Technical Information
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Ordering Telephony Visual Driver' = 'C:\qeqwaakrih\myncnzjjikq.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\WMI Interactive Connections Time] 'Start' = '00000002'
- 'C:\qeqwaakrih\kividlb.exe' "c:\qeqwaakrih\myncnzjjikq.exe"
- 'C:\qeqwaakrih\myncnzjjikq.exe'
- 'C:\qeqwaakrih\eunmt2uqcvtgofondu.exe'
- C:\qeqwaakrih\myncnzjjikq.exe
- C:\qeqwaakrih\kividlb.exe
- C:\qeqwaakrih\ngytowz
- %WINDIR%\qeqwaakrih\mplpg2ugqk
- C:\qeqwaakrih\mplpg2ugqk
- C:\qeqwaakrih\eunmt2uqcvtgofondu.exe
- C:\qeqwaakrih\kividlb.exe
- C:\qeqwaakrih\myncnzjjikq.exe
- C:\qeqwaakrih\eunmt2uqcvtgofondu.exe
- %WINDIR%\qeqwaakrih\mplpg2ugqk
- 'wi####suppose.net':80
- 'su####suppose.net':80
- 'wi####service.net':80
- 'th###river.net':80
- 'wi####mister.net':80
- 'su####mister.net':80
- 'ef####mister.net':80
- 'th####hmister.net':80
- 'ef####suppose.net':80
- 'su####service.net':80
- 'wi###nriver.net':80
- 'su###rriver.net':80
- 'ch###river.net':80
- 'be####service.net':80
- 'ri###nriver.net':80
- 'be###griver.net':80
- 'ri####suppose.net':80
- 'be####suppose.net':80
- 'ri####service.net':80
- 'th####uppose.net':80
- 'ch####ervice.net':80
- 'th####ervice.net':80
- 'ch###mister.net':80
- 'th###mister.net':80
- 'ch####uppose.net':80
- 're####ersuppose.net':80
- 'wo####ervice.net':80
- 're####erservice.net':80
- 'wo###mister.net':80
- 're####ermister.net':80
- 'wo####uppose.net':80
- 'hu####dnearly.net':80
- 'jo####yhappen.net':80
- 'hu####dhappen.net':80
- 'wo###river.net':80
- 're####erriver.net':80
- 'jo####ynearly.net':80
- 'in####seriver.net':80
- 'ef###triver.net':80
- 'th####hriver.net':80
- 'fo####mister.net':80
- 'th####hsuppose.net':80
- 'ef####service.net':80
- 'th####hservice.net':80
- 'fo####service.net':80
- 'in####seservice.net':80
- 'fo###triver.net':80
- 'in####semister.net':80
- 'fo####suppose.net':80
- 'in####sesuppose.net':80
- 'be####mister.net':80
- 'th####harticle.net':80
- 'fo###tdried.net':80
- 'in####sedried.net':80
- 'ef###tangry.net':80
- 'th####hangry.net':80
- 'ef####article.net':80
- 'in####seangry.net':80
- 'fo####article.net':80
- 'in####searticle.net':80
- 'fo####fifteen.net':80
- 'in####sefifteen.net':80
- 'fo###tangry.net':80
- 'th####hfifteen.net':80
- 'wi####fifteen.net':80
- 'su####fifteen.net':80
- 'wi###nangry.net':80
- 'th####rticle.net':80
- 'wi###ndried.net':80
- 'su###rdried.net':80
- 'ef###tdried.net':80
- 'th####hdried.net':80
- 'ef####fifteen.net':80
- 'su###rangry.net':80
- 'wi####article.net':80
- 'su####article.net':80
- 'de####ymister.net':80
- 'li####mister.net':80
- 'de####ysuppose.net':80
- 'hu####dservice.net':80
- 'jo####yriver.net':80
- 'hu####driver.net':80
- 'de####yriver.net':80
- 'li###eriver.net':80
- 'ri####mister.net':80
- 'li####suppose.net':80
- 'de####yservice.net':80
- 'li####service.net':80
- 'jo####yservice.net':80
- 're####erfifteen.net':80
- 'wo###angry.net':80
- 're####erangry.net':80
- 'wo###dried.net':80
- 're####erdried.net':80
- 'wo####ifteen.net':80
- 'hu####dmister.net':80
- 'jo####ysuppose.net':80
- 'hu####dsuppose.net':80
- 'wo####rticle.net':80
- 're####erarticle.net':80
- 'jo####ymister.net':80
- http://wi####suppose.net/index.php
