Gen.Variant.Midie.6956_1c4574d8af

August 20, 2021 15:30

Trojan-Dropper.Win32.Daws.awfy (Kaspersky), Gen:Variant.Midie.6956 (B) (Emsisoft), Gen:Variant.Midie.6956 (AdAware), Virus.Win32.Sality.2.FD, VirusSality.YR, GenericAutorunWorm.YR, GenericInjector.YR (Lavasoft MAS)Behaviour: Trojan-Dropper, Trojan, Worm, Virus, WormAutorun

The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.

Summary

MD5: 1c4574d8af783820e7eec1902d30c073

SHA1: 88b5a656a46fd9dca75eebfdab50ebf8b8fb0b26

SHA256: 9c2ec95628363b43f0083de9eae5a102a3a6ba7e34037043ba59dd4aa0830d09

SSDeep: 49152:WYBFbTCVBoxKCnFnQXBbrtgb/iQvu0UHOau:bF60xvWbrtUTrUHOl

Size: 2096940 bytes

File type: EXE

Platform: WIN32

Entropy: Packed

PEID: MicrosoftVisualC, MicrosoftVisualCv50v60MFC, MicrosoftVisualC50, Armadillov171, UPolyXv05_v6

Company: no certificate found

Created at: 2012-03-05 10:37:55

Analyzed on: WindowsXP SP3 32-bit

Summary: Trojan-Dropper. Trojan program, intended for stealth installation of other malware into user's system.

Dynamic Analysis

Payload

Behaviour	Description
WormAutorun	A worm can spread via removable drives. It writes its executable and creates "autorun.inf" scripts on all removable drives. The autorun script will execute the Trojan's file once a user opens a drive's folder in Windows Explorer.

Process activity

The Trojan creates the following process(es):

%original file name%.exe:1232
wtmps.exe:2908
mscaps.exe:2960
@AE1.tmp.exe:1632
launch.exe:2824
WdExt.exe:2284

The Trojan injects its code into the following process(es):

service.exe:1496
EmangEloh.exe:1324
winlogon.exe:1512
Explorer.EXE:1140

Mutexes

The following mutexes were created/opened:No objects were found.

File activity

The process %original file name%.exe:1232 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Templates\O63746Z\winlogon.exe (1281 bytes)
%Documents and Settings%\%current user%\Start Menu\Programs\Startup\sql.cmd (1281 bytes)
%Documents and Settings%\%current user%\Templates\O63746Z\service.exe (1281 bytes)
%WinDir%\Ti645063ta.exe (1281 bytes)
%System%\X51334go\Z127387cie.cmd (1281 bytes)
%WinDir%\M35838\smss.exe (1281 bytes)
%WinDir%\M35838\Ja856821bLay.com (1281 bytes)
%System%\127387645063l.exe (1281 bytes)
%WinDir%\sa-755287.exe (1281 bytes)
%WinDir%\M35838\EmangEloh.exe (1281 bytes)
%WinDir%\system\msvbvm60.dll (8657 bytes)
%Documents and Settings%\%current user%\Templates\O63746Z\TuxO63746Z.exe (1281 bytes)

The process wtmps.exe:2908 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%System%\mscaps.exe (27349 bytes)

The process mscaps.exe:2960 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%System%\wtime32.dll (29045 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\E.tmp (406 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\wtmps.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\E.tmp (0 bytes)

The process @AE1.tmp.exe:1632 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\000808E2_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00080901_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0007FF6C_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000804EA_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000805D5_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0007FD69_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00080008_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00080400_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0007FA6B_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\Messenger\Extension\WdExt.exe (244510 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0008050A_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00080047_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0007F673_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0008074C_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0007FEA1_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0007F700_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0007F8A6_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0007F599_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0007F6B2_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Sp3.tmp (1304 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0007F932_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0007FB36_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000808C3_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0007F952_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00080884_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000806FE_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0007F7DB_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0007FD0B_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0007F7BB_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000802C8_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00080613_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0008044E_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0007F9BF_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0007F625_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00080671_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00080354_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\buxql.exe (561 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00080539_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000807AA_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000804CB_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0007F73E_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0007FCBD_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0007F80A_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00080690_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00080279_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0007FEE0_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0007FA1D_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00080325_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0007FBE2_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000807C9_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00080112_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0007FE63_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00080141_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0007F9CF_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0007F616_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0007F9FE_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0007F971_Rar\@AE1.tmp.exe (13122 bytes)
%WinDir%\system.ini (68 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000806DE_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000800E3_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0007FDE6_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0008047D_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0007F79C_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0007FDA7_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00080076_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00080316_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0007F819_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0007F8E4_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000807E8_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000804AC_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0008042F_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000803A2_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0007F4ED_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0007FD49_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0007FBC3_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00080567_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0007FC7E_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00080383_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\desktop.ini (159 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000808A4_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0007F848_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0007FFAB_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0008072D_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0007F654_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0008046D_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\tmp2.tmp (459254 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000808F2_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Application Data\Temp\mydll.dll (12549 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00080652_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000805B6_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\tmp5.tmp (907 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0007FA8A_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000803C2_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0007FA4C_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0007FAC9_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Se4.tmp (1792 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0007FD88_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0007F5F6_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0007F78D_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0008071D_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0007FC20_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0007F913_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0007F838_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00080548_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0007F867_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0007FB17_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0007F6D1_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Application Data\Temp\adm1.bat (196 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0007F990_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0007FAE8_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0007F4CD_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0007F7EA_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0007F644_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00080817_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0007F54A_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00080587_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0007F693_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0007F664_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0007FB75_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00080836_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000802A8_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0007FE43_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0007FE24_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0007FA2C_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000806B0_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000805F4_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00080865_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0008023B_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00080633_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0008076B_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Application Data\Temp\adm0.bat (159 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0008078A_Rar\@AE1.tmp.exe (13122 bytes)

The Trojan deletes the following file(s):

%WinDir%\7f4cd (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\tmp2.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Sp3.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\buxql.exe (0 bytes)
%Documents and Settings%\%current user%\Application Data\Temp\mydll.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Se4.tmp (0 bytes)

The process service.exe:1496 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%WinDir%\pchealth\UploadLB\Gallery .scr (305 bytes)
%Documents and Settings%\%current user%\Start Menu\Programs\Startup\sql.cmd (1281 bytes)
%WinDir%\SoftwareDistribution\Download\TutoriaL HAcking .exe (305 bytes)
%WinDir%\ime\shared\Blink 182 .exe (305 bytes)
%Documents and Settings%\%current user%\Templates\O63746Z\TuxO63746Z.exe (1281 bytes)
%System%\X51334go\Z127387cie.cmd (1281 bytes)
%Documents and Settings%\%current user%\Application Data\Macromedia\Flash Player\#SharedObjects\Titip Folder Jangan DiHapus .exe (305 bytes)
%WinDir%\system\msvbvm60.dll (8657 bytes)
%WinDir%\[TheMoonlight].txt (109 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\Network\Downloader\RaHasIA .exe (305 bytes)
%Program Files%\Movie Maker\Shared\Gallery .scr (305 bytes)
%WinDir%\Downloaded Program Files\THe Best Ungu .scr (305 bytes)
%Program Files%\Common Files\Microsoft Shared\Titip Folder Jangan DiHapus .exe (305 bytes)

The process launch.exe:2824 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Application Data\Temp\adm0.bat (112 bytes)

The process WdExt.exe:2284 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\0008289F_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00082C97_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00083820_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00082F27_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00082F56_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00082FF2_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000818C1_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00082E2D_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000839D5_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000819AB_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0008210E_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00082F17_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000817D6_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0008368A_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00082294_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00081D54_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00083A33_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00083273_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000834B5_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000826CA_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00081892_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0008192E_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00081546_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000839B6_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00082071_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00083745_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00081E9D_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00082DDF_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00083978_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000835CE_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000839A6_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00082052_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00082C87_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00082285_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Application Data\Temp\mydll.dll (12549 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00083B8B_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00081DB2_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\Windows\Addins\att.dll (18829 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00082A64_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00083BBA_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0008290C_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\tmpD.tmp (55476 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0008314A_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00081D16_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00081FD5_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00082FC3_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00082042_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00082C77_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000832C1_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00081601_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000835AF_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\Shared\Modules\fil.dll (10805 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0008382F_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0008331F_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000816FB_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00081BCE_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00082459_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00081E8D_Rar\WdExt.exe (26244 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00081FC5_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\Repairs\sha.dll (7589 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00082B4F_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0008260F_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00082803_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00081BBE_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00083A43_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00081815_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0008293B_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0008148A_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0008266D_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000832FF_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00083BAA_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00081E5E_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00082544_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000834E4_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00081EFA_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00083774_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00082841_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0008146B_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00082747_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\tmp7.tmp (48916 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0008213C_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0008312B_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00082E1D_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00082524_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000835BE_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00081FF4_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00081B80_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00083784_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0008142D_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00081D83_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00082C29_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000821AA_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000819DA_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00082822_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00082E8B_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00081B12_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00083BC9_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00082515_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00083707_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\tmpB.tmp (21164 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000821C9_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00082479_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0008149A_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0008240B_Rar\WdExt.exe (26244 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00082023_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000834D4_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0008383F_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000823FC_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000830DC_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0008217B_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000822C3_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00081AB5_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00082A45_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000839C6_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\tmp9.tmp (28924 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00083179_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000818A1_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00082330_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00083447_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00081640_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000815B3_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0008165F_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00082E5C_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00081D74_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00081882_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000826BB_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000825FF_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00082F85_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00081A76_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0008361C_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00083A14_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0008330F_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0008196C_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00082DFE_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00082FB4_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00081EEB_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00082F46_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00081ECB_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0008214C_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\tmpC.tmp (36444 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00083810_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00082A93_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\Defender\launch.exe (18077 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000814AA_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00083726_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00082C58_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00081D06_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\wtmps.exe (31581 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00081B8F_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00081AE3_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00082CD5_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00082B3F_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00082062_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00081F1A_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0008241B_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00081B9F_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00081517_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00083438_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00082488_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00083409_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00083428_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00083457_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00081A28_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00081565_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0008190F_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000839F5_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00082B5E_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0008198C_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00083188_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00081D26_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00082B20_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0008387E_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00082E4C_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000831A8_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00082BFA_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000818EF_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000819F9_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00082E3D_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000832E0_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00082DC0_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00083159_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00083282_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000837E1_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00083476_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00081FE5_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000824A7_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00081E6E_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00081798_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0008143C_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000822E2_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00081B41_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00081B60_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00083292_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00081594_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00082D62_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00082469_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00081F0A_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00082AB2_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000832D0_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00082709_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00082728_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0008333E_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0008269B_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00083987_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0008294B_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00083002_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00082AE1_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000835FD_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00081E4E_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0008388D_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00081D35_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0008366A_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000828CE_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0008367A_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\tmp8.tmp (26548 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\Identities\"%CurrentUserName%"\arc.dll (96316 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00082861_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00083B7B_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00082718_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00081769_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0008310B_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00082033_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0008385E_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\Common\Shared\dis.dll (10077 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00081DA3_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000830CD_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00082E0E_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000814F8_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00082C49_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00082FD3_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Application Data\Temp\adm1.bat (156 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0008364B_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000832A2_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000822D3_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00082A35_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00081507_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0008172A_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00082AD2_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00083467_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00081853_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00081D93_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00082498_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00082E7B_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00082302_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00082C39_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0008386E_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000822A4_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000822F2_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0008218B_Rar\WdExt.exe (26244 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0008311B_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000816CD_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0008215C_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0008362C_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000835ED_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00083A04_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00083B5C_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00081621_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\Caches\Files\usd.dll (7933 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0008166F_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00081EDB_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000828DE_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00083B3D_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00082A26_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00081650_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00082014_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00083755_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00083263_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0008390A_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000814C9_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00082321_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\tmpA.tmp (18508 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000821B9_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00081EBC_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00082F94_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000838AC_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0008313A_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00083198_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00082311_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0008212D_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00081D64_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00083486_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000814E8_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0008291C_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00082340_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000814B9_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0008211D_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000828AF_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000834A5_Rar\WdExt.exe (26244 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00082F75_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000837F1_Rar\WdExt.exe (13122 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\tmp9.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\tmpC.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\tmpB.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\tmpD.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\tmp7.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\tmpA.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\tmp8.tmp (0 bytes)
%Documents and Settings%\%current user%\Application Data\Temp\mydll.dll (0 bytes)

The process EmangEloh.exe:1324 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%System%\X51334go\Z127387cie.cmd (1281 bytes)
%WinDir%\[TheMoonlight].txt (109 bytes)
%Documents and Settings%\%current user%\Start Menu\Programs\Startup\sql.cmd (1281 bytes)
%Documents and Settings%\%current user%\Templates\O63746Z\TuxO63746Z.exe (1281 bytes)

Registry activity

The process %original file name%.exe:1232 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKLM\SOFTWARE\Microsoft\TUX\Path]
"1" = "M35838"
"3" = "X51334go"
"2" = "O63746Z"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Templates" = "%Documents and Settings%\%current user%\Templates"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%Documents and Settings%\%current user%\Templates\O63746Z]
"winlogon.exe" = "winlogon"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\VB and VBA Program Settings\untukmu\version]
"me" = "4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%Documents and Settings%\%current user%\Templates\O63746Z]
"service.exe" = "service"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "B4 35 A9 A9 AE 62 7A EF 51 4E 02 0B F8 C6 CE B7"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%WinDir%\M35838]
"smss.exe" = "smss"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"
"Programs" = "%Documents and Settings%\%current user%\Start Menu\Programs"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\TUX\biang]
"4" = "856821"
"5" = "110343"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%WinDir%\M35838]
"EmangEloh.exe" = "EmangEloh"

