not-a-virus:HEUR:Monitor.Win32.Ardamax.gen (Kaspersky), Gen:Variant.FAkeAlert.105 (B) (Emsisoft), Trojan.Win32.IEDummy.FD, GenericInjector.YR (Lavasoft MAS)Behaviour: Trojan, Monitor
The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.
Summary
MD5: ed9033a5ab9cd103431c5cbc1d327c3d
SHA1: 638851cb47280957eb1815f1e95c578425e47ff4
SHA256: 8075facfbb75f2e36ef08944733e54e914548f62d3903881ec4f4a38a1279e33
SSDeep: 49152:uIsr3NYGRUaht dRx7CmOZulEDPVuGXmCakEvrHCuQ3TM2VYQrd2WAdnEK9HYPH:uPuWhsP9CmEYETVTJ3ErCuQ1f0BAH
Size: 3599360 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: UPolyXv05_v6
Company: no certificate found
Created at: 2015-04-12 22:49:14
Analyzed on: WindowsXP SP3 32-bit
Summary: Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).
Dynamic Analysis
Payload
No specific payload has been found.
Process activity
The Trojan creates the following process(es):
%original file name%.exe:1932
PRo.exe:1256
LGP.exe:740
The Trojan injects its code into the following process(es):
10.0.exe:164
Mutexes
The following mutexes were created/opened:No objects were found.
File activity
The process %original file name%.exe:1932 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
%Documents and Settings%\All Users\Application Data\GNPHXW\LGP.01 (81 bytes)
%Documents and Settings%\All Users\Application Data\GNPHXW\LGP.00 (2 bytes)
%Documents and Settings%\All Users\Application Data\GNPHXW\LGP.exe (17629 bytes)
%Documents and Settings%\All Users\Application Data\GNPHXW\LGP.02 (55 bytes)
C:\PRo.exe (7386 bytes)
The process PRo.exe:1256 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
C:\PRo\10.0.exe (2694 bytes)
C:\PRo\FapCF2.dll (1084 bytes)
C:\PRo\FapCF.dll (1084 bytes)
The Trojan deletes the following file(s):
C:\PRo\__tmp_rar_sfx_access_check_2447515 (0 bytes)
The process LGP.exe:740 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
%Documents and Settings%\All Users\Application Data\TUT\LGP.004 (644 bytes)
The process 10.0.exe:164 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\domainpark[1].htm (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\domainpark[1].com&output=html&drid=as-drid-oo-1750951074443211 (613 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@wm.sumohit[1].txt (261 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\cleardot[1].gif (43 bytes)
%Documents and Settings%\%current user%\Cookies\index.dat (964 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\desktop.ini (67 bytes)
The Trojan deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\MSHist012014041020140411\index.dat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\MSHist012014041020140411 (0 bytes)
%System%\drivers\etc\hosts (0 bytes)
Registry activity
The process %original file name%.exe:1932 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "EF 27 97 BB 1C A9 E2 72 C2 8B CD 77 5B 9C C9 21"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%Documents and Settings%\All Users\Application Data\GNPHXW]
"LGP.exe" = "LGP"
[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\c:]
"pro.exe" = "PRo"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"
The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"
The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:
"UNCAsIntranet" = "1"
The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:
"ProxyBypass" = "1"
The process PRo.exe:1256 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "FD 9D 89 1E CD D6 A2 ED 2A 3C DE C3 FE 1F 1B B7"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\PRo]
"10.0.exe" = "10.0"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"
[HKCU\Software\WinRAR SFX]
"C%%PRo" = "C:\PRo"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"
The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"
The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:
"UNCAsIntranet" = "1"
The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:
"ProxyBypass" = "1"
The process LGP.exe:740 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "6B 3A F9 2D 95 73 47 C0 4B 91 A2 13 9B B5 5D 24"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Programs" = "%Documents and Settings%\All Users\Start Menu\Programs"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"
To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"LGP Start" = "%Documents and Settings%\All Users\Application Data\GNPHXW\LGP.exe"
The process 10.0.exe:164 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012016033020160331]
"CacheRepair" = "0"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012016033020160331]
"CachePath" = "%USERPROFILE%\Local Settings\History\History.IE5\MSHist012016033020160331\"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1E 00 00 00 01 00 00 00 00 00 00 00"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012016033020160331]
