Trojan.Win32.Autoit.edt (Kaspersky), Dropped:Trojan.Autoit.Agent.HR (B) (Emsisoft), Backdoor.Win32.PcClient.FD, GenericAutorunWorm.YR (Lavasoft MAS)Behaviour: Trojan, Backdoor, Worm, WormAutorun
The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.
Summary
MD5: d3ec766ab5e9c6331e899d9488be8957
SHA1: 3595b3a915c78db2fe3bbe19868e94c17d7bf1a4
SHA256: 1592d1dae388d281548932c57b10f6d8ffd3be5425c12c2f2d4b3dfbd326d9b1
SSDeep: 24576:IIBe7GUPa77BCgkTs7VgYghPCPWX8qxaxe7C4 PmPi8HjajhaSj:IIISUPa71CThYNCakmm6hhau
Size: 1327522 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: UPolyXv05_v6
Company: no certificate found
Created at: 2008-09-16 17:17:44
Analyzed on: WindowsXP SP3 32-bit
Summary: Backdoor. Malware that enables a remote control of victim's machine.
Dynamic Analysis
Payload
Behaviour | Description |
---|---|
WormAutorun | A worm can spread via removable drives. It writes its executable and creates "autorun.inf" scripts on all removable drives. The autorun script will execute the Backdoor's file once a user opens a drive's folder in Windows Explorer. |
Process activity
The Backdoor creates the following process(es):
%original file name%.exe:924
uZOkAB.exe:1332
rundll32.exe:1300
rundll32.exe:1484
dumprep.exe:1240
dumprep.exe:1608
dumprep.exe:1252
dumprep.exe:2012
The Backdoor injects its code into the following process(es):
Svchost.exe:1676
Svchost.exe:380
Mutexes
The following mutexes were created/opened:No objects were found.
File activity
The process %original file name%.exe:924 makes changes in the file system.
The Backdoor creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\RarSFX0\voyVXU (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\RarSFX0\uZOkAB.exe (12865 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\RarSFX0\klbMgk.exe (2353 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\RarSFX0\jWqBJR.txt (9606 bytes)
The Backdoor deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\RarSFX0\voyVXU (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\RarSFX0\uZOkAB.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\RarSFX0\klbMgk.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\RarSFX0\__tmp_rar_sfx_access_check_831734 (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\RarSFX0\jWqBJR.txt (0 bytes)
The process uZOkAB.exe:1332 makes changes in the file system.
The Backdoor creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\Svchost.exe (14 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\voyVXU (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\jWqBJR.txt (11518 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\klbMgk.exe (601 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\uZOkAB.exe (3073 bytes)
The process dumprep.exe:1240 makes changes in the file system.
The Backdoor creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\WERdc8e.dir00\Svchost.exe.mdmp (102821 bytes)
The process dumprep.exe:1608 makes changes in the file system.
The Backdoor creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\WERdc8e.dir00\Svchost.exe.hdmp (229466 bytes)
The process dumprep.exe:1252 makes changes in the file system.
The Backdoor creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\WERbbc6.dir00\Svchost.exe.hdmp (230101 bytes)
The process dumprep.exe:2012 makes changes in the file system.
The Backdoor creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\WERbbc6.dir00\Svchost.exe.mdmp (106192 bytes)
Registry activity
The process %original file name%.exe:924 makes changes in the system registry.
The Backdoor creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "98 C2 7B 05 6B FC 38 A0 20 54 F5 25 01 4D 4B 95"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"
[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\RarSFX0]
"uZOkAB.exe" = "AutoIt v3 Script"
The Backdoor modifies IE settings for security zones to map all urls to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"
The Backdoor modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:
"UNCAsIntranet" = "1"
The Backdoor modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:
"ProxyBypass" = "1"
The process uZOkAB.exe:1332 makes changes in the system registry.
The Backdoor creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "29 49 82 1E 04 85 E5 C6 7F 4F A1 81 79 72 59 C4"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
The process rundll32.exe:1300 makes changes in the system registry.
The Backdoor creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "76 9B 81 9E C5 2B 9A 98 2E 2B FE C0 56 28 AE 5A"
The process rundll32.exe:1484 makes changes in the system registry.
The Backdoor creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "2B F1 5F ED 4C EE 03 75 C4 2D 9A 8C 9A B8 50 E8"
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers\%Documents and Settings%\%current user%\Local Settings\Temp]
"svchost.exe" = "EnableNXShowUI"
[HKLM\System\CurrentControlSet\Control\Session Manager\AppCompatibility]
"AppCompatCache" = "EF BE AD DE 60 00 00 00 00 00 00 00 00 00 00 00"
[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%Documents and Settings%\%current user%\Local Settings\Temp]
"svchost.exe" = "Generic Host Process for Win32 Services"
The process dumprep.exe:1240 makes changes in the system registry.
The Backdoor creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "F8 CC 7D 39 CE 72 8C 61 D6 4C 14 0B 05 F0 01 FE"
The process dumprep.exe:1608 makes changes in the system registry.
The Backdoor creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "7A B6 13 E8 1D F0 37 FC 1A 7C CD DD 05 6A BA DC"
The process dumprep.exe:1252 makes changes in the system registry.
The Backdoor creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "28 26 08 95 11 11 EA 9A 08 49 EC 69 4C 4A 7B 00"
The process dumprep.exe:2012 makes changes in the system registry.
The Backdoor creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "98 64 21 B0 D1 CF 9D 3D 04 B5 68 59 EB 26 45 EC"
Dropped PE files
MD5 | File path |
---|---|
27c6d03bcdb8cfeb96b716f3d8be3e18 | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\Svchost.exe |
9444124ca8b68840ea8ba70da0525bd5 | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\klbMgk.exe |
01d151ccd2a75bd713b8ce81d6509eb8 | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\uZOkAB.exe |
HOSTS file anomalies
No changes have been detected.
Rootkit activity
No anomalies have been detected.
Propagation
A worm can spread via removable drives. It writes its executable and creates "autorun.inf" scripts on all removable drives. The autorun script will execute the Backdoor's file once a user opens a drive's folder in Windows Explorer.
Removals
Remove it with Ad-Aware
- Click (here) to download and install Ad-Aware Free Antivirus.
- Update the definition files.
- Run a full scan of your computer.
Manual removal*
- Terminate malicious process(es) (How to End a Process With the Task Manager):
%original file name%.exe:924
uZOkAB.exe:1332
rundll32.exe:1300
rundll32.exe:1484
dumprep.exe:1240
dumprep.exe:1608
dumprep.exe:1252
dumprep.exe:2012 - Delete the original Backdoor file.
- Delete or disinfect the following files created/modified by the Backdoor:
%Documents and Settings%\%current user%\Local Settings\Temp\RarSFX0\voyVXU (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\RarSFX0\uZOkAB.exe (12865 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\RarSFX0\klbMgk.exe (2353 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\RarSFX0\jWqBJR.txt (9606 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Svchost.exe (14 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\voyVXU (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\jWqBJR.txt (11518 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\klbMgk.exe (601 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\uZOkAB.exe (3073 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\WERdc8e.dir00\Svchost.exe.mdmp (102821 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\WERdc8e.dir00\Svchost.exe.hdmp (229466 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\WERbbc6.dir00\Svchost.exe.hdmp (230101 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\WERbbc6.dir00\Svchost.exe.mdmp (106192 bytes) - Find and delete all copies of the worm's file together with "autorun.inf" scripts on removable drives.
- Reboot the computer.
Static Analysis
VersionInfo
No information is available.
No information is available.
