Skip to main content

notavirus.AdWare.Win32.Hebogo.qj_853f90ab74


not-a-virus:AdWare.Win32.Hebogo.qj (Kaspersky), mzpefinder_pcap_file.YR (Lavasoft MAS)Behaviour: Adware

The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.

Summary

MD5: 853f90ab74d1008d0ba93c07df9584c6

SHA1: 17c53db9a52ba87d3992aa4f1155204383ee9c2a

SHA256: bdac1bb51c175929274cf4a46db0f5c7e8ffd81f709a23e01f481a4419c60710

SSDeep: 24576:hcgCYQ1LGum4sx8Kofd/uV w67fGJXbyfJ:2gCh1LGumhuW 5zGVbyfJ

Size: 865920 bytes

File type: EXE

Platform: WIN32

Entropy: Packed

PEID: UPolyXv05_v6

Company: no certificate found

Created at: 2009-11-06 21:53:27

Analyzed on: WindowsXP SP3 32-bit

Summary: Adware. Delivers advertising content in a manner or context that may be unexpected and unwanted by users. Many adware applications also perform tracking functions. Users may want to remove adware if they object to such tracking, do not wish to see the advertising caused by the program or are frustrated by its effects on system performance.

Dynamic Analysis

Payload

No specific payload has been found.

Process activity

The not-a-virus creates the following process(es):

GuardConvert.exe:1996
MicroProProc.exe:648
MicroProProc.exe:516
MicroProCon.exe:1416
%original file name%.exe:468
WinCtrCon.exe:324
WinCtrProc.exe:544
irsetup.exe:1988

The not-a-virus injects its code into the following process(es):No processes have been created.

Mutexes

The following mutexes were created/opened:No objects were found.

File activity

The process GuardConvert.exe:1996 makes changes in the file system.


The not-a-virus creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\ServerList[2].htm (917 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\desktop.ini (159 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\FormChecktimemicroLab[1].htm (159 bytes)

The not-a-virus deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\~DFF69B.tmp (0 bytes)

The process MicroProProc.exe:648 makes changes in the file system.


The not-a-virus deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\~DFCA6F.tmp (0 bytes)

The process MicroProProc.exe:516 makes changes in the file system.


The not-a-virus creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\UCg_LPrMLab[1].htm (327 bytes)
%Documents and Settings%\%current user%\Application Data\WinCtrView\Engin\ProVersion\WinCtrCon.exe (49345 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\FcPimSLab[1].htm (157 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\WinCtrCon[1].exe (49345 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\StakePsList[1].htm (917 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\FormLocation[1].htm (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\TransSiteString[1].htm (24 bytes)

The not-a-virus deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\~DFAD60.tmp (0 bytes)

The process MicroProCon.exe:1416 makes changes in the file system.


The not-a-virus creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Application Data\MicroLab\MyEngin\Common\MicroProProc.exe (411881 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\Uninstall[1].exe (89729 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\FormChecktimemicroLab[1].htm (159 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\MicroProProc[1].exe (411881 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\ProgramUpdateLab[1].htm (21 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\ProgramSetCon[1].htm (218 bytes)
%Documents and Settings%\%current user%\Application Data\MicroLab\MyEngin\Common\Uninstall\Uninstall.exe (89729 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\serverlist[1].htm (917 bytes)

The not-a-virus deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\~DFF649.tmp (0 bytes)

The process %original file name%.exe:468 makes changes in the file system.


The not-a-virus creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\_ir_sf_temp_0\irsetup.exe (1861 bytes)

The not-a-virus deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\_ir_sf_temp_0 (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\_ir_sf_temp_0\irsetup.exe (0 bytes)

The process WinCtrCon.exe:324 makes changes in the file system.


The not-a-virus creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\ProgramUpdateLab[2].htm (19 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\WinCtrProc[1].exe (424825 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\FcTimeLab[1].htm (157 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\sTakeList[1].htm (917 bytes)
%Documents and Settings%\%current user%\Application Data\WinCtrView\Engin\ProVersion\WinCtrProc.exe (424825 bytes)

The not-a-virus deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\~DFE0C5.tmp (0 bytes)

The process WinCtrProc.exe:544 makes changes in the file system.


The not-a-virus creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\FormLocation[1].htm (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\FcPimSLab[1].htm (157 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\UCg_LPrMLab[1].htm (327 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\TransSiteString[1].htm (12 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\StakePsList[1].htm (917 bytes)
%Documents and Settings%\%current user%\Application Data\WinCtrView\Engin\ProVersion\Uninstall\Uninstaller.exe (90777 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\AskIP[1].htm (28 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\Uninstall_Ctr[1].exe (90777 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\keyword_platinum[1].htm (237 bytes)

The process irsetup.exe:1988 makes changes in the file system.


The not-a-virus creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Application Data\MicroLab\MyEngin\Common\MicroProCon.exe (2712 bytes)
%System%\VB6KO.DLL (2712 bytes)
%System%\MSINET.OCX (2784 bytes)
%Documents and Settings%\%current user%\Application Data\GuardSupport\GuardConvert.exe (2784 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\_ir_sf_temp_0\irsetup.dat (2784 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\_ir_sf_temp_0\IRIMG2.JPG (29 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\_ir_sf_temp_0\IRIMG1.JPG (2 bytes)

The not-a-virus deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\_ir_sf_temp_0\IRIMG1.JPG (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\_ir_sf_temp_0 (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\_ir_sf_temp_0\IRIMG2.JPG (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\_ir_sf_temp_0\irsetup.dat (0 bytes)

Registry activity

The process GuardConvert.exe:1996 makes changes in the system registry.


The not-a-virus creates and/or sets the following values in system registry:

[HKCR\InetCtls.Inet.1]
"(Default)" = "Microsoft Internet Transfer Control 6.0 (SP6)"

[HKCR\InetCtls.Inet\CurVer]
"(Default)" = "InetCtls.Inet.1"

[HKCR\Interface\{48E59292-9880-11CF-9754-00AA00C00908}]
"(Default)" = "DInetEvents"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKCR\CLSID\{48E59293-9880-11CF-9754-00AA00C00908}\Version]
"(Default)" = "1.0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1B 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKCR\InetCtls.Inet.1\CLSID]
"(Default)" = "{48E59293-9880-11CF-9754-00AA00C00908}"

[HKCR\TypeLib\{48E59290-9880-11CF-9754-00AA00C00908}\1.0\FLAGS]
"(Default)" = "2"

[HKCR\CLSID\{48E59293-9880-11CF-9754-00AA00C00908}\MiscStatus\1]
"(Default)" = "132497"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCR\InetCtls.Inet\CLSID]
"(Default)" = "{48E59293-9880-11CF-9754-00AA00C00908}"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKCR\TypeLib\{48E59290-9880-11CF-9754-00AA00C00908}\1.0]
"(Default)" = "Microsoft Internet Transfer Control 6.0 (SP6)"

[HKCR\InetCtls.Inet]
"(Default)" = "Microsoft Internet Transfer Control 6.0 (SP6)"

[HKCR\CLSID\{48E59295-9880-11CF-9754-00AA00C00908}\InprocServer32]
"(Default)" = "%System%\MSINET.OCX"

[HKCR\CLSID\{48E59293-9880-11CF-9754-00AA00C00908}\InprocServer32]
"(Default)" = "%System%\MSINET.OCX"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCR\CLSID\{48E59293-9880-11CF-9754-00AA00C00908}\ProgID]
"(Default)" = "InetCtls.Inet.1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKCR\CLSID\{48E59294-9880-11CF-9754-00AA00C00908}]
"(Default)" = "Internet Control General Property Page Object"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCR\Interface\{48E59291-9880-11CF-9754-00AA00C00908}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"

[HKCR\TypeLib\{48E59290-9880-11CF-9754-00AA00C00908}\1.0\HELPDIR]
"(Default)" = ""

[HKCR\CLSID\{48E59293-9880-11CF-9754-00AA00C00908}\MiscStatus]
"(Default)" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCR\CLSID\{48E59293-9880-11CF-9754-00AA00C00908}\VersionIndependentProgID]
"(Default)" = "InetCtls.Inet"

[HKCR\CLSID\{48E59293-9880-11CF-9754-00AA00C00908}\TypeLib]
"(Default)" = "{48E59290-9880-11CF-9754-00AA00C00908}"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "17 A7 6A 3D 66 97 12 BB 13 45 DA 7A E0 57 AF 76"

[HKCR\CLSID\{48E59294-9880-11CF-9754-00AA00C00908}\InprocServer32]
"(Default)" = "%System%\MSINET.OCX"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCR\CLSID\{48E59295-9880-11CF-9754-00AA00C00908}]
"(Default)" = "Internet Control URL Property Page Object"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCR\CLSID\{48E59293-9880-11CF-9754-00AA00C00908}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCR\CLSID\{48E59293-9880-11CF-9754-00AA00C00908}\ToolboxBitmap32]
"(Default)" = "%System%\MSINET.OCX, 1"

[HKCR\CLSID\{48E59293-9880-11CF-9754-00AA00C00908}]
"(Default)" = "Microsoft Internet Transfer Control 6.0 (SP6)"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKCR\Interface\{48E59292-9880-11CF-9754-00AA00C00908}\ProxyStubClsid32]
"(Default)" = "{00020420-0000-0000-C000-000000000046}"

The not-a-virus modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The not-a-virus modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The not-a-virus modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

The not-a-virus deletes the following registry key(s):

[HKCR\CLSID\{48E59294-9880-11CF-9754-00AA00C00908}]
[HKCR\CLSID\{48E59295-9880-11CF-9754-00AA00C00908}]
[]

The not-a-virus deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

[HKCR\CLSID\{48E59294-9880-11CF-9754-00AA00C00908}\InprocServer32]
"ThreadingModel"

[HKCR\CLSID\{48E59295-9880-11CF-9754-00AA00C00908}\InprocServer32]
"ThreadingModel"

The process MicroProProc.exe:648 makes changes in the system registry.


The not-a-virus creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "59 8E 01 41 B8 11 FD A1 A6 79 CE 1C 1E A9 DF 85"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

The process MicroProProc.exe:516 makes changes in the system registry.


The not-a-virus creates and/or sets the following values in system registry:

[HKCU\Software\WinCtrView]
"USER_NO" = "3"
"SUBNAME" = "MAIN"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1D 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\WinCtrView]
"AdFlag" = "Y"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache]
"@xpsp3res.dll,-20001" = "Diagnose Connection Problems..."

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\WinCtrView]
"Upmom" = "Y"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\WinCtrView]
"Intro_No" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\WinCtrView]
"Version" = "1762"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "2A 32 0D E9 2B E0 74 10 A1 D0 07 C6 AC 8E E9 A7"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

To automatically run itself each time Windows is booted, the not-a-virus adds the following link to its file to the system registry autorun key:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"WinCtrProc" = "%Documents and Settings%\%current user%\Application Data\WinCtrView\Engin\ProVersion\WinCtrProc.exe -SmdTh"

The not-a-virus modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The not-a-virus modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The not-a-virus modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

To automatically run itself each time Windows is booted, the not-a-virus adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"WinCtrCon" = "%Documents and Settings%\%current user%\Application Data\WinCtrView\Engin\ProVersion\WinCtrCon.exe -SmdTh"

The not-a-virus deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"
"ProxyOverride"

"AutoConfigURL"

The not-a-virus disables automatic startup of the application by deleting the following autorun value:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"MicroProCon"

"MicroProProc"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MicroProCon"

"MicroProProc"

The process MicroProCon.exe:1416 makes changes in the system registry.


