PUA.Win32.AdvWinUtilities.A

This Potentially Unwanted Application arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Arrival Details

This Potentially Unwanted Application arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Potentially Unwanted Application adds the following processes:

• %User Temp%\is-P87JP.tmp\rkverify.exe

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local\Temp on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)

It creates the following folders:

• %Program Files%\Advanced Win Utilities Free\skin
• %Program Files%\Advanced Win Utilities Free\prog\DriverBackup
• %User Temp%\nsd2904348865490\images
• %Program Files%\Advanced Win Utilities Free\prog\AutoShutdown
• %Program Files%\Advanced Win Utilities Free\prog\ProgramLock\exe
• %Program Files%\Advanced Win Utilities Free\prog\FileFolderMonitor
• %Program Files%\Advanced Win Utilities Free\prog\Keylogger
• %Program Files%\Advanced Win Utilities Free\prog\UninstallManager
• %Program Files%\Advanced Win Utilities Free
• %Program Files%\Advanced Win Utilities Free\prog\UninstallManager\exe
• %Program Files%\Advanced Win Utilities Free\prog\EmptyFolderRemoval\exe
• %Program Files%\Advanced Win Utilities Free\prog\StartupManager\exe
• %User Temp%\nsd2904348865490\css\sdk-ui\images
• %Program Files%\Advanced Win Utilities Free\prog\DriverBackup\exe
• %Program Files%\Advanced Win Utilities Free\prog\FileSplitJoin
• %Program Files%\Advanced Win Utilities Free\prog\FileLock\exe
• %User Temp%\nsd2904348865490\css
• %Program Files%\Advanced Win Utilities Free\prog\PasswordManager
• %Program Files%\Advanced Win Utilities Free\prog\DeletedFileRecovery\exe
• %Program Files%\Advanced Win Utilities Free\prog\Keylogger\exe
• %Program Files%\Advanced Win Utilities Free\prog\Shredder\exe
• %Program Files%\Advanced Win Utilities Free\prog\WiFiHotspotCreator
• %Program Files%\Advanced Win Utilities Free\prog\Shredder
• %Program Files%\Advanced Win Utilities Free\prog\WiFiHotspotCreator\exe
• %Program Files%\Advanced Win Utilities Free\prog\DuplicatesRemoval
• %Program Files%\Advanced Win Utilities Free\prog\WebBrowserCleanup
• %Program Files%\Advanced Win Utilities Free\prog\FileLock
• %Program Files%\Advanced Win Utilities Free\prog\EmptyFolderRemoval
• %User Temp%\nsd2904348865490\css\sdk-ui
• %User Temp%\nsd2904348865490
• %Program Files%\Advanced Win Utilities Free\prog\WebBrowserCleanup\exe
• %All Users Profile%\Microsoft\Windows\Start Menu\Programs\Advanced Win Utilities Free
• %Program Files%\Advanced Win Utilities Free\prog\DeletedFileRecovery
• %Program Files%\Advanced Win Utilities Free\prog\RegistryCleanup\exe
• %Program Files%\Advanced Win Utilities Free\prog\FileSplitJoin\exe
• %Program Files%\Advanced Win Utilities Free\prog\EXEResourceExtractor
• %User Temp%\ns14AB5EB1
• %Program Files%\Advanced Win Utilities Free\prog\FileFolderMonitor\exe
• %Program Files%\Advanced Win Utilities Free\prog\AutoShutdown\exe
• %Program Files%\Advanced Win Utilities Free\prog\RegistryCleanup
• %Program Files%\Advanced Win Utilities Free\prog\DiskCleanup\exe
• %Program Files%\Advanced Win Utilities Free\prog\AutoClicker\exe
• %Program Files%\Advanced Win Utilities Free\prog\DuplicatesRemoval\exe
• %User Temp%\is-P87JP.tmp\_isetup
• %Program Files%\Advanced Win Utilities Free\prog\StartupManager
• %Program Files%\Advanced Win Utilities Free\prog\BrokenShortcutRemoval
• %User Temp%\nsd2904348865490\locale
• %Program Files%\Advanced Win Utilities Free\prog\ProgramLock
• %Program Files%\Advanced Win Utilities Free\prog\AutoClicker
• %Program Files%\Advanced Win Utilities Free\prog\EXEResourceExtractor\exe
• %Program Files%\Advanced Win Utilities Free\prog\BrokenShortcutRemoval\exe
• %Program Files%\Advanced Win Utilities Free\prog
• %Program Files%\Advanced Win Utilities Free\prog\PasswordManager\exe
• %Program Files%\Advanced Win Utilities Free\prog\DiskCleanup

