Backdoor.Win32.Caphaw_QKKBAL_c423380884

Backdoor.Win32.Farfli.FD, GenericInjector.YR, BackdoorCaphaw_QKKBAL.YR (Lavasoft MAS)Behaviour: Backdoor

The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.

d:d:d

d:d:d

d-d-d

d-d-d

M@d

M@d

2147483647

2147483647

%s\etilqs_

%s\etilqs_

Outstanding page count goes from %d to %d during this analysis

Outstanding page count goes from %d to %d during this analysis

Pointer map page %d is referenced

Pointer map page %d is referenced

Page %d is never used

Page %d is never used

Unable to malloc %d bytes

Unable to malloc %d bytes

Bad ptr map entry key=%d expected=(%d,%d) got=(%d,%d)

Bad ptr map entry key=%d expected=(%d,%d) got=(%d,%d)

Failed to read ptrmap key=%d

Failed to read ptrmap key=%d

freelist leaf count too big on page %d

freelist leaf count too big on page %d

failed to get page %d

failed to get page %d

%d of %d pages missing from overflow list starting at %d

%d of %d pages missing from overflow list starting at %d

2nd reference to page %d

2nd reference to page %d

invalid page number %d

invalid page number %d

Fragmented space is %d byte reported as %d on page %d

Fragmented space is %d byte reported as %d on page %d

Multiple uses for byte %d of page %d

Multiple uses for byte %d of page %d

Corruption detected in cell %d on page %d

Corruption detected in cell %d on page %d

On page %d at right child:

On page %d at right child:

On tree page %d cell %d:

On tree page %d cell %d:

initPage() returns error code %d

initPage() returns error code %d

unable to get the page. error code=%d

unable to get the page. error code=%d

Page %d:

Page %d:

%s(%d)

%s(%d)

keyinfo(%d

keyinfo(%d

%s-mjX

%s-mjX

Aunable to use function %s in the requested context

Aunable to use function %s in the requested context

Unsupported module operation: xNext

Unsupported module operation: xNext

Unsupported module operation: xColumn

Unsupported module operation: xColumn

Unsupported module operation: xRowid

Unsupported module operation: xRowid

SELECT name, rootpage, sql FROM '%q'.%s WHERE %s

SELECT name, rootpage, sql FROM '%q'.%s WHERE %s

sqlite_master

sqlite_master

sqlite_temp_master

sqlite_temp_master

transaction - SQL statements in progress

transaction - SQL statements in progress

variable number must be between ?1 and ?%d

variable number must be between ?1 and ?%d

not authorized to use function: %s

not authorized to use function: %s

ambiguous column name: %s

ambiguous column name: %s

no such column: %s

no such column: %s

%.*s%Q%s

%.*s%Q%s

UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;

UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;

UPDATE %Q.sqlite_sequence set name = %Q WHERE name = %Q

UPDATE %Q.sqlite_sequence set name = %Q WHERE name = %Q

sqlite_sequence

sqlite_sequence

UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name, %d 18,10) ELSE name END WHERE tbl_name=%Q AND (type='table' OR type='index' OR type='trigger');

UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name, %d 18,10) ELSE name END WHERE tbl_name=%Q AND (type='table' OR type='index' OR type='trigger');

table %s may not be altered

table %s may not be altered

sqlite_

sqlite_

there is already another table or index with this name: %s

there is already another table or index with this name: %s

%s OR name=%Q

%s OR name=%Q

UPDATE %Q.%s SET sql = substr(sql,1,%d) || ', ' || %Q || substr(sql,%d,length(sql)) WHERE type = 'table' AND name = %Q

UPDATE %Q.%s SET sql = substr(sql,1,%d) || ', ' || %Q || substr(sql,%d,length(sql)) WHERE type = 'table' AND name = %Q

Cannot add a PRIMARY KEY column

Cannot add a PRIMARY KEY column

DELETE FROM %Q.sqlite_stat1 WHERE tbl=%Q

DELETE FROM %Q.sqlite_stat1 WHERE tbl=%Q

CREATE TABLE %Q.sqlite_stat1(tbl,idx,stat)

CREATE TABLE %Q.sqlite_stat1(tbl,idx,stat)

sqlite_stat1

sqlite_stat1

SELECT idx, stat FROM %Q.sqlite_stat1

SELECT idx, stat FROM %Q.sqlite_stat1

sqlite_detach

sqlite_detach

sqlite_attach

sqlite_attach

unable to open database: %s

unable to open database: %s

database %s is already in use

database %s is already in use

too many attached databases - max %d

too many attached databases - max %d

database %s is locked

database %s is locked

cannot detach database %s

cannot detach database %s

no such database: %s

no such database: %s

%s %T cannot reference objects in database %s

%s %T cannot reference objects in database %s

access to %s.%s is prohibited

access to %s.%s is prohibited

access to %s.%s.%s is prohibited

access to %s.%s.%s is prohibited

illegal return value (%d) from the authorization function - should be SQLITE_OK, SQLITE_IGNORE, or SQLITE_DENY

illegal return value (%d) from the authorization function - should be SQLITE_OK, SQLITE_IGNORE, or SQLITE_DENY

no such table: %s

no such table: %s

no such table: %s.%s

no such table: %s.%s

object name reserved for internal use: %s

object name reserved for internal use: %s

there is already an index named %s

there is already an index named %s

duplicate column name: %s

duplicate column name: %s

default value of column [%s] is not constant

default value of column [%s] is not constant

AUTOINCREMENT is only allowed on an INTEGER PRIMARY KEY

AUTOINCREMENT is only allowed on an INTEGER PRIMARY KEY

table "%s" has more than one primary key

table "%s" has more than one primary key

CREATE TABLE %Q.sqlite_sequence(name,seq)

CREATE TABLE %Q.sqlite_sequence(name,seq)

UPDATE %Q.%s SET type='%s', name=%Q, tbl_name=%Q, rootpage=#0, sql=%Q WHERE rowid=#1

UPDATE %Q.%s SET type='%s', name=%Q, tbl_name=%Q, rootpage=#0, sql=%Q WHERE rowid=#1

CREATE %s %.*s

CREATE %s %.*s

view %s is circularly defined

view %s is circularly defined

DELETE FROM %Q.%s WHERE tbl_name=%Q and type!='trigger'

DELETE FROM %Q.%s WHERE tbl_name=%Q and type!='trigger'

DELETE FROM %s.sqlite_sequence WHERE name=%Q

DELETE FROM %s.sqlite_sequence WHERE name=%Q

use DROP VIEW to delete view %s

use DROP VIEW to delete view %s

use DROP TABLE to delete table %s

use DROP TABLE to delete table %s

table %s may not be dropped

table %s may not be dropped

UPDATE %Q.%s SET rootpage=%d WHERE #0 AND rootpage=#0

UPDATE %Q.%s SET rootpage=%d WHERE #0 AND rootpage=#0

unknown column "%s" in foreign key definition

unknown column "%s" in foreign key definition

number of columns in foreign key does not match the number of columns in the referenced table

number of columns in foreign key does not match the number of columns in the referenced table

foreign key on %s should reference only one column of table %T

foreign key on %s should reference only one column of table %T

INSERT INTO %Q.%s VALUES('index',%Q,%Q,#0,%Q);

INSERT INTO %Q.%s VALUES('index',%Q,%Q,#0,%Q);

CREATE%s INDEX %.*s

CREATE%s INDEX %.*s

table %s has no column named %s

table %s has no column named %s

sqlite_autoindex_

sqlite_autoindex_

index %s already exists

index %s already exists

there is already a table named %s

there is already a table named %s

virtual tables may not be indexed

virtual tables may not be indexed

views may not be indexed

views may not be indexed

table %s may not be indexed

table %s may not be indexed

indexed columns are not unique

indexed columns are not unique

DELETE FROM %Q.%s WHERE name=%Q

DELETE FROM %Q.%s WHERE name=%Q

index associated with UNIQUE or PRIMARY KEY constraint cannot be dropped

index associated with UNIQUE or PRIMARY KEY constraint cannot be dropped

no such index: %S

no such index: %S

unable to identify the object to be reindexed

unable to identify the object to be reindexed

no such collation sequence: %s

no such collation sequence: %s

cannot modify %s because it is a view

cannot modify %s because it is a view

table %s may not be modified

table %s may not be modified

table %S has no column named %s

table %S has no column named %s

%d values for %d columns

%d values for %d columns

table %S has %d columns but %d values were supplied

table %S has %d columns but %d values were supplied

PRIMARY KEY must be unique

PRIMARY KEY must be unique

error during initialization: %s

error during initialization: %s

no entry point [%s] in shared library [%s]

no entry point [%s] in shared library [%s]

unable to open shared library [%s]

unable to open shared library [%s]

sqlite3_extension_init

sqlite3_extension_init

automatic extension loading failed: %s

automatic extension loading failed: %s

unsupported encoding: %s

unsupported encoding: %s

*** in database %s ***

*** in database %s ***

foreign_key_list

foreign_key_list

SELECT name, rootpage, sql FROM '%q'.%s

SELECT name, rootpage, sql FROM '%q'.%s

unsupported file format

unsupported file format

database schema is locked: %s

database schema is locked: %s

RIGHT and FULL OUTER JOINs are not currently supported

RIGHT and FULL OUTER JOINs are not currently supported

unknown or unsupported join type: %T%s%T%s%T

unknown or unsupported join type: %T%s%T%s%T

%z:%d

%z:%d

column%d

column%d

%s.%s

%s.%s

sqlite_subquery_%p_

sqlite_subquery_%p_

cannot join using column %s - column not present in both tables

cannot join using column %s - column not present in both tables

cannot have both ON and USING clauses in the same join

cannot have both ON and USING clauses in the same join

a NATURAL join may not have an ON or USING clause

a NATURAL join may not have an ON or USING clause

%s BY column number %d out of range - should be between 1 and %d

%s BY column number %d out of range - should be between 1 and %d

SELECTs to the left and right of %s do not have the same number of result columns

SELECTs to the left and right of %s do not have the same number of result columns

LIMIT clause should come after %s not before

LIMIT clause should come after %s not before

ORDER BY clause should come after %s not before

ORDER BY clause should come after %s not before

ORDER BY term number %d does not match any result column

ORDER BY term number %d does not match any result column

ORDER BY position %d should be between 1 and %d

ORDER BY position %d should be between 1 and %d

sqlite3_get_table() called with two or more incompatible queries

sqlite3_get_table() called with two or more incompatible queries

cannot create INSTEAD OF trigger on table: %S

cannot create INSTEAD OF trigger on table: %S

cannot create %s trigger on view: %S

cannot create %s trigger on view: %S

no such trigger: %S

no such trigger: %S

INSERT INTO vacuum_db.sqlite_master SELECT type, name, tbl_name, rootpage, sql FROM sqlite_master WHERE type='view' OR type='trigger' OR (type='table' AND rootpage=0)

INSERT INTO vacuum_db.sqlite_master SELECT type, name, tbl_name, rootpage, sql FROM sqlite_master WHERE type='view' OR type='trigger' OR (type='table' AND rootpage=0)

SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM ' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name=='sqlite_sequence';

SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM ' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name=='sqlite_sequence';

SELECT 'DELETE FROM vacuum_db.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name='sqlite_sequence'

SELECT 'DELETE FROM vacuum_db.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name='sqlite_sequence'

SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM ' || quote(name) || ';'FROM sqlite_master WHERE type = 'table' AND name!='sqlite_sequence' AND rootpage>0

SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM ' || quote(name) || ';'FROM sqlite_master WHERE type = 'table' AND name!='sqlite_sequence' AND rootpage>0

SELECT 'CREATE UNIQUE INDEX vacuum_db.' || substr(sql,21,100000000) FROM sqlite_master WHERE sql LIKE 'CREATE UNIQUE INDEX %'

SELECT 'CREATE UNIQUE INDEX vacuum_db.' || substr(sql,21,100000000) FROM sqlite_master WHERE sql LIKE 'CREATE UNIQUE INDEX %'

SELECT 'CREATE INDEX vacuum_db.' || substr(sql,14,100000000) FROM sqlite_master WHERE sql LIKE 'CREATE INDEX %'

SELECT 'CREATE INDEX vacuum_db.' || substr(sql,14,100000000) FROM sqlite_master WHERE sql LIKE 'CREATE INDEX %'

SELECT 'CREATE TABLE vacuum_db.' || substr(sql,14,100000000) FROM sqlite_master WHERE type='table' AND name!='sqlite_sequence' AND rootpage>0

SELECT 'CREATE TABLE vacuum_db.' || substr(sql,14,100000000) FROM sqlite_master WHERE type='table' AND name!='sqlite_sequence' AND rootpage>0

PRAGMA vacuum_db.synchronous=OFF

PRAGMA vacuum_db.synchronous=OFF

UPDATE %Q.%s SET type='table', name=%Q, tbl_name=%Q, rootpage=0, sql=%Q WHERE rowid=#1

UPDATE %Q.%s SET type='table', name=%Q, tbl_name=%Q, rootpage=0, sql=%Q WHERE rowid=#1

no such module: %s

no such module: %s

vtable constructor did not declare schema: %s

vtable constructor did not declare schema: %s

vtable constructor failed: %s

vtable constructor failed: %s

%z VIRTUAL TABLE INDEX %d:%s

%z VIRTUAL TABLE INDEX %d:%s

%z USING PRIMARY KEY

%z USING PRIMARY KEY

%z WITH INDEX %s

%z WITH INDEX %s

%z AS %s

%z AS %s

TABLE %s

TABLE %s

B}Tat most %d tables in a join

B}Tat most %d tables in a join

incomplete SQL statement

incomplete SQL statement

kernel lacks large file support

kernel lacks large file support

SQL logic error or missing database

SQL logic error or missing database

Invalid parameter passed to C runtime function.

Invalid parameter passed to C runtime function.

SOFTWARE\Far2\SavedDialogHistory\FTPHost

SOFTWARE\Far2\SavedDialogHistory\FTPHost

SOFTWARE\Far2\Plugins\FTP\Hosts

SOFTWARE\Far2\Plugins\FTP\Hosts

\wcx_PTF.ini

\wcx_PTF.ini

Software\Ghisler\Windows Commander

Software\Ghisler\Windows Commander

CSMFTPItem

CSMFTPItem

\sm.dat

\sm.dat

Software\GlobalSCAPE\CuteFTP 8 Professional\QCToolbar

Software\GlobalSCAPE\CuteFTP 8 Professional\QCToolbar

Software\GlobalSCAPE\CuteFTP 8 Home\QCToolbar

Software\GlobalSCAPE\CuteFTP 8 Home\QCToolbar

\GlobalSCAPE\CuteFTP

\GlobalSCAPE\CuteFTP

\GlobalSCAPE\CuteFTP Pro

\GlobalSCAPE\CuteFTP Pro

\GlobalSCAPE\CuteFTP Home

\GlobalSCAPE\CuteFTP Home

\GlobalSCAPE\CuteFTP Lite

\GlobalSCAPE\CuteFTP Lite

\Quick.dat

\Quick.dat

\Sites.dat

\Sites.dat

\FileZilla\sitemanager.xml

\FileZilla\sitemanager.xml

\FileZilla\recentservers.xml

\FileZilla\recentservers.xml

\ftplist.txt

\ftplist.txt

FTP Commander Pro

FTP Commander Pro

FTP Navigator

FTP Navigator

FTP Commander

FTP Commander

FTP Commander Deluxe

FTP Commander Deluxe

Software\BFTP

Software\BFTP

\BulletProof Software\BulletProof FTP Client 2009

\BulletProof Software\BulletProof FTP Client 2009

\BulletProof Software\BulletProof FTP Client

\BulletProof Software\BulletProof FTP Client

\SmartFTP\Client 2.0\Favorites

\SmartFTP\Client 2.0\Favorites

\SmartFTP

\SmartFTP

\TurboFTP

\TurboFTP

\addrbk.dat

\addrbk.dat

Software\TurboFTP

Software\TurboFTP

Software\Sota\FFFTP

Software\Sota\FFFTP

DefaultPassword

DefaultPassword

Software\Sota\FFFTP\Options

Software\Sota\FFFTP\Options

Software\FTPWare\COREFTP\Sites

Software\FTPWare\COREFTP\Sites

\FTP Explorer\profiles.xml

\FTP Explorer\profiles.xml

SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\UltraFXP

SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\UltraFXP

Software\Cryer\WebSitePublisher

Software\Cryer\WebSitePublisher

Software\NCH Software\ClassicFTP\FTPAccounts

Software\NCH Software\ClassicFTP\FTPAccounts

Software\SoftX.org\FTPClient\Sites

Software\SoftX.org\FTPClient\Sites

Software\FTPClient\Sites

Software\FTPClient\Sites

\GPSoftware\Directory Opus\ConfigFiles\PTF.oxc

\GPSoftware\Directory Opus\ConfigFiles\PTF.oxc

Software\Dev Zero G\FTP Uploader\FTP Uploader

Software\Dev Zero G\FTP Uploader\FTP Uploader

Software\South River Technologies\WebDrive\Connections

Software\South River Technologies\WebDrive\Connections

klfhuw%$#%fgjlvf

klfhuw%$#%fgjlvf

\NetDrive\NDSites.ini

\NetDrive\NDSites.ini

zcÁ

zcÁ

GetWindowsDirectoryA

GetWindowsDirectoryA

GetProcessHeap

GetProcessHeap

PeekNamedPipe

PeekNamedPipe

RegEnumKeyExA

RegEnumKeyExA

RegOpenKeyA

RegOpenKeyA

RegCloseKey

RegCloseKey

.flat

.flat

.text

.text

`.rdata

`.rdata

@.data

@.data

.idata

.idata

.asmdata

.asmdata

@.reloc

@.reloc

TPFk/dPipeG

TPFk/dPipeG

;-keXE

;-keXE

.ho"

.ho"

svchost.exe_608_rwx_20121000_0005D000:

t#WSSh

t#WSSh

BrowserRealKeyStream

BrowserRealKeyStream

BrowserRealKeyPress

BrowserRealKeyPress

BrowserKeyPress

BrowserKeyPress

GetDocumentUrl

GetDocumentUrl

LoadUrl

LoadUrl

ikey

ikey

!=*/&| -

!=*/&| -

0123456789

0123456789

--%s--

--%s--

Content-Disposition: form-data; name="%s"

Content-Disposition: form-data; name="%s"

Content-Disposition: form-data; name="%s"; filename="%s"

Content-Disposition: form-data; name="%s"; filename="%s"

Content-Transfer-Encoding: %s

Content-Transfer-Encoding: %s

Content-Type: multipart/form-data, boundary=%s

Content-Type: multipart/form-data, boundary=%s

Content-Type: application/x-www-form-urlencoded

Content-Type: application/x-www-form-urlencoded

Range: bytes=%d-

Range: bytes=%d-

Range: bytes=%d-%d

Range: bytes=%d-%d

https

https

Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)

Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)

%s%s%s

%s%s%s

00000409

00000409

%CommonProgramFiles%

%CommonProgramFiles%

GetExeDirectory

GetExeDirectory

GetExeFullPath

GetExeFullPath

GetExeName

GetExeName

SetDownloadUrl

SetDownloadUrl

UrlEncode

UrlEncode

DeleteUrlCache

DeleteUrlCache

SetUrlCookie

SetUrlCookie

GetUrlCookie

GetUrlCookie

KERNEL32.DLL

KERNEL32.DLL

mscoree.dll

mscoree.dll

Please contact the application's support team for more information.

