Trojan.DownLoader8.21202

Technical Information

To ensure autorun and distribution:

Modifies the following registry keys:

[<HKLM>\SOFTWARE\Classes\ShockwaveFlash.ShockwaveFlash.1\shell\Open\command] '' = '"%PROGRAM_FILES%\Xplus\Xplus.exe" %1'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Xplus' = '"%PROGRAM_FILES%\Xplus\XplusWait.exe" /min'
[<HKLM>\SOFTWARE\Classes\XplusFile\shell\open\command] '' = '"%PROGRAM_FILES%\Xplus\Xplus.exe"%1'

Malicious functions:

Creates and executes the following:

%CommonProgramFiles%\InstallShield\engine\6\Intel 32\IKernel.exe /REGSERVER
%PROGRAM_FILES%\Xplus\Xplus.exe
%CommonProgramFiles%\InstallShield\engine\6\Intel 32\IKernel.exe 32\IKernel.exe -Embedding
%TEMP%\pft3~tmp\Disk1\Setup.exe
%CommonProgramFiles%\InstallShield\engine\6\Intel 32\IKernel.exe -RegServer

Modifies file system :

Creates the following files:

%PROGRAM_FILES%\Xplus\Skin\main\over89c3.rra
%PROGRAM_FILES%\Xplus\Skin\main\wnd8a30.rra
%PROGRAM_FILES%\Xplus\Skin\main\NewMagz\mask8a5f.rra
%PROGRAM_FILES%\Xplus\Skin\main\over8955.rra
%PROGRAM_FILES%\Xplus\Skin\main\over8974.rra
%PROGRAM_FILES%\Xplus\Skin\main\sel_8994.rra
%PROGRAM_FILES%\Xplus\Skin\main\Broadcast\mask8a7e.rra
%PROGRAM_FILES%\Xplus\Skin\main\NewMagz\NewM8b59.rra
%PROGRAM_FILES%\Xplus\Skin\main\NewMagz\sel_8b88.rra
%PROGRAM_FILES%\Xplus\Skin\main\NewMagz\over8bb7.rra
%PROGRAM_FILES%\Xplus\Skin\main\Broadcast\NewM8a9d.rra
%PROGRAM_FILES%\Xplus\Skin\main\Broadcast\sel_8acc.rra
%PROGRAM_FILES%\Xplus\Skin\main\Broadcast\over8aeb.rra
%PROGRAM_FILES%\Xplus\Skin\main\sel_8926.rra
%PROGRAM_FILES%\Xplus\Resource\images\038742.rra
%PROGRAM_FILES%\Xplus\Resource\images\048761.rra
%PROGRAM_FILES%\Xplus\Resource\images\0587a0.rra
%PROGRAM_FILES%\Xplus\Resource\oldm86d5.rra
%PROGRAM_FILES%\Xplus\Resource\images\018703.rra
%PROGRAM_FILES%\Xplus\Resource\images\028723.rra
%PROGRAM_FILES%\Xplus\Resource\images\icon\a03087cf.rra
%PROGRAM_FILES%\Xplus\Skin\main\Broa88a9.rra
%PROGRAM_FILES%\Xplus\Skin\main\mask88c9.rra
%PROGRAM_FILES%\Xplus\Skin\main\myma88e8.rra
%PROGRAM_FILES%\Xplus\Skin\main882c.rra
%PROGRAM_FILES%\Xplus\Skin\main\body885b.rra
