Win32.Pincav.A_0571bfd2b1

by malwarelabrobot on June 26th, 2017 in Malware Descriptions.

Win32.Pincav.A (BitDefender), Trojan:Win32/Dorv.A (Microsoft), Trojan.Win32.Patched.kp (Kaspersky), Trojan.Win32.Patched.kp (v) (VIPRE), Trojan.DownLoad2.13788 (DrWeb), Win32.Pincav.A (B) (Emsisoft), W32/Yama.a (McAfee), Backdoor.Trojan (Symantec), Trojan.Win32.Pincav (Ikarus), Win32.Pincav.A (FSecure), MW97:ShellCode-CK [Expl] (AVG), MW97:ShellCode-CK [Expl] (Avast), PE_TRIYU.A (TrendMicro), Win32.Pincav.A (AdAware), Trojan.Win32.Pincav.FD, PackedThemida.YR (Lavasoft MAS)
Behaviour: Trojan, Backdoor, Packed


The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.

Requires JavaScript enabled!

Summary
Dynamic Analysis
Static Analysis
Network Activity
Map
Strings from Dumps
Removals

MD5: 0571bfd2b1ce767418dc181cb7bb576a
SHA1: caabe79beedce28b4b27b6eaf279476aa1d7c732
SHA256: 7ffabf8ca0e4b559416d53d356be22b429034c378737da6a418da13bdd62935e
SSDeep: 98304:reWLTKlTyl3JV6X99NgiWdedYOYklVLH:SeKlOJVO9yIYo7
Size: 4067328 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: UPolyXv05_v6
Company: CompanyName
Created at: 2008-08-04 09:35:04
Analyzed on: Windows7 SP1 32-bit


Summary:

Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).

Payload

No specific payload has been found.

Process activity

The Trojan creates the following process(es):
No processes have been created.
The Trojan injects its code into the following process(es):

WerFault.exe:2716
%original file name%.exe:452
Explorer.EXE:284

Mutexes

The following mutexes were created/opened:
No objects were found.

File activity

The process %original file name%.exe:452 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\1310330.dll (21 bytes)

Registry activity

The process WerFault.exe:2716 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\Windows Error Reporting\Debug]
"ExceptionRecord" = "05 00 00 C0 00 00 00 00 00 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Microsoft\Windows\Windows Error Reporting\Debug\UIHandles]
"FirstLevelConsentDialog" = "Type: REG_QWORD, Length: 8"

[HKCU\Software\Microsoft\Windows\Windows Error Reporting\Debug\UIHandles]
"FirstLevelConsentDialog" = "Type: REG_QWORD, Length: 8"

Dropped PE files

MD5 File path
d9b6a52858711b15208b2c496278ccea c:\Users\"%CurrentUserName%"\AppData\Local\Temp\1310330.dll

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

VersionInfo

No information is available.

PE Sections

Name Virtual Address Virtual Size Raw Size Entropy Section MD5
4096 253952 253952 3.96396 4ab72d1de0372095ab84a4036dc8af45
.rsrc 258048 141892 143360 5.54221 aece004011dd297f0e9f77706236439d
.idata 401408 4096 4096 0.652416 4abfce642b0a21e554d76fdf3553317a
WinLicen 405504 3018752 3018752 5.36641 aae92c05c51d8637d3e8fec6e19ad78e
SnD 3424256 42705 45056 5.36399 033a16464f40e145e4c5fd4ee1bdc8c2
.uuu9 3469312 46896 49152 5.42779 ba527c0c628610a624549db15b7eba97
.uuu9 3518464 46912 49152 5.42611 f74626bd770890faedb520335092e8b9
.uuu9 3567616 47053 49152 5.42653 eefe47b08354815480f2e3c0503314f9
.uuu9 3616768 46917 49152 5.42613 6f2490346b47c3ea7ce1254e92fb61c6
.uuu9 3665920 47002 49152 5.42619 fe91417cc2af9aa361ca72b98d2c5e3e
.uuu9 3715072 46975 49152 5.42962 2ac043bbceb5cbf95c2e0f11c87c5e8e
.uuu9 3764224 47022 49152 5.42961 9ac5b6b1a0fc8782b77250dad627ae31
.uuu9 3813376 46961 49152 5.42498 60a26312d52fa8008aaca5a4ffc529a6
.uuu9 3862528 46939 49152 5.42926 0a20fe59959914fd7a2cbed205dc87d2
.uuu9 3911680 47066 49152 5.37619 826a187f31a2522e28a39c2551346312
.uuu9 3960832 47043 49152 5.37416 f8e6e1111d6a48bee0836483da55f146
.uuu9 4009984 47043 49152 5.37417 62a5c4adc4e8f4530557d721ee1fcda1
.uuu9 4059136 46944 8192 4.53889 f11c5beea51752bd06411fbc37042199

