not-a-virus:HEUR:AdWare.Win32.AdLoad.heur (Kaspersky), Backdoor.Win32.PcClient.FD, Trojan.NSIS.StartPage.FD, SearchProtectToolbar.YR (Lavasoft MAS)Behaviour: Trojan, Backdoor, Adware
The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.
Summary
MD5: a6422c02666969fe4ec5661991e7a3b4
SHA1: a75e1adce86c96dc37ce2ca5c709214ca2ae8ad6
SHA256: 39f86ee9506295fe8a005d5c031db50c0190c44e5da868a0d18e2512ce12f72a
SSDeep: 49152:FJK9m/JZirdDUKWhJ3W 88FApj0WXeZKAoS6NakTAoE0ZNlmHkIYsGEoYSC5I:HFydDuh788EhoBX6Nak050ZNtGGHYSH
Size: 3177650 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: UPolyXv05_v6
Company:
Created at: 2014-08-27 19:40:54
Analyzed on: WindowsXP SP3 32-bit
Summary: Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).
Dynamic Analysis
Payload
No specific payload has been found.
Process activity
The Trojan creates the following process(es):
PowerISO32.exe:164
%original file name%.exe:1416
The Trojan injects its code into the following process(es):
RunDll32.exe:644
local.exe:1984
Mutexes
The following mutexes were created/opened:
_SHuassist.mtxZonesLockedCacheCounterMutexZonesCacheCounterMutexZonesCounterMutexShimCacheMutex
File activity
The process PowerISO32.exe:164 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\nsa2.tmp\setup.dll (45628 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa2.tmp\NSISdl.dll (14 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa2.tmp\conf (106 bytes)
The Trojan deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\nsv1.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa2.tmp (0 bytes)
The process %original file name%.exe:1416 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\RarSFX0\PowerISO32.exe (8557 bytes)
The Trojan deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\RarSFX0\__tmp_rar_sfx_access_check_522656 (0 bytes)
The process RunDll32.exe:644 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\desktop.ini (159 bytes)
%System%\wbem\Logs\wbemprox.log (7500 bytes)
The process local.exe:1984 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\nsm4.tmp (195945 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsm5.tmp\InstOpt.dll (1552 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsm5.tmp\OCSetupHlp.dll (28288 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\sp-downloader.exe (2392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsm5.tmp\System.dll (11 bytes)
The Trojan deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\nsx3.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsm5.tmp (0 bytes)
Registry activity
The process PowerISO32.exe:164 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "67 B0 9D 3C 6E D3 41 AB 01 11 88 4B 07 12 72 A8"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
The process %original file name%.exe:1416 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "7B 2C 41 79 56 77 32 8A 02 4A DC F2 FB 20 5A C5"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\RarSFX0]
"PowerISO32.exe" = "PowerISO32"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"
The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"
The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:
"UNCAsIntranet" = "1"
The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:
"ProxyBypass" = "1"
The process RunDll32.exe:644 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
[HKCR\TypeLib\{A8A8FC8F-45DF-4720-B6D9-F8CE7E1483A2}\1.0\0\win32]
"(Default)" = "C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsm5.tmp\OCSetupHlp.dll"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
[HKCU\Software\Microsoft\Windows Script\Settings]
"JITDebug" = "0"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"
[HKCR\TypeLib\{A8A8FC8F-45DF-4720-B6D9-F8CE7E1483A2}\1.0\HELPDIR]
"(Default)" = "C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsm5.tmp"
[HKCR\TypeLib\{A8A8FC8F-45DF-4720-B6D9-F8CE7E1483A2}\1.0]
"(Default)" = "OCValidateLib"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1B 00 00 00 01 00 00 00 00 00 00 00"
[HKCR\TypeLib\{A8A8FC8F-45DF-4720-B6D9-F8CE7E1483A2}\1.0\FLAGS]
"(Default)" = "0"
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "25 26 9D 44 90 44 B8 0F 69 71 77 93 46 99 CB CB"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"
Proxy settings are disabled:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
The Trojan deletes the following registry key(s):
[HKCR\TypeLib\{A8A8FC8F-45DF-4720-B6D9-F8CE7E1483A2}\1.0\HELPDIR]
[HKCR\TypeLib\{A8A8FC8F-45DF-4720-B6D9-F8CE7E1483A2}\1.0\FLAGS]
[HKCR\TypeLib\{A8A8FC8F-45DF-4720-B6D9-F8CE7E1483A2}\1.0\0]
[HKCR\TypeLib\{A8A8FC8F-45DF-4720-B6D9-F8CE7E1483A2}\1.0]
[HKCR\TypeLib\{A8A8FC8F-45DF-4720-B6D9-F8CE7E1483A2}\1.0\0\win32]
[HKCR\TypeLib\{A8A8FC8F-45DF-4720-B6D9-F8CE7E1483A2}]
The Trojan deletes the following value(s) in system registry:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"
The process local.exe:1984 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "7D F4 61 3D 53 2F C0 B2 DC DC E8 61 89 8D 93 A7"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\PowerISO]
"TbInstallFlag2" = "0"
"TbInstallFlag" = "0"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"
[HKLM\SOFTWARE\PowerISO]
"TbShowFlag" = "2"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
Dropped PE files
MD5 | File path |
---|---|
34013e8602ede27582fd189c6aa0addd | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\RarSFX0\PowerISO32.exe |
3113497b7ef6aa0a7d236cde58670c46 | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\local.exe |
a5f8399a743ab7f9c88c645c35b1ebb5 | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nsa2.tmp\NSISdl.dll |
14b9885d98946ed769f3507690f83f0d | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nsm5.tmp\InstOpt.dll |
0783eba8ac87193609d19d71b8427072 | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nsm5.tmp\OCSetupHlp.dll |
c17103ae9072a06da581dec998343fc1 | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nsm5.tmp\System.dll |
9fb9d49c2db7edd1084ab765d619f5c6 | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\sp-downloader.exe |
HOSTS file anomalies
No changes have been detected.
