MD5: f663e0bb08ef761c493659078a47dbca
SHA1: d62cc1bcb448565751a2705180e4114117ac6be4
SHA256: 663f4dacf9f80ca04cdd1af1bb356c201e85e439d31ec984311b57bb4b454694
SSDeep: 12288:i9GcukRNfj9O0JL61VZ0VEqx7Cb0vjLa8981L9r00rnY5I:adjj99JL6zeVjj2Ss9IjS
Size: 612312 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: MicrosoftVisualC, MicrosoftVisualCv50v60MFC, MicrosoftVisualC50, Armadillov171, UPolyXv05_v6
Company: Premium Installer
Created at: 1991-11-15 13:03:21
Analyzed on: WindowsXP SP3 32-bit

Summary:

Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).

Payload

No specific payload has been found.

Process activity

The Trojan creates the following process(es):

attrib.exe:1724
%original file name%.exe:1756

The Trojan injects its code into the following process(es):

icardagt.exe:340
Explorer.EXE:1572

Mutexes

The following mutexes were created/opened:
No objects were found.

File activity

The process %original file name%.exe:1756 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\2d17e659d34601689591 (67 bytes)
%Documents and Settings%\All Users\Application Data\bd00b4j6bf.exe (4185 bytes)

The process icardagt.exe:340 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\desktop.ini (159 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\C8AOUZ1F\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\NTUSER.DAT.LOG (7824 bytes)
%Documents and Settings%\%current user%\NTUSER.DAT (6508 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\H2HRBYMJ\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\GXYBO5UR\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\R5AZOTYN\desktop.ini (67 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\2d17e659d34601689591 (0 bytes)

Registry activity

The process attrib.exe:1724 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "A4 92 01 4D 6B 42 59 4D B1 97 39 A2 EA D6 40 20"

The process %original file name%.exe:1756 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "1B 46 61 39 ED B5 61 CD 0E D6 4B 97 75 A4 E0 46"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\D:]
"2680782998.bat" = "2680782998"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass" = "1"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

"IntranetName" = "1"

The process icardagt.exe:340 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1B 00 00 00 01 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "81 12 22 AA FF DB B7 C7 E8 BF 93 FE 97 30 27 C0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Keyboard]
"2d17e6" = "73 A5 FF C7 F6 1B F6 C7 5C AE 44 EB 46 A5 FF 2C"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"IntelPowerAgent64" = "rundll32.exe shell32.dll, ShellExec_RunDLL C:\DOCUME~1\ALLUSE~1\APPLIC~1\BD00B4~1.EXE"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

Dropped PE files

There are no dropped PE files.

HOSTS file anomalies

No changes have been detected.

Rootkit activity

The Trojan installs the following user-mode hooks in CRYPT32.dll:

PFXImportCertStore

The Trojan installs the following user-mode hooks in WININET.dll:

HttpSendRequestExA
HttpSendRequestW
InternetSetStatusCallbackW
InternetReadFileExA
InternetWriteFileExA
InternetSetStatusCallback
InternetQueryDataAvailable
HttpSendRequestExW
InternetReadFile
HttpSendRequestA
InternetCloseHandle

The Trojan installs the following user-mode hooks in USER32.dll:

GetClipboardData
SendInput
GetMessageA
CreateDialogParamW
GetMessageW
TranslateMessage

The Trojan installs the following user-mode hooks in ADVAPI32.dll:

CryptEncrypt

The Trojan installs the following user-mode hooks in WS2_32.dll:

WSASend
recv
gethostbyname
WSARecv
send
getaddrinfo

The Trojan installs the following user-mode hooks in kernel32.dll:

CreateProcessInternalW
LoadLibraryExW

The Trojan installs the following user-mode hooks in ntdll.dll:

RtlGetNativeSystemInformation
NtQueryInformationProcess

Propagation

VersionInfo

Company Name:
Product Name:
Product Version:
Legal Copyright:
Legal Trademarks:
Original Filename:
Internal Name:
File Version:
File Description:
Comments:
Language: Language Neutral

