HEUR:Trojan.Win32.Generic (Kaspersky), Backdoor.Win32.PcClient.FD, Trojan.NSIS.StartPage.FD, SearchProtectToolbar.YR (Lavasoft MAS)Behaviour: Trojan, Backdoor
The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.
Summary
MD5: 215f1a45f2d9180bf04563cba70bc318
SHA1: d370e2f084745e421c5527516cbfb21b82e629de
SHA256: f0aaa415bce12883ea17e61bbca37cf83579526ee15c9d0fbd8d4d7977121558
SSDeep: 98304:ztrbTA1II8F/lw0WbuRJOPA D8yoxCLthGdAJp:Jc1KtlwBuREPH8yo6tJp
Size: 3703175 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: UPolyXv05_v6
Company: no certificate found
Created at: 2012-01-29 23:32:28
Analyzed on: WindowsXP SP3 32-bit
Summary: Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).
Dynamic Analysis
Payload
No specific payload has been found.
Process activity
The Trojan creates the following process(es):
%original file name%.exe:1152
PowerIS06.exe:272
netsh.exe:308
The Trojan injects its code into the following process(es):
PowerISO6.exe:1676
RunDll32.exe:1288
igfxpers.exe:572
Mutexes
The following mutexes were created/opened:No objects were found.
File activity
The process %original file name%.exe:1152 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\aut1.tmp (23346 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\PowerISO6.exe (20504 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\PowerIS06.exe (3225 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\aut2.tmp (1337 bytes)
The Trojan deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\aut1.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\aut2.tmp (0 bytes)
The process PowerISO6.exe:1676 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\nsr5.tmp\InstOpt.dll (1552 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsr5.tmp\System.dll (11 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsr5.tmp\OCSetupHlp.dll (28288 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\sp-downloader.exe (2392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsl4.tmp (195945 bytes)
The Trojan deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\nsr5.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsg3.tmp (0 bytes)
The process PowerIS06.exe:272 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\igfxpers.exe (1281 bytes)
The process RunDll32.exe:1288 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\W9MNGLIJ\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OXEVKLMR\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\8FVLKSZR\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\KTYF4TEF\desktop.ini (67 bytes)
%System%\wbem\Logs\wbemprox.log (7500 bytes)
The process igfxpers.exe:572 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Start Menu\Programs\Startup\dc75d1d4ffbb0f0a1291940192d4d141.exe (6405 bytes)
Registry activity
The process %original file name%.exe:1152 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "74 E2 32 93 4A B3 46 26 26 D6 99 F0 FB 57 B0 F2"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
"Startup" = "%Documents and Settings%\%current user%\Start Menu\Programs\Startup"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp]
"PowerISO6.exe" = "PowerISO Setup"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp]
"PowerIS06.exe" = ""
The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"
The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:
"UNCAsIntranet" = "1"
The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:
"ProxyBypass" = "1"
The process PowerISO6.exe:1676 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "E9 EF D3 16 99 FF 7F FE 5C D8 2A DF 98 FC D7 7F"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\PowerISO]
"TbInstallFlag2" = "0"
"TbInstallFlag" = "0"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"
[HKLM\SOFTWARE\PowerISO]
"TbShowFlag" = "2"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
The process PowerIS06.exe:272 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "6B 10 A2 9E EE FC B5 54 40 C3 69 64 88 1C C3 EB"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp]
"igfxpers.exe" = ""
[HKCU\Software\dc75d1d4ffbb0f0a1291940192d4d141]
"US" = "@"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
[HKCU\Environment]
"SEE_MASK_NOZONECHECKS" = "1"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"
The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"
The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:
"ProxyBypass" = "1"
The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:
"IntranetName" = "1"
The process netsh.exe:308 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy\traceIdentifier]
"Guid" = "5f31090b-d990-4e91-b16d-46121d0255aa"
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\qagent]
"Active" = "1"
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil\traceIdentifier]
"Guid" = "8aefce96-4618-42ff-a057-3536aa78233e"
[HKLM\SOFTWARE\Microsoft\Tracing\FWCFG]
"MaxFileSize" = "1048576"
