MD5: 620f2e794b81cc8c2a3ef6230dd4537f
SHA1: 1f2089eb2c162b5558c23b34317288554e89f07f
SHA256: 5db7eea65290a0574a58cfa1516c0071efd9d07a04ea38554b4b1c25a1f2ead7
SSDeep: 24576:G4csVnmW5AJg2/H/9p1tWYIX XIUk0tWSVYvTU xf:Gymgc/z1ASIUkdu8TPx
Size: 1056256 bytes
File type: EXE
Platform: WIN32
Entropy: Not Packed
PEID: UPolyXv05_v6, BorlandDelphi30, BorlandDelphiv30, ACProtect141
Company: File Syn
Created at: 1992-06-20 01:22:17
Analyzed on: Windows7 SP1 32-bit

Summary:

Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).

Payload

Process activity

The Trojan creates the following process(es):
No processes have been created.
The Trojan injects its code into the following process(es):

%original file name%.exe:3432

Mutexes

The following mutexes were created/opened:
No objects were found.

File activity

The process %original file name%.exe:3432 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\KZP95AMG.txt (90 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\828298824EA5549947C17DDABF6871F5_0206EFBC540300C3BF0163CDBC3D7D56 (1424 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\23B523C9E7746F715D33C6527C18EB9D (325 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8A574ED5927B3CEC9626151D220C7448 (582 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8A574ED5927B3CEC9626151D220C7448 (248 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Cab3AAF.tmp (51 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\23B523C9E7746F715D33C6527C18EB9D (876 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\25FDO7QC\2tY8crt[1].htm (165 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\828298824EA5549947C17DDABF6871F5_0206EFBC540300C3BF0163CDBC3D7D56 (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Tar3AB0.tmp (2712 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8059E9A0D314877E40FE93D8CCFB3C69_A4F397860F7EB63B354881601512B12C (668 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8059E9A0D314877E40FE93D8CCFB3C69_A4F397860F7EB63B354881601512B12C (463 bytes)

The Trojan deletes the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Cab3AAF.tmp (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Tar3AB0.tmp (0 bytes)

Registry activity

The process %original file name%.exe:3432 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D69B561148F01C77C54578C10926DF5B856976AD]
"Blob" = "0F 00 00 00 01 00 00 00 20 00 00 00 52 29 BA 15"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKLM\SOFTWARE\Microsoft\Tracing\620f2e794b81cc8c2a3ef6230dd4537f_RASMANCS]
"FileTracingMask" = "4294901760"
"ConsoleTracingMask" = "4294901760"

[HKLM\SOFTWARE\Microsoft\Tracing\620f2e794b81cc8c2a3ef6230dd4537f_RASAPI32]
"FileTracingMask" = "4294901760"

[HKCU\Software\Classes\Local Settings\MuiCache\2D\52C64B7E]
"LanguageList" = "en-US, en"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 3C 00 00 00 09 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Microsoft\Tracing\620f2e794b81cc8c2a3ef6230dd4537f_RASMANCS]
"EnableFileTracing" = "0"

[HKLM\SOFTWARE\Microsoft\Tracing\620f2e794b81cc8c2a3ef6230dd4537f_RASAPI32]
"EnableFileTracing" = "0"

[HKLM\SOFTWARE\Microsoft\Tracing\620f2e794b81cc8c2a3ef6230dd4537f_RASMANCS]
"FileDirectory" = "%windir%\tracing"

[HKLM\SOFTWARE\Microsoft\Tracing\620f2e794b81cc8c2a3ef6230dd4537f_RASAPI32]
"EnableConsoleTracing" = "0"

[HKLM\SOFTWARE\Microsoft\Tracing\620f2e794b81cc8c2a3ef6230dd4537f_RASMANCS]
"EnableConsoleTracing" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKLM\SOFTWARE\Microsoft\Tracing\620f2e794b81cc8c2a3ef6230dd4537f_RASMANCS]
"MaxFileSize" = "1048576"

[HKLM\SOFTWARE\Microsoft\Tracing\620f2e794b81cc8c2a3ef6230dd4537f_RASAPI32]
"MaxFileSize" = "1048576"
"ConsoleTracingMask" = "4294901760"

"FileDirectory" = "%windir%\tracing"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"

[HKLM\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates]
"D69B561148F01C77C54578C10926DF5B856976AD"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"

Dropped PE files

There are no dropped PE files.

