Worm.Win32.Ainslot_VariantOfZeus_ebcfd0480d – Adaware

Dynamic Analysis

Payload

Behaviour	Description
WormAutorun	A worm can spread via removable drives. It writes its executable and creates "autorun.inf" scripts on all removable drives. The autorun script will execute the Worm's file once a user opens a drive's folder in Windows Explorer.

Process activity

The Worm creates the following process(es):

PDFill.exe:1368
%original file name%.exe:844
MsiExec.exe:1956
vkZtkbozih.exe:1104

The Worm injects its code into the following process(es):

vbc.exe:1056

Mutexes

The following mutexes were created/opened:No objects were found.

File activity

The process PDFill.exe:1368 makes changes in the file system.

The Worm creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Application Data\PlotSoft LLC\PDFill PDF Editor with FREE Writer and FREE Tools\install\2EF6902\PDFWriter\PDFillPDFButton_Excel.dll (79 bytes)
%Documents and Settings%\%current user%\Application Data\PlotSoft LLC\PDFill PDF Editor with FREE Writer and FREE Tools\install\2EF6902\WriterSave.exe (1795 bytes)
%Documents and Settings%\%current user%\Application Data\PlotSoft LLC\PDFill PDF Editor with FREE Writer and FREE Tools\install\2EF6902\DownloadandInstall.exe (79 bytes)
%Documents and Settings%\%current user%\Application Data\PlotSoft LLC\PDFill PDF Editor with FREE Writer and FREE Tools\install\2EF6902\PDFWriter\PDFillPDFButton_Word.dll (79 bytes)
%Documents and Settings%\%current user%\Application Data\PlotSoft LLC\PDFill PDF Editor with FREE Writer and FREE Tools\install\2EF6902\PDFWriter\Driver\PDFILLPSCRIPT.HLP (26 bytes)
%Documents and Settings%\%current user%\Application Data\PlotSoft LLC\PDFill PDF Editor with FREE Writer and FREE Tools\install\2EF6902\PDFWriter\Driver\64\PDFILLPSCRIPT.NTF (5442 bytes)
%Documents and Settings%\%current user%\Application Data\PlotSoft LLC\PDFill PDF Editor with FREE Writer and FREE Tools\install\2EF6902\PDFWriter\Driver\PDFILLPSCRIPT5.DLL (1824 bytes)
%Documents and Settings%\%current user%\Application Data\PlotSoft LLC\PDFill PDF Editor with FREE Writer and FREE Tools\install\2EF6902\SpellChecker\ssceam.tlx (7 bytes)
%Documents and Settings%\%current user%\Application Data\PlotSoft LLC\PDFill PDF Editor with FREE Writer and FREE Tools\install\2EF6902\SpellChecker\wspell.ocx (180 bytes)
%Documents and Settings%\%current user%\Application Data\PlotSoft LLC\PDFill PDF Editor with FREE Writer and FREE Tools\install\2EF6902\SpellChecker\Wspelldlg.GID (8 bytes)
%Documents and Settings%\%current user%\Application Data\PlotSoft LLC\PDFill PDF Editor with FREE Writer and FREE Tools\install\2EF6902\SpellChecker\correct.tlx (21 bytes)
%Documents and Settings%\%current user%\Application Data\PlotSoft LLC\PDFill PDF Editor with FREE Writer and FREE Tools\install\2EF6902\PDFill.ico (3 bytes)
%Documents and Settings%\%current user%\Application Data\PlotSoft LLC\PDFill PDF Editor with FREE Writer and FREE Tools\install\2EF6902\PDFWriter\Driver\64\PDFILLPSCRIPT.HLP (26 bytes)
%Documents and Settings%\%current user%\Application Data\PlotSoft LLC\PDFill PDF Editor with FREE Writer and FREE Tools\install\2EF6902\WriterSave.chm (64 bytes)
%Documents and Settings%\%current user%\Application Data\PlotSoft LLC\PDFill PDF Editor with FREE Writer and FREE Tools\install\2EF6902\SpellChecker\userdic.tlx (89 bytes)
%Documents and Settings%\%current user%\Application Data\PlotSoft LLC\PDFill PDF Editor with FREE Writer and FREE Tools\install\2EF6902\PDFWriter\Driver\PDFILLPS5UI.DLL (3801 bytes)
%Documents and Settings%\%current user%\Application Data\PlotSoft LLC\PDFill PDF Editor with FREE Writer and FREE Tools\install\2EF6902\SpellChecker\ssceam2.clx (327 bytes)
%Documents and Settings%\%current user%\Application Data\PlotSoft LLC\PDFill PDF Editor with FREE Writer and FREE Tools\install\decoder.dll (1738 bytes)
%Documents and Settings%\%current user%\Application Data\PlotSoft LLC\PDFill PDF Editor with FREE Writer and FREE Tools\install\2EF6902\PDFWriter\PDFillWriterMon32.dll (26 bytes)
%Documents and Settings%\%current user%\Application Data\PlotSoft LLC\PDFill PDF Editor with FREE Writer and FREE Tools\install\2EF6902\PDFill_PDF_Tools.exe (24 bytes)
%Documents and Settings%\%current user%\Application Data\PlotSoft LLC\PDFill PDF Editor with FREE Writer and FREE Tools\install\2EF6902\PDFWriter\Driver\64\PDFILLPSCRIPT5.DLL (3701 bytes)
%Documents and Settings%\%current user%\Application Data\PlotSoft LLC\PDFill PDF Editor with FREE Writer and FREE Tools\install\2EF6902\PDFWriter\Driver\64\PDFILLPS5UI.DLL (3923 bytes)
%Documents and Settings%\%current user%\Application Data\PlotSoft LLC\PDFill PDF Editor with FREE Writer and FREE Tools\install\2EF6902\PDFWriter\PDFillWriterMon64.dll (30 bytes)
%Documents and Settings%\%current user%\Application Data\PlotSoft LLC\PDFill PDF Editor with FREE Writer and FREE Tools\install\2EF6902\PDFWriter\Driver\PSCRIPT5.jar (25429 bytes)
%Documents and Settings%\%current user%\Application Data\PlotSoft LLC\PDFill PDF Editor with FREE Writer and FREE Tools\install\2EF6902\SpellChecker\sscebr.tlx (7 bytes)
%Documents and Settings%\%current user%\Application Data\PlotSoft LLC\PDFill PDF Editor with FREE Writer and FREE Tools\install\2EF6902\PDFWriter\Driver\PDFILLPSCRIPT.NTF (5442 bytes)
%Documents and Settings%\%current user%\Application Data\PlotSoft LLC\PDFill PDF Editor with FREE Writer and FREE Tools\install\2EF6902\cimage.dll (3851 bytes)
%Documents and Settings%\%current user%\Application Data\PlotSoft LLC\PDFill PDF Editor with FREE Writer and FREE Tools\install\2EF6902\PDFill.x64.msi (6 bytes)
%Documents and Settings%\%current user%\Application Data\PlotSoft LLC\PDFill PDF Editor with FREE Writer and FREE Tools\install\2EF6902\PDFill.mst (290 bytes)
%Documents and Settings%\%current user%\Application Data\PlotSoft LLC\PDFill PDF Editor with FREE Writer and FREE Tools\install\2EF6902\SpellChecker\ssceca.tlx (7 bytes)
%Documents and Settings%\%current user%\Application Data\PlotSoft LLC\PDFill PDF Editor with FREE Writer and FREE Tools\install\2EF6902\PDFill_license.rtf (10 bytes)
%Documents and Settings%\%current user%\Application Data\PlotSoft LLC\PDFill PDF Editor with FREE Writer and FREE Tools\install\2EF6902\PDFWriter\PDFWrite.rsp (133 bytes)
%Documents and Settings%\%current user%\Application Data\PlotSoft LLC\PDFill PDF Editor with FREE Writer and FREE Tools\install\2EF6902\PDFill.exe (7972 bytes)
%Documents and Settings%\%current user%\Application Data\PlotSoft LLC\PDFill PDF Editor with FREE Writer and FREE Tools\install\2EF6902\PDFill.msi (6 bytes)
%Documents and Settings%\%current user%\Application Data\PlotSoft LLC\PDFill PDF Editor with FREE Writer and FREE Tools\install\2EF6902\DownloadPDF.exe (170 bytes)
%Documents and Settings%\%current user%\Application Data\PlotSoft LLC\PDFill PDF Editor with FREE Writer and FREE Tools\install\2EF6902\SpellChecker\accent.tlx (2 bytes)
%Documents and Settings%\%current user%\Application Data\PlotSoft LLC\PDFill PDF Editor with FREE Writer and FREE Tools\install\2EF6902\SystemFolder\mfc70u.dll (6405 bytes)
%Documents and Settings%\%current user%\Application Data\PlotSoft LLC\PDFill PDF Editor with FREE Writer and FREE Tools\install\2EF6902\PDFWriter\Driver\PDFillWriter.PPD (25 bytes)
%Documents and Settings%\%current user%\Application Data\PlotSoft LLC\PDFill PDF Editor with FREE Writer and FREE Tools\install\2EF6902\SystemFolder\msvcr70.dll (1625 bytes)
%Documents and Settings%\%current user%\Application Data\PlotSoft LLC\PDFill PDF Editor with FREE Writer and FREE Tools\install\2EF6902\SpellChecker\tech.tlx (3 bytes)
%Documents and Settings%\%current user%\Application Data\PlotSoft LLC\PDFill PDF Editor with FREE Writer and FREE Tools\install\2EF6902\PDFWriter\PDFillPDFButton_PowerPoint.dll (79 bytes)
%Documents and Settings%\%current user%\Application Data\PlotSoft LLC\PDFill PDF Editor with FREE Writer and FREE Tools\install\2EF6902\pdf2image.dll (22433 bytes)
%Documents and Settings%\%current user%\Application Data\PlotSoft LLC\PDFill PDF Editor with FREE Writer and FREE Tools\install\2EF6902\SpellChecker\ssceca2.clx (1609 bytes)
%Documents and Settings%\%current user%\Application Data\PlotSoft LLC\PDFill PDF Editor with FREE Writer and FREE Tools\install\2EF6902\PDFillZip.exe (75 bytes)
%Documents and Settings%\%current user%\Application Data\PlotSoft LLC\PDFill PDF Editor with FREE Writer and FREE Tools\install\2EF6902\SpellChecker\sscebr2.clx (1611 bytes)
%Documents and Settings%\%current user%\Application Data\PlotSoft LLC\PDFill PDF Editor with FREE Writer and FREE Tools\install\2EF6902\SystemFolder\DynamicTwainCtrl.dll (294 bytes)
%Documents and Settings%\%current user%\Application Data\PlotSoft LLC\PDFill PDF Editor with FREE Writer and FREE Tools\install\2EF6902\SpellChecker\Wspelldlg.hlp (18 bytes)
%Documents and Settings%\%current user%\Application Data\PlotSoft LLC\PDFill PDF Editor with FREE Writer and FREE Tools\install\2EF6902\CommandBars1300vc70U.dll (7972 bytes)
%Documents and Settings%\%current user%\Application Data\PlotSoft LLC\PDFill PDF Editor with FREE Writer and FREE Tools\install\2EF6902\PDFWriter\WriterSetup.exe (57 bytes)
%Documents and Settings%\%current user%\Application Data\PlotSoft LLC\PDFill PDF Editor with FREE Writer and FREE Tools\install\2EF6902\PDFill.chm (275 bytes)

