Technical Information
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Shell' = '<LS_APPDATA>\a72a1ac3\X'
- [<HKLM>\SYSTEM\ControlSet001\Services\.afd] 'ImagePath' = '\?'
- <LS_APPDATA>\a72a1ac3\X
- %WINDIR%\explorer.exe
- <SYSTEM32>\winlogon.exe
- %WINDIR%\Explorer.EXE
- <LS_APPDATA>\a72a1ac3\X
- <LS_APPDATA>\a72a1ac3\@
- '59.##.219.246':21810
- '18#.#59.32.137':21810
- '19#.#89.114.37':21810
- '12#.#40.100.113':21810
- '14.##.107.160':21810
- '58.#.219.10':21810
- '11#.#7.140.190':21810
- '76.##1.52.30':21810
- '19#.#05.135.219':21810
- '59.##.10.219':21810
- '68.##3.251.198':21810
- '18#.#6.213.48':21810
- '11#.#04.223.210':21810
- '89.##6.226.112':21810
- '18#.#14.35.200':21810
- '11#.#42.54.34':21810
- '12#.#36.135.166':21810
- '76.##.167.67':21810
- '1.##.244.110':21810
- '20#.#14.107.72':21810
- '49.#.19.146':21810
- '79.##7.214.222':21810
- '18#.#6.249.5':21810
- '76.##.198.251':21810
- '61.##.160.153':21810
- '89.##.160.38':21810
- '49.##0.31.10':21810
- '98.##8.12.245':21810
- '10#.#5.197.137':21810
- '11#.#54.63.113':21810
- '79.##3.183.227':21810
- '20#.#6.188.88':21810
- '42.##1.10.29':21810
- '85.##.196.222':21810
- '78.##0.210.126':21810
- '18#.#73.77.199':21810
- '82.##.130.255':21810
- '12#.#09.211.178':21810
- '21#.#0.129.85':21810
- '19#.#20.81.160':21810
- '95.#27.1.47':21810
- '79.##8.229.216':21810
- '22#.#38.97.159':21810
- '59.##.54.132':21810
- '17#.#9.179.56':21810
- '17#.52.1.13':21810
- '14.##.96.163':21810
- '15#.#3.16.125':21810
- '11#.#00.1.110':21810
- '21#.#1.29.67':21810
- '24.##7.214.238':21810
- '24.##7.18.60':21810
- '78.##.25.138':21810
- '86.##7.152.27':21810
- '46.##5.44.24':21810
- '14.#7.96.46':21810
- '70.##0.167.218':21810
- '92.#1.30.51':21810
- '49.##2.164.77':21810
- '81.#03.16.9':21810
- '11#.#54.0.184':21810
- '11#.#02.46.239':21810
- '67.##1.246.89':21810
- '18#.#6.113.183':21810
- '11#.#04.2.229':21810
- '62.##5.201.224':21810
- '18#.#60.38.133':21810
- '86.##6.63.26':21810
- '11#.#06.83.134':21810
- '49.##0.225.139':21810
- '11#.#8.37.69':21810
- '11#.#84.124.181':21810
- '89.##1.19.246':21810
- '18#.#23.250.116':21810
- '89.##.42.246':21810
- '12#.#38.15.147':21810
- '46.##.87.131':21810
- '18#.#37.149.28':21810
- '18#.#6.14.98':21810
- '74.##6.6.124':21810
- '20#.#4.157.113':21810
- '10#.#60.72.61':21810
- '17#.#55.57.33':21810
- '11#.#41.88.64':21810
- '11#.#5.181.168':21810
- '86.##3.129.194':21810
- '11#.#13.92.56':21810
- '31.#92.8.55':21810
- '89.#2.51.78':21810
- '86.#.95.220':21810
- '46.##4.249.230':21810
- '20#.#65.103.221':21810
- '41.##8.218.146':21810
- '10#.#27.113.88':21810
- '41.##.83.244':21810
- '59.#5.51.68':21810
- '22#.#6.69.208':21810
- '88.##2.13.226':21810
- '95.##.112.143':21810
- '14#.#36.68.223':21810
- '87.##0.8.171':21810
- '85.##7.251.16':21810
- '11#.#9.252.16':21810
- '31.##0.182.206':21810
- '92.##.21.174':21810
- '78.##.205.199':21810
- '46.##8.195.41':21810
- '12#.#7.115.100':21810
- '92.##2.153.218':21810
- '19#.#8.139.149':21810
- '98.##8.128.34':21810
- '11#.#00.214.149':21810
- '21#.#29.147.54':21810
- '19#.#9.27.38':21810
- '58.##.110.83':21810
- '18#.#10.213.254':21810
- '11#.#3.151.58':21810
- '11#.#54.33.92':21810
- '14.##0.127.4':21810
- '84.##2.45.168':21810
- '79.##6.126.78':21810
- '78.##.100.13':21810
- '60.##4.111.51':21810
- '89.#4.197.2':21810
- '22#.#05.154.194':21810
- '95.#4.27.3':21810
- '71.#9.5.109':21810
