Technical Information
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Shell' = '<LS_APPDATA>\f5a698ed\X'
- [<HKLM>\SYSTEM\ControlSet001\Services\.netbt] 'ImagePath' = '\?'
- <LS_APPDATA>\f5a698ed\X
- <SYSTEM32>\winlogon.exe
- %WINDIR%\Explorer.EXE
- <LS_APPDATA>\f5a698ed\@
- <LS_APPDATA>\f5a698ed\X
- %WINDIR%\$NtUninstallKB37556$\4121336045\L\alehhooo
- %WINDIR%\$NtUninstallKB37556$\4121336045\@
- '18#.#4.220.100':21810
- '21#.#11.105.102':21810
- '18#.#47.1.139':21810
- '18#.#2.83.13':21810
- '11#.#93.126.103':21810
- '59.##3.192.37':21810
- '17#.#67.196.102':21810
- '19#.#8.140.72':21810
- '88.##4.155.70':21810
- '11#.#6.205.223':21810
- '21#.#18.109.7':21810
- '12#.#58.69.145':21810
- '75.##2.29.234':21810
- '66.##.100.13':21810
- '15#.#48.198.203':21810
- '20#.#04.203.41':21810
- '79.##3.238.40':21810
- '10#.#01.164.168':21810
- '17#.#0.18.33':21810
- '76.##1.113.173':21810
- '88.##3.134.58':21810
- '46.##9.116.168':21810
- '88.#8.27.40':21810
- '95.##6.108.180':21810
- '18#.#0.31.155':21810
- '18#.#94.184.77':21810
- '20#.#10.70.166':21810
- '19#.#6.101.76':21810
- '49.#38.4.91':21810
- '89.##.26.129':21810
- '10#.#2.196.49':21810
- '19#.#74.214.47':21810
- '19#.#6.101.48':21810
- '15#.#81.185.56':21810
- '14#.#32.183.223':21810
- '96.#7.2.190':21810
- '19#.#76.193.73':21810
- '19#.#60.252.47':21810
- '18#.#25.47.56':21810
- '2.##.108.210':21810
- '18#.#.249.82':21810
- '71.#30.80.3':21810
- '49.##5.103.124':21810
- '92.##.156.29':21810
- '20#.#48.152.150':21810
- '14.##8.41.10':21810
- '31.##3.177.206':21810
- '19#.#6.171.194':21810
- '66.##9.120.240':21810
- '69.##.229.204':21810
- '39.##9.172.61':21810
- '18#.#8.232.148':21810
- '18#.#92.170.11':21810
- '20#.#6.183.210':21810
- '19#.#2.38.93':21810
- '86.##.215.16':21810
- '91.##5.50.110':21810
- '11#.#05.46.38':21810
- '10#.#73.61.190':21810
- '2.###.177.131':21810
- '92.##.136.211':21810
- '58.##.218.164':21810
- '14.##.49.199':21810
- '24.##4.190.217':21810
- '95.##9.191.185':21810
- '84.##.142.179':21810
- '46.##.138.193':21810
- '20#.#55.177.188':21810
- '18#.#6.238.242':21810
- '83.##3.79.72':21810
- '95.##.237.80':21810
- '89.#7.72.53':21810
- '84.##2.116.202':21810
- '19#.#40.212.125':21810
- '83.##3.44.207':21810
- '92.##.227.76':21810
- '17#.#81.160.139':21810
- '20#.#04.95.194':21810
- '46.##2.64.35':21810
- '16#.#41.51.30':21810
- '75.#92.5.75':21810
- '79.##3.92.178':21810
- '11#.#54.177.156':21810
- '78.##.22.171':21810
- '75.##0.202.30':21810
- '31.##.210.52':21810
- '72.##8.18.145':21810
- '21#.#29.78.198':21810
- '1.##.62.240':21810
- '20#.#2.218.239':21810
- '18#.#1.138.66':21810
- '19#.#03.35.120':21810
- '98.##7.188.230':21810
- '87.##7.12.58':21810
- '79.##1.191.156':21810
- '17#.#22.161.67':21810
- '95.##.124.246':21810
- '77.##.170.245':21810
- '19#.#05.212.189':21810
- '18#.#20.57.244':21810
- '11#.#40.83.26':21810
- '19#.#9.178.104':21810
- '49.#0.2.84':21810
- '11#.#2.128.204':21810
- '17#.#1.90.163':21810
- '18#.#34.87.224':21810
- '95.##.43.228':21810
- '11#.#84.28.127':21810
- '19#.#77.226.112':21810
- '31.##4.250.159':21810
- '46.##1.175.172':21810
- '2.##3.40.45':21810
- '19#.#18.242.114':21810
- '19#.#6.63.177':21810
- '19#.#00.169.249':21810
- '2.##3.99.44':21810
- '19#.#92.252.2':21810
- '18#.#4.28.249':21810
- '14.##.52.139':21810
- '72.##.78.103':21810
- '92.##.192.89':21810
- '71.##6.195.64':21810
- '95.##.157.117':21810
- '91.##.228.101':21810
