MD5: e6b7ab524aad3fdbf1d0bb7945fae24a
SHA1: e755d19914803c129993857a60636be168b3131d
SHA256: 11eadc2ba91cbe2cd6c93fd5117024cdc63164c28e75db6c5f39fefa8a0d3a33
SSDeep: 12288:yAmiALKD7V4jiAoI7nxEiW78FmCpVIgJzO tc:yAm3Ln jIn1Wsmwyec
Size: 524288 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: UPolyXv05_v6
Company: no certificate found
Created at: 2009-12-06 00:50:52
Analyzed on: Windows7 SP1 32-bit

Summary:

Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).

Payload

No specific payload has been found.

Process activity

The Trojan creates the following process(es):

%original file name%.exe:1796
ns38BD.tmp:3580
setupfs_1123.exe:1780

The Trojan injects its code into the following process(es):

WerFault.exe:2892

Mutexes

The following mutexes were created/opened:
No objects were found.

File activity

The process %original file name%.exe:1796 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

C:\setupfs_1123.exe (332936 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsm1F53.tmp\ns38BD.tmp (14 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsm1F53.tmp\nsExec.dll (14 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsm1F53.tmp\inetc.dll (44 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\25FDO7QC\setupfs_1123[1].exe (313824 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsm1F53.tmp\UAC.dll (29 bytes)

The Trojan deletes the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsm1F53.tmp (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsm1F52.tmp (0 bytes)

The process ns38BD.tmp:3580 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

C:\setupfs_1123.exe (2093 bytes)

Registry activity

The process %original file name%.exe:1796 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Tracing\e6b7ab524aad3fdbf1d0bb7945fae24a_RASMANCS]
"MaxFileSize" = "1048576"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKLM\SOFTWARE\Microsoft\Tracing\e6b7ab524aad3fdbf1d0bb7945fae24a_RASMANCS]
"FileDirectory" = "%windir%\tracing"

[HKLM\SOFTWARE\Microsoft\Tracing\e6b7ab524aad3fdbf1d0bb7945fae24a_RASAPI32]
"FileDirectory" = "%windir%\tracing"

[HKLM\SOFTWARE\Microsoft\Tracing\e6b7ab524aad3fdbf1d0bb7945fae24a_RASMANCS]
"EnableFileTracing" = "0"

[HKLM\SOFTWARE\Microsoft\Tracing\e6b7ab524aad3fdbf1d0bb7945fae24a_RASAPI32]
"EnableConsoleTracing" = "0"
"MaxFileSize" = "1048576"
"ConsoleTracingMask" = "4294901760"

[HKLM\SOFTWARE\Microsoft\Tracing\e6b7ab524aad3fdbf1d0bb7945fae24a_RASMANCS]
"ConsoleTracingMask" = "4294901760"

[HKLM\SOFTWARE\Microsoft\Tracing\e6b7ab524aad3fdbf1d0bb7945fae24a_RASAPI32]
"FileTracingMask" = "4294901760"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 3C 00 00 00 09 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Microsoft\Tracing\e6b7ab524aad3fdbf1d0bb7945fae24a_RASAPI32]
"EnableFileTracing" = "0"

[HKLM\SOFTWARE\Microsoft\Tracing\e6b7ab524aad3fdbf1d0bb7945fae24a_RASMANCS]
"EnableConsoleTracing" = "0"
"FileTracingMask" = "4294901760"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"
"AutoConfigURL"

The process WerFault.exe:2892 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\Windows Error Reporting\Debug]
"ExceptionRecord" = "05 00 00 C0 00 00 00 00 00 00 00 00 B3 4C 17 77"

[HKLM\SOFTWARE\Microsoft\Windows\Windows Error Reporting\Debug\UIHandles]
"FirstLevelConsentDialog" = "Type: REG_QWORD, Length: 8"

[HKCU\Software\Microsoft\Windows\Windows Error Reporting\Debug\UIHandles]
"FirstLevelConsentDialog" = "Type: REG_QWORD, Length: 8"

The process setupfs_1123.exe:1780 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\System\CurrentControlSet\Control\Session Manager]
"PendingFileRenameOperations" = "\??\c:\setupfs_1123.exe, !\??\D:\uo0uFhC5GIFg9xy5UGMth25LoDefmxeZlDEsC0kpgAZHcM2ygVU1K5YqvOJSUv54W3q7v0Iro6ncu4BENW2nMPpW2Ef322HBMT20o9PDiCKo1dop38aU26yZAkRmPIiOmQ1qBSZmWLOhDXqMuIAJltBfCPUrxvibQyT2gSyR3nPbCMbyf0bBIt48acUqxavAVNCgq5n3zcpmUEgttvw7xZVPnjigFwawRRGXmvSWvmauwG8g1f8iDBL3E"

Dropped PE files

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

VersionInfo

No information is available.

PE Sections

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Total found: 128
8c788790039d11a28836711e355ba31e
d642abd6b2675f8d897df8961a1fd43f
cf40995b74a67f40158d4c104ed51daf
beb19bebd28c091394ff345049101a4d
29ce21b10d9af7d8d145107466590809
9681175f881a5dcfd819e9712e61c8d0
e3acba6e93c31d3f1ab9c1feb2e08916
8605309549e1e8dfee2153f1e538a2e7
028e4a1ca60b20afbf1089a7d1453c51
4f55e9fd52f06b51cd80e064e1f12e3e
35678f0ba1c4752567f1eeb2d699113b
848722288f353befac6d68e254918bdf
41e3f2f69d2901b7ae9c3231b463c7bd
233bb553e8c065cbed76c65871a8d75b
ff4193520655ec660ebda2735a8a9b0a
c846a6aba23ee84e6be692f506f6bcef
1184077fa235d4a7e773cafe4943eaba
f8cb0b05268eeca71d38d4593abe9a61
4b328a649efcfdf9377bc172ae071175
f077a3b063daa6384f1eb79365330ccb
c7a8845b57d143bb902df4baba1b00ca
d49d5da01b19ad8aabab97f19a337da8
384bf102787328527c87bbbb1274b103
8186f0dbada1151c5f020429de7111fd
726e612289972e153aadd407584c2257