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\NAP\Netsh]
"ControlFlags" = "1"
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\qagent]
"ControlFlags" = "1"
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\NAP\Netsh]
"Active" = "1"
[HKLM\SOFTWARE\Microsoft\Tracing\FWCFG]
"ConsoleTracingMask" = "4294901760"
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\NAP\Netsh\Napmontr]
"BitNames" = " NAP_TRACE_BASE NAP_TRACE_NETSH"
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy]
"Active" = "1"
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg\traceIdentifier]
"BitNames" = " Error Unusual Info Debug"
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg]
"Active" = "1"
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy\traceIdentifier]
"BitNames" = " Error Unusual Info Debug"
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg]
"ControlFlags" = "1"
[HKLM\SOFTWARE\Microsoft\Tracing\FWCFG]
"EnableFileTracing" = "0"
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg]
"LogSessionName" = "stdout"
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\NAP\Netsh\Napmontr]
"Guid" = "710adbf0-ce88-40b4-a50d-231ada6593f0"
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil]
"Active" = "1"
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy]
"LogSessionName" = "stdout"
"ControlFlags" = "1"
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\qagent\traceIdentifier]
"Guid" = "b0278a28-76f1-4e15-b1df-14b209a12613"
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg\traceIdentifier]
"Guid" = "5f31090b-d990-4e91-b16d-46121d0255aa"
[HKLM\SOFTWARE\Microsoft\Tracing\FWCFG]
"EnableConsoleTracing" = "0"
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil\traceIdentifier]
"BitNames" = " Error Unusual Info Debug"
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "F3 6F F6 12 81 FD 28 F6 17 CD EE EE B6 79 54 E3"
[HKLM\SOFTWARE\Microsoft\Tracing\FWCFG]
"FileDirectory" = "%windir%\tracing"
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil]
"LogSessionName" = "stdout"
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\qagent]
"LogSessionName" = "stdout"
[HKLM\SOFTWARE\Microsoft\Tracing\FWCFG]
"FileTracingMask" = "4294901760"
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\NAP\Netsh]
"LogSessionName" = "stdout"
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\qagent\traceIdentifier]
"BitNames" = " Error Unusual Info Debug"
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil]
"ControlFlags" = "1"
Adds a rule to the firewall Windows which allows any network activity:
[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\%Documents and Settings%\%current user%\Local Settings\Temp]
"igfxpers.exe" = "%Documents and Settings%\%current user%\Local Settings\Temp\igfxpers.exe:*:Enabled:igfxpers.exe"
The process RunDll32.exe:1288 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
[HKCR\TypeLib\{A8A8FC8F-45DF-4720-B6D9-F8CE7E1483A2}\1.0\0\win32]
"(Default)" = "C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsr5.tmp\OCSetupHlp.dll"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
[HKCU\Software\Microsoft\Windows Script\Settings]
"JITDebug" = "0"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"
[HKCR\TypeLib\{A8A8FC8F-45DF-4720-B6D9-F8CE7E1483A2}\1.0\HELPDIR]
"(Default)" = "C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsr5.tmp"
[HKCR\TypeLib\{A8A8FC8F-45DF-4720-B6D9-F8CE7E1483A2}\1.0]
"(Default)" = "OCValidateLib"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1A 00 00 00 01 00 00 00 00 00 00 00"
[HKCR\TypeLib\{A8A8FC8F-45DF-4720-B6D9-F8CE7E1483A2}\1.0\FLAGS]
"(Default)" = "0"
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "08 D8 C7 A6 01 A7 05 AB B9 90 3C 3E B1 15 8B E4"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"
Proxy settings are disabled:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
The Trojan deletes the following registry key(s):
[HKCR\TypeLib\{A8A8FC8F-45DF-4720-B6D9-F8CE7E1483A2}\1.0\HELPDIR]
[HKCR\TypeLib\{A8A8FC8F-45DF-4720-B6D9-F8CE7E1483A2}\1.0\FLAGS]
[HKCR\TypeLib\{A8A8FC8F-45DF-4720-B6D9-F8CE7E1483A2}\1.0\0]
[HKCR\TypeLib\{A8A8FC8F-45DF-4720-B6D9-F8CE7E1483A2}\1.0]
[HKCR\TypeLib\{A8A8FC8F-45DF-4720-B6D9-F8CE7E1483A2}\1.0\0\win32]
[HKCR\TypeLib\{A8A8FC8F-45DF-4720-B6D9-F8CE7E1483A2}]
The Trojan deletes the following value(s) in system registry:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"
The process igfxpers.exe:572 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "CE A3 C4 47 A5 69 71 50 34 DC 2B 1D 58 5F 46 6D"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Startup" = "%Documents and Settings%\%current user%\Start Menu\Programs\Startup"
"AppData" = "%Documents and Settings%\%current user%\Application Data"
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"dc75d1d4ffbb0f0a1291940192d4d141" = "%Documents and Settings%\%current user%\Local Settings\Temp\igfxpers.exe .."
