Gen.Variant.Kazy.276834_0aecb6afe3

by malwarelabrobot on January 31st, 2017 in Malware Descriptions.

HEUR:Trojan.Win32.Generic (Kaspersky), Gen:Variant.Kazy.276834 (B) (Emsisoft), Gen:Variant.Kazy.276834 (AdAware), Trojan.Win32.Sasfis.FD, VirTool.Win32.DelfInject.FD, GenericInjector.YR (Lavasoft MAS)
Behaviour: Trojan, VirTool


The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.

Requires JavaScript enabled!

Summary
Dynamic Analysis
Static Analysis
Network Activity
Map
Strings from Dumps
Removals

MD5: 0aecb6afe317a0bb2b969466f047a7e1
SHA1: c3f4b05900c3476dbab4392c7bb9cd3afb732e0a
SHA256: 26fb400b8e17e802d3d54b2ad77cf156858e39a67240027989b67aec21e56528
SSDeep: 12288:365MBnh54DQwE8O4DhA0AGddsEVanF5rqCsg7k9EpvzH:xIDQwFO4N iCHPD
Size: 551936 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: MicrosoftVisualC, NETexecutable, UPolyXv05_v6
Company: Mail.Ru
Created at: 2017-01-25 10:49:15
Analyzed on: Windows7 SP1 32-bit


Summary:

Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).

Payload

No specific payload has been found.

Process activity

The Trojan creates the following process(es):

cscript.exe:4020
csc.exe:3424

The Trojan injects its code into the following process(es):

explorer.exe:992
Explorer.EXE:1440

Mutexes

The following mutexes were created/opened:
No objects were found.

File activity

The process cscript.exe:4020 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\teste.txt (2 bytes)

The process csc.exe:3424 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\adm2.txt (230 bytes)
C:\Windows\System32\Driver\svchost.exe (601 bytes)

Registry activity

The process csc.exe:3424 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run]
"Policies" = "C:\Windows\system32\Driver\svchost.exe"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run]
"Policies" = "C:\Windows\system32\Driver\svchost.exe"

[HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\{S6DI21WB-13R4-OO0H-O648-2MWW631C7EB8}]
"StubPath" = "C:\Windows\system32\Driver\svchost.exe Restart"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"HKCU" = "C:\Windows\system32\Driver\svchost.exe"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"HKLM" = "C:\Windows\system32\Driver\svchost.exe"

Dropped PE files

MD5 File path
3d7d2e825c63ff501e896cf008c70d75 c:\Windows\System32\Driver\svchost.exe

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

VersionInfo

Company Name: MyImgur Programming Team.
Product Name: MyImgur
Product Version: 5.11.2.0
Legal Copyright: Copyright (c)MyImgur Programming Team.
Legal Trademarks: MyImgur(tm). All rights reserved.
Original Filename: dddd.exe
Internal Name: dddd.exe
File Version: 5.11.2.0
File Description: MyImgur
Comments: An application to upload images directly to Imgur.
Language: Chinese (Simplified, PRC)

PE Sections

Name Virtual Address Virtual Size Raw Size Entropy Section MD5
.text 8192 531252 531456 5.23118 f93a4e9fb6c24d4466c7301b840f546f
.rsrc 540672 18224 18432 4.23983 f66ce4a9b9b3d9cb551eb46b70c2e03d
.reloc 565248 12 1024 0.037362 206dcb9de55467ffb528766a3fc341ef

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

URLs

URL IP
crocrocro35.ddns.net 94.253.131.3


IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

The Trojan connects to the servers at the folowing location(s):

explorer.exe_992:

.text
`.data
.rsrc
@.reloc
ADVAPI32.dll
ntdll.DLL
KERNEL32.dll
GDI32.dll
USER32.dll
msvcrt.dll
SHLWAPI.dll
SHELL32.dll
ole32.dll
OLEAUT32.dll
EXPLORERFRAME.dll
UxTheme.dll
POWRPROF.dll
dwmapi.dll
slc.dll
gdiplus.dll
Secur32.dll
SSPICLI.DLL
RPCRT4.dll
PROPSYS.dll
QSShM
PSSh^
FtPhq
SSSSh
SShxSc
PSSh,
QPSSSShL
t7WSSh
SSShO
tfSSh
Software\Microsoft\Windows\CurrentVersion\Explorer\StartMenu\StartPanel
kernel32.dll
t.It It
taSSSh
explorer.exe
FtPhO
SSShI
F8SSh
tRSSh
PSSh|$h
PSShL$h
t}SShV
tKSSSh
t SSSh
?.ulf
.ue9]
TaskDialogIndirect
TSAppCMP.DLL
SSShT
PSSShA
SSSh?
SSShB
t.Ht%Ht
SSSShD
WINMM.dll
CFGMGR32.dll
WINSTA.dll
OLEACC.dll
WINBRAND.dll
DUI70.dll
SndVolSSO.DLL
netutils.dll
wkscli.dll
NetGetJoinInformation
ntdll.dll
RegCloseKey
RegCreateKeyW
RegOpenKeyExW
RegCreateKeyExW
RegDeleteKeyExW
RegOpenKeyW
RegQueryInfoKeyW
RegEnumKeyExW
CreateIoCompletionPort
GetWindowsDirectoryW
GetProcessHeap
SetProcessShutdownParameters
OffsetViewportOrgEx
GetViewportOrgEx
SetViewportOrgEx
EnumChildWindows
GetKeyboardLayout
ActivateKeyboardLayout
GetProcessWindowStation
UnhookWindowsHookEx
SetWindowsHookExW
MsgWaitForMultipleObjectsEx
TileWindows
CascadeWindows
EnumWindows
UnregisterHotKey
RegisterHotKey
GetAsyncKeyState
GetKeyState
MsgWaitForMultipleObjects
ExitWindowsEx
_amsg_exit
_wcmdln
SHDeleteKeyW
SHQueryInfoKeyW
AssocQueryKeyW
ShellExecuteExW
ShellExecuteW
SHFileOperationW
SLGetWindowsInformationDWORD
GdiplusShutdown
explorer.pdb
name="Microsoft.Windows.Shell.explorer"
version="5.1.0.0"
<description>Windows Shell</description>
name="Microsoft.Windows.Common-Controls"
version="6.0.0.0"
publicKeyToken="6595b64144ccf1df"
<requestedExecutionLevel level="asInvoker" uiAccess="false"/>
<windowsSettings>
<dpiAware xmlns="hXXp://schemas.microsoft.com/SMI/2005/WindowsSettings">true</dpiAware>
</windowsSettings>
{;;;;{;;
I51111111111111.1.1.B
46464444
*,,.,,.,'/'....'/
1888661
A1.<yjjjggbbZYV?=9.=zjjjjgddbabYV>.=||wwwwpggb_a`X.?0......Tmmkj__.<S
k}??F.o
Ja(%F
uz.In
#-.12220 *!
(-12220 
Knmhe.HH
%Mgr.RhY4RfE5Qd:d
2<===@@=
&$%Uooqkezs
['$$#%&(4
5>^666^.>66^6>>>
>>^6^.>^6>
5^66^6>66
6>>6^6^>=>>6>6>
>>^66>6>^6^6^6
>=>>^6>>=
=_>>7>_6_>>>>
>^.>^.6^'
=6^66^66>>
7'''')) 
3'')))33.
.mnnw
4444444444
288888888882
911111111119
,Cÿ>I
..--11///06
%F|aD
%XX^^
%XXX^
%UXXX
!$$$$'$$#$!!"
6****,@=
!!1.WN
!..WKA@?
::8240-)%2/
,-(%(-(%%*%**17
!#)'&4,- 
=$.VP^
0.rJ)I
\.gh.v(sO
W%3UI
0.aT@
%D&PJ
1.JV2
t4%CU
uvm%s|
Ep.SU0
kq.kV
njW%c
 !/.!375
@$@:'&%:
(*),,,0001
!!! ###%%$
n.2.Ýdddddddd
*.UGA
%u}} mtt
&PQMSornurl[
%XR8]
....raK
***.sdR
,-il}
%%%Ìccr`H
./".LMBNmnPPa
.jkL^
45 .WX]n
$$$$!!!!
%%%%$$$$!!!!
&&&&%%%%$$$$!!!!
@6'~@6'~
=4$|=4$|
$$$$""""
%%%%$$$$""""
&&&&%%%%$$$$""""
;2${;2${=4$}
####!!!!
$$$$####!!!!
%%%%$$$$####!!!!
&&&&%%%%$$$$####!!!!
####""""
$$$$####""""
%%%%$$$$####""""
4 4$4(4,4
;#< <8<><]<
; ;(;0;8;
1 1$1(1,1014181<1
3"3)30373>3
70767<7}7
%0,090?0
<$</<8<]<
=0>9>?>[>
5 5&565<5
<&= =4=\=
; ;$;(;,;0;4;8;<;@;
5#5)5:5@5]5
= >(>8>>>
; ;$;(;,;0;4;
323d3m3
3 3%3:3|3
0 1$1(1,10141
9 9$9(9,9
9(:,:0:4:8:<:
1 2$2(2,20242
: :$:(:,:
:(;,;0;4;8;<;
< <$<(<,<
< =$=(=,=0=4=8=<=
2 3$3(3,30343
; ;$;(;,;
;(<,<0<4<8<<<
9":,:^:{:
0$0*01070?0
:$: :1:7:
5"5=5{5=6
UseExecutableForTaskbarGroupIcon
Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced
Software\Microsoft\Windows\CurrentVersion\Explorer
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage
{59031a47-3f72-44a7-89c5-5595fe6b30ee}
imageres.dll
::{E44E5D18-0652-4508-A4E2-8A090067BCB0}
::{26EE0668-A00A-44D7-9371-BEB064C98683}\5\::{D20EA4E1-3957-11d2-A40B-0C5020524153}
::{26EE0668-A00A-44D7-9371-BEB064C98683}\0\::{38A98528-6CBF-4CA9-8DC0-B1E1D10F7B1B}
::{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}
Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\SearchExtensions
shell:::{e345f35f-9397-435c-8f95-4e922c26259e}
shell:::{daf95313-e44d-46af-be1b-cbacea2c3065}
%s\%s
user.bmp
%s\%s\%s
%s::%s
{A1965210-3A9D-4bca-822B-433645B3F5A2}
%LocalAppData%\Microsoft\Windows\Explorer
Local\ExplorerIsShellMutex
Software\Microsoft\Windows\CurrentVersion\Explorer\FolderTypes\{EF87B4CB-F2CE-4785-8658-4CA6C63E38C6}\TopViews\{00000000-0000-0000-0000-000000000000}
Software\Policies\Microsoft\Windows\Explorer
Software\Microsoft\Windows\CurrentVersion\RunOnce
Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run
Software\Microsoft\Windows\CurrentVersion\Run
DisabledHotkeys
Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\DelayedApps
Software\Microsoft\Windows NT\CurrentVersion\Windows,Load
Software\Microsoft\Windows NT\CurrentVersion\Windows
UserChosenExecuteHandlers\%s
Software\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers
Software\Microsoft\Windows\CurrentVersion\ThemeManager
USER32.DLL
Software\Microsoft\Windows\CurrentVersion\Explorer\Taskband
comctl32.dll
Software\Microsoft\Windows\CurrentVersion\Explorer\ControlPanel
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones
Software\Microsoft\Windows\CurrentVersion\Themes
Software\Microsoft\Windows\CurrentVersion\RunOnceEx
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
system.ini
::{2559a1f2-21d7-11d4-bdaf-00c04f60b9f0}
::{2559a1f1-21d7-11d4-bdaf-00c04f60b9f0}
::{26EE0668-A00A-44D7-9371-BEB064C98683}\2\::{A8A91A66-3A7D-4424-8D24-04E180695C7A}
{5399E694-6CE5-4D6C-8FCE-1D8870FDCBA0}
::{5399E694-6CE5-4D6C-8FCE-1D8870FDCBA0}
{20D04FE0-3AEA-1069-A2D8-08002B30309D}
::{0c39a5cf-1a7a-40c8-ba74-8900e6df5fcd}
Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites
SOFTWARE\Microsoft\Windows\CurrentVersion\Diagnostics\Performance\Shell\ResponseMonitor
Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify
Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
AppEvents\Schemes\Apps\%s\%s\.current
.Default
Software\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\UAS
control.exe
{A4756F80-4AE7-4A1F-A776-F5E9D9B04406}
Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel
Software\Microsoft\Windows\DWM
Microsoft-Windows-DesktopWindowManager-Core-LivePreviewAllowed
Microsoft.Windows.ControlPanel.Taskbar
%systemRoot%\system32\rundll32.exe %systemRoot%\system32\shell32.dll,Options_RunDLL 1
shell32.dll,-40
@explorer.exe,-810
Microsoft.NotificationAreaIcons
timedate.cpl
Software\Microsoft\Windows\CurrentVersion\Policies\System
Software\Microsoft\Windows\CurrentVersion\Explorer\ApplicationDestinations\
HELP_ENTRY_ID_START_MENU_HELP_AND_SUPPORT
WindowsLogon
WindowsLogoff
*PIDx
Windows
SOFTWARE\Microsoft\Windows\CurrentVersion\Control Panel
install.exe
@themeui.dll,-853
@themeui.dll,-852
@themeui.dll,-851
@themeui.dll,-850
runonce.exe
NoDataExecutionPrevention
UpdateURL
WindowsUpdate
Software\Microsoft\Windows\CurrentVersion\Explorer\NotificationCustomization
Software\Microsoft\Windows\CurrentVersion\Explorer\Remote\%d
Software\Microsoft\Windows NT\CurrentVersion\Windows,Run
Software\Microsoft\Windows\CurrentVersion\OOBE
Software\Microsoft\Windows\CurrentVersion\Explorer\StartPage\NewShortcuts
shell32.dll
Microsoft.UserAccounts
Software\Microsoft\Windows\CurrentVersion\Explorer\StartPage
NewExeName
desk.cpl
Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\FirstFolder
Software\Microsoft\Windows\CurrentVersion\Explorer\Comdlg32\LastVisitedPidlMRULegacy
Software\Microsoft\Windows\CurrentVersion\Explorer\Comdlg32\LastVisitedPidlMRU
Software\Microsoft\Windows\CurrentVersion\Explorer\Comdlg32\OpenSavePidlMRU
Software\Microsoft\Windows\CurrentVersion\Explorer\Doc Find Spec MRU
Software\Microsoft\Windows\CurrentVersion\Explorer\TypedPaths
Software\Microsoft\Internet Explorer\TypedURLs
mshelp://windows/?id=c45acd5d-98b5-4245-8ce6-1f7bba654767
hSystem.StructuredQueryType.AllBitsSet
System.StructuredQueryType.AnyBitsSet
System.StructuredQueryType.SortKeyDescription
Accessories\Windows PowerShell\Windows PowerShell.lnk
Administrative Tools\Server Manager.lnk
Windows Media Player.lnk
Accessories\Windows Explorer.lnk
Internet Explorer.lnk
Accessories\Notepad.lnk
Accessories\Command Prompt.lnk
Windows Fax and Scan.lnk
XPS Viewer.lnk
Accessories\displayswitch.lnk
Accessories\Wordpad.lnk
Windows Anytime Upgrade.lnk
{00D8862B-6453-4957-A821-3D98D74C76BE}
Accessories\Accessibility\Magnify.lnk
Accessories\Remote Desktop Connection.lnk
Accessories\Paint.lnk
Accessories\Snipping Tool.lnk
Accessories\Sticky Notes.lnk
Accessories\Calculator.lnk
Media Center.lnk
Accessories\Welcome Center.lnk
Microsoft.Windows.ControlPanel
CLSID\%s\ShellExplorerRoot
AlwaysShowMenus
WebView
AltTab_KeyHookWnd
/globalhotkey
"%systemroot%\system32\magnify.exe"
SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\system
shell32.dll,WaitForExplorerRestart "
"%systemroot%\system32\rundll32.exe"
%s%d%s
%s, %s, %s
Software\Microsoft\Windows\CurrentVersion\Explorer\NotificationArea\PromotedIcon2
Software\Microsoft\Windows\CurrentVersion\Explorer\NotificationArea\PromotedIcon1
?guid=%s&hwnd=%lu&id=%lu&ecrc=%lu
{00000000-0000-0000-0000-000000000000}
\\?\Volume
mshelp://windows/?id=5de7c31f-1b8b-4431-9d3d-c0994939b186
\\?\UNC\
Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist
taskmgr.exe
ShellExecute
Software\Microsoft\Windows\CurrentVersion\Explorer\AppKey\%d
AppEvents\Schemes\Apps\.Default\%ws\.Current
D:(A;;GA;;;SY)(A;;0x%x;;;%s)
D:(A;;GA;;;SY)(A;;0x%x;;;%s)S:(ML;;1;;;LW)
%s%I64u%s
%s%g%s
%s%I64d%s
RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL ?0x%X?%s
RunDLL32.EXE
SOFTWARE\Microsoft\Windows\CurrentVersion\explorer\ControlPanel\NameSpace\{5ea4f148-308c-46d7-98a9-49041b1dd468}
Software\Microsoft\Windows\CurrentVersion\SMDEn
SOFTWARE\Microsoft\Windows\Tablet PC
OEM%d
%s %s
%SystemRoot%\system32\GettingStarted.exe
Microsoft.Windows.GettingStarted
SBOEM%d
Software\Microsoft\Windows\CurrentVersion\Explorer\TBDEn
Software\Microsoft\Windows\CurrentVersion\Explorer\OEMWC
Accessories\Mobility Center.lnk
@%s,%d
WCOEM%d
Software\Microsoft\Windows\CurrentVersion\Explorer\WCDEn
{00021401-0000-0000-C000-000000000046}
Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU
StartMenuKeyBoard
StartMenuKeyBoardComposited
201ef99a-7fa0-444c-9399-19ba84f12a1a
%WINDOWS_LONG%
mshelp://windows/?id=83f968d5-844e-408c-a7c4-69ff50f0ff54
@tzres.dll,
\tzres.dll
Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}
.\%s.mui
.\%s\%s.mui
%s\%s.mui
%s\%s\%s.mui
guest.bmp
"? %s"
hXXps://
hXXp://
Windows Explorer
6.1.7601.17567 (win7sp1_gdr.110224-1502)
EXPLORER.EXE
Windows
Operating System
6.1.7601.17567

