Gen.Variant.Dox.2_76dada3d14

by malwarelabrobot on May 16th, 2017 in Malware Descriptions.

Gen:Variant.Dox.2 (BitDefender), Trojan:Win32/Xiskace.A!bit (Microsoft), HEUR:Trojan.Win32.Generic (Kaspersky), Win32.MewsSpy.42 (DrWeb), Gen:Variant.Dox.2 (B) (Emsisoft), Generic Obfuscated.g (McAfee), Trojan.Gen.2 (Symantec), Virus.Win32.MewsSpy (Ikarus), Gen:Variant.Dox.2 (FSecure), Win32.Generic.WI (AVG), Win32:Malware-gen (Avast), HT_TDSS_FC280029.UVPM (TrendMicro), Gen:Variant.Dox.2 (AdAware), Installer.Win32.InnoSetup.FD, Installer.Win32.InnoSetup.2.FD, InstallerInnoSetup.YR (Lavasoft MAS)
Behaviour: Trojan, Virus, Installer, Malware


The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.

Requires JavaScript enabled!

Summary
Dynamic Analysis
Static Analysis
Network Activity
Map
Strings from Dumps
Removals

MD5: 76dada3d14c329736ba96e87a85cc18e
SHA1: 658a979603ed359ad190f6072392341c6472fc62
SHA256: 44dc5d5304460f24cd21fc0b8ea855b1323d1f9739d03f24f6afc927952899e9
SSDeep: 12288:HiI/A8SfxTTnR XklDMEoVnnxmVbMoiY/JExFxglAbwWA DZQp8ZSlLnWkhtq8uz:HN/A86TTnR XkhYM5iyegabwWA DZe8P
Size: 694596 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: UPolyXv05_v6
Company:
Created at: 1971-07-14 14:59:20
Analyzed on: Windows7 SP1 32-bit


Summary:

Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).

Payload

No specific payload has been found.

Process activity

The Trojan creates the following process(es):

76dada3d14c329736ba96e87a85cc18e .exe:348
76dada3d14c329736ba96e87a85cc18e .exe:2452
76dada3d14c329736ba96e87a85cc18e .tmp:3108
%original file name%.exe:452
ohvoca.exe:2052
ohvoca.exe:2336
ohvoca.exe:2812
ohvoca.exe:3340
ohvoca.exe:816
ohvoca.exe:564
ohvoca.exe:1720
ohvoca.exe:3716
ohvoca.exe:2988
ohvoca.exe:3144
ohvoca.exe:1584
ohvoca.exe:3224
ohvoca.exe:2248
ohvoca.exe:3268
ohvoca.exe:3160

The Trojan injects its code into the following process(es):

76dada3d14c329736ba96e87a85cc18e .tmp:2020
ohvoca.exe:3580
ohvoca.exe:3584
ohvoca.exe:2732
ohvoca.exe:572

Mutexes

The following mutexes were created/opened:
No objects were found.

File activity

The process 76dada3d14c329736ba96e87a85cc18e .exe:348 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\is-H3R84.tmp\76dada3d14c329736ba96e87a85cc18e .tmp (1416 bytes)

The process 76dada3d14c329736ba96e87a85cc18e .exe:2452 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\is-UCI3B.tmp\76dada3d14c329736ba96e87a85cc18e .tmp (1416 bytes)

The Trojan deletes the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\is-UCI3B.tmp\76dada3d14c329736ba96e87a85cc18e .tmp (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\is-UCI3B.tmp (0 bytes)

The process 76dada3d14c329736ba96e87a85cc18e .tmp:2020 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\is-DKB79.tmp\plugin.dll (3589 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\is-DKB79.tmp\_isetup\_shfoldr.dll (47 bytes)

The process 76dada3d14c329736ba96e87a85cc18e .tmp:3108 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\is-Q9MIB.tmp\_isetup\_shfoldr.dll (47 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\is-Q9MIB.tmp\plugin.dll (3589 bytes)

The Trojan deletes the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\is-Q9MIB.tmp (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\is-Q9MIB.tmp\_isetup\_shfoldr.dll (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\is-Q9MIB.tmp\plugin.dll (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\is-Q9MIB.tmp\_isetup (0 bytes)

The process %original file name%.exe:452 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Roaming\Haoruvevk\RCXF73A.tmp (19854 bytes)
C:\76dada3d14c329736ba96e87a85cc18e .exe (892 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Haoruvevk\ohvoca.exe (1143 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Haoruvevk\RCXF739.tmp (30254 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Haoruvevk\ohvoca.exep (225 bytes)

The process ohvoca.exe:2732 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\1BB09BEEC155258835C193A7AA85AA5B_24063F956624883A5BA3ACEFF45EA084 (1488 bytes)
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\5080DC7A65DB6A5960ECD874088F3328_6CBA2C06D5985DD95AE59AF8FC7C6220 (1488 bytes)
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\5457A8CE4B2A7499F8299A013B6E1C7C_CE50F893881D43DC0C815E4D80FAF2B4 (1480 bytes)
C:\ProgramData\Microsoft\Crypto\RSA\S-1-5-18\6d14e4b1d8ca773bab785d1be032546e_88dcd395-b062-45b3-a6cd-79f37c0eba08 (47 bytes)
C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F5BEJ4YJ\icanhazip_com[1].txt (15 bytes)
C:\Windows\Temp\TarA361.tmp (2712 bytes)
C:\Windows\Temp\CabA360.tmp (48 bytes)
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\1BB09BEEC155258835C193A7AA85AA5B_24063F956624883A5BA3ACEFF45EA084 (471 bytes)
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\5080DC7A65DB6A5960ECD874088F3328_6CBA2C06D5985DD95AE59AF8FC7C6220 (727 bytes)
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\5457A8CE4B2A7499F8299A013B6E1C7C_CE50F893881D43DC0C815E4D80FAF2B4 (471 bytes)

The Trojan deletes the following file(s):

C:\Windows\Temp\CabA360.tmp (0 bytes)
C:\Windows\Temp\TarA361.tmp (0 bytes)
C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F5BEJ4YJ\icanhazip_com[1].txt (0 bytes)

The process ohvoca.exe:572 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8D93UTC3\icanhazip_com[1].txt (15 bytes)

The Trojan deletes the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8D93UTC3\icanhazip_com[1].txt (0 bytes)

The process ohvoca.exe:3144 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

C:\ProgramData\Haoruvevk\quatubiq\suegneiqce.dmp (48472 bytes)
C:\ProgramData\Haoruvevk\ohvoca.exe (449 bytes)
C:\ProgramData\Haoruvevk\quatubiq\cialkar.cat (4742912 bytes)

Registry activity

The process 76dada3d14c329736ba96e87a85cc18e .tmp:2020 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\RestartManager\Session0000]
"Sequence" = "1"
"Owner" = "E4 07 00 00 64 B0 EF A9 FF CC D2 01"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKCU\Software\Microsoft\RestartManager\Session0000]
"SessionHash" = "45 00 01 24 FF E1 98 1E 3D E9 64 D4 35 61 AD 91"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

The Trojan deletes the following value(s) in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"
"IntranetName"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

The process 76dada3d14c329736ba96e87a85cc18e .tmp:3108 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\RestartManager\Session0000]
"Sequence" = "1"
"Owner" = "24 0C 00 00 F9 17 8E A9 FF CC D2 01"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKCU\Software\Microsoft\RestartManager\Session0000]
"SessionHash" = "05 D5 26 63 F8 2B D7 EB 92 1A 1E A2 D6 51 E2 9F"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

The Trojan deletes the following registry key(s):

[HKCU\Software\Microsoft\RestartManager\Session0000]

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\RestartManager\Session0000]
"Sequence"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\RestartManager\Session0000]
"SessionHash"
"Owner"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"
"ProxyBypass"

The process ohvoca.exe:2732 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 03 00 00 00 09 00 00 00 00 00 00 00"

[HKU\.DEFAULT\Software\Classes\Okfoexibdiko\Ashailli]
"(Default)" = "25 66 38 25 61 65 25 61 34 25 66 38 25 61 65 25"