PE Sections

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Total found: 18
e03fc730c82a946c8bae47b8ee170482
c79d637339fd7facceabb88f47e93d4b
a3f203a4d0edfb4551d276d1e619150d
ad4a834e856901913762b72f2bc3abd0
72c2e6526d655fcb60a42c38b43eed95
5b922b453379bff49411ccfeeec12b57
907b9edff1063388a7b47455cc8de7ce
23eb5914772fbbc6ece6f181944c82c3
e6fc8d256cd02772b550d8de91f999a8
730d67807e2e4020583415b48f3071e1
cbdf45b834e63323319177d67dc2304c
07353a1878f0389cfeab1bf36c58a36e
fb115bb2cc8df01a5751f65c4241c5e9
1180b5ef7dd644e2642bc14441822ab0
a8c9e42457796d3ed873acc587b4a9bb
42bc26f94ff8f53c9e8f7506ce41f605
25823f6fc96a6ff4f2c93178eda92910
245bb7064c60c6763feae00413afc8f8

URLs

URL	IP
download.windowsupdate.com	213.155.152.146
www.microsoft.com	23.64.223.148

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

The Trojan connects to the servers at the folowing location(s):

.text

`.data

.rsrc

f:\dd\ndp\indigo\src\infocard\agent\common.cpp

f:\dd\ndp\indigo\src\infocard\agent\desktop.h

f:\dd\ndp\indigo\src\infocard\agent\agentmodule.cpp

f:\dd\ndp\indigo\src\infocard\agent\crypthash.cpp

f:\dd\ndp\indigo\src\infocard\agent\claim.cpp

f:\dd\ndp\indigo\src\infocard\agent\infocard.cpp

f:\dd\ndp\indigo\src\infocard\agent\recipient.cpp

f:\dd\ndp\indigo\src\infocard\agent\uiagent.cpp

f:\dd\ndp\indigo\src\infocard\agent\asyncrequest.h

f:\dd\ndp\indigo\src\infocard\agent\agentservicerequest.h

f:\dd\ndp\indigo\src\infocard\agent\asynccreatesecuritytokenrequest.h

f:\dd\ndp\indigo\src\infocard\agent\userpreference.cpp

f:\dd\ndp\indigo\src\infocard\agent\deletecardrequest.cpp

f:\dd\ndp\indigo\src\infocard\agent\getcertificaterequest.cpp

f:\dd\ndp\indigo\src\infocard\agent\roundrectanglematrix.cpp

f:\dd\ndp\indigo\src\infocard\agent\fontmanager.cpp

f:\dd\ndp\indigo\src\infocard\agent\imagebase.cpp

f:\dd\ndp\indigo\src\infocard\agent\cardimage.cpp

f:\dd\ndp\indigo\src\infocard\agent\card.cpp

f:\dd\ndp\indigo\src\infocard\agent\backbuttoncontrolimpl.cpp

f:\dd\ndp\indigo\src\infocard\agent\control.h

f:\dd\ndp\indigo\src\infocard\agent\commandlinkcontrolimpl.cpp

f:\dd\ndp\indigo\src\infocard\agent\syslinkcontrolimpl.cpp

f:\dd\ndp\indigo\src\infocard\agent\certificatecontrol.cpp

f:\dd\ndp\indigo\src\infocard\agent\certificateviewer.cpp

f:\dd\ndp\indigo\src\infocard\agent\claimseditor.h

f:\dd\ndp\indigo\src\infocard\agent\claimseditor.cpp

f:\dd\ndp\indigo\src\infocard\agent\headercontrol.h

f:\dd\ndp\indigo\src\infocard\agent\utility.h

f:\dd\ndp\indigo\src\infocard\agent\imagelist.h

f:\dd\ndp\indigo\src\infocard\agent\gdiobject.h

f:\dd\ndp\indigo\src\infocard\agent\cardlistcontrol.cpp

f:\dd\ndp\indigo\src\infocard\agent\contextcontrol.cpp

f:\dd\ndp\indigo\src\infocard\agent\listviewcontrol.cpp

