Technical Information
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'WebClient Update Connect Notification Now' = 'C:\uqpqcgbmlkft\xefvqbwxfsho.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\Support Bluetooth Services SPP Tunneling] 'ImagePath' = 'C:\uqpqcgbmlkft\xefvqbwxfsho.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\Support Bluetooth Services SPP Tunneling] 'Start' = '00000002'
- 'C:\uqpqcgbmlkft\wpszptyy.exe' "c:\uqpqcgbmlkft\xefvqbwxfsho.exe"
- 'C:\uqpqcgbmlkft\xefvqbwxfsho.exe'
- 'C:\uqpqcgbmlkft\llp379bspehenhefwm.exe'
- C:\uqpqcgbmlkft\xefvqbwxfsho.exe
- C:\uqpqcgbmlkft\wpszptyy.exe
- C:\uqpqcgbmlkft\llp379bspehenhefwm.exe
- %WINDIR%\uqpqcgbmlkft\mhhyoumamta
- C:\uqpqcgbmlkft\mhhyoumamta
- C:\uqpqcgbmlkft\wpszptyy.exe
- C:\uqpqcgbmlkft\xefvqbwxfsho.exe
- C:\uqpqcgbmlkft\llp379bspehenhefwm.exe
- %WINDIR%\uqpqcgbmlkft\mhhyoumamta
- 'fa####happen.net':80
- 'ch####enshake.net':80
- 'fa####nearly.net':80
- 'ch####enhappen.net':80
- 'fa###yshare.net':80
- 'ei####nearly.net':80
- 'fa###yshake.net':80
- 'ch####enshare.net':80
- 'ci####ttehappen.net':80
- 'pi####eshake.net':80
- 'ci####ttenearly.net':80
- 'pi####ehappen.net':80
- 'ci####tteshare.net':80
- 'ch####ennearly.net':80
- 'ci####tteshake.net':80
- 'pi####eshare.net':80
- 'en####hnearly.net':80
- 'ex####produce.net':80
- 'be####eproduce.net':80
- 'ex####between.net':80
- 'be####ebetween.net':80
- 'pe####succeed.net':80
- 'ma####esucceed.net':80
- 'ex####student.net':80
- 'be####estudent.net':80
- 'ei###rshake.net':80
- 'en####hshake.net':80
- 'ei####happen.net':80
- 'en####hhappen.net':80
- 'ex####succeed.net':80
- 'be####esucceed.net':80
- 'ei###rshare.net':80
- 'en####hshare.net':80
- 'pi####enearly.net':80
- 'fo####nnearly.net':80
- 'su####happen.net':80
- 'ma####eshare.net':80
- 'su####nearly.net':80
- 'fo####nshake.net':80
- 'su###nshare.net':80
- 'fo####nhappen.net':80
- 'su###nshake.net':80
- 'ma####enearly.net':80
- 'pe####happen.net':80
- 'be####eshare.net':80
- 'pe####nearly.net':80
- 'ma####eshake.net':80
- 'pe###nshare.net':80
- 'ma####ehappen.net':80
- 'pe###nshake.net':80
- 'fo####nshare.net':80
- 'fi####happen.net':80
- 'th####happen.net':80
- 'fi####nearly.net':80
- 'th####nearly.net':80
- 'fi###eshare.net':80
- 'th###hshare.net':80
- 'fi###eshake.net':80
- 'th###hshake.net':80
- 'wh####rhappen.net':80
- 'ri###happen.net':80
- 'wh####rnearly.net':80
- 'ri###nearly.net':80
- 'wh####rshare.net':80
- 'ri###share.net':80
- 'wh####rshake.net':80
- 'ri###shake.net':80
- http://fa####happen.net/index.php
- http://ch####enshake.net/index.php
- http://fa####nearly.net/index.php
- http://ch####enhappen.net/index.php
- http://fa###yshare.net/index.php
- http://ei####nearly.net/index.php
- http://fa###yshake.net/index.php
- http://ch####enshare.net/index.php
- http://ci####ttehappen.net/index.php
- http://pi####eshake.net/index.php
- http://ci####ttenearly.net/index.php
- http://pi####ehappen.net/index.php
- http://ci####tteshare.net/index.php
- http://ch####ennearly.net/index.php
- http://ci####tteshake.net/index.php
- http://pi####eshare.net/index.php
- http://en####hnearly.net/index.php
- http://ex####produce.net/index.php
- http://be####eproduce.net/index.php
- http://ex####between.net/index.php
- http://be####ebetween.net/index.php
- http://pe####succeed.net/index.php
- http://ma####esucceed.net/index.php
- http://ex####student.net/index.php
- http://be####estudent.net/index.php