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

VersionInfo

No information is available.

PE Sections

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

URLs

URL	IP
hxxp://bit.ly/2tY8crt	67.199.248.10
hxxp://e6845.dscb1.akamaiedge.net/crls/secureca.crl
hxxp://e8218.dscb1.akamaiedge.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSxtDkXkBa3l3lQEfFgudSiPNvt7gQUAPkqw0GRtsnCuD5V8sCXEROgByACEAEAISWIsPpZp3fvBXtmJ98=
hxxp://docs.google.com/ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCDRz/RyozF6Q	172.217.18.78
hxxp://docs.google.com/GIAG2.crl	172.217.18.78
hxxp://clients1.google.com/ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCDRz/RyozF6Q	172.217.18.78
hxxp://pki.google.com/GIAG2.crl	172.217.18.78
hxxp://crl.geotrust.com/crls/secureca.crl	23.46.117.163
hxxp://g.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSxtDkXkBa3l3lQEfFgudSiPNvt7gQUAPkqw0GRtsnCuD5V8sCXEROgByACEAEAISWIsPpZp3fvBXtmJ98=	23.46.123.27

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

GET /ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCDRz/RyozF6Q HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: clients1.google.com

HTTP/1.1 200 OK

Content-Type: application/ocsp-response

Date: Thu, 20 Jul 2017 17:58:42 GMT

Expires: Mon, 24 Jul 2017 17:58:42 GMT

Server: ocsp_responder

Content-Length: 463

X-XSS-Protection: 1; mode=block

X-Frame-Options: SAMEORIGIN

Cache-Control: public, max-age=345600

Age: 48146
0..........0..... .....0......0...0......J......h.v....b..Z./..2017072
0132707Z0k0i0A0... ..........j.....p.I.#z...(~d..J......h.v....b..Z./.
.4s....^.....20170720132707Z....20170727132707Z0...*.H.............UA\
_..T@GO...n....c..-...X$z..&.k..v......[i.|.......?K..8H".L...'.p\f..i
t.uP@.~...FD...}......`E.O..E......=rR..>.].Ra..KS...Q.C.I"~.J.."..
R8..wo..#.'m....I....f...a....r{...S..P. 3,N..3.&.KxQ....kJ.....<..
Q.-|....=......z.]|.s.Cb.......u 2K......2pM.X.'.HTTP/1.1 200 OK..Cont
ent-Type: application/ocsp-response..Date: Thu, 20 Jul 2017 17:58:42 G
MT..Expires: Mon, 24 Jul 2017 17:58:42 GMT..Server: ocsp_responder..Co
ntent-Length: 463..X-XSS-Protection: 1; mode=block..X-Frame-Options: S
AMEORIGIN..Cache-Control: public, max-age=345600..Age: 48146..0.......
...0..... .....0......0...0......J......h.v....b..Z./..20170720132707Z
0k0i0A0... ..........j.....p.I.#z...(~d..J......h.v....b..Z./..4s....^
.....20170720132707Z....20170727132707Z0...*.H.............UA\_..T@GO.
..n....c..-...X$z..&.k..v......[i.|.......?K..8H".L...'.p\f..it.uP@.~.
..FD...}......`E.O..E......=rR..>.].Ra..KS...Q.C.I"~.J.."..R8..wo..
#.'m....I....f...a....r{...S..P. 3,N..3.&.KxQ....kJ.....<..Q.-|....
=......z.]|.s.Cb.......u 2K......2pM.X.'...

GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSxtDkXkBa3l3lQEfFgudSiPNvt7gQUAPkqw0GRtsnCuD5V8sCXEROgByACEAEAISWIsPpZp3fvBXtmJ98= HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: g.symcd.com

HTTP/1.1 200 OK

Server: nginx/1.10.2

Content-Type: application/ocsp-response

Content-Length: 1390

content-transfer-encoding: binary

Cache-Control: max-age=310053, public, no-transform, must-revalidate

Last-Modified: Mon, 17 Jul 2017 21:26:55 GMT

Expires: Mon, 24 Jul 2017 21:26:55 GMT

Date: Fri, 21 Jul 2017 07:21:03 GMT

Connection: keep-alive
0..j......c0.._.. .....0.....P0..L0......V.T'S...q..."...zr.*..2017071
7212655Z0s0q0I0... ..........9.....yP..`...<.......*.A.....>U...
.... ....!%...Y.w..{f'.....20170717212655Z....20170724212655Z0...*.H..
...........Samg$.p..-.F..]....B.j.6.]N..2.w....9..N/...`.'..........]F
.5."............G*.#C.......*...k.....7c,.P4kU...../p...k...Bi.m......
.nUr...`4.Y...<........W.R0.'. \...=......J..yR.}..fJ.$6h..<....
F..q;b..X...K ....,K.*e...... .F.....p.!.bU......#.yL...f.....>....
0...0...0..s............ ...y..^..g0...*.H........0B1.0...U....US1.0..
.U....GeoTrust Inc.1.0...U....GeoTrust Global CA0...161208112535Z..171
214112535Z02100...U...'GeoTrust Global CA TGV OCSP Responder 50.."0...
*.H.............0...............S....!....,.t.?....d...M@.._.=.S..,.".
.....Gdv._c..D1..N'E.:.....a2.......{/rD. .c.2..P...!.....Xn..}....{{.
zI9.Y....../.....;.......fu..,...B._o..B..g....o........?Y\.?...y.H*..
]yi.....3.......F.6.....Q.........{B..19..Kz...\z...P..._...-!.....'.Y
m........0..0...U.#..0....z.h.....d..}.}e...N0... .....0......0...U.%.
.0... .......0...U...........0...U.......0.0"..U....0...0.1.0...U....T
GV-OFF-570...*.H..............md.....yV{......y:5..@l#..5.......o..X..
..,r}......i..3..o.e...e5..@..H/Q..;.vd..?.j.m....../hv..A.......g....
...a.....G..\.'*.b..>.....L.Y.To<.@>...&1..9.w.....N*Au.e....
.b..K...PO47.J.....{.C\....G..0/.a.Eo.`z.<;IA...  #.''.CG..K@7z..7.
\_..'.]q.f._.WN....
<<< skipped >>>

GET /GIAG2.crl HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: pki.google.com

HTTP/1.1 200 OK

Accept-Ranges: none

Vary: Accept-Encoding

Content-Type: application/pkix-crl

Date: Fri, 21 Jul 2017 07:07:06 GMT

Expires: Fri, 21 Jul 2017 08:07:06 GMT

Last-Modified: Fri, 21 Jul 2017 02:15:00 GMT

X-Content-Type-Options: nosniff

Server: sffe

X-XSS-Protection: 1; mode=block

Cache-Control: public, max-age=3600

Age: 846

Transfer-Encoding: chunked
246..0..B0..*...0...*.H........0I1.0...U....US1.0...U....Google Inc1%0
#..U....Google Internet Authority G2..170721010003Z..170731010003Z0{0'
..;w._......170510105507Z0.0...U.......0'...T...y.K..170412085317Z0.0.
..U.......0'..1.3..*....160915202213Z0.0...U........00.0...U.#..0...J.
.....h.v....b..Z./0...U.......<0...*.H.............ki..........Dx..
...n.&.:i..T.......Fd."..f)...b.#.M..k.....wM...T.mFV........r.$=.....
.y.....0..F.s.....t.....F3..Ho.lt..{[G.....N.....(I_...... 4h.*<#..
...#.u.&.Z..^q_...a.......bA.!.>c...{.N.........Rf1....."....B#..rJ
.5..[...0.zD1#...$.L..@......Ng^...>..0..HTTP/1.1 200 OK..Accept-Ra
nges: none..Vary: Accept-Encoding..Content-Type: application/pkix-crl.
.Date: Fri, 21 Jul 2017 07:07:06 GMT..Expires: Fri, 21 Jul 2017 08:07:
06 GM..

