Skip to main content

Worm.Generic.228477_82b072430d


Trojan-Dropper.Win32.Mudrop.xfj (Kaspersky), Worm.Generic.228477 (B) (Emsisoft), Worm.Generic.228477 (AdAware), GenericAutorunWorm.YR (Lavasoft MAS)Behaviour: Trojan-Dropper, Trojan, Worm, WormAutorun

The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.

Summary

MD5: 82b072430d1842d2093bc56661d8f2d2

SHA1: 49ae0c58912671e08956422dad2f18d955f455b1

SHA256: d13cae34dea3044cb2d44eba19d0bf3228a62dcb5144dc10224a7ef77d145064

SSDeep: 12288:v1dcoCUyZtwAvAs4wTCyrPT0yq0VezaOvoJpaz/g/J/vVoS:vvfty/wAvN7lry0VeH8az/g/J/No

Size: 978432 bytes

File type: EXE

Platform: WIN32

Entropy: Not Packed

PEID: PackerUPXCompresorGratuitowwwupxsourceforgenet, UPolyXv05_v6

Company: no certificate found

Created at: 2009-07-04 18:42:17

Analyzed on: WindowsXP SP3 32-bit

Summary: Worm. A program that is primarily replicating on networks or removable drives.

Dynamic Analysis

Payload

Behaviour Description
WormAutorunA worm can spread via removable drives. It writes its executable and creates "autorun.inf" scripts on all removable drives. The autorun script will execute the Worm's file once a user opens a drive's folder in Windows Explorer.


Process activity

The Worm creates the following process(es):

taskkill.exe:556
taskkill.exe:1180
taskkill.exe:1660
sc.exe:516
ipconfig.exe:576
rundll32.exe:1820
cacls.exe:864
cacls.exe:1640

The Worm injects its code into the following process(es):

%original file name%.exe:984

File activity

The process ipconfig.exe:576 makes changes in the file system.


The Worm creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\drv2 (56 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\temp_wincheck.txt (145171 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\dch3.sys (13122 bytes)

The Worm deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\drv2 (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\dch3.sys (0 bytes)

The process rundll32.exe:1820 makes changes in the file system.


The Worm creates and/or writes to the following file(s):

%System%\drivers\acpiec.sys (13 bytes)

The process %original file name%.exe:984 makes changes in the file system.


The Worm creates and/or writes to the following file(s):

%Documents and Settings% (4 bytes)
%System%\wbem\Repository\FS\OBJECTS.MAP (12 bytes)
%System%\wbem\Repository\FS\INDEX.MAP (4 bytes)
C:\autorun.inf (21 bytes)
%System%\drivers\etc\hosts (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\index.dat (388 bytes)
C:\ (4 bytes)
%Documents and Settings%\Default User (540 bytes)
%Documents and Settings%\All Users (4 bytes)
%WinDir% (892 bytes)
C:\$Directory (12 bytes)
%System%\dllcache (4 bytes)
%System% (3624 bytes)
C:\PROGRAM FILES (8 bytes)
%Documents and Settings%\NetworkService (4 bytes)
%System%\drivers\pcidump.sys (5404535 bytes)
%System%\config (192 bytes)
%WinDir%\Temp\Perflib_Perfdata_7ac.dat (4 bytes)
%System%\drivers (968 bytes)
%WinDir%\phpq.dll (22141559 bytes)
%System%\func.dll (18378359 bytes)
%Documents and Settings%\%current user% (12 bytes)
C:\totalcmd (4 bytes)
%System%\wbem\Repository\FS\MAPPING1.MAP (192 bytes)
C:\1.exe (7345 bytes)
%Documents and Settings%\LocalService (4 bytes)

Registry activity

The process taskkill.exe:556 makes changes in the system registry.


The Worm creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "03 E6 55 31 EF 5C 79 77 28 70 5B F0 C7 C7 BA 99"

The process taskkill.exe:1180 makes changes in the system registry.


