Skip to main content

Trojan.Generic.5325758_52badfde88


Susp_Dropper (Kaspersky), Trojan.Generic.5325758 (AdAware), Backdoor.Win32.PcClient.FD, Trojan.NSIS.StartPage.FD, Tdl4.YR (Lavasoft MAS)Behaviour: Trojan, Backdoor

The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.

Summary

MD5: 52badfde88a0ee73f28b070519156057

SHA1: ca510f7efe1973edee837569fc53b6325abc6b59

SHA256: 90c9cbd3223f04ee03ae0a8d371082553c47f52fbe45256a038363db7613e303

SSDeep: 12288:nKHFvHmWbA7dB44i2sQ3r/ksIac4CnV/XptFg1AY8es91YfwKGbZq/TcjOO1:nKHF/mWbACQbqJfi1AYHEUnrc31

Size: 818603 bytes

File type: EXE

Platform: WIN32

Entropy: Packed

PEID: UPolyXv05_v6

Company: MONOGRAM Multimedia, s.r.o.

Created at: 2009-02-21 21:46:23

Analyzed on: WindowsXP SP3 32-bit

Summary: Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).

Dynamic Analysis

Payload

No specific payload has been found.

Process activity

The Trojan creates the following process(es):

Done.exe:636
%original file name%.exe:580
WinInstall.exe:912
ntvdm.exe:2244
Rich.exe:1688
E4U.exe:1416
IC.exe:1232
EuroP.exe:1460
tbp.exe:1692
SLFAT.exe:1392
rundll32.exe:2848

The Trojan injects its code into the following process(es):

stb1.exe:444
tenn2.exe:564
Gi.exe:2008
willwnd.exe:424
rundll32.exe:1636
svchost.exe:1108
Explorer.EXE:1140
spoolsv.exe:1448

Mutexes

The following mutexes were created/opened:No objects were found.

File activity

The process stb1.exe:444 makes changes in the file system.


The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\px[1].js (346 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\px[1].js (346 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@bridge.sf.admarketplace[2].txt (487 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@admarketplace[1].txt (232 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\zcredirect[1].htm (384 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\10990-28346606.ampxchange[1].htm (1056 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\CANRFMN5.htm (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\track[1].htm (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\xt.exe (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\12224[1].htm (1 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@admarketplace[2].txt (446 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\quickdomainfwd[1].net&pid=9PO755G95 (2266 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\js3[1].js (2843 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@quickdomainfwd[1].txt (180 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\quickdomainfwd[1].htm (5 bytes)
%Documents and Settings%\%current user%\Cookies\index.dat (4820 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@bridge.sf.admarketplace[1].txt (252 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\83de2468-71e2-11e6-a14b-0ad4d45a4925[1].htm (1007 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\CAX8W3TD (726 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\quickdomainfwd[1].net&pid=9PO755G95 (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\sk-logabpstatus[1].htm (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@bridge.sf.admarketplace[1].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\quickdomainfwd[1].htm (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\zcredirect[1].htm (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@admarketplace[1].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\83de2468-71e2-11e6-a14b-0ad4d45a4925[1].htm (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\CAX8W3TD (0 bytes)

The process Done.exe:636 makes changes in the file system.


The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\WinInstall.exe (1552 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsaC.tmp (45 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nsaD.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nslB.tmp (0 bytes)

The process %original file name%.exe:580 makes changes in the file system.


The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nst3.tmp\EuroP.exe (3616 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nst3.tmp\SLFAT.exe (12024 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nst3.tmp\tenn2.exe (12 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nst3.tmp\E4U.exe (1552 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nst3.tmp\converter7.exe (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nst3.tmp\Gi.exe (2392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nst3.tmp\Rich.exe (3312 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nst3.tmp\tbp.exe (3312 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nst3.tmp\IC.exe (4992 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nse2.tmp (15568 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nst3.tmp\EuroP.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nso1.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nst3.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nst3.tmp\tenn2.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nst3.tmp\E4U.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nst3.tmp\converter7.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nst3.tmp\Gi.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nst3.tmp\tbp.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nst3.tmp\Rich.exe (0 bytes)

The process tenn2.exe:564 makes changes in the file system.


The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\track[1].htm (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\CAN1TMRA.htm (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\park.lwken[1].htm (1 bytes)

The process WinInstall.exe:912 makes changes in the file system.


The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\stb1.exe (784 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nshF.tmp (1568 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\willwnd.exe (784 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nsh10.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nshE.tmp (0 bytes)

The process ntvdm.exe:2244 makes changes in the file system.


The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\px[1].js (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nst3.tmp (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nss7.tmp (4185 bytes)
C:\ (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\px[1].js (4 bytes)
%Documents and Settings%\%current user%\Local Settings\APPLICATION DATA (4 bytes)
%WinDir%\assembly (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp (4 bytes)
%WinDir%\Temp (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\index.dat (2996 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J (4 bytes)
%WinDir%\Microsoft.NET\Framework\v4.0.30319 (672 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\wireshark.txt (344 bytes)
%WinDir%\Microsoft.NET\Framework (96 bytes)
%WinDir%\Microsoft.NET\Framework\v2.0.50727\CONFIG (4 bytes)
%Documents and Settings%\%current user%\MY DOCUMENTS (4 bytes)
%WinDir%\Fonts (632 bytes)
%WinDir%\Temp\scs11.tmp (33880 bytes)
C:\$Directory (2240 bytes)
%Documents and Settings%\%current user%\Local Settings (4 bytes)
%System%\dllcache (648 bytes)
%System% (6264 bytes)
%WinDir%\Microsoft.NET\Framework\V2.0.50727 (768 bytes)
%WinDir% (972 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~DF39BF.tmp (4 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\MSHist012016090320160904\index.dat (400 bytes)
%Documents and Settings%\All Users\DOCUMENTS (4 bytes)
%WinDir%\WinSxS\Policies\x86_Policy.8.0.Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_x-ww_77c24773 (4 bytes)
%System%\config (4 bytes)
%WinDir%\Temp\Perflib_Perfdata_678.dat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\zcredirect[1].htm (4 bytes)
%WinDir%\Temp\scs12.tmp (10145 bytes)
%Documents and Settings%\%current user% (4 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\index.dat (388 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN (4 bytes)
%WinDir%\MICROSOFT.NET (4 bytes)
%Documents and Settings%\%current user%\Cookies (96 bytes)

The Trojan deletes the following file(s):

%WinDir%\Temp\scs11.tmp (0 bytes)
%WinDir%\Temp\scs12.tmp (0 bytes)

The process IC.exe:1232 makes changes in the file system.


The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\4.tmp (601 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\5.tmp (0 bytes)

The process EuroP.exe:1460 makes changes in the file system.


The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Scv..bat (166 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\desktop.ini (159 bytes)

The process tbp.exe:1692 makes changes in the file system.


The Trojan creates and/or writes to the following file(s):

%WinDir%\packcrt.dll (90 bytes)

The process SLFAT.exe:1392 makes changes in the file system.


The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\7za.exe (18424 bytes)
%Documents and Settings%\%current user%\Application Data\Done.exe (1856 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\a1.7z (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nss7.tmp (12234 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nsd6.tmp (0 bytes)

Registry activity

The process stb1.exe:444 makes changes in the system registry.


The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp]
"xt.exe" = "xt"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1D 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "40 FB 29 30 A0 25 76 03 46 85 89 BC 7E 86 60 16"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process Done.exe:636 makes changes in the system registry.


The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "F4 4C 49 81 44 A7 68 75 D0 90 58 88 75 0D 25 D0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp]
"WinInstall.exe" = "WinInstall"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Temp\7]
"7" = "http://www.flvtube.net/12224"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

The process %original file name%.exe:580 makes changes in the system registry.


The Trojan creates and/or sets the following values in system registry:

[HKLM\System\CurrentControlSet\Control\Session Manager]
"PendingFileRenameOperations" = "\??\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\9.tmp, , \??\%WinDir%\TEMP\A.tmp, , \??\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nst3.tmp\EuroP.exe,"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nst3.tmp]
"tbp.exe" = "checkactivate"
"E4U.exe" = "Pagefile Manager"
"Rich.exe" = "Rich"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nst3.tmp]
"SLFAT.exe" = "SLFAT"
"tenn2.exe" = "DrawOverWindows"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nst3.tmp]
"EuroP.exe" = ".KLite Codec Pack"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nst3.tmp]
"Gi.exe" = "Gi"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nst3.tmp]
"converter7.exe" = "Systray .exe stub"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "00 A8 DC F0 F3 DC 63 2F 98 7C 34 66 12 3F 0A 18"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nst3.tmp]
"ic.exe" = "CTF Loader"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

"IntranetName" = "1"

The process tenn2.exe:564 makes changes in the system registry.


The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012016090320160904]
"CacheLimit" = "8192"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012016090320160904]
"CachePrefix" = ":2016090320160904:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012016090320160904]
"CacheRepair" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012016090320160904]
"CacheOptions" = "11"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1E 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012016090320160904]
"CachePath" = "%USERPROFILE%\Local Settings\History\History.IE5\MSHist012016090320160904\"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "BC 77 22 3D 3C 71 F4 E1 5E 48 75 6C CF EF 6E 2E"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan deletes the following registry key(s):

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014031720140318]

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process WinInstall.exe:912 makes changes in the system registry.


The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "77 31 20 8D 95 CD DB 4B 8E B6 B0 33 25 65 A2 C2"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp]
"stb1.exe" = "stb1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp]
"willwnd.exe" = "willwnd"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

The process Gi.exe:2008 makes changes in the system registry.


The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache]
"@xpsp3res.dll,-20001" = "Diagnose Connection Problems..."

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1C 00 00 00 01 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "9B AF 1D 4B 20 32 55 41 04 58 8F 78 F8 3D 71 B3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process ntvdm.exe:2244 makes changes in the system registry.


The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "ED FC 87 38 C7 2F FB 77 34 30 72 1A 02 B0 96 6F"

The process willwnd.exe:424 makes changes in the system registry.


The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "C0 BE A3 3E 64 E2 92 29 A2 9E 7E 3D 74 46 8B FF"

The process Rich.exe:1688 makes changes in the system registry.


The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "C4 1A DF 3C A7 36 15 EF 28 DA EE 3F 51 67 C9 8D"

The process E4U.exe:1416 makes changes in the system registry.


The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "EF 5F D5 DA 84 BB F5 A5 E5 BE 5A 7F 30 3E DF F0"

The process IC.exe:1232 makes changes in the system registry.


The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "EE BC CB D3 E7 CD 3D F1 71 48 66 45 BB D9 18 B7"

[HKLM\System\CurrentControlSet\Control\Session Manager]
"PendingFileRenameOperations" = "\??\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\9.tmp,"

The process EuroP.exe:1460 makes changes in the system registry.


The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\]
"1806" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "85 4C 5C A5 C5 95 0F B6 75 4B FE DC 6A 56 C0 47"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

"IntranetName" = "1"

The process tbp.exe:1692 makes changes in the system registry.


The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "61 B7 D1 A8 52 C2 00 C1 78 55 05 BC 26 43 C0 1B"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Wtube]
"Bveqayeweci" = "43 01 38 03 58 05 51 07 41 09 44 0B 48 0D 41 0F"
"Ydapup" = "36 01 31 03 3D 05 43 07 49 09 3B 0B 3E 0D 3A 0F"

The process SLFAT.exe:1392 makes changes in the system registry.


The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "96 C4 A2 6F 2C F4 76 F1 AB 5E C7 BC EE BC CC 52"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%Documents and Settings%\%current user%\Application Data]
"done.exe" = "Done"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

The process rundll32.exe:2848 makes changes in the system registry.


The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "66 C6 89 2D 36 46 68 76 0C 1C 22 0D 25 1A 8D 13"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Wtube]
"Bveqayeweci" = "43 01 38 03 58 05 51 07 41 09 44 0B 48 0D 41 0F"

The process rundll32.exe:1636 makes changes in the system registry.


The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "BE A6 13 F1 EB 04 53 40 65 6E 3E AE D5 DD 2A 2C"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Wtube]
"Eqegaqojoqoka" = "180"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"Ihoragiqinicim" = "rundll32.exe %WinDir%\packcrt.dll,Startup"

Dropped PE files

MD5 File path
718854b7caba09012abffa7d5836d782c:\Documents and Settings\"%CurrentUserName%"\Application Data\Done.exe
e92604e043f51c604b6d1ac3bcd3a202c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\7za.exe
2511bf2b50a5741cc0d2b91972896c0cc:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\9.tmp
ab8f527334017fec45cc285a063e4340c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\WinInstall.exe
12896823fb95bfb3dc9b46bcaedc9923c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\explorer.dat
12e654572c6ebbf9fec73577d14ce83fc:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nst3.tmp\Gi.exe
67ce715c6f59d2ebbbebae9564fcf97bc:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nst3.tmp\SLFAT.exe
cb8f046e6b9fa5026d38fe5abb8f28fcc:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nst3.tmp\tbp.exe
a94c45db924030d107edafebc29a8f09c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nst3.tmp\tenn2.exe
04bcec7b6cef5cd941e5097b7401b55ec:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\stb1.exe
0ba8663c43440ea72fbd8f4b7890914dc:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\willwnd.exe
ed0ef0a136dec83df69f04118870003ec:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\winlogon.dat
a2133bda7bb648bdc433a117af905e81c:\WINDOWS\Temp\A.tmp
a61da3b3f1b85cd2e94e0a7996b94229c:\WINDOWS\packcrt.dll
8e28886e4a4fff518e51a9528b1482d4c:\WINDOWS\system32\ms.dll

HOSTS file anomalies

No changes have been detected.

Rootkit activity

Using the driver "UNKNOWN" the Trojan controls loading executable images into a memory by installing the Load image notifier.