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

URLs

URL IP
hxxp://log.y5z.info/icon.jpg 23.253.126.58
hxxp://log.y5w.info/icon.jpg 23.226.76.207


IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

GET /icon.jpg HTTP/1.1
Accept: */*
Connection: Close
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1;.NET CLR 1.1.4322)
Host: log.y5w.info
Cache-Control: no-cache


HTTP/1.1 200 OK
Date: Sun, 25 Jun 2017 19:47:14 GMT
Content-Length: 917
Content-Type: image/jpeg
Server: Microsoft-IIS/6.0
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transition0al//EN" "ht
tp://VVV.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html>
<head><meta http-equiv="Content-Type" content="text/html; cha
rset=gb2312" /><meta http-equiv="pragma" content="no-cache" />
;<meta http-equiv="cache-control" content="no-store" /><meta 
http-equiv="Connection" content="Close" /><script>function Ju
mpSelf(){.self.location="/icon.jpg?WebShieldDRSessionVerify=X5NycecObu
nNc4DJiDVX";}</script><title>........................</
title></head><body><div style="margin:0 auto; width:
400px; height:200px; border:2px solid #3589e7; background:#eef7fe">
<div style="text-..



GET /icon.jpg HTTP/1.1
Accept: */*
Connection: Close
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1;.NET CLR 1.1.4322)
Host: log.y5z.info
Cache-Control: no-cache


HTTP/1.1 404 Not Found
Server: nginx 1.1.19
Date: Sun, 25 Jun 2017 19:47:14 GMT
X-Malware-Sinkhole: Arbor Networks
Connection: close







The Trojan connects to the servers at the folowing location(s):







%original file name%.exe_452:




.rsrc
.idata
.uuu9
@.uuu9
Caterpillar KG (SIS/STW/ET, 2008) sultancarsoft@gmail.com
frakey
Site Key Making :
Applications Supported :
lvkeys
ComctlLib.ListView
Site Key
Factory Passwords Making :
MSComDlg.CommonDialog
ComctlLib.StatusBar
ComctlLib.ImageList
COMCTL32.OCX
Comdlg32.ocx
%Program Files%\MVS\VB98\VB6.OLB
C:\WINNT\system32\COMCTL32.oca
C:\WINNT\system32\MSVBVM60.DLL\3
olepro32.dll
sc32lds.dll
imagehlp.dll
comctl32.dll
VBA6.DLL
user32.dll
kernel32.dll
uMsg
N<SSh
.Umy^
.Olp}fO
.Jh ;
(?%c(
q,.wa_B<e'F
U}.jB&mp
s"!F%S
r?|9.RRI;
.tM>p
.WeH9
KERNEL32.dll
COMCTL32.dll
`.rsrc
.pdata
\linkinfo.dll
-c}/W1
uk?%x
X^x%f
Oh.ha
/1.VA
rfÁV
h.jPr
`.JB>~o
@".NV
(7.LtA
%XQni\{P
4.TM@
Tv.GW5
%%u5@lK
z%SwE
KKt.br
$-7.el
<h!%f
>.QU|
8.IvZ
.lM!m
KJw@%sKt
-x %X
z~%DU
9;Œ
M`=%C$
32.dl
]a)
%CU9X$
.eh8{
wmSG.
S.fJA
.BEq<xE
].nYTvFj
.jJ:A\
%S[V^
QN0%S
{,.ab(
l2).DK
'.fuL
V}O~%s
.RrBC
.qs}8
R %sB
N%SVP
AP %S
'.hGX
@%Ds/
H#.WjD
q%u`6
h`t.Jo
6A8/o%2xr
Z`.BcRX
JkTN%xk
oe.Bdw
%C?W)
.M.ujv
tC.XIv]
#o%Ck:
QG.cK?
)*%u 
%uHf78
j$%f-
B.IT{
"$Ari-K}
%xrsF%
^hy.wy
0x%X 
%fI}sh
LN$"k.dGf
$%1X`
O:\jd
\.UuK
d%DtS
4Y1,_%S
%4X`'
.EO#0
c`7.JL
,h:%.c
`,.Yh
0q.BS
1%U$}H
"B%DR
jM.XT
!J6%x:
8$.jKU
%8xcdz
GZ%Us
e.RoD
%X<H7
-pKXS%FW
!%sB$
L{%Co
?a.Qg
@$}.urA
!\j%c
SPUy.Bz
"q4%X
%dvQX
06@%7} ,)
%WinDir%\System32\ntdll.dll
333333333333
regkey.dat
reg_key
C:\Dokumente und Einstellungen\Clara\Desktop\KEY REGDAT\KEYGEN  LICENSE SULTAN VERSION\regkey.dat
%userappdata%\RestartApp.exe
Exit Status = %d
4$.Lvyj
%%U9m%
3,$1,$3,$\
3,$1,$3,$
3<$1<$3<$\
r.jX5
34$14$34$
0$$2$$0$$
3<$1<$3<$
[3,$1,$3,$\
1,$3,$1,$
1<$3<$1<$
]3<$1<$3<$
]%Cic*
f.ZVV[^
[34$14$34$
Sh.jPr[
3,$1,$3,$\1
34$14$34$\
14$34$14$
yFTP
W}.ih
.Vm]34$14$
&75`[3<$1<$3<$
.vWT_P
]3<$1<$3<$\
$\04$24$04$
_3,$1,$3,$
[3,$1,$3,$
,$\3,$1,$3,$
~_@^3,$1,$3,$
^3<$1<$3<$\
14$34$\!
3,$1,$3,$\(
USER32.dll
ADVAPI32.dll
NTDLL.dll
H/.RJ 
uOB.Iz
%CU9X
\\.\SICE
\\.\SIWVID
\\.\NTICE
3Cannot write oreans.vxd
\Oreans.vxd
ADVAPI32.DLL
oreans32.sys
oreansx64.sys
\\.\oreans32
\\.\Global\oreans32
\\.\Global\oreansx64
%s\system32\drivers\%s
%s\syswow64\drivers\%s
%s\system32\drivers\oreans32.sys
3Cannot Update oreans.sys driver. Please, make sure that you have
3Cannot open oreans.vxd driver. Make sure that oreans.vxd
\\.\Oreans.vxd
%s\Oreans.vxd
contact info@oreans.com for this error
winmm.dll
Version = %s
CheckIN = %d
CheckOUT = %d
ProcIN = %d
ProcOUT = %d
ExitIN = %d
ExitOUT = %d
TPin = %d
HWIn = %d
IntV = %x, %x, %x, %x
E*.FqX
3An internal exception occured (Address: 0x%x)
Please, contact support@oreans.com. Thank you!
.YDYDe
bK12312.txt - Editor
-jEE<%sr
<9.EXEu
[c.BR
.YLQX
.YLQ,Q8
ce.KZ
%B%S/v
V*cpE%U\
f()0%Xnv
.text
`.rdata
@.data
>%use
>%com
OB.Iy
X$5.cb
cec.BR
%d/%d/%d
%s, %s, %s
WLRegDisableCurrentKey
WLRegExecutionsLeft
WLRegNormalKeyCheck
WLRegNormalKeyInstallToFile
WLRegNormalKeyInstallToRegistry
WLRegRemoveCurrentKey
WLRegSmartKeyCheck
WLRegSmartKeyInstallToFile
WLRegSmartKeyInstallToRegistry
WLRegTotalExecutions
WLTrialExecutionsLeft
