Gen.Trojan.Heur.Bu0bfH3Drjki_d0abb00103 – Adaware

Gen:Trojan.Heur.Bu0bfH3Drjki (B) (Emsisoft), Gen:Trojan.Heur.Bu0bfH3Drjki (AdAware), Trojan.Win32.IEDummy.FD, GenericInjector.YR (Lavasoft MAS)Behaviour: Trojan

The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.

Summary

MD5: d0abb001034dc077c047026e54151587

SHA1: 10f10e1a9e265902799706a39835ea85ddffe40a

SHA256: 2907c5e45c52419854169029d5113904c5e36581dc28c7068059953d225f870d

SSDeep: 12288:Mqwqoeq63VFik8gSSriSXyc40uHXRi2D4WA2lKTuRHlR:MqwhEFiknriQLkXRqWA2UqN

Size: 444416 bytes

File type: EXE

Platform: WIN32

Entropy: Packed

PEID: ASPackv212, UPolyXv05_v6

Company: no certificate found

Created at: 2016-03-23 08:04:52

Analyzed on: WindowsXP SP3 32-bit

Summary: Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).

Dynamic Analysis

Payload

No specific payload has been found.

Process activity

The Trojan creates the following process(es):No processes have been created.The Trojan injects its code into the following process(es):

%original file name%.exe:860

Mutexes

The following mutexes were created/opened:

ShimCacheMutex

File activity

The process %original file name%.exe:860 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%System%\MSINET.OCX (132 bytes)
%System%\COMCTL32.OCX (3681 bytes)
%System%\COMDLG32.OCX (350 bytes)
%System%\drivers\etc\hosts (1 bytes)

The Trojan deletes the following file(s):

%System%\drivers\etc\hosts (0 bytes)

Registry activity

The process %original file name%.exe:860 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "78 1B 28 8A 36 A9 F3 36 E4 46 F9 30 41 A8 BA 23"

Dropped PE files

MD5	File path
eb5f811c1f78005b3c147599a0cccf51	c:\WINDOWS\system32\COMCTL32.OCX
6785b09fc2d286f88944718acee94b52	c:\WINDOWS\system32\COMDLG32.OCX
90a39346e9b67f132ef133725c487ff6	c:\WINDOWS\system32\MSINET.OCX

HOSTS file anomalies

The Trojan modifies "%System%\drivers\etc\hosts" file which is used to translate DNS entries to IP addresses. The modified file is 1132 bytes in size. The following strings are added to the hosts file listed below:

127.0.0.0	http://www.vista-tigabelas.blogspot.co.id/
127.0.0.0	https://www.vista-tigabelas.blogspot.co.id/
127.0.0.0	https://www.vista-tigabelas.blogspot.com/
127.0.0.0	vista-tigabelas.blogspot.com
127.0.0.0	www.vista-tigabelas.blogspot.co.id

Rootkit activity

No anomalies have been detected.

Propagation

Removals

Remove it with Ad-Aware

Click (here) to download and install Ad-Aware Free Antivirus.
Update the definition files.
Run a full scan of your computer.

Manual removal*

Terminate malicious process(es) (How to End a Process With the Task Manager):No processes have been created.
Delete the original Trojan file.
Delete or disinfect the following files created/modified by the Trojan:
%System%\MSINET.OCX (132 bytes)
%System%\COMCTL32.OCX (3681 bytes)
%System%\COMDLG32.OCX (350 bytes)
%System%\drivers\etc\hosts (1 bytes)
Restore the original content of the HOSTS file (%System%\drivers\etc\hosts): 127.0.0.1 localhost
Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
Reboot the computer.

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

VersionInfo

Company Name:
Product Name: eder
Product Version: 0.00.0026
Legal Copyright:
Legal Trademarks:
Original Filename: pb.exe
Internal Name: pb
File Version: 0.00.0026
File Description:
Comments:
Language: English (United States)

Company Name: Product Name: ederProduct Version: 0.00.0026Legal Copyright: Legal Trademarks: Original Filename: pb.exeInternal Name: pbFile Version: 0.00.0026File Description: Comments: Language: English (United States)

PE Sections

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Section MD5
.text	4096	552960	129024	5.54374	e713cf4bcba023035488a8dd38cba34b
.data	557056	172032	512	0.402874	8968c4e30fdc2cd1e3ac0ba01f35cef4
.rsrc	729088	1101824	305664	5.54457	3ace2c73c828c20b98cc821a2d3e2baf
.aspack	1830912	8192	8192	3.6456	e492d067694bc4c83a32857773df5bf5
.adata	1839104	4096	0	0	d41d8cd98f00b204e9800998ecf8427e

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Network Activity

URLs

URL	IP
hxxp://ghs.l.google.com/
hxxp://bootstrapcdn.jdorfman.netdna-cdn.com/font-awesome/4.3.0/css/font-awesome.min.css
hxxp://bootstrapcdn.jdorfman.netdna-cdn.com/font-awesome/4.3.0/fonts/fontawesome-webfont.eot?
hxxp://googleapis.l.google.com/ajax/libs/jquery/2.1.1/jquery.min.js
hxxp://go.pub2srv.com/apu.php?zoneid=487476	78.140.191.74
hxxp://onclickads.net/apu.php?zoneid=487476	78.140.191.70
hxxp://scr.kliksaya.com/js-ad.php?zid=185936	216.185.100.67
hxxp://blogger.l.google.com/img/icon18_wrench_allbkg.png
hxxp://scr.kliksaya.com/ba/185936/waw-cheaters.com	216.185.100.67
hxxp://scr.kliksaya.com/js-ad.php?zid=185935	216.185.100.67
hxxp://ghs.l.google.com/feeds/posts/summary?alt=json-in-script&callback=pageNavi&max-results=99999
hxxp://scr.kliksaya.com/ad/185935/waw-cheaters.com	216.185.100.67
hxxp://googleapis.l.google.com/ajax/libs/jquery/1.4.1/jquery.min.js
hxxp://star-mini.c10r.facebook.com/plugins/likebox.php?href=http://www.facebook.com/wawcheater&width&height=62&colorscheme=light&show_faces=false&header=true&stream=false&show_border=false&appId=371524026202784
hxxp://scr.kliksaya.com/upload/ban/71/GBR071192.gif	216.185.100.67
hxxp://scr.kliksaya.com/js-ad.php?zid=185937	216.185.100.67
hxxp://photos-ugc.l.googleusercontent.com/-JbKcdfpLIpY/VGPWTO9Us7I/AAAAAAAAA9g/WT3xvYm_J28/s1600/btp.png
hxxp://scr.kliksaya.com/ba/185937/waw-cheaters.com	216.185.100.67
hxxp://scr.kliksaya.com/upload/ban/60/GBR060479.jpg	216.185.100.67
hxxp://maxcdn.bootstrapcdn.com/font-awesome/4.3.0/css/font-awesome.min.css	108.161.188.218
hxxp://maxcdn.bootstrapcdn.com/font-awesome/4.3.0/fonts/fontawesome-webfont.eot?	108.161.188.218
hxxp://img1.blogblog.com/img/icon18_wrench_allbkg.png	216.58.214.201
hxxp://ajax.googleapis.com/ajax/libs/jquery/1.4.1/jquery.min.js	216.58.214.202
hxxp://www.facebook.com/plugins/likebox.php?href=http://www.facebook.com/wawcheater&width&height=62&colorscheme=light&show_faces=false&header=true&stream=false&show_border=false&appId=371524026202784	31.13.90.36
hxxp://www.waw-cheaters.com/feeds/posts/summary?alt=json-in-script&callback=pageNavi&max-results=99999	64.233.164.121
hxxp://ajax.googleapis.com/ajax/libs/jquery/2.1.1/jquery.min.js	216.58.214.202
hxxp://www.waw-cheaters.com/	64.233.164.121
hxxp://4.bp.blogspot.com/-JbKcdfpLIpY/VGPWTO9Us7I/AAAAAAAAA9g/WT3xvYm_J28/s1600/btp.png	216.58.214.193
1.bp.blogspot.com	216.58.214.193
2.bp.blogspot.com	216.58.214.193
apis.google.com	173.194.113.193
3.bp.blogspot.com	216.58.214.193
www.blogger.com	216.58.214.201

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

GET /font-awesome/4.3.0/css/font-awesome.min.css HTTP/1.1

Accept: */*

Referer: hXXp://VVV.waw-cheaters.com/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: maxcdn.bootstrapcdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Sun, 24 Apr 2016 00:58:28 GMT

Content-Type: text/css

Content-Length: 23739

Connection: keep-alive

Last-Modified: Thu, 22 Jan 2015 19:53:38 GMT

ETag: "04425bbdc6243fc6e54bf8984fe50330"

Server: NetDNA-cache/2.2

Expires: Wed, 19 Apr 2017 00:58:28 GMT

Cache-Control: max-age=31104000

Vary: Accept-Encoding

Access-Control-Allow-Origin: *

X-Hello-Human: You should work for us! Email: jdorfman theheader@maxcdn.com or @MaxCDNDeveloper on Twitter

X-Cache: HIT

Accept-Ranges: bytes

/*!. * Font Awesome 4.3.0 by @davegandy - hXXp://fontawesome.io - @fontawesome. * License - hXXp://fontawesome.io/license (Font: SIL OFL 1.1, CSS: MIT License). */@font-face{font-family:'FontAwesome';src:url('../fonts/fontawesome-webfont.eot?v=4.3.0');src:url('../fonts/fontawesome-webfont.eot?#iefix&v=4.3.0') format('embedded-opentype'),url('../fonts/fontawesome-webfont.woff2?v=4.3.0') format('woff2'),url('../fonts/fontawesome-webfont.woff?v=4.3.0') format('woff'),url('../fonts/fontawesome-webfont.ttf?v=4.3.0') format('truetype'),url('../fonts/fontawesome-webfont.svg?v=4.3.0#fontawesomeregular') format('svg');font-weight:normal;font-style:normal}.fa{display:inline-block;font:normal normal normal 14px/1 FontAwesome;font-size:inherit;text-rendering:auto;-webkit-font-smoothing:antialiased;-moz-osx-font-smoothing:grayscale;transform:translate(0, 0)}.fa-lg{font-size:1.33333333em;line-height:.75em;vertical-align:-15%}.fa-2x{font-size:2em}.fa-3x{font-size:3em}.fa-4x{font-size:4em}.fa-5x{font-size:5em}.fa-fw{width:1.28571429em;text-align:center}.fa-ul{padding-left:0;margin-left:2.14285714em;list-style-type:none}.fa-ul>li{position:relative}.fa-li{position:absolute;left:-2.14285714em;width:2.14285714em;top:.14285714em;text-align:center}.fa-li.fa-lg{left:-1.85714286em}.fa-border{padding:.2em .25em .15em;border:solid .08em #eee;border-radius:.1em}.pull-right{float:right}.pull-left{float:left}.fa.pull-left{margin-right:.3em}.fa.pull-right{margin-left:.3em}.fa-spin{-webkit-animation:fa-spin 2s infinite linear;animation:

<<< skipped >>>

GET /font-awesome/4.3.0/fonts/fontawesome-webfont.eot? HTTP/1.1

Accept: */*

Referer: hXXp://VVV.waw-cheaters.com/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: maxcdn.bootstrapcdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Sun, 24 Apr 2016 00:58:28 GMT

Content-Type: application/vnd.ms-fontobject

Content-Length: 60767

Connection: keep-alive

Last-Modified: Thu, 22 Jan 2015 19:53:40 GMT

ETag: "f7c2b4b747b1a225eb8dee034134a1b0"

Server: NetDNA-cache/2.2

Expires: Wed, 19 Apr 2017 00:58:28 GMT

Cache-Control: max-age=31104000

Vary: Accept-Encoding

Access-Control-Allow-Origin: *

X-Hello-Human: You should work for us! Email: jdorfman theheader@maxcdn.com or @MaxCDNDeveloper on Twitter

X-Cache: HIT

Accept-Ranges: bytes

_...y.............................LP.........................P......................F.o.n.t.A.w.e.s.o.m.e.....R.e.g.u.l.a.r...$.V.e.r.s.i.o.n. .4...3...0. .2.0.1.5...&.F.o.n.t.A.w.e.s.o.m.e. .R.e.g.u.l.a.r.....BSGP...................T..q..u..*.......Y.D.M.F..x...>..........)Y......h..D....pj....f.i..)..U.'.&a..;`.*.../.....V...B.....OV..r.n.:..{$2D....:.&...m..d ..CeH.\../o.......U.M....X.`?....?.A....C...@..'.(g~......%(.Jl.&zw.....W#.mw".].At.....k.......p....E....[..=.gM.................go..W.R.q...`{.ZwUF.........o ..D.p)A8.....$..M.#.>..?....... d.No2..L.......<.t.....B..T..a....<...`.......e.SO.....cI[.p..E1R*.fMd.....>..2V.........z7..&. .....f..V.(8....aR.....x.Z\R.e..$.Vw.......K......gs.......*.... ..dI......6......)...rj..:Z."1.'...<....'.Q/....8..).B..5..tgk.AM.)...|~...."....2.... h...(.&.c..sw...(....h.Dg.k...w..zm%.f....//5.%....}....k.......... ...@....[#.D)..J<..?YAT.......o.s%....Z...G).5....#R'...#...).... R.....Z.z... ._....K&%'5.....(b.....Y..i_......|B.>U.......<q2i.....Q....7.....<2.._.y\n..9..u w.'!.p.5...q..u ...XU@.1OZt.I..g..'d...5.,.Y_.M.i.......D...H...Y.y.@.f....`Oqi...b...5..p......E1....x..............F?.....fS...n.>m"fE...u..n=.y..`LA&C.2].W&o.2pKDRI...3L...px..$.P ...p.P........$..........,a2T..X.!......av.....q.v,KZ...E..r?Z....m."..#&?.>.i]G^....Y....E&.(m>..?.hp..X..G.e^J...9[|...}...b..b..........P|q.......ka<..j$.....t5LG....i..#....h..W.kR..T.2...Of.e......b\~...fAh..L..La.......!...P~e...0.l ...Z.....$...0@.0.....GG.W....e..WE.

