Technical Information
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Brightness Shadow Upgrade Auto Level Routing Power' = 'C:\ulehuwwed\ivlqzblhyvxi.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\Helper Framework Policy Connect DCOM] 'ImagePath' = 'C:\ulehuwwed\ivlqzblhyvxi.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\Helper Framework Policy Connect DCOM] 'Start' = '00000002'
- 'C:\ulehuwwed\ryapsudzkh.exe' "c:\ulehuwwed\ivlqzblhyvxi.exe"
- 'C:\ulehuwwed\ivlqzblhyvxi.exe'
- 'C:\ulehuwwed\vokpt344wxujdjvwpcw.exe'
- C:\ulehuwwed\ivlqzblhyvxi.exe
- C:\ulehuwwed\ryapsudzkh.exe
- C:\ulehuwwed\vokpt344wxujdjvwpcw.exe
- %WINDIR%\ulehuwwed\orgqafvg
- C:\ulehuwwed\orgqafvg
- C:\ulehuwwed\ryapsudzkh.exe
- C:\ulehuwwed\ivlqzblhyvxi.exe
- C:\ulehuwwed\vokpt344wxujdjvwpcw.exe
- %WINDIR%\ulehuwwed\orgqafvg
- 'ei###rwrite.net':80
- 'en####hwrite.net':80
- 'ei###rniece.net':80
- 'en####hniece.net':80
- 'fr###almost.net':80
- 'ex#####ncealmost.net':80
- 'ei####oclock.net':80
- 'en####hoclock.net':80
- 'en####hspeak.net':80
- 'fa###yniece.net':80
- 'ch####enwrite.net':80
- 'fa###yspeak.net':80
- 'ch####enniece.net':80
- 'fa####oclock.net':80
- 'ei###rspeak.net':80
- 'fa###ywrite.net':80
- 'ch####enoclock.net':80
- 'fr###reason.net':80
- 'ge####manvalue.net':80
- 'al####yvalue.net':80
- 'ge#####anorderly.net':80
- 'al####yorderly.net':80
- 'fo####reason.net':80
- 'me####reason.net':80
- 'fo####almost.net':80
- 'me####almost.net':80
- 'al####yreason.net':80
- 'ex#####nceorderly.net':80
- 'fr###value.net':80
- 'ex#####ncereason.net':80
- 'fr####rderly.net':80
- 'al####yalmost.net':80
- 'ge####manreason.net':80
- 'ex####encevalue.net':80
- 'ge####manalmost.net':80
- 'ch####enspeak.net':80
- 'wh####rspeak.net':80
- 'ri###speak.net':80
- 'su####oclock.net':80
- 'fo####noclock.net':80
- 'wh####rwrite.net':80
- 'ri###write.net':80
- 'wh####rniece.net':80
- 'ri###niece.net':80
- 'fo####nwrite.net':80
- 'ma####eoclock.net':80
- 'su###nspeak.net':80
- 'ma####ewrite.net':80
- 'pe####oclock.net':80
- 'fo####nniece.net':80
- 'su###nwrite.net':80
- 'fo####nspeak.net':80
- 'su###nniece.net':80
- 'wh####roclock.net':80
- 'pi####eniece.net':80
- 'ci####tteniece.net':80
- 'pi####espeak.net':80
- 'ci####ttespeak.net':80
- 'pi####eoclock.net':80
- 'ci####tteoclock.net':80
- 'pi####ewrite.net':80
- 'ci####ttewrite.net':80
- 'th####oclock.net':80
- 'th###hspeak.net':80
- 'fi###eniece.net':80
- 'ri###oclock.net':80
- 'fi###espeak.net':80
- 'th###hwrite.net':80
- 'fi####oclock.net':80
- 'th###hniece.net':80
- 'fi###ewrite.net':80
- http://ei###rwrite.net/index.php
- http://en####hwrite.net/index.php
- http://ei###rniece.net/index.php
- http://en####hniece.net/index.php
- http://fr###almost.net/index.php
- http://ex#####ncealmost.net/index.php
- http://ei####oclock.net/index.php
- http://en####hoclock.net/index.php
- http://en####hspeak.net/index.php
- http://fa###yniece.net/index.php
- http://ch####enwrite.net/index.php
- http://fa###yspeak.net/index.php
- http://ch####enniece.net/index.php
- http://fa####oclock.net/index.php
- http://ei###rspeak.net/index.php
- http://fa###ywrite.net/index.php
- http://ch####enoclock.net/index.php
- http://fr###reason.net/index.php
- http://ge####manvalue.net/index.php
- http://al####yvalue.net/index.php
- http://ge#####anorderly.net/index.php
- http://al####yorderly.net/index.php
- http://fo####reason.net/index.php
- http://me####reason.net/index.php
- http://fo####almost.net/index.php
- http://me####almost.net/index.php
- http://al####yreason.net/index.php
- http://ex#####nceorderly.net/index.php
