Gen.Variant.Application.Bundler.Amonetize.14_aa0ec9ee5e

Dynamic Analysis

Payload

No specific payload has been found.

Process activity

The Trojan creates the following process(es):

%original file name%.exe:320

The Trojan injects its code into the following process(es):

Uniblue__3607_il4231915.exe:816

Mutexes

The following mutexes were created/opened:No objects were found.

File activity

The process Uniblue__3607_il4231915.exe:816 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\6NIVM3W5\cancel[1].gif (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\6NIVM3W5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Uniblue__3607_il4231915.exe (673 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\desktop.ini (159 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ami1.tmp.ico (766 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\ANMTEH4P\cancel1[1].gif (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\GLQJKPMN\decline[1].gif (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\GLQJKPMN\footer_img[1].png (937 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\6NIVM3W5\next[1].gif (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\GLQJKPMN\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\U72V39E8\install[1].gif (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\ANMTEH4P\main[1].css (769 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\U72V39E8\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\ANMTEH4P\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\ANMTEH4P\accept[1].gif (967 bytes)
%Documents and Settings%\%current user%\Desktop\Continue installation - %appname% Installation.lnk (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\amipixel.cfg (31 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\6NIVM3W5\index[1].htm (9577 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\U72V39E8\skip[1].gif (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\U72V39E8\amipb[1].js (30276 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\ami1.tmp (0 bytes)

The process %original file name%.exe:320 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\IXP000.TMP\Uniblue__3607_il4231915.exe (3165 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\IXP000.TMP\driverscanner.exe (87403 bytes)

Registry activity

The process Uniblue__3607_il4231915.exe:816 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKCR\CLSID\{A6FEED89-3BCD-4D19-9DC2-3E613A80A2A4}\LocalServer32]
"(Default)" = "C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\IXP000.TMP\Uniblue__3607_il4231915.exe"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy\traceIdentifier]
"Guid" = "5f31090b-d990-4e91-b16d-46121d0255aa"

[HKCR\CLSID\{A6FEED89-3BCD-4D19-9DC2-3E613A80A2A4}\VersionIndependentProgID]
"(Default)" = "AmiBs.Installer"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil\traceIdentifier]
"Guid" = "8aefce96-4618-42ff-a057-3536aa78233e"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCR\CLSID\{A6FEED89-3BCD-4D19-9DC2-3E613A80A2A4}\Version]
"(Default)" = "1.0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Start Menu" = "%Documents and Settings%\%current user%\Start Menu"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\ESENT\Process\Uniblue__3607_il4231915\DEBUG]
"Trace Level" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"My Pictures" = "%Documents and Settings%\%current user%\My Documents\My Pictures"

[HKLM\System\CurrentControlSet\Services\Eventlog\Application\ESENT]
"EventMessageFile" = "%System%\ESENT.dll"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCR\Interface\{D54C859C-6066-4F31-8FE0-2AAEDCAE67D7}\TypeLib]
"(Default)" = "{1C1356DA-1E98-4810-A9F6-18D89BD1C0C0}"

[HKCR\CLSID\{A6FEED89-3BCD-4D19-9DC2-3E613A80A2A4}]
"(Default)" = "Installer Class"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Start Menu" = "%Documents and Settings%\All Users\Start Menu"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1B 00 00 00 01 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKLM\System\CurrentControlSet\Services\Eventlog\Application\ESENT]
"CategoryCount" = "16"
"TypesSupported" = "7"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKCR\TypeLib\{1C1356DA-1E98-4810-A9F6-18D89BD1C0C0}\1.0\FLAGS]
"(Default)" = "0"

[HKCR\CLSID\{A6FEED89-3BCD-4D19-9DC2-3E613A80A2A4}\LocalServer32]
"ServerExecutable" = "C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\IXP000.TMP\Uniblue__3607_il4231915.exe"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg\traceIdentifier]
"BitNames" = " Error Unusual Info Debug"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg]
"Active" = "1"

[HKCR\AmiBs.Installer.1\CLSID]
"(Default)" = "{A6FEED89-3BCD-4D19-9DC2-3E613A80A2A4}"

[HKCR\TypeLib\{1C1356DA-1E98-4810-A9F6-18D89BD1C0C0}\1.0\0\win32]
"(Default)" = "C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\IXP000.TMP\Uniblue__3607_il4231915.exe"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCR\AmiBs.Installer]
"(Default)" = "Installer Class"

[HKCR\Interface\{D54C859C-6066-4F31-8FE0-2AAEDCAE67D7}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil]
"Active" = "1"

[HKCR\TypeLib\{1C1356DA-1E98-4810-A9F6-18D89BD1C0C0}\1.0\HELPDIR]
"(Default)" = "C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\IXP000.TMP"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg]
"ControlFlags" = "1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonMusic" = "%Documents and Settings%\All Users\Documents\My Music"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg]
"LogSessionName" = "stdout"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKCR\Interface\{D54C859C-6066-4F31-8FE0-2AAEDCAE67D7}]
"(Default)" = "IBoot"

[HKLM\SOFTWARE\Microsoft\DirectDraw\MostRecentApplication]
"ID" = "1389284156"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy\traceIdentifier]
"BitNames" = " Error Unusual Info Debug"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\DirectDraw\MostRecentApplication]
"Name" = "Uniblue__3607_il4231915.exe"

[HKCR\AmiBs.Installer.1]
"(Default)" = "Installer Class"

[HKCR\CLSID\{A6FEED89-3BCD-4D19-9DC2-3E613A80A2A4}\TypeLib]
"(Default)" = "{1C1356DA-1E98-4810-A9F6-18D89BD1C0C0}"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

[HKCR\CLSID\{A6FEED89-3BCD-4D19-9DC2-3E613A80A2A4}\ProgID]
"(Default)" = "AmiBs.Installer.1"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy]
"LogSessionName" = "stdout"
"ControlFlags" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg\traceIdentifier]
"Guid" = "5f31090b-d990-4e91-b16d-46121d0255aa"

[HKCR\Interface\{D54C859C-6066-4F31-8FE0-2AAEDCAE67D7}\TypeLib]
"Version" = "1.0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonVideo" = "%Documents and Settings%\All Users\Documents\My Videos"
"CommonPictures" = "%Documents and Settings%\All Users\Documents\My Pictures"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy]
"Active" = "1"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "37 AB 64 79 80 4C 74 7B D3 86 1A 03 5A 91 22 FE"

[HKCR\TypeLib\{1C1356DA-1E98-4810-A9F6-18D89BD1C0C0}\1.0]
"(Default)" = "InstallerLib"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\System\CurrentControlSet\Services\Eventlog\Application\ESENT]
"CategoryMessageFile" = "%System%\ESENT.dll"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil]
"LogSessionName" = "stdout"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil\traceIdentifier]
"BitNames" = " Error Unusual Info Debug"

[HKCR\AmiBs.Installer\CurVer]
"(Default)" = "AmiBs.Installer.1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil]
"ControlFlags" = "1"

[HKCR\Interface\{D54C859C-6066-4F31-8FE0-2AAEDCAE67D7}\ProxyStubClsid]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

[HKLM\SOFTWARE\Microsoft\ESENT\Process\Uniblue__3607_il4231915\DEBUG]
"Trace Level"

The process %original file name%.exe:320 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "31 BF 47 FE 14 2E D6 87 0D E0 6A 14 4C 89 19 E5"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"wextract_cleanup0" = "rundll32.exe %System%\advpack.dll,DelNodeRunDLL32 C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\IXP000.TMP\"

Dropped PE files

MD5	File path
be27246c78bb8ff6aa4e29b016969889	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\IXP000.TMP\Uniblue__3607_il4231915.exe
480a104a2068a79900f32840fab2f0ab	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\IXP000.TMP\driverscanner.exe
be27246c78bb8ff6aa4e29b016969889	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\Uniblue__3607_il4231915.exe

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

Removals

Remove it with Ad-Aware

1. Click (here) to download and install Ad-Aware Free Antivirus.
2. Update the definition files.
3. Run a full scan of your computer.