<<< skipped >>>

GET / HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.waw-cheaters.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Type: text/html; charset=UTF-8

Expires: Sun, 24 Apr 2016 00:58:27 GMT

Date: Sun, 24 Apr 2016 00:58:27 GMT

Cache-Control: private, max-age=0

Last-Modified: Sat, 23 Apr 2016 14:54:41 GMT

ETag: "620c3bd2-257b-4f33-884c-991d9d3b07e1"

Content-Encoding: gzip

X-Content-Type-Options: nosniff

X-XSS-Protection: 1; mode=block

Content-Length: 22018

Server: GSE

............y....0.....8g.8F..1!..-qbg...L&...$@AHD.^b...........;3s..gl.......^.....j....}e.L.'.........I..35......N.....Y.T..^7u.34j.6i.....Mo.9.!S...y...m.....m9.e...^n....r....tA.T.Z.L./....S<...t......;.B..e...6G.....vG#...Y-.7.sH.%a....2$..P...8(..S........Y.Ti.].....g...e.....p...B.vW....6v......@....?5....J..5.U...4D..f6.;.\.L }.rz'.K...P.y.....=9...0#.~QU.d..r..zJF..f.uu;!.N....3|.6...g....ST>..e....Ky......Zy...~Qa.TL.k.....g].1'...('dJ.=....`}P......]F..~....5C .....z...".c.P.?YM..eV..9 .9p....f..k6f...(...R7...........@>.\..;5..R.T)...H.M-(....\..?6....~e......V.|B1 .....#....8...y?.....Z..2F&.n.Yot4..j.,.......a...hR.`...."=.<......66.{@<hx.......f.ZkT..J..nu...o..{.jE....Zm..j}X...v]W;....@..L....h. .A....rT-....u...........x.U......GS..Ry._.C.%..m..(.[..|.z.h..B...M.R ..0..!p.0x. _.p..^....,.,..K.\...M..y...k....v]..n.61.q"..........V^.1.. .Gt....7JH`...u.$......)...lk@I....rF...F.b..\..aX.h..tg5.=...0 .d........aw.....5....e(....{.....>.| 0.k..]o.Q.VK..].l..%}.y@.k......0.q...0u........'_......vk..F..5.........L. ).......10.Y`Ng6..k....U<h..x.2.....t.h..S..{.\o..nJ..D....SA.(.......b..3L.....xtD...)%&4T.:"X.........b0. ....<....&.b....D$).2..........A.R<..}....b....o}3.5d":L..F.....X..p...z...n.w...../.6..b.......8_..B0.5...U.1*..Z..|fd.,-..Y..@...84........(..(L.E....T..un......0.&L...T...B.7u..uH4.Q..7.}...d....X ...q.8.......`.:.".n..I...F....0...1.:...a.W@...bR.&...*M..IZ..b.x..%.c4.....5. ..,.T....NYE..l...zo...H...g.'..EE...J.}&.......R..M.N..08..e..I..Ei`...q..!

<<< skipped >>>

GET /feeds/posts/summary?alt=json-in-script&callback=pageNavi&max-results=99999 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.waw-cheaters.com/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.waw-cheaters.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Encoding: gzip

ETag: W/"620c3bd2-257b-4f33-884c-991d9d3b07e1"

Date: Sun, 24 Apr 2016 00:58:30 GMT

Content-Type: text/javascript; charset=UTF-8

Server: blogger-renderd

Cache-Control: public, must-revalidate, proxy-revalidate, max-age=1

Vary: Accept-Encoding

Expires: Sun, 24 Apr 2016 00:58:31 GMT

X-Content-Type-Options: nosniff

X-XSS-Protection: 1; mode=block

Last-Modified: Sat, 23 Apr 2016 14:54:41 GMT

Content-Length: 24477

X-Frame-Options: SAMEORIGIN

.............r.......B.....8E*-."N..{.y4...F.}..........."D.%.........$.....2........<5..Q...._.z...........s.?.....t..~...4......(....=.i.[....?..h...{.....y.^...=.w..............t.....y...........Y..... .. .........1.v...GK..k....;.vG...._..Zzo.mO..].xxl.....W.n....._....4[.G..T..V.Y_......]o=..... ....Y../.p.7..eY.?."@..S@..eI........Y.Z.E..........y._(y!..P..@|...,.vw:........E{>f..../.f..d....'C...'K......}.g.....|Q..xj...8..p..TY(.n...>;r............:.x8o .o/M.C..!?y..].....E}....X}..~.d....g.I.....)P.M... _.?.........}......H......._.,..Q[...v.V.N{.`Ci?..].tq...Q./......e....z...............'.........b1.~....V~=.Z......t.TG...O...=...r.q...f....W.)z9.......T...=.q...^v~.>J}6..N.:S.....4v.uNo...z.%6T... ...>.o..>......,.....q.X....G.:;....qR.~...>Z...2........g..%.H..7.../G......gA.6...}..H...|.d}............`..=.X6..{Pf...O....\...}.N....>E.......v3.Mv.....Sh6..?g_...n._.1.....9.....1Q...?.~k.^X0R?A...-N.).&.....z..m.J{..N.....-......Qk%z^.=..E.~....{...K..#..(D.&...t1u.f..._J.=i..E.^...........y9:.".g..x.c...e._.)S..a,.......LY..-2i.7./.....h..t{.>~....F.../...?.d..... .aQ..a.d.?..x.....k....B..2].?D>....O...|.>?O..W..[....G......~a..wP/.w.(.e?...g.._O..zB.._`.....Z.....Z.....D`.e....'.r1..~....]....B=6N.....p..O[.'.h.o...A...}...,.2.$....hZo]_S...:=.xb..t.V..'.=..<.s...7 1>...t...........?>5.uz.x.>o.F....":~..V.G=.........D..VO..tU..m..K....>...L....v.........L.2..M.W..gW.....v......K...\{.p.5.5k...(.B..>..G5...w..c...t>>..h..n...p.....~yP..h...?

<<< skipped >>>

GET /img/icon18_wrench_allbkg.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.waw-cheaters.com/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: img1.blogblog.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Type: image/png

Date: Sat, 23 Apr 2016 19:26:23 GMT

Expires: Sat, 30 Apr 2016 19:26:23 GMT

Last-Modified: Sat, 23 Apr 2016 10:30:11 GMT

X-Content-Type-Options: nosniff

Server: sffe

Content-Length: 475

X-XSS-Protection: 1; mode=block

Cache-Control: public, max-age=604800

Age: 19926

.PNG........IHDR.............a.~e....PLTE...... J.4e.............u..l..e..c{.........................................................................Y}.T|....`v.`w.............................................................[q.............Eq....__^........bY....tRNS.@..f....IDATx^M.U..1.@...A(33.Cf....qR......"..@....*.v&.g...X.="6.Xz.$/".3.;.R\....Mb.((...J...R...pK.OY.0...Q......q.r3..r.v...b...j ..h.r....<._...l.}lY........o%....b..d,l/. .........N...ig.K.....IEND.B`.HTTP/1.1 200 OK..Content-Type: image/png..Date: Sat, 23 Apr 2016 19:26:23 GMT..Expires: Sat, 30 Apr 2016 19:26:23 GMT..Last-Modified: Sat, 23 Apr 2016 10:30:11 GMT..X-Content-Type-Options: nosniff..Server: sffe..Content-Length: 475..X-XSS-Protection: 1; mode=block..Cache-Control: public, max-age=604800..Age: 19926...PNG........IHDR.............a.~e....PLTE...... J.4e.............u..l..e..c{.........................................................................Y}.T|....`v.`w.............................................................[q.............Eq....__^........bY....tRNS.@..f....IDATx^M.U..1.@...A(33.Cf....qR......"..@....*.v&.g...X.="6.Xz.$/".3.;.R\....Mb.((...J...R...pK.OY.0...Q......q.r3..r.v...b...j ..h.r....<._...l.}lY........o%....b..d,l/. .........N...ig.K.....IEND.B`...

<<< skipped >>>

GET /-JbKcdfpLIpY/VGPWTO9Us7I/AAAAAAAAA9g/WT3xvYm_J28/s1600/btp.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.waw-cheaters.com/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: 4.bp.blogspot.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Access-Control-Allow-Origin: *

ETag: "v3d9"

Expires: Sun, 24 Apr 2016 13:55:29 GMT

Content-Disposition: inline;filename="btp.png"

Content-Type: image/png

X-Content-Type-Options: nosniff

Date: Sun, 24 Apr 2016 00:03:44 GMT

Server: fife

Content-Length: 182

X-XSS-Protection: 1; mode=block

Age: 3288

Cache-Control: public, max-age=86400, no-transform

.PNG........IHDR............. 1.....}IDAT8...... ..aFp.G`.F....Q...E.b...%}#_ =R.....=[.#..d....8...-.G..T.T .........A.{,..Q97R.l.....e.....0.4H.";........./....A?.....O....IEND.B`.HTTP/1.1 200 OK..Access-Control-Allow-Origin: *..ETag: "v3d9"..Expires: Sun, 24 Apr 2016 13:55:29 GMT..Content-Disposition: inline;filename="btp.png"..Content-Type: image/png..X-Content-Type-Options: nosniff..Date: Sun, 24 Apr 2016 00:03:44 GMT..Server: fife..Content-Length: 182..X-XSS-Protection: 1; mode=block..Age: 3288..Cache-Control: public, max-age=86400, no-transform...PNG........IHDR............. 1.....}IDAT8...... ..aFp.G`.F....Q...E.b...%}#_ =R.....=[.#..d....8...-.G..T.T .........A.{,..Q97R.l.....e.....0.4H.";........./....A?.....O....IEND.B`...

GET /ad/185935/waw-cheaters.com HTTP/1.1

Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*

Referer: hXXp://VVV.waw-cheaters.com/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: scr.kliksaya.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Sun, 24 Apr 2016 00:58:31 GMT

Server: Apache/2.2.27 (Unix) mod_ssl/2.2.27 OpenSSL/1.0.1e-fips mod_bwlimited/1.4 PHP/5.4.30

X-Powered-By: PHP/5.4.30

Content-Length: 1294

Connection: close

Content-Type: text/html

<html><head><style type="text/css">..ot{border:#ffffff 1px solid;background-color:#FFFFFF;height:58;width:466;overflow:hidden;}..at,.at A:link,.at A:visited{font-family:Arial;font-size:10pt;overflow:hidden;margin:0 auto;font-weight:bold;color:#000000;text-decoration:underline;}..ab,.ab A:link,.ab A:visited{overflow:hidden;margin:0 auto;text-align:left;font-family:Arial;font-size:10pt;text-decoration:none;color:#555555;}..ab A:hover{text-decoration: underline;}.</style></head><body bgcolor="#FFFFFF">.<div class="ot">.<table width="468" cellspacing="0" cellpadding="2" style="height:60;">.<tr><td width="50%" valign="top" align="left" height="35"><div class="at"><a href="hXXp://click.kliksaya.com/click.php?aid=2853559&zid=185935" target="_blank">CCCWEALTH</a></div><div class="ab"><a href="hXXp://click.kliksaya.com/click.php?aid=2853559&zid=185935" target="_blank">5% Daily and 112% after 10 Days</a></div></td><td width="50%" valign="top" align="left" height="35"><div class="at"><a href="hXXp://click.kliksaya.com/click.php?aid=2853661&zid=185935" target="_blank">PAY GET</a></div><div class="ab"><a href="hXXp://click.kliksaya.com/click.php?aid=2853661&zid=185935" target="_blank">Profit Hourly, 50% one month without yours efforts</a></div></td></tr></table>.</div>.</body>.</html>..