PE Sections
Name | Virtual Address | Virtual Size | Raw Size | Entropy | Section MD5 |
---|---|---|---|---|---|
.text | 4096 | 81920 | 80384 | 4.4941 | d9c3b0b82d7da6d18b0896fb360cea84 |
.data | 86016 | 32768 | 2560 | 3.41851 | 568dd221456d807ca821813c84d65e70 |
.idata | 118784 | 8192 | 4608 | 3.31984 | bc7806e1c1ce9ebfd00ad834c1f7a647 |
.rsrc | 126976 | 14627 | 14848 | 3.04271 | 5d81a7baa5b61cc0275bd832f59c26f5 |
Dropped from:
Downloaded by:
Similar by SSDeep:
Similar by Lavasoft Polymorphic Checker:
Network Activity
URLs
IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)
Traffic
Map
The Backdoor connects to the servers at the folowing location(s):
Strings from Dumps
Svchost.exe_1676:
`.rsrc
`.rsrc
%Program Files% (x86)\Microsoft Visual Studio\VB98\VB6.OLB
%Program Files% (x86)\Microsoft Visual Studio\VB98\VB6.OLB
kernel32.dll
kernel32.dll
MSVBVM60.dll
MSVBVM60.dll
ntdll.dll
ntdll.dll
user32.dll
user32.dll
urlmon
urlmon
URLDownloadToFileA
URLDownloadToFileA
PSAPI.DLL
PSAPI.DLL
advapi32.dll
advapi32.dll
shell32.dll
shell32.dll
ShellExecuteA
ShellExecuteA
RegOpenKeyExA
RegOpenKeyExA
RegCloseKey
RegCloseKey
FindExecutableA
FindExecutableA
VBA6.DLL
VBA6.DLL
MasterKey
MasterKey
.text
.text
`.reloc
`.reloc
B.rsrc
B.rsrc
@?"333?(
@?"333?(
y.fefeffeef(
y.fefeffeef(
lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet
lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet
fSystem.Drawing.Icon, System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3aBj
fSystem.Drawing.Icon, System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3aBj
QSystem.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a
QSystem.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a
System.Drawing.Icon
System.Drawing.Icon
System.Drawing.Size
System.Drawing.Size
Windows.v4.0.HiDef
Windows.v4.0.HiDef
-Gt1}
-Gt1}
$`J.qp
$`J.qp
7-Nxf}
7-Nxf}
%DOQ)s
%DOQ)s
.rkr&
.rkr&
%.qw ]
%.qw ]
.tT*)
.tT*)
=SV%D
=SV%D
bj.Fy2
bj.Fy2
9.ZOZ
9.ZOZ
]t.ObG$N
]t.ObG$N
|3n@%8X
|3n@%8X
\v.tJ
\v.tJ
%sxfSz
%sxfSz
%{.UQ
%{.UQ
P)#n%s
P)#n%s
.uxA:
.uxA:
j|'y.zuT
j|'y.zuT
.%^%fx
.%^%fx
t/%x|
t/%x|
J.lS"
J.lS"
.cDh9t
.cDh9t
_V7.Aw
_V7.Aw
-IJ%S$
-IJ%S$
;u.Am
;u.Am
weB;SHZ
weB;SHZ
Z%.JH
Z%.JH
.WOr.$}
.WOr.$}
2l%f!7
2l%f!7
U~.mD
U~.mD
.SPzre#tI
.SPzre#tI
%D,yZ
%D,yZ
v4.0.30319
v4.0.30319
1%FND
1%FND
1%FNl
1%FNl
1%FN,
1%FN,
1%FN
1%FN
1%FN$
1%FN$
1%FN\
1%FN\
1%FNL
1%FNL
1%FNd
1%FNd
1%FN|
1%FN|
M.MMMwM
M.MMMwM
Blockscape.exe
Blockscape.exe
System.Windows.Forms
System.Windows.Forms
Microsoft.Xna.Framework.Game
Microsoft.Xna.Framework.Game
Microsoft.Xna.Framework
Microsoft.Xna.Framework
Microsoft.Xna.Framework.Graphics
Microsoft.Xna.Framework.Graphics
System.Drawing
System.Drawing
System.Core
System.Core
System.Xml
System.Xml
WindowsBase
WindowsBase
System.Management
System.Management
.resources
.resources
Microsoft.Xna.Framework.RuntimeProfile
Microsoft.Xna.Framework.RuntimeProfile
Microsoft.Xna.Framework.Audio
Microsoft.Xna.Framework.Audio
Microsoft.Xna.Framework.Content
Microsoft.Xna.Framework.Content
EffectPass
EffectPass
EffectPassCollection
EffectPassCollection
VertexElement
VertexElement
VertexElementFormat
VertexElementFormat
VertexElementUsage
VertexElementUsage
Viewport
Viewport
Microsoft.Xna.Framework.Input
Microsoft.Xna.Framework.Input
Keyboard
Keyboard
KeyboardState
KeyboardState
Keys
Keys
Microsoft.Xna.Framework.Media
Microsoft.Xna.Framework.Media
System.Collections.Generic
System.Collections.Generic
KeyCollection
KeyCollection
KeyValuePair`2
KeyValuePair`2
System.Collections
System.Collections
System.Collections.ObjectModel
System.Collections.ObjectModel
System.ComponentModel
System.ComponentModel
System.Diagnostics
System.Diagnostics
System.Globalization
System.Globalization
InvalidOperationException
InvalidOperationException
System.IO
System.IO
System.Linq
System.Linq
System.Net
System.Net
System.Net.Sockets
System.Net.Sockets
TcpClient
TcpClient
TcpListener
TcpListener
WebRequest
WebRequest
WebResponse
WebResponse
NotSupportedException
NotSupportedException
System.Reflection
System.Reflection
System.Resources
System.Resources
System.Runtime.CompilerServices
System.Runtime.CompilerServices
System.Runtime.InteropServices
System.Runtime.InteropServices
System.Runtime.Versioning
System.Runtime.Versioning
System.Security.Cryptography
System.Security.Cryptography
System.Text
System.Text
System.Threading
System.Threading
KeyEventArgs
KeyEventArgs
KeyEventHandler
KeyEventHandler
KeyPressEventArgs
KeyPressEventArgs
KeyPressEventHandler
KeyPressEventHandler
System.Windows
System.Windows
System.Windows.Media.Imaging
System.Windows.Media.Imaging
System.Windows.Media
System.Windows.Media
.ctor
.ctor
.cctor
.cctor
SetWindowsHookExA
SetWindowsHookExA
UnhookWindowsHookEx
UnhookWindowsHookEx
ContainsKey
ContainsKey
get_SupportedDisplayModes
get_SupportedDisplayModes
GetExecutingAssembly
GetExecutingAssembly
set_PasswordChar
set_PasswordChar
get_Keys
get_Keys
AcceptTcpClient
AcceptTcpClient
IsKeyDown
IsKeyDown
GetPressedKeys
GetPressedKeys
get_Passes
get_Passes
get_Viewport
get_Viewport
set_Viewport
set_Viewport
get_Msg
get_Msg
get_KeyChar
get_KeyChar
GetPublicKeyToken
GetPublicKeyToken
get_Key
get_Key
).NETFramework,Version=v4.0,Profile=Client
).NETFramework,Version=v4.0,Profile=Client
.NET Framework 4 Client Profile
.NET Framework 4 Client Profile
$1cb36746-1c92-461e-920f-a056aa95df47
$1cb36746-1c92-461e-920f-a056aa95df47
_CorExeMain
_CorExeMain
mscoree.dll
mscoree.dll
`.data
`.data
.rsrc
.rsrc
MSVBVM60.DLL
MSVBVM60.DLL
F:\Softwares\VB98\VB6.OLB
F:\Softwares\VB98\VB6.OLB
0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0||1|0|0||PA1|1|262|.exe0|0|1|1|0|0|0|1|0|0|0|0|0|0|0|PAhXXp://VVV.host.com/path/yourfile.exe|1|262PMicrosoft Error|Microsoft Error|32|262PAuZOkAB.exe|jWqBJR.txt|klbMgk.exe|voyVXU|
0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0||1|0|0||PA1|1|262|.exe0|0|1|1|0|0|0|1|0|0|0|0|0|0|0|PAhXXp://VVV.host.com/path/yourfile.exe|1|262PMicrosoft Error|Microsoft Error|32|262PAuZOkAB.exe|jWqBJR.txt|klbMgk.exe|voyVXU|
KERNEL32.DLL
KERNEL32.DLL
Avastui.exe
Avastui.exe
NIS.exe
NIS.exe
\Norton Internet Security\Engine\21.1.0.18\NIS.exe
