MD5: 68819428cb45a54fc083591f38328631
SHA1: a01405b8ac461e9eb0eca81c67354d84cfc0a742
SHA256: 38e1d257ab16f06b65265cfaf3d2ed2623e4617e6acc14f9ceaceb495daa01d1
SSDeep: 393216:tOD0vI6NV Vt5ZWLXIkpes8b1EUseccChoIAIzKjMs:eX6rArZWskpeH c57asMs
Size: 14402777 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: UPolyXv05_v6
Company: no certificate found
Created at: 2015-02-15 10:00:31
Analyzed on: WindowsXP SP3 32-bit

Summary:

Backdoor. Malware that enables a remote control of victim's machine.

Payload

No specific payload has been found.

Process activity

The Backdoor creates the following process(es):

setup_wm.exe:2000
kop.exe:1856
wmplayer.exe:1936
MegaHack.EXE:216
MegaHack.EXE:1492
MegaHack.EXE:1140
kophack.exe:1752
.Net_Framework.exe:1136
.Net_Framework.exe:376
Clear.exe:1316
%original file name%.exe:856
KopaT.exe:320

The Backdoor injects its code into the following process(es):

csrss.exe:1820

Mutexes

The following mutexes were created/opened:
No objects were found.

File activity

The process kop.exe:1856 makes changes in the file system.
The Backdoor creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Application Data\Microsoft\Windows\License\.Net_Framework.exe (9134 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\Windows\License\MegaHack.EXE (38184 bytes)

The Backdoor deletes the following file(s):

%Documents and Settings%\%current user%\Application Data\Microsoft\Windows\License\__tmp_rar_sfx_access_check_473140 (0 bytes)

The process MegaHack.EXE:216 makes changes in the file system.
The Backdoor creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\cetrainers\CET1.tmp\extracted\speedhack-i386.dll (275 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\cetrainers\CET1.tmp\extracted\lua5.1-32.dll (563 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\cetrainers\CET1.tmp\extracted\CET_TRAINER.CETRAINER (5237 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\cetrainers\CET1.tmp\extracted\MegaHack.EXE (45699 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\cetrainers\CET1.tmp\extracted\defines.lua (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\cetrainers\CET1.tmp\extracted\win32\dbghelp.dll (4438 bytes)

The process MegaHack.EXE:1492 makes changes in the file system.
The Backdoor creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\cetrainers\CET1.tmp\CET_Archive.dat (31790 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\cetrainers\CET1.tmp\MegaHack.EXE (192 bytes)

The Backdoor deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\cetrainers\CET1.tmp (0 bytes)

The process kophack.exe:1752 makes changes in the file system.
The Backdoor creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Application Data\Microsoft\Windows\License\Clear.exe (2961 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\Windows\License\vagner.mp3 (63989 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\Windows\License\starter.cmd (226 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\Windows\License\kop.exe (43201 bytes)

The Backdoor deletes the following file(s):

%Documents and Settings%\%current user%\Application Data\Microsoft\Windows\License\__tmp_rar_sfx_access_check_471500 (0 bytes)

The process .Net_Framework.exe:1136 makes changes in the file system.
The Backdoor creates and/or writes to the following file(s):

%WinDir%\csrss.exe (7433 bytes)

The process Clear.exe:1316 makes changes in the file system.
The Backdoor creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Application Data\Windows.bat (78 bytes)

The Backdoor deletes the following file(s):

%Documents and Settings%\%current user%\Application Data\__tmp_rar_sfx_access_check_472796 (0 bytes)

The process %original file name%.exe:856 makes changes in the file system.
The Backdoor creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Application Data\Microsoft\Windows\License\KopaT.exe (109736 bytes)

The Backdoor deletes the following file(s):

%Documents and Settings%\%current user%\Application Data\Microsoft\Windows\License\__tmp_rar_sfx_access_check_469000 (0 bytes)

The process KopaT.exe:320 makes changes in the file system.
The Backdoor creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\$inst\2.tmp (68 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\Windows\License\kophack.exe (228743 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\$inst\temp_0.tmp (47091 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\$inst\0001.tmp (28666 bytes)

The Backdoor deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\$inst (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\$inst\2.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\$inst\temp_0.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\$inst\0001.tmp (0 bytes)

Registry activity

The process setup_wm.exe:2000 makes changes in the system registry.
The Backdoor creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "24 AA 49 06 E5 2D DF 92 89 F5 20 37 C4 FF 8E C1"

[HKLM\SOFTWARE\Microsoft\MediaPlayer]
"MP2.SaveDir" = "%Program Files%\Windows Media Player"

[HKCU\Software\Microsoft\ActiveMovie\devenum\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device]
"FriendlyName" = "Default DirectSound Device"

[HKCU\Software\Microsoft\Multimedia\ActiveMovie\Filter Cache]
"0" = "E0 5A 00 00 65 68 63 66 00 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\ActiveMovie\devenum\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device]
"DSGuid" = "{00000000-0000-0000-0000-000000000000}"
"FilterData" = "02 00 00 00 00 00 80 00 01 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\ActiveMovie\devenum\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device]
"FilterData" = "02 00 00 00 00 00 80 00 01 00 00 00 00 00 00 00"
"CLSID" = "{07B65360-C445-11CE-AFDE-00AA006C14F4}"

[HKCU\Software\Microsoft\ActiveMovie\devenum\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device]
"CLSID" = "{79376820-07D0-11CF-A24D-0020AFD79767}"

[HKCU\Software\Microsoft\ActiveMovie\devenum\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device]
"FriendlyName" = "Default MidiOut Device"
"MidiOutId" = "4294967295"

The Backdoor deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Multimedia\ActiveMovie\Filter Cache]
"1"

The process kop.exe:1856 makes changes in the system registry.
The Backdoor creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "8A 26 69 3D 3F 7E C0 BE 39 46 47 F8 E8 C2 3E 7E"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%Documents and Settings%\%current user%\Application Data\Microsoft\Windows\License]
".Net_Framework.exe" = ".Net_Framework"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%Documents and Settings%\%current user%\Application Data\Microsoft\Windows\License]
"MegaHack.EXE" = "MegaHack"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

The Backdoor modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Backdoor modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

"UNCAsIntranet" = "1"

The Backdoor modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

The process wmplayer.exe:1936 makes changes in the system registry.
The Backdoor creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "35 D8 1A ED E5 6F 54 CB EB 6F 05 D2 33 08 A0 87"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%Program Files%\Windows Media Player]
"setup_wm.exe" = "Microsoft Windows Media Configuration Utility"

The Backdoor modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass" = "1"

The Backdoor modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

"UNCAsIntranet" = "1"

The Backdoor modifies IE settings for security zones to map all urls to the Intranet Zone:

"IntranetName" = "1"

The process MegaHack.EXE:216 makes changes in the system registry.
The Backdoor creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "BB 65 45 4D 41 D3 0B 1B 2A D5 10 57 22 19 6F F5"

The process MegaHack.EXE:1140 makes changes in the system registry.
The Backdoor creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "82 A4 2B 0C 44 EC C8 31 F3 45 05 5A 61 F6 57 5B"

The process kophack.exe:1752 makes changes in the system registry.
The Backdoor creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "EE 71 57 6F 93 D6 B1 D1 09 45 9D 0F 47 2F 33 7D"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%Program Files%\Windows Media Player]
"wmplayer.exe" = "Windows Media Player"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%Documents and Settings%\%current user%\Application Data\Microsoft\Windows\License]
"starter.cmd" = "starter"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%Documents and Settings%\%current user%\Application Data\Microsoft\Windows\License]
"clear.exe" = "Clear"

The Backdoor modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Backdoor modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

"UNCAsIntranet" = "1"

The Backdoor modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

The process .Net_Framework.exe:1136 makes changes in the system registry.
The Backdoor creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "EC 49 1A C2 3C 64 31 3C C1 96 FF E7 BD 16 1F 83"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%WinDir%]
"csrss.exe" = "csrss"

To automatically run itself each time Windows is booted, the Backdoor adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"WindowsNT" = "C:\Windows\csrss.exe"

The Backdoor adds the reference to itself to be executed when a user logs on:

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"UserInit" = "%System%\userinit.exe,C:\Windows\csrss.exe"

The Backdoor modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass" = "1"

The Backdoor modifies IE settings for security zones to map all urls to the Intranet Zone:

"IntranetName" = "1"

The Backdoor modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

"UNCAsIntranet" = "1"

The process .Net_Framework.exe:376 makes changes in the system registry.
The Backdoor creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "C9 A6 58 79 E9 1E 09 BD DF CF 5F 42 BF 32 F4 8A"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

The process Clear.exe:1316 makes changes in the system registry.
The Backdoor creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "AE B2 70 91 A4 1F 91 C2 D3 E5 B1 2F BF CE BE 03"

The process %original file name%.exe:856 makes changes in the system registry.
The Backdoor creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "1C 42 51 17 82 C5 9E 05 0E 42 C0 09 51 5A 7C 71"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%Documents and Settings%\%current user%\Application Data\Microsoft\Windows\License]
"KopaT.exe" = "Kopatel Hack 2016 2.16 Installation"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

The Backdoor modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Backdoor modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

"UNCAsIntranet" = "1"

The Backdoor modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

The process KopaT.exe:320 makes changes in the system registry.
The Backdoor creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Kopatel Hack 2016 2.16]
"NoModify" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Kopatel Hack 2016 2.16]
"Language" = "1049"
"VersionMajor" = "2"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%Documents and Settings%\%current user%\Application Data\Microsoft\Windows\License]
"kophack.exe" = "kophack"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Kopatel Hack 2016 2.16]
"VersionMinor" = "16"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Kopatel Hack 2016 2.16]
"InstallLocation" = "%Documents and Settings%\%current user%\Application Data\Microsoft\Windows\License\"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Kopatel Hack 2016 2.16]
"EstimatedSize" = "13822"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Kopatel Hack 2016 2.16]
"NoRepair" = "1"
"InstallSource" = "%Documents and Settings%\%current user%\Application Data\Microsoft\Windows\License\"

"InstallDate" = "20160220"
"DisplayName" = "Kopatel Hack 2016 2.16"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "E5 BD E0 82 CD A1 74 BF 8F B8 94 AD BC 30 EA 92"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Kopatel Hack 2016 2.16]
"Publisher" = "Eureka"
"DisplayIcon" = "%Documents and Settings%\%current user%\Application Data\Microsoft\Windows\License\Uninstall.exe"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Kopatel Hack 2016 2.16]
"DisplayVersion" = "2.16"
"UninstallString" = "%Documents and Settings%\%current user%\Application Data\Microsoft\Windows\License\Uninstall.exe"

The Backdoor modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Backdoor modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

The Backdoor modifies IE settings for security zones to map all urls to the Intranet Zone:

"IntranetName" = "1"

Dropped PE files

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

VersionInfo

No information is available.

PE Sections

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

URLs

No activity has been detected.

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

Web Traffic was not found.

The Backdoor connects to the servers at the folowing location(s):

.text

`.data

.rsrc

msvcrt.dll

ADVAPI32.dll

KERNEL32.dll

NTDLL.DLL

GDI32.dll

USER32.dll

ole32.dll

COMCTL32.dll

SHELL32.dll

WININET.dll

SETUPAPI.dll

WINTRUST.dll

WSOCK32.dll

ws2_32.DLL

MPR.dll

urlmon.dll

SHLWAPI.dll

OLEAUT32.dll

VERSION.dll

9.00.00.4503

Attempt to copy mpsetup.exe to system for migration purposes returned: '0x%x'.

eula.txt

Finished building install list. Result: '0x%x'.

Download complete. Result: '0x%x'.

Could not set system restore end point: error 0x%x.

Setup complete. Result: '0x%x'.

ERROR: Could not set system restore point: error 0x%x.

System restore is not supported on this system.

Installed %S

=====Installing Install list. Last result: 0x%x.

CreateEvent For ExitSyncEvent failed. LastError: '0x%x'.

msctls_hotkey32

ShellExecuteExW

GetSystemWindowsDirectoryW

control.xml

Component '%S' can not be installed: file '%S' not found.

Component '%S' can not be installed: No install package available.

XML Parser: Found value '%S' for attribute '%S'.

Reg Parser: Obtained value '%S' for attribute '%S'.

Adding dependency type '%S' to registry.

Package clean-up: Cleaning up files at '%S'.

ERROR: Package download failure for '%S'. Result: 0x%x.

ERROR: Package download failure has occured. Result: 0x%x.

Removing component database for '%S'.

ERROR: Unable to obtain base URL for UDB file. Result: '0x%x'.

UDBBaseURL

ERROR: XML Parser: Failed to add dependency information from XML. Last result: 0x%x.

XML Parser: No data available for Dependency attribute '%S'.

ERROR: XML Parser: Could not set Dependency attribute '%S'.

ERROR: XML Parser: Missing required Dependency attribute '%S'.

ERROR: Reg Parser: Failed to add dependency information from reg. Result: 0x%x.

ERROR: Reg Parser: Missing required Dependency attribute '%S'.

Reg parser: Adding dependency '%S'.

WARNING: Base URL is not set. All packages must be available locally.

ERROR: Cab extraction failed for '%S'. Error 0x%x.

