Trojan.DownLoader45.7120

Technical Information

To ensure autorun and distribution

Sets the following service settings

[<HKLM>\System\CurrentControlSet\Services\SCardPrv] 'Start' = '00000002'
[<HKLM>\System\CurrentControlSet\Services\SCardPrv] 'ImagePath' = '<SYSTEM32>\svchost.exe -k SCardPrv'
[<HKLM>\SYSTEM\CurrentControlSet\Services\SCardPrv\Parameters] 'ServiceDll' = '<SYSTEM32>\scardprv.dll'
[<HKLM>\System\CurrentControlSet\Services\Wmmvsvc] 'Start' = '00000002'
[<HKLM>\System\CurrentControlSet\Services\Wmmvsvc] 'ImagePath' = '<SYSTEM32>\svchost.exe -k Wmmvsvc'
[<HKLM>\SYSTEM\CurrentControlSet\Services\Wmmvsvc\Parameters] 'ServiceDll' = '<SYSTEM32>\Wmmvsvc.dll'

Creates the following services

'SCardPrv' <SYSTEM32>\svchost.exe -k SCardPrv
'Wmmvsvc' <SYSTEM32>\svchost.exe -k Wmmvsvc

Modifies file system

Creates the following files

%WINDIR%\syswow64\scardprv.dll
%WINDIR%\syswow64\wmmvsvc.dll
<Current directory>\d.bat
%WINDIR%\syswow64\kb25879.dat

Deletes itself.

