Debugging and reverse engineering: debugging

Showing posts with label debugging. Show all posts

Friday, February 13, 2015

When 0xFC is not entirely a driver issue...

I very recently received a crash dump from a user in which they stated their system either rebooted randomly or bug checked during streamed content, etc. The user had their system built by a 3rd party, specifically Power4PC in Belgium. Given it was relatively new and was under their warranty type guarantee of course, the user shipped it back to them and they ran "diagnostics". During these "diagnostics", they reported to the user that there were, and I quote, "faulty drivers", so it doesn't fall under their warranty guarantee, and the user had to ultimately pay money to get the system back.

I contemplated whether or not I wanted to name drop Power4PC, but given they pretty much robbed the user of money and went about it extremely poorly, I decided I was going to. Interestingly enough the user gets their system back and it's still crashing, what a surprise! Let's take a look at the crash dump.

 2: kd> .bugcheck  
 Bugcheck code 000000FC  
 Arguments ffffc001`b4bf7010 d6b00001`05e5b963 ffffd000`bfe2adb0 00000000`00000002

So here's our bug check - ATTEMPTED_EXECUTE_OF_NOEXECUTE_MEMORY (0xFC). I won't go into the specifics regarding executable/non-exectuable memory, but know that it mostly has to do with security, such as attempting to prevent things such as buffer overflows. Windows (and other OS' of course, although all implemented a bit differently) defines certain pages of memory as non-executable, which in turn tells the processor not to execute the data stored in those pages.

When an attempt is made to execute memory that is defined as non-executable, Windows throws a bug check for security (and disaster prevention as usual) purposes. Do note that there's of course exploits and ways around non-executable memory, such as the well known return to libc (function RET pointed to library/popular function or system API).

Before going into the various parameters, let's check and see if PAE is enabled so we know what to expect. To know what register to look for to see if PAE is enabled/in use, the best way to go about that is to check your corresponding processor manual. For example, on this system:

 2: kd> !cpuinfo  
 CP F/M/S Manufacturer MHz PRCB Signature  MSR 8B Signature Features  
  0 6,60,3 GenuineIntel 3399 0000000900000000          3d193fff  
  1 6,60,3 GenuineIntel 3399 0000000900000000          3d193fff  
  2 6,60,3 GenuineIntel 3399 0000000900000000          3d193fff  
  3 6,60,3 GenuineIntel 3399 0000000900000000          3d193fff  
            Cached Update Signature 0000000900000000  
            Initial Update Signature 0000000900000000

We can see that's it a quad core Intel processor, therefore we'd check the Intel manual. According to the Intel manual (2.5 CONTROL REGISTERS), PAE is stored on x64 (and x86 I believe as well) in CR4.

CR4 — Contains a group of flags that enable several arch itectural extensions, and indicate operating system or executive support for specific processor capabilities. The control registers can be read and loaded (or modified) using the move-to-or-from-control-registers forms of the MOV instruction. In protected mode, the MOV instructions allow the control registers to be read or loaded (at privilege level 0 only). This restriction means that application programs or operating-system procedures (running at privilege levels 1, 2, or 3) are prevented from reading or loading the control registers.

If we use the r command (show registers) along with cr4:

 2: kd> r cr4  
 Last set context:  
 cr4=00000000001506f8

We have our cr4 address now, and from this point can use .formats to check the bits:

 2: kd> .formats 00000000001506f8  
 Evaluate expression:  
  Hex:   00000000`001506f8  
  Decimal: 1378040  
  Octal:  0000000000000005203370  
  Binary: 00000000 00000000 00000000 00000000 00000000 00010101 00000110 11111000

Starting from the right most zero, it's the fifth bit. We can see it's enabled, which helps. The first parameter of the bug check contains the virtual address whose execution was attempted:

 2: kd> !pte ffffc001b4bf7010  
                       VA ffffc001b4bf7010  
 PXE at FFFFF6FB7DBEDC00  PPE at FFFFF6FB7DB80030  PDE at FFFFF6FB70006D28  PTE at FFFFF6E000DA5FB8  
 contains 0000000000A75863 contains 0000000000A74863 contains 00000001087E8863 contains D6B0000105E5B963  
 pfn a75    ---DA--KWEV pfn a74    ---DA--KWEV pfn 1087e8  ---DA--KWEV pfn 105e5b  -G-DA--KW-V

 2: kd> dt nt!_MMPTE u.Hard  
   +0x000 u   :   
    +0x000 Hard  : _MMPTE_HARDWARE

Here we can see the data type regarding the PDE. Let's go further and dump the PDE from the virtual address:

 2: kd> dt _MMPTE_HARDWARE FFFFF6FB70006D28  
 nt!_MMPTE_HARDWARE  
   +0x000 Valid      : 0y1  
   +0x000 Dirty1      : 0y1  
   +0x000 Owner      : 0y0  
   +0x000 WriteThrough   : 0y0  
   +0x000 CacheDisable   : 0y0  
   +0x000 Accessed     : 0y1  
   +0x000 Dirty      : 0y1  
   +0x000 LargePage    : 0y0  
   +0x000 Global      : 0y0  
   +0x000 CopyOnWrite   : 0y0  
   +0x000 Unused      : 0y0  
   +0x000 Write      : 0y1  
   +0x000 PageFrameNumber : 0y000000000000000100001000011111101000 (0x1087e8)  
   +0x000 reserved1    : 0y0000  
   +0x000 SoftwareWsIndex : 0y00000000000 (0)  
   +0x000 NoExecute    : 0y0

If we pay attention to the various flags from PDE section of the VA dump, we can see it's:

D - Dirty, as in the page was previously written to.

A - Accessed, as in the page (or table) has been previously accessed (read).

K - This page is owned by kernel-mode, not user-mode.

W - Writable, as in the page is able to be written to (not just read).

E - Executable, as in the page is executable.

V - Valid, as in the page is located in physical memory.

However if we take a look at the PTE section of the VA dump, we can see it's:

G - Global, as in the TLB won't be flushed upon a context switch.

D - Dirty, as in the page was previously written to.

A - Accessed, as in the page (or table) has been previously accessed (read).

K - This page is owned by kernel-mode, not user-mode.

W - Writable, as in the page is able to be written to (not just read).

V - Valid, as in the page is located in physical memory.

Notice anything missing? The executable flag. In addition however, there's the global flag. The second parameter of the bug check contains the contents of the page table entry:

 2: kd> !pte d6b0000105e5b963  
                       VA d6b0000105e5b963  
 PXE at FFFFF6FB7DBED000  PPE at FFFFF6FB7DA00020  PDE at FFFFF6FB40004178  PTE at FFFFF6800082F2D8  
 contains 00C00001364F5867 contains 0000000000000000  
 pfn 1364f5  ---DA--UWEV not valid  
 WARNING: noncanonical VA, accesses will fault !

We can see it's a noncanonical address, therefore it's of course going to fail. Let's dump the stack so we can find the pagefault:

 2: kd> kv  
 Child-SP     RetAddr      : Args to Child                              : Call Site  
 ffffd000`bfe2ab18 fffff803`ac420096 : 00000000`000000fc ffffc001`b4bf7010 d6b00001`05e5b963 ffffd000`bfe2adb0 : nt!KeBugCheckEx  
 ffffd000`bfe2ab20 fffff803`ac30b7ce : d6b00001`05e5b963 00000980`00000000 ffffd000`bfe2ad40 fffff801`16e343d8 : nt! ?? ::FNODOBFM::`string'+0x4b9e6  
 ffffd000`bfe2ab60 fffff803`ac2d9e78 : 00000000`00000008 ffffe000`f1ee5900 ffffd000`bfe2adb0 ffffe000`f0618420 : nt!MiSystemFault+0xb5e  
 ffffd000`bfe2ac00 fffff803`ac3ce42f : ffffc001`b4bf7010 00000000`00000000 00000000`00000000 ffffd000`bfe2adb0 : nt!MmAccessFault+0x758  
 ffffd000`bfe2adb0 ffffc001`b4bf7010 : ffffc001`b4bf7010 ffffc001`b4bf7010 ffffd000`bfe2b060 ffffc001`00000000 : nt!KiPageFault+0x12f (TrapFrame @ ffffd000`bfe2adb0)  
 ffffd000`bfe2af48 ffffc001`b4bf7010 : ffffc001`b4bf7010 ffffd000`bfe2b060 ffffc001`00000000 00000000`00000000 : 0xffffc001`b4bf7010  
 ffffd000`bfe2af50 ffffc001`b4bf7010 : ffffd000`bfe2b060 ffffc001`00000000 00000000`00000000 00000000`00000000 : 0xffffc001`b4bf7010  
 ffffd000`bfe2af58 ffffd000`bfe2b060 : ffffc001`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0xffffc001`b4bf7010  
 ffffd000`bfe2af60 ffffc001`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`0000000f : 0xffffd000`bfe2b060  
 ffffd000`bfe2af68 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`0000000f fffff801`17ae846e : 0xffffc001`00000000

 2: kd> .trap ffffd000`bfe2adb0  
 NOTE: The trap frame does not contain all registers.  
 Some register values may be zeroed or incorrect.  
 rax=0000000000000001 rbx=0000000000000000 rcx=ffffd000bfe2ae20  
 rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000  
 rip=ffffc001b4bf7010 rsp=ffffd000bfe2af48 rbp=ffffd000bfe2b060  
  r8=fffff80116e1bcd0 r9=0000000000000000 r10=0000000000000000  
 r11=ffffd000bfe2aee0 r12=0000000000000000 r13=0000000000000000  
 r14=0000000000000000 r15=0000000000000000  
 iopl=0     nv up ei ng nz na pe nc  
 ffffc001`b4bf7010 400200     add   al,byte ptr [rax] ds:00000000`00000001=??

We failed on a very basic arithmetic instruction, which was to add the single byte stored at rax to the 8 least significant bits of AX (whereas AX itself is the 16 least significant bits of EAX).

 2: kd> !pte rax  // Or 0000000000000001
                       VA 0000000000000001  
 PXE at FFFFF6FB7DBED000  PPE at FFFFF6FB7DA00000  PDE at FFFFF6FB40000000  PTE at FFFFF68000000000  
 contains 00C00001364F5867 contains 0610000136476867 contains 0000000000000000  
 pfn 1364f5  ---DA--UWEV pfn 136476  ---DA--UWEV not valid

It's not uncommon whatsoever that buggy and malicious drivers cause 0xFC bug checks, but in this case I think the company that built the system couldn't figure it out, took a look at the bug check, Googled it, saw the MSDN article/a few forum posts that it was a generally a driver related bug check, said it's being caused by "faulty drivers" so they don't have to look into it, and then charged money to do absolutely nothing. Also, not only is the thread in regards to the thread completely bare and showing no signs of "faulty drivers", let's take a look and see what actual 3rd party drivers there are on the system:

 3: kd> lm  
 start       end         module name  
 fffff801`15828000 fffff801`1588e000  mcupdate_GenuineIntel  (deferred)         
 fffff801`1588e000 fffff801`1589c000  werkernel  (deferred)         
 fffff801`1589c000 fffff801`158fd000  CLFS    (deferred)         
 fffff801`158fd000 fffff801`1591f000  tm     (deferred)         
 fffff801`1591f000 fffff801`15934000  PSHED   (deferred)         
 fffff801`15934000 fffff801`1593e000  BOOTVID  (deferred)         
 fffff801`1593e000 fffff801`159c6000  CI     (deferred)         
 fffff801`15a00000 fffff801`15a69000  spaceport  (deferred)         
 fffff801`15a83000 fffff801`15ae0000  msrpc   (deferred)         
 fffff801`15ae0000 fffff801`15baf000  Wdf01000  (deferred)         
 fffff801`15baf000 fffff801`15bc0000  WDFLDR   (deferred)         
 fffff801`15bc0000 fffff801`15bd8000  acpiex   (deferred)         
 fffff801`15bd8000 fffff801`15be3000  WppRecorder  (deferred)         
 fffff801`15c00000 fffff801`15c8b000  cng    (deferred)         
 fffff801`15c96000 fffff801`15ca0000  msisadrv  (deferred)         
 fffff801`15ca0000 fffff801`15ce8000  pci    (deferred)         
 fffff801`15cf4000 fffff801`15d7e000  ACPI    (deferred)         
 fffff801`15d7e000 fffff801`15d88000  WMILIB   (deferred)         
 fffff801`15d88000 fffff801`15d95000  vdrvroot  (deferred)         
 fffff801`15d95000 fffff801`15db1000  pdc    (deferred)         
 fffff801`15db1000 fffff801`15dc9000  partmgr  (deferred)         
 fffff801`15dc9000 fffff801`15dde000  volmgr   (deferred)         
 fffff801`15e00000 fffff801`15e55000  CLASSPNP  (deferred)         
 fffff801`15e72000 fffff801`15ed1000  volmgrx  (deferred)         
 fffff801`15ed1000 fffff801`15eec000  mountmgr  (deferred)         
 fffff801`15eec000 fffff801`15f17000  Wof    (deferred)         
 fffff801`15f17000 fffff801`15f59000  WdFilter  (deferred)         
 fffff801`15f59000 fffff801`15f89000  ksecpkg  (deferred)         
 fffff801`15f89000 fffff801`15fcf000  rdyboost  (deferred)         
 fffff801`1601d000 fffff801`162ee000  iaStorA  (deferred)         
 fffff801`162ee000 fffff801`1634d000  storport  (deferred)         
 fffff801`1634d000 fffff801`16367000  EhStorClass  (deferred)         
 fffff801`16367000 fffff801`163c3000  fltmgr   (deferred)         
 fffff801`163c3000 fffff801`163d9000  fileinfo  (deferred)         
 fffff801`163d9000 fffff801`163f5000  disk    (deferred)         
 fffff801`16400000 fffff801`16415000  crashdmp  (deferred)         
 fffff801`16418000 fffff801`1660e000  Ntfs    (deferred)         
 fffff801`1660e000 fffff801`1662a000  ksecdd   (deferred)         
 fffff801`1662a000 fffff801`1663a000  pcw    (deferred)         
 fffff801`1663a000 fffff801`16645000  Fs_Rec   (deferred)         
 fffff801`16645000 fffff801`1675d000  ndis    (deferred)         
 fffff801`1675d000 fffff801`167d5000  NETIO   (deferred)         
 fffff801`167d5000 fffff801`167e4000  intelpep  (deferred)         
 fffff801`16800000 fffff801`16895000  fvevol   (deferred)         
 fffff801`16895000 fffff801`168e4000  volsnap  (deferred)         
 fffff801`168e5000 fffff801`16b56000  tcpip   (deferred)         
 fffff801`16b56000 fffff801`16bc2000  fwpkclnt  (deferred)         
 fffff801`16bc2000 fffff801`16be7000  wfplwfs  (deferred)         
 fffff801`16be7000 fffff801`16bfe000  mup    (deferred)         
 fffff801`16e00000 fffff801`16e61000  dxgmms1  (pdb symbols)     c:\symbols\dxgmms1.pdb\55D4ABFFE5B6411898E90F5E6E72B1071\dxgmms1.pdb  
 fffff801`16e61000 fffff801`17132000  dump_iaStorA  (deferred)         
 fffff801`17132000 fffff801`17175000  srvnet   (deferred)         
 fffff801`1717f000 fffff801`171ad000  cdrom   (deferred)         
 fffff801`171ad000 fffff801`171b6000  Null    (deferred)         
 fffff801`171b6000 fffff801`171be000  Beep    (deferred)         
 fffff801`171be000 fffff801`171cc000  BasicRender  (deferred)         
 fffff801`17200000 fffff801`17220000  tdx    (deferred)         
 fffff801`1722c000 fffff801`173ad000  dxgkrnl  (pdb symbols)     c:\symbols\dxgkrnl.pdb\9D44B2A5938E41528DA86348D6D1F5C21\dxgkrnl.pdb  
 fffff801`173ad000 fffff801`173bf000  watchdog  (deferred)         
 fffff801`173bf000 fffff801`173d1000  BasicDisplay  (deferred)         
 fffff801`173d1000 fffff801`173e5000  Npfs    (deferred)         
 fffff801`173e5000 fffff801`173f1000  Msfs    (deferred)         
 fffff801`173f1000 fffff801`173ff000  TDI    (deferred)         
 fffff801`17411000 fffff801`1745d000  netbt   (deferred)         
 fffff801`1745d000 fffff801`174ef000  afd    (deferred)         
 fffff801`174ef000 fffff801`17519000  pacer   (deferred)         
 fffff801`17519000 fffff801`1752a000  netbios  (deferred)         
 fffff801`1752a000 fffff801`1759a000  rdbss   (deferred)         
 fffff801`1759a000 fffff801`175b6000  drmk    (deferred)         
 fffff801`175b6000 fffff801`175dd000  AMDACPKSL  (deferred)         
 fffff801`17600000 fffff801`1766a000  usbhub   (deferred)         
 fffff801`17679000 fffff801`17707000  csc    (deferred)         
 fffff801`17707000 fffff801`17715000  nsiproxy  (deferred)         
 fffff801`17715000 fffff801`17721000  npsvctrig  (deferred)         
 fffff801`17721000 fffff801`1772d000  mssmbios  (deferred)         
 fffff801`1772d000 fffff801`17753000  dfsc    (deferred)         
 fffff801`17763000 fffff801`1777a000  ahcache  (deferred)         
 fffff801`1777a000 fffff801`17789000  CompositeBus  (deferred)         
 fffff801`17789000 fffff801`17794000  kdnic   (deferred)         
 fffff801`17794000 fffff801`177a5000  umbus   (deferred)         
 fffff801`177a5000 fffff801`177ec000  portcls  (deferred)         
 fffff801`17800000 fffff801`1784e000  ks     (deferred)         
 fffff801`1784e000 fffff801`17859000  rdpbus   (deferred)         
 fffff801`17859000 fffff801`17865000  USBD    (deferred)         
 fffff801`17874000 fffff801`1790a000  atikmpag  (no symbols)        
 fffff801`1790a000 fffff801`17979000  USBPORT  (deferred)         
 fffff801`17979000 fffff801`17997000  intelppm  (deferred)         
 fffff801`17997000 fffff801`179a8000  ISCTD64  (deferred)         
 fffff801`179a8000 fffff801`179b3000  NdisVirtualBus  (deferred)         
 fffff801`179b3000 fffff801`179ee000  AtihdWB6  (deferred)         
 fffff801`17a00000 fffff801`17a18000  usbehci  (deferred)         
 fffff801`17a18000 fffff801`17a32000  serial   (deferred)         
 fffff801`17a32000 fffff801`17a3c000  wmiacpi  (deferred)         
 fffff801`17a3c000 fffff801`18cc0000  atikmdag  (no symbols)        
 fffff801`18cc0000 fffff801`18cc1600  swenum   (deferred)         
 fffff801`18cc2000 fffff801`18cc7300  ksthunk  (deferred)         
 fffff801`18cca000 fffff801`18ce3000  HDAudBus  (deferred)         
 fffff801`18ce3000 fffff801`18d38000  USBXHCI  (deferred)         
 fffff801`18d38000 fffff801`18d6a000  ucx01000  (deferred)         
 fffff801`18d6a000 fffff801`18d7d000  HECIx64  (deferred)         
 fffff801`18d7d000 fffff801`18df1000  e1d64x64  (deferred)         
 fffff801`18df1000 fffff801`18dfe000  serenum  (deferred)         
 fffff801`18e00000 fffff801`18ea9000  peauth   (deferred)         
 fffff801`18eb7000 fffff801`18f2f000  UsbHub3  (deferred)         
 fffff801`18f2f000 fffff801`18f3d000  monitor  (deferred)         
 fffff801`18f3d000 fffff801`18f61000  luafv   (deferred)         
 fffff801`18f61000 fffff801`18f75000  lltdio   (deferred)         
 fffff801`18f75000 fffff801`18f8d000  rspndr   (deferred)         
 fffff801`18f8d000 fffff801`18fd8000  mrxsmb10  (deferred)         
 fffff801`18fd8000 fffff801`18ff5000  Ndu    (deferred)         
 fffff801`19000000 fffff801`1900c000  dump_diskdump  (deferred)         
 fffff801`1900c000 fffff801`19022000  dump_dumpfve  (deferred)         
 fffff801`1902b000 fffff801`19362400  RTKVHD64  (deferred)         
 fffff801`19363000 fffff801`1938a000  usbccgp  (deferred)         
 fffff801`1938a000 fffff801`19398000  hidusb   (deferred)         
 fffff801`19398000 fffff801`193b7000  HIDCLASS  (deferred)         
 fffff801`193b7000 fffff801`193bef00  HIDPARSE  (deferred)         
 fffff801`193bf000 fffff801`193cd000  kbdhid   (deferred)         
 fffff801`193cd000 fffff801`193dd000  kbdclass  (deferred)         
 fffff801`193dd000 fffff801`193ea000  mouhid   (deferred)         
 fffff801`193ea000 fffff801`193fa000  mouclass  (deferred)         
 fffff801`19600000 fffff801`19639000  mrxsmb20  (deferred)         
 fffff801`19639000 fffff801`19644000  secdrv   (deferred)         
 fffff801`1964e000 fffff801`19748000  HTTP    (deferred)         
 fffff801`19748000 fffff801`19768000  bowser   (deferred)         
 fffff801`19768000 fffff801`1977f000  mpsdrv   (deferred)         
 fffff801`1977f000 fffff801`197eb000  mrxsmb   (deferred)         
 fffff801`197eb000 fffff801`197fd000  tcpipreg  (deferred)         
 fffff801`19a12000 fffff801`19abe000  srv2    (deferred)         
 fffff801`19abe000 fffff801`19b4c000  srv    (deferred)         
 fffff801`19b4c000 fffff801`19b79000  tunnel   (deferred)         
 fffff801`19b79000 fffff801`19b8f000  mslldp   (deferred)         
 fffff801`19b8f000 fffff801`19bae000  WdNisDrv  (deferred)         
 fffff801`19bae000 fffff801`19bbe000  condrv   (deferred)         
 fffff803`ab4f4000 fffff803`ab4fd000  kd     (deferred)         
 fffff803`ac205000 fffff803`ac275000  hal    (deferred)         
 fffff803`ac275000 fffff803`aca0b000  nt     (pdb symbols)     c:\symbols\ntkrnlmp.pdb\E018720B8C414EF799EACB23114763921\ntkrnlmp.pdb  
 fffff960`00018000 fffff960`00430000  win32k   (pdb symbols)     c:\symbols\win32k.pdb\F8BA0C5F0A844DC199DAC8CAB88C653B2\win32k.pdb  
 fffff960`00746000 fffff960`0074f000  TSDDD   (deferred)         
 fffff960`0091c000 fffff960`00957000  cdd    (deferred)

I give or take count ~7 3rd party drivers, none of which show any apparent or obvious evidence to being faulty and are essentially necessary to the hardware to properly communicate with the OS (minus Intel Rapid Storage, which unless the user was running a RAID config could easily uninstall and replace with default MSFT AHCI). Instead to me, this right away looked like a RAM issue as opposed to a driver issue.

I had the user run Memtest right away as opposed to verifier given the signs in the dumps and the mention of random reboots, and within a few minutes there were over 700+ errors. Now the user is hopefully getting their money back, free shipping to and from, and new RAM.

Friday, February 6, 2015

Pirating Antiviruses

I receive crash dumps containing pirated antiviruses all the time, however I felt the need to blog about it for once because it's actually so often and just comical to me at this point. I also haven't blogged in a little while. I'm not really here to discuss the pros & cons of antivirus software, it's obvious. What I will say however is it's also obvious that for any software you install regardless of its intended job, you're increasing your attack surface. Given the fact that most antiviruses are granted complete come/go access to the kernel, have the highest privileges, have various kernel-mode drivers, etc, your surface is increased just that much more.

Let's take a look at this crash dump (unfortunately only a Small Memory dump...):

 2: kd> .bugcheck  
 Bugcheck code 00000024  
 Arguments 00000000`001904fb fffff880`085866a8 fffff880`08585f00 fffff880`016b1d82

Right, so we have our bug check - NTFS_FILE_SYSTEM (0x24). Big hint, if you see this bug check on a crash dump from a user, chances are it's 50/60% (or more) the fault of either the one security application they have installed (whatever the actual problem with the application is), or user error as far as installing more than one security applications go. It's generally a bad idea to pigeonhole a bug check with a single problem (because it's ridiculous to do so), but I'd personally say over the years 0x24 has been much more of a security software issue than anything else.

 2: kd> .exr fffff880`085866a8  
 ExceptionAddress: fffff880016b1d82 (Ntfs!NtfsRemoveHashEntry+0x00000000000000c2)  
   ExceptionCode: c0000005 (Access violation)  
  ExceptionFlags: 00000000  
 NumberParameters: 2  
   Parameter[0]: 0000000000000000  
   Parameter[1]: ffffffffffffffff  
 Attempt to read from address ffffffffffffffff

By taking a look at the exception record structure, we can see the direct reason for the exception being thrown that caused the actual crash was an access violation occurring in Ntfs!NtfsRemoveHashEntry. Now that we know why, let's take a look at the context record using the address from our 3rd parameter in the .bugcheck output.

 2: kd> .cxr fffff880`08585f00  
 rax=0000000000000000 rbx=fffff8a00224e050 rcx=0001000000000000  
 rdx=0000000000000000 rsi=000000001fdefdd9 rdi=fffffa80049be358  
 rip=fffff880016b1d82 rsp=fffff880085868e0 rbp=00000000000001d9  
  r8=00000000000003b2 r9=0000000000000000 r10=00000000000003b2  
 r11=fffff88008586910 r12=0000000000000001 r13=0000000000000000  
 r14=0000000000000001 r15=fffff8a003533ed0  
 iopl=0     nv up ei pl nz na po nc  
 cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b       efl=00010206  
 Ntfs!NtfsRemoveHashEntry+0xc2:  
 fffff880`016b1d82 397110     cmp   dword ptr [rcx+10h],esi ds:002b:00010000`00000010=????????

On the instruction regarding Ntfs!NtfsRemoveHashEntry, we can see it was comparing the esi register to the memory at address rcx+10. rcx looks pretty bogus, and just to confirm:

 2: kd> !pte 0001000000000000  // Or !pte rcx
                       VA 0001000000000000  
 PXE at FFFFF6FB7DBED000  PPE at FFFFF6FB7DA00000  PDE at FFFFF6FB40000000  PTE at FFFFF68000000000  
 Unable to get PXE FFFFF6FB7DBED000  
 WARNING: noncanonical VA, accesses will fault !

So here's the reason why the exception was thrown, it was noncanonical.

Now that we've also instructed the debugger to use the context record as the register context, we can run a k(b,nL,whatever) to get a more detailed stack in our case - even with a Small Memory dump:

 2: kd> k  
  *** Stack trace for last set context - .thread/.cxr resets it  
 Child-SP     RetAddr      Call Site  
 fffff880`085868e0 fffff880`016b224f Ntfs!NtfsRemoveHashEntry+0xc2  
 fffff880`08586970 fffff880`016b0a24 Ntfs!NtfsDeleteNormalizedName+0x7f  
 fffff880`085869a0 fffff880`016b4cdb Ntfs!NtfsDeleteScb+0x1f4  
 fffff880`085869e0 fffff880`0162e343 Ntfs!NtfsRemoveScb+0x5b  
 fffff880`08586a20 fffff880`016b2a3c Ntfs!NtfsPrepareFcbForRemoval+0x53  
 fffff880`08586a50 fffff880`01635a52 Ntfs!NtfsTeardownStructures+0xdc  
 fffff880`08586ad0 fffff880`016c22d3 Ntfs!NtfsDecrementCloseCounts+0xa2  
 fffff880`08586b10 fffff880`01714d32 Ntfs!NtfsCommonClose+0x353  
 fffff880`08586be0 fffff800`02ae1561 Ntfs!NtfsFspCloseInternal+0x186  
 fffff880`08586cb0 fffff800`02d740ca nt!ExpWorkerThread+0x111  
 fffff880`08586d40 fffff800`02ac8be6 nt!PspSystemThreadStartup+0x5a  
 fffff880`08586d80 00000000`00000000 nt!KxStartSystemThread+0x16

Not going to put comments, but rather just talk about it. We were starting a system thread which turned out to be a worker thread (as we can see from the ExpWorkerThread function), and from then on go throughout various NT file system calls. Given the fact that it's a worker thread dealing with NTFS tells us we're likely dealing with a driver requiring delayed processing, etc. As we're going through various NTFS calls, we can see we're preparing the File Control Block (FCB) and Stream Control Block (SCB) for removal and deletion. This also tells us if anything, it's a driver working actively with/for the file system.

Looking at the loaded modules list for any drivers actively working with the file system, what do we find? Hint: A lot of Symantec/Norton kernel-mode drivers

 2: kd> lmvm SRTSP64  
 start       end         module name  
 fffff880`082d4000 fffff880`08394000  SRTSP64  (deferred)         
   Image path: SRTSP64.SYS  
   Image name: SRTSP64.SYS  
   Timestamp:    Tue Mar 29 22:46:12 2011

Here is Symantec's x64 Real Time Storage Protection (SRTSP) driver. This driver is used by Symantec's Auto-Protect feature, which is what scans files under various conditions. You can expect to find this kernel-mode driver on any system with NIS installed, so what's the big deal? The timestamp/date on the driver itself is from March 29th 2011. The time of the bug check is:

 Debug session time: Tue Feb 3 23:57:58.466 2015 (UTC - 5:00)

Okay, so we have a kernel-mode driver from/for Norton that's approximately as of this blog post 3.8 years old. That's.... bad. To give the user the absolute ultimate benefit of the doubt, I for a split-second thought that perhaps maybe Symantec really has a kernel-mode driver regarding RTP that's 3.8 years old. Surely there may be hundreds of vulnerabilities, but it's possible.. right? Wrong.

 2: kd> vertarget  
 Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64  
 Product: WinNt, suite: TerminalServer SingleUserTS Personal  
 Built by: 7601.18700.amd64fre.win7sp1_gdr.141211-1742

It's a Windows 7 x64 system, so let's create a test environment really quick and install the latest trial version of NIS.

Ah, that's much better.