WLTrialTotalExecutions
WLPasswordCheck
WLRegSmartKeyCheckW
WLRegSmartKeyInstallToFileW
WLRegSmartKeyInstallToRegistryW
WLRegNormalKeyCheckW
WLRegNormalKeyInstallToFileW
WLRegNormalKeyInstallToRegistryW
WLRegGetDynSmartKey
WLRegDisableKeyCurrentInstance
TC-H}
oc.BR
Qdec.BR
wC:\Dokumente und Einstellungen\Clara\Desktop\KEY REGDAT\KEYGEN  LICENSE SULTAN VERSION
FpETKgl.exe
3Cannot find '%s'. Please, re-install this application
ux%x1
j%u4i
ÞY8#
#%s "%u" "%s"
%s "%u" "%s" "%s"
sJYntdll.dll
!.fCH[i[
XH&.ja3X
.UB7\
D$%CXK
(!s.bj*aB
.fCHC
#]f.eF
%f]Fe(dl(c
!.fCHTS
@c-71}
v3Q%x]
V .xo
Iphlpapi.dll
ZwCreateKey
ZwOpenKey
ZwQueryValueKey
ZwSetValueKey
ZwDeleteKey
ZwEnumerateKey
ZwEnumerateValueKey
ZwQueryKey
RtlCreateRegistryKey
.WJ6Q
I.oXq
tEXEd
g.od/AQ
@.oa0D
@.oP n
.onMXEd
6k.KZ
G.oJ[
Z`.BR
oe.Bd
e.Pm0M<
.pe:_F
.peR!SB
.pe[j
.peZ9lz
#.oDe
.Bj&c
.oP ,
06b%F
.YLQ,]
]lB7.N-xl
pe.Bd
.aBG^
QqeT%x
$MXEXEd
toÞ
Y zuÞ
UrL(f
.QCy5PISq
|w.de
.de|E
%XSQjo
Þs>S>KZ
$Fk.KZ
*VEXEd
.jj&'R3
ceoJ6%x
.Ej7xA\M
frec.BR
5Latest Instance = 0x%X
Instance shadow1 = 0x%X
Instance shadow2 = 0x%X
a.aZX
%u"dj
zu%se
e.Pm0
\Registry\Machine\SOFTWARE\Classes\CLSID\{%8x-%4x-%4x-%4x-%8x}
\Registry\Machine\SOFTWARE\Classes\CLSID\%8x-%4x-%4x-%4x-%8x
\Registry\Machine\SOFTWARE\Classes\CcFWSettg.Category\CLSID\{%8x-%4x-%4x-%4x}
Category ID (M)
\Registry\Machine\SOFTWARE\Classes\CertificateAuthority.Request\CLSID
Certificate Number ()
Request ID (=%2s%3s-)
{%8x-%4x-%4x-%4x-%8x}
%8s-
Compression Type (%4sM%1s)
Seed}
RndSeed (%2s)
InitOrder()
InitOrder()
\Registry\Machine\SOFTWARE\Microsoft\Windows\Help
Guide]%1s.hlp
DBM%2s.hlp
%3s-%2s.hlp
\Registry\Machine\SOFTWARE\Classes\.%3s-%1s
Content Type (=)
Extension (%2s=)
TypeFile_%3s
%sE-q
C:\WLstatuslog.txt
5Log status saved into 'C:\WLstatuslog.txt'
.fCH[
,.BI<
V .xo?
.fCHC^
YT@a.eF
[T@a.eF
R'%Ta3n=V".fCHC^
.qddb
kf.eDKX
$.fCH
%S\8i6u
kd0q#.fCr
/0.yV
#Bs9<
.fCH(%o<
sl'%C
YX<o.jd-
.BjdG
@W!.fE
.fC-|
!.fCHC
Z.qdY
}S.vW
.xoK)
IKVe.mR
.fEwEw
.jc1p?T
%X,b)`
xC-H}
xIz[d,h:%.c
Úysleft
%execleft
%company
%custom
%totalexec
%us-expdate
%XMP9
F-x%xQ
.JWJO*[
.de]?BG>3
G.QD3
.YZ#f
%se3r
.XMf3r
dec.BR
n<J6%xQ
Amaevthxh.biv
[c.co
;EXEXQ
:c.RnY
.Jt!l=q
vewB.Iz[
.WJ6n
N-x%x1
live %u,%u
geti %u
Ws2_32.dll
%name - %company
-maevthxh.biv
SJ6%x
!J6%xQ
8c.BR
.YDYP
.G.md
%XMPY
D%9Xin
.RTA3%/
[wB.Iz
&fB.BB
DOB.Iy
DOB.Iz[xK|
G-x%xQ
ceT%x1
.Wen'R3
B.Iz[
-x%xQ~
.WJOV
_$Fk.KZ
deN-x%x1
AT wlÞ6i
.jidj
msvbvm60.dll
9.Uv*
ÿl3
2@|%9s
.ID4Tk
F:\CH
.text
Mozilla/
1;.NET C
LR 1.1.4
LORE.EX
SER32.dl
Clos@eKey
@MSVCRT
NEL32.dl
A%.aM
S.vtC
1106090710020423
keys
28C4C820-401A-101B-A3C9-08002B2F49FB
Make Factory Passwords
Save lic_pwds.txt
Make Site Keys
Save lic_keys.txt
Copy Selected Site Key
HTML Files (*.html)|*.html
Text Files (*.txt)|*.txt
Service Tool Serial Number;Engine Serial Number;ECM Serial Number;Total Tattletales;Reason;FLS;FTS;From Interlock;To Interlock;ECM Diagnostic Clock;Factory Password #1;Factory Password #2
Site Key :
lic_keys.txt
lic_pwds.txt
s%s, %s, %s

