Trojan.DownLoader45.11310

Technical Information

To ensure autorun and distribution

Sets the following service settings

[<HKLM>\System\CurrentControlSet\Services\SCardPrv] 'Start' = '00000002'
[<HKLM>\System\CurrentControlSet\Services\SCardPrv] 'ImagePath' = '<SYSTEM32>\svchost.exe -k SCardPrv'
[<HKLM>\SYSTEM\CurrentControlSet\Services\SCardPrv\Parameters] 'ServiceDll' = '<SYSTEM32>\scardprv.dll'
[<HKLM>\System\CurrentControlSet\Services\Wmmvsvc] 'Start' = '00000002'
[<HKLM>\System\CurrentControlSet\Services\Wmmvsvc] 'ImagePath' = '<SYSTEM32>\svchost.exe -k Wmmvsvc'
[<HKLM>\SYSTEM\CurrentControlSet\Services\Wmmvsvc\Parameters] 'ServiceDll' = '<SYSTEM32>\Wmmvsvc.dll'

Creates the following services

'SCardPrv' <SYSTEM32>\svchost.exe -k SCardPrv
'Wmmvsvc' <SYSTEM32>\svchost.exe -k Wmmvsvc

Modifies file system

Creates the following files

%WINDIR%\syswow64\scardprv.dll
%WINDIR%\syswow64\wmmvsvc.dll
<Current directory>\d.bat
%WINDIR%\syswow64\kb25879.dat

Deletes itself.

