Trojan.MulDrop20.41967

Technical Information

To ensure autorun and distribution

Sets the following service settings

[<HKLM>\System\CurrentControlSet\Services\Wmmvsvc] 'Start' = '00000002'
[<HKLM>\System\CurrentControlSet\Services\Wmmvsvc] 'ImagePath' = '<SYSTEM32>\svchost.exe -k Wmmvsvc'
[<HKLM>\SYSTEM\CurrentControlSet\Services\Wmmvsvc\Parameters] 'ServiceDll' = '<SYSTEM32>\Wmmvsvc.dll'

Creates the following services

'Wmmvsvc' <SYSTEM32>\svchost.exe -k Wmmvsvc

Modifies file system

Creates the following files

%WINDIR%\syswow64\wmmvsvc.dll
<Current directory>\d.bat
%WINDIR%\syswow64\kb25879.dat

Deletes itself.

Network activity

Connects to

'<LOCALNET>.16.1':445
'6.###.229.196':445
'10#.#27.10.189':445
'53.##2.33.254':445
'36.##.252.24':445
'21.##2.192.238':445
'4.###.139.184':445
'20#.#05.162.249':445
'15#.#3.185.58':445
'15#.#14.238.110':445
'11#.#7.208.123':445
'61.##1.231.187':445
'11#.#43.144.166':445
'21#.#5.120.49':445
'59.#6.58.53':445
'77.##0.78.49':445
'21#.#75.104.183':445
'58.##7.141.175':445
'17#.#79.153.104':445
'21#.#9.187.49':445
'16#.#77.125.18':445
'11#.#78.233.178':445
'21#.#40.15.171':445
'16#.#14.38.235':445
'11#.#2.61.44':445
'66.##6.84.109':445
'3.###.52.221':445
'10#.#08.35.245':445
'33.##9.179.17':445
'15#.#24.168.243':445
'55.##.206.132':445
'10#.#7.183.67':445
'42.##6.22.70':445
'72.##.150.122':445
'62.##.104.38':445
'51.##.58.210':445
'43.##.12.127':445
'32.##.222.43':445
'63.##0.93.95':445
'52.##0.47.12':445
'41.##1.1.184':445
'33.##1.211.101':445
'22.#.165.17':445
'53.##5.36.69':445
'42.##5.246.242':445
'32.##5.200.158':445
'19#.#1.7.150':445
'23.##5.154.74':445
'38.##.72.143':445
'19#.#09.247.123':445
'15#.#8.77.136':445
'43.##.236.43':445
'10#.#62.100.201':445
'49.##0.215.183':445
'21#.#01.233.140':445
'24.##.144.132':445
'13.##0.98.48':445
'72.##6.160.64':445
'15#.#99.160.2':445
'16.##1.107.174':445
'17#.#67.231.18':445
'17#.#65.24.134':445
'13.##6.17.161':445
'32.##1.93.72':445
'23#.#05.116.137':445
'79.##8.153.129':445
'30.##2.176.194':445
'23#.#0.199.3':445
'18#.#34.222.68':445
'13#.#09.245.132':445
'23#.#71.26.125':445
'18#.#45.49.190':445
'13#.#3.72.254':445
'87.##7.95.63':445
'15.##.190.40':445
'38.##2.118.128':445
'85.##8.178.185':445
'36.##.201.250':445
'24#.#41.224.58':445
'12#.#47.123.28':445
'36.##7.29.116':445
'24#.#51.52.180':445
'19#.#9.75.245':445
'54.#71.0.85':445
'14#.#44.98.54':445
'50.##7.85.232':445
'52.##8.221.225':445
'81.##2.243.142':445
'13#.#28.220.77':445
'13#.#74.155.120':445
'81.#7.70.7':445
'13#.#39.47.199':445
'18#.#4.197.12':445
'23#.#36.174.203':445
'21#.#20.40.226':445
'17#.#8.63.35':445
'12#.#13.86.100':445
'72.##7.109.164':445
'16#.#49.146.157':445
'11#.#23.169.222':445
'47.##2.30.120':445
'21.##6.215.95':445
'22#.#90.238.160':445
'70.##2.19.152':445
'80.##5.206.148':445