Using the driver ROOTKITPATH the Trojan intercepts DriverStartIO in a miniport driver of a hard drive controller (ATAPI) to handle request to its own files:

StartIo

Propagation

Removals

Remove it with Ad-Aware

  1. Click (here) to download and install Ad-Aware Free Antivirus.
  2. Update the definition files.
  3. Run a full scan of your computer.

Manual removal*

  1. Scan a system with an anti-rootkit tool.
  2. Terminate malicious process(es) (How to End a Process With the Task Manager):

    Done.exe:636
    %original file name%.exe:580
    WinInstall.exe:912
    ntvdm.exe:2244
    Rich.exe:1688
    E4U.exe:1416
    IC.exe:1232
    EuroP.exe:1460
    tbp.exe:1692
    SLFAT.exe:1392
    rundll32.exe:2848

  3. Delete the original Trojan file.
  4. Delete or disinfect the following files created/modified by the Trojan:

    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\px[1].js (346 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\px[1].js (346 bytes)
    %Documents and Settings%\%current user%\Cookies\Current_User@bridge.sf.admarketplace[2].txt (487 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\desktop.ini (67 bytes)
    %Documents and Settings%\%current user%\Cookies\Current_User@admarketplace[1].txt (232 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\desktop.ini (67 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\zcredirect[1].htm (384 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\10990-28346606.ampxchange[1].htm (1056 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\desktop.ini (67 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\CANRFMN5.htm (4 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\track[1].htm (0 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\xt.exe (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\12224[1].htm (1 bytes)
    %Documents and Settings%\%current user%\Cookies\Current_User@admarketplace[2].txt (446 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\quickdomainfwd[1].net&pid=9PO755G95 (2266 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\js3[1].js (2843 bytes)
    %Documents and Settings%\%current user%\Cookies\Current_User@quickdomainfwd[1].txt (180 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\quickdomainfwd[1].htm (5 bytes)
    %Documents and Settings%\%current user%\Cookies\index.dat (4820 bytes)
    %Documents and Settings%\%current user%\Cookies\Current_User@bridge.sf.admarketplace[1].txt (252 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\desktop.ini (67 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\83de2468-71e2-11e6-a14b-0ad4d45a4925[1].htm (1007 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\CAX8W3TD (726 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\WinInstall.exe (1552 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\nsaC.tmp (45 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\nst3.tmp\EuroP.exe (3616 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\nst3.tmp\SLFAT.exe (12024 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\nst3.tmp\tenn2.exe (12 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\nst3.tmp\E4U.exe (1552 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\nst3.tmp\converter7.exe (3 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\nst3.tmp\Gi.exe (2392 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\nst3.tmp\Rich.exe (3312 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\nst3.tmp\tbp.exe (3312 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\nst3.tmp\IC.exe (4992 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\nse2.tmp (15568 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\track[1].htm (0 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\CAN1TMRA.htm (0 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\park.lwken[1].htm (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\stb1.exe (784 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\nshF.tmp (1568 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\willwnd.exe (784 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\nss7.tmp (4185 bytes)
    %Documents and Settings%\%current user%\Local Settings\APPLICATION DATA (4 bytes)
    %WinDir%\assembly (4 bytes)
    %WinDir%\Temp (4 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\index.dat (2996 bytes)
    %WinDir%\Microsoft.NET\Framework\v4.0.30319 (672 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\wireshark.txt (344 bytes)
    %WinDir%\Microsoft.NET\Framework\v2.0.50727\CONFIG (4 bytes)
    %Documents and Settings%\%current user%\MY DOCUMENTS (4 bytes)
    %WinDir%\Fonts (632 bytes)
    %WinDir%\Temp\scs11.tmp (33880 bytes)
    C:\$Directory (2240 bytes)
    %System%\dllcache (648 bytes)
    %WinDir%\Microsoft.NET\Framework\V2.0.50727 (768 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\~DF39BF.tmp (4 bytes)
    %Documents and Settings%\%current user%\Local Settings\History\History.IE5\MSHist012016090320160904\index.dat (400 bytes)
    %Documents and Settings%\All Users\DOCUMENTS (4 bytes)
    %WinDir%\WinSxS\Policies\x86_Policy.8.0.Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_x-ww_77c24773 (4 bytes)
    %System%\config (4 bytes)
    %WinDir%\Temp\Perflib_Perfdata_678.dat (4 bytes)
    %WinDir%\Temp\scs12.tmp (10145 bytes)
    %Documents and Settings%\%current user%\Local Settings\History\History.IE5\index.dat (388 bytes)
    %WinDir%\MICROSOFT.NET (4 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\4.tmp (601 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\Scv..bat (166 bytes)
    %Documents and Settings%\%current user%\Local Settings\History\History.IE5\desktop.ini (159 bytes)
    %WinDir%\packcrt.dll (90 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\7za.exe (18424 bytes)
    %Documents and Settings%\%current user%\Application Data\Done.exe (1856 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\a1.7z (5 bytes)

  5. Delete the following value(s) in the autorun key (How to Work with System Registry):

    [HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
    "Ihoragiqinicim" = "rundll32.exe %WinDir%\packcrt.dll,Startup"

  6. Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
  7. Reboot the computer.
*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

VersionInfo

No information is available.

No information is available.

PE Sections

Name Virtual Address Virtual Size Raw Size Entropy Section MD5
.text409623458235524.51332cec663f64ef38694dc96bb9f9cb766d
.rdata28672449646083.58909db16645055619c0cc73276ff5c3adb75
.data36864377442410243.26654b9d0aa986d9e766521436f5ad38cd7c5
.ndata38133763276800d41d8cd98f00b204e9800998ecf8427e
.rsrc3846144173620482.018992f2678dd9e97ae3fdffce33f180dbf60

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:


Total found: 78
13ab683047580206713a0f19ebe0427e
3a9d59d3c0513d9e09bdd7cd0913317a
09af02fa44c6bf227bb0d6e199a19499
6df0f423fb672c7925de87b12e214f89
6c77646a57ca346f85955675f504c751
35f27015c54bef542f360a7c2ba5c229
09044e8d1e7cb7f6883f983c17d17bcc
0503370605c61ff728ff008dc03a1825
709c892167fce654126edb577421be29
1dc8f3bb2a983d7137276a217b4d705b
0f339065053ebd425e75b23558963750
ca5d6a20d387eb2e49389f6a39636da9
8a2f117c3e780d2a0ee0aefc9602d738
14e473d02dd6b3107715a02a70cfc4ca
450999c36485a084aa7dd1b603da875b
a51b0e4d59528d3c37c089b3920aefe1
2f92f621850cf288ff8a61cc0a7e1034
0092c82b8f71c849b1799747344a0013
848bd0a9a22e7e72609328d19e9ac880
273bae01660db7dac324f798d2c8812b
e612517c3e59b53ffb829dab9699a8f7
5853e9ba1c8d75393dcef359471d5a9e
90eeaf37ac1ec866ddf48f1f56edf745
65b18506a33d72ec059fb281acf7f87e
485f7cc7b007342caccad569a8eb6b44

Network Activity

URLs

URL IP
hxxp://www.flvtube.net/12224
hxxp://parkingcrew.net/assets/scripts/js3.js
hxxp://www.flvtube.net/track.php?domain=flvtube.net&toggle=browserjs&uid=MTQ3MjkxMjgzNS45MzQ4OmZlMDBkYjAzODc3ZTlhY2MxZjE1ZWMxODk4MjJiMDMzNWM3MGU2ZjI4YWYyMmExNjZkZjMzOGM3Nzc1OGYwYTE6NTdjYWRkYzNlNDNlNg==
hxxp://quickdomainfwd.com/?dn=flvtube.net&pid=9PO755G95208.91.196.46
hxxp://lwken.com/click/?s=151123&c=2554165.61.39.56
hxxp://767113.parkingcrew.net/?s=151123&c=255416
hxxp://quickdomainfwd.com/trf?&o=HFRAMAuCnlXeP3KlHXkYsOaly3GLenZ43pkQYGb+kpYA3tdDpxVqycjzk0vZlLhmGTzHXDjkpFGw/hS+I0X3ab/EkOEHSzp73cgAf4qbq4bfg3ScSql5j38kDQdoDeTo940aU35X4R5MRgNwHOfuhnNPytAMxBdz6gYmLqR5GR1gSOVGM7L/c8EMxIJyqkCACGH/GsNsaNdlltxCL+jtpeOK3Gxtz1dJ/UGL60Kfy2cx9fMm6T+W2q3iOMLZArmpZm0ckskx5HiV35MeMlv7j5vogltbEqj7L3e+JoKSuohXkldg8P8XS6XbdIqaMdcNQ4NlyqEst3uWjLqb26QeMFEAhuCESyP0f5prwASk7rnIlaGGCt+SvF7c3wBXH6PV&c=21242204584369804966200&n=0HmIW0ZsBwY7+oKbpKNcMiiKkOzszstU7HHWkQbByqvIrsfAI7LfUkRWNyPpF2uOeDQ4If5H/i5T8wG2ZSOY7wxw/30Du/yxzk2gf9GX2tKIl3p0TeDh+Hu0h+BBqijdnJUcbBc67/CVtbVvhDwJJGaog6PNwQ2nKD0et8n9PVnziOlPt6yqALR3mZBjGM0H4UTVrc7uCNQYIaU8CFtpYbBqojnfHym9be7B06zeqcDxZzHWG+ayL2xo/ipyy4alk3Pde9zCfkPsHsh3NiWc8LWnXj62vDnnh+nM/Da+srej7n36z+AwlQ9Fqd2AOjpcmSxyjCy6F8o1kNGZjQ53Uax1HQdyBa76IFpTxPu52fzpm/rKDuInKBLFgP7ixEt+Opt4MpYPKLbciIV4Wvmq1leNoP6wFRgRR4V83keVYblPeCDs3/aa31zxQPGtc9aN&kgp=0&jccheck=1208.91.196.46
hxxp://767113.parkingcrew.net/track.php?domain=lwken.com&toggle=browserjs&uid=MTQ3MjkxMjgzNy4yODUzOjQ0MTQ4YTgwNDM1ZGI0NjE0OGJjY2NjNDIyMzlhN2NlNGExYjIyN2UzMjM3MmM4NmYxOTA2M2JmMTFmNzAzMWQ6NTdjYWRkYzU0NWFhNQ==
hxxp://767113.parkingcrew.net/track.php?click=5b53ccd02792a79936184954fc4d1abe5dbbc818&domain=lwken.com&uid=MTQ3MjkxMjgzNy4yODUzOjQ0MTQ4YTgwNDM1ZGI0NjE0OGJjY2NjNDIyMzlhN2NlNGExYjIyN2UzMjM3MmM4NmYxOTA2M2JmMTFmNzAzMWQ6NTdjYWRkYzU0NWFhNQ==&ts=fHx8ZDQxZDh8fHxidWNrZXQwMzl8fHx8NTdjYWRkYzU0NDk5MXx8fDE0NzI5MTI4MzcuODAxM3w5ZjJjNjEwNTU0MzMwNTI4NjRkZDc5MjMzNTliODk5MjVkNTUzYTA5fHx8fHwxfHx8MHw1N2NhZGRjNThlNDdlYWE3MTc4YjRjODh8fHx8fHx8fDB8MHx8fHx8fHx8fA==&kw=&search=&pcat=&rxid=&bucket=&clientID=&adtest=off
hxxp://quickdomainfwd.com/px.js?ch=1208.91.196.46
hxxp://quickdomainfwd.com/px.js?ch=2208.91.196.46
hxxp://quickdomainfwd.com/sk-logabpstatus.php?a=STZaRExrSldTVVBEeGVNQnlDc0NnQkVNa2lZUXE5VVA2NXlvVkFoc29HWE9aUkdTT1pJa0hCVmVDakczMjhFa1hMM1lIZEEyTVBkdUNRdmFFY3VucTlubGhsUmxLSk9JYVFQdkJtMmszVnM9&b=false208.91.196.46
hxxp://zu1.sierra-fox.com/zcvisitor/83de2468-71e2-11e6-a14b-0ad4d45a4925?52.3.56.61
hxxp://zu1.sierra-fox.com/zcredirect?visitid=83de2468-71e2-11e6-a14b-0ad4d45a4925&type=js&browserWidth=589&browserHeight=317&iframeDetected=false52.3.56.61
hxxp://bridge.sf.admarketplace.net/ct?version=16.0.0&ci=1472912837068.10890&key=1472912837200800018.172.28.103.32
hxxp://bridge.sf.admarketplace.net/ct?cid=1472912840200100000&cide=95644800000&ctcookie_value=1472912840012.1AAD0654AC6B559CA3902EF6F5E24EDA&csession=1&version=16.0.0&ci=1472912837068.10890&key=1472912837200800018.172.28.103.32
hxxp://geo-static.ampxchange.com.akadns.net/?sid=NUEmXTQIGzkoGShQXgs5J1ADAzY2UCoXPQhBNn8DfgYKW3l0AUdBamcCfwljXQU2fAd4Ah5acmEFRFNrZwl9DmlfBTZ/Dn0aAV55YgxBXWhmCzMI
hxxp://bridge.sf.admarketplace.net/bounce?click_id=1472912840200100000&m_width=1276&m_height=846&b_width=589&b_height=317&b_top=155&b_left=136&in_iframe=072.28.103.32
hxxp://tzpzc.com/px.js?ch=1208.91.196.46
hxxp://tzpzc.com/trf?&o=HFRAMAuCnlXeP3KlHXkYsOaly3GLenZ43pkQYGb+kpYA3tdDpxVqycjzk0vZlLhmGTzHXDjkpFGw/hS+I0X3ab/EkOEHSzp73cgAf4qbq4bfg3ScSql5j38kDQdoDeTo940aU35X4R5MRgNwHOfuhnNPytAMxBdz6gYmLqR5GR1gSOVGM7L/c8EMxIJyqkCACGH/GsNsaNdlltxCL+jtpeOK3Gxtz1dJ/UGL60Kfy2cx9fMm6T+W2q3iOMLZArmpZm0ckskx5HiV35MeMlv7j5vogltbEqj7L3e+JoKSuohXkldg8P8XS6XbdIqaMdcNQ4NlyqEst3uWjLqb26QeMFEAhuCESyP0f5prwASk7rnIlaGGCt+SvF7c3wBXH6PV&c=21242204584369804966200&n=0HmIW0ZsBwY7+oKbpKNcMiiKkOzszstU7HHWkQbByqvIrsfAI7LfUkRWNyPpF2uOeDQ4If5H/i5T8wG2ZSOY7wxw/30Du/yxzk2gf9GX2tKIl3p0TeDh+Hu0h+BBqijdnJUcbBc67/CVtbVvhDwJJGaog6PNwQ2nKD0et8n9PVnziOlPt6yqALR3mZBjGM0H4UTVrc7uCNQYIaU8CFtpYbBqojnfHym9be7B06zeqcDxZzHWG+ayL2xo/ipyy4alk3Pde9zCfkPsHsh3NiWc8LWnXj62vDnnh+nM/Da+srej7n36z+AwlQ9Fqd2AOjpcmSxyjCy6F8o1kNGZjQ53Uax1HQdyBa76IFpTxPu52fzpm/rKDuInKBLFgP7ixEt+Opt4MpYPKLbciIV4Wvmq1leNoP6wFRgRR4V83keVYblPeCDs3/aa31zxQPGtc9aN&kgp=0&jccheck=1208.91.196.46
hxxp://park.lwken.com/track.php?domain=lwken.com&toggle=browserjs&uid=MTQ3MjkxMjgzNy4yODUzOjQ0MTQ4YTgwNDM1ZGI0NjE0OGJjY2NjNDIyMzlhN2NlNGExYjIyN2UzMjM3MmM4NmYxOTA2M2JmMTFmNzAzMWQ6NTdjYWRkYzU0NWFhNQ==54.72.9.51
hxxp://park.lwken.com/track.php?click=5b53ccd02792a79936184954fc4d1abe5dbbc818&domain=lwken.com&uid=MTQ3MjkxMjgzNy4yODUzOjQ0MTQ4YTgwNDM1ZGI0NjE0OGJjY2NjNDIyMzlhN2NlNGExYjIyN2UzMjM3MmM4NmYxOTA2M2JmMTFmNzAzMWQ6NTdjYWRkYzU0NWFhNQ==&ts=fHx8ZDQxZDh8fHxidWNrZXQwMzl8fHx8NTdjYWRkYzU0NDk5MXx8fDE0NzI5MTI4MzcuODAxM3w5ZjJjNjEwNTU0MzMwNTI4NjRkZDc5MjMzNTliODk5MjVkNTUzYTA5fHx8fHwxfHx8MHw1N2NhZGRjNThlNDdlYWE3MTc4YjRjODh8fHx8fHx8fDB8MHx8fHx8fHx8fA==&kw=&search=&pcat=&rxid=&bucket=&clientID=&adtest=off54.72.9.51
hxxp://10990-28346606.ampxchange.com/?sid=NUEmXTQIGzkoGShQXgs5J1ADAzY2UCoXPQhBNn8DfgYKW3l0AUdBamcCfwljXQU2fAd4Ah5acmEFRFNrZwl9DmlfBTZ/Dn0aAV55YgxBXWhmCzMI72.28.103.31
hxxp://zu1.zeroredirect11.com/zcredirect?visitid=83de2468-71e2-11e6-a14b-0ad4d45a4925&type=js&browserWidth=589&browserHeight=317&iframeDetected=false52.3.56.61
hxxp://tzpzc.com/px.js?ch=2208.91.196.46
hxxp://park.lwken.com/?s=151123&c=25541654.72.9.51
hxxp://tzpzc.com/sk-logabpstatus.php?a=STZaRExrSldTVVBEeGVNQnlDc0NnQkVNa2lZUXE5VVA2NXlvVkFoc29HWE9aUkdTT1pJa0hCVmVDakczMjhFa1hMM1lIZEEyTVBkdUNRdmFFY3VucTlubGhsUmxLSk9JYVFQdkJtMmszVnM9&b=false208.91.196.46
2b.perfectexe.com204.11.56.48
www.facebook.com31.13.92.36
google.co.id216.58.214.195
youporn.com31.192.116.24
katie.dntrx.com54.173.213.61

