Generic.Rebhip.D8977122_6e914b3e92 – Adaware

Dynamic Analysis

Payload

Behaviour	Description
WormAutorun	A worm can spread via removable drives. It writes its executable and creates "autorun.inf" scripts on all removable drives. The autorun script will execute the Generic's file once a user opens a drive's folder in Windows Explorer.

Process activity

The Generic creates the following process(es):

%original file name%.exe:396
rundll32.exe:1164

The Generic injects its code into the following process(es):

rundll32.exe:364
explorer.exe:188
Explorer.EXE:532

Mutexes

The following mutexes were created/opened:No objects were found.

File activity

The process %original file name%.exe:396 makes changes in the file system.

The Generic creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\XX--XX--XX.txt (1672 bytes)
C:\dir\install\explorer.exe\install\Photo.jpeg (2321 bytes)

Registry activity

The process %original file name%.exe:396 makes changes in the system registry.

The Generic creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "C7 1A 9D ED 24 26 4F 97 05 5C E9 CF 82 0E D2 63"

[HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\{2P84811C-IDMG-W210-7662-7BY1HUC5IE84}]
"StubPath" = "c:\dir\install\explorer.exe\install\Photo.jpeg Restart"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run]
"Policies" = "c:\dir\install\explorer.exe\install\Photo.jpeg"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run]
"Policies" = "c:\dir\install\explorer.exe\install\Photo.jpeg"

To automatically run itself each time Windows is booted, the Generic adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"HKCU" = "c:\dir\install\explorer.exe\install\Photo.jpeg"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"HKLM" = "c:\dir\install\explorer.exe\install\Photo.jpeg"

The process rundll32.exe:1164 makes changes in the system registry.

The Generic creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "C8 A1 D1 8E 9A 69 64 87 47 10 C0 4F 51 CF 4C 15"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

The process rundll32.exe:364 makes changes in the system registry.

The Generic creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "65 37 B5 94 AD 1D DB A2 59 00 F5 AD 16 5F 11 95"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

Dropped PE files

There are no dropped PE files.

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

A worm can spread via removable drives. It writes its executable and creates "autorun.inf" scripts on all removable drives. The autorun script will execute the Generic's file once a user opens a drive's folder in Windows Explorer.

Removals

Remove it with Ad-Aware

Click (here) to download and install Ad-Aware Free Antivirus.
Update the definition files.
Run a full scan of your computer.

Manual removal*

Terminate malicious process(es) (How to End a Process With the Task Manager):
%original file name%.exe:396
rundll32.exe:1164
Delete the original Generic file.
Delete or disinfect the following files created/modified by the Generic:
%Documents and Settings%\%current user%\Local Settings\Temp\XX--XX--XX.txt (1672 bytes)
C:\dir\install\explorer.exe\install\Photo.jpeg (2321 bytes)
Delete the following value(s) in the autorun key (How to Work with System Registry):
[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"HKCU" = "c:\dir\install\explorer.exe\install\Photo.jpeg"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"HKLM" = "c:\dir\install\explorer.exe\install\Photo.jpeg"
Find and delete all copies of the worm's file together with "autorun.inf" scripts on removable drives.
Reboot the computer.

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

VersionInfo

No information is available.

PE Sections

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Section MD5
CODE	4096	45512	45568	4.44597	4a2150bf37c4ff6bbd8f4f2c3a09b096
DATA	53248	544	1024	1.91604	dd653175899ceecf929eb6d19ce189b4
BSS	57344	4593	0	0	d41d8cd98f00b204e9800998ecf8427e
.idata	65536	3044	3072	3.30697	4f982c9b59dc3fc83ad5a7c9912faa66
.tls	69632	8	0	0	d41d8cd98f00b204e9800998ecf8427e
.rdata	73728	24	512	0.142404	a270a5e1f4f71f9ddb31027f913842a2
.reloc	77824	2656	3072	4.32933	ba51f7deda6128aa3417cb4fe1f7eb61
.rsrc	81920	398752	398848	5.51661	122b60ac67f5bab77323a36582a4897b

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Total found: 1
9fdb4fc05fc42056c47cd7e7f86a0f82

Network Activity

URLs

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

Map

The Generic connects to the servers at the folowing location(s):

Strings from Dumps

explorer.exe_188:

.text

`.data

.rsrc

@.reloc

ADVAPI32.dll

BROWSEUI.dll

GDI32.dll

KERNEL32.dll

NTDLL.DLL

msvcrt.dll

ole32.dll

OLEAUT32.dll

SHDOCVW.dll

SHELL32.dll

SHLWAPI.dll

USER32.dll

UxTheme.dll

FTSSh

t0SSh

SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon

SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system

SShwk

98~%SP

ExplorerStartMsgLoop

PSSh;

6SSSSh

SSSSh

SPSSSShL

u%SSh

t.WWWW

xpsp2res.dll

xpsp3res.dll

tbSSh

Software\Microsoft\Windows\CurrentVersion\Explorer\StartMenu\StartMenu

Software\Microsoft\Windows\CurrentVersion\Explorer\StartMenu\StartPanel

kernel32.dll

GetSystemWindowsDirectoryW

NetGetJoinInformation

WINMM.dll

SETUPAPI.dll

WINSTA.dll

OLEACC.dll

USERENV.dll

ntdll.dll

RegEnumKeyExW

RegNotifyChangeKeyValue

RegOpenKeyExA

RegEnumKeyW

RegCloseKey

RegCreateKeyW

RegQueryInfoKeyW

RegOpenKeyExW

RegCreateKeyExW

OffsetViewportOrgEx

GetViewportOrgEx

SetViewportOrgEx

SetProcessShutdownParameters

GetProcessHeap

GetWindowsDirectoryW

CreateIoCompletionPort

ShellExecuteExW

SHRegCloseUSKey

SHRegCreateUSKeyW

AssocQueryKeyW

SHRegOpenUSKeyW

SHDeleteKeyW

TileWindows

ExitWindowsEx

RegisterHotKey

UnregisterHotKey

EnumChildWindows

GetKeyState

GetAsyncKeyState

CascadeWindows

MsgWaitForMultipleObjects

EnumWindows

explorer.pdb

name="Microsoft.Windows.Shell.explorer"

version="5.1.0.0"

Windows Shell

name="Microsoft.Windows.Common-Controls"

version="6.0.0.0"

publicKeyToken="6595b64144ccf1df"

]]"```^]]\

3333333330

3333330

333333334

)@. '5 !*

.DEHHF>?/

2

&$%Uooqkezs

['$$#%&(4

3333333333333333333

33333333333330

7''''))

3'')))33.

222`444(555

%%%{///-

000000000

00000000

`[66...00

0000000

`]66./.000

/./././././././.

66///0000

0000000000000

0000000000

6666,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,0.010.010.010.010.010.010.010.010.010.010.001

4366666666K,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6.010.010.010.010.010.010.010.010.010.010.000

:;

) ) ) ) )

|2222'2'2'2'2'2'2'2'2'2'2'2'2'2'2'2',),),),),),),),),),),),),),),),),),),),),),,

22222222222

3333333

.SB99;;;99twv}ut{oxt~

.SB;;;:::2:w}{{qddgghg

" """ """ """ """ "" #

""" """ """ "#

.SG>''';;9::p

:5:5:5:5:5:5:5:5:5:5#"

# # # # # # # # # # # # # # # # # # # # # ##$

( # # # # # # # # # # # # # # # # # # # # ###

1232123212321232123

(&(((&(((&(((&(((&((&&)

&(((&(((&(((&()

`,''')))

'4,4'4,4'4,4'4,4'4,4)(

55///0000

5555-5-5-5-5-5-5-5-5-5-5-5-5-5-5-5-0

555555555

55555555

5555555

14441444144414441

4343434343434343

5555555555555

5555555555

-,-,-,-,-,-,-,-,-,-,-*.