The not-a-virus creates and/or sets the following values in system registry:

[HKCR\InetCtls.Inet.1]
"(Default)" = "Microsoft Internet Transfer Control 6.0 (SP6)"

[HKCR\InetCtls.Inet\CurVer]
"(Default)" = "InetCtls.Inet.1"

[HKCU\Software\MicroLab]
"Upmom" = "N"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKCR\CLSID\{48E59293-9880-11CF-9754-00AA00C00908}\Version]
"(Default)" = "1.0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1C 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\MicroLab]
"MomDate" = "3/10/2016"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKCR\InetCtls.Inet.1\CLSID]
"(Default)" = "{48E59293-9880-11CF-9754-00AA00C00908}"

[HKCR\CLSID\{48E59293-9880-11CF-9754-00AA00C00908}\MiscStatus\1]
"(Default)" = "132497"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCR\InetCtls.Inet\CLSID]
"(Default)" = "{48E59293-9880-11CF-9754-00AA00C00908}"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCR\Interface\{48E59291-9880-11CF-9754-00AA00C00908}\TypeLib]
"Version" = "1.0"

[HKCR\InetCtls.Inet]
"(Default)" = "Microsoft Internet Transfer Control 6.0 (SP6)"

[HKCR\CLSID\{48E59295-9880-11CF-9754-00AA00C00908}\InprocServer32]
"(Default)" = "%System%\MSINET.OCX"

[HKCR\CLSID\{48E59293-9880-11CF-9754-00AA00C00908}\ProgID]
"(Default)" = "InetCtls.Inet.1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCR\Interface\{48E59292-9880-11CF-9754-00AA00C00908}\TypeLib]
"Version" = "1.0"

[HKCR\Interface\{48E59291-9880-11CF-9754-00AA00C00908}]
"(Default)" = "IInet"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKCR\TypeLib\{48E59290-9880-11CF-9754-00AA00C00908}\1.0\0\win32]
"(Default)" = "%System%\MSINET.OCX"

[HKCR\CLSID\{48E59294-9880-11CF-9754-00AA00C00908}]
"(Default)" = "Internet Control General Property Page Object"

[HKCR\Interface\{48E59291-9880-11CF-9754-00AA00C00908}\ProxyStubClsid]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKCR\Interface\{48E59292-9880-11CF-9754-00AA00C00908}\ProxyStubClsid]
"(Default)" = "{00020420-0000-0000-C000-000000000046}"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\MicroLab]
"Commit" = "N"

"firstTime" = "0"

[HKCR\Interface\{48E59291-9880-11CF-9754-00AA00C00908}\TypeLib]
"(Default)" = "{48E59290-9880-11CF-9754-00AA00C00908}"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"

[HKCR\CLSID\{48E59293-9880-11CF-9754-00AA00C00908}\MiscStatus]
"(Default)" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCR\CLSID\{48E59293-9880-11CF-9754-00AA00C00908}\VersionIndependentProgID]
"(Default)" = "InetCtls.Inet"

[HKCR\CLSID\{48E59293-9880-11CF-9754-00AA00C00908}\TypeLib]
"(Default)" = "{48E59290-9880-11CF-9754-00AA00C00908}"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "4D 59 B0 08 0A 34 04 CC D4 94 33 62 6D 11 F4 AC"

[HKCR\CLSID\{48E59294-9880-11CF-9754-00AA00C00908}\InprocServer32]
"(Default)" = "%System%\MSINET.OCX"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\MicroLab]
"Version" = "1279"

[HKCR\CLSID\{48E59295-9880-11CF-9754-00AA00C00908}]
"(Default)" = "Internet Control URL Property Page Object"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCR\CLSID\{48E59293-9880-11CF-9754-00AA00C00908}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCR\CLSID\{48E59293-9880-11CF-9754-00AA00C00908}\ToolboxBitmap32]
"(Default)" = "%System%\MSINET.OCX, 1"

[HKCR\Interface\{48E59292-9880-11CF-9754-00AA00C00908}\TypeLib]
"(Default)" = "{48E59290-9880-11CF-9754-00AA00C00908}"

[HKCR\CLSID\{48E59293-9880-11CF-9754-00AA00C00908}\InprocServer32]
"(Default)" = "%System%\MSINET.OCX"

[HKCR\CLSID\{48E59293-9880-11CF-9754-00AA00C00908}]
"(Default)" = "Microsoft Internet Transfer Control 6.0 (SP6)"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

To automatically run itself each time Windows is booted, the not-a-virus adds the following link to its file to the system registry autorun key:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MicroProProc" = "%Documents and Settings%\%current user%\Application Data\MicroLab\MyEngin\Common\MicroProProc.exe -ezpguE"

The not-a-virus modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

To automatically run itself each time Windows is booted, the not-a-virus adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"MicroProCon" = "%Documents and Settings%\%current user%\Application Data\MicroLab\MyEngin\Common\MicroProCon.exe -ezpguE"

The not-a-virus modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The not-a-virus modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

The not-a-virus deletes the following registry key(s):

[HKCR\CLSID\{48E59293-9880-11CF-9754-00AA00C00908}]
[HKCR\CLSID\{48E59294-9880-11CF-9754-00AA00C00908}]
[HKCR\CLSID\{48E59295-9880-11CF-9754-00AA00C00908}]

The not-a-virus deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

[HKCR\CLSID\{48E59294-9880-11CF-9754-00AA00C00908}\InprocServer32]
"ThreadingModel"

[HKCR\CLSID\{48E59295-9880-11CF-9754-00AA00C00908}\InprocServer32]
"ThreadingModel"

The process %original file name%.exe:468 makes changes in the system registry.


The not-a-virus creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "3F EC 76 DA C7 C5 F6 93 A7 A1 95 B0 E7 8C 1D 78"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\_ir_sf_temp_0]
"irsetup.exe" = "Setup Application"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

The not-a-virus modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The not-a-virus modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

"UNCAsIntranet" = "1"

The not-a-virus modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

The process WinCtrCon.exe:324 makes changes in the system registry.


The not-a-virus creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%Documents and Settings%\%current user%\Application Data\WinCtrView\Engin\ProVersion]
"WinCtrProc.exe" = "WinCtrProc"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKCU\Software\WinCtrView]
"Commit" = "N"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1E 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\WinCtrView]
"Upmom" = "Y"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKCU\Software\WinCtrView]
"firstTime" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\WinCtrView]
"Version" = "1817"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "88 3C 16 3D 88 B4 25 3C 40 DD 64 7A 64 92 C7 9E"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKCU\Software\WinCtrView]
"MomDate" = "3/10/2016"

To automatically run itself each time Windows is booted, the not-a-virus adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"WinCtrCon" = "%Documents and Settings%\%current user%\Application Data\WinCtrView\Engin\ProVersion\WinCtrCon.exe -KeVMZkTS"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"WinCtrProc" = "%Documents and Settings%\%current user%\Application Data\WinCtrView\Engin\ProVersion\WinCtrProc.exe -KeVMZkTS"

The not-a-virus modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The not-a-virus modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The not-a-virus modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The not-a-virus deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"

"AutoConfigURL"
"ProxyOverride"

The not-a-virus disables automatic startup of the application by deleting the following autorun value:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"MicroProCon"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MicroProProc"

The process WinCtrProc.exe:544 makes changes in the system registry.


The not-a-virus creates and/or sets the following values in system registry:

[HKCU\Software\WinCtrView]
"USER_NO" = "3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKCU\Software\WinCtrView]
"Commit" = "Y"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1F 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\WinCtrView]
"ver" = "sup"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKCU\Software\WinCtrView]
"firstTime" = "1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKCU\Software\WinCtrView]
"Actdate" = "3/10/2016"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "5B AB B6 62 5F B0 F2 C0 42 07 F7 0B 32 53 9E 9A"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

To automatically run itself each time Windows is booted, the not-a-virus adds the following link to its file to the system registry autorun key:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"WinCtrProc" = "%Documents and Settings%\%current user%\Application Data\WinCtrView\Engin\ProVersion\WinCtrProc.exe -NhYPcnWVI"

The not-a-virus modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The not-a-virus modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The not-a-virus modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

To automatically run itself each time Windows is booted, the not-a-virus adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"WinCtrCon" = "%Documents and Settings%\%current user%\Application Data\WinCtrView\Engin\ProVersion\WinCtrCon.exe -NhYPcnWVI"

The not-a-virus deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"
"ProxyOverride"

"AutoConfigURL"

The not-a-virus disables automatic startup of the application by deleting the following autorun value:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"MicroProCon"

"MicroProProc"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MicroProCon"

"MicroProProc"

The process irsetup.exe:1988 makes changes in the system registry.


The not-a-virus creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"My Video" = ""

[HKCU\Software\MicroLab]
"Owner" = "admin"
"PDR" = "asdfaeiqwerh"
"USER_NO" = "835"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Fonts" = "%WinDir%\Fonts"
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Start Menu" = "%Documents and Settings%\All Users\Start Menu"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\MicroLab]
"S_NO" = "0"
"CURDIR" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Startup" = "%Documents and Settings%\%current user%\Start Menu\Programs\Startup"

[HKCU\Software\MicroLab]
"Upmom" = "Y"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"My Pictures" = "%Documents and Settings%\%current user%\My Documents\My Pictures"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"
"Common Startup" = "%Documents and Settings%\All Users\Start Menu\Programs\Startup"

[HKCU\Software\MicroLab]
"Version" = "0000"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"
"CommonMusic" = "%Documents and Settings%\All Users\Documents\My Music"

[HKCU\Software\MicroLab]
"Commit" = "Y"
"SUBNAME" = "MAIN"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Start Menu" = "%Documents and Settings%\%current user%\Start Menu"
"My Music" = "%Documents and Settings%\%current user%\My Documents\My Music"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonVideo" = "%Documents and Settings%\All Users\Documents\My Videos"
"CommonPictures" = "%Documents and Settings%\All Users\Documents\My Pictures"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "7D 32 C1 03 3C 89 55 A7 5F 39 DF 62 50 0A BE 36"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Programs" = "%Documents and Settings%\All Users\Start Menu\Programs"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKCU\Software\MicroLab]
"ver" = "sup"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Programs" = "%Documents and Settings%\%current user%\Start Menu\Programs"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

To automatically run itself each time Windows is booted, the not-a-virus adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"MicroLabCon" = "%ApplicationDataFolder%\MicroLab\MyEngin\Common\MicroProCon.exe"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MicroLabProc" = "%ApplicationDataFolder%\MicroLab\MyEngin\Common\MicroProCon.exe"

Dropped PE files

MD5 File path
7b9ae70623c3bda9dafd17da027975c8c:\Documents and Settings\"%CurrentUserName%"\Application Data\GuardSupport\GuardConvert.exe
7fab278f103c9b22955702c300477302c:\Documents and Settings\"%CurrentUserName%"\Application Data\MicroLab\MyEngin\Common\MicroProCon.exe
ff6b119d0c26c92bf9db541096687e01c:\Documents and Settings\"%CurrentUserName%"\Application Data\MicroLab\MyEngin\Common\MicroProProc.exe
c3a2676fd2bec4903dea49c7e31f890bc:\Documents and Settings\"%CurrentUserName%"\Application Data\MicroLab\MyEngin\Common\Uninstall\Uninstall.exe
e2dee98a4500a03811bcd94b288bab73c:\Documents and Settings\"%CurrentUserName%"\Application Data\WinCtrView\Engin\ProVersion\Uninstall\Uninstaller.exe
fbd4d0ec8ea25331febfe215242d99c3c:\Documents and Settings\"%CurrentUserName%"\Application Data\WinCtrView\Engin\ProVersion\WinCtrCon.exe
dfb343bf7e00ea6fece6d57c6d385becc:\Documents and Settings\"%CurrentUserName%"\Application Data\WinCtrView\Engin\ProVersion\WinCtrProc.exe
3fe7c92dba5c9240b4ab0d6a87e6166ac:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\_ir_sf_temp_0\irsetup.exe
fbd4d0ec8ea25331febfe215242d99c3c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\WinCtrCon[1].exe
dfb343bf7e00ea6fece6d57c6d385becc:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\WinCtrProc[1].exe
c3a2676fd2bec4903dea49c7e31f890bc:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\Uninstall[1].exe
ff6b119d0c26c92bf9db541096687e01c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\MicroProProc[1].exe
e2dee98a4500a03811bcd94b288bab73c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\Uninstall_Ctr[1].exe
90a39346e9b67f132ef133725c487ff6c:\WINDOWS\system32\MSINET.OCX
84742b5754690ed667372be561cf518dc:\WINDOWS\system32\VB6KO.DLL

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

Removals

Remove it with Ad-Aware

  1. Click (here) to download and install Ad-Aware Free Antivirus.
  2. Update the definition files.
  3. Run a full scan of your computer.