<<< skipped >>>

GET /upload/ban/71/GBR071192.gif HTTP/1.1

Accept: */*

Referer: hXXp://scr.kliksaya.com/ba/185936/waw-cheaters.com

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: scr.kliksaya.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Sun, 24 Apr 2016 00:58:31 GMT

Server: Apache/2.2.27 (Unix) mod_ssl/2.2.27 OpenSSL/1.0.1e-fips mod_bwlimited/1.4 PHP/5.4.30

Last-Modified: Fri, 17 Jul 2015 23:55:01 GMT

ETag: "22c229e-4e43-51b1aea8c38f2"

Accept-Ranges: bytes

Content-Length: 20035

Connection: close

Content-Type: image/gif

GIF89a..Z....I:6...........|...TMJR............vj.f[z...........].. i.............TA<..x......r.....o.....V...........z.................(((..........]v......5(&........................|||jhh.kb.|q.........................................................>54:..z\S"........wVL.............{h......e..;.....N....w....qh...Q..vif...b...........&........eG?...a............^S.................._WU......}a[..............|fQK.{x%......z....................IW...............-" ......>/-l..............9..qOE..r..........n_..................Xmu....nb.........#48I.......q.........|...........*.....x............................................4..l..`..$. ... ..D..L.. ..r..\..Au.f..<..T........&..6.-qpp...............`^_..................cjncu|.pl........................~.................!..NETSCAPE2.0.....!..XMP DataXMP<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:4A2B67A3D829E511BBF9B8BBAE51001B" xmpMM:DocumentID="xmp.did:1B175D7F29F111E5B7E7BF44C7ABCF93" xmpMM:InstanceID="xmp.iid:1B175D7E29F111E5B7E7BF44C7ABCF93" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="x

<<< skipped >>>

GET /js-ad.php?zid=185937 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.waw-cheaters.com/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: scr.kliksaya.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Sun, 24 Apr 2016 00:58:32 GMT

Server: Apache/2.2.27 (Unix) mod_ssl/2.2.27 OpenSSL/1.0.1e-fips mod_bwlimited/1.4 PHP/5.4.30

X-Powered-By: PHP/5.4.30

Content-Length: 236

Connection: close

Content-Type: text/html

document.write('<ifr' 'ame src=' '"hXXp://scr.kliksaya.com/ba/185937/waw-cheaters.com"' ' marginwidth="0" marginheight="0" width=' '"300"' ' height=' '"250"' ' border="0" frameborder="0" style="border:none;" scrolling="no"></iframe>');...

GET /ad/185935/waw-cheaters.com HTTP/1.1

Referer: hXXp://VVV.waw-cheaters.com/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: scr.kliksaya.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Sun, 24 Apr 2016 00:58:30 GMT

Server: Apache/2.2.27 (Unix) mod_ssl/2.2.27 OpenSSL/1.0.1e-fips mod_bwlimited/1.4 PHP/5.4.30

X-Powered-By: PHP/5.4.30

Content-Length: 1379

Connection: close

Content-Type: text/html

<html><head><style type="text/css">..ot{border:#ffffff 1px solid;background-color:#FFFFFF;height:58;width:466;overflow:hidden;}..at,.at A:link,.at A:visited{font-family:Arial;font-size:10pt;overflow:hidden;margin:0 auto;font-weight:bold;color:#000000;text-decoration:underline;}..ab,.ab A:link,.ab A:visited{overflow:hidden;margin:0 auto;text-align:left;font-family:Arial;font-size:10pt;text-decoration:none;color:#555555;}..ab A:hover{text-decoration: underline;}.</style></head><body bgcolor="#FFFFFF">.<div class="ot">.<table width="468" cellspacing="0" cellpadding="2" style="height:60;">.<tr><td width="50%" valign="top" align="left" height="35"><div class="at"><a href="hXXp://click.kliksaya.com/click.php?aid=2852886&zid=185935" target="_blank">Ingin MENGECILKAN PERUT?</a></div><div class="ab"><a href="http://click.kliksaya.com/click.php?aid=2852886&zid=185935" target="_blank">PELANGSING SAVANNAH SOLUSINYA. SEKARANG DISKON 40%! 2Kotak HANYA 340rb</a></div></td><td width="50%" valign="top" align="left" height="35"><div class="at"><a href="hXXp://click.kliksaya.com/click.php?aid=2849467&zid=185935" target="_blank">PERUT KEMPES Dalam 3 HARI</a></div><div class="ab"><a href="hXXp://click.kliksaya.com/click.php?aid=2849467&zid=185935" target="_blank">PELANGSING SAVANNAH BEKERJA CEPAT! NOW DISKON 40%, 2Kotak 340rb!</a></div></td></tr></tab

<<< skipped >>>

GET /ad/185935/waw-cheaters.com HTTP/1.1

Referer: hXXp://VVV.waw-cheaters.com/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: scr.kliksaya.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Sun, 24 Apr 2016 00:58:30 GMT

Server: Apache/2.2.27 (Unix) mod_ssl/2.2.27 OpenSSL/1.0.1e-fips mod_bwlimited/1.4 PHP/5.4.30

X-Powered-By: PHP/5.4.30

Content-Length: 1379

Connection: close

Content-Type: text/html

<html><head><style type="text/css">..ot{border:#ffffff 1px solid;background-color:#FFFFFF;height:58;width:466;overflow:hidden;}..at,.at A:link,.at A:visited{font-family:Arial;font-size:10pt;overflow:hidden;margin:0 auto;font-weight:bold;color:#000000;text-decoration:underline;}..ab,.ab A:link,.ab A:visited{overflow:hidden;margin:0 auto;text-align:left;font-family:Arial;font-size:10pt;text-decoration:none;color:#555555;}..ab A:hover{text-decoration: underline;}.</style></head><body bgcolor="#FFFFFF">.<div class="ot">.<table width="468" cellspacing="0" cellpadding="2" style="height:60;">.<tr><td width="50%" valign="top" align="left" height="35"><div class="at"><a href="hXXp://click.kliksaya.com/click.php?aid=2852886&zid=185935" target="_blank">Ingin MENGECILKAN PERUT?</a></div><div class="ab"><a href="http://click.kliksaya.com/click.php?aid=2852886&zid=185935" target="_blank">PELANGSING SAVANNAH SOLUSINYA. SEKARANG DISKON 40%! 2Kotak HANYA 340rb</a></div></td><td width="50%" valign="top" align="left" height="35"><div class="at"><a href="hXXp://click.kliksaya.com/click.php?aid=2849467&zid=185935" target="_blank">PERUT KEMPES Dalam 3 HARI</a></div><div class="ab"><a href="hXXp://click.kliksaya.com/click.php?aid=2849467&zid=185935" target="_blank">PELANGSING SAVANNAH BEKERJA CEPAT! NOW DISKON 40%, 2Kotak 340rb!</a></div></td></tr></tab

<<< skipped >>>

GET /js-ad.php?zid=185936 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.waw-cheaters.com/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: scr.kliksaya.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Sun, 24 Apr 2016 00:58:29 GMT

Server: Apache/2.2.27 (Unix) mod_ssl/2.2.27 OpenSSL/1.0.1e-fips mod_bwlimited/1.4 PHP/5.4.30

X-Powered-By: PHP/5.4.30

Content-Length: 235

Connection: close

Content-Type: text/html

document.write('<ifr' 'ame src=' '"hXXp://scr.kliksaya.com/ba/185936/waw-cheaters.com"' ' marginwidth="0" marginheight="0" width=' '"728"' ' height=' '"90"' ' border="0" frameborder="0" style="border:none;" scrolling="no"></iframe>');...

GET /ad/185935/waw-cheaters.com HTTP/1.1

Referer: hXXp://VVV.waw-cheaters.com/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: scr.kliksaya.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Sun, 24 Apr 2016 00:58:30 GMT

Server: Apache/2.2.27 (Unix) mod_ssl/2.2.27 OpenSSL/1.0.1e-fips mod_bwlimited/1.4 PHP/5.4.30

X-Powered-By: PHP/5.4.30

Content-Length: 1379

Connection: close

Content-Type: text/html

<html><head><style type="text/css">..ot{border:#ffffff 1px solid;background-color:#FFFFFF;height:58;width:466;overflow:hidden;}..at,.at A:link,.at A:visited{font-family:Arial;font-size:10pt;overflow:hidden;margin:0 auto;font-weight:bold;color:#000000;text-decoration:underline;}..ab,.ab A:link,.ab A:visited{overflow:hidden;margin:0 auto;text-align:left;font-family:Arial;font-size:10pt;text-decoration:none;color:#555555;}..ab A:hover{text-decoration: underline;}.</style></head><body bgcolor="#FFFFFF">.<div class="ot">.<table width="468" cellspacing="0" cellpadding="2" style="height:60;">.<tr><td width="50%" valign="top" align="left" height="35"><div class="at"><a href="hXXp://click.kliksaya.com/click.php?aid=2852886&zid=185935" target="_blank">Ingin MENGECILKAN PERUT?</a></div><div class="ab"><a href="http://click.kliksaya.com/click.php?aid=2852886&zid=185935" target="_blank">PELANGSING SAVANNAH SOLUSINYA. SEKARANG DISKON 40%! 2Kotak HANYA 340rb</a></div></td><td width="50%" valign="top" align="left" height="35"><div class="at"><a href="hXXp://click.kliksaya.com/click.php?aid=2849467&zid=185935" target="_blank">PERUT KEMPES Dalam 3 HARI</a></div><div class="ab"><a href="hXXp://click.kliksaya.com/click.php?aid=2849467&zid=185935" target="_blank">PELANGSING SAVANNAH BEKERJA CEPAT! NOW DISKON 40%, 2Kotak 340rb!</a></div></td></tr></tab

<<< skipped >>>

GET /apu.php?zoneid=487476 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.waw-cheaters.com/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: go.pub2srv.com

Connection: Keep-Alive

HTTP/1.1 302 Moved Temporarily

Server: nginx

Date: Sun, 24 Apr 2016 00:58:28 GMT

Content-Type: text/html

Content-Length: 154

Connection: keep-alive

Location: hXXp://onclickads.net/apu.php?zoneid=487476

<html>..<head><title>302 Found</title></head>..<body bgcolor="white">..<center><h1>302 Found</h1></center>..<hr><center>nginx</center>..</body>..</html>..HTTP/1.1 302 Moved Temporarily..Server: nginx..Date: Sun, 24 Apr 2016 00:58:28 GMT..Content-Type: text/html..Content-Length: 154..Connection: keep-alive..Location: hXXp://onclickads.net/apu.php?zoneid=487476..<html>..<head><title>302 Found</title></head>..<body bgcolor="white">..<center><h1>302 Found</h1></center>..<hr><center>nginx</center>..</body>..</html>....

GET /ajax/libs/jquery/2.1.1/jquery.min.js HTTP/1.1

Accept: */*

Referer: hXXp://VVV.waw-cheaters.com/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: ajax.googleapis.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Vary: Accept-Encoding

Content-Encoding: gzip

Content-Type: text/javascript; charset=UTF-8

Access-Control-Allow-Origin: *

Timing-Allow-Origin: *

Date: Sat, 23 Apr 2016 19:53:58 GMT

Expires: Sun, 23 Apr 2017 19:53:58 GMT

Last-Modified: Fri, 16 Oct 2015 18:27:31 GMT

X-Content-Type-Options: nosniff

Server: sffe

Content-Length: 29497

X-XSS-Protection: 1; mode=block

Cache-Control: public, max-age=31536000, stale-while-revalidate=2592000

Age: 18270

............{..../....CD.....);.;.1..d.N$.........$f.....y.|.[...F..%..{.:q4......z............w...n.l......^.....?3._...Y. VKu..2.R..[...6..y...m~....Z..e.r~....[%.y...h.~..&g.Uv7..../...z..m...(.f..n./w..jn...l(x,&~.,..f....2.?.j.Ym|O.b.....|{............./.`..ww......B..{4.|R,..k....C..w.b..#..o..h4VY.v..!..U.Z..NM.r}...)]P...w.5.....f....nS,...nf........:.......;........eT....&b..,..b.o.j.].2..^......../z...v..b..T.|.=.P....?.........P.......k...x...a...ew.Y.V...Q '\(...ns..V.p...<.K.S.|9........l...j...n...>...3.w..0C...[Q<.].C.....t..q(..a.2...]..T...&4.E...\.....T\B..7....x........[s.....t.6.[...%%....M..*m.}.b...0.....e.....T/.g...*...z=..{..2.mQ...lw.*.o......,r..2.m..; ....w|,g...|...^F.v;.L.#^.t<.GcT..N....~....#...Dm.%....Gm.<ut...E....v".q..i.C.....T.&...D.z...v.,.........V.0.:KV.y./K.9m...hZ.l. .t.u.m..=...K..i...SB-...E..7........r6@E.geG.q.. @..... H..(....3mEQ.....A....b)s.gh8...7:=......i....v.2..)V2.....-...Gf..k.d.4|.*...............t....C}lx...y..f.../. .n..<Ns....aI..T..!...a..r.:.8..Ht...j.v..P.]..M..G..48.#W..&..f...Or2....vL5.]9.P....."m..U.A.....x.._.W1.'..6|.,ES.5......qw....t .)..W.V?..=.n...oU............U..g_-....=c.2p@W....._..S.H.7.;.....x.w..<..F..D@..|......U...z...{J./....3.)..B.2.}^GME..B..MOA..NJ.y7.....j.c...6..kzI...H..wg.........y.'A.....K.D..X.... L.m..4^.s..M3..].V...^.mn..w@..K54.~..xO.g...x..7...<.>i8Oq.a...F=.(.A..hK...RK.........2....2._..x...&Bk.!. .).9.s.k|...../N.%...s.......28...P.!`&P....J...@x..5B..r..~4......5b&X...)U...[w[......HR.

