Skip to main content

Backdoor.Win32.PcClient_82b072430d


Trojan-Dropper.Win32.Mudrop.xfj (Kaspersky), Worm.Generic.228477 (B) (Emsisoft), Worm.Generic.228477 (AdAware), Backdoor.Win32.PcClient.FD, GenericAutorunWorm.YR (Lavasoft MAS)Behaviour: Trojan-Dropper, Trojan, Backdoor, Worm, WormAutorun

The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.

Summary

MD5: 82b072430d1842d2093bc56661d8f2d2

SHA1: 49ae0c58912671e08956422dad2f18d955f455b1

SHA256: d13cae34dea3044cb2d44eba19d0bf3228a62dcb5144dc10224a7ef77d145064

SSDeep: 12288:v1dcoCUyZtwAvAs4wTCyrPT0yq0VezaOvoJpaz/g/J/vVoS:vvfty/wAvN7lry0VeH8az/g/J/No

Size: 978432 bytes

File type: EXE

Platform: WIN32

Entropy: Not Packed

PEID: PackerUPXCompresorGratuitowwwupxsourceforgenet, UPolyXv05_v6

Company: MiniApp

Created at: 2009-07-04 18:42:17

Analyzed on: WindowsXP SP3 32-bit

Summary: Backdoor. Malware that enables a remote control of victim's machine.

Dynamic Analysis

Payload

Behaviour Description
WormAutorunA worm can spread via removable drives. It writes its executable and creates "autorun.inf" scripts on all removable drives. The autorun script will execute the Backdoor's file once a user opens a drive's folder in Windows Explorer.


Process activity

The Backdoor creates the following process(es):

taskkill.exe:560
taskkill.exe:188
taskkill.exe:1480
sc.exe:548
rundll32.exe:1720
cacls.exe:348
cacls.exe:1584

The Backdoor injects its code into the following process(es):

%original file name%.exe:136

File activity

The process rundll32.exe:1720 makes changes in the file system.


The Backdoor creates and/or writes to the following file(s):

%System%\drivers\acpiec.sys (13 bytes)

The process %original file name%.exe:136 makes changes in the file system.


The Backdoor creates and/or writes to the following file(s):

C:\ (4 bytes)
%System%\wbem\Logs (4 bytes)
C:\autorun.inf (21 bytes)
%WinDir%\WinSxS (12 bytes)
%System%\drivers\etc\hosts (5 bytes)
C:\$Directory (20 bytes)
%System%\dllcache (4 bytes)
%WinDir%\inf (400 bytes)
%System%\config\systemprofile\Application Data\Microsoft (4 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\desktop.ini (159 bytes)
%System%\config\systemprofile (4 bytes)
%System%\drivers\pcidump.sys (5404535 bytes)
%System%\config (8 bytes)
%System%\drivers (296 bytes)
%WinDir%\phpq.dll (22141559 bytes)
%System%\func.dll (18378359 bytes)
%Documents and Settings%\%current user% (4 bytes)
C:\1.exe (7345 bytes)

Registry activity

The process taskkill.exe:560 makes changes in the system registry.


The Backdoor creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "0B D1 EC BD 2A E6 41 B4 1C 52 8C 20 16 DE AC A7"

The process taskkill.exe:188 makes changes in the system registry.


The Backdoor creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "E8 BD 7E 83 1F 47 74 D7 F6 AA CC 03 9A B4 47 3E"

The process taskkill.exe:1480 makes changes in the system registry.


The Backdoor creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "D2 BF 9E F9 BA 09 05 C8 77 0E AD 91 05 17 71 D0"

The process sc.exe:548 makes changes in the system registry.


The Backdoor creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "27 D6 68 04 0D 13 B7 B4 FF 4D F0 1A D0 D7 34 7A"

The process rundll32.exe:1720 makes changes in the system registry.


The Backdoor creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "2D 10 83 5C EF 68 0B 48 2B 27 90 6F BC 5C 5D 04"

The process cacls.exe:348 makes changes in the system registry.


The Backdoor creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "4C 8D AB F2 94 F8 90 96 AA 04 4E FF 04 F2 55 6E"

The process cacls.exe:1584 makes changes in the system registry.