(Note: %Program Files% is the default Program Files folder, usually C:\Program Files in Windows 2000(32-bit), Server 2003(32-bit), XP, Vista(64-bit), 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit) , or C:\Program Files (x86) in Windows XP(64-bit), Vista(64-bit), 7(64-bit), 8(64-bit), 8.1(64-bit), 2008(64-bit), 2012(64-bit) and 10(64-bit).. %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local\Temp on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).. %All Users Profile% is the common user's profile folder, which is usually C:\Documents and Settings\All Users on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\ProgramData on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit). )

Autostart Technique

This Potentially Unwanted Application drops the following file(s) in the Windows User Startup folder to enable its automatic execution at every system startup:

• %User Startup%\Advanced Win Utilities Free Update.lnk

(Note: %User Startup% is the current user's Startup folder, which is usually C:\Windows\Profiles\{user name}\Start Menu\Programs\Startup on Windows 98 and ME, C:\WINNT\Profiles\{user name}\Start Menu\Programs\Startup on Windows NT, C:\Documents and Settings\{User name}\Start Menu\Programs\Startup on Windows 2003(32-bit), XP and 2000(32-bit), or C:\Users\{user name}\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit), 10(64-bit).)

Other System Modifications

This Potentially Unwanted Application deletes the following files:

• %Application Data%\Microsoft\Internet Explorer\Quick Launch\Advanced Win Utilities Free.url
• %Desktop%\Advanced Win Utilities Free.pif
• %All Users Profile%\Microsoft\Windows\Start Menu\Programs\Advanced Win Utilities Free\More Free Tools.pif
• %Application Data%\Microsoft\Internet Explorer\Quick Launch\Advanced Win Utilities Free.pif
• %Start Menu%\Advanced Win Utilities Free.url
• %Start Menu%\Advanced Win Utilities Free.pif
• %All Users Profile%\Microsoft\Windows\Start Menu\Programs\Advanced Win Utilities Free\Advanced Win Utilities Free.pif
• %Desktop%\Advanced Win Utilities Free.url
• %All Users Profile%\Microsoft\Windows\Start Menu\Programs\Advanced Win Utilities Free\Advanced Win Utilities Free.url
• %User Startup%\Advanced Win Utilities Free Update.pif
• %All Users Profile%\Microsoft\Windows\Start Menu\Programs\Advanced Win Utilities Free\More Free Tools.lnk
• %All Users Profile%\Microsoft\Windows\Start Menu\Programs\Advanced Win Utilities Free\Uninstall.pif
• %User Temp%\nsd2904348865490\bootstrap_22046.html
• %All Users Profile%\Microsoft\Windows\Start Menu\Programs\Advanced Win Utilities Free\Uninstall.url
• %User Startup%\Advanced Win Utilities Free Update.url
• %All Users Profile%\Microsoft\Windows\Start Menu\Programs\Advanced Win Utilities Free\Advanced Win Utilities Free on the Web.pif
• %All Users Profile%\Microsoft\Windows\Start Menu\Programs\Advanced Win Utilities Free\Advanced Win Utilities Free on the Web.lnk

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Roaming on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).. %Desktop% is the current user's desktop, which is usually C:\Documents and Settings\{User Name}\Desktop on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\Desktop on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).. %All Users Profile% is the common user's profile folder, which is usually C:\Documents and Settings\All Users on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\ProgramData on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit). . %Start Menu% is the current user's Start Menu folder, which is usually C:\Windows\Start Menu or C:\Documents and Settings\{User name}\Start Menu on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Roaming\Microsoft\Windows\Start Menu on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).. %User Startup% is the current user's Startup folder, which is usually C:\Windows\Profiles\{user name}\Start Menu\Programs\Startup on Windows 98 and ME, C:\WINNT\Profiles\{user name}\Start Menu\Programs\Startup on Windows NT, C:\Documents and Settings\{User name}\Start Menu\Programs\Startup on Windows 2003(32-bit), XP and 2000(32-bit), or C:\Users\{user name}\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit), 10(64-bit).. %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local\Temp on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)

It adds the following registry entries:

HKEY_CURRENT_USER\Software\Microsoft\
RestartManager\Session0000
Owner = "\xec\x04\x00\x00\xeb\xc7\x92\xc0@\xdc\xd5\x01"

HKEY_CURRENT_USER\Software\Microsoft\
RestartManager\Session0000
SessionHash = "{random characters}"

HKEY_CURRENT_USER\Software\Microsoft\
RestartManager\Session0000
Sequence = "1"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Shell Extensions\
Cached
{random string} = "\x01\x00\x00\x00\x00\x00\x00\x00F\xa5\xfe\x83\xdc\xd5\x01"

HKEY_CURRENT_USER\Software\Microsoft\
RestartManager\Session0000
RegFiles0000 = "\x00\x00\x00tP\xe4\x81\x81Z\xe5\x90\x90\xef\x80\x80\x04\xe1\x80\x80t\xe6\xad\xa0"

