Packed MD5 37f41fd8ab03ae646487531ef1316ebc 
Priority 28 
First 07/24/2008 
Last 08/19/2008 
Count 111 
History 111 hits: 07-24 to 08-19 
Unpacked MD5  
AV Hits 19 17 
AV Count 32 
CC Servers 210.245.211.11:65520 210.245.211.11:65520 190.174.67.119:13001 210.245.211.11:65520 24.192.170.232:13001 72.10.172.218:2938 210.245.211.11:65520 210.245.211.11:65520 122.131.133.19:13001 210.245.211.11:65520 67.149.121.39:13001 
DNS Lookups HK:proxim.ircgalaxy.pl IL:ksn.a1001186.wrs.mcboo.com DE:dl2.teenpassage.com JP:chat-shqip.org US:wr.mcboo.com HK:proxima.ircgalaxy.pl US:microsoft.com US:download.microsoft.com :fleshkatera.cn :lolika.cn :www.upononjob.cn :mulfika.cn IL:wr.mcboo.com IL:bfb88.a1001186.wrs.loloplanet.com US:mysoft-forum.net EU:terahost.cn US:windowsupdate.microsoft.com EU:antivirusxp08.net EU:stat.antivirusxp08.net IL:bfb88.a1001186.wrs.mcboo.com US:ksn.a1001186.wrs.mcboo.com US:bfb88.a1001186.wrs.mcboo.com :zredirector.com :wpad US:chat-shqip.org US:w3bs.chat-shqip.org CA:japan.youngpeyatech.info CA:fuck.urpal43sourpalhuh.com CA:teek.ihshsd8.com IL:dl.mcboo.com US:b156.mcboo.ws US:b155.mcboo.com US:b148.mcboo.com :berlinads3.com IL:mtn6.com-com.ws 
Failed Connects IL:194.90.224.86:80 US:204.160.126.126:80 HK:210.245.211.11:65520 IL:62.90.134.24:80 US:199.93.44.126:80 US:192.221.110.126:80 US:198.78.201.126:80 US:207.123.46.126:80 US:192.221.110.125:80 US:69.28.178.10:80 US:24.192.170.232:12351 US:24.192.170.232:13001 CA:72.10.172.218:2938 CA:72.10.172.218:9928 US:206.251.244.226:80 DE:85.114.143.2:80 US:199.93.46.125:80 US:205.128.66.124:80 US:4.23.60.125:80 US:192.221.108.126:80 US:205.128.73.126:80 US:207.123.47.126:80 VE:190.75.104.96:12351 VE:190.75.104.96:13001 DE:85.114.141.207:80 US:198.78.220.126:80 US:67.149.121.39:12351 US:67.149.121.39:13001 HK:210.245.211.11:80 US:204.160.126.124:80 US:207.123.37.125:80 76.9.9.190:80 US:206.33.45.125:80 US:208.111.153.215:80 US:208.111.153.231:80 US:208.111.148.254:80 
AV Name AhnLab-V3:MISSED, AntiVir:TRCrypt.ULPM.Gen, Authentium:MISSED, Avast:_Agent-ZII, AVG:Downloader.Generic7.ABJV, BitDefender:Retapu.D, CAT-QuickHeal:MISSED, ClamAV:MISSED, DrWeb:MISSED, eSafe:MISSED, eTrust-Vet:MISSED, Ewido:MISSED, FileAdvisor:MISSED, Fortinet:MISSED, F-Prot:MISSED, F-Secure:Trojan-Downloader.Small.yxa, Ikarus:Retapu.D, Kaspersky:Trojan-Downloader.Small.yxa, McAfee:MISSED, Microsoft:MISSED, NOD32v2:MISSED, Norman:MISSED, Panda:MISSED, Prevx1:MISSED, Rising:MISSED, Sophos:MalDownLdr-O, Sunbelt:MISSED, Symantec:Downloader, TheHacker:MISSED, VBA32:MISSED, VirusBuster:MISSED, Webwasher-Gateway:Crypt.ULPM.Gen  
