MD5: 47dcbc00a52126aeb8382ce86b5f4892
SHA1: 6e90988c0423f55d382a1d81a145577e8944f06e
SHA256: a053194680f5a6dec6766f5c008566207e3ee0d5f412449db0f92e84bb7f0c5b
SSDeep: 6144:yZXBsWqsE/Ao mv8Qv0LVmwq4FU0nN876sa1A7uxI1yRS9DY1y29gv:0XmwRo mv8QD4 0N46lScM9DYjo
Size: 310861 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: BorlandDelphi30, BorlandDelphiv30, UPolyXv05_v6
Company: no certificate found
Created at: 1992-06-20 01:22:17
Analyzed on: WindowsXP SP3 32-bit

Summary:

Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).

Payload

No specific payload has been found.

Process activity

The Trojan creates the following process(es):

%original file name%.exe:396
crypt.exe:1388
WScript.exe:1524
WScript.exe:1224

The Trojan injects its code into the following process(es):

crypt.exe:1252

Mutexes

The following mutexes were created/opened:
No objects were found.

File activity

The process %original file name%.exe:396 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Program Files%\Gorn\Gorn\prostoigra.bat (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\$inst\temp_0.tmp (230 bytes)
%Program Files%\Gorn\Gorn\2.txt (27 bytes)
%Program Files%\Gorn\Gorn\Uninstall.exe (3832 bytes)
%Program Files%\Gorn\Gorn\crypt.exe (2753 bytes)
%Program Files%\Gorn\Gorn\neznoesvidanie.vbs (292 bytes)
%Program Files%\Gorn\Gorn\dns_bablo.vbs (819 bytes)
%Program Files%\Gorn\Gorn\Uninstall.ini (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\$inst\2.tmp (68 bytes)
%Program Files%\Gorn\Gorn\1.txt (15 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\$inst (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\$inst\2.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\$inst\temp_0.tmp (0 bytes)

The process crypt.exe:1388 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nsh2.tmp (2294 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsw3.tmp\systematists.dll (1856 bytes)
%Documents and Settings%\%current user%\Application Data\default (1).cfl (1552 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nsw3.tmp\systematists.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsr1.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsw3.tmp (0 bytes)

The process WScript.exe:1524 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\86[1].htm (2 bytes)

Registry activity

The process %original file name%.exe:396 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Gorn 1.3]
"EstimatedSize" = "191"
"Publisher" = "Gorn"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Gorn 1.3]
"DisplayIcon" = "%Program Files%\Gorn\Gorn\Uninstall.exe"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Gorn 1.3]
"NoModify" = "1"
"UninstallString" = "%Program Files%\Gorn\Gorn\Uninstall.exe"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Gorn 1.3]
"DisplayName" = "Gorn 1.3"
"InstallDate" = "20150217"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Gorn 1.3]
"NoRepair" = "1"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%Program Files%\Gorn\Gorn]
"CRYPT.EXE" = "crypt"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%System%]
"wscript.exe" = "Microsoft (R) Windows Based Script Host"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%Program Files%\Gorn\Gorn]
"prostoigra.bat" = "prostoigra"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "FB 12 B6 B0 D2 32 85 BD 7E 97 01 F0 56 2B 4C BC"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Gorn 1.3]
"VersionMajor" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Gorn 1.3]
"InstallSource" = "c:\"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Gorn 1.3]
"Language" = "1033"
"VersionMinor" = "3"
"InstallLocation" = "%Program Files%\Gorn\Gorn\"
"DisplayVersion" = "1.3"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Gorn" = "%Program Files%\Gorn\Gorn\crypt.exe"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The process crypt.exe:1252 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "C0 64 43 64 FB E3 FC F7 CC B9 B0 BF A5 B1 57 02"

[HKCU\Software\NVIDIA Corporation\Global\nvUpdate]
"Value" = "20150126"
"Guid" = "cb631cb5-98b9-4c8d-b63a-b34831512edc"

The process crypt.exe:1388 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "87 67 6F DC 1B FD 2D 24 4B AC BE B9 E7 82 CB CF"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

The process WScript.exe:1524 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1D 00 00 00 01 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "5B B8 79 AD 64 D1 9B FD DA 3E 77 30 0D A7 D8 33"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process WScript.exe:1224 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "9F 25 3C CB 39 AC D1 8F 2B 5B B0 E9 A4 02 0D 66"

Dropped PE files

HOSTS file anomalies

The Trojan modifies "%System%\drivers\etc\hosts" file which is used to translate DNS entries to IP addresses.
The modified file is 1178 bytes in size. The following strings are added to the hosts file listed below:

Rootkit activity

No anomalies have been detected.

