PUP.Win32.YahooCompanion_bd5840fa50 – Adaware

Dynamic Analysis

Payload

No specific payload has been found.

Process activity

The PUP creates the following process(es):No processes have been created.The PUP injects its code into the following process(es):

%original file name%.exe:1388

Mutexes

The following mutexes were created/opened:

c:!documents and settings!adm!local settings!history!history.ie5!mshist012015022620150227!_!SHMSFTHISTORY!___DDrawCheckExclMode__DDrawDriverObjectListMutexDDrawWindowListMutex__DDrawExclMode__CTF.TMD.MutexDefaultS-1-5-21-1844237615-1960408961-1801674531-1003CTF.Layouts.MutexDefaultS-1-5-21-1844237615-1960408961-1801674531-1003CTF.Asm.MutexDefaultS-1-5-21-1844237615-1960408961-1801674531-1003CTF.Compart.MutexDefaultS-1-5-21-1844237615-1960408961-1801674531-1003CTF.LBES.MutexDefaultS-1-5-21-1844237615-1960408961-1801674531-1003VdiMsiLockInstallIQUninstallOptionLockInstallIQFirefoxLockRasPbFileWininetProxyRegistryMutexWininetConnectionMutexWininetStartupMutexc:!documents and settings!adm!local settings!history!history.ie5!c:!documents and settings!adm!cookies!c:!documents and settings!adm!local settings!temporary internet files!content.ie5!_!MSFTHISTORY!_ShimCacheMutexQuickStartAppW3i_CoreBrowserShutdownW3iFFPrefslockDialogCloseProcessLockCPackageZlib::CPackageZlibW3iCoreLoggerZonesLockedCacheCounterMutexZonesCacheCounterMutexZonesCounterMutex

File activity

The process %original file name%.exe:1388 makes changes in the file system.

The PUP creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\zx_11a33600\AD04DC3C-8B12-4879-83E3-523DF600D9DE.zip (968 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_11a33600\dialogs\library\images\btn.png (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_11a33600\dialogs\library\images\installprogress.png (998 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_11a33600\dialogs\library\images\bg-installprogress.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_11a33600\dialogs\library\js\noyahoo.js (323 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_11a33600\dialogs\yahoosuite.vi.json (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_11a33600\55997C50-1F00-4D74-BAEF-46A658272B17.zip (971 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_11a33600\2704D408-C40A-4848-BC30-B5478423E8C9.zip (821 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_11a33600\dialogs\library\images\title-bar.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_11a33600\dialogs\petite_oo_v5.vi.json (74 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_11a33600\D21384DD-7E7F-4D84-9C43-6D82036FA24F.zip (9352 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_11a33600\dialogs\library\images\filewhiz_tn.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_11a33600\7E447291-0A05-4EB1-98E9-49ECF3C139D1.zip (834 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_11a33600\B7F6A91D-8542-4B59-A285-EF08E6922F28.zip (883 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_11a33600\C4B20519-3B35-4A1C-BB5C-695D80D9C28D.zip (926 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_11a33600\dialogs\view.petite_oo_v5.vi.json (27 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_11a33600\dialogs\library\js\.DS_Store (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_11a33600\dialogs\slowpcfighter.vi.json (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_11a33600\dialogs\library\js\lodash.custom.min.js (1928 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_11a33600\dialogs\library\js\offerparser.js (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_11a33600\dialogs\pcmechanic.vi.json (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_11a33600\dialogs\library\js\screen.js (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\ENG.SCC.config[1].txt (740 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_11a33600\dialogs\library\images\product-icon.png (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_11a33600\1E00B2CE-84B4-4764-A567-81130045EEE4.zip (739 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_11a33600\bd5840fa50a5eb32ba9f6adeb41fd599.log (1577847 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_11a33600\E92D7B47-33AD-4469-81D4-CB551DE8DDA8.zip (889 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_11a33600\dialogs\library\js\script.js (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_11a33600\dialogs\library\images\btn-win.png (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_11a33600\13D66679-5DC0-48AA-BB42-E7BD34CEBAE2.zip (889 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_11a33600\8BF6320F-C08A-446A-80A8-FBCCDBA35CB7.zip (804 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_11a33600\dialogs\library\images\minmax.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_11a33600\AFB3988D-640F-43BB-8422-D40ED6AA32BE.zip (820 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_11a33600\dialogs\wecarecleanwater.vi.json (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SymCCIS.dll (11704 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_11a33600\BF68CAAA-24EB-4A90-94B1-A68D8718116D.zip (731 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_11a33600\7BAB633E-6C2D-45CC-BFE3-A79142FDABBF.zip (507 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_11a33600\dialogs\library\js\json2.js (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_11a33600\0393A455-8396-4E79-8339-7DAEDC83567B.zip (801 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_11a33600\dialogs\library\js\jquery.min.js (6984 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_11a33600\404D0823-2D00-44F7-AC98-92F79F87E4F2.zip (778 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_11a33600\F3DA0320-7EB0-4648-BE62-3B08958C9B3E.zip (920 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_11a33600\dialogs\smartweb.vi.json (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_11a33600\dialogs\library\images\close.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_11a33600\A93B8CBE-2E96-442C-A85F-49ED855FDB8B.zip (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_11a33600\dialogs\nortonsecurityscan.vi.json (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_11a33600\F3823C96-34C1-478F-BA9E-3F84F3D6094F.zip (787 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_11a33600\dialogs\resultsbay.vi.json (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_11a33600\dialogs\library\images\bg_disc_wrap.gif (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_11a33600\dialogs\library\js\screenfactory.js (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_11a33600\4FFA1EE1-2AD7-40C8-9643-B801D9DED1A0.zip (804 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_11a33600\dialogs\library\js\responsemanager.js (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_11a33600\dialogs\library\images\step-contents.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_11a33600\dialogs\library\js\common.js (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_11a33600\3927F92B-2CF0-4555-8A62-C42865E873C2.zip (936 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_11a33600\4594AF2F-4D07-4B39-B15B-443A87882878.zip (732 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_11a33600\dialogs\library\js\screenconfig.js (240 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_11a33600\dialogs\vebasearch.vi.json (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_11a33600\B7109C6A-73CA-4979-B038-5AE45CBE649F.zip (811 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_11a33600\B2B00637-BC0D-48D8-B686-9F13DA5E04A1.zip (822 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_11a33600\dialogs\library\js\testsuitemanager.js (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_11a33600\2E076E93-E171-4F73-A0D5-5BFDDE0E4783.zip (792 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_11a33600\099AEF6E-E690-4A5C-85F8-481343649504.zip (809 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_11a33600\8C58D003-E863-4399-A7CF-A32275393FD1.zip (412 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SCC.dll (1736 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_11a33600\stub.xml (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_11a33600\80A3CCD4-64BC-4AF8-853B-ABA075AE5218.zip (866 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_11a33600\dialogs\fulldiskfighter.vi.json (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_11a33600\73EB1E3A-0BE4-4F19-8F38-6B2B93DB1927.zip (939 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_11a33600\dialogs\library\js\yahoo.js (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_11a33600\dialogs\library\js\config.js (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_11a33600\dialogs\library\images\checkbox.png (650 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_11a33600\5C22ACAC-4D3A-4D89-9980-81FBB493E7B8.zip (888 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_11a33600\441493C8-0E32-4504-B8CC-7851FFF110EC.zip (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_11a33600\dialogs\yahoo_hpds_defaultsearch.vi.json (533 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_11a33600\dialogs\library\images\step-contents-stepped.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\SCC[1].dll (17597 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_11a33600\dialogs\gamehug.vi.json (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_11a33600\1D677809-65E4-4CBA-B3B2-1705755F5F07.zip (434 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_11a33600\session.response.json (4708 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_11a33600\theanswerfinder.vi.zip (838 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_11a33600\dialogs\driverscanner.vi.json (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_11a33600\dialogs\kaspersky.vi.json (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_11a33600\dialogs\library\js\saferbrowser.js (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_11a33600\dialogs\library\images\btn-win-cancel.png (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_11a33600\DF86C614-36F8-4BE3-A1A0-78E774802EE7.zip (928 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_11a33600\dialogs\winferno.vi.json (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SymCCIS2.zip (162 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_11a33600\dialogs\java.vi.json (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_11a33600\F80287B7-718C-4676-AC71-3F1AB04A60E1.zip (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_11a33600\dialogs\library\js\screenmanager.js (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_11a33600\java_14161.txt (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_11a33600\225E5BB2-B83F-478E-B774-62F53C2BCAD7.zip (858 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_11a33600\dialogs\driverfighter.vi.json (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_11a33600\dialogs\library\js\utils.js (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_11a33600\BB13E620-1EBA-47D8-A623-39986DE12F1F.zip (790 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_11a33600\42FDD0AA-EAD7-45DD-8421-47492FCFF9DB.zip (941 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_11a33600\dialogs\library\js\knockout-2.2.1.js (2696 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_11a33600\B88FF7FD-BE0E-44BC-97BC-D6943F9F8A86.zip (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SCCLog.txt (169952 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_11a33600\dialogs\library\images\container-separator.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_11a33600\9332870F-9082-4684-AFF2-8C852FCEE8D7.zip (747 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_11a33600\ECBFC9AB-A637-4487-9A66-817881951C55.zip (904 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_11a33600\66DFABC3-9023-45A3-A5DE-FA8CAAEF0AAC.zip (856 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_11a33600\config.xml (17904 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_11a33600\dialogs\java\java_tn.png (776 bytes)
%System%\wbem\Logs\wbemprox.log (228 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_11a33600\dialogs\smartdriverupdater.vi.json (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_11a33600\00EB7EC2-4B2C-4603-9043-79A1C36414EE.zip (422 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_11a33600\AF33782B-57D0-466B-831D-0CE47455F809.zip (892 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SCC.config (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_11a33600\224505F1-4910-4879-A9AD-B70D1AE1A120.zip (904 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_11a33600\E9E56BE3-7EC7-450B-9C2E-BA9B0BCD6B05.zip (817 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_11a33600\F5C1E3BE-C571-4295-82AB-9C78A7DFD0BA.zip (823 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SymCCISDll.txt (41444 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_11a33600\dialogs\library\js\kmsxSuite.js (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_11a33600\dialogs\library\js\clickmanager.js (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_11a33600\dialogs\petite_oo_v5.vi.html (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_11a33600\226383C9-5E0D-4ABD-8308-30F31DD040A6.zip (666 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_11a33600\dialogs\library\css\style.css (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_11a33600\dialogs\yahoo_hpds_startpage.vi.json (523 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_11a33600\dialogs\library\images\custom-check.png (1 bytes)

