Technical Information
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Presentation Superfetch Software Accounts' = 'C:\vnrkchpvnslftfh\hisvmeu.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\Detection Resource Virtual Intelligent] 'Start' = '00000002'
- 'C:\vnrkchpvnslftfh\npgfnogb.exe' "c:\vnrkchpvnslftfh\hisvmeu.exe"
- 'C:\vnrkchpvnslftfh\hisvmeu.exe'
- 'C:\vnrkchpvnslftfh\atga2m1uuonugzqfeqq.exe'
- C:\vnrkchpvnslftfh\hisvmeu.exe
- C:\vnrkchpvnslftfh\npgfnogb.exe
- C:\vnrkchpvnslftfh\hhc9xhvgu
- %WINDIR%\vnrkchpvnslftfh\sbdbnj9zc
- C:\vnrkchpvnslftfh\sbdbnj9zc
- C:\vnrkchpvnslftfh\atga2m1uuonugzqfeqq.exe
- C:\vnrkchpvnslftfh\npgfnogb.exe
- C:\vnrkchpvnslftfh\hisvmeu.exe
- C:\vnrkchpvnslftfh\atga2m1uuonugzqfeqq.exe
- %WINDIR%\vnrkchpvnslftfh\sbdbnj9zc
- 'co####ereason.net':80
- 'ch####rderly.net':80
- 'ch###reason.net':80
- 'ch###almost.net':80
- 'co####ealmost.net':80
- 'of###almost.net':80
- 'al###almost.net':80
- 'co####evalue.net':80
- 'co####eorderly.net':80
- 'ch###value.net':80
- 'pr####talmost.net':80
- 'th###reason.net':80
- 'th###almost.net':80
- 'qu###battle.net':80
- 'se####battle.net':80
- 'th###value.net':80
- 'pr####tvalue.net':80
- 'pr####torderly.net':80
- 'pr####treason.net':80
- 'th####rderly.net':80
- 'tw###evalue.net':80
- 'ra####almost.net':80
- 'mi###evalue.net':80
- 'mi####orderly.net':80
- 'tw####orderly.net':80
- 'ra####orderly.net':80
- 'mo####gorderly.net':80
- 'mo####greason.net':80
- 'mo####galmost.net':80
- 'ra####reason.net':80
- 'al####rderly.net':80
- 'of###value.net':80
- 'of####rderly.net':80
- 'of###reason.net':80
- 'al###reason.net':80
- 'mi####reason.net':80
- 'tw####reason.net':80
- 'tw####almost.net':80
- 'al###value.net':80
- 'mi####almost.net':80
- 'tr####erfect.net':80
- 'st###tmayor.net':80
- 'st####perfect.net':80
- 'st###theart.net':80
- 'tr###heart.net':80
- 'be###rheart.net':80
- 'ga###rheart.net':80
- 'tr###battle.net':80
- 'tr###mayor.net':80
- 'st####battle.net':80
- 'el####icheart.net':80
- 're####perfect.net':80
- 're###dheart.net':80
- 'la###battle.net':80
- 'ca####nbattle.net':80
- 're####battle.net':80
- 'el####icbattle.net':80
- 'el####icmayor.net':80
- 'el####icperfect.net':80
- 're###dmayor.net':80
- 'br###battle.net':80
- 'qu###heart.net':80
- 'fl###battle.net':80
- 'fl###mayor.net':80
- 'br###mayor.net':80
- 'qu###mayor.net':80
- 'se###nmayor.net':80
- 'se####perfect.net':80
- 'se###nheart.net':80
- 'qu####erfect.net':80
- 'ga###rmayor.net':80
- 'be####battle.net':80
- 'be###rmayor.net':80
- 'be####perfect.net':80
- 'ga####perfect.net':80
- 'fl####erfect.net':80
- 'br####erfect.net':80
- 'br###heart.net':80
- 'ga####battle.net':80
- 'fl###heart.net':80
- http://co####ereason.net/index.php
- http://ch####rderly.net/index.php
- http://ch###reason.net/index.php
- http://ch###almost.net/index.php
- http://co####ealmost.net/index.php
- http://of###almost.net/index.php
- http://al###almost.net/index.php
- http://co####evalue.net/index.php
- http://co####eorderly.net/index.php
- http://ch###value.net/index.php
- http://pr####talmost.net/index.php
- http://th###reason.net/index.php
- http://th###almost.net/index.php
- http://qu###battle.net/index.php
- http://se####battle.net/index.php
- http://th###value.net/index.php
- http://pr####tvalue.net/index.php
- http://pr####torderly.net/index.php
- http://pr####treason.net/index.php
- http://th####rderly.net/index.php
- http://tw###evalue.net/index.php
- http://ra####almost.net/index.php
- http://mi###evalue.net/index.php
- http://mi####orderly.net/index.php
- http://tw####orderly.net/index.php
- http://ra####orderly.net/index.php
- http://mo####gorderly.net/index.php
- http://mo####greason.net/index.php
- http://mo####galmost.net/index.php
- http://ra####reason.net/index.php
- http://al####rderly.net/index.php
- http://of###value.net/index.php
- http://of####rderly.net/index.php
