Technical Information
- <SYSTEM32>\shrpubw.exe
- %WINDIR%\windowsshell0521433.log
- %WINDIR%\windowssystemupdate127.log
- 'wa###ngwan.site':36281
- '<LOCALNET>..114.1':51420
- '<LOCALNET>..114.3':51420
- '<LOCALNET>..114.0':51420
- '<LOCALNET>..114.5':51420
- '<LOCALNET>..114.7':51420
- '<LOCALNET>..114.11':51420
- '<LOCALNET>..114.13':51420
- '<LOCALNET>..114.15':51420
- '<LOCALNET>..114.9':51420
- '<LOCALNET>..114.17':51420
- '<LOCALNET>..114.19':51420
- '<LOCALNET>..114.21':51420
- '<LOCALNET>..114.23':51420
- '<LOCALNET>..114.25':51420
- '<LOCALNET>..114.27':51420
- '<LOCALNET>..114.29':51420
- '<LOCALNET>..114.31':51420
- '<LOCALNET>..114.33':51420
- '<LOCALNET>..114.35':51420
- '<LOCALNET>..114.37':51420
- '<LOCALNET>..114.39':51420
- '<LOCALNET>..114.41':51420
- '<LOCALNET>..114.43':51420
- '<LOCALNET>..114.45':51420
- '<LOCALNET>..114.47':51420
- '<LOCALNET>..114.49':51420
- '<LOCALNET>..114.53':51420
- '<LOCALNET>..114.55':51420
- '<LOCALNET>..114.59':51420
- '<LOCALNET>..114.57':51420
- '<LOCALNET>..114.61':51420
- '<LOCALNET>..114.63':51420
- '<LOCALNET>..114.65':51420
- '<LOCALNET>..114.67':51420
- '<LOCALNET>..114.71':51420
- '<LOCALNET>..114.73':51420
- '<LOCALNET>..114.75':51420
- '<LOCALNET>..114.77':51420
- '<LOCALNET>..114.79':51420
- '<LOCALNET>..114.81':51420
- '<LOCALNET>..114.83':51420
- '<LOCALNET>..114.87':51420
- '<LOCALNET>..114.89':51420
- '<LOCALNET>..114.91':51420
- '<LOCALNET>..114.85':51420
- '<LOCALNET>..114.93':51420
- '<LOCALNET>..114.95':51420
- '<LOCALNET>..114.97':51420
- '<LOCALNET>..114.101':51420
- '<LOCALNET>..114.51':51420
- '<LOCALNET>..114.69':51420
- '<LOCALNET>..114.103':51420
- '<LOCALNET>..114.105':51420
- '<LOCALNET>..114.107':51420
- '<LOCALNET>..114.109':51420
- '<LOCALNET>..114.111':51420
- '<LOCALNET>..114.113':51420
- '<LOCALNET>..114.115':51420
- '<LOCALNET>..114.117':51420
- '<LOCALNET>..114.119':51420
- '<LOCALNET>..114.99':51420
- '<LOCALNET>..114.2':51420
- '<LOCALNET>..114.4':51420
- '<LOCALNET>..114.6':51420
- '<LOCALNET>..114.12':51420
- '<LOCALNET>..114.10':51420
- '<LOCALNET>..114.14':51420
- '<LOCALNET>..114.16':51420
- '<LOCALNET>..114.18':51420
- '<LOCALNET>..114.20':51420
- '<LOCALNET>..114.22':51420
- '<LOCALNET>..114.24':51420
- '<LOCALNET>..114.26':51420
- '<LOCALNET>..114.28':51420
- '<LOCALNET>..114.30':51420
- '<LOCALNET>..114.32':51420
- '<LOCALNET>..114.36':51420
- '<LOCALNET>..114.34':51420
- '<LOCALNET>..114.38':51420
- '<LOCALNET>..114.40':51420
- '<LOCALNET>..114.42':51420
- '<LOCALNET>..114.44':51420
- '<LOCALNET>..114.46':51420
- '<LOCALNET>..114.50':51420
- '<LOCALNET>..114.52':51420
- '<LOCALNET>..114.56':51420
- '<LOCALNET>..114.58':51420
- '<LOCALNET>..114.62':51420
- '<LOCALNET>..114.60':51420
- '<LOCALNET>..114.66':51420
- '<LOCALNET>..114.68':51420
- '<LOCALNET>..114.72':51420
- '<LOCALNET>..114.70':51420
- '<LOCALNET>..114.74':51420
- '<LOCALNET>..114.76':51420
- '<LOCALNET>..114.78':51420
- '<LOCALNET>..114.121':51420
- '<LOCALNET>..114.123':51420
- '<LOCALNET>..114.125':51420
- '<LOCALNET>..114.127':51420
- '<LOCALNET>..114.129':51420
- '<LOCALNET>..114.131':51420
- '<LOCALNET>..114.133':51420
- '<LOCALNET>..114.135':51420
- '<LOCALNET>..114.139':51420
- '<LOCALNET>..114.143':51420
- '<LOCALNET>..114.145':51420
- '<LOCALNET>..114.147':51420