f:\dd\ndp\indigo\src\infocard\agent\richeditcontrol.cpp

f:\dd\ndp\indigo\src\infocard\agent\pagecontrol.cpp

f:\dd\ndp\indigo\src\infocard\agent\taskcontrol.cpp

f:\dd\ndp\indigo\src\infocard\agent\shutdowndialog.cpp

f:\dd\ndp\indigo\src\infocard\agent\monitorwindow.cpp

f:\dd\ndp\indigo\src\infocard\agent\monitorwindows.cpp

f:\dd\ndp\indigo\src\infocard\agent\page.cpp

f:\dd\ndp\indigo\src\infocard\agent\checkboxcontrol.h

f:\dd\ndp\indigo\src\infocard\agent\carddetailpage.cpp

f:\dd\ndp\indigo\src\infocard\agent\menu.h

f:\dd\ndp\indigo\src\infocard\agent\cardpickerpage.cpp

f:\dd\ndp\indigo\src\infocard\agent\credentialspage.cpp

f:\dd\ndp\indigo\src\infocard\agent\credentialcardpage.cpp

f:\dd\ndp\indigo\src\infocard\agent\certificatecredentialpage.cpp

f:\dd\ndp\indigo\src\infocard\agent\recipientinformationcontrol.cpp

f:\dd\ndp\indigo\src\infocard\agent\deletecardpage.cpp

f:\dd\ndp\indigo\src\infocard\agent\editcardpage.cpp

f:\dd\ndp\indigo\src\infocard\agent\importcardpage.cpp

f:\dd\ndp\indigo\src\infocard\agent\lockcodepage.cpp

f:\dd\ndp\indigo\src\infocard\agent\networkaccesspage.cpp

f:\dd\ndp\indigo\src\infocard\agent\pinpage.cpp

f:\dd\ndp\indigo\src\infocard\agent\policypage.cpp

f:\dd\ndp\indigo\src\infocard\agent\commandlinkcontrol.h

f:\dd\ndp\indigo\src\infocard\agent\rippage.cpp

f:\dd\ndp\indigo\src\infocard\agent\selectcardspage.cpp

f:\dd\ndp\indigo\src\infocard\agent\authenticationstate.cpp

f:\dd\ndp\indigo\src\infocard\agent\authenticationwindowstate.h

f:\dd\ndp\indigo\src\infocard\agent\carddetailstate.cpp

f:\dd\ndp\indigo\src\infocard\agent\mainwindowstate.h

f:\dd\ndp\indigo\src\infocard\agent\cardnotselectedstate.cpp

f:\dd\ndp\indigo\src\infocard\agent\cardpickerstate.cpp

f:\dd\ndp\indigo\src\infocard\agent\cardselectedstate.cpp

f:\dd\ndp\indigo\src\infocard\agent\changepinstate.cpp

f:\dd\ndp\indigo\src\infocard\agent\copycardstate.cpp

f:\dd\ndp\indigo\src\infocard\agent\createtokenstate.cpp

f:\dd\ndp\indigo\src\infocard\agent\credentialsstate.cpp

f:\dd\ndp\indigo\src\infocard\agent\deletecardstate.cpp

f:\dd\ndp\indigo\src\infocard\agent\editcardstate.cpp

f:\dd\ndp\indigo\src\infocard\agent\exportselectstate.cpp

f:\dd\ndp\indigo\src\infocard\agent\exportpasswordstate.cpp

f:\dd\ndp\indigo\src\infocard\agent\exportfilestate.cpp

f:\dd\ndp\indigo\src\infocard\agent\gettokenstate.cpp

f:\dd\ndp\indigo\src\infocard\agent\importstate.cpp

f:\dd\ndp\indigo\src\infocard\agent\importcardstate.cpp

f:\dd\ndp\indigo\src\infocard\agent\importcardpolicystate.cpp

f:\dd\ndp\indigo\src\infocard\agent\importpasswordstate.cpp

f:\dd\ndp\indigo\src\infocard\agent\importselectstate.cpp

f:\dd\ndp\indigo\src\infocard\agent\lockcardstate.cpp

f:\dd\ndp\indigo\src\infocard\agent\managestate.cpp

