HEUR:Trojan.Win32.Generic (Kaspersky), Gen:Variant.Buzy.1752 (B) (Emsisoft), Gen:Variant.Buzy.1752 (AdAware), Trojan.Win32.Delphi.FD, Trojan.Win32.Sasfis.FD, VirTool.Win32.DelfInject.FD, Tdl4.YR (Lavasoft MAS)Behaviour: Trojan, VirTool
The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.
Summary
MD5: af70e9a59686eb0512c07b5f20329781
SHA1: 997415052f970ab4aad67fa4563ff32f0230a9b0
SHA256: d5325cedc9f8187b3e304f12b584bdc0b410731d1cc909c9db908ea0e5bd26a8
SSDeep: 12288:hsC/xnJOUzGvraFA QQWYuGSHNucBRfAs23Psy7RcDqWWHsyeoFfhaCmVO7pAQEy:a2QaF8Q9CU6NWPs cpyJ0CmIlJEy
Size: 862720 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: PackerUPXCompresorGratuitowwwupxsourceforgenet, UPolyXv05_v6
Company: Or Strain
Created at: 1992-06-20 01:22:17
Analyzed on: WindowsXP SP3 32-bit
Summary: Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).
Dynamic Analysis
Payload
No specific payload has been found.
Process activity
The Trojan creates the following process(es):
%original file name%.exe:2040
jh1.exe:1116
at.exe:1304
at.exe:740
at.exe:1300
at.exe:1484
at.exe:492
at.exe:1632
at.exe:1980
at.exe:356
at.exe:1944
at.exe:1256
at.exe:1252
at.exe:544
at.exe:548
at.exe:348
at.exe:1272
at.exe:1052
at.exe:1596
at.exe:268
at.exe:900
at.exe:1620
at.exe:1604
at.exe:1240
at.exe:436
at.exe:1368
The Trojan injects its code into the following process(es):
jh.exe:1108
mshta.exe:256
svchost.exe:1084
spoolsv.exe:1424
Mutexes
The following mutexes were created/opened:No objects were found.
File activity
The process %original file name%.exe:2040 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\c.txt (3601656 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\jh1.exe (489800 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\a.txt (4001 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\aslkhs (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\jh.exe (1718200 bytes)
The Trojan deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\c.txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\a.txt (0 bytes)
The process jh1.exe:1116 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\1.tmp (673 bytes)
The Trojan deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\2.tmp (0 bytes)
The process jh.exe:1108 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Application Data\asdfasfas.bat (114 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Application Data\uid_pal (8 bytes)
%Documents and Settings%\%current user%\Application Data\palladium.exe (5381 bytes)
Registry activity
The process %original file name%.exe:2040 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "DF 39 D7 EA F1 EE 99 BA 5A 0B 53 B4 1B A8 B8 27"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp]
"jh1.exe" = "jh1"
"jh.exe" = "jh"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass" = "1"
The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:
"IntranetName" = "1"
The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:
"UNCAsIntranet" = "1"
The process jh1.exe:1116 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "8D DF 09 61 B1 55 92 BB 49 70 97 92 C4 55 FE 15"
[HKLM\System\CurrentControlSet\Control\Session Manager]
"PendingFileRenameOperations" = "\??\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\4.tmp,"
The process jh.exe:1108 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%System%]
"mshta.exe" = "Microsoft (R) HTML Application host"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"
[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%System%]
"AT.exe" = "Schedule service command line interface"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"WarnOnPost" = "0"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"WarnOnPostRedirect" = "0"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%Documents and Settings%\%current user%\Application Data]
"asdfasfas.bat" = "asdfasfas"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"WarnonBadCertRecving" = "0"
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "BD 2D 2E 80 D0 35 A3 65 9C F3 F4 DA B9 DF 1E 19"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"WarnOnZoneCrossing" = "0"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"
The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"
The Trojan adds the reference to itself to be executed when a user logs on:
[HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
"Shell" = "%Documents and Settings%\%current user%\Application Data\palladium.exe"
The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass" = "1"
The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:
"IntranetName" = "1"
The process mshta.exe:256 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1D 00 00 00 01 00 00 00 00 00 00 00"
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "3E 87 24 B2 86 B9 62 18 A8 AE 71 02 5B 8D 6C 40"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"
The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"
The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:
"ProxyBypass" = "1"
Proxy settings are disabled:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"
The Trojan deletes the following value(s) in system registry:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"
The process at.exe:1304 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "4C A0 6F AF B7 74 E8 B2 CA 2D 42 23 7C 92 2C CC"
The process at.exe:740 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "AE 27 FB 52 FC D6 07 3B CC 51 FB 2E F5 E4 34 D3"
The process at.exe:1300 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "4A 1C 0A 65 09 D0 4E 2A 92 DE C0 3F 1C FC 0C 78"
The process at.exe:1484 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "F5 B6 3E 5D 87 FE 2B D0 51 35 9E 8D B3 BF CD DA"
The process at.exe:492 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "13 1B 69 E6 28 6D E3 A9 D2 ED 84 69 0B DB 97 D1"
The process at.exe:1632 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "2F F1 EA 4A 4E C5 81 F1 C1 D4 DB 3B 97 7C FD 5C"
The process at.exe:1980 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "9F E4 A7 06 C7 DD 60 A6 5E 4C 62 DF 29 C9 6C C1"
The process at.exe:356 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "D4 97 A4 C1 D4 24 C1 6E B8 A3 DF F6 1C 05 FD DC"
The process at.exe:1944 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "F8 DD 51 EC FE 50 2A 84 8D C1 CB C4 04 5C D0 37"
The process at.exe:1256 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "AF D4 7E 93 DB AA 7E 2B DA C3 F2 B0 57 15 2A 42"
The process at.exe:1252 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "49 19 2C 7E B9 27 21 2A A6 FE 9A 75 BE 9F E8 09"
The process at.exe:544 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "70 D7 11 E0 12 D9 0B 97 7F 22 AF F0 38 7D 5A 54"
The process at.exe:548 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "33 95 51 F2 6A 76 99 E1 2D FF 85 86 8F 12 4E 8B"
The process at.exe:348 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "B9 81 52 8A 8A 5F 13 B7 C7 3D 4C C3 65 95 93 0A"
The process at.exe:1272 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "95 81 60 B3 72 EB AD 1D 17 A2 04 73 EE 3C 19 B3"
The process at.exe:1052 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "BC EF FE A5 28 8E 5C 3A 53 0C A3 B5 64 BF DE D8"
The process at.exe:1596 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "54 30 94 97 33 5E 8D 2D 68 C4 81 96 39 82 F4 D2"
The process at.exe:268 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "04 8A 9E 2B 44 89 FA CD 74 93 72 F8 6A 10 5D 03"
The process at.exe:900 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "3B B0 1A 49 7E A4 AF 22 8B EB 22 8C 7D 17 77 2B"
The process at.exe:1620 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "BE 59 B4 1D 3D 42 5E A6 E9 55 F0 B4 D4 52 36 BD"
The process at.exe:1604 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "3E D8 D8 09 C3 27 AB B9 05 F7 F5 77 1D 5E F5 2B"
The process at.exe:1240 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "AA D4 FB B5 CC 63 F4 C7 D8 D1 03 2B B7 A2 B6 39"
The process at.exe:436 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "F8 B1 98 5E 83 CC 16 6F A2 CC 8C FC 51 70 83 2A"
The process at.exe:1368 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "6C 19 5F 85 45 2E 8E EF A5 4B 27 B3 C8 E8 F1 C1"
Dropped PE files
MD5 | File path |
---|---|
c70df429f1b5686a1a025d93aa339df9 | c:\Documents and Settings\"%CurrentUserName%"\Application Data\palladium.exe |
e684e8db6f61576d1ebd241a9c8668d5 | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\4.tmp |
c70df429f1b5686a1a025d93aa339df9 | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\jh.exe |
5aed7fe24364216f19ce72f19e2bb9d6 | c:\WINDOWS\Temp\5.tmp |
HOSTS file anomalies
No changes have been detected.
Rootkit activity
Using the driver "UNKNOWN" the Trojan controls loading executable images into a memory by installing the Load image notifier.
Using the driver ROOTKITPATH the Trojan intercepts DriverStartIO in a miniport driver of a hard drive controller (ATAPI) to handle request to its own files:
StartIo
Propagation
Removals
Remove it with Ad-Aware
- Click (here) to download and install Ad-Aware Free Antivirus.
- Update the definition files.
- Run a full scan of your computer.
Manual removal*
- Scan a system with an anti-rootkit tool.
- Terminate malicious process(es) (How to End a Process With the Task Manager):
%original file name%.exe:2040
jh1.exe:1116
at.exe:1304
at.exe:740
at.exe:1300
at.exe:1484
at.exe:492
at.exe:1632
at.exe:1980
at.exe:356
at.exe:1944
at.exe:1256
at.exe:1252
at.exe:544
at.exe:548
at.exe:348
at.exe:1272
at.exe:1052
at.exe:1596
at.exe:268
at.exe:900
at.exe:1620
at.exe:1604
at.exe:1240
at.exe:436
at.exe:1368 - Delete the original Trojan file.
- Delete or disinfect the following files created/modified by the Trojan:
%Documents and Settings%\%current user%\Local Settings\Temp\c.txt (3601656 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\jh1.exe (489800 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\a.txt (4001 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\aslkhs (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\jh.exe (1718200 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\1.tmp (673 bytes)
%Documents and Settings%\%current user%\Application Data\asdfasfas.bat (114 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Application Data\uid_pal (8 bytes)
%Documents and Settings%\%current user%\Application Data\palladium.exe (5381 bytes) - Remove the references to the Trojan by modifying the following registry value(s) (How to Work with System Registry):
[HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
"Shell" = "%Documents and Settings%\%current user%\Application Data\palladium.exe" - Reboot the computer.
Static Analysis
VersionInfo
No information is available.
No information is available.
