HEUR:Trojan.Win32.Generic (Kaspersky), Trojan.Generic.KD.140939 (AdAware), Trojan.Win32.Alureon.FD, GenericInjector.YR, BankerGeneric.YR (Lavasoft MAS)Behaviour: Banker, Trojan
The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.
Summary
MD5: 75321fdf9aab2bbe386ebcfa3604956d
SHA1: 9fe4ad206016dea9c758aadc269ebb77dce472c0
SHA256: d78909002fc6e295284f91d8db701497659fc101fca38c2d805334a2bb8bbfa8
SSDeep: 393216:W9mADn1yVqVphE3V4cxFQltcfet/mFzD6DpiLMoTtwRozD:W9mArpvcrQXLt2CDp M ks
Size: 15618560 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: UPolyXv05_v6
Company: no certificate found
Created at: 2009-03-08 13:32:38
Analyzed on: WindowsXP SP3 32-bit
Summary: Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).
Dynamic Analysis
Payload
No specific payload has been found.
Process activity
The Trojan creates the following process(es):
Setup.exe:2560
%original file name%.exe:1568
MsiExec.exe:1216
SETUP2~1.EXE:1528
The Trojan injects its code into the following process(es):
spoolsv.exe:1432
Explorer.EXE:1948
Mutexes
The following mutexes were created/opened:No objects were found.
File activity
The process Setup.exe:2560 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\MSIB2.tmp (1028428 bytes)
The process %original file name%.exe:1568 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\IXP000.TMP\Setup.exe (260033 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\IXP000.TMP\SETUP2~1.EXE (2104 bytes)
The Trojan deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\IXP000.TMP\Setup.exe (0 bytes)
The process MsiExec.exe:1216 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\CFGB4.tmp (196 bytes)
The process SETUP2~1.EXE:1528 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
%Documents and Settings%\All Users\Documents\dll (44 bytes)
%Documents and Settings%\All Users\Documents\k.dll (3 bytes)
The Trojan deletes the following file(s):
%Documents and Settings%\All Users\Documents\k.dll (0 bytes)
Registry activity
The process Setup.exe:2560 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "FD A9 02 05 83 87 84 80 EE 71 4F 54 4E B2 24 4C"
The process %original file name%.exe:1568 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "6F B1 B9 D5 BC D1 D4 C8 5F AB E0 07 99 BE 96 2D"
To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"wextract_cleanup0" = "rundll32.exe %System%\advpack.dll,DelNodeRunDLL32 C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\IXP000.TMP\"
The Trojan deletes the following value(s) in system registry:
The Trojan disables automatic startup of the application by deleting the following autorun value:
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"wextract_cleanup0"
The process MsiExec.exe:1216 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "2D 2D 85 93 0C F6 15 BA 41 F0 DE 0A E4 6C 0D E4"
The process SETUP2~1.EXE:1528 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "F2 26 C6 75 F2 EF D2 9C 12 EC D7 23 ED 90 C3 29"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"
Dropped PE files
| MD5 | File path |
|---|---|
| fbcc8ddc61ae2dddadf29200c86e56c8 | c:\Documents and Settings\All Users\Documents\19792079 |
| 12896823fb95bfb3dc9b46bcaedc9923 | c:\WINDOWS\Temp\explorer.dat |
