MD5: c3a8ed2b3039e682d74e89eb21ebc57c
SHA1: ae41cead65651fd738f6274d136c8afffd0d7842
SHA256: 4ccf69b7a3d9efb17434a0adc5125ebb47bece5f96e59ee476908d67ae9cac10
SSDeep: 24576:x7el XMBNaHt2dLl898AwV6Od6DpMxs0mUCJ:x7CAwaUdh83wUO0MeLL
Size: 1158112 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: BorlandDelphi30, UPolyXv05_v6
Company: no certificate found
Created at: 1992-06-20 01:22:17
Analyzed on: Windows7 SP1 32-bit

Summary:

Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).

Payload

No specific payload has been found.

Process activity

The Trojan creates the following process(es):
No processes have been created.
The Trojan injects its code into the following process(es):

%original file name%.exe:2604

Mutexes

The following mutexes were created/opened:
No objects were found.

File activity

The process %original file name%.exe:2604 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH33633812990\images\Grey_Button.png (808 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH33633812990\css\sdk-ui\button.css (417 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\000521D2.log (8 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH33633812990\images\Close_Hover.png (207 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\in364BB553\27254D51_stp.EXE (258379 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH33633812990\images\Loader.gif (10 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH33633812990\images\Grey_Button_Hover.png (818 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH33633812990\css\main.css (8 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\25FDO7QC\webcammax[1].jpg (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH33633812990\images\Quick_Specs.png (221 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH33633812990\locale\CS.locale (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\QGTKGB9M.txt (125 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH33633812990\images\Progress.png (104 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH33633812990\images\Resume_Button.png (718 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH33633812990\css\ie6_main.css (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH33633812990\css\sdk-ui\images\progress-bg-corner.png (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH33633812990\locale\JA.locale (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\in364BB553\27254D51_stp.EXE.part (4422 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH33633812990\images\ProgressBar.png (812 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH33633812990\locale\EL.locale (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH33633812990\images\Color_Button.png (808 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH33633812990\locale\NL.locale (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH33633812990\locale\EN.locale (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH33633812990\css\sdk-ui\checkbox.css (190 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\0005228D.log (16 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH33633812990\csshover3.htc (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH33633812990\images\Close.png (207 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH33633812990\form.bmp.Mask (244 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH33633812990\css\sdk-ui\images\progress-bg.png (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH33633812990\css\sdk-ui\progress-bar.css (506 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH33633812990\bootstrap_20918.html (156 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH33633812990\images\Color_Button_Hover.png (818 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH33633812990\images\text-bg.png (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH33633812990\css\sdk-ui\browse.css (337 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH33633812990\images\BG.jpg (27 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH33633812990\images\Pause_Button.png (577 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH33633812990\images\sponsored.png (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH33633812990\css\sdk-ui\images\button-bg.png (131 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH33633812990\locale\ID.locale (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH33633812990\css\sdk-ui\images\progress-bg2.png (978 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH33633812990\images\Icon_Generic.png (1 bytes)

The Trojan deletes the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\000521D2.log (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\0005228D.log (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH33633812990\bootstrap_20918.html (0 bytes)

Registry activity

The process %original file name%.exe:2604 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKLM\SOFTWARE\Microsoft\DirectDraw\MostRecentApplication]
"ID" = "708992537"

[HKLM\SOFTWARE\Microsoft\Tracing\c3a8ed2b3039e682d74e89eb21ebc57c_RASMANCS]
"FileTracingMask" = "4294901760"
"ConsoleTracingMask" = "4294901760"

[HKLM\SOFTWARE\Microsoft\Tracing\c3a8ed2b3039e682d74e89eb21ebc57c_RASAPI32]
"FileTracingMask" = "4294901760"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 3C 00 00 00 09 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Microsoft\Tracing\c3a8ed2b3039e682d74e89eb21ebc57c_RASMANCS]
"EnableFileTracing" = "0"

[HKLM\SOFTWARE\Microsoft\Tracing\c3a8ed2b3039e682d74e89eb21ebc57c_RASAPI32]
"EnableFileTracing" = "0"
"EnableConsoleTracing" = "0"

[HKLM\SOFTWARE\Microsoft\Tracing\c3a8ed2b3039e682d74e89eb21ebc57c_RASMANCS]
"EnableConsoleTracing" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKLM\SOFTWARE\Microsoft\Tracing\c3a8ed2b3039e682d74e89eb21ebc57c_RASMANCS]
"MaxFileSize" = "1048576"

[HKLM\SOFTWARE\Microsoft\Tracing\c3a8ed2b3039e682d74e89eb21ebc57c_RASAPI32]
"MaxFileSize" = "1048576"
"ConsoleTracingMask" = "4294901760"

[HKLM\SOFTWARE\Microsoft\DirectDraw\MostRecentApplication]
"Name" = "%original file name%.exe"

[HKLM\SOFTWARE\Microsoft\Tracing\c3a8ed2b3039e682d74e89eb21ebc57c_RASMANCS]
"FileDirectory" = "%windir%\tracing"

[HKLM\SOFTWARE\Microsoft\Tracing\c3a8ed2b3039e682d74e89eb21ebc57c_RASAPI32]
"FileDirectory" = "%windir%\tracing"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"
"ProxyOverride"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"

Dropped PE files

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

VersionInfo

Company Name: Comabob
Product Name: Hoperal
Product Version: 5.6
Legal Copyright:
Legal Trademarks:
Original Filename:
Internal Name:
File Version:
File Description: Hoperal Setup
Comments: This installation was built with Inno Setup.
Language: Language Neutral

PE Sections

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Total found: 8
2478360764c8fd42de15eb955a6dfa32
ede729b39ed1ac99c034a4fd68d191ab
3674560952ced607f2a8c00721bf538f
dec72da776e044fd213f817e71e649f8
96fe2aa69c13b5efd2d6365308dd6495
6532288b824aee9878f10cb79be8b013
a80baca830fd203522dc6d703f62e4a2
7de6a9015ae1a7fcdf54a162694d8ed4

URLs

URL	IP
hxxp://info.downloadastrocdn.com/?v=1.03&c=747cb4ef&at=1301533066&cntr=0	52.212.198.18
hxxp://rp.downloadastrocdn.com/?v=2.0&subver=6.21&pcrc=1288620391	52.30.100.116
hxxp://os.downloadastrocdn.com/DownloadAstro/?v=6.0&c=1291581036&t=337398	52.17.193.140
hxxp://images.downloadastro.com/downloader/id/webcammax.jpeg	104.25.53.103
hxxp://download.webcammax.com/webcammaxcur/WebcamMaxSetup.exe	72.14.183.252
hxxp://rp.downloadastrocdn.com/?v=2.0&subver=6.21&pcrc=1658363155	52.30.100.116

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

ET MALWARE Win32/InstallCore Initial Install Activity 1
ET POLICY PE EXE or DLL Windows file download HTTP

Traffic

POST /?v=1.03&c=747cb4ef&at=1301533066&cntr=0 HTTP/1.1

Accept: */*

Host: info.downloadastrocdn.com

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; Trident/5.0)

Content-Length: 172

Cache-Control: no-cache

6l7GU7LYt04pVHc/00d7Jq3echfF9QCpjdqI9kfl18zV6SwOfNODsQqxM55DZM h8QJKpu7mqJ5d0wjNI6lm1P8AtlL1XMmjfdRU/ut2mad620/zL5ylk/hMflggI4pGRj ZkX5UEHl98MmxRYPBY3zmBlMCOt87n6fN1fwx2Gc=
HTTP/1.1 200 OK

