ThreatExpert Report: W32/Bamital.dll, Backdoor.Win32.Shiz

Submission Summary:

Submission details:

Submission received: 19 February 2011, 03:26:14
Processing time: 13 min 55 sec
Submitted sample:

File MD5: 0x826C855B440611A944E25F072A533EA3
File SHA-1: 0xA47B808987DF31318F0ED76E68BDF9B46B0B1018
Filesize: 45,412 bytes

Summary of the findings:

What's been found	Severity Level
Downloads/requests other files from Internet.
Creates a startup registry entry.
Registers a 32-bit in-process server DLL.
Registers a Browser Helper Object (Microsoft's Internet Explorer plugin module).

Technical Details:

File System Modifications

The following files were created in the system:

#	Filename(s)	File Size	File Hash	Alias
1	%CommonPrograms%\Xvid\Configure Decoder.lnk	1,389 bytes	MD5: 0x1B6CDF63A45304080C1EFEC73FCB868C SHA-1: 0xD9E6117A9F3A40523366F7EFF2AC338596E45C83	(not available)
2	%CommonPrograms%\Xvid\Configure Encoder.lnk	1,399 bytes	MD5: 0x55B0B31E0D8CA941BDB0C818399D5E31 SHA-1: 0x310E6569F9FE11554F326E12AA53582496EB436F	(not available)
3	%CommonPrograms%\Xvid\INet-Doom9's Xvid Forum.lnk	684 bytes	MD5: 0x6D9922DA7EADC67BFE79843251487190 SHA-1: 0x8E7DDC1B871857BAFE26538C29C08ACCF452D70D	(not available)
4	%CommonPrograms%\Xvid\INet-Koepi's Homepage (Updates).lnk	758 bytes	MD5: 0xB6E1AF01319B8D78AE4B6E6E5CF3BCBB SHA-1: 0x08F8CB3DBAE16BC18427570BF797C7D18DFE3618	(not available)
5	%CommonPrograms%\Xvid\INet-Xvid Homepage.lnk	688 bytes	MD5: 0x2767FD5C1C3A08E0E91BBBF71B2FBFAB SHA-1: 0xB3AC4865762133533A6948CD8B704D79C5D62044	(not available)
6	%CommonPrograms%\Xvid\Koepi's OGMCalc.lnk	717 bytes	MD5: 0x7948AFC19C15C65FEB7F449467BAE8E8 SHA-1: 0xAB9681411817663BF36AAA32CAECE1B0CC8C3C0D	(not available)
7	%CommonPrograms%\Xvid\Nic's FourCC changer.lnk	668 bytes	MD5: 0xBDC1A5FA5F320085980C07AFAA391AB3 SHA-1: 0x2CD306446544AD1686AD6456026C192B7D024EDD	(not available)
8	%CommonPrograms%\Xvid\Nic's MiniCalc.lnk	672 bytes	MD5: 0x3B3ADADD26BDB4A09609413F376B9C35 SHA-1: 0x05F1FECEFB6E311FC349A9806F93E1F2E73992E9	(not available)
9	%CommonPrograms%\Xvid\Release Notes.lnk	726 bytes	MD5: 0x86ADE317B7F035BF9E189126DC6B6689 SHA-1: 0x1BAF370E880635B8E30AD6B07A89F9F227898AFA	(not available)
10	%CommonPrograms%\Xvid\Some quantization matrices.lnk	749 bytes	MD5: 0x6DC294304C5E6EA7A230E5A9C57429CD SHA-1: 0x6657B496128958AE5EB5622ECEA4E928A23BD4C6	(not available)
11	%CommonPrograms%\Xvid\StatsReader 2.1.lnk	705 bytes	MD5: 0x839F4D3619F3114AB1ABED25D25C2459 SHA-1: 0x464F7AE474C802E9271C3B34B4EA22D209634AD8	(not available)
12	%CommonPrograms%\Xvid\StatsReader Notes.lnk	703 bytes	MD5: 0x8EE862B649B8555F55E8CA0FF8CB8273 SHA-1: 0x175FAD453670736301596CDDF308705CDB81CAC1	(not available)
13	%CommonPrograms%\Xvid\Uninstall Xvid.lnk	1,522 bytes	MD5: 0x1D61B2DD134D547047D0AB76F6C7A15C SHA-1: 0xDF1A7B34DB41D7748DEC6D3160536058F6669FF1	(not available)
14	%CommonPrograms%\Xvid\Vidc.Cleaner.lnk	1,623 bytes	MD5: 0x19B7B491B18009650A798E91DD8D6A70 SHA-1: 0xABEEE086E69E48D0D172DD7E074A154F5289272A	(not available)
15	%AppData%\GoogleDownload.exe	53,248 bytes	MD5: 0xD63D6096F2C30AFADACD398BE05F8534 SHA-1: 0xD7BD2C30D2751D51D7AE9C7BD8E99BFC5D033CA3	(not available)
16	%AppData%\Microsoft\Crypto\RSA\S-1-5-21-606747145-764733703-839522115-1003\90ac1d5a5a4073905d0aad6e1ee11e6b_a7bcc1a4-f7a4-4502-8650-8579e607f7f7	77 bytes	MD5: 0x83708FC68B5DA8E6E1DD4792CBAAB76B SHA-1: 0x5B561D14BACCDADDC0D3BA3B24B276A79F389487	(not available)
17	%AppData%\Microsoft\Google\s.txt	156 bytes	MD5: 0xA71DB56D032282A51D5E60841E1B7AC5 SHA-1: 0xCEA9331D6D2A9D6F8522CCC1ED89BFBF1B7E680C	(not available)
18	%Temp%\219201132626.exe [file and pathname of the sample #1]	45,412 bytes	MD5: 0x826C855B440611A944E25F072A533EA3 SHA-1: 0xA47B808987DF31318F0ED76E68BDF9B46B0B1018	(not available)
