HEUR:Backdoor.Win32.CosmicDuke.gen (Kaspersky), Gen:Variant.Graftor.147251 (B) (Emsisoft), Gen:Variant.Graftor.147251 (AdAware)Behaviour: Backdoor
The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.
Summary
MD5: 1276d0aa5ad16fb57426be3050a9bb0b
SHA1: c0003644554da09fed52c9d71b985100c0742a00
SHA256: eaef3614766b3be5b88a375f5c96f005056b6253e432059eb38e8c679f6cd679
SSDeep: 6144:Jn EelAZ9fPaGwMILw xotaLZ1rRQWsBqqjM6LoOIKW5j:xe6TfPaGw/w xoWKWsVjM6UOMF
Size: 1088092 bytes
File type: EXE
Platform: WIN32
Entropy: Not Packed
PEID: UPolyXv05_v6
Company: no certificate found
Created at: 2012-11-13 11:53:11
Analyzed on: WindowsXP SP3 32-bit
Summary: Backdoor. Malware that enables a remote control of victim's machine.
Dynamic Analysis
Payload
No specific payload has been found.
Process activity
The Backdoor creates the following process(es):
winpdb.exe:332
The Backdoor injects its code into the following process(es):
%original file name%.exe:328
cmswdm.exe:1356
Mutexes
The following mutexes were created/opened:No objects were found.
File activity
The process %original file name%.exe:328 makes changes in the file system.
The Backdoor creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Desktop\Total Commander.lnk (1 bytes)
%Documents and Settings%\All Users\Documents\ntuser{4CB43D7F-7EEE-4906-8698-FFFFFFFF80A5F801}.pol (4 bytes)
%Documents and Settings%\All Users\Documents\ntuser{4CB43D7F-7EEE-4906-8698-FFFFFFFF80CD9101}.pol (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%System%\winpdb.exe (194 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\objwm.exe (7495 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\apisql.exe (8417 bytes)
%System%\cmswdm.exe (7675 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\Address Book\adm.wab (4250 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\tapidsp.exe (7490 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\2c1c2a37-c472-4c0c-a481-6487a06d0372 (5 bytes)
%Documents and Settings%\All Users\Documents\ntuser{4CB43D7F-7EEE-4906-8698-FFFFFFFF70141501}.pol (24 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk (1 bytes)
%Documents and Settings%\All Users\Desktop\Adobe Reader 9.lnk (1 bytes)
%System%\srvinf.exe (8009 bytes)
%Documents and Settings%\All Users\Documents\ntuser{4CB43D7F-7EEE-4906-8698-FFFFFFFF80156501}.pol (4 bytes)
%WinDir%\Tasks\Watchmon Service.job (290 bytes)
%Documents and Settings%\All Users\Documents\ntuser{4CB43D7F-7EEE-4906-8698-FFFFFFFF70AA0201}.pol (4 bytes)
%Documents and Settings%\All Users\Documents\ntuser{4CB43D7F-7EEE-4906-8698-FFFFFFFF8094E303}.pol (4 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\Internet Explorer\Quick Launch\Wireshark.lnk (1 bytes)
The process cmswdm.exe:1356 makes changes in the file system.
The Backdoor creates and/or writes to the following file(s):
%Documents and Settings%\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\GX23KPCP\desktop.ini (67 bytes)
%Documents and Settings%\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\W8EBSI63\desktop.ini (67 bytes)
%Documents and Settings%\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\7J4KIJM1\desktop.ini (67 bytes)
%Documents and Settings%\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\IRU2W0P2\desktop.ini (67 bytes)
The Backdoor deletes the following file(s):
%Documents and Settings%\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\CHEZ8TER (0 bytes)
%Documents and Settings%\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\CHEZ8TER\desktop.ini (0 bytes)
%Documents and Settings%\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\S96BCDQ7\desktop.ini (0 bytes)
%Documents and Settings%\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\KP27CLYF (0 bytes)
%Documents and Settings%\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\O167C5I7\desktop.ini (0 bytes)
%Documents and Settings%\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\KP27CLYF\desktop.ini (0 bytes)
%Documents and Settings%\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\O167C5I7 (0 bytes)
%Documents and Settings%\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\S96BCDQ7 (0 bytes)
Registry activity
The process winpdb.exe:332 makes changes in the system registry.
The Backdoor creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "7C B7 02 8F C2 B0 4B 07 93 50 95 12 E8 DF 23 B2"
The process %original file name%.exe:328 makes changes in the system registry.
