Technical Information
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Source Error Credential Wired' = 'C:\mbujaeuvqidzzdz\rxnufyiflxb.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\Routing List Framework Reporting Browser Socket] 'Start' = '00000002'
- 'C:\mbujaeuvqidzzdz\ikzsdykmk.exe' "c:\mbujaeuvqidzzdz\rxnufyiflxb.exe"
- 'C:\mbujaeuvqidzzdz\rxnufyiflxb.exe'
- 'C:\mbujaeuvqidzzdz\yw2og8j5jluvksohjq8.exe'
- C:\mbujaeuvqidzzdz\rxnufyiflxb.exe
- C:\mbujaeuvqidzzdz\ikzsdykmk.exe
- C:\mbujaeuvqidzzdz\yw2og8j5jluvksohjq8.exe
- %WINDIR%\mbujaeuvqidzzdz\arledktz
- C:\mbujaeuvqidzzdz\arledktz
- C:\mbujaeuvqidzzdz\ikzsdykmk.exe
- C:\mbujaeuvqidzzdz\rxnufyiflxb.exe
- C:\mbujaeuvqidzzdz\yw2og8j5jluvksohjq8.exe
- %WINDIR%\mbujaeuvqidzzdz\arledktz
- 'pr####bottom.net':80
- 'fe####beyond.net':80
- 'pr####forever.net':80
- 'do####bottom.net':80
- 'fe###wbeing.net':80
- 'fe####bottom.net':80
- 'br####beyond.net':80
- 'do###ebeing.net':80
- 'fe####forever.net':80
- 'st###bottom.net':80
- 'mi###bottom.net':80
- 'st####orever.net':80
- 'mi####orever.net':80
- 'do####beyond.net':80
- 'pr###ybeing.net':80
- 'do####forever.net':80
- 'pr####beyond.net':80
- 'do###rbeing.net':80
- 're####beyond.net':80
- 'de####forever.net':80
- 'pr####ebottom.net':80
- 'de###ebeing.net':80
- 'pr####eforever.net':80
- 'de####bottom.net':80
- 'st####thforever.net':80
- 'st####thbottom.net':80
- 'st####thbeyond.net':80
- 'st####thbeing.net':80
- 'br####forever.net':80
- 're####forever.net':80
- 'br###nbeing.net':80
- 're###tbeing.net':80
- 'br####bottom.net':80
- 'de####beyond.net':80
- 'pr####ebeing.net':80
- 're####bottom.net':80
- 'pr####ebeyond.net':80
- 'mi###being.net':80
- 'en####huntil.net':80
- 'ei###rabove.net':80
- 'fa####finger.net':80
- 'ei###runtil.net':80
- 'en####habove.net':80
- 'ei####finger.net':80
- 'en####hfinger.net':80
- 'ei####shoulder.net':80
- 'en####hshoulder.net':80
- 'ch####enuntil.net':80
- 'fa###yuntil.net':80
- 'pi####efinger.net':80
- 'ci####ttefinger.net':80
- 'ch####enabove.net':80
- 'fa####shoulder.net':80
- 'ch####enfinger.net':80
- 'fa###yabove.net':80
- 'ch#####nshoulder.net':80
- 'mo####ntbeyond.net':80
- 'bu####ngforever.net':80
- 'ev####gforever.net':80
- 'bu####ngbeing.net':80
- 'ev####gbeing.net':80
- 'bu####ngbottom.net':80
- 'mi###beyond.net':80
- 'st###being.net':80
- 'ev####gbottom.net':80
- 'st###beyond.net':80
- 'ou####ebeing.net':80
- 'mo####ntforever.net':80
- 'ou####ebeyond.net':80
- 'mo####ntbeing.net':80
- 'ou####eforever.net':80
- 'bu####ngbeyond.net':80
- 'ev####gbeyond.net':80
- 'mo####ntbottom.net':80
- 'ou####ebottom.net':80
- http://pr####bottom.net/index.php
- http://fe####beyond.net/index.php
- http://pr####forever.net/index.php
- http://do####bottom.net/index.php
- http://fe###wbeing.net/index.php
- http://fe####bottom.net/index.php
- http://br####beyond.net/index.php
- http://do###ebeing.net/index.php
- http://fe####forever.net/index.php
- http://st###bottom.net/index.php
- http://mi###bottom.net/index.php
- http://st####orever.net/index.php
- http://mi####orever.net/index.php
- http://do####beyond.net/index.php
- http://pr###ybeing.net/index.php
- http://do####forever.net/index.php
- http://pr####beyond.net/index.php
- http://do###rbeing.net/index.php
- http://re####beyond.net/index.php
- http://de####forever.net/index.php
- http://pr####ebottom.net/index.php
- http://de###ebeing.net/index.php
- http://pr####eforever.net/index.php
- http://de####bottom.net/index.php
- http://st####thforever.net/index.php
- http://st####thbottom.net/index.php
- http://st####thbeyond.net/index.php
- http://st####thbeing.net/index.php
- http://br####forever.net/index.php
- http://re####forever.net/index.php
- http://br###nbeing.net/index.php