"CachePrefix" = ":2016033020160331:"
"CacheLimit" = "8192"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "61 A7 3F CD 59 A3 44 1B 87 B7 88 0B 20 F7 5B 03"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012016033020160331]
"CacheOptions" = "11"
The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"
The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:
"ProxyBypass" = "1"
Proxy settings are disabled:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"
The Trojan deletes the following registry key(s):
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014041020140411]
The Trojan deletes the following value(s) in system registry:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"
Dropped PE files
| MD5 | File path |
|---|---|
| 8b55503bc54186c7592a0a68218ab881 | c:\Documents and Settings\All Users\Application Data\GNPHXW\LGP.01 |
| f9a8dd8f8b38b8a9d03fb66a8d0df4de | c:\Documents and Settings\All Users\Application Data\GNPHXW\LGP.02 |
| 5fa30c535081694f3fce3a298b294b31 | c:\Documents and Settings\All Users\Application Data\GNPHXW\LGP.exe |
| f9b8acd80e64f941d27b5b6dbbb2bd2a | c:\PRo.exe |
| 2c972501cbdb46a23f540f1d75e967d8 | c:\PRo\10.0.exe |
| bbb498665f0fab8f992f13a170d0a0aa | c:\PRo\FapCF.dll |
| bbb498665f0fab8f992f13a170d0a0aa | c:\PRo\FapCF2.dll |
HOSTS file anomalies
No changes have been detected.
Rootkit activity
No anomalies have been detected.
Propagation
Removals
Remove it with Ad-Aware
- Click (here) to download and install Ad-Aware Free Antivirus.
- Update the definition files.
- Run a full scan of your computer.
Manual removal*
- Terminate malicious process(es) (How to End a Process With the Task Manager):
%original file name%.exe:1932
PRo.exe:1256
LGP.exe:740 - Delete the original Trojan file.
- Delete or disinfect the following files created/modified by the Trojan:
%Documents and Settings%\All Users\Application Data\GNPHXW\LGP.01 (81 bytes)
%Documents and Settings%\All Users\Application Data\GNPHXW\LGP.00 (2 bytes)
%Documents and Settings%\All Users\Application Data\GNPHXW\LGP.exe (17629 bytes)
%Documents and Settings%\All Users\Application Data\GNPHXW\LGP.02 (55 bytes)
C:\PRo.exe (7386 bytes)
C:\PRo\10.0.exe (2694 bytes)
C:\PRo\FapCF2.dll (1084 bytes)
C:\PRo\FapCF.dll (1084 bytes)
%Documents and Settings%\All Users\Application Data\TUT\LGP.004 (644 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\domainpark[1].htm (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\domainpark[1].com&output=html&drid=as-drid-oo-1750951074443211 (613 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@wm.sumohit[1].txt (261 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\cleardot[1].gif (43 bytes)
%Documents and Settings%\%current user%\Cookies\index.dat (964 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\desktop.ini (67 bytes) - Delete the following value(s) in the autorun key (How to Work with System Registry):
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"LGP Start" = "%Documents and Settings%\All Users\Application Data\GNPHXW\LGP.exe" - Reboot the computer.
Static Analysis
VersionInfo
No information is available.
No information is available.
PE Sections
| Name | Virtual Address | Virtual Size | Raw Size | Entropy | Section MD5 |
|---|---|---|---|---|---|
| .text | 4096 | 39972 | 40448 | 4.42322 | d757b5377d52e6b5321b79d7a3a82774 |
| .rdata | 45056 | 9122 | 9216 | 3.83132 | 153268f01def965db6f339c3a76b7fa8 |
| .data | 57344 | 8000 | 3584 | 1.59546 | d74c536cb49fae160bed11f31867c3b7 |
| .rsrc | 65536 | 3539572 | 3539968 | 5.36598 | 2fc3294902aeb12140210b2b172acae8 |
| .reloc | 3608576 | 4742 | 5120 | 2.51978 | 526ef451c025897e25a21986c03c6774 |
Dropped from:
Downloaded by:
Similar by SSDeep:
Similar by Lavasoft Polymorphic Checker:
Network Activity
URLs
IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)
Traffic
Map
The Trojan connects to the servers at the folowing location(s):
Strings from Dumps
10.0.exe_164:
.text
.text
`.data
`.data
.vmp0
.vmp0
.vmp1
.vmp1
.rsrc
.rsrc
SHDocVwCtl.WebBrowser
SHDocVwCtl.WebBrowser
Facebook: wWw.Facebook.com/fappro
Facebook: wWw.Facebook.com/fappro
ieframe.dll
ieframe.dll
WebBrowser
WebBrowser
%Program Files%\Microsoft Visual Studio\VB98\VB6.OLB
%Program Files%\Microsoft Visual Studio\VB98\VB6.OLB
C:\Windows\System32\ieframe.oca
C:\Windows\System32\ieframe.oca
user32.dll
user32.dll
shell32.dll
shell32.dll
ShellExecuteA
ShellExecuteA
kernel32.dll
kernel32.dll
ntdll.dll
ntdll.dll
PSAPI.DLL
PSAPI.DLL
VBA6.DLL
VBA6.DLL
sKey
sKey
@.ihG
@.ihG
%Swuf
%Swuf
y%0XP
y%0XP
Please contact the application's support team for more information.
