Trojan.Win32.Cosmu.dhrw (Kaspersky), Dropped:Generic.Malware.SFYBdg.6140F5F2 (B) (Emsisoft), Dropped:Generic.Malware.SFYBdg.6140F5F2 (AdAware), Trojan.Win32.IEDummy.FD, GenericInjector.YR (Lavasoft MAS)Behaviour: Trojan, Malware
The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.
Summary
MD5: a2e04faa2ab56f806c2dc7255d2c9b6d
SHA1: 45aefe4d633033cf35542807533bca95aa829362
SHA256: 495077bbd41bb7e1ee0b08389c355300b480cb8bbcf5c44c7550ce374155823f
SSDeep: 3072:vxAHNZL/I /9yajam oz4cDh4 O1qAFLRgTJWqS:JkPLAmDjlvEoAFLRW4
Size: 1130496 bytes
File type: EXE
Platform: WIN32
Entropy: Not Packed
PEID: UPolyXv05_v6
Company: no certificate found
Created at: 2010-04-05 17:48:51
Analyzed on: WindowsXP SP3 32-bit
Summary: Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).
Dynamic Analysis
Payload
No specific payload has been found.
Process activity
The Dropped creates the following process(es):
%original file name%.exe:852
The Dropped injects its code into the following process(es):No processes have been created.
Mutexes
The following mutexes were created/opened:
c:!documents and settings!adm!cookies!_!MSFTHISTORY!_c:!documents and settings!adm!local settings!temporary internet files!content.ie5!WininetStartupMutexc:!documents and settings!adm!local settings!history!history.ie5!WininetProxyRegistryMutexWininetConnectionMutexRasPbFileShimCacheMutex48C56927-A0DB-4e31-8C32-FE15FBA45043
File activity
The process %original file name%.exe:852 makes changes in the file system.
The Dropped creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\5b0420fb-f88b-4b88-aa34-0015c7d55007 (4 bytes)
%System%\inforasip.ocx (4 bytes)
%System%\srvsvcinfo.exe (327681 bytes)
%System%\pdbpoolfwc.exe (327681 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ee0c9b8c-9d6b-4e8c-9e74-98e962b397b7 (42 bytes)
%System%\svcctfdisp.exe (327681 bytes)
%System%\poolipdhcp.exe (327681 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\de64b09e-733d-4087-90e9-983e892b9682 (4 bytes)
Registry activity
The process %original file name%.exe:852 makes changes in the system registry.
The Dropped creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\{22d7f312-b0f6-11d2-94ab-0080c33c7e95}]
"IconsBinary" = "%System%\svcctfdisp.exe"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\82.146.51.22]
"*" = "2"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
[HKCR\CLSID\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}\VersionIndependentProgID]
"(Default)" = "AcroIEHelperShim.AcroIEHelperShimObj"
[HKCU\Software\Microsoft\Windows NT\CurrentVersion]
"SerialIID" = "CC FE 34 01 63 8E 34 12 08 21 02 2A 5D 9D 1F F5"
[HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\{22d7f312-b0f6-11d2-94ab-0080c33c7e95}]
"StubPath" = "rundll32.exe %System%\themeuichk.dll,ThemesSetupInstallCheck"
[HKCU\Control Panel\Desktop]
"ForegroundLockTimeout" = "20250408"
[HKCU\Software\Microsoft\Internet Explorer\Main]
"Check_Associations" = "no"
[HKCR\CLSID\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
"(Default)" = "Adobe PDF Link Helper"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"
[HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\{22d7f312-b0f6-11d2-94ab-0080c33c7e95}]
"ComponentID" = "DOTNETFRAMEWORKS"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"
[HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\{22d7f312-b0f6-11d2-94ab-0080c33c7e95}]
"IsInstalled" = "1"
[HKCR\CLSID\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
[HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\{22d7f312-b0f6-11d2-94ab-0080c33c7e95}]
"DontAsk" = "2"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"