%original file name%.exe_452_rwx_00463000_00001000:




\linkinfo.dll

%original file name%.exe_452_rwx_10001000_00002000:




Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1;.NET CLR 1.1.4322)
Software\Microsoft\Windows\CurrentVersion\App Paths\IEXPLORE.EXE
USER32.dll
ole32.dll
RegCloseKey
RegOpenKeyExA
ADVAPI32.dll
MSVCRT.dll
KERNEL32.dll
YKWSteal.dll

svchost.exe_3776:




.text
`.data
.rsrc
@.reloc
msvcrt.dll
API-MS-Win-Core-ProcessThreads-L1-1-0.dll
KERNEL32.dll
NTDLL.DLL
API-MS-Win-Security-Base-L1-1-0.dll
API-MS-WIN-Service-Core-L1-1-0.dll
API-MS-WIN-Service-winsvc-L1-1-0.dll
RPCRT4.dll
ole32.dll
ntdll.dll
_amsg_exit
RegCloseKey
RegOpenKeyExW
GetProcessHeap
svchost.pdb
version="5.1.0.0"
name="Microsoft.Windows.Services.SvcHost"
<description>Host Process for Windows Services</description>
<requestedExecutionLevel
Software\Microsoft\Windows NT\CurrentVersion\Svchost
Software\Microsoft\Windows NT\CurrentVersion\MgdSvchost
\PIPE\
Host Process for Windows Services
6.1.7600.16385 (win7_rtm.090713-1255)
svchost.exe
Windows
Operating System
6.1.7600.16385