f:\dd\ndp\indigo\src\infocard\agent\newcardstate.cpp

f:\dd\ndp\indigo\src\infocard\agent\removepinstate.cpp

f:\dd\ndp\indigo\src\infocard\agent\ripstate.cpp

f:\dd\ndp\indigo\src\infocard\agent\topstate.cpp

f:\dd\ndp\indigo\src\infocard\agent\unlockcardstate.cpp

f:\dd\ndp\indigo\src\infocard\agent\statecontext.cpp

f:\dd\ndp\indigo\src\infocard\agent\mainwindowcontext.cpp

f:\dd\ndp\indigo\src\infocard\agent\authenticationwindowcontext.cpp

f:\dd\ndp\indigo\src\infocard\agent\mainwindow.cpp

f:\dd\ndp\indigo\src\infocard\agent\mainhelperwindow.cpp

f:\dd\ndp\indigo\src\infocard\agent\authenticationwindow.cpp

f:\dd\ndp\indigo\src\infocard\agent\displaytoken.cpp

f:\dd\ndp\indigo\src\infocard\agent\rpccryptoservice.cpp

f:\dd\ndp\indigo\src\infocard\agent\cryptkey.h

f:\dd\ndp\indigo\src\infocard\agent\rpccryptocontext.cpp

f:\dd\ndp\indigo\src\infocard\agent\x509certificatetokenfactorycredential.cpp

305.1if:\dd\ndp\indigo\src\infocard\agent\accannotationhelper.cpp

f:\dd\ndp\indigo\src\infocard\agent\deletestorestate.cpp

f:\dd\ndp\indigo\src\infocard\agent\agentmodulebase.cpp

f:\dd\ndp\indigo\src\infocard\agent\helpwindow.cpp

f:\dd\ndp\indigo\src\infocard\agent\getfilenamefromuserrequest.h

f:\dd\ndp\indigo\src\infocard\agent\getfilenamefromuserrequest.cpp

f:\dd\ndp\indigo\src\infocard\agent\selectcreatecardpage.cpp

f:\dd\ndp\indigo\src\infocard\agent\selectcreatecardstate.cpp

f:\dd\ndp\indigo\src\infocard\agent\webclient.cpp

f:\dd\ndp\indigo\src\infocard\agent\x509certlogoclient.cpp

f:\dd\ndp\indigo\src\infocard\agent\asyncwebclient.cpp

f:\dd\ndp\indigo\src\infocard\agent\notificationcontrol.cpp

f:\dd\ndp\indigo\src\infocard\agent\cardusagecontrol.cpp

f:\dd\ndp\indigo\src\infocard\agent\horizontalbuttonstrip.cpp

f:\dd\ndp\indigo\src\infocard\agent\cardusagestate.cpp

f:\dd\ndp\indigo\src\infocard\agent\cardsummaryviewcontrol.cpp

f:\dd\ndp\indigo\src\infocard\agent\fileselectpage.cpp

f:\dd\ndp\indigo\src\infocard\agent\importfileselectstate.cpp

f:\dd\ndp\indigo\src\infocard\agent\preferencespage.cpp

f:\dd\ndp\indigo\src\infocard\agent\preferencesstate.cpp

f:\dd\ndp\indigo\src\infocard\agent\lockcode.cpp

f:\dd\ndp\indigo\src\infocard\agent\lockcodeeditcontrol.cpp

f:\dd\ndp\indigo\src\infocard\agent\selectfilepage.cpp

f:\dd\ndp\indigo\src\infocard\agent\claimnamecontrol.cpp

f:\dd\ndp\indigo\src\infocard\agent\progressstate.cpp

f:\dd\ndp\indigo\src\infocard\agent\commonfiledialogbase.cpp

f:\dd\ndp\indigo\src\infocard\agent\vistacommonfiledialog.cpp

f:\dd\ndp\indigo\src\infocard\agent\filedialog.cpp

f:\dd\ndp\indigo\src\infocard\agent\errorwindow.cpp

f:\dd\ndp\indigo\src\infocard\agent\claimvaluecontrolimpl.cpp

kernel32.dll

icardagt.pdb

PSSj%S

8P%u#

t1It.It

Wj.hl~@

x8SSh

x8SSh!