Network activity

Connects to

'<LOCALNET>.53.1':445
'21#.#25.149.30':445
'34.##.191.28':445
'20#.#35.103.203':445
'24#.#54.214.93':445
'19#.#45.57.119':445
'19#.#28.237.158':445
'18#.#56.11.36':445
'34.##0.18.150':445
'21#.#9.139.88':445
'23#.#.41.215':445
'13#.#87.145.155':445
'20#.49.93.4':445
'83.#.168.219':445
'66.##.177.72':445
'91.##1.110.153':445
'18#.#93.147.146':445
'14#.#2.170.210':445
'89.##.193.19':445
'40.##0.216.84':445
'24#.#34.239.148':445
'89.##7.20.141':445
'40.##.43.206':445
'24#.#9.66.14':445
'19#.#63.89.79':445
'18#.#3.64.24':445
'14#.#37.112.144':445
'14#.#57.87.88':445
'22#.#15.195.114':445
'18#.#8.62.251':445
'20#.#21.114.145':445
'7.##.186.104':445
'25#.#7.140.20':445
'24#.#7.94.193':445
'16.##7.222.245':445
'5.###.176.161':445
'25#.#.130.78':445
'24#.#1.84.250':445
'19.##.167.141':445
'6.###.165.219':445
'13#.#19.135.201':445
'24#.#81.73.52':445
'26.#6.22.15':445
'23#.#92.27.224':445
'25#.#5.109.192':445
'24#.#6.63.109':445
'23#.#06.17.25':445
'22#.#16.227.198':445
'21#.#26.181.114':445
'24#.#0.52.166':445
'23#.20.6.83':445
'22#.#0.216.255':445
'21#.#1.170.172':445
'20#.#1.124.88':445
'23#.#90.252.140':445
'22#.#00.206.56':445
'22#.#02.237.141':445
'21#.#11.160.229':445
'16#.#6.110.235':445
'15.##.232.188':445
'24#.#00.149.136':445
'46.##1.241.139':445
'55.##1.30.104':445
'6.##.53.169':445
'21#.#14.76.234':445
'16#.#88.98.43':445
'11#.#.121.107':445
'20#.#24.159.100':445
'16#.#3.182.165':445
'16#.#16.178.98':445
'11#.#90.200.163':445
'68.#.223.227':445
'19.##.246.36':445
'6.###.225.47':445
'21#.#.248.112':445
'22#.#57.13.101':445
'22#.#2.97.223':445
'17#.#6.120.31':445
'22#.#43.96.97':445
'22#.#22.180.89':445
'63.##3.153.172':445
'12#.#5.226.218':445
'73.##.249.27':445
'25.##3.16.92':445
'12#.#25.53.84':445
'73.##0.76.149':445
'24.##.99.214':445
'67.##9.51.93':445
'19.##3.74.158':445
'55.##1.202.238':445
'15#.#18.156.109':445
'14#.#32.29.11':445
'14#.#03.23.132':445
'94.##.46.197':445
'46.#5.69.5':445
'25#.#69.92.70':445
'11.##4.135.42':445
'43.##6.152.127':445
'24#.#4.175.192':445
'20#.#8.198.1':445
'15#.#73.221.65':445
'15#.#44.130.96':445
'13#.#5.123.179':445
'14#.#7.48.187':445
'10#.#01.71.252':445
'51.##6.94.61':445
'3.###.117.126':445
'10#.#12.154.118':445
'12#.#83.226.199':445
'25#.#04.200.248':445
'20#.#79.223.56':445
'15#.#53.246.121':445
'16#.#7.114.31':445
'21.##.187.65':445
'15#.#08.73.243':445
'10#.#82.96.52':445
'57.#.119.116':445
'19#.#8.172.201':445
'95.##6.218.75':445
'14#.#2.195.10':445
'17#.#5.156.63':445
'15#.#22.75.94':445
'17#.#66.145.87':445
'16#.#95.245.246':445
'22#.#31.69.26':445
'32.##.199.64':445
'96.##6.73.101':445
'16#.#49.202.139':445
'22#.#34.76.176':445
'33.##.206.214':445
'97.##9.80.251':445
'16#.#3.210.33':445
'15#.#45.188.94':445
'22#.#36.83.71':445
'98.##1.87.146':445
'96.##6.65.207':445
'16#.#5.217.183':445
'35.#2.220.3':445
'98.##3.94.40':445
'16#.#7.224.78':445
'22#.#88.98.115':445
'35.##.229.153':445
'37.##4.67.121':445
'99.##5.101.191':445
'27.##5.21.38':445
'16#.#9.231.228':445
'34.##.213.108':445
'95.##4.58.57':445
'22#.#90.106.10':445