The Backdoor creates and/or sets the following values in system registry:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\WLanDiagCtlGuid]
"BitNames" = " WLANHC_AUTOCONFIG WLANHC_RNWFMSM WLANHC_FATMSM WLANHC_DLLMAIN WLANHC_TEST"
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing]
"Active" = "1"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"
[HKLM\SOFTWARE\JavaSoft]
"Supplement" = "22 00 43 00 3A 00 5C 00 57 00 49 00 4E 00 44 00"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1D 00 00 00 01 00 00 00 00 00 00 00"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Start Menu" = "%Documents and Settings%\All Users\Start Menu"
[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
[HKCU\Software\Microsoft\WAB\WAB4\Wab File Name]
"(Default)" = "%Documents and Settings%\%current user%\Application Data\Microsoft\Address Book\adm.wab"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
"Startup" = "%Documents and Settings%\%current user%\Start Menu\Programs\Startup"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"
[HKCU\Software\Microsoft\WAB\WAB4]
"OlkFolderRefresh" = "0"
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\CtlGuid]
"BitNames" = " DOT11_ASSOCIATE DOT11_ROAMING DOT11_1X DOT11_PNP DOT11_SCAN DOT11_RECEIVE DOT11_SEND DOT11_IOCTL DOT11_OID DOT11_MISC DOT11_UPCALL DOT11_KEYMGR DOT11_PEER DOT11_SOFTAP DOT11_PAM DOT11_REPEATER DOT11_APROUTER DOT11_WME DOT11_CONFIG DOT11_MSM DOT11_MSM_ADAPT DOT11_MSM_SCAN DOT11_MSM_CONNECT DOT11_MSM_SECURITY_PKT DOT11_NOTIFY_OBJECT"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonMusic" = "%Documents and Settings%\All Users\Documents\My Music"
[HKCU\Identities\{37E80C13-CB45-4DCE-A438-545B791476AC}]
"Identity Ordinal" = "1"
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing]
"ControlFlags" = "1"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing]
"LogSessionName" = "stdout"
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\CtlGuid]
"Guid" = "d905ac1c-65e7-4242-99ea-fe66a8355df8"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"My Pictures" = "%Documents and Settings%\%current user%\My Documents\My Pictures"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Startup" = "%Documents and Settings%\All Users\Start Menu\Programs\Startup"
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\DiagL2SecCtlGuid]
"Guid" = "2e8d9ec5-a712-48c4-8ce0-631eb0c1cd65"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced]
"EnableBalloonTips" = "0"
[HKCU\Identities]
"Identity Ordinal" = "2"
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\ServiceCtlGuid]
"BitNames" = " DOT11_AUTOCONF DOT11_AUTOCONF_CLIENT DOT11_AUTOCONF_UI DOT11_FATMSM DOT11_COMMON DOT11_WLANGPA DOT11_CLASS_COINSTALLER"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Start Menu" = "%Documents and Settings%\%current user%\Start Menu"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonVideo" = "%Documents and Settings%\All Users\Documents\My Videos"
"CommonPictures" = "%Documents and Settings%\All Users\Documents\My Pictures"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "4A 65 EF 3D 4D CF 21 97 66 D6 14 47 2C CD 8E F3"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\ServiceCtlGuid]
"Guid" = "0c5a3172-2248-44fd-b9a6-8389cb1dc56a"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\WDiagCoreCtlGuid]
"BitNames" = " WD_LOG_FLAG_INIT WD_LOG_FLAG_RPC WD_LOG_FLAG_EVENT WD_LOG_FLAG_INTERFACE WD_LOG_FLAG_CONNECTION WD_LOG_FLAG_CONTROL WD_LOG_FLAG_LOCKS WD_LOG_FLAG_MEMORY WD_LOG_FLAG_REFERENCES WD_LOG_FLAG_FUNCTION_TRACE WD_LOG_FLAG_ASSERT"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\DiagL2SecCtlGuid]
"BitNames" = " SECHC_LOG_FLAG_ASSERT SECHC_LOG_FLAG_INIT SECHC_LOG_FLAG_DIAG SECHC_LOG_FLAG_ONEX_DIAG SECHC_LOG_FLAG_REPAIR SECHC_LOG_FLAG_STATE SECHC_LOG_FLAG_EXT SECHC_LOG_FLAG_EVENT_LOG SECHC_LOG_FLAG_FUNCTION SECHC_LOG_FLAG_MEMORY SECHC_LOG_FLAG_LOCKS"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Recent" = "%Documents and Settings%\%current user%\Recent"
[HKCU\Software\Microsoft\WAB\WAB4]
"OlkContactRefresh" = "0"
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\WLanDiagCtlGuid]
"Guid" = "6da4ddca-0901-4bae-9ad4-7e6030bab531"
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\WDiagCoreCtlGuid]
"Guid" = "637a0f36-dff5-4b2f-83dd-b106c1c725e2"
Proxy settings are disabled:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
The Backdoor deletes the following value(s) in system registry:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride"
[HKCU\Identities]
"Changing"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"
"AutoConfigURL"
[HKCU\Identities]
"OutgoingID"
"IncomingID"
The process cmswdm.exe:1356 makes changes in the system registry.
The Backdoor creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "6F B9 EB 6C 0B D4 76 4E 54 67 CF CD FF 2D 79 38"
[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\NetworkService\Cookies"
[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 03 00 00 00 01 00 00 00 00 00 00 00"
[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\Cache2"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\Cache1"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\NetworkService\Local Settings\Temporary Internet Files\Content.IE5"
[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\NetworkService\Local Settings\History"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\Cache4"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\Cache3"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"
[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced]
"EnableBalloonTips" = "0"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"
[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\NetworkService\Local Settings\Temporary Internet Files"
Proxy settings are disabled:
[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
The Backdoor deletes the following value(s) in system registry:
[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride"
"AutoConfigURL"
"ProxyServer"
Dropped PE files
MD5 | File path |
---|---|
492756a2e8ccc85b6db827b3da975985 | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\apisql.exe |
17d000479b93ea97277164ab0e97f99d | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\tapidsp.exe |
b59199877e0d68a5e93fc8ea76374ed1 | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\mgrhost.exe |
5098efd4fdc5fd591c65f9d850e07b30 | c:\WINDOWS\system32\cmswdm.exe |
eed550d95c90cd155288a2e609d37288 | c:\WINDOWS\system32\winpdb.exe |
HOSTS file anomalies
No changes have been detected.
Rootkit activity
No anomalies have been detected.
Propagation
Removals
Remove it with Ad-Aware
- Click (here) to download and install Ad-Aware Free Antivirus.
- Update the definition files.
- Run a full scan of your computer.
Manual removal*
- Terminate malicious process(es) (How to End a Process With the Task Manager):
winpdb.exe:332
- Delete the original Backdoor file.
