Technical Information
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Netlogon UPnP Workstation Isolation' = 'C:\uyctsfmlcqtc\jbvkloydear.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\Bluetooth Foundation iSCSI Machine Offline] 'ImagePath' = 'C:\uyctsfmlcqtc\jbvkloydear.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\Bluetooth Foundation iSCSI Machine Offline] 'Start' = '00000002'
- 'C:\uyctsfmlcqtc\jtexwud.exe' "c:\uyctsfmlcqtc\jbvkloydear.exe"
- 'C:\uyctsfmlcqtc\jbvkloydear.exe'
- 'C:\uyctsfmlcqtc\cpsw2y3gpswllfcizwy.exe'
- C:\uyctsfmlcqtc\jbvkloydear.exe
- C:\uyctsfmlcqtc\jtexwud.exe
- C:\uyctsfmlcqtc\cpsw2y3gpswllfcizwy.exe
- %WINDIR%\uyctsfmlcqtc\l92udzsg5e
- C:\uyctsfmlcqtc\l92udzsg5e
- C:\uyctsfmlcqtc\jtexwud.exe
- C:\uyctsfmlcqtc\jbvkloydear.exe
- C:\uyctsfmlcqtc\cpsw2y3gpswllfcizwy.exe
- %WINDIR%\uyctsfmlcqtc\l92udzsg5e
- 'su####station.net':80
- 'cr####tation.net':80
- 'be####hildhood.net':80
- 'kn####hildhood.net':80
- 'su###rthird.net':80
- 'cr###object.net':80
- 'su####childhood.net':80
- 'cr###third.net':80
- 'su####object.net':80
- 'me####childhood.net':80
- 'be####tation.net':80
- 'me####object.net':80
- 'fo####childhood.net':80
- 'kn####tation.net':80
- 'be###object.net':80
- 'kn###object.net':80
- 'be###third.net':80
- 'kn###third.net':80
- 'cr####hildhood.net':80
- 'sm###third.net':80
- 'wo###object.net':80
- 'sm####tation.net':80
- 'wo###third.net':80
- 'sm###object.net':80
- 'pa####tation.net':80
- 'fi####tation.net':80
- 'wo####hildhood.net':80
- 'sm####hildhood.net':80
- 'th####tthird.net':80
- 'wa###third.net':80
- 'th####tstation.net':80
- 'wa####tation.net':80
- 'th####tobject.net':80
- 'wa####hildhood.net':80
- 'wo####tation.net':80
- 'wa###object.net':80
- 'th#####childhood.net':80
- 'fi###listen.net':80
- 'pa###demand.net':80
- 'fi###bring.net':80
- 'pa###listen.net':80
- 'fi###demand.net':80
- 'fr####tation.net':80
- 'ex#####ncestation.net':80
- 'pa###shout.net':80
- 'fi###shout.net':80
- 'wo###listen.net':80
- 'sm###listen.net':80
- 'wo###bring.net':80
- 'sm###bring.net':80
- 'wo###demand.net':80
- 'sm###shout.net':80
- 'pa###bring.net':80
- 'sm###demand.net':80
- 'wo###shout.net':80
- 'fr###third.net':80
- 'ge#####anchildhood.net':80
- 'al#####childhood.net':80
- 'ge####manobject.net':80
- 'al####yobject.net':80
- 'fo####station.net':80
- 'me###rthird.net':80
- 'fo####object.net':80
- 'me####station.net':80
- 'fo###wthird.net':80
- 'ex#####nceobject.net':80
- 'fr####hildhood.net':80
- 'ex####encethird.net':80
- 'fr###object.net':80
- 'ex#####ncechildhood.net':80
- 'ge####manthird.net':80
- 'al####ythird.net':80
- 'ge#####anstation.net':80
- 'al####ystation.net':80
- http://su####station.net/index.php
- http://cr####tation.net/index.php
- http://be####hildhood.net/index.php
- http://kn####hildhood.net/index.php
- http://su###rthird.net/index.php
- http://cr###object.net/index.php
- http://su####childhood.net/index.php
- http://cr###third.net/index.php
- http://su####object.net/index.php
- http://me####childhood.net/index.php
- http://be####tation.net/index.php
- http://me####object.net/index.php
- http://fo####childhood.net/index.php
- http://kn####tation.net/index.php
- http://be###object.net/index.php
- http://kn###object.net/index.php
- http://be###third.net/index.php
- http://kn###third.net/index.php
- http://cr####hildhood.net/index.php
- http://sm###third.net/index.php
- http://wo###object.net/index.php
- http://sm####tation.net/index.php
- http://wo###third.net/index.php
- http://sm###object.net/index.php
- http://pa####tation.net/index.php
- http://fi####tation.net/index.php
- http://wo####hildhood.net/index.php
- http://sm####hildhood.net/index.php
- http://th####tthird.net/index.php