..............................JFJFJFJFJFJFJFJFJFJFJ.-

{22*2*2*2*2*2*2*2*2*2*2*2*2*2*2*2*.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-../

|ujjjjuhF..BBBBBBBBBBBBT

~j|F.BB*BBB*BBB*Bwop

&!!!&!!!&

44466666

44444444416

4446666

66666666

|= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |=

|= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |=

DDDDE%CTDD@

A%US$

%UUUU

%%UUU

33U

""2222!!

!"!"%UUR""

!""!"#2"""

"!!"#3"!"

dnnnnn:n.nfCnmddddd

////;/;;88

;888;;!/

!//!!;;^

:;:!::!!!

.88.88.8

.N.NN.M

::8.8...

:::!;;:!

//!!;888

.8.8.88...

:;!::!!;!//!;

!!;:!!::

.88..8..

!!:::/^!

!;/;!;;;!!!:

.8:!!!!^

!!:;:::..

/:!^^!;{8{../

...:::.-

**6***66*6**6566*5666 ,

6*6666*6*6 655*65

6*65 56*5 55 555 *5 6

555( 55 (5 5(

76 5 66 555*677

6*6 5 5(5 (55( '5((5 (556 ('5

665**6(('S((((((S(((]('((@('SS((S(((((((6C-.NEC66S5sU

555(555(5((5(5(5(

5 5 5 5555 (555(555'(((5(5('55(((

((''('5'5(5('('('('('((''('(((@(((('&(((&

%&&%&&&&3>&3&3&33&3&3333&&3>3333

'(3&'&3&

3&33&&((

3323>33>%>3%>3>33>3%3&%

*5'(('((&@3(

,63%3>323>3%>&>33323>>%>

3(3'(((@@'5('@(@(&('(

>2>323%>3

75((((@3&333&3&&&%&3&&3&33>33%3>23%>3

>2%$32%>2>%>2$3>

3&%&&3&33>3>33

3>%>3%&3$23>23$2>2%$>2>

)4433((&(&('*

('((((''(**6(('' *

32323>3>

2$%>22%>%3' (

&(&''((5(5 *

'(&(&((&('''

&&%&3&&%3%

2%>22>22

5''3(((3(('&(&'&

3%%3%3%2#$

22$22$2%$22$2%2%$2%$2$222%$22

&>2$2$2$222$22$%%

:7'((('(3('(3(&(&

222222222222

22222222222222

222222222222222

22$22$22$22$

&(%3%&&&&3&&&3%3

222222222222222222

&&(&3(&(&'('((3'(&&

2222222

22$

&&(3(3('(&'

222"2212

22

(&(3(3((

((565 ((( 6

333&33(&&

'(('('(('(

'&%%"$

2"2"22"2

2222

"2"22

2%('(3'32222?&'

2"2"2"121212

2"2"2$"?

%%22%2

&3(3(3((&

"2"

1"?((&21

22

2%""22&&

2

'&('(3(''

((%%%"

5(3%"%

"2%5*67

))) ))))

""**

"*

#2#---2222-222442-

---(-%

$/222(--444222!

#&-221269924999;

&$-22-($2%

#(2---222622212-

#2221299629968

#&--%#(2##!

-222422422426662-%

"2-##&

!##-#-&%---#---#&-219662%

$&-(151,44.9

&1242662-

-(..19.19

,4492.12

12-$-,-,

-, $$----

#%#-15/-&

-,(,,(,(,

$$11651566/,$&&

,2592&&&-

2466/!$$

""*

) '????[

&&&$-556>>61,,5994511-

$(//$$$(6>6/,$,-$

#$-22692/,,$,-&

-266661..4514#

&,2-&#

&-222,22--#

#&&---2-,-&$&(,,291.566..BNNNTNNNNNAABIAA88

&!#&!-##

--//11468>885882&

$266961$&--$&%

,1661,!-((#

&$,4255$,92

&$,44..&

""**""***""

"****

"**""""*""""

&-569./-,16522$

.BAA=86546888=AAAEAAEMNRMQQSWZZ\]gk__m__\

bTRHHHHHQQHQJQWJSSSSSSSSSSSSSSSSWWSSSS\\V]VZW8,.FW]\\]\]\]\\ZZ\\WFR>38(

.BTTkgn]ktvgmvvvvvmvvvsvzzzyzyzyzyyyzmkkkkkZSRA816;F87

yzyzyzym^Z]WN3 $&$.Wt\

""*"""****""""

"***"**""**

$5612,.2,

&$$,,,5]