Unfortunately, that wasn't the only out of date kernel-mode driver regarding Symantec loaded on this particular system. Let's keep comparing:

 2: kd> lmvm SYMDS64  
 start       end         module name  
 fffff880`01279000 fffff880`012ea000  SYMDS64  (deferred)         
   Image path: SYMDS64.SYS  
   Image name: SYMDS64.SYS  
   Timestamp:    Tue Dec 07 19:16:58 2010

Symantec's x64 Data Store (SymDS) driver.

 2: kd> lmvm SYMEFA64  
 start       end         module name  
 fffff880`014f4000 fffff880`015d8000  SYMEFA64  (deferred)         
   Image path: SYMEFA64.SYS  
   Image name: SYMEFA64.SYS  
   Timestamp:    Sun Mar 13 23:20:58 2011

Symantec's x64 Extended File Attributes driver.

 2: kd> lmvm SYMEVENT64x86  
 start       end         module name  
 fffff880`01dbf000 fffff880`01df5000  SYMEVENT64x86  (deferred)         
   Image path: SYMEVENT64x86.SYS  
   Image name: SYMEVENT64x86.SYS  
   Timestamp:    Thu Mar 24 19:02:36 2011

Symantec's x64 SymEvent driver.

 2: kd> lmvm SRTSPX64  
 start       end         module name  
 fffff880`01c2d000 fffff880`01c43000  SRTSPX64  (deferred)         
   Image path: SRTSPX64.SYS  
   Image name: SRTSPX64.SYS  
   Timestamp:    Tue Mar 29 22:46:18 2011

Symantec's x64 Real Time Storage Protection (SRTSP - PEL) driver.

 2: kd> lmvm SYMNETS  
 start       end         module name  
 fffff880`01d58000 fffff880`01dbf000  SYMNETS  (deferred)         
   Image path: SYMNETS.SYS  
   Image name: SYMNETS.SYS  
   Timestamp:    Tue Apr 19 18:33:31 2011

Symantec's Network Security WFP driver.

Overall, we can see that all of these Symantec/Norton kernel-mode drivers are not their latest versions. Given the fact that the user's system bug checked Feb 2015 and many of its kernel-mode drivers are 3.8 years (or older) old, we know it's pirated. Remove pirated Norton, crashes stop. Surprise surprise.

Moral of the story: If you really are going to pirate an antivirus, be sure it's actually as up to date as it would be if you paid for it. If you're running an antivirus with kernel-mode drivers from 3.8> years old, the amount of vulnerabilities you're vulnerable to that were patched years ago is pretty high. You're also opening yourself up to becoming infected with old malware that was invalidated if not further developed if it relied on certain EOP (or other) exploits to get around active protection. Also, as you can see here, chances are you'll bug check considering you're also subject to ~3.8> year old driver bugs that have since been patched.

You could alternatively just buy the antivirus. Crazy, I know.

Friday, December 19, 2014

Regin, the top-tier PASSIVE_LEVEL malware!

Over the past few weeks it seems left and right there's Regin this, Regin that. I am not going to do a detailed analysis and discuss its stages and what have you, as there are various/informative in-depth whitepapers, etc.

To name a few:

Symantec, Symantec.
Kaspersky, Kaspersky.
F-Secure.

In my opinion, Regin is your typical malware that expands outside of the reverse engineer/security community due to its original goal. Journalists or researchers with little kernel-level knowledge/background get a hold of it and before you know it, it's the next biggest sophisticated piece of malware and all that matters is PR. At this point, writing accurate and detailed articles doesn't matter anymore. What am I referring to, and what will I instead talk about with Regin?

Secret Malware in European Union Attack Linked to U.S. and British Intelligence.

Let's quickly talk about a short few things the whitepapers haven't mentioned (as far as I am aware), and the above article. Respectfully, I have absolutely no idea who reviewed the above article before it was pushed. You have to wonder if The Intercept rushed like hell to publish this article because Symantec released their whitepaper and didn't care about what half of it even said. Note the dates:

There's a lot of strange and irrelevant information in that article you can pick at, but the absolute best is:

This Regin driver recurrently checks that the current IRQL (Interrupt Request Level) is set to PASSIVE_LEVEL using the KeGetCurrentIrql() function in many parts of the code, probably in order to operate as silently as possible and to prevent possible IRQL confusion. This technique is another example of the level of precaution the developers took while designing this malware framework.

Since its publication date this has yet to have been changed, so I guess they don't care after all about its inaccuracies. Anyway, if it's not a surprise, calling KeGetCurrentIrql over and over again throughout the code is just a PAGED_CODE macro. It has absolutely nothing to do with stealth, and PASSIVE_LEVEL doesn't automatically imply obfuscation or stealth. For an example, here's an excerpt from db405ad775ac887a337b02ea8b07fddc (kernel driver - stage 1).

 call  KeGetCurrentIrql  
 test  al, al  
 jnz   short loc_FDEFAA3D  
 push  dword ptr [esi] ; Handle  
 call  ZwClose  
 test  eax, eax  
 jnz   short loc_FDEFAA3D  
 push  18h  
 push  ebx  
 push  esi  
 call  sub_FDEFA2EC  
 add   esp, 0Ch  
 mov   bl, 1

Again taking a look at db405ad775ac887a337b02ea8b07fddc, there's another interesting tidbit throughout the code:

 push  43726150h 
 push  20h  
 push  edi  
 call  ds:ExAllocatePoolWithTag

The above is the kernel mode driver's pool tag, the # of bytes to allocate for the memory request, the pool type, and finally its call to ExAllocatePoolWithTag allocate pool memory. Okay, so what's the big deal? If we convert the pool tag operand to a character, we get the following result:

 push  'CraP'  
 push  20h  
 push  edi  
 call  ds:ExAllocatePoolWithTag

The pooltag is CraP : ) This is probably how many of us feel about this malware being so hyped by the media. There are of course others throughout the code, for example:

 push  'CraP'  
 push  eax  
 push  1  
 call  ds:ExAllocatePoolWithTag

Overall, I guess the moral is to take time to get as much accurate information as you can for your articles. I cannot speak for anyone but myself, but as someone with a love for reverse engineering, malware, and debugging, I appreciate in-depth whitepapers and articles that provide thorough analysis. If all you're worried about is competition for views and hyping malware, chances are you're not going to appeal to the people who really care about the written content.

PS: Thanks to KernelMode as always for the hilarious discussion.

Sunday, November 16, 2014

Stuxnet - User/Kernel-Mode analysis

Today I'll be taking a look at Stuxnet, and at a kernel level mostly (as usual) more than its impact on user-mode. I'll still however be going over a few user-mode things as it ties in with our kernel level discussion. I also won't go in-depth regarding all of the ways Stuxnet uses its four-slot toolbelt of zero-day flaws, and a lot of other Stuxnet's methods of attack (network, etc). ESET, Symantec, and others have done a fantastic job in that regard.

What is Stuxnet?

First of all, it's important (and a bit hilarious) to know the story behind Stuxnet. If you're researching Stuxnet for the first time, it's really easy to get confused. There's finger pointing, claims, supposed "confirmed sources", etc, left and right. I'll briefly go over it. For example:

Confirmed: US and Israel created Stuxnet, lost control of it.

The article is adapted from journalist David Sanger's forthcoming book, Confront and Conceal: Obama’s Secret Wars and Surprising Use of American Power, and it confirms that both the US and Israeli governments developed and deployed Stuxnet.

Obama Order Sped Up Wave of Cyberattacks Against Iran.

Computer security experts who began studying the worm, which had been developed by the United States and Israel, gave it a name: Stuxnet.

US unleashed Stuxnet cyber war on Iran to appease Israel – report.

The US and Israel made the Stuxnet virus as a new kind of weapon targeted against Iran, a media investigation revealed. The operation reportedly started in the Bush era, but was intensified by Obama administration.

Snowden confirms NSA created Stuxnet with Israeli aid.

“The NSA and Israel wrote Stuxnet together,” Snowden told Applebaum in the interview that was carried out in May.

The big TLDR is here - Operation Olympic Games.

My initial reaction was "What the hell am I reading?", and it still sort of is. It goes on and on. All in all, after reading the above, you're likely inclined to believe that the US (and maybe even Israel) were behind Stuxnet. Whether or not this is true is a story for another day, although it's easier to lean towards 'yes' than it is to 'no'. The reason for this is due to the fact that Stuxnet as I discussed above used four zero-day flaws within Windows. It's a pretty big deal when malware exploits one zero-day flaw within the OS, but four is extremely high.

It's also pretty laughable to think that Stuxnet was created by amateurs not invested in any sort of organization regarding cyber warfare, etc of some sort, or amateurs in general. A lot of amateurs make malware for a lot of reasons, but causing nuclear centrifuges to commit suicide is pretty advanced. Aside from the many reasons to believe the answer is yes, some may lean towards no, and it's largely due to the fact that most cannot imagine the US and Israel working closely together to create something like Stuxnet.

I digress, and in any case, I'm not here to discuss politics or debate the true creator(s), so let's just get to the part where we talk about what Stuxnet was primarily created for. Stuxnet is a worm that was developed primarily to target industrial PLCs, which led to the nuclear centrifuges ultimately destroying themselves. The malware obviously couldn't be outright sent to the nuclear facilities themselves, so this is where its USB attack vector comes into play. More notably known as a supply chain attack:

So the creators of Stuxnet, they were thinking that these companies would do some communications with power plant workers; maybe exchange with USB devices. That’s probably how Stuxnet infected the system.

Stuxnet patient zero: Kaspesky Lab identifies worm’s first victims in Iran.

In the end, Stuxnet ended up destroying nearly one-fifth of Iran's centrifuges. In November 2010, it was reported that uranium enrichment within the Natanz nuclear facility had halted several times due to severe technical issues.

User-Mode

Stuxnet has two ways of injecting itself into the address space of a process and then executing exported functions. Stuxnet's user-mode modules are implemented as DLLs, and the first method is done by injecting itself into a preexisting process.

Preexisting Process Inject

1. Allocates a memory buffer in the calling process for the modules to be loaded.

2. Patches ntdll and hooks the following APIs:

ZwMapViewOfSection.

ZwCreateSection.

ZwOpenFile.

ZwClose.

ZwQueryAttributesFile.

ZwQuerySection.

Here's what a clean (unpatched) ntdll MZ header looks like:

We can see some of these hooks in action:

 ServiceDescriptor n°0  
 ---------------------  
   ServiceTable       : nt!KiServiceTable (804e26a8)  
   ParamTableBase      : nt!KiArgumentTable (80510088)  
   NumberOfServices     : 0000011c  
   Index Args Check System call  
   ----- ---- ----- -----------  
   0019  0001 HOOK-> f8c5761c ##### Original -> nt!NtClose (805678dd)  
   0029  0007 HOOK-> f8c575d6 ##### Original -> nt!NtCreateKey (8057065d)  
   0032  0007 HOOK-> f8c57626 ##### Original -> nt!NtCreateSection (805652b3)  
   0035  0008 HOOK-> f8c575cc ##### Original -> nt!NtCreateThread (8058e63f)  
   003F  0001 HOOK-> f8c575db ##### Original -> nt!NtDeleteKey (805952be)  
   0041  0002 HOOK-> f8c575e5 ##### Original -> nt!NtDeleteValueKey (80592d50)  
   0044  0007 HOOK-> f8c57617 ##### Original -> nt!NtDuplicateObject (805715e0)  
   0062  0002 HOOK-> f8c575ea ##### Original -> nt!NtLoadKey (805aed5d)  
   007A  0004 HOOK-> f8c575b8 ##### Original -> nt!NtOpenProcess (805717c7)  
   0080  0004 HOOK-> f8c575bd ##### Original -> nt!NtOpenThread (8058a1bd)  
   00B1  0006 HOOK-> f8c5763f ##### Original -> nt!NtQueryValueKey (8056a1f1)  
   00C1  0003 HOOK-> f8c575f4 ##### Original -> nt!NtReplaceKey (8064f0fa)  
   00C8  0003 HOOK-> f8c57630 ##### Original -> nt!NtRequestWaitReplyPort (80576ce6)  
   00CC  0003 HOOK-> f8c575ef ##### Original -> nt!NtRestoreKey (8064ec91)  
   00D5  0002 HOOK-> f8c5762b ##### Original -> nt!NtSetContextThread (8062dcdf)  
   00ED  0003 HOOK-> f8c57635 ##### Original -> nt!NtSetSecurityObject (8059b19b)  
   00F7  0006 HOOK-> f8c575e0 ##### Original -> nt!NtSetValueKey (80572889)  
   00FF  0006 HOOK-> f8c5763a ##### Original -> nt!NtSystemDebugControl (80649ce3)  
   0101  0002 HOOK-> f8c575c7 ##### Original -> nt!NtTerminateProcess (805822e0)

If we for example go ahead and disassemble our hooked nt!NtClose function, we see the following:

 lkd> u 0xFFFFFFFFF8C5761C L1  
 f8c5761c e92d8b23fe   jmp   f6e9014e

We have a hook regarding nt!NtClose and a jump. Classic rootkit behavior. Let's go further and dump the IAT by loading notepad.exe into OlyDbg and viewing executable modules:

 Address  Section  Type  ( Name                  Comment  
 0100102C  .text   Import ( GDI32.AbortDoc  
 0100131C  .text   Import   msvcrt._acmdln  
 0100132C  .text   Import   msvcrt._adjust_fdiv  
 01001300  .text   Import ( msvcrt._cexit  
 01001204  .text   Import ( USER32.CharLowerW  
 01001244  .text   Import ( USER32.CharNextW  
 010011C0  .text   Import ( USER32.CharUpperW  
 01001248  .text   Import ( USER32.CheckMenuItem  
 01001230  .text   Import ( USER32.ChildWindowFromPoint  
 010012D0  .text   Import ( comdlg32.ChooseFontW  
 0100124C  .text   Import ( USER32.CloseClipboard  
 010010F8  .text   Import ( KERNEL32.CloseHandle  
 010012B8  .text   Import   WINSPOOL.ClosePrinter  
 010012E0  .text   Import ( comdlg32.CommDlgExtendedError  
 010010EC  .text   Import ( KERNEL32.CompareStringW  
 0100133C  .text   Import ( msvcrt._controlfp  
 01001040  .text   Import ( GDI32.CreateDCW  
 01001214  .text   Import ( USER32.CreateDialogParamW  
 010010B4  .text   Import ( KERNEL32.CreateFileMappingW  
 01001104  .text   Import ( KERNEL32.CreateFileW  
 01001064  .text   Import ( GDI32.CreateFontIndirectW  
 01001020  .text   Import ( COMCTL32.CreateStatusWindowW  
 010011E0  .text   Import ( USER32.CreateWindowExW  
 010012F4  .text   Import ( msvcrt._c_exit  
 010011A4  .text   Import ( USER32.DefWindowProcW  
 01001034  .text   Import ( GDI32.DeleteDC  
 01001158  .text   Import ( KERNEL32.DeleteFileW  
 01001068  .text   Import ( GDI32.DeleteObject  
 010011A8  .text   Import ( USER32.DestroyWindow  
 01001198  .text   Import ( USER32.DialogBoxParamW  
 01001294  .text   Import ( USER32.DispatchMessageW  
 0100117C  .text   Import ( SHELL32.DragAcceptFiles  
 01001174  .text   Import ( SHELL32.DragFinish  
 01001178  .text   Import ( SHELL32.DragQueryFileW  
 01001210  .text   Import ( USER32.DrawTextExW  
 0100125C  .text   Import ( USER32.EnableMenuItem  
 0100120C  .text   Import ( USER32.EnableWindow  
 01001288  .text   Import ( USER32.EndDialog  
 01001030  .text   Import ( GDI32.EndDoc  
 01001028  .text   Import ( GDI32.EndPage  
 01001054  .text   Import ( GDI32.EnumFontsW  
 01001308  .text   Import ( msvcrt._except_handler3  
 010012F0  .text   Import ( msvcrt._exit  
 01001318  .text   Import ( msvcrt.exit  
 0100111C  .text   Import ( KERNEL32.FindClose  
 01001120  .text   Import ( KERNEL32.FindFirstFileW  
 010012C8  .text   Import ( comdlg32.FindTextW  
 010010F4  .text   Import   KERNEL32.FoldStringW  
 0100114C  .text   Import ( KERNEL32.FormatMessageW  
 0100115C  .text   Import ( KERNEL32.GetACP  
 01001188  .text   Import ( USER32.GetClientRect  
 01001114  .text   Import ( KERNEL32.GetCommandLineW  
 010010C0  .text   Import ( KERNEL32.GetCurrentProcess  
 0100110C  .text   Import ( KERNEL32.GetCurrentProcessId  
 0100108C  .text   Import ( KERNEL32.GetCurrentThreadId  
 01001238  .text   Import ( USER32.GetCursorPos  
 010010A0  .text   Import ( KERNEL32.GetDateFormatW  
 01001194  .text   Import ( USER32.GetDC  
 010011E4  .text   Import ( USER32.GetDesktopWindow  
 01001060  .text   Import ( GDI32.GetDeviceCaps  
 0100122C  .text   Import ( USER32.GetDlgCtrlID  
 01001274  .text   Import ( USER32.GetDlgItem  
 01001284  .text   Import ( USER32.GetDlgItemTextW  
 01001124  .text   Import ( KERNEL32.GetFileAttributesW  
 010010B0  .text   Import ( KERNEL32.GetFileInformationByHandle  
 010012D4  .text   Import ( comdlg32.GetFileTitleW  
 010011E8  .text   Import ( USER32.GetFocus  
 010011B4  .text   Import ( USER32.GetForegroundWindow  
 010011A0  .text   Import ( USER32.GetKeyboardLayout  
 01001138  .text   Import ( KERNEL32.GetLastError  
 010010D8  .text   Import ( KERNEL32.GetLocaleInfoW  
 01001098  .text   Import ( KERNEL32.GetLocalTime  
 01001320  .text   Import   msvcrt.__getmainargs  
 01001264  .text   Import ( USER32.GetMenu  
 01001258  .text   Import ( USER32.GetMenuState  
 010012A8  .text   Import ( USER32.GetMessageW  
 010010CC  .text   Import ( KERNEL32.GetModuleHandleA  
 0100105C  .text   Import ( GDI32.GetObjectW  
 010012D8  .text   Import ( comdlg32.GetOpenFileNameW  
 0100128C  .text   Import ( USER32.GetParent  
 010012B4  .text   Import   WINSPOOL.GetPrinterDriverW  
 01001110  .text   Import ( KERNEL32.GetProcAddress  
 010012E4  .text   Import ( comdlg32.GetSaveFileNameW  
 010010D0  .text   Import ( KERNEL32.GetStartupInfoA  
 01001058  .text   Import ( GDI32.GetStockObject  
 01001260  .text   Import ( USER32.GetSubMenu  
 010011CC  .text   Import ( USER32.GetSystemMenu  
 0100121C  .text   Import ( USER32.GetSystemMetrics  
 010010B8  .text   Import ( KERNEL32.GetSystemTimeAsFileTime  
 0100103C  .text   Import ( GDI32.GetTextExtentPoint32W  
 01001048  .text   Import ( GDI32.GetTextFaceW  
 0100106C  .text   Import ( GDI32.GetTextMetricsW  
 01001090  .text   Import ( KERNEL32.GetTickCount  
 010010A4  .text   Import   KERNEL32.GetTimeFormatW  
 0100109C  .text   Import ( KERNEL32.GetUserDefaultLCID  
 01001150  .text   Import   KERNEL32.GetUserDefaultUILanguage  
 01001270  .text   Import ( USER32.GetWindowLongW  
 010011BC  .text   Import ( USER32.GetWindowPlacement  
 01001218  .text   Import ( USER32.GetWindowTextW  
 010010D4  .text   Import ( KERNEL32.GlobalFree  
 010010A8  .text   Import ( KERNEL32.GlobalLock  
 010010AC  .text   Import ( KERNEL32.GlobalUnlock  
 01001324  .text   Import   msvcrt._initterm  
 01001224  .text   Import ( USER32.InvalidateRect  
 01001250  .text   Import ( USER32.IsClipboardFormatAvailable  
 010012A0  .text   Import ( USER32.IsDialogMessageW  
 010011B8  .text   Import ( USER32.IsIconic  
 0100100C  .text   Import   ADVAPI32.IsTextUnicode  
 01001304  .text   Import ( msvcrt.iswctype  
 010011C8  .text   Import ( USER32.LoadAcceleratorsW  
 010011D8  .text   Import ( USER32.LoadCursorW  
 010011EC  .text   Import ( USER32.LoadIconW  
 010011D4  .text   Import ( USER32.LoadImageW  
 010010C8  .text   Import ( KERNEL32.LoadLibraryA  
 010011C4  .text   Import ( USER32.LoadStringW  
 010010E0  .text   Import ( KERNEL32.LocalAlloc  
 010010DC  .text   Import ( KERNEL32.LocalFree  
 010010F0  .text   Import ( KERNEL32.LocalLock  
 01001148  .text   Import ( KERNEL32.LocalReAlloc  
 01001134  .text   Import ( KERNEL32.LocalSize  
 010012FC  .text   Import ( msvcrt.localtime  
 010010E8  .text   Import ( KERNEL32.LocalUnlock  
 01001074  .text   Import ( GDI32.LPtoDP  
 01001118  .text   Import ( KERNEL32.lstrcatW  
 01001108  .text   Import ( KERNEL32.lstrcmpiW  
 01001128  .text   Import ( KERNEL32.lstrcmpW  
 01001130  .text   Import ( KERNEL32.lstrcpynW  
 010010FC  .text   Import ( KERNEL32.lstrcpyW  
 010010E4  .text   Import ( KERNEL32.lstrlenW  
 01001168  .text   Import ( KERNEL32.MapViewOfFile  
 010011AC  .text   Import ( USER32.MessageBeep  
 01001268  .text   Import ( USER32.MessageBoxW  
 0100739D  .text   Export   <ModuleEntryPoint>  
 01001220  .text   Import ( USER32.MoveWindow  
 0100112C  .text   Import ( KERNEL32.MulDiv  
 01001164  .text   Import ( KERNEL32.MultiByteToWideChar  
 01001254  .text   Import ( USER32.OpenClipboard  
 010012BC  .text   Import   WINSPOOL.OpenPrinterW  
 010012C4  .text   Import   comdlg32.PageSetupDlgW  
 01001208  .text   Import ( USER32.PeekMessageW  
 010012A4  .text   Import ( USER32.PostMessageW  
 010011F4  .text   Import ( USER32.PostQuitMessage  
 010012CC  .text   Import   comdlg32.PrintDlgExW  
 01001330  .text   Import   msvcrt.__p__commode  
 01001334  .text   Import   msvcrt.__p__fmode  
 01001094  .text   Import ( KERNEL32.QueryPerformanceCounter  
 01001100  .text   Import ( KERNEL32.ReadFile  
 01001004  .text   Import ( ADVAPI32.RegCloseKey  
 01001008  .text   Import ( ADVAPI32.RegCreateKeyW  
 010011D0  .text   Import ( USER32.RegisterClassExW  
 010011F8  .text   Import ( USER32.RegisterWindowMessageW  
 01001014  .text   Import ( ADVAPI32.RegOpenKeyExA  
 01001010  .text   Import ( ADVAPI32.RegQueryValueExA  
 01001000  .text   Import ( ADVAPI32.RegQueryValueExW  
 01001018  .text   Import ( ADVAPI32.RegSetValueExW  
 01001190  .text   Import ( USER32.ReleaseDC  
 010012DC  .text   Import ( comdlg32.ReplaceTextW  
 01001234  .text   Import ( USER32.ScreenToClient  
 01001084  .text   Import ( GDI32.SelectObject  
 0100123C  .text   Import ( USER32.SendDlgItemMessageW  
 01001240  .text   Import ( USER32.SendMessageW  
 01001044  .text   Import ( GDI32.SetAbortProc  
 0100119C  .text   Import ( USER32.SetActiveWindow  
 01001070  .text   Import ( GDI32.SetBkMode  
 0100118C  .text   Import ( USER32.SetCursor  
 0100127C  .text   Import ( USER32.SetDlgItemTextW  
 01001154  .text   Import ( KERNEL32.SetEndOfFile  
 01001278  .text   Import ( USER32.SetFocus  
 01001140  .text   Import ( KERNEL32.SetLastError  
 01001080  .text   Import ( GDI32.SetMapMode  
 01001200  .text   Import ( USER32.SetScrollPos  
 010010C4  .text   Import ( KERNEL32.SetUnhandledExceptionFilter  
 01001328  .text   Import   msvcrt.__setusermatherr  
 0100107C  .text   Import ( GDI32.SetViewportExtEx  
 01001078  .text   Import ( GDI32.SetWindowExtEx  
 0100126C  .text   Import ( USER32.SetWindowLongW  
 010011DC  .text   Import ( USER32.SetWindowPlacement  
 010011F0  .text   Import ( USER32.SetWindowTextW  
 010012AC  .text   Import ( USER32.SetWinEventHook  
 01001338  .text   Import   msvcrt.__set_app_type  
 01001180  .text   Import ( SHELL32.ShellAboutW  
 010011B0  .text   Import ( USER32.ShowWindow  
 01001314  .text   Import ( msvcrt._snwprintf  
 01001050  .text   Import ( GDI32.StartDocW  
 01001038  .text   Import ( GDI32.StartPage  
 010010BC  .text   Import ( KERNEL32.TerminateProcess  
 0100104C  .text   Import ( GDI32.TextOutW  
 010012F8  .text   Import ( msvcrt.time  
 0100129C  .text   Import ( USER32.TranslateAcceleratorW  
 01001298  .text   Import ( USER32.TranslateMessage  
 0100116C  .text   Import ( KERNEL32.UnhandledExceptionFilter  
 01001290  .text   Import ( USER32.UnhookWinEvent  
 01001160  .text   Import ( KERNEL32.UnmapViewOfFile  
 010011FC  .text   Import ( USER32.UpdateWindow  
 01001310  .text   Import ( msvcrt.wcsncmp  
 01001340  .text   Import ( msvcrt.wcsncpy  
 01001144  .text   Import ( KERNEL32.WideCharToMultiByte  
 01001228  .text   Import ( USER32.WinHelpW  
 0100113C  .text   Import ( KERNEL32.WriteFile  
 01001280  .text   Import ( USER32.wsprintfW  
 0100130C  .text   Import ( msvcrt._wtol  
 010012EC  .text   Import   msvcrt._XcptFilter

The Import Address Table (IAT) is essentially just a table of jumps. It's used primarily as a lookup table when an application is calling a function in a different module. Compiled programs cannot know the memory locations of the libraries they depend on, therefore an indirect jump (jmp) is required whenever an API call is made.

In the above code we can see jumps to functions such as USER32.GetKeyboardLayout, which is a wrapper for the NtUserLoadKeyboardLayoutEx win32k syscall. This is in regards to Stuxnet's keyboard layout vulnerability (CVE-2010-2743), which is one of four exploitative ways used to escalate privileges in order to reach ring 0.

I would have loved to set a breakpoint on win32k!NtUserLoadKeyboardLayoutEx and trace the malware as it's extremely interesting, but setting breakpoints is not possible on an LKD session. I would have needed to break in to another physical machine (which I don't have), or set up a host > virtual COM port, which is a bit of a pain. I'll chalk it up to something to do on a rainy day. Call me lazy... I know.

3. Calls LoadLibraryW which is exported from kernel32.dll and passes it as a parameter for specially crafted file names such as: KERNEL32.DLL.ASLR.[HEX] or SHELL32.DLL.ASLR.[HEX]. Below we can see an example of a KERNEL32 variant:

4. Calls desired exported function.

5. Calls FreeLibrary function to free load library.

New Process Inject

The second method of injection is done through injecting a newly created process, as such:

1. Creates host process.

2. Replaces process image with the Stuxnet module to execute and with code that will load the module and call a specificed export passing parameters.

There's a few different image names that can be chosen as the host process for the module:

lsass.exe - MSFT system process in charge of enforcing the security policy.

avp.exe - Kaspersky.

mcshield.exe - McAfee VirusScan.

avguard.exe - Avira Personal Edition.

bdagent.exe - Bitdefender Switch Agent.

UmxCfg.exe - eTrust Configuration Engine (HIPS).

fsdfwd.exe - F-Secure.

rtvscan.exe - Symantec Real time Virus Scan Service.

ccSvchst.exe - Symantec Service Framework.

ekrn.exe - ESET Service Process.

tmproxy.exe - TrendMicro (PC-cillin in Australia and Virus Buster in Japan).

Malware Execution and Infection

First of all, to even successfully execute the malware you need to set your system time to before June 24th, 2012. This is due to the fact that Stuxnet hard-coded a poison pill to fully delete itself on June 24th, 2012. This was most likely done with the original idea in mind that Stuxnet wouldn't escape the nuclear facilities, which would allow time for Stuxnet to be reversed and ultimately defeated.

This piece of malware wanted to stay inside nuclear facilities, target Siemens systems, cause large actual damage, spread to cause more damage, and then go ghost. Fortunately, it did happen to escape its intended environment (some even speculate deliberately) and was inevitably reversed and defeated long before its hard-coded deletion date.

First of all, let's take a pre-infected look at the system with Autoruns + Process Explorer:

(Ignore the file not found messages)

Note the checked filter options > Verify code signatures + Hide Microsoft entries.

Everything looks to be pretty normal, and nothing really out of the ordinary. We can see we have one instance of lsass.exe.

Now let's turn things up a bit by executing the malware, and then comparing our results from pre-infection:

We can see now within Autoruns we have two new services - MRxCls and MRxNet. These are Stuxnet's kernel-mode drivers which enable its rookit functionality.

One big thing about malware that surfaces to the face of the public media (for whatever reason, we'll assume popularity/intention) is that journalists love to spin it and give awkward buzzwords - Undefeatable, The Most Sophisticated Malware, etc. Was Stuxnet an elborate piece of code? Yes, absolutely. Not only was knowledge needed regarding your typical rootkit/Win development, but heavy reverse engineering knowledge regarding Semens software was necessary as well.