_amsg_exit

_wcmdln

MSVCR80.dll

_crt_debugger_hook

MSVCP80.dll

RegCloseKey

RegOpenKeyExW

CryptDestroyKey

ReportEventW

CryptGetUserKey

ADVAPI32.dll

KERNEL32.dll

GDI32.dll

GetKeyboardLayout

GetKeyboardLayoutList

GetKeyState

MsgWaitForMultipleObjects

USER32.dll

COMCTL32.dll

comdlg32.dll

CryptUIDlgViewCertificateW

CRYPTUI.dll

GdiplusShutdown

gdiplus.dll

MSIMG32.dll

ole32.dll

RPCRT4.dll

SHLWAPI.dll

UxTheme.dll

CertFreeCertificateContext

CertCreateCertificateContext

CertCloseStore

CertDuplicateCertificateContext

CertDuplicateStore

CertFindCertificateInStore

CertStrToNameW

CertOpenStore

CertSerializeCertificateStoreElement

CryptAcquireCertificatePrivateKey

CertOIDToAlgId

CRYPT32.dll

USERENV.dll

ShellExecuteExW

SHELL32.dll

VERSION.dll

HttpQueryInfoW

HttpSendRequestW

HttpOpenRequestW

InternetCrackUrlW

WININET.dll

GetProcessHeap

.PAVInfoCardException@@

<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"><assemblyIdentity version="5.1.0.0" name="Microsoft.Windows.ndp.icardagt" processorArchitecture="x86" type="win32"></assemblyIdentity><dependency><dependentAssembly><assemblyIdentity type="win32" name="Microsoft.VC80.CRT" version="8.0.50608.0" processorArchitecture="x86" publicKeyToken="1fc8b3b9a1e18e3b"></assemblyIdentity></dependentAssembly></dependency><dependency><dependentAssembly><assemblyIdentity type="win32" name="Microsoft.Windows.Common-Controls" version="6.0.0.0" publicKeyToken="6595b64144ccf1df" processorArchitecture="x86" language="*"></assemblyIdentity></dependentAssembly></dependency></assembly>PAPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDING

%SystemRoot%\System32\icardres.dll

%systemroot%\system32\msctfmonitor.dll

strMessage.LoadStringW( 527 )

ShellExecEx failed on wisptis.exe AgentModule::StartTabletProcessesIfNeeded()

CloseHandle( shexinfo.hProcess )

Successfully terminated wisptis.exe process early.

Failed to terminuate wisptis.exe AgentModule::StartTabletProcessesIfNeeded()

\wisptis.exe

rSelfIssuedClaimCount == m_mapClaimToIndex.size()

strClaim.length() > 0

strResource.LoadStringW( 105 )

!m_claims.empty()

A!m_pinHash.empty()

!newpin.empty()

m_pinHash.empty()

!oldpin.empty()

!m_pin.empty()

m_pinHash.size() == hash.size()

m_isCertCached

m_pAsyncImpl || !"AsyncRequest.IsComplete shouldn't be called after the operation is cancelled"

NULL != m_pOutArgs.get()

m_pAsyncImpl || !"AsyncRequest.GetOutArgs shouldn't be called after the operation is cancelled"

!"AsyncRequest.Process shouldn't be called after the operation is cancelled"

B!m_recipientIdentifier.empty()

GetCertificateRequest

strFaceName.LoadStringW( uFaceNameId )

strMessage.LoadStringW( 512 )

strMessage.LoadStringW( 517 )

Bg.DrawImage( pOldBitmap, rectNew, 0, 0, sizeOldBitmap.cx, sizeOldBitmap.cy, UnitPixel ) == Ok

g.SetInterpolationMode( InterpolationModeHighQualityBicubic ) == Ok

strText.LoadStringW( 80 )

strUnnamed.LoadStringW( 101 )

m_imageGlyph.LoadFromUserDefinedResource( 413, 256 )

WM_NCCREATE == uMsg

0 != wci.Register( &wci.pWndProc )

m_imageGlyph.LoadFromUserDefinedResource( 406, 256 )

DCertificateControl

strLock.LoadStringW( 1404 )

strNotVerified.LoadStringW( 1408 )

logoString.LoadStringW( 1126 )

logoString.LoadStringW( 1127 )

logoString.LoadStringW( 1125 )

logoString.LoadStringW( 1135 )

strTitle.LoadStringW( 1124 )

strTitle.LoadStringW( 1122 )

strNote.LoadStringW( 1139 )

strTitle.LoadStringW( 1132 )

strTitle.LoadStringW( 1131 )

strTitle.LoadStringW( 1137 )

strName.LoadStringW( uNameId )

strTitle.LoadStringW( 1136 )

strError.LoadStringW( 528 )

