Gen.Variant.Adware.Graftor.188840_5b61a91198

Dynamic Analysis

Payload

No specific payload has been found.

Process activity

The Trojan creates the following process(es):No processes have been created.The Trojan injects its code into the following process(es):

tmp2.tmp:612
cpSetup.exe:1988
%original file name%.exe:1156

Mutexes

The following mutexes were created/opened:No objects were found.

File activity

The process tmp2.tmp:612 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nsc4.tmp\nsArray.dll (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsc4.tmp\cpSetup.exe (5657 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsc4.tmp\1199306015 (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsc4.tmp\NSISdl.dll (15 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nsc4.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn3.tmp (0 bytes)

The process cpSetup.exe:1988 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\000cdbcf.a (1691 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000ccf7a.a (28 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsk6.tmp (14 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsk7.tmp\1b18d9a7-5a11-4bf0-861e-81b5c12fd397.dll (11 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nsk5.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsk7.tmp (0 bytes)

The process %original file name%.exe:1156 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\tmp1.tmp (6334 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\tmp2.tmp (14230 bytes)

Registry activity

The process tmp2.tmp:612 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "F8 4A 32 FA CD 44 3D E9 73 70 F2 DB 07 2E 6A CD"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

The process cpSetup.exe:1988 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "44 AA B8 65 50 60 EC 3F B5 BD E0 7A A1 F4 A4 42"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass" = "1"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

"IntranetName" = "1"

The process %original file name%.exe:1156 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "F9 3E 04 93 38 13 A8 7A 84 5A 8F C3 20 AB 01 8C"

Dropped PE files

MD5	File path
b2ed02c6fb911155dde9fde4599171a5	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\000ccf7a.a
b82329a96f83f950e0a9d143db001d53	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\000cdbcf.a
7caaf58a526da33c24cbe122e7839693	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nsc4.tmp\NSISdl.dll
115707359622f58e905eea0cc40036af	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nsc4.tmp\cpSetup.exe
89d40ecddf3ce6f3b0e6a84f40936912	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nsc4.tmp\nsArray.dll
a5fe75b45fb8874e72b7238d7f7c0967	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nsk7.tmp\1b18d9a7-5a11-4bf0-861e-81b5c12fd397.dll
a294582b51caca3ab9d47a87e089a9dd	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\tmp1.tmp
4a5c7586dd05e6a6e180273f01cc1a55	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\tmp2.tmp

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

Removals

Remove it with Ad-Aware

1. Click (here) to download and install Ad-Aware Free Antivirus.
2. Update the definition files.
3. Run a full scan of your computer.

Manual removal*

1. Terminate malicious process(es) (How to End a Process With the Task Manager):No processes have been created.
2. Delete the original Trojan file.
   
3. Delete or disinfect the following files created/modified by the Trojan:

   %Documents and Settings%\%current user%\Local Settings\Temp\nsc4.tmp\nsArray.dll (6 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsc4.tmp\cpSetup.exe (5657 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsc4.tmp\1199306015 (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsc4.tmp\NSISdl.dll (15 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000cdbcf.a (1691 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\000ccf7a.a (28 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsk6.tmp (14 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsk7.tmp\1b18d9a7-5a11-4bf0-861e-81b5c12fd397.dll (11 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\tmp1.tmp (6334 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\tmp2.tmp (14230 bytes)

4. Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
   
5. Reboot the computer.
   

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

VersionInfo

Company Name: NCH Software
Product Name: WavePad
Product Version:
Legal Copyright: NCH Software
Legal Trademarks:
Original Filename:
Internal Name: WavePad
File Version: 5.95
File Description: WavePad Sound Editor
Comments:
Language: English

Company Name: NCH SoftwareProduct Name: WavePadProduct Version: Legal Copyright: NCH SoftwareLegal Trademarks: Original Filename: Internal Name: WavePadFile Version: 5.95 File Description: WavePad Sound EditorComments: Language: English

PE Sections

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Section MD5
.text	4096	499712	496640	4.53998	68df1e629c2deefbc755df7be6191378
.data	503808	94208	56320	2.65859	cc69a5fea5a0f7859dfcece2418fadc3
.tls	598016	4096	512	0	bf619eac0cdf3f68d496ea9344137e8b
.rdata	602112	4096	512	0.146134	06d040c8632d6ec782abc37cc386ade1
.idata	606208	12288	10752	3.47336	8ef80f865fb56b54f3ec5032dedce1a4
.edata	618496	4096	512	1.04563	fe5b11d2b2890f421d84c05e4a717f7f
.rsrc	622592	27104	27136	3.40533	c56785e68a559a2bbc56bde35b417da8
.reloc	651264	36864	33280	4.60394	d19d6b13bba6d39cc0ee2ff8629328a2