The Worm creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "0E DC B4 CD 22 CF E1 C4 0D 7E EB 02 14 82 E1 76"

The process taskkill.exe:1660 makes changes in the system registry.


The Worm creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "F5 F8 08 53 88 DA 5B CD F6 48 87 EE 43 CE 39 EA"

The process sc.exe:516 makes changes in the system registry.


The Worm creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "88 38 DF 55 E7 56 49 2A E1 94 2A E5 6D 35 B6 FE"

The process rundll32.exe:1820 makes changes in the system registry.


The Worm creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "7D 32 41 82 D3 D2 38 B4 8D 64 DD 28 2A 57 9A 13"

The process cacls.exe:864 makes changes in the system registry.


The Worm creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "21 7D C4 B2 B1 1D 6A 94 C6 6E 7D 89 90 13 F2 50"

The process cacls.exe:1640 makes changes in the system registry.


The Worm creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "BA 1F B7 30 14 C6 00 68 74 4B BF FB 6F 58 BD B7"

Dropped PE files

MD5 File path
522afca05d2634a769adbe29d64cfa08c:\WINDOWS\LastGood\system32\drivers\acpiec.sys
4485601a5a45d10f44cd57c1f09048e0c:\WINDOWS\phpq.dll
9859c0f6936e723e4892d7141b1327d5c:\WINDOWS\system32\dllcache\acpiec.sys
522afca05d2634a769adbe29d64cfa08c:\WINDOWS\system32\drivers\OLD3.tmp
601b3f2466bfa6989b9c7586b5ba54aac:\WINDOWS\system32\drivers\pcidump.sys
e13f938795bc9fc449d0a7ef6deb2c8bc:\WINDOWS\system32\func.dll

HOSTS file anomalies

The Worm modifies "%System%\drivers\etc\hosts" file which is used to translate DNS entries to IP addresses. The modified file is 5743 bytes in size. The following strings are added to the hosts file listed below:

127.0.0.1v.onondown.com.cn
127.0.0.2ymsdasdw1.cn
127.0.0.3h96b.info
127.0.0.0fuck.zttwp.cn
127.0.0.0www.hackerbf.cn
127.0.0.0geekbyfeng.cn
127.0.0.0121.14.101.68
127.0.0.0ppp.etimes888.com
127.0.0.0www.bypk.com
127.0.0.0CSC3-2004-crl.verisign.com
127.0.0.1va9sdhun23.cn
127.0.0.0udp.hjob123.com
127.0.0.2bnasnd83nd.cn
127.0.0.0www.gamehacker.com.cn
127.0.0.0gamehacker.com.cn
127.0.0.3adlaji.cn
127.0.0.1858656.com
127.1.1.1bnasnd83nd.cn
127.0.0.1my123.com
127.0.0.0user1.12-27.net
127.0.0.18749.com
127.0.0.0fengent.cn
127.0.0.14199.com
127.0.0.1user1.16-22.net
127.0.0.17379.com
127.0.0.12be37c5f.3f6e2cc5f0b.com
127.0.0.17255.com
127.0.0.1user1.23-12.net
127.0.0.13448.com
127.0.0.1www.guccia.net
127.0.0.17939.com
127.0.0.1a.o1o1o1.nEt
127.0.0.18009.com
127.0.0.1user1.12-73.cn
127.0.0.1piaoxue.com
127.0.0.13n8nlasd.cn
127.0.0.1kzdh.com
127.0.0.0www.sony888.cn
127.0.0.1about.blank.la
127.0.0.0user1.asp-33.cn
127.0.0.16781.com
127.0.0.0www.netkwek.cn
127.0.0.17322.com
127.0.0.0ymsdkad6.cn
127.0.0.0www.lkwueir.cn
127.0.0.106.jacai.com
127.0.1.1user1.23-17.net
127.0.0.11.jopenkk.com
127.0.0.0upa.luzhiai.net
127.0.0.11.jopenqc.com
127.0.0.0www.guccia.net
127.0.0.11.joppnqq.com
127.0.0.04m9mnlmi.cn
127.0.0.11.xqhgm.com
127.0.0.0mm119mkssd.cn
127.0.0.1100.332233.com
127.0.0.061.128.171.115:8080
127.0.0.1121.11.90.79
127.0.0.0www.1119111.com
127.0.0.1121565.net
127.0.0.0win.nihao69.cn
127.0.0.1125.90.88.38
127.0.0.116888.6to23.com
127.0.0.12.joppnqq.com
127.0.0.0puc.lianxiac.net
127.0.0.1204.177.92.68
127.0.0.0pud.lianxiac.net
127.0.0.1210.74.145.236
127.0.0.0210.76.0.133
127.0.0.1219.129.239.220
127.0.0.061.166.32.2
127.0.0.1219.153.40.221
127.0.0.0218.92.186.27
127.0.0.1219.153.46.27
127.0.0.0www.fsfsfag.cn
127.0.0.1219.153.52.123
127.0.0.0ovo.ovovov.cn
127.0.0.1221.195.42.71
127.0.0.0dw.com.com
127.0.0.1222.73.218.115
127.0.0.1203.110.168.233:80
127.0.0.13.joppnqq.com
127.0.0.1203.110.168.221:80
127.0.0.1363xx.com
127.0.0.1www1.ip10086.com.cm
127.0.0.14199.com
127.0.0.1blog.ip10086.com.cn
127.0.0.143242.com
127.0.0.1www.ccji68.cn
127.0.0.15.xqhgm.com
127.0.0.0t.myblank.cn
127.0.0.1520.mm5208.com
127.0.0.0x.myblank.cn
127.0.0.159.34.131.54
127.0.0.1210.51.45.5
127.0.0.159.34.198.228
127.0.0.1www.ew1q.cn
127.0.0.159.34.198.88
127.0.0.159.34.198.97
127.0.0.160.190.114.101
127.0.0.160.190.218.34
127.0.0.0qq-xing.com.cn
127.0.0.160.191.124.252
127.0.0.161.145.117.212
127.0.0.161.157.109.222
127.0.0.175.126.3.216
127.0.0.175.126.3.217
127.0.0.175.126.3.218
127.0.0.059.125.231.177:17777
127.0.0.175.126.3.220
127.0.0.175.126.3.221
127.0.0.175.126.3.222
127.0.0.1772630.com
127.0.0.1832823.cn
127.0.0.18749.com
127.0.0.1888.jopenqc.com
127.0.0.189382.cn
127.0.0.18v8.biz
127.0.0.197725.com
127.0.0.19gg.biz
127.0.0.1www.9000music.com
127.0.0.1test.591jx.com
127.0.0.1a.topxxxx.cn
127.0.0.1picon.chinaren.com
127.0.0.1www.5566.net
127.0.0.1p.qqkx.com
127.0.0.1news.netandtv.com
127.0.0.1z.neter888.cn
127.0.0.1b.myblank.cn
127.0.0.1wvw.wokutu.com
127.0.0.1unionch.qyule.com
127.0.0.1www.qyule.com
127.0.0.1it.itjc.cn
127.0.0.1www.linkwww.com
127.0.0.1vod.kaicn.com
127.0.0.1www.tx8688.com
127.0.0.1b.neter888.cn
127.0.0.1promote.huanqiu.com
127.0.0.1www.huanqiu.com
127.0.0.1www.haokanla.com
127.0.0.1play.unionsky.cn
127.0.0.1www.52v.com
127.0.0.1www.gghka.cn
127.0.0.1icon.ajiang.net
127.0.0.1new.ete.cn
127.0.0.1www.stiae.cn
127.0.0.1o.neter888.cn
127.0.0.1comm.jinti.com
127.0.0.1www.google-analytics.com
127.0.0.1hz.mmstat.com
127.0.0.1www.game175.cn
127.0.0.1x.neter888.cn
127.0.0.1z.neter888.cn
127.0.0.1p.etimes888.com
127.0.0.1hx.etimes888.com
127.0.0.1abc.qqkx.com
127.0.0.1dm.popdm.cn
127.0.0.1www.yl9999.com
127.0.0.1www.dajiadoushe.cn
127.0.0.1v.onondown.com.cn
127.0.0.1www.interoo.net
127.0.0.1bally1.bally-bally.net
127.0.0.1www.bao5605509.cn
127.0.0.1www.rty456.cn
127.0.0.1www.werqwer.cn
127.0.0.11.360-1.cn
127.0.0.1user1.23-16.net
127.0.0.1www.guccia.net
127.0.0.1www.interoo.net
127.0.0.1upa.netsool.net
127.0.0.1js.users.51.la
127.0.0.1vip2.51.la
127.0.0.1web.51.la
127.0.0.1qq.gong2008.com
127.0.0.12008tl.copyip.com
127.0.0.1tla.laozihuolaile.cn
127.0.0.1www.tx6868.cn
127.0.0.1p001.tiloaiai.com
127.0.0.1s1.tl8tl.com
127.0.0.1s1.gong2008.com
127.0.0.14b3ce56f9g.3f6e2cc5f0b.com