%PROGRAM_FILES%\Xplus\Skin\main\NewM888a.rra
%PROGRAM_FILES%\Xplus\Skin\Reader\BEST8bf5.rra
%PROGRAM_FILES%\Xplus\Skin\Reader\REST8e76.rra
%PROGRAM_FILES%\Xplus\Skin\Reader\SEPA8ea5.rra
%PROGRAM_FILES%\Xplus\Skin\Reader\Titl8ec4.rra
%PROGRAM_FILES%\Xplus\Skin\Reader\MIN_8e18.rra
%PROGRAM_FILES%\Xplus\Skin\Reader\REST8e37.rra
%PROGRAM_FILES%\Xplus\Skin\Reader\REST8e56.rra
%PROGRAM_FILES%\Xplus\Skin\Reader\Titl8ee3.rra
%ALLUSERSPROFILE%\Desktop\Xplus.lnk
%ALLUSERSPROFILE%\Desktop\My Magazine.lnk
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\Reg[1].php
<SYSTEM32>\file8f12.rra
%ALLUSERSPROFILE%\Start Menu\Programs\Xplus\Жф¶Ї Xplus.lnk
%ALLUSERSPROFILE%\Start Menu\Programs\Xplus\Йѕіэ Xplus.lnk
%PROGRAM_FILES%\Xplus\Skin\Reader\MIN_8df9.rra
%PROGRAM_FILES%\Xplus\Skin\Reader\CLOS8c82.rra
%PROGRAM_FILES%\Xplus\Skin\Reader\CLOS8cb1.rra
%PROGRAM_FILES%\Xplus\Skin\Reader\ERES8cd0.rra
%PROGRAM_FILES%\Xplus\Skin\Reader\BEST8c14.rra
%PROGRAM_FILES%\Xplus\Skin\Reader\BEST8c34.rra
%PROGRAM_FILES%\Xplus\Skin\Reader\CLOS8c62.rra
%PROGRAM_FILES%\Xplus\Skin\Reader\FULL8cff.rra
%PROGRAM_FILES%\Xplus\Skin\Reader\MAX_8d8b.rra
%PROGRAM_FILES%\Xplus\Skin\Reader\MAX_8dab.rra
%PROGRAM_FILES%\Xplus\Skin\Reader\MIN_8dca.rra
%PROGRAM_FILES%\Xplus\Skin\Reader\FULL8d1e.rra
%PROGRAM_FILES%\Xplus\Skin\Reader\FULL8d3d.rra
%PROGRAM_FILES%\Xplus\Skin\Reader\MAX_8d5c.rra
%PROGRAM_FILES%\Xplus\Resource\ТСПВ86b5.rra
%CommonProgramFiles%\InstallShield\engine\6\Intel 32\iuse638d.rra
%CommonProgramFiles%\InstallShield\IScript\IScr6756.rra
%TEMP%\{810e11d3-543b-4c69-b6e5-d4e20260b1cc}\setu734d.rra
%CommonProgramFiles%\InstallShield\engine\6\Intel 32\core5ff3.rra
%CommonProgramFiles%\InstallShield\engine\6\Intel 32\ctor6061.rra
%CommonProgramFiles%\InstallShield\engine\6\Intel 32\obje6301.rra
%TEMP%\{810e11d3-543b-4c69-b6e5-d4e20260b1cc}\lice7408.rra
%TEMP%\{810e11d3-543b-4c69-b6e5-d4e20260b1cc}\_IsR760c.rra
%PROGRAM_FILES%\InstallShield Installation Information\{810E11D3-543B-4C69-B6E5-D4E20260B1CC}\layo7e39.rra
%PROGRAM_FILES%\InstallShield Installation Information\{810E11D3-543B-4C69-B6E5-D4E20260B1CC}\data7e49.rra