Manual removal*

  1. Terminate malicious process(es) (How to End a Process With the Task Manager):

    GuardConvert.exe:1996
    MicroProProc.exe:648
    MicroProProc.exe:516
    MicroProCon.exe:1416
    %original file name%.exe:468
    WinCtrCon.exe:324
    WinCtrProc.exe:544
    irsetup.exe:1988

  2. Delete the original not-a-virus file.
  3. Delete or disinfect the following files created/modified by the not-a-virus:

    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\ServerList[2].htm (917 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\desktop.ini (67 bytes)
    %Documents and Settings%\%current user%\Local Settings\History\History.IE5\desktop.ini (159 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\FormChecktimemicroLab[1].htm (159 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\UCg_LPrMLab[1].htm (327 bytes)
    %Documents and Settings%\%current user%\Application Data\WinCtrView\Engin\ProVersion\WinCtrCon.exe (49345 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\FcPimSLab[1].htm (157 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\WinCtrCon[1].exe (49345 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\StakePsList[1].htm (917 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\FormLocation[1].htm (5 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\TransSiteString[1].htm (24 bytes)
    %Documents and Settings%\%current user%\Application Data\MicroLab\MyEngin\Common\MicroProProc.exe (411881 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\Uninstall[1].exe (89729 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\FormChecktimemicroLab[1].htm (159 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\desktop.ini (67 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\MicroProProc[1].exe (411881 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\desktop.ini (67 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\desktop.ini (67 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\ProgramUpdateLab[1].htm (21 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\ProgramSetCon[1].htm (218 bytes)
    %Documents and Settings%\%current user%\Application Data\MicroLab\MyEngin\Common\Uninstall\Uninstall.exe (89729 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\serverlist[1].htm (917 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\_ir_sf_temp_0\irsetup.exe (1861 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\ProgramUpdateLab[2].htm (19 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\WinCtrProc[1].exe (424825 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\FcTimeLab[1].htm (157 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\sTakeList[1].htm (917 bytes)
    %Documents and Settings%\%current user%\Application Data\WinCtrView\Engin\ProVersion\WinCtrProc.exe (424825 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\FormLocation[1].htm (5 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\FcPimSLab[1].htm (157 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\UCg_LPrMLab[1].htm (327 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\TransSiteString[1].htm (12 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\StakePsList[1].htm (917 bytes)
    %Documents and Settings%\%current user%\Application Data\WinCtrView\Engin\ProVersion\Uninstall\Uninstaller.exe (90777 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\AskIP[1].htm (28 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\Uninstall_Ctr[1].exe (90777 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\keyword_platinum[1].htm (237 bytes)
    %Documents and Settings%\%current user%\Application Data\MicroLab\MyEngin\Common\MicroProCon.exe (2712 bytes)
    %System%\VB6KO.DLL (2712 bytes)
    %System%\MSINET.OCX (2784 bytes)
    %Documents and Settings%\%current user%\Application Data\GuardSupport\GuardConvert.exe (2784 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\_ir_sf_temp_0\irsetup.dat (2784 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\_ir_sf_temp_0\IRIMG2.JPG (29 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\_ir_sf_temp_0\IRIMG1.JPG (2 bytes)

  4. Delete the following value(s) in the autorun key (How to Work with System Registry):

    [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "WinCtrProc" = "%Documents and Settings%\%current user%\Application Data\WinCtrView\Engin\ProVersion\WinCtrProc.exe -SmdTh"

    [HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
    "WinCtrCon" = "%Documents and Settings%\%current user%\Application Data\WinCtrView\Engin\ProVersion\WinCtrCon.exe -SmdTh"

    [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "MicroProProc" = "%Documents and Settings%\%current user%\Application Data\MicroLab\MyEngin\Common\MicroProProc.exe -ezpguE"

    [HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
    "MicroProCon" = "%Documents and Settings%\%current user%\Application Data\MicroLab\MyEngin\Common\MicroProCon.exe -ezpguE"

    [HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
    "WinCtrCon" = "%Documents and Settings%\%current user%\Application Data\WinCtrView\Engin\ProVersion\WinCtrCon.exe -KeVMZkTS"

    [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "WinCtrProc" = "%Documents and Settings%\%current user%\Application Data\WinCtrView\Engin\ProVersion\WinCtrProc.exe -KeVMZkTS"

    [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "WinCtrProc" = "%Documents and Settings%\%current user%\Application Data\WinCtrView\Engin\ProVersion\WinCtrProc.exe -NhYPcnWVI"

    [HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
    "WinCtrCon" = "%Documents and Settings%\%current user%\Application Data\WinCtrView\Engin\ProVersion\WinCtrCon.exe -NhYPcnWVI"

    [HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
    "MicroLabCon" = "%ApplicationDataFolder%\MicroLab\MyEngin\Common\MicroProCon.exe"

    [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "MicroLabProc" = "%ApplicationDataFolder%\MicroLab\MyEngin\Common\MicroProCon.exe"

  5. Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

VersionInfo

Company Name:
Product Name: Setup Factory 8.0 Runtime
Product Version: 8.2.1.0
Legal Copyright: Setup Engine Copyright (c) 2004-2009 Indigo Rose Corporation
Legal Trademarks: Setup Factory is a trademark of Indigo Rose Corporation.
Original Filename: suf80_launch.exe
Internal Name: suf80_launch
File Version: 8.2.1.0
File Description: Setup Application
Comments: Created with Setup Factory 8.0
Language: English (United States)

Company Name: Product Name: Setup Factory 8.0 RuntimeProduct Version: 8.2.1.0Legal Copyright: Setup Engine Copyright (c) 2004-2009 Indigo Rose CorporationLegal Trademarks: Setup Factory is a trademark of Indigo Rose Corporation.Original Filename: suf80_launch.exeInternal Name: suf80_launchFile Version: 8.2.1.0File Description: Setup ApplicationComments: Created with Setup Factory 8.0Language: English (United States)

PE Sections

Name Virtual Address Virtual Size Raw Size Entropy Section MD5
.text409628836327684.26507a8dbcac095aef6f1ff0f56e91c5abc15
.rdata3686410370122883.44532efb6029b9a5f70171975f6b5a16c78ce
.data49152644040961.54728cf8d7dd9f4b828868db85743b8601f51
.rsrc5734428040286724.0648705962a2c16ea40395e7b662814eba9fd

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:


Total found: 98
0e1bf09cea8e7cf2d8ff215b54ccc3ff
1bc64dbfe22d0945161fb563f5a606fb
e123f2f40b357f0016fb5bf495c4ef43
da755f638348508133fce2d595ba97bd
65420dc6c8a8bc9e5fb759d0edc2517e
7abeba6239fd4d4541737ee65df6a1bf
c7d5988a2afd6f1fce4ee439d764ed37
db762c79ed41d5c3f8d7f230ac8d33dc
ebe594af090d6546b5e2b9ccf897db73
56e27cd6b6997470ce0f3b92af3cb187
2789f08ba3fb2a5bcd5f112d363bd999
c0b4142eb72fe956e74c584b1215907a
39fe8d114fcb62b2e6be3d097edacbf3
61b81d2cf8bded72d6158892ff0b5b20
967b49a0114e7e5b45f66aae62735515
24ff3bf86d40ac0a0477740ce344d0cf
12dd91b22af7ff74acfe4607a6948385
c4d423533c62c52389640fb4b26f5361
d7a544365dfede8355841e2a3fa007cd
4b14a102a3cbc077af938376cdffb1f6
14b52c794216c9bb7a93afbeb41cf065
aa55d3b8b236f4cffac5a3aa2bd868f3
31be43b7df97c4bb0fab6501b5ae6a23
d91483756010b48c16abd9217cb76e1b
2fa3858a740d0a6f9081a2a147431038

Network Activity

URLs

URL IP
hxxp://koreaserver.kr/Config/ServerList.asp?uno=835220.73.162.56
hxxp://hostserver.kr/Config/serverlist.asp?n=835220.73.162.54
hxxp://220.73.162.25/Config/FormChecktimemicroLab.asp
hxxp://220.73.162.58/Config/FormChecktimemicroLab.asp
hxxp://220.73.162.25/Config/ProgramUpdateLab.asp?version=1279
hxxp://220.73.162.58/Config/ProgramGuard.asp?uno=835&ver=&wver=5
hxxp://220.73.162.25/Config/ProgramSetCon.asp?user_no=835
hxxp://micronames.co.kr/Download/Uninstall.exe220.73.162.14
hxxp://micronames.co.kr/Download/MicroProProc.exe220.73.162.14
hxxp://domainserver.co.kr/Config/AdNw/StakePsList.asp?uno=5220.73.162.53
hxxp://koreaserver.kr/Config/FormLocation.asp220.73.162.56
hxxp://koreaserver.kr/Config/AdNw/FcPimSLab.asp220.73.162.56
hxxp://koreaserver.kr/Config/newConf/UCg_LPrMLab.asp?user_no=3220.73.162.56
hxxp://koreaserver.kr/Config/TransSiteString.asp?nation=KOREA220.73.162.56
hxxp://220.73.162.3/Download/WinCtrCon.exe
hxxp://makevalue.com/Config/sTakeList.asp?n=3220.73.162.46
hxxp://220.73.162.48/Config/AdNw/FcTimeLab.asp
hxxp://220.73.162.48/Config/NewConf/ProgramUpdateLab.asp?version=1817
hxxp://220.73.162.2/Download/WinCtrProc.exe
hxxp://koreaserver.kr/Config/AdNw/StakePsList.asp?uno=3220.73.162.56
hxxp://220.73.162.44/Config/AskIP.asp
hxxp://220.73.162.44/Config/FormLocation.asp
hxxp://220.73.162.44/Config/AdNw/FcPimSLab.asp
hxxp://220.73.162.44/Config/newConf/UCg_LPrMLab.asp?user_no=3
hxxp://220.73.162.44/Config/TransSiteString.asp?nation=KOREA
hxxp://220.73.162.44/config/keyword_platinum.asp?user_no=3&SubName=MAIN
hxxp://220.73.162.44/Config/ipget.asp?kn=first&usd=3&SubName=MAIN&preid=0&ver=sup&Version=1817
hxxp://220.73.162.44/Config/ipget.asp?kn=every&usd=3&SubName=MAIN&preid=0&ver=sup&Version=1817
hxxp://220.73.162.2/Download/Uninstall_Ctr.exe
hxxp://220.73.162.56/Config/newConf/UCg_LPrMLab.asp?user_no=3
hxxp://220.73.162.56/Config/AdNw/FcPimSLab.asp
hxxp://220.73.162.56/Config/FormLocation.asp
hxxp://220.73.162.56/Config/TransSiteString.asp?nation=KOREA

