Technical Information
- [<HKLM>\System\CurrentControlSet\Services\UbMe_394] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\UbMe_394] 'ImagePath' = '"<Full path to file>" -servis -baslat'
- %PROGRAMDATA%\ubaglan\mola2
- %PROGRAMDATA%\ubaglan\mola3
- %PROGRAMDATA%\ubaglan\mesettings3.bin
- http://co#####.biliciyatirim.com/default.aspx?va########
- DNS ASK co#####.biliciyatirim.com
- ClassName: 'UbMe3Main' WindowName: ''