ThreatExpert Report: Application.Pal_Computer_Surveillance_System

Visit ThreatExpert web site

Close Report

Submission Summary:

Submission details:

Submission received: 1 December 2010, 14:24:49
Processing time: 7 min 41 sec
Submitted sample:

File MD5: 0xDAC3B051DA602782D0775DD15C28A900
File SHA-1: 0x1FBBA9B2D8C40F1CE3777EF229AADC9845B26211
Filesize: 1,661,631 bytes
Alias:

Application.Pal_Computer_Surveillance_System_3.2 [PCTools]
Spyware.ComSurveilSys [Symantec]
not-a-virus:Monitor.Win32.KeyLog.32 [Kaspersky Lab]
Generic PWS.y [McAfee]
not-a-virus:Monitor.Win32.KeyLog [Ikarus]

Summary of the findings:

What's been found	Severity Level
Capability to send out email message(s) with the built-in SMTP client engine.
Creates a startup registry entry.
Registers a 32-bit in-process server DLL.
Registers a Browser Helper Object (Microsoft's Internet Explorer plugin module).
Contains characteristics of an identified security risk.

Technical Details:

The new window was created, as shown below:

NOTICE: The content shown in the above window is captured automatically and is not controlled or endorsed by ThreatExpert.
Please contact us on this link should any material be offensive or inappropriate and we will ensure any such content is blocked from future viewers of the report.

Possible Security Risk

Attention! The following threat category was identified:

Threat Category	Description
	A spyware program that represents security risk for a local system

File System Modifications

The following files were created in the system:

#	Filename(s)	File Size	File Hash	Alias
1	%DesktopDir%\PAL - CSS.lnk	750 bytes	MD5: 0x1B1DD99CEC075D4AD2299C4A12C93964 SHA-1: 0x132FAB0A5B7B7B8FE558DCFE4A15366163724AC9	(not available)
2	%System%\PAL\CSS\atl71.dll	89,088 bytes	MD5: 0x8F2097E8B174F38178570C611464935F SHA-1: 0x86476819229F4BF00F32E5F0969E19C5B61D1B2A	(not available)
3	%System%\PAL\CSS\cpu.exe	45,056 bytes	MD5: 0xA7918DAD4F42B9C6A573006449AD0914 SHA-1: 0x9FAE677650261230566C6D34F63A4FCC0E58B23F	Keylog-PAL [McAfee] Virus.Win32.Rootkit [Ikarus]
4	%System%\PAL\CSS\CSS - Shareware License.txt	4,523 bytes	MD5: 0x982A6FAEB5C9EC273BDE5E85D918171D SHA-1: 0xDDFE20584900EF2DC16958D78B1B806977A3A73C	(not available)
5	%System%\PAL\CSS\explorer.exe	22,016 bytes	MD5: 0xABAE7E3B0A82C891C6646FF382D67AD5 SHA-1: 0x9AE45A8B46B3ACA54111AA7C2C5E8A6448274903	Spyware.ComSurveilSys!rem [PCTools] Spyware.ComSurveilSys [Symantec] not-a-virus:Monitor.Win32.KeyLog.32 [Kaspersky Lab] Generic PUP.a [McAfee] MonitoringTool:Win32/Csysserv [Microsoft] not-a-virus:Monitor.Win32.KeyLog [Ikarus]
6	%System%\PAL\CSS\IEGuard.dll	360,448 bytes	MD5: 0x6E18C5CC38A3266277EA411EACC2DE7D SHA-1: 0xCD170FDBF431A36539B58593E8FC8504ED66136C	Spyware.ComSurveilSys!rem [PCTools] Spyware.ComSurveilSys [Symantec] Mal/Generic-A [Sophos] MonitoringTool:Win32/Csysserv [Microsoft] MonitoringTool.Win32.Csysserv [Ikarus]
7	%System%\PAL\CSS\ijl15.dll	352,256 bytes	MD5: 0x4FC074C3C6CF290BB2C11E5C31C97B27 SHA-1: 0x95A0EA2ECB46FF8424D76D2F3BB9878794F57AE9	(not available)
8	%System%\PAL\CSS\klpf.exe	815,104 bytes	MD5: 0x788BF3443BADE8B86C390F90690783A8 SHA-1: 0x3D572D750605DBD663EFC069AB31347FCE8DB85D	Spyware.ComSurveilSys!rem [PCTools] Spyware.ComSurveilSys [Symantec] MonitoringTool:Win32/Csysserv [Microsoft] Trojan.SuspectCRC [Ikarus]
9	%System%\PAL\CSS\log\default\2010_12_01_14_26_50_.txt	943 bytes	MD5: 0xD3770EDF6C70FFFE8B02F095A2BF911C SHA-1: 0xE2E20374209DDCA80765B4A336FB75B0604A8284	(not available)
10	%System%\PAL\CSS\log\%UserName%\2010_12_01_14_26_51_.txt	815 bytes	MD5: 0x668AA56ABBDD9B9E8C49053602C4BA41 SHA-1: 0x438C2F407A8FB983C054D869BBD16985541F14D8	(not available)
11	%System%\PAL\CSS\MFC71.dll	1,060,864 bytes	MD5: 0xF35A584E947A5B401FEB0FE01DB4A0D7 SHA-1: 0x664DC99E78261A43D876311931694B6EF87CC8B9	(not available)
12	%System%\PAL\CSS\MkShort.exe	12,800 bytes	MD5: 0xA046595A914725C135D85E3CF68B0CC5 SHA-1: 0x1CF137A60FE2AD401417455CE0563A6FACD8ED64	Spyware.ComSurveilSys!rem [PCTools] Spyware.ComSurveilSys [Symantec] MonitoringTool:Win32/Csysserv [Microsoft] MonitoringTool [Ikarus]
13	%System%\PAL\CSS\msvcp71.dll	499,712 bytes	MD5: 0x561FA2ABB31DFA8FAB762145F81667C2 SHA-1: 0xC8CCB04EEDAC821A13FAE314A2435192860C72B8	(not available)
14	%System%\PAL\CSS\msvcr71.dll	348,160 bytes	MD5: 0x86F1895AE8C5E8B17D99ECE768A70732 SHA-1: 0xD5502A1D00787D68F548DDEEBBDE1ECA5E2B38CA	(not available)
