Analysis Date2015-08-27 05:16:00
MD564ba3a0f952a8dec75523b75c894b181
SHA1dfc10b971e4da7078cf522c7d28ebca804fa594f

Static Details:

File typePE32 executable for MS Windows (GUI) Intel 80386 32-bit
Section.text md5: eb7985d64333db01c58f3fb2a6d15588 sha1: bd1da495e1b110a8af8bb518a8d8e498ca6c11f0 size: 672768
Section.rdata md5: 827f66eaf7c31a4f58d7670cf22e193f sha1: 0da75d10e6e460aad59d5d5e589aa7da9eb614d6 size: 53760
Section.data md5: 0b307346e688ba62f6b1fa87492c71d1 sha1: 183cdbe81399d9d7b422beba03d08eb4acfee750 size: 421376
Timestamp2014-05-09 20:27:19
PackerMicrosoft Visual C++ ?.?
PEhash895692dffa87a58785e13492c87c606494c57a6a
IMPhash7697b879b2848f0d9a67a8cf0cd7c52e
AVRisingno_virus
AVCA (E-Trust Ino)no_virus
AVF-SecureGen:Variant.Symmi.22722
AVDr. Webno_virus
AVClamAVno_virus
AVArcabit (arcavir)Error Scanning File
AVBullGuardGen:Variant.Symmi.22722
AVPadvishno_virus
AVVirusBlokAda (vba32)no_virus
AVCAT (quickheal)no_virus
AVTrend MicroTSPY_NIVDORT.SMA
AVKasperskyTrojan.Win32.Generic
AVZillya!no_virus
AVEmsisoftGen:Variant.Symmi.22722
AVIkarusVirus.Win32.Cryptor
AVFrisk (f-prot)no_virus
AVAuthentiumW32/Nivdort.A.gen!Eldorado
AVMalwareBytesno_virus
AVMicroWorld (escan)Gen:Variant.Symmi.22722
AVMicrosoft Security EssentialsTrojanSpy:Win32/Nivdort.Y
AVK7Trojan ( 004cd0081 )
AVBitDefenderGen:Variant.Symmi.22722
AVFortinetW32/Agent.VNC!tr
AVSymantecDownloader.Upatre!g15
AVGrisoft (avg)Win32/Cryptor
AVEset (nod32)Win32/Kryptik.CCLE
AVAlwil (avast)Kryptik-PLS [Trj]
AVAd-AwareGen:Variant.Symmi.22722
AVTwisterTrojan.Girtk.BCFJ.cpsn.mg
AVAvira (antivir)TR/Crypt.ZPACK.Gen8
AVMcafeeno_virus

Runtime Details:

Screenshot

Process
↳ C:\malware.exe

Creates FileC:\WINDOWS\system32\vnxgfuf\tst
Creates FileC:\Documents and Settings\Administrator\Local Settings\Temp\yzjkvysv1l4usehwyndamol.exe
Creates ProcessC:\Documents and Settings\Administrator\Local Settings\Temp\yzjkvysv1l4usehwyndamol.exe

Process
↳ C:\Documents and Settings\Administrator\Local Settings\Temp\yzjkvysv1l4usehwyndamol.exe

RegistryHKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\Interactive Browser Routing Session ➝
C:\WINDOWS\system32\liydrzselnd.exe
Creates FileC:\WINDOWS\system32\drivers\etc\hosts
Creates FileC:\WINDOWS\system32\vnxgfuf\lck
Creates FileC:\WINDOWS\system32\vnxgfuf\tst
Creates FileC:\WINDOWS\system32\liydrzselnd.exe
Creates FileC:\WINDOWS\system32\vnxgfuf\etc
Deletes FileC:\WINDOWS\system32\\drivers\etc\hosts
Creates ProcessC:\WINDOWS\system32\liydrzselnd.exe
Creates ServiceResolution Compatibility Logon - C:\WINDOWS\system32\liydrzselnd.exe

Process
↳ C:\WINDOWS\system32\svchost.exe

Process
↳ Pid 804

Process
↳ Pid 848

Process
↳ C:\WINDOWS\System32\svchost.exe

Creates File\Device\Afd\Endpoint
Creates FileC:\WINDOWS\system32\WBEM\Logs\wbemess.log