\Norton Internet Security\Engine\21.1.0.18\NIS.exe
egui.exe
egui.exe
\ESET\ESET NOD32 Antivirus\ecls.exe
\ESET\ESET NOD32 Antivirus\ecls.exe
avpui.exe
avpui.exe
bdagent.exe
bdagent.exe
\Bitdefender\Bitdefender 2015\certutil.exe
\Bitdefender\Bitdefender 2015\certutil.exe
\AVAST Software\Avast\VisthAux.exe
\AVAST Software\Avast\VisthAux.exe
\svchost.exe
\svchost.exe
\SysWOW64\svchost.exe
\SysWOW64\svchost.exe
\System32\svchost.exe
\System32\svchost.exe
cmd /c taskkill /F /pid
cmd /c taskkill /F /pid
\net.exe
\net.exe
\file.txt
\file.txt
SELECT * FROM Win32_OperatingSystem
SELECT * FROM Win32_OperatingSystem
\skype.exe
\skype.exe
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\
wscript.shell
wscript.shell
\Project1.exe
\Project1.exe
\1.txt
\1.txt
\2.txt
\2.txt
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\
schtasks /create /sc minute /mo 1 /tn WindowsUpdate
schtasks /create /sc minute /mo 1 /tn WindowsUpdate
schtasks /delete /tn WindowsUpdate
schtasks /delete /tn WindowsUpdate
cmd /c icacls
cmd /c icacls
/deny %username%:F
/deny %username%:F
\test.exe
\test.exe
\SkypeUpdates\skype.exe
\SkypeUpdates\skype.exe
media.exe
media.exe
WScript.Shell
WScript.Shell
hXXps://twitter.com
hXXps://twitter.com
SendKeys
SendKeys
hXXp://VVV.facebook.com
hXXp://VVV.facebook.com
SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
cmd.exe
cmd.exe
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe
&& ping 127.0.0.1 && exit
&& ping 127.0.0.1 && exit
consent.exe
consent.exe
athenahttpbotnet
athenahttpbotnet
VVV.update.microsoft.com
VVV.update.microsoft.com
POST /%s HTTP/1
POST /%s HTTP/1
compatible; MSIE 7.0; Windows NT 5.1; SV1)
compatible; MSIE 7.0; Windows NT 5.1; SV1)
MapVirtualKeyA
MapVirtualKeyA
SOFTWARE\Microsoft\Active Setup\Installed Components\%s
SOFTWARE\Microsoft\Active Setup\Installed Components\%s
RegCreateKeyExA
RegCreateKeyExA
\system\systwin32.exe
\system\systwin32.exe
DownloadAndExecute
DownloadAndExecute
javaw.exe
javaw.exe
GetKeyboardType
GetKeyboardType
InternetOpenUrlA
InternetOpenUrlA
HTTP/1.1
HTTP/1.1
PR_OpenTCPSocket
PR_OpenTCPSocket
GdiplusShutdown
GdiplusShutdown
ole32.dll
ole32.dll
UnitKeylogger
UnitKeylogger
GetKeyboardLayoutNameA
GetKeyboardLayoutNameA
C:\Windows\tracing
C:\Windows\tracing
C:\ProgramData\Microsoft\Network\Connections\Pbk
C:\ProgramData\Microsoft\Network\Connections\Pbk
*facebook.*/login.php*
*facebook.*/login.php*
*login.live.*/*post.srf*
*login.live.*/*post.srf*
*paypal.*/webscr?cmd=_login-submit*
*paypal.*/webscr?cmd=_login-submit*
application/x-www-form-urlencoded
application/x-www-form-urlencoded
Mozilla/5.0 (Windows NT 6.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/32.0.1700.76 Safari/537.36
Mozilla/5.0 (Windows NT 6.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/32.0.1700.76 Safari/537.36
%WinDir%\SysWOW64\svchost.exe
%WinDir%\SysWOW64\svchost.exe
Content-Length: %d
Content-Length: %d
Keylogger
Keylogger
CryptDllConvertPublicKeyInfo
CryptDllConvertPublicKeyInfo
CryptDllEncodePublicKeyAndParameters
CryptDllEncodePublicKeyAndParameters
REG add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoRun
REG add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoRun
KeyHook
KeyHook
KeyboardHookDelegate
KeyboardHookDelegate
[BypassScreening]
[BypassScreening]
HuntHTTPDownload
HuntHTTPDownload
Webcam
Webcam
Mozilla Firefox
Mozilla Firefox
KeyTLIST=b03
KeyTLIST=b03
You need a registered nick to join that channel
You need a registered nick to join that channel
flood.anope
flood.anope
InternetOpenUrlW
InternetOpenUrlW
hXXp://VVV.gofuckbiz.com/
hXXp://VVV.gofuckbiz.com/
hXXp://kremlin.ru/
hXXp://kremlin.ru/
Opera/7.60 (Windows NT 5.2; U) [en] (IBM EVV/3.0/EAK01AG9/LE)
Opera/7.60 (Windows NT 5.2; U) [en] (IBM EVV/3.0/EAK01AG9/LE)
cmd /c taskkill /F /PID
cmd /c taskkill /F /PID
Scripting.FileSystemObject
Scripting.FileSystemObject
autorun.inf
autorun.inf
Icon=%SystemRoot%\system32\SHELL32.dll,7
Icon=%SystemRoot%\system32\SHELL32.dll,7
shell32.dll, 2
shell32.dll, 2
shell32.dll, 3
shell32.dll, 3
.fldr
.fldr
shell32.dll, 0
shell32.dll, 0
\explorer.exe
\explorer.exe
Kernel32.dll
Kernel32.dll
$this.Icon
$this.Icon
0.9.5304.39905
0.9.5304.39905
Project1.exe
Project1.exe
Project1xp.exe
Project1xp.exe
Svchost.exe_1676_rwx_00400000_00183000:
`.rsrc
`.rsrc
%Program Files% (x86)\Microsoft Visual Studio\VB98\VB6.OLB
%Program Files% (x86)\Microsoft Visual Studio\VB98\VB6.OLB
kernel32.dll
kernel32.dll
MSVBVM60.dll
MSVBVM60.dll
ntdll.dll
ntdll.dll
user32.dll
user32.dll
urlmon
urlmon
URLDownloadToFileA
URLDownloadToFileA
PSAPI.DLL
PSAPI.DLL
advapi32.dll
advapi32.dll
shell32.dll
shell32.dll
ShellExecuteA
ShellExecuteA
RegOpenKeyExA
RegOpenKeyExA
RegCloseKey
RegCloseKey
FindExecutableA
FindExecutableA
VBA6.DLL
VBA6.DLL
MasterKey
MasterKey
.text
.text
`.reloc
`.reloc
B.rsrc
B.rsrc
@?"333?(
@?"333?(
y.fefeffeef(
y.fefeffeef(
lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet
lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet
fSystem.Drawing.Icon, System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3aBj
fSystem.Drawing.Icon, System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3aBj
QSystem.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a
QSystem.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a
System.Drawing.Icon
System.Drawing.Icon
System.Drawing.Size
System.Drawing.Size
Windows.v4.0.HiDef
Windows.v4.0.HiDef
-Gt1}
-Gt1}
$`J.qp
$`J.qp
7-Nxf}
7-Nxf}
%DOQ)s
%DOQ)s
.rkr&
.rkr&
%.qw ]
%.qw ]
.tT*)
.tT*)
=SV%D
=SV%D
bj.Fy2
bj.Fy2
9.ZOZ
9.ZOZ
]t.ObG$N
]t.ObG$N
|3n@%8X
|3n@%8X
\v.tJ
\v.tJ
%sxfSz
%sxfSz
%{.UQ
%{.UQ
P)#n%s
P)#n%s
.uxA:
.uxA:
j|'y.zuT
j|'y.zuT
.%^%fx
.%^%fx
t/%x|
t/%x|
J.lS"
J.lS"
.cDh9t
.cDh9t
_V7.Aw
_V7.Aw
-IJ%S$
-IJ%S$
;u.Am
;u.Am
weB;SHZ
weB;SHZ
Z%.JH
Z%.JH
.WOr.$}
.WOr.$}
2l%f!7
2l%f!7
U~.mD
U~.mD
.SPzre#tI
.SPzre#tI
%D,yZ
%D,yZ
v4.0.30319
v4.0.30319
1%FND
1%FND
1%FNl
1%FNl
1%FN,
1%FN,
1%FN
1%FN
1%FN$
1%FN$
1%FN\
1%FN\
1%FNL
1%FNL
1%FNd
1%FNd
1%FN|
1%FN|
M.MMMwM
M.MMMwM
Blockscape.exe
Blockscape.exe
System.Windows.Forms
System.Windows.Forms
Microsoft.Xna.Framework.Game