Network activity

Connects to

'<LOCALNET>.13.1':445
'13#.#5.78.168':445
'11#.#97.223.222':445
'83.##9.101.233':445
'10#.#07.177.139':445
'18#.#21.138.225':445
'23#.#31.55.105':445
'13#.#95.161.34':445
'86.##8.85.228':445
'82.##.184.99':445
'75.##8.39.144':445
'32.##.207.163':445
'18#.#1.55.103':445
'85.##.96.171':445
'13#.#67.196.218':445
'80.##4.11.221':445
'31.##9.34.29':445
'23#.#7.57.94':445
'18#.#1.80.159':445
'13#.#65.103.223':445
'23#.#27.140.216':445
'18#.#02.163.25':445
'13#.#0.186.89':445
'88.##.209.154':445
'37.##8.232.219':445
'13#.#30.13.211':445
'23#.#62.230.228':445
'95.##2.121.113':445
'96.##.142.254':445
'10#.#7.188.82':445
'11#.#7.234.165':445
'3.###.152.170':445
'16#.#49.5.40':445
'15#.#59.215.213':445
'13.##0.127.248':445
'13#.#80.123.46':445
'7.###.97.181':445
'15#.#3.204.14':445
'14#.#4.158.186':445
'9.###.94.104':445
'12#.#04.66.19':445
'15#.#43.194.71':445
'14#.#54.148.244':445
'14#.#55.179.72':445
'13#.#.102.160':445
'11#.#8.10.249':445
'14#.#68.137.45':445
'4.##.218.162':445
'12#.#88.45.134':445
'11#.#99.255.50':445
'10#.#09.209.223':445
'13#.#2.81.19':445
'12#.#03.35.191':445
'11#.#13.245.108':445
'10#.#23.199.24':445
'95.##3.153.197':445
'12#.#7.24.249':445
'12#.#8.56.77':445
'25#.#0.251.217':445
'37.#3.59.85':445
'24#.#7.82.150':445
'19#.#71.105.214':445
'15#.#26.173.244':445
'18#.#95.53.255':445
'54.##9.218.117':445
'5.###.241.182':445
'10#.#55.23.175':445
'52.##9.46.239':445
'3.##.69.48':445
'20#.#22.92.113':445
'16#.#96.115.178':445
'12#.#12.120.208':445
'20#.#33.175.235':445
'15#.#1.198.44':445
'16#.#24.194.233':445
'60.##9.244.173':445
'15#.#5.166.176':445
'10#.#36.48.230':445
'58.#4.71.39':445
'72.##5.126.178':445
'21#.#02.117.168':445
'57.##5.154.161':445
'9.###.177.226':445
'21#.#7.200.34':445
'16#.#31.223.99':445
'11#.#05.246.164':445
'21#.#68.27.156':445
'34.##.221.21':445
'11#.#0.73.30':445
'20#.#52.150.179':445
'14#.#9.122.194':445
'10#.#90.112.187':445
'44.##.57.201':445
'37.##4.143.207':445
'24#.#66.16.192':445
'19#.#6.189.80':445
'19#.#11.145.178':445
'94.##4.234.210':445
'19#.#37.16.202':445
'14#.#11.39.11':445
'92.#9.62.76':445
'43.##3.85.140':445
'24#.#78.108.205':445
'91.##0.145.198':445
'25.#68.6.45':445
'24#.#2.191.71':445
'19#.#06.214.136':445
'79.##7.201.24':445
'24#.#43.18.193':445
'65.##.124.189':445
'14#.#5.64.67':445
'97.##0.87.131':445
'22#.#10.196.78':445
'14#.#46.147.188':445
'97.##0.170.253':445
'48.##.193.62':445
'25#.#13.216.127':445
'20#.#87.239.191':445
'46.##9.20.184':445
'19#.#3.249.208':445
'63.##4.96.95':445
'15#.#45.225.155':445
'16#.#35.15.239':445
'17#.#24.61.66':445
'13#.#4.112.103':445
'74.##.37.142':445
'13#.#90.166.180':445
'20#.#4.40.217':445
'11.##5.170.255':445
'75.#9.44.36':445
'13#.#40.174.74':445
'20#.#6.47.112':445
'15#.#77.149.231':445
'76.##2.51.187':445
'13#.#42.181.224':445
'13#.#88.159.29':445
'20#.#2.33.67':445
'20#.#27.55.6':445
'14#.#44.188.118':445
'20#.#29.62.156':445
'13.##.192.193':445
'75.##6.65.231':445
'13#.#46.195.13':445
'20#.#31.69.50':445
'11.##.199.88':445
'24.##8.182.41':445
'77.##6.73.125':445