Cab extraction succeeded for '%S'.

Package install complete. Last result 0x%x.

ERROR: Install for package was halted. RunDll32.exe was not found on the system.

ERROR: XML Parser: Failed to add package information from XML. Result: 0x%x.

ERROR: XML Parser: No install available locally, URL not provided.

ERROR: XML Parser: Missing required Package attribute '%S'.

Created instance of download manager. Now converting URL to ANSI.

DownloadFileFromURL: We '%hs' force a connection.

ERROR: UDB file not downloaded. Result: '0x%x'.

ERROR: Reg Parser: Failed to add uninstall information from reg. Last result: 0x%x.

ERROR: Setup missing uninstall file: '%S'.

ERROR: Reg Parser: Missing required Package attribute '%S'.

Beginning download of component '%S'.

A download will be required for component '%S' from URL '%S'.

ERROR: Component '%S' is NOT available for install.

Component '%S' may be installable from URL: '%S'.

ERROR: XML Parser: Failed to add component from XML. Result: 0x%x.

ERROR: XML Parser: Missing required component attribute '%S'.

ERROR: Reg Parser: Failed to add component from reg. Result: 0x%x.

ERROR: Reg Parser: Missing required component attribute '%S'.

Package '%S' is version '%S'. This is '%S' than the version currently installed.

Warning: Base URL not defined in XML.

XML Parser: Parsing Element '%S'.

Install for component '%S' was halted. Ran out of disk space. Needed at least %lu kbytes more.

Install for component '%S' was halted. A required component was not available.

Install for component '%S' was halted. Component is not available for install.

Install for component '%S' was halted. It was deemed already installed.

======Installing component '%S'.

ERROR: Attempted to install '%S' which had been marked as noninstallable.

SUCCESS: Package '%S'. Result: 0x%x.

ERROR: Package '%S'. Result: 0x%x.

WinVerifyTrust on file '%S' returned 0x%x.

GetDiskFreeSpaceEx failed. Error: '%x'

ERROR: Could not create directory '%S'. Error: '0x%x'.

Reboot requested due to '%S' file clean-up.

Reboot required due to '%S' driver installation.

Reboot requested due to '%S' file copy.

ERROR: Could not store delayed action for component '%S': '0x%x'.

ERROR: Process '%S' deadlocked. Terminated after '%lu'ms.

ERROR: Process '%S' failed. Error: '0x%x'.

Starting process '%S'.

ERROR: Application '%S' not found. Process could not be executed.

PendingFileRenameOperations

\wininit.ini

ERROR: OLE Initialization failed: '0x%x'.

ERROR: Could not set AllowProtectedRename flag for SFP. Error: 0x%x

ERROR: Decryption failed for file '%S'. Last result: 0x%x.

File replacement for '%S' queued in non-admin file cache.

ERROR: Could not store delayed file move for '%S': '0x%x'.

Dll UnRegistration: Could not find file '%S'.

ERROR: Dll Registration: Could not find file '%S': '0x%x'.

Dll Registration: Succeeded for file '%S'.

Delayed Dll Registration: Succeeded for file '%S'.

ERROR: Dll Registration: Failed for file '%S': '0x%x'.

ERROR: Failed delaying dll registration for file '%S': '0x%x'.

Registering DLL: '%S'.

%S=%S

WARNING: MoveFileEx failed for file '%S'. Error: '0x%x'.

WARNING: Reboot required due to file '%S'.

ERROR: Bad file destination '%S'.

Moved file '%S' to temp location for clean-up upon reboot.

ERROR: Replace file in place failed for '%S'. File still exists.

ERROR: ReplaceFileOnReboot: Could not move file '%S' to '%S'. Error 0x%x.

Copied file '%S' to DllCache.

WMC_CopyFile: File '%S' is newer than the installed version. This file will be installed.

WMC_CopyFile: File '%S' is newer than the version to be installed. No copy will occur.

ERROR: WMC_CopyFile: Could not find file version for '%S'. This file will not be copied.

WMC_CopyFile: Could not find file version for '%S'. This file will be overwritten.

WMC_CopyFile: Could not replace file '%S'. This file will be replaced on reboot.

WMC_CopyFile: File '%S' should always to be installed. This file will be installed.

WMC_CopyFile: File '%S' is not to be installed if already present on the system. It was present and thus will not be reinstalled.

WMC_CopyFile: File '%S' was only to be installed if already present on the system. It was not present and thus will not be installed.

ERROR: WMC_CopyFile: Could not find source file '%S'. Error: '0x%x'.

ERROR: Could not connect to SFP server. 0x%x

MbP?OS is %s. OSVer is %S. Setup version %s.]

Stopping service '%S' %S.

Stopping service '%S'.

ERROR: %S, 2-queryservicestatus

Starting service '%S' %S.

ERROR: %S, timed out

ERROR: %S, 1-queryservicestatus

ERROR: Failed to start service: '%S'. Result: 0x%x.

ERROR: Failed to open service: '%S'. Result: 0x%x.

ERROR: Failed to open SCM: '%S'. Result: 0x%x.

Now starting service: '%S'.

InfParser: Set source directory '%S'.

ERROR: Unsupported use of UpdateIni: '%S'.

Could not decode INF key name:'%S'

ERROR: Registry transaction failure for: '%S'.

Processed %S line: '%S', result 0x%x.

ERROR: Registry key change failed: lRes = 0x%x.

GetNameForCatalogOnSystem returned '0x%x'.

Another version of catalog file '%S' was previously installed.

INF: Found section '%S'.

@INF: Line '%S' not found in section: '%S'. Result: 0x%x.

Parsing Reg section:'%S'.

Processed UpdateIni line: '%S'.

Parsing UpdateIni section:'%S'.

INF: INF requested error override for '%S'.

Parsing StopServices section:'%S'.

Parsing StartServices section:'%S'.

FireNamedEvent : OpenEvent returned 0x%x.

FireNamedEvent : SetEvent returned 0x%x.

Firing event: '%S'.

ERROR: Could not set CustomDestination '%S'. Result: 0x%x.

ERROR: Could not set CustomDestination '%lu'. Result: 0x%x.

Added CustomDestination '%lu' as '%S'.

ERROR: CustomDestination '%S' not settable: LDIDs require 8 characters previous to '=' due to setupapi.

Assigned destination: '%S' for section '%S'

Parsing CustomDestination INFSection:'%S'

Attempted to delete: '%S'.

Parsing DelDirs section:'%S'.

ERROR: ProcessSetupCommand failed for: '%S': 0x%x.

Success: Ran command: '%S'.

Parsing RunCommands section: '%S'.

Parsing RegisterOCX INFSection:'%S'.

SUCCESS: GetInstallSizeEstimate for '%S': size: '%lu'.

FAILED: GetInstallSizeEstimate for '%S': Result: 0x%x.

ERROR: Could not find file '%S' for INF '%S'.

GetInstallSizeEstimate for '%S': size: '%lu'.

Parsing INFSection:'%S'.

Current directory is: '%S'.

Trust on catalog '%S' complete. Result: 0x%x.

ERROR: Could not add catalog '%S'. Result: 0x%x. 0x%x

Added catalog '%S' unappended. Last result: 0x%x.

System.Cat

Adding catalog '%S'...

%s\old%s

GetNameForCatalogOnSystem returned '%S'.

ERROR: Trust on catalog '%S' failed. Could not load SFC Lib. Last result: 0x%x.

ERROR: Could not add catalog '%S'. Result: 0x%x.

Added catalog '%S'. Last result: 0x%x.

ERROR: Trust on catalog '%S' failed. Could not load Crypto Lib. Last result: 0x%x.

ERROR: Trust on catalog '%S' failed. Error: 0x%x.

Trust on catalog '%S' beginning. Last result: 0x%x.

TrustCatalogFile returned 0x%x.

Trusting Catalog: '%S'.

ERROR: Failed to assign destination for: '%S'.

Deleted file '%S'.

ERROR: Could not delete '%S': 0x%x.

Copied file '%S' to '%S'.

ERROR: Could not find file '%S' at source '%S' for dest '%S': 0x%x.

Assigned destination: '%S' to '%S'.

Parsing '%S' INFSection:'%S'

Source location is:'%S'.

ERROR: INF parser failed on: '%S'. Result: 0x%x.

ERROR: Failed to open INF: '%S'. Result: 0x%x.

INF: Error '0x%x' reported for '%S'. Honoring INF error override and continuing.

ERROR: Invalid arguments passed to AddDirectoryToList.

ERROR: Could not start download. Result: '0x%x'.

ERROR: WriteFile failed. Result: '0x%x'.

ERROR: InternetReadFile failed. Result: '0x%x'.

Could not determine download size for URL.

ERROR: Could not open URL: '0x%x'.

ERROR: Could not obtain connection result: '0x%x'.

ERROR: Could not open URL. Result: '0x%x'.

ERROR: HTTPSendRequest failed. Result: '0x%x'.

Download manager now connecting to URL.

ERROR: Could not open request: '0x%x'.

ERROR: Could not connect to host: '0x%x'.

ERROR: Could not crack URL: '0x%x'.

127.0.0.1

InternetDial returned: '0x%x'.

InternetAutoDial returned: '0x%x' for connection '%lu'.

InternetDial returned: '0x%x' for connection '%lu'.

InternetHangup returned: '0x%x' for connection '%lu'.

Lxhttp\shell\open\command

ERROR: Initialization of CWMXDownload failed. Result: '0x%x'.

%S:%u

HttpQueryInfoA

HttpSendRequestA

HttpOpenRequestA

InternetCrackUrlA

InternetOpenUrlA

wsock32.dll

ntdll.dll

WMCheckURLScheme

\\.\VWIN32

setup_wm.pdb

PSWSSSh

PSShP 

C.PVV

vLSSh

PSSSSSSh

Ht.Hut

SSSSh

t.SjB

WSSSh

SSSh|

PSSSSSSSSh

_acmdln

RegCloseKey

comdlg32.dll

WINSPOOL.DRV

ShellExecuteExA

ShellExecuteA

ShellExecuteW

WINMM.dll

AVIFIL32.dll

InternetCrackUrlW

oledlg.dll

UrlMkSetSessionOption

RegCreateKeyExA

RegCreateKeyExW

RegDeleteKeyA

RegDeleteKeyW

RegOpenKeyExA

RegOpenKeyExW

RegQueryInfoKeyA

RegQueryInfoKeyW

RegEnumKeyExA

RegEnumKeyExW

GetWindowsDirectoryA

GetWindowsDirectoryW

GetProcessHeap

MsgWaitForMultipleObjects

WMVCore.DLL

wmsetup.log

#'%UUUUUUU

#B%UUUUUUUUUQyy

""%UUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUU

"%UUUUUUUUUUUUUUUUUUUUUU

*) ....122226111

*) ..5562:654..00

 & ) ,222

 )..,22:17

,)556:657:2

version="9.0.0.0"

name="Microsoft.Windows.Setup_nu"

<description>Windows Media Player Setup</description>

name="Microsoft.Windows.Common-Controls"

version="6.0.0.0"

publicKeyToken="6595b64144ccf1df"