19	%Temp%\219201132629.exe %Temp%\219201132631.exe	64,512 bytes	MD5: 0x45039C9BD32914D7E9A2AC380160E113 SHA-1: 0x0BDBF178318648E578CEE3C8B20BC0CED685688B	(not available)
20	%Temp%\219201132633.exe	63,112 bytes	MD5: 0x2F7F1C2F8BF471ED96C2A7114AC14655 SHA-1: 0xA2E23CADFB0C9A0AD582A91AD67EF9353B15F5D7	(not available)
21	%Temp%\219201132634.exe	64,512 bytes	MD5: 0x79950ECF7D41D7CB28B37F342DBD96A5 SHA-1: 0xB0850887AA33421EA830D4E97583C741AACCF293	packed with UPX [Kaspersky Lab]
22	%Temp%\219201132636.exe	49,198 bytes	MD5: 0xF95C289F293BBFBD361485EBD3018732 SHA-1: 0x2EDF346921FE24EA9CC116263BFB1C2B7FF57284	(not available)
23	%Temp%\219201132654.exe	907,064 bytes	MD5: 0x2580024FADF928DEB1020093CE90F7DF SHA-1: 0x0EA1488ED66ABFAAB9A20D062FB7670BC1A7FA4C	(not available)
24	%Temp%\219201132655.bat	55 bytes	MD5: 0x035AB0C77B022996DEA64B81B6A812AE SHA-1: 0xE5E0C0D7F00AAB96E514CA9001D05B697FCE52F2	(not available)
25	%Temp%\219201132655.exe	907,064 bytes	MD5: 0xF9A9485AE9BB129852711DD85304B8CD SHA-1: 0x93D7EBA6F30C446962C4B0ABDC2AF421A9554CAA	(not available)
26	%Temp%\219201132656.bat	55 bytes	MD5: 0x8FB9B63ED15A390FC14AFD1ECD413549 SHA-1: 0x93C0FB587D945F6F491F7C3D42256382D050DD27	(not available)
27	%Temp%\219201132820.exe	907,064 bytes	MD5: 0x7B3DE1833032AA5E5735D38EBFBAD4A1 SHA-1: 0x858349225A74ECFA0B6F7FF67F90DAB330102DBD	(not available)
28	%Temp%\219201132821.bat	55 bytes	MD5: 0x6746F0BCD08B8B0467EFFFC80AE78873 SHA-1: 0x1F85824D09B7B07FBE8B88E935B1E405F524280C	(not available)
29	%Temp%\nsn34.tmp\Background.png	963 bytes	MD5: 0xE4161911C702BFE4F953A0C909075FCF SHA-1: 0xD3E4B87F5CD405C634A786FF2A41DEF44790D01A	(not available)
30	%Temp%\nsn34.tmp\blowfish.dll %Temp%\nsu1B.tmp\blowfish.dll %Temp%\nsv1E.tmp\blowfish.dll	61,440 bytes	MD5: 0x926E4475C00FB5254C32C876921B77D0 SHA-1: 0x8A55BC8B6E49021A4ABBD441783C41D5E019798B	(not available)
31	%Temp%\nsn34.tmp\button-active.gif	991 bytes	MD5: 0x88FCA2603BCB5C39B9592625B1A14212 SHA-1: 0x2691188FFB42FC83E9D8FAF9FA50D0B77429C3CA	(not available)
32	%Temp%\nsn34.tmp\button.gif	1,084 bytes	MD5: 0x6F5E5FDD7270519A55C71FE2E0971A7C SHA-1: 0x1890CBE5D64D155370D77ADC81BFE964772089B0	(not available)
33	%Temp%\nsn34.tmp\Components.html	67,017 bytes	MD5: 0xEF783439456E7B2DF66940B5AADDED9E SHA-1: 0xFC15562AF079C63681FA4202AEAA97D205E6916E	(not available)
34	%Temp%\nsn34.tmp\Final.html	2,438 bytes	MD5: 0x20622CDE5D463F692052753D96B47EAD SHA-1: 0x03C103C158D0FF18561C11545A9A9AC4F9C3A1B7	(not available)
35	%Temp%\nsn34.tmp\nswg.dll %Temp%\nsu1B.tmp\nswg.dll %Temp%\nsv1E.tmp\nswg.dll	186,368 bytes	MD5: 0x4F2B563F712670211D0E932E43B6E277 SHA-1: 0x53014306F362C90AF7F58AD546237E6310E58FD3	(not available)
36	%Temp%\nsn34.tmp\System.dll	11,264 bytes	MD5: 0xC17103AE9072A06DA581DEC998343FC1 SHA-1: 0xB72148C6BDFAADA8B8C3F950E610EE7CF1DA1F8D	(not available)
37	%Temp%\nsn34.tmp\welcomebg.gif	35,270 bytes	MD5: 0xF6918D85FE37ED92393432B6C003811D SHA-1: 0x5D01308D78664E610BA31020F9C7F2214D848D32	(not available)
38	%Temp%\nsn34.tmp\welcomepage.html	5,534 bytes	MD5: 0xEAD9AA05537BFB602BF7CF3243EF4E59 SHA-1: 0x39F7F7662FC3EF31DE18FF03F55D37BCEBBBCDCC	(not available)
39	%Temp%\nsu1B.tmp\InetLoadEx.dll %Temp%\nsv1E.tmp\InetLoadEx.dll	56,832 bytes	MD5: 0x9FAE574B1004BB0650EEBBA3D8040C59 SHA-1: 0x541583EC14AF05915B8EFEFE520EDD4F25914C9A	(not available)
40	%Temp%\nsu1B.tmp\Progress.dll %Temp%\nsv1E.tmp\Progress.dll	82,432 bytes	MD5: 0x15E01578481287BBCF32D2217F1B5246 SHA-1: 0x67A7D05BB2F8B33980867D3352280FA0CD0B4E9F	(not available)
41	%Temp%\nsy33.tmp	1,385,123 bytes	MD5: 0xAFF1D60212FCCFCAA269CBECE359EDC5 SHA-1: 0x50FCE2066E50BC0607CCD2F302776FB18CAF587B	(not available)
42	%InternetCache%\ziJILC0Bxj	2,284 bytes	MD5: 0x26A4F1BB4FBB9D232C8EA2AAD577685C SHA-1: 0x4DAA383FEC15A76F845CC3771351928830E4D09B	(not available)
43	%ProgramFiles%\Xvid\AviC.exe	6,144 bytes	MD5: 0xC39AD6299E0E1F7AA3F5B51AC9B5CD0E SHA-1: 0x468E27F8A20C07AC8100E8223B326909095DD6D6	(not available)