Rootkit activity
No anomalies have been detected.
Propagation
Removals
Remove it with Ad-Aware
- Click (here) to download and install Ad-Aware Free Antivirus.
- Update the definition files.
- Run a full scan of your computer.
Manual removal*
- Terminate malicious process(es) (How to End a Process With the Task Manager):
PowerISO32.exe:164
%original file name%.exe:1416 - Delete the original Trojan file.
- Delete or disinfect the following files created/modified by the Trojan:
%Documents and Settings%\%current user%\Local Settings\Temp\nsa2.tmp\setup.dll (45628 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa2.tmp\NSISdl.dll (14 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa2.tmp\conf (106 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\RarSFX0\PowerISO32.exe (8557 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\desktop.ini (159 bytes)
%System%\wbem\Logs\wbemprox.log (7500 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsm4.tmp (195945 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsm5.tmp\InstOpt.dll (1552 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsm5.tmp\OCSetupHlp.dll (28288 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\sp-downloader.exe (2392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsm5.tmp\System.dll (11 bytes) - Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
- Reboot the computer.
Static Analysis
VersionInfo
No information is available.
No information is available.
PE Sections
Name | Virtual Address | Virtual Size | Raw Size | Entropy | Section MD5 |
---|---|---|---|---|---|
.text | 4096 | 165731 | 165888 | 4.65939 | 3abcaafbf6704002a8d67715ecbcfbb2 |
.rdata | 172032 | 20515 | 20992 | 3.67193 | 9fa192174c9919add286b72b23b3765e |
.data | 196608 | 137468 | 5632 | 2.41253 | 095408555ae838fc66e40e7651304833 |
.rsrc | 335872 | 44776 | 45056 | 3.73441 | 6ca3de1b744a902b45b8cb026466eb91 |
Dropped from:
Downloaded by:
Similar by SSDeep:
Similar by Lavasoft Polymorphic Checker:
Network Activity
URLs
URL | IP |
---|---|
hxxp://pe-wine.club/launch_reb.php?p=sevenzip&pid=1146&tid=3915135&b_typ=pe | 46.21.100.248 |
hxxp://api.opencandy.com/?bn=3&bv=6.00.2900.5512&clientv=101&cltzone=180&csk=07462960027171767072-11640358311484402863&language=en,en&method=get_offers&mstime=0.156&num_offers=2&os=WIN5.1SP3&product_key=e3097e0858ba5638b820aeebfa8df51e&tm=2015-09-22 15:26:31.287&v=1.0&signature=5a5fa56b235113c119e8ade1d663b7b4 | 162.209.122.21 |
hxxp://a469.d.akamai.net/templates/9073/0/68240.png | |
hxxp://cdn3.opencandy.com/templates/9073/0/68240.png | 188.43.72.112 |
IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)
Traffic
GET /?bn=3&bv=6.00.2900.5512&clientv=101&cltzone=180&csk=07462960027171767072-11640358311484402863&language=en,en&method=get_offers&mstime=0.156&num_offers=2&os=WIN5.1SP3&product_key=e3097e0858ba5638b820aeebfa8df51e&tm=2015-09-22 15:26:31.287&v=1.0&signature=5a5fa56b235113c119e8ade1d663b7b4 HTTP/1.1
Accept: */*
Cache-Control: no-cache
Pragma: no-cache
Accept-Encoding: gzip
Host: api.opencandy.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Date: Tue, 22 Sep 2015 15:26:35 GMT
Server: Apache
X-Robots-Tag: noindex
Last-Modified: Tue, 22 Sep 2015 15:26:35 GMT
Cache-Control: no-store, no-cache, must-revalidate
Cache-Control: post-check=0, pre-check=0
Pragma: no-cache
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/xml