%TEMP%\{810e11d3-543b-4c69-b6e5-d4e20260b1cc}\valu7495.rra
%TEMP%\{810e11d3-543b-4c69-b6e5-d4e20260b1cc}\isrt7512.rra
%TEMP%\{810e11d3-543b-4c69-b6e5-d4e20260b1cc}\defa758f.rra
%TEMP%\pft3~tmp\Disk1\data1.cab
%TEMP%\pft3~tmp\Disk1\data1.hdr
%TEMP%\pft3~tmp\Disk1\data2.cab
%TEMP%\ext2.tmp
%TEMP%\plf1.tmp
%TEMP%\pft3~tmp\pftw1.pkg
%TEMP%\pft3~tmp\Disk1\ikernel.ex_
%TEMP%\pft3~tmp\Disk1\Setup.ini
%TEMP%\pft3~tmp\Disk1\setup.inx
%CommonProgramFiles%\InstallShield\engine\6\Intel 32\temp.000
%TEMP%\pft3~tmp\Disk1\layout.bin
%TEMP%\pft3~tmp\Disk1\setup.bmp
%TEMP%\pft3~tmp\Disk1\Setup.exe
%PROGRAM_FILES%\InstallShield Installation Information\{810E11D3-543B-4C69-B6E5-D4E20260B1CC}\data7e68.rra
%PROGRAM_FILES%\Xplus\Resource\Move857d.rra
%PROGRAM_FILES%\Xplus\Resource\noco859c.rra
%PROGRAM_FILES%\Xplus\Resource\images\FsCommand\Redi85cb.rra
%PROGRAM_FILES%\Xplus\Resource\magi850f.rra
%PROGRAM_FILES%\Xplus\Resource\MagN852f.rra
%PROGRAM_FILES%\Xplus\Resource\main854e.rra
%PROGRAM_FILES%\Xplus\Resource\Redi85ea.rra
%PROGRAM_FILES%\Xplus\Resource\ТСПВ8667.rra
%PROGRAM_FILES%\Xplus\Resource\ОґФД8686.rra
%PROGRAM_FILES%\Xplus\Resource\ОґФД86a6.rra
%PROGRAM_FILES%\Xplus\Resource\main8609.rra
%PROGRAM_FILES%\Xplus\Resource\magi8629.rra
%PROGRAM_FILES%\Xplus\Resource\oldm8648.rra
%PROGRAM_FILES%\Xplus\Resource\Chan84f0.rra
%PROGRAM_FILES%\InstallShield Installation Information\{810E11D3-543B-4C69-B6E5-D4E20260B1CC}\Setup.ini
%PROGRAM_FILES%\Xplus\GetM802d.rra
%PROGRAM_FILES%\Xplus\Hook805c.rra
%PROGRAM_FILES%\InstallShield Installation Information\{810E11D3-543B-4C69-B6E5-D4E20260B1CC}\Setu7ed6.rra
%PROGRAM_FILES%\InstallShield Installation Information\{810E11D3-543B-4C69-B6E5-D4E20260B1CC}\Setu7f14.rra
%PROGRAM_FILES%\InstallShield Installation Information\{810E11D3-543B-4C69-B6E5-D4E20260B1CC}\setu7f33.rra
%PROGRAM_FILES%\Xplus\kme807c.rra
%PROGRAM_FILES%\Xplus\Xplu8185.rra
%PROGRAM_FILES%\Xplus\Xplu81b4.rra
%PROGRAM_FILES%\Xplus\Resource\images\FsCommand\Chan84d1.rra
%PROGRAM_FILES%\Xplus\Read80ba.rra
%PROGRAM_FILES%\Xplus\Stri8127.rra
%PROGRAM_FILES%\Xplus\Xplu8156.rra

