Technical Information
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Routing Event Provider Security Power' = 'C:\veqjsmmkq\revavvgbk.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\Store PnP-X Foundation Presentation Office] 'ImagePath' = 'C:\veqjsmmkq\revavvgbk.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\Store PnP-X Foundation Presentation Office] 'Start' = '00000002'
- 'C:\veqjsmmkq\uqlwdinypvro.exe' "c:\veqjsmmkq\revavvgbk.exe"
- 'C:\veqjsmmkq\revavvgbk.exe'
- 'C:\veqjsmmkq\zhu1y397macsygohvt.exe'
- C:\veqjsmmkq\revavvgbk.exe
- C:\veqjsmmkq\uqlwdinypvro.exe
- C:\veqjsmmkq\zhu1y397macsygohvt.exe
- %WINDIR%\veqjsmmkq\expnccdrj1f
- C:\veqjsmmkq\expnccdrj1f
- C:\veqjsmmkq\uqlwdinypvro.exe
- C:\veqjsmmkq\revavvgbk.exe
- C:\veqjsmmkq\zhu1y397macsygohvt.exe
- %WINDIR%\veqjsmmkq\expnccdrj1f
- 're####daughter.net':80
- 'de####nation.net':80
- 're####people.net':80
- 'va####sdaughter.net':80
- 'fo####dsoldier.net':80
- 'de####please.net':80
- 'fo####dnation.net':80
- 'de####soldier.net':80
- 'va####speople.net':80
- 'ge####people.net':80
- 'ge####daughter.net':80
- 'ge###eready.net':80
- 'ge###ebrown.net':80
- 'va####sbrown.net':80
- 're###nbrown.net':80
- 'va####sready.net':80
- 're###nready.net':80
- 'fo####dplease.net':80
- 'he###nation.net':80
- 'di#####ltsoldier.net':80
- 'gl####ondition.net':80
- 'di####ultnation.net':80
- 'he###please.net':80
- 'di#####ltcondition.net':80
- 'he####oldier.net':80
- 'di####ultplease.net':80
- 'an####condition.net':80
- 'an####nation.net':80
- 'gl###nation.net':80
- 'de####condition.net':80
- 'fo#####condition.net':80
- 'an####please.net':80
- 'gl###please.net':80
- 'an####soldier.net':80
- 'gl####oldier.net':80
- 'pl####ntready.net':80
- 'ne####aryready.net':80
- 'di#####ltdaughter.net':80
- 'he####aughter.net':80
- 'pl####ntpeople.net':80
- 'ne####arypeople.net':80
- 'pl####ntbrown.net':80
- 'ne####arybrown.net':80
- 'he###people.net':80
- 'gl####aughter.net':80
- 'di####ultready.net':80
- 'gl###people.net':80
- 'an####daughter.net':80
- 'he###brown.net':80
- 'di####ultpeople.net':80
- 'he###ready.net':80
- 'di####ultbrown.net':80
- 'pl#####tdaughter.net':80
- 'le###rbrown.net':80
- 'he###nbrown.net':80
- 'le###rready.net':80
- 'he###nready.net':80
- 'le####daughter.net':80
- 'he####daughter.net':80
- 'le####people.net':80
- 'he####people.net':80
- 're####edaughter.net':80
- 're####eready.net':80
- 'or###brown.net':80
- 'ne#####rydaughter.net':80
- 'or###ready.net':80
- 're####epeople.net':80
- 'or####aughter.net':80
- 're####ebrown.net':80
- 'or###people.net':80
- http://re####daughter.net/index.php
- http://de####nation.net/index.php
- http://re####people.net/index.php
- http://va####sdaughter.net/index.php
- http://fo####dsoldier.net/index.php
- http://de####please.net/index.php
- http://fo####dnation.net/index.php
- http://de####soldier.net/index.php
- http://va####speople.net/index.php
- http://ge####people.net/index.php
- http://ge####daughter.net/index.php
- http://ge###eready.net/index.php
- http://ge###ebrown.net/index.php
- http://va####sbrown.net/index.php
- http://re###nbrown.net/index.php
- http://va####sready.net/index.php
- http://re###nready.net/index.php
- http://fo####dplease.net/index.php
- http://he###nation.net/index.php
- http://di#####ltsoldier.net/index.php
- http://gl####ondition.net/index.php
- http://di####ultnation.net/index.php
- http://he###please.net/index.php
- http://di#####ltcondition.net/index.php
- http://he####oldier.net/index.php
- http://di####ultplease.net/index.php
- http://an####condition.net/index.php
- http://an####nation.net/index.php
