MD5: 78ce6a63d14369f8b1ee8d8652450638
SHA1: 44380025a6e004a3971178175318930f09cc01eb
SHA256: 91f3e31d4e20b58cb23780180ecc118dc9d8dc716dfb78fb914df613a17e318e
SSDeep: 49152:LE4KXe94D35OVGA0uXX4gcl/aZzqNEJvWE2B:Y4KuS36V1dXzqNE9
Size: 2510848 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: UPolyXv05_v6
Company:
Created at: 2017-08-16 07:27:39
Analyzed on: Windows7 SP1 32-bit

Summary:

Trojan-PSW. Trojan program intended for stealing users passwords.

Payload

No specific payload has been found.

Process activity

The Trojan creates the following process(es):
No processes have been created.
The Trojan injects its code into the following process(es):

%original file name%.exe:2572

Mutexes

The following mutexes were created/opened:
No objects were found.

File activity

The process %original file name%.exe:2572 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8D93UTC3\api[1].htm (31 bytes)
C:\login.ini (161 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\XR6QK9HV.txt (109 bytes)

Registry activity

The process %original file name%.exe:2572 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Tracing\78ce6a63d14369f8b1ee8d8652450638_RASAPI32]
"FileTracingMask" = "4294901760"
"EnableFileTracing" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKLM\SOFTWARE\Microsoft\Tracing\78ce6a63d14369f8b1ee8d8652450638_RASAPI32]
"FileDirectory" = "%windir%\tracing"
"EnableConsoleTracing" = "0"

[HKLM\SOFTWARE\Microsoft\Tracing\78ce6a63d14369f8b1ee8d8652450638_RASMANCS]
"EnableConsoleTracing" = "0"

[HKLM\SOFTWARE\Microsoft\Tracing\78ce6a63d14369f8b1ee8d8652450638_RASAPI32]
"ConsoleTracingMask" = "4294901760"

[HKLM\SOFTWARE\Microsoft\Tracing\78ce6a63d14369f8b1ee8d8652450638_RASMANCS]
"ConsoleTracingMask" = "4294901760"
"FileDirectory" = "%windir%\tracing"
"EnableFileTracing" = "0"
"FileTracingMask" = "4294901760"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 41 00 00 00 09 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Microsoft\Tracing\78ce6a63d14369f8b1ee8d8652450638_RASAPI32]
"MaxFileSize" = "1048576"

[HKLM\SOFTWARE\Microsoft\Tracing\78ce6a63d14369f8b1ee8d8652450638_RASMANCS]
"MaxFileSize" = "1048576"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"
"AutoConfigURL"

Dropped PE files

There are no dropped PE files.

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

VersionInfo

Company Name: UTX
Product Name: UTX
Product Version: 3.1.0.0
Legal Copyright: UTX ????
Legal Trademarks:
Original Filename:
Internal Name:
File Version: 3.1.0.0
File Description: UTX
Comments: UTX
Language: Language Neutral

PE Sections

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

URLs

URL	IP
hxxp://ver.jkb9.com/Notice.txt	162.159.211.38
hxxp://ver.jkb9.com/yz.txt	162.159.211.38
hxxp://web.w45.vhostgo.com/kss_api/api.php?a=uplog&apiver=903&c=0&gdata=1&softcode=1000004&&x=7069856
login1.jkb9.com	118.123.7.47

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

ET POLICY Unsupported/Fake Windows NT Version 5.0

Traffic

GET /kss_api/api.php?a=uplog&apiver=903&c=0&gdata=1&softcode=1000004&&x=7069856 HTTP/1.1

Accept: */*

Accept-Language: en-us

User-Agent: Mozilla/4.0  (compatible; MSiE 6.0; Windows NT 5.1;)

Accept-Encoding: gzip, deflate

Host: login1.jkb9.com

Connection: Keep-Alive

Cookie: __cfduid=d87bf5e2bbdfb6fd6e35bc13c378ee5561521826040

HTTP/1.1 200 OK

Date: Fri, 23 Mar 2018 17:27:25 GMT

Content-Type: text/html;charset=utf-8

Transfer-Encoding: chunked

Connection: keep-alive

X-Powered-By: PHP/5.2.17

X-Powered-By: ASP.NET

Server: wts/1.2

Content-Encoding: gzip
28...............NI,I4...2...... }} ..........a....2rp.......0..