$]t.Ft

7%8U8

3 303

2

8 8$8(8,80848885%5,575{6
7 7$7(7,70747
rundll32.exe
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage
Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
::{2559a1f6-21d7-11d4-bdaf-00c04f60b9f0}
::{2559a1f2-21d7-11d4-bdaf-00c04f60b9f0}
::{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}
::{2559a1f0-21d7-11d4-bdaf-00c04f60b9f0}
::{2559a1f1-21d7-11d4-bdaf-00c04f60b9f0}
::{D20EA4E1-3957-11d2-A40B-0C5020524153}
::{2559a1f7-21d7-11d4-bdaf-00c04f60b9f0}
{208D2C60-3AEA-1069-A2D7-08002B30309D}
{20D04FE0-3AEA-1069-A2D8-08002B30309D}
Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites
{450D8FBA-AD25-11D0-98A8-0800361B1103}
CLSID\{2559a1f6-21d7-11d4-bdaf-00c04f60b9f0}
Software\Microsoft\Windows\CurrentVersion\RunOnce
Software\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad
Software\Microsoft\Windows\CurrentVersion\Explorer\DontShowMeThisDialogAgain
Software\Microsoft\Windows\CurrentVersion\Explorer\Desktop\CleanupWiz
\\.\WMIDataDevice
Software\Microsoft\Windows\CurrentVersion\Run
Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run
Software\Microsoft\Windows NT\CurrentVersion\Windows
ExplorerIsShellMutex
desk.cpl
Software\Microsoft\Windows\CurrentVersion\Explorer
tourstart.exe
tourstart.exe,0
Microsoft.OfferTour
WINWORD.EXE
Software\Microsoft\Windows\CurrentVersion\Applets
Software\Microsoft\Windows\CurrentVersion\Applets\Tour
explorer.exe,9
Microsoft.FixScreenResolution
shell:::{2559a1f4-21d7-11d4-bdaf-00c04f60b9f0}
Software\Microsoft\Windows\CurrentVersion\Explorer\FileAssociation
Software\Microsoft\Windows NT\CurrentVersion
shell:::{2559a1f5-21d7-11d4-bdaf-00c04f60b9f0}
Software\Microsoft\Windows\CurrentVersion\Explorer\StartPage
Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
DDEEXECUTESHORTCIRCUIT
http\shell
IEXPLORE.EXE
Software\Microsoft\Windows\CurrentVersion\Explorer\Streams\Desktop
Software\Microsoft\Windows\CurrentVersion\RunOnceEx
comctl32.dll
Software\Microsoft\Windows\Internet Settings
AutoConfigURL
system.ini
AppEvents\Schemes\Apps\.Default\%s\.current
Software\Microsoft\Windows\CurrentVersion\Explorer\TrayNotify
MSShellRunDlgReady
res://mys.dll/mys.hta /explorer
mshta.exe
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Setup\Welcome
Software\Microsoft\Windows\CurrentVersion\Explorer\Tips
SOFTWARE\Policies\Microsoft\Windows NT\CurrentVersion\MYS
cys.exe
SOFTWARE\Microsoft\Windows NT\CurrentVersion\srvWiz
install.exe
SOFTWARE\Microsoft\Windows\CurrentVersion\Control Panel
OUTLOOK.EXE
explorer.exe,16
iernonce.dll
WININET.DLL
UpdateURL
WindowsUpdate
HWND%x
Software\Microsoft\Windows\CurrentVersion\OemStartMenuData
fldrclnr.dll,Wizard_RunDLL
iexplore.exe
winbrand.dll
Software\Microsoft\Windows\CurrentVersion\Explorer\Remote\%d
shell32.dll
nusrmgr.cpl ,initialTask=ChangePicture
NewExeName
Windows
ediskeer.dll
timedate.cpl
Software\Microsoft\Windows\CurrentVersion\Explorer\Comdlg32\LastVisitedMRU
Software\Microsoft\Windows\CurrentVersion\Explorer\Comdlg32\OpenSaveMRU
Software\Microsoft\Windows\CurrentVersion\Explorer\Doc Find Spec MRU
Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU
Software\Microsoft\Internet Explorer\TypedURLs
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Calculator.lnk
%ALLUSERSPROFILE%\Start Menu\Programs\Games\Solitaire.lnk
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Paint.lnk
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\WordPad.lnk
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\System Tools\Files and Settings Transfer Wizard.lnk
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Windows Movie Maker.lnk
%USERPROFILE%\Start Menu\Programs\Accessories\Tour Windows XP.lnk
%ALLUSERSPROFILE%\Start Menu\Programs\Windows Messenger.lnk
%USERPROFILE%\Start Menu\Programs\Windows Media Player.lnk
%ALLUSERSPROFILE%\Start Menu\Programs\MSN.lnk
%ALLUSERSPROFILE%\Start Menu\Programs\Get Online with MSN.lnk
%ALLUSERSPROFILE%\Start Menu\Programs\Get Going with Tablet PC.lnk
%ALLUSERSPROFILE%\Start Menu\Set Program Access and Defaults.lnk
%ALLUSERSPROFILE%\Start Menu\Programs\Windows Journal.lnk
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Media Center\Media Center.lnk
%USERPROFILE%\Start Menu\Programs\Internet Explorer.lnk
Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel
TSAppCMP.DLL
netapi32.dll
%SystemRoot%\system32\restore\rstrui.exe
RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL ?0x%X?%s
RunDLL32.EXE
%s%d%s
Software\Microsoft\Windows\CurrentVersion\Policies\System
settings.dll
explorer.exe "
explorer.exe /e, "
WindowsLogon
WindowsLogoff
%s %s
Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count
uAppWiz.Cpl
\explorer.exe
Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Start Menu
::{20D04FE0-3AEA-1069-A2D8-08002B30309D}
taskmgr.exe
ShellExecute
Software\Microsoft\Windows\CurrentVersion\Explorer\AppKey\%d
\WindowsShell.Manifest
Get Online with MSN.lnk
Set Program Access and Defaults.lnk
Link%d
OEM%d
Software\Microsoft\Windows\CurrentVersion\SMDEn
::{D20EA4E1-3957-11d2-A40B-0C5020524152}
There is a file or folder on your computer called "%s" which could cause certain applications to not function correctly. Renaming it to "%s" would solve this problem. Would you like to rename it now?
Ca&scade Windows
Tile Windows &Horizontally
Tile Windows V&ertically
&Windows Security...
&Help and Support
&Log Off %s...
Windows Explorer
6.00.2900.5512 (xpsp.080413-2105)
EXPLORER.EXE
Windows
Operating System
6.00.2900.5512
Keep the &taskbar on top of other windows
To remove records of recently accessed documents, programs, and Web sites, click Clear.
Windows displays icons for active and urgent notifications, and hides inactive ones. You can change this behavior for items in the list below.
Select this option to use the menu style from earlier versions of Windows.
6There is not enough memory to complete this operation.8Unable to run command.
The folder '%1' has been removed.WMy Computer or Windows Explorer has not been properly initialized yet. Try again later.
&Undo %s
Windows is running in safe mode.
This special diagnostic mode of Windows enables you to fix a problem which may be caused by your network or hardware settings. Make sure these settings are correct in Control Panel, and then try starting Windows again. While in safe mode, some of your devices may not be available.
startRThere was an internal error and one of the windows you were using has been closed.
Restrictions{This operation has been cancelled due to restrictions in effect on this computer. Please contact your system administrator.
&Show Open Windows
Windows was unable to change the display settings for the new configuration. Return the computer to the previous state, shut down Windows, and restart the computer in the desired configuration.
