Technical Information
To ensure autorun and distribution:
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\NUS_BusXP32] 'ImagePath' = 'system32\DRIVERS\NUS_BusXP32.sys'
- [<HKLM>\SYSTEM\ControlSet001\Services\EST_BusEnum] 'ImagePath' = 'system32\DRIVERS\GenBus.sys'
Malicious functions:
Creates and executes the following:
- '%ProgramFiles%\Generic\USB over IP Server\Driver\DrvSetup.exe' install Driver\NUS_BusXP.inf root\NUS_Bus 16
- '%ProgramFiles%\Generic\USB over IP Server\Driver\DIFxCmd.exe' /p Driver\NUServerXP.inf 16
- '%ProgramFiles%\Generic\USB over IP Server\Driver\DIFxCmd.exe' /i Driver\NUServerXP.inf 16
- '%ProgramFiles%\Generic\USB over IP Server\Driver\DrvSetup.exe' install Driver\GenBus.inf root\EST_Bus
- '%ProgramFiles%\Generic\USB over IP Server\Driver\DIFxCmd.exe' /p Driver\GenHC.inf
- '%ProgramFiles%\Generic\USB over IP Server\Driver\DIFxCmd.exe' /i Driver\GenHC.inf
Executes the following:
- '<SYSTEM32>\msiexec.exe' -Embedding 1C313317A4B3C0F451247638BE19E681
- '<SYSTEM32>\runonce.exe' -r
- '<SYSTEM32>\msiexec.exe' /V
- '<SYSTEM32>\msiexec.exe' -Embedding 7D548E7115A8F1D047F5B281C7854017 C
Modifies file system:
Creates the following files:
- %ProgramFiles%\InstallShield Installation Information\{4DC0BBCC-3A7B-4284-BE34-CEE37C926C79}\0x049ef5.rra
- %ProgramFiles%\InstallShield Installation Information\{4DC0BBCC-3A7B-4284-BE34-CEE37C926C79}\setu9ea7.rra
- %ProgramFiles%\InstallShield Installation Information\{4DC0BBCC-3A7B-4284-BE34-CEE37C926C79}\0x049f91.rra
- %ProgramFiles%\InstallShield Installation Information\{4DC0BBCC-3A7B-4284-BE34-CEE37C926C79}\1028.mst
- %WINDIR%\Installer\{4DC0BBCC-3A7B-4284-BE34-CEE37C926C79}\1033.MST
- %WINDIR%\Installer\{4DC0BBCC-3A7B-4284-BE34-CEE37C926C79}\USBoverIPServer.ex_C202D67FD3204148886B37A6A72DC6CE.exe
- %ProgramFiles%\InstallShield Installation Information\{4DC0BBCC-3A7B-4284-BE34-CEE37C926C79}\ISSe9d40.rra
- %ProgramFiles%\InstallShield Installation Information\{4DC0BBCC-3A7B-4284-BE34-CEE37C926C79}\setu9ca3.rra
- %ProgramFiles%\InstallShield Installation Information\{4DC0BBCC-3A7B-4284-BE34-CEE37C926C79}\1031.mst
- %ProgramFiles%\InstallShield Installation Information\{4DC0BBCC-3A7B-4284-BE34-CEE37C926C79}\1036.mst
- %ProgramFiles%\InstallShield Installation Information\{4DC0BBCC-3A7B-4284-BE34-CEE37C926C79}\0x04a118.rra
- %ProgramFiles%\InstallShield Installation Information\{4DC0BBCC-3A7B-4284-BE34-CEE37C926C79}\1040.mst
- %ProgramFiles%\InstallShield Installation Information\{4DC0BBCC-3A7B-4284-BE34-CEE37C926C79}\0x04a185.rra
- %ProgramFiles%\InstallShield Installation Information\{4DC0BBCC-3A7B-4284-BE34-CEE37C926C79}\1033a03d.rra
- %ProgramFiles%\InstallShield Installation Information\{4DC0BBCC-3A7B-4284-BE34-CEE37C926C79}\0x049fff.rra
- %ProgramFiles%\InstallShield Installation Information\{4DC0BBCC-3A7B-4284-BE34-CEE37C926C79}\1034.mst
- %ProgramFiles%\InstallShield Installation Information\{4DC0BBCC-3A7B-4284-BE34-CEE37C926C79}\0x04a07c.rra
- %ProgramFiles%\Generic\USB over IP Server\UNTPDLL.dll
- %ProgramFiles%\Generic\USB over IP Server\PSMDLL.dll