15	%System%\PAL\CSS\readme!!!.txt	164 bytes	MD5: 0x6CBBC1FE17647379D4F647EC69B95BC4 SHA-1: 0xB5AA51DFD1D583DD08BF44EBB46ECAD0290FA7EE	(not available)
16	%System%\PAL\CSS\regsvr32.exe	10,000 bytes	MD5: 0x86E56792D01380EC4880EC22E4A1BCE6 SHA-1: 0xE4DEFB01B5419C750FEE7095A3A54157561346BB	(not available)
17	%System%\PAL\CSS\run32dll.exe	102,400 bytes	MD5: 0x6B90C4FA8ACF03F35642E9ECB5393F4E SHA-1: 0x2C6CECBB295425D8009D53916E5CDF2BDF9EA288	Spyware.ComSurveilSys!rem [PCTools] Spyware.ComSurveilSys [Symantec] not-a-virus:Monitor.Win32.KeyLog.k [Kaspersky Lab] Generic PWS.y [McAfee] Mal/Generic-A [Sophos] MonitoringTool:Win32/Csysserv [Microsoft] not-a-virus:Monitor.Win32.KeyLog [Ikarus]
18	%System%\PAL\CSS\svchost.exe	90,112 bytes	MD5: 0x18C63F5100E0CECE87F820A941C47904 SHA-1: 0x9A6FFEAE8C953D26112E5CB45CE7D78705CBDEAB	Spyware.ComSurveilSys!rem [PCTools] Spyware.ComSurveilSys [Symantec] not-a-virus:Monitor.Win32.KeyLog.b [Kaspersky Lab] Generic PUP.a [McAfee] MonitoringTool:Win32/Csysserv [Microsoft] not-a-virus:Monitor.Win32.KeyLog [Ikarus]
19	%System%\PAL\CSS\TheHook.dll	28,672 bytes	MD5: 0x98482CB82C0D207B3D8E83CAEF3255E6 SHA-1: 0x645347A2B20C41642F254924D17E1B49821CC5E1	Spyware.ComSurveilSys!rem [PCTools] Spyware.ComSurveilSys [Symantec] not-a-virus:Monitor.Win32.KeyLog.32 [Kaspersky Lab] Generic PUP.e [McAfee] MonitoringTool:Win32/Csysserv [Microsoft] not-a-virus:Monitor.Win32.KeyLog [Ikarus]
20	%System%\PAL\CSS\TheHookXP.dll	9,216 bytes	MD5: 0x61CF82E79C44EBC67978924848F145C7 SHA-1: 0x0FC2B674DC2ED0E79CECB9FB7E3E55EA9BC9154A	Application.Pal_Computer_Surveillance_System_3.2 [PCTools] Spyware.ComSurveilSys [Symantec] not-a-virus:Monitor.Win32.KeyLog.32 [Kaspersky Lab] Generic KeyLog.b [McAfee] MonitoringTool:Win32/Csysserv [Microsoft] not-a-virus:Monitor.Win32.KeyLog [Ikarus]
21	%System%\PAL\CSS\Uninstall.exe	48,939 bytes	MD5: 0x377EA8EE867427F6E27F876140994CFF SHA-1: 0x743D1A212078CED16E20C50E943E7A5D93D0FF08	(not available)
22	%System%\PAL\CSS\UNZIP.EXE	159,744 bytes	MD5: 0xF35B2E2D664167D88280281972D40EE4 SHA-1: 0x3F6B987A8C754442C0A9656B0976FE980F6D07B5	(not available)
23	%System%\PAL\CSS\ZIP.EXE	126,976 bytes	MD5: 0xE3A4B873FDCCC484A4F2C4172949E38B SHA-1: 0x1916DFF9E6CA10F255A1AB9E1FD601CBFB695B12	(not available)
24	%System%\PAL\CSS\zip_copyright.txt	2,460 bytes	MD5: 0xD90138172BC3AE710EA30900FFB3E523 SHA-1: 0xE4B4881C8674C7B333E69D19674BAAFB02BFA59B	(not available)
25	[file and pathname of the sample #1]	1,661,631 bytes	MD5: 0xDAC3B051DA602782D0775DD15C28A900 SHA-1: 0x1FBBA9B2D8C40F1CE3777EF229AADC9845B26211	Application.Pal_Computer_Surveillance_System_3.2 [PCTools] Spyware.ComSurveilSys [Symantec] not-a-virus:Monitor.Win32.KeyLog.32, not-a-virus:Monitor.Win32.KeyLog.k, not-a-virus:Monitor.Win32.KeyLog.b [Kaspersky Lab] Generic PWS.y [McAfee] not-a-virus:Monitor.Win32.KeyLog [Ikarus]