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"dc75d1d4ffbb0f0a1291940192d4d141" = "%Documents and Settings%\%current user%\Local Settings\Temp\igfxpers.exe .."
Dropped PE files
MD5 | File path |
---|---|
5a8186bb48db8234ad05c18c1a4a41cf | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\PowerIS06.exe |
3113497b7ef6aa0a7d236cde58670c46 | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\PowerISO6.exe |
5a8186bb48db8234ad05c18c1a4a41cf | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\igfxpers.exe |
14b9885d98946ed769f3507690f83f0d | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nsr5.tmp\InstOpt.dll |
0783eba8ac87193609d19d71b8427072 | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nsr5.tmp\OCSetupHlp.dll |
c17103ae9072a06da581dec998343fc1 | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nsr5.tmp\System.dll |
9fb9d49c2db7edd1084ab765d619f5c6 | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\sp-downloader.exe |
5a8186bb48db8234ad05c18c1a4a41cf | c:\Documents and Settings\"%CurrentUserName%"\Start Menu\Programs\Startup\dc75d1d4ffbb0f0a1291940192d4d141.exe |
HOSTS file anomalies
No changes have been detected.
Rootkit activity
No anomalies have been detected.
Propagation
Removals
Remove it with Ad-Aware
- Click (here) to download and install Ad-Aware Free Antivirus.
- Update the definition files.
- Run a full scan of your computer.
Manual removal*
- Terminate malicious process(es) (How to End a Process With the Task Manager):
%original file name%.exe:1152
PowerIS06.exe:272
netsh.exe:308 - Delete the original Trojan file.
- Delete or disinfect the following files created/modified by the Trojan:
%Documents and Settings%\%current user%\Local Settings\Temp\aut1.tmp (23346 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\PowerISO6.exe (20504 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\PowerIS06.exe (3225 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\aut2.tmp (1337 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsr5.tmp\InstOpt.dll (1552 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsr5.tmp\System.dll (11 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsr5.tmp\OCSetupHlp.dll (28288 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\sp-downloader.exe (2392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsl4.tmp (195945 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\igfxpers.exe (1281 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\W9MNGLIJ\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OXEVKLMR\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\8FVLKSZR\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\KTYF4TEF\desktop.ini (67 bytes)
%System%\wbem\Logs\wbemprox.log (7500 bytes)
%Documents and Settings%\%current user%\Start Menu\Programs\Startup\dc75d1d4ffbb0f0a1291940192d4d141.exe (6405 bytes) - Delete the following value(s) in the autorun key (How to Work with System Registry):
[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"dc75d1d4ffbb0f0a1291940192d4d141" = "%Documents and Settings%\%current user%\Local Settings\Temp\igfxpers.exe .."
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"dc75d1d4ffbb0f0a1291940192d4d141" = "%Documents and Settings%\%current user%\Local Settings\Temp\igfxpers.exe .." - Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
- Reboot the computer.