The Backdoor creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "AE 28 58 1F 20 6A DA E8 90 47 40 C8 D6 06 F4 C8"

Dropped PE files

MD5 File path
522afca05d2634a769adbe29d64cfa08c:\WINDOWS\LastGood\system32\drivers\acpiec.sys
4485601a5a45d10f44cd57c1f09048e0c:\WINDOWS\phpq.dll
9859c0f6936e723e4892d7141b1327d5c:\WINDOWS\system32\dllcache\acpiec.sys
522afca05d2634a769adbe29d64cfa08c:\WINDOWS\system32\drivers\OLD3.tmp
601b3f2466bfa6989b9c7586b5ba54aac:\WINDOWS\system32\drivers\pcidump.sys
e13f938795bc9fc449d0a7ef6deb2c8bc:\WINDOWS\system32\func.dll

HOSTS file anomalies

The Backdoor modifies "%System%\drivers\etc\hosts" file which is used to translate DNS entries to IP addresses. The modified file is 5743 bytes in size. The following strings are added to the hosts file listed below:

127.0.0.1v.onondown.com.cn
127.0.0.2ymsdasdw1.cn
127.0.0.3h96b.info
127.0.0.0fuck.zttwp.cn
127.0.0.0www.hackerbf.cn
127.0.0.0geekbyfeng.cn
127.0.0.0121.14.101.68
127.0.0.0ppp.etimes888.com
127.0.0.0www.bypk.com
127.0.0.0CSC3-2004-crl.verisign.com
127.0.0.1va9sdhun23.cn
127.0.0.0udp.hjob123.com
127.0.0.2bnasnd83nd.cn
127.0.0.0www.gamehacker.com.cn
127.0.0.0gamehacker.com.cn
127.0.0.3adlaji.cn
127.0.0.1858656.com
127.1.1.1bnasnd83nd.cn
127.0.0.1my123.com
127.0.0.0user1.12-27.net
127.0.0.18749.com
127.0.0.0fengent.cn
127.0.0.14199.com
127.0.0.1user1.16-22.net
127.0.0.17379.com
127.0.0.12be37c5f.3f6e2cc5f0b.com
127.0.0.17255.com
127.0.0.1user1.23-12.net
127.0.0.13448.com
127.0.0.1www.guccia.net
127.0.0.17939.com
127.0.0.1a.o1o1o1.nEt
127.0.0.18009.com
127.0.0.1user1.12-73.cn
127.0.0.1piaoxue.com
127.0.0.13n8nlasd.cn
127.0.0.1kzdh.com
127.0.0.0www.sony888.cn
127.0.0.1about.blank.la
127.0.0.0user1.asp-33.cn
127.0.0.16781.com
127.0.0.0www.netkwek.cn
127.0.0.17322.com
127.0.0.0ymsdkad6.cn
127.0.0.0www.lkwueir.cn
127.0.0.106.jacai.com
127.0.1.1user1.23-17.net
127.0.0.11.jopenkk.com
127.0.0.0upa.luzhiai.net
127.0.0.11.jopenqc.com
127.0.0.0www.guccia.net
127.0.0.11.joppnqq.com
127.0.0.04m9mnlmi.cn
127.0.0.11.xqhgm.com
127.0.0.0mm119mkssd.cn
127.0.0.1100.332233.com
127.0.0.061.128.171.115:8080
127.0.0.1121.11.90.79
127.0.0.0www.1119111.com
127.0.0.1121565.net
127.0.0.0win.nihao69.cn
127.0.0.1125.90.88.38
127.0.0.116888.6to23.com
127.0.0.12.joppnqq.com
127.0.0.0puc.lianxiac.net
127.0.0.1204.177.92.68
127.0.0.0pud.lianxiac.net
127.0.0.1210.74.145.236
127.0.0.0210.76.0.133
127.0.0.1219.129.239.220
127.0.0.061.166.32.2
127.0.0.1219.153.40.221
127.0.0.0218.92.186.27
127.0.0.1219.153.46.27
127.0.0.0www.fsfsfag.cn
127.0.0.1219.153.52.123
127.0.0.0ovo.ovovov.cn
127.0.0.1221.195.42.71
127.0.0.0dw.com.com
127.0.0.1222.73.218.115
127.0.0.1203.110.168.233:80
127.0.0.13.joppnqq.com
127.0.0.1203.110.168.221:80
127.0.0.1363xx.com
127.0.0.1www1.ip10086.com.cm
127.0.0.14199.com
127.0.0.1blog.ip10086.com.cn
127.0.0.143242.com
127.0.0.1www.ccji68.cn
127.0.0.15.xqhgm.com
127.0.0.0t.myblank.cn
127.0.0.1520.mm5208.com
127.0.0.0x.myblank.cn