Manual removal*

1. Terminate malicious process(es) (How to End a Process With the Task Manager):

   %original file name%.exe:320

2. Delete the original Trojan file.
   
3. Delete or disinfect the following files created/modified by the Trojan:

   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\6NIVM3W5\cancel[1].gif (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\6NIVM3W5\desktop.ini (67 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\Uniblue__3607_il4231915.exe (673 bytes)
   %Documents and Settings%\%current user%\Local Settings\History\History.IE5\desktop.ini (159 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\ami1.tmp.ico (766 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\ANMTEH4P\cancel1[1].gif (2 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\GLQJKPMN\decline[1].gif (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\GLQJKPMN\footer_img[1].png (937 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\6NIVM3W5\next[1].gif (2 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\GLQJKPMN\desktop.ini (67 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\U72V39E8\install[1].gif (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\ANMTEH4P\main[1].css (769 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\U72V39E8\desktop.ini (67 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\ANMTEH4P\desktop.ini (67 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\ANMTEH4P\accept[1].gif (967 bytes)
   %Documents and Settings%\%current user%\Desktop\Continue installation - %appname% Installation.lnk (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\amipixel.cfg (31 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\6NIVM3W5\index[1].htm (9577 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\U72V39E8\skip[1].gif (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\U72V39E8\amipb[1].js (30276 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\IXP000.TMP\Uniblue__3607_il4231915.exe (3165 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\IXP000.TMP\driverscanner.exe (87403 bytes)

4. Delete the following value(s) in the autorun key (How to Work with System Registry):

   [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
   "wextract_cleanup0" = "rundll32.exe %System%\advpack.dll,DelNodeRunDLL32 C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\IXP000.TMP\"

5. Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
   
6. Reboot the computer.
   

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

VersionInfo

Company Name: Uniblue
Product Name: DriverScanner
Product Version: 6.00.2900.5512
Legal Copyright: Uniblue Systems Ltd (c)All rights reserved.
Legal Trademarks:
Original Filename:
Internal Name:
File Version: 4.0.12.2 (xpsp.080413-2105)
File Description: DriverScanner Setup
Comments:
Language: English (United Kingdom)

Company Name: UniblueProduct Name: DriverScannerProduct Version: 6.00.2900.5512Legal Copyright: Uniblue Systems Ltd (c)All rights reserved.Legal Trademarks: Original Filename: Internal Name: File Version: 4.0.12.2 (xpsp.080413-2105)File Description: DriverScanner Setup Comments: Language: English (United Kingdom)

PE Sections

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Section MD5
.text	4096	39368	39424	4.55933	fd7744c26c2bf4d279968be94b283b11
.data	45056	7140	1024	2.94449	99858e86526942a66950c7139f78a725
.rsrc	53248	5701596	5701632	5.50195	b03d6b12483e21b5787cdd4036722c1d

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Network Activity

URLs

URL	IP
hxxp://ils-front-balancer3-264552681.us-east-1.elb.amazonaws.com/index.php
hxxp://d3a3s75zr23wnc.cloudfront.net/f2958b2a-7357-4f94-a6f3-865aafa6e1c6/main.css
hxxp://dyno3mlj15jgv.cloudfront.net/V9/amipb.js
hxxp://d3a3s75zr23wnc.cloudfront.net/f2958b2a-7357-4f94-a6f3-865aafa6e1c6/footer_img.png
hxxp://d3a3s75zr23wnc.cloudfront.net/f2958b2a-7357-4f94-a6f3-865aafa6e1c6/cancel.gif
hxxp://d3a3s75zr23wnc.cloudfront.net/f2958b2a-7357-4f94-a6f3-865aafa6e1c6/cancel1.gif
hxxp://d3a3s75zr23wnc.cloudfront.net/f2958b2a-7357-4f94-a6f3-865aafa6e1c6/skip.gif
hxxp://d3a3s75zr23wnc.cloudfront.net/f2958b2a-7357-4f94-a6f3-865aafa6e1c6/decline.gif
hxxp://d3a3s75zr23wnc.cloudfront.net/f2958b2a-7357-4f94-a6f3-865aafa6e1c6/next.gif
hxxp://d3a3s75zr23wnc.cloudfront.net/f2958b2a-7357-4f94-a6f3-865aafa6e1c6/accept.gif
hxxp://d3a3s75zr23wnc.cloudfront.net/f2958b2a-7357-4f94-a6f3-865aafa6e1c6/install.gif
hxxp://ils-front-balancer3-264552681.us-east-1.elb.amazonaws.com/finalize.php
hxxp://ils-front-balancer3-264552681.us-east-1.elb.amazonaws.com/Html/40e838de-4611-4759-87df-ec18301b0aa7/%appimageurl%
hxxp://cdn2.promptdownload.com/f2958b2a-7357-4f94-a6f3-865aafa6e1c6/cancel1.gif	54.192.47.24
hxxp://cdn1.promptdownload.com/V9/amipb.js	54.230.46.69
hxxp://cdn2.promptdownload.com/f2958b2a-7357-4f94-a6f3-865aafa6e1c6/next.gif	54.192.47.24
hxxp://cdn2.promptdownload.com/f2958b2a-7357-4f94-a6f3-865aafa6e1c6/accept.gif	54.192.47.24
hxxp://cdn2.promptdownload.com/f2958b2a-7357-4f94-a6f3-865aafa6e1c6/skip.gif	54.192.47.24
hxxp://cdn2.promptdownload.com/f2958b2a-7357-4f94-a6f3-865aafa6e1c6/decline.gif	54.192.47.24
hxxp://cdn2.promptdownload.com/f2958b2a-7357-4f94-a6f3-865aafa6e1c6/footer_img.png	54.192.47.24
hxxp://www.keenondownload.com/Html/40e838de-4611-4759-87df-ec18301b0aa7/%appimageurl%	23.21.228.251
hxxp://cdn2.promptdownload.com/f2958b2a-7357-4f94-a6f3-865aafa6e1c6/cancel.gif	54.192.47.24
hxxp://www.keenondownload.com/index.php	23.21.228.251
hxxp://cdn2.promptdownload.com/f2958b2a-7357-4f94-a6f3-865aafa6e1c6/install.gif	54.192.47.24
hxxp://www.keenondownload.com/finalize.php	23.21.228.251
hxxp://cdn2.promptdownload.com/f2958b2a-7357-4f94-a6f3-865aafa6e1c6/main.css	54.192.47.24

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

GET /f2958b2a-7357-4f94-a6f3-865aafa6e1c6/cancel1.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.keenondownload.com/index.php

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: cdn2.promptdownload.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Type: image/gif

Content-Length: 2881

Connection: keep-alive

Date: Thu, 23 Oct 2014 15:23:57 GMT

Content-Disposition: attachment; filename="cancel1.gif"

Last-Modified: Thu, 23 Oct 2014 06:08:43 GMT

ETag: "d9f00c86bfa3e08e905128b131229fac"

Accept-Ranges: bytes

Server: AmazonS3

Age: 23528

X-Cache: Hit from cloudfront

Via: 1.1 efbf3c8a99d39ecf2b926d3c4a537082.cloudfront.net (CloudFront)