Static Analysis
VersionInfo
Company Name:
Product Name:
Product Version: 3.3.8.1
Legal Copyright: Copyright(c) 2004-2014
Legal Trademarks:
Original Filename:
Internal Name:
File Version: 6.0.0.0
File Description: PowerISO Setup
Comments: Power Software Ltd
Language: English (United States)
Company Name: Product Name: Product Version: 3.3.8.1Legal Copyright: Copyright(c) 2004-2014Legal Trademarks: Original Filename: Internal Name: File Version: 6.0.0.0File Description: PowerISO SetupComments: Power Software LtdLanguage: English (United States)
PE Sections
Name | Virtual Address | Virtual Size | Raw Size | Entropy | Section MD5 |
---|---|---|---|---|---|
.text | 4096 | 525852 | 526336 | 4.63347 | 61ffce4768976fa0dd2a8f6a97b1417a |
.rdata | 532480 | 57280 | 57344 | 3.32693 | 0354bc5f2376b5e9a4a3ba38b682dff1 |
.data | 589824 | 108376 | 26624 | 1.49032 | 8033f5a38941b4685bc2299e78f31221 |
.rsrc | 700416 | 37764 | 37888 | 3.83941 | b963d0080ac77325495c8242e4108c88 |
Dropped from:
Downloaded by:
Similar by SSDeep:
Similar by Lavasoft Polymorphic Checker:
Network Activity
URLs
URL | IP |
---|---|
hxxp://api.opencandy.com/?bn=3&bv=6.00.2900.5512&clientv=101&cltzone=180&csk=15916953577315061588-12371450053361214768&language=en,en&method=get_offers&mstime=0.328&num_offers=2&os=WIN5.1SP3&product_key=e3097e0858ba5638b820aeebfa8df51e&tm=2015-10-03 10:34:23.854&v=1.0&signature=c785615124063e54a659e151c1b057bc | 162.209.122.21 |
hxxp://a469.d.akamai.net/templates/9073/0/68240.png | |
hxxp://cdn3.opencandy.com/templates/9073/0/68240.png | 88.221.132.220 |
IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)
Traffic
GET /templates/9073/0/68240.png HTTP/1.1
Accept: */*
Host: cdn3.opencandy.com
Connection: Keep-Alive
HTTP/1.1 200 OK
x-amz-id-2: 7q WAxDRU/AxW/ndHApTjGi1lpGc7BywJCayagogDLF9z0I/cnPqoq8YsA6IV5 BcFDYwvxC/cg=
x-amz-request-id: 473BA2D5D101969D
Last-Modified: Wed, 23 Sep 2015 20:25:52 GMT
ETag: "bfa5a5a23f1a1049da952270a672d6d4"
Accept-Ranges: bytes
Content-Type: image/png
Content-Length: 23224
Server: AmazonS3
Cache-Control: max-age=274
Date: Sat, 03 Oct 2015 10:34:15 GMT
Connection: keep-alive
.PNG........IHDR.......h........a.. .IDATx...{\Tu.?...Hx..G.,..8...QBR.FD4...h$...\#J..R3sEVq .e5...@.%..&.*.^B4R..K..4.ED.....|g.f....8\.....Q...|....|...w..... ..B.h.:;.B.!.qC. !.."2.\.!.....J.!...6WB.!Dd...B.!"....B...m...B..hs%..BDF. !.."2.\E...........P(....Q.u...(...Y|..3g.......v...B.%..Z\\..D....q..*^.qqq..bbb,....H..$''C*.b..9-.M*.b...( ......./....O?...C!.....,......\..HQ}..............N.c...HOO..].o...X.d.>...l......j...........d.....B.j...K.,Att4......6l...........C*.B.P....yyyx.......a...........GGG...B.........R..>>>8z.(.1s...0n.8(.JH.R..........3g.....D"ATT.T*..r9.........DA.QTT....`...&_...7BBBPQQ.?..~.X.f.... .....l.2....... V...q....:u*.R)V.\...7....~~~....t. .V..... .....\.....mb.occ....dee..cB..l.n....K.....-.g.}..~.....