[HKLM\SOFTWARE\Adobe\CommonFiles]
"IconsStorage0" = "%System%\poolipdhcp.exe"
[HKCR\CLSID\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}\ProgID]
"(Default)" = "AcroIEHelperShim.AcroIEHelperShimObj.1"
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "ED AD 04 64 EA 8B C6 9B 6F C4 41 1C C6 21 1F 0A"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"
[HKU\.DEFAULT\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
"ParseAutoexec" = "1"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"
[HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\{22d7f312-b0f6-11d2-94ab-0080c33c7e95}]
"(Default)" = "Themes Setup"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"
[HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\{22d7f312-b0f6-11d2-94ab-0080c33c7e95}]
"Version" = "1,1,1,2"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run]
"recovery" = "%System%\pdbpoolfwc.exe"
[HKCR\CLSID\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}\InprocServer32]
"(Default)" = "%System%\inforasip.ocx"
To automatically run itself each time Windows is booted, the Dropped adds the following link to its file to the system registry autorun key:
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"recovery" = "%System%\pdbpoolfwc.exe"
It registers itself as a Browser Helper Object (BHO) to ensure its automatic execution every time Internet Explorer is run. It does this by creating the following registry key(s)/entry(ies):
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
"(Default)" = "AcroIEHelperStub"
"NoExplorer" = "1"
Dropped PE files
MD5 | File path |
---|---|
97c92f4457dd94d678d4c9e4bdd8352f | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\advsec32.dll |
0295fb28f715a19e2b0c497b5dd55629 | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\ctfdispvdm.dll |
97c92f4457dd94d678d4c9e4bdd8352f | c:\WINDOWS\system32\inforasip.ocx |
e3bca97b0bcdbdb91d3d80c5dc343080 | c:\WINDOWS\system32\pdbpoolfwc.exe |
264d6333854b78fd6884e331be789cec | c:\WINDOWS\system32\poolipdhcp.exe |
609ad64af04f9dc3b500132332de5bca | c:\WINDOWS\system32\srvsvcinfo.exe |
1308522ca93d07acf87727f9330188f9 | c:\WINDOWS\system32\svcctfdisp.exe |
50cd611f2eb788b26e0ad6afb1328331 | c:\WINDOWS\system32\themeuichk.dll |
HOSTS file anomalies
No changes have been detected.
Rootkit activity
No anomalies have been detected.
Propagation
Removals
Remove it with Ad-Aware
- Click (here) to download and install Ad-Aware Free Antivirus.
- Update the definition files.
- Run a full scan of your computer.
Manual removal*
- Terminate malicious process(es) (How to End a Process With the Task Manager):
%original file name%.exe:852
- Delete the original Dropped file.
- Delete or disinfect the following files created/modified by the Dropped:
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\5b0420fb-f88b-4b88-aa34-0015c7d55007 (4 bytes)
%System%\inforasip.ocx (4 bytes)
%System%\srvsvcinfo.exe (327681 bytes)
%System%\pdbpoolfwc.exe (327681 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ee0c9b8c-9d6b-4e8c-9e74-98e962b397b7 (42 bytes)
%System%\svcctfdisp.exe (327681 bytes)
%System%\poolipdhcp.exe (327681 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\de64b09e-733d-4087-90e9-983e892b9682 (4 bytes) - Delete the following value(s) in the autorun key (How to Work with System Registry):
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"recovery" = "%System%\pdbpoolfwc.exe"
Static Analysis
VersionInfo
Company Name: Intel NGO
Product Name: NGO
Product Version: 6, 5, 0, 0
Legal Copyright: Copyright (C) 2007
Legal Trademarks: Intel Corp.