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

GET /Config/sTakeList.asp?n=3 HTTP/1.1

Accept: image/gif,image/x-xbitmap,image/jpeg,image/pjpeg,*/*

User-Agent: Microsoft URL Control - 6.01.9782

Host: makevalue.com

Connection: Keep-Alive

Cache-Control: no-cache

HTTP/1.1 200 OK

Cache-Control: private

Content-Length: 917

Content-Type: text/html

Server: Microsoft-IIS/7.0

Set-Cookie: ASPSESSIONIDSQSASATR=HNBIHOFAAGDOMKJPKIJEDPMK; path=/

X-Powered-By: ASP.NET

Date: Thu, 10 Mar 2016 00:21:31 GMT

hXXp://220.73.162.22,..hXXp://220.73.162.23,..hXXp://220.73.162.24,..http://220.73.162.25,..hXXp://220.73.162.26,..hXXp://220.73.162.27,..http://220.73.162.28,..hXXp://220.73.162.29,..hXXp://220.73.162.30,..http://220.73.162.31,..hXXp://220.73.162.32,..hXXp://220.73.162.33,..http://220.73.162.34,..hXXp://220.73.162.35,..hXXp://220.73.162.36,..http://220.73.162.37,..hXXp://220.73.162.38,..hXXp://220.73.162.39,..http://220.73.162.40,..hXXp://220.73.162.41,..hXXp://220.73.162.42,..hXXp://220.73.162.43,..hXXp://220.73.162.44,..hXXp://220.73.162.45,..hXXp://220.73.162.46,..hXXp://220.73.162.47,..hXXp://220.73.162.48,..hXXp://220.73.162.49,..hXXp://220.73.162.50,..hXXp://220.73.162.51,..hXXp://220.73.162.52,..hXXp://220.73.162.53,..hXXp://220.73.162.54,..hXXp://220.73.162.55,..hXXp://220.73.162.56,..hXXp://220.73.162.57,..hXXp://220.73.162.58,..hXXp://220.73.162.59,..hXXp://220.73.162.60,..hXXp://220.73.162.61HTTP/1.1 200 OK..Cache-Control: private..Content-Length: 917..Content-Type: text/html..Server: Microsoft-IIS/7.0..Set-Cookie: ASPSESSIONIDSQSASATR=HNBIHOFAAGDOMKJPKIJEDPMK; path=/..X-Powered-By: ASP.NET..Date: Thu, 10 Mar 2016 00:21:31 GMT..hXXp://220.73.162.22,..hXXp://220.73.162.23,..hXXp://220.73.162.24,..hXXp://220.73.162.25,..hXXp://220.73.162.26,..hXXp://220.73.162.27,..hXXp://220.73.162.28,..hXXp://220.73.162.29,..hXXp://220.73.162.30,..hXXp://220.73.162.31,..hXXp://220.73.162.32,..hXXp://220.73.162.33,..hXXp://220.73.162.34,..hXXp://220.73.162.35,..hXXp://220.73.162.36,..hXXp://220.73.162.37,..hXXp://220

<<< skipped >>>

GET /Download/WinCtrCon.exe HTTP/1.1

Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, */*

User-Agent: Microsoft URL Control - 6.01.9782

Host: 220.73.162.3

Cache-Control: no-cache

HTTP/1.1 200 OK

Content-Type: application/octet-stream

Last-Modified: Tue, 08 Mar 2016 01:11:49 GMT

Accept-Ranges: bytes

ETag: "8cdfc37dd778d11:0"

Server: Microsoft-IIS/8.0

X-Powered-By: ASP.NET

Date: Thu, 10 Mar 2016 00:07:34 GMT

Content-Length: 108344

MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......}...9...9...9.......8...P...?.......8...Rich9...........PE..L...L'.V.................`... ......l!.......p....@..................................<.......................................b..(.......................8...................................................(... ....... ............................text...$[.......`.................. ..`.data........p.......p..............@....rsrc...............................@..@l.[J............MSVBVM60.DLL.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

<<< skipped >>>

GET /Download/Uninstall_Ctr.exe HTTP/1.1

Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, */*

User-Agent: Microsoft URL Control - 6.01.9782

Host: 220.73.162.2

Cache-Control: no-cache

HTTP/1.1 200 OK

Content-Type: application/octet-stream

Last-Modified: Tue, 19 Jan 2016 00:55:41 GMT

Accept-Ranges: bytes

ETag: "707adb1e5452d11:0"

Server: Microsoft-IIS/7.0

X-Powered-By: ASP.NET

Date: Wed, 09 Mar 2016 23:58:30 GMT

Content-Length: 194376

MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........y.............................`.......Rich............................PE..L......V..................... .......)............@.................................M.......................................4...(.......@...............H...................................................8... ....................................text............................... ..`.data...............................@....rsrc...@...........................@..@l.[J............MSVBVM60.DLL............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

<<< skipped >>>

GET /Config/AdNw/StakePsList.asp?uno=3 HTTP/1.1

Accept: image/gif,image/x-xbitmap,image/jpeg,image/pjpeg,*/*

User-Agent: Microsoft URL Control - 6.01.9782

Host: koreaserver.kr

Connection: Keep-Alive

Cache-Control: no-cache

HTTP/1.1 200 OK

Cache-Control: private

Content-Length: 917

Content-Type: text/html

Server: Microsoft-IIS/7.0

Set-Cookie: ASPSESSIONIDASBQCAQT=HLNFHOFAMAOEPADMEBLEOJHI; path=/

X-Powered-By: ASP.NET

Date: Thu, 10 Mar 2016 00:22:19 GMT

hXXp://220.73.162.22,..hXXp://220.73.162.23,..hXXp://220.73.162.24,..http://220.73.162.25,..hXXp://220.73.162.26,..hXXp://220.73.162.27,..http://220.73.162.28,..hXXp://220.73.162.29,..hXXp://220.73.162.30,..http://220.73.162.31,..hXXp://220.73.162.32,..hXXp://220.73.162.33,..http://220.73.162.34,..hXXp://220.73.162.35,..hXXp://220.73.162.36,..http://220.73.162.37,..hXXp://220.73.162.38,..hXXp://220.73.162.39,..http://220.73.162.40,..hXXp://220.73.162.41,..hXXp://220.73.162.42,..hXXp://220.73.162.43,..hXXp://220.73.162.44,..hXXp://220.73.162.45,..hXXp://220.73.162.46,..hXXp://220.73.162.47,..hXXp://220.73.162.48,..hXXp://220.73.162.49,..hXXp://220.73.162.50,..hXXp://220.73.162.51,..hXXp://220.73.162.52,..hXXp://220.73.162.53,..hXXp://220.73.162.54,..hXXp://220.73.162.55,..hXXp://220.73.162.56,..hXXp://220.73.162.57,..hXXp://220.73.162.58,..hXXp://220.73.162.59,..hXXp://220.73.162.60,..hXXp://220.73.162.61HTTP/1.1 200 OK..Cache-Control: private..Content-Length: 917..Content-Type: text/html..Server: Microsoft-IIS/7.0..Set-Cookie: ASPSESSIONIDASBQCAQT=HLNFHOFAMAOEPADMEBLEOJHI; path=/..X-Powered-By: ASP.NET..Date: Thu, 10 Mar 2016 00:22:19 GMT..hXXp://220.73.162.22,..hXXp://220.73.162.23,..hXXp://220.73.162.24,..hXXp://220.73.162.25,..hXXp://220.73.162.26,..hXXp://220.73.162.27,..hXXp://220.73.162.28,..hXXp://220.73.162.29,..hXXp://220.73.162.30,..hXXp://220.73.162.31,..hXXp://220.73.162.32,..hXXp://220.73.162.33,..hXXp://220.73.162.34,..hXXp://220.73.162.35,..hXXp://220.73.162.36,..hXXp://220.73.162.37,..hXXp://220

<<< skipped >>>

GET /Config/FormChecktimemicroLab.asp HTTP/1.1

Accept: image/gif,image/x-xbitmap,image/jpeg,image/pjpeg,*/*

User-Agent: Microsoft URL Control - 6.01.9782

Host: 220.73.162.25

Connection: Keep-Alive

Cache-Control: no-cache

HTTP/1.1 200 OK

Cache-Control: private

Content-Length: 159

Content-Type: text/html

Server: Microsoft-IIS/8.0

Set-Cookie: ASPSESSIONIDCQAATTSQ=NCGBDOFAIBHGBNNOIDDIJJEH; path=/

X-Powered-By: ASP.NET

Date: Thu, 10 Mar 2016 00:21:25 GMT

5|5|60|hXXp://micronames.co.kr/Download,hXXp://220.73.162.2/Download,http://220.73.162.3/Download,hXXp://220.73.162.4/Download|5|100|100||100|120|Y|Y|Y|Y|Y|Y......

GET /Config/ProgramUpdateLab.asp?version=1279 HTTP/1.1

Accept: image/gif,image/x-xbitmap,image/jpeg,image/pjpeg,*/*

User-Agent: Microsoft URL Control - 6.01.9782

Host: 220.73.162.25

Connection: Keep-Alive

Cache-Control: no-cache

Cookie: ASPSESSIONIDCQAATTSQ=NCGBDOFAIBHGBNNOIDDIJJEH

HTTP/1.1 200 OK

Cache-Control: private

Content-Length: 21

Content-Type: text/html

Server: Microsoft-IIS/8.0

X-Powered-By: ASP.NET

Date: Thu, 10 Mar 2016 00:21:26 GMT

1656|MicroProProc.exeHTTP/1.1 200 OK..Cache-Control: private..Content-Length: 21..Content-Type: text/html..Server: Microsoft-IIS/8.0..X-Powered-By: ASP.NET..Date: Thu, 10 Mar 2016 00:21:26 GMT..1656|MicroProProc.exe....

GET /Config/ProgramSetCon.asp?user_no=835 HTTP/1.1

Accept: image/gif,image/x-xbitmap,image/jpeg,image/pjpeg,*/*

User-Agent: Microsoft URL Control - 6.01.9782

Host: 220.73.162.25

Connection: Keep-Alive

Cache-Control: no-cache

Cookie: ASPSESSIONIDCQAATTSQ=NCGBDOFAIBHGBNNOIDDIJJEH

HTTP/1.1 200 OK

Cache-Control: private

Content-Length: 218

Content-Type: text/html

Expires: Thu, 10 Mar 2016 00:21:26 GMT

Server: Microsoft-IIS/8.0

X-Powered-By: ASP.NET

Date: Thu, 10 Mar 2016 00:21:26 GMT

RetainGard|..26/MicroLab/MyEngin/Retain|..RetainGard:700|..RetainPt:100|..00000162|..MicroName|..26/MicroLab/MyEngin/Common|..1500|..MicroProCon:80,MicroProProc:700|..Actdate:>:3|..anytime|..1000|..N|..N|..E|..00000162HTTP/1.1 200 OK..Cache-Control: private..Content-Length: 218..Content-Type: text/html..Expires: Thu, 10 Mar 2016 00:21:26 GMT..Server: Microsoft-IIS/8.0..X-Powered-By: ASP.NET..Date: Thu, 10 Mar 2016 00:21:26 GMT..RetainGard|..26/MicroLab/MyEngin/Retain|..RetainGard:700|..RetainPt:100|..00000162|..MicroName|..26/MicroLab/MyEngin/Common|..1500|..MicroProCon:80,MicroProProc:700|..Actdate:>:3|..anytime|..1000|..N|..N|..E|..00000162..

GET /Config/AskIP.asp HTTP/1.1

Accept: image/gif,image/x-xbitmap,image/jpeg,image/pjpeg,*/*

User-Agent: Microsoft URL Control - 6.01.9782

Host: 220.73.162.44

Connection: Keep-Alive

Cache-Control: no-cache

HTTP/1.1 200 OK

Cache-Control: private

Content-Length: 28

Content-Type: text/html

Server: Microsoft-IIS/7.0

Set-Cookie: ASPSESSIONIDQQBCARBA=AGHNGOFAJIMDHHEHGNNCCLDE; path=/

X-Powered-By: ASP.NET

Date: Thu, 10 Mar 2016 00:22:47 GMT

194.242.96.218|220.73.162.44....