URLs

URL	IP
hxxp://www.flowsurf.net/setupfs_1123.exe	82.165.149.116

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

ET POLICY User-Agent (NSIS_Inetc (Mozilla)) - Sometimes used by hostile installers
ET POLICY PE EXE or DLL Windows file download HTTP

Traffic

GET /setupfs_1123.exe HTTP/1.1

User-Agent: NSIS_Inetc (Mozilla)

Host: VVV.flowsurf.net

Connection: Keep-Alive

Cache-Control: no-cache

HTTP/1.1 200 OK

Server: nginx

Date: Tue, 22 Aug 2017 20:03:54 GMT

Content-Type: application/octet-stream

Content-Length: 5369344

Last-Modified: Mon, 21 Aug 2017 15:09:08 GMT

Connection: keep-alive

ETag: "599af794-51ee00"

Accept-Ranges: bytes
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$..........b...1...1
...1..O1...1F..1...1F..16..1.7.1...1F..1...1.._1...1...1$..1.7.1...1.6
.1...1..[1...1.6.1...1Rich...1................PE..L...'..W............
..........G......D............M.......................... [.......R...
..................................0[..<........3B..................
.Q.........................................@...............T..........
..................text...f........................... ..`.rdata..Nx...
....z..................@..@.data....J...p.......^..............@....rs
rc....3B......4B..v..............@..@.reloc........Q..D....P..........
...@..B...............................................................
......................................................................
......................................................................
......................................................................
...............................................U.....j.h.zW.d.....P..@
.`s[.3..D$8SVW.`s[.3.P.D$Pd......u..L$.......D$X.........[....f...I..R
.f..u..D$X.....T$........B.....I......R...P..L$0........D$X.....y..r..
..@.[...$.......f...I..R.f..u..D$X.....|$D.r..t$0..(.....3....D$D.....
D$@....f.D$0.v............tF.5L.W.j.j.j..D$ P....t .=H.W...D.W..D$.P..
.D$.P..j.j.j..D$ P....u..D$..L$Pd......Y_^[.L$83...(....]..........4..
$P.D$.0....D$......D$.0.M..D$......D$......L$..D$......D$ .....D$$....
.D$(.....D$,@.[..D$0......@.W...4....j.Qj.j.j.h....j.h....h....h..
<<< skipped >>>

The Trojan connects to the servers at the folowing location(s):

.text

`.rdata

@.data

.ndata

.rsrc

uDSSh

hu2.iu

.DEFAULT\Control Panel\International

Software\Microsoft\Windows\CurrentVersion

GetWindowsDirectoryA

KERNEL32.dll

ExitWindowsEx

USER32.dll

GDI32.dll

SHFileOperationA

ShellExecuteA

SHELL32.dll

RegEnumKeyA

RegCreateKeyExA

RegCloseKey

RegDeleteKeyA

RegOpenKeyExA

ADVAPI32.dll

COMCTL32.dll

ole32.dll

VERSION.dll

verifying installer: %d%%

hXXp://nsis.sf.net/NSIS_Error

... %d%%

~nsu.tmp

%u.%u%s%s

RegDeleteKeyExA

%s=%s

*?|<>/":

\AppData\Local\Temp\nsm1F53.tmp\nsExec.dll

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsm1F53.tmp\nsExec.dll

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsm1F53.tmp

.reloc

SShL0

PeekNamedPipe

CreatePipe

nsExec.dll

99|9

: :0:5:>:

u.Uj@

MSVCRT.dll

HttpSendRequestA

HttpSendRequestExA

HttpQueryInfoA

FtpCreateDirectoryA

FtpOpenFileA

HttpOpenRequestA

HttpAddRequestHeadersA

HttpEndRequestA

InternetCrackUrlA

WININET.dll

inetc.dll

Open URL Error

URL Parts Error

FtpCreateDir failed (550)

Error FTP path (550)

Downloading %s

%dkB (%d%%) of %dkB @ %d.
dkB/s

(%d %s%s remaining)

REST %d

SIZE %s

Content-Length: %d

Content-Type: application/x-www-form-urlencoded

Authorization: basic %s

Proxy-authorization: basic %s

%s:%s

FtpCommandA

wininet.dll

%u MB

%u kB

%u bytes

%d:d:d

%s - %s

(Err=%d)

NSIS_Inetc (Mozilla)

Filename: %s

/password

Uploading %s

9!9-9B9}9

#q %u

nsm1F53.tmp

\Users\"%CurrentUserName%"\AppData\Local\Temp\nsm1F53.tmp

c:\%original file name%.exe

%original file name%.exe

ers\"%CurrentUserName%"\AppData\Local\Temp\nsm1F52.tmp

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\

<?xml version="1.0" encoding="UTF-8" standalone="yes"?><assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"><assemblyIdentity version="1.0.0.0" processorArchitecture="X86" name="Nullsoft.NSIS.exehead" type="win32"/><description>Nullsoft Install System v2.46</description><trustInfo xmlns="urn:schemas-microsoft-com:asm.v3"><security><requestedPrivileges><requestedExecutionLevel level="asInvoker" uiAccess="false"/></requestedPrivileges></security></trustInfo><compatibility xmlns="urn:schemas-microsoft-com:compatibility.v1"><application><supportedOS Id="{35138b9a-5d96-4fbd-8e2d-a2440225f93a}"/><supportedOS Id="{e2011457-1546-43c5-a5fe-008deee3d3f0}"/></application></compatibility></assembly>

ns38BD.tmp_3580:

.text

`.rdata

@.data

.reloc

SShL0

PeekNamedPipe

CreatePipe

KERNEL32.dll

USER32.dll

ADVAPI32.dll

nsExec.dll

99|9

: :0:5:>:

conhost.exe_264:

.text

`.data

.rsrc

@.reloc

GDI32.dll

USER32.dll

msvcrt.dll

ntdll.dll

API-MS-Win-Core-LocalRegistry-L1-1-0.dll

KERNEL32.dll

IMM32.dll

ole32.dll

OLEAUT32.dll

PutInputInBuffer: EventsWritten != 1 (0x%x), 1 expected

Invalid message 0x%x

InitExtendedEditKeys: Unsupported version number(%d)

Console init failed with status 0x%x

CreateWindowsWindow failed with status 0x%x, gle = 0x%x

InitWindowsStuff failed with status 0x%x (gle = 0x%x)

InitSideBySide failed create an activation context. Error: %d

GetModuleFileNameW requires more than ScratchBufferSize(%d) - 1.

