Technical Information
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Acquisition PC Receiver Proxy Studio Removal' = 'C:\qtnctxwcjm\mprdlsoje.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\Intelligent Modules Encryption Support] 'Start' = '00000002'
- 'C:\qtnctxwcjm\nrucfhkiiohk.exe' "c:\qtnctxwcjm\mprdlsoje.exe"
- 'C:\qtnctxwcjm\mprdlsoje.exe'
- 'C:\qtnctxwcjm\us36iepjb9oihodyyb.exe'
- C:\qtnctxwcjm\mprdlsoje.exe
- C:\qtnctxwcjm\nrucfhkiiohk.exe
- C:\qtnctxwcjm\gplokke
- %WINDIR%\qtnctxwcjm\xcluikq9n6
- C:\qtnctxwcjm\xcluikq9n6
- C:\qtnctxwcjm\us36iepjb9oihodyyb.exe
- C:\qtnctxwcjm\nrucfhkiiohk.exe
- C:\qtnctxwcjm\mprdlsoje.exe
- C:\qtnctxwcjm\us36iepjb9oihodyyb.exe
- %WINDIR%\qtnctxwcjm\xcluikq9n6
- 'tr###action.net':80
- 'st####direct.net':80
- 'tr###method.net':80
- 'st####action.net':80
- 'tr####rought.net':80
- 'be####method.net':80
- 'tr###direct.net':80
- 'st####brought.net':80
- 'el####icaction.net':80
- 're####direct.net':80
- 'el####icmethod.net':80
- 're####action.net':80
- 'el####icbrought.net':80
- 'st####method.net':80
- 'el####icdirect.net':80
- 're####brought.net':80
- 'br###action.net':80
- 'fl###direct.net':80
- 'br###method.net':80
- 'fl###action.net':80
- 'br####rought.net':80
- 'qu###method.net':80
- 'br###direct.net':80
- 'fl####rought.net':80
- 'ga####action.net':80
- 'be####direct.net':80
- 'ga####method.net':80
- 'be####action.net':80
- 'ga####brought.net':80
- 'fl###method.net':80
- 'ga####direct.net':80
- 'be####brought.net':80
- 're####method.net':80
- 'ag####taction.net':80
- 'do###action.net':80
- 'ag####tmethod.net':80
- 'do###method.net':80
- 'ag####tbrought.net':80
- 'do####rought.net':80
- 'ag####tdirect.net':80
- 'do###direct.net':80
- 'qu####lossary.net':80
- 'se####glossary.net':80
- 'qu###round.net':80
- 'se###nround.net':80
- 'qu###worth.net':80
- 'se###nworth.net':80
- 'qu###likely.net':80
- 'se####likely.net':80
- 'la###action.net':80
- 'ca####naction.net':80
- 'la###method.net':80
- 'ca####nmethod.net':80
- 'la####rought.net':80
- 'ca####nbrought.net':80
- 'la###direct.net':80
- 'ca####ndirect.net':80
- 'ni###action.net':80
- 'de####action.net':80
- 'ni###method.net':80
- 'de####method.net':80
- 'ni####rought.net':80
- 'de####brought.net':80
- 'ni###direct.net':80
- 'de####direct.net':80
- http://tr###action.net/index.php?me########
- http://st####direct.net/index.php?me########
- http://tr###method.net/index.php?me########
- http://st####action.net/index.php?me########
- http://tr####rought.net/index.php?me########
- http://be####method.net/index.php?me########
- http://tr###direct.net/index.php?me########
- http://st####brought.net/index.php?me########
- http://el####icaction.net/index.php?me########
- http://re####direct.net/index.php?me########
- http://el####icmethod.net/index.php?me########
- http://re####action.net/index.php?me########
- http://el####icbrought.net/index.php?me########
- http://st####method.net/index.php?me########
- http://el####icdirect.net/index.php?me########
- http://re####brought.net/index.php?me########
- http://br###action.net/index.php?me########
- http://fl###direct.net/index.php?me########
- http://br###method.net/index.php?me########
- http://fl###action.net/index.php?me########
- http://br####rought.net/index.php?me########
- http://qu###method.net/index.php?me########
- http://br###direct.net/index.php?me########
- http://fl####rought.net/index.php?me########
- http://ga####action.net/index.php?me########
- http://be####direct.net/index.php?me########
- http://ga####method.net/index.php?me########
- http://be####action.net/index.php?me########