- http://ei###rshake.net/index.php
- http://en####hshake.net/index.php
- http://ei####happen.net/index.php
- http://en####hhappen.net/index.php
- http://ex####succeed.net/index.php
- http://be####esucceed.net/index.php
- http://ei###rshare.net/index.php
- http://en####hshare.net/index.php
- http://pi####enearly.net/index.php
- http://fo####nnearly.net/index.php
- http://su####happen.net/index.php
- http://ma####eshare.net/index.php
- http://su####nearly.net/index.php
- http://fo####nshake.net/index.php
- http://su###nshare.net/index.php
- http://fo####nhappen.net/index.php
- http://su###nshake.net/index.php
- http://ma####enearly.net/index.php
- http://pe####happen.net/index.php
- http://be####eshare.net/index.php
- http://pe####nearly.net/index.php
- http://ma####eshake.net/index.php
- http://pe###nshare.net/index.php
- http://ma####ehappen.net/index.php
- http://pe###nshake.net/index.php
- http://fo####nshare.net/index.php
- http://fi####happen.net/index.php
- http://th####happen.net/index.php
- http://fi####nearly.net/index.php
- http://th####nearly.net/index.php
- http://fi###eshare.net/index.php
- http://th###hshare.net/index.php
- http://fi###eshake.net/index.php
- http://th###hshake.net/index.php
- http://wh####rhappen.net/index.php
- http://ri###happen.net/index.php
- http://wh####rnearly.net/index.php
- http://ri###nearly.net/index.php
- http://wh####rshare.net/index.php
- http://ri###share.net/index.php
- http://wh####rshake.net/index.php
- http://ri###shake.net/index.php
- DNS ASK ch####enshake.net
- DNS ASK fa###yshake.net
- DNS ASK ch####enhappen.net
- DNS ASK fa####happen.net
- DNS ASK ei####nearly.net
- DNS ASK en####hnearly.net
- DNS ASK ch####enshare.net
- DNS ASK fa###yshare.net
- DNS ASK fa####nearly.net
- DNS ASK ci####ttehappen.net
- DNS ASK pi####eshake.net
- DNS ASK ci####ttenearly.net
- DNS ASK pi####ehappen.net
- DNS ASK ci####tteshare.net
- DNS ASK ch####ennearly.net
- DNS ASK ci####tteshake.net
- DNS ASK pi####eshare.net
- DNS ASK be####eproduce.net
- DNS ASK ex####student.net
- DNS ASK be####ebetween.net
- DNS ASK ex####produce.net
- DNS ASK ma####esucceed.net
- DNS ASK pe####between.net
- DNS ASK be####estudent.net
- DNS ASK pe####succeed.net
- DNS ASK ex####between.net
- DNS ASK ei###rshake.net
- DNS ASK en####hshake.net
- DNS ASK ei####happen.net
- DNS ASK en####hhappen.net
- DNS ASK ex####succeed.net
- DNS ASK be####esucceed.net
- DNS ASK ei###rshare.net
- DNS ASK en####hshare.net
- DNS ASK su####happen.net
- DNS ASK fo####nhappen.net
- DNS ASK su####nearly.net
- DNS ASK fo####nnearly.net
- DNS ASK su###nshare.net
- DNS ASK fo####nshare.net
- DNS ASK su###nshake.net
- DNS ASK fo####nshake.net
- DNS ASK ma####eshare.net
- DNS ASK ma####enearly.net
- DNS ASK pe####happen.net
- DNS ASK be####eshare.net
- DNS ASK pe####nearly.net
- DNS ASK ma####eshake.net
- DNS ASK pe###nshare.net
- DNS ASK ma####ehappen.net
- DNS ASK pe###nshake.net
- DNS ASK th####happen.net
- DNS ASK fi###eshake.net
- DNS ASK th####nearly.net
- DNS ASK fi####happen.net
- DNS ASK th###hshare.net
- DNS ASK pi####enearly.net
- DNS ASK th###hshake.net
- DNS ASK fi###eshare.net
- DNS ASK fi####nearly.net
- DNS ASK wh####rhappen.net
- DNS ASK ri###happen.net
- DNS ASK wh####rnearly.net
- DNS ASK ri###nearly.net
- DNS ASK wh####rshare.net
- DNS ASK ri###share.net
- DNS ASK wh####rshake.net
- DNS ASK ri###shake.net
- ClassName: 'Shell_TrayWnd' WindowName: ''