- Delete or disinfect the following files created/modified by the Backdoor:
%Documents and Settings%\%current user%\Desktop\Total Commander.lnk (1 bytes)
%Documents and Settings%\All Users\Documents\ntuser{4CB43D7F-7EEE-4906-8698-FFFFFFFF80A5F801}.pol (4 bytes)
%Documents and Settings%\All Users\Documents\ntuser{4CB43D7F-7EEE-4906-8698-FFFFFFFF80CD9101}.pol (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%System%\winpdb.exe (194 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\objwm.exe (7495 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\apisql.exe (8417 bytes)
%System%\cmswdm.exe (7675 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\Address Book\adm.wab (4250 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\tapidsp.exe (7490 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\2c1c2a37-c472-4c0c-a481-6487a06d0372 (5 bytes)
%Documents and Settings%\All Users\Documents\ntuser{4CB43D7F-7EEE-4906-8698-FFFFFFFF70141501}.pol (24 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk (1 bytes)
%Documents and Settings%\All Users\Desktop\Adobe Reader 9.lnk (1 bytes)
%System%\srvinf.exe (8009 bytes)
%Documents and Settings%\All Users\Documents\ntuser{4CB43D7F-7EEE-4906-8698-FFFFFFFF80156501}.pol (4 bytes)
%WinDir%\Tasks\Watchmon Service.job (290 bytes)
%Documents and Settings%\All Users\Documents\ntuser{4CB43D7F-7EEE-4906-8698-FFFFFFFF70AA0201}.pol (4 bytes)
%Documents and Settings%\All Users\Documents\ntuser{4CB43D7F-7EEE-4906-8698-FFFFFFFF8094E303}.pol (4 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\Internet Explorer\Quick Launch\Wireshark.lnk (1 bytes)
%Documents and Settings%\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\GX23KPCP\desktop.ini (67 bytes)
%Documents and Settings%\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\W8EBSI63\desktop.ini (67 bytes)
%Documents and Settings%\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\7J4KIJM1\desktop.ini (67 bytes)
%Documents and Settings%\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\IRU2W0P2\desktop.ini (67 bytes) - Reboot the computer.
Static Analysis
VersionInfo
Company Name: NVIDIA Corporation
Product Name: NVIDIA Update Components
Product Version: 1.5.20.0
Legal Copyright: (C) NVIDIA Corporation. All rights reserved.
Legal Trademarks:
Original Filename: WLMerger.exe
Internal Name: WLMerger
File Version: 1.5.20.0
File Description: WLMerger Application
Comments:
Language: Chinese (Simplified, PRC)
Company Name: NVIDIA CorporationProduct Name: NVIDIA Update ComponentsProduct Version: 1.5.20.0Legal Copyright: (C) NVIDIA Corporation. All rights reserved.Legal Trademarks: Original Filename: WLMerger.exeInternal Name: WLMergerFile Version: 1.5.20.0File Description: WLMerger ApplicationComments: Language: Chinese (Simplified, PRC)
PE Sections
Name | Virtual Address | Virtual Size | Raw Size | Entropy | Section MD5 |
---|---|---|---|---|---|
.text | 4096 | 136669 | 136704 | 4.55502 | 1625282d8e32880dcd64cf0d83d477c1 |
.rdata | 143360 | 25436 | 25600 | 3.34715 | 7da2f39fc2e605b68d02fb73d4804721 |
.data | 172032 | 1587268 | 530432 | 1.98944 | 48dcab11fabcb0c8bdd4435691adbf71 |
.rsrc | 1761280 | 4082 | 4096 | 2.31339 | 9088c985e60466a1c6ecf3698c760444 |
Dropped from:
Downloaded by:
Similar by SSDeep:
Similar by Lavasoft Polymorphic Checker:
Total found: 1
0e7dff2fbb12d94fb08ac78d58e5219c
Network Activity
URLs
IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)
Traffic
Map
The Backdoor connects to the servers at the folowing location(s):
Strings from Dumps
%original file name%.exe_328_rwx_00400000_00020000:
.text
.text
`.rdata
`.rdata
@.data
@.data
.rsrc
.rsrc
PSSSSSSh
PSSSSSSh
PSSSSSSh#
PSSSSSSh#
PSSSSSSh"
PSSSSSSh"
SSj%S
SSj%S
SSh|fB
SSh|fB
tÂ$
tÂ$
%original file name%.exe_328_rwx_00420000_00020000:
F%D,3
F%D,3
.mixcrt
.mixcrt
KERNEL32.DLL
KERNEL32.DLL
mscoree.dll
mscoree.dll
Please contact the application's support team for more information.
Please contact the application's support team for more information.
- Attempt to initialize the CRT more than once.
- Attempt to initialize the CRT more than once.