2000..<?xml version="1.0"?>.<get_offers>. <installer_md5s>. <md5>0</md5>. </installer_md5s>. <session_key>e65cd094d12c929fa89ca67ddf4301c1</session_key><session_key>4f67fa513f96bc7411deeb77b527a0c2</session_key><product_name><![CDATA[PowerISO]]></product_name>. <data encoding="gzip"><![CDATA[H4sIAAAAAAAAA 1dWY/rynF vvMraAE3FziaMxQ3UbrWyKAkahmto3Uk2zigyCZFiZu4aBnDQGDDQIIkCGAgcPKQvATIS4A4MII8ZP0xN9e RdpUhs3zWjmnGvHyfBlyGZ3dVV11VfVzdI5OV0UgYnIwm0im6KJBCJrls1pPPjgNqUzOJlKIAqnSQ4ngdsE0BIIJ6yAacsWML0 GE7giTxyheyvnMapIJ/7zveLJabPfL/JSTLPKUhZ1oQf/jCfQ73Xp95gwyuOJeuahdicZN0meM7 wOuOoWvX7q0AOMXy7jhB1ubXhql9sGxgLpQt5n/4oHArztJFO4H6qIuyAl9bCGcYigwg9QSyAFv3r7 XwfELKN4Hx1TyM9s2vkRRXtCIG90AGs9pwvaG11XUQKGoaVRYcagwwzDqBmxADvWPjVJUBSqfFaYYnSamQORJkUqLvCBQgAACB6YpjiKmJxpu7ygNKAOw5EeQx7JwOTKn7scX0TG2risf4DK5ioWS5ix7C/vmc7LqvrV0x QB4q7EbUJWJcvkE08IbgPVUDgbWKhrImgK9czixtCkHOonCBd3P8 JoSmnadBQbNlWfEZRc41MUZCIcQS6R6gIwOJN2bChUCdaXQB5VIEmAAGZbpGOvgZmrdf2k/OPu8p5Fv/BArYta5KFGJxlwScF8DaA5mybDkggvK65JndohjcGZ3K2bt4mvptAjs2GCUR5c5tA28VilS3We/A2DxdBA0r s6vP3Gun8r2uVU6GDuS17FR2VD/iLuRtgqSxaxyHLmfoluzye5tIXcNHTTdVTvEGiqau7lrRPPLZ1Z7 UzQJfEMHSGKZ62wcUSINJ08nENuUJQkaz23C05U109fal5y2/dK9u95J/yWRIoPPGP7lTBag8layJU8VOLMIXRck8lefIU9fezPKXygMFRAGMo2lMmekIX X0viW/8klT21wKrjiWJaKXXM8m31CHpffkzx4SD7so WJk UgxcYvwHUM836 fUxAI/bc5Cq382I732VKtXZh0O 3Wz2EaZWQfrXLsojnX4X2A9vLoYeuV0jo2rmeF82IlGvhO4TboU0C6W8N NiFgURPIAIQOUex3Z4YZI6bWrZuSCaMPAcQEExuLeq8Y
<<< skipped >>>
GET /templates/9073/0/68240.png HTTP/1.1
Accept: */*
Host: cdn3.opencandy.com
Connection: Keep-Alive
HTTP/1.1 200 OK
x-amz-id-2: optl0pmZWE5V 4kp5LqWH7Klwxq5hJ tGHtP1M0LGCW0m9h 15X4GGSbOHK8SwTC
x-amz-request-id: 99EC59871BCF10CE
Last-Modified: Mon, 17 Aug 2015 17:28:49 GMT
ETag: "c2ecdf00fb1913ac4f3a4e963ad7fd44"
Accept-Ranges: bytes
Content-Type: image/png
Content-Length: 23193
Server: AmazonS3
Cache-Control: max-age=300
Date: Tue, 22 Sep 2015 15:26:36 GMT
Connection: keep-alive
.PNG........IHDR.......h........a.. .IDATx...y\.W.?...Hpk..t:......H$H...!.5....$..h.5..fSc.#2..e.F.....(1^$. "..DC.[..t...E.D$...nwz.S]...>...W..:.9K.C...n555.@.!....tv...B...6WB.!Dd...B.!"....B...m...B..hs%..BDF. !.."2.\.!.....J.!...6WB.!Dd..........f...P(....Q.u.......Y}...........v...B.%..ZRR..Db.g...b./...x}l...V][\\,Z{RRR .J1s.L.~.J..8q"...E..Q......g..O>..P.!D0;1.sss.....,RT...>......."!!.....a........[]]..,Y..?..[.l.....9s..........d...!.X.....,Y.9s...._..!C. ==.AAA.6m..R)...jjj........111.2d.. !!....pqqA\\..Z-....P( .J.....G.r..$//..G..J..T*EDD....9..1c.~..GH$....@.VC.........HJJ.........?...d..^.z!<<.....c\...5k.....2.L....-...;....b..}.....)S.@*.b.............@..uK.9.XX}.. W.... .r9...-..u...=......)...!......../F...-[.O?..?......{...;......_?..s.../.........?...PQQ...~.%%%HKKCYY....q..%TTT ##.III...Ayy9...q....cBh4........hhh....8...s'.......l...r..j...............d..K..a..a._......;.........."--.yyy........c........38u..rss....o....Q\\...dh.Z\.|......k..sX...p........S.P\\.ooo.6.......Z..4.....D.\...PSS...j.*888 99....x..'.........../....T*q..Y..\....>....................P.....Eff&.._.;;;..........F`` ........F#....:,]........F}}=...,.WWW...{...}S....www,Z..................\DEE....R..........}.....L..T.._~.....:t(* .......YYY....L&...#...x..:_.o...s...1%....!.-..[7......{._ojjB..=..?x...6l0...,Y..J..[.....qqqX.n..1k.........Y.k..a..-.|.2...'..^.z.m..oJ>..c.<yR.I......t.......f...Z..q.!.....[:...)]....o...7.:....:.o.6....B..v.\......o#--.....v....e....EUU....k....]......d...
<<< skipped >>>
GET /launch_reb.php?p=sevenzip&pid=1146&tid=3915135&b_typ=pe HTTP/1.0
Host: pe-wine.club
User-Agent: NSISDL/1.2 (Mozilla)
Accept: */*
HTTP/1.1 200 OK
Date: Tue, 22 Sep 2015 15:26:33 GMT
Server: Apache/2.2.15 (CentOS)
X-Powered-By: PHP/5.3.3
Content-Length: 106
Connection: close
Content-Type: text/html; charset=UTF-8
