Trojan-Dropper.Win32.Injector.jksa (Kaspersky), Win32.Virtob.Gen.12 (B) (Emsisoft), Win32.Virtob.Gen.12 (AdAware), Trojan.NSIS.StartPage.FD, BackdoorMorix.YR (Lavasoft MAS)Behaviour: Trojan-Dropper, Trojan, Backdoor
The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.
Summary
MD5: 453f39ae5ea386ce7c024249ae393804
SHA1: c4199f9ef2363bbd28f4dbd86b6e9a279743484b
SHA256: 472f9c7ff8691254a6fd18eb110bea62ba85897e9cb143b3acdde87c9f5bed81
SSDeep: 196608:epg81OENlDjllJbaPEvH/El5F3ISEsPYXYmZ79Svholf:e3UEN1llnvfiDyjSvhwf
Size: 8040194 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: UPolyXv05_v6
Company: CinemXidv1.3V23.09
Created at: 2009-12-04 15:35:59
Analyzed on: WindowsXP SP3 32-bit
Summary: Trojan-Dropper. Trojan program, intended for stealth installation of other malware into user's system.
Dynamic Analysis
Payload
No specific payload has been found.
Process activity
The Trojan creates the following process(es):
%original file name%.exe:1068
The Trojan injects its code into the following process(es):
360.exe:1076
lmy.exe:1312
Mutexes
The following mutexes were created/opened:No objects were found.
File activity
The process 360.exe:1076 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
%WinDir%\Temp\2011.exe (1281 bytes)
%WinDir%\V2011.exe (1281 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\Startup\SVCHOST.SCR (1281 bytes)
The process %original file name%.exe:1068 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\lmy.exe (53851 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\360.exe (203 bytes)
The process lmy.exe:1312 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\nsr3.tmp\System.dll (11 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsm2.tmp (608329 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsr3.tmp\FindProcDLL.dll (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsr3.tmp\ÃÂÂúÂÃÂÂÓÎ.zip (8560 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsr3.tmp\nsDialogs.dll (9 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsr3.tmp\SkinSE_NSIS.dll (784 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsr3.tmp\left.bmp (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsr3.tmp\SkinSE.dll (9608 bytes)
The Trojan deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\nsr3.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsm1.tmp (0 bytes)
Registry activity
The process 360.exe:1076 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "B7 2B C2 2F 96 0B E3 38 64 A5 C2 37 0E FB 36 5D"
[HKLM\System\CurrentControlSet\Control\Session Manager]
"PendingFileRenameOperations" = "\??\%WinDir%\temp\2011.exe, \??\%Documents and Settings%\All Users\¡¸¿ªÊ¼¡¹²Ëµ¥\³ÌÃÂÂò\Æô¶¯\SVCHOST.SCR"
To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"V2011" = "%WinDir%\V2011.exe"
The process %original file name%.exe:1068 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "F9 24 37 53 99 0C CC 77 19 5C 3D F8 E5 DE 84 8C"
The process lmy.exe:1312 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "33 45 BC E7 54 94 8A 06 F8 C9 CC 68 79 B5 61 AB"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Multimedia\DrawDib]
"vga.drv 1024x768x32(BGR 0)" = "31,31,31,31"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"
Dropped PE files
| MD5 | File path |
|---|---|
| 68e209435cc8364b45d12552be046be9 | c:\Documents and Settings\All Users\Start Menu\Programs\Startup\SVCHOST.SCR |
| 68e209435cc8364b45d12552be046be9 | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\360.exe |
| 7995ae4b018d78c249a9dd5986d47f0e | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\lmy.exe |
HOSTS file anomalies
No changes have been detected.
Rootkit activity
The Trojan installs the following user-mode hooks in ntdll.dll:
NtQueryInformationProcess
ZwOpenFile
NtDeviceIoControlFile
NtCreateProcessEx
NtCreateProcess
NtCreateFile
Propagation
Removals
Remove it with Ad-Aware
- Click (here) to download and install Ad-Aware Free Antivirus.
- Update the definition files.
- Run a full scan of your computer.
Manual removal*
- Scan a system with an anti-rootkit tool.
- Terminate malicious process(es) (How to End a Process With the Task Manager):
%original file name%.exe:1068
- Delete the original Trojan file.