GET /Notice.txt HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)

Accept: */*

Host: ver.jkb9.com

Cache-Control: no-cache

HTTP/1.1 200 OK

Date: Fri, 23 Mar 2018 17:27:22 GMT

Content-Type: text/plain

Content-Length: 134

Connection: keep-alive

Set-Cookie: __cfduid=d87bf5e2bbdfb6fd6e35bc13c378ee5561521826040; expires=Sat, 23-Mar-19 17:27:20 GMT; path=/; domain=.jkb9.com; HttpOnly

Last-Modified: Tue, 05 Dec 2017 05:53:53 GMT

Accept-Ranges: bytes

ETag: "eaae8c6e8d6dd31:0"

X-Powered-By: ASP.NET

Server: yunjiasu-nginx

CF-RAY: 40029bb422fb8249-KBP
helloworld[.........:...........................,.....................
...........]helloworld..<hXXp://login1.jkb9.com/u1w/banner.html>
....


GET /Notice.txt HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)

Accept: */*

Host: ver.jkb9.com

Cache-Control: no-cache

Cookie: __cfduid=d87bf5e2bbdfb6fd6e35bc13c378ee5561521826040

HTTP/1.1 200 OK

Date: Fri, 23 Mar 2018 17:27:22 GMT

Content-Type: text/plain

Content-Length: 134

Connection: keep-alive

Last-Modified: Tue, 05 Dec 2017 05:53:53 GMT

Accept-Ranges: bytes

ETag: "eaae8c6e8d6dd31:0"

X-Powered-By: ASP.NET

Server: yunjiasu-nginx

CF-RAY: 40029bbc74688249-KBP
helloworld[.........:...........................,.....................
...........]helloworld..<hXXp://login1.jkb9.com/u1w/banner.html>
HTTP/1.1 200 OK..Date: Fri, 23 Mar 2018 17:27:22 GMT..Content-Type: te
xt/plain..Content-Length: 134..Connection: keep-alive..Last-Modified: 
Tue, 05 Dec 2017 05:53:53 GMT..Accept-Ranges: bytes..ETag: "eaae8c6e8d
6dd31:0"..X-Powered-By: ASP.NET..Server: yunjiasu-nginx..CF-RAY: 40029
bbc74688249-KBP..helloworld[.........:...........................,....
............................]helloworld..<hXXp://login1.jkb9.com/u1
w/banner.html>....


GET /yz.txt HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)

Accept: */*

Host: ver.jkb9.com

Cache-Control: no-cache

Cookie: __cfduid=d87bf5e2bbdfb6fd6e35bc13c378ee5561521826040

HTTP/1.1 200 OK

Date: Fri, 23 Mar 2018 17:27:23 GMT

Content-Type: text/plain

Content-Length: 17

Connection: keep-alive

Last-Modified: Sun, 30 Apr 2017 03:37:12 GMT

Accept-Ranges: bytes

ETag: "06486d63c1d21:0"

X-Powered-By: ASP.NET

Server: yunjiasu-nginx

CF-RAY: 40029bbf64ff8249-KBP
fe16887c290d246caHTTP/1.1 200 OK..Date: Fri, 23 Mar 2018 17:27:23 GMT.
.Content-Type: text/plain..Content-Length: 17..Connection: keep-alive.
.Last-Modified: Sun, 30 Apr 2017 03:37:12 GMT..Accept-Ranges: bytes..E
Tag: "06486d63c1d21:0"..X-Powered-By: ASP.NET..Server: yunjiasu-nginx.
.CF-RAY: 40029bbf64ff8249-KBP..fe16887c290d246ca..

The Trojan connects to the servers at the folowing location(s):

.text

`.rdata

@.data

.vmp0

`.vmp1

.rsrc

;1#!3='! 

.MhdIQf?