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Network Activity

URLs

URL	IP
hxxp://fc-rich.space/launch_askar.php?p=sevenzip&tid=4196400&pid=1505&n=V2F2ZXBhZCBzb3VuZCBlZGl0b3IgbWFzdGVycyBlZGl0aW9uIDUuOTUgY3JhY2sgWzE1MDUxNUJBUF0=&b_typ=pe	46.21.100.248
hxxp://d1gahxamcuu9d3.cloudfront.net/stub_maker.php?program=sevenzip&tid=4196400&pid=1505&b_typ=pe&reb=1&name=Wavepad sound editor masters e&t=first&truename=/InstallerSetup.exe
hxxp://dna4mm5c1mahl.cloudfront.net/launch_v5.php?p=sevenzip&pid=1505&tid=4196400&b_typ=pe&n=V2F2ZXBhZCBzb3VuZCBlZGl0b3IgbWFzdGVycyBl&reb=1&ic=
hxxp://d24txo22v2kbr3.cloudfront.net/?affId=1006&appTitle=Wavepad%20sound%20editor%20masters%20e&s1=1505&s2=4196400&setupName=cpSetup&appVersion=2.92&instId=11
hxxp://capital.go2cloud.org/aff_c?offer_id=4&aff_id=1006&source=11&aff_sub=1505&aff_sub2=4196400&aff_sub3=0&aff_sub4=0&aff_sub5=0&url=http://up.dibida-22.xyz/offer.php?affId={aff_id}&trackingId=1890954&instId=11&ho_trackingid={transaction_id}&cc=UA	54.246.209.153
hxxp://up.dibida-22.xyz/offer.php?affId=1006&trackingId=1890954&instId=11&ho_trackingid=102e80269c556c013592751483006f&cc=UA	216.137.61.108
hxxp://up.dibida-22.xyz/installer.php?affId=1006&instId=11&ho_trackingid=102e80269c556c013592751483006f&trackingId=1890954&cc=UA	216.137.61.108
hxxp://up.cp-int-45.xyz/installer.php?affId=1006&instId=11&ho_trackingid=102e80269c556c013592751483006f&trackingId=1890954&cc=UA	54.88.21.193
hxxp://up.dibida-22.xyz/installer.php?affId=1006&instId=11&ho_trackingid=102e80269c556c013592751483006f&trackingId=1890954&cc=UA&id[]=29&id[]=34&id[]=35&id[]=36&id[]=37&id[]=38&id[]=39&id[]=40&id[]=41&id[]=42&id[]=43&id[]=44&id[]=45&id[]=46&id[]=47&id[]=48&id[]=49&id[]=50&id[]=51&id[]=52&id[]=53&id[]=54&id[]=55&id[]=56&id[]=57	216.137.61.108
hxxp://up.cp-int-45.xyzhxxp://up.cp-int-45.xyz/installer.php?affId=1006&instId=11&ho_trackingid=102e80269c556c013592751483006f&trackingId=1890954&cc=UA	54.88.21.193
hxxp://up.dibida-22.xyzhxxp://up.dibida-22.xyz/installer.php?affId=1006&instId=11&ho_trackingid=102e80269c556c013592751483006f&trackingId=1890954&cc=UA&id[]=29&id[]=34&id[]=35&id[]=36&id[]=37&id[]=38&id[]=39&id[]=40&id[]=41&id[]=42&id[]=43&id[]=44&id[]=45&id[]=46&id[]=47&id[]=48&id[]=49&id[]=50&id[]=51&id[]=52&id[]=53&id[]=54&id[]=55&id[]=56&id[]=57	216.137.61.108
hxxp://capital.go2cloud.orghxxp://capital.go2cloud.org/aff_c?offer_id=4&aff_id=1006&source=11&aff_sub=1505&aff_sub2=4196400&aff_sub3=0&aff_sub4=0&aff_sub5=0&url=http://up.dibida-22.xyz/offer.php?affId={aff_id}&trackingId=1890954&instId=11&ho_trackingid={transaction_id}&cc=UA	54.246.209.153
hxxp://up.int-ic-4.xyz/launch_v5.php?p=sevenzip&pid=1505&tid=4196400&b_typ=pe&n=V2F2ZXBhZCBzb3VuZCBlZGl0b3IgbWFzdGVycyBl&reb=1&ic=	216.137.61.225
hxxp://get.free-me-ic.xyz/?affId=1006&appTitle=Wavepad%20sound%20editor%20masters%20e&s1=1505&s2=4196400&setupName=cpSetup&appVersion=2.92&instId=11	216.137.61.10
hxxp://up.dibida-22.xyzhxxp://up.dibida-22.xyz/offer.php?affId=1006&trackingId=1890954&instId=11&ho_trackingid=102e80269c556c013592751483006f&cc=UA	216.137.61.108
hxxp://up.dibida-22.xyzhxxp://up.dibida-22.xyz/installer.php?affId=1006&instId=11&ho_trackingid=102e80269c556c013592751483006f&trackingId=1890954&cc=UA	216.137.61.108
hxxp://dl.fripp54.xyz/stub_maker.php?program=sevenzip&tid=4196400&pid=1505&b_typ=pe&reb=1&name=Wavepad sound editor masters e&t=first&truename=/InstallerSetup.exe	216.137.61.110

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

GET /?affId=1006&appTitle=Wavepad%20sound%20editor%20masters%20e&s1=1505&s2=4196400&setupName=cpSetup&appVersion=2.92&instId=11 HTTP/1.0

Host: get.free-me-ic.xyz

User-Agent: NSISDL/1.2 (Mozilla)

Accept: */*

HTTP/1.1 200 OK

Content-Type: application/octet-stream

Content-Length: 52912

Connection: close

Server: Microsoft-IIS/8.5

X-Powered-By: PHP/5.3.28

Content-Transfer-Encoding: Binary

Content-Disposition: attachment; filename="cpSetup.exe"

