Technical Information
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Transfer Coordinator PnP-X Plug' = 'C:\zwgpnhbfoa\zivbuxyf.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\ActiveX Function Registrar Multimedia Bluetooth] 'ImagePath' = 'C:\zwgpnhbfoa\zivbuxyf.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\ActiveX Function Registrar Multimedia Bluetooth] 'Start' = '00000002'
- 'C:\zwgpnhbfoa\jelyfbtdv.exe' "c:\zwgpnhbfoa\zivbuxyf.exe"
- 'C:\zwgpnhbfoa\zivbuxyf.exe'
- 'C:\zwgpnhbfoa\pmqkv2ghrscfmwyilix.exe'
- C:\zwgpnhbfoa\zivbuxyf.exe
- C:\zwgpnhbfoa\jelyfbtdv.exe
- C:\zwgpnhbfoa\pmqkv2ghrscfmwyilix.exe
- %WINDIR%\zwgpnhbfoa\raarno3
- C:\zwgpnhbfoa\raarno3
- C:\zwgpnhbfoa\jelyfbtdv.exe
- C:\zwgpnhbfoa\zivbuxyf.exe
- C:\zwgpnhbfoa\pmqkv2ghrscfmwyilix.exe
- %WINDIR%\zwgpnhbfoa\raarno3
- %WINDIR%\zwgpnhbfoa\raarno3
- 'al###enter.net':80
- 'mi####character.net':80
- 'al###board.net':80
- 'of###enter.net':80
- 'tw####ladder.net':80
- 'mi###eboard.net':80
- 'tw####character.net':80
- 'mi####ladder.net':80
- 'co####eenter.net':80
- 'of####haracter.net':80
- 'co####eboard.net':80
- 'ch###enter.net':80
- 'al###ladder.net':80
- 'of###board.net':80
- 'al####haracter.net':80
- 'of###ladder.net':80
- 'tw###eboard.net':80
- 'st#####character.net':80
- 'hi#####character.net':80
- 'ra###renter.net':80
- 'mo####genter.net':80
- 'st####eboard.net':80
- 'hi####yboard.net':80
- 'st####eladder.net':80
- 'hi####yladder.net':80
- 'ra####character.net':80
- 'mo#####character.net':80
- 'mi###eenter.net':80
- 'tw###eenter.net':80
- 'ra###rboard.net':80
- 'mo####gboard.net':80
- 'ra####ladder.net':80
- 'mo####gladder.net':80
- 'ch###board.net':80
- 'we####rdollar.net':80
- 'am####realize.net':80
- 'we####rwritten.net':80
- 'am####dollar.net':80
- 'cl###shore.net':80
- 'th####ritten.net':80
- 'we####rrealize.net':80
- 'th###shore.net':80
- 'hi####ydollar.net':80
- 'st####erealize.net':80
- 'hi####ywritten.net':80
- 'st####edollar.net':80
- 'we####rshore.net':80
- 'am####written.net':80
- 'hi####yrealize.net':80
- 'am###tshore.net':80
- 'cl####ritten.net':80
- 'th###enter.net':80
- 'pr####tenter.net':80
- 'th###board.net':80
- 'pr####tboard.net':80
- 'ch###ladder.net':80
- 'co####eladder.net':80
- 'ch####haracter.net':80
- 'co#####character.net':80
- 'th####ealize.net':80
- 'cl####ealize.net':80
- 'th###dollar.net':80
- 'cl###dollar.net':80
- 'th###ladder.net':80
- 'pr####tladder.net':80
- 'th####haracter.net':80
- 'pr#####character.net':80
- http://al###enter.net/index.php
- http://mi####character.net/index.php
- http://al###board.net/index.php
- http://of###enter.net/index.php
- http://tw####ladder.net/index.php
- http://mi###eboard.net/index.php
- http://tw####character.net/index.php
- http://mi####ladder.net/index.php
- http://co####eenter.net/index.php
- http://of####haracter.net/index.php
- http://co####eboard.net/index.php
- http://ch###enter.net/index.php
- http://al###ladder.net/index.php
- http://of###board.net/index.php
- http://al####haracter.net/index.php
- http://of###ladder.net/index.php
- http://tw###eboard.net/index.php
- http://st#####character.net/index.php
- http://hi#####character.net/index.php
- http://ra###renter.net/index.php
- http://mo####genter.net/index.php
- http://st####eboard.net/index.php
- http://hi####yboard.net/index.php
- http://st####eladder.net/index.php
- http://hi####yladder.net/index.php