PE Sections
Name | Virtual Address | Virtual Size | Raw Size | Entropy | Section MD5 |
---|---|---|---|---|---|
UPX0 | 4096 | 208896 | 0 | 0 | d41d8cd98f00b204e9800998ecf8427e |
UPX1 | 212992 | 851968 | 850432 | 5.34021 | c001fbe49ad36b243320a01a1c22b486 |
.rsrc | 1064960 | 12288 | 11264 | 2.95648 | 6a0286450c1b8ee0c914d7d3343fe94a |
Dropped from:
Downloaded by:
Similar by SSDeep:
Similar by Lavasoft Polymorphic Checker:
Network Activity
URLs
IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)
Traffic
Map
The Trojan connects to the servers at the folowing location(s):
Strings from Dumps
jh.exe_1108:
`.rsrc
`.rsrc
kernel32.dll
kernel32.dll
Windows
Windows
MSWHEEL_ROLLMSG
MSWHEEL_ROLLMSG
MSH_WHEELSUPPORT_MSG
MSH_WHEELSUPPORT_MSG
MSH_SCROLL_LINES_MSG
MSH_SCROLL_LINES_MSG
$*@@@*$@@@$ *@@* $@@($*)@-$*@@$-*@@$*-@@(*$)@-*$@@*-$@@*$-@@-* $@-$ *@* $-@$ *-@$ -*@*- $@($ *)(* $)
$*@@@*$@@@$ *@@* $@@($*)@-$*@@$-*@@$*-@@(*$)@-*$@@*-$@@*$-@@-* $@-$ *@* $-@$ *-@$ -*@*- $@($ *)(* $)
oleaut32.dll
oleaut32.dll
EVariantBadIndexError
EVariantBadIndexError
ssShift
ssShift
htKeyword
htKeyword
EInvalidOperation
EInvalidOperation
u%CNu
u%CNu
%s[%d]
%s[%d]
%s_%d
%s_%d
.Owner
.Owner
EInvalidGraphicOperation
EInvalidGraphicOperation
comctl32.dll
comctl32.dll
USER32.DLL
USER32.DLL
uxtheme.dll
uxtheme.dll
Proportional
Proportional
MAPI32.DLL
MAPI32.DLL
vsReport
vsReport
OnKeyDown$
OnKeyDown$
OnKeyPress
OnKeyPress
OnKeyUp
OnKeyUp
TComboBoxExEnumerator
TComboBoxExEnumerator
ole32.dll
ole32.dll
PasswordChar
PasswordChar
TButtonControl(%D
TButtonControl(%D
IE(AL("%s",4),"AL(\"%0:s\",3)","JK(\"%1:s\",\"%0:s\")")
IE(AL("%s",4),"AL(\"%0:s\",3)","JK(\"%1:s\",\"%0:s\")")
JumpID("","%s")
JumpID("","%s")
TKeyEvent
TKeyEvent
TKeyPressEvent
TKeyPressEvent
HelpKeyword\`A
HelpKeyword\`A
crSQLWait
crSQLWait
%s (%s)
%s (%s)
Uh.JE
Uh.JE
imm32.dll
imm32.dll
AutoHotkeys$
AutoHotkeys$
AutoHotkeysl
AutoHotkeysl
ssHotTrack
ssHotTrack
TWindowState
TWindowState
poProportional
poProportional
TWMKey
TWMKey
KeyPreview
KeyPreview
PopupMenuDPF
PopupMenuDPF
WindowStateP
WindowStateP
System\CurrentControlSet\Control\Keyboard Layouts\%.8x
System\CurrentControlSet\Control\Keyboard Layouts\%.8x
vcltest3.dll
vcltest3.dll
User32.dll
User32.dll
advapi32.dll
advapi32.dll
olepro32.dll
olepro32.dll
IWebBrowser
IWebBrowser
IWebBrowserApp
IWebBrowserApp
IWebBrowser2
IWebBrowser2
TWebBrowserStatusTextChange
TWebBrowserStatusTextChange
TWebBrowserProgressChange
TWebBrowserProgressChange
TWebBrowserCommandStateChange
TWebBrowserCommandStateChange
TWebBrowserTitleChange
TWebBrowserTitleChange
TWebBrowserPropertyChange
TWebBrowserPropertyChange
TWebBrowserBeforeNavigate2
TWebBrowserBeforeNavigate2
TWebBrowserNewWindow2
TWebBrowserNewWindow2
TWebBrowserNavigateComplete2
TWebBrowserNavigateComplete2
TWebBrowserDocumentComplete
TWebBrowserDocumentComplete
TWebBrowserOnVisible
TWebBrowserOnVisible
TWebBrowserOnToolBar
TWebBrowserOnToolBar
TWebBrowserOnMenuBar
TWebBrowserOnMenuBar
TWebBrowserOnStatusBar
TWebBrowserOnStatusBar
TWebBrowserOnFullScreen
TWebBrowserOnFullScreen
TWebBrowserOnTheaterMode
TWebBrowserOnTheaterMode
TWebBrowser
TWebBrowser
WebBrowser1
WebBrowser1
WebBrowser1TitleChange
WebBrowser1TitleChange
32D39BBB-7641-4A4B-B8C3-51ABCFBC8681
32D39BBB-7641-4A4B-B8C3-51ABCFBC8681
palladium.exe
palladium.exe
b~~z0%%xozec
b~~z0%%xozec
xs$iegÃy~$zbz5cn7
xs$iegÃy~$zbz5cn7
%lv%u`wcjwhlkb%d%cpii%vfdk%jc%|jpw%v|vq`h
%lv%u`wcjwhlkb%d%cpii%vfdk%jc%|jpw%v|vq`h
Ui`dv`%g`%udql`kq)%qm`%uwjf`vvýk%qdn`%v`s`wdi%hlkpq`v
Ui`dv`%g`%udql`kq)%qm`%uwjf`vvýk%qdn`%v`s`wdi%hlkpq`v
\jpw%v|vq`h%mdv%g``k%lkc`fq`a%rlqm%hpiqlui`%vu|rdw`%uwjbwdhv
\jpw%v|vq`h%mdv%g``k%lkc`fq`a%rlqm%hpiqlui`%vu|rdw`%uwjbwdhv
\jp%vmjpia%fjkvla`w%lkvqdiilkb%qm`%k`f`vvdw|%m`pwlvqlf%hjapi`%qj%uwjq`fq%|jpw%fjhupq`w
\jp%vmjpia%fjkvla`w%lkvqdiilkb%qm`%k`f`vvdw|%m`pwlvqlf%hjapi`%qj%uwjq`fq%|jpw%fjhupq`w
Divj)%|jp%dw`%qj%lkvqdii%qm`%m`pwlvqlf%hjapi`%qj%uwjq`fq%jqm`w%fjhupq`wv)%dv%r`ii%dv%|jpw%uf%mdv%w`u`dq`ai|%qwl`a%qj%lkc`fq%jqm`w%fjhupq`wv%sld%Lkq`wk`q)%dka%qj%v`ka%vudh
Divj)%|jp%dw`%qj%lkvqdii%qm`%m`pwlvqlf%hjapi`%qj%uwjq`fq%jqm`w%fjhupq`wv)%dv%r`ii%dv%|jpw%uf%mdv%w`u`dq`ai|%qwl`a%qj%lkc`fq%jqm`w%fjhupq`wv%sld%Lkq`wk`q)%dka%qj%v`ka%vudh
Qm`Ãfq%jc%vudhhlkbýk%w`vpiq%lk%fwlhlkdi%uwjv`fpqljk)%a`vulq`%qm`Ãfq%qmdq%|jp%dw`%qm`%slfqlh%jc%hdilfljpv%vjcqrdw`
Qm`Ãfq%jc%vudhhlkbýk%w`vpiq%lk%fwlhlkdi%uwjv`fpqljk)%a`vulq`%qm`Ãfq%qmdq%|jp%dw`%qm`%slfqlh%jc%hdilfljpv%vjcqrdw`
Cjw%qm`%vdc`q|%jc%|jpw%v|vq`h%lq%lv%`vv`kqldi%cjw%|jp%qj%lkvqdii%qm`%k`f`vvdw|%m`pwlvqlf%hjapi`%dka%u`wcjwh%d%cpii%vfdk%jc%|jpw%fjhupq`w%qj%`}q`whlkdq`%hdilfljpv%uwjbwdhv%cwjh%lq
Cjw%qm`%vdc`q|%jc%|jpw%v|vq`h%lq%lv%`vv`kqldi%cjw%|jp%qj%lkvqdii%qm`%k`f`vvdw|%m`pwlvqlf%hjapi`%dka%u`wcjwh%d%cpii%vfdk%jc%|jpw%fjhupq`w%qj%`}q`whlkdq`%hdilfljpv%uwjbwdhv%cwjh%lq
\palladium.exe
\palladium.exe
user32.dll
user32.dll
Palladium for Windows.lnk
Palladium for Windows.lnk
Vm`ii%Cjia`wv
Vm`ii%Cjia`wv
Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
PSAPI.dll
PSAPI.dll
Qm`%duuilfdqljk%
Qm`%duuilfdqljk%
%rdv%idpkfm`a%vpff`vcpii|%gpq%lq%rdv%cjwf`a%qj%vmpq%ajrk%ap`%qj%v`fpwlq|%w`dvjkv
%rdv%idpkfm`a%vpff`vcpii|%gpq%lq%rdv%cjwf`a%qj%vmpq%ajrk%ap`%qj%v`fpwlq|%w`dvjkv
Qmlv%mduu`k`a%g`fdpv`%qm`%duuilfdqljk%rdv%lkc`fq`a%g|%d%hdilfljpv%uwjbwdh%rmlfm%hlbmq%ujv`%d%qmw`dq%cjw%qm`%JV
Qmlv%mduu`k`a%g`fdpv`%qm`%duuilfdqljk%rdv%lkc`fq`a%g|%d%hdilfljpv%uwjbwdh%rmlfm%hlbmq%ujv`%d%qmw`dq%cjw%qm`%JV
