Trojan.GenericKD.1859911_8b8b14205a – Adaware

Dynamic Analysis

Payload

No specific payload has been found.

Process activity

The Trojan creates the following process(es):

imapi.exe:1584
attrib.exe:1124
%original file name%.exe:1772

The Trojan injects its code into the following process(es):

rundll32.exe:564
explorer.exe:452

Mutexes

The following mutexes were created/opened:No objects were found.

File activity

The process imapi.exe:1584 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%WinDir%\Temp\iga4nzhe.TMP (146970 bytes)

The process %original file name%.exe:1772 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

C:\471187.bat (70 bytes)
%System%\raspprov.exe (1425 bytes)

Registry activity

The process imapi.exe:1584 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "16 22 A5 3D 0F 7D 85 22 AD 4F C4 C1 0E 9E 4B 3B"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\Imapi]
"ControlFlags" = "1"
"Active" = "1"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\Imapi\ImapiSvc]
"BitNames" = " ImapiDebugError ImapiDebugWarning ImapiDebugTrace ImapiDebugInfo ImapiDebugX ImapiDebugSort"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\Imapi]
"LogSessionName" = "stdout"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\Imapi\ImapiSvc]
"Guid" = "8107d8e9-e323-49f5-bba2-abc35c243dca"

The process rundll32.exe:564 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "E4 CA 36 CA CB 90 67 74 81 59 C2 CE A9 88 E2 E6"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

The process attrib.exe:1124 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "C2 EC EB 85 7A C0 75 56 6A 53 F0 02 C2 FE 61 6D"

The process %original file name%.exe:1772 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "68 10 C3 C8 FA B7 F0 F9 3B DF E5 87 B0 50 19 E6"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\c:]
"471187.bat" = "471187"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"dcomycfg" = "%System%\raspprov.exe"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Dropped PE files

There are no dropped PE files.

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

Removals

Remove it with Ad-Aware

Click (here) to download and install Ad-Aware Free Antivirus.
Update the definition files.
Run a full scan of your computer.

Manual removal*

Terminate malicious process(es) (How to End a Process With the Task Manager):
imapi.exe:1584
attrib.exe:1124
%original file name%.exe:1772
Delete the original Trojan file.
Delete or disinfect the following files created/modified by the Trojan:
%WinDir%\Temp\iga4nzhe.TMP (146970 bytes)
C:\471187.bat (70 bytes)
%System%\raspprov.exe (1425 bytes)
Delete the following value(s) in the autorun key (How to Work with System Registry):
[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"dcomycfg" = "%System%\raspprov.exe"
Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
Reboot the computer.

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

VersionInfo

Company Name: InterBase Software Corp. bcba5b14
Product Name: sTV33733Ul
Product Version: 4.5.9.3
Legal Copyright: Y7P5hJk73B20 1996 bcba5b14
Legal Trademarks:
Original Filename: S655S4Gj.exe
Internal Name: S655S4Gj.exe
File Version: 4.5.9.3 bcba5b14
File Description: aI2HGm1V9U bcba5b14
Comments:
Language: English (United States)

Company Name: InterBase Software Corp. bcba5b14Product Name: sTV33733UlProduct Version: 4.5.9.3Legal Copyright: Y7P5hJk73B20 1996 bcba5b14Legal Trademarks: Original Filename: S655S4Gj.exeInternal Name: S655S4Gj.exeFile Version: 4.5.9.3 bcba5b14File Description: aI2HGm1V9U bcba5b14Comments: Language: English (United States)

PE Sections

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Section MD5
.text	4096	86686	90112	4.24785	7b11c1413dcaa37a1c8aa25a9af238f7
.rdata	94208	5246	8192	2.87325	cd0820dd642625928a45bcb27739787d
.data	102400	1029900	12288	3.33048	36b704f269d5feb2fbd2e9386e410b24
.rsrc	1134592	14240	16384	2.37378	c9fb6d95476db6c1881fbc003643525d

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Network Activity

URLs

URL	IP
hxxp://www.7-zip.org/license.txt	216.34.181.97

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

GET /license.txt HTTP/1.1

Host: VVV.7-zip.org

Connection: Keep-Alive

Cache-Control: no-cache

HTTP/1.1 200 OK

Server: Apache/2.2.15 (CentOS)

