Technical Information
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Encrypting CNG Upgrade AuthIP Ordering Store' = 'C:\mahtoatwoarn\sbrmqyk.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\Parental Key Disk RPC Resolution Connections] 'ImagePath' = 'C:\mahtoatwoarn\sbrmqyk.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\Parental Key Disk RPC Resolution Connections] 'Start' = '00000002'
- 'C:\mahtoatwoarn\xsniivnh.exe' "c:\mahtoatwoarn\sbrmqyk.exe"
- 'C:\mahtoatwoarn\sbrmqyk.exe'
- 'C:\mahtoatwoarn\pa2yf5mufawlyanonmu.exe'
- C:\mahtoatwoarn\sbrmqyk.exe
- C:\mahtoatwoarn\xsniivnh.exe
- C:\mahtoatwoarn\pa2yf5mufawlyanonmu.exe
- %WINDIR%\mahtoatwoarn\mfahrkl
- C:\mahtoatwoarn\mfahrkl
- C:\mahtoatwoarn\xsniivnh.exe
- C:\mahtoatwoarn\sbrmqyk.exe
- C:\mahtoatwoarn\pa2yf5mufawlyanonmu.exe
- %WINDIR%\mahtoatwoarn\mfahrkl
- 'bu####nghappen.net':80
- 'ev####ghappen.net':80
- 'bu####ngnearly.net':80
- 'ev####gnearly.net':80
- 'bu####ngshare.net':80
- 'ev####gshare.net':80
- 'bu####ngshake.net':80
- 'ev####gshake.net':80
- 'ou####eshare.net':80
- 'ou####enearly.net':80
- 'mo####nthappen.net':80
- 'st###river.net':80
- 'mo####ntnearly.net':80
- 'ou####eshake.net':80
- 'mo####ntshare.net':80
- 'ou####ehappen.net':80
- 'mo####ntshake.net':80
- 'pr####happen.net':80
- 'do###rshake.net':80
- 'pr####nearly.net':80
- 'do####happen.net':80
- 'pr###yshare.net':80
- 'fe####nearly.net':80
- 'pr###yshake.net':80
- 'do###rshare.net':80
- 'do####nearly.net':80
- 'st###happen.net':80
- 'mi###happen.net':80
- 'st###nearly.net':80
- 'mi###nearly.net':80
- 'st###share.net':80
- 'mi###share.net':80
- 'st###shake.net':80
- 'mi###shake.net':80
- 'st####thriver.net':80
- 'do###eriver.net':80
- 'br####mister.net':80
- 'fe####service.net':80
- 'fe###wriver.net':80
- 're####suppose.net':80
- 'br####service.net':80
- 're####mister.net':80
- 'br####suppose.net':80
- 'do####suppose.net':80
- 'pr####service.net':80
- 'do###rriver.net':80
- 'pr####suppose.net':80
- 'do####service.net':80
- 'do####mister.net':80
- 'fe####suppose.net':80
- 'pr###yriver.net':80
- 'fe####mister.net':80
- 'st####thmister.net':80
- 'st###mister.net':80
- 'pr####eriver.net':80
- 'de###eriver.net':80
- 'st####thservice.net':80
- 'st####ervice.net':80
- 'st####thsuppose.net':80
- 'st####uppose.net':80
- 'de####service.net':80
- 're###triver.net':80
- 'pr####emister.net':80
- 're####service.net':80
- 'br###nriver.net':80
- 'de####suppose.net':80
- 'pr####eservice.net':80
- 'de####mister.net':80
- 'pr####esuppose.net':80
- http://bu####nghappen.net/index.php
- http://ev####ghappen.net/index.php
- http://bu####ngnearly.net/index.php
- http://ev####gnearly.net/index.php
- http://bu####ngshare.net/index.php
- http://ev####gshare.net/index.php
- http://bu####ngshake.net/index.php
- http://ev####gshake.net/index.php
- http://ou####eshare.net/index.php
- http://ou####enearly.net/index.php
- http://mo####nthappen.net/index.php
- http://st###river.net/index.php
- http://mo####ntnearly.net/index.php
- http://ou####eshake.net/index.php
- http://mo####ntshare.net/index.php
- http://ou####ehappen.net/index.php
- http://mo####ntshake.net/index.php
- http://pr####happen.net/index.php
- http://do###rshake.net/index.php
- http://pr####nearly.net/index.php
- http://do####happen.net/index.php
- http://pr###yshare.net/index.php
- http://fe####nearly.net/index.php
- http://pr###yshake.net/index.php
- http://do###rshare.net/index.php
- http://do####nearly.net/index.php
- http://st###happen.net/index.php