[HKLM\SOFTWARE\Microsoft\TUX\biang]
"1" = "127387"
"2" = "755287"
"3" = "645063"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

"IntranetName" = "1"

The process mscaps.exe:2960 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\{ef2b00e3-19da-4e78-b118-6b6451b719f2}]
"Locale" = "*"
"StubPath" = "%System%\mscaps.exe /s /n /i:U shell32.dll"
"Version" = "1,125,2406,1"
"ComponentID" = "DirectShow"

The process @AE1.tmp.exe:1632 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%Documents and Settings%\%current user%\Application Data\Temp]
"adm1.bat" = "adm1"
"adm0.bat" = "adm0"

[HKCU\Software\Stvncyfrlda]
"m2_8" = "997419746"

[HKCU\Software\Stvncyfrlda\168128873]
"-1648771660" = "30"

[HKCU\Software\Stvncyfrlda]
"m2_2" = "3470575367"
"m2_3" = "910905639"
"m2_0" = "6889"
"m2_1" = "1735293802"
"m2_6" = "1821804778"
"m2_7" = "3557105245"
"m2_4" = "2646190109"
"m2_5" = "86520731"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Security Center]
"AntiVirusOverride" = "1"

[HKLM\SOFTWARE\Microsoft\Security Center\Svc]
"UpdatesDisableNotify" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Stvncyfrlda\168128873]
"-737866757" = "1E5571E550EC6AC53AE13D3F7DC0CC8061CA44594227D6670DCDCEE4A123B745EEAD14A703C99DD3DBA2A4D607F69A83882C176653A4259F99BD6A9AA8EBC4B5A7028BF34E1C7C726DDA76137D0018A90E5CEFA084D0BB9F20D2346760CC5762EE70F3336E4A2BF1EC3D5E297DC79279B9237BA952F46582C5B90B54CE577E6852FFEDCF4C3AF6531535847E5DA8CDE9FB42AE7DAD10CECB5628D6CB3D14BE8454AD881D29EE50C7CACF782FDC3C2625A60E29DB5AF20451090ADA90C8E812FAF069C6194C2CA266BD6AA8911F3774E5030BA04C8A9D88FAC4EFE9901B2A630033F20048AF11A37D0019DA4E355233F7FB54DC18CA8FD6E270532510C72C472D"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced]
"Hidden" = "2"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1B 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\Stvncyfrlda]
"m4_0" = "0"
"m4_1" = "1735290733"
"m4_2" = "3470581466"
"m4_3" = "910904903"
"m4_4" = "2646195636"
"m4_5" = "86519073"
"m4_6" = "1821809806"
"m4_7" = "3557100539"
"m4_8" = "997423976"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"GlobalUserOffline" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Security Center]
"UpdatesDisableNotify" = "1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKLM\SOFTWARE\Microsoft\Security Center\Svc]
"FirewallDisableNotify" = "1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Stvncyfrlda\168128873]
"910904903" = "0"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "7F C2 CF 4B 97 50 F8 4A 55 08 3B F5 3B 00 C3 A3"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Stvncyfrlda]
"m3_3" = "927474798"

[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DoNotAllowExceptions" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKLM\SOFTWARE\Microsoft\Security Center]
"FirewallOverride" = "1"

[HKLM\SOFTWARE\Microsoft\Security Center\Svc]
"UacDisableNotify" = "1"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKCU\Software\Stvncyfrlda\168128873]
"-824385830" = "0"
"1821809806" = "0200687474703A2F2F7061647275702E636F6D2F736F62616B61312E67696600687474703A2F2F3139302E3132302E3232372E39313A383038302F736F62616B61766F6C6F732E676966"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = "1"

[HKLM\SOFTWARE\Microsoft\Security Center]
"UacDisableNotify" = "1"

[HKCU\Software\Stvncyfrlda]
"m3_2" = "3487544563"
"m3_1" = "1718420804"
"m3_0" = "17001001"
"m3_7" = "3573965266"
"m3_6" = "1838544551"
"m3_5" = "69945096"
"m3_4" = "2629490589"
"m3_8" = "980422977"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system]
"EnableLUA" = "0"

[HKCU\Software\Stvncyfrlda\168128873]
"1735290733" = "14"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Security Center\Svc]
"FirewallOverride" = "1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Stvncyfrlda]
"m1_5" = "3898353818"
"m1_4" = "2161800132"
"m1_7" = "1991572934"
"m1_6" = "1482184409"
"m1_1" = "3902816932"
"m1_0" = "3576254676"
"m1_3" = "1738348942"
"m1_2" = "1341601299"

"m1_8" = "2910010173"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKLM\SOFTWARE\Microsoft\Security Center]
"FirewallDisableNotify" = "1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKCU\Software\Stvncyfrlda\168128873]
"86519073" = "75"

Adds a rule to the firewall Windows which allows any network activity:

[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp]
"@AE1.tmp.exe" = "C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\@AE1.tmp.exe:*:Enabled:ipsec"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

A firewall is disabled:

[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = "0"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

Antivirus notifications are disabled:

[HKLM\SOFTWARE\Microsoft\Security Center]
"AntiVirusDisableNotify" = "1"

[HKLM\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusDisableNotify" = "1"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Firewall notifications are disabled:

[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = "1"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process service.exe:1496 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\VB and VBA Program Settings\noGods\appActive]
"service.exe" = "Ãƒâ€¹Ã¢â‚¬Â Ãƒâ€šÃ‚ÂÃƒÆ’Ã¢â‚¬Â¢qÃƒâ€šÃ‚Â ÃƒÆ’Ã‚ÂÃƒÂ¢Ã¢â€šÂ¬Ã‚Â°WÃƒâ€šÃ‚Â«"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"DisableRegistryTools" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced]
"HideFileExt" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\System\CurrentControlSet\Control\SafeBoot]
"AlternateShell" = "127387645063l.exe"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders]
"Common Startup" = "%System%\X51334go"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Templates" = "%Documents and Settings%\%current user%\Templates"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\CabinetState]
"fullpath" = "1"

[HKCU\Software\VB and VBA Program Settings\untukmu\version]
"me" = "4"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe]
"debugger" = "%WinDir%\notepad.exe"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe]
"debugger" = "%WinDir%\notepad.exe"

[HKCR\scrfile]
"(Default)" = "File Folder"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced]
"Hidden" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Programs" = "%Documents and Settings%\%current user%\Start Menu\Programs"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced]
"ShowSuperHidden" = "0"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "CE 19 3E 0F 60 F4 26 1B 85 EA CE C5 B6 12 D4 35"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\SuperHidden]
"UncheckedValue" = "0"

[HKLM\SYSTEM\ControlSet002\Control\SafeBoot]
"AlternateShell" = "127387645063l.exe"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"T46Z273" = "%WinDir%\sa-755287.exe"

The following driver will be automatically launched by the OS Loader:

[HKLM\System\CurrentControlSet\Services\SharedAccess]
"Start" = "0"

The Trojan adds the reference to itself to be executed when a user logs on:

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"UserInit" = "%System%\userinit.exe , %WinDir%\M35838\Ja856821bLay.com"

"Shell" = "explorer.exe, %Documents and Settings%\%current user%\Templates\O63746Z\TuxO63746Z.exe"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"T1358287TT4" = "%System%\127387645063l.exe"

The Trojan deletes the following value(s) in system registry:

The Trojan disables automatic startup of the application by deleting the following autorun value:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Bron-Spizaetus-cfirltrx"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"AllMyBallance"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"YourUnintendes"

"Bron-Spizaetus-cgglmmrv"

"dkernel"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"Tok-Cirrhatus-1101"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"TryingToSpeak"

"YourUnintended"

"Bron-Spizaetus"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"MomentEverComes"

"SaTRio ADie X"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ADie suka kamu"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"Tok-Cirrhatus"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"lexplorer"

The process launch.exe:2824 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "25 D1 DE CA EE 5C 3D 01 D9 13 A0 62 A3 8A EF E9"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass" = "1"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

"IntranetName" = "1"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

"UNCAsIntranet" = "1"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender Extension" = "%Documents and Settings%\%current user%\Application Data\Microsoft\Defender\launch.exe"

The process WdExt.exe:2284 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "3B AC FE 75 43 0E DC 57 E9 55 3E FF 06 E2 58 09"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

The process EmangEloh.exe:1324 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\VB and VBA Program Settings\noGods\appActive]
"EmangEloh.exe" = "Ãƒâ€šÃ‚Â¦Ãƒâ€šÃ‚Â»ÃƒÆ’Ã‚Â³Ãƒâ€¦Ã‚Â½Ãƒâ€šÃ‚Â½ÃƒÆ’Ã‚ÂªÃƒâ€šÃ‚Â§tÃƒÆ’Ã‹â€ "

[HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"DisableRegistryTools" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced]
"HideFileExt" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\System\CurrentControlSet\Control\SafeBoot]
"AlternateShell" = "127387645063l.exe"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders]
"Common Startup" = "%System%\X51334go"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Templates" = "%Documents and Settings%\%current user%\Templates"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\CabinetState]
"fullpath" = "1"

[HKCU\Software\VB and VBA Program Settings\untukmu\version]
"me" = "4"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe]
"debugger" = "%WinDir%\notepad.exe"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe]
"debugger" = "%WinDir%\notepad.exe"

[HKCR\scrfile]
"(Default)" = "File Folder"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced]
"Hidden" = "0"

"ShowSuperHidden" = "0"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "4C 02 A5 F5 AC F5 3B D6 23 5D BF 14 8D 76 25 FB"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Programs" = "%Documents and Settings%\%current user%\Start Menu\Programs"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\SuperHidden]
"UncheckedValue" = "0"

[HKLM\SYSTEM\ControlSet002\Control\SafeBoot]
"AlternateShell" = "127387645063l.exe"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"T46Z273" = "%WinDir%\sa-755287.exe"

The following driver will be automatically launched by the OS Loader:

[HKLM\System\CurrentControlSet\Services\SharedAccess]
"Start" = "0"

The Trojan adds the reference to itself to be executed when a user logs on:

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"UserInit" = "%System%\userinit.exe , %WinDir%\M35838\Ja856821bLay.com"

"Shell" = "explorer.exe, %Documents and Settings%\%current user%\Templates\O63746Z\TuxO63746Z.exe"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"T1358287TT4" = "%System%\127387645063l.exe"

The Trojan deletes the following value(s) in system registry:

The Trojan disables automatic startup of the application by deleting the following autorun value:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Bron-Spizaetus-cfirltrx"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"AllMyBallance"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"YourUnintendes"

"Bron-Spizaetus-cgglmmrv"

"dkernel"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"Tok-Cirrhatus-1101"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"TryingToSpeak"

"YourUnintended"

"Bron-Spizaetus"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"MomentEverComes"

"SaTRio ADie X"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ADie suka kamu"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"Tok-Cirrhatus"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"lexplorer"