<<< skipped >>>

GET /ajax/libs/jquery/1.4.1/jquery.min.js HTTP/1.1

Accept: */*

Referer: hXXp://VVV.waw-cheaters.com/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: ajax.googleapis.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Vary: Accept-Encoding

Content-Encoding: gzip

Content-Type: text/javascript; charset=UTF-8

Access-Control-Allow-Origin: *

Timing-Allow-Origin: *

Date: Tue, 19 Apr 2016 13:35:25 GMT

Expires: Wed, 19 Apr 2017 13:35:25 GMT

Last-Modified: Fri, 16 Oct 2015 18:27:31 GMT

X-Content-Type-Options: nosniff

Server: sffe

Content-Length: 24049

X-XSS-Protection: 1; mode=block

Cache-Control: public, max-age=31536000, stale-while-revalidate=2592000

Age: 386585

............i{.8.(.].B..q..-.I.}..f.f.NO..i..# }I..(K..%.#.......(...9..b. v.jCU.....|...s....?D....2[..?f.2..O......g.^/.Ngz.Y..b..T...X./..d.|.=.z...I..9]ec..r....l...4in.$]6.......f.l....._..* ..c.o.>l.X.;..l.M>.m.t...>......(....Ju....../.i.|]@..5t.........^...K....u.G..4.h....0..".._.....{.?yBm5....v!_...6...r?{..V.5g. ...=.....i....zy.]..b......,..x..*f3.....#..h=........l....;..s.,..f....%V...^..6r#/....Z.{.v4....f9.)..V....E.U...D.......4...........O......n....."_CG.5..t....?.v.#........"IOO.7.......d...E.....^.......S.lN..=K..z.....c....a...4...lG....y3....Jr/....'Q3...PCr.....Ivz::=..x.V..bey....i..Z"u#.).F..=.`%.=...!..:[6"....f.b.?..f.0....\n...8.....5.....IkS~....z.1>.#.B.M..6.W......'....6l.h......,.G.[8....a.......\.......o.........O......v..$[y...rD{.}J........z]......Vq............N..~1.BS*....n7mG....FK.?[..{.?z..xzv..,.R.....P}.:................0#......&...`...X.}.K.L.u.6...,.bW`...h.g....;..Q{.Y"...o.. ....3....U0.....<...A.Z....a....To`...m..s..f.B.........}J.1../...b..2..b.)Z..L.l.\$<-[...{........K...eI..AeN`"h|.-...r.x0R|ah.\^*`..'...C..............?98.m..F.......U ../f.0u;W...s....Njb..c.......$..N"...v.[;.?......e.7.[.......F..5..e..D5.....@)..*......E....[...mkn....Q.Ho..`.X..7.8!H..p...^...GB.N......'Q.p......@.R...{c...EQ...c....1...JD...au.^f...q.V....=.,.2 .w.F.sQ,..G\tOO.a{.Y,...=......"..9Y..E.................0]....&..........r1P4...?.....KI...B..........T}z-.vE....J...b.(..N.A.a......o.G....T.(..~j@.?L..%.2H.a..9..r..J....Wn.I.g.]......^...lac.>r...|(......

<<< skipped >>>

GET /ad/185935/waw-cheaters.com HTTP/1.1

Referer: hXXp://VVV.waw-cheaters.com/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: scr.kliksaya.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Sun, 24 Apr 2016 00:58:30 GMT

Server: Apache/2.2.27 (Unix) mod_ssl/2.2.27 OpenSSL/1.0.1e-fips mod_bwlimited/1.4 PHP/5.4.30

X-Powered-By: PHP/5.4.30

Content-Length: 1294

Connection: close

Content-Type: text/html

<<< skipped >>>

GET /plugins/likebox.php?href=http://VVV.facebook.com/wawcheater&width&height=62&colorscheme=light&show_faces=false&header=true&stream=false&show_border=false&appId=371524026202784 HTTP/1.1

Referer: hXXp://VVV.waw-cheaters.com/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.facebook.com

Connection: Keep-Alive

HTTP/1.1 302 Found

Location: hXXps://VVV.facebook.com/plugins/likebox.php?href=http://VVV.facebook.com/wawcheater&width&height=62&colorscheme=light&show_faces=false&header=true&stream=false&show_border=false&appId=371524026202784

Content-Type: text/html

X-FB-Debug: UWG7VxOCfcBcdaSK6VCElAx /VYNPLwqfE9OJnk6/uEGGtZynmf4ge96Fg2tpmxZdaoDhNUbZyDwkA4EN/T4MA==

Date: Sun, 24 Apr 2016 00:58:30 GMT

Connection: keep-alive

Content-Length: 0

HTTP/1.1 302 Found..Location: hXXps://VVV.facebook.com/plugins/likebox.php?href=http://VVV.facebook.com/wawcheater&width&height=62&colorscheme=light&show_faces=false&header=true&stream=false&show_border=false&appId=371524026202784..Content-Type: text/html..X-FB-Debug: UWG7VxOCfcBcdaSK6VCElAx /VYNPLwqfE9OJnk6/uEGGtZynmf4ge96Fg2tpmxZdaoDhNUbZyDwkA4EN/T4MA==..Date: Sun, 24 Apr 2016 00:58:30 GMT..Connection: keep-alive..Content-Length: 0..

GET /ba/185936/waw-cheaters.com HTTP/1.1

Referer: hXXp://VVV.waw-cheaters.com/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: scr.kliksaya.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Sun, 24 Apr 2016 00:58:29 GMT

Server: Apache/2.2.27 (Unix) mod_ssl/2.2.27 OpenSSL/1.0.1e-fips mod_bwlimited/1.4 PHP/5.4.30

X-Powered-By: PHP/5.4.30

Content-Length: 459

Connection: close

Content-Type: text/html

<html><head><style type="text/css">..ot {border: #000000 1px solid;font-size:10pt;font-family:Arial;position:relative; width:726px; height:88px; overflow:hidden;}.</style></head><body bgcolor="#FFFFFF">.<div class="ot"><a href="hXXp://click.kliksaya.com/click.php?aid=2853719&zid=185936" target="_blank"><img style="position:absolute; top:-1px; left:-1px;" alt="Konsep Baru" src="hXXp://scr.kliksaya.com/upload/ban/71/GBR071192.gif"></a></div></body>.</html>...

GET /ad/185935/waw-cheaters.com HTTP/1.1

Referer: hXXp://VVV.waw-cheaters.com/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: scr.kliksaya.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Sun, 24 Apr 2016 00:58:31 GMT

Server: Apache/2.2.27 (Unix) mod_ssl/2.2.27 OpenSSL/1.0.1e-fips mod_bwlimited/1.4 PHP/5.4.30

X-Powered-By: PHP/5.4.30

Content-Length: 1294

Connection: close

Content-Type: text/html

<<< skipped >>>

GET /ad/185935/waw-cheaters.com HTTP/1.1

Referer: hXXp://VVV.waw-cheaters.com/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: scr.kliksaya.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Sun, 24 Apr 2016 00:58:31 GMT

Server: Apache/2.2.27 (Unix) mod_ssl/2.2.27 OpenSSL/1.0.1e-fips mod_bwlimited/1.4 PHP/5.4.30

X-Powered-By: PHP/5.4.30

Content-Length: 1328

Connection: close

Content-Type: text/html

<html><head><style type="text/css">..ot{border:#ffffff 1px solid;background-color:#FFFFFF;height:58;width:466;overflow:hidden;}..at,.at A:link,.at A:visited{font-family:Arial;font-size:10pt;overflow:hidden;margin:0 auto;font-weight:bold;color:#000000;text-decoration:underline;}..ab,.ab A:link,.ab A:visited{overflow:hidden;margin:0 auto;text-align:left;font-family:Arial;font-size:10pt;text-decoration:none;color:#555555;}..ab A:hover{text-decoration: underline;}.</style></head><body bgcolor="#FFFFFF">.<div class="ot">.<table width="468" cellspacing="0" cellpadding="2" style="height:60;">.<tr><td width="50%" valign="top" align="left" height="35"><div class="at"><a href="hXXp://click.kliksaya.com/click.php?aid=2853559&zid=185935" target="_blank">CCCWEALTH</a></div><div class="ab"><a href="hXXp://click.kliksaya.com/click.php?aid=2853559&zid=185935" target="_blank">5% Daily and 112% after 10 Days</a></div></td><td width="50%" valign="top" align="left" height="35"><div class="at"><a href="hXXp://click.kliksaya.com/click.php?aid=2851651&zid=185935" target="_blank">PERUT KEMPES dalam 3 HARI</a></div><div class="ab"><a href="hXXp://click.kliksaya.com/click.php?aid=2851651&zid=185935" target="_blank">Simpelet3! 100% AMAN &AMPUH!PESAN Sekarang dan dapatkan DISKON</a></div></td></tr></table>.</div>.</body>.</html>..

<<< skipped >>>

GET /apu.php?zoneid=487476 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.waw-cheaters.com/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Connection: Keep-Alive

Host: onclickads.net

HTTP/1.1 200 OK

Server: nginx

Date: Sun, 24 Apr 2016 00:58:28 GMT

Content-Type: application/x-javascript

Transfer-Encoding: chunked

Connection: keep-alive

Pragma: no-cache

Cache-Control: private, max-age=0, no-cache

Expires: Mon, 26 Jul 1997 05:00:00 GMT

P3P: CP="CUR ADM OUR NOR STA NID"

Set-Cookie: OAGEOa2766=4|UA|63|KHARKIV|BROADBAND|PITLINE LTD||15610|25314|?|0; expires=Mon, 25-Apr-2016 00:58:28 GMT; path=/

Set-Cookie: OAID=0ba0ff2ed689858fa9da4408e41032c6; expires=Mon, 24-Apr-2017 00:58:28 GMT; path=/

Set-Cookie: pbk2=67058970ac348b6f87fef5748c8512716276920793256346026; expires=Sun, 24-Apr-2016 01:03:28 GMT

Content-Encoding: gzip

e30.............{i_......)..&m..b.HG....N...;p......0.*....U.`...........TR..<U!.... ..r..?}Uj..D......mY......}..#7......6.[SG....z........EO.r`......h...V.>.4.c.....Q./.dOS....h....f.....-..n..../N..?..]./N.M....... (*o.......d.....5...a Q..}.....d...V..........n..`...... ..)....d...y..mT5...0bo...4..R<FD.Tu..T....{..._.n z)..m.R.mH......m..e.0.-=.....ml.{.......Sv....Y..........=9.....#oY9.@W....d.....e W.:..VA...q^...-]......%C..Ce.,..d};.n..v..[.EQ...t%.F..<. .[...YPu}.!....=..............A..\(...Z ...0_..r...S...&......-.[..\..H..mBV;.%.....<..lH..}[..t..-o...){[..>2J.:.@.,...t-....^.4......s........C.o....vn.(..r..i.M....u...X...V...o...#..Q.....8...........s...$.Z[,Hp..n..-f.x.....ZC.....X~F..X..i.dO......,3....O....a....4&g......7.s.....: ........@........F....3,.$...nX4%O...,. j......>MgFqDF...Vq..*H.....oB.s.PB.Q=a.....E.4......n.r.....%:.>.i....5$y.lH.........k..;-U:...L......M!p&.yT...".&.7.[m...-...Z.7....A..?.%..t/^..~\zhH.......V[.........u .Y.........a........;..^p0...h..]yq.n_.}..c.J...y.k..S%.....:.~.F/..~.&._...Ik.........A.aw...A8..vC..c.|...A...(oM....Th._.z.~0..w.Y....]CR3..N..'.7(.6}.-.@...H.q........At5........~......#..`i_d...nC..tm3G..7.2...j..L.> gm.a.....(p.[..d`e.`.\......I...ZQ{.....'gt.D.A....qC"....7=w...3>?D...B..}..........7&1.\G.}.......].[..G|qH|{=...1...E/............~p>...;....A...;<B.VVnq.!.!(.....~.Z6..oX:.=.n.z5r....>.....Y......3...Y....8.?...-S....$Y.....1-..u..._.&c.'..@...q;d.;.];.\2.<..Q.c....(.._M.......B..x.}8......N.;..s

<<< skipped >>>

GET /js-ad.php?zid=185935 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.waw-cheaters.com/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: scr.kliksaya.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Sun, 24 Apr 2016 00:58:29 GMT

Server: Apache/2.2.27 (Unix) mod_ssl/2.2.27 OpenSSL/1.0.1e-fips mod_bwlimited/1.4 PHP/5.4.30

X-Powered-By: PHP/5.4.30

Content-Length: 235

Connection: close

Content-Type: text/html

document.write('<ifr' 'ame src=' '"hXXp://scr.kliksaya.com/ad/185935/waw-cheaters.com"' ' marginwidth="0" marginheight="0" width=' '"468"' ' height=' '"60"' ' border="0" frameborder="0" style="border:none;" scrolling="no"></iframe>');...