Microsoft.Xna.Framework.Game
Microsoft.Xna.Framework
Microsoft.Xna.Framework
Microsoft.Xna.Framework.Graphics
Microsoft.Xna.Framework.Graphics
System.Drawing
System.Drawing
System.Core
System.Core
System.Xml
System.Xml
WindowsBase
WindowsBase
System.Management
System.Management
.resources
.resources
Microsoft.Xna.Framework.RuntimeProfile
Microsoft.Xna.Framework.RuntimeProfile
Microsoft.Xna.Framework.Audio
Microsoft.Xna.Framework.Audio
Microsoft.Xna.Framework.Content
Microsoft.Xna.Framework.Content
EffectPass
EffectPass
EffectPassCollection
EffectPassCollection
VertexElement
VertexElement
VertexElementFormat
VertexElementFormat
VertexElementUsage
VertexElementUsage
Viewport
Viewport
Microsoft.Xna.Framework.Input
Microsoft.Xna.Framework.Input
Keyboard
Keyboard
KeyboardState
KeyboardState
Keys
Keys
Microsoft.Xna.Framework.Media
Microsoft.Xna.Framework.Media
System.Collections.Generic
System.Collections.Generic
KeyCollection
KeyCollection
KeyValuePair`2
KeyValuePair`2
System.Collections
System.Collections
System.Collections.ObjectModel
System.Collections.ObjectModel
System.ComponentModel
System.ComponentModel
System.Diagnostics
System.Diagnostics
System.Globalization
System.Globalization
InvalidOperationException
InvalidOperationException
System.IO
System.IO
System.Linq
System.Linq
System.Net
System.Net
System.Net.Sockets
System.Net.Sockets
TcpClient
TcpClient
TcpListener
TcpListener
WebRequest
WebRequest
WebResponse
WebResponse
NotSupportedException
NotSupportedException
System.Reflection
System.Reflection
System.Resources
System.Resources
System.Runtime.CompilerServices
System.Runtime.CompilerServices
System.Runtime.InteropServices
System.Runtime.InteropServices
System.Runtime.Versioning
System.Runtime.Versioning
System.Security.Cryptography
System.Security.Cryptography
System.Text
System.Text
System.Threading
System.Threading
KeyEventArgs
KeyEventArgs
KeyEventHandler
KeyEventHandler
KeyPressEventArgs
KeyPressEventArgs
KeyPressEventHandler
KeyPressEventHandler
System.Windows
System.Windows
System.Windows.Media.Imaging
System.Windows.Media.Imaging
System.Windows.Media
System.Windows.Media
.ctor
.ctor
.cctor
.cctor
SetWindowsHookExA
SetWindowsHookExA
UnhookWindowsHookEx
UnhookWindowsHookEx
ContainsKey
ContainsKey
get_SupportedDisplayModes
get_SupportedDisplayModes
GetExecutingAssembly
GetExecutingAssembly
set_PasswordChar
set_PasswordChar
get_Keys
get_Keys
AcceptTcpClient
AcceptTcpClient
IsKeyDown
IsKeyDown
GetPressedKeys
GetPressedKeys
get_Passes
get_Passes
get_Viewport
get_Viewport
set_Viewport
set_Viewport
get_Msg
get_Msg
get_KeyChar
get_KeyChar
GetPublicKeyToken
GetPublicKeyToken
get_Key
get_Key
).NETFramework,Version=v4.0,Profile=Client
).NETFramework,Version=v4.0,Profile=Client
.NET Framework 4 Client Profile
.NET Framework 4 Client Profile
$1cb36746-1c92-461e-920f-a056aa95df47
$1cb36746-1c92-461e-920f-a056aa95df47
_CorExeMain
_CorExeMain
mscoree.dll
mscoree.dll
`.data
`.data
.rsrc
.rsrc
MSVBVM60.DLL
MSVBVM60.DLL
F:\Softwares\VB98\VB6.OLB
F:\Softwares\VB98\VB6.OLB
0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0||1|0|0||PA1|1|262|.exe0|0|1|1|0|0|0|1|0|0|0|0|0|0|0|PAhXXp://VVV.host.com/path/yourfile.exe|1|262PMicrosoft Error|Microsoft Error|32|262PAuZOkAB.exe|jWqBJR.txt|klbMgk.exe|voyVXU|
0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0||1|0|0||PA1|1|262|.exe0|0|1|1|0|0|0|1|0|0|0|0|0|0|0|PAhXXp://VVV.host.com/path/yourfile.exe|1|262PMicrosoft Error|Microsoft Error|32|262PAuZOkAB.exe|jWqBJR.txt|klbMgk.exe|voyVXU|
KERNEL32.DLL
KERNEL32.DLL
Avastui.exe
Avastui.exe
NIS.exe
NIS.exe
\Norton Internet Security\Engine\21.1.0.18\NIS.exe
\Norton Internet Security\Engine\21.1.0.18\NIS.exe
egui.exe
egui.exe
\ESET\ESET NOD32 Antivirus\ecls.exe
\ESET\ESET NOD32 Antivirus\ecls.exe
avpui.exe
avpui.exe
bdagent.exe
bdagent.exe
\Bitdefender\Bitdefender 2015\certutil.exe
\Bitdefender\Bitdefender 2015\certutil.exe
\AVAST Software\Avast\VisthAux.exe
\AVAST Software\Avast\VisthAux.exe
\svchost.exe
\svchost.exe
\SysWOW64\svchost.exe
\SysWOW64\svchost.exe
\System32\svchost.exe
\System32\svchost.exe
cmd /c taskkill /F /pid
cmd /c taskkill /F /pid
\net.exe
\net.exe
\file.txt
\file.txt
SELECT * FROM Win32_OperatingSystem
SELECT * FROM Win32_OperatingSystem
\skype.exe
\skype.exe
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\
wscript.shell
wscript.shell
\Project1.exe
\Project1.exe
\1.txt
\1.txt
\2.txt
\2.txt
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\
schtasks /create /sc minute /mo 1 /tn WindowsUpdate
schtasks /create /sc minute /mo 1 /tn WindowsUpdate
schtasks /delete /tn WindowsUpdate
schtasks /delete /tn WindowsUpdate
cmd /c icacls
cmd /c icacls
/deny %username%:F
/deny %username%:F
\test.exe
\test.exe
\SkypeUpdates\skype.exe
\SkypeUpdates\skype.exe
media.exe
media.exe
WScript.Shell
WScript.Shell
hXXps://twitter.com
hXXps://twitter.com
SendKeys
SendKeys
hXXp://VVV.facebook.com
hXXp://VVV.facebook.com
SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
cmd.exe
cmd.exe
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe
&& ping 127.0.0.1 && exit
&& ping 127.0.0.1 && exit
consent.exe
consent.exe
athenahttpbotnet
athenahttpbotnet
VVV.update.microsoft.com
VVV.update.microsoft.com
POST /%s HTTP/1
POST /%s HTTP/1
compatible; MSIE 7.0; Windows NT 5.1; SV1)
compatible; MSIE 7.0; Windows NT 5.1; SV1)
MapVirtualKeyA
MapVirtualKeyA
SOFTWARE\Microsoft\Active Setup\Installed Components\%s
SOFTWARE\Microsoft\Active Setup\Installed Components\%s
RegCreateKeyExA
RegCreateKeyExA
\system\systwin32.exe
\system\systwin32.exe
DownloadAndExecute
DownloadAndExecute
javaw.exe
javaw.exe
GetKeyboardType
GetKeyboardType
InternetOpenUrlA
InternetOpenUrlA
HTTP/1.1
HTTP/1.1
PR_OpenTCPSocket
PR_OpenTCPSocket
GdiplusShutdown
GdiplusShutdown
ole32.dll
ole32.dll
UnitKeylogger
UnitKeylogger
GetKeyboardLayoutNameA
GetKeyboardLayoutNameA
C:\Windows\tracing
C:\Windows\tracing
C:\ProgramData\Microsoft\Network\Connections\Pbk
C:\ProgramData\Microsoft\Network\Connections\Pbk
*facebook.*/login.php*
*facebook.*/login.php*
*login.live.*/*post.srf*
*login.live.*/*post.srf*
*paypal.*/webscr?cmd=_login-submit*