The PUP deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\History\History.IE5\MSHist012014041020140411\index.dat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SCC.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SCC.config (0 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\MSHist012014041020140411 (0 bytes)

Registry activity

The process %original file name%.exe:1388 makes changes in the system registry.

The PUP creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012015022620150227]
"CacheLimit" = "8192"
"CacheRepair" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012015022620150227]
"CachePrefix" = ":2015022620150227:"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012015022620150227]
"CacheOptions" = "11"

[HKLM\SOFTWARE\Microsoft\DirectDraw\MostRecentApplication]
"Name" = "%original file name%.exe"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\InstallIQ]
"test" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1D 00 00 00 01 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Microsoft\DirectDraw\MostRecentApplication]
"ID" = "1423502951"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "3A F3 B7 0D 02 85 E8 C3 5B 0F 6F 3E AE A7 98 CA"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012015022620150227]
"CachePath" = "%USERPROFILE%\Local Settings\History\History.IE5\MSHist012015022620150227\"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

The PUP modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The PUP modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The PUP modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The PUP deletes the following registry key(s):

[HKLM\SOFTWARE\InstallIQ]
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014041020140411]

The PUP deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"

[HKLM\SOFTWARE\InstallIQ]
"test"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride"

Dropped PE files

MD5	File path
6bec059e9f70b59873807c4f2a72a8b5	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\SymCCIS.dll
303f02fcd577a11acab7c3a36970e4be	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\SCC[1].dll

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

Removals

Remove it with Ad-Aware

Click (here) to download and install Ad-Aware Free Antivirus.
Update the definition files.
Run a full scan of your computer.