Access-Control-Allow-Origin: *

Content-Type: text/plain; charset=utf-8

Date: Sat, 09 Sep 2017 00:26:29 GMT

Content-Length: 1152

Connection: keep-alive
z9HhcyqDBkQg mT3pXx4leVT1Yn4z0DBfI9AIhTdGrBv6Hc7/aAarbKKO4fIdkyBfFKWqr
qnwfbpOPeXOEJLyULLgsrkx4e6Uf1BULvawE0h0Vo8VDrufFwGjeP HDB3vst PZI8rUoY
hu4uoagrHJTgaQvvRKhbtZtZfU3V/sdIOmJClk79y98xUYCcbi UDH9Y82Mf/a9X8lbGpv
ljX6wEaY0p9tUIOBKehu8hBwfqln4NkxmcCjWwVRnWBvd1bbpglDa0cVh8C/6dyJxeC5yR
gJb6WpvZCBtaujm3of4I8XLl/L7pq2ToRkeQvj4aX5A0x3ydgqfZg1tN4vKgavSU1VkdeO
jHxfCWvY1a8yMIPgOl2y3BowS5BiQXuKJAjuEQDIfcYPYYghTqmlE0/0EYIBRngqblM05F
M/RzBtIeP7ntVVuL860tcofq3tD/kT9KLg0Iw7K2aa714SsNdODohTuL2IuaHzk7GJSnrZ
hTH0iY5 RAaMKX4eUVOj h5mG3YlftS YC7XtW RE8KPeelpru5TXBEi7x3a078GKIKZob
lnbT5DXBcbq2XM/NGa5Qu/bTANuVdVG3RakTFAPvolWj GDSxYpjJuuL0L7/icU2h0uJ/i
LydDh4nk4fIzQV2V5Wor/XKkcnd16tROe1J21oIKIxF1RkwJh8xDNlrUbDpV7mHzwouqtW
UKffYA4ZrpI 6WiAp/DDCtvZ9r2W5xKNHPVbG6IOJLwod5KkL6pzpjdKtBuelvuq8dHcC5
S6EPfb6F7tAk8Mozp1UG0SHlVnZYE50gegHFyaR3677Nh9sxeeS7EYhElbKjyDEblu21Du
VLQgm7iwkTeH A wBrlJEFm95gzHmQGkWVqlaeNLqLwCQJ/eC NAsQD2iPd6XKvtNyapLg
xsVA5Opkj8YB8L6yb3oAH87iRUGEjrJhfN3X3c/4PfIZp87DoKwiDsBqz2zbUyNZKrNNRL
La0ZU6Eksslm6EXoPZFfwHbBp2RjN6zLSmvAK SOhy h1kk6mli wDkGnB7GmLlc/7CKke
9xc0J4Z93X7K8YrVWlrCAdIamdH3NAQHBWvCbN5DaZ348EeHiealQo8guz6d8Fc2 Ud pr
9HQV7EfOpB CdL 9vuI5LOIiSEQ6F5amHTTP/1.1 200 OK..Access-Control-Allow-
Origin: *..Content-Type: text/plain; charset=utf-8..Date: Sat, 09 Sep 
2017 00:26:29 GMT..Content-Length: 1152..Connection: keep-alive..z9Hhc
yqDBkQg mT3pXx4leVT1Yn4z0DBfI9AIhTdGrBv6Hc7/aAarbKKO4fIdkyBfFKWqrqnwfb
pOPeXOEJLyULLgsrkx4e6Uf1BULvawE0h0Vo8VDrufFwGjeP HDB3vst PZI8rUoYhu4uo
agrHJTgaQvvRKhbtZtZfU3V/sdIOmJClk79y98xUYCcbi UDH9Y82Mf/a9X8lbGpvl
<<< skipped >>>

GET /webcammaxcur/WebcamMaxSetup.exe HTTP/1.1

Range: bytes=12390400-13209599

Accept: */*

Host: download.webcammax.com

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; Trident/5.0; ICDM 2.1)

Connection: Keep-Alive

HTTP/1.1 206 Partial Content

Date: Sat, 09 Sep 2017 00:27:14 GMT

Server: Apache/2.2.21 (CentOS)

Last-Modified: Tue, 22 Aug 2017 02:51:09 GMT

ETag: "30095-18f1193-5574eaad98140"

Accept-Ranges: bytes

Content-Length: 819200

Content-Range: bytes 12390400-13209599/26153363

Connection: close

Content-Type: application/octet-stream
.9?cr.$Mt.RG.......Z.....,....H.n.W2.q.....z3~MM.d......c0..E.R.B....a
....Q........"..........5.G.h..h.rqq$h....yT.<....c.cG.8.J./.i..F..
......"....B....._l5=.:)..x.._....u.x.4....DZ..........i.....{Q..x..1.
....~.G..Z.h.b....h..^.......p.qM.Z...eTkB...I=..g.7...z.....~..U....i
 .....X9....T0.f....A...X...6.32..B.t.Y|-S........q...}.q....s.'Be..n3
~....{.rH..4jT._.iHZ..%.U..d...\[....d9;".. .... .P).K.........^....0.
...0|Y.v...q7.>, Wo..~.@^.......j..&...aq..Gn...}.!.mC...v.r..'P.Z{
.M.N....>]j."..g..........=..-.a.2..c.z..??V,..J.L.?O.%...R..z$b..b
..{...y.:5.. <.......vD._i S..!..~....'[d..J...vx..f.....Z.x05J...1
...N.v....z: .j.......Jid.T.<m..F....%..z..M..G.....>..<.@t..
..q...*."7.p.].....<......G7.....pJ....=V.I~6.......3..4p....xg....
f.=...H.5...{...8...K.....v..%.4.*N>....F.?.0h}D..76$r0.....u..{;.m
..9G. V..W..L\A....l4)D...w.G...t......\d0~...s."..^.._V..b[...0..2a..
.......C&.u....I.....d..c..ZKYZ..~...........<........@h..0....&.zS
..t.}.}...0U^C.(..a.....!.).z.~.7.U.<.jv.........z..H.#m....M...f..
..] ..Ac.L&......='O.... U.w.dR..p.0...:.(l@..L.9...-.....I$..r..zW.w=
..?i56.5.[)..U...5P.e.......?.LI.s...]D.D[/o..L".F.g1k...jO.......h..B
.Y....*m..|..C....../..&....<....~.\.tt4[e......w..}..G.....1v5c...
Pl|.CH....(..ye.........k.A".6{........fY}dT*  T....goRb).....z...F..a
 ......l>.li.%I.....>.,.q.~t.....5..gD8.....?N.i[..Y`)..R.E..W.E
....Q`ji.....f2Y..IE.....4uP.ci..cv..K.lrd(.XCx@9.....M.l......z#.E\&.
.T{..C...{=.. |..z...J...U...4.....[.$.Qw....n...u.U2.|.v...r..t;.
<<< skipped >>>

GET /webcammaxcur/WebcamMaxSetup.exe HTTP/1.1

Range: bytes=0-26153362

Accept: */*

Host: download.webcammax.com

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; Trident/5.0; ICDM 2.1)

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Sat, 09 Sep 2017 00:26:33 GMT

Server: Apache/2.2.21 (CentOS)

Last-Modified: Tue, 22 Aug 2017 02:51:09 GMT

ETag: "30095-18f1193-5574eaad98140"

Accept-Ranges: bytes

Content-Length: 26153363

Connection: close

Content-Type: application/octet-stream
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..i
u..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i..................
......PE..L.....*J.................\..........<2.......p....@......
....................0...............................................s.
..........N...........................................................
................p...............................text...ZZ.......\.....
............. ..`.rdata.......p.......`..............@..@.data........
........r..............@....ndata.......@...........................rs
rc....N.......P...v..............@..@.................................
......................................................................
......................................................................
......................................................................
......................................................................
...............................................U....\.}..t .}.F.E.u..H
.....>B..H.P.u..u..u...Hr@..B...SV.5.>B..E.WP.u...Lr@..e...E..E.
P.u...Pr@..}..e....Dp@........FR..VV..U... M.......M....3.....FQ.....N
U..M..........VT..U.....FP..E...............E.P.M...Hp@..E...E.P.E.P.u
...Tr@..u....E..9}...w....~X.te.v4..Lp@....E.tU.}.j.W.E......E.......P
p@..vXW..Tp@..u..5Xp@.W...E..E.h ...Pj.h.6B.W..Xr@..u.W...u....E.P.u..
.\r@._^3.[.....L$...>B...Si.....VW.T.....tO.q.3.;5.>B.sB..i.....
.D.......t.G.....t...O..t .....u...3....3...F.....;5.>B.r._^[..
<<< skipped >>>

POST /?v=2.0&subver=6.21&pcrc=1288620391 HTTP/1.1

Accept: */*

Host: rp.downloadastrocdn.com

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; Trident/5.0)

Content-Length: 2432

Cache-Control: no-cache

...4.....>.K..~..}...0..5..i..M.c...{..VM....T.c.]....~.6..j....O%..1..u/..&....z.....FG..J.
F.uy....
..*w.A..Ng.I.@V..:.a%}...% .......i.p.#U...TZ..D...~{.Pi.......K...#|..`.3.Xek.P.....kC.9]eV..k.^^..s."LqV.N:...5i?/*u.u..-.B..~.7A>...i.....x.[..~t.h..L..9Fn..W.v....0....H.)..3`U y.\I.
.sP.m...2...@......a....b)..^...x.. y..?)..WE:".E....V.P..T7<.........7..

fwb<..._.A.BWk....?(.]...[.QE"...a.=..J.. .*.E7....Y.<=|.C..........Q.O..-..Ug.