Dropped PE files

MD5	File path
6bba9e183cc0212f741c4a43130225d0	c:\%original file name%.exe
6bba9e183cc0212f741c4a43130225d0	c:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\RaHasIA .exe
6bba9e183cc0212f741c4a43130225d0	c:\Documents and Settings\"%CurrentUserName%"\Application Data\Macromedia\Flash Player\#SharedObjects\Titip Folder Jangan DiHapus .exe
f1c9f4a1f92588aeb82be5d2d4c2c730	c:\Documents and Settings\"%CurrentUserName%"\Application Data\Microsoft\Caches\Files\usd.dll
1fcc5b3ed6bc76d70cfa49d051e0dff6	c:\Documents and Settings\"%CurrentUserName%"\Application Data\Microsoft\Common\Shared\dis.dll
bb3bb6e7fe14b92175c7bad897e221c7	c:\Documents and Settings\"%CurrentUserName%"\Application Data\Microsoft\Defender\launch.exe
a92cb8491a1066e1f2de6eafff0df53a	c:\Documents and Settings\"%CurrentUserName%"\Application Data\Microsoft\Messenger\Extension\WdExt.exe
6a9461f260ebb2556b8ae1d0ba93858a	c:\Documents and Settings\"%CurrentUserName%"\Application Data\Microsoft\Repairs\sha.dll
d0c9ada173da923efabb53d5a9b28d54	c:\Documents and Settings\"%CurrentUserName%"\Application Data\Microsoft\Shared\Modules\fil.dll
fffa05401511ad2a89283c52d0c86472	c:\Documents and Settings\"%CurrentUserName%"\Application Data\Microsoft\Windows\Addins\att.dll
790c6356f71a379b8ae84a25d563b3b3	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\0007F4CD_Rar\@AE1.tmp.exe
790c6356f71a379b8ae84a25d563b3b3	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\0007F4ED_Rar\@AE1.tmp.exe
790c6356f71a379b8ae84a25d563b3b3	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\0007F54A_Rar\@AE1.tmp.exe
790c6356f71a379b8ae84a25d563b3b3	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\0007F599_Rar\@AE1.tmp.exe
790c6356f71a379b8ae84a25d563b3b3	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\0007F5F6_Rar\@AE1.tmp.exe
790c6356f71a379b8ae84a25d563b3b3	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\0007F616_Rar\@AE1.tmp.exe
790c6356f71a379b8ae84a25d563b3b3	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\0007F625_Rar\@AE1.tmp.exe
790c6356f71a379b8ae84a25d563b3b3	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\0007F644_Rar\@AE1.tmp.exe
790c6356f71a379b8ae84a25d563b3b3	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\0007F654_Rar\@AE1.tmp.exe
790c6356f71a379b8ae84a25d563b3b3	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\0007F664_Rar\@AE1.tmp.exe
790c6356f71a379b8ae84a25d563b3b3	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\0007F673_Rar\@AE1.tmp.exe
790c6356f71a379b8ae84a25d563b3b3	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\0007F693_Rar\@AE1.tmp.exe
790c6356f71a379b8ae84a25d563b3b3	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\0007F6B2_Rar\@AE1.tmp.exe
790c6356f71a379b8ae84a25d563b3b3	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\0007F6D1_Rar\@AE1.tmp.exe
790c6356f71a379b8ae84a25d563b3b3	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\0007F700_Rar\@AE1.tmp.exe
790c6356f71a379b8ae84a25d563b3b3	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\0007F73E_Rar\@AE1.tmp.exe
790c6356f71a379b8ae84a25d563b3b3	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\0007F78D_Rar\@AE1.tmp.exe
790c6356f71a379b8ae84a25d563b3b3	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\0007F79C_Rar\@AE1.tmp.exe
790c6356f71a379b8ae84a25d563b3b3	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\0007F7BB_Rar\@AE1.tmp.exe
790c6356f71a379b8ae84a25d563b3b3	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\0007F7DB_Rar\@AE1.tmp.exe
790c6356f71a379b8ae84a25d563b3b3	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\0007F7EA_Rar\@AE1.tmp.exe
790c6356f71a379b8ae84a25d563b3b3	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\0007F80A_Rar\@AE1.tmp.exe
790c6356f71a379b8ae84a25d563b3b3	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\0007F819_Rar\@AE1.tmp.exe
790c6356f71a379b8ae84a25d563b3b3	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\0007F838_Rar\@AE1.tmp.exe
790c6356f71a379b8ae84a25d563b3b3	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\0007F848_Rar\@AE1.tmp.exe
790c6356f71a379b8ae84a25d563b3b3	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\0007F867_Rar\@AE1.tmp.exe
790c6356f71a379b8ae84a25d563b3b3	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\0007F8A6_Rar\@AE1.tmp.exe
790c6356f71a379b8ae84a25d563b3b3	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\0007F8E4_Rar\@AE1.tmp.exe
790c6356f71a379b8ae84a25d563b3b3	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\0007F913_Rar\@AE1.tmp.exe
790c6356f71a379b8ae84a25d563b3b3	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\0007F932_Rar\@AE1.tmp.exe
790c6356f71a379b8ae84a25d563b3b3	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\0007F952_Rar\@AE1.tmp.exe
790c6356f71a379b8ae84a25d563b3b3	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\0007F971_Rar\@AE1.tmp.exe
790c6356f71a379b8ae84a25d563b3b3	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\0007F990_Rar\@AE1.tmp.exe
790c6356f71a379b8ae84a25d563b3b3	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\0007F9BF_Rar\@AE1.tmp.exe
790c6356f71a379b8ae84a25d563b3b3	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\0007F9CF_Rar\@AE1.tmp.exe
790c6356f71a379b8ae84a25d563b3b3	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\0007F9FE_Rar\@AE1.tmp.exe
790c6356f71a379b8ae84a25d563b3b3	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\0007FA1D_Rar\@AE1.tmp.exe
790c6356f71a379b8ae84a25d563b3b3	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\0007FA2C_Rar\@AE1.tmp.exe
790c6356f71a379b8ae84a25d563b3b3	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\0007FA4C_Rar\@AE1.tmp.exe
790c6356f71a379b8ae84a25d563b3b3	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\0007FA6B_Rar\@AE1.tmp.exe
790c6356f71a379b8ae84a25d563b3b3	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\0007FA8A_Rar\@AE1.tmp.exe
790c6356f71a379b8ae84a25d563b3b3	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\0007FAC9_Rar\@AE1.tmp.exe
790c6356f71a379b8ae84a25d563b3b3	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\0007FAE8_Rar\@AE1.tmp.exe
790c6356f71a379b8ae84a25d563b3b3	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\0007FB17_Rar\@AE1.tmp.exe
790c6356f71a379b8ae84a25d563b3b3	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\0007FB36_Rar\@AE1.tmp.exe
790c6356f71a379b8ae84a25d563b3b3	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\0007FB75_Rar\@AE1.tmp.exe
790c6356f71a379b8ae84a25d563b3b3	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\0007FBC3_Rar\@AE1.tmp.exe
790c6356f71a379b8ae84a25d563b3b3	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\0007FBE2_Rar\@AE1.tmp.exe
790c6356f71a379b8ae84a25d563b3b3	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\0007FC20_Rar\@AE1.tmp.exe
790c6356f71a379b8ae84a25d563b3b3	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\0007FC7E_Rar\@AE1.tmp.exe
790c6356f71a379b8ae84a25d563b3b3	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\0007FCBD_Rar\@AE1.tmp.exe
790c6356f71a379b8ae84a25d563b3b3	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\0007FD0B_Rar\@AE1.tmp.exe
790c6356f71a379b8ae84a25d563b3b3	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\0007FD49_Rar\@AE1.tmp.exe
790c6356f71a379b8ae84a25d563b3b3	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\0007FD69_Rar\@AE1.tmp.exe
790c6356f71a379b8ae84a25d563b3b3	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\0007FD88_Rar\@AE1.tmp.exe
790c6356f71a379b8ae84a25d563b3b3	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\0007FDA7_Rar\@AE1.tmp.exe
790c6356f71a379b8ae84a25d563b3b3	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\0007FDE6_Rar\@AE1.tmp.exe
790c6356f71a379b8ae84a25d563b3b3	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\0007FE24_Rar\@AE1.tmp.exe
790c6356f71a379b8ae84a25d563b3b3	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\0007FE43_Rar\@AE1.tmp.exe
790c6356f71a379b8ae84a25d563b3b3	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\0007FE63_Rar\@AE1.tmp.exe
790c6356f71a379b8ae84a25d563b3b3	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\0007FEA1_Rar\@AE1.tmp.exe
790c6356f71a379b8ae84a25d563b3b3	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\0007FEE0_Rar\@AE1.tmp.exe
790c6356f71a379b8ae84a25d563b3b3	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\0007FF6C_Rar\@AE1.tmp.exe
790c6356f71a379b8ae84a25d563b3b3	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\0007FFAB_Rar\@AE1.tmp.exe
790c6356f71a379b8ae84a25d563b3b3	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\00080008_Rar\@AE1.tmp.exe
790c6356f71a379b8ae84a25d563b3b3	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\00080047_Rar\@AE1.tmp.exe
790c6356f71a379b8ae84a25d563b3b3	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\00080076_Rar\@AE1.tmp.exe
790c6356f71a379b8ae84a25d563b3b3	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\000800E3_Rar\@AE1.tmp.exe
790c6356f71a379b8ae84a25d563b3b3	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\00080112_Rar\@AE1.tmp.exe
790c6356f71a379b8ae84a25d563b3b3	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\00080141_Rar\@AE1.tmp.exe
790c6356f71a379b8ae84a25d563b3b3	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\0008023B_Rar\@AE1.tmp.exe
790c6356f71a379b8ae84a25d563b3b3	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\00080279_Rar\@AE1.tmp.exe
790c6356f71a379b8ae84a25d563b3b3	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\000802A8_Rar\@AE1.tmp.exe
790c6356f71a379b8ae84a25d563b3b3	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\000802C8_Rar\@AE1.tmp.exe
790c6356f71a379b8ae84a25d563b3b3	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\00080316_Rar\@AE1.tmp.exe
790c6356f71a379b8ae84a25d563b3b3	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\00080325_Rar\@AE1.tmp.exe
790c6356f71a379b8ae84a25d563b3b3	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\00080354_Rar\@AE1.tmp.exe
790c6356f71a379b8ae84a25d563b3b3	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\00080383_Rar\@AE1.tmp.exe
790c6356f71a379b8ae84a25d563b3b3	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\000803A2_Rar\@AE1.tmp.exe
790c6356f71a379b8ae84a25d563b3b3	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\000803C2_Rar\@AE1.tmp.exe
790c6356f71a379b8ae84a25d563b3b3	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\00080400_Rar\@AE1.tmp.exe
790c6356f71a379b8ae84a25d563b3b3	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\0008042F_Rar\@AE1.tmp.exe
790c6356f71a379b8ae84a25d563b3b3	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\0008044E_Rar\@AE1.tmp.exe
790c6356f71a379b8ae84a25d563b3b3	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\0008046D_Rar\@AE1.tmp.exe
790c6356f71a379b8ae84a25d563b3b3	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\0008047D_Rar\@AE1.tmp.exe
790c6356f71a379b8ae84a25d563b3b3	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\000804AC_Rar\@AE1.tmp.exe
790c6356f71a379b8ae84a25d563b3b3	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\000804CB_Rar\@AE1.tmp.exe
790c6356f71a379b8ae84a25d563b3b3	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\000804EA_Rar\@AE1.tmp.exe
790c6356f71a379b8ae84a25d563b3b3	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\0008050A_Rar\@AE1.tmp.exe
790c6356f71a379b8ae84a25d563b3b3	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\00080539_Rar\@AE1.tmp.exe
790c6356f71a379b8ae84a25d563b3b3	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\00080548_Rar\@AE1.tmp.exe
790c6356f71a379b8ae84a25d563b3b3	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\00080567_Rar\@AE1.tmp.exe
790c6356f71a379b8ae84a25d563b3b3	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\00080587_Rar\@AE1.tmp.exe
790c6356f71a379b8ae84a25d563b3b3	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\000805B6_Rar\@AE1.tmp.exe
790c6356f71a379b8ae84a25d563b3b3	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\000805D5_Rar\@AE1.tmp.exe
790c6356f71a379b8ae84a25d563b3b3	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\000805F4_Rar\@AE1.tmp.exe
790c6356f71a379b8ae84a25d563b3b3	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\00080613_Rar\@AE1.tmp.exe
790c6356f71a379b8ae84a25d563b3b3	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\00080633_Rar\@AE1.tmp.exe
790c6356f71a379b8ae84a25d563b3b3	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\00080652_Rar\@AE1.tmp.exe
790c6356f71a379b8ae84a25d563b3b3	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\00080671_Rar\@AE1.tmp.exe
790c6356f71a379b8ae84a25d563b3b3	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\00080690_Rar\@AE1.tmp.exe
790c6356f71a379b8ae84a25d563b3b3	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\000806B0_Rar\@AE1.tmp.exe
790c6356f71a379b8ae84a25d563b3b3	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\000806DE_Rar\@AE1.tmp.exe
790c6356f71a379b8ae84a25d563b3b3	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\000806FE_Rar\@AE1.tmp.exe
790c6356f71a379b8ae84a25d563b3b3	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\0008071D_Rar\@AE1.tmp.exe
790c6356f71a379b8ae84a25d563b3b3	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\0008072D_Rar\@AE1.tmp.exe
790c6356f71a379b8ae84a25d563b3b3	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\0008074C_Rar\@AE1.tmp.exe
790c6356f71a379b8ae84a25d563b3b3	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\0008076B_Rar\@AE1.tmp.exe
790c6356f71a379b8ae84a25d563b3b3	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\0008078A_Rar\@AE1.tmp.exe
790c6356f71a379b8ae84a25d563b3b3	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\000807AA_Rar\@AE1.tmp.exe
790c6356f71a379b8ae84a25d563b3b3	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\000807C9_Rar\@AE1.tmp.exe
790c6356f71a379b8ae84a25d563b3b3	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\000807E8_Rar\@AE1.tmp.exe
790c6356f71a379b8ae84a25d563b3b3	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\00080817_Rar\@AE1.tmp.exe
790c6356f71a379b8ae84a25d563b3b3	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\00080836_Rar\@AE1.tmp.exe
790c6356f71a379b8ae84a25d563b3b3	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\00080865_Rar\@AE1.tmp.exe
790c6356f71a379b8ae84a25d563b3b3	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\00080884_Rar\@AE1.tmp.exe
790c6356f71a379b8ae84a25d563b3b3	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\000808A4_Rar\@AE1.tmp.exe
790c6356f71a379b8ae84a25d563b3b3	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\000808C3_Rar\@AE1.tmp.exe
790c6356f71a379b8ae84a25d563b3b3	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\000808E2_Rar\@AE1.tmp.exe
790c6356f71a379b8ae84a25d563b3b3	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\000808F2_Rar\@AE1.tmp.exe
790c6356f71a379b8ae84a25d563b3b3	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\00080901_Rar\@AE1.tmp.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\0008142D_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\0008143C_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\0008146B_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\0008148A_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\0008149A_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\000814AA_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\000814B9_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\000814C9_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\000814E8_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\000814F8_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\00081507_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\00081517_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\00081546_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\00081565_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\00081594_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\000815B3_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\00081601_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\00081621_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\00081640_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\00081650_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\0008165F_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\0008166F_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\000816CD_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\000816FB_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\0008172A_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\00081769_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\00081798_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\000817D6_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\00081815_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\00081853_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\00081882_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\00081892_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\000818A1_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\000818C1_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\000818EF_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\0008190F_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\0008192E_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\0008196C_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\0008198C_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\000819AB_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\000819DA_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\000819F9_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\00081A28_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\00081A76_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\00081AB5_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\00081AE3_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\00081B12_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\00081B41_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\00081B60_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\00081B80_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\00081B8F_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\00081B9F_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\00081BBE_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\00081BCE_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\00081D06_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\00081D16_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\00081D26_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\00081D35_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\00081D54_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\00081D64_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\00081D74_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\00081D83_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\00081D93_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\00081DA3_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\00081DB2_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\00081E4E_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\00081E5E_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\00081E6E_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\00081E8D_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\00081E9D_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\00081EBC_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\00081ECB_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\00081EDB_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\00081EEB_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\00081EFA_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\00081F0A_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\00081F1A_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\00081FC5_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\00081FD5_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\00081FE5_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\00081FF4_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\00082014_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\00082023_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\00082033_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\00082042_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\00082052_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\00082062_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\00082071_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\0008210E_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\0008211D_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\0008212D_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\0008213C_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\0008214C_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\0008215C_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\0008217B_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\0008218B_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\000821AA_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\000821B9_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\000821C9_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\00082285_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\00082294_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\000822A4_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\000822C3_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\000822D3_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\000822E2_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\000822F2_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\00082302_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\00082311_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\00082321_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\00082330_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\00082340_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\000823FC_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\0008240B_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\0008241B_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\00082459_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\00082469_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\00082479_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\00082488_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\00082498_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\000824A7_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\00082515_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\00082524_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\00082544_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\000825FF_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\0008260F_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\0008266D_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\0008269B_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\000826BB_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\000826CA_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\00082709_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\00082718_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\00082728_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\00082747_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\00082803_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\00082822_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\00082841_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\00082861_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\0008289F_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\000828AF_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\000828CE_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\000828DE_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\0008290C_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\0008291C_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\0008293B_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\0008294B_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\00082A26_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\00082A35_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\00082A45_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\00082A64_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\00082A93_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\00082AB2_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\00082AD2_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\00082AE1_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\00082B20_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\00082B3F_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\00082B4F_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\00082B5E_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\00082BFA_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\00082C29_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\00082C39_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\00082C49_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\00082C58_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\00082C77_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\00082C87_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\00082C97_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\00082CD5_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\00082D62_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\00082DC0_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\00082DDF_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\00082DFE_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\00082E0E_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\00082E1D_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\00082E2D_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\00082E3D_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\00082E4C_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\00082E5C_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\00082E7B_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\00082E8B_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\00082F17_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\00082F27_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\00082F46_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\00082F56_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\00082F75_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\00082F85_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\00082F94_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\00082FB4_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\00082FC3_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\00082FD3_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\00082FF2_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\00083002_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\000830CD_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\000830DC_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\0008310B_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\0008311B_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\0008312B_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\0008313A_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\0008314A_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\00083159_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\00083179_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\00083188_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\00083198_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\000831A8_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\00083263_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\00083273_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\00083282_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\00083292_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\000832A2_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\000832C1_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\000832D0_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\000832E0_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\000832FF_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\0008330F_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\0008331F_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\0008333E_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\00083409_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\00083428_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\00083438_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\00083447_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\00083457_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\00083467_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\00083476_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\00083486_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\000834A5_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\000834B5_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\000834D4_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\000834E4_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\000835AF_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\000835BE_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\000835CE_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\000835ED_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\000835FD_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\0008361C_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\0008362C_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\0008364B_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\0008366A_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\0008367A_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\0008368A_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\00083707_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\00083726_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\00083745_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\00083755_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\00083774_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\00083784_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\000837E1_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\000837F1_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\00083810_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\00083820_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\0008382F_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\0008383F_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\0008385E_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\0008386E_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\0008387E_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\0008388D_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\000838AC_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\0008390A_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\00083978_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\00083987_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\000839A6_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\000839B6_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\000839C6_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\000839D5_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\000839F5_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\00083A04_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\00083A14_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\00083A33_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\00083A43_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\00083B3D_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\00083B5C_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\00083B7B_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\00083B8B_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\00083BAA_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\00083BBA_Rar\WdExt.exe
3fb2fbb07ad188aecc02144c37b362a7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\00083BC9_Rar\WdExt.exe
6bba9e183cc0212f741c4a43130225d0	c:\Documents and Settings\"%CurrentUserName%"\Start Menu\Programs\Startup\sql.cmd
6bba9e183cc0212f741c4a43130225d0	c:\Documents and Settings\"%CurrentUserName%"\Templates\O63746Z\TuxO63746Z.exe
6bba9e183cc0212f741c4a43130225d0	c:\Documents and Settings\"%CurrentUserName%"\Templates\O63746Z\service.exe
6bba9e183cc0212f741c4a43130225d0	c:\Documents and Settings\"%CurrentUserName%"\Templates\O63746Z\winlogon.exe
6bba9e183cc0212f741c4a43130225d0	c:\Perl\lib\auto\share\Blink 182 .exe
6bba9e183cc0212f741c4a43130225d0	c:\Perl\lib\auto\threads\shared\Data DosenKu .exe
6bba9e183cc0212f741c4a43130225d0	c:\Program Files\Common Files\Microsoft Shared\Titip Folder Jangan DiHapus .exe
6bba9e183cc0212f741c4a43130225d0	c:\Program Files\Movie Maker\Shared\Gallery .scr
6bba9e183cc0212f741c4a43130225d0	c:\WINDOWS\Downloaded Program Files\THe Best Ungu .scr
6bba9e183cc0212f741c4a43130225d0	c:\WINDOWS\M35838\EmangEloh.exe
6bba9e183cc0212f741c4a43130225d0	c:\WINDOWS\M35838\Ja856821bLay.com
6bba9e183cc0212f741c4a43130225d0	c:\WINDOWS\M35838\smss.exe
6bba9e183cc0212f741c4a43130225d0	c:\WINDOWS\SoftwareDistribution\Download\TutoriaL HAcking .exe
6bba9e183cc0212f741c4a43130225d0	c:\WINDOWS\Ti645063ta.exe
6bba9e183cc0212f741c4a43130225d0	c:\WINDOWS\ime\shared\Blink 182 .exe
6bba9e183cc0212f741c4a43130225d0	c:\WINDOWS\pchealth\UploadLB\Gallery .scr
6bba9e183cc0212f741c4a43130225d0	c:\WINDOWS\sa-755287.exe
6bba9e183cc0212f741c4a43130225d0	c:\WINDOWS\system32\127387645063l.exe
6bba9e183cc0212f741c4a43130225d0	c:\WINDOWS\system32\X51334go\Z127387cie.cmd
78d3c8705f8baf7d34e6a6737d1cfa18	c:\WINDOWS\system32\mscaps.exe
978888892a1ed13e94d2fcb832a2a6b5	c:\WINDOWS\system32\wtime32.dll
64b33cc5bf131def2721394cf9b3f8ed	c:\WINDOWS\system\msvbvm60.dll
a08fecd7705529a07032346ab85a5521	c:\tmlslf.pif