BnameStr.LoadStringW( uNameId )

hstr.LoadStringW( strId )

m_unspecifiedStr.LoadStringW( 621 )

m_femaleStr.LoadStringW( 620 )

m_maleStr.LoadStringW( 619 )

strGroup.LoadStringW( 882 )

strGroup.LoadStringW( 884   index )

strGroup.LoadStringW( 880   index )

notSpecified.LoadStringW( 624 )

str.LoadStringW( 618 )

gender.LoadStringW( 619 )

gender.LoadStringW( 620 )

nIndex < static_cast<int>( m_data.size()   2   m_history.size()   m_details.size()   GroupMaxValue   2 )

m_details.end() != simpleVal

imageLabel.LoadStringW( 613 )

nameLabel.LoadStringW( 612 )

BrequiredIndicator.LoadStringW( 626 )

DisplayClaimList == displayToken.GetDisplayType()

hXXp://schemas.xmlsoap.org/ws/2005/05/identity/claims/dateofbirth

hXXp://schemas.xmlsoap.org/ws/2005/05/identity/claims/gender

hXXp://schemas.xmlsoap.org/ws/2005/05/identity/claims/privatepersonalidentifier

addCardName.LoadStringW( 900 )

strOther.LoadStringW( 899 )

strOther.LoadStringW( 897 )

strUsed.LoadStringW( 898 )

strHeader.LoadStringW( 897 )

strName.LoadStringW( 896 )

m_strContext.LoadStringW( uId )

m_strUEText.LoadStringW( uId )

m_image.LoadFromUserDefinedResource( 412, 256 )

priched20.dll

D!button.IsWindow()

text.LoadStringW( 135 )

controlText.LoadStringW( uTextId )

m_titleText.LoadStringW(titleTextId)

0 != pMonitorWindows

strCaption.LoadStringW( 96 )

notifyMessage.LoadStringW( 604 )

notifyMessage.LoadStringW( 1266 )

notifyMessage.LoadStringW( 602 )

notifyMessage.LoadStringW( 601 )

notifyMessage.LoadStringW( 609 )

notifyMessage.LoadStringW( 636 )

strItem.LoadStringW( uStringId )

strText.LoadStringW( 940 )

strText.LoadStringW( 627 )

strText.LoadStringW( 955 )

strText.LoadStringW( 934 )

strPersonal.LoadStringW( 932 )

strManaged.LoadStringW( 933 )

strText.LoadStringW( 935 )

strButtonText.LoadStringW( 584 )

strButtonText.LoadStringW( 585 )

m_strPreviewText.LoadStringW( 930 )

iconAnnotation.LoadStringW( 1407 )

strText.LoadStringW( replacementId )

pstrTitle.LoadStringW( 682 )

strError.LoadStringW( uErrorId )

EstrTitle.LoadStringW( 814 )

strShield.LoadStringW( 1407 )

EusageText.LoadStringW( 633 )

EstrError.LoadStringW( 529 )

EstrButton.LoadStringW( 727 )

Emsg.LoadStringW( messageId )

strAnnotation.LoadStringW( 122 )

strText.LoadStringW( 758 )

strText.LoadStringW( 759 )

strText.LoadStringW( 760 )

strText.LoadStringW( 757 )

hstrMessage.LoadStringW( 526 )

strMessage.LoadStringW( 516 )

Dmessage.IsCommand()

name.LoadStringW( nameTxtId )

strAddText.LoadStringW( 584 )

strAddText.LoadStringW( 585 )

message.IsNotify()

DGetContext().IsCardSelected()

strPrefix.LoadStringW( 100 )

strGenericError.LoadString( IDS_E_ICARD_FAILED_NETWORK_ACCESS )

strMessage.LoadStringW( 520 )

plockCodeA.Unprotect()

pstrCue.LoadStringW( 1158 )

warningTitle.LoadStringW( 0x1400 )

warningText.LoadStringW( 0x1401 )

pstrMessage.LoadStringW( 524 )

DstrMessage.LoadStringW( 521 )

DpAgent && pImport

plockCode.Protect()

lockCode.Unprotect()

DpImport

ERecipientTypeX509 == recipient.GetRecipientType()

EstrMessage.LoadStringW( 523 )

strWindowName.LoadStringW( 97 )

windowParent.GetWindowRect( rectParent )

strWindowName.LoadStringW( 98 )