- Delete or disinfect the following files created/modified by the Trojan:
%WinDir%\Temp\2011.exe (1281 bytes)
%WinDir%\V2011.exe (1281 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\Startup\SVCHOST.SCR (1281 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\lmy.exe (53851 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\360.exe (203 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsr3.tmp\System.dll (11 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsm2.tmp (608329 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsr3.tmp\FindProcDLL.dll (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsr3.tmp\ÃÂÂúÂÃÂÂÓÎ.zip (8560 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsr3.tmp\nsDialogs.dll (9 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsr3.tmp\SkinSE_NSIS.dll (784 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsr3.tmp\left.bmp (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsr3.tmp\SkinSE.dll (9608 bytes) - Delete the following value(s) in the autorun key (How to Work with System Registry):
[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"V2011" = "%WinDir%\V2011.exe" - Reboot the computer.
Static Analysis
VersionInfo
No information is available.
No information is available.
PE Sections
| Name | Virtual Address | Virtual Size | Raw Size | Entropy | Section MD5 |
|---|---|---|---|---|---|
| CODE | 4096 | 40448 | 40448 | 4.53268 | f4d2726f5a89f7b49f9144828631e64e |
| DATA | 45056 | 15632 | 15872 | 5.26127 | 1fb0fcf0a8c302fd1e7df6150f434d7e |
| BSS | 61440 | 1825 | 0 | 0 | d41d8cd98f00b204e9800998ecf8427e |
| .idata | 65536 | 1730 | 2048 | 2.91217 | 9e9581a6aeb1c6de49e8280941f8bb34 |
| .tls | 69632 | 8 | 0 | 0 | d41d8cd98f00b204e9800998ecf8427e |
| .rdata | 73728 | 24 | 512 | 0.142404 | 996c4942e3a4d2795a22f3ace698d094 |
| .reloc | 77824 | 1792 | 2048 | 4.24404 | d645c969d7346a611453d5e9e94c66f4 |
| .rsrc | 81920 | 7801344 | 7800320 | 5.54496 | b208d68c8c81d7644e4b61d2722db94d |
| wteqslb | 7884800 | 4096 | 0 | 0 | d41d8cd98f00b204e9800998ecf8427e |
| .jgd | 7888896 | 4096 | 2048 | 0 | c99a74c555371a433d121f551d6c6398 |
Dropped from:
Downloaded by:
Similar by SSDeep:
Similar by Lavasoft Polymorphic Checker:
Network Activity
URLs
IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)
Traffic
Map
The Trojan connects to the servers at the folowing location(s):
Strings from Dumps
360.exe_1076:
.text
.text
.rdata
.rdata
@.data
@.data
.rsrc
.rsrc
|$<.tk>
|$<.tk>
D$XRPSSh
D$XRPSSh
USER32.dll
USER32.dll
GDI32.dll
GDI32.dll
ADVAPI32.dll
ADVAPI32.dll
SHELL32.dll
SHELL32.dll
SHLWAPI.dll
SHLWAPI.dll
deflate 1.1.4 Copyright 1995-2002 Jean-loup Gailly
deflate 1.1.4 Copyright 1995-2002 Jean-loup Gailly
inflate 1.1.4 Copyright 1995-2002 Mark Adler
inflate 1.1.4 Copyright 1995-2002 Mark Adler
WINMM.dll
WINMM.dll
__MSVCRT_HEAP_SELECT
__MSVCRT_HEAP_SELECT
user32.dll
user32.dll
WS2_32.dll
WS2_32.dll
WININET.dll
WININET.dll
MSVFW32.dll
MSVFW32.dll
PSAPI.DLL
PSAPI.DLL
WTSAPI32.dll
WTSAPI32.dll
GetAsyncKeyState
GetAsyncKeyState
GetKeyState
GetKeyState
ExitWindowsEx
ExitWindowsEx
EnumWindows
EnumWindows
keybd_event
keybd_event
MapVirtualKeyA
MapVirtualKeyA
EnumChildWindows
EnumChildWindows
SetProcessWindowStation
SetProcessWindowStation
OpenWindowStationA
OpenWindowStationA