GET /2tY8crt HTTP/1.1

Accept: */*

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: bit.ly

Connection: Keep-Alive

HTTP/1.1 301 Moved Permanently

Server: nginx

Date: Fri, 21 Jul 2017 07:20:51 GMT

Content-Type: text/html; charset=utf-8

Content-Length: 165

Connection: keep-alive

Cache-Control: private, max-age=90

Location: hXXps://docs.google.com/uc?export=download&id=0BzjT0iC5hLGELU03bUMxLXNvams

Set-Cookie: _bit=h6l7kP-dbbf116ad7118dd4fa-00a; Domain=bit.ly; Expires=Wed, 17 Jan 2018 07:20:51 GMT
<html>.<head><title>Bitly</title></head>
.<body><a href="hXXps://docs.google.com/uc?export=download&am
p;id=0BzjT0iC5hLGELU03bUMxLXNvams">moved here</a></body>
;.</html>HTTP/1.1 301 Moved Permanently..Server: nginx..Date: Fr
i, 21 Jul 2017 07:20:51 GMT..Content-Type: text/html; charset=utf-8..C
ontent-Length: 165..Connection: keep-alive..Cache-Control: private, ma
x-age=90..Location: hXXps://docs.google.com/uc?export=download&id=0Bzj
T0iC5hLGELU03bUMxLXNvams..Set-Cookie: _bit=h6l7kP-dbbf116ad7118dd4fa-0
0a; Domain=bit.ly; Expires=Wed, 17 Jan 2018 07:20:51 GMT..<html>
.<head><title>Bitly</title></head>.<body>
;<a href="hXXps://docs.google.com/uc?export=download&id=0BzjT0i
C5hLGELU03bUMxLXNvams">moved here</a></body>.</html&
gt;..

GET /crls/secureca.crl HTTP/1.1

Connection: Keep-Alive

Accept: */*

If-Modified-Since: Thu, 13 Oct 2016 09:30:22 GMT

If-None-Match: "b6a46da3cf1aa70c10b101b12c9733f4:1476351022"

User-Agent: Microsoft-CryptoAPI/6.1

Host: crl.geotrust.com

HTTP/1.1 200 OK

Server: Apache

ETag: "0b12b97758735a504696913a1885cdc8:1500621322"

Last-Modified: Fri, 21 Jul 2017 07:15:22 GMT

Date: Fri, 21 Jul 2017 07:20:57 GMT

Content-Length: 325

Connection: keep-alive

Content-Type: application/pkix-crl
0..A0..0...*.H........0N1.0...U....US1.0...U....Equifax1-0 ..U...$Equi
fax Secure Certificate Authority..170721070300Z..170731070300Z0,0....%
...020514181157Z0.....3..020515130611Z0...*.H.............5...~..e..A.
..g...|'.66......S...0...y.. .2Qm.e..V.....r!,}......!Uv....t.2....p.5
...f..d...^..h.qa..o.}..^U..S.....'1.Q......vHTTP/1.1 200 OK..Server: 
Apache..ETag: "0b12b97758735a504696913a1885cdc8:1500621322"..Last-Modi
fied: Fri, 21 Jul 2017 07:15:22 GMT..Date: Fri, 21 Jul 2017 07:20:57 G
MT..Content-Length: 325..Connection: keep-alive..Content-Type: applica
tion/pkix-crl..0..A0..0...*.H........0N1.0...U....US1.0...U....Equifax
1-0 ..U...$Equifax Secure Certificate Authority..170721070300Z..170731
070300Z0,0....%...020514181157Z0.....3..020515130611Z0...*.H..........
...5...~..e..A...g...|'.66......S...0...y.. .2Qm.e..V.....r!,}......!U
v....t.2....p.5...f..d...^..h.qa..o.}..^U..S.....'1.Q......v..

