ThreatExpert Report

Submission Summary:

Submission details:

Submission received: 14 February 2008, 20:56:38
Processing time: 3 min 31 sec
Submitted sample:

File MD5: 0x3E4FD68BF2B3BE70A583B043F8C93E32
File SHA-1: 0xCD6C2025B0255BB4FB0412BA7B80AFE83F7A3DA4
Filesize: 116,225 bytes

Summary of the findings:

What's been found	Severity Level
Threat characteristics of the Storm worm (aka CME-711/Peacomm/Nuwar/Zhelatin/Tibs). This threat is normally received as an email attachment; it may consist of a rootkit, a peer-to-peer client, and a mass-mailing worm component. To bypass firewalls, its code may be injected and run from the legitimate services.exe process.
Capability to send out email message(s) with the built-in SMTP client engine.
Searching for email addresses by enumerating files with the certain extensions. This functionality is used by mass-mailers and spam-bots.
Backdoor functionality: connected remote users are able to perform multiple actions on the compromised system.
Contains characteristics of an identified security risk.

Technical Details:

Possible Security Risk

Attention! The following threat categories were identified:

Threat Category	Description
	A malicious backdoor trojan that runs in the background and allows remote access to the compromised system
	A network-aware worm that attempts to replicate across the existing network(s)

File System Modifications

The following files were created in the system:

#	Filename(s)	File Size	File Hash
1	%System%\diperto.ini	38,701 bytes	MD5: 0xC2F3D9DE7D5C202E73F00053ACDEFA7E SHA-1: 0x3A61571F852F6A05E4ECB3084A69BA99B9144BA7
2	%System%\diperto1205-67d5.sys	129,920 bytes	MD5: 0xF75CED55DDF2005BF949A35534057887 SHA-1: 0x042038D4315DDBBBA5874BF0298430601B61990B
3	[file and pathname of the sample #1]	116,225 bytes	MD5: 0x3E4FD68BF2B3BE70A583B043F8C93E32 SHA-1: 0xCD6C2025B0255BB4FB0412BA7B80AFE83F7A3DA4

Note:

%System% is a variable that refers to the System folder. By default, this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).

Memory Modifications

There was a new process created in the system:

Process Name	Process Filename	Main Module Size
[filename of the sample #1]	[file and pathname of the sample #1]	135,168 bytes

There was a new memory page created in the address space of the system process(es):

Process Name	Process Filename	Allocated Size
services.exe	%System%\services.exe	135,168 bytes

There was a new kernel-mode driver installed in the system:

Driver Name	Driver Filename
diperto1205-67d5	%System%\diperto1205-67d5.sys

Registry Modifications

The following Registry Keys were created:

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_DIPERTO1205-67D5
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_DIPERTO1205-67D5\0000
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_DIPERTO1205-67D5\0000\Control
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\diperto1205-67d5
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\diperto1205-67d5\Security
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\diperto1205-67d5\Enum
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_DIPERTO1205-67D5
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_DIPERTO1205-67D5\0000
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_DIPERTO1205-67D5\0000\Control
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\diperto1205-67d5
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\diperto1205-67d5\Security
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\diperto1205-67d5\Enum

The newly created Registry Values are:

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_DIPERTO1205-67D5\0000\Control]

*NewlyCreated* = 0x00000000
ActiveService = "diperto1205-67d5"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_DIPERTO1205-67D5\0000]

Service = "diperto1205-67d5"
Legacy = 0x00000001
ConfigFlags = 0x00000000
Class = "LegacyDriver"
ClassGUID = "{8ECC055D-047F-11D1-A537-0000F8753ED1}"
DeviceDesc = "diperto1205-67d5"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_DIPERTO1205-67D5]

NextInstance = 0x00000001

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\diperto1205-67d5\Enum]

0 = "Root\LEGACY_DIPERTO1205-67D5\0000"
Count = 0x00000001
NextInstance = 0x00000001

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\diperto1205-67d5\Security]

Security = 01 00 14 80 90 00 00 00 9C 00 00 00 14 00 00 00 30 00 00 00 02 00 1C 00 01 00 00 00 02 80 14 00 FF 01 0F 00 01 01 00 00 00 00 00 01 00 00 00 00 02 00 60 00 04 00 00 00 00 00 14 00 FD 01 02 00 01 01 00 00 00 00 00 05 12 00 00 00 00 00 18 00 FF 01 0F 0

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\diperto1205-67d5]

Type = 0x00000001
Start = 0x00000002
ErrorControl = 0x00000001
ImagePath = "%System%\diperto1205-67d5.sys"
DisplayName = "diperto1205-67d5"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_DIPERTO1205-67D5\0000\Control]

*NewlyCreated* = 0x00000000
ActiveService = "diperto1205-67d5"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_DIPERTO1205-67D5\0000]

Service = "diperto1205-67d5"
Legacy = 0x00000001
ConfigFlags = 0x00000000
Class = "LegacyDriver"
ClassGUID = "{8ECC055D-047F-11D1-A537-0000F8753ED1}"
DeviceDesc = "diperto1205-67d5"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_DIPERTO1205-67D5]

NextInstance = 0x00000001

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\diperto1205-67d5\Enum]

0 = "Root\LEGACY_DIPERTO1205-67D5\0000"
Count = 0x00000001
NextInstance = 0x00000001

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\diperto1205-67d5\Security]