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

A worm can spread via removable drives. It writes its executable and creates "autorun.inf" scripts on all removable drives. The autorun script will execute the Trojan's file once a user opens a drive's folder in Windows Explorer.

Removals

Remove it with Ad-Aware

Click (here) to download and install Ad-Aware Free Antivirus.
Update the definition files.
Run a full scan of your computer.

Manual removal*

Terminate malicious process(es) (How to End a Process With the Task Manager):
%original file name%.exe:1232
wtmps.exe:2908
mscaps.exe:2960
@AE1.tmp.exe:1632
launch.exe:2824
WdExt.exe:2284
Delete the original Trojan file.
Delete or disinfect the following files created/modified by the Trojan:
%Documents and Settings%\%current user%\Templates\O63746Z\winlogon.exe (1281 bytes)
%Documents and Settings%\%current user%\Start Menu\Programs\Startup\sql.cmd (1281 bytes)
%Documents and Settings%\%current user%\Templates\O63746Z\service.exe (1281 bytes)
%WinDir%\Ti645063ta.exe (1281 bytes)
%System%\X51334go\Z127387cie.cmd (1281 bytes)
%WinDir%\M35838\smss.exe (1281 bytes)
%WinDir%\M35838\Ja856821bLay.com (1281 bytes)
%System%\127387645063l.exe (1281 bytes)
%WinDir%\sa-755287.exe (1281 bytes)
%WinDir%\M35838\EmangEloh.exe (1281 bytes)
%WinDir%\system\msvbvm60.dll (8657 bytes)
%Documents and Settings%\%current user%\Templates\O63746Z\TuxO63746Z.exe (1281 bytes)
%System%\mscaps.exe (27349 bytes)
%System%\wtime32.dll (29045 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\E.tmp (406 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000808E2_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00080901_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0007FF6C_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000804EA_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000805D5_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0007FD69_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00080008_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00080400_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0007FA6B_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\Messenger\Extension\WdExt.exe (244510 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0008050A_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00080047_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0007F673_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0008074C_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0007FEA1_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0007F700_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0007F8A6_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0007F599_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0007F6B2_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Sp3.tmp (1304 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0007F932_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0007FB36_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000808C3_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0007F952_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00080884_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000806FE_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0007F7DB_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0007FD0B_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0007F7BB_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000802C8_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00080613_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0008044E_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0007F9BF_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0007F625_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00080671_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00080354_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\buxql.exe (561 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00080539_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000807AA_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000804CB_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0007F73E_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0007FCBD_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0007F80A_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00080690_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00080279_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0007FEE0_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0007FA1D_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00080325_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0007FBE2_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000807C9_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00080112_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0007FE63_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00080141_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0007F9CF_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0007F616_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0007F9FE_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0007F971_Rar\@AE1.tmp.exe (13122 bytes)
%WinDir%\system.ini (68 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000806DE_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000800E3_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0007FDE6_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0008047D_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0007F79C_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0007FDA7_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00080076_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00080316_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0007F819_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0007F8E4_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000807E8_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000804AC_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0008042F_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000803A2_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0007F4ED_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0007FD49_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0007FBC3_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00080567_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0007FC7E_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00080383_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\desktop.ini (159 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000808A4_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0007F848_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0007FFAB_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0008072D_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0007F654_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0008046D_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\tmp2.tmp (459254 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000808F2_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Application Data\Temp\mydll.dll (12549 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00080652_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000805B6_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\tmp5.tmp (907 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0007FA8A_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000803C2_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0007FA4C_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0007FAC9_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Se4.tmp (1792 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0007FD88_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0007F5F6_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0007F78D_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0008071D_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0007FC20_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0007F913_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0007F838_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00080548_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0007F867_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0007FB17_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0007F6D1_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Application Data\Temp\adm1.bat (196 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0007F990_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0007FAE8_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0007F4CD_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0007F7EA_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0007F644_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00080817_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0007F54A_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00080587_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0007F693_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0007F664_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0007FB75_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00080836_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000802A8_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0007FE43_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0007FE24_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0007FA2C_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000806B0_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000805F4_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00080865_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0008023B_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00080633_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0008076B_Rar\@AE1.tmp.exe (13122 bytes)
%Documents and Settings%\%current user%\Application Data\Temp\adm0.bat (159 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0008078A_Rar\@AE1.tmp.exe (13122 bytes)
%WinDir%\pchealth\UploadLB\Gallery .scr (305 bytes)
%WinDir%\SoftwareDistribution\Download\TutoriaL HAcking .exe (305 bytes)
%WinDir%\ime\shared\Blink 182 .exe (305 bytes)
%Documents and Settings%\%current user%\Application Data\Macromedia\Flash Player\#SharedObjects\Titip Folder Jangan DiHapus .exe (305 bytes)
%WinDir%\[TheMoonlight].txt (109 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\Network\Downloader\RaHasIA .exe (305 bytes)
%Program Files%\Movie Maker\Shared\Gallery .scr (305 bytes)
%WinDir%\Downloaded Program Files\THe Best Ungu .scr (305 bytes)
%Program Files%\Common Files\Microsoft Shared\Titip Folder Jangan DiHapus .exe (305 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0008289F_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00082C97_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00083820_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00082F27_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00082F56_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00082FF2_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000818C1_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00082E2D_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000839D5_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000819AB_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0008210E_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00082F17_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000817D6_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0008368A_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00082294_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00081D54_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00083A33_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00083273_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000834B5_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000826CA_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00081892_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0008192E_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00081546_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000839B6_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00082071_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00083745_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00081E9D_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00082DDF_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00083978_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000835CE_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000839A6_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00082052_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00082C87_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00082285_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00083B8B_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00081DB2_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\Windows\Addins\att.dll (18829 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00082A64_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00083BBA_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0008290C_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\tmpD.tmp (55476 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0008314A_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00081D16_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00081FD5_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00082FC3_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00082042_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00082C77_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000832C1_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00081601_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000835AF_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\Shared\Modules\fil.dll (10805 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0008382F_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0008331F_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000816FB_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00081BCE_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00082459_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00081E8D_Rar\WdExt.exe (26244 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00081FC5_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\Repairs\sha.dll (7589 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00082B4F_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0008260F_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00082803_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00081BBE_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00083A43_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00081815_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0008293B_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0008148A_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0008266D_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000832FF_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00083BAA_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00081E5E_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00082544_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000834E4_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00081EFA_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00083774_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00082841_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0008146B_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00082747_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\tmp7.tmp (48916 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0008213C_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0008312B_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00082E1D_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00082524_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000835BE_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00081FF4_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00081B80_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00083784_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0008142D_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00081D83_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00082C29_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000821AA_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000819DA_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00082822_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00082E8B_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00081B12_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00083BC9_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00082515_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00083707_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\tmpB.tmp (21164 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000821C9_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00082479_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0008149A_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0008240B_Rar\WdExt.exe (26244 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00082023_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000834D4_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0008383F_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000823FC_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000830DC_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0008217B_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000822C3_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00081AB5_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00082A45_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000839C6_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\tmp9.tmp (28924 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00083179_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000818A1_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00082330_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00083447_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00081640_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000815B3_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0008165F_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00082E5C_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00081D74_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00081882_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000826BB_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000825FF_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00082F85_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00081A76_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0008361C_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00083A14_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0008330F_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0008196C_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00082DFE_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00082FB4_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00081EEB_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00082F46_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00081ECB_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0008214C_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\tmpC.tmp (36444 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00083810_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00082A93_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\Defender\launch.exe (18077 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000814AA_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00083726_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00082C58_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00081D06_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\wtmps.exe (31581 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00081B8F_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00081AE3_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00082CD5_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00082B3F_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00082062_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00081F1A_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0008241B_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00081B9F_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00081517_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00083438_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00082488_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00083409_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00083428_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00083457_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00081A28_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00081565_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0008190F_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000839F5_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00082B5E_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0008198C_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00083188_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00081D26_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00082B20_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0008387E_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00082E4C_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000831A8_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00082BFA_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000818EF_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000819F9_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00082E3D_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000832E0_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00082DC0_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00083159_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00083282_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000837E1_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00083476_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00081FE5_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000824A7_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00081E6E_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00081798_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0008143C_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000822E2_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00081B41_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00081B60_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00083292_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00081594_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00082D62_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00082469_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00081F0A_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00082AB2_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000832D0_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00082709_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00082728_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0008333E_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0008269B_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00083987_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0008294B_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00083002_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00082AE1_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000835FD_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00081E4E_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0008388D_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00081D35_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0008366A_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000828CE_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0008367A_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\tmp8.tmp (26548 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\Identities\"%CurrentUserName%"\arc.dll (96316 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00082861_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00083B7B_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00082718_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00081769_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0008310B_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00082033_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0008385E_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\Common\Shared\dis.dll (10077 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00081DA3_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000830CD_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00082E0E_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000814F8_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00082C49_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00082FD3_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0008364B_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000832A2_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000822D3_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00082A35_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00081507_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0008172A_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00082AD2_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00083467_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00081853_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00081D93_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00082498_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00082E7B_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00082302_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00082C39_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0008386E_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000822A4_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000822F2_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0008218B_Rar\WdExt.exe (26244 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0008311B_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000816CD_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0008215C_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0008362C_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000835ED_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00083A04_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00083B5C_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00081621_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\Caches\Files\usd.dll (7933 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0008166F_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00081EDB_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000828DE_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00083B3D_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00082A26_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00081650_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00082014_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00083755_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00083263_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0008390A_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000814C9_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00082321_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\tmpA.tmp (18508 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000821B9_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00081EBC_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00082F94_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000838AC_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0008313A_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00083198_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00082311_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0008212D_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00081D64_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00083486_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000814E8_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0008291C_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00082340_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000814B9_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0008211D_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000828AF_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000834A5_Rar\WdExt.exe (26244 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00082F75_Rar\WdExt.exe (13122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000837F1_Rar\WdExt.exe (13122 bytes)
Delete the following value(s) in the autorun key (How to Work with System Registry):
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"T46Z273" = "%WinDir%\sa-755287.exe"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"T1358287TT4" = "%System%\127387645063l.exe"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender Extension" = "%Documents and Settings%\%current user%\Application Data\Microsoft\Defender\launch.exe"
Remove the references to the Trojan by modifying the following registry value(s) (How to Work with System Registry):
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"UserInit" = "%System%\userinit.exe , %WinDir%\M35838\Ja856821bLay.com"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"Shell" = "explorer.exe, %Documents and Settings%\%current user%\Templates\O63746Z\TuxO63746Z.exe"
Find and delete all copies of the worm's file together with "autorun.inf" scripts on removable drives.
Reboot the computer.

