Skip to main content

Adware.Generic.166427_188218cb81


not-a-virus:AdWare.Win32.CloverPlus.dy (Kaspersky), Adware.Generic.166427 (B) (Emsisoft), Adware.Generic.166427 (AdAware), mzpefinder_pcap_file.YR (Lavasoft MAS)Behaviour: Adware

The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.

Summary

MD5: 188218cb81df3fd73d196e3f5af96a00

SHA1: 42211ed560f16b0ec28ce31ea29911c78d4bca2d

SHA256: d042aa8235fefcb9c0257c2d2e20ac1f63a9968b7a46d045285c6f317dbb7cce

SSDeep: 1536:FaMftiEbfMZhASsSBarSieYqRi1T507908tiu/Ov6NYGsuV88XP qDxU79u:F7liEbfHSviecFJ8tiOKqV8k Gxd

Size: 140544 bytes

File type: EXE

Platform: WIN32

Entropy: Packed

PEID: UPolyXv05_v6, PolyEnE001byLennartHedlund, ACProtect14x, ACProtectv135

Company: Cinema HDV12.01

Created at: 2009-04-22 15:06:47

Analyzed on: WindowsXP SP3 32-bit

Summary: Adware. Delivers advertising content in a manner or context that may be unexpected and unwanted by users. Many adware applications also perform tracking functions. Users may want to remove adware if they object to such tracking, do not wish to see the advertising caused by the program or are frustrated by its effects on system performance.

Dynamic Analysis

Payload

No specific payload has been found.

Process activity

The Adware creates the following process(es):

updater250.exe:912
clover.exe:1136
%original file name%.exe:464

The Adware injects its code into the following process(es):No processes have been created.

Mutexes

The following mutexes were created/opened:No objects were found.

File activity

The process updater250.exe:912 makes changes in the file system.


The Adware creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\5671\clover.exe (352976 bytes)
%Program Files%\CloverPlus\clover.exe (2105 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\c_exe[1].exe (352976 bytes)
%WinDir%\CloverPlus.cot (719 bytes)

The Adware deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\5671\clover.exe (0 bytes)
%WinDir%\CloverPlusprv.cot (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\5671 (0 bytes)

The process clover.exe:1136 makes changes in the file system.


The Adware creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Favorites\¿¬°á\¼­Ä¡¹ÙÀ̹Ì.url (95 bytes)
%Documents and Settings%\%current user%\Favorites\¼­Ä¡¹ÙÀÌ¹Ì - ³»°¡ ¸¸µé¾î°¡´Â °Ë»öÇü ºí·Î±×.url (95 bytes)
%Documents and Settings%\%current user%\Desktop\¼­Ä¡¹ÙÀ̹Ì.url (95 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\searchbyme[1].ico (158104 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\alive[1].htm (25 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\desktop.ini (67 bytes)
%WinDir%\searchbyme.ico (158104 bytes)

The process %original file name%.exe:464 makes changes in the file system.


The Adware creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\desktop.ini (159 bytes)
%Program Files%\CloverPlus\updater250.exe (111712 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\c_updater[1].exe (111712 bytes)
%WinDir%\CloverPlusprv.cot (733 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\desktop.ini (67 bytes)

Registry activity

The process updater250.exe:912 makes changes in the system registry.


The Adware creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKCU\Software\Microsoft\CloverPlus]
"updater_loaddate" = "4-7"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%Program Files%\CloverPlus]
"clover.exe" = "MFC 응용 프로그램"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1C 00 00 00 01 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "7B 23 5A BF C0 F9 D5 0B F4 93 62 D7 86 EC D7 23"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

The Adware modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Adware modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

To automatically run itself each time Windows is booted, the Adware adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"clover" = "%Program Files%\CloverPlus\clover.exe"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Adware modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

To automatically run itself each time Windows is booted, the Adware adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"clover_u" = "%Program Files%\CloverPlus\clover_updater.exe"

The Adware deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process clover.exe:1136 makes changes in the system registry.


The Adware creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKCU\Software\Microsoft\CloverPlus]
"sidebar_loaddate" = "4-7"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1D 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\CloverP]
"ext" = "A25BD2DA31FC4EB545CA0A57C0378AE69534BA358E28D49EF84D0F3A0FC9B57808681CF36A54C4236E4280942B2394A76D46CC50BD0E6C810E156D81273B5F13EA5457624C068F950D2A2F61EDD50D3440F5B4F1F590F51783548CB0D6584C89BD32FF9ED99C08379FFAB98C91FB82C482C0404069369CEEA4F0AB1F05E1651DAAE13177C9ABDD7A27792DFBF8B9C7209D9527999891A6E66B28A7F68FA532FB9FA8004CADF8486F1B6BF55A451CEF4F696683FD5906AFD0DA6E2BC618FD06F4E6FFCF6368089C7E437CFF3532E7CE76652991A1843F4F0A8DA6807EBCFF18F7AAD7A622C4D7A3EFED035E158E079679B075D5644CF1DA835C3D419DC41454D212846B7E2761BFB7F2C4873995CDC05876F956B2A8D5F681B9AAB77D37309C93F75577AFD44BEB548E0DFF9E315A069A6A6B900D28D06D442BC18CFFDB45B1CB856C5318B43D584FF3011477D32B396DA9DD3EA2E8E7F8F5B12CCC18747E0DA30F389F3A57E20094E327BC2065B8D71777DB924C6A0DAE7ECD21C10757B3809A5B0BC78860E8DC596118988410D4498BA6F8116376DA1C71EEB69BF83FF7265CE8569B5D8628CC2A108C2E2E7502CA4873F03CB7BB3CB9543A76F98B4F18CAE31591C6E0435F7102720B722C7360B33A1F3CA339A2DA51AA5FD63CEA6A36B360F3E584D4F1562953"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "91 13 3D 10 94 12 34 D4 A8 7D AB 24 CD FD D8 EB"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

The Adware modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Adware modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Adware modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Adware deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process %original file name%.exe:464 makes changes in the system registry.


The Adware creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%Program Files%\CloverPlus]
"updater250.exe" = "updater250"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1B 00 00 00 01 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "A0 87 2F 9C 90 61 15 F9 84 AD 3A EC 49 09 25 67"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

The Adware modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Adware modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Adware modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Adware deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

Dropped PE files

MD5 File path
7aedd69cf2565da0d4caaefaaa32f336c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\c_exe[1].exe
6e928ca124dcb70da2ec716019b509e5c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\c_updater[1].exe
7aedd69cf2565da0d4caaefaaa32f336c:\Program Files\CloverPlus\clover.exe
6e928ca124dcb70da2ec716019b509e5c:\Program Files\CloverPlus\clover_updater.exe

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

Removals

Remove it with Ad-Aware

  1. Click (here) to download and install Ad-Aware Free Antivirus.
  2. Update the definition files.
  3. Run a full scan of your computer.

