Gen.Heur.MSIL.Krypt.3_25de6c41bd

by malwarelabrobot on June 15th, 2017 in Malware Descriptions.

Gen:Heur.MSIL.Krypt.3 (BitDefender), HEUR:Trojan.Win32.Generic (Kaspersky), Trojan.DownLoader23.46699 (DrWeb), Gen:Heur.MSIL.Krypt.3 (B) (Emsisoft), Artemis!25DE6C41BD6A (McAfee), ML.Attribute.HighConfidence (Symantec), PUA.MSIL.Dotbundle (Ikarus), Gen:Heur.MSIL.Krypt.3 (FSecure), Win32:Rootkit-gen [Rtk] (AVG), Win32:Rootkit-gen [Rtk] (Avast), BKDR_BLADABI.SMC (TrendMicro), Gen:Heur.MSIL.Krypt.3 (AdAware), Trojan-Banker.Win32.Brasil.FD, Trojan.Win32.Delphi.FD, Trojan.Win32.Sasfis.FD, VirTool.Win32.DelfInject.FD (Lavasoft MAS)
Behaviour: Banker, Trojan, VirTool


The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.

Requires JavaScript enabled!

Summary
Dynamic Analysis
Static Analysis
Network Activity
Map
Strings from Dumps
Removals

MD5: 25de6c41bd6a98b70c3903a797bad94f
SHA1: 4f6ea379e7267781d6df1c4c826a13072597db79
SHA256: 470b5e7568366baf1d639fe103162083e48ef7e784f170a09580f13e2371d31b
SSDeep: 12288:3UBgyoyvfF2PzitLbIjkzN4OYmsgmDqL98sWQiyF6UaGuIT1zCu8ZQiYHVXzxZa4:3UXvfF274Skz798snLXzCuvlFxcgS/iz
Size: 958106 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: UPolyXv05_v6
Company: CompanyName
Created at: 2016-08-14 22:15:54
Analyzed on: Windows7 SP1 32-bit


Summary:

Banker. Steals data relating to online banking systems, e-payment systems and credit card systems.

Payload

No specific payload has been found.

Process activity

The Trojan creates the following process(es):

explore.exe:3808
Áudio do Windows.EXE:3512
%original file name%.exe:3428
netsh.exe:3352

The Trojan injects its code into the following process(es):

explore.exe:532
Dllhost.exe:3804
Server.exe:1876
setup.EXE:3568

Mutexes

The following mutexes were created/opened:
No objects were found.

File activity

The process explore.exe:532 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\000372a60fd07aeaad4e41aacc913275.exe (1425 bytes)

The process Áudio do Windows.EXE:3512 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Dllhost.exe (89 bytes)

The process Dllhost.exe:3804 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe (44 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Server.exe (44 bytes)

The process %original file name%.exe:3428 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Áudio do Windows.exe (89 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\setup.exe (3361 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\explorer.exe (1695 bytes)

The Trojan deletes the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\__tmp_rar_sfx_access_check_336150 (0 bytes)

The process setup.EXE:3568 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017061420170615\index.dat (16 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\25FDO7QC\playpatcher[1].htm (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\OL61VJMF.txt (114 bytes)

The Trojan deletes the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012016101320161014\index.dat (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012016101320161014 (0 bytes)

Registry activity

The process explore.exe:532 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKCU\Environment]
"SEE_MASK_NOZONECHECKS" = "1"

[HKCU\Software\000372a60fd07aeaad4e41aacc913275]
"[kl]" = ""

[HKCU]
"di" = "!"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"000372a60fd07aeaad4e41aacc913275" = "C:\Users\"%CurrentUserName%"\AppData\Local\Temp\explore.exe .."

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"000372a60fd07aeaad4e41aacc913275" = "C:\Users\"%CurrentUserName%"\AppData\Local\Temp\explore.exe .."

The process Áudio do Windows.EXE:3512 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"
"AutoDetect" = "1"

[HKCU]
"di" = "!"

The Trojan deletes the following value(s) in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"
"IntranetName"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

The process Dllhost.exe:3804 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKCU\Environment]
"SEE_MASK_NOZONECHECKS" = "1"

[HKCU]
"di" = "!"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"Windows Update" = "C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Dllhost.exe .."

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows Update" = "C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Dllhost.exe .."

The process %original file name%.exe:3428 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"
"UNCAsIntranet" = "0"

The Trojan deletes the following value(s) in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"
"IntranetName"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

The process netsh.exe:3352 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32]
"eapqec.dll,-101" = "Provides Network Access Protection enforcement for EAP authenticated network connections, such as those used with 802.1X and VPN technologies."
"eapqec.dll,-100" = "EAP Quarantine Enforcement Client"
"eapqec.dll,-103" = "Microsoft Corporation"
"eapqec.dll,-102" = "1.0"
"tsgqec.dll,-101" = "Provides RD Gateway enforcement for NAP"

[HKCU\Software\Classes\Local Settings\MuiCache\2D\52C64B7E]
"LanguageList" = "en-US, en"

[HKCU\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32]
"tsgqec.dll,-103" = "Microsoft Corporation"
"tsgqec.dll,-100" = "RD Gateway Quarantine Enforcement Client"
"napipsec.dll,-2" = "Provides IPsec based enforcement for Network Access Protection"
"napipsec.dll,-3" = "Microsoft Corporation"
"napipsec.dll,-1" = "IPsec Relying Party"
"napipsec.dll,-4" = "1.0"
"tsgqec.dll,-102" = "1.0"
"dhcpqec.dll,-103" = "1.0"
"dhcpqec.dll,-102" = "Microsoft Corporation"
"dhcpqec.dll,-101" = "Provides DHCP based enforcement for NAP"
"dhcpqec.dll,-100" = "DHCP Quarantine Enforcement Client"

