Skip to main content

Dropped.Win32.Sality.3_4850b811e8


Trojan.Win32.Patched.la (Kaspersky), Dropped:Win32.Sality.3 (B) (Emsisoft), Dropped:Win32.Sality.3 (AdAware), Backdoor.Win32.PcClient.FD, Trojan.Win32.FlySky.FD, Virus.Win32.Sality.FD, Virus.Win32.Sality.2.FD, VirusSality.YR, GenericAutorunWorm.YR, GenericInjector.YR (Lavasoft MAS)Behaviour: Trojan, Backdoor, Worm, Virus, WormAutorun

The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.

Summary

MD5: 4850b811e8e91206517ea5a4701c918f

SHA1: c8a0a43424b41a9ff119b1a1f0dd8d2c33e6c5c3

SHA256: 4f07b36e0ae75f566d415aad5d86adb3fe84107e1f05f411608f9eca091671a2

SSDeep: 49152:HitKwZ35xLVPh9i2Jf2JiwBAGXhVbOQjJd7hxLC7tViQQ:HitKwpVPhA2Jf2JhqYhVbOGjhJCZViQQ

Size: 2058455 bytes

File type: EXE

Platform: WIN32

Entropy: Packed

PEID: UPolyXv05_v6

Company: Installer Pack

Created at: 1972-12-25 08:33:23

Analyzed on: WindowsXPESX SP3 32-bit

Summary: Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).

Dynamic Analysis

Payload

Behaviour Description
WormAutorunA worm can spread via removable drives. It writes its executable and creates "autorun.inf" scripts on all removable drives. The autorun script will execute the Dropped's file once a user opens a drive's folder in Windows Explorer.


Process activity

The Dropped creates the following process(es):

sc.exe:832
sc.exe:2044
sc.exe:888
sc.exe:1732
sc.exe:1596
sc.exe:1864
sc.exe:1512
net1.exe:1284
net1.exe:176
system.exe:1452
net.exe:1096
net.exe:1844
Rundll32.exe:332
XP-2CF7370F.EXE:4088
%original file name%.exe:3808

The Dropped injects its code into the following process(es):

XP-542ADE6B.EXE:3884
Rundll32.exe:1364
%original file name%.exe:272
Explorer.EXE:512

Mutexes

The following mutexes were created/opened:No objects were found.

File activity

The process XP-542ADE6B.EXE:3884 makes changes in the file system.


The Dropped creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\001E67FF_Rar\XP-542ADE6B.EXE (10815 bytes)
%System%\com.run (1425 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\E_4\internet.fne (184 bytes)
%System%\spec.fne (601 bytes)
%System%\RegEx.fnr (1281 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\MSHist012013021120130218\index.dat (202 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\E_4\spec.fne (73 bytes)
%System%\ul.dll (3856 bytes)
%System%\XP-2CF7370F.EXE (9606 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@baidu[2].txt (389 bytes)
%System%\og.dll (2728 bytes)
%System%\eAPI.fne (1425 bytes)
%System%\dp1.fne (601 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\E_4\eAPI.fne (323 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@baidu[1].txt (194 bytes)
%System%\internet.fne (673 bytes)
%System%\og.EDT (2008 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\index.dat (266 bytes)
%Documents and Settings%\%current user%\Start Menu\Programs\Startup\¡¡¡¡¡¡.lnk (1250 bytes)
%Documents and Settings%\%current user%\Cookies\index.dat (776 bytes)
%System%\krnln.fnr (7433 bytes)
%System%\shell.fne (40 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\MSHist012013030120130302\index.dat (202 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\E_4\RegEx.fnr (217 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\MSHist012013021820130225\index.dat (202 bytes)

The Dropped deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\History\History.IE5\MSHist012013021120130218\index.dat (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@baidu[1].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (0 bytes)
%System%\XP-2CF7370F.EXE (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\desktop.ini (0 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\MSHist012013021120130218 (0 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\MSHist012013021820130225 (0 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\MSHist012013021820130225\index.dat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5 (0 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\MSHist012013030120130302\index.dat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\MSHist012013030120130302 (0 bytes)

The process system.exe:1452 makes changes in the file system.


The Dropped creates and/or writes to the following file(s):

%WinDir%\system.ini (72 bytes)
%System%\uquqet.dll (76 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ktvm.exe (561 bytes)
%System%\sgdvet.dll (22 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\wintilnkr.exe (561 bytes)
C:\totalcmd\TOTALCMD.EXE (854 bytes)

The Dropped deletes the following file(s):

%WinDir%\1deadf (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ktvm.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\wintilnkr.exe (0 bytes)

The process Rundll32.exe:1364 makes changes in the file system.


The Dropped creates and/or writes to the following file(s):