X-Amz-Cf-Id: i9CWNWKfIE-Ih4CMZ5GfSawwBK14ywKQnHw2K2kKmp0LiMm0VjAydQ==

GIF89ae......@.H*.-<.AC.K=.F>.H'. ;.B,./=.E)./)..@.I=.D=.D?.GC.M>.DC.IC.K'.,@.H>.F:.A*./D.LC.M?.HB.L=.G;.A9.@:.C .-;.CuuuB.K(.)>.G)..<.C). @.I>.E...>.G,. ). &. <.E*.&%.*6.C-.3-.33.7).1&.)www(.-*. .../.54.?-.4=.B...!.().0...-.7...G.I..9-.35.7?.F'.0A.O-..,.5<.B>.J ..D.I5.:..5=.GE.K/.0-.-/.2?.=,.7*. ;.B/.4 .'C.I..79.B&.2 .,<.>".*-.0?.C-.-8.>-.&'.12.4:.AC.B1.7-.4..$'. 3.8Q.\<.A<.G4.9 .05.<C.F6.;;.I@.I".%;.B>.Q*.-0.5&.<9.?'.-#.) .6:.A ./..31.57.>4.96.>0.76.<&.)2.78.?-.2-.3ppp..................................................................................................................................................................................................................................................................................................................!..XMP DataXMP<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)" xmpMM:InstanceID="xmp.iid:5653313B52CD11E48302D8AFAF09E831" xmpMM:DocumentID="xmp.did:5653313C52CD11E48302D8AFAF09E831"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:5653313952CD11E48302D8AFAF

<<< skipped >>>

GET /f2958b2a-7357-4f94-a6f3-865aafa6e1c6/decline.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.keenondownload.com/index.php

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: cdn2.promptdownload.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Type: image/gif

Content-Length: 1293

Connection: keep-alive

Date: Thu, 23 Oct 2014 15:23:57 GMT

Content-Disposition: attachment; filename="decline.gif"

Last-Modified: Thu, 23 Oct 2014 06:08:43 GMT

ETag: "137a96f0655570ffdf65ae14dad52404"

Accept-Ranges: bytes

Server: AmazonS3

Age: 21428

X-Cache: Hit from cloudfront

Via: 1.1 efbf3c8a99d39ecf2b926d3c4a537082.cloudfront.net (CloudFront)

X-Amz-Cf-Id: 2DsPSfFNuh4UVBsHcZ2wrHCekBrb8bkqHRYb69cDDFnH_8DDU9xh0A==

GIF89ae......................................................................................................................................................................................................................................................................................................................................................................................................!.....t.,....e........ns.............n..mB.............FBm.s.C.............AB.DE.............DDI.GGF.............G.I.........(.....HJ.LML..........%....8...z.J.\..a.%N.5qB......8...F......H..F...$)..e.&P.A.I....37>......Ax..JT.N%D..\....)..H.J..U...H..u...[.... ..&/H.{!%.V.m...X0...)Se.......W.P!D.J.... ^.a@..T..(.........B.E....4.<Z4..-2..r....7L.....m*W.Y..........Nc...<.x..a.....Do..........;........{......_.>.. ..3(p....W._9p........{.........z... {[.....Vh...F0@..vX..Y.....D.E..v.!. f.".%j...#bh#._....[....@.)..@.1..[.....L2YD...I..C.X...H@..M2.D.`.....|...h....^.0@.pv.D..`...S.........o....z....7......9.!b.!...Vji. .... ....`<A'..f...T....=......:....0A.[$0@.>......{....a...&.....8@........a...&`...6.l.bP0....;n._. B...@.....l...a.......d......,....k......!h4....G....Wl.j..g....w.q.g.2..$.l..(....,....0..s.4..r......<....6.-t.?.m4.l.<G.o....PG-..TWM..M[...P....X...$d.m..g..@ .;....

<<< skipped >>>

GET /f2958b2a-7357-4f94-a6f3-865aafa6e1c6/accept.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.keenondownload.com/index.php

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: cdn2.promptdownload.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Type: image/gif

Content-Length: 3033

Connection: keep-alive

Date: Thu, 23 Oct 2014 15:23:57 GMT

Content-Disposition: attachment; filename="accept.gif"

Last-Modified: Thu, 23 Oct 2014 06:08:42 GMT

ETag: "3484f982bbd281ea323f9dedb47098ed"

Accept-Ranges: bytes

Server: AmazonS3

Age: 73469

X-Cache: Hit from cloudfront

Via: 1.1 efbf3c8a99d39ecf2b926d3c4a537082.cloudfront.net (CloudFront)

X-Amz-Cf-Id: y0JuWii9T_09Gn8MLvJCwOZ8ysXps0YMs-2Q88QgxlIT7xUIKOwG6g==

GIF89ae...............!.(:.AhxjC.M..%...C.E...?.G...gvh*. *./*.3guhwww?.H<.E>.E&.) .->.G;.Appp.....3-.3,./-.2*.-=.E@.H<.A)..@.IC.K'. =.D8.?:.A7.>6.<2.74.91.50.76.>..................C.K...}..o.t ./...............'.,^.d......L.R~..uuu...............J.N...<.C...H.KL.P..................[._&. ...........................|.~......(.-...4.?k.oB.KG.M?.G...[.^;.C...|.....y.}...a.f......;.B...Y.^...j.m.........I.M......?.B>.D............M.Q...........9<.?... .5o.s1.8(.,A.K......C.I%.*..2?.Hgug).1E.Kn.o@.I-.4E.I>.F=.D6.;...'.)*.(*./-.-?.=-..:.C../<.C...5.<=.B?.C...9.@9.A:.A,.2;.B;.BQ.\...O.Tkyl/.3\._8.>'.-/.2>.F?.P<.F*.&-.34.9(.,@.I .....)./=.D3.8&.<C.K#.*C.J .,~.. .&...#.&(.) .2,.3=.F,.5(./...{.}...=.E&.*Y.\-.39.B{.|.........hwi). iyjjzk-.2^.b>.J&.,q.ul.pm.pn.q...M.R......<.A......!..XMP DataXMP<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:325014833434E411B829A1185F1C216E" xmpMM:DocumentID="xmp.did:D165859F343611E4B378E2150F88781F" xmpMM:InstanceID="xmp.iid:D165859E343611E4B378E2150F88781F" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)"> <xmpMM:Deriv

<<< skipped >>>

GET /V9/amipb.js HTTP/1.1

Accept: */*

Referer: hXXp://VVV.keenondownload.com/index.php

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: cdn1.promptdownload.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Type: application/x-javascript

Content-Length: 47172

Connection: keep-alive

Date: Wed, 03 Dec 2014 08:54:47 GMT

Last-Modified: Wed, 03 Dec 2014 08:50:14 GMT

ETag: "8a6685288514d601ec6b4eac9fc01b65"

Accept-Ranges: bytes

Server: AmazonS3

Age: 54856

X-Cache: Hit from cloudfront

Via: 1.1 a70588b1afbbe21656319d2e73052366.cloudfront.net (CloudFront)

X-Amz-Cf-Id: zMf9nWi-A0ZdjAUnIIFVLvq3Xtsw2imDRUZtx5Q3WYo-TVknefVNGg==

//<!-- ../* Progress bar */..var g_AmiPbs = new Array();..var g_AmiPbsEx = new Array();..function LogMessage(message)..{.. try.. {.. g_ami.Log(message);.. }.. catch (excpt) { }..}..function AmiPbDelayedCheck(id) {.. var that = g_AmiPbs[id];.. // LogMessage('AmiPbDelayedCheck id: ' id); .. if (that && that.periodicCheck) that.periodicCheck();..}..function AmiPbDelayedCheckEx(id) {.. var that = g_AmiPbsEx[id];.. // LogMessage('AmiPbDelayedCheckEx id: ' id); .. if (that && that.periodicCheck) .. that.periodicCheck();..}....function InitPbEx() { .. LogMessage('InitPbEx function started'); .. var progress = new AmiPbEx(); .. progress.start(function () { .. var p = g_ami.InstallProgress; .. var pp = g_ami.PartialInstallProgress; .. if(pp < 100).. this.set();.. .. /// LogMessage('InitPbEx progress.start p=' p ' pp=' pp );.. .. if (p){.. for (var j = 0; j < g_comps.length; j ) {.. if (g_comps[j].id > 0 && g_comps[j].sel == 1) {.. pp = g_ami.GetDownloadStatus(g_comps[j].id);.. p = (pp == 7 || pp >= ((g_comps[j].mode & 0x0800) ? 9 : 8));.. if (p) {.. var k = 0;.. try{.. k = g_comps[j].testa();.. }.. catch(err).. {..