Vary: Host, Accept-Encoding, User-Agent

Last-Modified: Wed, 27 Aug 2014 09:51:50 GMT

ETag: "787-501995e826199"

Accept-Ranges: bytes

Cache-Control: max-age=172800

Expires: Wed, 01 Oct 2014 02:28:36 GMT

Content-Type: text/plain

Content-Length: 1927

Date: Mon, 29 Sep 2014 02:28:36 GMT

X-Varnish: 632750849

Age: 0

Via: 1.1 varnish

Connection: keep-alive

7-Zip.. ~~~~~.. License for use and distribution.. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~.. 7-Zip Copyright (C) 1999-2014 Igor Pavlov... Licenses for files are:.. 1) 7z.dll: GNU LGPL unRAR restriction.. 2) All other files: GNU LGPL.. The GNU LGPL unRAR restriction means that you must follow both .. GNU LGPL rules and unRAR restriction rules..... Note: .. You can use 7-Zip on any computer, including a computer in a commercial .. organization. You don't need to register or pay for 7-Zip..... GNU LGPL information.. --------------------.. This library is free software; you can redistribute it and/or.. modify it under the terms of the GNU Lesser General Public.. License as published by the Free Software Foundation; either.. version 2.1 of the License, or (at your option) any later version... This library is distributed in the hope that it will be useful,.. but WITHOUT ANY WARRANTY; without even the implied warranty of.. MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU.. Lesser General Public License for more details... You can receive a copy of the GNU Lesser General Public License from .. hXXp://VVV.gnu.org/.... unRAR restriction.. -----------------.. The decompression engine for RAR archives was developed using source .. code of unRAR program... All copyrights to original unRAR code are owned by Alexander Roshal... The license for original unRAR code has the following restriction:.. The unRAR sources cannot be used to re-creat

<<< skipped >>>

Map

The Trojan connects to the servers at the folowing location(s):

Strings from Dumps

explorer.exe_452:

.text

`.data

.rsrc

@.reloc

ADVAPI32.dll

BROWSEUI.dll

GDI32.dll

KERNEL32.dll

NTDLL.DLL

msvcrt.dll

ole32.dll

OLEAUT32.dll

SHDOCVW.dll

SHELL32.dll

SHLWAPI.dll

USER32.dll

UxTheme.dll

FTSSh

t0SSh

SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon

SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system

SShwk

98~%SP

ExplorerStartMsgLoop

PSSh;

6SSSSh

SSSSh

SPSSSShL

u%SSh

t.WWWW

xpsp2res.dll

xpsp3res.dll

tbSSh

Software\Microsoft\Windows\CurrentVersion\Explorer\StartMenu\StartMenu

Software\Microsoft\Windows\CurrentVersion\Explorer\StartMenu\StartPanel

kernel32.dll

GetSystemWindowsDirectoryW

NetGetJoinInformation

WINMM.dll

SETUPAPI.dll

WINSTA.dll

OLEACC.dll

USERENV.dll

ntdll.dll

RegEnumKeyExW

RegNotifyChangeKeyValue

RegOpenKeyExA

RegEnumKeyW

RegCloseKey

RegCreateKeyW

RegQueryInfoKeyW

RegOpenKeyExW

RegCreateKeyExW

OffsetViewportOrgEx

GetViewportOrgEx

SetViewportOrgEx

SetProcessShutdownParameters

GetProcessHeap

GetWindowsDirectoryW

CreateIoCompletionPort

ShellExecuteExW

SHRegCloseUSKey

SHRegCreateUSKeyW

AssocQueryKeyW

SHRegOpenUSKeyW

SHDeleteKeyW

TileWindows

ExitWindowsEx

RegisterHotKey

UnregisterHotKey

EnumChildWindows

GetKeyState

GetAsyncKeyState

CascadeWindows

MsgWaitForMultipleObjects

EnumWindows

explorer.pdb

name="Microsoft.Windows.Shell.explorer"

version="5.1.0.0"

Windows Shell

name="Microsoft.Windows.Common-Controls"

version="6.0.0.0"

publicKeyToken="6595b64144ccf1df"

]]"```^]]\

3333333330

3333330

333333334

)@. '5 !*

.DEHHF>?/

2

&$%Uooqkezs

['$$#%&(4

3333333333333333333

33333333333330

7''''))

3'')))33.