CancelAsyncOperationRequest

EGetImportedCardRequest

EExportFileRequest

NULL != m_hCryptKey

EstrMessage.LoadStringW( 1360 )

ImportFileRequest

EGetImportFileNameRequest

ppropStr.LoadStringW( iStrId )

E%SystemRoot%\System32\icardres.dll

The Windows CardSpace User Interface Agent was not able to load the MUI Library. This indicates a problem with the installation of Windows CardSpace. Contact your system administrator

CardSpace 3.0.0.0

NULL != s_pAgentModule.get()

p\StringFileInfo\xx\FileDescription

version.dll

NULL == s_pAgentModule.get()

D\StringFileInfo\xx\ProductVersion

13d389bc-393e-47bf-b667-aafe93ac6b63

Reporting file dialog selection to idsvc. pwszFileChoice=%1!ws!

strWindowName.LoadStringW( 0x1201 )

%u %ld %ld %ld %ld "%s"

FileType::Unspecified <= dwFileType && dwFileType <= FileType::ExportStore

m_userAgentString.LoadStringW( 106 )

0 == m_logoBytes.size()

0 == m_downloadBytes.size()

iconAnnotation.LoadStringW( uIconText )

notifyIconText.LoadStringW( 890 )

bullet.LoadStringW( 107 )

notification.LoadStringW( uTextId )

noItemsText.LoadStringW( 846 )

colum1text.LoadStringW( 842 )

colum0text.LoadStringW( 841 )

noItemsText.LoadStringW( 843 )

rect.X   rect.Width >= container.X && rect.X   rect.Width <= container.X   container.Width

rect.X >= container.X && rect.X <= container.X   container.Width

nameTxt.LoadStringW( uNameTextId )

EstrFilePath.LoadStringW( 1158 )

strFilePath.LoadStringW( 1159 )

DFileType::ImportCard == fileType || FileType::ImportStore == fileType

strCueManaged.LoadStringW( 1159 )

strMessage.LoadStringW( 530 )

txt.LoadStringW(uLabelTextId)

colon.LoadStringW( 1281 )

strMessage.LoadStringW( uExtensionErrorId )

strMessage.LoadStringW( 522 )

strFilter.LoadStringW( uFilterId )

strTitle.LoadStringW( uTitleId )

pstrWindowName.LoadStringW( uWindowName )

Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}

.\%s.mui

.\%s\%s.mui

%s\%s.mui

%s\%s\%s.mui

%s\%s

%S:%d: %s

Windows CardSpace User Interface Agent

3.0.4506.648 (Winfxred.004506-0648)

.NET Framework

3.0.4506.648

icardagt.exe_340_rwx_00A70000_00026000:

.text

`.rdata

@.data

.reloc

SSSh`M

SSSSh

|$L.to

%x.tmp

|.^$* ?()[\

%%%d%s

%s\%s

Z:\coding\project\main\payload\payload.x86.pdb

CallNamedPipeA

ConnectNamedPipe

GetSystemWindowsDirectoryA

DisconnectNamedPipe

CreateNamedPipeA

KERNEL32.dll

GetKeyboardState

USER32.dll

GDI32.dll

RegOpenKeyExA

RegCloseKey

RegNotifyChangeKeyValue

RegFlushKey

ADVAPI32.dll

SHELL32.dll

ODBC32.dll

WS2_32.dll

SHLWAPI.dll

ntdll.dll

HttpQueryInfoA

HttpAddRequestHeadersW

HttpAddRequestHeadersA

WININET.dll

CryptAcquireCertificatePrivateKey

CertOpenStore

CertOpenSystemStoreW

CertFreeCertificateContext

CertAddCertificateContextToStore

CertFindCertificateInStore

CertCloseStore

CertGetNameStringA

CryptVerifyCertificateSignature

PFXImportCertStore

CertEnumCertificatesInStore

CertEnumSystemStore

CertNameToStrA

CertVerifyTimeValidity

PFXExportCertStoreEx

CRYPT32.dll

WinHttpQueryOption

WinHttpSendRequest

WinHttpConnect

WinHttpOpen

WinHttpOpenRequest

WinHttpCloseHandle

WinHttpSetOption

WINHTTP.dll

GetProcessHeap

MsgWaitForMultipleObjects

ExitWindowsEx

ShellExecuteExA

ole32.dll

OLEAUT32.dll

WinSCard.dll

GetTcpTable

IPHLPAPI.DLL

WINTRUST.dll

SensApi.dll

HttpOpenRequestA

HttpSendRequestA

urlmon.dll

gdiplus.dll

USERENV.dll

payload.x86.dll

%Documents and Settings%\All Users\Application Data\bd00b4j6bf.exe

\\.\pipe\ffb23cf9

a8a56912x

a8a5691dx

%System%\icardagt.exe

%Documents and Settings%\%current user%

?.?5?:???\?