'16.##8.136.214':445
'14#.#48.202.163':445
'11.##9.184.43':445
'74.##4.58.81':445
'7.##.248.122':445
'9.###.156.210':445
'20#.#0.7.178':445
'71.##0.234.219':445
'13#.#25.108.1':445
'1.###.38.180':445
'7.###.111.76':445
'70.##2.241.114':445
'13#.#27.115.151':445
'19#.#2.245.189':445
'8.###.119.226':445
'71.##5.248.8':445
'13#.#29.122.46':445
'34.##2.83.51':445
'24#.#26.121.215':445
'21#.#5.32.171':445
'72.#9.0.158':445
'19#.#6.3.234':445
'5.##3.15.23':445
'71.#1.7.53':445
'13#.#81.137.90':445
'20#.#8.10.128':445
'9.###.140.166':445
'72.##.14.203':445
'13#.#83.145.241':445
'19#.#8.19.22':445
'17#.#39.51.124':445
'73.#5.22.97':445
'13#.#86.152.135':445
'13#.#31.129.196':445
'5.###.90.130':445
'20#.#33.76.201':445
'35.##.217.182':445
'17.##6.238.56':445
'21#.#86.53.57':445
'20#.#97.7.229':445
'23#.#0.134.25':445
'19#.#8.197.234':445
'21#.#01.42.114':445
'20#.#11.252.30':445
'61.##6.203.138':445
'22#.#.78.255':445
'19#.#17.41.2':445
'20#.#5.242.88':445
'19#.#5.196.4':445
'39.##0.177.101':445
'21#.#85.21.229':445
'20#.#95.231.145':445
'19#.#05.185.61':445
'18#.#16.139.234':445
'17#.#26.93.150':445
'20#.#09.220.202':445
'13#.#74.119.124':445
'17#.#28.35.178':445
'21#.#2.208.231':445
'16#.#50.37.124':445
'19#.#4.164.176':445
'18#.#4.118.93':445
'15#.#2.9.141':445
'16#.#4.26.181':445
'15#.#5.236.98':445
'22#.#76.99.140':445
'24#.#56.191.51':445
'23#.#66.145.224':445
'21#.#6.63.255':445
'25.##.171.99':445
'76.##8.80.20':445
'14.##.125.15':445
'13#.#3.210.57':445
'6.##.80.188':445
'81.##.95.211':445
'24#.#2.34.104':445
'13.##.213.133':445
'26.##2.161.156':445
'15.##2.115.72':445
'4.###.69.245':445
'25#.#33.23.161':445
'23#.#43.233.78':445
'16.##6.104.130':445
'5.##7.58.46':445
'25#.#47.12.219':445
'24#.#57.222.135':445
'22#.#67.176.52':445
'6.##.48.104':445
'80.#08.42.4':445
'24#.#1.212.192':445
'23#.#2.166.109':445
'22#.#2.120.25':445
'25#.#31.247.77':445
'24#.#01.250.51':445
'23#.#52.155.166':445
'63.##9.83.157':445
'18#.#14.107.150':445
'17#.#15.201.233':445
'22#.#73.165.229':445
'63.##5.179.217':445
'20#.#19.180.104':445
'17.##5.150.54':445
'14#.#19.4.227':445
'12#.#55.83.111':445
'76.##.225.33':445
'13#.#2.194.239':445
'20#.#33.164.189':445
'11.##8.133.139':445
'21.##.218.241':445
'12#.#39.168.47':445
'22#.#09.118.108':445
'82.##.241.204':445
'15#.#4.181.140':445
'76.##8.68.170':445
'16.##3.47.177':445
'11#.#23.253.239':445
'64.##4.192.203':445
'12#.#0.162.153':445
'59.##.42.232':445
'12#.#6.12.182':445
'18#.#38.237.132':445
'25#.#83.207.82':445
'58.##8.176.33':445
'16#.#00.190.52':445
'55.##5.26.61':445
'19#.#47.148.18':445
'13#.#3.28.97':445
'25#.#05.125.97':445
'85.##.135.175':445
'23.##1.166.225':445
'49.##8.125.111':445
'11#.#4.94.62':445
'17#.9.64.12':445
'23#.#10.33.218':445
'17#.#42.170.40':445
'23#.#87.139.247':445
'43.##2.109.197':445
'71.##.147.26':445
'17#.#3.48.97':445
'10#.#4.184.176':445
'24#.16.90.8':445
'22#.#01.123.76':445
'24#.#73.155.161':445
'37.##6.92.26':445
'35.##3.198.55':445
'15#.#68.5.164':445
'16#.#3.137.211':445
'11#.#07.161.31':445
'31.##0.76.111':445
'21#.#92.212.190':445
'29.##7.182.140':445