Security = 01 00 14 80 90 00 00 00 9C 00 00 00 14 00 00 00 30 00 00 00 02 00 1C 00 01 00 00 00 02 80 14 00 FF 01 0F 00 01 01 00 00 00 00 00 01 00 00 00 00 02 00 60 00 04 00 00 00 00 00 14 00 FD 01 02 00 01 01 00 00 00 00 00 05 12 00 00 00 00 00 18 00 FF 01 0F 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\diperto1205-67d5]

Type = 0x00000001
Start = 0x00000002
ErrorControl = 0x00000001
ImagePath = "%System%\diperto1205-67d5.sys"
DisplayName = "diperto1205-67d5"

Heuristics Analysis

Heuristically identified details of the peer-to-peer botnet that could be used to download the latest instructions:

IP address: 12.214.95.95; port: 33137
IP address: 12.195.84.84; port: 15553
IP address: 12.214.76.76; port: 19151
IP address: 24.82.164.164; port: 6439
IP address: 24.231.226.226; port: 17890
IP address: 24.23.223.223; port: 19074
IP address: 24.109.85.85; port: 4839
IP address: 24.214.227.227; port: 9896
IP address: 24.225.37.37; port: 9956
IP address: 24.174.186.186; port: 32224
IP address: 24.154.221.221; port: 8819
IP address: 24.140.50.50; port: 11217
IP address: 24.113.170.170; port: 30924
IP address: 24.69.200.200; port: 27712
IP address: 24.60.209.209; port: 8815
IP address: 24.149.210.210; port: 29595
IP address: 24.6.10.10; port: 8429
IP address: 24.121.73.73; port: 12358
IP address: 24.184.11.11; port: 14056
IP address: 24.10.206.206; port: 19400
IP address: 24.111.109.109; port: 1623
IP address: 24.34.58.58; port: 24881
IP address: 24.2.215.215; port: 12165
IP address: 24.212.92.92; port: 31713
IP address: 24.60.78.78; port: 1357
IP address: 24.161.112.112; port: 25606
IP address: 24.10.223.223; port: 6915
IP address: 24.0.128.128; port: 17736
IP address: 24.126.138.138; port: 29972
IP address: 24.247.133.133; port: 7443
IP address: 24.8.215.215; port: 15733
IP address: 24.187.40.40; port: 29046
IP address: 24.41.35.35; port: 1756
IP address: 24.216.118.118; port: 14073
IP address: 24.144.96.96; port: 8682
IP address: 24.60.212.212; port: 29646
IP address: 24.16.240.240; port: 4848
IP address: 24.0.242.242; port: 13859
IP address: 24.224.192.192; port: 28488
IP address: 32.107.9.9; port: 24015
IP address: 41.242.236.236; port: 21776
IP address: 41.244.240.240; port: 10775
IP address: 41.251.83.83; port: 28840
IP address: 41.243.215.215; port: 5980
IP address: 41.240.87.87; port: 25842
IP address: 58.10.27.27; port: 19439
IP address: 58.8.59.59; port: 25126
IP address: 58.9.92.92; port: 26700
IP address: 58.8.151.151; port: 5191
IP address: 58.176.5.5; port: 17153
IP address: 58.226.30.30; port: 8485
IP address: 58.90.245.245; port: 25143
IP address: 58.177.165.165; port: 10196
IP address: 58.72.24.24; port: 5084
IP address: 58.9.231.231; port: 23968
IP address: 58.239.129.129; port: 9051
IP address: 59.92.16.16; port: 17320
IP address: 59.95.170.170; port: 14283
IP address: 59.95.50.50; port: 26417
IP address: 59.94.187.187; port: 33326
IP address: 59.94.178.178; port: 8103
IP address: 59.93.39.39; port: 22441
IP address: 59.95.50.50; port: 10621
IP address: 59.94.114.114; port: 12255
IP address: 59.164.145.145; port: 32541
IP address: 59.28.133.133; port: 15244
IP address: 59.160.99.99; port: 7897
IP address: 59.94.103.103; port: 29689
IP address: 59.161.103.103; port: 6242
IP address: 59.93.241.241; port: 16788
IP address: 59.92.86.86; port: 7764
IP address: 59.184.38.38; port: 24435
IP address: 59.0.88.88; port: 30933
IP address: 59.162.187.187; port: 3827
IP address: 59.6.133.133; port: 11620
IP address: 59.93.208.208; port: 12997
IP address: 59.93.93.93; port: 8429
IP address: 59.114.198.198; port: 31074
IP address: 59.92.252.252; port: 3548
IP address: 59.20.187.187; port: 4127
IP address: 59.163.5.5; port: 33043
IP address: 59.4.16.16; port: 27566
IP address: 59.95.96.96; port: 18105
IP address: 59.94.185.185; port: 12984
IP address: 59.93.202.202; port: 21090
IP address: 59.99.12.12; port: 19439
IP address: 59.96.40.40; port: 22351
IP address: 59.93.199.199; port: 29273
IP address: 59.165.17.17; port: 3188
IP address: 59.90.16.16; port: 16432
IP address: 59.155.197.197; port: 32541
IP address: 59.95.116.116; port: 14185
IP address: 59.9.151.151; port: 27875
IP address: 59.93.1.1; port: 19413
IP address: 59.92.123.123; port: 8292
IP address: 60.50.92.92; port: 23496
IP address: 60.184.194.194; port: 19357
IP address: 60.20.208.208; port: 19430
IP address: 60.216.123.123; port: 26262
IP address: 60.45.70.70; port: 12156
IP address: 60.50.254.254; port: 15240
IP address: 61.98.11.11; port: 8901
IP address: 61.11.47.47; port: 12109
IP address: 61.36.53.53; port: 24911
IP address: 61.178.213.213; port: 17028