*paypal.*/webscr?cmd=_login-submit*
application/x-www-form-urlencoded
application/x-www-form-urlencoded
Mozilla/5.0 (Windows NT 6.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/32.0.1700.76 Safari/537.36
Mozilla/5.0 (Windows NT 6.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/32.0.1700.76 Safari/537.36
%WinDir%\SysWOW64\svchost.exe
%WinDir%\SysWOW64\svchost.exe
Content-Length: %d
Content-Length: %d
Keylogger
Keylogger
CryptDllConvertPublicKeyInfo
CryptDllConvertPublicKeyInfo
CryptDllEncodePublicKeyAndParameters
CryptDllEncodePublicKeyAndParameters
REG add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoRun
REG add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoRun
KeyHook
KeyHook
KeyboardHookDelegate
KeyboardHookDelegate
[BypassScreening]
[BypassScreening]
HuntHTTPDownload
HuntHTTPDownload
Webcam
Webcam
Mozilla Firefox
Mozilla Firefox
KeyTLIST=b03
KeyTLIST=b03
You need a registered nick to join that channel
You need a registered nick to join that channel
flood.anope
flood.anope
InternetOpenUrlW
InternetOpenUrlW
hXXp://VVV.gofuckbiz.com/
hXXp://VVV.gofuckbiz.com/
hXXp://kremlin.ru/
hXXp://kremlin.ru/
Opera/7.60 (Windows NT 5.2; U) [en] (IBM EVV/3.0/EAK01AG9/LE)
Opera/7.60 (Windows NT 5.2; U) [en] (IBM EVV/3.0/EAK01AG9/LE)
cmd /c taskkill /F /PID
cmd /c taskkill /F /PID
Scripting.FileSystemObject
Scripting.FileSystemObject
autorun.inf
autorun.inf
Icon=%SystemRoot%\system32\SHELL32.dll,7
Icon=%SystemRoot%\system32\SHELL32.dll,7
shell32.dll, 2
shell32.dll, 2
shell32.dll, 3
shell32.dll, 3
.fldr
.fldr
shell32.dll, 0
shell32.dll, 0
\explorer.exe
\explorer.exe
Kernel32.dll
Kernel32.dll
$this.Icon
$this.Icon
0.9.5304.39905
0.9.5304.39905
Project1.exe
Project1.exe
Project1xp.exe
Project1xp.exe
rundll32.exe_1484:
.text
.text
`.data
`.data
.rsrc
.rsrc
msvcrt.dll
msvcrt.dll
KERNEL32.dll
KERNEL32.dll
NTDLL.DLL
NTDLL.DLL
GDI32.dll
GDI32.dll
USER32.dll
USER32.dll
IMAGEHLP.dll
IMAGEHLP.dll
rundll32.pdb
rundll32.pdb
.....eZXnnnnnnnnnnnn3
.....eZXnnnnnnnnnnnn3
....eDXnnnnnnnnnnnn3
....eDXnnnnnnnnnnnn3
...eDXnnnnnnnnnnnn,
...eDXnnnnnnnnnnnn,
.eDXnnnnnnnnnnnn,
.eDXnnnnnnnnnnnn,
%Xnnnnnnnnnnnnnnn1
%Xnnnnnnnnnnnnnnn1
O3$dS7"%U9
O3$dS7"%U9
.manifest
.manifest
5.1.2600.5512 (xpsp.080413-2105)
5.1.2600.5512 (xpsp.080413-2105)
RUNDLL.EXE
RUNDLL.EXE
Windows
Windows
Operating System
Operating System
5.1.2600.5512
5.1.2600.5512
YThere is not enough memory to run the file %s.
YThere is not enough memory to run the file %s.
Please close other windows and try again.
Please close other windows and try again.
9The file %s or one of its components could not be opened.
9The file %s or one of its components could not be opened.
0The file %s or one of its components cannot run.
0The file %s or one of its components cannot run.
MThe file %s or one of its components requires a different version of Windows.
MThe file %s or one of its components requires a different version of Windows.
UThe file %s or one of its components cannot run in standard or enhanced mode Windows.3Another instance of the file %s is already running./An exception occurred while trying to run "%s"
UThe file %s or one of its components cannot run in standard or enhanced mode Windows.3Another instance of the file %s is already running./An exception occurred while trying to run "%s"
Error in %s
Error in %s
Missing entry:%s
Missing entry:%s
Error loading %s
Error loading %s
Svchost.exe_380:
`.rsrc
`.rsrc
%Program Files% (x86)\Microsoft Visual Studio\VB98\VB6.OLB
%Program Files% (x86)\Microsoft Visual Studio\VB98\VB6.OLB
kernel32.dll
kernel32.dll
MSVBVM60.dll
MSVBVM60.dll
ntdll.dll
ntdll.dll
user32.dll
user32.dll
urlmon
urlmon
URLDownloadToFileA
URLDownloadToFileA
PSAPI.DLL
PSAPI.DLL
advapi32.dll
advapi32.dll
shell32.dll
shell32.dll
ShellExecuteA
ShellExecuteA
RegOpenKeyExA
RegOpenKeyExA
RegCloseKey
RegCloseKey
FindExecutableA
FindExecutableA
VBA6.DLL
VBA6.DLL
MasterKey
MasterKey
.text
.text
`.reloc
`.reloc
B.rsrc
B.rsrc
@?"333?(
@?"333?(
y.fefeffeef(
y.fefeffeef(
lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet
lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet
fSystem.Drawing.Icon, System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3aBj
fSystem.Drawing.Icon, System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3aBj
QSystem.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a
QSystem.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a
System.Drawing.Icon
System.Drawing.Icon
System.Drawing.Size
System.Drawing.Size
Windows.v4.0.HiDef
Windows.v4.0.HiDef
-Gt1}
-Gt1}
$`J.qp
$`J.qp
7-Nxf}
7-Nxf}
%DOQ)s
%DOQ)s
.rkr&
.rkr&
%.qw ]
%.qw ]
.tT*)
.tT*)
=SV%D
=SV%D
bj.Fy2
bj.Fy2
9.ZOZ
9.ZOZ
]t.ObG$N
]t.ObG$N
|3n@%8X
|3n@%8X
\v.tJ
\v.tJ
%sxfSz
%sxfSz
%{.UQ
%{.UQ
P)#n%s
P)#n%s
.uxA:
.uxA:
j|'y.zuT
j|'y.zuT
.%^%fx
.%^%fx
t/%x|
t/%x|
J.lS"
J.lS"
.cDh9t
.cDh9t
_V7.Aw
_V7.Aw
-IJ%S$
-IJ%S$
;u.Am
;u.Am
weB;SHZ
weB;SHZ
Z%.JH
Z%.JH
.WOr.$}
.WOr.$}
2l%f!7
2l%f!7
U~.mD
U~.mD
.SPzre#tI
.SPzre#tI
%D,yZ
%D,yZ
v4.0.30319
v4.0.30319
1%FND
1%FND
1%FNl
1%FNl
1%FN,
1%FN,
1%FN
1%FN
1%FN$
1%FN$
1%FN\
1%FN\
1%FNL
1%FNL
1%FNd
1%FNd
1%FN|
1%FN|
M.MMMwM
M.MMMwM
Blockscape.exe
Blockscape.exe
System.Windows.Forms
System.Windows.Forms
Microsoft.Xna.Framework.Game
Microsoft.Xna.Framework.Game
Microsoft.Xna.Framework
Microsoft.Xna.Framework
Microsoft.Xna.Framework.Graphics
Microsoft.Xna.Framework.Graphics
System.Drawing
System.Drawing
System.Core
System.Core
System.Xml
System.Xml
WindowsBase
WindowsBase
System.Management
System.Management
.resources
.resources
Microsoft.Xna.Framework.RuntimeProfile
Microsoft.Xna.Framework.RuntimeProfile
Microsoft.Xna.Framework.Audio
Microsoft.Xna.Framework.Audio
Microsoft.Xna.Framework.Content
Microsoft.Xna.Framework.Content
EffectPass
EffectPass
EffectPassCollection
EffectPassCollection
VertexElement
VertexElement
VertexElementFormat
VertexElementFormat
VertexElementUsage
VertexElementUsage
Viewport
Viewport
Microsoft.Xna.Framework.Input
Microsoft.Xna.Framework.Input
Keyboard
Keyboard
KeyboardState
KeyboardState
Keys
Keys
Microsoft.Xna.Framework.Media
Microsoft.Xna.Framework.Media
System.Collections.Generic
