Gen.Variant.Symmi.41732_744dc36fce – Adaware

Dynamic Analysis

Payload

No specific payload has been found.

Process activity

The Trojan creates the following process(es):

%original file name%.exe:3404

The Trojan injects its code into the following process(es):

AppModelService.exe:3500
notepad.exe:3392

Mutexes

The following mutexes were created/opened:No objects were found.

File activity

The process %original file name%.exe:3404 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Roaming\AppModelService.exe (742 bytes)

Registry activity

The process AppModelService.exe:3500 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"AppModelService.exe" = "Type: REG_SZ, Length: 0"

The process %original file name%.exe:3404 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"
"UNCAsIntranet" = "0"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"AppModelService.exe" = "Type: REG_SZ, Length: 0"

The Trojan deletes the following value(s) in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"
"IntranetName"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

Dropped PE files

There are no dropped PE files.

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

Removals

Remove it with Ad-Aware

Click (here) to download and install Ad-Aware Free Antivirus.
Update the definition files.
Run a full scan of your computer.

Manual removal*

Terminate malicious process(es) (How to End a Process With the Task Manager):
%original file name%.exe:3404
Delete the original Trojan file.
Delete or disinfect the following files created/modified by the Trojan:
C:\Users\"%CurrentUserName%"\AppData\Roaming\AppModelService.exe (742 bytes)
Delete the following value(s) in the autorun key (How to Work with System Registry):
[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"AppModelService.exe" = "Type: REG_SZ, Length: 0"
Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
Reboot the computer.

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

VersionInfo

No information is available.

PE Sections

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Section MD5
UPX0	4096	311296	0	0	d41d8cd98f00b204e9800998ecf8427e
UPX1	315392	368640	367616	5.43995	9737472d12a1d6eeaba96a925a964d8f
.rsrc	684032	4096	2048	2.41589	0cf24c7550e05115dd852616c2eb6d01

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Total found: 12
14b7270426722a5ee8c3caaed10f7279
891b0cf3cd08d0f1f120825215858593
fd666eaadc94246a506a16deb66ddc8e
f0e6212ad84487e23b96f0fc6237b4a4
29614bca30f23abf9afca11256cd4dc6
7c1b4c32ff9082c6dab7e613aaff5130
cc1d5641e85ac8c81c712ccc80256b03
99a10aa16bb3ac6a0ca5927c43ebce26
7408ac611619e0b99946685e250c8ebb
5502dfbe1cf2bdf9810fd8154763f94d
10f049ab354b88cf5702ef6e0421136b
90d9650a193e54c99f38392ce67ba64e

Network Activity

URLs

URL	IP
dns.msftncsi.com
thebottleratmine.hldns.ru

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

Map

The Trojan connects to the servers at the folowing location(s):

Strings from Dumps

AppModelService.exe_3500:

`.rsrc

kernel32.dll

$*@@@*$@@@$ *@@* $@@($*)@-$*@@$-*@@$*-@@(*$)@-*$@@*-$@@*$-@@-* $@-$ *@* $-@$ *-@$ -*@*- $@($ *)(* $)

oleaut32.dll

EVariantBadIndexError

%s, ProgID: "%s"

ole32.dll

EInvalidOperation

EInvalidGraphicOperation

SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontSubstitutes

VBoxService.exe

SbieDll.dll

dbghelp.dll

Software\Microsoft\Windows\CurrentVersion

55274-640-2673064-23950

76487-644-3177037-23510

76487-337-8429955-22614

\\.\Syser

\\.\SyserDbgMsg

\\.\SyserBoot

\\.\SICE

\\.\NTICE

user32.dll

Software\Microsoft\Windows\CurrentVersion\Run\

10.211.55.20

notepad.exe

1.0.4

PSAPI.dll

C:\Users\gurkanarkas\Desktop\Dtback\AlienEdition\Server\SuperObject.pas

SOFTWARE\Mozilla\Mozilla Firefox

SOFTWARE\Wow6432Node\Mozilla\Mozilla Firefox

SOFTWARE\Mozilla\Mozilla Firefox\

SOFTWARE\Wow6432Node\Mozilla\Mozilla Firefox\

nss3.dll

PK11_GetInternalKeySlot

mozglue.dll

msvcr120.dll

msvcp120.dll

\Mozilla\Firefox\profiles.ini

\Mozilla\Firefox\

logins.json

Mozilla Firefox

logins[

].hostname

].encryptedUsername

].encryptedPassword

BuildImportTable: can't load library:

BuildImportTable: ReallocMemory failed

BuildImportTable: GetProcAddress failed

BTMemoryLoadLibary: BuildImportTable failed

BTMemoryGetProcAddress: no export table found

BTMemoryGetProcAddress: DLL doesn't export anything

BTMemoryGetProcAddress: exported symbol not found

sqlite3_open

sqlite3_close

sqlite3_exec

sqlite3_version

sqlite3_errmsg

sqlite3_errcode

sqlite3_free

sqlite3_get_table

sqlite3_free_table

sqlite3_complete

sqlite3_last_insert_rowid

sqlite3_interrupt

sqlite3_busy_Handler

sqlite3_busy_timeout

sqlite3_changes

sqlite3_total_changes

sqlite3_prepare

sqlite3_prepare_v2

sqlite3_column_count

sqlite3_column_name

sqlite3_column_decltype

sqlite3_step

sqlite3_data_count

sqlite3_column_blob

sqlite3_column_bytes

sqlite3_column_double

sqlite3_column_Int

sqlite3_column_text

sqlite3_column_type

sqlite3_column_int64

sqlite3_finalize

sqlite3_reset

sqlite3_bind_blob

sqlite3_bind_text

sqlite3_bind_double

sqlite3_bind_int

sqlite3_bind_int64

sqlite3_bind_null

sqlite3_bind_parameter_index

sqlite3_enable_shared_cache

sqlite3_create_collation

TSQLiteDatabase8

TSQLiteTable

Error executing SQL

Could not prepare SQL statement

Error executing SQL statement

SELECT * FROM logins

password_value

origin_url

\Scream.dll

WbemScripting.SWbemLocator

%s\%s

SELECT * FROM %s

displayName %s

HKEY_CLASSES_ROOT

HKEY_CURRENT_CONFIG

HKEY_CURRENT_USER

HKEY_LOCAL_MACHINE

HKEY_USERS

Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook

Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\

IMAP Password

POP3 Password

SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\

127.0.0.1

iphlpapi.dll

AllocateAndGetTcpExTableFromStack

AllocateAndGetUdpExTableFromStack

SetTcpEntry

GetExtendedTcpTable

GetExtendedUdpTable

\print.txt

Skype.exe

main.db

\Yandex\YandexBrowser\User Data\Default\Login Data

\Comodo\Dragon\User Data\Default\Login Data

\Google\Chrome\User Data\Default\Login Data

Google Chrome

TUnicodeKeyboard

Klog.dat

\Klog.dat

cmd.exe

SAPI.SpVoice

Windows 2000

Windows XP

Windows Server 2003

Windows Server 2003 R2

Windows Vista

Windows Server 2008

Windows Server 2008 R2

Windows 7

Windows 8

Windows Server 2012

Windows 8.1

Windows Server 2012 R2

Windows 10

Windows Server 2016 Technical Preview

%s|%s@%s|%s|%s|%s|%s|%s|%s|%s|%s|%s|

Can't get the Windows version

9.VNf

I.PXQP

.EF$q

XaP.uFP4

%xTPO

AURl

LP%CT

Dg_SYÃ’R^

W(.KgSi

7,%X\:p

.AbF P

.yBBo

ÃžAI

!"#$%&'()* ,-./

SQLite forma

CHECKEYCO

3.5.9{

ED/MSVCRTgr

685477580

lFk .AGc5N

!*&6.qos]