The process %original file name%.exe:844 makes changes in the file system.

The Worm creates and/or writes to the following file(s):

%Documents and Settings%\All Users\Application Data\PlotSoft LLC\PDFill PDF Editor with FREE Writer and FREE Tools\8.0.0.0\vkZtkbozih.exe (96836 bytes)

The process vkZtkbozih.exe:1104 makes changes in the file system.

The Worm creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\PDFill.exe (70225 bytes)
%Documents and Settings%\%current user%\Application Data\HBTDZJTZVhyNVWfDxbdK\HBTDZJTZVhyNVWfDxbdK\0.0.0.0\vkZtkbozih.exe (98579 bytes)
%Documents and Settings%\All Users\Application Data\PlotSoft LLC\PDFill PDF Editor with FREE Writer and FREE Tools\8.0.0.0\cic.dll (16 bytes)
%Documents and Settings%\%current user%\Application Data\HBTDZJTZVhyNVWfDxbdK\HBTDZJTZVhyNVWfDxbdK\0.0.0.0\cic.dll (16 bytes)

The process vbc.exe:1056 makes changes in the file system.

The Worm creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Application Data\data.dat (37 bytes)
%Documents and Settings%\%current user%\Application Data\host.exe (3860 bytes)

Registry activity

The process PDFill.exe:1368 makes changes in the system registry.

The Worm creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "2E 1A 34 3C C8 C3 EE BF AC C4 6F 54 27 3D 2B 06"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

The process %original file name%.exe:844 makes changes in the system registry.

The Worm creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "C4 A4 E2 2C 61 87 F0 F8 23 43 79 ED EE FA B3 5B"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%Documents and Settings%\All Users\Application Data\PlotSoft LLC\PDFill PDF Editor with FREE Writer and FREE Tools\8.0.0.0]
"vkZtkbozih.exe" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

"Personal" = "%Documents and Settings%\%current user%\My Documents"

The Worm modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Worm modifies IE settings for security zones to map all urls to the Intranet Zone:

"IntranetName" = "1"

The Worm modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

The process MsiExec.exe:1956 makes changes in the system registry.

The Worm creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "72 96 BE 25 DF 01 C3 9B FD B2 A8 17 D1 EE 51 42"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

The process vkZtkbozih.exe:1104 makes changes in the system registry.

The Worm creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "95 02 22 77 D7 7B CF 54 57 21 F3 62 43 22 F8 0F"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%Documents and Settings%\%current user%\Local Settings\Temp]
"PDFill.exe" = "Create, Edit, Save PDF; Edit PDF file without Adobe Acrobat"

To automatically run itself each time Windows is booted, the Worm adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"vkZtkbozih.exe" = "%Documents and Settings%\%current user%\Application Data\HBTDZJTZVhyNVWfDxbdK\HBTDZJTZVhyNVWfDxbdK\0.0.0.0\vkZtkbozih.exe"

The Worm modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Worm modifies IE settings for security zones to map all urls to the Intranet Zone:

"IntranetName" = "1"

The Worm modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

The process vbc.exe:1056 makes changes in the system registry.

The Worm creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "9F 43 F2 67 83 8D CC C0 DF C3 C3 3D 20 92 7B D6"

[HKCU\Software\VB and VBA Program Settings\INSTALL\DATE]
"Q5VSR2B9A4" = "June 28, 2014"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\VB and VBA Program Settings\SrvID\ID]
"Q5VSR2B9A4" = "1/20/11-1:27-angel"