44	%ProgramFiles%\Xvid\doom9forum.url	79 bytes	MD5: 0xDC45662BDF8CAD91226BA35461E5E645 SHA-1: 0x7419E01DD36CF99D20CCE57E8067ABD40E1765BA	(not available)
45	%ProgramFiles%\Xvid\koepishomepage.url	121 bytes	MD5: 0x2C6D2BF6124CF5ABEAB023541722DE8C SHA-1: 0x9DA65E876702EB24D01A4BB8AB1AEC82D5F7EB60	(not available)
46	%ProgramFiles%\Xvid\LICENSE	18,327 bytes	MD5: 0x9E865F6174E00936D7BE7B816B3FF188 SHA-1: 0xE64C9C36E85D2022A45A3D4CB0F196C01F216072	(not available)
47	%ProgramFiles%\Xvid\MiniCalc.exe	23,040 bytes	MD5: 0x7CE40A557359849EA374E0E4DDE52E26 SHA-1: 0xD865E7EF9C41D8C622EC87577685F3E1868F420E	packed with UPX [Kaspersky Lab]
48	%ProgramFiles%\Xvid\OGMCalc.exe	9,216 bytes	MD5: 0x95CAEF9DA6E9AEE1ECD627527CFA0F38 SHA-1: 0xF0CE07A0C7DA2F0239EBFE3CA37CD03332D80F0B	packed with UPX [Kaspersky Lab]
49	%ProgramFiles%\Xvid\plugins_lumimasking.c-diff.txt	5,021 bytes	MD5: 0x193362D99E0BB3BFA64D6E57D4C339D2 SHA-1: 0x8EDDCF87C0D5FD8E3B1D054B955347B94556DA4A	(not available)
50	%ProgramFiles%\Xvid\releasenotes.txt	1,095 bytes	MD5: 0x493EAB5004E236C6EA44CE95E62235A2 SHA-1: 0x4B4394E4897A0CB04A38F0FFB5471B4046C1DE33	(not available)
51	%ProgramFiles%\Xvid\StatsReader.exe	13,824 bytes	MD5: 0x487AF46145B81C5BC54873E764F93636 SHA-1: 0xF948B0544C59127E8845EEF915F2EC3B6B1C3508	packed with UPX [Kaspersky Lab]
52	%ProgramFiles%\Xvid\statsreader.txt	1,496 bytes	MD5: 0x01221F7D49384F1EA1FB6967A2D11C20 SHA-1: 0x89F7BD49C109D5109A71FD24A092338FFB0BD76B	(not available)
53	%ProgramFiles%\Xvid\unins000.dat	5,912 bytes	MD5: 0x87647D6FA5602918EC90DCE495661C32 SHA-1: 0x30267B915A85D92DC67663FA85AD1CD5BD086857	(not available)
54	%ProgramFiles%\Xvid\unins000.exe	673,610 bytes	MD5: 0x4BFD4F1E61C5C1A7D4158952AE2A2AD6 SHA-1: 0x8D38D0D38ED2FFA7F5559A382D16AE82EF99A08E	(not available)
55	%ProgramFiles%\Xvid\vidccleaner.exe	8,704 bytes	MD5: 0x6B5E418A9C02AB0C3F3DD50B0E3CD3A6 SHA-1: 0xD7E976B79DE0E822F41845F45C6311D11D2179D0	packed with UPX [Kaspersky Lab]
56	%ProgramFiles%\Xvid\xvid.ico	766 bytes	MD5: 0x4D0DBF39F00A21CF520E172EF37145D2 SHA-1: 0x8E0F324F43D30EF9535CEDD3CDE46CCCB6B8A21D	(not available)
57	%ProgramFiles%\Xvid\xvidhomepage.url	44 bytes	MD5: 0xDFD74226477506DCACF1FD7698DC7C00 SHA-1: 0xE7F1CA16188CD26FA29E8A53C64A8D9D7E3DBC85	(not available)
58	%ProgramFiles%\Xvid\Xvid_Quant_Matrices.zip	2,967 bytes	MD5: 0xF0176ACEBF968B6F6DF8743C26258D0F SHA-1: 0x021881D09DDFB398D65A0ABE367274553D926329	(not available)
59	%System%\-9sAPjw1WLHo.exe	127,234 bytes	MD5: 0x0DF77E05725BF1FABC5925C57011FA62 SHA-1: 0xB3585BB050513573A38298D109E13599E79C3CB7	(not available)
60	%System%\2K-fD_.dll	2,127,360 bytes	MD5: 0x3A4E6E4B235419B1594D9662E42D6245 SHA-1: 0x761CF7717DAF097DDAFD6CE67DD2BF255EAEA128	(not available)
61	%System%\dll	36,316 bytes	MD5: 0x8DB8100940972857279642952A257D14 SHA-1: 0x1BDA6DDD6292715DEE3216A2A195CE621CBEDC76	(not available)
62	%System%\xvid.ax	77,824 bytes	MD5: 0x06A1AAB474756DF76BB817CB680C4593 SHA-1: 0x7DE8634C41254217E67FD4D10643E8F88331CF62	(not available)
63	%System%\xvidcore.dll	819,200 bytes	MD5: 0x1CD08C0FA0C5BD53450E332F35304381 SHA-1: 0x3116C26AA9BA6FE26C004620EC3DB1B121FE2B1C	(not available)
64	%System%\xvidvfw.dll	180,224 bytes	MD5: 0x7FE2E2373140E32D4BB12633923C120A SHA-1: 0x978BC33DA441D37CEADF71B1375306E01E8AEDEC	(not available)
65	%System%\zx.dll	3,584 bytes	MD5: 0x7049917042D3BBFA152CB42EFD9F240B SHA-1: 0x4E9D0A1C45454ACD8E8B42FB62CC4AAF5CD15890	W32/Bamital.dll [McAfee] Backdoor.Win32.Shiz [Ikarus]
66	%Windir%\Temp\explorer.dat	1,032,192 bytes	MD5: 0xA0732187050030AE399B241436565E64 SHA-1: 0x69F33740413DA112630BE73EBB805A23B69F2F7F	(not available)
67	%Windir%\Temp\winlogon.dat	502,272 bytes	MD5: 0x01C3346C241652F43AED8E2149881BFE SHA-1: 0xA5396141CAB8B22D9D88B28A814089537DCE366A	(not available)