%System%\CatRoot2 (96 bytes)
%WinDir%\SoftwareDistribution (4 bytes)
%WinDir%\pchealth\helpctr\System\images (4 bytes)
%WinDir%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US (4 bytes)
%WinDir%\SoftwareDistribution\Download\36a2296f631a54daefcc3b56e3d990e2 (4 bytes)
%WinDir%\pchealth\helpctr\System\Remote Assistance (4 bytes)
%WinDir%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance (4 bytes)
%WinDir%\SoftwareDistribution\Download\2e6b16219034e135b4f869efb7a10fee (4 bytes)
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\Perflib_Perfdata_80.dat (100 bytes)
%WinDir%\pchealth\helpctr\System\panels (4 bytes)
%Program Files%\WINDOWS NT (4 bytes)
%Documents and Settings%\All Users\Start Menu\Programs (8 bytes)
%WinDir%\SoftwareDistribution\Download\6a410a1bd174bc123056d235ac4829af (4 bytes)
%WinDir%\Microsoft.NET\Framework\v4.0.30319 (1732 bytes)
%Documents and Settings%\Default User (540 bytes)
%WinDir%\SoftwareDistribution\Download\248802b74506342031e926839639c729 (4 bytes)
%WinDir%\pchealth\helpctr\System (4 bytes)
C:\$Directory (4308 bytes)
%System%\ul.dll (8 bytes)
%System%\config (548 bytes)
%WinDir%\assembly\NativeImages_v2.0.50727_32\PresentationFramewo# (4 bytes)
%Documents and Settings%\All Users\Start Menu (8 bytes)
%Documents and Settings%\All Users\Application Data (4 bytes)
%System%\krnln.fnr (7433 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\001F8B22_Rar\wincheck.exe (12191 bytes)
%WinDir%\SoftwareDistribution\Download\01229cf5dcf0df67992cac35a2ba0b3f (4 bytes)
%System%\CatRoot (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\B2.tmp (4545 bytes)
%WinDir%\SoftwareDistribution\Download\85947e1a809663c7f480717673587a59 (4 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\ACCESSORIES (4 bytes)
%WinDir%\assembly\GAC_32 (4 bytes)
%WinDir%\SoftwareDistribution\Download\da2a33b6770f970d7fe7262040f98a4f (4 bytes)
%Program Files%\Reference Assemblies\Microsoft\Framework\v3.0 (4 bytes)
%System% (21408 bytes)
%System%\config\systemprofile\Application Data\Microsoft (4 bytes)
%Program Files%\Adobe\Reader 9.0\Resource\Font (4 bytes)
%System%\og.dll (4 bytes)
%WinDir%\Installer\$PatchCache$\Managed (4 bytes)
%WinDir%\SoftwareDistribution\Download\b5f880834ad67f3d383ffff5f2fa46bd (4 bytes)
%Program Files%\Common Files\VMware\Drivers (8 bytes)
%WinDir%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Security\Permissions (4 bytes)
%Program Files%\Common Files\Microsoft Shared\OFFICE14 (4 bytes)
%WinDir%\Microsoft.NET\Framework\v4.0.30319\WPF (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\001E67FF_Rar\XP-542ADE6B.EXE (4942 bytes)
%WinDir%\Microsoft.NET\Framework\v3.0\WPF (4 bytes)
%WinDir%\assembly\GAC_MSIL (36 bytes)
%WinDir%\Microsoft.NET (4 bytes)
%Documents and Settings%\%current user%\MY DOCUMENTS (8 bytes)
%Documents and Settings%\NetworkService\Local Settings (4 bytes)
%Documents and Settings%\All Users\DOCUMENTS (4 bytes)
%WinDir%\WinSxS\Policies (8 bytes)
%WinDir%\SoftwareDistribution\Download (45 bytes)
%System%\oobe\html (4 bytes)
C:\totalcmd\TOTALCMD.EXE (1779 bytes)
%WinDir%\SoftwareDistribution\Download\f0fea42f69058000617da24986c3b109 (4 bytes)
%System%\og.EDT (4 bytes)
%WinDir%\assembly\NativeImages_v4.0.30319_32\PresentationFramewo# (4 bytes)
%Documents and Settings%\%current user%\Start Menu\Programs\ACCESSORIES (4 bytes)
%System%\shell.fne (40 bytes)
%WinDir%\SoftwareDistribution\Download\196fa81559690e2494e56094df51cdd8 (4 bytes)
%Documents and Settings%\%current user%\Cookies (576 bytes)
C:\ (36 bytes)
%Documents and Settings%\%current user%\Favorites (4 bytes)
%WinDir%\SoftwareDistribution\Download\621a08ac003b616bcaa86aa4d4292d50 (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp (72 bytes)
%Documents and Settings%\ALL USERS (8 bytes)
%Program Files%\Movie Maker (4 bytes)
%WinDir%\Microsoft.NET\assembly\GAC_32 (4 bytes)
%Documents and Settings%\%current user%\Cookies\index.dat (12 bytes)
%WinDir%\Microsoft.NET\Framework\v3.0\Windows Workflow Foundation (4 bytes)
%Documents and Settings%\LocalService (4 bytes)
%WinDir%\SoftwareDistribution\Download\c0c52c03306062533f7dcb087bfcfa6b (4 bytes)
%WinDir%\WinSxS (296 bytes)
%WinDir%\SoftwareDistribution\Download\7dc26e8888d68d9e04bc52940c0f24b5 (4 bytes)
%WinDir% (2144 bytes)
%WinDir%\pchealth\helpctr\OfflineCache (4 bytes)
%WinDir%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Security\Users (4 bytes)
%WinDir%\SoftwareDistribution\Download\e0c0da396303f1dd2c82cd2ccc07020d (4 bytes)
%WinDir%\SoftwareDistribution\Download\e79028ac4f02e201b61b2c632cb0fc5e (4 bytes)
%Program Files%\Adobe\Reader 9.0\Reader\plug_ins3d (4 bytes)
C:\PROGRAM FILES (120 bytes)
%WinDir%\Help\Tours\WindowsMediaPlayer\Img (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\History\History.IE5\index.dat (16 bytes)
%WinDir%\assembly\NativeImages_v4.0.30319_32 (4 bytes)
%WinDir%\SoftwareDistribution\Download\bc81666f3868f34642e3f5adbc2719f9 (4 bytes)
%Documents and Settings% (8 bytes)
%Documents and Settings%\Default User\Local Settings (4 bytes)
%WinDir%\$hf_mig$ (8 bytes)
%System%\spool\XPSEP\amd64 (4 bytes)
%WinDir%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Security\Roles (4 bytes)
%System%\wbem\Repository\FS (12 bytes)
%WinDir%\ime\imjp8_1 (4 bytes)
%WinDir%\SoftwareDistribution\Download\e8252bbfa91fcf5afb38775b18691074 (4 bytes)
%Program Files%\Adobe\Reader 9.0\Resource (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\E_4\internet.fne (2019 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\E_4\spec.fne (1803 bytes)
%Documents and Settings%\LocalService\Application Data\Microsoft (4 bytes)
%WinDir%\Help\Tours\WindowsMediaPlayer (4 bytes)
%Documents and Settings%\NetworkService (4 bytes)
%WinDir%\SoftwareDistribution\Download\c656e6c592787a464f852186d6e0b466 (4 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0 (8 bytes)
%WinDir%\SoftwareDistribution\Download\8bb5f1c638778df6b77d80bc61ffc63c (4 bytes)
%WinDir%\SoftwareDistribution\Download\b91377d1d56820d9d699c0c2dc7c8e80 (4 bytes)
%Program Files%\Adobe\Reader 9.0\Reader\READER_SL.EXE (1364 bytes)
%WinDir%\SoftwareDistribution\Download\30438597a812a5d1d7979088d451747f (4 bytes)
%System%\oobe (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Microsoft (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\E_4\RegEx.fnr (3843 bytes)
%Program Files%\Microsoft Office\Office14 (4 bytes)
%WinDir%\Temp (4 bytes)
%WinDir%\Installer (8 bytes)
%WinDir%\ime (4 bytes)
%WinDir%\SoftwareDistribution\Download\ee4e3d4bf0d346e1b8fdee8197195e59 (4 bytes)
%WinDir%\SoftwareDistribution\Download\211409fc1d99b95b32fb0344cad140df (4 bytes)
%WinDir%\SoftwareDistribution\Download\dffcab319e36b852e5b2d51802010a7a (4 bytes)
%System%\wbem\Repository\FS\OBJECTS.DATA (2312 bytes)
%WinDir%\SoftwareDistribution\Download\299840a657dd26ca3bbf3cee3ec999ba (4 bytes)
%WinDir%\Temp\Perflib_Perfdata_428.dat (100 bytes)
%WinDir%\Temp\Perflib_Perfdata_7ac.dat (24 bytes)
%WinDir%\pchealth\helpctr (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\E_4\eAPI.fne (1425 bytes)
%WinDir%\SoftwareDistribution\Download\e5c5fc9bd7a4957f0a45c6db2957c5c9 (4 bytes)
%WinDir%\Microsoft.NET\Framework\v3.0\Windows Communication Foundation (4 bytes)
%Program Files%\Common Files\Java\Java Update\jusched.exe (1612 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0 (8 bytes)
%WinDir%\SoftwareDistribution\Download\906245b7f0992255b054322b77475594 (4 bytes)
%Documents and Settings%\Default User\Start Menu\Programs\Accessories (4 bytes)
%WinDir%\ime\imkr6_1 (4 bytes)
%WinDir%\pchealth\helpctr\System\sysinfo\graphics (4 bytes)
%WinDir%\SoftwareDistribution\Download\022593ca08eb4cd8e9681a7116f902d9 (4 bytes)
%WinDir%\SoftwareDistribution\Download\cb88a2f03b29735db957d61a63df6504 (4 bytes)
%WinDir%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Providers (4 bytes)
%WinDir%\SoftwareDistribution\Download\21156e54b0f0f47f81dab4a39e109501 (4 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5 (20 bytes)
%Documents and Settings%\All Users\Documents\My Music (4 bytes)
%WinDir%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client (8 bytes)
%WinDir%\SoftwareDistribution\Download\c263092dccc247f68a43cfee93ecc72d (4 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment (4 bytes)
%Program Files%\Common Files\Adobe\ARM\1.0\AdobeARM.exe (3111 bytes)
%WinDir%\Web (4 bytes)
C:\totalcmd (4 bytes)
%Program Files%\Common Files\System (4 bytes)
%Program Files%\Windows Media Player (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\index.dat (12 bytes)
%WinDir%\SoftwareDistribution\Download\aadd6ccc4585cbf4ee04287eb0e679df (4 bytes)
%WinDir%\AppPatch (4 bytes)
%WinDir%\Microsoft.NET\Framework\v2.0.50727\CONFIG (4 bytes)
%WinDir%\SoftwareDistribution\Download\6b7f938fb3db15dab273f3f1702c318c (4 bytes)
%Documents and Settings%\%current user%\Application Data (12 bytes)
%WinDir%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 (384 bytes)
%WinDir%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles (8 bytes)
%WinDir%\pchealth\helpctr\Config (4 bytes)
%WinDir%\msagent (4 bytes)
%System%\spec.fne (601 bytes)
%Program Files%\Movie Maker\Shared (4 bytes)
%WinDir%\SoftwareDistribution\Download\bc8ea6c22fd142de8dd67336d23310cf (4 bytes)
%System%\wbem (1652 bytes)
%WinDir%\SoftwareDistribution\Download\1c47f41cc76cde4c629564d7564f2795 (4 bytes)
%WinDir%\SoftwareDistribution\Download\57b4b90cc3eead9f6c29b58581d03ae4 (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Cookies\index.dat (16 bytes)
%WinDir%\SoftwareDistribution\Download\21cbd3f70584651805685eba1753505f (4 bytes)
%Documents and Settings%\%current user%\Start Menu\Programs (12 bytes)
%WinDir%\SoftwareDistribution\Download\b6f4642d2b8dc03c5ce1b1a4f77b1bda (4 bytes)
%Program Files%\Adobe\Reader 9.0\Reader (288 bytes)
%WinDir%\SoftwareDistribution\Download\9460002f6d8231358fc1eb590f9b1dce (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Temporary Internet Files\Content.IE5\index.dat (400 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft (4 bytes)
%WinDir%\Microsoft.NET\Framework (96 bytes)
%System%\mui (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\E_4 (12 bytes)
%WinDir%\REGISTRATION (8 bytes)
%System%\spool\XPSEP\i386 (4 bytes)
%WinDir%\SoftwareDistribution\Download\de81b460c3abcfc5b8494c785a5f3944 (4 bytes)
%WinDir%\SoftwareDistribution\Download\2c95b28351986132d7f36dd28eece9b0 (4 bytes)
%System%\wbem\Logs\wbemess.log (672 bytes)
%System%\config\systemprofile\Start Menu\Programs (4 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\index.dat (1021 bytes)
%System%\wbem\Repository\FS\INDEX.BTR (4790 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\001F73B2_Rar\XP-2CF7370F.EXE (5624 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\001E60BB_Rar\%original file name%.exe (5488 bytes)
%Documents and Settings%\%current user%\Local Settings (56 bytes)
%WinDir%\Microsoft.NET\assembly\GAC_MSIL (28 bytes)
%WinDir%\SoftwareDistribution\Download\9cf59263a134ab3fbbee78365a2fa5fc (4 bytes)
%WinDir%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\AppConfig (4 bytes)
%System%\config\systemprofile\Start Menu\Programs\Accessories (4 bytes)
%WinDir%\WinSxS\Policies\x86_Policy.6.0.Microsoft.Windows.Common-Controls_6595b64144ccf1df_x-ww_5ddad775 (4 bytes)
%WinDir%\assembly\NativeImages_v2.0.50727_32 (4 bytes)
%WinDir%\SoftwareDistribution\Download\bc529fa49cb2cb097fdf1e22d25872da (4 bytes)
%Documents and Settings%\%current user%\Start Menu\Programs\Startup\¡¡¡¡¡¡.lnk (8 bytes)
%WinDir%\SoftwareDistribution\Download\e104dcd29adf1c6c473a5efad2d509be (4 bytes)
%Program Files%\Adobe\Reader 9.0 (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Program Files%\Common Files\Java\JAVA UPDATE (4 bytes)
%Program Files%\Common Files\Adobe\ARM\1.0 (4 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Acrobat\9.0 (12 bytes)
%System%\drivers (1184 bytes)
%WinDir%\Microsoft.NET\Framework\v2.0.50727 (1848 bytes)
%Documents and Settings%\%current user% (60 bytes)
%Program Files%\Common Files\Microsoft Shared\DW (4 bytes)
%System%\RegEx.fnr (1281 bytes)
%WinDir%\SoftwareDistribution\Download\07a96de176867bc25b7dc839d22b07e2 (4 bytes)
%WinDir%\SoftwareDistribution\Download\8cac00e8efc87d728c0261686f85c975 (4 bytes)
%WinDir%\SoftwareDistribution\Download\d48a3b967ba5709df048e8f2a49cf8a6 (4 bytes)
%Documents and Settings%\%current user%\Local Settings\APPLICATION DATA (4 bytes)
%Documents and Settings%\NetworkService\Application Data\Microsoft (4 bytes)
%WinDir%\SoftwareDistribution\Download\cedca0128a48437390192d906f83a717 (4 bytes)
%WinDir%\Help (248 bytes)
%WinDir%\security (4 bytes)
%WinDir%\SoftwareDistribution\Download\a4c07d9275eb613d842cb1e140d8a426 (4 bytes)
%WinDir%\pchealth\helpctr\System\sysinfo (4 bytes)
%System%\config\systemprofile (4 bytes)
%WinDir%\SoftwareDistribution\Download\17e46901add634f15d293735648771e6 (4 bytes)
%WinDir%\SoftwareDistribution\Download\50e2c72fd814d3841e776dd2c4918260 (4 bytes)
%WinDir%\SoftwareDistribution\Download\c0e4033a7ec549e982572f0d830cf5d0 (4 bytes)
%WinDir%\SoftwareDistribution\Download\0000894bab70b145c3629920ba907f7a (4 bytes)
%WinDir%\SoftwareDistribution\Download\cd75fc2c9aa3d47009fe2d95c9f43154 (4 bytes)
%WinDir%\SoftwareDistribution\Download\0c1e5e0ffeb238b1ee5c9ea3a4878374 (4 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft (4 bytes)
%WinDir%\Web\printers (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\temp_wincheck.txt (2020 bytes)
%System%\config\systemprofile\Local Settings (4 bytes)
%WinDir%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Security (4 bytes)
%WinDir%\SoftwareDistribution\Download\78cf8552430e25a8f24bc1e4dfb1970e (4 bytes)
%Program Files%\Internet Explorer (4 bytes)
%System%\eAPI.fne (1425 bytes)
%WinDir%\SoftwareDistribution\Download\8b9a83d2cde55eb19dc502cc2dd04e0d (4 bytes)
%WinDir%\SoftwareDistribution\Download\f2adb0f8440e5dbd459aa6bfcaed1ba5 (4 bytes)
%Program Files%\Reference Assemblies\Microsoft\Framework\v3.5 (4 bytes)
%WinDir%\Microsoft.NET\Framework\v3.5 (12 bytes)
%Documents and Settings%\LocalService\Local Settings (4 bytes)
%Program Files%\COMMON FILES (12 bytes)
%WinDir%\SoftwareDistribution\Download\23e79e5fb28793d8cb1c2055b0d8dcb9 (4 bytes)
%Program Files%\Common Files\Microsoft Shared (4 bytes)
%Documents and Settings%\All Users\Documents\My Music\Sample Playlists (4 bytes)
%Documents and Settings%\Default User\Start Menu\Programs (4 bytes)
%WinDir%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Security\Wizard (4 bytes)
%Documents and Settings%\LocalService\Local Settings\Temporary Internet Files\Content.IE5 (4 bytes)
%Program Files%\Adobe\Reader 9.0\Reader\plug_ins (4 bytes)
%System%\oobe\html\mouse (4 bytes)
%WinDir%\SoftwareDistribution\Download\abaf10b7d55d3716fbb63e0b568cb4b6 (4 bytes)
%System%\com.run (1425 bytes)
%Documents and Settings%\Default User\Application Data\Microsoft (4 bytes)
%WinDir%\SoftwareDistribution\Download\163d01893aa68b49abc63d8d6c9a7bb2 (4 bytes)
%System%\dp1.fne (601 bytes)
%WinDir%\assembly (4 bytes)
%System%\internet.fne (673 bytes)

The Dropped deletes the following file(s):

%System%\wininet.dll (0 bytes)

The process Rundll32.exe:332 makes changes in the file system.


The Dropped creates and/or writes to the following file(s):

%Program Files%\AAV\CDriver.sys (11 bytes)

The Dropped deletes the following file(s):

%Program Files%\AAV\CDriver.sys (0 bytes)
%Program Files%\AAV (0 bytes)

The process XP-2CF7370F.EXE:4088 makes changes in the file system.