Dropped PE files

MD5	File path
b8aea40ac6ed543c26889d74806e6341	c:\Documents and Settings\All Users\Application Data\PlotSoft LLC\PDFill PDF Editor with FREE Writer and FREE Tools\8.0.0.0\cic.dll
18c413862151141134cd74e9acee59c2	c:\Documents and Settings\All Users\Application Data\PlotSoft LLC\PDFill PDF Editor with FREE Writer and FREE Tools\8.0.0.0\vkZtkbozih.exe
b8aea40ac6ed543c26889d74806e6341	c:\Documents and Settings\"%CurrentUserName%"\Application Data\HBTDZJTZVhyNVWfDxbdK\HBTDZJTZVhyNVWfDxbdK\0.0.0.0\cic.dll
18c413862151141134cd74e9acee59c2	c:\Documents and Settings\"%CurrentUserName%"\Application Data\HBTDZJTZVhyNVWfDxbdK\HBTDZJTZVhyNVWfDxbdK\0.0.0.0\vkZtkbozih.exe
c917de5f7930ca038a8802220ef7364e	c:\Documents and Settings\"%CurrentUserName%"\Application Data\PlotSoft LLC\PDFill PDF Editor with FREE Writer and FREE Tools\install\2EF6902\CommandBars1300vc70U.dll
e36700e16aeb32828fab48c4282d8dae	c:\Documents and Settings\"%CurrentUserName%"\Application Data\PlotSoft LLC\PDFill PDF Editor with FREE Writer and FREE Tools\install\2EF6902\DownloadPDF.exe
5aeee73aa9c75860395e3fcf41773f85	c:\Documents and Settings\"%CurrentUserName%"\Application Data\PlotSoft LLC\PDFill PDF Editor with FREE Writer and FREE Tools\install\2EF6902\DownloadandInstall.exe
1ede62e047f4bb3d0398eba367c16484	c:\Documents and Settings\"%CurrentUserName%"\Application Data\PlotSoft LLC\PDFill PDF Editor with FREE Writer and FREE Tools\install\2EF6902\PDFWriter\Driver\64\PDFILLPS5UI.DLL
fb270d281f4929b9e0894afc816c9dbe	c:\Documents and Settings\"%CurrentUserName%"\Application Data\PlotSoft LLC\PDFill PDF Editor with FREE Writer and FREE Tools\install\2EF6902\PDFWriter\Driver\64\PDFILLPSCRIPT5.DLL
a8c4d265f14c4f977c399d51971041b6	c:\Documents and Settings\"%CurrentUserName%"\Application Data\PlotSoft LLC\PDFill PDF Editor with FREE Writer and FREE Tools\install\2EF6902\PDFWriter\Driver\PDFILLPS5UI.DLL
28e60cef92843c1ea5c221ddc308b766	c:\Documents and Settings\"%CurrentUserName%"\Application Data\PlotSoft LLC\PDFill PDF Editor with FREE Writer and FREE Tools\install\2EF6902\PDFWriter\Driver\PDFILLPSCRIPT5.DLL
c96a681f95aa743559bcac59f77cb5cd	c:\Documents and Settings\"%CurrentUserName%"\Application Data\PlotSoft LLC\PDFill PDF Editor with FREE Writer and FREE Tools\install\2EF6902\PDFWriter\PDFillPDFButton_Excel.dll
4cdffa0a4fcde5feb26d885a0649ddca	c:\Documents and Settings\"%CurrentUserName%"\Application Data\PlotSoft LLC\PDFill PDF Editor with FREE Writer and FREE Tools\install\2EF6902\PDFWriter\PDFillPDFButton_PowerPoint.dll
4abf064fc380b8a07f700c1df9fa00c6	c:\Documents and Settings\"%CurrentUserName%"\Application Data\PlotSoft LLC\PDFill PDF Editor with FREE Writer and FREE Tools\install\2EF6902\PDFWriter\PDFillPDFButton_Word.dll
6d64131c22edd8b39702725b4f4edae8	c:\Documents and Settings\"%CurrentUserName%"\Application Data\PlotSoft LLC\PDFill PDF Editor with FREE Writer and FREE Tools\install\2EF6902\PDFWriter\PDFillWriterMon32.dll
fd70b3cc5a9cd321edfc632917573703	c:\Documents and Settings\"%CurrentUserName%"\Application Data\PlotSoft LLC\PDFill PDF Editor with FREE Writer and FREE Tools\install\2EF6902\PDFWriter\PDFillWriterMon64.dll
3513cad065740a3026df62d01c907a6b	c:\Documents and Settings\"%CurrentUserName%"\Application Data\PlotSoft LLC\PDFill PDF Editor with FREE Writer and FREE Tools\install\2EF6902\PDFWriter\WriterSetup.exe
2ac8b80e04adbc55f1b05dcad42b1e89	c:\Documents and Settings\"%CurrentUserName%"\Application Data\PlotSoft LLC\PDFill PDF Editor with FREE Writer and FREE Tools\install\2EF6902\PDFill.exe
61bc45f660e690b01c36086ed8b9143e	c:\Documents and Settings\"%CurrentUserName%"\Application Data\PlotSoft LLC\PDFill PDF Editor with FREE Writer and FREE Tools\install\2EF6902\PDFillZip.exe
fee77eabe99b9ab64f4db7b77550007c	c:\Documents and Settings\"%CurrentUserName%"\Application Data\PlotSoft LLC\PDFill PDF Editor with FREE Writer and FREE Tools\install\2EF6902\PDFill_PDF_Tools.exe
b324f5ff2351b825b688422a1c22269f	c:\Documents and Settings\"%CurrentUserName%"\Application Data\PlotSoft LLC\PDFill PDF Editor with FREE Writer and FREE Tools\install\2EF6902\SpellChecker\wspell.ocx
aa62fdcb1e9a743ce6ccd7547752ed65	c:\Documents and Settings\"%CurrentUserName%"\Application Data\PlotSoft LLC\PDFill PDF Editor with FREE Writer and FREE Tools\install\2EF6902\SystemFolder\DynamicTwainCtrl.dll
c39dec838a5628de50d477e40359b5b7	c:\Documents and Settings\"%CurrentUserName%"\Application Data\PlotSoft LLC\PDFill PDF Editor with FREE Writer and FREE Tools\install\2EF6902\SystemFolder\mfc70u.dll
9972a6ed4f2388dbfa8e0a96f6f3fdf1	c:\Documents and Settings\"%CurrentUserName%"\Application Data\PlotSoft LLC\PDFill PDF Editor with FREE Writer and FREE Tools\install\2EF6902\SystemFolder\msvcr70.dll
9dd45fffc6b0c913ec3b5421a7ee0915	c:\Documents and Settings\"%CurrentUserName%"\Application Data\PlotSoft LLC\PDFill PDF Editor with FREE Writer and FREE Tools\install\2EF6902\WriterSave.exe
542a29caacd37105da8c177c0db1db84	c:\Documents and Settings\"%CurrentUserName%"\Application Data\PlotSoft LLC\PDFill PDF Editor with FREE Writer and FREE Tools\install\2EF6902\cimage.dll
4d506d149e0a0208f37dab531a76cdc2	c:\Documents and Settings\"%CurrentUserName%"\Application Data\PlotSoft LLC\PDFill PDF Editor with FREE Writer and FREE Tools\install\2EF6902\pdf2image.dll
68de94827d5ab59ec14d1c44771e35dd	c:\Documents and Settings\"%CurrentUserName%"\Application Data\PlotSoft LLC\PDFill PDF Editor with FREE Writer and FREE Tools\install\decoder.dll
67f5238229333c061092f5a32e8c2ee1	c:\Documents and Settings\"%CurrentUserName%"\Application Data\host.exe
b9b975bdbe32ca27b2b59e584040669e	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\PDFill.exe

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

A worm can spread via removable drives. It writes its executable and creates "autorun.inf" scripts on all removable drives. The autorun script will execute the Worm's file once a user opens a drive's folder in Windows Explorer.

Removals

Remove it with Ad-Aware

Click (here) to download and install Ad-Aware Free Antivirus.
Update the definition files.
Run a full scan of your computer.