IP address: 61.72.147.147; port: 29333
IP address: 62.24.121.121; port: 11594
IP address: 62.129.190.190; port: 23955
IP address: 62.64.114.114; port: 15536
IP address: 62.42.12.12; port: 18439
IP address: 62.215.233.233; port: 22295
IP address: 62.87.185.185; port: 13473
IP address: 63.161.253.253; port: 16891
IP address: 63.133.128.128; port: 10136
IP address: 64.46.23.23; port: 22625
IP address: 64.157.92.92; port: 6212
IP address: 64.113.109.109; port: 15360
IP address: 64.4.98.98; port: 9501
IP address: 64.148.255.255; port: 19902
IP address: 64.126.82.82; port: 1181
IP address: 64.53.170.170; port: 29020
IP address: 65.34.217.217; port: 17976
IP address: 65.29.157.157; port: 20262
IP address: 65.161.143.143; port: 32927
IP address: 65.100.114.114; port: 1966
IP address: 65.24.166.166; port: 25932
IP address: 65.94.51.51; port: 30255
IP address: 65.30.217.217; port: 31276
IP address: 65.186.84.84; port: 28758
IP address: 65.31.215.215; port: 28887
IP address: 66.229.155.155; port: 17766
IP address: 66.177.193.193; port: 30864
IP address: 66.130.195.195; port: 11363
IP address: 66.190.52.52; port: 10891
IP address: 66.154.94.94; port: 18002
IP address: 66.169.129.129; port: 24362
IP address: 66.154.94.94; port: 23556
IP address: 66.161.195.195; port: 16711
IP address: 66.91.245.245; port: 19353
IP address: 66.102.80.80; port: 3081
IP address: 66.72.176.176; port: 18924
IP address: 67.176.252.252; port: 4942
IP address: 67.169.121.121; port: 1108
IP address: 67.174.99.99; port: 16445
IP address: 67.169.245.245; port: 2236
IP address: 67.169.225.225; port: 31332
IP address: 67.182.11.11; port: 28441
IP address: 67.181.156.156; port: 32198
IP address: 67.82.0.0; port: 33622
IP address: 67.85.32.32; port: 3887
IP address: 67.193.43.43; port: 29346
IP address: 67.160.70.70; port: 32927
IP address: 67.165.46.46; port: 28883
IP address: 67.50.41.41; port: 24731
IP address: 67.182.46.46; port: 21073
IP address: 67.172.99.99; port: 20138
IP address: 67.83.32.32; port: 13344
IP address: 67.171.187.187; port: 14412
IP address: 67.8.190.190; port: 19936
IP address: 67.176.216.216; port: 1597
IP address: 67.94.179.179; port: 16741
IP address: 68.36.219.219; port: 26944
IP address: 68.56.146.146; port: 29728
IP address: 68.229.38.38; port: 24461
IP address: 68.147.252.252; port: 11899
IP address: 68.228.48.48; port: 15158
IP address: 68.104.41.41; port: 25829
IP address: 68.32.66.66; port: 26211
IP address: 68.114.165.165; port: 20597
IP address: 68.2.162.162; port: 8781
IP address: 68.60.141.141; port: 3827
IP address: 68.6.51.51; port: 16891
IP address: 68.83.205.205; port: 5397
IP address: 68.207.105.105; port: 31692
IP address: 68.81.122.122; port: 10621
IP address: 68.199.226.226; port: 22252
IP address: 68.60.57.57; port: 19430
IP address: 68.83.205.205; port: 16278
IP address: 68.192.40.40; port: 6769
IP address: 68.52.142.142; port: 20138
IP address: 68.100.253.253; port: 9999
IP address: 68.186.95.95; port: 9703
IP address: 68.60.20.20; port: 9501
IP address: 68.188.156.156; port: 29003
IP address: 68.108.119.119; port: 19945
IP address: 68.2.139.139; port: 25829
IP address: 68.1.104.104; port: 2562
IP address: 68.96.109.109; port: 11856
IP address: 68.192.136.136; port: 16286
IP address: 68.104.70.70; port: 26039
IP address: 68.106.22.22; port: 17624
IP address: 68.41.205.205; port: 13992
IP address: 68.113.203.203; port: 8292
IP address: 68.0.250.250; port: 17826
IP address: 68.53.115.115; port: 19074
IP address: 68.227.14.14; port: 16368
IP address: 68.144.227.227; port: 19031
IP address: 68.11.127.127; port: 20262
IP address: 68.151.203.203; port: 24731
IP address: 68.192.236.236; port: 14768
IP address: 68.2.219.219; port: 10925
IP address: 68.82.129.129; port: 4050
IP address: 68.36.213.213; port: 16158
IP address: 68.229.223.223; port: 33759
IP address: 68.89.232.232; port: 23286
IP address: 68.3.40.40; port: 19074
IP address: 68.13.107.107; port: 31919
IP address: 68.197.49.49; port: 19666
IP address: 68.14.12.12; port: 19190
IP address: 68.72.114.114; port: 20455
IP address: 68.144.229.229; port: 19546
IP address: 69.118.181.181; port: 26009
IP address: 69.152.223.223; port: 7168
IP address: 69.47.115.115; port: 5024
IP address: 69.94.182.182; port: 32777
IP address: 69.253.89.89; port: 5607
IP address: 69.136.236.236; port: 2283
IP address: 69.226.103.103; port: 24804
IP address: 69.205.76.76; port: 17976
IP address: 69.123.37.37; port: 7880
IP address: 69.109.155.155; port: 1756
IP address: 69.142.96.96; port: 26425
IP address: 69.125.165.165; port: 15120
IP address: 69.119.180.180; port: 20228