GET /upload/ban/60/GBR060479.jpg HTTP/1.1

Accept: */*

Referer: hXXp://scr.kliksaya.com/ba/185937/waw-cheaters.com

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: scr.kliksaya.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Sun, 24 Apr 2016 00:58:33 GMT

Server: Apache/2.2.27 (Unix) mod_ssl/2.2.27 OpenSSL/1.0.1e-fips mod_bwlimited/1.4 PHP/5.4.30

Last-Modified: Wed, 25 Jun 2014 03:55:03 GMT

ETag: "22a1bc6-1d8ef-4fca10a80f3c0"

Accept-Ranges: bytes

Content-Length: 121071

Connection: close

Content-Type: image/jpeg

.... .Exif..MM.*.............................b...........j.(...........1..... ...r.2...........i....................'.......'.Adobe Photoshop CS6 (Macintosh).2014:06:25 10:52:09............................,..........................................."...........*.(.....................2..........*F.......H.......H..........Adobe_CM......Adobe.d......................................................................................................................................................"................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE..t6..U.e.....u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te......u..F...............Vfv........'7GWgw.................?...z.S...2.......5.<...5.h...'#...Lu.....?...AU.[3...Z...m.k.....z.v.~...E.....dul..... W.muW[......m~.w..........YY9..$....3....>.....<..w.v.Y...g.MW.]..x.....B-........T..uU...G..Uos.....]..=;.f.YC..F.wY..c1.v5O..)..}~.6?..w.M..g.z...^.QK...f..#.1:..<2...Zat/.y?..X...:|>.h....z..?...........~..<j3....[.2E4..k..~_.xw...v.....W.^G....)...........3-.z[v....U...f...b......L..(....>S...#.....=w...Z....-......}b.z.q........I..p.........G.=Z...B.>.5.T...{>........Z=g'......cUew[_..n=Nu.u^..cM...7..._....N..Hq.D@.IO........c.........X.......h.t._....][..OQ.?..g.MjccQ..o...z. ......Z]....SC......,............g....M......k.,}.3...6.9.K=..I..n9%.>....,......Zj....

<<< skipped >>>

GET /ba/185937/waw-cheaters.com HTTP/1.1

Referer: hXXp://VVV.waw-cheaters.com/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: scr.kliksaya.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Sun, 24 Apr 2016 00:58:32 GMT

Server: Apache/2.2.27 (Unix) mod_ssl/2.2.27 OpenSSL/1.0.1e-fips mod_bwlimited/1.4 PHP/5.4.30

X-Powered-By: PHP/5.4.30

Content-Length: 473

Connection: close

Content-Type: text/html

<html><head><style type="text/css">..ot {border: #000000 1px solid;font-size:10pt;font-family:Arial;position:relative; width:298px; height:248px; overflow:hidden;}.</style></head><body bgcolor="#FFFFFF">.<div class="ot"><a href="http://click.kliksaya.com/click.php?aid=2849463&zid=185937" target="_blank"><img style="position:absolute; top:-1px; left:-1px;" alt="Mr.P tmbh PANJANG 6cm " src="hXXp://scr.kliksaya.com/upload/ban/60/GBR060479.jpg"></a></div></body>.</html>...

Map

The Trojan connects to the servers at the folowing location(s):

Strings from Dumps

%original file name%.exe_860:

.text

`.data

.rsrc

.aspack

.adata

MSINET.OCX

InetCtlsObjects.Inet

COMDLG32.OCX

MSComDlg.CommonDialog

%System%\MSINET.oca

%Program Files%\Microsoft Visual Studio\VB98\VB6.OLB

user32.dll

GetAsyncKeyState

PSAPI.DLL

shell32.dll

ShellExecuteA

VBA6.DLL

%System%\stdole2.tlb

gdi32.dll

olepro32.dll

MSIMG32.dll

KeyDown

KeyUp

KeyPress

[4q.Oi

13:131;13

J .Ti

J .yF

.yEn]

VVV.pekalongan-kommunity.com

strURL

uMsg

KeyCode

KeyAcsii

t.Hu`

MSVBVM60.DLL

# This is a sample HOSTS file used by Microsoft TCP/IP for Windows.

# 102.54.94.97 rhino.acme.com # source server

# 38.25.63.10 x.acme.com # x client host

# 127.0.0.1 localhost

127.0.0.0 hXXp://VVV.vista-tigabelas.blogspot.co.id/

127.0.0.0 hXXps://VVV.vista-tigabelas.blogspot.co.id/

127.0.0.0 hXXps://VVV.vista-tigabelas.blogspot.com/

127.0.0.0 vista-tigabelas.blogspot.com

127.0.0.0 VVV.vista-tigabelas.blogspot.co.id

127.0.0.0 VVV.vista-tigabelas.blogspot.com

.data

.reloc

CmDialogWndClass

cmdlg98.chm

Windows

%s,%s,%s

%s.drv

WINSPOOL.DRV

Ports

MbP?hhctrl.ocx

CLSID\{ADB880A6-D8FF-11CF-9377-00AA003B7A11}\InprocServer32

z!{lX-X-X-XX-XXXXXX}

SSSh`:{!

KERNEL32.dll

USER32.dll

ole32.dll

ADVAPI32.dll

OLEAUT32.dll

comdlg32.dll

GDI32.dll

GetProcessHeap

GetWindowsDirectoryA

GetKeyState

CreateDialogIndirectParamA

RegCloseKey

RegCreateKeyExA

RegOpenKeyExA

RegDeleteKeyA

RegEnumKeyExA

RegOpenKeyA

GetViewportExtEx

SetViewportExtEx

SetViewportOrgEx

%s%s.DLL

%u\%s.dll

{lX-X-X-XX-XXXXXX}

CLSID\%s

%s Object

%s.%s.%ld

%s.%s

%s.%s\CurVer

%s\InprocServer

VERSION.DLL

%ld - %s

stdole2.tlbWWW

cdlGetNotSupportedWW

0{ cdlSetNotSupportedWW

0B.cdlMemAllocFailureWW

.cdlNoFontsWW

cdlHelpKeyWW

cdlHelpPartialKeyWWWX

cdlPortraitWX

HelpKeyW

pbstrHelpKey

ComDlg32.OcxWW

cmdlg98.chmWWW

Sets or returns state of Collate check box.WWW%

Prevents a warning message when there is no default printer.WW5

Sets or returns the state of the Pages option button.WE

Returns a device context for the printer selection.WWW

Dialog box displays the Help button.WW!

Sets support for multiple copies.W,

Sets initial color value for the dialog box.WWK

Entire dialog box is displayed, including the Define Custom Colors section.WWW

Disables the Define Custom Colors section of the dialog box.WW"

Generates a message box if the selected file already exists.WW

Allows invalid characters in the returned file name.WW:

Extension of returned file name is different from the one set by DefaultExt.WW%

User can enter only names of existing files.WWF

The returned file will not have the Read Only attribute set.WW

Windows 95 Open A File dialog box template.WWW

Long filenames.WWW;

Dialog box lists only screen fonts supported by the system.WWW5

Dialog box lists only fonts supported by the printer.W4

Dialog box lists available screen and printer fonts.WW7

Dialog enables strikeout, underline, and color effects.WWW$

Dialog box enables the Apply button.WW@

Dialog box allows only fonts that use the Windows character set.WW3

Dialog box should not allow vector-font selections.WWWL

Dialog box should not allow graphic device interface (GDI) font simulations.WWH

Selects font sizes within the range specified by Min and Max properties.WW0

Dialog box should select only fixed-pitch fonts.WWL

Allows only the selection of fonts available to both the screen and printer.WWG

Displays an error if a user selects a font or style that doesn't exist.WWW>

No font style selected.WWW

Couldn't allocate memory for FileName or Filter.WW

Cancel was selected.WW!

Call to Windows Help failed.WW*

The function failed to load a specified string.WWW1

The function failed to lock a specified resource.WH

The function was unable to allocate memory for internal data structures.WWD

The function was unable to lock the memory associated with a handle.WW

No fonts exist.WWW=

File name is invalid.WC

An attempt to subclass a listbox failed due to insufficient memory.WWWB

DevMode and DevNames data structures describe two different printers.WH

The printer-device driver failed to initialize a DEVMODE data structure.WW3

The PrintDlg function failed during initialization.WWWK

The PrintDlg function failed to load the specified printer's device driver.WWW!

No printer device-drivers were found.WB

The Common Dialog function failed to parse the strings in WIN.INI.H

The printer device driver failed to initialize a DevMode data structure.WWK

The [devices] section of WIN.INI does not contain an entry for the printer.WWW:

No template provided by the application.WW/

Application did not provide an instance handle.WWW#

Displays Help for a particular topic.WO

Notifies the Help application that the specified Help file is no longer in use.WWW.

Display Help for using the Help application itself.WWW

Set the current Index for multi-index Help.WWW2

Displays a topic identified by a context number.WW8

Creates a Help file that displays text in only one font.WW'

Displays Help for a particular keyword.WWW'

Displays Help for a particular command.WWW'

Call the search engine in Windows Help.WWW"

Portrait printer paper orientation#

Sets the string displayed in the title bar of the dialog box.WQ

Returns/sets the default filename extension for the dialog box.WWW(

Returns/sets the initial file directory.WW

Returns/sets the selected color.WW"

Specifies the name of the font that appears in each row for the given level.WW

Returns/sets italic font styles.WW'

Returns/sets strikethrough font styles.WWW#

Returns/sets underline font styles.WWW8

Returns/sets the value for the first page to be printed.WWR

Returns/sets the maximum font size (Font dialog) or print range (Print dialog).WWWH

Returns/sets a value that determines the number of copies to be printed.WWP

Indicates whether an error is generated when the user chooses the Cancel button.WWC

Returns/sets the name of the Help file associated with the project.WWW/

Returns/sets the type of online Help requested.WWWB

Returns/sets the keyword that identifies the requested Help topic.f

Returns/sets a default filter for an Open or Save As dialog box.WW8

Returns/sets the context ID of the requested Help topic.WWX

Specifies the size (in points) of the font that appears in each row for the given level.WW4

Returns/sets the type of dialog box to be displayed.WWT

Returns/sets the maximum size of the filename opened using the CommonDialog control.WWI

Returns a handle (from Microsoft Windows) to the object's device context.WQ

Displays the CommonDialog control's Open dialog box.WW7

Displays the CommonDialog control's Save As dialog box.WWW5

Displays the CommonDialog control's Printer dialog box.WWW8

Runs Winhelp.EXE and displays the Help file you specify.WW&

5 5*545>5

6&6-646;6

ocx\ComDlg32.dbg

Internet Control URL Property Page

INET98.CHM

FTp/L#

rL#.OL#

hhctrl.ocx

hXXp://

PTF://

hXXps://

Microsoft URL Control - 6.01.9782

SSShp&M#

WININET.dll

InternetCreateUrlA

InternetCrackUrlA

InternetOpenUrlA

HttpSendRequestA

HttpOpenRequestA

HttpQueryInfoA

FtpFindFirstFileA

FtpRemoveDirectoryA

FtpGetCurrentDirectoryA

FtpCreateDirectoryA

FtpSetCurrentDirectoryA

FtpRenameFileA

FtpPutFileA

FtpGetFileA

FtpDeleteFileA

MsgWaitForMultipleObjects

OL#%s%s.DLL

0?NicFTPWWW

icHTTPWW

icHTTPSW,

icUrlOpenFailedW

icBadUrl

0NSicNoExecuteW

`icFtpCommandFailedWW

qicUnsupportedTypeWWW

icUnsupportedCommand

0-gicInvalidOperationWW

icExecutingW

0jHicInvalidForFtpW

hicInvalidURL

icIncorrectPasswordW

icLoginFailureWW

icInetInvalidOperationWW

[icOperationCancelled

00XicSecCertDateInvalid

0.(icSecCertCnInvalidWW

0WwicHttpToHttpsOnRedir

icHttpsToHttpOnRedir

.icPostIsNonSecureWWW

BicClientAuthCertNeededWW

icHttpsHttpSubmitRedirWW

icFtpTransferInProgressW

icFtpDropped

icFtpNoPassiveModeWW

ficHttpHeaderNotFound

icHttpDownlevelServerWWW

icHttpInvalidServerResponseW

icHttpInvalidHeaderW

icHttpInvalidQueryRequestWWW

icHttpHeaderAlreadyExistsWWW

0`>icHttpRedirectFailed

0~ icHttpCookieNeedsConfirmationWWW

7icHttpCookieDeclined

0DSicHttpRedirectNeedsConfirmationW

icSecInvalidCert

icSecCertRevoked

}|RemotePortWW

StillExecutingWW

URLW

Password

OpenURLW

yOperationWWW

~_URLX

MSINet.Ocx

FTPWWW

HTTPWW

Secure HTTPWWW

Unable to open URL

URL is malformedWW&

Protocol not supported for this method

You must execute an operation before retrieving dataWW

FTP command failed

Not a valid or supported commandWW

Invalid operation argument

Still executing last requestWW,

This call is not valid for an FTP connectionWW

Invalid URLWWW

Incorrect password

Invalid operationW

Operation cancelledWWW

Security certificate date invalidW#

Security certificate number invalidWWW

HTTP to HTTPS on redirectW

HTTPS to HTTP on redirectW

Client authorization certificate neededWWW

HTTPS HTTP submit redirWWW

FTP - Transfer in progress

FTP - Connection droppedWW

FTP - no passive modeW

HTTP - Header not foundWWW

HTTP - Downlevel serverWWW

HTTP - Invalid server response

HTTP - Invalid HeaderW

HTTP - Invalid query requestWW

HTTP - Header already existsWW

HTTP - Redirect failed

HTTP - cookie needs confirmationWW

HTTP - cookie declined"

HTTP - redirect needs confirmation

Invalid certWW

Cert revokedWW

Protocol to use for this URLWW

Returns/Sets the internet port to be used on the remote computerWW5

Returns/Sets the URL used by this controlW*

Password to use for authentication;

Open a URL&

Method used to cancel the request currently being executed

2 2>2`2~2

ocx\msinet.dbg

Thawte Certification1

hXXp://ocsp.verisign.com0

0hXXp://crl.verisign.com/ThawteTimestampingCA.crl0

"hXXp://crl.verisign.com/tss-ca.crl0

9hXXp://crl.microsoft.com/pki/crl/products/CodeSignPCA.crl0

hXXp://msdn.microsoft.com/vbasic0

Iz!.Iz!