GetProcessWindowStation
GetProcessWindowStation
RegCloseKey
RegCloseKey
RegOpenKeyExA
RegOpenKeyExA
RegCreateKeyA
RegCreateKeyA
RegOpenKeyA
RegOpenKeyA
RegCreateKeyExA
RegCreateKeyExA
RegSetKeySecurity
RegSetKeySecurity
RegEnumKeyExA
RegEnumKeyExA
RegDeleteKeyA
RegDeleteKeyA
RegQueryInfoKeyA
RegQueryInfoKeyA
RegRestoreKeyA
RegRestoreKeyA
RegSaveKeyA
RegSaveKeyA
ShellExecuteA
ShellExecuteA
SHDeleteKeyA
SHDeleteKeyA
InternetOpenUrlA
InternetOpenUrlA
GetWindowsDirectoryA
GetWindowsDirectoryA
WinExec
WinExec
CreatePipe
CreatePipe
DisconnectNamedPipe
DisconnectNamedPipe
KERNEL32.dll
KERNEL32.dll
ole32.dll
ole32.dll
OLEAUT32.dll
OLEAUT32.dll
NETAPI32.dll
NETAPI32.dll
MSVCRT.dll
MSVCRT.dll
AVICAP32.dll
AVICAP32.dll
GetCPInfo
GetCPInfo
%s//%s
%s//%s
Microsoft\Network\Connections\pbk\rasphone.pbk
Microsoft\Network\Connections\pbk\rasphone.pbk
\Application Data\Microsoft\Network\Connections\pbk\rasphone.pbk
\Application Data\Microsoft\Network\Connections\pbk\rasphone.pbk
RasDialParams!%s#0
RasDialParams!%s#0
%s\%s
%s\%s
%s\shell\open\command
%s\shell\open\command
%s\*.*
%s\*.*
%s%s%s
%s%s%s
%s%s*.*
%s%s*.*
a %s %s
a %s %s
a -r %s %s
a -r %s %s
rar.exe
rar.exe
x %s %s
x %s %s
SYSTEM\CurrentControlSet\Services\%s
SYSTEM\CurrentControlSet\Services\%s
Http/1.1 403 Forbidden
Http/1.1 403 Forbidden
:] %s
:] %s
:]%d-%d-%d %d:%d:%d
:]%d-%d-%d %d:%d:%d
s !socketClient.Connect !=-1
s !socketClient.Connect !=-1
Applications\iexplore.exe\shell\open\command
Applications\iexplore.exe\shell\open\command
ddd.exe
ddd.exe
Windows Windows7/Vista/2008
Windows Windows7/Vista/2008
Windows 2003
Windows 2003
Windows XP
Windows XP
Windows 2000
Windows 2000
Windows NT
Windows NT
QQPCTray.exe
QQPCTray.exe
KSafeTray.exe
KSafeTray.exe
kxetray.exe
kxetray.exe
egui.exe
egui.exe
exe.DnoMvaR
exe.DnoMvaR
KvMonXP.exe
KvMonXP.exe
avp.exe
avp.exe
exe.ds063
exe.ds063
360tray.exe
360tray.exe
PortNumber
PortNumber
SYSTEM\CurrentControlSet\Control\Terminal Server\Wds\rdpwd\Tds\tcp
SYSTEM\CurrentControlSet\Control\Terminal Server\Wds\rdpwd\Tds\tcp
:%dMB
:%dMB
:%dGB
:%dGB
.DEFAULT\Keyboard Layout\Toggle
.DEFAULT\Keyboard Layout\Toggle
Hotkey
Hotkey
SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp
SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp
SYSTEM\CurrentControlSet\Control\Terminal Server\RDPTcp
SYSTEM\CurrentControlSet\Control\Terminal Server\RDPTcp
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
SOFTWARE\Policies\Microsoft\Windows\Installer
SOFTWARE\Policies\Microsoft\Windows\Installer
SOFTWARE\Microsoft\Windows\CurrentVersion\netcache
SOFTWARE\Microsoft\Windows\CurrentVersion\netcache
C:\3389.bat
C:\3389.bat
REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\WinStations\RDP-Tcp /v PortNumber /t REG_DWORD /d
REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\WinStations\RDP-Tcp /v PortNumber /t REG_DWORD /d
REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\Wds\rdpwd\Tds\tcp /v PortNumber /t REG_DWORD /d
REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\Wds\rdpwd\Tds\tcp /v PortNumber /t REG_DWORD /d
c:\3389.bat
c:\3389.bat
gdt = x
gdt = x
idt = x
idt = x
%System%\ctfmon1.exe
%System%\ctfmon1.exe
%Documents and Settings%\All Users\
%Documents and Settings%\All Users\
\SVCHOST.SCR
\SVCHOST.SCR