GET /Config/FormLocation.asp HTTP/1.1

Accept: image/gif,image/x-xbitmap,image/jpeg,image/pjpeg,*/*

User-Agent: Microsoft URL Control - 6.01.9782

Host: 220.73.162.44

Connection: Keep-Alive

Cache-Control: no-cache

Cookie: ASPSESSIONIDQQBCARBA=AGHNGOFAJIMDHHEHGNNCCLDE

HTTP/1.1 200 OK

Cache-Control: private

Content-Length: 5287

Content-Type: text/html

Server: Microsoft-IIS/7.0

X-Powered-By: ASP.NET

Date: Thu, 10 Mar 2016 00:22:47 GMT

hXXp://blink.naver.com|961|C|962|50|R|L|8|8|283#..hXXp://cafe.naver.com/CafeRankingSectionList.nhn?|961|C|962|50|R|L|8|8|283#..hXXp://kin.naver.com/db/detail.php?|961|C|962|50|R|L|10|10|283#..hXXp://news.naver.com|961|C|962|50|R|L|8|8|283#..hXXp://section.blog.naver.com|961|C|962|50|R|L|8|8|283#..hXXp://sample.naver.com|781|C|870|260|R|L|12|12|255#..hXXp://weather.news.naver.com|961|C|962|50|R|L|8|8|283#..hXXp://VVV.naver.com|882|C|882|260|R|L|6|6|255#..hXXp://agora.media.daum.net|978|C|58.34|900|R|L|9|9|430#..hXXp://agoraplaza.media.daum.net/petition/petition.do?|978|C|58.34|900|R|L|9|9|430#..hXXp://blog.daum.net/?|978|C|58.34|900|R|L|9|9|430#..hXXp://blog.daum.net/_blog/_top|978|C|58.34|900|R|L|9|9|430#..hXXp://blog.daum.net/_top/|978|C|58.34|900|R|L|9|9|430#..hXXp://blog.daum.net/_top/layout|978|C|58.34|900|R|L|9|9|430#..http://cafe.daum.net/_c21_/cafefocus_list?|978|C|58.34|900|R|L|9|9|430#..http://cafe.daum.net/_ranking/rank_top100_1.html?|978|C|58.34|900|R|L|9|9|430#..hXXp://cafe.daum.net/support/cafesupport.html?|978|C|58.34|900|R|L|9|9|430#..hXXp://cafe.daum.net/brand/brandstar.html?|978|C|58.34|900|R|L|9|9|430#..hXXp://cafe.daum.net/event/event_list.html?|978|C|58.34|900|R|L|9|9|430#..hXXp://cafe.daum.net/_bbs/0noti/bbs_read?|978|C|58.34|900|R|L|9|9|430#..hXXp://cafe.daum.net/?_top_blogtop=navi_cafehome|978|C|58.34|900|R|L|9|9|430#..hXXp://cafe.daum.net/top/top.html?_top_cafetop=cafehome|978|C|58.34|900|R|L|9|9|430#..hXXp://cartoon.media.daum.net|978|C|58.34|900|R|L|9|9|430#..hXXp://issue.media.daum.ne

<<< skipped >>>

GET /Config/AdNw/FcPimSLab.asp HTTP/1.1

Accept: image/gif,image/x-xbitmap,image/jpeg,image/pjpeg,*/*

User-Agent: Microsoft URL Control - 6.01.9782

Host: 220.73.162.44

Connection: Keep-Alive

Cache-Control: no-cache

Cookie: ASPSESSIONIDQQBCARBA=AGHNGOFAJIMDHHEHGNNCCLDE

HTTP/1.1 200 OK

Cache-Control: private

Content-Length: 157

Content-Type: text/html

Server: Microsoft-IIS/7.0

X-Powered-By: ASP.NET

Date: Thu, 10 Mar 2016 00:22:48 GMT

5|5|60|hXXp://loadform.co.kr/Download,hXXp://220.73.162.2/Download,http://220.73.162.3/Download,hXXp://220.73.162.4/Download|5|100|100||100|120|Y|Y|Y|Y|Y|Y......

GET /Config/newConf/UCg_LPrMLab.asp?user_no=3 HTTP/1.1

Accept: image/gif,image/x-xbitmap,image/jpeg,image/pjpeg,*/*

User-Agent: Microsoft URL Control - 6.01.9782

Host: 220.73.162.44

Connection: Keep-Alive

Cache-Control: no-cache

Cookie: ASPSESSIONIDQQBCARBA=AGHNGOFAJIMDHHEHGNNCCLDE

HTTP/1.1 200 OK

Cache-Control: private

Content-Length: 327

Content-Type: text/html

Expires: Thu, 10 Mar 2016 00:22:48 GMT

Server: Microsoft-IIS/7.0

X-Powered-By: ASP.NET

Date: Thu, 10 Mar 2016 00:22:48 GMT

KOREA|Y|N|N|N|hXXp://|Y|N|N|0|hXXp://220.73.162.57/config/LanguageTranslate.asp?hl=[u]&sl=[u]&tl=[1]&p=[KEYWORD]|name="p" value=,16|hXXp://kr.dictionary.search.yahoo.com/search/dictionaryp?subtype=[1]&prop=7&p=[KEYWORD]|50|N|N|N|0|hXXp://VVV.hebogo.com/search/csearch.asp|N|0|N|0|Y|N|N|N|N|Y|Y|Y|0|N|ALRIM|Y|N|N|N|90|Y|60|Y|85|....

GET /Config/TransSiteString.asp?nation=KOREA HTTP/1.1

Accept: image/gif,image/x-xbitmap,image/jpeg,image/pjpeg,*/*

User-Agent: Microsoft URL Control - 6.01.9782

Host: 220.73.162.44

Connection: Keep-Alive

Cache-Control: no-cache

Cookie: ASPSESSIONIDQQBCARBA=AGHNGOFAJIMDHHEHGNNCCLDE

HTTP/1.1 200 OK

Cache-Control: private

Content-Length: 12071

Content-Type: text/html

Server: Microsoft-IIS/7.0

X-Powered-By: ASP.NET

Date: Thu, 10 Mar 2016 00:22:48 GMT

KOREA,ko,hXXp://kr.search.yahoo.com,hXXp://kr.search.yahoo.com/search?p=,hXXp://translate.google.com/translate?,u=[3][KEYWORD],sl=[1],tl=[u],ie=UTF-8,,|ENGLISH,en,hXXp://search.yahoo.com,hXXp://search.yahoo.com/search?p=,hXXp://translate.google.com/translate?,u=[3][KEYWORD],sl=[1],tl=[u],ie=UTF-8,,|CHINA,zh-TW,hXXp://one.cn.yahoo.com,hXXp://one.cn.yahoo.com/search?p=,hXXp://translate.google.com/translate?,u=[3][KEYWORD],sl=[1],tl=[u],ie=UTF-8,,|CANADA,ca,hXXp://ca.search.yahoo.com,http://ca.search.yahoo.com/search?p=,hXXp://translate.google.com/translate?,u=[3][KEYWORD],sl=[1],tl=[u],ie=UTF-8,,|GERMAN,de,hXXp://de.search.yahoo.com,hXXp://de.search.yahoo.com/search?p=,hXXp://translate.google.com/translate?,u=[3][KEYWORD],sl=[1],tl=[u],ie=UTF-8,,|FRANCE,fr,http://fr.search.yahoo.com,hXXp://fr.search.yahoo.com/search?p=,hXXp://translate.google.com/translate?,u=[3][KEYWORD],sl=[1],tl=[u],ie=UTF-8,,|JAPAN,ja,hXXp://VVV.yahoo.co.jp,hXXp://search.yahoo.co.jp/search?p=,http://translate.google.com/translate?,u=[3][KEYWORD],sl=[1],tl=[u],ie=UTF-8,,|KOREA,ko,hXXp://search.naver.com,hXXp://search.naver.com/search.naver?query=,hXXp://translate.google.com/translate?,u=[3][KEYWORD],sl=[1],tl=[u],ie=UTF-8,,|GERMAN,de,hXXp://de.search.yahoo.com,hXXp://de.search.yahoo.com/search?p=,hXXp://translate.google.com/translate?,u=[3][KEYWORD],sl=[1],tl=[u],ie=UTF-8,,|ENGLISH,en,hXXp://search.yahoo.com,http://search.yahoo.com/search?p=,hXXp://translate.google.com/translate?,u=[3][KEYWORD],sl=[1],tl=[u],ie=UTF-8,,|JAPAN,ja,hXXp://VVV.goog

<<< skipped >>>

GET /config/keyword_platinum.asp?user_no=3&SubName=MAIN HTTP/1.1

Accept: image/gif,image/x-xbitmap,image/jpeg,image/pjpeg,*/*

User-Agent: Microsoft URL Control - 6.01.9782

Host: 220.73.162.44

Connection: Keep-Alive

Cache-Control: no-cache

Cookie: ASPSESSIONIDQQBCARBA=AGHNGOFAJIMDHHEHGNNCCLDE

HTTP/1.1 200 OK

Cache-Control: private

Content-Length: 237

Content-Type: text/html

Expires: Thu, 10 Mar 2016 00:22:49 GMT

Server: Microsoft-IIS/7.0

X-Powered-By: ASP.NET

Date: Thu, 10 Mar 2016 00:22:49 GMT

[icon][/icon][startpage][/startpage][startpop][/startpop][popup][/popup][adminkeywordpop][/adminkeywordpop][keywordpop]|[/keywordpop][ver]sup[/ver][overtureflag]Y[/overtureflag][platinumflag]N[/platinumflag][distinctflag]Y[/distinctflag]....

GET /Config/ipget.asp?kn=first&usd=3&SubName=MAIN&preid=0&ver=sup&Version=1817 HTTP/1.1

Accept: image/gif,image/x-xbitmap,image/jpeg,image/pjpeg,*/*

User-Agent: Microsoft URL Control - 6.01.9782

Host: 220.73.162.44

Connection: Keep-Alive

Cache-Control: no-cache

Cookie: ASPSESSIONIDQQBCARBA=AGHNGOFAJIMDHHEHGNNCCLDE

HTTP/1.1 200 OK

Cache-Control: private

Content-Length: 0

Content-Type: text/html

Expires: Thu, 10 Mar 2016 00:22:50 GMT

Server: Microsoft-IIS/7.0

X-Powered-By: ASP.NET

Date: Thu, 10 Mar 2016 00:22:49 GMT

....

GET /Config/ipget.asp?kn=every&usd=3&SubName=MAIN&preid=0&ver=sup&Version=1817 HTTP/1.1

Accept: image/gif,image/x-xbitmap,image/jpeg,image/pjpeg,*/*

User-Agent: Microsoft URL Control - 6.01.9782

Host: 220.73.162.44

Connection: Keep-Alive

Cache-Control: no-cache

Cookie: ASPSESSIONIDQQBCARBA=AGHNGOFAJIMDHHEHGNNCCLDE

HTTP/1.1 200 OK

Cache-Control: private

Content-Length: 0

Content-Type: text/html

Expires: Thu, 10 Mar 2016 00:22:50 GMT

Server: Microsoft-IIS/7.0

X-Powered-By: ASP.NET

Date: Thu, 10 Mar 2016 00:22:50 GMT

HTTP/1.1 200 OK..Cache-Control: private..Content-Length: 0..Content-Type: text/html..Expires: Thu, 10 Mar 2016 00:22:50 GMT..Server: Microsoft-IIS/7.0..X-Powered-By: ASP.NET..Date: Thu, 10 Mar 2016 00:22:50 GMT..

GET /Config/FormChecktimemicroLab.asp HTTP/1.1

Accept: image/gif,image/x-xbitmap,image/jpeg,image/pjpeg,*/*

User-Agent: Microsoft URL Control - 6.01.9782

Host: 220.73.162.58

Connection: Keep-Alive

Cache-Control: no-cache

HTTP/1.1 200 OK

Cache-Control: private

Content-Length: 159

Content-Type: text/html

Server: Microsoft-IIS/7.0

Set-Cookie: ASPSESSIONIDCQASDBSS=OGILOOFAIGBKILACJDCKFMGI; path=/

X-Powered-By: ASP.NET

Date: Thu, 10 Mar 2016 00:21:55 GMT

5|5|60|hXXp://micronames.co.kr/Download,hXXp://220.73.162.2/Download,http://220.73.162.3/Download,hXXp://220.73.162.4/Download|5|100|100||100|120|Y|Y|Y|Y|Y|Y......