Deletes the following files:

%TEMP%\pft3~tmp\Disk1\data2.cab
%TEMP%\pft3~tmp\Disk1\ikernel.ex_
%TEMP%\pft3~tmp\Disk1\data1.cab
%TEMP%\pft3~tmp\Disk1\data1.hdr
%TEMP%\pft3~tmp\Disk1\layout.bin
%TEMP%\pft3~tmp\Disk1\Setup.ini
%TEMP%\pft3~tmp\Disk1\setup.inx
%TEMP%\pft3~tmp\Disk1\setup.bmp
%TEMP%\pft3~tmp\Disk1\Setup.exe
%TEMP%\{810e11d3-543b-4c69-b6e5-d4e20260b1cc}\_IsRes.dll
%TEMP%\{810e11d3-543b-4c69-b6e5-d4e20260b1cc}\default.pal
%TEMP%\ext2.tmp
%TEMP%\pft3~tmp\pftw1.pkg
%TEMP%\{810e11d3-543b-4c69-b6e5-d4e20260b1cc}\isrt.dll
%TEMP%\{810e11d3-543b-4c69-b6e5-d4e20260b1cc}\setup.inx
%TEMP%\plf1.tmp
%TEMP%\{810e11d3-543b-4c69-b6e5-d4e20260b1cc}\value.shl
%TEMP%\{810e11d3-543b-4c69-b6e5-d4e20260b1cc}\license.txt

Moves the following files:

from %PROGRAM_FILES%\Xplus\Skin\main\Broadcast\NewM8a9d.rra to %PROGRAM_FILES%\Xplus\Skin\main\Broadcast\NewMagz.gif
from %PROGRAM_FILES%\Xplus\Skin\main\Broadcast\sel_8acc.rra to %PROGRAM_FILES%\Xplus\Skin\main\Broadcast\sel_8abd.rra
from %PROGRAM_FILES%\Xplus\Skin\main\Broadcast\mask8a7e.rra to %PROGRAM_FILES%\Xplus\Skin\main\Broadcast\mask.gif
from %PROGRAM_FILES%\Xplus\Skin\main\sel_8994.rra to %PROGRAM_FILES%\Xplus\Skin\main\sel_mymag.gif
from %PROGRAM_FILES%\Xplus\Skin\main\wnd8a30.rra to %PROGRAM_FILES%\Xplus\Skin\main\wnd.ini
from %PROGRAM_FILES%\Xplus\Skin\main\Broadcast\over8aeb.rra to %PROGRAM_FILES%\Xplus\Skin\main\Broadcast\over_NewMagz.gif
from %PROGRAM_FILES%\Xplus\Skin\main\NewMagz\over8bb7.rra to %PROGRAM_FILES%\Xplus\Skin\main\NewMagz\over_NewMagz.gif
from %PROGRAM_FILES%\Xplus\Skin\main\NewMagz\sel_8b88.rra to %PROGRAM_FILES%\Xplus\Skin\main\NewMagz\sel_NewMagz.gif
from %PROGRAM_FILES%\Xplus\Skin\main\NewMagz\NewM8b59.rra to %PROGRAM_FILES%\Xplus\Skin\main\NewMagz\NewMagz.gif
from %PROGRAM_FILES%\Xplus\Skin\main\Broadcast\sel_8abd.rra to %PROGRAM_FILES%\Xplus\Skin\main\Broadcast\sel_NewMagz.gif
from %PROGRAM_FILES%\Xplus\Skin\main\NewMagz\mask8a5f.rra to %PROGRAM_FILES%\Xplus\Skin\main\NewMagz\mask.gif
from %PROGRAM_FILES%\Xplus\Skin\main\sel_8926.rra to %PROGRAM_FILES%\Xplus\Skin\main\sel_body.gif
from %PROGRAM_FILES%\Xplus\Skin\main\body885b.rra to %PROGRAM_FILES%\Xplus\Skin\main\body.gif
from %PROGRAM_FILES%\Xplus\Skin\main\Broa88a9.rra to %PROGRAM_FILES%\Xplus\Skin\main\Broadcast.ini
from %PROGRAM_FILES%\Xplus\Skin\main882c.rra to %PROGRAM_FILES%\Xplus\Skin\main.ini
from %PROGRAM_FILES%\Xplus\Resource\images\FsCommand\Chan84d1.rra to %PROGRAM_FILES%\Xplus\Resource\images\FsCommand\ChangeRes.exe
from %PROGRAM_FILES%\Xplus\Resource\images\FsCommand\Redi85cb.rra to %PROGRAM_FILES%\Xplus\Resource\images\FsCommand\Redir.exe
from %PROGRAM_FILES%\Xplus\Skin\main\mask88c9.rra to %PROGRAM_FILES%\Xplus\Skin\main\mask.gif
from %PROGRAM_FILES%\Xplus\Skin\main\over8974.rra to %PROGRAM_FILES%\Xplus\Skin\main\over_mag.gif
from %PROGRAM_FILES%\Xplus\Skin\main\over89c3.rra to %PROGRAM_FILES%\Xplus\Skin\main\over_mymag.gif
from %PROGRAM_FILES%\Xplus\Skin\main\over8955.rra to %PROGRAM_FILES%\Xplus\Skin\main\over_body.gif
from %PROGRAM_FILES%\Xplus\Skin\main\myma88e8.rra to %PROGRAM_FILES%\Xplus\Skin\main\mymag.gif
from %PROGRAM_FILES%\Xplus\Skin\main\NewM888a.rra to %PROGRAM_FILES%\Xplus\Skin\main\NewMagz.ini
from %PROGRAM_FILES%\Xplus\Skin\Reader\BEST8bf5.rra to %PROGRAM_FILES%\Xplus\Skin\Reader\BEST_IN.bmp
from %PROGRAM_FILES%\Xplus\Skin\Reader\REST8e37.rra to %PROGRAM_FILES%\Xplus\Skin\Reader\RESTORE_IN.bmp
from %PROGRAM_FILES%\Xplus\Skin\Reader\REST8e56.rra to %PROGRAM_FILES%\Xplus\Skin\Reader\RESTORE_OUT.bmp
from %PROGRAM_FILES%\Xplus\Skin\Reader\MIN_8e18.rra to %PROGRAM_FILES%\Xplus\Skin\Reader\MIN_PRESS.bmp