- http://wa###third.net/index.php
- http://th####tstation.net/index.php
- http://wa####tation.net/index.php
- http://th####tobject.net/index.php
- http://wa####hildhood.net/index.php
- http://wo####tation.net/index.php
- http://wa###object.net/index.php
- http://th#####childhood.net/index.php
- http://fi###listen.net/index.php
- http://pa###demand.net/index.php
- http://fi###bring.net/index.php
- http://pa###listen.net/index.php
- http://fi###demand.net/index.php
- http://fr####tation.net/index.php
- http://ex#####ncestation.net/index.php
- http://pa###shout.net/index.php
- http://fi###shout.net/index.php
- http://wo###listen.net/index.php
- http://sm###listen.net/index.php
- http://wo###bring.net/index.php
- http://sm###bring.net/index.php
- http://wo###demand.net/index.php
- http://sm###shout.net/index.php
- http://pa###bring.net/index.php
- http://sm###demand.net/index.php
- http://wo###shout.net/index.php
- http://fr###third.net/index.php
- http://ge#####anchildhood.net/index.php
- http://al#####childhood.net/index.php
- http://ge####manobject.net/index.php
- http://al####yobject.net/index.php
- http://fo####station.net/index.php
- http://me###rthird.net/index.php
- http://fo####object.net/index.php
- http://me####station.net/index.php
- http://fo###wthird.net/index.php
- http://ex#####nceobject.net/index.php
- http://fr####hildhood.net/index.php
- http://ex####encethird.net/index.php
- http://fr###object.net/index.php
- http://ex#####ncechildhood.net/index.php
- http://ge####manthird.net/index.php
- http://al####ythird.net/index.php
- http://ge#####anstation.net/index.php
- http://al####ystation.net/index.php
- DNS ASK cr####tation.net
- DNS ASK su###rthird.net
- DNS ASK kn####hildhood.net
- DNS ASK su####station.net
- DNS ASK cr###third.net
- DNS ASK su####childhood.net
- DNS ASK cr####hildhood.net
- DNS ASK su####object.net
- DNS ASK cr###object.net
- DNS ASK be####tation.net
- DNS ASK kn####tation.net
- DNS ASK fo####childhood.net
- DNS ASK me####childhood.net
- DNS ASK be###third.net
- DNS ASK kn###object.net
- DNS ASK be####hildhood.net
- DNS ASK kn###third.net
- DNS ASK be###object.net
- DNS ASK th####tstation.net
- DNS ASK wo###object.net
- DNS ASK sm###object.net
- DNS ASK wo###third.net
- DNS ASK sm###third.net
- DNS ASK wo####hildhood.net
- DNS ASK fi####tation.net
- DNS ASK pa###third.net
- DNS ASK sm####hildhood.net
- DNS ASK pa####tation.net
- DNS ASK wa###third.net
- DNS ASK th####tobject.net
- DNS ASK wa####tation.net
- DNS ASK th####tthird.net
- DNS ASK wa###object.net
- DNS ASK wo####tation.net
- DNS ASK sm####tation.net
- DNS ASK th#####childhood.net
- DNS ASK wa####hildhood.net
- DNS ASK me####object.net
- DNS ASK fi###listen.net
- DNS ASK pa###demand.net
- DNS ASK fi###bring.net
- DNS ASK pa###listen.net
- DNS ASK fi###demand.net
- DNS ASK fr####tation.net
- DNS ASK ex#####ncestation.net
- DNS ASK pa###shout.net
- DNS ASK fi###shout.net
- DNS ASK wo###listen.net
- DNS ASK sm###listen.net
- DNS ASK wo###bring.net
- DNS ASK sm###bring.net
- DNS ASK wo###demand.net
- DNS ASK sm###shout.net
- DNS ASK pa###bring.net
- DNS ASK sm###demand.net
- DNS ASK wo###shout.net
- DNS ASK fr###third.net
- DNS ASK ge#####anchildhood.net
- DNS ASK al#####childhood.net
- DNS ASK ge####manobject.net
- DNS ASK al####yobject.net
- DNS ASK fo####station.net
- DNS ASK me###rthird.net
- DNS ASK fo####object.net
- DNS ASK me####station.net
- DNS ASK fo###wthird.net
- DNS ASK ex#####nceobject.net
- DNS ASK fr####hildhood.net
- DNS ASK ex####encethird.net
- DNS ASK fr###object.net
- DNS ASK ex#####ncechildhood.net
- DNS ASK ge####manthird.net
- DNS ASK al####ythird.net
- DNS ASK ge#####anstation.net
- DNS ASK al####ystation.net
- ClassName: 'Shell_TrayWnd' WindowName: ''