%WinDir%\V2011.exe
%WinDir%\V2011.exe
kernel32.dll
kernel32.dll
hXXp://
hXXp://
ws2_32.dll
ws2_32.dll
@del 3596799a1543bc9f.aqq
@del 3596799a1543bc9f.aqq
afc9fe2f418b00a0.bat
afc9fe2f418b00a0.bat
%Documents and Settings%\All Users\Start Menu\Programs\Startup\SVCHOST.SCR
%Documents and Settings%\All Users\Start Menu\Programs\Startup\SVCHOST.SCR
%WinDir%\temp\svchost.exe
%WinDir%\temp\svchost.exe
%WinDir%\temp\2011.exe
%WinDir%\temp\2011.exe
%-25s %-15s 0x%x(%d)
%-25s %-15s 0x%x(%d)
%-25s %-15s %s
%-25s %-15s %s
\cmd.exe
\cmd.exe
PeekNamedPipe
PeekNamedPipe
recycle.{645FF040-5081-101B-9F08-00AA002F954E}\GHOSTBAK.exe
recycle.{645FF040-5081-101B-9F08-00AA002F954E}\GHOSTBAK.exe
Mozilla/4.0 (compatible)
Mozilla/4.0 (compatible)
hXXps://
hXXps://
ddd
ddd
passworD
passworD
OLEACC.DLL
OLEACC.DLL
Windows
Windows
%WinDir%\V2012.EXE
%WinDir%\V2012.EXE
%WinDir%\V2012.exe
%WinDir%\V2012.exe
%WinDir%\V2013.exe
%WinDir%\V2013.exe
taskkill /f /im KSafeTray.exe
taskkill /f /im KSafeTray.exe
Rstray.exe
Rstray.exe
%s\SysTEM32\sysedit.exe
%s\SysTEM32\sysedit.exe
Windows
Windows
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
explorer.exe
explorer.exe
1.1.4
1.1.4
zcÃ
zcÃ
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\360.exe
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\360.exe
[2014821135355]
[2014821135355]
2014821135355
2014821135355
3, 1, 3, 1000
3, 1, 3, 1000
Maxthon3.exe
Maxthon3.exe
360.exe_1076_rwx_00401000_00025000:
|$<.tk>
|$<.tk>
D$XRPSSh
D$XRPSSh
360.exe_1076_rwx_0042B000_00004000:
%s//%s
%s//%s
Microsoft\Network\Connections\pbk\rasphone.pbk
Microsoft\Network\Connections\pbk\rasphone.pbk
\Application Data\Microsoft\Network\Connections\pbk\rasphone.pbk
\Application Data\Microsoft\Network\Connections\pbk\rasphone.pbk
RasDialParams!%s#0
RasDialParams!%s#0
%s\%s
%s\%s
%s\shell\open\command
%s\shell\open\command
%s\*.*
%s\*.*
%s%s%s
%s%s%s
%s%s*.*
%s%s*.*
a %s %s
a %s %s
a -r %s %s
a -r %s %s
rar.exe
rar.exe
x %s %s
x %s %s
SYSTEM\CurrentControlSet\Services\%s
SYSTEM\CurrentControlSet\Services\%s
Http/1.1 403 Forbidden
Http/1.1 403 Forbidden
:] %s
:] %s
:]%d-%d-%d %d:%d:%d
:]%d-%d-%d %d:%d:%d
s !socketClient.Connect !=-1
s !socketClient.Connect !=-1
Applications\iexplore.exe\shell\open\command
Applications\iexplore.exe\shell\open\command
ddd.exe
ddd.exe
Windows Windows7/Vista/2008
Windows Windows7/Vista/2008
Windows 2003
Windows 2003
Windows XP
Windows XP
Windows 2000
Windows 2000
Windows NT
Windows NT
QQPCTray.exe
QQPCTray.exe
KSafeTray.exe
KSafeTray.exe
kxetray.exe
kxetray.exe
egui.exe
egui.exe
exe.DnoMvaR
exe.DnoMvaR
KvMonXP.exe
KvMonXP.exe
avp.exe
avp.exe
exe.ds063
exe.ds063
360tray.exe
360tray.exe
PortNumber
PortNumber
SYSTEM\CurrentControlSet\Control\Terminal Server\Wds\rdpwd\Tds\tcp
SYSTEM\CurrentControlSet\Control\Terminal Server\Wds\rdpwd\Tds\tcp
:%dMB
:%dMB
:%dGB
:%dGB
.DEFAULT\Keyboard Layout\Toggle
.DEFAULT\Keyboard Layout\Toggle
Hotkey
Hotkey
SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp
SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp
SYSTEM\CurrentControlSet\Control\Terminal Server\RDPTcp
SYSTEM\CurrentControlSet\Control\Terminal Server\RDPTcp
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
SOFTWARE\Policies\Microsoft\Windows\Installer
