Trojan.NSIS.StartPage_16f6a1ab6c

Dynamic Analysis

Payload

No specific payload has been found.

Process activity

The Trojan creates the following process(es):

FMOlsvr.exe:1564
fmol.exe:1824
%original file name%.exe:1360
FHSev.exe:2476
FHSev.exe:1540
FHSev.exe:360
setup_3386.exe:540

The Trojan injects its code into the following process(es):

FMOlsvr.exe:1644
ntvdm.exe:1248
ntvdm.exe:1520
%original file name%.exe:468
FHSev.exe:2548
BaiduPlayerNetSetup_368.exe:2024

Mutexes

The following mutexes were created/opened:No objects were found.

File activity

The process FMOlsvr.exe:1644 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\qqtj1[1].htm (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\qqtj2[1].htm (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\a35a3ed7\DMSet.Xml (673 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\qqtj1[1].htm (3 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\qqtj1[1].htm (0 bytes)

The process fmol.exe:1824 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Program Files%\fmol_201501212023\201501212023\Data\server.ini (1 bytes)
%Program Files%\fmol_201501212023\201501212023\Data\user2.ini (402 bytes)
%Program Files%\fmol_201501212023\201501212023\SysConfig.ini (606 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\ver[1].txt (36 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\a[1].htm (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\1113[1].htm (3 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\a[1].htm (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\1113[1].htm (0 bytes)

The process ntvdm.exe:1248 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

C:\ (4 bytes)
%WinDir%\Temp\scsBA.tmp (33880 bytes)
%Documents and Settings%\%current user%\FAVORITES (4 bytes)
%Documents and Settings%\%current user%\Desktop\Intrenet Explorer.lnk (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\_30863[1].htm (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\setup_3386[1].exe (3840 bytes)
%Program Files%\Internet Explorer (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\index.dat (576 bytes)
%Documents and Settings%\%current user%\Local Settings (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\wireshark.txt (12317 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsrB6.tmp (4 bytes)
%WinDir% (672 bytes)
C:\$Directory (508 bytes)
%System% (8808 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5 (4 bytes)
%Program Files% (4 bytes)
%WinDir%\WinSxS\Policies\x86_Policy.8.0.Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_x-ww_77c24773 (4 bytes)
%System%\config (8 bytes)
%WinDir%\Temp\Perflib_Perfdata_7ac.dat (4 bytes)
%System%\wbem (480 bytes)
%System%\drivers (480 bytes)
%WinDir%\Temp\scsBB.tmp (10145 bytes)
%Documents and Settings%\%current user% (4 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\index.dat (672 bytes)
%Program Files%\Common Files\Adobe\Acrobat\ActiveX (4 bytes)
C:\baidu download\BaiduPlayerNetSetup_368.exe (17787 bytes)
%Documents and Settings%\%current user%\Cookies (96 bytes)

The Trojan deletes the following file(s):

%WinDir%\Temp\scsBA.tmp (0 bytes)
%WinDir%\Temp\scsBB.tmp (0 bytes)

The process ntvdm.exe:1520 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings% (4 bytes)
C:\ (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\index.dat (388 bytes)
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\Perflib_Perfdata_2a4.dat (100 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsrB6.tmp (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsqB3.tmp (4 bytes)
%Documents and Settings%\All Users (4 bytes)
%WinDir%\REGISTRATION (4 bytes)
%WinDir%\Temp\Perflib_Perfdata_124.dat (100 bytes)
%WinDir% (680 bytes)
%Program Files%\COMMON FILES (4 bytes)
C:\$Directory (1344 bytes)
%Documents and Settings%\%current user%\Local Settings (4 bytes)
%System% (10920 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5 (4 bytes)
%WinDir%\Temp\scsB8.tmp (33872 bytes)
%Program Files% (4 bytes)
%Documents and Settings%\All Users\Documents (4 bytes)
%WinDir%\Temp\scsB9.tmp (10145 bytes)
%Documents and Settings%\%current user%\My Documents (4 bytes)
%System%\config (8 bytes)
%WinDir%\Temp\Perflib_Perfdata_7ac.dat (4 bytes)
%System%\wbem (1064 bytes)
%System%\drivers (32 bytes)
%Documents and Settings%\All Users\Start Menu (4 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\index.dat (4 bytes)
%Program Files%\Common Files\VMware\Drivers (4 bytes)
%Documents and Settings%\All Users\Application Data (4 bytes)
D: (148 bytes)
%Documents and Settings%\%current user%\Cookies (96 bytes)

The Trojan deletes the following file(s):