zcÃ

KERNEL32.DLL

Sqlite3.dll

sqlite3_aggregate_context

sqlite3_aggregate_count

sqlite3_auto_extension

sqlite3_bind_parameter_count

sqlite3_bind_parameter_name

sqlite3_bind_text16

sqlite3_bind_value

sqlite3_bind_zeroblob

sqlite3_blob_bytes

sqlite3_blob_close

sqlite3_blob_open

sqlite3_blob_read

sqlite3_blob_write

sqlite3_busy_handler

sqlite3_clear_bindings

sqlite3_collation_needed

sqlite3_collation_needed16

sqlite3_column_bytes16

sqlite3_column_decltype16

sqlite3_column_int

sqlite3_column_name16

sqlite3_column_text16

sqlite3_column_value

sqlite3_commit_hook

sqlite3_complete16

sqlite3_context_db_handle

sqlite3_create_collation16

sqlite3_create_collation_v2

sqlite3_create_function

sqlite3_create_function16

sqlite3_create_module

sqlite3_create_module_v2

sqlite3_db_handle

sqlite3_declare_vtab

sqlite3_enable_load_extension

sqlite3_errmsg16

sqlite3_expired

sqlite3_extended_result_codes

sqlite3_file_control

sqlite3_get_autocommit

sqlite3_get_auxdata

sqlite3_global_recover

sqlite3_libversion

sqlite3_libversion_number

sqlite3_limit

sqlite3_load_extension

sqlite3_malloc

sqlite3_memory_alarm

sqlite3_memory_highwater

sqlite3_memory_used

sqlite3_mprintf

sqlite3_mutex_alloc

sqlite3_mutex_enter

sqlite3_mutex_free

sqlite3_mutex_held

sqlite3_mutex_leave

sqlite3_mutex_notheld

sqlite3_mutex_try

sqlite3_open16

sqlite3_open_v2

sqlite3_overload_function

sqlite3_prepare16

sqlite3_prepare16_v2

sqlite3_profile

sqlite3_progress_handler

sqlite3_randomness

sqlite3_realloc

sqlite3_release_memory

sqlite3_reset_auto_extension

sqlite3_result_blob

sqlite3_result_double

sqlite3_result_error

sqlite3_result_error16

sqlite3_result_error_code

sqlite3_result_error_nomem

sqlite3_result_error_toobig

sqlite3_result_int

sqlite3_result_int64

sqlite3_result_null

sqlite3_result_text

sqlite3_result_text16

sqlite3_result_text16be

sqlite3_result_text16le

sqlite3_result_value

sqlite3_result_zeroblob

sqlite3_rollback_hook

sqlite3_set_authorizer

sqlite3_set_auxdata

sqlite3_sleep

sqlite3_snprintf

sqlite3_soft_heap_limit

sqlite3_sql

sqlite3_test_control

sqlite3_thread_cleanup

sqlite3_threadsafe

sqlite3_trace

sqlite3_transfer_bindings

sqlite3_update_hook

sqlite3_user_data

sqlite3_value_blob

sqlite3_value_bytes

sqlite3_value_bytes16

sqlite3_value_double

sqlite3_value_int

sqlite3_value_int64

sqlite3_value_numeric_type

sqlite3_value_text

sqlite3_value_text16

sqlite3_value_text16be

sqlite3_value_text16le

sqlite3_value_type

sqlite3_vfs_find

sqlite3_vfs_register

sqlite3_vfs_unregister

sqlite3_vmprintf

C:\Users\"%CurrentUserName%"\AppData\Roaming\AppModelService.exe

)ju2,iu2.iu

KWindows

yuActivePorts

FF_Passwords

UrlMon

UnitKeyboardStarter

UnitScriptExecuter

Usndkey32

GOutlookPasswords

UnitDownloadExec

UnitChrome

SQLiteTable3

SQLite3Dynamic

SQLite3DLL

AppModelService.exeP

AppModelService.exe

thebottleratmine.hldns.ru#P

WinExec

SetNamedPipeHandleState

GetProcessHeap

GetCPInfo

CreatePipe

RegQueryInfoKeyA

RegOpenKeyExW

RegOpenKeyExA

RegOpenKeyW

RegOpenKeyA

RegFlushKey

RegEnumKeyExW

RegEnumKeyExA

RegDeleteKeyA

RegCreateKeyExA

RegCreateKeyA

RegCloseKey

ShellExecuteA

SHFileOperationA

keybd_event

VkKeyScanA

SetKeyboardState

MsgWaitForMultipleObjectsEx

MsgWaitForMultipleObjects

