Technical Information
- %WINDIR%\Tasks\SA.DAT
- '<SYSTEM32>\svchost.exe' -k netsvcs
- %CommonProgramFiles%\Microsoft Shared\Stationery\nsqjttkv.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bnbtzwxt.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\tlcwjrwt.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\njbsvtll.exe
- %CommonProgramFiles%\System\ado\tsektjkj.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\brvrjrke.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\ehbebsrn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bzqlkhrh.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\xrljqjzn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bhrhnkht.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\vkjljzrn.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\bcwvzwbh.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\elwtjnbj.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\qjllsjhl.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\czjevcet.exe
- '59.##6.66.139':445
- '59.##6.56.199':445
- '59.##6.244.115':445
- '59.##6.74.201':445
- '59.##6.57.29':445
- '59.#26.77.6':445
- '59.##6.14.23':445
- '59.##6.34.180':445
- '59.##6.60.161':445
- '59.##6.129.203':139
- '59.##6.95.171':139
- '59.##6.193.124':139
- '59.##6.142.202':139
- '59.##6.25.168':139
- '59.##6.155.193':445
- '59.##6.118.241':445
- '59.##6.154.225':139
- '59.##6.24.196':139
- '59.##6.129.0':139
- '59.##6.191.36':139
- '59.##6.154.225':445
- '59.##6.24.196':445
- '59.##6.80.191':139
- '59.##6.236.31':139
- '59.##6.87.225':139
- '59.##6.20.81':139
- '59.##6.45.31':139
- '59.##6.125.82':445
- '59.##6.247.157':445
- '59.##6.77.143':445
- '59.##6.139.74':445
- '59.##6.193.124':445
- '59.##6.95.171':445
- '59.##6.25.168':445
- '59.##6.142.202':445
- '59.##6.129.203':445
- '59.##6.125.82':139
- '59.##6.99.76':445
- '59.##6.122.25':445
- '59.##6.166.37':445
- '59.##6.47.228':445
- '59.##6.247.182':445
- '59.##6.48.63':445
- '59.##6.24.10':445
- '59.##6.145.9':445
- '59.##6.89.90':445
- '59.##6.12.249':445
- '59.##6.148.32':445
- '59.##6.155.245':445
- '59.##6.152.164':445
- '59.##6.48.95':445
- '59.##6.126.254':445
- '59.##6.161.170':445
- '59.##6.51.219':445
- '59.##6.167.253':445
- '59.##6.34.180':139
- '59.##6.60.161':139
- '59.##6.56.199':139
- '59.##6.57.29':139
- '59.#26.77.6':139
- '59.##6.139.74':139
- '59.##6.247.157':139
- '59.##6.77.143':139
- '59.##6.14.23':139
- '59.#26.6.66':445
- '59.##6.152.130':445
- '59.##6.236.47':445
- '59.##6.129.217':445
- '59.##6.155.193':139
- '59.##6.74.201':139
- '59.##6.66.139':139
- '59.##6.118.241':139
- '59.##6.244.115':139
- '59.##6.120.106':445
- '59.##6.51.203':445
- '59.##6.63.158':445
- '59.##6.106.126':445
- '59.##6.82.214':445
- '59.##6.98.92':139
- '59.##6.184.161':139
- '59.##6.77.91':139
- '59.##6.92.88':139
- '59.##6.154.15':445
- '59.##6.104.172':445
- '59.##6.3.123':445
- '59.##6.83.79':445
- '59.##6.162.194':445
- '59.##6.216.169':445
- '59.##6.235.124':445
- '59.##6.241.227':445
- '59.##6.125.174':445
- '59.##6.64.160':139
- '59.##6.198.232':139
- '59.##6.148.234':139
- '59.##6.27.206':139
- '59.##6.11.10':139
- '59.##6.106.169':139
- '59.##6.22.137':139
- '59.##6.147.229':139
- '59.##6.66.147':139
- '59.##6.202.139':139
- '59.##6.212.244':139
- '59.##6.66.47':139
- '59.##6.211.107':139
- '59.##6.146.177':139
- '59.##6.190.132':139
- '59.#26.6.22':139
- '59.##6.247.180':139
- '59.#26.49.2':139
- '59.##6.89.71':445
- '59.##6.104.172':139
- '59.##6.241.227':139
- '59.##6.83.79':139
- '59.##6.154.15':139
- '59.##6.162.194':139
- '59.##6.235.124':139
- '59.##6.63.158':139
- '59.##6.125.174':139
- '59.##6.216.169':139
- '59.##6.252.125':139
- '59.##6.186.252':139
- '59.##6.110.87':139
- '59.##6.125.110':139
- '59.##6.92.104':139