WerFault.exe_2716:




.text
`.data
.rsrc
@.reloc
ADVAPI32.dll
ntdll.DLL
KERNEL32.dll
USER32.dll
msvcrt.dll
ole32.dll
OLEAUT32.dll
SHLWAPI.dll
IMM32.dll
wer.dll
COMCTL32.dll
faultrep.dll
Starting kernel vertical - %S
rundll32.exe
NtQueryInformationProcess failed with status: 0x%x
Reporting never started for process id %u
StringCchPrintf failed with 0x%x
NtWow64QueryInformationProcess64 failed with 0x%x
NtWow64ReadVirtualMemory64 failed with 0x%x
NtQueryInformationProcess failed with status 0x%x
WerpNtWow64QueryInformationProcess64 failed with status 0x%x
StringCchCopy failed with 0x%x
Invalid arg in %s
wdi.dll
dbgeng.dll
dbghelp.dll
SETUPAPI.dll
SHELL32.dll
VERSION.dll
WTSAPI32.dll
WerFault.pdb
PSShD
tSSh,<
t.PSj6
t5SSh
SShx`
tsShxc
t.Ph0j
_amsg_exit
RegCloseKey
RegCreateKeyExW
RegOpenKeyExW
RegEnumKeyExW
RegQueryInfoKeyW
GetProcessHeap
GetWindowsDirectoryW
RegDeleteKeyW
ReportEventW
RegOpenKeyW
RegSetKeyValueW
GetProcessWindowStation
EnumWindows
NtAlpcSendWaitReceivePort
NtAlpcConnectPort
ShipAssert
ntdll.dll
RegisterErrorReportingDialog
WerReportSubmit
WerReportAddFile
WerReportCreate
WerReportCloseHandle
WerReportSetUIOption
WerpGetReportConsent
WerpSetIntegratorReportId
WerpReportCancel
WerpAddRegisteredDataToReport
WerReportAddDump
WerpCreateIntegratorReportId
WerpSetReportFlags
WerpGetReportFlags
WerpIsTransportAvailable
WerReportSetParameter
WerpInitiateCrashReporting
version="1.0.0.0"
name="Microsoft.Windows.Feedback.Watson"
name="Microsoft.Windows.Common-Controls"
version="6.0.0.0"
publicKeyToken="6595b64144ccf1df"
<asmv3:windowsSettings xmlns="hXXp://schemas.microsoft.com/SMI/2005/WindowsSettings">
</asmv3:windowsSettings>
<requestedExecutionLevel
ÝCD0
#$$$3355<
##$$$335566
% "#$$$3355666=
"#$$33555666
!.DQ$
.Py>o
Kÿg
.ib:?
T3%X_
a,M.cbd
KEYW8
KEYWH
? ?$?(?,?0?4?8?
1 2$2(2,20242
>,?0?4?8?<?@?
?%?5?:?|?
5'565^5{5
3#3(353_3
=#='= =/=3=7=;=?=
=#=(=>=]=
>!>&>3>}>
1!1&131[1
Microsoft\Windows\WindowsErrorReporting\WerFault
%s %s
Global\WerKernelVerticalReporting
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\CrashControl
CrashDumpEnabled.Old
CrashDumpEnabled.New
%SystemRoot%\MEMORY.DMP
LiveKernelReports
Software\Microsoft\Windows\Windows Error Reporting\LiveKernelReports
LiveKernelReportsPath
BCCode=%x&BCP1=%p&BCP2=%p&BCP3=%p&BCP4=%p&OS Version=%u_%u_%u&Service Pack=%u_%u&Product=%u_%u
*WerKernelReporting
%SYSTEMROOT%\SYSTEM32\WerFault.exe -k -rq
SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
SOFTWARE\Microsoft\Windows\Windows Error Reporting\KernelFaults\Queue
sysdata.xml
%s -k -q
SOFTWARE\Microsoft\Windows NT\CurrentVersion
<OSVER>%u.%u.%u %u.%u</OSVER>
<OSLANGUAGE>%u</OSLANGUAGE>
<ARCHITECTURE>%u</ARCHITECTURE>
<PRODUCTTYPE>%u</PRODUCTTYPE>
<FILESIZE>%u</FILESIZE>
<CREATIONDATE>d-d-d d:d:d</CREATIONDATE>
<NAME>%s</NAME>
<DATA>%s</DATA>
<ERROR>Failed at Step: %s with error 0x%x</ERROR>
%sDrivers\%s.sys
</%s>
<%s>%s</%s>
%u.%u.%u.%u
*.mrk
WER-%u-%u.sysdata.xml
Software\Microsoft\Windows\CurrentVersion\CEIPRole\RolesInWER
SOFTWARE\Microsoft\Windows\CurrentVersion\Reliability\MemoryDiagnostic
Web Server
Software\Microsoft\Windows\Windows Error Reporting\Debug
%SystemRoot%\Minidump
0xx (0xx, 0xx, 0xx, 0xx)
%s\%2.2d%2.2d%2.2d-%u-%2.2d.dmp
*.dmp
Software\Microsoft\Windows\Windows Error Reporting
Software\Policies\Microsoft\Windows\Windows Error Reporting
