Technical Information
- %ALLUSERSPROFILE%\start menu\programs\startup\msmsgs.exe
- %ALLUSERSPROFILE%\start menu\programs\startup\rcx6.tmp
- [<HKLM>\SYSTEM\ControlSet001\Services\srservice] 'Start' = '00000002'
- [<HKLM>\SYSTEM\ControlSet001\Services\srservice] 'ImagePath' = '%WINDIR%\svchost.eXe'
- <Drive name for removable media>:\~angle.exe
- <Drive name for removable media>:\4f0bf7ff71f28.exe
- <Drive name for removable media>:\13.exe
- <Drive name for removable media>:\168.exe
- <Drive name for removable media>:\1189.exe
- <Drive name for removable media>:\region-north-karelia.exe
- <Drive name for removable media>:\block.exe
- <Drive name for removable media>:\calibre.exe
- <Drive name for removable media>:\background.exe
- <Drive name for removable media>:\asm.exe
- <Drive name for removable media>:\arrow-down.exe
- <Drive name for removable media>:\excel_example.exe
- <Drive name for removable media>:\price030215.exe
- <Drive name for removable media>:\productos.exe
- <Drive name for removable media>:\1sm_price.exe
- <Drive name for removable media>:\price.exe
- <Drive name for removable media>:\contractualdeadlines.exe
- <Drive name for removable media>:\calculatorworksheet.exe
- <Drive name for removable media>:\pushkin.exe
- <Drive name for removable media>:\~'.exe
- <Drive name for removable media>:\2.exe
- <Drive name for removable media>:\adadsi.exe
- <Drive name for removable media>:\~.exe
- <Drive name for removable media>:\coffee.exe
- <Drive name for removable media>:\dashborder_144.exe
- <Drive name for removable media>:\default.exe
- <Drive name for removable media>:\toolbar.exe
- <Drive name for removable media>:\skypesetup'.exe
- <Drive name for removable media>:\rcx12.tmp
- <Drive name for removable media>:\calc'.exe
- <Drive name for removable media>:\rcx13.tmp
- <Drive name for removable media>:\utorrent'.exe
- <Drive name for removable media>:\rcx14.tmp
- <Drive name for removable media>:\64bit_notes.exe
- <Drive name for removable media>:\ituneshelpunavailable.exe
- <Drive name for removable media>:\alert.exe
- <Drive name for removable media>:\browse.exe
- <Drive name for removable media>:\tree_view.exe
- <Drive name for removable media>:\about.exe
- <Drive name for removable media>:\howto-index.exe
- <Drive name for removable media>:\rcx15.tmp
- hidden files
- file extensions
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoSetFolders' = '00000001'
- %ALLUSERSPROFILE%\documents\my pictures\svchost.exe
- %ALLUSERSPROFILE%\documents\my music\rcxf.tmp
- %WINDIR%\rcxe.tmp
- %ALLUSERSPROFILE%\documents\my music\rcxd.tmp
- C:\surat buat presiden.htm
- %ALLUSERSPROFILE%\documents\my music\rcxc.tmp
- %ALLUSERSPROFILE%\documents\my pictures\rcxb.tmp
- %ALLUSERSPROFILE%\documents\my pictures\jpg.exe
- %ALLUSERSPROFILE%\documents\my pictures\rcxa.tmp
- %ALLUSERSPROFILE%\documents\my pictures\iexplore.exe
- %ALLUSERSPROFILE%\documents\my pictures\rcx9.tmp
- %ALLUSERSPROFILE%\documents\my pictures\wmplayer.exe
