Submission Summary:

• Submission details:
• Submission received: 17 July 2012, 14:36:43
• Processing time: 13 min 28 sec
• Submitted sample:
• File MD5: 0x3515BF75E9506F740DFA402745F67F48
• File SHA-1: 0x340F1380F67C372086FDFFDB6C695E627D187DBD
• Filesize: 172,032 bytes

• Summary of the findings:

What's been found	Severity Level
Creates a startup registry entry.

Technical Details:

File System Modifications

• The following files were created in the system:

#	Filename(s)	File Size	File Hash
1	%AppData%\svchost.exe	172,032 bytes	MD5: 0x72389E9E2971CD7227DD5AA2543D6C73 SHA-1: 0xFF0DE078F2BA2B1392B6F9A01200BF1C5B1E4B3C
2	[file and pathname of the sample #1]	172,032 bytes	MD5: 0x3515BF75E9506F740DFA402745F67F48 SHA-1: 0x340F1380F67C372086FDFFDB6C695E627D187DBD

• Note:
• %AppData% is a variable that refers to the file system directory that serves as a common repository for application-specific data. A typical path is C:\Documents and Settings\[UserName]\Application Data.

Memory Modifications

• There was a new process created in the system:

Registry Modifications

• The newly created Registry Value is:
• [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
• Google Inc = "%AppData%\svchost.exe"

so that svchost.exe runs every time Windows starts

Other details

• To mark the presence in the system, the following Mutex object was created:
• BYVOLK