s=cheat..u=hXXp://dl.ic-free.xyz/stub_maker.php?program=sevenzip&tid=3915135&pid=1146&b_typ=pe&reb=1&name=..
Map
The Trojan connects to the servers at the folowing location(s):
Strings from Dumps
%original file name%.exe_1416:
.text
.text
`.rdata
`.rdata
@.data
@.data
.rsrc
.rsrc
t(j.Xj\f
t(j.Xj\f
SSShP
SSShP
^SShq
^SShq
9.vpSW
9.vpSW
Please contact the application's support team for more information.
Please contact the application's support team for more information.
- Attempt to initialize the CRT more than once.
- Attempt to initialize the CRT more than once.
- CRT not initialized
- CRT not initialized
- floating point support not loaded
- floating point support not loaded
operator
operator
GetProcessWindowStation
GetProcessWindowStation
USER32.DLL
USER32.DLL
d:\Projects\WinRAR\SFX\build\sfxrar32\Release\sfxrar.pdb
d:\Projects\WinRAR\SFX\build\sfxrar32\Release\sfxrar.pdb
COMCTL32.dll
COMCTL32.dll
SHLWAPI.dll
SHLWAPI.dll
GetCPInfo
GetCPInfo
KERNEL32.dll
KERNEL32.dll
USER32.dll
USER32.dll
GDI32.dll
GDI32.dll
COMDLG32.dll
COMDLG32.dll
RegCloseKey
RegCloseKey
RegCreateKeyExW
RegCreateKeyExW
RegOpenKeyExW
RegOpenKeyExW
ADVAPI32.dll
ADVAPI32.dll
SHFileOperationW
SHFileOperationW
ShellExecuteExW
ShellExecuteExW
SHELL32.dll
SHELL32.dll
ole32.dll
ole32.dll
OLEAUT32.dll
OLEAUT32.dll
GetConsoleOutputCP
GetConsoleOutputCP
WINRAR.SFX
WINRAR.SFX
zcÃ
zcÃ
c:\%original file name%.exe
c:\%original file name%.exe
version="1.0.0.0"
version="1.0.0.0"
name="Microsoft.Windows.Common-Controls"
name="Microsoft.Windows.Common-Controls"
version="6.0.0.0"
version="6.0.0.0"
publicKeyToken="6595b64144ccf1df"
publicKeyToken="6595b64144ccf1df"
Maximum allowed array size (%u) is exceeded
Maximum allowed array size (%u) is exceeded
rtmp%d
rtmp%d
Crypt32.dll
Crypt32.dll
GETPASSWORD1
GETPASSWORD1
%s %s
%s %s
%s %s %s
%s %s %s
%s%s%d
%s%s%d
Software\Microsoft\Windows\CurrentVersion
Software\Microsoft\Windows\CurrentVersion
%s.%d.tmp
%s.%d.tmp
winrarsfxmappingfile.tmp
winrarsfxmappingfile.tmp
-el -s2 "-d%s" "-p%s" "-sp%s"
-el -s2 "-d%s" "-p%s" "-sp%s"
__tmp_rar_sfx_access_check_%u
__tmp_rar_sfx_access_check_%u
sfxcmd
sfxcmd
WaitForMultipleObjects error %d, GetLastError %d
WaitForMultipleObjects error %d, GetLastError %d
Shell.Explorer
Shell.Explorer
riched20.dll
riched20.dll
riched32.dll
riched32.dll
KERNEL32.DLL
KERNEL32.DLL
mscoree.dll
mscoree.dll
Extracting from %s
Extracting from %s
Extracting %s
Extracting %s
Enter password
Enter password
&Enter password for the encrypted file:
&Enter password for the encrypted file:
Skipping %s
Skipping %s
The file "%s" header is corrupt
The file "%s" header is corrupt
Unknown method in %s
Unknown method in %s
Cannot open %s
Cannot open %s
Cannot create %s
Cannot create %s
Cannot create folder %sHChecksum error in the encrypted file %s. Corrupt file or wrong password.
Cannot create folder %sHChecksum error in the encrypted file %s. Corrupt file or wrong password.
Checksum error in %s Packed data checksum error in %s
Checksum error in %s Packed data checksum error in %s
5Write error in the file %s. Probably the disk is full
5Write error in the file %s. Probably the disk is full
Read error in the file %s
Read error in the file %s
ErroraErrors encountered while performing the operation
ErroraErrors encountered while performing the operation
Please close all applications, reboot Windows and restart this installation\Some installation files are corrupt.
Please close all applications, reboot Windows and restart this installation\Some installation files are corrupt.
Extracting files to %s folder$Extracting files to temporary folder
