Technical Information
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Identity WLAN IPsec Server' = 'C:\biwgqcws\tzdtruhkv.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\DNS Foundation Background] 'ImagePath' = 'C:\biwgqcws\tzdtruhkv.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\DNS Foundation Background] 'Start' = '00000002'
- 'C:\biwgqcws\jycxuvxcwerh.exe' "c:\biwgqcws\tzdtruhkv.exe"
- 'C:\biwgqcws\tzdtruhkv.exe'
- 'C:\biwgqcws\mwzgc3czwemsolon1ncp.exe'
- C:\biwgqcws\tzdtruhkv.exe
- C:\biwgqcws\jycxuvxcwerh.exe
- C:\biwgqcws\mwzgc3czwemsolon1ncp.exe
- %WINDIR%\biwgqcws\ba3dn7md
- C:\biwgqcws\ba3dn7md
- C:\biwgqcws\jycxuvxcwerh.exe
- C:\biwgqcws\tzdtruhkv.exe
- C:\biwgqcws\mwzgc3czwemsolon1ncp.exe
- %WINDIR%\biwgqcws\ba3dn7md
- 'mo####butter.net':80
- 'mo#####nunderstand.net':80
- 'mo####behind.net':80
- 'si####butter.net':80
- 'po####lebroad.net':80
- 'mo####inbehind.net':80
- 'po#####eunderstand.net':80
- 'mo####inbroad.net':80
- 'si####behind.net':80
- 'se####butter.net':80
- 'la###butter.net':80
- 'se####behind.net':80
- 'la###behind.net':80
- 'si###ebroad.net':80
- 'mo###rbroad.net':80
- 'si#####nderstand.net':80
- 'mo#####nderstand.net':80
- 'po####lebehind.net':80
- 'wi###rbroad.net':80
- 'su####tbroad.net':80
- 'wi####butter.net':80
- 'su#####understand.net':80
- 'fi#####nderstand.net':80
- 'le####nderstand.net':80
- 'su####tbehind.net':80
- 'su####tbutter.net':80
- 'pe####sbutter.net':80
- 'pe#####understand.net':80
- 'wi#####nderstand.net':80
- 'mo####inbutter.net':80
- 'po####lebutter.net':80
- 'pe####sbehind.net':80
- 'wi####behind.net':80
- 'pe####sbroad.net':80
- 'wi###wbroad.net':80
- 'th####twrite.net':80
- 'wa###write.net':80
- 'th####tniece.net':80
- 'wa###niece.net':80
- 'wo###speak.net':80
- 'sm###speak.net':80
- 'th####toclock.net':80
- 'wa###oclock.net':80
- 'wa###speak.net':80
- 'cr###niece.net':80
- 'su###rwrite.net':80
- 'cr###speak.net':80
- 'su###rniece.net':80
- 'cr###oclock.net':80
- 'th####tspeak.net':80
- 'cr###write.net':80
- 'su####oclock.net':80
- 'wo###niece.net':80
- 'pa###oclock.net':80
- 'fi###oclock.net':80
- 'pa###write.net':80
- 'fi###write.net':80
- 'se###abroad.net':80
- 'la###broad.net':80
- 'se#####nderstand.net':80
- 'la####nderstand.net':80
- 'fi###niece.net':80
- 'sm###write.net':80
- 'wo###oclock.net':80
- 'sm###niece.net':80
- 'wo###write.net':80
- 'fi###speak.net':80
- 'pa###niece.net':80
- 'sm###oclock.net':80
- 'pa###speak.net':80
- http://mo####butter.net/index.php
- http://mo#####nunderstand.net/index.php
- http://mo####behind.net/index.php
- http://si####butter.net/index.php
- http://po####lebroad.net/index.php
- http://mo####inbehind.net/index.php
- http://po#####eunderstand.net/index.php
- http://mo####inbroad.net/index.php
- http://si####behind.net/index.php
- http://se####butter.net/index.php
- http://la###butter.net/index.php
- http://se####behind.net/index.php
- http://la###behind.net/index.php
- http://si###ebroad.net/index.php
- http://mo###rbroad.net/index.php
- http://si#####nderstand.net/index.php
- http://mo#####nderstand.net/index.php
- http://po####lebehind.net/index.php
- http://wi###rbroad.net/index.php
- http://su####tbroad.net/index.php
- http://wi####butter.net/index.php
- http://su#####understand.net/index.php
- http://fi#####nderstand.net/index.php
- http://le####nderstand.net/index.php
- http://su####tbehind.net/index.php
- http://su####tbutter.net/index.php
- http://pe####sbutter.net/index.php