'22#.#86.91.221':445
'57.##2.169.255':445
'32.##0.184.19':445
'22#.#27.55.237':445
'21#.#9.29.98':445
'20.##9.159.136':445
'84.##.33.173':445
'14#.#37.162.211':445
'13#.#04.252.24':445
'21.##2.166.30':445
'85.#6.40.68':445
'14#.#87.170.105':445
'21#.#3.43.143':445
'22.##4.173.180':445
'86.##.47.218':445
'84.##0.25.23':445
'14#.#89.177.0':445
'21.##6.180.75':445
'85.##.54.112':445
'15#.#91.184.150':445
'21#.#5.58.187':445
'23.##6.188.225':445
'86.#2.61.7':445
'14#.#93.191.44':445
'22#.#7.47.87':445
'31.##8.177.125':445
'96.##2.51.162':445
'16#.#43.181.200':445
'16.##5.231.210':445
'21#.#3.51.37':445
'19.##7.152.241':445
'8.###.185.127':445
'35.##.236.47':445
'22#.#23.194.137':445
'99.##5.110.85':445
'20#.#44.102.225':445
'35.##.142.10':445
'22#.#37.183.194':445
'21#.#47.137.110':445
'20#.#58.91.27':445
'19#.#68.45.199':445
'18#.#78.255.116':445
'21#.#2.127.168':445
'12#.#1.84.34':445
'19#.82.35.1':445
'18#.#2.245.173':445
'17#.#03.199.90':445
'66.##.141.200':445
'11#.#53.33.50':445
'18#.#.234.230':445
'17#.#7.188.147':445
'16#.#7.142.63':445
'19#.#67.13.115':445
'18#.#77.223.32':445
'17#.#87.177.204':445
'16#.#97.132.121':445
'15#.#07.86.37':445
'18#.#1.213.89':445
'17#.#01.167.6':445
'16#.#11.121.178':445
'23#.#13.240.220':445
'54.##2.168.47':445
'21#.#33.148.53':445
'10#.#6.179.174':445
'22#.#2.122.22':445
'22#.#29.62.132':445
'27.#9.10.95':445
'16#.#2.239.122':445
'17.##.220.12':445
'22#.#92.113.160':445
'8.##.175.184':445
'36.##.243.198':445
'25#.#09.129.101':445
'24#.#20.83.17':445
'18.#.210.69':445
'7.##.164.241':445
'25#.#4.118.158':445
'24#.#4.72.74':445
'23#.#4.26.247':445
'8.###.153.43':445
'25#.#94.107.215':445
'24#.#04.61.132':445
'23#.#14.15.48':445
'22#.#24.225.221':445
'25#.#08.97.17':445
'24#.#18.51.189':445
'23#.#28.5.105':445
'22#.#39.215.22':445
'21#.#49.169.194':445
'24#.#2.40.246':445
'23#.#3.250.163':445
'21#.#3.158.252':445
'25#.#95.139.43':445
'22#.#3.204.79':445
'13#.#47.227.11':445
'22.##8.182.80':445
'12#.#17.155.180':445
'15#.#51.236.0':445
'11#.#4.4.209':445
'5.###.56.184':445
'24#.#40.199.109':445
'53.##6.169.59':445
'11#.#31.138.9':445
'50.##.88.124':445
'12#.#86.99.20':445
'17#.#3.214.244':445
'23#.#54.183.194':445
'59.##2.185.230':445
'47.##0.153.144':445
'18#.#2.124.130':445
'45.##6.2.173':445
'16#.#7.197.73':445
'23#.#2.167.23':445
'16#.#4.47.102':445
'22#.#45.17.52':445
'39.##0.242.2':445
'10#.#36.212.208':445
'16#.#1.181.159':445
'96.##2.61.237':445
'16#.#8.31.187':445
'17#.#05.104.149':445
'23#.#31.33.223':445
'25#.#27.215.24':445
'10#.#22.228.123':445
'11.##6.74.120':445
'15#.#51.236.207':445
'13#.#2.88.181':445
'91.##3.38.88':445
'24.##4.175.166':445
'86.##0.144.117':445
'15#.#5.114.67':445
'21#.#0.83.17':445
'21.##1.53.223':445
'20#.#.189.46':445
'18.##8.158.252':445
'80.##3.128.202':445
'14#.#9.97.152':445
'20#.#4.67.102':445
'14#.#6.203.181':445
'27.##7.69.138':445
'18#.#73.131.47':445
'74.##7.112.31':445
'13#.#13.81.237':445
'71.##4.217.60':445
'13#.#9.187.10':445
'18#.#56.216.239':445
'6.###.126.166':445
'13#.#6.116.106':445
'1.###.232.195':445
'65.##8.201.145':445
