Gen.Variant.Strictor.69781_49560e0c30 – Adaware

Dynamic Analysis

Payload

Behaviour	Description
EmailWorm	Worm can send e-mails.

Process activity

The Trojan creates the following process(es):No processes have been created.The Trojan injects its code into the following process(es):

%original file name%.exe:120

Mutexes

The following mutexes were created/opened:No objects were found.

File activity

The process %original file name%.exe:120 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Cookies\Current_User@www.56645[1].txt (150 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\05I7KPMB\Logo[1].png (4917 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OX6J4PMZ\tool[1].htm (1301 bytes)
%Documents and Settings%\%current user%\Cookies\index.dat (1928 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OHYRGXIJ\leaan[1].js (731 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@www.56645[2].txt (291 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Cookies\Current_User@www.56645[1].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\MSHist012014040920140410 (0 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\MSHist012014040920140410\index.dat (0 bytes)

Registry activity

The process %original file name%.exe:120 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012015081620150817]
"CachePrefix" = ":2015081620150817:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012015081620150817]
"CacheOptions" = "11"
"CacheLimit" = "8192"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012015081620150817]
"CacheRepair" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 28 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012015081620150817]
"CachePath" = "%USERPROFILE%\Local Settings\History\History.IE5\MSHist012015081620150817\"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "4B 47 25 70 10 66 B8 EF EA 6D A8 2E 61 73 6D F1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan deletes the following registry key(s):

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014040920140410]

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

Dropped PE files

There are no dropped PE files.

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

Removals

Remove it with Ad-Aware

Click (here) to download and install Ad-Aware Free Antivirus.
Update the definition files.
Run a full scan of your computer.

Manual removal*

Terminate malicious process(es) (How to End a Process With the Task Manager):No processes have been created.
Delete the original Trojan file.
Delete or disinfect the following files created/modified by the Trojan:
%Documents and Settings%\%current user%\Cookies\Current_User@www.56645[1].txt (150 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\05I7KPMB\Logo[1].png (4917 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OX6J4PMZ\tool[1].htm (1301 bytes)
%Documents and Settings%\%current user%\Cookies\index.dat (1928 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OHYRGXIJ\leaan[1].js (731 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@www.56645[2].txt (291 bytes)
Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
Reboot the computer.

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

VersionInfo

Company Name:
Product Name: GameMaster????-??????
Product Version: 1.0.0.0
Legal Copyright: ?????? ????????
Legal Trademarks:
Original Filename:
Internal Name:
File Version: 1.0.0.0
File Description: GameMaster????-??????
Comments: GameMaster????-??????
Language: English (United States)

Company Name: Product Name: GameMaster????-??????Product Version: 1.0.0.0Legal Copyright: ?????? ????????Legal Trademarks: Original Filename: Internal Name: File Version: 1.0.0.0File Description: GameMaster????-??????Comments: GameMaster????-??????Language: English (United States)

PE Sections

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Section MD5
.text	4096	1033458	1036288	5.14722	fe12196dabf5c9524135b18a54fef205
.rdata	1040384	172752	176128	2.92402	069e8a8be79957389610d668bacfeea4
.data	1216512	299562	86016	4.35744	6141abe6636712acdab4eb3be1b7cd0a
.rsrc	1519616	24288	24576	3.38027	39fd0626d6bceefe8dd814bbcb821b02

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Network Activity

URLs

URL	IP
hxxp://www.56645.com/Logo.png	120.26.64.169
hxxp://s1.56645.com/leaan.js	114.215.185.27
hxxp://s1.56645.com/stat/index?id=leaan&rf=&w=1916&h=902&cdp=32&ld=null&t=0&mac=62795793&rnd=686&dwt=undefined	114.215.185.27
hxxp://p.56645.com/stat/index?id=leaan&rf=&w=1916&h=902&cdp=32&ld=null&t=0&mac=62795793&rnd=686&dwt=undefined	114.215.185.27

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

GET /stat/index?id=leaan&rf=&w=1916&h=902&cdp=32&ld=null&t=0&mac=62795793&rnd=686&dwt=undefined HTTP/1.1

Accept: */*

Referer: hXXp://VVV.56645.com/tool.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: p.56645.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Sun, 16 Aug 2015 02:11:36 GMT

Server: Microsoft-IIS/6.0

X-Powered-By: ASP.NET

X-AspNet-Version: 4.0.30319

X-AspNetMvc-Version: 3.0

Cache-Control: private

Content-Length: 0

HTTP/1.1 200 OK..Date: Sun, 16 Aug 2015 02:11:36 GMT..Server: Microsoft-IIS/6.0..X-Powered-By: ASP.NET..X-AspNet-Version: 4.0.30319..X-AspNetMvc-Version: 3.0..Cache-Control: private..Content-Length: 0..

