Technical Information
- [<HKLM>\SYSTEM\ControlSet001\Services\Wmmvsvc] 'Start' = '00000002'
- [<HKLM>\SYSTEM\ControlSet001\Services\SCardPrv] 'Start' = '00000002'
- <SYSTEM32>\cmd.exe /c d.bat "<Full path to virus>"
- <SYSTEM32>\svchost.exe -k Wmmvsvc
- <SYSTEM32>\svchost.exe -k SCardPrv
- <Current directory>\d.bat
- <SYSTEM32>\KB25879.dat
- C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\0J2LM5OP\wpad[1].dat
- <SYSTEM32>\scardprv.dll
- <SYSTEM32>\Wmmvsvc.dll
- <SYSTEM32>\mssscardprv.ax
- '22#.#47.146.33':445
- '17#.#05.247.10':445
- '18#.#44.1.12':445
- '18#.#44.1.11':445
- '34.##3.204.14':80
- '21#.#26.39.18':445
- '18#.#44.1.13':445
- '22#.#47.146.34':139
- '21#.#26.39.20':445
- '21#.#26.39.19':445
- '22#.#47.146.34':445
- '17#.#05.247.11':445
- '22#.#47.146.30':445
- '21#.#26.39.15':445
- '17#.#05.247.7':445
- '22#.#47.146.29':445
- '21#.#26.39.14':445
- '17#.#05.247.6':445
- '21#.#26.39.17':445
- '22#.#47.146.32':445
- '17#.#05.247.9':445
- '22#.#47.146.31':445
- '21#.#26.39.16':445
- '17#.#05.247.8':445
- '17#.#05.247.12':445
- '18#.#44.1.14':139
- '2.###.163.18':139
- '34.##3.204.15':445
- '17#.#1.163.18':445
- '22#.#47.146.35':445
- '9.#.175.17':80
- '22#.#47.146.36':445
- '17#.#1.163.18':80
- '22#.#47.146.35':80
- '34.##3.204.15':80
- '17#.#05.247.12':80
- '21#.#26.39.21':445
- '2.###.163.17':445
- '2.###.163.18':445
- '17#.#05.247.11':139
- '2.###.163.16':445
- '18#.#44.1.14':445
- '68.#4.255.9':445
- '17#.#05.247.11':80
- '9.#.175.17':445
- '25.##2.198.8':445
- '17#.#1.163.17':80
- '22#.#47.146.34':80
- '22#.#47.146.13':80
- '21#.#26.39.4':80
- '18#.#44.1.10':80
- '18#.#44.1.10':445
- '34.##3.204.14':445
- '34.##3.204.14':139
- '22#.#47.146.15':445
- '22#.#47.146.16':445
- '22#.#47.146.17':445
- '17#.#05.247.2':80
- '25.##2.198.7':80
- '22#.#47.146.14':445
- '2.###.163.15':445
- '9.#.175.16':445
- '25.##2.198.6':80
- '68.#4.255.7':445
- '17#.#05.247.1':80
- '68.#4.255.8':445
- '22#.#47.146.13':445
- '17#.#05.247.2':445
- '25.##2.198.7':445
- '18#.144.1.9':80
- '21#.#26.39.4':445
- '34.##3.204.13':80
- '22#.#47.146.26':445
- '17#.#05.247.3':445
- '9.#.175.16':80
- '22#.#47.146.24':445
- '22#.#47.146.25':445
- '21#.#26.39.10':445
- '22#.#47.146.28':445
- '21#.#26.39.13':445
- '17#.#05.247.5':445
- '22#.#47.146.27':445
- '21#.#26.39.12':445
- '17#.#05.247.4':445
- '21#.#26.39.5':445
- '68.#4.255.8':80
- '22#.#47.146.21':445
- '22#.#47.146.18':445
- '22#.#47.146.19':445
- '22#.#47.146.20':445
- '22#.#47.146.23':445
- '21#.#26.39.8':445
- '21#.#26.39.9':445
- '21#.#26.39.6':445
- '22#.#47.146.22':445
- '21#.#26.39.7':445
- '17#.#05.247.31':445
- '17#.#05.247.32':445
- '17#.#05.247.33':445
- '17#.#05.247.28':445
- '17#.#05.247.29':445
- '17#.#05.247.30':445
- '17#.#05.247.37':445
- '17#.#05.247.37':139
- '9.#.175.21':445
- '17#.#05.247.34':445
- '17#.#05.247.35':445
- '17#.#05.247.36':445
- '17#.#05.247.19':139
- '17#.#05.247.20':445
- '17#.#05.247.21':445
- '9.#.175.20':445