<<< skipped >>>

GET /f2958b2a-7357-4f94-a6f3-865aafa6e1c6/main.css HTTP/1.1

Accept: */*

Referer: hXXp://VVV.keenondownload.com/index.php

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: cdn2.promptdownload.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Type: text/css

Content-Length: 8109

Connection: keep-alive

Date: Thu, 23 Oct 2014 15:23:56 GMT

Content-Disposition: attachment; filename="main.css"

Last-Modified: Thu, 23 Oct 2014 06:08:44 GMT

ETag: "0b493735a117781fe1d7f5b1a0b1e355"

Accept-Ranges: bytes

Server: AmazonS3

Age: 54028

X-Cache: Hit from cloudfront

Via: 1.1 efbf3c8a99d39ecf2b926d3c4a537082.cloudfront.net (CloudFront)

X-Amz-Cf-Id: uNqfmrzkwoA6nLIrY4YHh_20wTMZCBq8tMN7_qiT1P20WOP4Cx9YIA==

body {. font-size:10px;. background:#eaeaea;. font-family: verdana;. margin: 0;. padding: 0;. color:#000000; .}.div, span, textarea {. cursor: default;.}.a, a span, a div {. cursor: pointer;.}../* whole screen stules */...ami-wrapper{. background : none no-repeat scroll 0 0 #eaeaea;. border:2px solid #989898; .}../* moddle element */..#ami-body.{. padding-left:27;. padding-right:27;.}...bottom-line{. background-color:#5cafd4;. height:45px;. width:100%;.}.table {. border-collapse: collapse;. margin: 0 ;. padding: 0;. font-size:10px;.}..textarea {..font-size:10px;..font-family: verdana;..width:98%;..padding: 5px;.}...textarea1{. background:#ffffff;. color:#000000;. height:100%;. width:100%;. overflow-x:hidden;.}..td{. padding: 0px;.}../* footer and footer buttons */...bottom-holder{. background-image:url('footer_img.png');. background-repeat:repeat-x;. height:59px;. position:absolute;. bottom:0px;. padding-left:20px;. padding-right:20px;.}...#btnNext{.background: url('next.gif') no-repeat;.}..#btnCancel{.background: url('cancel.gif') no-repeat;.}../* Use for cancle with no popup !!! */.#btnBack{.background: url('cancel1.gif') no-repeat;.}..#btnDecline{.background: url('decline.gif') no-repeat;.}..#btnAccept{.background: url('accept.gif') no-repeat;.}..#btnSkip{.background: url('skip.gif') no-repeat;.}..#btnInstall{.background: url('install.gif') no-repeat;.}....left-bottom-button-holder,.right-bottom-butt

<<< skipped >>>

GET /f2958b2a-7357-4f94-a6f3-865aafa6e1c6/footer_img.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.keenondownload.com/index.php

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: cdn2.promptdownload.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Type: image/png

Content-Length: 937

Connection: keep-alive

Date: Thu, 23 Oct 2014 15:23:57 GMT

Content-Disposition: attachment; filename="footer_img.png"

Last-Modified: Thu, 23 Oct 2014 06:08:43 GMT

ETag: "e2bf2d203887961a2e93c1a68b7e7534"

Accept-Ranges: bytes

Server: AmazonS3

Age: 54023

X-Cache: Hit from cloudfront

Via: 1.1 efbf3c8a99d39ecf2b926d3c4a537082.cloudfront.net (CloudFront)

X-Amz-Cf-Id: 24VsXY6m7g4GSEp-uxIMbTFX-_rgG1n6FOzomFnB6z1rVKZ5OmwghQ==

.PNG........IHDR.......;........B....tEXtSoftware.Adobe ImageReadyq.e<...!iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c021 79.154911, 2013/10/29-11:47:16 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC (Windows)" xmpMM:InstanceID="xmp.iid:E57C9F23EFB911E397DFE4EB8E55B910" xmpMM:DocumentID="xmp.did:E57C9F24EFB911E397DFE4EB8E55B910"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:E57C9F21EFB911E397DFE4EB8E55B910" stRef:documentID="xmp.did:E57C9F22EFB911E397DFE4EB8E55B910"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>........IDATx.b.y........g...?.(....0.....N.]l....IEND.B`.....

GET /f2958b2a-7357-4f94-a6f3-865aafa6e1c6/cancel.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.keenondownload.com/index.php

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: cdn2.promptdownload.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Type: image/gif

Content-Length: 1262

Connection: keep-alive

Date: Thu, 23 Oct 2014 15:23:57 GMT

Content-Disposition: attachment; filename="cancel.gif"

Last-Modified: Thu, 23 Oct 2014 06:08:43 GMT

ETag: "d92b8cccf7616d9e5f6162571dd3e1e8"

Accept-Ranges: bytes

Server: AmazonS3

Age: 22993

X-Cache: Hit from cloudfront

Via: 1.1 efbf3c8a99d39ecf2b926d3c4a537082.cloudfront.net (CloudFront)

X-Amz-Cf-Id: kzLN0Eu2gd4BHZZcxDx_pb88R1XJHl-QsZuxVWAtd0BJxjX9ZiEg1A==

GIF89ae......................................................................................................................................................................................................................................................................................................................................................................................................!.....u.,....e........ot.............o..nC.............GCn.t.D.............BC.EF.............EEJ.HHG.............H.J............*..IK.MNM......8.....H..H.`....*....!'O"J.H..D%....P.... C..8......D!.....0c.......4s.....O.....I.h.(S.QY.....K....c...Vg,.......f. 0.k... \..b.. L..@.J...)U.U.b......W.0......t..a.....7..7..."pt.<`...}/..M.o.,...^......_...`...MT.8p.........Z..../.^...j:Y.K.N.zt,,.`...;.)&.h.>....X4.p...z...D. ............................... }.J0...&x...f...-......AH.]pa..(..".A....=.(....p....X#...0#.5. ..A....H&ib.......PF).._x.E...`..^.0...n9..[z........".P..P.@..t..$...!..|....b..F.. ....$.....`....!g.6.j..?..A.[....?t............!d..........v....%.A.c.P@. .0..c.P..cT0@. .. ...P.... ......!gt......m...k..........n.f.AH...k...............p..../.......7.....!...Wl.K..c....C..!l.,..$..r.(....,.<r.".!..n.l..8....<....=.-..o....t....L7...s....;....

<<< skipped >>>

GET /f2958b2a-7357-4f94-a6f3-865aafa6e1c6/skip.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.keenondownload.com/index.php

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: cdn2.promptdownload.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Type: image/gif

Content-Length: 1740

Connection: keep-alive

Date: Thu, 23 Oct 2014 15:23:57 GMT

Content-Disposition: attachment; filename="skip.gif"

Last-Modified: Thu, 23 Oct 2014 06:08:44 GMT

ETag: "7c96892b1948a6e97494e2d58cafe1c0"

Accept-Ranges: bytes

Server: AmazonS3

Age: 19039

X-Cache: Hit from cloudfront

Via: 1.1 efbf3c8a99d39ecf2b926d3c4a537082.cloudfront.net (CloudFront)