.wesh

'1.tr>

-P}if

.SKnj

.WrvKWh5}

#9 9'=;1 9

t%SVh

t$(SSh

~%UVW

u$SShe

kernel32.dll

ole32.dll

advapi32.dll

shlwapi.dll

dbghelp.dll

ntdll.dll

user32.dll

KERNEL32.DLL

oleaut32.dll

MsgWaitForMultipleObjects

MapVirtualKeyA

RegOpenKeyA

RegEnumKeyA

RegCloseKey

RegOpenKeyExA

273906463

agent_check.php?n=

\login.ini

@hXXp://ver.jkb9.com/

Notice.txt

hXXp://login1.jkb9.com/

hXXp://login12.jkb9.com/

1970-1-1 00:00:01

MSXML2.XMLHTTP

Microsoft.XMLHTTP

Can't create XMLHTTP connection object

Mozilla/4.0 (compatible; MSiE 6.0; Windows NT 5.1;)

application/x-www-form-urlencoded

errmsg_s

password

yz.txt

x.yvr

x.yvkd

\data\setsoft.ini

\update.exe

lkpy.exe

&?%SJ(

a~Å/`

\wJ$#.bre

#Tw%C

.QDp*

%S. z

.IYc#p'%|

<.DW:

%Cq{'

.dLs<

Cy%UR

FRE9tCP

@Uf.Ab

n{1*C%d

g.hPlAz

r.qLE6:a

.yji J*

comctl32.dll

gdi32.dll

version.dll

wsock32.dll

rsadll.dll

001A2B3C4D5Ec:\kss.ini

SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkCards\

ServiceName\\.\

dm.dll

!!"#$%&'())?

%C%]uSj

Ha.QE

xCmD$L

s.Nd)

A_%.ID,

n.Nn0 b

.hh=@-

T8.Sz

.dTR0

.PWh=j

nL.nP?

webH

NQt%F

.XV LV#

PGPus(.Gz

.ROH=

]v%UO

uù u

0k00[ `.kh#

.scwX

?456789:;<=

!"#$%&'()* ,-./0123

CxImage 6.0.0

deflate 1.2.3 Copyright 1995-200d

a .WO<t

e processors when executed

>support g

X:

UxTheme.dll

;9HttpCli

7.PAVCExcep=^

.1.2600.441~

PSAPI.DLLU%f

%u%x-

88.185.3

20 4.49.

0.4.10n

129.6.15.29

202.120.

\.\%c

g%s#$A

"LuCBy%d

./*.bmp

log.tx

cpublic.inject.type.54

LL keypadput

k.ap*

.=.minmax

x.cfake`?

defense.szX

.sel/O

on.Leve

mp7%ss

tCPo

wKeyboardD

Scsi%d:

H%d_%

1.2.24

%ct t

: %s=

= (%d/10

gx=%f, gy

%ld, pass

xkey

'%ds=

3%u B

orm.de6

`O%dhx%dv qV

FD=%u, "

'z %4u

iY;kUnkeY

%ld%c$

-t.SSSj

MSVCRT

ntoskrnl.exQ

8)939@9|9

#&$&@'!?

9}%U}

3(Ýd

6,?-.7?`

SAPI.DLLK04e

506:6?6[

8(83888?

>,?0?4?8?<?

.net4x7

.Crz03

hÕ@e

:;.ofSb

R.of'z

B{.zS,y

6o.ob#

Ftpf

PIpE

.Sj_^

.vCb'PK

WlCmd

l%u$}0

Jy%s2;J

x-d}X

_~.SO

'.Sj?