IP address: 69.134.133.133; port: 9051
IP address: 69.122.255.255; port: 9849
IP address: 69.139.94.94; port: 1511
IP address: 69.255.129.129; port: 24847
IP address: 69.144.60.60; port: 3797
IP address: 69.253.216.216; port: 29333
IP address: 69.221.97.97; port: 14086
IP address: 69.207.11.11; port: 25872
IP address: 69.74.214.214; port: 25829
IP address: 69.76.20.20; port: 32181
IP address: 69.200.242.242; port: 6122
IP address: 69.109.229.229; port: 33746
IP address: 70.60.1.1; port: 3051
IP address: 70.239.164.164; port: 27317
IP address: 70.176.115.115; port: 6705
IP address: 70.176.162.162; port: 13108
IP address: 70.50.195.195; port: 14172
IP address: 70.190.110.110; port: 14446
IP address: 70.92.70.70; port: 23543
IP address: 70.121.188.188; port: 6928
IP address: 70.238.178.178; port: 14172
IP address: 70.73.42.42; port: 29818
IP address: 70.254.91.91; port: 2888
IP address: 70.72.218.218; port: 18229
IP address: 70.127.181.181; port: 1168
IP address: 70.66.141.141; port: 17933
IP address: 70.189.145.145; port: 33382
IP address: 70.189.149.149; port: 11397
IP address: 71.235.181.181; port: 5178
IP address: 71.10.6.6; port: 28385
IP address: 71.199.88.88; port: 1683
IP address: 71.7.227.227; port: 2965
IP address: 71.74.240.240; port: 25606
IP address: 71.63.60.60; port: 31332
IP address: 71.193.58.58; port: 5650
IP address: 71.63.152.152; port: 22312
IP address: 71.184.79.79; port: 7224
IP address: 71.205.183.183; port: 18332
IP address: 71.67.101.101; port: 16925
IP address: 71.224.145.145; port: 13108
IP address: 71.187.170.170; port: 13567
IP address: 71.210.38.38; port: 16235
IP address: 71.194.92.92; port: 32387
IP address: 71.203.81.81; port: 12508
IP address: 71.167.153.153; port: 10891
IP address: 71.80.237.237; port: 28488
IP address: 71.90.166.166; port: 27888
IP address: 71.171.88.88; port: 2326
IP address: 71.85.198.198; port: 33622
IP address: 71.57.122.122; port: 2506
IP address: 71.195.116.116; port: 20601
IP address: 71.239.229.229; port: 22685
IP address: 71.209.122.122; port: 17028
IP address: 71.61.187.187; port: 7224
IP address: 71.87.176.176; port: 30058
IP address: 71.59.119.119; port: 33077
IP address: 71.207.61.61; port: 4059
IP address: 71.200.134.134; port: 16874
IP address: 71.239.230.230; port: 13696
IP address: 72.24.62.62; port: 8819
IP address: 72.193.238.238; port: 26202
IP address: 72.43.49.49; port: 8425
IP address: 72.201.239.239; port: 21789
IP address: 72.208.99.99; port: 22441
IP address: 72.207.226.226; port: 4951
IP address: 72.193.90.90; port: 26331
IP address: 72.89.83.83; port: 4479
IP address: 72.67.92.92; port: 30671
IP address: 72.54.21.21; port: 19061
IP address: 72.183.122.122; port: 8408
IP address: 72.223.122.122; port: 17933
IP address: 72.12.132.132; port: 7078
IP address: 72.47.153.153; port: 1305
IP address: 72.227.27.27; port: 10775
IP address: 72.195.182.182; port: 24272
IP address: 72.71.204.204; port: 5989
IP address: 72.201.56.56; port: 7443
IP address: 72.188.23.23; port: 2742
IP address: 72.188.127.127; port: 12100
IP address: 74.79.69.69; port: 3853
IP address: 74.77.114.114; port: 28986
IP address: 74.75.83.83; port: 16784
IP address: 74.60.179.179; port: 13237
IP address: 74.76.22.22; port: 18941
IP address: 74.193.197.197; port: 28557
IP address: 74.195.192.192; port: 9939
IP address: 74.195.73.73; port: 3861
IP address: 74.211.54.54; port: 27197
IP address: 74.58.150.150; port: 32807
IP address: 74.78.135.135; port: 10942
IP address: 74.135.6.6; port: 25237
IP address: 74.76.219.219; port: 4646
IP address: 74.36.119.119; port: 19923
IP address: 75.110.202.202; port: 33373
IP address: 75.210.165.165; port: 3394
IP address: 75.184.26.26; port: 16788
IP address: 75.134.98.98; port: 9261
IP address: 75.165.198.198; port: 32327
IP address: 75.185.16.16; port: 28604
IP address: 75.179.189.189; port: 5761
IP address: 75.49.3.3; port: 11564
IP address: 75.131.237.237; port: 10775
IP address: 75.13.44.44; port: 3081
IP address: 75.147.142.142; port: 3827
IP address: 75.82.218.218; port: 21583
IP address: 75.141.208.208; port: 27725
IP address: 75.65.81.81; port: 29256
IP address: 75.35.228.228; port: 28505
IP address: 75.33.136.136; port: 26391
IP address: 75.21.202.202; port: 10895
IP address: 75.121.245.245; port: 24980
IP address: 75.143.218.218; port: 16265
IP address: 75.180.54.54; port: 33742
IP address: 75.5.244.244; port: 2339
IP address: 75.92.22.22; port: 5337
IP address: 75.143.181.181; port: 8579
IP address: 75.3.232.232; port: 2236
IP address: 76.118.123.123; port: 1438
IP address: 76.25.155.155; port: 1756