The Dropped creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\E_4\spec.fne (73 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\History\History.IE5\desktop.ini (159 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\001F73B2_Rar\XP-2CF7370F.EXE (10815 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Temporary Internet Files\Content.IE5\CXMFWL23\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Temporary Internet Files\Content.IE5\P9FH448M\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Temporary Internet Files\Content.IE5\G92JG5YB\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Temporary Internet Files\Content.IE5\4DIFKT2N\desktop.ini (67 bytes)

The process %original file name%.exe:272 makes changes in the file system.


The Dropped creates and/or writes to the following file(s):

%System%\system.exe (1678 bytes)
C:\%original file name%.exe (11433 bytes)

The process %original file name%.exe:3808 makes changes in the file system.


The Dropped creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\E_4\dp1.fne (114 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\E_4\krnln.fnr (5442 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\001E60BB_Rar\%original file name%.exe (10815 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\E_4\spec.fne (73 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\E_4\shell.fne (40 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\E_4\internet.fne (184 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\E_4\com.run (270 bytes)
%System%\XP-542ADE6B.EXE (9606 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\E_4\RegEx.fnr (217 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\E_4\eAPI.fne (323 bytes)

Registry activity

The process XP-542ADE6B.EXE:3884 makes changes in the system registry.


The Dropped creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 17 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Start Menu" = "%Documents and Settings%\All Users\Start Menu"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache]
"@xpsp3res.dll,-20001" = "Diagnose Connection Problems..."

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
"Startup" = "%Documents and Settings%\%current user%\Start Menu\Programs\Startup"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonMusic" = "%Documents and Settings%\All Users\Documents\My Music"
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"My Pictures" = "%Documents and Settings%\%current user%\My Documents\My Pictures"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Start Menu" = "%Documents and Settings%\%current user%\Start Menu"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonVideo" = "%Documents and Settings%\All Users\Documents\My Videos"
"CommonPictures" = "%Documents and Settings%\All Users\Documents\My Pictures"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "0D 2C D4 C5 4E 2B 76 21 F9 EB E3 CC 15 37 58 67"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

The Dropped modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Dropped modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Dropped modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

The Dropped deletes the following registry key(s):

[HKCU\Software\Microsoft\Internet Explorer\TypedURLs]

The Dropped deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process sc.exe:832 makes changes in the system registry.


The Dropped creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "CF 77 5C EA 7A 87 F9 68 28 2F BB BE CD 12 30 84"

The process sc.exe:2044 makes changes in the system registry.


The Dropped creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "C4 70 13 40 6F B2 28 E4 93 A1 89 DC 8E 42 E7 9F"

The process sc.exe:888 makes changes in the system registry.


The Dropped creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "8F 5B 3E BF F9 C3 66 36 B3 F8 F3 43 5A 1B 48 D1"

The process sc.exe:1732 makes changes in the system registry.


The Dropped creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "E6 0C 40 28 7B 04 45 86 45 A8 77 48 DF 24 03 05"

The process sc.exe:1596 makes changes in the system registry.


The Dropped creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "84 4C 3D 4C 9B 8D 67 39 74 FF 76 1A A7 EC 31 CD"

The process sc.exe:1864 makes changes in the system registry.


The Dropped creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "64 E3 23 F7 DC AC 4A 0A 12 C7 10 EE 6A 39 24 90"

The process sc.exe:1512 makes changes in the system registry.


The Dropped creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "69 CD C8 D4 B9 8C 71 11 F0 27 43 2F 92 DF E3 45"

The process net1.exe:1284 makes changes in the system registry.


The Dropped creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "47 6D A0 51 4C E6 E4 DD E5 0C 29 44 B1 75 91 5B"

The process net1.exe:176 makes changes in the system registry.


The Dropped creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "CB CC C4 FF DB 2F 23 7C 9C A7 6B C9 7B 62 3F DA"

The process system.exe:1452 makes changes in the system registry.


The Dropped creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Security Center]
"UacDisableNotify" = "1"

[HKCU\Software\Stvncyfrlda]
"m4_0" = "0"
"m3_1" = "1718420804"
"m3_0" = "17001001"
"m4_4" = "2646195636"

[HKCU\Software\Stvncyfrlda\168128873]
"-1648771660" = "30"

[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DoNotAllowExceptions" = "0"

[HKCU\Software\Stvncyfrlda]
"m2_2" = "3470576471"
"m2_3" = "910908362"
"m2_0" = "5517"
"m2_1" = "1735293664"
"m4_2" = "3470581466"
"m2_4" = "2646190137"
"m3_3" = "927474798"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system]
"EnableLUA" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"GlobalUserOffline" = "0"

[HKCU\Software\Stvncyfrlda\168128873]
"1735290733" = "10"

[HKLM\SOFTWARE\Microsoft\Security Center]
"AntiVirusOverride" = "1"

[HKLM\SOFTWARE\Microsoft\Security Center\Svc]
"UpdatesDisableNotify" = "1"

[HKLM\SOFTWARE\Microsoft\Security Center]
"UpdatesDisableNotify" = "1"

[HKCU\Software\Stvncyfrlda]
"m4_1" = "1735290733"
"m3_4" = "2629490589"
"m3_2" = "3487544563"
"m1_4" = "2043211597"

[HKLM\SOFTWARE\Microsoft\Security Center]
"FirewallOverride" = "1"

[HKCU\Software\Stvncyfrlda]
"m1_0" = "1431655765"
"m1_3" = "553799287"
"m1_2" = "2322242303"
"m1_1" = "692605188"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "40 69 D6 27 0E 26 51 FE 5D 49 E3 5D A1 93 1D C1"

[HKLM\SOFTWARE\Microsoft\Security Center\Svc]
"UacDisableNotify" = "1"

[HKCU\Software\Stvncyfrlda\168128873]
"-737866757" = "B5F225269A94E53FC892A47837AA894DC328B93497A79B2314ED91820160186D68B0C00F755B6C4CC0387FE313BCD8D6A58BA3DAC431743BD392A7C563199B44081248F6152FF724A95C2A765BC10968C4C2CEB0E53CA7A69DF35475F09D93B33BBFD2535C074E8B250CBD55F902269A0499E93F6673CA91491C5F7958DA144FFE25D17026723A8E189A46E61A2E234BE756D5FDB61638EA7E40E047C94DC49DDE7F265E48F42E1DC434C124478FA6F299E3C23263AA4B00D376398B465A46307BB521E13A901AF5D16F5D5954D69A2C8961E99DE65697374A10C867AAED3F5FC5420667FAD8192B34153E5A156C2DAFA208CFDC8241F114EAC26543EDACBB08"
"-824385830" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced]
"Hidden" = "2"

[HKLM\SOFTWARE\Microsoft\Security Center\Svc]
"FirewallOverride" = "1"

[HKCU\Software\Stvncyfrlda\168128873]
"910904903" = "0"
"1821809806" = "0200687474703A2F2F7061647275702E636F6D2F736F62616B612E6173707800687474703A2F2F6B756B75312E696E666F696572"

[HKLM\SOFTWARE\Microsoft\Security Center]
"FirewallDisableNotify" = "1"
[HKCU\Software\Stvncyfrlda]
"m4_3" = "910904903"

[HKLM\SOFTWARE\Microsoft\Security Center\Svc]
"FirewallDisableNotify" = "1"
[HKCU\Software\Stvncyfrlda\168128873]
"86519073" = "53"

[HKLM\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = "1"

Firewall notifications are disabled:

[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = "1"

Antivirus notifications are disabled:

[HKLM\SOFTWARE\Microsoft\Security Center]
"AntiVirusDisableNotify" = "1"

[HKLM\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusDisableNotify" = "1"

A firewall is disabled:

[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = "0"

Adds a rule to the firewall Windows which allows any network activity:

[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\%WinDir%\System32]
"system.exe" = "%System%\system.exe:*:Enabled:ipsec"

The process net.exe:1096 makes changes in the system registry.


The Dropped creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "D4 DB 53 05 BA E9 81 A9 E6 86 AF E3 B1 7B 23 D0"

The process net.exe:1844 makes changes in the system registry.


The Dropped creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "79 2B 97 3B 63 8F 85 2A 1F 19 87 F9 B6 F0 FB AF"

The process Rundll32.exe:1364 makes changes in the system registry.


The Dropped creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 16 00 00 00 01 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "F2 38 5E 63 09 F6 2B 98 AE AE F2 02 9C 99 66 A8"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

The Dropped modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Dropped modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Dropped modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

To automatically run itself each time Windows is booted, the Dropped adds the following link to its file to the system registry autorun key:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"System" = "%System%\system.exe"

The Dropped deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process Rundll32.exe:332 makes changes in the system registry.


The Dropped creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "79 15 C7 3B 25 60 81 06 F4 4D 62 DB 95 F3 8B D0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%System%]
"sc.exe" = "A tool to aid in developing services for WindowsNT"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

The Dropped modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass" = "1"

The Dropped modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

"UNCAsIntranet" = "1"

The Dropped modifies IE settings for security zones to map all urls to the Intranet Zone:

"IntranetName" = "1"

The process XP-2CF7370F.EXE:4088 makes changes in the system registry.


The Dropped creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "2A B7 E8 EA E5 BE 17 94 6A A5 52 15 4D 60 5C D9"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

To automatically run itself each time Windows is booted, the Dropped adds the following link to its file to the system registry autorun key:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"XP-542ADE6B" = "%System%\XP-542ADE6B.EXE"

The process %original file name%.exe:3808 makes changes in the system registry.


The Dropped creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "57 48 CF 27 5A 4B 6F 41 6E 25 1B B3 50 42 6B D1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

Dropped PE files

MD5 File path
692a7e8f9b64a7e274f374d19249e43ec:\%original file name%.exe
af1ad9f373feae93694010619390ba08c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\001E60BB_Rar\%original file name%.exe
692a7e8f9b64a7e274f374d19249e43ec:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\001E67FF_Rar\XP-542ADE6B.EXE
7a4f775abb2f1c97def3e73afa2faeddc:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\B2.tmp
895dd12a54a923789f8f1d8b66bd88e9c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\E_4\RegEx.fnr
95ebaae66a69f881f2fa08c71952ce72c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\E_4\com.run
c57939798d01772689b016fcf3eae47ec:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\E_4\dp1.fne
c23c63a788d8ca38d955f5baebef719fc:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\E_4\eAPI.fne
b0c160001c8e88f403bf03af1059bd38c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\E_4\internet.fne
38dccb9d4114a3c2dd0003f6233bac77c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\E_4\krnln.fnr
c8208124af35856e0eba72d33620799bc:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\E_4\shell.fne
600e6bb9bdbd8f2f19e123d8e5300718c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\E_4\spec.fne
895dd12a54a923789f8f1d8b66bd88e9c:\WINDOWS\system32\RegEx.fnr
692a7e8f9b64a7e274f374d19249e43ec:\WINDOWS\system32\XP-542ADE6B.EXE
95ebaae66a69f881f2fa08c71952ce72c:\WINDOWS\system32\com.run
c57939798d01772689b016fcf3eae47ec:\WINDOWS\system32\dp1.fne
c23c63a788d8ca38d955f5baebef719fc:\WINDOWS\system32\eAPI.fne
b0c160001c8e88f403bf03af1059bd38c:\WINDOWS\system32\internet.fne
38dccb9d4114a3c2dd0003f6233bac77c:\WINDOWS\system32\krnln.fnr
eb26752ac1f113c9b91cf26ff63eeb08c:\WINDOWS\system32\sgdvet.dll
c8208124af35856e0eba72d33620799bc:\WINDOWS\system32\shell.fne
600e6bb9bdbd8f2f19e123d8e5300718c:\WINDOWS\system32\spec.fne
f54649e626384249c74775d3a30fa254c:\WINDOWS\system32\system.exe
f3612075a0b4bacd5a0a7e20060c962dc:\WINDOWS\system32\uquqet.dll

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

A worm can spread via removable drives. It writes its executable and creates "autorun.inf" scripts on all removable drives. The autorun script will execute the Dropped's file once a user opens a drive's folder in Windows Explorer.