Lq%lv%mlbmi|%w`fjhh`ka`a%qj%lkvqdii%qm`%k`f`vvdw|%m`pwlvqlf%hjapi`%dka%u`wcjwh%d%cpii%vfdk%jc%|jpw%fjhupq`w%qj%`}q`whlkdq`%hdilfljpv%uwjbwdhv%cwjh%lq
Lq%lv%mlbmi|%w`fjhh`ka`a%qj%lkvqdii%qm`%k`f`vvdw|%m`pwlvqlf%hjapi`%dka%u`wcjwh%d%cpii%vfdk%jc%|jpw%fjhupq`w%qj%`}q`whlkdq`%hdilfljpv%uwjbwdhv%cwjh%lq
Qm`%m`pwlvqlf%hjapi`%uw`s`kqv%cwjh%wpkklkb%hdilfljpv%uwjf`vv`v%jk%|jpw%fjhupq`w%dka%i`qv%|jp%hdkdb`%dii%v|vq`h%uwjf`vv`v%fpww`kqi|%wpkklkb%jk%|jpw%UF
Qm`%m`pwlvqlf%hjapi`%uw`s`kqv%cwjh%wpkklkb%hdilfljpv%uwjf`vv`v%jk%|jpw%fjhupq`w%dka%i`qv%|jp%hdkdb`%dii%v|vq`h%uwjf`vv`v%fpww`kqi|%wpkklkb%jk%|jpw%UF
Pu(qj(adq`%vu|rdw`%uwjbwdhvýk%mla`%qm`hv`is`v%lk%cli`v%dsjlalkb%DS%vjcqrdw`
Pu(qj(adq`%vu|rdw`%uwjbwdhvýk%mla`%qm`hv`is`v%lk%cli`v%dsjlalkb%DS%vjcqrdw`
Mjr`s`w%qm`|ýk%kjq%udvv%qmwjpbm%jpw%m`pwlvqlf%hjapi`)%dv%lq%qwdfnv%`dfm%dka%`s`w|%uwjf`vv%jk%qm`%UF%dka%rjpia%kjq%i`q%dk|%hdirdw`%vq`di%|jpw%uwlsdq`%lkcjwhdqljk
Mjr`s`w%qm`|ýk%kjq%udvv%qmwjpbm%jpw%m`pwlvqlf%hjapi`)%dv%lq%qwdfnv%`dfm%dka%`s`w|%uwjf`vv%jk%qm`%UF%dka%rjpia%kjq%i`q%dk|%hdirdw`%vq`di%|jpw%uwlsdq`%lkcjwhdqljk
Hjapi`%kjq%dsdlidgi`%lk%qwldi%s`wvljk
Hjapi`%kjq%dsdlidgi`%lk%qwldi%s`wvljk
Qmlv%hjapi`%lv%lkvqdii`a%dka%wpkklkb
Qmlv%hjapi`%lv%lkvqdii`a%dka%wpkklkb
%s`wvljk%jc%vjcqrdw`%jw%k``a%dka%puadq`%jwÚa(jk%qj%cpkfqljk%uwju`wi|
%s`wvljk%jc%vjcqrdw`%jw%k``a%dka%puadq`%jwÚa(jk%qj%cpkfqljk%uwju`wi|
Jpw%vpuujwq%rlii%m`iu%|jp%vjis`%dk|%uwjgi`h%|jp%hlbmqÃf`%rmli`%pvlkb%jpw%vjcqrdw`
Jpw%vpuujwq%rlii%m`iu%|jp%vjis`%dk|%uwjgi`h%|jp%hlbmqÃf`%rmli`%pvlkb%jpw%vjcqrdw`
Fmjjv`%g`qr``k%qm`q*2%umjk`%vpuujwq%jw%jkilk`%vpuujwq%g|%`(hdli*ils`fmdq
Fmjjv`%g`qr``k%qm`q*2%umjk`%vpuujwq%jw%jkilk`%vpuujwq%g|%`(hdli*ils`fmdq
This can also be done in part by using the IP address of the computer requesting the page or the referrer field of the HTTP header, but cookies allow for greater precision.
This can also be done in part by using the IP address of the computer requesting the page or the referrer field of the HTTP header, but cookies allow for greater precision.
Jpqadq`a%slwpv`vÂqdgdv`v%dw`%kjq%`cc`fqls`%dkaýk"q%bpdwdkq``Ú`tpdq`%uwjq`fqljk%dka%v`fpwlq|%cjw%|jpw%UF$
Jpqadq`a%slwpv`vÂqdgdv`v%dw`%kjq%`cc`fqls`%dkaýk"q%bpdwdkq``Ú`tpdq`%uwjq`fqljk%dka%v`fpwlq|%cjw%|jpw%UF$
Filfn%m`w`%qj%b`q%qm`%cpii%s`wvljk%jc%qm`%uwjapfq%dka%puadq`%qm`Âqdgdv`$
Filfn%m`w`%qj%b`q%qm`%cpii%s`wvljk%jc%qm`%uwjapfq%dka%puadq`%qm`Âqdgdv`$
Please save your code, it will help you in case you ever need to reinstall our software or if our support team asks you for this code.
Please save your code, it will help you in case you ever need to reinstall our software or if our support team asks you for this code.
PLEASE NOTE: YOUR COPY IS ALREADY ACITVATED (you do not have to use the key for activation purposes).
PLEASE NOTE: YOUR COPY IS ALREADY ACITVATED (you do not have to use the key for activation purposes).
We will help you to allocate and solve any problem or conflict our software may face while installing onto your operation system etc.
We will help you to allocate and solve any problem or conflict our software may face while installing onto your operation system etc.
hXXp://oneworldbill.com/pal/index.php?id=
hXXp://oneworldbill.com/pal/index.php?id=
Fi`dk%fjhupq`w
Fi`dk%fjhupq`w
Duui|ßqljkv
Duui|ßqljkv
Email support: support@software-retail.com
Email support: support@software-retail.com
Phone support: 1-800-760-0917
Phone support: 1-800-760-0917
333333333333333333
333333333333333333
33333833
33333833
3333339
3333339
3333333333333338
3333333333333338
:*"*"$3338
:*"*"$3338
3333333
3333333
33333333
33333333
33333333333
33333333333
3333333333338
3333333333338
33338?383
33338?383
333333333333
333333333333
:*3:"$3338
:*3:"$3338
333333333333333
333333333333333
KWindows
KWindows
UrlMon
UrlMon
Font.Charset
Font.Charset
Font.Color
Font.Color
Font.Height
Font.Height
Font.Name
Font.Name
Font.Style
Font.Style
Icon.Data
Icon.Data
Picture.Data
Picture.Data
3e[.Ut
3e[.Ut
ej$%c
ej$%c
mf.AA
mf.AA
GV.tF,
GV.tF,
ÕhZ
ÕhZ
a.Ty/
a.Ty/
X=.Rd
X=.Rd
e}.HF
e}.HF
.Li%O"?
.Li%O"?
2%dwww
2%dwww
XXYY ..CC\\DD
XXYY ..CC\\DD
~{{/..JII
~{{/..JII
...RRRRRRIrM
...RRRRRRIrM
..RIIIIIrrrr
..RIIIIIrrrr
.RIrMrrMrMr
.RIrMrrMrMr
.cI3'
.cI3'
URL/.-
URL/.-
.yyyyyyyyyyyyyyy
.yyyyyyyyyyyyyyy
?-~///~-?
?-~///~-?
.c.pp
.c.pp
&&&&`{8{
&&&&`{8{
( (.DFi7K
( (.DFi7K
.XHHO6
.XHHO6
Support module:
Support module:
Items.Strings
Items.Strings
4444222111111
4444222111111
11122224444
11122224444
;D.eu
;D.eu
M:\#t
M:\#t
C 0%d
C 0%d
0|%u=a9
0|%u=a9
ftpT
ftpT
.gLC1
.gLC1
777777777777777777
777777777777777777
%B*E.!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!.ER^47J
%B*E.!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!.ER^47J
&&!&&!&&&&22&!&&!&&!&&!&&.Eb^47J
&&!&&!&&&&22&!&&!&&!&&!&&.Eb^47J
.uGmmmmmmm
.uGmmmmmmm
.umhY::::::::::::::::::::::::::::::::::::::::::::
.umhY::::::::::::::::::::::::::::::::::::::::::::
.uGawCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCw~`
.uGawCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCw~`
.uGhDC
.uGhDC
.umhDC
.umhDC
.uGhD
.uGhD
.uGhSF
.uGhSF
.uGhDFFFFFFFFFFFFFFFFFDu~:5
.uGhDFFFFFFFFFFFFFFFFFDu~:5
.uGhSFFFFFFFFFFFFFFFFDu``ZD5FFFFFFFFFFFFFFFFFFFFD~`
.uGhSFFFFFFFFFFFFFFFFDu``ZD5FFFFFFFFFFFFFFFFFFFFD~`
.uGhS5F5F5F5F5F5F5F5Su`
.uGhS5F5F5F5F5F5F5F5Su`
.uGhS55555555555555S_P
.uGhS55555555555555S_P
.uGhS55
.uGhS55
.uG`S
.uG`S
.ushST
.ushST
.us0ETTT
.us0ETTT
.ushETTTTTTTT
.ushETTTTTTTT
.us0EJTJTTTEc44c4c4c4ccc4c4RA8GsXnc
.us0EJTJTTTEc44c4c4c4ccc4c4RA8GsXnc
.ushEJJTJJEcccccccccccccc
.ushEJJTJJEcccccccccccccc
.ushEJJJJEc
.ushEJJJJEc
.ushE
.ushE
.ush?
.ush?
