Technical Information
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Adaptive Configuration HomeGroup' = 'C:\uqcmyajxu\aecnanrfpwb.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\Auto Key Builder UserMode BitLocker] 'ImagePath' = 'C:\uqcmyajxu\aecnanrfpwb.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\Auto Key Builder UserMode BitLocker] 'Start' = '00000002'
- 'C:\uqcmyajxu\vzynaelem.exe' "c:\uqcmyajxu\aecnanrfpwb.exe"
- 'C:\uqcmyajxu\aecnanrfpwb.exe'
- 'C:\uqcmyajxu\f7cwm2g3fymqpdthllsd.exe'
- C:\uqcmyajxu\aecnanrfpwb.exe
- C:\uqcmyajxu\vzynaelem.exe
- C:\uqcmyajxu\f7cwm2g3fymqpdthllsd.exe
- %WINDIR%\uqcmyajxu\pohurxbwbyjs
- C:\uqcmyajxu\pohurxbwbyjs
- C:\uqcmyajxu\vzynaelem.exe
- C:\uqcmyajxu\aecnanrfpwb.exe
- C:\uqcmyajxu\f7cwm2g3fymqpdthllsd.exe
- %WINDIR%\uqcmyajxu\pohurxbwbyjs
- 'mo###rvalue.net':80
- 'mo####inalmost.net':80
- 'si###evalue.net':80
- 'si####orderly.net':80
- 'mo####orderly.net':80
- 'po####lealmost.net':80
- 'po####leorderly.net':80
- 'mo####invalue.net':80
- 'mo####inorderly.net':80
- 'mo####inreason.net':80
- 'po####lereason.net':80
- 'se####orderly.net':80
- 'la####rderly.net':80
- 'la###reason.net':80
- 'la###almost.net':80
- 'se####reason.net':80
- 'se###avalue.net':80
- 'si####reason.net':80
- 'mo####reason.net':80
- 'mo####almost.net':80
- 'la###value.net':80
- 'si####almost.net':80
- 'fi####almost.net':80
- 'le###almost.net':80
- 'su####tvalue.net':80
- 'su####torderly.net':80
- 'wi###rvalue.net':80
- 'fi####reason.net':80
- 'fi###hvalue.net':80
- 'le###value.net':80
- 'le####rderly.net':80
- 'le###reason.net':80
- 'fi####orderly.net':80
- 'pe####sreason.net':80
- 'wi####reason.net':80
- 'wi####almost.net':80
- 'po####levalue.net':80
- 'pe####salmost.net':80
- 'pe####sorderly.net':80
- 'su####talmost.net':80
- 'su####treason.net':80
- 'wi###wvalue.net':80
- 'wi####orderly.net':80
- 'pe####svalue.net':80
- 'se####almost.net':80
- 'su####perfect.net':80
- 'cr####erfect.net':80
- 'cr###heart.net':80
- 'kn###battle.net':80
- 'su###rheart.net':80
- 'su###rmayor.net':80
- 'th####theart.net':80
- 'wa###heart.net':80
- 'cr###battle.net':80
- 'cr###mayor.net':80
- 'su####battle.net':80
- 'me####battle.net':80
- 'be###heart.net':80
- 'fo####battle.net':80
- 'fo###wmayor.net':80
- 'me###rmayor.net':80
- 'kn###heart.net':80
- 'kn###mayor.net':80
- 'be###battle.net':80
- 'be###mayor.net':80
- 'be####erfect.net':80
- 'kn####erfect.net':80
- 'pa###heart.net':80
- 'fi###heart.net':80
- 'sm###battle.net':80
- 'sm###mayor.net':80
- 'wo###battle.net':80
- 'pa####erfect.net':80
- 'pa###battle.net':80
- 'fi###battle.net':80
- 'fi###mayor.net':80
- 'fi####erfect.net':80
- 'pa###mayor.net':80
- 'wa###mayor.net':80
- 'th####tbattle.net':80
- 'th####tmayor.net':80
- 'th####tperfect.net':80
- 'wa####erfect.net':80
- 'wa###battle.net':80
- 'sm####erfect.net':80
- 'wo###mayor.net':80
- 'wo####erfect.net':80
- 'wo###heart.net':80
- 'sm###heart.net':80
- http://mo###rvalue.net/index.php
- http://mo####inalmost.net/index.php
- http://si###evalue.net/index.php
- http://si####orderly.net/index.php
- http://mo####orderly.net/index.php
- http://po####lealmost.net/index.php
- http://po####leorderly.net/index.php
- http://mo####invalue.net/index.php
- http://mo####inorderly.net/index.php
- http://mo####inreason.net/index.php
- http://po####lereason.net/index.php
- http://se####orderly.net/index.php
- http://la####rderly.net/index.php
- http://la###reason.net/index.php
- http://la###almost.net/index.php
- http://se####reason.net/index.php
- http://se###avalue.net/index.php
- http://si####reason.net/index.php
- http://mo####reason.net/index.php
- http://mo####almost.net/index.php
- http://la###value.net/index.php
- http://si####almost.net/index.php
- http://fi####almost.net/index.php
- http://le###almost.net/index.php
- http://su####tvalue.net/index.php
- http://su####torderly.net/index.php
- http://wi###rvalue.net/index.php
- http://fi####reason.net/index.php
- http://fi###hvalue.net/index.php
- http://le###value.net/index.php
- http://le####rderly.net/index.php
- http://le###reason.net/index.php
- http://fi####orderly.net/index.php
- http://pe####sreason.net/index.php
- http://wi####reason.net/index.php
- http://wi####almost.net/index.php
- http://po####levalue.net/index.php