IP address: 76.79.102.102; port: 19752
IP address: 76.181.180.180; port: 22145
IP address: 76.202.134.134; port: 32357
IP address: 76.93.55.55; port: 31692
IP address: 76.110.117.117; port: 29595
IP address: 76.108.122.122; port: 33283
IP address: 76.189.137.137; port: 22604
IP address: 76.28.36.36; port: 18371
IP address: 76.99.113.113; port: 4106
IP address: 76.102.116.116; port: 5860
IP address: 76.103.71.71; port: 16355
IP address: 76.193.198.198; port: 18697
IP address: 76.23.72.72; port: 32777
IP address: 76.254.25.25; port: 22831
IP address: 76.197.197.197; port: 17959
IP address: 76.112.66.66; port: 11856
IP address: 76.111.160.160; port: 4252
IP address: 76.28.64.64; port: 31632
IP address: 76.123.173.173; port: 11268
IP address: 76.182.158.158; port: 19610
IP address: 76.182.74.74; port: 17959
IP address: 76.176.199.199; port: 2472
IP address: 76.31.213.213; port: 6212
IP address: 77.193.34.34; port: 32202
IP address: 77.253.96.96; port: 11886
IP address: 77.81.159.159; port: 12066
IP address: 77.125.70.70; port: 9630
IP address: 77.50.34.34; port: 18332
IP address: 77.122.73.73; port: 24971
IP address: 77.109.23.23; port: 6375
IP address: 77.51.59.59; port: 21137
IP address: 77.239.239.239; port: 20112
IP address: 77.85.181.181; port: 10072
IP address: 77.51.117.117; port: 28698
IP address: 77.85.73.73; port: 2819
IP address: 77.187.143.143; port: 20485
IP address: 77.122.67.67; port: 19923
IP address: 77.41.40.40; port: 8408
IP address: 78.107.154.154; port: 10934
IP address: 78.83.69.69; port: 28986
IP address: 78.36.192.192; port: 5264
IP address: 78.161.63.63; port: 6902
IP address: 78.61.164.164; port: 10110
IP address: 78.60.167.167; port: 5191
IP address: 78.107.155.155; port: 20228
IP address: 78.30.79.79; port: 23556
IP address: 78.139.156.156; port: 9347
IP address: 79.112.95.95; port: 2811
IP address: 79.140.167.167; port: 28587
IP address: 79.185.181.181; port: 16286
IP address: 79.115.46.46; port: 7443
IP address: 79.113.194.194; port: 15703
IP address: 79.120.8.8; port: 16535
IP address: 80.123.226.226; port: 9570
IP address: 80.230.118.118; port: 15733
IP address: 80.34.234.234; port: 4020
IP address: 80.240.212.212; port: 10754
IP address: 80.174.190.190; port: 4938
IP address: 80.90.236.236; port: 3248
IP address: 81.30.219.219; port: 12482
IP address: 81.1.244.244; port: 9999
IP address: 81.192.145.145; port: 31632
IP address: 81.45.251.251; port: 27210
IP address: 81.64.198.198; port: 31104
IP address: 81.56.98.98; port: 15750
IP address: 81.109.0.0; port: 17153
IP address: 81.56.175.175; port: 14549
IP address: 81.22.207.207; port: 22351
IP address: 81.164.191.191; port: 28467
IP address: 81.200.145.145; port: 6212
IP address: 81.251.105.105; port: 22441
IP address: 81.15.23.23; port: 16762
IP address: 82.157.90.90; port: 25709
IP address: 82.32.156.156; port: 19782
IP address: 82.147.131.131; port: 7207
IP address: 82.65.190.190; port: 26417
IP address: 82.246.75.75; port: 20228
IP address: 82.149.26.26; port: 7250
IP address: 82.45.210.210; port: 31949
IP address: 82.196.88.88; port: 31692
IP address: 82.34.144.144; port: 24135
IP address: 82.233.191.191; port: 23303
IP address: 82.122.124.124; port: 14532
IP address: 82.64.154.154; port: 26331
IP address: 82.228.227.227; port: 1365
IP address: 82.193.159.159; port: 21111
IP address: 82.246.21.21; port: 31074
IP address: 83.110.64.64; port: 13563
IP address: 83.110.12.12; port: 29183
IP address: 83.4.233.233; port: 5002
IP address: 83.9.86.86; port: 3917
IP address: 83.31.1.1; port: 7168
IP address: 83.14.102.102; port: 28587
IP address: 83.28.206.206; port: 7777
IP address: 83.30.104.104; port: 10655
IP address: 83.223.146.146; port: 1284
IP address: 83.110.200.200; port: 33043
IP address: 83.27.195.195; port: 3793
IP address: 83.174.253.253; port: 8103
IP address: 83.13.185.185; port: 12349
IP address: 83.110.253.253; port: 18594
IP address: 83.250.1.1; port: 19254
IP address: 83.9.163.163; port: 30547
IP address: 83.110.146.146; port: 16338
IP address: 83.85.45.45; port: 21716
IP address: 84.229.143.143; port: 22604
IP address: 84.1.199.199; port: 24881
IP address: 84.95.82.82; port: 9600
IP address: 84.244.93.93; port: 16998
IP address: 84.229.93.93; port: 22801
IP address: 84.54.155.155; port: 27836
IP address: 84.109.113.113; port: 7717
IP address: 84.68.201.201; port: 20485
IP address: 84.91.19.19; port: 5504
IP address: 84.247.45.45; port: 30886
IP address: 85.178.49.49; port: 7880
IP address: 85.255.166.166; port: 8562
IP address: 85.21.92.92; port: 12997
IP address: 85.100.115.115; port: 9308
IP address: 85.47.27.27; port: 30671
