar#####ldsherwood.net
- DNS ASK an#####lesherwood.net
- DNS ASK ar#####ldkingsley.net
- 'C:\mtlablgeb\lveaado32f9bleaezdfl9ni.exe'
- 'C:\mtlablgeb\npifhvea4wa.exe'
- 'C:\mtlablgeb\oumybcbpoek.exe' "c:\mtlablgeb\npifhvea4wa.exe"