'73.##1.95.113':445
'17#.#40.45.174':445
'24#.#1.74.99':445
'36.##2.81.108':445
'49.##2.43.49':445
'11#.#97.13.255':445
'17#.#42.238.205':445
'97.##4.3.210':445
'20#.#7.98.42':445
'11#.#05.254.34':445
'16.##.68.248':445
'21#.#9.17.22':445
'20#.#4.204.71':445
'22#.#1.13.101':445
'11.##.173.21':445
'24#.#18.8.181':445
'36.##3.227.106':445
'1.##9.4.4':445
'15.##0.255.83':445
'11#.#30.18.71':445
'13#.#82.14.151':445
'14#.#33.9.230':445
'16#.84.5.53':445
'17#.#5.0.132':445
'21.##6.19.121':445
'36.##.15.200':445
'51.#8.10.23':445
'64.##5.6.103':445
'79.##6.1.182':445
'18#.#1.20.170':445
'40.##.250.136':445
'14#.#1.73.223':445
'22#.#70.6.152':445
'23#.#21.2.231':445
'14#.#51.129.92':445
'21#.#6.99.187':445
'21#.#7.22.204':445
'67.#6.12.52':445
'10#.#74.118.28':445
'17#.#19.88.234':445
'23#.#4.57.184':445
'43.##.27.134':445
'13#.#52.84.216':445
'40.##2.133.163':445
'21#.#02.113.161':445
'16#.#33.72.63':445
'22#.#8.41.13':445
'37.##.11.219':445
'22#.#5.147.42':445
'34.#.116.248':445
'96.##2.86.198':445
'16#.#47.55.148':445
'22#.#2.25.99':445
'15#.#24.161.177':445
'21#.#9.131.127':445
'28.##.100.77':445
'90.##5.70.28':445
'15#.#61.39.234':445
'87.##2.175.56':445
'15#.#38.145.6':445
'21#.#3.114.213':445
'22.##.84.163':445
'20#.#4.113.225':445
'54.##4.16.229':445
'17.#.190.191':445
'81.##6.159.142':445
'21#.#07.86.3':445
'14#.#34.155.61':445
'93.##.100.174':445
'15#.#39.90.240':445
'20#.#31.21.39':445
'77.#.8.124':445
'19#.#29.250.209':445
'51.##1.97.94':445
'17#.#48.83.179':445
'41.#19.69.8':445
'16#.#46.55.94':445
'33.##7.41.179':445
'13#.#09.145.63':445
'6.###.131.149':445
'11#.#41.202.240':445
'12#.#07.117.234':445
'87.#.35.209':445
'24#.#9.149.12':445
'94.##4.178.118':445
'22#.#64.204.56':445
'84.##1.150.33':445
'9.###.95.250':445
'19#.#40.2.100':445
'18#.#11.226.88':445
'50.##.212.173':445
'17#.#09.198.3':445
'40.##.184.88':445
'14#.#2.31.228':445
'25#.#34.103.63':445
'24#.#4.216.154':445
'22#.#7.192.33':445
'12#.#43.230.69':445
'25#.#6.244.240':445
'17#.#1.228.209':445
'79.##9.18.82':445
'17#.#31.55.75':445
'12#.#06.78.140':445
'79.##.101.204':445
'30.##.124.13':445
'35.##7.78.58':445
'20#.#69.163.215':445
'77.##5.184.70':445
'78.##.149.44':445
'28.##9.207.135':445
'20#.#67.135.130':445
'23#.#7.230.200':445
'13#.#5.251.18':445
'68.##.121.215':445
'19#.#65.107.44':445
'13#.#76.20.73':445
'43.##7.210.185':445
'23#.#38.58.66':445
'16#.#8.196.14':445
'18#.#12.81.131':445
'33.##5.182.99':445
'11#.#04.195.181':445
'15#.#6.168.185':445
'23.##3.154.14':445
'13#.#45.2.154':445
'24.#7.74.39':445
'18#.#01.253.9':445
'13#.#0.4.143':445
'6.###.246.228':445
'12#.#8.232.58':445
'14#.#37.62.155':445
'25#.#28.166.39':445
'12#.#55.152.124':445
'24#.#26.138.210':445
'11#.#53.124.39':445
'23#.#24.110.125':445
'84.##6.213.9':445
'20#.#43.199.94':445
'74.##4.186.180':445
'19#.#41.172.9':445
'64.##2.158.94':445
'17#.#04.5.234':445
'40.##1.247.64':445
'16#.#02.233.149':445
'30.##9.219.235':445
'18#.#05.64.54':445
'16#.#7.146.152':445
'6.##.53.204':445
'22#.#.116.102':445
'12#.#19.39.33':445
'32.##4.85.52':445
'25#.#0.25.119':445