127.0.0.159.34.131.54
127.0.0.1210.51.45.5
127.0.0.159.34.198.228
127.0.0.1www.ew1q.cn
127.0.0.159.34.198.88
127.0.0.159.34.198.97
127.0.0.160.190.114.101
127.0.0.160.190.218.34
127.0.0.0qq-xing.com.cn
127.0.0.160.191.124.252
127.0.0.161.145.117.212
127.0.0.161.157.109.222
127.0.0.175.126.3.216
127.0.0.175.126.3.217
127.0.0.175.126.3.218
127.0.0.059.125.231.177:17777
127.0.0.175.126.3.220
127.0.0.175.126.3.221
127.0.0.175.126.3.222
127.0.0.1772630.com
127.0.0.1832823.cn
127.0.0.18749.com
127.0.0.1888.jopenqc.com
127.0.0.189382.cn
127.0.0.18v8.biz
127.0.0.197725.com
127.0.0.19gg.biz
127.0.0.1www.9000music.com
127.0.0.1test.591jx.com
127.0.0.1a.topxxxx.cn
127.0.0.1picon.chinaren.com
127.0.0.1www.5566.net
127.0.0.1p.qqkx.com
127.0.0.1news.netandtv.com
127.0.0.1z.neter888.cn
127.0.0.1b.myblank.cn
127.0.0.1wvw.wokutu.com
127.0.0.1unionch.qyule.com
127.0.0.1www.qyule.com
127.0.0.1it.itjc.cn
127.0.0.1www.linkwww.com
127.0.0.1vod.kaicn.com
127.0.0.1www.tx8688.com
127.0.0.1b.neter888.cn
127.0.0.1promote.huanqiu.com
127.0.0.1www.huanqiu.com
127.0.0.1www.haokanla.com
127.0.0.1play.unionsky.cn
127.0.0.1www.52v.com
127.0.0.1www.gghka.cn
127.0.0.1icon.ajiang.net
127.0.0.1new.ete.cn
127.0.0.1www.stiae.cn
127.0.0.1o.neter888.cn
127.0.0.1comm.jinti.com
127.0.0.1www.google-analytics.com
127.0.0.1hz.mmstat.com
127.0.0.1www.game175.cn
127.0.0.1x.neter888.cn
127.0.0.1z.neter888.cn
127.0.0.1p.etimes888.com
127.0.0.1hx.etimes888.com
127.0.0.1abc.qqkx.com
127.0.0.1dm.popdm.cn
127.0.0.1www.yl9999.com
127.0.0.1www.dajiadoushe.cn
127.0.0.1v.onondown.com.cn
127.0.0.1www.interoo.net
127.0.0.1bally1.bally-bally.net
127.0.0.1www.bao5605509.cn
127.0.0.1www.rty456.cn
127.0.0.1www.werqwer.cn
127.0.0.11.360-1.cn
127.0.0.1user1.23-16.net
127.0.0.1www.guccia.net
127.0.0.1www.interoo.net
127.0.0.1upa.netsool.net
127.0.0.1js.users.51.la
127.0.0.1vip2.51.la
127.0.0.1web.51.la
127.0.0.1qq.gong2008.com
127.0.0.12008tl.copyip.com
127.0.0.1tla.laozihuolaile.cn
127.0.0.1www.tx6868.cn
127.0.0.1p001.tiloaiai.com
127.0.0.1s1.tl8tl.com
127.0.0.1s1.gong2008.com
127.0.0.14b3ce56f9g.3f6e2cc5f0b.com


Rootkit activity

The Backdoor installs the following kernel-mode hooks:

ZwQuerySystemInformation

Using the driver "%System%\drivers\pcidump.sys" the Backdoor substitutes IRP handlers in a file system driver (NTFS) to control operations with files:

MJ_CREATE

Using the driver "%System%\drivers\pcidump.sys" the Backdoor substitutes IRP handlers in a file system driver (FastFAT) to control operations with files:

MJ_CREATE

Propagation

A worm can spread via removable drives. It writes its executable and creates "autorun.inf" scripts on all removable drives. The autorun script will execute the Backdoor's file once a user opens a drive's folder in Windows Explorer.

Removals

Remove it with Ad-Aware

  1. Click (here) to download and install Ad-Aware Free Antivirus.
  2. Update the definition files.
  3. Run a full scan of your computer.

