Technical Information
- [HKLM\SYSTEM\CurrentControlSet\Services\cnyflyknp] 'Start' = '00000002'
- [HKLM\SYSTEM\CurrentControlSet\Services\cnyflyknp] 'ImagePath' = '<SYSTEM32>\gotten.exe cnyflyknp'
- 'cnyflyknp' <SYSTEM32>\gotten.exe cnyflyknp
- %WINDIR%\syswow64\gotten.exe
- from <Full path to file> to %WINDIR%\syswow64\wostmp\_1348165002_688828995
- '1.###.248.27':27930
- '<LOCALNET>..35.0':27930
- '14.#92.2.37':27930
- '<LOCALNET>..35.1':27930
- '<LOCALNET>..35.2':27930
- '<LOCALNET>..35.3':27930
- '<LOCALNET>..35.4':27930
- '17#.16.8.50':27930
- '<LOCALNET>..35.5':27930
- '<LOCALNET>..35.6':27930
- '<LOCALNET>..35.7':27930
- '<LOCALNET>..35.8':27930
- '17#.16.8.40':27930
- '<LOCALNET>..35.9':27930
- '<LOCALNET>..35.10':27930
- '<LOCALNET>..35.11':27930
- '<LOCALNET>..35.12':27930
- '17#.#6.48.221':27930
- '<LOCALNET>..35.13':27930
- '<LOCALNET>..35.14':27930
- '<LOCALNET>..35.15':27930
- '<LOCALNET>..35.16':27930
- '17#.#6.12.203':27930
- '<LOCALNET>..35.17':27930
- '<LOCALNET>..35.18':27930
- '<LOCALNET>..35.19':27930
- '<LOCALNET>..35.20':27930
- '10#.#16.52.20':27930
- '<LOCALNET>..35.21':27930
- '<LOCALNET>..35.22':27930
- '<LOCALNET>..35.23':27930
- '<LOCALNET>..35.24':27930
- '<LOCALNET>..35.25':27930
- '11#.#10.212.150':27930
- '<LOCALNET>..35.26':27930
- '<LOCALNET>..35.27':27930
- '<LOCALNET>..35.28':27930
- '<LOCALNET>..35.29':27930
- '12#.#60.154.252':27930
- '<LOCALNET>..35.30':27930
- '<LOCALNET>..35.31':27930
- '<LOCALNET>..35.32':27930
- '<LOCALNET>..35.33':27930
- '18#.#8.212.176':27930
- '<LOCALNET>..35.34':27930
- '<LOCALNET>..35.35':27930
- '<LOCALNET>..35.36':27930
- '<LOCALNET>..35.37':27930
- '18#.#1.63.214':27930
- '<LOCALNET>..35.38':27930
- '<LOCALNET>..35.39':27930
- '<LOCALNET>..35.40':27930
- '<LOCALNET>..35.41':27930
- '22#.#1.122.230':27930
- '<LOCALNET>..35.42':27930
- '<LOCALNET>..35.43':27930
- '<LOCALNET>..35.44':27930
- '<LOCALNET>..35.45':27930
- '58.##.147.71':27930
- '<LOCALNET>..35.46':27930
- '<LOCALNET>..35.47':27930
- '<LOCALNET>..35.48':27930
- '<LOCALNET>..35.49':27930
- '59.##.201.97':27930
- '<LOCALNET>..35.50':27930
- '<LOCALNET>..35.51':27930
- '<LOCALNET>..35.52':27930
- '<LOCALNET>..35.53':27930
- '61.##4.50.237':27930
- '<LOCALNET>..35.54':27930
- '<LOCALNET>..35.55':27930
- '<LOCALNET>..35.56':27930
- '<LOCALNET>..35.57':27930
- '82.##.198.189':27930
- '<LOCALNET>..35.58':27930
- '<LOCALNET>..35.59':27930
- '<LOCALNET>..35.60':27930
- '<LOCALNET>..35.61':27930
- '91.#87.99.3':27930
- '<LOCALNET>..35.62':27930
- '<LOCALNET>..35.63':27930
- '<LOCALNET>..35.64':27930
- '<LOCALNET>..35.65':27930
- '10#.#4.137.178':27930
- '<LOCALNET>..35.66':27930
- '<LOCALNET>..35.67':27930
- '<LOCALNET>..35.68':27930
- '<LOCALNET>..35.69':27930
- '11#.#93.17.179':27930
- '<LOCALNET>..35.70':27930