SOFTWARE\Policies\Microsoft\Windows\Installer
SOFTWARE\Microsoft\Windows\CurrentVersion\netcache
SOFTWARE\Microsoft\Windows\CurrentVersion\netcache
C:\3389.bat
C:\3389.bat
REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\WinStations\RDP-Tcp /v PortNumber /t REG_DWORD /d
REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\WinStations\RDP-Tcp /v PortNumber /t REG_DWORD /d
REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\Wds\rdpwd\Tds\tcp /v PortNumber /t REG_DWORD /d
REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\Wds\rdpwd\Tds\tcp /v PortNumber /t REG_DWORD /d
c:\3389.bat
c:\3389.bat
gdt = x
gdt = x
idt = x
idt = x
%System%\ctfmon1.exe
%System%\ctfmon1.exe
%Documents and Settings%\All Users\
%Documents and Settings%\All Users\
\SVCHOST.SCR
\SVCHOST.SCR
%WinDir%\V2011.exe
%WinDir%\V2011.exe
kernel32.dll
kernel32.dll
hXXp://
hXXp://
ws2_32.dll
ws2_32.dll
KERNEL32.dll
KERNEL32.dll
@del 3596799a1543bc9f.aqq
@del 3596799a1543bc9f.aqq
afc9fe2f418b00a0.bat
afc9fe2f418b00a0.bat
%Documents and Settings%\All Users\Start Menu\Programs\Startup\SVCHOST.SCR
%Documents and Settings%\All Users\Start Menu\Programs\Startup\SVCHOST.SCR
%WinDir%\temp\svchost.exe
%WinDir%\temp\svchost.exe
%WinDir%\temp\2011.exe
%WinDir%\temp\2011.exe
%-25s %-15s 0x%x(%d)
%-25s %-15s 0x%x(%d)
%-25s %-15s %s
%-25s %-15s %s
\cmd.exe
\cmd.exe
PeekNamedPipe
PeekNamedPipe
recycle.{645FF040-5081-101B-9F08-00AA002F954E}\GHOSTBAK.exe
recycle.{645FF040-5081-101B-9F08-00AA002F954E}\GHOSTBAK.exe
Mozilla/4.0 (compatible)
Mozilla/4.0 (compatible)
hXXps://
hXXps://
ddd
ddd
passworD
passworD
OLEACC.DLL
OLEACC.DLL
Windows
Windows
%WinDir%\V2012.EXE
%WinDir%\V2012.EXE
%WinDir%\V2012.exe
%WinDir%\V2012.exe
%WinDir%\V2013.exe
%WinDir%\V2013.exe
taskkill /f /im KSafeTray.exe
taskkill /f /im KSafeTray.exe
Rstray.exe
Rstray.exe
%s\SysTEM32\sysedit.exe
%s\SysTEM32\sysedit.exe
Windows
Windows
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
explorer.exe
explorer.exe
1.1.4
1.1.4
360.exe_1076_rwx_00430000_00007000:
zcÃ
zcÃ
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\360.exe
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\360.exe
lmy.exe_1312:
.text
.text
`.rdata
`.rdata
@.data
@.data
.ndata
.ndata
.rsrc
.rsrc
uDSSh
uDSSh
.DEFAULT\Control Panel\International
.DEFAULT\Control Panel\International
Software\Microsoft\Windows\CurrentVersion
Software\Microsoft\Windows\CurrentVersion
GetWindowsDirectoryA
GetWindowsDirectoryA
KERNEL32.dll
KERNEL32.dll
ExitWindowsEx
ExitWindowsEx
USER32.dll
USER32.dll
GDI32.dll
GDI32.dll
SHFileOperationA
SHFileOperationA
ShellExecuteA
ShellExecuteA
SHELL32.dll
SHELL32.dll
RegEnumKeyA
RegEnumKeyA
RegCreateKeyExA
RegCreateKeyExA
RegCloseKey
RegCloseKey
RegDeleteKeyA
RegDeleteKeyA
RegOpenKeyExA
RegOpenKeyExA
ADVAPI32.dll
ADVAPI32.dll
COMCTL32.dll
COMCTL32.dll
ole32.dll
ole32.dll
VERSION.dll
VERSION.dll
verifying installer: %d%%
verifying installer: %d%%
unpacking data: %d%%
unpacking data: %d%%
... %d%%
... %d%%
hXXp://nsis.sf.net/NSIS_Error
hXXp://nsis.sf.net/NSIS_Error
~nsu.tmp
~nsu.tmp
%u.%u%s%s
%u.%u%s%s
RegDeleteKeyExA
RegDeleteKeyExA
%s=%s
%s=%s
*?|/":
*?|/":
CUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsr3.tmp\nsDialogs.dll
CUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsr3.tmp\nsDialogs.dll