[HKU\.DEFAULT\Software\Classes\Okfoexibdiko\UfmoLeemuma]
"(Default)" = "Type: REG_NONE, Length: 0"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"DefaultConnectionSettings" = "46 00 00 00 03 00 00 00 09 00 00 00 00 00 00 00"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKU\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E]
"LanguageList" = "en-US, en"

Proxy settings are disabled:

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan deletes the following value(s) in system registry:

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"
"IntranetName"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"
"ProxyBypass"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process ohvoca.exe:572 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Tracing\ohvoca_RASMANCS]
"FileDirectory" = "%windir%\tracing"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"
"UNCAsIntranet" = "0"

[HKLM\SOFTWARE\Microsoft\Tracing\ohvoca_RASAPI32]
"EnableConsoleTracing" = "0"
"ConsoleTracingMask" = "4294901760"
"FileDirectory" = "%windir%\tracing"

[HKLM\SOFTWARE\Microsoft\Tracing\ohvoca_RASMANCS]
"MaxFileSize" = "1048576"

[HKCU\Software\Classes\Okfoexibdiko\UfmoLeemuma]
"(Default)" = "Type: REG_NONE, Length: 0"

[HKLM\SOFTWARE\Microsoft\Tracing\ohvoca_RASMANCS]
"EnableFileTracing" = "0"
"FileTracingMask" = "4294901760"

[HKLM\SOFTWARE\Microsoft\Tracing\ohvoca_RASAPI32]
"FileTracingMask" = "4294901760"

"EnableFileTracing" = "0"

[HKLM\SOFTWARE\Microsoft\Tracing\ohvoca_RASMANCS]
"EnableConsoleTracing" = "0"

[HKCU\Software\Classes\Okfoexibdiko\Ashailli]
"(Default)" = "25 66 38 25 61 65 25 61 34 25 66 38 25 61 65 25"

[HKLM\SOFTWARE\Microsoft\Tracing\ohvoca_RASMANCS]
"ConsoleTracingMask" = "4294901760"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 3E 00 00 00 09 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Microsoft\Tracing\ohvoca_RASAPI32]
"MaxFileSize" = "1048576"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"Uximkeon" = "C:\Users\"%CurrentUserName%"\AppData\Roaming\Haoruvevk\ohvoca.exe /START C:\Users\"%CurrentUserName%"\AppData\Roaming\Haoruvevk\ohvoca.exe"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"
"AutoConfigURL"

Dropped PE files

MD5 File path
5a91bb03dec6eb826a2d4f2e1260a473 c:\76dada3d14c329736ba96e87a85cc18e .exe
ff8f3bdf85d6409328f96a8b9d0dc7ce c:\ProgramData\Haoruvevk\ohvoca.exe
ff8f3bdf85d6409328f96a8b9d0dc7ce c:\Users\All Users\Haoruvevk\ohvoca.exe
92dc6ef532fbb4a5c3201469a5b5eb63 c:\Users\"%CurrentUserName%"\AppData\Local\Temp\is-DKB79.tmp\_isetup\_shfoldr.dll
02d6f1fb319220523ee6e1b87ceec410 c:\Users\"%CurrentUserName%"\AppData\Local\Temp\is-DKB79.tmp\plugin.dll
2c10db017057dce22651243244e4fee6 c:\Users\"%CurrentUserName%"\AppData\Local\Temp\is-H3R84.tmp\76dada3d14c329736ba96e87a85cc18e .tmp
ff8f3bdf85d6409328f96a8b9d0dc7ce c:\Users\"%CurrentUserName%"\AppData\Roaming\Haoruvevk\ohvoca.exe

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

VersionInfo

Company Name:
Product Name: Video-AdBlock
Product Version: 1.0.0.38
Legal Copyright:
Legal Trademarks:
Original Filename:
Internal Name:
File Version:
File Description: Video-AdBlock Setup
Comments: This installation was built with Inno Setup.
Language: English (United States)

PE Sections

Name Virtual Address Virtual Size Raw Size Entropy Section MD5
.text 4096 8032 8192 4.06723 020a9182e650916351f8925cb9e46804
.data 12288 82784 82944 5.53668 5e55fd527f0daef3022622aea72616e1
.rdata 98304 380 512 2.31583 c9e14337001ce06425565b05feed6c77
.bss 102400 12 0 0 d41d8cd98f00b204e9800998ecf8427e
.idata 106496 20 512 0 bf619eac0cdf3f68d496ea9344137e8b
.rsrc 110592 134048 134144 3.00566 d3ae1f437127d00d12e888ebf553c68f

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Total found: 4
46d51d111e40ca2415d0d7ed85a85563
bbccf0f3ead0194420915b2199b8aa2f
56311e12fe4785afb745d56ca68a6a8b
d8a0e69323c4bd69cb3ead2450f9197f

URLs

URL IP
hxxp://track.media-traffic.net/pin.gif?e=start&s=3017&i={540405E9-61C4-48F7-AE6D-F8404CA26831}&v=1.0.0.38 158.85.62.84
hxxp://icanhazip.com/ 104.20.16.242
hxxp://ocsp.usertrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBR8sWZUnKvbRO5iJhat9GV793rVlAQUrb2YejS0Jvf6xCZU7wO94CTLVBoCECdm7lbrSfOOq9dwovyE3iI= 178.255.83.1
hxxp://ocsp.usertrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBReAhtobFzTvhaRmVeJ38QUchY9AwQUu69+Aj36pvE8hI6t7jiY7NkyMtQCECsuburZdTZsFIpu26N8jAc= 178.255.83.1
hxxp://ocsp.usertrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBR64T7ooMQqLLQoy+emBUYZQOKh6QQUkK9qOpRaC9iQ6hJWc99DtDoo2ucCEHhAeV4jr1s1463s34v3X2I= 178.255.83.1
hxxp://ocsp.comodoca.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBReAhtobFzTvhaRmVeJ38QUchY9AwQUu69+Aj36pvE8hI6t7jiY7NkyMtQCECsuburZdTZsFIpu26N8jAc= 178.255.83.1
hxxp://ocsp.comodoca.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBR64T7ooMQqLLQoy+emBUYZQOKh6QQUkK9qOpRaC9iQ6hJWc99DtDoo2ucCEHhAeV4jr1s1463s34v3X2I= 178.255.83.1
ogwaevanilrel.localtunnel.me 138.197.63.247
kufiobhea.localtunnel.me 138.197.63.247
evebepevovlao.localtunnel.me 138.197.63.247
dns.msftncsi.com 131.107.255.255
alfenaaf.localtunnel.me 138.197.63.247
ixlupaedfaviabu.localtunnel.me 138.197.63.247
crl.comodoca.com
lemamegega.localtunnel.me


IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

ET POLICY HTTP Request on Unusual Port Possibly Hostile
ET POLICY Internal Host Retrieving External IP via icanhazip.com - Possible Infection
ET TROJAN Suspicious User-Agent (MSIE)

Traffic

POST /pin.gif?e=start&s=3017&i={540405E9-61C4-48F7-AE6D-F8404CA26831}&v=1.0.0.38 HTTP/1.1
Connection: Keep-Alive
Content-Type: text/plain; Charset=UTF-8
Accept: */*
User-Agent: Mozilla/4.0 (compatible; en-US; Windows NT 6.01.7601) MSIE 9.0.8112.16421
Content-Length: 0
Host: track.media-traffic.net


HTTP/1.1 200 OK
Date: Sun, 14 May 2017 22:15:57 GMT
Server: Apache/2.4.7 (Ubuntu)
Last-Modified: Tue, 02 Dec 2014 14:44:47 GMT
ETag: "31-5093cc4bd95c0"
Accept-Ranges: bytes
Content-Length: 49
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: image/gif
GIF89a...................!.......,...........T..;HTTP/1.1 200 OK..Date
: Sun, 14 May 2017 22:15:57 GMT..Server: Apache/2.4.7 (Ubuntu)..Last-M
odified: Tue, 02 Dec 2014 14:44:47 GMT..ETag: "31-5093cc4bd95c0"..Acce
pt-Ranges: bytes..Content-Length: 49..Keep-Alive: timeout=5, max=100..
Connection: Keep-Alive..Content-Type: image/gif..GIF89a...............
....!.......,...........T..;..



GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBReAhtobFzTvhaRmVeJ38QUchY9AwQUu69+Aj36pvE8hI6t7jiY7NkyMtQCECsuburZdTZsFIpu26N8jAc= HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: ocsp.comodoca.com


HTTP/1.1 200 OK
Date: Sun, 14 May 2017 22:16:33 GMT
Server: Apache
Last-Modified: Tue, 09 May 2017 14:10:49 GMT
Expires: Tue, 16 May 2017 14:10:49 GMT
ETag: A4E30097BB04FA610AA8FF98B18F917682219889
Cache-Control: max-age=143055,public,no-transform,must-revalidate
X-OCSP-Reponder-ID: rmdccaocsp33
Content-Length: 727
Connection: close
Content-Type: application/ocsp-response
0..........0..... .....0......0...0........~.=...<....8...22...2017
0509141049Z0s0q0I0... ........^..hl\.....W....r.=.....~.=...<....8.
..22... .n..u6l..n..|......20170509141049Z....20170516141049Z0...*.H..
...........??../E..sB"..].M....>........J.."..u...s.p..[.8....'.A..
.x.n1..vYC.Ah.._....^.....ncg..,$0n.M*.o....S,.>9..-$7<R.*.....{
~-.`n.WAV.TP.b..]......>..Z.b....)H9.....:....h.....x...A..h.N.2...
...%....3.?.Z....K..5.|.`\C....C..M.r...x.`..-I..'.D.~}..>d}.o.`...
(.^...I-...J......?.e]4...Ck..m$*....P..9...,..6P.#.V....z...w<w...
.'u.. <!.....t'Q....<..9`......D.H.)..|M^.....g....7...a:...,...
...d....c.......S.....Y.....((f...!...fg35...?\(1......HB.I.I.9......e
|C...M...).d..K.)}......R..P..CO....dF%.!.D..d......]P.....



GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBR8sWZUnKvbRO5iJhat9GV793rVlAQUrb2YejS0Jvf6xCZU7wO94CTLVBoCECdm7lbrSfOOq9dwovyE3iI= HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: ocsp.usertrust.com


HTTP/1.1 200 OK
Date: Sun, 14 May 2017 22:16:27 GMT
Server: Apache
Last-Modified: Tue, 09 May 2017 14:10:49 GMT
Expires: Tue, 16 May 2017 14:10:49 GMT
ETag: 53E5570CAB981F33F0656776C55E35B1A89B4618
Cache-Control: max-age=143061,public,no-transform,must-revalidate
X-OCSP-Reponder-ID: rmdccaocsp33
Content-Length: 471
Connection: close
Content-Type: application/ocsp-response
0..........0..... .....0......0...0.........z4.&...&T....$.T...2017050
9141049Z0s0q0I0... ........|.fT...D.b&...e{.z.......z4.&...&T....$.T..
.'f.V.I....p...."....20170509141049Z....20170516141049Z0...*.H........
.....e.V...0]Ogy.....W3.EN~(.=.Q.5.d..d....C:..y4..q...9c.W.... ....!.
..l.J\.v^.|.[B.B.,../........EL...5.%.Q.n.......tgmK...9..... {.L..!GF
. y........K.hS.;.ZZd..\U......yI... .~.$..XpY>....t.u....jy....c..
,..<..J..,......?1T.P.K..V.U....:|...6....fI.h...}......



POST / HTTP/1.1
Host: icanhazip.com
Content-Length: 0
Cache-Control: no-cache


HTTP/1.1 200 OK
Date: Sun, 14 May 2017 22:16:24 GMT
Content-Type: text/plain; charset=UTF-8
Content-Length: 15
Connection: keep-alive
Set-Cookie: __cfduid=df854bc2cc842e8e231bb1e67d86a19341494800184; expires=Mon, 14-May-18 22:16:24 GMT; path=/; domain=.icanhazip.com; HttpOnly
X-SECURITY: This site doesn't distribute malware. Get the facts. hXXps://is.gd/1LWdFz
X-RTFM: Learn about this site at hXXp://bit.ly/icanhazip-faq and don't abuse the service.
X-BECOME-A-RACKER: If you're reading this, apply here: hXXps://VVV.rackspace.com/talent/
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: GET
Server: cloudflare-nginx
CF-RAY: 35f138c174774ea8-DME
194.242.96.226.HTTP/1.1 200 OK..Date: Sun, 14 May 2017 22:16:24 GMT..C
ontent-Type: text/plain; charset=UTF-8..Content-Length: 15..Connection
: keep-alive..Set-Cookie: __cfduid=df854bc2cc842e8e231bb1e67d86a193414
94800184; expires=Mon, 14-May-18 22:16:24 GMT; path=/; domain=.icanhaz
ip.com; HttpOnly..X-SECURITY: This site doesn't distribute malware. Ge
t the facts. hXXps://is.gd/1LWdFz..X-RTFM: Learn about this site at ht
tp://bit.ly/icanhazip-faq and don't abuse the service...X-BECOME-A-RAC
KER: If you're reading this, apply here: hXXps://VVV.rackspace.com/tal
ent/..Access-Control-Allow-Origin: *..Access-Control-Allow-Methods: GE
T..Server: cloudflare-nginx..CF-RAY: 35f138c174774ea8-DME..194.242.96.
226...



GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBR64T7ooMQqLLQoy+emBUYZQOKh6QQUkK9qOpRaC9iQ6hJWc99DtDoo2ucCEHhAeV4jr1s1463s34v3X2I= HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: ocsp.comodoca.com


HTTP/1.1 200 OK
Date: Sun, 14 May 2017 22:16:41 GMT
Server: Apache
Last-Modified: Sun, 14 May 2017 20:09:59 GMT
Expires: Sun, 21 May 2017 20:09:59 GMT
ETag: 9A0837A43DEEF8CB931677FCC628403953C03A48
Cache-Control: max-age=596597,public,no-transform,must-revalidate
X-OCSP-Reponder-ID: rmdccaocsp33
Content-Length: 471
Connection: close
Content-Type: application/ocsp-response
0..........0..... .....0......0...0........j:.Z.....Vs.C.:(....2017051
4200959Z0s0q0I0... ........z.>...*,.(....F.@.......j:.Z.....Vs.C.:(
....x@y^#.[5......_b....20170514200959Z....20170521200959Z0...*.H.....
........L...PO..S.H.../B.~.X*....P......>*..'....Y.......0..$.....[
d7.s............'..8.NK......YkG.....BO....K..^9..m.d5...|N..W..,b...a
5r=.|.xR).iv.B..&.../ .>...-.b.f... ^e.8z..^..c...@.2.E.N..z'.....=
W.<m..@..n..1.?Hq. .J.F^s..V..#q!.....y. ..=i.S!Zk.E.~`....,..



POST / HTTP/1.1
Host: icanhazip.com
Content-Length: 0
Cache-Control: no-cache


HTTP/1.1 200 OK
Date: Sun, 14 May 2017 22:16:17 GMT
Content-Type: text/plain; charset=UTF-8
Content-Length: 15
Connection: keep-alive
Set-Cookie: __cfduid=def5e979a9df1245bc69c05dad332b0381494800177; expires=Mon, 14-May-18 22:16:17 GMT; path=/; domain=.icanhazip.com; HttpOnly
X-SECURITY: This site doesn't distribute malware. Get the facts. hXXps://is.gd/1LWdFz
X-RTFM: Learn about this site at hXXp://bit.ly/icanhazip-faq and don't abuse the service.
X-BECOME-A-RACKER: If you're reading this, apply here: hXXps://VVV.rackspace.com/talent/
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: GET
Server: cloudflare-nginx
CF-RAY: 35f1389254624efc-DME
194.242.96.218.HTTP/1.1 200 OK..Date: Sun, 14 May 2017 22:16:17 GMT..C
ontent-Type: text/plain; charset=UTF-8..Content-Length: 15..Connection
: keep-alive..Set-Cookie: __cfduid=def5e979a9df1245bc69c05dad332b03814
94800177; expires=Mon, 14-May-18 22:16:17 GMT; path=/; domain=.icanhaz
ip.com; HttpOnly..X-SECURITY: This site doesn't distribute malware. Ge
t the facts. hXXps://is.gd/1LWdFz..X-RTFM: Learn about this site at ht
tp://bit.ly/icanhazip-faq and don't abuse the service...X-BECOME-A-RAC
KER: If you're reading this, apply here: hXXps://VVV.rackspace.com/tal
ent/..Access-Control-Allow-Origin: *..Access-Control-Allow-Methods: GE
T..Server: cloudflare-nginx..CF-RAY: 35f1389254624efc-DME..194.242.96.
218...

