Technical Information
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Biometric Log Networking Encryption Firewall' = 'C:\cdvqpnczx\cnizhbsd.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\Foundation Propagation WLAN] 'ImagePath' = 'C:\cdvqpnczx\cnizhbsd.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\Foundation Propagation WLAN] 'Start' = '00000002'
- 'C:\cdvqpnczx\owqjpslu.exe' "c:\cdvqpnczx\cnizhbsd.exe"
- 'C:\cdvqpnczx\cnizhbsd.exe'
- 'C:\cdvqpnczx\tt306jvoshwlyqmvf2.exe'
- C:\cdvqpnczx\cnizhbsd.exe
- C:\cdvqpnczx\owqjpslu.exe
- C:\cdvqpnczx\ctd2y3bhhzbn
- %WINDIR%\cdvqpnczx\b4mijauca1jq
- C:\cdvqpnczx\b4mijauca1jq
- C:\cdvqpnczx\tt306jvoshwlyqmvf2.exe
- C:\cdvqpnczx\owqjpslu.exe
- C:\cdvqpnczx\cnizhbsd.exe
- C:\cdvqpnczx\tt306jvoshwlyqmvf2.exe
- %WINDIR%\cdvqpnczx\b4mijauca1jq
- %WINDIR%\cdvqpnczx\b4mijauca1jq
- 'fr###device.net':80
- 'ex#####ncedevice.net':80
- 'fr####anguage.net':80
- 'ex#####ncelanguage.net':80
- 'ge####mansettle.net':80
- 'al####ysettle.net':80
- 'fr###before.net':80
- 'ex#####ncebefore.net':80
- 'pa####ontain.net':80
- 'fi####ontain.net':80
- 'pa###became.net':80
- 'fi###became.net':80
- 'fr###settle.net':80
- 'ex#####ncesettle.net':80
- 'pa###basket.net':80
- 'fi###basket.net':80
- 'ge#####anlanguage.net':80
- 'me####device.net':80
- 'fo####before.net':80
- 'me####language.net':80
- 'fo####device.net':80
- 'kn###settle.net':80
- 'be####anguage.net':80
- 'me####before.net':80
- 'be###settle.net':80
- 'al####ydevice.net':80
- 'ge####manbefore.net':80
- 'al####ylanguage.net':80
- 'ge####mandevice.net':80
- 'me####settle.net':80
- 'fo####language.net':80
- 'al####ybefore.net':80
- 'fo####settle.net':80
- 'fi####ndustry.net':80
- 'su####became.net':80
- 'cr###became.net':80
- 'su####industry.net':80
- 'cr####ndustry.net':80
- 'su####basket.net':80
- 'cr###basket.net':80
- 'su####contain.net':80
- 'cr####ontain.net':80
- 'be###became.net':80
- 'kn###became.net':80
- 'be####ndustry.net':80
- 'kn####ndustry.net':80
- 'be###basket.net':80
- 'kn###basket.net':80
- 'be####ontain.net':80
- 'kn####ontain.net':80
- 'th####tindustry.net':80
- 'sm###became.net':80
- 'wo####ontain.net':80
- 'sm####ndustry.net':80
- 'wo###became.net':80
- 'sm###basket.net':80
- 'pa####ndustry.net':80
- 'sm####ontain.net':80
- 'wo###basket.net':80
- 'wa###became.net':80
- 'th####tcontain.net':80
- 'wa####ndustry.net':80
- 'th####tbecame.net':80
- 'wa###basket.net':80
- 'wo####ndustry.net':80
- 'wa####ontain.net':80
- 'th####tbasket.net':80
- http://fr###device.net/index.php
- http://ex#####ncedevice.net/index.php
- http://fr####anguage.net/index.php
- http://ex#####ncelanguage.net/index.php
- http://ge####mansettle.net/index.php
- http://al####ysettle.net/index.php
- http://fr###before.net/index.php
- http://ex#####ncebefore.net/index.php
- http://pa####ontain.net/index.php
- http://fi####ontain.net/index.php
- http://pa###became.net/index.php
- http://fi###became.net/index.php
- http://fr###settle.net/index.php
- http://ex#####ncesettle.net/index.php
- http://pa###basket.net/index.php
- http://fi###basket.net/index.php
- http://ge#####anlanguage.net/index.php
- http://me####device.net/index.php
- http://fo####before.net/index.php
- http://me####language.net/index.php
- http://fo####device.net/index.php
- http://kn###settle.net/index.php
- http://be####anguage.net/index.php
- http://me####before.net/index.php
- http://be###settle.net/index.php