Manual removal*

  1. Terminate malicious process(es) (How to End a Process With the Task Manager):

    updater250.exe:912
    clover.exe:1136
    %original file name%.exe:464

  2. Delete the original Adware file.
  3. Delete or disinfect the following files created/modified by the Adware:

    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\desktop.ini (67 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\5671\clover.exe (352976 bytes)
    %Program Files%\CloverPlus\clover.exe (2105 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\c_exe[1].exe (352976 bytes)
    %WinDir%\CloverPlus.cot (719 bytes)
    %Documents and Settings%\%current user%\Favorites\¿¬°á\¼­Ä¡¹ÙÀ̹Ì.url (95 bytes)
    %Documents and Settings%\%current user%\Favorites\¼­Ä¡¹ÙÀÌ¹Ì - ³»°¡ ¸¸µé¾î°¡´Â °Ë»öÇü ºí·Î±×.url (95 bytes)
    %Documents and Settings%\%current user%\Desktop\¼­Ä¡¹ÙÀ̹Ì.url (95 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\searchbyme[1].ico (158104 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\alive[1].htm (25 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\desktop.ini (67 bytes)
    %WinDir%\searchbyme.ico (158104 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
    %Documents and Settings%\%current user%\Local Settings\History\History.IE5\desktop.ini (159 bytes)
    %Program Files%\CloverPlus\updater250.exe (111712 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\c_updater[1].exe (111712 bytes)
    %WinDir%\CloverPlusprv.cot (733 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\desktop.ini (67 bytes)

  4. Delete the following value(s) in the autorun key (How to Work with System Registry):

    [HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
    "clover" = "%Program Files%\CloverPlus\clover.exe"

    [HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
    "clover_u" = "%Program Files%\CloverPlus\clover_updater.exe"

  5. Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

VersionInfo

Company Name:
Product Name: CloverUpdater ?? ????
Product Version: 1, 0, 0, 1
Legal Copyright: Copyright (C) 2009
Legal Trademarks:
Original Filename: CloverUpdater.EXE
Internal Name: CloverUpdater
File Version: 1, 0, 0, 1
File Description: CloverUpdater MFC ?? ????
Comments:
Language: English (United States)

Company Name: Product Name: CloverUpdater ?? ????Product Version: 1, 0, 0, 1Legal Copyright: Copyright (C) 2009Legal Trademarks: Original Filename: CloverUpdater.EXEInternal Name: CloverUpdaterFile Version: 1, 0, 0, 1File Description: CloverUpdater MFC ?? ????Comments: Language: English (United States)

PE Sections

Name Virtual Address Virtual Size Raw Size Entropy Section MD5
.text409678440409605.09336ee7dde2fe17ed393d188da8187202676
.rdata8601618122204803.3589664e4e173ce80fe58360bf1f6ce8e4fe7
.data106496407240962.9313926f02aede3dcf482c847919e95223cd9
.rsrc110592409640962.84033518ae57a2c1f5cb8829e55afbdb45b86
.perplex11468866816668165.49176bf30bf0b5d9837134a54a6cd1852ccb5

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Network Activity

URLs

URL IP
hxxp://e10088.dspb.akamaiedge.net/
hxxp://mng.cloverplus.com/files.php?client=218.149.84.44
hxxp://mng.cloverplus.com/files/pav/c_updater.exe218.149.84.44
hxxp://c.batangicon.net/log_progress.php?client=&action=update&target=0211.110.214.22
hxxp://www.google.com/173.194.113.208
hxxp://www.google.com.ua/?gfe_rd=cr&ei=uj8jVdzhM9SBNLWVgPgD173.194.113.208
hxxp://mng.cloverplus.com/files/pav/c_exe.exe218.149.84.44
hxxp://c.batangicon.net/log_progress.php?client=&action=install&target=1211.110.214.22
hxxp://c.batangicon.net/log_progress.php?client=&action=load&target=0211.110.214.22
hxxp://mng.cloverplus.com/alive.php?client=218.149.84.44
hxxp://mng.cloverplus.com/config.php?client=218.149.84.44
hxxp://mng.cloverplus.com/cls.php?client=218.149.84.44
hxxp://c.batangicon.net/log_progress.php?client=&action=load&target=1211.110.214.22
hxxp://mng.cloverplus.com/ext.php?client=218.149.84.44
hxxp://mng.cloverplus.com/fdwn/icon/searchbyme.ico218.149.84.44
hxxp://m.batangicon.net/alive.php?client=218.149.84.44
hxxp://m.batangicon.net/config.php?client=218.149.84.44
hxxp://m.batangicon.net/files/pav/c_exe.exe218.149.84.44
hxxp://m.batangicon.net/fdwn/icon/searchbyme.ico218.149.84.44
hxxp://www.microsoft.com/184.86.56.154
hxxp://m.batangicon.net/files.php?client=218.149.84.44
hxxp://m.batangicon.net/ext.php?client=218.149.84.44
hxxp://m.batangicon.net/cls.php?client=218.149.84.44
hxxp://m.batangicon.net/files/pav/c_updater.exe218.149.84.44