Manual removal*

Terminate malicious process(es) (How to End a Process With the Task Manager):
PDFill.exe:1368
%original file name%.exe:844
MsiExec.exe:1956
vkZtkbozih.exe:1104
Delete the original Worm file.
Delete or disinfect the following files created/modified by the Worm:
%Documents and Settings%\%current user%\Application Data\PlotSoft LLC\PDFill PDF Editor with FREE Writer and FREE Tools\install\2EF6902\PDFWriter\PDFillPDFButton_Excel.dll (79 bytes)
%Documents and Settings%\%current user%\Application Data\PlotSoft LLC\PDFill PDF Editor with FREE Writer and FREE Tools\install\2EF6902\WriterSave.exe (1795 bytes)
%Documents and Settings%\%current user%\Application Data\PlotSoft LLC\PDFill PDF Editor with FREE Writer and FREE Tools\install\2EF6902\DownloadandInstall.exe (79 bytes)
%Documents and Settings%\%current user%\Application Data\PlotSoft LLC\PDFill PDF Editor with FREE Writer and FREE Tools\install\2EF6902\PDFWriter\PDFillPDFButton_Word.dll (79 bytes)
%Documents and Settings%\%current user%\Application Data\PlotSoft LLC\PDFill PDF Editor with FREE Writer and FREE Tools\install\2EF6902\PDFWriter\Driver\PDFILLPSCRIPT.HLP (26 bytes)
%Documents and Settings%\%current user%\Application Data\PlotSoft LLC\PDFill PDF Editor with FREE Writer and FREE Tools\install\2EF6902\PDFWriter\Driver\64\PDFILLPSCRIPT.NTF (5442 bytes)
%Documents and Settings%\%current user%\Application Data\PlotSoft LLC\PDFill PDF Editor with FREE Writer and FREE Tools\install\2EF6902\PDFWriter\Driver\PDFILLPSCRIPT5.DLL (1824 bytes)
%Documents and Settings%\%current user%\Application Data\PlotSoft LLC\PDFill PDF Editor with FREE Writer and FREE Tools\install\2EF6902\SpellChecker\ssceam.tlx (7 bytes)
%Documents and Settings%\%current user%\Application Data\PlotSoft LLC\PDFill PDF Editor with FREE Writer and FREE Tools\install\2EF6902\SpellChecker\wspell.ocx (180 bytes)
%Documents and Settings%\%current user%\Application Data\PlotSoft LLC\PDFill PDF Editor with FREE Writer and FREE Tools\install\2EF6902\SpellChecker\Wspelldlg.GID (8 bytes)
%Documents and Settings%\%current user%\Application Data\PlotSoft LLC\PDFill PDF Editor with FREE Writer and FREE Tools\install\2EF6902\SpellChecker\correct.tlx (21 bytes)
%Documents and Settings%\%current user%\Application Data\PlotSoft LLC\PDFill PDF Editor with FREE Writer and FREE Tools\install\2EF6902\PDFill.ico (3 bytes)
%Documents and Settings%\%current user%\Application Data\PlotSoft LLC\PDFill PDF Editor with FREE Writer and FREE Tools\install\2EF6902\PDFWriter\Driver\64\PDFILLPSCRIPT.HLP (26 bytes)
%Documents and Settings%\%current user%\Application Data\PlotSoft LLC\PDFill PDF Editor with FREE Writer and FREE Tools\install\2EF6902\WriterSave.chm (64 bytes)
%Documents and Settings%\%current user%\Application Data\PlotSoft LLC\PDFill PDF Editor with FREE Writer and FREE Tools\install\2EF6902\SpellChecker\userdic.tlx (89 bytes)
%Documents and Settings%\%current user%\Application Data\PlotSoft LLC\PDFill PDF Editor with FREE Writer and FREE Tools\install\2EF6902\PDFWriter\Driver\PDFILLPS5UI.DLL (3801 bytes)
%Documents and Settings%\%current user%\Application Data\PlotSoft LLC\PDFill PDF Editor with FREE Writer and FREE Tools\install\2EF6902\SpellChecker\ssceam2.clx (327 bytes)
%Documents and Settings%\%current user%\Application Data\PlotSoft LLC\PDFill PDF Editor with FREE Writer and FREE Tools\install\decoder.dll (1738 bytes)
%Documents and Settings%\%current user%\Application Data\PlotSoft LLC\PDFill PDF Editor with FREE Writer and FREE Tools\install\2EF6902\PDFWriter\PDFillWriterMon32.dll (26 bytes)
%Documents and Settings%\%current user%\Application Data\PlotSoft LLC\PDFill PDF Editor with FREE Writer and FREE Tools\install\2EF6902\PDFill_PDF_Tools.exe (24 bytes)
%Documents and Settings%\%current user%\Application Data\PlotSoft LLC\PDFill PDF Editor with FREE Writer and FREE Tools\install\2EF6902\PDFWriter\Driver\64\PDFILLPSCRIPT5.DLL (3701 bytes)
%Documents and Settings%\%current user%\Application Data\PlotSoft LLC\PDFill PDF Editor with FREE Writer and FREE Tools\install\2EF6902\PDFWriter\Driver\64\PDFILLPS5UI.DLL (3923 bytes)
%Documents and Settings%\%current user%\Application Data\PlotSoft LLC\PDFill PDF Editor with FREE Writer and FREE Tools\install\2EF6902\PDFWriter\PDFillWriterMon64.dll (30 bytes)
%Documents and Settings%\%current user%\Application Data\PlotSoft LLC\PDFill PDF Editor with FREE Writer and FREE Tools\install\2EF6902\PDFWriter\Driver\PSCRIPT5.jar (25429 bytes)
%Documents and Settings%\%current user%\Application Data\PlotSoft LLC\PDFill PDF Editor with FREE Writer and FREE Tools\install\2EF6902\SpellChecker\sscebr.tlx (7 bytes)
%Documents and Settings%\%current user%\Application Data\PlotSoft LLC\PDFill PDF Editor with FREE Writer and FREE Tools\install\2EF6902\PDFWriter\Driver\PDFILLPSCRIPT.NTF (5442 bytes)
%Documents and Settings%\%current user%\Application Data\PlotSoft LLC\PDFill PDF Editor with FREE Writer and FREE Tools\install\2EF6902\cimage.dll (3851 bytes)
%Documents and Settings%\%current user%\Application Data\PlotSoft LLC\PDFill PDF Editor with FREE Writer and FREE Tools\install\2EF6902\PDFill.x64.msi (6 bytes)
%Documents and Settings%\%current user%\Application Data\PlotSoft LLC\PDFill PDF Editor with FREE Writer and FREE Tools\install\2EF6902\PDFill.mst (290 bytes)
%Documents and Settings%\%current user%\Application Data\PlotSoft LLC\PDFill PDF Editor with FREE Writer and FREE Tools\install\2EF6902\SpellChecker\ssceca.tlx (7 bytes)
%Documents and Settings%\%current user%\Application Data\PlotSoft LLC\PDFill PDF Editor with FREE Writer and FREE Tools\install\2EF6902\PDFill_license.rtf (10 bytes)
%Documents and Settings%\%current user%\Application Data\PlotSoft LLC\PDFill PDF Editor with FREE Writer and FREE Tools\install\2EF6902\PDFWriter\PDFWrite.rsp (133 bytes)
%Documents and Settings%\%current user%\Application Data\PlotSoft LLC\PDFill PDF Editor with FREE Writer and FREE Tools\install\2EF6902\PDFill.exe (7972 bytes)
%Documents and Settings%\%current user%\Application Data\PlotSoft LLC\PDFill PDF Editor with FREE Writer and FREE Tools\install\2EF6902\PDFill.msi (6 bytes)
%Documents and Settings%\%current user%\Application Data\PlotSoft LLC\PDFill PDF Editor with FREE Writer and FREE Tools\install\2EF6902\DownloadPDF.exe (170 bytes)
%Documents and Settings%\%current user%\Application Data\PlotSoft LLC\PDFill PDF Editor with FREE Writer and FREE Tools\install\2EF6902\SpellChecker\accent.tlx (2 bytes)
%Documents and Settings%\%current user%\Application Data\PlotSoft LLC\PDFill PDF Editor with FREE Writer and FREE Tools\install\2EF6902\SystemFolder\mfc70u.dll (6405 bytes)
%Documents and Settings%\%current user%\Application Data\PlotSoft LLC\PDFill PDF Editor with FREE Writer and FREE Tools\install\2EF6902\PDFWriter\Driver\PDFillWriter.PPD (25 bytes)
%Documents and Settings%\%current user%\Application Data\PlotSoft LLC\PDFill PDF Editor with FREE Writer and FREE Tools\install\2EF6902\SystemFolder\msvcr70.dll (1625 bytes)
%Documents and Settings%\%current user%\Application Data\PlotSoft LLC\PDFill PDF Editor with FREE Writer and FREE Tools\install\2EF6902\SpellChecker\tech.tlx (3 bytes)
%Documents and Settings%\%current user%\Application Data\PlotSoft LLC\PDFill PDF Editor with FREE Writer and FREE Tools\install\2EF6902\PDFWriter\PDFillPDFButton_PowerPoint.dll (79 bytes)
%Documents and Settings%\%current user%\Application Data\PlotSoft LLC\PDFill PDF Editor with FREE Writer and FREE Tools\install\2EF6902\pdf2image.dll (22433 bytes)
%Documents and Settings%\%current user%\Application Data\PlotSoft LLC\PDFill PDF Editor with FREE Writer and FREE Tools\install\2EF6902\SpellChecker\ssceca2.clx (1609 bytes)
%Documents and Settings%\%current user%\Application Data\PlotSoft LLC\PDFill PDF Editor with FREE Writer and FREE Tools\install\2EF6902\PDFillZip.exe (75 bytes)
%Documents and Settings%\%current user%\Application Data\PlotSoft LLC\PDFill PDF Editor with FREE Writer and FREE Tools\install\2EF6902\SpellChecker\sscebr2.clx (1611 bytes)
%Documents and Settings%\%current user%\Application Data\PlotSoft LLC\PDFill PDF Editor with FREE Writer and FREE Tools\install\2EF6902\SystemFolder\DynamicTwainCtrl.dll (294 bytes)
%Documents and Settings%\%current user%\Application Data\PlotSoft LLC\PDFill PDF Editor with FREE Writer and FREE Tools\install\2EF6902\SpellChecker\Wspelldlg.hlp (18 bytes)
%Documents and Settings%\%current user%\Application Data\PlotSoft LLC\PDFill PDF Editor with FREE Writer and FREE Tools\install\2EF6902\CommandBars1300vc70U.dll (7972 bytes)
%Documents and Settings%\%current user%\Application Data\PlotSoft LLC\PDFill PDF Editor with FREE Writer and FREE Tools\install\2EF6902\PDFWriter\WriterSetup.exe (57 bytes)
%Documents and Settings%\%current user%\Application Data\PlotSoft LLC\PDFill PDF Editor with FREE Writer and FREE Tools\install\2EF6902\PDFill.chm (275 bytes)
%Documents and Settings%\All Users\Application Data\PlotSoft LLC\PDFill PDF Editor with FREE Writer and FREE Tools\8.0.0.0\vkZtkbozih.exe (96836 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\PDFill.exe (70225 bytes)
%Documents and Settings%\%current user%\Application Data\HBTDZJTZVhyNVWfDxbdK\HBTDZJTZVhyNVWfDxbdK\0.0.0.0\vkZtkbozih.exe (98579 bytes)
%Documents and Settings%\All Users\Application Data\PlotSoft LLC\PDFill PDF Editor with FREE Writer and FREE Tools\8.0.0.0\cic.dll (16 bytes)
%Documents and Settings%\%current user%\Application Data\HBTDZJTZVhyNVWfDxbdK\HBTDZJTZVhyNVWfDxbdK\0.0.0.0\cic.dll (16 bytes)
%Documents and Settings%\%current user%\Application Data\data.dat (37 bytes)
%Documents and Settings%\%current user%\Application Data\host.exe (3860 bytes)
Delete the following value(s) in the autorun key (How to Work with System Registry):
[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"vkZtkbozih.exe" = "%Documents and Settings%\%current user%\Application Data\HBTDZJTZVhyNVWfDxbdK\HBTDZJTZVhyNVWfDxbdK\0.0.0.0\vkZtkbozih.exe"
Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
Find and delete all copies of the worm's file together with "autorun.inf" scripts on removable drives.
Reboot the computer.