Date: Tue, 06 Oct 2015 03:27:29 GMT

X-Cache: Miss from cloudfront

Via: 1.1 e24fef4a7b03bd84e1e8d57f2471a84d.cloudfront.net (CloudFront)

X-Amz-Cf-Id: pk4dj2AcNFRcMqKpRwwN-wrKfAnYbSHq2EqTrlR9_56o3NPBxkmhhw==

MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......1p.:u..iu..iu..i...iw..iu..i...i...id..i!2.i...i...it..iRichu..i........PE..L....\.U.................^...........2.......p....@.......................................@..................................s.......... -...........................................................................p...............................text...:\.......^.................. ..`.rdata.......p.......b..............@..@.data................t..............@....ndata.......@...........................rsrc... -...........x..............@..@........................................................................................................................................................................................................................................................................................................................................................................................U....\.}..t .}.F.E.u..H.....7B..H.P.u..u..u....r@..B...SV.5.7B..E.WP.u....r@..e...E..E.P.u....r@..}..e....Lp@........FR..VV..U... M.......M....3.....FQ.....NU..M..........VT..U.....FP..E...............E.P.M...Tp@..E...E.P.E.P.u....r@..u....E..9}...w....~X.te.v4..Dp@....E.tU.}.j.W.E......E.......@p@..vXW..Hp@..u..5<p@.W...E..E.h ...Pj.h./B.W...r@..u.W...u....E.P.u...\r@._^3.[.....L$..(7B...Si.....VW.T.....tO.q.3.;5,7B.sB..i......D.......t.G.....t...O..t .....u...3....3...F.....;5,7B.r._^[...U..QQ.U.SV..i.

<<< skipped >>>

GET /launch_askar.php?p=sevenzip&tid=4196400&pid=1505&n=V2F2ZXBhZCBzb3VuZCBlZGl0b3IgbWFzdGVycyBlZGl0aW9uIDUuOTUgY3JhY2sgWzE1MDUxNUJBUF0=&b_typ=pe HTTP/1.1

User-Agent: Mozilla/5.0 (Windows NT 6.3; rv:36.0) Gecko/20100101 Firefox/36.0

Host: fc-rich.space

Connection: Keep-Alive

Cache-Control: no-cache

Pragma: no-cache

HTTP/1.1 200 OK

Date: Tue, 06 Oct 2015 03:27:22 GMT

Server: Apache/2.2.15 (CentOS)

X-Powered-By: PHP/5.3.3

Content-Length: 176

Connection: close

Content-Type: text/html; charset=UTF-8

first:hXXp://dl.fripp54.xyz/stub_maker.php?program=sevenzip&tid=4196400&pid=1505&b_typ=pe&reb=1&name=Wavepad sound editor masters e&t=first&truename=/InstallerSetup.exe..

GET hXXp://up.dibida-22.xyz/offer.php?affId=1006&trackingId=1890954&instId=11&ho_trackingid=102e80269c556c013592751483006f&cc=UA HTTP/1.1

Host: up.dibida-22.xyz

Connection: close

Accept: */*

User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; fr; rv:1.8.1.3) Gecko/20070309 Firefox/2.0.0.3

HTTP/1.1 200 OK

Content-Type: text/html

Content-Length: 28712

Connection: close

Server: Microsoft-IIS/8.5

X-Powered-By: PHP/5.3.28

Date: Tue, 06 Oct 2015 03:27:30 GMT

X-Cache: Miss from cloudfront

Via: 1.1 8a4d4882753d62d900bb1b7541308eca.cloudfront.net (CloudFront)

X-Amz-Cf-Id: -2mZklRUHcEhktfA-zqypfO1XtUitycEDq8hPwLJIFX-CHNP6WHXQw==

. 7;...d.{....q...<w...?..._|K.m....6.......i..........").. ..8..>....2..T....u.\....K.....=....-......Y....=.%..E.....s....y...@R.z.S<?.n....$..............:.aq..z....V.....i/......8"#..d^.Vn..A*C(......i..]tnp... D..'$......7...n...v...#q...V.Y..[.=.*....%l....)Gn..nN.{z0M..$m..r......k.R.PaY~vB.Z;'..&..5..adc...-.....,i....n.yR.^.R.YLaV.....Cq..j......l^.kZV$."Y_..B.h..d..............T.W...<.....].>..'i^.!..G3..h......]zj.2@.f..58..L.x....>.........D7Q...G.M.W.........>..qu.q#{.....Q..........L}...ST.).i..>~........b>8.. .`..`M.....S<J%@...p....O{".d9...2...S.. ..YG....^*....#UZ-q.`..i..\6Cf..8....r....0o^;....r........k.f...Q.M..`.#.....;7|?A..D..\......!".I.A.VF..Y..D..d..1`...|-Wv..[.....GG....tVR.....V.5h..._ .k..i...SX..:y .S.8]j...K)i}...[...T k........N|..v...5........./....qa.P..T...>d)z.lyIW......R.s>f..j.A/v.....l... .S....cM.m..S..MI..a.....y..M..C.....W....NC# ..d..SY.e..Py..[3..e..Br.~..... .e..mw..X..B ....j..eyI..kb ^.M._..8Q..@u.o.....D.........g...<U.........,........_.!r.{.....*....e...%}T&].>.R....D...i....bT2....|.#/. ....... .y..p...ek......I58G....G.|...j{).99...ft......\3.......W...T#...X..Y/..F7.."..S f..{..c.v........$c!.X....m....?..../.h.}x...$r..I<h.....Ezi.... *..^......4......C..R.@v.E.......-FU.....jhz.D....*&y.Adlt... y...m.....Y#'-....#..B..H...8.. .V.?..^f.J............=~..v;.}.D..4.`K(.'....*.....I.#.M..6.n..B.A.c6.J.....x.6..h .7\yE............A.d';E...N..@...Y[..1..L.........u71..L..5.;.@...kG......AfR.C....#.....(.....".....A!