GET /Config/ProgramGuard.asp?uno=835&ver=&wver=5 HTTP/1.1

Accept: image/gif,image/x-xbitmap,image/jpeg,image/pjpeg,*/*

User-Agent: Microsoft URL Control - 6.01.9782

Host: 220.73.162.58

Connection: Keep-Alive

Cache-Control: no-cache

Cookie: ASPSESSIONIDCQASDBSS=OGILOOFAIGBKILACJDCKFMGI

HTTP/1.1 500 Internal Server Error

Cache-Control: private

Content-Type: text/html

Server: Microsoft-IIS/7.0

X-Powered-By: ASP.NET

Date: Thu, 10 Mar 2016 00:21:55 GMT

Content-Length: 1160

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "hXXp://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">..<html xmlns="hXXp://VVV.w3.org/1999/xhtml">..<head>..<meta http-equiv="Content-Type" content="text/html; charset=ks_c_5601-1987"/>..<title>500 - .... .... .....</title>..<style type="text/css">..<!--..body{margin:0;font-size:.7em;font-family:Verdana, Arial, Helvetica, sans-serif;background:#EEEEEE;}..fieldset{padding:0 15px 10px 15px;} ..h1{font-size:2.4em;margin:0;color:#FFF;}..h2{font-size:1.7em;margin:0;color:#CC0000;} ..h3{font-size:1.2em;margin:10px 0 0 0;color:#000000;} ..#header{width:96%;margin:0 0 0 0;padding:6px 2% 6px 2%;font-family:"trebuchet MS", Verdana, sans-serif;color:#FFF;..background-color:#555555;}..#content{margin:0 0 0 2%;position:relative;}...content-container{background:#FFF;width:96%;margin-top:8px;padding:10px;position:relative;}..-->..</style>..</head>..<body>..<div id="header"><h1>.... ....</h1></div>..<div id="content">.. <div class="content-container"><fieldset>.. <h2>500 - .... .... .....</h2>.. <h3>.... .... ........ ...... .... ...... .. .........</h3>.. </fieldset></div>..</div>..</body>..</html>..HTTP/1.1 500 Internal Server Error..Cache-Control: private..Content-Type: text/html..Server: Microsoft-IIS/7.0..X-Powered-By: ASP.NET..Date: Thu, 10 Mar 2016 00:21:55 GMT..Content-Length: 1160..<!DOCTYPE html PU

<<< skipped >>>

GET /Config/AdNw/StakePsList.asp?uno=5 HTTP/1.1

Accept: image/gif,image/x-xbitmap,image/jpeg,image/pjpeg,*/*

User-Agent: Microsoft URL Control - 6.01.9782

Host: domainserver.co.kr

Connection: Keep-Alive

Cache-Control: no-cache

HTTP/1.1 200 OK

Cache-Control: private

Content-Length: 917

Content-Type: text/html

Server: Microsoft-IIS/7.0

Set-Cookie: ASPSESSIONIDSQDSABQR=BEBADOFAHHKGCHJJHOEDIEPF; path=/

X-Powered-By: ASP.NET

Date: Thu, 10 Mar 2016 00:22:25 GMT

hXXp://220.73.162.22,..hXXp://220.73.162.23,..hXXp://220.73.162.24,..http://220.73.162.25,..hXXp://220.73.162.26,..hXXp://220.73.162.27,..http://220.73.162.28,..hXXp://220.73.162.29,..hXXp://220.73.162.30,..http://220.73.162.31,..hXXp://220.73.162.32,..hXXp://220.73.162.33,..http://220.73.162.34,..hXXp://220.73.162.35,..hXXp://220.73.162.36,..http://220.73.162.37,..hXXp://220.73.162.38,..hXXp://220.73.162.39,..http://220.73.162.40,..hXXp://220.73.162.41,..hXXp://220.73.162.42,..hXXp://220.73.162.43,..hXXp://220.73.162.44,..hXXp://220.73.162.45,..hXXp://220.73.162.46,..hXXp://220.73.162.47,..hXXp://220.73.162.48,..hXXp://220.73.162.49,..hXXp://220.73.162.50,..hXXp://220.73.162.51,..hXXp://220.73.162.52,..hXXp://220.73.162.53,..hXXp://220.73.162.54,..hXXp://220.73.162.55,..hXXp://220.73.162.56,..hXXp://220.73.162.57,..hXXp://220.73.162.58,..hXXp://220.73.162.59,..hXXp://220.73.162.60,..hXXp://220.73.162.61HTTP/1.1 200 OK..Cache-Control: private..Content-Length: 917..Content-Type: text/html..Server: Microsoft-IIS/7.0..Set-Cookie: ASPSESSIONIDSQDSABQR=BEBADOFAHHKGCHJJHOEDIEPF; path=/..X-Powered-By: ASP.NET..Date: Thu, 10 Mar 2016 00:22:25 GMT..hXXp://220.73.162.22,..hXXp://220.73.162.23,..hXXp://220.73.162.24,..hXXp://220.73.162.25,..hXXp://220.73.162.26,..hXXp://220.73.162.27,..hXXp://220.73.162.28,..hXXp://220.73.162.29,..hXXp://220.73.162.30,..hXXp://220.73.162.31,..hXXp://220.73.162.32,..hXXp://220.73.162.33,..hXXp://220.73.162.34,..hXXp://220.73.162.35,..hXXp://220.73.162.36,..hXXp://220.73.162.37,..hXXp://220

<<< skipped >>>

GET /Config/FormLocation.asp HTTP/1.1

Accept: image/gif,image/x-xbitmap,image/jpeg,image/pjpeg,*/*

User-Agent: Microsoft URL Control - 6.01.9782

Host: 220.73.162.56

Connection: Keep-Alive

Cache-Control: no-cache

HTTP/1.1 200 OK

Cache-Control: private

Content-Length: 5287

Content-Type: text/html

Server: Microsoft-IIS/7.0

Set-Cookie: ASPSESSIONIDASBQCAQT=JENFHOFAEJKPBFAGHDDBFJCK; path=/

X-Powered-By: ASP.NET

Date: Thu, 10 Mar 2016 00:22:02 GMT

hXXp://blink.naver.com|961|C|962|50|R|L|8|8|283#..hXXp://cafe.naver.com/CafeRankingSectionList.nhn?|961|C|962|50|R|L|8|8|283#..hXXp://kin.naver.com/db/detail.php?|961|C|962|50|R|L|10|10|283#..hXXp://news.naver.com|961|C|962|50|R|L|8|8|283#..hXXp://section.blog.naver.com|961|C|962|50|R|L|8|8|283#..hXXp://sample.naver.com|781|C|870|260|R|L|12|12|255#..hXXp://weather.news.naver.com|961|C|962|50|R|L|8|8|283#..hXXp://VVV.naver.com|882|C|882|260|R|L|6|6|255#..hXXp://agora.media.daum.net|978|C|58.34|900|R|L|9|9|430#..hXXp://agoraplaza.media.daum.net/petition/petition.do?|978|C|58.34|900|R|L|9|9|430#..hXXp://blog.daum.net/?|978|C|58.34|900|R|L|9|9|430#..hXXp://blog.daum.net/_blog/_top|978|C|58.34|900|R|L|9|9|430#..hXXp://blog.daum.net/_top/|978|C|58.34|900|R|L|9|9|430#..hXXp://blog.daum.net/_top/layout|978|C|58.34|900|R|L|9|9|430#..http://cafe.daum.net/_c21_/cafefocus_list?|978|C|58.34|900|R|L|9|9|430#..http://cafe.daum.net/_ranking/rank_top100_1.html?|978|C|58.34|900|R|L|9|9|430#..hXXp://cafe.daum.net/support/cafesupport.html?|978|C|58.34|900|R|L|9|9|430#..hXXp://cafe.daum.net/brand/brandstar.html?|978|C|58.34|900|R|L|9|9|430#..hXXp://cafe.daum.net/event/event_list.html?|978|C|58.34|900|R|L|9|9|430#..hXXp://cafe.daum.net/_bbs/0noti/bbs_read?|978|C|58.34|900|R|L|9|9|430#..hXXp://cafe.daum.net/?_top_blogtop=navi_cafehome|978|C|58.34|900|R|L|9|9|430#..hXXp://cafe.daum.net/top/top.html?_top_cafetop=cafehome|978|C|58.34|900|R|L|9|9|430#..hXXp://cartoon.media.daum.net|978|C|58.34|900|R|L|9|9|430#..hXXp://issue.media.daum.ne

<<< skipped >>>

GET /Config/AdNw/FcPimSLab.asp HTTP/1.1

Accept: image/gif,image/x-xbitmap,image/jpeg,image/pjpeg,*/*

User-Agent: Microsoft URL Control - 6.01.9782

Host: 220.73.162.56

Connection: Keep-Alive

Cache-Control: no-cache

Cookie: ASPSESSIONIDASBQCAQT=JENFHOFAEJKPBFAGHDDBFJCK

HTTP/1.1 200 OK

Cache-Control: private

Content-Length: 157

Content-Type: text/html

Server: Microsoft-IIS/7.0

X-Powered-By: ASP.NET

Date: Thu, 10 Mar 2016 00:22:03 GMT

5|5|60|hXXp://loadform.co.kr/Download,hXXp://220.73.162.2/Download,http://220.73.162.3/Download,hXXp://220.73.162.4/Download|5|100|100||100|120|Y|Y|Y|Y|Y|Y......

GET /Config/newConf/UCg_LPrMLab.asp?user_no=3 HTTP/1.1

Accept: image/gif,image/x-xbitmap,image/jpeg,image/pjpeg,*/*

User-Agent: Microsoft URL Control - 6.01.9782

Host: 220.73.162.56

Connection: Keep-Alive

Cache-Control: no-cache

Cookie: ASPSESSIONIDASBQCAQT=JENFHOFAEJKPBFAGHDDBFJCK

HTTP/1.1 200 OK

Cache-Control: private

Content-Length: 327

Content-Type: text/html

Expires: Thu, 10 Mar 2016 00:22:03 GMT

Server: Microsoft-IIS/7.0

X-Powered-By: ASP.NET

Date: Thu, 10 Mar 2016 00:22:03 GMT

KOREA|Y|N|N|N|hXXp://|Y|N|N|0|hXXp://220.73.162.54/config/LanguageTranslate.asp?hl=[u]&sl=[u]&tl=[1]&p=[KEYWORD]|name="p" value=,16|hXXp://kr.dictionary.search.yahoo.com/search/dictionaryp?subtype=[1]&prop=7&p=[KEYWORD]|50|N|N|N|0|hXXp://VVV.hebogo.com/search/csearch.asp|N|0|N|0|Y|N|N|N|N|Y|Y|Y|0|N|ALRIM|Y|N|N|N|90|Y|60|Y|85|....