- %ProgramFiles%\Generic\USB over IP Server\Driver\DrvSetup.exe
- %ProgramFiles%\Generic\USB over IP Server\Driver\DIFxCmd.exe
- %ProgramFiles%\Generic\USB over IP Server\USBoverIPServer.exe
- %WINDIR%\inf\GenBus.inf
- %ProgramFiles%\Generic\USB over IP Server\ESTLogDLL.dll
- %ProgramFiles%\Generic\USB over IP Server\DCPDLL.dll
- <SYSTEM32>\DIFxAPI.dll
- %WINDIR%\Installer\{4DC0BBCC-3A7B-4284-BE34-CEE37C926C79}\ARPPRODUCTICON.exe
- %WINDIR%\Installer\27f3c.msi
- %WINDIR%\Installer\{4DC0BBCC-3A7B-4284-BE34-CEE37C926C79}\UNINST_Uninstall_U_08974A74D282466E8674D1157FB4587E.exe
- %WINDIR%\Installer\{4DC0BBCC-3A7B-4284-BE34-CEE37C926C79}\USBoverIPServer.ex_798342C18209478F8322D0EA6A4AC104.exe
- %ALLUSERSPROFILE%\Start Menu\Programs\Generic\USB over IP Server\Launch USBoverIPServer.exe.lnk
- %ProgramFiles%\Generic\USB over IP Server\CreateShortcut.exe
- %ALLUSERSPROFILE%\Start Menu\Programs\Generic\USB over IP Server\Uninstall.lnk
- %ALLUSERSPROFILE%\Desktop\Launch USBoverIPServer.exe.lnk
- %ProgramFiles%\InstallShield Installation Information\{4DC0BBCC-3A7B-4284-BE34-CEE37C926C79}\0x04a1f3.rra
- %WINDIR%\inf\oem3.PNF
- %WINDIR%\inf\oem3.inf
- <SYSTEM32>\DRVSTORE\NUServerXP_87F6D4B18921DC8AB6EBA1E7820BF379B5374602\NUServerXP32.cat
- <SYSTEM32>\DRVSTORE\NUServerXP_87F6D4B18921DC8AB6EBA1E7820BF379B5374602\NUServerXP.inf
- <SYSTEM32>\DRVSTORE\GenHC_AF3BDE5753269D005AA19F53855B02E88913C467\GenHC.cat
- <SYSTEM32>\DRVSTORE\GenHC_AF3BDE5753269D005AA19F53855B02E88913C467\GenHC.inf
- <SYSTEM32>\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\oem3.CAT
- <SYSTEM32>\DRVSTORE\GenHC_AF3BDE5753269D005AA19F53855B02E88913C467\GenHC.sys
- <SYSTEM32>\DRVSTORE\NUServerXP_87F6D4B18921DC8AB6EBA1E7820BF379B5374602\NUServerXP32.sys
- %WINDIR%\inf\oem4.inf
- <SYSTEM32>\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\oem4.CAT
- %WINDIR%\inf\oem4.PNF
- %WINDIR%\inf\nus_busxp.PNF
- %WINDIR%\LastGood\TMPD.tmp
- <SYSTEM32>\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\nus_busxp.CAT
- <DRIVERS>\SETF.tmp
- %WINDIR%\Temp\OLDE.tmp
- %ProgramFiles%\InstallShield Installation Information\{4DC0BBCC-3A7B-4284-BE34-CEE37C926C79}\0x04a34b.rra
- %ProgramFiles%\InstallShield Installation Information\{4DC0BBCC-3A7B-4284-BE34-CEE37C926C79}\1045.mst
- %ProgramFiles%\InstallShield Installation Information\{4DC0BBCC-3A7B-4284-BE34-CEE37C926C79}\0x08a3b8.rra
- %ProgramFiles%\InstallShield Installation Information\{4DC0BBCC-3A7B-4284-BE34-CEE37C926C79}\1049.mst
- %ProgramFiles%\InstallShield Installation Information\{4DC0BBCC-3A7B-4284-BE34-CEE37C926C79}\0x04a270.rra
- %ProgramFiles%\InstallShield Installation Information\{4DC0BBCC-3A7B-4284-BE34-CEE37C926C79}\1041.mst
- %ProgramFiles%\InstallShield Installation Information\{4DC0BBCC-3A7B-4284-BE34-CEE37C926C79}\0x04a2ed.rra
- %ProgramFiles%\InstallShield Installation Information\{4DC0BBCC-3A7B-4284-BE34-CEE37C926C79}\1042.mst
- %ProgramFiles%\InstallShield Installation Information\{4DC0BBCC-3A7B-4284-BE34-CEE37C926C79}\2052.mst
- %WINDIR%\Temp\OLD9.tmp
- %WINDIR%\LastGood\TMP8.tmp
- %WINDIR%\inf\genbus.PNF