| ed0ef0a136dec83df69f04118870003e | c:\WINDOWS\Temp\winlogon.dat |
| 1441b5df605294cbb9453f3abf12b2a6 | c:\WINDOWS\system32\k.dll |
HOSTS file anomalies
The Trojan modifies "%System%\drivers\etc\hosts" file which is used to translate DNS entries to IP addresses. The modified file is 5628 bytes in size. The following strings are added to the hosts file listed below:
| 127.0.0.1 | 82.165.237.14 |
| 127.0.0.1 | 82.165.250.33 |
| 127.0.0.1 | akamai.avg.com |
| 127.0.0.1 | antivir.es |
| 127.0.0.1 | anti-virus.by |
| 127.0.0.1 | avast.com |
| 127.0.0.1 | avg.com |
| 127.0.0.1 | avp.com |
| 127.0.0.1 | avp.ru |
| 127.0.0.1 | avp.ru/download/ |
| 127.0.0.1 | avpg.crsi.symantec.com |
| 127.0.0.1 | backup.avg.cz |
| 127.0.0.1 | bancoguayaquil.com |
| 127.0.0.1 | bcpzonasegura.viabcp.com |
| 127.0.0.1 | bitdefender.com |
| 127.0.0.1 | clamav.net |
| 127.0.0.1 | comodo.com |
| 127.0.0.1 | customer.symantec.com |
| 127.0.0.1 | dispatch.mcafee.com |
| 127.0.0.1 | download.mcafee.com |
| 127.0.0.1 | download.microsoft.com |
| 127.0.0.1 | downloads.microsoft.com |
| 127.0.0.1 | downloads1.kaspersky-labs.com |
| 127.0.0.1 | downloads1.kaspersky-labs.com/products/ |
| 127.0.0.1 | downloads1.kaspersky-labs.com/updates/ |
| 127.0.0.1 | downloads2.kaspersky-labs.com |
| 127.0.0.1 | downloads2.kaspersky-labs.com/products/ |
| 127.0.0.1 | downloads2.kaspersky-labs.com/updates/ |
| 127.0.0.1 | downloads3.kaspersky-labs.com |
| 127.0.0.1 | downloads3.kaspersky-labs.com/products/ |
| 127.0.0.1 | downloads3.kaspersky-labs.com/updates/ |
| 127.0.0.1 | downloads4.kaspersky-labs.com |
| 127.0.0.1 | downloads4.kaspersky-labs.com/products/ |
| 127.0.0.1 | downloads4.kaspersky-labs.com/updates/ |
| 127.0.0.1 | downloads5.kaspersky-labs.com |
| 127.0.0.1 | downloads5.kaspersky-labs.com/products/ |
| 127.0.0.1 | downloads5.kaspersky-labs.com/updates/ |
| 127.0.0.1 | drweb.com |
| 127.0.0.1 | emsisoft.com |
| 127.0.0.1 | eset.com |
| 127.0.0.1 | eset.com/ |
| 127.0.0.1 | eset.com/download/index.php |
| 127.0.0.1 | eset.com/joomla/ |
| 127.0.0.1 | eset.com/products/index.php |
| 127.0.0.1 | eset.es |
| 127.0.0.1 | fortinet.com |
| 127.0.0.1 | f-prot.com |
| 127.0.0.1 | f-secure.com |
| 127.0.0.1 | gdata.es |
| 127.0.0.1 | go.microsoft.com |
| 127.0.0.1 | hacksoft.com.pe |
| 127.0.0.1 | ikarus.at |
| 127.0.0.1 | kaspersky.com |
| 127.0.0.1 | kaspersky.ru |
| 127.0.0.1 | kaspersky-labs.com |
| 127.0.0.1 | liveupdate.symantec.com |
| 127.0.0.1 | liveupdate.symantecliveupdate.com |
| 127.0.0.1 | macafee.com |
| 127.0.0.1 | mast.mcafee.com |
| 127.0.0.1 | mcafee.com |
| 127.0.0.1 | microsoft.com |
| 127.0.0.1 | msdn.microsoft.com |
| 127.0.0.1 | my-etrust.com |
| 127.0.0.1 | networkassociates.com |
| 127.0.0.1 | nod32.com |
| 127.0.0.1 | norman.com |
| 127.0.0.1 | norton.com |
| 127.0.0.1 | nprotect.com |
| 127.0.0.1 | pandasecurity.com |
| 127.0.0.1 | pandasoftware.com |
| 127.0.0.1 | pctools.com |
| 127.0.0.1 | pif.symantec.com |
| 127.0.0.1 | pifmain.symantec.com |
| 127.0.0.1 | rads.mcafee.com |
| 127.0.0.1 | rising-global.com |
| 127.0.0.1 | scanner.novirusthanks.org |
| 127.0.0.1 | secure.nai.com |
| 127.0.0.1 | securityresponse.symantec.com |
