Technical Information
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Grouping Netlogon Removal' = 'C:\aihcawpvgvkcx\jgpwcgrwmpg.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\Adaptive Protected Configuration] 'Start' = '00000002'
- 'C:\aihcawpvgvkcx\qpoplxwdnu.exe' "c:\aihcawpvgvkcx\jgpwcgrwmpg.exe"
- 'C:\aihcawpvgvkcx\jgpwcgrwmpg.exe'
- 'C:\aihcawpvgvkcx\ysy2we8v0vqbonvqc.exe'
- C:\aihcawpvgvkcx\jgpwcgrwmpg.exe
- C:\aihcawpvgvkcx\qpoplxwdnu.exe
- C:\aihcawpvgvkcx\pxh9woil
- %WINDIR%\aihcawpvgvkcx\cxns430
- C:\aihcawpvgvkcx\cxns430
- C:\aihcawpvgvkcx\ysy2we8v0vqbonvqc.exe
- C:\aihcawpvgvkcx\qpoplxwdnu.exe
- C:\aihcawpvgvkcx\jgpwcgrwmpg.exe
- C:\aihcawpvgvkcx\ysy2we8v0vqbonvqc.exe
- %WINDIR%\aihcawpvgvkcx\cxns430
- 'fr###father.net':80
- 'ex#####ncefather.net':80
- 'fi####ontrol.net':80
- 'fi####ogether.net':80
- 'pa####ontrol.net':80
- 'ex####encebuilt.net':80
- 'fr###carry.net':80
- 'fr###built.net':80
- 'fr###apple.net':80
- 'ex####enceapple.net':80
- 'pa####ogether.net':80
- 'sm####ogether.net':80
- 'wo####ontrol.net':80
- 'wo####ogether.net':80
- 'wo###spent.net':80
- 'sm###spent.net':80
- 'pa###spent.net':80
- 'fi###spent.net':80
- 'fi###matter.net':80
- 'sm####ontrol.net':80
- 'pa###matter.net':80
- 'me###rbuilt.net':80
- 'fo###wcarry.net':80
- 'fo###wbuilt.net':80
- 'fo###wapple.net':80
- 'me###rapple.net':80
- 'be###apple.net':80
- 'kn###apple.net':80
- 'kn###father.net':80
- 'me###rcarry.net':80
- 'be###father.net':80
- 'me####father.net':80
- 'ge####manapple.net':80
- 'al####yapple.net':80
- 'al####yfather.net':80
- 'ex####encecarry.net':80
- 'ge####manfather.net':80
- 'al####ycarry.net':80
- 'fo####father.net':80
- 'ge####mancarry.net':80
- 'ge####manbuilt.net':80
- 'al####ybuilt.net':80
- 'sm###matter.net':80
- 'me####together.net':80
- 'fo####control.net':80
- 'fo####together.net':80
- 'fo###wspent.net':80
- 'me###rspent.net':80
- 'be###spent.net':80
- 'kn###spent.net':80
- 'kn###matter.net':80
- 'me####control.net':80
- 'be###matter.net':80
- 'me####matter.net':80
- 'ge####manspent.net':80
- 'al####yspent.net':80
- 'al####ymatter.net':80
- 'ex#####ncecontrol.net':80
- 'ge####manmatter.net':80
- 'al####ycontrol.net':80
- 'fo####matter.net':80
- 'ge#####ancontrol.net':80
- 'ge#####antogether.net':80
- 'al####ytogether.net':80
- 'th####tspent.net':80
- 'wa###spent.net':80
- 'wa###matter.net':80
- 'cr####ontrol.net':80
- 'th####tmatter.net':80
- 'wa####ontrol.net':80
- 'wo###matter.net':80
- 'th####tcontrol.net':80
- 'th####ttogether.net':80
- 'wa####ogether.net':80
- 'su####control.net':80
- 'kn####ontrol.net':80
- 'su####matter.net':80
- 'be####ontrol.net':80
- 'be####ogether.net':80
- 'kn####ogether.net':80
- 'su####together.net':80
- 'cr####ogether.net':80
- 'cr###spent.net':80
- 'cr###matter.net':80
- 'su###rspent.net':80
- http://fr###father.net/index.php
- http://ex#####ncefather.net/index.php
- http://fi####ontrol.net/index.php
- http://fi####ogether.net/index.php
- http://pa####ontrol.net/index.php
- http://ex####encebuilt.net/index.php
- http://fr###carry.net/index.php
- http://fr###built.net/index.php
- http://fr###apple.net/index.php
- http://ex####enceapple.net/index.php
- http://pa####ogether.net/index.php
- http://sm####ogether.net/index.php
- http://wo####ontrol.net/index.php
- http://wo####ogether.net/index.php
- http://wo###spent.net/index.php
- http://sm###spent.net/index.php
- http://pa###spent.net/index.php
- http://fi###spent.net/index.php
- http://fi###matter.net/index.php
- http://sm####ontrol.net/index.php
- http://pa###matter.net/index.php
- http://me###rbuilt.net/index.php
- http://fo###wcarry.net/index.php
- http://fo###wbuilt.net/index.php
- http://fo###wapple.net/index.php
- http://me###rapple.net/index.php
- http://be###apple.net/index.php
- http://kn###apple.net/index.php
- http://kn###father.net/index.php
- http://me###rcarry.net/index.php
- http://be###father.net/index.php
- http://me####father.net/index.php
- http://ge####manapple.net/index.php
- http://al####yapple.net/index.php
- http://al####yfather.net/index.php
- http://ex####encecarry.net/index.php
- http://ge####manfather.net/index.php
