210.170.62.106

Remote Host Port Number
208.50.81.138 80
208.50.81.144 80
208.50.81.160 80
208.50.81.161 80
216.178.38.168 80
63.135.80.58 80
63.135.86.23 80
63.135.86.37 80
64.208.138.220 80
64.236.79.122 80
210.170.62.106 2345 PASS xxx

MODE NEW-[USA|00|P|57813] -ix
JOIN #!gf! test
NICK NEW-[USA|00|P|57813]
USER XP-1197 * 0 :COMPUTERNAME
PONG irc.priv8net.com

* The data identified by the following URLs was then requested from the remote web server:
o http://cms.myspacecdn.com/cms/js/ad_wrapper0153.js
o http://1.download.advertise.myspace.com/03/1f/bf/bd1fbf9e3437c71996a5000fd8a10312_final.jpg
o http://x.myspacecdn.com/modules/common/static/img/onlinenow2.gif
o http://x.myspacecdn.com/modules/splash/static/img/bgSheet.png
o http://x.myspacecdn.com/modules/splash/static/img/moduleBg.gif
o http://x.myspacecdn.com/Modules/Common/Static/img/cornersSheet3.png
o http://x.myspacecdn.com/modules/common/static/css/Sprites/globalNavRefreshSprite.png
o http://x.myspacecdn.com/modules/browse/static/img/btnicons_tiled.gif
o http://x.myspacecdn.com/modules/common/static/css/global_y5kcgkyi.css
o http://x.myspacecdn.com/modules/common/static/css/uploadcontrol_ioe1imsn.css
o http://x.myspacecdn.com/modules/browse/static/css/browse_qiz4yewv.css
o http://x.myspacecdn.com/modules/profilesdirectory/static/css/browsebyname_4vb3esmf.css
o http://x.myspacecdn.com/modules/common/static/img/spacer.gif
o http://js.myspacecdn.com/modules/common/static/js/atlas/msglobal__7us4lzq.js
o http://js.myspacecdn.com/modules/browse/static/js/browsebundle_kwg2eboy.js
o http://js.myspacecdn.com/modules/common/static/js/jquery/tracking/tynt_zcvgeagv.js?user=bjNOt4bfyr35kFadbiUt4I&lang=en
o http://js.myspacecdn.com/modules/common/static/js/atlas/quickpost_a0c24hfu.js
o http://cdn.doubleverify.com/script44.js?agnc=607671&cmp=CINGCP908001CNT&crt=&crtname=&adnet=&dvtagver=3.3.1346.2176&adsrv=2&plc=193886852&advid=607930&sid=193886852&adid=
o http://js.myspacecdn.com/modules/common/static/js/atlas/richtexteditor_uvm5sqtf.js
o http://browseusers.myspace.com/Browse/Browse.aspx
o http://delb.opt.fimserve.com/adopt/?r=h&l=24000000&pos=leaderboard&rnd=338698224
o http://desk.opt.fimserve.com/adopt/?r=h&l=24000000&pos=skyscraper&rnd=338698224
o http://fim.adnxs.com/fpt?id=3594&size=160×600&flash=1&cookies=1&callback=C1Ax7Fg3Xf2C.b0Ul7Is3Ax2F&referrer=www.foxaudiencenetwork.com&age=&gender=&cb=1280279858470
o http://bid.ace.advertising.com/bid/ebs=1/site=744646/size=728090/tags=1/callback=C1Xs6Eh4Vd5S.b0Xs6Eh4Vd5S/bnum=1280279858830
o http://bid.ace.advertising.com/ctst=1/bid/ebs=1/site=744646/size=728090/tags=1/callback=C1Xs6Eh4Vd5S.b0Xs6Eh4Vd5S/bnum=1280279858830
o http://p.ic.tynt.com/b/p?id=bjNOt4bfyr35kFadbiUt4I&ts=1280279859220&t=Browse%20MySpace%20Friends%20and%20Profiles
o http://googleads.g.doubleclick.net/pagead/test_domain.js
o http://pagead2.googlesyndication.com/pagead/show_ads.js
o http://pagead2.googlesyndication.com/pagead/render_ads.js
o http://www.google-analytics.com/ga.js
o http://ad.yieldmanager.com/getbid?Z=728×90&s=796250&_salt=1280279858830&u=http://www.foxaudiencenetwork.com&r=1&callback=C1Xs6Eh4Vd5S.b1Ql6Rk4Ce5M&cookie=1&flash=1&bvs=&hvs=BBJRUOOP
o http://c3.ac-images.myspacecdn.com/images02/125/s_1a4c2b4c5284430d80adab79e370801a.jpg
o http://c3.ac-images.myspacecdn.com/images02/142/s_d7a76b1a42db42988a9a2e5b93bf306a.jpg