g&bccc&%%®fgjgeË&&&b&bcd

re%&Ì&&faegk&d_c^^^^^^``$%

, *))))**,

\ddcd%%Ì%%c%%d%dÛ%Ë%c¼cbÌdÌcd

))))****    *,

))))***   ,, ,

)))***    ,,, 

))***   ,,

))***  ,,

)***  ,,

 )**  ,,

  ,,-..//

))))*** 

5555555555

-*))) ,,

cccdcd%%Ì%%c%%d%dÛ%Ë%c¼cbÌdÌcdccccccK

,;;@@@;;@;@;<@<<<@@<;;<;;;;<@;<;<;;<<<;;<<;;<;;;@

,,  ,,,, ,

  Kccdcd%%Ì%%c%%d%dÛ%Ë%c¼cbÌdÌcW>K

4;@;@;<@<<<@@<;;<;;;;<@;<;<;;<<<;;<<;3>

ooooooooooooooooooooooooolnlnljnjllojlnlnllolonllolonllnllnnolnnonoooololnnnmnglnnllmjlgmljmmllnmmlnmmnnlmmmlnnllnlnnnmlmlmnnlmmmmmgmgmgggmmknnmmmmmnmmnmmmmmllljljmjlmmnmmmmmnmnmkknmmmkmmmmmgmmmmmkmmmmmmnmkmmmkgkmmmmmnmmmmmmggmmggmmhgggkgjggjgjmjjggmmgmgmgkmgmmkmmggmmmmkmmkmkmmmmmmgkmgmmmgkhmkkkkhkkkkhmkmhkkkkkgkmmmkkkkkmkkhhkhkhhhkhhhkhkgghkkgkgkkkhkkkkhhhhkkkhkhhkkkkkkkkkkkkkkkkkhhkkkkkkkkkhkhhhkkhhhhkkhkkhhhhkkhkhhkhkhkhkhehkhkhkeieeeeeeeieeekeeeeeheeeeeekhhkhhkhhkhhkmjmlmljjjmlnmnnlnlljlllmlmmmjmnmmmmmnmmmmmmmmmmmmmmmmmmnmmmnmmmmmmmmmmmnmmmmmmnmnmnmmmmmmmmmkmmgmmjljjgjgggmmmmmmmmmnmmmmgggkmkgmgmjgggmmmkmkmmgkmmmkkmmgmmgmmgmgmmmmmkmmmkgggmmmmkmkkmmmmmmkmmkkkkkkkkkmgghkgkkggkhkkkkkkkkkkkhkkkkkkggkkggkgkhhkkkkkkhkhhkhkkhhkkkhkkhkkkkhkkkhhhkkkkkkkhkkhhkkkhkkhkkehhkhhhhhehhhhehhhhhhhhhhhhhhhehhhhkkkkkhekhkhkkhehhhkhhekkhkkhhkeekhhehekhkkhkkekekekkhhhhkhehhhhhhheeeeheefheeeefeieeeeeeeeeeeeeeeeeeeeeeiiiiieeeeieeeeieeeieeeiheeieeheiiiiieeeieiieeiiehieeieeieeieeieeimmmnmlmmmmmmmmmmmmmmmmmmmmmmnmnmmmmmmmkmmgmgggjlmmlmmlmmjjmlmlmmnmgmgmkmggggmmggggggmmgmggmmmgmgmmmmmgkkkggmmmgmmggkgmkggggkkkkkkkkkkmkkkkkhkkhkhgkmkmmgkgkmmkkmkmmkkkkhkkkhgkkkkkgghkkkkhhkkhhkhhkhkhkkkkhkkkkkkkhkkkhkhhhhkhkkhkhhhhkkhkhhhkhhhhhehhekhhkkhhhhkhhhhkhhhkhhhhhhhheehekkehkkkkheehekekkkkkhhhkhehhhkheeekkhheehekekhhhehkhhhhhhehhhhhhfeeeeeeehhhhhhehhhhhehehhhhheeeeeeeeieiiiiiiieeeieieeiiieeeeeiieiiiiiieeiiiiiiiiiiiiieiieiieieeiieeieeieieeiieiiiiiieeiiiieeeieeeeiiaiaffffifefeeifffafafffafanmkgjmjgjmggmkkkgmmgmkmggmkkkkkkkkhggkgmkgkmmkkkkkkkkkmkmhkkkkkgkkkkmgmkmkkkkkkkkkkkkkkkkkkhkkkkhkkkkkkkkhkkkkkhkkkhkkhhkhkkkkhkhkhhhhhhhkekhkhkhkhkkhkhkhhkhhhhhhhhhhhekkhhhhhhhkhhhkkhheeeeeeeekhkhhhhhkhhehhhhhhhhhhkheeekkkhehhhhheheeeeeeeeekhhheehhhhehekhhkheeeeeeeeeeeeeeeeeihiehieeeieefeieeeieeieieieiiiieiiiiieiieeiieiiiiiihiieiiiieiiiieiiieeiiiiiiiieiiiieiieeiiiiiiiiiiiihiffeaffffeefaffeaafaefaaaeeiaffaheffeffffffffaffffffffff&&&f&f&f&f&f&&&&&f&ff&ff&ff&&&&&&f&&f&&&&&ffff&ff&&&f&&%&&%&&%&&%&&kkkkkkkgkgghkkgkhgkkkkhhkkkkkhkkkkhkkhhkkhhkkkkkkkkkkkkhkhkhhhhkhhhhkkhhkhhheehhhehkhkkhkhhkkhkkkhhhhhhhhhehhkhkhhhkhhkkhkhkhhheeekhkkkheheeehehkhekhkkehhhkhhhhhhhheeekeeehhhhhheeeeeieehhhhhhhhhhhhhhehhhhheeeeeefieieeeeeieiieieeeeeeieeieeeieiiieieieiiieeiiiieeiiieeeieeieieiieieiieieieieieeieheeiiiieeeiiiiiiiiieeeieiiiiiiiffafafeffffffffafffaafffafffafffffiffffff&f&&&f&&&&&&&f&&f&&f&&&&&&&f&&f&f&fff&f&f&&&&&&ff&&&&f&&f&f&&&f&&&&&%%&&&%%%&&&&&%&&&&&f&&&f&&&&%&&%%%%%%&%&%%&&&%&%%%&%%%&&%&&&&%%&&&&%kkhhhhhhhkhhkkkkhkhhkkhhkkhkkkhkhkhhhhhkhkhhhhkkhekhkkkhehhhkehhhhhkheeekekehhkhkkkkhkhkkehhhheheeekkkhhhehhehehhhehehhhhheeeieeeeehhhehhhheehhhhhhehheeeeeeiiehiieiiiiheeeieieeiiieiiiiiieeieiiieeeiiiiieeeeieeeieeeeeiiieeieieieieeeieiieiieieeiieiieieiiiieffifffefefiefffaafafaaafffffafaafffaafafaffafffafffffff&&&&&&&&f&ff&&&&&&&f&&&&f&&&&&&ff&&fff&&&&&&&&&&&&&&&&&b&&&&&&&&&&&%&&&f&&&&&&&&&&&&&&&&&&f&&&&%%%%%&%&%%%&%%&%%%%%&&b&%&%b&%&%%%%%&&&&&%%&&%%%%%&%&%&%&&%&&%&%%&&%%%&&%%%%%%%%%%%&%&%%%&%&%%%&eefeefeeeeeeeeeeeeeeeeeieeeeeeieeeiieeheeeieieeeeiieeihieieeieiheeiheieiieieeeiiieeeeieeieiihieeieeeiiiiiiiiiieeiiieiihiieeeiieeeefaffaafafaffffffefifafffaffffiffaffiifififfffffffffffffffffffffffffff&&&fff&&&&&&ff&&&&ff&ff&&&&&&&&&&&&&f&&&&&&&&&&&&&&&&&f&%&%%%&%&%&&%&%%%&%&&%%%&&&%&&&%%&%&&%&%%&&%&&%&&&&%&%&%%&&%%&&&%&&%&%&&%&&&&&&&&&&&&%&%&%&%%%%»&%&b%b%&%&%&&%%%&&&c&c&b&¼%b&c&&%%&&cb%&%&%&c%»%&&%%%b&%»b%&&%%%%d%%%%%c%%c%%%%%c%%%cÌ%%Ìdccccbccccccd%%cÜccccccccccccddcdcccccccccccccceiieiieheiieieeiieeieiieieiiihiiiieeiiieeiieiieeeiieeieieieeeiiieeieieeiiieaffafaaaeffffffffffaaafafffffaffefffiiffif&&fff&f&ff&&f&&&f&&&&&&&f&&&&f&&&f&f&f&&f&&&&&&&f&&&&&&&&&&&&&&&&&&%%%%&&&&%%&&&%&%&%%&&&ff&&f&&%%&&&&&&%&%&&%%%%%&%%%&%%%%%&&%%%%&&%%&&&%%%%&%%%&&%%&%&&&&%&%%&&%%%&%&&&c&&&bb&&%&bb%%c%%b&&%%%%%%%&bbbc&bbbb»%%&&&bË&»bbbbc&cccb&b&c%b&b&&cbb&%%ÌcÍ%c%bÌc%c%dÌcdcccccdcccccdd%%Ì%ÌÌÌccccccccdccccccccccccddddddddddccdddccddcccdddccddddccddddddccddc__ccd_cdcc_dcdcc_diiiiiififfefaieffffefaafaffaffffffaaffafffaafffffaffaafffffiff&&ff&&&&f&&f&%%f&b&&&&&&&&&&&f&f&f&f&&&&&%&&&&b&&b&f&&f&%&&&&&&&b&f&%&%%&%%&&&&&%&&%&&&&&f&&&f%%&%&%%&%%&%%%&%%%&%%&b&&&bb%&&%%&&%&%%&&%%&%&&b&%b&&&&&%&%&%b%&%%&%&%%&%Ëb&&bbbc&&bb&%&%b%&%&&%%&&%&&b%%b%%%&%&b&&b%%»b&&b&&&&bË%c%b%%%&»&bËbbc%cÌccc%%Ì%%Ýccdcccdcccddc%Ìcc%b%Íccc%cÍccccccccdcccdcccccccccdddddccdcdccccccdcccc_cccccdddddddddcdcccdddccd^cc

&&&&f&&&&&&&&&&&f&&%&%&%&&&&&&&%&&&&&f&&&f&&&&&&%%&&%%%&%&&&&%%&&&&%%&&&%&%&&%%&%%&&%%%%%%&&%&&&%%%&&&%&&&%&&%&&%%%%%&&%c%bË&b&%%%&%&&&%%%&%%&%&&%b&»b&%%%&&&%&c%%%&&&»%%&bbb&&b&cbbc%b%&c%&&%%&&%%%c%c%%Ì%%cÌ%%Ýcccdccccc%ÌddÜc%%Ü%%%cÌcccccccccdcccccdcccdccddcddddddccccccccccccdccccdcdcdcccdcccdccdccdddddcdcccddc__dccd__cd__dccdccddddddddd___dd^c^ddcc_

__^^_______^__^^^^^_^^^^^^^^^^^^^^^^_^^^^_^^___^^^^^^^^^`^^^^^^^^^^^`^`^^```^`^^^^^^^^^^^^^^^^^%%%&&%%%%%%&&%&%&&&%%%&%&&%%&&%%&%&&&&%%%&%&%&%%%%&&&%&%&&&&%&&&%%&&Ë&&b%%&%&&%%&%%%&%&%%%&bc&bc&bcb&bbbb%%&c%c&bbc%»c%&bbbcb&cb%&&%b&%%»bccccÌc»cÌcÝd%%ÜccÛdÌdcÌbcccbcc%cÌdccdcccccdcccddccccccdcdcdcdcdcccdcdccccddcdcddccccccdddccddcdddddcd

^^_^^__^^^

^^^^^^^_^^^^^^^^^^^^^^^^_^^^^^^^^^^^^^^^^^`^^``^^`^`^`^`^^^``^`^^^^^^^^^^^^`^``^^^`^``^`^``^^^^^^^^^^^``````````^````^`````^```^^````^^``&b&&&&&&b&&&%&&&b&b&%&%Ë&%&b&&b&bccÍccc%%c%%%cÍ%%%c%%d%%%Ü%%c&%%%¼c%%%Ý%Üccdccd%c%%Ýdc%dÝdÌddÝÌÝd%Ìdcbccbcddddcddddccddddd_dcdd_ddcdccddccdcccdccdcd_dccdddddcccdcddc_d

^^^^^^````^`^^^`````^`^^^^``^`^``^^``^^`^^`^^`^``$``^``^``^^^``^^`````^^^^`````````^`^^^``^``^```````^```$$^```^`````````$```^$$`$`$$`$$$$$``$`$``$``$$```$`$``$````$`$``$$`$``$$`%Üccccccccddccccccccccdcdddccccdcdddddccdcddddcdcdddcddcddccdddcdccddcdcd__dddd_ddcdcc_c__c_cdddd__ddcddccddc^_^

^^_^__^_^_

_^___^^_

55555555

5555555

65555555555556555

5555555555555555

555555555555

222222222

5:<=<@@@<

55966969!6995655

(6666:69669999664:9999:8

99699:99

*44:6::4*

:4464466664646

)//433/444334/3

//3/3//3/3/0///

330333303303000

.111.........0..0131.01.311..3.11..0.111.15

,,.,,.,.,...,...,,.,

,)-Sccdcd%%Ì%%c%%d%dÛ%Ë%c¼cbÌdÌcW

,.YXYZZYYZYZZYXQQQQQQRUUURUUQQUUQQP

.VUVUVUUUVUVVOMOOOMOMMMOMMMMOOOMQ

;;@;@;<@<<<@@<;;<;;;;<@;<;<;;<<<;;<<;?