Notes:

%CommonPrograms% is a variable that refers to the file system directory that contains the directories for the common program groups that appear on the Start menu for all users. A typical path is C:\Documents and Settings\All Users\Start Menu\Programs (Windows NT/2000/XP).
%AppData% is a variable that refers to the file system directory that serves as a common repository for application-specific data. A typical path is C:\Documents and Settings\[UserName]\Application Data.
%Temp% is a variable that refers to the temporary folder in the short path form. By default, this is C:\Documents and Settings\[UserName]\Local Settings\Temp\ (Windows NT/2000/XP).
%InternetCache% is a variable that refers to the file system directory that serves as a common repository for temporary Internet files. A typical path is C:\Documents and Settings\[UserName]\Local Settings\Temporary Internet Files.
%ProgramFiles% is a variable that refers to the Program Files folder. A typical path is C:\Program Files.
%System% is a variable that refers to the System folder. By default, this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).
%Windir% is a variable that refers to the Windows installation folder. By default, this is C:\Windows or C:\Winnt.

The following directories were created:

%CommonPrograms%\Xvid
%AppData%\Microsoft\Google
%Temp%\nsn34.tmp
%Temp%\nsn34.tmp\downloads
%Temp%\nsu1B.tmp
%Temp%\nsv1E.tmp
%ProgramFiles%\Xvid

Memory Modifications

There were new processes created in the system:

Process Name	Process Filename	Main Module Size
GoogleDownload.exe	%AppData%\googledownload.exe	57,344 bytes
219201132633.exe	%Temp%\219201132633.exe	53,248 bytes
219201132636.exe	%Temp%\219201132636.exe	53,248 bytes
219201132820.exe	%Temp%\219201132820.exe	311,296 bytes

There were new memory pages created in the address space of the system process(es):

Process Name	Process Filename	Allocated Size
spoolsv.exe	%System%\spoolsv.exe	999,424 bytes
spoolsv.exe	%System%\spoolsv.exe	999,424 bytes

The following module was loaded into the address space of other process(es):

Module Name	Module Filename	Address Space Details
2K-fD_.dll	%System%\2K-fD_.dll	Process name: IEXPLORE.EXE Process filename: %ProgramFiles%\internet explorer\iexplore.exe Address space: 0x2C9E0000 - 0x2CBF7000

Registry Modifications

The following Registry Keys were created:

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{64697678-0000-0010-8000-00AA00389B71}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00000001-4FEF-40D3-B3FA-E0531B897F98}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00000001-4FEF-40D3-B3FA-E0531B897F98}\InprocServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{46c050df-0783-c267-6957-88d73fa89c71}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{64697678-0000-0010-8000-00AA00389B71}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{64697678-0000-0010-8000-00AA00389B71}\InprocServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{d3c299f2-8028-5bf5-3005-7755263a2886}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{d3c299f2-8028-5bf5-3005-7755263a2886}\InProcServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EB6D578499B1CCF5F581EAD56BE3D9B6744A5E5
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{d3c299f2-8028-5bf5-3005-7755263a2886}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\-9sAPjw1WLHo
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Xvid_is1
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\MediaResources\icm
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\MediaResources\icm\vidc.XVID
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\MediaResources\icm
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\MediaResources\icm\vidc.XVID
HKEY_USERS\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates\F77A3F82B7C4B3A9D869A93E3335CF1F78BC441E
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{0AE0623A-93A8-44A1-9C55-C163D71F1529}
HKEY_CURRENT_USER\Software\Microsoft\SystemCertificates\CA\Certificates\F77A3F82B7C4B3A9D869A93E3335CF1F78BC441E
HKEY_CURRENT_USER\Software\AppDataLow
HKEY_CURRENT_USER\Software\AppDataLow\---N2-GaIU-1-
HKEY_CURRENT_USER\Software\AppDataLow\---N2-GaIU-1-\k_A7f_I
HKEY_CURRENT_USER\Software\GNU
HKEY_CURRENT_USER\Software\GNU\Xvid

