Technical Information
- <SYSTEM32>\proquota.exe
- %WINDIR%\windowsshell821748.log
- %WINDIR%\windowssystemupdate57.log
- '47.#8.35.46':36281
- '<LOCALNET>..70.0':51420
- '<LOCALNET>..70.2':51420
- '<LOCALNET>..70.4':51420
- '<LOCALNET>..70.6':51420
- '<LOCALNET>..70.1':51420
- '<LOCALNET>..70.3':51420
- '<LOCALNET>..70.5':51420
- '<LOCALNET>..70.7':51420
- '<LOCALNET>..70.9':51420
- '<LOCALNET>..70.11':51420
- '<LOCALNET>..70.15':51420
- '<LOCALNET>..70.17':51420
- '<LOCALNET>..70.19':51420
- '<LOCALNET>..70.21':51420
- '<LOCALNET>..70.23':51420
- '<LOCALNET>..70.25':51420
- '<LOCALNET>..70.29':51420
- '<LOCALNET>..70.31':51420
- '<LOCALNET>..70.33':51420
- '<LOCALNET>..70.35':51420
- '<LOCALNET>..70.37':51420
- '<LOCALNET>..70.39':51420
- '<LOCALNET>..70.41':51420
- '<LOCALNET>..70.43':51420
- '<LOCALNET>..70.47':51420
- '<LOCALNET>..70.49':51420
- '<LOCALNET>..70.51':51420
- '<LOCALNET>..70.53':51420
- '<LOCALNET>..70.55':51420
- '<LOCALNET>..70.59':51420
- '<LOCALNET>..70.63':51420
- '<LOCALNET>..70.65':51420
- '<LOCALNET>..70.67':51420
- '<LOCALNET>..70.13':51420
- '<LOCALNET>..70.61':51420
- '<LOCALNET>..70.69':51420
- '<LOCALNET>..70.71':51420
- '<LOCALNET>..70.73':51420
- '<LOCALNET>..70.75':51420
- '<LOCALNET>..70.8':51420
- '<LOCALNET>..70.77':51420
- '<LOCALNET>..70.10':51420
- '<LOCALNET>..70.79':51420
- '<LOCALNET>..70.14':51420
- '<LOCALNET>..70.81':51420
- '<LOCALNET>..70.18':51420
- '<LOCALNET>..70.20':51420
- '<LOCALNET>..70.22':51420
- '<LOCALNET>..70.24':51420
- '<LOCALNET>..70.83':51420
- '<LOCALNET>..70.85':51420
- '<LOCALNET>..70.89':51420
- '<LOCALNET>..70.28':51420
- '<LOCALNET>..70.26':51420
- '<LOCALNET>..70.32':51420
- '<LOCALNET>..70.34':51420
- '<LOCALNET>..70.36':51420
- '<LOCALNET>..70.38':51420
- '<LOCALNET>..70.40':51420
- '<LOCALNET>..70.42':51420
- '<LOCALNET>..70.44':51420
- '<LOCALNET>..70.46':51420
- '<LOCALNET>..70.48':51420
- '<LOCALNET>..70.30':51420
- '<LOCALNET>..70.91':51420
- '<LOCALNET>..70.50':51420
- '<LOCALNET>..70.93':51420
- '<LOCALNET>..70.52':51420
- '<LOCALNET>..70.95':51420
- '<LOCALNET>..70.54':51420
- '<LOCALNET>..70.56':51420
- '<LOCALNET>..70.97':51420
- '<LOCALNET>..70.58':51420
- '<LOCALNET>..70.99':51420
- '<LOCALNET>..70.60':51420
- '<LOCALNET>..70.62':51420
- '<LOCALNET>..70.101':51420
- '<LOCALNET>..70.64':51420
- '<LOCALNET>..70.105':51420
- '<LOCALNET>..70.66':51420
- '<LOCALNET>..70.107':51420
- '<LOCALNET>..70.68':51420
- '<LOCALNET>..70.70':51420
- '<LOCALNET>..70.109':51420
- '<LOCALNET>..70.72':51420
- '<LOCALNET>..70.111':51420
- '<LOCALNET>..70.76':51420
- '<LOCALNET>..70.113':51420
- '<LOCALNET>..70.78':51420
- '<LOCALNET>..70.80':51420
- '<LOCALNET>..70.115':51420
- '<LOCALNET>..70.84':51420
- '<LOCALNET>..70.27':51420
- '<LOCALNET>..70.86':51420
- '<LOCALNET>..70.88':51420
- '<LOCALNET>..70.45':51420
- '<LOCALNET>..70.57':51420
- '<LOCALNET>..70.90':51420
- '<LOCALNET>..70.119':51420
- '<LOCALNET>..70.92':51420
- '<LOCALNET>..70.123':51420
- '<LOCALNET>..70.94':51420
- '<LOCALNET>..70.87':51420
- '<LOCALNET>..70.96':51420
- '<LOCALNET>..70.98':51420
- '<LOCALNET>..70.117':51420
- '<LOCALNET>..70.74':51420
- '<LOCALNET>..70.125':51420
- '<LOCALNET>..70.127':51420