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsr3.tmp\nsDialogs.dll
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsr3.tmp\nsDialogs.dll
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsr3.tmp
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsr3.tmp
Eu%C@
Eu%C@
t3x
t3x
__MSVCRT
__MSVCRT
2.dll}
2.dll}
G.Hook
G.Hook
KERNEL32.DLL
KERNEL32.DLL
SkinSE.dll
SkinSE.dll
SkinSE_NSIS.dll
SkinSE_NSIS.dll
@.reloc
@.reloc
GetProcessHeap
GetProcessHeap
comdlg32.dll
comdlg32.dll
nsDialogs.dll
nsDialogs.dll
All Files|*.*
All Files|*.*
URL=hXXp://VVV.999qp.com/
URL=hXXp://VVV.999qp.com/
.reloc
.reloc
System.dll
System.dll
callback%d
callback%d
/%x5>
/%x5>
<.lxb>
<.lxb>
.HjOk
.HjOk
nsr3.tmp
nsr3.tmp
1311000
1311000
adm\LOCALS~1\Temp\nsr3.tmp
adm\LOCALS~1\Temp\nsr3.tmp
1245478
1245478
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\lmy.exe
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\lmy.exe
%Program Files%\
%Program Files%\
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp
lmy.exe
lmy.exe
CUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsm1.tmp
CUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsm1.tmp
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\
1245448
1245448
-888535893
-888535893
1376588
1376588
1114340
1114340
1573138
1573138
1311006
1311006
1442010
1442010
1179898
1179898
1245452
1245452
1310942
1310942
-1308294008
-1308294008
1179886
1179886
1966300
1966300
1048670
1048670
1179860
1179860
D:\temp
D:\temp
11131827
11131827
J.nzm
J.nzm
Nullsoft Install System v2.45
Nullsoft Install System v2.45
lmy.exe_1312_rwx_003C1000_0000D000:
__MSVCRT_HEAP_SELECT
__MSVCRT_HEAP_SELECT
user32.dll
user32.dll
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\lmy.exe
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\lmy.exe
GetCPInfo
GetCPInfo
.text
.text
`.rdata
`.rdata
@.data
@.data
.reloc
.reloc
__MSVCRT
__MSVCRT
2.dll}
2.dll}
G.Hook
G.Hook
lmy.exe_1312_rwx_029B1000_000DC000:
<.utv>
<.utv>
USSSSSSh
USSSSSSh
t%UVWS
t%UVWS
SSh0j
SSh0j
9^ u%f
9^ u%f
~%UVW
~%UVW
uù u f9k
uù u f9k
inflate 1.1.3 Copyright 1995-1998 Mark Adler
inflate 1.1.3 Copyright 1995-1998 Mark Adler
?CxImage 6.0.0
?CxImage 6.0.0
deflate 1.2.3 Copyright 1995-2005 Jean-loup Gailly
deflate 1.2.3 Copyright 1995-2005 Jean-loup Gailly
1.2.3
1.2.3
inflate 1.2.3 Copyright 1995-2005 Mark Adler
inflate 1.2.3 Copyright 1995-2005 Mark Adler
%s%d bytes
%s%d bytes
Element '%s' at offset %d not ended
Element '%s' at offset %d not ended
End tag '%s' at offset %d does not match start tag '%s' at offset %d
End tag '%s' at offset %d does not match start tag '%s' at offset %d
No start tag for end tag '%s' at offset %d
No start tag for end tag '%s' at offset %d
%s at offset %d unterminated
%s at offset %d unterminated
Incorrect %s at offset %d
Incorrect %s at offset %d
msctls_hotkey32
msctls_hotkey32
%*.*f
%*.*f
\winhlp32.exe
\winhlp32.exe
%.f%%
%.f%%
hotkey
hotkey
1.1.3
1.1.3
%s%s%s
%s%s%s
1.2.24
1.2.24
compression type not supported
compression type not supported
libpng error: %s
libpng error: %s
libpng error: %s, offset=%d
libpng error: %s, offset=%d
libpng error no. %s: %s
libpng error no. %s: %s
libpng warning: %s
libpng warning: %s
libpng warning no. %s: %s
libpng warning no. %s: %s
iTXt chunk not supported.