Manual removal*

Terminate malicious process(es) (How to End a Process With the Task Manager):No processes have been created.
Delete the original PUP file.
Delete or disinfect the following files created/modified by the PUP:
%Documents and Settings%\%current user%\Local Settings\Temp\zx_11a33600\AD04DC3C-8B12-4879-83E3-523DF600D9DE.zip (968 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_11a33600\dialogs\library\images\btn.png (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_11a33600\dialogs\library\images\installprogress.png (998 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_11a33600\dialogs\library\images\bg-installprogress.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_11a33600\dialogs\library\js\noyahoo.js (323 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_11a33600\dialogs\yahoosuite.vi.json (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_11a33600\55997C50-1F00-4D74-BAEF-46A658272B17.zip (971 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_11a33600\2704D408-C40A-4848-BC30-B5478423E8C9.zip (821 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_11a33600\dialogs\library\images\title-bar.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_11a33600\dialogs\petite_oo_v5.vi.json (74 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_11a33600\D21384DD-7E7F-4D84-9C43-6D82036FA24F.zip (9352 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_11a33600\dialogs\library\images\filewhiz_tn.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_11a33600\7E447291-0A05-4EB1-98E9-49ECF3C139D1.zip (834 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_11a33600\B7F6A91D-8542-4B59-A285-EF08E6922F28.zip (883 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_11a33600\C4B20519-3B35-4A1C-BB5C-695D80D9C28D.zip (926 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_11a33600\dialogs\view.petite_oo_v5.vi.json (27 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_11a33600\dialogs\library\js\.DS_Store (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_11a33600\dialogs\slowpcfighter.vi.json (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_11a33600\dialogs\library\js\lodash.custom.min.js (1928 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_11a33600\dialogs\library\js\offerparser.js (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_11a33600\dialogs\pcmechanic.vi.json (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_11a33600\dialogs\library\js\screen.js (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\ENG.SCC.config[1].txt (740 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_11a33600\dialogs\library\images\product-icon.png (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_11a33600\1E00B2CE-84B4-4764-A567-81130045EEE4.zip (739 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_11a33600\bd5840fa50a5eb32ba9f6adeb41fd599.log (1577847 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_11a33600\E92D7B47-33AD-4469-81D4-CB551DE8DDA8.zip (889 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_11a33600\dialogs\library\js\script.js (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_11a33600\dialogs\library\images\btn-win.png (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_11a33600\13D66679-5DC0-48AA-BB42-E7BD34CEBAE2.zip (889 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_11a33600\8BF6320F-C08A-446A-80A8-FBCCDBA35CB7.zip (804 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_11a33600\dialogs\library\images\minmax.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_11a33600\AFB3988D-640F-43BB-8422-D40ED6AA32BE.zip (820 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_11a33600\dialogs\wecarecleanwater.vi.json (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SymCCIS.dll (11704 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_11a33600\BF68CAAA-24EB-4A90-94B1-A68D8718116D.zip (731 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_11a33600\7BAB633E-6C2D-45CC-BFE3-A79142FDABBF.zip (507 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_11a33600\dialogs\library\js\json2.js (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_11a33600\0393A455-8396-4E79-8339-7DAEDC83567B.zip (801 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_11a33600\dialogs\library\js\jquery.min.js (6984 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_11a33600\404D0823-2D00-44F7-AC98-92F79F87E4F2.zip (778 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_11a33600\F3DA0320-7EB0-4648-BE62-3B08958C9B3E.zip (920 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_11a33600\dialogs\smartweb.vi.json (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_11a33600\dialogs\library\images\close.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_11a33600\A93B8CBE-2E96-442C-A85F-49ED855FDB8B.zip (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_11a33600\dialogs\nortonsecurityscan.vi.json (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_11a33600\F3823C96-34C1-478F-BA9E-3F84F3D6094F.zip (787 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_11a33600\dialogs\resultsbay.vi.json (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_11a33600\dialogs\library\images\bg_disc_wrap.gif (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_11a33600\dialogs\library\js\screenfactory.js (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_11a33600\4FFA1EE1-2AD7-40C8-9643-B801D9DED1A0.zip (804 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_11a33600\dialogs\library\js\responsemanager.js (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_11a33600\dialogs\library\images\step-contents.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_11a33600\dialogs\library\js\common.js (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_11a33600\3927F92B-2CF0-4555-8A62-C42865E873C2.zip (936 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_11a33600\4594AF2F-4D07-4B39-B15B-443A87882878.zip (732 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_11a33600\dialogs\library\js\screenconfig.js (240 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_11a33600\dialogs\vebasearch.vi.json (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_11a33600\B7109C6A-73CA-4979-B038-5AE45CBE649F.zip (811 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_11a33600\B2B00637-BC0D-48D8-B686-9F13DA5E04A1.zip (822 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_11a33600\dialogs\library\js\testsuitemanager.js (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_11a33600\2E076E93-E171-4F73-A0D5-5BFDDE0E4783.zip (792 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_11a33600\099AEF6E-E690-4A5C-85F8-481343649504.zip (809 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_11a33600\8C58D003-E863-4399-A7CF-A32275393FD1.zip (412 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SCC.dll (1736 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_11a33600\stub.xml (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_11a33600\80A3CCD4-64BC-4AF8-853B-ABA075AE5218.zip (866 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_11a33600\dialogs\fulldiskfighter.vi.json (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_11a33600\73EB1E3A-0BE4-4F19-8F38-6B2B93DB1927.zip (939 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_11a33600\dialogs\library\js\yahoo.js (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_11a33600\dialogs\library\js\config.js (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_11a33600\dialogs\library\images\checkbox.png (650 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_11a33600\5C22ACAC-4D3A-4D89-9980-81FBB493E7B8.zip (888 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_11a33600\441493C8-0E32-4504-B8CC-7851FFF110EC.zip (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_11a33600\dialogs\yahoo_hpds_defaultsearch.vi.json (533 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_11a33600\dialogs\library\images\step-contents-stepped.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\SCC[1].dll (17597 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_11a33600\dialogs\gamehug.vi.json (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_11a33600\1D677809-65E4-4CBA-B3B2-1705755F5F07.zip (434 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_11a33600\session.response.json (4708 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_11a33600\theanswerfinder.vi.zip (838 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_11a33600\dialogs\driverscanner.vi.json (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_11a33600\dialogs\kaspersky.vi.json (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_11a33600\dialogs\library\js\saferbrowser.js (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_11a33600\dialogs\library\images\btn-win-cancel.png (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_11a33600\DF86C614-36F8-4BE3-A1A0-78E774802EE7.zip (928 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_11a33600\dialogs\winferno.vi.json (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SymCCIS2.zip (162 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_11a33600\dialogs\java.vi.json (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_11a33600\F80287B7-718C-4676-AC71-3F1AB04A60E1.zip (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_11a33600\dialogs\library\js\screenmanager.js (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_11a33600\java_14161.txt (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_11a33600\225E5BB2-B83F-478E-B774-62F53C2BCAD7.zip (858 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_11a33600\dialogs\driverfighter.vi.json (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_11a33600\dialogs\library\js\utils.js (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_11a33600\BB13E620-1EBA-47D8-A623-39986DE12F1F.zip (790 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_11a33600\42FDD0AA-EAD7-45DD-8421-47492FCFF9DB.zip (941 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_11a33600\dialogs\library\js\knockout-2.2.1.js (2696 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_11a33600\B88FF7FD-BE0E-44BC-97BC-D6943F9F8A86.zip (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SCCLog.txt (169952 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_11a33600\dialogs\library\images\container-separator.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_11a33600\9332870F-9082-4684-AFF2-8C852FCEE8D7.zip (747 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_11a33600\ECBFC9AB-A637-4487-9A66-817881951C55.zip (904 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_11a33600\66DFABC3-9023-45A3-A5DE-FA8CAAEF0AAC.zip (856 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_11a33600\config.xml (17904 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_11a33600\dialogs\java\java_tn.png (776 bytes)
%System%\wbem\Logs\wbemprox.log (228 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_11a33600\dialogs\smartdriverupdater.vi.json (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_11a33600\00EB7EC2-4B2C-4603-9043-79A1C36414EE.zip (422 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_11a33600\AF33782B-57D0-466B-831D-0CE47455F809.zip (892 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SCC.config (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_11a33600\224505F1-4910-4879-A9AD-B70D1AE1A120.zip (904 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_11a33600\E9E56BE3-7EC7-450B-9C2E-BA9B0BCD6B05.zip (817 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_11a33600\F5C1E3BE-C571-4295-82AB-9C78A7DFD0BA.zip (823 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SymCCISDll.txt (41444 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_11a33600\dialogs\library\js\kmsxSuite.js (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_11a33600\dialogs\library\js\clickmanager.js (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_11a33600\dialogs\petite_oo_v5.vi.html (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_11a33600\226383C9-5E0D-4ABD-8308-30F31DD040A6.zip (666 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_11a33600\dialogs\library\css\style.css (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_11a33600\dialogs\yahoo_hpds_startpage.vi.json (523 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zx_11a33600\dialogs\library\images\custom-check.png (1 bytes)
Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
Reboot the computer.

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

VersionInfo

Company Name: SafeInstall, LLC
Product Name: SafeInstaller
Product Version: 1.0.72.0
Legal Copyright: Copyright (C) 2014
Legal Trademarks:
Original Filename: safeinstall.exe
Internal Name: SafeInstaller
File Version: 1.0.72.0
File Description: Safe Installer
Comments:
Language: Spanish (Spain, International Sort)

Company Name: SafeInstall, LLCProduct Name: SafeInstallerProduct Version: 1.0.72.0Legal Copyright: Copyright (C) 2014Legal Trademarks: Original Filename: safeinstall.exeInternal Name: SafeInstallerFile Version: 1.0.72.0File Description: Safe InstallerComments: Language: Spanish (Spain, International Sort)

PE Sections

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Section MD5
.text	4096	494937	495104	4.49559	79f82a13a49c4af97e56105203db816e
.text-qu	499712	3923	4096	4.19142	c228b851da5948298b88d0f68be44c9c
.text-co	503808	88205	88576	4.48498	2f42aaee8fba0023ededca09590de4fb
.text-co	593920	75433	75776	4.46199	bec45236b00d2c6df3523d3abeae3c59
.text-co	671744	48588	48640	4.49726	bbc1d90a9748a63315478d95a33581ab
.text-co	720896	14904	15360	4.40895	549da5eaa45276aef072ae9d0d48fac2
.text-co	737280	27320	27648	4.61595	cb725a9e61efca91b39ed98e633883c3
.text-co	765952	10272	10752	4.36435	35783d34da5aea49ae9ae220f91dc23e
.text-co	778240	263610	263680	4.59722	6130032b23e5b050f7ef6e091de45279
.text-ti	1044480	43367	43520	4.58486	8592313570f96ea9a1561a479718e67a
.text-co	1089536	16103	16384	4.37497	f049073835c36de1a89968d36253ad67
.text-co	1105920	59	512	0.606205	fd9b2190e38582cf67313d0dd565b92b
.text-co	1110016	12737	12800	4.42102	fff94e8753aacfac54a8e2f4400a0b1e
.rdata	1126400	266756	267264	3.8846	08eafd22a21d685373e8bbfdd4a5c06f
.data	1396736	27492	17408	3.39538	47aaca79819f8c4e6b08107eac1eb3f9
.data-qu	1425408	41	512	0	bf619eac0cdf3f68d496ea9344137e8b
.data-co	1429504	188	512	0	bf619eac0cdf3f68d496ea9344137e8b
.data-co	1433600	56	512	0.042395	1e293257cf493bcacc1f9d4b65c50fe8
.data-co	1437696	40	512	0	bf619eac0cdf3f68d496ea9344137e8b
.data-co	1441792	44	512	0.014135	2d5fe836dd5a60fa37b7c590cfc70410
.data-co	1445888	41	512	0	bf619eac0cdf3f68d496ea9344137e8b
.data-co	1449984	40	512	0	bf619eac0cdf3f68d496ea9344137e8b
.data-co	1454080	2932	3072	1.35606	dcd991a144b39f17d95b47640f8edfb7
.data-ti	1458176	1176	1536	1.01305	3b2768e897e8ea9ee1bf5c4827ee3ac6
.data-co	1462272	40	512	0	bf619eac0cdf3f68d496ea9344137e8b
.data-co	1466368	4	512	0.014135	d340f23a7d18057bb02252a3cb40b877
.data-co	1470464	40	512	0	bf619eac0cdf3f68d496ea9344137e8b
.rsrc	1474560	751644	752128	5.36402	b217f3c21507cd92ee57a949de7e31bf