MapVirtualKeyExA

MapVirtualKeyA

GetKeyboardState

GetKeyboardLayout

GetKeyState

GetKeyNameTextA

GetAsyncKeyState

ExitWindowsEx

EnumWindows

GetKeyboardType

InternetOpenUrlA

.text

`.itext

`.data

.idata

.rdata

@.reloc

B.rsrc

1W8p6Ãœ/

Q `.ij

advapi32.dll

crypt32.dll

gdi32.dll

mpr.dll

msacm32.dll

msvcrt.dll

NetAPI32.dll

ntdll.dll

powrprof.dll

shell32.dll

shfolder.dll

wininet.dll

winmm.dll

wsock32.dll

logins

software\microsoft\windows\currentversion\uninstall\

66006666

Bitmaps Clipboard does not support Icons&Cannot change the size of a JPEG image

JPEG error #%d

Invalid stream operation

Failed to get data for '%s'

%s.Seek not implemented$Operation not allowed on sorted list

Thread creation error: %s

Thread Error: %s (%d)

Unsupported clipboard format

.Method '%s' not supported by automation object/Variant does not reference an automation object7Dispatch methods do not support more than 64 parameters

Cannot assign a %s to a %sECheckSynchronize called from thread $%x, which is NOT the main thread%List does not allow duplicates ($0%x)%String list does not allow duplicates

Cannot create file "%s". %s

Cannot open file "%s". %s

Invalid data type for '%s' List capacity out of bounds (%d)

List count out of bounds (%d)

List index out of bounds (%d) Out of memory while expanding memory stream

External exception %x

Interface not supported

%s (%s, line %d)

Abstract Error?Access violation at address %p in module '%s'. %s of address %p

System Error. Code: %d.

"Variant method calls not supported

Invalid variant operation%Invalid variant operation (%s%.8x)

%s5Could not convert variant of type (%s) into type (%s)=Overflow while converting variant of type (%s) into type (%s)

Operation not supported

Invalid floating point operation

Invalid pointer operation

Invalid class typecast0Access violation at address %p. %s of address %p

Operation aborted(Exception %s in module %s at %p.

Application Error1Format '%s' invalid or incompatible with argument

No argument for format '%s'!'%s' is not a valid integer value('%s' is not a valid floating point value

I/O error %d

AppModelService.exe_3500_rwx_00401000_000A5000:

kernel32.dll

$*@@@*$@@@$ *@@* $@@($*)@-$*@@$-*@@$*-@@(*$)@-*$@@*-$@@*$-@@-* $@-$ *@* $-@$ *-@$ -*@*- $@($ *)(* $)

oleaut32.dll

EVariantBadIndexError

%s, ProgID: "%s"

ole32.dll

EInvalidOperation

EInvalidGraphicOperation

SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontSubstitutes

VBoxService.exe

SbieDll.dll

dbghelp.dll

Software\Microsoft\Windows\CurrentVersion

55274-640-2673064-23950

76487-644-3177037-23510

76487-337-8429955-22614

\\.\Syser

\\.\SyserDbgMsg

\\.\SyserBoot

\\.\SICE

\\.\NTICE

user32.dll

Software\Microsoft\Windows\CurrentVersion\Run\

10.211.55.20

notepad.exe

1.0.4

PSAPI.dll

C:\Users\gurkanarkas\Desktop\Dtback\AlienEdition\Server\SuperObject.pas

SOFTWARE\Mozilla\Mozilla Firefox

SOFTWARE\Wow6432Node\Mozilla\Mozilla Firefox

SOFTWARE\Mozilla\Mozilla Firefox\

SOFTWARE\Wow6432Node\Mozilla\Mozilla Firefox\

nss3.dll

PK11_GetInternalKeySlot

mozglue.dll

msvcr120.dll

msvcp120.dll

\Mozilla\Firefox\profiles.ini

\Mozilla\Firefox\

logins.json

Mozilla Firefox

logins[

].hostname

].encryptedUsername

].encryptedPassword

BuildImportTable: can't load library:

BuildImportTable: ReallocMemory failed

BuildImportTable: GetProcAddress failed

BTMemoryLoadLibary: BuildImportTable failed

BTMemoryGetProcAddress: no export table found

BTMemoryGetProcAddress: DLL doesn't export anything

BTMemoryGetProcAddress: exported symbol not found

sqlite3_open

sqlite3_close

sqlite3_exec

sqlite3_version

sqlite3_errmsg

sqlite3_errcode

sqlite3_free

sqlite3_get_table

sqlite3_free_table

sqlite3_complete

sqlite3_last_insert_rowid

sqlite3_interrupt

sqlite3_busy_Handler

sqlite3_busy_timeout

sqlite3_changes

sqlite3_total_changes

sqlite3_prepare

sqlite3_prepare_v2

sqlite3_column_count

sqlite3_column_name

sqlite3_column_decltype

sqlite3_step

sqlite3_data_count

sqlite3_column_blob

sqlite3_column_bytes

sqlite3_column_double

sqlite3_column_Int

sqlite3_column_text

sqlite3_column_type

sqlite3_column_int64

sqlite3_finalize

sqlite3_reset

sqlite3_bind_blob

sqlite3_bind_text

sqlite3_bind_double

sqlite3_bind_int

sqlite3_bind_int64

sqlite3_bind_null

sqlite3_bind_parameter_index

sqlite3_enable_shared_cache

sqlite3_create_collation

TSQLiteDatabase8

TSQLiteTable

Error executing SQL

Could not prepare SQL statement

Error executing SQL statement

SELECT * FROM logins

password_value

origin_url

\Scream.dll

WbemScripting.SWbemLocator

%s\%s

SELECT * FROM %s

displayName %s

HKEY_CLASSES_ROOT

HKEY_CURRENT_CONFIG

HKEY_CURRENT_USER

HKEY_LOCAL_MACHINE

HKEY_USERS

Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook

Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\

IMAP Password

POP3 Password

SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\

127.0.0.1

iphlpapi.dll

AllocateAndGetTcpExTableFromStack

AllocateAndGetUdpExTableFromStack

SetTcpEntry

GetExtendedTcpTable

GetExtendedUdpTable

\print.txt

Skype.exe

main.db

\Yandex\YandexBrowser\User Data\Default\Login Data

\Comodo\Dragon\User Data\Default\Login Data

\Google\Chrome\User Data\Default\Login Data

Google Chrome

TUnicodeKeyboard

Klog.dat

\Klog.dat

cmd.exe

SAPI.SpVoice

Windows 2000

Windows XP

Windows Server 2003

Windows Server 2003 R2

Windows Vista

Windows Server 2008

Windows Server 2008 R2

Windows 7

Windows 8

Windows Server 2012

Windows 8.1

Windows Server 2012 R2

Windows 10

Windows Server 2016 Technical Preview

%s|%s@%s|%s|%s|%s|%s|%s|%s|%s|%s|%s|

Can't get the Windows version

9.VNf

I.PXQP

.EF$q

XaP.uFP4

%xTPO

AURl

LP%CT

Dg_SYÃ’R^

W(.KgSi

7,%X\:p

.AbF P

.yBBo

ÃžAI

!"#$%&'()* ,-./

SQLite forma

CHECKEYCO

3.5.9{

ED/MSVCRTgr

685477580

lFk .AGc5N

!*&6.qos]