- CRT not initialized
- CRT not initialized
- floating point support not loaded
- floating point support not loaded
kernel32.dll
kernel32.dll
operator
operator
GetProcessWindowStation
GetProcessWindowStation
USER32.DLL
USER32.DLL
?456789:;
?456789:;
!"#$%&'()* ,-./0123
!"#$%&'()* ,-./0123
NetGetJoinInformation
NetGetJoinInformation
FtpOpenFileW
FtpOpenFileW
FtpSetCurrentDirectoryW
FtpSetCurrentDirectoryW
XX
XX
URLOpenBlockingStreamW
URLOpenBlockingStreamW
PK11_GetInternalKeySlot
PK11_GetInternalKeySlot
sqlite3_open16
sqlite3_open16
sqlite3_close
sqlite3_close
sqlite3_exec
sqlite3_exec
sqlite3_free
sqlite3_free
select id, hostname, usernamefield, passwordfield, encryptedusername, encryptedpassword from moz_logins
select id, hostname, usernamefield, passwordfield, encryptedusername, encryptedpassword from moz_logins
abe2869f-9b47-4cd9-a358-c22904dba7f7
abe2869f-9b47-4cd9-a358-c22904dba7f7
82BD0E67-9FEA-4748-8672-D5EFE5B779B0
82BD0E67-9FEA-4748-8672-D5EFE5B779B0
c:\botgenstudio\generations\55ff7700\bin\Bot.pdb
c:\botgenstudio\generations\55ff7700\bin\Bot.pdb
GetWindowsDirectoryW
GetWindowsDirectoryW
CreateNamedPipeW
CreateNamedPipeW
KERNEL32.dll
KERNEL32.dll
GetKeyboardType
GetKeyboardType
GetKeyboardState
GetKeyboardState
GetAsyncKeyState
GetAsyncKeyState
GetKeyboardLayout
GetKeyboardLayout
SetProcessWindowStation
SetProcessWindowStation
GetKeyboardLayoutNameW
GetKeyboardLayoutNameW
USER32.dll
USER32.dll
GDI32.dll
GDI32.dll
RegOpenKeyExW
RegOpenKeyExW
RegEnumKeyW
RegEnumKeyW
RegCreateKeyExW
RegCreateKeyExW
RegOpenKeyW
RegOpenKeyW
RegCloseKey
RegCloseKey
RegQueryInfoKeyW
RegQueryInfoKeyW
CryptDestroyKey
CryptDestroyKey
CryptImportKey
CryptImportKey
CryptSetKeyParam
CryptSetKeyParam
ADVAPI32.dll
ADVAPI32.dll
ShellExecuteExW
ShellExecuteExW
SHFileOperationW
SHFileOperationW
SHELL32.dll
SHELL32.dll
ole32.dll
ole32.dll
OLEAUT32.dll
OLEAUT32.dll
RPCRT4.dll
RPCRT4.dll
IPHLPAPI.DLL
IPHLPAPI.DLL
WTSAPI32.dll
WTSAPI32.dll
Secur32.dll
Secur32.dll
WININET.dll
WININET.dll
WS2_32.dll
WS2_32.dll
SHLWAPI.dll
SHLWAPI.dll
CertCloseStore
CertCloseStore
PFXExportCertStoreEx
PFXExportCertStoreEx
CertOpenStore
CertOpenStore
CRYPT32.dll
CRYPT32.dll
GetProcessHeap
GetProcessHeap
GetCPInfo
GetCPInfo
HTTP/1.1
HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; InfoPath.2)
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; InfoPath.2)
Content-Type: application/x-www-form-urlencoded
Content-Type: application/x-www-form-urlencoded
.text
.text
`.rdata
`.rdata
32.dll
32.dll
KeyW
KeyW
echo del %0 >> "%TEMP%\msicheck.cmd"
echo del %0 >> "%TEMP%\msicheck.cmd"
echo copy /y "%SYSTEMROOT%\system32\ping.exe" "%TEMP%\smss.exe" >> "%TEMP%\msicheck.cmd"
echo copy /y "%SYSTEMROOT%\system32\ping.exe" "%TEMP%\smss.exe" >> "%TEMP%\msicheck.cmd"
echo :z >> "%TEMP%\msicheck.cmd"
echo :z >> "%TEMP%\msicheck.cmd"
echo del %1 >> "%TEMP%\msicheck.cmd"
echo del %1 >> "%TEMP%\msicheck.cmd"
echo "%TEMP%\smss.exe" 127.1 -n
echo "%TEMP%\smss.exe" 127.1 -n
>> "%TEMP%\msicheck.cmd"
>> "%TEMP%\msicheck.cmd"
echo attrib -s -h %1 >> "%TEMP%\msicheck.cmd"
echo attrib -s -h %1 >> "%TEMP%\msicheck.cmd"
echo if exist %1 goto z >> "%TEMP%\msicheck.cmd"
echo if exist %1 goto z >> "%TEMP%\msicheck.cmd"
echo del "%TEMP%\smss.exe" >> "%TEMP%\msicheck.cmd"
echo del "%TEMP%\smss.exe" >> "%TEMP%\msicheck.cmd"
echo del "%TEMP%\msicheck.cmd" >> "%TEMP%\msicheck.cmd"
echo del "%TEMP%\msicheck.cmd" >> "%TEMP%\msicheck.cmd"
"%SYSTEMROOT%\system32\cmd.exe" /c "%TEMP%\msicheck.cmd"
"%SYSTEMROOT%\system32\cmd.exe" /c "%TEMP%\msicheck.cmd"
zcÃ
zcÃ
c:\%original file name%.exe
c:\%original file name%.exe
\system32\cmd.exe
\system32\cmd.exe
cmd.exe
cmd.exe
savadminservice.exe
savadminservice.exe
scfservice.exe
scfservice.exe
savservice.exe
savservice.exe
ekrn.exe
ekrn.exe
msseces.exe
msseces.exe
MsMpEng.exe
MsMpEng.exe
dwengine.exe
dwengine.exe
ekern.exe
ekern.exe
nod32.exe
nod32.exe
nod32krn.exe
nod32krn.exe
AvastUi.exe
AvastUi.exe
AvastSvc.exe
AvastSvc.exe
kav.exe
kav.exe