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Network Activity

URLs

URL	IP
hxxp://a568.d.akamai.net/upgrade/NSS/SymCCIS/Production/SCC.dll
hxxp://a568.d.akamai.net/upgrade/NSS/SymCCIS/Production/SCC/w3i/ENG.SCC.config.txt
hxxp://stats.norton.com/n/p?module=9160&product=SCC&version=4.6.1.11&language=09.01&os=5.1.2600.3.0&y=1033&a=w3i&b=false&c=nis&d=nis=1000;nss=1123&e=0x0&error=0&n=0&j=0&k=0&l=none&m=none&o=none&q=none&t=none&u=-1&v=none	63.245.197.111
hxxp://stats.norton.com/n/p?module=9151&product=SymCCIS&version=2.1.0.20&language=09.01&os=5.1.2600.3.0&y=1033&b=w3i&a=CallCriteriaChecker&f=10&c=false&d=false&e=0x0&error=0&j=nis&k=nis=1000;nss=1123&g=0.761&l=2.797	63.245.197.111
hxxp://liveupdate.symantecliveupdate.com/upgrade/NSS/SymCCIS/Production/SCC.dll	212.30.134.160
hxxp://liveupdate.symantecliveupdate.com/upgrade/NSS/SymCCIS/Production/SCC/w3i/ENG.SCC.config.txt	212.30.134.160

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

GET /upgrade/NSS/SymCCIS/Production/SCC.dll HTTP/1.1

Accept: */*

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: liveupdate.symantecliveupdate.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Apache

ETag: "303f02fcd577a11acab7c3a36970e4be:1409925581"

Last-Modified: Fri, 05 Sep 2014 13:59:34 GMT

Accept-Ranges: bytes

Content-Length: 168288

Content-Type: application/octet-stream

Cache-Control: max-age=1244

Expires: Thu, 26 Feb 2015 01:47:30 GMT

Date: Thu, 26 Feb 2015 01:26:46 GMT

Connection: keep-alive

MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........r.................................E...............................Q...................................Rich............PE..L......T...........!.........F............................................................@.........................E...........{.......=............x..`...........0................................................................................text............X......PEC2TO...... ....rsrc.... ...........\.............. ....reloc...............v..............@.............................................................................................................................................................................................................................................................................................................................................................................................................................../.....*..u?...._.Z.|'..Y9j1..V...*%O%.D.o....*/.}......}.p....H...\C...u.J...V...U$ Z!.....4.=..`.r..9?o.m.z.6..L.6.pD.N..;.h ..c....".o....D.^......Q......I.y>.^....o.%-e=WR..K...l. ..K33..........^v....U. ....o[a..*...US...l.{.OA........Be...9..Ybk.........n.. i!.$C.o.V..cT..7..o..1.'.(.B.i.LP$0{;..E%...[..;x.0......k.aTS...j<.T[..>.Y..)L..J..........Y.}N.l.K..|.&..g..b...."{b'.......?......Y%_A.N>I..A.......}..2......qe.... .CqA..P.(4.P..9.J-R..[.m..........^...Z=.v....fq....E>/.R...r,

<<< skipped >>>

GET /upgrade/NSS/SymCCIS/Production/SCC/w3i/ENG.SCC.config.txt HTTP/1.1

Accept: */*

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: liveupdate.symantecliveupdate.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Apache

ETag: "b8dbac3cc2be258b539c305a828416aa:1395133614"

Last-Modified: Tue, 18 Mar 2014 09:06:50 GMT

Accept-Ranges: bytes

Content-Length: 3216

Content-Type: text/plain

Cache-Control: max-age=316

Expires: Thu, 26 Feb 2015 01:32:03 GMT

Date: Thu, 26 Feb 2015 01:26:47 GMT

Connection: keep-alive

...<..iy..}...e_.k.2..#r...-..\\^../..SG>Jc.G2...S... .d".!..:.\..A...='.... .......^....0...>.y..G...X...(.v..u.._...z.....#.[....yIie.......G.^1h...-.....7i........L(,.t......<.3....9.&.......q.....]O.6..A..h...^.:q.....X4a;T.....2.[.h. ..................`S...u......\.y.-...b...YVPT.CqXK....c....\,....R.N.[..2.[.h. ..SV.3..-......#.!u......A.S...^......o..p"d#../q...-.......0a.3.g. ..A...........{xE...%.ws=....d'Y....C...$..k.7...4.]|....Z..L..R.O._S?.g........n..G.v...d....!........\r.T...V.{.]h2.Z.]I...S.}.B..}..._%.n.t.6XK..rK.v.K...3Na..-...?......~_.....9..|............!fr.qON".H .......[.k..&..1l.>a2......3.C.#.A.y.....zx......4.."......u...%.....t.Nsb.&r..NS..]/.c^.j(z0M..pSn.:..t.....&~...E.|ab.L..(}..8..S._3...r....H.Y....0f...X<..U.o....b.g..U...av.....P#W..,.4..x..._..Y..D.......s...K.....8.....?.H.P.L..b.H..J.R..y...........R......'@.l.. k.. .z..m..8.9h.....3#...hkO.AiD....W>1...3...J.....eVqE.H.......v....._.........f..-0....@:....&.`.M.{...O.Ew.O..c..P.....(c...a;T......M~.1*.........hL..l.A....F}<)K.#.T.n.#..h{...U.&.`.M.{.di<:hTh.(............y..!.[.-RJ\...._...Tp.PD"#.".E.....gu,.3..o(X...ZL.....eX.(...y\....t..py1...EE...R....DOQ.H. .y......S.f...x]v.R...?..8|...........f..-0..Z...u.n.........`..;.5.(...S...EE...R..l..*.].F.....$.u%.".IT.F.....$...(c...]O.6..A....@.L...g.V.4...._..w.....(i...g. ..A..jyE. ..B..cH..{j,g........(......!....,..........N..W.Q.M...<'..U...~.$}.Z..]/...:U..@p(U...~.$}@.......%..h_...O]3...y..I.!.R....a......l..D.9:...K. .r.s.xa...H.

<<< skipped >>>

GET /n/p?module=9160&product=SCC&version=4.6.1.11&language=09.01&os=5.1.2600.3.0&y=1033&a=w3i&b=false&c=nis&d=nis=1000;nss=1123&e=0x0&error=0&n=0&j=0&k=0&l=none&m=none&o=none&q=none&t=none&u=-1&v=none HTTP/1.1

User-Agent: Install Stub

Accept: */*

Host: stats.norton.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Apache-Coyote/1.1

Cache-Control: no-cache

Pragma: no-cache

Content-Type: text/plain;charset=ISO-8859-1

Content-Length: 13

Date: Thu, 26 Feb 2015 01:26:47 GMT

1424914008509....

