Technical Information
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000002] 'PackedCatalogItem' = '{6d,73,77,73,6f,63,6b,2e,64,6c,6c,00,00,00,00,00,00,00,00,00,00,...
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000003] 'PackedCatalogItem' = '{6d,73,77,73,6f,63,6b,2e,64,6c,6c,00,00,00,00,00,00,00,00,00,00,...
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000004] 'PackedCatalogItem' = '{6d,73,77,73,6f,63,6b,2e,64,6c,6c,00,00,00,00,00,00,00,00,00,00,...
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000001] 'LibraryPath' = 'mswsock.dll'
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000003] 'LibraryPath' = 'mswsock.dll'
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001] 'PackedCatalogItem' = '{6d,73,77,73,6f,63,6b,2e,64,6c,6c,00,00,00,00,00,00,00,00,00,00,...
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000005] 'PackedCatalogItem' = '{6d,73,77,73,6f,63,6b,2e,64,6c,6c,00,00,00,00,00,00,00,00,00,00,...
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000009] 'PackedCatalogItem' = '{6d,73,77,73,6f,63,6b,2e,64,6c,6c,00,00,00,00,00,00,00,00,00,00,...
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000010] 'PackedCatalogItem' = '{6d,73,77,73,6f,63,6b,2e,64,6c,6c,00,00,00,00,00,00,00,00,00,00,...
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000011] 'PackedCatalogItem' = '{6d,73,77,73,6f,63,6b,2e,64,6c,6c,00,00,00,00,00,00,00,00,00,00,...
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000006] 'PackedCatalogItem' = '{6d,73,77,73,6f,63,6b,2e,64,6c,6c,00,00,00,00,00,00,00,00,00,00,...
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000007] 'PackedCatalogItem' = '{6d,73,77,73,6f,63,6b,2e,64,6c,6c,00,00,00,00,00,00,00,00,00,00,...
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000008] 'PackedCatalogItem' = '{6d,73,77,73,6f,63,6b,2e,64,6c,6c,00,00,00,00,00,00,00,00,00,00,...
- [<HKLM>\SYSTEM\ControlSet001\Services\.afd] 'ImagePath' = '\?'
- Windows Security Center
- '<SYSTEM32>\cmd.exe'
- <SYSTEM32>\cmd.exe
- <SYSTEM32>\winlogon.exe
- %WINDIR%\Explorer.EXE
- %WINDIR%\$NtUninstallKB27979$\4121336045\@
- %WINDIR%\$NtUninstallKB27979$\4121336045\L\alehhooo
- %WINDIR%\$NtUninstallKB27979$\4121336045\Desktop.ini
- '21#.#08.252.185':80
- 'pr####.fling.com':80
- http://le#####eecounters.com/5699002-2F6F334BF9ACF1B2401D3874A5B0C048/counter.img?th################################ via 21#.#08.252.185
- http://le#####eecounters.com/5699002-2F6F334BF9ACF1B2401D3874A5B0C048/counter.img?th############################### via 21#.#08.252.185
- http://pr####.fling.com/geo/txt/city.php
- DNS ASK �c#��p
- DNS ASK �c#�
- DNS ASK �c#d;P
- DNS ASK �c#�(#
- DNS ASK �c#j@�
- DNS ASK �c#&qY
- DNS ASK �c#3�
- DNS ASK �c#�K
- DNS ASK pr####.fling.com
- DNS ASK �c#�S�
- DNS ASK �c#A�
- DNS ASK �c#��y
- '95.##.217.227':16471
- '96.##.220.227':16471
- '2.###.160.228':16471
- '74.##.58.225':16471
- '96.##.154.225':16471
- '68.##4.37.227':16471
- '2.###.168.229':16471
- '24.##6.7.230':16471
- '68.##5.53.230':16471
- '76.##.164.228':16471
- '75.##8.37.229':16471
- '17#.#7.54.229':16471
- '78.##0.165.215':16471
- '24.##6.135.218':16471
- '75.##.173.218':16471
- '12#.#5.71.213':16471
- '19#.#58.43.215':16471
- '93.##3.136.215':16471
- '85.##5.184.221':16471
- '69.##8.51.222':16471
- '67.##6.34.223':16471
- '10#.#5.1.219':16471
- '24.##2.151.219':16471
- '67.##6.115.220':16471
- '69.#.55.239':16471
- '71.##8.235.239':16471
- '80.##8.27.241':16471
- '19#.#7.115.236':16471
- '92.##9.127.236':16471
- '61.##5.253.237':16471
- '97.##1.80.246':16471
- '98.##.252.248':16471
- '75.##.98.253':16471
- '72.##8.203.242':16471
- '24.##4.124.243':16471
- '24.#.121.244':16471
- '67.##1.52.232':16471
- '68.#.118.232':16471
- '19#.#28.131.232':16471
- '17#.#3.68.230':16471
- '67.##5.98.230':16471
- '10#.#5.41.232':16471
- '17#.#.99.234':16471
- '24.##8.104.234':16471
- '98.##.199.235':16471
- '17#.#8.18.233':16471
- '12#.#36.192.233':16471
- '74.##7.11.234':16471