Trojan.GenericKD.1949790_ad4a834e85 – Adaware

Dynamic Analysis

Payload

No specific payload has been found.

Process activity

The Trojan creates the following process(es):

%original file name%.exe:1156
attrib.exe:1932

The Trojan injects its code into the following process(es):

icardagt.exe:2000
Explorer.EXE:532

Mutexes

The following mutexes were created/opened:No objects were found.

File activity

The process %original file name%.exe:1156 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\All Users\Application Data\d0hh048ddd.exe (4185 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\2d17e659d34601689591 (67 bytes)

The process icardagt.exe:2000 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\NTUSER.DAT.LOG (7416 bytes)
%Documents and Settings%\%current user%\NTUSER.DAT (6220 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\2d17e659d34601689591 (0 bytes)

Registry activity

The process %original file name%.exe:1156 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "7B E2 A6 8D 2C 4D 27 4D 5F 56 38 B0 AF AE CE B4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\D:]
"2361512357.bat" = "2361512357"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass" = "1"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

"IntranetName" = "1"

The process attrib.exe:1932 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "44 D7 03 1A 9F 52 AF 7A 09 17 8A D2 56 4B 5B AA"

The process icardagt.exe:2000 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1D 00 00 00 01 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "40 6D 51 95 76 47 12 53 A8 4D 00 8F 7E 68 D0 8E"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Keyboard]
"2d17e6" = "73 A5 FF C7 F6 1B F6 C7 5C AE 44 EB 46 A5 FF 2C"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"IntelPowerAgent64" = "rundll32.exe shell32.dll, ShellExec_RunDLL C:\DOCUME~1\ALLUSE~1\APPLIC~1\D0HH04~1.EXE"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

Dropped PE files

There are no dropped PE files.

HOSTS file anomalies

No changes have been detected.

Rootkit activity

The Trojan installs the following user-mode hooks in CRYPT32.dll:

PFXImportCertStore

The Trojan installs the following user-mode hooks in WININET.dll:

HttpSendRequestExA
HttpSendRequestW
InternetSetStatusCallbackW
InternetReadFileExA
InternetWriteFileExA
InternetSetStatusCallback
InternetQueryDataAvailable
HttpSendRequestExW
InternetReadFile
HttpSendRequestA
InternetCloseHandle

The Trojan installs the following user-mode hooks in USER32.dll:

GetClipboardData
SendInput
GetMessageA
CreateDialogParamW
GetMessageW
TranslateMessage

The Trojan installs the following user-mode hooks in ADVAPI32.dll:

CryptEncrypt

The Trojan installs the following user-mode hooks in WS2_32.dll:

WSASend
recv
gethostbyname
WSARecv
send
getaddrinfo

The Trojan installs the following user-mode hooks in kernel32.dll:

CreateProcessInternalW
LoadLibraryExW

The Trojan installs the following user-mode hooks in ntdll.dll:

RtlGetNativeSystemInformation
NtQueryInformationProcess

Propagation

Removals

Remove it with Ad-Aware

Click (here) to download and install Ad-Aware Free Antivirus.
Update the definition files.
Run a full scan of your computer.

Manual removal*

Scan a system with an anti-rootkit tool.
Terminate malicious process(es) (How to End a Process With the Task Manager):
%original file name%.exe:1156
attrib.exe:1932
Delete the original Trojan file.
Delete or disinfect the following files created/modified by the Trojan:
%Documents and Settings%\All Users\Application Data\d0hh048ddd.exe (4185 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\2d17e659d34601689591 (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\NTUSER.DAT.LOG (7416 bytes)
Delete the following value(s) in the autorun key (How to Work with System Registry):
[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"IntelPowerAgent64" = "rundll32.exe shell32.dll, ShellExec_RunDLL C:\DOCUME~1\ALLUSE~1\APPLIC~1\D0HH04~1.EXE"
Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
Reboot the computer.