.{..M.....%..U..J..]............{..o......Nw....Z.../.&...%1..*wBC..>.v..W...n..........EI...K~ZPnu..RJ%.....@A.sD6D.b.h*|

X....y,g.3...$../E.$&..Axr.A.8:.....(.F.s...>..6gT..\....&}6.....K.4..l...]m..........AA$..".....a...L....x-..?x .P..A..~..q_
j.
r......N.....o.p..Q....p....g.......R..AN........zX..6hT............w......c.J....-U6..r...;e..X..S.,....K.....B...9.<..!Ywf..LZ..?:.e...o.t.c.......w.1h......y1. ..S.....'.F. .....f.u..E...
..g.'...GL..Pwjl"..o4.N._......}..0...Hg....`J.`.

.S$.rH..&...v5.-.b.2)v..ld...%.....e9>.._X;....g.L$.....-.E.......on.a..R.\.....d.;.

.

.

....u.......uE.N(_......XE.0..s.z..].6.Ru...q. .M.P..e.
-.0..H...

.........0Tv..s......u6..I.{...:.Y.....~..~....j.._...|..",..E..&...}..5o..G........ ..S...>.......).t"......W.q{.;.=;A...w*...c......S......Z..b ..,&.d.fYt..DIxYh.....;..Pw.1Gi.T.
HTTP/1.1 200 OK

Content-Type: text/html; charset=UTF-8

Date: Sat, 09 Sep 2017 00:26:30 GMT

Content-Length: 4

Connection: keep-alive
DONEHTTP/1.1 200 OK..Content-Type: text/html; charset=UTF-8..Date: Sat
, 09 Sep 2017 00:26:30 GMT..Content-Length: 4..Connection: keep-alive.
.DONE..

GET /webcammaxcur/WebcamMaxSetup.exe HTTP/1.1

Range: bytes=13209600-26153362

Accept: */*

Host: download.webcammax.com

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; Trident/5.0; ICDM 2.1)

Connection: Keep-Alive

HTTP/1.1 206 Partial Content

Date: Sat, 09 Sep 2017 00:26:34 GMT

Server: Apache/2.2.21 (CentOS)

Last-Modified: Tue, 22 Aug 2017 02:51:09 GMT

ETag: "30095-18f1193-5574eaad98140"

Accept-Ranges: bytes

Content-Length: 12943763

Content-Range: bytes 13209600-26153362/26153363

Connection: close

Content-Type: application/octet-stream
... .1;7xi....6?~. .....qf..3..].`a[.......#N 3...C@..t.%m.,3 30f.x`.'
...>M^.<.HZ......W..[o.Dpx...*.8..h."H..../%u..#...<MhN<."
.5,.......'....P..S.x......(9....E.^H.L......b..wGS%...rW.8c...:..Y...
.7.MXc..I...3.B..4$&....6....;xk..L........]..!..f.i......a....x%..)..
r?[_).~..p.fwF.....$.Nm.....;.......T&..H.....&.(...5g......H...../._.
..U"2..........S..4..SW....>}{.......D.l-.W.......*2.8.=.%c...`xH..
R1.j.C$.v....7^..-..E....6.dgS......;...;~....I.7-...q!...$..6on....pl
2.x....F'5.C.ZW..wsZ..$"..._.7.e....i#.I.Q.4.`..=P. -.....h..(./.Q..D.
(..X7@h!...Meu.]...............H.....p......]8.7.]).Q...].&...... ..0`
......7p...r.._zqd.t.I.q......J!..x.B{:....!t..c....I..{....]f8.FS....
..r..s.}..........K.x....@...W,E.?.Z..=....K..2B...N.v...g.A....Y.F~s.
..`....k..U`......h.o3......2A.......^S.k..cR.....(J.....N7.....dA....
.....2....>.'E...K..d.sK..y.O%QX...m.XT..I..-.^...g7..!.._..{."...[
....... .....j.!..dvI\...7.p...gT..!.......v........k6.._.`......r....
hB ...9..2T...Z..u.;..u7....w.=.....)^2..&.....N.-.v>{N.L.6.ct..M=.
R.%...9Uk.\./mhx.[...Z...F.k...Jo........h........"7........=.LS....6.
..:......"e.).."... ...,..s:@..$.(.....n..Ol.......@m...]..8C1P.&...z.
{.;X;...O$."M...j........1A...$..D.B[......o.t.\....g......5C.`....t..
..C"-...R}.`..d..h..D.S.;..V)..V$...o...Y......k...p].9Y~..5GF.....I..
a.......>5..?j..v?.I#e_.M.....C..i.5b.=,....A_`....S$A....$5Y"v....
#il(/I2..5.q...SP..0.._.v...v].c...!...v'..kM...;...=M.[...e..>..X.
.d..`............T]..m9.].......*@-.0..L...M..A..'B$.7.....J"....$
<<< skipped >>>

GET /downloader/id/webcammax.jpeg HTTP/1.1

Accept: */*

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: images.downloadastro.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Sat, 09 Sep 2017 00:26:30 GMT

Content-Type: image/jpeg

Content-Length: 2528

Connection: keep-alive

Set-Cookie: __cfduid=d05a86abb70dbd767dfda1b43ab2d17fe1504916790; expires=Sun, 09-Sep-18 00:26:30 GMT; path=/; domain=.downloadastro.com; HttpOnly

Last-Modified: Sat, 11 Jun 2016 17:08:37 GMT

ETag: "42e6c4ba87269dcdae46c86f9e5ae94e"

Cache-Control: public, max-age=432000

X-Cache: Miss from cloudfront

Via: 1.1 6fe4f291bdbb60b59b125730d90a7eff.cloudfront.net (CloudFront)

X-Amz-Cf-Id: uso9IBlHxwB2v_N-9uRN6wSmSd6cwA4WRXXrKiBJOVDmG5RqARCpjQ==

CF-Cache-Status: MISS

Expires: Thu, 14 Sep 2017 00:26:30 GMT

Accept-Ranges: bytes

Server: cloudflare-nginx

CF-RAY: 39b6043317d58442-KBP
.PNG........IHDR... ... .....szz.....pHYs.......... ......IDATX...i..U
......o_f&3.!..d....!...P.)((P..Dq).#K..........".P(D..2.JA..(h `.H..0
Y....{........`$,...|..u.....9u.m._7...Z...D2.FJ..vc}.q....t*..t.\UU3.
..{lbr.}..K.n..o..y..T.F....;.0...>.R.D..&d.S....j..P...fB.....4M%a
...9....vv...~.Z:e.85U...X...."8{.'.X...o0.......c...<{...O.O;...?P
.:..^..((.)....6.b5m.}..m......~.y,X...&.v......./.l.39.|_..q.:...4..9
...o.>w..u....yR....C...i..:]...x....6.uZ.9...N..{y...(..L.... A.TH
&M......V_.K..n....E-9..$..Qi.4L.b@.0.E....*>..u*.....<...d... .
M.g......P ..qd..$.:.....qTG.yy.M../..s..J...,.X:..CZM..M.[-.\\......{
...y..(........S.d.4..?x..G\.Cz..X.na%.D....~.x.y..?.72..X..i[...V....
.0T....6..mh.go.&.....A..q.. ..~...Z..m.....y....s.Y.f....&.......4..u
q].F..V..Z..:.:...D......].z.xk........?.V....m..c...........].r...X.Q
qW~...u.v..6E}z...0.W..=.{...W.!/o:...x..cb..... ''.W.z.(u..t.......IJ
..N[......U.*.B.!].9<@..........e#..O..x.8...O ...i.G.A....<>
J..).....(zb.......J.....\..t:u...}.c.........1...l..., .\...#..9...h.
............j......v.....WWZa.....IEND.B`...
<<< skipped >>>