GET /n/p?module=9151&product=SymCCIS&version=2.1.0.20&language=09.01&os=5.1.2600.3.0&y=1033&b=w3i&a=CallCriteriaChecker&f=10&c=false&d=false&e=0x0&error=0&j=nis&k=nis=1000;nss=1123&g=0.761&l=2.797 HTTP/1.1

User-Agent: Install Stub

Accept: */*

Host: stats.norton.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Apache-Coyote/1.1

Cache-Control: no-cache

Pragma: no-cache

Content-Type: text/plain;charset=ISO-8859-1

Content-Length: 13

Date: Thu, 26 Feb 2015 01:26:47 GMT

1424914008704..

Map

The PUP connects to the servers at the folowing location(s):

Strings from Dumps

%original file name%.exe_1388:

.text

`.text-quS

`.text-co

`.text-co8:

`.text-co (

`.text-tig

`.text-co;

`.rdata

@.data

.data-qu)

.data-co

.data-co8

.data-co(

.data-co,

.data-co)

.data-cot

.data-ti

.rsrc

CSShZ

t.ShPvR

CSSh4

CSSh9

CSSh>

CSShl

CSSh[

CSSh`

<:>

t8Ht.HHt#

.FGy1

Af;FP}%S3

|$|.tD

#t.Ht

2 34 567

u.SSV

1t.Ht

9sxv%UW

function not supported

operation canceled

address_family_not_supported

operation_in_progress

operation_not_supported

protocol_not_supported

operation_would_block

address family not supported

broken pipe

inappropriate io control operation

not supported

operation in progress

operation not permitted

operation not supported

operation would block

protocol not supported

operator

GetProcessWindowStation

Operation not permitted

Inappropriate I/O control operation

Broken pipe

0xX

Invalid CRT parameter

QuickStartApp.cpp

vi.engine.xml

chk_firefox

chk_chrome

OfferManager.cpp

position=%d, active=%d

%s[%d]

%d,%d,%d

** Debug mode: simulating stopping Firefox

** Debug mode: simulating stopping Chrome

%s must be closed before continuing. Press OK to close %s now. You may need to close %s manually.

Firefox

Google Chrome

%d err: %s

Chrome

firefox

chrome

opera

sxexaxrxcxhxpxrxoxtxexcxtxoxrx.xexxxex

view=%d,sel=%d,inst=%d,conf=%d,can=%d,err=%d,eid=%d,pos=%d,%s

control.txt

00000000-0000-0000-0000-000000000000

QuickStartProcess.cpp

%programfiles%\Free Offers from Freeze.com

disabling offer because system doesn't have Firefox

disabling offer because system doesn't have Chrome

%s[%s]: view=%s accept=%s

%s,%s

WindowsErrorCode

targetbrowser/key

%s:v=%s,id=%s,rc=%d,f=%d,e=%d,i=%s,p=%s,pb=%s,ex=%s,tr=%s,px=%d

%s:v=%s,rc=%d,os=%s,%s,%s|ie=%s

%d,%d,%s,%s,%s,%s

%d,%d,%d,%d,%d

%d,%d,%s,%s,%s,%s,%s

%d,%s,%s,%s,%s,%d,%d,%d,%d,%d,%d,%d,%d,%s,%s,%d,%s

offers

%s,%s,%s,%s,%s,%s,%s,%s

%s,%d,%s,%s

%s,%s,%u,%u,%d,%s

Unable to open thankyou page; url is empty or invalid!

statsd.response.txt

Web.Installer.VDI.CommError

Web.Installer.VDI.InstallError

Web.Installer.VDI.OfferDownloadError

Web.Installer.VDI.OfferInstallError

Web.Installer.VDI.OfferInstallFailed

hxtxtxpx:x/x/xdxlx2x.xvx4x7xixnxsxtxaxlxlxexrx.xcxoxmx/xlxmx/xbxuxnxdxlxexsx/xkxexexpxmxyxsxextxtxixnxgxsxxx/xkxexexpxmxyxsxextxtxixnxgxsxxx.xzxixpx

hxtxtxpx:x/x/xsxdxsxpxaxpxix.xcxoxmx/xaxpxix/xvxaxlxuxexsx

hXXps://search.yahoo.com/yhs/web?hspart=w3i&hsimp=yhs-syctransfer&type=W3i_DS,221,0_0,Search,20140522,19669,0,FF29,7635

hxtxtxpx:x/x/xdxlx2x.xvx4x7xixnxsxtxaxlxlxexrx.xcxoxmx/xlxmx/xbxuxnxdxlxexsx/xkxexexpxmxyxsxextxtxixnxgxsxxx/xsxpxvx1x.xzxixpx

spv1.zip

hxtxtxpx:x/x/xvxixnxsxtxaxlxlxexrx.xcxoxmx/xaxpxix/xtxrxaxcxkxoxfxfxexrxixnxsxtxaxlxlxdxextxaxixlxsx

hxtxtxpx:x/x/xvxixnxsxtxaxlxlxexrx.xcxoxmx/xaxpxix/xixnxsxtxaxlxlxexrxrxoxrx

session.response.json

postback.response.json

vmtest.txt

vmtest.txt is present, enbaling offers for vmtest

config.xml

pingurl

postbackurl

errorurl

statsdurl

uninstalloptionurl

encryptionkey

PingUrl

PostbackUrl

Config.cpp

stub.xml

.json

MainWnd.cpp

.html

OfferThread.cpp

Setting offer checkbox value: key=

COfferExe::GetXpiFilename

g:\winapps\windows\main\installer.quickstart.application\installer.quickstart.lib\OfferExe.h

configuration/downloadurl

configuration/downloadurl.64bit

configuration/msie.downloadurl

configuration/msie.commandline

configuration/firefox.downloadurl

configuration/firefox.commandline

configuration/chrome.downloadurl

configuration/chrome.commandline

configuration/allbrowser.downloadurl

configuration/allbrowser.commandline

configuration/regkeyadd

regkeyadd

configuration/ieregkey

ieregkey

configuration/firefox.pref

firefox.pref

configuration/firefox.xpimethod

configuration/firefox.xpilocation

configuration/firefox.xpidelete

LUA account detected, and flag lua_runasdesktopuser detected, forcing executeAsDesktopUser

configuration/iconurl

adding %s entry, ourVal='%s', theirVal='%s'

COfferExe::Download

Download url is empty!

_firefox is NULL!

COfferExe::OnInstall

Install is a dropfile; no exe to run...

Icon offer (in exe config) detected, running icon install

COfferExe::Run

COfferExe::HandleFirefoxOptions

firefoxoffer

HandleFirefoxOptions called with incorrect preferences set in config!

COfferExe::BuildCommandLine

msiexec.exe /i "%s" /qn ALLUSERS=2 REBOOT=ReallySuppress

msiexec.exe /i "%s" %s

Could not find firefox exe to install

Offer is installing XPI for Firefox 8 or higher, enabling GUI.

"%s" "%s"

"%s" %s

COfferExe::RunSearchProtectInstall

COfferExe::WaitForInstallProcess

OfferExe.cpp

COfferExe::WaitForProcessStarted

waiting for registry key:

COfferExe::WaitForRegistryValue

Registry key found.

Registry key found (64-bit).

COfferExe::WaitForFile

COfferExe::InstallXpi

Bad RegKeyAdd config; not correct format: (missing hive \ )

Bad RegKeyAdd config; not correct format: (missing , )

Bad RegKeyAdd config; not correct format: (missing = )

unable to set regkey from following RegKeyAdd:

RegKeyAdd:

unrecognized values in RegKeyAdd:

unable to set regkey from following IERegKey:

IERegKeyAdd:

unrecognized values in IERegKey:

COfferExe::FinishXpiInstall

COfferExe::CancelXpiInstall

COfferExe::RunIconInstall

%s_%s.url

configuration/url

configuration/msie.url

configuration/firefox.url

configuration/firefox.newtaburl

configuration/chrome.extensionid

configuration/chrome.extensionparam

All urls are empty!

COfferStartPage::InstallFirefox

_firefox is NULL!

** Debug mode: simulated setting Firefox startpage:

Error writing Firefox pref for startpage!

Error setting Firefox new tab!

Set new tab in Firefox.

Firefox startpage set successful.

chromeoffer

COfferStartPage::InstallChrome

_chrome is NULL!

