Technical Information
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000002] 'PackedCatalogItem' = '{6d,73,77,73,6f,63,6b,2e,64,6c,6c,00,00,00,00,00,00,00,00,00,00,...
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000003] 'PackedCatalogItem' = '{6d,73,77,73,6f,63,6b,2e,64,6c,6c,00,00,00,00,00,00,00,00,00,00,...
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000004] 'PackedCatalogItem' = '{6d,73,77,73,6f,63,6b,2e,64,6c,6c,00,00,00,00,00,00,00,00,00,00,...
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000001] 'LibraryPath' = 'mswsock.dll'
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000003] 'LibraryPath' = 'mswsock.dll'
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001] 'PackedCatalogItem' = '{6d,73,77,73,6f,63,6b,2e,64,6c,6c,00,00,00,00,00,00,00,00,00,00,...
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000005] 'PackedCatalogItem' = '{6d,73,77,73,6f,63,6b,2e,64,6c,6c,00,00,00,00,00,00,00,00,00,00,...
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000009] 'PackedCatalogItem' = '{6d,73,77,73,6f,63,6b,2e,64,6c,6c,00,00,00,00,00,00,00,00,00,00,...
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000010] 'PackedCatalogItem' = '{6d,73,77,73,6f,63,6b,2e,64,6c,6c,00,00,00,00,00,00,00,00,00,00,...
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000011] 'PackedCatalogItem' = '{6d,73,77,73,6f,63,6b,2e,64,6c,6c,00,00,00,00,00,00,00,00,00,00,...
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000006] 'PackedCatalogItem' = '{6d,73,77,73,6f,63,6b,2e,64,6c,6c,00,00,00,00,00,00,00,00,00,00,...
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000007] 'PackedCatalogItem' = '{6d,73,77,73,6f,63,6b,2e,64,6c,6c,00,00,00,00,00,00,00,00,00,00,...
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000008] 'PackedCatalogItem' = '{6d,73,77,73,6f,63,6b,2e,64,6c,6c,00,00,00,00,00,00,00,00,00,00,...
- [<HKLM>\SYSTEM\ControlSet001\Services\.ipsec] 'ImagePath' = '\?'
- Windows Security Center
- '<SYSTEM32>\cmd.exe'
- <SYSTEM32>\cmd.exe
- <SYSTEM32>\winlogon.exe
- %WINDIR%\Explorer.EXE
- %WINDIR%\$NtUninstallKB27979$\4121336045\@
- %WINDIR%\$NtUninstallKB27979$\4121336045\L\alehhooo
- %WINDIR%\$NtUninstallKB27979$\4121336045\Desktop.ini
- 'localhost':80
- 'j.###mind.com':80
- http://le#####eecounters.com/5699002-2F6F334BF9ACF1B2401D3874A5B0C048/counter.img?th################################ via localhost
- http://le#####eecounters.com/5699002-2F6F334BF9ACF1B2401D3874A5B0C048/counter.img?th############################### via localhost
- http://j.###mind.com/app/geoip.js
- DNS ASK �c#j�~
- DNS ASK �c# 4
- DNS ASK �c#O~�
- DNS ASK �c#�'�
- DNS ASK �c#O-
- DNS ASK �c#��
- DNS ASK j.###mind.com
- DNS ASK �c#Z�E
- DNS ASK �c#�\^
- DNS ASK �c#�Y
- '2.##2.71.14':16471
- '84.##8.219.13':16471
- '71.##.164.15':16471
- '83.#.184.18':16471
- '24.##.143.243':16471
- '24.##7.197.244':16471
- '17#.#.198.247':16471
- '85.##4.10.12':16471
- '18#.#3.214.245':16471
- '10#.#49.47.13':16471
- '21#.#2.182.12':16471
- '70.##7.78.21':16471
- '11#.#14.8.29':16471
- '74.##2.51.241':16471
- '46.##.238.30':16471
- '18#.#5.68.35':16471
- '11#.#62.182.34':16471
- '18#.#01.129.28':16471
- '10#.#2.247.21':16471
- '24.##6.162.21':16471
- '78.##8.109.24':16471
- '72.##1.185.24':16471
- '21#.#48.170.24':16471
- '18#.#53.253.254':16471
- '19#.#53.253.254':16471
- '16#.#53.253.254':16471
- '11#.#53.253.254':16471
- '15#.#53.253.254':16471
- '21#.#53.253.254':16471
- '13#.#54.253.254':16471
- '18#.#54.253.254':16471
- '88.##4.253.254':16471
- '24#.#53.253.254':16471
- '71.##4.253.254':16471
- '71.##3.253.254':16471
- '24.##5.199.9':16471
- '95.#5.69.9':16471
- '95.#0.213.9':16471
- '17#.#16.96.10':16471
- '24.##9.247.9':16471
- '68.##6.118.252':16471
- '21#.#89.229.254':16471
- '18#.#52.253.254':16471
- '17#.#20.118.3':16471
- '72.#3.39.7':16471
- '31.#9.20.4':16471