\KernelObjects\SystemErrorPortReady
%s\%s
Microsoft.Windows.Setup
\WindowsErrorReportingServicePort
(0x%x): %s
%u %s
WindowsNTVersion
%u.%u
ErrorPort
\StringFileInfo\xx\%s
HKEY_USERS\
HKEY_CURRENT_CONFIG\
HKEY_CLASSES_ROOT\
HKEY_LOCAL_MACHINE\
HKEY_CURRENT_USER\
%s="%s"
%s.%s
%s %d
Software\Microsoft\Windows\Windows Error Reporting\Hangs
_NT_EXECUTABLE_IMAGE_PATH
wxmu.dmp
wxhu.dmp
axmu.dmp
axhu.dmp
hu.kdmp
mu.kdmp
hu.dmp
mu.dmp
Software\Microsoft\.NETFramework
NOT_TCPIP
sos.dll
version.xml
.version.xml
%s.xml
memory.hdmp
minidump.mdmp
Local\WERReportingForProcess%d
atk.kdmp
Software\Microsoft\Windows\Windows Error Reporting\Hangs\NHRTimes
%i|%d|%d
xxxxxxxxxxxxxxxx
xx
%d.%d.%d.%d
D:P(A;;GA;;;BA)(A;;GA;;;SY)(A;;GA;;;%s)
D:P(A;;GA;;;BA)(A;;GA;;;SY)(A;;GA;;;%s)S:(ML;;NR;;;HI)
dc.noreflect
dc.xpmemdump
dc.xpdata
dc.CustomDump
dc.expmodmem
dc.expmoddata
dc.OnDemandKdmp
dc.xpmodmem
dc.xpmoddata
default=%s
memory=%s
module=%s
.dbgcfg.ini
ElevatedDataCollectionStatus.txt
Open process failed unexpectedly: 0X%X
Attempting to cross-proc reporting process!
Elevation:Administrator!new:%s
Reflection attempt failed: 0X%X
Attempting to reflect reporting process!
Could not collect dump for reflection cross process: 0x%x
Could not collect xproc for reflection: 0x%x
CollectFile for reflection failed: 0x%x
Could not collect dump for cross process: 0x%x
CollectReflectionDump failed with: 0x%x
0 processes found for xproc module: %s
Could not collect cross dump from module: 0x%x
CollectCrossProcessModuleDumps failed: 0x%x
CollectCrossProcessDumps failed: 0x%x
KernelDump failed: 0x%x
ProcessHandle
%s|%s
rpcrt4
\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AeDebugProtected\AutoExclusionList
\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AeDebug\AutoExclusionList
\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AeDebugProtected
\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AeDebug
sntdll.dll
WerDiagController.dll
Software\Microsoft\Windows\Windows Error Reporting\Plugins
Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers
Software\Microsoft\Windows\Windows Error Reporting\Plugins\FDR\CurrentSession
%s\%s\%u-%u.etl
%s\%s\%u-%u.etl_%d
Microsoft\Windows\FDR
%s-%d
Software\Microsoft\Windows\Windows Error Reporting\Plugins\DriverVerifier
Software\Microsoft\Windows\Windows Error Reporting\Plugins\AppRecorder
%d-AppRecorderEnabled
%s /stop
psr.exe
Software\Microsoft\Windows\Windows Error Reporting\RuntimeExceptionHelperModules
verifier.dll
nVerifier.dll
Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\%s
Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
lsvchost.exe
"%s" "%s" "%s"
%s\system32\cofire.exe
psapi.dll
sfc_os.dll
werfault.exe
%s\%s-(PID-%u)-%u
%s\%s-(PID-%u).dmp
%s\*-(PID-*)-*
SOFTWARE\Microsoft\Windows NT\CurrentVersion\SilentProcessExit\%s
SOFTWARE\Microsoft\Windows NT\CurrentVersion\SilentProcessExit
kernel32.dll
kernelbase.dll
ReportingMode
WinShipAssert
WindowsMessageReportingB1
Windows
ws2_32.dll
Software\Microsoft\SQMClient\%s\AdaptiveSqm\ManifestInfo
%s\Sqm%d.bin
CorporateWerPortNumber
BypassDataThrottling
Software\Microsoft\Windows\Windows Error Reporting\Consent
Windows Problem Reporting
6.1.7600.16385 (win7_rtm.090713-1255)
WerFault.exe
Windows
Operating System
6.1.7600.16385
Microsoft-Windows-WER-Diag/Operational

