Trojan.GenericKD.1777158_ca8404c573

Dynamic Analysis

Payload

Behaviour	Description
WormAutorun	A worm can spread via removable drives. It writes its executable and creates "autorun.inf" scripts on all removable drives. The autorun script will execute the Trojan's file once a user opens a drive's folder in Windows Explorer.

Process activity

The Trojan creates the following process(es):

%original file name%.exe:1504
update.exe:3648

The Trojan injects its code into the following process(es):

QIcon Changer.exe:4084
update.exe:2168
svchost.exe:1540

Mutexes

The following mutexes were created/opened:No objects were found.

File activity

The process %original file name%.exe:1504 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\QIcon Changer.exe (12288 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\update.exe (264 bytes)

The process update.exe:2168 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Application Data\Microsoft\Windows\Chrome.dat (322 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%System%\Chrome\Chrome.exe (1425 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\x.html (0 bytes)

Registry activity

The process QIcon Changer.exe:4084 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "49 A2 DF 55 E0 1B EB 74 83 8F 00 1A 89 12 ED CB"

The process %original file name%.exe:1504 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "B4 81 1A 46 A3 2C F5 47 A3 DC 7C 33 DB 3F 41 12"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{fdd9f6f3-7454-11e2-b4cd-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{773a730e-74fb-11e2-b597-000c293bdf2f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%Documents and Settings%\%current user%\Local Settings\Temp]
"update.exe" = "WindowsApplication1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{fdd9f6f2-7454-11e2-b4cd-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%Documents and Settings%\%current user%\Local Settings\Temp]
"QIcon Changer.exe" = "QIcon Changer"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{fdd9f6f5-7454-11e2-b4cd-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
"Personal" = "%Documents and Settings%\%current user%\My Documents"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

"IntranetName" = "1"

The process update.exe:2168 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{fdd9f6f3-7454-11e2-b4cd-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\Chrome]
"StubPath" = "%System%\Chrome\Chrome.exe restart"

[HKCU\Software\Chrome]
"ServerStarted" = "01/08/2014 05:08:48"

[HKCU\Software\XtremeRAT]
"Mutex" = "Chrome"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\DirectDraw\MostRecentApplication]
"ID" = "1406158059"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\DirectDraw\MostRecentApplication]
"Name" = "update.exe"

[HKCU\Chrome]
"Chrome" = "%Chrome%"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{fdd9f6f2-7454-11e2-b4cd-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Chrome]
"ServerName" = "%System%\Chrome\Chrome.exe"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 41 00 00 00 01 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "42 C9 90 94 70 54 F6 E6 6A 54 C5 8E 2E 1E 6C C8"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{773a730e-74fb-11e2-b597-000c293bdf2f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{fdd9f6f5-7454-11e2-b4cd-806d6172696f}]
"BaseClass" = "Drive"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"Chrome" = "%System%\Chrome\Chrome.exe"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass" = "1"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

"IntranetName" = "1"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Chrome" = "%System%\Chrome\Chrome.exe"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process update.exe:3648 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "79 AA 99 A0 E6 18 20 AD 34 42 DF 99 C3 60 73 20"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

Dropped PE files

MD5	File path
c4e36e661b2e6ee85590c50a5c2c83fd	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\QIcon Changer.exe
e15f4955f84871a2d5fa658bceaca312	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\update.exe
e15f4955f84871a2d5fa658bceaca312	c:\WINDOWS\system32\Chrome\Chrome.exe

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

A worm can spread via removable drives. It writes its executable and creates "autorun.inf" scripts on all removable drives. The autorun script will execute the Trojan's file once a user opens a drive's folder in Windows Explorer.

Removals

Remove it with Ad-Aware

1. Click (here) to download and install Ad-Aware Free Antivirus.
2. Update the definition files.
3. Run a full scan of your computer.

Manual removal*

1. Terminate malicious process(es) (How to End a Process With the Task Manager):

   %original file name%.exe:1504
   update.exe:3648
   

2. Delete the original Trojan file.
   
3. Delete or disinfect the following files created/modified by the Trojan:

   %Documents and Settings%\%current user%\Local Settings\Temp\QIcon Changer.exe (12288 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\update.exe (264 bytes)
   %Documents and Settings%\%current user%\Application Data\Microsoft\Windows\Chrome.dat (322 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
   %System%\Chrome\Chrome.exe (1425 bytes)

4. Delete the following value(s) in the autorun key (How to Work with System Registry):

   [HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
   "Chrome" = "%System%\Chrome\Chrome.exe"
   
   [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
   "Chrome" = "%System%\Chrome\Chrome.exe"

5. Find and delete all copies of the worm's file together with "autorun.inf" scripts on removable drives.
   
6. Reboot the computer.
   

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

VersionInfo

Company Name:
Product Name:
Product Version: 0.0.0.0
Legal Copyright:
Legal Trademarks:
Original Filename: 1.exe
Internal Name: 1.exe
File Version: 0.0.0.0
File Description:
Comments:
Language: Language Neutral

Company Name: Product Name: Product Version: 0.0.0.0Legal Copyright: Legal Trademarks: Original Filename: 1.exeInternal Name: 1.exeFile Version: 0.0.0.0File Description: Comments: Language: Language Neutral

PE Sections

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Section MD5
.text	8192	2938564	2940928	3.71219	473b16ec8e978eb018544cf4b0cb0cbf
.rsrc	2949120	141288	143360	3.69209	b217a1e06e1f1efb8771691c69bfbd8d
.reloc	3096576	12	4096	0.011373	43a3fbba96a60aaaa3270071b3bd6909