- http://fr###value.net/index.php
- http://ex#####ncereason.net/index.php
- http://fr####rderly.net/index.php
- http://al####yalmost.net/index.php
- http://ge####manreason.net/index.php
- http://ex####encevalue.net/index.php
- http://ge####manalmost.net/index.php
- http://ch####enspeak.net/index.php
- http://wh####rspeak.net/index.php
- http://ri###speak.net/index.php
- http://su####oclock.net/index.php
- http://fo####noclock.net/index.php
- http://wh####rwrite.net/index.php
- http://ri###write.net/index.php
- http://wh####rniece.net/index.php
- http://ri###niece.net/index.php
- http://fo####nwrite.net/index.php
- http://ma####eoclock.net/index.php
- http://su###nspeak.net/index.php
- http://ma####ewrite.net/index.php
- http://pe####oclock.net/index.php
- http://fo####nniece.net/index.php
- http://su###nwrite.net/index.php
- http://fo####nspeak.net/index.php
- http://su###nniece.net/index.php
- http://wh####roclock.net/index.php
- http://pi####eniece.net/index.php
- http://ci####tteniece.net/index.php
- http://pi####espeak.net/index.php
- http://ci####ttespeak.net/index.php
- http://pi####eoclock.net/index.php
- http://ci####tteoclock.net/index.php
- http://pi####ewrite.net/index.php
- http://ci####ttewrite.net/index.php
- http://th####oclock.net/index.php
- http://th###hspeak.net/index.php
- http://fi###eniece.net/index.php
- http://ri###oclock.net/index.php
- http://fi###espeak.net/index.php
- http://th###hwrite.net/index.php
- http://fi####oclock.net/index.php
- http://th###hniece.net/index.php
- http://fi###ewrite.net/index.php
- DNS ASK ei###rwrite.net
- DNS ASK en####hwrite.net
- DNS ASK ei###rniece.net
- DNS ASK en####hniece.net
- DNS ASK ei####oclock.net
- DNS ASK ex#####ncealmost.net
- DNS ASK fr###reason.net
- DNS ASK en####hoclock.net
- DNS ASK fr###almost.net
- DNS ASK fa###yniece.net
- DNS ASK ch####enwrite.net
- DNS ASK fa###yspeak.net
- DNS ASK ch####enniece.net
- DNS ASK fa###ywrite.net
- DNS ASK ei###rspeak.net
- DNS ASK en####hspeak.net
- DNS ASK ch####enoclock.net
- DNS ASK fa####oclock.net
- DNS ASK ge####manvalue.net
- DNS ASK al####yvalue.net
- DNS ASK ge#####anorderly.net
- DNS ASK al####yorderly.net
- DNS ASK fo####almost.net
- DNS ASK me####reason.net
- DNS ASK fo####orderly.net
- DNS ASK me####almost.net
- DNS ASK fo####reason.net
- DNS ASK ex#####nceorderly.net
- DNS ASK fr###value.net
- DNS ASK ex#####ncereason.net
- DNS ASK fr####rderly.net
- DNS ASK ex####encevalue.net
- DNS ASK ge####manreason.net
- DNS ASK al####yreason.net
- DNS ASK ge####manalmost.net
- DNS ASK al####yalmost.net
- DNS ASK wh####rspeak.net
- DNS ASK ri###speak.net
- DNS ASK su####oclock.net
- DNS ASK fo####noclock.net
- DNS ASK wh####rniece.net
- DNS ASK ri###write.net
- DNS ASK wh####roclock.net
- DNS ASK ri###niece.net
- DNS ASK wh####rwrite.net
- DNS ASK ma####eoclock.net
- DNS ASK su###nspeak.net
- DNS ASK ma####ewrite.net
- DNS ASK pe####oclock.net
- DNS ASK fo####nspeak.net
- DNS ASK su###nwrite.net
- DNS ASK fo####nwrite.net
- DNS ASK su###nniece.net
- DNS ASK fo####nniece.net
- DNS ASK pi####eniece.net
- DNS ASK ci####tteniece.net
- DNS ASK pi####espeak.net
- DNS ASK ci####ttespeak.net
- DNS ASK pi####ewrite.net
- DNS ASK ci####tteoclock.net
- DNS ASK ch####enspeak.net
- DNS ASK ci####ttewrite.net
- DNS ASK pi####eoclock.net
- DNS ASK th###hspeak.net
- DNS ASK fi###eniece.net
- DNS ASK ri###oclock.net
- DNS ASK fi###espeak.net
- DNS ASK th###hniece.net
- DNS ASK fi####oclock.net
- DNS ASK th####oclock.net
- DNS ASK fi###ewrite.net
- DNS ASK th###hwrite.net
- ClassName: 'Shell_TrayWnd' WindowName: ''