HKEY_CURRENT_USER\Software\Microsoft\
RestartManager\Session0000
RegFilesHash = "{random characters}"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Microsoft\Windows\CurrentVersion\
Uninstall\Advanced Win Utilities Free_is1
Inno Setup: Setup Version = "6.0.3 (u)"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Microsoft\Windows\CurrentVersion\
Uninstall\Advanced Win Utilities Free_is1
Inno Setup: App Path = "%Program Files%\Advanced Win Utilities Free"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Microsoft\Windows\CurrentVersion\
Uninstall\Advanced Win Utilities Free_is1
InstallLocation = "%Program Files%\Advanced Win Utilities Free"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Microsoft\Windows\CurrentVersion\
Uninstall\Advanced Win Utilities Free_is1
Inno Setup: Icon Group = "Advanced Win Utilities Free"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Microsoft\Windows\CurrentVersion\
Uninstall\Advanced Win Utilities Free_is1
Inno Setup: User = "{username}"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Microsoft\Windows\CurrentVersion\
Uninstall\Advanced Win Utilities Free_is1
Inno Setup: Language = "en_1"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Microsoft\Windows\CurrentVersion\
Uninstall\Advanced Win Utilities Free_is1
DisplayName = "Advanced Win Utilities Free 8.8.2.6"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Microsoft\Windows\CurrentVersion\
Uninstall\Advanced Win Utilities Free_is1
UninstallString = "%Program Files%\Advanced Win Utilities Free\unins000.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Microsoft\Windows\CurrentVersion\
Uninstall\Advanced Win Utilities Free_is1
QuietUninstallString = "%Program Files%\Advanced Win Utilities Free\unins000.exe /SILENT"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Microsoft\Windows\CurrentVersion\
Uninstall\Advanced Win Utilities Free_is1
Publisher = "Win Utilities Software, Inc."

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Microsoft\Windows\CurrentVersion\
Uninstall\Advanced Win Utilities Free_is1
URLInfoAbout = "http://www.{BLOCKED}ilities.net"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Microsoft\Windows\CurrentVersion\
Uninstall\Advanced Win Utilities Free_is1
HelpLink = "http://www.{BLOCKED}ilities.net"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Microsoft\Windows\CurrentVersion\
Uninstall\Advanced Win Utilities Free_is1
URLUpdateInfo = "http://www.{BLOCKED}ilities.net"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Microsoft\Windows\CurrentVersion\
Uninstall\Advanced Win Utilities Free_is1
NoModify = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Microsoft\Windows\CurrentVersion\
Uninstall\Advanced Win Utilities Free_is1
NoRepair = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Microsoft\Windows\CurrentVersion\
Uninstall\Advanced Win Utilities Free_is1
InstallDate = "20200206"

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
Microsoft\Windows\CurrentVersion\
Uninstall\Advanced Win Utilities Free_is1
EstimatedSize = "75223"

Dropping Routine

This Potentially Unwanted Application drops the following files:

• %Program Files%\Advanced Win Utilities Free\prog\DiskCleanup\exe\is-NBQ28.tmp
• %Program Files%\Advanced Win Utilities Free\is-CO00H.tmp
• %Program Files%\Advanced Win Utilities Free\prog\DiskCleanup\exe\DiskCleanup.exe
• %Program Files%\Advanced Win Utilities Free\prog\Shredder\exe\is-8N6KT.tmp
• %User Temp%\nsd2904348865490\locale\ML.locale
• %Program Files%\Advanced Win Utilities Free\prog\FileSplitJoin\exe\is-UADO4.tmp
• %Program Files%\Advanced Win Utilities Free\prog\ProgramLock\exe\is-N50MN.tmp
• %Program Files%\Advanced Win Utilities Free\prog\AutoClicker\exe\UI.jpg
• %Program Files%\Advanced Win Utilities Free\prog\FileLock\exe\FileLock.exe
• %Program Files%\Advanced Win Utilities Free\prog\DeletedFileRecovery\exe\is-8J20D.tmp
• %Program Files%\Advanced Win Utilities Free\prog\FileFolderMonitor\exe\FileFolderMonitor.exe
• %Program Files%\Advanced Win Utilities Free\prog\BrokenShortcutRemoval\exe\UI.bmp
• %Program Files%\Advanced Win Utilities Free\prog\DuplicatesRemoval\exe\DuplicatesRemoval.exe
• %User Temp%\nsd2904348865490\locale\MR.locale
• %Program Files%\Advanced Win Utilities Free\prog\WiFiHotspotCreator\exe\is-POV41.tmp
• %Program Files%\Advanced Win Utilities Free\skin\is-AK5D6.tmp
• %Program Files%\Advanced Win Utilities Free\prog\RegistryCleanup\exe\Microsoft.WindowsAPICodePack.Shell.dll
• %User Temp%\nsd2904348865490\locale\LV.locale
• %User Temp%\nsd2904348865490\css\sdk-ui\button.css
• %Program Files%\Advanced Win Utilities Free\prog\DiskCleanup\exe\logo.png
• %Program Files%\Advanced Win Utilities Free\is-CKFNF.tmp
• %User Temp%\nsd2904348865490\locale\BG.locale
• %User Temp%\01BB2D52.log
• %User Temp%\nsd2904348865490\locale\KA.locale
• %Program Files%\Advanced Win Utilities Free\skin\is-RFKQ4.tmp
• %Program Files%\Advanced Win Utilities Free\prog\BrokenShortcutRemoval\exe\icon.ico
• %Program Files%\Advanced Win Utilities Free\prog\ProgramLock\exe\is-8GMM2.tmp
• %User Temp%\nsd2904348865490\locale\FA.locale
• %Program Files%\Advanced Win Utilities Free\prog\PasswordManager\exe\is-BDEGQ.tmp
• %User Temp%\nsd2904348865490\locale\CA.locale
• %All Users Profile%\Microsoft\Windows\Start Menu\Programs\Advanced Win Utilities Free\Advanced Win Utilities Free.lnk
• %Program Files%\Advanced Win Utilities Free\prog\FileSplitJoin\exe\is-MBJN8.tmp
• %User Temp%\nsd2904348865490\css\sdk-ui\browse.css
• %Program Files%\Advanced Win Utilities Free\prog\DuplicatesRemoval\exe\is-QCBVO.tmp
• %Program Files%\Advanced Win Utilities Free\prog\PasswordManager\exe\lamecore.dll
• %Program Files%\Advanced Win Utilities Free\prog\Keylogger\exe\lamecore.dll
• %Program Files%\Advanced Win Utilities Free\prog\DeletedFileRecovery\exe\is-0726M.tmp
• %Program Files%\Advanced Win Utilities Free\prog\FileSplitJoin\exe\FileSplitterJoiner.exe
• %Program Files%\Advanced Win Utilities Free\prog\FileSplitJoin\exe\lamecore.dll
• %Program Files%\Advanced Win Utilities Free\prog\EXEResourceExtractor\exe\icon.ico
• %Program Files%\Advanced Win Utilities Free\prog\EXEResourceExtractor\exe\is-3NHD8.tmp
• %User Temp%\is-P87JP.tmp\ezdatzsazzxt.dll
• %User Temp%\nsd2904348865490\locale\SK.locale
• %User Temp%\nsd2904348865490\locale\MK.locale
• %User Temp%\nsd2904348865490\locale\PS.locale
• %User Temp%\is-P87JP.tmp\RKBanner.bmp
• %User Temp%\01BB2D42.log
• %Program Files%\Advanced Win Utilities Free\prog\BrokenShortcutRemoval\exe\BrokenShortcutRemova.exe
• %All Users Profile%\Microsoft\Windows\Start Menu\Programs\Advanced Win Utilities Free\More Free Tools.url
• %Program Files%\Advanced Win Utilities Free\prog\AutoShutdown\exe\lamecore.dll
• %User Temp%\nsd2904348865490\locale\TH.locale
• %Program Files%\Advanced Win Utilities Free\Advanced Win Utilities Free Update.exe
• %Program Files%\Advanced Win Utilities Free\prog\DuplicatesRemoval\exe\lamecore.dll
• %Program Files%\Advanced Win Utilities Free\prog\RegistryCleanup\exe\is-1R7HG.tmp
• %Program Files%\Advanced Win Utilities Free\prog\DuplicatesRemoval\exe\is-PEV27.tmp
• %Program Files%\Advanced Win Utilities Free\prog\Shredder\exe\is-CO4AF.tmp
• %Program Files%\Advanced Win Utilities Free\prog\DeletedFileRecovery\exe\is-RK633.tmp
• %Program Files%\Advanced Win Utilities Free\prog\Shredder\exe\is-6JUCP.tmp
• %Program Files%\Advanced Win Utilities Free\skin\youtubemisc_panel.bmp
• %All Users Profile%\Microsoft\Windows\Start Menu\Programs\Advanced Win Utilities Free\Uninstall.lnk
• %Program Files%\Advanced Win Utilities Free\skin\active.bmp