'97.#49.55.2':445
'11#.#17.11.204':445
'15#.#4.24.209':445
'24#.#8.253.34':445
'92.##6.160.31':445
'23.#0.76.70':445
'15#.#1.130.237':445
'22#.#03.205.144':445
'16#.#41.118.69':445
'14#.#9.198.10':445
'23#.#57.108.244':445
'22#.#8.51.112':445
'92.##5.37.198':445
'21#.#6.23.27':445
'67.##.127.167':445
'18#.#75.113.253':445
'57.#6.99.82':445
'17#.#73.85.167':445
'47.##.71.253':445
'15#.#6.174.137':445
'23.##3.160.222':445
'14#.#4.146.52':445
'13.##1.133.137':445
'13#.#2.119.222':445
'24#.#4.222.107':445
'11#.#51.208.192':445
'24#.#65.23.130':445
'11#.#6.9.216':445
'23#.#63.251.45':445
'10#.#4.237.130':445
'22#.#61.223.216':445
'77.##3.71.100':445
'19#.#4.57.185':445
'67.##1.43.15':445
'18#.#2.29.100':445
'46.##.185.234':445
'25.##4.155.131':445
'21#.#33.49.124':445
'14#.#32.148.166':445
'83.##8.18.129':445
'20.##7.144.91':445
'<LOCALNET>.53.159':445
'<LOCALNET>.53.160':445
'<LOCALNET>.53.161':445
'<LOCALNET>.53.162':445
'<LOCALNET>.53.163':445
'<LOCALNET>.53.164':445
'<LOCALNET>.53.165':445
'<LOCALNET>.53.166':445
'<LOCALNET>.53.167':445
'<LOCALNET>.53.155':445
'<LOCALNET>.53.168':445
'<LOCALNET>.53.172':445
'<LOCALNET>.53.158':445
'<LOCALNET>.53.174':445
'<LOCALNET>.53.169':445
'<LOCALNET>.53.171':445
'<LOCALNET>.53.178':445
'<LOCALNET>.53.180':445
'<LOCALNET>.53.173':445
'<LOCALNET>.53.182':445
'<LOCALNET>.53.175':445
'<LOCALNET>.53.177':445
'<LOCALNET>.53.179':445
'<LOCALNET>.53.170':445
'<LOCALNET>.53.154':445
'<LOCALNET>.53.183':445
'<LOCALNET>.53.176':445
'<LOCALNET>.53.157':445
'<LOCALNET>.53.153':445
'<LOCALNET>.53.151':445
'<LOCALNET>.53.134':445
'<LOCALNET>.53.123':445
'<LOCALNET>.53.125':445
'<LOCALNET>.53.127':445
'<LOCALNET>.53.129':445
'<LOCALNET>.53.131':445
'<LOCALNET>.53.133':445
'<LOCALNET>.53.136':445
'<LOCALNET>.53.135':445
'<LOCALNET>.53.137':445
'<LOCALNET>.53.138':445
'<LOCALNET>.53.119':445
'<LOCALNET>.53.140':445
'<LOCALNET>.53.142':445
'<LOCALNET>.53.143':445
'<LOCALNET>.53.141':445
'<LOCALNET>.53.145':445
'<LOCALNET>.53.144':445
'<LOCALNET>.53.146':445
'<LOCALNET>.53.148':445
'<LOCALNET>.53.147':445
'<LOCALNET>.53.150':445
'<LOCALNET>.53.152':445
'<LOCALNET>.53.149':445
'<LOCALNET>.53.181':445
'<LOCALNET>.53.139':445
'<LOCALNET>.53.132':445
'<LOCALNET>.53.184':445
'<LOCALNET>.53.186':445
'<LOCALNET>.53.218':445
'<LOCALNET>.53.187':445
'<LOCALNET>.53.219':445
'<LOCALNET>.53.220':445
'<LOCALNET>.53.221':445
'<LOCALNET>.53.222':445
'<LOCALNET>.53.224':445
'<LOCALNET>.53.223':445
'<LOCALNET>.53.225':445
'<LOCALNET>.53.227':445
'<LOCALNET>.53.226':445
'<LOCALNET>.53.228':445
'<LOCALNET>.53.229':445
'<LOCALNET>.53.231':445
'<LOCALNET>.53.230':445
'<LOCALNET>.53.232':445
'<LOCALNET>.53.234':445
'<LOCALNET>.53.236':445
'<LOCALNET>.53.233':445
'<LOCALNET>.53.235':445
'<LOCALNET>.53.238':445
'<LOCALNET>.53.240':445
'<LOCALNET>.53.237':445
'<LOCALNET>.53.242':445
'<LOCALNET>.53.239':445
'<LOCALNET>.53.241':445
'<LOCALNET>.53.246':445
'<LOCALNET>.53.215':445
'<LOCALNET>.53.216':445
'<LOCALNET>.53.217':445
'<LOCALNET>.53.121':445
'<LOCALNET>.53.130':445
'<LOCALNET>.53.81':445