- http://su####suppose.net/index.php
- http://wi####service.net/index.php
- http://th###river.net/index.php
- http://wi####mister.net/index.php
- http://su####mister.net/index.php
- http://ef####mister.net/index.php
- http://th####hmister.net/index.php
- http://ef####suppose.net/index.php
- http://su####service.net/index.php
- http://wi###nriver.net/index.php
- http://su###rriver.net/index.php
- http://ch###river.net/index.php
- http://be####service.net/index.php
- http://ri###nriver.net/index.php
- http://be###griver.net/index.php
- http://ri####suppose.net/index.php
- http://be####suppose.net/index.php
- http://ri####service.net/index.php
- http://th####uppose.net/index.php
- http://ch####ervice.net/index.php
- http://th####ervice.net/index.php
- http://ch###mister.net/index.php
- http://th###mister.net/index.php
- http://ch####uppose.net/index.php
- http://re####ersuppose.net/index.php
- http://wo####ervice.net/index.php
- http://re####erservice.net/index.php
- http://wo###mister.net/index.php
- http://re####ermister.net/index.php
- http://wo####uppose.net/index.php
- http://hu####dnearly.net/index.php
- http://jo####yhappen.net/index.php
- http://hu####dhappen.net/index.php
- http://wo###river.net/index.php
- http://re####erriver.net/index.php
- http://jo####ynearly.net/index.php
- http://in####seriver.net/index.php
- http://ef###triver.net/index.php
- http://th####hriver.net/index.php
- http://fo####mister.net/index.php
- http://th####hsuppose.net/index.php
- http://ef####service.net/index.php
- http://th####hservice.net/index.php
- http://fo####service.net/index.php
- http://in####seservice.net/index.php
- http://fo###triver.net/index.php
- http://in####semister.net/index.php
- http://fo####suppose.net/index.php
- http://in####sesuppose.net/index.php
- http://be####mister.net/index.php
- http://th####harticle.net/index.php
- http://fo###tdried.net/index.php
- http://in####sedried.net/index.php
- http://ef###tangry.net/index.php
- http://th####hangry.net/index.php
- http://ef####article.net/index.php
- http://in####seangry.net/index.php
- http://fo####article.net/index.php
- http://in####searticle.net/index.php
- http://fo####fifteen.net/index.php
- http://in####sefifteen.net/index.php
- http://fo###tangry.net/index.php
- http://th####hfifteen.net/index.php
- http://wi####fifteen.net/index.php
- http://su####fifteen.net/index.php
- http://wi###nangry.net/index.php
- http://th####rticle.net/index.php
- http://wi###ndried.net/index.php
- http://su###rdried.net/index.php
- http://ef###tdried.net/index.php
- http://th####hdried.net/index.php
- http://ef####fifteen.net/index.php
- http://su###rangry.net/index.php
- http://wi####article.net/index.php
- http://su####article.net/index.php
- http://de####ymister.net/index.php
- http://li####mister.net/index.php
- http://de####ysuppose.net/index.php
- http://hu####dservice.net/index.php
- http://jo####yriver.net/index.php
- http://hu####driver.net/index.php
- http://de####yriver.net/index.php
- http://li###eriver.net/index.php
- http://ri####mister.net/index.php
- http://li####suppose.net/index.php
- http://de####yservice.net/index.php
- http://li####service.net/index.php
- http://jo####yservice.net/index.php
- http://re####erfifteen.net/index.php
