Technical Information
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Shell' = '<LS_APPDATA>\a72a1ac3\X'
- [<HKLM>\SYSTEM\ControlSet001\Services\.ipsec] 'ImagePath' = '\?'
- <LS_APPDATA>\a72a1ac3\X
- %WINDIR%\Explorer.EXE
- <LS_APPDATA>\a72a1ac3\@
- <LS_APPDATA>\a72a1ac3\X
- %WINDIR%\$NtUninstallKB16918$\2804554435\L\acbrwqkz
- %WINDIR%\$NtUninstallKB16918$\2804554435\@
- '22#.#29.114.4':21810
- '18#.#2.209.117':21810
- '24.##.188.246':21810
- '67.##7.186.246':21810
- '11#.#43.25.216':21810
- '21#.#90.121.126':21810
- '27.##7.136.24':21810
- '12#.#38.20.23':21810
- '71.##.16.102':21810
- '20#.#27.248.158':21810
- '78.##.186.169':21810
- '22#.#31.161.101':21810
- '89.#6.23.56':21810
- '81.##1.34.111':21810
- '83.##.66.105':21810
- '84.#0.6.5':21810
- '11#.#54.158.224':21810
- '18#.#6.44.176':21810
- '20#.#11.202.143':21810
- '89.##5.89.150':21810
- '86.##0.75.16':21810
- '95.##.107.134':21810
- '19#.#06.242.149':21810
- '17#.#8.4.235':21810
- '79.##1.126.16':21810
- '75.##2.62.151':21810
- '18#.#3.177.244':21810
- '21#.#0.32.216':21810
- '17#.#4.40.137':21810
- '18#.#78.170.143':21810
- '46.##.101.237':21810
- '20#.#3.183.61':21810
- '49.##2.48.245':21810
- '72.##3.66.200':21810
- '18#.#30.30.25':21810
- '31.##.110.10':21810
- '94.##.204.183':21810
- '83.##.149.109':21810
- '18#.#5.200.8':21810
- '58.##.222.163':21810
- '88.##8.32.52':21810
- '79.##2.149.171':21810
- '18#.37.11.0':21810
- '18#.#.145.167':21810
- '18#.#1.45.203':21810
- '20#.#79.6.150':21810
- '18#.#1.147.62':21810
- '79.##2.80.79':21810
- '61.##.78.155':21810
- '20#.92.6.98':21810
- '20#.#16.172.3':21810
- '78.##.217.191':21810
- '49.##.29.255':21810
- '93.##.18.171':21810
- '12#.#08.240.37':21810
- '18#.#06.101.22':21810
- '89.#76.2.55':21810
- '24.##0.100.173':21810
- '85.##.48.109':21810
- '98.##1.148.84':21810
- '17#.#8.192.156':21810
- '92.##4.18.90':21810
- '41.#6.44.6':21810
- '18#.#37.120.42':21810
- '94.##.147.60':21810
- '94.##.103.67':21810
- '18#.#9.188.215':21810
- '11#.#00.105.74':21810
- '98.##4.210.219':21810
- '95.##.223.95':21810
- '99.##.247.152':21810
- '19#.#6.123.61':21810
- '79.##9.191.111':21810
- '19#.#5.50.120':21810
- '19#.#02.231.48':21810
- '12#.#25.250.82':21810
- '95.##0.40.76':21810
- '68.##.155.58':21810
- '86.##1.111.125':21810
- '78.##.213.245':21810
- '24.##4.105.161':21810
- '18#.#35.224.105':21810
- '98.##9.117.199':21810
- '86.##6.244.26':21810
- '18#.#03.244.183':21810
- '11#.#04.121.248':21810
- '11#.#03.93.88':21810
- '12#.#1.211.173':21810
- '89.##5.13.153':21810
- '98.##7.228.56':21810
- '75.##.106.18':21810
- '90.##3.139.68':21810
- '27.##6.71.201':21810
- '17#.#22.20.56':21810
- '94.##5.231.133':21810
- '94.##.235.129':21810
- '41.##1.102.198':21810
- '14#.#36.15.166':21810
- '85.##.231.199':21810
- '19#.#4.18.155':21810
- '89.##1.223.171':21810
- '11#.#68.168.27':21810
- '89.##5.105.99':21810
- '11#.#2.128.247':21810
- '81.##3.188.241':21810
- '18#.1.8.244':21810
- '94.##3.51.219':21810
- '18#.#15.115.75':21810
- '71.#5.94.6':21810
- '92.##.185.106':21810
- '18#.#9.251.245':21810
- '13#.#0.19.121':21810
- '62.##.44.190':21810
- '17#.#3.111.40':21810
- '85.#4.0.40':21810
- '11#.#54.228.96':21810
- '89.##.122.172':21810
- '72.##1.50.184':21810
- '79.##9.182.102':21810
- '94.##.52.192':21810
- '18#.#6.228.172':21810
- '17#.#36.83.48':21810
- '18#.3.31.4':21810
- '11#.#95.83.198':21810
- '84.##2.157.190':21810