from %PROGRAM_FILES%\Xplus\Skin\Reader\MIN_8dca.rra to %PROGRAM_FILES%\Xplus\Skin\Reader\MIN_IN.bmp
from %PROGRAM_FILES%\Xplus\Skin\Reader\MIN_8df9.rra to %PROGRAM_FILES%\Xplus\Skin\Reader\MIN_OUT.bmp
from %PROGRAM_FILES%\Xplus\Skin\Reader\REST8e76.rra to %PROGRAM_FILES%\Xplus\Skin\Reader\RESTORE_PRESS.bmp
from <SYSTEM32>\file8f12.rra to <SYSTEM32>\file.html
from %TEMP%\5a75.rra to %PROGRAM_FILES%\InstallShield Installation Information\{810E11D3-543B-4C69-B6E5-D4E20260B1CC}\setup.ilg
from %PROGRAM_FILES%\Xplus\Skin\Reader\Titl8ee3.rra to %PROGRAM_FILES%\Xplus\Skin\Reader\TitleLeft.bmp
from %PROGRAM_FILES%\Xplus\Skin\Reader\SEPA8ea5.rra to %PROGRAM_FILES%\Xplus\Skin\Reader\SEPARATE.bmp
from %PROGRAM_FILES%\Xplus\Skin\Reader\Titl8ec4.rra to %PROGRAM_FILES%\Xplus\Skin\Reader\TitleBK.bmp
from %PROGRAM_FILES%\Xplus\Skin\Reader\MAX_8dab.rra to %PROGRAM_FILES%\Xplus\Skin\Reader\MAX_PRESS.bmp
from %PROGRAM_FILES%\Xplus\Skin\Reader\CLOS8c82.rra to %PROGRAM_FILES%\Xplus\Skin\Reader\CLOSE_OUT.bmp
from %PROGRAM_FILES%\Xplus\Skin\Reader\CLOS8cb1.rra to %PROGRAM_FILES%\Xplus\Skin\Reader\CLOSE_PRESS.bmp
from %PROGRAM_FILES%\Xplus\Skin\Reader\CLOS8c62.rra to %PROGRAM_FILES%\Xplus\Skin\Reader\CLOSE_IN.bmp
from %PROGRAM_FILES%\Xplus\Skin\Reader\BEST8c14.rra to %PROGRAM_FILES%\Xplus\Skin\Reader\BEST_OUT.bmp
from %PROGRAM_FILES%\Xplus\Skin\Reader\BEST8c34.rra to %PROGRAM_FILES%\Xplus\Skin\Reader\BEST_PRESS.bmp
from %PROGRAM_FILES%\Xplus\Skin\Reader\ERES8cd0.rra to %PROGRAM_FILES%\Xplus\Skin\Reader\ERESTORE_PRESS.bmp
from %PROGRAM_FILES%\Xplus\Skin\Reader\MAX_8d5c.rra to %PROGRAM_FILES%\Xplus\Skin\Reader\MAX_IN.bmp
from %PROGRAM_FILES%\Xplus\Skin\Reader\MAX_8d8b.rra to %PROGRAM_FILES%\Xplus\Skin\Reader\MAX_OUT.bmp
from %PROGRAM_FILES%\Xplus\Skin\Reader\FULL8d3d.rra to %PROGRAM_FILES%\Xplus\Skin\Reader\FULLSCREEN_PRESS.bmp
from %PROGRAM_FILES%\Xplus\Skin\Reader\FULL8cff.rra to %PROGRAM_FILES%\Xplus\Skin\Reader\FULLSCREEN_IN.bmp
from %PROGRAM_FILES%\Xplus\Skin\Reader\FULL8d1e.rra to %PROGRAM_FILES%\Xplus\Skin\Reader\FULLSCREEN_OUT.bmp
from %PROGRAM_FILES%\InstallShield Installation Information\{810E11D3-543B-4C69-B6E5-D4E20260B1CC}\Setu7ed6.rra to %PROGRAM_FILES%\InstallShield Installation Information\{810E11D3-543B-4C69-B6E5-D4E20260B1CC}\Setup.exe
from %PROGRAM_FILES%\InstallShield Installation Information\{810E11D3-543B-4C69-B6E5-D4E20260B1CC}\Setu7f14.rra to %PROGRAM_FILES%\InstallShield Installation Information\{810E11D3-543B-4C69-B6E5-D4E20260B1CC}\Setup.ini
from %PROGRAM_FILES%\InstallShield Installation Information\{810E11D3-543B-4C69-B6E5-D4E20260B1CC}\data7e68.rra to %PROGRAM_FILES%\InstallShield Installation Information\{810E11D3-543B-4C69-B6E5-D4E20260B1CC}\data1.cab
