Trojan.Win32.Sasfis_470c67df48 – Adaware

Dynamic Analysis

Payload

No specific payload has been found.

Process activity

The Trojan creates the following process(es):No processes have been created.The Trojan injects its code into the following process(es):

%original file name%.exe:272

Mutexes

The following mutexes were created/opened:No objects were found.

File activity

The process %original file name%.exe:272 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\is691223201\522373_Setup.EXE (5442 bytes)
%Documents and Settings%\%current user%\Desktop\Continue Advanced Call Recorder Installation.lnk (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ish519546\images\BG.png (20 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ish519546\css\sdk-ui\progress-bar.css (506 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ish519546\images\Icon_Generic.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ish519546\css\sdk-ui\browse.css (337 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ish519546\defaultOffer\images\toolbar.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ish519546\css\sdk-ui\images\button-bg.png (131 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ish519546\css\sdk-ui\images\progress-bg-corner.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ish519546\images\Close.png (207 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ish519546\images\Color_Button.png (808 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ish519546\form.bmp.Mask (244 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ish519546\images\Grey_Button.png (698 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ish519546\images\Pause_Button.png (493 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0007F79C.log (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0007ED6B.log (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ish519546\css\main.css (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ish519546\css\sdk-ui\images\progress-bg2.png (978 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ish519546\images\ProgressBar.png (812 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ish519546\images\Progress.png (104 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ish519546\images\Loader.gif (10 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ish519546\images\Resume_Button.png (681 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ish519546\images\Close_Hover.png (207 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ish519546\css\sdk-ui\images\progress-bg.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ish519546\csshover3.htc (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ish519546\images\Quick_Specs.png (221 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ish519546\css\sdk-ui\button.css (417 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ish519546\css\sdk-ui\checkbox.css (190 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ish519546\images\Color_Button_Hover.png (818 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ICReinstall_%original file name%.exe (7386 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ish519546\images\Grey_Button_Hover.png (719 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ish519546\css\ie6_main.css (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0007F848.log (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\166892[1].png (1304 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ish519546\bootstrap_28157.html (156 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ish519546\locale\EN.locale (1 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\0007F79C.log (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0007F848.log (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0007ED6B.log (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ish519546\bootstrap_28157.html (0 bytes)

Registry activity

The process %original file name%.exe:272 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1B 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Start Menu" = "%Documents and Settings%\All Users\Start Menu"

"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache]
"@xpsp3res.dll,-20001" = "Diagnose Connection Problems..."

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonMusic" = "%Documents and Settings%\All Users\Documents\My Music"
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\DirectDraw\MostRecentApplication]
"Name" = "%original file name%.exe"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"My Pictures" = "%Documents and Settings%\%current user%\My Documents\My Pictures"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Start Menu" = "%Documents and Settings%\%current user%\Start Menu"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\DirectDraw\MostRecentApplication]
"ID" = "708992537"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonVideo" = "%Documents and Settings%\All Users\Documents\My Videos"
"CommonPictures" = "%Documents and Settings%\All Users\Documents\My Pictures"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "3D 4B 88 84 0D 90 26 C0 26 E3 C8 BE 9C 72 6E 5C"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

Dropped PE files

MD5	File path
5846e35270a32af01bf6d60cac614ec8	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\is691223201\522373_Setup.EXE

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

Removals

Remove it with Ad-Aware

Click (here) to download and install Ad-Aware Free Antivirus.
Update the definition files.
Run a full scan of your computer.

Manual removal*

Terminate malicious process(es) (How to End a Process With the Task Manager):No processes have been created.
Delete the original Trojan file.
Delete or disinfect the following files created/modified by the Trojan:
%Documents and Settings%\%current user%\Local Settings\Temp\is691223201\522373_Setup.EXE (5442 bytes)
%Documents and Settings%\%current user%\Desktop\Continue Advanced Call Recorder Installation.lnk (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ish519546\images\BG.png (20 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ish519546\css\sdk-ui\progress-bar.css (506 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ish519546\images\Icon_Generic.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ish519546\css\sdk-ui\browse.css (337 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ish519546\defaultOffer\images\toolbar.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ish519546\css\sdk-ui\images\button-bg.png (131 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ish519546\css\sdk-ui\images\progress-bg-corner.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ish519546\images\Close.png (207 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ish519546\images\Color_Button.png (808 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ish519546\form.bmp.Mask (244 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ish519546\images\Grey_Button.png (698 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ish519546\images\Pause_Button.png (493 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0007F79C.log (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0007ED6B.log (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ish519546\css\main.css (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ish519546\css\sdk-ui\images\progress-bg2.png (978 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ish519546\images\ProgressBar.png (812 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ish519546\images\Progress.png (104 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ish519546\images\Loader.gif (10 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ish519546\images\Resume_Button.png (681 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ish519546\images\Close_Hover.png (207 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ish519546\css\sdk-ui\images\progress-bg.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ish519546\csshover3.htc (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ish519546\images\Quick_Specs.png (221 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ish519546\css\sdk-ui\button.css (417 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ish519546\css\sdk-ui\checkbox.css (190 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ish519546\images\Color_Button_Hover.png (818 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ICReinstall_%original file name%.exe (7386 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ish519546\images\Grey_Button_Hover.png (719 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ish519546\css\ie6_main.css (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0007F848.log (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\166892[1].png (1304 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ish519546\bootstrap_28157.html (156 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ish519546\locale\EN.locale (1 bytes)
Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
Reboot the computer.

