[ General information ]
   * File name: c:\documents and settings\r32\mis documentos\descargas\comradex crypter\stub_unc.exe

[ Changes to filesystem ]
   * Creates file C:\Documents and Settings\All Users\Datos de programa\Microsoft\Dr Watson\drwtsn32.log
   * Creates file C:\Documents and Settings\All Users\Datos de programa\Microsoft\Dr Watson\user.dmp
   * Modifies file C:\Documents and Settings\r32\Configuración local\Archivos temporales de Internet\Content.IE5\index.dat

 [ Changes to registry ]
   * Modifies value "NumberOfCrashes=00000003" in key HKEY_LOCAL_MACHINE\software\microsoft\DrWatson
          old value "NumberOfCrashes=00000002"
   * Modifies value "NukeOnDelete=00000001" in key HKEY_LOCAL_MACHINE\software\microsoft\Windows\CurrentVersion\Explorer\BitBucket
          old value empty
   * Modifies value "SavedLegacySettings=46000000CC0100000100000000000000050000006C6F63616C00000000040000000000000050EB206AFBFACD01010000000A00020F000000000000000000000000" in key HKEY_CURRENT_USER\software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
          old value "SavedLegacySettings=46000000CB0100000100000000000000050000006C6F63616C00000000040000000000000050EB206AFBFACD01010000000A00020F000000000000000000000000"

[ Network services ]
   * Looks for an Internet connection.

 [ Process/window/string information ]
   * Enables process privileges.
   * Gets user name information.
   * Gets system default language ID.
   * Gets computer name.
   * Checks for debuggers.
   * Creates a mutex "CTF.LBES.MutexDefaultS-1-5-21-1482476501-1202660629-1957994488-1003".
   * Creates a mutex "CTF.Compart.MutexDefaultS-1-5-21-1482476501-1202660629-1957994488-1003".
   * Creates a mutex "CTF.Asm.MutexDefaultS-1-5-21-1482476501-1202660629-1957994488-1003".
   * Creates a mutex "CTF.Layouts.MutexDefaultS-1-5-21-1482476501-1202660629-1957994488-1003".
   * Creates a mutex "CTF.TMD.MutexDefaultS-1-5-21-1482476501-1202660629-1957994488-1003".
   * Creates a mutex "CTF.TimListCache.FMPDefaultS-1-5-21-1482476501-1202660629-1957994488-1003MUTEX.DefaultS-1-5-21-1482476501-1202660629-1957994488-1003".
   * Creates process "C:\WINDOWS\system32\svchost.exe,(null),(null)".
   * Injects code into process "c:\windows\system32\svchost.exe".
   * Enumerates running processes.
   * Injects code into process "c:\windows\system32\dwwin.exe".
   * Creates a mutex "SHIMLIB_LOG_MUTEX".
   * Creates a mutex "Local\_!MSFTHISTORY!_".
   * Creates a mutex "Local\c:!documents and settings!r32!configuración local!archivos temporales de internet!content.ie5!".
   * Creates a mutex "Local\c:!documents and settings!r32!cookies!".
   * Creates a mutex "Local\c:!documents and settings!r32!configuración local!historial!history.ie5!".
   * Creates a mutex "RasPbFile".
   * Opens a service named "RASMAN".
   * Lists all entry names in a remote access phone book.
   * Opens a service named "Sens".
   * Creates a mutex "MSCTF.Shared.MUTEX.EBH".
   * Creates process "(null),C:\WINDOWS\system32\drwtsn32 -p 1796 -e 340 -g,(null)".
   * Injects code into process "c:\windows\system32\drwtsn32.exe".
   * Creates an event named "DbgEngEvent_00000070".
   * Injects code into process "c:\documents and settings\r32\mis documentos\descargas\comradex crypter\stub_unc.exe".
   * Terminates process "à?¤\dee\harskvol1\do".