from %PROGRAM_FILES%\InstallShield Installation Information\{810E11D3-543B-4C69-B6E5-D4E20260B1CC}\layo7e39.rra to %PROGRAM_FILES%\InstallShield Installation Information\{810E11D3-543B-4C69-B6E5-D4E20260B1CC}\layout.bin
from %PROGRAM_FILES%\InstallShield Installation Information\{810E11D3-543B-4C69-B6E5-D4E20260B1CC}\data7e49.rra to %PROGRAM_FILES%\InstallShield Installation Information\{810E11D3-543B-4C69-B6E5-D4E20260B1CC}\data1.hdr
from %PROGRAM_FILES%\InstallShield Installation Information\{810E11D3-543B-4C69-B6E5-D4E20260B1CC}\setu7f33.rra to %PROGRAM_FILES%\InstallShield Installation Information\{810E11D3-543B-4C69-B6E5-D4E20260B1CC}\setup.inx
from %PROGRAM_FILES%\Xplus\Read80ba.rra to %PROGRAM_FILES%\Xplus\Reader.exe
from %PROGRAM_FILES%\Xplus\Stri8127.rra to %PROGRAM_FILES%\Xplus\String.dll
from %PROGRAM_FILES%\Xplus\kme807c.rra to %PROGRAM_FILES%\Xplus\kme.exe
from %PROGRAM_FILES%\Xplus\GetM802d.rra to %PROGRAM_FILES%\Xplus\GetMD5.dll
from %PROGRAM_FILES%\Xplus\Hook805c.rra to %PROGRAM_FILES%\Xplus\HookDll.dll
from %TEMP%\{810e11d3-543b-4c69-b6e5-d4e20260b1cc}\_IsR760c.rra to %TEMP%\{810e11d3-543b-4c69-b6e5-d4e20260b1cc}\_IsRes.dll
from %CommonProgramFiles%\InstallShield\engine\6\Intel 32\obje6301.rra to %CommonProgramFiles%\InstallShield\engine\6\Intel 32\objectps.dll
from %CommonProgramFiles%\InstallShield\engine\6\Intel 32\iuse638d.rra to %CommonProgramFiles%\InstallShield\engine\6\Intel 32\iuser.dll
from %CommonProgramFiles%\InstallShield\engine\6\Intel 32\ctor6061.rra to %CommonProgramFiles%\InstallShield\engine\6\Intel 32\ctor.dll
from %CommonProgramFiles%\InstallShield\engine\6\Intel 32\temp.000 to %CommonProgramFiles%\InstallShield\engine\6\Intel 32\IKernel.exe
from %CommonProgramFiles%\InstallShield\engine\6\Intel 32\core5ff3.rra to %CommonProgramFiles%\InstallShield\engine\6\Intel 32\corecomp.ini
from %CommonProgramFiles%\InstallShield\IScript\IScr6756.rra to %CommonProgramFiles%\InstallShield\IScript\IScript.dll
from %TEMP%\{810e11d3-543b-4c69-b6e5-d4e20260b1cc}\isrt7512.rra to %TEMP%\{810e11d3-543b-4c69-b6e5-d4e20260b1cc}\isrt.dll
from %TEMP%\{810e11d3-543b-4c69-b6e5-d4e20260b1cc}\defa758f.rra to %TEMP%\{810e11d3-543b-4c69-b6e5-d4e20260b1cc}\default.pal
from %TEMP%\{810e11d3-543b-4c69-b6e5-d4e20260b1cc}\valu7495.rra to %TEMP%\{810e11d3-543b-4c69-b6e5-d4e20260b1cc}\value.shl
from %TEMP%\{810e11d3-543b-4c69-b6e5-d4e20260b1cc}\setu734d.rra to %TEMP%\{810e11d3-543b-4c69-b6e5-d4e20260b1cc}\setup.inx
from %TEMP%\{810e11d3-543b-4c69-b6e5-d4e20260b1cc}\lice7408.rra to %TEMP%\{810e11d3-543b-4c69-b6e5-d4e20260b1cc}\license.txt
from %PROGRAM_FILES%\Xplus\Xplu8156.rra to %PROGRAM_FILES%\Xplus\Xplus_Firewall.exe
from %PROGRAM_FILES%\Xplus\Resource\ТСПВ86b5.rra to %PROGRAM_FILES%\Xplus\Resource\ТСПВФШФУЦѕ.gif
from %PROGRAM_FILES%\Xplus\Resource\oldm86d5.rra to %PROGRAM_FILES%\Xplus\Resource\oldmaginfo.html