Propagation

VersionInfo

Company Name: Gorn
Product Name:
Product Version:
Legal Copyright: Gorn
Legal Trademarks:
Original Filename:
Internal Name:
File Version: 1.3
File Description: Gorn 1.3 Installation
Comments:
Language: English (United States)

PE Sections

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Total found: 8
8fa1d401efdc8f2d6f38889e0ff3ae17
aaddd8d4e79e9327162b35db9b96abb5
a393f9f372840a9184d01323243bf08b
2601cb0f40ed8f01e052a344ed349383
dc56c69b5607e188be4cdb864cfdc23b
c11c94ee1112ffaa9e96d7e381f9c39d
a8af34d443637a23be69d3887c4f08e6
10bbc7a5cbc14ab1e8a8c45b6a5d5710

URLs

URL	IP
hxxp://104.207.142.110/apologi/trotski/86/?mwa=5a2f3f
time.windows.com	64.4.10.33

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

GET /apologi/trotski/86/?mwa=5a2f3f HTTP/1.1

Accept: */*

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: 104.207.142.110

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.6.2

Date: Mon, 16 Feb 2015 22:20:17 GMT

Content-Type: text/html

Transfer-Encoding: chunked

Connection: keep-alive

X-Powered-By: PHP/5.4.22

Set-Cookie: ci_session=9aCuiJCWy7YEzcik5CWNbWSsAX3DyAqMbQWhboEZAqHBcOwzUbk4NaR99Htkk+cbtaW5fOjFljhaEG03d58wFO9BFCUWvoaJk2y1LJIGT0g2+rO7bPeAHrlJABv1sVRr1dV0AwFXdstsRWvQYbP0rkAqNuzV4F6Xqbmd0csfV8HsPph+4Au8fpTyVJ3zm93ZCFGiWeCvjXpZTpHVBzw8h2rr9YrO4D1zPN+LQUA5kjNs6d4h2j8ECpXinwHluGgbah346MrmBRcMoEShisdTzBZvMrn6m8EZfCsWBm0UaduAHdvnPj9veZJgxtIzbl9/2FDnVeita1XNurDJla4PTVZyrBn2ZRgWgomHf2vKX/B+L8M/ydARBjMHH0GfYHPlPCcvZ0DK147VBR9SDhMPV/5xyYLM4nunquiS34UEkekPuwNeo2SsiCvEgRBpOCWnfJi3jk4s5M4qE0SRAQaFPQ==; path=/
2..ok..0..HTTP/1.1 200 OK..Server: nginx/1.6.2..Date: Mon, 16 Feb 2015
 22:20:17 GMT..Content-Type: text/html..Transfer-Encoding: chunked..Co
nnection: keep-alive..X-Powered-By: PHP/5.4.22..Set-Cookie: ci_session
=9aCuiJCWy7YEzcik5CWNbWSsAX3DyAqMbQWhboEZAqHBcOwzUbk4NaR99Htkk+cbtaW
5fOjFljhaEG03d58wFO9BFCUWvoaJk2y1LJIGT0g2+rO7bPeAHrlJABv1sVRr1dV0AwF
XdstsRWvQYbP0rkAqNuzV4F6Xqbmd0csfV8HsPph+4Au8fpTyVJ3zm93ZCFGiWeCvjXp
ZTpHVBzw8h2rr9YrO4D1zPN+LQUA5kjNs6d4h2j8ECpXinwHluGgbah346MrmBRcMoES
hisdTzBZvMrn6m8EZfCsWBm0UaduAHdvnPj9veZJgxtIzbl9/2FDnVeita1XNurDJla4
PTVZyrBn2ZRgWgomHf2vKX/B+L8M/ydARBjMHH0GfYHPlPCcvZ0DK147VBR9SDhM
PV/5xyYLM4nunquiS34UEkekPuwNeo2SsiCvEgRBpOCWnfJi3jk4s5M4qE0SRAQaFPQ%
3D=; path=/..2..ok..0..

