Technical Information
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Shell' = '<LS_APPDATA>\a72a1ac3\X'
- [<HKLM>\SYSTEM\ControlSet001\Services\.ipsec] 'ImagePath' = '\?'
- <LS_APPDATA>\a72a1ac3\X
- %WINDIR%\explorer.exe
- <SYSTEM32>\winlogon.exe
- %WINDIR%\Explorer.EXE
- <LS_APPDATA>\a72a1ac3\X
- <LS_APPDATA>\a72a1ac3\@
- '81.##6.87.224':21810
- '18#.#3.112.68':21810
- '18#.#12.142.224':21810
- '20#.#3.157.19':21810
- '11#.#98.205.241':21810
- '59.#5.62.15':21810
- '18#.#96.128.124':21810
- '14.##.167.223':21810
- '70.##.139.108':21810
- '89.##.166.183':21810
- '60.##3.109.104':21810
- '80.##5.89.105':21810
- '12#.#63.39.231':21810
- '18#.#55.52.54':21810
- '89.##7.193.200':21810
- '78.##.218.200':21810
- '79.##2.237.216':21810
- '12#.#3.80.19':21810
- '17#.#06.124.217':21810
- '20#.#63.89.38':21810
- '94.##0.194.70':21810
- '59.##.21.115':21810
- '77.##.215.162':21810
- '11#.#01.109.212':21810
- '68.##4.196.135':21810
- '11#.#18.189.250':21810
- '18#.#60.52.249':21810
- '89.##7.245.41':21810
- '11#.#61.0.139':21810
- '94.##3.51.219':21810
- '94.##.35.220':21810
- '11#.#05.15.132':21810
- '17#.#96.10.140':21810
- '17#.2.74.25':21810
- '11#.#95.112.94':21810
- '18#.#6.209.139':21810
- '11#.#68.219.146':21810
- '14.##.88.255':21810
- '11#.#04.60.143':21810
- '95.##.128.116':21810
- '17#.#7.245.20':21810
- '79.##9.106.93':21810
- '11#.#9.142.139':21810
- '11#.#00.106.27':21810
- '24.##8.34.52':21810
- '75.#6.59.94':21810
- '81.##3.188.241':21810
- '18#.#49.249.93':21810
- '95.##.160.104':21810
- '89.##.53.161':21810
- '76.#0.12.5':21810
- '95.##0.148.99':21810
- '11#.#02.171.4':21810
- '17#.#4.165.179':21810
- '20#.#18.0.65':21810
- '89.##.238.18':21810
- '77.##.114.168':21810
- '11#.#00.4.237':21810
- '95.##.177.184':21810
- '59.##1.133.254':21810
- '19#.#40.224.70':21810
- '79.##5.71.106':21810
- '14#.#61.141.211':21810
- '68.#00.6.23':21810
- '11#.#2.210.116':21810
- '18#.#78.171.110':21810
- '99.##5.238.21':21810
- '20#.#7.146.187':21810
- '11#.#06.184.91':21810
- '21#.#32.253.206':21810
- '21#.#64.99.102':21810
- '18#.#78.31.102':21810
- '18#.#77.231.31':21810
- '41.##.151.125':21810
- '85.##2.180.127':21810
- '11#.#11.6.160':21810
- '14#.#3.197.165':21810
- '17#.#17.133.182':21810
- '18#.#6.150.163':21810
- '20#.#23.36.119':21810
- '46.##2.49.228':21810
- '79.##2.88.231':21810
- '20#.#6.130.142':21810
- '12#.#23.46.228':21810
- '19#.95.66.3':21810
- '11#.#10.52.3':21810
- '10#.#24.205.69':21810
- '20#.#1.244.254':21810
- '19#.#9.78.81':21810
- '59.##.201.13':21810
- '31.#30.1.86':21810
- '18#.#87.143.16':21810
- '83.##6.225.8':21810
- '72.##6.109.70':21810
- '87.##0.184.226':21810
- '11#.#42.231.226':21810
- '71.##4.85.199':21810
- '11#.#65.172.103':21810
- '89.##.184.98':21810
- '12#.#7.115.100':21810
- '85.##.157.112':21810
- '89.##4.93.53':21810
- '46.##4.101.20':21810
- '20#.#.155.57':21810
- '11#.#2.9.222':21810
- '18#.#4.144.211':21810
- '19#.#13.97.238':21810
- '27.#.10.227':21810
- '11#.#03.236.93':21810
- '11#.#42.156.97':21810
- '20#.#41.72.3':21810
- '17#.#54.243.203':21810
- '93.##8.95.38':21810
- '20#.#2.225.5':21810
- '12#.#58.65.3':21810
- '49.##3.217.147':21810
- '24.##9.144.133':21810
- '85.##.22.153':21810
- '89.##.136.156':21810
- '11#.#17.150.139':21810
- '79.##4.101.167':21810
- '59.##.108.123':21810
- '24.##9.253.202':21810
- '79.##4.59.197':21810
- '87.##.127.152':21810
- '18#.#23.231.41':21810