- http://re###tbeing.net/index.php
- http://br####bottom.net/index.php
- http://de####beyond.net/index.php
- http://pr####ebeing.net/index.php
- http://re####bottom.net/index.php
- http://pr####ebeyond.net/index.php
- http://mi###being.net/index.php
- http://en####huntil.net/index.php
- http://ei###rabove.net/index.php
- http://fa####finger.net/index.php
- http://ei###runtil.net/index.php
- http://en####habove.net/index.php
- http://ei####finger.net/index.php
- http://en####hfinger.net/index.php
- http://ei####shoulder.net/index.php
- http://en####hshoulder.net/index.php
- http://ch####enuntil.net/index.php
- http://fa###yuntil.net/index.php
- http://pi####efinger.net/index.php
- http://ci####ttefinger.net/index.php
- http://ch####enabove.net/index.php
- http://fa####shoulder.net/index.php
- http://ch####enfinger.net/index.php
- http://fa###yabove.net/index.php
- http://ch#####nshoulder.net/index.php
- http://mo####ntbeyond.net/index.php
- http://bu####ngforever.net/index.php
- http://ev####gforever.net/index.php
- http://bu####ngbeing.net/index.php
- http://ev####gbeing.net/index.php
- http://bu####ngbottom.net/index.php
- http://mi###beyond.net/index.php
- http://st###being.net/index.php
- http://ev####gbottom.net/index.php
- http://st###beyond.net/index.php
- http://ou####ebeing.net/index.php
- http://mo####ntforever.net/index.php
- http://ou####ebeyond.net/index.php
- http://mo####ntbeing.net/index.php
- http://ou####eforever.net/index.php
- http://bu####ngbeyond.net/index.php
- http://ev####gbeyond.net/index.php
- http://mo####ntbottom.net/index.php
- http://ou####ebottom.net/index.php
- DNS ASK pr####bottom.net
- DNS ASK fe####beyond.net
- DNS ASK pr####forever.net
- DNS ASK do####bottom.net
- DNS ASK fe###wbeing.net
- DNS ASK fe####bottom.net
- DNS ASK br####beyond.net
- DNS ASK do###ebeing.net
- DNS ASK fe####forever.net
- DNS ASK st###bottom.net
- DNS ASK mi###bottom.net
- DNS ASK st####orever.net
- DNS ASK mi####orever.net
- DNS ASK do####beyond.net
- DNS ASK pr###ybeing.net
- DNS ASK do####forever.net
- DNS ASK pr####beyond.net
- DNS ASK do###rbeing.net
- DNS ASK re####beyond.net
- DNS ASK de####forever.net
- DNS ASK pr####ebottom.net
- DNS ASK de###ebeing.net
- DNS ASK pr####eforever.net
- DNS ASK de####bottom.net
- DNS ASK st####thforever.net
- DNS ASK st####thbottom.net
- DNS ASK st####thbeyond.net
- DNS ASK st####thbeing.net
- DNS ASK br####forever.net
- DNS ASK re####forever.net
- DNS ASK br###nbeing.net
- DNS ASK re###tbeing.net
- DNS ASK br####bottom.net
- DNS ASK de####beyond.net
- DNS ASK pr####ebeing.net
- DNS ASK re####bottom.net
- DNS ASK pr####ebeyond.net
- DNS ASK mi###being.net
- DNS ASK en####huntil.net
- DNS ASK ei###rabove.net
- DNS ASK fa####finger.net
- DNS ASK ei###runtil.net
- DNS ASK en####habove.net
- DNS ASK ei####finger.net
- DNS ASK en####hfinger.net
- DNS ASK ei####shoulder.net
- DNS ASK en####hshoulder.net
- DNS ASK ch####enuntil.net
- DNS ASK fa###yuntil.net
- DNS ASK pi####efinger.net
- DNS ASK ci####ttefinger.net
- DNS ASK ch####enabove.net
- DNS ASK fa####shoulder.net
- DNS ASK ch####enfinger.net
- DNS ASK fa###yabove.net
- DNS ASK ch#####nshoulder.net
- DNS ASK mo####ntbeyond.net
- DNS ASK bu####ngforever.net
- DNS ASK ev####gforever.net
- DNS ASK bu####ngbeing.net
- DNS ASK ev####gbeing.net
- DNS ASK bu####ngbottom.net
- DNS ASK mi###beyond.net
- DNS ASK st###being.net
- DNS ASK ev####gbottom.net
- DNS ASK st###beyond.net
- DNS ASK ou####ebeing.net
- DNS ASK mo####ntforever.net
- DNS ASK ou####ebeyond.net
- DNS ASK mo####ntbeing.net
- DNS ASK ou####eforever.net
- DNS ASK bu####ngbeyond.net
- DNS ASK ev####gbeyond.net
- DNS ASK mo####ntbottom.net
- DNS ASK ou####ebottom.net
- ClassName: 'Shell_TrayWnd' WindowName: ''