The newly created Registry Values are:

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{64697678-0000-0010-8000-00AA00389B71}]

FriendlyName = "Xvid MPEG-4 Video Decoder"
CLSID = "{64697678-0000-0010-8000-00AA00389B71}"
FilterData = 02 00 00 00 00 00 80 00 02 00 00 00 00 00 00 00 30 70 69 33 00 00 00 00 00 00 00 00 08 00 00 00 00 00 00 00 00 00 00 00 30 74 79 33 00 00 00 00 D0 00 00 00 E0 00 00 00 31 74 79 33 00 00 00 00 D0 00 00 00 F0 00 00 00 32 74 79 33 00 00 00 00 D0 00 00 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00000001-4FEF-40D3-B3FA-E0531B897F98}\InprocServer32]

(Default) = "%System%\xvid.ax"
ThreadingModel = "Both"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00000001-4FEF-40D3-B3FA-E0531B897F98}]

(Default) = "Xvid MPEG-4 Video DecoderAbout"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{46c050df-0783-c267-6957-88d73fa89c71}]

3452890890 = "ï¿½ï¿½ï¿½ï¿½ï¿½ï¿½ï¿½ï¿½ï¿½ï¿½ï¿½ï¿½ð©º¨ï¿½ï¿½ï¿½ï¡¬ï¿½Çï¿½ï¿½ï¿½"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{64697678-0000-0010-8000-00AA00389B71}\InprocServer32]

(Default) = "%System%\xvid.ax"
ThreadingModel = "Both"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{64697678-0000-0010-8000-00AA00389B71}]

(Default) = "Xvid MPEG-4 Video Decoder"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{d3c299f2-8028-5bf5-3005-7755263a2886}\InProcServer32]

(Default) = "%System%\2K-fD_.dll"
ThreadingModel = "Apartment"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{d3c299f2-8028-5bf5-3005-7755263a2886}]

(Default) = "closespace"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EB6D578499B1CCF5F581EAD56BE3D9B6744A5E5]

Blob = 04 00 00 00 01 00 00 00 10 00 00 00 CB 17 E4 31 67 3E E2 09 FE 45 57 93 F3 0A FA 1C 03 00 00 00 01 00 00 00 14 00 00 00 4E B6 D5 78 49 9B 1C CF 5F 58 1E AD 56 BE 3D 9B 67 44 A5 E5 1D 00 00 00 01 00 00 00 10 00 00 00 C6 CB CA FA 17 95 5C 4C FD 41 EC A

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{d3c299f2-8028-5bf5-3005-7755263a2886}]

NoExplorer = 0x00000000

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

GoogleDownload = "%AppData%\GoogleDownload.exe"

so that GoogleDownload.exe runs every time Windows starts

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\-9sAPjw1WLHo]

DisplayName = "Stumble Sites Add On"
UninstallString = "%System%\-9sAPjw1WLHo.exe"
NoModify = 0x00000000
NoRepair = 0x00000000

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Xvid_is1]

Inno Setup: Setup Version = "5.1.6"
Inno Setup: App Path = "%ProgramFiles%\Xvid"
InstallLocation = "%ProgramFiles%\Xvid\"
Inno Setup: Icon Group = "Xvid"
Inno Setup: User = "%UserName%"
Inno Setup: Selected Tasks = "DecodeAll"
Inno Setup: Deselected Tasks = ""
DisplayName = "Xvid 1.2.2 final uninstall"
DisplayIcon = "%ProgramFiles%\Xvid\xvid.ico"
UninstallString = ""%ProgramFiles%\Xvid\unins000.exe""
QuietUninstallString = ""%ProgramFiles%\Xvid\unins000.exe" /SILENT"
DisplayVersion = "1.2"
Publisher = "Xvid team (Koepi)"
URLInfoAbout = "http://www.xvid.org/"
HelpLink = "http://forum.doom9.org/forumdisplay.php?f=52"
URLUpdateInfo = "http://www.koepi.info/"
NoModify = 0x00000001
NoRepair = 0x00000001

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\drivers.desc]

xvidvfw.dll = "Xvid MPEG-4 Video Codec"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]

vidc.XVID = "xvidvfw.dll"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\MediaResources\icm\vidc.XVID]

Description = "Xvid MPEG-4 Video Codec"
Driver = "xvidvfw.dll"
FriendlyName = "Xvid"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\MediaResources\icm\vidc.XVID]

Description = "Xvid MPEG-4 Video Codec"
Driver = "xvidvfw.dll"
FriendlyName = "Xvid"

[HKEY_USERS\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates\F77A3F82B7C4B3A9D869A93E3335CF1F78BC441E]

Blob = 03 00 00 00 01 00 00 00 14 00 00 00 F7 7A 3F 82 B7 C4 B3 A9 D8 69 A9 3E 33 35 CF 1F 78 BC 44 1E 14 00 00 00 01 00 00 00 14 00 00 00 E1 92 97 A8 5F 54 4D 19 CD 2B EA 21 A3 D9 1E FC A1 31 DF C3 04 00 00 00 01 00 00 00 10 00 00 00 45 29 4D AB B4 74 15 7

[HKEY_CURRENT_USER]

ClientID = "{E7D2C561-32E7-4AC5-B177-BF32D6099F2D}"