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

GET /?sid=NUEmXTQIGzkoGShQXgs5J1ADAzY2UCoXPQhBNn8DfgYKW3l0AUdBamcCfwljXQU2fAd4Ah5acmEFRFNrZwl9DmlfBTZ/Dn0aAV55YgxBXWhmCzMI HTTP/1.1

Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Connection: Keep-Alive

Host: 10990-28346606.ampxchange.com

HTTP/1.1 200 OK

Date: Sat, 03 Sep 2016 14:27:20 GMT

Server: Apache/2.2.15 (CentOS)

X-Powered-By: PHP/5.3.3

Content-Length: 4349

Keep-Alive: timeout=15

Connection: Keep-Alive

Content-Type: text/html; charset=UTF-8

..<html>..<head>..<title>Page Loading...</title>..<meta http-equiv="cache-control" content="no-cache" >..<meta http-equiv="pragma" content="no-cache" >..<meta http-equiv="refresh" content="1;url=hXXp://bridge.sf.admarketplace.net/bounce?click_id=1472912840200100000" >..</head>..<body>..<div style="height:300px"><a href="hXXp://bridge.sf.admarketplace.net/bounce?click_id=1472912840200100000&isaction=5" id="redirect" style="color: #FFFFFF">click here!</a></div>..<script type="text/javascript">..function screenSizeParameters() { if (window.screen !== undefined) { return '&m_width=' window.screen.width '&m_height=' window.screen.height; } else if (window.java !== undefined) { var oScreen = ava.awt.Toolkit.getDefaultToolkit().getScreenSize().screen; return '&m_width=' oScreen.width '&m_height=' oScreen.height; } else { return '&m_width=&m_height='; }};..function docSizeParameters() { var doc = window.document; if (typeof window.innerWidth === 'number') { return '&b_width=' window.innerWidth '&b_height=' window.innerHeight;} else if (doc.documentElement !== undefined && doc.documentElement.clientWidth !== undefined && doc.documentElement.clientWidth !== 0) { return '&b_width=' doc.documentElement.clientWidth '&b_height=' doc.documentElement.clientHeight; } else if (doc.body !== undefined && doc.body.clientWidth !== undefined) { return '&b_width=' doc.body.clientWidth '&b_height=' doc.body.clientHeight; }

<<< skipped >>>

GET /zcredirect?visitid=83de2468-71e2-11e6-a14b-0ad4d45a4925&type=js&browserWidth=589&browserHeight=317&iframeDetected=false HTTP/1.1

Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: zu1.zeroredirect11.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Cache-Control: no-store, no-cache, pre-check=0, post-check=0

content-security-policy: default-src 'self'; script-src 'self' 'unsafe-inline'

x-content-security-policy: default-src 'self'; script-src 'self' 'unsafe-inline'

X-WebKit-CSP: default-src 'self'; script-src 'self' 'unsafe-inline'

redirected: JS

Content-Type: text/html;charset=UTF-8

Transfer-Encoding: chunked

Date: Sat, 03 Sep 2016 14:27:19 GMT

Server: ZeroPark-Traffic

180..<!DOCTYPE html>.<html>..<head>...<META http-equiv="refresh" content="1;URL='hXXp://bridge.sf.admarketplace.net/ct?version=16.0.0&ci=1472912837068.10890&key=1472912837200800018.1'">..</head>..<body>...<script type="text/javascript">....window.location="hXXp://bridge.sf.admarketplace.net/ct?version=16.0.0&ci=1472912837068.10890&key=1472912837200800018.1";...</script>..</body>.</html>..0..HTTP/1.1 200 OK..Cache-Control: no-store, no-cache, pre-check=0, post-check=0..content-security-policy: default-src 'self'; script-src 'self' 'unsafe-inline'..x-content-security-policy: default-src 'self'; script-src 'self' 'unsafe-inline'..X-WebKit-CSP: default-src 'self'; script-src 'self' 'unsafe-inline'..redirected: JS..Content-Type: text/html;charset=UTF-8..Transfer-Encoding: chunked..Date: Sat, 03 Sep 2016 14:27:19 GMT..Server: ZeroPark-Traffic..180..<!DOCTYPE html>.<html>..<head>...<META http-equiv="refresh" content="1;URL='hXXp://bridge.sf.admarketplace.net/ct?version=16.0.0&ci=1472912837068.10890&key=1472912837200800018.1'">..</head>..<body>...<script type="text/javascript">....window.location="hXXp://bridge.sf.admarketplace.net/ct?version=16.0.0&ci=1472912837068.10890&key=1472912837200800018.1";...</script>..</body>.</html>..0..

<<< skipped >>>

GET /12224 HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.flvtube.net

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx

Date: Sat, 03 Sep 2016 14:05:55 GMT

Content-Type: text/html; charset=UTF-8

Transfer-Encoding: chunked

Connection: keep-alive

Vary: Accept-Encoding

X-Check: 3c12dc4d54f8e22d666785b733b0052100c53444

X-Language: english

X-Template: tpl_CleanPeppermintBlack_twoclick

Content-Encoding: gzip

370.............T]s.H.}...a.b. DAGF.V.....$.1.2.6..|9..tk..6BjI......q...=}._4......O..{\.~.....(n.;Q.,.{.....P....&y@.4..(....>..o.X..PJB..D.Y....5.....Rp.._....U.%...c...4h.{6.1t..lN...k/z.....%Of..s.q..1........"xS..4.8.....<..K.)..Xs.q..Y..ZPo0..S..e..r....)..7.x.\..].w,.b.....u..f...0H8...$.F.?;..$.U`.F....A....I2HX.dw.?..q|......6.......X.o...!...1*S.e...C3.`cH...9.A.7..... N...h....hh.vi[...\bo.C.."..g..-5..(|g.xy0.q...8..dmet..*,.V.a...g. ..Y...s[..w..<.Q.....\y....O......t).O......!=B.N..Bl.....R..~.0.'.2\...a.....\$.$...95............fY...../..&*..*.7 ....=Z...u....S.....W.O#Wc2z..u.......1Z3..H.}5.]....192...24...f.....V82.Uhn.>....,.M.1...qa5X.mY.*=m-..e..L....1..m}....Ac[.so[.......M-.N..b.....=t...... q.RH.(..$."A.J...........p~~.z.ql...g....Z_.......... ... .E...L..W.#E.o..X.&..........h.......B.3.1V....0.6 . ].........r..\Uy4....2.g....]....a..l.]...^.v......0..HTTP/1.1 200 OK..Server: nginx..Date: Sat, 03 Sep 2016 14:05:55 GMT..Content-Type: text/html; charset=UTF-8..Transfer-Encoding: chunked..Connection: keep-alive..Vary: Accept-Encoding..X-Check: 3c12dc4d54f8e22d666785b733b0052100c53444..X-Language: english..X-Template: tpl_CleanPeppermintBlack_twoclick..Content-Encoding: gzip..370.............T]s.H.}...a.b. DAGF.V.....$.1.2.6..|9..tk..6BjI......q...=}._4......O..{\.~.....(n.;Q.,.{.....P....&y@.4..(....>..o.X..PJB..D.Y....5.....Rp.._....U.%...c...4h.{6.1t..lN...k/z.....%Of..s.q..1........"xS..4.8.....<..K.)..Xs.q..Y..ZPo0..S..e..r....)..7.x.\..].w,.b.....u..f...0H8...$.F.?;

<<< skipped >>>

GET /track.php?domain=flvtube.net&toggle=browserjs&uid=MTQ3MjkxMjgzNS45MzQ4OmZlMDBkYjAzODc3ZTlhY2MxZjE1ZWMxODk4MjJiMDMzNWM3MGU2ZjI4YWYyMmExNjZkZjMzOGM3Nzc1OGYwYTE6NTdjYWRkYzNlNDNlNg== HTTP/1.1

Accept: */*

Accept-Language: en-us

Referer: hXXp://VVV.flvtube.net/12224

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.flvtube.net

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx

Date: Sat, 03 Sep 2016 14:05:55 GMT

Content-Type: text/html; charset=UTF-8

Transfer-Encoding: chunked

Connection: keep-alive

Vary: Accept-Encoding

Access-Control-Allow-Origin: *

Content-Encoding: gzip

14........................0..HTTP/1.1 200 OK..Server: nginx..Date: Sat, 03 Sep 2016 14:05:55 GMT..Content-Type: text/html; charset=UTF-8..Transfer-Encoding: chunked..Connection: keep-alive..Vary: Accept-Encoding..Access-Control-Allow-Origin: *..Content-Encoding: gzip..14........................0..