k.DC:L

8888888

8888888888

88888888888888888888888888888888888888888888888888888888888888888888887788888887888888888888788888788887788888888878887877887788777778887878878777878888778888878788877777777777777887777777777777777777777777777777776777777777777776777777777766676666777777767777777777766766666667666676666666666666666666666666666666666677666666666666667666666555555656666667666667666666765555566556565666666655665556565665666656565666666566666666666566666566666665555566666666665666665666888888888788878787888888888788788888877888787778787878888877778878877888778887878787888878888788778878788788787777777778778877877787878788778777777687777777777766666666777777777677877777766667677767667767777776677777666666777666776677777777676666667666666766676665556666666767676666766667755565565666657666666665666665555555666665666666665666666566666666666666666556666666666666666666566666665666666555566556665655666655666566666556565665665666665656555555565555555555555555555555555555554555554555557778887787787877788888878888777777777877777787777777777777777767777777777777777777777777777777777777777766666666777777777777777777777666666677666767766667666667666666666666666676666666666766667766666666666665566566566666666666766777665565666666666566666555665665666665666666666666656666566666666565665566666665665556666665666666656655656655565656556556655555565565556665555565556555656655665566555555555555555555545555555555555555555555555555554455554444555544545444455444555554455554455554555454555477777777777777776777777777767777777777777777777777777777677777777777777777777666666667776766676666666676666666667666766666776666666666666666666666666666666666666666666666666667666655556666566666666666566666566665656656665666666666566565666666566666565666555566566666566665665666566655655566555555565665565555555655555565655555656566555556655555565555555555555555555555555555554455445555555445554545555434445443435335334544354444445433333533303430333303044330343333334033334333333443340434334304334304766666666666666666666665666666665666666666666665665666666665666656556666666666665666665666666666566655566666665665656666566665555665556665665556555556565556555665665665665665665665655556555555565566556656566555556555555555655555555555555555545555555555555455555355555553335555535455553555355553335553535455453455535553335353335333333333333333333333333333333333433443434330443344344444400044004444004444404444444444444444444444444444444444444444444444444444444444444444444242424444422444224224444224446666666656666666666656666666556565566666655566656666666666655556566665556555555565655555666665555655555655665565655565556655556556565555555665655556566656555555555555555555555555555554554554555555555445455534544444445444445454444554455554455444453333343330444433444333343334030330333334333343443433334334333343443444444444440044040404343343444444400444444444444444444444444444444424444424444444444444444444244444424442222222442224224244444444442222242422224422224244424422244422222422222242422242422266666565555666666666666665566666655555555556665556565655555555655555655555565555555655554555554565545555554555554555545455545555444454455353545444455555533445444453454334534544553443355545444534033433434343303433003333333043333343333333333343334334303433444343400044400004444343343433343044044424444444444444444444444444444444444444424444444444444444444444444444222222244444444424444444444242424222424422244222222224424242422222242222442422222222242222222224422242424222244424244442242442444222444222555555555555555555555555545555555555455554554544454444545554544555445554554544444545535533555335334333333333333334334343433333433433403334434333444444044444440444444333334433443004404444444444444444444444442444244444444444444444444444444244244444444444444222444444444424444444444444422242242242242244222242222242222442222222222224444422422444244244222242222442444444442422424444242224222222422242222422222244422244222222222442222222222242222222222222222222222222222222222222222222221212122222222222223555555545454453434434444454403333333334343304043333333034333333344033333303333434043333334403444040440440444443334444444444004444444244444242442444444444444444442244444444444444444444444444444424222444244444444444444444444422244222442222442242242222424242224444424222244444424422422242222222422422222222224244244244244444244244222222211..///UUUUUUU,U,U,,,,,,UU///12121122224222222222222222222222222222211112222222222222222222221222212221222212222222111121212211221212212222222222222211122211222211223304343333330303303443034343443334033442443334444443343444242442444422222242224444444444424424444444444444444444442444444444244444424444244444444444444444444444424242222242222222222444424244444444444442444242242424422422422442222444442224442244422222444444442444222422242222222222222222222222242224222222222242224224222222211.../U,,-,                *                 --,,U/U/..1112222222121212221211212212121122122122222222212212121212112122121221122222211121212221111221121112122211212221211121211144442422222244222242244444444442244244442222444242244222224242422222422224242222224422244442422442442242222224224244222222422222222224224224222422222422224422242222244222242222242222222222242222222222222222222222222222222222222222222222212222222222222212222222212111221122112112121121222212122122222122121222221221211//U,--  ***  * * *  * ****  ***  ***  * ** **  *  **** **  *** -,U//1111121111222222211121121121111111111121211122121112111111111111111111.1111111111.11.111.11111111111111111111111111422224422442242222222242222224422442222442222222242422224224444224444244444444222222222224224224224222222224222442244222222422222422222222222222222222222221222222222222222222222222222222222212222222212221222221212221212222222211221221121111111112222121121121212121121221211122221211122221211212211112112112211.1./,,  *  ******* *        *  ***** ***   **    ******** *****  ***(((****** -U/.111111.1.1111111111.11.11.1/1/.1111.1.1.11/11/../1..../...........//...../...../../...../.....///.//.//.//.//2222242442424222442222422222222222224222222122122222224222222222222222221212122222222222211222222221122122221222222221221222222112211112212212211221121212122111112221111222111212211211111122122221211111111112121122212211212121122111112122121222211111111121121211221211122121111111.1111.1111111111121111212//,,- **(**(*******((*(*((((*(((((*((*****((((((((((((((()()((()(((((((((((((()(())()**--U/./././////././////////./////////////////.///////////U//////U////UU/U////////////UUU//U/U//U/U/UUU/U/UUU/2222222222222222222222222222222221222212211221222111222222222222222121112122121211221211222122211111212111111212221112121221212221211221121121121111111111111211112212212121121122212121221121.11.1.11111122121212222121111/11111.1111111111.111.111/1111///111.11/111111111111/.11.1111.1/11./....././.11/./U,- *)((((*((((((((((((((((()())(()(()())(()()))(()))))))(()))(())))))))))())))))))))())()))()(* ,U///////UU///////////./UUU//U/UU//U//U//UUU//UUU//UUU/////UUU/UUU//U//UUUUUUUU/UUUUUUUUUUUUUUUUUUUUUU122222221211212112111211112222111212121221221111121211111112111121112112221222122222221221122111211221122122211112211221112122111111112111112212121212111121121111.111..11.1.11.11..111111/1.1/.111.11..1..1111111111111/..././...../...../..////.../...../......//..//.//...//////////////////.///////UU, *())))))()(((()(()))))())))((((()()()))()))))))))()))()))))))()))))))))))))))))))))))))))))))))'')'))((-UUUUUUU/U/UUU/UUUUUU/UUUUUU,UUUUUUUUUUUUUUUU,UUUUUUUUUUUUUUUUUUUUU,UUUUU,UUUUUUU,UUUUUUU,,,UUU,,,1112111.111211121221111111111111111111111111111111111111111111111111111111.1111111111.1111111..1111111.11111//...//../..///././.././////././/////././/.////.///.////////////////./////////////////////////U//////////////UU////U//UU////U//U/////U/UU//U//UUU/U///UUU//UUU////UU//U///UU/UUUU////U,, *())''''))'')'))'')''''''''''))))')))'''''''')'''''')'')''''''''''''

%%%%$%%%$%$%$$%

%$%$$%$$%%%%$%%%%$%%%

" !#%%')')''

!!!! !! !

1111111111

33333333333

86755555555

 , ,, ,   ,

 ,,  , ,,,, 

  [   , ,[,,[

&$'&$&$$$&&&%&

&&%$%%%$%$%&$%$%%$%

%%%%&%%$&%%%%

%%$%$$%$$%%$%$%%%$%%$%%%

%$%%"""%%"%""

<!<!<!!<!<!<!!<<!

<!<!!<!<

!<<!<!!<!<<!<

!"$&&&$$$&&

%%%%&$%%&

%%%%$%%%

!!"!%"&&'&='==@>>@>@(>@@=>=='''&&&$%"!!!

SoK.iztEej

;;)&""""

""""&);;

"""---& ;

; )--"""

2 &-""""

"""--&) 2

2 &--""""

""""---));;

2 )---""

2 )---"""

"""---& 2

&~~)~&~&~~

566666666

5555555555555

%SA=BC

*.mgjmmjlgjjgmgkmmmgggmmmkmgkk

V%%c%%%%ÝccÌcdcd%%Ì%%c%%d%dÛ%Ë%c¼cbÌdÌcd]M

,  *  ,,

,  *   ,

*.ZZZZZZZZZ[[ZZZZZZZZZZZYYVVUUVUUQQQUQUQQQUUQUUR

,  *   .

, * * * * * * * * * * * ,

%s.bak

%lu|%lu|%lu|%lu|%s

%s (%lu of %lu items)

%s %s

\inf\unregmp2.exe /FixUps

Software\Microsoft\Windows\CurrentVersion\RunOnce

4.90.0.3003

\smgr.dll

\wmpband.dll

\wmdband.dll

\wmvcore.dll

\wmp.dll

setup_wm.exe

msdmo.dll

\Help\wmplayer.bak

\Help\wmplayer.chm

wmplayer.exe

Microsoft Windows Media Player 9 Series

Software\Microsoft\Windows\CurrentVersion\Setup\Migration Dlls

W\pidgen.dll

\notepad.exe

%s\%s\

%s\%s

wmexpack.inf

msoobci.dll

advpack.dll,LaunchINFSection %s,Uninstall

\inf\wmp.inf

advpack.dll,LaunchINFSection %s,Uninstall,1,N

\inf\roxio.inf

\rundll32.exe

::/htm/nomoreinformationisavailable.htm

wmplayer.chm

HHCTRL.OCX

hXXp://

Software\Policies\Microsoft\WindowsMediaPlayer

\wmplayer.exe

\INF\unregmp2.exe

ginetcpl.cpl

E33D49A9-409C-4acd-A1F5-DA7DBB99EB30

Windows Media Player 9 Series

sfc.dll

DEVELOPER WARNING: Detected use of a Windows message that probably needs special-case thunking code that hasn't been implemented yet!

kernel32.dll

BASEURL

UDBSOURCEURL

SUPPORTEDRANGE

SOURCEURL

Windows Media Setup

%s_Win9X

%s_NT

%s_NT%lu

%s_%s

1.0.0.0

0.0.0.0

%sWMC%4.4lu.tmp

%s advpack.dll,LaunchINFSectionEx %s,%s,,%lu,N

\msdxm.ocx

\msxml.dll

%s%lu

advapi32.dll

Software\Microsoft\Windows\CurrentVersion

Software\Microsoft\Windows NT\CurrentVersion

unregmp2.exe

wmpshell.dll

wmploc.dll

Software\Microsoft\Windows\CurrentVersion\MUILanguages\FileVersions

migrate.exe

\kernel32.dll

%s\..

MP2.SaveDir

\wmploc.dll

%ssetb%lu.tmp

Software\Microsoft\MediaPlayer\Setup\FileMoveCache\%s

\inf\unregmp2.exe /Fixups

\regsvr32.exe

\WinInit.Ini

{05589fa1-c356-11CE-bf01-00aa0055595a}

{22d6f312-b0f6-11d0-94ab-0080c74c7e95}

amovie.ocx

\nsplay.exe

\mplayer2.exe

msdxm.ocx

%s\Groups\%s

%s\Devices\%s

%s\Protocols\%s

%s\MIME Types\%s

%sFile

Extension.Handler

%s\Extensions\%s

\inf\unregmp2.exe

\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\

%s.NT%lu.%lu

%s.NT4

%s.NT5

%s.NT

%s.Win95

%s.Win98

%s.WinMe

%s.Win9x

MediaPlayerV2.dll

\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\wmsocm.cat

milltrc.exe

insttrc.exe

%s,%s

MS_WebcheckMonitor

iphlpapi.dll

http=

hXXps://

@%SystemRoot%\inf\unregmp2.exe,-9991

{CE3FB1D1-02AE-4a5f-A6E9-D9F1B4073E6C}

mplayer2.exe

Software\Clients\Media\Windows Media Player\InstallInfo

iexplore.exe

dvdplay.exe

deluxecd.exe

cdplayer.exe

soundrec.exe

sndrec32.exe

mplayer.exe

mplay32.exe

MPlayer2.BAK

%s\ddeexec.bak

%s\ddeexec

%s\command

%s\shell

%s\shell\open\ddeexec.bak

%s\shell\open\ddeexec

%s\shell\open\command

%s\shell\%s\command

MIME\Database\Content Type\%s

%s\DefaultIcon

URL:%s Protocol

URL Protocol

%s "%%L"

Software\Microsoft\Windows\CurrentVersion\Applets\DeluxeCD\Settings

WMP.%s\Shell\Play\Command

%s /device:%s "%%L"

%s /prefetch:4 /device:%s "%%L"

%s /prefetch:3 /device:%s "%%L"

MPlayer2.Set

%s\shell\%s\ddeexec.bak

%s\shell\%s

%s\shell\open

%s\shell\open\DropTarget

MPlayer2.Bak

clsid:05589fa1-c356-11ce-bf01-00aa0055595a

Software\Microsoft\Internet Explorer\EmbedExtnToClsidMappings\%s

MCI Extensions.BAK

mciqtz.drv

mciqtz32.dll

\system.ini

MP2.Last

CLSID\{22D6F312-B0F6-11D0-94AB-0080C74C7E95}\EnablePlugin\MIME\%s

CLSID\{22D6F312-B0F6-11D0-94AB-0080C74C7E95}\EnablePlugin\%s

CLSID\{05589FA1-C356-11CE-BF01-00AA0055595A}\EnablePlugin\MIME\%s

CLSID\{05589FA1-C356-11CE-BF01-00AA0055595A}\EnablePlugin\%s

%s\shell\%s\ddeexec

PreferExecuteOnMismatch

{8DD448E6-C188-4aed-AF92-44956194EB1F}

%s\shellex\ContextMenuHandlers\WMPBurnAudioCD

{F1B9284F-E9DC-4e68-9D7E-42362A59F0FD}

%s\shellex\ContextMenuHandlers\WMPAddToPlaylist

%s\shellex\ContextMenuHandlers\WMPPlayAsPlaylist

CLSID\{CE3FB1D1-02AE-4a5f-A6E9-D9F1B4073E6C}\SupportedTypes

CLSID\{F1B9284F-E9DC-4e68-9D7E-42362A59F0FD}\SupportedTypes

Applications\mplayer2.exe\SupportedTypes

Applications\wmplayer.exe\SupportedTypes

%s\OpenWithProgIds

%s\OpenWithList\%s

Software\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers\Handlers\MSWMDMHandler

Software\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers\Handlers\MSPlayDVDMovieOnArrival

Software\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers\Handlers\MSWMPBurnCDOnArrival

Software\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers\Handlers\MSRipCDAudioOnArrival

Software\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers\Handlers\MSPlayCDAudioOnArrival