Removals

Remove it with Ad-Aware

  1. Click (here) to download and install Ad-Aware Free Antivirus.
  2. Update the definition files.
  3. Run a full scan of your computer.

Manual removal*

  1. Terminate malicious process(es) (How to End a Process With the Task Manager):

    sc.exe:832
    sc.exe:2044
    sc.exe:888
    sc.exe:1732
    sc.exe:1596
    sc.exe:1864
    sc.exe:1512
    net1.exe:1284
    net1.exe:176
    system.exe:1452
    net.exe:1096
    net.exe:1844
    Rundll32.exe:332
    XP-2CF7370F.EXE:4088
    %original file name%.exe:3808

  2. Delete the original Dropped file.
  3. Delete or disinfect the following files created/modified by the Dropped:

    %Documents and Settings%\%current user%\Local Settings\Temp\001E67FF_Rar\XP-542ADE6B.EXE (10815 bytes)
    %System%\com.run (1425 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\E_4\internet.fne (184 bytes)
    %System%\spec.fne (601 bytes)
    %System%\RegEx.fnr (1281 bytes)
    %Documents and Settings%\%current user%\Local Settings\History\History.IE5\MSHist012013021120130218\index.dat (202 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\E_4\spec.fne (73 bytes)
    %System%\ul.dll (3856 bytes)
    %System%\XP-2CF7370F.EXE (9606 bytes)
    %Documents and Settings%\%current user%\Cookies\Current_User@baidu[2].txt (389 bytes)
    %System%\og.dll (2728 bytes)
    %System%\eAPI.fne (1425 bytes)
    %System%\dp1.fne (601 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\E_4\eAPI.fne (323 bytes)
    %Documents and Settings%\%current user%\Cookies\Current_User@baidu[1].txt (194 bytes)
    %System%\internet.fne (673 bytes)
    %System%\og.EDT (2008 bytes)
    %Documents and Settings%\%current user%\Local Settings\History\History.IE5\index.dat (266 bytes)
    %Documents and Settings%\%current user%\Start Menu\Programs\Startup\¡¡¡¡¡¡.lnk (1250 bytes)
    %Documents and Settings%\%current user%\Cookies\index.dat (776 bytes)
    %System%\krnln.fnr (7433 bytes)
    %System%\shell.fne (40 bytes)
    %Documents and Settings%\%current user%\Local Settings\History\History.IE5\MSHist012013030120130302\index.dat (202 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\E_4\RegEx.fnr (217 bytes)
    %Documents and Settings%\%current user%\Local Settings\History\History.IE5\MSHist012013021820130225\index.dat (202 bytes)
    %WinDir%\system.ini (72 bytes)
    %System%\uquqet.dll (76 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\ktvm.exe (561 bytes)
    %System%\sgdvet.dll (22 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\wintilnkr.exe (561 bytes)
    C:\totalcmd\TOTALCMD.EXE (854 bytes)
    %System%\CatRoot2 (96 bytes)
    %WinDir%\SoftwareDistribution (4 bytes)
    %WinDir%\pchealth\helpctr\System\images (4 bytes)
    %WinDir%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US (4 bytes)
    %WinDir%\SoftwareDistribution\Download\36a2296f631a54daefcc3b56e3d990e2 (4 bytes)
    %WinDir%\pchealth\helpctr\System\Remote Assistance (4 bytes)
    %WinDir%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance (4 bytes)
    %WinDir%\SoftwareDistribution\Download\2e6b16219034e135b4f869efb7a10fee (4 bytes)
    C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\Perflib_Perfdata_80.dat (100 bytes)
    %WinDir%\pchealth\helpctr\System\panels (4 bytes)
    %Program Files%\WINDOWS NT (4 bytes)
    %Documents and Settings%\All Users\Start Menu\Programs (8 bytes)
    %WinDir%\SoftwareDistribution\Download\6a410a1bd174bc123056d235ac4829af (4 bytes)
    %WinDir%\Microsoft.NET\Framework\v4.0.30319 (1732 bytes)
    %Documents and Settings%\Default User (540 bytes)
    %WinDir%\SoftwareDistribution\Download\248802b74506342031e926839639c729 (4 bytes)
    C:\$Directory (4308 bytes)
    %System%\config (548 bytes)
    %WinDir%\assembly\NativeImages_v2.0.50727_32\PresentationFramewo# (4 bytes)
    %Documents and Settings%\All Users\Application Data (4 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\001F8B22_Rar\wincheck.exe (12191 bytes)
    %WinDir%\SoftwareDistribution\Download\01229cf5dcf0df67992cac35a2ba0b3f (4 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\B2.tmp (4545 bytes)
    %WinDir%\SoftwareDistribution\Download\85947e1a809663c7f480717673587a59 (4 bytes)
    %Documents and Settings%\All Users\Start Menu\Programs\ACCESSORIES (4 bytes)
    %WinDir%\assembly\GAC_32 (4 bytes)
    %WinDir%\SoftwareDistribution\Download\da2a33b6770f970d7fe7262040f98a4f (4 bytes)
    %Program Files%\Reference Assemblies\Microsoft\Framework\v3.0 (4 bytes)
    %System%\config\systemprofile\Application Data\Microsoft (4 bytes)
    %Program Files%\Adobe\Reader 9.0\Resource\Font (4 bytes)
    %WinDir%\Installer\$PatchCache$\Managed (4 bytes)
    %WinDir%\SoftwareDistribution\Download\b5f880834ad67f3d383ffff5f2fa46bd (4 bytes)
    %Program Files%\Common Files\VMware\Drivers (8 bytes)
    %WinDir%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Security\Permissions (4 bytes)
    %Program Files%\Common Files\Microsoft Shared\OFFICE14 (4 bytes)
    %WinDir%\Microsoft.NET\Framework\v4.0.30319\WPF (4 bytes)
    %WinDir%\Microsoft.NET\Framework\v3.0\WPF (4 bytes)
    %WinDir%\assembly\GAC_MSIL (36 bytes)
    %Documents and Settings%\%current user%\MY DOCUMENTS (8 bytes)
    %Documents and Settings%\NetworkService\Local Settings (4 bytes)
    %Documents and Settings%\All Users\DOCUMENTS (4 bytes)
    %WinDir%\WinSxS\Policies (8 bytes)
    %System%\oobe\html (4 bytes)
    %WinDir%\SoftwareDistribution\Download\f0fea42f69058000617da24986c3b109 (4 bytes)
    %WinDir%\assembly\NativeImages_v4.0.30319_32\PresentationFramewo# (4 bytes)
    %Documents and Settings%\%current user%\Start Menu\Programs\ACCESSORIES (4 bytes)
    %WinDir%\SoftwareDistribution\Download\196fa81559690e2494e56094df51cdd8 (4 bytes)
    %Documents and Settings%\%current user%\Favorites (4 bytes)
    %WinDir%\SoftwareDistribution\Download\621a08ac003b616bcaa86aa4d4292d50 (4 bytes)
    %Documents and Settings%\ALL USERS (8 bytes)
    %Program Files%\Movie Maker (4 bytes)
    %WinDir%\Microsoft.NET\assembly\GAC_32 (4 bytes)
    %WinDir%\Microsoft.NET\Framework\v3.0\Windows Workflow Foundation (4 bytes)
    %Documents and Settings%\LocalService (4 bytes)
    %WinDir%\SoftwareDistribution\Download\c0c52c03306062533f7dcb087bfcfa6b (4 bytes)
    %WinDir%\SoftwareDistribution\Download\7dc26e8888d68d9e04bc52940c0f24b5 (4 bytes)
    %WinDir%\pchealth\helpctr\OfflineCache (4 bytes)
    %WinDir%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Security\Users (4 bytes)
    %WinDir%\SoftwareDistribution\Download\e0c0da396303f1dd2c82cd2ccc07020d (4 bytes)
    %WinDir%\SoftwareDistribution\Download\e79028ac4f02e201b61b2c632cb0fc5e (4 bytes)
    %Program Files%\Adobe\Reader 9.0\Reader\plug_ins3d (4 bytes)
    C:\PROGRAM FILES (120 bytes)
    %WinDir%\Help\Tours\WindowsMediaPlayer\Img (4 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\History\History.IE5\index.dat (16 bytes)
    %WinDir%\SoftwareDistribution\Download\bc81666f3868f34642e3f5adbc2719f9 (4 bytes)
    %Documents and Settings%\Default User\Local Settings (4 bytes)
    %WinDir%\$hf_mig$ (8 bytes)
    %System%\spool\XPSEP\amd64 (4 bytes)
    %WinDir%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Security\Roles (4 bytes)
    %System%\wbem\Repository\FS (12 bytes)
    %WinDir%\ime\imjp8_1 (4 bytes)
    %WinDir%\SoftwareDistribution\Download\e8252bbfa91fcf5afb38775b18691074 (4 bytes)
    %Documents and Settings%\LocalService\Application Data\Microsoft (4 bytes)
    %WinDir%\SoftwareDistribution\Download\c656e6c592787a464f852186d6e0b466 (4 bytes)
    %Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0 (8 bytes)
    %WinDir%\SoftwareDistribution\Download\8bb5f1c638778df6b77d80bc61ffc63c (4 bytes)
    %WinDir%\SoftwareDistribution\Download\b91377d1d56820d9d699c0c2dc7c8e80 (4 bytes)
    %Program Files%\Adobe\Reader 9.0\Reader\READER_SL.EXE (1364 bytes)
    %WinDir%\SoftwareDistribution\Download\30438597a812a5d1d7979088d451747f (4 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Microsoft (4 bytes)
    %Program Files%\Microsoft Office\Office14 (4 bytes)
    %WinDir%\Temp (4 bytes)
    %WinDir%\SoftwareDistribution\Download\ee4e3d4bf0d346e1b8fdee8197195e59 (4 bytes)
    %WinDir%\SoftwareDistribution\Download\211409fc1d99b95b32fb0344cad140df (4 bytes)
    %WinDir%\SoftwareDistribution\Download\dffcab319e36b852e5b2d51802010a7a (4 bytes)
    %System%\wbem\Repository\FS\OBJECTS.DATA (2312 bytes)
    %WinDir%\SoftwareDistribution\Download\299840a657dd26ca3bbf3cee3ec999ba (4 bytes)
    %WinDir%\Temp\Perflib_Perfdata_428.dat (100 bytes)
    %WinDir%\Temp\Perflib_Perfdata_7ac.dat (24 bytes)
    %WinDir%\SoftwareDistribution\Download\e5c5fc9bd7a4957f0a45c6db2957c5c9 (4 bytes)
    %WinDir%\Microsoft.NET\Framework\v3.0\Windows Communication Foundation (4 bytes)
    %Program Files%\Common Files\Java\Java Update\jusched.exe (1612 bytes)
    %Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0 (8 bytes)
    %WinDir%\SoftwareDistribution\Download\906245b7f0992255b054322b77475594 (4 bytes)
    %Documents and Settings%\Default User\Start Menu\Programs\Accessories (4 bytes)
    %WinDir%\ime\imkr6_1 (4 bytes)
    %WinDir%\pchealth\helpctr\System\sysinfo\graphics (4 bytes)
    %WinDir%\SoftwareDistribution\Download\022593ca08eb4cd8e9681a7116f902d9 (4 bytes)
    %WinDir%\SoftwareDistribution\Download\cb88a2f03b29735db957d61a63df6504 (4 bytes)
    %WinDir%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Providers (4 bytes)
    %WinDir%\SoftwareDistribution\Download\21156e54b0f0f47f81dab4a39e109501 (4 bytes)
    %Documents and Settings%\All Users\Documents\My Music (4 bytes)
    %WinDir%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client (8 bytes)
    %WinDir%\SoftwareDistribution\Download\c263092dccc247f68a43cfee93ecc72d (4 bytes)
    %Program Files%\Common Files\Adobe\ARM\1.0\AdobeARM.exe (3111 bytes)
    %WinDir%\Web (4 bytes)
    %Program Files%\Common Files\System (4 bytes)
    %Program Files%\Windows Media Player (4 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\index.dat (12 bytes)
    %WinDir%\SoftwareDistribution\Download\aadd6ccc4585cbf4ee04287eb0e679df (4 bytes)
    %WinDir%\AppPatch (4 bytes)
    %WinDir%\Microsoft.NET\Framework\v2.0.50727\CONFIG (4 bytes)
    %WinDir%\SoftwareDistribution\Download\6b7f938fb3db15dab273f3f1702c318c (4 bytes)
    %WinDir%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 (384 bytes)
    %WinDir%\pchealth\helpctr\Config (4 bytes)
    %WinDir%\msagent (4 bytes)
    %Program Files%\Movie Maker\Shared (4 bytes)
    %WinDir%\SoftwareDistribution\Download\bc8ea6c22fd142de8dd67336d23310cf (4 bytes)
    %WinDir%\SoftwareDistribution\Download\1c47f41cc76cde4c629564d7564f2795 (4 bytes)
    %WinDir%\SoftwareDistribution\Download\57b4b90cc3eead9f6c29b58581d03ae4 (4 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\Cookies\index.dat (16 bytes)
    %WinDir%\SoftwareDistribution\Download\21cbd3f70584651805685eba1753505f (4 bytes)
    %WinDir%\SoftwareDistribution\Download\b6f4642d2b8dc03c5ce1b1a4f77b1bda (4 bytes)
    %WinDir%\SoftwareDistribution\Download\9460002f6d8231358fc1eb590f9b1dce (4 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\Temporary Internet Files\Content.IE5\index.dat (400 bytes)
    %Documents and Settings%\%current user%\Application Data\Microsoft (4 bytes)
    %System%\mui (4 bytes)
    %WinDir%\REGISTRATION (8 bytes)
    %System%\spool\XPSEP\i386 (4 bytes)
    %WinDir%\SoftwareDistribution\Download\de81b460c3abcfc5b8494c785a5f3944 (4 bytes)
    %WinDir%\SoftwareDistribution\Download\2c95b28351986132d7f36dd28eece9b0 (4 bytes)
    %System%\wbem\Logs\wbemess.log (672 bytes)
    %System%\config\systemprofile\Start Menu\Programs (4 bytes)
    %System%\wbem\Repository\FS\INDEX.BTR (4790 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\001F73B2_Rar\XP-2CF7370F.EXE (5624 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\001E60BB_Rar\%original file name%.exe (5488 bytes)
    %WinDir%\Microsoft.NET\assembly\GAC_MSIL (28 bytes)
    %WinDir%\SoftwareDistribution\Download\9cf59263a134ab3fbbee78365a2fa5fc (4 bytes)
    %WinDir%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\AppConfig (4 bytes)
    %System%\config\systemprofile\Start Menu\Programs\Accessories (4 bytes)
    %WinDir%\WinSxS\Policies\x86_Policy.6.0.Microsoft.Windows.Common-Controls_6595b64144ccf1df_x-ww_5ddad775 (4 bytes)
    %WinDir%\SoftwareDistribution\Download\bc529fa49cb2cb097fdf1e22d25872da (4 bytes)
    %WinDir%\SoftwareDistribution\Download\e104dcd29adf1c6c473a5efad2d509be (4 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
    %Program Files%\Common Files\Java\JAVA UPDATE (4 bytes)
    %Documents and Settings%\%current user%\Application Data\Adobe\Acrobat\9.0 (12 bytes)
    %System%\drivers (1184 bytes)
    %Program Files%\Common Files\Microsoft Shared\DW (4 bytes)
    %WinDir%\SoftwareDistribution\Download\07a96de176867bc25b7dc839d22b07e2 (4 bytes)
    %WinDir%\SoftwareDistribution\Download\8cac00e8efc87d728c0261686f85c975 (4 bytes)
    %WinDir%\SoftwareDistribution\Download\d48a3b967ba5709df048e8f2a49cf8a6 (4 bytes)
    %Documents and Settings%\%current user%\Local Settings\APPLICATION DATA (4 bytes)
    %Documents and Settings%\NetworkService\Application Data\Microsoft (4 bytes)
    %WinDir%\SoftwareDistribution\Download\cedca0128a48437390192d906f83a717 (4 bytes)
    %WinDir%\security (4 bytes)
    %WinDir%\SoftwareDistribution\Download\a4c07d9275eb613d842cb1e140d8a426 (4 bytes)
    %WinDir%\SoftwareDistribution\Download\17e46901add634f15d293735648771e6 (4 bytes)
    %WinDir%\SoftwareDistribution\Download\50e2c72fd814d3841e776dd2c4918260 (4 bytes)
    %WinDir%\SoftwareDistribution\Download\c0e4033a7ec549e982572f0d830cf5d0 (4 bytes)
    %WinDir%\SoftwareDistribution\Download\0000894bab70b145c3629920ba907f7a (4 bytes)
    %WinDir%\SoftwareDistribution\Download\cd75fc2c9aa3d47009fe2d95c9f43154 (4 bytes)
    %WinDir%\SoftwareDistribution\Download\0c1e5e0ffeb238b1ee5c9ea3a4878374 (4 bytes)
    %Documents and Settings%\All Users\Application Data\Microsoft (4 bytes)
    %WinDir%\Web\printers (4 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\temp_wincheck.txt (2020 bytes)
    %System%\config\systemprofile\Local Settings (4 bytes)
    %WinDir%\SoftwareDistribution\Download\78cf8552430e25a8f24bc1e4dfb1970e (4 bytes)
    %Program Files%\Internet Explorer (4 bytes)
    %WinDir%\SoftwareDistribution\Download\8b9a83d2cde55eb19dc502cc2dd04e0d (4 bytes)
    %WinDir%\SoftwareDistribution\Download\f2adb0f8440e5dbd459aa6bfcaed1ba5 (4 bytes)
    %Program Files%\Reference Assemblies\Microsoft\Framework\v3.5 (4 bytes)
    %Documents and Settings%\LocalService\Local Settings (4 bytes)
    %Program Files%\COMMON FILES (12 bytes)
    %WinDir%\SoftwareDistribution\Download\23e79e5fb28793d8cb1c2055b0d8dcb9 (4 bytes)
    %Documents and Settings%\All Users\Documents\My Music\Sample Playlists (4 bytes)
    %WinDir%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Security\Wizard (4 bytes)
    %Documents and Settings%\LocalService\Local Settings\Temporary Internet Files\Content.IE5 (4 bytes)
    %System%\oobe\html\mouse (4 bytes)
    %WinDir%\SoftwareDistribution\Download\abaf10b7d55d3716fbb63e0b568cb4b6 (4 bytes)
    %Documents and Settings%\Default User\Application Data\Microsoft (4 bytes)
    %WinDir%\SoftwareDistribution\Download\163d01893aa68b49abc63d8d6c9a7bb2 (4 bytes)
    %Program Files%\AAV\CDriver.sys (11 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\desktop.ini (67 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\History\History.IE5\desktop.ini (159 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\Temporary Internet Files\Content.IE5\CXMFWL23\desktop.ini (67 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\Temporary Internet Files\Content.IE5\P9FH448M\desktop.ini (67 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\Temporary Internet Files\Content.IE5\G92JG5YB\desktop.ini (67 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\Temporary Internet Files\Content.IE5\4DIFKT2N\desktop.ini (67 bytes)
    %System%\system.exe (1678 bytes)
    C:\%original file name%.exe (11433 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\E_4\dp1.fne (114 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\E_4\krnln.fnr (5442 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\E_4\shell.fne (40 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\E_4\com.run (270 bytes)
    %System%\XP-542ADE6B.EXE (9606 bytes)

