Technical Information
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Net.Tcp Video Application ActiveX' = 'C:\iwbfcrzrpe\kaldsisyjymz.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\COM CNG Authentication Level Control Socket] 'Start' = '00000002'
- 'C:\iwbfcrzrpe\kwfposkifwtg.exe' "c:\iwbfcrzrpe\kaldsisyjymz.exe"
- 'C:\iwbfcrzrpe\kaldsisyjymz.exe'
- 'C:\iwbfcrzrpe\nbb2iqhzvryvhiiv2ic.exe'
- C:\iwbfcrzrpe\kaldsisyjymz.exe
- C:\iwbfcrzrpe\kwfposkifwtg.exe
- C:\iwbfcrzrpe\nbb2iqhzvryvhiiv2ic.exe
- %WINDIR%\iwbfcrzrpe\lur98vlqd2fw
- C:\iwbfcrzrpe\lur98vlqd2fw
- C:\iwbfcrzrpe\kwfposkifwtg.exe
- C:\iwbfcrzrpe\kaldsisyjymz.exe
- C:\iwbfcrzrpe\nbb2iqhzvryvhiiv2ic.exe
- %WINDIR%\iwbfcrzrpe\lur98vlqd2fw
- 'ci#####tecompany.net':80
- 'ch####enfurther.net':80
- 'ci####ttebecome.net':80
- 'pi####ecompany.net':80
- 'fa####further.net':80
- 'ch####enbecome.net':80
- 'fa####become.net':80
- 'ch####encover.net':80
- 'fa###ycover.net':80
- 'pi####ebecome.net':80
- 'th####become.net':80
- 'fi####company.net':80
- 'th###hcover.net':80
- 'fi####become.net':80
- 'th####company.net':80
- 'pi####ecover.net':80
- 'ci####ttecover.net':80
- 'pi####efurther.net':80
- 'ci#####tefurther.net':80
- 'ex###tabove.net':80
- 'be####eabove.net':80
- 'ex###tuntil.net':80
- 'be####euntil.net':80
- 'ex####shoulder.net':80
- 'be####efinger.net':80
- 'pe###nuntil.net':80
- 'be####eshoulder.net':80
- 'ex####finger.net':80
- 'en####hcompany.net':80
- 'ei####further.net':80
- 'en####hfurther.net':80
- 'ch####encompany.net':80
- 'fa####company.net':80
- 'ei###rcover.net':80
- 'en####hbecome.net':80
- 'ei####company.net':80
- 'en####hcover.net':80
- 'ei####become.net':80
- 'fi###ecover.net':80
- 'pe####further.net':80
- 'ma####efurther.net':80
- 'ex####company.net':80
- 'be####ecompany.net':80
- 'pe###ncover.net':80
- 'ma####ebecome.net':80
- 'pe####company.net':80
- 'ma####ecover.net':80
- 'pe####become.net':80
- 'be####ebecome.net':80
- 'ei####govern.net':80
- 'en####hgovern.net':80
- 'ei####enough.net':80
- 'en####henough.net':80
- 'ex####further.net':80
- 'be####ecover.net':80
- 'ex####become.net':80
- 'be####efurther.net':80
- 'ex###tcover.net':80
- 'ri###cover.net':80
- 'wh####rbecome.net':80
- 'ri####urther.net':80
- 'wh####rcover.net':80
- 'ri###become.net':80
- 'fi####further.net':80
- 'th####further.net':80
- 'wh####rcompany.net':80
- 'ri####ompany.net':80
- 'wh####rfurther.net':80
- 'fo####nfurther.net':80
- 'su###ncover.net':80
- 'ma####ecompany.net':80
- 'su####further.net':80
- 'fo####ncover.net':80
- 'su####company.net':80
- 'fo####ncompany.net':80
- 'su####become.net':80
- 'fo####nbecome.net':80
- http://ci#####tecompany.net/index.php
- http://ch####enfurther.net/index.php
- http://ci####ttebecome.net/index.php
- http://pi####ecompany.net/index.php
- http://fa####further.net/index.php
- http://ch####enbecome.net/index.php
- http://fa####become.net/index.php
- http://ch####encover.net/index.php
- http://fa###ycover.net/index.php
- http://pi####ebecome.net/index.php
- http://th####become.net/index.php
- http://fi####company.net/index.php
- http://th###hcover.net/index.php
- http://fi####become.net/index.php
- http://th####company.net/index.php
- http://pi####ecover.net/index.php
- http://ci####ttecover.net/index.php
- http://pi####efurther.net/index.php
- http://ci#####tefurther.net/index.php
- http://ex###tabove.net/index.php
- http://be####eabove.net/index.php
- http://ex###tuntil.net/index.php
- http://be####euntil.net/index.php
- http://ex####shoulder.net/index.php
- http://be####efinger.net/index.php
- http://pe###nuntil.net/index.php
- http://be####eshoulder.net/index.php
- http://ex####finger.net/index.php
- http://en####hcompany.net/index.php
- http://ei####further.net/index.php
- http://en####hfurther.net/index.php
- http://ch####encompany.net/index.php
- http://fa####company.net/index.php