Software\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers\EventHandlers\PlayVideoFilesOnArrival

Software\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers\EventHandlers\PlayMusicFilesOnArrival

Software\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers\EventHandlers\HandleCDBurningOnArrival

Software\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers\EventHandlers\PlayDVDMovieOnArrival

Software\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers\EventHandlers\PlayCDAudioOnArrival

SystemFileAssociations\Directory.Video\shellex\ContextMenuHandlers\WMPPlayAsPlaylist

SystemFileAssociations\Directory.Video\shellex\ContextMenuHandlers\WMPAddToPlaylist

SystemFileAssociations\Directory.Audio\shellex\ContextMenuHandlers\WMPPlayAsPlaylist

SystemFileAssociations\Directory.Audio\shellex\ContextMenuHandlers\WMPAddToPlaylist

Software\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers\EventHandlers

%s\shell\play

Shell.AltVerb.Name

SystemFileAssociations\%s\shellex\ContextMenuHandlers\WMPBurnAudioCD

%s\shell\play\command

Shell.HWEventHandlerShellExecute

InitCmdLine

"%ProgramFiles%\Windows Media Player\wmplayer.exe" /prefetch:3 /task:PortableDevice

{91778246-9BE4-4713-A651-E833B853CC30}

WMP.DVD

@wmploc.dll,-6504

WMP.BurnCD

@wmploc.dll,-6505

WMP.RipCD

@wmploc.dll,-6506

WMP.AudioCD

@wmploc.dll,-6502

@wmploc.dll,-6503

%ProgramFiles%\Windows Media Player\wmplayer.exe,0

{7D4734E6-047E-41e2-AEAA-E763B4739DC4}

CheckSupportedTypes

Player.Path

Shell.Play

Shell.Open

Text.PlayVerb

Text.OpenVerb

Shell.AltVerb.Cmd

Extension.MIME

\inf\unregmp2.exe,-

MediaType.DescriptionID

MediaType.Description

MediaType.Icon

Extensions.SpaceSep

Extensions.CommaSep

Extension.Key

{ee4da6a4-8c52-4a63-bbb8-97c93d7e1b6c}

-b84f-48f0-9393-7edc34128127}

{00022601-0000-0000-C000-000000000046}

{25336920-03F9-11cf-8FD0-00AA00686F13}

Software\Netscape\Netscape Navigator\Viewers.BAK

Viewers.BAK

MPlayer2.BAK.CLSID

CLSID\%s\ProgId

%s\Mime Types\%s

setupapi.dll

tmscat32.dll

Kernel32.dll

\Device\Tcp

Windows-Media-Player/

\\?\GLOBALROOT%s\

dw15.exe

WMPlayer/%s

hXXp://go.microsoft.com/fwlink/?linkid=3274

hXXp://go.microsoft.com/fwlink/?LinkId=7499

hXXp://go.microsoft.com/fwlink/?LinkId=6061

hXXp://go.microsoft.com/fwlink/?LinkId=9983

hXXp://go.microsoft.com/fwlink/?prd=766&pver=9.0&plcid=0x409&clcid=0x409&ar=options&sar=privacy

DVD.bookmark

DVD.title

DVD.chapter

%c:\video_ts\video_ts.ifo

video_ts.ifo

AVSEQ%d.dat

MUSIC%d.dat

_Small.jpg

_Large.jpg

OCXLayoutInvisible.wsz

OCXLayoutFull.wsz

OCXLayoutMini.wsz

OCXLayoutNone.wsz

DRMHeader.SubscriptionContentID

DRMHeader.ContentDistributor

DRMHeader.SECURITYVERSION

DRMHeader.CID

DRMHeader.LAINFO

DRMHeader.KID

LicenseStateData.Transfer.NONSDMI

LicenseStateData.Transfer.SDMI

LicenseStateData.Print.redbook

LicenseStateData.Play

ActionAllowed.Backup

ActionAllowed.Transfer.NONSDMI

ActionAllowed.Transfer.SDMI

ActionAllowed.Print.redbook

ActionAllowed.Play

BaseLAURL

Transfer.NONSDMI

Transfer.SDMI

Print.redbook

https

vnd.ms.wmhtml

{445FCAE5-A5EE-4b8d-989B-CFB436426602}

wmvcore.dll

\\.\%c:

%c%s=%s

%s://

%s%c%s

wmploc.dll/

wmploc.dll\

%s://%s

%d/%d

%s://%c?contentdir=%s

%s://%c/%d?contentdir=%s

icmp.dll

res://wmploc/RT_TEXT/corporate.wsz

\9SeriesDefault.wmz

BuyMusicURL

WMBurn.exe

SOFTWARE\Microsoft\MediaPlayer\Player\Schemes\%s

SOFTWARE\Microsoft\Multimedia\WMPlayer\Schemes\%s

SOFTWARE\Microsoft\MediaPlayer\Player\Extensions\.%s

SOFTWARE\Microsoft\Multimedia\WMPlayer\Extensions\.%s

Software\Policies\Microsoft\WindowsMediaPlayer\

Software\Policies\Microsoft\WindowsMediaPlayer\Protocols\

Software\Microsoft\Windows\CurrentVersion\Policies\

/:*?"<>|

Microsoft Windows Media Configuration Utility

Microsoft(R) Windows Media Player

Save file and URL &history in the Player

Microsoft is committed to protecting your privacy as a consumer. The Windows Media Player 9 Series privacy statement, explaining what data is collected, how that data is used, and what privacy controls exist is available at:

hXXp://VVV.microsoft.com/windows/windowsmedia/privacy/9splayer.asp

Depending on the privacy settings you have selected, Windows Media Player 9 Series may access the Microsoft WindowsMedia.com Web site in order to provide you with an enhanced media experience. The privacy statement for that site is available at:

hXXp://windowsmedia.com/privacy/privacystatement.asp

Windows Media Audio/Video file"Windows Media Audio/Video playlist

Windows Media Audio shortcut

Windows Media Audio file"Windows Media Audio/Video playlist

Windows Media Audio/Video file

Windows Media Player Skin File!Windows Media Player Skin Package

Windows Media Player File

%Windows Media Player Download Package

Windows Media playlist

Windows Media Library

Windows Media Audio file (wma)

Windows audio file (wav)

Windows Media file (asf)

Windows video file (avi)

Windows Media Video file (wmv)

-Includes files with .au, and .snd extensions.5Includes files with .mid, .midi, and .rmi extensions.-Includes files with .wma and .wax extensions.$Includes files with .wav extensions.KIncludes files with .asf, .asx, .wpl, .wm, .wmx, .wmd, and .wmz extensions.$Includes files with .avi extensions.

2Includes audio CDs and files with .cda extensions.

DVD Video playback.-Includes files with .wmv and .wvx extensions.

-Includes files with .mp3 and .m3u extensions.VIncludes files with .mpeg, .mpg, .mpe, .mv1, .mp2, .mpv2, .mp2v, and .mpa extensions.6Includes files with .aif, .aifc, and .aiff extensions.TIncludes files with .asf, .asx, .dvr-ms, .wpl, .wm, .wmx, .wmd, and .wmz extensions.

Deleting old directories...CPerforming post-setup operations... (this may take several minutes)&Performing pre-setup initialization...

Windows Media Player

Determining file availability.<Downloading file. Time remaining: %s. Received %8lu bytes.

4hXXp://autoupdate.windowsmedia.com/update/update.asp

The Setup Wizard has found one or more problems that could affect your installation. Review the following information and take the corrective actions as appropriate.4Thank you for choosing Windows Media Player 9 Series

"Customize the Installation OptionsJConfigure your desktop and Windows Media Player 9 Series default settings.

[Please wait while the Windows Media Player Setup Wizard downloads files onto your computer.

Windows is being upgraded with Windows Media Player 9 Series. After the upgrade is complete, you can configure Player options.

Windows Media Player UpdateUA Windows Media Player update is available. Please review the following information./Windows Media Player 9 Series Setup is complete5Thank you for choosing Windows Media Player 9 Series.(Welcome to Windows Media Player 9 SeriesTEnjoy fast and flexible music and video playback with Windows Media Player 9 Series.

3Cannot complete Windows Media Player 9 Series Setup

Exit Windows Media Player, other programs, and close all Explorer windows before continuing with setup of Windows Media Player 9 Series.

Another program installation was not completed. You must restart your computer to complete that installation before upgrading Windows. Click Cancel, restart your computer, and then try installing Windows Media Player 9 Series again.

Windows is enabled to use the Multilingual User Interface (MUI). After setup completes, you can install the appropriate Windows Media Player Language Packs to enable language switching capabilities for the languages you use.

Your version of Windows on this Computer already contains a more recent version of Windows Media Player. Windows Media Player 9 Series setup will now exit.

To upgrade Windows with Windows Media Player 9 Series, you must have administrative rights and permissions for this computer. Click Finish, log off from the computer, and log on using an Administrator account.=Multilingual User Interface (MUI) version of Windows detected

It is not possible to install localized versions of Windows Media Player 9 Series on a Windows Multilingual User Interface (MUI) version of Windows. Please install the English version of Windows Media Player 9 Series on this machine, and then install the appropriate Windows Media Player 9 Series Language Packs to obtain language switching capabilities for the languages you use.

System Restore is turned off or disabled on this computer. If you continue setup, you will be unable to use System Restore to restore Windows Media Player that is part of this version of Windows. It is recommended that you click Cancel, turn on System Restore, and then upgrade to Windows Media Player 9 Series. For more information about System Restore, see Help and Support. Do you want to continue?

If you continue Setup, you will be unable to use System Restore to rollback changes to your computer from this installation. It is recommended that you click Cancel and use Windows Update to obtain fix Q290700 and re-run Windows Media Player Setup.

You have the Windows Media Player 9 Series mini-mode enabled; please disable the Windows Media Player toolbar before continuing. To disable mini-mode, right-click on an empty area of the taskbar, point to Toolbars, and then clear the check next to Windows Media Player.'Unsupported version of Windows detected

This version of Windows Media Player can be installed only on Windows 98 Second Edition, Windows Millennium Edition, Windows 2000, Windows XP(32-bit), and Windows .NET Server(32-bit).

Printable Version]hXXp://go.microsoft.com/fwlink/?prd=766&pver=9.0&plcid=0x409&clcid=0x409&ar=setup&sar=privacy'Windows Media Setup is already running.#Windows Media Configuration Manager

Setup has detected that you are running an older operating system. Windows Media Player 9 Series is only supported on Windows 98SE, Windows Me, Windows 2000, and Windows XP.

yYou have the latest version of Windows Media Player 9 Series and all its components. No update is available at this time. The installer is now starting...

Windows Media Player 9 Series setup has failed. The setup program could not connect to the upgrade server. Not all components may be available for install.

Setting System Restore point...%It was not possible to complete Setup%Windows has been successfully updated

Windows Media Player 9 Series was not installed. To update Windows, run Windows Media Player 9 Series Setup again. You must restart your computer now. Click the Restart button to restart your computer.zThe Windows Media Player update is %lu MB. This will take approximately %lu minutes to download on a 28.8kbps connection.=This feature has been disabled by your network administrator.jWindows Media Player is required by other components on this computer and may not be removed at this time.

Windows Media Player is in use by other components on this computer and should not be removed at this time. Are you sure you wish to remove Windows Media Player?

During setup, Windows Media Player 9 Series will be set as the default player for playing your digital media content, including music, videos, CDs, and DVDs. This setup process will allow you to customize these defaults and other installation options.

You are about to change privacy settings that will affect the way cookies are handled in Microsoft Internet Explorer, Outlook, Outlook Express, Windows Media Player, and any other programs that rely on these privacy settings.

]hXXp://go.microsoft.com/fwlink/?prd=766&pver=9.0&plcid=0x409&clcid=0x409&ar=setup&sar=privacy`hXXp://go.microsoft.com/fwlink/?prd=766&pver=9.0&plcid=0x409&clcid=0x409&ar=setup&sar=wm_privacyMA Windows Media update is currently available. Would you like to update now?2The %s format(s) include files with %s extensions.

Windows Media Player 9 Series will be the default player for the file types that are selected in the following list. You must be logged on as an administrator or a member of the Administrators group to change these settings.sWindows Media Player 9 Series was not installed. To update Windows, run Windows Media Player 9 Series Setup again.

In order for your changes to take effect, you must restart Windows. Save your work and close all programs, then click Restart to restart Windows.

MegaHack.EXE_1492:

.text

`.rdata

@.data

.rsrc

@.reloc

Please contact the application's support team for more information.

- Attempt to initialize the CRT more than once.