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

VersionInfo

Company Name:
Product Name:
Product Version:
Legal Copyright:
Legal Trademarks:
Original Filename:
Internal Name:
File Version:
File Description:
Comments:
Language: English (United States)

Company Name: Product Name: Product Version: Legal Copyright: Legal Trademarks: Original Filename: Internal Name: File Version: File Description: Comments: Language: English (United States)

PE Sections

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Section MD5
.text	4096	38170	40960	4.24785	e39baa5e8374acb58089a9ea204ee810
.rdata	45056	9554	12288	3.45397	faba8c448c715d14966f345edfa876bd
.data	57344	512536	4096	0.18937	309143eec9eb8cb63ab7dd2c120c11d7
.rsrc	573440	904	4096	0.651009	e2eac8f044f29fe83311dc34648a2350

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Total found: 18
e03fc730c82a946c8bae47b8ee170482
c79d637339fd7facceabb88f47e93d4b
a3f203a4d0edfb4551d276d1e619150d
72c2e6526d655fcb60a42c38b43eed95
5b922b453379bff49411ccfeeec12b57
f663e0bb08ef761c493659078a47dbca
907b9edff1063388a7b47455cc8de7ce
23eb5914772fbbc6ece6f181944c82c3
e6fc8d256cd02772b550d8de91f999a8
730d67807e2e4020583415b48f3071e1
cbdf45b834e63323319177d67dc2304c
07353a1878f0389cfeab1bf36c58a36e
fb115bb2cc8df01a5751f65c4241c5e9
1180b5ef7dd644e2642bc14441822ab0
a8c9e42457796d3ed873acc587b4a9bb
42bc26f94ff8f53c9e8f7506ce41f605
25823f6fc96a6ff4f2c93178eda92910
245bb7064c60c6763feae00413afc8f8

Network Activity

URLs

URL	IP
download.windowsupdate.com	213.155.152.146
www.microsoft.com	23.64.223.148

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

Map

The Trojan connects to the servers at the folowing location(s):

Strings from Dumps

icardagt.exe_2000:

.text

`.data

.rsrc

f:\dd\ndp\indigo\src\infocard\agent\common.cpp

f:\dd\ndp\indigo\src\infocard\agent\desktop.h

f:\dd\ndp\indigo\src\infocard\agent\agentmodule.cpp

f:\dd\ndp\indigo\src\infocard\agent\crypthash.cpp

f:\dd\ndp\indigo\src\infocard\agent\claim.cpp

f:\dd\ndp\indigo\src\infocard\agent\infocard.cpp

f:\dd\ndp\indigo\src\infocard\agent\recipient.cpp

f:\dd\ndp\indigo\src\infocard\agent\uiagent.cpp

f:\dd\ndp\indigo\src\infocard\agent\asyncrequest.h

f:\dd\ndp\indigo\src\infocard\agent\agentservicerequest.h

f:\dd\ndp\indigo\src\infocard\agent\asynccreatesecuritytokenrequest.h

f:\dd\ndp\indigo\src\infocard\agent\userpreference.cpp

f:\dd\ndp\indigo\src\infocard\agent\deletecardrequest.cpp

f:\dd\ndp\indigo\src\infocard\agent\getcertificaterequest.cpp

f:\dd\ndp\indigo\src\infocard\agent\roundrectanglematrix.cpp

f:\dd\ndp\indigo\src\infocard\agent\fontmanager.cpp

f:\dd\ndp\indigo\src\infocard\agent\imagebase.cpp

f:\dd\ndp\indigo\src\infocard\agent\cardimage.cpp

f:\dd\ndp\indigo\src\infocard\agent\card.cpp

f:\dd\ndp\indigo\src\infocard\agent\backbuttoncontrolimpl.cpp

f:\dd\ndp\indigo\src\infocard\agent\control.h

f:\dd\ndp\indigo\src\infocard\agent\commandlinkcontrolimpl.cpp

f:\dd\ndp\indigo\src\infocard\agent\syslinkcontrolimpl.cpp

f:\dd\ndp\indigo\src\infocard\agent\certificatecontrol.cpp

f:\dd\ndp\indigo\src\infocard\agent\certificateviewer.cpp

f:\dd\ndp\indigo\src\infocard\agent\claimseditor.h

f:\dd\ndp\indigo\src\infocard\agent\claimseditor.cpp

f:\dd\ndp\indigo\src\infocard\agent\headercontrol.h

f:\dd\ndp\indigo\src\infocard\agent\utility.h

f:\dd\ndp\indigo\src\infocard\agent\imagelist.h

f:\dd\ndp\indigo\src\infocard\agent\gdiobject.h

f:\dd\ndp\indigo\src\infocard\agent\cardlistcontrol.cpp

f:\dd\ndp\indigo\src\infocard\agent\contextcontrol.cpp

f:\dd\ndp\indigo\src\infocard\agent\listviewcontrol.cpp

f:\dd\ndp\indigo\src\infocard\agent\richeditcontrol.cpp

f:\dd\ndp\indigo\src\infocard\agent\pagecontrol.cpp

f:\dd\ndp\indigo\src\infocard\agent\taskcontrol.cpp

f:\dd\ndp\indigo\src\infocard\agent\shutdowndialog.cpp

f:\dd\ndp\indigo\src\infocard\agent\monitorwindow.cpp

f:\dd\ndp\indigo\src\infocard\agent\monitorwindows.cpp

f:\dd\ndp\indigo\src\infocard\agent\page.cpp

f:\dd\ndp\indigo\src\infocard\agent\checkboxcontrol.h

f:\dd\ndp\indigo\src\infocard\agent\carddetailpage.cpp

f:\dd\ndp\indigo\src\infocard\agent\menu.h

f:\dd\ndp\indigo\src\infocard\agent\cardpickerpage.cpp

f:\dd\ndp\indigo\src\infocard\agent\credentialspage.cpp

f:\dd\ndp\indigo\src\infocard\agent\credentialcardpage.cpp

f:\dd\ndp\indigo\src\infocard\agent\certificatecredentialpage.cpp

f:\dd\ndp\indigo\src\infocard\agent\recipientinformationcontrol.cpp

f:\dd\ndp\indigo\src\infocard\agent\deletecardpage.cpp

f:\dd\ndp\indigo\src\infocard\agent\editcardpage.cpp

f:\dd\ndp\indigo\src\infocard\agent\importcardpage.cpp

f:\dd\ndp\indigo\src\infocard\agent\lockcodepage.cpp

f:\dd\ndp\indigo\src\infocard\agent\networkaccesspage.cpp

f:\dd\ndp\indigo\src\infocard\agent\pinpage.cpp

f:\dd\ndp\indigo\src\infocard\agent\policypage.cpp

f:\dd\ndp\indigo\src\infocard\agent\commandlinkcontrol.h

f:\dd\ndp\indigo\src\infocard\agent\rippage.cpp

f:\dd\ndp\indigo\src\infocard\agent\selectcardspage.cpp