222`444(555

%%%{///-

000000000

00000000

`[66...00

0000000

`]66./.000

/./././././././.

66///0000

0000000000000

0000000000

6666,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,0.010.010.010.010.010.010.010.010.010.010.001

4366666666K,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6.010.010.010.010.010.010.010.010.010.010.000

:;

) ) ) ) )

|2222'2'2'2'2'2'2'2'2'2'2'2'2'2'2'2',),),),),),),),),),),),),),),),),),),),),),,

22222222222

3333333

.SB99;;;99twv}ut{oxt~

.SB;;;:::2:w}{{qddgghg

" """ """ """ """ "" #

""" """ """ "#

.SG>''';;9::p

:5:5:5:5:5:5:5:5:5:5#"

# # # # # # # # # # # # # # # # # # # # # ##$

( # # # # # # # # # # # # # # # # # # # # ###

1232123212321232123

(&(((&(((&(((&(((&((&&)

&(((&(((&(((&()

`,''')))

'4,4'4,4'4,4'4,4'4,4)(

55///0000

5555-5-5-5-5-5-5-5-5-5-5-5-5-5-5-5-0

555555555

55555555

5555555

14441444144414441

4343434343434343

5555555555555

5555555555

-,-,-,-,-,-,-,-,-,-,-*.

..............................JFJFJFJFJFJFJFJFJFJFJ.-

{22*2*2*2*2*2*2*2*2*2*2*2*2*2*2*2*.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-../

|ujjjjuhF..BBBBBBBBBBBBT

~j|F.BB*BBB*BBB*Bwop

&!!!&!!!&

44466666

44444444416

4446666

66666666

|= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |=

|= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |= |=

DDDDE%CTDD@

A%US$

%UUUU

%%UUU

33U

""2222!!

!"!"%UUR""

!""!"#2"""

"!!"#3"!"

dnnnnn:n.nfCnmddddd

////;/;;88

;888;;!/

!//!!;;^

:;:!::!!!

.88.88.8

.N.NN.M

::8.8...

:::!;;:!

//!!;888

.8.8.88...

:;!::!!;!//!;

!!;:!!::

.88..8..

!!:::/^!

!;/;!;;;!!!:

.8:!!!!^

!!:;:::..

/:!^^!;{8{../

...:::.-

**6***66*6**6566*5666 ,

6*6666*6*6 655*65

6*65 56*5 55 555 *5 6

555( 55 (5 5(

76 5 66 555*677

6*6 5 5(5 (55( '5((5 (556 ('5

665**6(('S((((((S(((]('((@('SS((S(((((((6C-.NEC66S5sU

555(555(5((5(5(5(

5 5 5 5555 (555(555'(((5(5('55(((

((''('5'5(5('('('('('((''('(((@(((('&(((&

%&&%&&&&3>&3&3&33&3&3333&&3>3333

'(3&'&3&

3&33&&((

3323>33>%>3%>3>33>3%3&%

*5'(('((&@3(

,63%3>323>3%>&>33323>>%>

3(3'(((@@'5('@(@(&('(

>2>323%>3

75((((@3&333&3&&&%&3&&3&33>33%3>23%>3

>2%$32%>2>%>2$3>

3&%&&3&33>3>33

3>%>3%&3$23>23$2>2%$>2>

)4433((&(&('*

('((((''(**6(('' *

32323>3>

2$%>22%>%3' (

&(&''((5(5 *

'(&(&((&('''

&&%&3&&%3%

2%>22>22

5''3(((3(('&(&'&

3%%3%3%2#$

22$22$2%$22$2%2%$2%$2$222%$22

&>2$2$2$222$22$%%

:7'((('(3('(3(&(&

222222222222

22222222222222

222222222222222

22$22$22$22$

&(%3%&&&&3&&&3%3

222222222222222222

&&(&3(&(&'('((3'(&&

2222222

22$

&&(3(3('(&'

222"2212

22

(&(3(3((

((565 ((( 6

333&33(&&

'(('('(('(

'&%%"$

2"2"22"2

2222

"2"22

2%('(3'32222?&'

2"2"2"121212

2"2"2$"?

%%22%2

&3(3(3((&

"2"

1"?((&21

22

2%""22&&

2

'&('(3(''

((%%%"

5(3%"%

"2%5*67

))) ))))

""**

"*

#2#---2222-222442-

---(-%

$/222(--444222!