=.y..|......?n..............._|.......o....b.......EEE.|.2***......Dxzz........y.&.1!.j5bccq..5444.....e.......Gmm-.l...\..J....dggc....h4f..|.2F.......j.........l.JJ...........l...;w.DAA...=...O#77.))).6._..EEEHJJ.V... W......w.:...........,.>}.EEE....m..|.....T*AcJ.!.M..........?.V....-.......g.y.aaa..777xyy.......8w...@....g...dee!55.....8p ..:..J.///deea........Y.8......???.......j.ZPY...X.t).......;w.....l}......O.c.oJ............?;;.QQQprr........g....R.....:....}.....L..T.W^y.....>|8.............Fdd$d2....`oo..&..:.........)!.t...m.n............F.A..=M.?|...6lh.a/Y..J....mC.......u..q..T....@PYk.......u.V\.r.....TG...M6..7%.|..N.:...Y....!.u.fRvSS....Z..q.! ..7w. .c.>|...lllL..*.u...[.L.)!.....7........HKK./.....T...e]]......._#((.....@$%%......
<<< skipped >>>
GET /?bn=3&bv=6.00.2900.5512&clientv=101&cltzone=180&csk=15916953577315061588-12371450053361214768&language=en,en&method=get_offers&mstime=0.328&num_offers=2&os=WIN5.1SP3&product_key=e3097e0858ba5638b820aeebfa8df51e&tm=2015-10-03 10:34:23.854&v=1.0&signature=c785615124063e54a659e151c1b057bc HTTP/1.1
Accept: */*
Cache-Control: no-cache
Pragma: no-cache
Accept-Encoding: gzip
Host: api.opencandy.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Date: Sat, 03 Oct 2015 10:34:14 GMT
Server: Apache
X-Robots-Tag: noindex
Last-Modified: Sat, 03 Oct 2015 10:34:14 GMT
Cache-Control: no-store, no-cache, must-revalidate
Cache-Control: post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Transfer-Encoding: chunked
Content-Type: text/xml
2000..<?xml version="1.0"?>.<get_offers>. <installer_md5s>. <md5>0</md5>. </installer_md5s>. <session_key>b2a2fc59143b8423615e19cf24421c7f</session_key><session_key>1839c9ad496c60448d2dcbad3f8b2cdc</session_key><product_name><![CDATA[PowerISO]]></product_name>. <data encoding="gzip"><![CDATA[H4sIAAAAAAAAA 1dWY/rynF vvMraAE3FziaMxQ3UbrWyKAkat9G60i2cUCRTYoSN3HRMoaBwIaBBEkQwEDg5CF5CZCXAHFgBHnI mNurn3zL9KkNm6a7Zxrx8nwZchmd3VVddVX1c3SOTldFIGJyMJtIpuiiQQia5bNaTz44DalMziZSiAKp0kOJ4HbBNASCCesgWnLFjC9PhhO4Ik8coUcrpzGqSCf 873iyVmwHy/r2syjwxMTtZ MN8DvXenjuDLa84lqxrFmJzknWb4Dn7A687hq5du7cC4BTLu MEWVtcG6b2wbKBuVR2mP/hg8KtOUsX7QTqoy7KCnxtIZxhKDKA1BPIEuzcv/5eBscvoXQfHFPJz23b BJFeUEjbnQDaDynCbsbXldRA4WSplFhzaHCHKOpG7AFOdQ/NkpRFag8z MiDkhSpPh0lsczGJ1OUyTG8yKfTs3S/JmG2ztKA8oALPkB5LEsXI3MufvpRXSMrevKB7hKrmKhpDnL3sG Zysum8t3TF5gLgrcZuQVcky cQjgttANRTOBhbqWgiaQj2ruDE0KYf6CcLFPcxzZmjGaRq0E1u2FZ9N1FwbUxQkbBuB3hEiArB4UzZsKNOZVA9AFlWgCUBAZjukq2 AWet3/OT8465ynr1/sIBty5pkIQZnWfBJAbwNoDHbpgMSCK9rrsUdm GNwZmcrZu3ie8mkFOzYQJR3t4m0E6xWGWLjT68zcM10ICS/ zqM/faa/ygahXKCR3Mbdlr7KR9xF3H2wRJY9c4Dh3O0C3Z5fc2kbqGj5puqpziDRRNXd23onnks6sD/cdoEviWDpDEMtfZOKJEGk6eTiC2KUsStJ3bhKcra65vtC85bfele3e9l/5LIkUGnzH8y7ksQOWtZUueKXBmEXouSOSvPkMevw5WlH mMFRAGMg0lspckIb8XUrjW/5Hlzy1xangimNZKnbN8Wz2EXlcfs/y4CH5sI WJ06WoxRbvwDXMcz7 fYxAY3Yc5Or3N6L7XyPKdU6heFg0Gn3EaZdQgbVHssinn8VOvdsP4ceu14hoWvvel4sI1Kuhe8Bbg82CWSwM BjD8YRPYEIQOQcxXZ7YpA5bmbZuiGZMPAcQUAwuY2o847l4