The Trojan connects to the servers at the folowing location(s):

.idata

.rdata

P.reloc

P.rsrc

kernel32.dll

Windows

MSWHEEL_ROLLMSG

MSH_WHEELSUPPORT_MSG

MSH_SCROLL_LINES_MSG

$*@@@*$@@@$ *@@* $@@($*)@-$*@@$-*@@$*-@@(*$)@-*$@@*-$@@*$-@@-* $@-$ *@* $-@$ *-@$ -*@*- $@($ *)(* $)

oleaut32.dll

EVariantBadIndexError

ssShift

htKeyword

EInvalidOperation

u%CNu

%s[%d]

%s_%d

EInvalidGraphicOperation

USER32.DLL

comctl32.dll

uxtheme.dll

UhE%C

%s%s%s%s%s%s%s%s%s%s

Proportional

MAPI32.DLL

PasswordCharL

OnKeyDown`

OnKeyPress

OnKeyUp8

IE(AL("%s",4),"AL(\"%0:s\",3)","JK(\"%1:s\",\"%0:s\")")

JumpID("","%s")

TKeyEvent

TKeyPressEvent

HelpKeywordT

crSQLWait

%s (%s)

imm32.dll

AutoHotkeysl

AutoHotkeys

ssHotTrack

TWindowState

poProportional

TWMKey

KeyPreview`

WindowState

System\CurrentControlSet\Control\Keyboard Layouts\%.8x

vcltest3.dll

User32.dll

ole32.dll

EIdSocksAuthMethodErrorP%F

getservbyport

WSAAsyncGetServByPort

WSAJoinLeaf

WS2_32.DLL

Uh.BF

127.0.0.1

TIdSocketListWindows

TIdStackWindowsU

IdStackWindows

TSQLTimeStampVariantType

TSQLTimeStampData

SqlTimSt

%s %s

(%s%s)

-%s%s

%s-%s

%s%s-

-%s %s

%s %s-

%s -%s

(%s- %s)

(%s %s)

ftParadoxOle

TLoginEvent

Password

pfInKey

ImportedConstraint

LookupKeyFields

KeyFields

TSQLTimeStampField

SQLTimeStamp

%s: %s

%s.%s

mtxex.dll

ctKeyset

TExecuteOption

eoAsyncExecute

eoExecuteNoRecords

TExecuteOptions

cmdUnknown

cmdText

cmdTable

cmdStoredProc

cmdFile

cmdTableDirect

TExecuteCompleteEvent

TWillExecuteEvent

LoginPrompt

OnExecuteComplete

OnWillExecutet

OnLogin

(%s%s%s%s%2:s)

RDSServer.DataFactory

COLUMN%d

%s[%s],

%s%s,

%s;%s

PRIMARY_KEY

tcPW

!"#$%&*;<=>@[]^_`{|}

Invalid size or check sum of file or unsupported compression format

File "%s" not found

Cannot create file "%s"

Cannot create directory "%s"

Cannot open file "%s"

Cannot delete file "%s"

Invalid compressed size, rfs.size = %d, count = %d

Cannot create output file. Probably file is locked by another process. FileName = '%s'.

Archive is open. You should close it beore performing this operation.

Cannot compress file '%s'. Zip64 mode is not enabled

Deflate64 compression method is not supported

Cannot delete folder "%s"

Multiple transactions are not supported for multi-volume archives

Invalid InitVector index = %d. Index should be >= 0 and < %d

Invalid password. Cannot decompress encrypted file.