GET /?s=151123&c=255416 HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: park.lwken.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx

Date: Sat, 03 Sep 2016 14:29:59 GMT

Content-Type: text/html; charset=UTF-8

Transfer-Encoding: chunked

Connection: keep-alive

Vary: Accept-Encoding

X-Check: 3c12dc4d54f8e22d666785b733b0052100c53444

Content-Encoding: gzip

3ec.............T.r.8.].....B...6S....I0......y%.r<.."....[6..T.M..|..t...N~h..a>.9.F!.......vW...L.4C.^..x.$^.....G.$F. .a.k......<..\...M0....%.....=..mj.o[..."..L.M.i<...Y...%.f...z4$.a.....ep..h"......._...y?x.j{.....k.{....R...T...p.EiF.z.Nw...[2.z{.Q..v.X.}.#..B.....s-....vn[.(..$B^..\...3z...s....a-.....Z.........[.K.\i.j..E. ...C.H.{]..\\./}..}..%.B..`......%.m*...D@..Y..i....0."XM .]..a...)0....w.\.....=.|2c.hz G..%....)c{.......J.{..1.gvZx..i.p@...v6.cC.'.@.Y^|.~!.F.#7dS.5...9%.'...'!&.....5K..9Iw..z 8%9..*...!;%e.....u.'....--}...(F;m].4w..={....:g*.....jA...#G........P..J..@..;..35..........?.;....*h.......,.2.i...Y.E}.E.1....'..n.5;4.s..X1.'.u...r..,..=.....z3.N.zb%vy>.o5..{...|.......b\o..k.....\}...e3..aBg..W.7~Ne..L.\.u^..V_...{.q...cy ..q_q.bK."}...H...oZ.4..a...c..)q..f.elY..&.......@..<[...M.D.1B.P....B..`..-ih.,Dd..{..O/i..r)........Hk.a.t.{\....%.-.<.....@]....#&......r........0...D\.........hd.....aQ!....!...3 ...........R.....|.f....(..3-..U....}......!N.............L......0..HTTP/1.1 200 OK..Server: nginx..Date: Sat, 03 Sep 2016 14:29:59 GMT..Content-Type: text/html; charset=UTF-8..Transfer-Encoding: chunked..Connection: keep-alive..Vary: Accept-Encoding..X-Check: 3c12dc4d54f8e22d666785b733b0052100c53444..Content-Encoding: gzip..3ec.............T.r.8.].....B...6S....I0......y%.r<.."....[6..T.M..|..t...N~h..a>.9.F!.......vW...L.4C.^..x.$^.....G.$F. .a.k......<..\...M0....%.....=..mj.o[..."..L.M.i<...Y...%.f...z4$.a.....ep..h"......._...y?x.j{.....k.{....R.

<<< skipped >>>

GET /track.php?domain=lwken.com&toggle=browserjs&uid=MTQ3MjkxMjgzNy4yODUzOjQ0MTQ4YTgwNDM1ZGI0NjE0OGJjY2NjNDIyMzlhN2NlNGExYjIyN2UzMjM3MmM4NmYxOTA2M2JmMTFmNzAzMWQ6NTdjYWRkYzU0NWFhNQ== HTTP/1.1

Accept: */*

Accept-Language: en-us

Referer: hXXp://park.lwken.com/?s=151123&c=255416

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: park.lwken.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx

Date: Sat, 03 Sep 2016 14:29:59 GMT

Content-Type: text/html; charset=UTF-8

Transfer-Encoding: chunked

Connection: keep-alive

Vary: Accept-Encoding

Access-Control-Allow-Origin: *

Content-Encoding: gzip

14........................0......

GET /track.php?click=5b53ccd02792a79936184954fc4d1abe5dbbc818&domain=lwken.com&uid=MTQ3MjkxMjgzNy4yODUzOjQ0MTQ4YTgwNDM1ZGI0NjE0OGJjY2NjNDIyMzlhN2NlNGExYjIyN2UzMjM3MmM4NmYxOTA2M2JmMTFmNzAzMWQ6NTdjYWRkYzU0NWFhNQ==&ts=fHx8ZDQxZDh8fHxidWNrZXQwMzl8fHx8NTdjYWRkYzU0NDk5MXx8fDE0NzI5MTI4MzcuODAxM3w5ZjJjNjEwNTU0MzMwNTI4NjRkZDc5MjMzNTliODk5MjVkNTUzYTA5fHx8fHwxfHx8MHw1N2NhZGRjNThlNDdlYWE3MTc4YjRjODh8fHx8fHx8fDB8MHx8fHx8fHx8fA==&kw=&search=&pcat=&rxid=&bucket=&clientID=&adtest=off HTTP/1.1

Accept: */*

Accept-Language: en-us

Referer: hXXp://park.lwken.com/?s=151123&c=255416

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: park.lwken.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx

Date: Sat, 03 Sep 2016 14:29:59 GMT

Content-Type: text/html; charset=UTF-8

Transfer-Encoding: chunked

Connection: keep-alive

Vary: Accept-Encoding

Access-Control-Allow-Origin: *

Content-Encoding: gzip

14........................0..HTTP/1.1 200 OK..Server: nginx..Date: Sat, 03 Sep 2016 14:29:59 GMT..Content-Type: text/html; charset=UTF-8..Transfer-Encoding: chunked..Connection: keep-alive..Vary: Accept-Encoding..Access-Control-Allow-Origin: *..Content-Encoding: gzip..14........................0..

GET /trf?&o=HFRAMAuCnlXeP3KlHXkYsOaly3GLenZ43pkQYGb+kpYA3tdDpxVqycjzk0vZlLhmGTzHXDjkpFGw/hS+I0X3ab/EkOEHSzp73cgAf4qbq4bfg3ScSql5j38kDQdoDeTo940aU35X4R5MRgNwHOfuhnNPytAMxBdz6gYmLqR5GR1gSOVGM7L/c8EMxIJyqkCACGH/GsNsaNdlltxCL+jtpeOK3Gxtz1dJ/UGL60Kfy2cx9fMm6T+W2q3iOMLZArmpZm0ckskx5HiV35MeMlv7j5vogltbEqj7L3e+JoKSuohXkldg8P8XS6XbdIqaMdcNQ4NlyqEst3uWjLqb26QeMFEAhuCESyP0f5prwASk7rnIlaGGCt+SvF7c3wBXH6PV&c=21242204584369804966200&n=0HmIW0ZsBwY7+oKbpKNcMiiKkOzszstU7HHWkQbByqvIrsfAI7LfUkRWNyPpF2uOeDQ4If5H/i5T8wG2ZSOY7wxw/30Du/yxzk2gf9GX2tKIl3p0TeDh+Hu0h+BBqijdnJUcbBc67/CVtbVvhDwJJGaog6PNwQ2nKD0et8n9PVnziOlPt6yqALR3mZBjGM0H4UTVrc7uCNQYIaU8CFtpYbBqojnfHym9be7B06zeqcDxZzHWG+ayL2xo/ipyy4alk3Pde9zCfkPsHsh3NiWc8LWnXj62vDnnh+nM/Da+srej7n36z+AwlQ9Fqd2AOjpcmSxyjCy6F8o1kNGZjQ53Uax1HQdyBa76IFpTxPu52fzpm/rKDuInKBLFgP7ixEt+Opt4MpYPKLbciIV4Wvmq1leNoP6wFRgRR4V83keVYblPeCDs3/aa31zxQPGtc9aN&kgp=0&jccheck=1 HTTP/1.1

Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: tzpzc.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Sat, 03 Sep 2016 14:27:18 GMT

Server: Apache

Vary: Accept-Encoding,User-Agent

ntCoent-Length: 4909

Keep-Alive: timeout=5, max=122

Connection: Keep-Alive

Content-Type: text/html; charset=UTF-8

Cache-Control: private

Content-Encoding: gzip

Content-Length: 2061

...........Xyo......)<<M....B7HG].. ......j.$.I.....Q..;...Uu.;V.z9..wV;.C50}...O.2%K.|...W.'.. ...~....?.Ga.Je.R.... ..6T.i...K.M5.V..7Ij.cI'z....\d`W.......D.../...b*.....HB..F.qiC...d`.6....\.q....B...`..b......a.A~...2x.5y6;......./Tq..[.1n...?.....=.a/f..S.GW..G...d...`.8.9..l....1.-c4j......<;....Ts....Y..v.\.....}..n.f.{...#'\.....".k.......5...W;7L[.p-..w.S... ..z.g.z5].{mx..aM.2.:G...:6..k'..@>EW.|W..?^........~>....m...`,K....o..'?...t...b...^.N?.*7O.S*..9.?........swQ..n"..E..Z..V.Xl....r.M....y.Bt/ .7A.. ....[.r.C$A.._@....B..fsB......$.VQ...`6\..e.M ua.&.....F.....A........VG..X.h........dg.J..|..;...... .,.6.D..,..-...7b.U. ..t......k....U.{..h. ......S.]8.:..F........D.. A.m.U3.y.....KW.k...._...6..............G.u._.Dz.....c-.zw.<<....|..........q/.....7.F..o.....h9&.j.O.._...*.O....w.....C..@uv.B........t........wsy.).;.....s....P...{......]....{..K:.C.K\..h2Y...&..^....a..T6...V.._q_by.G...W.<.......Z....`B.3B.8J.X .......n6.O.i.C.. ..km@t.^Y.........~ l....J*<..s..u.a.8&hL...P..H...`q..8.S;.n.nI.?{....Su..X..i <q...w.N(pJ.....O...2..d_bh..7x.....=.....U...h...7.n. ....@.z(....0.LG......]? TGB-....-qCB.^C..[.I..{E.CL.....&.3.cc#.T........yK.......Z.<.!....Q.C..,.4l...q"...L....)!..r.W... .......~...LD)....p%G.....C.'..=.pI.Bc.U"...c.%kZ.PbA@`1.o...x...].T3...<.T...-9?...y..H..h.}..G.Z7]p$ ..Vn..;.....MbSP....dV#.m.#..`.4 .|....Q.n.{.yc;.....xJ43.......-..0..Q.xH!n ..j.b...K...VS.B...E.v....TS.P...c...._H..c....L...Xz&'....J.. ..v..m.......~(xb.LAj&w........[.

<<< skipped >>>

GET /px.js?ch=1 HTTP/1.1

Accept: */*

Referer: hXXp://tzpzc.com/trf?&o=HFRAMAuCnlXeP3KlHXkYsOaly3GLenZ43pkQYGb+kpYA3tdDpxVqycjzk0vZlLhmGTzHXDjkpFGw/hS+I0X3ab/EkOEHSzp73cgAf4qbq4bfg3ScSql5j38kDQdoDeTo940aU35X4R5MRgNwHOfuhnNPytAMxBdz6gYmLqR5GR1gSOVGM7L/c8EMxIJyqkCACGH/GsNsaNdlltxCL+jtpeOK3Gxtz1dJ/UGL60Kfy2cx9fMm6T+W2q3iOMLZArmpZm0ckskx5HiV35MeMlv7j5vogltbEqj7L3e+JoKSuohXkldg8P8XS6XbdIqaMdcNQ4NlyqEst3uWjLqb26QeMFEAhuCESyP0f5prwASk7rnIlaGGCt+SvF7c3wBXH6PV&c=21242204584369804966200&n=0HmIW0ZsBwY7+oKbpKNcMiiKkOzszstU7HHWkQbByqvIrsfAI7LfUkRWNyPpF2uOeDQ4If5H/i5T8wG2ZSOY7wxw/30Du/yxzk2gf9GX2tKIl3p0TeDh+Hu0h+BBqijdnJUcbBc67/CVtbVvhDwJJGaog6PNwQ2nKD0et8n9PVnziOlPt6yqALR3mZBjGM0H4UTVrc7uCNQYIaU8CFtpYbBqojnfHym9be7B06zeqcDxZzHWG+ayL2xo/ipyy4alk3Pde9zCfkPsHsh3NiWc8LWnXj62vDnnh+nM/Da+srej7n36z+AwlQ9Fqd2AOjpcmSxyjCy6F8o1kNGZjQ53Uax1HQdyBa76IFpTxPu52fzpm/rKDuInKBLFgP7ixEt+Opt4MpYPKLbciIV4Wvmq1leNoP6wFRgRR4V83keVYblPeCDs3/aa31zxQPGtc9aN&kgp=0&jccheck=1

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: tzpzc.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Sat, 03 Sep 2016 14:27:18 GMT

Server: Apache

Last-Modified: Thu, 11 Jun 2015 06:47:35 GMT

Accept-Ranges: bytes

Content-Length: 346

Cache-Control: max-age=1209600

Expires: Sat, 17 Sep 2016 14:27:18 GMT

Vary: Accept-Encoding,User-Agent

Keep-Alive: timeout=5, max=115

Connection: Keep-Alive

Content-Type: application/x-javascript

GET /px.js?ch=2 HTTP/1.1

Accept: */*

Referer: hXXp://tzpzc.com/trf?&o=HFRAMAuCnlXeP3KlHXkYsOaly3GLenZ43pkQYGb+kpYA3tdDpxVqycjzk0vZlLhmGTzHXDjkpFGw/hS+I0X3ab/EkOEHSzp73cgAf4qbq4bfg3ScSql5j38kDQdoDeTo940aU35X4R5MRgNwHOfuhnNPytAMxBdz6gYmLqR5GR1gSOVGM7L/c8EMxIJyqkCACGH/GsNsaNdlltxCL+jtpeOK3Gxtz1dJ/UGL60Kfy2cx9fMm6T+W2q3iOMLZArmpZm0ckskx5HiV35MeMlv7j5vogltbEqj7L3e+JoKSuohXkldg8P8XS6XbdIqaMdcNQ4NlyqEst3uWjLqb26QeMFEAhuCESyP0f5prwASk7rnIlaGGCt+SvF7c3wBXH6PV&c=21242204584369804966200&n=0HmIW0ZsBwY7+oKbpKNcMiiKkOzszstU7HHWkQbByqvIrsfAI7LfUkRWNyPpF2uOeDQ4If5H/i5T8wG2ZSOY7wxw/30Du/yxzk2gf9GX2tKIl3p0TeDh+Hu0h+BBqijdnJUcbBc67/CVtbVvhDwJJGaog6PNwQ2nKD0et8n9PVnziOlPt6yqALR3mZBjGM0H4UTVrc7uCNQYIaU8CFtpYbBqojnfHym9be7B06zeqcDxZzHWG+ayL2xo/ipyy4alk3Pde9zCfkPsHsh3NiWc8LWnXj62vDnnh+nM/Da+srej7n36z+AwlQ9Fqd2AOjpcmSxyjCy6F8o1kNGZjQ53Uax1HQdyBa76IFpTxPu52fzpm/rKDuInKBLFgP7ixEt+Opt4MpYPKLbciIV4Wvmq1leNoP6wFRgRR4V83keVYblPeCDs3/aa31zxQPGtc9aN&kgp=0&jccheck=1

