Gen.Variant.Razy.133646_290b8d8797

August 19, 2021 15:18

Trojan.MSIL.DOTHETUK.cnz (Kaspersky), Gen:Variant.Razy.133646 (B) (Emsisoft), Gen:Variant.Razy.133646 (AdAware), Worm.Win32.Ainslot.VB.FD, GenericAutorunWorm.YR, WormAinslot_VariantOfZeus.YR (Lavasoft MAS)Behaviour: Trojan, Worm, WormAutorun

The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.

Summary

MD5: 290b8d8797a9ddacdd0d5b98facc95a6

SHA1: 4c552c4b150134754761677e6708cc73a289c78f

SHA256: 71102fe8758e56a3fa85564a58f065d315ffc198b3a68b0d842e10202656eff4

SSDeep: 12288:iPLiOS Lan5tPbenb7EkvtOecHOXZ19/WPvQ359lcbmLWz/w09nRFDl3xE:iG eDben8LecHecw359lEN/wMnfDl3

Size: 839680 bytes

File type: EXE

Platform: WIN32

Entropy: Packed

PEID: MicrosoftVisualC, NETexecutable, UPolyXv05_v6

Company: no certificate found

Created at: 2017-03-05 16:37:06

Analyzed on: Windows7 SP1 32-bit

Summary: Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).

Dynamic Analysis

Payload

Behaviour	Description
WormAutorun	A worm can spread via removable drives. It writes its executable and creates "autorun.inf" scripts on all removable drives. The autorun script will execute the Trojan's file once a user opens a drive's folder in Windows Explorer.

Process activity

The Trojan creates the following process(es):

csc.exe:1388
csc.exe:992
cvtres.exe:2924
cvtres.exe:2360
%original file name%.exe:2748

The Trojan injects its code into the following process(es):

svhost.exe:3400
svhost.exe:812
vbc.exe:2356

Mutexes

The following mutexes were created/opened:No objects were found.

File activity

The process csc.exe:1388 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\wnrdyh65.out (396 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\wnrdyh65.dll (2426 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\CSC1C36.tmp (652 bytes)

The Trojan deletes the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RES1C47.tmp (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\CSC1C36.tmp (0 bytes)

The process csc.exe:992 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\trrid72w.out (396 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\trrid72w.dll (5226 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\CSC1DCC.tmp (652 bytes)

The Trojan deletes the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RES1DCD.tmp (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\CSC1DCC.tmp (0 bytes)

The process svhost.exe:3400 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\wnrdyh65.cmdline (192 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\wnrdyh65.out (259 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\tmp1B0E.tmp.txt (67988 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\fSWegQfK.exe (53 bytes)

The Trojan deletes the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\wnrdyh65.out (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\wnrdyh65.cmdline (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\wnrdyh65.dll (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\tmp1B0E.tmp.txt (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\wnrdyh65.tmp (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\wnrdyh65.err (0 bytes)

The process svhost.exe:812 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\IlTKkCWP.exe (53 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\tmp1D01.tmp.txt (46772 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\trrid72w.out (259 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\trrid72w.cmdline (192 bytes)

The Trojan deletes the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\tmp1D01.tmp.txt (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\trrid72w.tmp (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\trrid72w.dll (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\trrid72w.err (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\trrid72w.cmdline (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\trrid72w.out (0 bytes)

The process cvtres.exe:2924 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RES1C47.tmp (3666 bytes)

The process cvtres.exe:2360 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RES1DCD.tmp (3666 bytes)

The process %original file name%.exe:2748 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Roaming\svhost.exe (106 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\vbc\vbc.exe (839 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\vbc\vbc.exe.lnk (707 bytes)

The process vbc.exe:2356 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Roaming\MWB (34 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\MWB.exe (3690 bytes)

Registry activity

The process svhost.exe:3400 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"Vbc" = "C:\Users\"%CurrentUserName%"\AppData\Local\Temp\fSWegQfK.exe"

The process svhost.exe:812 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"(Default)" = "C:\Users\"%CurrentUserName%"\AppData\Local\Temp\IlTKkCWP.exe"

The process vbc.exe:2356 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\VB and VBA Program Settings\SrvID\ID]
"4CJY24NXG8" = "MWB"

[HKCU\Software\VB and VBA Program Settings\INSTALL\DATE]
"4CJY24NXG8" = "March 17, 2017"

Dropped PE files

MD5	File path
278edbd499374bf73621f8c1f969d894	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\IlTKkCWP.exe
278edbd499374bf73621f8c1f969d894	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\fSWegQfK.exe
34aa912defa18c2c129f1e09d75c1d7e	c:\Users\"%CurrentUserName%"\AppData\Roaming\MWB.exe
278edbd499374bf73621f8c1f969d894	c:\Users\"%CurrentUserName%"\AppData\Roaming\svhost.exe

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

A worm can spread via removable drives. It writes its executable and creates "autorun.inf" scripts on all removable drives. The autorun script will execute the Trojan's file once a user opens a drive's folder in Windows Explorer.

Removals

Remove it with Ad-Aware

Click (here) to download and install Ad-Aware Free Antivirus.
Update the definition files.
Run a full scan of your computer.