  4. Delete the following value(s) in the autorun key (How to Work with System Registry):

    [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "System" = "%System%\system.exe"

    [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "XP-542ADE6B" = "%System%\XP-542ADE6B.EXE"

  5. Find and delete all copies of the worm's file together with "autorun.inf" scripts on removable drives.
  6. Reboot the computer.
*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

VersionInfo

No information is available.

No information is available.

PE Sections

Name Virtual Address Virtual Size Raw Size Entropy Section MD5
.text409620924245764.83107c14ebfe9b7102feefe90d51cd4fc9a74
.rdata28672263440962.48317777ac25ec7bba2eed5c97e65e8a812c4
.data32768802481923.1859a435036dc64f4384cba8403e29007608
.data409601187841187844.7618567912e2d1b3c953806e669b1bdd6000
.rsrc15974494208942085.143655741bea6b6ad0476ee48dcdcdcd296cf
nnwhfa253952428881922.50431a7bacf087567384d270aad24341c84ed
2621443973123973125.11513f54649e626384249c74775d3a30fa254

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Network Activity

URLs

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

Map

The Dropped connects to the servers at the folowing location(s):

Strings from Dumps

%original file name%.exe_272:

.text

.text

.rdata

.rdata

.data

.data

.rsrc

.rsrc

MT/%f

MT/%f

user32.dll

user32.dll

KERNEL32.dll

KERNEL32.dll

USER32.dll

USER32.dll

GetCPInfo

GetCPInfo

.aUf2y:

.aUf2y:

icmd\

icmd\

].nAk

].nAk

R'.qV

R'.qV

:Ga.AM

:Ga.AM

%x_#

%x_#

).Lr#

).Lr#

4R.Uw

4R.Uw

`.rdata

`.rdata

.reloc

.reloc

Please contact the application's support team for more information.

Please contact the application's support team for more information.

- Attempt to initialize the CRT more than once.

- Attempt to initialize the CRT more than once.

- CRT not initialized

- CRT not initialized

- floating point support not loaded

- floating point support not loaded

GetProcessWindowStation

GetProcessWindowStation

USER32.DLL

USER32.DLL

@.data

@.data

K200.exe

K200.exe

GetProcessHeap

GetProcessHeap

RegDeleteKeyA

RegDeleteKeyA

RegOpenKeyExA

RegOpenKeyExA

RegQueryInfoKeyA

RegQueryInfoKeyA

RegEnumKeyA

RegEnumKeyA

RegCloseKey

RegCloseKey

ADVAPI32.dll

ADVAPI32.dll

SETUPAPI.dll

SETUPAPI.dll

ExecuteModule.dll

ExecuteModule.dll

:):$:?:4:

:):$:?:4:

C@Y'''.YNLTXQ.'.On}bhnHgjxxEjfn.

C@Y'''.YNLTXQ.'.On}bhnHgjxxEjfn.

bhx'.YNLTO\DYO.';s:;; 0 MBGNTON]BHNTXNH^YNTD[NE

bhx'.YNLTO\DYO.';s:;; 0 MBGNTON]BHNTXNH^YNTD[NE

: 6 .Obx`Bo:.'''))

: 6 .Obx`Bo:.'''))

HOyb}ny%xrx 6 :''

HOyb}ny%xrx 6 :''

.FmlEjfn. 6 HOyb}nyTFml

.FmlEjfn. 6 HOyb}nyTFml

.HOyb}nyTOn}bhnOnxh.6HOyb}nyTOOB' !HOyb}ny

.HOyb}nyTOn}bhnOnxh.6HOyb}nyTOOB' !HOyb}ny

C@Y''E_F[Oyb}ny''HOyb}ny%xrx

C@Y''E_F[Oyb}ny''HOyb}ny%xrx

bde''.HOyb}nyTOn}bhnOnxh.

bde''.HOyb}nyTOn}bhnOnxh.

