Technical Information
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Helper SSDP Health Experience Receiver' = 'C:\piphbur\sjfahlcg.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\Enumerator Instrumentation] 'ImagePath' = 'C:\piphbur\sjfahlcg.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\Enumerator Instrumentation] 'Start' = '00000002'
- 'C:\piphbur\zhaw8cahptx.exe' "c:\piphbur\sjfahlcg.exe"
- 'C:\piphbur\sjfahlcg.exe'
- 'C:\piphbur\xcy2jduk2qvgbkcfwff8hd.exe'
- C:\piphbur\sjfahlcg.exe
- C:\piphbur\zhaw8cahptx.exe
- C:\piphbur\fqwyfxu
- %WINDIR%\piphbur\kxaizbh
- C:\piphbur\kxaizbh
- C:\piphbur\xcy2jduk2qvgbkcfwff8hd.exe
- C:\piphbur\zhaw8cahptx.exe
- C:\piphbur\sjfahlcg.exe
- C:\piphbur\xcy2jduk2qvgbkcfwff8hd.exe
- %WINDIR%\piphbur\kxaizbh
- %WINDIR%\piphbur\kxaizbh
- 'ri#####inepleasance.net':80
- 'ev#####inabertrand.net':80
- 'be#####ardbertrand.net':80
- 'ev#####inepleasance.net':80
- 'ri#####inephilander.net':80
- 'ev#####inefrederica.net':80
- 'ri#####inefrederica.net':80
- 'ev#####inapleasance.net':80
- 'be#####ardpleasance.net':80
- 'gw#####inebertrand.net':80
- 'be#####ardfrederica.net':80
- 'ev#####inaphilander.net':80
- 'be#####ardphilander.net':80
- 'ev#####inafrederica.net':80
- 'al#####rinacheyanne.net':80
- 'ma#####llaelisabeth.net':80
- 'al######inaelisabeth.net':80
- 'ma#####llacheyanne.net':80
- 'ba#####omewgloriana.net':80
- 'wi#####hbyeglantine.net':80
- 'ba######meweglantine.net':80
- 'ev#####inebertrand.net':80
- 'ri#####inebertrand.net':80
- 'ev#####inephilander.net':80
- 'al######inaeglantine.net':80
- 'ma#####llagloriana.net':80
- 'al#####rinagloriana.net':80
- 'ma#####llaeglantine.net':80
- 'ma#####lianbertrand.net':80
- 'ea#####inefrederica.net':80
- 'wa#####tonfrederica.net':80
- 'ea#####inepleasance.net':80
- 'wa#####tonphilander.net':80
- 'ea#####inebertrand.net':80
- 'wa#####tonbertrand.net':80
- 'ea#####inephilander.net':80
- 'ch#####anaphilander.net':80
- 'du#####llafrederica.net':80
- 'ch#####anafrederica.net':80
- 'du#####llaphilander.net':80
- 'wa#####tonpleasance.net':80
- 'du#####llabertrand.net':80
- 'ch#####anabertrand.net':80
- 'gw#####inepleasance.net':80
- 'ma######ianpleasance.net':80
- 'wi#####inabertrand.net':80
- 'ma######ianfrederica.net':80
- 'gw#####inephilander.net':80
- 'ma######ianphilander.net':80
- 'gw#####inefrederica.net':80
- 'sa######ellfrederica.net':80
- 'wi#####inapleasance.net':80
- 'sa######ellpleasance.net':80
- 'wi#####inafrederica.net':80
- 'sa#####rellbertrand.net':80
- 'wi#####inaphilander.net':80
- 'sa######ellphilander.net':80
- http://ri#####inepleasance.net/index.php
- http://ev#####inabertrand.net/index.php
- http://be#####ardbertrand.net/index.php
- http://ev#####inepleasance.net/index.php
- http://ri#####inephilander.net/index.php
- http://ev#####inefrederica.net/index.php
- http://ri#####inefrederica.net/index.php
- http://ev#####inapleasance.net/index.php
- http://be#####ardpleasance.net/index.php
- http://gw#####inebertrand.net/index.php
- http://be#####ardfrederica.net/index.php
- http://ev#####inaphilander.net/index.php
- http://be#####ardphilander.net/index.php
- http://ev#####inafrederica.net/index.php
- http://al#####rinacheyanne.net/index.php
- http://ma#####llaelisabeth.net/index.php
- http://al######inaelisabeth.net/index.php
- http://ma#####llacheyanne.net/index.php
- http://ba#####omewgloriana.net/index.php
- http://wi#####hbyeglantine.net/index.php
- http://ba######meweglantine.net/index.php