The process setup.EXE:3568 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012017061420170615]
"CachePrefix" = ":2017061420170615:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKLM\SOFTWARE\Microsoft\Tracing\Setup_RASMANCS]
"MaxFileSize" = "1048576"

[HKLM\SOFTWARE\Microsoft\Tracing\Setup_RASAPI32]
"ConsoleTracingMask" = "4294901760"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKLM\SOFTWARE\Microsoft\Tracing\Setup_RASMANCS]
"EnableConsoleTracing" = "0"

[HKLM\SOFTWARE\Microsoft\Tracing\Setup_RASAPI32]
"FileDirectory" = "%windir%\tracing"
"EnableFileTracing" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012017061420170615]
"CachePath" = "%USERPROFILE%\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017061420170615"
"CacheOptions" = "11"

[HKLM\SOFTWARE\Microsoft\Tracing\Setup_RASAPI32]
"EnableConsoleTracing" = "0"

[HKLM\SOFTWARE\Microsoft\Tracing\Setup_RASMANCS]
"EnableFileTracing" = "0"

[HKLM\SOFTWARE\Microsoft\Tracing\Setup_RASAPI32]
"FileTracingMask" = "4294901760"

[HKLM\SOFTWARE\Microsoft\Tracing\Setup_RASMANCS]
"FileDirectory" = "%windir%\tracing"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012017061420170615]
"CacheLimit" = "8192"

[HKLM\SOFTWARE\Microsoft\Tracing\Setup_RASAPI32]
"MaxFileSize" = "1048576"

[HKLM\SOFTWARE\Microsoft\Tracing\Setup_RASMANCS]
"ConsoleTracingMask" = "4294901760"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 3C 00 00 00 09 00 00 00 00 00 00 00"

[HKCU\AppEvents\Schemes\Apps\Explorer\Navigating\Old_Current]
"(Default)" = "C:\Windows\Media\Delta\Windows Navigation Start.wav"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
" Embedded Web Browser from: http://bsalsa.com/" = ""

[HKLM\SOFTWARE\Microsoft\Tracing\Setup_RASMANCS]
"FileTracingMask" = "4294901760"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012017061420170615]
"CacheRepair" = "0"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan deletes the following registry key(s):

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012016101320161014]
[HKCU\AppEvents\Schemes\Apps\Explorer\Navigating\.Current]

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"
"ProxyOverride"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"

Dropped PE files

MD5 File path
e9cec94c044bb2473d5030f85dc7bf8b c:\Users\"%CurrentUserName%"\AppData\Local\Temp\Dllhost.exe
e9cec94c044bb2473d5030f85dc7bf8b c:\Users\"%CurrentUserName%"\AppData\Local\Temp\Server.exe
ad7b6a4aac6922851a308f21833c5f3b c:\Users\"%CurrentUserName%"\AppData\Local\Temp\explore.exe
ad7b6a4aac6922851a308f21833c5f3b c:\Users\"%CurrentUserName%"\AppData\Local\Temp\explorer.exe
d4f8a7c1d790dccb5e52592820ecc052 c:\Users\"%CurrentUserName%"\AppData\Local\Temp\setup.exe
e9cec94c044bb2473d5030f85dc7bf8b c:\Users\"%CurrentUserName%"\AppData\Local\Temp\Áudio do Windows.exe
e9cec94c044bb2473d5030f85dc7bf8b c:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

VersionInfo

No information is available.

PE Sections

Name Virtual Address Virtual Size Raw Size Entropy Section MD5
.text 4096 135031 135168 4.58976 792daf1ebbf0f019d3486580dfe317d1
.rdata 139264 36820 36864 3.55965 9d62ca750ab21611bd69d7a3e5333d52
.data 176128 185200 3072 1.91669 ab0f244b352be8b4c7ffac28b0999542
.gfids 364544 252 512 1.49939 7af9f45b4511d68a2575fde63622b162
.rsrc 368640 54039 54272 3.18252 badee2ca98cd9ad890409afb22ab930f
.reloc 425984 9044 9216 4.64072 f61d7f0f6bcc5a445f5126dff171e1c0

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

URLs

URL IP
hxxp://box.playcheat.net/app/script/playpatcher.php?id=0 104.27.177.218
iagodornelas25.duckdns.org 187.41.203.158
configure.duckdns.org 188.80.3.14
dns.msftncsi.com 131.107.255.255


IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

GET /app/script/playpatcher.php?id=0 HTTP/1.1
Accept: */*
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: box.playcheat.net
Connection: Keep-Alive


HTTP/1.1 200 OK
Date: Wed, 14 Jun 2017 10:50:46 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Set-Cookie: __cfduid=dffccef1e2264d298a81be5cf98bc4f721497437446; expires=Thu, 14-Jun-18 10:50:46 GMT; path=/; domain=.playcheat.net; HttpOnly
Vary: Accept-Encoding,User-Agent
Server: cloudflare-nginx
CF-RAY: 36ecbb07d16e8436-KBP
Content-Encoding: gzip
12............26........a......b.......0..HTTP/1.1 200 OK..Date: Wed, 
14 Jun 2017 10:50:46 GMT..Content-Type: text/html; charset=UTF-8..Tran
sfer-Encoding: chunked..Connection: keep-alive..Set-Cookie: __cfduid=d
ffccef1e2264d298a81be5cf98bc4f721497437446; expires=Thu, 14-Jun-18 10:
50:46 GMT; path=/; domain=.playcheat.net; HttpOnly..Vary: Accept-Encod
ing,User-Agent..Server: cloudflare-nginx..CF-RAY: 36ecbb07d16e8436-KBP
..Content-Encoding: gzip..12............26........a......b.......0..