GET /Logo.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.56645.com/tool.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.56645.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Length: 16081

Content-Type: image/png

Last-Modified: Sun, 03 Mar 2013 23:22:03 GMT

Accept-Ranges: bytes

ETag: "80df95e96518ce1:e26"

Server: Microsoft-IIS/6.0

X-Powered-By: ASP.NET

Date: Sun, 16 Aug 2015 02:11:55 GMT

.PNG........IHDR...>...7......@&L....pHYs.................gAMA....|.Q.... cHRM..z%..............u0...`..:....o._.F..>GIDATx..]w..E..v...0.s..%/.@\@D.e=9..dM.i.....SOP......T<..s8...1..........y6N.....gj..=.......?3;.....W.z...*F.$(.a.DZ..b.~.r.[!......0....&W.......S...26.......L...x.........z...>..~....@. ... ....G.B.]....=i...r..@.....|.........-...T.uQ..R..)Z.J....j:...,)4..T...>.z.....xQ..l...g..kT..F.......f.2.....F...../W.G6}.:.09S...|...:..... K)?O......I.....KG9s..........T..W.....j0....L....7.S..:.x&.x....... ..!&...r.u....`.j}.(.T{....Ni.S...4...........rYI....).E....).......9..g....C@...(...t.......<.%...^tQ.o'.C..-Eg.....n ...3.....2.y.zY.....C}..lE....m.../.[.Xx4..2r..1....g..b....oI.5.H>.0...k|us9P..$-=.[...!..L....G[.&.b...(..Qxn"f.7.y.......%._...k..\.........z...`.. .@....k...V.OKY................a$...Z.Z.........1c....)&.!yi..n......0Z\0.<...8]5.....X....B......Kv..f].%.....P..fJ.. /.|.,QH.]..M.. *.a.dl..I.......hp.I.B..[.. .`.......d4.4-.)..c^....W......>.}.H....t..H:C<.Dr%..Y..0w.X....a.r.Lp.....j.tb...7.<../..k.).R..$r....0..L3.(...G..Q....t>..N..NUg-.....e..C5"..q...E.\..Q.t.P:.b,f..j.V..m.F0Y....M....,.@.(y...I.........2...%@..Ar..]....]..t8..........X.q......Kt..=,}..m.....#.g..*Jb%.O... ..)...X<..b$e.EL...GL.f,...`k.w..\...#I.'J...O.Ah.......lB..yo(@../.;..S.\ZF.^...k/.......fDFq.......y/...6~.V/X*d.M....$d^*...........h_.0........".2.....r....L....`K.`.&^......K.db.....&C:2l.".:........!m=.p..S...B[.V........v...,...#q.;/..J,-...\].r....e.H'.....G

<<< skipped >>>

GET /leaan.js HTTP/1.1

Accept: */*

Referer: hXXp://VVV.56645.com/tool.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: s1.56645.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Sun, 16 Aug 2015 02:11:34 GMT

Server: Microsoft-IIS/6.0

X-Powered-By: ASP.NET

X-AspNet-Version: 4.0.30319

X-AspNetMvc-Version: 3.0

Cache-Control: private

Content-Type: application/x-javascript; charset=utf-8

Content-Length: 2804

<<< skipped >>>

Map

The Trojan connects to the servers at the folowing location(s):

Strings from Dumps

%original file name%.exe_120:

.text

.rdata

@.data

.rsrc

uh.AP

t$(SSh

|$D.tm

~%UVW

HW%X>S

u$SShe

ole32.dll

wininet.dll

kernel32.dll

advapi32.dll

shlwapi.dll

user32.dll

Kernel32.dll

oleaut32.dll

HttpOpenRequestA

HttpSendRequestA

HttpQueryInfoA

ShellExecuteA

FtpCreateDirectoryA

FtpRemoveDirectoryA

FtpGetFileA

FtpFindFirstFileA

FtpSetCurrentDirectoryA

FtpGetCurrentDirectoryA

FtpDeleteFileA

FtpRenameFileA

FtpPutFileA

FtpOpenFileA

FtpGetFileSize

hXXp://VVV.56645.com//MyAJAX/HdCheckUser.ashx?t=Reg&clientid=txtUname&rand=1&txtUname=