iTXt chunk not supported.
Corrupt JPEG data: found marker 0xx instead of RST%d
Corrupt JPEG data: found marker 0xx instead of RST%d
Warning: unknown JFIF revision number %d.d
Warning: unknown JFIF revision number %d.d
Corrupt JPEG data: %u extraneous bytes before marker 0xx
Corrupt JPEG data: %u extraneous bytes before marker 0xx
Inconsistent progression sequence for component %d coefficient %d
Inconsistent progression sequence for component %d coefficient %d
Unknown Adobe color transform code %d
Unknown Adobe color transform code %d
Obtained XMS handle %u
Obtained XMS handle %u
Freed XMS handle %u
Freed XMS handle %u
Unrecognized component IDs %d %d %d, assuming YCbCr
Unrecognized component IDs %d %d %d, assuming YCbCr
JFIF extension marker: RGB thumbnail image, length %u
JFIF extension marker: RGB thumbnail image, length %u
JFIF extension marker: palette thumbnail image, length %u
JFIF extension marker: palette thumbnail image, length %u
JFIF extension marker: JPEG-compressed thumbnail image, length %u
JFIF extension marker: JPEG-compressed thumbnail image, length %u
Opened temporary file %s
Opened temporary file %s
Closed temporary file %s
Closed temporary file %s
Ss=%d, Se=%d, Ah=%d, Al=%d
Ss=%d, Se=%d, Ah=%d, Al=%d
Component %d: dc=%d ac=%d
Component %d: dc=%d ac=%d
Start Of Scan: %d components
Start Of Scan: %d components
Component %d: %dhx%dv q=%d
Component %d: %dhx%dv q=%d
Start Of Frame 0xx: width=%u, height=%u, components=%d
Start Of Frame 0xx: width=%u, height=%u, components=%d
Smoothing not supported with nonstandard sampling ratios
Smoothing not supported with nonstandard sampling ratios
RST%d
RST%d
At marker 0xx, recovery action %d
At marker 0xx, recovery action %d
Selected %d colors for quantization
Selected %d colors for quantization
Quantizing to %d colors
Quantizing to %d colors
Quantizing to %d = %d*%d*%d colors
Quantizing to %d = %d*%d*%d colors
%4u %4u %4u %4u %4u %4u %4u %4u
%4u %4u %4u %4u %4u %4u %4u %4u
Unexpected marker 0xx
Unexpected marker 0xx
Miscellaneous marker 0xx, length %u
Miscellaneous marker 0xx, length %u
with %d x %d thumbnail image
with %d x %d thumbnail image
JFIF extension marker: type 0xx, length %u
JFIF extension marker: type 0xx, length %u
Warning: thumbnail image size does not match data length %u
Warning: thumbnail image size does not match data length %u
JFIF APP0 marker: version %d.d, density %dx%d %d
JFIF APP0 marker: version %d.d, density %dx%d %d
= = = = = = = =
= = = = = = = =
Obtained EMS handle %u
Obtained EMS handle %u
Freed EMS handle %u
Freed EMS handle %u
Define Restart Interval %u
Define Restart Interval %u
Define Quantization Table %d precision %d
Define Quantization Table %d precision %d
Define Huffman Table 0xx
Define Huffman Table 0xx
Define Arithmetic Table 0xx: 0xx
Define Arithmetic Table 0xx: 0xx
Unknown APP14 marker (not Adobe), length %u
Unknown APP14 marker (not Adobe), length %u
Unknown APP0 marker (not JFIF), length %u
Unknown APP0 marker (not JFIF), length %u
Adobe APP14 marker: version %d, flags 0xx 0xx, transform %d
Adobe APP14 marker: version %d, flags 0xx 0xx, transform %d
Unsupported marker type 0xx
Unsupported marker type 0xx
Failed to create temporary file %s
Failed to create temporary file %s
Unsupported JPEG process: SOF type 0xx
Unsupported JPEG process: SOF type 0xx
Cannot quantize to more than %d colors
