Hey Hey,

This thing definately reads a lot of directories and a lot of files... it also does some file creation and that's what I documented.

Extract zip file
single exe - f22-012.exe
Run the EXE
system32\winshost.exe is created
ntuser.dat and ntuser.dat.log in c:\documents and settings\Administrator were changed
HKLM\Software\Microsoft\Windows\CurrentUser\Run\winshost.exe added
system32\config\software.log modified
system32\wiwshost.exe created
At this point explorer crashed and drwatson ran... The logs became so full that I couldn't follow it anymore.

I had my subnet changed (in case it did any scanning/passing by looking at the current subnet range).. but I didn't see any network traffic..

Peace,
HT