There may be a problem with your display settings if you continue. To safely change to a new configuration, you should shut down Windows and restart the computer in the desired configuration. Do you want to continue anyway?
This pre-release version of "Internet Explorer 4.0" Desktop/Explorer has expired. Please update to the latest release of "Internet Explorer 4.0" from WWW.MICROSOFT.COM
helpctr.exe>-FromStartHelp
Take a tour of Windows XP
NOpens a window where you can pick search options and work with search results.aOpens a central location for Help topics, tutorials, troubleshooting, and other support services.
/Opens a program, folder, document, or Web site.
Provides options for closing your programs and logging off, or for leaving your programs running and switching to another user.lProvides options for turning off or restarting your computer, or for activating Stand By or Hibernate modes.RDisconnects your session. You can reconnect to the session when you log on again.
&Windows Security
iOpens the My Documents folder, where you can store letters, reports, notes, and other kinds of documents./Displays recently opened documents and folders.KOpens the My Music folder, where you can store music and other audio files.]Opens the My Pictures folder, where you can store digital photos, images, and graphics files.zGives access to, and information about, the disk drives, cameras, scanners, and other hardware connected to your computer.MGives access to, and information about, folders and files on other computers.8Connects to other computers, networks, and the Internet.
explorer.exe_188_rwx_00090000_00001000:KERNEL32.DLL
explorer.exe_188_rwx_001D0000_00001000:KERNEL32.DLL
rundll32.exe_364:.text
`.data
.rsrc
msvcrt.dll
KERNEL32.dll
NTDLL.DLL
GDI32.dll
USER32.dll
IMAGEHLP.dll
rundll32.pdb
.....eZXnnnnnnnnnnnn3
....eDXnnnnnnnnnnnn3
...eDXnnnnnnnnnnnn,
.eDXnnnnnnnnnnnn,
%Xnnnnnnnnnnnnnnn1
O3$dS7"%U9
.manifest
5.1.2600.5512 (xpsp.080413-2105)
RUNDLL.EXE
Windows
Operating System
5.1.2600.5512
YThere is not enough memory to run the file %s.
Please close other windows and try again.
9The file %s or one of its components could not be opened.
0The file %s or one of its components cannot run.
MThe file %s or one of its components requires a different version of Windows.
UThe file %s or one of its components cannot run in standard or enhanced mode Windows.3Another instance of the file %s is already running./An exception occurred while trying to run "%s"
Error in %s
Missing entry:%s
Error loading %s
explorer.exe_188_rwx_00210000_00001000:KERNEL32.DLL
explorer.exe_188_rwx_00250000_00001000:KERNEL32.DLL
explorer.exe_188_rwx_00290000_00001000:KERNEL32.DLL
explorer.exe_188_rwx_002D0000_00001000:KERNEL32.DLL
explorer.exe_188_rwx_00BD0000_00001000:advapi32.dll
explorer.exe_188_rwx_00C00000_00001000:RegOpenKeyA
explorer.exe_188_rwx_00C10000_00001000:advapi32.dll
explorer.exe_188_rwx_00C40000_00001000:AVICAP32.DLL
explorer.exe_188_rwx_00C90000_00001000:AVICAP32.DLL
explorer.exe_188_rwx_00CC0000_00001000:gdi32.dll
explorer.exe_188_rwx_00D00000_00001000:gdi32.dll
explorer.exe_188_rwx_00F40000_00001000:gdiplus.dll
explorer.exe_188_rwx_00F80000_00001000:gdiplus.dll
explorer.exe_188_rwx_00FC0000_00001000:mpr.dll
explorer.exe_188_rwx_01400000_00001000:mpr.dll
explorer.exe_188_rwx_01430000_00001000:msacm32.dll
explorer.exe_188_rwx_01570000_00001000:msacm32.dll
explorer.exe_188_rwx_015A0000_00001000:ntdll.dll
explorer.exe_188_rwx_016E0000_00001000:ntdll.dll
explorer.exe_188_rwx_01710000_00001000:ole32.dll
explorer.exe_188_rwx_01850000_00001000:ole32.dll
explorer.exe_188_rwx_01880000_00001000:oleaut32.dll
explorer.exe_188_rwx_019C0000_00001000:oleaut32.dll
explorer.exe_188_rwx_019F0000_00001000:powrprof.dll
explorer.exe_188_rwx_01B30000_00001000:powrprof.dll
explorer.exe_188_rwx_01B60000_00001000:shell32.dll
explorer.exe_188_rwx_01CA0000_00001000:shell32.dll
explorer.exe_188_rwx_01CD0000_00001000:user32.dll
explorer.exe_188_rwx_01E10000_00001000:user32.dll
explorer.exe_188_rwx_01E40000_00001000:wininet.dll
explorer.exe_188_rwx_01F70000_00001000:FtpOpenFileA
explorer.exe_188_rwx_01F80000_00001000:wininet.dll
explorer.exe_188_rwx_01FB0000_00001000:winmm.dll
explorer.exe_188_rwx_020F0000_00001000:winmm.dll
explorer.exe_188_rwx_02120000_00001000:wsock32.dll
explorer.exe_188_rwx_02260000_00001000:wsock32.dll
explorer.exe_188_rwx_02690000_0004B000:`.rsrc
kernel32.dll
$*@@@*$@@@$ *@@* $@@($*)@-$*@@$-*@@$*-@@(*$)@-*$@@*-$@@*$-@@-* $@-$ *@* $-@$ *-@$ -*@*- $@($ *)(* $)
sqlite3_bind_blob
sqlite3_bind_text
sqlite3_bind_double
sqlite3_bind_int
sqlite3_bind_int64
sqlite3_bind_null
sqlite3_bind_parameter_index
sqlite3_open
sqlite3_close
sqlite3_errmsg
sqlite3_errcode
sqlite3_free
sqlite3_prepare_v2
sqlite3_column_count
sqlite3_column_name
sqlite3_column_decltype
sqlite3_step
sqlite3_column_blob
sqlite3_column_bytes
sqlite3_column_double
sqlite3_column_text
sqlite3_column_type
sqlite3_column_int64
sqlite3_finalize
sqlite3_reset
SQL error or missing database
An internal logic error in SQLite
Operation terminated by sqlite3_interrupt()
Uses OS features not supported on host
2nd parameter to sqlite3_bind out of range
sqlite3_step() has another row ready
sqlite3_step() has finished executing
Unknown SQLite Error Code "
oleaut32.dll
EVariantBadIndexError
u%CNu
Uh%fj
%s[%d]
ESQLiteException
TSQLiteDatabasex
TSQLiteTable
Failed to open database "%s" : %s
Failed to open database "%s" : unknown error
Error [%d]: %s.
"%s": %s
Error executing SQL
Could not prepare SQL statement
Error executing SQL statement
SQLite is Busy
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
Mozilla
Firefox
sqlite3.dll
mozcrt19.dll
nspr4.dll
plc4.dll
plds4.dll
nssutil3.dll
nss3.dll
PK11_GetInternalKeySlot
\Mozilla\Firefox\profiles.ini
\Mozilla\Firefox\
signons.sqlite
SELECT * FROM moz_logins
encryptedPassword
ole32.dll
##@@## ##@@## ##@@##
\Google\Chrome\User Data\Default\Web Data
SELECT * FROM logins
password_value
origin_url
getservbyport
WSAAsyncGetServByPort
WSAJoinLeaf
WS2_32.DLL
127.0.0.1
TIdSocketListWindows
TIdStackWindowsU
IdStackWindows
ftpTransfer
ftpReady
ftpAborted
ClientPortMinClientPortMaxh
Port
EIdCanNotBindPortInRange
EIdInvalidPortRangeSVW
saUsernamePassword
PasswordPorth
0.0.0.1
TIdTCPConnection
IdTCPConnection
EIdTCPConnectionError
EIdObjectTypeNotSupported
TIdTCPServer
IdTCPServer
CmdDelimiterh
TIdTCPServerConnection
DefaultPort
OnExecuteL
EIdTCPServerError
EIdNoExecuteSpecified
TIdTCPClient
IdTCPClient
BoundPorth
PortU
TOnHTTPDocument
TIdHTTPProxyServer
TIdHTTPProxyServer0
IdHTTPProxyServer
DefaultPortd
OnHTTPDocument
HTTP/1.0
Windows Firewall Update
1.2.3
deflate 1.2.3 Copyright 1995-2005 Jean-loup Gailly
KWindows
IdTCPStream
 IdTCPServer
SQLiteTable3
SQLite3
DIdHTTPProxyServer
UnitChrome