HEAD /webcammaxcur/WebcamMaxSetup.exe HTTP/1.1

Accept: */*

Host: download.webcammax.com

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; Trident/5.0; ICDM 2.1)

Content-Length: 0

Connection: Keep-Alive

Cache-Control: no-cache

HTTP/1.1 200 OK

Date: Sat, 09 Sep 2017 00:26:32 GMT

Server: Apache/2.2.21 (CentOS)

Last-Modified: Tue, 22 Aug 2017 02:51:09 GMT

ETag: "30095-18f1193-5574eaad98140"

Accept-Ranges: bytes

Content-Length: 26153363

Connection: close

Content-Type: application/octet-stream

POST /?v=2.0&subver=6.21&pcrc=1658363155 HTTP/1.1

Accept: */*

Host: rp.downloadastrocdn.com

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; Trident/5.0)

Content-Length: 1984

Cache-Control: no-cache

...3E.Q)_l.y...K.1>Q.9v"..0....AZ.g.....6.t=..h%g.&[.$...}\...\...=l.KeM.<......c..=...............#T..e...\.....?.U......s..{.p..IQ4.i2..T.x.....2y&..ke....X.iY.6..vv.2..|..c.m.$0^=p...}r....*.hFN.........w.Dgv.].].i.
..nz..m..G&....1.K

.J..L.
..."..3..|.<.2...K.J.&y..vM{*l..l.2...s.My.qI.l}....c..[O

...b(..l.a....x......q;.Y [....
us!f7.....@.6..P..Z..].... ..@G....4.@i..i.s.....|;.il..t..<....d.mg........-??.JS.Nw..?\....T.RR.O$...G5{M....&tH1..Mr.1..g.(....{.{7.^[ Jl.s.'}...Y.C..q.".t:%.M.pS~J........ ..{-....u..ku...-.
`..).A.Va.....].......<,..t.HUA...T......d.WJsu2..X..V.\....K....D....X..OI..e....n

.~..&...>s...t)......nG.D.. 1.......|...X^..&..).......i.g...1.. . .V..m.&...ft.....L|^J!..KG.....K{s.l!...._'oY...o<Dc......TY...Kd.<<.7....g....3ph(..%..cX...5....y..0=p#.......d...,L..hI..W.];..."z9...L.SERQ..~..v#6......T.A..........u ...kx.u..._.PxU$5......#...D..W4..I....3....~I.%s...w....g..F9..[T......e..4...[B.B.3.
...Jl.?H..'...../..u..|}.yG.Qa.....!.]h... ..R.MF...x..uc..{...p@|.b)!...~.`.b...O.........X-z.PBH..A..y.:.z./..D96o...Z..&.|..'.... .GZz...Q.N..c.-...
..._..t..Vt...."l..G\b...U...../....>...5..ZH............:..4.w._.t.M...q.7l}......N...k.AF.......5..9.IT&p...p..>..hi.b.v..}*....2..R.}.0..............5..i.v..u9

FS.1...2.. ...9^...
HTTP/1.1 200 OK

Content-Type: text/html; charset=UTF-8

Date: Sat, 09 Sep 2017 00:26:32 GMT

Content-Length: 4

Connection: keep-alive
DONEHTTP/1.1 200 OK..Content-Type: text/html; charset=UTF-8..Date: Sat
, 09 Sep 2017 00:26:32 GMT..Content-Length: 4..Connection: keep-alive.
.DONE..

POST /DownloadAstro/?v=6.0&c=1291581036&t=337398 HTTP/1.1

Accept: */*

Host: os.downloadastrocdn.com

User-Agent: ICAS

Content-Length: 1408

Cache-Control: no-cache

.I..~...$$..........$.lq..l .7x.HJB..Q..H......af.....}.k.b..l....Z}....d~.c....j..........pU.r>.X..o..M..tt.~u....=.......9.v...9I........J.G~3..7..[......#

D......$...s....F.7`E.:..Y(. .j%'d....8X(.J.......@Zt.6..g.y\.|.l. .g"G.....Th|..H..U.NB...1.(E.0?j.E....F#... ..M. V....[..6TD.2...xJ......E....J.....X...-....cL.2.....u...m.W@."....^F.eV..>.D..KL....I"!}...[..[7..k".2.5.{....Y.>......9..c.x-F7..W.....

u.%...o.A..V.)N@./n^m...mp..S..o/...p....qM..........s...oBDV.;.Q..9...b[....Q...e...#..d.2.1..Ya....,/...7o.A.....O.P.9!a...z3..p..z......#..|...X..(.\

I...~....@X.:.E/...>..`H.E..L....n`u...9)....@.*K.m0./..I5.I".j.c.

3.

H...2kV.8.>...>.8~/...u..."Z.?..}akQf/2.8.C..O..Z.,..x.s..|..L.vA&9F.,...].... ...........G>.B-.^.-oQ.^.{(.[']..WR.A.d.....OI1..x..GOq=JTd._Y....R^#.],..T...c7uyw..N.....!".lC..&..Q.W.#(9'.F@./.........@.....{....:..&5.....o ...B..

.. ..9.M8....X....z}.z?..-.b)....}.M1..y............DF...b0E.f..q..D.8$.s...zQ..fds]..P.......V./*.N.V....!.0BH.-.j.w{.mW.P....Q....8.q...*..M|....ni. .q....s....V.....|.U-...[.;6.....B<<..v..%j.u..La...".Z..M@#...2(:..7.[Mt..%^N.....6...Q..z..QD.L.....P@...;...T~....\. ..O....Q..AH<J..a.0.....I.X:.@......A.V..V!.2....N..j...0<f..B.uprw;s?....F...h...|W...RYpj)=U;p..S...s..]A.H...G....$........`.)....0.....I..'...=Q/$.gAC.I,z......S.4...~w..!..SYiS..
HTTP/1.1 200 OK

