Technical Information
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Connections Scheduler Center Layer' = '%APPDATA%\zanpbdpymj\tpknwxhlj.exe'
- '%APPDATA%\zanpbdpymj\rkcmzhesbsm.exe' "%APPDATA%\zanpbdpymj\tpknwxhlj.exe"
- '%APPDATA%\zanpbdpymj\tpknwxhlj.exe'
- '<SYSTEM32>\wbem\wmiadap.exe' /R /T
- %APPDATA%\zanpbdpymj\tpknwxhlj.nowqu
- %APPDATA%\zanpbdpymj\rkcmzhesbsm.exe
- %APPDATA%\zanpbdpymj\tpknwxhlj.exe
- %APPDATA%\zanpbdpymj\rkcmzhesbsm.exe
- %APPDATA%\zanpbdpymj\tpknwxhlj.exe
- 'th####hoclock.net':80
- 'ef####oclock.net':80
- 'fo###tspeak.net':80
- 'fo###tniece.net':80
- 'in####sespeak.net':80
- 'th####hwrite.net':80
- 'th####hspeak.net':80
- 'ef###tspeak.net':80
- 'ef###tniece.net':80
- 'ef###twrite.net':80
- 'th####hniece.net':80
- 'wo###niece.net':80
- 're####erspeak.net':80
- 're####erniece.net':80
- 're####erwrite.net':80
- 'wo###write.net':80
- 'wo###speak.net':80
- 'fo###twrite.net':80
- 'in####seniece.net':80
- 'in####sewrite.net':80
- 'in####seoclock.net':80
- 'fo####oclock.net':80
- 'th###speak.net':80
- 'ch###speak.net':80
- 'ch###niece.net':80
- 'ch###write.net':80
- 'th###niece.net':80
- 'be####oclock.net':80
- 'be###gniece.net':80
- 'ri###nniece.net':80
- 'ri###nwrite.net':80
- 'ri####oclock.net':80
- 'be###gwrite.net':80
- 'wi###nwrite.net':80
- 'su###rniece.net':80
- 'su###rwrite.net':80
- 'su####oclock.net':80
- 'wi####oclock.net':80
- 'wi###nniece.net':80
- 'ch###oclock.net':80
- 'th###write.net':80
- 'th###oclock.net':80
- 'su###rspeak.net':80
- 'wi###nspeak.net':80
- th####hoclock.net/forum/search.php?em#####################################
- ef####oclock.net/forum/search.php?em#####################################
- fo###tspeak.net/forum/search.php?em#####################################
- fo###tniece.net/forum/search.php?em#####################################
- in####sespeak.net/forum/search.php?em#####################################
- th####hwrite.net/forum/search.php?em#####################################
- th####hspeak.net/forum/search.php?em#####################################
- ef###tspeak.net/forum/search.php?em#####################################
- ef###tniece.net/forum/search.php?em#####################################
- ef###twrite.net/forum/search.php?em#####################################
- th####hniece.net/forum/search.php?em#####################################
- wo###niece.net/forum/search.php?em#####################################
- re####erspeak.net/forum/search.php?em#####################################
- re####erniece.net/forum/search.php?em#####################################
- re####erwrite.net/forum/search.php?em#####################################
- wo###write.net/forum/search.php?em#####################################
- wo###speak.net/forum/search.php?em#####################################
- fo###twrite.net/forum/search.php?em#####################################
- in####seniece.net/forum/search.php?em#####################################
- in####sewrite.net/forum/search.php?em#####################################
- in####seoclock.net/forum/search.php?em#####################################
- fo####oclock.net/forum/search.php?em#####################################
- th###speak.net/forum/search.php?em#####################################
- ch###speak.net/forum/search.php?em#####################################
- ch###niece.net/forum/search.php?em#####################################
- ch###write.net/forum/search.php?em#####################################
- th###niece.net/forum/search.php?em#####################################
- be####oclock.net/forum/search.php?em#####################################
- be###gniece.net/forum/search.php?em#####################################
- ri###nniece.net/forum/search.php?em#####################################
- ri###nwrite.net/forum/search.php?em#####################################
- ri####oclock.net/forum/search.php?em#####################################
- be###gwrite.net/forum/search.php?em#####################################
- wi###nwrite.net/forum/search.php?em#####################################
- su###rniece.net/forum/search.php?em#####################################
- su###rwrite.net/forum/search.php?em#####################################
- su####oclock.net/forum/search.php?em#####################################
- wi####oclock.net/forum/search.php?em#####################################
- wi###nniece.net/forum/search.php?em#####################################
- ch###oclock.net/forum/search.php?em#####################################
- th###write.net/forum/search.php?em#####################################
- th###oclock.net/forum/search.php?em#####################################
- su###rspeak.net/forum/search.php?em#####################################
- wi###nspeak.net/forum/search.php?em#####################################
- DNS ASK fo###tspeak.net
- DNS ASK th####hoclock.net
- DNS ASK in####sespeak.net
- DNS ASK in####seniece.net
- DNS ASK fo###tniece.net
- DNS ASK ef####oclock.net
- DNS ASK ef###tniece.net
- DNS ASK th####hspeak.net
- DNS ASK th####hniece.net
- DNS ASK th####hwrite.net
- DNS ASK ef###twrite.net
- DNS ASK re####erniece.net
- DNS ASK wo###niece.net
- DNS ASK wo###write.net
- DNS ASK wo###oclock.net
- DNS ASK re####erwrite.net
- DNS ASK re####erspeak.net
- DNS ASK in####sewrite.net
- DNS ASK fo###twrite.net
- DNS ASK fo####oclock.net
- DNS ASK wo###speak.net
- DNS ASK in####seoclock.net
- DNS ASK ef###tspeak.net
- DNS ASK th###speak.net
- DNS ASK ch###speak.net
- DNS ASK ch###niece.net
- DNS ASK ch###write.net
- DNS ASK th###niece.net
- DNS ASK be####oclock.net
- DNS ASK be###gniece.net
- DNS ASK ri###nniece.net
- DNS ASK ri###nwrite.net
- DNS ASK ri####oclock.net
- DNS ASK be###gwrite.net
- DNS ASK wi###nwrite.net
- DNS ASK su###rniece.net
- DNS ASK su###rwrite.net
- DNS ASK su####oclock.net
- DNS ASK wi####oclock.net
- DNS ASK wi###nniece.net
- DNS ASK ch###oclock.net
- DNS ASK th###write.net
- DNS ASK th###oclock.net
- DNS ASK su###rspeak.net
- DNS ASK wi###nspeak.net
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: 'Indicator' WindowName: ''