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

GET /log_progress.php?client=&action=load&target=1 HTTP/1.1

Host: c.batangicon.net

Cache-Control: no-cache

HTTP/1.1 200 OK

Date: Tue, 07 Apr 2015 02:24:13 GMT

Server: Apache/2.2.16 (Unix) DAV/2 PHP/5.2.14

X-Powered-By: PHP/5.2.14

Set-Cookie: PHPSESSID=ba6b2ea9e76a9f008996adcf9bcc97d2; path=/

Expires: Thu, 19 Nov 1981 08:52:00 GMT

Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0

Pragma: no-cache

Content-Length: 0

Connection: close

Content-Type: text/html

GET /config.php?client= HTTP/1.1

Host: m.batangicon.net

HTTP/1.1 200 OK

Date: Tue, 07 Apr 2015 02:24:12 GMT

Server: Apache/1.3.33 (Unix) PHP/4.4.7

X-Powered-By: PHP/4.4.7

Connection: close

Transfer-Encoding: chunked

Content-Type: text/html; charset=EUC-KR

c32..F55F12926DE40E2DF5F4B99D5CD19602CA57523BB1D3B24E1EFF0824010C2CF2FF233EF4691E3C88668FE04E8B1D9B0A3C5DD2FA5E4E5D559BAF9188FD1552E7472A62FABDC274B4DF4E9BC5EDF2926AFC633FAAB09C39787B6B9523B05328AFCC80E88E82C5A4A314D7C7A18D09901D24ED4281B4F55A5262EFFE26DC6872E3BB199AD0BC2C1155CB53685DC78BC0FC6F5DD563D99D2174ACEF02E042B66EBE9C90CA50ABC048761163B5470FAFB15E51C5F9FCFC0C1BDEF076E9B7DB110D205EF81D330858F07D8A7C061F237F2CA8AF341BDB7C6EE9CACE2582D60AC0D55B55D7F924F9A18C5FE36B65147CE5C9A29DCB706AB621C36F1B7A125AB2000CF418E68BB6534F758712C0B9B1B45C4C8264699E6AE7F0D614A65ABC906E1205C0B3FDC8A6E63090114A8FC29AB28AE01611C26E2524DA5A958F112C6DAA9462FED58533CF8265F9AAF6E1E955A9FCCBE9057D1C7E667A4C6BA09C2BF3855E35F90F3AEC0206A9C46DCA2D95208CB1D9D62B9AF95EF64D9D79CDD5C17082499BDB2FB8ECA5082DBB17D268DFADDEE753AAC9C8F0163C4D7FE327A5970A94DE12B5121E30FE4969F71D1E5E4EFD8478185E11B25EAD36F1D52354AE0878302AAAC55DE0E6DB8AD5FF95B34E994FA436F4048630F8BEBA14035A4419E4D15564A94EF7E90CE08DAC738092EB7898CF0C21BCF09A43C52CA2D1FF8B1EF43CEA58100EDEBF15B9D135E3BDF5C789C105C470131AF7D4FA823C114ACF4859DAC133F91C2BA3508F9AD87E83ADB14728E3C53AB33E8736522F3BC76E16A7D52F4D2F3E144C568DFC29D8660A2D87B998EACABC42D03C0D1951B626EFE4F8512C5EEF39399981586ECA34A7A5943AAC805C91B182EF9A6EE9FF03206C326C42EE89BB84BBAB07C18D4D9D8ACAEE9A2CC29B1923EE8FFFFA423A909AEDF4246938420038BED0A4B4C504703EBCE910E64518EB40C02DEA59A3B1126CD9CC402D5B816AD85CF3B0C803DA1FAAD8E1A72F3651A2A831786EFFA3ED877158D040D7FDE1C894FFCC3CB3EDD42005D8960D32650F9702745EC94BBAF5F8F14CE1BF2B6A056

<<< skipped >>>

GET /log_progress.php?client=&action=load&target=0 HTTP/1.1

Host: c.batangicon.net

Cache-Control: no-cache

Cookie: PHPSESSID=107ab246870bd499a80580fe04706c16

HTTP/1.1 200 OK

Date: Tue, 07 Apr 2015 02:24:02 GMT

Server: Apache/2.2.16 (Unix) DAV/2 PHP/5.2.14

X-Powered-By: PHP/5.2.14

Expires: Thu, 19 Nov 1981 08:52:00 GMT

Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0

Pragma: no-cache

Content-Length: 0

Connection: close

Content-Type: text/html

GET /?gfe_rd=cr&ei=uj8jVdzhM9SBNLWVgPgD HTTP/1.1

Connection: Keep-Alive

Host: VVV.google.com.ua

HTTP/1.1 200 OK

Date: Tue, 07 Apr 2015 02:23:54 GMT

Expires: -1

Cache-Control: private, max-age=0

Content-Type: text/html; charset=windows-1251

Set-Cookie: PREF=ID=4b85f16c24e92a17:FF=0:TM=1428373434:LM=1428373435:S=KclUD5F-_1LD5oFY; expires=Thu, 06-Apr-2017 02:23:55 GMT; path=/; domain=.google.com.ua

Set-Cookie: NID=67=mBEXLn86_TQlL066yLYmKouggxnBdvJfq4YHCCT8rjSoDra2yJyLPvA4QlCZxLa_olIMcT-FR_JxXvl71uliIasHIhujbxigk7t58ojxNmFbzPruK3DxqjsLFYq75E4b; expires=Wed, 07-Oct-2015 02:23:55 GMT; path=/; domain=.google.com.ua; HttpOnly

P3P: CP="This is not a P3P policy! See hXXp://VVV.google.com/support/accounts/bin/answer.py?hl=en&answer=151657 for more info."

Server: gws

X-XSS-Protection: 1; mode=block

X-Frame-Options: SAMEORIGIN

Alternate-Protocol: 80:quic,p=0.5

Accept-Ranges: none

Vary: Accept-Encoding

Transfer-Encoding: chunked

8000..<!doctype html><html itemscope="" itemtype="hXXp://schema.org/WebPage" lang="uk"><head><meta content="/logos/doodles/2015/gabriela-mistrals-126th-birthday-5301646531756032-hp.jpg" itemprop="image"><meta content="126 ..... . ... .......... ........ ........ #GoogleDoodle" property="og:description"><meta content="hXXp://VVV.google.com/logos/doodles/2015/gabriela-mistrals-126th-birthday-5301646531756032-hp.jpg" property="og:image"><meta content="491" property="og:image:width"><meta content="190" property="og:image:height"><title>Google</title><script>(function(){window.google={kEI:'uj8jVaiHPISksgHnvICQBw',kEXPI:'18167,3700272,3700362,4003510,4011559,4020347,4020726,4025836,4028716,4028932,4029054,4029515,4029815,4030440,4031242,4031391,4031394,4031478,4031571,4031608,4031622,4031627,4031713,4031789,4032500,8500394,8500972,8501248,8501295,8501313,8501350,10200083,10201001',authuser:0,kSID:'c9c918f0_10'};google.kHL='uk';})();(function(){google.lc=[];google.li=0;google.getEI=function(a){for(var b;a&&(!a.getAttribute||!(b=a.getAttribute("eid")));)a=a.parentNode;return b||google.kEI};google.getLEI=function(a){for(var b=null;a&&(!a.getAttribute||!(b=a.getAttribute("leid")));)a=a.parentNode;return b};google.https=function(){return"https:"==window.location.protocol};google.ml=function(){};google.time=function(){return(new Date).getTime()};google.log=function(a,b,e,f,l){var d=new Image,h=google.lc,g=google.li,c="",m=google.ls||"";d.onerror=d.onload=d.o