Please contact the application's support team for more information.
- Attempt to initialize the CRT more than once.
- Attempt to initialize the CRT more than once.
- CRT not initialized
- CRT not initialized
- floating point support not loaded
- floating point support not loaded
GetProcessWindowStation
GetProcessWindowStation
USER32.DLL
USER32.DLL
operator
operator
activation.php?code=
activation.php?code=
deactivation.php?hash=
deactivation.php?hash=
.?AVIUrlBuilderSource@@
.?AVIUrlBuilderSource@@
C:\PRo\10.0.exe
C:\PRo\10.0.exe
o.as{
o.as{
K C.jV#9
K C.jV#9
.PbyE
.PbyE
?`w'.aJw
?`w'.aJw
q".jMS
q".jMS
.VDb9
.VDb9
P-NZ|%f
P-NZ|%f
6CRTr
6CRTr
3B.XF
3B.XF
".jVN
".jVN
Jz|%f
Jz|%f
x.afy
x.afy
r.PD,
r.PD,
z%DL=
z%DL=
Z1^%X
Z1^%X
|%fwxHJ
|%fwxHJ
=.vBZ
=.vBZ
e?%F)r
e?%F)r
b.jHo
b.jHo
!e.enD
!e.enD
`9@1UrLl
`9@1UrLl
[%xQ:
[%xQ:
F.jvx2
F.jvx2
0RXcú
0RXcú
Q.Oaa?_
Q.Oaa?_
.sAMwV
.sAMwV
PUdP
PUdP
O%s.{o
O%s.{o
@a?%X
@a?%X
e;|%f
e;|%f
B.Xp;>6
B.Xp;>6
&).YD
&).YD
NZ|%f
NZ|%f
MSVBVM60.DLL
MSVBVM60.DLL
X%FRtefVX
X%FRtefVX
L:^.YB{P\
L:^.YB{P\
\?O.OS
\?O.OS
l$X
l$X
(Ph.vL
(Ph.vL
.Gfji
.Gfji
{.Fry
{.Fry
RH)%s
RH)%s
ky.WQ
ky.WQ
Lb.SJt
Lb.SJt
0.qF6
0.qF6
O%UiN
O%UiN
jk.Xx
jk.Xx
.lgg|
.lgg|
.GlNj
.GlNj
%SZe@Z
%SZe@Z
E.cC
E.cC
%Dr3mr?
%Dr3mr?
u=.Ft
u=.Ft
h}Þ
h}Þ
ErE.FW
ErE.FW
N.nR/
N.nR/
1.Ke}
1.Ke}
%uHq-n
%uHq-n
s0%CM
s0%CM
%drpF
%drpF
v-O}ZW
v-O}ZW
>5w%c
>5w%c
EiB.nE
EiB.nE
6%FNh
6%FNh
q.iY!
q.iY!