- http://wo###angry.net/index.php
- http://re####erangry.net/index.php
- http://wo###dried.net/index.php
- http://re####erdried.net/index.php
- http://wo####ifteen.net/index.php
- http://hu####dmister.net/index.php
- http://jo####ysuppose.net/index.php
- http://hu####dsuppose.net/index.php
- http://wo####rticle.net/index.php
- http://re####erarticle.net/index.php
- http://jo####ymister.net/index.php
- DNS ASK wi####suppose.net
- DNS ASK su####suppose.net
- DNS ASK wi####service.net
- DNS ASK th###river.net
- DNS ASK wi####mister.net
- DNS ASK su####mister.net
- DNS ASK ef####mister.net
- DNS ASK th####hmister.net
- DNS ASK ef####suppose.net
- DNS ASK su####service.net
- DNS ASK wi###nriver.net
- DNS ASK su###rriver.net
- DNS ASK ch###river.net
- DNS ASK be####service.net
- DNS ASK ri###nriver.net
- DNS ASK be###griver.net
- DNS ASK ri####suppose.net
- DNS ASK be####suppose.net
- DNS ASK ri####service.net
- DNS ASK th####uppose.net
- DNS ASK ch####ervice.net
- DNS ASK th####ervice.net
- DNS ASK ch###mister.net
- DNS ASK th###mister.net
- DNS ASK ch####uppose.net
- DNS ASK re####ersuppose.net
- DNS ASK wo####ervice.net
- DNS ASK re####erservice.net
- DNS ASK wo###mister.net
- DNS ASK re####ermister.net
- DNS ASK wo####uppose.net
- DNS ASK hu####dnearly.net
- DNS ASK jo####yhappen.net
- DNS ASK hu####dhappen.net
- DNS ASK wo###river.net
- DNS ASK re####erriver.net
- DNS ASK jo####ynearly.net
- DNS ASK in####seriver.net
- DNS ASK ef###triver.net
- DNS ASK th####hriver.net
- DNS ASK fo####mister.net
- DNS ASK th####hsuppose.net
- DNS ASK ef####service.net
- DNS ASK th####hservice.net
- DNS ASK fo####service.net
- DNS ASK in####seservice.net
- DNS ASK fo###triver.net
- DNS ASK in####semister.net
- DNS ASK fo####suppose.net
- DNS ASK in####sesuppose.net
- DNS ASK be####mister.net
- DNS ASK th####harticle.net
- DNS ASK fo###tdried.net
- DNS ASK in####sedried.net
- DNS ASK ef###tangry.net
- DNS ASK th####hangry.net
- DNS ASK ef####article.net
- DNS ASK in####seangry.net
- DNS ASK fo####article.net
- DNS ASK in####searticle.net
- DNS ASK fo####fifteen.net
- DNS ASK in####sefifteen.net
- DNS ASK fo###tangry.net
- DNS ASK th####hfifteen.net
- DNS ASK wi####fifteen.net
- DNS ASK su####fifteen.net
- DNS ASK wi###nangry.net
- DNS ASK th####rticle.net
- DNS ASK wi###ndried.net
- DNS ASK su###rdried.net
- DNS ASK ef###tdried.net
- DNS ASK th####hdried.net
- DNS ASK ef####fifteen.net
- DNS ASK su###rangry.net
- DNS ASK wi####article.net
- DNS ASK su####article.net
- DNS ASK de####ymister.net
- DNS ASK li####mister.net
- DNS ASK de####ysuppose.net
- DNS ASK hu####dservice.net
- DNS ASK jo####yriver.net
- DNS ASK hu####driver.net
- DNS ASK de####yriver.net
- DNS ASK li###eriver.net
- DNS ASK ri####mister.net
- DNS ASK li####suppose.net
- DNS ASK de####yservice.net
- DNS ASK li####service.net
- DNS ASK jo####yservice.net
- DNS ASK re####erfifteen.net
- DNS ASK wo###angry.net
- DNS ASK re####erangry.net
- DNS ASK wo###dried.net
- DNS ASK re####erdried.net
- DNS ASK wo####ifteen.net
- DNS ASK hu####dmister.net
- DNS ASK jo####ysuppose.net
- DNS ASK hu####dsuppose.net
- DNS ASK wo####rticle.net
- DNS ASK re####erarticle.net
- DNS ASK jo####ymister.net
- ClassName: 'Shell_TrayWnd' WindowName: ''