#&-221269924999;

&$-22-($2%

#(2---222622212-

#2221299629968

#&--%#(2##!

-222422422426662-%

"2-##&

!##-#-&%---#---#&-219662%

$&-(151,44.9

&1242662-

-(..19.19

,4492.12

12-$-,-,

-, $$----

#%#-15/-&

-,(,,(,(,

$$11651566/,$&&

,2592&&&-

2466/!$$

""*

) '????[

&&&$-556>>61,,5994511-

$(//$$$(6>6/,$,-$

#$-22692/,,$,-&

-266661..4514#

&,2-&#

&-222,22--#

#&&---2-,-&$&(,,291.566..BNNNTNNNNNAABIAA88

&!#&!-##

--//11468>885882&

$266961$&--$&%

,1661,!-((#

&$,4255$,92

&$,44..&

""**""***""

"****

"**""""*""""

&-569./-,16522$

.BAA=86546888=AAAEAAEMNRMQQSWZZ\]gk__m__\

bTRHHHHHQQHQJQWJSSSSSSSSSSSSSSSSWWSSSS\\V]VZW8,.FW]\\]\]\]\\ZZ\\WFR>38(

.BTTkgn]ktvgmvvvvvmvvvsvzzzyzyzyzyyyzmkkkkkZSRA816;F87

yzyzyzym^Z]WN3 $&$.Wt\

""*"""****""""

"***"**""**

$5612,.2,

&$$,,,5]