Rootkit activity

The Worm installs the following kernel-mode hooks:

ZwQuerySystemInformation

Using the driver "%System%\drivers\pcidump.sys" the Worm substitutes IRP handlers in a file system driver (NTFS) to control operations with files:

MJ_CREATE

Propagation

A worm can spread via removable drives. It writes its executable and creates "autorun.inf" scripts on all removable drives. The autorun script will execute the Worm's file once a user opens a drive's folder in Windows Explorer.

Removals

Remove it with Ad-Aware

  1. Click (here) to download and install Ad-Aware Free Antivirus.
  2. Update the definition files.
  3. Run a full scan of your computer.

Manual removal*

  1. Scan a system with an anti-rootkit tool.
  2. Terminate malicious process(es) (How to End a Process With the Task Manager):

    taskkill.exe:556
    taskkill.exe:1180
    taskkill.exe:1660
    sc.exe:516
    ipconfig.exe:576
    rundll32.exe:1820
    cacls.exe:864
    cacls.exe:1640

  3. Delete the original Worm file.
  4. Delete or disinfect the following files created/modified by the Worm:

    %Documents and Settings%\%current user%\Local Settings\Temp\drv2 (56 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\temp_wincheck.txt (145171 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\dch3.sys (13122 bytes)
    %System%\drivers\acpiec.sys (13 bytes)
    %System%\wbem\Repository\FS\OBJECTS.MAP (12 bytes)
    %System%\wbem\Repository\FS\INDEX.MAP (4 bytes)
    C:\autorun.inf (21 bytes)
    %System%\drivers\etc\hosts (5 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\index.dat (388 bytes)
    %Documents and Settings%\Default User (540 bytes)
    %Documents and Settings%\All Users (4 bytes)
    C:\$Directory (12 bytes)
    %System%\dllcache (4 bytes)
    C:\PROGRAM FILES (8 bytes)
    %Documents and Settings%\NetworkService (4 bytes)
    %System%\drivers\pcidump.sys (5404535 bytes)
    %System%\config (192 bytes)
    %WinDir%\Temp\Perflib_Perfdata_7ac.dat (4 bytes)
    %WinDir%\phpq.dll (22141559 bytes)
    %System%\func.dll (18378359 bytes)
    C:\totalcmd (4 bytes)
    %System%\wbem\Repository\FS\MAPPING1.MAP (192 bytes)
    C:\1.exe (7345 bytes)
    %Documents and Settings%\LocalService (4 bytes)

  5. Restore the original content of the HOSTS file (%System%\drivers\etc\hosts): 127.0.0.1 localhost
  6. Find and delete all copies of the worm's file together with "autorun.inf" scripts on removable drives.
  7. Reboot the computer.
*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