.FQ@*b
.FQ@*b
.oBP
.oBP
%xN/L
%xN/L
siyZ%x
siyZ%x
.hML%
.hML%
s.ZEb
s.ZEb
n:\a&
n:\a&
Xy.eU
Xy.eU
USER32.dll
USER32.dll
zd{%%sh=
zd{%%sh=
s.Bpc
s.Bpc
.vLy3
.vLy3
X%F;\!Br
X%F;\!Br
KERNEL32.dll
KERNEL32.dll
Sm.oi
Sm.oi
J*,.Zik;
J*,.Zik;
hXXp:///
hXXp:///
C:\Users
C:\Users
*\AE:\srouce\modznc\Project1.vbp
*\AE:\srouce\modznc\Project1.vbp
C:\aim1
C:\aim1
C:\aim2.dat
C:\aim2.dat
\system32\Drivers\etc\hosts.ics
\system32\Drivers\etc\hosts.ics
crossfire.dat
crossfire.dat
HGWC.exe
HGWC.exe
iexplore.exe
iexplore.exe
hXXp://tenlua-fapcf.googlecode.com/svn/trunk/active.html
hXXp://tenlua-fapcf.googlecode.com/svn/trunk/active.html
\Desktop\Google Chrome.htm
\Desktop\Google Chrome.htm
\Desktop\Google Chrome.html
\Desktop\Google Chrome.html
\Desktop\Google Chrome.lnk
\Desktop\Google Chrome.lnk
\Desktop\Mozilla Firefox.htm
\Desktop\Mozilla Firefox.htm
\Desktop\Mozilla Firefox.html
\Desktop\Mozilla Firefox.html
\Desktop\Mozilla Firefox.lnk
\Desktop\Mozilla Firefox.lnk
hXXp://wm.sumohit.com/cf.html
hXXp://wm.sumohit.com/cf.html
C:\*.dll
C:\*.dll
InternetExplorer.Application
InternetExplorer.Application
\ddraw.dll
\ddraw.dll
0123456789
0123456789
\???.dll
\???.dll
\FapCF.dll
\FapCF.dll
Windows Internet Explorer
Windows Internet Explorer
Web Browser
Web Browser
iexplore.exe - Application Error
iexplore.exe - Application Error
crossfire.exe
crossfire.exe
\CShell.dll
\CShell.dll
LocationURL
LocationURL
adf.ly
adf.ly
Chrome_RenderWidgetHostHWND
Chrome_RenderWidgetHostHWND
Chrome_WidgetWin_1
Chrome_WidgetWin_1
MozillaWindowClass
MozillaWindowClass
hXXp://6b188f15.linkbucks.com
hXXp://6b188f15.linkbucks.com
hXXp://e96c08fe.linkbucks.com
hXXp://e96c08fe.linkbucks.com
hXXp://197290c7.linkbucks.com
hXXp://197290c7.linkbucks.com
hXXp://863ffe29.linkbucks.com
hXXp://863ffe29.linkbucks.com
hXXp://adf.ly/Wo4hu
hXXp://adf.ly/Wo4hu
hXXp://adf.ly/Wo4pL
hXXp://adf.ly/Wo4pL
hXXp://adf.ly/XX1H9
hXXp://adf.ly/XX1H9
hXXp://adf.ly/XX1JN
hXXp://adf.ly/XX1JN
hXXp://adf.ly/XX1FB
hXXp://adf.ly/XX1FB
hXXp://adf.ly/ruqY2
hXXp://adf.ly/ruqY2
hXXp://adf.ly/ruqZ7
hXXp://adf.ly/ruqZ7
hXXp://adf.ly/ruqdu
hXXp://adf.ly/ruqdu
hXXp://adf.ly/ruqbS
hXXp://adf.ly/ruqbS
@*\AE:\srouce\modznc\Project1.vbp
@*\AE:\srouce\modznc\Project1.vbp
KERNEL32.DLL
KERNEL32.DLL
mscoree.dll
mscoree.dll
Error at initialization of bundled DLL: %s
Error at initialization of bundled DLL: %s
Error at hooking API "%S"
Error at hooking API "%S"
Dumping first %d bytes:
Dumping first %d bytes:
9.5.exe
9.5.exe
10.0.exe_164_rwx_0040D000_00090000:
@.ihG
@.ihG
%Swuf
%Swuf
y%0XP
y%0XP
Please contact the application's support team for more information.
Please contact the application's support team for more information.
- Attempt to initialize the CRT more than once.
- Attempt to initialize the CRT more than once.