Cache-Control: no-cache

Content-Type: text/plain

Date: Sat, 09 Sep 2017 00:26:30 GMT

Expires: Thu, 01 Jan 1970 00:00:01 GMT

Server: nginx

X-ICSCT-CC: UA

X-ICSCT-GICSET: 13718icuthotfixCSAImported

X-ICSCT-IP: 194.242.96.218

X-ICSCT-ISP: Pitline Ltd

X-ICSCT-ORGANIZATION: Pitline Ltd

X-ICSCT-SERVER-NAME: ads-slave-173-production-eu-west-1-i-01fb83e82cc1a03b8

X-ICSCT-TIMESTAMP: 20170908192630256

X-ICSCT-VERSION: v1.7.3

X-ICSCT-XC: 1f3cfb072bc5ded412eb0f20eaa0b3fa349c056a

X-ICSCT-XS: 91bba9083b637bbb85f2bc525458ea3d2e0cb405

X-Powered-By: PHP/5.5.38

X-Robots-Tag: none

transfer-encoding: chunked

Connection: keep-alive
2500...fQ}..Y}......z.y..@..S...J5m.Y.ll.|..[dS.....ee..y...uE....].s.
..j..`...!=^<..;...Y<E.......q.-...R.@.RQZ.}.|..s....i...."...v.
..l.:>........b.XX.{.v..=&..3.7...d.J....4..E.4 . .......7...}...W.
.Rlf...6... ....b..6......]._.6B.7....P2KEB2zZ.V..._`@6B..*qc.zBr.j...
8....@.....=.T.jh..2..B...~2*~.{.g..&P. .#..p....0.>.....=..2B!aB..
df@..Sd..qNS.3..;....TG[.......#P^.b.CWFq..%......:.F..,P....'Bb.V..8.
..O......l[;.......7...h".VNG... ..[....VzpQ.......J.N..Cz.P......'V..
.....I..;p..s...J./:._._.........l.D...T&l$1........ 2>....@qs.....
v\..0.u)..<.....jT{nfy...}$#.3..L......(.6_>VxjN....... ...4.g.)
&.b..k..?.F..y........{.D..b.........Lpu...C.....x..&..!....).H.K..4'.
......i.t..&.......(.?.7...B$aX..@...c.......G.*b.@.,<R......s.CP..
B...~j..8w...b#..l/fT..Dd.7L`....F.Z..(..}1P.waE.;V.a_..4...).=.......
BbU:G^..@.}.:..Z.........b\......;.V}.............Q7f.F...~..J...D.M.Q
...x.L...*.N...''...u..wXY........r..y..`n..tpv...y.=......b.....a...[
.9.|.;..:.(....i.h.....Z3.....a............S.I...{...I,`.o...4d.W..d.w
\..{..r.6.....DB.....P..Cg..#1...?@].N:!..7..;0c........b..L8...>07
[.wE,..L.j6..;b...p/...j...!5@.'...."..R=.!..L .P..6...*.W........2Z..
.e..:........?a..X..J*...2;...U.9.o'.X........g.....8....:!.1..T...{do
D..2".?....&...$Gr...4#%..Q..{.. @~X..4..{Z/..<=.....0x.c./.?......
..&..Q......fA..'.o!...EK..1........&.1..I.......<l.>.q..$'...Q:
..S\..2.......b'Z.g11..........D..O .......U...O...O.S.......{....S...
.:.....=....nu.U......E@.._A..e.o.#.>.iA\.S3......?..$:..G..2.&
<<< skipped >>>

The Trojan connects to the servers at the folowing location(s):

.idata

.rdata

P.reloc

P.rsrc

kernel32.dll

uxtheme.dll

userenv.dll

setupapi.dll

apphelp.dll

propsys.dll

dwmapi.dll

cryptbase.dll

oleacc.dll

version.dll

profapi.dll

comres.dll

clbcatq.dll

.DEFAULT\Control Panel\International

File I/O error %d

lzmadecompsmall: Compressed data is corrupted (%d)

lzmadecompsmall: %s

LzmaDecode failed (%d)

shell32.dll

/SUPPRESSMSGBOXES

/PASSWORD=password

Specifies the password to use.

For more detailed information, please visit hXXp://VVV.jrsoftware.org/ishelp/index.php?topic=setupcmdline

/SL5="$%x,%d,%d,

Inno Setup Setup Data (5.5.7)

Inno Setup Messages (5.5.3)

mu2.iu

user32.dll

oleaut32.dll

advapi32.dll

RegOpenKeyExA

RegCloseKey

GetWindowsDirectoryA

MsgWaitForMultipleObjects

ExitWindowsEx

comctl32.dll

name="JR.Inno.Setup"

version="1.0.0.0"

name="Microsoft.Windows.Common-Controls"

version="6.0.0.0"

publicKeyToken="6595b64144ccf1df"

<requestedExecutionLevel level="asInvoker" uiAccess="false"/>

<windowsSettings>

<dpiAware xmlns="hXXp://schemas.microsoft.com/SMI/2005/WindowsSettings">true</dpiAware>

</windowsSettings>

<supportedOS Id="{e2011457-1546-43c5-a5fe-008deee3d3f0}"/>

<supportedOS Id="{35138b9a-5d96-4fbd-8e2d-a2440225f93a}"/>

<supportedOS Id="{4a2f28e3-53b9-4441-ba9c-d69d4a4a6e38}"/>

<supportedOS Id="{1f676c76-80e1-4239-95bb-83d0f6d0da78}"/>

<supportedOS Id="{8e0f7a12-bfb3-4fe8-b9a5-48fd50a15a9a}"/>

!'%s' is not a valid integer value('%s' is not a valid floating point value

'%s' is not a valid date

'%s' is not a valid time!'%s' is not a valid date and time

I/O error %d

Integer overflow Invalid floating point operation

Invalid pointer operation

Invalid class typecast0Access violation at address %p. %s of address %p

Operation aborted%Exception %s in module %s at %p.

Application Error1Format '%s' invalid or incompatible with argument

No argument for format '%s'

Invalid variant operation"Variant method calls not supported

External exception %x

Hoperal Setup

Hoperal

%original file name%.exe_2604_rwx_01330000_000C4000:

.uzY1

2(E%X

.eGl@:

N.lmO

%cw}5

@#.xK

bTO%xR

g.hiD

fwv.qm<

q=.OG

(X.ed

.SJqK

p*S%F}!

%s2S2I

nh.bW6K

.vc'`sR

Pw.dnc

Y%xf"

%dx]H

>Q={L.ROW

I n(P.Sn

g_Bj%d

v.Bfed 

(V(%x

w%3SP

[H.ML

'HQ#<R.CE

.Kvdsva

d`.ED

^-Ft.EH

)=Jv.BKe

8%.qyi

hu!.vv

# y%x

6h.CG

Q4.uo

0 %d|

d.wg?

&-RGu}9

\>Z%S

mt.ZR5

J.hIt

ZhJ%D)

L#$%U

}%U*ZJ}

g.ir[

Je}.%9X

x.RPaO

(b.PF

kEY67

ea%D?

?E&5.Oj

i%s="/

].qd>

5L.ex

j.hhPP

{Ð]

^.ZG?

.np|K

i%Cs.

QZ%Xgo

%dHA`

.vQW9

U.rN8

-Se}19

@9Í

Nu.QQ

B÷)d

Gt.XNL

.TEvL

j<Zu.BZx

_.de8K

Rb.pOK

tuIE.Yvx:

p.bg"

sG

.zg'z

0!%S 

$KÁ

%original file name%.exe_2604_rwx_01400000_000C4000:

%9u,y

U.tJ6

elT%UN

.tM@;

@G.sd

Ipr-g}qA

.xJFY

$.Il0

cd.Vu

9_%FI

B.lUa\

{g-u}/

7.BCl

{s%F|

u.Zf%

.Ld"S

xY_%di

Q.jE<G

Ic%d{

<8B.LBJ

7.SwHi

2.Hg _p

^.Ije

.Pq^)

.JEDR

l.QE1

Kx2%S

}.QAf

.lyJ?&

_m).jS

yuM%x

}0ñ

.dw,-

m<iR

 \.GrX`/7

Sl.Xcz

K-cjP}

GbW%U

Xo%Xt

fTp'8

x-Z%F{

2N/%f

Nl$.Hj

.hf[c}

v eV%U'

sBL.le

[?wó

_i&%Ss

1G%X}

t.AKd

#z.jP

.hvf<

_\:.Gs

$_%4uW

:.tOx

A.IwT

u:Œ]

.oa3/

c5b.iX^

Ü7{

.fO=C[

\.lTq

J.cL@%]Hh

P.pjU

Ok.Pb/u@=0

].TQQ

%original file name%.exe_2604_rwx_016A0000_000B9000:

RJ-.yq=

.YkBu

×[w

S-cvm}x

%.yMF

f.iU@m

Au%Cr}

xh

.PM#.