Manual removal*

  1. Scan a system with an anti-rootkit tool.
  2. Terminate malicious process(es) (How to End a Process With the Task Manager):

    taskkill.exe:560
    taskkill.exe:188
    taskkill.exe:1480
    sc.exe:548
    rundll32.exe:1720
    cacls.exe:348
    cacls.exe:1584

  3. Delete the original Backdoor file.
  4. Delete or disinfect the following files created/modified by the Backdoor:

    %System%\drivers\acpiec.sys (13 bytes)
    %System%\wbem\Logs (4 bytes)
    C:\autorun.inf (21 bytes)
    %WinDir%\WinSxS (12 bytes)
    %System%\drivers\etc\hosts (5 bytes)
    C:\$Directory (20 bytes)
    %System%\dllcache (4 bytes)
    %WinDir%\inf (400 bytes)
    %System%\config\systemprofile\Application Data\Microsoft (4 bytes)
    %Documents and Settings%\%current user%\Local Settings\History\History.IE5\desktop.ini (159 bytes)
    %System%\drivers\pcidump.sys (5404535 bytes)
    %WinDir%\phpq.dll (22141559 bytes)
    %System%\func.dll (18378359 bytes)
    C:\1.exe (7345 bytes)

  5. Restore the original content of the HOSTS file (%System%\drivers\etc\hosts): 127.0.0.1 localhost
  6. Find and delete all copies of the worm's file together with "autorun.inf" scripts on removable drives.
  7. Reboot the computer.
*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

VersionInfo

Company Name:
Product Name: ????
Product Version: 4, 3, 1, 1
Legal Copyright: ???? (C) 2009
Legal Trademarks:
Original Filename: notepad.EXE
Internal Name: test
File Version: 1, 0, 0, 1
File Description: Microsoft ???????
Comments:
Language: English (United States)

Company Name: Product Name: ????Product Version: 4, 3, 1, 1Legal Copyright: ???? (C) 2009Legal Trademarks: Original Filename: notepad.EXEInternal Name: testFile Version: 1, 0, 0, 1File Description: Microsoft ???????Comments: Language: English (United States)

PE Sections

Name Virtual Address Virtual Size Raw Size Entropy Section MD5
UPX040967782400d41d8cd98f00b204e9800998ecf8427e
UPX18192032768307205.46213f31a4d2c191bb50deff8a3e381d5418b
.rsrc114688409615361.99209c42b12aadc909baa46a4ceea8788a913

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Network Activity

URLs

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

Map

The Backdoor connects to the servers at the folowing location(s):

Strings from Dumps

%original file name%.exe_136:

.rsrc

.rsrc

z.wxE

z.wxE

(Exec

(Exec

/1.html

/1.html

\phpq.dllvi

\phpq.dllvi

$\ 8cmd

$\ 8cmd

%}cls "%s"?pB

%}cls "%s"?pB

GetWindowsDirectoryA

GetWindowsDirectoryA

WinExec

WinExec

tp://localhost/1.html

tp://localhost/1.html

\phpq.dll

\phpq.dll

rundll32.exe func.dll, droqp

rundll32.exe func.dll, droqp

\system32\func.dll

\system32\func.dll

cmd /c taskkill /im ScanFrm.exe /f

cmd /c taskkill /im ScanFrm.exe /f

cmd /c taskkill /im egui.exe /f

cmd /c taskkill /im egui.exe /f

cmd /c taskkill /im ekrn.exe /f

cmd /c taskkill /im ekrn.exe /f

cmd /c sc config ekrn start= disabled

cmd /c sc config ekrn start= disabled

cmd /c cacls "%s" /e /p everyone:f

cmd /c cacls "%s" /e /p everyone:f

cmd /c cacls %s /e /p everyone:f

cmd /c cacls %s /e /p everyone:f

\temp\explorer.exe

\temp\explorer.exe

\drivers\gm.dls

\drivers\gm.dls

Explorer.EXE

Explorer.EXE

explorer.EXE

explorer.EXE

EXPLORER.EXE

EXPLORER.EXE

EXPLORER.exe

EXPLORER.exe

Explorer.exe

Explorer.exe

explorer.exe

explorer.exe

kjk.om\k)`s`

kjk.om\k)`s`

Ci=l_[n_Msg\ifc]Fche

Ci=l_[n_Msg\ifc]Fche

,-2) ) ),

,-2) ) ),

,-2) ) )-

,-2) ) )-

,-2) ) ).