The Trojan connects to the servers at the folowing location(s):

setup.EXE_3568:

`.rsrc
kernel32.dll
Windows
MSWHEEL_ROLLMSG
MSH_WHEELSUPPORT_MSG
MSH_SCROLL_LINES_MSG
$*@@@*$@@@$ *@@* $@@($*)@-$*@@$-*@@$*-@@(*$)@-*$@@*-$@@*$-@@-* $@-$ *@* $-@$ *-@$ -*@*- $@($ *)(* $)
oleaut32.dll
EVariantBadIndexError
IOleInPlaceFrameXeA
ssShift
htKeyword
EInvalidOperation
u%CNu
%s[%d]
%s_%d
EInvalidGraphicOperation
USER32.DLL
comctl32.dll
uxtheme.dll
UrlMon
%s%s%s%s%s%s%s%s%s%s
Proportional
MAPI32.DLL
OnKeyDownH
OnKeyPress
OnKeyUp
OnKeyUp
IE(AL("%s",4),"AL(\"%0:s\",3)","JK(\"%1:s\",\"%0:s\")")
JumpID("","%s")
TKeyEvent
TKeyPressEvent
HelpKeyword
crSQLWait
%s (%s)
Uh.dD
imm32.dll
AutoHotkeys
ssHotTrack
TWindowState
poProportional
TWMKey
KeyPreviewx
WindowState
System\CurrentControlSet\Control\Keyboard Layouts\%.8x
vcltest3.dll
User32.dll
1.2.3
Invalid ZStream operation!
Options.dat
SM_ALPHACMD
ole32.dll
Cannot load image. %s not supported for %s files.
Cannot load image. Palette in %s file is invalid.
Cannot load image. Invalid or unexpected %s image format.
Cannot load image. CRC error found in %s file.
Cannot load image. Extra compressed data found in %s file.
Cannot load image. Compression error found in %s file.
Invalid color format in %s file.
3333333
Conversion between indexed and non-indexed pixel formats is not supported.
Portable network graphics (AlphaControls)
TacMDIWnd
C.PhdUI
r.uXh
WEBBUTTON
TacMenuSupport
TacMenuSupport|
Webdings
DWMAPI.DLL
acMDIIcons
f;x.tP
t.Ht!
f;p.tC
Zf;P.tC
MenuSupport
c:\Skins
1.tmp
.JPEG
2.tmp
" skin, please update a skins to latest or link with AlphaControls support for upgrading of existing skin.
This version of the skin have not complete support by used AlphaControls package release.
olepro32.dll
IWebBrowser
IWebBrowserApp|
IWebBrowser2
TWebBrowserStatusTextChange
TWebBrowserProgressChange
TWebBrowserCommandStateChange
TWebBrowserTitleChange
TWebBrowserPropertyChange
TWebBrowserBeforeNavigate2
TWebBrowserNewWindow2
TWebBrowserNavigateComplete2
TWebBrowserDocumentComplete
TWebBrowserOnVisible
TWebBrowserOnToolBar
TWebBrowserOnMenuBar
TWebBrowserOnStatusBar
TWebBrowserOnFullScreen
TWebBrowserOnTheaterMode
TWebBrowser
shell32.dll
hhctrl.ocx
IWebBrowserApp
IWebBrowser2(
TEWBWindowSetResizable
TEWBWindowSetLeft
TEWBWindowSetTop
TEWBWindowSetWidth
TEWBWindowSetHeight
bstrUrlContext
bstrUrl
OnWindowSetResizableX
OnWindowSetLeft
OnWindowSetTop
OnWindowSetWidth
OnWindowSetHeighth
PTF://
hXXp://
hXXps://
Embedded Web Browser from: hXXp://bsalsa.com/
\Software\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform
.Current
TGetOverrideKeyPathEvent
pchKey
pszUrl
pszUrlContext
TGetOptionKeyPathEvent
pcmdtReserved
lpMsg
PMsg
pguidCmdGroup
nCmdID
TTranslateUrlEvent
pchURLIn
ppchURLOut
ErrorUrl
CmdID
grfKeyState
DontExecuteScripts
DontExecuteJava
DontExecuteActiveX
DisableUrlIfEncodingUTF8
EnableUrlIfEncodingUTF8
CheckFontSupportsCodePage
DisableSubmitUrlInUTF8
EnableSubmitUrlInUTF8
Port
Password
InternalErrMsg
poPortrait
OnEnableModelessh
OnGetOptionKeyPath
OnGetOverrideKeyPathX
OnTranslateUrlx
OptionKeyPath
OverrideOptionKeyPath
The drag-and-drop operation was successful.
The drag-and-drop operation was canceled.
operation was successful.
SHDOCLC.DLL
'%s' not supported.
htmlfile\shell\open\ddeexec\application
htmlfile\shell\open\ddeexec\topic
Folder\shell\open\ddeexec\application
Folder\shell\open\ddeexec\topic
Folder\shell\open\ddeexec
Folder\shell\explore\ddeexec
Directory\shell\find\ddeexec
Web Browser
0.750000
WebBrowser1
WebBrowser2
WebBrowser3
WebBrowser1NavigateComplete2#
WebBrowser2NavigateComplete2"
WebBrowser1DocumentComplete"
WebBrowser2DocumentComplete
WebBrowser2NewWindow2"
WebBrowser1NewWindow2
setup.dll
O arquivo setup.dll n
hXXp://box.playcheat.net/app/script/playpatcher.php?id=0
inflate 1.2.3 Copyright 1995-2005 Mark Adler
1iu2.iu
user32.dll
GetKeyboardType
advapi32.dll
RegOpenKeyExA
RegCloseKey
RegQueryInfoKeyA
RegFlushKey
RegEnumKeyExA
RegDeleteKeyA
RegCreateKeyExA
GetCPInfo
version.dll
gdi32.dll
SetViewportOrgEx
GetViewportOrgEx
UnhookWindowsHookEx
SetWindowsHookExA
MapVirtualKeyA
LoadKeyboardLayoutA
GetKeyboardState
GetKeyboardLayoutList
GetKeyboardLayout
GetKeyState
GetKeyNameTextA
EnumWindows
EnumThreadWindows
EnumChildWindows
ActivateKeyboardLayout
ShellExecuteExA
wininet.dll
URLMON.DLL
msimg32.dll
333333333333333333
33333833
3333339
3333333333333338
:*"*"$3338
33333333
33333333333
3333333333338
33338?383
333333333333
:*3:"$3338
333333333333333
.r$%Fg
KWindows
%sPopupClndr
Font.Charset
Font.Color
Font.Height
Font.Name
Font.Style
KeyPreview
OnKeyDown
FormKeyDown
Constraints.MinHeight
Constraints.MinWidth
SkinData.SkinSection
BoundLabel.Indent
BoundLabel.Layout
BoundLabel.MaxWidth
BoundLabel.UseSkinColor
TsShellTreeView
sShellTreeView1
sShellTreeView1Change
BoundLabel.Active
BoundLabel.Caption
Icon.Data
5555555555555555554
555?55?55?55?55?5552
/555?55?55?55?55 