.gp4;

%dl@J

BM%c.=

T:\w^

#CoK.jg

{2}=.#9(

.EPcW

Q.fg>d

.Jp9:

F?bS9.TU

`%d)S

.Ml,n

Wm[g1.yB

6e.ce

Jd%fi

)%Cq$

Gzq4u}RQl%D

y%u]C

m.zsV

pb.dP

UI|H%d

.joE{

%c-c,

%2X; 

p%u[L

..Bt&Q

EkeY/

.yLO|

T%d&n

9%3s,

.fC$[Y

%ucIu

DuO*%S?

fYhhL.gO

}V:.kw~)

9A.kQ

.yJ>Z

zuy%u%

.yS6as|

^.fDrz

T/Q[%U

>%ujG

W!.Iu

}[#e%C

e%u.#

WfQ%S

C6.ZQ

F.nQv

.tV]<

WuE%dV

%F?^@3F2

Td.dx

%S*7G

47.Eb

%UQ@Nmi

_p.Fe

-c}tcKF"

>%C\Rv^

.eRop

%original file name%.exe_2604_rwx_01821000_0017D000:

kernel32.dll

MSWHEEL_ROLLMSG

MSH_WHEELSUPPORT_MSG

MSH_SCROLL_LINES_MSG

$*@@@*$@@@$ *@@* $@@($*)@-$*@@$-*@@$*-@@(*$)@-*$@@*-$@@*$-@@-* $@-$ *@* $-@$ *-@$ -*@*- $@($ *)(* $)

htKeyword

EInvalidOperation

u%CNu

%s[%d]

%s_%d

.Owner

EInvalidGraphicOperation

USER32.DLL

comctl32.dll

UrlMon

IE(AL("%s",4),"AL(\"%0:s\",3)","JK(\"%1:s\",\"%0:s\")")

JumpID("","%s")

TKeyEvent

TKeyPressEvent

HelpKeyword

crSQLWait

%s (%s)

IMM32.DLL

AutoHotkeys

AutoHotkeys\

ssHotTrack

TWindowState

poProportional

TWMKey

KeyPreview

WindowState@

OnKeyDown

OnKeyPressx

OnKeyUp

System\CurrentControlSet\Control\Keyboard Layouts\%.8x

vcltest3.dll

User32.dll

A`bng`@ikc-4,uUxlxs-4,Ht.HA

Vh-0,Cd`jiVhlxwd-0,tLcibD.ZP

Portuguese

ZkkdDocjn^g-4,o.ye

^ioM-3,iiziGmwItI.cG

\h-2,Jfal\`dgxj-4.DZ

,-\ T,/.Om

hcl.sf

webqskv`T-Y

oj-2,`ac<<*kcb.jo

ak-2,`ob<< T,jcb.je

Mmed]ugkf-3,ffgvllCi-2,`ah QQ .,h`l`, -2,(cmgiiim(zc)x-1,cjm-24,)x-1,i-4,aayzdw,,x-2,kyll,.al-1,fcm-0 R ,,fzji-0,(mc-1,dj,,km,.h`-01,yy-1,kh W->.I

IN]JVN]K]KJ]B]F^UF@@]\v-2,ujbRBjazsnc^s`lkr-1,`-1,].jl

7Teah P,Ckh`-3,fkgo-2,7*NNYO.uh

1.2.3

Gx-21,\igh]ixyj-42,M.DJ

A`qjz``-0,ZkdkNgij.pc

Kcqjpc`-0,Aaj-1,gEdafa`.pM

Jmvgknm Q,2,,<,./accwcxgeni5 W,O_GB R,=>)27,.Pkbjhu-4-.,IV,,8)37,.Spejblx Q,2,,< W.g W

Ecezcb-4 S,Tmeic6.fA

Bc/K-33,`-1.jG

Jbhblnrefc V,H-0,bv-1,li.AT

Uju-0,c-2 W,Ht-2,h-4.Rq

Ijv-1,h-0,jm Q,Jq-1,n-2,/,.u`l,.lnmw Q,ll`oj`zh`m-2 Q,xjzi`vz Q,kbz`.^l

Q-0,iznjib Q,`u,.tgu-0,qyi-1,ulb.a-F

Ob-4,/dcdzfe, kh-3,`/r-2,jld.vL

V-1,ns-4-.,hx V,lmdeehea,.mdhi Q,hi`onezhdh-2f.a

ebP-3,dLfnda`-4,`yj-4.PL

,.djxzheo,.bb, jhbj-0,ap1,.-i.Y

Fb`b(bh W,gx-1 W,zh-4,rm-3,zt(l-1,b(-2,ot-0,d``(d` W,X-4,a-4,q,-Chlh,.*(-30,txhmsaci W,acoeaagsq,-zh(iapfaafl,-hug`,.d-241,bfy,.tm-4,xbz Q .,sztgio,-oigyfbz,-FBII,.um-10,b-0,y,.sg,-cfch,.t-24,k)-3.S

Zm`vk U,dvk U,kk,.hjvk U,vk-0,wfa-2 U,fe-3,dghk U,jb,.ajs`ijejlkc RU,cegilji U,qlk U,akykikoa, E^

Cjf`,.o`y`g`oj, -0,f-1,nnj,.xjkcx/za, mk,.m-2,atna,. V,f`-1,k, -0,foe/.j9

f-1 TP  -1,ymy-0,dbl/nc-3,ayhdxc R.Hv

Eoe)r,.-32,c,.-4,fc,.fov R  ,jgzj,.ban-2,h)-4-.,ko-4,mn P.fa

Ja-0,hbamb,.fmu,.Hmobkh*,.K-3,tMahc4,.l.i

,..XN

@ojjcj S,qtgwc V,zl V,g,.eojk/ V,q-1,jrrkm< V,c.a

Ffzfn)-1,(vgum U,g-1,(kkhiqgym),.-2,mvk-0,aki/-1,j,.umwa/ UU,zgav,.lik,.cmdj/fjy/-1,j,.mia,.-0,`l`h-0- D.`

Ql-14,d,--0,ipxl-4,u,-`kob-0,ie Q,)-4,d-44,is-3,)-0,hyacty)DUYY,,Slgkd,-zyq-2,f-3,u,--3,ema)o`xzi Q,if-0,oafme,--0,iryh-3,u S.DL

Vrzvoii R,rok R,bhyljhofcu,.khsa R,Vf-0,qc W,cmbb P .,v

Gl-2,elsktfa,.`jikhbhk V,jk,.Ekp`mp U,Cgs),.dvq,.rk`,.`jik V,mjz V,f-2,guwv,.,  S,lihlwkb S -,nS

 W.OC

Co-2,(Makfkmqaa` U,Zo`bm,.yd-0-.2,`-1-.,zj(-:.i

YV`vk T,lp-1,k-0 R,jql R,zk)k`w-1,dhmjkkj-2 R,jmzi,.wycma UR,aje-0,4 T,)N

[ofdbd W,ra Q,ptgub V,zn W,`gmb*,.hkjkffj,.gnjkofkk; W,g N

[zomm-14,h-2,c,,-1,mke-1,mlx,.fzalm-2,6,..gs

Rhyzd-4- 4,dhf-4 Q,yd,,ch, cty, cg,-xis-0,bod,- S.FL

Jblalnvffc R.mT

 P .,G-43,Mmii4 R.Mg

/ W.Wz

Hkog]kyg,.wmgvrfazgg R,mjblig/ R,ang R,xcowk8 SS .

Kwz,-kd,.`aoa-42 R,yeal,.Khw-2,emli,-gm`caazdkl,.ievo QT,ok` T,pk-1,qg-2,yaf4,-.Y T

XvfjoiNalt S,jsef-44,ola, dfje V,`n-3,ak-0,1 V.n,k

GyohgObgNooedks T,fvbaszhkm,.caf` Q,gb-0,flw4 Q,A.^

]DKizHi-4,exc-1,Hc`hk-3.GI

L_LCUNTF, KHC.op

0.0.0.0

3?:96=>?59:;.ZQ

6?0N2=.Lq

;768>1-80

cabinet.dll

\fgejnhg,.Dhr,.f-3- ,z`b, -2,gbyz,..8y

000000000000

 ;7.Q,>N-Y,[ T,Tc.Uv

 P .,o-1,^ku-4,c`ujZojfh4 V.qg

Cnxn=/.wr

 Q -,Gxy-2,Lcih5,,.JX

Bm-0,l<,,.ZA

Hvp-4,lmp,-H-1,vb-4,4 T,nl` S,y,-hkxcj T-3,b-0,vnh,.bdak>,-.Oh

BmfzBhkk T,vf-2 T,d-4,zv`dzae W,hvnj,.GHT RT,sb-2,qms4.b D

Gabva`x R,kh,,DhoxDmbi R,so-4 R,avxpemxg`,.xm>,.,,._

Y]H.if

d-3,tdcQqdc.Lb

)hix.CB

,.kb`,.new-3,fm-2-.,dmik0,,L-c

Y^`acxziagKphh-01,hy,.kle,.jh, mzhjzmi, afar,.gchk V-C.8

,.qn`-0,b2.J-3

,.Hzdz,-Tlbxg7,..MY

/x`azk<.Lj

 V,H-3,dr,-Pljxc7 V.QQ

Ovnl-4,znLgj1/Ovb-0,Iaoj0,..ve

CJ[hx.Xu

G`pa-1,`eh,.hemb-0,va4,.D.i

 WP,/koecd`k/yfi/d`-40,lb`j-4 P.ZI

_.Wo*BC-T5p7d.V-b,

Gjufbmg W,cqosgtbuz T,Ar``ob,.vft-3,kmtk T  ,n`bl=,.sN

NAER_[URNDT].Lw

[h-3,f-0,y,.dhd`)yl-1,hd7,.-S.T

Deib`dfk W,^LX W-4,m-2,rh-0,x W,zi-4 W,imbnhl,,cxm,,sb(`fnc,,hk(\ud-3,ekhoi W,@ghb S.CR