f:\dd\ndp\indigo\src\infocard\agent\authenticationstate.cpp

f:\dd\ndp\indigo\src\infocard\agent\authenticationwindowstate.h

f:\dd\ndp\indigo\src\infocard\agent\carddetailstate.cpp

f:\dd\ndp\indigo\src\infocard\agent\mainwindowstate.h

f:\dd\ndp\indigo\src\infocard\agent\cardnotselectedstate.cpp

f:\dd\ndp\indigo\src\infocard\agent\cardpickerstate.cpp

f:\dd\ndp\indigo\src\infocard\agent\cardselectedstate.cpp

f:\dd\ndp\indigo\src\infocard\agent\changepinstate.cpp

f:\dd\ndp\indigo\src\infocard\agent\copycardstate.cpp

f:\dd\ndp\indigo\src\infocard\agent\createtokenstate.cpp

f:\dd\ndp\indigo\src\infocard\agent\credentialsstate.cpp

f:\dd\ndp\indigo\src\infocard\agent\deletecardstate.cpp

f:\dd\ndp\indigo\src\infocard\agent\editcardstate.cpp

f:\dd\ndp\indigo\src\infocard\agent\exportselectstate.cpp

f:\dd\ndp\indigo\src\infocard\agent\exportpasswordstate.cpp

f:\dd\ndp\indigo\src\infocard\agent\exportfilestate.cpp

f:\dd\ndp\indigo\src\infocard\agent\gettokenstate.cpp

f:\dd\ndp\indigo\src\infocard\agent\importstate.cpp

f:\dd\ndp\indigo\src\infocard\agent\importcardstate.cpp

f:\dd\ndp\indigo\src\infocard\agent\importcardpolicystate.cpp

f:\dd\ndp\indigo\src\infocard\agent\importpasswordstate.cpp

f:\dd\ndp\indigo\src\infocard\agent\importselectstate.cpp

f:\dd\ndp\indigo\src\infocard\agent\lockcardstate.cpp

f:\dd\ndp\indigo\src\infocard\agent\managestate.cpp

f:\dd\ndp\indigo\src\infocard\agent\newcardstate.cpp

f:\dd\ndp\indigo\src\infocard\agent\removepinstate.cpp

f:\dd\ndp\indigo\src\infocard\agent\ripstate.cpp

f:\dd\ndp\indigo\src\infocard\agent\topstate.cpp

f:\dd\ndp\indigo\src\infocard\agent\unlockcardstate.cpp

f:\dd\ndp\indigo\src\infocard\agent\statecontext.cpp

f:\dd\ndp\indigo\src\infocard\agent\mainwindowcontext.cpp

f:\dd\ndp\indigo\src\infocard\agent\authenticationwindowcontext.cpp

f:\dd\ndp\indigo\src\infocard\agent\mainwindow.cpp

f:\dd\ndp\indigo\src\infocard\agent\mainhelperwindow.cpp

f:\dd\ndp\indigo\src\infocard\agent\authenticationwindow.cpp

f:\dd\ndp\indigo\src\infocard\agent\displaytoken.cpp

f:\dd\ndp\indigo\src\infocard\agent\rpccryptoservice.cpp

f:\dd\ndp\indigo\src\infocard\agent\cryptkey.h

f:\dd\ndp\indigo\src\infocard\agent\rpccryptocontext.cpp

f:\dd\ndp\indigo\src\infocard\agent\x509certificatetokenfactorycredential.cpp

305.1if:\dd\ndp\indigo\src\infocard\agent\accannotationhelper.cpp

f:\dd\ndp\indigo\src\infocard\agent\deletestorestate.cpp

f:\dd\ndp\indigo\src\infocard\agent\agentmodulebase.cpp

f:\dd\ndp\indigo\src\infocard\agent\helpwindow.cpp

f:\dd\ndp\indigo\src\infocard\agent\getfilenamefromuserrequest.h

f:\dd\ndp\indigo\src\infocard\agent\getfilenamefromuserrequest.cpp

f:\dd\ndp\indigo\src\infocard\agent\selectcreatecardpage.cpp

f:\dd\ndp\indigo\src\infocard\agent\selectcreatecardstate.cpp

f:\dd\ndp\indigo\src\infocard\agent\webclient.cpp

f:\dd\ndp\indigo\src\infocard\agent\x509certlogoclient.cpp

f:\dd\ndp\indigo\src\infocard\agent\asyncwebclient.cpp

f:\dd\ndp\indigo\src\infocard\agent\notificationcontrol.cpp

f:\dd\ndp\indigo\src\infocard\agent\cardusagecontrol.cpp

f:\dd\ndp\indigo\src\infocard\agent\horizontalbuttonstrip.cpp

f:\dd\ndp\indigo\src\infocard\agent\cardusagestate.cpp

