Remote Host Port Number
174.37.200.82 80
216.178.38.224 80
63.135.80.46 80
64.208.241.41 80
69.63.181.15 80
205.234.145.229 1234 PASS xxx
MODE NEW-[USA|00|P|57896] -ix
JOIN #!nn! test
PONG 22 MOTD
NICK NEW-[USA|00|P|57896]
USER XP-0495 * 0 :COMPUTERNAME
Other details
* The following ports were open in the system:
Port Protocol Process
1059 TCP nvsvc32.exe (%Windir%nvsvc32.exe)
1062 TCP nvsvc32.exe (%Windir%nvsvc32.exe)
1063 TCP nvsvc32.exe (%Windir%nvsvc32.exe)
Registry Modifications
* The newly created Registry Values are:
o [HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun]
+ NVIDIA driver monitor = “%Windir%nvsvc32.exe”
so that nvsvc32.exe runs every time Windows starts
o [HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionTerminal ServerInstallSoftwareMicrosoftWindowsCurrentVersionRun]
+ NVIDIA driver monitor = “%Windir%nvsvc32.exe”
so that nvsvc32.exe runs every time Windows starts
o [HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionRun]
+ NVIDIA driver monitor = “%Windir%nvsvc32.exe”
so that nvsvc32.exe runs every time Windows starts
Memory Modifications
* There was a new process created in the system:
Process Name Process Filename Main Module Size
nvsvc32.exe %Windir%nvsvc32.exe 3,129,344 bytes
* The following system service was modified:
Service Name Display Name New Status Service Filename
wuauserv Automatic Updates “Stopped” %System%svchost.exe -k netsvcs
File System Modifications
* The following files were created in the system:
# Filename(s) File Size File Hash
1 %Windir%ndl.dl 2,256 bytes MD5: 0xF041A749EFF854EFB2C276E0178A7A72
SHA-1: 0x2E9A6DB741879BCBF7DCF753DD91F512218F7FDA
2 %Windir%nvsvc32.exe
[file and pathname of the sample #1] 87,552 bytes MD5: 0x410F4DAE19CC08591AE28E76A84A9C0F
SHA-1: 0xDA402D101FA894D68A0923DE3ADD8D8DB3B561BF
3 %Windir%wibrf.jpg 3,968 bytes MD5: 0xE246233F7DCFE923D7A54F29B63CC30E
SHA-1: 0xB512DA23F7D01E8BD23133583103A83DC6D5C787
4 %Windir%wiybr.png 3,416 bytes MD5: 0xD3A3A9391EA080EDFEF8BA202CC36D2E
SHA-1: 0xD771C5BA93DC6FC0438AF3FF1E909338F63EC283
infos about hosting:
http://whois.domaintools.com/205.234.145.229