NOTE.EXE – Unknown removal

NOTE.EXE size: 377422 bytes
NOTE.EXE hash: DDA5DC389CCA8AF26752E4AFC06788E1

Created files:

%SysDir%\note.exe
%Temp%\Stub Mod Wally Fud.exe

Autostart registry keys:

HKLM\Software\Microsoft\Active Setup\Installed Components\{08B0E5JF-4FCB-11CF-AAA5-00401C6XX500}\StubPath: %WinDir%\System32\note.exe Restart
HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies: 43003A005C00570049004E0044004F00570053005C00730079007300740065006D00330032005C006E006F00740065002E006500780065000000
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\HKLM: 43003A005C00570049004E0044004F00570053005C00730079007300740065006D00330032005C006E006F00740065002E006500780065000000
HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies: 43003A005C00570049004E0044004F00570053005C00730079007300740065006D00330032005C006E006F00740065002E006500780065000000
HKCU\Software\Microsoft\Windows\CurrentVersion\Run\HKCU: 43003A005C00570049004E0044004F00570053005C00730079007300740065006D00330032005C006E006F00740065002E006500780065000000

Detected by UnHackMe:

NOTE.EXE
Default location: %SYSDIR%\NOTE.EXE

Dropper information:
MD5: 226552fca38a6d44f07d6dae5e7719c7
File size: 1053198 bytes