VersionInfo

Company Name:
Product Name: ????
Product Version: 4, 3, 1, 1
Legal Copyright: ???? (C) 2009
Legal Trademarks:
Original Filename: notepad.EXE
Internal Name: test
File Version: 1, 0, 0, 1
File Description: Microsoft ???????
Comments:
Language: English (United States)

Company Name: Product Name: ????Product Version: 4, 3, 1, 1Legal Copyright: ???? (C) 2009Legal Trademarks: Original Filename: notepad.EXEInternal Name: testFile Version: 1, 0, 0, 1File Description: Microsoft ???????Comments: Language: English (United States)

PE Sections

Name Virtual Address Virtual Size Raw Size Entropy Section MD5
UPX040967782400d41d8cd98f00b204e9800998ecf8427e
UPX18192032768307205.46213f31a4d2c191bb50deff8a3e381d5418b
.rsrc114688409615361.99209c42b12aadc909baa46a4ceea8788a913

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Network Activity

URLs

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

Map

The Worm connects to the servers at the folowing location(s):

Strings from Dumps

%original file name%.exe_984:

.rsrc

.rsrc

z.wxE

z.wxE

(Exec

(Exec

/1.html

/1.html

\phpq.dllvi

\phpq.dllvi

$\ 8cmd

$\ 8cmd

%}cls "%s"?pB

%}cls "%s"?pB

GetWindowsDirectoryA

GetWindowsDirectoryA

WinExec

WinExec

tp://localhost/1.html

tp://localhost/1.html

\phpq.dll

\phpq.dll

rundll32.exe func.dll, droqp

rundll32.exe func.dll, droqp

\system32\func.dll

\system32\func.dll

cmd /c taskkill /im ScanFrm.exe /f

cmd /c taskkill /im ScanFrm.exe /f

cmd /c taskkill /im egui.exe /f

cmd /c taskkill /im egui.exe /f

cmd /c taskkill /im ekrn.exe /f

cmd /c taskkill /im ekrn.exe /f

cmd /c sc config ekrn start= disabled

cmd /c sc config ekrn start= disabled

cmd /c cacls "%s" /e /p everyone:f

cmd /c cacls "%s" /e /p everyone:f

cmd /c cacls %s /e /p everyone:f

cmd /c cacls %s /e /p everyone:f

\temp\explorer.exe

\temp\explorer.exe

\drivers\gm.dls

\drivers\gm.dls

Explorer.EXE

Explorer.EXE

explorer.EXE

explorer.EXE

EXPLORER.EXE

EXPLORER.EXE

EXPLORER.exe

EXPLORER.exe

Explorer.exe

Explorer.exe

explorer.exe

explorer.exe

kjk.om\k)`s`

kjk.om\k)`s`

Ci=l_[n_Msg\ifc]Fche

Ci=l_[n_Msg\ifc]Fche

,-2) ) ),

,-2) ) ),

,-2) ) )-

,-2) ) )-

,-2) ) ).

,-2) ) ).

,-2) ) )

,-2) ) )

,-,),/), ,)13

,-,),/), ,)13

,-2),),),

,-2),),),

,-2) ),),

,-2) ),),

1,),-3),2,),,053 3

1,),-3),2,),,053 3

,-,),,)4 )24

,-,),,)4 )24

,-0)4 )33).3

,-0)4 )33).3

- /),22)4-)13

- /),22)4-)13

-, )2/),/0)-.1

-, )2/),/0)-.1

-, )21) ),..

-, )21) ),..

-,4),-4)-.4)--

-,4),-4)-.4)--

1,),11).-)-

1,),11).-)-

-,4),0.)/ )--,

-,4),0.)/ )--,

-,3)4-),31)-2

-,3)4-),31)-2

-,4),0.)/1)-2

-,4),0.)/1)-2

-,4),0.)0-),-.

-,4),0.)0-),-.