'19.##6.42.217':445
'17#.#19.88.91':445
'53.##6.68.153':445
'14#.#11.155.160':445
'17#.#29.171.212':445
'78.##4.21.228':445
'76.##2.217.86':445
'31.##0.151.214':445
'12#.#58.22.143':445
'75.##3.45.208':445
'27.#1.68.17':445
'23#.#25.91.81':445
'18#.#99.114.146':445
'24.##1.151.139':445
'22#.#5.65.26':445
'22#.#36.169.253':445
'22#.#10.213.104':445
'22#.#55.148.148':445
'61.##6.114.237':445
'52.##2.79.96':445
'61.##2.125.179':445
'14#.#09.149.59':445
'20#.#49.23.96':445
'18.##4.153.134':445
'81.##.27.171':445
'14#.#11.156.209':445
'20#.#51.30.247':445
'19.##6.160.28':445
'20#.#41.201.109':445
'82.#0.34.66':445
'20#.#45.195.118':445
'14#.#61.164.103':445
'19#.#.149.34':445
'20#.#53.37.141':445
'18#.#0.103.207':445
'18#.#67.179.69':445
'20#.#24.137.194':445
'83.##.41.216':445
'20#.#60.184.175':445
'14#.#63.171.254':445
'19#.#70.138.92':445
'21#.#7.45.35':445
'18#.#80.92.8':445
'19.##0.174.73':445
'17#.#90.46.180':445
'14#.#06.142.165':445
'18.##.137.90':445
'23#.#38.143.170':445
'82.##4.19.21':445
'17.##2.146.240':445
'81.##2.11.127':445
'20#.#45.9.52':445
'78.##9.217.99':445
'14#.#4.91.136':445
'20#.#36.220.174':445
'15.##.94.212':445
'12#.#24.249.201':445
'14#.#6.98.31':445
'30.##8.68.18':445
'14.##.101.106':445
'78.##3.231.144':445
'14#.#8.105.181':445
'20#.#88.235.219':445
'20#.#4.173.232':445
'16.#3.109.0':445
'19#.#4.127.149':445
'14#.#0.112.75':445
'15.##.116.150':445
'80.##6.246.188':445
'14#.#2.119.226':445
'20#.#93.249.7':445
'16.##.123.45':445
'79.##8.253.82':445
'14#.#02.127.120':445
'20#.#95.0.158':445
'17.##.130.195':445
'80.##0.4.233':445
'14#.#04.134.14':445
'20#.#34.213.24':445
'79.##5.238.38':445
'20#.#90.242.113':445
'14#.#49.83.242':445
'17#.#05.35.238':445
'18#.#.71.123':445
'11#.#7.152.54':445
'99.##.106.227':445
'13#.#37.233.23':445
'11#.#47.187.195':445
'11#.#.141.112':445
'10#.#2.95.28':445
'89.##.49.201':445
'12#.#62.176.253':445
'10#.#72.130.169':445
'6.##.85.16':445
'20#.#47.16.202':445
'90.#92.38.2':445
'11#.#6.120.226':445
'99.##.74.143':445
'91.##7.28.59':445
'80.##7.238.232':445
'72.##7.192.148':445
'10#.#0.63.200':445
'91.##.17.117':445
'81.##.227.33':445
'70.##.181.206':445
'62.##.135.122':445
'90.##1.7.174':445
'82.##1.217.90':445
'10#.#73.162.253':445
'85.##8.174.123':445
'71.##1.171.7':445
'48.##7.138.89':445
'12#.#7.243.221':445
'14#.#7.33.49':445
'12#.#63.208.81':445
'17#.#9.25.39':445
'20#.#4.79.127':445
'16#.#9.235.212':445
'15#.#9.189.128':445
'15#.#34.12.180':445
'17#.#89.14.96':445
'16#.#99.224.13':445
'15#.#09.178.185':445
'14#.#20.132.102':445
'17#.#03.4.154':445
'4.##.56.62':445
'16#.#13.214.70':445
'16#.#03.210.113':445
'19#.#54.117.206':445
'13#.#44.76.76':445
'15#.#8.157.44':445
'14#.#8.111.216':445
'14#.#8.65.133':445
'12#.#8.19.49':445
'15#.#08.147.101':445
'53.##1.18.109':445
'13#.#28.55.190':445
'13#.#39.9.107':445