X-Amz-Cf-Id: FYgROQzQ8ZZWOMIf-TOLxkJI19S3iBy5H4UHvV9wjisn2N5byKn47w==

GIF89ae......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................!.......,....e........|"E......*\......?...)....3j...... Cb.....R...\.....0c..I.&K8q........@...J....>...C...:P.J.J.*U.X.:......`...C....h....'...d..= W...x...Cp..=....L..`>}...Q...>b.....N.3~.k..y..>....M.....I...CB..1R......?....1.P............. _.\. :.f..$...@*@..$h. @y....$(P.A..._..O .....O.>.Ct..Idh. B.\.. ..........f.!D.0..D..Uha}..B.!..... .(.....H...Q."..b..! ...[..../4...Vxq.......D.9"!.....L6...O&....L........C... ......ta...$ D./ ...p:YH...h..x.......F....."/<A...0.. .x........J..D......z2B."..*....jj#.(.F.d8....|...#......t..!.$..........[*$.5..#.6....F.l#.0..#%....p...".........!.4.I...R.....m$.A............".T..%.pPC./.@....P.".......!.%......v.1...4.$$.l..(.lr%}HQ..f@.. .`..$..`...l0.'6T@..?.........*cB.%PG-..TW

<<< skipped >>>

GET /f2958b2a-7357-4f94-a6f3-865aafa6e1c6/next.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.keenondownload.com/index.php

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: cdn2.promptdownload.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Type: image/gif

Content-Length: 2157

Connection: keep-alive

Date: Thu, 23 Oct 2014 15:23:57 GMT

Content-Disposition: attachment; filename="next.gif"

Last-Modified: Thu, 23 Oct 2014 06:08:43 GMT

ETag: "ba2e9f310f01397a1f41cb6a7ab2e3c9"

Accept-Ranges: bytes

Server: AmazonS3

Age: 54023

X-Cache: Hit from cloudfront

Via: 1.1 efbf3c8a99d39ecf2b926d3c4a537082.cloudfront.net (CloudFront)

X-Amz-Cf-Id: zZt7vcWGmW1HrAKkFDygV4eReVgpLPXgS-bgktqmlXLDZuXirjCk0g==

GIF89ae............pppC.K@.H>.H=.F=.D;.B7.>6.<4.9-.3-.2 ./*.-)./'. ...&.<>.Q..' ., .6&.26.C5.A,.7;.I<.G .*'.1'.0".*$.,,.43.<*.11.9/.8..76.?9.D5.=4.<:.C9.B9.A6.><.E:.B?.I>.G=.G;.C<.D@.I>.F@.I?.H>.GC.MB.LB.K@.IE.OK.RT.\..$..# .%!..)&..%. ".'&.-*.1!.&).1-.5)..&. -.5*.0'.,-.4*.0)..)./(.-'.-0.8,.2'.,)../.6-.4,.1 .1 .1)..0.7-.2,.23.;-.2*./3.9/.42.90.60.50.7..3..5-.24.;1.70.55.<4.;..48.?7.>6.=5.<4.:2.78.?6.=<.B:.A9.@8.?2.7-.3:.A8.?7.=;.B8.><.B<.C;.B;.@7.=@.H>.D>.D=.D:.A>.D:.?C.KC.IC.J8.=D.L?.F3.8?.F<.AE.JD.KF.LB.HA.FD.HN.TK.PP.TX.]a.fe.jn.rx.|~............................................$.('. %.)4.9).,).-*.. .-). .. .-*.--.10.41.5/.22.44.86.:C.HG.IH.L_.b.............................................'.(*.*(.)-../.0-.->.>C.E........................,. .&..................uuu...!.......,....e..........'......*\.........'.....f...i... C...i...Az...qZ.O"Ej...Z..0c....Z...4..8.....|.X.....P..X:5.U.U.j.....v3...Q.......].....p.....F...FM.R....1r..a........A.D.....NL........2...J.[T:p.....H.^....G...IQ..-Z{Z.&].....w....u.O<:<.....G..!pD......g...\.l\.q..'.......H..S...-....Q...lp)....D.......h......>...E..p...i@a!....D..0...\4..<i4..#..XH$...b .0...S.T.!8....<........8...G.f... .."K)S..M l.Q.,....>..RJ.9.QG.9..G..h...;6QP.p.)..t..G..h..?.X.'7V..J<....8....>.$A.>..R.?.."..p.!D ~..G...b...h.B....AA0........ .,......#...~ D<.."H ....,..B.<....8..r."....7.Xc...|.K(#(..................nD.D ....8.(aK>.............

<<< skipped >>>

GET /f2958b2a-7357-4f94-a6f3-865aafa6e1c6/install.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.keenondownload.com/index.php

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: cdn2.promptdownload.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Type: image/gif

Content-Length: 1977

Connection: keep-alive

Date: Thu, 23 Oct 2014 15:23:57 GMT

Content-Disposition: attachment; filename="install.gif"

Last-Modified: Thu, 23 Oct 2014 06:08:43 GMT

ETag: "6f21b0fe1db5314357f4d28b9303fa81"

Accept-Ranges: bytes

Server: AmazonS3

Age: 78945

X-Cache: Hit from cloudfront

Via: 1.1 efbf3c8a99d39ecf2b926d3c4a537082.cloudfront.net (CloudFront)

X-Amz-Cf-Id: DiEibueH_7hnb1V7uIPoNAfPlsM9EGH9_uRlhGWaA0i2EBJLLLhmeA==

GIF89ae...............pppC.K@.H>.H=.F=.D;.B:.A8.?-.3-.2 ./*.-)./'. &.<>.Q..' ., .6&.26.C5.A,.7;.I<.G .*'.1'.0".*$.,,.43.<*.11.9/.8..76.?9.D5.=4.<:.C9.B9.A6.><.E?.I>.G=.G;.C<.D@.I>.F@.I?.H>.GC.MB.LB.K@.IE.OC.KK.RT.\k.q........#!..)%. ".'&.-*.1!.&)..&. -.5*.0*.0'.-0.8'.,)../.6-.4,.1 .1)..0.7-.2,.23.;-.2*.//.42.90.60.50.7..3..5-.24.;1.70.55.<4.;..46.=5.<4.:2.78.?4.9<.B:.A9.@7.>6.<2.7-.38.?;.B8.><.B<.C;.@;.B>.D>.D=.D>.DC.KC.IC.JD.L?.F3.8?.F<.AE.J;.@>.DD.KC.IH.NB.HA.FQ.WO.SP.TX.]W.[a.fe.jk.on.rx.}y.}s.v~..........................................................................$.('. %.)4.9).,).- .-). .. .-*.--.10.41.5/.22.44.86.:C.HG.I@.D_.bv.y.............................................'.(*.*(.)-../.0-.->.>C.E.................................,. .&............uuu.........!.......,....e..........7......*\.........'p....b. ..... C...(...?v.{....E"E"....:.0c...........8sG...x.X.....P..X:5...U.j.jc.$u3...1.E.....].....p....v.... I.RpD..0n .q...... ^.x.......<....:|....PA... .d(.!...........[.F-.]...c....u!F:8.:.. .@..$.t'....VC.N.z....;...{w............hP).g. ...(.O_........N?.........W...$g ~t`.G:-@Q...Th....#...vh...xx.......'V...pX.F..f...4..DAy....;j.....b......$..."&.....y .!<...c......[..F......yx2..%....<..f......t.Y..t.........C.IK>D.R..@..g(....-.."@ s.9g. d...Wl..6.. . .....z.a.......z..*....#....CI....K.Y..G....K<...k<r4.l.cL..:..1.'........-...T....[...fY..ux#@6...O..pc....;n.k....kD..*.........3s.....&Q...