- http://pe####salmost.net/index.php
- http://pe####sorderly.net/index.php
- http://su####talmost.net/index.php
- http://su####treason.net/index.php
- http://wi###wvalue.net/index.php
- http://wi####orderly.net/index.php
- http://pe####svalue.net/index.php
- http://se####almost.net/index.php
- http://su####perfect.net/index.php
- http://cr####erfect.net/index.php
- http://cr###heart.net/index.php
- http://kn###battle.net/index.php
- http://su###rheart.net/index.php
- http://su###rmayor.net/index.php
- http://th####theart.net/index.php
- http://wa###heart.net/index.php
- http://cr###battle.net/index.php
- http://cr###mayor.net/index.php
- http://su####battle.net/index.php
- http://me####battle.net/index.php
- http://be###heart.net/index.php
- http://fo####battle.net/index.php
- http://fo###wmayor.net/index.php
- http://me###rmayor.net/index.php
- http://kn###heart.net/index.php
- http://kn###mayor.net/index.php
- http://be###battle.net/index.php
- http://be###mayor.net/index.php
- http://be####erfect.net/index.php
- http://kn####erfect.net/index.php
- http://pa###heart.net/index.php
- http://fi###heart.net/index.php
- http://sm###battle.net/index.php
- http://sm###mayor.net/index.php
- http://wo###battle.net/index.php
- http://pa####erfect.net/index.php
- http://pa###battle.net/index.php
- http://fi###battle.net/index.php
- http://fi###mayor.net/index.php
- http://fi####erfect.net/index.php
- http://pa###mayor.net/index.php
- http://wa###mayor.net/index.php
- http://th####tbattle.net/index.php
- http://th####tmayor.net/index.php
- http://th####tperfect.net/index.php
- http://wa####erfect.net/index.php
- http://wa###battle.net/index.php
- http://sm####erfect.net/index.php
- http://wo###mayor.net/index.php
- http://wo####erfect.net/index.php
- http://wo###heart.net/index.php
- http://sm###heart.net/index.php
- DNS ASK mo###rvalue.net
- DNS ASK mo####inalmost.net
- DNS ASK si###evalue.net
- DNS ASK si####orderly.net
- DNS ASK mo####orderly.net
- DNS ASK po####lealmost.net
- DNS ASK po####leorderly.net
- DNS ASK mo####invalue.net
- DNS ASK mo####inorderly.net
- DNS ASK mo####inreason.net
- DNS ASK po####lereason.net
- DNS ASK se####orderly.net
- DNS ASK la####rderly.net
- DNS ASK la###reason.net
- DNS ASK la###almost.net
- DNS ASK se####reason.net
- DNS ASK se###avalue.net
- DNS ASK si####reason.net
- DNS ASK mo####reason.net
- DNS ASK mo####almost.net
- DNS ASK la###value.net
- DNS ASK si####almost.net
- DNS ASK fi####almost.net
- DNS ASK le###almost.net
- DNS ASK su####tvalue.net
- DNS ASK su####torderly.net
- DNS ASK wi###rvalue.net
- DNS ASK fi####reason.net
- DNS ASK fi###hvalue.net
- DNS ASK le###value.net
- DNS ASK le####rderly.net
- DNS ASK le###reason.net
- DNS ASK fi####orderly.net
- DNS ASK pe####sreason.net
- DNS ASK wi####reason.net
- DNS ASK wi####almost.net
- DNS ASK po####levalue.net
- DNS ASK pe####salmost.net
- DNS ASK pe####sorderly.net
- DNS ASK su####talmost.net
- DNS ASK su####treason.net
- DNS ASK wi###wvalue.net
- DNS ASK wi####orderly.net
- DNS ASK pe####svalue.net
- DNS ASK se####almost.net
- DNS ASK su####perfect.net
- DNS ASK cr####erfect.net
- DNS ASK cr###heart.net
- DNS ASK kn###battle.net
- DNS ASK su###rheart.net
- DNS ASK su###rmayor.net
- DNS ASK th####theart.net
- DNS ASK wa###heart.net
- DNS ASK cr###battle.net
- DNS ASK cr###mayor.net
- DNS ASK su####battle.net
- DNS ASK me####battle.net
- DNS ASK be###heart.net
- DNS ASK fo####battle.net
- DNS ASK fo###wmayor.net
- DNS ASK me###rmayor.net
- DNS ASK kn###heart.net
- DNS ASK kn###mayor.net
- DNS ASK be###battle.net
- DNS ASK be###mayor.net
- DNS ASK be####erfect.net
- DNS ASK kn####erfect.net
- DNS ASK pa###heart.net
- DNS ASK fi###heart.net
- DNS ASK sm###battle.net
- DNS ASK sm###mayor.net
- DNS ASK wo###battle.net
- DNS ASK pa####erfect.net
- DNS ASK pa###battle.net
- DNS ASK fi###battle.net
- DNS ASK fi###mayor.net
- DNS ASK fi####erfect.net
- DNS ASK pa###mayor.net
- DNS ASK wa###mayor.net
- DNS ASK th####tbattle.net
- DNS ASK th####tmayor.net
- DNS ASK th####tperfect.net
- DNS ASK wa####erfect.net
- DNS ASK wa###battle.net
- DNS ASK sm####erfect.net
- DNS ASK wo###mayor.net
- DNS ASK wo####erfect.net
- DNS ASK wo###heart.net
- DNS ASK sm###heart.net
- ClassName: 'Shell_TrayWnd' WindowName: ''