IP address: 85.54.185.185; port: 22351
IP address: 85.140.150.150; port: 27566
IP address: 85.90.111.111; port: 15866
IP address: 85.130.38.38; port: 9583
IP address: 85.140.51.51; port: 6945
IP address: 85.98.144.144; port: 21510
IP address: 85.75.160.160; port: 16938
IP address: 85.140.154.154; port: 10964
IP address: 85.160.30.30; port: 20322
IP address: 85.105.217.217; port: 4934
IP address: 85.201.152.152; port: 29689
IP address: 85.217.209.209; port: 32022
IP address: 85.101.41.41; port: 28038
IP address: 85.249.253.253; port: 18023
IP address: 85.141.239.239; port: 17736
IP address: 86.203.17.17; port: 1777
IP address: 86.98.63.63; port: 12774
IP address: 86.8.105.105; port: 6083
IP address: 86.105.51.51; port: 18332
IP address: 86.70.172.172; port: 10093
IP address: 86.127.22.22; port: 9956
IP address: 86.106.174.174; port: 1365
IP address: 86.210.84.84; port: 12615
IP address: 86.98.47.47; port: 16788
IP address: 86.80.194.194; port: 14395
IP address: 86.96.24.24; port: 28990
IP address: 87.120.19.19; port: 30877
IP address: 87.207.238.238; port: 21073
IP address: 87.253.209.209; port: 27373
IP address: 87.121.18.18; port: 9780
IP address: 87.24.68.68; port: 5019
IP address: 87.207.51.51; port: 29728
IP address: 88.228.62.62; port: 13683
IP address: 88.224.132.132; port: 24688
IP address: 88.103.175.175; port: 16998
IP address: 88.247.28.28; port: 6212
IP address: 88.210.242.242; port: 20455
IP address: 88.238.124.124; port: 13258
IP address: 88.210.255.255; port: 29818
IP address: 88.156.222.222; port: 8815
IP address: 88.140.80.80; port: 18371
IP address: 88.160.94.94; port: 1215
IP address: 88.237.209.209; port: 18371
IP address: 89.165.138.138; port: 7314
IP address: 89.40.106.106; port: 2133
IP address: 89.215.138.138; port: 19456
IP address: 89.232.35.35; port: 13550
IP address: 89.251.73.73; port: 2519
IP address: 89.165.245.245; port: 22338
IP address: 89.142.32.32; port: 2742
IP address: 89.41.7.7; port: 24971
IP address: 89.178.93.93; port: 14219
IP address: 89.215.8.8; port: 7717
IP address: 89.79.98.98; port: 26944
IP address: 89.179.116.116; port: 33219
IP address: 89.38.169.169; port: 14824
IP address: 89.45.247.247; port: 25812
IP address: 89.166.145.145; port: 29625
IP address: 89.21.65.65; port: 2892
IP address: 89.166.190.190; port: 12576
IP address: 89.1.206.206; port: 2819
IP address: 89.40.89.89; port: 3188
IP address: 89.113.79.79; port: 21073
IP address: 89.35.97.97; port: 3548
IP address: 89.218.188.188; port: 30843
IP address: 89.41.64.64; port: 27566
IP address: 89.208.80.80; port: 27935
IP address: 90.16.114.114; port: 33712
IP address: 90.35.78.78; port: 28758
IP address: 90.47.25.25; port: 21467
IP address: 90.47.106.106; port: 24538
IP address: 90.151.138.138; port: 17543
IP address: 90.230.150.150; port: 33549
IP address: 91.193.169.169; port: 23723
IP address: 91.89.55.55; port: 16368
IP address: 91.92.201.201; port: 24118
IP address: 91.50.113.113; port: 11620
IP address: 92.113.72.72; port: 2772
IP address: 92.83.117.117; port: 17976
IP address: 92.114.214.214; port: 28604
IP address: 92.80.60.60; port: 22801
IP address: 92.97.32.32; port: 3986
IP address: 92.112.81.81; port: 31919
IP address: 96.24.10.10; port: 5191
IP address: 97.90.234.234; port: 27399
IP address: 97.97.158.158; port: 5084
IP address: 98.162.200.200; port: 24971
IP address: 98.197.211.211; port: 21064
IP address: 98.200.181.181; port: 7310
IP address: 98.196.69.69; port: 10260
IP address: 98.195.31.31; port: 17453
IP address: 98.195.248.248; port: 14897
IP address: 98.210.81.81; port: 13091
IP address: 99.251.134.134; port: 23273
IP address: 116.72.33.33; port: 21746
IP address: 116.225.17.17; port: 3643
IP address: 117.198.145.145; port: 14785
IP address: 117.5.71.71; port: 3497
IP address: 117.195.64.64; port: 27918
IP address: 117.7.51.51; port: 31104
IP address: 118.78.164.164; port: 22201
IP address: 118.136.24.24; port: 25889
IP address: 121.247.124.124; port: 6396
IP address: 121.69.90.90; port: 17337
IP address: 121.183.110.110; port: 5148
IP address: 121.247.160.160; port: 4646
IP address: 121.245.51.51; port: 5989
IP address: 121.11.36.36; port: 11363
IP address: 121.246.253.253; port: 26914
IP address: 121.16.189.189; port: 7996
IP address: 121.243.201.201; port: 29183
IP address: 121.240.109.109; port: 19589
IP address: 121.54.1.1; port: 33043
IP address: 121.124.201.201; port: 33575
IP address: 121.16.91.91; port: 17264
IP address: 121.247.217.217; port: 9205
IP address: 121.145.11.11; port: 15604
IP address: 121.247.164.164; port: 8871
IP address: 121.69.217.217; port: 17766