- CRT not initialized
- CRT not initialized
- floating point support not loaded
- floating point support not loaded
GetProcessWindowStation
GetProcessWindowStation
USER32.DLL
USER32.DLL
operator
operator
activation.php?code=
activation.php?code=
deactivation.php?hash=
deactivation.php?hash=
.?AVIUrlBuilderSource@@
.?AVIUrlBuilderSource@@
C:\PRo\10.0.exe
C:\PRo\10.0.exe
o.as{
o.as{
K C.jV#9
K C.jV#9
.PbyE
.PbyE
?`w'.aJw
?`w'.aJw
q".jMS
q".jMS
.VDb9
.VDb9
P-NZ|%f
P-NZ|%f
6CRTr
6CRTr
3B.XF
3B.XF
".jVN
".jVN
Jz|%f
Jz|%f
x.afy
x.afy
r.PD,
r.PD,
z%DL=
z%DL=
Z1^%X
Z1^%X
|%fwxHJ
|%fwxHJ
=.vBZ
=.vBZ
e?%F)r
e?%F)r
b.jHo
b.jHo
!e.enD
!e.enD
`9@1UrLl
`9@1UrLl
[%xQ:
[%xQ:
F.jvx2
F.jvx2
0RXcú
0RXcú
Q.Oaa?_
Q.Oaa?_
.sAMwV
.sAMwV
PUdP
PUdP
O%s.{o
O%s.{o
@a?%X
@a?%X
e;|%f
e;|%f
B.Xp;>6
B.Xp;>6
&).YD
&).YD
NZ|%f
NZ|%f
KERNEL32.DLL
KERNEL32.DLL
mscoree.dll
mscoree.dll
Error at initialization of bundled DLL: %s
Error at initialization of bundled DLL: %s
Error at hooking API "%S"
Error at hooking API "%S"
Dumping first %d bytes:
Dumping first %d bytes:
10.0.exe_164_rwx_0051D000_00001000:
Xy.eU
Xy.eU
USER32.dll
USER32.dll
10.0.exe_164_rwx_0051F000_00001000:
zd{%%sh=
zd{%%sh=
iexplore.exe_664:
%?9-*09,*19}*09
%?9-*09,*19}*09
.text
.text
`.data
`.data
.rsrc
.rsrc
msvcrt.dll
msvcrt.dll
KERNEL32.dll
KERNEL32.dll
NTDLL.DLL
NTDLL.DLL
USER32.dll
USER32.dll
SHLWAPI.dll
SHLWAPI.dll
SHDOCVW.dll
SHDOCVW.dll
Software\Microsoft\Windows\CurrentVersion\Explorer\BrowseNewProcess
Software\Microsoft\Windows\CurrentVersion\Explorer\BrowseNewProcess
IE-X-X
IE-X-X
rsabase.dll
rsabase.dll
System\CurrentControlSet\Control\Windows
System\CurrentControlSet\Control\Windows
dw15 -x -s %u
dw15 -x -s %u
watson.microsoft.com
watson.microsoft.com
IEWatsonURL
IEWatsonURL
%s -h %u
%s -h %u
iedw.exe
iedw.exe
Iexplore.XPExceptionFilter
Iexplore.XPExceptionFilter
jscript.DLL
jscript.DLL
mshtml.dll
mshtml.dll
mlang.dll
mlang.dll
urlmon.dll
urlmon.dll
wininet.dll
wininet.dll
shdocvw.DLL
shdocvw.DLL
browseui.DLL
browseui.DLL
comctl32.DLL
comctl32.DLL
IEXPLORE.EXE
IEXPLORE.EXE
iexplore.pdb
iexplore.pdb
ADVAPI32.dll
ADVAPI32.dll
MsgWaitForMultipleObjects
MsgWaitForMultipleObjects
IExplorer.EXE
IExplorer.EXE
IIIIIB(II<.fg>
IIIIIB(II<.fg>
7?_____ZZSSH%
7?_____ZZSSH%
)z.UUUUUUUU
)z.UUUUUUUU
,....Qym
,....Qym
````2```
````2```
{.QLQIIIKGKGKGKGKGKG
{.QLQIIIKGKGKGKGKGKG
;33;33;0
;33;33;0
8888880
8888880
8887080
8887080
browseui.dll
browseui.dll
shdocvw.dll
shdocvw.dll
6.00.2900.5512 (xpsp.080413-2105)
6.00.2900.5512 (xpsp.080413-2105)
Windows
Windows
Operating System
Operating System
6.00.2900.5512
6.00.2900.5512