<<< skipped >>>
Map
The Trojan connects to the servers at the folowing location(s):
Strings from Dumps
PowerISO6.exe_1676:
.text
.text
`.rdata
`.rdata
@.data
@.data
.ndata
.ndata
.rsrc
.rsrc
uDSSh
uDSSh
.DEFAULT\Control Panel\International
.DEFAULT\Control Panel\International
Software\Microsoft\Windows\CurrentVersion
Software\Microsoft\Windows\CurrentVersion
GetWindowsDirectoryA
GetWindowsDirectoryA
KERNEL32.dll
KERNEL32.dll
ExitWindowsEx
ExitWindowsEx
USER32.dll
USER32.dll
GDI32.dll
GDI32.dll
SHFileOperationA
SHFileOperationA
ShellExecuteA
ShellExecuteA
SHELL32.dll
SHELL32.dll
RegEnumKeyA
RegEnumKeyA
RegCreateKeyExA
RegCreateKeyExA
RegCloseKey
RegCloseKey
RegDeleteKeyA
RegDeleteKeyA
RegOpenKeyExA
RegOpenKeyExA
ADVAPI32.dll
ADVAPI32.dll
COMCTL32.dll
COMCTL32.dll
ole32.dll
ole32.dll
VERSION.dll
VERSION.dll
verifying installer: %d%%
verifying installer: %d%%
unpacking data: %d%%
unpacking data: %d%%
... %d%%
... %d%%
hXXp://nsis.sf.net/NSIS_Error
hXXp://nsis.sf.net/NSIS_Error
~nsu.tmp
~nsu.tmp
%u.%u%s%s
%u.%u%s%s
RegDeleteKeyExA
RegDeleteKeyExA
%s=%s
%s=%s
*?|/":
*?|/":
ME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsr5.tmp\System.dll
ME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsr5.tmp\System.dll
:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsr5.tmp\System.dll
:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsr5.tmp\System.dll
\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsr5.tmp
\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsr5.tmp
6.exe"
6.exe"
\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsr5.tmp\System.dll
\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsr5.tmp\System.dll
ShellExecuteExA
ShellExecuteExA
MSVCRT.dll
MSVCRT.dll
InstOpt.dll
InstOpt.dll
.ashdisc
.ashdisc
SHDeleteKeyA
SHDeleteKeyA
shlwapi.dll
shlwapi.dll
PowerISO %s
PowerISO %s
\PowerISO.exe,0
\PowerISO.exe,0
\PowerISO.exe "%1"
\PowerISO.exe "%1"
regsvr32.exe
regsvr32.exe
PWRISOSH.DLL
PWRISOSH.DLL
PortugueseBR
PortugueseBR
RICHED20.DLL
RICHED20.DLL
hXXp://info.trovi.com/searchprotect/uninstall
hXXp://info.trovi.com/searchprotect/uninstall
hXXp://info.trovi.com/searchprotect/about
hXXp://info.trovi.com/searchprotect/about
hXXp://info.trovi.com/Privacy
hXXp://info.trovi.com/Privacy
hXXp://info.trovi.com/Eula
hXXp://info.trovi.com/Eula
user32.dll
user32.dll
Gdi32.dll
Gdi32.dll
hXXp://VVV.poweriso.com/thankyou.htm
hXXp://VVV.poweriso.com/thankyou.htm
hXXp://VVV.poweriso.com/thank-you-for-installing.htm
hXXp://VVV.poweriso.com/thank-you-for-installing.htm
hXXp://VVV.poweriso.com/thank-you.htm
hXXp://VVV.poweriso.com/thank-you.htm
PowerISO_Setup.txt
PowerISO_Setup.txt
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\DriveIcons\
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\DriveIcons\
PWRISOVM.EXE
PWRISOVM.EXE