GetModuleFileNameW failed %d.

Invalid EventType: 0x%x

Dup handle failed for %d of %d (Status = 0x%x)

Couldn't grow input buffer, Status == 0x%x

InitializeScrollBuffer failed, Status = 0x%x

CreateWindow failed with gle = 0x%x

Opening Font file failed with error 0x%x

\ega.cpi

NtReplyWaitReceivePort failed with Status 0x%x

ConsoleOpenWaitEvent failed with Status 0x%x

NtCreatePort failed with Status 0x%x

GetCharWidth32 failed with error 0x%x

GetTextMetricsW failed with error 0x%x

GetSystemEUDCRangeW: RegOpenKeyExW(%ws) failed, error = 0x%x

RtlStringCchCopy failed with Status 0x%x

Cannot allocate 0n%d bytes

|%SWj

O.fBf;

ReCreateDbcsScreenBuffer failed. Restoring to CP=%d

Invalid Parameter: 0x%x, 0x%x, 0x%x

ConsoleKeyInfo buffer is full

Invalid screen buffer size (0x%x, 0x%x)

SetROMFontCodePage: failed to memory allocation %d bytes

FONT.NT

Failed to set font image. wc=x, sz=(%x,%x)

Failed to set font image. wc=x sz=(%x, %x).

Failed to set font image. wc=x sz=(%x,%x)

FullscreenControlSetColors failed - Status = 0x%x

FullscreenControlSetPalette failed - Status = 0x%x

WriteCharsFromInput failed 0x%x

WriteCharsFromInput failed %x

RtlStringCchCopyW failed with Status 0x%x

CreateFontCache failed with Status 0x%x

FTPh

\>.Sj

GetKeyboardLayout

MapVirtualKeyW

VkKeyScanW

GetKeyboardState

UnhookWindowsHookEx

SetWindowsHookExW

GetKeyState

ActivateKeyboardLayout

GetKeyboardLayoutNameA

GetKeyboardLayoutNameW

_amsg_exit

_acmdln

ShipAssert

NtReplyWaitReceivePort

NtCreatePort

NtEnumerateValueKey

NtQueryValueKey

NtOpenKey

NtAcceptConnectPort

NtReplyPort

SetProcessShutdownParameters

GetCPInfo

conhost.pdb

%$%a%b%V%U%c%Q%W%]%\%[%

%<%^%_%Z%T%i%f%`%P%l%g%h%d%e%Y%X%R%S%k%j%

version="5.1.0.0"

name="Microsoft.Windows.ConsoleHost"

<requestedExecutionLevel

name="Microsoft.Windows.ConsoleHost.SystemDefault"

publicKeyToken="6595b64144ccf1df"

name="Microsoft.Windows.SystemCompatible"

version="6.0.0.0"

publicKeyToken="6595b64144ccf1df"

< =$>:>@>

2%2X2

%SystemRoot%

\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Console\TrueTypeFont

\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Console\FullScreen

WindowSize

ColorTableu

ExtendedEditkeyCustom

ExtendedEditKey

Software\Microsoft\Windows\CurrentVersion

\ !:=/.<>;|&

%d/%d

cmd.exe

desktop.ini

\console.dll

%d/%d

6.1.7601.17641 (win7sp1_gdr.110623-1503)

CONHOST.EXE

Windows

Operating System

6.1.7601.17641

setupfs_1123.exe_1780:

.text

`.rdata

@.data

.rsrc

@.reloc

j.Yf;

_tcPVj@

.PjRW

function not supported

operation canceled

address_family_not_supported

operation_in_progress

operation_not_supported

protocol_not_supported

operation_would_block

address family not supported

broken pipe

inappropriate io control operation

not supported

operation in progress

operation not permitted

operation not supported

operation would block

protocol not supported

GxIHnkHFogb2GVrEfPyzQkz78Z1qzdVNzuclmpbyzjAY5PhyWftp7IxQB1neuVgs1X1jUABOLJUNDcpn8UYvnjMjtWnUQoRaPB97QYlWMrd09omwiyHBkyh4unn4DrBD1gLIvWZwu3OE58heN6H9

4fvScF2AySvecV6jxkUPUNXh3QkZuzx0JdDgexdGYRR61UC6kfT0Tnxxz1FSSHis4K6dJ5VaYWWUH4KuQbtbEJZWMKfd4DZUcJBx7AQVk2dL0Eawb5uLzrYuxTXQ7Xz4dSPJ8xW46lRqcwuEjxI0cQWA71HR7Eksy4zPfJFEz5aT2Gl5Vlpr1MKl6P8rqrKJoUVLyE9AlcH

nvEFNieE2xpo0hiwPldKAOfpVd1hWU2vTVKhEVLcrKAtAIm1GLREzcBbkd4Shq6QF154QkxZTOgD5WMDpdiK9FwYhcFb34676KFQBmcKxhWsuZ349E5SGHu33Z1eonENGi6tcfLdCornZce6ecxksWLwG8budpYf81uzmLGhpWHCzlNC4jbenrTJTGWSw9d2YpFEIbzavhZa9

fGKeYJpCWEQovxcQkTfUzxjsf9AXljgXBqYKqPp38G6nKzjNDymJNldlHYoM4vxW2LPSJfA5PcMx7ERvBXfVLWtLixOkbsVzSZAW7npvCKQGP7Z7vVAPnwIZlnyxcZQHkYPizGd7GlsxXfKNPUodHl1d