<<< skipped >>>

GET /stub_maker.php?program=sevenzip&tid=4196400&pid=1505&b_typ=pe&reb=1&name=Wavepad sound editor masters e&t=first&truename=/InstallerSetup.exe HTTP/1.1

User-Agent: Mozilla/5.0 (Windows NT 6.3; rv:36.0) Gecko/20100101 Firefox/36.0

Host: dl.fripp54.xyz

Connection: Keep-Alive

Cache-Control: no-cache

Pragma: no-cache

HTTP/1.1 200 OK

Content-Type: application/force-download

Content-Length: 75767

Connection: keep-alive

Server: Microsoft-IIS/7.5

X-Powered-By: PHP/5.3.28

Content-Disposition: attachment; filename="56133f7aa6bc8.exe"

X-Powered-By: ASP.NET

Date: Tue, 06 Oct 2015 03:26:51 GMT

X-Cache: Miss from cloudfront

Via: 1.1 b098e6f4643cebda4b3dc6797be9944c.cloudfront.net (CloudFront)

X-Amz-Cf-Id: wehxoCjZK7yBchNfMu7MDgWJbppe-hwGIR9bd8THxDK5O2oM3n2AOw==

MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......aKZe%*46%*46%*46,R.6&*46,R.64*46%*56.*46>..6 *46>..6$*46>..6$*46Rich%*46........PE..L.....GO.................p....>..B...8............@...........................O...........@.................................4.........N.......................?.H....................................................................................text....o.......p.................. ..`.rdata..b*.......,...t..............@..@.data....f>.........................@....ndata....... ?..........................rsrc.........N.....................@..@.reloc...2....N..4..................@..B........................................................................................................................................................................................................................................................................................................................................U....\.}..t .}.F.E.u..H.........H.P.u..u..u.....@..K...SV.5....W.E.P.u.....@..e...E..E.P.u.....@..}..e....D.@........FR..VV..U... M..........M........E...FQ.....NU..M.......M...VT..U........FP..E...............E.P.M...H.@..E..P.E..E.P.u.....@..u....E..9}...n....~X.te.v4..L.@..E...tU.}.j.W.E......E.......P.@..vXW..T.@..u..5X.@.W..h ....E..E.Pj.h..~.W....@..u.W...u....E.P.u.....@._^3.[.....L$........i. @...T.....tUVW.q.3.;5....sD..i. @...D..S.....t.G.....t...O..t .....u...3....3...F. @..;5....r

<<< skipped >>>

GET hXXp://up.dibida-22.xyz/installer.php?affId=1006&instId=11&ho_trackingid=102e80269c556c013592751483006f&trackingId=1890954&cc=UA&id[]=29&id[]=34&id[]=35&id[]=36&id[]=37&id[]=38&id[]=39&id[]=40&id[]=41&id[]=42&id[]=43&id[]=44&id[]=45&id[]=46&id[]=47&id[]=48&id[]=49&id[]=50&id[]=51&id[]=52&id[]=53&id[]=54&id[]=55&id[]=56&id[]=57 HTTP/1.1

Host: up.dibida-22.xyz

Connection: close

Accept: */*

User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; fr; rv:1.8.1.3) Gecko/20070309 Firefox/2.0.0.3

HTTP/1.1 200 OK

Content-Type: text/html

Content-Length: 410152

Connection: close

Server: Microsoft-IIS/8.5

X-Powered-By: PHP/5.3.28

Date: Tue, 06 Oct 2015 03:27:33 GMT

X-Cache: Miss from cloudfront

Via: 1.1 2ce6276171358bf7d052aa190ed98f8d.cloudfront.net (CloudFront)