Ez!&Nz!:Nz!.Pz!BPz!

FTP3z!

SSSh0:{!

2 2(2,2024282

6%7S7Y7s7

]/ ?- '?-

#]/ *]/ 1]/

$ ;$ |$

. ?- '?-

9. "9. ,9. 69.

Button%d

ListImage%d

ColumnHeader(%d)

@- !@- .@-

?- ?- '?-

COMCTL32.DLL

!/ :!/ {!/ %!/

%/ ?- '?-

Panel%d

Tab%d

$. )$. 3$. ?- '?-

- ?- '?-

&, /$, ,

- /%, 9%,

- ,8, 68,

SSh

9FL|$SSh

P8SShG

}2SSh

t&SSh

comctl1.hlp

&- %'- 5

/ SHELL32.DLL

COMCTL32.ocx

VERSION.dll

COMCTL32.dll

VkKeyScanA

MapVirtualKeyA

SetWindowsHookExA

UnhookWindowsHookEx

.IImagesW

8T.IImage10

x}pbFormatSupportedWWW

ccSetNotSupportedAtRuntimeWW

0NmccSetNotSupportedWWW

0UÃŒGetNotSupportedWWW

CccNonUniqueKeyWW

OccInvalidKey

.aKeyDownW

KeyCodeW

#KeyAscii

MKeyUpWWW

pvKeyWWW

KeyW

dzpbstrKey4

PSubkeyWW

0 %sbrInset

.lvwManualWWW

0yUlvwReportWWW

SortKeyW

psKeyWWW

.ophImageListW

Microsoft Windows Common Controls 5.0 (SP2)WWW

COMCTL32.OCXWW

comctl1.hlpWWW

Constants for the OLEDragMode property (but not the DragMode or OLEDropMode properties).WWX

Constants for the OLEDropMode property (but not the DragMode or OLEDragMode properties).WWC

State transition constants for the DragOver and OLEDragOver events.WWW

Clipboard format constants.WWW3

Drop effect constants for OLE drag and drop events.WWW

TabWidthStyle constants.WW

TabStyle constants.WWW

Returns a reference to a collection of Tab objects in the TabStrip control.WWWK

An individual object, analogous to a page, contained in a TabStrip control.WWW

Toolbar Button Style constants.WWW

Toolbar Value constants.WW

Displays a hierarchical list of Node objects, each of which consists of a label and an optional bitmap.WWW

Displays a collection of ListItems such as files or folders.WW%

An item in a ListView control that contains the index of icons associated with it, text, and an array of strings representing subitems that are displayed in Report view.W!

Contains a collection of ListImage objects, each of which can be referred to by its index or keyWW&

A bitmap or icon of any size that can be used in other controls.WW

A calibrated control with a slider for setting or selecting values.WWW"

Clears all data and formats in a DataObject object.WWW>

Determines if a specified clipboard format is supported by the DataObject object.WE

Adds a supported format and possibly its data to a DataObject object.W7

A collection of filenames used by the vbCFFiles format.WWWn

Returns the number of filenames in the Files collection of a DataObject object (vbCFFiles format only).WWWW

Adds a filename to the Files collection of a DataObject object (vbCFFiles format only).WWWc

Clears all filenames stored in the Files collection of a DataObject object (vbCFFiles format only).WWW\

Removes a filename from the Files collection of a DataObject object (vbCFFiles format only).WW

Accepts no OLE drag/drop operations.WW9

Source control dragged into target.WWW%

Text (.txt file).W

Bitmap (.bmp file).WWW

Metafile (.wmf file).W

Enhanced metafile (.emf file).*

Filename list (Microsoft Windows Explorer)

Rich Text Format (.rtf file).W

No OLE drag/drop operation has taken place/would take place.WW@

A mask to indicate that a copy has taken place/would take place.WW@

A mask to indicate that a move has taken place/would take place.WWI

Expected at least one argument.WWW1

Non-intrinsic OLE drag and drop formats used with SetData require Byte array data. GetData may return more bytes than were given to SetData.WN

Key is not unique in collectionWWW

Invalid keyWWW$

Returns/sets a value that determines whether a form or control can respond to user-generated events.WW

Sets a custom mouse icon.WZ

Returns/sets the style appearance (tab or button) of a TabStrip control.WWd

Returns/sets a fixed height of a TabStrip control, but only if the TabWidthStyle is set to tabFixed.WWK

Returns/sets the width and justification of all tabs in a TabStrip control.WWW?

Returns the top coordinate of the internal area of the control.WWW@

Returns the left coordinate of the internal area of the control.WW7

Returns the height of the internal area of the control.WWW6

Returns/Sets whether this control can act as an OLE drop target.WW/

Forces a complete repaint of a form or control.WWWC

Starts an OLE drag/drop event with the given control as the source.WWWM

Occurs when the user presses and then releases a mouse button over an object.WA

Occurs when the user presses a key while an object has the focus.W6

Occurs when the user presses and releases an ANSI key.B

Occurs when the user releases a key while an object has the focus.L

Occurs when the user presses the mouse button while an object has the focus.WW%

Occurs when the user moves the mouse.WM

Generated when a Tab object is clicked, or the tab's Value setting has been changed. Used to check parameters before actually generating a Click event.WWW

Returns a specific member of a Collection object either by position or by key.,

Removes a specific member from a collection.WW$

Removes all objects in a collection.WW'

Adds a Tab object to a Tabs collection.WWWS

Returns/sets the text displayed in an object's title bar or below an object's icon.WWW.

Returns/sets the index of an object in a collection. Read-only at run time.WWW

Returns/sets the unique string of an object in a collection.WWF

Returns/sets the width of an object.WW%

Returns/sets the height of an object.Wg

Returns/sets the distance between the internal top edge of an object and the top edge of its container.WWWi

Returns/sets the distance between the internal left edge of an object and the left edge of its container.WO

Returns/sets a value which determines if a ListItem or Node object is selected.WWW?

Returns/sets the index or key of a ListImage object to be used.WWW

Returns/sets whether or not controls, Forms or an MDIForm are painted at run time with 3-D effects.WWWI

Returns/sets a value which determines if users can customize the Toolbar.WH

Returns a reference to a Toolbar control's collection of Button objects.WW

Help context of topic to be displayed when inquiring help from Toolbar Customize dialog.WWG

Help file to be used when inquiring help from Toolbar Customize dialog.WWWZ

Saves a Toolbar configuration in an initialization (.ini) file.WWWa

Restores a toolbar, created with a Toolbar control, to its original state after being customized.WD

Occurs when the user clicks on a Button object in a Toolbar control.WWn

Occurs when you press and release a mouse button and then press and release it again over an object.WW[

Adds a Button object to a Buttons collection and returns a reference to the created object.WWWL

Returns/sets a value that determines whether an object is visible or hidden.WW$

Returns/sets the value of an object.WW

Returns/sets the description displayed when the user clicks a Button object during a customization operation.W

Returns/sets the text displayed when a StatusBar control's Style property is set to Simple.WWW

Similar to the standard Click event, but the PanelClick event occurs when a user presses and then releases a mouse button over any of the StatusBar control's Panel objects.WW

Similar to the standard DblClick Event, the PanelDblClick occurs when a user presses and then releases a mouse button twice over a StatusBar control's Panel object.WWX

Adds a Panel object to a Panels collection and returns a reference to the created Panel.WW

Returns/sets a control's maximum value.WWW'

Returns/sets a control's minimum value.WWW3

Returns or sets a control's current Value property.WWW,

Returns/sets the border style for an object.WW

Returns a reference to a Node or ListItem object and highlights the object with the system highlight color.WWW[

Returns/sets a value that determines if a user can edit the label of a ListItem or Node object.WWW?

Returns/sets the style of lines displayed between Node objects.WWW4

Returns a reference to a collection of Node objects.WWV

Indicates whether the elements of a control are automatically sorted alphabetically.WW

Returns a reference to the ListItem object or Node object located at the coordinates of x and y. Used with drag and drop operations.WWW

Returns the number of Node objects that fit in the internal area of a TreeView control.WWW>

Begins a label editing operation on a ListItem or Node object.`

Occurs when a user attempts to edit the label of the currently selected ListItem or Node object.WWV

Occurs when a Node object is clicked.WW

Adds a Node object to a Nodes collection and returns a reference to the created object.WWWL

Returns a specific item of a Collection object either by position or by key.WW8

Returns a reference to the first child of a Node object.WW4

Returns the number of child nodes a Node object has.WWB

Returns/sets the Index or Key of an image in an ImageList control used when the Node is expanded.WB

Returns a reference to the last Node object in a hierarchy level.WA

Returns/sets a reference to the parent of a Node object.WWE

Returns a reference to the previous Node object in a hierarchy level.WB

Returns/sets the Index or Key of an image in an ImageList control which is displayed when a Node object is selected.WW3

Returns/sets the text to be displayed in a control.WWWY

Creates a composite image from an icon and a caption for use in drag and drop operations.W^

Report

Returns/sets how the icons in a ListView control's Icon or SmallIcon view are arranged.WWW

Returns a reference to a collection of ColumnHeader objects.WWZ

Returns/sets whether or not a ListView control's column headers are hidden in Report view.[

Returns or sets a value that determines if labels are wrapped when the ListView is in Icon view.WW

Returns/sets a value indicating whether a user can make multiple selections in the ListView control and how the multiple selections can be made.WWF

Returns/sets the current sort key.Z

Finds an item in the list and returns a reference to that item.WWWC

Retrieves a reference of the first item visible in the client area.WWWC

Occurs when a ColumnHeader object in a ListView control is clicked.WWW4

Returns/sets the state of a ListView control Object item.WE

Returns/sets the index of an icon in an associated ImageList control.WK

Returns/sets the index of an small icon in an associated ImageList control.WWWC

Returns/sets an array of strings representing the ListIitem's data.WWWZ

Returns/sets a value that determines where an object is displayed on a form.WW]

Returns/sets the width of ListImage objects in an ImageList control.WWd

Returns/sets a value which determines the color to be transparent in ImageList graphical operations.WW_

Returns/sets a value which determines if the ImageList control will use the MaskColor property.WWWQ

Returns a handle to an ImageList control.Wg

Creates a composite third image out of two ListImage objects and returns a reference to the new object.WWWa

Returns/sets the increment value when the PageDown or PageUp key is pressed.WWM

Returns/sets the increment value when the left or right arrow key is pressed.W,

Returns/sets the maximum value of a control.WW,

Returns/sets the minimum value of a control.WWI

Returns/sets the orientation of a Slider control, horizontal or vertical.WE

Returns/sets the value where a selection starts.WW'

Returns/sets the length of a selection.WWW4

Returns/sets where ticks appear on a Slider control.WWN

Sets the SelLength to 0.WW8

Returns the number of visible ticks on a Slider control.WW

Returns a specific member of a Collection object either by position or by keyW

4 5$5(5,5054585

7 7$7(7,7074787

3 3$3)434

0U0

5 5$5(5,5054585

comctl32.dbg

=VVV.verisign.com/repository/RPA Incorp. by Ref.,LIAB.LTD(c)981.0,

'hXXps://VVV.verisign.com/repository/RPA0

=VVV.verisign.com/repository/RPA Incorp. by Ref.,LIAB.LTD(c)981>0

'hXXps://VVV.verisign.com/repository/CPS

This certificate incorporates by reference, and its use is strictly

subject to, the VeriSign Certification Practice Statement (CPS)

hXXps://VVV.verisign.com; by E-mail at CPS-requests@verisign.com; or

WARNING: THE USE OF THIS CERTIFICATE IS STRICTLY SUBJECT TO THE

VERISIGN CERTIFICATION PRACTICE STATEMENT. THE ISSUING AUTHORITY

DISCLAIMS CERTAIN IMPLIED AND EXPRESS WARRANTIES, INCLUDING WARRANTIES

BE LIABLE FOR CONSEQUENTIAL, PUNITIVE, AND CERTAIN OTHER DAMAGES. SEE

4hXXps://VVV.verisign.com/repository/verisignlogo.gif0

This certificate incorporates by reference, and its use is strictly subject to, the VeriSign Certification Practice Statement (CPS), available at: hXXps://VVV.verisign.com/CPS; by E-mail at CPS-requests@verisign.com; or by mail at VeriSign, Inc., 2593 Coast Ave., Mountain View, CA 94043 USA Tel. 1 (415) 961-8830 Copyright (c) 1996 VeriSign, Inc. All Rights Reserved. CERTAIN WARRANTIES DISCLAIMED and LIABILITY LIMITED.