o http://c3.ac-images.myspacecdn.com/images02/106/s_663d792ab9a449dca9b21877c4230006.jpg
o http://c3.ac-images.myspacecdn.com/images02/79/s_bc8ca5137db94a26bb6f084c8cec92b2.jpg
o http://c3.ac-images.myspacecdn.com/images02/13/s_6e810bcaad51423b9e03ab2c5aa6c146.jpg
o http://c3.ac-images.myspacecdn.com/images02/63/s_0d0823b872e74fdb893877d30ce9497e.jpg
o http://c3.ac-images.myspacecdn.com/images02/126/s_bb1b251c2021439b845cf96c673e134e.jpg
o http://c1.ac-images.myspacecdn.com/images02/101/s_6379efcc8c46427e99f733c40e79cfd4.jpg
o http://c1.ac-images.myspacecdn.com/images02/147/s_2454f3376a4c4d07a1be4319582b0a68.jpg
o http://c1.ac-images.myspacecdn.com/images02/66/s_12872121e7a44d7fb9f656dffe1bc86c.jpg
o http://c1.ac-images.myspacecdn.com/images02/120/s_b357cbc581394368946f7811dd66b444.jpg
o http://c1.ac-images.myspacecdn.com/images02/141/s_c83b52c6db2140c79ed4f48b3d43abbc.jpg
o http://c1.ac-images.myspacecdn.com/images02/76/s_2adbf9a8892f4ffbaf93f35304d9b18c.jpg
o http://c1.ac-images.myspacecdn.com/images01/67/s_6b5a0365c6244c3004bcbfbbf1b1666c.jpg
o http://c1.ac-images.myspacecdn.com/images02/27/s_7b62775f100f46ba830c566a21bddba8.jpg
o http://c1.ac-images.myspacecdn.com/images02/68/s_e96743e447494ea1ac971d09767e3bb0.jpg
o http://c1.ac-images.myspacecdn.com/images02/124/s_cb57746e4c7e4654a2c8d55f34d16cec.jpg
o http://c1.ac-images.myspacecdn.com/images01/45/s_e2c19fd4123171f022785e46fffec2dc.jpg
o http://c1.ac-images.myspacecdn.com/images02/120/s_ca96fabdabd44a7c932cb39f2537ad04.jpg
o http://c1.ac-images.myspacecdn.com/images02/104/s_7ac8c3952e4f42b2952d437c15ca48a4.jpg
o http://c1.ac-images.myspacecdn.com/images02/123/s_454e12078582428f985740b42fef5df4.jpg
o http://c2.ac-images.myspacecdn.com/images02/120/s_5ee2328556ea499b8cb0e5e25c5e1171.jpg
o http://c2.ac-images.myspacecdn.com/images02/105/s_e8a2096a97a44870ae0428f457798c7d.jpg
o http://c2.ac-images.myspacecdn.com/images02/91/s_f991ce203aea4c5c983aea1385930489.jpg
o http://c2.ac-images.myspacecdn.com/images02/74/s_8508819929ae4f85a628215dda63a89d.jpg
o http://c2.ac-images.myspacecdn.com/images02/143/s_3f568cfdbb27417ba0505ff279f74985.jpg
o http://c2.ac-images.myspacecdn.com/images02/145/s_01de490373244618b2fd787431c4a851.jpg
o http://c2.ac-images.myspacecdn.com/images01/55/s_c7b20e93ca9086055a7f5fba792340ad.jpg
o http://c2.ac-images.myspacecdn.com/images02/75/s_eb9d654084ac407a9101977509c3b72d.jpg
o http://c2.ac-images.myspacecdn.com/images02/118/s_ef16fb09eb864117aab7bdb066bf13d5.jpg
o http://c4.ac-images.myspacecdn.com/images02/52/s_2ffa8c927ac04a37ba2495ca266bd643.jpg
o http://c4.ac-images.myspacecdn.com/images02/79/s_889a6fdd50ee4687a092b5807f11bc0f.jpg
o http://c4.ac-images.myspacecdn.com/images02/109/s_1d97bc010120456b860375cef7f6541b.gif
o http://c4.ac-images.myspacecdn.com/images01/59/s_349473c6c5c854640533414fdce7582b.jpg
o http://c4.ac-images.myspacecdn.com/images02/69/s_356a0cdc0b0a416d90348175a04e7297.jpg
o http://c4.ac-images.myspacecdn.com/images02/132/s_5533358fe60c421b9f17a2b6fd20d9df.jpg
o http://c4.ac-images.myspacecdn.com/images02/127/s_e661490e9a83449d8a980fd21ab02b8b.jpg
o http://c4.ac-images.myspacecdn.com/images02/71/s_917bb56fc1aa477391cecb4b3dbf4fc3.jpg
o http://c4.ac-images.myspacecdn.com/images02/124/s_8c34e30d56854f2db734f604d00f2027.jpg
o http://c4.ac-images.myspacecdn.com/images02/93/s_4725cd83e6a642a79d3767842eecee6f.jpg