System.Collections.Generic
KeyCollection
KeyCollection
KeyValuePair`2
KeyValuePair`2
System.Collections
System.Collections
System.Collections.ObjectModel
System.Collections.ObjectModel
System.ComponentModel
System.ComponentModel
System.Diagnostics
System.Diagnostics
System.Globalization
System.Globalization
InvalidOperationException
InvalidOperationException
System.IO
System.IO
System.Linq
System.Linq
System.Net
System.Net
System.Net.Sockets
System.Net.Sockets
TcpClient
TcpClient
TcpListener
TcpListener
WebRequest
WebRequest
WebResponse
WebResponse
NotSupportedException
NotSupportedException
System.Reflection
System.Reflection
System.Resources
System.Resources
System.Runtime.CompilerServices
System.Runtime.CompilerServices
System.Runtime.InteropServices
System.Runtime.InteropServices
System.Runtime.Versioning
System.Runtime.Versioning
System.Security.Cryptography
System.Security.Cryptography
System.Text
System.Text
System.Threading
System.Threading
KeyEventArgs
KeyEventArgs
KeyEventHandler
KeyEventHandler
KeyPressEventArgs
KeyPressEventArgs
KeyPressEventHandler
KeyPressEventHandler
System.Windows
System.Windows
System.Windows.Media.Imaging
System.Windows.Media.Imaging
System.Windows.Media
System.Windows.Media
.ctor
.ctor
.cctor
.cctor
SetWindowsHookExA
SetWindowsHookExA
UnhookWindowsHookEx
UnhookWindowsHookEx
ContainsKey
ContainsKey
get_SupportedDisplayModes
get_SupportedDisplayModes
GetExecutingAssembly
GetExecutingAssembly
set_PasswordChar
set_PasswordChar
get_Keys
get_Keys
AcceptTcpClient
AcceptTcpClient
IsKeyDown
IsKeyDown
GetPressedKeys
GetPressedKeys
get_Passes
get_Passes
get_Viewport
get_Viewport
set_Viewport
set_Viewport
get_Msg
get_Msg
get_KeyChar
get_KeyChar
GetPublicKeyToken
GetPublicKeyToken
get_Key
get_Key
).NETFramework,Version=v4.0,Profile=Client
).NETFramework,Version=v4.0,Profile=Client
.NET Framework 4 Client Profile
.NET Framework 4 Client Profile
$1cb36746-1c92-461e-920f-a056aa95df47
$1cb36746-1c92-461e-920f-a056aa95df47
_CorExeMain
_CorExeMain
mscoree.dll
mscoree.dll
`.data
`.data
.rsrc
.rsrc
MSVBVM60.DLL
MSVBVM60.DLL
F:\Softwares\VB98\VB6.OLB
F:\Softwares\VB98\VB6.OLB
0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0||1|0|0||PA1|1|262|.exe0|0|1|1|0|0|0|1|0|0|0|0|0|0|0|PAhXXp://VVV.host.com/path/yourfile.exe|1|262PMicrosoft Error|Microsoft Error|32|262PAuZOkAB.exe|jWqBJR.txt|klbMgk.exe|voyVXU|
0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0||1|0|0||PA1|1|262|.exe0|0|1|1|0|0|0|1|0|0|0|0|0|0|0|PAhXXp://VVV.host.com/path/yourfile.exe|1|262PMicrosoft Error|Microsoft Error|32|262PAuZOkAB.exe|jWqBJR.txt|klbMgk.exe|voyVXU|
KERNEL32.DLL
KERNEL32.DLL
Avastui.exe
Avastui.exe
NIS.exe
NIS.exe
\Norton Internet Security\Engine\21.1.0.18\NIS.exe
\Norton Internet Security\Engine\21.1.0.18\NIS.exe
egui.exe
egui.exe
\ESET\ESET NOD32 Antivirus\ecls.exe
\ESET\ESET NOD32 Antivirus\ecls.exe
avpui.exe
avpui.exe
bdagent.exe
bdagent.exe
\Bitdefender\Bitdefender 2015\certutil.exe
\Bitdefender\Bitdefender 2015\certutil.exe
\AVAST Software\Avast\VisthAux.exe
\AVAST Software\Avast\VisthAux.exe
\svchost.exe
\svchost.exe
\SysWOW64\svchost.exe
\SysWOW64\svchost.exe
\System32\svchost.exe
\System32\svchost.exe
cmd /c taskkill /F /pid
cmd /c taskkill /F /pid
\net.exe
\net.exe
\file.txt
\file.txt
SELECT * FROM Win32_OperatingSystem
SELECT * FROM Win32_OperatingSystem
\skype.exe
\skype.exe
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\
wscript.shell
wscript.shell
\Project1.exe
\Project1.exe
\1.txt
\1.txt
\2.txt
\2.txt
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\
schtasks /create /sc minute /mo 1 /tn WindowsUpdate
schtasks /create /sc minute /mo 1 /tn WindowsUpdate
schtasks /delete /tn WindowsUpdate
schtasks /delete /tn WindowsUpdate
cmd /c icacls
cmd /c icacls
/deny %username%:F
/deny %username%:F
\test.exe
\test.exe
\SkypeUpdates\skype.exe
\SkypeUpdates\skype.exe
media.exe
media.exe
WScript.Shell
WScript.Shell
hXXps://twitter.com
hXXps://twitter.com
SendKeys
SendKeys
hXXp://VVV.facebook.com
hXXp://VVV.facebook.com
SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
cmd.exe
cmd.exe
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe
&& ping 127.0.0.1 && exit
&& ping 127.0.0.1 && exit
consent.exe
consent.exe
athenahttpbotnet
athenahttpbotnet
VVV.update.microsoft.com
VVV.update.microsoft.com
POST /%s HTTP/1
POST /%s HTTP/1
compatible; MSIE 7.0; Windows NT 5.1; SV1)
compatible; MSIE 7.0; Windows NT 5.1; SV1)
MapVirtualKeyA
MapVirtualKeyA
SOFTWARE\Microsoft\Active Setup\Installed Components\%s
SOFTWARE\Microsoft\Active Setup\Installed Components\%s
RegCreateKeyExA
RegCreateKeyExA
\system\systwin32.exe
\system\systwin32.exe
DownloadAndExecute
DownloadAndExecute
javaw.exe
javaw.exe
GetKeyboardType
GetKeyboardType
InternetOpenUrlA
InternetOpenUrlA
HTTP/1.1
HTTP/1.1
PR_OpenTCPSocket
PR_OpenTCPSocket
GdiplusShutdown
GdiplusShutdown
ole32.dll
ole32.dll
UnitKeylogger
UnitKeylogger
GetKeyboardLayoutNameA
GetKeyboardLayoutNameA
C:\Windows\tracing
C:\Windows\tracing
C:\ProgramData\Microsoft\Network\Connections\Pbk
C:\ProgramData\Microsoft\Network\Connections\Pbk
*facebook.*/login.php*
*facebook.*/login.php*
*login.live.*/*post.srf*
*login.live.*/*post.srf*
*paypal.*/webscr?cmd=_login-submit*
*paypal.*/webscr?cmd=_login-submit*
application/x-www-form-urlencoded
application/x-www-form-urlencoded
Mozilla/5.0 (Windows NT 6.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/32.0.1700.76 Safari/537.36
Mozilla/5.0 (Windows NT 6.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/32.0.1700.76 Safari/537.36
%WinDir%\SysWOW64\svchost.exe
%WinDir%\SysWOW64\svchost.exe
Content-Length: %d
Content-Length: %d
Keylogger
Keylogger
CryptDllConvertPublicKeyInfo
CryptDllConvertPublicKeyInfo
CryptDllEncodePublicKeyAndParameters
CryptDllEncodePublicKeyAndParameters
REG add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoRun
REG add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoRun
KeyHook
KeyHook
KeyboardHookDelegate
KeyboardHookDelegate
[BypassScreening]
[BypassScreening]
HuntHTTPDownload
HuntHTTPDownload
Webcam
Webcam
Mozilla Firefox
Mozilla Firefox
KeyTLIST=b03