The Trojan connects to the servers at the folowing location(s):

ohvoca.exe_572:

.text
P`.data
.rdata
`@.bss
.idata
.rsrc
Ü~:
A:\~S
VJ.ae
.OBNb "
w*-.GEP
F.DuS
9J.LP(
%dowWNT\Cur
hXXps://c
e%.LI
.Rv94
i` z%SZ%
lB8*YKey
.iegM
KERNEL32.DLL
ADVAPI32.dll
CRYPT32.dll
GDI32.dll
gdiplus.dll
IPHLPAPI.DLL
MPR.dll
NETAPI32.dll
ole32.dll
OLEAUT32.dll
SHELL32.dll
SHLWAPI.dll
USER32.dll
USERENV.dll
WININET.dll
WINMM.dll
WS2_32.dll
WTSAPI32.dll
ShellExecuteA
client.dll
kernel32.dll
GetProcessHeap
CryptDestroyKey
CryptImportKey
advapi32.dll
CryptSetKeyParam
:\myapp.exe
GCC: (GNU) 4.8.1
<585585576
558558558558@
>585585556
**/**/)(
,****/**

ohvoca.exe_572_rwx_10001000_00031000:

Ht.Ht
QSSSSSSh
%s\%s
"%s" %s %u
%s\%s.%s
"%s" %s "%s"
%s%s\
%s.%s
%c:\%s
%s %s
\\.\%c:
Software\Microsoft\Windows NT\CurrentVersion
%s %s build %s
x%sx%sx%sx%sx%sx
hXXps://
hXXp://
HTTP/1.0
kernel32.dll
.Rv94
CreatePipe
GetProcessHeap
CryptDestroyKey
CryptImportKey
CryptSetKeyParam
RegCreateKeyExA
RegCloseKey
RegOpenKeyExA
RegEnumKeyA
GdiplusShutdown
ShellExecuteA
ShellExecuteExA
SHDeleteKeyA
EnumWindows
UnhookWindowsHookEx
SetWindowsHookExA
GetAsyncKeyState
GetKeyNameTextA
HttpSendRequestA
HttpOpenRequestA
InternetOpenUrlA
.text
`.rdata
@.data
.reloc
i` z%SZ%
lB8*YKey
.iegM

ohvoca.exe_3584:

.text
P`.data
.rdata
`@.bss
.idata
.rsrc
Ü~:
A:\~S
VJ.ae
.OBNb "
w*-.GEP
F.DuS
9J.LP(
%dowWNT\Cur
hXXps://c
e%.LI
.Rv94
i` z%SZ%
lB8*YKey
.iegM
KERNEL32.DLL
ADVAPI32.dll
CRYPT32.dll
GDI32.dll
gdiplus.dll
IPHLPAPI.DLL
MPR.dll
NETAPI32.dll
ole32.dll
OLEAUT32.dll
SHELL32.dll
SHLWAPI.dll
USER32.dll
USERENV.dll
WININET.dll
WINMM.dll
WS2_32.dll
WTSAPI32.dll
ShellExecuteA
client.dll
kernel32.dll
GetProcessHeap
CryptDestroyKey
CryptImportKey
advapi32.dll
CryptSetKeyParam
:\myapp.exe
GCC: (GNU) 4.8.1
<585585576
558558558558@
>585585556
**/**/)(
,****/**

ohvoca.exe_3584_rwx_10001000_00031000:

Ht.Ht
QSSSSSSh
%s\%s
"%s" %s %u
%s\%s.%s
"%s" %s "%s"
%s%s\
%s.%s
%c:\%s
%s %s
\\.\%c:
Software\Microsoft\Windows NT\CurrentVersion
%s %s build %s
x%sx%sx%sx%sx%sx
hXXps://
hXXp://
HTTP/1.0
kernel32.dll
.Rv94
CreatePipe
GetProcessHeap
CryptDestroyKey
CryptImportKey
CryptSetKeyParam
RegCreateKeyExA
RegCloseKey
RegOpenKeyExA
RegEnumKeyA
GdiplusShutdown
ShellExecuteA
ShellExecuteExA
SHDeleteKeyA
EnumWindows
UnhookWindowsHookEx
SetWindowsHookExA
GetAsyncKeyState
GetKeyNameTextA
HttpSendRequestA
HttpOpenRequestA
InternetOpenUrlA
.text
`.rdata
@.data
.reloc
i` z%SZ%
lB8*YKey
.iegM

ohvoca.exe_2732:

.text
P`.data
.rdata
`@.bss
.idata
.rsrc
Ü~:
A:\~S
VJ.ae
.OBNb "
w*-.GEP
F.DuS
9J.LP(
%dowWNT\Cur
hXXps://c
e%.LI
.Rv94
i` z%SZ%
lB8*YKey
.iegM
KERNEL32.DLL
ADVAPI32.dll
CRYPT32.dll
GDI32.dll
gdiplus.dll
IPHLPAPI.DLL
MPR.dll
NETAPI32.dll
ole32.dll
OLEAUT32.dll
SHELL32.dll
SHLWAPI.dll
USER32.dll
USERENV.dll
WININET.dll
WINMM.dll
WS2_32.dll
WTSAPI32.dll
ShellExecuteA
client.dll
kernel32.dll
GetProcessHeap
CryptDestroyKey
CryptImportKey
advapi32.dll
CryptSetKeyParam
:\myapp.exe
GCC: (GNU) 4.8.1
<585585576
558558558558@
>585585556
**/**/)(
,****/**

76dada3d14c329736ba96e87a85cc18e .exe_348:

.idata
.rdata
P.reloc
P.rsrc
kernel32.dll
.DEFAULT\Control Panel\International
File I/O error %d
lzmadecompsmall: Compressed data is corrupted (%d)
lzmadecompsmall: %s
LzmaDecode failed (%d)
shell32.dll
/SUPPRESSMSGBOXES
/PASSWORD=password
Specifies the password to use.
For more detailed information, please visit hXXp://VVV.jrsoftware.org/ishelp/index.php?topic=setupcmdline
/SL5="$%x,%d,%d,
Inno Setup Setup Data (5.5.6)
Inno Setup Messages (5.5.3)
user32.dll
oleaut32.dll
advapi32.dll
RegOpenKeyExA
RegCloseKey
GetWindowsDirectoryA
MsgWaitForMultipleObjects
ExitWindowsEx
comctl32.dll
name="JR.Inno.Setup"
version="1.0.0.0"
name="Microsoft.Windows.Common-Controls"
version="6.0.0.0"
publicKeyToken="6595b64144ccf1df"
<requestedExecutionLevel level="asInvoker" uiAccess="false"/>
<windowsSettings>
<dpiAware xmlns="hXXp://schemas.microsoft.com/SMI/2005/WindowsSettings">true</dpiAware>
</windowsSettings>
<supportedOS Id="{e2011457-1546-43c5-a5fe-008deee3d3f0}"/>
<supportedOS Id="{35138b9a-5d96-4fbd-8e2d-a2440225f93a}"/>
<supportedOS Id="{4a2f28e3-53b9-4441-ba9c-d69d4a4a6e38}"/>
<supportedOS Id="{1f676c76-80e1-4239-95bb-83d0f6d0da78}"/>
<supportedOS Id="{8e0f7a12-bfb3-4fe8-b9a5-48fd50a15a9a}"/>
!'%s' is not a valid integer value('%s' is not a valid floating point value
'%s' is not a valid date
'%s' is not a valid time!'%s' is not a valid date and time
I/O error %d
Integer overflow Invalid floating point operation
Invalid pointer operation
Invalid class typecast0Access violation at address %p. %s of address %p
Operation aborted%Exception %s in module %s at %p.
Application Error1Format '%s' invalid or incompatible with argument
No argument for format '%s'
Invalid variant operation"Variant method calls not supported
External exception %x
1.0.0.38