Original Filename: NGO
Internal Name: Intel NGO
File Version: 6, 5, 1, 1
File Description: Intel Motherboard Service
Comments:
Language: English (United States)
Company Name: Intel NGOProduct Name: NGOProduct Version: 6, 5, 0, 0Legal Copyright: Copyright (C) 2007Legal Trademarks: Intel Corp.Original Filename: NGOInternal Name: Intel NGOFile Version: 6, 5, 1, 1File Description: Intel Motherboard ServiceComments: Language: English (United States)
PE Sections
Name | Virtual Address | Virtual Size | Raw Size | Entropy | Section MD5 |
---|---|---|---|---|---|
.text | 4096 | 101304 | 102400 | 4.62199 | 4146e9e115d66c0f5010428c8d302703 |
.rdata | 106496 | 27986 | 28672 | 3.28394 | b45eafb3a9a3738f0028f8822b50cdee |
.data | 135168 | 68836 | 45056 | 4.79578 | 1349fc1499e17b72c38084ff125d843f |
.rsrc | 204800 | 856 | 4096 | 0.616061 | d11836e51194f444ded1c05b44489c74 |
Dropped from:
Downloaded by:
Similar by SSDeep:
Similar by Lavasoft Polymorphic Checker:
Network Activity
URLs
IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)
Traffic
Map
The Dropped connects to the servers at the folowing location(s):
Strings from Dumps
%original file name%.exe_852:
.text
.text
`.rdata
`.rdata
@.data
@.data
.rsrc
.rsrc
PSSSSSSh
PSSSSSSh
PSSSSSSh#
PSSSSSSh#
PSSSSSSh"
PSSSSSSh"
SSj%S
SSj%S
n%D,3
n%D,3
deflate 1.1.4 Copyright 1995-2002 Jean-loup Gailly
deflate 1.1.4 Copyright 1995-2002 Jean-loup Gailly
inflate 1.1.4 Copyright 1995-2002 Mark Adler
inflate 1.1.4 Copyright 1995-2002 Mark Adler
.mixcrt
.mixcrt
KERNEL32.DLL
KERNEL32.DLL
mscoree.dll
mscoree.dll
Please contact the application's support team for more information.
Please contact the application's support team for more information.
- Attempt to initialize the CRT more than once.
- Attempt to initialize the CRT more than once.
- CRT not initialized
- CRT not initialized
- floating point support not loaded
- floating point support not loaded
kernel32.dll
kernel32.dll
operator
operator
GetProcessWindowStation
GetProcessWindowStation
USER32.DLL
USER32.DLL
?456789:;
?456789:;
!"#$%&'()* ,-./0123
!"#$%&'()* ,-./0123
abe2869f-9b47-4cd9-a358-c22904dba7f7
abe2869f-9b47-4cd9-a358-c22904dba7f7
82BD0E67-9FEA-4748-8672-D5EFE5B779B0
82BD0E67-9FEA-4748-8672-D5EFE5B779B0
d:\src\abordaje\bin\Release\Bot.pdb
d:\src\abordaje\bin\Release\Bot.pdb
ADVAPI32.dll
ADVAPI32.dll
CRYPT32.dll
CRYPT32.dll
ole32.dll
ole32.dll
OLEAUT32.dll
OLEAUT32.dll
RPCRT4.dll
RPCRT4.dll
Secur32.dll
Secur32.dll
SHELL32.dll
SHELL32.dll
USER32.dll
USER32.dll
WININET.dll
WININET.dll
WS2_32.dll
WS2_32.dll
WTSAPI32.dll
WTSAPI32.dll
CreatePipe
CreatePipe
PeekNamedPipe
PeekNamedPipe