Software\Microsoft\Windows\CurrentVersion\Run\
Software\Microsoft\Windows\CurrentVersion\Run\
kernel32.dll
kernel32.dll
/hXXp://csc3-2010-crl.verisign.com/CSC3-2010.crl0D
/hXXp://csc3-2010-crl.verisign.com/CSC3-2010.crl0D
hXXps://VVV.verisign.com/rpa0
hXXps://VVV.verisign.com/rpa0
hXXp://ocsp.verisign.com0;
hXXp://ocsp.verisign.com0;
/hXXp://csc3-2010-aia.verisign.com/CSC3-2010.cer0
/hXXp://csc3-2010-aia.verisign.com/CSC3-2010.cer0
2Terms of use at hXXps://VVV.verisign.com/rpa (c)101.0,
2Terms of use at hXXps://VVV.verisign.com/rpa (c)101.0,
hXXps://VVV.verisign.com/cps0*
hXXps://VVV.verisign.com/cps0*
#hXXp://logo.verisign.com/vslogo.gif04
#hXXp://logo.verisign.com/vslogo.gif04
#hXXp://crl.verisign.com/pca3-g5.crl04
#hXXp://crl.verisign.com/pca3-g5.crl04
hXXp://ocsp.verisign.com0
hXXp://ocsp.verisign.com0
Thawte Certification1
Thawte Certification1
hXXp://ocsp.thawte.com0
hXXp://ocsp.thawte.com0
.hXXp://crl.thawte.com/ThawteTimestampingCA.crl0
.hXXp://crl.thawte.com/ThawteTimestampingCA.crl0
hXXp://ts-ocsp.ws.symantec.com07
hXXp://ts-ocsp.ws.symantec.com07
hXXp://ts-aia.ws.symantec.com/tss-ca-g2.cer0
hXXp://ts-aia.ws.symantec.com/tss-ca-g2.cer0
hXXp://ts-crl.ws.symantec.com/tss-ca-g2.crl0(
hXXp://ts-crl.ws.symantec.com/tss-ca-g2.crl0(
P.DVI
P.DVI
.WJmE2C
.WJmE2C
/U.an
/U.an
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsr5.tmp
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsr5.tmp
nsr5.tmp
nsr5.tmp
:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\PowerISO6.exe"
:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\PowerISO6.exe"
"C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\PowerISO6.exe"
"C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\PowerISO6.exe"
%Program Files%\PowerISO
%Program Files%\PowerISO
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp
PowerISO6.exe
PowerISO6.exe
CUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsg3.tmp
CUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsg3.tmp
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\PowerISO6.exe
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\PowerISO6.exe
1091175365
1091175365
1419120
1419120
1423848
1423848
1440320
1440320
1698528
1698528
1698560
1698560
1698592
1698592
1802664
1802664
1048834
1048834
1048858
1048858
1179850
1179850
1179940
1179940
2"&,\45>
2"&,\45>
*.**)
*.**)
.uy}"
.uy}"
Nullsoft Install System v2.46
Nullsoft Install System v2.46
If you elect to change your browser settings via Search Protect, your settings preferences will be applied to Chrome
If you elect to change your browser settings via Search Protect, your settings preferences will be applied to Chrome
, Firefox
, Firefox
If you elect to change your browser settings via your web browser, Search Protect will be disabled for that setting, therefore its ability to prevent third-party software from changing your settings will be halted.