| 127.0.0.1 | service1.symantec.com |
| 127.0.0.1 | sophos.com |
| 127.0.0.1 | sunbeltsoftware.com |
| 127.0.0.1 | support.microsoft.com |
| 127.0.0.1 | symantec.com |
| 127.0.0.1 | symantec.com/updates |
| 127.0.0.1 | threatexpert.com |
| 127.0.0.1 | trendmicro.com |
| 127.0.0.1 | u2.eset.com |
| 127.0.0.1 | u20.eset.com |
| 127.0.0.1 | u3.eset.com |
| 127.0.0.1 | u3.eset.com/ |
| 127.0.0.1 | u4.eset.com |
| 127.0.0.1 | u4.eset.com/ |
| 127.0.0.1 | u7.eset.com |
| 127.0.0.1 | update.avg.com |
| 127.0.0.1 | update.microsoft.com |
| 127.0.0.1 | update.symantec.com |
| 127.0.0.1 | updates.symantec.com |
| 127.0.0.1 | updates1.kaspersky-labs.com |
| 127.0.0.1 | updates2.kaspersky-labs.com |
| 127.0.0.1 | updates3.kaspersky-labs.com |
| 127.0.0.1 | us.mcafee.com |
| 127.0.0.1 | viabcp.com |
| 127.0.0.1 | virscan.org |
| 127.0.0.1 | virusbuster.hu |
| 127.0.0.1 | viruslist.com |
| 127.0.0.1 | viruslist.ru |
| 127.0.0.1 | virusscan.jotti.org |
| 127.0.0.1 | virustotal.com |
| 127.0.0.1 | windowsupdate.microsoft.com |
| 127.0.0.1 | www.ahnlab.com |
| 127.0.0.1 | www.aladdin.com |
| 127.0.0.1 | www.antivir.es |
| 127.0.0.1 | www.antiy.net |
| 127.0.0.1 | www.authentium.com |
| 127.0.0.1 | www.avast.com |
| 127.0.0.1 | www.avg.com |
| 127.0.0.1 | www.avp.com |
| 127.0.0.1 | www.avp.ru |
| 127.0.0.1 | www.avp.ru/download/ |
| 127.0.0.1 | www.bitdefender.com |
| 127.0.0.1 | www.clamav.net |
| 127.0.0.1 | www.comodo.com |
| 127.0.0.1 | www.download.mcafee.com |
| 127.0.0.1 | www.drweb.com |
| 127.0.0.1 | www.emsisoft.com |
| 127.0.0.1 | www.eset.com |
| 127.0.0.1 | www.eset.com/ |
| 127.0.0.1 | www.eset.com/download/index.php |
| 127.0.0.1 | www.eset.com/joomla/ |
| 127.0.0.1 | www.eset.com/products/index.php |
| 127.0.0.1 | www.fortinet.com |
| 127.0.0.1 | www.f-prot.com |
| 127.0.0.1 | www.f-secure.com |
| 127.0.0.1 | www.gdata.es |
| 127.0.0.1 | www.grisoft.com |
| 127.0.0.1 | www.ikarus.at |
| 127.0.0.1 | www.kaspersky.com |
| 127.0.0.1 | www.kaspersky.ru |
| 127.0.0.1 | www.kaspersky-labs.com |
| 127.0.0.1 | www.macafee.com |
| 127.0.0.1 | www.mcafee.com |
| 127.0.0.1 | www.microsoft.com |
| 127.0.0.1 | www.my-etrust.com |
| 127.0.0.1 | www.networkassociates.com |
| 127.0.0.1 | www.nod32.com |
| 127.0.0.1 | www.norman.com |
| 127.0.0.1 | www.norton.com |
| 127.0.0.1 | www.nprotect.com |
| 127.0.0.1 | www.pandasecurity.com |
| 127.0.0.1 | www.pandasoftware.com |
| 127.0.0.1 | www.pctools.com |
| 127.0.0.1 | www.rising-global.com |
| 127.0.0.1 | www.scanner.novirusthanks.org |
| 127.0.0.1 | www.sophos.com |
| 127.0.0.1 | www.sunbeltsoftware.com |
| 127.0.0.1 | www.symantec.com |
| 127.0.0.1 | www.symantec.com/updates |
| 127.0.0.1 | www.trendmicro.com |
| 127.0.0.1 | www.virscan.org |
| 127.0.0.1 | www.viruslist.com |
| 127.0.0.1 | www.viruslist.ru |
| 127.0.0.1 | www.virusscan.jotti.org |
| 127.0.0.1 | www.virustotal.com |
| 127.0.0.1 | www.windowsupdate.microsoft.com |
Rootkit activity
No anomalies have been detected.
Propagation
Removals
Static Analysis
VersionInfo
Company Name: Microsoft Corporation
Product Name: HD Player
Product Version: 8.00.6001.18702
Legal Copyright: (c) Microsoft Corporation. All rights reserved.