- '12#.#0.183.162':21810
- '89.##.149.127':21810
- '76.##.72.252':21810
- '85.##.199.90':21810
- '20#.#5.222.70':21810
- '77.##.19.112':21810
- '11#.#54.9.217':21810
- '91.##0.194.223':21810
- '98.##7.172.157':21810
- '11#.#9.49.216':21810
- '21#.#02.34.246':21810
- '85.##.196.222':21810
- '17#.#21.109.66':21810
- '21#.#9.37.37':21810
- '11#.#9.166.227':21810
- '11#.#9.49.174':21810
- '31.##.202.74':21810
- '11#.#9.13.96':21810
- '24.##6.178.138':21810
- '18#.#09.100.124':21810
- '92.##4.206.91':21810
- '18#.#58.204.209':21810
- '20#.#64.152.69':21810
- '46.##0.169.19':21810
- '91.##7.147.186':21810
- '18#.#23.36.49':21810
- '95.#8.43.90':21810
- '11#.#01.85.61':21810
- '92.##7.120.32':21810
- '92.##2.173.238':21810
- '20#.#79.19.233':21810
- '11#.#12.90.53':21810
- '18#.#14.209.120':21810
- '98.##8.123.161':21810
- '20#.#11.97.162':21810
- '11#.#00.78.133':21810
- '19#.#13.133.238':21810
- '12#.#45.120.102':21810
- '94.##9.101.105':21810
- '12#.#84.254.165':21810
- '17#.#7.53.83':21810
- '17#.79.6.67':21810
- '11#.#54.57.41':21810
- '71.#2.9.194':21810
- '24.##2.189.222':21810
- '19#.#05.154.210':80
- '27.#.0.148':21810
- '12#.#37.53.35':21810
- '84.##6.221.246':21810
- '20#.#79.13.207':21810
- '11#.#31.17.48':21810
- '70.##.44.163':21810
- '95.##.183.68':21810
- '11#.#04.173.93':21810
- '18#.#5.230.151':21810
- '22#.#20.231.158':21810
- '24.##.117.139':21810
- '11#.#42.152.52':21810
- '11#.#9.3.196':21810
- '78.##6.15.96':21810
- '27.#.129.190':21810
- '77.##.94.200':21810
- '92.##.210.202':21810
- '11#.#93.110.81':21810
- '18#.#60.39.178':21810
- '18#.#3.95.66':21810
- '10.##9.6.175':21810
- '79.##8.147.149':21810
- '95.##.248.226':21810
- '20#.#49.114.214':21810
- '94.##7.47.150':21810
- '11#.#00.129.147':21810
- '20#.#09.163.115':21810
- '12#.#20.48.217':21810
- '24.#42.9.78':21810
- '20#.#3.56.207':21810
- '86.##1.73.232':21810
- '20#.#7.216.109':21810
- '84.##2.16.17':21810
- '10.##0.113.35':21810
- '18#.#15.246.188':21810
- '72.##9.11.30':21810
- '12#.#45.168.72':21810
- '19#.#5.221.245':21810
- '80.##.252.250':21810
- '75.##5.67.69':21810
- '11#.#00.169.132':21810
- '77.##1.184.245':21810
- '19#.#05.135.219':21810
- '18#.#15.30.64':21810
- '12#.#19.155.89':21810
- '72.##2.44.143':21810
- '18#.#3.142.40':21810
- '12#.#36.252.28':21810
- '11#.#05.66.12':21810
- '21#.#12.237.12':21810
- '11#.#42.44.223':21810
- '68.##4.100.142':21810
- '89.##1.156.118':21810
- '17#.#76.23.98':21810
- '14.##.250.66':21810
- '20#.#7.113.80':21810
- '67.#67.30.4':21810
- '17#.#87.10.110':21810
- '11#.30.76.6':21810
- '94.##6.103.4':21810
- '18#.#68.87.104':21810
- '78.##.175.196':21810
- '83.##.34.190':21810
- '59.#5.54.69':21810
- '17#.#06.207.138':21810
- '89.##4.93.21':21810
- '11#.#41.237.159':21810
- '11#.#34.129.189':21810
- '83.##5.17.74':21810
- '27.##7.81.214':21810
- '89.##6.51.157':21810
- '24.##6.215.36':21810
- '46.##9.219.162':21810
- '12#.#1.193.180':21810
- '27.##6.24.204':21810
- '17#.#23.21.162':21810
- '67.##1.246.89':21810
- '18#.#9.46.117':21810
- '24.##.227.122':21810
- '1.##.164.202':21810
- '98.##.24.111':21810
- '12#.#9.132.164':21810
- '11#.#1.224.143':21810
- '17#.#39.170.174':21810
- '92.#7.24.44':21810
- 19#.#05.154.210/bad.php?w=############################################
- 19#.#05.154.210/stat2.php?w=#########################################
- 19#.#05.154.210/stat2.php?w=##########################################