Technical Information
- <SYSTEM32>\nbtstat.exe
- %WINDIR%\windowsshell673517.log
- %WINDIR%\windowssystemupdate767.log
- '47.#8.35.46':36281
- '<LOCALNET>..25.0':51420
- '<LOCALNET>..25.2':51420
- '<LOCALNET>..25.1':51420
- '<LOCALNET>..25.6':51420
- '<LOCALNET>..25.3':51420
- '<LOCALNET>..25.5':51420
- '<LOCALNET>..25.4':51420
- '<LOCALNET>..25.8':51420
- '<LOCALNET>..25.10':51420
- '<LOCALNET>..25.12':51420
- '<LOCALNET>..25.9':51420
- '<LOCALNET>..25.11':51420
- '<LOCALNET>..25.7':51420
- '<LOCALNET>..25.13':51420
- '<LOCALNET>..25.20':51420
- '<LOCALNET>..25.18':51420
- '<LOCALNET>..25.22':51420
- '<LOCALNET>..25.15':51420
- '<LOCALNET>..25.24':51420
- '<LOCALNET>..25.26':51420
- '<LOCALNET>..25.16':51420
- '<LOCALNET>..25.17':51420
- '<LOCALNET>..25.19':51420
- '<LOCALNET>..25.21':51420
- '<LOCALNET>..25.28':51420
- '<LOCALNET>..25.23':51420
- '<LOCALNET>..25.14':51420
- '<LOCALNET>..25.30':51420
- '<LOCALNET>..25.32':51420
- '<LOCALNET>..25.34':51420
- '<LOCALNET>..25.36':51420
- '<LOCALNET>..25.25':51420
- '<LOCALNET>..25.40':51420
- '<LOCALNET>..25.29':51420
- '<LOCALNET>..25.42':51420
- '<LOCALNET>..25.31':51420
- '<LOCALNET>..25.38':51420
- '<LOCALNET>..25.44':51420
- '<LOCALNET>..25.46':51420
- '<LOCALNET>..25.48':51420
- '<LOCALNET>..25.52':51420
- '<LOCALNET>..25.54':51420
- '<LOCALNET>..25.50':51420
- '<LOCALNET>..25.27':51420
- '<LOCALNET>..25.33':51420
- '<LOCALNET>..25.39':51420
- '<LOCALNET>..25.35':51420
- '<LOCALNET>..25.41':51420
- '<LOCALNET>..25.37':51420
- '<LOCALNET>..25.45':51420
- '<LOCALNET>..25.43':51420
- '<LOCALNET>..25.47':51420
- '<LOCALNET>..25.56':51420
- '<LOCALNET>..25.49':51420
- '<LOCALNET>..25.51':51420
- '<LOCALNET>..25.58':51420
- '<LOCALNET>..25.53':51420
- '<LOCALNET>..25.60':51420
- '<LOCALNET>..25.55':51420
- '<LOCALNET>..25.57':51420
- '<LOCALNET>..25.64':51420
- '<LOCALNET>..25.66':51420
- '<LOCALNET>..25.63':51420
- '<LOCALNET>..25.61':51420
- '<LOCALNET>..25.59':51420
- '<LOCALNET>..25.68':51420
- '<LOCALNET>..25.62':51420
- '<LOCALNET>..25.70':51420
- '<LOCALNET>..25.72':51420
- '<LOCALNET>..25.74':51420
- '<LOCALNET>..25.65':51420
- '<LOCALNET>..25.71':51420
- '<LOCALNET>..25.67':51420
- '<LOCALNET>..25.69':51420
- '<LOCALNET>..25.76':51420
- '<LOCALNET>..25.78':51420
- '<LOCALNET>..25.77':51420
- '<LOCALNET>..25.73':51420
- '<LOCALNET>..25.75':51420
- '<LOCALNET>..25.80':51420
- '<LOCALNET>..25.82':51420
- '<LOCALNET>..25.84':51420
- '<LOCALNET>..25.86':51420
- '<LOCALNET>..25.90':51420
- '<LOCALNET>..25.88':51420
- '<LOCALNET>..25.92':51420
- '<LOCALNET>..25.94':51420
- '<LOCALNET>..25.79':51420
- '<LOCALNET>..25.81':51420
- '<LOCALNET>..25.83':51420
- '<LOCALNET>..25.87':51420
- '<LOCALNET>..25.96':51420
- '<LOCALNET>..25.98':51420
- '<LOCALNET>..25.100':51420
- '<LOCALNET>..25.89':51420
- '<LOCALNET>..25.102':51420
- '<LOCALNET>..25.104':51420
- '<LOCALNET>..25.106':51420
- '<LOCALNET>..25.110':51420
- '<LOCALNET>..25.108':51420
- '<LOCALNET>..25.112':51420
- '<LOCALNET>..25.91':51420
- '<LOCALNET>..25.116':51420
- '<LOCALNET>..25.118':51420
- '<LOCALNET>..25.85':51420
- '<LOCALNET>..25.122':51420
- '<LOCALNET>..25.124':51420