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Network Activity

URLs

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

Map

The Trojan connects to the servers at the folowing location(s):

Strings from Dumps

QIcon Changer.exe_4084:

.text

.text

`.itext

`.itext

`.data

`.data

.idata

.idata

.didata

.didata

.rdata

.rdata

@.reloc

@.reloc

B.rsrc

B.rsrc

biClrImportant

biClrImportant

tagMSG

tagMSG

Windows

Windows

HKEY

HKEY

TWMKey

TWMKey

KeyData

KeyData

etNoMonitorSupportException

etNoMonitorSupportException

TArray<System></System>

TArray<System></System>

ENotSupportedException

ENotSupportedException

ENoMonitorSupportException

ENoMonitorSupportException

TArray<SysUtils></SysUtils>

TArray<SysUtils></SysUtils>

TArray<System></System>

TArray<System></System>

csshiftjis

csshiftjis

windows-936

windows-936

windows-1250

windows-1250

windows-1251

windows-1251

windows-1252

windows-1252

windows-1253

windows-1253

windows-1254

windows-1254

windows-1255

windows-1255

windows-1256

windows-1256

windows-1257

windows-1257

windows-1258

windows-1258

windows-874

windows-874

$*@@@*$@@@$ *@@* $@@($*)@-$*@@$-*@@$*-@@(*$)@-*$@@*-$@@*$-@@-* $@-$ *@* $-@$ *-@$ -*@*- $@($ *)(* $)

$*@@@*$@@@$ *@@* $@@($*)@-$*@@$-*@@$*-@@(*$)@-*$@@*-$@@*$-@@-* $@-$ *@* $-@$ *-@$ -*@*- $@($ *)(* $)

