Technical Information
- <SYSTEM32>\services.exe
- %WINDIR%\Explorer.EXE
- C:\RECYCLER\S-1-5-18\$2ebe1c2e2a38cb36436c4d1cb8c2630c\n
- C:\RECYCLER\S-1-5-21-2052111302-484763869-725345543-1003\$I58AFF310
- C:\RECYCLER\S-1-5-18\$2ebe1c2e2a38cb36436c4d1cb8c2630c\@
- C:\RECYCLER\S-1-5-21-2052111302-484763869-725345543-1003\$2ebe1c2e2a38cb36436c4d1cb8c2630c\@
- C:\RECYCLER\S-1-5-21-2052111302-484763869-725345543-1003\$2ebe1c2e2a38cb36436c4d1cb8c2630c\n
- from <Full path to virus> to C:\RECYCLER\S-1-5-21-2052111302-484763869-725345543-1003\$R58AFF310
- '20#.#8.32.176':80
- 'j.###mind.com':80
- 20#.#8.32.176/count.php?pa################################
- j.###mind.com/app/geoip.js
- DNS ASK pz#� �
- DNS ASK pz#�~>
- DNS ASK pz#�wh
- DNS ASK pz#����
- DNS ASK pz# \�V
- DNS ASK pz#��
- DNS ASK j.###mind.com
- DNS ASK pz#�)�
- DNS ASK pz#�#
- DNS ASK pz#�\KK
- '85.##.144.121':16464
- '18#.#61.5.122':16464
- '69.##4.69.123':16464
- '17#.#37.249.70':16464
- '84.##6.165.116':16464
- '12#.#3.155.72':16464
- '11#.#20.83.71':16464
- '17#.#77.226.69':16464
- '46.##9.82.126':16464
- '58.##6.126.128':16464
- '14.##.10.126':16464
- '24.##.222.123':16464
- '94.##.231.123':16464
- '15#.#5.219.124':16464
- '50.##.135.94':16464
- '17#.#77.254.102':16464
- '11#.#5.252.105':16464
- '99.#84.9.93':16464
- '50.##.122.86':16464
- '89.##5.189.90':16464
- '11#.#46.107.92':16464
- '18#.#26.159.111':16464
- '18#.#6.243.112':16464
- '12#.#00.85.114':16464
- '21#.#8.216.110':16464
- '95.##.49.106':16464
- '18#.#96.97.109':16464
- '69.##3.116.110':16464
- '24.##.242.149':16464
- '85.##.199.151':16464
- '24.##.201.152':16464
- '11#.#15.146.149':16464
- '14.##.22.140':16464
- '21#.#6.150.142':16464
- '21#.#03.215.145':16464
- '67.##4.115.157':16464
- '18#.#.249.157':16464
- '20#.#42.228.60':16464
- '50.##8.69.156':16464
- '67.##8.78.153':16464
- '76.##.198.154':16464
- '17#.#74.31.155':16464
- '50.##.138.129':16464
- '21#.#17.147.131':16464
- '69.#.109.132':16464
- '1.###.136.67':16464
- '21#.#25.15.69':16464
- '5.##.203.68':16464
- '66.##4.121.68':16464
- '76.##0.136.133':16464
- '76.##.181.133':16464
- '17#.#17.209.138':16464
- '86.##.177.61':16464
- '74.##3.138.132':16464
- '16#.#00.39.66':16464
- '98.#47.3.65':16464
- '89.##.186.176':16464
- '74.##.85.176':16464
- '65.##5.50.176':16464
- '18#.#07.77.178':16464
- '70.##.250.180':16464
- '17#.#.186.180':16464
- '89.##.70.180':16464
- '98.##5.157.171':16464
- '12#.#21.189.170':16464
- '21#.#4.251.169':16464
- '68.##.239.171':16464
- '11#.#43.190.175':16464
- '75.##9.175.173':16464
- '11#.#14.249.172':16464
- '58.##.71.189':16464
- '75.##.47.188':16464
- '12#.#1.203.187':16464
- '80.##.101.189':16464
- '74.##.184.190':16464
- '11#.#41.92.190':16464
- '68.##0.129.189':16464
- '17#.#1.135.183':16464
- '11#.#43.29.183':16464
- '65.##4.20.182':16464
- '16#.#55.86.184':16464
- '61.##3.33.187':16464
- '65.##.27.185':16464
- '76.##.121.184':16464
- '46.#2.35.74':16464
- '17#.#3.12.75':16464
- '22#.#42.21.75':16464
- '76.##8.25.74':16464
- '98.#23.58.1':16464
- '68.##6.158.72':16464
- '68.##1.24.74':16464
- '17#.#.106.80':16464
- '11#.#9.145.81':16464
- '98.##1.47.84':16464