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

VersionInfo

No information is available.

PE Sections

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Section MD5
CODE	4096	885772	886272	4.58897	073c28c3364d4ac38cb4551004192942
DATA	892928	21608	22016	4.31367	48583ff027e2862049206b6cf0a0c338
BSS	917504	15461	0	0	d41d8cd98f00b204e9800998ecf8427e
.idata	933888	12904	13312	3.36636	deef2a8e770e228c0e288c3ecfbf5a14
.tls	950272	16	0	0	d41d8cd98f00b204e9800998ecf8427e
.rdata	954368	24	512	0.135303	e42739227ff2805f3e297aa560b490a6
.reloc	958464	48836	49152	4.72746	459340ca82a70ae6105bdab14e15e98a
.rsrc	1007616	142156	142336	5.06751	c2a12e4af9f981766d52417e8426f65a

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Total found: 1
0fff5461be66dee790ca09b463c78eaf

Network Activity

URLs

URL	IP
hxxp://os.ptfcdn.com/PTF/?v=2.0&c=1974858242	54.229.110.27
hxxp://www.rayslab.com/acrecord.exe	198.63.211.38
hxxp://img.ptf.com/picons/png/32/166/166892.png	74.117.177.188
hxxp://www.rayslab.com/get.cgi?f=acre	198.63.211.38
hxxp://www.rayslab.com/files/acrecord.exe	198.63.211.38

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

GET /files/acrecord.exe HTTP/1.1

Accept: */*

Host: VVV.rayslab.com

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Thu, 10 Mar 2016 09:51:26 GMT

Server: Apache/2.2.15 (Fedora)

Last-Modified: Mon, 21 Apr 2003 08:41:10 GMT

ETag: "100b0a-fb910-3bbcd17ac7580"

Accept-Ranges: bytes

Content-Length: 1030416

Connection: close

Content-Type: application/octet-stream

MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................................................Rich............................PE..L....b=9.....................*.......(...................................................................................... ............$...........................................................................................................text............................... ..`.data...............................@....rsrc....0.......&..................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

<<< skipped >>>

GET /acrecord.exe HTTP/1.1

Accept: */*

Host: VVV.rayslab.com

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)

Connection: Keep-Alive

HTTP/1.1 302 Found

Date: Thu, 10 Mar 2016 09:51:25 GMT

Server: Apache/2.2.15 (Fedora)

Location: hXXp://VVV.rayslab.com/get.cgi?f=acre

Content-Length: 302

Connection: close

Content-Type: text/html; charset=iso-8859-1

<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">.<html><head>.<title>302 Found</title>.</head><body>.<h1>Found</h1>.<p>The document has moved <a href="hXXp://VVV.rayslab.com/get.cgi?f=acre">here</a>.</p>.<hr>.<address>Apache/2.2.15 (Fedora) Server at VVV.rayslab.com Port 80</address>.</body></html>...

GET /picons/png/32/166/166892.png HTTP/1.1

Accept: */*

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: img.ptf.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx

Date: Thu, 10 Mar 2016 09:51:58 GMT

Content-Type: image/png

Content-Length: 1304

Last-Modified: Sun, 31 Jan 2016 14:18:15 GMT

Connection: keep-alive

ETag: "56ae17a7-518"

Expires: Thu, 17 Mar 2016 09:51:58 GMT

Cache-Control: max-age=604800

Accept-Ranges: bytes

.PNG........IHDR... ... .....szz.....IDATX..._lSu..?..0..m..l%.v..V..l`M.h,q/},3.$.....`|4..bbx0.........I....1.d.)X..:W....v.Z...k}...ww.....t...~.{..w~....T*..{p...?......M.T....f........*`.hak.f^<..7.."......N.L.b..|MFhz|..%........^;.....{p...N(..3)...F....M.k.......=N|...v..b:.D(FpJ$.M..g.\...8l......Lr5..T..5.0..8.uq...`j6...4........U.i7q..>..[....\Po...S....>...R*..@...$.H.fb..r.1...B.7.v.7.....*#..h4p..b.@/..<..A>..7D.._.. ?.X.c1.9{r?...|...b;...z....(...|5q,.CL/RX....P...E4...7!...;..yz....z......{....X....j.A.....ab2&.....w.N....4#.Iy.Y0..ie/S...[...h< ..K>d..Pa....w...Y0....pw...O ....x.........,..y....o.....^....pUU.:-..f:.6...x...........wv.....<...zJ.K..jP...^..&...,..pu.......\L.y..W.-........~.s.o....YLF...\.f.......k9.....y/)......^U..j.%H.z.kG....2....G..\....i...k2X...lm..P5...#C...K.U........`~...".Fpi...I..8.P......*0.....Zc@"...2...TK.n=....k.|.7..r.{.I.1<{r?..f.|)...r...$..zb@L.9w.6...@V.P(...)....S. ..2%K.s...x.h<.\"G.P..@b!/....re.S.. <.b".[Q@J.......o'f.6 ..b.ZPX..K.T*..#r.*."....\..:-.......{...H.....u..T.......I4.].'X.......'_Y.!.......S..vz...{.....v;..-....(.........-..-.p...V.....s...wm..k;..24.uXLF<{....I.o.Q*W.".b........[n..[.jJ.z`......i..N.....=W(........h...m..|;}=..-....1.y."=..S.I..47r.V...w.l....j...%r....P$....3..=...........A........IEND.B`...

