Technical Information
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Shell' = '<LS_APPDATA>\a72a1ac3\X'
- [<HKLM>\SYSTEM\ControlSet001\Services\a72a1ac3] 'ImagePath' = '%WINDIR%\3273271975:1490412860.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\.netbt] 'ImagePath' = '\?'
- <LS_APPDATA>\a72a1ac3\X
- %WINDIR%\explorer.exe
- <SYSTEM32>\winlogon.exe
- %WINDIR%\Explorer.EXE
- %WINDIR%\$NtUninstallKB16918$\2804554435\L\acbrwqkz
- %WINDIR%\$NtUninstallKB16918$\2804554435\@
- %WINDIR%\3273271975:1490412860.exe
- <LS_APPDATA>\a72a1ac3\@
- <LS_APPDATA>\a72a1ac3\X
- '20#.#62.191.140':21810
- '14#.#18.120.170':21810
- '20#.#89.124.99':21810
- '27.##6.86.166':21810
- '93.##2.66.133':21810
- '91.#7.247.6':21810
- '14.#8.89.33':21810
- '14#.#69.115.38':21810
- '69.##8.57.133':21810
- '94.##.184.242':21810
- '11#.#05.97.43':21810
- '16#.#16.62.231':21810
- '93.##2.54.135':21810
- '20#.#4.74.39':21810
- '11#.#7.45.232':21810
- '72.##4.245.85':21810
- '17#.#04.52.187':21810
- '19#.#7.161.57':21810
- '68.##.182.122':21810
- '20#.#7.218.228':21810
- '84.##9.143.28':21810
- '20#.#15.157.84':21810
- '14#.#0.123.85':21810
- '87.##6.223.185':21810
- '18#.#.213.190':21810
- '18#.#2.63.18':21810
- '18#.#34.167.244':21810
- '20#.#25.14.128':21810
- '83.#.79.121':21810
- '71.##8.184.36':21810
- '12#.#32.144.178':21810
- '17#.#.151.59':21810
- '19#.#01.175.11':21810
- '18#.#33.4.111':21810
- '19#.#74.186.53':21810
- '19#.#9.228.145':21810
- '11#.#26.22.31':21810
- '95.##.188.204':21810
- '79.##8.189.36':21810
- '2.##.15.240':21810
- '74.##3.100.15':21810
- '18#.#60.39.144':21810
- '10#.#9.109.166':21810
- '46.##9.122.204':21810
- '1.##.13.141':21810
- '13#.#6.212.226':21810
- '68.##.194.74':21810
- '76.##0.165.48':21810
- '18#.#10.225.1':21810
- '95.##5.91.243':21810
- '89.##9.109.220':21810
- '76.#6.40.6':21810
- '2.##.125.10':21810
- '12#.#45.109.105':21810
- '12#.#01.14.104':21810
- '10#.#1.51.141':21810
- '17#.#04.241.48':21810
- '76.##9.45.180':21810
- '22#.#76.229.18':21810
- '12#.#38.109.53':21810
- '18#.#1.87.21':21810
- '24.##9.137.34':21810
- '81.##.167.125':21810
- '17#.#12.81.11':21810
- '95.#6.219.5':21810
- '83.##3.242.61':21810
- '79.##6.105.201':21810
- '14.#9.48.70':21810
- '67.##3.19.211':21810
- '17#.#5.21.40':21810
- '69.##4.39.78':21810
- '17#.#96.123.125':21810
- '11#.#71.91.171':21810
- '75.##0.83.37':21810
- '89.##3.106.38':21810
- '20#.#49.101.226':21810
- '12#.#21.29.145':21810
- '98.##7.106.99':21810
- '14#.#15.202.163':21810
- '69.##3.2.120':21810
- '21#.#8.184.112':21810
- '11#.#7.48.28':21810
- '19#.#76.157.91':21810
- '42.#.35.206':21810
- '94.##.185.196':21810
- '71.##6.229.122':21810
- '10#.#38.88.3':21810
- '62.##.84.204':21810
- '91.#87.0.64':21810
- '12#.#3.123.77':21810
- '76.##.220.162':21810
- '92.##.217.134':21810
- '79.##7.143.66':21810
- '94.##2.189.118':21810
- '12#.#74.29.47':21810
- '22#.#36.28.117':21810
- '11#.#17.232.138':21810
- '11#.#01.43.211':21810
- '18#.#22.177.43':21810
- '11#.#07.254.177':21810
- '11#.#3.168.149':21810
- '21#.#6.191.229':21810
- '21#.#18.139.171':21810
- '21#.#09.243.216':21810
- '11#.#4.110.141':21810
- '77.##8.209.186':21810
- '95.##.83.184':21810
- '17#.#23.73.53':21810
- '89.##2.77.252':21810
- '19#.#7.86.86':21810
- '11#.#41.145.6':21810
- '20#.#32.227.40':21810