'<LOCALNET>.53.188':445
'<LOCALNET>.53.189':445
'<LOCALNET>.53.190':445
'<LOCALNET>.53.191':445
'<LOCALNET>.53.192':445
'<LOCALNET>.53.194':445
'<LOCALNET>.53.196':445
'<LOCALNET>.53.198':445
'<LOCALNET>.53.193':445
'<LOCALNET>.53.195':445
'<LOCALNET>.53.197':445
'<LOCALNET>.53.199':445
'<LOCALNET>.53.200':445
'<LOCALNET>.53.201':445
'<LOCALNET>.53.202':445
'<LOCALNET>.53.203':445
'<LOCALNET>.53.204':445
'<LOCALNET>.53.206':445
'<LOCALNET>.53.205':445
'<LOCALNET>.53.207':445
'<LOCALNET>.53.208':445
'<LOCALNET>.53.209':445
'<LOCALNET>.53.210':445
'<LOCALNET>.53.211':445
'<LOCALNET>.53.212':445
'<LOCALNET>.53.213':445
'<LOCALNET>.53.185':445
'<LOCALNET>.53.214':445
'84.##2.21.220':445
'<LOCALNET>.53.244':445
'<LOCALNET>.53.124':445
'<LOCALNET>.53.62':445
'<LOCALNET>.53.64':445
'<LOCALNET>.53.66':445
'<LOCALNET>.53.68':445
'<LOCALNET>.53.9':445
'<LOCALNET>.53.11':445
'<LOCALNET>.53.70':445
'<LOCALNET>.53.13':445
'<LOCALNET>.53.74':445
'<LOCALNET>.53.76':445
'<LOCALNET>.53.56':445
'<LOCALNET>.53.78':445
'<LOCALNET>.53.60':445
'<LOCALNET>.53.82':445
'<LOCALNET>.53.84':445
'<LOCALNET>.53.72':445
'<LOCALNET>.53.86':445
'<LOCALNET>.53.88':445
'<LOCALNET>.53.90':445
'<LOCALNET>.53.92':445
'<LOCALNET>.53.94':445
'<LOCALNET>.53.96':445
'<LOCALNET>.53.98':445
'<LOCALNET>.53.100':445
'<LOCALNET>.53.80':445
'<LOCALNET>.53.54':445
'<LOCALNET>.53.15':445
'<LOCALNET>.53.52':445
'<LOCALNET>.53.8':445
'<LOCALNET>.53.3':445
'<LOCALNET>.53.7':445
'<LOCALNET>.53.4':445
'<LOCALNET>.53.10':445
'<LOCALNET>.53.2':445
'<LOCALNET>.53.12':445
'<LOCALNET>.53.14':445
'<LOCALNET>.53.16':445
'<LOCALNET>.53.18':445
'<LOCALNET>.53.20':445
'<LOCALNET>.53.22':445
'<LOCALNET>.53.24':445
'<LOCALNET>.53.26':445
'<LOCALNET>.53.5':445
'<LOCALNET>.53.28':445
'<LOCALNET>.53.32':445
'<LOCALNET>.53.34':445
'<LOCALNET>.53.6':445
'<LOCALNET>.53.36':445
'<LOCALNET>.53.38':445
'<LOCALNET>.53.40':445
'<LOCALNET>.53.42':445
'<LOCALNET>.53.44':445
'<LOCALNET>.53.46':445
'<LOCALNET>.53.48':445
'<LOCALNET>.53.50':445
'<LOCALNET>.53.17':445
'<LOCALNET>.53.30':445
'<LOCALNET>.53.19':445
'<LOCALNET>.53.58':445
'<LOCALNET>.53.21':445
'<LOCALNET>.53.87':445
'<LOCALNET>.53.91':445
'<LOCALNET>.53.93':445
'<LOCALNET>.53.95':445
'<LOCALNET>.53.97':445
'<LOCALNET>.53.99':445
'<LOCALNET>.53.101':445
'<LOCALNET>.53.102':445
'<LOCALNET>.53.103':445
'<LOCALNET>.53.104':445
'<LOCALNET>.53.105':445
'<LOCALNET>.53.106':445
'<LOCALNET>.53.107':445
'<LOCALNET>.53.109':445
'<LOCALNET>.53.108':445
'<LOCALNET>.53.110':445
'<LOCALNET>.53.111':445
'<LOCALNET>.53.118':445
'<LOCALNET>.53.116':445
'<LOCALNET>.53.114':445
'<LOCALNET>.53.113':445
'<LOCALNET>.53.115':445
'<LOCALNET>.53.112':445
'<LOCALNET>.53.120':445
'<LOCALNET>.53.122':445
'<LOCALNET>.53.117':445
'<LOCALNET>.53.85':445
'<LOCALNET>.53.23':445
'<LOCALNET>.53.89':445
'<LOCALNET>.53.128':445
'<LOCALNET>.53.126':445
'<LOCALNET>.53.79':445
'<LOCALNET>.53.27':445
'<LOCALNET>.53.29':445
'<LOCALNET>.53.31':445
'<LOCALNET>.53.33':445
'<LOCALNET>.53.35':445
'<LOCALNET>.53.37':445
'<LOCALNET>.53.39':445
'<LOCALNET>.53.41':445