- '<LOCALNET>..25.114':51420
- '<LOCALNET>..25.120':51420
- '<LOCALNET>..25.93':51420
- '<LOCALNET>..25.95':51420
- '<LOCALNET>..25.97':51420
- '<LOCALNET>..25.99':51420
- '<LOCALNET>..25.101':51420
- '<LOCALNET>..25.109':51420
- '<LOCALNET>..25.103':51420
- '<LOCALNET>..25.105':51420
- '<LOCALNET>..25.107':51420
- '<LOCALNET>..25.111':51420
- '<LOCALNET>..25.117':51420
- '<LOCALNET>..25.113':51420
- '<LOCALNET>..25.115':51420
- '<LOCALNET>..25.119':51420
- '<LOCALNET>..25.126':51420
- '<LOCALNET>..25.121':51420
- '<LOCALNET>..25.128':51420
- '<LOCALNET>..25.123':51420
- '<LOCALNET>..25.125':51420
- '<LOCALNET>..25.130':51420
- '<LOCALNET>..25.132':51420
- '<LOCALNET>..25.134':51420
- '<LOCALNET>..25.136':51420
- '<LOCALNET>..25.138':51420
- '<LOCALNET>..25.140':51420
- '<LOCALNET>..25.142':51420
- '<LOCALNET>..25.144':51420
- '<LOCALNET>..25.152':51420
- '<LOCALNET>..25.156':51420
- '<LOCALNET>..25.160':51420
- '<LOCALNET>..25.146':51420
- '<LOCALNET>..25.148':51420
- '<LOCALNET>..25.127':51420
- '<LOCALNET>..25.150':51420
- '<LOCALNET>..25.131':51420
- '<LOCALNET>..25.133':51420
- '<LOCALNET>..25.158':51420
- '<LOCALNET>..25.170':51420
- '<LOCALNET>..25.162':51420
- '<LOCALNET>..25.164':51420
- '<LOCALNET>..25.129':51420
- '<LOCALNET>..25.168':51420
- '<LOCALNET>..25.135':51420
- '<LOCALNET>..25.172':51420
- '<LOCALNET>..25.154':51420
- '<LOCALNET>..25.166':51420
- '<LOCALNET>..25.174':51420
- '<LOCALNET>..25.176':51420
- '<LOCALNET>..25.178':51420
- '<LOCALNET>..25.180':51420
- '<LOCALNET>..25.184':51420
- '<LOCALNET>..25.186':51420
- '<LOCALNET>..25.188':51420
- '<LOCALNET>..25.190':51420
- '<LOCALNET>..25.192':51420
- '<LOCALNET>..25.194':51420
- '<LOCALNET>..25.198':51420
- '<LOCALNET>..25.196':51420
- '<LOCALNET>..25.182':51420
- '<LOCALNET>..25.139':51420
- '<LOCALNET>..25.143':51420
- '<LOCALNET>..25.147':51420
- '<LOCALNET>..25.149':51420
- '<LOCALNET>..25.151':51420
- '<LOCALNET>..25.137':51420
- '<LOCALNET>..25.153':51420
- '<LOCALNET>..25.157':51420
- '<LOCALNET>..25.161':51420
- '<LOCALNET>..25.145':51420
- '<LOCALNET>..25.141':51420
- '<LOCALNET>..25.159':51420
- '<LOCALNET>..25.155':51420
- '<LOCALNET>..25.165':51420
- '<LOCALNET>..25.163':51420
- '<LOCALNET>..25.169':51420
- '<LOCALNET>..25.167':51420
- '<LOCALNET>..25.173':51420
- '<LOCALNET>..25.175':51420
- '<LOCALNET>..25.171':51420
- '<LOCALNET>..25.177':51420
- '<LOCALNET>..25.179':51420
- '<LOCALNET>..25.181':51420
- '<LOCALNET>..25.187':51420
- '<LOCALNET>..25.185':51420
- '<LOCALNET>..25.189':51420
- '<LOCALNET>..25.183':51420
- '<LOCALNET>..25.191':51420
- '<LOCALNET>..25.193':51420
- '<LOCALNET>..25.197':51420
- '<LOCALNET>..25.199':51420
- '<LOCALNET>..25.195':51420
- '43.##9.192.68':46283
- '47.##.113.58':46282
- '47.#8.35.46':36281
- '255.255.255.255':10596
- '<SYSTEM32>\nbtstat.exe'
- '<SYSTEM32>\rundll32.exe' <SYSTEM32>\FirewallControlPanel.dll,ShowNotificationDialog /configure /ETOnly 0 /OnProfiles 6 /OtherAllowed 0 /OtherBlocked 0 /OtherEdgeAllowed 0 /NewBlocked 4 "<SYSTEM32>\nbtstat.exe"
- '<SYSTEM32>\cmd.exe' /c del <Full path to file> >> NUL
- '<SYSTEM32>\cmd.exe' /c del <Full path to file> >> NUL' (with hidden window)