UnitFireFox3_5
GetCPInfo
RegOpenKeyExA
RegFlushKey
RegCreateKeyExA
RegCloseKey
GetKeyboardType
MsgWaitForMultipleObjects
((&)))!&$
"#$$&-)01$$'&,--%.&,
4\@%c
.idata
.edata
P.reloc
P.rsrc
$>.icR9
KERNEL32.DLL
advapi32.dll
crypt32.dll
user32.dll
funcoes.dll
GetChromePass
Mozilla3_5Password
StartHttpProxy
Request rejected or failed.5Request rejected because SOCKS server cannot connect.QRequest rejected because the client program and identd report different user-ids.
Command not supported.
Address type not supported.
Socket is not connected..Cannot send or receive after socket is closed.#Too many references, cannot splice.
Operation would block.
Operation now in progress.
Operation already in progress.
Socket operation on non-socket.
Protocol not supported.
Socket type not supported."Operation not supported on socket.
Protocol family not supported.0Address family not supported by protocol family.
&Error on loading Winsock2 library (%s)
Resolving hostname %s.
Connecting to %s.
%s is not a valid service.
Socket Error # %d
File "%s" not found1Only one TIdAntiFreeze can exist per application.
Object type not supported.
No execute handler found.
No data to read.$Can not bind in port range (%d - %d)
Invalid Port Range (%d - %d)
No command handler found.*Error on call Winsock2 library function %s
Failed to set data for '%s'
%s.Seek not implemented$Operation not allowed on sorted list
Property %s does not exist
Thread creation error: %s
Thread Error: %s (%d)
OLE error %.8x.Method '%s' not supported by automation object/Variant does not reference an automation object7Dispatch methods do not support more than 64 parameters
Connection Closed Gracefully.;Could not bind socket. Address and port are already in use.
%List does not allow duplicates ($0%x)#A component named %s already exists%String list does not allow duplicates
Cannot create file "%s". %s
Cannot open file "%s". %s$''%s'' is not a valid component name
Invalid property value List capacity out of bounds (%d)
List count out of bounds (%d)
List index out of bounds (%d) Out of memory while expanding memory stream
Error reading %s%s%s: %s
Ancestor for '%s' not found
Cannot assign a %s to a %sECheckSynchronize called from thread $%x, which is NOT the main thread
Class %s not found
%s (%s, line %d)
Abstract Error?Access violation at address %p in module '%s'. %s of address %p
System Error. Code: %d.
Invalid variant operation%Invalid variant operation (%s%.8x)
%s5Could not convert variant of type (%s) into type (%s)=Overflow while converting variant of type (%s) into type (%s)
Operation not supported
External exception %x
Interface not supported
Invalid pointer operation
Invalid class typecast0Access violation at address %p. %s of address %p
Privileged instruction(Exception %s in module %s at %p.
Application Error1Format '%s' invalid or incompatible with argument
No argument for format '%s'"Variant method calls not supported
!'%s' is not a valid integer value('%s' is not a valid floating point value
I/O error %d
Integer overflow Invalid floating point operation
explorer.exe_188_rwx_027E0000_0004B000:`.rsrc
kernel32.dll
$*@@@*$@@@$ *@@* $@@($*)@-$*@@$-*@@$*-@@(*$)@-*$@@*-$@@*$-@@-* $@-$ *@* $-@$ *-@$ -*@*- $@($ *)(* $)
sqlite3_bind_blob
sqlite3_bind_text
sqlite3_bind_double
sqlite3_bind_int
sqlite3_bind_int64
sqlite3_bind_null
sqlite3_bind_parameter_index
sqlite3_open
sqlite3_close
sqlite3_errmsg
sqlite3_errcode
sqlite3_free
sqlite3_prepare_v2
sqlite3_column_count
sqlite3_column_name
sqlite3_column_decltype
sqlite3_step
sqlite3_column_blob
sqlite3_column_bytes
sqlite3_column_double
sqlite3_column_text
sqlite3_column_type
sqlite3_column_int64
sqlite3_finalize
sqlite3_reset
SQL error or missing database
An internal logic error in SQLite
Operation terminated by sqlite3_interrupt()
Uses OS features not supported on host
2nd parameter to sqlite3_bind out of range
sqlite3_step() has another row ready
sqlite3_step() has finished executing
Unknown SQLite Error Code "
oleaut32.dll
EVariantBadIndexError
u%CNu
%s[%d]
ESQLiteException
TSQLiteDatabasex
TSQLiteTable
Failed to open database "%s" : %s
Failed to open database "%s" : unknown error
Error [%d]: %s.
"%s": %s
Error executing SQL
Could not prepare SQL statement
Error executing SQL statement
SQLite is Busy
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
Mozilla
Firefox
sqlite3.dll
mozcrt19.dll
nspr4.dll
plc4.dll
plds4.dll
nssutil3.dll
nss3.dll
PK11_GetInternalKeySlot
\Mozilla\Firefox\profiles.ini
\Mozilla\Firefox\
signons.sqlite
SELECT * FROM moz_logins
encryptedPassword
ole32.dll
##@@## ##@@## ##@@##
\Google\Chrome\User Data\Default\Web Data
SELECT * FROM logins
password_value
origin_url
getservbyport
WSAAsyncGetServByPort
WSAJoinLeaf
WS2_32.DLL
127.0.0.1
TIdSocketListWindows
TIdStackWindowsU
IdStackWindows
ftpTransfer
ftpReady
ftpAborted
ClientPortMinClientPortMaxh
Port
EIdCanNotBindPortInRange
EIdInvalidPortRangeSVW
saUsernamePassword
PasswordPorth
0.0.0.1
TIdTCPConnection
IdTCPConnection
EIdTCPConnectionError
EIdObjectTypeNotSupported
TIdTCPServer
IdTCPServer
CmdDelimiterh
TIdTCPServerConnection
DefaultPort
OnExecuteL
EIdTCPServerError
EIdNoExecuteSpecified
TIdTCPClient
IdTCPClient
BoundPorth
PortU
TOnHTTPDocument
TIdHTTPProxyServer
TIdHTTPProxyServer0
IdHTTPProxyServer
DefaultPortd
OnHTTPDocument
HTTP/1.0
Windows Firewall Update
1.2.3
deflate 1.2.3 Copyright 1995-2005 Jean-loup Gailly
KWindows
IdTCPStream
 IdTCPServer
SQLiteTable3
SQLite3
DIdHTTPProxyServer
UnitChrome
UnitFireFox3_5
GetCPInfo
RegOpenKeyExA
RegFlushKey
RegCreateKeyExA
RegCloseKey
GetKeyboardType
MsgWaitForMultipleObjects
((&)))!&$
"#$$&-)01$$'&,--%.&,
4\@%c
.idata
.edata
P.reloc
P.rsrc
$>.icR9
KERNEL32.DLL
advapi32.dll
crypt32.dll
user32.dll
funcoes.dll
GetChromePass
Mozilla3_5Password
StartHttpProxy
Request rejected or failed.5Request rejected because SOCKS server cannot connect.QRequest rejected because the client program and identd report different user-ids.
Command not supported.
Address type not supported.
Socket is not connected..Cannot send or receive after socket is closed.#Too many references, cannot splice.
Operation would block.
Operation now in progress.
Operation already in progress.
Socket operation on non-socket.
Protocol not supported.
Socket type not supported."Operation not supported on socket.
Protocol family not supported.0Address family not supported by protocol family.
&Error on loading Winsock2 library (%s)
Resolving hostname %s.
Connecting to %s.
%s is not a valid service.
Socket Error # %d
File "%s" not found1Only one TIdAntiFreeze can exist per application.
Object type not supported.
No execute handler found.
No data to read.$Can not bind in port range (%d - %d)
Invalid Port Range (%d - %d)
No command handler found.*Error on call Winsock2 library function %s
