home

system32.exe

game

WORKGROUP

The executable system32.exe has been detected as malware by 7 anti-virus scanners. It is set to automatically start when a user logs into Windows via the current user run registry key under the display name ‘Svchost’.
Publisher:
WORKGROUP

Product:
game

Version:
2.07

MD5:
cc15fb6a538c41148079dd5eb29d52a9

SHA-1:
a74b559f1ee794cfe252a13cdf4e2a06cfcaad39

SHA-256:
061e357eb98744bb265ee564e9770ad25ef6c901335729962ab24b6784e9b287

Scanner detections:
7 / 68

Status:
Malware

Analysis date:
5/4/2024 9:13:34 AM UTC  (today)

Scan engine
Detection
Engine version

Clam AntiVirus
Win.Trojan.Qhost-151
0.98/23207

Dr.Web
Win32.HLLW.Autoruner1.18381
9.0.1.05190

ESET NOD32
Win32/AutoRun.VB.DL worm
6.3.12010.0

F-Prot
W32/Worm.ANEY
4.6.5.141

F-Secure
Worm.VB.NII
5.16.24

Kaspersky
Worm.Win32.AutoRun
15.0.2.529

Microsoft Security Essentials
Worm:Win32/Autorun.TB
1.237.1231.0

File size:
100 KB (102,400 bytes)

Product version:
2.07

Copyright:
...xD

Original file name:
stub propagador.exe

File type:
Executable application (Win32 EXE)

Language:
Spanish

Common path:
C:\Documents and Settings\{user}\Application data\system32.exe

File PE Metadata
Compilation timestamp:
4/24/2009 3:11:46 AM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
6.0

Entry address:
0x1D90

Entry point:
68, 18, 57, 40, 00, E8, EE, FF, FF, FF, 00, 00, 00, 00, 00, 00, 30, 00, 00, 00, 50, 00, 00, 00, 38, 00, 00, 00, 92, 7A, 35, 24, 0B, D1, 26, 46, 81, 73, 7A, CB, 95, D1, 2D, 6F, 00, 00, 00, 00, 00, 00, 01, 00, 00, 00, 42, 00, 06, 50, 83, 01, 67, 61, 6D, 65, 00, BB, B0, 03, 67, 61, 6D, 65, 20, 6F, 66, 20, 64, 65, 74, 61, 68, 20, 78, 64, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, FF, CC, 31, 00, 1D, 1F, 7C, C0, A1, 11, 3C, 1D, 42, 8E, FE, 57, EC, C4, 44, C4, 57, EA, F7, 1C, A4, F8, AD, 62, 43, A8, 34, 7A...
 
[+]

Developed / compiled with:
Microsoft Visual Basic v5.0/v6.0

Code size:
80 KB (81,920 bytes)

Startup File (User Run)
Registry location:
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Name:
Svchost

Command:
C:\Documents and Settings\{user}\Application data\svchost.exe


Remove system32.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.