Windows Explorer

Explorer.EXE_1572_rwx_01EA0000_00026000:

.text

`.rdata

@.data

.reloc

SSSh`M

SSSSh

|$L.to

%x.tmp

|.^$* ?()[\

%%%d%s

%s\%s

Z:\coding\project\main\payload\payload.x86.pdb

CallNamedPipeA

ConnectNamedPipe

GetSystemWindowsDirectoryA

DisconnectNamedPipe

CreateNamedPipeA

KERNEL32.dll

GetKeyboardState

USER32.dll

GDI32.dll

RegOpenKeyExA

RegCloseKey

RegNotifyChangeKeyValue

RegFlushKey

ADVAPI32.dll

SHELL32.dll

ODBC32.dll

WS2_32.dll

SHLWAPI.dll

ntdll.dll

HttpQueryInfoA

HttpAddRequestHeadersW

HttpAddRequestHeadersA

WININET.dll

CryptAcquireCertificatePrivateKey

CertOpenStore

CertOpenSystemStoreW

CertFreeCertificateContext

CertAddCertificateContextToStore

CertFindCertificateInStore

CertCloseStore

CertGetNameStringA

CryptVerifyCertificateSignature

PFXImportCertStore

CertEnumCertificatesInStore

CertEnumSystemStore

CertNameToStrA

CertVerifyTimeValidity

PFXExportCertStoreEx

CRYPT32.dll

WinHttpQueryOption

WinHttpSendRequest

WinHttpConnect

WinHttpOpen

WinHttpOpenRequest

WinHttpCloseHandle

WinHttpSetOption

WINHTTP.dll

GetProcessHeap

MsgWaitForMultipleObjects

ExitWindowsEx

ShellExecuteExA

ole32.dll

OLEAUT32.dll

WinSCard.dll

GetTcpTable

IPHLPAPI.DLL

WINTRUST.dll

SensApi.dll

HttpOpenRequestA

HttpSendRequestA

urlmon.dll

gdiplus.dll

USERENV.dll

payload.x86.dll

%Documents and Settings%\All Users\Application Data\bd00b4j6bf.exe

\\.\pipe\ffb23cf9

a8a56912x

a8a5691dx

%WinDir%\explorer.exe

?.?5?:???\?

Windows Explorer

Remove it with Ad-Aware

1. Click (here) to download and install Ad-Aware Free Antivirus.
2. Update the definition files.
3. Run a full scan of your computer.

Manual removal*

1. Scan a system with an anti-rootkit tool.
   
2. Terminate malicious process(es) (How to End a Process With the Task Manager):
   

   attrib.exe:1724
   %original file name%.exe:1756
   

3. Delete the original Trojan file.
   
4. Delete or disinfect the following files created/modified by the Trojan:
   

   %Documents and Settings%\%current user%\Local Settings\Temp\2d17e659d34601689591 (67 bytes)
   %Documents and Settings%\All Users\Application Data\bd00b4j6bf.exe (4185 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
   %Documents and Settings%\%current user%\Local Settings\History\History.IE5\desktop.ini (159 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\C8AOUZ1F\desktop.ini (67 bytes)
   %Documents and Settings%\%current user%\NTUSER.DAT.LOG (7824 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\H2HRBYMJ\desktop.ini (67 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\GXYBO5UR\desktop.ini (67 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\R5AZOTYN\desktop.ini (67 bytes)

5. Delete the following value(s) in the autorun key (How to Work with System Registry):
   

   [HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
   "IntelPowerAgent64" = "rundll32.exe shell32.dll, ShellExec_RunDLL C:\DOCUME~1\ALLUSE~1\APPLIC~1\BD00B4~1.EXE"

6. Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
   
7. Reboot the computer.
   

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.