Technical Information
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Client BitLocker Disk Shell Controls Play' = 'C:\ozxffupaxdn\cypbkexm.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\Wired Profile Intelligent Adaptive] 'Start' = '00000002'
- [<HKLM>\SYSTEM\ControlSet001\Services\Wired Profile Intelligent Adaptive] 'ImagePath' = 'C:\ozxffupaxdn\cypbkexm.exe'
- %WINDIR%\ozxffupaxdn\fncn8k6frk
- C:\ozxffupaxdn\fncn8k6frk
- C:\ozxffupaxdn\zr2vabfeuyxlqkdi.exe
- C:\ozxffupaxdn\cypbkexm.exe
- C:\ozxffupaxdn\sedttjdgy.exe
- C:\ozxffupaxdn\cypbkexm.exe
- C:\ozxffupaxdn\sedttjdgy.exe
- %WINDIR%\ozxffupaxdn\fncn8k6frk
- C:\ozxffupaxdn\zr2vabfeuyxlqkdi.exe
- %WINDIR%\ozxffupaxdn\fncn8k6frk
- 'fa####article.net':80
- 'pi####eservice.net':80
- 'ci#####tesuppose.net':80
- 'pi####esuppose.net':80
- 'ci####ttemister.net':80
- 'pi####emister.net':80
- 'th###hriver.net':80
- 'fi###eriver.net':80
- 'th####service.net':80
- 'fi####service.net':80
- 'th####suppose.net':80
- 'fi####suppose.net':80
- 'th####mister.net':80
- 'fi####mister.net':80
- 'ri###river.net':80
- 'wh####rriver.net':80
- 'ci#####teservice.net':80
- 'ci####tteriver.net':80
- 'ex####nearly.net':80
- 'ch####enmister.net':80
- 'en####hriver.net':80
- 'ei###rriver.net':80
- 'en####hservice.net':80
- 'ei####service.net':80
- 'en####hsuppose.net':80
- 'ei####suppose.net':80
- 'en####hmister.net':80
- 'ei####mister.net':80
- 'fa###yriver.net':80
- 'ch####enriver.net':80
- 'fa####service.net':80
- 'ch####enservice.net':80
- 'fa####suppose.net':80
- 'ch####ensuppose.net':80
- 'fa####mister.net':80
- 'ri####ervice.net':80
- 'pi####eriver.net':80
- 'wh####rservice.net':80
- 'pe####mister.net':80
- 'ex###triver.net':80
- 'be####eservice.net':80
- 'ex####service.net':80
- 'be####esuppose.net':80
- 'ex####suppose.net':80
- 'be####emister.net':80
- 'ex####mister.net':80
- 'en####harticle.net':80
- 'ei####article.net':80
- 'en####hangry.net':80
- 'ei###rangry.net':80
- 'en####hfifteen.net':80
- 'ei####fifteen.net':80
- 'en####hdried.net':80
- 'ei###rdried.net':80
- 'be####eriver.net':80
- 'ma####emister.net':80
- 'wh####rsuppose.net':80
- 'pe####suppose.net':80
- 'ri###mister.net':80
- 'wh####rmister.net':80
- 'fo####nriver.net':80
- 'su###nriver.net':80
- 'fo####nservice.net':80
- 'su####service.net':80
- 'fo####nsuppose.net':80
- 'su####suppose.net':80
- 'fo####nmister.net':80
- 'su####mister.net':80
- 'ma####eriver.net':80
- 'pe###nriver.net':80
- 'ma####eservice.net':80
- 'pe####service.net':80
- 'ma####esuppose.net':80
- 'ri####uppose.net':80
- 'be####enearly.net':80
- http://fa####article.net/index.php
- http://pi####eservice.net/index.php
- http://ci#####tesuppose.net/index.php
- http://pi####esuppose.net/index.php
- http://ci####ttemister.net/index.php
- http://pi####emister.net/index.php
- http://th###hriver.net/index.php
- http://fi###eriver.net/index.php
- http://th####service.net/index.php
- http://fi####service.net/index.php
- http://th####suppose.net/index.php
- http://fi####suppose.net/index.php
- http://th####mister.net/index.php
- http://fi####mister.net/index.php
- http://ri###river.net/index.php
- http://wh####rriver.net/index.php
- http://ci#####teservice.net/index.php
- http://ci####tteriver.net/index.php
- http://ex####nearly.net/index.php
- http://ch####enmister.net/index.php
- http://en####hriver.net/index.php
- http://ei###rriver.net/index.php
- http://en####hservice.net/index.php
- http://ei####service.net/index.php
- http://en####hsuppose.net/index.php
- http://ei####suppose.net/index.php
- http://en####hmister.net/index.php
- http://ei####mister.net/index.php
- http://fa###yriver.net/index.php
- http://ch####enriver.net/index.php
- http://fa####service.net/index.php
- http://ch####enservice.net/index.php
- http://fa####suppose.net/index.php