X-Amz-Cf-Id: RABP6hsoSMs9O3sMu5wAtCbfh-eO2VmDlmYLSwXRKFUL9e2L9E3SpA==

(.<~.MS......]....#...k..<.{....2..`....-.>.#..d,...9l....i.G.z}.k..u.j q3.&.Z..-UNCf.@...BI..O>...?...}..f=[...~H.`...r...p.N:.....l..M..E}..A/..Q.....m..o...`..zS....|w$I=.....'...hy...r^.:1_...:.."J.....9.d...,f.}...f.4!.$.K........!.......>.b...=......\.....T....T......|.X...H...............4.7D..UO...;x,..,....r;w....4.1..[......u.i..yF.r[.4.9S.m.....$U.............E.7....f...8....Q.a..G$.=..dn.|q......9.....zy..%..'.o...LD.|.Jr......G..q7..`..DA\.*...M.~.c.A..Q.F.WcZ.P...;\....cO.z...n..:...p..cyA....l....z i.Y.-I........K.W.....l....=/h..@..~th.N,..a.{1.M...2.,..lO.&..Q..Ox....20......87..sC....{....t.[........G..[..........&....yd.-.S!.,..#......W.....,j ..:.1.|.......p....<.?WGSu. Q.u. 7m.;.....,6..Q..N _.4$&$S;N..i[v.........,.)..<.....L.7d.3^{....>....S1..9;...?..9.^..l`.Fz.6dr8U......6.8....B...dc..F.!..Vwi.9j%.....G....b...i....o......E2...6...H\{q...OxAV.3..........jE.2.Z....cB.rIs(.u.M...AU....qxd2.[...g/.4...m)5.r.JN...,QP~hs=.......M.g5q.P.4)..b....nH.....;.b....3\.u.uxD.'C.......P..:.Z....(...D.u.%\....rd.-.O..g}5...V?[~.R..F.....[e......E.....L.-T..i.O....v[.F....\7f3..^.xu..<})^..h...]........o.zw.\..`.........b....MQ .>.%.....Hs...._...}U.PA.X.a_YUs5.._.;pV..._.m....ofs..Y...;..U~.V%... ..`.....r`...w......6....R...4..K_.1.N......-9e..N..>rJ.ob.}^.$.*...R.. ..8...rg}...x`...tTz.'.e.JP&...d........>..pJ.V."P~....~... ..H..v..UJF......~....E.nlA...Q.._./]....Z..q../..6G.`!...........-.Gc#7...f..h...`gn.pO.vLx....v.e^.u.......Gqs$.<..r.Nw......g..5Q.*...X

<<< skipped >>>

GET hXXp://capital.go2cloud.org/aff_c?offer_id=4&aff_id=1006&source=11&aff_sub=1505&aff_sub2=4196400&aff_sub3=0&aff_sub4=0&aff_sub5=0&url=http://up.dibida-22.xyz/offer.php?affId={aff_id}&trackingId=1890954&instId=11&ho_trackingid={transaction_id}&cc=UA HTTP/1.1

Host: capital.go2cloud.org

Connection: close

Accept: */*

User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; fr; rv:1.8.1.3) Gecko/20070309 Firefox/2.0.0.3

HTTP/1.1 302 Found

Cache-Control: no-cache, no-store, must-revalidate

Content-Type: text/html; charset=iso-8859-1

Date: Tue, 06 Oct 2015 03:27:28 GMT

Expires: Sat, 26 Jul 1997 05:00:00 GMT

Location: hXXp://up.dibida-22.xyz/offer.php?affId=1006&trackingId=1890954&instId=11&ho_trackingid=102e80269c556c013592751483006f&cc=UA

P3P: CP="NOI CUR OUR NOR INT"

Pragma: no-cache

Server: nginx/1.7.9

Set-Cookie: enc_aff_session_4=ENC02754-102e80269c556c013592751483006f-1006-4-0-0-0-0-UA-2-3131-31353035-34313936343030-30-30-30-194.242.96.218-20151005232728-_-7F2D731E05743562753D171F441B61027368636E1C4E750408396B7E46645051194902486010165464; expires=Thu, 05 Nov 2015 03:27:28 GMT; path=/;

Set-Cookie: ho_mob=eyJtb2JpbGVfZGV2aWNlX29zIjoiRGVza3RvcCIsIm1vYmlsZV9kZXZpY2VfbW9kZWwiOiJGaXJlZm94IiwibW9iaWxlX2RldmljZV9icmFuZCI6Ik1vemlsbGEiLCJtb2JpbGVfYnJvd3NlciI6IkZpcmVmb3ggRGVza3RvcCIsIm1vYmlsZV9icm93c2VyX3ZlcnNpb24iOiIyLjAiLCJtb2JpbGVfY2FycmllciI6Ij8iLCJ1c2VyX2FnZW50IjoiTW96aWxsYS81LjAgKFdpbmRvd3M7IFU7IFdpbmRvd3MgTlQgNS4xOyBGcjsgUnY6MS44LjEuMykgR2Vja28vMjAwNzAzMDkgRmlyZWZveC8yLjAuMC4zIiwiY29ubmVjdGlvbl9zcGVlZCI6ImJyb2FkYmFuZCJ9; expires=Thu, 30 Aug 2018 14:07:28 GMT; path=/;

tracking_id: 102e80269c556c013592751483006f

X-Robots-Tag: noindex, nofollow

Content-Length: 324

Connection: Close

<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">.<html><head>.<title>302 Found</title>.</head><body>.<h1>Found</h1>.<p>The document has moved <a href="hXXp://up.dibida-22.xyz/offer.php?affId=1006&trackingId=1890954&instId=11&ho_trackingid=102e80269c556c013592751483006f&cc=UA">here</a>.</p>.</body></html>...