.ush?|
.ush?|
.uXhOO=
.uXhOO=
.uXh?vv
.uXh?vv
.uXhv?vv
.uXhv?vv
.usP?gggggggggqggqggggggggggggggggg}ggggggggggg}v
.usP?gggggggggqggqggggggggggggggggg}ggggggggggg}v
.usm_
.usm_
666666666
666666666
Hourly
Hourly
Maintenance security key:
Maintenance security key:
WindowState
WindowState
.hXXps://arcsoftware.org/palladium/register.php
.hXXps://arcsoftware.org/palladium/register.php
GetCPInfo
GetCPInfo
RegOpenKeyExA
RegOpenKeyExA
RegFlushKey
RegFlushKey
RegCreateKeyExA
RegCreateKeyExA
RegCloseKey
RegCloseKey
SetViewportOrgEx
SetViewportOrgEx
ShellExecuteA
ShellExecuteA
UnhookWindowsHookEx
UnhookWindowsHookEx
SetWindowsHookExA
SetWindowsHookExA
MapVirtualKeyA
MapVirtualKeyA
LoadKeyboardLayoutA
LoadKeyboardLayoutA
GetKeyboardState
GetKeyboardState
GetKeyboardLayoutList
GetKeyboardLayoutList
GetKeyboardLayout
GetKeyboardLayout
GetKeyState
GetKeyState
GetKeyNameTextA
GetKeyNameTextA
EnumWindows
EnumWindows
EnumThreadWindows
EnumThreadWindows
ActivateKeyboardLayout
ActivateKeyboardLayout
GetKeyboardType
GetKeyboardType
.idata
.idata
.rdata
.rdata
P.reloc
P.reloc
P.rsrc
P.rsrc
version="1.0.0.0"
version="1.0.0.0"
name="Microsoft.Windows.Common-Controls"
name="Microsoft.Windows.Common-Controls"
version="6.0.0.0"
version="6.0.0.0"
publicKeyToken="6595b64144ccf1df"
publicKeyToken="6595b64144ccf1df"
KERNEL32.DLL
KERNEL32.DLL
gdi32.dll
gdi32.dll
shell32.dll
shell32.dll
version.dll
version.dll
CF35B9AD-A699-4106-8A6F-E4474A2FF065
CF35B9AD-A699-4106-8A6F-E4474A2FF065
7Dispatch methods do not support more than 64 parameters
7Dispatch methods do not support more than 64 parameters
JPEG error #%d
JPEG error #%d
OLE control activation failed*Could not obtain OLE control window handle%License information for %s is invalidPLicense information for %s not found. You cannot use this control in design modeNUnable to retrieve a pointer to a running object registered with OLE for %s/%s
OLE control activation failed*Could not obtain OLE control window handle%License information for %s is invalidPLicense information for %s not found. You cannot use this control in design modeNUnable to retrieve a pointer to a running object registered with OLE for %s/%s
Invalid owner=This control requires version 4.70 or greater of COMCTL32.DLL
Invalid owner=This control requires version 4.70 or greater of COMCTL32.DLL
No help keyword specified.
No help keyword specified.
OLE error %.8x.Method '%s' not supported by automation object/Variant does not reference an automation object
OLE error %.8x.Method '%s' not supported by automation object/Variant does not reference an automation object
Error setting %s.Count8Listbox (%s) style must be virtual in order to set Count#No OnGetItem event handler assigned"Unable to find a Table of Contents
Error setting %s.Count8Listbox (%s) style must be virtual in order to set Count#No OnGetItem event handler assigned"Unable to find a Table of Contents
No help found for %s#No context-sensitive help installed$No topic-based help system installed
No help found for %s#No context-sensitive help installed$No topic-based help system installed
Value must be between %d and %d
Value must be between %d and %d
Unable to insert a line Clipboard does not support Icons/Menu '%s' is already being used by another form
Unable to insert a line Clipboard does not support Icons/Menu '%s' is already being used by another form
!Control '%s' has no parent window
!Control '%s' has no parent window
%s property out of range
%s property out of range
Scan line index out of range!Cannot change the size of an icon Invalid operation on TOleGraphic
Scan line index out of range!Cannot change the size of an icon Invalid operation on TOleGraphic
Unsupported clipboard format
Unsupported clipboard format
List capacity out of bounds (%d)
List capacity out of bounds (%d)
List count out of bounds (%d)
List count out of bounds (%d)
List index out of bounds (%d) Out of memory while expanding memory stream
List index out of bounds (%d) Out of memory while expanding memory stream
Error reading %s%s%s: %s
Error reading %s%s%s: %s
Failed to get data for '%s'
Failed to get data for '%s'
Resource %s not found
Resource %s not found
%s.Seek not implemented$Operation not allowed on sorted list$%s not in a class registration group
%s.Seek not implemented$Operation not allowed on sorted list$%s not in a class registration group
Property %s does not exist
Property %s does not exist
Bits index out of range*Can't write to a read-only resource streamECheckSynchronize called from thread $%x, which is NOT the main thread
Bits index out of range*Can't write to a read-only resource streamECheckSynchronize called from thread $%x, which is NOT the main thread
Class %s not found
Class %s not found
A class named %s already exists%List does not allow duplicates ($0%x)#A component named %s already exists%String list does not allow duplicates
A class named %s already exists%List does not allow duplicates ($0%x)#A component named %s already exists%String list does not allow duplicates
Cannot create file "%s". %s
Cannot create file "%s". %s
Cannot open file "%s". %s
Cannot open file "%s". %s
Invalid stream format$''%s'' is not a valid component name
Invalid stream format$''%s'' is not a valid component name
Invalid data type for '%s'
Invalid data type for '%s'
Ancestor for '%s' not found
Ancestor for '%s' not found
Cannot assign a %s to a %s
Cannot assign a %s to a %s
Interface not supported
Interface not supported
%s (%s, line %d)
%s (%s, line %d)
Abstract Error?Access violation at address %p in module '%s'. %s of address %p
Abstract Error?Access violation at address %p in module '%s'. %s of address %p
System Error. Code: %d.
System Error. Code: %d.
Invalid variant operation
Invalid variant operation
Invalid NULL variant operation%Invalid variant operation (%s%.8x)
Invalid NULL variant operation%Invalid variant operation (%s%.8x)
%s5Could not convert variant of type (%s) into type (%s)=Overflow while converting variant of type (%s) into type (%s)
%s5Could not convert variant of type (%s) into type (%s)=Overflow while converting variant of type (%s) into type (%s)
Operation not supported
Operation not supported
External exception %x
External exception %x
Invalid pointer operation
Invalid pointer operation
Invalid class typecast0Access violation at address %p. %s of address %p
Invalid class typecast0Access violation at address %p. %s of address %p
Privileged instruction(Exception %s in module %s at %p.
Privileged instruction(Exception %s in module %s at %p.
Application Error1Format '%s' invalid or incompatible with argument
Application Error1Format '%s' invalid or incompatible with argument
No argument for format '%s'"Variant method calls not supported
No argument for format '%s'"Variant method calls not supported
!'%s' is not a valid integer value
