Technical Information
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'exexc10' = '%TEMP%\RarSFX1\smss.exe'
- '<SYSTEM32>\wscript.exe' "%TEMP%\RarSFX0\0.vbs"
- '<SYSTEM32>\taskkill.exe' /im smss.exe /f
- '%TEMP%\RarSFX1\smss.exe'
- '<SYSTEM32>\taskkill.exe' /im sppsvd.exe /F
- '%TEMP%\RarSFX0\0.exe' /start
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\RarSFX0\1.bat" /start"
- '%TEMP%\RarSFX0\a\sppsvd.exe' /start
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1201' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1405' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '2201' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1001' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1004' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1200' = '00000000'
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\U98D4X8H\m327games[1]
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\U98D4X8H\m347games[1]
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\2VAZY7AN\m287games[1]
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\KHMHGZ4F\m307games[1]
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\YPORKZYZ\m367games[1]
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\KHMHGZ4F\m287games[1]
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\2VAZY7AN\m307games[1]
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\YPORKZYZ\kupeer[1].html
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\KHMHGZ4F\m267games[1]
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\2VAZY7AN\m124games[1]
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\KHMHGZ4F\m144games[1]
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\U98D4X8H\kupeer[1].html
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\2VAZY7AN\m104games[1]
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\KHMHGZ4F\m164games[1]
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\U98D4X8H\kupeer[2].html
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\2VAZY7AN\m267games[1]
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\YPORKZYZ\m184games[1]
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\YPORKZYZ\m204games[1]
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\2VAZY7AN\kupeer[3].html
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\YPORKZYZ\m293games[1]
- <LS_APPDATA>\Microsoft\Internet Explorer\MSIMGSIZ.DAT
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\2VAZY7AN\m220games[1]
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\YPORKZYZ\m273games[1]
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\U98D4X8H\m353games[1]
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\U98D4X8H\m373games[1]
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\KHMHGZ4F\m333games[1]
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\KHMHGZ4F\m313games[1]
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\U98D4X8H\m367games[1]
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\YPORKZYZ\kupeer[2].html
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\2VAZY7AN\m327games[1]
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\U98D4X8H\m347games[2]
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\YPORKZYZ\m120games[1]
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\U98D4X8H\m180games[1]
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\U98D4X8H\m200games[1]
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\KHMHGZ4F\m140games[1]
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\KHMHGZ4F\m160games[1]
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\U98D4X8H\m219games[1]
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\2VAZY7AN\m172games[1]
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\YPORKZYZ\m245games[1]
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\U98D4X8H\m132games[1]
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\2VAZY7AN\m192games[1]
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\YPORKZYZ\m212games[1]
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\U98D4X8H\m285games[1]
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\U98D4X8H\m305games[1]
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\KHMHGZ4F\m265games[1]
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\KHMHGZ4F\kupeer[1].html
- %TEMP%\RarSFX0\1.bat
- %TEMP%\RarSFX0\a\sppsvd.exe
- %TEMP%\RarSFX0\0.exe
- %TEMP%\RarSFX0\0.vbs
- %TEMP%\RarSFX1\smss.exe
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\KHMHGZ4F\m112games[1]
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\U98D4X8H\m152games[1]
- %TEMP%\RarSFX1\Interop.SHDocVw.dll
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\KHMHGZ4F\m91games[1]
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\2VAZY7AN\kupeer[2].html
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\YPORKZYZ\m98games[2]
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\U98D4X8H\m199games[1]
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\2VAZY7AN\m219games[1]
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\YPORKZYZ\m119games[2]
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\U98D4X8H\m179games[2]
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\U98D4X8H\m199games[2]
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\KHMHGZ4F\m139games[2]
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\KHMHGZ4F\m159games[2]
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\2VAZY7AN\kupeer[1].html
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\2VAZY7AN\m325games[1]
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\2VAZY7AN\m345games[1]
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\YPORKZYZ\m365games[1]
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\YPORKZYZ\m98games[1]
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\KHMHGZ4F\m159games[1]
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\U98D4X8H\m179games[1]
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\YPORKZYZ\m119games[1]
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\KHMHGZ4F\m139games[1]
- %TEMP%\RarSFX0\0.exe
- 'localhost':1039
- 'ku##er.com':80
- 'wp#d':80
- http://ku##er.com/m327games/?
- http://ku##er.com/m307games/?
- http://ku##er.com/m287games/?
- http://ku##er.com/m347games/?
- http://ku##er.com/m120games/?
- http://ku##er.com/?51######
- http://ku##er.com/m367games/?
- http://ku##er.com/m184games/?
- http://ku##er.com/m164games/?
- http://ku##er.com/m144games/?
- http://ku##er.com/m204games/?
- http://ku##er.com/m267games/?
- http://ku##er.com/m246games/?
- http://ku##er.com/?6.#####
- http://ku##er.com/m313games/?
- http://ku##er.com/m333games/?
- http://ku##er.com/m273games/?
- http://ku##er.com/m353games/?
- http://ku##er.com/m270games/?
- http://ku##er.com/?63######
- http://ku##er.com/m373games/?
- http://ku##er.com/m180games/?
- http://ku##er.com/m160games/?
- http://ku##er.com/m140games/?
- http://ku##er.com/m200games/?
- http://ku##er.com/m293games/?
- http://ku##er.com/?37######
- http://ku##er.com/m220games/?
- http://ku##er.com/m124games/?
- http://ku##er.com/m212games/?
- http://ku##er.com/m172games/?
- http://ku##er.com/m192games/?
- http://ku##er.com/m245games/?
- http://ku##er.com/m285games/?
- http://ku##er.com/?21######
- http://ku##er.com/m265games/?
- http://ku##er.com/advnew/tdv19.txt
- http://ku##er.com/advnew/d02.txt
- http://11#.#11.111.1/wpad.dat via wp#d
- http://ku##er.com/m91games/?
- http://ku##er.com/m132games/?
- http://ku##er.com/m152games/?
- http://ku##er.com/m112games/?
- http://ku##er.com/m179games/?
- http://ku##er.com/m159games/?
- http://ku##er.com/m139games/?
- http://ku##er.com/m199games/?
- http://ku##er.com/m104games/?
- http://ku##er.com/?35######
- http://ku##er.com/m219games/?
- http://ku##er.com/m365games/?
- http://ku##er.com/m345games/?
- http://ku##er.com/m305games/?
- http://ku##er.com/?48######
- http://ku##er.com/m119games/?
- http://ku##er.com/m98games/?
- http://ku##er.com/m325games/?
- DNS ASK ku##er.com
- DNS ASK wp#d
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebcheckMonitor' WindowName: ''
- ClassName: '' WindowName: ''
- ClassName: 'EDIT' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''