Notes:

%DesktopDir% is a variable that refers to the file system directory used to physically store file objects on the desktop. A typical path is C:\Documents and Settings\[UserName]\Desktop.
%System% is a variable that refers to the System folder. By default, this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).
%UserName% is a variable that refers to the current user name.

The following directories were created:

%System%\PAL
%System%\PAL\CSS
%System%\PAL\CSS\log
%System%\PAL\CSS\log\default
%System%\PAL\CSS\log\%UserName%
%System%\PAL\CSS\scr
%System%\PAL\CSS\scr\%UserName%

Memory Modifications

There was a new process created in the system:

Process Name	Process Filename	Main Module Size
[filename of the sample #1]	[file and pathname of the sample #1]	3,825,664 bytes

There was a new service created in the system:

Service Name	Display Name	Status	Service Filename
Windows LAN Service Manager	Windows LAN Service Manager	"Running"	%System%\PAL\CSS\svchost.exe

Registry Modifications

The following Registry Keys were created:

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\TestService.EXE
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{2EAF3815-55F5-11D1-B9C5-00C04FBD6229}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1B77D30A-81C9-497A-8647-142F7511B1FB}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1B77D30A-81C9-497A-8647-142F7511B1FB}\InprocServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1B77D30A-81C9-497A-8647-142F7511B1FB}\ProgID
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1B77D30A-81C9-497A-8647-142F7511B1FB}\Programmable
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1B77D30A-81C9-497A-8647-142F7511B1FB}\TypeLib
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1B77D30A-81C9-497A-8647-142F7511B1FB}\VersionIndependentProgID
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{267B1ED2-2C9E-4A3F-BE15-7AFC79403073}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{267B1ED2-2C9E-4A3F-BE15-7AFC79403073}\ProxyStubClsid
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{267B1ED2-2C9E-4A3F-BE15-7AFC79403073}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{267B1ED2-2C9E-4A3F-BE15-7AFC79403073}\TypeLib
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{80CC88FE-2567-42ED-A3AE-E397D2A12C52}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{80CC88FE-2567-42ED-A3AE-E397D2A12C52}\ProxyStubClsid
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{80CC88FE-2567-42ED-A3AE-E397D2A12C52}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{80CC88FE-2567-42ED-A3AE-E397D2A12C52}\TypeLib
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{2EAF3814-55F5-11D1-B9C5-00C04FBD6229}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{2EAF3814-55F5-11D1-B9C5-00C04FBD6229}\1.0
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{2EAF3814-55F5-11D1-B9C5-00C04FBD6229}\1.0\0
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{2EAF3814-55F5-11D1-B9C5-00C04FBD6229}\1.0\0\win32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{2EAF3814-55F5-11D1-B9C5-00C04FBD6229}\1.0\FLAGS
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{2EAF3814-55F5-11D1-B9C5-00C04FBD6229}\1.0\HELPDIR
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{5AB0D266-DD2B-4006-B9D6-A9145291BDD6}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{5AB0D266-DD2B-4006-B9D6-A9145291BDD6}\1.0
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{5AB0D266-DD2B-4006-B9D6-A9145291BDD6}\1.0\0
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{5AB0D266-DD2B-4006-B9D6-A9145291BDD6}\1.0\0\win32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{5AB0D266-DD2B-4006-B9D6-A9145291BDD6}\1.0\FLAGS
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{5AB0D266-DD2B-4006-B9D6-A9145291BDD6}\1.0\HELPDIR
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\IEGuard.IEWebGuard
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\IEGuard.IEWebGuard\CLSID
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\IEGuard.IEWebGuard\CurVer
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\IEGuard.IEWebGuard.1
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\IEGuard.IEWebGuard.1\CLSID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1B77D30A-81C9-497A-8647-142F7511B1FB}
HKEY_LOCAL_MACHINE\SOFTWARE\KLP
HKEY_LOCAL_MACHINE\SOFTWARE\KLP\KLP
HKEY_LOCAL_MACHINE\SOFTWARE\KLP\KLP\BU_USERS
HKEY_LOCAL_MACHINE\SOFTWARE\KLP\KLP\Common
HKEY_LOCAL_MACHINE\SOFTWARE\KLP\KLP\Email
HKEY_LOCAL_MACHINE\SOFTWARE\KLP\KLP\IE
HKEY_LOCAL_MACHINE\SOFTWARE\KLP\KLP\KW_USERS
HKEY_LOCAL_MACHINE\SOFTWARE\KLP\KLP\Logging
HKEY_LOCAL_MACHINE\SOFTWARE\KLP\KLP\Miscellaneous
HKEY_LOCAL_MACHINE\SOFTWARE\KLP\KLP\Running
HKEY_LOCAL_MACHINE\SOFTWARE\KLP\KLP\Screenshots
HKEY_LOCAL_MACHINE\SOFTWARE\KLP\KLP\UR_USERS
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_WINDOWS_LAN_SERVICE_MANAGER
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_WINDOWS_LAN_SERVICE_MANAGER\0000
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_WINDOWS_LAN_SERVICE_MANAGER\0000\Control
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Windows LAN Service Manager
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Windows LAN Service Manager\Security
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Windows LAN Service Manager\Enum
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_WINDOWS_LAN_SERVICE_MANAGER
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_WINDOWS_LAN_SERVICE_MANAGER\0000
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_WINDOWS_LAN_SERVICE_MANAGER\0000\Control
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Windows LAN Service Manager
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Windows LAN Service Manager\Security
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Windows LAN Service Manager\Enum
HKEY_CURRENT_USER\Software\Iconizer
HKEY_CURRENT_USER\Software\Iconizer\Text
HKEY_CURRENT_USER\Software\Iconizer\Text\Settings

The newly created Registry Values are:

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\TestService.EXE]

AppID = "{2EAF3815-55F5-11D1-B9C5-00C04FBD6229}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{2EAF3815-55F5-11D1-B9C5-00C04FBD6229}]

(Default) = "TestService"
LocalService = "TestService"
ServiceParameters = "-Service"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1B77D30A-81C9-497A-8647-142F7511B1FB}\VersionIndependentProgID]

(Default) = "IEGuard.IEWebGuard"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1B77D30A-81C9-497A-8647-142F7511B1FB}\TypeLib]

(Default) = "{5AB0D266-DD2B-4006-B9D6-A9145291BDD6}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1B77D30A-81C9-497A-8647-142F7511B1FB}\ProgID]