<<< skipped >>>

GET /cls.php?client= HTTP/1.1

Host: m.batangicon.net

HTTP/1.1 200 OK

Date: Tue, 07 Apr 2015 02:24:13 GMT

Server: Apache/1.3.33 (Unix) PHP/4.4.7

X-Powered-By: PHP/4.4.7

Connection: close

Transfer-Encoding: chunked

Content-Type: text/html; charset=EUC-KR

e10..F523D1E0711315956B9F796AC282C2F0F1842C2B52A46AE1BCD0100BEAF0A17EAD210FC6BF10A1634C55BCA368523F1F3589FA909245B181D3DB95464506091FF9D951454A0C2BB1A6DF8476EC2F065F9FA54435B12F6D5FC83B5C64F34950F2C295ED50B9D373A657DCAAB084C96AC234DA92587F3873546502AF93F78AB6D4F2C535A9A36BA65C25066D1F66F9AE6C646CEF75987D85CCAD50EDB9994B5A8F8970E55F9D56AC9636498E58E635D098472532B8B29C611F8120D4B9A2DC404B90BD7F44F21CEFB345D122EC8B26364EF76B88C38A2E4FC9D14BC0CA14BDE8AA6D62DCDFDF116944855A85B889D0D7A4DE1AF711AF52F5CA7659E925D3262498D40FDB083B5F72573E2462606171A4BC6686B15088FBA7256AB9AAAAC8336BA726359B137F129C733C85FCFCC2B5FFA525868F3E26A31FF52CFC4D49139FB0C289BD3DC5D381710EEC72307805E440D4792C4C0E164A02F5B13688BF7D0D9BB80323F4D9DD64D4B9CD75BCB05864905E80CF300050DAF0BFB8ED981459B07076C306F867E94C0B3733890D70D2B51B6C52D8F05183F04F1108BF36D55E6C963C7B780F1A244E82B9D03B5F165E19C20B0599294076E28B794E7C61445B25D1C2ECE51CF0FD073197B4A5954FB5282CD7247C6F96E4038F23E43A0484B0659252419A78AA977E78884942AC6AE14E3D19E29E0FD12C93DA62B81E4C4BD51717FD9508E8AF97E5DCBCDBADDB8F2284B1562D5417F5683741630B6E36CCE396B61341ADAA068EFB8132ACA8366F5F0306FF541EB39F5AEEBA767DE9A01771D30E753F6A53D0F0D38ED4087CB9985C3EAF35CEE5FECE1E652513410DBA14FEBB6F9B4311620366039E7F63EF8CF6F4A3C76B3A74129851E1E14C739F92C5C046BCE815E3BBEBEFA6682BB576DAF20D113FC79BD0C4986CB1739A62BB565C91A7CF5F3C92B29ABB67A2DC24D5C39A607EFFA71FB348B8BCBE817570811250797B27A24BACA4FCB01265DDA0893FE5338D722DBBB8FC07B442F3D2858FD5C4DA94A901E3978535A44DF5C535D198A27BCE478FA8884BE90589DD0AE459F79C1C6

<<< skipped >>>

GET /fdwn/icon/searchbyme.ico HTTP/1.1

Host: m.batangicon.net

Cache-Control: no-cache

HTTP/1.1 200 OK

Date: Tue, 07 Apr 2015 02:24:15 GMT

Server: Apache/1.3.33 (Unix) PHP/4.4.7

Last-Modified: Thu, 28 Mar 2013 10:06:18 GMT

ETag: "5f073e-27846-5154161a"

Accept-Ranges: bytes

Content-Length: 161862

Connection: close

Content-Type: image/x-icon

............ .(.......``.... .........HH.... ..T..V...@@.... .(B......00.... ..%...4.. .... ......Y........ .....Vj........ .h....s..(............. ...................................................................'\44g.HH..NN..OO..LL..JJ..II..II..II..II..II..II..II..II..II..II..II..II..II..II..II..GG..AA..88..00..,,..**}.((|.))}.**......44..<<..CC..GG..II..II..II..II..II..II..II..II..II..II..II..II..II..II..II..II..II..II..II..II..II..II..II..II..II..II..II..II..II..II..II..II..II..II..II..II..II..II..II..II..II..II..II..II..II..II..II..II..II..II..II..II..II..II..II..II..II..II..II..II..II..II..II..II..II..JJ..LL..OO..NN..HH..44g...'b..........................................................................:xFF..JJ..))..................................................................................................................==....l...t.....................................................................................................................................................................................................................................................................................................))..JJ..EE....:~...........................................................>BB..DD........................................................................................................................................o...x..........................................................................................................................................................

<<< skipped >>>

GET / HTTP/1.1

Host: VVV.google.com

HTTP/1.1 302 Found

Cache-Control: private

Content-Type: text/html; charset=UTF-8

Location: hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=uj8jVdzhM9SBNLWVgPgD

Content-Length: 260

Date: Tue, 07 Apr 2015 02:23:54 GMT

Server: GFE/2.0

Alternate-Protocol: 80:quic,p=0.5

<HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8">.<TITLE>302 Moved</TITLE></HEAD><BODY>.<H1>302 Moved</H1>.The document has moved.<A HREF="hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=uj8jVdzhM9SBNLWVgPgD">here</A>...</BODY></HTML>..HTTP/1.1 302 Found..Cache-Control: private..Content-Type: text/html; charset=UTF-8..Location: hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=uj8jVdzhM9SBNLWVgPgD..Content-Length: 260..Date: Tue, 07 Apr 2015 02:23:54 GMT..Server: GFE/2.0..Alternate-Protocol: 80:quic,p=0.5..<HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8">.<TITLE>302 Moved</TITLE></HEAD><BODY>.<H1>302 Moved</H1>.The document has moved.<A HREF="hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=uj8jVdzhM9SBNLWVgPgD">here</A>...</BODY></HTML>....

GET /files/pav/c_exe.exe HTTP/1.1

Host: m.batangicon.net

Cache-Control: no-cache

HTTP/1.1 200 OK

Date: Tue, 07 Apr 2015 02:23:57 GMT

Server: Apache/1.3.33 (Unix) PHP/4.4.7

Last-Modified: Tue, 24 Sep 2013 06:28:00 GMT

ETag: "5e8e26-58000-524130f0"

Accept-Ranges: bytes

Content-Length: 360448

Connection: close

Content-Type: application/octet-stream

MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......[1...P...P...P..dL...P...X...P...X...P...L...P...O...P...O...P...O...P...P...Q..)v...P...V...P..Rich.P..........PE..L...U0AR.................@...0......(........P....@.........................................................................P........P..`!...........................................................................P...............................text....7.......@.................. ..`.rdata.......P.......P..............@..@.data..../... ...0... ..............@....rsrc...`!...P...0...P..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

<<< skipped >>>

GET /files/pav/c_updater.exe HTTP/1.1

User-Agent: microsoft

Host: m.batangicon.net

Cache-Control: no-cache

HTTP/1.1 200 OK

Date: Tue, 07 Apr 2015 02:23:38 GMT

Server: Apache/1.3.33 (Unix) PHP/4.4.7

Last-Modified: Tue, 06 Aug 2013 11:32:00 GMT

ETag: "5e8d66-1c000-5200deb0"

Accept-Ranges: bytes

Content-Length: 114688

Connection: close

Content-Type: application/octet-stream

MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............}...}...}...q...}... ...}...s...}.x.w...}.x.v...}.x.y...}...|...}...v...}.W.{...}.Rich..}.................PE..L......Q.................@...p......o).......P....@..........................................................................w..........`............................................................................P..$............................text...h7.......@.................. ..`.rdata...G...P...P...P..............@..@.data... ...........................@....rsrc...`...........................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