Manual removal*

Terminate malicious process(es) (How to End a Process With the Task Manager):
csc.exe:1388
csc.exe:992
cvtres.exe:2924
cvtres.exe:2360
%original file name%.exe:2748
Delete the original Trojan file.
Delete or disinfect the following files created/modified by the Trojan:
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\wnrdyh65.out (396 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\wnrdyh65.dll (2426 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\CSC1C36.tmp (652 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\trrid72w.out (396 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\trrid72w.dll (5226 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\CSC1DCC.tmp (652 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\wnrdyh65.cmdline (192 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\tmp1B0E.tmp.txt (67988 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\fSWegQfK.exe (53 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\IlTKkCWP.exe (53 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\tmp1D01.tmp.txt (46772 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\trrid72w.cmdline (192 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RES1C47.tmp (3666 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RES1DCD.tmp (3666 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\svhost.exe (106 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\vbc\vbc.exe (839 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\vbc\vbc.exe.lnk (707 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\MWB (34 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\MWB.exe (3690 bytes)
Delete the following value(s) in the autorun key (How to Work with System Registry):
[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"Vbc" = "C:\Users\"%CurrentUserName%"\AppData\Local\Temp\fSWegQfK.exe"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"(Default)" = "C:\Users\"%CurrentUserName%"\AppData\Local\Temp\IlTKkCWP.exe"
Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
Find and delete all copies of the worm's file together with "autorun.inf" scripts on removable drives.
Reboot the computer.

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

VersionInfo

Company Name: Malwarebytes
Product Name: Malwarebytes
Product Version: 3.0.0.912
Legal Copyright: (c) Malwarebytes. All rights reserved.
Legal Trademarks:
Original Filename: mbam.exe
Internal Name: mbam.exe
File Version: 3.0.0.912
File Description: Malwarebytes
Comments:
Language: Language Neutral

Company Name: MalwarebytesProduct Name: Malwarebytes Product Version: 3.0.0.912Legal Copyright: (c) Malwarebytes. All rights reserved.Legal Trademarks: Original Filename: mbam.exeInternal Name: mbam.exeFile Version: 3.0.0.912File Description: Malwarebytes Comments: Language: Language Neutral

PE Sections

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Section MD5
.text	8192	715540	715776	5.40408	fe31c3e5721192252a9eefa76deb0010
.sdata	729088	1976	2048	4.1442	ef6b33c3405fec670bc55e23c36c3d14
.rsrc	737280	119976	120320	2.74618	8cebdc01254784e7b4ef987e08cc98c3
.reloc	860160	12	512	0.056519	e161f60c0ba36766ae9f35d7dd77b38e

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Network Activity

URLs

URL	IP
daaromniet.servebeer.com	81.207.125.150

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

Map

The Trojan connects to the servers at the folowing location(s):

Strings from Dumps

svhost.exe_3400:

.text

.text

`.rsrc

`.rsrc

@.reloc

@.reloc

lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet

lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet

..TO8

..TO8

.XA_

.XA_

,.vP|

,.vP|

w*

w*

uo3%C

uo3%C

:|.Zy

:|.Zy

}%%uM

}%%uM

\ -z}

\ -z}

.SJW'

.SJW'

.K%Uz

.K%Uz

%U9;[

%U9;[

/w.bF

/w.bF

$Ã™\

$Ã™\

".kz?

".kz?

.pf9z

.pf9z

7%DJY

7%DJY

4i%F%

4i%F%

uo/%F

uo/%F

,*.ln

,*.ln

pI%S?$e

pI%S?$e

=5.gQ

=5.gQ

/%U)b

/%U)b

.9.QD

.9.QD

.xKm 2j

.xKm 2j

?Q.bz

?Q.bz

/-PH}

/-PH}

j0.uz

j0.uz

.dK'$/[

.dK'$/[

.dKW'/

.dKW'/

v%.XI

v%.XI

5.ptn

5.ptn

w).FI

w).FI

?o.RA

?o.RA

,..qE

,..qE

)j.Ta

)j.Ta

p..pp

p..pp

.yBR=xS

.yBR=xS

.nogp

.nogp

.yDL93~

.yDL93~

%x4O=

%x4O=

.gXP"?0

.gXP"?0

1\8U&%C

1\8U&%C

.UX$y

.UX$y

.vS/]

.vS/]

6S9d%%x

6S9d%%x

p.pw~

p.pw~

*%x>t

*%x>t

%.iHB

%.iHB

(e.Lp

(e.Lp

V.RIB

V.RIB

v2.0.50727

v2.0.50727

mw3.exe

mw3.exe

NQD2fr1X.resources

NQD2fr1X.resources

System.Collections.Generic

System.Collections.Generic

System.Reflection

System.Reflection

System.Resources

System.Resources

.ctor

.ctor

System.IO

System.IO

System.Text

System.Text

System.CodeDom.Compiler

System.CodeDom.Compiler

System.Collections.Specialized

System.Collections.Specialized

set_GenerateExecutable

set_GenerateExecutable

Microsoft.CSharp

Microsoft.CSharp

.cctor

.cctor

System.Runtime.CompilerServices

System.Runtime.CompilerServices

System.Security

System.Security

0.0.0

0.0.0

System.Security.Permissions.SecurityPermissionAttribute, mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089

System.Security.Permissions.SecurityPermissionAttribute, mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089

_CorExeMain

_CorExeMain

mscoree.dll

mscoree.dll

System.dll

System.dll

/target:winexe /platform:x86

/target:winexe /platform:x86

0.0.0.0

0.0.0.0

svhost.exe_812:

.text

.text

`.rsrc

`.rsrc

@.reloc

@.reloc

lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet

lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet

1%cU8

1%cU8

1%cU7

1%cU7

m%cQ7

m%cQ7

.oW>"

.oW>"

.kWe

.kWe

WÃ¸&

WÃ¸&

.oW&,

.oW&,

.kW8.

.kW8.

.kW?.

.kW?.

.IW29

.IW29

U%XV&

U%XV&

.KpJ%

.KpJ%

2b.xe

2b.xe

}%7X6

}%7X6

.zkU{

.zkU{

IÃŸ7

IÃŸ7

:o.yY

:o.yY

D%uVl

D%uVl

.Krc;

.Krc;

nC.Bd

nC.Bd

%Å’>

%Å’>

nG%c&

nG%c&

.he7?