navapsvc.exe
navapsvc.exe
mcods.exe
mcods.exe
mcvsescn.exe
mcvsescn.exe
outpost.exe
outpost.exe
acs.exe
acs.exe
avp.exe
avp.exe
ntdll.dll
ntdll.dll
crypt32.dll
crypt32.dll
MyKeyContainer
MyKeyContainer
hXXp://
hXXp://
Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
Software\Microsoft\Windows NT\CurrentVersion
Software\Microsoft\Windows NT\CurrentVersion
wininet.dll
wininet.dll
ntuser{4CB43D7F-7EEE-4906-8698-
ntuser{4CB43D7F-7EEE-4906-8698-
}.pol
}.pol
\\.\pipe\4012D44D-F62E-093E-8A91-736FF2FA2AA2
\\.\pipe\4012D44D-F62E-093E-8A91-736FF2FA2AA2
*.exe;*.ndb;*.mp3;*.avi
*.exe;*.ndb;*.mp3;*.avi
*temporary;*Cookies;*games;*system32;*program files;*\windows;*\System Volume Information
*temporary;*Cookies;*games;*system32;*program files;*\windows;*\System Volume Information
*.doc;*.xps;*.xls;*.ppt;*.pps;*.wps;*.wpd;*.ods;*.odt;*.lwp;*.jtd;*.pdf;*.zip;*.rar;*.docx;*.url;*.xlsx;*.pptx;*.ppsx;*.pst;*.ost;*psw*;*pass*;*login*;*admin*;*sifr*;*sifer*;*vpn;*.jpg;*.txt;*.lnk
*.doc;*.xps;*.xls;*.ppt;*.pps;*.wps;*.wpd;*.ods;*.odt;*.lwp;*.jtd;*.pdf;*.zip;*.rar;*.docx;*.url;*.xlsx;*.pptx;*.ppsx;*.pst;*.ost;*psw*;*pass*;*login*;*admin*;*sifr*;*sifer*;*vpn;*.jpg;*.txt;*.lnk
*.exe;*.dll;*.tmp;*.obj;*.ocx;*.js
*.exe;*.dll;*.tmp;*.obj;*.ocx;*.js
*temporary;*Cookies;*games;*system32;*program files;*\windows\;*\System Volume Information
*temporary;*Cookies;*games;*system32;*program files;*\windows\;*\System Volume Information
>\config.xml
>\config.xml
netapi32.dll
netapi32.dll
oiphlpapi.dll
oiphlpapi.dll
*.lnk
*.lnk
Shell32.dll
Shell32.dll
Microsoft\Windows\Media Center\PBDARegisterSW
Microsoft\Windows\Media Center\PBDARegisterSW
WXX
WXX
XXXXXXXXXXX
XXXXXXXXXXX
=X&
=X&
=XX&
=XX&
urlmon.dll
urlmon.dll
XXXXXX
XXXXXX
SECURITY\Policy\PolSecretEncryptionKey
SECURITY\Policy\PolSecretEncryptionKey
wlanapi.dll
wlanapi.dll
Web Data
Web Data
Login Data
Login Data
Google\Chrome\User Data\Default\
Google\Chrome\User Data\Default\
hXXp://VVV.facebook.com/login.php
hXXp://VVV.facebook.com/login.php
hXXps://login.facebook.com/login.php
hXXps://login.facebook.com/login.php
hXXp://VVV.facebook.com/
hXXp://VVV.facebook.com/
hXXp://VVV.facebook.com/index.php
hXXp://VVV.facebook.com/index.php
hXXp://m.facebook.com/login.php
hXXp://m.facebook.com/login.php
hXXp://m.myspace.com/login.wap
hXXp://m.myspace.com/login.wap
hXXp://VVV.myspace.com/
hXXp://VVV.myspace.com/
hXXp://VVV.myspace.com/index.cfm
hXXp://VVV.myspace.com/index.cfm
hXXp://babelfish.yahoo.com/translate_url
hXXp://babelfish.yahoo.com/translate_url
hXXp://services.msn.com/svcs/hotmail/httpmail.asp
hXXp://services.msn.com/svcs/hotmail/httpmail.asp
hXXp://google.com/
hXXp://google.com/
hXXps://VVV.google.com/analytics/reporting/login
hXXps://VVV.google.com/analytics/reporting/login
hXXps://VVV.google.com/groups/signin
hXXps://VVV.google.com/groups/signin
hXXps://VVV.google.com/accounts/ManageAccount
hXXps://VVV.google.com/accounts/ManageAccount
hXXp://VVV.google.com/
hXXp://VVV.google.com/
hXXps://VVV.google.com/accounts/Login
hXXps://VVV.google.com/accounts/Login
hXXp://mail.google.com/mail/
hXXp://mail.google.com/mail/
hXXps://VVV.google.com/accounts/ServiceLoginAuth
hXXps://VVV.google.com/accounts/ServiceLoginAuth
hXXps://VVV.google.com/accounts/ServiceLogin
hXXps://VVV.google.com/accounts/ServiceLogin
wand.dat
wand.dat
\Application Data\Opera
\Application Data\Opera
nx
nx
%s::%s --> %s (decrypted: %s)
%s::%s --> %s (decrypted: %s)
%s::%s --> %s
%s::%s --> %s
%s::%s
%s::%s
Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676
Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676
\account.cfn
\account.cfn
nss3.dll
nss3.dll
sqlite3.dll
sqlite3.dll
mozsqlite3.dll
mozsqlite3.dll
SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\firefox.exe
SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\firefox.exe
SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\thunderbird.exe
SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\thunderbird.exe
Mozilla
Mozilla
signons.sqlite