- '<LOCALNET>..35.71':27930
- '<LOCALNET>..35.72':27930
- '<LOCALNET>..35.73':27930
- '11#.#8.238.194':27930
- '<LOCALNET>..35.74':27930
- '<LOCALNET>..35.75':27930
- '<LOCALNET>..35.76':27930
- '<LOCALNET>..0.0':27930
- '<LOCALNET>..35.77':27930
- '11#.#3.15.166':27930
- '<LOCALNET_GATEWAY>':27930
- '<LOCALNET>..35.78':27930
- '<LOCALNET>..0.2':27930
- '<LOCALNET>..35.79':27930
- '<LOCALNET>..0.3':27930
- '<LOCALNET>..35.80':27930
- '<LOCALNET>..0.4':27930
- '<LOCALNET>..35.81':27930
- '<LOCALNET>..0.5':27930
- '11#.#19.252.204':27930
- '<LOCALNET>..35.82':27930
- '<LOCALNET>..0.6':27930
- '<LOCALNET>..35.83':27930
- '<LOCALNET>..0.7':27930
- '<LOCALNET>..35.84':27930
- '<LOCALNET>..0.8':27930
- '<LOCALNET>..35.85':27930
- '<LOCALNET>..0.9':27930
- '12#.#8.33.17':27930
- '<LOCALNET>..35.86':27930
- '<LOCALNET>..0.10':27930
- '<LOCALNET>..35.87':27930
- '<LOCALNET>..0.11':27930
- '<LOCALNET>..35.88':27930
- '<LOCALNET>..0.12':27930
- '<LOCALNET>..35.89':27930
- '<LOCALNET>..0.13':27930
- '12#.#47.83.95':27930
- '<LOCALNET>..35.90':27930
- '<LOCALNET>..0.14':27930
- '<LOCALNET>..35.91':27930
- '<LOCALNET>..0.15':27930
- '<LOCALNET>..35.92':27930
- '<LOCALNET>..0.16':27930
- '<LOCALNET>..35.93':27930
- '<LOCALNET>..0.17':27930
- '12#.#60.58.206':27930
- '<LOCALNET>..35.94':27930
- '<LOCALNET>..0.18':27930
- '<LOCALNET>..0.19':27930
- '<LOCALNET>..35.95':27930
- '<LOCALNET>..0.20':27930
- '<LOCALNET>..35.96':27930
- '<LOCALNET>..0.21':27930
- '<LOCALNET>..35.97':27930
- '<LOCALNET>..0.22':27930
- '<LOCALNET>..35.98':27930
- '16#.#94.189.141':27930
- '<LOCALNET>..0.23':27930
- '<LOCALNET>..35.99':27930
- '<LOCALNET>..0.24':27930
- '<LOCALNET>..35.100':27930
- '<LOCALNET>..0.25':27930
- '<LOCALNET>..35.101':27930
- '<LOCALNET>..0.29':27930
- '<LOCALNET>..35.102':27930
- '18#.#1.168.237':27930
- '<LOCALNET>..0.26':27930
- '<LOCALNET>..35.103':27930
- '<LOCALNET>..0.27':27930
- '<LOCALNET>..35.104':27930
- '<LOCALNET>..0.28':27930
- '<LOCALNET>..35.105':27930
- '<LOCALNET>..0.30':27930
- '<LOCALNET>..35.106':27930
- '<LOCALNET>..0.31':27930
- '18#.#2.131.182':27930
- '<LOCALNET>..35.107':27930
- '<LOCALNET>..0.32':27930
- '<LOCALNET>..35.108':27930
- '<LOCALNET>..0.33':27930
- '<LOCALNET>..35.109':27930
- '<LOCALNET>..0.34':27930
- '<LOCALNET>..35.110':27930
- '<LOCALNET>..0.35':27930
- '18#.#2.112.114':27930
- '<LOCALNET>..35.111':27930
- '<LOCALNET>..0.36':27930
- '<LOCALNET>..35.112':27930
- '<LOCALNET>..0.37':27930
- '<LOCALNET>..35.113':27930
- '<LOCALNET>..0.38':27930
- '<LOCALNET>..35.114':27930
- '<LOCALNET>..0.39':27930
- '18#.#8.218.133':27930
- '<LOCALNET>..35.115':27930
- '<LOCALNET>..0.40':27930
- '<LOCALNET>..0.41':27930
- '<LOCALNET>..35.116':27930
- '<LOCALNET>..0.42':27930
- '<LOCALNET>..35.117':27930
- '<LOCALNET>..0.43':27930