However, one of Stuxnet's biggest weak points was its immense lack of anti-debugging/reversing techniques. Among a slew of reasons such as zero VM obfuscation, you can literally use the default regedit to find the locations of both MRxCLS and MRxNet. For example:

This had led Stuxnet to be something of a joke among some reverse engneers and analysts, even moreso if you believe that it was created by [insert government]. It's hard to imagine [insert government] wouldn't go to any lengths at all to hide its malware, but then again you never really know, right? : ) I'll continue the discussion regarding its kernel-mode functionality a little later as I'd like to swing back to user-mode real quick.

I couldn't get Process Explorer to run after infection, as the VM would bugcheck. I have no idea why, and AFAIK Stuxnet doesn't employ anti-debugging against Sysinternals tools by any means, so it was likely a buggy sample. I digress, and used VMmap instead:

We can see there's now three instances of lsass.exe, two of which are fake (newly created host processes). So first off, which is our legitmate lsass.exe? Well, 2/3 are the only ones above 1xxx regarding PID, so let's assume the only one not above 1xxx is legitimate:

If sort by Protection regarding the tabs, we can see it's mostly Execute/Read which doesn't raise any red flags. Let's assume for the moment this is legitimate and take a look at another one:

Uh oh, we can see two instances of memory that was chosen to share from this lsass.exe that has Write permissions in addition to Execute and Read. When a process has all three, it's a huge red flag for a fake/compromised process. In addition, note how the Size>Commited>Total Working Set, etc are equal. We can now at this point determine PID 648 is legitimate, and PID 1812 is fake. We can also at this point then assume that PID 1840 is fake as well:

Yep! In this case, we have five instances of memory that was chosen to be shared with R/W/E permissions, in addition to ntdll with R/W/E permissions as well. Note the Size>Commited>Total Working Set, etc equals again as well. At this point we can fully determine 1812 and 1840 are our fake lsass.exe instances, and 1840 is in relation to the patching of ntdll.

Let's further compare the three images based on their strings:

(PID 648 - legit)

(PID 1812 - fake #1)

Note we have quite the changes here, with the important being "!This program cannot run in DOS mode.". This is the classic MZ exe format used for .exe files within DOS. We can note the ASCII string - 4D. Let's take a look at the bottom of the string list:

(PID 1812 - fake #1)

We can see a number of functions, such as InternetOpen. We can at this point determine the DLL was successfully injected into this image of lsass.exe.

We can of course expect similar results with PID 1840:

(PID 1840 - fake #2)

We can also see abnormal termination of the NT Kernel, as well as a jmp:

Another big red flag of a malformed image.

Let's head back to discussing our kernel-mode drivers, MRxCls and MRxNet. As noted above, these two drivers aren't packed whatsoever with a protector nor packer, so inspecting them in-depth is painless:

First off, both of these drivers were digitally signed (albeit fake... what a surprise) to fool the user into believing it was a legitmate driver signed off as such by VeriSign. For example:

We can see MRxCls was fake-signed by VeriSign which claimed to be from Realtek. Realtek is obviously a legitimate company and releases lots of software/drivers for their products, such as audio, so this would fool a user if they ever questioned the legitimacy of the apparent MRxCls/Net drivers.

Using SwishDbgExt, let's dump the list of objects:

 lkd> !ms_object  
   Object: \ (Directory)  
   |------|----------------------|--------------------|---------------------------------------------------------------------------|  
   | Hdle | Object Type     | Addr        | Name                                                                                                                               |  
   |------|----------------------|--------------------|---------------------------------------------------------------------------|  
   | 0000 | Directory      | 0xFFFFFFFFE100D748 | ArcName                                                                                                                             |   
   | 0000 | Device        | 0xFFFFFFFF821C75C0 | Ntfs                                                                                                                               |   
   | 0000 | Port         | 0xFFFFFFFFE15EABB8 | SeLsaCommandPort                                                                                                                         |   
   | 0000 | Key         | 0xFFFFFFFFE1010478 | \REGISTRY                                                                                                                            |   
   | 0000 | Port         | 0xFFFFFFFFE186B9E8 | ThemeApiPort                                                                                                                           |   
   | 0000 | Port         | 0xFFFFFFFFE1B05230 | XactSrvLpcPort                                                                                                                          |   
   | 0000 | Directory      | 0xFFFFFFFFE15AA4B8 | NLS                                                                                                                               |   
   | 0000 | SymbolicLink     | 0xFFFFFFFFE1008748 | DosDevices                                                                                                                            |   
   | 0000 | Port         | 0xFFFFFFFFE13D4B68 | SeRmCommandPort                                                                                                                         |   
   | 0000 | Port         | 0xFFFFFFFFE173BA00 | LsaAuthenticationPort                                                                                                                      |   
   | 0000 | Device        | 0xFFFFFFFF82063A90 | Dfs                                                                                                                               |   
   | 0000 | Event        | 0xFFFFFFFF821EF5C0 |                                                                                                                                 |   
   | 0000 | Directory      | 0xFFFFFFFFE100E838 | Driver

Notice the strange 'Driver' object with a 'Directory' type. Let's take a look:

 lkd> !ms_object 0xFFFFFFFFE100E838  
   Object: Driver (Directory)  
   |------|----------------------|--------------------|---------------------------------------------------------------------------|  
   | Hdle | Object Type     | Addr        | Name                                                                                                                               |  
   |------|----------------------|--------------------|---------------------------------------------------------------------------|  
   | 0000 | Driver        | 0xFFFFFFFF8231ECC0 | \Driver\Beep                                                                                                                           |   
   | 0000 | Driver        | 0xFFFFFFFF821C72C0 | \Driver\NDIS                                                                                                                           |   
   | 0000 | Driver        | 0xFFFFFFFF821D39C0 | \Driver\KSecDD                                                                                                                          |   
   | 0000 | Driver        | 0xFFFFFFFF82198F38 | \Driver\Mouclass                                                                                                                         |   
   | 0000 | Driver        | 0xFFFFFFFF82245410 | \Driver\Raspti                                                                                                                          |   
   | 0000 | Driver        | 0xFFFFFFFF81F18768 | \Driver\es1371                                                                                                                          |   
   ...                                                                                                                      |   
   | 0000 | Driver        | 0xFFFFFFFF81EA2880 | \Driver\MRxCls                                                                                                                          |   
   | 0000 | Driver        | 0xFFFFFFFF821DE4A0 | \Driver\PCnet                                                                                                                          |   
   | 0000 | Driver        | 0xFFFFFFFF81F0FAE8 | \Driver\MRxNet

Let's dump the driver object information for MRxNet:

 lkd> !drvobj 81f0fae8  
 Driver object (81f0fae8) is for:  
  \Driver\MRxNet  
 Driver Extension List: (id , addr)  
 Device Object list:  
 820ee288 81f10020 81ebac80 82136298  
 82302298 82339be0 821bb500 821996c0  
 821bc238 8224a9d0

We can see MRxNet has a lot of device objects, so let's check one:

 lkd> !devobj 81ebac80   
 Device object (81ebac80) is for:  
  \Driver\MRxNet DriverObject 81f0fae8  
 Current Irp 00000000 RefCount 0 Type 00000003 Flags 00000080  
 DevExt 81ebad38 DevObjExt 81ebad40   
 ExtensionFlags (0000000000)   
 AttachedTo (Lower) 821d4450 \FileSystem\Cdfs

Stuxnet creates new device objects and attaches to the device chain for each device object. As we can see, Stuxnet attached to cdfs.sys, which is part of the filesystem, specifically the CD-ROM filesystem driver. Other filesystem drivers it attaches to are: ntfs.sys, and fastfat.sys. After attaching, Stuxnet manages the driver object, which in turn provides Stuxnet with the ability to succesfully intercept IRP requests.

Other than checking regedit, we can also confirm the existence of the MRxCls service within the registry using the !dreg command, which displays formatted registry key information. Before we do this however, we need to load ntsdexts.dll, or we'll get the following:

 lkd> !dreg System\CurrentControlSet\Services  
 No export dreg found

This is due to the fact that ntsdexts.dll isn't of course loaded in the extension DLL chain list:

 lkd> .chain  
 Extension DLL search Path:  
   C:\Program Files\Debugging Tools for Windows (x86)\WINXP;C:\Program Files\Debugging Tools for Windows (x86)\winext;C:\Program Files\Debugging Tools for Windows (x86)\winext\arcade;C:\Program Files\Debugging Tools for Windows (x86)\pri;C:\Program Files\Debugging Tools for Windows (x86);C:\Program Files\Debugging Tools for Windows (x86)\winext\arcade;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem  
 Extension DLL chain:  
   dbghelp: image 6.12.0002.633, API 6.1.6, built Mon Feb 01 15:08:26 2010  
     [path: C:\Program Files\Debugging Tools for Windows (x86)\dbghelp.dll]  
   ext: image 6.12.0002.633, API 1.0.0, built Mon Feb 01 15:08:31 2010  
     [path: C:\Program Files\Debugging Tools for Windows (x86)\winext\ext.dll]  
   exts: image 6.12.0002.633, API 1.0.0, built Mon Feb 01 15:08:24 2010  
     [path: C:\Program Files\Debugging Tools for Windows (x86)\WINXP\exts.dll]  
   kext: image 6.12.0002.633, API 1.0.0, built Mon Feb 01 15:08:22 2010  
     [path: C:\Program Files\Debugging Tools for Windows (x86)\winext\kext.dll]  
   kdexts: image 6.1.7650.0, API 1.0.0, built Mon Feb 01 15:08:19 2010  
     [path: C:\Program Files\Debugging Tools for Windows (x86)\WINXP\kdexts.dll]

After loading it however with .load ntsdexts, we can then see it's in the list:

 lkd> .chain  
 Extension DLL search Path:  
   C:\Program Files\Debugging Tools for Windows (x86)\WINXP;C:\Program Files\Debugging Tools for Windows (x86)\winext;C:\Program Files\Debugging Tools for Windows (x86)\winext\arcade;C:\Program Files\Debugging Tools for Windows (x86)\pri;C:\Program Files\Debugging Tools for Windows (x86);C:\Program Files\Debugging Tools for Windows (x86)\winext\arcade;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem  
 Extension DLL chain:  
   ntsdexts: image 6.1.7650.0, API 1.0.0, built Mon Feb 01 15:08:08 2010  
     [path: C:\Program Files\Debugging Tools for Windows (x86)\WINXP\ntsdexts.dll]  
   dbghelp: image 6.12.0002.633, API 6.1.6, built Mon Feb 01 15:08:26 2010  
     [path: C:\Program Files\Debugging Tools for Windows (x86)\dbghelp.dll]  
   ext: image 6.12.0002.633, API 1.0.0, built Mon Feb 01 15:08:31 2010  
     [path: C:\Program Files\Debugging Tools for Windows (x86)\winext\ext.dll]  
   exts: image 6.12.0002.633, API 1.0.0, built Mon Feb 01 15:08:24 2010  
     [path: C:\Program Files\Debugging Tools for Windows (x86)\WINXP\exts.dll]  
   kext: image 6.12.0002.633, API 1.0.0, built Mon Feb 01 15:08:22 2010  
     [path: C:\Program Files\Debugging Tools for Windows (x86)\winext\kext.dll]  
   kdexts: image 6.1.7650.0, API 1.0.0, built Mon Feb 01 15:08:19 2010  
     [path: C:\Program Files\Debugging Tools for Windows (x86)\WINXP\kdexts.dll]

Let's now run !dreg again with our path to MRxCls:

 lkd> !dreg System\CurrentControlSet\Services\MRxCls  
 Subkey: Enum

There it is, and we can see its subkey is Enum. We can confirm that looking back at the screenshot of its registry location above from earlier.

Here were the overall changes in the registry comparing pre-infection > post-infection:

 ----------------------------------  
 Keys deleted: 23  
 ----------------------------------  
 HKLM\SYSTEM\ControlSet001\Enum\Root\LEGACY_MRXCLS  
 HKLM\SYSTEM\ControlSet001\Enum\Root\LEGACY_MRXCLS\0000  
 HKLM\SYSTEM\ControlSet001\Enum\Root\LEGACY_MRXCLS\0000\Control  
 HKLM\SYSTEM\ControlSet001\Enum\Root\LEGACY_MRXNET  
 HKLM\SYSTEM\ControlSet001\Enum\Root\LEGACY_MRXNET\0000  
 HKLM\SYSTEM\ControlSet001\Enum\Root\LEGACY_MRXNET\0000\Control  
 HKLM\SYSTEM\ControlSet001\Services\MRxCls  
 HKLM\SYSTEM\ControlSet001\Services\MRxCls\Enum  
 HKLM\SYSTEM\ControlSet001\Services\MRxNet  
 HKLM\SYSTEM\ControlSet001\Services\MRxNet\Enum  
 HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_MRXCLS  
 HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_MRXCLS\0000  
 HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_MRXCLS\0000\Control  
 HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_MRXNET  
 HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_MRXNET\0000  
 HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_MRXNET\0000\Control  
 HKLM\SYSTEM\CurrentControlSet\Services\MRxCls  
 HKLM\SYSTEM\CurrentControlSet\Services\MRxCls\Enum  
 HKLM\SYSTEM\CurrentControlSet\Services\MRxNet  
 HKLM\SYSTEM\CurrentControlSet\Services\MRxNet\Enum  
 HKU\S-1-5-21-515967899-1935655697-682003330-1003\Software\Microsoft\Windows\ShellNoRoam\BagMRU\6\0\0  
 HKU\S-1-5-21-515967899-1935655697-682003330-1003\Software\Microsoft\Windows\ShellNoRoam\Bags\34  
 HKU\S-1-5-21-515967899-1935655697-682003330-1003\Software\Microsoft\Windows\ShellNoRoam\Bags\34\Shell  
 ----------------------------------  
 Values deleted: 110  
 ----------------------------------  
 HKLM\SYSTEM\ControlSet001\Enum\Root\LEGACY_MRXCLS\NextInstance: 0x00000001  
 HKLM\SYSTEM\ControlSet001\Enum\Root\LEGACY_MRXCLS\0000\Service: "MRxCls"  
 HKLM\SYSTEM\ControlSet001\Enum\Root\LEGACY_MRXCLS\0000\Legacy: 0x00000001  
 HKLM\SYSTEM\ControlSet001\Enum\Root\LEGACY_MRXCLS\0000\ConfigFlags: 0x00000000  
 HKLM\SYSTEM\ControlSet001\Enum\Root\LEGACY_MRXCLS\0000\Class: "LegacyDriver"  
 HKLM\SYSTEM\ControlSet001\Enum\Root\LEGACY_MRXCLS\0000\ClassGUID: "{8ECC055D-047F-11D1-A537-0000F8753ED1}"  
 HKLM\SYSTEM\ControlSet001\Enum\Root\LEGACY_MRXCLS\0000\DeviceDesc: "MRXCLS"  
 HKLM\SYSTEM\ControlSet001\Enum\Root\LEGACY_MRXCLS\0000\Control\*NewlyCreated*: 0x00000000  
 HKLM\SYSTEM\ControlSet001\Enum\Root\LEGACY_MRXCLS\0000\Control\ActiveService: "MRxCls"  
 HKLM\SYSTEM\ControlSet001\Enum\Root\LEGACY_MRXNET\NextInstance: 0x00000001  
 HKLM\SYSTEM\ControlSet001\Enum\Root\LEGACY_MRXNET\0000\Service: "MRxNet"  
 HKLM\SYSTEM\ControlSet001\Enum\Root\LEGACY_MRXNET\0000\Legacy: 0x00000001  
 HKLM\SYSTEM\ControlSet001\Enum\Root\LEGACY_MRXNET\0000\ConfigFlags: 0x00000000  
 HKLM\SYSTEM\ControlSet001\Enum\Root\LEGACY_MRXNET\0000\Class: "LegacyDriver"  
 HKLM\SYSTEM\ControlSet001\Enum\Root\LEGACY_MRXNET\0000\ClassGUID: "{8ECC055D-047F-11D1-A537-0000F8753ED1}"  
 HKLM\SYSTEM\ControlSet001\Enum\Root\LEGACY_MRXNET\0000\DeviceDesc: "MRXNET"  
 HKLM\SYSTEM\ControlSet001\Enum\Root\LEGACY_MRXNET\0000\Control\*NewlyCreated*: 0x00000000  
 HKLM\SYSTEM\ControlSet001\Enum\Root\LEGACY_MRXNET\0000\Control\ActiveService: "MRxNet"  
 HKLM\SYSTEM\ControlSet001\Services\MRxCls\Description: "MRXCLS"  
 HKLM\SYSTEM\ControlSet001\Services\MRxCls\DisplayName: "MRXCLS"  
 HKLM\SYSTEM\ControlSet001\Services\MRxCls\ErrorControl: 0x00000000  
 HKLM\SYSTEM\ControlSet001\Services\MRxCls\Group: "Network"  
 HKLM\SYSTEM\ControlSet001\Services\MRxCls\ImagePath: "\??\C:\WINDOWS\system32\Drivers\mrxcls.sys"  
 HKLM\SYSTEM\ControlSet001\Services\MRxCls\Start: 0x00000001  
 HKLM\SYSTEM\ControlSet001\Services\MRxCls\Type: 0x00000001  
 HKLM\SYSTEM\ControlSet001\Services\MRxCls\Data: 8F 1F F7 6D 7D B1 C9 09 9D CC 24 7A C6 9F FB 23 90 BD 9D BF F1 D4 51 92 2A B4 1F 6A 2E A6 4F B3 CB 69 7C 0B 92 3B 1B C0 D7 75 17 A9 E3 33 48 DC AD F6 DA EA 2F 87 10 C4 21 81 A5 75 68 00 2E B1 C2 7B EB DD BB 72 47 DC 87 91 14 A5 F3 C4 32 B0 CC 93 38 36 6B 49 0A F2 6F 1F 1D A1 4A 15 05 80 4B 13 A8 AA 82 41 4B 89 DC 89 24 A2 ED 16 37 F3 42 A9 A0 6A 7F 82 CD 90 E5 3C 49 CC B2 97 CA CB 7B 64 C1 48 B2 4C F5 AE 54 42 74 0F 00 31 FD 80 E8 7E 0E 69 12 42 3A EC 0F 6F 03 B8 46 9C 68 97 AC 62 16 FB 1A 1B D9 33 6C E8 F9 93 C3 56 54 A1 89 7A 7B 77 CE BA 0D 95 A7 0F AB 5E 1C 3C 18 63 AE 3E 60 A6 81 BC FA 85 FB 37 A0 0A 57 F9 C9 D3 CF 6B 41 D9 6D CD 39 71 C5 11 83 F1 D9 F3 7D B7 91 F7 70 46 C2 24 F7 B9 0F 2D B2 60 72 1C 8F F9 98 16 34 52 4B 7D 5F 81 5F 35 FD 8B 3E 78 B1 0B 0A 90 5A D8 30 5A 56 90 9A C0 C1 0F EB 95 D5 2F B7 C5 8D 2B 3F 49 41 8B 86 B4 DB 71 67 69 E6 E8 69 77 29 77 18 82 11 8B D7 5D 26 E4 5A 5C 2C 46 C2 F0 02 28 D8 EA 4B 95 9C 3A 3C 12 DA   
 C4 87 21 91 4F D0 6E FA C4 DD B7 C9 AF E2 AE FE 14 0F 53 C4 BA DD 31 1A 38 7B 37 C0 9E 83 FF 2C B2 4C 88 33 C1 89 E5 CA 68 31 2D 20 CE 50 64 7B 39 C7 FB B1 9F A9 0D 6C 2A 82 AE 7F 25 43 A7 A2 28 EB 27 73 C9 45 F9 FD 53 A8 F4 A7 FD B4 90 B2 28 D8 0C 5A A8 84 D0 7F ED 99 25 18 FE B8 4C 48 66 8D 59 40 F6 CC 30 A6 F4 04 E8 76 9C EA 0E F6 A4 4A CE D2  
 HKLM\SYSTEM\ControlSet001\Services\MRxCls\Enum\0: "Root\LEGACY_MRXCLS\0000"  
 HKLM\SYSTEM\ControlSet001\Services\MRxCls\Enum\Count: 0x00000001  
 HKLM\SYSTEM\ControlSet001\Services\MRxCls\Enum\NextInstance: 0x00000001  
 HKLM\SYSTEM\ControlSet001\Services\MRxNet\Description: "MRXNET"  
 HKLM\SYSTEM\ControlSet001\Services\MRxNet\DisplayName: "MRXNET"  
 HKLM\SYSTEM\ControlSet001\Services\MRxNet\ErrorControl: 0x00000000  
 HKLM\SYSTEM\ControlSet001\Services\MRxNet\Group: "Network"  
 HKLM\SYSTEM\ControlSet001\Services\MRxNet\ImagePath: "\??\C:\WINDOWS\system32\Drivers\mrxnet.sys"  
 HKLM\SYSTEM\ControlSet001\Services\MRxNet\Start: 0x00000001  
 HKLM\SYSTEM\ControlSet001\Services\MRxNet\Type: 0x00000001  
 HKLM\SYSTEM\ControlSet001\Services\MRxNet\Enum\0: "Root\LEGACY_MRXNET\0000"  
 HKLM\SYSTEM\ControlSet001\Services\MRxNet\Enum\Count: 0x00000001  
 HKLM\SYSTEM\ControlSet001\Services\MRxNet\Enum\NextInstance: 0x00000001  
 HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_MRXCLS\NextInstance: 0x00000001  
 HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_MRXCLS\0000\Service: "MRxCls"  
 HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_MRXCLS\0000\Legacy: 0x00000001  
 HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_MRXCLS\0000\ConfigFlags: 0x00000000  
 HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_MRXCLS\0000\Class: "LegacyDriver"  
 HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_MRXCLS\0000\ClassGUID: "{8ECC055D-047F-11D1-A537-0000F8753ED1}"  
 HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_MRXCLS\0000\DeviceDesc: "MRXCLS"  
 HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_MRXCLS\0000\Control\*NewlyCreated*: 0x00000000  
 HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_MRXCLS\0000\Control\ActiveService: "MRxCls"  
 HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_MRXNET\NextInstance: 0x00000001  
 HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_MRXNET\0000\Service: "MRxNet"  
 HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_MRXNET\0000\Legacy: 0x00000001  
 HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_MRXNET\0000\ConfigFlags: 0x00000000  
 HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_MRXNET\0000\Class: "LegacyDriver"  
 HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_MRXNET\0000\ClassGUID: "{8ECC055D-047F-11D1-A537-0000F8753ED1}"  
 HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_MRXNET\0000\DeviceDesc: "MRXNET"  
 HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_MRXNET\0000\Control\*NewlyCreated*: 0x00000000  
 HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_MRXNET\0000\Control\ActiveService: "MRxNet"  
 HKLM\SYSTEM\CurrentControlSet\Services\MRxCls\Description: "MRXCLS"  
 HKLM\SYSTEM\CurrentControlSet\Services\MRxCls\DisplayName: "MRXCLS"  
 HKLM\SYSTEM\CurrentControlSet\Services\MRxCls\ErrorControl: 0x00000000  
 HKLM\SYSTEM\CurrentControlSet\Services\MRxCls\Group: "Network"  
 HKLM\SYSTEM\CurrentControlSet\Services\MRxCls\ImagePath: "\??\C:\WINDOWS\system32\Drivers\mrxcls.sys"  
 HKLM\SYSTEM\CurrentControlSet\Services\MRxCls\Start: 0x00000001  
 HKLM\SYSTEM\CurrentControlSet\Services\MRxCls\Type: 0x00000001  
 HKLM\SYSTEM\CurrentControlSet\Services\MRxCls\Data: 8F 1F F7 6D 7D B1 C9 09 9D CC 24 7A C6 9F FB 23 90 BD 9D BF F1 D4 51 92 2A B4 1F 6A 2E A6 4F B3 CB 69 7C 0B 92 3B 1B C0 D7 75 17 A9 E3 33 48 DC AD F6 DA EA 2F 87 10 C4 21 81 A5 75 68 00 2E B1 C2 7B EB DD BB 72 47 DC 87 91 14 A5 F3 C4 32 B0 CC 93 38 36 6B 49 0A F2 6F 1F 1D A1 4A 15 05 80 4B 13 A8 AA 82 41 4B 89 DC 89 24 A2 ED 16 37 F3 42 A9 A0 6A 7F 82 CD 90 E5 3C 49 CC B2 97 CA CB 7B 64 C1 48 B2 4C F5 AE 54 42 74 0F 00 31 FD 80 E8 7E 0E 69 12 42 3A EC 0F 6F 03 B8 46 9C 68 97 AC 62 16 FB 1A 1B D9 33 6C E8 F9 93 C3 56 54 A1 89 7A 7B 77 CE BA 0D 95 A7 0F AB 5E 1C 3C 18 63 AE 3E 60 A6 81 BC FA 85 FB 37 A0 0A 57 F9 C9 D3 CF 6B 41 D9 6D CD 39 71 C5 11 83 F1 D9 F3 7D B7 91 F7 70 46 C2 24 F7 B9 0F 2D B2 60 72 1C 8F F9 98 16 34 52 4B 7D 5F 81 5F 35 FD 8B 3E 78 B1 0B 0A 90 5A D8 30 5A 56 90 9A C0 C1 0F EB 95 D5 2F B7 C5 8D 2B 3F 49 41 8B 86 B4 DB 71 67 69 E6 E8 69 77 29 77 18 82 11 8B D7 5D 26 E4 5A 5C 2C 46 C2 F0 02 28 D8 EA 4B 95 9C 3A 3C 12  
  DA C4 87 21 91 4F D0 6E FA C4 DD B7 C9 AF E2 AE FE 14 0F 53 C4 BA DD 31 1A 38 7B 37 C0 9E 83 FF 2C B2 4C 88 33 C1 89 E5 CA 68 31 2D 20 CE 50 64 7B 39 C7 FB B1 9F A9 0D 6C 2A 82 AE 7F 25 43 A7 A2 28 EB 27 73 C9 45 F9 FD 53 A8 F4 A7 FD B4 90 B2 28 D8 0C 5A A8 84 D0 7F ED 99 25 18 FE B8 4C 48 66 8D 59 40 F6 CC 30 A6 F4 04 E8 76 9C EA 0E F6 A4 4A CE D2  
 HKLM\SYSTEM\CurrentControlSet\Services\MRxCls\Enum\0: "Root\LEGACY_MRXCLS\0000"  
 HKLM\SYSTEM\CurrentControlSet\Services\MRxCls\Enum\Count: 0x00000001  
 HKLM\SYSTEM\CurrentControlSet\Services\MRxCls\Enum\NextInstance: 0x00000001  
 HKLM\SYSTEM\CurrentControlSet\Services\MRxNet\Description: "MRXNET"  
 HKLM\SYSTEM\CurrentControlSet\Services\MRxNet\DisplayName: "MRXNET"  
 HKLM\SYSTEM\CurrentControlSet\Services\MRxNet\ErrorControl: 0x00000000  
 HKLM\SYSTEM\CurrentControlSet\Services\MRxNet\Group: "Network"  
 HKLM\SYSTEM\CurrentControlSet\Services\MRxNet\ImagePath: "\??\C:\WINDOWS\system32\Drivers\mrxnet.sys"  
 HKLM\SYSTEM\CurrentControlSet\Services\MRxNet\Start: 0x00000001  
 HKLM\SYSTEM\CurrentControlSet\Services\MRxNet\Type: 0x00000001  
 HKLM\SYSTEM\CurrentControlSet\Services\MRxNet\Enum\0: "Root\LEGACY_MRXNET\0000"  
 HKLM\SYSTEM\CurrentControlSet\Services\MRxNet\Enum\Count: 0x00000001  