<<< skipped >>>

GET /get.cgi?f=acre HTTP/1.1

Accept: */*

Host: VVV.rayslab.com

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)

Connection: Keep-Alive

HTTP/1.1 302 Moved Temporary

Date: Thu, 10 Mar 2016 09:51:26 GMT

Server: Apache/2.2.15 (Fedora)

Location: hXXp://VVV.rayslab.com/files/acrecord.exe

Content-Length: 0

Connection: close

Content-Type: text/plain; charset=windows-1251

POST /PTF/?v=2.0&c=1974858242 HTTP/1.1

Accept: */*

Host: os.ptfcdn.com

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)

Content-Length: 256

Cache-Control: no-cache

0A0CzutD0PtD0TtD0FtN0U0I0DzutDtDtD0CtBzyyD0CzyyEyCyEyB0AtByDtN0W0VzuyDtFtCtN0W0S0PzutAtN0L1T1G1Nzu0E1G1N1I1L1B1MZZtN0S2Z1T1H1EzutCtCtBtByEtByDtN1L1B0A1Q1H1L1GzutCtN0T0KzuyDtBtDtAyEtAtN0S0S0NzuyDtCzyyEyCzztN0P0N0Mzu1B1T1G1Q1S1F2V1V1B2X1RtF1P2V1PtN0V0M0WzutC

HTTP/1.1 404 Not Found

Content-Type: text/html

Date: Thu, 10 Mar 2016 09:51:56 GMT

Server: nginx

Content-Length: 0

Connection: keep-alive

HTTP/1.1 404 Not Found..Content-Type: text/html..Date: Thu, 10 Mar 2016 09:51:56 GMT..Server: nginx..Content-Length: 0..Connection: keep-alive......

POST /PTF/?v=2.0&c=1974858242 HTTP/1.1

Accept: */*

Host: os.ptfcdn.com

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)

Content-Length: 256

Cache-Control: no-cache

0A0CzutD0PtD0TtD0FtN0U0I0DzutDtDtD0CtBzyyD0CzyyEyCyEyB0AtByDtN0W0VzuyDtFtCtN0W0S0PzutAtN0L1T1G1Nzu0E1G1N1I1L1B1MZZtN0S2Z1T1H1EzutCtCtBtByEtByDtN1L1B0A1Q1H1L1GzutCtN0T0KzuyDtBtDtAyEtAtN0S0S0NzuyDtCzyyEyCzztN0P0N0Mzu1B1T1G1Q1S1F2V1V1B2X1RtF1P2V1PtN0V0M0WzutC

HTTP/1.1 404 Not Found

Content-Type: text/html

Date: Thu, 10 Mar 2016 09:51:57 GMT

Server: nginx

Content-Length: 0

Connection: keep-alive

HTTP/1.1 404 Not Found..Content-Type: text/html..Date: Thu, 10 Mar 2016 09:51:57 GMT..Server: nginx..Content-Length: 0..Connection: keep-alive......

POST /PTF/?v=2.0&c=1974858242 HTTP/1.1

Accept: */*

Host: os.ptfcdn.com

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)

Content-Length: 256

Cache-Control: no-cache

0A0CzutD0PtD0TtD0FtN0U0I0DzutDtDtD0CtBzyyD0CzyyEyCyEyB0AtByDtN0W0VzuyDtFtCtN0W0S0PzutAtN0L1T1G1Nzu0E1G1N1I1L1B1MZZtN0S2Z1T1H1EzutCtCtBtByEtByDtN1L1B0A1Q1H1L1GzutCtN0T0KzuyDtBtDtAyEtAtN0S0S0NzuyDtCzyyEyCzztN0P0N0Mzu1B1T1G1Q1S1F2V1V1B2X1RtF1P2V1PtN0V0M0WzutC

HTTP/1.1 404 Not Found

Content-Type: text/html

Date: Thu, 10 Mar 2016 09:51:58 GMT

Server: nginx

Content-Length: 0

Connection: keep-alive

HTTP/1.1 404 Not Found..Content-Type: text/html..Date: Thu, 10 Mar 2016 09:51:58 GMT..Server: nginx..Content-Length: 0..Connection: keep-alive..

