Technical Information
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Interactive Panel Cryptographic TCP/IP' = '%APPDATA%\ntwqdids\oofzqzrppu.exe'
- '%APPDATA%\ntwqdids\pqdogqarbpru.exe' "%APPDATA%\ntwqdids\oofzqzrppu.exe"
- '%APPDATA%\ntwqdids\oofzqzrppu.exe'
- %APPDATA%\ntwqdids\oofzqzrppu.c61nr
- %APPDATA%\ntwqdids\pqdogqarbpru.exe
- %APPDATA%\ntwqdids\oofzqzrppu.exe
- %APPDATA%\ntwqdids\pqdogqarbpru.exe
- %APPDATA%\ntwqdids\oofzqzrppu.exe
- 're####ebridge.net':80
- 'or###bridge.net':80
- 'or####icycle.net':80
- 'or###whose.net':80
- 're####ebicycle.net':80
- 're####eexcept.net':80
- 'ne#####rybicycle.net':80
- 'pl####ntbicycle.net':80
- 'pl####ntwhose.net':80
- 'or###except.net':80
- 'ne####arywhose.net':80
- 're####ewhose.net':80
- 'he###nwhose.net':80
- 'le###rwhose.net':80
- 'ge####except.net':80
- 'ge####bicycle.net':80
- 'ge####bridge.net':80
- 'he####bicycle.net':80
- 'he####except.net':80
- 'le####except.net':80
- 'le####bridge.net':80
- 'le####bicycle.net':80
- 'he####bridge.net':80
- 'ne####arybridge.net':80
- 'gl###bridge.net':80
- 'an####bridge.net':80
- 'an####bicycle.net':80
- 'an###rwhose.net':80
- 'gl####icycle.net':80
- 'gl###except.net':80
- 'fo####dbicycle.net':80
- 'de####bicycle.net':80
- 'de###ewhose.net':80
- 'an####except.net':80
- 'fo####dwhose.net':80
- 'gl###whose.net':80
- 'he###whose.net':80
- 'di####ultwhose.net':80
- 'pl####ntexcept.net':80
- 'pl####ntbridge.net':80
- 'ne####aryexcept.net':80
- 'he####icycle.net':80
- 'he###except.net':80
- 'di####ultexcept.net':80
- 'di####ultbridge.net':80
- 'di#####ltbicycle.net':80
- 'he###bridge.net':80
- re####ebridge.net/forum/search.php?em###################################
- or###bridge.net/forum/search.php?em###################################
- or####icycle.net/forum/search.php?em###################################
- or###whose.net/forum/search.php?em###################################
- re####ebicycle.net/forum/search.php?em###################################
- re####eexcept.net/forum/search.php?em###################################
- ne#####rybicycle.net/forum/search.php?em###################################
- pl####ntbicycle.net/forum/search.php?em###################################
- pl####ntwhose.net/forum/search.php?em###################################
- or###except.net/forum/search.php?em###################################
- ne####arywhose.net/forum/search.php?em###################################
- re####ewhose.net/forum/search.php?em###################################
- he###nwhose.net/forum/search.php?em###################################
- le###rwhose.net/forum/search.php?em###################################
- ge####except.net/forum/search.php?em###################################
- ge####bicycle.net/forum/search.php?em###################################
- ge####bridge.net/forum/search.php?em###################################
- he####bicycle.net/forum/search.php?em###################################
- he####except.net/forum/search.php?em###################################
- le####except.net/forum/search.php?em###################################
- le####bridge.net/forum/search.php?em###################################
- le####bicycle.net/forum/search.php?em###################################
- he####bridge.net/forum/search.php?em###################################
- ne####arybridge.net/forum/search.php?em###################################
- gl###bridge.net/forum/search.php?em###################################
- an####bridge.net/forum/search.php?em###################################
- an####bicycle.net/forum/search.php?em###################################
- an###rwhose.net/forum/search.php?em###################################
- gl####icycle.net/forum/search.php?em###################################
- gl###except.net/forum/search.php?em###################################
- fo####dbicycle.net/forum/search.php?em###################################
- de####bicycle.net/forum/search.php?em###################################
- de###ewhose.net/forum/search.php?em###################################
- an####except.net/forum/search.php?em###################################
- fo####dwhose.net/forum/search.php?em###################################
- gl###whose.net/forum/search.php?em###################################
- he###whose.net/forum/search.php?em###################################
- di####ultwhose.net/forum/search.php?em###################################
- pl####ntexcept.net/forum/search.php?em###################################
- pl####ntbridge.net/forum/search.php?em###################################
- ne####aryexcept.net/forum/search.php?em###################################
- he####icycle.net/forum/search.php?em###################################
- he###except.net/forum/search.php?em###################################
- di####ultexcept.net/forum/search.php?em###################################
- di####ultbridge.net/forum/search.php?em###################################
- di#####ltbicycle.net/forum/search.php?em###################################
- he###bridge.net/forum/search.php?em###################################
- DNS ASK or####icycle.net
- DNS ASK re####ebridge.net
- DNS ASK or###bridge.net
- DNS ASK re####ewhose.net
- DNS ASK or###whose.net
- DNS ASK re####ebicycle.net
- DNS ASK pl####ntwhose.net
- DNS ASK ne#####rybicycle.net
- DNS ASK pl####ntbicycle.net
- DNS ASK re####eexcept.net
- DNS ASK or###except.net
- DNS ASK ne####arywhose.net
- DNS ASK ge####except.net
- DNS ASK he###nwhose.net
- DNS ASK le###rwhose.net
- DNS ASK ge###ewhose.net
- DNS ASK ge####bicycle.net
- DNS ASK ge####bridge.net
- DNS ASK le####bridge.net
- DNS ASK he####except.net
- DNS ASK le####except.net
- DNS ASK he####bicycle.net
- DNS ASK le####bicycle.net
- DNS ASK he####bridge.net
- DNS ASK an####bicycle.net
- DNS ASK gl###bridge.net
- DNS ASK an####bridge.net
- DNS ASK gl###whose.net
- DNS ASK an###rwhose.net
- DNS ASK gl####icycle.net
- DNS ASK de###ewhose.net
- DNS ASK fo####dbicycle.net
- DNS ASK de####bicycle.net
- DNS ASK gl###except.net
- DNS ASK an####except.net
- DNS ASK fo####dwhose.net
- DNS ASK pl####ntexcept.net
- DNS ASK he###whose.net
- DNS ASK di####ultwhose.net
- DNS ASK ne####arybridge.net
- DNS ASK pl####ntbridge.net
- DNS ASK ne####aryexcept.net
- DNS ASK di####ultbridge.net
- DNS ASK he###except.net
- DNS ASK di####ultexcept.net
- DNS ASK he####icycle.net
- DNS ASK di#####ltbicycle.net
- DNS ASK he###bridge.net
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: 'Indicator' WindowName: '(null)'