Picture.Data
WebBrowser1NavigateComplete2
WebBrowser1DocumentComplete
WebBrowser2NewWindow2
WebBrowser2NavigateComplete2
. Embedded Web Browser from: hXXp://bsalsa.com/
MessagesBoxes.DisableAll
MessagesBoxes.InternalErrMsg
MessagesBoxes.ReplaceIcon
MessagesBoxes.NewCaption
PrintOptions.Margins.Left
PrintOptions.Margins.Right
PrintOptions.Margins.Top
PrintOptions.Margins.Bottom
PrintOptions.HTMLHeader.Strings
PrintOptions.Orientation
VisualEffects.DisableSounds
Br.BMPf
Huge.bmp6
{,.Vu
<.%!.-%1 -5'3-/;
Master.bmp
4HÇ
;f.MIN
1.KILJ
X%XWz[
>~.ue
MenuSupport.IcoLineSkin
ICOLINE!MenuSupport.ExtraLineFont.Charset
MenuSupport.ExtraLineFont.Color
clWindowText MenuSupport.ExtraLineFont.Height
MenuSupport.ExtraLineFont.Name
MenuSupport.ExtraLineFont.Style
ThirdParty.ThirdEdits
ThirdParty.ThirdButtons
ThirdParty.ThirdBitBtns
ThirdParty.ThirdCheckBoxes
ThirdParty.ThirdGroupBoxes
ThirdParty.ThirdListViews
ThirdParty.ThirdPanels
ThirdParty.ThirdGrids
ThirdParty.ThirdTreeViews
ThirdParty.ThirdComboBoxes
ThirdParty.ThirdWWEdits
ThirdParty.ThirdVirtualTrees
ThirdParty.ThirdGridEh
ThirdParty.ThirdPageControl
ThirdParty.ThirdTabControl
ThirdParty.ThirdToolBar
ThirdParty.ThirdStatusBar
ThirdParty.ThirdSpeedButton
FormKeyPress
Constraints.MaxHeight
Constraints.MaxWidth
Glyph.Data
SkinData.CustomColor
GlyphMode.Grayed
Colors.Strings
sEditHexKeyPress
<assemblyIdentity type="win32" name="PlayCheat - PBBR.exe" version="3.1.0.0" processorArchitecture="*"/>
<assemblyIdentity type="win32" name="Microsoft.Windows.Common-Controls" version="6.0.0.0" publicKeyToken="6595b64144ccf1df" language="*" processorArchitecture="*"/>
<requestedExecutionLevel level="requireAdministrator" uiAccess="false"/>
<!--The ID below indicates application support for Windows Vista -->
<supportedOS Id="{e2011457-1546-43c5-a5fe-008deee3d3f0}"/>
<!--The ID below indicates application support for Windows 7 -->
<supportedOS Id="{35138b9a-5d96-4fbd-8e2d-a2440225f93a}"/>
%SWVUP
errorUrl
hXXp://box.playcheat.net/blog/
Add to custom colors set8Listbox (%s) style must be virtual in order to set Count
Error setting %s.Count
OLE error %.8x.Method '%s' not supported by automation object/Variant does not reference an automation object7Dispatch methods do not support more than 64 parameters
OLE control activation failed*Could not obtain OLE control window handle%License information for %s is invalidPLicense information for %s not found. You cannot use this control in design modeNUnable to retrieve a pointer to a running object registered with OLE for %s/%s
No help keyword specified.&Cannot change the size of a JPEG image
JPEG error #%d
Unable to insert a line Clipboard does not support Icons
Cannot open clipboard/Menu '%s' is already being used by another form
No help found for %s#No context-sensitive help installed$No topic-based help system installed
Error creating window class Cannot focus a disabled or invisible window!Control '%s' has no parent window
$%s not in a class registration group
Property %s does not exist
Scan line index out of range!Cannot change the size of an icon Invalid operation on TOleGraphic
Unsupported clipboard format
Invalid data type for '%s' List capacity out of bounds (%d)
List count out of bounds (%d)
List index out of bounds (%d) Out of memory while expanding memory stream
Error reading %s%s%s: %s
Failed to create key %s
Failed to get data for '%s'
Failed to set data for '%s'
Resource %s not found
%s.Seek not implemented$Operation not allowed on sorted list
Ancestor for '%s' not found
Cannot assign a %s to a %s
Bits index out of range*Can't write to a read-only resource streamECheckSynchronize called from thread $%x, which is NOT the main thread
Class %s not found
A class named %s already exists%List does not allow duplicates ($0%x)#A component named %s already exists%String list does not allow duplicates
Cannot create file "%s". %s
Cannot open file "%s". %s
Invalid stream format$''%s'' is not a valid component name
Invalid property element: %s
External exception %x
Interface not supported
%s (%s, line %d)
Abstract Error?Access violation at address %p in module '%s'. %s of address %p
System Error. Code: %d.
"Variant method calls not supported
Invalid variant operation
Invalid NULL variant operation%Invalid variant operation (%s%.8x)
%s5Could not convert variant of type (%s) into type (%s)=Overflow while converting variant of type (%s) into type (%s)
Operation not supported
Integer overflow Invalid floating point operation
Invalid pointer operation
Invalid class typecast0Access violation at address %p. %s of address %p
Privileged instruction(Exception %s in module %s at %p.
Application Error1Format '%s' invalid or incompatible with argument
No argument for format '%s'
!'%s' is not a valid integer value('%s' is not a valid floating point value
'%s' is not a valid date
'%s' is not a valid time!'%s' is not a valid date and time
I/O error %d