** Debug mode: simulated setting Chrome startpage:

Error setting Chrome startpage: browser is still running!

Error writing Chrome pref for startpage!

Can't set new tab Chrome, function is implemented with Default Search.

Chrome startpage set successful.

OfferStartPage.cpp

startpageurl

oldstartpageurl

hXXp://ff.search.yahoo.com/gossip?output=fxjson&command={searchTerms}

configuration/msie.searchname

configuration/firefox.searchname

configuration/firefox.suggesturl

configuration/firefox.selectedengine

Error setting IE search: url is empty!

Internet Explorer version 6 or older does not support default search!

COfferDefaultSearch::InstallFirefox

** Debug mode: simulated setting Firefox default search:

Failed to write Yahoo xml for Firefox!

Firefox default search set successful.

COfferDefaultSearch::InstallChrome

** Debug mode: simulated setting Chrome default search by extension:

Failed to install default search extension for chrome!

Chrome default search set successful.

OfferDefaultSearch.cpp

searchurl

hxtxtxpx:x/x/xdxlx5x.xvx1xixnxsxtxaxlxlxexrx.xcxoxmx/x

PingResponse.cpp

targetbrowser/Key

PingThread.cpp

offer %s[%s]: isInstalled=%d canShow=%d

rule %s[%s]: isInstalled=%d

QuickStartDetectThread.cpp

ResourceThread.cpp

Response/url

passed

CRequirementManager::RunExecute

CRequirementManager::ParseExecuteResult

invalid flag in execute result:

Software\Microsoft\Windows\CurrentVersion\RunOnce

Running requirement.OnInstall:

Running requirement.OnCancel:

requirement.OnCancel is empty, skipping.

Running requirement.OnExit:

requirement.OnExit is empty, skipping.

%programdata%\W3i\UninstallHelper\iqu.ini

2.0.1.0

%xpxrxoxgxrxaxmxdxaxtxax%x\xWx3xix\xUxnxixnxsxtxaxlxlxHxexlxpxexrx\xixmxpxoxrxtx

quickstart.xml

quickstart%d.xml

Failed to save IQU data, too many import files in directory!

%xpxrxoxgxrxaxmxfxixlxexsx%x\xWx3xix\xUxnxixnxsxtxaxlxlxHxexlxpxexrx\xUxnxixnxsxtxaxlxlxHxexlxpxexrx.xexxxex

quickstart_si.xml

quickstart_si%d.xml

Failed to save SoftwareInfo data, too many import files in directory!

hxtxtxpx:x/x/xdxlx.xixnxsxtxaxlxlxixqx.xcxoxmx/xAxPxIx/xIxQxUx/xSxoxfxtxwxaxrxexIxnxfxox.xaxsxpxxx

UH executable not found!

"%s" /silent /noswinfo

%s:%d

handling firefox cookies...

FF.GetCookiesError

FF.NoCookies

firefox: no cookies found

FF.SetCookieError

FF.SetCookies

firefox: set cookies

getting firefox cookies for

CCookieManager::GetFirefoxCookies

Error enumerating firefox cookies!

firefoxenum

hXXp://

cookie.dat

Vista.NoResult

Vista.SavedLow

Vista.NoCookies

Vista.CopiedLow

%a, %d-%b-%Y %H:%M:%S GMT

cookieman.exe

Vista.ExtractError

Vista.CreateLowError

handling chrome cookies

Chrome.GetCookiesError

Chrome.NoCookies

Chrome: no cookies found

Chrome.SetCookieError

Chrome.SetCookies

Chrome: set cookies succeeded

getting Chrome cookies for

CCookieManager::GetChromeCookies

Error enumerating chrome cookies!

chromeenum

Safari.GetCookiesError

Safari.NoCookies

Safari.SetCookieError

Safari.SetCookies

Sending session request, url=

Request url is empty!

Request url is invalid!

ErrorLogger.cpp

explorer.exe

CDialogWindowJson::OnBeforeNavigate2, url=

DialogWindowJson.cpp

%s: view=%s accept=%s

chk_%s=

checkbox found; %s=%s

adding disclosure(%s): %s

installedbrowsers/firefox

installedbrowsers/chrome

installedbrowsers/opera

view.buildconfig.json

view.productconfig.json

ProgressDialog.cpp

Installing %d of %d

uninstalloption.exe

InstallIQFirefoxLock

configuration/postinstallexecute

configuration/postinstallexecuteintegrity

stopfirefox

stopchrome

disablechromeextensions

/msie.autoconfirm

/firefox.autoconfirm

/chrome.autoconfirm

COffer::WaitForFirefoxLock

Offer.cpp

_firefoxLock is already created!

Waiting for Firefox lock...

Firefox lock status:

Releasing Firefox lock

PostInstallExecute:

iexplore.exe

** Debug mode: simulating PostInstallExecute:

Cannot run post-install execute, file does not exist:

COffer::PostInstallExecute

PostInstallExecute command failed!

http:

Adding UH data: %s|%s,%s

Failed to extract uninstall option exe!

Error; uninstalloption.exe doesn't exist (after download and extract!)

Error copying uninstalloption.exe to program files!

error downloading uninstall option url!

%programfiles%\Common Files\Adobe AIR\Versions\1.0\Adobe AIR Application Installer.exe

hXXp://airdownload.adobe.com/air/win/download/latest/AdobeAIRInstaller.exe

"%s" %s "%s"

AdobeAirInstaller.exe

JsonResponse.cpp

%firefoxprofiles%

SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\

Unknown uninstall key type encountered, skipping lookup

HRESULT:0x%X

crterr:%d

Win32Err:%d

@ line %d in function .

wininet.dll

Unknown error: %d

IDispatch error #%d

LoadLibrary failed in loading current exe:

CoreResource.cpp

CStringW.GetBuffer failed!

0xx

%s. {%s} @ line %d in function in module %s.

Win32Err:%d

HRESULT:0x%X

Error:%d

HttpStatus:%d

L%d:d.d.d_d:d:d.d

-- %s line %d --

[X]

ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789 /%d

%s_%x%x%x%x%x

CoreFile.cpp

Exception %X in module %s at: 0x%p.

dbghelp.dll

0x%p %s

CoreProcess.cpp

CCoreProcess::ShellExecuteCommand

ShellExecuteCommand:

CCoreProcess::ShellExecuteCommandAndWait

Failed to execute command:

CCoreProcess::CloseProcessWindowsByModuleName

CCoreProcess::GetProcessExe32

CCoreProcess::GetProcessExe64

kernel32.dll

CoreXml.cpp

_ftprintf_s failed writing header to

]/Key/text()

CCoreXml::ParseRequiredKeyValue

CCoreXml::ParseRequiredKeyInt

CoreThread.cpp

PTF://

hXXps://

CCoreSystem::GetWindowsVersionId

Missing windows version, check the code!!

CoreSystem.cpp

%s (Build %d)

CCoreSystem::CacheWindowsInfo

Unknown OS! Major: 0xX, Minor: 0xX

%windows%

%system%

Software\Microsoft\Windows\CurrentVersion

Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders

Ãžsktop%

Ãžsktopdir%

%userprofile%

%s0x%.2x%.2x%.2x%.2x%.2x%.2x-

SOFTWARE\Microsoft\NET Framework Setup\NDP\v1.1.4322

SOFTWARE\Microsoft\NET Framework Setup\NDP\v2.0.50727

SOFTWARE\Microsoft\.NETFramework\policy\v1.0

3321-3705

SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\

Iphlpapi.dll

%windows%\Desktop

proc.vboxsvc

VBoxService.exe

proc.vboxtray

vboxtray.exe

proc.vmtools

vmtoolsd.exe

proc.hvsvc

vmicsvc.exe

reg.vboxguest

reg.vboxmouse

reg.vboxsvc

reg.vboxsf

reg.vboxvid

reg.vboxbios

reg.vboxsguest

file.vboxhook

%system%\vboxhook.dll

reg.vmvid

reg.vmpci

reg.vmdbg

reg.vmcrd

reg.vmmem

reg.vmmouse

reg.vmdsk

reg.vmtools

reg.vmsnap

reg.vmnet64

reg.hvgenctr

SYSTEM\CurrentControlSet\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000

reg.hvvmbus

reg.hvvid

reg.hvscsi

SYSTEM\CurrentControlSet\Control\Class\{4D36E97B-E325-11CE-BFC1-08002BE10318}\0000

reg.hvinput

SYSTEM\CurrentControlSet\Control\Class\{745A17A0-74D3-11D0-B6FE-00A0C90F57DA}\0000

reg.vboxdisk

reg.vmdisk

reg.hvdisk

sng.vmt2

sng.vmt1

sng.vmt4

sng.vmt3

gen.dbg

CCoreRegKey::Create

Warning: HKEY_CLASSES_ROOT opened for writing! This can lead to unpredictable results.