- http://al####ydevice.net/index.php
- http://ge####manbefore.net/index.php
- http://al####ylanguage.net/index.php
- http://ge####mandevice.net/index.php
- http://me####settle.net/index.php
- http://fo####language.net/index.php
- http://al####ybefore.net/index.php
- http://fo####settle.net/index.php
- http://fi####ndustry.net/index.php
- http://su####became.net/index.php
- http://cr###became.net/index.php
- http://su####industry.net/index.php
- http://cr####ndustry.net/index.php
- http://su####basket.net/index.php
- http://cr###basket.net/index.php
- http://su####contain.net/index.php
- http://cr####ontain.net/index.php
- http://be###became.net/index.php
- http://kn###became.net/index.php
- http://be####ndustry.net/index.php
- http://kn####ndustry.net/index.php
- http://be###basket.net/index.php
- http://kn###basket.net/index.php
- http://be####ontain.net/index.php
- http://kn####ontain.net/index.php
- http://th####tindustry.net/index.php
- http://sm###became.net/index.php
- http://wo####ontain.net/index.php
- http://sm####ndustry.net/index.php
- http://wo###became.net/index.php
- http://sm###basket.net/index.php
- http://pa####ndustry.net/index.php
- http://sm####ontain.net/index.php
- http://wo###basket.net/index.php
- http://wa###became.net/index.php
- http://th####tcontain.net/index.php
- http://wa####ndustry.net/index.php
- http://th####tbecame.net/index.php
- http://wa###basket.net/index.php
- http://wo####ndustry.net/index.php
- http://wa####ontain.net/index.php
- http://th####tbasket.net/index.php
- DNS ASK ex#####ncedevice.net
- DNS ASK fr###before.net
- DNS ASK ex#####ncelanguage.net
- DNS ASK fr###device.net
- DNS ASK al####ysettle.net
- DNS ASK ge#####anlanguage.net
- DNS ASK ex#####ncebefore.net
- DNS ASK ge####mansettle.net
- DNS ASK fr####anguage.net
- DNS ASK pa####ontain.net
- DNS ASK fi####ontain.net
- DNS ASK pa###became.net
- DNS ASK fi###became.net
- DNS ASK fr###settle.net
- DNS ASK ex#####ncesettle.net
- DNS ASK pa###basket.net
- DNS ASK fi###basket.net
- DNS ASK fo####before.net
- DNS ASK me####before.net
- DNS ASK fo####device.net
- DNS ASK me####device.net
- DNS ASK be####anguage.net
- DNS ASK kn####anguage.net
- DNS ASK be###settle.net
- DNS ASK kn###settle.net
- DNS ASK me####language.net
- DNS ASK al####ydevice.net
- DNS ASK ge####manbefore.net
- DNS ASK al####ylanguage.net
- DNS ASK ge####mandevice.net
- DNS ASK me####settle.net
- DNS ASK fo####language.net
- DNS ASK al####ybefore.net
- DNS ASK fo####settle.net
- DNS ASK cr###became.net
- DNS ASK su####contain.net
- DNS ASK cr####ndustry.net
- DNS ASK su####became.net
- DNS ASK cr###basket.net
- DNS ASK th####tindustry.net
- DNS ASK cr####ontain.net
- DNS ASK su####basket.net
- DNS ASK su####industry.net
- DNS ASK be###became.net
- DNS ASK kn###became.net
- DNS ASK be####ndustry.net
- DNS ASK kn####ndustry.net
- DNS ASK be###basket.net
- DNS ASK kn###basket.net
- DNS ASK be####ontain.net
- DNS ASK kn####ontain.net
- DNS ASK wo####ontain.net
- DNS ASK sm####ontain.net
- DNS ASK wo###became.net
- DNS ASK sm###became.net
- DNS ASK pa####ndustry.net
- DNS ASK fi####ndustry.net
- DNS ASK wo###basket.net
- DNS ASK sm###basket.net
- DNS ASK sm####ndustry.net
- DNS ASK wa###became.net
- DNS ASK th####tcontain.net
- DNS ASK wa####ndustry.net
- DNS ASK th####tbecame.net
- DNS ASK wa###basket.net
- DNS ASK wo####ndustry.net
- DNS ASK wa####ontain.net
- DNS ASK th####tbasket.net