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

VersionInfo

No information is available.

No information is available.

PE Sections

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Section MD5
.text	4096	2108	2560	3.76997	6dbb11cce72cc16b887018dd4c34d252
.rdata	8192	1478	1536	3.36814	838666d924e8b6e9dfc84f930bd16733
.data	12288	86016	512	0.377955	7d6dcdf3bcb22dca4957ddb77c1c8cbf
.rsrc	98304	188416	188416	4.00891	2b7c687262025c29b9cf4de80bca2c0d

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Network Activity

URLs

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

Map

The Trojan connects to the servers at the folowing location(s):

Strings from Dumps

service.exe_1496:

.text

.text

`.rsrc

`.rsrc

keylog

keylog

shell32.dll

shell32.dll

ShellExecuteA

ShellExecuteA

RasApi32.dll

RasApi32.dll

wininet.dll

wininet.dll

InternetOpenUrlA

InternetOpenUrlA

advapi32.dll

advapi32.dll

GetWindowsDirectoryA

GetWindowsDirectoryA

user32.dll

user32.dll

EnumWindows

EnumWindows

VBA6.DLL

VBA6.DLL

RegCloseKey

RegCloseKey

RegCreateKeyA

RegCreateKeyA

RegDeleteKeyA

RegDeleteKeyA

RegOpenKeyA

RegOpenKeyA

RegOpenKeyExA

RegOpenKeyExA

%Program Files%\Microsoft Visual Studio\VB98\VB6.OLB

%Program Files%\Microsoft Visual Studio\VB98\VB6.OLB

OpenUrl

OpenUrl

GetKeyState

GetKeyState

GetAsyncKeyState

GetAsyncKeyState

Kernel32.dll

Kernel32.dll

MSVBVM60.DLL

MSVBVM60.DLL

kernel32.dll

kernel32.dll

%sy5|l

%sy5|l

SSSSSh

SSSSSh

{6S%X

{6S%X

^.NrL

^.NrL

I.Mh|

I.Mh|

SHELL32.DLL

SHELL32.DLL

KERNEL32.DLL

KERNEL32.DLL

service.exe

service.exe

.rsrc

.rsrc

%Documents and Settings%\%current user%\Templates\O63746Z\service.exe

%Documents and Settings%\%current user%\Templates\O63746Z\service.exe

hXXp://padrup.com/sobaka1.gif

hXXp://padrup.com/sobaka1.gif

hXXp://190.120.227.91:8080/sobakavolos.gif

hXXp://190.120.227.91:8080/sobakavolos.gif

hXXp://89.11

hXXp://89.11

.info/home.gifIh

.info/home.gifIh

bW.text

bW.text

JKERNEL32.dll

JKERNEL32.dll

%x.exe

%x.exe

h.rdla&

h.rdla&

mH.MN8

mH.MN8

T4.At%

T4.At%

S.twa

S.twa

.klkjw:9fqwiBumW

.klkjw:9fqwiBumW

.sysa

.sysa

Zc.pBTa

Zc.pBTa

~%s:*:yd:

~%s:*:yd:

.!.VF*

.!.VF*

.d&?%x=

.d&?%x=

GUrlA'

GUrlA'

"\'Web%w}

"\'Web%w}

HTTP)s'PS

HTTP)s'PS

2GUARDCMD

2GUARDCMD

o.ENHCDM

o.ENHCDM

wWEBWUPD

wWEBWUPD

MM.PF

MM.PF

%xn'[

%xn'[

>>?456789:;

>>?456789:;

!"#$%&'()* ,-./4

!"#$%&'()* ,-./4

qn%CXf

qn%CXf

UP*dB.PPd@.

UP*dB.PPd@.

%FoAN-x

%FoAN-x

Ã„EW

Ã„EW

%F" *" a

%F" *" a

ADVAPI32.dll

ADVAPI32.dll

MSVCRT.dll

MSVCRT.dll

SHELL32.dll

SHELL32.dll

USER32.dll

USER32.dll

WS2_32.dll

WS2_32.dll

SHFileOperationA

SHFileOperationA

%sgkU

%sgkU

ei.sEI

ei.sEI

*\AD:\DataHellSpawn\WARING_VIRII_LABORATORY\Virus Ku\Moonlight.b\Project1.vbp

*\AD:\DataHellSpawn\WARING_VIRII_LABORATORY\Virus Ku\Moonlight.b\Project1.vbp

winlogon.exe

winlogon.exe

suport

suport

login

login

ZIPPED.zip

ZIPPED.zip

FILEATTACH.bz2

FILEATTACH.bz2

Doc.gz

Doc.gz

SMTP Server

SMTP Server

SMTP Email Address

SMTP Email Address

smtp.

smtp.

curriculum vittae.zip

curriculum vittae.zip

USE_RAR_To_Extract.ace

USE_RAR_To_Extract.ace

file.bz2

file.bz2

thisfile.gz

thisfile.gz

TITTA'S Picture.jar

TITTA'S Picture.jar

free screen saver romance for you
Please Visit Our Web Site hXXp://VVV.moonLight.com

free screen saver romance for you
Please Visit Our Web Site hXXp://VVV.moonLight.com

aku mahasiswa Bsi Margonda smt 3

aku mahasiswa Bsi Margonda smt 3

12050075

12050075

password lampiran 55132098

password lampiran 55132098

\regsvr32.exe

\regsvr32.exe

\twain32.dll

\twain32.dll

For security reasons attached file is password protected.
The password is 55132098

For security reasons attached file is password protected.
The password is 55132098

OSSMTP.SMTPSession

OSSMTP.SMTPSession

*.html

*.html

TutoriaL HAcking .exe

TutoriaL HAcking .exe

Lagu - Server .scr

Lagu - Server .scr

Data DosenKu .exe

Data DosenKu .exe

Titip Folder Jangan DiHapus .exe

Titip Folder Jangan DiHapus .exe

Love Song .scr

Love Song .scr

New mp3 BaraT !! .exe

New mp3 BaraT !! .exe

THe Best Ungu .scr

THe Best Ungu .scr

Blink 182 .exe

Blink 182 .exe

Norman virus Control 5.18 .exe

Norman virus Control 5.18 .exe

Windows Vista setup .scr

Windows Vista setup .scr

Gallery .scr

Gallery .scr

RaHasIA .exe

RaHasIA .exe

smss.exe

smss.exe

EmangEloh.exe

EmangEloh.exe

\msvbvm60.dll

\msvbvm60.dll

\system\msvbvm60.dll

\system\msvbvm60.dll

\service.exe

\service.exe

\smss.exe

\smss.exe

\EmangEloh.exe

\EmangEloh.exe

\winlogon.exe

\winlogon.exe

cie.cmd

cie.cmd

ta.exe

ta.exe

bLay.com

bLay.com

l.exe

l.exe

\sql.cmd

\sql.cmd

Software\Microsoft\Windows\CurrentVersion

Software\Microsoft\Windows\CurrentVersion

SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon

SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon

explorer.exe,

explorer.exe,

\userinit.exe ,

\userinit.exe ,

SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders

SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders

msconfig.exe

msconfig.exe

SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\

SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\

\notepad.exe

\notepad.exe

regedit.exe

regedit.exe

Software\Microsoft\Windows\CurrentVersion\run

Software\Microsoft\Windows\CurrentVersion\run

\*.pif

\*.pif

*.htm

*.htm

hXXp://VVV.geocities.com/m00nL19ht2006/

hXXp://VVV.geocities.com/m00nL19ht2006/

\MYpIC.zip

\MYpIC.zip

zipfile.txt

zipfile.txt

dll.txt

dll.txt

payload.txt

payload.txt

\payload.vbs

\payload.vbs

update1.txt

update1.txt

\untk.com

\untk.com

hXXp://VVV.apasajalah.host.sk/testms.php?mod=save&bkd=0&klog=

hXXp://VVV.apasajalah.host.sk/testms.php?mod=save&bkd=0&klog=

\[TheMoonlight].txt

\[TheMoonlight].txt

@*\AD:\DataHellSpawn\WARING_VIRII_LABORATORY\Virus Ku\Moonlight.b\Project1.vbp

@*\AD:\DataHellSpawn\WARING_VIRII_LABORATORY\Virus Ku\Moonlight.b\Project1.vbp

Moonlight.exe

Moonlight.exe

service.exe_1496_rwx_00350000_00002000:

The procedure %s could not be located in the DLL %s.

The procedure %s could not be located in the DLL %s.

The ordinal %d could not be located in the DLL %s.