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{0AE0623A-93A8-44A1-9C55-C163D71F1529}]

DisplayName = "Search"
URL = "http://chameleonsearch.com/websearch.php?src=tops&search={SearchTerms}"

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes]

DefaultScope = "{0AE0623A-93A8-44A1-9C55-C163D71F1529}"

[HKEY_CURRENT_USER\Software\Microsoft\SystemCertificates\CA\Certificates\F77A3F82B7C4B3A9D869A93E3335CF1F78BC441E]

Blob = 03 00 00 00 01 00 00 00 14 00 00 00 F7 7A 3F 82 B7 C4 B3 A9 D8 69 A9 3E 33 35 CF 1F 78 BC 44 1E 14 00 00 00 01 00 00 00 14 00 00 00 E1 92 97 A8 5F 54 4D 19 CD 2B EA 21 A3 D9 1E FC A1 31 DF C3 04 00 00 00 01 00 00 00 10 00 00 00 45 29 4D AB B4 74 15 7

[HKEY_CURRENT_USER\Software\AppDataLow\---N2-GaIU-1-]

eaf = "3615"
(Default) = ""
3204302020441 = 00 00
11313103011220 = 25 65 33 25 31 31 25 66 66 25 31 66 4A 2E 25 65 31 25 36 30 25 38 61 25 30 34 25 61 36 25 62 61 25 66 64 25 31 31 25 31 39 25 33 61 00 53 25 61 34 25 33 64 25 38 38 50 25 32 31 25 62 35 2A 00 25 30 38 25 65 39 25 38 36 67 25 63 37 25 64 66 25 31 35 2
134201323202 = "+%b7%89%c7%b1z%2c%80"
3413014020310 = "%edTU%d8%b48%80%c5%8a%d9M%60%eb%d6%292%f8%f6%04%c6%1c%26%21R%0d%8d%23R%bb%f7%c8%25%fe%1dE%a6%03C%9d%80w%12%3c24%3e%19I%fe%fc%85%96%e3%a7A%7c%29m%9e%bc%acN%84%a9%f05-%f8%d1@%1a%93C%01%a4%c8%90zI%ef"
11142223303443 = 0x4D5FA91E
12023444031432 = 6B 25 30 35 25 61 31 25 30 66 25 31 36 25 65 66 25 30 62 76 00 66 6F 7A 5F 25 39 34 25 65 61 25 38 31 25 65 37 00 62 25 39 37 25 32 39 25 32 33 47 25 61 61 25 35 62 25 33 65 00 41 25 31 30 40 25 38 62 25 61 61 77 25 33 64 25 65 65 00 74 25 30 61 25 3
24203223401243 = "s%05%00H%cc%87%c1%7d"
32120241242224 = "%d5%ca%9e%2c*eN0"
4114144243302 = 0x4D5FA923
23411022223341 = "%f4%11%21%012X%bd%c9"
23044132403412 = 0x00000001
31121100012420 = 0x4D5FA91F
14313224343444 = 0x4D5FA922
4241034014430 = "O%ba%3f%d1b%8cS%87oq0E%c5%95by"
21123433214244 = "%7e%8f%e2%f0%0aYs%bd%d9%a686%9e%83%a9%ee"
23242243220312 = "%09U%8e%ad%d7%de%13%b3"
24412033201220 = 0x00000078
24230333121300 = 0x00000005
11113143012121 = 0x00000000
4344342411023 = 0x00000000
24334211020203 = "%248Z%1e%c0j%95%d3"
24234324303441 = 0x00001C20
14204403124334 = "%9dL%a3%9c%e2%14%84%efJkX%98%05%fb%24%91%cfe%8e%9a%e2%22%88%d2%fb%b6%82%87Y%d4%8d%117%06%11%9b%c9%01-%bf%0b%60%07%c3%a9%1c%bf%15Q%b0%25%f4%11%0f%90%dc%0e%d3b7%c9%b5%8a%cc%85%f4CM%25e%de%12%00%23%c4%e9F%85%88%1e%8e%98%cc%b9%b0%04%0d%99%86%10E%e4%d2e%
30034023000002 = "%5e%da%8d%8c%ed%e8o%86%c9%ean%1b%23e%a8t%26%f0%0e%e7%d0%2b%1b1"
23004330134120 = "%248Z%1e%c0j%95%d3"
30310011214124 = 0x00000000
3320312041112 = 0x00000000
2101133231214 = 0x00000008
12302334344014 = "%d9%b1%94%97%03%9bE%d2"
11114011140213 = 0x00000000
12020321404134 = "%83%da*%91%97Z%fa%d1"
32023423002344 = "%cf%94%b3%85t%98iC%94%06%dd%86%c0%17%26%9cS%f9%ca%91%9fI%a1%83%b3%9d%cd%ff%be%d1%9e%e1%7f%feU%0fkP%17%14%8e%3c%1a%d0q%ae2%a7"
20423341312334 = "%96%af%09%f0%8f%c6%10%a1"
12214041214240 = "%09U%8e%ad%d7%de%13%b3"
4131011320204 = 0x00000001
12241000004030 = "+%b7%89%c7%b1z%2c%80"
24410013413010 = "%f0%05%b9%a7%cd%2b%d7%ce%c0%ac%ee%81V%0eo%29tr%a9%3bR%2f%ba%f0%8c%e5Kpkv%f7%608.%9a%a7%14%d9%94%7c%0c%b3L9%ff%fa%95%7d%17%88%b44%a9%9d%a6%afu%7c%25%f8A%7e%87%f2"
24130324010432 = 0x00000000
14401311213111 = 0x0000000F
30132122133010 = 0x00000001
22123244222441 = 0x00000000
3132133020130 = "%83%da*%91%97Z%fa%d1"
24030414040402 = "9%c5g%0e%23%ddz%8f"
10341114233112 = "9%c5g%0e%23%ddz%8f"
31334041333321 = "%21p%e4%d3%06%df%28%c0%0d%d4i%874%87%3eg"
14040040431211 = "%d8%ab%ea%d2%5e%28%ac3%b7R2%11%26%b2%fa+A%fa%f9%cf%c60%dc%f6%13%98%24%3e%8f%f3l%27%a2%84%1e%26%befr3%b0%adK%d3%16%05bwk%3b%21%95%ae%14%97%8d%109%df%28%053%22%1a%9e%98%f3%aa5%3a%a8%a5"
2333442031244 = 0x00000B40
11421230012123 = "%09U%8e%ad%d7%de%13%b3"
22304143023303 = "%09U%8e%ad%d7%de%13%b3"