- http://mi###happen.net/index.php
- http://st###nearly.net/index.php
- http://mi###nearly.net/index.php
- http://st###share.net/index.php
- http://mi###share.net/index.php
- http://st###shake.net/index.php
- http://mi###shake.net/index.php
- http://st####thriver.net/index.php
- http://do###eriver.net/index.php
- http://br####mister.net/index.php
- http://fe####service.net/index.php
- http://fe###wriver.net/index.php
- http://re####suppose.net/index.php
- http://br####service.net/index.php
- http://re####mister.net/index.php
- http://br####suppose.net/index.php
- http://do####suppose.net/index.php
- http://pr####service.net/index.php
- http://do###rriver.net/index.php
- http://pr####suppose.net/index.php
- http://do####service.net/index.php
- http://do####mister.net/index.php
- http://fe####suppose.net/index.php
- http://pr###yriver.net/index.php
- http://fe####mister.net/index.php
- http://st####thmister.net/index.php
- http://st###mister.net/index.php
- http://pr####eriver.net/index.php
- http://de###eriver.net/index.php
- http://st####thservice.net/index.php
- http://st####ervice.net/index.php
- http://st####thsuppose.net/index.php
- http://st####uppose.net/index.php
- http://de####service.net/index.php
- http://re###triver.net/index.php
- http://pr####emister.net/index.php
- http://re####service.net/index.php
- http://br###nriver.net/index.php
- http://de####suppose.net/index.php
- http://pr####eservice.net/index.php
- http://de####mister.net/index.php
- http://pr####esuppose.net/index.php
- DNS ASK bu####nghappen.net
- DNS ASK ev####ghappen.net
- DNS ASK bu####ngnearly.net
- DNS ASK ev####gnearly.net
- DNS ASK bu####ngshare.net
- DNS ASK ev####gshare.net
- DNS ASK bu####ngshake.net
- DNS ASK ev####gshake.net
- DNS ASK ou####eshare.net
- DNS ASK ou####enearly.net
- DNS ASK mo####nthappen.net
- DNS ASK st###river.net
- DNS ASK mo####ntnearly.net
- DNS ASK ou####eshake.net
- DNS ASK mo####ntshare.net
- DNS ASK ou####ehappen.net
- DNS ASK mo####ntshake.net
- DNS ASK st###nearly.net
- DNS ASK do###rshake.net
- DNS ASK pr###yshake.net
- DNS ASK do####happen.net
- DNS ASK pr####happen.net
- DNS ASK fe####nearly.net
- DNS ASK fe####happen.net
- DNS ASK do###rshare.net
- DNS ASK pr###yshare.net
- DNS ASK pr####nearly.net
- DNS ASK mi###happen.net
- DNS ASK st###shake.net
- DNS ASK mi###nearly.net
- DNS ASK st###happen.net
- DNS ASK mi###share.net
- DNS ASK do####nearly.net
- DNS ASK mi###shake.net
- DNS ASK st###share.net
- DNS ASK do###eriver.net
- DNS ASK br####mister.net
- DNS ASK fe####service.net
- DNS ASK fe###wriver.net
- DNS ASK re####suppose.net
- DNS ASK br####service.net
- DNS ASK re####mister.net
- DNS ASK br####suppose.net
- DNS ASK do####suppose.net
- DNS ASK pr####service.net
- DNS ASK do###rriver.net
- DNS ASK pr####suppose.net
- DNS ASK do####service.net
- DNS ASK do####mister.net
- DNS ASK fe####suppose.net
- DNS ASK pr###yriver.net
- DNS ASK fe####mister.net
- DNS ASK re####service.net
- DNS ASK st###mister.net
- DNS ASK st####thsuppose.net
- DNS ASK de###eriver.net
- DNS ASK st####thmister.net
- DNS ASK st####ervice.net
- DNS ASK st####thriver.net
- DNS ASK st####uppose.net
- DNS ASK st####thservice.net
- DNS ASK pr####eriver.net
- DNS ASK pr####emister.net
- DNS ASK de####mister.net
- DNS ASK br###nriver.net
- DNS ASK re###triver.net
- DNS ASK pr####eservice.net
- DNS ASK de####service.net
- DNS ASK pr####esuppose.net
- DNS ASK de####suppose.net
- ClassName: 'Shell_TrayWnd' WindowName: ''