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: tzpzc.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Sat, 03 Sep 2016 14:27:18 GMT

Server: Apache

Last-Modified: Thu, 11 Jun 2015 06:47:35 GMT

Accept-Ranges: bytes

Content-Length: 346

Cache-Control: max-age=1209600

Expires: Sat, 17 Sep 2016 14:27:18 GMT

Vary: Accept-Encoding,User-Agent

Keep-Alive: timeout=5, max=121

Connection: Keep-Alive

Content-Type: application/x-javascript

var abp=abp||false;var scripts=document.getElementsByTagName("script");var script=scripts[scripts.length-1];if(script){var query=script.src.replace(/^[^\?] \??/,"").split("&");var params={};for(var i=0;i<query.length;i ){var param=query[i].split("=");params[param[0]]=param[1]}if(params["ch"]==1)abp=true;else if(params["ch"]==2)abp=abp&&false};HTTP/1.1 200 OK..Date: Sat, 03 Sep 2016 14:27:18 GMT..Server: Apache..Last-Modified: Thu, 11 Jun 2015 06:47:35 GMT..Accept-Ranges: bytes..Content-Length: 346..Cache-Control: max-age=1209600..Expires: Sat, 17 Sep 2016 14:27:18 GMT..Vary: Accept-Encoding,User-Agent..Keep-Alive: timeout=5, max=121..Connection: Keep-Alive..Content-Type: application/x-javascript..var abp=abp||false;var scripts=document.getElementsByTagName("script");var script=scripts[scripts.length-1];if(script){var query=script.src.replace(/^[^\?] \??/,"").split("&");var params={};for(var i=0;i<query.length;i ){var param=query[i].split("=");params[param[0]]=param[1]}if(params["ch"]==1)abp=true;else if(params["ch"]==2)abp=abp&&false};....

GET /sk-logabpstatus.php?a=STZaRExrSldTVVBEeGVNQnlDc0NnQkVNa2lZUXE5VVA2NXlvVkFoc29HWE9aUkdTT1pJa0hCVmVDakczMjhFa1hMM1lIZEEyTVBkdUNRdmFFY3VucTlubGhsUmxLSk9JYVFQdkJtMmszVnM9&b=false HTTP/1.1

Accept: */*

Referer: hXXp://tzpzc.com/trf?&o=HFRAMAuCnlXeP3KlHXkYsOaly3GLenZ43pkQYGb+kpYA3tdDpxVqycjzk0vZlLhmGTzHXDjkpFGw/hS+I0X3ab/EkOEHSzp73cgAf4qbq4bfg3ScSql5j38kDQdoDeTo940aU35X4R5MRgNwHOfuhnNPytAMxBdz6gYmLqR5GR1gSOVGM7L/c8EMxIJyqkCACGH/GsNsaNdlltxCL+jtpeOK3Gxtz1dJ/UGL60Kfy2cx9fMm6T+W2q3iOMLZArmpZm0ckskx5HiV35MeMlv7j5vogltbEqj7L3e+JoKSuohXkldg8P8XS6XbdIqaMdcNQ4NlyqEst3uWjLqb26QeMFEAhuCESyP0f5prwASk7rnIlaGGCt+SvF7c3wBXH6PV&c=21242204584369804966200&n=0HmIW0ZsBwY7+oKbpKNcMiiKkOzszstU7HHWkQbByqvIrsfAI7LfUkRWNyPpF2uOeDQ4If5H/i5T8wG2ZSOY7wxw/30Du/yxzk2gf9GX2tKIl3p0TeDh+Hu0h+BBqijdnJUcbBc67/CVtbVvhDwJJGaog6PNwQ2nKD0et8n9PVnziOlPt6yqALR3mZBjGM0H4UTVrc7uCNQYIaU8CFtpYbBqojnfHym9be7B06zeqcDxZzHWG+ayL2xo/ipyy4alk3Pde9zCfkPsHsh3NiWc8LWnXj62vDnnh+nM/Da+srej7n36z+AwlQ9Fqd2AOjpcmSxyjCy6F8o1kNGZjQ53Uax1HQdyBa76IFpTxPu52fzpm/rKDuInKBLFgP7ixEt+Opt4MpYPKLbciIV4Wvmq1leNoP6wFRgRR4V83keVYblPeCDs3/aa31zxQPGtc9aN&kgp=0&jccheck=1

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: tzpzc.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Sat, 03 Sep 2016 14:27:18 GMT

Server: Apache

Vary: Accept-Encoding,User-Agent

Content-Length: 0

Keep-Alive: timeout=5, max=123

Connection: Keep-Alive

Content-Type: text/html; charset=UTF-8

HTTP/1.1 200 OK..Date: Sat, 03 Sep 2016 14:27:18 GMT..Server: Apache..Vary: Accept-Encoding,User-Agent..Content-Length: 0..Keep-Alive: timeout=5, max=123..Connection: Keep-Alive..Content-Type: text/html; charset=UTF-8..

GET /click/?s=151123&c=255416 HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: lwken.com

Connection: Keep-Alive

HTTP/1.1 301 Moved Permanently

Date: Sat, 03 Sep 2016 05:01:30 GMT

Server: Apache/2.2.15 (CentOS)

Location: hXXp://park.lwken.com?s=151123&c=255416

Content-Length: 326

Connection: close

Content-Type: text/html; charset=iso-8859-1

<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">.<html><head>.<title>301 Moved Permanently</title>.</head><body>.<h1>Moved Permanently</h1>.<p>The document has moved <a href="hXXp://park.lwken.com?s=151123&c=255416">here</a>.</p>.<hr>.<address>Apache/2.2.15 (CentOS) Server at lwken.com Port 80</address>.</body></html>...

GET /zcvisitor/83de2468-71e2-11e6-a14b-0ad4d45a4925? HTTP/1.1

Referer: hXXp://zu1.sierra-fox.com/zcvisitor/83de2468-71e2-11e6-a14b-0ad4d45a4925?

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)

Accept: */*

Host: zu1.sierra-fox.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Cache-Control: no-store, no-cache, pre-check=0, post-check=0

content-security-policy: default-src 'self'; script-src 'self' 'unsafe-inline'

x-content-security-policy: default-src 'self'; script-src 'self' 'unsafe-inline'

X-WebKit-CSP: default-src 'self'; script-src 'self' 'unsafe-inline'

Content-Type: text/html;charset=UTF-8

Transfer-Encoding: chunked

Date: Sat, 03 Sep 2016 14:27:19 GMT

Server: ZeroPark-Traffic

3ef..<!DOCTYPE html>.<html>..<head>...<META http-equiv="refresh" content="1;URL='hXXp://zu1.zeroredirect11.com/zcredirect?visitid=83de2468-71e2-11e6-a14b-0ad4d45a4925&type=meta'">..</head>..<body>...<script type="text/javascript">....setTimeout(function () {.....var pageWidth = window.innerWidth ? window.innerWidth : (document.documentElement && document.documentElement.clientWidth ? document.documentElement.clientWidth : document.getElementsByTagName('body')[0].clientWidth);.....var pageHeight = window.innerHeight ? window.innerHeight : (document.documentElement && document.documentElement.clientHeight ? document.documentElement.clientHeight : document.getElementsByTagName('body')[0].clientHeight);.....var iframeDetected = window.self !== window.top;.....window.location="hXXp://zu1.zeroredirect11.com/zcredirect?visitid=83de2468-71e2-11e6-a14b-0ad4d45a4925&type=js&browserWidth=" pageWidth "&browserHeight=" pageHeight "&iframeDetected=" iframeDetected;....}, 1);...</script>..</body>.</html>..0..

GET /ct?version=16.0.0&ci=1472912837068.10890&key=1472912837200800018.1 HTTP/1.1

Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: bridge.sf.admarketplace.net

Connection: Keep-Alive

HTTP/1.1 302 Found

Server: Apache-Coyote/1.1

Set-Cookie: JSESSIONID=1AAD0654AC6B559CA3902EF6F5E24EDA; Path=/; HttpOnly

P3P: CP="CAO IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"

Set-Cookie: bridge_v2=1472912840012.1AAD0654AC6B559CA3902EF6F5E24EDA; Expires=Wed, 02-Nov-2016 14:27:20 GMT

Set-Cookie: bridge_v2=1472912840012.1AAD0654AC6B559CA3902EF6F5E24EDA; Domain=.admarketplace.net; Expires=Wed, 02-Nov-2016 14:27:20 GMT

Set-Cookie: csession_1472912840200100000=1472912840012; Expires=Sat, 03-Sep-2016 14:57:20 GMT

Set-Cookie: csession_1472912840200100000=1472912840012; Domain=.admarketplace.net; Expires=Sat, 03-Sep-2016 14:57:20 GMT

Location: hXXp://bridge.sf.admarketplace.net/ct?cid=1472912840200100000&cide=95644800000&ctcookie_value=1472912840012.1AAD0654AC6B559CA3902EF6F5E24EDA&csession=1&version=16.0.0&ci=1472912837068.10890&key=1472912837200800018.1

Content-Length: 0

Date: Sat, 03 Sep 2016 14:27:19 GMT

....

GET /ct?cid=1472912840200100000&cide=95644800000&ctcookie_value=1472912840012.1AAD0654AC6B559CA3902EF6F5E24EDA&csession=1&version=16.0.0&ci=1472912837068.10890&key=1472912837200800018.1 HTTP/1.1

Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: bridge.sf.admarketplace.net

Connection: Keep-Alive

Cookie: JSESSIONID=1AAD0654AC6B559CA3902EF6F5E24EDA; bridge_v2=1472912840012.1AAD0654AC6B559CA3902EF6F5E24EDA; csession_1472912840200100000=1472912840012; bridge_v2=1472912840012.1AAD0654AC6B559CA3902EF6F5E24EDA; csession_1472912840200100000=1472912840012

HTTP/1.1 302 Found

Server: Apache-Coyote/1.1

Location: hXXp://10990-28346606.ampxchange.com?sid=NUEmXTQIGzkoGShQXgs5J1ADAzY2UCoXPQhBNn8DfgYKW3l0AUdBamcCfwljXQU2fAd4Ah5acmEFRFNrZwl9DmlfBTZ/Dn0aAV55YgxBXWhmCzMI

Content-Length: 0

Date: Sat, 03 Sep 2016 14:27:19 GMT

HTTP/1.1 302 Found..Server: Apache-Coyote/1.1..Location: hXXp://10990-28346606.ampxchange.com?sid=NUEmXTQIGzkoGShQXgs5J1ADAzY2UCoXPQhBNn8DfgYKW3l0AUdBamcCfwljXQU2fAd4Ah5acmEFRFNrZwl9DmlfBTZ/Dn0aAV55YgxBXWhmCzMI..Content-Length: 0..Date: Sat, 03 Sep 2016 14:27:19 GMT......

GET /bounce?click_id=1472912840200100000&m_width=1276&m_height=846&b_width=589&b_height=317&b_top=155&b_left=136&in_iframe=0 HTTP/1.1

Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*

Referer: hXXp://10990-28346606.ampxchange.com/?sid=NUEmXTQIGzkoGShQXgs5J1ADAzY2UCoXPQhBNn8DfgYKW3l0AUdBamcCfwljXQU2fAd4Ah5acmEFRFNrZwl9DmlfBTZ/Dn0aAV55YgxBXWhmCzMI

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: bridge.sf.admarketplace.net

Connection: Keep-Alive

Cookie: JSESSIONID=1AAD0654AC6B559CA3902EF6F5E24EDA; bridge_v2=1472912840012.1AAD0654AC6B559CA3902EF6F5E24EDA; csession_1472912840200100000=1472912840012; bridge_v2=1472912840012.1AAD0654AC6B559CA3902EF6F5E24EDA; csession_1472912840200100000=1472912840012

HTTP/1.1 302 Found

Server: Apache-Coyote/1.1

Location: hXXps://VVV.facebook.com/campaign/landing.php?campaign_id=1565112697068002&partner_id=admarket&placement=Ukraine&extra_1=1472912840200100000

Content-Length: 0

Date: Sat, 03 Sep 2016 14:27:20 GMT

HTTP/1.1 302 Found..Server: Apache-Coyote/1.1..Location: hXXps://VVV.facebook.com/campaign/landing.php?campaign_id=1565112697068002&partner_id=admarket&placement=Ukraine&extra_1=1472912840200100000..Content-Length: 0..Date: Sat, 03 Sep 2016 14:27:20 GMT..