- http://al####ycarry.net/index.php
- http://fo####father.net/index.php
- http://ge####mancarry.net/index.php
- http://ge####manbuilt.net/index.php
- http://al####ybuilt.net/index.php
- http://sm###matter.net/index.php
- http://me####together.net/index.php
- http://fo####control.net/index.php
- http://fo####together.net/index.php
- http://fo###wspent.net/index.php
- http://me###rspent.net/index.php
- http://be###spent.net/index.php
- http://kn###spent.net/index.php
- http://kn###matter.net/index.php
- http://me####control.net/index.php
- http://be###matter.net/index.php
- http://me####matter.net/index.php
- http://ge####manspent.net/index.php
- http://al####yspent.net/index.php
- http://al####ymatter.net/index.php
- http://ex#####ncecontrol.net/index.php
- http://ge####manmatter.net/index.php
- http://al####ycontrol.net/index.php
- http://fo####matter.net/index.php
- http://ge#####ancontrol.net/index.php
- http://ge#####antogether.net/index.php
- http://al####ytogether.net/index.php
- http://th####tspent.net/index.php
- http://wa###spent.net/index.php
- http://wa###matter.net/index.php
- http://cr####ontrol.net/index.php
- http://th####tmatter.net/index.php
- http://wa####ontrol.net/index.php
- http://wo###matter.net/index.php
- http://th####tcontrol.net/index.php
- http://th####ttogether.net/index.php
- http://wa####ogether.net/index.php
- http://su####control.net/index.php
- http://kn####ontrol.net/index.php
- http://su####matter.net/index.php
- http://be####ontrol.net/index.php
- http://be####ogether.net/index.php
- http://kn####ogether.net/index.php
- http://su####together.net/index.php
- http://cr####ogether.net/index.php
- http://cr###spent.net/index.php
- http://cr###matter.net/index.php
- http://su###rspent.net/index.php
- DNS ASK fr###father.net
- DNS ASK ex#####ncefather.net
- DNS ASK fi####ontrol.net
- DNS ASK fi####ogether.net
- DNS ASK pa####ontrol.net
- DNS ASK ex####encebuilt.net
- DNS ASK fr###carry.net
- DNS ASK fr###built.net
- DNS ASK fr###apple.net
- DNS ASK ex####enceapple.net
- DNS ASK pa####ogether.net
- DNS ASK sm####ogether.net
- DNS ASK wo####ontrol.net
- DNS ASK wo####ogether.net
- DNS ASK wo###spent.net
- DNS ASK sm###spent.net
- DNS ASK pa###spent.net
- DNS ASK fi###spent.net
- DNS ASK fi###matter.net
- DNS ASK sm####ontrol.net
- DNS ASK pa###matter.net
- DNS ASK me###rbuilt.net
- DNS ASK fo###wcarry.net
- DNS ASK fo###wbuilt.net
- DNS ASK fo###wapple.net
- DNS ASK me###rapple.net
- DNS ASK be###apple.net
- DNS ASK kn###apple.net
- DNS ASK kn###father.net
- DNS ASK me###rcarry.net
- DNS ASK be###father.net
- DNS ASK me####father.net
- DNS ASK ge####manapple.net
- DNS ASK al####yapple.net
- DNS ASK al####yfather.net
- DNS ASK ex####encecarry.net
- DNS ASK ge####manfather.net
- DNS ASK al####ycarry.net
- DNS ASK fo####father.net
- DNS ASK ge####mancarry.net
- DNS ASK ge####manbuilt.net
- DNS ASK al####ybuilt.net
- DNS ASK sm###matter.net
- DNS ASK me####together.net
- DNS ASK fo####control.net
- DNS ASK fo####together.net
- DNS ASK fo###wspent.net
- DNS ASK me###rspent.net
- DNS ASK be###spent.net
- DNS ASK kn###spent.net
- DNS ASK kn###matter.net
- DNS ASK me####control.net
- DNS ASK be###matter.net
- DNS ASK me####matter.net
- DNS ASK ge####manspent.net
- DNS ASK al####yspent.net
- DNS ASK al####ymatter.net
- DNS ASK ex#####ncecontrol.net
- DNS ASK ge####manmatter.net
- DNS ASK al####ycontrol.net
- DNS ASK fo####matter.net
- DNS ASK ge#####ancontrol.net
- DNS ASK ge#####antogether.net
- DNS ASK al####ytogether.net
- DNS ASK th####tspent.net
- DNS ASK wa###spent.net
- DNS ASK wa###matter.net
- DNS ASK cr####ontrol.net
- DNS ASK th####tmatter.net
- DNS ASK wa####ontrol.net
- DNS ASK wo###matter.net
- DNS ASK th####tcontrol.net
- DNS ASK th####ttogether.net
- DNS ASK wa####ogether.net
- DNS ASK su####control.net
- DNS ASK kn####ontrol.net
- DNS ASK su####matter.net
- DNS ASK be####ontrol.net
- DNS ASK be####ogether.net
- DNS ASK kn####ogether.net
- DNS ASK su####together.net
- DNS ASK cr####ogether.net
- DNS ASK cr###spent.net
- DNS ASK cr###matter.net
- DNS ASK su###rspent.net
- ClassName: 'Shell_TrayWnd' WindowName: ''