- '21#.#26.39.23':139
- '9.#.175.20':139
- '17#.#05.247.25':445
- '17#.#05.247.26':445
- '17#.#05.247.27':445
- '17#.#05.247.22':445
- '17#.#05.247.23':445
- '17#.#05.247.24':445
- '2.###.163.19':139
- '68.##.255.10':139
- '18#.#44.1.15':139
- '22#.#47.146.56':80
- '9.#.175.21':139
- '17#.#1.163.19':139
- '9.#.175.21':80
- '68.##.255.10':80
- '17#.#1.163.19':80
- '34.##3.204.29':139
- '21#.#26.39.24':139
- '17#.#05.247.38':139
- '34.##3.204.28':80
- '18#.#44.1.15':445
- '21#.#26.39.23':80
- '17#.#1.163.19':445
- '2.###.163.18':80
- '68.##.255.10':445
- '34.##3.204.29':445
- '21#.#26.39.24':445
- '17#.#05.247.38':445
- '17#.#05.247.37':80
- '25.##2.198.9':445
- '2.###.163.19':445
- '22#.#47.146.47':445
- '34.##3.204.20':445
- '22#.#47.146.48':445
- '34.##3.204.18':445
- '22#.#47.146.46':445
- '34.##3.204.19':445
- '22#.#47.146.50':445
- '18#.#44.1.14':80
- '17#.#05.247.13':445
- '34.##3.204.21':445
- '22#.#47.146.49':445
- '34.##3.204.22':445
- '22#.#47.146.40':445
- '22#.#47.146.41':445
- '22#.#47.146.42':445
- '22#.#47.146.37':445
- '22#.#47.146.38':445
- '22#.#47.146.39':445
- '22#.#47.146.44':445
- '34.##3.204.17':445
- '22#.#47.146.45':445
- '22#.#47.146.43':445
- '34.##3.204.16':445
- '68.#4.255.9':80
- '34.##3.204.28':445
- '9.#.175.18':445
- '25.##2.198.8':80
- '34.##3.204.27':445
- '22#.#47.146.55':445
- '17#.#05.247.18':445
- '22#.#47.146.56':139
- '9.#.175.19':445
- '21#.#26.39.23':445
- '22#.#47.146.56':445
- '17#.#05.247.19':445
- '21#.#26.39.22':445
- '34.##3.204.24':445
- '22#.#47.146.52':445
- '17#.#05.247.15':445
- '34.##3.204.23':445
- '22#.#47.146.51':445
- '17#.#05.247.14':445
- '22#.#47.146.54':445
- '34.##3.204.26':445
- '17#.#05.247.17':445
- '34.##3.204.25':445
- '22#.#47.146.53':445
- '17#.#05.247.16':445
- '2.##4.163.7':445
- '18#.#0.209.155':445
- '17.##.114.199':445
- '9.#.175.7':445
- '13.##9.46.180':445
- '18#.#44.1.238':445
- '9.#.175.8':139
- '66.##0.242.208':445
- '21#.#26.39.1':445
- '21#.#26.39.0':445
- '9.#.175.8':445
- '18#.144.1.0':445
- '10#.#09.245.179':445
- '2.##4.163.5':445
- '1.##.23.132':445
- '2.##4.163.4':445
- '22#.#.204.215':445
- '9.#.175.5':445
- '2.##4.163.6':445
- '13#.#39.178.255':445
- '21#.#26.39.11':445
- '23#.#1.78.224':445
- '9.#.175.6':445
- '16#.#.48.176':445
- '34.##3.204.2':445
- '22#.#47.146.0':445
- '25.##2.198.0':445
- '22#.#47.146.134':445
- '34.##3.204.1':445
- '25.##2.198.109':445
- '17#.#05.247.89':445
- '17#.#05.247.0':445
- '2.##4.163.7':80
- '22#.#47.146.1':445
- '68.##.255.146':445
- '68.#4.255.0':445
- '11#.#26.154.191':445
- '17#.#1.163.72':445
- '18#.144.1.1':139
- '20#.#24.52.37':445
- '18#.144.1.1':445
- '81.##.181.108':445
- '17#.#1.163.1':445
- '34.##3.204.0':445
- '61.##.143.45':445
- '34.##3.204.10':445
- '14#.#58.175.90':445
- '17#.#1.163.0':445
- '20#.#22.45.142':445
- '14#.#25.72.239':445
- '17#.#57.174.14':445
- '83.##8.114.166':445
- '52.##9.240.209':445
- '18#.#00.33.128':445
- '21#.#9.93.213':445