CCoreRegKey::Open

RegCreateKeyEx failed on key=

RegOpenKeyEx failed on key=

Registry key is not open! (

CoreRegKey.cpp

CCoreRegKey::GetValueType

CCoreRegKey::GetValueSize

CCoreRegKey::GetValueString

CCoreRegKey::GetValue

CCoreRegKey::SetValue

CCoreRegKey::DeleteValue

RegDeleteKeyExA

CCoreRegKey::DeleteKey

RegDeleteKey failed on

RegDeleteKeyEx failed on

CCoreRegKey::EnumSubKeys

SHCopyKey failed for

CCoreRegKey::CopyTree

CCoreEntryPoint::LoadProcAddress

CCoreEntryPoint::CCoreEntryPoint

Advapi32.dll

UniqueId.cpp

subKey is NULL!

%u,%u,%u,%u

0.0.0.0

\/:*?"|

createurlfilefail

Failed to create URL file!

Encryption key not initialized!

%Y-%m-%dT%H:%M:%S

CommandLine.cpp

CoreEvent.cpp

shell32.dll

CoreVista.cpp

Software\Microsoft\Windows\CurrentVersion\Policies\System

HKEY_CURRENT_CONFIG

HKEY_LOCAL_MACHINE

HKEY_USERS

HKEY_CLASSES_ROOT

HKEY_CURRENT_USER

%s.%s

iexplore,ie.http

Failed to get IE version key!

Loading IE cookies for url:[

wrote %d cookies

CoreInternetExplorer.cpp

-noframemerging "%s"

ie.http\shell\open\command

Unable to find iexplore.exe, using shell execute (with possible warnings)

Default search regkey not found (may be a brand new install)

EnumSubKeys failed!

ieframe.dll

hXXp://VVV.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC

url is empty!

Replacing existing provider url:

Error setting provider url!

CCoreInternetExplorer::FindFirstHistoryUrl

findfirsturlfailed

FindFirstUrlCacheEntry() failed!!

FindUrlCache handle is null!! Did you call FindFirstHistoryUrl first??

CCoreInternetExplorer::FindNextHistoryUrl

findnexturlfailed

FindNextUrlCacheEntry() failed!!

FindCloseUrlCache() failed!!

CCoreInternetExplorer::FindCloseHistoryUrl

findcloseurlfailed

msgTitle is required!

msgText is required!

browser.search.defaultenginename

browser.search.selectedEngine

MozillaUIWindowClass

browser.startup.homepage

firefox.exe,firefox.url,firefoxportableurl,firefoxurl,firefox

MozillaWindowClass

Software\Mozilla\Mozilla Firefox

Failed to get Firefox version key!

CCoreFirefox::GetVersion

Profile%d

firefoxver

%appdata%\Mozilla\Firefox

Firefox versions prior to 3 are not supported by LoadProfileCookies!

profiles.ini

Loading Firefox3 cookies for url:[

%s=%s

cookies.sqlite

Enumerating Firefox3 cookies for

cookies.txt

Enumerating Firefox cookies for

Found partial cookie in Firefox profile:

firefox.exe

-requestPending -osint -new-window "%s"

PathToExe

prefs.js

%programfiles%\Mozilla Firefox

CoreFirefox.cpp

CCoreFirefox::GetPrefString

CCoreFirefox::SetPrefString

user_pref("%s", %s%s%s);

CCoreFirefox::SetDefaultSearch

searchUrl is empty!

Can't set search engine while Firefox is running!

suggestionUrl is empty!

Setting Firefox default search engine:

SuggestionUrl=

SearchUrl=

Failed to write search hash for Firefox!

Failed to write search engine plug-in xml for Firefox!

hXXp://VVV.mozilla.org/2006/browser/search/

browser.search.order.2

browser.search.order.1

downloads.sqlite

Failed to open downloads.sqlite database!

places.sqlite

select source from moz_downloads where source like '%%%s%%' order by id desc

Failed to open places.sqlite database!

select url from moz_places where url like '%%%s%%' order by id desc

CCoreFirefox::SetStartpage

browser.startup.page

cannot set startpage; firefox is currently running!

CCoreFirefox::SetNewTab

Cannot set newtab because firefox is running!

/SearchPlugin/Url

browser.newtab.url

browser.search.param.yahoo-fr

firefox pref: browser.search.param.yahoo-fr=

CCoreFirefox::WriteSearchHash

search-metadata.json

nss3.dll

CCoreFirefox::GetVerificationHash

secmod.db

By modifying this file, I agree that I am doing so only within Firefox itself, using official, user-driven search engine selection processes, and in a way which does not circumvent user consent. I acknowledge that any attempt to change this file from outside of Firefox is a malicious act, and will be responded to accordingly.

CCoreChrome::SetCookie

g:\winapps\windows\main\core.cpplib\core.cpplib.browser\CoreChrome.h

Chrome_WidgetWin_0

Chrome_WindowImpl_0

Chrome_WidgetWin_1

Chrome_RenderWidgetHostHWND

chrome.exe,chrome.hwd,chromehtml,chromiumhtml,chrome,chromium

CCoreChrome; Cookie file does not exist

%local_appdata%\Google\Chrome\User Data\Default\Cookies

select name, value, host_key, path, expires_utc from cookies where

Loading Google Chrome cookies for url:[

Enumerating Google Chrome cookies for

host_key like '%

Chrome cookie file does not exist

CCoreChrome::EnumCookiesLegacy

select host_key, name, value, path, expires_utc from cookies where host_key like '%

CCoreChrome::EnumCookiesV33

Enumerating Google Chrome cookies (v33) for

CCoreChrome::EnumCookieRowCallback

select host_key, name, value, path, expires_utc, encrypted_value from cookies where host_key like '%

Failed to decrypt chrome cookie:

CoreChrome.cpp

chrome.dll

Chrome cookie:

Unable to find chrome.exe, using shell execute (with possible warnings)

--new-window "%s"

ChromeHTML\shell\open\command

chrome.exe

%programfiles%\Google\Chrome\Application

%local_appdata%\Google\Chrome\Application

CCoreChrome::GetStartpage

session/startup_urls

CCoreChrome::IsMultiStartPageEnabled

/preferences/session.restore_on_startup

/manifest/chrome_settings_overrides/search_provider/

CCoreChrome::GetDefaultSearchUrl

%local_appdata%\Google\Chrome\User Data\Default\Web Data

search_url

SELECT value FROM meta WHERE key='Default Search Provider ID'

SELECT id, short_name, url FROM keywords where id = %s

default_search_provider_data/template_url_data

CCoreChrome::GetDSUrlFromPrefTemplate

{google:baseURL}search?q={searchTerms}&{google:RLZ}{google:originalQueryForSuggestion}{google:assistedQueryStats}{google:searchFieldtrialParameter}{google:bookmarkBarPinned}{google:searchClient}{google:sourceId}{google:instantExtendedEnabledParameter}{google:omniboxStartMarginParameter}ie={inputEncoding}

default_search_provider_data/template_url_data/short_name

default_search_provider_data/template_url_data/url

default_search_provider_data/template_url_data/id

CCoreChrome::GetPreference

CCoreChrome::LoadPreferences

%local_appdata%\Google\Chrome\User Data\Default\Preferences

CCoreChrome::LoadSecurePreferences

%local_appdata%\Google\Chrome\User Data\Default\Secure Preferences

%local_appdata%\Google\Chrome\User Data\Default\History

select url from downloads_url_chains where url like '%%%s%%' order by id desc

Found chrome extension

chrome_url_overrides

Setting chrome extension [

Software\Wow6432Node\Google\Chrome\Extensions

Installing extension from web store:

CCoreChrome::InstallExtensionFromWebStore

Software\Google\Chrome\Extensions

hXXps://clients2.google.com/service/update2/crx

Error setting update_url in registry!

update_url

%local_appdata%\Google\Chrome\User Data\Default\Extensions

CCoreFirefoxXpiInstaller::Install

CoreFirefoxXPIInstaller.cpp

CCoreFirefoxXpiInstaller::GetXpiInfo

install.rdf

xml.LoadBuffer failed on

Installing Firefox add-ons via package...