• %Desktop%\Advanced Win Utilities Free.lnk
• %Program Files%\Advanced Win Utilities Free\prog\AutoClicker\exe\AutoClicker.exe
• %User Temp%\nsd2904348865490\locale\LT.locale
• %AppDataLocal%\Microsoft\Internet Explorer\MSIMGSIZ.DAT
• %User Temp%\nsd2904348865490\locale\RO.locale
• %Program Files%\Advanced Win Utilities Free\prog\AutoClicker\exe\is-1L1HJ.tmp
• %Program Files%\Advanced Win Utilities Free\prog\AutoShutdown\exe\icon.ico
• %Program Files%\Advanced Win Utilities Free\prog\WiFiHotspotCreator\exe\is-0D3B4.tmp
• %Program Files%\Advanced Win Utilities Free\prog\DeletedFileRecovery\exe\is-8MVV8.tmp
• %Program Files%\Advanced Win Utilities Free\prog\WiFiHotspotCreator\exe\Interop.NETCONLib.dll
• %User Temp%\nsd2904348865490\locale\YO.locale
• %User Temp%\nsd2904348865490\css\sdk-ui\progress-bar.css
• %Program Files%\Advanced Win Utilities Free\prog\FileFolderMonitor\exe\is-7UJOR.tmp
• %User Temp%\nsd2904348865490\locale\ET.locale
• %Program Files%\Advanced Win Utilities Free\prog\UninstallManager\exe\Tsing Tools.dll
• %User Temp%\nsd2904348865490\locale\EU.locale
• %Program Files%\Advanced Win Utilities Free\prog\FileFolderMonitor\exe\is-6LL5V.tmp
• %Program Files%\Advanced Win Utilities Free\prog\Keylogger\exe\icon.ico
• %User Temp%\nsd2904348865490\locale\IT.locale
• %All Users Profile%\Microsoft\Windows\Start Menu\Programs\Advanced Win Utilities Free\Advanced Win Utilities Free on the Web.url
• %User Temp%\nsd2904348865490\locale\HT.locale
• %Program Files%\Advanced Win Utilities Free\prog\FileLock\exe\is-E51JO.tmp
• %User Temp%\nsd2904348865490\locale\HU.locale
• %Program Files%\Advanced Win Utilities Free\prog\DiskCleanup\exe\system.dat
• %User Temp%\nsd2904348865490\csshover3.htc
• %Program Files%\Advanced Win Utilities Free\prog\EXEResourceExtractor\exe\is-061GV.tmp
• %Program Files%\Advanced Win Utilities Free\prog\AutoClicker\exe\is-SH5IV.tmp
• %User Temp%\is-P87JP.tmp\rkverify.exe
• %User Temp%\nsd2904348865490\locale\KK.locale
• %Program Files%\Advanced Win Utilities Free\prog\DeletedFileRecovery\exe\FileSystems.dll
• %Program Files%\Advanced Win Utilities Free\prog\ProgramLock\exe\ProgramLock.exe
• %User Temp%\nsd2904348865490\locale\FI.locale
• %Program Files%\Advanced Win Utilities Free\prog\DiskCleanup\exe\is-MR5B5.tmp
• %Program Files%\Advanced Win Utilities Free\prog\Shredder\exe\icon.ico
• %Program Files%\Advanced Win Utilities Free\version.dat
• %Program Files%\Advanced Win Utilities Free\prog\Keylogger\exe\is-IBFMB.tmp
• %Program Files%\Advanced Win Utilities Free\prog\DriverBackup\exe\DriverBackup.exe
• %Program Files%\Advanced Win Utilities Free\prog\FileLock\exe\icon.ico
• %Program Files%\Advanced Win Utilities Free\skin\is-HO9LA.tmp
• %Program Files%\Advanced Win Utilities Free\prog\FileFolderMonitor\exe\is-N78Q2.tmp
• %Program Files%\Advanced Win Utilities Free\prog\Shredder\exe\core.dll
• %Program Files%\Advanced Win Utilities Free\prog\WiFiHotspotCreator\exe\WiFiHotspotCreator.exe
• %Program Files%\Advanced Win Utilities Free\prog\BrokenShortcutRemoval\exe\is-NVLU0.tmp
• %Program Files%\Advanced Win Utilities Free\prog\FileSplitJoin\exe\is-0T764.tmp
• %User Temp%\nsd2904348865490\locale\AF.locale
• %Program Files%\Advanced Win Utilities Free\prog\DiskCleanup\exe\lamecore.dll
• %User Temp%\nsd2904348865490\locale\SL.locale
• %Program Files%\Advanced Win Utilities Free\skin\normal.bmp
• %Program Files%\Advanced Win Utilities Free\skin\photoimages_panel.bmp
• %User Temp%\nsd2904348865490\locale\TA.locale
• %Program Files%\Advanced Win Utilities Free\unins000.dat
• %Program Files%\Advanced Win Utilities Free\is-NNRRQ.tmp
• %Program Files%\Advanced Win Utilities Free\prog\RegistryCleanup\exe\Tsing Tools.dll
• %User Temp%\nsd2904348865490\locale\TL.locale
• %Program Files%\Advanced Win Utilities Free\prog\Keylogger\exe\is-JBPLR.tmp
• %User Temp%\nsd2904348865490\locale\HI.locale
• %User Temp%\nsd2904348865490\locale\VI.locale
• %User Temp%\nsd2904348865490\locale\PT.locale
• %User Temp%\nsd2904348865490\locale\UK.locale
• %Program Files%\Advanced Win Utilities Free\prog\WiFiHotspotCreator\exe\is-F9RIR.tmp
• %User Temp%\nsd2904348865490\css\sdk-ui\images\button-bg.png
• %User Temp%\nsd2904348865490\locale\TR.locale
• %User Temp%\nsd2904348865490\css\ie6_main.css
• %Program Files%\Advanced Win Utilities Free\prog\DriverBackup\exe\lamecore.dll
• %User Temp%\01BB2B01.log
• %User Temp%\nsd2904348865490\locale\ID.locale