(Default) = "IEGuard.IEWebGuard.1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1B77D30A-81C9-497A-8647-142F7511B1FB}\InprocServer32]

(Default) = "%System%\PAL\CSS\ieguard.dll"
ThreadingModel = "Apartment"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1B77D30A-81C9-497A-8647-142F7511B1FB}]

(Default) = "IEWebGuard Class"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{267B1ED2-2C9E-4A3F-BE15-7AFC79403073}\TypeLib]

(Default) = "{5AB0D266-DD2B-4006-B9D6-A9145291BDD6}"
Version = "1.0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{267B1ED2-2C9E-4A3F-BE15-7AFC79403073}\ProxyStubClsid32]

(Default) = "{00020420-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{267B1ED2-2C9E-4A3F-BE15-7AFC79403073}\ProxyStubClsid]

(Default) = "{00020420-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{267B1ED2-2C9E-4A3F-BE15-7AFC79403073}]

(Default) = "_IIEWebGuardEvents"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{80CC88FE-2567-42ED-A3AE-E397D2A12C52}\TypeLib]

(Default) = "{5AB0D266-DD2B-4006-B9D6-A9145291BDD6}"
Version = "1.0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{80CC88FE-2567-42ED-A3AE-E397D2A12C52}\ProxyStubClsid32]

(Default) = "{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{80CC88FE-2567-42ED-A3AE-E397D2A12C52}\ProxyStubClsid]

(Default) = "{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{80CC88FE-2567-42ED-A3AE-E397D2A12C52}]

(Default) = "IIEWebGuard"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{2EAF3814-55F5-11D1-B9C5-00C04FBD6229}\1.0\0\win32]

(Default) = "%System%\PAL\CSS\svchost.exe"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{2EAF3814-55F5-11D1-B9C5-00C04FBD6229}\1.0\HELPDIR]

(Default) = "%System%\PAL\CSS\"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{2EAF3814-55F5-11D1-B9C5-00C04FBD6229}\1.0\FLAGS]

(Default) = "0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{2EAF3814-55F5-11D1-B9C5-00C04FBD6229}\1.0]

(Default) = "TestService 1.0 Type Library"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{5AB0D266-DD2B-4006-B9D6-A9145291BDD6}\1.0\0\win32]

(Default) = "%System%\PAL\CSS\ieguard.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{5AB0D266-DD2B-4006-B9D6-A9145291BDD6}\1.0\HELPDIR]

(Default) = "%System%\PAL\CSS\"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{5AB0D266-DD2B-4006-B9D6-A9145291BDD6}\1.0\FLAGS]

(Default) = "0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{5AB0D266-DD2B-4006-B9D6-A9145291BDD6}\1.0]

(Default) = "IEGuard 1.0 Type Library"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\IEGuard.IEWebGuard\CurVer]

(Default) = "IEGuard.IEWebGuard.1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\IEGuard.IEWebGuard\CLSID]

(Default) = "{1B77D30A-81C9-497A-8647-142F7511B1FB}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\IEGuard.IEWebGuard]

(Default) = "IEWebGuard Class"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\IEGuard.IEWebGuard.1\CLSID]

(Default) = "{1B77D30A-81C9-497A-8647-142F7511B1FB}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\IEGuard.IEWebGuard.1]

(Default) = "IEWebGuard Class"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1B77D30A-81C9-497A-8647-142F7511B1FB}]

(Default) = "Internet Explorer Web Content Guard "

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

klp = "%System%\PAL\CSS\explorer.exe"

so that explorer.exe runs every time Windows starts

[HKEY_LOCAL_MACHINE\SOFTWARE\KLP\KLP\Screenshots]

ScrDir = "%System%\PAL\CSS\scr"
EnableScrFunct = 0x00000001
IsHidden = 0x00000000
ScrPeriod = 0x00000168
ScrInactivity = 0x0000003C
ScrQuality = 0x0000004B

[HKEY_LOCAL_MACHINE\SOFTWARE\KLP\KLP\Running]

Status = 0x00000004
Status = 0x00000000

[HKEY_LOCAL_MACHINE\SOFTWARE\KLP\KLP\Miscellaneous]

ActivateOnShF12 = 0x00000001
ActivateOnCtShW = 0x00000001

[HKEY_LOCAL_MACHINE\SOFTWARE\KLP\KLP\Logging]