signons.sqlite
s\Application Data\Mozilla\Firefox\Profiles
s\Application Data\Mozilla\Firefox\Profiles
INTERNET EXPLORER 7.x-8.x HTTPPASS
INTERNET EXPLORER 7.x-8.x HTTPPASS
advapi32.dll
advapi32.dll
pstorec.dll
pstorec.dll
INTERNET EXPLORER 6.x HTTPPASS
INTERNET EXPLORER 6.x HTTPPASS
SMTP
SMTP
Password
Password
POP3 Port
POP3 Port
IMAP Port
IMAP Port
SMTP Port
SMTP Port
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
%Documents and Settings%\All Users\Documents\ntuser{4CB43D7F-7EEE-4906-8698-FFFFFFFF70737200}.pol
%Documents and Settings%\All Users\Documents\ntuser{4CB43D7F-7EEE-4906-8698-FFFFFFFF70737200}.pol
%Documents and Settings%\All Users\Documents\ntuser{4CB43D7F-7EEE-4906-8698-FFFFFFFF70AA0201}.pol
%Documents and Settings%\All Users\Documents\ntuser{4CB43D7F-7EEE-4906-8698-FFFFFFFF70AA0201}.pol
%Documents and Settings%\All Users\Documents\ntuser{4CB43D7F-7EEE-4906-8698-FFFFFFFF70245201}.pol
%Documents and Settings%\All Users\Documents\ntuser{4CB43D7F-7EEE-4906-8698-FFFFFFFF70245201}.pol
%Documents and Settings%\All Users\Documents\ntuser{4CB43D7F-7EEE-4906-8698-FFFFFFFF70775500}.pol
%Documents and Settings%\All Users\Documents\ntuser{4CB43D7F-7EEE-4906-8698-FFFFFFFF70775500}.pol
%Documents and Settings%\All Users\Documents\ntuser{4CB43D7F-7EEE-4906-8698-FFFFFFFF80CD9101}.pol
%Documents and Settings%\All Users\Documents\ntuser{4CB43D7F-7EEE-4906-8698-FFFFFFFF80CD9101}.pol
%Documents and Settings%\All Users\Documents\ntuser{4CB43D7F-7EEE-4906-8698-FFFFFFFF8094E303}.pol
%Documents and Settings%\All Users\Documents\ntuser{4CB43D7F-7EEE-4906-8698-FFFFFFFF8094E303}.pol
iphlpapi.dll
iphlpapi.dll
c:\program files\common files\
c:\program files\common files\
6, 1, 1, 1
6, 1, 1, 1
javacc.exe
javacc.exe
cmswdm.exe_1356_rwx_00400000_00020000:
.text
.text
`.rdata
`.rdata
@.data
@.data
.rsrc
.rsrc
PSSSSSSh
PSSSSSSh
PSSSSSSh#
PSSSSSSh#
PSSSSSSh"
PSSSSSSh"
SSj%S
SSj%S
SSh|fB
SSh|fB
tÂ$
tÂ$
cmswdm.exe_1356_rwx_00420000_00020000:
F%D,3
F%D,3
.mixcrt
.mixcrt
KERNEL32.DLL
KERNEL32.DLL
mscoree.dll
mscoree.dll
Please contact the application's support team for more information.
Please contact the application's support team for more information.
- Attempt to initialize the CRT more than once.
- Attempt to initialize the CRT more than once.
- CRT not initialized
- CRT not initialized
- floating point support not loaded
- floating point support not loaded
kernel32.dll
kernel32.dll
operator
operator
GetProcessWindowStation
GetProcessWindowStation
USER32.DLL
USER32.DLL
?456789:;
?456789:;
!"#$%&'()* ,-./0123
!"#$%&'()* ,-./0123
NetGetJoinInformation
NetGetJoinInformation
FtpOpenFileW
FtpOpenFileW
FtpSetCurrentDirectoryW
FtpSetCurrentDirectoryW
XX
XX
URLOpenBlockingStreamW
URLOpenBlockingStreamW
PK11_GetInternalKeySlot
PK11_GetInternalKeySlot
sqlite3_open16
sqlite3_open16
sqlite3_close
sqlite3_close
sqlite3_exec
sqlite3_exec
sqlite3_free
sqlite3_free
select id, hostname, usernamefield, passwordfield, encryptedusername, encryptedpassword from moz_logins
select id, hostname, usernamefield, passwordfield, encryptedusername, encryptedpassword from moz_logins
abe2869f-9b47-4cd9-a358-c22904dba7f7
abe2869f-9b47-4cd9-a358-c22904dba7f7
82BD0E67-9FEA-4748-8672-D5EFE5B779B0
82BD0E67-9FEA-4748-8672-D5EFE5B779B0
c:\botgenstudio\generations\55ff7700\bin\Bot.pdb
c:\botgenstudio\generations\55ff7700\bin\Bot.pdb
GetWindowsDirectoryW
GetWindowsDirectoryW
CreateNamedPipeW
CreateNamedPipeW
KERNEL32.dll
KERNEL32.dll
GetKeyboardType
GetKeyboardType
GetKeyboardState
GetKeyboardState
GetAsyncKeyState
GetAsyncKeyState
GetKeyboardLayout
GetKeyboardLayout
SetProcessWindowStation
SetProcessWindowStation
GetKeyboardLayoutNameW
GetKeyboardLayoutNameW
USER32.dll
USER32.dll
GDI32.dll
GDI32.dll
RegOpenKeyExW
RegOpenKeyExW
RegEnumKeyW
RegEnumKeyW
RegCreateKeyExW
RegCreateKeyExW
RegOpenKeyW
RegOpenKeyW
RegCloseKey
RegCloseKey
RegQueryInfoKeyW
RegQueryInfoKeyW
CryptDestroyKey
CryptDestroyKey
CryptImportKey
CryptImportKey
CryptSetKeyParam
CryptSetKeyParam