• %Program Files%\Advanced Win Utilities Free\prog\EmptyFolderRemoval\exe\is-AMO6P.tmp
• %Program Files%\Advanced Win Utilities Free\prog\StartupManager\exe\Tsing Tools.dll
• %Program Files%\Advanced Win Utilities Free\prog\DriverBackup\exe\icon.ico
• %Program Files%\Advanced Win Utilities Free\prog\FileLock\exe\is-E80TN.tmp
• %User Temp%\nsd2904348865490\locale\ES.locale
• %Program Files%\Advanced Win Utilities Free\prog\Shredder\exe\is-OLOL0.tmp
• %Program Files%\Advanced Win Utilities Free\prog\BrokenShortcutRemoval\exe\is-BCH5M.tmp
• %Program Files%\Advanced Win Utilities Free\prog\DriverBackup\exe\is-EFLTB.tmp
• %Program Files%\Advanced Win Utilities Free\skin\layerframemask.bmp
• %User Temp%\nsd2904348865490\locale\SR.locale
• %User Temp%\nsd2904348865490\css\sdk-ui\images\progress-bg.png
• %Program Files%\Advanced Win Utilities Free\prog\AutoClicker\exe\is-KC48G.tmp
• %Program Files%\Advanced Win Utilities Free\skin\skin.ini
• %Program Files%\Advanced Win Utilities Free\skin\is-ANDHG.tmp
• %Program Files%\Advanced Win Utilities Free\prog\FileSplitJoin\exe\icon.ico
• %Program Files%\Advanced Win Utilities Free\prog\PasswordManager\exe\PasswordManager.exe
• %Program Files%\Advanced Win Utilities Free\skin\is-VKSC8.tmp
• %Start Menu%\Advanced Win Utilities Free.lnk
• %User Temp%\nsd2904348865490\locale\ZH.locale
• %Program Files%\Advanced Win Utilities Free\prog\PasswordManager\exe\icon.ico
• %User Temp%\nsd2904348865490\locale\UZ.locale
• %Program Files%\Advanced Win Utilities Free\unins000.exe
• %Program Files%\Advanced Win Utilities Free\prog\UninstallManager\exe\is-APIDL.tmp
• %User Temp%\nsd2904348865490\css\sdk-ui\images\progress-bg-corner.png
• %User Temp%\nsd2904348865490\locale\HE.locale
• %User Temp%\nsd2904348865490\locale\CS.locale
• %Program Files%\Advanced Win Utilities Free\prog\Shredder\exe\lamecore.dll
• %Program Files%\Advanced Win Utilities Free\prog\RegistryCleanup\exe\Microsoft.WindowsAPICodePack.dll
• %Program Files%\Advanced Win Utilities Free\prog\StartupManager\exe\is-OMTOL.tmp
• %User Temp%\nsd2904348865490\locale\PL.locale
• %Program Files%\Advanced Win Utilities Free\prog\DiskCleanup\exe\is-FUPUF.tmp
• %Program Files%\Advanced Win Utilities Free\prog\WebBrowserCleanup\exe\is-0PV3J.tmp
• %Program Files%\Advanced Win Utilities Free\prog\EXEResourceExtractor\exe\EXEResourceExtractor.exe
• %Program Files%\Advanced Win Utilities Free\prog\AutoShutdown\exe\AutoShutdown.exe
• %Program Files%\Advanced Win Utilities Free\prog\RegistryCleanup\exe\is-GA0KR.tmp
• %Program Files%\Advanced Win Utilities Free\prog\WebBrowserCleanup\exe\Tsing Tools.dll
• %Program Files%\Advanced Win Utilities Free\skin\is-M2G85.tmp
• %Program Files%\Advanced Win Utilities Free\prog\Keylogger\exe\is-S8K1P.tmp
• %Program Files%\Advanced Win Utilities Free\prog\DeletedFileRecovery\exe\GuiComponents.dll
• %Program Files%\Advanced Win Utilities Free\prog\AutoClicker\exe\icon.ico
• %Program Files%\Advanced Win Utilities Free\prog\FileLock\exe\is-7UJMN.tmp
• %User Temp%\nsd2904348865490\locale\RU.locale
• %User Temp%\nsd2904348865490\locale\GU.locale
• %User Temp%\nsd2904348865490\locale\JA.locale
• %Program Files%\Advanced Win Utilities Free\goup.exe
• %User Temp%\nsd2904348865490\locale\BE.locale
• %User Temp%\nsd2904348865490\locale\LO.locale
• %Program Files%\Advanced Win Utilities Free\prog\DiskCleanup\exe\icon.ico
• %Program Files%\Advanced Win Utilities Free\prog\AutoShutdown\exe\is-H05KT.tmp
• %Program Files%\Advanced Win Utilities Free\is-04L42.tmp
• %Program Files%\Advanced Win Utilities Free\prog\Keylogger\exe\UI.bmp
• %User Temp%\nsd2904348865490\locale\KU.locale
• %User Temp%\nsd2904348865490\css\main.css
• %User Temp%\nsd2904348865490\locale\IS.locale
• %Program Files%\Advanced Win Utilities Free\prog\BrokenShortcutRemoval\exe\is-BFKTT.tmp
• %User Temp%\nsd2904348865490\css\sdk-ui\images\progress-bg2.png
• %User Temp%\nsd2904348865490\locale\SQ.locale
• %Program Files%\Advanced Win Utilities Free\prog\Shredder\exe\is-P0D2D.tmp
• %Program Files%\Advanced Win Utilities Free\prog\ProgramLock\exe\is-IU5CV.tmp
• %Program Files%\Advanced Win Utilities Free\prog\BrokenShortcutRemoval\exe\lamecore.dll
• %User Temp%\is-P87JP.tmp\itdownload.dll
• %Program Files%\Advanced Win Utilities Free\prog\BrokenShortcutRemoval\exe\is-8EPML.tmp
• %Program Files%\Advanced Win Utilities Free\prog\FileFolderMonitor\exe\lamecore.dll
• %Program Files%\Advanced Win Utilities Free\prog\PasswordManager\exe\is-CFVTR.tmp