76dada3d14c329736ba96e87a85cc18e .tmp_2020:

.idata
.rdata
P.reloc
P.rsrc
kernel32.dll
%s_%d
EInvalidOperation
TKeyEvent
TKeyPressEvent
crSQLWait
t.HtR
EInvalidGraphicOperation
TWindowState
poProportional
KeyPreview
WindowState
OnKeyDown
OnKeyPress
OnKeyUp
CTL3D32.DLL
PasswordChar
ssHorizontal
OnKeyUpheB
RegDeleteKeyExA
advapi32.dll
.DEFAULT\Control Panel\International
user32.dll
shlwapi.dll
TPSExec
TPSRuntimeClassImporter
TPSExportedVar
Cannot Import
Interface not supported
Uh.dC
TPSCustomDebugExec
TPSDebugExec
uxtheme.dll
oleacc.dll
RICHED20.DLL
RICHED32.DLL
Rstrtmgr.dll
File I/O error %d
Messages file "%s" is missing. Please correct the problem or obtain a new copy of the program.
shell32.dll
HKEY_CLASSES_ROOT
HKEY_CURRENT_USER
HKEY_LOCAL_MACHINE
HKEY_USERS
HKEY_PERFORMANCE_DATA
HKEY_CURRENT_CONFIG
HKEY_DYN_DATA
WININIT.INI
Uh.DE
t.Htb
Software\Microsoft\Windows\CurrentVersion\SharedDLLs
RegCreateKeyEx
RegOpenKeyEx
sfc.dll
cmd.exe" /C "
COMMAND.COM" /C
PendingFileRenameOperations
PendingFileRenameOperations2
Software\Microsoft\Windows\CurrentVersion\Fonts
Software\Microsoft\Windows NT\CurrentVersion\Fonts
IPropertyStore::SetValue(PKEY_AppUserModel_PreventPinning)
IPropertyStore::SetValue(PKEY_AppUserModel_ID)
IPropertyStore::SetValue(PKEY_AppUserModel_ExcludeFromShowInNewInstall)
IPropertyStore::SetValue(PKEY_AppUserModel_StartPinOption)
OLEAUT32.DLL
Log opened. (Time zone: UTC%s%.2u:%.2u)
%s Log %s #%.3u.txt
MsgWaitForMultipleObjects
regsvr32.exe"
Cannot register 64-bit DLLs on this version of Windows
HELPER_EXE_AMD64
Cannot utilize 64-bit features on this version of Windows
64-bit helper EXE wasn't extracted
\\.\pipe\InnoSetup64BitHelper-%.8x-%.8x-%.8x-%.8x%.8x
CreateNamedPipe
SetNamedPipeHandleState
helper %d 0x%x
Helper process PID: %u
Stopping 64-bit helper process. (PID: %u)
Helper process exited with failure code: 0x%x
TransactNamedPipe
TransactNamedPipe/GetOverlappedResult
Helper: Command did not execute
SOFTWARE\Microsoft\.NETFramework
.NET Framework not found
SOFTWARE\Microsoft\.NETFramework\Policy\v4.0
v4.0.30319
SOFTWARE\Microsoft\.NETFramework\Policy\v2.0
v2.0.50727
SOFTWARE\Microsoft\.NETFramework\Policy\v1.1
v1.1.4322
.NET Framework version %s not found
Fusion.dll
Failed to load .NET Framework DLL "%s"
Failed to get address of .NET Framework CreateAssemblyCache function
.NET Framework CreateAssemblyCache function failed
MoveFileEx failed (%d).
Deleting directory: %s
Failed to delete directory (%d). Will retry later.
Failed to delete directory (%d). Will delete on restart (if empty).
Failed to delete directory (%d).
Deleting file: %s
Failed to delete the file; it may be in use (%d).
ExtractRecData: Unicode data unsupported by this build
The file appears to be in use (%d). Will delete on restart.
Decrementing shared count (%d-bit): %s
Unregistering 64-bit DLL/OCX: %s
Unregistering 32-bit DLL/OCX: %s
Not unregistering DLL/OCX again: %s
Unregistering 64-bit type library: %s
Unregistering 32-bit type library: %s
Uninstalling from GAC: %s
Running Exec filename:
Running Exec parameters:
CreateProcess failed (%d).
Process exit code: %u
Running ShellExec filename:
Running ShellExec parameters:
ShellExecuteEx failed (%d).
Skipping RunOnceId "%s" filename: %s
Unregistering font: %s
zlib: Internal error. Code %d
1.2.1
bzlib: Internal error. Code %d
lzmadecomp: %s
lzmadecomp: Compressed data is corrupted (%d)
DecodeToBuf failed (%d)
TPasswordEdit
PasswordEdit(
Password
c:\directory
Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
PasswordPage
PasswordLabel
PasswordEdit
PasswordEditLabel$
Could not find page with ID %d
Software\Microsoft\Windows\CurrentVersion\Uninstall
%s\%s_is1
RestartManager found an application using one of our files: %s
Can use RestartManager to avoid reboot? %s (%d)
CheckPassword
PrepareToInstall failed: %s
Need to restart Windows? %s
/:*?"<>|
\/:*?"<>|
%s-%d.bin
%s-%d%s.bin
..\DISK%d\
Asking user for new disk containing "%s".
Cannot read an encrypted file before the key has been set
LoggedMsgBox returned an unexpected value. Assuming Abort.
Software\Microsoft\Windows\CurrentVersion\Uninstall\
5.5.6 (a)
URLInfoAbout
URLUpdateInfo
Creating directory: %s
Setting permissions on directory: %s
Failed to set permissions on directory (%d).
Setting NTFS compression on directory: %s
Unsetting NTFS compression on directory: %s
Failed to set NTFS compression state (%d).
IMsg
Failed to set value in Fonts registry key.
Failed to open Fonts registry key.
Setting permissions on file: %s
Failed to set permissions on file (%d).
Setting NTFS compression on file: %s
Unsetting NTFS compression on file: %s
Dest filename: %s
Dest file is protected by Windows File Protection.
Time stamp of our file: %s
Time stamp of existing file: %s
Version of our file: %u.%u.%u.%u
Version of existing file: %u.%u.%u.%u
Existing file is protected by Windows File Protection. Skipping.
Uninstaller requires administrator: %s
The existing file appears to be in use (%d). Will replace on restart.
The existing file appears to be in use (%d). Retrying.
Registering file as a font ("%s")
Cannot install files to 64-bit locations on this version of Windows
desktop.ini
.ShellClassInfo
{0AFACED1-E828-11D1-9187-B532F1E9575D}
target.lnk
Desktop.ini
Software\Microsoft\Windows\CurrentVersion\App Paths\
Section: %s
Entry: %s
Value: %s
Updating the .INI file.
Successfully updated the .INI file.
Skipping updating the .INI file, only updating uninstall log.
Setting permissions on registry key: %s\%s
Could not set permissions on the registry key because it currently does not exist.
Failed to set permissions on registry key (%d).
Cannot access 64-bit registry keys on this version of Windows
Registration executable created: %s
Software\Microsoft\Windows\CurrentVersion\RunOnce
Registering 64-bit DLL/OCX: %s
Registering 32-bit DLL/OCX: %s
Registering 64-bit type library: %s
Registering 32-bit type library: %s
Uh.UG
Directory for uninstall files: %s
Will append to existing uninstall log: %s
Will overwrite existing uninstall log: %s
Creating new uninstall log: %s
LoggedMsgBox returned an unexpected value. Assuming Cancel.
RmShutdown returned an error: %d
Fatal exception during installation process (%s):
ExtractTemporaryFile: The file "%s" was not found
ExtractTemporaryFiles: No files matching "%s" found
Invalid symbol '%s' found
Invalid token '%s' found
QuerySpawnServer: Unexpected response: $%x
CallSpawnServer: Unexpected response: $%x
CallSpawnServer: Unexpected status: %d
ShellExecuteEx
ShellExecuteEx returned hProcess=0
Wnd=$%x
FormKeyDown
PasswordCheckHash
Expression error '%s'
SuppressMsgBoxes
Cannot evaluate "%s" constant during Uninstall