 HKLM\SYSTEM\CurrentControlSet\Services\MRxNet\Enum\NextInstance: 0x00000001  
 HKU\S-1-5-21-515967899-1935655697-682003330-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\HRZR_EHAPCY:gvzrqngr.pcy: 04 00 00 00 06 00 00 00 00 54 07 85 81 FE CF 01  
 HKU\S-1-5-21-515967899-1935655697-682003330-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\HRZR_EHACNGU:P:\Qbphzragf naq Frggvatf\Bjare\Qrfxgbc\ZJ\Ybgf bs Fghkarg\fazj\znyjner.rkr: 04 00 00 00 06 00 00 00 50 13 53 27 90 93 CA 01  
 HKU\S-1-5-21-515967899-1935655697-682003330-1003\Software\Microsoft\Windows\ShellNoRoam\BagMRU\6\0\0: 34 00 31 00 00 00 00 00 2C 3C 8C 70 10 00 73 6E 6D 77 00 00 20 00 03 00 04 00 EF BE 2C 3C 8C 70 2C 3C 8C 70 14 00 00 00 73 00 6E 00 6D 00 77 00 00 00 14 00 00 00  
 HKU\S-1-5-21-515967899-1935655697-682003330-1003\Software\Microsoft\Windows\ShellNoRoam\BagMRU\6\0\0\NodeSlot: 0x00000022  
 HKU\S-1-5-21-515967899-1935655697-682003330-1003\Software\Microsoft\Windows\ShellNoRoam\BagMRU\6\0\0\MRUListEx: FF FF FF FF  
 HKU\S-1-5-21-515967899-1935655697-682003330-1003\Software\Microsoft\Windows\ShellNoRoam\Bags\34\Shell\FolderType: "Documents"  
 HKU\S-1-5-21-515967899-1935655697-682003330-1003\Software\Microsoft\Windows\ShellNoRoam\Bags\34\Shell\Mode: 0x00000006  
 HKU\S-1-5-21-515967899-1935655697-682003330-1003\Software\Microsoft\Windows\ShellNoRoam\Bags\34\Shell\ScrollPos1280x720(1).x: 0x00000000  
 HKU\S-1-5-21-515967899-1935655697-682003330-1003\Software\Microsoft\Windows\ShellNoRoam\Bags\34\Shell\ScrollPos1280x720(1).y: 0x00000000  
 HKU\S-1-5-21-515967899-1935655697-682003330-1003\Software\Microsoft\Windows\ShellNoRoam\Bags\34\Shell\Sort: 0x00000000  
 HKU\S-1-5-21-515967899-1935655697-682003330-1003\Software\Microsoft\Windows\ShellNoRoam\Bags\34\Shell\SortDir: 0x00000001  
 HKU\S-1-5-21-515967899-1935655697-682003330-1003\Software\Microsoft\Windows\ShellNoRoam\Bags\34\Shell\Col: 0xFFFFFFFF  
 HKU\S-1-5-21-515967899-1935655697-682003330-1003\Software\Microsoft\Windows\ShellNoRoam\Bags\34\Shell\ColInfo: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 FD DF DF FD 0F 00 06 00 28 00 10 00 34 00 48 00 00 00 00 00 01 00 00 00 02 00 00 00 03 00 00 00 04 00 00 00 05 00 00 00 B4 00 60 00 78 00 78 00 B4 00 B4 00 00 00 00 00 01 00 00 00 02 00 00 00 03 00 00 00 FF FF FF FF 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  
 HKU\S-1-5-21-515967899-1935655697-682003330-1003\Software\Microsoft\Windows\ShellNoRoam\Bags\34\Shell\MinPos1280x720(1).x: 0xFFFFFFFF  
 HKU\S-1-5-21-515967899-1935655697-682003330-1003\Software\Microsoft\Windows\ShellNoRoam\Bags\34\Shell\MinPos1280x720(1).y: 0xFFFFFFFF  
 HKU\S-1-5-21-515967899-1935655697-682003330-1003\Software\Microsoft\Windows\ShellNoRoam\Bags\34\Shell\MaxPos1280x720(1).x: 0xFFFFFFFF  
 HKU\S-1-5-21-515967899-1935655697-682003330-1003\Software\Microsoft\Windows\ShellNoRoam\Bags\34\Shell\MaxPos1280x720(1).y: 0xFFFFFFFF  
 HKU\S-1-5-21-515967899-1935655697-682003330-1003\Software\Microsoft\Windows\ShellNoRoam\Bags\34\Shell\WinPos1280x720(1).left: 0x000000CB  
 HKU\S-1-5-21-515967899-1935655697-682003330-1003\Software\Microsoft\Windows\ShellNoRoam\Bags\34\Shell\WinPos1280x720(1).top: 0x00000034  
 HKU\S-1-5-21-515967899-1935655697-682003330-1003\Software\Microsoft\Windows\ShellNoRoam\Bags\34\Shell\WinPos1280x720(1).right: 0x000003EB  
 HKU\S-1-5-21-515967899-1935655697-682003330-1003\Software\Microsoft\Windows\ShellNoRoam\Bags\34\Shell\WinPos1280x720(1).bottom: 0x0000028C  
 HKU\S-1-5-21-515967899-1935655697-682003330-1003\Software\Microsoft\Windows\ShellNoRoam\Bags\34\Shell\Rev: 0x00000000  
 HKU\S-1-5-21-515967899-1935655697-682003330-1003\Software\Microsoft\Windows\ShellNoRoam\Bags\34\Shell\WFlags: 0x00000000  
 HKU\S-1-5-21-515967899-1935655697-682003330-1003\Software\Microsoft\Windows\ShellNoRoam\Bags\34\Shell\ShowCmd: 0x00000001  
 HKU\S-1-5-21-515967899-1935655697-682003330-1003\Software\Microsoft\Windows\ShellNoRoam\Bags\34\Shell\FFlags: 0x00000001  
 HKU\S-1-5-21-515967899-1935655697-682003330-1003\Software\Microsoft\Windows\ShellNoRoam\Bags\34\Shell\HotKey: 0x00000000  
 HKU\S-1-5-21-515967899-1935655697-682003330-1003\Software\Microsoft\Windows\ShellNoRoam\Bags\34\Shell\Buttons: 0xFFFFFFFF  
 HKU\S-1-5-21-515967899-1935655697-682003330-1003\Software\Microsoft\Windows\ShellNoRoam\Bags\34\Shell\Links: 0x00000000  
 HKU\S-1-5-21-515967899-1935655697-682003330-1003\Software\Microsoft\Windows\ShellNoRoam\Bags\34\Shell\Address: 0x00000000  
 HKU\S-1-5-21-515967899-1935655697-682003330-1003\Software\Microsoft\Windows\ShellNoRoam\Bags\34\Shell\Vid: "{65F125E5-7BE1-4810-BA9D-D271C8432CE3}"  
 HKU\S-1-5-21-515967899-1935655697-682003330-1003\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\Documents and Settings\Owner\Desktop\MW\Lots of Stuxnet\snmw\malware.exe: "malware"  
 HKU\S-1-5-21-515967899-1935655697-682003330-1003\Software\WinRAR\Interface\ShowPassword: 0x00000000  
 ----------------------------------  
 Values modified: 17  
 ----------------------------------  
 HKLM\SOFTWARE\Microsoft\Cryptography\RNG\Seed: 5B 70 29 6B 9F F8 6B 2E 27 BB 05 43 02 B3 42 43 88 7C 39 EA 7C 8F C3 C1 DA 61 6A 7A 3D A9 27 BB 06 12 F2 A2 B5 89 09 83 C9 CE 03 F8 7F 6C 1E 79 D9 10 7D F0 29 05 03 B9 29 88 8C EC E2 3C CB 04 12 E3 E3 EC 8F E6 27 0A 15 A9 09 6C 29 34 89 55  
 HKLM\SOFTWARE\Microsoft\Cryptography\RNG\Seed: 53 06 23 D9 FE 36 71 5D D7 02 23 98 92 D3 0C AA 52 45 17 A4 D9 2B 2E E6 C7 C1 12 FE D2 A0 E1 8A 5F CF 23 E0 9B 16 74 7E DC 38 BF 7E D6 F0 9F 97 9A 5B C8 12 7C C2 9E CE EF 95 DE D1 60 56 23 7A 21 96 9C 23 E4 CF D9 77 67 97 F4 EA F1 0D 25 18  
 HKU\S-1-5-21-515967899-1935655697-682003330-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{5E6AB780-7743-11CF-A12B-00AA004AE837}\Count\HRZR_PGYFRFFVBA: 81 9C 54 0E 05 00 00 00  
 HKU\S-1-5-21-515967899-1935655697-682003330-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{5E6AB780-7743-11CF-A12B-00AA004AE837}\Count\HRZR_PGYFRFFVBA: E3 F3 7F 0E 04 00 00 00  
 HKU\S-1-5-21-515967899-1935655697-682003330-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\HRZR_EHACNGU: 04 00 00 00 79 00 00 00 E0 8D E6 42 90 93 CA 01  
 HKU\S-1-5-21-515967899-1935655697-682003330-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\HRZR_EHACNGU: 04 00 00 00 77 00 00 00 A0 EC DC 76 81 FE CF 01  
 HKU\S-1-5-21-515967899-1935655697-682003330-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\HRZR_EHAPCY: 04 00 00 00 0B 00 00 00 00 54 07 85 81 FE CF 01  
 HKU\S-1-5-21-515967899-1935655697-682003330-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\HRZR_EHAPCY: 01 00 00 00 0B 00 00 00 60 F6 98 73 27 F4 CF 01  
 HKU\S-1-5-21-515967899-1935655697-682003330-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\HRZR_HVFPHG: 04 00 00 00 4C 00 00 00 F0 8C 4C 41 90 93 CA 01  
 HKU\S-1-5-21-515967899-1935655697-682003330-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\HRZR_HVFPHG: 04 00 00 00 4A 00 00 00 90 73 55 73 81 FE CF 01  
 HKU\S-1-5-21-515967899-1935655697-682003330-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\HRZR_EHACNGU:P:\Qbphzragf naq Frggvatf\Bjare\Qrfxgbc\FlfGbbyf\Nhgbehaf\nhgbehaf.rkr: 04 00 00 00 08 00 00 00 E0 8D E6 42 90 93 CA 01  
 HKU\S-1-5-21-515967899-1935655697-682003330-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\HRZR_EHACNGU:P:\Qbphzragf naq Frggvatf\Bjare\Qrfxgbc\FlfGbbyf\Nhgbehaf\nhgbehaf.rkr: 04 00 00 00 07 00 00 00 50 F6 45 98 7E FE CF 01  
 HKU\S-1-5-21-515967899-1935655697-682003330-1003\Software\Microsoft\Windows\Shell\Bags\1\Desktop\ItemPos1280x720(1): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 15 00 00 00 16 02 00 00 14 00 1F 60 40 F0 5F 64 81 50 1B 10 9F 08 00 AA 00 2F 95 4E 15 00 00 00 4E 00 00 00 5A 00 3A 00 D4 02 00 00 5E 45 49 46 20 00 4D 4F 5A 49 4C 4C 7E 31 2E 4C 4E 4B 00 00 3E 00 03 00 04 00 EF BE 5E 45 49 46 6C 45 D2 6B 14 00 00 00 4D 00 6F 00 7A 00 69 00 6C 00 6C 00 61 00 20 00 46 00 69 00 72 00 65 00 66 00 6F 00 78 00 2E 00 6C 00 6E 00 6B 00 00 00 1C 00 15 00 00 00 CA 01 00 00 34 00 31 00 00 00 00 00 5E 45 65 50 10 00 6D 62 61 72 00 00 20 00 03 00 04 00 EF BE 5E 45 63 50 5F 45 8D 55 14 00 00 00 6D 00 62 00 61 00 72 00 00 00 14 00 60 00 00 00 CA 01 00 00 2E 00 31 00 00 00 00 00 6C 45 4F 6C 10 00 4D 57 00 00 1C 00 03 00 04 00 EF BE 6C 45 48 6C 6C 45 4F 6C 14 00 00 00 4D 00 57 00 00 00 12 00 60 00 00 00 E6 00 00 00 3C 00 31 00 00 00 00 00 6A 45 6B 21 10 00 6F 64 62 67 31 31 30 00 26 00 03 00 04 00 EF BE   
 6A 45 F4 1A 6C 45 59 6C 14 00 00 00 6F 00 64 00 62 00 67 00 31 00 31 00 30 00 00 00 16 00 AB 00 00 00 02 00 00 00 4C 00 31 00 00 00 00 00 6C 45 0F 6D 10 00 52 45 47 53 48 4F 7E 31 2E 30 00 00 32 00 03 00 04 00 EF BE 6C 45 0F 6D 6C 45 12 6D 14 00 00 00 52 00 65 00 67 00 73 00 68 00 6F 00 74 00 2D 00 31 00 2E 00 39 00 2E 00 30 00 00 00 1A 00 60 00 00 00 16 02 00 00 40 00 31 00 00 00 00 00 6C 45 D1 6E 10 00 53 79 73 54 6F 6F 6C 73 00 00 28 00 03 00 04 00 EF BE 6C 45 73 6C 6C 45 D1 6E 14 00 00 00 53 00 79 00 73 00 54 00 6F 00 6F 00 6C 00 73 00 00 00 18 00 15 00 00 00 02 00 00 00 3C 00 32 00 5F 38 1C 00 5E 45 EF 45 20 00 62 65 72 2E 72 61 72 00 26 00 03 00 04 00 EF BE 5E 45 EF 45 6C 45 AE 6B 14 00 00 00 62 00 65 00 72 00 2E 00 72 00 61 00 72 00 00 00 16 00 60 00 00 00 32 01 00 00 4E 00 32 00 78 ED 9C 00 5E 45 D0 51 20 00 48 49 54 4D 41 4E 7E 31 2E 45 58 45 00 00 32 00 03 00 04 00 EF BE 5E 45 C6 51 6A 45 87 28 14 00 00 00 48 00 69 00 74 00 6D 00 61 00 6E 00 50 00 72 00 6F 00 2E 00 65 00 78 0  
 0 65 00 00 00 1C 00 60 00 00 00 4E 00 00 00 5C 00 32 00 8B 02 00 00 6A 45 80 12 20 00 49 44 41 50 52 4F 7E 31 2E 4C 4E 4B 00 00 40 00 03 00 04 00 EF BE 6A 45 80 12 6A 45 E7 1A 14 00 00 00 49 00 44 00 41 00 20 00 50 00 72 00 6F 00 20 00 28 00 33 00 32 00 2D 00 62 00 69 00 74 00 29 00 2E 00 6C 00 6E 00 6B 00 00 00 1C 00 60 00 00 00 9A 00 00 00 5C 00 32 00 97 02 00 00 6A 45 80 12 20 00 49 44 41 50 52 4F 7E 32 2E 4C 4E 4B 00 00 40 00 03 00 04 00 EF BE 6A 45 80 12 6A 45 F3 1E 14 00 00 00 49 00 44 00 41 00 20 00 50 00 72 00 6F 00 20 00 28 00 36 00 34 00 2D 00 62 00 69 00 74 00 29 00 2E 00 6C 00 6E 00 6B 00 00 00 1C 00 60 00 00 00 02 00 00 00 52 00 32 00 CE 02 00 00 5E 45 74 83 20 00 4F 53 46 4F 52 45 7E 31 2E 4C 4E 4B 00 00 36 00 03 00 04 00 EF BE 5E 45 74 83 6A 45 12 59 14 00 00 00 4F 00 53 00 46 00 6F 00 72 00 65 00 6E 00 73 00 69 00 63 00 73 00 2E 00 6C 00 6E 00 6B 00 00 00 1C 00 15 00 00 00 9A 00 00 00 66 00 32 00 97 01 00 00 5E 45 ED 46 20 00 53 48 4F 52 54 43 7E 31 2E 4C 4E 4B 00 00 4A  
  00 03 00 04 00 EF BE 5E 45 ED 46 6C 45 75 6C 14 00 00 00 53 00 68 00 6F 00 72 00 74 00 63 00 75 00 74 00 20 00 74 00 6F 00 20 00 44 00 6F 00 77 00 6E 00 6C 00 6F 00 61 00 64 00 73 00 2E 00 6C 00 6E 00 6B 00 00 00 1C 00 15 00 00 00 E6 00 00 00 62 00 32 00 8A 02 00 00 5E 45 58 47 20 00 53 48 4F 52 54 43 7E 32 2E 4C 4E 4B 00 00 46 00 03 00 04 00 EF BE 5E 45 58 47 6C 45 E5 6C 14 00 00 00 53 00 68 00 6F 00 72 00 74 00 63 00 75 00 74 00 20 00 74 00 6F 00 20 00 66 00 69 00 72 00 65 00 66 00 6F 00 78 00 2E 00 6C 00 6E 00 6B 00 00 00 1C 00 15 00 00 00 32 01 00 00 60 00 32 00 DF 02 00 00 5E 45 A8 48 20 00 53 48 4F 52 54 43 7E 33 2E 4C 4E 4B 00 00 44 00 03 00 04 00 EF BE 5E 45 A8 48 6C 45 5A 6C 14 00 00 00 53 00 68 00 6F 00 72 00 74 00 63 00 75 00 74 00 20 00 74 00 6F 00 20 00 77 00 69 00 6E 00 64 00 62 00 67 00 2E 00 6C 00 6E 00 6B 00 00 00 1C 00 60 00 00 00 7E 01 00 00 50 00 32 00 F1 85 3F 00 5F 45 09 56 20 00 54 44 53 53 4B 49 7E 31 2E 5A 49 50 00 00 34 00 03 00 04 00 EF BE 5F 45 09 56 6C 45   
 75 6C 14 00 00 00 74 00 64 00 73 00 73 00 6B 00 69 00 6C 00 6C 00 65 00 72 00 2E 00 7A 00 69 00 70 00 00 00 1C 00 15 00 00 00 7E 01 00 00 4C 00 32 00 00 CE 05 00 5E 45 3B 50 20 00 74 67 32 69 6A 6E 6A 69 2E 65 78 65 00 00 30 00 03 00 04 00 EF BE 5E 45 3A 50 5E 45 35 83 14 00 00 00 74 00 67 00 32 00 69 00 6A 00 6E 00 6A 00 69 00 2E 00 65 00 78 00 65 00 00 00 1C 00 15 00 00 00 7E 01 00 00 00 00 00 00  
 HKU\S-1-5-21-515967899-1935655697-682003330-1003\Software\Microsoft\Windows\Shell\Bags\1\Desktop\ItemPos1280x720(1): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 15 00 00 00 16 02 00 00 14 00 1F 60 40 F0 5F 64 81 50 1B 10 9F 08 00 AA 00 2F 95 4E 15 00 00 00 4E 00 00 00 5A 00 3A 00 D4 02 00 00 5E 45 49 46 20 00 4D 4F 5A 49 4C 4C 7E 31 2E 4C 4E 4B 00 00 3E 00 03 00 04 00 EF BE 5E 45 49 46 6C 45 D2 6B 14 00 00 00 4D 00 6F 00 7A 00 69 00 6C 00 6C 00 61 00 20 00 46 00 69 00 72 00 65 00 66 00 6F 00 78 00 2E 00 6C 00 6E 00 6B 00 00 00 1C 00 15 00 00 00 CA 01 00 00 34 00 31 00 00 00 00 00 5E 45 65 50 10 00 6D 62 61 72 00 00 20 00 03 00 04 00 EF BE 5E 45 63 50 5F 45 8D 55 14 00 00 00 6D 00 62 00 61 00 72 00 00 00 14 00 60 00 00 00 CA 01 00 00 2E 00 31 00 00 00 00 00 6C 45 4F 6C 10 00 4D 57 00 00 1C 00 03 00 04 00 EF BE 6C 45 48 6C 6C 45 4F 6C 14 00 00 00 4D 00 57 00 00 00 12 00 60 00 00 00 E6 00 00 00 3C 00 31 00 00 00 00 00 6A 45 6B 21 10 00 6F 64 62 67 31 31 30 00 26 00 03 00 04 00 EF BE   
 6A 45 F4 1A 6C 45 59 6C 14 00 00 00 6F 00 64 00 62 00 67 00 31 00 31 00 30 00 00 00 16 00 60 00 00 00 16 02 00 00 40 00 31 00 00 00 00 00 6C 45 84 6C 10 00 53 79 73 54 6F 6F 6C 73 00 00 28 00 03 00 04 00 EF BE 6C 45 73 6C 6C 45 84 6C 14 00 00 00 53 00 79 00 73 00 54 00 6F 00 6F 00 6C 00 73 00 00 00 18 00 15 00 00 00 02 00 00 00 3C 00 32 00 5F 38 1C 00 5E 45 EF 45 20 00 62 65 72 2E 72 61 72 00 26 00 03 00 04 00 EF BE 5E 45 EF 45 6C 45 AE 6B 14 00 00 00 62 00 65 00 72 00 2E 00 72 00 61 00 72 00 00 00 16 00 60 00 00 00 32 01 00 00 4E 00 32 00 78 ED 9C 00 5E 45 D0 51 20 00 48 49 54 4D 41 4E 7E 31 2E 45 58 45 00 00 32 00 03 00 04 00 EF BE 5E 45 C6 51 6A 45 87 28 14 00 00 00 48 00 69 00 74 00 6D 00 61 00 6E 00 50 00 72 00 6F 00 2E 00 65 00 78 00 65 00 00 00 1C 00 60 00 00 00 4E 00 00 00 5C 00 32 00 8B 02 00 00 6A 45 80 12 20 00 49 44 41 50 52 4F 7E 31 2E 4C 4E 4B 00 00 40 00 03 00 04 00 EF BE 6A 45 80 12 6A 45 E7 1A 14 00 00 00 49 00 44 00 41 00 20 00 50 00 72 00 6F 00 20 00 28 00 33 00 32 0  
 0 2D 00 62 00 69 00 74 00 29 00 2E 00 6C 00 6E 00 6B 00 00 00 1C 00 60 00 00 00 9A 00 00 00 5C 00 32 00 97 02 00 00 6A 45 80 12 20 00 49 44 41 50 52 4F 7E 32 2E 4C 4E 4B 00 00 40 00 03 00 04 00 EF BE 6A 45 80 12 6A 45 F3 1E 14 00 00 00 49 00 44 00 41 00 20 00 50 00 72 00 6F 00 20 00 28 00 36 00 34 00 2D 00 62 00 69 00 74 00 29 00 2E 00 6C 00 6E 00 6B 00 00 00 1C 00 60 00 00 00 02 00 00 00 52 00 32 00 CE 02 00 00 5E 45 74 83 20 00 4F 53 46 4F 52 45 7E 31 2E 4C 4E 4B 00 00 36 00 03 00 04 00 EF BE 5E 45 74 83 6A 45 12 59 14 00 00 00 4F 00 53 00 46 00 6F 00 72 00 65 00 6E 00 73 00 69 00 63 00 73 00 2E 00 6C 00 6E 00 6B 00 00 00 1C 00 15 00 00 00 9A 00 00 00 66 00 32 00 97 01 00 00 5E 45 ED 46 20 00 53 48 4F 52 54 43 7E 31 2E 4C 4E 4B 00 00 4A 00 03 00 04 00 EF BE 5E 45 ED 46 6C 45 75 6C 14 00 00 00 53 00 68 00 6F 00 72 00 74 00 63 00 75 00 74 00 20 00 74 00 6F 00 20 00 44 00 6F 00 77 00 6E 00 6C 00 6F 00 61 00 64 00 73 00 2E 00 6C 00 6E 00 6B 00 00 00 1C 00 15 00 00 00 E6 00 00 00 62 00 32  
  00 8A 02 00 00 5E 45 58 47 20 00 53 48 4F 52 54 43 7E 32 2E 4C 4E 4B 00 00 46 00 03 00 04 00 EF BE 5E 45 58 47 6A 45 F3 1E 14 00 00 00 53 00 68 00 6F 00 72 00 74 00 63 00 75 00 74 00 20 00 74 00 6F 00 20 00 66 00 69 00 72 00 65 00 66 00 6F 00 78 00 2E 00 6C 00 6E 00 6B 00 00 00 1C 00 15 00 00 00 32 01 00 00 60 00 32 00 DF 02 00 00 5E 45 A8 48 20 00 53 48 4F 52 54 43 7E 33 2E 4C 4E 4B 00 00 44 00 03 00 04 00 EF BE 5E 45 A8 48 6C 45 5A 6C 14 00 00 00 53 00 68 00 6F 00 72 00 74 00 63 00 75 00 74 00 20 00 74 00 6F 00 20 00 77 00 69 00 6E 00 64 00 62 00 67 00 2E 00 6C 00 6E 00 6B 00 00 00 1C 00 60 00 00 00 7E 01 00 00 50 00 32 00 F1 85 3F 00 5F 45 09 56 20 00 54 44 53 53 4B 49 7E 31 2E 5A 49 50 00 00 34 00 03 00 04 00 EF BE 5F 45 09 56 6C 45 75 6C 14 00 00 00 74 00 64 00 73 00 73 00 6B 00 69 00 6C 00 6C 00 65 00 72 00 2E 00 7A 00 69 00 70 00 00 00 1C 00 15 00 00 00 7E 01 00 00 4C 00 32 00 00 CE 05 00 5E 45 3B 50 20 00 74 67 32 69 6A 6E 6A 69 2E 65 78 65 00 00 30 00 03 00 04 00 EF BE 5E 45   
 3A 50 5E 45 35 83 14 00 00 00 74 00 67 00 32 00 69 00 6A 00 6E 00 6A 00 69 00 2E 00 65 00 78 00 65 00 00 00 1C 00 AB 00 00 00 02 00 00 00 4C 00 31 00 00 00 00 00 6C 45 0F 6D 10 00 52 45 47 53 48 4F 7E 31 2E 30 00 00 32 00 03 00 04 00 EF BE 6C 45 0F 6D 6C 45 12 6D 14 00 00 00 52 00 65 00 67 00 73 00 68 00 6F 00 74 00 2D 00 31 00 2E 00 39 00 2E 00 30 00 00 00 1A 00 AB 00 00 00 02 00 00 00 00 00 00 00  
 HKU\S-1-5-21-515967899-1935655697-682003330-1003\Software\Microsoft\Windows\ShellNoRoam\BagMRU\NodeSlots: 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02  
 HKU\S-1-5-21-515967899-1935655697-682003330-1003\Software\Microsoft\Windows\ShellNoRoam\BagMRU\NodeSlots: 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02  
 HKU\S-1-5-21-515967899-1935655697-682003330-1003\Software\Microsoft\Windows\ShellNoRoam\BagMRU\MRUListEx: 07 00 00 00 06 00 00 00 08 00 00 00 02 00 00 00 01 00 00 00 05 00 00 00 04 00 00 00 03 00 00 00 00 00 00 00 FF FF FF FF  
 HKU\S-1-5-21-515967899-1935655697-682003330-1003\Software\Microsoft\Windows\ShellNoRoam\BagMRU\MRUListEx: 08 00 00 00 06 00 00 00 02 00 00 00 07 00 00 00 01 00 00 00 05 00 00 00 04 00 00 00 03 00 00 00 00 00 00 00 FF FF FF FF  
 HKU\S-1-5-21-515967899-1935655697-682003330-1003\Software\Microsoft\Windows\ShellNoRoam\BagMRU\6\0\MRUListEx: 00 00 00 00 FF FF FF FF  
 HKU\S-1-5-21-515967899-1935655697-682003330-1003\Software\Microsoft\Windows\ShellNoRoam\BagMRU\6\0\MRUListEx: FF FF FF FF  
 HKU\S-1-5-21-515967899-1935655697-682003330-1003\Software\Microsoft\Windows\ShellNoRoam\BagMRU\7\MRUListEx: 00 00 00 00 01 00 00 00 FF FF FF FF  
 HKU\S-1-5-21-515967899-1935655697-682003330-1003\Software\Microsoft\Windows\ShellNoRoam\BagMRU\7\MRUListEx: 01 00 00 00 00 00 00 00 FF FF FF FF  
 HKU\S-1-5-21-515967899-1935655697-682003330-1003\Software\Microsoft\Windows\ShellNoRoam\Bags\27\Shell\ItemPos1280x720(1): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 02 00 00 00 02 00 00 00 4E 00 31 00 00 00 00 00 6C 45 23 70 10 00 4C 4F 54 53 4F 46 7E 31 00 00 36 00 03 00 04 00 EF BE 6C 45 3C 6C 6C 45 23 70 14 00 00 00 4C 00 6F 00 74 00 73 00 20 00 6F 00 66 00 20 00 53 00 74 00 75 00 78 00 6E 00 65 00 74 00 00 00 18 00 DC 00 00 00 02 00 00 00 34 00 31 00 00 00 00 00 6C 45 51 6C 10 00 54 44 4C 34 00 00 20 00 03 00 04 00 EF BE 6C 45 4F 6C 6C 45 51 6C 14 00 00 00 54 00 44 00 4C 00 34 00 00 00 14 00 DC 00 00 00 02 00 00 00 00 00 00 00  
 HKU\S-1-5-21-515967899-1935655697-682003330-1003\Software\Microsoft\Windows\ShellNoRoam\Bags\27\Shell\ItemPos1280x720(1): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 02 00 00 00 02 00 00 00 4E 00 31 00 00 00 00 00 6C 45 E9 6C 10 00 4C 4F 54 53 4F 46 7E 31 00 00 36 00 03 00 04 00 EF BE 6C 45 3C 6C 6C 45 E9 6C 14 00 00 00 4C 00 6F 00 74 00 73 00 20 00 6F 00 66 00 20 00 53 00 74 00 75 00 78 00 6E 00 65 00 74 00 00 00 18 00 DC 00 00 00 02 00 00 00 34 00 31 00 00 00 00 00 6C 45 51 6C 10 00 54 44 4C 34 00 00 20 00 03 00 04 00 EF BE 6C 45 4F 6C 6C 45 51 6C 14 00 00 00 54 00 44 00 4C 00 34 00 00 00 14 00 DC 00 00 00 02 00 00 00 00 00 00 00  
 HKU\S-1-5-21-515967899-1935655697-682003330-1003\Software\Microsoft\Windows\ShellNoRoam\Bags\29\Shell\WinPos1280x720(1).left: 0x00000049  
 HKU\S-1-5-21-515967899-1935655697-682003330-1003\Software\Microsoft\Windows\ShellNoRoam\Bags\29\Shell\WinPos1280x720(1).left: 0x0000002C  
 HKU\S-1-5-21-515967899-1935655697-682003330-1003\Software\Microsoft\Windows\ShellNoRoam\Bags\29\Shell\WinPos1280x720(1).top: 0x00000057  
 HKU\S-1-5-21-515967899-1935655697-682003330-1003\Software\Microsoft\Windows\ShellNoRoam\Bags\29\Shell\WinPos1280x720(1).top: 0x0000003A  
 HKU\S-1-5-21-515967899-1935655697-682003330-1003\Software\Microsoft\Windows\ShellNoRoam\Bags\29\Shell\WinPos1280x720(1).right: 0x00000369  
 HKU\S-1-5-21-515967899-1935655697-682003330-1003\Software\Microsoft\Windows\ShellNoRoam\Bags\29\Shell\WinPos1280x720(1).right: 0x0000034C  
 HKU\S-1-5-21-515967899-1935655697-682003330-1003\Software\Microsoft\Windows\ShellNoRoam\Bags\29\Shell\WinPos1280x720(1).bottom: 0x000002AF  
 HKU\S-1-5-21-515967899-1935655697-682003330-1003\Software\Microsoft\Windows\ShellNoRoam\Bags\29\Shell\WinPos1280x720(1).bottom: 0x00000292  
 HKU\S-1-5-21-515967899-1935655697-682003330-1003\SessionInformation\ProgramCount: 0x00000002  
 HKU\S-1-5-21-515967899-1935655697-682003330-1003\SessionInformation\ProgramCount: 0x00000001  
 ----------------------------------  
 Total changes: 150  
 ----------------------------------

23 deleted keys, 110 values deleted, 17 values modified. Total = 150 changes.

Overall, there's a lot to this rootkit. I didn't go into the MRxCls configuration file decryption, network changes/attack methods, other methods of zero-day flaws, etc but even so you can see that this is a pretty sophisticated piece of malware. However, as we now see, its biggest downfall was its complete lack of protection.

The only personal explanation I have for this is that the creator(s) were either rushed to get it done by 'x' timeframe, so they focused on main code more than obfuscation, or they just imagined it wouldn't ever escape its original intended environment, so they'd never have to worry about reverse engineering being an issue.

References

Stuxnet Under the Microscope.
Analyzing a Stuxnet Infection with the Sysinternals Tools.