- '59.##6.89.71':139
- '59.##6.3.123':139
- '59.##6.45.74':139
- '59.##6.96.126':139
- '59.##6.110.87':445
- '59.##6.125.110':445
- '59.##6.236.31':445
- '59.##6.87.225':445
- '59.##6.252.125':445
- '59.##6.45.74':445
- '59.##6.96.126':445
- '59.##6.186.252':445
- '59.##6.92.104':445
- '59.##6.51.203':139
- '59.##6.82.214':139
- '59.##6.106.126':139
- '59.##6.120.106':139
- '59.##6.129.0':445
- '59.##6.20.81':445
- '59.##6.45.31':445
- '59.##6.191.36':445
- '59.##6.80.191':445
- '59.##6.127.55':445
- '59.##6.32.154':139
- '59.##6.31.81':139
- '59.##6.196.232':139
- '59.##6.154.155':139
- '59.##6.109.138':139
- '59.##6.39.118':445
- '59.##6.182.65':445
- '59.##6.96.54':445
- '59.##6.48.117':445
- '59.##6.129.244':139
- '59.##6.120.6':139
- '59.##6.157.163':139
- '59.##6.62.113':139
- '59.##6.113.119':139
- '59.##6.36.42':139
- '59.#26.7.13':139
- '59.##6.78.127':139
- '59.##6.27.254':139
- '59.##6.208.218':445
- '59.##6.254.2':445
- '59.##6.215.156':445
- '59.##6.215.34':445
- '59.##6.97.55':445
- '59.##6.237.43':445
- '59.##6.84.48':445
- '59.##6.121.147':445
- '59.##6.186.213':445
- '59.##6.86.224':445
- '59.##6.117.96':445
- '59.##6.85.12':445
- '59.##6.223.188':445
- '59.##6.87.107':445
- '59.##6.64.23':445
- '59.##6.16.48':445
- '59.##6.120.87':445
- '59.##6.73.111':445
- '59.##6.130.206':139
- '59.##6.64.23':139
- '59.##6.16.48':139
- '59.##6.120.87':139
- '59.##6.73.111':139
- '59.##6.215.156':139
- '59.##6.254.2':139
- '59.##6.97.55':139
- '59.##6.215.34':139
- '59.##6.208.218':139
- '59.##6.117.96':139
- '59.##6.85.12':139
- '59.##6.96.54':139
- '59.##6.223.188':139
- '59.##6.48.117':139
- '59.##6.86.224':139
- '59.##6.87.107':139
- '59.##6.39.118':139
- '59.##6.182.65':139
- '59.##6.58.168':139
- '59.##6.237.57':139
- '59.##6.163.168':139
- '59.##6.168.148':139
- '59.##6.3.235':139
- '59.##6.156.72':139
- '59.##6.1.147':139
- '59.##6.124.193':139
- '59.##6.193.232':139
- '59.##6.237.43':139
- '59.##6.84.48':139
- '59.##6.121.147':139
- '59.##6.186.213':139
- '59.##6.174.138':139
- '59.##6.45.135':139
- '59.##6.247.203':139
- '59.##6.52.135':139
- '59.##6.108.235':139
- '59.##6.48.95':139
- '59.##6.148.32':139
- '59.##6.152.164':139
- '59.##6.12.249':139
- '59.##6.51.219':139
- '59.##6.161.170':139
- '59.##6.166.37':139
- '59.##6.167.253':139
- '59.##6.126.254':139
- '59.##6.194.92':139
- '59.##6.192.139':139
- '59.##6.113.119':9988
- '59.##6.73.104':139
- '59.##6.72.92':139
- '59.##6.127.55':139
- '59.##6.155.245':139
- '59.##6.39.220':139
- '59.##6.40.185':139
- '59.##6.152.130':139
- '59.##6.73.104':445
- '59.##6.129.217':139
- '59.#26.6.66':139
- '59.##6.194.92':445
- '59.##6.39.220':445
- '59.##6.40.185':445
- '59.##6.192.139':445
- '59.##6.72.92':445
- '59.##6.122.25':139
- '59.##6.247.182':139
- '59.##6.47.228':139
- '59.##6.99.76':139
- '59.##6.145.9':139
- '59.##6.48.63':139
- '59.##6.236.47':139
- '59.##6.24.10':139
- '59.##6.89.90':139
- '59.##6.168.148':9988
- '59.##6.193.232':445
- '59.##6.156.72':445
- '59.##6.3.235':445
- '59.##6.124.193':445
- '59.##6.1.147':445
- '59.##6.157.163':445
- '59.##6.120.6':445
- '59.##6.130.206':445
- '59.##6.62.113':445
- '59.##6.108.235':445
- '59.##6.45.135':445
- '59.##6.174.138':445
- '59.##6.52.135':445
- '59.##6.247.203':445
- '59.##6.237.57':445
- '59.##6.58.168':445
- '59.##6.163.168':445
- '59.##6.168.148':445
- '59.##6.215.156':9988
- '59.##6.39.118':9988
- '59.##6.31.81':445
- '59.##6.109.138':445
- '59.##6.73.111':9988
- '59.##6.121.147':9988
- '59.##6.84.48':9988
- '59.##6.120.87':9988
- '59.##6.237.43':9988
- '59.##6.78.127':445
- '59.##6.27.254':445
- '59.##6.129.244':445
- '59.##6.113.119':445
- '59.##6.36.42':445
- '59.##6.154.155':445
- '59.##6.32.154':445
- '59.#26.7.13':445
- '59.##6.196.232':445