Cannot access a 64-bit key in a "reg" constant on this version of Windows
Unknown custom message name "%s" in "cm" constant
srcexe
Cannot expand "pf64" constant on this version of Windows
Cannot expand "cf64" constant on this version of Windows
uninstallexe
Cannot expand "dotnet2064" constant on this version of Windows
Cannot expand "dotnet4064" constant on this version of Windows
Failed to expand shell folder constant "%s"
Unknown constant "%s"
Software\Microsoft\Windows\CurrentVersion
SOFTWARE\Microsoft\Windows NT\CurrentVersion
cmd.exe
COMMAND.COM
\_setup64.tmp
_isetup\_shfoldr.dll
Failed to get version numbers of _shfoldr.dll
shfolder.dll
Failed to load DLL "%s"
Found pending rename or delete that matches one of our files: %s
Windows version: %u.%u.%u%s (NT platform: %s)
64-bit Windows: %s
Processor architecture: %s
Defaulting to %s for suppressed message box (%s):
Message box (%s):
User chose %s.
MsgBox failed.
/SPAWNWND=$%x /NOTIFYWND=$%x
64-bit install mode: %s
Windows
_isetup\_isdecmp.dll
_isetup\_iscrypt.dll
/Password=
/SuppressMsgBoxes
/DETACHEDMSG
-0.bin
Setup version: Inno Setup version 5.5.6 (a)
Original Setup EXE:
Not restarting Windows because Setup is being run from the debugger.
Restarting Windows.
Inno Setup version 5.5.6 (a)
Portions Copyright (C) 2000-2015 Martijn Laan
hXXp://VVV.innosetup.com/
hXXp://VVV.remobjects.com/ps
Cannot run files in 64-bit locations on this version of Windows
Type: Exec
Type: ShellExec
RmRestart returned an error: %d
Need to restart Windows, not attempting to restart applications
Will not restart Windows automatically.
System\CurrentControlSet\Control\Windows
TOutputMsgWizardPage
TOutputMsgMemoWizardPage
TOutputMsgMemoWizardPage|IH
PasswordEdit
PasswordEditLabel
MsgLabel
Msg1Label
Msg2Label
function CreateOutputMsgPage(const AfterID: Integer; const ACaption, ADescription, AMsg: String): TOutputMsgWizardPage;
function CreateOutputMsgMemoPage(const AfterID: Integer; const ACaption, ADescription, ASubCaption: String; const AMsg: AnsiString): TOutputMsgMemoWizardPage;
function MsgBox(const Text: String; const Typ: TMsgBoxType; const Buttons: Integer): Integer;
function GetIniString(const Section, Key, Default, Filename: String): String;
function GetIniInt(const Section, Key: String; const Default, Min, Max: Longint; const Filename: String): Longint;
function GetIniBool(const Section, Key: String; const Default: Boolean; const Filename: String): Boolean;
function IniKeyExists(const Section, Key, Filename: String): Boolean;
function SetIniString(const Section, Key, Value, Filename: String): Boolean;
function SetIniInt(const Section, Key: String; const Value: Longint; const Filename: String): Boolean;
function SetIniBool(const Section, Key: String; const Value: Boolean; const Filename: String): Boolean;
procedure DeleteIniEntry(const Section, Key, Filename: String);
function GetCmdTail: String;
function StringChangeEx(var S: String; const FromStr, ToStr: String; const SupportDBCS: Boolean): Integer;
function RegValueExists(const RootKey: Integer; const SubKeyName, ValueName: String): Boolean;
function RegQueryStringValue(const RootKey: Integer; const SubKeyName, ValueName: String; var ResultStr: String): Boolean;
function RegQueryMultiStringValue(const RootKey: Integer; const SubKeyName, ValueName: String; var ResultStr: String): Boolean;
function RegDeleteKeyIncludingSubkeys(const RootKey: Integer; const SubkeyName: String): Boolean;
function RegDeleteKeyIfEmpty(const RootKey: Integer; const SubkeyName: String): Boolean;
function RegKeyExists(const RootKey: Integer; const SubKeyName: String): Boolean;
function RegDeleteValue(const RootKey: Integer; const SubKeyName, ValueName: String): Boolean;
function RegGetSubkeyNames(const RootKey: Integer; const SubKeyName: String; var Names: TArrayOfString): Boolean;
function RegGetValueNames(const RootKey: Integer; const SubKeyName: String; var Names: TArrayOfString): Boolean;
function RegQueryDWordValue(const RootKey: Integer; const SubKeyName, ValueName: String; var ResultDWord: Cardinal): Boolean;
function RegQueryBinaryValue(const RootKey: Integer; const SubKeyName, ValueName: String; var ResultStr: AnsiString): Boolean;
function RegWriteStringValue(const RootKey: Integer; const SubKeyName, ValueName, Data: String): Boolean;
function RegWriteExpandStringValue(const RootKey: Integer; const SubKeyName, ValueName, Data: String): Boolean;
function RegWriteMultiStringValue(const RootKey: Integer; const SubKeyName, ValueName, Data: String): Boolean;
function RegWriteDWordValue(const RootKey: Integer; const SubKeyName, ValueName: String; const Data: Cardinal): Boolean;
function RegWriteBinaryValue(const RootKey: Integer; const SubKeyName, ValueName: String; const Data: AnsiString): Boolean;
function CheckForMutexes(Mutexes: String): Boolean;
function Exec(const Filename, Params, WorkingDir: String; const ShowCmd: Integer; const Wait: TExecWait; var ResultCode: Integer): Boolean;
function ExecAsOriginalUser(const Filename, Params, WorkingDir: String; const ShowCmd: Integer; const Wait: TExecWait; var ResultCode: Integer): Boolean;
function ShellExec(const Verb, Filename, Params, WorkingDir: String; const ShowCmd: Integer; const Wait: TExecWait; var ErrorCode: Integer): Boolean;
function ShellExecAsOriginalUser(const Verb, Filename, Params, WorkingDir: String; const ShowCmd: Integer; const Wait: TExecWait; var ErrorCode: Integer): Boolean;
function MakePendingFileRenameOperationsChecksum: String;
function CreateShellLink(const Filename, Description, ShortcutTo, Parameters, WorkingDir, IconFilename: String; const IconIndex, ShowCmd: Integer): String;
function ExitSetupMsgBox: Boolean;
function GetWindowsVersion: Cardinal;
procedure GetWindowsVersionEx(var Version: TWindowsVersion);
function GetWindowsVersionString: String;
function SuppressibleMsgBox(const Text: String; const Typ: TMsgBoxType; const Buttons, Default: Integer): Integer;
function CustomMessage(const MsgName: String): String;
function SendMessage(const Wnd: HWND; const Msg, WParam, LParam: Longint): Longint;
function PostMessage(const Wnd: HWND; const Msg, WParam, LParam: Longint): Boolean;
function SendNotifyMessage(const Wnd: HWND; const Msg, WParam, LParam: Longint): Boolean;
function SendBroadcastMessage(const Msg, WParam, LParam: Longint): Longint;
function PostBroadcastMessage(const Msg, WParam, LParam: Longint): Boolean;
function SendBroadcastNotifyMessage(const Msg, WParam, LParam: Longint): Boolean;
procedure RaiseException(const Msg: String);
function SetPreviousData(const PreviousDataKey: Integer; const ValueName, ValueData: String): Boolean;