Extracting files to %s folder$Extracting files to temporary folder
=Total path and file name length must not exceed %d characters
=Total path and file name length must not exceed %d characters
Unknown encryption method in %s$The specified password is incorrect.
Unknown encryption method in %s$The specified password is incorrect.
Cannot copy %s to %s.
Cannot copy %s to %s.
Cannot create symbolic link %s
Cannot create symbolic link %s
Cannot create hard link %s
Cannot create hard link %s
PowerISO32.exe_164:
.text
.text
`.rdata
`.rdata
@.data
@.data
.ndata
.ndata
.rsrc
.rsrc
uDSSh
uDSSh
.DEFAULT\Control Panel\International
.DEFAULT\Control Panel\International
Software\Microsoft\Windows\CurrentVersion
Software\Microsoft\Windows\CurrentVersion
GetWindowsDirectoryA
GetWindowsDirectoryA
KERNEL32.dll
KERNEL32.dll
ExitWindowsEx
ExitWindowsEx
USER32.dll
USER32.dll
GDI32.dll
GDI32.dll
SHFileOperationA
SHFileOperationA
ShellExecuteA
ShellExecuteA
SHELL32.dll
SHELL32.dll
RegEnumKeyA
RegEnumKeyA
RegCreateKeyExA
RegCreateKeyExA
RegCloseKey
RegCloseKey
RegDeleteKeyA
RegDeleteKeyA
RegOpenKeyExA
RegOpenKeyExA
ADVAPI32.dll
ADVAPI32.dll
COMCTL32.dll
COMCTL32.dll
ole32.dll
ole32.dll
VERSION.dll
VERSION.dll
verifying installer: %d%%
verifying installer: %d%%
hXXp://nsis.sf.net/NSIS_Error
hXXp://nsis.sf.net/NSIS_Error
... %d%%
... %d%%
~nsu.tmp
~nsu.tmp
%u.%u%s%s
%u.%u%s%s
RegDeleteKeyExA
RegDeleteKeyExA
%s=%s
%s=%s
*?|/":
*?|/":
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\local.exe
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\local.exe
etup.dll
etup.dll
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsa2.tmp\setup.dll->C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\local.exe
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsa2.tmp\setup.dll->C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\local.exe
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsa2.tmp\setup.dll
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsa2.tmp\setup.dll
Thawte Certification1
Thawte Certification1
hXXp://ocsp.thawte.com0
hXXp://ocsp.thawte.com0
.hXXp://crl.thawte.com/ThawteTimestampingCA.crl0
.hXXp://crl.thawte.com/ThawteTimestampingCA.crl0
hXXp://ts-ocsp.ws.symantec.com07
hXXp://ts-ocsp.ws.symantec.com07
hXXp://ts-aia.ws.symantec.com/tss-ca-g2.cer0
hXXp://ts-aia.ws.symantec.com/tss-ca-g2.cer0
hXXp://ts-crl.ws.symantec.com/tss-ca-g2.crl0(
hXXp://ts-crl.ws.symantec.com/tss-ca-g2.crl0(
2Terms of use at hXXps://VVV.verisign.com/rpa (c)101.0,
2Terms of use at hXXps://VVV.verisign.com/rpa (c)101.0,
/hXXp://csc3-2010-crl.verisign.com/CSC3-2010.crl0D
/hXXp://csc3-2010-crl.verisign.com/CSC3-2010.crl0D
hXXps://VVV.verisign.com/rpa0
hXXps://VVV.verisign.com/rpa0
hXXp://ocsp.verisign.com0;
hXXp://ocsp.verisign.com0;
/hXXp://csc3-2010-aia.verisign.com/CSC3-2010.cer0
/hXXp://csc3-2010-aia.verisign.com/CSC3-2010.cer0
hXXps://VVV.verisign.com/cps0*
hXXps://VVV.verisign.com/cps0*
#hXXp://logo.verisign.com/vslogo.gif04
#hXXp://logo.verisign.com/vslogo.gif04
#hXXp://crl.verisign.com/pca3-g5.crl04
#hXXp://crl.verisign.com/pca3-g5.crl04
hXXp://ocsp.verisign.com0
hXXp://ocsp.verisign.com0
.reloc
.reloc
WS2_32.dll
WS2_32.dll
NSISdl.dll
NSISdl.dll
invalid URL
invalid URL
Host: %s
Host: %s
GET %s HTTP/1.0
GET %s HTTP/1.0
User-Agent: NSISDL/1.2 (Mozilla)
User-Agent: NSISDL/1.2 (Mozilla)
http=
http=
Software\Microsoft\Windows\CurrentVersion\Internet Settings
Software\Microsoft\Windows\CurrentVersion\Internet Settings
Unable to open %s
Unable to open %s
%skB (%d%%) of %skB at %u.ukB/s