The following Registry Value was deleted:

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]

DisableSR = 0x00000001

The following Registry Values were modified:

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0048F8D37B153F6EA2798C323EF4F318A5624A9E]

Blob =

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\00EA522C8A9C06AA3ECCE0B4FA6CDC21D92E8099]

Blob =

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0483ED3399AC3608058722EDBC5E4600E3BEF9D7]

Blob =

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\049811056AFE9FD0F5BE01685AACE6A5D1C4454C]

Blob =

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0B77BEBBCB7AA24705DECC0FBD6A02FC7ABD9B52]

Blob =

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\1331F48A5DA8E01DAACA1BB0C17044ACFEF755BB]

Blob =

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\1F55E8839BAC30728BE7108EDE7B0BB0D3298224]

Blob =

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\209900B63D955728140CD13622D8C687A4EB0085]

Blob =

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\216B2A29E62A00CE820146D8244141B92511B279]

Blob =

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\23E594945195F2414803B4D564D2A3A3F5D88B8C]

Blob =

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\24A40A1F573643A67F0A4B0749F6A22BF28ABB6B]

Blob =

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\24BA6D6C8A5B5837A48DB5FAE919EA675C94D217]

Blob =

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\273EE12457FDC4F90C55E82B56167F62F532E547]

Blob =

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\284F55C41A1A7A3F8328D4C262FB376ED6096F24]

Blob =

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2F173F7DE99667AFA57AF80AA2D1B12FAC830338]

Blob =

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\317A2AD07F2B335EF5A1C34E4B57E8B7D8F1FCA6]

Blob =

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\36863563FD5128C7BEA6F005CFE9B43668086CCE]

Blob =

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\394FF6850B06BE52E51856CC10E180E882B385CC]

Blob =

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\3F85F2BB4A62B0B58BE1614ABB0D4631B4BEF8BA]

Blob =

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4072BA31FEC351438480F62E6CB95508461EAB2F]

Blob =

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\40E78C1D523D1CD9954FAC1A1AB3BD3CBAA15BFC]

Blob =

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\43DDB1FFF3B49B73831407F6BC8B975023D07C50]

Blob =

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\43F9B110D5BAFD48225231B0D0082B372FEF9A54]

Blob =

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4463C531D7CCC1006794612BB656D3BF8257846F]

Blob =

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\47AFB915CDA26D82467B97FA42914468726138DD]

Blob =

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4B421F7515F6AE8A6ECEF97F6982A400A4D9224E]

Blob =

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4BA7B9DDD68788E12FF852E1A024204BF286A8F6]

Blob =

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4C95A9902ABE0777CED18D6ACCC3372D2748381E]

Blob =

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EF2E6670AC9B5091FE06BE0E5483EAAD6BA32D9]

Blob =

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EFCED9C6BDD0C985CA3C7D253063C5BE6FC620C]

Blob =

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]

Start Page =

Other details

Analysis of the file resources indicate the following possible countries of origin:

	Russian Federation
	Germany

The following ports were open in the system:

Port	Protocol	Process
1069	UDP	GoogleDownload.exe (%AppData%\GoogleDownload.exe)
1081	UDP	GoogleDownload.exe (%AppData%\GoogleDownload.exe)
1116	UDP	GoogleDownload.exe (%AppData%\GoogleDownload.exe)
1196	UDP	219201132633.exe (%Temp%\219201132633.exe)
1235	UDP	219201132633.exe (%Temp%\219201132633.exe)
1236	TCP	219201132633.exe (%Temp%\219201132633.exe)

There were registered attempts to establish connection with the remote hosts. The connection details are:

Remote Host	Port Number
174.137.179.4	80
184.86.144.80	80
184.86.147.191	80
199.7.48.190	80
204.0.5.49	80
204.0.5.51	80
206.127.14.99	80
209.200.12.164	80
65.55.12.249	80
67.55.67.250	80