.he7?

A%uV8

A%uV8

v2.0.50727

v2.0.50727

MWB2.exe

MWB2.exe

7NThDaW7.resources

7NThDaW7.resources

System.Collections.Generic

System.Collections.Generic

System.Reflection

System.Reflection

System.Resources

System.Resources

.ctor

.ctor

System.IO

System.IO

System.Text

System.Text

System.CodeDom.Compiler

System.CodeDom.Compiler

System.Collections.Specialized

System.Collections.Specialized

set_GenerateExecutable

set_GenerateExecutable

Microsoft.CSharp

Microsoft.CSharp

.cctor

.cctor

System.Runtime.CompilerServices

System.Runtime.CompilerServices

System.Security

System.Security

1.0.9

1.0.9

System.Security.Permissions.SecurityPermissionAttribute, mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089

System.Security.Permissions.SecurityPermissionAttribute, mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089

_CorExeMain

_CorExeMain

mscoree.dll

mscoree.dll

System.dll

System.dll

/target:winexe /platform:x86

/target:winexe /platform:x86

1.0.9.0

1.0.9.0

svhost.exe_3400_rwx_00400000_0008A000:

.text

.text

`.rsrc

`.rsrc

@.reloc

@.reloc

lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet

lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet

..TO8

..TO8

.XA_

.XA_

,.vP|

,.vP|

w*

w*

uo3%C

uo3%C

:|.Zy

:|.Zy

}%%uM

}%%uM

\ -z}

\ -z}

.SJW'

.SJW'

.K%Uz

.K%Uz

%U9;[

%U9;[

/w.bF

/w.bF

$Ã™\

$Ã™\

".kz?

".kz?

.pf9z

.pf9z

7%DJY

7%DJY

4i%F%

4i%F%

uo/%F

uo/%F

,*.ln

,*.ln

pI%S?$e

pI%S?$e

=5.gQ

=5.gQ

/%U)b

/%U)b

.9.QD

.9.QD

.xKm 2j

.xKm 2j

?Q.bz

?Q.bz

/-PH}

/-PH}

j0.uz

j0.uz

.dK'$/[

.dK'$/[

.dKW'/

.dKW'/

v%.XI

v%.XI

5.ptn

5.ptn

w).FI

w).FI

?o.RA

?o.RA

,..qE

,..qE

)j.Ta

)j.Ta

p..pp

p..pp

.yBR=xS

.yBR=xS

.nogp

.nogp

.yDL93~

.yDL93~

%x4O=

%x4O=

.gXP"?0

.gXP"?0

1\8U&%C

1\8U&%C

.UX$y

.UX$y

.vS/]

.vS/]

6S9d%%x

6S9d%%x

p.pw~

p.pw~

*%x>t

*%x>t

%.iHB

%.iHB

(e.Lp

(e.Lp

V.RIB

V.RIB

v2.0.50727

v2.0.50727

mw3.exe

mw3.exe

NQD2fr1X.resources

NQD2fr1X.resources

System.Collections.Generic

System.Collections.Generic

System.Reflection

System.Reflection

System.Resources

System.Resources

.ctor

.ctor

System.IO

System.IO

System.Text

System.Text

System.CodeDom.Compiler

System.CodeDom.Compiler

System.Collections.Specialized

System.Collections.Specialized

set_GenerateExecutable

set_GenerateExecutable

Microsoft.CSharp

Microsoft.CSharp

.cctor

.cctor

System.Runtime.CompilerServices

System.Runtime.CompilerServices

System.Security

System.Security

0.0.0

0.0.0

System.Security.Permissions.SecurityPermissionAttribute, mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089

System.Security.Permissions.SecurityPermissionAttribute, mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089

_CorExeMain

_CorExeMain

mscoree.dll

mscoree.dll

System.dll

System.dll

/target:winexe /platform:x86

/target:winexe /platform:x86

0.0.0.0

0.0.0.0

vbc.exe_2356:

.text

.text

`.data

`.data

.rsrc

.rsrc

MSVBVM60.DLL

MSVBVM60.DLL

bss_server.usrReverseRelay

bss_server.usrReverseRelay

tmrWebHide

tmrWebHide

bss_server.Socket

bss_server.Socket

bss_server.usrRelay

bss_server.usrRelay

mswinsck.ocx

mswinsck.ocx

MSWinsockLib.Winsock

MSWinsockLib.Winsock

ieframe.dll

ieframe.dll

SHDocVwCtl.WebBrowser

SHDocVwCtl.WebBrowser

WebBrowser

WebBrowser

modLaunchWeb

modLaunchWeb

%Program Files% (x86)\Microsoft Visual Studio\VB98\VB6.OLB

%Program Files% (x86)\Microsoft Visual Studio\VB98\VB6.OLB

C:\Windows\SysWOW64\ieframe.dll

C:\Windows\SysWOW64\ieframe.dll

winmm.dll

winmm.dll

user32.dll

user32.dll

advapi32.dll

advapi32.dll

shell32.dll

shell32.dll

kernel32.dll

kernel32.dll

avicap32.dll

avicap32.dll

advpack.dll

advpack.dll

GetAsyncKeyState

GetAsyncKeyState

SetWindowsHookExA

SetWindowsHookExA

UnhookWindowsHookEx

UnhookWindowsHookEx

GetKeyboardLayout

GetKeyboardLayout

GetKeyboardState

GetKeyboardState

GetKeyState

GetKeyState

SHFileOperationA

SHFileOperationA

CreatePipe

CreatePipe

PSAPI.DLL

PSAPI.DLL

GetTcpTable

GetTcpTable

ExitWindowsEx

ExitWindowsEx

EnumWindows

EnumWindows

WinInet.dll

WinInet.dll

DeleteUrlCacheEntryA

DeleteUrlCacheEntryA

urlmon

urlmon

URLDownloadToFileA

URLDownloadToFileA

ShellExecuteA

ShellExecuteA

keybd_event

keybd_event

AddMsg

AddMsg

CHAT_ADDMSG

CHAT_ADDMSG

VBA6.DLL

VBA6.DLL

C:\Windows\SysWow64\msvbvm60.dll\3

C:\Windows\SysWow64\msvbvm60.dll\3

ws2_32.dll

ws2_32.dll

olepro32.dll

olepro32.dll

GdiplusShutdown

GdiplusShutdown

RemotePort

RemotePort

LocalPort

LocalPort

WSOCK32.DLL

WSOCK32.DLL

RegCloseKey

RegCloseKey

RegOpenKeyExA

RegOpenKeyExA

ntdll.dll

ntdll.dll

C:\Windows\SysWOW64\ieframe.oca

C:\Windows\SysWOW64\ieframe.oca

6tmrTCP

6tmrTCP

%Program Files% (x86)\Microsoft Visual Studio\VB98\mswinsck.oca

%Program Files% (x86)\Microsoft Visual Studio\VB98\mswinsck.oca

tmrUDP

tmrUDP

UDPSocket

UDPSocket

UDPFlood

UDPFlood

ole32.dll

ole32.dll

crypt32.dll

crypt32.dll

oleaut32.dll

oleaut32.dll

RegOpenKeyA

RegOpenKeyA

FindNextUrlCacheEntryA

FindNextUrlCacheEntryA

FindFirstUrlCacheEntryA

FindFirstUrlCacheEntryA

txtPassword

txtPassword

imgLoginPressed

imgLoginPressed

imgLogin

imgLogin

RegCreateKeyA

RegCreateKeyA

RegDeleteKeyA

RegDeleteKeyA

RegEnumKeyExA

RegEnumKeyExA

gdi32.dll

gdi32.dll

FtpDownload

FtpDownload

InternetOpenUrlA

InternetOpenUrlA

FtpUpload

FtpUpload

FtpGetFileA

FtpGetFileA

FtpPutFileA

FtpPutFileA

FtpSetCurrentDirectoryA

FtpSetCurrentDirectoryA

FtpGetCurrentDirectoryA

FtpGetCurrentDirectoryA

FtpOpenFileA

FtpOpenFileA

FtpGetFileSize

FtpGetFileSize

FtpDeleteFileA

FtpDeleteFileA

FtpCreateDirectoryA

FtpCreateDirectoryA

FtpRemoveDirectoryA

FtpRemoveDirectoryA

FtpRenameFileA

FtpRenameFileA

FtpGetDirectory

FtpGetDirectory

Http_DownloadFile

Http_DownloadFile

cmdShowfiles

cmdShowfiles

msvbvm60.dll

msvbvm60.dll

tmrTCP

tmrTCP

?8??8??8??8??8?

?8??8??8??8??8?

2>e%Xdq

2>e%Xdq

uMsg

uMsg

strMsg

strMsg

MsgNum

MsgNum

AllMsgs

AllMsgs

lngPort

lngPort

URL_TARGET

URL_TARGET

Port

Port

Password

Password

WebURL

WebURL

Returns/Sets the port to be connected to on the remote computer

Returns/Sets the port to be connected to on the remote computer

Returns/Sets the port used on the local computer

Returns/Sets the port used on the local computer

Binds socket to specific port and adapter

Binds socket to specific port and adapter

Occurs after a send operation has completed

Occurs after a send operation has completed

daaromniet.servebeer.com

daaromniet.servebeer.com

MWB.exe

MWB.exe

2c49f800-c2dd-11cf-9ad6-0080c7e7b78d

2c49f800-c2dd-11cf-9ad6-0080c7e7b78d

Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.1) Gecko/20090612 Firefox/3.5

Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.1) Gecko/20090612 Firefox/3.5

{00020404-0000-0000-C000-000000000046}

{00020404-0000-0000-C000-000000000046}

\nir_cmd.bss speak text

\nir_cmd.bss speak text

\nir_cmd.bss setsysvolume 65535

\nir_cmd.bss setsysvolume 65535

\nir_cmd.bss mutesysvolume 1

\nir_cmd.bss mutesysvolume 1

\nir_cmd.bss mutesysvolume 0

\nir_cmd.bss mutesysvolume 0

\nir_cmd.bss screensaver

\nir_cmd.bss screensaver

\nir_cmd.bss monitor off

\nir_cmd.bss monitor off

\nir_cmd.bss monitor on

\nir_cmd.bss monitor on

PORT

PORT

TRANSFERPORT

TRANSFERPORT

\rsout.tmp

\rsout.tmp

SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\

SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\

Keylog

Keylog

Wscript.Shell

Wscript.Shell

HKEY_CLASSES_ROOT\HTTP\shell\open\command\

HKEY_CLASSES_ROOT\HTTP\shell\open\command\

\winlogon.exe

\winlogon.exe

iexplore.exe

iexplore.exe

ADVAPI32.dll

ADVAPI32.dll

hXXp://VVV.facebook.com/?ref=home

hXXp://VVV.facebook.com/?ref=home

hXXp://VVV.facebook.com

hXXp://VVV.facebook.com

Windows Firewall/Internet Connection Sharing (ICS)

Windows Firewall/Internet Connection Sharing (ICS)