'17#.#19.23.13':445
'14#.#32.90.75':445
'23.##5.154.195':445
'13#.#43.44.248':445
'12#.#53.254.164':445
'16#.#8.203.128':445
'14.#9.87.61':445
'19#.#80.158.111':445
'80.##8.219.225':445
'18#.#0.57.30':445
'12#.#62.196.136':445
'18#.#07.166.86':445
'24#.#2.135.36':445
'54.##3.105.242':445
'11#.#99.74.192':445
'51.##0.211.15':445
'11#.#75.180.221':445
'17#.#21.150.171':445
'24#.#6.119.121':445
'48.#1.89.71':445
'23#.#3.225.150':445
'93.##4.237.249':445
'45.##4.194.100':445
'17#.#35.133.0':445
'23#.#0.103.206':445
'16#.#11.239.29':445
'22#.#7.209.235':445
'39.#.178.185':445
'10#.#03.148.135':445
'16#.#48.117.85':445
'99.##0.253.164':445
'16#.#25.223.114':445
'22#.#0.192.64':445
'33.##.162.15':445
'96.##7.132.221':445
'23#.#21.157.163':445
'12#.#85.91.107':445
'10#.#89.164.50':445
'29.##9.12.43':445
'37.##.178.156':445
'91.##0.231.15':445
'24.#.111.93':445
'87.##7.80.43':445
'15#.#52.50.250':445
'21#.#8.19.200':445
'21.##.245.150':445
'20#.#4.125.228':445
'50.##.179.92':445
'81.##1.64.129':445
'14#.#66.34.79':445
'10#.3.29.21':445
'14#.#43.139.108':445
'19#.#09.58.222':445
'13.#4.78.8':445
'75.##5.48.214':445
'13#.#80.17.164':445
'72.##2.153.243':445
'13#.#57.123.193':445
'22#.#43.158.76':445
'7.##.62.93':445
'71.##9.32.43':445
'4.##.168.122':445
'66.##6.137.72':445
'12#.#71.107.22':445
'18#.#6.228.94':445
'18#.#3.182.1':445
'21#.#4.35.114':445
'12#.#52.207.101':445
'16#.#62.216.135':445
'15#.#39.207.200':445
'75.##5.215.147':445
'95.##0.154.158':445
'23#.#47.181.197':445
'81.#.200.185':445
'24#.#7.19.92':445
'11#.#60.191.88':445
'19#.#04.8.141':445
'13#.#2.182.246':445
'24#.#73.201.235':445
'1.###.197.58':445
'14.##.192.137':445
'29.##.188.216':445
'44.##3.183.40':445
'21#.#4.176.150':445
'14#.#8.202.28':445
'17#.#46.193.187':445
'18#.#97.189.10':445
'8.###.89.251':445
'49.#.203.78':445
'16.##8.157.22':445
'77.##1.194.236':445
'92.##2.189.59':445
'10#.#3.185.139':445
'20#.#74.204.127':445
'22#.#25.199.206':445
'11#.#9.141.11':445
'16#.#2.171.214':445
'75.##2.180.147':445
'20#.#45.190.38':445
'62.##.185.68':445
'14#.#96.190.193':445
'41.##6.100.43':445
'23.#.251.129':445
'87.##8.221.79':445
'13#.#91.17.17':445
'14#.#53.191.29':445
'23#.#87.97.104':445
'33.##4.121.97':445
'93.##.182.176':445
'14#.#30.40.58':445
'10#.#31.178.255':445
'23.#0.8.119':445
'10#.#44.97.10':445
'96.##9.196.9':445
'17.##.235.214':445
'12#.#11.187.167':445
'81.##2.205.164':445
'14#.#67.174.114':445
'25#.#95.183.225':445
'76.##8.54.193':445
'22#.#79.49.55':445
'11#.#.198.37':445
'12#.#08.193.116':445
'16#.#5.196.41':445
'20.##0.98.88':445
'17.##2.198.86':445
'32.##3.194.166':445
'47.##.189.245':445
'22#.#7.192.67':445
'21#.#1.26.178':445
'23#.#44.188.146':445
'93.##3.96.214':445
'22#.#96.186.118':445
'18#.#.102.214':445
'11#.#48.43.152':445
'21#.#6.235.128':445
'85.##3.221.214':445