- '23#.#3.106.53':445
- '69.#.74.20':445
- '72.##3.235.121':445
- '68.##0.158.86':445
- '59.##7.94.33':445
- 'wpad.localdomain':80
- '5.##.248.2':445
- '13#.#02.125.164':445
- '<Private IP address>':445
- '<Private IP address>':139
- '<Private IP address>':80
- '13#.#1.3.169':445
- '15#.#04.220.32':445
- '11#.#02.240.202':445
- '13#.#9.172.104':445
- '14#.#7.47.218':445
- '22#.#48.121.93':445
- '91.##8.31.180':445
- '9.#.175.3':445
- '73.##7.49.217':445
- '9.#.175.2':445
- '86.##.165.87':445
- '2.##4.163.2':445
- '15#.#77.82.103':445
- '15.##.112.62':445
- '16#.#53.193.168':445
- '19#.#32.75.208':445
- '2.##4.163.3':445
- '9.#.175.4':445
- '2.###.163.27':445
- '18#.#2.133.154':445
- '9.#.175.0':445
- '14#.#4.39.159':445
- '85.##6.100.111':445
- '9.#.175.180':445
- '60.##2.201.225':445
- '2.##4.163.1':445
- '4.###.64.149':445
- '2.##4.163.0':445
- '13#.#09.77.175':445
- '9.#.175.1':445
- '22#.#47.146.12':445
- '17#.#1.163.2':445
- '17#.#1.163.3':445
- '2.###.163.14':445
- '18#.144.1.9':445
- '22#.#47.146.11':445
- '18#.144.1.9':139
- '25.##2.198.6':139
- '2.###.163.14':139
- '17#.#05.247.1':445
- '21#.#26.39.3':445
- '9.#.175.15':139
- '68.#4.255.6':445
- '9.#.175.14':445
- '22#.#47.146.9':445
- '2.###.163.12':445
- '34.##3.204.8':445
- '18#.144.1.7':445
- '18#.144.1.8':445
- '9.#.175.15':445
- '22#.#47.146.10':445
- '25.##2.198.6':445
- '2.###.163.13':445
- '34.##3.204.9':445
- '17#.#1.163.13':445
- '34.##3.204.11':445
- '17#.#1.163.14':445
- '17#.#1.163.11':445
- '22#.#47.146.12':80
- '17#.#1.163.12':445
- '17#.#1.163.16':445
- '34.##3.204.13':139
- '17#.#1.163.17':445
- '34.##3.204.12':445
- '17#.#1.163.15':445
- '34.##3.204.13':445
- '9.#.175.15':80
- '21#.#26.39.3':80
- '17#.#1.163.4':445
- '34.##3.204.9':80
- '17#.#1.163.3':80
- '2.###.163.14':80
- '17#.#1.163.8':445
- '17#.#1.163.9':445
- '17#.#1.163.10':445
- '17#.#1.163.5':445
- '17#.#1.163.6':445
- '17#.#1.163.7':445
- '18#.144.1.2':445
- '9.#.175.9':445
- '22#.#47.146.4':445
- '22#.#47.146.3':445
- '68.#4.255.1':445
- '34.##3.204.3':445
- '34.##3.204.4':445
- '68.#4.255.2':445
- '18#.144.1.3':445
- '2.##4.163.8':445
- '25.##2.198.1':445
- '21#.#26.39.2':80
- '68.#4.255.0':139
- '34.##3.204.2':139
- '25.##2.198.0':80
- '9.#.175.8':80
- '21#.#26.39.1':80
- '18#.144.1.1':80
- '17#.#05.247.0':80
- '22#.#47.146.2':445
- '21#.#26.39.2':139
- '22#.#47.146.1':80
- '68.#4.255.0':80
- '21#.#26.39.2':445
- '22#.#47.146.7':445
- '25.##2.198.4':445
- '2.###.163.11':445
- '18#.144.1.5':445
- '68.#4.255.4':445
- '9.#.175.12':445
- '9.#.175.13':445
- '22#.#47.146.8':445
- '25.##2.198.5':445
- '34.##3.204.7':445
- '18#.144.1.6':445
- '68.#4.255.5':445
- '25.##2.198.2':445
- '34.##3.204.5':445
- '18#.144.1.4':445
- '9.#.175.10':445
- '22#.#47.146.5':445
- '2.##4.163.9':445
- '25.##2.198.3':445
- '2.###.163.10':445
- '34.##3.204.6':445
- '68.#4.255.3':445
- '9.#.175.11':445
- '22#.#47.146.6':445
- wpad.localdomain/wpad.dat
- DNS ASK wpad.localdomain