setup.EXE_3568_rwx_00401000_003ED000:

kernel32.dll
Windows
MSWHEEL_ROLLMSG
MSH_WHEELSUPPORT_MSG
MSH_SCROLL_LINES_MSG
$*@@@*$@@@$ *@@* $@@($*)@-$*@@$-*@@$*-@@(*$)@-*$@@*-$@@*$-@@-* $@-$ *@* $-@$ *-@$ -*@*- $@($ *)(* $)
oleaut32.dll
EVariantBadIndexError
IOleInPlaceFrameXeA
ssShift
htKeyword
EInvalidOperation
u%CNu
%s[%d]
%s_%d
EInvalidGraphicOperation
USER32.DLL
comctl32.dll
uxtheme.dll
UrlMon
%s%s%s%s%s%s%s%s%s%s
Proportional
MAPI32.DLL
OnKeyDownH
OnKeyPress
OnKeyUp
OnKeyUp
IE(AL("%s",4),"AL(\"%0:s\",3)","JK(\"%1:s\",\"%0:s\")")
JumpID("","%s")
TKeyEvent
TKeyPressEvent
HelpKeyword
crSQLWait
%s (%s)
Uh.dD
imm32.dll
AutoHotkeys
ssHotTrack
TWindowState
poProportional
TWMKey
KeyPreviewx
WindowState
System\CurrentControlSet\Control\Keyboard Layouts\%.8x
vcltest3.dll
User32.dll
1.2.3
Invalid ZStream operation!
Options.dat
SM_ALPHACMD
ole32.dll
Cannot load image. %s not supported for %s files.
Cannot load image. Palette in %s file is invalid.
Cannot load image. Invalid or unexpected %s image format.
Cannot load image. CRC error found in %s file.
Cannot load image. Extra compressed data found in %s file.
Cannot load image. Compression error found in %s file.
Invalid color format in %s file.
3333333
Conversion between indexed and non-indexed pixel formats is not supported.
Portable network graphics (AlphaControls)
TacMDIWnd
C.PhdUI
r.uXh
WEBBUTTON
TacMenuSupport
TacMenuSupport|
Webdings
DWMAPI.DLL
acMDIIcons
f;x.tP
t.Ht!
f;p.tC
Zf;P.tC
MenuSupport
c:\Skins
1.tmp
.JPEG
2.tmp
" skin, please update a skins to latest or link with AlphaControls support for upgrading of existing skin.
This version of the skin have not complete support by used AlphaControls package release.
olepro32.dll
IWebBrowser
IWebBrowserApp|
IWebBrowser2
TWebBrowserStatusTextChange
TWebBrowserProgressChange
TWebBrowserCommandStateChange
TWebBrowserTitleChange
TWebBrowserPropertyChange
TWebBrowserBeforeNavigate2
TWebBrowserNewWindow2
TWebBrowserNavigateComplete2
TWebBrowserDocumentComplete
TWebBrowserOnVisible
TWebBrowserOnToolBar
TWebBrowserOnMenuBar
TWebBrowserOnStatusBar
TWebBrowserOnFullScreen
TWebBrowserOnTheaterMode
TWebBrowser
shell32.dll
hhctrl.ocx
IWebBrowserApp
IWebBrowser2(
TEWBWindowSetResizable
TEWBWindowSetLeft
TEWBWindowSetTop
TEWBWindowSetWidth
TEWBWindowSetHeight
bstrUrlContext
bstrUrl
OnWindowSetResizableX
OnWindowSetLeft
OnWindowSetTop
OnWindowSetWidth
OnWindowSetHeighth
PTF://
hXXp://
hXXps://
Embedded Web Browser from: hXXp://bsalsa.com/
\Software\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform
.Current
TGetOverrideKeyPathEvent
pchKey
pszUrl
pszUrlContext
TGetOptionKeyPathEvent
pcmdtReserved
lpMsg
PMsg
pguidCmdGroup
nCmdID
TTranslateUrlEvent
pchURLIn
ppchURLOut
ErrorUrl
CmdID
grfKeyState
DontExecuteScripts
DontExecuteJava
DontExecuteActiveX
DisableUrlIfEncodingUTF8
EnableUrlIfEncodingUTF8
CheckFontSupportsCodePage
DisableSubmitUrlInUTF8
EnableSubmitUrlInUTF8
Port
Password
InternalErrMsg
poPortrait
OnEnableModelessh
OnGetOptionKeyPath
OnGetOverrideKeyPathX
OnTranslateUrlx
OptionKeyPath
OverrideOptionKeyPath
The drag-and-drop operation was successful.
The drag-and-drop operation was canceled.
operation was successful.
SHDOCLC.DLL
'%s' not supported.
htmlfile\shell\open\ddeexec\application
htmlfile\shell\open\ddeexec\topic
Folder\shell\open\ddeexec\application
Folder\shell\open\ddeexec\topic
Folder\shell\open\ddeexec
Folder\shell\explore\ddeexec
Directory\shell\find\ddeexec
Web Browser
0.750000
WebBrowser1
WebBrowser2
WebBrowser3
WebBrowser1NavigateComplete2#
WebBrowser2NavigateComplete2"
WebBrowser1DocumentComplete"
WebBrowser2DocumentComplete
WebBrowser2NewWindow2"
WebBrowser1NewWindow2
setup.dll
O arquivo setup.dll n
hXXp://box.playcheat.net/app/script/playpatcher.php?id=0
inflate 1.2.3 Copyright 1995-2005 Mark Adler
1iu2.iu
user32.dll
GetKeyboardType
advapi32.dll
RegOpenKeyExA
RegCloseKey
RegQueryInfoKeyA
RegFlushKey
RegEnumKeyExA
RegDeleteKeyA
RegCreateKeyExA
GetCPInfo
version.dll
gdi32.dll
SetViewportOrgEx
GetViewportOrgEx
UnhookWindowsHookEx
SetWindowsHookExA
MapVirtualKeyA
LoadKeyboardLayoutA
GetKeyboardState
GetKeyboardLayoutList
GetKeyboardLayout
GetKeyState
GetKeyNameTextA
EnumWindows
EnumThreadWindows
EnumChildWindows
ActivateKeyboardLayout
ShellExecuteExA
wininet.dll
URLMON.DLL
msimg32.dll
333333333333333333
33333833
3333339
3333333333333338
:*"*"$3338
33333333
33333333333
3333333333338
33338?383
333333333333
:*3:"$3338
333333333333333
.r$%Fg
KWindows
%sPopupClndr
Font.Charset
Font.Color
Font.Height
Font.Name
Font.Style
KeyPreview
OnKeyDown
FormKeyDown
Constraints.MinHeight