!'%s' is not a valid integer value
I/O error %d
I/O error %d
Integer overflow Invalid floating point operation
Integer overflow Invalid floating point operation
jh.exe_1108_rwx_00401000_00390000:
kernel32.dll
kernel32.dll
Windows
Windows
MSWHEEL_ROLLMSG
MSWHEEL_ROLLMSG
MSH_WHEELSUPPORT_MSG
MSH_WHEELSUPPORT_MSG
MSH_SCROLL_LINES_MSG
MSH_SCROLL_LINES_MSG
$*@@@*$@@@$ *@@* $@@($*)@-$*@@$-*@@$*-@@(*$)@-*$@@*-$@@*$-@@-* $@-$ *@* $-@$ *-@$ -*@*- $@($ *)(* $)
$*@@@*$@@@$ *@@* $@@($*)@-$*@@$-*@@$*-@@(*$)@-*$@@*-$@@*$-@@-* $@-$ *@* $-@$ *-@$ -*@*- $@($ *)(* $)
oleaut32.dll
oleaut32.dll
EVariantBadIndexError
EVariantBadIndexError
ssShift
ssShift
htKeyword
htKeyword
EInvalidOperation
EInvalidOperation
u%CNu
u%CNu
%s[%d]
%s[%d]
%s_%d
%s_%d
.Owner
.Owner
EInvalidGraphicOperation
EInvalidGraphicOperation
comctl32.dll
comctl32.dll
USER32.DLL
USER32.DLL
uxtheme.dll
uxtheme.dll
Proportional
Proportional
MAPI32.DLL
MAPI32.DLL
vsReport
vsReport
OnKeyDown$
OnKeyDown$
OnKeyPress
OnKeyPress
OnKeyUp
OnKeyUp
TComboBoxExEnumerator
TComboBoxExEnumerator
ole32.dll
ole32.dll
PasswordChar
PasswordChar
TButtonControl(%D
TButtonControl(%D
IE(AL("%s",4),"AL(\"%0:s\",3)","JK(\"%1:s\",\"%0:s\")")
IE(AL("%s",4),"AL(\"%0:s\",3)","JK(\"%1:s\",\"%0:s\")")
JumpID("","%s")
JumpID("","%s")
TKeyEvent
TKeyEvent
TKeyPressEvent
TKeyPressEvent
HelpKeyword\`A
HelpKeyword\`A
crSQLWait
crSQLWait
%s (%s)
%s (%s)
Uh.JE
Uh.JE
imm32.dll
imm32.dll
AutoHotkeys$
AutoHotkeys$
AutoHotkeysl
AutoHotkeysl
ssHotTrack
ssHotTrack
TWindowState
TWindowState
poProportional
poProportional
TWMKey
TWMKey
KeyPreview
KeyPreview
PopupMenuDPF
PopupMenuDPF
WindowStateP
WindowStateP
System\CurrentControlSet\Control\Keyboard Layouts\%.8x
System\CurrentControlSet\Control\Keyboard Layouts\%.8x
vcltest3.dll
vcltest3.dll
User32.dll
User32.dll
advapi32.dll
advapi32.dll
olepro32.dll
olepro32.dll
IWebBrowser
IWebBrowser
IWebBrowserApp
IWebBrowserApp
IWebBrowser2
IWebBrowser2
TWebBrowserStatusTextChange
TWebBrowserStatusTextChange
TWebBrowserProgressChange
TWebBrowserProgressChange
TWebBrowserCommandStateChange
TWebBrowserCommandStateChange
TWebBrowserTitleChange
TWebBrowserTitleChange
TWebBrowserPropertyChange
TWebBrowserPropertyChange
TWebBrowserBeforeNavigate2
TWebBrowserBeforeNavigate2
TWebBrowserNewWindow2
TWebBrowserNewWindow2
TWebBrowserNavigateComplete2
TWebBrowserNavigateComplete2
TWebBrowserDocumentComplete
TWebBrowserDocumentComplete
TWebBrowserOnVisible
TWebBrowserOnVisible
TWebBrowserOnToolBar
TWebBrowserOnToolBar
TWebBrowserOnMenuBar
TWebBrowserOnMenuBar
TWebBrowserOnStatusBar
TWebBrowserOnStatusBar
TWebBrowserOnFullScreen
TWebBrowserOnFullScreen
TWebBrowserOnTheaterMode
TWebBrowserOnTheaterMode
TWebBrowser
TWebBrowser
WebBrowser1
WebBrowser1
WebBrowser1TitleChange
WebBrowser1TitleChange
32D39BBB-7641-4A4B-B8C3-51ABCFBC8681
32D39BBB-7641-4A4B-B8C3-51ABCFBC8681
palladium.exe
palladium.exe
b~~z0%%xozec
b~~z0%%xozec
xs$iegÃy~$zbz5cn7
xs$iegÃy~$zbz5cn7
%lv%u`wcjwhlkb%d%cpii%vfdk%jc%|jpw%v|vq`h
%lv%u`wcjwhlkb%d%cpii%vfdk%jc%|jpw%v|vq`h
Ui`dv`%g`%udql`kq)%qm`%uwjf`vvýk%qdn`%v`s`wdi%hlkpq`v
Ui`dv`%g`%udql`kq)%qm`%uwjf`vvýk%qdn`%v`s`wdi%hlkpq`v
\jpw%v|vq`h%mdv%g``k%lkc`fq`a%rlqm%hpiqlui`%vu|rdw`%uwjbwdhv
\jpw%v|vq`h%mdv%g``k%lkc`fq`a%rlqm%hpiqlui`%vu|rdw`%uwjbwdhv
\jp%vmjpia%fjkvla`w%lkvqdiilkb%qm`%k`f`vvdw|%m`pwlvqlf%hjapi`%qj%uwjq`fq%|jpw%fjhupq`w
\jp%vmjpia%fjkvla`w%lkvqdiilkb%qm`%k`f`vvdw|%m`pwlvqlf%hjapi`%qj%uwjq`fq%|jpw%fjhupq`w
Divj)%|jp%dw`%qj%lkvqdii%qm`%m`pwlvqlf%hjapi`%qj%uwjq`fq%jqm`w%fjhupq`wv)%dv%r`ii%dv%|jpw%uf%mdv%w`u`dq`ai|%qwl`a%qj%lkc`fq%jqm`w%fjhupq`wv%sld%Lkq`wk`q)%dka%qj%v`ka%vudh
Divj)%|jp%dw`%qj%lkvqdii%qm`%m`pwlvqlf%hjapi`%qj%uwjq`fq%jqm`w%fjhupq`wv)%dv%r`ii%dv%|jpw%uf%mdv%w`u`dq`ai|%qwl`a%qj%lkc`fq%jqm`w%fjhupq`wv%sld%Lkq`wk`q)%dka%qj%v`ka%vudh
Qm`Ãfq%jc%vudhhlkbýk%w`vpiq%lk%fwlhlkdi%uwjv`fpqljk)%a`vulq`%qm`Ãfq%qmdq%|jp%dw`%qm`%slfqlh%jc%hdilfljpv%vjcqrdw`
Qm`Ãfq%jc%vudhhlkbýk%w`vpiq%lk%fwlhlkdi%uwjv`fpqljk)%a`vulq`%qm`Ãfq%qmdq%|jp%dw`%qm`%slfqlh%jc%hdilfljpv%vjcqrdw`
Cjw%qm`%vdc`q|%jc%|jpw%v|vq`h%lq%lv%`vv`kqldi%cjw%|jp%qj%lkvqdii%qm`%k`f`vvdw|%m`pwlvqlf%hjapi`%dka%u`wcjwh%d%cpii%vfdk%jc%|jpw%fjhupq`w%qj%`}q`whlkdq`%hdilfljpv%uwjbwdhv%cwjh%lq
Cjw%qm`%vdc`q|%jc%|jpw%v|vq`h%lq%lv%`vv`kqldi%cjw%|jp%qj%lkvqdii%qm`%k`f`vvdw|%m`pwlvqlf%hjapi`%dka%u`wcjwh%d%cpii%vfdk%jc%|jpw%fjhupq`w%qj%`}q`whlkdq`%hdilfljpv%uwjbwdhv%cwjh%lq
\palladium.exe
\palladium.exe
user32.dll
user32.dll
Palladium for Windows.lnk
Palladium for Windows.lnk
Vm`ii%Cjia`wv
Vm`ii%Cjia`wv
Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
PSAPI.dll
PSAPI.dll
Qm`%duuilfdqljk%
Qm`%duuilfdqljk%
%rdv%idpkfm`a%vpff`vcpii|%gpq%lq%rdv%cjwf`a%qj%vmpq%ajrk%ap`%qj%v`fpwlq|%w`dvjkv
%rdv%idpkfm`a%vpff`vcpii|%gpq%lq%rdv%cjwf`a%qj%vmpq%ajrk%ap`%qj%v`fpwlq|%w`dvjkv
Qmlv%mduu`k`a%g`fdpv`%qm`%duuilfdqljk%rdv%lkc`fq`a%g|%d%hdilfljpv%uwjbwdh%rmlfm%hlbmq%ujv`%d%qmw`dq%cjw%qm`%JV
Qmlv%mduu`k`a%g`fdpv`%qm`%duuilfdqljk%rdv%lkc`fq`a%g|%d%hdilfljpv%uwjbwdh%rmlfm%hlbmq%ujv`%d%qmw`dq%cjw%qm`%JV
Lq%lv%mlbmi|%w`fjhh`ka`a%qj%lkvqdii%qm`%k`f`vvdw|%m`pwlvqlf%hjapi`%dka%u`wcjwh%d%cpii%vfdk%jc%|jpw%fjhupq`w%qj%`}q`whlkdq`%hdilfljpv%uwjbwdhv%cwjh%lq
Lq%lv%mlbmi|%w`fjhh`ka`a%qj%lkvqdii%qm`%k`f`vvdw|%m`pwlvqlf%hjapi`%dka%u`wcjwh%d%cpii%vfdk%jc%|jpw%fjhupq`w%qj%`}q`whlkdq`%hdilfljpv%uwjbwdhv%cwjh%lq
Qm`%m`pwlvqlf%hjapi`%uw`s`kqv%cwjh%wpkklkb%hdilfljpv%uwjf`vv`v%jk%|jpw%fjhupq`w%dka%i`qv%|jp%hdkdb`%dii%v|vq`h%uwjf`vv`v%fpww`kqi|%wpkklkb%jk%|jpw%UF
Qm`%m`pwlvqlf%hjapi`%uw`s`kqv%cwjh%wpkklkb%hdilfljpv%uwjf`vv`v%jk%|jpw%fjhupq`w%dka%i`qv%|jp%hdkdb`%dii%v|vq`h%uwjf`vv`v%fpww`kqi|%wpkklkb%jk%|jpw%UF
Pu(qj(adq`%vu|rdw`%uwjbwdhvýk%mla`%qm`hv`is`v%lk%cli`v%dsjlalkb%DS%vjcqrdw`
Pu(qj(adq`%vu|rdw`%uwjbwdhvýk%mla`%qm`hv`is`v%lk%cli`v%dsjlalkb%DS%vjcqrdw`
Mjr`s`w%qm`|ýk%kjq%udvv%qmwjpbm%jpw%m`pwlvqlf%hjapi`)%dv%lq%qwdfnv%`dfm%dka%`s`w|%uwjf`vv%jk%qm`%UF%dka%rjpia%kjq%i`q%dk|%hdirdw`%vq`di%|jpw%uwlsdq`%lkcjwhdqljk
Mjr`s`w%qm`|ýk%kjq%udvv%qmwjpbm%jpw%m`pwlvqlf%hjapi`)%dv%lq%qwdfnv%`dfm%dka%`s`w|%uwjf`vv%jk%qm`%UF%dka%rjpia%kjq%i`q%dk|%hdirdw`%vq`di%|jpw%uwlsdq`%lkcjwhdqljk
Hjapi`%kjq%dsdlidgi`%lk%qwldi%s`wvljk
Hjapi`%kjq%dsdlidgi`%lk%qwldi%s`wvljk
Qmlv%hjapi`%lv%lkvqdii`a%dka%wpkklkb
Qmlv%hjapi`%lv%lkvqdii`a%dka%wpkklkb
%s`wvljk%jc%vjcqrdw`%jw%k``a%dka%puadq`%jwÚa(jk%qj%cpkfqljk%uwju`wi|
%s`wvljk%jc%vjcqrdw`%jw%k``a%dka%puadq`%jwÚa(jk%qj%cpkfqljk%uwju`wi|
Jpw%vpuujwq%rlii%m`iu%|jp%vjis`%dk|%uwjgi`h%|jp%hlbmqÃf`%rmli`%pvlkb%jpw%vjcqrdw`
Jpw%vpuujwq%rlii%m`iu%|jp%vjis`%dk|%uwjgi`h%|jp%hlbmqÃf`%rmli`%pvlkb%jpw%vjcqrdw`
Fmjjv`%g`qr``k%qm`q*2%umjk`%vpuujwq%jw%jkilk`%vpuujwq%g|%`(hdli*ils`fmdq
Fmjjv`%g`qr``k%qm`q*2%umjk`%vpuujwq%jw%jkilk`%vpuujwq%g|%`(hdli*ils`fmdq
This can also be done in part by using the IP address of the computer requesting the page or the referrer field of the HTTP header, but cookies allow for greater precision.