,-2) ) ).

,-2) ) )

,-2) ) )

,-,),/), ,)13

,-,),/), ,)13

,-2),),),

,-2),),),

,-2) ),),

,-2) ),),

1,),-3),2,),,053 3

1,),-3),2,),,053 3

,-,),,)4 )24

,-,),,)4 )24

,-0)4 )33).3

,-0)4 )33).3

- /),22)4-)13

- /),22)4-)13

-, )2/),/0)-.1

-, )2/),/0)-.1

-, )21) ),..

-, )21) ),..

-,4),-4)-.4)--

-,4),-4)-.4)--

1,),11).-)-

1,),11).-)-

-,4),0.)/ )--,

-,4),0.)/ )--,

-,3)4-),31)-2

-,3)4-),31)-2

-,4),0.)/1)-2

-,4),0.)/1)-2

-,4),0.)0-),-.

-,4),0.)0-),-.

--,),40)/-)2,

--,),40)/-)2,

---)2.)-,3),,0

---)2.)-,3),,0

- .),, ),13)-..53

- .),, ),13)-..53

- .),, ),13)--,53

- .),, ),13)--,53

.1.ss)^jh

.1.ss)^jh

04)./),.,)0/

04)./),.,)0/

-, )0,)/0)0

-, )0,)/0)0

04)./),43)--3

04)./),43)--3

04)./),43)33

04)./),43)33

04)./),43)42

04)./),43)42

1 ),4 ),,/), ,

1 ),4 ),,/), ,

1 ),4 )-,3)./

1 ),4 )-,3)./

1 ),4,),-/)-0-

1 ),4,),-/)-0-

1,),/0),,2)-,-

1,),/0),,2)-,-

1,),02), 4)---

1,),02), 4)---

20),-1).)-,1

20),-1).)-,1

20),-1).)-,2

20),-1).)-,2

20),-1).)-,3

20),-1).)-,3

04),-0)-.,),225,2222

04),-0)-.,),225,2222

20),-1).)--

20),-1).)--

20),-1).)--,

20),-1).)--,

20),-1).)---

20),-1).)---

.text

.text

`.rdata

`.rdata

@.data

@.data

r4.Tq:]du

r4.Tq:]du

7'7,71767<</pre><pre>a .Mt</pre><pre>B .rd</pre><pre>KERNEL32.DLL</pre><pre>MSVCRT.dll</pre><pre>1, 0, 0, 1</pre><pre>notepad.EXE</pre><pre>4, 3, 1, 1</pre><b>%original file name%.exe_136_rwx_00401000_0001A000:</b><pre>GetWindowsDirectoryA</pre><pre>WinExec</pre><pre>tp://localhost/1.html</pre><pre>\phpq.dll</pre><pre>rundll32.exe func.dll, droqp</pre><pre>\system32\func.dll</pre><pre>cmd /c taskkill /im ScanFrm.exe /f</pre><pre>cmd /c taskkill /im egui.exe /f</pre><pre>cmd /c taskkill /im ekrn.exe /f</pre><pre>cmd /c sc config ekrn start= disabled</pre><pre>cmd /c cacls "%s" /e /p everyone:f</pre><pre>cmd /c cacls %s /e /p everyone:f</pre><pre>\temp\explorer.exe</pre><pre>\drivers\gm.dls</pre><pre>Explorer.EXE</pre><pre>explorer.EXE</pre><pre>EXPLORER.EXE</pre><pre>EXPLORER.exe</pre><pre>Explorer.exe</pre><pre>explorer.exe</pre><pre>kjk.om\k)`s`</pre><pre>Ci=l_[n_Msg\ifc]Fche</pre><pre>,-2) ) ),</pre><pre>,-2) ) )-</pre><pre>,-2) ) ).</pre><pre>,-2) ) ) </pre><pre>,-,),/), ,)13</pre><pre>,-2),),),</pre><pre>,-2) ),),</pre><pre>1,),-3),2,),,053 3 </pre><pre>,-,),,)4 )24</pre><pre>,-0)4 )33).3</pre><pre>- /),22)4-)13</pre><pre>-, )2/),/0)-.1</pre><pre>-, )21) ),..</pre><pre>-,4),-4)-.4)-- </pre><pre>1,),11).-)-</pre><pre>-,4),0.)/ )--,</pre><pre>-,3)4-),31)-2</pre><pre>-,4),0.)/1)-2</pre><pre>-,4),0.)0-),-.</pre><pre>--,),40)/-)2,</pre><pre>---)2.)