The Trojan connects to the servers at the folowing location(s):

.text

P`.data

.rdata

[email protected]_fram

[email protected]

.idata

bpass

qcb631cb5-98b9-4c8d-b63a-b34831512edc

libgcj-13.dll

@%s:%s:%d

-_.!~*'()

GET /stat?uptime=%d&downlink=%d&uplink=%d&id=%s&statpass=%s&version=%d&features=%d&guid=%s&comment=%s&p=%d&s=%s HTTP/1.0

badpass

%s:%s

20150126

server-%s.o12955reps.com:35,server-%s.updmaker.com:35,server-%s.gglerr.com:35,server-%s.statgglr.com:35,server-%s.toolgot.com:35,server-%s.sndcmdex.com:35,server-%s.sendrepp.com:35,server-%s.microrepo.com:35

8kernel32.dll

advapi32.dll

rpcrt4.dll

shlwapi.dll

RegCreateKeyA

RegCloseKey

RegOpenKeyA

ws2_32.dll

VirtualQuery failed for %d bytes at address %p

Unknown pseudo relocation protocol version %d.

Unknown pseudo relocation bit size %d.

GCC: (tdm-2) 4.8.1

KERNEL32.dll

msvcrt.dll

crypt.exe_1252_rwx_00400000_00010000:

.text

P`.data

.rdata

[email protected]_fram

[email protected]

.idata

bpass

qcb631cb5-98b9-4c8d-b63a-b34831512edc

libgcj-13.dll

@%s:%s:%d

-_.!~*'()

GET /stat?uptime=%d&downlink=%d&uplink=%d&id=%s&statpass=%s&version=%d&features=%d&guid=%s&comment=%s&p=%d&s=%s HTTP/1.0

badpass

%s:%s

20150126

server-%s.o12955reps.com:35,server-%s.updmaker.com:35,server-%s.gglerr.com:35,server-%s.statgglr.com:35,server-%s.toolgot.com:35,server-%s.sndcmdex.com:35,server-%s.sendrepp.com:35,server-%s.microrepo.com:35

8kernel32.dll

advapi32.dll

rpcrt4.dll

shlwapi.dll

RegCreateKeyA

RegCloseKey

RegOpenKeyA

ws2_32.dll

VirtualQuery failed for %d bytes at address %p

Unknown pseudo relocation protocol version %d.

Unknown pseudo relocation bit size %d.

GCC: (tdm-2) 4.8.1

KERNEL32.dll

msvcrt.dll

Remove it with Ad-Aware

1. Click (here) to download and install Ad-Aware Free Antivirus.
2. Update the definition files.
3. Run a full scan of your computer.

Manual removal*

1. Terminate malicious process(es) (How to End a Process With the Task Manager):
   

   %original file name%.exe:396
   crypt.exe:1388
   WScript.exe:1524
   WScript.exe:1224

2. Delete the original Trojan file.
   
3. Delete or disinfect the following files created/modified by the Trojan:
   

   %Program Files%\Gorn\Gorn\prostoigra.bat (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\$inst\temp_0.tmp (230 bytes)
   %Program Files%\Gorn\Gorn\2.txt (27 bytes)
   %Program Files%\Gorn\Gorn\Uninstall.exe (3832 bytes)
   %Program Files%\Gorn\Gorn\crypt.exe (2753 bytes)
   %Program Files%\Gorn\Gorn\neznoesvidanie.vbs (292 bytes)
   %Program Files%\Gorn\Gorn\dns_bablo.vbs (819 bytes)
   %Program Files%\Gorn\Gorn\Uninstall.ini (2 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\$inst\2.tmp (68 bytes)
   %Program Files%\Gorn\Gorn\1.txt (15 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsh2.tmp (2294 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsw3.tmp\systematists.dll (1856 bytes)
   %Documents and Settings%\%current user%\Application Data\default (1).cfl (1552 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\desktop.ini (67 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\86[1].htm (2 bytes)

4. Delete the following value(s) in the autorun key (How to Work with System Registry):
   

   [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
   "Gorn" = "%Program Files%\Gorn\Gorn\crypt.exe"

5. Restore the original content of the HOSTS file (%System%\drivers\etc\hosts):
   127.0.0.1 localhost
   
6. Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
   
7. Reboot the computer.
   

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.