- http://ch####ensuppose.net/index.php
- http://fa####mister.net/index.php
- http://ri####ervice.net/index.php
- http://pi####eriver.net/index.php
- http://wh####rservice.net/index.php
- http://pe####mister.net/index.php
- http://ex###triver.net/index.php
- http://be####eservice.net/index.php
- http://ex####service.net/index.php
- http://be####esuppose.net/index.php
- http://ex####suppose.net/index.php
- http://be####emister.net/index.php
- http://ex####mister.net/index.php
- http://en####harticle.net/index.php
- http://ei####article.net/index.php
- http://en####hangry.net/index.php
- http://ei###rangry.net/index.php
- http://en####hfifteen.net/index.php
- http://ei####fifteen.net/index.php
- http://en####hdried.net/index.php
- http://ei###rdried.net/index.php
- http://be####eriver.net/index.php
- http://ma####emister.net/index.php
- http://wh####rsuppose.net/index.php
- http://pe####suppose.net/index.php
- http://ri###mister.net/index.php
- http://wh####rmister.net/index.php
- http://fo####nriver.net/index.php
- http://su###nriver.net/index.php
- http://fo####nservice.net/index.php
- http://su####service.net/index.php
- http://fo####nsuppose.net/index.php
- http://su####suppose.net/index.php
- http://fo####nmister.net/index.php
- http://su####mister.net/index.php
- http://ma####eriver.net/index.php
- http://pe###nriver.net/index.php
- http://ma####eservice.net/index.php
- http://pe####service.net/index.php
- http://ma####esuppose.net/index.php
- http://ri####uppose.net/index.php
- http://be####enearly.net/index.php
- DNS ASK fa####article.net
- DNS ASK pi####eriver.net
- DNS ASK ci#####teservice.net
- DNS ASK pi####eservice.net
- DNS ASK ci#####tesuppose.net
- DNS ASK pi####esuppose.net
- DNS ASK ci####ttemister.net
- DNS ASK pi####emister.net
- DNS ASK th###hriver.net
- DNS ASK fi###eriver.net
- DNS ASK th####service.net
- DNS ASK fi####service.net
- DNS ASK th####suppose.net
- DNS ASK fi####suppose.net
- DNS ASK th####mister.net
- DNS ASK fi####mister.net
- DNS ASK wh####rriver.net
- DNS ASK ri###river.net
- DNS ASK ci####tteriver.net
- DNS ASK ch####enmister.net
- DNS ASK ex####nearly.net
- DNS ASK en####hriver.net
- DNS ASK ei###rriver.net
- DNS ASK en####hservice.net
- DNS ASK ei####service.net
- DNS ASK en####hsuppose.net
- DNS ASK ei####suppose.net
- DNS ASK ei####mister.net
- DNS ASK su####suppose.net
- DNS ASK fa###yriver.net
- DNS ASK ch####enriver.net
- DNS ASK fa####service.net
- DNS ASK ch####enservice.net
- DNS ASK fa####suppose.net
- DNS ASK ch####ensuppose.net
- DNS ASK fa####mister.net
- DNS ASK ri####ervice.net
- DNS ASK wh####rservice.net
- DNS ASK ri####uppose.net
- DNS ASK be####eservice.net
- DNS ASK ex####service.net
- DNS ASK be####esuppose.net
- DNS ASK ex####suppose.net
- DNS ASK be####emister.net
- DNS ASK ex####mister.net
- DNS ASK en####harticle.net
- DNS ASK ei####article.net
- DNS ASK en####hangry.net
- DNS ASK ei###rangry.net
- DNS ASK en####hfifteen.net
- DNS ASK ei####fifteen.net
- DNS ASK en####hdried.net
- DNS ASK ei###rdried.net
- DNS ASK be####eriver.net
- DNS ASK pe####mister.net
- DNS ASK ex###triver.net
- DNS ASK ma####emister.net
- DNS ASK wh####rsuppose.net
- DNS ASK pe####suppose.net
- DNS ASK ri###mister.net
- DNS ASK wh####rmister.net
- DNS ASK fo####nriver.net
- DNS ASK su###nriver.net
- DNS ASK fo####nservice.net
- DNS ASK su####service.net
- DNS ASK en####hmister.net
- DNS ASK be####enearly.net
- DNS ASK fo####nmister.net
- DNS ASK su####mister.net
- DNS ASK ma####eriver.net
- DNS ASK pe###nriver.net
- DNS ASK ma####eservice.net
- DNS ASK pe####service.net
- DNS ASK ma####esuppose.net
- DNS ASK fo####nsuppose.net
- DNS ASK ex####happen.net
- 'C:\ozxffupaxdn\zr2vabfeuyxlqkdi.exe'
- 'C:\ozxffupaxdn\cypbkexm.exe'
- 'C:\ozxffupaxdn\sedttjdgy.exe' "c:\ozxffupaxdn\cypbkexm.exe"