UAQzOe5RTw5a7WuhTtpJuqANEdot2zXV0dEOF

k5VmZ7XgvmkEYUezTuNwBWRDk6eumaYlvTZRLtTwOEMdx35EvNV53QRlc0Frxx8N5zjAmkSjrRYP1fUj7BH8h2GKmDecPM3T0a4mR2e7MCNUATY82kOdMpWy74KS74WMIlXkBHR2dEaYRTmNpw3vMtOkZ5CdVxEcFeDYQi1LI6iD0FjAmVIizlqzKqh2VYKd1ta7aw8gzaJQ3nK0uBh1HT5XiYTkDQcCXfg9

IaglNCgOWUkRc6wD7qqWMqNkxmCUoiFgvvK0OBxGyG7LjnABaFjAVD0rjxirtTQDLzlg91YtS4MlfFIRpRFsWSdVJddN8KsjN4Pv0FbwGFq6rnauZo6nCzMbUKFBIWSDsIS6UDP8CAnOvgc6cxXTHQ7Bo4IoiaJmo2DnywE8Db

kKcuPzcoV5CbPNkeYfVfmhzqds8fpHLcG4JfyXkDU8DzTBXe72dU6iQLWEHcqBTSQThNXpzUkxBGhxGi8aE10E83Y9oMqiEi9oPu35V36EoICcVogFiRLP1Gmuq6LYk4IFCO16TOeUSiHOhqSRNb9mG0gL3viY9ASlxhuXTuafUB7sRDn3YJgq

0kQ8hw3ow42WTZc4D7csy6w1B259Ahzlrv85mEIV6IMIbgnEMTca92zua0RzgCO0RUfTP962DCPJPo3gULiUn5kRniHagIBajfwmnBak5Z0Zpkjks3P7tATPx2WEgUM3NdzZlJkHIBXXsSWlI8gtDMijKh83cgfbxXm8IsecAtZnJ5IHFRsXWbvFXyy46J0w3Va

05dgIV3xB2PKS5LiWI1w3IVPlhC0Bu1IwTGKxBTjKZpnGM2f88QWGqNPLOLF60nQVffoKaZUdBWZ4KlbCkt83Zc1qLQNGeXEjRU48bm0NCltxETUbQdLoMWCp2USv8tn2EAX4mFhikCZEKe0NrqixoiFeOAWgjX3FyEQom2eahB9kKYyFRLxfSJrwBKRXNaRQI3ZPEe0fn6z3zq4pb6pzBMGe5hPzhKpB94tP74J4zJY

UX9svCvAInrLRGT1X103n4vflDy03whj8BYbrcRqul6UDpOLv5GcQgyXe50tNVBGf13

kQUNV9ddEtALr539mF4v4S2UOTmDUzSsHbgGoaUrSvqhrpo66YuiuvplaBIOXmZxcxI2

SCrt0zL1koRxPDE6zlYMGQQ1VFL01wFKtZmrMg3CwvMMsXC95aYPxxmPEOc9r0BoLAPWjAiHu5e1IUY2BTAIswEPQHa2JljDgHEF4Qn6c1m8VltjvDBB8rGFGJZ4P1

operator

GetProcessWindowStation

E4HEpGrhIeoOsWIKi8lkUTXmi8iVFdN56xA3lRGMQ38JFoE6oJa6TrFNfDkWOlMJBQ7ctl447wf8TT2LGpMdH67WEai1zK5qlmDV01OQN3BapsN6qRF6OKjUdJ2JwtD8GOLgaKyU2duHUHv0Zx9k3uGws2TKny0SPmTGvsYAbKwdPEIC43xJCDDEz8SUGYOm7kEyKCUkcgTVo6egDIB4Z453LYIYjGnLmcXs

ya22w8aKGbHWEbPC9qXVKObnzFmjNnOLeQeKf3KaFJpf9IJgh3rbH6IxSk1sYJGqrD4T6DGIQyVZQc2

AlJ9o866nxEBBz6DXN4459pYk28knvveNvo0i9zGUVt6R1dVRROuaJa5s6JFiOSE1bWGIuFeNmqrLYNpfNXaqHuIxnOnpvHEGKrMfDiQfqBus8AX8AGl0OT97H7Kz2x6KD8JU3PV2fAeousmZkCgyxQ1FFyr1Eb4cboAFhavmCmdJBUwUSVwhsqnhhutuaBjEgU4rnHhElyTqQKkfeHDJ

HmHn0yc1vEhR2UUssuIxDuFvnUAIsBpNXMvNJObtKB9W54Sg1pgnzpsq4L1CkmOQKbz7R0OHFRsZNJCqpHYqWQKQ33xMTE7fO4X5FagAuG8UiJXzBu2JazhgPLRySE6lRyM3muOzmZqIPGpav8pc4G4LnSQL0bouHmzeyEhJ9JNQhvQXSdKasrxZ0y1DRfkM7uP1XHTc6uAJXXC0stXvnlRnRUmRivcxLN

OMKiXHyi8Eg7ELFGq3cr2niySLSrkOymUrLC6IaePWvILH8IqvbGebYpDSqDI7peFWmdHxeJZEpkic4uFyK17gbM8S962odMdT1vLC8JogUx6PHBQbB4ily8HVfaXkNoLBNEaUHilP1iHuXBEwndkso6NdalqBYNfofRZmqDMOaP

ZRfdNFv4qOUztIw2Xlq9hFvKH4xvk7OELx6Bw2ZeuTPuIZRR24yHXrhtzKT1NzOL1nNtG0iWy8I2wuZFSmk6TV5OciqAM1TDnG1eB8NekO3BUmYg3oWzhkqJarq7FH28DbFNpvQNky9cE7APEQgATROXqB69hD0ybVk4IRZ0VGUEYm9eouIWtH6cRTPYlYlvznD2z3FoNPUsN9PXzRFNasrwCBr90mGKcVDSWi7Wr4Bi

id0xiGp45aCfWtr8i9XkdHEagCD2NH0lNk4UYfvdckeaF4vMwccKO2uMRYJr8NCTP4aPMzc9xETGa7Aj2ACWYRoLXVyVH3ogAqgsCmdhiJvH0XzPslEqZRumcLF08aPKv8o4rxJ7Z2P75Gp1319Fb0KTWD5t8DvafPEXeBXdtDehkHE3fe4OPph2vzudretQkExUdIlFwe9LhHhPU