- '11#.#40.122.185':21810
- '18#.#3.82.185':21810
- '17#.#51.20.235':21810
- '46.##.53.184':21810
- '21#.#0.62.21':21810
- '15#.#4.103.68':21810
- '90.##9.105.247':21810
- '18#.#80.187.88':21810
- '13#.#42.125.247':21810
- '11#.#19.180.199':21810
- '17#.#72.175.237':21810
- '11#.#7.212.65':21810
- '46.##8.179.210':21810
- '99.##7.139.113':21810
- '88.##8.32.52':21810
- '95.##0.125.34':21810
- '19#.#90.39.243':21810
- '39.##9.94.153':21810
- '19#.#.107.161':21810
- '11#.#3.69.42':21810
- '21#.#7.168.108':21810
- '17#.#26.78.164':21810
- '92.##5.211.12':21810
- '11#.#8.0.154':21810
- '20#.#32.187.191':21810
- '18#.#0.71.44':21810
- '95.#52.9.64':21810
- '2.###.134.20':21810
- '77.##1.63.253':21810
- '84.##.183.19':21810
- '89.##.132.84':21810
- '92.##3.17.110':21810
- '12#.#23.103.65':21810
- '88.##2.130.250':21810
- '77.##3.18.75':21810
- '46.##.236.66':21810
- '89.##3.234.106':21810
- '82.##.189.202':21810
- '18#.#75.141.63':21810
- '95.##4.165.145':21810
- '95.##.214.27':21810
- '69.##5.218.167':21810
- '11#.#95.66.67':21810
- '18#.#60.209.172':21810
- '18#.#2.176.193':21810
- '95.##.103.219':21810
- '59.##9.197.5':21810
- '11#.#4.114.137':21810
- '18#.#74.177.77':21810
- '19#.#05.154.210':80
- '68.##6.197.133':21810
- '86.##7.178.149':21810
- '46.##5.60.11':21810
- '17#.#.190.12':21810
- '93.#1.14.29':21810
- '10#.#99.34.248':21810
- '59.##4.185.194':21810
- '79.##8.116.29':21810
- '78.##.225.251':21810
- '10#.#30.15.90':21810
- '46.##8.223.23':21810
- '20#.#32.106.90':21810
- '75.#2.82.59':21810
- '18#.#60.174.168':21810
- '11#.#18.227.192':21810
- '18#.#90.89.31':21810
- '81.##.117.35':21810
- '10#.#42.9.67':21810
- '18#.#9.131.250':21810
- '11#.#00.147.138':21810
- '67.##3.110.120':21810
- '22#.#07.161.137':21810
- '11#.#9.166.9':21810
- '59.##1.34.249':21810
- '62.##2.198.236':21810
- '18#.#56.117.47':21810
- '19#.#53.174.237':21810
- '91.##4.17.209':21810
- '10#.#97.81.126':21810
- '82.#9.88.76':21810
- '77.##8.243.232':21810
- '20#.#88.83.197':21810
- '19#.#05.135.219':21810
- '98.##7.21.57':21810
- '70.##5.64.187':21810
- '89.##4.180.179':21810
- '31.##7.12.204':21810
- '83.##5.135.75':21810
- '17#.#4.240.90':21810
- '17#.#2.188.201':21810
- '41.##0.104.128':21810
- '95.#7.81.44':21810
- '86.##.41.101':21810
- '14.#8.36.26':21810
- '12#.#23.161.245':21810
- '49.##9.128.225':21810
- '87.##1.108.192':21810
- '11#.#4.106.6':21810
- '78.##.201.167':21810
- '77.##.207.61':21810
- '79.##2.215.137':21810
- '75.#3.7.101':21810
- '89.##5.132.108':21810
- '94.##7.46.52':21810
- '98.##.211.54':21810
- '75.##.184.59':21810
- '11#.#42.159.207':21810
- '11#.#54.134.49':21810
- '77.##1.32.158':21810
- '12#.#23.206.49':21810
- '75.##6.86.90':21810
- '19#.#4.157.97':21810
- '12#.#45.104.95':21810
- '86.##2.244.51':21810
- '75.##.227.32':21810
- '14.##.22.152':21810
- '10#.#08.130.235':21810
- '20#.#7.14.238':21810
- '82.##4.250.252':21810
- '18#.#33.166.253':21810
- '14#.#29.215.12':21810
- '89.##6.141.111':21810
- '88.##5.134.53':21810
- '79.##2.138.222':21810
- '15#.#2.138.161':21810
- '18#.#32.130.105':21810
- '84.##.201.41':21810
- '78.##.136.198':21810
- '11#.#96.8.93':21810
- 19#.#05.154.210/stat2.php?w=##########################################
- 19#.#05.154.210/stat2.php?w=###########################################