f:\dd\ndp\indigo\src\infocard\agent\cardsummaryviewcontrol.cpp

f:\dd\ndp\indigo\src\infocard\agent\fileselectpage.cpp

f:\dd\ndp\indigo\src\infocard\agent\importfileselectstate.cpp

f:\dd\ndp\indigo\src\infocard\agent\preferencespage.cpp

f:\dd\ndp\indigo\src\infocard\agent\preferencesstate.cpp

f:\dd\ndp\indigo\src\infocard\agent\lockcode.cpp

f:\dd\ndp\indigo\src\infocard\agent\lockcodeeditcontrol.cpp

f:\dd\ndp\indigo\src\infocard\agent\selectfilepage.cpp

f:\dd\ndp\indigo\src\infocard\agent\claimnamecontrol.cpp

f:\dd\ndp\indigo\src\infocard\agent\progressstate.cpp

f:\dd\ndp\indigo\src\infocard\agent\commonfiledialogbase.cpp

f:\dd\ndp\indigo\src\infocard\agent\vistacommonfiledialog.cpp

f:\dd\ndp\indigo\src\infocard\agent\filedialog.cpp

f:\dd\ndp\indigo\src\infocard\agent\errorwindow.cpp

f:\dd\ndp\indigo\src\infocard\agent\claimvaluecontrolimpl.cpp

kernel32.dll

icardagt.pdb

PSSj%S

8P%u#

t1It.It

Wj.hl~@

x8SSh

x8SSh!

_amsg_exit

_wcmdln

MSVCR80.dll

_crt_debugger_hook

MSVCP80.dll

RegCloseKey

RegOpenKeyExW

CryptDestroyKey

ReportEventW

CryptGetUserKey

ADVAPI32.dll

KERNEL32.dll

GDI32.dll

GetKeyboardLayout

GetKeyboardLayoutList

GetKeyState

MsgWaitForMultipleObjects

USER32.dll

COMCTL32.dll

comdlg32.dll

CryptUIDlgViewCertificateW

CRYPTUI.dll

GdiplusShutdown

gdiplus.dll

MSIMG32.dll

ole32.dll

RPCRT4.dll

SHLWAPI.dll

UxTheme.dll

CertFreeCertificateContext

CertCreateCertificateContext

CertCloseStore

CertDuplicateCertificateContext

CertDuplicateStore

CertFindCertificateInStore

CertStrToNameW

CertOpenStore

CertSerializeCertificateStoreElement

CryptAcquireCertificatePrivateKey

CertOIDToAlgId

CRYPT32.dll

USERENV.dll

ShellExecuteExW

SHELL32.dll

VERSION.dll

HttpQueryInfoW

HttpSendRequestW

HttpOpenRequestW

InternetCrackUrlW

WININET.dll

GetProcessHeap

.PAVInfoCardException@@

PAPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDING

%SystemRoot%\System32\icardres.dll

%systemroot%\system32\msctfmonitor.dll

strMessage.LoadStringW( 527 )

ShellExecEx failed on wisptis.exe AgentModule::StartTabletProcessesIfNeeded()

CloseHandle( shexinfo.hProcess )

Successfully terminated wisptis.exe process early.

Failed to terminuate wisptis.exe AgentModule::StartTabletProcessesIfNeeded()

\wisptis.exe

rSelfIssuedClaimCount == m_mapClaimToIndex.size()

strClaim.length() > 0

strResource.LoadStringW( 105 )

!m_claims.empty()

A!m_pinHash.empty()

!newpin.empty()

m_pinHash.empty()

!oldpin.empty()

!m_pin.empty()

m_pinHash.size() == hash.size()

m_isCertCached

m_pAsyncImpl || !"AsyncRequest.IsComplete shouldn't be called after the operation is cancelled"

NULL != m_pOutArgs.get()

m_pAsyncImpl || !"AsyncRequest.GetOutArgs shouldn't be called after the operation is cancelled"

!"AsyncRequest.Process shouldn't be called after the operation is cancelled"

B!m_recipientIdentifier.empty()

GetCertificateRequest

strFaceName.LoadStringW( uFaceNameId )

strMessage.LoadStringW( 512 )

strMessage.LoadStringW( 517 )

Bg.DrawImage( pOldBitmap, rectNew, 0, 0, sizeOldBitmap.cx, sizeOldBitmap.cy, UnitPixel ) == Ok

g.SetInterpolationMode( InterpolationModeHighQualityBicubic ) == Ok

strText.LoadStringW( 80 )

strUnnamed.LoadStringW( 101 )

m_imageGlyph.LoadFromUserDefinedResource( 413, 256 )