65ALpTXE0l33tsero7UL6YbwJpBCOmV02XqZcMd7C7zUn8wYVqPen9cRsevBItd4amRUQz3xKozxJ7px2uDBLPEMIbt6p6rYNPiswtk6t2yNxZsDuNjq0Z0GOipq7ZdypLLgos3BZBxC8sM970A3xtJ4Y

BFtgI2RsOT5jbeEYGswPesQl4RaM9rjkefet8rzBIDOJfJ5zlYj4JbATD7jcsEd3BvPuAARenn48wMbxIm80kZWB7eEpS52ERawWDXaDnzHvgcLGYcatWOQWruKqT3KZQFtolQDv3OY2NaqBjUXqypSpHF15EWb7QNt0G8YE6HdSGVHegYNsXC2bKDIDnAdawC2d4LxmGSHgFLHqVCdv5BC639GcFhBDFUyUjpR2GDsf01FvZp8uP3oD1obN

zoSkNLH4W32HTAb60FnPw0AxXCC9YwRPSKloY4SCMdDXtZKIFw3YwoHaXS0IwTBraGj8nzQ20Ug4J2zFs5t6P7nyxUMMijTplBzCwz0dfCrrc5rJhCS8euvamykr6kHUvM59LRVWkErg9ZhDXrDAnBuZpo7P6b5Wq

oyfxp1r26iKgf0Lrl1Ljwamq5P7kC8CJU5fSo6quTuTq65X9jee6LI2floxkctFWj5QXczNTAFOBavFd8smoHzQIEPx5Z1LKmnsRAccbKSaZLySg8cKxjVm6xIlktY57VNYCRyS9yxBiQaQ4xmHMymmEMV3tICCg8nU30RgAWeBwPfjaH034QTXwXmEwEF6qGp7sEGPcGvOo3FBi3ZLhvsd3jtJv7

bgRBddfmYlfTP2g9cAfrLysl7QQ1gJOaqiw4eNUMaXwolp2X3Kclkrg70EVaG37cntz1DpI9t6mJtbfSJiu0TvcHdi3fKSZm3TreLhROHvXYoWOUB8NqHb0fKLMKhtNtjJ4LZLzGWOdXzwzp4cxgTsXPDJeRImW39gdqKYYI1hPbiSSD5kaua7m0nKcprl6R9BuHiRq50wKyykEPLEBIpkQ5DFw9trk27kbhbfFCwEmdottpXiQCs

2Uyn4odxeUaZFWKT9i9uF2DLOEQ8euh11meDmoWI3rR9u4AWOoozUCUah1n62fUrlOqcZTr6vR5nqyqXM12XJD5DrCUUCR7VEz7vVyoFxIlDX0VdtYsTr7kEkV4lz9tW9IL2t4q8kIw5Y5RaV8UD8vR8qCmcudnWm9CmMpFLWXdUydpniMRteiwSsQIPoGA7jJyjjncvp4etT5y

MTchaAMDMaLJRSdEeXRHkNqJ3hVOK5qpiMwRmUfJiKTdRzMiNfzITamJD0VQmg77OFMdCZwTjIteEwpLhLHcorfFuRLjUca8TaOZvlpTx7W7jfMtuWfW9QVQrYBbIBNOi5SUcYSD5nXDdwrb8HkcjieI22MbCF

UaOGOEzTLNRhDBxDNXH4AasAeEJQSaQrKSu4trVKb31xenaDAHFq6Ef0GsCHI8ykcMdZ27Mr8HyhN9MzQ

zfo8XhRNOBzBow9Fwqwe6OlT3hPZ4jSmKBE5CRtNR3xTzqvKWLlHgkNmHAqdH9v3FldQWfp37SITR0y5AbSgzBr08bwWb9nLTyJU1jOB5rxEE7eoBRfJWl6MubOB18SHrXlsdKb1

7fEnzw1EcIkVtyYxTem0FFKiJbkn3Si3gr0rMmlyLxa738RpRHUkVWKFHbUn8XLYFpJfTpxEeEMwXwgDSWCzuMGUbZCsHvjRPJa5UyGxX22SvM6zDz8VqdOTZBgBcB5LgpXGf29FT2Mxs0JW91xBkrCJMsqKDBJVPoDsCUHb

aAWPg7bVopenPK13AoVY9qEr1t0XoETLuDPsfYQkpAcfgE2Z5M38YoAvQSTH6qydS5zRXHxKc1ENhaUMh7Md5ydcz9wLTQkktQr0Ri6yMpU

VAmL6ujbObDtu4rPl3l55HAhudPFfgzK3GDwmouei05f85Ezaf5FRexuCgzEnWAYbxy9TQ

CreateNamedPipeA

GetProcessHeap

GetConsoleAliasExesLengthA

KERNEL32.dll

USER32.dll

GetCPInfo

.?AVExecutor@@

zcÁ

data0.dat

data553878.dat

data1109792.dat

data1691747.dat

data2252063.dat

data2823470.dat

data3393609.dat

data3973534.dat

data4527265.dat

%0.av

MO.in

%Du1d)}

i.UUu

EMWû

r{%u.

ci.Gu

V.Dz>

*.MAIY

^%dQ =

.BOCb

!:%dLJA

?q.it'a

.zT*g

.yRuJ

.fjQPG

o:.hS[

#2SSH

|0M(%C

!9.DRnT

n%S7WM

n{%CQ

_-.YP

x %SZ7;

fz

e#.ZGeF

k*%C.