PHOyb}nyTOOB%E_%Xny}bhnxV

PHOyb}nyTOOB%E_%Xny}bhnxV

Jooxny}bhn 6 HOyb}ny' .MGLTJOOYNLTEDHGDIINY.' HOyb}nyTXny}bhn

Jooxny}bhn 6 HOyb}ny' .MGLTJOOYNLTEDHGDIINY.' HOyb}nyTXny}bhn

Obx{gjrEjfn 6 .HOyb}nyTX}hOnxh.

Obx{gjrEjfn 6 .HOyb}nyTX}hOnxh.

Xny}bhn_r{n 6 .XNY]BHNT@NYENGTOYB]NY.

Xny}bhn_r{n 6 .XNY]BHNT@NYENGTOYB]NY.

_r{n 6 .XNY]BHNTONFJEOTX_JY_.

_r{n 6 .XNY]BHNTONFJEOTX_JY_.

ydg 6 .XNY]BHNTNYYDYTEDYFJG.

ydg 6 .XNY]BHNTNYYDYTEDYFJG.

Xny}bhnIbejyr 6 .:9.WHOyb}ny%xrx

Xny}bhnIbejyr 6 .:9.WHOyb}ny%xrx

HOyb}ny%xrx'''9

HOyb}ny%xrx'''9

8*9794:>:

8*9794:>:

5*6064686

5*6064686

@.reloc

@.reloc

.exet

.exet

\\.\%c:

\\.\%c:

PubwinClient.exe

PubwinClient.exe

EnumWindows

EnumWindows

DownModule.dll

DownModule.dll

5(5.575>5`5

5(5.575>5`5

1.24282

1.24282

4 4@4\4`4

4 4@4\4`4

5 5@5`5|5

5 5@5`5|5

%DxQy9

%DxQy9

.AWAO

.AWAO

,

,

9EsShn\i0rP

9EsShn\i0rP

^*%C\

^*%C\

%UV}J

%UV}J

%c@fP

%c@fP

-xEXE

-xEXE

.Cp -

.Cp -

.Txh-

.Txh-

8F%fG

8F%fG

9>%S2s

9>%S2s

%9s-=W

%9s-=W

%XXYd6z

%XXYd6z

{o1.Fy

{o1.Fy

0N..Xr

0N..Xr

!W%%Fm

!W%%Fm

%S'

%S'

|F%ueT*

|F%ueT*

.xCS$

.xCS$

%Dh1KK

%Dh1KK

mscoree.dll

mscoree.dll

KERNEL32.DLL

KERNEL32.DLL

%original file name%.exe_272_rwx_00D10000_00002000:

SHELL32.DLL

SHELL32.DLL

ShellExecuteA

ShellExecuteA

KERNEL32.DLL

KERNEL32.DLL

.reloc

.reloc

SSSSSh

SSSSSh

%original file name%.exe_272_rwx_00E20000_00001000:

|%original file name%.exeM_272_

|%original file name%.exeM_272_

Rundll32.exe_1364:

.text

.text

`.data

`.data

.rsrc

.rsrc

msvcrt.dll

msvcrt.dll

KERNEL32.dll

KERNEL32.dll

NTDLL.DLL

NTDLL.DLL

GDI32.dll

GDI32.dll

USER32.dll

USER32.dll

IMAGEHLP.dll

IMAGEHLP.dll

rundll32.pdb

rundll32.pdb

.....eZXnnnnnnnnnnnn3

.....eZXnnnnnnnnnnnn3

....eDXnnnnnnnnnnnn3

....eDXnnnnnnnnnnnn3

...eDXnnnnnnnnnnnn,

...eDXnnnnnnnnnnnn,

.eDXnnnnnnnnnnnn,

.eDXnnnnnnnnnnnn,

%Xnnnnnnnnnnnnnnn1

%Xnnnnnnnnnnnnnnn1

O3$dS7"%U9

O3$dS7"%U9

.manifest

.manifest

5.1.2600.5512 (xpsp.080413-2105)

5.1.2600.5512 (xpsp.080413-2105)

RUNDLL.EXE

RUNDLL.EXE

Windows

Windows

Operating System

Operating System

5.1.2600.5512

5.1.2600.5512

YThere is not enough memory to run the file %s.

YThere is not enough memory to run the file %s.

Please close other windows and try again.

Please close other windows and try again.

9The file %s or one of its components could not be opened.

9The file %s or one of its components could not be opened.

0The file %s or one of its components cannot run.

0The file %s or one of its components cannot run.

MThe file %s or one of its components requires a different version of Windows.

MThe file %s or one of its components requires a different version of Windows.

UThe file %s or one of its components cannot run in standard or enhanced mode Windows.3Another instance of the file %s is already running./An exception occurred while trying to run "%s"

UThe file %s or one of its components cannot run in standard or enhanced mode Windows.3Another instance of the file %s is already running./An exception occurred while trying to run "%s"

Error in %s

Error in %s

Missing entry:%s

Missing entry:%s

Error loading %s

Error loading %s

Rundll32.exe_1364_rwx_00B80000_00002000:

SHELL32.DLL

SHELL32.DLL

ShellExecuteA

ShellExecuteA

KERNEL32.DLL

KERNEL32.DLL

.reloc

.reloc

SSSSSh

SSSSSh

Rundll32.exe_1364_rwx_00B90000_00001000:

|rundll32.exeM_1364_

|rundll32.exeM_1364_

XP-542ADE6B.EXE_3884:

.text

.text

.rdata

.rdata

.data

.data

.rsrc

.rsrc

user32.dll

user32.dll

KERNEL32.dll

KERNEL32.dll

USER32.dll

USER32.dll

GetCPInfo

GetCPInfo

krnln.fne

krnln.fne

krnln.fnr

krnln.fnr

1.1.3

1.1.3

%System%\XP-542ADE6B.EXE

%System%\XP-542ADE6B.EXE

@@shdocvw.dll

@@shdocvw.dll

{8856F961-340A-11D0-A96B-00C04FD705A2}##0

{8856F961-340A-11D0-A96B-00C04FD705A2}##0

2,{34A226E0-DF30-11CF-89A9-00A0C9054129},CommandStateChangeConstants,{},{1073741826,1073741825,1073741824,},{}2,{00000000-0000-0000-0000-000000000000},OLECMDID,{},{1073741880,1073741879,1073741878,1073741877,1073741876,1073741875,1073741874,1073741873,1073741872,1073741871,1073741870,1073741869,1073741868,1073741867,1073741866,1073741865,1073741864,1073741863,1073741862,1073741861,1073741860,1073741859,1073741858,1073741857,1073741856,1073741855,1073741854,1073741853,1073741852,1073741851,1073741850,1073741849,1073741848,1073741847,1073741846,1073741845,1073741844,1073741843,1073741842,1073741841,1073741840,1073741839,1073741838,1073741837,1073741836,1073741835,1073741834,1073741833,1073741832,1073741831,1073741830,1073741829,1073741828,1073741827,1073741826,1073741825,1073741824,},{}2,{00000000-0000-0000-0000-000000000000},OLECMDF,{},{1073741829,1073741828,1073741827,1073741826,1073741825,1073741824,},{}2,{00000000-0000-0000-0000-000000000000},OLECMDEXECOPT,{},{1073741827,1073741826,1073741825,1073741824,},{}2,{00000000-0000-0000-0000-000000000000},tagREADYSTATE,{},{1073741828,1073741827,1073741826,1073741825,1073741824,},{}2,{65507BE0-91A8-11D3-A845-009027220E6D},SecureLockIconConstants,{},{1073741830,1073741829,1073741828,1073741827,1073741826,1073741825,1073741824,},{}0,{EAB22AC3-30C1-11CF-A7EB-0000C05BAE0B},WebBrowser_V1,{100,101,102,103,104,-550,105,106,200,201,202,203,},{212,211,210,209,208,207,206,205,204,},{100,101,102,108,104,105,106,107,113,200,201,204,103,109,110,111,112,}1,{8856F961-340A-11D0-A96B-00C04FD705A2},WebBrowser,{100,101,102,103,104,-550,105,106,200,201,202,203,300,301,302,303,500,501,502,503,},{556,555,554,553,552,551,550,-525,407,406,405,404,403,402,401,400,-515,0,212,211,210,209,208,207,206,205,204,},{102,108,105,106,104,113,112,250,251,252,259,253,254,255,256,257,258,260,262,264,265,266,267,263,268,269,270,271,225,226,227,272,273,}0,{0002DF01-0000-0000-C000-000000000046},InternetExplorer,{100,101,102,103,104,-550,105,106,200,201,202,203,300,301,302,303,500,501,502,503,},{556,555,554,553,552,551,550,-525,407,406,405,404,403,402,401,400,-515,0,212,211,210,209,208,207,206,205,204,},{102,108,105,106,104,113,112,250,251,252,259,253,254,255,256,257,258,260,262,264,265,266,267,263,268,269,270,271,225,226,227,272,273,}2,{F41E6981-28E5-11D0-82B4-00A0C90C29C5},ShellWindowTypeConstants,{},{1073741827,1073741826,1073741825,1073741824,},{}0,{9BA05972-F6A8-11CF-A442-00A0C90A8F39},ShellWindows,{0,-4,},{1610743808,},{200,201,}0,{64AB4BB7-111E-11D1-8F79-00C04FC2FBE1},ShellUIHelper,{4,5,6,7,8,9,10,11,13,},{},{}0,{55136805-B2DE-11D1-B9F2-00A0C98BC547},ShellNameSpace,{1,2,3,4,5,6,7,8,9,11,12,13,15,16,23,24,25,26,15,16,},{22,21,20,19,18,17,14,10,},{1,2,3,4,}0,{2F2F1F96-2BC1-4B1C-BE28-EA3774F4676A},ShellShellNameSpace,{1,2,3,4,5,6,7,8,9,11,12,13,15,16,23,24,25,26,15,16,},{22,21,20,19,18,17,14,10,},{1,2,3,4,}

2,{34A226E0-DF30-11CF-89A9-00A0C9054129},CommandStateChangeConstants,{},{1073741826,1073741825,1073741824,},{}2,{00000000-0000-0000-0000-000000000000},OLECMDID,{},{1073741880,1073741879,1073741878,1073741877,1073741876,1073741875,1073741874,1073741873,1073741872,1073741871,1073741870,1073741869,1073741868,1073741867,1073741866,1073741865,1073741864,1073741863,1073741862,1073741861,1073741860,1073741859,1073741858,1073741857,1073741856,1073741855,1073741854,1073741853,1073741852,1073741851,1073741850,1073741849,1073741848,1073741847,1073741846,1073741845,1073741844,1073741843,1073741842,1073741841,1073741840,1073741839,1073741838,1073741837,1073741836,1073741835,1073741834,1073741833,1073741832,1073741831,1073741830,1073741829,1073741828,1073741827,1073741826,1073741825,1073741824,},{}2,{00000000-0000-0000-0000-000000000000},OLECMDF,{},{1073741829,1073741828,1073741827,1073741826,1073741825,1073741824,},{}2,{00000000-0000-0000-0000-000000000000},OLECMDEXECOPT,{},{1073741827,1073741826,1073741825,1073741824,},{}2,{00000000-0000-0000-0000-000000000000},tagREADYSTATE,{},{1073741828,1073741827,1073741826,1073741825,1073741824,},{}2,{65507BE0-91A8-11D3-A845-009027220E6D},SecureLockIconConstants,{},{1073741830,1073741829,1073741828,1073741827,1073741826,1073741825,1073741824,},{}0,{EAB22AC3-30C1-11CF-A7EB-0000C05BAE0B},WebBrowser_V1,{100,101,102,103,104,-550,105,106,200,201,202,203,},{212,211,210,209,208,207,206,205,204,},{100,101,102,108,104,105,106,107,113,200,201,204,103,109,110,111,112,}1,{8856F961-340A-11D0-A96B-00C04FD705A2},WebBrowser,{100,101,102,103,104,-550,105,106,200,201,202,203,300,301,302,303,500,501,502,503,},{556,555,554,553,552,551,550,-525,407,406,405,404,403,402,401,400,-515,0,212,211,210,209,208,207,206,205,204,},{102,108,105,106,104,113,112,250,251,252,259,253,254,255,256,257,258,260,262,264,265,266,267,263,268,269,270,271,225,226,227,272,273,}0,{0002DF01-0000-0000-C000-000000000046},InternetExplorer,{100,101,102,103,104,-550,105,106,200,201,202,203,300,301,302,303,500,501,502,503,},{556,555,554,553,552,551,550,-525,407,406,405,404,403,402,401,400,-515,0,212,211,210,209,208,207,206,205,204,},{102,108,105,106,104,113,112,250,251,252,259,253,254,255,256,257,258,260,262,264,265,266,267,263,268,269,270,271,225,226,227,272,273,}2,{F41E6981-28E5-11D0-82B4-00A0C90C29C5},ShellWindowTypeConstants,{},{1073741827,1073741826,1073741825,1073741824,},{}0,{9BA05972-F6A8-11CF-A442-00A0C90A8F39},ShellWindows,{0,-4,},{1610743808,},{200,201,}0,{64AB4BB7-111E-11D1-8F79-00C04FC2FBE1},ShellUIHelper,{4,5,6,7,8,9,10,11,13,},{},{}0,{55136805-B2DE-11D1-B9F2-00A0C98BC547},ShellNameSpace,{1,2,3,4,5,6,7,8,9,11,12,13,15,16,23,24,25,26,15,16,},{22,21,20,19,18,17,14,10,},{1,2,3,4,}0,{2F2F1F96-2BC1-4B1C-BE28-EA3774F4676A},ShellShellNameSpace,{1,2,3,4,5,6,7,8,9,11,12,13,15,16,23,24,25,26,15,16,},{22,21,20,19,18,17,14,10,},{1,2,3,4,}