WinXP Files , 6.tmp, 7.tmp, 8.tmp, accwiz.exe, actmovie.exe, agentsvr.exe, ahui.exe, alg.exe, arp.exe, asr_fmt.exe, asr_ldm.exe, at.exe, atmadm.exe, attrib.exe, bootcfg.exe, bootok.exe, bootvrfy.exe, cacls.exe, calc.exe, charmap.exe, chkdsk.exe, chkntfs.exe, cidaemon.exe, cipher.exe, cisvc.exe, ckcnv.exe, cleanmgr.exe, cliconfg.exe, clipbrd.exe, clipsrv.exe, cmdl32.exe, cmmon32.exe, cmstp.exe, compact.exe, comp.exe, comrepl.exe, conime.exe, control.exe, convert.exe, cscript.exe, ctfmon.exe, dcomcnfg.exe, ddeshare.exe, defrag.exe, dfrgfat.exe, dfrgntfs.exe, diantz.exe, DIL3.tmp, DIL4.tmp, diskpart.exe, diskperf.exe, dllhost.exe, dllhst3g.exe, dmadmin.exe, dmremote.exe, doskey.exe, dplaysvr.exe, dpnsvr.exe, dpvsetup.exe, driverquery.exe, drwtsn32.exe, dumprep.exe, dvdplay.exe, dvdupgrd.exe, dxdiag.exe, esentutl.exe, eudcedit.exe, eventcreate.exe, eventtriggers.exe, eventvwr.exe, expand.exe, extrac32.exe, fc.exe, find.exe, findstr.exe, finger.exe, fixmapi.exe, fontview.exe, forcedos.exe, freecell.exe, fsutil.exe, ftp.exe, getmac.exe, gpresult.exe, gpupdate.exe, grpconv.exe, HelpCtr.exe, help.exe, HelpHost.exe, HelpSvc.exe, hh.exe, hostname.exe, hosts, ie4uinit.exe, iexpress.exe, imapi.exe, ipconfig.exe, ipsec6.exe, ipv6.exe, ipxroute.exe, label.exe, lights.exe, lnkstub.exe, locator.exe, lodctr.exe, logagent.exe, logman.exe, logoff.exe, logon.scr, logonui.exe, lpq.exe, lpr.exe, magnify.exe, makecab.exe, migload.exe, migpwd.exe, migwiz_a.exe, migwiz.exe, mmc.exe, mnmsrvc.exe, mobsync.exe, mofcomp.exe, mountvol.exe, mplay32.exe, mpnotify.exe, mqbkup.exe, mqsvc.exe, mqtgsvc.exe, mrinfo.exe, mrofinu1001186.exe, msconfig.exe, msdtc.exe, msg.exe, mshearts.exe, mshta.exe, msiexec.exe, msoobe.exe, mspaint.exe, msswchx.exe, mstinit.exe, mstsc.exe, MYBHO.DLL, narrator.exe, nbtstat.exe, nddeapir.exe, net1.exe, netdde.exe, net.exe, netsetup.exe, netsh.exe, netstat.exe, NOTEPAD.EXE, notiflag.exe, nppagent.exe, nslookup.exe, ntbackup.exe, ntsd.exe, ntvdm.exe, nwscript.exe, odbcad32.exe, odbcconf.exe, oobebaln.exe, openfiles.exe, osk.exe, osuninst.exe, packager.exe, pathping.exe, pentnt.exe, perfmon.exe, ping6.exe, print.exe, progman.exe, proquota.exe, proxycfg.exe, qappsrv.exe, qprocess.exe, qwinsta.exe, rasautou.exe, rasdial.exe, rasphone.exe, rcimlby.exe, rcp.exe, rdpclip.exe, rdsaddin.exe, rdshost.exe, recover.exe, relog.exe, replace.exe, reset.exe, rexec.exe, routemon.exe, rsh.exe, rsm.exe, rsmsink.exe, rsmui.exe, rsnotify.exe, rsopprov.exe, rstrui.exe, rsvp.exe, rtcshare.exe, runas.exe, rundll32.exe, runonce.exe, rwinsta.exe, savedump.exe, scardsvr.exe, schtasks.exe, scrcons.exe, scrnsave.scr, sdbinst.exe, secedit.exe, sessmgr.exe, sethc.exe, sfc.exe, shadow.exe, shmgrate.exe, shrpubw.exe, shutdown.exe, sigverif.exe, skeys.exe, smlogsvc.exe, sndrec32.exe, sndvol32.exe, sol.exe, sort.exe, spider.exe, srdiag.exe, ss3dfo.scr, ssbezier.scr, ssflwbox.scr, ssmarque.scr, ssmypics.scr, ssmyst.scr, sspipes.scr, ssstars.scr, sstext3d.scr, stimon.exe, subst.exe, SVCHOST.EXE, syncapp.exe, syskey.exe, sysocmgr.exe, systeminfo.exe, systray.exe, taskkill.exe, tasklist.exe, taskman.exe, taskmgr.exe, tcmsetup.exe, tcpsvcs.exe, telnet.exe, tftp.exe, tlntadmn.exe, tlntsess.exe, tlntsvr.exe, tourstart.exe, tracerpt.exe, tracert6.exe, tracert.exe, tscon.exe, tscupgrd.exe, tsdiscon.exe, tskill.exe, tsshutdn.exe, twunk_32.exe, typeperf.exe, unlodctr.exe, unsecapp.exe, UploadM.exe, upnpcont.exe, ups.exe, userinit.exe, usrmlnka.exe, usrprbda.exe, usrshuta.exe, utilman.exe, verifier.exe, VRT2.tmp, VRT9.tmp, vssadmin.exe, vssvc.exe, w32tm.exe, wbemtest.exe, wextract.exe, wiaacmgr.exe, winhlp32.exe, winmgmt.exe, winmine.exe, winmsd.exe, winver.exe, wmiadap.exe, wmiapsrv.exe, wmic.exe, wmiprvse.exe, wmpstub.exe, wpabaln.exe, wpnpinst.exe, write.exe, wuauclt.exe, wupdmgr.exe, xcopy.exe  
WinXP Processes CMD.EXE, CSRSS.EXE, DLLHOST.EXE, EXPLORER.EXE, LSASS.EXE, MROFIN~1.EXE, MSMSGS.EXE, SERVICES.EXE, SPOOLSV.EXE, SVCHOST.EXE, WINLOGON.EXE  
WinXP Registries HKEY_CLASSES_ROOT@...HKEY_CLASSES_ROOT\\WR, HKEY_LOCAL_MACHINE@...BrowserHelperObjects\\45080112-43D4-4B43-A8BC-7F1DFBFDCEAF, HKEY_LOCAL_MACHINE@...Classes\\WR, HKEY_LOCAL_MACHINE@...Explorer\\BrowserHelperObjects, HKEY_LOCAL_MACHINE@...Microsoft\\DownloadManager  
WinXP Ports 1031, 1054, 707, 1035, 1042, 69, 1034, 1036, 1040  
Win-2Kf Files  
Win-2Kf Processes  
Win-2Kf Registries HKEY_CLASSES_ROOT@...HKEY_CLASSES_ROOT\\WR, HKEY_LOCAL_MACHINE@...Classes\\WR, HKEY_USERS@...InternetSettings\\5.0, HKEY_USERS@...InternetSettings\\Connections  
Win-2Kf Ports  
Create Events  
Create Files  
Create RegKeys  
Open RegKeys  
Service Starts  
Service Deletes  
Service Creates  
Cluster  
Cluster Confidence  
Packer ID1 none 
Packer ID2 none 
Embedded DNS  
String Count  
String Link text
String MD5  
Timerange 365 Days 
Unpack Status unknown () 
Countries 16 
Unpacked Link none[none
Callgraph none:none 
API Resolution  
Comment none