Map

The Trojan connects to the servers at the folowing location(s):

Strings from Dumps

%original file name%.exe_272:

.idata

.rdata

P.reloc

P.rsrc

kernel32.dll

MSWHEEL_ROLLMSG

MSH_WHEELSUPPORT_MSG

MSH_SCROLL_LINES_MSG

$*@@@*$@@@$ *@@* $@@($*)@-$*@@$-*@@$*-@@(*$)@-*$@@*-$@@*$-@@-* $@-$ *@* $-@$ *-@$ -*@*- $@($ *)(* $)

EVariantBadIndexError

htKeyword

EInvalidOperation

u%CNu

%s[%d]

%s_%d

.Owner

EInvalidGraphicOperation

USER32.DLL

comctl32.dll

UrlMon

Uho%C

IE(AL("%s",4),"AL(\"%0:s\",3)","JK(\"%1:s\",\"%0:s\")")

JumpID("","%s")

TKeyEvent

TKeyPressEvent

HelpKeyword

crSQLWait

%s (%s)

IMM32.DLL

AutoHotkeys

ssHotTrack

TWindowState

poProportional

TWMKey

KeyPreview

WindowState

OnKeyDown

OnKeyPress

OnKeyUp

System\CurrentControlSet\Control\Keyboard Layouts\%.8x

vcltest3.dll

User32.dll

2301654879

Vh-0,Cd`jiVhlxwd-0,tLcibD.ZP

TThreadExecuter

TScanAllWindowsCallBackData

Portuguese

i\*.*2XE

i.dwcnhE

Uh-%F

nmhpjhc03.fcclJL

i.ulzn1E

Uh.GF

powrprof.dll

1.2.3

THttpTimeOutThread

THttpCallBackShell

Gx-21,\igh]ixyj-42,M.DJ

A`qjz``-0,ZkdkNgij.pc

Kcqjpc`-0,Aaj-1,gEdafa`.pM

hXXps://

hXXp://

https

SQL error or missing database

An internal logic error in SQLite

Operation terminated by sqlite3_interrupt()

Uses OS features not supported on host

2nd parameter to sqlite3_bind out of range

sqlite3_step() has another row ready

sqlite3_step() has finished executing

Unknown SQLite Error Code

sqlite3.dll

ESQLiteException

TSQLiteDatabaseH

TSQLiteTable

Error executing SQL

Could not prepare SQL statement

Error executing SQL statement

select [sql] from sqlite_master where [type] = 'table' and lower(name) = '

Could not prepare SQL statement

SQLite is Busy

SOFTWARE\Mozilla\Mozilla Firefox

cookies.sqlite

session\urls_to_restore_on_startup\[size]

session\urls_to_restore_on_startup

session\urls_to_restore_on_startup\0

SELECT value FROM meta WHERE key='Default Search Provider ID'

SELECT short_name FROM keywords WHERE id='

GetChromeDefaultSearchProviderFromDb - got provider:

GetChromeDefaultSearchProviderFromDb - exception:

UPDATE keywords SET sync_guid='

UPDATE keywords SET instant_url='' WHERE id=

keywords_backup

DROP TABLE keywords_backup

CREATE TABLE keywords_backup AS SELECT * FROM keywords ORDER BY id ASC

autogenerate_keyword ||

SELECT id || short_name || keyword || favicon_url || url || safe_for_autoreplace || originating_url || date_created || usage_count || input_encodings || show_in_default_list || suggest_url || prepopulate_id ||

created_by_policy || instant_url || last_modified || sync_guid

FROM keywords ORDER BY id ASC

RemoveChromeSearchProvider - cannot remove

RemoveChromeSearchProvider -

DELETE from keywords WHERE short_name='

RemoveChromeSearchProvider - exception:

SELECT id FROM keywords WHERE short_name='

Opera

Home URL

Amazon.com

eBay.com

Merriam-Webster

Opera Preferences version 2.0

; Do not edit this file while Opera is running

Suggest URL

Key=c

Suggest URL=

HNetCfg.FwMgr

HNetCfg.FwAuthorizedApplication

]DKizHi-4,exc-1,Hc`hk-3.GI

005345000000

000000000000

000000000010

000000000030

cabinet.dll

TUninstallExecuter

TUninstallExecuter can be created only once.

Report internal param:

CJ[hx.Xu

Report main param:

Report param (pkg:

), exeName:

Uh.sI

GENERIC_WINDOWS

NO_JAR_SUPPORT

ole32.dll

olepro32.dll

IWebBrowser

IWebBrowserApp

IWebBrowser2

TEWBWindowSetResizable

TEWBWindowSetLeft

TEWBWindowSetTop

TEWBWindowSetWidth

TEWBWindowSetHeight

bstrUrlContext

bstrUrl

OnWindowSetResizableL

OnWindowSetLeft

OnWindowSetTop

OnWindowSetWidth

OnWindowSetHeight4

grfKeyState

TComTargetExecEvent

CmdGroup

nCmdID

nCmdexecopt

hhctrl.ocx

URLMON.DLL

SHDOCLC.DLL

rcmDefault

rcmDebug

DontExecuteScripts

DontExecuteJava

DontExecuteActiveX

DisableUrlIfEncodingUTF8

EnableUrlIfEncodingUTF8

CheckFontSupportsCodePage

DisableSubmitUrlInUTF8

EnableSubmitUrlInUTF8

lpMsg

PMsg

pguidCmdGroup

TTranslateUrlEvent

pchURLIn

ppchURLOut

CmdID

pszUrl

pszUrlContext

szPassWord

ErrorUrl

OptionKeyPath

OverrideOptionKeyPath

OnTranslateUrl

OnCommandExec

'%s' is not supported.