- '14.#1.27.67':21810
- '46.##7.242.45':21810
- '27.#4.18.29':21810
- '18#.#0.20.145':21810
- '11#.#86.52.70':21810
- '91.#4.49.14':21810
- '68.##.198.81':21810
- '11#.#5.79.71':21810
- '14.#0.5.150':21810
- '83.##7.18.78':21810
- '75.##.24.208':21810
- '18#.#4.23.127':21810
- '41.##.238.174':21810
- '11#.#84.229.50':21810
- '69.#2.7.134':21810
- '77.##4.233.220':21810
- '17#.#5.155.26':21810
- '19#.#06.42.34':21810
- '18#.#6.37.79':21810
- '39.##3.197.130':21810
- '68.##4.4.120':21810
- '19#.#5.184.157':21810
- '11#.#93.139.193':21810
- '46.##5.65.193':21810
- '77.##9.25.116':21810
- '89.##.122.51':21810
- '12#.#2.46.191':21810
- '79.##7.113.71':21810
- '79.##2.154.231':21810
- '20#.#7.113.27':21810
- '21#.#5.10.125':21810
- '71.##2.96.61':21810
- '12#.#58.64.123':21810
- '17#.#26.20.15':21810
- '18#.#4.83.152':21810
- '19#.#3.206.212':21810
- '72.##5.238.254':21810
- '99.##7.32.61':21810
- '95.##5.204.228':21810
- '77.##.156.149':21810
- '80.##1.109.216':21810
- '89.#2.51.78':21810
- '11#.#42.160.128':21810
- '93.##3.188.168':21810
- '41.##2.150.218':21810
- '20#.#89.39.129':21810
- '19#.#05.154.210':80
- '11#.#71.82.28':21810
- '10#.#7.85.13':21810
- '91.##.209.94':21810
- '11#.#06.98.196':21810
- '11#.#54.62.250':21810
- '81.##0.147.182':21810
- '78.##.140.170':21810
- '68.##.134.221':21810
- '85.##.239.147':21810
- '84.#0.99.16':21810
- '79.##9.221.167':21810
- '17#.#14.211.61':21810
- '18#.#37.131.88':21810
- '11#.#03.200.91':21810
- '10#.#97.83.71':21810
- '11#.#4.107.62':21810
- '87.##7.12.119':21810
- '46.##.47.235':21810
- '88.##.217.88':21810
- '11#.#8.9.136':21810
- '41.##4.229.48':21810
- '11#.#03.142.241':21810
- '75.##6.105.34':21810
- '11#.#04.174.242':21810
- '11#.#86.173.13':21810
- '91.##5.132.236':21810
- '46.##.103.236':21810
- '11#.#40.174.239':21810
- '17#.#74.137.238':21810
- '20#.#6.177.194':21810
- '17#.#6.28.28':21810
- '17#.#21.157.48':21810
- '19#.#61.190.59':21810
- '22#.#6.69.201':21810
- '78.##.33.118':21810
- '88.##8.56.82':21810
- '84.##0.253.112':21810
- '95.##1.105.77':21810
- '17#.#23.70.16':21810
- '86.##6.24.213':21810
- '86.##6.104.19':21810
- '81.##3.201.210':21810
- '31.#30.2.14':21810
- '86.##.113.140':21810
- '89.##.240.210':21810
- '17#.#7.141.213':21810
- '94.#0.1.77':21810
- '19#.#8.207.232':21810
- '18#.#54.128.184':21810
- '11#.#42.244.167':21810
- '20#.#1.142.187':21810
- '14.#6.3.214':21810
- '20#.#42.31.30':21810
- '19#.#05.135.93':21810
- '18#.#41.33.181':21810
- '11#.#4.129.124':21810
- '89.##.166.179':21810
- '11#.#9.83.182':21810
- '18#.#7.193.6':21810
- '17#.#24.105.5':21810
- '78.##3.96.106':21810
- '85.##.216.49':21810
- '18#.#4.47.84':21810
- '24.##9.144.133':21810
- '81.##8.145.25':21810
- '18#.#1.123.219':21810
- '84.##7.203.177':21810
- '17#.#9.57.112':21810
- '89.#6.86.2':21810
- '68.##4.152.53':21810
- '85.##6.137.54':21810
- '68.##.146.209':21810
- '89.##9.77.204':21810
- '11#.#02.133.86':21810
- '11#.#97.255.151':21810
- '18#.#2.217.98':21810
- '46.##7.175.89':21810
- '20#.#43.113.105':21810
- '10.##1.103.131':21810
- '19#.#7.231.121':21810
- '79.##1.243.121':21810
- '87.##1.70.20':21810
- '86.##.125.179':21810
- '18#.#15.160.131':21810
- '1.##.246.32':21810
- 19#.#05.154.210/bad.php?w=############################################
- 19#.#05.154.210/stat2.php?w=##########################################
- 19#.#05.154.210/stat2.php?w=#########################################