- http://pe#####understand.net/index.php
- http://wi#####nderstand.net/index.php
- http://mo####inbutter.net/index.php
- http://po####lebutter.net/index.php
- http://pe####sbehind.net/index.php
- http://wi####behind.net/index.php
- http://pe####sbroad.net/index.php
- http://wi###wbroad.net/index.php
- http://th####twrite.net/index.php
- http://wa###write.net/index.php
- http://th####tniece.net/index.php
- http://wa###niece.net/index.php
- http://wo###speak.net/index.php
- http://sm###speak.net/index.php
- http://th####toclock.net/index.php
- http://wa###oclock.net/index.php
- http://wa###speak.net/index.php
- http://cr###niece.net/index.php
- http://su###rwrite.net/index.php
- http://cr###speak.net/index.php
- http://su###rniece.net/index.php
- http://cr###oclock.net/index.php
- http://th####tspeak.net/index.php
- http://cr###write.net/index.php
- http://su####oclock.net/index.php
- http://wo###niece.net/index.php
- http://pa###oclock.net/index.php
- http://fi###oclock.net/index.php
- http://pa###write.net/index.php
- http://fi###write.net/index.php
- http://se###abroad.net/index.php
- http://la###broad.net/index.php
- http://se#####nderstand.net/index.php
- http://la####nderstand.net/index.php
- http://fi###niece.net/index.php
- http://sm###write.net/index.php
- http://wo###oclock.net/index.php
- http://sm###niece.net/index.php
- http://wo###write.net/index.php
- http://fi###speak.net/index.php
- http://pa###niece.net/index.php
- http://sm###oclock.net/index.php
- http://pa###speak.net/index.php
- DNS ASK mo#####nunderstand.net
- DNS ASK po#####eunderstand.net
- DNS ASK si####butter.net
- DNS ASK mo####butter.net
- DNS ASK mo####inbehind.net
- DNS ASK po####lebehind.net
- DNS ASK mo####inbroad.net
- DNS ASK po####lebroad.net
- DNS ASK mo####behind.net
- DNS ASK la###butter.net
- DNS ASK si#####nderstand.net
- DNS ASK la###behind.net
- DNS ASK se####butter.net
- DNS ASK mo###rbroad.net
- DNS ASK si####behind.net
- DNS ASK mo#####nderstand.net
- DNS ASK si###ebroad.net
- DNS ASK mo####inbutter.net
- DNS ASK su####tbroad.net
- DNS ASK su####tbehind.net
- DNS ASK su#####understand.net
- DNS ASK wi###rbroad.net
- DNS ASK le####nderstand.net
- DNS ASK fi###hbroad.net
- DNS ASK su####tbutter.net
- DNS ASK fi#####nderstand.net
- DNS ASK wi####butter.net
- DNS ASK wi#####nderstand.net
- DNS ASK pe####sbroad.net
- DNS ASK po####lebutter.net
- DNS ASK pe#####understand.net
- DNS ASK wi####behind.net
- DNS ASK pe####sbutter.net
- DNS ASK wi###wbroad.net
- DNS ASK pe####sbehind.net
- DNS ASK se####behind.net
- DNS ASK th####twrite.net
- DNS ASK wa###write.net
- DNS ASK th####tniece.net
- DNS ASK wa###niece.net
- DNS ASK wo###speak.net
- DNS ASK sm###speak.net
- DNS ASK th####toclock.net
- DNS ASK wa###oclock.net
- DNS ASK wa###speak.net
- DNS ASK cr###niece.net
- DNS ASK su###rwrite.net
- DNS ASK cr###speak.net
- DNS ASK su###rniece.net
- DNS ASK cr###oclock.net
- DNS ASK th####tspeak.net
- DNS ASK cr###write.net
- DNS ASK su####oclock.net
- DNS ASK wo###niece.net
- DNS ASK pa###oclock.net
- DNS ASK fi###oclock.net
- DNS ASK pa###write.net
- DNS ASK fi###write.net
- DNS ASK se###abroad.net
- DNS ASK la###broad.net
- DNS ASK se#####nderstand.net
- DNS ASK la####nderstand.net
- DNS ASK fi###niece.net
- DNS ASK sm###write.net
- DNS ASK wo###oclock.net
- DNS ASK sm###niece.net
- DNS ASK wo###write.net
- DNS ASK fi###speak.net
- DNS ASK pa###niece.net
- DNS ASK sm###oclock.net
- DNS ASK pa###speak.net
- ClassName: 'Shell_TrayWnd' WindowName: ''