KeyTLIST=b03
You need a registered nick to join that channel
You need a registered nick to join that channel
flood.anope
flood.anope
InternetOpenUrlW
InternetOpenUrlW
hXXp://VVV.gofuckbiz.com/
hXXp://VVV.gofuckbiz.com/
hXXp://kremlin.ru/
hXXp://kremlin.ru/
Opera/7.60 (Windows NT 5.2; U) [en] (IBM EVV/3.0/EAK01AG9/LE)
Opera/7.60 (Windows NT 5.2; U) [en] (IBM EVV/3.0/EAK01AG9/LE)
cmd /c taskkill /F /PID
cmd /c taskkill /F /PID
Scripting.FileSystemObject
Scripting.FileSystemObject
autorun.inf
autorun.inf
Icon=%SystemRoot%\system32\SHELL32.dll,7
Icon=%SystemRoot%\system32\SHELL32.dll,7
shell32.dll, 2
shell32.dll, 2
shell32.dll, 3
shell32.dll, 3
.fldr
.fldr
shell32.dll, 0
shell32.dll, 0
\explorer.exe
\explorer.exe
Kernel32.dll
Kernel32.dll
$this.Icon
$this.Icon
0.9.5304.39905
0.9.5304.39905
Project1.exe
Project1.exe
Project1xp.exe
Project1xp.exe
Svchost.exe_380_rwx_00400000_00183000:
`.rsrc
`.rsrc
%Program Files% (x86)\Microsoft Visual Studio\VB98\VB6.OLB
%Program Files% (x86)\Microsoft Visual Studio\VB98\VB6.OLB
kernel32.dll
kernel32.dll
MSVBVM60.dll
MSVBVM60.dll
ntdll.dll
ntdll.dll
user32.dll
user32.dll
urlmon
urlmon
URLDownloadToFileA
URLDownloadToFileA
PSAPI.DLL
PSAPI.DLL
advapi32.dll
advapi32.dll
shell32.dll
shell32.dll
ShellExecuteA
ShellExecuteA
RegOpenKeyExA
RegOpenKeyExA
RegCloseKey
RegCloseKey
FindExecutableA
FindExecutableA
VBA6.DLL
VBA6.DLL
MasterKey
MasterKey
.text
.text
`.reloc
`.reloc
B.rsrc
B.rsrc
@?"333?(
@?"333?(
y.fefeffeef(
y.fefeffeef(
lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet
lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet
fSystem.Drawing.Icon, System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3aBj
fSystem.Drawing.Icon, System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3aBj
QSystem.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a
QSystem.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a
System.Drawing.Icon
System.Drawing.Icon
System.Drawing.Size
System.Drawing.Size
Windows.v4.0.HiDef
Windows.v4.0.HiDef
-Gt1}
-Gt1}
$`J.qp
$`J.qp
7-Nxf}
7-Nxf}
%DOQ)s
%DOQ)s
.rkr&
.rkr&
%.qw ]
%.qw ]
.tT*)
.tT*)
=SV%D
=SV%D
bj.Fy2
bj.Fy2
9.ZOZ
9.ZOZ
]t.ObG$N
]t.ObG$N
|3n@%8X
|3n@%8X
\v.tJ
\v.tJ
%sxfSz
%sxfSz
%{.UQ
%{.UQ
P)#n%s
P)#n%s
.uxA:
.uxA:
j|'y.zuT
j|'y.zuT
.%^%fx
.%^%fx
t/%x|
t/%x|
J.lS"
J.lS"
.cDh9t
.cDh9t
_V7.Aw
_V7.Aw
-IJ%S$
-IJ%S$
;u.Am
;u.Am
weB;SHZ
weB;SHZ
Z%.JH
Z%.JH
.WOr.$}
.WOr.$}
2l%f!7
2l%f!7
U~.mD
U~.mD
.SPzre#tI
.SPzre#tI
%D,yZ
%D,yZ
v4.0.30319
v4.0.30319
1%FND
1%FND
1%FNl
1%FNl
1%FN,
1%FN,
1%FN
1%FN
1%FN$
1%FN$
1%FN\
1%FN\
1%FNL
1%FNL
1%FNd
1%FNd
1%FN|
1%FN|
M.MMMwM
M.MMMwM
Blockscape.exe
Blockscape.exe
System.Windows.Forms
System.Windows.Forms
Microsoft.Xna.Framework.Game
Microsoft.Xna.Framework.Game
Microsoft.Xna.Framework
Microsoft.Xna.Framework
Microsoft.Xna.Framework.Graphics
Microsoft.Xna.Framework.Graphics
System.Drawing
System.Drawing
System.Core
System.Core
System.Xml
System.Xml
WindowsBase
WindowsBase
System.Management
System.Management
.resources
.resources
Microsoft.Xna.Framework.RuntimeProfile
Microsoft.Xna.Framework.RuntimeProfile
Microsoft.Xna.Framework.Audio
Microsoft.Xna.Framework.Audio
Microsoft.Xna.Framework.Content
Microsoft.Xna.Framework.Content
EffectPass
EffectPass
EffectPassCollection
EffectPassCollection
VertexElement
VertexElement
VertexElementFormat
VertexElementFormat
VertexElementUsage
VertexElementUsage
Viewport
Viewport
Microsoft.Xna.Framework.Input
Microsoft.Xna.Framework.Input
Keyboard
Keyboard
KeyboardState
KeyboardState
Keys
Keys
Microsoft.Xna.Framework.Media
Microsoft.Xna.Framework.Media
System.Collections.Generic
System.Collections.Generic
KeyCollection
KeyCollection
KeyValuePair`2
KeyValuePair`2
System.Collections
System.Collections
System.Collections.ObjectModel
System.Collections.ObjectModel
System.ComponentModel
System.ComponentModel
System.Diagnostics
System.Diagnostics
System.Globalization
System.Globalization
InvalidOperationException
InvalidOperationException
System.IO
System.IO
System.Linq
System.Linq
System.Net
System.Net
System.Net.Sockets
System.Net.Sockets
TcpClient
TcpClient
TcpListener
TcpListener
WebRequest
WebRequest
WebResponse
WebResponse
NotSupportedException
NotSupportedException
System.Reflection
System.Reflection
System.Resources
System.Resources
System.Runtime.CompilerServices
System.Runtime.CompilerServices
System.Runtime.InteropServices
System.Runtime.InteropServices
System.Runtime.Versioning
System.Runtime.Versioning
System.Security.Cryptography
System.Security.Cryptography
System.Text
System.Text
System.Threading
System.Threading
KeyEventArgs
KeyEventArgs
KeyEventHandler
KeyEventHandler
KeyPressEventArgs
KeyPressEventArgs
KeyPressEventHandler
KeyPressEventHandler
System.Windows
System.Windows
System.Windows.Media.Imaging
System.Windows.Media.Imaging
System.Windows.Media
System.Windows.Media
.ctor
.ctor
.cctor
.cctor
SetWindowsHookExA
SetWindowsHookExA
UnhookWindowsHookEx
UnhookWindowsHookEx
ContainsKey
ContainsKey
get_SupportedDisplayModes
get_SupportedDisplayModes
GetExecutingAssembly
GetExecutingAssembly
set_PasswordChar
set_PasswordChar
get_Keys
get_Keys
AcceptTcpClient
AcceptTcpClient
IsKeyDown
IsKeyDown
GetPressedKeys
GetPressedKeys
get_Passes
get_Passes
get_Viewport
get_Viewport
set_Viewport
set_Viewport
get_Msg
get_Msg
get_KeyChar
get_KeyChar
GetPublicKeyToken
GetPublicKeyToken
get_Key
get_Key
).NETFramework,Version=v4.0,Profile=Client
).NETFramework,Version=v4.0,Profile=Client
.NET Framework 4 Client Profile
.NET Framework 4 Client Profile
$1cb36746-1c92-461e-920f-a056aa95df47
$1cb36746-1c92-461e-920f-a056aa95df47
_CorExeMain
_CorExeMain
mscoree.dll
mscoree.dll
`.data
`.data
.rsrc
.rsrc
MSVBVM60.DLL
MSVBVM60.DLL
F:\Softwares\VB98\VB6.OLB
F:\Softwares\VB98\VB6.OLB
0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0||1|0|0||PA1|1|262|.exe0|0|1|1|0|0|0|1|0|0|0|0|0|0|0|PAhXXp://VVV.host.com/path/yourfile.exe|1|262PMicrosoft Error|Microsoft Error|32|262PAuZOkAB.exe|jWqBJR.txt|klbMgk.exe|voyVXU|
0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0||1|0|0||PA1|1|262|.exe0|0|1|1|0|0|0|1|0|0|0|0|0|0|0|PAhXXp://VVV.host.com/path/yourfile.exe|1|262PMicrosoft Error|Microsoft Error|32|262PAuZOkAB.exe|jWqBJR.txt|klbMgk.exe|voyVXU|
KERNEL32.DLL
KERNEL32.DLL
Avastui.exe
Avastui.exe
NIS.exe
NIS.exe
\Norton Internet Security\Engine\21.1.0.18\NIS.exe
\Norton Internet Security\Engine\21.1.0.18\NIS.exe
egui.exe
egui.exe
\ESET\ESET NOD32 Antivirus\ecls.exe
\ESET\ESET NOD32 Antivirus\ecls.exe
avpui.exe
avpui.exe
bdagent.exe
bdagent.exe
\Bitdefender\Bitdefender 2015\certutil.exe
\Bitdefender\Bitdefender 2015\certutil.exe
\AVAST Software\Avast\VisthAux.exe
\AVAST Software\Avast\VisthAux.exe
\svchost.exe
\svchost.exe
\SysWOW64\svchost.exe
\SysWOW64\svchost.exe
\System32\svchost.exe
\System32\svchost.exe
cmd /c taskkill /F /pid
cmd /c taskkill /F /pid
\net.exe
\net.exe
\file.txt
\file.txt
SELECT * FROM Win32_OperatingSystem
SELECT * FROM Win32_OperatingSystem
\skype.exe
\skype.exe
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\
wscript.shell
wscript.shell
\Project1.exe
\Project1.exe
\1.txt
\1.txt
\2.txt
\2.txt
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\
schtasks /create /sc minute /mo 1 /tn WindowsUpdate
schtasks /create /sc minute /mo 1 /tn WindowsUpdate
schtasks /delete /tn WindowsUpdate
schtasks /delete /tn WindowsUpdate
cmd /c icacls
cmd /c icacls
/deny %username%:F
/deny %username%:F
\test.exe
\test.exe
\SkypeUpdates\skype.exe
\SkypeUpdates\skype.exe
media.exe
media.exe
WScript.Shell
WScript.Shell
hXXps://twitter.com
hXXps://twitter.com
SendKeys
SendKeys
hXXp://VVV.facebook.com
hXXp://VVV.facebook.com
SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
cmd.exe
cmd.exe
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe
&& ping 127.0.0.1 && exit
&& ping 127.0.0.1 && exit
consent.exe
consent.exe
athenahttpbotnet
athenahttpbotnet
VVV.update.microsoft.com
VVV.update.microsoft.com
POST /%s HTTP/1
POST /%s HTTP/1
compatible; MSIE 7.0; Windows NT 5.1; SV1)
compatible; MSIE 7.0; Windows NT 5.1; SV1)
MapVirtualKeyA
MapVirtualKeyA
SOFTWARE\Microsoft\Active Setup\Installed Components\%s
SOFTWARE\Microsoft\Active Setup\Installed Components\%s
RegCreateKeyExA
RegCreateKeyExA
\system\systwin32.exe
\system\systwin32.exe
DownloadAndExecute
DownloadAndExecute
javaw.exe
javaw.exe
GetKeyboardType
GetKeyboardType
InternetOpenUrlA
InternetOpenUrlA
HTTP/1.1
HTTP/1.1
PR_OpenTCPSocket
PR_OpenTCPSocket
GdiplusShutdown
GdiplusShutdown
ole32.dll
ole32.dll
UnitKeylogger
UnitKeylogger
GetKeyboardLayoutNameA
GetKeyboardLayoutNameA
C:\Windows\tracing
C:\Windows\tracing
C:\ProgramData\Microsoft\Network\Connections\Pbk
C:\ProgramData\Microsoft\Network\Connections\Pbk
*facebook.*/login.php*
*facebook.*/login.php*
*login.live.*/*post.srf*
*login.live.*/*post.srf*
*paypal.*/webscr?cmd=_login-submit*
*paypal.*/webscr?cmd=_login-submit*
application/x-www-form-urlencoded
application/x-www-form-urlencoded
Mozilla/5.0 (Windows NT 6.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/32.0.1700.76 Safari/537.36
Mozilla/5.0 (Windows NT 6.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/32.0.1700.76 Safari/537.36
%WinDir%\SysWOW64\svchost.exe
%WinDir%\SysWOW64\svchost.exe
Content-Length: %d
Content-Length: %d
Keylogger
Keylogger
CryptDllConvertPublicKeyInfo
CryptDllConvertPublicKeyInfo
CryptDllEncodePublicKeyAndParameters
CryptDllEncodePublicKeyAndParameters
REG add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoRun
REG add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoRun
KeyHook
KeyHook
KeyboardHookDelegate
KeyboardHookDelegate
[BypassScreening]
[BypassScreening]
HuntHTTPDownload
HuntHTTPDownload
Webcam
Webcam
Mozilla Firefox
Mozilla Firefox
KeyTLIST=b03
KeyTLIST=b03
You need a registered nick to join that channel
You need a registered nick to join that channel
flood.anope
flood.anope
InternetOpenUrlW
InternetOpenUrlW
hXXp://VVV.gofuckbiz.com/
hXXp://VVV.gofuckbiz.com/
hXXp://kremlin.ru/
hXXp://kremlin.ru/
Opera/7.60 (Windows NT 5.2; U) [en] (IBM EVV/3.0/EAK01AG9/LE)
Opera/7.60 (Windows NT 5.2; U) [en] (IBM EVV/3.0/EAK01AG9/LE)
cmd /c taskkill /F /PID
cmd /c taskkill /F /PID
Scripting.FileSystemObject
Scripting.FileSystemObject
autorun.inf
autorun.inf
Icon=%SystemRoot%\system32\SHELL32.dll,7
Icon=%SystemRoot%\system32\SHELL32.dll,7
shell32.dll, 2
shell32.dll, 2
shell32.dll, 3
shell32.dll, 3
.fldr
.fldr
shell32.dll, 0
shell32.dll, 0
\explorer.exe
\explorer.exe
Kernel32.dll
Kernel32.dll
$this.Icon
$this.Icon
0.9.5304.39905
0.9.5304.39905
Project1.exe
Project1.exe
Project1xp.exe
Project1xp.exe
rundll32.exe_1300:
.text
.text
`.data
`.data
.rsrc
.rsrc
msvcrt.dll
msvcrt.dll
KERNEL32.dll
KERNEL32.dll
NTDLL.DLL
NTDLL.DLL
GDI32.dll
GDI32.dll
USER32.dll
USER32.dll
IMAGEHLP.dll
IMAGEHLP.dll
rundll32.pdb
rundll32.pdb
.....eZXnnnnnnnnnnnn3
.....eZXnnnnnnnnnnnn3
....eDXnnnnnnnnnnnn3
....eDXnnnnnnnnnnnn3
...eDXnnnnnnnnnnnn,
...eDXnnnnnnnnnnnn,
.eDXnnnnnnnnnnnn,
.eDXnnnnnnnnnnnn,
%Xnnnnnnnnnnnnnnn1
%Xnnnnnnnnnnnnnnn1
O3$dS7"%U9
O3$dS7"%U9
.manifest
.manifest
5.1.2600.5512 (xpsp.080413-2105)
5.1.2600.5512 (xpsp.080413-2105)
RUNDLL.EXE
RUNDLL.EXE
Windows
Windows
Operating System
Operating System
5.1.2600.5512
5.1.2600.5512
YThere is not enough memory to run the file %s.
YThere is not enough memory to run the file %s.
Please close other windows and try again.
Please close other windows and try again.
9The file %s or one of its components could not be opened.
9The file %s or one of its components could not be opened.
0The file %s or one of its components cannot run.
0The file %s or one of its components cannot run.
MThe file %s or one of its components requires a different version of Windows.
MThe file %s or one of its components requires a different version of Windows.
UThe file %s or one of its components cannot run in standard or enhanced mode Windows.3Another instance of the file %s is already running./An exception occurred while trying to run "%s"
UThe file %s or one of its components cannot run in standard or enhanced mode Windows.3Another instance of the file %s is already running./An exception occurred while trying to run "%s"
Error in %s
Error in %s
Missing entry:%s
Missing entry:%s
Error loading %s
Error loading %s