'91.##.151.90':445
'15#.#7.121.40':445
'21#.#29.91.246':445
'15#.#.227.69':445
'19#.#96.19.168':445
'10#.#1.62.232':445
'11#.#0.251.12':445
'13#.#8.69.229':445
'24#.#97.191.168':445
'96.##.246.250':445
'57.##7.175.50':445
'21.#51.51.4':445
'72.##.171.129':445
'85.##.20.210':445
'20#.#56.33.7':445
'85.##.166.208':445
'10#.#.162.31':445
'80.##.126.239':445
'20#.#11.181.20':445
'21#.#2.176.99':445
'22#.#3.172.178':445
'24#.#20.167.2':445
'5.###.163.81':445
'10#.#6.181.69':445
'12#.#33.177.149':445
'13#.#84.172.228':445
'22#.#1.227.24':445
'16#.#7.163.130':445
'11.##7.182.119':445
'50.##3.18.115':445
'39.##.173.21':445
'53.##.169.100':445
'68.#.164.180':445
'16#.#12.183.168':445
'26.##9.247.118':445
'12#.#74.71.205':445
'22#.#70.150.36':445
'16.#1.54.1':445
'15#.#.111.104':445
'42.##6.180.226':445
'19#.#5.161.238':445
'23#.#74.40.197':445
'48.##.147.117':445
'11#.#25.178.83':445
'17#.#.205.47':445
'10#.#1.85.126':445
'17#.#42.54.76':445
'23#.#88.24.26':445
'44.##3.249.232':445
'10#.#8.219.182':445
'39.#10.99.5':445
'23#.#9.211.60':445
'16#.#.38.161':445
'22#.#01.8.111':445
'38.##7.233.61':445
'22#.#78.113.140':445
'33.##4.83.90':445
'97.#9.52.40':445
'15#.#4.22.246':445
'22#.#15.248.196':445
'17#.#28.19.3':445
'21#.#92.97.225':445
'27.##7.67.175':445
'91.##.36.125':445
'16#.#83.170.80':445
'15#.28.6.75':445
'18#.#34.165.159':445
'86.##.142.154':445
'11#.#71.157.152':445
'19#.#15.230.144':445
'54.##1.19.83':445
'24#.#96.50.132':445
'24#.#29.100.85':445
'10#.#21.203.225':445
'25#.#14.157.109':445
'92.##9.175.140':445
'21#.#0.162.225':445
'83.##7.148.55':445
'19#.#09.251.195':445
'16#.#37.24.96':445
'18#.#07.223.110':445
'15#.#09.195.134':445
'17#.#05.195.24':445
'5.###.128.170':445
'21#.#14.0.225':445
'24.##7.43.164':445
'13#.#6.1.165':445
'4.###.243.250':445
'11#.#85.90.134':445
'10#.#6.219.5':445
'10#.#83.62.49':445
'22#.#4.48.134':445
'98.##.220.191':445
'19#.#73.138.104':445
'14#.#8.210.154':445
'18#.#71.110.18':445
'56.##.96.104':445
'14#.#8.29.250':445
'14.##5.15.79':445
'13#.#04.142.85':445
'15.##3.156.0':445
'16#.#41.52.115':445
'22#.#37.225.90':445
'16#.#12.248.155':445
'21#.#0.147.137':445
'21#.#48.53.212':445
'16#.#6.76.21':445
'12#.#41.99.85':445
'25#.#2.241.5':445
'71.##5.122.150':445
'11#.#39.227.91':445
'16#.#77.159.143':445
'24#.#0.213.176':445
'11#.#51.182.207':445
'14.##.202.25':445
'95.#.60.60':445
'21#.#29.47.146':445
'20.##4.228.81':445
'85.#.33.231':445
'22#.#18.251.146':445
'20#.#27.19.60':445
'24#.#2.138.245':445
'75.##4.5.146':445
'18.##4.55.203':445
'18#.#46.108.30':445
'49.##7.94.115':445
'17#.#43.80.201':445
'39.##4.66.30':445
'54.##5.16.177':445
'70.##.189.18':445
'31.##1.185.73':445
'15#.#2.172.159':445
'21.##9.158.244':445
'28.##.159.233':445
'13#.#6.7.117':445
'11#.#49.202.238':445
'12#.#4.235.32':445
'24#.#01.221.117':445
'11#.#2.207.202':445
'22#.#4.54.87':445
'89.##1.40.172':445
'21#.62.27.1':445
'80.##9.13.87':445
'20#.#0.255.172':445
'56.#02.56.1':445
'17#.#79.88.142':445
'45.##.74.227':445
'16#.#76.60.56':445
'25#.#82.66.47':445
'35.##.46.142':445
'60.##8.35.253':445