If you elect to change your browser settings via your web browser, Search Protect will be disabled for that setting, therefore its ability to prevent third-party software from changing your settings will be halted.
In Chrome, browser settings can be changed via the Chrome menu or wrench icon. In Firefox, settings can be changed via the Firefox button or Tools menu. In Internet Explorer, settings can be changed via the gear icon or Tools menu. For all three browsers, new tab setting can be restored by opening a new tab and clicking "Restore" on the bottom of the page.
In Chrome, browser settings can be changed via the Chrome menu or wrench icon. In Firefox, settings can be changed via the Firefox button or Tools menu. In Internet Explorer, settings can be changed via the gear icon or Tools menu. For all three browsers, new tab setting can be restored by opening a new tab and clicking "Restore" on the bottom of the page.
You can uninstall Search Protect at any time by using the standard uninstall process that is available as part of your operating system. In Microsoft Windows
You can uninstall Search Protect at any time by using the standard uninstall process that is available as part of your operating system. In Microsoft Windows
Please read the following important information and terms before continuing.
Please read the following important information and terms before continuing.
PowerISO Virtual Drive requires Windows2000/XP or above.
PowerISO Virtual Drive requires Windows2000/XP or above.
04090000
04090000
6.0.0.0
6.0.0.0
PowerISO6.exe_1676_rwx_10004000_00001000:
callback%d
callback%d
RunDll32.exe_1288:
.text
.text
`.data
`.data
.rsrc
.rsrc
msvcrt.dll
msvcrt.dll
KERNEL32.dll
KERNEL32.dll
NTDLL.DLL
NTDLL.DLL
GDI32.dll
GDI32.dll
USER32.dll
USER32.dll
IMAGEHLP.dll
IMAGEHLP.dll
rundll32.pdb
rundll32.pdb
.....eZXnnnnnnnnnnnn3
.....eZXnnnnnnnnnnnn3
....eDXnnnnnnnnnnnn3
....eDXnnnnnnnnnnnn3
...eDXnnnnnnnnnnnn,
...eDXnnnnnnnnnnnn,
.eDXnnnnnnnnnnnn,
.eDXnnnnnnnnnnnn,
%Xnnnnnnnnnnnnnnn1
%Xnnnnnnnnnnnnnnn1
O3$dS7"%U9
O3$dS7"%U9
.manifest
.manifest
5.1.2600.5512 (xpsp.080413-2105)
5.1.2600.5512 (xpsp.080413-2105)
RUNDLL.EXE
RUNDLL.EXE
Windows
Windows
Operating System
Operating System
5.1.2600.5512
5.1.2600.5512
YThere is not enough memory to run the file %s.
YThere is not enough memory to run the file %s.
Please close other windows and try again.
Please close other windows and try again.
9The file %s or one of its components could not be opened.
9The file %s or one of its components could not be opened.
0The file %s or one of its components cannot run.
0The file %s or one of its components cannot run.
MThe file %s or one of its components requires a different version of Windows.
MThe file %s or one of its components requires a different version of Windows.
UThe file %s or one of its components cannot run in standard or enhanced mode Windows.3Another instance of the file %s is already running./An exception occurred while trying to run "%s"
UThe file %s or one of its components cannot run in standard or enhanced mode Windows.3Another instance of the file %s is already running./An exception occurred while trying to run "%s"
Error in %s
Error in %s
Missing entry:%s
Missing entry:%s
Error loading %s
Error loading %s