- http://ga####brought.net/index.php?me########
- http://fl###method.net/index.php?me########
- http://ga####direct.net/index.php?me########
- http://be####brought.net/index.php?me########
- http://re####method.net/index.php?me########
- http://ag####taction.net/index.php?me########
- http://do###action.net/index.php?me########
- http://ag####tmethod.net/index.php?me########
- http://do###method.net/index.php?me########
- http://ag####tbrought.net/index.php?me########
- http://do####rought.net/index.php?me########
- http://ag####tdirect.net/index.php?me########
- http://do###direct.net/index.php?me########
- http://qu####lossary.net/index.php?me########
- http://se####glossary.net/index.php?me########
- http://qu###round.net/index.php?me########
- http://se###nround.net/index.php?me########
- http://qu###worth.net/index.php?me########
- http://se###nworth.net/index.php?me########
- http://qu###likely.net/index.php?me########
- http://se####likely.net/index.php?me########
- http://la###action.net/index.php?me########
- http://ca####naction.net/index.php?me########
- http://la###method.net/index.php?me########
- http://ca####nmethod.net/index.php?me########
- http://la####rought.net/index.php?me########
- http://ca####nbrought.net/index.php?me########
- http://la###direct.net/index.php?me########
- http://ca####ndirect.net/index.php?me########
- http://ni###action.net/index.php?me########
- http://de####action.net/index.php?me########
- http://ni###method.net/index.php?me########
- http://de####method.net/index.php?me########
- http://ni####rought.net/index.php?me########
- http://de####brought.net/index.php?me########
- http://ni###direct.net/index.php?me########
- http://de####direct.net/index.php?me########
- DNS ASK tr###action.net
- DNS ASK st####direct.net
- DNS ASK tr###method.net
- DNS ASK st####action.net
- DNS ASK tr####rought.net
- DNS ASK be####method.net
- DNS ASK tr###direct.net
- DNS ASK st####brought.net
- DNS ASK el####icaction.net
- DNS ASK re####direct.net
- DNS ASK el####icmethod.net
- DNS ASK re####action.net
- DNS ASK el####icbrought.net
- DNS ASK st####method.net
- DNS ASK el####icdirect.net
- DNS ASK re####brought.net
- DNS ASK ga####method.net
- DNS ASK fl###direct.net
- DNS ASK br###direct.net
- DNS ASK fl###action.net
- DNS ASK br###action.net
- DNS ASK qu###method.net
- DNS ASK se####method.net
- DNS ASK fl####rought.net
- DNS ASK br####rought.net
- DNS ASK be####direct.net
- DNS ASK ga####direct.net
- DNS ASK be####action.net
- DNS ASK ga####action.net
- DNS ASK fl###method.net
- DNS ASK br###method.net
- DNS ASK be####brought.net
- DNS ASK ga####brought.net
- DNS ASK ag####taction.net
- DNS ASK do###action.net
- DNS ASK ag####tmethod.net
- DNS ASK do###method.net
- DNS ASK ag####tbrought.net
- DNS ASK do####rought.net
- DNS ASK ag####tdirect.net
- DNS ASK do###direct.net
- DNS ASK qu####lossary.net
- DNS ASK se####glossary.net
- DNS ASK qu###round.net
- DNS ASK se###nround.net
- DNS ASK qu###worth.net
- DNS ASK se###nworth.net
- DNS ASK qu###likely.net
- DNS ASK se####likely.net
- DNS ASK ni###method.net
- DNS ASK ca####naction.net
- DNS ASK la###direct.net
- DNS ASK ca####nmethod.net
- DNS ASK la###action.net
- DNS ASK ca####nbrought.net
- DNS ASK re####method.net
- DNS ASK ca####ndirect.net
- DNS ASK la####rought.net
- DNS ASK de####action.net
- DNS ASK ni###direct.net
- DNS ASK de####method.net
- DNS ASK ni###action.net
- DNS ASK de####brought.net
- DNS ASK la###method.net
- DNS ASK de####direct.net
- DNS ASK ni####rought.net
- ClassName: 'Shell_TrayWnd' WindowName: ''