Failed to set data for '%s'
%s.Seek not implemented$Operation not allowed on sorted list
Property %s does not exist
Thread creation error: %s
Thread Error: %s (%d)
OLE error %.8x.Method '%s' not supported by automation object/Variant does not reference an automation object7Dispatch methods do not support more than 64 parameters
Connection Closed Gracefully.;Could not bind socket. Address and port are already in use.
%List does not allow duplicates ($0%x)#A component named %s already exists%String list does not allow duplicates
Cannot create file "%s". %s
Cannot open file "%s". %s$''%s'' is not a valid component name
Invalid property value List capacity out of bounds (%d)
List count out of bounds (%d)
List index out of bounds (%d) Out of memory while expanding memory stream
Error reading %s%s%s: %s
Ancestor for '%s' not found
Cannot assign a %s to a %sECheckSynchronize called from thread $%x, which is NOT the main thread
Class %s not found
%s (%s, line %d)
Abstract Error?Access violation at address %p in module '%s'. %s of address %p
System Error. Code: %d.
Invalid variant operation%Invalid variant operation (%s%.8x)
%s5Could not convert variant of type (%s) into type (%s)=Overflow while converting variant of type (%s) into type (%s)
Operation not supported
External exception %x
Interface not supported
Invalid pointer operation
Invalid class typecast0Access violation at address %p. %s of address %p
Privileged instruction(Exception %s in module %s at %p.
Application Error1Format '%s' invalid or incompatible with argument
No argument for format '%s'"Variant method calls not supported
!'%s' is not a valid integer value('%s' is not a valid floating point value
I/O error %d
Integer overflow Invalid floating point operation
explorer.exe_188_rwx_02930000_0004B000:`.rsrc
kernel32.dll
$*@@@*$@@@$ *@@* $@@($*)@-$*@@$-*@@$*-@@(*$)@-*$@@*-$@@*$-@@-* $@-$ *@* $-@$ *-@$ -*@*- $@($ *)(* $)
sqlite3_bind_blob
sqlite3_bind_text
sqlite3_bind_double
sqlite3_bind_int
sqlite3_bind_int64
sqlite3_bind_null
sqlite3_bind_parameter_index
sqlite3_open
sqlite3_close
sqlite3_errmsg
sqlite3_errcode
sqlite3_free
sqlite3_prepare_v2
sqlite3_column_count
sqlite3_column_name
sqlite3_column_decltype
sqlite3_step
sqlite3_column_blob
sqlite3_column_bytes
sqlite3_column_double
sqlite3_column_text
sqlite3_column_type
sqlite3_column_int64
sqlite3_finalize
sqlite3_reset
SQL error or missing database
An internal logic error in SQLite
Operation terminated by sqlite3_interrupt()
Uses OS features not supported on host
2nd parameter to sqlite3_bind out of range
sqlite3_step() has another row ready
sqlite3_step() has finished executing
Unknown SQLite Error Code "
oleaut32.dll
EVariantBadIndexError
u%CNu
%s[%d]
ESQLiteException
TSQLiteDatabasex
TSQLiteTable
Failed to open database "%s" : %s
Failed to open database "%s" : unknown error
Error [%d]: %s.
"%s": %s
Error executing SQL
Could not prepare SQL statement
Error executing SQL statement
SQLite is Busy
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
Mozilla
Firefox
sqlite3.dll
mozcrt19.dll
nspr4.dll
plc4.dll
plds4.dll
nssutil3.dll
nss3.dll
PK11_GetInternalKeySlot
\Mozilla\Firefox\profiles.ini
\Mozilla\Firefox\
signons.sqlite
SELECT * FROM moz_logins
encryptedPassword
ole32.dll
##@@## ##@@## ##@@##
\Google\Chrome\User Data\Default\Web Data
SELECT * FROM logins
password_value
origin_url
getservbyport
WSAAsyncGetServByPort
WSAJoinLeaf
WS2_32.DLL
127.0.0.1
TIdSocketListWindows
TIdStackWindowsU
IdStackWindows
ftpTransfer
ftpReady
ftpAborted
ClientPortMinClientPortMaxh
Port
EIdCanNotBindPortInRange
EIdInvalidPortRangeSVW
saUsernamePassword
PasswordPorth
0.0.0.1
TIdTCPConnection
IdTCPConnection
EIdTCPConnectionError
EIdObjectTypeNotSupported
TIdTCPServer
IdTCPServer
CmdDelimiterh
TIdTCPServerConnection
DefaultPort
OnExecuteL
EIdTCPServerError
EIdNoExecuteSpecified
TIdTCPClient
IdTCPClient
BoundPorth
PortU
TOnHTTPDocument
TIdHTTPProxyServer
TIdHTTPProxyServer0
IdHTTPProxyServer
DefaultPortd
OnHTTPDocument
HTTP/1.0
Windows Firewall Update
1.2.3
deflate 1.2.3 Copyright 1995-2005 Jean-loup Gailly
KWindows
IdTCPStream
 IdTCPServer
SQLiteTable3
SQLite3
DIdHTTPProxyServer
UnitChrome
UnitFireFox3_5
GetCPInfo
RegOpenKeyExA
RegFlushKey
RegCreateKeyExA
RegCloseKey
GetKeyboardType
MsgWaitForMultipleObjects
((&)))!&$
"#$$&-)01$$'&,--%.&,
4\@%c
.idata
.edata
P.reloc
P.rsrc
$>.icR9
KERNEL32.DLL
advapi32.dll
crypt32.dll
user32.dll
funcoes.dll
GetChromePass
Mozilla3_5Password
StartHttpProxy
Request rejected or failed.5Request rejected because SOCKS server cannot connect.QRequest rejected because the client program and identd report different user-ids.
Command not supported.
Address type not supported.
Socket is not connected..Cannot send or receive after socket is closed.#Too many references, cannot splice.
Operation would block.
Operation now in progress.
Operation already in progress.
Socket operation on non-socket.
Protocol not supported.
Socket type not supported."Operation not supported on socket.
Protocol family not supported.0Address family not supported by protocol family.
&Error on loading Winsock2 library (%s)
Resolving hostname %s.
Connecting to %s.
%s is not a valid service.
Socket Error # %d
File "%s" not found1Only one TIdAntiFreeze can exist per application.
Object type not supported.
No execute handler found.
No data to read.$Can not bind in port range (%d - %d)
Invalid Port Range (%d - %d)
No command handler found.*Error on call Winsock2 library function %s
Failed to set data for '%s'
%s.Seek not implemented$Operation not allowed on sorted list
Property %s does not exist
Thread creation error: %s
Thread Error: %s (%d)
OLE error %.8x.Method '%s' not supported by automation object/Variant does not reference an automation object7Dispatch methods do not support more than 64 parameters
Connection Closed Gracefully.;Could not bind socket. Address and port are already in use.
%List does not allow duplicates ($0%x)#A component named %s already exists%String list does not allow duplicates
Cannot create file "%s". %s
Cannot open file "%s". %s$''%s'' is not a valid component name
Invalid property value List capacity out of bounds (%d)
List count out of bounds (%d)
List index out of bounds (%d) Out of memory while expanding memory stream
Error reading %s%s%s: %s
Ancestor for '%s' not found
Cannot assign a %s to a %sECheckSynchronize called from thread $%x, which is NOT the main thread
Class %s not found
%s (%s, line %d)
Abstract Error?Access violation at address %p in module '%s'. %s of address %p
System Error. Code: %d.
Invalid variant operation%Invalid variant operation (%s%.8x)
%s5Could not convert variant of type (%s) into type (%s)=Overflow while converting variant of type (%s) into type (%s)
Operation not supported
External exception %x