'10#.#07.43.82':445
'60.##.54.183':445
'18#.#43.40.13':445
'50.#4.26.98':445
'17#.#41.12.183':445
'41.##.254.13':445
'14#.#.102.153':445
'16.##1.88.238':445
'10#.#09.129.0':445
'53.##.68.209':445
'12#.#.46.238':445
'23#.#48.149.123':445
'10#.#19.135.208':445
'22#.#46.121.37':445
'94.##7.107.123':445
'22.##.208.75':445
'70.##6.197.92':445
'1.###.178.228':445
'25#.#69.7.119':445
'18#.#05.155.92':445
'24#.#41.178.158':445
'13#.#8.187.159':445
'9.###.201.73':445
'6.###.60.153':445
'22#.#8.6.214':445
'12#.#6.159.73':445
'14#.#0.215.244':445
'33.##.111.104':445
'42.##7.227.49':445
'20#.#9.205.55':445
'24#.#21.250.114':445
'70.##6.191.140':445
'90.##3.31.107':445
'17.##7.225.98':445
'44.##.24.109':445
'16#.#16.10.195':445
'17#.#34.249.221':445
'24#.#25.195.180':445
'15#.#24.244.62':445
'13#.#7.72.79':445
'12#.#5.44.250':445
'25#.#65.173.244':445
'23#.#9.218.171':445
'11#.#3.16.165':445
'16#.#25.82.79':445
'87.##2.106.134':445
'20#.#3.92.219':445
'97.##6.247.185':445
'19#.#0.64.134':445
'53.##.167.18':445
'15#.#39.66.164':445
'43.##.139.189':445
'27.#9.5.65':445
'25#.#04.58.164':445
'92.##.204.241':445
'11#.#75.39.186':445
'24#.#02.30.79':445
'98.##1.176.157':445
'23.##.231.147':445
'11#.#2.22.117':445
'18#.#43.159.107':445
'32.##.191.122':445
'20#.#5.197.244':445
'25#.#37.38.20':445
'17#.#20.9.136':445
'11#.#.24.105':445
'24#.#5.234.86':445
'24#.#35.10.191':445
'50.##.204.36':445
'94.##7.113.75':445
'24#.#73.242.8':445
'14.##.203.62':445
'45.##3.53.65':445
'14#.#59.189.195':445
'14#.#88.121.138':445
'23#.#6.68.200':445
'39.#.37.150':445
'10#.#03.7.100':445
'15#.#10.184.19':445
'16#.#48.232.50':445
'22#.#3.202.0':445
'17#.#7.199.136':445
'22#.#0.52.29':445
'33.##.21.235':445
'15#.#20.207.10':445
'30.##.232.136':445
'10#.#89.23.15':445
'6.###.66.105':445
'11#.#98.190.157':445
'46.##0.1.204':445
'16#.#49.246.50':445
'23#.#09.8.202':445
'10#.#0.250.32':445
'22#.#07.236.117':445
'77.#99.84.1':445
'19#.#0.70.86':445
'67.##7.56.172':445
'18#.68.42.1':445
'57.##5.28.87':445
'16#.#87.131.227':445
'33.##.117.56':445
'14#.#22.217.233':445
'15#.#85.103.141':445
'14#.#83.76.56':445
'18#.#60.235.173':445
'25#.#75.179.196':445
'24#.#73.151.111':445
'11#.#4.137.197':445
'23#.#71.123.26':445
'84.##3.227.166':445
'20#.#4.213.251':445
'74.##1.199.81':445
'19#.#2.185.166':445
'80.##1.252.143':445
'17#.#51.18.136':445
'40.#2.4.221':445
'23.##.90.227':445
'24#.#11.36.31':445
'13#.#19.189.147':445
'12#.#6.165.26':445
'77.##7.210.204':445
'13.##.80.167':445
'18#.#06.129.0':445
'<LOCALNET>.16.159':445
'<LOCALNET>.16.164':445
'<LOCALNET>.16.161':445
'<LOCALNET>.16.163':445
'<LOCALNET>.16.165':445
'<LOCALNET>.16.166':445
'<LOCALNET>.16.167':445
'<LOCALNET>.16.168':445
'<LOCALNET>.16.169':445
'<LOCALNET>.16.170':445
'<LOCALNET>.16.172':445
'<LOCALNET>.16.171':445
'<LOCALNET>.16.188':445