Constraints.MinWidth
SkinData.SkinSection
BoundLabel.Indent
BoundLabel.Layout
BoundLabel.MaxWidth
BoundLabel.UseSkinColor
TsShellTreeView
sShellTreeView1
sShellTreeView1Change
BoundLabel.Active
BoundLabel.Caption
Icon.Data
5555555555555555554
555?55?55?55?55?5552
/555?55?55?55?55 
Picture.Data
WebBrowser1NavigateComplete2
WebBrowser1DocumentComplete
WebBrowser2NewWindow2
WebBrowser2NavigateComplete2
. Embedded Web Browser from: hXXp://bsalsa.com/
MessagesBoxes.DisableAll
MessagesBoxes.InternalErrMsg
MessagesBoxes.ReplaceIcon
MessagesBoxes.NewCaption
PrintOptions.Margins.Left
PrintOptions.Margins.Right
PrintOptions.Margins.Top
PrintOptions.Margins.Bottom
PrintOptions.HTMLHeader.Strings
PrintOptions.Orientation
VisualEffects.DisableSounds
Br.BMPf
Huge.bmp6
{,.Vu
<.%!.-%1 -5'3-/;
Master.bmp
4HÇ
;f.MIN
1.KILJ
X%XWz[
>~.ue
MenuSupport.IcoLineSkin
ICOLINE!MenuSupport.ExtraLineFont.Charset
MenuSupport.ExtraLineFont.Color
clWindowText MenuSupport.ExtraLineFont.Height
MenuSupport.ExtraLineFont.Name
MenuSupport.ExtraLineFont.Style
ThirdParty.ThirdEdits
ThirdParty.ThirdButtons
ThirdParty.ThirdBitBtns
ThirdParty.ThirdCheckBoxes
ThirdParty.ThirdGroupBoxes
ThirdParty.ThirdListViews
ThirdParty.ThirdPanels
ThirdParty.ThirdGrids
ThirdParty.ThirdTreeViews
ThirdParty.ThirdComboBoxes
ThirdParty.ThirdWWEdits
ThirdParty.ThirdVirtualTrees
ThirdParty.ThirdGridEh
ThirdParty.ThirdPageControl
ThirdParty.ThirdTabControl
ThirdParty.ThirdToolBar
ThirdParty.ThirdStatusBar
ThirdParty.ThirdSpeedButton
FormKeyPress
Constraints.MaxHeight
Constraints.MaxWidth
Glyph.Data
SkinData.CustomColor
GlyphMode.Grayed
Colors.Strings
sEditHexKeyPress
errorUrl
hXXp://box.playcheat.net/blog/
Add to custom colors set8Listbox (%s) style must be virtual in order to set Count
Error setting %s.Count
OLE error %.8x.Method '%s' not supported by automation object/Variant does not reference an automation object7Dispatch methods do not support more than 64 parameters
OLE control activation failed*Could not obtain OLE control window handle%License information for %s is invalidPLicense information for %s not found. You cannot use this control in design modeNUnable to retrieve a pointer to a running object registered with OLE for %s/%s
No help keyword specified.&Cannot change the size of a JPEG image
JPEG error #%d
Unable to insert a line Clipboard does not support Icons
Cannot open clipboard/Menu '%s' is already being used by another form
No help found for %s#No context-sensitive help installed$No topic-based help system installed
Error creating window class Cannot focus a disabled or invisible window!Control '%s' has no parent window
$%s not in a class registration group
Property %s does not exist
Scan line index out of range!Cannot change the size of an icon Invalid operation on TOleGraphic
Unsupported clipboard format
Invalid data type for '%s' List capacity out of bounds (%d)
List count out of bounds (%d)
List index out of bounds (%d) Out of memory while expanding memory stream
Error reading %s%s%s: %s
Failed to create key %s
Failed to get data for '%s'
Failed to set data for '%s'
Resource %s not found
%s.Seek not implemented$Operation not allowed on sorted list
Ancestor for '%s' not found
Cannot assign a %s to a %s
Bits index out of range*Can't write to a read-only resource streamECheckSynchronize called from thread $%x, which is NOT the main thread
Class %s not found
A class named %s already exists%List does not allow duplicates ($0%x)#A component named %s already exists%String list does not allow duplicates
Cannot create file "%s". %s
Cannot open file "%s". %s
Invalid stream format$''%s'' is not a valid component name
Invalid property element: %s
External exception %x
Interface not supported
%s (%s, line %d)
Abstract Error?Access violation at address %p in module '%s'. %s of address %p
System Error. Code: %d.
"Variant method calls not supported
Invalid variant operation
Invalid NULL variant operation%Invalid variant operation (%s%.8x)
%s5Could not convert variant of type (%s) into type (%s)=Overflow while converting variant of type (%s) into type (%s)
Operation not supported
Integer overflow Invalid floating point operation
Invalid pointer operation
Invalid class typecast0Access violation at address %p. %s of address %p
Privileged instruction(Exception %s in module %s at %p.
Application Error1Format '%s' invalid or incompatible with argument
No argument for format '%s'
!'%s' is not a valid integer value('%s' is not a valid floating point value
'%s' is not a valid date
'%s' is not a valid time!'%s' is not a valid date and time
I/O error %d