GET /zcvisitor/83de2468-71e2-11e6-a14b-0ad4d45a4925? HTTP/1.1

Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*

Referer: hXXp://tzpzc.com/trf?&o=HFRAMAuCnlXeP3KlHXkYsOaly3GLenZ43pkQYGb+kpYA3tdDpxVqycjzk0vZlLhmGTzHXDjkpFGw/hS+I0X3ab/EkOEHSzp73cgAf4qbq4bfg3ScSql5j38kDQdoDeTo940aU35X4R5MRgNwHOfuhnNPytAMxBdz6gYmLqR5GR1gSOVGM7L/c8EMxIJyqkCACGH/GsNsaNdlltxCL+jtpeOK3Gxtz1dJ/UGL60Kfy2cx9fMm6T+W2q3iOMLZArmpZm0ckskx5HiV35MeMlv7j5vogltbEqj7L3e+JoKSuohXkldg8P8XS6XbdIqaMdcNQ4NlyqEst3uWjLqb26QeMFEAhuCESyP0f5prwASk7rnIlaGGCt+SvF7c3wBXH6PV&c=21242204584369804966200&n=0HmIW0ZsBwY7+oKbpKNcMiiKkOzszstU7HHWkQbByqvIrsfAI7LfUkRWNyPpF2uOeDQ4If5H/i5T8wG2ZSOY7wxw/30Du/yxzk2gf9GX2tKIl3p0TeDh+Hu0h+BBqijdnJUcbBc67/CVtbVvhDwJJGaog6PNwQ2nKD0et8n9PVnziOlPt6yqALR3mZBjGM0H4UTVrc7uCNQYIaU8CFtpYbBqojnfHym9be7B06zeqcDxZzHWG+ayL2xo/ipyy4alk3Pde9zCfkPsHsh3NiWc8LWnXj62vDnnh+nM/Da+srej7n36z+AwlQ9Fqd2AOjpcmSxyjCy6F8o1kNGZjQ53Uax1HQdyBa76IFpTxPu52fzpm/rKDuInKBLFgP7ixEt+Opt4MpYPKLbciIV4Wvmq1leNoP6wFRgRR4V83keVYblPeCDs3/aa31zxQPGtc9aN&kgp=0&jccheck=1

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: zu1.sierra-fox.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Cache-Control: no-store, no-cache, pre-check=0, post-check=0

content-security-policy: default-src 'self'; script-src 'self' 'unsafe-inline'

x-content-security-policy: default-src 'self'; script-src 'self' 'unsafe-inline'

X-WebKit-CSP: default-src 'self'; script-src 'self' 'unsafe-inline'

Content-Type: text/html;charset=UTF-8

Transfer-Encoding: chunked

Date: Sat, 03 Sep 2016 14:27:18 GMT

Server: ZeroPark-Traffic

3ef..<!DOCTYPE html>.<html>..<head>...<META http-equiv="refresh" content="1;URL='hXXp://zu1.zeroredirect11.com/zcredirect?visitid=83de2468-71e2-11e6-a14b-0ad4d45a4925&type=meta'">..</head>..<body>...<script type="text/javascript">....setTimeout(function () {.....var pageWidth = window.innerWidth ? window.innerWidth : (document.documentElement && document.documentElement.clientWidth ? document.documentElement.clientWidth : document.getElementsByTagName('body')[0].clientWidth);.....var pageHeight = window.innerHeight ? window.innerHeight : (document.documentElement && document.documentElement.clientHeight ? document.documentElement.clientHeight : document.getElementsByTagName('body')[0].clientHeight);.....var iframeDetected = window.self !== window.top;.....window.location="hXXp://zu1.zeroredirect11.com/zcredirect?visitid=83de2468-71e2-11e6-a14b-0ad4d45a4925&type=js&browserWidth=" pageWidth "&browserHeight=" pageHeight "&iframeDetected=" iframeDetected;....}, 1);...</script>..</body>.</html>..0..

GET /assets/scripts/js3.js HTTP/1.1

Accept: */*

Referer: hXXp://VVV.flvtube.net/12224

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: parkingcrew.net

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx

Date: Sat, 03 Sep 2016 14:05:55 GMT

Content-Type: application/javascript

Content-Length: 17915

Connection: keep-alive

Last-Modified: Tue, 23 Feb 2016 09:02:42 GMT

ETag: "56cc2032-45fb"

Accept-Ranges: bytes

var web2dspl = num_ads;..function getU(name) { ..var pattern = "[\?&]" name "=([^]*)"; ..var regex=new RegExp(pattern); ..var res=regex.exec(document.location.href); ..if(res==null){return ""}else{return decodeURIComponent(res[1])}.}..function checkWebsrc() {..if (reqt == 's' && got_ads) {...prepWebres();....if( document.getElementById('webrsc') ) {....window.setTimeout(function() {.....document.getElementById('webrsc').setAttribute('src', scriptPath '/scripts/webres.php?max=' encodeURIComponent(web2dspl) '&c=' encodeURIComponent(country) '&xbase=' encodeURIComponent(xbase) '&search=' encodeURIComponent(afs_q) "&d=" encodeURIComponent(domain) "&auto_load=" encodeURIComponent(xt_auto_load));....}, 200);...}..} else {...window.setTimeout(function() {....if(document.getElementById('webresults')) document.getElementById('webresults').innerHTML = '';...}, 100);..}.}..function prepWebres() {..if(asset_path == undefined) asset_path = '';..if(document.getElementById('webresults')) document.getElementById('webresults').innerHTML = '<span id="ajaxloaderHolder"><img src="' asset_path '/images/ajax-loader.gif" class="ajax-loader" /></span>';.}..var fallback_done = false;.function afdFallback() {..if (reqt == 's' && !got_ads && navigator.appVersion.search("WebKit") <= 0) {.//..google_afd_request = { 'adtest': adtest, client: clientIDd, domain_name: domain, num_radlinks: 0, hl: xlang, ad: 'w' num_ads, 'num_ads': num_ads, token: search_token, kw: keyword, q: afs_q, user_search: is_UserSearch };...tr

<<< skipped >>>

GET /?dn=flvtube.net&pid=9PO755G95 HTTP/1.1

Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: quickdomainfwd.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Sat, 03 Sep 2016 14:27:16 GMT

Server: Apache

Set-Cookie: vsid=924vr2204584367504966; expires=Thu, 02-Sep-2021 14:27:16 GMT; path=/; domain=quickdomainfwd.com; httponly

Expires: Mon, 22 Jul 2002 11:12:01 GMT

Cache-Control: private, no-cache

Pragma: no-cache

Vary: Accept-Encoding,User-Agent

ntCoent-Length: 5020

Keep-Alive: timeout=5, max=120

Connection: Keep-Alive

Content-Type: text/html; charset=UTF-8

Content-Encoding: gzip

Content-Length: 1399

...........X...8.}....#:...Jc..]e..7p.,......b1;.......YU.=SY..c=.E:.......6....F.1...k..8.....r....J...a.Q....%K<..|n6q.....~.'.o.!'....g..;".Yx..=......D...D..$...#7:..6&Q...x)].z.../lK.8...L..J......#.....U.......x...q[7-f.7...0=w.2.....6.......HkK............Q..._....nY.e/H.%......_....cA$=B*..lx....1...).F.q.2^.`',Yja.4.....[.:.1.(...'~t.)..n...=....]...5.<.O.Kw. ....6Yh.]..zj..a..1.5....-{E<M1....X....fS....M.Rf'Jn...&....a....:.B.6:.........4M.;.6..{T...4E=..%...uNG.S.8..=Z.Pr....i..]W...J...u..&?.....>.....LA.U{nv..r:..M.........2.$#."/].2.......D..Ml.O...4.....^vP.A.$2..................,&........Q<..E./....]......>..l,.Nsm...pt.Gqx.L...:..(.D1...R<.$.V,.<......y...._.MWM..fd..{.Cp...u..U..D...Xi....aKb.7o..... ........v..[.,./.......2...e..h..Y.6..'t.b....h9....O.uT".....X.........<$.*{.......1...tOE.I...McZe.R......Z.G.@s8..[.....i....\.<....X..keY..1..\MV>..}...m..zZ.........W.9......=.Gu..n.."..G@..%..y.i.j}n......-..4..I.......0AY.....j...=..0q".<-.2.B\..]...:.EDz0.q.O.C..U......if.@............4.=........Z.*... .|.u....x......'.J$....F..../......4*.....g..g........?..j...4..8.|?F.n..!. .nk.......A....9...'N`5Z?I.j.Y.8..r.l..%....$.gI...j...}$.o.O.....W..;..W..Z.r....6...z........{/..rx/...r...~.....~....D..S...B..U.x..Y.o.8....jU.xNP.i.5*...?..bh7P.QT.*.~%..<....Q..N."R...............3..3w.....Jg.c....Q..M~.p........M....... ..Zw....]..?t`.......K.........6........

<<< skipped >>>

Map

The Trojan connects to the servers at the folowing location(s):

Strings from Dumps

SLFAT.exe_1392:

.text

.text

`.rdata

`.rdata

@.data

@.data

.ndata

.ndata

.rsrc

.rsrc

uDSSh

uDSSh

.DEFAULT\Control Panel\International

.DEFAULT\Control Panel\International

Software\Microsoft\Windows\CurrentVersion

Software\Microsoft\Windows\CurrentVersion

GetWindowsDirectoryA

GetWindowsDirectoryA

KERNEL32.dll

KERNEL32.dll

ExitWindowsEx

ExitWindowsEx

USER32.dll

USER32.dll

GDI32.dll

GDI32.dll

SHFileOperationA

SHFileOperationA

ShellExecuteA

ShellExecuteA

SHELL32.dll

SHELL32.dll

RegEnumKeyA

RegEnumKeyA

RegCreateKeyExA

RegCreateKeyExA

RegCloseKey

RegCloseKey

RegDeleteKeyA

RegDeleteKeyA

RegOpenKeyExA

RegOpenKeyExA

ADVAPI32.dll

ADVAPI32.dll

COMCTL32.dll

COMCTL32.dll

ole32.dll

ole32.dll

VERSION.dll

VERSION.dll

verifying installer: %d%%

verifying installer: %d%%

unpacking data: %d%%

unpacking data: %d%%

... %d%%

... %d%%

hXXp://nsis.sf.net/NSIS_Error

hXXp://nsis.sf.net/NSIS_Error

~nsu.tmp

~nsu.tmp

%u.%u%s%s

%u.%u%s%s

RegDeleteKeyExA

RegDeleteKeyExA

%s=%s

%s=%s

*?|/":

*?|/":

cuments and Settings\"%CurrentUserName%"\Application Data\Done.exe

cuments and Settings\"%CurrentUserName%"\Application Data\Done.exe

open "%Documents and Settings%\%current user%\Application Data\Done.exe"

open "%Documents and Settings%\%current user%\Application Data\Done.exe"

"%Documents and Settings%\%current user%\Application Data\Done.exe"

"%Documents and Settings%\%current user%\Application Data\Done.exe"

.reloc

.reloc

q.cf&

q.cf&

MB, # %s =

MB, # %s =

RAM %s

RAM %s

N)0.BG

N)0.BG

:\Documents and Settings\"%CurrentUserName%"\Application Data\Done.exe"

:\Documents and Settings\"%CurrentUserName%"\Application Data\Done.exe"

"C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nst3.tmp\SLFAT.exe"

"C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nst3.tmp\SLFAT.exe"

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nst3.tmp

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nst3.tmp

SLFAT.exe

SLFAT.exe

CUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsd6.tmp

CUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsd6.tmp

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nst3.tmp\SLFAT.exe

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nst3.tmp\SLFAT.exe

Gi.exe_2008:

`.rsrc

`.rsrc

Ludps

Ludps

WebBrtsLr

WebBrtsLr

vb6chs.dll

vb6chs.dll

.Create

.Create

udpsocket

udpsocket

AutoDownload.Socket

AutoDownload.Socket

WebBrowser1

WebBrowser1

SHDocVwCtl.WebBrowser

SHDocVwCtl.WebBrowser

shdocvw.dll

shdocvw.dll

WebBrowser

WebBrowser

VBA6.DLL

VBA6.DLL

InternetOpenUrlA

InternetOpenUrlA

wininet.dll

wininet.dll

HttpQueryInfoA

HttpQueryInfoA

%Program Files%\Microsoft Visual Studio\VB98\VB6.OLB

%Program Files%\Microsoft Visual Studio\VB98\VB6.OLB

%System%\shdocvw.oca

%System%\shdocvw.oca

2rudpsocket

2rudpsocket

advapi32.dll

advapi32.dll

RegCreateKeyA

RegCreateKeyA

RegCloseKey

RegCloseKey

RegOpenKeyA

RegOpenKeyA

shell32.dll

shell32.dll

udpstop

udpstop

ws2_32.dll

ws2_32.dll

%System%\msvbvm60.dll\3

%System%\msvbvm60.dll\3

RemotePort

RemotePort

LocalPort

LocalPort

netapi32.dll

netapi32.dll

GetProcessHeap

GetProcessHeap

SAFE_OsrrW8QT3oyL2DrXBq0HbxrLleTcp1wv

SAFE_OsrrW8QT3oyL2DrXBq0HbxrLleTcp1wv

Returns/Sets the port to be connected to on the remote computer

Returns/Sets the port to be connected to on the remote computer

lngPort

lngPort

Returns/Sets the port used on the local computer

Returns/Sets the port used on the local computer

Binds socket to specific port and adapter

Binds socket to specific port and adapter

Occurs after a send operation has completed

Occurs after a send operation has completed

.text

.text

`.data

`.data

.rsrc

.rsrc

qo%S2

qo%S2

ld2%S2 of

ld2%S2 of

4%S WL

4%S WL

S2%S\Wo

S2%S\Wo

deXEQ

deXEQ

we2%S

we2%S

O!2%S2W AS2%Stla%S2%nt"*

O!2%S2W AS2%Stla%S2%nt"*

).eX!

).eX!