TArray<SysUtils></SysUtils>

TArray<SysUtils></SysUtils>

grfLocksSupported

grfLocksSupported

Operator

Operator

EVariantBadIndexError

EVariantBadIndexError

ssShift

ssShift

htKeyword

htKeyword

EInvalidOperation

EInvalidOperation

PPointerList<%C

PPointerList<%C

TList.TDirection

TList.TDirection

AOperator

AOperator

Count$%C

Count$%C

TPersistentClassH4C

TPersistentClassH4C

TThread.TSynchronizeRecord

TThread.TSynchronizeRecord

TOperation

TOperation

Operation

Operation

FOnExecute

FOnExecute

OnExecute

OnExecute

TArray<System></System>

TArray<System></System>

TArray<System></System>

TArray<System></System>

TList.Sort$876$0$Intf@

TList.Sort$876$0$Intf@

TList.Sort$876$ActRec

TList.Sort$876$ActRec

$TComponent.FindComponent$1499$0$Intf@

$TComponent.FindComponent$1499$0$Intf@

$TComponent.FindComponent$1499$ActRec

$TComponent.FindComponent$1499$ActRec

$TComponent.FindComponent$1499$ActRec,

$TComponent.FindComponent$1499$ActRec,

DeleteKey

DeleteKey

TRegKeyInfo

TRegKeyInfo

NumSubKeys

NumSubKeys

MaxSubKeyLen

MaxSubKeyLen

FCurrentKey

FCurrentKey

FRootKey

FRootKey

FCloseRootKey

FCloseRootKey

CloseKey

CloseKey

CreateKey

CreateKey

GetKeyInfo

GetKeyInfo

GetKeyNames

GetKeyNames

HasSubKeys

HasSubKeys

KeyExists

KeyExists

LoadKey

LoadKey

MoveKey

MoveKey

OpenKey

OpenKey

OpenKeyReadOnly

OpenKeyReadOnly

ReplaceKey

ReplaceKey

RestoreKey

RestoreKey

SaveKey

SaveKey

UnLoadKey

UnLoadKey

CurrentKey\

CurrentKey\

LastErrorMsg

LastErrorMsg

RootKey\

RootKey\

RootKeyName

RootKeyName

EInvalidGraphicOperation

EInvalidGraphicOperation

SupportsPartialTransparency

SupportsPartialTransparency

SupportsClipboardFormat

SupportsClipboardFormat

Monochrome

Monochrome

IsShortCut

IsShortCut

FHelpKeyword

FHelpKeyword

HelpKeyword,

HelpKeyword,

igoParentPassthrough

igoParentPassthrough

FAlwaysShowDragImages

FAlwaysShowDragImages

AlwaysShowDragImages

AlwaysShowDragImages

toFlickFallbackKeys

toFlickFallbackKeys

'TCustomGestureEngine.TGestureEngineFlag

'TCustomGestureEngine.TGestureEngineFlag

(TCustomGestureEngine.TGestureEngineFlags

(TCustomGestureEngine.TGestureEngineFlags

Supported

Supported

TKeyEvent

TKeyEvent

TKeyPressEvent

TKeyPressEvent

HelpKeyword

HelpKeyword

FOnKeyDown

FOnKeyDown

FOnKeyPress

FOnKeyPress

FOnKeyUp

FOnKeyUp

IsHintMsg

IsHintMsg

FNativeWheelSupport

FNativeWheelSupport

FWheelSupportMessage

FWheelSupportMessage

thHeaderItemLeftPressed

thHeaderItemLeftPressed

tsArrowBtnLeftPressed

tsArrowBtnLeftPressed

ttbThumbLeftPressed

ttbThumbLeftPressed

lrMonoChrome

lrMonoChrome

FAutoHotkeys

FAutoHotkeys

RethinkHotkeys

RethinkHotkeys

AutoHotkeys`/I

AutoHotkeys`/I

AutoHotkeys

AutoHotkeys

UnderstandsKeyword

UnderstandsKeyword

poPortrait

poPortrait

APort

APort

Port

Port

FProportional

FProportional

Proportional

Proportional

ssHotTrack

ssHotTrack

TWindowState

TWindowState

poProportional

poProportional

fsShowing

fsShowing

FWindowState

FWindowState

FKeyPreview

FKeyPreview

WantChildKey

WantChildKey

KeyPreview

KeyPreview

WindowState

WindowState

KeyPreviewP

KeyPreviewP

OnKeyDown

OnKeyDown

OnKeyPress

OnKeyPress

OnKeyUp|

OnKeyUp|

FBiDiKeyboard

FBiDiKeyboard

FNonBiDiKeyboard

FNonBiDiKeyboard

FEnumAllWindowsOnActivateHint

FEnumAllWindowsOnActivateHint

FOnActionExecute

FOnActionExecute

Keyword

Keyword

EnumAllWindowsOnActivateHint\

EnumAllWindowsOnActivateHint\

BiDiKeyboard\

BiDiKeyboard\

NonBiDiKeyboard

NonBiDiKeyboard

OnActionExecute`

OnActionExecute`

fKeyword

fKeyword

1.1.2

1.1.2

deflate 1.1.2 Copyright 1995-1998 Jean-loup Gailly

deflate 1.1.2 Copyright 1995-1998 Jean-loup Gailly

1.1.4

1.1.4

cmDefault

cmDefault

FAnimationForAllWindows

FAnimationForAllWindows

AuthorURL

AuthorURL

AnimationForAllWindows

AnimationForAllWindows

;!199{199

;!199{199

;0!8&2{199

;0!8&2{199

TMsgHandler

TMsgHandler

TMsgHandlerOO

TMsgHandlerOO

TMsgHandlers

TMsgHandlers

RollUpLeftPoint

RollUpLeftPoint

Generics.Defaults

Generics.Defaults

Generics.Collections

Generics.Collections

UrlMon

UrlMon

1.2.3

1.2.3

deflate 1.2.3 Copyright 1995-2005 Jean-loup Gailly

deflate 1.2.3 Copyright 1995-2005 Jean-loup Gailly

inflate 1.2.3 Copyright 1995-2005 Mark Adler

inflate 1.2.3 Copyright 1995-2005 Mark Adler

oleaut32.dll

oleaut32.dll

advapi32.dll

advapi32.dll

RegOpenKeyExW

RegOpenKeyExW

RegCloseKey

RegCloseKey

user32.dll

user32.dll

kernel32.dll

kernel32.dll

UnhookWindowsHookEx

UnhookWindowsHookEx

SetWindowsHookExW

SetWindowsHookExW

MsgWaitForMultipleObjectsEx

MsgWaitForMultipleObjectsEx

MsgWaitForMultipleObjects

MsgWaitForMultipleObjects

MapVirtualKeyW

MapVirtualKeyW

LoadKeyboardLayoutW

LoadKeyboardLayoutW

GetKeyboardState

GetKeyboardState

GetKeyboardLayoutNameW

GetKeyboardLayoutNameW

GetKeyboardLayoutList

GetKeyboardLayoutList

GetKeyboardLayout

GetKeyboardLayout

GetKeyState

GetKeyState

GetKeyNameTextW

GetKeyNameTextW

EnumWindows

EnumWindows

EnumThreadWindows

EnumThreadWindows

EnumChildWindows

EnumChildWindows

ActivateKeyboardLayout

ActivateKeyboardLayout

msimg32.dll

msimg32.dll

gdi32.dll

gdi32.dll

SetViewportOrgEx

SetViewportOrgEx

version.dll

version.dll

GetCPInfoExW

GetCPInfoExW

GetCPInfo

GetCPInfo

RegUnLoadKeyW

RegUnLoadKeyW

RegSaveKeyW

RegSaveKeyW

RegRestoreKeyW

RegRestoreKeyW

RegReplaceKeyW

RegReplaceKeyW

RegQueryInfoKeyW

RegQueryInfoKeyW

RegLoadKeyW

RegLoadKeyW

RegFlushKey

RegFlushKey

RegEnumKeyExW

RegEnumKeyExW

RegDeleteKeyW

RegDeleteKeyW

RegCreateKeyExW

RegCreateKeyExW

ole32.dll

ole32.dll

comctl32.dll

comctl32.dll

winspool.drv

winspool.drv

shell32.dll

shell32.dll

windowscodecs.dll

windowscodecs.dll

uxtheme.dll

uxtheme.dll

DWMAPI.DLL

DWMAPI.DLL

;%;<;^;{;

;%;<;^;{;

2!2'2/242

2!2'2/242

1 1$1(1,10112

1 1$1(1,10112

0Y01K2

0Y01K2

8>8[8_8{8

8>8[8_8{8

4$4(4,4044484

4$4(4,4044484

= =$=@=[=_=4>

= =$=@=[=_=4>

535;5?5`5

535;5?5`5

?!?(?/?7?]?}?

?!?(?/?7?]?}?