- '67.#.81.79':16464
- '18#.#15.21.75':16464
- '11#.#93.144.77':16464
- '92.##3.19.79':16464
- '68.#0.42.63':16464
- '75.##9.223.132':16464
- '11#.#95.195.132':16464
- '18#.#4.225.132':16464
- '13#.#06.56.169':16464
- '76.##.55.169':16464
- '18#.#1.149.158':16464
- '62.##6.69.126':16464
- '65.##4.110.121':16464
- '90.##.112.120':16464
- '74.##9.130.128':16464
- '20#.#5.113.129':16464
- '68.##.153.128':16464
- '65.#.141.128':16464
- '11#.#05.38.9':16464
- '98.##1.3.204':16464
- '21#.#93.4.204':16464
- '36.##.173.201':16464
- '84.##8.165.13':16464
- '24.##2.253.11':16464
- '75.#7.58.10':16464
- '79.#12.90.4':16464
- '24.##2.51.205':16464
- '10#.#2.181.3':16464
- '11#.26.61.5':16464
- '16#.#2.192.8':16464
- '11#.#93.105.7':16464
- '68.#6.124.5':16464
- '17#.#18.240.28':16464
- '71.##3.224.27':16464
- '64.##7.115.196':16464
- '11#.#4.184.29':16464
- '76.##7.229.34':16464
- '66.##8.252.31':16464
- '96.##.19.195':16464
- '37.##4.198.16':16464
- '18#.#27.114.16':16464
- '90.##9.74.198':16464
- '50.##0.131.18':16464
- '11#.#42.187.196':16464
- '1.###.161.26':16464
- '12#.8.80.26':16464
- '81.##6.243.247':16464
- '79.##3.102.248':16464
- '95.##5.222.254':16464
- '68.##.194.244':16464
- '11#.#05.110.239':16464
- '67.##.184.239':16464
- '11#.#33.164.243':16464
- '18#.#54.253.254':16464
- '19#.#54.253.254':16464
- '20#.#54.253.254':16464
- '16#.#54.253.254':16464
- '92.##4.253.254':16464
- '11#.#54.253.254':16464
- '13#.#54.253.254':16464
- '18#.#53.231.210':16464
- '67.##.223.211':16464
- '70.##2.65.214':16464
- '11#.#41.242.209':16464
- '10#.#.36.207':16464
- '98.##4.238.2':16464
- '24.#50.87.1':16464
- '71.##6.55.228':16464
- '21#.#09.250.231':16464
- '11#.#3.165.234':16464
- '11#.#53.239.226':16464
- '46.##.93.216':16464
- '16#.#2.1.220':16464
- '68.##.191.220':16464
- '10#.#3.220.175':16464
- '17#.#02.241.175':16464
- '11#.#00.38.53':16464
- '10#.#3.70.53':16464
- '12#.#01.178.53':16464
- '18#.#61.195.174':16464
- '24.##6.67.175':16464
- '18#.#15.7.178':16464
- '77.##5.69.178':16464
- '12#.#10.119.52':16464
- '92.##6.215.177':16464
- '11#.#4.215.52':16464
- '68.#.160.52':16464
- '99.#2.5.177':16464
- '11#.#41.80.166':16464
- '24.##2.98.166':16464
- '49.##9.122.59':16464
- '69.##1.56.166':16464
- '98.##9.194.159':16464
- '11#.#42.30.161':16464
- '18#.#.36.162':16464
- '10#.#83.39.55':16464
- '10#.#84.244.54':16464
- '12#.#16.109.54':16464
- '24.#.209.170':16464
- '71.##8.72.58':16464
- '19#.#98.238.56':16464
- '19#.#8.129.55':16464
- '99.#.122.43':16464
- '75.#5.53.41':16464
- '11#.#76.228.40':16464
- '75.##.128.44':16464
- '17#.#25.64.45':16464
- '21#.#73.36.187':16464
- '10#.#7.104.187':16464
- '68.##.29.191':16464
- '11#.#3.18.35':16464
- '20#.#8.81.194':16464
- '11#.#9.166.36':16464
- '75.##0.45.38':16464
- '18#.#1.29.190':16464
- '24.#38.5.38':16464
- '1.###.139.182':16464
- '11#.#25.207.48':16464
- '11#.#53.196.48':16464
- '61.##5.191.49':16464
- '19#.#1.90.50':16464
- '69.##0.253.49':16464
- '98.##8.240.49':16464
- '10#.#70.53.186':16464
- '24.##1.196.186':16464
- '67.##.231.186':16464
- '12#.#93.183.185':16464
- '19#.#1.88.48':16464
- '17#.#11.126.47':16464
- '96.#8.4.47':16464