GET /Config/TransSiteString.asp?nation=KOREA HTTP/1.1

Accept: image/gif,image/x-xbitmap,image/jpeg,image/pjpeg,*/*

User-Agent: Microsoft URL Control - 6.01.9782

Host: 220.73.162.56

Connection: Keep-Alive

Cache-Control: no-cache

Cookie: ASPSESSIONIDASBQCAQT=JENFHOFAEJKPBFAGHDDBFJCK

HTTP/1.1 200 OK

Cache-Control: private

Content-Length: 24143

Content-Type: text/html

Server: Microsoft-IIS/7.0

X-Powered-By: ASP.NET

Date: Thu, 10 Mar 2016 00:22:03 GMT

KOREA,ko,hXXp://kr.search.yahoo.com,hXXp://kr.search.yahoo.com/search?p=,hXXp://translate.google.com/translate?,u=[3][KEYWORD],sl=[1],tl=[u],ie=UTF-8,,|ENGLISH,en,hXXp://search.yahoo.com,hXXp://search.yahoo.com/search?p=,hXXp://translate.google.com/translate?,u=[3][KEYWORD],sl=[1],tl=[u],ie=UTF-8,,|CHINA,zh-TW,hXXp://one.cn.yahoo.com,hXXp://one.cn.yahoo.com/search?p=,hXXp://translate.google.com/translate?,u=[3][KEYWORD],sl=[1],tl=[u],ie=UTF-8,,|CANADA,ca,hXXp://ca.search.yahoo.com,http://ca.search.yahoo.com/search?p=,hXXp://translate.google.com/translate?,u=[3][KEYWORD],sl=[1],tl=[u],ie=UTF-8,,|GERMAN,de,hXXp://de.search.yahoo.com,hXXp://de.search.yahoo.com/search?p=,hXXp://translate.google.com/translate?,u=[3][KEYWORD],sl=[1],tl=[u],ie=UTF-8,,|FRANCE,fr,http://fr.search.yahoo.com,hXXp://fr.search.yahoo.com/search?p=,hXXp://translate.google.com/translate?,u=[3][KEYWORD],sl=[1],tl=[u],ie=UTF-8,,|JAPAN,ja,hXXp://VVV.yahoo.co.jp,hXXp://search.yahoo.co.jp/search?p=,http://translate.google.com/translate?,u=[3][KEYWORD],sl=[1],tl=[u],ie=UTF-8,,|KOREA,ko,hXXp://search.naver.com,hXXp://search.naver.com/search.naver?query=,hXXp://translate.google.com/translate?,u=[3][KEYWORD],sl=[1],tl=[u],ie=UTF-8,,|GERMAN,de,hXXp://de.search.yahoo.com,hXXp://de.search.yahoo.com/search?p=,hXXp://translate.google.com/translate?,u=[3][KEYWORD],sl=[1],tl=[u],ie=UTF-8,,|ENGLISH,en,hXXp://search.yahoo.com,http://search.yahoo.com/search?p=,hXXp://translate.google.com/translate?,u=[3][KEYWORD],sl=[1],tl=[u],ie=UTF-8,,|JAPAN,ja,hXXp://VVV.goog

<<< skipped >>>

GET /Config/ServerList.asp?uno=835 HTTP/1.1

Accept: image/gif,image/x-xbitmap,image/jpeg,image/pjpeg,*/*

User-Agent: Microsoft URL Control - 6.01.9782

Host: koreaserver.kr

Connection: Keep-Alive

Cache-Control: no-cache

HTTP/1.1 200 OK

Cache-Control: private

Content-Length: 917

Content-Type: text/html

Server: Microsoft-IIS/7.0

Set-Cookie: ASPSESSIONIDASBQCAQT=EOMFHOFACFGHLEOGGIIIIEPP; path=/

X-Powered-By: ASP.NET

Date: Thu, 10 Mar 2016 00:21:46 GMT

hXXp://220.73.162.22,..hXXp://220.73.162.23,..hXXp://220.73.162.24,..http://220.73.162.25,..hXXp://220.73.162.26,..hXXp://220.73.162.27,..http://220.73.162.28,..hXXp://220.73.162.29,..hXXp://220.73.162.30,..http://220.73.162.31,..hXXp://220.73.162.32,..hXXp://220.73.162.33,..http://220.73.162.34,..hXXp://220.73.162.35,..hXXp://220.73.162.36,..http://220.73.162.37,..hXXp://220.73.162.38,..hXXp://220.73.162.39,..http://220.73.162.40,..hXXp://220.73.162.41,..hXXp://220.73.162.42,..hXXp://220.73.162.43,..hXXp://220.73.162.44,..hXXp://220.73.162.45,..hXXp://220.73.162.46,..hXXp://220.73.162.47,..hXXp://220.73.162.48,..hXXp://220.73.162.49,..hXXp://220.73.162.50,..hXXp://220.73.162.51,..hXXp://220.73.162.52,..hXXp://220.73.162.53,..hXXp://220.73.162.54,..hXXp://220.73.162.55,..hXXp://220.73.162.56,..hXXp://220.73.162.57,..hXXp://220.73.162.58,..hXXp://220.73.162.59,..hXXp://220.73.162.60,..hXXp://220.73.162.61HTTP/1.1 200 OK..Cache-Control: private..Content-Length: 917..Content-Type: text/html..Server: Microsoft-IIS/7.0..Set-Cookie: ASPSESSIONIDASBQCAQT=EOMFHOFACFGHLEOGGIIIIEPP; path=/..X-Powered-By: ASP.NET..Date: Thu, 10 Mar 2016 00:21:46 GMT..hXXp://220.73.162.22,..hXXp://220.73.162.23,..hXXp://220.73.162.24,..hXXp://220.73.162.25,..hXXp://220.73.162.26,..hXXp://220.73.162.27,..hXXp://220.73.162.28,..hXXp://220.73.162.29,..hXXp://220.73.162.30,..hXXp://220.73.162.31,..hXXp://220.73.162.32,..hXXp://220.73.162.33,..hXXp://220.73.162.34,..hXXp://220.73.162.35,..hXXp://220.73.162.36,..hXXp://220.73.162.37,..hXXp://220

<<< skipped >>>

GET /Config/AdNw/FcTimeLab.asp HTTP/1.1

Accept: image/gif,image/x-xbitmap,image/jpeg,image/pjpeg,*/*

User-Agent: Microsoft URL Control - 6.01.9782

Host: 220.73.162.48

Connection: Keep-Alive

Cache-Control: no-cache

HTTP/1.1 200 OK

Cache-Control: private

Content-Length: 157

Content-Type: text/html

Server: Microsoft-IIS/7.0

Set-Cookie: ASPSESSIONIDQATABRDB=BJJHCPFAEENFGHNPJONEMOHD; path=/

X-Powered-By: ASP.NET

Date: Thu, 10 Mar 2016 00:23:19 GMT

5|5|60|hXXp://loadform.co.kr/Download,hXXp://220.73.162.2/Download,http://220.73.162.3/Download,hXXp://220.73.162.4/Download|5|100|100||100|120|Y|Y|Y|Y|Y|Y..HTTP/1.1 200 OK..Cache-Control: private..Content-Length: 157..Content-Type: text/html..Server: Microsoft-IIS/7.0..Set-Cookie: ASPSESSIONIDQATABRDB=BJJHCPFAEENFGHNPJONEMOHD; path=/..X-Powered-By: ASP.NET..Date: Thu, 10 Mar 2016 00:23:19 GMT..5|5|60|hXXp://loadform.co.kr/Download,hXXp://220.73.162.2/Download,hXXp://220.73.162.3/Download,hXXp://220.73.162.4/Download|5|100|100||100|120|Y|Y|Y|Y|Y|Y..t>....

GET /Config/NewConf/ProgramUpdateLab.asp?version=1817 HTTP/1.1

Accept: image/gif,image/x-xbitmap,image/jpeg,image/pjpeg,*/*

User-Agent: Microsoft URL Control - 6.01.9782

Host: 220.73.162.48

Connection: Keep-Alive

Cache-Control: no-cache

Cookie: ASPSESSIONIDQATABRDB=BJJHCPFAEENFGHNPJONEMOHD

HTTP/1.1 200 OK

Cache-Control: private

Content-Length: 19

Content-Type: text/html

Server: Microsoft-IIS/7.0

X-Powered-By: ASP.NET

Date: Thu, 10 Mar 2016 00:23:21 GMT

1817|WinCtrProc.exeHTTP/1.1 200 OK..Cache-Control: private..Content-Length: 19..Content-Type: text/html..Server: Microsoft-IIS/7.0..X-Powered-By: ASP.NET..Date: Thu, 10 Mar 2016 00:23:21 GMT..1817|WinCtrProc.exe..

GET /Download/Uninstall.exe HTTP/1.1

Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, */*

User-Agent: Microsoft URL Control - 6.01.9782

Host: micronames.co.kr

Cache-Control: no-cache

HTTP/1.1 200 OK

Content-Type: application/octet-stream

Last-Modified: Thu, 03 Mar 2016 09:07:35 GMT

Accept-Ranges: bytes

ETag: "f0ca69202c75d11:0"

Server: Microsoft-IIS/7.0

X-Powered-By: ASP.NET

Date: Thu, 10 Mar 2016 00:21:31 GMT

Content-Length: 191984

MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........y.............................`.......Rich............................PE..L...8.yS..................... .......(............@..................................(..........................................(.......@...................................................................8... ....................................text............................... ..`.data...............................@....rsrc...@...........................@..@=..H............MSVBVM60.DLL............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

<<< skipped >>>

GET /Download/MicroProProc.exe HTTP/1.1

Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, */*

User-Agent: Microsoft URL Control - 6.01.9782

Host: micronames.co.kr

Cache-Control: no-cache

HTTP/1.1 200 OK

Content-Type: application/octet-stream

Last-Modified: Thu, 03 Mar 2016 09:07:18 GMT

Accept-Ranges: bytes

ETag: "e0a152162c75d11:0"

Server: Microsoft-IIS/7.0

X-Powered-By: ASP.NET

Date: Thu, 10 Mar 2016 00:21:34 GMT

Content-Length: 843224

MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........MTK.,:..,:..,:.~04..,:..33..,:..37..,:.Rich.,:.................PE..L....s.U.....................P.......s............@.............................................................................(.......h...................................................................0... ....................................text............................... ..`.data....5..........................@....rsrc...h...........................@..@l.[J............MSVBVM60.DLL....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

<<< skipped >>>

GET /Download/WinCtrProc.exe HTTP/1.1

Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, */*

User-Agent: Microsoft URL Control - 6.01.9782

Host: 220.73.162.2

Cache-Control: no-cache

HTTP/1.1 200 OK

Content-Type: application/octet-stream

Last-Modified: Tue, 08 Mar 2016 01:01:52 GMT

Accept-Ranges: bytes

ETag: "b18eb419d678d11:0"

Server: Microsoft-IIS/7.0

X-Powered-By: ASP.NET

Date: Wed, 09 Mar 2016 23:58:17 GMT

Content-Length: 870192

MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........MTK.,:..,:..,:.~04..,:..33..,:..37..,:.Rich.,:.................PE..L...t'.V.....................P.......w............@..........................`..................................................(....P..h............0..0...................................................0... ....................................text............................... ..`.data...H5..........................@....rsrc...h....P....... ..............@..@l.[J............MSVBVM60.DLL....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

<<< skipped >>>

GET /Config/serverlist.asp?n=835 HTTP/1.1

Accept: image/gif,image/x-xbitmap,image/jpeg,image/pjpeg,*/*

User-Agent: Microsoft URL Control - 6.01.9782

Host: hostserver.kr

Connection: Keep-Alive

Cache-Control: no-cache

HTTP/1.1 200 OK

Cache-Control: private

Content-Length: 917

Content-Type: text/html

Server: Microsoft-IIS/7.0

Set-Cookie: ASPSESSIONIDQSBRDAQR=JKGDDOFAKDMLICIDLHGIKIEN; path=/

X-Powered-By: ASP.NET

Date: Thu, 10 Mar 2016 00:21:25 GMT

hXXp://220.73.162.22,..hXXp://220.73.162.23,..hXXp://220.73.162.24,..http://220.73.162.25,..hXXp://220.73.162.26,..hXXp://220.73.162.27,..http://220.73.162.28,..hXXp://220.73.162.29,..hXXp://220.73.162.30,..http://220.73.162.31,..hXXp://220.73.162.32,..hXXp://220.73.162.33,..http://220.73.162.34,..hXXp://220.73.162.35,..hXXp://220.73.162.36,..http://220.73.162.37,..hXXp://220.73.162.38,..hXXp://220.73.162.39,..http://220.73.162.40,..hXXp://220.73.162.41,..hXXp://220.73.162.42,..hXXp://220.73.162.43,..hXXp://220.73.162.44,..hXXp://220.73.162.45,..hXXp://220.73.162.46,..hXXp://220.73.162.47,..hXXp://220.73.162.48,..hXXp://220.73.162.49,..hXXp://220.73.162.50,..hXXp://220.73.162.51,..hXXp://220.73.162.52,..hXXp://220.73.162.53,..hXXp://220.73.162.54,..hXXp://220.73.162.55,..hXXp://220.73.162.56,..hXXp://220.73.162.57,..hXXp://220.73.162.58,..hXXp://220.73.162.59,..hXXp://220.73.162.60,..hXXp://220.73.162.61HTTP/1.1 200 OK..Cache-Control: private..Content-Length: 917..Content-Type: text/html..Server: Microsoft-IIS/7.0..Set-Cookie: ASPSESSIONIDQSBRDAQR=JKGDDOFAKDMLICIDLHGIKIEN; path=/..X-Powered-By: ASP.NET..Date: Thu, 10 Mar 2016 00:21:25 GMT..hXXp://220.73.162.22,..hXXp://220.73.162.23,..hXXp://220.73.162.24,..hXXp://220.73.162.25,..hXXp://220.73.162.26,..hXXp://220.73.162.27,..hXXp://220.73.162.28,..hXXp://220.73.162.29,..hXXp://220.73.162.30,..hXXp://220.73.162.31,..hXXp://220.73.162.32,..hXXp://220.73.162.33,..hXXp://220.73.162.34,..hXXp://220.73.162.35,..hXXp://220.73.162.36,..hXXp://220.73.162.37,..hXXp://220