Interface not supported
Invalid pointer operation
Invalid class typecast0Access violation at address %p. %s of address %p
Privileged instruction(Exception %s in module %s at %p.
Application Error1Format '%s' invalid or incompatible with argument
No argument for format '%s'"Variant method calls not supported
!'%s' is not a valid integer value('%s' is not a valid floating point value
I/O error %d
Integer overflow Invalid floating point operation
explorer.exe_188_rwx_24080000_00062000:`.rsrc
/w)f%u/
kernel32.dll
Portions Copyright (c) 1999,2003 Avenger by NhT
SHFileOperationA
shell32.dll
URLDownloadToFileA
urlmon.dll
ShellExecuteA
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
GetWindowsDirectoryA
SOFTWARE\Microsoft\Windows\CurrentVersion
http\shell\open\command
\Internet Explorer\iexplore.exe
####@####
$*@@@*$@@@$ *@@* $@@($*)@-$*@@$-*@@$*-@@(*$)@-*$@@*-$@@*$-@@-* $@-$ *@* $-@$ *-@$ -*@*- $@($ *)(* $)
Portugal
Turkey
Windows 3.1
Windows 95 (Release 2)
Windows 95
Windows 98 SE
Windows 98
Windows ME
Windows 7
Windows Vista
%s %s
Windows XP Professional x64
Windows XP Home
Windows XP Professional
Windows 2000 Professional
Windows NT %d.%d
Windows 2008
%s %s Server
Windows 2003 Server Datacenter
Windows 2003 Server Enterprise
Windows 2003 Server Web Edition
Windows 2003 Server
Windows Home Server
Windows 2003 Server (Release 2)
Windows 2000 Server Datacenter
Windows 2000 Server Enterprise
Windows 2000 Server Web Edition
Windows 2000 Server
Windows NT 4.0 Server Datacenter
Windows NT 4.0 Server Enterprise
Windows NT 4.0 Server Web Edition
Windows NT 4.0 Server
Unknown Platform ID (%d)
%d.%d
%s (Build: %d
- Service Pack: %s
KERNEL32.DLL
teste.vbs
teste.txt
Set objSecurityCenter = GetObject("winmgmts:\\.\root\SecurityCenter")
Set colFirewall = objSecurityCenter.ExecQuery("Select * From FirewallProduct",,48)
Set colAntiVirus = objSecurityCenter.ExecQuery("Select * From AntiVirusProduct",,48)
Set objFileSystem = CreateObject("Scripting.fileSystemObject")
Set objFile = objFileSystem.CreateTextFile("
Info = Info & "F" & CountFw & ") " & objFirewall.displayName & " v" & objFirewall.versionNumber & Enter
Info = Info & "A" & CountAV & ") " & objAntiVirus.displayName & " v" & objAntiVirus.versionNumber & Enter
objFile.WriteLine(Info)
objFile.Close
cscript.exe
AVICAP32.dll
tFtpAccess
BuildImportTable: can't load library:
BuildImportTable: ReallocMemory failed
BuildImportTable: GetProcAddress failed
BTMemoryLoadLibary: BuildImportTable failed
BTMemoryGetProcAddress: no export table found
BTMemoryGetProcAddress: DLL doesn't export anything
BTMemoryGetProcAddress: exported symbol not found
SetupApi.dll
SetupDiOpenClassRegKey
SetupDiOpenClassRegKeyExA
SetupDiOpenClassRegKeyExW
SetupDiCreateDeviceInterfaceRegKeyA
SetupDiCreateDeviceInterfaceRegKeyW
SetupDiOpenDeviceInterfaceRegKey
SetupDiDeleteDeviceInterfaceRegKey
SetupDiCreateDevRegKeyA
SetupDiCreateDevRegKeyW
SetupDiOpenDevRegKey
SetupDiDeleteDevRegKey
CM_DEVCAP_LOCKSUPPORTED
CM_DEVCAP_EJECTSUPPORTED
PDCAP_D0_SUPPORTED
PDCAP_D1_SUPPORTED
PDCAP_D2_SUPPORTED
PDCAP_D3_SUPPORTED
PDCAP_WAKE_FROM_D0_SUPPORTED
PDCAP_WAKE_FROM_D1_SUPPORTED
PDCAP_WAKE_FROM_D2_SUPPORTED
PDCAP_WAKE_FROM_D3_SUPPORTED
PDCAP_WARM_EJECT_SUPPORTED
HKEY_CLASSES_ROOT
HKEY_CURRENT_CONFIG
HKEY_CURRENT_USER
HKEY_LOCAL_MACHINE
HKEY_USERS
127.0.0.1
iphlpapi.dll
AllocateAndGetTcpExTableFromStack
AllocateAndGetUdpExTableFromStack
SetTcpEntry
GetExtendedTcpTable
GetExtendedUdpTable
Mozilla3_5Password
GetChromePass
StartHttpProxy
1.2.3
XxX.xXx
UuU.uUu
keyboardkey
webcaminactive
webcamgetbuffer
webcam
enviarexecnormal
enviarexechidden
openweb
downexec
sendftp
keylogger
keyloggergetlog
keyloggereraselog
keyloggerativar
keyloggerdesativar
renamekey
windowsfechar
windowsmax
windowsmin
windowsmostrar
windowsocultar
windowsmintodas
windowscaption
listarportas
listarportasdns
finalizarprocessoportas
webcamsettings
chatmsg
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\
PSAPI.dll
\config\SteamAppData.vdf
AutoLoginUser
/ClientRegistry.Blob
\ClientRegistry.blob
\steam.dll
%SYS%
ÃžSKTOP%
FirstExecution
chatmsg|
Software\Microsoft\Windows\CurrentVersion\Run
Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run
listarjanelas|windowsfechar|
listarjanelas|windowsmax|
listarjanelas|windowsmin|
listarjanelas|windowsmostrar|
listarjanelas|windowsocultar|
listarjanelas|windowsmintodas|
listarjanelas|windowscaption|
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
listarportas|listadeportaspronta|
listarportas|finalizarconexao|
listarportas|finalizarprocessoportas|Y|
listarportas|finalizarprocessoportas|N|
registro|renamekey|
keylogger|keylogger|keyloggerativar|
keylogger|keylogger|keyloggerdesativar|
keylogger|keyloggergetlog|
keylogger|keylogger|keyloggervazio|
keyloggersearch
keyloggersearchok|
webcam|webcaminactive|
webcam|webcamactive|
getpassword
_x_X_PASSWORDLIST_X_x_
NOIP.abc
MSN.abc
FIREFOX.abc
IELOGIN.abc
IEPASS.abc
IEAUTO.abc
IEWEB.abc
SOFTWARE\Mozilla\Mozilla Firefox
getfirefox
getielogin
getiepass
getieweb
getchrome
getpassword|getpasswordlist|
getpassword|getpassworderror|
updateservidorweb
##@@## ##@@## ##@@##
Windows\CurrentVersion\Uninstall\eDonkey2000
UNWISE.EXE
ntdll.dll
icon=shell32.dll,4
shellexecute=
autorun.inf
XX--XX--XX.txt
logs.dat
SQLite3.dll
$1.2.3
deflate 1.2.3 Copyright 1995-2005 Jean-loup Gailly
inflate 1.2.3 Copyright 1995-2005 Mark Adler
KWindows
UnitExecutarComandos
uftp
UrlMon
.UnitBytesSize
UnitListarPortasAtivas
UnitWebcam
UnitKeylogger
WinExec
SetNamedPipeHandleState
GetProcessHeap
CreatePipe
RegOpenKeyExA
RegOpenKeyA
RegEnumKeyExA
RegDeleteKeyA
RegCreateKeyA
RegCloseKey
GdiplusShutdown
keybd_event
MapVirtualKeyA
GetKeyboardState
GetKeyboardLayoutNameA
GetKeyState
GetAsyncKeyState
ExitWindowsEx
EnumWindows
FtpGetFileSize
FtpSetCurrentDirectoryA
FtpOpenFileA
%( % & % % % ]
.idata
.reloc
P.rsrc
advapi32.dll
AVICAP32.DLL
gdi32.dll
gdiplus.dll
mpr.dll
msacm32.dll
ole32.dll
oleaut32.dll
powrprof.dll
user32.dll
wininet.dll
winmm.dll
wsock32.dll
Explorer.EXE_532_rwx_00FF0000_00001000:KERNEL32.DLL
Explorer.EXE_532_rwx_01F00000_00001000:KERNEL32.DLL
Explorer.EXE_532_rwx_01FD0000_00001000:KERNEL32.DLL
Explorer.EXE_532_rwx_02020000_00001000:KERNEL32.DLL
Explorer.EXE_532_rwx_020A0000_00001000:KERNEL32.DLL
Explorer.EXE_532_rwx_02120000_00001000:KERNEL32.DLL
Explorer.EXE_532_rwx_02360000_00001000:advapi32.dll
Explorer.EXE_532_rwx_02390000_00001000:RegOpenKeyA
Explorer.EXE_532_rwx_023A0000_00001000:advapi32.dll
Explorer.EXE_532_rwx_023D0000_00001000:AVICAP32.DLL
Explorer.EXE_532_rwx_02410000_00001000:AVICAP32.DLL
Explorer.EXE_532_rwx_02890000_00001000:gdi32.dll
Explorer.EXE_532_rwx_029B0000_00001000:gdi32.dll
Explorer.EXE_532_rwx_029E0000_00001000:gdiplus.dll
Explorer.EXE_532_rwx_02AB0000_00001000:gdiplus.dll