<<< skipped >>>

GET /log_progress.php?client=&action=install&target=1 HTTP/1.1

Host: c.batangicon.net

Cache-Control: no-cache

Cookie: PHPSESSID=107ab246870bd499a80580fe04706c16

HTTP/1.1 200 OK

Date: Tue, 07 Apr 2015 02:24:02 GMT

Server: Apache/2.2.16 (Unix) DAV/2 PHP/5.2.14

X-Powered-By: PHP/5.2.14

Expires: Thu, 19 Nov 1981 08:52:00 GMT

Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0

Pragma: no-cache

Content-Length: 0

Connection: close

Content-Type: text/html

GET / HTTP/1.1

Host: VVV.microsoft.com

HTTP/1.1 200 OK

Cache-Control: no-cache

Content-Type: text/html

Last-Modified: Mon, 16 Mar 2009 20:35:26 GMT

Accept-Ranges: bytes

ETag: "67991fbd76a6c91:0"

Server: Microsoft-IIS/8.0

X-Powered-By: ASP.NET

Content-Length: 1020

Date: Tue, 07 Apr 2015 02:23:34 GMT

Connection: keep-alive

X-CCC: SE

X-CID: 2

<html><head><title>Microsoft Corporation</title><meta http-equiv="X-UA-Compatible" content="IE=EmulateIE7"></meta><meta http-equiv="Content-Type" content="text/html; charset=utf-8"></meta><meta name="SearchTitle" content="Microsoft.com" scheme=""></meta><meta name="Description" content="Get product information, support, and news from Microsoft." scheme=""></meta><meta name="Title" content="Microsoft.com Home Page" scheme=""></meta><meta name="Keywords" content="Microsoft, product, support, help, training, Office, Windows, software, download, trial, preview, demo, business, security, update, free, computer, PC, server, search, download, install, news" scheme=""></meta><meta name="SearchDescription" content="Microsoft.com Homepage" scheme=""></meta></head><body><p>Your current User-Agent string appears to be from an automated process, if this is incorrect, please click this link:<a href="hXXp://VVV.microsoft.com/en/us/default.aspx?redir=true">United States English Microsoft Homepage</a></p></body></html>....

GET /files.php?client= HTTP/1.1

User-Agent: microsoft

Host: mng.cloverplus.com

HTTP/1.1 200 OK

Date: Tue, 07 Apr 2015 02:23:36 GMT

Server: Apache/1.3.33 (Unix) PHP/4.4.7

X-Powered-By: PHP/4.4.7

Connection: close

Transfer-Encoding: chunked

Content-Type: text/html; charset=EUC-KR

53a..F509D2B02FF1E5916DAE84BAEFCD62B491306CE41F0694EEC059E44FA2BF6584F22927F295968E11A092D85E9D23373E6B8A1D557D6B0F1D11CB6A87333278BBA82E9F72855FCDB84D64446D512F0C8363286C149F6929D3929645B0C33E04E18E04D4F3ABDDF4E59228B7AC9CA2C06B17A7C94D5E58A3E0B178FF8842E2660FA3E977C5D1A2A53530652DFB4C541A023F22DF668AB52C697E7A70F34907722EE07DCE1F755A4695173A737AD53A0E8C015214101A9DA1449E97A3ED29F83F51C5BE3D77CB29BA681AC65FCDEACECC4BC14BB2EBBB25240C413B83C710B35B596FCEB2DDEF17DFD480403F835CFBDFB4E7BAE1AC671967831F224A94B8D070ED4D6F705941B38F64F076854793B79A4906709262355945EB7369C5C88540E7FFF4FCC3D6D5CA450C5E552CEBACB13963E5C74A622E489100A40EF36379B89F21DD892FE181736356D3A43371C63F0FF906151FC979554E255995785E55077FBA61703703F375F22E9ADC45054654145D281606BAA5C3DC7D01809F5178B25C9E04B5D1CC951877C1ED435C51039151FD38E5D0825EDB61322DE2A3E6620B9BF9CBAA79059C0082177871F9D1BEACE71084B224F0BB9FBE2A14D706B23A619C282979DF58EA644E5D780921FA05E92FD48B37E9E1ADFE8B08252F163225ECA39F02DCFF75E1693485A2F1A87C7B1E3C71139C58D611D2E8BF88303823C48C49B07E9FAF4DD2D4B2A6CC24124B23846C21E5469B7E7E257C06BA6653DFB5A442026F5E972668FFB040DBD16D32F9DECF8A753199F70C4C1658429EC50599A2D83662432FAFF78A67851C6192C755710A616519E921958DDD64030A728CAEC721E7ED6E0F1416EFDDD909E1A7950D91B1CF9F072BE031E65F6B8FF264E867C415A9BAD9F5DB2AA079B1108241A4AA6152D0C2A9095391BC6CCFA4BA4F5E5F..0..

<<< skipped >>>

GET /files.php?client= HTTP/1.1

Host: m.batangicon.net

HTTP/1.1 200 OK

Date: Tue, 07 Apr 2015 02:23:56 GMT

Server: Apache/1.3.33 (Unix) PHP/4.4.7

X-Powered-By: PHP/4.4.7

Connection: close

Transfer-Encoding: chunked

Content-Type: text/html; charset=EUC-KR

53a..F509D2B02FF1E5916DAE84BAEFCD62B491306CE41F0694EEC059E44FA2BF6584F22927F295968E11A092D85E9D23373E6B8A1D557D6B0F1D11CB6A87333278BBA82E9F72855FCDB84D64446D512F0C8363286C149F6929D3929645B0C33E04E18E04D4F3ABDDF4E59228B7AC9CA2C06B17A7C94D5E58A3E0B178FF8842E2660FA3E977C5D1A2A53530652DFB4C541A023F22DF668AB52C697E7A70F34907722EE07DCE1F755A4695173A737AD53A0E8C015214101A9DA1449E97A3ED29F83F51C5BE3D77CB29BA681AC65FCDEACECC4BC14BB2EBBB25240C413B83C710B35B596FCEB2DDEF17DFD480403F835CFBDFB4E7BAE1AC671967831F224A94B8D070ED4D6F705941B38F64F076854793B79A4906709262355945EB7369C5C88540E7FFF4FCC3D6D5CA450C5E552CEBACB13963E5C74A622E489100A40EF36379B89F21DD892FE181736356D3A43371C63F0FF906151FC979554E255995785E55077FBA61703703F375F22E9ADC45054654145D281606BAA5C3DC7D01809F5178B25C9E04B5D1CC951877C1ED435C51039151FD38E5D0825EDB61322DE2A3E6620B9BF9CBAA79059C0082177871F9D1BEACE71084B224F0BB9FBE2A14D706B23A619C282979DF58EA644E5D780921FA05E92FD48B37E9E1ADFE8B08252F163225ECA39F02DCFF75E1693485A2F1A87C7B1E3C71139C58D611D2E8BF88303823C48C49B07E9FAF4DD2D4B2A6CC24124B23846C21E5469B7E7E257C06BA6653DFB5A442026F5E972668FFB040DBD16D32F9DECF8A753199F70C4C1658429EC50599A2D83662432FAFF78A67851C6192C755710A616519E921958DDD64030A728CAEC721E7ED6E0F1416EFDDD909E1A7950D91B1CF9F072BE031E65F6B8FF264E867C415A9BAD9F5DB2AA079B1108241A4AA6152D0C2A9095391BC6CCFA4BA4F5E5F..0..