'14#.#9.150.26':445
'12#.#3.5.203':445
'11.##6.136.111':445
'55.##4.141.26':445
'23.##2.197.122':445
'11#.#0.111.232':445
'1.###.108.26':445
'18#.#51.80.182':445
'12#.#5.94.111':445
'16#.#13.173.147':445
'15.##9.119.159':445
'38.##.187.62':445
'48.##.215.147':445
'14#.#0.144.73':445
'11.##7.130.159':445
'11#.#49.233.43':445
'22.##9.128.254':445
'20.##5.214.145':445
'16.##1.43.36':445
'99.##4.177.128':445
'20#.#36.25.13':445
'73.#.11.98':445
'24#.#53.183.228':445
'65.#.239.13':445
'18#.#32.225.98':445
'39.##4.72.238':445
'16#.#51.58.68':445
'29.##2.44.153':445
'15#.#49.31.238':445
'19.##0.17.68':445
'24#.#60.56.111':445
'24#.#39.106.37':445
'11#.#10.92.123':445
'25#.#24.163.61':445
'10#.#08.64.37':445
'16#.#68.178.181':445
'82.##7.154.7':445
'16#.#40.92.220':445
'11#.#4.235.97':445
'19#.#6.112.7':445
'25#.#97.251.166':445
'99.##4.183.81':445
'13#.#23.101.107':445
'69.##0.11.202':445
'<LOCALNET>.13.155':445
'<LOCALNET>.13.153':445
'<LOCALNET>.13.157':445
'<LOCALNET>.13.162':445
'<LOCALNET>.13.161':445
'<LOCALNET>.13.159':445
'<LOCALNET>.13.163':445
'<LOCALNET>.13.164':445
'<LOCALNET>.13.165':445
'<LOCALNET>.13.166':445
'<LOCALNET>.13.167':445
'<LOCALNET>.13.151':445
'<LOCALNET>.13.160':445
'<LOCALNET>.13.168':445
'<LOCALNET>.13.172':445
'<LOCALNET>.13.171':445
'<LOCALNET>.13.173':445
'<LOCALNET>.13.175':445
'<LOCALNET>.13.174':445
'<LOCALNET>.13.176':445
'<LOCALNET>.13.178':445
'<LOCALNET>.13.177':445
'<LOCALNET>.13.179':445
'<LOCALNET>.13.180':445
'<LOCALNET>.13.181':445
'<LOCALNET>.13.169':445
'<LOCALNET>.13.170':445
'<LOCALNET>.13.158':445
'<LOCALNET>.13.149':445
'<LOCALNET>.13.147':445
'<LOCALNET>.13.130':445
'<LOCALNET>.13.132':445
'<LOCALNET>.13.134':445
'<LOCALNET>.13.136':445
'<LOCALNET>.13.138':445
'<LOCALNET>.13.140':445
'<LOCALNET>.13.123':445
'<LOCALNET>.13.142':445
'<LOCALNET>.13.144':445
'<LOCALNET>.13.146':445
'<LOCALNET>.13.148':445
'<LOCALNET>.13.150':445
'<LOCALNET>.13.128':445
'<LOCALNET>.13.152':445
'<LOCALNET>.13.156':445
'<LOCALNET>.13.125':445
'<LOCALNET>.13.127':445
'<LOCALNET>.13.129':445
'<LOCALNET>.13.131':445
'<LOCALNET>.13.133':445
'<LOCALNET>.13.135':445
'<LOCALNET>.13.137':445
'<LOCALNET>.13.139':445
'<LOCALNET>.13.141':445
'<LOCALNET>.13.143':445
'<LOCALNET>.13.145':445
'<LOCALNET>.13.154':445
'<LOCALNET>.13.182':445
'<LOCALNET>.13.184':445
'<LOCALNET>.13.183':445
'<LOCALNET>.13.185':445
'<LOCALNET>.13.217':445
'<LOCALNET>.13.219':445
'<LOCALNET>.13.218':445
'<LOCALNET>.13.220':445
'<LOCALNET>.13.222':445
'<LOCALNET>.13.224':445
'<LOCALNET>.13.226':445
'<LOCALNET>.13.228':445
'<LOCALNET>.13.230':445
'<LOCALNET>.13.232':445
'<LOCALNET>.13.221':445
'<LOCALNET>.13.223':445
'<LOCALNET>.13.225':445
'<LOCALNET>.13.227':445
'<LOCALNET>.13.231':445
'<LOCALNET>.13.233':445
'<LOCALNET>.13.229':445
'<LOCALNET>.13.234':445
'<LOCALNET>.13.235':445
'<LOCALNET>.13.236':445
'<LOCALNET>.13.237':445
'<LOCALNET>.13.238':445
'<LOCALNET>.13.239':445
'<LOCALNET>.13.240':445
'<LOCALNET>.13.242':445
'<LOCALNET>.13.244':445
'<LOCALNET>.13.241':445
'<LOCALNET>.13.216':445
'<LOCALNET>.13.214':445