.Increm

WinExe&Copy

.DIBi

uDPtoLPNq`n

fo@@UAE@XZ.on

ad.boa

.DD-?J8

1,//2/,/

7G#V%F

(.text

@.tp0

{43C6DBBB-BEAD-4DFB-B6D2-52C5CDB5B70A} = s 'Dm'

'Dm.EXE'

val AppID = s {43C6DBBB-BEAD-4DFB-B6D2-52C5CDB5B70A}

dm.dmsoft = s 'dm.dmsoft'

CLSID = s '{26037A0E-7CBD-4FFF-9C63-56F2D0770214}'

CurVer = s 'dm.dmsoft'

ForceRemove {26037A0E-7CBD-4FFF-9C63-56F2D0770214} = s 'dm.dmsoft'

ProgID = s 'dm.dmsoft'

stdole2.tlbWWW

~cmdWd

KeyPress

.aKeyDownWd

MKeyUpWWWd

ShowScrMsgWW

msgWd

SetShowErrorMsgW

>SGetWindowStateWW

U@SetWindowSizeWWWd

SetWindowStateWWd

iRSetKeypadDelayWWd

BkeypadWW

SetExportDictWWWd

keyWd

FindWindowSuperW

qHKeyDownCharW

pOkey_strWd

KeyUpCharWWWd

KeyPressChard

KeyPressStrWd

EnableKeypadPatchWWWd

=PEnableKeypadSyncd

EnableRealKeypadd

GetKeyStateWd

[.ReadFiled

WaitKeyW

!key_coded

joEnumWindowSuperW

urlW

=EnableKeypadMsgWd

EnableMouseMsgWWd

method KeyPressWWW

method KeyDown

method KeyUpWW

method ShowScrMsgW

method SetShowErrorMsg

method GetWindowStateW

method SetWindowSizeWW

method SetWindowStateW

method SetKeypadDelayW

method SetExportDictWW

method FindWindowSuper

method KeyDownChar

method KeyUpCharWW

method KeyPressCharWWW

method KeyPressStr

method EnableKeypadPatchWW

method EnableKeypadSyncWWW

method EnableRealKeypadWWW

method GetKeyState

method WaitKey

method EnumWindowSuper

method EnableKeypadMsg

method EnableMouseMsgW

ADVAPI32.dll

GDI32.dll

IMM32.dll

MFC42.DLL

MSVCRT.dll

OLEAUT32.dll

SHELL32.dll

USER32.dll

VERSION.dll

WINMM.dll

WS2_32.dll

\dm.dll

dm.dmsoft

1970.01.01 08:00:00

function timea(){var d,s;d=new Date();d.setTime('

KeyDown

KeyUp

ShowScrMsg

SetShowErrorMsg

GetWindowState

SetWindowSize

SetWindowState

SetKeypadDelay

SetExportDict

FindWindowSuper

KeyDownChar

KeyUpChar

KeyPressChar

KeyPressStr

EnableKeypadPatch

EnableKeypadSync

EnableRealKeypad

GetKeyState

WaitKey

EnumWindowSuper

EnableKeypadMsg

EnableMouseMsg

:1234567891011

hXXp://VVV.u1w.net/down/video/

C:\jjhyaot\

999999999

5000000

hXXp://VVV.u1w.net/soft.html

%d&&'

123456789

00003333

deflate 1.1.3 Copyright 1995-1998 Jean-loup Gailly

inflate 1.1.3 Copyright 1995-1998 Mark Adler

%*.*f

CNotSupportedException

commctrl_DragListMsg

Afx:%x:%x:%x:%x:%x

Afx:%x:%x

COMCTL32.DLL

CCmdTarget

__MSVCRT_HEAP_SELECT

Broken pipe

Inappropriate I/O control operation

Operation not permitted

iphlpapi.dll

SHLWAPI.dll

MPR.dll

-P}E`x8

%UU/`

WSOCK32.dll

{9 %CG

.PAVCException@@

.PAVCNotSupportedException@@

.PAVCFileException@@

(*.prn)|*.prn|

(*.*)|*.*||

Shell32.dll

Mpr.dll

Advapi32.dll

User32.dll

Gdi32.dll

Kernel32.dll

(&07-034/)7 '

?? / %d]

%d / %d]

: %d]