(hXXps://VVV.verisign.com/repository/CPS 0

kernel32.dll

The procedure entry point %s could not be located in the dynamic link library %s

The ordinal %u could not be located in the dynamic link library %s

msvbvm60.dll

H*\AI:\WWWAWWWA\`aaReal Inject\Project1.vbp

78E1BDD1-9941-11cf-9756-00AA00C00908

28C4C820-401A-101B-A3C9-08002B2F49FB

C:\UpdateLog.txt

PointBlank.exe

hXXp://pastebin.com/raw.php?i=5QCCehkC

hXXps://sites.google.com/site/hostingindo1/weAwcit-pb23.dll?attredirects=0&d=1

\UpdateLog.txt

hXXp://VVV.waw-cheaters.com/

\PerX.ini

Dll Injected...Creating Thread.....

Can't find LoadLibrary API from kernel32.dll

c:\Windows\system32\

c:\windows\system32\drivers\etc\hosts

c:\Windows\system32\COMCTL32.OCX

c:\Windows\system32\COMDLG32.OCX

c:\Windows\system32\MSINET.OCX

c:\Windows\system32\Comdlg32.ocx

C:\windows..txt

@*\AI:\WWWAWWWA\`aaReal Inject\Project1.vbp

DB4C0D00-400B-101B-A3C9-08002B2F49FB

4D553650-6ABE-11cf-8ADB-00AA00C00905

HelpKey

CmDlg

Help&Key:

CMDialog ActiveX Control DLL

6.00.8877

CMDIALOG

is a registered trademark of Microsoft Corporation. Windows(TM) is a trademark of Microsoft Corporation

Printer Dialog Box Constants1Sets or returns state of All Pages option button. Sets or returns state of Collate check box.%Disables the Print to File check box.-The Print to File check box is not displayed.4Sets or returns the state of the Pages option button%Disables the Selection option button.

)Couldn't determine procedure address(es).!Failed to show the common dialog.HThe printer device driver failed to initialize a DevMode data structure.

Printer Orientation Constants$Dialog box displays the Help button.!Sets support for multiple copies.

Color Dialog Box Constants,Sets initial color value for the dialog box.KEntire dialog box is displayed, including the Define Custom Colors section.

Hides the Read Only check box.JSets the current directory to what it was when the dialog box was invoked.1Causes the dialog box to display the Help button.4Allows invalid characters in the returned file name.:Allows the File Name list box to have multiple selections.LExtension of returned file name is different from the one set by DefaultExt.

%User can enter only valid path names.,User can enter only names of existing files.FAsks if the user wants to create a file that does not currently exist.)Sharing violation errors will be ignored.

Fonts Dialog Box Constants;Dialog box lists only screen fonts supported by the system.5Dialog box lists only fonts supported by the printer.4Dialog box lists available screen and printer fonts."Dialog box displays a Help button.7Dialog enables strikeout, underline, and color effects.$Dialog box enables the Apply button.@Dialog box allows only fonts that use the Windows character set.QReturns/sets the name (without the path) of the file to open or save at run time.4Displays the CommonDialog control's Open dialog box.7Displays the CommonDialog control's Save As dialog box.5Displays the CommonDialog control's Color dialog box.3Displays the CommonDialog control's Font dialog box7Displays the CommonDialog control's Printer dialog box.8Runs Winhelp.EXE and displays the Help file you specify.

3Dialog box should not allow vector-font selections.LDialog box should not allow graphic device interface (GDI) font simulations.HSelects font sizes within the range specified by Min and Max properties.0Dialog box should select only fixed-pitch fonts.LAllows only the selection of fonts available to both the screen and printer.GDisplays an error if a user selects a font or style that doesn't exist.>Dialog box should allow only the selection of scaleable fonts.>Dialog box should allow only the selection of True Type fonts.

"Portrait printer paper orientation#Landscape printer paper orientation

BThe Common Dialog function failed to parse the strings in WIN.INI.

KThe [devices] section of WIN.INI does not contain an entry for the printer.:The PDReturnDefault flag was set, but a field was nonzero./Application did not provide an instance handle.

Help Constants%Displays Help for a particular topic.ONotifies the Help application that the specified Help file is no longer in use..Displays the index of the specified Help file.5Displays the contents topic in the current Help file.3Display Help for using the Help application itself. Set the current Index for multi-index Help.2Designates a specific topic as the contents topic.0Displays a topic identified by a context number.

8Creates a Help file that displays text in only one font.'Displays Help for a particular keyword.'Displays Help for a particular command.'Call the search engine in Windows Help.6Returns/sets the path and filename of a selected file.=Sets the string displayed in the title bar of the dialog box.QReturns/sets the filters that are displayed in the Type list box of a dialog box.?Returns/sets the default filename extension for the dialog box.(Returns/sets the initial file directory. Returns/sets the selected color."Sets the options for a dialog box.LSpecifies the name of the font that appears in each row for the given level.

Returns/sets bold font styles. Returns/sets italic font styles.'Returns/sets strikethrough font styles.#Returns/sets underline font styles.8Returns/sets the value for the first page to be printed.8Returns/sets the value for the first page to be printed.RSets the smallest allowable font size (Font dialog) or print range (Print dialog).OReturns/sets the maximum font size (Font dialog) or print range (Print dialog).HReturns/sets a value that determines the number of copies to be printed.PIndicates whether an error is generated when the user chooses the Cancel button.CReturns/sets the name of the Help file associated with the project./Returns/sets the type of online Help requested.BReturns/sets the keyword that identifies the requested Help topic.fDetermines if user selections in the Print dialog box are used to change the default printer settings.@Returns/sets a default filter for an Open or Save As dialog box.8Returns/sets the context ID of the requested Help topic.XSpecifies the size (in points) of the font that appears in each row for the given level.4Returns/sets the type of dialog box to be displayed.TReturns/sets the maximum size of the filename opened using the CommonDialog control.IReturns a handle (from Microsoft Windows) to the object's device context.

The ENABLEHOOK flag was set in the Flags member of a common-dialog data structure but the application failed to provide a pointer to a corresponding hook function.RThe common dialog function was unable to lock the memory associated with a handle.VThe common dialog function was unable to allocate memory for internal data structures.?The common dialog function failed to lock a specified resource.?The common dialog function failed to load a specified resource.?The common dialog function failed to find a specified resource.=The common dialog function failed to load a specified string.

The ENABLETEMPLATE flag was set in the Flags member of a common-dialog data structure but the application failed to provide a corresponding template.wThe common dialog function failed during initialization. This error often occurs when insufficient memory is available.TThe lStructSize member of the corresponding common-dialog data structure is invalid.

Call to Windows Help failed.*The function failed during initialization.1The function failed to load a specified resource./The function failed to load a specified string.1The function failed to lock a specified resource.HThe function was unable to allocate memory for internal data structures.DThe function was unable to lock the memory associated with a handle.

BThe PrintDlg function failed when creating an information context.EDevMode and DevNames data structures describe two different printers.HThe printer-device driver failed to initialize a DEVMODE data structure.

]The [devices] section of the file WIN.INI did not contain an entry for the requested printer.PThe PrintDlg function failed when it attempted to create an information context.VThe data in the DEVMODE and DEVNAMES data structures describes two different printers.!A default printer does not exist.%No printer device-drivers were found.3The PrintDlg function failed during initialization.

The printer device-driver failed to initialize a DEVMODE data structure. (This error constant only applies to printer drivers written for Windows 3.0 or later versions.)KThe PrintDlg function failed to load the specified printer's device driver.

The PD_RETURNDEFAULT flag was set in the Flags member of the PRINTDLG data structure but either the hDevMode or hDevNames field were nonzero.dThe common dialog function failed to parse the strings in the [devices] section of the file WIN.INI.

RemotePort

Pass&word

6.01.9782

is a registered trademark of Microsoft Corporation. Windows(tm) is a trademark of Microsoft Corporation.

Returns/Sets the remote computer@Returns/Sets the internet port to be used on the remote computer

5Returns information received from the remote computer9Returns a response code received from the remote computer6Returns the low-level internet handle for this control.Returns whether this control is currently busy)Returns/Sets the URL used by this control5Returns/Sets the Document to be retrieved from server

>Returns/Sets the proxy behavior for this control's connections7Event interface for Microsoft Internet Transfer Control#Microsoft Internet Transfer Control&Issue a request to the remote computer:Method used to cancel the request currently being executed

Secure HTTP

Protocol to use for this URL#User name to use for authentication"Password to use for authentication

Open a URL

URL is malformed&Protocol not supported for this method Unable to connect to remote host

Unable to complete request4You must execute an operation before retrieving data

Request timed out Not a valid or supported command

Still executing last request,This call is not valid for an FTP connection

Invalid URL

Invalid operation

Operation cancelled

Handle exists!Security certificate date invalid#Security certificate number invalid

HTTP to HTTPS on redirect

HTTPS to HTTP on redirect

Post is non-secure'Client authorization certificate needed

FTP - Connection dropped

HTTP - Header not found

HTTP - Downlevel server

HTTP - Invalid Header

HTTP - Invalid query request

HTTP - Header already exists

HTTP - Redirect failed

HTTPS HTTP submit redir

FTP - no passive mode HTTP - cookie needs confirmation

HTTP - cookie declined"HTTP - redirect needs confirmation

Invalid cert

Cert revoked

URL'URL properties for the internet control

57CBF9E0-6AA7-11cf-8ADB-00AA00C00905

SortKey

ImageKey

Windows Common Controls ActiveX Control DLL

6.00.8105

COMCTL32.OCX

&Key:

Sort&Key:

Microsoft Windows Common Controls 5.0 (SP2)

3DQA collection whose elements represent each contained control in a parent control.-Returns the number of members in a collectionMReturns a specific member of a Collection object either by position or by key`Contains a collection of ListImage objects, each of which can be referred to by its index or key

FReturns/sets the string displayed when a cursor hovers over an object.XConstants for the OLEDragMode property (but not the DragMode or OLEDropMode properties).BOLE drag/drop will be initialized only under programmatic control.jOLE drag/drop will be initialized when the user drags 'out' of the control, or under programmatic control.XConstants for the OLEDropMode property (but not the DragMode or OLEDragMode properties).$Accepts no OLE drag/drop operations.9Accepts an OLE drag/drop under programmatic control only.CState transition constants for the DragOver and OLEDragOver events.#Source control dragged into target.%Source control dragged out of target.>Source control dragged from one position in target to another.

Text (.txt file).

Bitmap (.bmp file).

Metafile (.wmf file).

Enhanced metafile (.emf file).*Filename list (Microsoft Windows Explorer)

Rich Text Format (.rtf file).3Drop effect constants for OLE drag and drop events.

Returns/Sets whether this control can act as an OLE drag/drop source, and whether this process is started automatically or under programmatic control.@Returns/Sets whether this control can act as an OLE drop target.3Clears all data and formats in a DataObject object.>Retrieves data of a specified format from a DataObject object.QDetermines if a specified clipboard format is supported by the DataObject object.EAdds a supported format and possibly its data to a DataObject object.7A collection of filenames used by the vbCFFiles format.nReturns a specific filename by index from the Files collection of a DataObject object (vbCFFiles format only).gReturns the number of filenames in the Files collection of a DataObject object (vbCFFiles format only).WAdds a filename to the Files collection of a DataObject object (vbCFFiles format only).cClears all filenames stored in the Files collection of a DataObject object (vbCFFiles format only).\Removes a filename from the Files collection of a DataObject object (vbCFFiles format only).

.Object variable or With block variable not set

.Object doesn't support this property or method

Non-intrinsic OLE drag and drop formats used with SetData require Byte array data. GetData may return more bytes than were given to SetData.NRequested data was not supplied to the DataObject during the OLESetData event.

Key is not unique in collection

Invalid key;The first column in a ListView control must be left aligned$This item's control has been deleted&Control's collection has been modified

Focus.Returns/sets the height of a ListImage object.DReturns/sets the width of ListImage objects in an ImageList control.dReturns/sets a value which determines the color to be transparent in ImageList graphical operations.QReturns a reference to a collection of ListImage objects in an ImageList control.)Returns a handle to an ImageList control.QReturns/sets the background color used to display text and graphics in an object.gCreates a composite third image out of two ListImage objects and returns a reference to the new object.@A bitmap or icon of any size that can be used in other controls..Returns the number of objects in a collection.aAdds a ListImage object to a ListImages collection and returns a reference to the created object.$Removes all objects in a collection.NReturns a specific member of a Collection object either by position or by key.,Removes a specific member from a collection.@A bitmap or icon of any size that can be used in other controls.KReturns/sets the index of an object in a collection. Read-only at run time.

Microsoft ProgressBar Control'Returns/sets a control's maximum value.'Returns/sets a control's minimum value.MReturns/sets the type of mouse pointer displayed when over part of an object.