'<LOCALNET>.16.173':445
'<LOCALNET>.16.176':445
'<LOCALNET>.16.178':445
'<LOCALNET>.16.180':445
'<LOCALNET>.16.175':445
'<LOCALNET>.16.177':445
'<LOCALNET>.16.179':445
'<LOCALNET>.16.182':445
'<LOCALNET>.16.181':445
'<LOCALNET>.16.183':445
'<LOCALNET>.16.184':445
'<LOCALNET>.16.185':445
'<LOCALNET>.16.158':445
'<LOCALNET>.16.186':445
'<LOCALNET>.16.162':445
'<LOCALNET>.16.174':445
'<LOCALNET>.16.157':445
'<LOCALNET>.16.130':445
'<LOCALNET>.16.132':445
'<LOCALNET>.16.134':445
'<LOCALNET>.16.131':445
'<LOCALNET>.16.135':445
'<LOCALNET>.16.133':445
'<LOCALNET>.16.136':445
'<LOCALNET>.16.138':445
'<LOCALNET>.16.140':445
'<LOCALNET>.16.137':445
'<LOCALNET>.16.139':445
'<LOCALNET>.16.141':445
'<LOCALNET>.16.142':445
'<LOCALNET>.16.143':445
'<LOCALNET>.16.144':445
'<LOCALNET>.16.145':445
'<LOCALNET>.16.146':445
'<LOCALNET>.16.147':445
'<LOCALNET>.16.148':445
'<LOCALNET>.16.149':445
'<LOCALNET>.16.150':445
'<LOCALNET>.16.151':445
'<LOCALNET>.16.152':445
'<LOCALNET>.16.153':445
'<LOCALNET>.16.154':445
'<LOCALNET>.16.156':445
'<LOCALNET>.16.187':445
'<LOCALNET>.16.127':445
'<LOCALNET>.16.155':445
'<LOCALNET>.16.247':445
'<LOCALNET>.16.189':445
'<LOCALNET>.16.217':445
'<LOCALNET>.16.230':445
'<LOCALNET>.16.219':445
'<LOCALNET>.16.232':445
'<LOCALNET>.16.225':445
'<LOCALNET>.16.223':445
'<LOCALNET>.16.227':445
'<LOCALNET>.16.234':445
'<LOCALNET>.16.229':445
'<LOCALNET>.16.236':445
'<LOCALNET>.16.238':445
'<LOCALNET>.16.240':445
'<LOCALNET>.16.242':445
'<LOCALNET>.16.228':445
'<LOCALNET>.16.233':445
'<LOCALNET>.16.231':445
'<LOCALNET>.16.246':445
'<LOCALNET>.16.248':445
'<LOCALNET>.16.250':445
'<LOCALNET>.16.252':445
'<LOCALNET>.16.235':445
'<LOCALNET>.16.237':445
'<LOCALNET>.16.239':445
'<LOCALNET>.16.241':445
'<LOCALNET>.16.243':445
'<LOCALNET>.16.226':445
'<LOCALNET>.16.224':445
'<LOCALNET>.16.215':445
'<LOCALNET>.16.221':445
'<LOCALNET>.16.213':445
'<LOCALNET>.16.190':445
'<LOCALNET>.16.191':445
'<LOCALNET>.16.193':445
'<LOCALNET>.16.194':445
'<LOCALNET>.16.196':445
'<LOCALNET>.16.195':445
'<LOCALNET>.16.197':445
'<LOCALNET>.16.198':445
'<LOCALNET>.16.199':445
'<LOCALNET>.16.200':445
'<LOCALNET>.16.201':445
'<LOCALNET>.16.202':445
'<LOCALNET>.16.128':445
'<LOCALNET>.16.203':445
'<LOCALNET>.16.205':445
'<LOCALNET>.16.129':445
'<LOCALNET>.16.206':445
'<LOCALNET>.16.210':445
'<LOCALNET>.16.212':445
'<LOCALNET>.16.214':445
'<LOCALNET>.16.216':445
'<LOCALNET>.16.218':445
'<LOCALNET>.16.207':445
'<LOCALNET>.16.220':445
'<LOCALNET>.16.209':445
'<LOCALNET>.16.211':445
'<LOCALNET>.16.222':445
'<LOCALNET>.16.204':445
'<LOCALNET>.16.125':445
'<LOCALNET>.16.192':445
'<LOCALNET>.16.208':445
'<LOCALNET>.16.126':445
'<LOCALNET>.16.123':445
'<LOCALNET>.16.26':445
'<LOCALNET>.16.44':445
'<LOCALNET>.16.46':445
'<LOCALNET>.16.48':445
'<LOCALNET>.16.31':445
'<LOCALNET>.16.50':445