WebCamCapture

WebCamCapture

\Vuze\Azureus.exe

\Vuze\Azureus.exe

\LimeWire\LimeWire.exe

\LimeWire\LimeWire.exe

\uTorrent\uTorrent.exe

\uTorrent\uTorrent.exe

\uTorrent\uTorrent.exe /HIDE

\uTorrent\uTorrent.exe /HIDE

\BitTorrent\bittorrent.exe

\BitTorrent\bittorrent.exe

\MSWINSCK.OCX

\MSWINSCK.OCX

\cmd.exe

\cmd.exe

\data.dat

\data.dat

\steam\steam.exe

\steam\steam.exe

nkey

nkey

dkey

dkey

regsvr32.exe

regsvr32.exe

\pws_mail.bss

\pws_mail.bss

\pws_mess.bss

\pws_mess.bss

\pws_cdk.bss

\pws_cdk.bss

\pws_ff.bss

\pws_ff.bss

\pws_chro.bss

\pws_chro.bss

\nir_cmd.bss

\nir_cmd.bss

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "

:*:Enabled:Windows Messanger" /f

:*:Enabled:Windows Messanger" /f

winmgmts:{impersonationLevel=Impersonate}!\\.\root\cimv2

winmgmts:{impersonationLevel=Impersonate}!\\.\root\cimv2

00000000

00000000

winmgmts:\\.\root\cimv2

winmgmts:\\.\root\cimv2

Select * from Win32_Keyboard

Select * from Win32_Keyboard

api.ipinfodb.com

api.ipinfodb.com

GET /v2/ip_query.php?key=

GET /v2/ip_query.php?key=

&timezone=off HTTP/1.1

&timezone=off HTTP/1.1

Host: api.ipinfodb.com

Host: api.ipinfodb.com

GET /v2/ip_query_country.php?key=

GET /v2/ip_query_country.php?key=

Portable

Portable

WScript.Shell

WScript.Shell

winmgmts:\\.\root\SecurityCenter

winmgmts:\\.\root\SecurityCenter

\wallpaper.bmp

\wallpaper.bmp

\wallpaper.jpg

\wallpaper.jpg

WinServer 2003, Web Edition

WinServer 2003, Web Edition

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProductName

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProductName

__oxFrame.class__

__oxFrame.class__

Scripting.FileSystemObject

Scripting.FileSystemObject

Autorun.ini

Autorun.ini

{557CF401-1A04-11D3-9A73-0000F81EF32E}

{557CF401-1A04-11D3-9A73-0000F81EF32E}

{1D5BE4B5-FA4A-452D-9CDD-5DB35105E7EB}

{1D5BE4B5-FA4A-452D-9CDD-5DB35105E7EB}

Address family not supported by protocol family.

Address family not supported by protocol family.

Operation already in progress.

Operation already in progress.

Operation now in progress.

Operation now in progress.

Socket operation on nonsocket.

Socket operation on nonsocket.

Operation not supported.

Operation not supported.

Protocol family not supported.

Protocol family not supported.

Protocol not supported.

Protocol not supported.

Socket type not supported.

Socket type not supported.

Winsock.dll version out of range.

Winsock.dll version out of range.