Sets a custom mouse icon.3Returns or sets a control's current Value property.cReturns/sets whether or not controls, Forms or an MDIForm are painted at run time with 3-D effects.,Returns/sets the border style for an object.dReturns/sets a value that determines whether a form or control can respond to user-generated events.&Returns a handle to a form or control.

ButtonsKReturns a reference to a collection of Tab objects in the TabStrip control.dReturns/sets a value that determines whether a form or control can respond to user-generated events.

Sets a custom mouse icon.ZReturns/sets a value indicating whether the control can display more than one row of tabs.HReturns/sets the style appearance (tab or button) of a TabStrip control.dReturns/sets a fixed height of a TabStrip control, but only if the TabWidthStyle is set to tabFixed.KReturns/sets the width and justification of all tabs in a TabStrip control.?Returns the top coordinate of the internal area of the control.@Returns the left coordinate of the internal area of the control.7Returns the height of the internal area of the control.6Returns the width of the internal area of the control.MReturns/sets the type of mouse pointer displayed when over part of an object..Returns/sets the ImageList control to be used.dReturns/sets a fixed height of a TabStrip control, but only if the TabWidthStyle is set to tabFixed.!Enables/disables the Tooltip text

Returns/sets the selected Tab/Forces a complete repaint of a form or control.MOccurs when the user presses and then releases a mouse button over an object.AOccurs when the user presses a key while an object has the focus.

6Occurs when the user presses and releases an ANSI key.BOccurs when the user releases a key while an object has the focus.LOccurs when the user presses the mouse button while an object has the focus.%Occurs when the user moves the mouse.MOccurs when the user releases the mouse button while an object has the focus.

StatusBar Tabs collection.Returns the number of objects in a collection.NReturns a specific member of a Collection object either by position or by key.,Removes a specific member from a collection.$Removes all objects in a collection.'Adds a Tab object to a Tabs collection.KAn individual object, analogous to a page, contained in a TabStrip control.SReturns/sets the text displayed in an object's title bar or below an object's icon..Stores any extra data needed for your program.KReturns/sets the index of an object in a collection. Read-only at run time.

ToolBar Buttons.Returns the number of objects in a collection.NReturns a specific member of a Collection object either by position or by key.,Removes a specific member from a collection.$Removes all objects in a collection.[Adds a Button object to a Buttons collection and returns a reference to the created object.

ToolBar ButtonSReturns/sets the text displayed in an object's title bar or below an object's icon..Stores any extra data needed for your program.dReturns/sets a value that determines whether a form or control can respond to user-generated events.KReturns/sets the index of an object in a collection. Read-only at run time.

Returns/sets the button stylemReturns/sets the description displayed when the user clicks a Button object during a customization operation.?Returns/sets the index or key of a ListImage object to be used.?Returns/sets the index or key of a ListImage object to be used.cReturns/sets whether or not controls, Forms or an MDIForm are painted at run time with 3-D effects.IReturns/sets a value which determines if users can customize the Toolbar.HReturns a reference to a Toolbar control's collection of Button objects.dReturns/sets a value that determines whether a form or control can respond to user-generated events.&Returns a handle to a form or control.

Sets a custom mouse icon.MReturns/sets the type of mouse pointer displayed when over part of an object.

.Returns/sets the ImageList control to be used.*Enables/disables ToolTips for tool buttons

ToolBar Controls Collection/Forces a complete repaint of a form or control.ZInvokes the Customize Toolbar dialog box when the user double-clicks on a Toolbar control.?Saves a Toolbar configuration in an initialization (.ini) file.aRestores a toolbar, created with a Toolbar control, to its original state after being customized.DOccurs when the user clicks on a Button object in a Toolbar control.nGenerated after the end user customizes a Toolbar control's appearance using the Customize Toolbar dialog box.MOccurs when the user presses and then releases a mouse button over an object.LOccurs when the user presses the mouse button while an object has the focus.%Occurs when the user moves the mouse.MOccurs when the user releases the mouse button while an object has the focus.dOccurs when you press and release a mouse button and then press and release it again over an object.CA calibrated control with a slider for setting or selecting values.

No TicksLReturns/sets the increment value when the PageDown or PageUp key is pressed.MReturns/sets the increment value when the left or right arrow key is pressed.,Returns/sets the maximum value of a control.,Returns/sets the minimum value of a control.IReturns/sets the orientation of a Slider control, horizontal or vertical.

EReturns/sets whether or not a Slider control can have a select range.0Returns/sets the value where a selection starts.'Returns/sets the length of a selection.4Returns/sets where ticks appear on a Slider control.NReturns/sets the ratio of ticks on a Slider control; 1tick every n increments.$Returns/sets the value of an object.

Sets a custom mouse icon.MReturns/sets the type of mouse pointer displayed when over part of an object.dReturns/sets a value that determines whether a form or control can respond to user-generated events.&Returns a handle to a form or control.,Returns/sets the border style for an object./Forces a complete repaint of a form or control.

Sets the SelLength to 0.8Hidden method that can be used to invoke the Click event8Returns the number of visible ticks on a Slider control.MOccurs when the user presses and then releases a mouse button over an object.AOccurs when the user presses a key while an object has the focus.6Occurs when the user presses and releases an ANSI key.BOccurs when the user releases a key while an object has the focus.LOccurs when the user presses the mouse button while an object has the focus.%Occurs when the user moves the mouse.MOccurs when the user releases the mouse button while an object has the focus.

Slider scroll event6Indicates that the contents of a control have changed.gDisplays a hierarchical list of Node objects, each of which consists of a label and an optional bitmap.

.Returns/sets the ImageList control to be used.AReturns/sets the width of the indentation for a TreeView control._Returns/sets a value that determines if a user can edit the label of a ListItem or Node object.?Returns/sets the style of lines displayed between Node objects.MReturns/sets the type of mouse pointer displayed when over part of an object.

Sets a custom mouse icon.4Returns a reference to a collection of Node objects.VReturns/sets the delimiter string used for the path returned by the FullPath property.OReturns/sets a value which determines if a ListItem or Node object is selected.TIndicates whether the elements of a control are automatically sorted alphabetically.gDisplays a hierarchical list of Node objects, each of which consists of a label and an optional bitmap.cReturns/sets whether or not controls, Forms or an MDIForm are painted at run time with 3-D effects.,Returns/sets the border style for an object.dReturns/sets a value that determines whether a form or control can respond to user-generated events.

Returns a reference to the ListItem object or Node object located at the coordinates of x and y. Used with drag and drop operations.WReturns the number of Node objects that fit in the internal area of a TreeView control.>Begins a label editing operation on a ListItem or Node object./Forces a complete repaint of a form or control.`Occurs when a user attempts to edit the label of the currently selected ListItem or Node object.VOccurs after a user edits the label of the currently selected Node or ListItem object.BGenerated when any Node object in a TreeView control is collapsed.jOccurs when a Node object in a TreeView control is expanded; that is, when its child nodes become visible.%Occurs when a Node object is clicked.AOccurs when the user presses a key while an object has the focus.BOccurs when the user releases a key while an object has the focus.6Occurs when the user presses and releases an ANSI key.LOccurs when the user presses the mouse button while an object has the focus.%Occurs when the user moves the mouse.MOccurs when the user releases the mouse button while an object has the focus.MOccurs when the user presses and then releases a mouse button over an object.

Treeview Nodes collection.Returns the number of objects in a collection.WAdds a Node object to a Nodes collection and returns a reference to the created object.$Removes all objects in a collection.LReturns a specific item of a Collection object either by position or by key.,Removes a specific member from a collection.AAn object in a TreeView control that can contain images and text.8Returns a reference to the first child of a Node object.4Returns the number of child nodes a Node object has.BReturns/sets a value which specifies if a Node object is expanded.aReturns/sets the Index or Key of an image in an ImageList control used when the Node is expanded.BReturns a reference to the first Node object in a hierarchy level.2Returns the fully qualified name of a Node object.?Returns/sets the index or key of a ListImage object to be used.KReturns/sets the index of an object in a collection. Read-only at run time.

PartialWReturns/sets how the icons in a ListView control's Icon or SmallIcon view are arranged.

Returns/sets a value indicating whether a user can make multiple selections in the ListView control and how the multiple selections can be made.FReturns a reference to the currently selected ListItem or Node object.VReturns/sets the images associated with the SmallIcons property of a ListView control.TIndicates whether the elements of a control are automatically sorted alphabetically."Returns/sets the current sort key.ZReturns/sets whether or not the ListItems will be sorted in ascending or descending order.6Returns/sets the current view of the ListView control.cReturns/sets whether or not controls, Forms or an MDIForm are painted at run time with 3-D effects.QReturns/sets the background color used to display text and graphics in an object.,Returns/sets the border style for an object.dReturns/sets a value that determines whether a form or control can respond to user-generated events.

QReturns/sets the background color used to display text and graphics in an object.&Returns a handle to a form or control.?Finds an item in the list and returns a reference to that item.CRetrieves a reference of the first item visible in the client area.

Returns a reference to the ListItem object or Node object located at the coordinates of x and y. Used with drag and drop operations.>Begins a label editing operation on a ListItem or Node object./Forces a complete repaint of a form or control.`Occurs when a user attempts to edit the label of the currently selected ListItem or Node object.VOccurs after a user edits the label of the currently selected Node or ListItem object.COccurs when a ColumnHeader object in a ListView control is clicked.4Occurs when a ListItem object is clicked or selectedAOccurs when the user presses a key while an object has the focus.BOccurs when the user releases a key while an object has the focus.6Occurs when the user presses and releases an ANSI key.LOccurs when the user presses the mouse button while an object has the focus.%Occurs when the user moves the mouse.

MOccurs when the user releases the mouse button while an object has the focus.MOccurs when the user presses and then releases a mouse button over an object.dOccurs when you press and release a mouse button and then press and release it again over an object.

ListView Item collection.Returns the number of objects in a collection.BAdds a ListItem object to a ListItems collection only at run time.$Removes all objects in a collection.LReturns a specific item of a Collection object either by position or by key.,Removes a specific member from a collection.

An item in a ListView control that contains the index of icons associated with it, text, and an array of strings representing subitems that are displayed in Report view.9Returns/sets the state of a ListView control Object item.%Returns/sets the height of an object.EReturns/sets the index of an icon in an associated ImageList control.KReturns/sets the index of an object in a collection. Read-only at run time.

LReturns/sets a value that determines where an object is displayed on a form.KReturns/sets the index of an object in a collection. Read-only at run time.

Single panel simple text[Returns/sets the text displayed when a StatusBar control's Style property is set to Simple.

Sets a custom mouse icon.dReturns/sets a value that determines whether a form or control can respond to user-generated events.cReturns/sets a value that determines whether a form or control can respond to user-generated events

Similar to the standard DblClick Event, the PanelDblClick occurs when a user presses and then releases a mouse button twice over a StatusBar control's Panel object.LOccurs when the user presses the mouse button while an object has the focus.%Occurs when the user moves the mouse.MOccurs when the user releases the mouse button while an object has the focus.MOccurs when the user presses and then releases a mouse button over an object.dOccurs when you press and release a mouse button and then press and release it again over an object.

StatusBar Panels collection.Returns the number of objects in a collection.XAdds a Panel object to a Panels collection and returns a reference to the created Panel.

$Removes all objects in a collection.NReturns a specific member of a Collection object either by position or by key.,Removes a specific member from a collection.

2Returns/sets the text to be displayed in a controlKReturns/sets a value that determines whether an object is visible or hidden#Returns/sets the width of an object.Stores any extra data needed for your program.

Error #%d

Invalid entry for %s

}Bitmap and Icon Files (*.bmp, *.ico) |*.bmp;*.ico|Bitmap Files (*.bmp) |*.bmp|Icon Files (*.ico)|*.ico|All Files (*.*)|*.*||

0.00.0026

pb.exe

%original file name%.exe_860_rwx_005BF000_00003000:

kernel32.dll

user32.dll

The procedure entry point %s could not be located in the dynamic link library %s

The ordinal %u could not be located in the dynamic link library %s

msvbvm60.dll

0.00.0026

pb.exe

iexplore.exe_1772:

%?9-*09,*19}*09

.text

`.data

.rsrc

msvcrt.dll

KERNEL32.dll

NTDLL.DLL

USER32.dll

SHLWAPI.dll

SHDOCVW.dll

Software\Microsoft\Windows\CurrentVersion\Explorer\BrowseNewProcess

IE-X-X

rsabase.dll

System\CurrentControlSet\Control\Windows

dw15 -x -s %u

watson.microsoft.com

IEWatsonURL

%s -h %u

iedw.exe

Iexplore.XPExceptionFilter

jscript.DLL

mshtml.dll

mlang.dll

urlmon.dll

wininet.dll

shdocvw.DLL

browseui.DLL

comctl32.DLL

IEXPLORE.EXE

iexplore.pdb

ADVAPI32.dll

MsgWaitForMultipleObjects

IExplorer.EXE

IIIIIB(II<.fg>

7?_____ZZSSH%

)z.UUUUUUUU

,....Qym

````2```

{.QLQIIIKGKGKGKGKGKG

;33;33;0

8888880

8887080

browseui.dll

shdocvw.dll

6.00.2900.5512 (xpsp.080413-2105)

Windows

Operating System

6.00.2900.5512