'<LOCALNET>.16.52':445
'<LOCALNET>.16.54':445
'<LOCALNET>.16.56':445
'<LOCALNET>.16.33':445
'<LOCALNET>.16.58':445
'<LOCALNET>.16.60':445
'<LOCALNET>.16.62':445
'<LOCALNET>.16.64':445
'<LOCALNET>.16.66':445
'<LOCALNET>.16.68':445
'<LOCALNET>.16.70':445
'<LOCALNET>.16.72':445
'<LOCALNET>.16.74':445
'<LOCALNET>.16.76':445
'<LOCALNET>.16.78':445
'<LOCALNET>.16.80':445
'<LOCALNET>.16.82':445
'<LOCALNET>.16.84':445
'<LOCALNET>.16.86':445
'<LOCALNET>.16.40':445
'<LOCALNET>.16.38':445
'<LOCALNET>.16.34':445
'<LOCALNET>.16.42':445
'<LOCALNET>.16.36':445
'<LOCALNET>.16.4':445
'<LOCALNET>.16.245':445
'<LOCALNET>.16.6':445
'<LOCALNET>.16.3':445
'<LOCALNET>.16.8':445
'<LOCALNET>.16.5':445
'<LOCALNET>.16.10':445
'<LOCALNET>.16.7':445
'<LOCALNET>.16.9':445
'<LOCALNET>.16.11':445
'<LOCALNET>.16.12':445
'<LOCALNET>.16.13':445
'<LOCALNET>.16.15':445
'<LOCALNET>.16.88':445
'<LOCALNET>.16.17':445
'<LOCALNET>.16.90':445
'<LOCALNET>.16.19':445
'<LOCALNET>.16.16':445
'<LOCALNET>.16.18':445
'<LOCALNET>.16.23':445
'<LOCALNET>.16.20':445
'<LOCALNET>.16.25':445
'<LOCALNET>.16.27':445
'<LOCALNET>.16.29':445
'<LOCALNET>.16.22':445
'<LOCALNET>.16.30':445
'<LOCALNET>.16.32':445
'<LOCALNET>.16.24':445
'<LOCALNET>.16.14':445
'<LOCALNET>.16.2':445
'<LOCALNET>.16.21':445
'<LOCALNET>.16.244':445
'<LOCALNET>.16.94':445
'<LOCALNET>.16.100':445
'<LOCALNET>.16.89':445
'<LOCALNET>.16.101':445
'<LOCALNET>.16.102':445
'<LOCALNET>.16.104':445
'<LOCALNET>.16.103':445
'<LOCALNET>.16.105':445
'<LOCALNET>.16.106':445
'<LOCALNET>.16.107':445
'<LOCALNET>.16.108':445
'<LOCALNET>.16.109':445
'<LOCALNET>.16.110':445
'<LOCALNET>.16.28':445
'<LOCALNET>.16.111':445
'<LOCALNET>.16.114':445
'<LOCALNET>.16.112':445
'<LOCALNET>.16.116':445
'<LOCALNET>.16.118':445
'<LOCALNET>.16.115':445
'<LOCALNET>.16.120':445
'<LOCALNET>.16.122':445
'<LOCALNET>.16.117':445
'<LOCALNET>.16.119':445
'<LOCALNET>.16.121':445
'<LOCALNET>.16.124':445
'<LOCALNET>.16.95':445
'<LOCALNET>.16.93':445
'<LOCALNET>.16.113':445
'<LOCALNET>.16.87':445
'<LOCALNET>.16.99':445
'<LOCALNET>.16.91':445
'<LOCALNET>.16.85':445
'<LOCALNET>.16.35':445
'<LOCALNET>.16.37':445
'<LOCALNET>.16.39':445
'<LOCALNET>.16.41':445
'<LOCALNET>.16.43':445
'<LOCALNET>.16.45':445
'<LOCALNET>.16.47':445
'<LOCALNET>.16.49':445
'<LOCALNET>.16.51':445
'<LOCALNET>.16.53':445
'<LOCALNET>.16.92':445
'<LOCALNET>.16.55':445
'<LOCALNET>.16.59':445
'<LOCALNET>.16.97':445
'<LOCALNET>.16.61':445
'<LOCALNET>.16.65':445
'<LOCALNET>.16.67':445
'<LOCALNET>.16.69':445
'<LOCALNET>.16.71':445
'<LOCALNET>.16.73':445
'<LOCALNET>.16.75':445
'<LOCALNET>.16.77':445
'<LOCALNET>.16.79':445
'<LOCALNET>.16.81':445
'<LOCALNET>.16.83':445
'<LOCALNET>.16.57':445
'<LOCALNET>.16.98':445
'<LOCALNET>.16.96':445
'<LOCALNET>.16.63':445
'<LOCALNET>.16.160':445
'<LOCALNET>.16.249':445
'21#.#48.131.216':445
'20#.#02.188.54':445