Please contact the application's support team for more information.

- Attempt to initialize the CRT more than once.

- Attempt to initialize the CRT more than once.

- CRT not initialized

- CRT not initialized

operator

operator

kernel32.dll

kernel32.dll

GetProcessWindowStation

GetProcessWindowStation

USER32.DLL

USER32.DLL

.?AVCMyWebBrowser@@

.?AVCMyWebBrowser@@

.?AVCSdkWebBrowser@@

.?AVCSdkWebBrowser@@

IEScope%d

IEScope%d

iexplore%d

iexplore%d

zcÁ

zcÁ

%System%\svchost.exe

%System%\svchost.exe

GetWindowsDirectoryA

GetWindowsDirectoryA

GetCPInfo

GetCPInfo

GetProcessHeap

GetProcessHeap

GetConsoleOutputCP

GetConsoleOutputCP

PeekNamedPipe

PeekNamedPipe

ShellExecuteA

ShellExecuteA

UrlMkSetSessionOption

UrlMkSetSessionOption

UrlMkGetSessionOption

UrlMkGetSessionOption

SetWindowsHookExA

SetWindowsHookExA

UnhookWindowsHookEx

UnhookWindowsHookEx

LoadKeyboardLayoutA

LoadKeyboardLayoutA

VkKeyScanExA

VkKeyScanExA

keybd_event

keybd_event

DeleteUrlCacheEntry

DeleteUrlCacheEntry

FindNextUrlCacheEntryA

FindNextUrlCacheEntryA

FindFirstUrlCacheEntryA

FindFirstUrlCacheEntryA

HttpSendRequestA

HttpSendRequestA

HttpEndRequestA

HttpEndRequestA

GetUrlCacheEntryInfoA

GetUrlCacheEntryInfoA

InternetCrackUrlA

InternetCrackUrlA

FindCloseUrlCache

FindCloseUrlCache

HttpOpenRequestA

HttpOpenRequestA

HttpAddRequestHeadersA

HttpAddRequestHeadersA

HttpSendRequestExA

HttpSendRequestExA

xquuuuuRLMLMLMLMLMLM

xquuuuuRLMLMLMLMLMLM

.text

.text

`.rdata

`.rdata

@.data

@.data

.rsrc

.rsrc

@.reloc

@.reloc

svchost.exe_608_rwx_20181000_00036000:

Gh.logWj

Gh.logWj

h.logPj

h.logPj

tcPR

tcPR

h.exe

h.exe

user32.dll

user32.dll

kernel32.dll

kernel32.dll

|GetWindowsDirectoryA

|GetWindowsDirectoryA

{X-X-X-X-XX}

{X-X-X-X-XX}

ntdll.dll

ntdll.dll

shlwapi.dll

shlwapi.dll

SHDeleteKeyA

SHDeleteKeyA

SOFTWARE\Microsoft\Windows\CurrentVersion

SOFTWARE\Microsoft\Windows\CurrentVersion

shell32.dll

shell32.dll

?456789:;

?456789:;

!"#$%&'()* ,-./0123

!"#$%&'()* ,-./0123

ws2_32.dll

ws2_32.dll

HTTP/*.*

HTTP/*.*

/HTTPMozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)

/HTTPMozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)

Referer: %s

Referer: %s

Content-Type: multipart/form-data; boundary=%s

Content-Type: multipart/form-data; boundary=%s

Content-Length: %d

Content-Length: %d

Content-Disposition: form-data; name="%s"

Content-Disposition: form-data; name="%s"

--%s--

--%s--

%s /%s HTTP/1.1

%s /%s HTTP/1.1

Host: %s

Host: %s

User-Agent: %s

User-Agent: %s

%sAccept-Language: %s

%sAccept-Language: %s

HTTP/1.x 301 Moved Permanently

HTTP/1.x 301 Moved Permanently

Server: Apache/2.2.14

Server: Apache/2.2.14

advapi32.dll

advapi32.dll

%CommonProgramFiles%

%CommonProgramFiles%

\/*.*

\/*.*

winlogon.exe

winlogon.exe

csrss.exe

csrss.exe

smss.exe

smss.exe

keyworddestination

keyworddestination

USER PASS

USER PASS

PORT

PORT

RapportGP.dll

RapportGP.dll

csshiftjis

csshiftjis

cswindows31j

cswindows31j

iso_646.irv:1991

iso_646.irv:1991

windows-1250

windows-1250

windows-1251

windows-1251

windows-1252

windows-1252

windows-1253

windows-1253

windows-1254

windows-1254

windows-1255

windows-1255

windows-1256

windows-1256

windows-1257

windows-1257

windows-1258

windows-1258

windows-874

windows-874

hostuser-agentoptionsgetheadpostputdeletetraceacceptaccept-charsetaccept-encodingaccept-languageauthorizationexpectfromhostif-modified-sinceif-matchif-none-matchif-rangeif-unmodifiedsincemax-forwardsproxy-authorizationrangerefererteuser-agent100101200201202203204205206300301302303304305306307400401402403404405406407408409410411412413414415416417500501502503504505accept-rangesageetaglocationproxy-authenticatepublicretry-afterservervarywarningwww-authenticateallowcontent-basecontent-encodingcache-controlconnectiondatetrailertransfer-encodingupgradeviawarningcontent-languagecontent-lengthcontent-locationcontent-md5content-rangecontent-typeetagexpireslast-modifiedset-cookieMondayTuesdayWednesdayThursdayFridaySaturdaySundayJanFebMarAprMayJunJulAugSepOctNovDecchunkedtext/htmlimage/pngimage/jpgimage/gifapplication/xmlapplication/xhtmltext/plainpublicmax-agecharset=iso-8859-1utf-8gzipdeflateHTTP/1.1statusversionurl

hostuser-agentoptionsgetheadpostputdeletetraceacceptaccept-charsetaccept-encodingaccept-languageauthorizationexpectfromhostif-modified-sinceif-matchif-none-matchif-rangeif-unmodifiedsincemax-forwardsproxy-authorizationrangerefererteuser-agent100101200201202203204205206300301302303304305306307400401402403404405406407408409410411412413414415416417500501502503504505accept-rangesageetaglocationproxy-authenticatepublicretry-afterservervarywarningwww-authenticateallowcontent-basecontent-encodingcache-controlconnectiondatetrailertransfer-encodingupgradeviawarningcontent-languagecontent-lengthcontent-locationcontent-md5content-rangecontent-typeetagexpireslast-modifiedset-cookieMondayTuesdayWednesdayThursdayFridaySaturdaySundayJanFebMarAprMayJunJulAugSepOctNovDecchunkedtext/htmlimage/pngimage/jpgimage/gifapplication/xmlapplication/xhtmltext/plainpublicmax-agecharset=iso-8859-1utf-8gzipdeflateHTTP/1.1statusversionurl

HTTP/1.1

HTTP/1.1

\\.\pipe\

\\.\pipe\

gdiplus.dll

gdiplus.dll

GdiplusShutdown

GdiplusShutdown

PTF://%s:%s@%s:%d/

PTF://%s:%s@%s:%d/

pop3://%s:%s@%s:%d/

pop3://%s:%s@%s:%d/

dnsapi.dll

dnsapi.dll

wininet.dll

wininet.dll

HttpOpenRequestA

HttpOpenRequestA

HttpOpenRequestW

HttpOpenRequestW

InternetOpenUrlA

InternetOpenUrlA

InternetOpenUrlW

InternetOpenUrlW

HttpSendRequestA

HttpSendRequestA

HttpSendRequestW

HttpSendRequestW

HttpSendRequestExA

HttpSendRequestExA

HttpSendRequestExW

HttpSendRequestExW

DeleteUrlCacheEntryW

DeleteUrlCacheEntryW

HttpQueryInfoA

HttpQueryInfoA

HttpQueryInfoW

HttpQueryInfoW

GetUrlCacheEntryInfoW

GetUrlCacheEntryInfoW

HttpAddRequestHeadersA

HttpAddRequestHeadersA

HttpAddRequestHeadersW

HttpAddRequestHeadersW

urlmon.dll

urlmon.dll

UrlMkGetSessionOption

UrlMkGetSessionOption

nss3.dll

nss3.dll

PR_OpenTCPSocket

PR_OpenTCPSocket

nspr4.dll

nspr4.dll

hXXps://hXXp://TE

hXXps://hXXp://TE

%Documents and Settings%\%current user%\Local Settings\Application Data\iwmikkry.log

%Documents and Settings%\%current user%\Local Settings\Application Data\iwmikkry.log

%Documents and Settings%\%current user%\Local Settings\Application Data\ahigjltn.log

%Documents and Settings%\%current user%\Local Settings\Application Data\ahigjltn.log

%Documents and Settings%\%current user%\Local Settings\Application Data\taywrdpm.log

%Documents and Settings%\%current user%\Local Settings\Application Data\taywrdpm.log

%Documents and Settings%\%current user%\Local Settings\Application Data\vssqectp.log

%Documents and Settings%\%current user%\Local Settings\Application Data\vssqectp.log

%Documents and Settings%\%current user%\Local Settings\Application Data\klsckhjr.log

%Documents and Settings%\%current user%\Local Settings\Application Data\klsckhjr.log

{49A21781-C39D-B603-C11E-00485360D01E}

{49A21781-C39D-B603-C11E-00485360D01E}

{49A21782-C39D-B603-C11E-00485360D01E}

{49A21782-C39D-B603-C11E-00485360D01E}

{49A21783-C39D-B603-C11E-00485360D01E}

{49A21783-C39D-B603-C11E-00485360D01E}

PeekNamedPipe

PeekNamedPipe

SetNamedPipeHandleState

SetNamedPipeHandleState

WaitNamedPipeA

WaitNamedPipeA

DisconnectNamedPipe

DisconnectNamedPipe

CreateNamedPipeA

CreateNamedPipeA

ConnectNamedPipe

ConnectNamedPipe

RegCloseKey

RegCloseKey

RegDeleteKeyA

RegDeleteKeyA

RegEnumKeyExA

RegEnumKeyExA

RegOpenKeyExA

RegOpenKeyExA

RegQueryInfoKeyA

RegQueryInfoKeyA

ExitWindowsEx

ExitWindowsEx

GetKeyboardState

GetKeyboardState

.text

.text

`.rdata

`.rdata

@.data

@.data

.reloc

.reloc

|75001234

|75001234

PR_xTCPSh

PR_xTCPSh

wsock32.dll

wsock32.dll

multipart/*boundary={*}application/x-www-form-urlencodedname="{*}"{*}hXXps://hXXp://

multipart/*boundary={*}application/x-www-form-urlencodedname="{*}"{*}hXXps://hXXp://

keywords

keywords

alluniqcontrolexplicitASCIIUTF8UNICODE{keyword}

alluniqcontrolexplicitASCIIUTF8UNICODE{keyword}

set_url

set_url

WebFilters

WebFilters

WebDataFilters

WebDataFilters

WebFakes

WebFakes

|0123456789

|0123456789

gzipdeflateContent-Type: application/x-www-form-urlencoded

gzipdeflateContent-Type: application/x-www-form-urlencoded

Tdomain=google.ru&cookies=enabled&reason=1&auth=false

Tdomain=google.ru&cookies=enabled&reason=1&auth=false

Cookie: User-Agent-Session: Basic login: Basic password:

Cookie: User-Agent-Session: Basic login: Basic password:

svchost.exe_608_rwx_201C1000_0003F000:

\$0#\$83

\$0#\$83

\$4#\$,3

\$4#\$,3

PSSh0G

PSSh0G

G%F;0r

G%F;0r

Single block msg

Single block msg

AES-CTR-128 (%s):

AES-CTR-128 (%s):

AES-CFB128-= (%s):

AES-CFB128-= (%s):

AES-CBC-= (%s):

AES-CBC-= (%s):

passed

passed

AES-ECB-= (%s):

AES-ECB-= (%s):

ARC4 test #%d:

ARC4 test #%d:

?456789:;

?456789:;

!"#$%&'()* ,-./0123

!"#$%&'()* ,-./0123

Unexpected error, return code = X

Unexpected error, return code = X

failed at %d

failed at %d

CAMELLIA-CTR-128 (%s):

CAMELLIA-CTR-128 (%s):

CAMELLIA-CBC-= (%s):

CAMELLIA-CBC-= (%s):

CAMELLIA-ECB-= (%s):

CAMELLIA-ECB-= (%s):

-----BEGIN CERTIFICATE-----

-----BEGIN CERTIFICATE-----

gZUwgZIwDAYDVR0TBAUwAwEB/zAdBgNVHQ4EFgQUtFrkpbPe0lL2udWmlQ/rPrzH

gZUwgZIwDAYDVR0TBAUwAwEB/zAdBgNVHQ4EFgQUtFrkpbPe0lL2udWmlQ/rPrzH

-----END CERTIFICATE-----

-----END CERTIFICATE-----

-----BEGIN RSA PRIVATE KEY-----

-----BEGIN RSA PRIVATE KEY-----

JczSfpRWLlbPznZg8OQh/VgCMA58N5DjOzTIK7sJJ5r 94ZBTCpgAMbF588f0NTR

JczSfpRWLlbPznZg8OQh/VgCMA58N5DjOzTIK7sJJ5r 94ZBTCpgAMbF588f0NTR

-----END RSA PRIVATE KEY-----

-----END RSA PRIVATE KEY-----

lZvc/kFeF6babFtpzAK6FCwWJJxK3M3Q91Jnc/EtoCP9fvQxyi1wyokLBNsupk9w

lZvc/kFeF6babFtpzAK6FCwWJJxK3M3Q91Jnc/EtoCP9fvQxyi1wyokLBNsupk9w

pgVb5xOXhbUjktnUJAbVCSWJdQfdphqPPwkZvq1lLGTrlZvc/kFeF6babFtpzAK6

pgVb5xOXhbUjktnUJAbVCSWJdQfdphqPPwkZvq1lLGTrlZvc/kFeF6babFtpzAK6

%s(d): %s

%s(d): %s

%s(d): %s() returned %d (0x%x)

%s(d): %s() returned %d (0x%x)

%s(d): x:

%s(d): x:

%s(d): dumping '%s' (%d bytes)

%s(d): dumping '%s' (%d bytes)

%s(d):

%s(d):

%s(d): value of '%s' (%lu bits) is:

%s(d): value of '%s' (%lu bits) is:

crt->rsa.E

crt->rsa.E

crt->rsa.N

crt->rsa.N

%s(d): %s #%d:

%s(d): %s #%d:

DES%c-CBC-= (%s):

DES%c-CBC-= (%s):

DES%c-ECB-= (%s):

DES%c-ECB-= (%s):

HMAC-MD5 test #%d:

HMAC-MD5 test #%d:

MD5 test #%d:

MD5 test #%d:

RSA key validation:

RSA key validation:

HMAC-SHA-1 test #%d:

HMAC-SHA-1 test #%d:

SHA-1 test #%d:

SHA-1 test #%d:

HMAC-SHA-%d test #%d:

HMAC-SHA-%d test #%d:

SHA-%d test #%d:

SHA-%d test #%d:

p.il :

p.il :

client hello, server name extension: %s

client hello, server name extension: %s

client hello, compress alg.: %d

client hello, compress alg.: %d

client hello, compress len.: %d

client hello, compress len.: %d

client hello, add ciphersuite: -

client hello, add ciphersuite: -

client hello, got %d ciphersuites

client hello, got %d ciphersuites

client hello, session id len.: %d

client hello, session id len.: %d

client hello, max version: [%d:%d]

client hello, max version: [%d:%d]

server hello, compress alg.: %d

server hello, compress alg.: %d

server hello, chosen ciphersuite: %d

server hello, chosen ciphersuite: %d

%s session has been resumed

%s session has been resumed

ssl_derive_keys

ssl_derive_keys

server hello, session id len.: %d

server hello, session id len.: %d

server hello, chosen version: [%d:%d]

server hello, chosen version: [%d:%d]

bad server key exchange message

bad server key exchange message

=> parse server key exchange

=> parse server key exchange

got %s certificate request

got %s certificate request

bad certificate request message

bad certificate request message

=> parse certificate request

=> parse certificate request

=> write client key exchange

=> write client key exchange

got no private key

got no private key

=> write certificate verify

=> write certificate verify

invalid state %d

invalid state %d

client state: %d

client state: %d

client hello v3, max. version: [%d:%d]

client hello v3, max. version: [%d:%d]

client hello v3, handshake len.: %d

client hello v3, handshake len.: %d

client hello v3, handshake type: %d

client hello v3, handshake type: %d

client hello v3, protocol ver: [%d:%d]

client hello v3, protocol ver: [%d:%d]

client hello v3, message len.: %d

client hello v3, message len.: %d

client hello v3, message type: %d

client hello v3, message type: %d

ciph_len: %d, sess_len: %d, chal_len: %d

ciph_len: %d, sess_len: %d, chal_len: %d

client hello v2, max. version: [%d:%d]

client hello v2, max. version: [%d:%d]

client hello v2, message len.: %d

client hello v2, message len.: %d

client hello v2, message type: %d

client hello v2, message type: %d

=> write certificate request

=> write certificate request

=> write server key exchange

=> write server key exchange

bad client key exchange message

bad client key exchange message

=> parse client key exchange

=> parse client key exchange

bad certificate verify message

bad certificate verify message

=> parse certificate verify

=> parse certificate verify

server state: %d

server state: %d

before encrypt: msglen = %d, including %d bytes of IV and %d bytes of padding

before encrypt: msglen = %d, including %d bytes of IV and %d bytes of padding

before encrypt: msglen = %d, including %d bytes of padding

before encrypt: msglen = %d, including %d bytes of padding

bad padding byte: should be x, but is x

bad padding byte: should be x, but is x

bad padding length: is %d, should be no more than %d

bad padding length: is %d, should be no more than %d

msglen (%d) %% ivlen (%d) != 0

msglen (%d) %% ivlen (%d) != 0

in_msglen (%d)

in_msglen (%d)

in_left: %d, nb_want: %d

in_left: %d, nb_want: %d

message length: %d, out_left: %d

message length: %d, out_left: %d

output record: msgtype = %d, version = [%d:%d], msglen = %d

output record: msgtype = %d, version = [%d:%d], msglen = %d

got an alert message, type: [%d:%d]

got an alert message, type: [%d:%d]

input record: msgtype = %d, version = [%d:%d], msglen = %d

input record: msgtype = %d, version = [%d:%d], msglen = %d

handshake message: msglen = %d, type = %d, hslen = %d

handshake message: msglen = %d, type = %d, hslen = %d

certificate too large, %d > %d

certificate too large, %d > %d

own certificate

own certificate

got no certificate to send

got no certificate to send

=> write certificate

=> write certificate

x509_verify_cert

x509_verify_cert

x509parse_crt

x509parse_crt

peer certificate

peer certificate

malloc(%d bytes) failed

malloc(%d bytes) failed

bad certificate message

bad certificate message

TLSv1 client has no certificate

TLSv1 client has no certificate

SSLv3 client has no certificate

SSLv3 client has no certificate

=> parse certificate

=> parse certificate

keylen: %d, minlen: %d, ivlen: %d, maclen: %d

keylen: %d, minlen: %d, ivlen: %d, maclen: %d

ciphersuite %s is not available

ciphersuite %s is not available

key block

key block

ciphersuite = %s

ciphersuite = %s

key expansion

key expansion

=> derive keys

=> derive keys

1.0.0

1.0.0

PolarSSL 1.0.0

PolarSSL 1.0.0

M-----

M-----

------

------

-----BEGIN PRIVATE KEY-----

-----BEGIN PRIVATE KEY-----

-----END PRIVATE KEY-----

-----END PRIVATE KEY-----

-----BEGIN PUBLIC KEY-----

-----BEGIN PUBLIC KEY-----

-----END PUBLIC KEY-----

-----END PUBLIC KEY-----

0xX=

0xX=

X%s

X%s

%sRSA key size : %d bits

%sRSA key size : %d bits

%ssigned using : RSA

%ssigned using : RSA

%sexpires on : d-d-d d:d:d

%sexpires on : d-d-d d:d:d

%sissued on : d-d-d d:d:d

%sissued on : d-d-d d:d:d

%ssubject name :

%ssubject name :

%sissuer name :

%sissuer name :

%sserial number :

%sserial number :

%scert. version : %d

%scert. version : %d

TLS Web Client Authentication

TLS Web Client Authentication

TLS Web Server Authentication

TLS Web Server Authentication

%d.%d

%d.%d

revocation date: d-d-d d:d:d

revocation date: d-d-d d:d:d

%sserial number:

%sserial number:

%sRevoked certificates:

%sRevoked certificates:

%snext update : d-d-d d:d:d

%snext update : d-d-d d:d:d

%sthis update : d-d-d d:d:d

%sthis update : d-d-d d:d:d

%sCRL version : %d

%sCRL version : %d

X.509 private key load:

X.509 private key load:

X.509 certificate load:

X.509 certificate load:

XTEA test #%d:

XTEA test #%d:

Mozilla/5.0 (Windows NT 6.1; rv:11.0) Gecko/20100101 Firefox/11.0

Mozilla/5.0 (Windows NT 6.1; rv:11.0) Gecko/20100101 Firefox/11.0

SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Adobe Flash Player Plugin

SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Adobe Flash Player Plugin

SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Adobe Flash Player ActiveX

SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Adobe Flash Player ActiveX

System32\Macromed\Flash\mms.cfg

System32\Macromed\Flash\mms.cfg

%SystemRoot%\

%SystemRoot%\

/get/flashplayer/current/licensing/win/install_flash_player_11_active_x_32bit.exe

/get/flashplayer/current/licensing/win/install_flash_player_11_active_x_32bit.exe

/get/flashplayer/current/licensing/win/install_flash_player_11_plugin_32bit.exe

/get/flashplayer/current/licensing/win/install_flash_player_11_plugin_32bit.exe

fpdownload.macromedia.com

fpdownload.macromedia.com

\install_flash_player_11_plugin_32bit.exe

\install_flash_player_11_plugin_32bit.exe

\install_flash_player_11_active_x_32bit.exe

\install_flash_player_11_active_x_32bit.exe

SOFTWARE\Microsoft\Windows\CurrentVersion\Run

SOFTWARE\Microsoft\Windows\CurrentVersion\Run

ardownload.adobe.com

ardownload.adobe.com

/pub/adobe/reader/win/10.x/10.1.2/en_US/AdbeRdr1012_en_US.exe

/pub/adobe/reader/win/10.x/10.1.2/en_US/AdbeRdr1012_en_US.exe

\AdbeRdr1012_en_US.exe

\AdbeRdr1012_en_US.exe

\Common Files\Java\Java Update\jucheck.exe

\Common Files\Java\Java Update\jucheck.exe

https

https

hXXp://VVV.oracle.com/technetwork/java/javase/downloads/jre-6u31-download-1501637.html

hXXp://VVV.oracle.com/technetwork/java/javase/downloads/jre-6u31-download-1501637.html

download.oracle.com

download.oracle.com

/otn-pub/java/jdk/6u31-b05/jre-6u31-windows-i586.exe

/otn-pub/java/jdk/6u31-b05/jre-6u31-windows-i586.exe

\jre-6u31-windows-i586-s.exe

\jre-6u31-windows-i586-s.exe

%s=%s

%s=%s

Range: bytes=%d-%d

Range: bytes=%d-%d

Cookie:%s

Cookie:%s

Cache-Control: %s

Cache-Control: %s

Connection: %s

Connection: %s

Content-Length: %d

Content-Length: %d

Host: %s

Host: %s

Accept-Encoding: %s

Accept-Encoding: %s

Content-Type: %s

Content-Type: %s

User-Agent: %s

User-Agent: %s

Accept-Language: %s

Accept-Language: %s

Referer: %s

Referer: %s

Accept: %s

Accept: %s

%s %s HTTP/1.1

%s %s HTTP/1.1

Test Using Larger Than Block-Size Key - Hash Key First

Test Using Larger Than Block-Size Key - Hash Key First

Test Using Larger Than Block-Size Key and Larger Than One Block-Size Data

Test Using Larger Than Block-Size Key and Larger Than One Block-Size Data

This is a test using a larger than block-size key and a larger than block-size data. The key needs to be hashed before being used by the HMAC algorithm.

This is a test using a larger than block-size key and a larger than block-size data. The key needs to be hashed before being used by the HMAC algorithm.

gpw_e24=http://VVV.oracle.com/technetwork/java/javase/downloads/jre-6u31-download-1501637.html

gpw_e24=http://VVV.oracle.com/technetwork/java/javase/downloads/jre-6u31-download-1501637.html

s_sq=[[B]];

s_sq=[[B]];

%s=%s;

%s=%s;

GetProcessHeap

GetProcessHeap

CreateIoCompletionPort

CreateIoCompletionPort

RegEnumKeyExA

RegEnumKeyExA

RegOpenKeyA

RegOpenKeyA

RegCreateKeyExA

RegCreateKeyExA

RegCloseKey

RegCloseKey

.text

.text

`.rdata

`.rdata

@.data

@.data

.idata

.idata

.reloc

.reloc

services.exe_764_rwx_20570000_00037000:

Gh.logWj

Gh.logWj

h.logPj

h.logPj

tcPR

tcPR

h.exe

h.exe

user32.dll

user32.dll

kernel32.dll

kernel32.dll

|GetWindowsDirectoryA

|GetWindowsDirectoryA

{X-X-X-X-XX}

{X-X-X-X-XX}

ntdll.dll

ntdll.dll

shlwapi.dll

shlwapi.dll

SHDeleteKeyA

SHDeleteKeyA

SOFTWARE\Microsoft\Windows\CurrentVersion

SOFTWARE\Microsoft\Windows\CurrentVersion

shell32.dll

shell32.dll

?456789:;

?456789:;

!"#$%&'()* ,-./0123

!"#$%&'()* ,-./0123

ws2_32.dll

ws2_32.dll

HTTP/*.*

HTTP/*.*

/HTTPMozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)

/HTTPMozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)

Referer: %s

Referer: %s

Content-Type: multipart/form-data; boundary=%s

Content-Type: multipart/form-data; boundary=%s

Content-Length: %d

Content-Length: %d

Content-Disposition: form-data; name="%s"

Content-Disposition: form-data; name="%s"

--%s--

--%s--

%s /%s HTTP/1.1

%s /%s HTTP/1.1

Host: %s

Host: %s

User-Agent: %s

User-Agent: %s

%sAccept-Language: %s

%sAccept-Language: %s

HTTP/1.x 301 Moved Permanently

HTTP/1.x 301 Moved Permanently

Server: Apache/2.2.14

Server: Apache/2.2.14

advapi32.dll

advapi32.dll

%CommonProgramFiles%

%CommonProgramFiles%

\/*.*

\/*.*

winlogon.exe

winlogon.exe

csrss.exe

csrss.exe

smss.exe

smss.exe

keyworddestination

keyworddestination

USER PASS

USER PASS

PORT

PORT

RapportGP.dll

RapportGP.dll

csshiftjis

csshiftjis

cswindows31j

cswindows31j

iso_646.irv:1991

iso_646.irv:1991

windows-1250

windows-1250

windows-1251

windows-1251

windows-1252

windows-1252

windows-1253

windows-1253

windows-1254

windows-1254

windows-1255

windows-1255

windows-1256

windows-1256

windows-1257

windows-1257

windows-1258

windows-1258

windows-874

windows-874

hostuser-agentoptionsgetheadpostputdeletetraceacceptaccept-charsetaccept-encodingaccept-languageauthorizationexpectfromhostif-modified-sinceif-matchif-none-matchif-rangeif-unmodifiedsincemax-forwardsproxy-authorizationrangerefererteuser-agent100101200201202203204205206300301302303304305306307400401402403404405406407408409410411412413414415416417500501502503504505accept-rangesageetaglocationproxy-authenticatepublicretry-afterservervarywarningwww-authenticateallowcontent-basecontent-encodingcache-controlconnectiondatetrailertransfer-encodingupgradeviawarningcontent-languagecontent-lengthcontent-locationcontent-md5content-rangecontent-typeetagexpireslast-modifiedset-cookieMondayTuesdayWednesdayThursdayFridaySaturdaySundayJanFebMarAprMayJunJulAugSepOctNovDecchunkedtext/htmlimage/pngimage/jpgimage/gifapplication/xmlapplication/xhtmltext/plainpublicmax-agecharset=iso-8859-1utf-8gzipdeflateHTTP/1.1statusversionurl

hostuser-agentoptionsgetheadpostputdeletetraceacceptaccept-charsetaccept-encodingaccept-languageauthorizationexpectfromhostif-modified-sinceif-matchif-none-matchif-rangeif-unmodifiedsincemax-forwardsproxy-authorizationrangerefererteuser-agent100101200201202203204205206300301302303304305306307400401402403404405406407408409410411412413414415416417500501502503504505accept-rangesageetaglocationproxy-authenticatepublicretry-afterservervarywarningwww-authenticateallowcontent-basecontent-encodingcache-controlconnectiondatetrailertransfer-encodingupgradeviawarningcontent-languagecontent-lengthcontent-locationcontent-md5content-rangecontent-typeetagexpireslast-modifiedset-cookieMondayTuesdayWednesdayThursdayFridaySaturdaySundayJanFebMarAprMayJunJulAugSepOctNovDecchunkedtext/htmlimage/pngimage/jpgimage/gifapplication/xmlapplication/xhtmltext/plainpublicmax-agecharset=iso-8859-1utf-8gzipdeflateHTTP/1.1statusversionurl

HTTP/1.1

HTTP/1.1

\\.\pipe\

\\.\pipe\

gdiplus.dll

gdiplus.dll

GdiplusShutdown

GdiplusShutdown

PTF://%s:%s@%s:%d/

PTF://%s:%s@%s:%d/

pop3://%s:%s@%s:%d/

pop3://%s:%s@%s:%d/

dnsapi.dll

dnsapi.dll

wininet.dll

wininet.dll

HttpOpenRequestA

HttpOpenRequestA

HttpOpenRequestW

HttpOpenRequestW

InternetOpenUrlA

InternetOpenUrlA

InternetOpenUrlW

InternetOpenUrlW

HttpSendRequestA

HttpSendRequestA

HttpSendRequestW

HttpSendRequestW

HttpSendRequestExA

HttpSendRequestExA

HttpSendRequestExW

HttpSendRequestExW

QX .QX hSX B^X ']X

QX .QX hSX B^X ']X

DeleteUrlCacheEntryW

DeleteUrlCacheEntryW

HttpQueryInfoA

HttpQueryInfoA

HttpQueryInfoW

HttpQueryInfoW

GetUrlCacheEntryInfoW

GetUrlCacheEntryInfoW

HttpAddRequestHeadersA

HttpAddRequestHeadersA

HttpAddRequestHeadersW

HttpAddRequestHeadersW

urlmon.dll

urlmon.dll

UrlMkGetSessionOption

UrlMkGetSessionOption

nss3.dll

nss3.dll

PR_OpenTCPSocket

PR_OpenTCPSocket

nspr4.dll

nspr4.dll

hXXps://hXXp://TE

hXXps://hXXp://TE

{49A21781-C39D-B603-C11E-00485360D01E}

{49A21781-C39D-B603-C11E-00485360D01E}

%Documents and Settings%\LocalService\Local Settings\Application Data\iwmikkry.log

%Documents and Settings%\LocalService\Local Settings\Application Data\iwmikkry.log