(*.WAV;*.MID)|*.WAV;*.MID|WAV

(*.WAV)|*.WAV|MIDI

(*.MID)|*.MID|

(*.txt)|*.txt|

(*.JPG;*.PNG;*.BMP;*.GIF;*.ICO;*.CUR)|*.JPG;*.PNG;*.BMP;*.GIF;*.ICO;*.CUR|JPG

(*.JPG)|*.JPG|PNG

(*.PNG)|*.PNG|BMP

(*.BMP)|*.BMP|GIF

(*.GIF)|*.GIF|

(*.ICO)|*.ICO|

(*.CUR)|*.CUR|

%s:%d

windows

1.6.9

unsupported zlib version

png_read_image: unsupported transformation

out.prn

%d.%d

%d / %d

%d/%d

Bogus message code %d

libpng error: %s

libpng warning: %s

1.1.3

bad keyword

libpng does not support gamma background rgb_to_gray

Palette is NULL in indexed image

(%d-%d):

%ld%c

VVV.dywt.com.cn

msctls_hotkey32

(*.htm;*.html)|*.htm;*.html

%d%d%d

rundll32.exe shell32.dll,

Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)

HTTP/1.0

%s <%s>

Reply-To: %s

From: %s

To: %s

Subject: %s

Date: %s

Cc: %s

%a, %d %b %Y %H:%M:%S

SMTP

;3 #>6.&

'2, / 0&7!4-)1#

.PAVCOleException@@

.PAVCObject@@

.PAVCSimpleException@@

.PAVCMemoryException@@

.?AVCNotSupportedException@@

.PAVCResourceException@@

.PAVCUserException@@

.?AVCCmdTarget@@

.?AVCCmdUI@@

.?AVCTestCmdUI@@

.PAVCOleDispatchException@@

.PAVCArchiveException@@

zcÁ

<hXXp://login1.jkb9.com/u1w/banner.html>

c:\%original file name%.exe

""b%s,

%ug$zD

UOugakEyoE[d9q

@1keYC

icykeYW~

|b.tA

.VHtfF

B.HK\

.gew}

j.GmY{iKnFT^{s

6,>,* >$

w5.Gbz

.mwO?

%.WIS

yc)

`j.GM#

)9 = 4)=?

ÚaDh

.yD|K:

:(.$>,"8

Y%XB$.

@j.awE,

keY[I_SU_ewY[

om.pr

.mZ?0eJ

Yd1.pZ

kEyo

Úy\tQY

.Ox%m

.ASvn

.lh`)

Su.pV

.yb(^1C

%XuyK

@U.Rn7$

.KV^i

>V9#.xj

:$>,>$68"(

-Da}P|

0*$>,>82

7- !#1/5

kEycW}w

.GMh`Z

7-'5/= '

M*%Dg

Ú}5

.AW}_|Q

*0"$.84>,2

=/9$0-9;

-P}mZ

Udp?Qu[vZr

!.KVB@

.<. :<6<

.<.$6(2$(2 "

$>$64&(2

i.gik

.wRbG_

kykeYwmkGU

l!.VHa

.Wr^a

5;!#17='

%uWtq

/5'5 1/5 )

5!.wRvKGx5

4: :(>20"

.zKw^

).Vd06

(:$><.<.$6

.oJBu

purl

_UGsykEySA_EKwEqW{E

-sYKEy

.oJ^&

!.WL'

KEyGE

-?1 !3%<

><.,>828

$.<"86,:60:

.GbNq

I}WcmD

.mH@eyF

u.yD`

ÚYn

{|b.aC

m.oi,

.EKHLc.

;1#-75'1=/='

!35?1 5/-

.gBJoS

Úql

.MhPuUphKJ

KeYGl6emk

QCasqcEOqkeYSY

HBvH.emkW]j

.Ojj]

KEySgUGycEW

.eqlHue

0"(: 24>,

34.<*&<.<

hK%uy

1#!3%s

.CnvA<

p#1'<.Hy

: >$>,:60

5!.Wrf

_keYwmw}

'5'%7-?1 !3

kEy{ici

?-#9 9#1' 