• %Program Files%\Advanced Win Utilities Free\prog\EXEResourceExtractor\exe\is-UFOBC.tmp
• %Program Files%\Advanced Win Utilities Free\prog\FileFolderMonitor\exe\icon.ico
• %User Temp%\is-P87JP.tmp\rkinstaller.exe
• %Program Files%\Advanced Win Utilities Free\prog\RegistryCleanup\exe\is-JHH7N.tmp
• %Program Files%\Advanced Win Utilities Free\prog\Shredder\exe\shredder.avi
• %Application Data%\Microsoft\Internet Explorer\Quick Launch\Advanced Win Utilities Free.lnk
• %Program Files%\Advanced Win Utilities Free\prog\EmptyFolderRemoval\exe\EmptyFolderRemoval.exe
• %Program Files%\Advanced Win Utilities Free\prog\UninstallManager\exe\UninstallManager.exe
• %Program Files%\Advanced Win Utilities Free\prog\AutoShutdown\exe\is-PPNNF.tmp
• %Program Files%\Advanced Win Utilities Free\prog\DuplicatesRemoval\exe\icon.ico
• %User Temp%\nsd2904348865490\locale\NE.locale
• %Program Files%\Advanced Win Utilities Free\prog\DriverBackup\exe\is-VNNEB.tmp
• %Program Files%\Advanced Win Utilities Free\prog\Shredder\exe\is-GAEG8.tmp
• %Program Files%\Advanced Win Utilities Free\skin\is-1NBFQ.tmp
• %User Temp%\nsd2904348865490\locale\BS.locale
• %Program Files%\Advanced Win Utilities Free\prog\Shredder\exe\UI.bmp
• %Program Files%\Advanced Win Utilities Free\prog\WiFiHotspotCreator\exe\Interop.NetFwTypeLib.dll
• %Program Files%\Advanced Win Utilities Free\skin\mp3audio_panel.bmp
• %Program Files%\Advanced Win Utilities Free\prog\DriverBackup\exe\is-LP2QL.tmp
• %User Temp%\nsd2904348865490\locale\NL.locale
• %Program Files%\Advanced Win Utilities Free\prog\ProgramLock\exe\lamecore.dll
• %Program Files%\Advanced Win Utilities Free\prog\AutoShutdown\exe\is-GECLR.tmp
• %User Temp%\nsd2904348865490\locale\FR.locale
• %Program Files%\Advanced Win Utilities Free\prog\DeletedFileRecovery\exe\DeletedFileRecovery.exe
• %Program Files%\Advanced Win Utilities Free\prog\FileLock\exe\lamecore.dll
• %User Temp%\nsd2904348865490\locale\ZU.locale
• %Program Files%\Advanced Win Utilities Free\prog\Shredder\exe\Shredder.exe
• %Program Files%\Advanced Win Utilities Free\is-SNTVL.tmp
• %User Temp%\nsd2904348865490\css\sdk-ui\checkbox.css
• %User Temp%\nsd2904348865490\locale\KO.locale
• %User Temp%\nsd2904348865490\locale\SV.locale
• %User Temp%\nsd2904348865490\locale\AZ.locale
• %User Temp%\nsd2904348865490\locale\UR.locale
• %Program Files%\Advanced Win Utilities Free\skin\is-G23IF.tmp
• %User Temp%\nsd2904348865490\locale\HY.locale
• %User Temp%\nsd2904348865490\locale\PA.locale
• %User Temp%\nsd2904348865490\locale\MS.locale
• %Program Files%\Advanced Win Utilities Free\prog\StartupManager\exe\StartupManager.exe
• %Program Files%\Advanced Win Utilities Free\prog\WebBrowserCleanup\exe\is-9UCEJ.tmp
• %Program Files%\Advanced Win Utilities Free\prog\DuplicatesRemoval\exe\is-82R2N.tmp
• %Program Files%\Advanced Win Utilities Free\unins000.msg
• %User Temp%\nsd2904348865490\locale\NO.locale
• %Program Files%\Advanced Win Utilities Free\prog\StartupManager\exe\is-EI8JP.tmp
• %User Temp%\nsd2904348865490\images\Loader.gif
• %User Temp%\nsd2904348865490\locale\DA.locale
• %User Temp%\nsd2904348865490\locale\EL.locale
• %Program Files%\Advanced Win Utilities Free\prog\ProgramLock\exe\icon.ico
• %Program Files%\Advanced Win Utilities Free\prog\WebBrowserCleanup\exe\WebBrowserCleanup.exe
• %Program Files%\Advanced Win Utilities Free\AdvancedWinUtilitiesFree.exe
• %Program Files%\Advanced Win Utilities Free\prog\DeletedFileRecovery\exe\Ionic.Zip.dll
• %Program Files%\Advanced Win Utilities Free\prog\RegistryCleanup\exe\RegistryCleanup.exe
• %Program Files%\Advanced Win Utilities Free\skin\is-9UG45.tmp
• %Program Files%\Advanced Win Utilities Free\prog\DiskCleanup\exe\is-TU05E.tmp
• %Program Files%\Advanced Win Utilities Free\prog\PasswordManager\exe\is-INSRF.tmp
• %Program Files%\Advanced Win Utilities Free\skin\dvdvideo_panel.bmp
• %Program Files%\Advanced Win Utilities Free\prog\RegistryCleanup\exe\is-A3QTJ.tmp
• %User Temp%\nsd2904348865490\locale\EN.locale
• %User Temp%\nsd2904348865490\locale\DE.locale
• %Program Files%\Advanced Win Utilities Free\prog\DiskCleanup\exe\is-HSMCH.tmp
• %User Temp%\nsd2904348865490\locale\HR.locale
• %Program Files%\Advanced Win Utilities Free\prog\UninstallManager\exe\is-NURVT.tmp
• %Program Files%\Advanced Win Utilities Free\skin\layerframe.bmp
• %User Temp%\nsd2904348865490\locale\TE.locale
• %Program Files%\Advanced Win Utilities Free\prog\EXEResourceExtractor\exe\lamecore.dll