The data identified by the following URLs was then requested from the remote web server:

http://closespace.biz/a3OtBp/setup.asp?res=ok&id=a072d03383cdb1e0fdddc908e949bdb25144109e
http://closespace.biz/a3OtBp/installed.asp
http://closespace.biz/a3OtBp/hb.asp
http://closespace.biz/a3OtBp/domdb.asp
http://images.scanalert.com/meter/www.downloaddirect.com/12.gif
http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
http://crl.verisign.com/pca3-g5.crl
http://csc3-2010-crl.verisign.com/CSC3-2010.crl
http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt
http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/4EB6D578499B1CCF5F581EAD56BE3D9B6744A5E5.crt
http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
http://ian.smileymedia.com/r2/?placementID=lm-1&pubSubID=64&additional=http%3A%2F%2Fdownloaddirect.com%2Fsites%2Fdefault%2Ffiles%2Fsmiley.png&pubSubID2=3615&destURL=http%3A%2F%2Fdownloaddirect.com%2F%3Faff%3D3615
http://ian.smileymedia.com/r2/r2-1.8.21.js
http://ian.smileymedia.com/r2/visitor_pixel.php?visitorID=312813987&language=en-us&jsver=1.3&screenH=480&screenW=640&nocache=cf6e1491775380f04eb39b049fec6d8a
http://coreg.smileymedia.com/services/files/images/lmo/green_gloss_arrow_100pxw.png
http://submit.flvpremier.com/usr/getgeoipinfo.php?gup=JLhdMVHAQ38=&u={E7D2C561-32E7-4AC5-B177-BF32D6099F2D}
http://www.microsoft.com/pki/certs/MicCerTruLisPCA_2009-04-02.crt
http://www.downloaddirect.com/software/xvid/3615
http://cdn.downloaddirect.com/sites/default/files/css/css_d50bda7054f963cc858dcf0ef96002e9.css
http://cdn.downloaddirect.com/sites/default/files/css/css_16fce840094ccfa0568f83a4d9db5ac7.css
http://cdn.downloaddirect.com/sites/all/themes/zen/zen/ie.css?2
http://cdn.downloaddirect.com/sites/default/files/js/js_cccaa3d5cf8382e0ee13bfeb19932e69.js
http://www.downloaddirect.com/sites/default/files/foss_logo.png
http://downloaddirect.com/sites/default/files/main-xvid.gif
http://cdn.downloaddirect.com/sites/all/themes/foss/images/body-bg.gif
http://cdn.downloaddirect.com/sites/default/files/icon-opensource.gif
http://cdn.downloaddirect.com/sites/default/files/icon-player.gif
http://cdn.downloaddirect.com/sites/default/files/icon-video.gif
http://cdn.downloaddirect.com/sites/default/files/icon-award.gif
http://cdn.downloaddirect.com/sites/default/files/icon-speed.gif
http://cdn.downloaddirect.com/sites/default/files/follow-twitter.png
http://cdn.downloaddirect.com/sites/default/files/facebook.png
http://cdn.downloaddirect.com/sites/default/files/js/js_795dc7d80c2656e868f3d8adf965e015.jsmin.js
http://cdn.downloaddirect.com/sites/all/themes/foss/images/stars.png
http://cdn.downloaddirect.com/sites/all/themes/foss/images/comments-faux-bg.png
http://cdn.downloaddirect.com/sites/all/themes/foss/images/submit-bg.png
http://go.ldmtracking.com/aff_c?offer_id=294&aff_id=1&aff_sub=3615&source=7Zip
http://go.ldmtracking.com/aff_c?offer_id=295&aff_id=1&aff_sub=3615&source=7Zip
http://go.ldmtracking.com/
http://l.addthiscdn.com/live/t00/250lo.gif?14nr841&uid=4d5fa8fd24e1699d&CXNID=2000001.5215456080540439072NXC&pub=xa-4c8b1e6f7bf5875e&rev=89959&si=4d5fa94f1c173507&ln=en&pc=men&uf=0&pi=1&dp=www.downloaddirect.com&fp=software%2Fxvid%2F3615
http://l.addthiscdn.com/live/t00/250lo.gif?1ny823f&uid=4d5fa8fd24e1699d&CXNID=2000001.5215456080540439072NXC&pub=xa-4c8b1e6f7bf5875e&rev=89959&si=4d5fa8ec552bfa95&ln=en&pc=men&uf=1&pi=1&dp=www.downloaddirect.com&fp=software%2Fxvid%2F3615
http://l.addthiscdn.com/live/t00/250lo.gif?175haup&uid=4d5fa8fd24e1699d&CXNID=2000001.5215456080540439072NXC&pub=xa-4c8b1e6f7bf5875e&rev=89959&si=4d5fa8efbe9ff545&ln=en&pc=men&uf=0&pi=1&dp=www.downloaddirect.com&fp=software%2Fxvid%2F3615
http://download.flvpremier.com/closespace.biz/get.php?aff=3615
http://eateggsmore.info/get.php
http://eateggsmore.info/d.php
http://rdr.ldmtracking.com/redir.php?o=csearch_hp_c&aff_sub=3615&source=7Zip
http://rdr.ldmtracking.com/redir.php?o=csearch_defaultsearch_c&aff_sub=3615&source=7Zip
http://ldmdownload.com/redir.php?o=XviD&aff=3615
http://seany.dazlle.u2m.ru/fuddy.exe
http://seany.dazlle.u2m.ru/setup2048.exe
http://seany.dazlle.u2m.ru/winupdate.exe
http://kak2.u2m.ru/setupp.exe
http://s7.addthis.com/js/250/addthis_widget.js
http://s7.addthis.com/static/btn/v2/lg-share-en.gif
http://s7.addthis.com/static/r07/widget52.css
http://s7.addthis.com/static/r07/sh32.html

All content ("Information") contained in this report is the copyrighted work of Threat Expert Ltd and its associated companies ("ThreatExpert") and may not be copied without the express permission of ThreatExpert.

The Information is provided on an "as is" basis. ThreatExpert disclaims all warranties, whether express or implied, to the maximum extent permitted by law, including the implied warranties that the Information is merchantable, of satisfactory quality, accurate, fit for a particular purpose or need, or non-infringing, unless such implied warranties are legally incapable of exclusion. Further, ThreatExpert does not warrant or make any representations regarding the use or the results of the use of the Information in terms of their correctness, accuracy, reliability, or otherwise.