- '<LOCALNET>..114.151':51420
- '<LOCALNET>..114.153':51420
- '<LOCALNET>..114.155':51420
- '<LOCALNET>..114.149':51420
- '<LOCALNET>..114.157':51420
- '<LOCALNET>..114.159':51420
- '<LOCALNET>..114.161':51420
- '<LOCALNET>..114.163':51420
- '<LOCALNET>..114.165':51420
- '<LOCALNET>..114.167':51420
- '<LOCALNET>..114.169':51420
- '<LOCALNET>..114.175':51420
- '<LOCALNET>..114.8':51420
- '<LOCALNET>..114.137':51420
- '<LOCALNET>..114.173':51420
- '<LOCALNET>..114.171':51420
- '<LOCALNET>..114.177':51420
- '<LOCALNET>..114.179':51420
- '<LOCALNET>..114.181':51420
- '<LOCALNET>..114.48':51420
- '<LOCALNET>..114.185':51420
- '<LOCALNET>..114.64':51420
- '<LOCALNET>..114.187':51420
- '<LOCALNET>..114.80':51420
- '<LOCALNET>..114.189':51420
- '<LOCALNET>..114.191':51420
- '<LOCALNET>..114.84':51420
- '<LOCALNET>..114.193':51420
- '<LOCALNET>..114.141':51420
- '<LOCALNET>..114.183':51420
- '<LOCALNET>..114.195':51420
- '<LOCALNET>..114.197':51420
- '<LOCALNET>..114.199':51420
- '<LOCALNET>..114.82':51420
- '<LOCALNET>..114.88':51420
- '<LOCALNET>..114.90':51420
- '<LOCALNET>..114.92':51420
- '<LOCALNET>..114.98':51420
- '<LOCALNET>..114.86':51420
- '<LOCALNET>..114.94':51420
- '<LOCALNET>..114.100':51420
- '<LOCALNET>..114.102':51420
- '<LOCALNET>..114.54':51420
- '<LOCALNET>..114.104':51420
- '<LOCALNET>..114.108':51420
- '<LOCALNET>..114.106':51420
- '<LOCALNET>..114.110':51420
- '<LOCALNET>..114.112':51420
- '<LOCALNET>..114.114':51420
- '<LOCALNET>..114.118':51420
- '<LOCALNET>..114.120':51420
- '<LOCALNET>..114.116':51420
- '<LOCALNET>..114.122':51420
- '<LOCALNET>..114.124':51420
- '<LOCALNET>..114.128':51420
- '<LOCALNET>..114.96':51420
- '<LOCALNET>..114.126':51420
- '<LOCALNET>..114.132':51420
- '<LOCALNET>..114.134':51420
- '<LOCALNET>..114.130':51420
- '<LOCALNET>..114.136':51420
- '<LOCALNET>..114.138':51420
- '<LOCALNET>..114.140':51420
- '<LOCALNET>..114.144':51420
- '<LOCALNET>..114.146':51420
- '<LOCALNET>..114.142':51420
- '<LOCALNET>..114.148':51420
- '<LOCALNET>..114.150':51420
- '<LOCALNET>..114.152':51420
- '<LOCALNET>..114.154':51420
- '<LOCALNET>..114.156':51420
- '<LOCALNET>..114.158':51420
- '<LOCALNET>..114.160':51420
- '<LOCALNET>..114.162':51420
- '<LOCALNET>..114.166':51420
- '<LOCALNET>..114.164':51420
- '<LOCALNET>..114.170':51420
- '<LOCALNET>..114.168':51420
- '<LOCALNET>..114.174':51420
- '<LOCALNET>..114.172':51420
- '<LOCALNET>..114.178':51420
- '<LOCALNET>..114.180':51420
- '<LOCALNET>..114.176':51420
- '<LOCALNET>..114.186':51420
- '<LOCALNET>..114.182':51420
- '<LOCALNET>..114.188':51420
- '<LOCALNET>..114.190':51420
- '<LOCALNET>..114.184':51420
- '<LOCALNET>..114.196':51420
- '<LOCALNET>..114.192':51420
- '<LOCALNET>..114.198':51420
- '<LOCALNET>..114.194':51420
- '43.##9.192.68':46283
- '47.##.113.58':46282
- 'wa###ngwan.site':36281
- '47.##.113.58':46282
- DNS ASK wa###ngwan.site
- DNS ASK 82###836.site
- DNS ASK al###ncom.site
- '255.255.255.255':16527
- '<SYSTEM32>\shrpubw.exe'
- '<SYSTEM32>\cmd.exe' /c del <Full path to file> >> NUL
- '<SYSTEM32>\rundll32.exe' <SYSTEM32>\FirewallControlPanel.dll,ShowNotificationDialog /configure /ETOnly 0 /OnProfiles 6 /OtherAllowed 0 /OtherBlocked 0 /OtherEdgeAllowed 0 /NewBlocked 4 "<SYSTEM32>\shrpubw.exe"
- '<SYSTEM32>\cmd.exe' /c del <Full path to file> >> NUL' (with hidden window)