GetWindowsDirectoryW
GetWindowsDirectoryW
GetCPInfo
GetCPInfo
GetProcessHeap
GetProcessHeap
RegDeleteKeyW
RegDeleteKeyW
RegQueryInfoKeyW
RegQueryInfoKeyW
RegCloseKey
RegCloseKey
RegOpenKeyW
RegOpenKeyW
RegCreateKeyExW
RegCreateKeyExW
RegEnumKeyExW
RegEnumKeyExW
RegEnumKeyW
RegEnumKeyW
RegOpenKeyExW
RegOpenKeyExW
RegSetKeySecurity
RegSetKeySecurity
PFXExportCertStoreEx
PFXExportCertStoreEx
CertCloseStore
CertCloseStore
CertOpenStore
CertOpenStore
GetKeyboardLayoutNameW
GetKeyboardLayoutNameW
1.1.4
1.1.4
,q%fR
,q%fR
L8.CM
L8.CM
hXXp://82.146.51.22/joomla/modules/xsnt-direct.php
hXXp://82.146.51.22/joomla/modules/xsnt-direct.php
82.146.51.22
82.146.51.22
HTTP/1.1
HTTP/1.1
User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-GB; rv:1.9.0.9) Gecko/2009042113 Ubuntu/9.04 (jaunty) Firefox/3.0.9
User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-GB; rv:1.9.0.9) Gecko/2009042113 Ubuntu/9.04 (jaunty) Firefox/3.0.9
Content-Type: application/x-www-form-urlencoded
Content-Type: application/x-www-form-urlencoded
echo del %0 > "%TEMP%\msicheck.cmd"
echo del %0 > "%TEMP%\msicheck.cmd"
echo copy /y "%SYSTEMROOT%\system32\ping.exe" "%TEMP%\smss.exe" >> "%TEMP%\msicheck.cmd"
echo copy /y "%SYSTEMROOT%\system32\ping.exe" "%TEMP%\smss.exe" >> "%TEMP%\msicheck.cmd"
echo :z >> "%TEMP%\msicheck.cmd"
echo :z >> "%TEMP%\msicheck.cmd"
echo del %1 >> "%TEMP%\msicheck.cmd"
echo del %1 >> "%TEMP%\msicheck.cmd"
echo "%TEMP%\smss.exe" 127.1 -n 30 >> "%TEMP%\msicheck.cmd"
echo "%TEMP%\smss.exe" 127.1 -n 30 >> "%TEMP%\msicheck.cmd"
echo attrib -s -h %1 >> "%TEMP%\msicheck.cmd"
echo attrib -s -h %1 >> "%TEMP%\msicheck.cmd"
echo if exist %1 goto z >> "%TEMP%\msicheck.cmd"
echo if exist %1 goto z >> "%TEMP%\msicheck.cmd"
echo del "%TEMP%\msicheck.cmd" >> "%TEMP%\msicheck.cmd"
echo del "%TEMP%\msicheck.cmd" >> "%TEMP%\msicheck.cmd"
echo del "%TEMP%\smss.exe" >> "%TEMP%\msicheck.cmd"
echo del "%TEMP%\smss.exe" >> "%TEMP%\msicheck.cmd"
"%SYSTEMROOT%\system32\cmd.exe" /c "%TEMP%\msicheck.cmd"
"%SYSTEMROOT%\system32\cmd.exe" /c "%TEMP%\msicheck.cmd"
c:\%original file name%.exe
c:\%original file name%.exe
\system32\cmd.exe
\system32\cmd.exe
cmd.exe
cmd.exe
ntdll.dll
ntdll.dll
hXXp://
hXXp://
Software\Microsoft\Windows NT\CurrentVersion
Software\Microsoft\Windows NT\CurrentVersion
explorer.exe
explorer.exe
Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\
Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\
Global\48C56927-A0DB-4e31-8C32-FE15FBA45043
Global\48C56927-A0DB-4e31-8C32-FE15FBA45043
hXXp://82.146.51.22/joomla/modules/xsnt.php
hXXp://82.146.51.22/joomla/modules/xsnt.php
Software\Microsoft\Keyboard