6<:0>$>,

:("0*8*8

:.iv%

ÚqK

ShellExecuteA

RegisterHotKey

SetWindowsHookExA

WINSPOOL.DRV

MSIMG32.dll

UnregisterHotKey

RASAPI32.dll

ykEyG

COMCTL32.dll

RegCreateKeyExA

%x|dM

VaQ.ry

yq.Dj

Yo,d%s

3TCPH

7; .dQ6t

%uIzB$

%xi`d

8K.xw

.fxnf

.kV`J

Z:I%d

t'b#%f

.Qx65

s0.EU

W&%xi

web;h

&V$.Wt

R4%d~

'~Y%f

;S/~%d

px'd

.ko"\

Sz.am1

8H`-%X!

x]!%f

Kx.BPFI

&0.psf

-%S"b

(.wEJ 

{".gR

ZB%Cg

L&:%D

>{m-u}

r#^".ab

.aEi_

!%c)d|

.tf`H2qg

P.td"

$.Dndf

n%nE.en

%UBCR

%X=}`

.dKh$

.uD %

=.GXm

.a%x;>

NF.he

.Bha*

mBKþ

.tUf{

W\þ

i.fsY

.UMdR

h!.GK

d%c`;

K%.xf

cb'%c

 /)-("<.

C9d!4%X/

%UQ%!%

û#l

g"%.ce.Pd

CreateDialogIndirectParamA

SetViewportOrgEx

GetViewportExtEx

HttpOpenRequestA

OffsetViewportOrgEx

SetViewportExtEx

EnumChildWindows

.cC,#

HttpSendRequestA

UnhookWindowsHookEx

KERNEL32.dll

{C-!%C

693 %s

b1%ue$M

)KEY \

.zt;X

.KSxV

&.Xz(

i%U[%[

hi.vk

O.qrg{\

(.GE;A

_s.Kz.^

%CYlc,[_

K<8

I:)%U

/-Jh}

ek%D`j

.RS!;

%CV/"

9'B%2Uf"

%C-2K

O%F[&

Sx.BP

%C#RA

F".fdWR

q?.Vq

.CSb:

r4%3x

.`[kr.Lc4

s-Y1}

InternetCanonicalizeUrlA

EnumThreadWindows

GetViewportOrgEx

ScaleViewportExtEx

RNý;

Q.EdZI

[.my-n

>%xKf

=.fE$

xS0D%U

.VMr!

_%.be

ùs~

zdp%F

2V6%d

%un:G

F-Mr}C~

Y'%xtL

v,z&%c

I#.uz

T%fLC

&].uG!

>Xý

.Fo,f

V%uWZ

0[%Cz

.Pg'/

H-?.Pz$

vy%dv

R:%Uveg

].pFY

?q2%SB

d"%u`

|%x20

.xxD4q

Wr$Tk:AJ%S

%Xk<T

%'.gg

2n.Xi

L.gwlH

H%UW(

.tofq

comdlg32.dll

GetProcessHeap

GetCPInfo

InternetCrackUrlA

WININET.dll

HttpQueryInfoA

=.GyTtQiL

6Cfoledlg.dll

WinExec

<?xml version="1.0" encoding="UTF-8" standalone="yes"?><assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"><assemblyIdentity name="E.App" processorArchitecture="x86" version="5.2.0.0" type="win32"/><dependency><dependentAssembly><assemblyIdentity type="win32" name="Microsoft.Windows.Common-Controls" version="6.0.0.0" processorArchitecture="x86" publicKeyToken="6595b64144ccf1df" language="*" /></dependentAssembly></dependency></assembly>

#include "l.chs\afxres.rc" // Standard components

3, 1233, 0, 0

3.1.0.0

(*.*)

%original file name%.exe_2572_rwx_00709000_00001000:

WS2_32.dll

ykEyG

WINMM.dll

%original file name%.exe_2572_rwx_01750000_00072000:

`.rsrc

kernel32.dll

Windows

MSWHEEL_ROLLMSG

MSH_WHEELSUPPORT_MSG

MSH_SCROLL_LINES_MSG

$*@@@*$@@@$ *@@* $@@($*)@-$*@@$-*@@$*-@@(*$)@-*$@@*-$@@*$-@@-* $@-$ *@* $-@$ *-@$ -*@*- $@($ *)(* $)

