Technical Information
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Shell' = '<LS_APPDATA>\a72a1ac3\X'
- [<HKLM>\SYSTEM\ControlSet001\Services\.ipsec] 'ImagePath' = '\?'
- <LS_APPDATA>\a72a1ac3\X
- %WINDIR%\Explorer.EXE
- <LS_APPDATA>\a72a1ac3\@
- <LS_APPDATA>\a72a1ac3\X
- %WINDIR%\$NtUninstallKB16918$\2804554435\L\acbrwqkz
- %WINDIR%\$NtUninstallKB16918$\2804554435\@
- '93.##.225.219':21810
- '11#.#41.126.11':21810
- '12#.#45.109.223':21810
- '18#.#37.152.107':21810
- '81.##.163.132':21810
- '17#.#0.86.210':21810
- '17#.#91.208.169':21810
- '87.#.238.242':21810
- '76.##.132.247':21810
- '11#.#18.53.63':21810
- '94.##1.239.138':21810
- '92.##.233.81':21810
- '46.##9.161.178':21810
- '70.##0.67.114':21810
- '18#.#33.113.71':21810
- '92.##.214.174':21810
- '11#.#87.59.254':21810
- '92.##.66.142':21810
- '81.##3.188.241':21810
- '85.##.84.119':21810
- '79.##2.227.182':21810
- '92.##2.150.150':21810
- '17#.#0.81.22':21810
- '92.##5.107.236':21810
- '11#.#04.67.2':21810
- '21#.#0.32.216':21810
- '18#.#.23.227':21810
- '49.##8.112.100':21810
- '11#.#54.131.125':21810
- '78.##0.127.113':21810
- '92.##5.110.115':21810
- '87.#.75.2':21810
- '95.#9.74.31':21810
- '58.##.68.243':21810
- '79.##1.164.6':21810
- '96.##.192.81':21810
- '1.##.170.151':21810
- '70.##2.167.32':21810
- '18#.#5.69.188':21810
- '94.##5.90.91':21810
- '12#.#23.91.116':21810
- '76.##3.88.116':21810
- '58.#.85.76':21810
- '90.##7.134.213':21810
- '79.##5.190.251':21810
- '79.##2.201.68':21810
- '46.##.43.219':21810
- '18#.#3.151.135':21810
- '20#.#46.206.180':21810
- '18#.#37.10.108':21810
- '21#.#22.0.118':21810
- '17#.#26.163.240':21810
- '62.##3.244.113':21810
- '10#.#27.127.54':21810
- '70.##2.194.164':21810
- '89.##2.71.179':21810
- '11#.#05.47.149':21810
- '94.##.181.25':21810
- '91.##5.150.36':21810
- '11#.#40.211.105':21810
- '83.##.183.34':21810
- '95.##0.48.54':21810
- '85.##2.131.168':21810
- '49.##.161.232':21810
- '46.#7.66.41':21810
- '2.###.146.81':21810
- '12#.#3.68.63':21810
- '59.##.170.51':21810
- '11#.#84.146.121':21810
- '82.##.94.120':21810
- '89.##.139.198':21810
- '77.##9.6.123':21810
- '11#.#41.140.156':21810
- '79.##5.199.162':21810
- '20#.#50.64.71':21810
- '18#.#73.58.147':21810
- '10#.#17.195.89':21810
- '75.##4.29.88':21810
- '81.##3.217.136':21810
- '11#.#9.146.112':21810
- '18#.#54.196.58':21810
- '83.##7.17.59':21810
- '92.##.75.115':21810
- '13#.#7.170.55':21810
- '85.#6.35.68':21810
- '49.#.134.111':21810
- '49.#02.62.6':21810
- '22#.#29.114.82':21810
- '84.##.211.187':21810
- '1.##.123.27':21810
- '11#.#86.52.70':21810
- '46.##2.63.99':21810
- '17#.#25.80.239':21810
- '84.##.113.132':21810
- '85.##.172.174':21810
- '89.#7.49.36':21810
- '2.##0.46.15':21810
- '10#.#97.84.191':21810
- '1.##.253.97':21810
- '84.##6.173.90':21810
- '94.##9.170.126':21810
- '11#.#53.77.242':21810
- '12#.#8.164.192':21810
- '42.#.200.227':21810
- '92.##1.247.57':21810
- '11#.#02.41.121':21810
- '18#.#2.147.55':21810
- '14.##9.141.92':21810
- '11#.#42.79.8':21810
- '15#.#7.102.249':21810
- '93.##5.253.149':21810
- '70.##.16.231':21810
- '18#.#45.90.242':21810
- '89.##5.60.10':21810
- '92.##6.208.114':21810
- '19#.#05.135.93':21810
- '87.#.118.55':21810
- '89.##5.89.150':21810
- '24.##.138.142':21810
- '21#.#2.152.54':21810
- '49.##6.167.224':21810
- '95.##6.20.15':21810
- '13#.#04.1.209':21810
- '74.##9.134.77':21810
- '11#.#8.31.66':21810