TMsgEvent

TKeyEventEx

Port

Password

poPortrait

OnKeyDown0NJ

0.750000

3333333

\Software\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent

\Software\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform

User-agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)

User-agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)(

This object does not support this method (

Unsupported type for Parameter with Index %d

Method call unsuccessful. %s (%s).

eiOnKeyDown

eiOnKeyPress

eiOnKeyUp

Handler with EventID = %s already exists.

Error on IConnectionPoint.Advise

Source don't have connection point for [%s]

JS function sync-execution failed with message:

] execution failed with message:

.html

MAPI32.DLL

LeftPopup

TPipeServer

TPipeObject

TPipeServerListener

TPipeClientU

2.1.0.0

This exe was created with an old version of HtmlAppMaker.

irsoMsgDialog

irsoGetCurExePath

irsoJoinPath

irsoGetCmdLineParam

irsoGetCmdLineCount

irsoGetCmdLineIndexOf

irsoGetCmdLineParamValue

irsoGetCmdLineAll

irsoRegCreateKey

irsoRegCreateKeyTree

irsoRegDeleteKey

irsoIsRegKeyExists

irsoRegListKeyValues

irsoRegListKeyKeys

irsoRegSearchKeyKeys

irsoRegCopyKey

irsoHttpGetData

irsoHttpGetDataInThread

irsoLibraryExecuteProc

irsoLibraryExecuteProcW

irsoLibraryExecuteProcWithResult

!irsoLibraryExecuteProcWithResultW

irsoExecute

irsoShellExecute

irsoExecuteAsNoneAdmin

irsoExecuteWithOutput

irsoExecuteInThread

irsoExecuteInThreadWithOutput

irsoIsMutexExists

irsoGetCurExeCheckSum

irsoSetSQLiteDll

irsoGetSQLiteDll

H-4,njBdi-2,o-4,r.vY

iexplore.exe

firefox.exe

chrome.exe

safari.exe

opera.exe

THtmlUIExeApp

irsoExecutePackage

irsoExecutePackageAsAdmin

irsoReportPackageError

irsoReportPackageSkip

irsoReportPackageQuit

irsoReportPackageSuccess

irsoGetPackageFilenameFromHttp

irsoGetPackageExecExitCode

irsoSetPackageRelProgressShare

irsoIsFireFoxInstalled

irsoIsChromeInstalled

irsoIsOperaInstalled

irsoGetFireFoxHomePage

irsoGetChromeHomePage

irsoGetOperaHomePage

irsoSetFireFoxHomePage

irsoSetChromeHomePage

irsoSetOperaHomePage

irsoGetFireFoxDefaultSP

irsoGetChromeDefaultSP

irsoGetOperaDefaultSP

irsoAddFireFoxDefaultSPFromXML

irsoAddFireFoxDefaultSP

irsoSetFireFoxAddressBar

irsoAddOperaDefaultSP

irsoAddChromeDefaultSP

irsoGetFireFoxEXE

irsoGetIEEXE

irsoGetChromeEXE

irsoGetOperaEXE

irsoGetFireFoxVer

irsoGetChromeVer

irsoGetOperaVer

irsoLocateSQLite

irsoGetFireFoxCookie

irsoGetChromeCookie

irsoIsFireFoxExtensionInstalled

irsoInstallFireFoxAddon

irsoInstallChromeAddon

irsoUninstallAddExeCmd

irsoUninstallAddOpenBrowserCmd

irsoUninstallAddRegistryKey

irsoUninstallExecute

irsoReportStart

irsoSetExclusiveExec

\fuj-1,w U,P\O U,qah`k,.nlvcbqff,-U>

/UnExeFile:

UnExeFile

z`o1caig2,.hf5b Q,0cfh)914`,,34`6;ia2f=ae-3,L1

Cv.aF

Y.Phy

1.2.1

user32.dll

GetKeyboardType

advapi32.dll

RegOpenKeyExA

RegCloseKey

oleaut32.dll

UnhookWindowsHookEx

SetWindowsHookExA

MapVirtualKeyA

LoadKeyboardLayoutA

GetKeyboardState

GetKeyboardLayoutList

GetKeyboardLayout

GetKeyState

GetKeyNameTextA

GetAsyncKeyState

EnumWindows

EnumThreadWindows

EnumChildWindows

ActivateKeyboardLayout

gdi32.dll

SetViewportOrgEx

version.dll

WaitNamedPipeA

PeekNamedPipe

GetWindowsDirectoryW

GetCPInfo

DisconnectNamedPipe

CreatePipe

CreateNamedPipeA

ConnectNamedPipe

RegQueryInfoKeyA

RegOpenKeyExW

RegFlushKey

RegEnumKeyW

RegEnumKeyExA

RegDeleteKeyW

RegDeleteKeyA

RegCreateKeyExW

RegCreateKeyExA

shell32.dll

wininet.dll

comdlg32.dll

;!;$;,;5;

9-9.949799

?"?;?@?~?