- CRT not initialized

- floating point support not loaded

GetProcessWindowStation

USER32.DLL

-ORIGIN:"%s"

CET_Archive.dat

%s\%s

"%s" %s

Failure loading the trainer. Your tempfolder must allow execution. (Check your anti virus)

SHLWAPI.dll

KERNEL32.dll

USER32.dll

ADVAPI32.dll

GetCPInfo

GetConsoleOutputCP

%Documents and Settings%\%current user%\Application Data\Microsoft\Windows\License\MegaHack.EXE

CET_TRAINER.CETRAINER

Zd .OG

Ux:m~w%s

%flx9

%X7{l

T.oE~

gR%S)

!@'%s

g%f B/

 rz%u{

~]Û

/A=.GY

F[Le%u

>.HUb

ZZ%u6

1kQK%dW|

QN.ET

.NlgS

KeYj

}0.MVoa

f$.Xak

yJ.Yn

VZ%Sr

8L%u/

,.fwv

|.Ju2

<0%x*

%SQn"

B.SVVBe

Sg.fQ{eb

_/(d%C V

e.Xx0

7}9&T%f-g

z1.oZ

n7%s\

'R.rJj

%U0\`

yH.Ig

.WlG{

M&.IkUVM

L[.OA

NwH%s

.VV=jO

.fnAH

-gL}.

p<.VE

OuÉr

?.AlJTg"

sO.aq5^

.Hk/\

{\\?\

.ztZN

m)..Vq

0E%xr 

%u()j

Þd-

%X>=m6

P*.%U

^.Ec_

:vmsg

%D[HqE

%X }S3

bPf.Lv

w&.lg%w

<.ot5?g

}M:.of

0A.%X

%uNG@M#

.YW'{R5

5h%uS

.Vr[k

..JT"

{%s_*

D@~%f

.JwwC

zk%cv

n3.XZ

&F'.if

K.UDrZn

 8e.GR,

r.eq3

%c/~X

-.GEpn

.Hq8n.

O%6SPL

v%UOd

.iJ=5Tc

%UgfBRT

%S"J,E

.izY1

tF$m;%c

Z.mTt

c.Ay$

.QrQlw

<.vA-[

z?%X&

.qB-^

.eHj9

%S*SZ

2w%d&

%%Fm>-

Ÿ\DTr

S.RN.

J%U)c

dATssH

.XZoO

nSG%Xv

?o/%.mz

&.oCE

{M.be"*<t

-Pa}A

.iA%dM

E~03Q j.dg

r%XQ8AZ<

".JJK

tCpt

nFH.pgT@

-aP0}

m`.Hj

T.0.YZ

P.CHd

Bo%)Io%S

.TbH` 

K%FG>

Wd.wIYa

fX%Fn

-bA}U

G%s;fG

hJÅR)

!qK.Jf

S.SVn

N0Y%X'

%XA7A

%xE5Q3

D)_/%s~We

L%u''

a:\/I

l#.hj

\%.iO

gd"%d

#h.jC

FRz%s

Pq.jH

2$@:%u

!5DH

.lSCn^

"A.ln

bY%So&

%dIFo

FY.Du

--8d%X

).yfk\

p8.ET

Z>.Mp

>-.WmO

NK%sbn

4B7G%D h

.Ptx^

.cS[_L

S)y.Fp

3P&t.fyQ

7C%SC

K%FV-

Is.Cj

.QB@^z%W

.WQF?

/b.Tg

-@2-@2-@

Fcp%uk

%cp{U

Ud/%x^

.UH_x

9È;

.uh*.w

l.DJ1

-C};O

d.dp~c

s*S%d

X.bU{

AMm.Ol

pcMd

XG.nys

8/.Uu

~-u}x

d .hyE6x

`|.ST

%XXi3L9

{l%s6a

(T%Cr$

^C.tWS]/

.SWui]

%F&e)

y]R.vN

9-Q}G

;^.LjTJ

}.uc,

m.sQO

$A|%u9^s

.zXW{

0.Ue]ZK

>8.Sx

qTcPE-

Cd.xCy

?l.oZ

W?{%d

Y.Jt8

ü\[

T-Jbq3}

.EK\_!

.tq N<

}z.Na}

'.qv?0-

Gg.QT,K

).FI#/-'

.QX)e?_

p%d@kXk

%d?Rl

%sB(s

tQ%foB

j.woBo{?X_.P

uDPs

J>1%s

3..Sp

G.eat&

Q]im5W%D

WyE-.MK

F3$%d

-5}CN

.Sa`D

k.ye'

dVD.tl-

h.OHL

%u;D@

_.IRV

z*".h.Ln

R~<==.Ttp'b

.lnq!

3X.tb-W

bW!.aSr

.xQ;xj>

%uuSX

.NV#~

*Vb%F

%Sc8yd,

.WqUm?

3%X?(4

\:i.Wx

.aDve

G.hWOp/

 .GeDz

`Ee.uNE

h.fhBoT 3.G[

4M=b(.sX

n/"#.EEL

..gf»

m.XKL

e;.bK

.OYT#wS

09s_%cQ

SA%UTS

SA%UTSC-u

n~U.VE

A zF.rF

OE.fJP*

A^p.wH

.kYGs

XH%U,

z\%U,

XH%U\

.vx~35

K.KyW

.IiJQA

V.elg

r.hj_(

.`.JmF2

{.BWs

rYA%UTS

rYA%UT

&.IIG

(_%uxG

/b.Kx

:Î^

9u.nr.X

RA%UTSC-1

.TX4{

q-F.meW

{i%dO?

.ru0W2

J.Rt#

a .QY

uD.Wo~

.AN*yz

/d%Fr

0.3.7

=Ln.NL

ss.kv

%Sb /

#j-.kJ-

,NHù

.eMnP

v/%FM83

&yÞ

9$"Ã

T{%-xa}{

.JR`b)

g5%0U

d%.NOJLO's;

'$.JJ

qHCX.fa

.XVivY

k0.lr

.fws9

%s|x}xAp

tCpG

0mcMD

k%Syy

rÂx

1IF%C{6

.hlF7

lWf.CF

J.SZ|

eûW

c_.WQ

.pPnc

%x;K$

N%C(Lja

S.sU?)*N

a4d%c

K.Rqs(

m#.bSZX

e-2i}U

iN.RD

R%XsrN

G.cl_

0g.yb

;3r.iy

WjKG.Jgh

:Qt%c

E%cK4

'8.LH

Y&x<2%U

%.bw_

-1X}`

O(`%F

Vv%sc

-Q}^`

#.Sd^]

"9.Gy

*w.jj^

%xF5E

ecRt0[

,V.ji

7.uD1J

%uv D#

Tm%U[

 Ev.sgAZ

o.em6

{ú8

.uhp>

~{.GT

5HD%X

^.ppI

&u%UJa

'.ND|p

.uKy 

W.es^

.uZ"N

.pQUk

ÑYJ

%s)\*

e.en`60[

m.pU 

.Gktc

mG-Y%f

@W.DK

.ub\4k

wU%UF

wU%D<

%%h.kY{

k&uDP

7.VbP

Q.GK 

`.data

.idata

t.Ht2Ht6Ht:Ht>

F&{00000000-0000-0000-C000-000000000046}

3This binary has no widestrings support compiled in.

6This binary has no unicodestrings support compiled in.

&{3FEEC8E1-E400-4A24-BCAC-1F01476439B1}

.Owner

cheatengine-i386.exe

cheatengine-x86_64.exe

CET_TRAINER.CETRAINER"

Ancestor class for "%s" not found.

rtlconsts.sancestornotfound

Cannot assign a %s to a %s.

rtlconsts.sassignerror

Class "%s" not found

rtlconsts.sclassnotfound

Duplicate name: A component named "%s" already exists

rtlconsts.sduplicatename

rtlconsts.sduplicatestring

rtlconsts.semptystreamillegalreader

rtlconsts.semptystreamillegalwriter

No variant support for properties. Please use the variants unit in your project and recompile

rtlconsts.serrnovariantsupport

Unable to create file "%s"

rtlconsts.sfcreateerror

Unable to open file "%s"

rtlconsts.sfopenerror

rtlconsts.sinvalidimage

"%s" is not a valid component name

rtlconsts.sinvalidname

rtlconsts.sinvalidpropertypath

rtlconsts.sinvalidpropertyvalue

List capacity (%d) exceeded.

rtlconsts.slistcapacityerror

List count (%d) out of bounds.

rtlconsts.slistcounterror

List index (%d) out of bounds

rtlconsts.slistindexerror

rtlconsts.smemorystreamerror

Error reading %s%s%s: %s

rtlconsts.spropertyexception

rtlconsts.sreaderror

rtlconsts.sreadonlyproperty

Resource "%s" not found

rtlconsts.sresnotfound

%s.Seek not implemented

rtlconsts.sseeknotimplemented

Operation not allowed on sorted list

rtlconsts.ssortedlisterror

Invalid stream operation %s.Seek

rtlconsts.sstreaminvalidseek

Reading from %s is not supported

rtlconsts.sstreamnoreading

Writing to %s is not supported

rtlconsts.sstreamnowriting

Unknown property: "%s"

rtlconsts.sunknownproperty

Unknown property type %d

rtlconsts.sunknownpropertytype

Unsupported property variant type %d

rtlconsts.sunsupportedpropertyvarianttype

rtlconsts.swriteerror

ENoThreadSupport

ENoWideStringSupport

=?&{7B108C52-1D8F-4CDB-9CDF-57E071193D3F}$TMultiReadExclusiveWriteSynchronizer

BasicEventWaitFor failed in TMultiReadExclusiveWriteSynchronizer.Beginread

sysconst.sabstracterror

sysconst.saccessdenied

sysconst.saccessviolation

Missing argument in format "%s"

sysconst.sargumentmissing

%s (%s, line %d)

sysconst.sasserterror

sysconst.sassertionfailed

sysconst.sbuserror

sysconst.scannotcreateemptydir

sysconst.scontrolc

sysconst.sdiskfull

sysconst.sdispatcherror

sysconst.sdivbyzero

sysconst.sendoffile

External exception %x

sysconst.sexternalexception

sysconst.sfilenotassigned

sysconst.sfilenotfound

sysconst.sfilenotopen

sysconst.sfilenotopenforinput

sysconst.sfilenotopenforoutput

sysconst.sinvalidfilename

sysconst.sintoverflow

Interface not supported

sysconst.sintfcasterror

Invalid argument index in format "%s"

sysconst.sinvalidargindex

sysconst.sinvalidcast

sysconst.sinvaliddrive

sysconst.sinvalidfilehandle

Invalid format specifier : "%s"

sysconst.sinvalidformat

sysconst.sinvalidinput

Invalid floating point operation

sysconst.sinvalidop

Invalid pointer operation

sysconst.sinvalidpointer

sysconst.sinvalidvarcast

Invalid variant operation

sysconst.sinvalidvarop

Threads not supported. Recompile program with thread driver.

sysconst.snothreadsupport

sysconst.smissingwstringmanager

sysconst.ssigquit

System error, (OS Code %d):

sysconst.soserror

sysconst.soutofmemory

sysconst.soverflow

sysconst.sprivilege

sysconst.srangeerror

sysconst.ssafecallexception

sysconst.siconverror

sysconst.stoomanyopenfiles

sysconst.sunknownruntimeerror

sysconst.sunderflow

An operating system call failed.

sysconst.sunkoserror

sysconst.svararraybounds

sysconst.svararraycreate

sysconst.svarnotarray

zstream.sseek_failed

zbase.sneed_dict

zbase.sstream_end

zbase.sfile_error

zbase.sstream_error

zbase.sdata_error

zbase.smem_error

zbase.sbuf_error

zbase.sversion_error

1.1.2

FPC 2.5.1 [2011/11/24] for i386 - Win32

GetProcessHeap

GetWindowsDirectoryA

kernel32.dll

oleaut32.dll

user32.dll

version="1.0.0.0"

<requestedExecutionLevel level="requireAdministrator"/>

name="Microsoft.Windows.Common-Controls"

version="6.0.0.0"

publicKeyToken="6595b64144ccf1df"

<requestedExecutionLevel level="requireAdministrator" uiAccess="false"></requestedExecutionLevel>

5 5$5@5\5`5

2$2,242<2

mscoree.dll

KERNEL32.DLL

csrss.exe_1820:

.text

`.itext

`.data

.idata

.rdata

@.reloc

B.rsrc

kernel32.dll

Windows

MSWHEEL_ROLLMSG

MSH_WHEELSUPPORT_MSG

MSH_SCROLL_LINES_MSG

$*@@@*$@@@$ *@@* $@@($*)@-$*@@$-*@@$*-@@(*$)@-*$@@*-$@@*$-@@-* $@-$ *@* $-@$ *-@$ -*@*- $@($ *)(* $)

oleaut32.dll

EVariantBadIndexError

ssShift

htKeyword

EInvalidOperation

%s_%d

EInvalidGraphicOperation

SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontSubstitutes

%s, ClassID: %s

%s, ProgID: "%s"

ole32.dll

USER32.DLL

uxtheme.dll

DWMAPI.DLL

clWebSnow

clWebFloralWhite

clWebLavenderBlush

clWebOldLace

clWebIvory

clWebCornSilk

clWebBeige

clWebAntiqueWhite

clWebWheat

clWebAliceBlue

clWebGhostWhite

clWebLavender

clWebSeashell

clWebLightYellow

clWebPapayaWhip

clWebNavajoWhite

clWebMoccasin

clWebBurlywood

clWebAzure

clWebMintcream

clWebHoneydew

clWebLinen

clWebLemonChiffon

clWebBlanchedAlmond

clWebBisque

clWebPeachPuff

clWebTan

clWebYellow

clWebDarkOrange

clWebRed

clWebDarkRed

clWebMaroon

clWebIndianRed

clWebSalmon

clWebCoral

clWebGold

clWebTomato

clWebCrimson

clWebBrown

clWebChocolate

clWebSandyBrown

clWebLightSalmon

clWebLightCoral

clWebOrange

clWebOrangeRed

clWebFirebrick

clWebSaddleBrown

clWebSienna

clWebPeru

clWebDarkSalmon

clWebRosyBrown

clWebPaleGoldenrod

clWebLightGoldenrodYellow

clWebOlive

clWebForestGreen

clWebGreenYellow

clWebChartreuse

clWebLightGreen

clWebAquamarine

clWebSeaGreen

clWebGoldenRod

clWebKhaki

clWebOliveDrab

clWebGreen

clWebYellowGreen

clWebLawnGreen

clWebPaleGreen

clWebMediumAquamarine

clWebMediumSeaGreen

clWebDarkGoldenRod

clWebDarkKhaki

clWebDarkOliveGreen

clWebDarkgreen

clWebLimeGreen

clWebLime

clWebSpringGreen

clWebMediumSpringGreen

clWebDarkSeaGreen

clWebLightSeaGreen

clWebPaleTurquoise

clWebLightCyan

clWebLightBlue

clWebLightSkyBlue

clWebCornFlowerBlue

clWebDarkBlue

clWebIndigo

clWebMediumTurquoise

clWebTurquoise

clWebCyan

clWebPowderBlue

clWebSkyBlue

clWebRoyalBlue

clWebMediumBlue

clWebMidnightBlue

clWebDarkTurquoise

clWebCadetBlue

clWebDarkCyan

clWebTeal

clWebDeepskyBlue

clWebDodgerBlue

clWebBlue

clWebNavy

clWebDarkViolet

clWebDarkOrchid

clWebMagenta

clWebDarkMagenta

clWebMediumVioletRed

clWebPaleVioletRed

clWebBlueViolet

clWebMediumOrchid

clWebMediumPurple

clWebPurple

clWebDeepPink

clWebLightPink

clWebViolet

clWebOrchid

clWebPlum

clWebThistle

clWebHotPink

clWebPink

clWebLightSteelBlue

clWebMediumSlateBlue

clWebLightSlateGray

clWebWhite

clWebLightgrey

clWebGray

clWebSteelBlue

clWebSlateBlue

clWebSlateGray

clWebWhiteSmoke

clWebSilver

clWebDimGray

clWebMistyRose

clWebDarkSlateBlue

clWebDarkSlategray

clWebGainsboro

clWebDarkGray

clWebBlack

comctl32.dll

AutoHotkeysd-C

AutoHotkeys

\SYSTEM\CurrentControlSet\Control\Keyboard Layouts\

ssHotTrack

TWindowState

poProportional

TWMKey

KeyPreview

WindowState

OnKeyDownL

OnKeyPress

OnKeyUpH

GlassFrame.Bottom

GlassFrame.Enabled

GlassFrame.Left

GlassFrame.Right

GlassFrame.SheetOfGlass

GlassFrame.Top

System\CurrentControlSet\Control\Keyboard Layouts\%.8x

Uh.ID

User32.dll

TKeyEvent

TKeyPressEvent

HelpKeyword nA

crSQLWait

%s (%s)

imm32.dll

TSocketPort

%d.%d.%d.%d

0.0.0.0

PSAPI.dll

TDCWebCam

127.0.0.1

BuildImportTable: can't load library:

BuildImportTable: ReallocMemory failed

BuildImportTable: GetProcAddress failed

BTMemoryLoadLibary: BuildImportTable failed

BTMemoryGetProcAddress: no export table found

BTMemoryGetProcAddress: DLL doesn't export anything

BTMemoryGetProcAddress: exported symbol not found

1.2.3

127.0.0.1:1604

#KCMDDC51#-

5.3.0

cmd.exe

SOFTWARE\Microsoft\Windows\CurrentVersion\Run

hkey

\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders

*.torrent

\Internet Explorer\iexplore.exe

explorer.exe

wlanapi.dll

80211_SHARED_KEY

user32.dll

TUploadFTP

notepad.exe

KEYNAME

%ShortCut#

RELATEDCMD

ping 127.0.0.1 -n 4 > NUL && "

DRKey

CRKey

DelMSKey

InstallHKEY

ActiveOnlineKeylogger

UnActiveOnlineKeylogger

KeylogOn

ActiveOfflineKeylogger

UnActiveOfflineKeylogger

ActiveOnlineKeyStrokes

UnActiveOnlineKeyStrokes

OpenWebPage

tmpprint.txt

URLUpdate

MSGBOX

#BOT#VisitUrl

#BOT#OpenUrl

HTTP://

hXXp://

BTRESULTOpen URL|

Command successfully executed!|

#BOT#URLUpdate

BTERRORUpdate from URL| Error on downloading file check if you type the correct url...|

BTRESULTUpdate from URL|Update : File Downloaded , Executing new one in temp dir...|

#BOT#URLDownload

GetActivePorts

out.txt

tmp.txt

DDOSHTTPFLOOD

DDOSUDPFLOOD

%IPPORTSCAN

SAPI.SpVoice

WEBCAMLIVE

WEBCAMSTOP

PASSWORD

FTPFILEUPLOAD

URLDOWNLOADTOFILE

UPLOADEXEC

UPANDEXEC

FTPPORT

FTPPASS

FTPUSER

FTPHOST

FTPROOT

FTPUPLOADK

FTPSIZE

BTRESULTUDP Flood|UDP Flood task finished!|

PortScanAdd

BTRESULTVisit URL|finished to visit

BTERRORVisit URL|An exception occured in the thread|

POST /index.php/1.0

BTRESULTHTTP Flood|Http Flood task finished!|

Mozilla

BTRESULTDownload File|Mass Download : File Downloaded , Executing new one in temp dir...|

BTERRORDownload File| Error on downloading file check if you type the correct url...|

Software\Microsoft\Windows\CurrentVersion\Run

Software\Microsoft\Windows NT\CurrentVersion\Winlogon

ERR|Cannot listen to port, try another one..|

TCaptureWebcam

taskmgr.exe

\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall

\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\

DC3_FEXEC

Windows NT 4.0

Windows 2000

Windows XP

Windows Server 2003

Windows Vista

Windows 7

Windows 95

Windows 98

Windows Me

S-%u-

FAKEMSG

MSGICON

MSGTITLE

MSGCORE

deflate 1.2.3 Copyright 1995-2005 Jean-loup Gailly

inflate 1.2.3 Copyright 1995-2005 Mark Adler

%Documents and Settings%\%current user%\Application Data\dclogs\2016-02-20-7.dc

advapi32.dll

RegOpenKeyExA

RegCloseKey

GetKeyboardType

keybd_event

VkKeyScanA

UnhookWindowsHookEx

SetWindowsHookExA

MsgWaitForMultipleObjectsEx

MsgWaitForMultipleObjects

MapVirtualKeyA

LoadKeyboardLayoutA

GetKeyboardState

GetKeyboardLayoutNameA

GetKeyboardLayoutList

GetKeyboardLayout

GetKeyState

GetKeyNameTextA

ExitWindowsEx

EnumWindows

EnumThreadWindows

EnumChildWindows

ActivateKeyboardLayout

gdi32.dll

SetViewportOrgEx

version.dll

WinExec

PeekNamedPipe

GetWindowsDirectoryA

GetProcessHeap

GetCPInfo

CreatePipe

RegQueryInfoKeyA

RegOpenKeyA

RegFlushKey

RegEnumKeyExA

RegDeleteKeyA

RegCreateKeyExA

RegCreateKeyA

wsock32.dll

shell32.dll

ShellExecuteExA

ShellExecuteA

SHFileOperationA

URLMON.DLL

URLDownloadToFileA

wininet.dll

InternetOpenUrlA

HttpQueryInfoA

FtpPutFileA

winmm.dll

netapi32.dll

gdiplus.dll

GdiplusShutdown

msacm32.dll

ntdll.dll

WS2_32.DLL

SHFolder.dll

SHELL32.DLL

AVICAP32.DLL

1!1,1=1|1

6 6$6(6,606

=!=$=)=-=1=

01m1

0 0$0(0,0004080<0@0

<!=$=)=-=4=

;"<?<_<|<

; ;$;(;,;0;4;8;<;@;

7 8$888<8

= =$=(=,=0=4=8=

UntKeylogger

KWindows

UntActivePorts

UntControlKey

UntCaptureWebcam

UntWebCam

UrlMon

(UntUploadFTPThread

UntFTP

_UntUDPFlood

YUntScanPorts

0UntPasswordAndData

XUntHTTPFlood

UntCPU

66006666

No help found for %s#No context-sensitive help installed

No help found for context$No topic-based help system installedNUnable to retrieve a pointer to a running object registered with OLE for %s/%s

Invalid clipboard format Clipboard does not support Icons

Cannot open clipboard/Menu '%s' is already being used by another form

- Dock zone has no controlLError loading dock zone from the stream. Expecting version %d, but found %d.

OLE error %.8x.Method '%s' not supported by automation object/Variant does not reference an automation object7Dispatch methods do not support more than 64 parameters

Error creating window class Cannot focus a disabled or invisible window!Control '%s' has no parent window

Not enough timers available@GroupIndex cannot be less than a previous menu item's GroupIndex5Cannot create form. No MDI forms are currently active$%s not in a class registration group

Property %s does not exist

Thread creation error: %s

Thread Error: %s (%d)

Unsupported clipboard format

Invalid data type for '%s' List capacity out of bounds (%d)

List count out of bounds (%d)

List index out of bounds (%d) Out of memory while expanding memory stream

Error reading %s%s%s: %s

Failed to create key %s

Failed to get data for '%s'

Failed to set data for '%s'

Resource %s not found

%s.Seek not implemented$Operation not allowed on sorted list

Ancestor for '%s' not found

Cannot assign a %s to a %s

Bits index out of range*Can't write to a read-only resource streamECheckSynchronize called from thread $%x, which is NOT the main thread

Class %s not found

A class named %s already exists%List does not allow duplicates ($0%x)#A component named %s already exists%String list does not allow duplicates

Cannot create file "%s". %s

Cannot open file "%s". %s

Invalid stream format$''%s'' is not a valid component name

External exception %x

Interface not supported

%s (%s, line %d)

Abstract Error?Access violation at address %p in module '%s'. %s of address %p

System Error. Code: %d.

No argument for format '%s'"Variant method calls not supported

Invalid variant operation%Invalid variant operation (%s%.8x)

%s5Could not convert variant of type (%s) into type (%s)=Overflow while converting variant of type (%s) into type (%s)

Operation not supported

Integer overflow Invalid floating point operation

Invalid pointer operation

Invalid class typecast0Access violation at address %p. %s of address %p

Privileged instruction(Exception %s in module %s at %p.

Application Error1Format '%s' invalid or incompatible with argument

!'%s' is not a valid integer value('%s' is not a valid floating point value!'%s' is not a valid date and time

'%s' is not a valid GUID value

I/O error %d

1, 0, 0, 1

MSRSAAP.EXE

4, 0, 0, 0

csrss.exe_1820_rwx_00400000_000B2000:

.text

`.itext

`.data

.idata

.rdata

@.reloc

B.rsrc

kernel32.dll

Windows

MSWHEEL_ROLLMSG

MSH_WHEELSUPPORT_MSG

MSH_SCROLL_LINES_MSG

$*@@@*$@@@$ *@@* $@@($*)@-$*@@$-*@@$*-@@(*$)@-*$@@*-$@@*$-@@-* $@-$ *@* $-@$ *-@$ -*@*- $@($ *)(* $)

oleaut32.dll

EVariantBadIndexError

ssShift

htKeyword

EInvalidOperation

%s_%d

EInvalidGraphicOperation

SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontSubstitutes

%s, ClassID: %s

%s, ProgID: "%s"