- http://of###reason.net/index.php
- http://al###reason.net/index.php
- http://mi####reason.net/index.php
- http://tw####reason.net/index.php
- http://tw####almost.net/index.php
- http://al###value.net/index.php
- http://mi####almost.net/index.php
- http://tr####erfect.net/index.php
- http://st###tmayor.net/index.php
- http://st####perfect.net/index.php
- http://st###theart.net/index.php
- http://tr###heart.net/index.php
- http://be###rheart.net/index.php
- http://ga###rheart.net/index.php
- http://tr###battle.net/index.php
- http://tr###mayor.net/index.php
- http://st####battle.net/index.php
- http://el####icheart.net/index.php
- http://re####perfect.net/index.php
- http://re###dheart.net/index.php
- http://la###battle.net/index.php
- http://ca####nbattle.net/index.php
- http://re####battle.net/index.php
- http://el####icbattle.net/index.php
- http://el####icmayor.net/index.php
- http://el####icperfect.net/index.php
- http://re###dmayor.net/index.php
- http://br###battle.net/index.php
- http://qu###heart.net/index.php
- http://fl###battle.net/index.php
- http://fl###mayor.net/index.php
- http://br###mayor.net/index.php
- http://qu###mayor.net/index.php
- http://se###nmayor.net/index.php
- http://se####perfect.net/index.php
- http://se###nheart.net/index.php
- http://qu####erfect.net/index.php
- http://ga###rmayor.net/index.php
- http://be####battle.net/index.php
- http://be###rmayor.net/index.php
- http://be####perfect.net/index.php
- http://ga####perfect.net/index.php
- http://fl####erfect.net/index.php
- http://br####erfect.net/index.php
- http://br###heart.net/index.php
- http://ga####battle.net/index.php
- http://fl###heart.net/index.php
- DNS ASK ch####rderly.net
- DNS ASK co####eorderly.net
- DNS ASK co####ereason.net
- DNS ASK co####ealmost.net
- DNS ASK ch###reason.net
- DNS ASK al###almost.net
- DNS ASK of###reason.net
- DNS ASK of###almost.net
- DNS ASK ch###value.net
- DNS ASK co####evalue.net
- DNS ASK th###reason.net
- DNS ASK pr####treason.net
- DNS ASK pr####talmost.net
- DNS ASK se####battle.net
- DNS ASK th###almost.net
- DNS ASK pr####tvalue.net
- DNS ASK ch###almost.net
- DNS ASK th###value.net
- DNS ASK th####rderly.net
- DNS ASK pr####torderly.net
- DNS ASK ra####almost.net
- DNS ASK mo####galmost.net
- DNS ASK tw###evalue.net
- DNS ASK tw####orderly.net
- DNS ASK mi###evalue.net
- DNS ASK mo####gorderly.net
- DNS ASK ra###rvalue.net
- DNS ASK ra####orderly.net
- DNS ASK ra####reason.net
- DNS ASK mo####greason.net
- DNS ASK of###value.net
- DNS ASK al###value.net
- DNS ASK al####rderly.net
- DNS ASK al###reason.net
- DNS ASK of####rderly.net
- DNS ASK tw####reason.net
- DNS ASK mi####orderly.net
- DNS ASK mi####reason.net
- DNS ASK mi####almost.net
- DNS ASK tw####almost.net
- DNS ASK qu###battle.net
- DNS ASK tr####erfect.net
- DNS ASK st###tmayor.net
- DNS ASK st####perfect.net
- DNS ASK st###theart.net
- DNS ASK tr###heart.net
- DNS ASK be###rheart.net
- DNS ASK ga###rheart.net
- DNS ASK tr###battle.net
- DNS ASK tr###mayor.net
- DNS ASK st####battle.net
- DNS ASK el####icheart.net
- DNS ASK re####perfect.net
- DNS ASK re###dheart.net
- DNS ASK la###battle.net
- DNS ASK ca####nbattle.net
- DNS ASK re####battle.net
- DNS ASK el####icbattle.net
- DNS ASK el####icmayor.net
- DNS ASK el####icperfect.net
- DNS ASK re###dmayor.net
- DNS ASK br###battle.net
- DNS ASK qu###heart.net
- DNS ASK fl###battle.net
- DNS ASK fl###mayor.net
- DNS ASK br###mayor.net
- DNS ASK qu###mayor.net
- DNS ASK se###nmayor.net
- DNS ASK se####perfect.net
- DNS ASK se###nheart.net
- DNS ASK qu####erfect.net
- DNS ASK ga###rmayor.net
- DNS ASK be####battle.net
- DNS ASK be###rmayor.net
- DNS ASK be####perfect.net
- DNS ASK ga####perfect.net
- DNS ASK fl####erfect.net
- DNS ASK br####erfect.net
- DNS ASK br###heart.net
- DNS ASK ga####battle.net
- DNS ASK fl###heart.net
- ClassName: 'Shell_TrayWnd' WindowName: ''