<<< skipped >>>

POST hXXp://up.dibida-22.xyz/installer.php?affId=1006&instId=11&ho_trackingid=102e80269c556c013592751483006f&trackingId=1890954&cc=UA HTTP/1.1

Host: up.dibida-22.xyz

Connection: close

Accept: */*

User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; fr; rv:1.8.1.3) Gecko/20070309 Firefox/2.0.0.3

Content-Type: application/x-www-form-urlencoded

id[]=29&id[]=34&id[]=35&id[]=36&id[]=37&id[]=38&id[]=39&id[]=40&id[]=41&id[]=42&id[]=43&id[]=44&id[]=45&id[]=46&id[]=47&id[]=48&id[]=49&id[]=50&id[]=51&id[]=52&id[]=53&id[]=54&id[]=55&id[]=56&id[]=57

HTTP/1.1 403 Forbidden

Server: CloudFront

Date: Tue, 06 Oct 2015 03:27:29 GMT

Content-Type: text/html

Content-Length: 689

Connection: close

X-Cache: Error from cloudfront

Via: 1.1 015c1e778cc5d31da28c11dae16786ab.cloudfront.net (CloudFront)

X-Amz-Cf-Id: 0wtaDyQOWj55DeRqeiSaPnXO9aUT8JYZO6WyUAm1j4RJpKWPKYeh2A==

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://VVV.w3.org/TR/html4/loose.dtd">.<HTML><HEAD><META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=iso-8859-1">.<TITLE>ERROR: The request could not be satisfied</TITLE>.</HEAD><BODY>.<H1>ERROR</H1>.<H2>The request could not be satisfied.</H2>.<HR noshade size="1px">.This distribution is not configured to allow the HTTP request method that was used for this request. The distribution supports only cachable requests..<BR clear="all">.<HR noshade size="1px">.<PRE>.Generated by cloudfront (CloudFront).Request ID: 0wtaDyQOWj55DeRqeiSaPnXO9aUT8JYZO6WyUAm1j4RJpKWPKYeh2A==.</PRE>.<ADDRESS>.</ADDRESS>.</BODY></HTML>..

GET /launch_v5.php?p=sevenzip&pid=1505&tid=4196400&b_typ=pe&n=V2F2ZXBhZCBzb3VuZCBlZGl0b3IgbWFzdGVycyBl&reb=1&ic= HTTP/1.0

Host: up.int-ic-4.xyz

User-Agent: NSISDL/1.2 (Mozilla)

Accept: */*

HTTP/1.1 200 OK

Content-Type: text/html; charset=UTF-8

Content-Length: 1568

Connection: close

Date: Tue, 06 Oct 2015 03:27:24 GMT

Server: Apache/2.2.15 (CentOS)

X-Powered-By: PHP/5.3.3

X-Cache: Miss from cloudfront

Via: 1.1 9e2316f9bf6c03b8640526708b3cdb00.cloudfront.net (CloudFront)

X-Amz-Cf-Id: To_ES17GbZ5-8HfiiHJYXsL64jid20GF4mXsAqRhHskZu7f1cQ5eFA==

files=4.t1=dl.u1=hXXp://get.free-me-ic.xyz/?affId=1006&appTitle=Wavepad%20sound%20editor%20masters%20e&s1=1505&s2=4196400&setupName=cpSetup&appVersion=2.92&instId=11.n1=cpSetup.exe.b1=cp.c1=sevenzip-1.s1=0.m1=0.d1=0.t2=dl.u2=hXXp://d2xthso60kkbfb.cloudfront.net/ru/setup-ru-4.exe.n2=setup-1228.exe.b2=ru.c2=sevenzip-2.s2=0.m2=1.d2=1500.t3=dl.u3=hXXp://VVV.amonisto.org/download.php?version=1.1.5.26&campid=2140&instid[appname]=&instid[appsetupurl]=http://pe-sixi.com/downloadS.php?bu=am&instid[cmdline]=/S&instid[appimageurl]=http:/%2Fpe-sixi.com/img/icon_installer.png&prefix=Setup&instid[thankyoupage]=.n3=Setup__2140_il20.exe.b3=am.c3=2140-sevenzip.s3=0.m3=0.d3=0.t4=dl.u4=hXXp://stapi.sweetcomet.com/api/stamp/setup.exe?&affiliateid=1780&productname=Wavepad%20sound%20editor%20masters%20e&producturl=http://d3pccup19xda2t.cloudfront.net/sevenzip-setup-ap.exe&productimage=http://d3pccup19xda2t.cloudfront.net/pe/szip_pub.png&productversion=9.20&producteula=http://sevenzip.info/terms.html&productsize=1.06MB&productcmd=s&publishercontact=http:/%2Fsevenzip.info&productbusiness=sd,se,ad,co,prm,wsa,ita,serp,bro&antivirusPolicy=2&subid=1505&subid2=4196400.n4=SevenZip-apset.exe.b4=ap.c4=sevenzip.s4=0.m4=0.d4=0.t5=dl.u5=hXXp://sub.spirlymo.com/installers/cli/1444100539465/SevenZip_downloader-Q7BA7UqEv.exe.n5=SevenZip_downloader-Q7BA7UqEv.exe.b5=bi.c5=sevenzip-3.s5=0.m5=1.d5=1500.fn1=Components.fn2=File opener.fn3=File finder.fn4=SevenZip.ftitl

<<< skipped >>>

POST hXXp://up.cp-int-45.xyz/installer.php?affId=1006&instId=11&ho_trackingid=102e80269c556c013592751483006f&trackingId=1890954&cc=UA HTTP/1.1

Host: up.cp-int-45.xyz

Connection: close

Accept: */*

User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; fr; rv:1.8.1.3) Gecko/20070309 Firefox/2.0.0.3

Content-Type: application/x-www-form-urlencoded

id[]=29&id[]=34&id[]=35&id[]=36&id[]=37&id[]=38&id[]=39&id[]=40&id[]=41&id[]=42&id[]=43&id[]=44&id[]=45&id[]=46&id[]=47&id[]=48&id[]=49&id[]=50&id[]=51&id[]=52&id[]=53&id[]=54&id[]=55&id[]=56&id[]=57

HTTP/1.1 411 Length Required

Content-Type: text/html; charset=us-ascii

Server: Microsoft-HTTPAPI/2.0

Date: Tue, 06 Oct 2015 03:27:33 GMT

Connection: close

Content-Length: 344

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""hXXp://VVV.w3.org/TR/html4/strict.dtd">..<HTML><HEAD><TITLE>Length Required</TITLE>..<META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD>..<BODY><h2>Length Required</h2>..<hr><p>HTTP Error 411. The request must be chunked or have a content length.</p>..</BODY></HTML>....