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

VersionInfo

Company Name: PlotSoft LLC
Product Name: PDFill PDF Editor with FREE Writer and FREE Tools
Product Version: 8.0.0.0
Legal Copyright: Copyright (C) PlotSoft LLC
Legal Trademarks:
Original Filename: PDFill.exe
Internal Name: PDFill.exe
File Version: 8.0.0.0
File Description: PDFill.exe
Comments: Create, Edit, Save PDF; Edit PDF file without Adobe Acrobat
Language: English (United Kingdom)

Company Name: PlotSoft LLCProduct Name: PDFill PDF Editor with FREE Writer and FREE ToolsProduct Version: 8.0.0.0Legal Copyright: Copyright (C) PlotSoft LLCLegal Trademarks: Original Filename: PDFill.exeInternal Name: PDFill.exeFile Version: 8.0.0.0File Description: PDFill.exeComments: Create, Edit, Save PDF; Edit PDF file without Adobe AcrobatLanguage: English (United Kingdom)

PE Sections

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Section MD5
.text	8192	17308564	17309696	4.16104	b0696c79d59b7b9af9d0aa2a23e291d2
.rsrc	17317888	68872	69632	3.45505	19bc28a29ff596f2135581d4cc2f41cd
.reloc	17391616	12	4096	0.013648	c8ff6d3d1bd4c0b2581f22f1674561ec

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Network Activity

URLs

URL	IP
hxxp://crl.usertrust.com/UTN-USERFirst-Object.crl	178.255.83.2

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

GET /UTN-USERFirst-Object.crl HTTP/1.1

Accept: */*

User-Agent: Microsoft-CryptoAPI/5.131.2600.5512

Host: crl.usertrust.com

Connection: Keep-Alive

Cache-Control: no-cache

Pragma: no-cache

HTTP/1.1 200 OK

Server: nginx

Date: Sat, 28 Jun 2014 05:57:31 GMT

Content-Type: application/x-pkcs7-crl

Content-Length: 75433

Last-Modified: Fri, 27 Jun 2014 16:46:01 GMT

Connection: close

X-CCACDN-Mirror-ID: t8edcacrl4

Accept-Ranges: bytes

0..&.0..%....0...*.H........0..1.0...U....US1.0...U....UT1.0...U....Salt Lake City1.0...U....The USERTRUST Network1!0...U....hXXp://VVV.usertrust.com1.0...U....UTN-USERFirst-Object..140627164601Z..140701164601Z0..$.0"....2EY..aU..........050525083740Z0".....Iv...h ..ys.....050525090148Z0!..u.......|..xk.0...050602000000Z0".....6.z..........7..050602075356Z0"....!.$.KM(C@="..o}..050603153950Z0".......W%Ny.vD.q..Y..050607084159Z0".......3W]...$.#\F4..050613095931Z0!......(.62..2PLr.q..050630164737Z0"....BLA......)..5....050707141212Z0!..Wa........q#......050711082844Z0!.._j.....o...'...m..050715130339Z0!..?........N]B..Z...050721083234Z0!..RO.)@..Q...p._....050726090436Z0".....k......1.g......050729091017Z0"....l........o... ...050729134103Z0"....v.R..~...?.(..&..050803165854Z0!..6..;....sC.M.s:...050809135135Z0!...........^nH.U.(..050810132024Z0"......;.S...wU-K.c...050810211644Z0"......d..#IE..#|.g#..050811182050Z0"....!..|....]rR..-r..050817085053Z0"......Ai..xJ..q]Xi...050822140450Z0!..>...........t'6...050824025640Z0!..?3..rd5>ocV.. ....050824075512Z0"....|..5u[.}<..[.@...050908092147Z0!..GJ.C...<NM.i......050912092806Z0!....(.8....U.1.'....050912144650Z0!..*.(ECy.V.?x.3S_k..050915103419Z0!......./.....L...r..050919144257Z0!..Y....=....#.......050929000000Z0!..p.,.g.x..z:q~.....050930114111Z0"....-.."...\w...~....050930123007Z0!....o0........P.H...051004084832Z0".......=6......4.....051005122403Z0!..md\\...~.v.o......051013100954Z0!...6.D...hR..BO._...051013110610Z0!..5.x.1..6.p~}>.....0510181

<<

<<< skipped >>>

Map

The Worm connects to the servers at the folowing location(s):

Strings from Dumps

PDFill.exe_1368:

.text

`.rdata

@.data

.rsrc

9/t%S3

Ht~Ht^Ht:Ht.Ht"H

8%u2P

WININET.dll

msi.dll

internal state. The program cannot safely continue execution and must

continue execution and must now be terminated.

FtpGetFileSize

FtpCommandA

wininet.dll

REST %u

Range: bytes=%u-

HTTP/1.0

FTP Server

.part

/exelang

/exebasicui

/exenoui

comctl32.dll

%d.%d %s

%d.0%d %s

%d %s

\StringFileInfo\xx\%s

%d.%d.%d.%d

Shell32.dll

Shlwapi.dll

\explorer.exe

\/:*?"<>|

%d-%s

kernel32.dll

%d.dll

shfolder.dll

SETUPEXEDIR

WindowsVolume

WindowsFolder

SearchCmdLine

Operator

SQLCompact

SQLExpress

MainAppURL

MainAppCmdLine

URL=%s

/n %s

TRANSFORMS=:%s.mst MSINEWINSTANCE=1

{FAB10E66-B22C-4274-8647-7CA1BA5EF30F}

http://www.example.com

http://www.yahoo.com

http://www.google.com

[SystemFolder]inetsrv\w3wp.exe

[SystemFolder]inetsrv\inetinfo.exe

[SystemFolder]wininet.dll

Windows Mobile Device Center 6.1

Windows Mobile Device Center 6.0

HKLM\SOFTWARE\Microsoft\Windows CE Services\MinorVersion

HKLM\SOFTWARE\Microsoft\Windows CE Services\MajorVersion

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\CEAPPMGR.EXE\

HKLM\Software\Microsoft\VSTO Runtime Setup\v9.0.21022\Install

HKLM\Software\Microsoft\vsto runtime Setup\v2.0.50727\Install

{957A4EC0-E67B-4E86-A383-6AF7270B216A}

{53C65973-D89D-4EA0-8567-8788C14E0A02}

{A58B51D1-89BF-4D88-939D-B6D0DB2EEB53}

{835AC3CE-E36B-4D65-B50F-2863A682ABEE}

{1C8772BD-6E6F-4C9D-8FF8-B5EA072F86EF}

{6F1AE751-4D8A-4B25-AC0A-C6CB912A9791}

{3F40FA9E-26CA-4CA2-93C9-603622349915}

{14D3E42A-A318-4D77-9895-A7EE585EFC3B}

{C1E59364-35F6-44B3-AF0F-FCA934C4B252}

{A1FE0698-609D-400F-BF10-F52238DD6475}

6.01.7000.0000

6.00.6000.16386

4.09.00.0903

4.09.00.0902

4.09.00.0901

4.09.00.0900

4.08.02.0134

4.08.01.0901

4.08.01.0810

4.08.00.0400

4.07.01.3000

4.07.00.0716

4.07.00.0700

SQL Server Compact 3.5 SP1

HKLM\SOFTWARE\Microsoft\Microsoft SQL Server Compact Edition\v3.5\ENU\DesktopRuntimeServicePackLevel