.cn/ul.htm

.cn/ul.htm

hXXp://VVV.

hXXp://VVV.

.com/ul.htm

.com/ul.htm

[%s%]

[%s%]

[%f%]

[%f%]

document.all('

document.all('

document.frames('

document.frames('

.value='';};catch(e){};function a(){};a();

.value='';};catch(e){};function a(){};a();

.value='

.value='

].selected=true;};catch(e){};function a(){};a();

].selected=true;};catch(e){};function a(){};a();

.options[

.options[

.checked='';};catch(e){};function a(){};a();

.checked='';};catch(e){};function a(){};a();

.checked='checked';};catch(e){};function a(){};a();

.checked='checked';};catch(e){};function a(){};a();

SOFTWARE\Microsoft\Windows\CurrentVersion\Run\

SOFTWARE\Microsoft\Windows\CurrentVersion\Run\

Recycled.exe

Recycled.exe

ul.dll

ul.dll

og.dll

og.dll

:\autorun.inf

:\autorun.inf

shellexecute

shellexecute

OLEACC.DLL

OLEACC.DLL

keybd_event

keybd_event

WebBrowser

WebBrowser

SHELL32.DLL

SHELL32.DLL

ShellExecuteA

ShellExecuteA

KERNEL32.DLL

KERNEL32.DLL

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\001E67FF_Rar\XP-542ADE6B.EXE

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\001E67FF_Rar\XP-542ADE6B.EXE

XP-542ADE6B.EXE

XP-542ADE6B.EXE

hXXp://padrup.com/sobaka.aspx

hXXp://padrup.com/sobaka.aspx

hXXp://kuku1.infoier

hXXp://kuku1.infoier

hXXp://89.11

hXXp://89.11

.info/home.gifIh

.info/home.gifIh

bW.text

bW.text

JKERNEL32.dll

JKERNEL32.dll

%x.exe

%x.exe

h.rdla&

h.rdla&

mH.MN8

mH.MN8

T4.At%

T4.At%

S.twa

S.twa

.klkjw:9fqwiBumW

.klkjw:9fqwiBumW

.sysa

.sysa

Zc.pBTa

Zc.pBTa

~%s:*:yd:

~%s:*:yd:

.!.VF*

.!.VF*

.d&?%x=

.d&?%x=

GUrlA'

GUrlA'

"\'Web%w}

"\'Web%w}

HTTP)s'PS

HTTP)s'PS

2GUARDCMD

2GUARDCMD

o.ENHCDM

o.ENHCDM

wWEBWUPD

wWEBWUPD

MM.PF

MM.PF

%xn'[

%xn'[

>>?456789:;

>>?456789:;

!"#$%&'()* ,-./4

!"#$%&'()* ,-./4

qn%CXf

qn%CXf

UP*dB.PPd@.

UP*dB.PPd@.

%FoAN-x

%FoAN-x

ÄEW

ÄEW

%F" *" a

%F" *" a

ADVAPI32.dll

ADVAPI32.dll

MSVCRT.dll

MSVCRT.dll

SHELL32.dll

SHELL32.dll

WS2_32.dll

WS2_32.dll

RegCloseKey

RegCloseKey

SHFileOperationA

SHFileOperationA

4R.Uw

4R.Uw

XP-542ADE6B.EXE_3884_rwx_0040A000_0001D000:

@@shdocvw.dll

@@shdocvw.dll

{8856F961-340A-11D0-A96B-00C04FD705A2}##0

{8856F961-340A-11D0-A96B-00C04FD705A2}##0

2,{34A226E0-DF30-11CF-89A9-00A0C9054129},CommandStateChangeConstants,{},{1073741826,1073741825,1073741824,},{}2,{00000000-0000-0000-0000-000000000000},OLECMDID,{},{1073741880,1073741879,1073741878,1073741877,1073741876,1073741875,1073741874,1073741873,1073741872,1073741871,1073741870,1073741869,1073741868,1073741867,1073741866,1073741865,1073741864,1073741863,1073741862,1073741861,1073741860,1073741859,1073741858,1073741857,1073741856,1073741855,1073741854,1073741853,1073741852,1073741851,1073741850,1073741849,1073741848,1073741847,1073741846,1073741845,1073741844,1073741843,1073741842,1073741841,1073741840,1073741839,1073741838,1073741837,1073741836,1073741835,1073741834,1073741833,1073741832,1073741831,1073741830,1073741829,1073741828,1073741827,1073741826,1073741825,1073741824,},{}2,{00000000-0000-0000-0000-000000000000},OLECMDF,{},{1073741829,1073741828,1073741827,1073741826,1073741825,1073741824,},{}2,{00000000-0000-0000-0000-000000000000},OLECMDEXECOPT,{},{1073741827,1073741826,1073741825,1073741824,},{}2,{00000000-0000-0000-0000-000000000000},tagREADYSTATE,{},{1073741828,1073741827,1073741826,1073741825,1073741824,},{}2,{65507BE0-91A8-11D3-A845-009027220E6D},SecureLockIconConstants,{},{1073741830,1073741829,1073741828,1073741827,1073741826,1073741825,1073741824,},{}0,{EAB22AC3-30C1-11CF-A7EB-0000C05BAE0B},WebBrowser_V1,{100,101,102,103,104,-550,105,106,200,201,202,203,},{212,211,210,209,208,207,206,205,204,},{100,101,102,108,104,105,106,107,113,200,201,204,103,109,110,111,112,}1,{8856F961-340A-11D0-A96B-00C04FD705A2},WebBrowser,{100,101,102,103,104,-550,105,106,200,201,202,203,300,301,302,303,500,501,502,503,},{556,555,554,553,552,551,550,-525,407,406,405,404,403,402,401,400,-515,0,212,211,210,209,208,207,206,205,204,},{102,108,105,106,104,113,112,250,251,252,259,253,254,255,256,257,258,260,262,264,265,266,267,263,268,269,270,271,225,226,227,272,273,}0,{0002DF01-0000-0000-C000-000000000046},InternetExplorer,{100,101,102,103,104,-550,105,106,200,201,202,203,300,301,302,303,500,501,502,503,},{556,555,554,553,552,551,550,-525,407,406,405,404,403,402,401,400,-515,0,212,211,210,209,208,207,206,205,204,},{102,108,105,106,104,113,112,250,251,252,259,253,254,255,256,257,258,260,262,264,265,266,267,263,268,269,270,271,225,226,227,272,273,}2,{F41E6981-28E5-11D0-82B4-00A0C90C29C5},ShellWindowTypeConstants,{},{1073741827,1073741826,1073741825,1073741824,},{}0,{9BA05972-F6A8-11CF-A442-00A0C90A8F39},ShellWindows,{0,-4,},{1610743808,},{200,201,}0,{64AB4BB7-111E-11D1-8F79-00C04FC2FBE1},ShellUIHelper,{4,5,6,7,8,9,10,11,13,},{},{}0,{55136805-B2DE-11D1-B9F2-00A0C98BC547},ShellNameSpace,{1,2,3,4,5,6,7,8,9,11,12,13,15,16,23,24,25,26,15,16,},{22,21,20,19,18,17,14,10,},{1,2,3,4,}0,{2F2F1F96-2BC1-4B1C-BE28-EA3774F4676A},ShellShellNameSpace,{1,2,3,4,5,6,7,8,9,11,12,13,15,16,23,24,25,26,15,16,},{22,21,20,19,18,17,14,10,},{1,2,3,4,}

2,{34A226E0-DF30-11CF-89A9-00A0C9054129},CommandStateChangeConstants,{},{1073741826,1073741825,1073741824,},{}2,{00000000-0000-0000-0000-000000000000},OLECMDID,{},{1073741880,1073741879,1073741878,1073741877,1073741876,1073741875,1073741874,1073741873,1073741872,1073741871,1073741870,1073741869,1073741868,1073741867,1073741866,1073741865,1073741864,1073741863,1073741862,1073741861,1073741860,1073741859,1073741858,1073741857,1073741856,1073741855,1073741854,1073741853,1073741852,1073741851,1073741850,1073741849,1073741848,1073741847,1073741846,1073741845,1073741844,1073741843,1073741842,1073741841,1073741840,1073741839,1073741838,1073741837,1073741836,1073741835,1073741834,1073741833,1073741832,1073741831,1073741830,1073741829,1073741828,1073741827,1073741826,1073741825,1073741824,},{}2,{00000000-0000-0000-0000-000000000000},OLECMDF,{},{1073741829,1073741828,1073741827,1073741826,1073741825,1073741824,},{}2,{00000000-0000-0000-0000-000000000000},OLECMDEXECOPT,{},{1073741827,1073741826,1073741825,1073741824,},{}2,{00000000-0000-0000-0000-000000000000},tagREADYSTATE,{},{1073741828,1073741827,1073741826,1073741825,1073741824,},{}2,{65507BE0-91A8-11D3-A845-009027220E6D},SecureLockIconConstants,{},{1073741830,1073741829,1073741828,1073741827,1073741826,1073741825,1073741824,},{}0,{EAB22AC3-30C1-11CF-A7EB-0000C05BAE0B},WebBrowser_V1,{100,101,102,103,104,-550,105,106,200,201,202,203,},{212,211,210,209,208,207,206,205,204,},{100,101,102,108,104,105,106,107,113,200,201,204,103,109,110,111,112,}1,{8856F961-340A-11D0-A96B-00C04FD705A2},WebBrowser,{100,101,102,103,104,-550,105,106,200,201,202,203,300,301,302,303,500,501,502,503,},{556,555,554,553,552,551,550,-525,407,406,405,404,403,402,401,400,-515,0,212,211,210,209,208,207,206,205,204,},{102,108,105,106,104,113,112,250,251,252,259,253,254,255,256,257,258,260,262,264,265,266,267,263,268,269,270,271,225,226,227,272,273,}0,{0002DF01-0000-0000-C000-000000000046},InternetExplorer,{100,101,102,103,104,-550,105,106,200,201,202,203,300,301,302,303,500,501,502,503,},{556,555,554,553,552,551,550,-525,407,406,405,404,403,402,401,400,-515,0,212,211,210,209,208,207,206,205,204,},{102,108,105,106,104,113,112,250,251,252,259,253,254,255,256,257,258,260,262,264,265,266,267,263,268,269,270,271,225,226,227,272,273,}2,{F41E6981-28E5-11D0-82B4-00A0C90C29C5},ShellWindowTypeConstants,{},{1073741827,1073741826,1073741825,1073741824,},{}0,{9BA05972-F6A8-11CF-A442-00A0C90A8F39},ShellWindows,{0,-4,},{1610743808,},{200,201,}0,{64AB4BB7-111E-11D1-8F79-00C04FC2FBE1},ShellUIHelper,{4,5,6,7,8,9,10,11,13,},{},{}0,{55136805-B2DE-11D1-B9F2-00A0C98BC547},ShellNameSpace,{1,2,3,4,5,6,7,8,9,11,12,13,15,16,23,24,25,26,15,16,},{22,21,20,19,18,17,14,10,},{1,2,3,4,}0,{2F2F1F96-2BC1-4B1C-BE28-EA3774F4676A},ShellShellNameSpace,{1,2,3,4,5,6,7,8,9,11,12,13,15,16,23,24,25,26,15,16,},{22,21,20,19,18,17,14,10,},{1,2,3,4,}

.cn/ul.htm

.cn/ul.htm

hXXp://VVV.

hXXp://VVV.