LJ_.ge

fxk S,Cym^rk.Um

ole32.dll

olepro32.dll

IWebBrowser

IWebBrowserApp0

IWebBrowser2h

TEWBWindowSetResizable

TEWBWindowSetLeft

TEWBWindowSetTop

TEWBWindowSetWidth

TEWBWindowSetHeight

bstrUrlContext

bstrUrl

OnWindowSetResizable

OnWindowSetLeft

OnWindowSetTop<

OnWindowSetWidthx

OnWindowSetHeight

grfKeyState

TComTargetExecEvent

CmdGroup

nCmdID

nCmdexecopt

hhctrl.ocx

URLMON.DLL

SHDOCLC.DLL

rcmDefault

rcmDebug

DontExecuteScripts

DontExecuteJava

DontExecuteActiveX

DisableUrlIfEncodingUTF8

EnableUrlIfEncodingUTF8

CheckFontSupportsCodePage

DisableSubmitUrlInUTF8

EnableSubmitUrlInUTF8

lpMsg

PMsg

pguidCmdGroup

TTranslateUrlEvent

pchURLIn

ppchURLOut

CmdID

pszUrl

pszUrlContext

szPassWord

ErrorUrl

OptionKeyPath

OverrideOptionKeyPath(

OnTranslateUrlP

OnCommandExec\

'%s' is not supported.

TMsgEvent

TKeyEventEx

Port

Password

poPortrait

0.750000

3333333

\Software\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent

\Software\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform

User-agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)

User-agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)(

This object does not support this method (

Unsupported type for Parameter with Index %d

Method call unsuccessful. Object: %s, Method: %s, Exception: %s , Source: %s.

hXXp://

hXXps://

eiOnKeyDown

eiOnKeyPress

eiOnKeyUp

OnKeyPress

Handler with EventID = %s already exists.

Error on IConnectionPoint.Advise

Source don't have connection point for [%s]

C^,-j-4,hc-0,)nlceollb,-hwlnx-0,l,--30,h-4,y5).xT

RZ-3,i-1,/ImznQ.Hy

MAPI32.DLL

LeftPopup

,.Ojjzj?E,.

Fliof S,ganjlgib-3,gemy,.ll-4,`n S,ygd`o,.fbyz*`ecgj-3,zog*o-3 S,xk-1,jygem.e,:

YR-0,xh]izn.cQ

2.1.0.0

This exe was created with an old version of HtmlAppMaker.

Azhi\G U,w-1,`klgi U,lg,.UW@XLILI@ZDAA@ W,U.d

-0,cnyzgcEi.Tc

https

Iii W,vc-1,q`t,.Rwj,.nv V,gisgbna<,.-3,e

Sf[.t,T*.lJ,e

^g`hdli,,Ami,,ym,.xeg,.jbnbczk`k,-W-1,`7 R.I.-

Kma,.Ovr-3 W,pc-4,rguz W,jg-2 W,vocbf V,arv(.a W

Aa`da,.-2,e V-2,aeq,.-2,bc,.Yxii-0,ou-2,)li-1,d T-^.a

M`-0,b, l-0,jj-0,lk1.tv

MSGALL

Afye,,keohndi,,axaa W,lg`b*fmt*hmnfkh, *heko,.bh-3-.,jh-4,`h=*.e-1

irsoMsgDialog

irsoJoinPath

irsoGetCmdLineParam

irsoGetCmdLineCount

irsoGetCmdLineIndexOf

irsoGetCmdLineParamValue

irsoGetCmdLineAll

irsoRegCreateKey

irsoRegCreateKeyTree

irsoRegDeleteKey

irsoIsRegKeyExists

irsoRegListKeyValues

irsoRegListKeyKeys

irsoRegSearchKeyKeys

irsoRegCopyKey

irsoGetRegKeyInfo

irsoHttpGetData

irsoHttpGetDataInThread

irsoLibraryExecuteProc

irsoLibraryExecuteProcW

irsoLibraryExecuteProcWithResult

!irsoLibraryExecuteProcWithResultW

irsoExecute

irsoExecuteDllInProcess

irsoSaveExecuteUsingCMD

irsoIsMutexExists

irsoCreatePipeServer

irsoStopPipeServer

irsoSendDataToPipeServer

irsoSetDebugLogUrl

irsoGetDebugLogUrl

irsoGetWebBrowserHandle

irsoGetCurExeCheckSum

irsoGetExeInjection

iubnyybRolkanldf.RW

b-1,[-1,e.Hv

.html

H-4,njBdi-2,o-4,r.vY

-4,fhxXahcxgw.rg

gghYcjrf.ae

jehGbeags.qB

PIPE_DATA

PIPE

LNYCD_^.eP

HMVH9>.PE

Ykifxz-1,v, k`-0,yw,.-2,ncaynj4/Czcc^G,.Myay-1,n-1-.,`idkl-4,)-2,/BK9/mobciomd, -2040,a-10- ,g-2,/eay/n`omgkj Q.yf

Cpcb^M,.Lyky-2,nv,.ainkm-4 S-2-.,BA9,.mebbieme, eb-1,nejw, `g-2,jfbko*.i,K

-3,1 T-1,`-4,b-4,w37 P,abov=.vN

NK Q,RblCwhyr`u,.ejd\dkcCnab4 Q,Q.b

 V ,,dck,,kb-0-,,Ad-1,mgajE@:Imionon S.PJ

<,.Mcr,.giu-2,kkc,.l-3,ic*mha-3,dc-1,*eh-23,mhmo6 V.Ea

8 W,Iav W,ckqtoig W,h-1,mj,.olhzfgu,.gltzoldk4 R.i,r

^lvn,.fifcdho,.ph``jqe4 U.1,^

Eaz QP,MAOVG@TG,,,.bmcc`lj,.gpac Q,dg-1,rv,.-3,smmkrq R .,ujg-2 Q,r-1,abg-22 Q,ugbm R,maovg`tg,.-1,tl`goe N.]

\g`c,.dnuc R,ebhctkz R,qn-3,g Q,sgodc,.mts RR,bf` U,u W,jgub-1,ohik R,ha,.vib-1,g V,t,.cohzjdu,.kotzcodk R,sr`lhiiq,.

ung`.Nr

Jdn W-1,msrgzgt,.ifjgfktzzcsg-3,g W-3,zkqgdg`k-0 R,sa(pr`r-C

gbo`dhfm.cV

Ul-2,uf-0,z@tHjlng4 Q,RHM Q,nz,.enzocklj,- W,h-2,rrdgo`)-3,shjkrt)f`t)oej`` Q,w-0,gwnekfbz RQ,df`ung-0,d W-3,guof-0,u W-0,krsh-1,ungi/ N-L