from %PROGRAM_FILES%\Xplus\Resource\ОґФД86a6.rra to %PROGRAM_FILES%\Xplus\Resource\ОґФД¶БФУЦѕ.gif
from %PROGRAM_FILES%\Xplus\Resource\ТСПВ8667.rra to %PROGRAM_FILES%\Xplus\Resource\ТСПВФШФУЦѕ.html
from %PROGRAM_FILES%\Xplus\Resource\ОґФД8686.rra to %PROGRAM_FILES%\Xplus\Resource\ОґФД¶БФУЦѕ.html
from %PROGRAM_FILES%\Xplus\Resource\images\018703.rra to %PROGRAM_FILES%\Xplus\Resource\images\01.gif
from %PROGRAM_FILES%\Xplus\Resource\images\0587a0.rra to %PROGRAM_FILES%\Xplus\Resource\images\05.gif
from %PROGRAM_FILES%\Xplus\Resource\images\icon\a03087cf.rra to %PROGRAM_FILES%\Xplus\Resource\images\icon\a0300.gif
from %PROGRAM_FILES%\Xplus\Resource\images\048761.rra to %PROGRAM_FILES%\Xplus\Resource\images\04.gif
from %PROGRAM_FILES%\Xplus\Resource\images\028723.rra to %PROGRAM_FILES%\Xplus\Resource\images\02.gif
from %PROGRAM_FILES%\Xplus\Resource\images\038742.rra to %PROGRAM_FILES%\Xplus\Resource\images\03.gif
from %PROGRAM_FILES%\Xplus\Resource\oldm8648.rra to %PROGRAM_FILES%\Xplus\Resource\oldmaginfo.gif
from %PROGRAM_FILES%\Xplus\Resource\magi850f.rra to %PROGRAM_FILES%\Xplus\Resource\maginfo.gif
from %PROGRAM_FILES%\Xplus\Resource\MagN852f.rra to %PROGRAM_FILES%\Xplus\Resource\MagNoConnect.htm
from %PROGRAM_FILES%\Xplus\Resource\Chan84f0.rra to %PROGRAM_FILES%\Xplus\Resource\ChangeRes.exe
from %PROGRAM_FILES%\Xplus\Xplu8185.rra to %PROGRAM_FILES%\Xplus\XplusWait.exe
from %PROGRAM_FILES%\Xplus\Xplu81b4.rra to %PROGRAM_FILES%\Xplus\Xplus.exe
from %PROGRAM_FILES%\Xplus\Resource\main854e.rra to %PROGRAM_FILES%\Xplus\Resource\main.gif
from %PROGRAM_FILES%\Xplus\Resource\main8609.rra to %PROGRAM_FILES%\Xplus\Resource\main.html
from %PROGRAM_FILES%\Xplus\Resource\magi8629.rra to %PROGRAM_FILES%\Xplus\Resource\maginfo.html
from %PROGRAM_FILES%\Xplus\Resource\Redi85ea.rra to %PROGRAM_FILES%\Xplus\Resource\Redir.exe
from %PROGRAM_FILES%\Xplus\Resource\Move857d.rra to %PROGRAM_FILES%\Xplus\Resource\MoveMagz.exe
from %PROGRAM_FILES%\Xplus\Resource\noco859c.rra to %PROGRAM_FILES%\Xplus\Resource\noconnect.gif

Network activity:

Connects to:

'localhost':1043
'xp######j-01.xplus.com.cn':80
'xp#####bj2.xplus.com.cn':80
'localhost':2002
'xp#######st-bj2.xplus.com.cn':9975

TCP:

HTTP GET requests:

xp######j-01.xplus.com.cn/Reg/Reg.php?re#############################################
xp#####bj2.xplus.com.cn/

UDP:

DNS ASK xp#####bj2.xplus.com.cn
DNS ASK xp######j-01.xplus.com.cn
DNS ASK xp#######st-bj2.xplus.com.cn
DNS ASK xp######bj2.xplus.com.cn
'xp######bj2.xplus.com.cn':9976

Miscellaneous:

Searches for the following windows:

ClassName: 'MS_AutodialMonitor' WindowName: ''
ClassName: 'MS_WebcheckMonitor' WindowName: ''
ClassName: 'Shell_TrayWnd' WindowName: ''
ClassName: 'Indicator' WindowName: ''

Technologies

Terminology

Training and education

Myths

Technical Information

Curing recommendations

Free trial