- http://gl###nation.net/index.php
- http://de####condition.net/index.php
- http://fo#####condition.net/index.php
- http://an####please.net/index.php
- http://gl###please.net/index.php
- http://an####soldier.net/index.php
- http://gl####oldier.net/index.php
- http://pl####ntready.net/index.php
- http://ne####aryready.net/index.php
- http://di#####ltdaughter.net/index.php
- http://he####aughter.net/index.php
- http://pl####ntpeople.net/index.php
- http://ne####arypeople.net/index.php
- http://pl####ntbrown.net/index.php
- http://ne####arybrown.net/index.php
- http://he###people.net/index.php
- http://gl####aughter.net/index.php
- http://di####ultready.net/index.php
- http://gl###people.net/index.php
- http://an####daughter.net/index.php
- http://he###brown.net/index.php
- http://di####ultpeople.net/index.php
- http://he###ready.net/index.php
- http://di####ultbrown.net/index.php
- http://pl#####tdaughter.net/index.php
- http://le###rbrown.net/index.php
- http://he###nbrown.net/index.php
- http://le###rready.net/index.php
- http://he###nready.net/index.php
- http://le####daughter.net/index.php
- http://he####daughter.net/index.php
- http://le####people.net/index.php
- http://he####people.net/index.php
- http://re####edaughter.net/index.php
- http://re####eready.net/index.php
- http://or###brown.net/index.php
- http://ne#####rydaughter.net/index.php
- http://or###ready.net/index.php
- http://re####epeople.net/index.php
- http://or####aughter.net/index.php
- http://re####ebrown.net/index.php
- http://or###people.net/index.php
- DNS ASK de####nation.net
- DNS ASK fo####dnation.net
- DNS ASK va####sdaughter.net
- DNS ASK re####daughter.net
- DNS ASK de####please.net
- DNS ASK fo####dplease.net
- DNS ASK de####soldier.net
- DNS ASK fo####dsoldier.net
- DNS ASK re####people.net
- DNS ASK ge####daughter.net
- DNS ASK va####sready.net
- DNS ASK ge###ebrown.net
- DNS ASK ge####people.net
- DNS ASK re###nbrown.net
- DNS ASK va####speople.net
- DNS ASK re###nready.net
- DNS ASK va####sbrown.net
- DNS ASK de####condition.net
- DNS ASK di#####ltsoldier.net
- DNS ASK he####oldier.net
- DNS ASK di####ultnation.net
- DNS ASK he###nation.net
- DNS ASK di#####ltcondition.net
- DNS ASK he####ondition.net
- DNS ASK di####ultplease.net
- DNS ASK he###please.net
- DNS ASK gl####ondition.net
- DNS ASK gl###nation.net
- DNS ASK an####soldier.net
- DNS ASK fo#####condition.net
- DNS ASK an####nation.net
- DNS ASK gl###please.net
- DNS ASK an####condition.net
- DNS ASK gl####oldier.net
- DNS ASK an####please.net
- DNS ASK ge###eready.net
- DNS ASK pl####ntready.net
- DNS ASK ne####aryready.net
- DNS ASK di#####ltdaughter.net
- DNS ASK he####aughter.net
- DNS ASK pl####ntpeople.net
- DNS ASK ne####arypeople.net
- DNS ASK pl####ntbrown.net
- DNS ASK ne####arybrown.net
- DNS ASK he###people.net
- DNS ASK gl####aughter.net
- DNS ASK di####ultready.net
- DNS ASK gl###people.net
- DNS ASK an####daughter.net
- DNS ASK he###brown.net
- DNS ASK di####ultpeople.net
- DNS ASK he###ready.net
- DNS ASK di####ultbrown.net
- DNS ASK pl#####tdaughter.net
- DNS ASK le###rbrown.net
- DNS ASK he###nbrown.net
- DNS ASK le###rready.net
- DNS ASK he###nready.net
- DNS ASK le####daughter.net
- DNS ASK he####daughter.net
- DNS ASK le####people.net
- DNS ASK he####people.net
- DNS ASK re####edaughter.net
- DNS ASK re####eready.net
- DNS ASK or###brown.net
- DNS ASK ne#####rydaughter.net
- DNS ASK or###ready.net
- DNS ASK re####epeople.net
- DNS ASK or####aughter.net
- DNS ASK re####ebrown.net
- DNS ASK or###people.net
- ClassName: 'Shell_TrayWnd' WindowName: ''