<<< skipped >>>

POST /index.php HTTP/1.1

Accept: */*

Accept-Language: en-us

Content-Type: application/x-www-form-urlencoded

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.keenondownload.com

Content-Length: 266

Connection: Keep-Alive

Cache-Control: no-cache

Net1.1=&Net2=3.5.21022.08&Net4=4.0.30319&OSversion=NT5.1SP3&Slv=&Sysid=975F29BE8C8FD0BC5E8EBA2BBF1B629F&Sysid1=975F29BE8C8FD0BC5E8EBA2BBF1B629F&X64=N&admin=Y&browser=IEXPLORE.EXE&chver=&exe=Uniblue__3607_il4231915&ffver=&lang_DfltUser=0409&ver=1.1.5.98&ts=1417911227

HTTP/1.1 200 OK

Content-Type: text/html; charset=UTF-8

Date: Sun, 07 Dec 2014 00:13:47 GMT

Server: Apache/2.2.15 (Red Hat)

X-Powered-By: PHP/5.3.3

transfer-encoding: chunked

Connection: keep-alive

1b79.... ..<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">..<html>..<head>..<meta http-equiv="content-type" content="text/html; charset=UTF-8" /> ..<title>%appname% Installation</title>..<base href="hXXp://VVV.keenondownload.com:80/index.php" />..<link rel="stylesheet" type="text/css" href="hXXp://cdn2.promptdownload.com/f2958b2a-7357-4f94-a6f3-865aafa6e1c6/main.css" /><script type="text/javascript" src="hXXp://cdn1.promptdownload.com/V9/amipb.js"></script>..<script type="text/javascript">..var g_amiobj = '', g_ami, g_updb = false;..var g_eula = 'VGhlIGRvd25sb2FkIGFuZCBpbnN0YWxsYXRpb24gcHJvY2VzcyBvZiB0aGlzIGZpbGUgaXMgcnVuIGJ5IEluc3RhbGxQYXRoIEluc3RhbGwgTWFuYWdlci4KQnkgY2xpY2tpbmcgdGhlICJBY2NlcHQiIG9yICJOZXh0IiBidXR0b25zIGJlbG93LCBvciBieSBjb250aW51aW5nIHRoaXMgSW5zdGFsbFBhdGggSW5zdGFsbCBNYW5hZ2VyIGluc3RhbGxhdGlvbiwgb3Igb3RoZXJ3aXNlIHVzaW5nIHRoZSBTb2Z0d2FyZSwgeW91IGFncmVlIHRvIGJlIGJvdW5kIGJ5IHRoZSB0ZXJtcyBvZiBJbnN0YWxsUGF0aCBJbnN0YWxsIE1hbmFnZXIgRVVMQSAoRW5kIFVzZXIgTGljZW5zZSBhZ3JlZW1lbnQpIGxvYWN0ZWQgYXQgaHR0cDovL3d3dy5pbnN0YWxscGF0aC5jb20vZXVsYS5odG1sLCBpdHMgUHJpdmFjeSBQb2xpY3kgKGh0dHA6Ly93d3cuaW5zdGFsbHBhdGguY29tL3ByaXZhY3kuaHRtbCkgYW5kIFRlcm1zIG9mIFNlcnZpY2UgKGh0dHA6Ly93d3cuaW5zdGFsbHBhdGguY29tL3Rlcm1zLmh0bWwpLiBGb3IgYW55IGFkZGl0aW9uYWwgaW5mb3JtYXRpb24gb24gSW5zdGFsbFBhdGggSW5zdGFsbCBNYW5hZ2VyIHlvdSBjYW4gdmlzaXQgSW5zdGFsbFBhdGgncyB3ZWJzaXRlIGF0IHd3dy5JbnN0YWxsUGF0aC5jb20gLgoKSW5zdGFsbFBhdGggSW5zdGFsbCBNYW5hZ2VyIGRvZXMgbm90IGhh

<<< skipped >>>

POST /finalize.php HTTP/1.1

Accept: */*

Accept-Language: en-us

Referer: hXXp://VVV.keenondownload.com/index.php

Content-Type: application/x-www-form-urlencoded

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.keenondownload.com

Content-Length: 273

Connection: Keep-Alive

Cache-Control: no-cache

_hdn=0&_ver=1.1.5.98&_p=1&_s=20&_cc=UA&_cid=3607&_psb=0&_cnt=40233f31fbd1d7df7ef09b76f1ea9a2b&_instid=&_brw=ie&_fc=0&_appname=&_appimageurl=&_netfs=0&_vert=0&r_DownloadManager=0&r_updater=0.01&r_NetFilter=0.01&r_Yontoo17=1&DownloadManager=3&updater=2&NetFilter=0&Yontoo17=1

HTTP/1.1 200 OK

Content-Type: text/xml

Date: Sun, 07 Dec 2014 00:13:49 GMT

Server: Apache/2.2.15 (Red Hat)

X-Powered-By: PHP/5.3.3

Content-Length: 5327

Connection: keep-alive

....<Array><page><f>1</f><fb>1</fb><pt>0</pt><cats>0</cats><updh>1</updh><wrn></wrn><comps>DownloadManager</comps><bdy>CgoJPGRpdiBzdHlsZT0id2lkdGg6IDEwMCU7IGhlaWdodDogODVweDsgYm9yZGVyLWJvdHRvbS13aWR0aDogMXB4OyBib3JkZXItYm90dG9tLXN0eWxlOiBzb2xpZDsgYm9yZGVyLWJvdHRvbS1jb2xvcjogcmdiKDE3MCwgMTcwLCAxNzApOyBtYXJnaW4tdG9wOiAwcHgiPgoJPGltZyBzcmM9Ikh0bWwvNDBlODM4ZGUtNDYxMS00NzU5LTg3ZGYtZWMxODMwMWIwYWE3LyVhcHBpbWFnZXVybCUiIHN0eWxlPSJ3aWR0aDogNzVweDsgaGVpZ2h0OiA3NXB4OyBmbG9hdDogbGVmdDsgZGlzcGxheTogYmxvY2s7IG1hcmdpbjogMTBweCIgLz4mbmJzcDsmbmJzcDsKCTxwIHN0eWxlPSJwYWRkaW5nOiA1cHg7IHRleHQtYWxpZ246IGxlZnQ7IGZvbnQtc2l6ZTogMTdweCI CjxzcGFuIHN0eWxlPSJmb250LXNpemU6IDE3cHg7IHRleHQtYWxpZ246IGxlZnQiPkRvd25sb2FkICZhbXA7IEluc3RhbGwgPGI JWFwcG5hbWUlPC9iPiBmb3IgRlJFRTwvc3Bhbj4KICA8L3A CjwvZGl2Pgo8ZGl2IGlkPSJkX2FtaV9Eb3dubG9hZE1hbmFnZXIiIHN0eWxlPSJoZWlnaHQ6IDEzMHB4Ij4gCjxiciAvPgo8cCBzdHlsZT0iZm9udC1zaXplOiAxM3B4OyB0ZXh0LWFsaWduOiBjZW50ZXI7IHBhZGRpbmc6IDBweCI PGI Q2xpY2sgTmV4dCBvciBJbnN0YWxsIGJlbG93IHRvIGJlZ2luIHlvdXIgaW5zdGFsbGF0aW9uLjwvYj48L3A Cgk8ZGl2IGRhdGEtYWRqdXN0LWhlaWdodD0iMCIgaWQ9Im1pZGRsZSIgc3R5bGU9IndpZHRoOiAxMDAlOyBwYWRkaW5nOiAwcHg7IGhlaWdodDogMTEwcHg7IG1hcmdpbi10b3A6IDBweCI CgkKCQk8dGV4dGFyZWEgc3BlbGxjaGVjaz0iZmFsc2UiIGNsYXNzPSJ0ZXh0YXJlYTEiIGlkPSJhbWlfZXVsYV9Eb3dubG9hZE1hbmFnZXIiIHJlYWRvbmx5PSJyZWFkb25seSI CQkKCQk8L3RleHRhcmVhPgoKCTwvZGl2PgoJPC9kaXY CgoJPGlucHV0IGlkPSJpX2FtaV9Eb3dubG9hZE1hbmFnZXIiIHR5cGU9ImhpZGRlbiIgdmFsdWU9IjE