- http://ei###rcover.net/index.php
- http://en####hbecome.net/index.php
- http://ei####company.net/index.php
- http://en####hcover.net/index.php
- http://ei####become.net/index.php
- http://fi###ecover.net/index.php
- http://pe####further.net/index.php
- http://ma####efurther.net/index.php
- http://ex####company.net/index.php
- http://be####ecompany.net/index.php
- http://pe###ncover.net/index.php
- http://ma####ebecome.net/index.php
- http://pe####company.net/index.php
- http://ma####ecover.net/index.php
- http://pe####become.net/index.php
- http://be####ebecome.net/index.php
- http://ei####govern.net/index.php
- http://en####hgovern.net/index.php
- http://ei####enough.net/index.php
- http://en####henough.net/index.php
- http://ex####further.net/index.php
- http://be####ecover.net/index.php
- http://ex####become.net/index.php
- http://be####efurther.net/index.php
- http://ex###tcover.net/index.php
- http://ri###cover.net/index.php
- http://wh####rbecome.net/index.php
- http://ri####urther.net/index.php
- http://wh####rcover.net/index.php
- http://ri###become.net/index.php
- http://fi####further.net/index.php
- http://th####further.net/index.php
- http://wh####rcompany.net/index.php
- http://ri####ompany.net/index.php
- http://wh####rfurther.net/index.php
- http://fo####nfurther.net/index.php
- http://su###ncover.net/index.php
- http://ma####ecompany.net/index.php
- http://su####further.net/index.php
- http://fo####ncover.net/index.php
- http://su####company.net/index.php
- http://fo####ncompany.net/index.php
- http://su####become.net/index.php
- http://fo####nbecome.net/index.php
- DNS ASK ci#####tecompany.net
- DNS ASK ch####enfurther.net
- DNS ASK ci####ttebecome.net
- DNS ASK pi####ecompany.net
- DNS ASK fa####further.net
- DNS ASK ch####enbecome.net
- DNS ASK fa####become.net
- DNS ASK ch####encover.net
- DNS ASK fa###ycover.net
- DNS ASK pi####ebecome.net
- DNS ASK th####become.net
- DNS ASK fi####company.net
- DNS ASK th###hcover.net
- DNS ASK fi####become.net
- DNS ASK th####company.net
- DNS ASK pi####ecover.net
- DNS ASK ci####ttecover.net
- DNS ASK pi####efurther.net
- DNS ASK ci#####tefurther.net
- DNS ASK ch####encompany.net
- DNS ASK be####eabove.net
- DNS ASK ex####shoulder.net
- DNS ASK be####euntil.net
- DNS ASK ex###tabove.net
- DNS ASK be####eshoulder.net
- DNS ASK pe###nuntil.net
- DNS ASK ma####euntil.net
- DNS ASK ex####finger.net
- DNS ASK be####efinger.net
- DNS ASK ex###tuntil.net
- DNS ASK en####hfurther.net
- DNS ASK ei###rcover.net
- DNS ASK fa####company.net
- DNS ASK ei####further.net
- DNS ASK en####hcover.net
- DNS ASK ei####company.net
- DNS ASK en####hcompany.net
- DNS ASK ei####become.net
- DNS ASK en####hbecome.net
- DNS ASK pe####further.net
- DNS ASK ma####efurther.net
- DNS ASK ex####company.net
- DNS ASK be####ecompany.net
- DNS ASK pe###ncover.net
- DNS ASK ma####ebecome.net
- DNS ASK pe####company.net
- DNS ASK ma####ecover.net
- DNS ASK pe####become.net
- DNS ASK be####ebecome.net
- DNS ASK ei####govern.net
- DNS ASK en####hgovern.net
- DNS ASK ei####enough.net
- DNS ASK en####henough.net
- DNS ASK ex####further.net
- DNS ASK be####ecover.net
- DNS ASK ex####become.net
- DNS ASK be####efurther.net
- DNS ASK ex###tcover.net
- DNS ASK ma####ecompany.net
- DNS ASK wh####rbecome.net
- DNS ASK ri###become.net
- DNS ASK wh####rcover.net
- DNS ASK ri###cover.net
- DNS ASK wh####rcompany.net
- DNS ASK th####further.net
- DNS ASK fi###ecover.net
- DNS ASK ri####ompany.net
- DNS ASK fi####further.net
- DNS ASK ri####urther.net
- DNS ASK su###ncover.net
- DNS ASK fo####ncover.net
- DNS ASK su####further.net
- DNS ASK fo####nfurther.net
- DNS ASK su####become.net
- DNS ASK fo####ncompany.net
- DNS ASK wh####rfurther.net
- DNS ASK fo####nbecome.net
- DNS ASK su####company.net
- ClassName: 'Shell_TrayWnd' WindowName: ''