4Y5F5P5a5i5s5

4&5(5.51565;5?5?5

7.8.86898:8?8D8F8

5b6c6

8 8$8$8)8-82868

8"8=8]8?9

5-5}5p6l7s8

7v7D7L7[7

4 434>4[4

='?8?;?{?

6!6#6&6 6-6

2b3h3%4S4k4r4

1%2U2

5!5!5&5*5

;)

;2;9;`;|;

223D3

333333333333333333

33333833

3333339

3333333333333338

:*"*"$3338

33333333

33333333333

3333333333338

33338?383

333333333333

:*3:"$3338

333333333333333

Y".jb

.sGQ#

\Rqn-4j}"#

I.ch}4`

Q.tlH9h

.GmQ`

-F}(J

Google\Chrome\Application\chrome.exe

Google\Chrome\User Data\Default\

SRWare Iron\iron.exe

Software\Microsoft\Windows\Shell\Associations\UrlAssociations\http\UserChoice

http\shell\open\command

PathToExe

mozsqlite3.dll

GetChromeDefaultSearchProviderFromDb - failed to get spid!

Google\Chrome

SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome

ChromeExe:

Opera\

\operaprefs.ini

\profile\operaprefs.ini

\profile\opera6.ini

\opera6.ini

Software\Opera Software

locale\en\en.lng

\profile\search.ini

\search.ini

search.ini

\defaults\search.ini

DoRemoveOperaSearchProvider - file

TopResultURLFallback

FaviconURL

FaviconURLFallback

*.txt

Uninstall\Uninstall.exe

Uninstall\uninst.dat

uninst.dat

regsvr32.exe

Execution failed, exeName:

_EXEXE_

errorUrl

Failed to launch htmlUI from the following url:

main.html

Please login as administrator and try again.

.Uninstall\

No help found for %s#No context-sensitive help installed$No topic-based help system installed

OLE error %.8x.Method '%s' not supported by automation object/Variant does not reference an automation object7Dispatch methods do not support more than 64 parameters

OLE error %.8x%License information for %s is invalidPLicense information for %s not found. You cannot use this control in design modeNUnable to retrieve a pointer to a running object registered with OLE for %s/%s

Alt Clipboard does not support Icons/Menu '%s' is already being used by another form

!Control '%s' has no parent window

Metafile is not valid!Cannot change the size of an icon Invalid operation on TOleGraphic

Unsupported clipboard format

Invalid data type for '%s' List capacity out of bounds (%d)

List count out of bounds (%d)

List index out of bounds (%d) Out of memory while expanding memory stream

Error reading %s%s%s: %s

Failed to get data for '%s'

Failed to set data for '%s'

Resource %s not found

%s.Seek not implemented$Operation not allowed on sorted list$%s not in a class registration group

Property %s does not exist

Cannot assign a %s to a %s

Bits index out of range*Can't write to a read-only resource streamECheckSynchronize called from thread $%x, which is NOT the main thread

Class %s not found

A class named %s already exists%List does not allow duplicates ($0%x)#A component named %s already exists%String list does not allow duplicates

Cannot create file %s

Cannot open file %s

Invalid stream format$''%s'' is not a valid component name

Ancestor for '%s' not found

External exception %x

Interface not supported

%s (%s, line %d)

Abstract Error?Access violation at address %p in module '%s'. %s of address %p

System Error. Code: %d.

Invalid variant operation!Invalid variant operation ($%.8x)

Variant is not an array5Could not convert variant of type (%s) into type (%s)=Overflow while converting variant of type (%s) into type (%s)

Operation not supported

Integer overflow Invalid floating point operation

Invalid pointer operation

Invalid class typecast0Access violation at address %p. %s of address %p

Privileged instruction(Exception %s in module %s at %p.

Application Error1Format '%s' invalid or incompatible with argument

No argument for format '%s'"Variant method calls not supported

!'%s' is not a valid integer value('%s' is not a valid floating point value"'%s' is not a valid currency value!'%g' is not a valid date and time

'%s' is not a valid GUID value

I/O error %d

%original file name%.exe_272_rwx_00401000_000D1000:

kernel32.dll

MSWHEEL_ROLLMSG

MSH_WHEELSUPPORT_MSG

MSH_SCROLL_LINES_MSG

$*@@@*$@@@$ *@@* $@@($*)@-$*@@$-*@@$*-@@(*$)@-*$@@*-$@@*$-@@-* $@-$ *@* $-@$ *-@$ -*@*- $@($ *)(* $)