zcÃ

KERNEL32.DLL

Sqlite3.dll

sqlite3_aggregate_context

sqlite3_aggregate_count

sqlite3_auto_extension

sqlite3_bind_parameter_count

sqlite3_bind_parameter_name

sqlite3_bind_text16

sqlite3_bind_value

sqlite3_bind_zeroblob

sqlite3_blob_bytes

sqlite3_blob_close

sqlite3_blob_open

sqlite3_blob_read

sqlite3_blob_write

sqlite3_busy_handler

sqlite3_clear_bindings

sqlite3_collation_needed

sqlite3_collation_needed16

sqlite3_column_bytes16

sqlite3_column_decltype16

sqlite3_column_int

sqlite3_column_name16

sqlite3_column_text16

sqlite3_column_value

sqlite3_commit_hook

sqlite3_complete16

sqlite3_context_db_handle

sqlite3_create_collation16

sqlite3_create_collation_v2

sqlite3_create_function

sqlite3_create_function16

sqlite3_create_module

sqlite3_create_module_v2

sqlite3_db_handle

sqlite3_declare_vtab

sqlite3_enable_load_extension

sqlite3_errmsg16

sqlite3_expired

sqlite3_extended_result_codes

sqlite3_file_control

sqlite3_get_autocommit

sqlite3_get_auxdata

sqlite3_global_recover

sqlite3_libversion

sqlite3_libversion_number

sqlite3_limit

sqlite3_load_extension

sqlite3_malloc

sqlite3_memory_alarm

sqlite3_memory_highwater

sqlite3_memory_used

sqlite3_mprintf

sqlite3_mutex_alloc

sqlite3_mutex_enter

sqlite3_mutex_free

sqlite3_mutex_held

sqlite3_mutex_leave

sqlite3_mutex_notheld

sqlite3_mutex_try

sqlite3_open16

sqlite3_open_v2

sqlite3_overload_function

sqlite3_prepare16

sqlite3_prepare16_v2

sqlite3_profile

sqlite3_progress_handler

sqlite3_randomness

sqlite3_realloc

sqlite3_release_memory

sqlite3_reset_auto_extension

sqlite3_result_blob

sqlite3_result_double

sqlite3_result_error

sqlite3_result_error16

sqlite3_result_error_code

sqlite3_result_error_nomem

sqlite3_result_error_toobig

sqlite3_result_int

sqlite3_result_int64

sqlite3_result_null

sqlite3_result_text

sqlite3_result_text16

sqlite3_result_text16be

sqlite3_result_text16le

sqlite3_result_value

sqlite3_result_zeroblob

sqlite3_rollback_hook

sqlite3_set_authorizer

sqlite3_set_auxdata

sqlite3_sleep

sqlite3_snprintf

sqlite3_soft_heap_limit

sqlite3_sql

sqlite3_test_control

sqlite3_thread_cleanup

sqlite3_threadsafe

sqlite3_trace

sqlite3_transfer_bindings

sqlite3_update_hook

sqlite3_user_data

sqlite3_value_blob

sqlite3_value_bytes

sqlite3_value_bytes16

sqlite3_value_double

sqlite3_value_int

sqlite3_value_int64

sqlite3_value_numeric_type

sqlite3_value_text

sqlite3_value_text16

sqlite3_value_text16be

sqlite3_value_text16le

sqlite3_value_type

sqlite3_vfs_find

sqlite3_vfs_register

sqlite3_vfs_unregister

sqlite3_vmprintf

C:\Users\"%CurrentUserName%"\AppData\Roaming\AppModelService.exe

)ju2,iu2.iu

KWindows

yuActivePorts

FF_Passwords

UrlMon

UnitKeyboardStarter

UnitScriptExecuter

Usndkey32

GOutlookPasswords

UnitDownloadExec

UnitChrome

SQLiteTable3

SQLite3Dynamic

SQLite3DLL

AppModelService.exeP

AppModelService.exe

thebottleratmine.hldns.ru#P

WinExec

SetNamedPipeHandleState

GetProcessHeap

GetCPInfo

CreatePipe

RegQueryInfoKeyA

RegOpenKeyExW

RegOpenKeyExA

RegOpenKeyW

RegOpenKeyA

RegFlushKey

RegEnumKeyExW

RegEnumKeyExA

RegDeleteKeyA

RegCreateKeyExA

RegCreateKeyA

RegCloseKey

ShellExecuteA

SHFileOperationA

keybd_event

VkKeyScanA

SetKeyboardState