Cannot quantize to more than %d colors
Cannot quantize to fewer than %d colors
Cannot quantize to fewer than %d colors
Cannot quantize more than %d color components
Cannot quantize more than %d color components
Insufficient memory (case %d)
Insufficient memory (case %d)
Not a JPEG file: starts with 0xx 0xx
Not a JPEG file: starts with 0xx 0xx
Quantization table 0xx was not defined
Quantization table 0xx was not defined
Huffman table 0xx was not defined
Huffman table 0xx was not defined
Backing store not supported
Backing store not supported
Cannot transcode due to multiple use of quantization table %d
Cannot transcode due to multiple use of quantization table %d
Maximum supported image dimension is %u pixels
Maximum supported image dimension is %u pixels
Empty JPEG image (DNL not supported)
Empty JPEG image (DNL not supported)
Bogus DQT index %d
Bogus DQT index %d
Bogus DHT index %d
Bogus DHT index %d
Bogus DAC value 0x%x
Bogus DAC value 0x%x
Bogus DAC index %d
Bogus DAC index %d
Unsupported color conversion request
Unsupported color conversion request
Too many color components: %d, max %d
Too many color components: %d, max %d
Buffer passed to JPEG library is too small
Buffer passed to JPEG library is too small
JPEG parameter struct mismatch: library thinks size is %u, caller expects %u
JPEG parameter struct mismatch: library thinks size is %u, caller expects %u
Improper call to JPEG library in state %d
Improper call to JPEG library in state %d
Invalid scan script at entry %d
Invalid scan script at entry %d
Invalid progressive parameters at scan script entry %d
Invalid progressive parameters at scan script entry %d
Invalid progressive parameters Ss=%d Se=%d Ah=%d Al=%d
Invalid progressive parameters Ss=%d Se=%d Ah=%d Al=%d
Unsupported JPEG data precision %d
Unsupported JPEG data precision %d
Invalid memory pool code %d
Invalid memory pool code %d
Wrong JPEG library version: library is %d, caller expects %d
Wrong JPEG library version: library is %d, caller expects %d
IDCT output block size %d not supported
IDCT output block size %d not supported
Invalid component ID %d in SOS
Invalid component ID %d in SOS
Bogus message code %d
Bogus message code %d
Unknown zTXt compression type %d
Unknown zTXt compression type %d
Incomplete compressed datastream in %s chunk
Incomplete compressed datastream in %s chunk
Data error in compressed datastream in %s chunk
Data error in compressed datastream in %s chunk
Buffer error in compressed datastream in %s chunk
Buffer error in compressed datastream in %s chunk
gamma = (%d/100000)
gamma = (%d/100000)
gx=%f, gy=%f, bx=%f, by=%f
gx=%f, gy=%f, bx=%f, by=%f
wx=%f, wy=%f, rx=%f, ry=%f
wx=%f, wy=%f, rx=%f, ry=%f
incorrect gamma=(%d/100000)
incorrect gamma=(%d/100000)
NULL row buffer for row %ld, pass %d
NULL row buffer for row %ld, pass %d
%ld%c
%ld%c
GetWindowsDirectoryA
GetWindowsDirectoryA
GetViewportExtEx
GetViewportExtEx
SetViewportOrgEx
SetViewportOrgEx
SetViewportExtEx
SetViewportExtEx
SetWindowsHookExA
SetWindowsHookExA
UnhookWindowsHookEx
UnhookWindowsHookEx
EnumChildWindows
EnumChildWindows
EnumThreadWindows
EnumThreadWindows
)(56")0%
)(56")0%
8000000000000000000
8000000000000000000
9.KAbC
9.KAbC
.text
.text
`.rdata
`.rdata
@.data
@.data
.reloc
.reloc
!7.LkWh=IP0v
!7.LkWh=IP0v
lmy.exe_1312_rwx_10004000_00001000:
callback%d
callback%d