<<< skipped >>>

GET /Html/40e838de-4611-4759-87df-ec18301b0aa7/%appimageurl% HTTP/1.1

Accept: */*

Referer: hXXp://VVV.keenondownload.com/index.php

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.keenondownload.com

Connection: Keep-Alive

HTTP/1.1 400 Bad Request

Content-Type: text/html; charset=iso-8859-1

Date: Sun, 07 Dec 2014 00:13:50 GMT

Server: Apache/2.2.15 (Red Hat)

Content-Length: 315

Connection: keep-alive

<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">.<html><head>.<title>400 Bad Request</title>.</head><body>.<h1>Bad Request</h1>.<p>Your browser sent a request that this server could not understand.<br />.</p>.<hr>.<address>Apache/2.2.15 (Red Hat) Server at VVV.keenondownload.com Port 80</address>.</body></html>.HTTP/1.1 400 Bad Request..Content-Type: text/html; charset=iso-8859-1..Date: Sun, 07 Dec 2014 00:13:50 GMT..Server: Apache/2.2.15 (Red Hat)..Content-Length: 315..Connection: keep-alive..<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">.<html><head>.<title>400 Bad Request</title>.</head><body>.<h1>Bad Request</h1>.<p>Your browser sent a request that this server could not understand.<br />.</p>.<hr>.<address>Apache/2.2.15 (Red Hat) Server at VVV.keenondownload.com Port 80</address>.</body></html>...

GET /Html/40e838de-4611-4759-87df-ec18301b0aa7/%appimageurl% HTTP/1.1

Accept: */*

Referer: hXXp://VVV.keenondownload.com/index.php

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.keenondownload.com

Connection: Keep-Alive

HTTP/1.1 400 Bad Request

Content-Type: text/html; charset=iso-8859-1

Date: Sun, 07 Dec 2014 00:13:50 GMT

Server: Apache/2.2.15 (Red Hat)

Content-Length: 315

Connection: keep-alive

<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">.<html><head>.<title>400 Bad Request</title>.</head><body>.<h1>Bad Request</h1>.<p>Your browser sent a request that this server could not understand.<br />.</p>.<hr>.<address>Apache/2.2.15 (Red Hat) Server at VVV.keenondownload.com Port 80</address>.</body></html>.HTTP/1.1 400 Bad Request..Content-Type: text/html; charset=iso-8859-1..Date: Sun, 07 Dec 2014 00:13:50 GMT..Server: Apache/2.2.15 (Red Hat)..Content-Length: 315..Connection: keep-alive..<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">.<html><head>.<title>400 Bad Request</title>.</head><body>.<h1>Bad Request</h1>.<p>Your browser sent a request that this server could not understand.<br />.</p>.<hr>.<address>Apache/2.2.15 (Red Hat) Server at VVV.keenondownload.com Port 80</address>.</body></html>...

Map

The Trojan connects to the servers at the folowing location(s):

Strings from Dumps

%original file name%.exe_320:

.text

.text

`.data

`.data

.rsrc

.rsrc

ADVAPI32.dll

ADVAPI32.dll

KERNEL32.dll

KERNEL32.dll

NTDLL.DLL

NTDLL.DLL

GDI32.dll

GDI32.dll

USER32.dll

USER32.dll

COMCTL32.dll

COMCTL32.dll

VERSION.dll

VERSION.dll

advapi32.dll

advapi32.dll

advpack.dll

advpack.dll

wininit.ini

wininit.ini

Software\Microsoft\Windows\CurrentVersion\App Paths

Software\Microsoft\Windows\CurrentVersion\App Paths

setupapi.dll

setupapi.dll

setupx.dll

setupx.dll

IXPd.TMP

IXPd.TMP

TMP4351$.TMP

TMP4351$.TMP

FINISHMSG

FINISHMSG

USRQCMD

USRQCMD

ADMQCMD

ADMQCMD

msdownld.tmp

msdownld.tmp

wextract.pdb

wextract.pdb

PSSSSSSh

PSSSSSSh

RegCloseKey

RegCloseKey

RegOpenKeyExA

RegOpenKeyExA

RegCreateKeyExA

RegCreateKeyExA

RegQueryInfoKeyA

RegQueryInfoKeyA

GetWindowsDirectoryA

GetWindowsDirectoryA

ExitWindowsEx

ExitWindowsEx

MsgWaitForMultipleObjects

MsgWaitForMultipleObjects

rundll32.exe %s,InstallHinfSection %s 128 %s

rundll32.exe %s,InstallHinfSection %s 128 %s

SHELL32.DLL

SHELL32.DLL

Software\Microsoft\Windows\CurrentVersion\RunOnce

Software\Microsoft\Windows\CurrentVersion\RunOnce

PendingFileRenameOperations

PendingFileRenameOperations

System\CurrentControlSet\Control\Session Manager\FileRenameOperations

System\CurrentControlSet\Control\Session Manager\FileRenameOperations

wextract_cleanup%d

wextract_cleanup%d

%s /D:%s

%s /D:%s

rundll32.exe %sadvpack.dll,DelNodeRunDLL32 "%s"

rundll32.exe %sadvpack.dll,DelNodeRunDLL32 "%s"

Command.com /c %s

Command.com /c %s

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\IXP000.TMP\

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\IXP000.TMP\

33333330

33333330

3333333

3333333

33333333

33333333

333333333

333333333

3333338

3333338

66666666

66666666

driverscanner.exe

driverscanner.exe

Uniblue__3607_il4231915.exe

Uniblue__3607_il4231915.exe

T7k.sG

T7k.sG

0.KSul>

0.KSul>

u%S\GFq

u%S\GFq

$%COT

$%COT

.pIC=5^

.pIC=5^

I}UM%D

I}UM%D

#d1%C

#d1%C

bP%sZ

bP%sZ

l;}%x

l;}%x

/%.wX

/%.wX

{w.MX>

{w.MX>

y;.FV

y;.FV

3H.df

3H.df

$.eH3

$.eH3

ssHO/6~

ssHO/6~

.vS?7

.vS?7

}%D>Tv>b

}%D>Tv>b

IW.YX

IW.YX

r~.Uq

r~.Uq

a%UB5]

a%UB5]

XcK.wQ

XcK.wQ

Rj%xH

Rj%xH

p%uVP

p%uVP

lz=_/%S_

lz=_/%S_

.Jg:w

.Jg:w

%SR)(

%SR)(

%d}SALK

%d}SALK

.ShE=

.ShE=

!.th9

!.th9

Y.uB3

Y.uB3

-.djM~

-.djM~

y)%CV

y)%CV

o.Gj}Ar

o.Gj}Ar

FTf.PZ

FTf.PZ

dC.Esw

dC.Esw

P%FkL

P%FkL

.gc(y

.gc(y

J.'%X

J.'%X

A9%Du

A9%Du

c5.wi

c5.wi

p%D/1

p%D/1

$%x:u

$%x:u

%SL2

%SL2

~.kX

~.kX

02.gsuz

02.gsuz

[%2u)

[%2u)

.GFT]

.GFT]

/4.VyH

/4.VyH

G%c#R

G%c#R

Hs.YZ

Hs.YZ

b.Zsea

b.Zsea

P)pSql]

P)pSql]

{&'

{&'

z}C.Tr

z}C.Tr

i.ETP]L

i.ETP]L

T.EJB

T.EJB

e%S84i

e%S84i

/w$DKey

/w$DKey

%d:fV_

%d:fV_

.Fp;

.Fp;

e`A?%d

e`A?%d

[".CW

[".CW

@.NgkR

@.NgkR

vj.MA

vj.MA

ô,@#

ô,@#

4.pS*5h

4.pS*5h

V~.Jr~$

V~.Jr~$

2`V%X

2`V%X

es

es

.mt28

.mt28

o.qyj

o.qyj

h.dMr

h.dMr

$8J%X

$8J%X

^8%dV

^8%dV

UZ.no

UZ.no

kj%X%p1H#

kj%X%p1H#

\.EMv8^

\.EMv8^

.PKji

.PKji

6Å“!

