Technical Information
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Shell' = '<LS_APPDATA>\f5a698ed\X'
- [<HKLM>\SYSTEM\ControlSet001\Services\.ipsec] 'ImagePath' = '\?'
- <LS_APPDATA>\f5a698ed\X
- %WINDIR%\Explorer.EXE
- <LS_APPDATA>\f5a698ed\@
- <LS_APPDATA>\f5a698ed\X
- %WINDIR%\$NtUninstallKB37556$\4121336045\L\alehhooo
- %WINDIR%\$NtUninstallKB37556$\4121336045\@
- '17#.#91.208.169':21810
- '11#.#40.19.194':21810
- '24.##4.236.149':21810
- '20#.#55.183.87':21810
- '18#.#4.42.86':21810
- '46.##.40.115':21810
- '19#.#51.152.87':21810
- '94.##.250.38':21810
- '58.##.189.63':21810
- '79.##7.171.213':21810
- '77.##.220.154':21810
- '93.##7.174.177':21810
- '20#.#.45.170':21810
- '12#.#6.189.58':21810
- '11#.#5.247.166':21810
- '96.##.149.253':21810
- '79.##6.20.63':21810
- '49.#.144.177':21810
- '11#.#00.135.112':21810
- '89.##2.18.82':21810
- '17#.#0.16.45':21810
- '67.#69.4.12':21810
- '49.##1.209.231':21810
- '17#.#68.22.160':21810
- '79.##7.152.199':21810
- '78.#.116.140':21810
- '18#.#60.0.222':21810
- '20#.#4.187.230':21810
- '78.##6.231.104':21810
- '12#.#4.207.217':21810
- '20#.#73.224.21':21810
- '94.##1.71.251':21810
- '66.##.42.133':21810
- '99.##.18.250':21810
- '11#.#30.195.210':21810
- '24.##2.201.250':21810
- '19#.53.9.15':21810
- '18#.#3.226.99':21810
- '11#.#2.51.56':21810
- '17#.#7.224.190':21810
- '18#.#37.182.139':21810
- '62.#3.68.93':21810
- '19#.#6.152.7':21810
- '11#.#25.231.244':21810
- '94.##8.176.201':21810
- '18#.#22.133.241':21810
- '14#.#58.77.177':21810
- '94.##3.4.130':21810
- '20#.#14.44.6':21810
- '46.##.204.53':21810
- '68.#5.9.233':21810
- '24.##7.93.65':21810
- '19#.#47.29.184':21810
- '11#.#03.40.199':21810
- '46.##4.37.25':21810
- '78.##.64.124':21810
- '84.##4.232.229':21810
- '70.#24.7.90':21810
- '19#.#40.152.248':21810
- '20#.#7.51.32':21810
- '19#.#38.190.92':21810
- '10#.#09.62.240':21810
- '96.#7.82.56':21810
- '10#.0.50.76':21810
- '82.##9.57.194':21810
- '49.##1.140.91':21810
- '19#.#7.46.242':21810
- '19#.#05.154.210':80
- '70.##4.27.241':21810
- '12#.#38.226.130':21810
- '39.##3.43.112':21810
- '11#.#41.223.101':21810
- '78.##3.99.231':21810
- '18#.#46.105.102':21810
- '19#.#42.245.248':21810
- '78.##.186.169':21810
- '11#.#5.58.121':21810
- '64.##9.29.18':21810
- '20#.#6.177.194':21810
- '95.#6.29.69':21810
- '46.##8.180.222':21810
- '11#.#02.157.236':21810
- '78.##.131.193':21810
- '11#.#18.59.230':21810
- '87.##5.157.224':21810
- '12#.#79.225.161':21810
- '12#.#25.242.78':21810
- '46.#58.29.6':21810
- '87.##1.90.85':21810
- '74.##.152.39':21810
- '17#.#17.88.221':21810
- '95.#8.28.98':21810
- '75.##9.190.218':21810
- '59.##2.93.193':21810
- '75.##.48.166':21810
- '14.##.135.129':21810
- '11#.#13.214.27':21810
- '11#.#8.113.195':21810
- '69.##5.201.91':21810
- '17#.#40.75.213':21810
- '81.##.167.125':21810
- '19#.#19.213.241':21810
- 19#.#05.154.210/bad.php?w=###################################################
- 19#.#05.154.210/stat2.php?w=#################################################
- 19#.#05.154.210/stat2.php?w=################################################