WM_NCCREATE == uMsg

0 != wci.Register( &wci.pWndProc )

m_imageGlyph.LoadFromUserDefinedResource( 406, 256 )

DCertificateControl

strLock.LoadStringW( 1404 )

strNotVerified.LoadStringW( 1408 )

logoString.LoadStringW( 1126 )

logoString.LoadStringW( 1127 )

logoString.LoadStringW( 1125 )

logoString.LoadStringW( 1135 )

strTitle.LoadStringW( 1124 )

strTitle.LoadStringW( 1122 )

strNote.LoadStringW( 1139 )

strTitle.LoadStringW( 1132 )

strTitle.LoadStringW( 1131 )

strTitle.LoadStringW( 1137 )

strName.LoadStringW( uNameId )

strTitle.LoadStringW( 1136 )

strError.LoadStringW( 528 )

BnameStr.LoadStringW( uNameId )

hstr.LoadStringW( strId )

m_unspecifiedStr.LoadStringW( 621 )

m_femaleStr.LoadStringW( 620 )

m_maleStr.LoadStringW( 619 )

strGroup.LoadStringW( 882 )

strGroup.LoadStringW( 884 index )

strGroup.LoadStringW( 880 index )

notSpecified.LoadStringW( 624 )

str.LoadStringW( 618 )

gender.LoadStringW( 619 )

gender.LoadStringW( 620 )

nIndex ( m_data.size() 2 m_history.size() m_details.size() GroupMaxValue 2 )

m_details.end() != simpleVal

imageLabel.LoadStringW( 613 )

nameLabel.LoadStringW( 612 )

BrequiredIndicator.LoadStringW( 626 )

DisplayClaimList == displayToken.GetDisplayType()

hXXp://schemas.xmlsoap.org/ws/2005/05/identity/claims/dateofbirth

hXXp://schemas.xmlsoap.org/ws/2005/05/identity/claims/gender

hXXp://schemas.xmlsoap.org/ws/2005/05/identity/claims/privatepersonalidentifier

addCardName.LoadStringW( 900 )

strOther.LoadStringW( 899 )

strOther.LoadStringW( 897 )

strUsed.LoadStringW( 898 )

strHeader.LoadStringW( 897 )

strName.LoadStringW( 896 )

m_strContext.LoadStringW( uId )

m_strUEText.LoadStringW( uId )

m_image.LoadFromUserDefinedResource( 412, 256 )

priched20.dll

D!button.IsWindow()

text.LoadStringW( 135 )

controlText.LoadStringW( uTextId )

m_titleText.LoadStringW(titleTextId)

0 != pMonitorWindows

strCaption.LoadStringW( 96 )

notifyMessage.LoadStringW( 604 )

notifyMessage.LoadStringW( 1266 )

notifyMessage.LoadStringW( 602 )

notifyMessage.LoadStringW( 601 )

notifyMessage.LoadStringW( 609 )

notifyMessage.LoadStringW( 636 )

strItem.LoadStringW( uStringId )

strText.LoadStringW( 940 )

strText.LoadStringW( 627 )

strText.LoadStringW( 955 )

strText.LoadStringW( 934 )

strPersonal.LoadStringW( 932 )

strManaged.LoadStringW( 933 )

strText.LoadStringW( 935 )

strButtonText.LoadStringW( 584 )

strButtonText.LoadStringW( 585 )

m_strPreviewText.LoadStringW( 930 )

iconAnnotation.LoadStringW( 1407 )

strText.LoadStringW( replacementId )

pstrTitle.LoadStringW( 682 )

strError.LoadStringW( uErrorId )

EstrTitle.LoadStringW( 814 )

strShield.LoadStringW( 1407 )

EusageText.LoadStringW( 633 )

EstrError.LoadStringW( 529 )

EstrButton.LoadStringW( 727 )

Emsg.LoadStringW( messageId )

strAnnotation.LoadStringW( 122 )

strText.LoadStringW( 758 )

strText.LoadStringW( 759 )

strText.LoadStringW( 760 )

strText.LoadStringW( 757 )

hstrMessage.LoadStringW( 526 )

strMessage.LoadStringW( 516 )

