Submission Summary:

• Submission details:
• Submission received: 26 June 2012, 01:07:50
• Processing time: 13 min 40 sec
• Submitted sample:
• File MD5: 0xF8AC62886168D28D986DA3225B236320
• File SHA-1: 0x30561B7F2026E560D90BC581006836C77845B00D
• Filesize: 187,140 bytes

• Summary of the findings:

What's been found	Severity Level
Downloads/requests other files from Internet.
Creates a startup registry entry.

Technical Details:

File System Modifications

• The following file was created in the system:

#	Filename(s)	File Size	File Hash
1	%Windir%\Qedie\conime.exe [file and pathname of the sample #1]	187,140 bytes	MD5: 0xF8AC62886168D28D986DA3225B236320 SHA-1: 0x30561B7F2026E560D90BC581006836C77845B00D

• Note:
• %Windir% is a variable that refers to the Windows installation folder. By default, this is C:\Windows or C:\Winnt.

• The following directory was created:
• %Windir%\Qedie

Memory Modifications

• There were new processes created in the system:

Process Name	Process Filename	Main Module Size
conime.exe	%Windir%\qedie\conime.exe	225,280 bytes
[filename of the sample #1]	[file and pathname of the sample #1]	225,280 bytes

Registry Modifications

• The following Registry Key was created:
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{AENGFU3AA-B933-11d2-9CBD-0000F87A369E}

• The newly created Registry Value is:
• [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{AENGFU3AA-B933-11d2-9CBD-0000F87A369E}]
• (Default) = "Ver933"
• stubpath = "%Windir%\qedie\conime.exe"

so that conime.exe runs every time Windows starts

Other details

• Analysis of the file resources indicate the following possible country of origin:

	China

• To mark the presence in the system, the following Mutex object was created:
• XLXNDXS

• The data identified by the following URL was then requested from the remote web server:
• http://127.0.0.1.jk136.com:123/js/js/top.gif