%skB (%d%%) of %skB at %u.ukB/s
(%u hours remaining)
(%u hours remaining)
(%u minutes remaining)
(%u minutes remaining)
(%u seconds remaining)
(%u seconds remaining)
Downloading %s
Downloading %s
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsa2.tmp
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsa2.tmp
nsa2.tmp
nsa2.tmp
etup.dll->C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\local.exe
etup.dll->C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\local.exe
E~1\"%CurrentUserName%"\LOCALS~1\Temp\nsa2.tmp\conf
E~1\"%CurrentUserName%"\LOCALS~1\Temp\nsa2.tmp\conf
l.ic-free.xyz/stub_maker.php?program=sevenzip&tid=3915135&pid=1146&b_typ=pe&reb=1&name=
l.ic-free.xyz/stub_maker.php?program=sevenzip&tid=3915135&pid=1146&b_typ=pe&reb=1&name=
"C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\RarSFX0\PowerISO32.exe"
"C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\RarSFX0\PowerISO32.exe"
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\RarSFX0
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\RarSFX0
PowerISO32.exe
PowerISO32.exe
CUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsv1.tmp
CUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsv1.tmp
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\RarSFX0\PowerISO32.exe
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\RarSFX0\PowerISO32.exe
hXXp://dl.ic-free.xyz/stub_maker.php?program=sevenzip&tid=3915135&pid=1146&b_typ=pe&reb=1&name=
hXXp://dl.ic-free.xyz/stub_maker.php?program=sevenzip&tid=3915135&pid=1146&b_typ=pe&reb=1&name=
Windows Utilities
Windows Utilities
Nullsoft Install System v2.46
Nullsoft Install System v2.46
local.exe_1984:
.text
.text
`.rdata
`.rdata
@.data
@.data
.ndata
.ndata
.rsrc
.rsrc
uDSSh
uDSSh
.DEFAULT\Control Panel\International
.DEFAULT\Control Panel\International
Software\Microsoft\Windows\CurrentVersion
Software\Microsoft\Windows\CurrentVersion
GetWindowsDirectoryA
GetWindowsDirectoryA
KERNEL32.dll
KERNEL32.dll
ExitWindowsEx
ExitWindowsEx
USER32.dll
USER32.dll
GDI32.dll
GDI32.dll
SHFileOperationA
SHFileOperationA
ShellExecuteA
ShellExecuteA
SHELL32.dll
SHELL32.dll
RegEnumKeyA
RegEnumKeyA
RegCreateKeyExA
RegCreateKeyExA
RegCloseKey
RegCloseKey
RegDeleteKeyA
RegDeleteKeyA
RegOpenKeyExA
RegOpenKeyExA
ADVAPI32.dll
ADVAPI32.dll
COMCTL32.dll
COMCTL32.dll
ole32.dll
ole32.dll
VERSION.dll
VERSION.dll
verifying installer: %d%%
verifying installer: %d%%
unpacking data: %d%%
unpacking data: %d%%
... %d%%
... %d%%
hXXp://nsis.sf.net/NSIS_Error
hXXp://nsis.sf.net/NSIS_Error
~nsu.tmp
~nsu.tmp
%u.%u%s%s
%u.%u%s%s
RegDeleteKeyExA
RegDeleteKeyExA
%s=%s
%s=%s
*?|/":
*?|/":
ME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsm5.tmp\System.dll
ME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsm5.tmp\System.dll
:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsm5.tmp\System.dll
:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsm5.tmp\System.dll
\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsm5.tmp
\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsm5.tmp
\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsm5.tmp\System.dll
\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsm5.tmp\System.dll
ShellExecuteExA
ShellExecuteExA
MSVCRT.dll
MSVCRT.dll
InstOpt.dll
InstOpt.dll
.ashdisc
.ashdisc
SHDeleteKeyA
SHDeleteKeyA
shlwapi.dll
shlwapi.dll
PowerISO %s
PowerISO %s
\PowerISO.exe,0
\PowerISO.exe,0
\PowerISO.exe "%1"
\PowerISO.exe "%1"
regsvr32.exe
regsvr32.exe
PWRISOSH.DLL
PWRISOSH.DLL
PortugueseBR
PortugueseBR
RICHED20.DLL
RICHED20.DLL
hXXp://info.trovi.com/searchprotect/uninstall