- '<LOCALNET>..35.118':27930
- '19#.#5.222.155':27930
- '<LOCALNET>..0.44':27930
- '<LOCALNET>..35.119':27930
- '<LOCALNET>..0.45':27930
- '<LOCALNET>..35.120':27930
- '<LOCALNET>..0.46':27930
- '<LOCALNET>..35.121':27930
- '<LOCALNET>..0.47':27930
- '<LOCALNET>..35.122':27930
- '19#.#51.12.63':27930
- '<LOCALNET>..0.48':27930
- '<LOCALNET>..35.123':27930
- '<LOCALNET>..0.51':27930
- '<LOCALNET>..35.124':27930
- '<LOCALNET>..0.49':27930
- '<LOCALNET>..35.125':27930
- '<LOCALNET>..0.50':27930
- '<LOCALNET>..35.126':27930
- '20#.71.0.93':27930
- '<LOCALNET>..0.52':27930
- '<LOCALNET>..35.127':27930
- '<LOCALNET>..0.53':27930
- '<LOCALNET>..35.128':27930
- '<LOCALNET>..0.54':27930
- '<LOCALNET>..35.129':27930
- '<LOCALNET>..0.55':27930
- '<LOCALNET>..35.130':27930
- '20#.#35.34.69':27930
- '<LOCALNET>..0.59':27930
- '<LOCALNET>..35.131':27930
- '<LOCALNET>..0.56':27930
- '<LOCALNET>..35.132':27930
- '<LOCALNET>..0.57':27930
- '<LOCALNET>..35.133':27930
- '<LOCALNET>..0.58':27930
- '<LOCALNET>..35.134':27930
- '<LOCALNET>..0.60':27930
- '21#.#48.16.76':27930
- '<LOCALNET>..35.135':27930
- '<LOCALNET>..0.61':27930
- '<LOCALNET>..35.136':27930
- '<LOCALNET>..0.62':27930
- '<LOCALNET>..35.137':27930
- '<LOCALNET>..0.63':27930
- '<LOCALNET>..35.138':27930
- '<LOCALNET>..0.64':27930
- '<LOCALNET>..35.139':27930
- '<LOCALNET>..0.65':27930
- '<LOCALNET>..0.66':27930
- '<LOCALNET>..35.140':27930
- '<LOCALNET>..0.67':27930
- '<LOCALNET>..35.141':27930
- '<LOCALNET>..0.68':27930
- '<LOCALNET>..35.142':27930
- '<LOCALNET>..0.69':27930
- '<LOCALNET>..35.143':27930
- '<LOCALNET>..0.70':27930
- '<LOCALNET>..35.144':27930
- '<LOCALNET>..0.71':27930
- '<LOCALNET>..35.145':27930
- '<LOCALNET>..0.74':27930
- '<LOCALNET>..35.146':27930
- '<LOCALNET>..0.72':27930
- '<LOCALNET>..35.147':27930
- '<LOCALNET>..0.73':27930
- '<LOCALNET>..35.148':27930
- '<LOCALNET>..0.75':27930
- '<LOCALNET>..35.149':27930
- '<LOCALNET>..0.76':27930
- '<LOCALNET>..35.150':27930
- '<LOCALNET>..0.77':27930
- '<LOCALNET>..35.151':27930
- '<LOCALNET>..0.78':27930
- '<LOCALNET>..35.152':27930
- '<LOCALNET>..0.79':27930
- '<LOCALNET>..35.153':27930
- '<LOCALNET>..0.80':27930
- '<LOCALNET>..35.154':27930
- '<LOCALNET>..0.84':27930
- '<LOCALNET>..35.155':27930
- '<LOCALNET>..0.81':27930
- '<LOCALNET>..35.156':27930
- '<LOCALNET>..0.82':27930
- '<LOCALNET>..35.157':27930
- '<LOCALNET>..0.83':27930
- '<LOCALNET>..35.158':27930
- '<LOCALNET>..0.88':27930
- '<LOCALNET>..35.159':27930
- '<LOCALNET>..0.85':27930
- '<LOCALNET>..35.160':27930
- '<LOCALNET>..0.86':27930
- '<LOCALNET>..35.161':27930
- '<LOCALNET>..0.87':27930
- '<LOCALNET>..35.162':27930
- '<LOCALNET>..0.89':27930
- '<LOCALNET>..0.90':27930
- '<LOCALNET>..35.163':27930
- '<LOCALNET>..0.92':27930
- '<LOCALNET>..35.164':27930