Other details

* The following ports were open in the system:

Port Protocol Process
1053 TCP jusched.exe (%Windir%jusched.exe)
1089 TCP jusched.exe (%Windir%jusched.exe)

Registry Modifications

* The newly created Registry Values are:
o [HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun]
+ Java developer Script Browse = “%Windir%jusched.exe”

so that jusched.exe runs every time Windows starts
o [HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionTerminal ServerInstallSoftwareMicrosoftWindowsCurrentVersionRun]
+ Java developer Script Browse = “%Windir%jusched.exe”

so that jusched.exe runs every time Windows starts
o [HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionRun]
+ Java developer Script Browse = “%Windir%jusched.exe”

so that jusched.exe runs every time Windows starts

Memory Modifications

* There was a new process created in the system:

Process Name Process Filename Main Module Size
jusched.exe %Windir%jusched.exe 3 141 632 bytes

* The following system service was modified:

Service Name Display Name New Status Service Filename
wuauserv Automatic Updates “Stopped” %System%svchost.exe -k netsvcs

* Notes:
o %System% is a variable that refers to the System folder. By default, this is C:WindowsSystem (Windows 95/98/Me), C:WinntSystem32 (Windows NT/2000), or C:WindowsSystem32 (Windows XP).

File System Modifications

* The following files were created in the system:

# Filename(s) File Size File Hash
1 %Windir%jusched.exe
[file and pathname of the sample #1] 103 424 bytes MD5: 0x1BE65C0597137D85879259696ADBD166
SHA-1: 0xD9094BCC7CA87ABBE80D9D4619C729B4B2F51F79
2 %Windir%mdll.dl 2 191 bytes MD5: 0xFE74CEFD04571E7CF2D4095158DAE514
SHA-1: 0x8D97ED0ABC1E23E1619E5B50AD80A17AA465EDFA
3 %Windir%wintybrd.png 3 416 bytes MD5: 0xD3A3A9391EA080EDFEF8BA202CC36D2E
SHA-1: 0xD771C5BA93DC6FC0438AF3FF1E909338F63EC283
4 %Windir%wintybrdf.jpg 3 968 bytes MD5: 0xE246233F7DCFE923D7A54F29B63CC30E
SHA-1: 0xB512DA23F7D01E8BD23133583103A83DC6D5C787