SQL Server Compact 3.5

HKLM\SOFTWARE\Microsoft\Microsoft SQL Server Compact Edition\v3.5\ENU\DesktopRuntimeVersion

HKLM\SOFTWARE\Microsoft\Microsoft SQL Server\SQLSERVER2008\MSSQLServer\CurrentVersion\CurrentVersion

SQL Server Express 2008

HKLM\SOFTWARE\Microsoft\Microsoft SQL Server\SQLEXPRESS\MSSQLServer\CurrentVersion\CurrentVersion

9.00.4035

SQL Server Express 2005 SP3

9.00.3042

SQL Server Express 2005 SP2

9.00.2047

SQL Server Express 2005 SP1

SQL Server Express 2005

HKLM\SOFTWARE\Microsoft\Microsoft SQL Server\90\Tools\ClientSetup\CurrentVersion\CurrentVersion

HKLM\SOFTWARE\Microsoft\NET Framework Setup\NDP\v2.0.50727\Install

HKLM\SOFTWARE\Microsoft\NET Framework Setup\NDP\v1.1.4322\Install

3321-3705

HKLM\SOFTWARE\Microsoft\.NETFramework\policy\v1.0\3705

SELECT `Value` FROM `Property` WHERE `Property` = '%s'

[SystemFolder]msi.dll

\\.\pipe\ToServer

Software\Microsoft\Windows\CurrentVersion\Run

mstask.exe

HKEY_CURRENT_CONFIG

HKEY_DYN_DATA

HKEY_PERFORMANCE_DATA

HKEY_USERS

HKEY_LOCAL_MACHINE

HKEY_CURRENT_USER

HKEY_CLASSES_ROOT

RICHED20.DLL

ATTRIB -r "%s"

del "%s"

if exist "%s" goto try

del "%s" | cls

rd "%s"

[SystemFolder]msiexec.exe

%s AI_SETUPEXEPATH="%s" SETUPEXEDIR="%s"

TRANSFORMS="%s"

TRANSFORMS="%s;%s\%d"

TRANSFORMS=":%d"

"%s" /OriginalPath:"%s"%s

.eui.exe

unpack200.exe

--verbose --log-file="%s" --remove-pack-file "%s" "%s"

.pack

0.0.0.0

0123456789

InternetCrackUrlA

HttpQueryInfoA

HttpOpenRequestA

HttpSendRequestA

FtpOpenFileA

FtpFindFirstFileA

VERSION.dll

GetProcessHeap

GetWindowsDirectoryA

CreateNamedPipeA

ConnectNamedPipe

KERNEL32.dll

ExitWindowsEx

MsgWaitForMultipleObjects

USER32.dll

GetViewportExtEx

GDI32.dll

RegOpenKeyA

RegOpenKeyExA

RegCloseKey

RegEnumKeyExA

RegCreateKeyExA

RegDeleteKeyA

RegQueryInfoKeyA

ADVAPI32.dll

ShellExecuteExA

ShellExecuteA

SHELL32.dll

ole32.dll

OLEAUT32.dll

SHLWAPI.dll

COMCTL32.dll

{\*\generator Msftedit 5.41.15.1507;}\viewkind4\uc1\pard\lang1033\f0\fs20\par

{\*\generator Msftedit 5.41.15.1507;}\viewkind4\uc1\pard\f0\fs20 EULA\par

3334445558;;<<<<>>>?

"999500>

"999550-]

version="1.0.0.0"

name="Microsoft.Windows.AdvancedInstallerSetup"

name="Microsoft.Windows.Common-Controls"

version="6.0.0.0"

publicKeyToken="6595b64144ccf1df"

B.aiu

*\\?\

<>:"/\|?*

[WindowsFolder]explorer.exe

Copy URL In Clipboard

You must locate, download and install the following prerequisites onto your computer. Double click on an URL to open it in your web browser.

This archive is corrupted.(This archive has an unsupported version.'Windows Installer could not be started.)An error occurred while reading the file.#An error occurred while extracting.

Select the download folder.R%s can not be installed on systems with Windows Installer version smaller than %s.

ErrorkThis package requires Windows Installer version "%s". You have "%s".

Please upgrade your Windows Installer.

%s Options(Extracting the main application files...

%s [options]

/listlangs - list languages supported by this setup

<msiOptions> - options for msiexec.exe on running the MSI package</msiOptions>

Installing %s4Press the Next button to download the prerequisites.3Press the Next button to install the prerequisites.;Press the Next button to open the prerequisites' web sites.8Press the Finish button to install the main application.

%s Setup

Required: %s or lower.

Required: %s or higher.

Required: between %s and %s.

Found: %s.

NameCPress the Finish button when you are done and ready to install %s. 3Press the Next button to install the prerequisites.

Error: %s

Installing %s from: %sZSome prerequisites could not be installed. Press Back to return to the prerequisites list.{After launching all packages some required prerequisites are still missing. Press Back to return to the prerequisites list.aAll prerequisites have been installed successfully. Press Finish to install the main application.&Welcome to the %s Prerequisites Wizard

%d.%d KB/slSome required prerequisites are still missing. You can try again or remove them from the prerequisites list.

%d hr %d min at %s/sec

%d min %d sec at %s/sec

%d sec at %s/sec

Progress: %d%% (%s of %s) Downloading: %s %d%% (%s of %s)

Opening site of %s

Downloading %s Extracting files from archive...

Extracting file to %s0The %s file can't be unpacked. Error message: %saThe Java Runtime Environment version 1.5 or later must be installed in order to unpack JAR files.-Another instance of setup is already running.

%s can not be installed on %s2%s can not be installed on systems earlier than %s

Q%s can not be installed on systems with Internet Explorer version smaller than %s]%s can not be installed on systems with Internet Information Services version smaller than %sI%s can not be installed on systems with screen resolution smaller than %sK%s can not be installed on systems with color quality smaller than %s bits.H%s can not be installed on systems with less physical memory than %s MB.N%s can not be installed on systems with .NET Framework version smaller than %s1%s requires administrative privileges to install.

Unpacking file:%syThere is not enough space in folder:%s

Preparing...N%s can not be installed on systems with Acrobat Reader version smaller than %s

%s Languages

C%s can not be installed on systems with JRE version smaller than %sG%s can not be installed on systems with DirectX version smaller than %sw%s requires an active Internet connection for installation. Please check your network configuration and proxy settings.1%s cannot be installed on systems without %s 20031%s cannot be installed on systems without %s 2007

QuestionOAn upgrade of the selected instance will be performed. Do you want to continue? Upgrade all installed instances.xThis package allows you to install multiple instances of %s. Please select the option you want and press OK to continue:M%s can not be installed on systems with XNA Framework version smaller than %s

Evaluating launch conditions...C%s can not be installed on systems with JDK version smaller than %s-%s can not be installed on systems without %s7%s can not be installed on systems without %s or higher

,%s cannot be installed on systems without %sK%s cannot be installed on systems without %s 2003 Primary Interop Assembly.K%s cannot be installed on systems without %s 2007 Primary Interop Assembly.-%s cannot be installed on systems without %s.