explorer.exe_992_rwx_00060000_00001000:

KERNEL32.DLL

explorer.exe_992_rwx_000A0000_00001000:

KERNEL32.DLL

svchost.exe_548:

.text
`.data
.rsrc
%f=?0t
SShE/
SShF/
CSSh40
YYSSh>0
VERSION.dll
ADVAPI32.dll
cscomp.dll
USER32.dll
SHLWAPI.dll
OLEAUT32.dll
ole32.dll
mscoree.dll
KERNEL32.dll
MSVCR80.dll
_amsg_exit
_crt_debugger_hook
GetProcessHeap
GetConsoleOutputCP
PathIsURLW
csc.pdb
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"><assemblyIdentity version="1.0.0.0" processorArchitecture="X86" name="csc" type="win32" publicKeyToken="000000000000000"></assemblyIdentity><dependency><dependentAssembly><assemblyIdentity type="win32" name="Microsoft.VC80.CRT" version="8.0.50608.0" processorArchitecture="x86" publicKeyToken="1fc8b3b9a1e18e3b"></assemblyIdentity></dependentAssembly></dependency><trustInfo xmlns="urn:schemas-microsoft-com:asm.v3">
<requestedExecutionLevel level="asInvoker" uiAccess="false"></requestedExecutionLevel>
(%d,%d)
%s %sd:
bugreport:
bugreport
Unable to find messages file '%s'
cscompui.dll
(%d,%d)-(%d,%d)
csc.rsp
%s\%s
winexe
target:winexe
t:winexe
target:exe
t:exe
0xx
(0xx)
/%s[ |-]
/%s[ |-]:%s
/%s:%s
%s (%s: /%s)
%d.d.d.%d
%d.d.d
mscorlib.dll
Windows NT
Windows 9x
8.0.50727.4927 (NetFXspW7.050727-4900)
csc.exe
8.0.50727.4927

conhost.exe_1776:

.text
`.data
.rsrc
@.reloc
GDI32.dll
USER32.dll
msvcrt.dll
ntdll.dll
API-MS-Win-Core-LocalRegistry-L1-1-0.dll
KERNEL32.dll
IMM32.dll
ole32.dll
OLEAUT32.dll
PutInputInBuffer: EventsWritten != 1 (0x%x), 1 expected
Invalid message 0x%x
InitExtendedEditKeys: Unsupported version number(%d)
Console init failed with status 0x%x
CreateWindowsWindow failed with status 0x%x, gle = 0x%x
InitWindowsStuff failed with status 0x%x (gle = 0x%x)
InitSideBySide failed create an activation context. Error: %d
GetModuleFileNameW requires more than ScratchBufferSize(%d) - 1.
GetModuleFileNameW failed %d.
Invalid EventType: 0x%x
Dup handle failed for %d of %d (Status = 0x%x)
Couldn't grow input buffer, Status == 0x%x
InitializeScrollBuffer failed, Status = 0x%x
CreateWindow failed with gle = 0x%x
Opening Font file failed with error 0x%x
\ega.cpi
NtReplyWaitReceivePort failed with Status 0x%x
ConsoleOpenWaitEvent failed with Status 0x%x
NtCreatePort failed with Status 0x%x
GetCharWidth32 failed with error 0x%x
GetTextMetricsW failed with error 0x%x
GetSystemEUDCRangeW: RegOpenKeyExW(%ws) failed, error = 0x%x
RtlStringCchCopy failed with Status 0x%x
Cannot allocate 0n%d bytes
|%SWj
O.fBf;
ReCreateDbcsScreenBuffer failed. Restoring to CP=%d
Invalid Parameter: 0x%x, 0x%x, 0x%x
ConsoleKeyInfo buffer is full
Invalid screen buffer size (0x%x, 0x%x)
SetROMFontCodePage: failed to memory allocation %d bytes
FONT.NT
Failed to set font image. wc=x, sz=(%x,%x)
Failed to set font image. wc=x sz=(%x, %x).
Failed to set font image. wc=x sz=(%x,%x)
FullscreenControlSetColors failed - Status = 0x%x
FullscreenControlSetPalette failed - Status = 0x%x
WriteCharsFromInput failed 0x%x
WriteCharsFromInput failed %x
RtlStringCchCopyW failed with Status 0x%x
CreateFontCache failed with Status 0x%x
FTPh
\>.Sj
GetKeyboardLayout
MapVirtualKeyW
VkKeyScanW
GetKeyboardState
UnhookWindowsHookEx
SetWindowsHookExW
GetKeyState
ActivateKeyboardLayout
GetKeyboardLayoutNameA
GetKeyboardLayoutNameW
_amsg_exit
_acmdln
ShipAssert
NtReplyWaitReceivePort
NtCreatePort
NtEnumerateValueKey
NtQueryValueKey
NtOpenKey
NtAcceptConnectPort
NtReplyPort
SetProcessShutdownParameters
GetCPInfo
conhost.pdb
%$%a%b%V%U%c%Q%W%]%\%[%
%<%^%_%Z%T%i%f%`%P%l%g%h%d%e%Y%X%R%S%k%j%
version="5.1.0.0"
name="Microsoft.Windows.ConsoleHost"
<requestedExecutionLevel
name="Microsoft.Windows.ConsoleHost.SystemDefault"
publicKeyToken="6595b64144ccf1df"
name="Microsoft.Windows.SystemCompatible"
version="6.0.0.0"
publicKeyToken="6595b64144ccf1df"
< =$>:>@>
2%2X2
%SystemRoot%
\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Console\TrueTypeFont
\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Console\FullScreen
WindowSize
ColorTableu
ExtendedEditkeyCustom
ExtendedEditKey
Software\Microsoft\Windows\CurrentVersion
\ !:=/.<>;|&
%d/%d
cmd.exe
desktop.ini
\console.dll
%d/%d
6.1.7601.17641 (win7sp1_gdr.110623-1503)
CONHOST.EXE
Windows
Operating System
6.1.7601.17641

explorer.exe_992_rwx_001B0000_00001000:

KERNEL32.DLL

explorer.exe_992_rwx_00270000_00001000:

KERNEL32.DLL

explorer.exe_992_rwx_002B0000_00001000:

KERNEL32.DLL

explorer.exe_992_rwx_002F0000_00001000:

KERNEL32.DLL

explorer.exe_992_rwx_00320000_00001000:

advapi32.dll

explorer.exe_992_rwx_00350000_00001000:

RegOpenKeyA

explorer.exe_992_rwx_00360000_00001000:

advapi32.dll

explorer.exe_992_rwx_00470000_00001000:

AVICAP32.DLL

explorer.exe_992_rwx_005F0000_00001000:

AVICAP32.DLL

explorer.exe_992_rwx_015F0000_00001000:

gdi32.dll

explorer.exe_992_rwx_01630000_00001000:

gdi32.dll

explorer.exe_992_rwx_01660000_00001000:

gdiplus.dll

explorer.exe_992_rwx_016A0000_00001000:

gdiplus.dll

explorer.exe_992_rwx_016D0000_00001000:

mpr.dll

explorer.exe_992_rwx_01750000_00001000:

mpr.dll

explorer.exe_992_rwx_017C0000_00001000:

msacm32.dll

explorer.exe_992_rwx_01800000_00001000:

msacm32.dll

explorer.exe_992_rwx_01830000_00001000:

ntdll.dll

explorer.exe_992_rwx_018B0000_00001000:

ntdll.dll

explorer.exe_992_rwx_01920000_00001000:

ole32.dll

explorer.exe_992_rwx_019A0000_00001000:

ole32.dll

explorer.exe_992_rwx_019D0000_00001000:

oleaut32.dll

explorer.exe_992_rwx_01A10000_00001000:

oleaut32.dll

explorer.exe_992_rwx_01A40000_00001000:

powrprof.dll

explorer.exe_992_rwx_01BC0000_00001000:

powrprof.dll

explorer.exe_992_rwx_01CB0000_00001000:

shell32.dll

explorer.exe_992_rwx_01CE0000_00001000:

ShellExecuteA

explorer.exe_992_rwx_01CF0000_00001000:

shell32.dll

explorer.exe_992_rwx_01D60000_00001000:

user32.dll

explorer.exe_992_rwx_01DA0000_00001000:

user32.dll

explorer.exe_992_rwx_01E10000_00001000:

wininet.dll

explorer.exe_992_rwx_01E40000_00001000:

FtpOpenFileA

explorer.exe_992_rwx_01E50000_00001000:

wininet.dll

explorer.exe_992_rwx_01E80000_00001000:

winmm.dll

explorer.exe_992_rwx_01EC0000_00001000:

winmm.dll

explorer.exe_992_rwx_01EF0000_00001000:

wsock32.dll

explorer.exe_992_rwx_01F70000_00001000:

wsock32.dll

explorer.exe_992_rwx_028E0000_00046000:

`.rsrc
kernel32.dll
$*@@@*$@@@$ *@@* $@@($*)@-$*@@$-*@@$*-@@(*$)@-*$@@*-$@@*$-@@-* $@-$ *@* $-@$ *-@$ -*@*- $@($ *)(* $)
sqlite3_bind_blob
sqlite3_bind_text
sqlite3_bind_double
sqlite3_bind_int
sqlite3_bind_int64
sqlite3_bind_null
sqlite3_bind_parameter_index
sqlite3_open
sqlite3_close
sqlite3_errmsg
sqlite3_errcode
sqlite3_free
sqlite3_prepare_v2
sqlite3_column_count
sqlite3_column_name
sqlite3_column_decltype
sqlite3_step
sqlite3_column_blob
sqlite3_column_bytes
sqlite3_column_double
sqlite3_column_text
sqlite3_column_type
sqlite3_column_int64
sqlite3_finalize
sqlite3_reset
SQL error or missing database
An internal logic error in SQLite
Operation terminated by sqlite3_interrupt()
Uses OS features not supported on host
2nd parameter to sqlite3_bind out of range
sqlite3_step() has another row ready
sqlite3_step() has finished executing
Unknown SQLite Error Code "
oleaut32.dll
EVariantBadIndexError
u%CNu
%s[%d]
ESQLiteException
TSQLiteDatabase
TSQLiteTable
Failed to open database "%s" : %s
Failed to open database "%s" : unknown error
Error [%d]: %s.
"%s": %s
Error executing SQL
Could not prepare SQL statement
Error executing SQL statement
SQLite is Busy
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
Mozilla
Firefox
sqlite3.dll
mozcrt19.dll
nspr4.dll
plc4.dll
plds4.dll
nssutil3.dll
nss3.dll
PK11_GetInternalKeySlot
\Mozilla\Firefox\profiles.ini
\Mozilla\Firefox\
signons.sqlite
SELECT * FROM moz_logins
encryptedPassword
\Google\Chrome\User Data\Default\Web Data
SELECT * FROM logins
password_value
origin_url
getservbyport
WSAAsyncGetServByPort
WSAJoinLeaf
WS2_32.DLL
127.0.0.1
TIdSocketListWindows
TIdStackWindowsU
IdStackWindows
ftpTransfer
ftpReady
ftpAborted
ClientPortMin<
ClientPortMaxh
Port,$
EIdCanNotBindPortInRange
EIdInvalidPortRangeSVW
saUsernamePassword
Password<
Porth
0.0.0.1
TIdTCPConnection
IdTCPConnection
EIdTCPConnectionError
EIdObjectTypeNotSupported
Z:\CyberGate\workplace\CyberGate\Cliente\Indy\IdStrings.pas
TIdTCPServer
IdTCPServer
CmdDelimiterh
TIdTCPServerConnection
DefaultPort<3
OnExecutep
EIdTCPServerError
EIdNoExecuteSpecified
TIdTCPClient
TIdTCPClient4
IdTCPClient
BoundPorth
PortU
TOnHTTPDocument
TIdHTTPProxyServer
TIdHTTPProxyServerT
IdHTTPProxyServer
DefaultPort
OnHTTPDocument
HTTP/1.0
Windows Firewall Update
1.2.3
deflate 1.2.3 Copyright 1995-2005 Jean-loup Gailly
giu2.iua
KWindows
IdTCPStream
 IdTCPServer
SQLiteTable3
SQLite3
DIdHTTPProxyServer
UnitChrome
UnitFireFox3_5
GetCPInfo
RegOpenKeyExA
RegFlushKey
RegCreateKeyExA
RegCloseKey
GetKeyboardType
MsgWaitForMultipleObjects
((&)))!&$
"#$$&-)01$$'&,--%.&,
4\@%c
.idata
.edata
P.reloc
P.rsrc
JEO%C
`P.re
KERNEL32.DLL
advapi32.dll
crypt32.dll
user32.dll
wsock32.dll
funcoes.dll
GetChromePass
Mozilla3_5Password
StartHttpProxy
Command not supported.
Address type not supported.;Cannot call TerminateAndWaitFor on FreeAndTerminate threads
Socket is not connected..Cannot send or receive after socket is closed.#Too many references, cannot splice.
Request rejected or failed.5Request rejected because SOCKS server cannot connect.QRequest rejected because the client program and identd report different user-ids.
Protocol not supported.
Socket type not supported."Operation not supported on socket.
Protocol family not supported.0Address family not supported by protocol family.
%s is not a valid service.
Socket Error # %d
Operation would block.
Operation now in progress.
Operation already in progress.
Socket operation on non-socket.
Object type not supported.
No execute handler found.
No data to read.$Can not bind in port range (%d - %d)
Invalid Port Range (%d - %d)
No command handler found.*Error on call Winsock2 library function %s&Error on loading Winsock2 library (%s)
Resolving hostname %s.
Connecting to %s.
Failed to set data for '%s'
%s.Seek not implemented$Operation not allowed on sorted list
Property %s does not exist
Thread creation error: %s
Thread Error: %s (%d)
Connection Closed Gracefully.;Could not bind socket. Address and port are already in use.
File "%s" not found
%List does not allow duplicates ($0%x)#A component named %s already exists%String list does not allow duplicates
Cannot create file "%s". %s
Cannot open file "%s". %s$''%s'' is not a valid component name
Invalid property value List capacity out of bounds (%d)
List count out of bounds (%d)
List index out of bounds (%d) Out of memory while expanding memory stream
Error reading %s%s%s: %s
Ancestor for '%s' not found
Cannot assign a %s to a %sECheckSynchronize called from thread $%x, which is NOT the main thread
Class %s not found
%s (%s, line %d)
Abstract Error?Access violation at address %p in module '%s'. %s of address %p
System Error. Code: %d.
Invalid variant operation%Invalid variant operation (%s%.8x)
%s5Could not convert variant of type (%s) into type (%s)=Overflow while converting variant of type (%s) into type (%s)
Operation not supported
External exception %x
Interface not supported
Invalid pointer operation
Invalid class typecast0Access violation at address %p. %s of address %p
Privileged instruction(Exception %s in module %s at %p.
Application Error1Format '%s' invalid or incompatible with argument
No argument for format '%s'"Variant method calls not supported
!'%s' is not a valid integer value('%s' is not a valid floating point value
I/O error %d
Integer overflow Invalid floating point operation

explorer.exe_992_rwx_047B0000_00046000:

`.rsrc
kernel32.dll
$*@@@*$@@@$ *@@* $@@($*)@-$*@@$-*@@$*-@@(*$)@-*$@@*-$@@*$-@@-* $@-$ *@* $-@$ *-@$ -*@*- $@($ *)(* $)
sqlite3_bind_blob
sqlite3_bind_text
sqlite3_bind_double
sqlite3_bind_int
sqlite3_bind_int64
sqlite3_bind_null
sqlite3_bind_parameter_index
sqlite3_open
sqlite3_close
sqlite3_errmsg
sqlite3_errcode
sqlite3_free
sqlite3_prepare_v2
sqlite3_column_count
sqlite3_column_name
sqlite3_column_decltype
sqlite3_step
sqlite3_column_blob
sqlite3_column_bytes
sqlite3_column_double
sqlite3_column_text
sqlite3_column_type
sqlite3_column_int64
sqlite3_finalize
sqlite3_reset
SQL error or missing database
An internal logic error in SQLite
Operation terminated by sqlite3_interrupt()
Uses OS features not supported on host
2nd parameter to sqlite3_bind out of range
sqlite3_step() has another row ready
sqlite3_step() has finished executing
Unknown SQLite Error Code "
oleaut32.dll
EVariantBadIndexError
u%CNu
%s[%d]
ESQLiteException
TSQLiteDatabase
TSQLiteTable
Failed to open database "%s" : %s
Failed to open database "%s" : unknown error
Error [%d]: %s.
"%s": %s
Error executing SQL
Could not prepare SQL statement
Error executing SQL statement
SQLite is Busy
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
Mozilla
Firefox
sqlite3.dll
mozcrt19.dll
nspr4.dll
plc4.dll
plds4.dll
nssutil3.dll
nss3.dll
PK11_GetInternalKeySlot
\Mozilla\Firefox\profiles.ini
\Mozilla\Firefox\
signons.sqlite
SELECT * FROM moz_logins
encryptedPassword
\Google\Chrome\User Data\Default\Web Data
SELECT * FROM logins
password_value
origin_url
getservbyport
WSAAsyncGetServByPort
WSAJoinLeaf
WS2_32.DLL
127.0.0.1
TIdSocketListWindows
TIdStackWindowsU
IdStackWindows
ftpTransfer
ftpReady
ftpAborted
ClientPortMin<
ClientPortMaxh
Port,$}
EIdCanNotBindPortInRange
EIdInvalidPortRangeSVW
saUsernamePassword
Password<
Porth
0.0.0.1
Uh-E}
TIdTCPConnection
IdTCPConnection
EIdTCPConnectionError
EIdObjectTypeNotSupported
Z:\CyberGate\workplace\CyberGate\Cliente\Indy\IdStrings.pas
TIdTCPServer
IdTCPServer
CmdDelimiterh
TIdTCPServerConnection
DefaultPort<3}
OnExecutep
EIdTCPServerError
EIdNoExecuteSpecified
TIdTCPClient
TIdTCPClient4
IdTCPClient
BoundPorth
PortU
TOnHTTPDocument
TIdHTTPProxyServer
TIdHTTPProxyServerT
IdHTTPProxyServer
DefaultPort
OnHTTPDocument
HTTP/1.0
Windows Firewall Update
1.2.3
deflate 1.2.3 Copyright 1995-2005 Jean-loup Gailly
giu2.iua
KWindows
IdTCPStream
 IdTCPServer
SQLiteTable3
SQLite3
DIdHTTPProxyServer
UnitChrome
UnitFireFox3_5
GetCPInfo
RegOpenKeyExA
RegFlushKey
RegCreateKeyExA
RegCloseKey
GetKeyboardType
MsgWaitForMultipleObjects
((&)))!&$
"#$$&-)01$$'&,--%.&,
4\@%c
.idata
.edata
P.reloc
P.rsrc
JEO%C
`P.re
KERNEL32.DLL
advapi32.dll
crypt32.dll
user32.dll
wsock32.dll
funcoes.dll
GetChromePass
Mozilla3_5Password
StartHttpProxy
Command not supported.
Address type not supported.;Cannot call TerminateAndWaitFor on FreeAndTerminate threads
Socket is not connected..Cannot send or receive after socket is closed.#Too many references, cannot splice.
Request rejected or failed.5Request rejected because SOCKS server cannot connect.QRequest rejected because the client program and identd report different user-ids.
Protocol not supported.
Socket type not supported."Operation not supported on socket.
Protocol family not supported.0Address family not supported by protocol family.
%s is not a valid service.
Socket Error # %d
Operation would block.
Operation now in progress.
Operation already in progress.
Socket operation on non-socket.
Object type not supported.
No execute handler found.
No data to read.$Can not bind in port range (%d - %d)
Invalid Port Range (%d - %d)
No command handler found.*Error on call Winsock2 library function %s&Error on loading Winsock2 library (%s)
Resolving hostname %s.
Connecting to %s.
Failed to set data for '%s'
%s.Seek not implemented$Operation not allowed on sorted list
Property %s does not exist
Thread creation error: %s
Thread Error: %s (%d)
Connection Closed Gracefully.;Could not bind socket. Address and port are already in use.
File "%s" not found
%List does not allow duplicates ($0%x)#A component named %s already exists%String list does not allow duplicates
Cannot create file "%s". %s
Cannot open file "%s". %s$''%s'' is not a valid component name
Invalid property value List capacity out of bounds (%d)
List count out of bounds (%d)
List index out of bounds (%d) Out of memory while expanding memory stream
Error reading %s%s%s: %s
Ancestor for '%s' not found
Cannot assign a %s to a %sECheckSynchronize called from thread $%x, which is NOT the main thread
Class %s not found
%s (%s, line %d)
Abstract Error?Access violation at address %p in module '%s'. %s of address %p
System Error. Code: %d.
Invalid variant operation%Invalid variant operation (%s%.8x)
%s5Could not convert variant of type (%s) into type (%s)=Overflow while converting variant of type (%s) into type (%s)
Operation not supported
External exception %x
Interface not supported
Invalid pointer operation
Invalid class typecast0Access violation at address %p. %s of address %p
Privileged instruction(Exception %s in module %s at %p.
Application Error1Format '%s' invalid or incompatible with argument
No argument for format '%s'"Variant method calls not supported
!'%s' is not a valid integer value('%s' is not a valid floating point value
I/O error %d
Integer overflow Invalid floating point operation

explorer.exe_992_rwx_04850000_00046000:

`.rsrc
kernel32.dll
$*@@@*$@@@$ *@@* $@@($*)@-$*@@$-*@@$*-@@(*$)@-*$@@*-$@@*$-@@-* $@-$ *@* $-@$ *-@$ -*@*- $@($ *)(* $)
sqlite3_bind_blob
sqlite3_bind_text
sqlite3_bind_double
sqlite3_bind_int
sqlite3_bind_int64
sqlite3_bind_null
sqlite3_bind_parameter_index
sqlite3_open
sqlite3_close
sqlite3_errmsg
sqlite3_errcode
sqlite3_free
sqlite3_prepare_v2
sqlite3_column_count
sqlite3_column_name
sqlite3_column_decltype
sqlite3_step
sqlite3_column_blob
sqlite3_column_bytes
sqlite3_column_double
sqlite3_column_text
sqlite3_column_type
sqlite3_column_int64
sqlite3_finalize
sqlite3_reset
SQL error or missing database
An internal logic error in SQLite
Operation terminated by sqlite3_interrupt()
Uses OS features not supported on host
2nd parameter to sqlite3_bind out of range
sqlite3_step() has another row ready
sqlite3_step() has finished executing
Unknown SQLite Error Code "
oleaut32.dll
EVariantBadIndexError
u%CNu
%s[%d]
ESQLiteException
TSQLiteDatabase
TSQLiteTable
Failed to open database "%s" : %s
Failed to open database "%s" : unknown error
Error [%d]: %s.
"%s": %s
Error executing SQL
Could not prepare SQL statement
Error executing SQL statement
SQLite is Busy
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
Mozilla
Firefox
sqlite3.dll
mozcrt19.dll
nspr4.dll
plc4.dll
plds4.dll
nssutil3.dll
nss3.dll
PK11_GetInternalKeySlot
\Mozilla\Firefox\profiles.ini
\Mozilla\Firefox\
signons.sqlite
SELECT * FROM moz_logins
encryptedPassword
\Google\Chrome\User Data\Default\Web Data
SELECT * FROM logins
password_value
origin_url
getservbyport
WSAAsyncGetServByPort
WSAJoinLeaf
WS2_32.DLL
127.0.0.1
TIdSocketListWindows
TIdStackWindowsU
IdStackWindows
ftpTransfer
ftpReady
ftpAborted
ClientPortMin<
ClientPortMaxh
Port,$
EIdCanNotBindPortInRange
EIdInvalidPortRangeSVW
saUsernamePassword
Password<
Porth
0.0.0.1
TIdTCPConnection
IdTCPConnection
EIdTCPConnectionError
EIdObjectTypeNotSupported
Z:\CyberGate\workplace\CyberGate\Cliente\Indy\IdStrings.pas
TIdTCPServer
IdTCPServer
CmdDelimiterh
TIdTCPServerConnection
DefaultPort<3
OnExecutep
EIdTCPServerError
EIdNoExecuteSpecified
TIdTCPClient
TIdTCPClient4
IdTCPClient
BoundPorth
PortU
TOnHTTPDocument
TIdHTTPProxyServer
TIdHTTPProxyServerT
IdHTTPProxyServer
DefaultPort
OnHTTPDocument
HTTP/1.0
Windows Firewall Update
1.2.3
deflate 1.2.3 Copyright 1995-2005 Jean-loup Gailly
giu2.iua
KWindows
IdTCPStream
 IdTCPServer
SQLiteTable3
SQLite3
DIdHTTPProxyServer
UnitChrome
UnitFireFox3_5
GetCPInfo
RegOpenKeyExA
RegFlushKey
RegCreateKeyExA
RegCloseKey
GetKeyboardType
MsgWaitForMultipleObjects
((&)))!&$
"#$$&-)01$$'&,--%.&,
4\@%c
.idata
.edata
P.reloc
P.rsrc
JEO%C
`P.re
KERNEL32.DLL
advapi32.dll
crypt32.dll
user32.dll
wsock32.dll
funcoes.dll
GetChromePass
Mozilla3_5Password
StartHttpProxy
Command not supported.
Address type not supported.;Cannot call TerminateAndWaitFor on FreeAndTerminate threads
Socket is not connected..Cannot send or receive after socket is closed.#Too many references, cannot splice.
Request rejected or failed.5Request rejected because SOCKS server cannot connect.QRequest rejected because the client program and identd report different user-ids.
Protocol not supported.
Socket type not supported."Operation not supported on socket.
Protocol family not supported.0Address family not supported by protocol family.
%s is not a valid service.
Socket Error # %d
Operation would block.
Operation now in progress.
Operation already in progress.
Socket operation on non-socket.
Object type not supported.
No execute handler found.
No data to read.$Can not bind in port range (%d - %d)
Invalid Port Range (%d - %d)
No command handler found.*Error on call Winsock2 library function %s&Error on loading Winsock2 library (%s)
Resolving hostname %s.
Connecting to %s.
Failed to set data for '%s'
%s.Seek not implemented$Operation not allowed on sorted list
Property %s does not exist
Thread creation error: %s
Thread Error: %s (%d)
Connection Closed Gracefully.;Could not bind socket. Address and port are already in use.
File "%s" not found
%List does not allow duplicates ($0%x)#A component named %s already exists%String list does not allow duplicates
Cannot create file "%s". %s
Cannot open file "%s". %s$''%s'' is not a valid component name
Invalid property value List capacity out of bounds (%d)
List count out of bounds (%d)
List index out of bounds (%d) Out of memory while expanding memory stream
Error reading %s%s%s: %s
Ancestor for '%s' not found
Cannot assign a %s to a %sECheckSynchronize called from thread $%x, which is NOT the main thread
Class %s not found
%s (%s, line %d)
Abstract Error?Access violation at address %p in module '%s'. %s of address %p
System Error. Code: %d.
Invalid variant operation%Invalid variant operation (%s%.8x)
%s5Could not convert variant of type (%s) into type (%s)=Overflow while converting variant of type (%s) into type (%s)
Operation not supported
External exception %x
Interface not supported
Invalid pointer operation
Invalid class typecast0Access violation at address %p. %s of address %p
Privileged instruction(Exception %s in module %s at %p.
Application Error1Format '%s' invalid or incompatible with argument
No argument for format '%s'"Variant method calls not supported
!'%s' is not a valid integer value('%s' is not a valid floating point value
I/O error %d
Integer overflow Invalid floating point operation

explorer.exe_992_rwx_10480000_00065000:

`.rsrc
kernel32.dll
Portions Copyright (c) 1999,2003 Avenger by NhT
SHFileOperationA
shell32.dll
URLDownloadToFileA
urlmon.dll
ShellExecuteA
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
GetWindowsDirectoryA
SOFTWARE\Microsoft\Windows\CurrentVersion
http\shell\open\command
\Internet Explorer\iexplore.exe
####@####
$*@@@*$@@@$ *@@* $@@($*)@-$*@@$-*@@$*-@@(*$)@-*$@@*-$@@*$-@@-* $@-$ *@* $-@$ *-@$ -*@*- $@($ *)(* $)
Portugal
Turkey
Windows 3.1
Windows 95 (Release 2)
Windows 95
Windows 98 SE
Windows 98
Windows ME
Windows 7
Windows Vista
%s %s
Windows XP Professional x64
Windows XP Home
Windows XP Professional
Windows 2000 Professional
Windows NT %d.%d
Windows 2008
%s %s Server
Windows 2003 Server Datacenter
Windows 2003 Server Enterprise
Windows 2003 Server Web Edition
Windows 2003 Server
Windows Home Server
Windows 2003 Server (Release 2)
Windows 2000 Server Datacenter
Windows 2000 Server Enterprise
Windows 2000 Server Web Edition
Windows 2000 Server
Windows NT 4.0 Server Datacenter
Windows NT 4.0 Server Enterprise
Windows NT 4.0 Server Web Edition
Windows NT 4.0 Server
Unknown Platform ID (%d)
%d.%d
%s (Build: %d
- Service Pack: %s
KERNEL32.DLL
teste.vbs
teste.txt
Set objSecurityCenter = GetObject("winmgmts:\\.\root\SecurityCenter")
Set colFirewall = objSecurityCenter.ExecQuery("Select * From FirewallProduct",,48)
Set colAntiVirus = objSecurityCenter.ExecQuery("Select * From AntiVirusProduct",,48)
Set objFileSystem = CreateObject("Scripting.fileSystemObject")
Set objFile = objFileSystem.CreateTextFile("
Info = Info & "F" & CountFw & ") " & objFirewall.displayName & " v" & objFirewall.versionNumber & Enter
Info = Info & "A" & CountAV & ") " & objAntiVirus.displayName & " v" & objAntiVirus.versionNumber & Enter
objFile.WriteLine(Info)
objFile.Close
cscript.exe
AVICAP32.dll
tFtpAccess
v1.07.5
BuildImportTable: can't load library:
BuildImportTable: ReallocMemory failed
BuildImportTable: GetProcAddress failed
BTMemoryLoadLibary: BuildImportTable failed
BTMemoryGetProcAddress: no export table found
BTMemoryGetProcAddress: DLL doesn't export anything
BTMemoryGetProcAddress: exported symbol not found
SetupApi.dll
SetupDiOpenClassRegKey
SetupDiOpenClassRegKeyExA
SetupDiOpenClassRegKeyExW
SetupDiCreateDeviceInterfaceRegKeyA
SetupDiCreateDeviceInterfaceRegKeyW
SetupDiOpenDeviceInterfaceRegKey
SetupDiDeleteDeviceInterfaceRegKey
SetupDiCreateDevRegKeyA
SetupDiCreateDevRegKeyW
SetupDiOpenDevRegKey
SetupDiDeleteDevRegKey
CM_DEVCAP_LOCKSUPPORTED
CM_DEVCAP_EJECTSUPPORTED
PDCAP_D0_SUPPORTED
PDCAP_D1_SUPPORTED
PDCAP_D2_SUPPORTED
PDCAP_D3_SUPPORTED
PDCAP_WAKE_FROM_D0_SUPPORTED
PDCAP_WAKE_FROM_D1_SUPPORTED
PDCAP_WAKE_FROM_D2_SUPPORTED
PDCAP_WAKE_FROM_D3_SUPPORTED
PDCAP_WARM_EJECT_SUPPORTED
HKEY_CLASSES_ROOT
HKEY_CURRENT_CONFIG
HKEY_CURRENT_USER
HKEY_LOCAL_MACHINE
HKEY_USERS
127.0.0.1
iphlpapi.dll
AllocateAndGetTcpExTableFromStack
AllocateAndGetUdpExTableFromStack
SetTcpEntry
GetExtendedTcpTable
GetExtendedUdpTable
Mozilla3_5Password
GetChromePass
StartHttpProxy
1.2.3
keyboardkey
webcaminactive
webcamgetbuffer
webcam
enviarexecnormal
enviarexechidden
openweb
openwebpage
openwebhidden
downexec
sendftp
keylogger
keyloggergetlog
keyloggereraselog
keyloggerativar
keyloggerdesativar
renamekey
windowsfechar
windowsmax
windowsmin
windowsmostrar
windowsocultar
windowsmintodas
windowscaption
listarportas
listarportasdns
finalizarprocessoportas
webcamsettings
chatmsg
getpassword
updateservidorweb
keyloggersearch
urlredirect
urlredirecttrue
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\
PSAPI.dll
\config\SteamAppData.vdf
AutoLoginUser
/ClientRegistry.Blob
\ClientRegistry.blob
\steam.dll
%SYS%
ÞSKTOP%
HKEY_PERFORMANCE_DATA
HKEY_DYN_DATA
FirstExecution
chatmsg|
Software\Microsoft\Windows\CurrentVersion\Run
Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run
listarjanelas|windowsfechar|
listarjanelas|windowsmax|
listarjanelas|windowsmin|
listarjanelas|windowsmostrar|
listarjanelas|windowsocultar|
listarjanelas|windowsmintodas|
listarjanelas|windowscaption|
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
listarportas|listadeportaspronta|
listarportas|finalizarconexao|
listarportas|finalizarprocessoportas|Y|
listarportas|finalizarprocessoportas|N|
registro|renamekey|
keylogger|keylogger|keyloggerativar|
keylogger|keylogger|keyloggerdesativar|
keylogger|keyloggergetlog|
keylogger|keylogger|keyloggervazio|
keyloggersearchok|
webcam|webcaminactive|
webcam|webcamactive|
SOFTWARE\Mozilla\Mozilla Firefox
getfirefox
getielogin
getiepass
getieweb
getchrome
getpassword|getpasswordlist|
getpassword|getpassworderror|
duac.bat
%windir%\System32\cmd.exe /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
cmd.exe duac.bat
C:\Windows\System32\drivers\etc\hosts
Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\
Software\Microsoft\Windows\CurrentVersion\RunServicesOnce\
Software\Microsoft\Windows\CurrentVersion\RunServices\
Software\Microsoft\Windows\CurrentVersion\RunOnce\
Software\Microsoft\Windows\CurrentVersion\Run\
temp.vbs
ntdll.dll
log.dat
SQLite3.dll
deflate 1.2.3 Copyright 1995-2005 Jean-loup Gailly
inflate 1.2.3 Copyright 1995-2005 Mark Adler
)ju2.iu
KWindows
RegExport
UrlMon
UnitExecutarComandos
uftp
.UnitBytesSize
UnitListarPortasAtivas
UnitWebcam
UnitKeylogger
WinExec
SetNamedPipeHandleState
GetProcessHeap
CreatePipe
RegQueryInfoKeyA
RegOpenKeyExA
RegOpenKeyA
RegEnumKeyExA
RegDeleteKeyA
RegCreateKeyExA
RegCreateKeyA
RegCloseKey
GdiplusShutdown
keybd_event
MsgWaitForMultipleObjects
MapVirtualKeyA
GetKeyboardState
GetKeyboardLayoutNameA
GetKeyState
GetAsyncKeyState
ExitWindowsEx
EnumWindows
FtpGetFileSize
FtpSetCurrentDirectoryA
FtpOpenFileA
%( % & % % % ]
.idata
.reloc
P.rsrc
hbS%S
advapi32.dll
AVICAP32.DLL
gdi32.dll
gdiplus.dll
mpr.dll
msacm32.dll
ole32.dll
oleaut32.dll
powrprof.dll
user32.dll
wininet.dll
winmm.dll
wsock32.dll

