Technical Information
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Shell' = '<LS_APPDATA>\a72a1ac3\X'
- [<HKLM>\SYSTEM\ControlSet001\Services\a72a1ac3] 'ImagePath' = '%WINDIR%\3273271975:1490412860.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\.serial] 'ImagePath' = '\?'
- <LS_APPDATA>\a72a1ac3\X
- %WINDIR%\explorer.exe
- <SYSTEM32>\winlogon.exe
- %WINDIR%\Explorer.EXE
- %WINDIR%\$NtUninstallKB16918$\2804554435\L\acbrwqkz
- %WINDIR%\$NtUninstallKB16918$\2804554435\@
- %WINDIR%\3273271975:1490412860.exe
- <LS_APPDATA>\a72a1ac3\@
- <LS_APPDATA>\a72a1ac3\X
- '19#.#04.91.138':21810
- '21#.#44.177.24':21810
- '81.##.75.235':21810
- '82.##0.222.133':21810
- '10#.#71.16.54':21810
- '21#.#04.94.96':21810
- '95.##.232.96':21810
- '75.##.96.122':21810
- '46.##1.204.106':21810
- '95.##.197.46':21810
- '61.##6.200.214':21810
- '17#.#0.241.215':21810
- '17#.#4.40.62':21810
- '20#.#56.61.161':21810
- '18#.#75.4.145':21810
- '95.##.208.87':21810
- '41.#07.6.46':21810
- '21#.#42.32.131':21810
- '21#.#2.142.59':21810
- '94.##.115.97':21810
- '19#.#8.242.169':21810
- '79.##7.230.102':21810
- '19#.#07.255.3':21810
- '78.##.75.122':21810
- '18#.#9.128.131':21810
- '41.##4.180.115':21810
- '41.##4.13.224':21810
- '10#.#87.250.30':21810
- '21#.#3.183.41':21810
- '17#.#4.106.175':21810
- '12#.#68.211.27':21810
- '19#.#98.193.174':21810
- '10#.#13.43.2':21810
- '86.#9.4.46':21810
- '18#.#60.34.49':21810
- '91.#0.73.22':21810
- '94.##3.16.82':21810
- '11#.#41.194.174':21810
- '94.##9.140.118':21810
- '79.##8.87.206':21810
- '78.##1.103.136':21810
- '18#.#.111.36':21810
- '11#.#41.135.237':21810
- '75.##0.27.47':21810
- '21#.#55.239.127':21810
- '11#.#0.112.73':21810
- '41.##6.81.114':21810
- '18#.#6.71.129':21810
- '94.##.41.213':21810
- '27.#.148.40':21810
- '71.##8.184.36':21810
- '85.##6.196.187':21810
- '46.##1.105.75':21810
- '82.##9.72.120':21810
- '18#.#23.38.147':21810
- '21#.#64.170.243':21810
- '19#.#45.166.141':21810
- '18#.#7.8.231':21810
- '95.##.107.21':21810
- '24.##2.177.185':21810
- '10#.#20.52.24':21810
- '41.##7.2.219':21810
- '10#.#69.250.122':21810
- '20#.#62.220.102':21810
- '94.##1.83.141':21810
- '12#.#40.183.56':21810
- '21#.#.221.205':21810
- '10#.#95.216.198':21810
- '18#.#86.19.4':21810
- '12#.#38.123.171':21810
- '18#.#58.169.227':21810
- '11#.#6.254.86':21810
- '95.##3.253.18':21810
- '95.##.219.145':21810
- '10#.#25.37.183':21810
- '90.##1.240.176':21810
- '19#.#2.102.125':21810
- '18#.#32.23.8':21810
- '95.##.123.67':21810
- '41.##2.134.33':21810
- '18#.#85.19.216':21810
- '21#.#09.243.216':21810
- '31.##1.64.130':21810
- '88.#6.2.206':21810
- '18#.#60.46.89':21810
- '21#.#02.149.193':21810
- '17#.#04.198.126':21810
- '21#.#3.232.198':21810
- '14.##.203.176':21810
- '11#.#24.92.217':21810
- '11#.#66.212.250':21810
- '11#.#68.67.165':21810
- '79.##2.137.223':21810
- '94.##.56.167':21810
- '83.##.232.227':21810
- '11#.#05.37.124':21810
- '11#.#54.24.240':21810
- '11#.#96.69.201':21810
- '91.##5.142.6':21810
- '84.##8.156.122':21810
- '27.#.137.71':21810
- '75.##2.22.136':21810
- '10#.#7.102.119':21810
- '31.##4.211.140':21810
- '17#.#6.51.188':21810
- '11#.#8.24.133':21810
- '80.##5.236.128':21810
- '62.##5.126.157':21810
- '10#.#1.34.154':21810
- '17#.#41.58.29':21810
- '83.##3.242.61':21810
- '83.##5.188.163':21810