'<LOCALNET>.13.215':445
'<LOCALNET>.13.213':445
'<LOCALNET>.13.186':445
'<LOCALNET>.13.188':445
'<LOCALNET>.13.190':445
'<LOCALNET>.13.187':445
'<LOCALNET>.13.192':445
'<LOCALNET>.13.189':445
'<LOCALNET>.13.191':445
'<LOCALNET>.13.193':445
'<LOCALNET>.13.194':445
'<LOCALNET>.13.195':445
'<LOCALNET>.13.196':445
'<LOCALNET>.13.198':445
'<LOCALNET>.13.200':445
'<LOCALNET>.13.197':445
'<LOCALNET>.13.199':445
'<LOCALNET>.13.201':445
'<LOCALNET>.13.202':445
'<LOCALNET>.13.203':445
'<LOCALNET>.13.204':445
'<LOCALNET>.13.206':445
'<LOCALNET>.13.205':445
'<LOCALNET>.13.208':445
'<LOCALNET>.13.207':445
'<LOCALNET>.13.210':445
'<LOCALNET>.13.209':445
'<LOCALNET>.13.211':445
'<LOCALNET>.13.212':445
'<LOCALNET>.13.243':445
'<LOCALNET>.13.126':445
'<LOCALNET>.13.124':445
'<LOCALNET>.13.122':445
'<LOCALNET>.13.60':445
'<LOCALNET>.13.62':445
'<LOCALNET>.13.64':445
'<LOCALNET>.13.66':445
'<LOCALNET>.13.68':445
'<LOCALNET>.13.70':445
'<LOCALNET>.13.72':445
'<LOCALNET>.13.84':445
'<LOCALNET>.13.9':445
'<LOCALNET>.13.11':445
'<LOCALNET>.13.74':445
'<LOCALNET>.13.56':445
'<LOCALNET>.13.58':445
'<LOCALNET>.13.76':445
'<LOCALNET>.13.82':445
'<LOCALNET>.13.86':445
'<LOCALNET>.13.88':445
'<LOCALNET>.13.90':445
'<LOCALNET>.13.92':445
'<LOCALNET>.13.94':445
'<LOCALNET>.13.96':445
'<LOCALNET>.13.98':445
'<LOCALNET>.13.100':445
'<LOCALNET>.13.13':445
'<LOCALNET>.13.15':445
'<LOCALNET>.13.78':445
'<LOCALNET>.13.80':445
'<LOCALNET>.13.54':445
'<LOCALNET>.13.52':445
'<LOCALNET>.13.50':445
'<LOCALNET>.13.2':445
'<LOCALNET>.13.5':445
'<LOCALNET>.13.6':445
'<LOCALNET>.13.8':445
'<LOCALNET>.13.10':445
'<LOCALNET>.13.12':445
'<LOCALNET>.13.14':445
'<LOCALNET>.13.16':445
'<LOCALNET>.13.4':445
'<LOCALNET>.13.18':445
'<LOCALNET>.13.20':445
'<LOCALNET>.13.22':445
'<LOCALNET>.13.3':445
'<LOCALNET>.13.24':445
'<LOCALNET>.13.28':445
'<LOCALNET>.13.30':445
'<LOCALNET>.13.32':445
'<LOCALNET>.13.34':445
'<LOCALNET>.13.36':445
'<LOCALNET>.13.38':445
'<LOCALNET>.13.40':445
'<LOCALNET>.13.44':445
'<LOCALNET>.13.46':445
'<LOCALNET>.13.42':445
'<LOCALNET>.13.7':445
'<LOCALNET>.13.48':445
'<LOCALNET>.13.26':445
'<LOCALNET>.13.17':445
'<LOCALNET>.13.19':445
'<LOCALNET>.13.21':445
'<LOCALNET>.13.23':445
'<LOCALNET>.13.87':445
'<LOCALNET>.13.89':445
'<LOCALNET>.13.91':445
'<LOCALNET>.13.93':445
'<LOCALNET>.13.95':445
'<LOCALNET>.13.97':445
'<LOCALNET>.13.99':445
'<LOCALNET>.13.101':445
'<LOCALNET>.13.103':445
'<LOCALNET>.13.105':445
'<LOCALNET>.13.107':445
'<LOCALNET>.13.109':445
'<LOCALNET>.13.104':445
'<LOCALNET>.13.102':445
'<LOCALNET>.13.106':445
'<LOCALNET>.13.108':445
'<LOCALNET>.13.110':445
'<LOCALNET>.13.111':445
'<LOCALNET>.13.113':445
'<LOCALNET>.13.115':445
'<LOCALNET>.13.117':445
'<LOCALNET>.13.119':445
'<LOCALNET>.13.121':445
'<LOCALNET>.13.112':445
'<LOCALNET>.13.114':445
'<LOCALNET>.13.116':445
'<LOCALNET>.13.118':445
'<LOCALNET>.13.85':445
'<LOCALNET>.13.81':445
'<LOCALNET>.13.83':445
'<LOCALNET>.13.79':445
'<LOCALNET>.13.25':445
'<LOCALNET>.13.27':445
'<LOCALNET>.13.29':445
'<LOCALNET>.13.31':445
'<LOCALNET>.13.33':445
'<LOCALNET>.13.35':445