- '<LOCALNET>..0.91':27930
- '<LOCALNET>..35.165':27930
- '<LOCALNET>..0.93':27930
- '<LOCALNET>..35.166':27930
- '<LOCALNET>..0.94':27930
- '<LOCALNET>..35.167':27930
- '<LOCALNET>..0.95':27930
- '<LOCALNET>..35.168':27930
- '<LOCALNET>..0.99':27930
- '<LOCALNET>..35.169':27930
- '<LOCALNET>..0.96':27930
- '<LOCALNET>..35.170':27930
- '<LOCALNET>..0.97':27930
- '<LOCALNET>..35.171':27930
- '<LOCALNET>..0.98':27930
- '<LOCALNET>..35.172':27930
- '<LOCALNET>..0.100':27930
- '<LOCALNET>..35.173':27930
- '<LOCALNET>..0.101':27930
- '<LOCALNET>..35.174':27930
- '<LOCALNET>..0.102':27930
- '<LOCALNET>..35.175':27930
- '<LOCALNET>..0.103':27930
- '<LOCALNET>..35.176':27930
- '<LOCALNET>..0.104':27930
- '<LOCALNET>..35.177':27930
- '<LOCALNET>..0.105':27930
- '<LOCALNET>..35.178':27930
- '<LOCALNET>..0.108':27930
- '<LOCALNET>..35.179':27930
- '<LOCALNET>..0.106':27930
- '<LOCALNET>..35.180':27930
- '<LOCALNET>..0.107':27930
- '<LOCALNET>..35.181':27930
- '<LOCALNET>..0.109':27930
- '<LOCALNET>..35.182':27930
- '<LOCALNET>..0.110':27930
- '<LOCALNET>..35.183':27930
- '<LOCALNET>..0.111':27930
- '<LOCALNET>..35.184':27930
- '<LOCALNET>..0.112':27930
- '<LOCALNET>..35.185':27930
- '<LOCALNET>..0.115':27930
- '<LOCALNET>..35.186':27930
- '<LOCALNET>..0.113':27930
- '<LOCALNET>..0.114':27930
- '<LOCALNET>..35.187':27930
- '<LOCALNET>..0.119':27930
- '<LOCALNET>..35.188':27930
- '<LOCALNET>..0.116':27930
- '<LOCALNET>..35.189':27930
- '<LOCALNET>..0.117':27930
- '<LOCALNET>..35.190':27930
- '<LOCALNET>..0.118':27930
- '<LOCALNET>..35.191':27930
- '<LOCALNET>..0.122':27930
- '<LOCALNET>..35.192':27930
- '<LOCALNET>..0.120':27930
- '<LOCALNET>..35.193':27930
- '<LOCALNET>..0.121':27930
- '<LOCALNET>..35.194':27930
- '<LOCALNET>..0.123':27930
- '<LOCALNET>..35.195':27930
- '<LOCALNET>..0.124':27930
- '<LOCALNET>..35.196':27930
- '<LOCALNET>..0.125':27930
- '<LOCALNET>..35.197':27930
- '<LOCALNET>..0.126':27930
- '<LOCALNET>..35.198':27930
- '<LOCALNET>..0.127':27930
- '<LOCALNET>..35.199':27930
- '<LOCALNET>..0.128':27930
- '<LOCALNET>..35.200':27930
- '<LOCALNET>..0.132':27930
- '<LOCALNET>..35.201':27930
- '<LOCALNET>..0.129':27930
- '<LOCALNET>..35.202':27930
- '<LOCALNET>..0.130':27930
- '<LOCALNET>..35.203':27930
- '<LOCALNET>..0.131':27930
- '<LOCALNET>..35.204':27930
- '<LOCALNET>..0.133':27930
- '<LOCALNET>..35.205':27930
- '<LOCALNET>..0.134':27930
- '<LOCALNET>..35.206':27930
- '<LOCALNET>..0.135':27930
- '<LOCALNET>..35.207':27930
- '<LOCALNET>..0.139':27930
- '<LOCALNET>..35.208':27930
- '<LOCALNET>..0.136':27930
- '<LOCALNET>..35.209':27930
- '<LOCALNET>..0.137':27930
- '<LOCALNET>..0.138':27930
- '<LOCALNET>..35.210':27930
- '<LOCALNET>..0.140':27930
- '<LOCALNET>..35.211':27930
- '<LOCALNET>..0.142':27930
- '<LOCALNET>..35.212':27930