--,),40)/-)2,

--,),40)/-)2,

---)2.)-,3),,0

---)2.)-,3),,0

- .),, ),13)-..53

- .),, ),13)-..53

- .),, ),13)--,53

- .),, ),13)--,53

.1.ss)^jh

.1.ss)^jh

04)./),.,)0/

04)./),.,)0/

-, )0,)/0)0

-, )0,)/0)0

04)./),43)--3

04)./),43)--3

04)./),43)33

04)./),43)33

04)./),43)42

04)./),43)42

1 ),4 ),,/), ,

1 ),4 ),,/), ,

1 ),4 )-,3)./

1 ),4 )-,3)./

1 ),4,),-/)-0-

1 ),4,),-/)-0-

1,),/0),,2)-,-

1,),/0),,2)-,-

1,),02), 4)---

1,),02), 4)---

20),-1).)-,1

20),-1).)-,1

20),-1).)-,2

20),-1).)-,2

20),-1).)-,3

20),-1).)-,3

04),-0)-.,),225,2222

04),-0)-.,),225,2222

20),-1).)--

20),-1).)--

20),-1).)--,

20),-1).)--,

20),-1).)---

20),-1).)---

.text

.text

`.rdata

`.rdata

@.data

@.data

r4.Tq:]du

r4.Tq:]du

7'7,71767<</pre><pre>a .Mt</pre><pre>B .rd</pre><pre>KERNEL32.DLL</pre><pre>MSVCRT.dll</pre><pre>1, 0, 0, 1</pre><pre>notepad.EXE</pre><pre>4, 3, 1, 1</pre><b>%original file name%.exe_984_rwx_00401000_0001A000:</b><pre>GetWindowsDirectoryA</pre><pre>WinExec</pre><pre>tp://localhost/1.html</pre><pre>\phpq.dll</pre><pre>rundll32.exe func.dll, droqp</pre><pre>\system32\func.dll</pre><pre>cmd /c taskkill /im ScanFrm.exe /f</pre><pre>cmd /c taskkill /im egui.exe /f</pre><pre>cmd /c taskkill /im ekrn.exe /f</pre><pre>cmd /c sc config ekrn start= disabled</pre><pre>cmd /c cacls "%s" /e /p everyone:f</pre><pre>cmd /c cacls %s /e /p everyone:f</pre><pre>\temp\explorer.exe</pre><pre>\drivers\gm.dls</pre><pre>Explorer.EXE</pre><pre>explorer.EXE</pre><pre>EXPLORER.EXE</pre><pre>EXPLORER.exe</pre><pre>Explorer.exe</pre><pre>explorer.exe</pre><pre>kjk.om\k)`s`</pre><pre>Ci=l_[n_Msg\ifc]Fche</pre><pre>,-2) ) ),</pre><pre>,-2) ) )-</pre><pre>,-2) ) ).</pre><pre>,-2) ) ) </pre><pre>,-,),/), ,)13</pre><pre>,-2),),),</pre><pre>,-2) ),),</pre><pre>1,),-3),2,),,053 3 </pre><pre>,-,),,)4 )24</pre><pre>,-0)4 )33).3</pre><pre>- /),22)4-)13</pre><pre>-, )2/),/0)-.1</pre><pre>-, )21) ),..</pre><pre>-,4),-4)-.4)-- </pre><pre>1,),11).-)-</pre><pre>-,4),0.)/ )--,</pre><pre>-,3)4-),31)-2</pre><pre>-,4),0.)/1)-2</pre><pre>-,4),0.)0-),-.</pre><pre>--,),40)/-)2,</pre><pre>---)2.)-,3),,0</pre><pre>- .),, ),13)-..53 </pre><pre>- .),, ),13)--,53 </pre><pre>.1.ss)^jh</pre><pre>04)./),.,)0/</pre><pre>-, )0,)/0)0</pre><pre>04)./),43)--3</pre><pre>04)./),43)33</pre><pre>04)./),43)42</pre><pre>1 ),4 ),,/), ,</pre><pre>1 ),4 )-,3)./</pre><pre>1 ),4,),-/)-0-</pre><pre>1,),/0),,2)-,-</pre><pre>1,),02), 4)---</pre><pre>20),-1).)-,1</pre><pre>20),-1).)