- '95.#9.16.60':21810
- '2.###.118.135':21810
- '17#.#0.27.40':21810
- '18#.#51.47.4':21810
- '95.##.78.134':21810
- '17#.#48.241.251':21810
- '17#.#1.241.244':21810
- '95.##5.10.142':21810
- '78.##.12.136':21810
- '80.##1.242.197':21810
- '11#.#41.96.132':21810
- '18#.#07.143.160':21810
- '19#.#8.238.245':21810
- '76.#8.9.162':21810
- '18#.#0.72.120':21810
- '11#.#6.131.45':21810
- '20#.#42.250.212':21810
- '92.##.72.110':21810
- '21#.#18.235.89':21810
- '59.##1.130.191':21810
- '16#.#32.41.77':21810
- '49.##3.191.9':21810
- '11#.#8.69.163':21810
- '21#.#09.244.124':21810
- '1.##.38.170':21810
- '27.#.39.218':21810
- '95.#8.61.82':21810
- '92.##.182.86':21810
- '11#.#98.165.53':21810
- '94.#42.8.83':21810
- '17#.#1.45.68':21810
- '19#.#47.181.94':21810
- '19#.#4.161.172':21810
- '20#.#8.117.253':21810
- '18#.#60.22.124':21810
- '46.##9.230.10':21810
- '85.##.144.13':21810
- '17#.#0.21.166':21810
- '27.##5.10.33':21810
- '20#.#42.197.5':21810
- '19#.#8.141.120':21810
- '17#.#1.41.176':21810
- '12#.#36.232.135':21810
- '92.#6.98.60':21810
- '27.##6.75.42':21810
- '92.#6.96.5':21810
- '91.#8.68.44':21810
- '17#.#3.17.24':80
- '67.##0.251.161':21810
- '10#.#87.110.209':21810
- '19#.#63.145.219':21810
- '11#.#19.187.109':21810
- '10#.#8.222.231':21810
- '18#.#5.25.178':21810
- '83.#1.56.78':21810
- '18#.#43.86.98':21810
- '11#.#48.91.51':21810
- '41.##8.106.141':21810
- '20#.#48.84.230':21810
- '68.##4.14.10':21810
- '20#.#3.100.49':21810
- '20#.#19.167.57':21810
- '95.##.243.152':21810
- '46.##.16.103':21810
- '84.##0.209.126':21810
- '18#.#2.219.27':21810
- '98.##7.151.175':21810
- '13#.#04.120.6':21810
- '95.##.102.27':21810
- '17#.#0.178.77':21810
- '20#.#64.84.145':21810
- '95.##.196.173':21810
- '11#.#71.182.174':21810
- '20#.#5.120.142':21810
- '11#.#65.161.101':21810
- '14#.#6.34.192':21810
- '31.##.182.74':21810
- '46.##1.198.211':21810
- '89.##5.185.18':21810
- '58.##6.27.182':21810
- '31.##7.97.192':21810
- '20#.84.6.51':21810
- '95.##3.22.61':21810
- '92.##.72.154':21810
- '10#.#91.68.38':21810
- '59.##.21.131':21810
- '19#.#05.135.93':21810
- '17#.#9.219.33':21810
- '77.##1.83.247':21810
- '11#.#48.167.14':21810
- '79.#18.1.93':21810
- '87.##7.3.236':21810
- '46.##.160.12':21810
- '11#.#95.84.158':21810
- '95.##.100.238':21810
- '12#.#36.36.56':21810
- '11#.#61.187.122':21810
- '18#.#4.102.225':21810
- '18#.#54.193.52':21810
- '12#.#45.120.183':21810
- '84.##0.193.163':21810
- '24.#43.5.16':21810
- '46.##2.81.118':21810
- '85.##1.117.197':21810
- '96.##.53.116':21810
- '11#.#03.164.5':21810
- '19#.#44.84.24':21810
- '92.##.121.251':21810
- '17#.#1.46.226':21810
- '20#.#88.141.68':21810
- '66.##.243.203':21810
- '21#.#55.60.250':21810
- '46.##.151.155':21810
- '20#.#2.232.221':21810
- '11#.#84.114.150':21810
- '19#.#59.206.181':21810
- '18#.#2.82.237':21810
- '20#.#89.153.5':21810
- '19#.#7.24.118':21810
- '19#.#90.189.197':21810
- '19#.#2.12.59':21810
- '17#.#9.33.165':21810
- '19#.#05.20.43':21810
- '19#.#5.233.244':21810
- '72.##8.99.180':21810
- '59.##4.189.30':21810
- '49.##2.146.126':21810
- '11#.#06.133.112':21810
- '69.##1.105.202':21810
- '11#.#40.206.59':21810
- '11#.#35.97.110':21810
- '20#.#7.161.66':21810
- '11#.#01.81.48':21810
- 17#.#3.17.24/bad.php?w=#######################
- 17#.#3.17.24/stat2.php?w=###########################################
- 17#.#3.17.24/stat2.php?w=##########################################