hXXp://info.trovi.com/searchprotect/uninstall
hXXp://info.trovi.com/searchprotect/about
hXXp://info.trovi.com/searchprotect/about
hXXp://info.trovi.com/Privacy
hXXp://info.trovi.com/Privacy
hXXp://info.trovi.com/Eula
hXXp://info.trovi.com/Eula
user32.dll
user32.dll
Gdi32.dll
Gdi32.dll
hXXp://VVV.poweriso.com/thankyou.htm
hXXp://VVV.poweriso.com/thankyou.htm
hXXp://VVV.poweriso.com/thank-you-for-installing.htm
hXXp://VVV.poweriso.com/thank-you-for-installing.htm
hXXp://VVV.poweriso.com/thank-you.htm
hXXp://VVV.poweriso.com/thank-you.htm
PowerISO_Setup.txt
PowerISO_Setup.txt
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\DriveIcons\
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\DriveIcons\
PWRISOVM.EXE
PWRISOVM.EXE
Software\Microsoft\Windows\CurrentVersion\Run\
Software\Microsoft\Windows\CurrentVersion\Run\
kernel32.dll
kernel32.dll
/hXXp://csc3-2010-crl.verisign.com/CSC3-2010.crl0D
/hXXp://csc3-2010-crl.verisign.com/CSC3-2010.crl0D
hXXps://VVV.verisign.com/rpa0
hXXps://VVV.verisign.com/rpa0
hXXp://ocsp.verisign.com0;
hXXp://ocsp.verisign.com0;
/hXXp://csc3-2010-aia.verisign.com/CSC3-2010.cer0
/hXXp://csc3-2010-aia.verisign.com/CSC3-2010.cer0
2Terms of use at hXXps://VVV.verisign.com/rpa (c)101.0,
2Terms of use at hXXps://VVV.verisign.com/rpa (c)101.0,
hXXps://VVV.verisign.com/cps0*
hXXps://VVV.verisign.com/cps0*
#hXXp://logo.verisign.com/vslogo.gif04
#hXXp://logo.verisign.com/vslogo.gif04
#hXXp://crl.verisign.com/pca3-g5.crl04
#hXXp://crl.verisign.com/pca3-g5.crl04
hXXp://ocsp.verisign.com0
hXXp://ocsp.verisign.com0
Thawte Certification1
Thawte Certification1
hXXp://ocsp.thawte.com0
hXXp://ocsp.thawte.com0
.hXXp://crl.thawte.com/ThawteTimestampingCA.crl0
.hXXp://crl.thawte.com/ThawteTimestampingCA.crl0
hXXp://ts-ocsp.ws.symantec.com07
hXXp://ts-ocsp.ws.symantec.com07
hXXp://ts-aia.ws.symantec.com/tss-ca-g2.cer0
hXXp://ts-aia.ws.symantec.com/tss-ca-g2.cer0
hXXp://ts-crl.ws.symantec.com/tss-ca-g2.crl0(
hXXp://ts-crl.ws.symantec.com/tss-ca-g2.crl0(
P.DVI
P.DVI
.WJmE2C
.WJmE2C
/U.an
/U.an
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsm5.tmp
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsm5.tmp
nsm5.tmp
nsm5.tmp
\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\local.exe
\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\local.exe
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\local.exe
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\local.exe
%Program Files%\PowerISO
%Program Files%\PowerISO
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp
local.exe
local.exe
CUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsx3.tmp
CUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsx3.tmp
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\
1048768
1048768
-1995832360
-1995832360
1114382
1114382
1638704
1638704
1507596
1507596
1310964
1310964
1376590
1376590
1419344
1419344
1423992
1423992
1440304
1440304
1440368
1440368
1423872
1423872
1798112
1798112
1423904
1423904
1048876
1048876
1704224
1704224
2"&,\45>
2"&,\45>
*.**)
*.**)
.uy}"
.uy}"
Nullsoft Install System v2.46
Nullsoft Install System v2.46
If you elect to change your browser settings via Search Protect, your settings preferences will be applied to Chrome
If you elect to change your browser settings via Search Protect, your settings preferences will be applied to Chrome
, Firefox
, Firefox
If you elect to change your browser settings via your web browser, Search Protect will be disabled for that setting, therefore its ability to prevent third-party software from changing your settings will be halted.