6Å“!

9.Ywf

9.Ywf

q.QnO1

q.QnO1

h8.EC

h8.EC

9k.vvv

9k.vvv

)9.ULM

)9.ULM

EP.ON

EP.ON

.Jt*zUX

.Jt*zUX

2L%s4dL

2L%s4dL

g%xS#

g%xS#

Ii-ke}

Ii-ke}

%x-@^

%x-@^

#.Qv>u

#.Qv>u

_O.nT

_O.nT

;B.VU

;B.VU

M%Sw]

M%Sw]

i%dJr1

i%dJr1

.hKe7V

.hKe7V

.ToN2K?

.ToN2K?

.ad)X=

.ad)X=

.LN@7

.LN@7

pl!%fm

pl!%fm

%c_ro?O

%c_ro?O

/ .oe'I

/ .oe'I

,0|:Ú|L

,0|:Ú|L

.Ug$`Om

.Ug$`Om

.fOJP

.fOJP

znþ}

znþ}

8 .zv0

8 .zv0

.RG,t

.RG,t

YUDpaT

YUDpaT

),ß

),ß

Q%uf/:,

Q%uf/:,

Wq}%UoZ;f

Wq}%UoZ;f

o%sH2c

o%sH2c

%UEqS"

%UEqS"

.JgYtB

.JgYtB

q?.kR

q?.kR

cmDR

cmDR

f.Zs(

f.Zs(

^m.DH

^m.DH

$C5(>p.dd

$C5(>p.dd

:N.De

:N.De

.TEP5

.TEP5

.rO8)

.rO8)

.YmA0

.YmA0

%U8 y

%U8 y

.ZX`@G

.ZX`@G

E#ù

E#ù

$!f

$!f

:B>~Ï

:B>~Ï

"?1*1_) @

"?1*1_) @

.].rHA

.].rHA

=8R%u

=8R%u

.IO>T

.IO>T

r{h%U

r{h%U

.Zi{P

.Zi{P

.uu{

.uu{

BMSgQ

BMSgQ

(W.%CQ

(W.%CQ

P1.TxVc

P1.TxVc

ocmdV

ocmdV

R.et_G

R.et_G

NG.in

NG.in

9)B%Uj

9)B%Uj

=U7

=U7

%F$YA

%F$YA

H.Ho(67

H.Ho(67

?R %s

?R %s

5A.vg

5A.vg

%~.ha

%~.ha

(-l3}

(-l3}

J5%fO

J5%fO

m.LM%

m.LM%

%C|xK

%C|xK

K.DyQ

K.DyQ

ReA.ZO

ReA.ZO

m.Kej

m.Kej

.kt|a

.kt|a

3%fMX

3%fMX

Ec.oWx}

Ec.oWx}

.Zh%3

.Zh%3

QU.Lg

QU.Lg

_e.QX

_e.QX

c3@%d

c3@%d

~e%Xt

~e%Xt

9K.ks-y

9K.ks-y

88%Xpc

88%Xpc

l9/v?.vL#2

l9/v?.vL#2

.HYUqF

.HYUqF

.sXa

.sXa

Wöp

Wöp

)`#-%s

)`#-%s

pL-P}t

pL-P}t

}%stCv

}%stCv

J.nLag*

J.nLag*

)}Ä

)}Ä

.Ra$'

.Ra$'

o^.YG

o^.YG

N;E.DX}$

N;E.DX}$

yln.Jqh

yln.Jqh

.WwA/e

.WwA/e

-lJ%uB

-lJ%uB

w.RE,

w.RE,

=%Un:tAP

=%Un:tAP

%d'Y3

%d'Y3

T.qIJ6

T.qIJ6

m-%dJ

m-%dJ

GE~,g%x

GE~,g%x

\L(,D.vR

\L(,D.vR

\.uY3

\.uY3

fe8%d

fe8%d

}~Q

}~Q

:ut>.DN&

:ut>.DN&

( q"%u

( q"%u

om.cGa

om.cGa

k;%sP

k;%sP

.Uc6&

.Uc6&

.jj"8

.jj"8

T\B%C

T\B%C

.hTyX

.hTyX

.Wvqu

.Wvqu

x%x\n

x%x\n

CI.Lz

CI.Lz

)t;H~%x5I

)t;H~%x5I

.fU_$

.fU_$

.wQnc

.wQnc

r.fEe

r.fEe

E.Td.d

E.Td.d

-v.xe

-v.xe

6Se.NV

6Se.NV

.bxKv

.bxKv

$2-E}

$2-E}

..ljl

..ljl

8^

8^

iZ.Rv

iZ.Rv

!4

!4

}.mvd

}.mvd

%c&7(

%c&7(

AN%F;

AN%F;

.Qo4X

.Qo4X

P7Mb#.yUm

P7Mb#.yUm

4%cq/D~

4%cq/D~

TQ%d

TQ%d

,1q%X{{

,1q%X{{

3AV.nCk

3AV.nCk

)%coH

)%coH

.caDD

.caDD

S.Bj)3x

S.Bj)3x

k\.tys

k\.tys

.woP'e

.woP'e

f%Z%C

f%Z%C

.IMZ8

.IMZ8

.CM4z

.CM4z

5a.JX

5a.JX

E~-b}z

E~-b}z

y%XR"

y%XR"

P/-Cpc}p

P/-Cpc}p

6%DpxEn

6%DpxEn

.Se~FS%

.Se~FS%

.Cr56&l

.Cr56&l

1tCP :

1tCP :

x%d{}

x%d{}

%xyxc

%xyxc

.vJ}JD

.vJ}JD

Å’*LO

Å’*LO

8øC

8øC

.bV)q

.bV)q

Q[W%C>

Q[W%C>

y!.kZ

y!.kZ

18.FV

18.FV

.foSZ

.foSZ

qO%U1A

qO%U1A

.yan~

.yan~

ÛbYp

ÛbYp

.pGq^

.pGq^

s&.Hg

s&.Hg

5%s

5%s

gO

gO

.uL~?

.uL~?

Xe.kN

Xe.kN

g%xDm

g%xDm

fUO.GpW

fUO.GpW

.ic]kEP

.ic]kEP

.hbzc

.hbzc

MF).gUp

MF).gUp

%Ua?05

%Ua?05

PB.Hj

PB.Hj

mjo.MkO

mjo.MkO

9.TL$>

9.TL$>

zvU.UW

zvU.UW

q.ZSXB6

q.ZSXB6

HA.XG

HA.XG

Tr.pfo

Tr.pfo

!%dJ#

!%dJ#

Vq!%c

Vq!%c

lx.gn

lx.gn

SVF.mv

SVF.mv

?-%cLF

?-%cLF

lp{.sR

lp{.sR

X`.pWX

X`.pWX

Csc

Csc

.jz^{

.jz^{

=W!.Ih$

=W!.Ih$

OsqL

OsqL

X.bOt

X.bOt

l.EFo

l.EFo

kt-3X.SJ

kt-3X.SJ

K)3%X

K)3%X

|r%Ft

|r%Ft

.Hczf

.Hczf

`*#%%S

`*#%%S

Pc).VD

Pc).VD

-Q}XG

-Q}XG

a;.Xo

a;.Xo

_N.jR

_N.jR

r%X@!

r%X@!

[.RZ

[.RZ

.MoN7

.MoN7

.Hfn3

.Hfn3

$S]?/.xs,

$S]?/.xs,

%DTuF

%DTuF

;.TP]GK

;.TP]GK

R%S0|

R%S0|

.UyMh

.UyMh

I ol%x

I ol%x

Ar%fq

Ar%fq

.aL

.aL

V80).NYp

V80).NYp

\.QGw[

\.QGw[

@1.zY

@1.zY

-PDr}

-PDr}

.Jg'l

.Jg'l

%c'9c

%c'9c