Process
↳ Pid 1204

Process
↳ C:\WINDOWS\system32\spoolsv.exe

RegistryHKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Print\BeepEnabled ➝
NULL
RegistryHKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\System\Print\TypesSupported ➝
7
RegistryHKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Print\Printers\SymbolicLinkValue ➝
NULL
RegistryHKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Print\Printers\DefaultSpoolDirectory ➝
C:\WINDOWS\System32\spool\PRINTERS\\x00
Creates FileWMIDataDevice

Process
↳ Pid 1144

Process
↳ C:\WINDOWS\system32\liydrzselnd.exe

RegistryHKEY_LOCAL_MACHINE\Software\Microsoft\Security Center\FirewallDisableNotify ➝
1
Creates FileC:\WINDOWS\system32\vnxgfuf\tst
Creates FileC:\WINDOWS\system32\vnxgfuf\cfg
Creates FileC:\WINDOWS\system32\jojnnpdz.exe
Creates FileC:\WINDOWS\system32\vnxgfuf\lck
Creates Filepipe\net\NtControlPipe10
Creates FileC:\WINDOWS\TEMP\yzjkvysv1riwsehwy.exe
Creates FileC:\WINDOWS\system32\vnxgfuf\rng
Creates File\Device\Afd\Endpoint
Creates FileC:\WINDOWS\system32\vnxgfuf\run
Creates ProcessC:\WINDOWS\TEMP\yzjkvysv1riwsehwy.exe -r 39704 tcp
Creates ProcessWATCHDOGPROC "c:\windows\system32\liydrzselnd.exe"

Process
↳ C:\WINDOWS\system32\liydrzselnd.exe

Creates FileC:\WINDOWS\system32\vnxgfuf\tst

Process
↳ WATCHDOGPROC "c:\windows\system32\liydrzselnd.exe"

Creates FileC:\WINDOWS\system32\vnxgfuf\tst

Process
↳ C:\WINDOWS\TEMP\yzjkvysv1riwsehwy.exe -r 39704 tcp

Creates File\Device\Afd\Endpoint
Winsock DNS239.255.255.250

Network Details:

DNStablefruit.net
Type: A
69.195.129.70
DNSgainstock.net
Type: A
119.10.9.200
DNSstorystock.net
Type: A
188.93.10.94
DNSsellstock.net
Type: A
184.168.221.104
DNSdrivereply.net
Type: A
50.63.202.57
DNSfieldbone.net
Type: A
95.211.230.75
DNSqueenfire.net
Type: A
180.149.240.236
DNSmightglossary.net
Type: A
DNSgentlefriend.net
Type: A
DNSglasshealth.net
Type: A
DNSnecessarydress.net
Type: A
DNSrememberpaint.net
Type: A
DNSlittleappear.net
Type: A
DNSthroughcountry.net
Type: A
DNSfrontride.net
Type: A
DNSspendmarry.net
Type: A
DNSuponloud.net
Type: A
DNSwrongthrew.net
Type: A
DNSjinoplasker.com
Type: A
DNSwednesdayloud.net
Type: A
DNSselltree.net
Type: A
DNSwednesdaytree.net
Type: A
DNSdrivesaturday.net
Type: A
DNSnailsaturday.net
Type: A
DNSdrivethousand.net
Type: A
DNSnailthousand.net
Type: A
DNSdriveloud.net
Type: A
DNSnailloud.net
Type: A
DNSdrivetree.net
Type: A
DNSnailtree.net
Type: A
DNSfieldstock.net
Type: A
DNSqueenstock.net
Type: A
DNSfieldthrow.net
Type: A
DNSqueenthrow.net
Type: A
DNSfieldreply.net
Type: A
DNSqueenreply.net
Type: A
DNSfieldwhole.net
Type: A
DNSqueenwhole.net
Type: A
DNSbothstock.net
Type: A
DNSboththrow.net
Type: A
DNSgainthrow.net
Type: A
DNSbothreply.net
Type: A
DNSgainreply.net
Type: A
DNSbothwhole.net
Type: A
DNSgainwhole.net
Type: A
DNSleaststock.net
Type: A
DNSfacestock.net
Type: A
DNSleastthrow.net
Type: A
DNSfacethrow.net
Type: A
DNSleastreply.net
Type: A
DNSfacereply.net
Type: A
DNSleastwhole.net
Type: A
DNSfacewhole.net
Type: A
DNSmonthstock.net
Type: A
DNSwalkstock.net
Type: A
DNSmonththrow.net
Type: A
DNSwalkthrow.net
Type: A
DNSmonthreply.net
Type: A
DNSwalkreply.net
Type: A
DNSmonthwhole.net
Type: A
DNSwalkwhole.net
Type: A
DNSweakstock.net
Type: A
DNSstorythrow.net
Type: A
DNSweakthrow.net
Type: A
DNSstoryreply.net
Type: A
DNSweakreply.net
Type: A
DNSstorywhole.net
Type: A
DNSweakwhole.net
Type: A
DNSafterstock.net
Type: A
DNSforcestock.net
Type: A
DNSafterthrow.net
Type: A
DNSforcethrow.net
Type: A
DNSafterreply.net
Type: A
DNSforcereply.net
Type: A
DNSafterwhole.net
Type: A
DNSforcewhole.net
Type: A
DNSwednesdaystock.net
Type: A
DNSsellthrow.net
Type: A
DNSwednesdaythrow.net
Type: A
DNSsellreply.net
Type: A
DNSwednesdayreply.net
Type: A
DNSsellwhole.net
Type: A
DNSwednesdaywhole.net
Type: A
DNSdrivestock.net
Type: A
DNSnailstock.net
Type: A
DNSdrivethrow.net
Type: A
DNSnailthrow.net
Type: A
DNSnailreply.net
Type: A
DNSdrivewhole.net
Type: A
DNSnailwhole.net
Type: A
DNSfieldcold.net
Type: A
DNSqueencold.net
Type: A
DNSfieldwrote.net
Type: A
DNSqueenwrote.net
Type: A
DNSqueenbone.net
Type: A
DNSfieldfire.net
Type: A
DNSbothcold.net
Type: A
DNSgaincold.net
Type: A
HTTP GEThttp://tablefruit.net/index.php?method=validate&mode=sox&v=029&sox=3b949201
User-Agent:
HTTP GEThttp://gainstock.net/index.php?method=validate&mode=sox&v=029&sox=3b949201
User-Agent:
HTTP GEThttp://storystock.net/index.php?method=validate&mode=sox&v=029&sox=3b949201
User-Agent:
HTTP GEThttp://sellstock.net/index.php?method=validate&mode=sox&v=029&sox=3b949201
User-Agent:
HTTP GEThttp://drivereply.net/index.php?method=validate&mode=sox&v=029&sox=3b949201
User-Agent:
HTTP GEThttp://fieldbone.net/index.php?method=validate&mode=sox&v=029&sox=3b949201
User-Agent:
HTTP GEThttp://queenfire.net/index.php?method=validate&mode=sox&v=029&sox=3b949201
User-Agent:
HTTP GEThttp://tablefruit.net/index.php?method=validate&mode=sox&v=029&sox=3b949201
User-Agent:
HTTP GEThttp://gainstock.net/index.php?method=validate&mode=sox&v=029&sox=3b949201
User-Agent:
HTTP GEThttp://storystock.net/index.php?method=validate&mode=sox&v=029&sox=3b949201
User-Agent:
HTTP GEThttp://sellstock.net/index.php?method=validate&mode=sox&v=029&sox=3b949201
User-Agent:
HTTP GEThttp://drivereply.net/index.php?method=validate&mode=sox&v=029&sox=3b949201
User-Agent:
HTTP GEThttp://fieldbone.net/index.php?method=validate&mode=sox&v=029&sox=3b949201
User-Agent:
HTTP GEThttp://queenfire.net/index.php?method=validate&mode=sox&v=029&sox=3b949201
User-Agent:
Flows TCP192.168.1.1:1036 ➝ 69.195.129.70:80
Flows TCP192.168.1.1:1037 ➝ 119.10.9.200:80
Flows TCP192.168.1.1:1038 ➝ 188.93.10.94:80
Flows TCP192.168.1.1:1039 ➝ 184.168.221.104:80
Flows TCP192.168.1.1:1040 ➝ 50.63.202.57:80
Flows TCP192.168.1.1:1042 ➝ 95.211.230.75:80
Flows TCP192.168.1.1:1043 ➝ 180.149.240.236:80
Flows TCP192.168.1.1:1044 ➝ 69.195.129.70:80
Flows TCP192.168.1.1:1045 ➝ 119.10.9.200:80
Flows TCP192.168.1.1:1046 ➝ 188.93.10.94:80
Flows TCP192.168.1.1:1047 ➝ 184.168.221.104:80
Flows TCP192.168.1.1:1048 ➝ 50.63.202.57:80
Flows TCP192.168.1.1:1049 ➝ 95.211.230.75:80
Flows TCP192.168.1.1:1050 ➝ 180.149.240.236:80