$]t.Ft

7%8U8

3 303

2

8 8$8(8,80848885%5,575{6
7 7$7(7,70747
rundll32.exe
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage
Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
::{2559a1f6-21d7-11d4-bdaf-00c04f60b9f0}
::{2559a1f2-21d7-11d4-bdaf-00c04f60b9f0}
::{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}
::{2559a1f0-21d7-11d4-bdaf-00c04f60b9f0}
::{2559a1f1-21d7-11d4-bdaf-00c04f60b9f0}
::{D20EA4E1-3957-11d2-A40B-0C5020524153}
::{2559a1f7-21d7-11d4-bdaf-00c04f60b9f0}
{208D2C60-3AEA-1069-A2D7-08002B30309D}
{20D04FE0-3AEA-1069-A2D8-08002B30309D}
Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites
{450D8FBA-AD25-11D0-98A8-0800361B1103}
CLSID\{2559a1f6-21d7-11d4-bdaf-00c04f60b9f0}
Software\Microsoft\Windows\CurrentVersion\RunOnce
Software\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad
Software\Microsoft\Windows\CurrentVersion\Explorer\DontShowMeThisDialogAgain
Software\Microsoft\Windows\CurrentVersion\Explorer\Desktop\CleanupWiz
\\.\WMIDataDevice
Software\Microsoft\Windows\CurrentVersion\Run
Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run
Software\Microsoft\Windows NT\CurrentVersion\Windows
ExplorerIsShellMutex
desk.cpl
Software\Microsoft\Windows\CurrentVersion\Explorer
tourstart.exe
tourstart.exe,0
Microsoft.OfferTour
WINWORD.EXE
Software\Microsoft\Windows\CurrentVersion\Applets
Software\Microsoft\Windows\CurrentVersion\Applets\Tour
explorer.exe,9
Microsoft.FixScreenResolution
shell:::{2559a1f4-21d7-11d4-bdaf-00c04f60b9f0}
Software\Microsoft\Windows\CurrentVersion\Explorer\FileAssociation
Software\Microsoft\Windows NT\CurrentVersion
shell:::{2559a1f5-21d7-11d4-bdaf-00c04f60b9f0}
Software\Microsoft\Windows\CurrentVersion\Explorer\StartPage
Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
DDEEXECUTESHORTCIRCUIT
http\shell
IEXPLORE.EXE
Software\Microsoft\Windows\CurrentVersion\Explorer\Streams\Desktop
Software\Microsoft\Windows\CurrentVersion\RunOnceEx
comctl32.dll
Software\Microsoft\Windows\Internet Settings
AutoConfigURL
system.ini
AppEvents\Schemes\Apps\.Default\%s\.current
Software\Microsoft\Windows\CurrentVersion\Explorer\TrayNotify
MSShellRunDlgReady
res://mys.dll/mys.hta /explorer
mshta.exe
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Setup\Welcome
Software\Microsoft\Windows\CurrentVersion\Explorer\Tips
SOFTWARE\Policies\Microsoft\Windows NT\CurrentVersion\MYS
cys.exe
SOFTWARE\Microsoft\Windows NT\CurrentVersion\srvWiz
install.exe
SOFTWARE\Microsoft\Windows\CurrentVersion\Control Panel
OUTLOOK.EXE
explorer.exe,16
iernonce.dll
WININET.DLL
UpdateURL
WindowsUpdate
HWND%x
Software\Microsoft\Windows\CurrentVersion\OemStartMenuData
fldrclnr.dll,Wizard_RunDLL
iexplore.exe
winbrand.dll
Software\Microsoft\Windows\CurrentVersion\Explorer\Remote\%d
shell32.dll
nusrmgr.cpl ,initialTask=ChangePicture
NewExeName
Windows
ediskeer.dll
timedate.cpl
Software\Microsoft\Windows\CurrentVersion\Explorer\Comdlg32\LastVisitedMRU
Software\Microsoft\Windows\CurrentVersion\Explorer\Comdlg32\OpenSaveMRU
Software\Microsoft\Windows\CurrentVersion\Explorer\Doc Find Spec MRU
Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU
Software\Microsoft\Internet Explorer\TypedURLs
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Calculator.lnk
%ALLUSERSPROFILE%\Start Menu\Programs\Games\Solitaire.lnk
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Paint.lnk
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\WordPad.lnk
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\System Tools\Files and Settings Transfer Wizard.lnk
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Windows Movie Maker.lnk
%USERPROFILE%\Start Menu\Programs\Accessories\Tour Windows XP.lnk
%ALLUSERSPROFILE%\Start Menu\Programs\Windows Messenger.lnk
%USERPROFILE%\Start Menu\Programs\Windows Media Player.lnk
%ALLUSERSPROFILE%\Start Menu\Programs\MSN.lnk
%ALLUSERSPROFILE%\Start Menu\Programs\Get Online with MSN.lnk
%ALLUSERSPROFILE%\Start Menu\Programs\Get Going with Tablet PC.lnk
%ALLUSERSPROFILE%\Start Menu\Set Program Access and Defaults.lnk
%ALLUSERSPROFILE%\Start Menu\Programs\Windows Journal.lnk
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Media Center\Media Center.lnk
%USERPROFILE%\Start Menu\Programs\Internet Explorer.lnk
Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel
TSAppCMP.DLL
netapi32.dll
%SystemRoot%\system32\restore\rstrui.exe
RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL ?0x%X?%s
RunDLL32.EXE
%s%d%s
Software\Microsoft\Windows\CurrentVersion\Policies\System
settings.dll
explorer.exe "
explorer.exe /e, "
WindowsLogon
WindowsLogoff
%s %s
Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count
uAppWiz.Cpl
\explorer.exe
Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Start Menu
::{20D04FE0-3AEA-1069-A2D8-08002B30309D}
taskmgr.exe
ShellExecute
Software\Microsoft\Windows\CurrentVersion\Explorer\AppKey\%d
\WindowsShell.Manifest
Get Online with MSN.lnk
Set Program Access and Defaults.lnk
Link%d
OEM%d