- <DRIVERS>\SETA.tmp
- %ProgramFiles%\InstallShield Installation Information\{4DC0BBCC-3A7B-4284-BE34-CEE37C926C79}\2070.mst
- %ProgramFiles%\InstallShield Installation Information\{4DC0BBCC-3A7B-4284-BE34-CEE37C926C79}\0x08a425.rra
- <SYSTEM32>\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\genbus.CAT
- %ProgramFiles%\InstallShield Installation Information\{4DC0BBCC-3A7B-4284-BE34-CEE37C926C79}\setup.ini
- %WINDIR%\inf\genbus.cat
- %TEMP%\{7340A907-168A-4A5F-A376-4C9432B96B2A}\_isuser_0x0409.dll
- %TEMP%\{7340A907-168A-4A5F-A376-4C9432B96B2A}\String1033.txt
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-19
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-18
- %TEMP%\{7340A907-168A-4A5F-A376-4C9432B96B2A}\ISRT.dll
- %TEMP%\{7340A907-168A-4A5F-A376-4C9432B96B2A}\setup.inx
- %TEMP%\{7340A907-168A-4A5F-A376-4C9432B96B2A}\_isres_0x0409.dll
- %TEMP%\{7340A907-168A-4A5F-A376-4C9432B96B2A}\setup.exe
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-19
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SECURITY
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_.DEFAULT
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SYSTEM
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SOFTWARE
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-20
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-20
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-21-2052111302-484763869-725345543-1003
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-21-2052111302-484763869-725345543-1003
- %TEMP%\{DAE6266D-7365-4EB2-883A-BC58BD4F3ACF}\0x040a.ini
- %TEMP%\{DAE6266D-7365-4EB2-883A-BC58BD4F3ACF}\0x0409.ini
- %TEMP%\{DAE6266D-7365-4EB2-883A-BC58BD4F3ACF}\0x0410.ini
- %TEMP%\{DAE6266D-7365-4EB2-883A-BC58BD4F3ACF}\0x040c.ini
- %TEMP%\{DAE6266D-7365-4EB2-883A-BC58BD4F3ACF}\_ISMSIDEL.INI
- %TEMP%\{DAE6266D-7365-4EB2-883A-BC58BD4F3ACF}\Setup.INI
- %TEMP%\{DAE6266D-7365-4EB2-883A-BC58BD4F3ACF}\0x0407.ini
- %TEMP%\{DAE6266D-7365-4EB2-883A-BC58BD4F3ACF}\0x0404.ini
- %TEMP%\{DAE6266D-7365-4EB2-883A-BC58BD4F3ACF}\0x0411.ini
- %TEMP%\{DAE6266D-7365-4EB2-883A-BC58BD4F3ACF}\1033.MST
- %TEMP%\{DAE6266D-7365-4EB2-883A-BC58BD4F3ACF}\0x0816.ini
- %TEMP%\{DAE6266D-7365-4EB2-883A-BC58BD4F3ACF}\ISSetup.dll
- %TEMP%\{DAE6266D-7365-4EB2-883A-BC58BD4F3ACF}\USB over IP Server.msi
- %TEMP%\{DAE6266D-7365-4EB2-883A-BC58BD4F3ACF}\0x0415.ini
- %TEMP%\{DAE6266D-7365-4EB2-883A-BC58BD4F3ACF}\0x0412.ini
- %TEMP%\{DAE6266D-7365-4EB2-883A-BC58BD4F3ACF}\0x0804.ini
- %TEMP%\{DAE6266D-7365-4EB2-883A-BC58BD4F3ACF}\0x0419.ini
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SAM
- %ProgramFiles%\Generic\USB over IP Server\Driver\NUS_BusXP.inf
- %ProgramFiles%\Generic\USB over IP Server\Driver\GenHC.sys
- %ProgramFiles%\Generic\USB over IP Server\Driver\NUServerXP32.sys
- %ProgramFiles%\Generic\USB over IP Server\Driver\nuserverxp32.cat
- %ProgramFiles%\Generic\USB over IP Server\Driver\GenBus.sys
- %ProgramFiles%\Generic\USB over IP Server\Driver\GenBus.inf
- %ProgramFiles%\Generic\USB over IP Server\Driver\GenHC.inf