This can also be done in part by using the IP address of the computer requesting the page or the referrer field of the HTTP header, but cookies allow for greater precision.
Jpqadq`a%slwpv`vÂqdgdv`v%dw`%kjq%`cc`fqls`%dkaýk"q%bpdwdkq``Ú`tpdq`%uwjq`fqljk%dka%v`fpwlq|%cjw%|jpw%UF$
Jpqadq`a%slwpv`vÂqdgdv`v%dw`%kjq%`cc`fqls`%dkaýk"q%bpdwdkq``Ú`tpdq`%uwjq`fqljk%dka%v`fpwlq|%cjw%|jpw%UF$
Filfn%m`w`%qj%b`q%qm`%cpii%s`wvljk%jc%qm`%uwjapfq%dka%puadq`%qm`Âqdgdv`$
Filfn%m`w`%qj%b`q%qm`%cpii%s`wvljk%jc%qm`%uwjapfq%dka%puadq`%qm`Âqdgdv`$
Please save your code, it will help you in case you ever need to reinstall our software or if our support team asks you for this code.
Please save your code, it will help you in case you ever need to reinstall our software or if our support team asks you for this code.
PLEASE NOTE: YOUR COPY IS ALREADY ACITVATED (you do not have to use the key for activation purposes).
PLEASE NOTE: YOUR COPY IS ALREADY ACITVATED (you do not have to use the key for activation purposes).
We will help you to allocate and solve any problem or conflict our software may face while installing onto your operation system etc.
We will help you to allocate and solve any problem or conflict our software may face while installing onto your operation system etc.
hXXp://oneworldbill.com/pal/index.php?id=
hXXp://oneworldbill.com/pal/index.php?id=
Fi`dk%fjhupq`w
Fi`dk%fjhupq`w
Duui|ßqljkv
Duui|ßqljkv
Email support: support@software-retail.com
Email support: support@software-retail.com
Phone support: 1-800-760-0917
Phone support: 1-800-760-0917
333333333333333333
333333333333333333
33333833
33333833
3333339
3333339
3333333333333338
3333333333333338
:*"*"$3338
:*"*"$3338
3333333
3333333
33333333
33333333
33333333333
33333333333
3333333333338
3333333333338
33338?383
33338?383
333333333333
333333333333
:*3:"$3338
:*3:"$3338
333333333333333
333333333333333
KWindows
KWindows
UrlMon
UrlMon
Font.Charset
Font.Charset
Font.Color
Font.Color
Font.Height
Font.Height
Font.Name
Font.Name
Font.Style
Font.Style
Icon.Data
Icon.Data
Picture.Data
Picture.Data
3e[.Ut
3e[.Ut
ej$%c
ej$%c
mf.AA
mf.AA
GV.tF,
GV.tF,
ÕhZ
ÕhZ
a.Ty/
a.Ty/
X=.Rd
X=.Rd
e}.HF
e}.HF
.Li%O"?
.Li%O"?
2%dwww
2%dwww
XXYY ..CC\\DD
XXYY ..CC\\DD
~{{/..JII
~{{/..JII
...RRRRRRIrM
...RRRRRRIrM
..RIIIIIrrrr
..RIIIIIrrrr
.RIrMrrMrMr
.RIrMrrMrMr
.cI3'
.cI3'
URL/.-
URL/.-
.yyyyyyyyyyyyyyy
.yyyyyyyyyyyyyyy
?-~///~-?
?-~///~-?
.c.pp
.c.pp
&&&&`{8{
&&&&`{8{
( (.DFi7K
( (.DFi7K
.XHHO6
.XHHO6
Support module:
Support module:
Items.Strings
Items.Strings
4444222111111
4444222111111
11122224444
11122224444
;D.eu
;D.eu
M:\#t
M:\#t
C 0%d
C 0%d
0|%u=a9
0|%u=a9
ftpT
ftpT
.gLC1
.gLC1
777777777777777777
777777777777777777
%B*E.!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!.ER^47J
%B*E.!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!.ER^47J
&&!&&!&&&&22&!&&!&&!&&!&&.Eb^47J
&&!&&!&&&&22&!&&!&&!&&!&&.Eb^47J
.uGmmmmmmm
.uGmmmmmmm
.umhY::::::::::::::::::::::::::::::::::::::::::::
.umhY::::::::::::::::::::::::::::::::::::::::::::
.uGawCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCw~`
.uGawCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCw~`
.uGhDC
.uGhDC
.umhDC
.umhDC
.uGhD
.uGhD
.uGhSF
.uGhSF
.uGhDFFFFFFFFFFFFFFFFFDu~:5
.uGhDFFFFFFFFFFFFFFFFFDu~:5
.uGhSFFFFFFFFFFFFFFFFDu``ZD5FFFFFFFFFFFFFFFFFFFFD~`
.uGhSFFFFFFFFFFFFFFFFDu``ZD5FFFFFFFFFFFFFFFFFFFFD~`
.uGhS5F5F5F5F5F5F5F5Su`
.uGhS5F5F5F5F5F5F5F5Su`
.uGhS55555555555555S_P
.uGhS55555555555555S_P
.uGhS55
.uGhS55
.uG`S
.uG`S
.ushST
.ushST
.us0ETTT
.us0ETTT
.ushETTTTTTTT
.ushETTTTTTTT
.us0EJTJTTTEc44c4c4c4ccc4c4RA8GsXnc
.us0EJTJTTTEc44c4c4c4ccc4c4RA8GsXnc
.ushEJJTJJEcccccccccccccc
.ushEJJTJJEcccccccccccccc
.ushEJJJJEc
.ushEJJJJEc
.ushE
.ushE
.ush?
.ush?
.ush?|
.ush?|
.uXhOO=
.uXhOO=
.uXh?vv
.uXh?vv
.uXhv?vv
.uXhv?vv
.usP?gggggggggqggqggggggggggggggggg}ggggggggggg}v
.usP?gggggggggqggqggggggggggggggggg}ggggggggggg}v
.usm_
.usm_
666666666
666666666
Hourly
Hourly
Maintenance security key:
Maintenance security key:
WindowState
WindowState
.hXXps://arcsoftware.org/palladium/register.php
.hXXps://arcsoftware.org/palladium/register.php
GetCPInfo
GetCPInfo
RegOpenKeyExA
RegOpenKeyExA
RegFlushKey
RegFlushKey
RegCreateKeyExA
RegCreateKeyExA
RegCloseKey
RegCloseKey
SetViewportOrgEx
SetViewportOrgEx
ShellExecuteA
ShellExecuteA
UnhookWindowsHookEx
UnhookWindowsHookEx
SetWindowsHookExA
SetWindowsHookExA
MapVirtualKeyA
MapVirtualKeyA
LoadKeyboardLayoutA
LoadKeyboardLayoutA
GetKeyboardState
GetKeyboardState
GetKeyboardLayoutList
GetKeyboardLayoutList
GetKeyboardLayout
GetKeyboardLayout
GetKeyState
GetKeyState
GetKeyNameTextA
GetKeyNameTextA
EnumWindows
EnumWindows
EnumThreadWindows
EnumThreadWindows
ActivateKeyboardLayout
ActivateKeyboardLayout
GetKeyboardType
GetKeyboardType
.idata
.idata
.rdata
.rdata
P.reloc
P.reloc
P.rsrc
P.rsrc
CF35B9AD-A699-4106-8A6F-E4474A2FF065
CF35B9AD-A699-4106-8A6F-E4474A2FF065
7Dispatch methods do not support more than 64 parameters
7Dispatch methods do not support more than 64 parameters
JPEG error #%d
JPEG error #%d
OLE control activation failed*Could not obtain OLE control window handle%License information for %s is invalidPLicense information for %s not found. You cannot use this control in design modeNUnable to retrieve a pointer to a running object registered with OLE for %s/%s
OLE control activation failed*Could not obtain OLE control window handle%License information for %s is invalidPLicense information for %s not found. You cannot use this control in design modeNUnable to retrieve a pointer to a running object registered with OLE for %s/%s
Invalid owner=This control requires version 4.70 or greater of COMCTL32.DLL
Invalid owner=This control requires version 4.70 or greater of COMCTL32.DLL
No help keyword specified.
No help keyword specified.
OLE error %.8x.Method '%s' not supported by automation object/Variant does not reference an automation object
OLE error %.8x.Method '%s' not supported by automation object/Variant does not reference an automation object
Error setting %s.Count8Listbox (%s) style must be virtual in order to set Count#No OnGetItem event handler assigned"Unable to find a Table of Contents
Error setting %s.Count8Listbox (%s) style must be virtual in order to set Count#No OnGetItem event handler assigned"Unable to find a Table of Contents
No help found for %s#No context-sensitive help installed$No topic-based help system installed
No help found for %s#No context-sensitive help installed$No topic-based help system installed
Value must be between %d and %d
Value must be between %d and %d
Unable to insert a line Clipboard does not support Icons/Menu '%s' is already being used by another form
Unable to insert a line Clipboard does not support Icons/Menu '%s' is already being used by another form
!Control '%s' has no parent window
!Control '%s' has no parent window
%s property out of range
%s property out of range
Scan line index out of range!Cannot change the size of an icon Invalid operation on TOleGraphic
Scan line index out of range!Cannot change the size of an icon Invalid operation on TOleGraphic
Unsupported clipboard format
Unsupported clipboard format
List capacity out of bounds (%d)
List capacity out of bounds (%d)
List count out of bounds (%d)
List count out of bounds (%d)
List index out of bounds (%d) Out of memory while expanding memory stream
List index out of bounds (%d) Out of memory while expanding memory stream
Error reading %s%s%s: %s
Error reading %s%s%s: %s
Failed to get data for '%s'
Failed to get data for '%s'
Resource %s not found
Resource %s not found
%s.Seek not implemented$Operation not allowed on sorted list$%s not in a class registration group
%s.Seek not implemented$Operation not allowed on sorted list$%s not in a class registration group
Property %s does not exist
Property %s does not exist
Bits index out of range*Can't write to a read-only resource streamECheckSynchronize called from thread $%x, which is NOT the main thread
Bits index out of range*Can't write to a read-only resource streamECheckSynchronize called from thread $%x, which is NOT the main thread
Class %s not found
Class %s not found
A class named %s already exists%List does not allow duplicates ($0%x)#A component named %s already exists%String list does not allow duplicates
A class named %s already exists%List does not allow duplicates ($0%x)#A component named %s already exists%String list does not allow duplicates
Cannot create file "%s". %s
Cannot create file "%s". %s
Cannot open file "%s". %s
Cannot open file "%s". %s
Invalid stream format$''%s'' is not a valid component name
Invalid stream format$''%s'' is not a valid component name
Invalid data type for '%s'
Invalid data type for '%s'
Ancestor for '%s' not found
Ancestor for '%s' not found
Cannot assign a %s to a %s
Cannot assign a %s to a %s
Interface not supported
Interface not supported
%s (%s, line %d)
%s (%s, line %d)
Abstract Error?Access violation at address %p in module '%s'. %s of address %p
Abstract Error?Access violation at address %p in module '%s'. %s of address %p
System Error. Code: %d.