ADVAPI32.dll
ADVAPI32.dll
ShellExecuteExW
ShellExecuteExW
SHFileOperationW
SHFileOperationW
SHELL32.dll
SHELL32.dll
ole32.dll
ole32.dll
OLEAUT32.dll
OLEAUT32.dll
RPCRT4.dll
RPCRT4.dll
IPHLPAPI.DLL
IPHLPAPI.DLL
WTSAPI32.dll
WTSAPI32.dll
Secur32.dll
Secur32.dll
WININET.dll
WININET.dll
WS2_32.dll
WS2_32.dll
SHLWAPI.dll
SHLWAPI.dll
CertCloseStore
CertCloseStore
PFXExportCertStoreEx
PFXExportCertStoreEx
CertOpenStore
CertOpenStore
CRYPT32.dll
CRYPT32.dll
GetProcessHeap
GetProcessHeap
GetCPInfo
GetCPInfo
HTTP/1.1
HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; InfoPath.2)
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; InfoPath.2)
Content-Type: application/x-www-form-urlencoded
Content-Type: application/x-www-form-urlencoded
.text
.text
`.rdata
`.rdata
32.dll
32.dll
KeyW
KeyW
echo del %0 >> "%TEMP%\msicheck.cmd"
echo del %0 >> "%TEMP%\msicheck.cmd"
echo copy /y "%SYSTEMROOT%\system32\ping.exe" "%TEMP%\smss.exe" >> "%TEMP%\msicheck.cmd"
echo copy /y "%SYSTEMROOT%\system32\ping.exe" "%TEMP%\smss.exe" >> "%TEMP%\msicheck.cmd"
echo :z >> "%TEMP%\msicheck.cmd"
echo :z >> "%TEMP%\msicheck.cmd"
echo del %1 >> "%TEMP%\msicheck.cmd"
echo del %1 >> "%TEMP%\msicheck.cmd"
echo "%TEMP%\smss.exe" 127.1 -n
echo "%TEMP%\smss.exe" 127.1 -n
>> "%TEMP%\msicheck.cmd"
>> "%TEMP%\msicheck.cmd"
echo attrib -s -h %1 >> "%TEMP%\msicheck.cmd"
echo attrib -s -h %1 >> "%TEMP%\msicheck.cmd"
echo if exist %1 goto z >> "%TEMP%\msicheck.cmd"
echo if exist %1 goto z >> "%TEMP%\msicheck.cmd"
echo del "%TEMP%\smss.exe" >> "%TEMP%\msicheck.cmd"
echo del "%TEMP%\smss.exe" >> "%TEMP%\msicheck.cmd"
echo del "%TEMP%\msicheck.cmd" >> "%TEMP%\msicheck.cmd"
echo del "%TEMP%\msicheck.cmd" >> "%TEMP%\msicheck.cmd"
"%SYSTEMROOT%\system32\cmd.exe" /c "%TEMP%\msicheck.cmd"
"%SYSTEMROOT%\system32\cmd.exe" /c "%TEMP%\msicheck.cmd"
zcÃ
zcÃ
%System%\cmswdm.exe
%System%\cmswdm.exe
\system32\cmd.exe
\system32\cmd.exe
cmd.exe
cmd.exe
savadminservice.exe
savadminservice.exe
scfservice.exe
scfservice.exe
savservice.exe
savservice.exe
ekrn.exe
ekrn.exe
msseces.exe
msseces.exe
MsMpEng.exe
MsMpEng.exe
dwengine.exe
dwengine.exe
ekern.exe
ekern.exe
nod32.exe
nod32.exe
nod32krn.exe
nod32krn.exe
AvastUi.exe
AvastUi.exe
AvastSvc.exe
AvastSvc.exe
kav.exe
kav.exe
navapsvc.exe
navapsvc.exe
mcods.exe
mcods.exe
mcvsescn.exe
mcvsescn.exe
outpost.exe
outpost.exe
acs.exe
acs.exe
avp.exe
avp.exe
ntdll.dll
ntdll.dll
crypt32.dll
crypt32.dll
MyKeyContainer
MyKeyContainer
hXXp://
hXXp://
Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
Software\Microsoft\Windows NT\CurrentVersion
Software\Microsoft\Windows NT\CurrentVersion
wininet.dll
wininet.dll
ntuser{4CB43D7F-7EEE-4906-8698-
ntuser{4CB43D7F-7EEE-4906-8698-
}.pol
}.pol
\\.\pipe\4012D44D-F62E-093E-8A91-736FF2FA2AA2
\\.\pipe\4012D44D-F62E-093E-8A91-736FF2FA2AA2
*.exe;*.ndb;*.mp3;*.avi
*.exe;*.ndb;*.mp3;*.avi
*temporary;*Cookies;*games;*system32;*program files;*\windows;*\System Volume Information
*temporary;*Cookies;*games;*system32;*program files;*\windows;*\System Volume Information
*.doc;*.xps;*.xls;*.ppt;*.pps;*.wps;*.wpd;*.ods;*.odt;*.lwp;*.jtd;*.pdf;*.zip;*.rar;*.docx;*.url;*.xlsx;*.pptx;*.ppsx;*.pst;*.ost;*psw*;*pass*;*login*;*admin*;*sifr*;*sifer*;*vpn;*.jpg;*.txt;*.lnk
*.doc;*.xps;*.xls;*.ppt;*.pps;*.wps;*.wpd;*.ods;*.odt;*.lwp;*.jtd;*.pdf;*.zip;*.rar;*.docx;*.url;*.xlsx;*.pptx;*.ppsx;*.pst;*.ost;*psw*;*pass*;*login*;*admin*;*sifr*;*sifer*;*vpn;*.jpg;*.txt;*.lnk
*.exe;*.dll;*.tmp;*.obj;*.ocx;*.js
*.exe;*.dll;*.tmp;*.obj;*.ocx;*.js
*temporary;*Cookies;*games;*system32;*program files;*\windows\;*\System Volume Information
*temporary;*Cookies;*games;*system32;*program files;*\windows\;*\System Volume Information
>\config.xml
>\config.xml
netapi32.dll
netapi32.dll
oiphlpapi.dll
oiphlpapi.dll
*.lnk
*.lnk
Shell32.dll
Shell32.dll
Microsoft\Windows\Media Center\PBDARegisterSW
Microsoft\Windows\Media Center\PBDARegisterSW
WXX
WXX
XXXXXXXXXXX
XXXXXXXXXXX
=X&
=X&
=XX&
=XX&
urlmon.dll
urlmon.dll
XXXXXX
XXXXXX