- %ProgramFiles%\Generic\USB over IP Server\Driver\genhc.cat
- %ProgramFiles%\Generic\USB over IP Server\Driver\NUServerXP.inf
- <DRIVERS>\GenHC.sys
- <DRIVERS>\NUServerXP32.sys
- %WINDIR%\inf\NUS_BusXP32.cat
- %WINDIR%\inf\NUS_BusXP.inf
- %ProgramFiles%\Generic\USB over IP Server\Driver\NUS_BusXP32.sys
- %ProgramFiles%\Generic\USB over IP Server\Driver\NUS_BusXP32.cat
- <DRIVERS>\GenBus.sys
- <DRIVERS>\NUS_BusXP32.sys
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING.VER
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\INDEX.MAP
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING2.MAP
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING1.MAP
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\domain.txt
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\ComDb.Dat
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\INDEX.BTR
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\$WinMgmt.CFG
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\OBJECTS.DATA
- %WINDIR%\Installer\MSI5.tmp
- %WINDIR%\Installer\27f3a.ipi
- %ProgramFiles%\Generic\USB over IP Server\Driver\genbus.cat
- C:\Config.Msi\27f3b.rbs
- %WINDIR%\Installer\27f38.msi
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\OBJECTS.MAP
- %WINDIR%\Installer\MSI4.tmp
- %WINDIR%\Installer\27f39.mst
Sets the 'hidden' attribute to the following files:
- <SYSTEM32>\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\nus_busxp.CAT
- <SYSTEM32>\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\oem4.CAT
- <SYSTEM32>\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\genbus.CAT
- <SYSTEM32>\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\oem3.CAT
Deletes the following files:
- <DRIVERS>\GenBus.sys
- %WINDIR%\Installer\27f3a.ipi
- %WINDIR%\Installer\27f38.msi
- %WINDIR%\Temp\OLDE.tmp
- <DRIVERS>\NUS_BusXP32.sys
- %WINDIR%\Temp\OLD9.tmp
- %WINDIR%\Installer\27f39.mst
- %TEMP%\MSI3.tmp
- %TEMP%\~2.tmp
- %TEMP%\~1.tmp
- C:\Config.Msi\27f3b.rbs
- %WINDIR%\Installer\MSI5.tmp
- %WINDIR%\Installer\MSI4.tmp
Moves the following files:
- from %ProgramFiles%\InstallShield Installation Information\{4DC0BBCC-3A7B-4284-BE34-CEE37C926C79}\0x04a270.rra to %ProgramFiles%\InstallShield Installation Information\{4DC0BBCC-3A7B-4284-BE34-CEE37C926C79}\0x0412.ini
- from %ProgramFiles%\InstallShield Installation Information\{4DC0BBCC-3A7B-4284-BE34-CEE37C926C79}\0x04a2ed.rra to %ProgramFiles%\InstallShield Installation Information\{4DC0BBCC-3A7B-4284-BE34-CEE37C926C79}\0x0415.ini
- from %ProgramFiles%\InstallShield Installation Information\{4DC0BBCC-3A7B-4284-BE34-CEE37C926C79}\0x04a185.rra to %ProgramFiles%\InstallShield Installation Information\{4DC0BBCC-3A7B-4284-BE34-CEE37C926C79}\0x0410.ini
- from %ProgramFiles%\InstallShield Installation Information\{4DC0BBCC-3A7B-4284-BE34-CEE37C926C79}\0x04a1f3.rra to %ProgramFiles%\InstallShield Installation Information\{4DC0BBCC-3A7B-4284-BE34-CEE37C926C79}\0x0411.ini
- from %ProgramFiles%\InstallShield Installation Information\{4DC0BBCC-3A7B-4284-BE34-CEE37C926C79}\0x04a34b.rra to %ProgramFiles%\InstallShield Installation Information\{4DC0BBCC-3A7B-4284-BE34-CEE37C926C79}\0x0419.ini