'<LOCALNET>.13.37':445
'<LOCALNET>.13.39':445
'<LOCALNET>.13.41':445
'<LOCALNET>.13.43':445
'<LOCALNET>.13.45':445
'<LOCALNET>.13.47':445
'<LOCALNET>.13.49':445
'<LOCALNET>.13.51':445
'<LOCALNET>.13.53':445
'<LOCALNET>.13.55':445
'<LOCALNET>.13.57':445
'<LOCALNET>.13.59':445
'<LOCALNET>.13.61':445
'<LOCALNET>.13.63':445
'<LOCALNET>.13.65':445
'<LOCALNET>.13.67':445
'<LOCALNET>.13.69':445
'<LOCALNET>.13.71':445
'<LOCALNET>.13.73':445
'<LOCALNET>.13.75':445
'<LOCALNET>.13.77':445
'<LOCALNET>.13.120':445
'10#.#06.109.160':445
'7.##.97.32':445
'<LOCALNET>.13.248':445
'15#.#10.93.213':445
'16#.#25.184.24':445
'18#.#41.18.92':445
'11#.#09.159.9':445
'21#.#73.199.226':445
'12#.#20.58.15':445
'14#.#35.148.82':445
'21#.#39.149.61':445
'17#.#1.73.216':445
'19#.#7.164.28':445
'10#.#3.23.72':445
'21#.#7.144.102':445
'23#.#3.235.169':445
'12#.#9.113.139':445
'17#.#37.128.85':445
'89.##3.243.129':445
'10#.#99.78.196':445
'12#.#15.168.8':445
'60.##0.136.221':445
'15#.#47.93.142':445
'25.##8.187.197':445
'85.##.42.254':445
'10#.#9.133.65':445
'11#.#5.223.132':445
'13#.#01.57.200':445
'14#.#05.203.206':445
'15#.#21.38.18':445
'20#.#1.54.34':445
'18#.#5.219.223':445
'17#.#.129.156':445
'10#.#71.191.81':445
'16.##8.50.125':445
'55.##2.249.105':445
'49.##0.231.4':445
'64.#.66.71':445
'80.##.156.138':445
'25#.#2.15.182':445
'10#.#05.250.143':445
'29.##3.196.61':445
'10#.#0.128.104':445
'60.##5.121.195':445
'23#.#82.235.240':445
'84.##5.101.14':445
'24#.#98.70.51':445
'25.##9.251.186':445
'40.##5.85.253':445
'21#.#6.200.41':445
'22#.#2.34.108':445
'24#.#7.125.176':445
'5.##.215.243':445
'19.#9.50.54':445
'19#.#46.164.99':445
'8.###.104.182':445
'22#.#77.89.233':445
'23#.#93.180.44':445
'1.###.14.111':445
'8.###.160.118':445
'50.##7.172.244':445
'64.#63.7.55':445
'81.##9.97.122':445
'98.##5.188.190':445
'67.##7.176.41':445
'13#.#2.50.79':445
'19#.#52.180.116':445
'3.##.54.154':445
'68.##8.184.191':445
'13#.#4.57.229':445
'19#.#55.187.11':445
'4.##.61.48':445
'67.##0.191.86':445
'13#.#4.65.123':445
'19#.#57.194.161':445
'14.##.50.204':445
'68.##2.198.236':445
'13#.#6.72.17':445
'19#.#07.202.55':445
'6.##.75.93':445
'23#.#05.130.25':445
'13#.#8.79.168':445
'13#.#09.205.98':445
'5.##.83.243':445
'70.##6.212.25':445
'13#.#1.86.62':445
'19#.#11.216.100':445
'6.##.90.137':445
'69.##6.220.175':445
'13#.#3.93.213':445
'17#.#23.250.225':445
'21#.#01.85.86':445
'20#.#85.251.19':445
'4.##.47.3':445
'19#.#50.173.222':445
'11#.#11.22.1':445
'29.#.137.45':445
'46.##.227.113':445
'61.##.62.180':445
'77.##.152.247':445
'94.##.243.58':445
'9.###.101.103':445
'26.##7.192.170':445
'40.##3.26.237':445
'57.##9.117.48':445
'74.##5.207.116':445
'24#.#21.66.160':445
'5.###.156.227':445
'20.##3.247.38':445
'37.##.81.106':445
'67.##3.161.252':445
'53.##.172.173':445
'13#.8.35.34':445
'22#.#5.30.217':445
'19#.#48.166.71':445
'23#.#1.121.29':445
'2.###.38.109':445
'2.###.211.96':445
'66.##5.168.147':445
'16.##3.46.163':445
'13#.#0.43.184':445
'33.##9.136.230':445
'<LOCALNET>.13.245':445
'70.##8.227.69':445
'53.##4.176.135':445
'36.##8.86.68':445
'96.#16.72.1':445