Raw Pcap
0x00000000 (00000)   47455420 2f696e64 65782e70 68703f6d   GET /index.php?m
0x00000010 (00016)   6574686f 643d7661 6c696461 7465266d   ethod=validate&m
0x00000020 (00032)   6f64653d 736f7826 763d3032 3926736f   ode=sox&v=029&so
0x00000030 (00048)   783d3362 39343932 30312048 5454502f   x=3b949201 HTTP/
0x00000040 (00064)   312e300d 0a416363 6570743a 202a2f2a   1.0..Accept: */*
0x00000050 (00080)   0d0a436f 6e6e6563 74696f6e 3a20636c   ..Connection: cl
0x00000060 (00096)   6f73650d 0a486f73 743a2074 61626c65   ose..Host: table
0x00000070 (00112)   66727569 742e6e65 740d0a0d 0a         fruit.net....

0x00000000 (00000)   47455420 2f696e64 65782e70 68703f6d   GET /index.php?m
0x00000010 (00016)   6574686f 643d7661 6c696461 7465266d   ethod=validate&m
0x00000020 (00032)   6f64653d 736f7826 763d3032 3926736f   ode=sox&v=029&so
0x00000030 (00048)   783d3362 39343932 30312048 5454502f   x=3b949201 HTTP/
0x00000040 (00064)   312e300d 0a416363 6570743a 202a2f2a   1.0..Accept: */*
0x00000050 (00080)   0d0a436f 6e6e6563 74696f6e 3a20636c   ..Connection: cl
0x00000060 (00096)   6f73650d 0a486f73 743a2067 61696e73   ose..Host: gains
0x00000070 (00112)   746f636b 2e6e6574 0d0a0d0a 0a         tock.net.....

0x00000000 (00000)   47455420 2f696e64 65782e70 68703f6d   GET /index.php?m
0x00000010 (00016)   6574686f 643d7661 6c696461 7465266d   ethod=validate&m
0x00000020 (00032)   6f64653d 736f7826 763d3032 3926736f   ode=sox&v=029&so
0x00000030 (00048)   783d3362 39343932 30312048 5454502f   x=3b949201 HTTP/
0x00000040 (00064)   312e300d 0a416363 6570743a 202a2f2a   1.0..Accept: */*
0x00000050 (00080)   0d0a436f 6e6e6563 74696f6e 3a20636c   ..Connection: cl
0x00000060 (00096)   6f73650d 0a486f73 743a2073 746f7279   ose..Host: story
0x00000070 (00112)   73746f63 6b2e6e65 740d0a0d 0a         stock.net....

0x00000000 (00000)   47455420 2f696e64 65782e70 68703f6d   GET /index.php?m
0x00000010 (00016)   6574686f 643d7661 6c696461 7465266d   ethod=validate&m
0x00000020 (00032)   6f64653d 736f7826 763d3032 3926736f   ode=sox&v=029&so
0x00000030 (00048)   783d3362 39343932 30312048 5454502f   x=3b949201 HTTP/
0x00000040 (00064)   312e300d 0a416363 6570743a 202a2f2a   1.0..Accept: */*
0x00000050 (00080)   0d0a436f 6e6e6563 74696f6e 3a20636c   ..Connection: cl
0x00000060 (00096)   6f73650d 0a486f73 743a2073 656c6c73   ose..Host: sells
0x00000070 (00112)   746f636b 2e6e6574 0d0a0d0a 0a         tock.net.....

