Technical Information
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Drive Logs Reporting' = '%APPDATA%\cukrchiof\myyxjianhmw.exe'
- '%APPDATA%\cukrchiof\xikmhgscgxa.exe' "%APPDATA%\cukrchiof\myyxjianhmw.exe"
- '%APPDATA%\cukrchiof\myyxjianhmw.exe'
- %APPDATA%\cukrchiof\myyxjianhmw.ii
- %APPDATA%\cukrchiof\xikmhgscgxa.exe
- %APPDATA%\cukrchiof\myyxjianhmw.exe
- %APPDATA%\cukrchiof\xikmhgscgxa.exe
- %APPDATA%\cukrchiof\myyxjianhmw.exe
- 'be####brought.net':80
- 'ga####brought.net':80
- 'ga####direct.net':80
- 'ga####action.net':80
- 'be####direct.net':80
- 'br###action.net':80
- 'fl###direct.net':80
- 'fl###action.net':80
- 'fl###method.net':80
- 'br###method.net':80
- 'st####direct.net':80
- 'tr###direct.net':80
- 'tr###action.net':80
- 'tr###method.net':80
- 'st####action.net':80
- 'ga####method.net':80
- 'be####action.net':80
- 'be####method.net':80
- 'st####brought.net':80
- 'tr####rought.net':80
- 'ag####tniece.net':80
- 'do###niece.net':80
- 'do###speak.net':80
- 'se####brought.net':80
- 'ag####tspeak.net':80
- 'do###oclock.net':80
- 'ni###speak.net':80
- 'ag####toclock.net':80
- 'ag####twrite.net':80
- 'do###write.net':80
- 'qu###method.net':80
- 'se####method.net':80
- 'br####rought.net':80
- 'br###direct.net':80
- 'fl####rought.net':80
- 'se####direct.net':80
- 'qu####rought.net':80
- 'qu###direct.net':80
- 'qu###action.net':80
- 'se####action.net':80
- 'st####method.net':80
- 'do###direct.net':80
- 'ag####tbrought.net':80
- 'ag####tdirect.net':80
- 'ag####taction.net':80
- 'do###action.net':80
- 'ni###action.net':80
- 'de####action.net':80
- 'de####method.net':80
- 'do####rought.net':80
- 'ni###method.net':80
- 'se####glossary.net':80
- 'qu###likely.net':80
- 'qu####lossary.net':80
- 'qu###round.net':80
- 'se###nround.net':80
- 'ag####tmethod.net':80
- 'do###method.net':80
- 'se###nworth.net':80
- 'se####likely.net':80
- 'qu###worth.net':80
- 'el####icmethod.net':80
- 're####action.net':80
- 're####method.net':80
- 'la####rought.net':80
- 'ca####nbrought.net':80
- 're####brought.net':80
- 'el####icbrought.net':80
- 'el####icdirect.net':80
- 'el####icaction.net':80
- 're####direct.net':80
- 'de####brought.net':80
- 'la###method.net':80
- 'ni####rought.net':80
- 'ni###direct.net':80
- 'de####direct.net':80
- 'la###direct.net':80
- 'ca####ndirect.net':80
- 'ca####naction.net':80
- 'ca####nmethod.net':80
- 'la###action.net':80
- http://be####brought.net/forum/search.php?em############################
- http://ga####brought.net/forum/search.php?em############################
- http://ga####direct.net/forum/search.php?em############################
- http://ga####action.net/forum/search.php?em############################
- http://be####direct.net/forum/search.php?em############################
- http://br###action.net/forum/search.php?em############################
- http://fl###direct.net/forum/search.php?em############################
- http://fl###action.net/forum/search.php?em############################
- http://fl###method.net/forum/search.php?em############################
- http://br###method.net/forum/search.php?em############################
- http://st####direct.net/forum/search.php?em############################
- http://tr###direct.net/forum/search.php?em############################
- http://tr###action.net/forum/search.php?em############################
- http://tr###method.net/forum/search.php?em############################
- http://st####action.net/forum/search.php?em############################
- http://ga####method.net/forum/search.php?em############################
- http://be####action.net/forum/search.php?em############################
- http://be####method.net/forum/search.php?em############################
- http://st####brought.net/forum/search.php?em############################
- http://tr####rought.net/forum/search.php?em############################
- http://ag####tniece.net/forum/search.php?em############################
- http://do###niece.net/forum/search.php?em############################
- http://do###speak.net/forum/search.php?em############################
- http://se####brought.net/forum/search.php?em############################
- http://ag####tspeak.net/forum/search.php?em############################
- http://do###oclock.net/forum/search.php?em############################
- http://ni###speak.net/forum/search.php?em############################
- http://ag####toclock.net/forum/search.php?em############################
- http://ag####twrite.net/forum/search.php?em############################
- http://do###write.net/forum/search.php?em############################
- http://qu###method.net/forum/search.php?em############################
- http://se####method.net/forum/search.php?em############################
- http://br####rought.net/forum/search.php?em############################
- http://br###direct.net/forum/search.php?em############################
- http://fl####rought.net/forum/search.php?em############################
- http://se####direct.net/forum/search.php?em############################
- http://qu####rought.net/forum/search.php?em############################
- http://qu###direct.net/forum/search.php?em############################
- http://qu###action.net/forum/search.php?em############################
- http://se####action.net/forum/search.php?em############################
- http://st####method.net/forum/search.php?em############################
- http://do###direct.net/forum/search.php?em############################
- http://ag####tbrought.net/forum/search.php?em############################
- http://ag####tdirect.net/forum/search.php?em############################
- http://ag####taction.net/forum/search.php?em############################
- http://do###action.net/forum/search.php?em############################
- http://ni###action.net/forum/search.php?em############################
- http://de####action.net/forum/search.php?em############################
- http://de####method.net/forum/search.php?em############################
- http://do####rought.net/forum/search.php?em############################
- http://ni###method.net/forum/search.php?em############################
- http://se####glossary.net/forum/search.php?em############################
- http://qu###likely.net/forum/search.php?em############################
- http://qu####lossary.net/forum/search.php?em############################
- http://qu###round.net/forum/search.php?em############################
- http://se###nround.net/forum/search.php?em############################
- http://ag####tmethod.net/forum/search.php?em############################
- http://do###method.net/forum/search.php?em############################
- http://se###nworth.net/forum/search.php?em############################
- http://se####likely.net/forum/search.php?em############################
- http://qu###worth.net/forum/search.php?em############################
- http://el####icmethod.net/forum/search.php?em############################
- http://re####action.net/forum/search.php?em############################
- http://re####method.net/forum/search.php?em############################
- http://la####rought.net/forum/search.php?em############################
- http://ca####nbrought.net/forum/search.php?em############################
- http://re####brought.net/forum/search.php?em############################
- http://el####icbrought.net/forum/search.php?em############################
- http://el####icdirect.net/forum/search.php?em############################
- http://el####icaction.net/forum/search.php?em############################
- http://re####direct.net/forum/search.php?em############################
- http://de####brought.net/forum/search.php?em############################
- http://la###method.net/forum/search.php?em############################
- http://ni####rought.net/forum/search.php?em############################
- http://ni###direct.net/forum/search.php?em############################
- http://de####direct.net/forum/search.php?em############################
- http://la###direct.net/forum/search.php?em############################
- http://ca####ndirect.net/forum/search.php?em############################
- http://ca####naction.net/forum/search.php?em############################
- http://ca####nmethod.net/forum/search.php?em############################
- http://la###action.net/forum/search.php?em############################
- DNS ASK be####brought.net
- DNS ASK ga####brought.net
- DNS ASK ga####direct.net
- DNS ASK ga####action.net
- DNS ASK be####direct.net
- DNS ASK br###action.net
- DNS ASK fl###direct.net
- DNS ASK fl###action.net
- DNS ASK fl###method.net
- DNS ASK br###method.net
- DNS ASK st####direct.net
- DNS ASK tr###direct.net
- DNS ASK tr###action.net
- DNS ASK tr###method.net
- DNS ASK st####action.net
- DNS ASK ga####method.net
- DNS ASK be####action.net
- DNS ASK be####method.net
- DNS ASK st####brought.net
- DNS ASK tr####rought.net
- DNS ASK br###direct.net
- DNS ASK do###niece.net
- DNS ASK ag####twrite.net
- DNS ASK ag####tniece.net
- DNS ASK ag####tspeak.net
- DNS ASK do###speak.net
- DNS ASK ni###speak.net
- DNS ASK de###espeak.net
- DNS ASK do###oclock.net
- DNS ASK do###write.net
- DNS ASK ag####toclock.net
- DNS ASK se####method.net
- DNS ASK qu###action.net
- DNS ASK qu###method.net
- DNS ASK fl####rought.net
- DNS ASK br####rought.net
- DNS ASK qu####rought.net
- DNS ASK se####brought.net
- DNS ASK se####direct.net
- DNS ASK se####action.net
- DNS ASK qu###direct.net
- DNS ASK do###direct.net
- DNS ASK ag####tbrought.net
- DNS ASK ag####tdirect.net
- DNS ASK ag####taction.net
- DNS ASK do###action.net
- DNS ASK ni###action.net
- DNS ASK de####action.net
- DNS ASK de####method.net
- DNS ASK do####rought.net
- DNS ASK ni###method.net
- DNS ASK se####glossary.net
- DNS ASK qu###likely.net
- DNS ASK qu####lossary.net
- DNS ASK qu###round.net
- DNS ASK se###nround.net
- DNS ASK ag####tmethod.net
- DNS ASK do###method.net
- DNS ASK se###nworth.net
- DNS ASK se####likely.net
- DNS ASK qu###worth.net
- DNS ASK ni###direct.net
- DNS ASK re####action.net
- DNS ASK el####icaction.net
- DNS ASK el####icmethod.net
- DNS ASK ca####nbrought.net
- DNS ASK re####method.net
- DNS ASK el####icbrought.net
- DNS ASK st####method.net
- DNS ASK re####brought.net
- DNS ASK re####direct.net
- DNS ASK el####icdirect.net
- DNS ASK la###method.net
- DNS ASK ca####nmethod.net
- DNS ASK de####brought.net
- DNS ASK de####direct.net
- DNS ASK ni####rought.net
- DNS ASK ca####ndirect.net
- DNS ASK la####rought.net
- DNS ASK la###direct.net
- DNS ASK la###action.net
- DNS ASK ca####naction.net
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: 'Indicator' WindowName: ''