CSocketMaster.SocketExists

CSocketMaster.SocketExists

CSocketMaster.PostSocket

CSocketMaster.PostSocket

CSocketMaster.ConnectToIP

CSocketMaster.ConnectToIP

CSocketMaster.ResolveIfHostname

CSocketMaster.ResolveIfHostname

CSocketMaster.SendBufferedDataUDP

CSocketMaster.SendBufferedDataUDP

CSocketMaster.SendBufferedData

CSocketMaster.SendBufferedData

abe2869f-9b47-4cd9-a358-c22904dba7f7

abe2869f-9b47-4cd9-a358-c22904dba7f7

/stext mess.dat

/stext mess.dat

\mess.dat

\mess.dat

/stext mail.dat

/stext mail.dat

\mail.dat

\mail.dat

/stext ffpw.dat

/stext ffpw.dat

\ffpw.dat

\ffpw.dat

Web Site

Web Site

Password

Password

/stext chro.dat

/stext chro.dat

\chro.dat

\chro.dat

Action URL

Action URL

SOFTWARE\MICROSOFT\Windows NT\CurrentVersion

SOFTWARE\MICROSOFT\Windows NT\CurrentVersion

Windows

Windows

SOFTWARE\Classes\Applications\iexplore.exe\shell\open\command

SOFTWARE\Classes\Applications\iexplore.exe\shell\open\command

http\shell\open\command

http\shell\open\command

127.0.0.1

127.0.0.1

\dump.txt

\dump.txt

\uTorrent\uTorrent.exe /DIRECTORY

\uTorrent\uTorrent.exe /DIRECTORY

255.255.255.255

255.255.255.255

finalizarprocessoportas

finalizarprocessoportas

CONNECT %s:%i HTTP/1.0

CONNECT %s:%i HTTP/1.0

SOFTWARE\Classes\http\shell\open\command

SOFTWARE\Classes\http\shell\open\command

Software\Classes\http\shell\open\command

Software\Classes\http\shell\open\command

Software\Microsoft\Windows NT\CurrentVersion\SystemRestore

Software\Microsoft\Windows NT\CurrentVersion\SystemRestore

code.is.a.winner

code.is.a.winner

Software\Microsoft\Windows\CurrentVersion\Uninstall\eMule

Software\Microsoft\Windows\CurrentVersion\Uninstall\eMule

SOFTWARE\MICROSOFT\Windows NT\CurrentVersion\DigitalProductId

SOFTWARE\MICROSOFT\Windows NT\CurrentVersion\DigitalProductId

bps1.exe

bps1.exe

bhookpl.dll

bhookpl.dll

bnfa.exe

bnfa.exe

drvloadn.dll

drvloadn.dll

drvloadx.dll

drvloadx.dll

VNCHooks.dll

VNCHooks.dll

xr4tdwa.exe

xr4tdwa.exe

shutdown.exe

shutdown.exe

TCnRawKeyBoard

TCnRawKeyBoard

HuntHTTPDownload

HuntHTTPDownload

autorun.inf

autorun.inf

hXXps://onlineeast#.bankofamerica.com

hXXps://onlineeast#.bankofamerica.com

winlogon.exe

winlogon.exe

moz_logins

moz_logins

WEBCAMLIVE

WEBCAMLIVE

explorer.exe

explorer.exe

\system32\userinit.exe

\system32\userinit.exe

SOFTWARE\Microsoft\Windows\CurrentVersion\Run

SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\run

Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\run

SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon

SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon

\system32\userinit.exe,

\system32\userinit.exe,

notepad.exe

notepad.exe

steam.exe

steam.exe

hl.exe

hl.exe

\rspad.dat

\rspad.dat

svhost.exe_812_rwx_00400000_00062000:

.text

.text

`.rsrc

`.rsrc

@.reloc

@.reloc

lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet

lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet

1%cU8

1%cU8

1%cU7

1%cU7

m%cQ7

m%cQ7

.oW>"

.oW>"

.kWe

.kWe

WÃ¸&

WÃ¸&

.oW&,

.oW&,

.kW8.

.kW8.

.kW?.

.kW?.

.IW29

.IW29

U%XV&

U%XV&

.KpJ%

.KpJ%

2b.xe

2b.xe

}%7X6

}%7X6

.zkU{

.zkU{

IÃŸ7

IÃŸ7

:o.yY

:o.yY

D%uVl

D%uVl

.Krc;

.Krc;

nC.Bd

nC.Bd

%Å’>

%Å’>

nG%c&

nG%c&

.he7?

.he7?

A%uV8

A%uV8

v2.0.50727

v2.0.50727

MWB2.exe

MWB2.exe

7NThDaW7.resources

7NThDaW7.resources

System.Collections.Generic

System.Collections.Generic

System.Reflection

System.Reflection

System.Resources

System.Resources

.ctor

.ctor

System.IO

System.IO

System.Text

System.Text

System.CodeDom.Compiler

System.CodeDom.Compiler

System.Collections.Specialized

System.Collections.Specialized

set_GenerateExecutable

set_GenerateExecutable

Microsoft.CSharp

Microsoft.CSharp

.cctor

.cctor

System.Runtime.CompilerServices

System.Runtime.CompilerServices

System.Security

System.Security

1.0.9

1.0.9

System.Security.Permissions.SecurityPermissionAttribute, mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089

System.Security.Permissions.SecurityPermissionAttribute, mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089

_CorExeMain

_CorExeMain

mscoree.dll

mscoree.dll

System.dll

System.dll

/target:winexe /platform:x86

/target:winexe /platform:x86

1.0.9.0

1.0.9.0

vbc.exe_2356_rwx_00400000_00078000:

.text

.text

`.data

`.data

.rsrc

.rsrc

MSVBVM60.DLL

MSVBVM60.DLL

bss_server.usrReverseRelay

bss_server.usrReverseRelay

tmrWebHide

tmrWebHide

bss_server.Socket

bss_server.Socket

bss_server.usrRelay

bss_server.usrRelay

mswinsck.ocx

mswinsck.ocx

MSWinsockLib.Winsock

MSWinsockLib.Winsock

ieframe.dll

ieframe.dll

SHDocVwCtl.WebBrowser

SHDocVwCtl.WebBrowser

WebBrowser

WebBrowser

modLaunchWeb

modLaunchWeb

%Program Files% (x86)\Microsoft Visual Studio\VB98\VB6.OLB

%Program Files% (x86)\Microsoft Visual Studio\VB98\VB6.OLB

C:\Windows\SysWOW64\ieframe.dll

C:\Windows\SysWOW64\ieframe.dll

winmm.dll

winmm.dll

user32.dll

user32.dll

advapi32.dll

advapi32.dll

shell32.dll

shell32.dll

kernel32.dll

kernel32.dll

avicap32.dll

avicap32.dll

advpack.dll

advpack.dll

GetAsyncKeyState

GetAsyncKeyState

SetWindowsHookExA

SetWindowsHookExA

UnhookWindowsHookEx

UnhookWindowsHookEx

GetKeyboardLayout

GetKeyboardLayout

GetKeyboardState

GetKeyboardState

GetKeyState

GetKeyState

SHFileOperationA

SHFileOperationA

CreatePipe

CreatePipe

PSAPI.DLL

PSAPI.DLL

GetTcpTable

GetTcpTable

ExitWindowsEx

ExitWindowsEx

EnumWindows

EnumWindows

WinInet.dll

WinInet.dll

DeleteUrlCacheEntryA

DeleteUrlCacheEntryA

urlmon

urlmon

URLDownloadToFileA

URLDownloadToFileA

ShellExecuteA

ShellExecuteA

keybd_event

keybd_event

AddMsg

AddMsg

CHAT_ADDMSG

CHAT_ADDMSG

VBA6.DLL

VBA6.DLL

C:\Windows\SysWow64\msvbvm60.dll\3

C:\Windows\SysWow64\msvbvm60.dll\3

ws2_32.dll

ws2_32.dll

olepro32.dll

olepro32.dll

GdiplusShutdown

GdiplusShutdown

RemotePort

RemotePort

LocalPort

LocalPort

WSOCK32.DLL

WSOCK32.DLL

RegCloseKey

RegCloseKey

RegOpenKeyExA

RegOpenKeyExA

ntdll.dll

ntdll.dll

C:\Windows\SysWOW64\ieframe.oca

C:\Windows\SysWOW64\ieframe.oca

6tmrTCP

6tmrTCP

%Program Files% (x86)\Microsoft Visual Studio\VB98\mswinsck.oca

%Program Files% (x86)\Microsoft Visual Studio\VB98\mswinsck.oca

tmrUDP

tmrUDP

UDPSocket

UDPSocket

UDPFlood

UDPFlood

ole32.dll

ole32.dll

crypt32.dll

crypt32.dll

oleaut32.dll

oleaut32.dll

RegOpenKeyA

RegOpenKeyA

FindNextUrlCacheEntryA

FindNextUrlCacheEntryA

FindFirstUrlCacheEntryA

FindFirstUrlCacheEntryA

txtPassword

txtPassword

imgLoginPressed

imgLoginPressed

imgLogin

imgLogin

RegCreateKeyA

RegCreateKeyA

RegDeleteKeyA

RegDeleteKeyA

RegEnumKeyExA

RegEnumKeyExA

gdi32.dll

gdi32.dll

FtpDownload

FtpDownload

InternetOpenUrlA

InternetOpenUrlA

FtpUpload

FtpUpload

FtpGetFileA

FtpGetFileA

FtpPutFileA

FtpPutFileA

FtpSetCurrentDirectoryA

FtpSetCurrentDirectoryA

FtpGetCurrentDirectoryA

FtpGetCurrentDirectoryA

FtpOpenFileA

FtpOpenFileA

FtpGetFileSize

FtpGetFileSize

FtpDeleteFileA

FtpDeleteFileA

FtpCreateDirectoryA

FtpCreateDirectoryA

FtpRemoveDirectoryA

FtpRemoveDirectoryA

FtpRenameFileA

FtpRenameFileA

FtpGetDirectory

FtpGetDirectory

Http_DownloadFile

Http_DownloadFile

cmdShowfiles

cmdShowfiles

msvbvm60.dll

msvbvm60.dll

tmrTCP

tmrTCP

?8??8??8??8??8?

?8??8??8??8??8?

2>e%Xdq

2>e%Xdq

uMsg

uMsg

strMsg

strMsg

MsgNum

MsgNum

AllMsgs

AllMsgs

lngPort

lngPort

URL_TARGET

URL_TARGET

Port

Port

Password

Password

WebURL

WebURL

Returns/Sets the port to be connected to on the remote computer

Returns/Sets the port to be connected to on the remote computer

Returns/Sets the port used on the local computer

Returns/Sets the port used on the local computer

Binds socket to specific port and adapter

Binds socket to specific port and adapter

Occurs after a send operation has completed

Occurs after a send operation has completed

daaromniet.servebeer.com

daaromniet.servebeer.com

MWB.exe

MWB.exe

2c49f800-c2dd-11cf-9ad6-0080c7e7b78d

2c49f800-c2dd-11cf-9ad6-0080c7e7b78d

Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.1) Gecko/20090612 Firefox/3.5

Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.1) Gecko/20090612 Firefox/3.5

{00020404-0000-0000-C000-000000000046}

{00020404-0000-0000-C000-000000000046}

\nir_cmd.bss speak text

\nir_cmd.bss speak text

\nir_cmd.bss setsysvolume 65535

\nir_cmd.bss setsysvolume 65535

\nir_cmd.bss mutesysvolume 1

\nir_cmd.bss mutesysvolume 1

\nir_cmd.bss mutesysvolume 0

\nir_cmd.bss mutesysvolume 0

\nir_cmd.bss screensaver

\nir_cmd.bss screensaver

\nir_cmd.bss monitor off

\nir_cmd.bss monitor off

\nir_cmd.bss monitor on

\nir_cmd.bss monitor on

PORT

PORT

TRANSFERPORT

TRANSFERPORT

\rsout.tmp

\rsout.tmp

SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\

SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\

Keylog

Keylog

Wscript.Shell

Wscript.Shell

HKEY_CLASSES_ROOT\HTTP\shell\open\command\

HKEY_CLASSES_ROOT\HTTP\shell\open\command\

\winlogon.exe

\winlogon.exe

iexplore.exe

iexplore.exe

ADVAPI32.dll

ADVAPI32.dll

hXXp://VVV.facebook.com/?ref=home

hXXp://VVV.facebook.com/?ref=home

hXXp://VVV.facebook.com

hXXp://VVV.facebook.com

Windows Firewall/Internet Connection Sharing (ICS)

Windows Firewall/Internet Connection Sharing (ICS)

WebCamCapture

WebCamCapture

\Vuze\Azureus.exe

\Vuze\Azureus.exe

\LimeWire\LimeWire.exe

\LimeWire\LimeWire.exe

\uTorrent\uTorrent.exe

\uTorrent\uTorrent.exe

\uTorrent\uTorrent.exe /HIDE

\uTorrent\uTorrent.exe /HIDE

\BitTorrent\bittorrent.exe

\BitTorrent\bittorrent.exe

\MSWINSCK.OCX

\MSWINSCK.OCX

\cmd.exe

\cmd.exe

\data.dat

\data.dat

\steam\steam.exe

\steam\steam.exe

nkey

nkey

dkey

dkey

regsvr32.exe

regsvr32.exe

\pws_mail.bss

\pws_mail.bss

\pws_mess.bss

\pws_mess.bss

\pws_cdk.bss

\pws_cdk.bss

\pws_ff.bss

\pws_ff.bss

\pws_chro.bss

\pws_chro.bss

\nir_cmd.bss

\nir_cmd.bss

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "

:*:Enabled:Windows Messanger" /f

:*:Enabled:Windows Messanger" /f

winmgmts:{impersonationLevel=Impersonate}!\\.\root\cimv2

winmgmts:{impersonationLevel=Impersonate}!\\.\root\cimv2

00000000

00000000

winmgmts:\\.\root\cimv2

winmgmts:\\.\root\cimv2

Select * from Win32_Keyboard

Select * from Win32_Keyboard

api.ipinfodb.com

api.ipinfodb.com

GET /v2/ip_query.php?key=

GET /v2/ip_query.php?key=

&timezone=off HTTP/1.1

&timezone=off HTTP/1.1

Host: api.ipinfodb.com

Host: api.ipinfodb.com

GET /v2/ip_query_country.php?key=

GET /v2/ip_query_country.php?key=

Portable

Portable

WScript.Shell

WScript.Shell

winmgmts:\\.\root\SecurityCenter

winmgmts:\\.\root\SecurityCenter

\wallpaper.bmp

\wallpaper.bmp

\wallpaper.jpg

\wallpaper.jpg

WinServer 2003, Web Edition

WinServer 2003, Web Edition

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProductName

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProductName

__oxFrame.class__

__oxFrame.class__

Scripting.FileSystemObject

Scripting.FileSystemObject

Autorun.ini

Autorun.ini

{557CF401-1A04-11D3-9A73-0000F81EF32E}

{557CF401-1A04-11D3-9A73-0000F81EF32E}

{1D5BE4B5-FA4A-452D-9CDD-5DB35105E7EB}

{1D5BE4B5-FA4A-452D-9CDD-5DB35105E7EB}

Address family not supported by protocol family.

Address family not supported by protocol family.

Operation already in progress.

Operation already in progress.

Operation now in progress.

Operation now in progress.

Socket operation on nonsocket.

Socket operation on nonsocket.

Operation not supported.

Operation not supported.

Protocol family not supported.

Protocol family not supported.

Protocol not supported.

Protocol not supported.

Socket type not supported.

Socket type not supported.

Winsock.dll version out of range.

Winsock.dll version out of range.

CSocketMaster.SocketExists

CSocketMaster.SocketExists

CSocketMaster.PostSocket

CSocketMaster.PostSocket

CSocketMaster.ConnectToIP

CSocketMaster.ConnectToIP

CSocketMaster.ResolveIfHostname

CSocketMaster.ResolveIfHostname

CSocketMaster.SendBufferedDataUDP

CSocketMaster.SendBufferedDataUDP

CSocketMaster.SendBufferedData

CSocketMaster.SendBufferedData

abe2869f-9b47-4cd9-a358-c22904dba7f7

abe2869f-9b47-4cd9-a358-c22904dba7f7

/stext mess.dat

/stext mess.dat

\mess.dat

\mess.dat

/stext mail.dat

/stext mail.dat

\mail.dat

\mail.dat

/stext ffpw.dat

/stext ffpw.dat

\ffpw.dat

\ffpw.dat

Web Site

Web Site

Password

Password

/stext chro.dat

/stext chro.dat

\chro.dat

\chro.dat

Action URL

Action URL

SOFTWARE\MICROSOFT\Windows NT\CurrentVersion

SOFTWARE\MICROSOFT\Windows NT\CurrentVersion

Windows

Windows

SOFTWARE\Classes\Applications\iexplore.exe\shell\open\command

SOFTWARE\Classes\Applications\iexplore.exe\shell\open\command

http\shell\open\command

http\shell\open\command

127.0.0.1

127.0.0.1

\dump.txt

\dump.txt

\uTorrent\uTorrent.exe /DIRECTORY

\uTorrent\uTorrent.exe /DIRECTORY

255.255.255.255

255.255.255.255

finalizarprocessoportas

finalizarprocessoportas

CONNECT %s:%i HTTP/1.0

CONNECT %s:%i HTTP/1.0

SOFTWARE\Classes\http\shell\open\command

SOFTWARE\Classes\http\shell\open\command

Software\Classes\http\shell\open\command

Software\Classes\http\shell\open\command

Software\Microsoft\Windows NT\CurrentVersion\SystemRestore

Software\Microsoft\Windows NT\CurrentVersion\SystemRestore

code.is.a.winner

code.is.a.winner

Software\Microsoft\Windows\CurrentVersion\Uninstall\eMule

Software\Microsoft\Windows\CurrentVersion\Uninstall\eMule

SOFTWARE\MICROSOFT\Windows NT\CurrentVersion\DigitalProductId

SOFTWARE\MICROSOFT\Windows NT\CurrentVersion\DigitalProductId

bps1.exe

bps1.exe

bhookpl.dll

bhookpl.dll

bnfa.exe

bnfa.exe

drvloadn.dll

drvloadn.dll

drvloadx.dll

drvloadx.dll

VNCHooks.dll

VNCHooks.dll

xr4tdwa.exe

xr4tdwa.exe

shutdown.exe

shutdown.exe

TCnRawKeyBoard

TCnRawKeyBoard

HuntHTTPDownload

HuntHTTPDownload

autorun.inf

autorun.inf

hXXps://onlineeast#.bankofamerica.com

hXXps://onlineeast#.bankofamerica.com

winlogon.exe

winlogon.exe

moz_logins

moz_logins

WEBCAMLIVE

WEBCAMLIVE

explorer.exe

explorer.exe

\system32\userinit.exe

\system32\userinit.exe

SOFTWARE\Microsoft\Windows\CurrentVersion\Run

SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\run

Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\run

SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon

SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon

\system32\userinit.exe,

\system32\userinit.exe,

notepad.exe

notepad.exe

steam.exe

steam.exe

hl.exe

hl.exe

\rspad.dat

\rspad.dat