Map

The Trojan connects to the servers at the folowing location(s):

Strings from Dumps

%original file name%.exe_1156:

.text

.text

`.data

`.data

.rdata

.rdata

P.idata

P.idata

@.edata

@.edata

@.rsrc

@.rsrc

@.reloc

@.reloc

MsgHandler

MsgHandler

Windows

Windows

MSWHEEL_ROLLMSG

MSWHEEL_ROLLMSG

MSH_WHEELSUPPORT_MSG

MSH_WHEELSUPPORT_MSG

MSH_SCROLL_LINES_MSG

MSH_SCROLL_LINES_MSG

uxtheme.dll

uxtheme.dll

USER32.DLL

USER32.DLL

MAPI32.DLL

MAPI32.DLL

comctl32.dll

comctl32.dll

DWMAPI.DLL

DWMAPI.DLL

ssShift

ssShift

htKeyword

htKeyword

EInvalidOperation

EInvalidOperation

%s_%d

%s_%d

kernel32.dll

kernel32.dll

$*@@@*$@@@$ *@@* $@@($*)@-$*@@$-*@@$*-@@(*$)@-*$@@*-$@@*$-@@-* $@-$ *@* $-@$ *-@$ -*@*- $@($ *)(* $)

$*@@@*$@@@$ *@@* $@@($*)@-$*@@$-*@@$*-@@(*$)@-*$@@*-$@@*$-@@-* $@-$ *@* $-@$ *-@$ -*@*- $@($ *)(* $)