Software\Microsoft\Windows\CurrentVersion\SMDEn
::{D20EA4E1-3957-11d2-A40B-0C5020524152}
%WinDir%\explorer.exe
There is a file or folder on your computer called "%s" which could cause certain applications to not function correctly. Renaming it to "%s" would solve this problem. Would you like to rename it now?
Ca&scade Windows
Tile Windows &Horizontally
Tile Windows V&ertically
&Windows Security...
&Help and Support
&Log Off %s...
Windows Explorer
6.00.2900.5512 (xpsp.080413-2105)
EXPLORER.EXE
Windows
Operating System
6.00.2900.5512
Keep the &taskbar on top of other windows
To remove records of recently accessed documents, programs, and Web sites, click Clear.
Windows displays icons for active and urgent notifications, and hides inactive ones. You can change this behavior for items in the list below.
Select this option to use the menu style from earlier versions of Windows.
6There is not enough memory to complete this operation.8Unable to run command.
The folder '%1' has been removed.WMy Computer or Windows Explorer has not been properly initialized yet. Try again later.
&Undo %s
Windows is running in safe mode.
This special diagnostic mode of Windows enables you to fix a problem which may be caused by your network or hardware settings. Make sure these settings are correct in Control Panel, and then try starting Windows again. While in safe mode, some of your devices may not be available.
startRThere was an internal error and one of the windows you were using has been closed.
Restrictions{This operation has been cancelled due to restrictions in effect on this computer. Please contact your system administrator.
&Show Open Windows
Windows was unable to change the display settings for the new configuration. Return the computer to the previous state, shut down Windows, and restart the computer in the desired configuration.
There may be a problem with your display settings if you continue. To safely change to a new configuration, you should shut down Windows and restart the computer in the desired configuration. Do you want to continue anyway?
This pre-release version of "Internet Explorer 4.0" Desktop/Explorer has expired. Please update to the latest release of "Internet Explorer 4.0" from WWW.MICROSOFT.COM
helpctr.exe>-FromStartHelp
Take a tour of Windows XP
NOpens a window where you can pick search options and work with search results.aOpens a central location for Help topics, tutorials, troubleshooting, and other support services.
/Opens a program, folder, document, or Web site.
Provides options for closing your programs and logging off, or for leaving your programs running and switching to another user.lProvides options for turning off or restarting your computer, or for activating Stand By or Hibernate modes.RDisconnects your session. You can reconnect to the session when you log on again.
&Windows Security
iOpens the My Documents folder, where you can store letters, reports, notes, and other kinds of documents./Displays recently opened documents and folders.KOpens the My Music folder, where you can store music and other audio files.]Opens the My Pictures folder, where you can store digital photos, images, and graphics files.zGives access to, and information about, the disk drives, cameras, scanners, and other hardware connected to your computer.MGives access to, and information about, folders and files on other computers.8Connects to other computers, networks, and the Internet.
explorer.exe_452_rwx_00981000_0001F000:FTPR
.text
`.rdata
@.data
.reloc
=HTTPt
?http
HTTPt
WININET.dll
SHLWAPI.dll
gdiplus.dll
WS2_32.dll
CRYPT32.dll
USER32.dll
GDI32.dll
ADVAPI32.dll
SHELL32.dll
ole32.dll
PSAPI.DLL
!DLL load status: %u
/t%s.php?%s=
regisforbelowactu.net
/d%s.php?%s=
/c%s.php?%s=
.rdata
%s=%s&
SMTP
HTTPMail
Port
Password2
account{*}.oeaccount
Software\Microsoft\Windows Mail
Software\Microsoft\Windows Live Mail
SetWindowsHookExW
SetWindowsHookExA
user32.dll
CreateDialogIndirectParam
DeleteUrlCacheEntry
FindFirstUrlCacheEntryA
FindNextUrlCacheEntryA
FindCloseUrlCache
HttpQueryInfoA
HttpSendRequestW
HttpAddRequestHeadersW
HttpQueryInfoW
HttpAddRequestHeadersA
HttpSendRequestA
InternetCanonicalizeUrlA
HttpOpenRequestA
SHDeleteKeyA
CertOpenSystemStoreW
CertCloseStore
CertEnumCertificatesInStore
PFXExportCertStoreEx
ExitWindowsEx
CryptGetUserKey
RegCreateKeyA
RegOpenKeyA
RegCloseKey
RegNotifyChangeKeyValue
UnhookWindowsHookEx
GetKeyboardLayout
GetKeyboardState
ShellExecuteA
ntdll.dll
GetWindowsDirectoryA
CallNamedPipeA
WaitNamedPipeA
ConnectNamedPipe
DisconnectNamedPipe
CreateNamedPipeA
KERNEL32.dll
OLEAUT32.dll
client.dll
5 5-5557$70767=7
type=%S, name=%s, address=%s, server=%s, port=%u, ssl=%s, user=%s, password=%s
type=%S, name=%S, address=%S, server=%S, port=%u, ssl=%S, user=%S, password=%S
EmailAddressCollection/EmailAddress[%u]/Address
n%S_%S
SMTP_Email_Address

Summary

Dynamic Analysis

Removals

Static Analysis

Network Activity

Map

Strings from Dumps