<<< skipped >>>

GET /ext.php?client= HTTP/1.1

Host: m.batangicon.net

HTTP/1.1 200 OK

Date: Tue, 07 Apr 2015 02:24:15 GMT

Server: Apache/1.3.33 (Unix) PHP/4.4.7

X-Powered-By: PHP/4.4.7

Connection: close

Transfer-Encoding: chunked

Content-Type: text/html; charset=EUC-KR

38e..F585FCCD34E04EA02A02BD22A0957AACB01F9ECA930288B62B427F3EA3C0307DCA525FF32926995E718CD85DBF10583A6343FC480236085DDF56544728CE8D9845558C4DAE095F8B5996C9667DD3C9350D0B77AC8B7CF3069E0B52F09A8B42E4AC48D7EEDCABC6309F44B7C4ACF6A32234FBB5997721A1E62D3FFA30B234710047C4325EE0AEE80BEDF4C81D6C23382136C7012FC382CCA4B044D0935D3E585A76B31865CEE94341F7D6B943F9861E71217308175328ACC4DABAC32C32573C875A364B6A2E2375DF61D5553BEBCA2B15C934A1B29753312A04A15EB0741C313F6101E84896A1D1CB0C05413CB19F3C003D6C68234A1AB7782B213895BF2A0303AAE160B08529D8BD4C2F4E0C396A42BA2933130DD5A6CCD2349B34BFFC8692ADD1F1AB429B09797562856F23B7BDA75E199A293B105D3D3F43703D5C13607AC744A22317DA7D8F11BCC51C5E7D47456BAB1C82593483C410177ADCD3A973A310B14516D5D84BAB5341D5CBFA6CA078044C3D4B7461F9CA982132A81A992AF45D77DB08C1550CBFFCC3060C88A0B25DABF6AD1D1081328FDAE9C0CED24726AC953B4245186202A3282BA21EF430C30D51081B399E9420B77B36AB4F9171825CC25B7C7D47EE6427..0..

GET /log_progress.php?client=&action=update&target=0 HTTP/1.1

Host: c.batangicon.net

Cache-Control: no-cache

HTTP/1.1 200 OK

Date: Tue, 07 Apr 2015 02:23:47 GMT

Server: Apache/2.2.16 (Unix) DAV/2 PHP/5.2.14

X-Powered-By: PHP/5.2.14

Set-Cookie: PHPSESSID=107ab246870bd499a80580fe04706c16; path=/

Expires: Thu, 19 Nov 1981 08:52:00 GMT

Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0

Pragma: no-cache

Content-Length: 0

Connection: close

Content-Type: text/html

GET / HTTP/1.1

Host: VVV.microsoft.com

HTTP/1.1 200 OK

Cache-Control: no-cache

Content-Type: text/html

Last-Modified: Mon, 16 Mar 2009 20:35:26 GMT

Accept-Ranges: bytes

ETag: "67991fbd76a6c91:0"

Server: Microsoft-IIS/8.0

X-Powered-By: ASP.NET

Content-Length: 1020

Date: Tue, 07 Apr 2015 02:24:08 GMT

Connection: keep-alive

X-CCC: SE

X-CID: 2

<html><head><title>Microsoft Corporation</title><meta http-equiv="X-UA-Compatible" content="IE=EmulateIE7"></meta><meta http-equiv="Content-Type" content="text/html; charset=utf-8"></meta><meta name="SearchTitle" content="Microsoft.com" scheme=""></meta><meta name="Description" content="Get product information, support, and news from Microsoft." scheme=""></meta><meta name="Title" content="Microsoft.com Home Page" scheme=""></meta><meta name="Keywords" content="Microsoft, product, support, help, training, Office, Windows, software, download, trial, preview, demo, business, security, update, free, computer, PC, server, search, download, install, news" scheme=""></meta><meta name="SearchDescription" content="Microsoft.com Homepage" scheme=""></meta></head><body><p>Your current User-Agent string appears to be from an automated process, if this is incorrect, please click this link:<a href="hXXp://VVV.microsoft.com/en/us/default.aspx?redir=true">United States English Microsoft Homepage</a></p></body></html>....

GET /alive.php?client= HTTP/1.1

Host: m.batangicon.net

Cache-Control: no-cache

HTTP/1.1 200 OK

Date: Tue, 07 Apr 2015 02:24:12 GMT

Server: Apache/1.3.33 (Unix) PHP/4.4.7

X-Powered-By: PHP/4.4.7

Connection: close

Transfer-Encoding: chunked

Content-Type: text/html; charset=EUC-KR

4e8..F509D2B02FF1E5916DA25245F027B9A26D25A2CA29F42CBEEA823EB10CCF6E91172F5907C361A661A28DD6606BF34A435A862D57846A059109156E81353F7BB7B3444D485241314CA9483A01E4443749570D5C16CA582FC059914BC1897280EB9178D297A0EE70F4E022AAB7C5BC24232395B442285BB8005A5FD9A13A2373B3AED274C5C3FBC717D07727959B9BBF44D8A704BA783F1836DB1C1CC351F88E15D7E9E3AFDA1559D23FF5603DBE32B5F6876127FE0204A413D7880883F4D2347BBFC3965DF80CB5C52C8DCC333CA3CA1EF3549656BA2725E1356C7305C675D0E5BA15CEB3B6D6962D0AAF7B46B35AFEFD422CA80B512FD8795467505B9A0B5A05B5E63B9E284A9E95CB53CE136CB247AC1E6958E5BBF88ACE8F58FFC5CA3BF2D8EFF40EA8D2FFAB3B7B20938F0AD1DA6F208AD4674E41C5A7691584F89F7C97E91F799AE54221E9EA22B5F956D5518E26AF7B2C3B35A38C9D10DA27776D503C97254CDFC8AF60015A8EB7DFB7B165CDDA7BCCA1125D2FC0DF15D8A57B7808AFC76F27DA9C9877C84FB8DD0C66BE82C23D9D1E00878473BDE386C8A2D365A19ADA847C5E429E0CB233F24CC5B45CC0D14E844303457E375F514F55A739D1357885484384FAC4D807A5B2432716B14B189F4DA4B5E1570C500EE469FBD77D50DB47904F9F9CF9BC886823F7BF4ED7B0DD2D7B1676E6386EC4493A5355FF42CE1734DECF19E8A1369E5B2DAA7BD743DEF309E1C4BC85C04CEE07E8227D9312434D77AF9F1D9C8DAD6D76AD9E482E99F8E17691C6AB7C3129B52FAE70982B667FA22D7564716F3FBA5EDFD9767EE23E45A333BD5C8442F068D264284C71DE84972D09E8AD5EE4C72995A1C8E2E9485D8BAB80A9461EFD..0..