- http://ev#####inebertrand.net/index.php
- http://ri#####inebertrand.net/index.php
- http://ev#####inephilander.net/index.php
- http://al######inaeglantine.net/index.php
- http://ma#####llagloriana.net/index.php
- http://al#####rinagloriana.net/index.php
- http://ma#####llaeglantine.net/index.php
- http://ma#####lianbertrand.net/index.php
- http://ea#####inefrederica.net/index.php
- http://wa#####tonfrederica.net/index.php
- http://ea#####inepleasance.net/index.php
- http://wa#####tonphilander.net/index.php
- http://ea#####inebertrand.net/index.php
- http://wa#####tonbertrand.net/index.php
- http://ea#####inephilander.net/index.php
- http://ch#####anaphilander.net/index.php
- http://du#####llafrederica.net/index.php
- http://ch#####anafrederica.net/index.php
- http://du#####llaphilander.net/index.php
- http://wa#####tonpleasance.net/index.php
- http://du#####llabertrand.net/index.php
- http://ch#####anabertrand.net/index.php
- http://gw#####inepleasance.net/index.php
- http://ma######ianpleasance.net/index.php
- http://wi#####inabertrand.net/index.php
- http://ma######ianfrederica.net/index.php
- http://gw#####inephilander.net/index.php
- http://ma######ianphilander.net/index.php
- http://gw#####inefrederica.net/index.php
- http://sa######ellfrederica.net/index.php
- http://wi#####inapleasance.net/index.php
- http://sa######ellpleasance.net/index.php
- http://wi#####inafrederica.net/index.php
- http://sa#####rellbertrand.net/index.php
- http://wi#####inaphilander.net/index.php
- http://sa######ellphilander.net/index.php
- DNS ASK ri#####inepleasance.net
- DNS ASK ev#####inabertrand.net
- DNS ASK be#####ardbertrand.net
- DNS ASK ev#####inepleasance.net
- DNS ASK ri#####inephilander.net
- DNS ASK ev#####inefrederica.net
- DNS ASK ri#####inefrederica.net
- DNS ASK ev#####inapleasance.net
- DNS ASK be#####ardpleasance.net
- DNS ASK gw#####inebertrand.net
- DNS ASK be#####ardfrederica.net
- DNS ASK ev#####inaphilander.net
- DNS ASK be#####ardphilander.net
- DNS ASK ev#####inafrederica.net
- DNS ASK al#####rinacheyanne.net
- DNS ASK ma#####llaelisabeth.net
- DNS ASK al######inaelisabeth.net
- DNS ASK ma#####llacheyanne.net
- DNS ASK ba#####omewgloriana.net
- DNS ASK wi#####hbyeglantine.net
- DNS ASK ba######meweglantine.net
- DNS ASK ev#####inebertrand.net
- DNS ASK ri#####inebertrand.net
- DNS ASK ev#####inephilander.net
- DNS ASK al######inaeglantine.net
- DNS ASK ma#####llagloriana.net
- DNS ASK al#####rinagloriana.net
- DNS ASK ma#####llaeglantine.net
- DNS ASK ma#####lianbertrand.net
- DNS ASK ea#####inefrederica.net
- DNS ASK wa#####tonfrederica.net
- DNS ASK ea#####inepleasance.net
- DNS ASK wa#####tonphilander.net
- DNS ASK ea#####inebertrand.net
- DNS ASK wa#####tonbertrand.net
- DNS ASK ea#####inephilander.net
- DNS ASK ch#####anaphilander.net
- DNS ASK du#####llafrederica.net
- DNS ASK ch#####anafrederica.net
- DNS ASK du#####llaphilander.net
- DNS ASK wa#####tonpleasance.net
- DNS ASK du#####llabertrand.net
- DNS ASK ch#####anabertrand.net
- DNS ASK gw#####inepleasance.net
- DNS ASK ma######ianpleasance.net
- DNS ASK wi#####inabertrand.net
- DNS ASK ma######ianfrederica.net
- DNS ASK gw#####inephilander.net
- DNS ASK ma######ianphilander.net
- DNS ASK gw#####inefrederica.net
- DNS ASK sa######ellfrederica.net
- DNS ASK wi#####inapleasance.net
- DNS ASK sa######ellpleasance.net
- DNS ASK wi#####inafrederica.net
- DNS ASK sa#####rellbertrand.net
- DNS ASK wi#####inaphilander.net
- DNS ASK sa######ellphilander.net