00

00

7s7D7^7y7

7s7D7^7y7

="=&=*=.=2=6=:=>=

="=&=*=.=2=6=:=>=

5%5U5c5o5}5

5%5U5c5o5}5

11C1K1\1y1

11C1K1\1y1

00C0N0Y0m0

00C0N0Y0m0

7'898@8{8

7'898@8{8

2 2?2^2~2

2 2?2^2~2

464;4[4`4

464;4[4`4

>$> >2>:>>>]>}>

>$> >2>:>>>]>}>

3!3:3\3~3

3!3:3\3~3

0'0@0_0}0

0'0@0_0}0

333333333333333333

333333333333333333

33333833

33333833

3333339

3333339

3333333333333338

3333333333333338

:*"*"$3338

:*"*"$3338

3333333

3333333

33333333

33333333

33333333333

33333333333

3333333333338

3333333333338

33338?383

33338?383

333333333333

333333333333

:*3:"$3338

:*3:"$3338

333333333333333

333333333333333

.bsTrayIcon

.bsTrayIcon

KWindows

KWindows

CGenerics.Defaults

CGenerics.Defaults

Font.Charset

Font.Charset

Font.Color

Font.Color

Font.Height

Font.Height

Font.Name

Font.Name

Font.Style

Font.Style

Picture.Data

Picture.Data

LESUEUR).qhp

LESUEUR).qhp

darkcodersc.blogspot.com..tr

darkcodersc.blogspot.com..tr

..vct

..vct

Glyph.Data

Glyph.Data

Brush.Style

Brush.Style

Pen.Style

Pen.Style

version="15.0.3890.34076"

version="15.0.3890.34076"

name="Microsoft.Windows.Common-Controls"

name="Microsoft.Windows.Common-Controls"

version="6.0.0.0"

version="6.0.0.0"

publicKeyToken="6595b64144ccf1df"

publicKeyToken="6595b64144ccf1df"