The ordinal %d could not be located in the DLL %s.

service.exe_1496_rwx_00401000_00017000:

keylog

keylog

shell32.dll

shell32.dll

ShellExecuteA

ShellExecuteA

RasApi32.dll

RasApi32.dll

wininet.dll

wininet.dll

InternetOpenUrlA

InternetOpenUrlA

advapi32.dll

advapi32.dll

GetWindowsDirectoryA

GetWindowsDirectoryA

user32.dll

user32.dll

EnumWindows

EnumWindows

VBA6.DLL

VBA6.DLL

RegCloseKey

RegCloseKey

RegCreateKeyA

RegCreateKeyA

RegDeleteKeyA

RegDeleteKeyA

RegOpenKeyA

RegOpenKeyA

RegOpenKeyExA

RegOpenKeyExA

%Program Files%\Microsoft Visual Studio\VB98\VB6.OLB

%Program Files%\Microsoft Visual Studio\VB98\VB6.OLB

OpenUrl

OpenUrl

GetKeyState

GetKeyState

GetAsyncKeyState

GetAsyncKeyState

Kernel32.dll

Kernel32.dll

MSVBVM60.DLL

MSVBVM60.DLL

*\AD:\DataHellSpawn\WARING_VIRII_LABORATORY\Virus Ku\Moonlight.b\Project1.vbp

*\AD:\DataHellSpawn\WARING_VIRII_LABORATORY\Virus Ku\Moonlight.b\Project1.vbp

winlogon.exe

winlogon.exe

suport

suport

login

login

ZIPPED.zip

ZIPPED.zip

FILEATTACH.bz2

FILEATTACH.bz2

Doc.gz

Doc.gz

SMTP Server

SMTP Server

SMTP Email Address

SMTP Email Address

smtp.

smtp.

curriculum vittae.zip

curriculum vittae.zip

USE_RAR_To_Extract.ace

USE_RAR_To_Extract.ace

file.bz2

file.bz2

thisfile.gz

thisfile.gz

TITTA'S Picture.jar

TITTA'S Picture.jar

free screen saver romance for you
Please Visit Our Web Site hXXp://VVV.moonLight.com

free screen saver romance for you
Please Visit Our Web Site hXXp://VVV.moonLight.com

aku mahasiswa Bsi Margonda smt 3

aku mahasiswa Bsi Margonda smt 3

12050075

12050075

password lampiran 55132098

password lampiran 55132098

\regsvr32.exe

\regsvr32.exe

\twain32.dll

\twain32.dll

For security reasons attached file is password protected.
The password is 55132098

For security reasons attached file is password protected.
The password is 55132098

OSSMTP.SMTPSession

OSSMTP.SMTPSession

*.html

*.html

TutoriaL HAcking .exe

TutoriaL HAcking .exe

Lagu - Server .scr

Lagu - Server .scr

Data DosenKu .exe

Data DosenKu .exe

Titip Folder Jangan DiHapus .exe

Titip Folder Jangan DiHapus .exe

Love Song .scr

Love Song .scr

New mp3 BaraT !! .exe

New mp3 BaraT !! .exe

THe Best Ungu .scr

THe Best Ungu .scr

Blink 182 .exe

Blink 182 .exe

Norman virus Control 5.18 .exe

Norman virus Control 5.18 .exe

Windows Vista setup .scr

Windows Vista setup .scr

Gallery .scr

Gallery .scr

RaHasIA .exe

RaHasIA .exe

service.exe

service.exe

smss.exe

smss.exe

EmangEloh.exe

EmangEloh.exe

\msvbvm60.dll

\msvbvm60.dll

\system\msvbvm60.dll

\system\msvbvm60.dll

\service.exe

\service.exe

\smss.exe

\smss.exe

\EmangEloh.exe

\EmangEloh.exe

\winlogon.exe

\winlogon.exe

cie.cmd

cie.cmd

ta.exe

ta.exe

bLay.com

bLay.com

l.exe

l.exe

\sql.cmd

\sql.cmd

Software\Microsoft\Windows\CurrentVersion

Software\Microsoft\Windows\CurrentVersion

SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon

SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon

explorer.exe,

explorer.exe,

\userinit.exe ,

\userinit.exe ,

SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders

SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders

msconfig.exe

msconfig.exe

SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\

SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\

\notepad.exe

\notepad.exe

regedit.exe

regedit.exe

Software\Microsoft\Windows\CurrentVersion\run

Software\Microsoft\Windows\CurrentVersion\run

\*.pif

\*.pif

*.htm

*.htm

hXXp://VVV.geocities.com/m00nL19ht2006/

hXXp://VVV.geocities.com/m00nL19ht2006/

\MYpIC.zip

\MYpIC.zip

zipfile.txt

zipfile.txt

dll.txt

dll.txt

payload.txt

payload.txt

\payload.vbs

\payload.vbs

update1.txt

update1.txt

\untk.com

\untk.com

hXXp://VVV.apasajalah.host.sk/testms.php?mod=save&bkd=0&klog=

hXXp://VVV.apasajalah.host.sk/testms.php?mod=save&bkd=0&klog=

\[TheMoonlight].txt

\[TheMoonlight].txt

@*\AD:\DataHellSpawn\WARING_VIRII_LABORATORY\Virus Ku\Moonlight.b\Project1.vbp

@*\AD:\DataHellSpawn\WARING_VIRII_LABORATORY\Virus Ku\Moonlight.b\Project1.vbp

Moonlight.exe

Moonlight.exe

service.exe_1496_rwx_0041A000_00005000:

kernel32.dll

kernel32.dll

%sy5|l

%sy5|l

SSSSSh

SSSSSh

{6S%X

{6S%X

service.exe_1496_rwx_0042B000_00004000:

^.NrL

^.NrL

service.exe_1496_rwx_00435000_0000F000:

SHELL32.DLL

SHELL32.DLL

ShellExecuteA

ShellExecuteA

KERNEL32.DLL

KERNEL32.DLL

service.exe

service.exe

.rsrc

.rsrc

%Documents and Settings%\%current user%\Templates\O63746Z\service.exe

%Documents and Settings%\%current user%\Templates\O63746Z\service.exe

hXXp://padrup.com/sobaka1.gif

hXXp://padrup.com/sobaka1.gif

hXXp://190.120.227.91:8080/sobakavolos.gif

hXXp://190.120.227.91:8080/sobakavolos.gif

hXXp://89.11

hXXp://89.11

.info/home.gifIh

.info/home.gifIh

bW.text

bW.text

JKERNEL32.dll

JKERNEL32.dll

%x.exe

%x.exe

h.rdla&

h.rdla&

mH.MN8

mH.MN8

T4.At%

T4.At%

S.twa

S.twa

.klkjw:9fqwiBumW

.klkjw:9fqwiBumW

.sysa

.sysa

Zc.pBTa

Zc.pBTa

~%s:*:yd:

~%s:*:yd:

.!.VF*

.!.VF*

.d&?%x=

.d&?%x=

GUrlA'

GUrlA'

"\'Web%w}

"\'Web%w}

HTTP)s'PS

HTTP)s'PS

2GUARDCMD

2GUARDCMD

o.ENHCDM

o.ENHCDM

wWEBWUPD

wWEBWUPD

MM.PF

MM.PF

%xn'[

%xn'[

>>?456789:;

>>?456789:;

!"#$%&'()* ,-./4

!"#$%&'()* ,-./4

qn%CXf

qn%CXf

UP*dB.PPd@.

UP*dB.PPd@.

%FoAN-x

%FoAN-x

Ã„EW

Ã„EW

%F" *" a

%F" *" a

ADVAPI32.dll

ADVAPI32.dll

MSVCRT.dll

MSVCRT.dll

SHELL32.dll

SHELL32.dll

USER32.dll

USER32.dll

WS2_32.dll

WS2_32.dll

RegCloseKey

RegCloseKey

SHFileOperationA

SHFileOperationA

service.exe_1496_rwx_00F70000_00002000:

SHELL32.DLL

SHELL32.DLL

ShellExecuteA

ShellExecuteA

KERNEL32.DLL

KERNEL32.DLL

.rsrc

.rsrc

.text

.text

service.exe_1496_rwx_00F80000_00001000:

|service.exeM_1496_

|service.exeM_1496_

EmangEloh.exe_1324:

.text

.text

`.rsrc

`.rsrc

keylog

keylog

shell32.dll

shell32.dll

ShellExecuteA

ShellExecuteA

RasApi32.dll

RasApi32.dll

wininet.dll

wininet.dll

InternetOpenUrlA

InternetOpenUrlA

advapi32.dll

advapi32.dll

GetWindowsDirectoryA

GetWindowsDirectoryA

user32.dll

user32.dll

EnumWindows

EnumWindows

VBA6.DLL

VBA6.DLL

RegCloseKey

RegCloseKey

RegCreateKeyA

RegCreateKeyA

RegDeleteKeyA

RegDeleteKeyA

RegOpenKeyA

RegOpenKeyA

RegOpenKeyExA

RegOpenKeyExA

%Program Files%\Microsoft Visual Studio\VB98\VB6.OLB

%Program Files%\Microsoft Visual Studio\VB98\VB6.OLB

OpenUrl

OpenUrl

GetKeyState

GetKeyState

GetAsyncKeyState

GetAsyncKeyState

Kernel32.dll

Kernel32.dll

MSVBVM60.DLL

MSVBVM60.DLL

kernel32.dll

kernel32.dll

%sy5|l

%sy5|l

SSSSSh

SSSSSh

{6S%X

{6S%X

^.NrL

^.NrL

I.Mh|

I.Mh|

SHELL32.DLL

SHELL32.DLL

KERNEL32.DLL

KERNEL32.DLL

EmangEloh.exe

EmangEloh.exe

.rsrc

.rsrc

%WinDir%\M35838\EmangEloh.exe

%WinDir%\M35838\EmangEloh.exe

hXXp://padrup.com/sobaka1.gif

hXXp://padrup.com/sobaka1.gif

hXXp://190.120.227.91:8080/sobakavolos.gif

hXXp://190.120.227.91:8080/sobakavolos.gif

hXXp://89.11

hXXp://89.11

.info/home.gifIh

.info/home.gifIh

bW.text

bW.text

JKERNEL32.dll

JKERNEL32.dll

%x.exe

%x.exe

h.rdla&

h.rdla&

mH.MN8

mH.MN8

T4.At%

T4.At%

S.twa

S.twa

.klkjw:9fqwiBumW

.klkjw:9fqwiBumW

.sysa

.sysa

Zc.pBTa

Zc.pBTa

~%s:*:yd:

~%s:*:yd:

.!.VF*

.!.VF*

.d&?%x=

.d&?%x=

GUrlA'

GUrlA'

"\'Web%w}

"\'Web%w}

HTTP)s'PS

HTTP)s'PS

2GUARDCMD

2GUARDCMD

o.ENHCDM

o.ENHCDM

wWEBWUPD

wWEBWUPD

MM.PF

MM.PF

%xn'[

%xn'[

>>?456789:;

>>?456789:;

!"#$%&'()* ,-./4

!"#$%&'()* ,-./4

qn%CXf

qn%CXf

UP*dB.PPd@.

UP*dB.PPd@.

%FoAN-x

%FoAN-x

Ã„EW

Ã„EW

%F" *" a

%F" *" a

ADVAPI32.dll

ADVAPI32.dll

MSVCRT.dll

MSVCRT.dll

SHELL32.dll

SHELL32.dll

USER32.dll

USER32.dll

WS2_32.dll

WS2_32.dll

SHFileOperationA

SHFileOperationA

%sgkU

%sgkU

ei.sEI

ei.sEI

*\AD:\DataHellSpawn\WARING_VIRII_LABORATORY\Virus Ku\Moonlight.b\Project1.vbp

*\AD:\DataHellSpawn\WARING_VIRII_LABORATORY\Virus Ku\Moonlight.b\Project1.vbp

winlogon.exe

winlogon.exe

suport

suport

login

login

ZIPPED.zip

ZIPPED.zip

FILEATTACH.bz2

FILEATTACH.bz2

Doc.gz

Doc.gz

SMTP Server

SMTP Server

SMTP Email Address

SMTP Email Address

smtp.

smtp.

curriculum vittae.zip

curriculum vittae.zip

USE_RAR_To_Extract.ace

USE_RAR_To_Extract.ace

file.bz2

file.bz2

thisfile.gz

thisfile.gz

TITTA'S Picture.jar

TITTA'S Picture.jar

free screen saver romance for you
Please Visit Our Web Site hXXp://VVV.moonLight.com

free screen saver romance for you
Please Visit Our Web Site hXXp://VVV.moonLight.com

aku mahasiswa Bsi Margonda smt 3

aku mahasiswa Bsi Margonda smt 3

12050075

12050075

password lampiran 55132098

password lampiran 55132098

\regsvr32.exe

\regsvr32.exe

\twain32.dll

\twain32.dll

For security reasons attached file is password protected.
The password is 55132098

For security reasons attached file is password protected.
The password is 55132098

OSSMTP.SMTPSession

OSSMTP.SMTPSession

*.html

*.html

TutoriaL HAcking .exe

TutoriaL HAcking .exe

Lagu - Server .scr

Lagu - Server .scr

Data DosenKu .exe

Data DosenKu .exe

Titip Folder Jangan DiHapus .exe

Titip Folder Jangan DiHapus .exe

Love Song .scr

Love Song .scr

New mp3 BaraT !! .exe

New mp3 BaraT !! .exe

THe Best Ungu .scr

THe Best Ungu .scr

Blink 182 .exe

Blink 182 .exe

Norman virus Control 5.18 .exe

Norman virus Control 5.18 .exe

Windows Vista setup .scr

Windows Vista setup .scr

Gallery .scr

Gallery .scr

RaHasIA .exe

RaHasIA .exe

service.exe

service.exe

smss.exe

smss.exe

\msvbvm60.dll

\msvbvm60.dll

\system\msvbvm60.dll

\system\msvbvm60.dll

\service.exe

\service.exe

\smss.exe

\smss.exe

\EmangEloh.exe

\EmangEloh.exe

\winlogon.exe

\winlogon.exe

cie.cmd

cie.cmd

ta.exe

ta.exe

bLay.com

bLay.com

l.exe

l.exe

\sql.cmd

\sql.cmd

Software\Microsoft\Windows\CurrentVersion

Software\Microsoft\Windows\CurrentVersion

SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon

SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon

explorer.exe,

explorer.exe,

\userinit.exe ,

\userinit.exe ,

SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders

SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders

msconfig.exe

msconfig.exe

SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\

SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\

\notepad.exe

\notepad.exe

regedit.exe

regedit.exe

Software\Microsoft\Windows\CurrentVersion\run

Software\Microsoft\Windows\CurrentVersion\run

\*.pif

\*.pif

*.htm

*.htm

hXXp://VVV.geocities.com/m00nL19ht2006/

hXXp://VVV.geocities.com/m00nL19ht2006/

\MYpIC.zip

\MYpIC.zip

zipfile.txt

zipfile.txt

dll.txt

dll.txt

payload.txt

payload.txt

\payload.vbs

\payload.vbs

update1.txt

update1.txt

\untk.com

\untk.com

hXXp://VVV.apasajalah.host.sk/testms.php?mod=save&bkd=0&klog=

hXXp://VVV.apasajalah.host.sk/testms.php?mod=save&bkd=0&klog=

\[TheMoonlight].txt

\[TheMoonlight].txt

@*\AD:\DataHellSpawn\WARING_VIRII_LABORATORY\Virus Ku\Moonlight.b\Project1.vbp

@*\AD:\DataHellSpawn\WARING_VIRII_LABORATORY\Virus Ku\Moonlight.b\Project1.vbp

Moonlight.exe

Moonlight.exe

EmangEloh.exe_1324_rwx_00350000_00002000:

The procedure %s could not be located in the DLL %s.