Map

The Adware connects to the servers at the folowing location(s):

Strings from Dumps

clover.exe_1136:

.text

.text

`.rdata

`.rdata

@.data

@.data

.rsrc

.rsrc

t'

t'

SSSSh

SSSSh

MFC42.DLL

MFC42.DLL

MSVCRT.dll

MSVCRT.dll

_acmdln

_acmdln

GetWindowsDirectoryA

GetWindowsDirectoryA

KERNEL32.dll

KERNEL32.dll

USER32.dll

USER32.dll

RegCloseKey

RegCloseKey

RegCreateKeyExA

RegCreateKeyExA

RegDeleteKeyA

RegDeleteKeyA

RegOpenKeyExA

RegOpenKeyExA

RegQueryInfoKeyA

RegQueryInfoKeyA

ADVAPI32.dll

ADVAPI32.dll

ShellExecuteA

ShellExecuteA

SHELL32.dll

SHELL32.dll

ole32.dll

ole32.dll

OLEAUT32.dll

OLEAUT32.dll

InternetOpenUrlA

InternetOpenUrlA

WININET.dll

WININET.dll

NETAPI32.dll

NETAPI32.dll

WS2_32.dll

WS2_32.dll

MSVCP60.dll

MSVCP60.dll

URL=%s

URL=%s

%CONNECTION

%CONNECTION

úVORITE

úVORITE

ÞSKTOP

ÞSKTOP

Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders

Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders

.PAVCException@@

.PAVCException@@

.PAVCFileException@@

.PAVCFileException@@

.PAVCMemoryException@@

.PAVCMemoryException@@

c_exe

c_exe

hXXp://m.batangicon.net/files.php?client=%CLIENTID

hXXp://m.batangicon.net/files.php?client=%CLIENTID

hXXp://m.batangicon.net/config.php?client=%CLIENTID

hXXp://m.batangicon.net/config.php?client=%CLIENTID

hXXp://m.batangicon.net/inf_d.php?k=

hXXp://m.batangicon.net/inf_d.php?k=

hXXp://m.batangicon.net/inf_c.php?k=

hXXp://m.batangicon.net/inf_c.php?k=

hXXp://m.batangicon.net/ext.php?client=%CLIENTID

hXXp://m.batangicon.net/ext.php?client=%CLIENTID

hXXp://m.batangicon.net/cls.php?client=%CLIENTID

hXXp://m.batangicon.net/cls.php?client=%CLIENTID

hXXp://m.batangicon.net/alive.php?client=%CLIENTID

hXXp://m.batangicon.net/alive.php?client=%CLIENTID

hXXp://c.batangicon.net/log_progress.php?client=%CLIENTID&action=uninstall&target=0

hXXp://c.batangicon.net/log_progress.php?client=%CLIENTID&action=uninstall&target=0

hXXp://c.batangicon.net/log_progress.php?client=%CLIENTID&action=load&target=1

hXXp://c.batangicon.net/log_progress.php?client=%CLIENTID&action=load&target=1

hXXp://c.batangicon.net/log_progress.php?client=%CLIENTID&action=update&target=1

hXXp://c.batangicon.net/log_progress.php?client=%CLIENTID&action=update&target=1

hXXp://c.batangicon.net/log_progress.php?client=%CLIENTID&action=install&target=1

hXXp://c.batangicon.net/log_progress.php?client=%CLIENTID&action=install&target=1

hXXp://c.batangicon.net/log_progress.php?client=%CLIENTID&action=load&target=0

hXXp://c.batangicon.net/log_progress.php?client=%CLIENTID&action=load&target=0

hXXp://c.batangicon.net/log_progress.php?client=%CLIENTID&action=update&target=0

hXXp://c.batangicon.net/log_progress.php?client=%CLIENTID&action=update&target=0

hXXp://c.batangicon.net/log_progress.php?client=%CLIENTID&action=install&target=0

hXXp://c.batangicon.net/log_progress.php?client=%CLIENTID&action=install&target=0

%%WINDOWS\CloverPlusext::.cot

%%WINDOWS\CloverPlusext::.cot

%%WINDOWS\CloverPlusprv::.cot

%%WINDOWS\CloverPlusprv::.cot

%%WINDOWS\CloverPlus::.cot

%%WINDOWS\CloverPlus::.cot

%s\%s

%s\%s

%CLIENTID

%CLIENTID

amclick.wisenut.co.kr

amclick.wisenut.co.kr

.ilikeclick.com

.ilikeclick.com

.overture.com

.overture.com

siteurl_link

siteurl_link

FhXXp://VVV.google.com

FhXXp://VVV.google.com

hXXp://VVV.microsoft.com

hXXp://VVV.microsoft.com

%s/dvs/cnf.php

%s/dvs/cnf.php

%s/%s/cnf.php

%s/%s/cnf.php

Software\Microsoft\%s

Software\Microsoft\%s

%s_event

%s_event

%d-%d

%d-%d

hXXp://

hXXp://

Referer: %s

Referer: %s

.webstart.

.webstart.

.yorinara.

.yorinara.

hXXp://search.cuveus.com/tell.php?s=c&q=

hXXp://search.cuveus.com/tell.php?s=c&q=

hXXp://search.cuveus.com/tell.php?s=y&q=

hXXp://search.cuveus.com/tell.php?s=y&q=

ClickUrl

ClickUrl

link_url

link_url

site_url

site_url

hXXp://click.interlink.co.kr/?

hXXp://click.interlink.co.kr/?

*.hellodays.co.kr

*.hellodays.co.kr

*.119data.co.kr

*.119data.co.kr

*.searchmap.co.kr

*.searchmap.co.kr

*.xsearch.co.kr

*.xsearch.co.kr

*.yahoo.com

*.yahoo.com

/search/clicklog.php?

/search/clicklog.php?

*.search82.com

*.search82.com

*.dombyshop.co.kr

*.dombyshop.co.kr

*.boboscoms.com

*.boboscoms.com

KEYWORD=

KEYWORD=

keyword=

keyword=

/click.php?

/click.php?

rc14.overture.com

rc14.overture.com

wrs.yahoo.com/_ylt=

wrs.yahoo.com/_ylt=

shopping.yahoo.co.kr

shopping.yahoo.co.kr

kr.search.yahoo.com/r/_ylt=

kr.search.yahoo.com/r/_ylt=

hXXp://wrs.yahoo.com/_ylt=

hXXp://wrs.yahoo.com/_ylt=

*.ilikeclick.com

*.ilikeclick.com

search.n2s.co.kr

search.n2s.co.kr

*.cuveus.com

*.cuveus.com

*.yozzum.com

*.yozzum.com

*.interlink.co.kr

*.interlink.co.kr

*.pooc.me

*.pooc.me

.overture.