Explorer.EXE_284_rwx_10000000_00004000:




.text
.reloc
Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1;.NET CLR 1.1.4322)
Software\Microsoft\Windows\CurrentVersion\App Paths\IEXPLORE.EXE
USER32.dll
ole32.dll
RegCloseKey
RegOpenKeyExA
ADVAPI32.dll
MSVCRT.dll
KERNEL32.dll
YKWSteal.dll






Remove it with Ad-Aware




    

  1. Click (here) to download and install Ad-Aware Free Antivirus.
    2. 

  2. Update the definition files.
    3. 

  3. Run a full scan of your computer.
    4. 





Manual removal*




    

  1. Terminate malicious process(es) (How to End a Process With the Task Manager):No processes have been created.
    2. 

  2. Delete the original Trojan file.
    3. 

  3. Delete or disinfect the following files created/modified by the Trojan:
    

    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\1310330.dll (21 bytes)
    

    4. 

  4. Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
    5. 

  5. Reboot the computer.
    6. 



*Manual removal may cause unexpected system behaviour and should be performed at your own risk.












 
 




 
No votes yet












				


							


			

				
					  
							

		

		


					
							

	

	
	        


	

        
      
 

      
      

      
    
 

    
  
 

		


		

		
			

			

				

					Lavasoft is the maker of Ad-Aware,
					the world's most popular anti-malware 
					software with over 450 million 
					downloads.
				

				

					© 2025 Lavasoft. All rights reserved.

					Terms Of Use |   Privacy Policy
					


								

			


		

		


	

	
	

	

		x
		
Our best antivirus yet!

		
Fresh new look. Faster scanning. Better protection.

		

			
Enjoy unique new features, lightning fast scans and a simple yet beautiful new look in our best antivirus yet!

			
For a quicker, lighter and more secure experience, download the all new adaware antivirus 12 now!

			
			Download adaware antivirus 12
		

		No thanks, continue to lavasoft.com
	

	

		

			close x
			
Discover the new adaware antivirus 12

			
Our best antivirus yet

			Download Now