MsgWaitForMultipleObjectsEx

MsgWaitForMultipleObjects

MapVirtualKeyExA

MapVirtualKeyA

GetKeyboardState

GetKeyboardLayout

GetKeyState

GetKeyNameTextA

GetAsyncKeyState

ExitWindowsEx

EnumWindows

GetKeyboardType

InternetOpenUrlA

.text

`.itext

`.data

.idata

.rdata

@.reloc

B.rsrc

logins

software\microsoft\windows\currentversion\uninstall\

66006666

Bitmaps Clipboard does not support Icons&Cannot change the size of a JPEG image

JPEG error #%d

Invalid stream operation

Failed to get data for '%s'

%s.Seek not implemented$Operation not allowed on sorted list

Thread creation error: %s

Thread Error: %s (%d)

Unsupported clipboard format

.Method '%s' not supported by automation object/Variant does not reference an automation object7Dispatch methods do not support more than 64 parameters

Cannot assign a %s to a %sECheckSynchronize called from thread $%x, which is NOT the main thread%List does not allow duplicates ($0%x)%String list does not allow duplicates

Cannot create file "%s". %s

Cannot open file "%s". %s

Invalid data type for '%s' List capacity out of bounds (%d)

List count out of bounds (%d)

List index out of bounds (%d) Out of memory while expanding memory stream

External exception %x

Interface not supported

%s (%s, line %d)

Abstract Error?Access violation at address %p in module '%s'. %s of address %p

System Error. Code: %d.

"Variant method calls not supported

Invalid variant operation%Invalid variant operation (%s%.8x)

%s5Could not convert variant of type (%s) into type (%s)=Overflow while converting variant of type (%s) into type (%s)

Operation not supported

Invalid floating point operation

Invalid pointer operation

Invalid class typecast0Access violation at address %p. %s of address %p

Operation aborted(Exception %s in module %s at %p.

Application Error1Format '%s' invalid or incompatible with argument

No argument for format '%s'!'%s' is not a valid integer value('%s' is not a valid floating point value

I/O error %d

notepad.exe_3392:

.text

`.data

.rsrc

@.reloc

ADVAPI32.dll

KERNEL32.dll

NTDLL.DLL

GDI32.dll

USER32.dll

msvcrt.dll

COMDLG32.dll

SHELL32.dll

WINSPOOL.DRV

ole32.dll

SHLWAPI.dll

COMCTL32.dll

OLEAUT32.dll

VERSION.dll

ntdll.dll

RegCloseKey

RegCreateKeyW

RegOpenKeyExW

GetProcessHeap

SetViewportExtEx

GetKeyboardLayout

_amsg_exit

_acmdln

ShellExecuteExW

notepad.pdb

name="Microsoft.Windows.Shell.notepad"

version="5.1.0.0"

Windows Shell

name="Microsoft.Windows.Common-Controls"

version="6.0.0.0"

publicKeyToken="6595b64144ccf1df"

true

===111*!

'141133!/!(!(!""/""

;;;;4;3423332

keYM

,k<.kq>

.WF"hB

dx.Rl

V.xOx_T

/.SETUP

%s%c*.txt%c%s%c*.*%c

*.txt

mshelp://windows/?id=5d18d5fb-e737-4a73-b6cc-dccc63720231

\StringFileInfo\xx\OriginalFilename

\sppsvc.exe

\slui.exe

\sppuinotify.dll

Text Documents (*.txt)

6.1.7600.16385 (win7_rtm.090713-1255)

NOTEPAD.EXE

Windows

Operating System

6.1.7600.16385

notepad.exe_3392_rwx_00060000_00001000:

kernel32.dll

notepad.exe_3392_rwx_00070000_00001000:

user32.dll

notepad.exe_3392_rwx_00160000_00001000:

C:\Users\"%CurrentUserName%"\AppData\Roaming\AppModelService.exe

Summary

Dynamic Analysis

Removals

Static Analysis

Network Activity

Map

Strings from Dumps

Related articles