Dmessage.IsCommand()

name.LoadStringW( nameTxtId )

strAddText.LoadStringW( 584 )

strAddText.LoadStringW( 585 )

message.IsNotify()

DGetContext().IsCardSelected()

strPrefix.LoadStringW( 100 )

strGenericError.LoadString( IDS_E_ICARD_FAILED_NETWORK_ACCESS )

strMessage.LoadStringW( 520 )

plockCodeA.Unprotect()

pstrCue.LoadStringW( 1158 )

warningTitle.LoadStringW( 0x1400 )

warningText.LoadStringW( 0x1401 )

pstrMessage.LoadStringW( 524 )

DstrMessage.LoadStringW( 521 )

DpAgent && pImport

plockCode.Protect()

lockCode.Unprotect()

DpImport

ERecipientTypeX509 == recipient.GetRecipientType()

EstrMessage.LoadStringW( 523 )

strWindowName.LoadStringW( 97 )

windowParent.GetWindowRect( rectParent )

strWindowName.LoadStringW( 98 )

CancelAsyncOperationRequest

EGetImportedCardRequest

EExportFileRequest

NULL != m_hCryptKey

EstrMessage.LoadStringW( 1360 )

ImportFileRequest

EGetImportFileNameRequest

ppropStr.LoadStringW( iStrId )

E%SystemRoot%\System32\icardres.dll

The Windows CardSpace User Interface Agent was not able to load the MUI Library. This indicates a problem with the installation of Windows CardSpace. Contact your system administrator

CardSpace 3.0.0.0

NULL != s_pAgentModule.get()

p\StringFileInfo\xx\FileDescription

version.dll

NULL == s_pAgentModule.get()

D\StringFileInfo\xx\ProductVersion

13d389bc-393e-47bf-b667-aafe93ac6b63

Reporting file dialog selection to idsvc. pwszFileChoice=%1!ws!

strWindowName.LoadStringW( 0x1201 )

%u %ld %ld %ld %ld "%s"

FileType::Unspecified

m_userAgentString.LoadStringW( 106 )

0 == m_logoBytes.size()

0 == m_downloadBytes.size()

iconAnnotation.LoadStringW( uIconText )

notifyIconText.LoadStringW( 890 )

bullet.LoadStringW( 107 )

notification.LoadStringW( uTextId )

noItemsText.LoadStringW( 846 )

colum1text.LoadStringW( 842 )

colum0text.LoadStringW( 841 )

noItemsText.LoadStringW( 843 )

rect.X rect.Width >= container.X && rect.X rect.Width

rect.X >= container.X && rect.X

nameTxt.LoadStringW( uNameTextId )

EstrFilePath.LoadStringW( 1158 )

strFilePath.LoadStringW( 1159 )

DFileType::ImportCard == fileType || FileType::ImportStore == fileType

strCueManaged.LoadStringW( 1159 )

strMessage.LoadStringW( 530 )

txt.LoadStringW(uLabelTextId)

colon.LoadStringW( 1281 )

strMessage.LoadStringW( uExtensionErrorId )

strMessage.LoadStringW( 522 )

strFilter.LoadStringW( uFilterId )

strTitle.LoadStringW( uTitleId )

pstrWindowName.LoadStringW( uWindowName )

Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}

.\%s.mui

.\%s\%s.mui

%s\%s.mui

%s\%s\%s.mui

%s\%s

%S:%d: %s

Windows CardSpace User Interface Agent

3.0.4506.648 (Winfxred.004506-0648)

.NET Framework

3.0.4506.648

icardagt.exe_2000_rwx_00A70000_00026000:

.text

`.rdata

@.data

.reloc

SSSh`M

SSSSh

|$L.to

%x.tmp

|.^$* ?()[\

%%%d%s

%s\%s

Z:\coding\project\main\payload\payload.x86.pdb

CallNamedPipeA

ConnectNamedPipe

GetSystemWindowsDirectoryA

DisconnectNamedPipe

CreateNamedPipeA

KERNEL32.dll

GetKeyboardState

USER32.dll

GDI32.dll

RegOpenKeyExA

RegCloseKey

RegNotifyChangeKeyValue

RegFlushKey

ADVAPI32.dll

SHELL32.dll

ODBC32.dll

WS2_32.dll

SHLWAPI.dll

ntdll.dll

HttpQueryInfoA

HttpAddRequestHeadersW

HttpAddRequestHeadersA

WININET.dll

CryptAcquireCertificatePrivateKey

CertOpenStore

CertOpenSystemStoreW

CertFreeCertificateContext

CertAddCertificateContextToStore

CertFindCertificateInStore

CertCloseStore

CertGetNameStringA

CryptVerifyCertificateSignature

PFXImportCertStore

CertEnumCertificatesInStore

CertEnumSystemStore

CertNameToStrA

CertVerifyTimeValidity

PFXExportCertStoreEx

CRYPT32.dll

WinHttpQueryOption

WinHttpSendRequest

WinHttpConnect

WinHttpOpen

WinHttpOpenRequest

WinHttpCloseHandle

WinHttpSetOption

WINHTTP.dll

GetProcessHeap

MsgWaitForMultipleObjects

ExitWindowsEx

ShellExecuteExA

ole32.dll

OLEAUT32.dll

WinSCard.dll

GetTcpTable

IPHLPAPI.DLL

WINTRUST.dll

SensApi.dll

HttpOpenRequestA

HttpSendRequestA

urlmon.dll

gdiplus.dll

USERENV.dll

payload.x86.dll

%Documents and Settings%\All Users\Application Data\d0hh048ddd.exe

\\.\pipe\ffb23cf9

a8a56912x

a8a5691dx

%System%\icardagt.exe

%Documents and Settings%\%current user%

?.?5?:???\?

Windows Explorer

Explorer.EXE_532_rwx_02250000_00026000:

.text

`.rdata

@.data

.reloc

SSSh`M%

SSSSh

|$L.to

%x.tmp

|.^$* ?()[\

%%%d%s

%s\%s

Z:\coding\project\main\payload\payload.x86.pdb

CallNamedPipeA

ConnectNamedPipe

GetSystemWindowsDirectoryA

DisconnectNamedPipe

CreateNamedPipeA

KERNEL32.dll

GetKeyboardState

USER32.dll

GDI32.dll

RegOpenKeyExA

RegCloseKey

RegNotifyChangeKeyValue

RegFlushKey

ADVAPI32.dll

SHELL32.dll

ODBC32.dll

WS2_32.dll

SHLWAPI.dll

ntdll.dll

HttpQueryInfoA

HttpAddRequestHeadersW

HttpAddRequestHeadersA

WININET.dll

CryptAcquireCertificatePrivateKey

CertOpenStore

CertOpenSystemStoreW

CertFreeCertificateContext

CertAddCertificateContextToStore

CertFindCertificateInStore

CertCloseStore

CertGetNameStringA

CryptVerifyCertificateSignature

PFXImportCertStore

CertEnumCertificatesInStore

CertEnumSystemStore

CertNameToStrA

CertVerifyTimeValidity

PFXExportCertStoreEx

CRYPT32.dll

WinHttpQueryOption

WinHttpSendRequest

WinHttpConnect

WinHttpOpen

WinHttpOpenRequest

WinHttpCloseHandle

WinHttpSetOption

WINHTTP.dll

GetProcessHeap

MsgWaitForMultipleObjects

ExitWindowsEx

ShellExecuteExA

ole32.dll

OLEAUT32.dll

WinSCard.dll

GetTcpTable

IPHLPAPI.DLL

WINTRUST.dll

SensApi.dll

HttpOpenRequestA

HttpSendRequestA

urlmon.dll

gdiplus.dll

USERENV.dll

payload.x86.dll

%Documents and Settings%\All Users\Application Data\d0hh048ddd.exe

\\.\pipe\ffb23cf9

a8a56912x

a8a5691dx

%WinDir%\explorer.exe

?.?5?:???\?

Windows Explorer

Summary

Dynamic Analysis

Removals

Static Analysis

Network Activity

Map

Strings from Dumps