SECURITY\Policy\PolSecretEncryptionKey
SECURITY\Policy\PolSecretEncryptionKey
wlanapi.dll
wlanapi.dll
Web Data
Web Data
Login Data
Login Data
Google\Chrome\User Data\Default\
Google\Chrome\User Data\Default\
hXXp://VVV.facebook.com/login.php
hXXp://VVV.facebook.com/login.php
hXXps://login.facebook.com/login.php
hXXps://login.facebook.com/login.php
hXXp://VVV.facebook.com/
hXXp://VVV.facebook.com/
hXXp://VVV.facebook.com/index.php
hXXp://VVV.facebook.com/index.php
hXXp://m.facebook.com/login.php
hXXp://m.facebook.com/login.php
hXXp://m.myspace.com/login.wap
hXXp://m.myspace.com/login.wap
hXXp://VVV.myspace.com/
hXXp://VVV.myspace.com/
hXXp://VVV.myspace.com/index.cfm
hXXp://VVV.myspace.com/index.cfm
hXXp://babelfish.yahoo.com/translate_url
hXXp://babelfish.yahoo.com/translate_url
hXXp://services.msn.com/svcs/hotmail/httpmail.asp
hXXp://services.msn.com/svcs/hotmail/httpmail.asp
hXXp://google.com/
hXXp://google.com/
hXXps://VVV.google.com/analytics/reporting/login
hXXps://VVV.google.com/analytics/reporting/login
hXXps://VVV.google.com/groups/signin
hXXps://VVV.google.com/groups/signin
hXXps://VVV.google.com/accounts/ManageAccount
hXXps://VVV.google.com/accounts/ManageAccount
hXXp://VVV.google.com/
hXXp://VVV.google.com/
hXXps://VVV.google.com/accounts/Login
hXXps://VVV.google.com/accounts/Login
hXXp://mail.google.com/mail/
hXXp://mail.google.com/mail/
hXXps://VVV.google.com/accounts/ServiceLoginAuth
hXXps://VVV.google.com/accounts/ServiceLoginAuth
hXXps://VVV.google.com/accounts/ServiceLogin
hXXps://VVV.google.com/accounts/ServiceLogin
wand.dat
wand.dat
\Application Data\Opera
\Application Data\Opera
nx
nx
%s::%s --> %s (decrypted: %s)
%s::%s --> %s (decrypted: %s)
%s::%s --> %s
%s::%s --> %s
%s::%s
%s::%s
Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676
Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676
\account.cfn
\account.cfn
nss3.dll
nss3.dll
sqlite3.dll
sqlite3.dll
mozsqlite3.dll
mozsqlite3.dll
SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\firefox.exe
SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\firefox.exe
SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\thunderbird.exe
SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\thunderbird.exe
Mozilla
Mozilla
signons.sqlite
signons.sqlite
s\Application Data\Mozilla\Firefox\Profiles
s\Application Data\Mozilla\Firefox\Profiles
INTERNET EXPLORER 7.x-8.x HTTPPASS
INTERNET EXPLORER 7.x-8.x HTTPPASS
advapi32.dll
advapi32.dll
pstorec.dll
pstorec.dll
INTERNET EXPLORER 6.x HTTPPASS
INTERNET EXPLORER 6.x HTTPPASS
SMTP
SMTP
Password
Password
POP3 Port
POP3 Port
IMAP Port
IMAP Port
SMTP Port
SMTP Port
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
%Documents and Settings%\All Users\Documents\ntuser{4CB43D7F-7EEE-4906-8698-FFFFFFFF70737200}.pol
%Documents and Settings%\All Users\Documents\ntuser{4CB43D7F-7EEE-4906-8698-FFFFFFFF70737200}.pol
%Documents and Settings%\All Users\Documents\ntuser{4CB43D7F-7EEE-4906-8698-FFFFFFFF70AA0201}.pol
%Documents and Settings%\All Users\Documents\ntuser{4CB43D7F-7EEE-4906-8698-FFFFFFFF70AA0201}.pol
%Documents and Settings%\All Users\Documents\ntuser{4CB43D7F-7EEE-4906-8698-FFFFFFFF70245201}.pol
%Documents and Settings%\All Users\Documents\ntuser{4CB43D7F-7EEE-4906-8698-FFFFFFFF70245201}.pol
%Documents and Settings%\All Users\Documents\ntuser{4CB43D7F-7EEE-4906-8698-FFFFFFFF70775500}.pol
%Documents and Settings%\All Users\Documents\ntuser{4CB43D7F-7EEE-4906-8698-FFFFFFFF70775500}.pol
%Documents and Settings%\All Users\Documents\ntuser{4CB43D7F-7EEE-4906-8698-FFFFFFFF80CD9101}.pol
%Documents and Settings%\All Users\Documents\ntuser{4CB43D7F-7EEE-4906-8698-FFFFFFFF80CD9101}.pol
%Documents and Settings%\All Users\Documents\ntuser{4CB43D7F-7EEE-4906-8698-FFFFFFFF8094E303}.pol
%Documents and Settings%\All Users\Documents\ntuser{4CB43D7F-7EEE-4906-8698-FFFFFFFF8094E303}.pol
iphlpapi.dll
iphlpapi.dll
c:\program files\common files\
c:\program files\common files\
6, 1, 1, 1
6, 1, 1, 1
javacc.exe
javacc.exe