- '18#.#60.55.85':21810
- '79.##9.250.219':21810
- '2.##4.5.68':21810
- '24.##9.144.133':21810
- '74.##3.149.231':21810
- '76.##0.33.55':21810
- '17#.#6.233.90':21810
- '12#.#25.90.76':21810
- '77.#0.62.10':21810
- '91.##.248.253':21810
- '18#.#41.238.19':21810
- '62.#3.68.93':21810
- '12#.#8.156.132':21810
- '20#.#79.2.116':21810
- '11#.#30.26.217':21810
- '24.##2.201.250':21810
- '86.##3.129.180':21810
- '87.##7.35.52':21810
- '11#.#41.185.100':21810
- '65.#2.62.59':21810
- '11#.#41.200.119':21810
- '88.##8.32.52':21810
- '12#.#38.65.202':21810
- '10#.#73.29.207':21810
- '75.##2.48.146':21810
- '89.##3.15.221':21810
- '12#.#58.67.36':21810
- '46.##9.105.111':21810
- '75.##5.16.157':21810
- '22#.#29.213.194':21810
- '31.##.136.69':21810
- '27.##6.90.70':21810
- '18#.#73.77.199':21810
- '17#.#0.6.131':21810
- '83.#.20.196':21810
- '92.##1.223.196':21810
- '14#.#56.32.155':21810
- '68.##6.67.211':21810
- '67.##6.148.119':21810
- '88.##9.238.36':21810
- '68.##.131.130':21810
- '20#.#79.14.75':21810
- '77.##1.83.247':21810
- '46.##2.233.28':21810
- '95.##.38.175':21810
- '62.##.139.20':21810
- '19#.#05.154.210':80
- '86.##6.112.158':21810
- '11#.#06.2.42':21810
- '18#.#6.76.180':21810
- '17#.#55.84.247':21810
- '76.##4.44.206':21810
- '46.##.111.194':21810
- '11#.#00.189.29':21810
- '11#.#54.61.97':21810
- '15#.#2.159.18':21810
- '95.##.198.15':21810
- '17#.#6.86.150':21810
- '2.##3.46.22':21810
- '11#.#58.80.45':21810
- '46.##3.25.145':21810
- '31.##0.105.39':21810
- '11#.#84.23.136':21810
- '21#.#56.115.165':21810
- '17#.#21.198.182':21810
- '79.##8.215.142':21810
- '17#.#3.60.110':21810
- '11#.#41.79.253':21810
- '21#.#10.86.146':21810
- '11#.#54.49.19':21810
- '62.##.111.65':21810
- '95.##1.78.140':21810
- '46.##5.68.195':21810
- '18#.#2.134.48':21810
- '89.##0.212.170':21810
- '95.#6.19.73':21810
- '82.##4.132.101':21810
- '92.#3.48.36':21810
- '67.##1.246.89':21810
- '20#.#94.116.64':21810
- '79.##7.121.188':21810
- '89.##.64.191':21810
- '81.##8.145.25':21810
- '11#.#7.87.175':21810
- '20#.#7.118.210':21810
- '85.##.156.212':21810
- '18#.#60.4.167':21810
- '16#.#80.145.127':21810
- '68.##.106.195':21810
- '83.##.197.166':21810
- '18#.#4.90.202':21810
- '24.##7.110.37':21810
- '21#.#19.76.58':21810
- '12#.#25.57.213':21810
- '77.##9.229.155':21810
- '70.#0.81.72':21810
- '79.##2.90.123':21810
- '95.##.187.38':21810
- '68.##.96.201':21810
- '95.##.48.169':21810
- '94.##.147.60':21810
- '11#.#8.192.252':21810
- '71.##7.139.96':21810
- '79.##4.11.56':21810
- '98.##5.192.43':21810
- '78.##6.48.121':21810
- '18#.#8.118.67':21810
- '18#.#8.252.162':21810
- '89.##.215.31':21810
- '41.##2.140.180':21810
- '11#.#3.175.226':21810
- '65.##4.72.227':21810
- '92.#1.82.97':21810
- '95.##.241.254':21810
- '59.##.163.14':21810
- '20#.#92.251.235':21810
- '11#.#40.108.55':21810
- '10#.#07.241.90':21810
- '31.##0.4.220':21810
- '18#.#60.57.149':21810
- '11#.#42.233.10':21810
- '87.##.165.13':21810
- '19#.#31.102.46':21810
- '46.##1.235.9':21810
- '85.##5.54.136':21810
- '22#.#36.65.253':21810
- '18#.#26.19.5':21810
- '11#.#04.214.19':21810
- '71.#5.35.22':21810
- '94.##8.177.53':21810
- '19#.#04.138.77':21810
- '24.##9.163.170':21810
- 19#.#05.154.210/bad.php?w=############################################
- 19#.#05.154.210/stat2.php?w=##########################################
- 19#.#05.154.210/stat2.php?w=#########################################