'22#.#18.22.121':445
'23#.#34.113.188':445
'25#.#50.203.0':445
'15.#0.38.67':445
'18#.#6.152.111':445
'20#.#2.243.178':445
'21#.#8.77.246':445
'23#.#04.168.57':445
'25#.#20.2.124':445
'16#.#66.117.168':445
'17#.#54.65.120':445
'18#.#82.207.236':445
'21#.#14.132.114':445
'23#.#30.223.181':445
'14#.#0.81.226':445
'16#.#6.172.37':445
'17#.#2.6.104':445
'19#.#8.97.172':445
'20#.#4.187.239':445
'12#.#30.46.27':445
'14#.#46.136.94':445
'15#.#62.227.162':445
'17#.#78.61.229':445
'24#.#08.58.64':445
'22#.#2.223.252':445
'19#.#98.42.47':445
'20#.#3.9.178':445
'20.##0.239.198':445
'55.##.109.208':445
'39.##.18.141':445
'14#.#48.195.110':445
'15#.#.30.177':445
'72.##.145.222':445
'89.##.235.33':445
'10#.#6.69.100':445
'12#.#02.160.167':445
'13#.#18.250.235':445
'52.##5.109.23':445
'69.##1.200.90':445
'83.##6.34.158':445
'18#.#94.152.40':445
'10#.#12.124.225':445
'32.#9.74.80':445
'<LOCALNET>.16.251':445
'48.##.164.148':445
'79.#6.89.26':445
'96.##.179.93':445
'11.##9.38.138':445
'28.##4.129.205':445
'44.##0.219.16':445
'59.##6.54.83':445
'76.##2.144.151':445
'24#.#39.3.195':445
'7.##4.93.6':445
'24.##.184.74':445
'48.##5.36.49':445
'10#.#17.14.232':445
'93.##1.180.164':445
'65.##.255.215':445
'12#.#32.105.43':445
'10#.#40.11.85':445
'84.##.231.142':445
'20#.#1.163.251':445
'11.##2.37.33':445
'74.##.165.71':445
'13#.#89.39.108':445
'20#.#3.170.146':445
'14#.#34.122.159':445
'76.##.174.221':445
'13#.#91.47.3':445
'20#.#5.177.40':445
'11.##6.51.78':445
'75.##0.181.115':445
'13#.#6.191.219':445
'13#.#41.55.153':445
'36.##.228.148':445
'76.##3.188.10':445
'13#.#43.62.47':445
'15#.#92.85.129':445
'13.##0.65.122':445
'77.##5.195.160':445
'14#.#45.69.197':445
'20#.#30.199.235':445
'13.#4.73.16':445
'77.##7.202.54':445
'14#.#47.76.92':445
'20#.#9.155.101':445
'13#.#85.25.64':445
'20#.#8.184.191':445
'13#.#87.32.214':445
'73.##.158.176':445
'74.##.151.26':445
'11.##9.21.245':445
'10#.#10.66.209':445
'11#.#26.156.20':445
'72.##4.122.193':445
'13#.#42.246.88':445
'13#.#28.252.230':445
'14#.#58.81.155':445
'19#.#3.126.12':445
'66.##4.196.199':445
'8.##3.0.49':445
'30.##.10.238':445
'12#.#.101.152':445
'21#.#49.230.3':445
'13#.#30.3.125':445
'18#.#79.60.180':445
'11#.#52.211.145':445
'12#.#2.45.212':445
'9.##5.7.200':445
'45.#8.160.1':445
'72.##.137.237':445
'13#.#32.10.19':445
'20#.#7.140.57':445
'18#.#4.81.65':445
'73.##.144.132':445
'47.##.169.13':445
'20#.#9.147.207':445
'97.##6.121.78':445
'16#.#8.116.97':445
'15#.#2.26.30':445
'20#.#5.133.162':445
'22#.#98.107.245':445
'25#.#7.190.109':445
'12#.#07.50.174':445
'91.##0.70.79':445
'19#.#07.179.90':445
'44.##8.171.34':445
'14#.#5.23.45':445
'24#.#.132.57':445
'96.##5.240.68':445
'15#.#2.80.189':445
'49.##3.84.23':445
'15#.#0.193.34':445
'25#.#6.45.46':445
'10#.#19.154.57':445
'20#.#56.6.69':445
'52.##7.254.12':445