TZFProcessOperation

Operation

TZFOnPasswordEvent

NewPassword

OnPassword

1.2.5

Web site: hXXp://VVV.componentace.com

the appropriate version of this product at hXXp://VVV.componentace.com

feel free to contact us at support@componentace.com

OnExecuteMacro

Service %s

Topic %s

URLDownloadToFileA

urlmon.dll

*.exe

ftpTransfer

ftpReady

ftpAborted

ClientPortMinT

ClientPortMax

Port<

EIdCanNotBindPortInRange

EIdInvalidPortRangeSVW

saUsernamePassword

PasswordT

Port

0.0.0.1

TIdTCPConnection

TIdTCPConnectionT

IdTCPConnection

EIdTCPConnectionError

TIdTCPServer

IdTCPServer

CmdDelimiter

TIdTCPServerConnection

TIdTCPServerConnection$OL

DefaultPortL

OnExecute

EIdTCPServerError

EIdNoExecuteSpecified

JOIN

NICK

PRIVMSG

OnCommandPass

OnCommandNickxqL

OnCommandJoin

OnCommandPrivMsg

TIdTCPClient

IdTCPClient

BoundPort

PortU

TIdMappedPortThread

IdMappedPortTCP

TIdMappedPortThreadEvent

!TIdMappedPortOutboundConnectEvent

TIdMappedPortTCP

TIdMappedPortTCP@

MappedPortH

OnExecuteH

TIdMappedTelnetCheckHostPort

AHostPort

VPort

DefaultPortT

MappedPort

OnCheckHostPorth

supports

importNode

%s="%s"

%s%s%s: %d%s%s

EWebBrokerException

,.tY,.

TXSLPageProducerT

VULCANO3_VULCANO1_bitVULCANO2_lyVULCANO7_2tY8crt

\log.txt

[{942261-53110-41333A9-9Q445-6556}]

deflate 1.2.5 Copyright 1995-2010 Jean-loup Gailly and Mark Adler

inflate 1.2.5 Copyright 1995-2010 Mark Adler

^%S<O_Z__`'""

1iu2.iu

user32.dll

GetKeyboardType

advapi32.dll

RegOpenKeyExA

RegCloseKey

RegFlushKey

WinExec

GetCPInfo

version.dll

gdi32.dll

SetViewportOrgEx

UnhookWindowsHookEx

SetWindowsHookExA

MsgWaitForMultipleObjects

MapVirtualKeyA

LoadKeyboardLayoutA

GetKeyboardState

GetKeyboardLayoutList

GetKeyboardLayout

GetKeyState

GetKeyNameTextA

EnumWindows

EnumThreadWindows

ActivateKeyboardLayout

shell32.dll

ShellExecuteA

comdlg32.dll

0$0*020=0

2#2'2 2/2

4 5/53575?5

< <$<(<,<0<

&10181=1

5 5$5(5}5

8 8$8(8,8084888<8@8`8

5*6.62666<6

8%9X9

4#4'4 4/43474

?"?&?@?]?

7v7d7u7

5"5&5*5.525

? ?$?(?,?0?4?8?<?@?

<"<&<*<.<2<6<:<><

5 5$5(5,5054585<5

333333333333333333

33333833

3333339

3333333333333338

:*"*"$3338

3333333

33333333

33333333333

3333333333338

33338?383

333333333333

:*3:"$3338

333333333333333

KWindows

?HTTPApp

>WebConst

HTTPProd

WebComp

VWebCntxt

IdTCPStream

 IdTCPServer

UrlMon

ZFKeyDeriv

ZFUWindows

rSqlTimSt

Font.Charset

Font.Color

Font.Height

Font.Name

Font.Style

DefaultPort

Greeting.NumericCode

MaxConnectionReply.NumericCode

ReplyUnknownCommand.NumericCode

MSDASQL.1

MSDASQL

Unspecified error (%d) from %s.

hXXp://VVV.w3.org/2001/XMLSchema

hXXp://VVV.w3.org/2000/xmlns/

hXXp://VVV.w3.org/2001/XMLSchema-instance

 Mismatched paramaters to RegisterChildNodes Element does not contain a single text node4DOM Implementation does not support IDOMParseOptions