If you elect to change your browser settings via your web browser, Search Protect will be disabled for that setting, therefore its ability to prevent third-party software from changing your settings will be halted.
In Chrome, browser settings can be changed via the Chrome menu or wrench icon. In Firefox, settings can be changed via the Firefox button or Tools menu. In Internet Explorer, settings can be changed via the gear icon or Tools menu. For all three browsers, new tab setting can be restored by opening a new tab and clicking "Restore" on the bottom of the page.
In Chrome, browser settings can be changed via the Chrome menu or wrench icon. In Firefox, settings can be changed via the Firefox button or Tools menu. In Internet Explorer, settings can be changed via the gear icon or Tools menu. For all three browsers, new tab setting can be restored by opening a new tab and clicking "Restore" on the bottom of the page.
You can uninstall Search Protect at any time by using the standard uninstall process that is available as part of your operating system. In Microsoft Windows
You can uninstall Search Protect at any time by using the standard uninstall process that is available as part of your operating system. In Microsoft Windows
Please read the following important information and terms before continuing.
Please read the following important information and terms before continuing.
PowerISO Virtual Drive requires Windows2000/XP or above.
PowerISO Virtual Drive requires Windows2000/XP or above.
04090000
04090000
6.0.0.0
6.0.0.0
local.exe_1984_rwx_10004000_00001000:
callback%d
callback%d
RunDll32.exe_644:
.text
.text
`.data
`.data
.rsrc
.rsrc
msvcrt.dll
msvcrt.dll
KERNEL32.dll
KERNEL32.dll
NTDLL.DLL
NTDLL.DLL
GDI32.dll
GDI32.dll
USER32.dll
USER32.dll
IMAGEHLP.dll
IMAGEHLP.dll
rundll32.pdb
rundll32.pdb
.....eZXnnnnnnnnnnnn3
.....eZXnnnnnnnnnnnn3
....eDXnnnnnnnnnnnn3
....eDXnnnnnnnnnnnn3
...eDXnnnnnnnnnnnn,
...eDXnnnnnnnnnnnn,
.eDXnnnnnnnnnnnn,
.eDXnnnnnnnnnnnn,
%Xnnnnnnnnnnnnnnn1
%Xnnnnnnnnnnnnnnn1
O3$dS7"%U9
O3$dS7"%U9
.manifest
.manifest
5.1.2600.5512 (xpsp.080413-2105)
5.1.2600.5512 (xpsp.080413-2105)
RUNDLL.EXE
RUNDLL.EXE
Windows
Windows
Operating System
Operating System
5.1.2600.5512
5.1.2600.5512
YThere is not enough memory to run the file %s.
YThere is not enough memory to run the file %s.
Please close other windows and try again.
Please close other windows and try again.
9The file %s or one of its components could not be opened.
9The file %s or one of its components could not be opened.
0The file %s or one of its components cannot run.
0The file %s or one of its components cannot run.
MThe file %s or one of its components requires a different version of Windows.
MThe file %s or one of its components requires a different version of Windows.
UThe file %s or one of its components cannot run in standard or enhanced mode Windows.3Another instance of the file %s is already running./An exception occurred while trying to run "%s"
UThe file %s or one of its components cannot run in standard or enhanced mode Windows.3Another instance of the file %s is already running./An exception occurred while trying to run "%s"
Error in %s
Error in %s
Missing entry:%s
Missing entry:%s
Error loading %s
Error loading %s