setup.EXE_3568_rwx_007F9000_00002000:

<assemblyIdentity type="win32" name="PlayCheat - PBBR.exe" version="3.1.0.0" processorArchitecture="*"/>
<assemblyIdentity type="win32" name="Microsoft.Windows.Common-Controls" version="6.0.0.0" publicKeyToken="6595b64144ccf1df" language="*" processorArchitecture="*"/>
<requestedExecutionLevel level="requireAdministrator" uiAccess="false"/>
<!--The ID below indicates application support for Windows Vista -->
<supportedOS Id="{e2011457-1546-43c5-a5fe-008deee3d3f0}"/>
<!--The ID below indicates application support for Windows 7 -->
<supportedOS Id="{35138b9a-5d96-4fbd-8e2d-a2440225f93a}"/>
kernel32.dll
user32.dll
GetKeyboardType
advapi32.dll
oleaut32.dll
version.dll
gdi32.dll
ole32.dll
comctl32.dll
shell32.dll
ShellExecuteExA
wininet.dll
URLMON.DLL
msimg32.dll
%SWVUP

explore.exe_532:

.text
`.rsrc
@.reloc
v2.0.50727
System.Runtime.CompilerServices
.ctor
Microsoft.VisualBasic.CompilerServices
System.IO
Microsoft.VisualBasic.Devices
System.Net.Sockets
TcpClient
System.Reflection
Microsoft.VisualBasic.MyServices
Microsoft.Win32
RegistryKey
OpenSubKey
CreateSubKey
Operators
OperatingSystem
Microsoft.VisualBasic
RegistryKeyPermissionCheck
System.Text
System.IO.Compression
DeleteSubKey
System.Threading
System.Diagnostics
System.Net
WebClient
System.Drawing
System.Windows.Forms
System.Drawing.Imaging
CopyPixelOperation
System.Security.Cryptography
Join
Keys
Keyboard
get_Keyboard
get_ShiftKeyDown
get_CtrlKeyDown
j.exe
avicap32.dll
user32.dll
.cctor
lastKey
GetKeyboardState
MapVirtualKey
GetKeyboardLayout
GetAsyncKeyState
_CorExeMain
mscoree.dll
<assemblyIdentity version="1.0.0.0" name="MyApplication.app"/>
<requestedExecutionLevel level="asInvoker" uiAccess="false"/>
explore.exe
iagodornelas25.duckdns.org
Software\Microsoft\Windows\CurrentVersion\Run
??-??-??
Windows
cmd.exe /c ping 0 -n 2 & del "

taskeng.exe_852:

.text
`.data
.rsrc
@.reloc
USER32.dll
msvcrt.dll
ntdll.dll
API-MS-Win-Core-Debug-L1-1-0.dll
API-MS-Win-Core-ErrorHandling-L1-1-0.dll
API-MS-Win-Core-File-L1-1-0.dll
API-MS-Win-Core-Handle-L1-1-0.dll
API-MS-Win-Core-Heap-L1-1-0.dll
API-MS-Win-Core-Interlocked-L1-1-0.dll
API-MS-Win-Core-LibraryLoader-L1-1-0.dll
API-MS-Win-Core-Misc-L1-1-0.dll
API-MS-Win-Core-ProcessEnvironment-L1-1-0.dll
API-MS-Win-Core-ProcessThreads-L1-1-0.dll
API-MS-Win-Core-Profile-L1-1-0.dll
API-MS-Win-Core-Synch-L1-1-0.dll
API-MS-Win-Core-SysInfo-L1-1-0.dll
API-MS-Win-Core-ThreadPool-L1-1-0.dll
API-MS-Win-Security-Base-L1-1-0.dll
ole32.dll
OLEAUT32.dll
RPCRT4.dll
KERNEL32.dll
d:\w7rtm\admin\wmi\jobs\server\session\session\main.cpp
Session::ChannelMsgReceived
d:\w7rtm\admin\wmi\jobs\server\session\session\session.cpp
d:\w7rtm\admin\wmi\jobs\server\session\session\clientchannel2.cpp
d:\w7rtm\admin\wmi\jobs\server\engine\task.cpp
d:\w7rtm\admin\wmi\jobs\server\engine\comhandlerbase.cpp
StopJobMsg
StartJobMsg
ClientPipeName
Invalid parameter passed to C runtime function.
d:\w7rtm\admin\wmi\jobs\common\xml\taskxmlreader.cpp
TaskScheduler.log
j%Xf;
d:\w7rtm\admin\wmi\jobs\server\engine\action.cpp
API-MS-WIN-Service-Management-L1-1-0.dll
API-MS-WIN-Service-winsvc-L1-1-0.dll
ADVAPI32.dll
SHELL32.dll
SHLWAPI.dll
SspiCli.dll
XmlLite.dll
MPR.dll
RegOpenKeyTransactedW
RegCloseKey
RegOpenKeyExW
RegNotifyChangeKeyValue
RegCreateKeyExW
FindExecutableW
MsgWaitForMultipleObjects
EnumThreadWindows
EnumWindows
GetProcessWindowStation
_wcmdln
_amsg_exit
GetProcessHeap
SetProcessShutdownParameters
TaskEng.pdb
version="5.1.0.0"
name="Microsoft.Windows.WMI.TaskScheduler.TaskEng"
<requestedExecutionLevel
8 8$8(878
3=4Z4w4
=!=(=0=4=?=>>
5 5U5_5
5b6u6
-131J1X1o1}1
=$=<=\=|=
Password
hXXp://schemas.microsoft.com/windows/2004/02/mit/task
Jieframe.dll
%SystemRoot%\SYSTEM32\cmd.exe
%SystemRoot%\System32\Tasks
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\Configuration
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\Handshake
WindowSeconds
InitializeCmdlineProcessing()
pCrimson provider registration failed for taskeng, hr=0x%x
CATCH_KNOWN: %S ==> hr=0x%x [%S(),%d,%S]
InteractiveTokenOrPassword
Jurl
%d.%d
%s, (%d)
hXXp://schemas.microsoft.com/cdo/configuration/smtpconnectiontimeout
hXXp://schemas.microsoft.com/cdo/configuration/smtpauthenticate
hXXp://schemas.microsoft.com/cdo/configuration/sendusing
hXXp://schemas.microsoft.com/cdo/configuration/smtpserver
201ef99a-7fa0-444c-9399-19ba84f12a1a
C:\Windows\SYSTEM32\cmd.exe
6.1.7601.17514 (win7sp1_rtm.101119-1850)
taskeng.exe
Windows
Operating System
6.1.7601.17514

explore.exe_532_rwx_00400000_0000C000:

.text
`.rsrc
@.reloc
v2.0.50727
System.Runtime.CompilerServices
.ctor
Microsoft.VisualBasic.CompilerServices
System.IO
Microsoft.VisualBasic.Devices
System.Net.Sockets
TcpClient
System.Reflection
Microsoft.VisualBasic.MyServices
Microsoft.Win32
RegistryKey
OpenSubKey
CreateSubKey
Operators
OperatingSystem
Microsoft.VisualBasic
RegistryKeyPermissionCheck
System.Text
System.IO.Compression
DeleteSubKey
System.Threading
System.Diagnostics
System.Net
WebClient
System.Drawing
System.Windows.Forms
System.Drawing.Imaging
CopyPixelOperation
System.Security.Cryptography
Join
Keys
Keyboard
get_Keyboard
get_ShiftKeyDown
get_CtrlKeyDown
j.exe
avicap32.dll
user32.dll
.cctor
lastKey
GetKeyboardState
MapVirtualKey
GetKeyboardLayout
GetAsyncKeyState
_CorExeMain
mscoree.dll
<assemblyIdentity version="1.0.0.0" name="MyApplication.app"/>
<requestedExecutionLevel level="asInvoker" uiAccess="false"/>
explore.exe
iagodornelas25.duckdns.org
Software\Microsoft\Windows\CurrentVersion\Run
??-??-??
Windows
cmd.exe /c ping 0 -n 2 & del "


Remove it with Ad-Aware

  1. Click (here) to download and install Ad-Aware Free Antivirus.
  2. Update the definition files.
  3. Run a full scan of your computer.


Manual removal*

  1. Terminate malicious process(es) (How to End a Process With the Task Manager):

    explore.exe:3808
    Áudio do Windows.EXE:3512
    %original file name%.exe:3428
    netsh.exe:3352

  2. Delete the original Trojan file.
  3. Delete or disinfect the following files created/modified by the Trojan:

    C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\000372a60fd07aeaad4e41aacc913275.exe (1425 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Dllhost.exe (89 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe (44 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Server.exe (44 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Áudio do Windows.exe (89 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\setup.exe (3361 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\explorer.exe (1695 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017061420170615\index.dat (16 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\25FDO7QC\playpatcher[1].htm (2 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\OL61VJMF.txt (114 bytes)

  4. Delete the following value(s) in the autorun key (How to Work with System Registry):

    [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "000372a60fd07aeaad4e41aacc913275" = "C:\Users\"%CurrentUserName%"\AppData\Local\Temp\explore.exe .."

    [HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
    "000372a60fd07aeaad4e41aacc913275" = "C:\Users\"%CurrentUserName%"\AppData\Local\Temp\explore.exe .."

    [HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
    "Windows Update" = "C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Dllhost.exe .."

    [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "Windows Update" = "C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Dllhost.exe .."

  5. Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
  6. Reboot the computer.

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

No votes yet


Lavasoft is the maker of Ad-Aware, the world's most popular anti-malware software with over 450 million downloads.
© 2025 Lavasoft. All rights reserved.
Terms Of Use |   Privacy Policy


x

Our best antivirus yet!

Fresh new look. Faster scanning. Better protection.

Enjoy unique new features, lightning fast scans and a simple yet beautiful new look in our best antivirus yet!

For a quicker, lighter and more secure experience, download the all new adaware antivirus 12 now!

Download adaware antivirus 12
No thanks, continue to lavasoft.com
close x

Discover the new adaware antivirus 12

Our best antivirus yet

Download Now