EVariantBadIndexError

htKeyword

EInvalidOperation

u%CNu

%s[%d]

%s_%d

.Owner

EInvalidGraphicOperation

USER32.DLL

comctl32.dll

UrlMon

Uho%C

IE(AL("%s",4),"AL(\"%0:s\",3)","JK(\"%1:s\",\"%0:s\")")

JumpID("","%s")

TKeyEvent

TKeyPressEvent

HelpKeyword

crSQLWait

%s (%s)

IMM32.DLL

AutoHotkeys

ssHotTrack

TWindowState

poProportional

TWMKey

KeyPreview

WindowState

OnKeyDown

OnKeyPress

OnKeyUp

System\CurrentControlSet\Control\Keyboard Layouts\%.8x

vcltest3.dll

User32.dll

2301654879

Vh-0,Cd`jiVhlxwd-0,tLcibD.ZP

TThreadExecuter

TScanAllWindowsCallBackData

Portuguese

i\*.*2XE

i.dwcnhE

Uh-%F

nmhpjhc03.fcclJL

i.ulzn1E

Uh.GF

powrprof.dll

1.2.3

THttpTimeOutThread

THttpCallBackShell

Gx-21,\igh]ixyj-42,M.DJ

A`qjz``-0,ZkdkNgij.pc

Kcqjpc`-0,Aaj-1,gEdafa`.pM

hXXps://

hXXp://

https

SQL error or missing database

An internal logic error in SQLite

Operation terminated by sqlite3_interrupt()

Uses OS features not supported on host

2nd parameter to sqlite3_bind out of range

sqlite3_step() has another row ready

sqlite3_step() has finished executing

Unknown SQLite Error Code

sqlite3.dll

ESQLiteException

TSQLiteDatabaseH

TSQLiteTable

Error executing SQL

Could not prepare SQL statement

Error executing SQL statement

select [sql] from sqlite_master where [type] = 'table' and lower(name) = '

Could not prepare SQL statement

SQLite is Busy

SOFTWARE\Mozilla\Mozilla Firefox

cookies.sqlite

session\urls_to_restore_on_startup\[size]

session\urls_to_restore_on_startup

session\urls_to_restore_on_startup\0

SELECT value FROM meta WHERE key='Default Search Provider ID'

SELECT short_name FROM keywords WHERE id='

GetChromeDefaultSearchProviderFromDb - got provider:

GetChromeDefaultSearchProviderFromDb - exception:

UPDATE keywords SET sync_guid='

UPDATE keywords SET instant_url='' WHERE id=

keywords_backup

DROP TABLE keywords_backup

CREATE TABLE keywords_backup AS SELECT * FROM keywords ORDER BY id ASC

autogenerate_keyword ||

SELECT id || short_name || keyword || favicon_url || url || safe_for_autoreplace || originating_url || date_created || usage_count || input_encodings || show_in_default_list || suggest_url || prepopulate_id ||

created_by_policy || instant_url || last_modified || sync_guid

FROM keywords ORDER BY id ASC

RemoveChromeSearchProvider - cannot remove

RemoveChromeSearchProvider -

DELETE from keywords WHERE short_name='

RemoveChromeSearchProvider - exception:

SELECT id FROM keywords WHERE short_name='

Opera

Home URL

Amazon.com

eBay.com

Merriam-Webster

Opera Preferences version 2.0

; Do not edit this file while Opera is running

Suggest URL

Key=c

Suggest URL=

HNetCfg.FwMgr

HNetCfg.FwAuthorizedApplication

]DKizHi-4,exc-1,Hc`hk-3.GI

005345000000

000000000000

000000000010

000000000030

cabinet.dll

TUninstallExecuter

TUninstallExecuter can be created only once.

Report internal param:

CJ[hx.Xu

Report main param:

Report param (pkg:

), exeName:

Uh.sI

GENERIC_WINDOWS

NO_JAR_SUPPORT

ole32.dll

olepro32.dll

IWebBrowser

IWebBrowserApp

IWebBrowser2

TEWBWindowSetResizable

TEWBWindowSetLeft

TEWBWindowSetTop

TEWBWindowSetWidth

TEWBWindowSetHeight

bstrUrlContext

bstrUrl

OnWindowSetResizableL

OnWindowSetLeft

OnWindowSetTop

OnWindowSetWidth

OnWindowSetHeight4

grfKeyState

TComTargetExecEvent

CmdGroup

nCmdID

nCmdexecopt

hhctrl.ocx

URLMON.DLL

SHDOCLC.DLL

rcmDefault

rcmDebug

DontExecuteScripts

DontExecuteJava

DontExecuteActiveX

DisableUrlIfEncodingUTF8

EnableUrlIfEncodingUTF8

CheckFontSupportsCodePage

DisableSubmitUrlInUTF8

EnableSubmitUrlInUTF8

lpMsg

PMsg

pguidCmdGroup

TTranslateUrlEvent

pchURLIn

ppchURLOut

CmdID

pszUrl

pszUrlContext

szPassWord

ErrorUrl

OptionKeyPath

OverrideOptionKeyPath

OnTranslateUrl

OnCommandExec

'%s' is not supported.