'11#.#80.13.10':445
'46.#0.33.24':445
'15#.#11.25.223':445
'25#.#8.133.235':445
'10#.#41.242.246':445
'20#.#78.94.2':445
'51.##5.203.13':445
'15#.#36.195.213':445
'5.##.47.224':445
'10#.#0.156.235':445
'14#.#6.111.234':445
'24#.#3.220.246':445
'20#.#03.8.247':445
'20#.#62.255.166':445
'11#.#4.70.224':445
'21#.#27.178.236':445
'61.##4.30.247':445
'16#.#85.23.191':445
'15.##2.131.202':445
'11#.#9.239.214':445
'21#.#52.92.225':445
'66.##9.200.236':445
'17#.#10.192.180':445
'20.##7.45.191':445
'56.##9.117.2':445
'16#.#60.109.202':445
'41.##.119.35':445
'19#.#29.11.24':445
'91.##2.158.12':445
'<LOCALNET>.13.249':445
'<LOCALNET>.13.250':445
'<LOCALNET>.13.251':445
'<LOCALNET>.13.252':445
'<LOCALNET>.13.254':445
'<LOCALNET>.13.253':445
'73.##.247.56':445
'17#.#0.99.67':445
'23.##3.208.79':445
'12#.#44.200.22':445
'23#.#81.52.34':445
'78.##8.161.45':445
'<LOCALNET>.13.247':445
'18#.#5.13.56':445
'13#.#2.114.11':445
'23#.#05.222.23':445
'83.##2.74.34':445
'18#.#9.183.45':445
'33.#6.35.57':445
'13#.37.27.0':445
'24#.#30.136.12':445
'88.##7.244.23':445
'19#.#04.97.34':445
'36.##.205.46':445
'14#.#2.197.245':445
'38.#34.95.5':445
'28.##7.121.68':445
'12#.#4.153.203':445
'22#.#1.6.214':445
'71.##4.114.225':445
'17#.#34.106.169':445
'15#.#.62.126':445
'4.###.171.138':445
'10#.#30.23.149':445
'21#.#51.15.92':445
'60.##.124.104':445
'16#.#5.232.115':445
'9.###.85.127':445
'12#.#6.117.30':445
'11#.#55.193.138':445
'14#.#2.207.97':445
'21#.#76.185.81':445
'16#.#7.42.165':445
'65.##3.38.93':445
'77.##4.157.209':445
'16#.#0.146.104':445
'94.##0.247.20':445
'15.##3.254.116':445
'10#.#76.81.88':445
'11#.#80.107.127':445
'12#.#92.172.155':445
'22#.#00.99.70':445
'14#.#07.6.222':445
'70.##7.207.82':445
'57.##4.121.10':445
'73.##.212.78':445
'88.##.46.145':445
'10#.#5.136.212':445
'55.##.210.115':445
'<LOCALNET>.13.246':445
'20#.#26.101.103':445
'25#.#69.1.148':445
'25.##1.215.180':445
'21#.#7.192.239':445
'22#.#5.176.203':445
'76.##8.28.214':445
'18#.#.20.158':445
'30.##6.129.169':445
'13#.#33.237.181':445
'23#.#0.89.192':445
'81.#.198.204':445
'18#.#8.190.147':445
'35.##1.42.158':445
'13#.#58.151.170':445
'37.##8.188.117':445
'86.##.112.193':445
'17#.#04.136.234':445
'40.##5.212.147':445
'14#.#82.65.159':445
'24#.#19.173.170':445
'91.##.26.182':445
'19#.#7.18.125':445
'45.##.126.137':445
'14#.#07.235.148':445
'24#.#44.87.159':445
'96.##.195.171':445
'20#.#02.188.114':445
'50.##.40.126':445
'15#.#32.148.137':445
'12#.#1.227.23':445
'74.##.184.218':445

TCP

Other

'<LOCALNET>.13.67':445
'<LOCALNET>.13.67':49258
'<LOCALNET>.13.67':49275
'<LOCALNET>.13.67':49276
'<LOCALNET>.13.67':49277
'<LOCALNET>.13.67':49278

Miscellaneous

Creates and executes the following

'%WINDIR%\syswow64\cmd.exe' /c d.bat "<Full path to file>"' (with hidden window)

Executes the following

'%WINDIR%\syswow64\svchost.exe' -k SCardPrv
'%WINDIR%\syswow64\svchost.exe' -k Wmmvsvc
'%WINDIR%\syswow64\cmd.exe' /c d.bat "<Full path to file>"

Технологии

Термины

Обучение и просвещение

Мифы

Technical Information

Рекомендации по лечению

Демо бесплатно на 14 дней