Technical Information
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Accounts Superfetch Certificate NGEN Firewall' = 'C:\svwizkpnaduxxr\jawfboy.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\Configuration Multimedia Layer] 'Start' = '00000002'
- 'C:\svwizkpnaduxxr\ekptcpjgwtc.exe' "c:\svwizkpnaduxxr\jawfboy.exe"
- 'C:\svwizkpnaduxxr\jawfboy.exe'
- 'C:\svwizkpnaduxxr\smpbf32eefxuqgmqxjtv.exe'
- C:\svwizkpnaduxxr\jawfboy.exe
- C:\svwizkpnaduxxr\ekptcpjgwtc.exe
- C:\svwizkpnaduxxr\xi7oqks7
- %WINDIR%\svwizkpnaduxxr\frqrkda
- C:\svwizkpnaduxxr\frqrkda
- C:\svwizkpnaduxxr\smpbf32eefxuqgmqxjtv.exe
- C:\svwizkpnaduxxr\ekptcpjgwtc.exe
- C:\svwizkpnaduxxr\jawfboy.exe
- C:\svwizkpnaduxxr\smpbf32eefxuqgmqxjtv.exe
- %WINDIR%\svwizkpnaduxxr\frqrkda
- 'he####service.net':80
- 'le###rriver.net':80
- 'le####service.net':80
- 'le####suppose.net':80
- 'he####suppose.net':80
- 'he###nriver.net':80
- 'ge###eriver.net':80
- 'va####smister.net':80
- 'ge####service.net':80
- 'ge####mister.net':80
- 'ge####suppose.net':80
- 'he####mister.net':80
- 're####emister.net':80
- 'or####uppose.net':80
- 'or###mister.net':80
- 'pl####ntriver.net':80
- 'ne####aryriver.net':80
- 're####esuppose.net':80
- 're####eriver.net':80
- 'le####mister.net':80
- 'or###river.net':80
- 'or####ervice.net':80
- 're####eservice.net':80
- 'an####nearly.net':80
- 'gl###nearly.net':80
- 'fo####dshare.net':80
- 'fo####dshake.net':80
- 'de###eshare.net':80
- 'an####happen.net':80
- 'an###rshare.net':80
- 'gl###share.net':80
- 'gl###shake.net':80
- 'gl###happen.net':80
- 'an###rshake.net':80
- 'de###eshake.net':80
- 'va####sservice.net':80
- 're####service.net':80
- 're####suppose.net':80
- 're####mister.net':80
- 'va####ssuppose.net':80
- 'va####sriver.net':80
- 'de####happen.net':80
- 'fo####dhappen.net':80
- 'fo####dnearly.net':80
- 're###nriver.net':80
- 'de####nearly.net':80
- 're####article.net':80
- 'de####mister.net':80
- 'va####sarticle.net':80
- 'va####sangry.net':80
- 're###nangry.net':80
- 'fo####dmister.net':80
- 'fo####dservice.net':80
- 'de###eriver.net':80
- 'de####service.net':80
- 'de####suppose.net':80
- 'fo####dsuppose.net':80
- 're####fifteen.net':80
- 'ge####fifteen.net':80
- 'he###angry.net':80
- 'he####ifteen.net':80
- 'he###dried.net':80
- 'ge###edried.net':80
- 'ge###eangry.net':80
- 're###ndried.net':80
- 'va####sfifteen.net':80
- 'va####sdried.net':80
- 'he####rticle.net':80
- 'ge####article.net':80
- 'di####ultriver.net':80
- 'he###river.net':80
- 'he####ervice.net':80
- 'he####uppose.net':80
- 'di#####ltservice.net':80
- 'pl####ntmister.net':80
- 'pl####ntservice.net':80
- 'ne#####ryservice.net':80
- 'ne#####rysuppose.net':80
- 'ne####arymister.net':80
- 'pl####ntsuppose.net':80
- 'di#####ltsuppose.net':80
- 'an####suppose.net':80
- 'gl####uppose.net':80
- 'gl###mister.net':80
- 'fo####driver.net':80
- 'an####mister.net':80
- 'an####service.net':80
- 'di####ultmister.net':80
- 'he###mister.net':80
- 'gl###river.net':80
- 'gl####ervice.net':80
- 'an###rriver.net':80
- http://he####service.net/index.php
- http://le###rriver.net/index.php
- http://le####service.net/index.php
- http://le####suppose.net/index.php
- http://he####suppose.net/index.php
- http://he###nriver.net/index.php
- http://ge###eriver.net/index.php
- http://va####smister.net/index.php
- http://ge####service.net/index.php
- http://ge####mister.net/index.php
- http://ge####suppose.net/index.php
- http://he####mister.net/index.php
- http://re####emister.net/index.php
- http://or####uppose.net/index.php
- http://or###mister.net/index.php
- http://pl####ntriver.net/index.php
- http://ne####aryriver.net/index.php
- http://re####esuppose.net/index.php
- http://re####eriver.net/index.php
- http://le####mister.net/index.php
- http://or###river.net/index.php
- http://or####ervice.net/index.php
- http://re####eservice.net/index.php
- http://an####nearly.net/index.php
- http://gl###nearly.net/index.php
- http://fo####dshare.net/index.php
- http://fo####dshake.net/index.php
- http://de###eshare.net/index.php
- http://an####happen.net/index.php
- http://an###rshare.net/index.php
- http://gl###share.net/index.php
- http://gl###shake.net/index.php
- http://gl###happen.net/index.php
- http://an###rshake.net/index.php
- http://de###eshake.net/index.php
- http://va####sservice.net/index.php
- http://re####service.net/index.php
- http://re####suppose.net/index.php
- http://re####mister.net/index.php
- http://va####ssuppose.net/index.php
- http://va####sriver.net/index.php