-,3),,0</pre><pre>- .),, ),13)-..53 </pre><pre>- .),, ),13)--,53 </pre><pre>.1.ss)^jh</pre><pre>04)./),.,)0/</pre><pre>-, )0,)/0)0</pre><pre>04)./),43)--3</pre><pre>04)./),43)33</pre><pre>04)./),43)42</pre><pre>1 ),4 ),,/), ,</pre><pre>1 ),4 )-,3)./</pre><pre>1 ),4,),-/)-0-</pre><pre>1,),/0),,2)-,-</pre><pre>1,),02), 4)---</pre><pre>20),-1).)-,1</pre><pre>20),-1).)-,2</pre><pre>20),-1).)-,3</pre><pre>04),-0)-.,),225,2222</pre><pre>20),-1).)-- </pre><pre>20),-1).)--,</pre><pre>20),-1).)---</pre><pre>.text</pre><pre>`.rdata</pre><pre>@.data</pre><pre>.rsrc</pre><pre>r4.Tq:]du</pre><pre>7'7,71767<</pre><b>%original file name%.exe_136_rwx_10000000_00001000:</b><pre>.data</pre><pre>.rsrc</pre><pre>@.reloc</pre><pre>psapi.dll</pre><pre>\patch.exe</pre><pre>\dstdisk.exe</pre><pre>\defence.exe</pre><pre>192yuioealdjfiefjsdfas.txt</pre><pre>%SystemRoot%\System32\DRIVERS\puid.sys</pre><pre>\drivers\pcidump.sys</pre><pre>System32\DRIVERS\pcidump.sys</pre><pre>%SystemRoot%\system32\drivers\puid.sys</pre><pre>\\.\pcidump</pre><pre>\drivers\gm.dls</pre><pre>Windows</pre><pre>1.exe</pre><pre>autorun.inf</pre><pre>Open=1.exe</pre><pre>urlmon</pre><pre>\setup.exe</pre><pre>?mac=%s&ver=%s&key=%d&os=windows</pre><pre>.html</pre><pre>.hhqg</pre><pre>qq.exe</pre><pre>360safe.exe</pre><pre>\explorer.exe</pre><pre>\temp\explorer.exe</pre><pre>nfect_exe</pre><b>%original file name%.exe_136_rwx_10005000_00001000:</b><pre>\??\c:\%original file name%.exe</pre><pre>\??\%WinDir%\explorer.exe</pre><pre>ers\gm.dls</pre><pre>WinExec</pre><pre>CreatePipe</pre><pre>GetWindowsDirectoryA</pre><pre>KERNEL32.dll</pre><pre>USER32.dll</pre><pre>ADVAPI32.dll</pre><pre>InternetOpenUrlA</pre><pre>WININET.dll</pre><b>rundll32.exe_1720:</b><pre>.text</pre><pre>`.data</pre><pre>.rsrc</pre><pre>msvcrt.dll</pre><pre>KERNEL32.dll</pre><pre>NTDLL.DLL</pre><pre>GDI32.dll</pre><pre>USER32.dll</pre><pre>IMAGEHLP.dll</pre><pre>rundll32.pdb</pre><pre>.....eZXnnnnnnnnnnnn3</pre><pre>....eDXnnnnnnnnnnnn3</pre><pre>...eDXnnnnnnnnnnnn,</pre><pre>.eDXnnnnnnnnnnnn,</pre><pre>%Xnnnnnnnnnnnnnnn1</pre><pre>O3$dS7"%U9</pre><pre>.manifest</pre><pre>5.1.2600.5512 (xpsp.080413-2105)</pre><pre>RUNDLL.EXE</pre><pre>Windows</pre><pre>Operating System</pre><pre>5.1.2600.5512</pre><pre>YThere is not enough memory to run the file %s.</pre><pre>Please close other windows and try again.</pre><pre>9The file %s or one of its components could not be opened.</pre><pre>0The file %s or one of its components cannot run.</pre><pre>MThe file %s or one of its components requires a different version of Windows.</pre><pre>UThe file %s or one of its components cannot run in standard or enhanced mode Windows.3Another instance of the file %s is already running./An exception occurred while trying to run "%s"</pre><pre>Error in %s</pre><pre>Missing entry:%s</pre><pre>Error loading %s</pre></pre>


Related articles