IP address: 121.142.54.54; port: 6049
IP address: 121.188.3.3; port: 2712
IP address: 121.200.103.103; port: 25666
IP address: 122.163.157.157; port: 21467
IP address: 122.163.126.126; port: 19563
IP address: 122.161.20.20; port: 25662
IP address: 122.162.249.249; port: 22128
IP address: 122.167.207.207; port: 13563
IP address: 122.162.85.85; port: 19400
IP address: 122.163.248.248; port: 9733
IP address: 122.167.153.153; port: 25932
IP address: 122.163.96.96; port: 4106
IP address: 122.164.167.167; port: 28102
IP address: 122.167.50.50; port: 25031
IP address: 122.160.11.11; port: 16072
IP address: 122.126.37.37; port: 26807
IP address: 122.161.137.137; port: 10908
IP address: 122.26.53.53; port: 2133
IP address: 122.161.36.36; port: 13224
IP address: 122.167.75.75; port: 32687
IP address: 122.169.177.177; port: 26228
IP address: 122.99.206.206; port: 33099
IP address: 123.17.136.136; port: 7897
IP address: 123.18.41.41; port: 5208
IP address: 123.133.194.194; port: 14009
IP address: 123.236.232.232; port: 32245
IP address: 123.201.80.80; port: 2163
IP address: 123.109.195.195; port: 26644
IP address: 123.252.212.212; port: 1232
IP address: 123.201.71.71; port: 7194
IP address: 123.201.37.37; port: 4093
IP address: 123.109.212.212; port: 25203
IP address: 124.178.181.181; port: 8914
IP address: 124.30.74.74; port: 4106
IP address: 124.43.60.60; port: 21150
IP address: 124.136.119.119; port: 8562
IP address: 124.48.173.173; port: 7164
IP address: 124.125.226.226; port: 16548
IP address: 124.120.131.131; port: 21776
IP address: 124.62.118.118; port: 12139
IP address: 124.120.240.240; port: 16445
IP address: 124.106.231.231; port: 29612
IP address: 124.29.197.197; port: 11929
IP address: 124.120.37.37; port: 5041
IP address: 124.121.45.45; port: 13284
IP address: 124.125.185.185; port: 21077
IP address: 125.178.82.82; port: 15360
IP address: 125.22.172.172; port: 30774
IP address: 125.142.101.101; port: 21776
IP address: 125.134.80.80; port: 2506
IP address: 125.25.0.0; port: 22801
IP address: 125.115.109.109; port: 6919
IP address: 125.18.121.121; port: 8155
IP address: 125.177.185.185; port: 1541
IP address: 125.22.241.241; port: 25756
IP address: 125.235.36.36; port: 20232
IP address: 132.239.1.1; port: 52371
IP address: 132.64.61.61; port: 4252
IP address: 134.94.252.252; port: 2742
IP address: 137.132.99.99; port: 29749
IP address: 140.96.8.8; port: 19439
IP address: 143.215.139.139; port: 22990
IP address: 147.156.176.176; port: 20837
IP address: 158.195.103.103; port: 30504
IP address: 159.116.246.246; port: 5470
IP address: 161.200.32.32; port: 7250
IP address: 161.200.168.168; port: 10260
IP address: 164.100.255.255; port: 8871
IP address: 168.131.231.231; port: 16595
IP address: 189.27.97.97; port: 16265
IP address: 189.231.6.6; port: 5191
IP address: 189.148.59.59; port: 30530
IP address: 190.39.140.140; port: 7164
IP address: 190.51.53.53; port: 14807
IP address: 190.136.105.105; port: 29380
IP address: 190.19.76.76; port: 32198
IP address: 193.95.249.249; port: 11045
IP address: 193.219.173.173; port: 10775
IP address: 194.225.103.103; port: 9999
IP address: 194.190.128.128; port: 6469
IP address: 194.67.64.64; port: 9720
IP address: 194.105.172.172; port: 6902
IP address: 194.105.38.38; port: 22128
IP address: 194.63.135.135; port: 16548
IP address: 194.114.129.129; port: 14065
IP address: 195.239.168.168; port: 26129
IP address: 195.177.72.72; port: 13224
IP address: 195.101.151.151; port: 27124
IP address: 196.209.111.111; port: 32198
IP address: 200.95.139.139; port: 29603
IP address: 200.93.12.12; port: 19636
IP address: 200.175.212.212; port: 10655
IP address: 200.90.120.120; port: 10775
IP address: 200.109.60.60; port: 2991
IP address: 201.212.241.241; port: 4110
IP address: 202.156.105.105; port: 19507
IP address: 202.128.172.172; port: 21540
IP address: 202.164.158.158; port: 7524
IP address: 202.137.23.23; port: 1155
IP address: 202.136.246.246; port: 33622
IP address: 202.40.153.153; port: 11281
IP address: 202.56.7.7; port: 32953
IP address: 202.180.105.105; port: 30071
IP address: 202.74.245.245; port: 4299
IP address: 202.42.35.35; port: 12555
IP address: 202.157.94.94; port: 30924
IP address: 203.255.21.21; port: 19722
IP address: 203.184.5.5; port: 32104
IP address: 203.193.146.146; port: 20189
IP address: 203.212.237.237; port: 21780
IP address: 203.210.240.240; port: 22368
IP address: 203.143.25.25; port: 28591
IP address: 203.101.126.126; port: 33699
IP address: 203.134.223.223; port: 2626
IP address: 203.196.176.176; port: 15823
IP address: 203.98.100.100; port: 16278