USER32.DLL

oleaut32.dll

EVariantBadIndexError

ssShift

htKeyword

EInvalidOperation

u%CNu

%s_%d

EInvalidGraphicOperation

comctl32.dll

uxtheme.dll

MAPI32.DLL

!"#$%xiw

IE(AL("%s",4),"AL(\"%0:s\",3)","JK(\"%1:s\",\"%0:s\")")

JumpID("","%s")

ssHotTrack

TWindowState

poProportional

TWMKey

KeyPreview

WindowState

OnKeyDown

OnKeyPressl

OnKeyUp

System\CurrentControlSet\Control\Keyboard Layouts\%.8x

Uh%.x

vcltest3.dll

User32.dll

AutoHotkeys

TMainMenuDpx

TKeyEvent

TKeyPressEvent

HelpKeyword,

crSQLWait

%s (%s)

imm32.dll

readnowid.mtx

D:\ksreg_delphi\V9\_rsa_delphi_dll\UnitSock.pas

333333333333333333

33333833

3333339

3333333333333338

:*"*"$3338

3333333

33333333

33333333333

3333333333338

33338?383

333333333333

:*3:"$3338

333333333333333

KWindows

UrlMon

GetCPInfo

RegOpenKeyExA

RegCloseKey

SetViewportOrgEx

UnhookWindowsHookEx

SetWindowsHookExA

MapVirtualKeyA

LoadKeyboardLayoutA

GetKeyboardState

GetKeyboardLayoutList

GetKeyboardLayout

GetKeyState

GetKeyNameTextA

EnumWindows

EnumThreadWindows

ActivateKeyboardLayout

GetKeyboardType

38000=344

.idata

.edata

P.reloc

P.rsrc

KERNEL32.DLL

advapi32.dll

gdi32.dll

user32.dll

version.dll

wsock32.dll

rsadll.dll

No help keyword specified.

No help found for %s#No context-sensitive help installed$No topic-based help system installed

Alt  Clipboard does not support Icons/Menu '%s' is already being used by another form

Error creating window class Cannot focus a disabled or invisible window!Control '%s' has no parent window

Resource %s not found

%s.Seek not implemented$Operation not allowed on sorted list$%s not in a class registration group

Property %s does not exist

Unsupported clipboard format

Class %s not found

A class named %s already exists%List does not allow duplicates ($0%x)#A component named %s already exists%String list does not allow duplicates

Cannot create file "%s". %s

Cannot open file "%s". %s

Invalid stream format$''%s'' is not a valid component name

Invalid property value List capacity out of bounds (%d)

List count out of bounds (%d)

List index out of bounds (%d) Out of memory while expanding memory stream

Error reading %s%s%s: %s

Ancestor for '%s' not found

Cannot assign a %s to a %s

Bits index out of range*Can't write to a read-only resource streamECheckSynchronize called from thread $%x, which is NOT the main thread

%s (%s, line %d)

Abstract Error?Access violation at address %p in module '%s'. %s of address %p

System Error. Code: %d.

Invalid variant operation%Invalid variant operation (%s%.8x)

%s5Could not convert variant of type (%s) into type (%s)=Overflow while converting variant of type (%s) into type (%s)

Operation not supported

External exception %x

Interface not supported

Invalid pointer operation

Invalid class typecast0Access violation at address %p. %s of address %p

Privileged instruction(Exception %s in module %s at %p.

Application Error1Format '%s' invalid or incompatible with argument

No argument for format '%s'"Variant method calls not supported

!'%s' is not a valid integer value

I/O error %d

Integer overflow Invalid floating point operation

Remove it with Ad-Aware

1. Click (here) to download and install Ad-Aware Free Antivirus.
2. Update the definition files.
3. Run a full scan of your computer.

Manual removal*

1. Terminate malicious process(es) (How to End a Process With the Task Manager):No processes have been created.
2. Delete the original Trojan file.
   
3. Delete or disinfect the following files created/modified by the Trojan:
   

   C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8D93UTC3\api[1].htm (31 bytes)
   C:\login.ini (161 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\XR6QK9HV.txt (109 bytes)

4. Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
   
5. Reboot the computer.
   

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.