@qq.com&txtUQQ=

hXXp://VVV.56645.com/Register.aspx?ac=add

Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; 125LA; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022)

http=

https

HTTP/1.1

Content-Type: application/x-www-form-urlencoded

HTTP/1.1

hXXps://

hXXp://

hXXp://VVV.56645.com/UserLogin.aspx?userName=

hXXp://VVV.56645.com/v/WebsiteList.aspx

5277147

\config\gamemaster.dat

Password

hXXp://open.baidu.com/special/time/

window.baidu_time(

function timea(){var d,s;d=new Date();d.setTime('

D:\MirServer\Config.ini

D:\MirServer

\LoginSrv\IDDB

Config.ini

\Config.ini

Mir200\!Setup.txt

\Mir200\!Setup.txt

\Config\Mergetext.ini

\Tool\HeroTool.lde

\Tool\!Config.ini

\Tool\Config.ini

scripting.FileSystemObject

LoginSrv\IDDB\ID.DB

DBServer\FDB\HUM.DB

DBServer\FDB\Mir.DB

Mir200\Envir\UserData\LimitItem.txt

ID.DB

HUM.DB

Mir.DB

ID.txt

\LoginSrv\IDDB\

\Hum.DB

\DBServer\FDB\Hum.DB

\Mir.DB

\DBServer\FDB\Mir.DB

\Id.DB

\LoginSrv\IDDB\Id.DB

\UserSellOff.gold

\Mir200\Envir\Market_SellOff\UserSellOff.gold

\UserSellOff.sell

\Mir200\Envir\Market_SellOff\UserSellOff.sell

\BaiTan.Sell

\LoginSrv\IDDB\ID.DB

\DBServer\FDB\HUM.DB

M2Server.exe

Hum.DB

hXXp://wpa.qq.com/msgrd?V=1&Uin=527714&Site=-&Menu=no

hXXp://VVV.56645.com/config.htm

527714789

WinHttp.WinHttpRequest.5.1

User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; 125LA; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022)

(HeroM2)-hXXp://VVV.56645.com/-2.20150517

hXXp://VVV.56645.com/

\Config\Cleanfolder.ini

LoginSrv\ChrLog

LoginSrv\CountLog

LoginSrv\IDDB

\Config\Cleantext.ini

Mir200\GuildBase\GuildList.txt

Mir200\Envir\AdminList.txt

Mir200\Envir\DenyAccountList.txt

Mir200\Envir\DenyChrNameList.txt

Mir200\Envir\DenyIPAddrList.txt

Mir200\Envir\DisableSendMsgList.txt

Mir200\Envir\ItemBindAccount.txt

Mir200\Envir\ItemBindChrName.txt

Mir200\Envir\ItemBindIPaddr.txt

Mir200\Envir\UnForceMaster.txt

Mir200\Envir\UnMaster.txt

Mir200\Envir\UnMarry.txt

2.20150517

\Config\Config.ini

D:\MirServer\

127.0.0.1

ServerPort

GatePort

LoginGate

GatePort1

GatePort2

GatePort3

GatePort4

GatePort5

GatePort6

GatePort7

GatePort8

LoginServer

MonPort

RunPort

Port

MsgSrvPort

anonymous@123.com

.exe|.rar|.zip|.gif|.jpg|.mp3|.rm

VBScript.RegExp

hXXp://VVV.56645.com/tool.htmlo

2009-11-10

(Config.ini)|Config.ini

|*.zip

Id.DB

%*.*f

CNotSupportedException

commctrl_DragListMsg

Afx:%x:%x:%x:%x:%x

Afx:%x:%x

COMCTL32.DLL

CCmdTarget

__MSVCRT_HEAP_SELECT

RASAPI32.dll

GetProcessHeap

WinExec

GetWindowsDirectoryA

KERNEL32.dll

GetKeyState

RegisterHotKey

UnregisterHotKey

SetWindowsHookExA

UnhookWindowsHookEx

EnumThreadWindows

EnumChildWindows

USER32.dll

GetViewportOrgEx

GDI32.dll

WINMM.dll

MSIMG32.dll

WINSPOOL.DRV

RegCloseKey

RegOpenKeyExA

ADVAPI32.dll

SHELL32.dll

OLEAUT32.dll

COMCTL32.dll

oledlg.dll

WS2_32.dll

InternetCrackUrlA

InternetCanonicalizeUrlA

WININET.dll

WLDAP32.dll

GetCPInfo

CreateDialogIndirectParamA

SetViewportOrgEx

OffsetViewportOrgEx

SetViewportExtEx

ScaleViewportExtEx

GetViewportExtEx

comdlg32.dll

RegCreateKeyExA

.PAVCException@@

.PAVCNotSupportedException@@

.PAVCFileException@@

(*.prn)|*.prn|

(*.*)|*.*||

Shell32.dll

Mpr.dll

Advapi32.dll

User32.dll

Gdi32.dll

(&07-034/)7 '