S2%Sher0

S2%Sher0

KERNEL32.DLL

KERNEL32.DLL

MSVBVM60.DLL

MSVBVM60.DLL

*\AS:\Worker\tempvbp\AutoDownload.vbp

*\AS:\Worker\tempvbp\AutoDownload.vbp

USER32.DLL

USER32.DLL

ADVAPI32.DLL

ADVAPI32.DLL

WININET.DLL

WININET.DLL

RegOpenKeyExA

RegOpenKeyExA

@*\AS:\Worker\tempvbp\AutoDownload.vbp

@*\AS:\Worker\tempvbp\AutoDownload.vbp

dick.exe

dick.exe

tenn2.exe_564_rwx_05F40000_00010000:

s@SShi

s@SShi

LHGDbeXEwwo

LHGDbeXEwwo

rundll32.exe_1636:

.text

.text

`.data

`.data

.rsrc

.rsrc

msvcrt.dll

msvcrt.dll

KERNEL32.dll

KERNEL32.dll

NTDLL.DLL

NTDLL.DLL

GDI32.dll

GDI32.dll

USER32.dll

USER32.dll

IMAGEHLP.dll

IMAGEHLP.dll

rundll32.pdb

rundll32.pdb

.....eZXnnnnnnnnnnnn3

.....eZXnnnnnnnnnnnn3

....eDXnnnnnnnnnnnn3

....eDXnnnnnnnnnnnn3

...eDXnnnnnnnnnnnn,

...eDXnnnnnnnnnnnn,

.eDXnnnnnnnnnnnn,

.eDXnnnnnnnnnnnn,

%Xnnnnnnnnnnnnnnn1

%Xnnnnnnnnnnnnnnn1

O3$dS7"%U9

O3$dS7"%U9

.manifest

.manifest

5.1.2600.5512 (xpsp.080413-2105)

5.1.2600.5512 (xpsp.080413-2105)

RUNDLL.EXE

RUNDLL.EXE

Windows

Windows

Operating System

Operating System

5.1.2600.5512

5.1.2600.5512

YThere is not enough memory to run the file %s.

YThere is not enough memory to run the file %s.

Please close other windows and try again.

Please close other windows and try again.

9The file %s or one of its components could not be opened.

9The file %s or one of its components could not be opened.

0The file %s or one of its components cannot run.

0The file %s or one of its components cannot run.

MThe file %s or one of its components requires a different version of Windows.

MThe file %s or one of its components requires a different version of Windows.

UThe file %s or one of its components cannot run in standard or enhanced mode Windows.3Another instance of the file %s is already running./An exception occurred while trying to run "%s"

UThe file %s or one of its components cannot run in standard or enhanced mode Windows.3Another instance of the file %s is already running./An exception occurred while trying to run "%s"

Error in %s

Error in %s

Missing entry:%s

Missing entry:%s

Error loading %s

Error loading %s

Gi.exe_2008_rwx_00401000_00058000:

.Create

.Create

udpsocket

udpsocket

AutoDownload.Socket

AutoDownload.Socket

WebBrowser1

WebBrowser1

SHDocVwCtl.WebBrowser

SHDocVwCtl.WebBrowser

vb6chs.dll

vb6chs.dll

shdocvw.dll

shdocvw.dll

WebBrowser

WebBrowser

VBA6.DLL

VBA6.DLL

InternetOpenUrlA

InternetOpenUrlA

wininet.dll

wininet.dll

HttpQueryInfoA

HttpQueryInfoA

%Program Files%\Microsoft Visual Studio\VB98\VB6.OLB

%Program Files%\Microsoft Visual Studio\VB98\VB6.OLB

%System%\shdocvw.oca

%System%\shdocvw.oca

2rudpsocket

2rudpsocket

advapi32.dll

advapi32.dll

RegCreateKeyA

RegCreateKeyA

RegCloseKey

RegCloseKey

RegOpenKeyA

RegOpenKeyA

shell32.dll

shell32.dll

udpstop

udpstop

ws2_32.dll

ws2_32.dll

%System%\msvbvm60.dll\3

%System%\msvbvm60.dll\3

RemotePort

RemotePort

LocalPort

LocalPort

netapi32.dll

netapi32.dll

GetProcessHeap

GetProcessHeap

SAFE_OsrrW8QT3oyL2DrXBq0HbxrLleTcp1wv

SAFE_OsrrW8QT3oyL2DrXBq0HbxrLleTcp1wv

Returns/Sets the port to be connected to on the remote computer

Returns/Sets the port to be connected to on the remote computer

lngPort

lngPort

Returns/Sets the port used on the local computer

Returns/Sets the port used on the local computer

Binds socket to specific port and adapter

Binds socket to specific port and adapter

Occurs after a send operation has completed

Occurs after a send operation has completed

.text

.text

`.data

`.data

.rsrc

.rsrc

qo%S2

qo%S2

ld2%S2 of

ld2%S2 of

4%S WL

4%S WL

S2%S\Wo

S2%S\Wo

deXEQ

deXEQ

we2%S

we2%S

*\AS:\Worker\tempvbp\AutoDownload.vbp

*\AS:\Worker\tempvbp\AutoDownload.vbp

USER32.DLL

USER32.DLL

KERNEL32.DLL

KERNEL32.DLL

ADVAPI32.DLL

ADVAPI32.DLL

WININET.DLL

WININET.DLL

RegOpenKeyExA

RegOpenKeyExA

@*\AS:\Worker\tempvbp\AutoDownload.vbp

@*\AS:\Worker\tempvbp\AutoDownload.vbp

rundll32.exe_1636_rwx_00970000_00010000:

s@SShi

s@SShi

LHGDbeXEwwo

LHGDbeXEwwo

willwnd.exe_424:

.text

.text

`.data

`.data

.rsrc

.rsrc

MSVBVM60.DLL

MSVBVM60.DLL

%Program Files%\Microsoft Visual Studio\VB98\VB6.OLB

%Program Files%\Microsoft Visual Studio\VB98\VB6.OLB

user32.dll

user32.dll

VBA6.DLL

VBA6.DLL

@*\AC:\Users\Sean\Desktop\stbnes\willwind\Project1.vbp

@*\AC:\Users\Sean\Desktop\stbnes\willwind\Project1.vbp

killwnd.exe

killwnd.exe

rundll32.exe_1636_rwx_10000000_00001000:

.text

.text

`.data

`.data

.reloc

.reloc

willwnd.exe_424_rwx_00E60000_00010000:

s@SShi

s@SShi

LHGDbeXEwwo

LHGDbeXEwwo

stb1.exe_444:

.text

.text

`.data

`.data

.rsrc

.rsrc

MSVBVM60.DLL

MSVBVM60.DLL

Project1.UserControl1

Project1.UserControl1

SHDocVwCtl.WebBrowser

SHDocVwCtl.WebBrowser

StrUrl

StrUrl

ieframe.dll

ieframe.dll

WebBrowser

WebBrowser

%Program Files%\Microsoft Visual Studio\VB98\VB6.OLB

%Program Files%\Microsoft Visual Studio\VB98\VB6.OLB

C:\Windows\System32\ieframe.oca

C:\Windows\System32\ieframe.oca

user32.dll

user32.dll

EnumWindows

EnumWindows

shell32.dll

shell32.dll

ShellExecuteA

ShellExecuteA

VBA6.DLL

VBA6.DLL

EnumChildWindows

EnumChildWindows

WinHttp

WinHttp

.HTTPDownload

.HTTPDownload

.C:\Windows\system32\winhttp.dll

.C:\Windows\system32\winhttp.dll

C:\Windows\system32\mshtml.tlb

C:\Windows\system32\mshtml.tlb

*\AC:\Users\Sean\Desktop\stbnes\Project1.vbp

*\AC:\Users\Sean\Desktop\stbnes\Project1.vbp

\xt.exe

\xt.exe

Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)

Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)

@*\AC:\Users\Sean\Desktop\stbnes\Project1.vbp

@*\AC:\Users\Sean\Desktop\stbnes\Project1.vbp

1.00.0011

1.00.0011

stb1.exe

stb1.exe

stb1.exe_444_rwx_033B0000_00010000:

s@SShi

s@SShi

LHGDbeXEwwo

LHGDbeXEwwo

svchost.exe_1108_rwx_00A70000_00012000:

t.FE;l$

t.FE;l$

winmm.dll

winmm.dll

ole32.dll

ole32.dll

maxhttpredirects

maxhttpredirects

software\microsoft\windows\currentversion\internet settings

software\microsoft\windows\currentversion\internet settings

enablehttp1_1

enablehttp1_1

software\microsoft\windows\currentversion\internet settings\zones\3

software\microsoft\windows\currentversion\internet settings\zones\3

%s\%s

%s\%s

hXXp://%s/?xurl=%s&xref=%s

hXXp://%s/?xurl=%s&xref=%s

clk=%s&bid=%s&aid=%s&sid=%s&rd=%s

clk=%s&bid=%s&aid=%s&sid=%s&rd=%s

atl.dll

atl.dll

oleaut32.dll

oleaut32.dll

n%D,3

n%D,3

Global\3006345f-6baf-4669-a7e1-aaa310564be9

Global\3006345f-6baf-4669-a7e1-aaa310564be9

kdmf.tmp

kdmf.tmp

%d|%d|%s|%s

%d|%d|%s|%s

Mozilla/4.0 (compatible; MSIE 1.0; Windows NT; CMD3)

Mozilla/4.0 (compatible; MSIE 1.0; Windows NT; CMD3)

DownloadAndExecute

DownloadAndExecute

DownloadCryptedAndExecute

DownloadCryptedAndExecute

DownloadCryptedAndExecute2

DownloadCryptedAndExecute2

%[^.].%[^(](%[^)])

%[^.].%[^(](%[^)])

command|%s|%s|%s|%s|%s|%s|%s|%s|%s|%s|%s

command|%s|%s|%s|%s|%s|%s|%s|%s|%s|%s|%s

setup.exe

setup.exe

google;yahoo;bing.;live.com;msn.com;altavista.com;ask.com;exalead.com;excite.com;dogpile.com;metacrawler.com;webcrawler.com;alltheweb.com;.lycos.;gigablast.com;cuil.com;.aol.;entireweb.com;.search.com;mamma.com;mytalkingbuddy.com;about.com;myspace.com;answers.com;conduit.com;alexa.com;alltheinternet.com;blinkx.com;macromedia.com;adobe.com;amazon.com;facebook.com;youtube.com;wikipedia.org;wikimedia.org;twitter.com;aolcdn.com;othersonline.com;everesttech.net;adrevolver.com;tribalfusion.com;adbureau.net;abmr.net;gstatic.com;virtualearth.net;atdmt.com;ivwbox.;powerset.net;yimg.com;2mdn.net;doubleclick.net;iwon.com;scorecardresearch.com;66.235.120.66;66.235.120.67;ytimg.com;infospace.com;edgesuite.net;superpages.com;lygo.com;compete.com;firmserve.com;worthathousandwords.com;yieldmanager.com;wazizu.com;meedea.com;atwola.com;doubleverify.com;tacoda.net;truveo.com;openx.org;adcertising.com;twimg.com;picsearch.com;oneriot.com;.com.com;flickr.com;searchvideo.com;.tqn.com;myspacecdn.com;fimservecdn.com;alexametrics.com

google;yahoo;bing.;live.com;msn.com;altavista.com;ask.com;exalead.com;excite.com;dogpile.com;metacrawler.com;webcrawler.com;alltheweb.com;.lycos.;gigablast.com;cuil.com;.aol.;entireweb.com;.search.com;mamma.com;mytalkingbuddy.com;about.com;myspace.com;answers.com;conduit.com;alexa.com;alltheinternet.com;blinkx.com;macromedia.com;adobe.com;amazon.com;facebook.com;youtube.com;wikipedia.org;wikimedia.org;twitter.com;aolcdn.com;othersonline.com;everesttech.net;adrevolver.com;tribalfusion.com;adbureau.net;abmr.net;gstatic.com;virtualearth.net;atdmt.com;ivwbox.;powerset.net;yimg.com;2mdn.net;doubleclick.net;iwon.com;scorecardresearch.com;66.235.120.66;66.235.120.67;ytimg.com;infospace.com;edgesuite.net;superpages.com;lygo.com;compete.com;firmserve.com;worthathousandwords.com;yieldmanager.com;wazizu.com;meedea.com;atwola.com;doubleverify.com;tacoda.net;truveo.com;openx.org;adcertising.com;twimg.com;picsearch.com;oneriot.com;.com.com;flickr.com;searchvideo.com;.tqn.com;myspacecdn.com;fimservecdn.com;alexametrics.com

HTTP/1.1 302 Found

HTTP/1.1 302 Found

Location: %s

Location: %s

HTTP/1.1 200 OK

HTTP/1.1 200 OK

Content-Length: %d

Content-Length: %d

hXXps://68b6b6b6.com/;hXXps://61.61.20.132/;hXXps://34jh7alm94.asia/;hXXps://61.61.20.135/;hXXps://nyewrika.in/;hXXps://rukkieanno.in/

hXXps://68b6b6b6.com/;hXXps://61.61.20.132/;hXXps://34jh7alm94.asia/;hXXps://61.61.20.135/;hXXps://nyewrika.in/;hXXps://rukkieanno.in/

hXXp://rudolfdisney.com/;hXXp://crozybanner.com/;hXXp://imagemonstar.com/;hXXp://funimgpixson.com/;hXXp://bunnylandisney.com/

hXXp://rudolfdisney.com/;hXXp://crozybanner.com/;hXXp://imagemonstar.com/;hXXp://funimgpixson.com/;hXXp://bunnylandisney.com/

hXXp://cri71ki813ck.com/

hXXp://cri71ki813ck.com/

hXXp://lkckclckl1i1i.com/

hXXp://lkckclckl1i1i.com/

cfg.ini

cfg.ini

urlmon.dll

urlmon.dll

bckfg.tmp

bckfg.tmp

svchost.exe

svchost.exe

Global\9e6af8f3-75f3-4b67-877a-c80125d7bc08

Global\9e6af8f3-75f3-4b67-877a-c80125d7bc08

*firefox*

*firefox*

*chrome*

*chrome*

*opera*

*opera*

Global\a68d7de8-eba6-4a54-90e0-9cb9d93b3ed7

Global\a68d7de8-eba6-4a54-90e0-9cb9d93b3ed7

Global\cc51461b-e32a-4883-8e97-e0706dc65415

Global\cc51461b-e32a-4883-8e97-e0706dc65415

keywords

keywords

Accept-Language: %s

Accept-Language: %s

%s hXXp://%s/?xurl=%s&xref=%s

%s hXXp://%s/?xurl=%s&xref=%s

%s %s

%s %s

1.6|%s|%s|%s|%s|%s|%s

1.6|%s|%s|%s|%s|%s|%s

0123456789

0123456789

software\classes\http\shell\open\command

software\classes\http\shell\open\command

firefox

firefox

:"/\|?*

:"/\|?*

%s-%s

%s-%s

. d SP.%s

. d SP.%s

%s.dll

%s.dll

kernel32.dll

kernel32.dll

.text

.text

.rdata

.rdata

Global\452fefe0-a06e-400f-8d6b-6a12a0a09d4b

Global\452fefe0-a06e-400f-8d6b-6a12a0a09d4b

VVV.google.