-i{G%d

a.Ong

\Z.jk

aju%X

.BF%a

2B.Wn

 1

JF.nC

"ngPp%C^

>.Rb#

.GUY[z

FJ|_.dE

zm^f[r.az

k37.Hu&QJ

b83.jj

<&.QBJ

S.gsr

.nM/}a

e.Tb ?-

o-.fp

{-0}B

-.Cs~e

[%f$N

%Xn&(

Bx80.mk

av.pTP

81.gy,^

k.S.qdk

%cjI}

a.BRJht

f".QVt

8Q.nt

%sbdm

qY%dO

W8.Kw

.rkYq

).AO&V

.eEq8

%c#6Sy

'.Feo

F.Smz

j.Qok

%f}72

a.dw; i<

_%CN =

WE.Kh#

*%FMY

=%U<]{

mftp

y,.uL{]B

.ksd>QG

.HBQw

".iM,

-4wu}F

rT.gfu

?@$.ixA

'.pam

%1xDy

Hx)i%s

.xiL2

&8.xU.

L/!!2%f

-V7};

)!%s7[$

}6C%s

.mc{A

FU^%d

c.wcx

t.AG47

qKvj.Zb

.Ja`%y

D:Ë

m.ZQl

X>/%c

^]%sE

JÜj

RN.Jh|

C%sEa(

5"%Ss}j

quT%D

%{%s%

N3W.EA

UtCpD

.pBz\

=p.hv

m%d,w(

#V%Xn

-\a<%x

&%.pF

LI.ie

W.Za2u

oL

(X%X<

.oEUiN

>&.sM

%#6.bo

r.Xx&

v(3%F

3%s@O

.pXIZlO

%xvY=MS

[E%sRC

>X.WZj'[

$WEb3(

e".Rj

\{59~>*63_

h~.Ko

q%s6J

Fe.Th

d%XQ^2.9W

,h.NF5

%C[CR

,Y.nMC[.

F>W.dK

4"E.mwT[k'feQ

=D%FN

k.OCo

.NLPu

eKd%2u

[~%Ci

.m.Ye

U2}.pw

.Ommy

570Q%U

*{JM.Pl

{.MbQ

'%fO3

~%UfG

zJ%5X

c2jQ#.eU

6c%X%

g.OY-c*

.Nm D

.Eu@NI

isH.GO

.GePji

e.CBf

BudPX

-f#d/

2.MeW,

^T%xc

.Bx N#

.Gu)S

j.li,

sP7Y%FYR

ZUK.Cy2*

%d{Dr

WS%fUy

<~.BAh

f%c?V

p%9Xo

m.QjvnM!}

l-Asz}

ybm

%Ss[H

:.loVb@

6..On=

q.kpA

.jDAW

fJ.VWd 3

&~.SK

2.fX:fq

=7,Kr%u

U*VG`.xZ

$o=]ck<.ZP

n-e.EA_

p.UzM

v{{%Z.es

5.Wq}

J.ER:

e4>n.MC

Ow{I.Qe)

%f=4P

T.NUu*}

%U-@Z

7.Gh:

%dvr%En

%X6|Y-

.yBIp

Ü=&

h*;%F

6#{%fJ

.eGsn

.YCv}

U.vt)

W%dV@

y0Hi%UPb

nl{.Fx

8C.aP

%2u/o-

W.XK3"

Ml.Yu

%p.FG~

.oN9Mv

w.rM;.

.amD$

#E-n}

.Nyn\q

%X^/ 

E3Ï

p(2.tN

.ht92zs

Gx%scT

i..oQ

v{g%X

b8.ge

.np9]

.tqCn];

>t .iM

C.bf4

1.yq]

2}%C#

.FKX=% v`

%c@Ep

lW>8Kk-XA}

%.J.eQrN@

u1=%x

i.zEE

'.tW<

.Zfeo

JW$d%U

]0.xx2

.mY>E

.FNwb

[n.NJ

ai.blj

.JOnk

?%sH`

%;.Mx

w #.rzR

{%xb"

=ytI.Kd

P.qYo

%f#m|

j%.AOF

fcmd

-r.je

w8ú P

Bd .kuA

H%D]H

q]CcMd

.WMKn

.ZeBW

%c{Yuz

&D.Ls

'.RoC

\tHKbI.yU.

.Nt%8

.Id{wNyb

r_W%D

ß^b

trI74.Px

CmDO:L

.apW,

%s>Tu

nc.QAx

[?.Dp

mi.LG

0%Fp v

.tQSG

T.oZT

%c?,{

gfT%f

o.HjE

%SaVEU

(.ftv(

:>.GL

2S%Uwi4}~p

|C%u`$FJ

%cS6h;

 .QJQ

.VbwO

E8üx

}.zzN

BMsG{~K

:t.Lh

B1*%x5

-TK} #u

m.tKa

.okg{Qm?h

udPk

P".bh]

wLY%u%4^

.Zfdw

MEXE;8

`R.zQ7x

!g.Kyu

h-.Jl

|.yrY

.ZT1V

f%d{8

 j%4S

^-0LKQ}

.Mgnj"a)

~.egl%

O%FzA

%UK#S

R*.Ove

c.ytRih%

Y.nS*&

D.yQ]

k%%S2

.iY>n

oll.qy

K}i.Fm

R%S{CS

uS-27}

Z.Ss?

q*.cg

5.mRP

G%UM&Zq

.Jx(6

b.DFD

z .ZqG;

1H.HdC|v^D

icMD%

f!@.sY

u.XsL3

RB%FL

.xA~S

(pJ%9x

.WwA|g

j8'%C

Ü)["j

Dyn%s;c

9H:%F

<supportedOS Id="{e2011457-1546-43c5-a5fe-008deee3d3f0}"></supportedOS>

<supportedOS Id="{35138b9a-5d96-4fbd-8e2d-a2440225f93a}"></supportedOS>

<!-- -->

<requestedExecutionLevel level="requireAdministrator" uiAccess="false">

</requestedExecutionLevel>

2#292^2

5-5?5]5{5

> ?%?,?7?