Cannot call "%s" function during Setup
Cannot call "%s" function during Uninstall
Cannot call "%s" function during non Unicode Setup or Uninstall
CREATEOUTPUTMSGPAGE
CREATEOUTPUTMSGMEMOPAGE
MSGBOX
Invalid RootKey value
INIKEYEXISTS
GETCMDTAIL
REGKEYEXISTS
REGDELETEKEYINCLUDINGSUBKEYS
REGDELETEKEYIFEMPTY
REGGETSUBKEYNAMES
CHECKFORMUTEXES
SHELLEXEC
SHELLEXECASORIGINALUSER
MAKEPENDINGFILERENAMEOPERATIONSCHECKSUM
Unknown custom message name "%s"
EXITSETUPMSGBOX
GETWINDOWSVERSION
GETWINDOWSVERSIONSTRING
%u.%.2u.%u
SUPPRESSIBLEMSGBOX
%u.%u.%u.%u
Cannot disable FS redirection on this version of Windows
GetWindowsVersionEx
Runtime Error (at %d:%d):
Exception "%s" at address %p
TScriptRunner.SetPSExecParameters: Invalid type
TScriptRunner.LoadScript failed
Remove shared file %s? User chose %s%s
/INITPROCWND=$%x
/SECONDPHASE="%s" /FIRSTPHASEWND=$%x
Original Uninstall EXE:
Install was done in 64-bit mode but not running 64-bit Windows now
Removed all? %s
Not restarting Windows because Uninstall is being run from the debugger.
IMsgt
isRS-???.tmp
isRS-%.3u.tmp
DisableProcessWindowsGhosting
FTPF0P
0123456789abcdefInno Setup Setup Data (5.5.6)
Inno Setup Messages (5.5.3)
oleaut32.dll
RegQueryInfoKeyA
RegOpenKeyExA
RegEnumKeyExA
RegDeleteKeyA
RegCreateKeyExA
RegCloseKey
GetWindowsDirectoryA
CreateNamedPipeA
mpr.dll
version.dll
gdi32.dll
SetViewportOrgEx
UnhookWindowsHookEx
SetWindowsHookExA
MapVirtualKeyA
GetKeyState
GetKeyNameTextA
ExitWindowsEx
EnumWindows
EnumThreadWindows
comctl32.dll
ole32.dll
ShellExecuteExA
ShellExecuteA
comdlg32.dll
.text
`.rdata
@.data
.pdata
@.rsrc
COMCTL32.dll
SHLWAPI.dll
SetProcessShutdownParameters
KERNEL32.dll
ADVAPI32.dll
SHELL32.dll
OLEAUT32.dll
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"><dependency><dependentAssembly><assemblyIdentity type="win32" name="Microsoft.Windows.Common-Controls" version="6.0.0.0" processorArchitecture="*" publicKeyToken="6595b64144ccf1df" language="*"></assemblyIdentity></dependentAssembly></dependency><trustInfo xmlns="urn:schemas-microsoft-com:asm.v3"><security><requestedPrivileges><requestedExecutionLevel level="asInvoker" uiAccess="false"></requestedExecutionLevel></requestedPrivileges></security></trustInfo><compatibility xmlns="urn:schemas-microsoft-com:compatibility.v1"><application><supportedOS Id="{e2011457-1546-43c5-a5fe-008deee3d3f0}"></supportedOS><supportedOS Id="{35138b9a-5d96-4fbd-8e2d-a2440225f93a}"></supportedOS><supportedOS Id="{4a2f28e3-53b9-4441-ba9c-d69d4a4a6e38}"></supportedOS><supportedOS Id="{1f676c76-80e1-4239-95bb-83d0f6d0da78}"></supportedOS><supportedOS Id="{8e0f7a12-bfb3-4fe8-b9a5-48fd50a15a9a}"></supportedOS></application></compatibility></assembly>PADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXMZ
`.data
.rsrc
@.reloc
Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
SOFTWARE\Microsoft\Windows\CurrentVersion
Software\Microsoft\Windows\CurrentVersion\ProfileReconciliation
RegKey
GetWindowsDirectoryW
RegOpenKeyA
SHFOLDER.dll
dll\shfolder.dbg
Font.Color
Font.Height
Font.Name
Font.Style
Lines.Strings
name="JR.Inno.Setup"
version="1.0.0.0"
name="Microsoft.Windows.Common-Controls"
version="6.0.0.0"
publicKeyToken="6595b64144ccf1df"
<requestedExecutionLevel level="asInvoker" uiAccess="false"/>
<windowsSettings>
<dpiAware xmlns="hXXp://schemas.microsoft.com/SMI/2005/WindowsSettings">true</dpiAware>
</windowsSettings>
<supportedOS Id="{e2011457-1546-43c5-a5fe-008deee3d3f0}"/>
<supportedOS Id="{35138b9a-5d96-4fbd-8e2d-a2440225f93a}"/>
<supportedOS Id="{4a2f28e3-53b9-4441-ba9c-d69d4a4a6e38}"/>
<supportedOS Id="{1f676c76-80e1-4239-95bb-83d0f6d0da78}"/>
<supportedOS Id="{8e0f7a12-bfb3-4fe8-b9a5-48fd50a15a9a}"/>
Cannot assign a %s to a %s
Cannot create file %s
Cannot open file %s
Stream write error Out of memory while expanding memory stream*Can't write to a read-only resource stream.WriteObject called twice for the same instance
Class %s not found
Resource %s not found!Resource %s is of incorrect class
List index out of bounds Operation not allowed on sorted string list%String list does not allow duplicates
Tab index out of bounds#A component named %s already exists$''%s'' is not a valid component name
A class named %s already exists#''%s'' is not a valid integer value
Error reading %s.%s: %s
Ancestor for '%s' not found
Bitmap is empty!Cannot change the size of an icon$Unknown picture file extension (.%s)
Unsupported clipboard format
Error creating window Cannot focus a disabled or invisible window!Control '%s' has no parent window
%s property out of range
%s on %s@GroupIndex cannot be less than a previous menu item's GroupIndex2Cannot have more than one MDI form per application
Could not load CARDS.DLL
Duplicate CardId found"An error returned from DDE ($0%x)/DDE Error - conversation not established ($0%x)0Error occurred when DDE ran out of memory ($0%x)"Unable to connect DDE conversation
Grid too large for operation Too many rows or columns deleted
%s on line %d
''%s'' expected
%s expected
Invalid input value7Invalid input value. Use escape key to abandon changes
Value must be between %d and %d<Cannot create a default method name for an unnamed component
''%s'' is not a valid date
''%s'' is not a valid time#''%s'' is not a valid date and time
Invalid file name - %s
All files (*.*)|*.*
&Files: (*.*)
Invalid clipboard format Clipboard does not support Icons
Custom Colors Operation not supported on selected printer.There is no default printer currently selected
Unable to write to %s
Invalid data type for '%s'
Failed to create key %s
Failed to set data for '%s'
Failed to get data for '%s'9Synchronize called when main VCL thread in a WaitFor call0Unknown RichEdit conversion file extension (.%s)
/Menu '%s' is already being used by another form
Failed to Save Stream)StatusBar cannot have more than 64 panels!Error assigning Hot-Key to %s. %s
Hot-Key is invalid#Window is invalid or a child window%Hot-Key is assigned to another window %s is already associated with %s!'%s' is not a valid integer value('%s' is not a valid floating point value
'%s' is not a valid date
'%s' is not a valid time!'%s' is not a valid date and time
I/O error %d
Integer overflow Invalid floating point operation
Invalid pointer operation
Invalid class typecast0Access violation at address %p. %s of address %p
Operation aborted%Exception %s in module %s at %p.
Application Error1Format '%s' invalid or incompatible with argument
No argument for format '%s'
Invalid variant operation"Variant method calls not supported
External exception %x
n%USERPROFILE%
r%SYSTEMROOT%
5.50.4807.2300
Microsoft(R) Windows (R) 2000 Operating System
Datos de programa%Configuraci
51.52.0.0