%WinDir%\Temp\scsB9.tmp (0 bytes)
%WinDir%\Temp\scsB8.tmp (0 bytes)

The process %original file name%.exe:468 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\iplookup[1].htm (56 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsrB6.tmp\Inetc.dll (20 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\BaiduPlayerNetSetup_368[1].exe (68691 bytes)
%Documents and Settings%\%current user%\Desktop\Intrenet Explorer.lnk (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\setup_3386[1].exe (249349 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsrB6.tmp\i.rar (56 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsrB6.tmp\setup_3386.exe (249349 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsrB6.tmp\G0630_s_70886.exe (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsrB6.tmp\System.dll (11 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsrB6.tmp\1.jpg (5804 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\[1].htm (6 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@sina.com[1].txt (196 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\_30863[1].htm (6 bytes)
%Program Files%\FunshionInstall\uninst.exe (1281 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsrB6.tmp\yicir_30863.exe (6 bytes)
%Documents and Settings%\%current user%\Cookies\index.dat (964 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsrB6.tmp\BaiduPlayerNetSetup_368.exe (68691 bytes)
%Documents and Settings%\%current user%\Start Menu\Programs\FunshionInstall\uninst.lnk (745 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsrB6.tmp\nsProcess.dll (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\desktop.ini (67 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nsrB6.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsrB6.tmp\SoHuVA_4.3.0.1-c204900003-ng-nti-s-x.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsbB5.tmp (0 bytes)

The process %original file name%.exe:1360 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nsqB3.tmp\System.dll (11 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsqB3.tmp\i.rar (56 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsqB3.tmp\nsProcess.dll (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsqB3.tmp\%original file name%.exe (1281 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsqB3.tmp\Inetc.dll (20 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsqB3.tmp\1.jpg (5804 bytes)
%Documents and Settings%\%current user%\Start Menu\Programs\FunshionInstall\uninst.lnk (745 bytes)
%Program Files%\FunshionInstall\uninst.exe (1281 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nsqB3.tmp\System.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsqB3.tmp\nszB4.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsqB3.tmp\1.jpg (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsqB3.tmp\%original file name%.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsqB3.tmp\Inetc.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsqB3.tmp\nsProcess.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nslB2.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsqB3.tmp (0 bytes)

The process FHSev.exe:2548 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\LocalService\Local Settings\Temporary Internet Files\Content.IE5\OFK7QZUX\Update2[1].rar (1497 bytes)
%Program Files%\fmol_201501212023\201501212023\Data\2024.Tmp (1 bytes)
%Documents and Settings%\LocalService\Local Settings\Temporary Internet Files\Content.IE5\QLSNQ10Z\fwtj[1].htm (3 bytes)

The Trojan deletes the following file(s):

%Program Files%\fmol_201501212023\201501212023\Data\2024.Tmp (0 bytes)

The process setup_3386.exe:540 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Program Files%\fmol_201501212023\201501212023\FHSev.exe (11048 bytes)
%Program Files%\fmol_201501212023\201501212023\SysConfig.ini (763 bytes)
%Program Files%\fmol_201501212023\201501212023\fmol.exe (65976 bytes)
%Program Files%\fmol_201501212023\201501212023\favorfm.xml (440 bytes)
%Program Files%\fmol_201501212023\201501212023\source.dll (6584 bytes)
%Program Files%\fmol_201501212023\201501212023\avutil-52.dll (5520 bytes)
%Program Files%\fmol_201501212023\201501212023\avcore.dll (2392 bytes)
%Program Files%\fmol_201501212023\201501212023\Data\setup.ini (110 bytes)
%Program Files%\fmol_201501212023\201501212023\Data\client.ini (36 bytes)
%Program Files%\fmol_201501212023\201501212023\Unins.exe (9608 bytes)
%Program Files%\fmol_201501212023\201501212023\avformat-54.dll (12088 bytes)
%Documents and Settings%\%current user%\Start Menu\Programs\fmol\fmol.lnk (880 bytes)
%Program Files%\fmol_201501212023\201501212023\DuiLib.dll (16288 bytes)

><&<<<&>&&&<><&u9FK.<&&&ff&<

<<<>>>

&t

<<<>>>

>&<<<<&W.s.....WP3....v.&>>&<<<&

<<<>>>

&t

>&>&>>>>>&<&<<&<

<<<>>>

<

<<<>>>

<>><>&<&<<>&><<<<<>

<<<>>>

<><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><>“”“”<><>“”“”“”“”<><><>&lt

<<<>>>

&

&

&

&

&

&