<<< skipped >>>

Map

The not-a-virus connects to the servers at the folowing location(s):

Strings from Dumps

WinCtrProc.exe_544:

.text

.text

`.data

`.data

.rsrc

.rsrc

MSVBVM60.DLL

MSVBVM60.DLL

InetCtlsObjects.Inet

InetCtlsObjects.Inet

WebBrowser1

WebBrowser1

SHDocVwCtl.WebBrowser

SHDocVwCtl.WebBrowser

vb6ko.dll

vb6ko.dll

MSINET.OCX

MSINET.OCX

ieframe.dll

ieframe.dll

WebBrowser

WebBrowser

KeywordForm

KeywordForm

GetKeyState

GetKeyState

shell32.dll

shell32.dll

ShellExecuteA

ShellExecuteA

EnumWindows

EnumWindows

GetAsyncKeyState

GetAsyncKeyState

WSOCK32.DLL

WSOCK32.DLL

iphlpapi.dll

iphlpapi.dll

VBA6.DLL

VBA6.DLL

GetWindowsDirectoryA

GetWindowsDirectoryA

UpdateLayeredWindows

UpdateLayeredWindows

User32.DLL

User32.DLL

kernel32.dll

kernel32.dll

WinExec

WinExec

advapi32.dll

advapi32.dll

RegCloseKey

RegCloseKey

RegCreateKeyExA

RegCreateKeyExA

RegDeleteKeyA

RegDeleteKeyA

RegOpenKeyExA

RegOpenKeyExA

RegCreateKeyA

RegCreateKeyA

RegOpenKeyA

RegOpenKeyA

C:\Windows\system32\msvbvm60.dll\3

C:\Windows\system32\msvbvm60.dll\3

%Program Files%\Microsoft Visual Studio\VB98\VB6.OLB

%Program Files%\Microsoft Visual Studio\VB98\VB6.OLB

C:\Windows\system32\MSINET.oca

C:\Windows\system32\MSINET.oca

zdWebBrowser1

zdWebBrowser1

C:\Windows\System32\ieframe.oca

C:\Windows\System32\ieframe.oca

vb6stkit.dll

vb6stkit.dll

GetKeyboardState

GetKeyboardState

URLEncode

URLEncode

2008:02:21 11:10:24

2008:02:21 11:10:24

urlTEXT

urlTEXT

MsgeTEXT

MsgeTEXT

HhXXp://ns.adobe.com/xap/1.0/

HhXXp://ns.adobe.com/xap/1.0/

xmlns:xapMM='hXXp://ns.adobe.com/xap/1.0/mm/'>

xmlns:xapMM='hXXp://ns.adobe.com/xap/1.0/mm/'>

adobe:docid:photoshop:253266fe-e021-11dc-8e7f-a474304460f4

adobe:docid:photoshop:253266fe-e021-11dc-8e7f-a474304460f4

hXXp:///

hXXp:///

@isplay;0System.DateM

@isplay;0System.DateM

\WinCtrPrc(20140224)\WinCtrProc_Random\MainControlProc.vbp

\WinCtrPrc(20140224)\WinCtrProc_Random\MainControlProc.vbp

78E1BDD1-9941-11cf-9756-00AA00C00908

78E1BDD1-9941-11cf-9756-00AA00C00908

Error opening key.

Error opening key.

Error getting subkey value.

Error getting subkey value.

chrome

chrome

mozilla

mozilla

firefox

firefox

opera

opera

- chrome

- chrome

keyboard

keyboard

netpia.com

netpia.com

2.asp

2.asp

3.asp

3.asp

/config/FormActive_Distinct.asp?uno=

/config/FormActive_Distinct.asp?uno=

&url=

&url=

&keyword=

&keyword=

&keyno=

&keyno=

/config/Formactive_Distinct.asp?uno=

/config/Formactive_Distinct.asp?uno=

/config/formactive.asp?uno=

/config/formactive.asp?uno=

&kind=PORTAL

&kind=PORTAL

/config/FormActive.asp?uno=

/config/FormActive.asp?uno=

&kind=KEYWORD

&kind=KEYWORD

microsoft.com

microsoft.com

st.asp?uno=

st.asp?uno=

/Config/FormLocation.asp

/Config/FormLocation.asp

/Config/AdNw/FcPimSLab.asp

/Config/AdNw/FcPimSLab.asp

/Config/newConf/UCg_LPrMLab.asp?user_no=

/Config/newConf/UCg_LPrMLab.asp?user_no=

/Config/TransSiteString.asp?nation=

/Config/TransSiteString.asp?nation=

/Config/FileNameDataMicro.asp

/Config/FileNameDataMicro.asp

SetDownValue.asp?uno=

SetDownValue.asp?uno=

/Config/MakeIcon.asp?uno=

/Config/MakeIcon.asp?uno=

/Config/MakeStartPage.asp?uno=

/Config/MakeStartPage.asp?uno=

/Config/MakeSearchPage.asp?uno=

/Config/MakeSearchPage.asp?uno=

/Config/MakeProgram.asp?uno=

/Config/MakeProgram.asp?uno=

ERROR_URL

ERROR_URL

/Config/Pop_Key_MainPlatinum.asp?uno=

/Config/Pop_Key_MainPlatinum.asp?uno=

/Config/Pop_Key_MainDistinct.asp?uno=

/Config/Pop_Key_MainDistinct.asp?uno=

&distinct=keyword

&distinct=keyword

error_url

error_url

hXXp://VVV.naver.com

hXXp://VVV.naver.com

InternetExplorer.Application

InternetExplorer.Application

/advertisebanner/keyword/

/advertisebanner/keyword/

/advertisedistinct/keyword/

/advertisedistinct/keyword/

/Config/GuideSiteString.asp?p=

/Config/GuideSiteString.asp?p=

.dictionary

.dictionary

dic.daum

dic.daum

dic.naver

dic.naver

dic.nate

dic.nate

http:

http:

https:

https:

&key=

&key=

?keyword=

?keyword=

?key=

?key=

keyword=

keyword=

로

로

을

을

e.asp?p=

e.asp?p=

[KEYWORD]

[KEYWORD]

.asp?p=

.asp?p=

roLab.asp?p=

roLab.asp?p=

Code.asp?p=

Code.asp?p=

hXXp://

hXXp://

hXXps://

hXXps://

ode.asp?uno=

ode.asp?uno=

/Config/KeySt

/Config/KeySt

ab.asp?p=

ab.asp?p=

/Config/SiteLink_Code.asp?uno=

/Config/SiteLink_Code.asp?uno=

/Config/ConvertLanguagemicrOLAb.asp?p=

/Config/ConvertLanguagemicrOLAb.asp?p=

/Config/OvertureDataConnect.asp?p=&uno=

/Config/OvertureDataConnect.asp?p=&uno=

/Config/RankeyLink_Code.asp?uno=

/Config/RankeyLink_Code.asp?uno=

/advertisebanner/keyword

/advertisebanner/keyword

/advertisedistinct/keyword

/advertisedistinct/keyword

JOIN

JOIN

KEYWORD

KEYWORD

\Internet Explorer\iexplore.exe

\Internet Explorer\iexplore.exe

WScript.Shell

WScript.Shell

%Program Files%\Internet Explorer\iexplore.exe

%Program Files%\Internet Explorer\iexplore.exe

/Config/KeyStringmicrOLAbPop.asp?p=

/Config/KeyStringmicrOLAbPop.asp?p=

wscript.shell

wscript.shell

/Config/GolbalString.asp?p=

/Config/GolbalString.asp?p=

/Config/TransSiteString_Commit.asp?site=

/Config/TransSiteString_Commit.asp?site=

/Config/FindBrowserCode.asp?p=

/Config/FindBrowserCode.asp?p=

PORTUGAL

PORTUGAL

from portugal

from portugal

to portugal

to portugal

/Config/UrlEncodeDecode.asp?q=

/Config/UrlEncodeDecode.asp?q=

/Config/ServerList.asp?uno=

/Config/ServerList.asp?uno=

[keywordpop]

[keywordpop]

/Config/TargetDataConnect.asp?p=&uno=

/Config/TargetDataConnect.asp?p=&uno=

[/adminkeywordpop]

[/adminkeywordpop]

software\microsoft\windows\currentversion\run

software\microsoft\windows\currentversion\run

%Program Files%\micrOLAb\SearchEngin\LanguageConvert

%Program Files%\micrOLAb\SearchEngin\LanguageConvert

/config/keyword_platinum.asp?user_no=

/config/keyword_platinum.asp?user_no=

[adminkeywordpop]

[adminkeywordpop]

[/keywordpop]

[/keywordpop]

/Config/ipget.asp?kn=every&usd=

/Config/ipget.asp?kn=every&usd=

/Config/ipget.asp?kn=first&usd=

/Config/ipget.asp?kn=first&usd=

hXXp://koreaserver.kr

hXXp://koreaserver.kr

hXXp://domainserver.co.kr

hXXp://domainserver.co.kr

hXXp://hostserver.kr

hXXp://hostserver.kr

hXXp://mainserver.kr

hXXp://mainserver.kr

hXXp://makevalue.com

hXXp://makevalue.com

hXXp://duzip.com

hXXp://duzip.com

hXXp://maketop.kr

hXXp://maketop.kr

hXXp://itemprice.kr

hXXp://itemprice.kr

2000-10-01

2000-10-01

Software\Microsoft\Windows\currentversion\Run

Software\Microsoft\Windows\currentversion\Run

Software\Microsoft\Windows\CurrentVersion\Run

Software\Microsoft\Windows\CurrentVersion\Run

Software\Microsoft\Windows\Currentversion\Run

Software\Microsoft\Windows\Currentversion\Run

/Config/AskIP.asp

/Config/AskIP.asp

VB6KO.DLL

VB6KO.DLL

msvbvm60.dll

msvbvm60.dll

wshom.ocx

wshom.ocx

/config/KeyStringMicroLabRandom.asp?user_no=

/config/KeyStringMicroLabRandom.asp?user_no=

WEBSEARCH

WEBSEARCH

/config/KeyStringRandompacket.asp?user_no=

/config/KeyStringRandompacket.asp?user_no=

/config/KeyStringRandomPop.asp?uno=

/config/KeyStringRandomPop.asp?uno=

/config/KeyStringRandom.asp?user_no=

/config/KeyStringRandom.asp?user_no=

MicroProCon.exe

MicroProCon.exe

MicroProProc.exe

MicroProProc.exe

RetainPt.exe

RetainPt.exe

RetainComp.exe

RetainComp.exe

in.asp?uno=

in.asp?uno=

Software\Microsoft\Windows\currentversion\run

Software\Microsoft\Windows\currentversion\run

00000001

00000001

00000060

00000060

.asp?version=

.asp?version=

.asp?uno=

.asp?uno=

nCtrProc.exe

nCtrProc.exe