Explorer.EXE_1440_rwx_01C50000_00001000:

KERNEL32.DLL

Explorer.EXE_1440_rwx_02100000_00001000:

KERNEL32.DLL

Explorer.EXE_1440_rwx_02DA0000_00001000:

KERNEL32.DLL

Explorer.EXE_1440_rwx_02EC0000_00001000:

KERNEL32.DLL

Explorer.EXE_1440_rwx_039B0000_00001000:

KERNEL32.DLL

Explorer.EXE_1440_rwx_03C90000_00001000:

KERNEL32.DLL

Explorer.EXE_1440_rwx_03E40000_00001000:

advapi32.dll

Explorer.EXE_1440_rwx_03F30000_00001000:

RegOpenKeyA

Explorer.EXE_1440_rwx_03F80000_00001000:

advapi32.dll

Explorer.EXE_1440_rwx_04040000_00001000:

AVICAP32.DLL

Explorer.EXE_1440_rwx_04080000_00001000:

AVICAP32.DLL

Explorer.EXE_1440_rwx_041A0000_00001000:

gdi32.dll

Explorer.EXE_1440_rwx_04620000_00001000:

gdi32.dll

Explorer.EXE_1440_rwx_04650000_00001000:

gdiplus.dll

Explorer.EXE_1440_rwx_046D0000_00001000:

gdiplus.dll

Explorer.EXE_1440_rwx_04780000_00001000:

mpr.dll

Explorer.EXE_1440_rwx_047D0000_00001000:

mpr.dll

Explorer.EXE_1440_rwx_04880000_00001000:

msacm32.dll

Explorer.EXE_1440_rwx_048C0000_00001000:

msacm32.dll

Explorer.EXE_1440_rwx_04930000_00001000:

ntdll.dll

Explorer.EXE_1440_rwx_049B0000_00001000:

ntdll.dll

Explorer.EXE_1440_rwx_04A60000_00001000:

ole32.dll

Explorer.EXE_1440_rwx_04B60000_00001000:

ole32.dll

Explorer.EXE_1440_rwx_04BD0000_00001000:

oleaut32.dll

Explorer.EXE_1440_rwx_04C50000_00001000:

oleaut32.dll

Explorer.EXE_1440_rwx_04CC0000_00001000:

powrprof.dll

Explorer.EXE_1440_rwx_04D40000_00001000:

powrprof.dll

Explorer.EXE_1440_rwx_04DB0000_00001000:

shell32.dll

Explorer.EXE_1440_rwx_04DE0000_00001000:

ShellExecuteA

Explorer.EXE_1440_rwx_06710000_00001000:

shell32.dll

Explorer.EXE_1440_rwx_06740000_00001000:

user32.dll

Explorer.EXE_1440_rwx_07600000_00001000:

user32.dll

Explorer.EXE_1440_rwx_07670000_00001000:

wininet.dll

Explorer.EXE_1440_rwx_076A0000_00001000:

FtpOpenFileA

Explorer.EXE_1440_rwx_076B0000_00001000:

wininet.dll

Explorer.EXE_1440_rwx_076E0000_00001000:

winmm.dll

Explorer.EXE_1440_rwx_07720000_00001000:

winmm.dll

Explorer.EXE_1440_rwx_077D0000_00001000:

wsock32.dll

Explorer.EXE_1440_rwx_07810000_00001000:

wsock32.dll

Explorer.EXE_1440_rwx_10410000_00065000:

`.rsrc
kernel32.dll
Portions Copyright (c) 1999,2003 Avenger by NhT
SHFileOperationA
shell32.dll
URLDownloadToFileA
urlmon.dll
ShellExecuteA
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
GetWindowsDirectoryA
SOFTWARE\Microsoft\Windows\CurrentVersion
http\shell\open\command
\Internet Explorer\iexplore.exe
####@####
$*@@@*$@@@$ *@@* $@@($*)@-$*@@$-*@@$*-@@(*$)@-*$@@*-$@@*$-@@-* $@-$ *@* $-@$ *-@$ -*@*- $@($ *)(* $)
Portugal
Turkey
Windows 3.1
Windows 95 (Release 2)
Windows 95
Windows 98 SE
Windows 98
Windows ME
Windows 7
Windows Vista
%s %s
Windows XP Professional x64
Windows XP Home
Windows XP Professional
Windows 2000 Professional
Windows NT %d.%d
Windows 2008
%s %s Server
Windows 2003 Server Datacenter
Windows 2003 Server Enterprise
Windows 2003 Server Web Edition
Windows 2003 Server
Windows Home Server
Windows 2003 Server (Release 2)
Windows 2000 Server Datacenter
Windows 2000 Server Enterprise
Windows 2000 Server Web Edition
Windows 2000 Server
Windows NT 4.0 Server Datacenter
Windows NT 4.0 Server Enterprise
Windows NT 4.0 Server Web Edition
Windows NT 4.0 Server
Unknown Platform ID (%d)
%d.%d
%s (Build: %d
- Service Pack: %s
KERNEL32.DLL
teste.vbs
teste.txt
Set objSecurityCenter = GetObject("winmgmts:\\.\root\SecurityCenter")
Set colFirewall = objSecurityCenter.ExecQuery("Select * From FirewallProduct",,48)
Set colAntiVirus = objSecurityCenter.ExecQuery("Select * From AntiVirusProduct",,48)
Set objFileSystem = CreateObject("Scripting.fileSystemObject")
Set objFile = objFileSystem.CreateTextFile("
Info = Info & "F" & CountFw & ") " & objFirewall.displayName & " v" & objFirewall.versionNumber & Enter
Info = Info & "A" & CountAV & ") " & objAntiVirus.displayName & " v" & objAntiVirus.versionNumber & Enter
objFile.WriteLine(Info)
objFile.Close
cscript.exe
AVICAP32.dll
tFtpAccess
v1.07.5
BuildImportTable: can't load library:
BuildImportTable: ReallocMemory failed
BuildImportTable: GetProcAddress failed
BTMemoryLoadLibary: BuildImportTable failed
BTMemoryGetProcAddress: no export table found
BTMemoryGetProcAddress: DLL doesn't export anything
BTMemoryGetProcAddress: exported symbol not found
SetupApi.dll
SetupDiOpenClassRegKey
SetupDiOpenClassRegKeyExA
SetupDiOpenClassRegKeyExW
SetupDiCreateDeviceInterfaceRegKeyA
SetupDiCreateDeviceInterfaceRegKeyW
SetupDiOpenDeviceInterfaceRegKey
SetupDiDeleteDeviceInterfaceRegKey
SetupDiCreateDevRegKeyA
SetupDiCreateDevRegKeyW
SetupDiOpenDevRegKey
SetupDiDeleteDevRegKey
CM_DEVCAP_LOCKSUPPORTED
CM_DEVCAP_EJECTSUPPORTED
PDCAP_D0_SUPPORTED
PDCAP_D1_SUPPORTED
PDCAP_D2_SUPPORTED
PDCAP_D3_SUPPORTED
PDCAP_WAKE_FROM_D0_SUPPORTED
PDCAP_WAKE_FROM_D1_SUPPORTED
PDCAP_WAKE_FROM_D2_SUPPORTED
PDCAP_WAKE_FROM_D3_SUPPORTED
PDCAP_WARM_EJECT_SUPPORTED
HKEY_CLASSES_ROOT
HKEY_CURRENT_CONFIG
HKEY_CURRENT_USER
HKEY_LOCAL_MACHINE
HKEY_USERS
127.0.0.1
iphlpapi.dll
AllocateAndGetTcpExTableFromStack
AllocateAndGetUdpExTableFromStack
SetTcpEntry
GetExtendedTcpTable
GetExtendedUdpTable
Mozilla3_5Password
GetChromePass
StartHttpProxy
1.2.3
keyboardkey
webcaminactive
webcamgetbuffer
webcam
enviarexecnormal
enviarexechidden
openweb
openwebpage
openwebhidden
downexec
sendftp
keylogger
keyloggergetlog
keyloggereraselog
keyloggerativar
keyloggerdesativar
renamekey
windowsfechar
windowsmax
windowsmin
windowsmostrar
windowsocultar
windowsmintodas
windowscaption
listarportas
listarportasdns
finalizarprocessoportas
webcamsettings
chatmsg
getpassword
updateservidorweb
keyloggersearch
urlredirect
urlredirecttrue
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\
PSAPI.dll
\config\SteamAppData.vdf
AutoLoginUser
/ClientRegistry.Blob
\ClientRegistry.blob
\steam.dll
%SYS%
ÞSKTOP%
Uhm%D
HKEY_PERFORMANCE_DATA
HKEY_DYN_DATA
FirstExecution
chatmsg|
Software\Microsoft\Windows\CurrentVersion\Run
Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run
listarjanelas|windowsfechar|
listarjanelas|windowsmax|
listarjanelas|windowsmin|
listarjanelas|windowsmostrar|
listarjanelas|windowsocultar|
listarjanelas|windowsmintodas|
listarjanelas|windowscaption|
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
listarportas|listadeportaspronta|
listarportas|finalizarconexao|
listarportas|finalizarprocessoportas|Y|
listarportas|finalizarprocessoportas|N|
registro|renamekey|
keylogger|keylogger|keyloggerativar|
keylogger|keylogger|keyloggerdesativar|
keylogger|keyloggergetlog|
keylogger|keylogger|keyloggervazio|
keyloggersearchok|
webcam|webcaminactive|
webcam|webcamactive|
SOFTWARE\Mozilla\Mozilla Firefox
getfirefox
getielogin
getiepass
getieweb
getchrome
getpassword|getpasswordlist|
getpassword|getpassworderror|
duac.bat
%windir%\System32\cmd.exe /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
cmd.exe duac.bat
C:\Windows\System32\drivers\etc\hosts
Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\
Software\Microsoft\Windows\CurrentVersion\RunServicesOnce\
Software\Microsoft\Windows\CurrentVersion\RunServices\
Software\Microsoft\Windows\CurrentVersion\RunOnce\
Software\Microsoft\Windows\CurrentVersion\Run\
temp.vbs
ntdll.dll
log.dat
SQLite3.dll
deflate 1.2.3 Copyright 1995-2005 Jean-loup Gailly
inflate 1.2.3 Copyright 1995-2005 Mark Adler
)ju2.iu
KWindows
RegExport
UrlMon
UnitExecutarComandos
uftp
.UnitBytesSize
UnitListarPortasAtivas
UnitWebcam
UnitKeylogger
WinExec
SetNamedPipeHandleState
GetProcessHeap
CreatePipe
RegQueryInfoKeyA
RegOpenKeyExA
RegOpenKeyA
RegEnumKeyExA
RegDeleteKeyA
RegCreateKeyExA
RegCreateKeyA
RegCloseKey
GdiplusShutdown
keybd_event
MsgWaitForMultipleObjects
MapVirtualKeyA
GetKeyboardState
GetKeyboardLayoutNameA
GetKeyState
GetAsyncKeyState
ExitWindowsEx
EnumWindows
FtpGetFileSize
FtpSetCurrentDirectoryA
FtpOpenFileA
%( % & % % % ]
.idata
.reloc
P.rsrc
hbS%S
advapi32.dll
AVICAP32.DLL
gdi32.dll
gdiplus.dll
mpr.dll
msacm32.dll
ole32.dll
oleaut32.dll
powrprof.dll
user32.dll
wininet.dll
winmm.dll
wsock32.dll


Remove it with Ad-Aware

  1. Click (here) to download and install Ad-Aware Free Antivirus.
  2. Update the definition files.
  3. Run a full scan of your computer.


Manual removal*

  1. Terminate malicious process(es) (How to End a Process With the Task Manager):

    cscript.exe:4020
    csc.exe:3424

  2. Delete the original Trojan file.
  3. Delete or disinfect the following files created/modified by the Trojan:

    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\teste.txt (2 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\adm2.txt (230 bytes)
    C:\Windows\System32\Driver\svchost.exe (601 bytes)

  4. Delete the following value(s) in the autorun key (How to Work with System Registry):

    [HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
    "HKCU" = "C:\Windows\system32\Driver\svchost.exe"

    [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "HKLM" = "C:\Windows\system32\Driver\svchost.exe"

  5. Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
  6. Reboot the computer.

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

No votes yet


Lavasoft is the maker of Ad-Aware, the world's most popular anti-malware software with over 450 million downloads.
© 2025 Lavasoft. All rights reserved.
Terms Of Use |   Privacy Policy


x

Our best antivirus yet!

Fresh new look. Faster scanning. Better protection.

Enjoy unique new features, lightning fast scans and a simple yet beautiful new look in our best antivirus yet!

For a quicker, lighter and more secure experience, download the all new adaware antivirus 12 now!

Download adaware antivirus 12
No thanks, continue to lavasoft.com
close x

Discover the new adaware antivirus 12

Our best antivirus yet

Download Now