Software\Microsoft\Keyboard
vdm.dll
vdm.dll
\twunk_16.exe
\twunk_16.exe
\debug.exe
\debug.exe
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
hXXp://VVV.facebook.com/login.php
hXXp://VVV.facebook.com/login.php
hXXps://login.facebook.com/login.php
hXXps://login.facebook.com/login.php
hXXp://VVV.facebook.com/
hXXp://VVV.facebook.com/
hXXp://VVV.facebook.com/index.php
hXXp://VVV.facebook.com/index.php
hXXp://m.facebook.com/login.php
hXXp://m.facebook.com/login.php
hXXp://m.myspace.com/login.wap
hXXp://m.myspace.com/login.wap
hXXp://VVV.myspace.com/
hXXp://VVV.myspace.com/
hXXp://VVV.myspace.com/index.cfm
hXXp://VVV.myspace.com/index.cfm
hXXp://babelfish.yahoo.com/translate_url
hXXp://babelfish.yahoo.com/translate_url
hXXp://services.msn.com/svcs/hotmail/httpmail.asp
hXXp://services.msn.com/svcs/hotmail/httpmail.asp
hXXp://google.com/
hXXp://google.com/
hXXps://VVV.google.com/analytics/reporting/login
hXXps://VVV.google.com/analytics/reporting/login
hXXps://VVV.google.com/groups/signin
hXXps://VVV.google.com/groups/signin
hXXp://translate.google.com.tr/translate
hXXp://translate.google.com.tr/translate
hXXp://translate.google.com.ua/translate
hXXp://translate.google.com.ua/translate
hXXps://VVV.google.com/accounts/ManageAccount
hXXps://VVV.google.com/accounts/ManageAccount
hXXp://VVV.google.com/
hXXp://VVV.google.com/
hXXps://VVV.google.com/accounts/Login
hXXps://VVV.google.com/accounts/Login
hXXp://mail.google.com/mail/
hXXp://mail.google.com/mail/
hXXps://VVV.google.com/accounts/ServiceLoginAuth
hXXps://VVV.google.com/accounts/ServiceLoginAuth
hXXps://VVV.google.com/accounts/ServiceLogin
hXXps://VVV.google.com/accounts/ServiceLogin
hXXp://mail.bigmir.net/
hXXp://mail.bigmir.net/
hXXp://win.mail.ru/cgi-bin/login
hXXp://win.mail.ru/cgi-bin/login
hXXp://love.mail.ru/tips/
hXXp://love.mail.ru/tips/
hXXp://my.mail.ru/cgi-bin/login
hXXp://my.mail.ru/cgi-bin/login
hXXp://love.mail.ru/my/login.phtml
hXXp://love.mail.ru/my/login.phtml
hXXp://VVV.mail.ru/
hXXp://VVV.mail.ru/
hXXp://mail.ru/
hXXp://mail.ru/
advapi32.dll
advapi32.dll
INTERNET EXPLORER 7.x-8.x HTTPPASS
INTERNET EXPLORER 7.x-8.x HTTPPASS
pstorec.dll
pstorec.dll
INTERNET EXPLORER 6.x HTTPPASS
INTERNET EXPLORER 6.x HTTPPASS
SMTP
SMTP
Password
Password
POP3 Port
POP3 Port
IMAP Port
IMAP Port
SMTP Port
SMTP Port
hXXp://82.146.51.22/joomla/modules/xbrk.php
hXXp://82.146.51.22/joomla/modules/xbrk.php
{22d7f312-b0f6-11d2-94ab-0080c33c7e95}
{22d7f312-b0f6-11d2-94ab-0080c33c7e95}
system32\themeuichk.dll
system32\themeuichk.dll
themeuichk.dll
themeuichk.dll
rundll32.exe
rundll32.exe
system32\wlrsacert.nls
system32\wlrsacert.nls