- '<LOCALNET>..70.100':51420
- '<LOCALNET>..70.131':51420
- '<LOCALNET>..70.12':51420
- '<LOCALNET>..70.135':51420
- '<LOCALNET>..70.133':51420
- '<LOCALNET>..70.16':51420
- '<LOCALNET>..70.137':51420
- '<LOCALNET>..70.82':51420
- '<LOCALNET>..70.104':51420
- '<LOCALNET>..70.106':51420
- '<LOCALNET>..70.108':51420
- '<LOCALNET>..70.139':51420
- '<LOCALNET>..70.110':51420
- '<LOCALNET>..70.141':51420
- '<LOCALNET>..70.143':51420
- '<LOCALNET>..70.112':51420
- '<LOCALNET>..70.145':51420
- '<LOCALNET>..70.114':51420
- '<LOCALNET>..70.116':51420
- '<LOCALNET>..70.118':51420
- '<LOCALNET>..70.122':51420
- '<LOCALNET>..70.151':51420
- '<LOCALNET>..70.124':51420
- '<LOCALNET>..70.155':51420
- '<LOCALNET>..70.153':51420
- '<LOCALNET>..70.149':51420
- '<LOCALNET>..70.159':51420
- '<LOCALNET>..70.121':51420
- '<LOCALNET>..70.165':51420
- '<LOCALNET>..70.169':51420
- '<LOCALNET>..70.173':51420
- '<LOCALNET>..70.172':51420
- '<LOCALNET>..70.177':51420
- '<LOCALNET>..70.179':51420
- '<LOCALNET>..70.181':51420
- '<LOCALNET>..70.183':51420
- '<LOCALNET>..70.167':51420
- '<LOCALNET>..70.170':51420
- '<LOCALNET>..70.185':51420
- '<LOCALNET>..70.187':51420
- '<LOCALNET>..70.176':51420
- '<LOCALNET>..70.147':51420
- '<LOCALNET>..70.189':51420
- '<LOCALNET>..70.174':51420
- '<LOCALNET>..70.191':51420
- '<LOCALNET>..70.193':51420
- '<LOCALNET>..70.178':51420
- '<LOCALNET>..70.180':51420
- '<LOCALNET>..70.195':51420
- '<LOCALNET>..70.182':51420
- '<LOCALNET>..70.184':51420
- '<LOCALNET>..70.197':51420
- '<LOCALNET>..70.186':51420
- '<LOCALNET>..70.199':51420
- '<LOCALNET>..70.190':51420
- '<LOCALNET>..70.175':51420
- '<LOCALNET>..70.188':51420
- '<LOCALNET>..70.192':51420
- '<LOCALNET>..70.194':51420
- '<LOCALNET>..70.196':51420
- '<LOCALNET>..70.198':51420
- '<LOCALNET>..70.157':51420
- '<LOCALNET>..70.163':51420
- '<LOCALNET>..70.162':51420
- '<LOCALNET>..70.161':51420
- '<LOCALNET>..70.103':51420
- '<LOCALNET>..70.138':51420
- '<LOCALNET>..70.140':51420
- '<LOCALNET>..70.144':51420
- '<LOCALNET>..70.146':51420
- '<LOCALNET>..70.150':51420
- '<LOCALNET>..70.154':51420
- '<LOCALNET>..70.156':51420
- '<LOCALNET>..70.160':51420
- '<LOCALNET>..70.164':51420
- '<LOCALNET>..70.166':51420
- '<LOCALNET>..70.168':51420
- '<LOCALNET>..70.134':51420
- '<LOCALNET>..70.171':51420
- '<LOCALNET>..70.148':51420
- '<LOCALNET>..70.129':51420
- '<LOCALNET>..70.152':51420
- '<LOCALNET>..70.142':51420
- '<LOCALNET>..70.132':51420
- '<LOCALNET>..70.128':51420
- '<LOCALNET>..70.130':51420
- '<LOCALNET>..70.120':51420
- '<LOCALNET>..70.102':51420
- '<LOCALNET>..70.126':51420
- '<LOCALNET>..70.136':51420
- '<LOCALNET>..70.158':51420
- '43.##9.192.68':46283
- '47.##.113.58':46282
- '47.#8.35.46':36283
- '47.#8.35.46':36281
- '47.##.113.58':46282
- '47.#8.35.46':36283
- '255.255.255.255':14033
- '<SYSTEM32>\proquota.exe'
- '<SYSTEM32>\rundll32.exe' <SYSTEM32>\FirewallControlPanel.dll,ShowNotificationDialog /configure /ETOnly 0 /OnProfiles 6 /OtherAllowed 0 /OtherBlocked 0 /OtherEdgeAllowed 0 /NewBlocked 4 "<SYSTEM32>\proquota.exe"
- '<SYSTEM32>\cmd.exe' /c del <Full path to file> >> NUL
- '<SYSTEM32>\cmd.exe' /c del <Full path to file> >> NUL' (with hidden window)