oleaut32.dll

oleaut32.dll

EVariantBadIndexError

EVariantBadIndexError

clWebSnow

clWebSnow

clWebFloralWhite

clWebFloralWhite

clWebLavenderBlush

clWebLavenderBlush

clWebOldLace

clWebOldLace

clWebIvory

clWebIvory

clWebCornSilk

clWebCornSilk

clWebBeige

clWebBeige

clWebAntiqueWhite

clWebAntiqueWhite

clWebWheat

clWebWheat

clWebAliceBlue

clWebAliceBlue

clWebGhostWhite

clWebGhostWhite

clWebLavender

clWebLavender

clWebSeashell

clWebSeashell

clWebLightYellow

clWebLightYellow

clWebPapayaWhip

clWebPapayaWhip

clWebNavajoWhite

clWebNavajoWhite

clWebMoccasin

clWebMoccasin

clWebBurlywood

clWebBurlywood

clWebAzure

clWebAzure

clWebMintcream

clWebMintcream

clWebHoneydew

clWebHoneydew

clWebLinen

clWebLinen

clWebLemonChiffon

clWebLemonChiffon

clWebBlanchedAlmond

clWebBlanchedAlmond

clWebBisque

clWebBisque

clWebPeachPuff

clWebPeachPuff

clWebTan

clWebTan

clWebYellow

clWebYellow

clWebDarkOrange

clWebDarkOrange

clWebRed

clWebRed

clWebDarkRed

clWebDarkRed

clWebMaroon

clWebMaroon

clWebIndianRed

clWebIndianRed

clWebSalmon

clWebSalmon

clWebCoral

clWebCoral

clWebGold

clWebGold

clWebTomato

clWebTomato

clWebCrimson

clWebCrimson

clWebBrown

clWebBrown

clWebChocolate

clWebChocolate

clWebSandyBrown

clWebSandyBrown

clWebLightSalmon

clWebLightSalmon

clWebLightCoral

clWebLightCoral

clWebOrange

clWebOrange

clWebOrangeRed

clWebOrangeRed

clWebFirebrick

clWebFirebrick

clWebSaddleBrown

clWebSaddleBrown

clWebSienna

clWebSienna

clWebPeru

clWebPeru

clWebDarkSalmon

clWebDarkSalmon

clWebRosyBrown

clWebRosyBrown

clWebPaleGoldenrod

clWebPaleGoldenrod

clWebLightGoldenrodYellow

clWebLightGoldenrodYellow

clWebOlive

clWebOlive

clWebForestGreen

clWebForestGreen

clWebGreenYellow

clWebGreenYellow

clWebChartreuse

clWebChartreuse

clWebLightGreen

clWebLightGreen

clWebAquamarine

clWebAquamarine

clWebSeaGreen

clWebSeaGreen

clWebGoldenRod

clWebGoldenRod

clWebKhaki

clWebKhaki

clWebOliveDrab

clWebOliveDrab

clWebGreen

clWebGreen

clWebYellowGreen

clWebYellowGreen

clWebLawnGreen

clWebLawnGreen

clWebPaleGreen

clWebPaleGreen

clWebMediumAquamarine

clWebMediumAquamarine

clWebMediumSeaGreen

clWebMediumSeaGreen

clWebDarkGoldenRod

clWebDarkGoldenRod

clWebDarkKhaki

clWebDarkKhaki

clWebDarkOliveGreen

clWebDarkOliveGreen

clWebDarkgreen

clWebDarkgreen

clWebLimeGreen

clWebLimeGreen

clWebLime

clWebLime

clWebSpringGreen

clWebSpringGreen

clWebMediumSpringGreen

clWebMediumSpringGreen

clWebDarkSeaGreen

clWebDarkSeaGreen

clWebLightSeaGreen

clWebLightSeaGreen

clWebPaleTurquoise

clWebPaleTurquoise

clWebLightCyan

clWebLightCyan

clWebLightBlue

clWebLightBlue

clWebLightSkyBlue

clWebLightSkyBlue

clWebCornFlowerBlue

clWebCornFlowerBlue

clWebDarkBlue

clWebDarkBlue

clWebIndigo

clWebIndigo

clWebMediumTurquoise

clWebMediumTurquoise

clWebTurquoise

clWebTurquoise

clWebCyan

clWebCyan

clWebPowderBlue

clWebPowderBlue

clWebSkyBlue

clWebSkyBlue

clWebRoyalBlue

clWebRoyalBlue

clWebMediumBlue

clWebMediumBlue

clWebMidnightBlue

clWebMidnightBlue

clWebDarkTurquoise

clWebDarkTurquoise

clWebCadetBlue

clWebCadetBlue

clWebDarkCyan

clWebDarkCyan

clWebTeal

clWebTeal

clWebDeepskyBlue

clWebDeepskyBlue

clWebDodgerBlue

clWebDodgerBlue

clWebBlue

clWebBlue

clWebNavy

clWebNavy

clWebDarkViolet

clWebDarkViolet

clWebDarkOrchid

clWebDarkOrchid

clWebMagenta

clWebMagenta

clWebDarkMagenta

clWebDarkMagenta

clWebMediumVioletRed

clWebMediumVioletRed

clWebPaleVioletRed

clWebPaleVioletRed

clWebBlueViolet

clWebBlueViolet

clWebMediumOrchid

clWebMediumOrchid

clWebMediumPurple

clWebMediumPurple

clWebPurple

clWebPurple

clWebDeepPink

clWebDeepPink

clWebLightPink

clWebLightPink

clWebViolet

clWebViolet

clWebOrchid

clWebOrchid

clWebPlum

clWebPlum

clWebThistle

clWebThistle

clWebHotPink

clWebHotPink

clWebPink

clWebPink

clWebLightSteelBlue

clWebLightSteelBlue

clWebMediumSlateBlue

clWebMediumSlateBlue

clWebLightSlateGray

clWebLightSlateGray

clWebWhite

clWebWhite

clWebLightgrey

clWebLightgrey

clWebGray

clWebGray

clWebSteelBlue

clWebSteelBlue

clWebSlateBlue

clWebSlateBlue

clWebSlateGray

clWebSlateGray

clWebWhiteSmoke

clWebWhiteSmoke

clWebSilver

clWebSilver

clWebDimGray

clWebDimGray

clWebMistyRose

clWebMistyRose

clWebDarkSlateBlue

clWebDarkSlateBlue

clWebDarkSlategray

clWebDarkSlategray

clWebGainsboro

clWebGainsboro

clWebDarkGray

clWebDarkGray

clWebBlack

clWebBlack

AutoHotkeys

AutoHotkeys

\SYSTEM\CurrentControlSet\Control\Keyboard Layouts\

\SYSTEM\CurrentControlSet\Control\Keyboard Layouts\

EInvalidGraphicOperation

EInvalidGraphicOperation

SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontSubstitutes

SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontSubstitutes

ssHotTrack

ssHotTrack

TWindowState

TWindowState

poProportional

poProportional

TWMKey

TWMKey

KeyPreview

KeyPreview

WindowState

WindowState

OnKeyDown

OnKeyDown

OnKeyPress

OnKeyPress

OnKeyUp

OnKeyUp

GlassFrame.Bottom

GlassFrame.Bottom

GlassFrame.Enabled

GlassFrame.Enabled

GlassFrame.Left

GlassFrame.Left

GlassFrame.Right

GlassFrame.Right

GlassFrame.SheetOfGlass

GlassFrame.SheetOfGlass

GlassFrame.Top

GlassFrame.Top

Uhr%D

Uhr%D

System\CurrentControlSet\Control\Keyboard Layouts\%.8x

System\CurrentControlSet\Control\Keyboard Layouts\%.8x

User32.dll

User32.dll

TKeyEvent

TKeyEvent

TKeyPressEvent

TKeyPressEvent

HelpKeyword`

HelpKeyword`

crSQLWait

crSQLWait

%s (%s)

%s (%s)

imm32.dll

imm32.dll

xxtype.cpp

xxtype.cpp

derv->tpClass.tpcFlags & CF_HAS_BASES

derv->tpClass.tpcFlags & CF_HAS_BASES

Inappropriate I/O control operation

Inappropriate I/O control operation

Broken pipe

Broken pipe

Operation not permitted

Operation not permitted

%H:%M:%S

%H:%M:%S

%m/%d/%y

%m/%d/%y

%A, %B %d, %Y

%A, %B %d, %Y

%s: %s error

%s: %s error