wlrsacert.nls
wlrsacert.nls
RSACertPath
RSACertPath
Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\rsacert31
Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\rsacert31
Firefox\Profiles\
Firefox\Profiles\
extensions.ini
extensions.ini
extensions.rdf
extensions.rdf
extensions.cache
extensions.cache
{8919CE9F-23FD-411a-A2D3-A91DAC20C4FA}
{8919CE9F-23FD-411a-A2D3-A91DAC20C4FA}
chrome.manifest
chrome.manifest
install.rdf
install.rdf
fsoverlay.js
fsoverlay.js
fsoverlay.xul
fsoverlay.xul
galaxy.dll
galaxy.dll
firefox-cln.exe
firefox-cln.exe
IGalaxyComponent.xpt
IGalaxyComponent.xpt
glxcodec.exe
glxcodec.exe
\Mozilla
\Mozilla
advsec32.dll
advsec32.dll
{18DF081C-E8AD-4283-A596-FA578C2EBDC3}
{18DF081C-E8AD-4283-A596-FA578C2EBDC3}
AcroIEHelperShim.AcroIEHelperShimObj.1
AcroIEHelperShim.AcroIEHelperShimObj.1
AcroIEHelperShim.AcroIEHelperShimObj
AcroIEHelperShim.AcroIEHelperShimObj
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\
Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run
Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run
SOFTWARE\Microsoft\Windows\CurrentVersion\Run
SOFTWARE\Microsoft\Windows\CurrentVersion\Run
6, 5, 1, 1
6, 5, 1, 1
6, 5, 0, 0
6, 5, 0, 0
iexplore.exe_1636:
%?9-*09,*19}*09
%?9-*09,*19}*09
.text
.text
`.data
`.data
.rsrc
.rsrc
msvcrt.dll
msvcrt.dll
KERNEL32.dll
KERNEL32.dll
NTDLL.DLL
NTDLL.DLL
USER32.dll
USER32.dll
SHLWAPI.dll
SHLWAPI.dll
SHDOCVW.dll
SHDOCVW.dll
Software\Microsoft\Windows\CurrentVersion\Explorer\BrowseNewProcess
Software\Microsoft\Windows\CurrentVersion\Explorer\BrowseNewProcess
IE-X-X
IE-X-X
rsabase.dll
rsabase.dll
System\CurrentControlSet\Control\Windows
System\CurrentControlSet\Control\Windows
dw15 -x -s %u
dw15 -x -s %u
watson.microsoft.com
watson.microsoft.com
IEWatsonURL
IEWatsonURL
%s -h %u
%s -h %u
iedw.exe
iedw.exe
Iexplore.XPExceptionFilter
Iexplore.XPExceptionFilter
jscript.DLL
jscript.DLL
mshtml.dll
mshtml.dll
mlang.dll
mlang.dll
urlmon.dll
urlmon.dll
wininet.dll
wininet.dll
shdocvw.DLL
shdocvw.DLL
browseui.DLL
browseui.DLL
comctl32.DLL
comctl32.DLL
IEXPLORE.EXE
IEXPLORE.EXE
iexplore.pdb
iexplore.pdb
ADVAPI32.dll
ADVAPI32.dll
MsgWaitForMultipleObjects
MsgWaitForMultipleObjects
IExplorer.EXE
IExplorer.EXE
IIIIIB(II<.fg>
IIIIIB(II<.fg>
7?_____ZZSSH%
7?_____ZZSSH%
)z.UUUUUUUU
)z.UUUUUUUU
,....Qym
,....Qym
````2```
````2```
{.QLQIIIKGKGKGKGKGKG
{.QLQIIIKGKGKGKGKGKG
;33;33;0
;33;33;0
8888880
8888880
8887080
8887080
browseui.dll
browseui.dll
shdocvw.dll
shdocvw.dll
6.00.2900.5512 (xpsp.080413-2105)
6.00.2900.5512 (xpsp.080413-2105)
Windows
Windows
Operating System
Operating System
6.00.2900.5512
6.00.2900.5512