0x00000000 (00000)   47455420 2f696e64 65782e70 68703f6d   GET /index.php?m
0x00000010 (00016)   6574686f 643d7661 6c696461 7465266d   ethod=validate&m
0x00000020 (00032)   6f64653d 736f7826 763d3032 3926736f   ode=sox&v=029&so
0x00000030 (00048)   783d3362 39343932 30312048 5454502f   x=3b949201 HTTP/
0x00000040 (00064)   312e300d 0a416363 6570743a 202a2f2a   1.0..Accept: */*
0x00000050 (00080)   0d0a436f 6e6e6563 74696f6e 3a20636c   ..Connection: cl
0x00000060 (00096)   6f73650d 0a486f73 743a2064 72697665   ose..Host: drive
0x00000070 (00112)   7265706c 792e6e65 740d0a0d 0a         reply.net....

0x00000000 (00000)   47455420 2f696e64 65782e70 68703f6d   GET /index.php?m
0x00000010 (00016)   6574686f 643d7661 6c696461 7465266d   ethod=validate&m
0x00000020 (00032)   6f64653d 736f7826 763d3032 3926736f   ode=sox&v=029&so
0x00000030 (00048)   783d3362 39343932 30312048 5454502f   x=3b949201 HTTP/
0x00000040 (00064)   312e300d 0a416363 6570743a 202a2f2a   1.0..Accept: */*
0x00000050 (00080)   0d0a436f 6e6e6563 74696f6e 3a20636c   ..Connection: cl
0x00000060 (00096)   6f73650d 0a486f73 743a2066 69656c64   ose..Host: field
0x00000070 (00112)   626f6e65 2e6e6574 0d0a0d0a 0a         bone.net.....

0x00000000 (00000)   47455420 2f696e64 65782e70 68703f6d   GET /index.php?m
0x00000010 (00016)   6574686f 643d7661 6c696461 7465266d   ethod=validate&m
0x00000020 (00032)   6f64653d 736f7826 763d3032 3926736f   ode=sox&v=029&so
0x00000030 (00048)   783d3362 39343932 30312048 5454502f   x=3b949201 HTTP/
0x00000040 (00064)   312e300d 0a416363 6570743a 202a2f2a   1.0..Accept: */*
0x00000050 (00080)   0d0a436f 6e6e6563 74696f6e 3a20636c   ..Connection: cl
0x00000060 (00096)   6f73650d 0a486f73 743a2071 7565656e   ose..Host: queen
0x00000070 (00112)   66697265 2e6e6574 0d0a0d0a 0a         fire.net.....

0x00000000 (00000)   47455420 2f696e64 65782e70 68703f6d   GET /index.php?m
0x00000010 (00016)   6574686f 643d7661 6c696461 7465266d   ethod=validate&m
0x00000020 (00032)   6f64653d 736f7826 763d3032 3926736f   ode=sox&v=029&so
0x00000030 (00048)   783d3362 39343932 30312048 5454502f   x=3b949201 HTTP/
0x00000040 (00064)   312e300d 0a416363 6570743a 202a2f2a   1.0..Accept: */*
0x00000050 (00080)   0d0a436f 6e6e6563 74696f6e 3a20636c   ..Connection: cl
0x00000060 (00096)   6f73650d 0a486f73 743a2074 61626c65   ose..Host: table
0x00000070 (00112)   66727569 742e6e65 740d0a0d 0a         fruit.net....

0x00000000 (00000)   47455420 2f696e64 65782e70 68703f6d   GET /index.php?m
0x00000010 (00016)   6574686f 643d7661 6c696461 7465266d   ethod=validate&m
0x00000020 (00032)   6f64653d 736f7826 763d3032 3926736f   ode=sox&v=029&so
0x00000030 (00048)   783d3362 39343932 30312048 5454502f   x=3b949201 HTTP/
0x00000040 (00064)   312e300d 0a416363 6570743a 202a2f2a   1.0..Accept: */*
0x00000050 (00080)   0d0a436f 6e6e6563 74696f6e 3a20636c   ..Connection: cl
0x00000060 (00096)   6f73650d 0a486f73 743a2067 61696e73   ose..Host: gains
0x00000070 (00112)   746f636b 2e6e6574 0d0a0d0a 0a         tock.net.....