The procedure %s could not be located in the DLL %s.

The ordinal %d could not be located in the DLL %s.

The ordinal %d could not be located in the DLL %s.

winlogon.exe_1512:

.text

.text

`.rsrc

`.rsrc

keylog

keylog

shell32.dll

shell32.dll

ShellExecuteA

ShellExecuteA

RasApi32.dll

RasApi32.dll

wininet.dll

wininet.dll

InternetOpenUrlA

InternetOpenUrlA

advapi32.dll

advapi32.dll

GetWindowsDirectoryA

GetWindowsDirectoryA

user32.dll

user32.dll

EnumWindows

EnumWindows

VBA6.DLL

VBA6.DLL

RegCloseKey

RegCloseKey

RegCreateKeyA

RegCreateKeyA

RegDeleteKeyA

RegDeleteKeyA

RegOpenKeyA

RegOpenKeyA

RegOpenKeyExA

RegOpenKeyExA

%Program Files%\Microsoft Visual Studio\VB98\VB6.OLB

%Program Files%\Microsoft Visual Studio\VB98\VB6.OLB

OpenUrl

OpenUrl

GetKeyState

GetKeyState

GetAsyncKeyState

GetAsyncKeyState

Kernel32.dll

Kernel32.dll

MSVBVM60.DLL

MSVBVM60.DLL

kernel32.dll

kernel32.dll

%sy5|l

%sy5|l

SSSSSh

SSSSSh

{6S%X

{6S%X

^.NrL

^.NrL

I.Mh|

I.Mh|

SHELL32.DLL

SHELL32.DLL

KERNEL32.DLL

KERNEL32.DLL

winlogon.exe

winlogon.exe

.rsrc

.rsrc

%Documents and Settings%\%current user%\Templates\O63746Z\winlogon.exe

%Documents and Settings%\%current user%\Templates\O63746Z\winlogon.exe

hXXp://padrup.com/sobaka1.gif

hXXp://padrup.com/sobaka1.gif

hXXp://190.120.227.91:8080/sobakavolos.gif

hXXp://190.120.227.91:8080/sobakavolos.gif

hXXp://89.11

hXXp://89.11

.info/home.gifIh

.info/home.gifIh

bW.text

bW.text

JKERNEL32.dll

JKERNEL32.dll

%x.exe

%x.exe

h.rdla&

h.rdla&

mH.MN8

mH.MN8

T4.At%

T4.At%

S.twa

S.twa

.klkjw:9fqwiBumW

.klkjw:9fqwiBumW

.sysa

.sysa

Zc.pBTa

Zc.pBTa

~%s:*:yd:

~%s:*:yd:

.!.VF*

.!.VF*

.d&?%x=

.d&?%x=

GUrlA'

GUrlA'

"\'Web%w}

"\'Web%w}

HTTP)s'PS

HTTP)s'PS

2GUARDCMD

2GUARDCMD

o.ENHCDM

o.ENHCDM

wWEBWUPD

wWEBWUPD

MM.PF

MM.PF

%xn'[

%xn'[

>>?456789:;

>>?456789:;

!"#$%&'()* ,-./4

!"#$%&'()* ,-./4

qn%CXf

qn%CXf

UP*dB.PPd@.

UP*dB.PPd@.

%FoAN-x

%FoAN-x

Ã„EW

Ã„EW

%F" *" a

%F" *" a

ADVAPI32.dll

ADVAPI32.dll

MSVCRT.dll

MSVCRT.dll

SHELL32.dll

SHELL32.dll

USER32.dll

USER32.dll

WS2_32.dll

WS2_32.dll

SHFileOperationA

SHFileOperationA

%sgkU

%sgkU

ei.sEI

ei.sEI

*\AD:\DataHellSpawn\WARING_VIRII_LABORATORY\Virus Ku\Moonlight.b\Project1.vbp

*\AD:\DataHellSpawn\WARING_VIRII_LABORATORY\Virus Ku\Moonlight.b\Project1.vbp

suport

suport

login

login

ZIPPED.zip

ZIPPED.zip

FILEATTACH.bz2

FILEATTACH.bz2

Doc.gz

Doc.gz

SMTP Server

SMTP Server

SMTP Email Address

SMTP Email Address

smtp.

smtp.

curriculum vittae.zip

curriculum vittae.zip

USE_RAR_To_Extract.ace

USE_RAR_To_Extract.ace

file.bz2

file.bz2

thisfile.gz

thisfile.gz

TITTA'S Picture.jar

TITTA'S Picture.jar

free screen saver romance for you
Please Visit Our Web Site hXXp://VVV.moonLight.com

free screen saver romance for you
Please Visit Our Web Site hXXp://VVV.moonLight.com

aku mahasiswa Bsi Margonda smt 3

aku mahasiswa Bsi Margonda smt 3

12050075

12050075

password lampiran 55132098

password lampiran 55132098

\regsvr32.exe

\regsvr32.exe

\twain32.dll

\twain32.dll

For security reasons attached file is password protected.
The password is 55132098

For security reasons attached file is password protected.
The password is 55132098

OSSMTP.SMTPSession

OSSMTP.SMTPSession

*.html

*.html

TutoriaL HAcking .exe

TutoriaL HAcking .exe

Lagu - Server .scr

Lagu - Server .scr

Data DosenKu .exe

Data DosenKu .exe

Titip Folder Jangan DiHapus .exe

Titip Folder Jangan DiHapus .exe

Love Song .scr

Love Song .scr

New mp3 BaraT !! .exe

New mp3 BaraT !! .exe

THe Best Ungu .scr

THe Best Ungu .scr

Blink 182 .exe

Blink 182 .exe

Norman virus Control 5.18 .exe

Norman virus Control 5.18 .exe

Windows Vista setup .scr

Windows Vista setup .scr

Gallery .scr

Gallery .scr

RaHasIA .exe

RaHasIA .exe

service.exe

service.exe

smss.exe

smss.exe

EmangEloh.exe

EmangEloh.exe

\msvbvm60.dll

\msvbvm60.dll

\system\msvbvm60.dll

\system\msvbvm60.dll

\service.exe

\service.exe

\smss.exe

\smss.exe

\EmangEloh.exe

\EmangEloh.exe

\winlogon.exe

\winlogon.exe

cie.cmd

cie.cmd

ta.exe

ta.exe

bLay.com

bLay.com

l.exe

l.exe

\sql.cmd

\sql.cmd

Software\Microsoft\Windows\CurrentVersion

Software\Microsoft\Windows\CurrentVersion

SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon

SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon

explorer.exe,

explorer.exe,

\userinit.exe ,

\userinit.exe ,

SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders

SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders

msconfig.exe

msconfig.exe

SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\

SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\

\notepad.exe

\notepad.exe

regedit.exe

regedit.exe

Software\Microsoft\Windows\CurrentVersion\run

Software\Microsoft\Windows\CurrentVersion\run

\*.pif

\*.pif

*.htm

*.htm

hXXp://VVV.geocities.com/m00nL19ht2006/

hXXp://VVV.geocities.com/m00nL19ht2006/

\MYpIC.zip

\MYpIC.zip

zipfile.txt

zipfile.txt

dll.txt

dll.txt

payload.txt

payload.txt

\payload.vbs

\payload.vbs

update1.txt

update1.txt

\untk.com

\untk.com

hXXp://VVV.apasajalah.host.sk/testms.php?mod=save&bkd=0&klog=

hXXp://VVV.apasajalah.host.sk/testms.php?mod=save&bkd=0&klog=

\[TheMoonlight].txt

\[TheMoonlight].txt

@*\AD:\DataHellSpawn\WARING_VIRII_LABORATORY\Virus Ku\Moonlight.b\Project1.vbp

@*\AD:\DataHellSpawn\WARING_VIRII_LABORATORY\Virus Ku\Moonlight.b\Project1.vbp

Moonlight.exe

Moonlight.exe

EmangEloh.exe_1324_rwx_00401000_00017000:

keylog

keylog

shell32.dll

shell32.dll

ShellExecuteA

ShellExecuteA

RasApi32.dll

RasApi32.dll

wininet.dll

wininet.dll

InternetOpenUrlA

InternetOpenUrlA

advapi32.dll

advapi32.dll

GetWindowsDirectoryA

GetWindowsDirectoryA

user32.dll

user32.dll

EnumWindows

EnumWindows

VBA6.DLL

VBA6.DLL

RegCloseKey

RegCloseKey

RegCreateKeyA

RegCreateKeyA

RegDeleteKeyA

RegDeleteKeyA

RegOpenKeyA

RegOpenKeyA

RegOpenKeyExA

RegOpenKeyExA

%Program Files%\Microsoft Visual Studio\VB98\VB6.OLB

%Program Files%\Microsoft Visual Studio\VB98\VB6.OLB

OpenUrl

OpenUrl

GetKeyState

GetKeyState

GetAsyncKeyState

GetAsyncKeyState

Kernel32.dll

Kernel32.dll

MSVBVM60.DLL

MSVBVM60.DLL

*\AD:\DataHellSpawn\WARING_VIRII_LABORATORY\Virus Ku\Moonlight.b\Project1.vbp

*\AD:\DataHellSpawn\WARING_VIRII_LABORATORY\Virus Ku\Moonlight.b\Project1.vbp

winlogon.exe

winlogon.exe

suport

suport

login

login

ZIPPED.zip

ZIPPED.zip

FILEATTACH.bz2

FILEATTACH.bz2

Doc.gz

Doc.gz

SMTP Server

SMTP Server

SMTP Email Address

SMTP Email Address

smtp.

smtp.

curriculum vittae.zip

curriculum vittae.zip

USE_RAR_To_Extract.ace

USE_RAR_To_Extract.ace

file.bz2

file.bz2

thisfile.gz

thisfile.gz

TITTA'S Picture.jar

TITTA'S Picture.jar

free screen saver romance for you
Please Visit Our Web Site hXXp://VVV.moonLight.com

free screen saver romance for you
Please Visit Our Web Site hXXp://VVV.moonLight.com

aku mahasiswa Bsi Margonda smt 3

aku mahasiswa Bsi Margonda smt 3

12050075

12050075

password lampiran 55132098

password lampiran 55132098

\regsvr32.exe

\regsvr32.exe

\twain32.dll

\twain32.dll

For security reasons attached file is password protected.
The password is 55132098

For security reasons attached file is password protected.
The password is 55132098