System Error. Code: %d.
Invalid variant operation
Invalid variant operation
Invalid NULL variant operation%Invalid variant operation (%s%.8x)
Invalid NULL variant operation%Invalid variant operation (%s%.8x)
%s5Could not convert variant of type (%s) into type (%s)=Overflow while converting variant of type (%s) into type (%s)
%s5Could not convert variant of type (%s) into type (%s)=Overflow while converting variant of type (%s) into type (%s)
Operation not supported
Operation not supported
External exception %x
External exception %x
Invalid pointer operation
Invalid pointer operation
Invalid class typecast0Access violation at address %p. %s of address %p
Invalid class typecast0Access violation at address %p. %s of address %p
Privileged instruction(Exception %s in module %s at %p.
Privileged instruction(Exception %s in module %s at %p.
Application Error1Format '%s' invalid or incompatible with argument
Application Error1Format '%s' invalid or incompatible with argument
No argument for format '%s'"Variant method calls not supported
No argument for format '%s'"Variant method calls not supported
!'%s' is not a valid integer value
!'%s' is not a valid integer value
I/O error %d
I/O error %d
Integer overflow Invalid floating point operation
Integer overflow Invalid floating point operation
mshta.exe_256:
.text
.text
`.data
`.data
.rsrc
.rsrc
ADVAPI32.dll
ADVAPI32.dll
KERNEL32.dll
KERNEL32.dll
NTDLL.DLL
NTDLL.DLL
clsid\{25336920-03f9-11cf-8fd0-00aa00686f13}\InProcServer32
clsid\{25336920-03f9-11cf-8fd0-00aa00686f13}\InProcServer32
mscoree.dll
mscoree.dll
Please contact the application's support team for more information.
Please contact the application's support team for more information.
GetProcessWindowStation
GetProcessWindowStation
user32.dll
user32.dll
kernel32.dll
kernel32.dll
mshta.pdb
mshta.pdb
RegCloseKey
RegCloseKey
RegOpenKeyExA
RegOpenKeyExA
GetCPInfo
GetCPInfo
%System%\mshta.exe
%System%\mshta.exe
6.00.2900.5512 (xpsp.080413-2105)
6.00.2900.5512 (xpsp.080413-2105)
MSHTA.EXE
MSHTA.EXE
Windows
Windows
Operating System
Operating System
6.00.2900.5512
6.00.2900.5512
svchost.exe_1084_rwx_03020000_00012000:
t.FE;l$
t.FE;l$
winmm.dll
winmm.dll
ole32.dll
ole32.dll
maxhttpredirects
maxhttpredirects
software\microsoft\windows\currentversion\internet settings
software\microsoft\windows\currentversion\internet settings
enablehttp1_1
enablehttp1_1
software\microsoft\windows\currentversion\internet settings\zones\3
software\microsoft\windows\currentversion\internet settings\zones\3
%s\%s
%s\%s
hXXp://%s/?xurl=%s&xref=%s
hXXp://%s/?xurl=%s&xref=%s
clk=%s&bid=%s&aid=%s&sid=%s&rd=%s
clk=%s&bid=%s&aid=%s&sid=%s&rd=%s
atl.dll
atl.dll
oleaut32.dll
oleaut32.dll
n%D,3
n%D,3
Global\3006345f-6baf-4669-a7e1-aaa310564be9
Global\3006345f-6baf-4669-a7e1-aaa310564be9
kdmf.tmp
kdmf.tmp
%d|%d|%s|%s
%d|%d|%s|%s
Mozilla/4.0 (compatible; MSIE 1.0; Windows NT; CMD3)
Mozilla/4.0 (compatible; MSIE 1.0; Windows NT; CMD3)
DownloadAndExecute
DownloadAndExecute
DownloadCryptedAndExecute
DownloadCryptedAndExecute
DownloadCryptedAndExecute2
DownloadCryptedAndExecute2
%[^.].%[^(](%[^)])
%[^.].%[^(](%[^)])
command|%s|%s|%s|%s|%s|%s|%s|%s|%s|%s|%s
command|%s|%s|%s|%s|%s|%s|%s|%s|%s|%s|%s
setup.exe
setup.exe
google;yahoo;bing.;live.com;msn.com;altavista.com;ask.com;exalead.com;excite.com;dogpile.com;metacrawler.com;webcrawler.com;alltheweb.com;.lycos.;gigablast.com;cuil.com;.aol.;entireweb.com;.search.com;mamma.com;mytalkingbuddy.com;about.com;myspace.com;answers.com;conduit.com;alexa.com;alltheinternet.com;blinkx.com;macromedia.com;adobe.com;amazon.com;facebook.com;youtube.com;wikipedia.org;wikimedia.org;twitter.com;aolcdn.com;othersonline.com;everesttech.net;adrevolver.com;tribalfusion.com;adbureau.net;abmr.net;gstatic.com;virtualearth.net;atdmt.com;ivwbox.;powerset.net;yimg.com;2mdn.net;doubleclick.net;iwon.com;scorecardresearch.com;66.235.120.66;66.235.120.67;ytimg.com;infospace.com;edgesuite.net;superpages.com;lygo.com;compete.com;firmserve.com;worthathousandwords.com;yieldmanager.com;wazizu.com;meedea.com;atwola.com;doubleverify.com;tacoda.net;truveo.com;openx.org;adcertising.com;twimg.com;picsearch.com;oneriot.com;.com.com;flickr.com;searchvideo.com;.tqn.com;myspacecdn.com;fimservecdn.com;alexametrics.com
google;yahoo;bing.;live.com;msn.com;altavista.com;ask.com;exalead.com;excite.com;dogpile.com;metacrawler.com;webcrawler.com;alltheweb.com;.lycos.;gigablast.com;cuil.com;.aol.;entireweb.com;.search.com;mamma.com;mytalkingbuddy.com;about.com;myspace.com;answers.com;conduit.com;alexa.com;alltheinternet.com;blinkx.com;macromedia.com;adobe.com;amazon.com;facebook.com;youtube.com;wikipedia.org;wikimedia.org;twitter.com;aolcdn.com;othersonline.com;everesttech.net;adrevolver.com;tribalfusion.com;adbureau.net;abmr.net;gstatic.com;virtualearth.net;atdmt.com;ivwbox.;powerset.net;yimg.com;2mdn.net;doubleclick.net;iwon.com;scorecardresearch.com;66.235.120.66;66.235.120.67;ytimg.com;infospace.com;edgesuite.net;superpages.com;lygo.com;compete.com;firmserve.com;worthathousandwords.com;yieldmanager.com;wazizu.com;meedea.com;atwola.com;doubleverify.com;tacoda.net;truveo.com;openx.org;adcertising.com;twimg.com;picsearch.com;oneriot.com;.com.com;flickr.com;searchvideo.com;.tqn.com;myspacecdn.com;fimservecdn.com;alexametrics.com
HTTP/1.1 302 Found
HTTP/1.1 302 Found
Location: %s
Location: %s
HTTP/1.1 200 OK
HTTP/1.1 200 OK
Content-Length: %d
Content-Length: %d
hXXps://nichtadden.in/;hXXps://91.212.226.67/;hXXps://zz87jhfda88.com/;hXXps://n16fa53.com/;hXXps://01n02n4cx00.cc/;hXXps://lj1i16b0.com/
hXXps://nichtadden.in/;hXXps://91.212.226.67/;hXXps://zz87jhfda88.com/;hXXps://n16fa53.com/;hXXps://01n02n4cx00.cc/;hXXps://lj1i16b0.com/
hXXp://zl00zxcv1.com/;hXXp://zloozxcv1.com/;hXXp://71ha6dl01.com/;hXXp://axjau710h.com/;hXXp://rf9akjgh716zzl.com/;hXXp://dsg1tsga64aa17.com/;hXXp://l1i1e3e3oo8as0.com/;hXXp://7gafd33ja90a.com/;hXXp://n1mo661s6cx0.com/
hXXp://zl00zxcv1.com/;hXXp://zloozxcv1.com/;hXXp://71ha6dl01.com/;hXXp://axjau710h.com/;hXXp://rf9akjgh716zzl.com/;hXXp://dsg1tsga64aa17.com/;hXXp://l1i1e3e3oo8as0.com/;hXXp://7gafd33ja90a.com/;hXXp://n1mo661s6cx0.com/
hXXp://clkh71yhks66.com/
hXXp://clkh71yhks66.com/
hXXp://z0g7ya1i0.com/
hXXp://z0g7ya1i0.com/
cfg.ini
cfg.ini
urlmon.dll
urlmon.dll
bckfg.tmp
bckfg.tmp
svchost.exe
svchost.exe
Global\9e6af8f3-75f3-4b67-877a-c80125d7bc08
Global\9e6af8f3-75f3-4b67-877a-c80125d7bc08
*firefox*
*firefox*
*chrome*
*chrome*
*opera*
*opera*
Global\a68d7de8-eba6-4a54-90e0-9cb9d93b3ed7
Global\a68d7de8-eba6-4a54-90e0-9cb9d93b3ed7
Global\cc51461b-e32a-4883-8e97-e0706dc65415
Global\cc51461b-e32a-4883-8e97-e0706dc65415
keywords
keywords
Accept-Language: %s
Accept-Language: %s
%s hXXp://%s/?xurl=%s&xref=%s
%s hXXp://%s/?xurl=%s&xref=%s
%s %s
%s %s
1.6|%s|%s|%s|%s|%s|%s
1.6|%s|%s|%s|%s|%s|%s
0123456789
0123456789
software\classes\http\shell\open\command
software\classes\http\shell\open\command
firefox
firefox
:"/\|?*
:"/\|?*
%s-%s
%s-%s
. d SP.%s
. d SP.%s
%s.dll
%s.dll
kernel32.dll
kernel32.dll
.text
.text
.rdata
.rdata
Global\452fefe0-a06e-400f-8d6b-6a12a0a09d4b
Global\452fefe0-a06e-400f-8d6b-6a12a0a09d4b
VVV.google.