- from %WINDIR%\LastGood\TMP8.tmp to %WINDIR%\LastGood\system32\DRIVERS\GenBus.sys
- from %WINDIR%\LastGood\TMPD.tmp to %WINDIR%\LastGood\system32\DRIVERS\NUS_BusXP32.sys
- from %ProgramFiles%\InstallShield Installation Information\{4DC0BBCC-3A7B-4284-BE34-CEE37C926C79}\0x08a3b8.rra to %ProgramFiles%\InstallShield Installation Information\{4DC0BBCC-3A7B-4284-BE34-CEE37C926C79}\0x0804.ini
- from %ProgramFiles%\InstallShield Installation Information\{4DC0BBCC-3A7B-4284-BE34-CEE37C926C79}\0x08a425.rra to %ProgramFiles%\InstallShield Installation Information\{4DC0BBCC-3A7B-4284-BE34-CEE37C926C79}\0x0816.ini
- from %ProgramFiles%\InstallShield Installation Information\{4DC0BBCC-3A7B-4284-BE34-CEE37C926C79}\setu9ea7.rra to %ProgramFiles%\InstallShield Installation Information\{4DC0BBCC-3A7B-4284-BE34-CEE37C926C79}\setup.ini
- from %ProgramFiles%\InstallShield Installation Information\{4DC0BBCC-3A7B-4284-BE34-CEE37C926C79}\0x049ef5.rra to %ProgramFiles%\InstallShield Installation Information\{4DC0BBCC-3A7B-4284-BE34-CEE37C926C79}\0x0404.ini
- from %ProgramFiles%\InstallShield Installation Information\{4DC0BBCC-3A7B-4284-BE34-CEE37C926C79}\setu9ca3.rra to %ProgramFiles%\InstallShield Installation Information\{4DC0BBCC-3A7B-4284-BE34-CEE37C926C79}\setup.exe
- from %ProgramFiles%\InstallShield Installation Information\{4DC0BBCC-3A7B-4284-BE34-CEE37C926C79}\ISSe9d40.rra to %ProgramFiles%\InstallShield Installation Information\{4DC0BBCC-3A7B-4284-BE34-CEE37C926C79}\ISSetup.dll
- from %ProgramFiles%\InstallShield Installation Information\{4DC0BBCC-3A7B-4284-BE34-CEE37C926C79}\0x049f91.rra to %ProgramFiles%\InstallShield Installation Information\{4DC0BBCC-3A7B-4284-BE34-CEE37C926C79}\0x0407.ini
- from %ProgramFiles%\InstallShield Installation Information\{4DC0BBCC-3A7B-4284-BE34-CEE37C926C79}\0x04a07c.rra to %ProgramFiles%\InstallShield Installation Information\{4DC0BBCC-3A7B-4284-BE34-CEE37C926C79}\0x040a.ini
- from %ProgramFiles%\InstallShield Installation Information\{4DC0BBCC-3A7B-4284-BE34-CEE37C926C79}\0x04a118.rra to %ProgramFiles%\InstallShield Installation Information\{4DC0BBCC-3A7B-4284-BE34-CEE37C926C79}\0x040c.ini
- from %ProgramFiles%\InstallShield Installation Information\{4DC0BBCC-3A7B-4284-BE34-CEE37C926C79}\0x049fff.rra to %ProgramFiles%\InstallShield Installation Information\{4DC0BBCC-3A7B-4284-BE34-CEE37C926C79}\0x0409.ini
- from %ProgramFiles%\InstallShield Installation Information\{4DC0BBCC-3A7B-4284-BE34-CEE37C926C79}\1033a03d.rra to %ProgramFiles%\InstallShield Installation Information\{4DC0BBCC-3A7B-4284-BE34-CEE37C926C79}\1033.mst
Substitutes the following files:
- <DRIVERS>\NUS_BusXP32.sys
- <DRIVERS>\GenBus.sys
Network activity:
Connects to:
- '20#.#6.232.182':80
- 'wp#d':80
TCP:
HTTP GET requests:
- http://crl.microsoft.com/pki/crl/products/tspca.crl via 20#.#6.232.182
- http://crl.microsoft.com/pki/crl/products/MicWinHarComPCA_2008-01-08.crl via 20#.#6.232.182
- http://11#.#11.111.1/wpad.dat via wp#d
UDP:
- DNS ASK crl.microsoft.com
- DNS ASK wp#d