Loaeoj(-2,e,.zlga-3,l*z`l*,,Rfdk V,@nkf-2,chalx,,(Hfz[-2,xkid-M.e

\iwqo-3,pD-2,M`hgb> U,\iwqo-3,p U-2,ygfki`),.xvd`-4,b`-1,ejb,.okkz-3,ki,.xk U,zda U,`is U-33,kfk-4,w U,ob` U,zivhgbeqgbc U,zdmv,.cj` P,T.I

irsoExecutePackage

irsoReportPackageError

irsoReportPackageSkip

irsoReportPackageQuit

irsoReportPackageSuccess

irsoReportPackageInfo

irsoGetPackageFilenameFromHttp

irsoGetPackageExecExitCode

irsoGetPackageExecResult

irsoGetPackageDwnldUrls

irsoSetPackageRelProgressShare

irsoGetFireFoxEXE

irsoGetIEEXE

irsoGetChromeEXE

irsoGetOperaEXE

irsoGetFireFoxVer

irsoGetChromeVer

irsoGetOperaVer

irsoUninstallAddExeCmd

irsoUninstallAddOpenBrowserCmd

irsoUninstallAddRegistryKey

irsoUninstallExecute

irsoReportStart

irsoReportInfo

irsoSetExclusiveExec

isroSetReportUrl

-11,jycmjaOaahDgvyc-11.Pg

zfc.bz

]no^dun.Vx

Fe`jlm,.cso-13,lnk,,uk-1,mhy,.ebda-3,`n R ,,fxm?7*cevgoxfb,. T,s.I-Z

\fuj-1,w U,P\O U,qah`k,.nlvcbqff,-U>

\GCAPMA][.oj

TcUlue.PL

W`mmqzeon,.wvamaff P,4.]

z`o1caig2,.hf5b Q,0cfh)914`,,34`6;ia2f=ae-3,L1

e-1,f.Cw

-0,ilCcbd.LG

)h-4,k.bR

Un-4,ojjy,,q-0,j-3,vjo R.Fm

Yozmfk-1-.,ha-0,`j,.o,.-31,albkc R .,l-0,z,.mo`)z,.-1,k-3,a-1,z,. S .,k-22,k`zgob,.-1,k-3,a-1,z,.jozo,.g-2-.,cg-22,g`i P.ii

Ukszv.ra

MNWEZZWHWAE@@5 T,ed-1,mcb/ V.Op

[eckbn R-2,a, kgg-4,khbbxl,.blzzjneky R,N[B,,-G.9

FbghLbtaYhe.AU

1.2.1

inflate 1.2.1 Copyright 1995-2003 Mark Adler

deflate 1.2.1 Copyright 1995-2003 Jean-loup Gailly

?456789:;<=

!"#$%&'()* ,-./0123

1iu2.iu

333333333333333333

33333833

3333339

3333333333333338

:*"*"$3338

33333333

33333333333

3333333333338

33338?383

333333333333

:*3:"$3338

333333333333333

nmO%f

9&H.gD_

.IvNp{

-Y}M1p

g$.av

[.LhMy

2.xDG

.usYU&3(

!%Dz=

FV..fZD

{'.Ld

m(`a%.F

S%X(;

GetProcessHeap

GetCPInfo

RegQueryInfoKeyA

RegOpenKeyExA

RegFlushKey

RegEnumKeyExA

RegDeleteKeyA

RegCreateKeyExA

RegCloseKey

SetViewportOrgEx

UnhookWindowsHookEx

SetWindowsHookExA

MapVirtualKeyA

LoadKeyboardLayoutA

GetKeyboardState

GetKeyboardLayoutList

GetKeyboardLayout

GetKeyState

GetKeyNameTextA

GetAsyncKeyState

EnumWindows

EnumThreadWindows

EnumChildWindows

ActivateKeyboardLayout

GetKeyboardType

"$ %),'8

38000=344

4? 3!0 3!6

&W!%D)*

H.JXA

1 0 .'7(2':

- /*-( ,'.-!$$$&'('/*) ,*/.)*72-7)

&)"%&$&'&",,/- '

944(@32%2u8

.PMDF<7I

2222444424

.idata

.edata

P.reloc

P.rsrc

*/.)*72-7)

1d.XO

?P.re

SOFTWARE\Microsoft\Windows NT\CurrentVersion

errorUrl

\bin\SubWCRev.exe

Please login as administrator and try again.

OLE error %.8x%License information for %s is invalidPLicense information for %s not found. You cannot use this control in design modeNUnable to retrieve a pointer to a running object registered with OLE for %s/%s

Clipboard does not support Icons/Menu '%s' is already being used by another form

No help found for %s#No context-sensitive help installed$No topic-based help system installed

OLE error %.8x.Method '%s' not supported by automation object/Variant does not reference an automation object7Dispatch methods do not support more than 64 parameters

Error creating window class Cannot focus a disabled or invisible window!Control '%s' has no parent window

%s.Seek not implemented$Operation not allowed on sorted list$%s not in a class registration group

Property %s does not exist

Metafile is not valid!Cannot change the size of an icon Invalid operation on TOleGraphic

Unsupported clipboard format

Invalid stream format$''%s'' is not a valid component name

Invalid data type for '%s' List capacity out of bounds (%d)

List count out of bounds (%d)

List index out of bounds (%d) Out of memory while expanding memory stream

Error reading %s%s%s: %s

Failed to get data for '%s'

Failed to set data for '%s'

Resource %s not found

Ancestor for '%s' not found

Cannot assign a %s to a %s

Bits index out of range*Can't write to a read-only resource streamECheckSynchronize called from thread $%x, which is NOT the main thread

Class %s not found

A class named %s already exists%List does not allow duplicates ($0%x)#A component named %s already exists%String list does not allow duplicates

Cannot create file %s

Cannot open file %s

External exception %x

Interface not supported

%s (%s, line %d)

Abstract Error?Access violation at address %p in module '%s'. %s of address %p

System Error. Code: %d.

Invalid pointer operation

Invalid class typecast0Access violation at address %p. %s of address %p

Privileged instruction%Exception %s in module %s at %p.

Application Error1Format '%s' invalid or incompatible with argument

No argument for format '%s'

Invalid variant operation"Variant method calls not supported

!'%s' is not a valid integer value('%s' is not a valid floating point value

'%s' is not a valid GUID value

I/O error %d

Integer overflow Invalid floating point operation

Remove it with Ad-Aware

1. Click (here) to download and install Ad-Aware Free Antivirus.
2. Update the definition files.
3. Run a full scan of your computer.

Manual removal*

1. Terminate malicious process(es) (How to End a Process With the Task Manager):No processes have been created.
2. Delete the original Trojan file.
   
3. Delete or disinfect the following files created/modified by the Trojan:
   

   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH33633812990\images\Grey_Button.png (808 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH33633812990\css\sdk-ui\button.css (417 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\000521D2.log (8 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH33633812990\images\Close_Hover.png (207 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\in364BB553\27254D51_stp.EXE (258379 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH33633812990\images\Loader.gif (10 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH33633812990\images\Grey_Button_Hover.png (818 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH33633812990\css\main.css (8 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\25FDO7QC\webcammax[1].jpg (2 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH33633812990\images\Quick_Specs.png (221 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH33633812990\locale\CS.locale (4 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\QGTKGB9M.txt (125 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH33633812990\images\Progress.png (104 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH33633812990\images\Resume_Button.png (718 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH33633812990\css\ie6_main.css (1 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH33633812990\css\sdk-ui\images\progress-bg-corner.png (1 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH33633812990\locale\JA.locale (5 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\in364BB553\27254D51_stp.EXE.part (4422 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH33633812990\images\ProgressBar.png (812 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH33633812990\locale\EL.locale (6 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH33633812990\images\Color_Button.png (808 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH33633812990\locale\NL.locale (4 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH33633812990\locale\EN.locale (4 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH33633812990\css\sdk-ui\checkbox.css (190 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\0005228D.log (16 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH33633812990\csshover3.htc (2 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH33633812990\images\Close.png (207 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH33633812990\form.bmp.Mask (244 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH33633812990\css\sdk-ui\images\progress-bg.png (1 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH33633812990\css\sdk-ui\progress-bar.css (506 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH33633812990\bootstrap_20918.html (156 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH33633812990\images\Color_Button_Hover.png (818 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH33633812990\images\text-bg.png (1 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH33633812990\css\sdk-ui\browse.css (337 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH33633812990\images\BG.jpg (27 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH33633812990\images\Pause_Button.png (577 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH33633812990\images\sponsored.png (2 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH33633812990\css\sdk-ui\images\button-bg.png (131 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH33633812990\locale\ID.locale (4 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH33633812990\css\sdk-ui\images\progress-bg2.png (978 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\inH33633812990\images\Icon_Generic.png (1 bytes)

4. Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
   
5. Reboot the computer.
   

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.