'<LOCALNET>.53.43':445
'<LOCALNET>.53.45':445
'<LOCALNET>.53.47':445
'<LOCALNET>.53.49':445
'<LOCALNET>.53.25':445
'<LOCALNET>.53.51':445
'<LOCALNET>.53.55':445
'<LOCALNET>.53.57':445
'<LOCALNET>.53.59':445
'<LOCALNET>.53.61':445
'<LOCALNET>.53.63':445
'<LOCALNET>.53.65':445
'<LOCALNET>.53.67':445
'<LOCALNET>.53.69':445
'<LOCALNET>.53.71':445
'<LOCALNET>.53.73':445
'<LOCALNET>.53.75':445
'<LOCALNET>.53.77':445
'<LOCALNET>.53.53':445
'<LOCALNET>.53.83':445
'82.#7.7.131':445
'<LOCALNET>.53.243':445
'<LOCALNET>.53.252':445
'13#.#14.241.108':445
'53.##0.100.152':445
'69.##6.190.219':445
'86.##2.24.31':445
'10#.#08.115.98':445
'11#.#23.205.165':445
'34.##.64.209':445
'49.##.155.21':445
'65.##.245.88':445
'82.##.79.155':445
'22#.#92.21.36':445
'97.##.170.222':445
'12#.#8.150.40':445
'28.##0.119.78':445
'23#.#50.177.103':445
'25#.#66.11.170':445
'16.##2.102.237':445
'33.##8.192.48':445
'20#.#45.51.93':445
'21#.#.142.160':445
'23#.#0.232.227':445
'25#.#6.66.38':445
'10#.#57.106.240':445
'18#.#8.16.150':445
'14.##4.29.11':445
'21#.#06.217.74':445
'22#.#35.87.35':445
'10#.#2.60.229':445
'73.##.135.95':445
'15#.4.20.50':445
'24#.#06.107.208':445
'4.###.197.20':445
'17#.#2.56.64':445
'18#.#8.147.131':445
'20#.#4.237.198':445
'22#.#0.72.10':445
'23#.#6.162.77':445
'15#.#22.21.121':445
'17#.#38.111.189':445
'18#.#54.202.0':445
'20#.#70.36.67':445
'21#.#74.182.74':445
'21#.#86.127.134':445
'15#.#48.76.246':445
'16#.#.166.57':445
'18#.#4.1.124':445
'62.##.192.37':445
'11#.#6.206.236':445
'13#.#02.40.47':445
'14#.#18.131.115':445
'16#.#34.221.182':445
'17#.#50.56.249':445
'93.##6.170.37':445
'11#.#12.5.105':445
'12#.#28.95.172':445
'13#.#32.241.179':445
'14#.#44.186.239':445
'21#.#30.197.28':445
'22#.#46.31.96':445
'24#.#62.121.163':445
'16#.#08.236.207':445
'14#.#9.98.138':445
'20#.#62.226.176':445
'18.##.100.213':445
'81.##7.231.251':445
'14#.#2.105.32':445
'20#.#12.235.70':445
'17.##.108.108':445
'82.##9.238.145':445
'14#.#4.112.183':445
'20#.#14.242.220':445
'18.#9.116.2':445
'81.##1.245.40':445
'14#.#6.119.77':445
'20#.#16.249.115':445
'19.##1.123.152':445
'83.##1.253.190':445
'14#.#8.126.228':445
'20#.218.0.9':445
'18.##3.130.47':445
'81.#44.4.84':445
'14#.#28.134.122':445
'21#.#21.7.159':445
'19.##5.137.197':445
'82.##6.11.234':445
'14#.#30.141.16':445
'17#.#5.53.170':445
'19#.#58.92.7':445
'80.##5.223.101':445
'22#.#90.17.141':445
'11#.#68.19.59':445
'<LOCALNET>.53.248':445
'17#.#24.71.19':445
'19#.#40.161.86':445
'21#.#.252.153':445
'22#.#6.86.220':445
'14#.#2.201.9':445
'15#.#8.35.76':445
'17#.#4.126.143':445
'19#.#10.216.210':445
'20#.#26.51.22':445
'12#.#72.165.66':445
'13#.#88.0.133':445
'15#.#04.90.201':445
'17#.#20.181.12':445
'18#.#36.15.79':445
'80.##3.208.56':445
'10#.#6.130.123':445
'14#.#7.82.94':445
'11#.#2.220.191':445
'20#.#58.212.131':445
'13#.58.55.2':445
'16.##.86.169':445
'15#.#4.145.69':445
'79.##3.216.206':445
'16#.#0.236.136':445
'14#.#9.89.244':445
'82.##6.94.181':445
'20#.#60.219.26':445
'17.#4.93.63':445
'<LOCALNET>.53.245':445
'98.##2.185.248':445
'<LOCALNET>.53.156':445
'17#.#31.113.184':445