'15#.#14.107.23':445
'2.##.215.35':445
'10#.#44.68.46':445
'20#.#81.176.58':445
'57.##2.168.1':445
'15#.#39.21.13':445
'7.##.129.24':445
'10#.#3.238.35':445
'21#.#06.90.47':445
'62.##7.82.246':445
'16#.#64.190.2':445
'22#.#3.13.150':445
'39.#03.1.45':445
'86.##5.156.90':445
'24#.#33.218.68':445
'18#.#2.9.101':445
'23#.#08.48.79':445
'71.##.159.123':445
'<LOCALNET>.16.254':445
'11#.#48.114.122':445
'21#.#5.223.133':445
'61.##.75.145':445
'16#.#15.183.156':445
'14.##6.175.99':445
'11#.#73.28.111':445
'21#.#10.136.122':445
'66.##.245.134':445
'16#.#40.97.145':445
'19.#.89.89':445
'12#.#98.198.100':445
'11#.#7.151.24':445
'14#.#22.140.242':445
'22#.#34.50.111':445
'24.#9.3.78':445
'12#.#22.112.89':445
'22#.#59.220.100':445
'76.##.73.112':445
'17#.#3.181.123':445
'29.##.173.67':445
'13#.#47.26.78':445
'23#.#84.134.90':445
'81.##1.242.101':445
'18#.#8.95.112':445
'34.#9.87.56':445
'13#.#6.195.67':445
'<LOCALNET>.16.253':445
'17#.#.11.134':445
'16#.#38.231.53':445
'89.#.36.53':445
'11#.#2.65.14':445
'25#.#47.169.215':445
'24#.#11.117.79':445
'10#.#68.161.159':445
'3.###.207.147':445
'33.##.170.56':445
'73.##6.129.87':445
'52.##.122.182':445
'18#.#3.156.2':445
'15#.#35.230.193':445
'20#.#9.247.69':445
'2.###.83.204':445
'14#.#0.109.56':445
'22#.#4.81.137':445
'23#.#0.172.204':445
'15#.#27.30.248':445
'16#.#43.121.60':445
'18#.#59.211.127':445
'20#.#74.46.194':445
'38.##6.5.143':445
'13#.#37.251.50':445
'14#.#53.85.117':445
'16#.#3.176.184':445
'18#.#8.10.251':445
'19#.#4.101.63':445
'11#.#1.215.107':445
'20#.#79.192.201':445
'10#.#93.75.148':445
'22#.#95.26.12':445
'14#.#10.60.204':445
'47.##.208.193':445
'19#.#0.99.181':445
'22#.#55.174.25':445
'72.##.166.224':445
'17#.#13.18.236':445
'22.##0.127.247':445
'12#.#7.235.3':445
'22#.#4.88.14':445
'77.##.80.213':445
'17#.#38.188.225':445
'27.##5.41.236':445
'12#.#11.149.248':445
'23#.48.1.3':445
'67.##1.252.235':445
'82.##.249.202':445
'16#.#88.104.247':445
'32.##9.210.225':445
'23#.#3.171.248':445
'87.##.163.192':445
'18#.#1.16.203':445
'37.##4.124.214':445
'13#.#61.233.226':445
'24#.#8.85.237':445
'92.##9.77.181':445
'19#.#6.186.192':445
'42.##9.38.203':445
'14#.#85.147.215':445
'24#.#22.255.226':445
'17.##5.213.2':445
'97.##3.247.170':445
'13#.#36.63.237':445
'11.##4.186.188':445

TCP

Other

'<LOCALNET>.16.58':445
'<LOCALNET>.16.58':49220
'<LOCALNET>.16.58':49275
'<LOCALNET>.16.58':49276
'<LOCALNET>.16.58':49277
'<LOCALNET>.16.58':49278
'17#.#05.35.238':445

Miscellaneous

Creates and executes the following

'%WINDIR%\syswow64\cmd.exe' /c d.bat "<Full path to file>"' (with hidden window)

Executes the following

'%WINDIR%\syswow64\svchost.exe' -k Wmmvsvc
'%WINDIR%\syswow64\cmd.exe' /c d.bat "<Full path to file>"

テクノロジー

用語

トレーニングコースおよび啓蒙プロジェクト

アンチウイルスに関する誤解と噂

Technical Information

Curing recommendations

Free trial