-,2</pre><pre>20),-1).)-,3</pre><pre>04),-0)-.,),225,2222</pre><pre>20),-1).)-- </pre><pre>20),-1).)--,</pre><pre>20),-1).)---</pre><pre>.text</pre><pre>`.rdata</pre><pre>@.data</pre><pre>.rsrc</pre><pre>r4.Tq:]du</pre><pre>7'7,71767<</pre><b>%original file name%.exe_984_rwx_10000000_00001000:</b><pre>.data</pre><pre>.rsrc</pre><pre>@.reloc</pre><pre>psapi.dll</pre><pre>\patch.exe</pre><pre>\dstdisk.exe</pre><pre>\defence.exe</pre><pre>192yuioealdjfiefjsdfas.txt</pre><pre>%SystemRoot%\System32\DRIVERS\puid.sys</pre><pre>\drivers\pcidump.sys</pre><pre>System32\DRIVERS\pcidump.sys</pre><pre>%SystemRoot%\system32\drivers\puid.sys</pre><pre>\\.\pcidump</pre><pre>\drivers\gm.dls</pre><pre>Windows</pre><pre>1.exe</pre><pre>autorun.inf</pre><pre>Open=1.exe</pre><pre>urlmon</pre><pre>\setup.exe</pre><pre>?mac=%s&ver=%s&key=%d&os=windows</pre><pre>.html</pre><pre>.hhqg</pre><pre>qq.exe</pre><pre>360safe.exe</pre><pre>\explorer.exe</pre><pre>\temp\explorer.exe</pre><pre>nfect_exe</pre><b>%original file name%.exe_984_rwx_10005000_00001000:</b><pre>\??\c:\%original file name%.exe</pre><pre>\??\%WinDir%\explorer.exe</pre><pre>ers\gm.dls</pre><pre>WinExec</pre><pre>CreatePipe</pre><pre>GetWindowsDirectoryA</pre><pre>KERNEL32.dll</pre><pre>USER32.dll</pre><pre>ADVAPI32.dll</pre><pre>InternetOpenUrlA</pre><pre>WININET.dll</pre><b>rundll32.exe_1820:</b><pre>.text</pre><pre>`.data</pre><pre>.rsrc</pre><pre>msvcrt.dll</pre><pre>KERNEL32.dll</pre><pre>NTDLL.DLL</pre><pre>GDI32.dll</pre><pre>USER32.dll</pre><pre>IMAGEHLP.dll</pre><pre>rundll32.pdb</pre><pre>.....eZXnnnnnnnnnnnn3</pre><pre>....eDXnnnnnnnnnnnn3</pre><pre>...eDXnnnnnnnnnnnn,</pre><pre>.eDXnnnnnnnnnnnn,</pre><pre>%Xnnnnnnnnnnnnnnn1</pre><pre>O3$dS7"%U9</pre><pre>.manifest</pre><pre>5.1.2600.5512 (xpsp.080413-2105)</pre><pre>RUNDLL.EXE</pre><pre>Windows</pre><pre>Operating System</pre><pre>5.1.2600.5512</pre><pre>YThere is not enough memory to run the file %s.</pre><pre>Please close other windows and try again.</pre><pre>9The file %s or one of its components could not be opened.</pre><pre>0The file %s or one of its components cannot run.</pre><pre>MThe file %s or one of its components requires a different version of Windows.</pre><pre>UThe file %s or one of its components cannot run in standard or enhanced mode Windows.3Another instance of the file %s is already running./An exception occurred while trying to run "%s"</pre><pre>Error in %s</pre><pre>Missing entry:%s</pre><pre>Error loading %s</pre></pre>