Remote Host Port Number
irandy.info 8160
NICK {USA-XP}481463
USER yjmpomf * 0 :COMPUTERNAME
* The following ports were open in the system:
Port Protocol Process
1033 TCP svhost.exe (%Windir%svhost.exe)
1034 TCP svhost.exe (%Windir%svhost.exe)
* The following Host Name was requested from a host database:
o irandy.info
Other details
* To mark the presence in the system, the following Mutex objects were created:
o IgKS2jQ9H3EPFo4r
o lk9f6u6873jlids
File System Modifications
* The following file was created in the system:
# Filename(s) File Size File Hash
1 %Windir%svhost.exe
[file and pathname of the sample #1] 193 536 bytes MD5: 0xDA91D98380728186CA4CD69CF08A0E14
SHA-1: 0x7844EC8E665512EBE49E5651DDA1B8E605473E45
Memory Modifications
* There were new processes created in the system:
Process Name Process Filename Main Module Size
svhost.exe %Windir%svhost.exe 311 296 bytes
[filename of the sample #1] [file and pathname of the sample #1] 208 896 bytes
Registry Modifications
* The newly created Registry Value is:
o [HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun]
+ MSN = “%Windir%svhost.exe”
so that svhost.exe runs every time Windows starts