0x00000000 (00000)   47455420 2f696e64 65782e70 68703f6d   GET /index.php?m
0x00000010 (00016)   6574686f 643d7661 6c696461 7465266d   ethod=validate&m
0x00000020 (00032)   6f64653d 736f7826 763d3032 3926736f   ode=sox&v=029&so
0x00000030 (00048)   783d3362 39343932 30312048 5454502f   x=3b949201 HTTP/
0x00000040 (00064)   312e300d 0a416363 6570743a 202a2f2a   1.0..Accept: */*
0x00000050 (00080)   0d0a436f 6e6e6563 74696f6e 3a20636c   ..Connection: cl
0x00000060 (00096)   6f73650d 0a486f73 743a2073 746f7279   ose..Host: story
0x00000070 (00112)   73746f63 6b2e6e65 740d0a0d 0a         stock.net....

0x00000000 (00000)   47455420 2f696e64 65782e70 68703f6d   GET /index.php?m
0x00000010 (00016)   6574686f 643d7661 6c696461 7465266d   ethod=validate&m
0x00000020 (00032)   6f64653d 736f7826 763d3032 3926736f   ode=sox&v=029&so
0x00000030 (00048)   783d3362 39343932 30312048 5454502f   x=3b949201 HTTP/
0x00000040 (00064)   312e300d 0a416363 6570743a 202a2f2a   1.0..Accept: */*
0x00000050 (00080)   0d0a436f 6e6e6563 74696f6e 3a20636c   ..Connection: cl
0x00000060 (00096)   6f73650d 0a486f73 743a2073 656c6c73   ose..Host: sells
0x00000070 (00112)   746f636b 2e6e6574 0d0a0d0a 0a         tock.net.....

0x00000000 (00000)   47455420 2f696e64 65782e70 68703f6d   GET /index.php?m
0x00000010 (00016)   6574686f 643d7661 6c696461 7465266d   ethod=validate&m
0x00000020 (00032)   6f64653d 736f7826 763d3032 3926736f   ode=sox&v=029&so
0x00000030 (00048)   783d3362 39343932 30312048 5454502f   x=3b949201 HTTP/
0x00000040 (00064)   312e300d 0a416363 6570743a 202a2f2a   1.0..Accept: */*
0x00000050 (00080)   0d0a436f 6e6e6563 74696f6e 3a20636c   ..Connection: cl
0x00000060 (00096)   6f73650d 0a486f73 743a2064 72697665   ose..Host: drive
0x00000070 (00112)   7265706c 792e6e65 740d0a0d 0a         reply.net....

0x00000000 (00000)   47455420 2f696e64 65782e70 68703f6d   GET /index.php?m
0x00000010 (00016)   6574686f 643d7661 6c696461 7465266d   ethod=validate&m
0x00000020 (00032)   6f64653d 736f7826 763d3032 3926736f   ode=sox&v=029&so
0x00000030 (00048)   783d3362 39343932 30312048 5454502f   x=3b949201 HTTP/
0x00000040 (00064)   312e300d 0a416363 6570743a 202a2f2a   1.0..Accept: */*
0x00000050 (00080)   0d0a436f 6e6e6563 74696f6e 3a20636c   ..Connection: cl
0x00000060 (00096)   6f73650d 0a486f73 743a2066 69656c64   ose..Host: field
0x00000070 (00112)   626f6e65 2e6e6574 0d0a0d0a 0a         bone.net.....

0x00000000 (00000)   47455420 2f696e64 65782e70 68703f6d   GET /index.php?m
0x00000010 (00016)   6574686f 643d7661 6c696461 7465266d   ethod=validate&m
0x00000020 (00032)   6f64653d 736f7826 763d3032 3926736f   ode=sox&v=029&so
0x00000030 (00048)   783d3362 39343932 30312048 5454502f   x=3b949201 HTTP/
0x00000040 (00064)   312e300d 0a416363 6570743a 202a2f2a   1.0..Accept: */*
0x00000050 (00080)   0d0a436f 6e6e6563 74696f6e 3a20636c   ..Connection: cl
0x00000060 (00096)   6f73650d 0a486f73 743a2071 7565656e   ose..Host: queen
0x00000070 (00112)   66697265 2e6e6574 0d0a0d0a 0a         fire.net.....


Strings