<requestedExecutionLevel><pre>MSWHEEL_ROLLMSG</pre><pre>MSH_WHEELSUPPORT_MSG</pre><pre>MSH_SCROLL_LINES_MSG</pre><pre>C:\Builds\TP\rtl\sys\SysUtils.pas</pre><pre>%s-%s</pre><pre>C:\Builds\TP\rtl\common\TypInfo.pas</pre><pre>%s[%d]</pre><pre>%s_%d</pre><pre>.Owner</pre><pre>C:\Builds\TP\rtl\common\Classes.pas</pre><pre>C:\Builds\TP\rtl\common\SyncObjs.pas</pre><pre>\\?\UNC\</pre><pre>HKEY_CLASSES_ROOT</pre><pre>HKEY_CURRENT_USER</pre><pre>HKEY_LOCAL_MACHINE</pre><pre>HKEY_USERS</pre><pre>HKEY_PERFORMANCE_DATA</pre><pre>HKEY_CURRENT_CONFIG</pre><pre>HKEY_DYN_DATA</pre><pre>%s (*.%s)|*.%1:s</pre><pre>%s (%s)|%1:s|</pre><pre>SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontSubstitutes</pre><pre>crSQLWait</pre><pre>%s (%s)</pre><pre>imm32.dll</pre><pre>\SYSTEM\CurrentControlSet\Control\Keyboard Layouts\</pre><pre>clWebSnow</pre><pre>clWebFloralWhite</pre><pre>clWebLavenderBlush</pre><pre>clWebOldLace</pre><pre>clWebIvory</pre><pre>clWebCornSilk</pre><pre>clWebBeige</pre><pre>clWebAntiqueWhite</pre><pre>clWebWheat</pre><pre>clWebAliceBlue</pre><pre>clWebGhostWhite</pre><pre>clWebLavender</pre><pre>clWebSeashell</pre><pre>clWebLightYellow</pre><pre>clWebPapayaWhip</pre><pre>clWebNavajoWhite</pre><pre>clWebMoccasin</pre><pre>clWebBurlywood</pre><pre>clWebAzure</pre><pre>clWebMintcream</pre><pre>clWebHoneydew</pre><pre>clWebLinen</pre><pre>clWebLemonChiffon</pre><pre>clWebBlanchedAlmond</pre><pre>clWebBisque</pre><pre>clWebPeachPuff</pre><pre>clWebTan</pre><pre>clWebYellow</pre><pre>clWebDarkOrange</pre><pre>clWebRed</pre><pre>clWebDarkRed</pre><pre>clWebMaroon</pre><pre>clWebIndianRed</pre><pre>clWebSalmon</pre><pre>clWebCoral</pre><pre>clWebGold</pre><pre>clWebTomato</pre><pre>clWebCrimson</pre><pre>clWebBrown</pre><pre>clWebChocolate</pre><pre>clWebSandyBrown</pre><pre>clWebLightSalmon</pre><pre>clWebLightCoral</pre><pre>clWebOrange</pre><pre>clWebOrangeRed</pre><pre>clWebFirebrick</pre><pre>clWebSaddleBrown</pre><pre>clWebSienna</pre><pre>clWebPeru</pre><pre>clWebDarkSalmon</pre><pre>clWebRosyBrown</pre><pre>clWebPaleGoldenrod</pre><pre>clWebLightGoldenrodYellow</pre><pre>clWebOlive</pre><pre>clWebForestGreen</pre><pre>clWebGreenYellow</pre><pre>clWebChartreuse</pre><pre>clWebLightGreen</pre><pre>clWebAquamarine</pre><pre>clWebSeaGreen</pre><pre>clWebGoldenRod</pre><pre>clWebKhaki</pre><pre>clWebOliveDrab</pre><pre>clWebGreen</pre><pre>clWebYellowGreen</pre><pre>clWebLawnGreen</pre><pre>clWebPaleGreen</pre><pre>clWebMediumAquamarine</pre><pre>clWebMediumSeaGreen</pre><pre>clWebDarkGoldenRod</pre><pre>clWebDarkKhaki</pre><pre>clWebDarkOliveGreen</pre><pre>clWebDarkgreen</pre><pre>clWebLimeGreen</pre><pre>clWebLime</pre><pre>clWebSpringGreen</pre><pre>clWebMediumSpringGreen</pre><pre>clWebDarkSeaGreen</pre><pre>clWebLightSeaGreen</pre><pre>clWebPaleTurquoise</pre><pre>clWebLightCyan</pre><pre>clWebLightBlue</pre><pre>clWebLightSkyBlue</pre><pre>clWebCornFlowerBlue</pre><pre>clWebDarkBlue</pre><pre>clWebIndigo</pre><pre>clWebMediumTurquoise</pre><pre>clWebTurquoise</pre><pre>clWebCyan</pre><pre>clWebPowderBlue</pre><pre>clWebSkyBlue</pre><pre>clWebRoyalBlue</pre><pre>clWebMediumBlue</pre><pre>clWebMidnightBlue</pre><pre>clWebDarkTurquoise</pre><pre>clWebCadetBlue</pre><pre>clWebDarkCyan</pre><pre>clWebTeal</pre><pre>clWebDeepskyBlue</pre><pre>clWebDodgerBlue</pre><pre>clWebBlue</pre><pre>clWebNavy</pre><pre>clWebDarkViolet</pre><pre>clWebDarkOrchid</pre><pre>clWebMagenta</pre><pre>clWebDarkMagenta</pre><pre>clWebMediumVioletRed</pre><pre>clWebPaleVioletRed</pre><pre>clWebBlueViolet</pre><pre>clWebMediumOrchid</pre><pre>clWebMediumPurple</pre><pre>clWebPurple</pre><pre>clWebDeepPink</pre><pre>clWebLightPink</pre><pre>clWebViolet</pre><pre>clWebOrchid</pre><pre>clWebPlum</pre><pre>clWebThistle</pre><pre>clWebHotPink</pre><pre>clWebPink</pre><pre>clWebLightSteelBlue</pre><pre>clWebMediumSlateBlue</pre><pre>clWebLightSlateGray</pre><pre>clWebWhite</pre><pre>clWebLightgrey</pre><pre>clWebGray</pre><pre>clWebSteelBlue</pre><pre>clWebSlateBlue</pre><pre>clWebSlateGray</pre><pre>clWebWhiteSmoke</pre><pre>clWebSilver</pre><pre>clWebDimGray</pre><pre>clWebMistyRose</pre><pre>clWebDarkSlateBlue</pre><pre>clWebDarkSlategray</pre><pre>clWebGainsboro</pre><pre>clWebDarkGray</pre><pre>clWebBlack</pre><pre>System\CurrentControlSet\Control\Keyboard Layouts\%.8x</pre><pre>c:\program files (x86)\embarcadero\rad studio\8.0\lib\Win32\release\bsEffects.pas</pre><pre>1234567890</pre><pre>dwmapi.dll</pre><pre>Invalid stream operation</pre><pre>cmdefault</pre><pre>authorurl</pre><pre>MSG_BTN_YES=&Yes</pre><pre>MSG_BTN_NO=&No</pre><pre>MSG_BTN_OK=OK</pre><pre>MSG_BTN_CANCEL=Cancel</pre><pre>MSG_BTN_ABORT=&Abort</pre><pre>MSG_BTN_RETRY=&Retry</pre><pre>MSG_BTN_IGNORE=&Ignore</pre><pre>MSG_BTN_ALL=&All</pre><pre>MSG_BTN_NOTOALL=N&oToAll</pre><pre>MSG_BTN_YESTOALL=&YesToAll</pre><pre>MSG_BTN_HELP=&Help</pre><pre>MSG_BTN_OPEN=&Open</pre><pre>MSG_BTN_SAVE=&Save</pre><pre>MSG_BTN_CLOSE=Close</pre><pre>MSG_BTN_BACK_HINT=Go To Last Folder Visited</pre><pre>MSG_BTN_UP_HINT=Up One Level</pre><pre>MSG_BTN_NEWFOLDER_HINT=Create New Folder</pre><pre>MSG_BTN_VIEWMENU_HINT=View Menu</pre><pre>MSG_BTN_STRETCH_HINT=Stretch Picture</pre><pre>MSG_FILENAME=File name:</pre><pre>MSG_FILETYPE=File type:</pre><pre>MSG_NEWFOLDER=New Folder</pre><pre>MSG_LV_DETAILS=Details</pre><pre>MSG_LV_ICON=Large icons</pre><pre>MSG_LV_SMALLICON=Small icons</pre><pre>MSG_LV_LIST=List</pre><pre>MSG_PREVIEWSKIN=Preview</pre><pre>MSG_PREVIEWBUTTON=Button</pre><pre>MSG_OVERWRITE=Do you want to overwrite old file?</pre><pre>MSG_CAP_WARNING=Warning</pre><pre>MSG_CAP_ERROR=Error</pre><pre>MSG_CAP_INFORMATION=Information</pre><pre>MSG_CAP_CONFIRM=Confirm</pre><pre>MSG_CAP_SHOWFLAG=Do not display this message again</pre><pre>PRNDLG_PORTRAIT=Portrait</pre><pre>bsSkin%d</pre><pre>c:\program files (x86)\embarcadero\rad studio\8.0\lib\Win32\release\spEffBmp.pas</pre><pre>.jpeg</pre><pre>rollupleftpoint</pre><pre>spSkin%d</pre><pre>Portable Network Graphics</pre><pre>oSome operation could not be performed because the system is out of resources. Close some windows and try again.</pre><pre>Setting bit transparency color is not allowed for png images containing alpha value for each pixel (COLOR_RGBALPHA and COLOR_GRAYSCALEALPHA)OThis operation is not valid because the current image contains no valid header.4The new size provided for image resizing is invalid.oThe "Portable Network Graphics" could not be created because invalid image type parameters have being provided.&Cannot change the size of a JPEG image</pre><pre>JPEG error #%d</pre><pre>UThis "Portable Network Graphics" image is invalid because it has missing image parts.[Could not decompress the image because it contains invalid compressed data.</pre><pre>Description: BThe "Portable Network Graphics" image contains an invalid palette.</pre><pre>The file being read is not a valid "Portable Network Graphics" image because it contains an invalid header. This file may be corrupted, try obtaining it againnThis "Portable Network Graphics" image is not supported or it might be invalid.</pre><pre>This "Portable Network Graphics" image is not supported because either its width or height exceeds the maximum size of 65535 pixels.</pre><pre>There is no such palette entry.dThis "Portable Network Graphics" image contains an unknown critical part which could not be decoded.pThis "Portable Network Graphics" image is encoded with an unknown compression scheme which could not be decoded.cThis "Portable Network Graphics" image uses an unknown interlace scheme which could not be decoded.-The chunks must be compatible to be assigned.jThis "Portable Network Graphics" image is invalid because the decoder found an unexpected end of the file.8This "Portable Network Graphics" image contains no data.]The program tried to add a existent critical chunk to the current image which is not allowed.IIt's not allowed to add a new chunk because the current image is invalid.7The png image could not be loaded from the resource ID.</pre><pre>All Clipboard does not support Icons Operation not supported on selected printer.There is no default printer currently selected/Menu '%s' is already being used by another form</pre><pre>- Dock zone has no controlLError loading dock zone from the stream. Expecting version %d, but found %d.jThis "Portable Network Graphics" image is not valid because it contains invalid pieces of data (crc error)yThe "Portable Network Graphics" image could not be loaded because one of its main piece of data (ihdr) might be corrupted</pre><pre>Icons!Control '%s' has no parent window$Parent given is not a parent of '%s'</pre><pre>%s on %s@GroupIndex cannot be less than a previous menu item's GroupIndex5Cannot create form. No MDI forms are currently active</pre><pre>Scan line index out of range!Cannot change the size of an iconÊnnot change the size of a WIC Image$Unknown picture file extension (.%s)</pre><pre>Unsupported clipboard format</pre><pre>''%s'' is not a valid date#''%s'' is not a valid date and time#''%s'' is not a valid integer value</pre><pre>''%s'' is not a valid time#No context-sensitive help installed</pre><pre>No help found for context %d</pre><pre>No help found for %s</pre><pre>Thread Error: %s (%d)-Cannot terminate an externally created thread,Cannot wait for an externally created thread2Cannot call Start on a running or suspended thread;Cannot call CheckTerminated on an externally created thread9Cannot call SetReturnValue on an externally create thread'Parameter %s cannot be a negative value*Input buffer exceeded for %s = %d, %s = %d</pre><pre>The specified path is too long The specified path was not found The path format is not supported The specified file was not found$No help viewer that supports filters2Length of Strings and Objects arrays must be equal</pre><pre>Invalid Timeout value: %s</pre><pre>List index out of bounds (%d) Out of memory while expanding memory stream)%s has not been registered as a COM class</pre><pre>Error reading %s%s%s: %s</pre><pre>Failed to create key %s</pre><pre>Failed to get data for '%s'</pre><pre>Failed to set data for '%s'</pre><pre>Resource %s not found</pre><pre>%s.Seek not implemented$Operation not allowed on sorted list$%s not in a class registration group</pre><pre>Property %s does not exist</pre><pre>Thread creation error: %s</pre><pre>A class named %s already exists%List does not allow duplicates ($0%x)#A component named %s already exists%String list does not allow duplicates</pre><pre>Cannot create file "%s". %s</pre><pre>Cannot open file "%s". %s</pre><pre>Unable to write to %s</pre><pre>Invalid file name - %s</pre><pre>Invalid stream format$''%s'' is not a valid component name</pre><pre>Invalid data type for '%s' List capacity out of bounds (%d)</pre><pre>List count out of bounds (%d)</pre><pre>Invalid destination array"Character index out of bounds (%d)</pre><pre>Start index out of bounds (%d)</pre><pre>Invalid count (%d)</pre><pre>Invalid destination index (%d)</pre><pre>Ancestor for '%s' not found</pre><pre>Cannot assign a %s to a %s</pre><pre>Bits index out of range*Can't write to a read-only resource streamECheckSynchronize called from thread $%x, which is NOT the main thread</pre><pre>Class %s not found</pre><pre>External exception %x</pre><pre>Interface not supported</pre><pre>Object lock not owned(Monitor support function not initialized</pre><pre>%s (%s, line %d)</pre><pre>Abstract Error?Access violation at address %p in module '%s'. %s of address %p</pre><pre>System Error. Code: %d.</pre><pre>Invalid variant operation</pre><pre>Invalid NULL variant operation%Invalid variant operation (%s%.8x)</pre><pre>%s,Custom variant type (%s%.4x) is out of range/Custom variant type (%s%.4x) already used by %s*Custom variant type (%s%.4x) is not usable2Too many custom variant types have been registered5Could not convert variant of type (%s) into type (%s)=Overflow while converting variant of type (%s) into type (%s)</pre><pre>Operation not supported</pre><pre>Invalid pointer operation</pre><pre>Invalid class typecast0Access violation at address %p. %s of address %p</pre><pre>Privileged instruction(Exception %s in module %s at %p.</pre><pre>Application Error1Format '%s' invalid or incompatible with argument</pre><pre>No argument for format '%s'"Variant method calls not supported</pre><pre>('%s' is not a valid floating point value '%d.%d' is not a valid timestamp</pre><pre>I/O error %d</pre><pre>Integer overflow Invalid floating point operation</pre><b>update.exe_2168:</b><pre>`.rsrc</pre><pre>ServerKeyloggerU</pre><pre>789:;<&'()* ,-./12345</pre><pre>%SERVER%</pre><pre>URLMON.DLL</pre><pre>shell32.dll</pre><pre>http://</pre><pre>advapi32.dll</pre><pre>kernel32.dll</pre><pre>mpr.dll</pre><pre>version.dll</pre><pre>comctl32.dll</pre><pre>gdi32.dll</pre><pre>opengl32.dll</pre><pre>user32.dll</pre><pre>wintrust.dll</pre><pre>msimg32.dll</pre><pre>KWindows</pre><pre>TServerKeylogger</pre><pre>GetWindowsDirectoryW</pre><pre>RegOpenKeyExW</pre><pre>RegCreateKeyW</pre><pre>RegCloseKey</pre><pre>RegOpenKeyExA</pre><pre>FindExecutableW</pre><pre>ShellExecuteW</pre><pre>SHDeleteKeyW</pre><pre>URLDownloadToCacheFileW</pre><pre>UnhookWindowsHookEx</pre><pre>SetWindowsHookExW</pre><pre>MapVirtualKeyW</pre><pre>GetKeyboardLayout</pre><pre>GetKeyState</pre><pre>GetKeyboardType</pre><pre>GetKeyboardState</pre><pre>FtpPutFileW</pre><pre>FtpSetCurrentDirectoryW</pre><pre>.idata</pre><pre>.rdata</pre><pre>P.reloc</pre><pre>P.rsrc</pre><pre>KERNEL32.DLL</pre><pre>ntdll.dll</pre><pre>oleaut32.dll</pre><pre>shlwapi.dll</pre><pre>wininet.dll</pre><pre>x.html</pre><pre>HKEY_CLASSES_ROOT</pre><pre>HKEY_CURRENT_USER</pre><pre>HKEY_LOCAL_MACHINE</pre><pre>HKEY_USERS</pre><pre>HKEY_CURRENT_CONFIG</pre><pre>[Execute]</pre><pre>KeyDelBackspace</pre><pre><meta http-equiv="Content-Type" content="text/html;charset=UTF-8" /></pre><pre>.html</pre><pre>XtremeKeylogger</pre><pre>Software\Microsoft\Windows\CurrentVersion\Run</pre><pre>.functions</pre><pre>icon=shell32.dll,4</pre><pre>shellexecute=</pre><pre>autorun.inf</pre><pre>\Microsoft\Windows\</pre><pre>ÞFAULTBROWSER%</pre><pre>svchost.exe</pre><pre>uyi7.adultdns.net</pre><pre>Chrome</pre><pre>%Chrome%</pre><pre>Chrome.exe</pre><pre>CChrome</pre><pre>ChromeEXIT</pre><pre>ChromePERSIST</pre><pre>ftp.ftpserver.com</pre><pre>ftpuser</pre><pre>%Documents and Settings%\%current user%\Local Settings\Temp\update.exe</pre><b>update.exe_2168_rwx_10000000_0004D000:</b><pre>`.rsrc</pre><pre>ServerKeyloggerU</pre><pre>789:;<&'()* ,-./12345</pre><pre>%SERVER%</pre><pre>URLMON.DLL</pre><pre>shell32.dll</pre><pre>http://</pre><pre>advapi32.dll</pre><pre>kernel32.dll</pre><pre>mpr.dll</pre><pre>version.dll</pre><pre>comctl32.dll</pre><pre>gdi32.dll</pre><pre>opengl32.dll</pre><pre>user32.dll</pre><pre>wintrust.dll</pre><pre>msimg32.dll</pre><pre>KWindows</pre><pre>TServerKeylogger</pre><pre>GetWindowsDirectoryW</pre><pre>RegOpenKeyExW</pre><pre>RegCreateKeyW</pre><pre>RegCloseKey</pre><pre>RegOpenKeyExA</pre><pre>FindExecutableW</pre><pre>ShellExecuteW</pre><pre>SHDeleteKeyW</pre><pre>URLDownloadToCacheFileW</pre><pre>UnhookWindowsHookEx</pre><pre>SetWindowsHookExW</pre><pre>MapVirtualKeyW</pre><pre>GetKeyboardLayout</pre><pre>GetKeyState</pre><pre>GetKeyboardType</pre><pre>GetKeyboardState</pre><pre>FtpPutFileW</pre><pre>FtpSetCurrentDirectoryW</pre><pre>.idata</pre><pre>.rdata</pre><pre>P.reloc</pre><pre>P.rsrc</pre><pre>KERNEL32.DLL</pre><pre>ntdll.dll</pre><pre>oleaut32.dll</pre><pre>shlwapi.dll</pre><pre>wininet.dll</pre><pre>x.html</pre><pre>HKEY_CLASSES_ROOT</pre><pre>HKEY_CURRENT_USER</pre><pre>HKEY_LOCAL_MACHINE</pre><pre>HKEY_USERS</pre><pre>HKEY_CURRENT_CONFIG</pre><pre>[Execute]</pre><pre>KeyDelBackspace</pre><pre><meta http-equiv="Content-Type" content="text/html;charset=UTF-8" /></pre><pre>.html</pre><pre>XtremeKeylogger</pre><pre>Software\Microsoft\Windows\CurrentVersion\Run</pre><pre>.functions</pre><pre>icon=shell32.dll,4</pre><pre>shellexecute=</pre><pre>autorun.inf</pre><pre>\Microsoft\Windows\</pre><pre>ÞFAULTBROWSER%</pre><pre>svchost.exe</pre><pre>uyi7.adultdns.net</pre><pre>Chrome</pre><pre>%Chrome%</pre><pre>Chrome.exe</pre><pre>CChrome</pre><pre>ChromeEXIT</pre><pre>ChromePERSIST</pre><pre>ftp.ftpserver.com</pre><pre>ftpuser</pre><pre>%Documents and Settings%\%current user%\Local Settings\Temp\update.exe</pre><b>svchost.exe_1540:</b><pre>.text</pre><pre>`.data</pre><pre>.rsrc</pre><pre>ADVAPI32.dll</pre><pre>KERNEL32.dll</pre><pre>NTDLL.DLL</pre><pre>RPCRT4.dll</pre><pre>NETAPI32.dll</pre><pre>ole32.dll</pre><pre>ntdll.dll</pre><pre>RegCloseKey</pre><pre>RegOpenKeyExW</pre><pre>GetProcessHeap</pre><pre>NtOpenKey</pre><pre>svchost.pdb</pre><pre>\PIPE\</pre><pre>Software\Microsoft\Windows NT\CurrentVersion\Svchost</pre><pre>\Registry\Machine\System\CurrentControlSet\Control\SecurePipeServers\</pre><pre>5.1.2600.5512 (xpsp.080413-2111)</pre><pre>svchost.exe</pre><pre>Windows</pre><pre>Operating System</pre><pre>5.1.2600.5512</pre><b>svchost.exe_1540_rwx_10000000_0004D000:</b><pre>`.rsrc</pre><pre>ServerKeyloggerU</pre><pre>789:;<&'()* ,-./12345</pre><pre>%SERVER%</pre><pre>URLMON.DLL</pre><pre>shell32.dll</pre><pre>http://</pre><pre>advapi32.dll</pre><pre>kernel32.dll</pre><pre>mpr.dll</pre><pre>version.dll</pre><pre>comctl32.dll</pre><pre>gdi32.dll</pre><pre>opengl32.dll</pre><pre>user32.dll</pre><pre>wintrust.dll</pre><pre>msimg32.dll</pre><pre>KWindows</pre><pre>TServerKeylogger</pre><pre>GetWindowsDirectoryW</pre><pre>RegOpenKeyExW</pre><pre>RegCreateKeyW</pre><pre>RegCloseKey</pre><pre>RegOpenKeyExA</pre><pre>FindExecutableW</pre><pre>ShellExecuteW</pre><pre>SHDeleteKeyW</pre><pre>URLDownloadToCacheFileW</pre><pre>UnhookWindowsHookEx</pre><pre>SetWindowsHookExW</pre><pre>MapVirtualKeyW</pre><pre>GetKeyboardLayout</pre><pre>GetKeyState</pre><pre>GetKeyboardType</pre><pre>GetKeyboardState</pre><pre>FtpPutFileW</pre><pre>FtpSetCurrentDirectoryW</pre><pre>.idata</pre><pre>.rdata</pre><pre>P.reloc</pre><pre>P.rsrc</pre><pre>KERNEL32.DLL</pre><pre>ntdll.dll</pre><pre>oleaut32.dll</pre><pre>shlwapi.dll</pre><pre>wininet.dll</pre><pre>x.html</pre><pre>HKEY_CLASSES_ROOT</pre><pre>HKEY_CURRENT_USER</pre><pre>HKEY_LOCAL_MACHINE</pre><pre>HKEY_USERS</pre><pre>HKEY_CURRENT_CONFIG</pre><pre>[Execute]</pre><pre>KeyDelBackspace</pre><pre><meta http-equiv="Content-Type" content="text/html;charset=UTF-8" /></pre><pre>.html</pre><pre>XtremeKeylogger</pre><pre>Software\Microsoft\Windows\CurrentVersion\Run</pre><pre>.functions</pre><pre>icon=shell32.dll,4</pre><pre>shellexecute=</pre><pre>autorun.inf</pre><pre>\Microsoft\Windows\</pre><pre>ÞFAULTBROWSER%</pre><pre>svchost.exe</pre><pre>uyi7.adultdns.net</pre><pre>Chrome</pre><pre>%Chrome%</pre><pre>Chrome.exe</pre><pre>CChrome</pre><pre>ChromeEXIT</pre><pre>ChromePERSIST</pre><pre>ftp.ftpserver.com</pre><pre>ftpuser</pre></requestedExecutionLevel>