{49A21783-C39D-B603-C11E-00485360D01E}

{49A21783-C39D-B603-C11E-00485360D01E}

{49A21782-C39D-B603-C11E-00485360D01E}

{49A21782-C39D-B603-C11E-00485360D01E}

PeekNamedPipe

PeekNamedPipe

SetNamedPipeHandleState

SetNamedPipeHandleState

WaitNamedPipeA

WaitNamedPipeA

DisconnectNamedPipe

DisconnectNamedPipe

CreateNamedPipeA

CreateNamedPipeA

ConnectNamedPipe

ConnectNamedPipe

RegCloseKey

RegCloseKey

RegDeleteKeyA

RegDeleteKeyA

RegEnumKeyExA

RegEnumKeyExA

RegOpenKeyExA

RegOpenKeyExA

RegQueryInfoKeyA

RegQueryInfoKeyA

ExitWindowsEx

ExitWindowsEx

GetKeyboardState

GetKeyboardState

.text

.text

`.rdata

`.rdata

@.data

@.data

.reloc

.reloc

|75001234

|75001234

PR_xTCPSh

PR_xTCPSh

wsock32.dll

wsock32.dll

multipart/*boundary={*}application/x-www-form-urlencodedname="{*}"{*}hXXps://hXXp://

multipart/*boundary={*}application/x-www-form-urlencodedname="{*}"{*}hXXps://hXXp://

keywords

keywords

alluniqcontrolexplicitASCIIUTF8UNICODE{keyword}

alluniqcontrolexplicitASCIIUTF8UNICODE{keyword}

set_url

set_url

WebFilters

WebFilters

WebDataFilters

WebDataFilters

WebFakes

WebFakes

|0123456789

|0123456789

gzipdeflateContent-Type: application/x-www-form-urlencoded

gzipdeflateContent-Type: application/x-www-form-urlencoded

Tdomain=google.ru&cookies=enabled&reason=1&auth=false

Tdomain=google.ru&cookies=enabled&reason=1&auth=false

Cookie: User-Agent-Session: Basic login: Basic password:

Cookie: User-Agent-Session: Basic login: Basic password:

lsass.exe_776_rwx_20570000_00037000:

Gh.logWj

Gh.logWj

h.logPj

h.logPj

tcPR

tcPR

h.exe

h.exe

user32.dll

user32.dll

kernel32.dll

kernel32.dll

|GetWindowsDirectoryA

|GetWindowsDirectoryA

{X-X-X-X-XX}

{X-X-X-X-XX}

ntdll.dll

ntdll.dll

shlwapi.dll

shlwapi.dll

SHDeleteKeyA

SHDeleteKeyA

SOFTWARE\Microsoft\Windows\CurrentVersion

SOFTWARE\Microsoft\Windows\CurrentVersion

shell32.dll

shell32.dll

?456789:;

?456789:;

!"#$%&'()* ,-./0123

!"#$%&'()* ,-./0123

ws2_32.dll

ws2_32.dll

HTTP/*.*

HTTP/*.*

/HTTPMozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)

/HTTPMozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)

Referer: %s

Referer: %s

Content-Type: multipart/form-data; boundary=%s

Content-Type: multipart/form-data; boundary=%s

Content-Length: %d

Content-Length: %d

Content-Disposition: form-data; name="%s"

Content-Disposition: form-data; name="%s"

--%s--

--%s--

%s /%s HTTP/1.1

%s /%s HTTP/1.1

Host: %s

Host: %s

User-Agent: %s

User-Agent: %s

%sAccept-Language: %s

%sAccept-Language: %s

HTTP/1.x 301 Moved Permanently

HTTP/1.x 301 Moved Permanently

Server: Apache/2.2.14

Server: Apache/2.2.14

advapi32.dll

advapi32.dll

%CommonProgramFiles%

%CommonProgramFiles%

\/*.*

\/*.*

winlogon.exe

winlogon.exe

csrss.exe

csrss.exe

smss.exe

smss.exe

keyworddestination

keyworddestination

USER PASS

USER PASS

PORT

PORT

RapportGP.dll

RapportGP.dll

csshiftjis

csshiftjis

cswindows31j

cswindows31j

iso_646.irv:1991

iso_646.irv:1991

windows-1250

windows-1250

windows-1251

windows-1251

windows-1252

windows-1252

windows-1253

windows-1253

windows-1254

windows-1254

windows-1255

windows-1255

windows-1256

windows-1256

windows-1257

windows-1257

windows-1258

windows-1258

windows-874

windows-874

hostuser-agentoptionsgetheadpostputdeletetraceacceptaccept-charsetaccept-encodingaccept-languageauthorizationexpectfromhostif-modified-sinceif-matchif-none-matchif-rangeif-unmodifiedsincemax-forwardsproxy-authorizationrangerefererteuser-agent100101200201202203204205206300301302303304305306307400401402403404405406407408409410411412413414415416417500501502503504505accept-rangesageetaglocationproxy-authenticatepublicretry-afterservervarywarningwww-authenticateallowcontent-basecontent-encodingcache-controlconnectiondatetrailertransfer-encodingupgradeviawarningcontent-languagecontent-lengthcontent-locationcontent-md5content-rangecontent-typeetagexpireslast-modifiedset-cookieMondayTuesdayWednesdayThursdayFridaySaturdaySundayJanFebMarAprMayJunJulAugSepOctNovDecchunkedtext/htmlimage/pngimage/jpgimage/gifapplication/xmlapplication/xhtmltext/plainpublicmax-agecharset=iso-8859-1utf-8gzipdeflateHTTP/1.1statusversionurl

hostuser-agentoptionsgetheadpostputdeletetraceacceptaccept-charsetaccept-encodingaccept-languageauthorizationexpectfromhostif-modified-sinceif-matchif-none-matchif-rangeif-unmodifiedsincemax-forwardsproxy-authorizationrangerefererteuser-agent100101200201202203204205206300301302303304305306307400401402403404405406407408409410411412413414415416417500501502503504505accept-rangesageetaglocationproxy-authenticatepublicretry-afterservervarywarningwww-authenticateallowcontent-basecontent-encodingcache-controlconnectiondatetrailertransfer-encodingupgradeviawarningcontent-languagecontent-lengthcontent-locationcontent-md5content-rangecontent-typeetagexpireslast-modifiedset-cookieMondayTuesdayWednesdayThursdayFridaySaturdaySundayJanFebMarAprMayJunJulAugSepOctNovDecchunkedtext/htmlimage/pngimage/jpgimage/gifapplication/xmlapplication/xhtmltext/plainpublicmax-agecharset=iso-8859-1utf-8gzipdeflateHTTP/1.1statusversionurl

HTTP/1.1

HTTP/1.1

\\.\pipe\

\\.\pipe\

gdiplus.dll

gdiplus.dll

GdiplusShutdown

GdiplusShutdown

PTF://%s:%s@%s:%d/

PTF://%s:%s@%s:%d/

pop3://%s:%s@%s:%d/

pop3://%s:%s@%s:%d/

dnsapi.dll

dnsapi.dll

wininet.dll

wininet.dll

HttpOpenRequestA

HttpOpenRequestA

HttpOpenRequestW

HttpOpenRequestW

InternetOpenUrlA

InternetOpenUrlA

InternetOpenUrlW

InternetOpenUrlW

HttpSendRequestA

HttpSendRequestA

HttpSendRequestW

HttpSendRequestW

HttpSendRequestExA

HttpSendRequestExA

HttpSendRequestExW

HttpSendRequestExW

QX .QX hSX B^X ']X

QX .QX hSX B^X ']X

DeleteUrlCacheEntryW

DeleteUrlCacheEntryW

HttpQueryInfoA

HttpQueryInfoA

HttpQueryInfoW

HttpQueryInfoW

GetUrlCacheEntryInfoW

GetUrlCacheEntryInfoW

HttpAddRequestHeadersA

HttpAddRequestHeadersA

HttpAddRequestHeadersW

HttpAddRequestHeadersW

urlmon.dll

urlmon.dll

UrlMkGetSessionOption

UrlMkGetSessionOption

nss3.dll

nss3.dll

PR_OpenTCPSocket

PR_OpenTCPSocket

nspr4.dll

nspr4.dll

hXXps://hXXp://TE

hXXps://hXXp://TE

{49A21781-C39D-B603-C11E-00485360D01E}

{49A21781-C39D-B603-C11E-00485360D01E}

%System%\config\systemprofile\Local Settings\Application Data\iwmikkry.log

%System%\config\systemprofile\Local Settings\Application Data\iwmikkry.log

{49A21783-C39D-B603-C11E-00485360D01E}

{49A21783-C39D-B603-C11E-00485360D01E}

{49A21782-C39D-B603-C11E-00485360D01E}

{49A21782-C39D-B603-C11E-00485360D01E}

PeekNamedPipe

PeekNamedPipe

SetNamedPipeHandleState

SetNamedPipeHandleState

WaitNamedPipeA

WaitNamedPipeA

DisconnectNamedPipe

DisconnectNamedPipe

CreateNamedPipeA

CreateNamedPipeA

ConnectNamedPipe

ConnectNamedPipe

RegCloseKey

RegCloseKey

RegDeleteKeyA

RegDeleteKeyA

RegEnumKeyExA

RegEnumKeyExA

RegOpenKeyExA

RegOpenKeyExA

RegQueryInfoKeyA

RegQueryInfoKeyA

ExitWindowsEx

ExitWindowsEx

GetKeyboardState

GetKeyboardState

.text

.text

`.rdata

`.rdata

@.data

@.data

.reloc

.reloc

|75001234

|75001234

PR_xTCPSh

PR_xTCPSh

wsock32.dll

wsock32.dll

multipart/*boundary={*}application/x-www-form-urlencodedname="{*}"{*}hXXps://hXXp://

multipart/*boundary={*}application/x-www-form-urlencodedname="{*}"{*}hXXps://hXXp://

keywords

keywords

alluniqcontrolexplicitASCIIUTF8UNICODE{keyword}

alluniqcontrolexplicitASCIIUTF8UNICODE{keyword}

set_url

set_url

WebFilters

WebFilters

WebDataFilters

WebDataFilters

WebFakes

WebFakes

|0123456789

|0123456789

gzipdeflateContent-Type: application/x-www-form-urlencoded

gzipdeflateContent-Type: application/x-www-form-urlencoded

Tdomain=google.ru&cookies=enabled&reason=1&auth=false

Tdomain=google.ru&cookies=enabled&reason=1&auth=false

Cookie: User-Agent-Session: Basic login: Basic password:

Cookie: User-Agent-Session: Basic login: Basic password:

wmiprvse.exe_876_rwx_20590000_00037000:

Gh.logWj

Gh.logWj

h.logPj

h.logPj

tcPR

tcPR

h.exe

h.exe

user32.dll

user32.dll

kernel32.dll

kernel32.dll

|GetWindowsDirectoryA

|GetWindowsDirectoryA

{X-X-X-X-XX}

{X-X-X-X-XX}

ntdll.dll

ntdll.dll

shlwapi.dll

shlwapi.dll

SHDeleteKeyA

SHDeleteKeyA

SOFTWARE\Microsoft\Windows\CurrentVersion

SOFTWARE\Microsoft\Windows\CurrentVersion

shell32.dll

shell32.dll

?456789:;

?456789:;

!"#$%&'()* ,-./0123

!"#$%&'()* ,-./0123

ws2_32.dll

ws2_32.dll

HTTP/*.*

HTTP/*.*

/HTTPMozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)

/HTTPMozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)

Referer: %s

Referer: %s

Content-Type: multipart/form-data; boundary=%s

Content-Type: multipart/form-data; boundary=%s

Content-Length: %d

Content-Length: %d

Content-Disposition: form-data; name="%s"

Content-Disposition: form-data; name="%s"

--%s--

--%s--

%s /%s HTTP/1.1

%s /%s HTTP/1.1

Host: %s

Host: %s

User-Agent: %s

User-Agent: %s

%sAccept-Language: %s

%sAccept-Language: %s

HTTP/1.x 301 Moved Permanently

HTTP/1.x 301 Moved Permanently

Server: Apache/2.2.14

Server: Apache/2.2.14

advapi32.dll

advapi32.dll

%CommonProgramFiles%

%CommonProgramFiles%

\/*.*

\/*.*

winlogon.exe

winlogon.exe

csrss.exe

csrss.exe

smss.exe

smss.exe

keyworddestination

keyworddestination

USER PASS

USER PASS

PORT

PORT

RapportGP.dll

RapportGP.dll

csshiftjis

csshiftjis

cswindows31j

cswindows31j

iso_646.irv:1991

iso_646.irv:1991

windows-1250

windows-1250

windows-1251

windows-1251

windows-1252

windows-1252

windows-1253

windows-1253

windows-1254

windows-1254

windows-1255

windows-1255

windows-1256

windows-1256

windows-1257

windows-1257

windows-1258

windows-1258

windows-874

windows-874

hostuser-agentoptionsgetheadpostputdeletetraceacceptaccept-charsetaccept-encodingaccept-languageauthorizationexpectfromhostif-modified-sinceif-matchif-none-matchif-rangeif-unmodifiedsincemax-forwardsproxy-authorizationrangerefererteuser-agent100101200201202203204205206300301302303304305306307400401402403404405406407408409410411412413414415416417500501502503504505accept-rangesageetaglocationproxy-authenticatepublicretry-afterservervarywarningwww-authenticateallowcontent-basecontent-encodingcache-controlconnectiondatetrailertransfer-encodingupgradeviawarningcontent-languagecontent-lengthcontent-locationcontent-md5content-rangecontent-typeetagexpireslast-modifiedset-cookieMondayTuesdayWednesdayThursdayFridaySaturdaySundayJanFebMarAprMayJunJulAugSepOctNovDecchunkedtext/htmlimage/pngimage/jpgimage/gifapplication/xmlapplication/xhtmltext/plainpublicmax-agecharset=iso-8859-1utf-8gzipdeflateHTTP/1.1statusversionurl

hostuser-agentoptionsgetheadpostputdeletetraceacceptaccept-charsetaccept-encodingaccept-languageauthorizationexpectfromhostif-modified-sinceif-matchif-none-matchif-rangeif-unmodifiedsincemax-forwardsproxy-authorizationrangerefererteuser-agent100101200201202203204205206300301302303304305306307400401402403404405406407408409410411412413414415416417500501502503504505accept-rangesageetaglocationproxy-authenticatepublicretry-afterservervarywarningwww-authenticateallowcontent-basecontent-encodingcache-controlconnectiondatetrailertransfer-encodingupgradeviawarningcontent-languagecontent-lengthcontent-locationcontent-md5content-rangecontent-typeetagexpireslast-modifiedset-cookieMondayTuesdayWednesdayThursdayFridaySaturdaySundayJanFebMarAprMayJunJulAugSepOctNovDecchunkedtext/htmlimage/pngimage/jpgimage/gifapplication/xmlapplication/xhtmltext/plainpublicmax-agecharset=iso-8859-1utf-8gzipdeflateHTTP/1.1statusversionurl

HTTP/1.1

HTTP/1.1

\\.\pipe\

\\.\pipe\

gdiplus.dll

gdiplus.dll

GdiplusShutdown

GdiplusShutdown

PTF://%s:%s@%s:%d/

PTF://%s:%s@%s:%d/

pop3://%s:%s@%s:%d/

pop3://%s:%s@%s:%d/

dnsapi.dll

dnsapi.dll

wininet.dll

wininet.dll

HttpOpenRequestA

HttpOpenRequestA

HttpOpenRequestW

HttpOpenRequestW

InternetOpenUrlA

InternetOpenUrlA

InternetOpenUrlW

InternetOpenUrlW

HttpSendRequestA

HttpSendRequestA

HttpSendRequestW

HttpSendRequestW

HttpSendRequestExA

HttpSendRequestExA

HttpSendRequestExW

HttpSendRequestExW

QZ .QZ hSZ B^Z ']Z

QZ .QZ hSZ B^Z ']Z

DeleteUrlCacheEntryW

DeleteUrlCacheEntryW

HttpQueryInfoA

HttpQueryInfoA

HttpQueryInfoW

HttpQueryInfoW

GetUrlCacheEntryInfoW

GetUrlCacheEntryInfoW

HttpAddRequestHeadersA

HttpAddRequestHeadersA

HttpAddRequestHeadersW

HttpAddRequestHeadersW

urlmon.dll

urlmon.dll

UrlMkGetSessionOption

UrlMkGetSessionOption

nss3.dll

nss3.dll

PR_OpenTCPSocket

PR_OpenTCPSocket

nspr4.dll

nspr4.dll

hXXps://hXXp://TE

hXXps://hXXp://TE

{49A21781-C39D-B603-C11E-00485360D01E}

{49A21781-C39D-B603-C11E-00485360D01E}

%System%\config\systemprofile\Local Settings\Application Data\iwmikkry.log

%System%\config\systemprofile\Local Settings\Application Data\iwmikkry.log

{49A21783-C39D-B603-C11E-00485360D01E}

{49A21783-C39D-B603-C11E-00485360D01E}

{49A21782-C39D-B603-C11E-00485360D01E}

{49A21782-C39D-B603-C11E-00485360D01E}

PeekNamedPipe

PeekNamedPipe

SetNamedPipeHandleState

SetNamedPipeHandleState

WaitNamedPipeA

WaitNamedPipeA

DisconnectNamedPipe

DisconnectNamedPipe

CreateNamedPipeA

CreateNamedPipeA

ConnectNamedPipe

ConnectNamedPipe

RegCloseKey

RegCloseKey

RegDeleteKeyA

RegDeleteKeyA

RegEnumKeyExA

RegEnumKeyExA

RegOpenKeyExA

RegOpenKeyExA

RegQueryInfoKeyA

RegQueryInfoKeyA

ExitWindowsEx

ExitWindowsEx

GetKeyboardState

GetKeyboardState

.text

.text

`.rdata

`.rdata

@.data

@.data

.reloc

.reloc

|75001234

|75001234

PR_xTCPSh

PR_xTCPSh

wsock32.dll

wsock32.dll

multipart/*boundary={*}application/x-www-form-urlencodedname="{*}"{*}hXXps://hXXp://

multipart/*boundary={*}application/x-www-form-urlencodedname="{*}"{*}hXXps://hXXp://

keywords

keywords

alluniqcontrolexplicitASCIIUTF8UNICODE{keyword}

alluniqcontrolexplicitASCIIUTF8UNICODE{keyword}

set_url

set_url

WebFilters

WebFilters

WebDataFilters

WebDataFilters

WebFakes

WebFakes

|0123456789

|0123456789

gzipdeflateContent-Type: application/x-www-form-urlencoded

gzipdeflateContent-Type: application/x-www-form-urlencoded

Tdomain=google.ru&cookies=enabled&reason=1&auth=false

Tdomain=google.ru&cookies=enabled&reason=1&auth=false

Cookie: User-Agent-Session: Basic login: Basic password:

Cookie: User-Agent-Session: Basic login: Basic password:

svchost.exe_960_rwx_20590000_00037000:

Gh.logWj

Gh.logWj

h.logPj

h.logPj

tcPR

tcPR

h.exe

h.exe

user32.dll

user32.dll

kernel32.dll

kernel32.dll

|GetWindowsDirectoryA

|GetWindowsDirectoryA

{X-X-X-X-XX}

{X-X-X-X-XX}

ntdll.dll

ntdll.dll

shlwapi.dll

shlwapi.dll

SHDeleteKeyA

SHDeleteKeyA

SOFTWARE\Microsoft\Windows\CurrentVersion

SOFTWARE\Microsoft\Windows\CurrentVersion

shell32.dll

shell32.dll

?456789:;

?456789:;

!"#$%&'()* ,-./0123

!"#$%&'()* ,-./0123

ws2_32.dll

ws2_32.dll

HTTP/*.*

HTTP/*.*

/HTTPMozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)

/HTTPMozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)

Referer: %s

Referer: %s

Content-Type: multipart/form-data; boundary=%s

Content-Type: multipart/form-data; boundary=%s

Content-Length: %d

Content-Length: %d

Content-Disposition: form-data; name="%s"

Content-Disposition: form-data; name="%s"

--%s--

--%s--

%s /%s HTTP/1.1

%s /%s HTTP/1.1

Host: %s

Host: %s

User-Agent: %s

User-Agent: %s

%sAccept-Language: %s

%sAccept-Language: %s

HTTP/1.x 301 Moved Permanently

HTTP/1.x 301 Moved Permanently

Server: Apache/2.2.14

Server: Apache/2.2.14

advapi32.dll

advapi32.dll

%CommonProgramFiles%

%CommonProgramFiles%

\/*.*

\/*.*

winlogon.exe

winlogon.exe

csrss.exe

csrss.exe

smss.exe

smss.exe

keyworddestination

keyworddestination

USER PASS

USER PASS

PORT

PORT

RapportGP.dll

RapportGP.dll

csshiftjis

csshiftjis

cswindows31j

cswindows31j

iso_646.irv:1991

iso_646.irv:1991

windows-1250

windows-1250

windows-1251

windows-1251

windows-1252

windows-1252

windows-1253

windows-1253

windows-1254

windows-1254

windows-1255

windows-1255

windows-1256

windows-1256

windows-1257

windows-1257

windows-1258

windows-1258

windows-874

windows-874

hostuser-agentoptionsgetheadpostputdeletetraceacceptaccept-charsetaccept-encodingaccept-languageauthorizationexpectfromhostif-modified-sinceif-matchif-none-matchif-rangeif-unmodifiedsincemax-forwardsproxy-authorizationrangerefererteuser-agent100101200201202203204205206300301302303304305306307400401402403404405406407408409410411412413414415416417500501502503504505accept-rangesageetaglocationproxy-authenticatepublicretry-afterservervarywarningwww-authenticateallowcontent-basecontent-encodingcache-controlconnectiondatetrailertransfer-encodingupgradeviawarningcontent-languagecontent-lengthcontent-locationcontent-md5content-rangecontent-typeetagexpireslast-modifiedset-cookieMondayTuesdayWednesdayThursdayFridaySaturdaySundayJanFebMarAprMayJunJulAugSepOctNovDecchunkedtext/htmlimage/pngimage/jpgimage/gifapplication/xmlapplication/xhtmltext/plainpublicmax-agecharset=iso-8859-1utf-8gzipdeflateHTTP/1.1statusversionurl

hostuser-agentoptionsgetheadpostputdeletetraceacceptaccept-charsetaccept-encodingaccept-languageauthorizationexpectfromhostif-modified-sinceif-matchif-none-matchif-rangeif-unmodifiedsincemax-forwardsproxy-authorizationrangerefererteuser-agent100101200201202203204205206300301302303304305306307400401402403404405406407408409410411412413414415416417500501502503504505accept-rangesageetaglocationproxy-authenticatepublicretry-afterservervarywarningwww-authenticateallowcontent-basecontent-encodingcache-controlconnectiondatetrailertransfer-encodingupgradeviawarningcontent-languagecontent-lengthcontent-locationcontent-md5content-rangecontent-typeetagexpireslast-modifiedset-cookieMondayTuesdayWednesdayThursdayFridaySaturdaySundayJanFebMarAprMayJunJulAugSepOctNovDecchunkedtext/htmlimage/pngimage/jpgimage/gifapplication/xmlapplication/xhtmltext/plainpublicmax-agecharset=iso-8859-1utf-8gzipdeflateHTTP/1.1statusversionurl

HTTP/1.1

HTTP/1.1

\\.\pipe\

\\.\pipe\

gdiplus.dll

gdiplus.dll

GdiplusShutdown

GdiplusShutdown

PTF://%s:%s@%s:%d/

PTF://%s:%s@%s:%d/

pop3://%s:%s@%s:%d/

pop3://%s:%s@%s:%d/

dnsapi.dll

dnsapi.dll

wininet.dll

wininet.dll

HttpOpenRequestA

HttpOpenRequestA

HttpOpenRequestW

HttpOpenRequestW

InternetOpenUrlA

InternetOpenUrlA

InternetOpenUrlW

InternetOpenUrlW

HttpSendRequestA

HttpSendRequestA

HttpSendRequestW

HttpSendRequestW

HttpSendRequestExA

HttpSendRequestExA

HttpSendRequestExW

HttpSendRequestExW

QZ .QZ hSZ B^Z ']Z

QZ .QZ hSZ B^Z ']Z

DeleteUrlCacheEntryW

DeleteUrlCacheEntryW

HttpQueryInfoA

HttpQueryInfoA

HttpQueryInfoW

HttpQueryInfoW

GetUrlCacheEntryInfoW

GetUrlCacheEntryInfoW

HttpAddRequestHeadersA

HttpAddRequestHeadersA

HttpAddRequestHeadersW

HttpAddRequestHeadersW

urlmon.dll

urlmon.dll

UrlMkGetSessionOption

UrlMkGetSessionOption

nss3.dll

nss3.dll

PR_OpenTCPSocket

PR_OpenTCPSocket

nspr4.dll

nspr4.dll

hXXps://hXXp://TE

hXXps://hXXp://TE

{49A21781-C39D-B603-C11E-00485360D01E}

{49A21781-C39D-B603-C11E-00485360D01E}

%System%\config\systemprofile\Local Settings\Application Data\iwmikkry.log

%System%\config\systemprofile\Local Settings\Application Data\iwmikkry.log

{49A21783-C39D-B603-C11E-00485360D01E}

{49A21783-C39D-B603-C11E-00485360D01E}

{49A21782-C39D-B603-C11E-00485360D01E}

{49A21782-C39D-B603-C11E-00485360D01E}

PeekNamedPipe

PeekNamedPipe

SetNamedPipeHandleState

SetNamedPipeHandleState

WaitNamedPipeA

WaitNamedPipeA

DisconnectNamedPipe

DisconnectNamedPipe

CreateNamedPipeA

CreateNamedPipeA

ConnectNamedPipe

ConnectNamedPipe

RegCloseKey

RegCloseKey

RegDeleteKeyA

RegDeleteKeyA

RegEnumKeyExA

RegEnumKeyExA

RegOpenKeyExA

RegOpenKeyExA

RegQueryInfoKeyA

RegQueryInfoKeyA

ExitWindowsEx

ExitWindowsEx

GetKeyboardState

GetKeyboardState

.text

.text

`.rdata

`.rdata

@.data

@.data

.reloc

.reloc

|75001234

|75001234

PR_xTCPSh

PR_xTCPSh

wsock32.dll

wsock32.dll

multipart/*boundary={*}application/x-www-form-urlencodedname="{*}"{*}hXXps://hXXp://

multipart/*boundary={*}application/x-www-form-urlencodedname="{*}"{*}hXXps://hXXp://

keywords

keywords

alluniqcontrolexplicitASCIIUTF8UNICODE{keyword}

alluniqcontrolexplicitASCIIUTF8UNICODE{keyword}

set_url

set_url

WebFilters

WebFilters

WebDataFilters

WebDataFilters

WebFakes

WebFakes

|0123456789

|0123456789

gzipdeflateContent-Type: application/x-www-form-urlencoded

gzipdeflateContent-Type: application/x-www-form-urlencoded

Tdomain=google.ru&cookies=enabled&reason=1&auth=false

Tdomain=google.ru&cookies=enabled&reason=1&auth=false

Cookie: User-Agent-Session: Basic login: Basic password:

Cookie: User-Agent-Session: Basic login: Basic password:

svchost.exe_1028_rwx_20590000_00037000:

Gh.logWj

Gh.logWj

h.logPj

h.logPj

tcPR

tcPR

h.exe

h.exe

user32.dll

user32.dll

kernel32.dll

kernel32.dll

|GetWindowsDirectoryA

|GetWindowsDirectoryA

{X-X-X-X-XX}

{X-X-X-X-XX}

ntdll.dll

ntdll.dll

shlwapi.dll

shlwapi.dll

SHDeleteKeyA

SHDeleteKeyA

SOFTWARE\Microsoft\Windows\CurrentVersion

SOFTWARE\Microsoft\Windows\CurrentVersion

shell32.dll

shell32.dll

?456789:;

?456789:;

!"#$%&'()* ,-./0123

!"#$%&'()* ,-./0123

ws2_32.dll

ws2_32.dll

HTTP/*.*

HTTP/*.*

/HTTPMozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)

/HTTPMozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)

Referer: %s

Referer: %s

Content-Type: multipart/form-data; boundary=%s

Content-Type: multipart/form-data; boundary=%s

Content-Length: %d

Content-Length: %d

Content-Disposition: form-data; name="%s"

Content-Disposition: form-data; name="%s"

--%s--

--%s--

%s /%s HTTP/1.1

%s /%s HTTP/1.1

Host: %s

Host: %s

User-Agent: %s

User-Agent: %s

%sAccept-Language: %s

%sAccept-Language: %s

HTTP/1.x 301 Moved Permanently

HTTP/1.x 301 Moved Permanently

Server: Apache/2.2.14

Server: Apache/2.2.14

advapi32.dll

advapi32.dll

%CommonProgramFiles%

%CommonProgramFiles%

\/*.*

\/*.*

winlogon.exe

winlogon.exe

csrss.exe

csrss.exe

smss.exe

smss.exe

keyworddestination

keyworddestination

USER PASS

USER PASS

PORT

PORT

RapportGP.dll

RapportGP.dll

csshiftjis

csshiftjis

cswindows31j

cswindows31j

iso_646.irv:1991

iso_646.irv:1991

windows-1250

windows-1250

windows-1251

windows-1251

windows-1252

windows-1252

windows-1253

windows-1253

windows-1254

windows-1254

windows-1255

windows-1255

windows-1256

windows-1256

windows-1257

windows-1257

windows-1258

windows-1258

windows-874

windows-874

hostuser-agentoptionsgetheadpostputdeletetraceacceptaccept-charsetaccept-encodingaccept-languageauthorizationexpectfromhostif-modified-sinceif-matchif-none-matchif-rangeif-unmodifiedsincemax-forwardsproxy-authorizationrangerefererteuser-agent100101200201202203204205206300301302303304305306307400401402403404405406407408409410411412413414415416417500501502503504505accept-rangesageetaglocationproxy-authenticatepublicretry-afterservervarywarningwww-authenticateallowcontent-basecontent-encodingcache-controlconnectiondatetrailertransfer-encodingupgradeviawarningcontent-languagecontent-lengthcontent-locationcontent-md5content-rangecontent-typeetagexpireslast-modifiedset-cookieMondayTuesdayWednesdayThursdayFridaySaturdaySundayJanFebMarAprMayJunJulAugSepOctNovDecchunkedtext/htmlimage/pngimage/jpgimage/gifapplication/xmlapplication/xhtmltext/plainpublicmax-agecharset=iso-8859-1utf-8gzipdeflateHTTP/1.1statusversionurl

hostuser-agentoptionsgetheadpostputdeletetraceacceptaccept-charsetaccept-encodingaccept-languageauthorizationexpectfromhostif-modified-sinceif-matchif-none-matchif-rangeif-unmodifiedsincemax-forwardsproxy-authorizationrangerefererteuser-agent100101200201202203204205206300301302303304305306307400401402403404405406407408409410411412413414415416417500501502503504505accept-rangesageetaglocationproxy-authenticatepublicretry-afterservervarywarningwww-authenticateallowcontent-basecontent-encodingcache-controlconnectiondatetrailertransfer-encodingupgradeviawarningcontent-languagecontent-lengthcontent-locationcontent-md5content-rangecontent-typeetagexpireslast-modifiedset-cookieMondayTuesdayWednesdayThursdayFridaySaturdaySundayJanFebMarAprMayJunJulAugSepOctNovDecchunkedtext/htmlimage/pngimage/jpgimage/gifapplication/xmlapplication/xhtmltext/plainpublicmax-agecharset=iso-8859-1utf-8gzipdeflateHTTP/1.1statusversionurl

HTTP/1.1

HTTP/1.1

\\.\pipe\

\\.\pipe\

gdiplus.dll

gdiplus.dll

GdiplusShutdown

GdiplusShutdown

PTF://%s:%s@%s:%d/

PTF://%s:%s@%s:%d/

pop3://%s:%s@%s:%d/

pop3://%s:%s@%s:%d/

dnsapi.dll

dnsapi.dll

wininet.dll

wininet.dll

HttpOpenRequestA

HttpOpenRequestA

HttpOpenRequestW

HttpOpenRequestW

InternetOpenUrlA

InternetOpenUrlA

InternetOpenUrlW

InternetOpenUrlW

HttpSendRequestA

HttpSendRequestA

HttpSendRequestW

HttpSendRequestW

HttpSendRequestExA

HttpSendRequestExA

HttpSendRequestExW

HttpSendRequestExW

QZ .QZ hSZ B^Z ']Z

QZ .QZ hSZ B^Z ']Z

DeleteUrlCacheEntryW

DeleteUrlCacheEntryW

HttpQueryInfoA

HttpQueryInfoA

HttpQueryInfoW

HttpQueryInfoW

GetUrlCacheEntryInfoW

GetUrlCacheEntryInfoW

HttpAddRequestHeadersA

HttpAddRequestHeadersA

HttpAddRequestHeadersW

HttpAddRequestHeadersW

urlmon.dll

urlmon.dll

UrlMkGetSessionOption

UrlMkGetSessionOption

nss3.dll

nss3.dll

PR_OpenTCPSocket

PR_OpenTCPSocket

nspr4.dll

nspr4.dll

hXXps://hXXp://TE

hXXps://hXXp://TE

{49A21781-C39D-B603-C11E-00485360D01E}

{49A21781-C39D-B603-C11E-00485360D01E}

%Documents and Settings%\NetworkService\Local Settings\Application Data\iwmikkry.log

%Documents and Settings%\NetworkService\Local Settings\Application Data\iwmikkry.log

{49A21783-C39D-B603-C11E-00485360D01E}

{49A21783-C39D-B603-C11E-00485360D01E}

{49A21782-C39D-B603-C11E-00485360D01E}

{49A21782-C39D-B603-C11E-00485360D01E}

PeekNamedPipe

PeekNamedPipe

SetNamedPipeHandleState

SetNamedPipeHandleState

WaitNamedPipeA

WaitNamedPipeA

DisconnectNamedPipe

DisconnectNamedPipe

CreateNamedPipeA

CreateNamedPipeA

ConnectNamedPipe

ConnectNamedPipe

RegCloseKey

RegCloseKey

RegDeleteKeyA

RegDeleteKeyA

RegEnumKeyExA

RegEnumKeyExA

RegOpenKeyExA

RegOpenKeyExA

RegQueryInfoKeyA

RegQueryInfoKeyA

ExitWindowsEx

ExitWindowsEx

GetKeyboardState

GetKeyboardState

.text

.text

`.rdata

`.rdata

@.data

@.data

.reloc

.reloc

|75001234

|75001234

PR_xTCPSh

PR_xTCPSh

wsock32.dll

wsock32.dll

multipart/*boundary={*}application/x-www-form-urlencodedname="{*}"{*}hXXps://hXXp://

multipart/*boundary={*}application/x-www-form-urlencodedname="{*}"{*}hXXps://hXXp://

keywords

keywords

alluniqcontrolexplicitASCIIUTF8UNICODE{keyword}

alluniqcontrolexplicitASCIIUTF8UNICODE{keyword}

set_url

set_url

WebFilters

WebFilters

WebDataFilters

WebDataFilters

WebFakes

WebFakes

|0123456789

|0123456789

gzipdeflateContent-Type: application/x-www-form-urlencoded

gzipdeflateContent-Type: application/x-www-form-urlencoded

Tdomain=google.ru&cookies=enabled&reason=1&auth=false

Tdomain=google.ru&cookies=enabled&reason=1&auth=false

Cookie: User-Agent-Session: Basic login: Basic password:

Cookie: User-Agent-Session: Basic login: Basic password:

svchost.exe_1116_rwx_20590000_00037000:

Gh.logWj

Gh.logWj

h.logPj

h.logPj

tcPR

tcPR

h.exe

h.exe

user32.dll

user32.dll

kernel32.dll

kernel32.dll

|GetWindowsDirectoryA

|GetWindowsDirectoryA

{X-X-X-X-XX}

{X-X-X-X-XX}

ntdll.dll

ntdll.dll

shlwapi.dll

shlwapi.dll

SHDeleteKeyA

SHDeleteKeyA

SOFTWARE\Microsoft\Windows\CurrentVersion

SOFTWARE\Microsoft\Windows\CurrentVersion

shell32.dll

shell32.dll

?456789:;

?456789:;

!"#$%&'()* ,-./0123

!"#$%&'()* ,-./0123

ws2_32.dll

ws2_32.dll

HTTP/*.*

HTTP/*.*

/HTTPMozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)

/HTTPMozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)

Referer: %s

Referer: %s

Content-Type: multipart/form-data; boundary=%s

Content-Type: multipart/form-data; boundary=%s

Content-Length: %d

Content-Length: %d

Content-Disposition: form-data; name="%s"

Content-Disposition: form-data; name="%s"

--%s--

--%s--

%s /%s HTTP/1.1

%s /%s HTTP/1.1

Host: %s

Host: %s

User-Agent: %s

User-Agent: %s

%sAccept-Language: %s

%sAccept-Language: %s

HTTP/1.x 301 Moved Permanently

HTTP/1.x 301 Moved Permanently

Server: Apache/2.2.14

Server: Apache/2.2.14

advapi32.dll

advapi32.dll

%CommonProgramFiles%

%CommonProgramFiles%

\/*.*

\/*.*

winlogon.exe

winlogon.exe

csrss.exe

csrss.exe

smss.exe

smss.exe

keyworddestination

keyworddestination

USER PASS

USER PASS

PORT

PORT

RapportGP.dll

RapportGP.dll

csshiftjis

csshiftjis

cswindows31j

cswindows31j

iso_646.irv:1991

iso_646.irv:1991

windows-1250

windows-1250

windows-1251

windows-1251

windows-1252

windows-1252

windows-1253

windows-1253

windows-1254

windows-1254

windows-1255

windows-1255

windows-1256

windows-1256

windows-1257

windows-1257

windows-1258

windows-1258

windows-874

windows-874

hostuser-agentoptionsgetheadpostputdeletetraceacceptaccept-charsetaccept-encodingaccept-languageauthorizationexpectfromhostif-modified-sinceif-matchif-none-matchif-rangeif-unmodifiedsincemax-forwardsproxy-authorizationrangerefererteuser-agent100101200201202203204205206300301302303304305306307400401402403404405406407408409410411412413414415416417500501502503504505accept-rangesageetaglocationproxy-authenticatepublicretry-afterservervarywarningwww-authenticateallowcontent-basecontent-encodingcache-controlconnectiondatetrailertransfer-encodingupgradeviawarningcontent-languagecontent-lengthcontent-locationcontent-md5content-rangecontent-typeetagexpireslast-modifiedset-cookieMondayTuesdayWednesdayThursdayFridaySaturdaySundayJanFebMarAprMayJunJulAugSepOctNovDecchunkedtext/htmlimage/pngimage/jpgimage/gifapplication/xmlapplication/xhtmltext/plainpublicmax-agecharset=iso-8859-1utf-8gzipdeflateHTTP/1.1statusversionurl

hostuser-agentoptionsgetheadpostputdeletetraceacceptaccept-charsetaccept-encodingaccept-languageauthorizationexpectfromhostif-modified-sinceif-matchif-none-matchif-rangeif-unmodifiedsincemax-forwardsproxy-authorizationrangerefererteuser-agent100101200201202203204205206300301302303304305306307400401402403404405406407408409410411412413414415416417500501502503504505accept-rangesageetaglocationproxy-authenticatepublicretry-afterservervarywarningwww-authenticateallowcontent-basecontent-encodingcache-controlconnectiondatetrailertransfer-encodingupgradeviawarningcontent-languagecontent-lengthcontent-locationcontent-md5content-rangecontent-typeetagexpireslast-modifiedset-cookieMondayTuesdayWednesdayThursdayFridaySaturdaySundayJanFebMarAprMayJunJulAugSepOctNovDecchunkedtext/htmlimage/pngimage/jpgimage/gifapplication/xmlapplication/xhtmltext/plainpublicmax-agecharset=iso-8859-1utf-8gzipdeflateHTTP/1.1statusversionurl

HTTP/1.1

HTTP/1.1

\\.\pipe\

\\.\pipe\

gdiplus.dll

gdiplus.dll

GdiplusShutdown

GdiplusShutdown

PTF://%s:%s@%s:%d/

PTF://%s:%s@%s:%d/

pop3://%s:%s@%s:%d/

pop3://%s:%s@%s:%d/

dnsapi.dll

dnsapi.dll

wininet.dll

wininet.dll

HttpOpenRequestA

HttpOpenRequestA

HttpOpenRequestW

HttpOpenRequestW

InternetOpenUrlA

InternetOpenUrlA

InternetOpenUrlW

InternetOpenUrlW

HttpSendRequestA

HttpSendRequestA

HttpSendRequestW

HttpSendRequestW

HttpSendRequestExA

HttpSendRequestExA

HttpSendRequestExW

HttpSendRequestExW

QZ .QZ hSZ B^Z ']Z

QZ .QZ hSZ B^Z ']Z

DeleteUrlCacheEntryW

DeleteUrlCacheEntryW

HttpQueryInfoA

HttpQueryInfoA

HttpQueryInfoW

HttpQueryInfoW

GetUrlCacheEntryInfoW

GetUrlCacheEntryInfoW

HttpAddRequestHeadersA

HttpAddRequestHeadersA

HttpAddRequestHeadersW

HttpAddRequestHeadersW

wurlmon.dll

wurlmon.dll

UrlMkGetSessionOption

UrlMkGetSessionOption

nss3.dll

nss3.dll

PR_OpenTCPSocket

PR_OpenTCPSocket

nspr4.dll

nspr4.dll

hXXps://hXXp://TE

hXXps://hXXp://TE

{49A21781-C39D-B603-C11E-00485360D01E}

{49A21781-C39D-B603-C11E-00485360D01E}

%Documents and Settings%\NetworkService\Local Settings\Application Data\iwmikkry.log

%Documents and Settings%\NetworkService\Local Settings\Application Data\iwmikkry.log

{49A21783-C39D-B603-C11E-00485360D01E}

{49A21783-C39D-B603-C11E-00485360D01E}

{49A21782-C39D-B603-C11E-00485360D01E}

{49A21782-C39D-B603-C11E-00485360D01E}

PeekNamedPipe

PeekNamedPipe

SetNamedPipeHandleState

SetNamedPipeHandleState

WaitNamedPipeA

WaitNamedPipeA

DisconnectNamedPipe

DisconnectNamedPipe

CreateNamedPipeA

CreateNamedPipeA

ConnectNamedPipe

ConnectNamedPipe

RegCloseKey

RegCloseKey

RegDeleteKeyA

RegDeleteKeyA

RegEnumKeyExA

RegEnumKeyExA

RegOpenKeyExA

RegOpenKeyExA

RegQueryInfoKeyA

RegQueryInfoKeyA

ExitWindowsEx

ExitWindowsEx

GetKeyboardState

GetKeyboardState

.text

.text

`.rdata

`.rdata

@.data

@.data

.reloc

.reloc

|75001234

|75001234

PR_xTCPSh

PR_xTCPSh

wsock32.dll

wsock32.dll

multipart/*boundary={*}application/x-www-form-urlencodedname="{*}"{*}hXXps://hXXp://

multipart/*boundary={*}application/x-www-form-urlencodedname="{*}"{*}hXXps://hXXp://

keywords

keywords

alluniqcontrolexplicitASCIIUTF8UNICODE{keyword}

alluniqcontrolexplicitASCIIUTF8UNICODE{keyword}

set_url

set_url

WebFilters

WebFilters

WebDataFilters

WebDataFilters

WebFakes

WebFakes

|0123456789

|0123456789

gzipdeflateContent-Type: application/x-www-form-urlencoded

gzipdeflateContent-Type: application/x-www-form-urlencoded

Tdomain=google.ru&cookies=enabled&reason=1&auth=false

Tdomain=google.ru&cookies=enabled&reason=1&auth=false

Cookie: User-Agent-Session: Basic login: Basic password:

Cookie: User-Agent-Session: Basic login: Basic password:

svchost.exe_1160_rwx_20590000_00037000:

Gh.logWj

Gh.logWj

h.logPj

h.logPj

tcPR

tcPR

h.exe

h.exe

user32.dll

user32.dll

kernel32.dll

kernel32.dll

|GetWindowsDirectoryA

|GetWindowsDirectoryA

{X-X-X-X-XX}

{X-X-X-X-XX}

ntdll.dll

ntdll.dll

shlwapi.dll

shlwapi.dll

SHDeleteKeyA

SHDeleteKeyA

SOFTWARE\Microsoft\Windows\CurrentVersion

SOFTWARE\Microsoft\Windows\CurrentVersion

shell32.dll

shell32.dll

?456789:;

?456789:;

!"#$%&'()* ,-./0123

!"#$%&'()* ,-./0123

ws2_32.dll

ws2_32.dll

HTTP/*.*

HTTP/*.*

/HTTPMozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)

/HTTPMozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)

Referer: %s

Referer: %s

Content-Type: multipart/form-data; boundary=%s

Content-Type: multipart/form-data; boundary=%s

Content-Length: %d

Content-Length: %d

Content-Disposition: form-data; name="%s"

Content-Disposition: form-data; name="%s"

--%s--

--%s--

%s /%s HTTP/1.1

%s /%s HTTP/1.1

Host: %s

Host: %s

User-Agent: %s

User-Agent: %s

%sAccept-Language: %s

%sAccept-Language: %s

HTTP/1.x 301 Moved Permanently

HTTP/1.x 301 Moved Permanently

Server: Apache/2.2.14

Server: Apache/2.2.14

advapi32.dll

advapi32.dll

%CommonProgramFiles%

%CommonProgramFiles%

\/*.*

\/*.*

winlogon.exe

winlogon.exe

csrss.exe

csrss.exe

smss.exe

smss.exe

keyworddestination

keyworddestination

USER PASS

USER PASS

PORT

PORT

RapportGP.dll

RapportGP.dll

csshiftjis

csshiftjis

cswindows31j

cswindows31j

iso_646.irv:1991

iso_646.irv:1991

windows-1250

windows-1250

windows-1251

windows-1251

windows-1252

windows-1252

windows-1253

windows-1253

windows-1254

windows-1254

windows-1255

windows-1255

windows-1256

windows-1256

windows-1257

windows-1257

windows-1258

windows-1258

windows-874

windows-874

hostuser-agentoptionsgetheadpostputdeletetraceacceptaccept-charsetaccept-encodingaccept-languageauthorizationexpectfromhostif-modified-sinceif-matchif-none-matchif-rangeif-unmodifiedsincemax-forwardsproxy-authorizationrangerefererteuser-agent100101200201202203204205206300301302303304305306307400401402403404405406407408409410411412413414415416417500501502503504505accept-rangesageetaglocationproxy-authenticatepublicretry-afterservervarywarningwww-authenticateallowcontent-basecontent-encodingcache-controlconnectiondatetrailertransfer-encodingupgradeviawarningcontent-languagecontent-lengthcontent-locationcontent-md5content-rangecontent-typeetagexpireslast-modifiedset-cookieMondayTuesdayWednesdayThursdayFridaySaturdaySundayJanFebMarAprMayJunJulAugSepOctNovDecchunkedtext/htmlimage/pngimage/jpgimage/gifapplication/xmlapplication/xhtmltext/plainpublicmax-agecharset=iso-8859-1utf-8gzipdeflateHTTP/1.1statusversionurl

hostuser-agentoptionsgetheadpostputdeletetraceacceptaccept-charsetaccept-encodingaccept-languageauthorizationexpectfromhostif-modified-sinceif-matchif-none-matchif-rangeif-unmodifiedsincemax-forwardsproxy-authorizationrangerefererteuser-agent100101200201202203204205206300301302303304305306307400401402403404405406407408409410411412413414415416417500501502503504505accept-rangesageetaglocationproxy-authenticatepublicretry-afterservervarywarningwww-authenticateallowcontent-basecontent-encodingcache-controlconnectiondatetrailertransfer-encodingupgradeviawarningcontent-languagecontent-lengthcontent-locationcontent-md5content-rangecontent-typeetagexpireslast-modifiedset-cookieMondayTuesdayWednesdayThursdayFridaySaturdaySundayJanFebMarAprMayJunJulAugSepOctNovDecchunkedtext/htmlimage/pngimage/jpgimage/gifapplication/xmlapplication/xhtmltext/plainpublicmax-agecharset=iso-8859-1utf-8gzipdeflateHTTP/1.1statusversionurl

HTTP/1.1

HTTP/1.1

\\.\pipe\

\\.\pipe\

gdiplus.dll

gdiplus.dll

GdiplusShutdown

GdiplusShutdown

PTF://%s:%s@%s:%d/

PTF://%s:%s@%s:%d/

pop3://%s:%s@%s:%d/

pop3://%s:%s@%s:%d/

dnsapi.dll

dnsapi.dll

wininet.dll

wininet.dll

HttpOpenRequestA

HttpOpenRequestA

HttpOpenRequestW

HttpOpenRequestW

InternetOpenUrlA

InternetOpenUrlA

InternetOpenUrlW

InternetOpenUrlW

HttpSendRequestA

HttpSendRequestA

HttpSendRequestW

HttpSendRequestW

HttpSendRequestExA

HttpSendRequestExA

HttpSendRequestExW

HttpSendRequestExW

QZ .QZ hSZ B^Z ']Z

QZ .QZ hSZ B^Z ']Z

DeleteUrlCacheEntryW

DeleteUrlCacheEntryW

HttpQueryInfoA

HttpQueryInfoA

HttpQueryInfoW

HttpQueryInfoW

GetUrlCacheEntryInfoW

GetUrlCacheEntryInfoW

HttpAddRequestHeadersA

HttpAddRequestHeadersA

HttpAddRequestHeadersW

HttpAddRequestHeadersW

urlmon.dll

urlmon.dll

UrlMkGetSessionOption

UrlMkGetSessionOption

nss3.dll

nss3.dll

PR_OpenTCPSocket

PR_OpenTCPSocket

nspr4.dll

nspr4.dll

hXXps://hXXp://TE

hXXps://hXXp://TE

{49A21781-C39D-B603-C11E-00485360D01E}

{49A21781-C39D-B603-C11E-00485360D01E}

%Documents and Settings%\NetworkService\Local Settings\Application Data\iwmikkry.log

%Documents and Settings%\NetworkService\Local Settings\Application Data\iwmikkry.log

{49A21783-C39D-B603-C11E-00485360D01E}

{49A21783-C39D-B603-C11E-00485360D01E}

{49A21782-C39D-B603-C11E-00485360D01E}

{49A21782-C39D-B603-C11E-00485360D01E}

PeekNamedPipe

PeekNamedPipe

SetNamedPipeHandleState

SetNamedPipeHandleState

WaitNamedPipeA

WaitNamedPipeA

DisconnectNamedPipe

DisconnectNamedPipe

CreateNamedPipeA

CreateNamedPipeA

ConnectNamedPipe

ConnectNamedPipe

RegCloseKey

RegCloseKey

RegDeleteKeyA

RegDeleteKeyA

RegEnumKeyExA

RegEnumKeyExA

RegOpenKeyExA

RegOpenKeyExA

RegQueryInfoKeyA

RegQueryInfoKeyA

ExitWindowsEx

ExitWindowsEx

GetKeyboardState

GetKeyboardState

.text

.text

`.rdata

`.rdata

@.data

@.data

.reloc

.reloc

|75001234

|75001234

PR_xTCPSh

PR_xTCPSh

wsock32.dll

wsock32.dll

multipart/*boundary={*}application/x-www-form-urlencodedname="{*}"{*}hXXps://hXXp://

multipart/*boundary={*}application/x-www-form-urlencodedname="{*}"{*}hXXps://hXXp://

keywords

keywords

alluniqcontrolexplicitASCIIUTF8UNICODE{keyword}

alluniqcontrolexplicitASCIIUTF8UNICODE{keyword}

set_url

set_url

WebFilters

WebFilters

WebDataFilters

WebDataFilters

WebFakes

WebFakes

|0123456789

|0123456789

gzipdeflateContent-Type: application/x-www-form-urlencoded

gzipdeflateContent-Type: application/x-www-form-urlencoded

Tdomain=google.ru&cookies=enabled&reason=1&auth=false

Tdomain=google.ru&cookies=enabled&reason=1&auth=false

Cookie: User-Agent-Session: Basic login: Basic password:

Cookie: User-Agent-Session: Basic login: Basic password:

svchost.exe_1268_rwx_20590000_00037000:

Gh.logWj

Gh.logWj

h.logPj

h.logPj

tcPR

tcPR

h.exe

h.exe

user32.dll

user32.dll

kernel32.dll

kernel32.dll

|GetWindowsDirectoryA

|GetWindowsDirectoryA

{X-X-X-X-XX}

{X-X-X-X-XX}

ntdll.dll

ntdll.dll

shlwapi.dll

shlwapi.dll

SHDeleteKeyA

SHDeleteKeyA

SOFTWARE\Microsoft\Windows\CurrentVersion

SOFTWARE\Microsoft\Windows\CurrentVersion

shell32.dll

shell32.dll

?456789:;

?456789:;

!"#$%&'()* ,-./0123

!"#$%&'()* ,-./0123

ws2_32.dll

ws2_32.dll

HTTP/*.*

HTTP/*.*

/HTTPMozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)

/HTTPMozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)

Referer: %s

Referer: %s

Content-Type: multipart/form-data; boundary=%s

Content-Type: multipart/form-data; boundary=%s

Content-Length: %d

Content-Length: %d

Content-Disposition: form-data; name="%s"

Content-Disposition: form-data; name="%s"

--%s--

--%s--

%s /%s HTTP/1.1

%s /%s HTTP/1.1

Host: %s

Host: %s

User-Agent: %s

User-Agent: %s

%sAccept-Language: %s

%sAccept-Language: %s

HTTP/1.x 301 Moved Permanently

HTTP/1.x 301 Moved Permanently

Server: Apache/2.2.14

Server: Apache/2.2.14

advapi32.dll

advapi32.dll

%CommonProgramFiles%

%CommonProgramFiles%

\/*.*

\/*.*

winlogon.exe

winlogon.exe

csrss.exe

csrss.exe

smss.exe

smss.exe

keyworddestination

keyworddestination

USER PASS

USER PASS

PORT

PORT

RapportGP.dll

RapportGP.dll

csshiftjis

csshiftjis

cswindows31j

cswindows31j

iso_646.irv:1991

iso_646.irv:1991

windows-1250

windows-1250

windows-1251

windows-1251

windows-1252

windows-1252

windows-1253

windows-1253

windows-1254

windows-1254

windows-1255

windows-1255

windows-1256

windows-1256

windows-1257

windows-1257

windows-1258

windows-1258

windows-874

windows-874

hostuser-agentoptionsgetheadpostputdeletetraceacceptaccept-charsetaccept-encodingaccept-languageauthorizationexpectfromhostif-modified-sinceif-matchif-none-matchif-rangeif-unmodifiedsincemax-forwardsproxy-authorizationrangerefererteuser-agent100101200201202203204205206300301302303304305306307400401402403404405406407408409410411412413414415416417500501502503504505accept-rangesageetaglocationproxy-authenticatepublicretry-afterservervarywarningwww-authenticateallowcontent-basecontent-encodingcache-controlconnectiondatetrailertransfer-encodingupgradeviawarningcontent-languagecontent-lengthcontent-locationcontent-md5content-rangecontent-typeetagexpireslast-modifiedset-cookieMondayTuesdayWednesdayThursdayFridaySaturdaySundayJanFebMarAprMayJunJulAugSepOctNovDecchunkedtext/htmlimage/pngimage/jpgimage/gifapplication/xmlapplication/xhtmltext/plainpublicmax-agecharset=iso-8859-1utf-8gzipdeflateHTTP/1.1statusversionurl

hostuser-agentoptionsgetheadpostputdeletetraceacceptaccept-charsetaccept-encodingaccept-languageauthorizationexpectfromhostif-modified-sinceif-matchif-none-matchif-rangeif-unmodifiedsincemax-forwardsproxy-authorizationrangerefererteuser-agent100101200201202203204205206300301302303304305306307400401402403404405406407408409410411412413414415416417500501502503504505accept-rangesageetaglocationproxy-authenticatepublicretry-afterservervarywarningwww-authenticateallowcontent-basecontent-encodingcache-controlconnectiondatetrailertransfer-encodingupgradeviawarningcontent-languagecontent-lengthcontent-locationcontent-md5content-rangecontent-typeetagexpireslast-modifiedset-cookieMondayTuesdayWednesdayThursdayFridaySaturdaySundayJanFebMarAprMayJunJulAugSepOctNovDecchunkedtext/htmlimage/pngimage/jpgimage/gifapplication/xmlapplication/xhtmltext/plainpublicmax-agecharset=iso-8859-1utf-8gzipdeflateHTTP/1.1statusversionurl

HTTP/1.1

HTTP/1.1

\\.\pipe\

\\.\pipe\

gdiplus.dll

gdiplus.dll

GdiplusShutdown

GdiplusShutdown

PTF://%s:%s@%s:%d/

PTF://%s:%s@%s:%d/

pop3://%s:%s@%s:%d/

pop3://%s:%s@%s:%d/

dnsapi.dll

dnsapi.dll

wininet.dll

wininet.dll

HttpOpenRequestA

HttpOpenRequestA

HttpOpenRequestW

HttpOpenRequestW

InternetOpenUrlA

InternetOpenUrlA

InternetOpenUrlW

InternetOpenUrlW

HttpSendRequestA

HttpSendRequestA

HttpSendRequestW

HttpSendRequestW

HttpSendRequestExA

HttpSendRequestExA

HttpSendRequestExW

HttpSendRequestExW

QZ .QZ hSZ B^Z ']Z

QZ .QZ hSZ B^Z ']Z

DeleteUrlCacheEntryW

DeleteUrlCacheEntryW

HttpQueryInfoA

HttpQueryInfoA

HttpQueryInfoW

HttpQueryInfoW

GetUrlCacheEntryInfoW

GetUrlCacheEntryInfoW

HttpAddRequestHeadersA

HttpAddRequestHeadersA

HttpAddRequestHeadersW

HttpAddRequestHeadersW

wurlmon.dll

wurlmon.dll

UrlMkGetSessionOption

UrlMkGetSessionOption

nss3.dll

nss3.dll

PR_OpenTCPSocket

PR_OpenTCPSocket

nspr4.dll

nspr4.dll

hXXps://hXXp://TE

hXXps://hXXp://TE

{49A21781-C39D-B603-C11E-00485360D01E}

{49A21781-C39D-B603-C11E-00485360D01E}

%Documents and Settings%\LocalService\Local Settings\Application Data\iwmikkry.log

%Documents and Settings%\LocalService\Local Settings\Application Data\iwmikkry.log

{49A21783-C39D-B603-C11E-00485360D01E}

{49A21783-C39D-B603-C11E-00485360D01E}

{49A21782-C39D-B603-C11E-00485360D01E}

{49A21782-C39D-B603-C11E-00485360D01E}

PeekNamedPipe

PeekNamedPipe

SetNamedPipeHandleState

SetNamedPipeHandleState

WaitNamedPipeA

WaitNamedPipeA

DisconnectNamedPipe

DisconnectNamedPipe

CreateNamedPipeA

CreateNamedPipeA

ConnectNamedPipe

ConnectNamedPipe

RegCloseKey

RegCloseKey

RegDeleteKeyA

RegDeleteKeyA

RegEnumKeyExA

RegEnumKeyExA

RegOpenKeyExA

RegOpenKeyExA

RegQueryInfoKeyA

RegQueryInfoKeyA

ExitWindowsEx

ExitWindowsEx

GetKeyboardState

GetKeyboardState

.text

.text

`.rdata

`.rdata

@.data

@.data

.reloc

.reloc

|75001234

|75001234

PR_xTCPSh

PR_xTCPSh

wsock32.dll

wsock32.dll

multipart/*boundary={*}application/x-www-form-urlencodedname="{*}"{*}hXXps://hXXp://

multipart/*boundary={*}application/x-www-form-urlencodedname="{*}"{*}hXXps://hXXp://

keywords

keywords

alluniqcontrolexplicitASCIIUTF8UNICODE{keyword}

alluniqcontrolexplicitASCIIUTF8UNICODE{keyword}

set_url

set_url

WebFilters

WebFilters

WebDataFilters

WebDataFilters

WebFakes

WebFakes

|0123456789

|0123456789

gzipdeflateContent-Type: application/x-www-form-urlencoded

gzipdeflateContent-Type: application/x-www-form-urlencoded

Tdomain=google.ru&cookies=enabled&reason=1&auth=false

Tdomain=google.ru&cookies=enabled&reason=1&auth=false

Cookie: User-Agent-Session: Basic login: Basic password:

Cookie: User-Agent-Session: Basic login: Basic password:

spoolsv.exe_1448_rwx_20590000_00037000:

Gh.logWj

Gh.logWj

h.logPj

h.logPj

tcPR

tcPR

h.exe

h.exe

user32.dll

user32.dll

kernel32.dll

kernel32.dll

|GetWindowsDirectoryA

|GetWindowsDirectoryA

{X-X-X-X-XX}

{X-X-X-X-XX}

ntdll.dll

ntdll.dll

shlwapi.dll

shlwapi.dll

SHDeleteKeyA

SHDeleteKeyA

SOFTWARE\Microsoft\Windows\CurrentVersion

SOFTWARE\Microsoft\Windows\CurrentVersion

shell32.dll

shell32.dll

?456789:;

?456789:;

!"#$%&'()* ,-./0123

!"#$%&'()* ,-./0123

ws2_32.dll

ws2_32.dll

HTTP/*.*

HTTP/*.*

/HTTPMozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)

/HTTPMozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)

Referer: %s

Referer: %s

Content-Type: multipart/form-data; boundary=%s

Content-Type: multipart/form-data; boundary=%s

Content-Length: %d

Content-Length: %d

Content-Disposition: form-data; name="%s"

Content-Disposition: form-data; name="%s"

--%s--

--%s--

%s /%s HTTP/1.1

%s /%s HTTP/1.1

Host: %s

Host: %s

User-Agent: %s

User-Agent: %s

%sAccept-Language: %s

%sAccept-Language: %s

HTTP/1.x 301 Moved Permanently

HTTP/1.x 301 Moved Permanently

Server: Apache/2.2.14

Server: Apache/2.2.14

advapi32.dll

advapi32.dll

%CommonProgramFiles%

%CommonProgramFiles%

\/*.*

\/*.*

winlogon.exe

winlogon.exe

csrss.exe

csrss.exe

smss.exe

smss.exe

keyworddestination

keyworddestination

USER PASS

USER PASS

PORT

PORT

RapportGP.dll

RapportGP.dll

csshiftjis

csshiftjis

cswindows31j

cswindows31j

iso_646.irv:1991

iso_646.irv:1991

windows-1250

windows-1250

windows-1251

windows-1251

windows-1252

windows-1252

windows-1253

windows-1253

windows-1254

windows-1254

windows-1255

windows-1255

windows-1256

windows-1256

windows-1257

windows-1257

windows-1258

windows-1258

windows-874

windows-874

hostuser-agentoptionsgetheadpostputdeletetraceacceptaccept-charsetaccept-encodingaccept-languageauthorizationexpectfromhostif-modified-sinceif-matchif-none-matchif-rangeif-unmodifiedsincemax-forwardsproxy-authorizationrangerefererteuser-agent100101200201202203204205206300301302303304305306307400401402403404405406407408409410411412413414415416417500501502503504505accept-rangesageetaglocationproxy-authenticatepublicretry-afterservervarywarningwww-authenticateallowcontent-basecontent-encodingcache-controlconnectiondatetrailertransfer-encodingupgradeviawarningcontent-languagecontent-lengthcontent-locationcontent-md5content-rangecontent-typeetagexpireslast-modifiedset-cookieMondayTuesdayWednesdayThursdayFridaySaturdaySundayJanFebMarAprMayJunJulAugSepOctNovDecchunkedtext/htmlimage/pngimage/jpgimage/gifapplication/xmlapplication/xhtmltext/plainpublicmax-agecharset=iso-8859-1utf-8gzipdeflateHTTP/1.1statusversionurl

hostuser-agentoptionsgetheadpostputdeletetraceacceptaccept-charsetaccept-encodingaccept-languageauthorizationexpectfromhostif-modified-sinceif-matchif-none-matchif-rangeif-unmodifiedsincemax-forwardsproxy-authorizationrangerefererteuser-agent100101200201202203204205206300301302303304305306307400401402403404405406407408409410411412413414415416417500501502503504505accept-rangesageetaglocationproxy-authenticatepublicretry-afterservervarywarningwww-authenticateallowcontent-basecontent-encodingcache-controlconnectiondatetrailertransfer-encodingupgradeviawarningcontent-languagecontent-lengthcontent-locationcontent-md5content-rangecontent-typeetagexpireslast-modifiedset-cookieMondayTuesdayWednesdayThursdayFridaySaturdaySundayJanFebMarAprMayJunJulAugSepOctNovDecchunkedtext/htmlimage/pngimage/jpgimage/gifapplication/xmlapplication/xhtmltext/plainpublicmax-agecharset=iso-8859-1utf-8gzipdeflateHTTP/1.1statusversionurl

HTTP/1.1

HTTP/1.1

\\.\pipe\

\\.\pipe\

gdiplus.dll

gdiplus.dll

GdiplusShutdown

GdiplusShutdown

PTF://%s:%s@%s:%d/

PTF://%s:%s@%s:%d/

pop3://%s:%s@%s:%d/

pop3://%s:%s@%s:%d/

dnsapi.dll

dnsapi.dll

wininet.dll

wininet.dll

HttpOpenRequestA

HttpOpenRequestA

HttpOpenRequestW

HttpOpenRequestW

InternetOpenUrlA

InternetOpenUrlA

InternetOpenUrlW

InternetOpenUrlW

HttpSendRequestA

HttpSendRequestA

HttpSendRequestW

HttpSendRequestW

HttpSendRequestExA

HttpSendRequestExA

HttpSendRequestExW

HttpSendRequestExW

QZ .QZ hSZ B^Z ']Z

QZ .QZ hSZ B^Z ']Z

DeleteUrlCacheEntryW

DeleteUrlCacheEntryW

HttpQueryInfoA

HttpQueryInfoA

HttpQueryInfoW

HttpQueryInfoW

GetUrlCacheEntryInfoW

GetUrlCacheEntryInfoW

HttpAddRequestHeadersA

HttpAddRequestHeadersA

HttpAddRequestHeadersW

HttpAddRequestHeadersW

urlmon.dll

urlmon.dll

UrlMkGetSessionOption

UrlMkGetSessionOption

nss3.dll

nss3.dll

PR_OpenTCPSocket

PR_OpenTCPSocket

nspr4.dll

nspr4.dll

hXXps://hXXp://TE

hXXps://hXXp://TE

{49A21781-C39D-B603-C11E-00485360D01E}

{49A21781-C39D-B603-C11E-00485360D01E}

%Documents and Settings%\LocalService\Local Settings\Application Data\iwmikkry.log

%Documents and Settings%\LocalService\Local Settings\Application Data\iwmikkry.log

{49A21783-C39D-B603-C11E-00485360D01E}

{49A21783-C39D-B603-C11E-00485360D01E}

{49A21782-C39D-B603-C11E-00485360D01E}

{49A21782-C39D-B603-C11E-00485360D01E}

PeekNamedPipe

PeekNamedPipe

SetNamedPipeHandleState

SetNamedPipeHandleState

WaitNamedPipeA

WaitNamedPipeA

DisconnectNamedPipe

DisconnectNamedPipe

CreateNamedPipeA

CreateNamedPipeA

ConnectNamedPipe

ConnectNamedPipe

RegCloseKey

RegCloseKey

RegDeleteKeyA

RegDeleteKeyA

RegEnumKeyExA

RegEnumKeyExA

RegOpenKeyExA

RegOpenKeyExA

RegQueryInfoKeyA

RegQueryInfoKeyA

ExitWindowsEx

ExitWindowsEx

GetKeyboardState

GetKeyboardState

.text

.text

`.rdata

`.rdata

@.data

@.data

.reloc

.reloc

|75001234

|75001234

PR_xTCPSh

PR_xTCPSh

wsock32.dll

wsock32.dll

multipart/*boundary={*}application/x-www-form-urlencodedname="{*}"{*}hXXps://hXXp://

multipart/*boundary={*}application/x-www-form-urlencodedname="{*}"{*}hXXps://hXXp://

keywords

keywords

alluniqcontrolexplicitASCIIUTF8UNICODE{keyword}

alluniqcontrolexplicitASCIIUTF8UNICODE{keyword}

set_url

set_url

WebFilters

WebFilters

WebDataFilters

WebDataFilters

WebFakes

WebFakes

|0123456789

|0123456789

gzipdeflateContent-Type: application/x-www-form-urlencoded

gzipdeflateContent-Type: application/x-www-form-urlencoded

Tdomain=google.ru&cookies=enabled&reason=1&auth=false

Tdomain=google.ru&cookies=enabled&reason=1&auth=false

Cookie: User-Agent-Session: Basic login: Basic password:

Cookie: User-Agent-Session: Basic login: Basic password:

Explorer.EXE_1684_rwx_20590000_00037000:

Gh.logWj

Gh.logWj

h.logPj

h.logPj

tcPR

tcPR

h.exe

h.exe

user32.dll

user32.dll

kernel32.dll

kernel32.dll

|GetWindowsDirectoryA

|GetWindowsDirectoryA

{X-X-X-X-XX}

{X-X-X-X-XX}

ntdll.dll

ntdll.dll

shlwapi.dll

shlwapi.dll

SHDeleteKeyA

SHDeleteKeyA

SOFTWARE\Microsoft\Windows\CurrentVersion

SOFTWARE\Microsoft\Windows\CurrentVersion

shell32.dll

shell32.dll

?456789:;

?456789:;

!"#$%&'()* ,-./0123

!"#$%&'()* ,-./0123

ws2_32.dll

ws2_32.dll

HTTP/*.*

HTTP/*.*

/HTTPMozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)

/HTTPMozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)

Referer: %s

Referer: %s

Content-Type: multipart/form-data; boundary=%s

Content-Type: multipart/form-data; boundary=%s

Content-Length: %d

Content-Length: %d

Content-Disposition: form-data; name="%s"

Content-Disposition: form-data; name="%s"

--%s--

--%s--

%s /%s HTTP/1.1

%s /%s HTTP/1.1

Host: %s

Host: %s

User-Agent: %s

User-Agent: %s

%sAccept-Language: %s

%sAccept-Language: %s

HTTP/1.x 301 Moved Permanently

HTTP/1.x 301 Moved Permanently

Server: Apache/2.2.14

Server: Apache/2.2.14

advapi32.dll

advapi32.dll

%CommonProgramFiles%

%CommonProgramFiles%

\/*.*

\/*.*

winlogon.exe

winlogon.exe

csrss.exe

csrss.exe

smss.exe

smss.exe

keyworddestination

keyworddestination

USER PASS

USER PASS

PORT

PORT

RapportGP.dll

RapportGP.dll

csshiftjis

csshiftjis

cswindows31j

cswindows31j

iso_646.irv:1991

iso_646.irv:1991

windows-1250

windows-1250

windows-1251

windows-1251

windows-1252

windows-1252

windows-1253

windows-1253

windows-1254

windows-1254

windows-1255

windows-1255

windows-1256

windows-1256

windows-1257

windows-1257

windows-1258

windows-1258

windows-874

windows-874

hostuser-agentoptionsgetheadpostputdeletetraceacceptaccept-charsetaccept-encodingaccept-languageauthorizationexpectfromhostif-modified-sinceif-matchif-none-matchif-rangeif-unmodifiedsincemax-forwardsproxy-authorizationrangerefererteuser-agent100101200201202203204205206300301302303304305306307400401402403404405406407408409410411412413414415416417500501502503504505accept-rangesageetaglocationproxy-authenticatepublicretry-afterservervarywarningwww-authenticateallowcontent-basecontent-encodingcache-controlconnectiondatetrailertransfer-encodingupgradeviawarningcontent-languagecontent-lengthcontent-locationcontent-md5content-rangecontent-typeetagexpireslast-modifiedset-cookieMondayTuesdayWednesdayThursdayFridaySaturdaySundayJanFebMarAprMayJunJulAugSepOctNovDecchunkedtext/htmlimage/pngimage/jpgimage/gifapplication/xmlapplication/xhtmltext/plainpublicmax-agecharset=iso-8859-1utf-8gzipdeflateHTTP/1.1statusversionurl

hostuser-agentoptionsgetheadpostputdeletetraceacceptaccept-charsetaccept-encodingaccept-languageauthorizationexpectfromhostif-modified-sinceif-matchif-none-matchif-rangeif-unmodifiedsincemax-forwardsproxy-authorizationrangerefererteuser-agent100101200201202203204205206300301302303304305306307400401402403404405406407408409410411412413414415416417500501502503504505accept-rangesageetaglocationproxy-authenticatepublicretry-afterservervarywarningwww-authenticateallowcontent-basecontent-encodingcache-controlconnectiondatetrailertransfer-encodingupgradeviawarningcontent-languagecontent-lengthcontent-locationcontent-md5content-rangecontent-typeetagexpireslast-modifiedset-cookieMondayTuesdayWednesdayThursdayFridaySaturdaySundayJanFebMarAprMayJunJulAugSepOctNovDecchunkedtext/htmlimage/pngimage/jpgimage/gifapplication/xmlapplication/xhtmltext/plainpublicmax-agecharset=iso-8859-1utf-8gzipdeflateHTTP/1.1statusversionurl

HTTP/1.1

HTTP/1.1

\\.\pipe\

\\.\pipe\

gdiplus.dll

gdiplus.dll

GdiplusShutdown

GdiplusShutdown

PTF://%s:%s@%s:%d/

PTF://%s:%s@%s:%d/

pop3://%s:%s@%s:%d/

pop3://%s:%s@%s:%d/

dnsapi.dll

dnsapi.dll

wininet.dll

wininet.dll

HttpOpenRequestA

HttpOpenRequestA

HttpOpenRequestW

HttpOpenRequestW

InternetOpenUrlA

InternetOpenUrlA

InternetOpenUrlW

InternetOpenUrlW

HttpSendRequestA

HttpSendRequestA

HttpSendRequestW

HttpSendRequestW

HttpSendRequestExA

HttpSendRequestExA

HttpSendRequestExW

HttpSendRequestExW

QZ .QZ hSZ B^Z ']Z

QZ .QZ hSZ B^Z ']Z

DeleteUrlCacheEntryW

DeleteUrlCacheEntryW

HttpQueryInfoA

HttpQueryInfoA

HttpQueryInfoW

HttpQueryInfoW

GetUrlCacheEntryInfoW

GetUrlCacheEntryInfoW

HttpAddRequestHeadersA

HttpAddRequestHeadersA

HttpAddRequestHeadersW

HttpAddRequestHeadersW

wurlmon.dll

wurlmon.dll

UrlMkGetSessionOption

UrlMkGetSessionOption

nss3.dll

nss3.dll

PR_OpenTCPSocket

PR_OpenTCPSocket

nspr4.dll

nspr4.dll

hXXps://hXXp://TE

hXXps://hXXp://TE

{49A21781-C39D-B603-C11E-00485360D01E}

{49A21781-C39D-B603-C11E-00485360D01E}

%Documents and Settings%\%current user%\Local Settings\Application Data\iwmikkry.log

%Documents and Settings%\%current user%\Local Settings\Application Data\iwmikkry.log

{49A21783-C39D-B603-C11E-00485360D01E}

{49A21783-C39D-B603-C11E-00485360D01E}

{49A21782-C39D-B603-C11E-00485360D01E}

{49A21782-C39D-B603-C11E-00485360D01E}

PeekNamedPipe

PeekNamedPipe

SetNamedPipeHandleState

SetNamedPipeHandleState

WaitNamedPipeA

WaitNamedPipeA

DisconnectNamedPipe

DisconnectNamedPipe

CreateNamedPipeA

CreateNamedPipeA

ConnectNamedPipe

ConnectNamedPipe

RegCloseKey

RegCloseKey

RegDeleteKeyA

RegDeleteKeyA

RegEnumKeyExA

RegEnumKeyExA

RegOpenKeyExA

RegOpenKeyExA

RegQueryInfoKeyA

RegQueryInfoKeyA

ExitWindowsEx

ExitWindowsEx

GetKeyboardState

GetKeyboardState

.text

.text

`.rdata

`.rdata

@.data

@.data

.reloc

.reloc

|75001234

|75001234

PR_xTCPSh

PR_xTCPSh

wsock32.dll

wsock32.dll

multipart/*boundary={*}application/x-www-form-urlencodedname="{*}"{*}hXXps://hXXp://

multipart/*boundary={*}application/x-www-form-urlencodedname="{*}"{*}hXXps://hXXp://

keywords

keywords

alluniqcontrolexplicitASCIIUTF8UNICODE{keyword}

alluniqcontrolexplicitASCIIUTF8UNICODE{keyword}

set_url

set_url

WebFilters

WebFilters

WebDataFilters

WebDataFilters

WebFakes

WebFakes

|0123456789

|0123456789

gzipdeflateContent-Type: application/x-www-form-urlencoded

gzipdeflateContent-Type: application/x-www-form-urlencoded

Tdomain=google.ru&cookies=enabled&reason=1&auth=false

Tdomain=google.ru&cookies=enabled&reason=1&auth=false

Cookie: User-Agent-Session: Basic login: Basic password:

Cookie: User-Agent-Session: Basic login: Basic password:

jqs.exe_1972_rwx_20590000_00037000:

Gh.logWj

Gh.logWj

h.logPj

h.logPj

tcPR

tcPR

h.exe

h.exe

user32.dll

user32.dll

kernel32.dll

kernel32.dll

|GetWindowsDirectoryA

|GetWindowsDirectoryA

{X-X-X-X-XX}

{X-X-X-X-XX}

ntdll.dll

ntdll.dll

shlwapi.dll

shlwapi.dll

SHDeleteKeyA

SHDeleteKeyA

SOFTWARE\Microsoft\Windows\CurrentVersion

SOFTWARE\Microsoft\Windows\CurrentVersion

shell32.dll

shell32.dll

?456789:;

?456789:;

!"#$%&'()* ,-./0123

!"#$%&'()* ,-./0123

ws2_32.dll

ws2_32.dll

HTTP/*.*

HTTP/*.*

/HTTPMozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)

/HTTPMozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)

Referer: %s

Referer: %s

Content-Type: multipart/form-data; boundary=%s

Content-Type: multipart/form-data; boundary=%s

Content-Length: %d

Content-Length: %d

Content-Disposition: form-data; name="%s"

Content-Disposition: form-data; name="%s"

--%s--

--%s--

%s /%s HTTP/1.1

%s /%s HTTP/1.1

Host: %s

Host: %s

User-Agent: %s

User-Agent: %s

%sAccept-Language: %s

%sAccept-Language: %s

HTTP/1.x 301 Moved Permanently

HTTP/1.x 301 Moved Permanently

Server: Apache/2.2.14

Server: Apache/2.2.14

advapi32.dll

advapi32.dll

%CommonProgramFiles%

%CommonProgramFiles%

\/*.*

\/*.*

winlogon.exe

winlogon.exe

csrss.exe

csrss.exe

smss.exe

smss.exe

keyworddestination

keyworddestination

USER PASS

USER PASS

PORT

PORT

RapportGP.dll

RapportGP.dll

csshiftjis

csshiftjis

cswindows31j

cswindows31j

iso_646.irv:1991

iso_646.irv:1991

windows-1250

windows-1250

windows-1251

windows-1251

windows-1252

windows-1252

windows-1253

windows-1253

windows-1254

windows-1254

windows-1255

windows-1255

windows-1256

windows-1256

windows-1257

windows-1257

windows-1258

windows-1258

windows-874

windows-874

hostuser-agentoptionsgetheadpostputdeletetraceacceptaccept-charsetaccept-encodingaccept-languageauthorizationexpectfromhostif-modified-sinceif-matchif-none-matchif-rangeif-unmodifiedsincemax-forwardsproxy-authorizationrangerefererteuser-agent100101200201202203204205206300301302303304305306307400401402403404405406407408409410411412413414415416417500501502503504505accept-rangesageetaglocationproxy-authenticatepublicretry-afterservervarywarningwww-authenticateallowcontent-basecontent-encodingcache-controlconnectiondatetrailertransfer-encodingupgradeviawarningcontent-languagecontent-lengthcontent-locationcontent-md5content-rangecontent-typeetagexpireslast-modifiedset-cookieMondayTuesdayWednesdayThursdayFridaySaturdaySundayJanFebMarAprMayJunJulAugSepOctNovDecchunkedtext/htmlimage/pngimage/jpgimage/gifapplication/xmlapplication/xhtmltext/plainpublicmax-agecharset=iso-8859-1utf-8gzipdeflateHTTP/1.1statusversionurl

hostuser-agentoptionsgetheadpostputdeletetraceacceptaccept-charsetaccept-encodingaccept-languageauthorizationexpectfromhostif-modified-sinceif-matchif-none-matchif-rangeif-unmodifiedsincemax-forwardsproxy-authorizationrangerefererteuser-agent100101200201202203204205206300301302303304305306307400401402403404405406407408409410411412413414415416417500501502503504505accept-rangesageetaglocationproxy-authenticatepublicretry-afterservervarywarningwww-authenticateallowcontent-basecontent-encodingcache-controlconnectiondatetrailertransfer-encodingupgradeviawarningcontent-languagecontent-lengthcontent-locationcontent-md5content-rangecontent-typeetagexpireslast-modifiedset-cookieMondayTuesdayWednesdayThursdayFridaySaturdaySundayJanFebMarAprMayJunJulAugSepOctNovDecchunkedtext/htmlimage/pngimage/jpgimage/gifapplication/xmlapplication/xhtmltext/plainpublicmax-agecharset=iso-8859-1utf-8gzipdeflateHTTP/1.1statusversionurl

HTTP/1.1

HTTP/1.1

\\.\pipe\

\\.\pipe\

gdiplus.dll

gdiplus.dll

GdiplusShutdown

GdiplusShutdown

PTF://%s:%s@%s:%d/

PTF://%s:%s@%s:%d/

pop3://%s:%s@%s:%d/

pop3://%s:%s@%s:%d/

dnsapi.dll

dnsapi.dll

wininet.dll

wininet.dll

HttpOpenRequestA

HttpOpenRequestA

HttpOpenRequestW

HttpOpenRequestW

InternetOpenUrlA

InternetOpenUrlA

InternetOpenUrlW

InternetOpenUrlW

HttpSendRequestA

HttpSendRequestA

HttpSendRequestW

HttpSendRequestW

HttpSendRequestExA

HttpSendRequestExA

HttpSendRequestExW

HttpSendRequestExW

QZ .QZ hSZ B^Z ']Z

QZ .QZ hSZ B^Z ']Z

DeleteUrlCacheEntryW

DeleteUrlCacheEntryW

HttpQueryInfoA

HttpQueryInfoA

HttpQueryInfoW

HttpQueryInfoW

GetUrlCacheEntryInfoW

GetUrlCacheEntryInfoW

HttpAddRequestHeadersA

HttpAddRequestHeadersA

HttpAddRequestHeadersW

HttpAddRequestHeadersW

urlmon.dll

urlmon.dll

UrlMkGetSessionOption

UrlMkGetSessionOption

nss3.dll

nss3.dll

PR_OpenTCPSocket

PR_OpenTCPSocket

nspr4.dll

nspr4.dll

hXXps://hXXp://TE

hXXps://hXXp://TE

{49A21781-C39D-B603-C11E-00485360D01E}

{49A21781-C39D-B603-C11E-00485360D01E}

%Documents and Settings%\LocalService\Local Settings\Application Data\iwmikkry.log

%Documents and Settings%\LocalService\Local Settings\Application Data\iwmikkry.log

{49A21783-C39D-B603-C11E-00485360D01E}

{49A21783-C39D-B603-C11E-00485360D01E}

{49A21782-C39D-B603-C11E-00485360D01E}

{49A21782-C39D-B603-C11E-00485360D01E}

PeekNamedPipe

PeekNamedPipe

SetNamedPipeHandleState

SetNamedPipeHandleState

WaitNamedPipeA

WaitNamedPipeA

DisconnectNamedPipe

DisconnectNamedPipe

CreateNamedPipeA

CreateNamedPipeA

ConnectNamedPipe

ConnectNamedPipe

RegCloseKey

RegCloseKey

RegDeleteKeyA

RegDeleteKeyA

RegEnumKeyExA

RegEnumKeyExA

RegOpenKeyExA

RegOpenKeyExA

RegQueryInfoKeyA

RegQueryInfoKeyA

ExitWindowsEx

ExitWindowsEx

GetKeyboardState

GetKeyboardState

.text

.text

`.rdata

`.rdata

@.data

@.data

.reloc

.reloc

|75001234

|75001234

PR_xTCPSh

PR_xTCPSh

wsock32.dll

wsock32.dll

multipart/*boundary={*}application/x-www-form-urlencodedname="{*}"{*}hXXps://hXXp://

multipart/*boundary={*}application/x-www-form-urlencodedname="{*}"{*}hXXps://hXXp://

keywords

keywords

alluniqcontrolexplicitASCIIUTF8UNICODE{keyword}

alluniqcontrolexplicitASCIIUTF8UNICODE{keyword}

set_url

set_url

WebFilters

WebFilters

WebDataFilters

WebDataFilters

WebFakes

WebFakes

|0123456789

|0123456789

gzipdeflateContent-Type: application/x-www-form-urlencoded

gzipdeflateContent-Type: application/x-www-form-urlencoded

Tdomain=google.ru&cookies=enabled&reason=1&auth=false

Tdomain=google.ru&cookies=enabled&reason=1&auth=false

Cookie: User-Agent-Session: Basic login: Basic password:

Cookie: User-Agent-Session: Basic login: Basic password: