Technical Information
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Visual Tracking Logs Routing Window List Task' = 'C:\hzwsefuxbnc\lnqsstne.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\CardSpace Human Machine Storage Workstation] 'ImagePath' = 'C:\hzwsefuxbnc\lnqsstne.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\CardSpace Human Machine Storage Workstation] 'Start' = '00000002'
- 'C:\hzwsefuxbnc\kykvdspy.exe' "c:\hzwsefuxbnc\lnqsstne.exe"
- 'C:\hzwsefuxbnc\lnqsstne.exe'
- 'C:\hzwsefuxbnc\grig2uy5xmnufzp5n.exe'
- C:\hzwsefuxbnc\lnqsstne.exe
- C:\hzwsefuxbnc\kykvdspy.exe
- C:\hzwsefuxbnc\grig2uy5xmnufzp5n.exe
- %WINDIR%\hzwsefuxbnc\jmbe2k
- C:\hzwsefuxbnc\jmbe2k
- C:\hzwsefuxbnc\kykvdspy.exe
- C:\hzwsefuxbnc\lnqsstne.exe
- C:\hzwsefuxbnc\grig2uy5xmnufzp5n.exe
- %WINDIR%\hzwsefuxbnc\jmbe2k
- 'su####meeting.net':80
- 'cr####eeting.net':80
- 'cr###chance.net':80
- 'kn####nderstood.net':80
- 'su####chance.net':80
- 'cr####nderstood.net':80
- 'th####tchance.net':80
- 'su#####nderstood.net':80
- 'su####twenty.net':80
- 'cr###twenty.net':80
- 'be####nderstood.net':80
- 'me#####nderstood.net':80
- 'be###chance.net':80
- 'fo#####nderstood.net':80
- 'fo####twenty.net':80
- 'me####twenty.net':80
- 'be###twenty.net':80
- 'kn###twenty.net':80
- 'kn####eeting.net':80
- 'kn###chance.net':80
- 'be####eeting.net':80
- 'sm####nderstood.net':80
- 'pa###chance.net':80
- 'wo####nderstood.net':80
- 'wo###twenty.net':80
- 'sm###twenty.net':80
- 'pa###twenty.net':80
- 'fi###twenty.net':80
- 'fi####eeting.net':80
- 'fi###chance.net':80
- 'pa####eeting.net':80
- 'sm####eeting.net':80
- 'th####ttwenty.net':80
- 'wa###twenty.net':80
- 'wa####eeting.net':80
- 'wa###chance.net':80
- 'th####tmeeting.net':80
- 'sm###chance.net':80
- 'wo####eeting.net':80
- 'wo###chance.net':80
- 'th#####understood.net':80
- 'wa####nderstood.net':80
- 'me####meeting.net':80
- 'sm###value.net':80
- 'pa###almost.net':80
- 'wo###value.net':80
- 'wo####rderly.net':80
- 'sm####rderly.net':80
- 'pa####rderly.net':80
- 'fi####rderly.net':80
- 'fi###reason.net':80
- 'fi###almost.net':80
- 'pa###reason.net':80
- 'sm###reason.net':80
- 'th####torderly.net':80
- 'wa####rderly.net':80
- 'wa###reason.net':80
- 'wa###almost.net':80
- 'th####treason.net':80
- 'sm###almost.net':80
- 'wo###reason.net':80
- 'wo###almost.net':80
- 'th####tvalue.net':80
- 'wa###value.net':80
- 'ge####mantwenty.net':80
- 'al####ytwenty.net':80
- 'al####ymeeting.net':80
- 'al####ychance.net':80
- 'ge#####anmeeting.net':80
- 'me####chance.net':80
- 'fo####meeting.net':80
- 'fo####chance.net':80
- 'ge#####anunderstood.net':80
- 'al#####understood.net':80
- 'ge####manchance.net':80
- 'ex#####ncechance.net':80
- 'fr####eeting.net':80
- 'fr###chance.net':80
- 'pa###value.net':80
- 'fi###value.net':80
- 'fr####nderstood.net':80
- 'ex######ceunderstood.net':80
- 'ex#####ncetwenty.net':80
- 'ex#####ncemeeting.net':80
- 'fr###twenty.net':80
- http://su####meeting.net/index.php
- http://cr####eeting.net/index.php
- http://cr###chance.net/index.php
- http://kn####nderstood.net/index.php
- http://su####chance.net/index.php
- http://cr####nderstood.net/index.php
- http://th####tchance.net/index.php
- http://su#####nderstood.net/index.php
- http://su####twenty.net/index.php
- http://cr###twenty.net/index.php
- http://be####nderstood.net/index.php
- http://me#####nderstood.net/index.php
- http://be###chance.net/index.php
- http://fo#####nderstood.net/index.php
- http://fo####twenty.net/index.php
- http://me####twenty.net/index.php
- http://be###twenty.net/index.php
- http://kn###twenty.net/index.php
- http://kn####eeting.net/index.php
- http://kn###chance.net/index.php
- http://be####eeting.net/index.php
- http://sm####nderstood.net/index.php
- http://pa###chance.net/index.php
- http://wo####nderstood.net/index.php
- http://wo###twenty.net/index.php
- http://sm###twenty.net/index.php
- http://pa###twenty.net/index.php
- http://fi###twenty.net/index.php
- http://fi####eeting.net/index.php
- http://fi###chance.net/index.php
- http://pa####eeting.net/index.php
- http://sm####eeting.net/index.php
- http://th####ttwenty.net/index.php
- http://wa###twenty.net/index.php
- http://wa####eeting.net/index.php
- http://wa###chance.net/index.php
- http://th####tmeeting.net/index.php
- http://sm###chance.net/index.php
- http://wo####eeting.net/index.php
- http://wo###chance.net/index.php
- http://th#####understood.net/index.php
- http://wa####nderstood.net/index.php
- http://me####meeting.net/index.php
- http://sm###value.net/index.php
- http://pa###almost.net/index.php
- http://wo###value.net/index.php
- http://wo####rderly.net/index.php
- http://sm####rderly.net/index.php
- http://pa####rderly.net/index.php
- http://fi####rderly.net/index.php
- http://fi###reason.net/index.php
- http://fi###almost.net/index.php
- http://pa###reason.net/index.php
- http://sm###reason.net/index.php
- http://th####torderly.net/index.php
- http://wa####rderly.net/index.php
- http://wa###reason.net/index.php
- http://wa###almost.net/index.php
- http://th####treason.net/index.php
- http://sm###almost.net/index.php
- http://wo###reason.net/index.php
- http://wo###almost.net/index.php
- http://th####tvalue.net/index.php
- http://wa###value.net/index.php
- http://ge####mantwenty.net/index.php
- http://al####ytwenty.net/index.php
- http://al####ymeeting.net/index.php
- http://al####ychance.net/index.php
- http://ge#####anmeeting.net/index.php
- http://me####chance.net/index.php
- http://fo####meeting.net/index.php
- http://fo####chance.net/index.php
- http://ge#####anunderstood.net/index.php
- http://al#####understood.net/index.php
- http://ge####manchance.net/index.php
- http://ex#####ncechance.net/index.php
- http://fr####eeting.net/index.php
- http://fr###chance.net/index.php
- http://pa###value.net/index.php
- http://fi###value.net/index.php
- http://fr####nderstood.net/index.php
- http://ex######ceunderstood.net/index.php
- http://ex#####ncetwenty.net/index.php
- http://ex#####ncemeeting.net/index.php
- http://fr###twenty.net/index.php
- DNS ASK su####meeting.net
- DNS ASK cr####eeting.net
- DNS ASK cr###chance.net
- DNS ASK kn####nderstood.net
- DNS ASK su####chance.net
- DNS ASK cr####nderstood.net
- DNS ASK th####tchance.net
- DNS ASK su#####nderstood.net
- DNS ASK su####twenty.net
- DNS ASK cr###twenty.net
- DNS ASK be####nderstood.net
- DNS ASK me#####nderstood.net
- DNS ASK be###chance.net
- DNS ASK fo#####nderstood.net
- DNS ASK fo####twenty.net
- DNS ASK me####twenty.net
- DNS ASK be###twenty.net
- DNS ASK kn###twenty.net
- DNS ASK kn####eeting.net
- DNS ASK kn###chance.net
- DNS ASK be####eeting.net
- DNS ASK wa###chance.net
- DNS ASK pa###chance.net
- DNS ASK fi###chance.net
- DNS ASK sm####nderstood.net
- DNS ASK sm###twenty.net
- DNS ASK wo####nderstood.net
- DNS ASK fi###twenty.net
- DNS ASK pa####nderstood.net
- DNS ASK pa###twenty.net
- DNS ASK pa####eeting.net
- DNS ASK fi####eeting.net
- DNS ASK wo###twenty.net
- DNS ASK wa###twenty.net
- DNS ASK th#####understood.net
- DNS ASK th####ttwenty.net
- DNS ASK th####tmeeting.net
- DNS ASK wa####eeting.net
- DNS ASK wo####eeting.net
- DNS ASK sm####eeting.net
- DNS ASK sm###chance.net
- DNS ASK wa####nderstood.net
- DNS ASK wo###chance.net
- DNS ASK sm###value.net
- DNS ASK pa###almost.net
- DNS ASK wo###value.net
- DNS ASK wo####rderly.net
- DNS ASK sm####rderly.net
- DNS ASK pa####rderly.net
- DNS ASK fi####rderly.net
- DNS ASK fi###reason.net
- DNS ASK fi###almost.net
- DNS ASK pa###reason.net
- DNS ASK sm###reason.net
- DNS ASK th####torderly.net
- DNS ASK wa####rderly.net
- DNS ASK wa###reason.net
- DNS ASK wa###almost.net
- DNS ASK th####treason.net
- DNS ASK sm###almost.net
- DNS ASK wo###reason.net
- DNS ASK wo###almost.net
- DNS ASK th####tvalue.net
- DNS ASK wa###value.net
- DNS ASK pa###value.net
- DNS ASK al####ytwenty.net
- DNS ASK ge#####anunderstood.net
- DNS ASK ge####mantwenty.net
- DNS ASK ge#####anmeeting.net
- DNS ASK al####ymeeting.net
- DNS ASK fo####meeting.net
- DNS ASK me####meeting.net
- DNS ASK me####chance.net
- DNS ASK al#####understood.net
- DNS ASK fo####chance.net
- DNS ASK al####ychance.net
- DNS ASK fr####eeting.net
- DNS ASK ex#####ncemeeting.net
- DNS ASK ex#####ncechance.net
- DNS ASK fi###value.net
- DNS ASK fr###chance.net
- DNS ASK ex######ceunderstood.net
- DNS ASK ge####manchance.net
- DNS ASK fr####nderstood.net
- DNS ASK fr###twenty.net
- DNS ASK ex#####ncetwenty.net
- ClassName: 'Shell_TrayWnd' WindowName: ''