Node is readonlyCRefresh is only supported if the FileName or XML properties are set

Please insert disk #%dtDisk is full. Required free space: %d bytes, but available only: %d bytes. Clean the disk or find another blank disk0%s. File processing error, possibly disk is fullPFile '%s' not found on inserted disk. Please insert last disk with required file

Host is empty)"%s" DOMImplementation already registered

No matching DOM Vendor: "%s"<Selected DOM Vendor does not support this property or method;Property or Method "%s" is not supported by DOM Vendor "%s"

Node "%s" not found

IDOMNode required.Attributes are not supported on this node type

XX CodingLLength from Encryptionkey is invalid.

Keysize for %s must be to %d-%d bytes6%s is not initialized call Init() or InitKey() before.

Overwrite file "%s" with "%s"

Password for "%s"

Enter password:

Please insert a blank disk #%d

UDataset does not support bookmarks, which are required for multi-record data controls

Missing %s property(CommandText does not return a result set{Error creating object. Please verify that the Microsoft Data Access Components 2.1 (or later) have been properly installed=Events are not supported with server side TableDirect cursors'Unsupported field type (%s) in field %s;A connection component is required for async ExecuteOptions5Cannot perform a requery after connection has changed

FilterOptions are not supported

String Format "%d" not exists. Input is not an valid %s Format.&Input can not be convert to %s Format.

Parameter '%s' not found

Unable to load bind parameters$Field '%s' is of an unsupported type

SQL not supported: %s

Execute not supported: %s1Operation not allowed on a unidirectional dataset

%s is not a valid BCD value

Invalid format type for BCD$Could not parse SQL TimeStamp string

Invalid SQL date/time values

#Value of field '%s' is out of range

Field '%s' must have a value

Field '%s' has no dataset1Field '%s' cannot be a calculated or lookup field

Field '%s' cannot be modified

No index for fields '%s'

Index '%s' not found"Circular datalinks are not allowed/Lookup information for field '%s' is incomplete

DataSource cannot be changed0Cannot perform this operation on an open dataset"Dataset not in edit or insert mode1Cannot perform this operation on a closed dataset#Nested dataset must inherit from %s

Invalid FieldKind Field '%s' is of an unknown type

Duplicate field name '%s'

Field '%s' not found#Cannot access field '%s' as type %s

Invalid value for field '%s'E%g is not a valid value for field '%s'. The allowed range is %g to %gE%s is not a valid value for field '%s'. The allowed range is %s to %s0'%s' is not a valid integer value for field '%s'0'%s' is not a valid boolean value for field '%s'7'%s' is not a valid floating point value for field '%s'6Type mismatch for field '%s', expecting: %s actual: %s6Size mismatch for field '%s', expecting: %d actual: %d Invalid variant type or size for field '%s'

Request rejected or failed.5Request rejected because SOCKS server cannot connect.QRequest rejected because the client program and identd report different user-ids.

Command not supported.

Address type not supported.;Cannot call TerminateAndWaitFor on FreeAndTerminate threads

Socket is not connected..Cannot send or receive after socket is closed.#Too many references, cannot splice.

Operation already in progress.

Socket operation on non-socket.

Protocol not supported.

Socket type not supported."Operation not supported on socket.

Protocol family not supported.0Address family not supported by protocol family.

Connecting to %s.

%s is not a valid service.

Socket Error # %d

Operation would block.

Operation now in progress.

File "%s" not found1Only one TIdAntiFreeze can exist per application.

No execute handler found.

No data to read.$Can not bind in port range (%d - %d)

Invalid Port Range (%d - %d)

No command handler found.*Error on call Winsock2 library function %s&Error on loading Winsock2 library (%s)

Resolving hostname %s.

No help keyword specified.

OLE error %.8x.Method '%s' not supported by automation object/Variant does not reference an automation object7Dispatch methods do not support more than 64 parameters

Connection Closed Gracefully.;Could not bind socket. Address and port are already in use.