- '<LOCALNET>..0.141':27930
- '<LOCALNET>..35.213':27930
- '<LOCALNET>..0.146':27930
- '<LOCALNET>..35.214':27930
- '<LOCALNET>..0.143':27930
- '<LOCALNET>..35.215':27930
- '<LOCALNET>..0.144':27930
- '<LOCALNET>..35.216':27930
- '<LOCALNET>..0.145':27930
- '<LOCALNET>..35.217':27930
- '<LOCALNET>..0.150':27930
- '<LOCALNET>..35.218':27930
- '<LOCALNET>..0.147':27930
- '<LOCALNET>..35.219':27930
- '<LOCALNET>..0.148':27930
- '<LOCALNET>..35.220':27930
- '<LOCALNET>..0.149':27930
- '<LOCALNET>..35.221':27930
- '<LOCALNET>..0.151':27930
- '<LOCALNET>..35.222':27930
- '<LOCALNET>..0.152':27930
- '<LOCALNET>..35.223':27930
- '<LOCALNET>..0.153':27930
- '<LOCALNET>..35.224':27930
- '<LOCALNET>..0.154':27930
- '<LOCALNET>..35.225':27930
- '<LOCALNET>..0.157':27930
- '<LOCALNET>..35.226':27930
- '<LOCALNET>..0.155':27930
- '<LOCALNET>..35.227':27930
- '<LOCALNET>..0.156':27930
- '<LOCALNET>..35.228':27930
- '<LOCALNET>..0.158':27930
- '<LOCALNET>..35.229':27930
- '<LOCALNET>..0.159':27930
- '<LOCALNET>..35.230':27930
- '<LOCALNET>..0.160':27930
- '<LOCALNET>..35.231':27930
- '<LOCALNET>..0.164':27930
- '<LOCALNET>..35.232':27930
- '<LOCALNET>..0.161':27930
- '<LOCALNET>..35.233':27930
- '<LOCALNET>..0.162':27930
- '<LOCALNET>..0.163':27930
- '<LOCALNET>..35.234':27930
- '<LOCALNET>..0.165':27930
- '<LOCALNET>..35.235':27930
- '<LOCALNET>..0.166':27930
- '<LOCALNET>..35.236':27930
- '<LOCALNET>..0.167':27930
- '<LOCALNET>..35.237':27930
- '<LOCALNET>..0.171':27930
- '<LOCALNET>..35.238':27930
- '<LOCALNET>..0.168':27930
- '<LOCALNET>..35.239':27930
- '<LOCALNET>..0.169':27930
- '<LOCALNET>..35.240':27930
- '<LOCALNET>..0.170':27930
- '<LOCALNET>..35.241':27930
- '<LOCALNET>..0.175':27930
- '<LOCALNET>..35.242':27930
- '<LOCALNET>..0.172':27930
- '<LOCALNET>..35.243':27930
- '<LOCALNET>..0.173':27930
- '<LOCALNET>..35.244':27930
- '<LOCALNET>..0.174':27930
- '<LOCALNET>..35.245':27930
- '<LOCALNET>..0.179':27930
- '<LOCALNET>..35.246':27930
- '<LOCALNET>..0.176':27930
- '<LOCALNET>..35.247':27930
- '<LOCALNET>..0.177':27930
- '<LOCALNET>..35.248':27930
- '<LOCALNET>..0.178':27930
- '<LOCALNET>..35.249':27930
- '<LOCALNET>..0.183':27930
- '<LOCALNET>..35.250':27930
- '<LOCALNET>..0.180':27930
- '<LOCALNET>..35.251':27930
- '<LOCALNET>..0.181':27930
- '<LOCALNET>..35.252':27930
- '<LOCALNET>..0.182':27930
- '<LOCALNET>..35.253':27930
- '<LOCALNET>..0.187':27930
- '<LOCALNET>..35.254':27930
- '<LOCALNET>..0.184':27930
- '<LOCALNET>..0.185':27930
- '<LOCALNET>..0.186':27930
- '<LOCALNET>..0.188':27930
- '<LOCALNET>..0.189':27930
- '<LOCALNET>..0.190':27930
- '<LOCALNET>..0.191':27930
- '<LOCALNET>..0.195':27930
- '<LOCALNET>..0.192':27930
- '<LOCALNET>..0.193':27930
- '<LOCALNET>..0.194':27930
- '%WINDIR%\syswow64\gotten.exe' cnyflyknp