Create install.rdf failed!

Firefox.exe not found!

CCoreFirefoxXpiInstaller::InstallAsPackage

installiq.xpi

Running Firefox to install add-ons:

Error running Firefox!

CCoreFirefoxXpiInstaller::CreateInstallRDF

xmlns:NC="hXXp://home.netscape.com/NC-rdf#"

xmlns:em="hXXp://VVV.mozilla.org/2004/em-rdf#">

multi@installiq.com

{ec8030f7-c20a-464f-9b0e-13a3a9e97384}

*.*.*

CCoreFirefoxXpiInstaller::SetResult

Error creating install.rdf!

CCoreFirefoxXpiInstaller::GetExtensionsFolder

Installed Firefox extension:

Can't get Firefox default profiles folder!

g:\winapps\windows\main\core.cpplib\core.cpplib.browser\CoreSearchProtectorApp.h

kxexexpxmxyxsxextxtxixnxgxsxxx.xexxxex

hxtxtxpxsx:x/x/xixnxsxtxaxlxlxexrx.xfxrxexexzxex.xcxoxmx/xLxoxgxExrxrxoxrx.xaxsxpxxx

KxexexpxMxyxSxextxtxixnxgxsxXx

hxtxtxpx:x/x/xdxoxwxnxlxoxaxdx.xixnxsxtxaxlxlxixqx.xcxoxmx/xlxmx/xbxuxnxdxlxexsx/xkxexexpxmxyxsxextxtxixnxgxsxxx/xsxoxfxtxwxaxrxexixnxsxtxaxlxlxaxtxixoxnx_x1x3x4x7x1x.xexxxex

Software\Microsoft\Windows\CurrentVersion\Uninstall\Yahoo! Companion

Restoring V1 toolbar uninstall key...

Renaming V1 uninstall key...

Error replacing toolbar uninstall key!

Error opeing uninstall registry key in HKLM\

Sxoxfxtxwxaxrxex\xMxixcxrxoxsxoxfxtx\xWxixnxdxoxwxsx\xCxuxrxrxexnxtxVxexrxsxixoxnx\xUxnxixnxsxtxaxlxlx\xKxexexpxMxyxSxextxtxixnxgxsxXx

CoreSearchProtectorApp.cpp

Error removing V1 registry key from HKLM\

Error copying V1 registry key!

CCoreSearchProtectorApp.ShutDown: window not found

Error removing registry key from HKLM\

Software\Microsoft\Windows\CurrentVersion\Run

apiurl

offerurl

dsotherurl

spotherurl

%s/provider[%d]

hXXp://google.com

hXXp://bing.com

hXXps://VVV.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-us:IE-Address&ie=&oe=

firefoxsearch

chromesearch

firefoxstartpage

chromestartpage

keyword.URL

config.dat

Error replacing Yahoo Toolbar uninstall key!

Yahoo uninstall key not found

Software\Microsoft\Windows\CurrentVersion\Uninstall\

UninstallKey

ChromeSearchExtensionId

UninstallKey=

FirefoxPriorSearchUrl

ChromeStartPageExtensionId

FirefoxPriorStartPage

CoreBrowserOptionUninstaller.cpp

g:\winapps\windows\main\core.cpplib\core.cpplib.browser\CoreSafari.h

safari.exe,safariurl,safari

%appdata%\Apple Computer\Safari\Cookies\Cookies.binarycookies

Loading Safari cookies for url:[

CoreSafari.cpp

%appdata%\Apple Computer\Safari\Cookies\Cookies.plist

Failed to get Safari version key!

safari.exe

-url "%s"

Software\Microsoft\Windows\Shell\Associations\UrlAssociations\http\UserChoice

http\shell\open\command

Can't find shell associations or shell command reg keys!

CoreBrowser.cpp

Dll %s failed, resultcode = %x

SymCCIS2.zip

SymCCIS.dll

RunDLL productlist="%s" resultcodes="%s"

SCCLog.txt

SymCCISDll.txt

SymCCIS_CheckCriteria.txt

SymInstallStub.txt

Detect.cpp

/executeresult/text()

/execute/text()

Missing ExecuteResult in requirement config!

%programfiles%\iTunes\iTunes.exe

SOFTWARE\Microsoft\Windows Live\Messenger

msnmsgr.exe

ydetect.yas

ydetect.ytb

ydetect.yhp

Rules.cpp

RegKeyExists

regkey

firefoxprefs

chromeprefs

CDetectionYahooToolbar::IsInstalledFirefox

CLSID\{EF99BD32-C1FB-11D2-892F-0090271D4F88}\InprocServer32

%firefoxprofiles%\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}\install.rdf

KeyExists

SourceKey

hkey_current_user

hkey_classes_root

hkey_local_machine

hkey_current_config

multireg%d

multireg: unable to parse key:

multireg: key found:

1.1.0.6

//flag[%d]/text()

Cannot evaluate .NET Version, .NET may not be installed!

DetectionFile.cpp

wajam_validate.zip

wajamexemissing

extracted wajam exe file not found!

Timed out waiting for wajam_validate.exe!

Unable to get returncode from wajam_validate.exe!

wajam_validate.exe detection process result = %d

yahoo.com

live.com

google.com

ask.com

msn.com

aol.com

CDetectionFirefoxPrefs::OnEvaluate

DetectionFirefoxPrefs.cpp

CDetectionChromePrefs::OnEvaluate

DetectionChromePrefs.cpp

)] disabled because of minimum windows version.

minwindowsversion

DetectionRule.cpp

Disabled; Firefox is not installed

Disabled; rule target is not Firefox

Disabled; Chrome is not installed

Disabled; rule target is not Chrome

asktbdet.zip

Ask detection process result = %d

CoreWininet.cpp

Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)

wininet: connecting to %s:%d

HTTPSendRequest:

wininet: HttpOpenRequest failed!

CCoreWininet::HTTPSendRequest

wininet: Request handle is NULL after HttpSendRequest!

httpopenrequest

unable to set wininet http decoding

httpreqerr

Content-Type: application/x-www-form-urlencoded

httpaddheaders

wininet: HttpAddRequestHeaders (post flag) failed!

Range: bytes=%u-%u

Range: bytes=%u-

httpaddheader

wininet: HttpAddRequestHeaders (range specification) failed!

wininet: HttpSendRequest failed! (verb=

httpsendreq

wininet: HttpSendRequest failed!

httptimeout

httpqueryinfo

wininet: HttpQueryInfo failed!

httpproxy

wininet: Server responded with error: %d, %s. %s %s

wininet: HttpSendRequest: status OK received

httpstatus

wininet: HttpQueryInfo for content range failed!

wininet: HttpQueryInfo for file size failed!

wininet: Operation cancelled by caller.

Software\Microsoft\Windows\CurrentVersion\Internet Settings

HTTP Status %d: %s

API url is invalid!

apiUrl is null!

%m/%d/%Y

Url is null!

%s, %s, l=0xx

[0x%X]

Summary

Dynamic Analysis

Removals

Static Analysis

Network Activity

Map

Strings from Dumps