IP address: 203.145.99.99; port: 22711
IP address: 204.210.140.140; port: 33326
IP address: 205.174.117.117; port: 13576
IP address: 205.161.17.17; port: 14262
IP address: 206.188.245.245; port: 13108
IP address: 206.78.151.151; port: 21433
IP address: 206.212.48.48; port: 5637
IP address: 207.239.235.235; port: 33622
IP address: 207.255.245.245; port: 9604
IP address: 208.60.95.95; port: 24688
IP address: 208.98.203.203; port: 2339
IP address: 208.104.216.216; port: 2506
IP address: 208.0.110.110; port: 27137
IP address: 208.107.224.224; port: 20232
IP address: 209.60.47.47; port: 22973
IP address: 209.33.48.48; port: 13224
IP address: 210.214.17.17; port: 26644
IP address: 210.8.221.221; port: 11856
IP address: 210.211.251.251; port: 5152
IP address: 210.213.144.144; port: 33708
IP address: 210.9.120.120; port: 2575
IP address: 210.214.44.44; port: 27030
IP address: 210.214.68.68; port: 6928
IP address: 210.79.191.191; port: 7018
IP address: 210.4.126.126; port: 27712
IP address: 211.208.163.163; port: 26417
IP address: 211.236.58.58; port: 7717
IP address: 211.243.8.8; port: 12418
IP address: 211.247.193.193; port: 24984
IP address: 211.201.50.50; port: 29149
IP address: 212.96.107.107; port: 28475
IP address: 212.67.2.2; port: 29376
IP address: 212.7.216.216; port: 31276
IP address: 212.49.81.81; port: 25829
IP address: 212.149.206.206; port: 19400
IP address: 212.139.100.100; port: 9703
IP address: 212.118.10.10; port: 22780
IP address: 212.36.17.17; port: 14785
IP address: 212.116.228.228; port: 17766
IP address: 213.154.200.200; port: 12255
IP address: 213.132.60.60; port: 22128
IP address: 213.135.104.104; port: 15244
IP address: 213.131.59.59; port: 12842
IP address: 213.200.147.147; port: 25203
IP address: 213.181.164.164; port: 16848
IP address: 213.240.196.196; port: 25829
IP address: 213.147.47.47; port: 2626
IP address: 213.130.104.104; port: 19563
IP address: 213.113.83.83; port: 30594
IP address: 213.198.208.208; port: 27420
IP address: 216.206.47.47; port: 29393
IP address: 216.41.248.248; port: 28557
IP address: 216.255.6.6; port: 18774
IP address: 216.186.225.225; port: 12491
IP address: 217.98.19.19; port: 8120
IP address: 217.165.249.249; port: 28570
IP address: 218.180.152.152; port: 13194
IP address: 218.238.255.255; port: 16891
IP address: 218.49.114.114; port: 6349
IP address: 218.101.240.240; port: 33695
IP address: 218.186.67.67; port: 32867
IP address: 218.111.74.74; port: 8811
IP address: 218.254.54.54; port: 7048
IP address: 218.111.29.29; port: 32202
IP address: 219.142.188.188; port: 22115
IP address: 219.79.215.215; port: 25336
IP address: 219.91.233.233; port: 33099
IP address: 219.243.92.92; port: 1365
IP address: 219.64.124.124; port: 10968
IP address: 219.64.123.123; port: 28145
IP address: 219.91.250.250; port: 3437
IP address: 220.225.210.210; port: 2952
IP address: 220.225.51.51; port: 28458
IP address: 220.224.89.89; port: 15604
IP address: 220.226.134.134; port: 5148
IP address: 220.72.212.212; port: 30547
IP address: 220.224.82.82; port: 3304
IP address: 221.134.215.215; port: 3844
IP address: 221.236.91.91; port: 8609
IP address: 221.238.121.121; port: 11684
IP address: 221.221.164.164; port: 8819
IP address: 221.134.89.89; port: 15660
IP address: 221.207.84.84; port: 11684
IP address: 222.244.16.16; port: 22973
IP address: 222.66.111.111; port: 30049
IP address: 222.253.222.222; port: 9926
IP address: 222.253.141.141; port: 11950
IP address: 222.50.189.189; port: 12388
IP address: 222.121.186.186; port: 23938
IP address: 222.254.32.32; port: 2506

Heuristically identified capability to harvest email addresses (e.g. for spamming or mass-mailing purposes) from files with the following extensions:

Heuristically identified that addresses containing the following strings are not harvested:

All content ("Information") contained in this report is the copyrighted work of Threat Expert Ltd and its associated companies ("ThreatExpert") and may not be copied without the express permission of ThreatExpert.

The Information is provided on an "as is" basis. ThreatExpert disclaims all warranties, whether express or implied, to the maximum extent permitted by law, including the implied warranties that the Information is merchantable, of satisfactory quality, accurate, fit for a particular purpose or need, or non-infringing, unless such implied warranties are legally incapable of exclusion. Further, ThreatExpert does not warrant or make any representations regarding the use or the results of the use of the Information in terms of their correctness, accuracy, reliability, or otherwise.