- '94.##.135.35':21810
- '46.##6.207.15':21810
- '17#.#2.53.38':21810
- '92.##.21.174':21810
- '10#.#01.201.244':21810
- '31.##.175.54':21810
- '93.##7.153.119':21810
- '11#.#5.182.29':21810
- '22#.#3.1.112':21810
- '95.#0.62.86':21810
- '18#.#20.241.110':21810
- '11#.#96.148.8':21810
- '86.#04.50.2':21810
- '10#.#20.87.220':21810
- '92.##1.165.236':21810
- '59.##4.179.169':21810
- '95.#3.95.52':21810
- '18#.#6.110.183':21810
- '79.##4.82.58':21810
- '21#.#03.221.107':21810
- '17#.#87.251.106':21810
- '76.##0.23.101':21810
- '49.#.133.187':21810
- '18#.#52.3.177':21810
- '2.#.245.196':21810
- '93.##.208.73':21810
- '20#.#3.70.37':21810
- '20#.#29.25.92':21810
- '79.##4.24.39':21810
- '20#.#94.117.126':21810
- '46.##.78.122':21810
- '79.##9.201.252':21810
- '10#.#27.116.6':21810
- '11#.#84.139.157':21810
- '17#.#87.233.148':21810
- '46.##7.19.185':21810
- '12#.43.11.8':21810
- '91.##7.6.182':21810
- '20#.#7.114.196':21810
- '94.##.210.33':21810
- '78.##9.122.36':21810
- '17#.#6.69.16':21810
- '11#.#00.58.6':21810
- '75.##.184.59':21810
- '92.##9.246.141':21810
- '65.##.11.142':21810
- '94.##.184.242':21810
- '88.##0.235.215':21810
- '95.##6.98.42':21810
- '31.##1.196.180':21810
- '19#.#05.154.210':80
- '2.##.14.106':21810
- '2.##.15.181':21810
- '11#.#06.105.168':21810
- '11#.#41.166.106':21810
- '46.##.174.245':21810
- '87.##7.36.80':21810
- '62.##.165.10':21810
- '88.##.59.189':21810
- '46.##.53.184':21810
- '18#.#4.21.64':21810
- '18#.#62.27.26':21810
- '19#.#05.135.219':21810
- '11#.#7.25.27':21810
- '77.##.228.137':21810
- '27.##7.231.71':21810
- '19#.68.37.5':21810
- '11#.#18.111.72':21810
- '82.##2.57.95':21810
- '95.##.146.185':21810
- '92.##.70.238':21810
- '18#.#24.119.36':21810
- '20#.#04.144.238':21810
- '59.##3.204.168':21810
- '18#.#60.30.119':21810
- '79.##3.157.202':21810
- '17#.#26.189.209':21810
- '11#.#54.196.56':21810
- '11#.#35.136.52':21810
- '11#.#54.91.242':21810
- '95.##.20.116':21810
- '78.##.64.246':21810
- '17#.#55.166.48':21810
- '75.##.186.72':21810
- '41.##.132.229':21810
- '17#.#22.51.184':21810
- '19#.#06.205.124':21810
- '27.##7.72.241':21810
- '46.##0.227.151':21810
- '79.##3.227.54':21810
- '17#.#00.170.249':21810
- '17#.#08.241.80':21810
- '17#.#6.103.47':21810
- '68.##0.146.108':21810
- '14.#8.98.63':21810
- '41.##1.31.200':21810
- '11#.#3.155.250':21810
- '21#.#6.250.69':21810
- '17#.#87.28.215':21810
- '21#.#4.124.39':21810
- '11#.#42.111.59':21810
- '19#.#4.100.128':21810
- '95.##4.235.96':21810
- '19#.#01.13.132':21810
- '90.#89.5.66':21810
- '14#.#13.9.24':21810
- '1.##.0.211':21810
- '84.##9.46.178':21810
- '11#.#1.77.45':21810
- '11#.#84.119.145':21810
- '46.##6.196.168':21810
- '10#.#97.138.126':21810
- '49.##9.125.251':21810
- '79.##8.190.218':21810
- '58.##6.106.73':21810
- '98.##.179.67':21810
- '17#.#22.70.148':21810
- '67.##6.203.212':21810
- '89.##0.101.122':21810
- '11#.#70.68.9':21810
- '21#.#7.175.196':21810
- '24.##1.40.44':21810
- '11#.#42.231.197':21810
- '20#.#0.146.225':21810
- '94.##1.231.103':21810
- '11#.#84.137.108':21810
- '95.#3.88.74':21810
- '84.##4.188.143':21810
- '18#.#73.177.135':21810
- '92.##.185.172':21810
- '11#.#7.45.98':21810
- 19#.#05.154.210/stat2.php?w=################################################
- 19#.#05.154.210/stat2.php?w=#################################################