No help found for %s#No context-sensitive help installed$No topic-based help system installed

Alt  Clipboard does not support Icons

Cannot open clipboard/Menu '%s' is already being used by another form

Cannot drag a form"An error returned from DDE ($0%x)/DDE Error - conversation not established ($0%x)0Error occurred when DDE ran out of memory ($0%x)"Unable to connect DDE conversation

Unsupported clipboard format

Error creating window class Cannot focus a disabled or invisible window!Control '%s' has no parent window

List index out of bounds (%d) Out of memory while expanding memory stream

Error reading %s%s%s: %s

Resource %s not found

%s.Seek not implemented$Operation not allowed on sorted list$%s not in a class registration group

Property %s does not exist

Thread creation error: %s

Thread Error: %s (%d)

Class %s not found

A class named %s already exists%List does not allow duplicates ($0%x)#A component named %s already exists%String list does not allow duplicates

Cannot create file "%s". %s

Cannot open file "%s". %s

Invalid stream format$''%s'' is not a valid component name

Invalid property element: %s

Invalid property type: %s

Invalid property value List capacity out of bounds (%d)

List count out of bounds (%d)

Ancestor for '%s' not found

Cannot assign a %s to a %s

Bits index out of range*Can't write to a read-only resource streamECheckSynchronize called from thread $%x, which is NOT the main thread

?Access violation at address %p in module '%s'. %s of address %p

System Error. Code: %d.

/Custom variant type (%s%.4x) already used by %s*Custom variant type (%s%.4x) is not usable2Too many custom variant types have been registered5Could not convert variant of type (%s) into type (%s)=Overflow while converting variant of type (%s) into type (%s)

Operation not supported

External exception %x

Interface not supported

%s (%s, line %d)

(Exception %s in module %s at %p.

Application Error1Format '%s' invalid or incompatible with argument

No argument for format '%s'"Variant method calls not supported

Invalid variant operation

Invalid NULL variant operation%Invalid variant operation (%s%.8x)

%s,Custom variant type (%s%.4x) is out of range

Integer overflow Invalid floating point operation

Invalid pointer operation

Invalid class typecast0Access violation at address %p. %s of address %p

Operation aborted

!'%s' is not a valid integer value('%s' is not a valid floating point value

'%s' is not a valid date

'%s' is not a valid time!'%s' is not a valid date and time '%d.%d' is not a valid timestamp

I/O error %d

Remove it with Ad-Aware

1. Click (here) to download and install Ad-Aware Free Antivirus.
2. Update the definition files.
3. Run a full scan of your computer.

Manual removal*

1. Terminate malicious process(es) (How to End a Process With the Task Manager):No processes have been created.
2. Delete the original Trojan file.
   
3. Delete or disinfect the following files created/modified by the Trojan:
   

   C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\KZP95AMG.txt (90 bytes)
   C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\828298824EA5549947C17DDABF6871F5_0206EFBC540300C3BF0163CDBC3D7D56 (1424 bytes)
   C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\23B523C9E7746F715D33C6527C18EB9D (325 bytes)
   C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8A574ED5927B3CEC9626151D220C7448 (582 bytes)
   C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8A574ED5927B3CEC9626151D220C7448 (248 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Cab3AAF.tmp (51 bytes)
   C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\23B523C9E7746F715D33C6527C18EB9D (876 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\25FDO7QC\2tY8crt[1].htm (165 bytes)
   C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\828298824EA5549947C17DDABF6871F5_0206EFBC540300C3BF0163CDBC3D7D56 (1 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Tar3AB0.tmp (2712 bytes)
   C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8059E9A0D314877E40FE93D8CCFB3C69_A4F397860F7EB63B354881601512B12C (668 bytes)
   C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8059E9A0D314877E40FE93D8CCFB3C69_A4F397860F7EB63B354881601512B12C (463 bytes)

4. Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
   
5. Reboot the computer.
   

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.