- http://de####happen.net/index.php
- http://fo####dhappen.net/index.php
- http://fo####dnearly.net/index.php
- http://re###nriver.net/index.php
- http://de####nearly.net/index.php
- http://re####article.net/index.php
- http://de####mister.net/index.php
- http://va####sarticle.net/index.php
- http://va####sangry.net/index.php
- http://re###nangry.net/index.php
- http://fo####dmister.net/index.php
- http://fo####dservice.net/index.php
- http://de###eriver.net/index.php
- http://de####service.net/index.php
- http://de####suppose.net/index.php
- http://fo####dsuppose.net/index.php
- http://re####fifteen.net/index.php
- http://ge####fifteen.net/index.php
- http://he###angry.net/index.php
- http://he####ifteen.net/index.php
- http://he###dried.net/index.php
- http://ge###edried.net/index.php
- http://ge###eangry.net/index.php
- http://re###ndried.net/index.php
- http://va####sfifteen.net/index.php
- http://va####sdried.net/index.php
- http://he####rticle.net/index.php
- http://ge####article.net/index.php
- http://di####ultriver.net/index.php
- http://he###river.net/index.php
- http://he####ervice.net/index.php
- http://he####uppose.net/index.php
- http://di#####ltservice.net/index.php
- http://pl####ntmister.net/index.php
- http://pl####ntservice.net/index.php
- http://ne#####ryservice.net/index.php
- http://ne#####rysuppose.net/index.php
- http://ne####arymister.net/index.php
- http://pl####ntsuppose.net/index.php
- http://di#####ltsuppose.net/index.php
- http://an####suppose.net/index.php
- http://gl####uppose.net/index.php
- http://gl###mister.net/index.php
- http://fo####driver.net/index.php
- http://an####mister.net/index.php
- http://an####service.net/index.php
- http://di####ultmister.net/index.php
- http://he###mister.net/index.php
- http://gl###river.net/index.php
- http://gl####ervice.net/index.php
- http://an###rriver.net/index.php
- DNS ASK le###rriver.net
- DNS ASK he###nriver.net
- DNS ASK he####service.net
- DNS ASK he####suppose.net
- DNS ASK le####service.net
- DNS ASK ge####mister.net
- DNS ASK va####smister.net
- DNS ASK re####mister.net
- DNS ASK ge###eriver.net
- DNS ASK ge####suppose.net
- DNS ASK ge####service.net
- DNS ASK le####suppose.net
- DNS ASK or####uppose.net
- DNS ASK re####esuppose.net
- DNS ASK re####emister.net
- DNS ASK ne####aryriver.net
- DNS ASK or###mister.net
- DNS ASK or####ervice.net
- DNS ASK le####mister.net
- DNS ASK he####mister.net
- DNS ASK re####eriver.net
- DNS ASK re####eservice.net
- DNS ASK or###river.net
- DNS ASK gl###nearly.net
- DNS ASK an####happen.net
- DNS ASK an####nearly.net
- DNS ASK de###eshare.net
- DNS ASK fo####dshare.net
- DNS ASK gl###happen.net
- DNS ASK gl###share.net
- DNS ASK di####ultnearly.net
- DNS ASK an###rshare.net
- DNS ASK an###rshake.net
- DNS ASK gl###shake.net
- DNS ASK fo####dshake.net
- DNS ASK re####service.net
- DNS ASK va####sriver.net
- DNS ASK va####sservice.net
- DNS ASK va####ssuppose.net
- DNS ASK re####suppose.net
- DNS ASK re###nriver.net
- DNS ASK fo####dhappen.net
- DNS ASK de###eshake.net
- DNS ASK de####happen.net
- DNS ASK de####nearly.net
- DNS ASK fo####dnearly.net
- DNS ASK pl####ntriver.net
- DNS ASK re####article.net
- DNS ASK de####mister.net
- DNS ASK va####sarticle.net
- DNS ASK va####sangry.net
- DNS ASK re###nangry.net
- DNS ASK fo####dmister.net
- DNS ASK fo####dservice.net
- DNS ASK de###eriver.net
- DNS ASK de####service.net
- DNS ASK de####suppose.net
- DNS ASK fo####dsuppose.net
- DNS ASK re####fifteen.net
- DNS ASK ge####fifteen.net
- DNS ASK he###angry.net
- DNS ASK he####ifteen.net
- DNS ASK he###dried.net
- DNS ASK ge###edried.net
- DNS ASK ge###eangry.net
- DNS ASK re###ndried.net
- DNS ASK va####sfifteen.net
- DNS ASK va####sdried.net
- DNS ASK he####rticle.net
- DNS ASK ge####article.net
- DNS ASK di####ultriver.net
- DNS ASK he###river.net
- DNS ASK he####ervice.net
- DNS ASK he####uppose.net
- DNS ASK di#####ltservice.net
- DNS ASK pl####ntmister.net
- DNS ASK pl####ntservice.net
- DNS ASK ne#####ryservice.net
- DNS ASK ne#####rysuppose.net
- DNS ASK ne####arymister.net
- DNS ASK pl####ntsuppose.net
- DNS ASK di#####ltsuppose.net
- DNS ASK an####suppose.net
- DNS ASK gl####uppose.net
- DNS ASK gl###mister.net
- DNS ASK fo####driver.net
- DNS ASK an####mister.net
- DNS ASK an####service.net
- DNS ASK di####ultmister.net
- DNS ASK he###mister.net
- DNS ASK gl###river.net
- DNS ASK gl####ervice.net
- DNS ASK an###rriver.net
- ClassName: 'Shell_TrayWnd' WindowName: ''