(Note: %Program Files% is the default Program Files folder, usually C:\Program Files in Windows 2000(32-bit), Server 2003(32-bit), XP, Vista(64-bit), 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit) , or C:\Program Files (x86) in Windows XP(64-bit), Vista(64-bit), 7(64-bit), 8(64-bit), 8.1(64-bit), 2008(64-bit), 2012(64-bit) and 10(64-bit).. %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local\Temp on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).. %All Users Profile% is the common user's profile folder, which is usually C:\Documents and Settings\All Users on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\ProgramData on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit). . %Desktop% is the current user's desktop, which is usually C:\Documents and Settings\{User Name}\Desktop on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\Desktop on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).. %AppDataLocal% is the Local Application Data folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Application Data on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).. %Start Menu% is the current user's Start Menu folder, which is usually C:\Windows\Start Menu or C:\Documents and Settings\{User name}\Start Menu on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Roaming\Microsoft\Windows\Start Menu on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).. %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Roaming on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)

Other Details

This Potentially Unwanted Application connects to the following possibly malicious URL:

• http://rp.{BLOCKED}verseapplication.com
• http://os.{BLOCKED}verseapplication.com
• http://post.{BLOCKED}studies.com/packages/RI1034/ContentI3.exe
• http://post.{BLOCKED}studies.com/packages/RV0267/ContentV3.exe
• http://post.{BLOCKED}studies.com/TapAction.aspx?{random characters}
• http://dpd.{BLOCKED}studies.com

This report is generated via an automated analysis system.