- %ALLUSERSPROFILE%\documents\my music\angle.zip
- %ALLUSERSPROFILE%\documents\my music\rcx10.tmp
- %ALLUSERSPROFILE%\documents\my pictures\rcx8.tmp
- %WINDIR%\rcx7.tmp
- %WINDIR%\regedit.reg
- %WINDIR%\ziprar.exe
- %ALLUSERSPROFILE%\documents\my music\rcx5.tmp
- %ALLUSERSPROFILE%\documents\my music\angle.exe
- <SYSTEM32>\rcx4.tmp
- <SYSTEM32>\angle.exe
- %WINDIR%\rcx3.tmp
- %WINDIR%\svchost.exe
- %ALLUSERSPROFILE%\documents\my music\rcx2.tmp
- %ALLUSERSPROFILE%\documents\my music\svchost.exe
- %ALLUSERSPROFILE%\documents\my pictures\rcx1.tmp
- %ALLUSERSPROFILE%\documents\my pictures\messenger.exe
- %ALLUSERSPROFILE%\documents\my music\rcx11.tmp
- %ALLUSERSPROFILE%\documents\my pictures\svchost.exe
- %ALLUSERSPROFILE%\documents\my music\svchost.exe
- %WINDIR%\svchost.exe
- <SYSTEM32>\angle.exe
- <Drive name for removable media>:\~.exe
- <Drive name for removable media>:\~angle.exe
- %ALLUSERSPROFILE%\documents\my pictures\svchost.exe
- %ALLUSERSPROFILE%\documents\my music\svchost.exe
- %WINDIR%\svchost.exe
- <SYSTEM32>\angle.exe
- %ALLUSERSPROFILE%\documents\my music\angle.exe
- %ALLUSERSPROFILE%\start menu\programs\startup\msmsgs.exe
- %WINDIR%\ziprar.exe
- %ALLUSERSPROFILE%\documents\my pictures\messenger.exe
- %ALLUSERSPROFILE%\documents\my pictures\wmplayer.exe
- %ALLUSERSPROFILE%\documents\my pictures\iexplore.exe
- %ALLUSERSPROFILE%\documents\my pictures\jpg.exe
- <Drive name for removable media>:\skypesetup'.exe
- <Drive name for removable media>:\calc'.exe
- <Drive name for removable media>:\utorrent'.exe
- <Drive name for removable media>:\~'.exe
- %ALLUSERSPROFILE%\documents\my pictures\svchost.exe
- %ALLUSERSPROFILE%\documents\my music\svchost.exe
- %WINDIR%\svchost.exe
- <SYSTEM32>\angle.exe
- %ALLUSERSPROFILE%\documents\my music\angle.exe
- %WINDIR%\ziprar.exe
- %ALLUSERSPROFILE%\documents\my pictures\messenger.exe
- %ALLUSERSPROFILE%\documents\my pictures\wmplayer.exe
- %ALLUSERSPROFILE%\documents\my pictures\iexplore.exe
- %ALLUSERSPROFILE%\documents\my pictures\jpg.exe
- <Drive name for removable media>:\skypesetup'.exe
- <Drive name for removable media>:\calc'.exe
- <Drive name for removable media>:\utorrent'.exe
- <Drive name for removable media>:\~'.exe
- '%ALLUSERSPROFILE%\documents\my pictures\svchost.exe'
- '%ALLUSERSPROFILE%\start menu\programs\startup\msmsgs.exe'
- '<SYSTEM32>\angle.exe'
- '%ALLUSERSPROFILE%\documents\my pictures\wmplayer.exe'
- '<SYSTEM32>\reg.exe' export HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\srservice %WINDIR%\regedit.reg' (with hidden window)
- '%ProgramFiles%\winrar\rar.exe' a -ao -ep "%ALLUSERSPROFILE%\Documents\My Music\angle.Zip" "%ALLUSERSPROFILE%\Documents\My Music\angle.eXe"' (with hidden window)
- '<SYSTEM32>\reg.exe' export HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\srservice %WINDIR%\regedit.reg
- '%ProgramFiles%\winrar\rar.exe' a -ao -ep "%ALLUSERSPROFILE%\Documents\My Music\angle.Zip" "%ALLUSERSPROFILE%\Documents\My Music\angle.eXe"