ole32.dll

USER32.DLL

uxtheme.dll

DWMAPI.DLL

clWebSnow

clWebFloralWhite

clWebLavenderBlush

clWebOldLace

clWebIvory

clWebCornSilk

clWebBeige

clWebAntiqueWhite

clWebWheat

clWebAliceBlue

clWebGhostWhite

clWebLavender

clWebSeashell

clWebLightYellow

clWebPapayaWhip

clWebNavajoWhite

clWebMoccasin

clWebBurlywood

clWebAzure

clWebMintcream

clWebHoneydew

clWebLinen

clWebLemonChiffon

clWebBlanchedAlmond

clWebBisque

clWebPeachPuff

clWebTan

clWebYellow

clWebDarkOrange

clWebRed

clWebDarkRed

clWebMaroon

clWebIndianRed

clWebSalmon

clWebCoral

clWebGold

clWebTomato

clWebCrimson

clWebBrown

clWebChocolate

clWebSandyBrown

clWebLightSalmon

clWebLightCoral

clWebOrange

clWebOrangeRed

clWebFirebrick

clWebSaddleBrown

clWebSienna

clWebPeru

clWebDarkSalmon

clWebRosyBrown

clWebPaleGoldenrod

clWebLightGoldenrodYellow

clWebOlive

clWebForestGreen

clWebGreenYellow

clWebChartreuse

clWebLightGreen

clWebAquamarine

clWebSeaGreen

clWebGoldenRod

clWebKhaki

clWebOliveDrab

clWebGreen

clWebYellowGreen

clWebLawnGreen

clWebPaleGreen

clWebMediumAquamarine

clWebMediumSeaGreen

clWebDarkGoldenRod

clWebDarkKhaki

clWebDarkOliveGreen

clWebDarkgreen

clWebLimeGreen

clWebLime

clWebSpringGreen

clWebMediumSpringGreen

clWebDarkSeaGreen

clWebLightSeaGreen

clWebPaleTurquoise

clWebLightCyan

clWebLightBlue

clWebLightSkyBlue

clWebCornFlowerBlue

clWebDarkBlue

clWebIndigo

clWebMediumTurquoise

clWebTurquoise

clWebCyan

clWebPowderBlue

clWebSkyBlue

clWebRoyalBlue

clWebMediumBlue

clWebMidnightBlue

clWebDarkTurquoise

clWebCadetBlue

clWebDarkCyan

clWebTeal

clWebDeepskyBlue

clWebDodgerBlue

clWebBlue

clWebNavy

clWebDarkViolet

clWebDarkOrchid

clWebMagenta

clWebDarkMagenta

clWebMediumVioletRed

clWebPaleVioletRed

clWebBlueViolet

clWebMediumOrchid

clWebMediumPurple

clWebPurple

clWebDeepPink

clWebLightPink

clWebViolet

clWebOrchid

clWebPlum

clWebThistle

clWebHotPink

clWebPink

clWebLightSteelBlue

clWebMediumSlateBlue

clWebLightSlateGray

clWebWhite

clWebLightgrey

clWebGray

clWebSteelBlue

clWebSlateBlue

clWebSlateGray

clWebWhiteSmoke

clWebSilver

clWebDimGray

clWebMistyRose

clWebDarkSlateBlue

clWebDarkSlategray

clWebGainsboro

clWebDarkGray

clWebBlack

comctl32.dll

AutoHotkeysd-C

AutoHotkeys

\SYSTEM\CurrentControlSet\Control\Keyboard Layouts\

ssHotTrack

TWindowState

poProportional

TWMKey

KeyPreview

WindowState

OnKeyDownL

OnKeyPress

OnKeyUpH

GlassFrame.Bottom

GlassFrame.Enabled

GlassFrame.Left

GlassFrame.Right

GlassFrame.SheetOfGlass

GlassFrame.Top

System\CurrentControlSet\Control\Keyboard Layouts\%.8x

Uh.ID

User32.dll

TKeyEvent

TKeyPressEvent

HelpKeyword nA

crSQLWait

%s (%s)

imm32.dll

TSocketPort

%d.%d.%d.%d

0.0.0.0

PSAPI.dll

TDCWebCam

127.0.0.1

BuildImportTable: can't load library:

BuildImportTable: ReallocMemory failed

BuildImportTable: GetProcAddress failed

BTMemoryLoadLibary: BuildImportTable failed

BTMemoryGetProcAddress: no export table found

BTMemoryGetProcAddress: DLL doesn't export anything

BTMemoryGetProcAddress: exported symbol not found

1.2.3

127.0.0.1:1604

#KCMDDC51#-

5.3.0

cmd.exe

SOFTWARE\Microsoft\Windows\CurrentVersion\Run

hkey

\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders

*.torrent

\Internet Explorer\iexplore.exe

explorer.exe

wlanapi.dll

80211_SHARED_KEY

user32.dll

TUploadFTP

notepad.exe

KEYNAME

%ShortCut#

RELATEDCMD

ping 127.0.0.1 -n 4 > NUL && "

DRKey

CRKey

DelMSKey

InstallHKEY

ActiveOnlineKeylogger

UnActiveOnlineKeylogger

KeylogOn

ActiveOfflineKeylogger

UnActiveOfflineKeylogger

ActiveOnlineKeyStrokes

UnActiveOnlineKeyStrokes

OpenWebPage

tmpprint.txt

URLUpdate

MSGBOX

#BOT#VisitUrl

#BOT#OpenUrl

HTTP://

hXXp://

BTRESULTOpen URL|

Command successfully executed!|

#BOT#URLUpdate

BTERRORUpdate from URL| Error on downloading file check if you type the correct url...|

BTRESULTUpdate from URL|Update : File Downloaded , Executing new one in temp dir...|

#BOT#URLDownload

GetActivePorts

out.txt

tmp.txt

DDOSHTTPFLOOD

DDOSUDPFLOOD

%IPPORTSCAN

SAPI.SpVoice

WEBCAMLIVE

WEBCAMSTOP

PASSWORD

FTPFILEUPLOAD

URLDOWNLOADTOFILE

UPLOADEXEC

UPANDEXEC

FTPPORT

FTPPASS

FTPUSER

FTPHOST

FTPROOT

FTPUPLOADK

FTPSIZE

BTRESULTUDP Flood|UDP Flood task finished!|

PortScanAdd

BTRESULTVisit URL|finished to visit

BTERRORVisit URL|An exception occured in the thread|

POST /index.php/1.0

BTRESULTHTTP Flood|Http Flood task finished!|

Mozilla

BTRESULTDownload File|Mass Download : File Downloaded , Executing new one in temp dir...|

BTERRORDownload File| Error on downloading file check if you type the correct url...|

Software\Microsoft\Windows\CurrentVersion\Run

Software\Microsoft\Windows NT\CurrentVersion\Winlogon

ERR|Cannot listen to port, try another one..|

TCaptureWebcam

taskmgr.exe

\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall

\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\

DC3_FEXEC

Windows NT 4.0

Windows 2000

Windows XP

Windows Server 2003

Windows Vista

Windows 7

Windows 95

Windows 98

Windows Me

S-%u-

FAKEMSG

MSGICON

MSGTITLE

MSGCORE

deflate 1.2.3 Copyright 1995-2005 Jean-loup Gailly

inflate 1.2.3 Copyright 1995-2005 Mark Adler

%Documents and Settings%\%current user%\Application Data\dclogs\2016-02-20-7.dc

advapi32.dll

RegOpenKeyExA

RegCloseKey

GetKeyboardType

keybd_event

VkKeyScanA

UnhookWindowsHookEx

SetWindowsHookExA

MsgWaitForMultipleObjectsEx

MsgWaitForMultipleObjects

MapVirtualKeyA

LoadKeyboardLayoutA

GetKeyboardState

GetKeyboardLayoutNameA

GetKeyboardLayoutList

GetKeyboardLayout

GetKeyState

GetKeyNameTextA

ExitWindowsEx

EnumWindows

EnumThreadWindows

EnumChildWindows

ActivateKeyboardLayout

gdi32.dll

SetViewportOrgEx

version.dll

WinExec

PeekNamedPipe

GetWindowsDirectoryA

GetProcessHeap

GetCPInfo

CreatePipe

RegQueryInfoKeyA

RegOpenKeyA

RegFlushKey

RegEnumKeyExA

RegDeleteKeyA

RegCreateKeyExA

RegCreateKeyA

wsock32.dll

shell32.dll

ShellExecuteExA

ShellExecuteA

SHFileOperationA

URLMON.DLL

URLDownloadToFileA

wininet.dll

InternetOpenUrlA

HttpQueryInfoA

FtpPutFileA

winmm.dll

netapi32.dll

gdiplus.dll

GdiplusShutdown

msacm32.dll

ntdll.dll

WS2_32.DLL

SHFolder.dll

SHELL32.DLL

AVICAP32.DLL

1!1,1=1|1

6 6$6(6,606

=!=$=)=-=1=

01m1

0 0$0(0,0004080<0@0

<!=$=)=-=4=

;"<?<_<|<

; ;$;(;,;0;4;8;<;@;

7 8$888<8

= =$=(=,=0=4=8=

UntKeylogger

KWindows

UntActivePorts

UntControlKey

UntCaptureWebcam

UntWebCam

UrlMon

(UntUploadFTPThread

UntFTP

_UntUDPFlood

YUntScanPorts

0UntPasswordAndData

XUntHTTPFlood

UntCPU

66006666

No help found for %s#No context-sensitive help installed

No help found for context$No topic-based help system installedNUnable to retrieve a pointer to a running object registered with OLE for %s/%s

Invalid clipboard format Clipboard does not support Icons

Cannot open clipboard/Menu '%s' is already being used by another form

- Dock zone has no controlLError loading dock zone from the stream. Expecting version %d, but found %d.

OLE error %.8x.Method '%s' not supported by automation object/Variant does not reference an automation object7Dispatch methods do not support more than 64 parameters

Error creating window class Cannot focus a disabled or invisible window!Control '%s' has no parent window

Not enough timers available@GroupIndex cannot be less than a previous menu item's GroupIndex5Cannot create form. No MDI forms are currently active$%s not in a class registration group

Property %s does not exist

Thread creation error: %s

Thread Error: %s (%d)

Unsupported clipboard format

Invalid data type for '%s' List capacity out of bounds (%d)

List count out of bounds (%d)

List index out of bounds (%d) Out of memory while expanding memory stream

Error reading %s%s%s: %s

Failed to create key %s

Failed to get data for '%s'

Failed to set data for '%s'

Resource %s not found

%s.Seek not implemented$Operation not allowed on sorted list

Ancestor for '%s' not found

Cannot assign a %s to a %s

Bits index out of range*Can't write to a read-only resource streamECheckSynchronize called from thread $%x, which is NOT the main thread

Class %s not found

A class named %s already exists%List does not allow duplicates ($0%x)#A component named %s already exists%String list does not allow duplicates

Cannot create file "%s". %s

Cannot open file "%s". %s

Invalid stream format$''%s'' is not a valid component name

External exception %x

Interface not supported

%s (%s, line %d)

Abstract Error?Access violation at address %p in module '%s'. %s of address %p

System Error. Code: %d.

No argument for format '%s'"Variant method calls not supported

Invalid variant operation%Invalid variant operation (%s%.8x)

%s5Could not convert variant of type (%s) into type (%s)=Overflow while converting variant of type (%s) into type (%s)

Operation not supported

Integer overflow Invalid floating point operation

Invalid pointer operation

Invalid class typecast0Access violation at address %p. %s of address %p

Privileged instruction(Exception %s in module %s at %p.

Application Error1Format '%s' invalid or incompatible with argument

!'%s' is not a valid integer value('%s' is not a valid floating point value!'%s' is not a valid date and time

'%s' is not a valid GUID value

I/O error %d

1, 0, 0, 1

MSRSAAP.EXE

4, 0, 0, 0

Remove it with Ad-Aware

1. Click (here) to download and install Ad-Aware Free Antivirus.
2. Update the definition files.
3. Run a full scan of your computer.

Manual removal*

1. Terminate malicious process(es) (How to End a Process With the Task Manager):
   

   setup_wm.exe:2000
   kop.exe:1856
   wmplayer.exe:1936
   MegaHack.EXE:216
   MegaHack.EXE:1492
   MegaHack.EXE:1140
   kophack.exe:1752
   .Net_Framework.exe:1136
   .Net_Framework.exe:376
   Clear.exe:1316
   %original file name%.exe:856
   KopaT.exe:320
   

2. Delete the original Backdoor file.
   
3. Delete or disinfect the following files created/modified by the Backdoor:
   

   %Documents and Settings%\%current user%\Application Data\Microsoft\Windows\License\.Net_Framework.exe (9134 bytes)
   %Documents and Settings%\%current user%\Application Data\Microsoft\Windows\License\MegaHack.EXE (38184 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\cetrainers\CET1.tmp\extracted\speedhack-i386.dll (275 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\cetrainers\CET1.tmp\extracted\lua5.1-32.dll (563 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\cetrainers\CET1.tmp\extracted\CET_TRAINER.CETRAINER (5237 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\cetrainers\CET1.tmp\extracted\MegaHack.EXE (45699 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\cetrainers\CET1.tmp\extracted\defines.lua (4 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\cetrainers\CET1.tmp\extracted\win32\dbghelp.dll (4438 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\cetrainers\CET1.tmp\CET_Archive.dat (31790 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\cetrainers\CET1.tmp\MegaHack.EXE (192 bytes)
   %Documents and Settings%\%current user%\Application Data\Microsoft\Windows\License\Clear.exe (2961 bytes)
   %Documents and Settings%\%current user%\Application Data\Microsoft\Windows\License\vagner.mp3 (63989 bytes)
   %Documents and Settings%\%current user%\Application Data\Microsoft\Windows\License\starter.cmd (226 bytes)
   %Documents and Settings%\%current user%\Application Data\Microsoft\Windows\License\kop.exe (43201 bytes)
   %WinDir%\csrss.exe (7433 bytes)
   %Documents and Settings%\%current user%\Application Data\Windows.bat (78 bytes)
   %Documents and Settings%\%current user%\Application Data\Microsoft\Windows\License\KopaT.exe (109736 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\$inst\2.tmp (68 bytes)
   %Documents and Settings%\%current user%\Application Data\Microsoft\Windows\License\kophack.exe (228743 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\$inst\temp_0.tmp (47091 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\$inst\0001.tmp (28666 bytes)

4. Delete the following value(s) in the autorun key (How to Work with System Registry):
   

   [HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
   "WindowsNT" = "C:\Windows\csrss.exe"

5. Remove the references to the Backdoor by modifying the following registry value(s) (How to Work with System Registry):
   

   [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
   "UserInit" = "%System%\userinit.exe,C:\Windows\csrss.exe"

6. Reboot the computer.
   

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.