LogDir = "%System%\PAL\CSS\log"
EnableLogging = 0x00000001
IsHidden = 0x00000000
EnableURLStats = 0x00000001
EnableBannedURLstats = 0x00000001
EnableKWStats = 0x00000001
EnableKeywordAlert = 0x00000001
kwStatStart = AA CB F6 4C
bURLStatStart = AA CB F6 4C
URLStatStart = AA CB F6 4C

[HKEY_LOCAL_MACHINE\SOFTWARE\KLP\KLP\KW_USERS]

Keywords = 00
%UserName%Keywords = 00

[HKEY_LOCAL_MACHINE\SOFTWARE\KLP\KLP\IE]

DISABLEFLAG = 0x00000000
CLOSEFLAG = 0x00000001

[HKEY_LOCAL_MACHINE\SOFTWARE\KLP\KLP\Email]

From = ""
To = ""
Subject = "Key log report"
SMTPserver = ""
EnableEMailFunc = 0x00000000
EmailPeriod = 0x00000168
OnKeybAlert = 0x00000001

[HKEY_LOCAL_MACHINE\SOFTWARE\KLP\KLP\Common]

Path = "%System%\PAL\CSS"
Type = 0x00000003
Reconfig = 0x00000001
Date = AA CB F6 4C
Exists = "KLP"

[HKEY_LOCAL_MACHINE\SOFTWARE\KLP\KLP\BU_USERS]

bURLs = 00
%UserName%bURLs = 00

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_WINDOWS_LAN_SERVICE_MANAGER\0000\Control]

*NewlyCreated* = 0x00000000
ActiveService = "Windows LAN Service Manager"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_WINDOWS_LAN_SERVICE_MANAGER\0000]

Service = "Windows LAN Service Manager"
Legacy = 0x00000001
ConfigFlags = 0x00000000
Class = "LegacyDriver"
ClassGUID = "{8ECC055D-047F-11D1-A537-0000F8753ED1}"
DeviceDesc = "Windows LAN Service Manager"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_WINDOWS_LAN_SERVICE_MANAGER]

NextInstance = 0x00000001

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Windows LAN Service Manager\Enum]

0 = "Root\LEGACY_WINDOWS_LAN_SERVICE_MANAGER\0000"
Count = 0x00000001
NextInstance = 0x00000001

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Windows LAN Service Manager\Security]

Security = 01 00 14 80 90 00 00 00 9C 00 00 00 14 00 00 00 30 00 00 00 02 00 1C 00 01 00 00 00 02 80 14 00 FF 01 0F 00 01 01 00 00 00 00 00 01 00 00 00 00 02 00 60 00 04 00 00 00 00 00 14 00 FD 01 02 00 01 01 00 00 00 00 00 05 12 00 00 00 00 00 18 00 FF 01 0F 0

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Windows LAN Service Manager]

Type = 0x00000110
Start = 0x00000002
ErrorControl = 0x00000001
ImagePath = "%System%\PAL\CSS\svchost.exe"
DisplayName = "Windows LAN Service Manager"
DependOnService = "RPCSS"
DependOnGroup = 00
ObjectName = "LocalSystem"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_WINDOWS_LAN_SERVICE_MANAGER\0000\Control]

*NewlyCreated* = 0x00000000
ActiveService = "Windows LAN Service Manager"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_WINDOWS_LAN_SERVICE_MANAGER\0000]

Service = "Windows LAN Service Manager"
Legacy = 0x00000001
ConfigFlags = 0x00000000
Class = "LegacyDriver"
ClassGUID = "{8ECC055D-047F-11D1-A537-0000F8753ED1}"

The following Registry Values were modified:

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\ServiceCurrent]

(Default) =

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\ServiceCurrent]

(Default) =

Other details

Analysis of the file resources indicate the following possible countries of origin:

	Ukraine
	Russian Federation

All content ("Information") contained in this report is the copyrighted work of Threat Expert Ltd and its associated companies ("ThreatExpert") and may not be copied without the express permission of ThreatExpert.

The Information is provided on an "as is" basis. ThreatExpert disclaims all warranties, whether express or implied, to the maximum extent permitted by law, including the implied warranties that the Information is merchantable, of satisfactory quality, accurate, fit for a particular purpose or need, or non-infringing, unless such implied warranties are legally incapable of exclusion. Further, ThreatExpert does not warrant or make any representations regarding the use or the results of the use of the Information in terms of their correctness, accuracy, reliability, or otherwise.