TMsgEvent

TKeyEventEx

Port

Password

poPortrait

OnKeyDown0NJ

0.750000

3333333

\Software\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent

\Software\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform

User-agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)

User-agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)(

This object does not support this method (

Unsupported type for Parameter with Index %d

Method call unsuccessful. %s (%s).

eiOnKeyDown

eiOnKeyPress

eiOnKeyUp

Handler with EventID = %s already exists.

Error on IConnectionPoint.Advise

Source don't have connection point for [%s]

JS function sync-execution failed with message:

] execution failed with message:

.html

MAPI32.DLL

LeftPopup

TPipeServer

TPipeObject

TPipeServerListener

TPipeClientU

2.1.0.0

This exe was created with an old version of HtmlAppMaker.

irsoMsgDialog

irsoGetCurExePath

irsoJoinPath

irsoGetCmdLineParam

irsoGetCmdLineCount

irsoGetCmdLineIndexOf

irsoGetCmdLineParamValue

irsoGetCmdLineAll

irsoRegCreateKey

irsoRegCreateKeyTree

irsoRegDeleteKey

irsoIsRegKeyExists

irsoRegListKeyValues

irsoRegListKeyKeys

irsoRegSearchKeyKeys

irsoRegCopyKey

irsoHttpGetData

irsoHttpGetDataInThread

irsoLibraryExecuteProc

irsoLibraryExecuteProcW

irsoLibraryExecuteProcWithResult

!irsoLibraryExecuteProcWithResultW

irsoExecute

irsoShellExecute

irsoExecuteAsNoneAdmin

irsoExecuteWithOutput

irsoExecuteInThread

irsoExecuteInThreadWithOutput

irsoIsMutexExists

irsoGetCurExeCheckSum

irsoSetSQLiteDll

irsoGetSQLiteDll

H-4,njBdi-2,o-4,r.vY

iexplore.exe

firefox.exe

chrome.exe

safari.exe

opera.exe

THtmlUIExeApp

irsoExecutePackage

irsoExecutePackageAsAdmin

irsoReportPackageError

irsoReportPackageSkip

irsoReportPackageQuit

irsoReportPackageSuccess

irsoGetPackageFilenameFromHttp

irsoGetPackageExecExitCode

irsoSetPackageRelProgressShare

irsoIsFireFoxInstalled

irsoIsChromeInstalled

irsoIsOperaInstalled

irsoGetFireFoxHomePage

irsoGetChromeHomePage

irsoGetOperaHomePage

irsoSetFireFoxHomePage

irsoSetChromeHomePage

irsoSetOperaHomePage

irsoGetFireFoxDefaultSP

irsoGetChromeDefaultSP

irsoGetOperaDefaultSP

irsoAddFireFoxDefaultSPFromXML

irsoAddFireFoxDefaultSP

irsoSetFireFoxAddressBar

irsoAddOperaDefaultSP

irsoAddChromeDefaultSP

irsoGetFireFoxEXE

irsoGetIEEXE

irsoGetChromeEXE

irsoGetOperaEXE

irsoGetFireFoxVer

irsoGetChromeVer

irsoGetOperaVer

irsoLocateSQLite

irsoGetFireFoxCookie

irsoGetChromeCookie

irsoIsFireFoxExtensionInstalled

irsoInstallFireFoxAddon

irsoInstallChromeAddon

irsoUninstallAddExeCmd

irsoUninstallAddOpenBrowserCmd

irsoUninstallAddRegistryKey

irsoUninstallExecute

irsoReportStart

irsoSetExclusiveExec

\fuj-1,w U,P\O U,qah`k,.nlvcbqff,-U>

/UnExeFile:

UnExeFile

z`o1caig2,.hf5b Q,0cfh)914`,,34`6;ia2f=ae-3,L1

Cv.aF

Google\Chrome\Application\chrome.exe

Google\Chrome\User Data\Default\

SRWare Iron\iron.exe

Software\Microsoft\Windows\Shell\Associations\UrlAssociations\http\UserChoice

http\shell\open\command

PathToExe

mozsqlite3.dll

GetChromeDefaultSearchProviderFromDb - failed to get spid!

Google\Chrome

SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome

ChromeExe:

Opera\

\operaprefs.ini

\profile\operaprefs.ini

\profile\opera6.ini

\opera6.ini

Software\Opera Software

locale\en\en.lng

\profile\search.ini

\search.ini

search.ini

\defaults\search.ini

DoRemoveOperaSearchProvider - file

TopResultURLFallback

FaviconURL

FaviconURLFallback

*.txt

Uninstall\Uninstall.exe

Uninstall\uninst.dat

uninst.dat

regsvr32.exe

Execution failed, exeName:

_EXEXE_

errorUrl

Failed to launch htmlUI from the following url:

main.html

Please login as administrator and try again.

.Uninstall\

Summary

Dynamic Analysis

Removals

Static Analysis

Network Activity

Map

Strings from Dumps