;3<&=$>7>

03090[0|0

<(<.<3<=<

2$2,242|2

= =<=@=`=

Tmscoree.dll

- CRT not initialized

- Attempt to initialize the CRT more than once.

- floating point support not loaded

kernel32.dll

ADVAPI32.DLL

USER32.DLL

portuguese-brazilian

@Kernel32.dll

c:\setupfs_1123.exe

svchost.exe_3528:

.text

`.data

.rsrc

@.reloc

msvcrt.dll

API-MS-Win-Core-ProcessThreads-L1-1-0.dll

KERNEL32.dll

NTDLL.DLL

API-MS-Win-Security-Base-L1-1-0.dll

API-MS-WIN-Service-Core-L1-1-0.dll

API-MS-WIN-Service-winsvc-L1-1-0.dll

RPCRT4.dll

ole32.dll

ntdll.dll

_amsg_exit

RegCloseKey

RegOpenKeyExW

GetProcessHeap

svchost.pdb

version="5.1.0.0"

name="Microsoft.Windows.Services.SvcHost"

<description>Host Process for Windows Services</description>

<requestedExecutionLevel

Software\Microsoft\Windows NT\CurrentVersion\Svchost

Software\Microsoft\Windows NT\CurrentVersion\MgdSvchost

\PIPE\

Host Process for Windows Services

6.1.7600.16385 (win7_rtm.090713-1255)

svchost.exe

Windows

Operating System

6.1.7600.16385

WerFault.exe_2892:

.text

`.data

.rsrc

@.reloc

ADVAPI32.dll

ntdll.DLL

KERNEL32.dll

USER32.dll

msvcrt.dll

ole32.dll

OLEAUT32.dll

SHLWAPI.dll

IMM32.dll

wer.dll

COMCTL32.dll

faultrep.dll

Starting kernel vertical - %S

rundll32.exe

NtQueryInformationProcess failed with status: 0x%x

Reporting never started for process id %u

StringCchPrintf failed with 0x%x

NtWow64QueryInformationProcess64 failed with 0x%x

NtWow64ReadVirtualMemory64 failed with 0x%x

NtQueryInformationProcess failed with status 0x%x

WerpNtWow64QueryInformationProcess64 failed with status 0x%x

StringCchCopy failed with 0x%x

Invalid arg in %s

wdi.dll

dbgeng.dll

dbghelp.dll

SETUPAPI.dll

SHELL32.dll

VERSION.dll

WTSAPI32.dll

WerFault.pdb

PSShD

tSSh,<D

t.PSj6

t5SSh

SShx`D

tsShxcD

t.Ph0jD

_amsg_exit

RegCloseKey

RegCreateKeyExW

RegOpenKeyExW

RegEnumKeyExW

RegQueryInfoKeyW

GetProcessHeap

GetWindowsDirectoryW

RegDeleteKeyW

ReportEventW

RegOpenKeyW

RegSetKeyValueW

GetProcessWindowStation

EnumWindows

NtAlpcSendWaitReceivePort

NtAlpcConnectPort

ShipAssert

ntdll.dll

RegisterErrorReportingDialog

WerReportSubmit

WerReportAddFile

WerReportCreate

WerReportCloseHandle

WerReportSetUIOption

WerpGetReportConsent

WerpSetIntegratorReportId

WerpReportCancel

WerpAddRegisteredDataToReport

WerReportAddDump

WerpCreateIntegratorReportId

WerpSetReportFlags

WerpGetReportFlags

WerpIsTransportAvailable

WerReportSetParameter

WerpInitiateCrashReporting

version="1.0.0.0"

name="Microsoft.Windows.Feedback.Watson"

name="Microsoft.Windows.Common-Controls"

version="6.0.0.0"

publicKeyToken="6595b64144ccf1df"

<asmv3:windowsSettings xmlns="hXXp://schemas.microsoft.com/SMI/2005/WindowsSettings">

</asmv3:windowsSettings>

<requestedExecutionLevel

ÝCD0

#$$$3355<

##$$$335566

% "#$$$3355666=

"#$$33555666

!.DQ$

.Py>o

Kÿg

.ib:?

T3%X_

a,M.cbd

KEYW8

KEYWH

? ?$?(?,?0?4?8?

1 2$2(2,20242

>,?0?4?8?<?@?

?%?5?:?|?

5'565^5{5

3#3(353_3

=#='= =/=3=7=;=?=

=#=(=>=]=

>!>&>3>}>

1!1&131[1

Microsoft\Windows\WindowsErrorReporting\WerFault

%s %s

Global\WerKernelVerticalReporting

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\CrashControl

CrashDumpEnabled.Old

CrashDumpEnabled.New

%SystemRoot%\MEMORY.DMP

LiveKernelReports

Software\Microsoft\Windows\Windows Error Reporting\LiveKernelReports

LiveKernelReportsPath

BCCode=%x&BCP1=%p&BCP2=%p&BCP3=%p&BCP4=%p&OS Version=%u_%u_%u&Service Pack=%u_%u&Product=%u_%u

*WerKernelReporting

%SYSTEMROOT%\SYSTEM32\WerFault.exe -k -rq

SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce

SOFTWARE\Microsoft\Windows\Windows Error Reporting\KernelFaults\Queue

sysdata.xml

%s -k -q

SOFTWARE\Microsoft\Windows NT\CurrentVersion

<OSVER>%u.%u.%u %u.%u</OSVER>

<OSLANGUAGE>%u</OSLANGUAGE>

<ARCHITECTURE>%u</ARCHITECTURE>

<PRODUCTTYPE>%u</PRODUCTTYPE>

<FILESIZE>%u</FILESIZE>

<CREATIONDATE>d-d-d d:d:d</CREATIONDATE>

<NAME>%s</NAME>

<DATA>%s</DATA>

<ERROR>Failed at Step: %s with error 0x%x</ERROR>

%sDrivers\%s.sys

</%s>

<%s>%s</%s>

%u.%u.%u.%u

*.mrk

WER-%u-%u.sysdata.xml

Software\Microsoft\Windows\CurrentVersion\CEIPRole\RolesInWER

SOFTWARE\Microsoft\Windows\CurrentVersion\Reliability\MemoryDiagnostic

Web Server

Software\Microsoft\Windows\Windows Error Reporting\Debug

%SystemRoot%\Minidump

0xx (0xx, 0xx, 0xx, 0xx)

