Technical Information
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000002] 'PackedCatalogItem' = '{6d,73,77,73,6f,63,6b,2e,64,6c,6c,00,00,00,00,00,00,00,00,00,00,...
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000003] 'PackedCatalogItem' = '{6d,73,77,73,6f,63,6b,2e,64,6c,6c,00,00,00,00,00,00,00,00,00,00,...
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000004] 'PackedCatalogItem' = '{6d,73,77,73,6f,63,6b,2e,64,6c,6c,00,00,00,00,00,00,00,00,00,00,...
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000001] 'LibraryPath' = 'mswsock.dll'
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000003] 'LibraryPath' = 'mswsock.dll'
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001] 'PackedCatalogItem' = '{6d,73,77,73,6f,63,6b,2e,64,6c,6c,00,00,00,00,00,00,00,00,00,00,...
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000005] 'PackedCatalogItem' = '{6d,73,77,73,6f,63,6b,2e,64,6c,6c,00,00,00,00,00,00,00,00,00,00,...
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000009] 'PackedCatalogItem' = '{6d,73,77,73,6f,63,6b,2e,64,6c,6c,00,00,00,00,00,00,00,00,00,00,...
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000010] 'PackedCatalogItem' = '{6d,73,77,73,6f,63,6b,2e,64,6c,6c,00,00,00,00,00,00,00,00,00,00,...
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000011] 'PackedCatalogItem' = '{6d,73,77,73,6f,63,6b,2e,64,6c,6c,00,00,00,00,00,00,00,00,00,00,...
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000006] 'PackedCatalogItem' = '{6d,73,77,73,6f,63,6b,2e,64,6c,6c,00,00,00,00,00,00,00,00,00,00,...
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000007] 'PackedCatalogItem' = '{6d,73,77,73,6f,63,6b,2e,64,6c,6c,00,00,00,00,00,00,00,00,00,00,...
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000008] 'PackedCatalogItem' = '{6d,73,77,73,6f,63,6b,2e,64,6c,6c,00,00,00,00,00,00,00,00,00,00,...
- Windows Security Center
- '<SYSTEM32>\cmd.exe'
- <SYSTEM32>\cmd.exe
- <SYSTEM32>\services.exe
- %WINDIR%\Explorer.EXE
- C:\RECYCLER\S-1-5-18\$2ebe1c2e2a38cb36436c4d1cb8c2630c\n
- %WINDIR%\assembly\GAC\Desktop.ini
- C:\RECYCLER\S-1-5-18\$2ebe1c2e2a38cb36436c4d1cb8c2630c\@
- C:\RECYCLER\S-1-5-21-2052111302-484763869-725345543-1003\$2ebe1c2e2a38cb36436c4d1cb8c2630c\@
- C:\RECYCLER\S-1-5-21-2052111302-484763869-725345543-1003\$2ebe1c2e2a38cb36436c4d1cb8c2630c\n
- 'localhost':80
- 'j.###mind.com':80
- http://fo#####-counters.com/5699145-24B8EBEDAA47374020E664A2406FB684/counter.img?th############################### via localhost
- http://j.###mind.com/app/geoip.js
- DNS ASK �#�f�|
- DNS ASK �#��
- DNS ASK �#��
- DNS ASK �#��nz
- DNS ASK �#��e�
- DNS ASK �#��N
- DNS ASK j.###mind.com
- DNS ASK �#I��L
- DNS ASK �#�M�;
- DNS ASK �#ܝ�
- '21#.#15.25.8':16471
- '20#.#3.120.8':16471
- '72.##0.130.175':16471
- '86.##2.232.178':16471
- '67.##1.88.177':16471
- '89.#9.43.9':16471
- '24.##1.190.168':16471
- '77.##.252.166':16471
- '50.##.138.169':16471
- '12#.#59.192.10':16471
- '2.###.124.171':16471
- '11#.#65.228.186':16471
- '79.##3.111.3':16471
- '88.##6.101.187':16471
- '71.##6.14.192':16471
- '12#.#2.108.2':16471
- '91.#35.26.5':16471
- '17#.#4.205.6':16471
- '49.##.62.179':16471
- '93.##0.115.6':16471
- '98.##8.2.183':16471
- '61.##8.114.5':16471
- '71.##.174.12':16471
- '67.##7.185.14':16471
- '24.##.115.156':16471
- '79.##4.23.161':16471
- '36.##.227.158':16471
- '11#.#68.146.155':16471
- '71.##.195.151':16471
- '17#.#15.193.150':16471
- '24.##.32.152':16471
- '24.##1.12.154':16471
- '21#.#52.200.152':16471
- '18#.#45.37.163':16471
- '78.##.195.11':16471
- '89.##9.141.163':16471
- '12#.#4.227.10':16471
- '70.#0.1.11':16471
- '89.##0.216.162':16471
- '50.#7.9.162':16471
- '66.##0.14.12':16471
- '17#.#19.52.162':16471
- '12#.#25.80.162':16471
- '68.##.63.162':16471
- '69.##4.115.233':16471
- '90.##.75.233':16471
- '60.##.237.235':16471
- '76.##.154.239':16471
- '15#.#.186.237':16471
- '14.##.47.230':16471
- '72.##3.192.222':16471
- '71.##.209.221':16471
- '82.##0.239.223':16471
- '49.##5.62.229':16471
- '65.##.178.226':16471
- '20#.#57.30.247':16471
- '50.#6.2.247':16471
- '10#.#8.214.1':16471
- '17#.#23.204.252':16471
- '71.##0.136.251':16471
- '24.##6.252.244':16471
- '71.##.121.241':16471
- '11#.#41.113.241':16471
- '1.###.212.242':16471
- '11#.#95.196.244':16471
- '97.##.180.244':16471
- '14.##.133.206':16471
- '24.##.241.205':16471
- '79.##9.169.206':16471
- '75.##.71.210':16471
- '91.##5.36.210':16471
- '12#.#35.131.204':16471
- '68.##3.3.193':16471
- '96.##.165.192':16471
- '17#.#3.122.194':16471
- '12#.#4.125.202':16471
- '18#.#65.123.202':16471
- '11#.#12.154.217':16471
- '67.##5.231.215':16471
- '24.##5.196.217':16471
- '98.##2.167.220':16471
- '19#.#13.75.218':16471
- '11#.#40.59.214':16471
- '20#.#58.223.212':16471
- '19#.#47.132.212':16471
- '61.##.162.213':16471
- '20#.#4.55.214':16471
- '18#.#31.19.214':16471