'26.##.221.196':445
'12#.#.74.207':445
'22#.#98.182.218':445
'81.##9.174.162':445
'18#.#56.27.173':445
'31.##.135.185':445
'13#.#0.244.196':445
'23#.#23.96.208':445
'86.##4.88.151':445
'12#.#36.160.218':445
'18#.#80.196.162':445
'76.##4.4.173':445
'13#.#4.157.185':445
'91.#2.2.140':445
'19#.#05.110.151':445
'41.##2.219.163':445
'14#.#9.71.174':445
'24#.#6.180.186':445
'96.##.172.129':445
'16.##.140.115':445
'46.##7.133.152':445
'14#.#04.241.163':445
'25#.#1.94.175':445
'36.##7.49.174':445
'10#.#2.86.118':445
'24#.#47.10.197':445
'22#.#73.12.229':445
'21.##.51.207':445
'17#.#06.199.195':445
'<LOCALNET>.53.247':445
'<LOCALNET>.53.249':445
'<LOCALNET>.53.251':445
'<LOCALNET>.53.253':445
'<LOCALNET>.53.254':445
'53.##.179.227':445
'15#.#.31.239':445
'3.###.140.250':445
'10#.#38.248.6':445
'20#.#5.101.17':445
'56.##.93.216':445
'<LOCALNET>.53.250':445
'15#.#2.201.228':445
'10#.#62.162.251':445
'20#.99.15.6':445
'61.##0.7.206':445
'16#.#7.115.217':445
'11.##0.224.228':445
'11#.#87.76.240':445
'21#.#24.185.251':445
'66.##5.177.195':445
'16#.#2.29.206':445
'16.##.137.217':445
'11#.#12.246.229':445
'21#.#49.98.240':445
'6.###.54.239':445
'71.##0.90.184':445
'20#.#54.194.130':445
'51.##1.46.141':445
'15#.#28.155.152':445
'1.##.7.164':445
'33.##1.148.57':445
'13#.#72.140.0':445
'24#.#09.249.12':445
'88.##.101.23':445
'19#.#38.210.35':445
'38.##5.62.46':445
'25#.#5.198.91':445
'14#.#96.54.245':445
'17.##0.32.158':445
'24#.#33.163.1':445
'33.##6.123.225':445
'93.#0.15.12':445
'48.##2.213.36':445
'19#.#.124.24':445
'65.##8.48.104':445
'43.##0.232.35':445
'23#.#94.163.148':445
'14#.#21.224.235':445
'25#.#10.253.215':445
'24#.#58.77.246':445
'13.##6.87.26':445
'96.#5.185.1':445
'28.##2.178.94':445
'44.#.12.161':445
'21#.#8.127.205':445
'23#.#4.218.17':445
'7.##.142.151':445
'18#.#14.40.46':445
'24.##2.233.218':445
'83.##.188.34':445
'24#.#0.52.84':445
'10#.#6.255.107':445
'20#.#3.108.119':445
'56.##6.216.130':445
'15#.#53.69.141':445
'6.##.177.153':445
'11#.#11.169.96':445
'21#.#8.22.108':445
'11#.#8.59.55':445
'21#.#41.168.66':445
'63.##8.20.78':445
'16#.#15.129.89':445
'13.##.237.101':445
'11#.#3.229.44':445
'22#.#0.82.56':445
'68.##3.190.67':445
'17#.#40.42.78':445
'18.##.151.90':445
'12#.#8.143.33':445
'22#.#5.251.45':445
'73.##8.104.56':445
'17#.#64.212.67':445
'23.##1.65.79':445
'12#.#22.57.22':445
'23#.#9.165.34':445
'78.##2.18.45':445
'18#.#89.126.56':445
'28.##6.235.68':445
'23#.#4.79.23':445
'99.##3.16.43':445

TCP

Other

'<LOCALNET>.53.54':445
'<LOCALNET>.53.54':49205
'<LOCALNET>.53.54':49275
'<LOCALNET>.53.54':49276
'<LOCALNET>.53.54':49277
'<LOCALNET>.53.54':49278
'15#.#51.236.207':445

Miscellaneous

Creates and executes the following

'%WINDIR%\syswow64\cmd.exe' /c d.bat "<Full path to file>"' (with hidden window)

Executes the following

'%WINDIR%\syswow64\svchost.exe' -k SCardPrv
'%WINDIR%\syswow64\svchost.exe' -k Wmmvsvc
'%WINDIR%\syswow64\cmd.exe' /c d.bat "<Full path to file>"

Технологии

Термины

Обучение и просвещение

Мифы

Technical Information

Рекомендации по лечению

Демо бесплатно на 14 дней