VVV.google.

/webhp

/webhp

search.yahoo.com

search.yahoo.com

.altavista.com

.altavista.com

/web/results

/web/results

.ask.com

.ask.com

VVV.exalead.com

VVV.exalead.com

/search/web/results

/search/web/results

VVV.alltheweb.com

VVV.alltheweb.com

search.lycos.

search.lycos.

tab=web

tab=web

gigablast.com

gigablast.com

cuil.com

cuil.com

.aol.

.aol.

entireweb.com

entireweb.com

md=web

md=web

VVV.search.com

VVV.search.com

VVV.mamma.com

VVV.mamma.com

mytalkingbuddy.com

mytalkingbuddy.com

searchservice.myspace.com

searchservice.myspace.com

type=web

type=web

search.conduit.com

search.conduit.com

search.toolbars.alexa.com

search.toolbars.alexa.com

alltheinternet.com

alltheinternet.com

/ws/results/web/

/ws/results/web/

%u|%u

%u|%u

ver=%s&bid=%s&aid=%s&sid=%s&rd=%s&eng=%s&q=%s

ver=%s&bid=%s&aid=%s&sid=%s&rd=%s&eng=%s&q=%s

hXXp://%s%s

hXXp://%s%s

?xurl=

?xurl=

http/1.

http/1.

mozilla

mozilla

windowsupdate

windowsupdate

\\?\globalroot\device\00000a8a\3edcdc2b\kdmf.tmp

\\?\globalroot\device\00000a8a\3edcdc2b\kdmf.tmp

%WinDir%\System32\svchost.exe

%WinDir%\System32\svchost.exe

1078081533

1078081533

\\?\globalroot\device\00000a8a\3edcdc2b

\\?\globalroot\device\00000a8a\3edcdc2b

cmd.dll

cmd.dll

\\?\globalroot\device\00000a8a\3edcdc2b\keywords

\\?\globalroot\device\00000a8a\3edcdc2b\keywords

\\?\globalroot\device\00000a8a\3edcdc2b\cfg.ini

\\?\globalroot\device\00000a8a\3edcdc2b\cfg.ini

WinExec

WinExec

SHEnumKeyExA

SHEnumKeyExA

FindFirstUrlCacheEntryW

FindFirstUrlCacheEntryW

UnlockUrlCacheEntryFileW

UnlockUrlCacheEntryFileW

DeleteUrlCacheEntryW

DeleteUrlCacheEntryW

FindNextUrlCacheEntryW

FindNextUrlCacheEntryW

InternetCrackUrlA

InternetCrackUrlA

HttpOpenRequestA

HttpOpenRequestA

HttpSendRequestA

HttpSendRequestA

HttpQueryInfoW

HttpQueryInfoW

FindCloseUrlCache

FindCloseUrlCache

`.rdata

`.rdata

@.data

@.data

.reloc

.reloc

KERNEL32.DLL

KERNEL32.DLL

ADVAPI32.dll

ADVAPI32.dll

imagehlp.dll

imagehlp.dll

ntdll.dll

ntdll.dll

SHLWAPI.dll

SHLWAPI.dll

USER32.dll

USER32.dll

WININET.dll

WININET.dll

WebBrowser

WebBrowser

%s-%d

%s-%d

eplorer\iexplore.exe" -nohome

eplorer\iexplore.exe" -nohome

Explorer.EXE_1140_rwx_00FF0000_00009000:

.exeu]

.exeu]

%szptfzubjhp.php?adv=adv468&code1=%s&code2=%s&id=%d&p=%s&b=%s

%szptfzubjhp.php?adv=adv468&code1=%s&code2=%s&id=%d&p=%s&b=%s

Chrome

Chrome

Firefox

Firefox

Opera

Opera

%swtlj.exe

%swtlj.exe

%ssjnlgn.php?adv=adv468

%ssjnlgn.php?adv=adv468

%stmvspdwr.exe

%stmvspdwr.exe

%styfnhc.php?adv=adv468

%styfnhc.php?adv=adv468

%sifdla.exe

%sifdla.exe

%sxbvqxsa.php?adv=adv468

%sxbvqxsa.php?adv=adv468

%syset.exe

%syset.exe

%sxavdxsz.php?adv=adv468

%sxavdxsz.php?adv=adv468

%sldnhp.exe

%sldnhp.exe

%shyfaitavt.php?adv=adv468

%shyfaitavt.php?adv=adv468

%sbekyd.exe

%sbekyd.exe

%sqhlkrzhf.php?adv=adv468

%sqhlkrzhf.php?adv=adv468

%sbxxlpcxo.exe

%sbxxlpcxo.exe

%skbwdyfeyta.php?adv=adv468

%skbwdyfeyta.php?adv=adv468

%shywgxge.exe

%shywgxge.exe

%smmaucwe.php?adv=adv468

%smmaucwe.php?adv=adv468

%sokyqih.exe

%sokyqih.exe

%scptrlg.php?adv=adv468

%scptrlg.php?adv=adv468

%snyjq.exe

%snyjq.exe

%sizgowq.php?adv=adv468

%sizgowq.php?adv=adv468

%saydvhkl.exe

%saydvhkl.exe

%siztbjhowu.php?adv=adv468

%siztbjhowu.php?adv=adv468

%sultamgbih.php?adv=adv468

%sultamgbih.php?adv=adv468

hXXp://bbpolis.com/timuo/

hXXp://bbpolis.com/timuo/

hXXp://abretor.com/timuo/

hXXp://abretor.com/timuo/

psapi.dll

psapi.dll

ddraw.dll

ddraw.dll

urlmon.dll

urlmon.dll

shell32.dll

shell32.dll

kernel32.dll

kernel32.dll

user32.dll

user32.dll

wininet.dll

wininet.dll

ntdll.dll

ntdll.dll

\svchost.exe

\svchost.exe

explorer.exe

explorer.exe

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nst3.tmp\E4U.exe

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nst3.tmp\E4U.exe

ShellExecuteExA

ShellExecuteExA

InternetOpenUrlA

InternetOpenUrlA

HttpQueryInfoA

HttpQueryInfoA

.text

.text

`.rdata

`.rdata

@.data

@.data

.reloc

.reloc

%szptfzubjhp.p

%szptfzubjhp.p

ChromeFirefox

ChromeFirefox

httpo%u

httpo%u

fnhcifdla$%sxbvk

fnhcifdla$%sxbvk

polis.Qm/timuo/

polis.Qm/timuo/

`.rd!!

`.rd!!

KERNEL32.DLL

KERNEL32.DLL

ADVAPI32.dll

ADVAPI32.dll

DDRAW.dll

DDRAW.dll

PSAPI.DLL

PSAPI.DLL

SHELL32.dll

SHELL32.dll

SHLWAPI.dll

SHLWAPI.dll

USER32.dll

USER32.dll

WININET.dll

WININET.dll

spoolsv.exe_1448_rwx_012E0000_00100000:

.tesx

.tesx

`.rdat

`.rdat

.config

.config

Ng.

Ng.

.Lu;;:

.Lu;;:

DP%xU

DP%xU

.cV#~E

.cV#~E

O.BY#

O.BY#

{|.eB

{|.eB

t&`%f

t&`%f

.text

.text

`.rdata

`.rdata

@.data

@.data

.reloc

.reloc

N. d SP.

N. d SP.

%x%x%x%x%x%x

%x%x%x%x%x%x

%s|%s|%s|%x|%x|%s|prn3

%s|%s|%s|%x|%x|%s|prn3

%[^;];%[^;];%[^;];

%[^;];%[^;];%[^;];

ntdll.dll

ntdll.dll

system\currentcontrolset\services\%x

system\currentcontrolset\services\%x

\\?\globalroot%wZ\cmd.dll

\\?\globalroot%wZ\cmd.dll

\\?\globalroot%wZ\cfg.ini

\\?\globalroot%wZ\cfg.ini

\\?\globalroot%wZ\bckfg.tmp

\\?\globalroot%wZ\bckfg.tmp

cmd.dll

cmd.dll

%[^|]|%[^|]|%s

%[^|]|%[^|]|%s

\\?\globalroot%wZ\ldr16

\\?\globalroot%wZ\ldr16

\\?\globalroot%wZ\ldr32

\\?\globalroot%wZ\ldr32

\\?\globalroot%wZ\ldr64

\\?\globalroot%wZ\ldr64

\\?\globalroot%wZ\drv64

\\?\globalroot%wZ\drv64

\\?\globalroot%wZ\cmd64.dll

\\?\globalroot%wZ\cmd64.dll

cmd64.dll

cmd64.dll

\\?\globalroot%wZ\drv32

\\?\globalroot%wZ\drv32

aid=%s

aid=%s

sid=%s

sid=%s

*=cmd.dll

*=cmd.dll

* (x64)=cmd64.dll

* (x64)=cmd64.dll

[cmd]

[cmd]

srv=%s

srv=%s

wsrv=%s

wsrv=%s

psrv=%s

psrv=%s

cfg.ini

cfg.ini

bckfg.tmp

bckfg.tmp

ZwConnectPort

ZwConnectPort

GetWindowsDirectoryW

GetWindowsDirectoryW

KERNEL32.dll

KERNEL32.dll

RegCreateKeyA

RegCreateKeyA

RegCloseKey

RegCloseKey

ADVAPI32.dll

ADVAPI32.dll

SHDeleteKeyA

SHDeleteKeyA

SHLWAPI.dll

SHLWAPI.dll

imagehlp.dll

imagehlp.dll

PSAPI.DLL

PSAPI.DLL

RPCRT4.dll

RPCRT4.dll

InternetCrackUrlA

InternetCrackUrlA

HttpOpenRequestA

HttpOpenRequestA

HttpSendRequestA

HttpSendRequestA

WININET.dll

WININET.dll

ShellExecuteW

ShellExecuteW

SHELL32.dll

SHELL32.dll

ole32.dll

ole32.dll

WINSPOOL.DRV

WINSPOOL.DRV

Error loading operating system

Error loading operating system

Missing operating system

Missing operating system

`.reloc

`.reloc

kdcom.dll

kdcom.dll

ntoskrnl.exe

ntoskrnl.exe

`.pdata

`.pdata

.pdata

.pdata

@.reloc

@.reloc

tùXXt

tùXXt

\\?\globalroot%S

\\?\globalroot%S

%s (x64)

%s (x64)

KeDelayExecutionThread

KeDelayExecutionThread

ZwOpenKey

ZwOpenKey

ZwQueryValueKey

ZwQueryValueKey

ZwSetValueKey

ZwSetValueKey

!Win64 .DLL.

!Win64 .DLL.

.MPRESS1

.MPRESS1

.MPRESS2*

.MPRESS2*

%X%XLA

%X%XLA

AndExecu

AndExecu

https:/

https:/

alm94.as(ia

alm94.as(ia

wrika.in

wrika.in

pG&$.KG

pG&$.KG

DB.fD

DB.fD

9=!%F

9=!%F

\{x-x-x-x-xx}

\{x-x-x-x-xx}

\registry\machine\%S

\registry\machine\%S

\??\physicaldrive%d

\??\physicaldrive%d

services.exe

services.exe

\??\globalroot\systemroot\system32\tasks\%x

\??\globalroot\systemroot\system32\tasks\%x

\\?\globalroot%s

\\?\globalroot%s

%s.manifest

%s.manifest

%s\setup%u.exe

%s\setup%u.exe

%s\%S

%s\%S

*\KERNEL32.DLL

*\KERNEL32.DLL

\device\%s

\device\%s

%s\cfg.ini

%s\cfg.ini

%s\mbr

%s\mbr

Explorer.EXE_1140_rwx_01E00000_00013000:

HTTP/1.1

HTTP/1.1

Software\Microsoft\Windows\CurrentVersion\Explorer\LowRegistry

Software\Microsoft\Windows\CurrentVersion\Explorer\LowRegistry

SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore

SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore

\user32.dll

\user32.dll

ms.dll

ms.dll

task32.dll

task32.dll

\updhlp.dat

\updhlp.dat

Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders

Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders

19792079

19792079

[%subid]

[%subid]

[%key]

[%key]

google.com/

google.com/

**http://

**http://

search.yahoo.com

search.yahoo.com

bing.com

bing.com

.info/message.php

.info/message.php

\temp.ini

\temp.ini

\admin.txt

\admin.txt

.aspx

.aspx

iexplore.exe

iexplore.exe

&HTTP_REFERER=

&HTTP_REFERER=

\server.dat

\server.dat

\Windows

\Windows

\winhelp.exe

\winhelp.exe

yschttl spt" href="hXXp://

yschttl spt" href="hXXp://