VVV.google.
/webhp
/webhp
search.yahoo.com
search.yahoo.com
.altavista.com
.altavista.com
/web/results
/web/results
.ask.com
.ask.com
VVV.exalead.com
VVV.exalead.com
/search/web/results
/search/web/results
VVV.alltheweb.com
VVV.alltheweb.com
search.lycos.
search.lycos.
tab=web
tab=web
gigablast.com
gigablast.com
cuil.com
cuil.com
.aol.
.aol.
entireweb.com
entireweb.com
md=web
md=web
VVV.search.com
VVV.search.com
VVV.mamma.com
VVV.mamma.com
mytalkingbuddy.com
mytalkingbuddy.com
searchservice.myspace.com
searchservice.myspace.com
type=web
type=web
search.conduit.com
search.conduit.com
search.toolbars.alexa.com
search.toolbars.alexa.com
alltheinternet.com
alltheinternet.com
/ws/results/web/
/ws/results/web/
%u|%u
%u|%u
ver=%s&bid=%s&aid=%s&sid=%s&rd=%s&eng=%s&q=%s
ver=%s&bid=%s&aid=%s&sid=%s&rd=%s&eng=%s&q=%s
hXXp://%s%s
hXXp://%s%s
?xurl=
?xurl=
http/1.
http/1.
mozilla
mozilla
windowsupdate
windowsupdate
\\?\globalroot\device\00000785\3db8dd44\kdmf.tmp
\\?\globalroot\device\00000785\3db8dd44\kdmf.tmp
%WinDir%\System32\svchost.exe
%WinDir%\System32\svchost.exe
1614895754
1614895754
\\?\globalroot\device\00000785\3db8dd44
\\?\globalroot\device\00000785\3db8dd44
cmd.dll
cmd.dll
\\?\globalroot\device\00000785\3db8dd44\keywords
\\?\globalroot\device\00000785\3db8dd44\keywords
\\?\globalroot\device\00000785\3db8dd44\cfg.ini
\\?\globalroot\device\00000785\3db8dd44\cfg.ini
WinExec
WinExec
SHEnumKeyExA
SHEnumKeyExA
FindFirstUrlCacheEntryW
FindFirstUrlCacheEntryW
UnlockUrlCacheEntryFileW
UnlockUrlCacheEntryFileW
DeleteUrlCacheEntryW
DeleteUrlCacheEntryW
FindNextUrlCacheEntryW
FindNextUrlCacheEntryW
InternetCrackUrlA
InternetCrackUrlA
HttpOpenRequestA
HttpOpenRequestA
HttpSendRequestA
HttpSendRequestA
HttpQueryInfoW
HttpQueryInfoW
FindCloseUrlCache
FindCloseUrlCache
`.rdata
`.rdata
@.data
@.data
.reloc
.reloc
KERNEL32.DLL
KERNEL32.DLL
ADVAPI32.dll
ADVAPI32.dll
imagehlp.dll
imagehlp.dll
ntdll.dll
ntdll.dll
SHLWAPI.dll
SHLWAPI.dll
USER32.dll
USER32.dll
WININET.dll
WININET.dll
WebBrowser
WebBrowser
%s-%d
%s-%d
eplorer\iexplore.exe" -nohome
eplorer\iexplore.exe" -nohome
spoolsv.exe_1424_rwx_00B60000_00001000:
.text
.text
`.rdata
`.rdata
@.data
@.data
.config
.config
.reloc
.reloc
B.rsrc
B.rsrc
@.reloc
@.reloc
spoolsv.exe_1424_rwx_00B67000_00001000:
Hello.dat
Hello.dat
HHGHD%d
HHGHD%d
ntdll.dll
ntdll.dll
SHLWAPI.dll
SHLWAPI.dll
SHELL32.dll
SHELL32.dll
ConnectNamedPipe
ConnectNamedPipe
GetNamedPipeInfo
GetNamedPipeInfo
WaitNamedPipeW
WaitNamedPipeW
KERNEL32.dll
KERNEL32.dll
ExitWindowsEx
ExitWindowsEx
OemKeyScan
OemKeyScan
USER32.dll
USER32.dll
GDI32.dll
GDI32.dll
ADVAPI32.dll
ADVAPI32.dll
spoolsv.exe_1424_rwx_00F90000_00021000:
.text
.text
`.rdata
`.rdata
@.data
@.data
.config
.config
.reloc
.reloc
N. d SP.
N. d SP.
%x%x%x%x%x%x
%x%x%x%x%x%x
%s|%s|%s|%x|%x|%s|prn3
%s|%s|%s|%x|%x|%s|prn3
%[^;];%[^;];%[^;];
%[^;];%[^;];%[^;];
ntdll.dll
ntdll.dll
system\currentcontrolset\services\%x
system\currentcontrolset\services\%x
\\?\globalroot%wZ\cmd.dll
\\?\globalroot%wZ\cmd.dll
\\?\globalroot%wZ\cfg.ini
\\?\globalroot%wZ\cfg.ini
\\?\globalroot%wZ\bckfg.tmp
\\?\globalroot%wZ\bckfg.tmp
cmd.dll
cmd.dll
%[^|]|%[^|]|%s
%[^|]|%[^|]|%s
\\?\globalroot%wZ\ldr16
\\?\globalroot%wZ\ldr16
\\?\globalroot%wZ\ldr32
\\?\globalroot%wZ\ldr32
\\?\globalroot%wZ\ldr64
\\?\globalroot%wZ\ldr64
\\?\globalroot%wZ\drv64
\\?\globalroot%wZ\drv64
\\?\globalroot%wZ\cmd64.dll
\\?\globalroot%wZ\cmd64.dll
cmd64.dll
cmd64.dll
\\?\globalroot%wZ\drv32
\\?\globalroot%wZ\drv32
aid=%s
aid=%s
sid=%s
sid=%s
*=cmd.dll
*=cmd.dll
* (x64)=cmd64.dll
* (x64)=cmd64.dll
[cmd]
[cmd]
srv=%s
srv=%s
wsrv=%s
wsrv=%s
psrv=%s
psrv=%s
cfg.ini
cfg.ini
bckfg.tmp
bckfg.tmp
ZwConnectPort
ZwConnectPort
GetWindowsDirectoryW
GetWindowsDirectoryW
KERNEL32.dll
KERNEL32.dll
RegCreateKeyA
RegCreateKeyA
RegCloseKey
RegCloseKey
ADVAPI32.dll
ADVAPI32.dll
SHDeleteKeyA
SHDeleteKeyA
SHLWAPI.dll
SHLWAPI.dll
imagehlp.dll
imagehlp.dll
PSAPI.DLL
PSAPI.DLL
RPCRT4.dll
RPCRT4.dll
InternetCrackUrlA
InternetCrackUrlA
HttpOpenRequestA
HttpOpenRequestA
HttpSendRequestA
HttpSendRequestA
WININET.dll
WININET.dll
ShellExecuteW
ShellExecuteW
SHELL32.dll
SHELL32.dll
ole32.dll
ole32.dll
WINSPOOL.DRV
WINSPOOL.DRV
Error loading operating system
Error loading operating system
Missing operating system
Missing operating system
`.reloc
`.reloc
kdcom.dll
kdcom.dll
ntoskrnl.exe
ntoskrnl.exe
`.pdata
`.pdata
.pdata
.pdata
@.reloc
@.reloc
tùXXt
tùXXt
\\?\globalroot%S
\\?\globalroot%S
%s (x64)
%s (x64)
KeDelayExecutionThread
KeDelayExecutionThread
ZwOpenKey
ZwOpenKey
ZwQueryValueKey
ZwQueryValueKey
ZwSetValueKey
ZwSetValueKey
!Win64 .DLL.
!Win64 .DLL.
.MPRESS1
.MPRESS1
.MPRESS2*
.MPRESS2*
%X%XLA
%X%XLA
AndExecu
AndExecu
https:/
https:/
alm94.as(ia
alm94.as(ia
wrika.in
wrika.in
D.NLZ
D.NLZ
%c.F/
%c.F/
h2/ %u5
h2/ %u5
(e1y%s
(e1y%s
h%fxb
h%fxb
U.nSq
U.nSq
\{x-x-x-x-xx}
\{x-x-x-x-xx}
\registry\machine\%S
\registry\machine\%S
\??\physicaldrive%d
\??\physicaldrive%d
services.exe
services.exe
\??\globalroot\systemroot\system32\tasks\%x
\??\globalroot\systemroot\system32\tasks\%x
\\?\globalroot%s
\\?\globalroot%s
%s.manifest
%s.manifest
%s\setup%u.exe
%s\setup%u.exe
%s\%S
%s\%S
*\KERNEL32.DLL
*\KERNEL32.DLL
\device\%s
\device\%s
%s\cfg.ini
%s\cfg.ini
%s\mbr
%s\mbr