PDFill.exe

vbc.exe_1056:

`.rsrc

bss_server.usrReverseRelay

bss_server.usrRelay

tmrWebHide

bss_server.Socket

mswinsck.ocx

MSWinsockLib.Winsock

modLaunchWeb

%Program Files% (x86)\Microsoft Visual Studio\VB98\VB6.OLB

C:\Windows\SysWOW64\ieframe.dll

winmm.dll

user32.dll

CHAT_ADDMSG

advapi32.dll

shell32.dll

kernel32.dll

avicap32.dll

advpack.dll

GetAsyncKeyState

SetWindowsHookExA

UnhookWindowsHookEx

GetKeyboardLayout

GetKeyboardState

GetKeyState

PSAPI.DLL

CreatePipe

GetTcpTable

ExitWindowsEx

EnumWindows

WinInet.dll

DeleteUrlCacheEntryA

urlmon

URLDownloadToFileA

ShellExecuteA

keybd_event

cmdShowfiles

x%Program Files% (x86)\Microsoft Visual Studio\VB98\mswinsck.oca

UDPSocket

tmrUDP

tmrTCP

UDPFlood

VBA6.DLL

C:\Windows\SysWow64\MSVBVM60.DLL\3

ws2_32.dll

AddMsg

GdiplusShutdown

WSOCK32.DLL

RegCloseKey

RegOpenKeyExA

ntdll.dll

Http_DownloadFile

ole32.dll

FtpGetDirectory

crypt32.dll

oleaut32.dll

RegOpenKeyA

FindFirstUrlCacheEntryA

FtpUpload

FindNextUrlCacheEntryA

RegCreateKeyA

RegDeleteKeyA

RegEnumKeyExA

gdi32.dll

olepro32.dll

InternetOpenUrlA

FtpGetFileA

FtpPutFileA

FtpSetCurrentDirectoryA

FtpGetCurrentDirectoryA

FtpOpenFileA

FtpGetFileSize

FtpDeleteFileA

FtpCreateDirectoryA

FtpRemoveDirectoryA

FtpRenameFileA

FtpDownload

RemotePort

LocalPort

msvbvm60.dll

?8??8??8??8??8?

uMsg

strMsg

MsgNum

AllMsgs

Port

Password

WebURL

lngPort

Returns/Sets the port to be connected to on the remote computer

Returns/Sets the port used on the local computer

Binds socket to specific port and adapter

Occurs after a send operation has completed

.text

`.data

.rsrc

.rsrm

KERNEL32.DLL

MSVBVM60.DLL

*\AC:\Users\Admin\Desktop\Blackshades project\Blackshades NET\server\server.vbp

2c49f800-c2dd-11cf-9ad6-0080c7e7b78d

Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.1) Gecko/20090612 Firefox/3.5

{00020404-0000-0000-C000-000000000046}

4.0.1

data.dat

\nir_cmd.bss speak text

\nir_cmd.bss setsysvolume 65535

\nir_cmd.bss mutesysvolume 1

\nir_cmd.bss mutesysvolume 0

\nir_cmd.bss screensaver

\nir_cmd.bss monitor off

\nir_cmd.bss monitor on

PORT

TRANSFERPORT

SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\

Keylog

Wscript.Shell

HKEY_CLASSES_ROOT\HTTP\shell\open\command\

\winlogon.exe

iexplore.exe

ADVAPI32.dll

Windows Firewall/Internet Connection Sharing (ICS)

WebCamCapture

\Vuze\Azureus.exe

\LimeWire\LimeWire.exe

\uTorrent\uTorrent.exe

\BitTorrent\bittorrent.exe

\MSWINSCK.OCX

\cmd.exe

nkey

dkey

regsvr32.exe

\pws_mail.bss

\pws_mess.bss

\pws_cdk.bss

\nir_cmd.bss

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "

:*:Enabled:Windows Messanger" /f

winmgmts:{impersonationLevel=Impersonate}!\\.\root\cimv2

00000000

winmgmts:\\.\root\cimv2

api.ipinfodb.com

Select * from Win32_Keyboard

GET /v2/ip_query.php?key=

&timezone=off HTTP/1.1

Host: api.ipinfodb.com

GET /v2/ip_query_country.php?key=

Portable

winmgmts:\\.\root\SecurityCenter

\wallpaper.bmp

\wallpaper.jpg

WScript.Shell

WinServer 2003, Web Edition

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProductName

__oxFrame.class__

Scripting.FileSystemObject

Autorun.ini

{557CF401-1A04-11D3-9A73-0000F81EF32E}

{1D5BE4B5-FA4A-452D-9CDD-5DB35105E7EB}

Address family not supported by protocol family.

Operation already in progress.

Operation now in progress.

Socket operation on nonsocket.

Operation not supported.

Protocol family not supported.

Protocol not supported.

Socket type not supported.

Winsock.dll version out of range.

CSocketMaster.SocketExists

CSocketMaster.PostSocket

CSocketMaster.ConnectToIP

CSocketMaster.ResolveIfHostname

CSocketMaster.SendBufferedDataUDP

CSocketMaster.SendBufferedData

sqlite3_open

sqlite3.dll

sqlite3_close

sqlite3_prepare_v2

sqlite3_step

sqlite3_finalize

sqlite3_column_text

abe2869f-9b47-4cd9-a358-c22904dba7f7

/stext mess.dat

\mess.dat

/stext mail.dat

\mail.dat

SOFTWARE\MICROSOFT\Windows NT\CurrentVersion

Windows

softokn3.dll

nss3.dll

SOFTWARE\Classes\Applications\iexplore.exe\shell\open\command

\Mozilla Firefox\

mozcrt19.dll

nspr4.dll

plc4.dll

plds4.dll

nssutil3.dll

\Mozilla\Firefox\

profiles.ini

\signons.sqlite

select * from moz_logins

PK11_GetInternalKeySlot

http\shell\open\command

127.0.0.1

\dump.txt

255.255.255.255

bps1.exe

finalizarprocessoportas

CONNECT %s:%i HTTP/1.0

SOFTWARE\Classes\http\shell\open\command

Software\Classes\http\shell\open\command

Software\Microsoft\Windows NT\CurrentVersion\SystemRestore

code.is.a.winner

Software\Microsoft\Windows\CurrentVersion\Uninstall\eMule

SOFTWARE\MICROSOFT\Windows NT\CurrentVersion\DigitalProductId

bhookpl.dll

bnfa.exe

drvloadn.dll

drvloadx.dll

VNCHooks.dll

xr4tdwa.exe

shutdown.exe

TCnRawKeyBoard

HuntHTTPDownload

explorer.exe

autorun.inf

https://onlineeast#.bankofamerica.com

winlogon.exe

SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\run

SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon

\system32\userinit.exe,

@*\AC:\Users\Admin\Desktop\Blackshades project\Blackshades NET\server\server.vbp

vbc.exe_1056_rwx_00400000_0005C000:

`.rsrc

bss_server.usrReverseRelay

bss_server.usrRelay

tmrWebHide

bss_server.Socket

mswinsck.ocx

MSWinsockLib.Winsock

modLaunchWeb

%Program Files% (x86)\Microsoft Visual Studio\VB98\VB6.OLB

C:\Windows\SysWOW64\ieframe.dll

winmm.dll

user32.dll

CHAT_ADDMSG

advapi32.dll

shell32.dll

kernel32.dll

avicap32.dll

advpack.dll

GetAsyncKeyState

SetWindowsHookExA

UnhookWindowsHookEx

GetKeyboardLayout

GetKeyboardState

GetKeyState

PSAPI.DLL

CreatePipe

GetTcpTable

ExitWindowsEx

EnumWindows

WinInet.dll

DeleteUrlCacheEntryA

urlmon

URLDownloadToFileA

ShellExecuteA

keybd_event

cmdShowfiles

x%Program Files% (x86)\Microsoft Visual Studio\VB98\mswinsck.oca

UDPSocket

tmrUDP

tmrTCP

UDPFlood

VBA6.DLL

C:\Windows\SysWow64\MSVBVM60.DLL\3

ws2_32.dll

AddMsg

GdiplusShutdown

WSOCK32.DLL

RegCloseKey

RegOpenKeyExA

ntdll.dll

Http_DownloadFile

ole32.dll

FtpGetDirectory

crypt32.dll

oleaut32.dll

RegOpenKeyA

FindFirstUrlCacheEntryA

FtpUpload

FindNextUrlCacheEntryA

RegCreateKeyA

RegDeleteKeyA

RegEnumKeyExA

gdi32.dll

olepro32.dll

InternetOpenUrlA

FtpGetFileA

FtpPutFileA

FtpSetCurrentDirectoryA

FtpGetCurrentDirectoryA

FtpOpenFileA

FtpGetFileSize

FtpDeleteFileA

FtpCreateDirectoryA

FtpRemoveDirectoryA

FtpRenameFileA

FtpDownload

RemotePort

LocalPort

msvbvm60.dll

?8??8??8??8??8?

uMsg

strMsg

MsgNum

AllMsgs

Port

Password

WebURL

lngPort

Returns/Sets the port to be connected to on the remote computer

Returns/Sets the port used on the local computer

Binds socket to specific port and adapter

Occurs after a send operation has completed

.text

`.data

.rsrc

.rsrm

KERNEL32.DLL

MSVBVM60.DLL

*\AC:\Users\Admin\Desktop\Blackshades project\Blackshades NET\server\server.vbp

2c49f800-c2dd-11cf-9ad6-0080c7e7b78d

Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.1) Gecko/20090612 Firefox/3.5