.overture.

/search/clickLog.php

/search/clickLog.php

cxclick.php

cxclick.php

*.quicknet.co.kr

*.quicknet.co.kr

elink.php

elink.php

*.yorinara.co.kr

*.yorinara.co.kr

*.webstart.co.kr

*.webstart.co.kr

Software\Microsoft\Internet Explorer\New Windows\Allow

Software\Microsoft\Internet Explorer\New Windows\Allow

%s\%s.url

%s\%s.url

desturl

desturl

{3603D0AC-D295-4abb-A4D9-1B307EDB66CA}

{3603D0AC-D295-4abb-A4D9-1B307EDB66CA}

SOFTWARE\Microsoft\Internet Explorer\Extensions\{5B8D60AB-BA12-3da1-BEF4-30DFE1AECF24}

SOFTWARE\Microsoft\Internet Explorer\Extensions\{5B8D60AB-BA12-3da1-BEF4-30DFE1AECF24}

SOFTWARE\Microsoft\Internet Explorer\Extensions\{5B8D60AB-BA12-3da1-BEF4-30DFE1AECF23}

SOFTWARE\Microsoft\Internet Explorer\Extensions\{5B8D60AB-BA12-3da1-BEF4-30DFE1AECF23}

SOFTWARE\Microsoft\Internet Explorer\Extensions\{5B8D60AB-BA12-3da1-BEF4-30DFE1AECF22}

SOFTWARE\Microsoft\Internet Explorer\Extensions\{5B8D60AB-BA12-3da1-BEF4-30DFE1AECF22}

SOFTWARE\Microsoft\Internet Explorer\Extensions\{5B8D60AB-BA12-3da1-BEF4-30DFE1AECF21}

SOFTWARE\Microsoft\Internet Explorer\Extensions\{5B8D60AB-BA12-3da1-BEF4-30DFE1AECF21}

SOFTWARE\Microsoft\Internet Explorer\Extensions\{5B8D60AB-BA12-3da1-BEF4-30DFE1AECF20}

SOFTWARE\Microsoft\Internet Explorer\Extensions\{5B8D60AB-BA12-3da1-BEF4-30DFE1AECF20}

{5B8D60AB-BA12-3da1-BEF4-30DFE1AECF24}

{5B8D60AB-BA12-3da1-BEF4-30DFE1AECF24}

{5B8D60AB-BA12-3da1-BEF4-30DFE1AECF23}

{5B8D60AB-BA12-3da1-BEF4-30DFE1AECF23}

{5B8D60AB-BA12-3da1-BEF4-30DFE1AECF22}

{5B8D60AB-BA12-3da1-BEF4-30DFE1AECF22}

{5B8D60AB-BA12-3da1-BEF4-30DFE1AECF21}

{5B8D60AB-BA12-3da1-BEF4-30DFE1AECF21}

{5B8D60AB-BA12-3da1-BEF4-30DFE1AECF20}

{5B8D60AB-BA12-3da1-BEF4-30DFE1AECF20}

%s/lua.php

%s/lua.php

url02

url02

ovurl

ovurl

hXXp://srch.minisearch.co.kr/SEARCH/sponsor_log/sponsor_clk.php

hXXp://srch.minisearch.co.kr/SEARCH/sponsor_log/sponsor_clk.php

md=%s&keyword=%s

md=%s&keyword=%s

hXXp://srch.minisearch.co.kr/SEARCH/click_log.php

hXXp://srch.minisearch.co.kr/SEARCH/click_log.php

x-requested-with: XMLHttpRequest

x-requested-with: XMLHttpRequest

User-Agent: %s

User-Agent: %s

mg=%s

mg=%s

%s,%s,MINI,Y,sponsor,sponsor,N,%d,-1,X,%d,1

%s,%s,MINI,Y,sponsor,sponsor,N,%d,-1,X,%d,1

%%WINDOWS\dhid.dh

%%WINDOWS\dhid.dh

web_title

web_title

Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, application/vnd.ms-excel, application/vnd.ms-powerpoint, application/msword, */*

Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, application/vnd.ms-excel, application/vnd.ms-powerpoint, application/msword, */*

hXXp://sense.web-guide.co.kr/sense/webguide_sideband.php?type=

hXXp://sense.web-guide.co.kr/sense/webguide_sideband.php?type=

hXXp://sense.web-guide.co.kr/sense/squid_gateway.php?affiliate_id=%s&keyword=%s

hXXp://sense.web-guide.co.kr/sense/squid_gateway.php?affiliate_id=%s&keyword=%s

User-Agent: Mozilla/3.0 (compatible; Indy Library)

User-Agent: Mozilla/3.0 (compatible; Indy Library)

%KEYWORD

%KEYWORD

%SITE

%SITE

%KEYWORDUTF8

%KEYWORDUTF8

.PAVCInternetException@@

.PAVCInternetException@@

hXXp://%s

hXXp://%s

CWebBrowser2

CWebBrowser2

hXXp://c.batangicon.net

hXXp://c.batangicon.net

hXXp://m.batangicon.net

hXXp://m.batangicon.net

CLSID\%s\InprocServer32

CLSID\%s\InprocServer32

%SYSTEM32

%SYSTEM32

%WINDOWS

%WINDOWS

%s\Program Files

%s\Program Files

Software\Microsoft\Windows\CurrentVersion\Run

Software\Microsoft\Windows\CurrentVersion\Run

Content-Type: application/x-www-form-urlencoded

Content-Type: application/x-www-form-urlencoded

ip=%s&ua=%s&xfip=

ip=%s&ua=%s&xfip=

Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent\Post Platform

Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent\Post Platform

Software\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform

Software\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform

Windows CE

Windows CE

Windows NT %d.%d

Windows NT %d.%d

Windows 98; Win 9x 4.90

Windows 98; Win 9x 4.90

Windows 98

Windows 98

Windows 95

Windows 95

Windows %d.%d

Windows %d.%d

Software\Microsoft\Windows\CurrentVersion\Internet Settings

Software\Microsoft\Windows\CurrentVersion\Internet Settings

attribute has error

attribute has error

' ... %s>' is not wel-formed.

' ... %s>' is not wel-formed.

it must be closed with %s>

it must be closed with %s>

%s must be closed with %s>

%s must be closed with %s>

keyname

keyname

subper%d

subper%d

keycycle_b

keycycle_b

™%cNX%%%%%

™%cNX%%%%%

J%FXN)

J%FXN)

NcJ%FXNo)M

NcJ%FXNo)M

name="YourApp.exe"

name="YourApp.exe"

YourApp.exe

YourApp.exe

D27CDB6E-AE6D-11CF-96B8-444553540000

D27CDB6E-AE6D-11CF-96B8-444553540000

{8856F961-340A-11D0-A96B-00C04FD705A2}

{8856F961-340A-11D0-A96B-00C04FD705A2}

1, 0, 0, 1

1, 0, 0, 1