%s\%2.2d%2.2d%2.2d-%u-%2.2d.dmp

*.dmp

Software\Microsoft\Windows\Windows Error Reporting

Software\Policies\Microsoft\Windows\Windows Error Reporting

\KernelObjects\SystemErrorPortReady

%s\%s

Microsoft.Windows.Setup

\WindowsErrorReportingServicePort

(0x%x): %s

%u %s

WindowsNTVersion

%u.%u

ErrorPort

\StringFileInfo\xx\%s

HKEY_USERS\

HKEY_CURRENT_CONFIG\

HKEY_CLASSES_ROOT\

HKEY_LOCAL_MACHINE\

HKEY_CURRENT_USER\

%s="%s"

%s.%s

%s %d

Software\Microsoft\Windows\Windows Error Reporting\Hangs

_NT_EXECUTABLE_IMAGE_PATH

wxmu.dmp

wxhu.dmp

axmu.dmp

axhu.dmp

hu.kdmp

mu.kdmp

hu.dmp

mu.dmp

Software\Microsoft\.NETFramework

NOT_TCPIP

sos.dll

Eversion.xml

.version.xml

%s.xml

memory.hdmp

minidump.mdmp

Local\WERReportingForProcess%d

atk.kdmp

F%FNFAppTermFailureEvent

Software\Microsoft\Windows\Windows Error Reporting\Hangs\NHRTimes

%i|%d|%d

xxxxxxxxxxxxxxxx

xx

%d.%d.%d.%d

GD:P(A;;GA;;;BA)(A;;GA;;;SY)(A;;GA;;;%s)

D:P(A;;GA;;;BA)(A;;GA;;;SY)(A;;GA;;;%s)S:(ML;;NR;;;HI)

F.ref

dc.noreflect

dc.xpmemdump

dc.xpdata

dc.CustomDump

dc.expmodmem

dc.expmoddata

dc.OnDemandKdmp

dc.xpmodmem

dc.xpmoddata

default=%s

memory=%s

module=%s

.dbgcfg.ini

ElevatedDataCollectionStatus.txt

Open process failed unexpectedly: 0X%X

Attempting to cross-proc reporting process!

Elevation:Administrator!new:%s

Reflection attempt failed: 0X%X

Attempting to reflect reporting process!

Could not collect dump for reflection cross process: 0x%x

Could not collect xproc for reflection: 0x%x

CollectFile for reflection failed: 0x%x

Could not collect dump for cross process: 0x%x

CollectReflectionDump failed with: 0x%x

0 processes found for xproc module: %s

Could not collect cross dump from module: 0x%x

CollectCrossProcessModuleDumps failed: 0x%x

CollectCrossProcessDumps failed: 0x%x

KernelDump failed: 0x%x

ProcessHandle

%s|%s

rpcrt4

\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AeDebugProtected\AutoExclusionList

\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AeDebug\AutoExclusionList

\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AeDebugProtected

\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AeDebug

sntdll.dll

WerDiagController.dll

Software\Microsoft\Windows\Windows Error Reporting\Plugins

Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers

Software\Microsoft\Windows\Windows Error Reporting\Plugins\FDR\CurrentSession

%s\%s\%u-%u.etl

%s\%s\%u-%u.etl_%d

Microsoft\Windows\FDR

%s-%d

Software\Microsoft\Windows\Windows Error Reporting\Plugins\DriverVerifier

Software\Microsoft\Windows\Windows Error Reporting\Plugins\AppRecorder

%d-AppRecorderEnabled

F%s /stop

psr.exe

Software\Microsoft\Windows\Windows Error Reporting\RuntimeExceptionHelperModules

verifier.dll

nVerifier.dll

Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\%s

Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options

lsvchost.exe

"%s" "%s" "%s"

%s\system32\cofire.exe

psapi.dll

sfc_os.dll

werfault.exe

%s\%s-(PID-%u)-%u

%s\%s-(PID-%u).dmp

%s\*-(PID-*)-*

SOFTWARE\Microsoft\Windows NT\CurrentVersion\SilentProcessExit\%s

SOFTWARE\Microsoft\Windows NT\CurrentVersion\SilentProcessExit

kernel32.dll

kernelbase.dll

ReportingMode

DWinShipAssert

WindowsMessageReportingB1

Windows

ws2_32.dll

Software\Microsoft\SQMClient\%s\AdaptiveSqm\ManifestInfo

%s\Sqm%d.bin

CorporateWerPortNumber

BypassDataThrottling

Software\Microsoft\Windows\Windows Error Reporting\Consent

Windows Problem Reporting

6.1.7600.16385 (win7_rtm.090713-1255)

WerFault.exe

Windows

Operating System

6.1.7600.16385

Microsoft-Windows-WER-Diag/Operational

Remove it with Ad-Aware

1. Click (here) to download and install Ad-Aware Free Antivirus.
2. Update the definition files.
3. Run a full scan of your computer.

Manual removal*

1. Terminate malicious process(es) (How to End a Process With the Task Manager):
   

   %original file name%.exe:1796
   ns38BD.tmp:3580
   setupfs_1123.exe:1780

2. Delete the original Trojan file.
   
3. Delete or disinfect the following files created/modified by the Trojan:
   

   C:\setupfs_1123.exe (332936 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsm1F53.tmp\ns38BD.tmp (14 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsm1F53.tmp\nsExec.dll (14 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsm1F53.tmp\inetc.dll (44 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\25FDO7QC\setupfs_1123[1].exe (313824 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsm1F53.tmp\UAC.dll (29 bytes)
   

4. Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
   
5. Reboot the computer.
   

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.