.com/ul.htm

.com/ul.htm

[%s%]

[%s%]

[%f%]

[%f%]

document.all('

document.all('

document.frames('

document.frames('

.value='';};catch(e){};function a(){};a();

.value='';};catch(e){};function a(){};a();

.value='

.value='

].selected=true;};catch(e){};function a(){};a();

].selected=true;};catch(e){};function a(){};a();

.options[

.options[

.checked='';};catch(e){};function a(){};a();

.checked='';};catch(e){};function a(){};a();

.checked='checked';};catch(e){};function a(){};a();

.checked='checked';};catch(e){};function a(){};a();

SOFTWARE\Microsoft\Windows\CurrentVersion\Run\

SOFTWARE\Microsoft\Windows\CurrentVersion\Run\

Recycled.exe

Recycled.exe

ul.dll

ul.dll

og.dll

og.dll

:\autorun.inf

:\autorun.inf

shellexecute

shellexecute

OLEACC.DLL

OLEACC.DLL

user32.dll

user32.dll

keybd_event

keybd_event

WebBrowser

WebBrowser

XP-542ADE6B.EXE_3884_rwx_0042D000_0000F000:

SHELL32.DLL

SHELL32.DLL

ShellExecuteA

ShellExecuteA

KERNEL32.DLL

KERNEL32.DLL

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\001E67FF_Rar\XP-542ADE6B.EXE

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\001E67FF_Rar\XP-542ADE6B.EXE

XP-542ADE6B.EXE

XP-542ADE6B.EXE

.rsrc

.rsrc

%System%\XP-542ADE6B.EXE

%System%\XP-542ADE6B.EXE

hXXp://padrup.com/sobaka.aspx

hXXp://padrup.com/sobaka.aspx

hXXp://kuku1.infoier

hXXp://kuku1.infoier

hXXp://89.11

hXXp://89.11

.info/home.gifIh

.info/home.gifIh

bW.text

bW.text

JKERNEL32.dll

JKERNEL32.dll

%x.exe

%x.exe

h.rdla&

h.rdla&

mH.MN8

mH.MN8

T4.At%

T4.At%

S.twa

S.twa

.klkjw:9fqwiBumW

.klkjw:9fqwiBumW

.sysa

.sysa

Zc.pBTa

Zc.pBTa

~%s:*:yd:

~%s:*:yd:

.!.VF*

.!.VF*

.d&?%x=

.d&?%x=

GUrlA'

GUrlA'

"\'Web%w}

"\'Web%w}

HTTP)s'PS

HTTP)s'PS

2GUARDCMD

2GUARDCMD

o.ENHCDM

o.ENHCDM

wWEBWUPD

wWEBWUPD

MM.PF

MM.PF

%xn'[

%xn'[

>>?456789:;

>>?456789:;

!"#$%&'()* ,-./4

!"#$%&'()* ,-./4

qn%CXf

qn%CXf

UP*dB.PPd@.

UP*dB.PPd@.

%FoAN-x

%FoAN-x

ÄEW

ÄEW

%F" *" a

%F" *" a

ADVAPI32.dll

ADVAPI32.dll

MSVCRT.dll

MSVCRT.dll

SHELL32.dll

SHELL32.dll

USER32.dll

USER32.dll

WS2_32.dll

WS2_32.dll

RegCloseKey

RegCloseKey

SHFileOperationA

SHFileOperationA

XP-542ADE6B.EXE_3884_rwx_01531000_00030000:

t.It It

t.It It

SShH$W

SShH$W

.tTPV

.tTPV

FTPjK

FTPjK

FtPj;

FtPj;

F.PjRWj

F.PjRWj

u.WWj

u.WWj

u.VVj

u.VVj

XP-542ADE6B.EXE_3884_rwx_01820000_00002000:

SHELL32.DLL

SHELL32.DLL

ShellExecuteA

ShellExecuteA

KERNEL32.DLL

KERNEL32.DLL

.reloc

.reloc

SSSSSh

SSSSSh

XP-542ADE6B.EXE_3884_rwx_01830000_00001000:

|xp-542ade6b.exeM_3884_

|xp-542ade6b.exeM_3884_

XP-542ADE6B.EXE_3884_rwx_024B1000_0000A000:

^}•D

^}•D

XP-542ADE6B.EXE_3884_rwx_10001000_000C1000:

|$D.tm

|$D.tm

~%UVW

~%UVW

L$$SSh

L$$SSh

t%SVh

t%SVh

t$(SSh

t$(SSh

u$SShe

u$SShe

Explorer.EXE_512_rwx_00F30000_00002000:

SHELL32.DLL

SHELL32.DLL

ShellExecuteA

ShellExecuteA

KERNEL32.DLL

KERNEL32.DLL

.reloc

.reloc

SSSSSh

SSSSSh

Explorer.EXE_512_rwx_00F40000_00001000:

|explorer.exeM_512_

|explorer.exeM_512_

Explorer.EXE_512_rwx_021E0000_010BA000:

hXXp://89.11

hXXp://89.11

.info/home.gifIh

.info/home.gifIh

bW.text

bW.text

JKERNEL32.dll

JKERNEL32.dll

%x.exe

%x.exe

hXXp://89.119.67.154/testo5/

hXXp://89.119.67.154/testo5/

hXXp://kukutrustnet777.info/home.gif

hXXp://kukutrustnet777.info/home.gif

hXXp://kukutrustnet888.info/home.gif

hXXp://kukutrustnet888.info/home.gif

hXXp://kukutrustnet987.info/home.gif

hXXp://kukutrustnet987.info/home.gif

.text

.text

KERNEL32.dll

KERNEL32.dll

.reloc

.reloc

USER32.dll

USER32.dll

h.rdata

h.rdata

H.data

H.data

ntoskrnl.exe

ntoskrnl.exe

Mozilla/4.0 (compatible; MSIE 7.0b; Windows NT 6.0)

Mozilla/4.0 (compatible; MSIE 7.0b; Windows NT 6.0)

Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache

Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache

Software\Microsoft\Windows\CurrentVersion\Internet Settings

Software\Microsoft\Windows\CurrentVersion\Internet Settings

Software\Microsoft\Windows\CurrentVersion

Software\Microsoft\Windows\CurrentVersion

hXXp://VVV.klkjwre9fqwieluoi.info/

hXXp://VVV.klkjwre9fqwieluoi.info/

hXXp://kukutrustnet777888.info/

hXXp://kukutrustnet777888.info/

Software\Microsoft\Windows\CurrentVersion\policies\system

Software\Microsoft\Windows\CurrentVersion\policies\system

Software\Microsoft\Windows\ShellNoRoam\MUICache

Software\Microsoft\Windows\ShellNoRoam\MUICache

%s:*:Enabled:ipsec

%s:*:Enabled:ipsec

SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced

SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced

GdiPlus.dll

GdiPlus.dll

hXXp://

hXXp://

ipfltdrv.sys

ipfltdrv.sys

VVV.microsoft.com

VVV.microsoft.com

?%x=%d

?%x=%d

&%x=%d

&%x=%d

SYSTEM.INI

SYSTEM.INI

USER32.DLL

USER32.DLL

.%c%s

.%c%s

\\.\amsint32

\\.\amsint32

NTDLL.DLL

NTDLL.DLL

autorun.inf

autorun.inf

ADVAPI32.DLL

ADVAPI32.DLL

win%s.exe

win%s.exe

%s.exe

%s.exe

WININET.DLL

WININET.DLL

InternetOpenUrlA

InternetOpenUrlA

avast! Web Scanner

avast! Web Scanner

Avira AntiVir Premium WebGuard

Avira AntiVir Premium WebGuard

cmdGuard

cmdGuard

cmdAgent

cmdAgent

Eset HTTP Server

Eset HTTP Server

ProtoPort Firewall service

ProtoPort Firewall service

SpIDer FS Monitor for Windows NT

SpIDer FS Monitor for Windows NT

Symantec Password Validation

Symantec Password Validation

WebrootDesktopFirewallDataService

WebrootDesktopFirewallDataService

WebrootFirewall

WebrootFirewall

%d%d.tmp

%d%d.tmp

SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList

SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList

%s\%s

%s\%s

%s\Software\Microsoft\Windows\CurrentVersion\Ext\Stats

%s\Software\Microsoft\Windows\CurrentVersion\Ext\Stats

Software\Microsoft\Windows\CurrentVersion\Ext\Stats

Software\Microsoft\Windows\CurrentVersion\Ext\Stats

SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects

SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects

KERNEL32.DLL

KERNEL32.DLL

Explorer.exe

Explorer.exe

A2CMD.

A2CMD.

ASHWEBSV.

ASHWEBSV.

AVGCC.AVGCHSVX.

AVGCC.AVGCHSVX.

DRWEB

DRWEB

DWEBLLIO

DWEBLLIO

DWEBIO

DWEBIO

FSGUIEXE.

FSGUIEXE.

MCVSSHLD.

MCVSSHLD.

NPFMSG.

NPFMSG.

SYMSPORT.

SYMSPORT.

WEBSCANX.

WEBSCANX.

%c%d_%d

%c%d_%d

purity_control_%x

purity_control_%x

.adata

.adata

M_%d_

M_%d_

?456789:;

?456789:;

!"#$%&'()* ,-./0123

!"#$%&'()* ,-./0123

mong%WinDir%\

mong%WinDir%\

%WinDir%\hywjfubtsnl.log

%WinDir%\hywjfubtsnl.log

hXXp://padrup.com/sobaka.aspx

hXXp://padrup.com/sobaka.aspx

hXXp://kuku1.infoier

hXXp://kuku1.infoier

%System%\drivers\njphmn.sys

%System%\drivers\njphmn.sys

19607504459

19607504459

SHELL32.DLL

SHELL32.DLL

ShellExecuteA

ShellExecuteA

SSSSSh

SSSSSh

GetProcessHeap

GetProcessHeap

GetWindowsDirectoryA

GetWindowsDirectoryA

RegEnumKeyExA

RegEnumKeyExA

RegDeleteKeyA

RegDeleteKeyA

RegOpenKeyExA

RegOpenKeyExA

RegCreateKeyA

RegCreateKeyA

RegCloseKey

RegCloseKey

SHFileOperationA

SHFileOperationA

&3&3&3&389

&3&3&3&389

%F" *" a

%F" *" a

ADVAPI32.dll

ADVAPI32.dll

MSVCRT.dll

MSVCRT.dll

SHELL32.dll

SHELL32.dll

WS2_32.dll

WS2_32.dll