- http://ra####character.net/index.php
- http://mo#####character.net/index.php
- http://mi###eenter.net/index.php
- http://tw###eenter.net/index.php
- http://ra###rboard.net/index.php
- http://mo####gboard.net/index.php
- http://ra####ladder.net/index.php
- http://mo####gladder.net/index.php
- http://ch###board.net/index.php
- http://we####rdollar.net/index.php
- http://am####realize.net/index.php
- http://we####rwritten.net/index.php
- http://am####dollar.net/index.php
- http://cl###shore.net/index.php
- http://th####ritten.net/index.php
- http://we####rrealize.net/index.php
- http://th###shore.net/index.php
- http://hi####ydollar.net/index.php
- http://st####erealize.net/index.php
- http://hi####ywritten.net/index.php
- http://st####edollar.net/index.php
- http://we####rshore.net/index.php
- http://am####written.net/index.php
- http://hi####yrealize.net/index.php
- http://am###tshore.net/index.php
- http://cl####ritten.net/index.php
- http://th###enter.net/index.php
- http://pr####tenter.net/index.php
- http://th###board.net/index.php
- http://pr####tboard.net/index.php
- http://ch###ladder.net/index.php
- http://co####eladder.net/index.php
- http://ch####haracter.net/index.php
- http://co#####character.net/index.php
- http://th####ealize.net/index.php
- http://cl####ealize.net/index.php
- http://th###dollar.net/index.php
- http://cl###dollar.net/index.php
- http://th###ladder.net/index.php
- http://pr####tladder.net/index.php
- http://th####haracter.net/index.php
- http://pr#####character.net/index.php
- DNS ASK mi####character.net
- DNS ASK tw####character.net
- DNS ASK of###enter.net
- DNS ASK al###enter.net
- DNS ASK mi###eboard.net
- DNS ASK tw###eboard.net
- DNS ASK mi####ladder.net
- DNS ASK tw####ladder.net
- DNS ASK al###board.net
- DNS ASK co####eenter.net
- DNS ASK of####haracter.net
- DNS ASK co####eboard.net
- DNS ASK ch###enter.net
- DNS ASK al###ladder.net
- DNS ASK of###board.net
- DNS ASK al####haracter.net
- DNS ASK of###ladder.net
- DNS ASK hi#####character.net
- DNS ASK st####eladder.net
- DNS ASK mo####genter.net
- DNS ASK st#####character.net
- DNS ASK hi####yboard.net
- DNS ASK st####eenter.net
- DNS ASK hi####yladder.net
- DNS ASK st####eboard.net
- DNS ASK ra###renter.net
- DNS ASK ra####character.net
- DNS ASK mo#####character.net
- DNS ASK mi###eenter.net
- DNS ASK tw###eenter.net
- DNS ASK ra###rboard.net
- DNS ASK mo####gboard.net
- DNS ASK ra####ladder.net
- DNS ASK mo####gladder.net
- DNS ASK am####realize.net
- DNS ASK we####rrealize.net
- DNS ASK am####dollar.net
- DNS ASK we####rdollar.net
- DNS ASK th####ritten.net
- DNS ASK cl####ritten.net
- DNS ASK th###shore.net
- DNS ASK cl###shore.net
- DNS ASK we####rwritten.net
- DNS ASK hi####ydollar.net
- DNS ASK st####erealize.net
- DNS ASK hi####ywritten.net
- DNS ASK st####edollar.net
- DNS ASK we####rshore.net
- DNS ASK am####written.net
- DNS ASK hi####yrealize.net
- DNS ASK am###tshore.net
- DNS ASK pr####tenter.net
- DNS ASK ch####haracter.net
- DNS ASK pr####tboard.net
- DNS ASK th###enter.net
- DNS ASK co####eladder.net
- DNS ASK ch###board.net
- DNS ASK co#####character.net
- DNS ASK ch###ladder.net
- DNS ASK th###board.net
- DNS ASK th####ealize.net
- DNS ASK cl####ealize.net
- DNS ASK th###dollar.net
- DNS ASK cl###dollar.net
- DNS ASK th###ladder.net
- DNS ASK pr####tladder.net
- DNS ASK th####haracter.net
- DNS ASK pr#####character.net