?? / %d]

%d / %d]

: %d]

(*.WAV;*.MID)|*.WAV;*.MID|WAV

(*.WAV)|*.WAV|MIDI

(*.MID)|*.MID|

(*.txt)|*.txt|

(*.JPG;*.BMP;*.GIF;*.ICO;*.CUR)|*.JPG;*.BMP;*.GIF;*.ICO;*.CUR|JPG

(*.JPG)|*.JPG|BMP

(*.BMP)|*.BMP|GIF

(*.GIF)|*.GIF|

(*.ICO)|*.ICO|

(*.CUR)|*.CUR|

%s:%d

windows

out.prn

%d.%d

%d / %d

%d/%d

Bogus message code %d

(%d-%d):

%ld%c

Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)

HTTP/1.0

%s

Reply-To: %s

From: %s

To: %s

Subject: %s

Date: %s

Cc: %s

%a, %d %b %Y %H:%M:%S

SMTP

code %d bits %d->%d

gen_codes: max_code %d

bl code -

opt %lu(%lu) stat %lu(%lu) stored %lu lit %u dist %u

last_lit %u, last_dist %u, in %ld, out ~%ld(%ld%%)

1.1.3

%d%d%d

rundll32.exe shell32.dll,

msctls_hotkey32

[%s:%d]

Range: bytes=%s-

[%s:%d]

PASS %s

PASS ******

USER %s

E:\dev\e\static_link\static_libs\source\downlib\mystrlib.cpp

SIZE %s

PORT

User-Agent: %s

Mozilla/4.0 (compatible; MSIE 5.00; Windows 98)

Referer: %s

Host: %s

GET %s HTTP/1.1

Cookie: %s

%d, %s

\\192.168.0.129\TCP\1037

NSPlayer/9.0.0.2980; {%s}; Host: %s

rmff_fix_header: assuming data.size=%i

rmff_fix_header: assuming data.num_packets=%i

rmff_fix_header: assuming prop.num_packets=%i

rmff_fix_header: setting prop.data_offset from %i to %i

rmff_fix_header: correcting prop.num_streams from %i to %i

rmff_fix_header: correcting prop.size from %i to %i

%s %s %s

Session: %s

Cseq: %u

%*s %s

%*s %u

CSeq: %u

rtsp://%s:%i

rtsp://%s:%i/%s

ClientID: Linux_2.4_6.0.9.1235_play32_RN01_EN_586

GUID: 00000000-0000-0000-0000-000000000000

[%s:%d]

User-Agent: RealMedia Player Version 6.0.9.1235 (linux-2.0-libc6-i386-gcc2.95)

Range: npt=%s-

%s/streamid=1

%s/streamid=0

Transport: x-pn-tng/tcp;mode=play,rtp/avp/tcp;unicast;mode=play

If-Match: %s

RealChallenge2: %s, sd=%s

Title: %s

Copyright: %s

Author: %s

real: Content-length for description too big (> %uMB)!

Require: com.real.retain-entity-for-setup

SupportsMaximumASMBandwidth: 1

Bandwidth: %u

Challenge1: %s

hash output: %x %x %x %x

hash input: %x %x %x %x

stream=%u;rule=%u,

Illegal character '%c' in input.

(*.htm;*.html)|*.htm;*.html

;3 #>6.&

'2, / 0&7!4-)1#

.PAVCOleException@@

.PAVCObject@@

.PAVCSimpleException@@

.PAVCMemoryException@@

.?AVCNotSupportedException@@

.PAVCResourceException@@

.PAVCUserException@@

.?AVCCmdTarget@@

.?AVCCmdUI@@

.?AVCTestCmdUI@@

.PAVCOleDispatchException@@

.PAVCArchiveException@@

zcÃ

c:\%original file name%.exe

#include "l.chs\afxres.rc" // Standard components

(*.*)

1.0.0.0

%original file name%.exe_120_rwx_00401000_000FD000:

uh.AP

t$(SSh

|$D.tm

~%UVW

HW%X>S

u$SShe

Summary

Dynamic Analysis

Removals

Static Analysis

Network Activity

Map

Strings from Dumps