{00020404-0000-0000-C000-000000000046}

4.0.1

data.dat

\nir_cmd.bss speak text

\nir_cmd.bss setsysvolume 65535

\nir_cmd.bss mutesysvolume 1

\nir_cmd.bss mutesysvolume 0

\nir_cmd.bss screensaver

\nir_cmd.bss monitor off

\nir_cmd.bss monitor on

PORT

TRANSFERPORT

SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\

Keylog

Wscript.Shell

HKEY_CLASSES_ROOT\HTTP\shell\open\command\

\winlogon.exe

iexplore.exe

ADVAPI32.dll

Windows Firewall/Internet Connection Sharing (ICS)

WebCamCapture

\Vuze\Azureus.exe

\LimeWire\LimeWire.exe

\uTorrent\uTorrent.exe

\BitTorrent\bittorrent.exe

\MSWINSCK.OCX

\cmd.exe

nkey

dkey

regsvr32.exe

\pws_mail.bss

\pws_mess.bss

\pws_cdk.bss

\nir_cmd.bss

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "

:*:Enabled:Windows Messanger" /f

winmgmts:{impersonationLevel=Impersonate}!\\.\root\cimv2

00000000

winmgmts:\\.\root\cimv2

api.ipinfodb.com

Select * from Win32_Keyboard

GET /v2/ip_query.php?key=

&timezone=off HTTP/1.1

Host: api.ipinfodb.com

GET /v2/ip_query_country.php?key=

Portable

winmgmts:\\.\root\SecurityCenter

\wallpaper.bmp

\wallpaper.jpg

WScript.Shell

WinServer 2003, Web Edition

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProductName

__oxFrame.class__

Scripting.FileSystemObject

Autorun.ini

{557CF401-1A04-11D3-9A73-0000F81EF32E}

{1D5BE4B5-FA4A-452D-9CDD-5DB35105E7EB}

Address family not supported by protocol family.

Operation already in progress.

Operation now in progress.

Socket operation on nonsocket.

Operation not supported.

Protocol family not supported.

Protocol not supported.

Socket type not supported.

Winsock.dll version out of range.

CSocketMaster.SocketExists

CSocketMaster.PostSocket

CSocketMaster.ConnectToIP

CSocketMaster.ResolveIfHostname

CSocketMaster.SendBufferedDataUDP

CSocketMaster.SendBufferedData

sqlite3_open

sqlite3.dll

sqlite3_close

sqlite3_prepare_v2

sqlite3_step

sqlite3_finalize

sqlite3_column_text

abe2869f-9b47-4cd9-a358-c22904dba7f7

/stext mess.dat

\mess.dat

/stext mail.dat

\mail.dat

SOFTWARE\MICROSOFT\Windows NT\CurrentVersion

Windows

softokn3.dll

nss3.dll

SOFTWARE\Classes\Applications\iexplore.exe\shell\open\command

\Mozilla Firefox\

mozcrt19.dll

nspr4.dll

plc4.dll

plds4.dll

nssutil3.dll

\Mozilla\Firefox\

profiles.ini

\signons.sqlite

select * from moz_logins

PK11_GetInternalKeySlot

http\shell\open\command

127.0.0.1

\dump.txt

255.255.255.255

bps1.exe

finalizarprocessoportas

CONNECT %s:%i HTTP/1.0

SOFTWARE\Classes\http\shell\open\command

Software\Classes\http\shell\open\command

Software\Microsoft\Windows NT\CurrentVersion\SystemRestore

code.is.a.winner

Software\Microsoft\Windows\CurrentVersion\Uninstall\eMule

SOFTWARE\MICROSOFT\Windows NT\CurrentVersion\DigitalProductId

bhookpl.dll

bnfa.exe

drvloadn.dll

drvloadx.dll

VNCHooks.dll

xr4tdwa.exe

shutdown.exe

TCnRawKeyBoard

HuntHTTPDownload

explorer.exe

autorun.inf

https://onlineeast#.bankofamerica.com

winlogon.exe

SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\run

SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon

\system32\userinit.exe,

@*\AC:\Users\Admin\Desktop\Blackshades project\Blackshades NET\server\server.vbp

MsiExec.exe_1956:

.text

`.data

.rsrc

msvcrt.dll

ADVAPI32.dll

KERNEL32.dll

NTDLL.DLL

USER32.dll

ole32.dll

msi.dll

WinHttpOpen

WinHttpConnect

WinHttpCrackUrl

WinHttpOpenRequest

WinHttpCloseHandle

WinHttpSendRequest

WinHttpReceiveResponse

WinHttpQueryDataAvailable

WinHttpReadData

WinHttpQueryHeaders

WinHttpGetProxyForUrl

WinHttpGetIEProxyConfigForCurrentUser

WinHttpSetOption

RegDeleteKeyExW

SQLInstallDriverExW

SQLConfigDriverW

SQLRemoveDriverW

SQLInstallTranslatorExW

SQLRemoveTranslatorW

SQLConfigDataSourceW

SQLInstallerErrorW

SQLInstallDriverManagerW

SQLRemoveDriverManagerW

UrlCanonicalizeW

UrlCombineW

UrlIsW

UrlIsFileUrlW

UrlGetPartW

PathCreateFromUrlW

DeleteUrlCacheEntryW

URLDownloadToCacheFileW

SetThreadExecutionState

GetSystemWindowsDirectoryW

NtRenameKey

NtOpenKey

TermsrvLogInstallIniFileEx

WTHelperGetProvCertFromChain

CertDuplicateCertificateContext

CertFreeCertificateContext

ReportFault

ApphelpFixMsiPackageExe

msiexec.pdb

PSSSSSSh

SSSSht

_acmdln

RegOpenKeyExW

RegCreateKeyExW

RegCloseKey

RegDeleteKeyW

RegEnumKeyW

RegEnumKeyExW

RegGetKeySecurity

MsgWaitForMultipleObjects

ntdll.dll

name="MSIExec"

version="4.0.0.0"

<description> Windows installer setup service </description>

name="Microsoft.Windows.Common-Controls"

version="6.0.0.0"

publicKeyToken="6595b64144ccf1df"

Msi.Package

Windows Installer Package

Msi.Patch

Windows Installer Patch

APPID\%s

%s\DefaultIcon

%s\CLSID

CLSID\%s

CLSID\%s\ProgId

Msi.dll

MsiRegMv.Exe

MsiExecCA32

Software\Microsoft\Windows\CurrentVersion\Installer

{lX-0000-0000-C000-000000000046}

ISMIF32.DLL

RICHED20.DLL

%d.d.%.4d.%d

REINSTALL=ALL REINSTALLMODE=%s

Error: %d. %s.

Software\Policies\Microsoft\Windows\Installer

Failed to connect to server. Error: 0x%X

FDeleteRegTree: Unable to delete subkey: %s

Interface\{lX-0000-0000-C000-000000000046}\NumMethods

3.1.4000

3.0.3790

%d.%d.%d

CLSID\{lX-0000-0000-C000-000000000046}\DllVersion

FIsKeyLocalSystemOrAdminOwned: Could not get owner security info.

PurgeUserOwnedSubkeys: Could not open subkey: %s

PurgeUserOwnedSubkeys: Could not enumerate subkeys.

PurgeUserOwnedSubkeys: Could not delete SubKey tree.

PurgeUserOwnedSubkeys: %s not owned by System or Admin. Deleting key subkeys.

PurgeUserOwnedInstallerKeys: Could not delete tree.

PurgeUserOwnedInstallerKeys: Key '%s' not owned by System or Admin. Deleting key subkeys.

PurgeUserOwnedInstallerKeys: Could not open key '%s'

OpenProcessToken failed with %d

passive

Software\Microsoft\Windows\CurrentVersion\Installer\RunOnceEntries

SetInstallerACLs: Could not create Secure Installer sub key.

SetInstallerACLs: Could not delete Installer key tree.

SetInstallerACLs: Installer key not owned by System or Admin. Deleting key subkeys and re-creating.

SetInstallerACLs: Could not create Installer key.

kernel32.dll

WINHTTP

fusion.dll

URLMON

RPCRT4

Windows

3.1.4001.5512

msiexec

msiexec.exe

Windows Installer - Unicode

Summary

Dynamic Analysis

Removals

Static Analysis

Network Activity

Map

Strings from Dumps