OSSMTP.SMTPSession

OSSMTP.SMTPSession

*.html

*.html

TutoriaL HAcking .exe

TutoriaL HAcking .exe

Lagu - Server .scr

Lagu - Server .scr

Data DosenKu .exe

Data DosenKu .exe

Titip Folder Jangan DiHapus .exe

Titip Folder Jangan DiHapus .exe

Love Song .scr

Love Song .scr

New mp3 BaraT !! .exe

New mp3 BaraT !! .exe

THe Best Ungu .scr

THe Best Ungu .scr

Blink 182 .exe

Blink 182 .exe

Norman virus Control 5.18 .exe

Norman virus Control 5.18 .exe

Windows Vista setup .scr

Windows Vista setup .scr

Gallery .scr

Gallery .scr

RaHasIA .exe

RaHasIA .exe

service.exe

service.exe

smss.exe

smss.exe

EmangEloh.exe

EmangEloh.exe

\msvbvm60.dll

\msvbvm60.dll

\system\msvbvm60.dll

\system\msvbvm60.dll

\service.exe

\service.exe

\smss.exe

\smss.exe

\EmangEloh.exe

\EmangEloh.exe

\winlogon.exe

\winlogon.exe

cie.cmd

cie.cmd

ta.exe

ta.exe

bLay.com

bLay.com

l.exe

l.exe

\sql.cmd

\sql.cmd

Software\Microsoft\Windows\CurrentVersion

Software\Microsoft\Windows\CurrentVersion

SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon

SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon

explorer.exe,

explorer.exe,

\userinit.exe ,

\userinit.exe ,

SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders

SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders

msconfig.exe

msconfig.exe

SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\

SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\

\notepad.exe

\notepad.exe

regedit.exe

regedit.exe

Software\Microsoft\Windows\CurrentVersion\run

Software\Microsoft\Windows\CurrentVersion\run

\*.pif

\*.pif

*.htm

*.htm

hXXp://VVV.geocities.com/m00nL19ht2006/

hXXp://VVV.geocities.com/m00nL19ht2006/

\MYpIC.zip

\MYpIC.zip

zipfile.txt

zipfile.txt

dll.txt

dll.txt

payload.txt

payload.txt

\payload.vbs

\payload.vbs

update1.txt

update1.txt

\untk.com

\untk.com

hXXp://VVV.apasajalah.host.sk/testms.php?mod=save&bkd=0&klog=

hXXp://VVV.apasajalah.host.sk/testms.php?mod=save&bkd=0&klog=

\[TheMoonlight].txt

\[TheMoonlight].txt

@*\AD:\DataHellSpawn\WARING_VIRII_LABORATORY\Virus Ku\Moonlight.b\Project1.vbp

@*\AD:\DataHellSpawn\WARING_VIRII_LABORATORY\Virus Ku\Moonlight.b\Project1.vbp

Moonlight.exe

Moonlight.exe

EmangEloh.exe_1324_rwx_0041A000_00005000:

kernel32.dll

kernel32.dll

%sy5|l

%sy5|l

SSSSSh

SSSSSh

{6S%X

{6S%X

EmangEloh.exe_1324_rwx_0042B000_00004000:

^.NrL

^.NrL

EmangEloh.exe_1324_rwx_00435000_0000F000:

SHELL32.DLL

SHELL32.DLL

ShellExecuteA

ShellExecuteA

KERNEL32.DLL

KERNEL32.DLL

EmangEloh.exe

EmangEloh.exe

.rsrc

.rsrc

%WinDir%\M35838\EmangEloh.exe

%WinDir%\M35838\EmangEloh.exe

hXXp://padrup.com/sobaka1.gif

hXXp://padrup.com/sobaka1.gif

hXXp://190.120.227.91:8080/sobakavolos.gif

hXXp://190.120.227.91:8080/sobakavolos.gif

hXXp://89.11

hXXp://89.11

.info/home.gifIh

.info/home.gifIh

bW.text

bW.text

JKERNEL32.dll

JKERNEL32.dll

%x.exe

%x.exe

h.rdla&

h.rdla&

mH.MN8

mH.MN8

T4.At%

T4.At%

S.twa

S.twa

.klkjw:9fqwiBumW

.klkjw:9fqwiBumW

.sysa

.sysa

Zc.pBTa

Zc.pBTa

~%s:*:yd:

~%s:*:yd:

.!.VF*

.!.VF*

.d&?%x=

.d&?%x=

GUrlA'

GUrlA'

"\'Web%w}

"\'Web%w}

HTTP)s'PS

HTTP)s'PS

2GUARDCMD

2GUARDCMD

o.ENHCDM

o.ENHCDM

wWEBWUPD

wWEBWUPD

MM.PF

MM.PF

%xn'[

%xn'[

>>?456789:;

>>?456789:;

!"#$%&'()* ,-./4

!"#$%&'()* ,-./4

qn%CXf

qn%CXf

UP*dB.PPd@.

UP*dB.PPd@.

%FoAN-x

%FoAN-x

Ã„EW

Ã„EW

%F" *" a

%F" *" a

ADVAPI32.dll

ADVAPI32.dll

MSVCRT.dll

MSVCRT.dll

SHELL32.dll

SHELL32.dll

USER32.dll

USER32.dll

WS2_32.dll

WS2_32.dll

RegCloseKey

RegCloseKey

SHFileOperationA

SHFileOperationA

EmangEloh.exe_1324_rwx_00F60000_00002000:

SHELL32.DLL

SHELL32.DLL

ShellExecuteA

ShellExecuteA

KERNEL32.DLL

KERNEL32.DLL

.rsrc

.rsrc

.text

.text

EmangEloh.exe_1324_rwx_00F70000_00001000:

|emangeloh.exeM_1324_

|emangeloh.exeM_1324_

winlogon.exe_1512_rwx_00350000_00002000:

The procedure %s could not be located in the DLL %s.

The procedure %s could not be located in the DLL %s.

The ordinal %d could not be located in the DLL %s.

The ordinal %d could not be located in the DLL %s.

winlogon.exe_1512_rwx_00401000_00017000:

keylog

keylog

shell32.dll

shell32.dll

ShellExecuteA

ShellExecuteA

RasApi32.dll

RasApi32.dll

wininet.dll

wininet.dll

InternetOpenUrlA

InternetOpenUrlA

advapi32.dll

advapi32.dll

GetWindowsDirectoryA

GetWindowsDirectoryA

user32.dll

user32.dll

EnumWindows

EnumWindows

VBA6.DLL

VBA6.DLL

RegCloseKey

RegCloseKey

RegCreateKeyA

RegCreateKeyA

RegDeleteKeyA

RegDeleteKeyA

RegOpenKeyA

RegOpenKeyA

RegOpenKeyExA

RegOpenKeyExA

%Program Files%\Microsoft Visual Studio\VB98\VB6.OLB

%Program Files%\Microsoft Visual Studio\VB98\VB6.OLB

OpenUrl

OpenUrl

GetKeyState

GetKeyState

GetAsyncKeyState

GetAsyncKeyState

Kernel32.dll

Kernel32.dll

MSVBVM60.DLL

MSVBVM60.DLL

*\AD:\DataHellSpawn\WARING_VIRII_LABORATORY\Virus Ku\Moonlight.b\Project1.vbp

*\AD:\DataHellSpawn\WARING_VIRII_LABORATORY\Virus Ku\Moonlight.b\Project1.vbp

winlogon.exe

winlogon.exe

suport

suport

login

login

ZIPPED.zip

ZIPPED.zip

FILEATTACH.bz2

FILEATTACH.bz2

Doc.gz

Doc.gz

SMTP Server

SMTP Server

SMTP Email Address

SMTP Email Address

smtp.

smtp.

curriculum vittae.zip

curriculum vittae.zip

USE_RAR_To_Extract.ace

USE_RAR_To_Extract.ace

file.bz2

file.bz2

thisfile.gz

thisfile.gz

TITTA'S Picture.jar

TITTA'S Picture.jar

free screen saver romance for you
Please Visit Our Web Site hXXp://VVV.moonLight.com

free screen saver romance for you
Please Visit Our Web Site hXXp://VVV.moonLight.com

aku mahasiswa Bsi Margonda smt 3

aku mahasiswa Bsi Margonda smt 3

12050075

12050075

password lampiran 55132098

password lampiran 55132098

\regsvr32.exe

\regsvr32.exe

\twain32.dll

\twain32.dll

For security reasons attached file is password protected.
The password is 55132098

For security reasons attached file is password protected.
The password is 55132098

OSSMTP.SMTPSession

OSSMTP.SMTPSession

*.html

*.html

TutoriaL HAcking .exe

TutoriaL HAcking .exe

Lagu - Server .scr

Lagu - Server .scr

Data DosenKu .exe

Data DosenKu .exe

Titip Folder Jangan DiHapus .exe

Titip Folder Jangan DiHapus .exe

Love Song .scr

Love Song .scr

New mp3 BaraT !! .exe

New mp3 BaraT !! .exe

THe Best Ungu .scr

THe Best Ungu .scr

Blink 182 .exe

Blink 182 .exe

Norman virus Control 5.18 .exe

Norman virus Control 5.18 .exe

Windows Vista setup .scr

Windows Vista setup .scr

Gallery .scr

Gallery .scr

RaHasIA .exe

RaHasIA .exe

service.exe

service.exe

smss.exe

smss.exe

EmangEloh.exe

EmangEloh.exe

\msvbvm60.dll

\msvbvm60.dll

\system\msvbvm60.dll

\system\msvbvm60.dll

\service.exe

\service.exe

\smss.exe

\smss.exe

\EmangEloh.exe

\EmangEloh.exe

\winlogon.exe

\winlogon.exe

cie.cmd

cie.cmd

ta.exe

ta.exe

bLay.com

bLay.com

l.exe

l.exe

\sql.cmd

\sql.cmd

Software\Microsoft\Windows\CurrentVersion

Software\Microsoft\Windows\CurrentVersion

SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon

SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon

explorer.exe,

explorer.exe,

\userinit.exe ,

\userinit.exe ,

SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders

SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders

msconfig.exe

msconfig.exe

SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\

SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\

\notepad.exe

\notepad.exe

regedit.exe

regedit.exe

Software\Microsoft\Windows\CurrentVersion\run

Software\Microsoft\Windows\CurrentVersion\run

\*.pif

\*.pif

*.htm

*.htm

hXXp://VVV.geocities.com/m00nL19ht2006/

hXXp://VVV.geocities.com/m00nL19ht2006/

\MYpIC.zip

\MYpIC.zip

zipfile.txt

zipfile.txt

dll.txt

dll.txt

payload.txt

payload.txt

\payload.vbs

\payload.vbs

update1.txt

update1.txt

\untk.com

\untk.com

hXXp://VVV.apasajalah.host.sk/testms.php?mod=save&bkd=0&klog=

hXXp://VVV.apasajalah.host.sk/testms.php?mod=save&bkd=0&klog=

\[TheMoonlight].txt

\[TheMoonlight].txt

@*\AD:\DataHellSpawn\WARING_VIRII_LABORATORY\Virus Ku\Moonlight.b\Project1.vbp

@*\AD:\DataHellSpawn\WARING_VIRII_LABORATORY\Virus Ku\Moonlight.b\Project1.vbp

Moonlight.exe

Moonlight.exe

winlogon.exe_1512_rwx_0041A000_00005000:

kernel32.dll

kernel32.dll

%sy5|l

%sy5|l

SSSSSh

SSSSSh

{6S%X

{6S%X

winlogon.exe_1512_rwx_0042B000_00004000:

^.NrL

^.NrL

winlogon.exe_1512_rwx_00435000_0000F000:

SHELL32.DLL

SHELL32.DLL

ShellExecuteA

ShellExecuteA

KERNEL32.DLL

KERNEL32.DLL

winlogon.exe

winlogon.exe

.rsrc

.rsrc

%Documents and Settings%\%current user%\Templates\O63746Z\winlogon.exe

%Documents and Settings%\%current user%\Templates\O63746Z\winlogon.exe

hXXp://padrup.com/sobaka1.gif

hXXp://padrup.com/sobaka1.gif

hXXp://190.120.227.91:8080/sobakavolos.gif

hXXp://190.120.227.91:8080/sobakavolos.gif

hXXp://89.11

hXXp://89.11

.info/home.gifIh

.info/home.gifIh

bW.text

bW.text

JKERNEL32.dll

JKERNEL32.dll

%x.exe

%x.exe

h.rdla&

h.rdla&

mH.MN8

mH.MN8

T4.At%

T4.At%

S.twa

S.twa

.klkjw:9fqwiBumW

.klkjw:9fqwiBumW

.sysa

.sysa

Zc.pBTa

Zc.pBTa

~%s:*:yd:

~%s:*:yd:

.!.VF*

.!.VF*

.d&?%x=

.d&?%x=

GUrlA'

GUrlA'

"\'Web%w}

"\'Web%w}

HTTP)s'PS

HTTP)s'PS

2GUARDCMD

2GUARDCMD

o.ENHCDM

o.ENHCDM

wWEBWUPD

wWEBWUPD

MM.PF

MM.PF

%xn'[

%xn'[

>>?456789:;

>>?456789:;

!"#$%&'()* ,-./4

!"#$%&'()* ,-./4

qn%CXf

qn%CXf

UP*dB.PPd@.

UP*dB.PPd@.

%FoAN-x

%FoAN-x

Ã„EW

Ã„EW

%F" *" a

%F" *" a

ADVAPI32.dll

ADVAPI32.dll

MSVCRT.dll

MSVCRT.dll

SHELL32.dll

SHELL32.dll

USER32.dll

USER32.dll

WS2_32.dll

WS2_32.dll

RegCloseKey

RegCloseKey

SHFileOperationA

SHFileOperationA

winlogon.exe_1512_rwx_00F60000_00002000:

SHELL32.DLL

SHELL32.DLL

ShellExecuteA

ShellExecuteA

KERNEL32.DLL

KERNEL32.DLL

.rsrc

.rsrc

.text

.text

winlogon.exe_1512_rwx_00F70000_00001000:

|winlogon.exeM_1512_

|winlogon.exeM_1512_

Explorer.EXE_1140_rwx_00FF0000_00002000:

SHELL32.DLL

SHELL32.DLL

ShellExecuteA

ShellExecuteA

KERNEL32.DLL

KERNEL32.DLL

.rsrc

.rsrc

.text

.text

Explorer.EXE_1140_rwx_01E20000_00001000:

|explorer.exeM_1140_

|explorer.exeM_1140_