- '85.##4.46.100':21810
- '21#.#0.32.216':21810
- '18#.#41.183.241':21810
- '58.#.117.49':21810
- '49.##9.140.200':21810
- '1.##.160.191':21810
- '11#.#8.44.208':21810
- '79.##3.36.175':21810
- '11#.#9.135.173':21810
- '21#.#32.58.190':21810
- '19#.#7.89.133':21810
- '18#.#55.78.128':21810
- '17#.#57.73.17':21810
- '11#.#97.53.179':21810
- '13#.#17.137.199':21810
- '18#.#00.242.239':21810
- '20#.#1.244.254':21810
- '49.##9.185.24':21810
- '79.##4.55.241':21810
- '12#.#37.161.250':21810
- '12#.#37.173.174':21810
- '24.##2.162.52':21810
- '89.##.228.238':21810
- '14.##.205.223':21810
- '20#.#8.183.163':21810
- '20#.#96.140.101':21810
- '92.##.157.125':21810
- '2.###.40.179':21810
- '11#.#04.123.72':21810
- '11#.#98.12.115':21810
- '89.##3.188.132':21810
- '24.##3.235.126':21810
- '11#.#53.78.112':21810
- '11#.#84.86.34':21810
- '27.#.80.133':21810
- '18#.#55.52.54':21810
- '11#.#97.219.105':21810
- '86.##7.253.154':21810
- '11#.#33.198.196':21810
- '20#.#79.23.55':21810
- '11#.#94.231.7':21810
- '11#.#65.172.103':21810
- '49.##.133.175':21810
- '31.##.104.91':21810
- '19#.#05.154.210':80
- '18#.#6.164.240':21810
- '31.##1.121.5':21810
- '17#.#69.8.178':21810
- '86.##2.22.212':21810
- '46.##6.163.89':21810
- '19#.#81.178.105':21810
- '18#.#60.29.145':21810
- '80.#5.25.69':21810
- '14.##.239.191':21810
- '95.##.249.175':21810
- '11#.#06.1.17':21810
- '46.##6.175.23':21810
- '18#.#4.46.74':21810
- '94.##8.197.198':21810
- '67.#.134.244':21810
- '27.##4.29.236':21810
- '75.##9.250.194':21810
- '92.##4.206.91':21810
- '14.##8.236.251':21810
- '46.##1.210.29':21810
- '92.##5.199.125':21810
- '89.##.166.183':21810
- '11#.#98.12.247':21810
- '12#.#01.37.63':21810
- '18#.#48.45.90':21810
- '91.##.104.111':21810
- '11#.#93.230.253':21810
- '46.##5.37.203':21810
- '79.##.213.249':21810
- '95.#04.2.8':21810
- '18#.#56.160.132':21810
- '79.##6.33.129':21810
- '76.##4.140.161':21810
- '83.#.224.24':21810
- '12#.#35.47.76':21810
- '19#.#63.37.158':21810
- '86.##7.19.156':21810
- '19#.#13.134.74':21810
- '77.##.220.253':21810
- '18#.#58.198.236':21810
- '95.#8.40.45':21810
- '91.##9.191.202':21810
- '67.##3.146.36':21810
- '12#.#36.99.92':21810
- '95.##.107.251':21810
- '22#.#30.66.254':21810
- '78.##.225.73':21810
- '39.##9.192.44':21810
- '11#.#2.75.93':21810
- '72.##6.109.70':21810
- '11#.#2.104.137':21810
- '21#.#32.98.139':21810
- '12#.#36.218.120':21810
- '10.##4.106.207':21810
- '13#.#12.187.41':21810
- '93.##3.185.67':21810
- '18#.#51.27.148':21810
- '46.##0.75.135':21810
- '14.##.216.81':21810
- '11#.#93.173.187':21810
- '58.##6.124.148':21810
- '11#.#41.252.3':21810
- '14#.#6.49.20':21810
- '18#.#87.130.9':21810
- '85.##0.88.138':21810
- '11#.#24.220.67':21810
- '24.##9.177.192':21810
- '22#.#24.156.135':21810
- '18#.#12.142.224':21810
- '18#.#18.39.120':21810
- '49.##5.121.119':21810
- '18#.#6.125.123':21810
- '85.##6.205.138':21810
- '79.##1.126.127':21810
- '24.##.134.87':21810
- '95.##.124.221':21810
- '86.##6.123.222':21810
- '10.##3.161.239':21810
- '46.##.61.245':21810
- '14.##.220.56':21810
- '24.##6.215.36':21810
- '20#.#00.195.35':21810
- '20#.#.156.245':21810
- '86.##7.240.220':21810
- '88.##8.32.52':21810
- 19#.#05.154.210/bad.php?w=#############################################
- 19#.#05.154.210/stat2.php?w=##########################################
- 19#.#05.154.210/stat2.php?w=###########################################