ohvoca.exe_2732_rwx_10001000_00031000:

Ht.Ht
QSSSSSSh
%s\%s
"%s" %s %u
%s\%s.%s
"%s" %s "%s"
%s%s\
%s.%s
%c:\%s
%s %s
\\.\%c:
Software\Microsoft\Windows NT\CurrentVersion
%s %s build %s
x%sx%sx%sx%sx%sx
hXXps://
hXXp://
HTTP/1.0
kernel32.dll
.Rv94
CreatePipe
GetProcessHeap
CryptDestroyKey
CryptImportKey
CryptSetKeyParam
RegCreateKeyExA
RegCloseKey
RegOpenKeyExA
RegEnumKeyA
GdiplusShutdown
ShellExecuteA
ShellExecuteExA
SHDeleteKeyA
EnumWindows
UnhookWindowsHookEx
SetWindowsHookExA
GetAsyncKeyState
GetKeyNameTextA
HttpSendRequestA
HttpOpenRequestA
InternetOpenUrlA
.text
`.rdata
@.data
.reloc
i` z%SZ%
lB8*YKey
.iegM

ohvoca.exe_3580:

.text
P`.data
.rdata
`@.bss
.idata
.rsrc
Ü~:
A:\~S
VJ.ae
.OBNb "
w*-.GEP
F.DuS
9J.LP(
%dowWNT\Cur
hXXps://c
e%.LI
.Rv94
i` z%SZ%
lB8*YKey
.iegM
KERNEL32.DLL
ADVAPI32.dll
CRYPT32.dll
GDI32.dll
gdiplus.dll
IPHLPAPI.DLL
MPR.dll
NETAPI32.dll
ole32.dll
OLEAUT32.dll
SHELL32.dll
SHLWAPI.dll
USER32.dll
USERENV.dll
WININET.dll
WINMM.dll
WS2_32.dll
WTSAPI32.dll
ShellExecuteA
client.dll
kernel32.dll
GetProcessHeap
CryptDestroyKey
CryptImportKey
advapi32.dll
CryptSetKeyParam
:\myapp.exe
GCC: (GNU) 4.8.1
<585585576
558558558558@
>585585556
**/**/)(
,****/**

ohvoca.exe_3580_rwx_10001000_00031000:

Ht.Ht
QSSSSSSh
%s\%s
"%s" %s %u
%s\%s.%s
"%s" %s "%s"
%s%s\
%s.%s
%c:\%s
%s %s
\\.\%c:
Software\Microsoft\Windows NT\CurrentVersion
%s %s build %s
x%sx%sx%sx%sx%sx
hXXps://
hXXp://
HTTP/1.0
kernel32.dll
.Rv94
CreatePipe
GetProcessHeap
CryptDestroyKey
CryptImportKey
CryptSetKeyParam
RegCreateKeyExA
RegCloseKey
RegOpenKeyExA
RegEnumKeyA
GdiplusShutdown
ShellExecuteA
ShellExecuteExA
SHDeleteKeyA
EnumWindows
UnhookWindowsHookEx
SetWindowsHookExA
GetAsyncKeyState
GetKeyNameTextA
HttpSendRequestA
HttpOpenRequestA
InternetOpenUrlA
.text
`.rdata
@.data
.reloc
i` z%SZ%
lB8*YKey
.iegM


Remove it with Ad-Aware

  1. Click (here) to download and install Ad-Aware Free Antivirus.
  2. Update the definition files.
  3. Run a full scan of your computer.


Manual removal*

  1. Terminate malicious process(es) (How to End a Process With the Task Manager):

    76dada3d14c329736ba96e87a85cc18e .exe:348
    76dada3d14c329736ba96e87a85cc18e .exe:2452
    76dada3d14c329736ba96e87a85cc18e .tmp:3108
    %original file name%.exe:452
    ohvoca.exe:2052
    ohvoca.exe:2336
    ohvoca.exe:2812
    ohvoca.exe:3340
    ohvoca.exe:816
    ohvoca.exe:564
    ohvoca.exe:1720
    ohvoca.exe:3716
    ohvoca.exe:2988
    ohvoca.exe:3144
    ohvoca.exe:1584
    ohvoca.exe:3224
    ohvoca.exe:2248
    ohvoca.exe:3268
    ohvoca.exe:3160

  2. Delete the original Trojan file.
  3. Delete or disinfect the following files created/modified by the Trojan:

    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\is-H3R84.tmp\76dada3d14c329736ba96e87a85cc18e .tmp (1416 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\is-UCI3B.tmp\76dada3d14c329736ba96e87a85cc18e .tmp (1416 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\is-DKB79.tmp\plugin.dll (3589 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\is-DKB79.tmp\_isetup\_shfoldr.dll (47 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\is-Q9MIB.tmp\_isetup\_shfoldr.dll (47 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\is-Q9MIB.tmp\plugin.dll (3589 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Haoruvevk\RCXF73A.tmp (19854 bytes)
    C:\76dada3d14c329736ba96e87a85cc18e .exe (892 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Haoruvevk\ohvoca.exe (1143 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Haoruvevk\RCXF739.tmp (30254 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Haoruvevk\ohvoca.exep (225 bytes)
    C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\1BB09BEEC155258835C193A7AA85AA5B_24063F956624883A5BA3ACEFF45EA084 (1488 bytes)
    C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\5080DC7A65DB6A5960ECD874088F3328_6CBA2C06D5985DD95AE59AF8FC7C6220 (1488 bytes)
    C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\5457A8CE4B2A7499F8299A013B6E1C7C_CE50F893881D43DC0C815E4D80FAF2B4 (1480 bytes)
    C:\ProgramData\Microsoft\Crypto\RSA\S-1-5-18\6d14e4b1d8ca773bab785d1be032546e_88dcd395-b062-45b3-a6cd-79f37c0eba08 (47 bytes)
    C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F5BEJ4YJ\icanhazip_com[1].txt (15 bytes)
    C:\Windows\Temp\TarA361.tmp (2712 bytes)
    C:\Windows\Temp\CabA360.tmp (48 bytes)
    C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\1BB09BEEC155258835C193A7AA85AA5B_24063F956624883A5BA3ACEFF45EA084 (471 bytes)
    C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\5080DC7A65DB6A5960ECD874088F3328_6CBA2C06D5985DD95AE59AF8FC7C6220 (727 bytes)
    C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\5457A8CE4B2A7499F8299A013B6E1C7C_CE50F893881D43DC0C815E4D80FAF2B4 (471 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8D93UTC3\icanhazip_com[1].txt (15 bytes)
    C:\ProgramData\Haoruvevk\quatubiq\suegneiqce.dmp (48472 bytes)
    C:\ProgramData\Haoruvevk\ohvoca.exe (449 bytes)
    C:\ProgramData\Haoruvevk\quatubiq\cialkar.cat (4742912 bytes)

  4. Delete the following value(s) in the autorun key (How to Work with System Registry):

    [HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce]
    "Uximkeon" = "C:\Users\"%CurrentUserName%"\AppData\Roaming\Haoruvevk\ohvoca.exe /START C:\Users\"%CurrentUserName%"\AppData\Roaming\Haoruvevk\ohvoca.exe"

  5. Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
  6. Reboot the computer.

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

No votes yet


Lavasoft is the maker of Ad-Aware, the world's most popular anti-malware software with over 450 million downloads.
© 2025 Lavasoft. All rights reserved.
Terms Of Use |   Privacy Policy


x

Our best antivirus yet!

Fresh new look. Faster scanning. Better protection.

Enjoy unique new features, lightning fast scans and a simple yet beautiful new look in our best antivirus yet!

For a quicker, lighter and more secure experience, download the all new adaware antivirus 12 now!

Download adaware antivirus 12
No thanks, continue to lavasoft.com
close x

Discover the new adaware antivirus 12

Our best antivirus yet

Download Now