Explorer.EXE_532_rwx_02F10000_00001000:mpr.dll
Explorer.EXE_532_rwx_03050000_00001000:mpr.dll
Explorer.EXE_532_rwx_030C0000_00001000:msacm32.dll
Explorer.EXE_532_rwx_03400000_00001000:msacm32.dll
Explorer.EXE_532_rwx_03430000_00001000:ntdll.dll
Explorer.EXE_532_rwx_03470000_00001000:ntdll.dll
Explorer.EXE_532_rwx_034A0000_00001000:ole32.dll
Explorer.EXE_532_rwx_034E0000_00001000:ole32.dll
Explorer.EXE_532_rwx_03B10000_00001000:oleaut32.dll
Explorer.EXE_532_rwx_03C50000_00001000:oleaut32.dll
Explorer.EXE_532_rwx_03C80000_00001000:powrprof.dll
Explorer.EXE_532_rwx_03DC0000_00001000:powrprof.dll
Explorer.EXE_532_rwx_03DF0000_00001000:shell32.dll
Explorer.EXE_532_rwx_03F30000_00001000:shell32.dll
Explorer.EXE_532_rwx_03F60000_00001000:user32.dll
Explorer.EXE_532_rwx_040A0000_00001000:user32.dll
Explorer.EXE_532_rwx_040D0000_00001000:wininet.dll
Explorer.EXE_532_rwx_04200000_00001000:FtpOpenFileA
Explorer.EXE_532_rwx_04210000_00001000:wininet.dll
Explorer.EXE_532_rwx_04240000_00001000:winmm.dll
Explorer.EXE_532_rwx_04380000_00001000:winmm.dll
Explorer.EXE_532_rwx_043B0000_00001000:wsock32.dll
Explorer.EXE_532_rwx_044F0000_00001000:wsock32.dll
Explorer.EXE_532_rwx_24010000_00062000:`.rsrc
/w)f%u/
kernel32.dll
Portions Copyright (c) 1999,2003 Avenger by NhT
SHFileOperationA
shell32.dll
URLDownloadToFileA
urlmon.dll
ShellExecuteA
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
GetWindowsDirectoryA
SOFTWARE\Microsoft\Windows\CurrentVersion
http\shell\open\command
\Internet Explorer\iexplore.exe
####@####
$*@@@*$@@@$ *@@* $@@($*)@-$*@@$-*@@$*-@@(*$)@-*$@@*-$@@*$-@@-* $@-$ *@* $-@$ *-@$ -*@*- $@($ *)(* $)
Portugal
Turkey
Windows 3.1
Windows 95 (Release 2)
Windows 95
Windows 98 SE
Windows 98
Windows ME
Windows 7
Windows Vista
%s %s
Windows XP Professional x64
Windows XP Home
Windows XP Professional
Windows 2000 Professional
Windows NT %d.%d
Windows 2008
%s %s Server
Windows 2003 Server Datacenter
Windows 2003 Server Enterprise
Windows 2003 Server Web Edition
Windows 2003 Server
Windows Home Server
Windows 2003 Server (Release 2)
Windows 2000 Server Datacenter
Windows 2000 Server Enterprise
Windows 2000 Server Web Edition
Windows 2000 Server
Windows NT 4.0 Server Datacenter
Windows NT 4.0 Server Enterprise
Windows NT 4.0 Server Web Edition
Windows NT 4.0 Server
Unknown Platform ID (%d)
%d.%d
%s (Build: %d
- Service Pack: %s
KERNEL32.DLL
teste.vbs
teste.txt
Set objSecurityCenter = GetObject("winmgmts:\\.\root\SecurityCenter")
Set colFirewall = objSecurityCenter.ExecQuery("Select * From FirewallProduct",,48)
Set colAntiVirus = objSecurityCenter.ExecQuery("Select * From AntiVirusProduct",,48)
Set objFileSystem = CreateObject("Scripting.fileSystemObject")
Set objFile = objFileSystem.CreateTextFile("
Info = Info & "F" & CountFw & ") " & objFirewall.displayName & " v" & objFirewall.versionNumber & Enter
Info = Info & "A" & CountAV & ") " & objAntiVirus.displayName & " v" & objAntiVirus.versionNumber & Enter
objFile.WriteLine(Info)
objFile.Close
cscript.exe
AVICAP32.dll
tFtpAccess
BuildImportTable: can't load library:
BuildImportTable: ReallocMemory failed
BuildImportTable: GetProcAddress failed
BTMemoryLoadLibary: BuildImportTable failed
BTMemoryGetProcAddress: no export table found
BTMemoryGetProcAddress: DLL doesn't export anything
BTMemoryGetProcAddress: exported symbol not found
SetupApi.dll
SetupDiOpenClassRegKey
SetupDiOpenClassRegKeyExA
SetupDiOpenClassRegKeyExW
SetupDiCreateDeviceInterfaceRegKeyA
SetupDiCreateDeviceInterfaceRegKeyW
SetupDiOpenDeviceInterfaceRegKey
SetupDiDeleteDeviceInterfaceRegKey
SetupDiCreateDevRegKeyA
SetupDiCreateDevRegKeyW
SetupDiOpenDevRegKey
SetupDiDeleteDevRegKey
CM_DEVCAP_LOCKSUPPORTED
CM_DEVCAP_EJECTSUPPORTED
PDCAP_D0_SUPPORTED
PDCAP_D1_SUPPORTED
PDCAP_D2_SUPPORTED
PDCAP_D3_SUPPORTED
PDCAP_WAKE_FROM_D0_SUPPORTED
PDCAP_WAKE_FROM_D1_SUPPORTED
PDCAP_WAKE_FROM_D2_SUPPORTED
PDCAP_WAKE_FROM_D3_SUPPORTED
PDCAP_WARM_EJECT_SUPPORTED
HKEY_CLASSES_ROOT
HKEY_CURRENT_CONFIG
HKEY_CURRENT_USER
HKEY_LOCAL_MACHINE
HKEY_USERS
127.0.0.1
iphlpapi.dll
AllocateAndGetTcpExTableFromStack
AllocateAndGetUdpExTableFromStack
SetTcpEntry
GetExtendedTcpTable
GetExtendedUdpTable
Mozilla3_5Password
GetChromePass
StartHttpProxy
1.2.3
XxX.xXx
UuU.uUu
keyboardkey
webcaminactive
webcamgetbuffer
webcam
enviarexecnormal
enviarexechidden
openweb
downexec
sendftp
keylogger
keyloggergetlog
keyloggereraselog
keyloggerativar
keyloggerdesativar
renamekey
windowsfechar
windowsmax
windowsmin
windowsmostrar
windowsocultar
windowsmintodas
windowscaption
listarportas
listarportasdns
finalizarprocessoportas
webcamsettings
chatmsg
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\
PSAPI.dll
\config\SteamAppData.vdf
AutoLoginUser
/ClientRegistry.Blob
\ClientRegistry.blob
\steam.dll
%SYS%
ÃžSKTOP%
FirstExecution
chatmsg|
Software\Microsoft\Windows\CurrentVersion\Run
Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run
listarjanelas|windowsfechar|
listarjanelas|windowsmax|
listarjanelas|windowsmin|
listarjanelas|windowsmostrar|
listarjanelas|windowsocultar|
listarjanelas|windowsmintodas|
listarjanelas|windowscaption|
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
listarportas|listadeportaspronta|
listarportas|finalizarconexao|
listarportas|finalizarprocessoportas|Y|
listarportas|finalizarprocessoportas|N|
registro|renamekey|
keylogger|keylogger|keyloggerativar|
keylogger|keylogger|keyloggerdesativar|
keylogger|keyloggergetlog|
keylogger|keylogger|keyloggervazio|
keyloggersearch
keyloggersearchok|
webcam|webcaminactive|
webcam|webcamactive|
getpassword
_x_X_PASSWORDLIST_X_x_
NOIP.abc
MSN.abc
FIREFOX.abc
IELOGIN.abc
IEPASS.abc
IEAUTO.abc
IEWEB.abc
SOFTWARE\Mozilla\Mozilla Firefox
getfirefox
getielogin
getiepass
getieweb
getchrome
getpassword|getpasswordlist|
getpassword|getpassworderror|
updateservidorweb
##@@## ##@@## ##@@##
Windows\CurrentVersion\Uninstall\eDonkey2000
UNWISE.EXE
ntdll.dll
icon=shell32.dll,4
shellexecute=
autorun.inf
XX--XX--XX.txt
logs.dat
SQLite3.dll
$1.2.3
deflate 1.2.3 Copyright 1995-2005 Jean-loup Gailly
inflate 1.2.3 Copyright 1995-2005 Mark Adler
KWindows
UnitExecutarComandos
uftp
UrlMon
.UnitBytesSize
UnitListarPortasAtivas
UnitWebcam
UnitKeylogger
WinExec
SetNamedPipeHandleState
GetProcessHeap
CreatePipe
RegOpenKeyExA
RegOpenKeyA
RegEnumKeyExA
RegDeleteKeyA
RegCreateKeyA
RegCloseKey
GdiplusShutdown
keybd_event
MapVirtualKeyA
GetKeyboardState
GetKeyboardLayoutNameA
GetKeyState
GetAsyncKeyState
ExitWindowsEx
EnumWindows
FtpGetFileSize
FtpSetCurrentDirectoryA
FtpOpenFileA
%( % & % % % ]
.idata
.reloc
P.rsrc
advapi32.dll
AVICAP32.DLL
gdi32.dll
gdiplus.dll
mpr.dll
msacm32.dll
ole32.dll
oleaut32.dll
powrprof.dll
user32.dll
wininet.dll
winmm.dll
wsock32.dll
3>

Summary

Dynamic Analysis

Removals

Static Analysis

Network Activity

Map

Strings from Dumps