Legal Trademarks:
Original Filename: WEXTRACT.EXE
Internal Name: Wextract
File Version: 8.00.6001.18702 (longhorn_ie8_rtm(wmbla).090308-0339)
File Description: Win32 Cabinet Self-Extractor
Comments:
Language: Language Neutral
Company Name: Microsoft CorporationProduct Name: HD Player Product Version: 8.00.6001.18702Legal Copyright: (c) Microsoft Corporation. All rights reserved.Legal Trademarks: Original Filename: WEXTRACT.EXE Internal Name: Wextract File Version: 8.00.6001.18702 (longhorn_ie8_rtm(wmbla).090308-0339)File Description: Win32 Cabinet Self-Extractor Comments: Language: Language Neutral
PE Sections
| Name | Virtual Address | Virtual Size | Raw Size | Entropy | Section MD5 |
|---|---|---|---|---|---|
| .text | 4096 | 43568 | 44032 | 4.49092 | 01bd9281049701d15cfdc4ea914085d3 |
| .data | 49152 | 8800 | 1536 | 4.57321 | f3764284f4d25ed35f75b9c16e1ab608 |
| .rsrc | 61440 | 15568316 | 15568384 | 5.54455 | 9fd2741064d61b2c4c119009e835c264 |
| .reloc | 15630336 | 3280 | 3584 | 3.32738 | 0d1a3239e0dfa95a30f03f130df7797e |
Dropped from:
Downloaded by:
Similar by SSDeep:
Similar by Lavasoft Polymorphic Checker:
Network Activity
URLs
IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)
Traffic
Map
The Trojan connects to the servers at the folowing location(s):
Strings from Dumps
MsiExec.exe_1216:
.text
.text
`.data
`.data
.rsrc
.rsrc
msvcrt.dll
msvcrt.dll
ADVAPI32.dll
ADVAPI32.dll
KERNEL32.dll
KERNEL32.dll
NTDLL.DLL
NTDLL.DLL
USER32.dll
USER32.dll
ole32.dll
ole32.dll
msi.dll
msi.dll
WinHttpOpen
WinHttpOpen
WinHttpConnect
WinHttpConnect
WinHttpCrackUrl
WinHttpCrackUrl
WinHttpOpenRequest
WinHttpOpenRequest
WinHttpCloseHandle
WinHttpCloseHandle
WinHttpSendRequest
WinHttpSendRequest
WinHttpReceiveResponse
WinHttpReceiveResponse
WinHttpQueryDataAvailable
WinHttpQueryDataAvailable
WinHttpReadData
WinHttpReadData
WinHttpQueryHeaders
WinHttpQueryHeaders
WinHttpGetProxyForUrl
WinHttpGetProxyForUrl
WinHttpGetIEProxyConfigForCurrentUser
WinHttpGetIEProxyConfigForCurrentUser
WinHttpSetOption
WinHttpSetOption
RegDeleteKeyExW
RegDeleteKeyExW
SQLInstallDriverExW
SQLInstallDriverExW
SQLConfigDriverW
SQLConfigDriverW
SQLRemoveDriverW
SQLRemoveDriverW
SQLInstallTranslatorExW
SQLInstallTranslatorExW
SQLRemoveTranslatorW
SQLRemoveTranslatorW
SQLConfigDataSourceW
SQLConfigDataSourceW
SQLInstallerErrorW
SQLInstallerErrorW
SQLInstallDriverManagerW
SQLInstallDriverManagerW
SQLRemoveDriverManagerW
SQLRemoveDriverManagerW
UrlCanonicalizeW
UrlCanonicalizeW
UrlCombineW
UrlCombineW
UrlIsW
UrlIsW
UrlIsFileUrlW
UrlIsFileUrlW
UrlGetPartW
UrlGetPartW
PathCreateFromUrlW
PathCreateFromUrlW
DeleteUrlCacheEntryW
DeleteUrlCacheEntryW
URLDownloadToCacheFileW
URLDownloadToCacheFileW
SetThreadExecutionState
SetThreadExecutionState
GetSystemWindowsDirectoryW
GetSystemWindowsDirectoryW
NtRenameKey
NtRenameKey
NtOpenKey
NtOpenKey
TermsrvLogInstallIniFileEx
TermsrvLogInstallIniFileEx
WTHelperGetProvCertFromChain
WTHelperGetProvCertFromChain
CertDuplicateCertificateContext
CertDuplicateCertificateContext
CertFreeCertificateContext
CertFreeCertificateContext
ReportFault
ReportFault
ApphelpFixMsiPackageExe
ApphelpFixMsiPackageExe
msiexec.pdb
msiexec.pdb
PSSSSSSh
PSSSSSSh
SSSSht
SSSSht
_acmdln
_acmdln
RegOpenKeyExW
RegOpenKeyExW
RegCreateKeyExW
RegCreateKeyExW
RegCloseKey
RegCloseKey
RegDeleteKeyW
RegDeleteKeyW
RegEnumKeyW
RegEnumKeyW
RegEnumKeyExW
RegEnumKeyExW
RegGetKeySecurity
RegGetKeySecurity
MsgWaitForMultipleObjects
MsgWaitForMultipleObjects
ntdll.dll
ntdll.dll
name="MSIExec"
name="MSIExec"
version="4.0.0.0"
version="4.0.0.0"
<description> Windows installer setup service </description>
<description> Windows installer setup service </description>
name="Microsoft.Windows.Common-Controls"
name="Microsoft.Windows.Common-Controls"
version="6.0.0.0"
version="6.0.0.0"
publicKeyToken="6595b64144ccf1df"
publicKeyToken="6595b64144ccf1df"
Msi.Package
Msi.Package
Windows Installer Package
Windows Installer Package
Msi.Patch
Msi.Patch
Windows Installer Patch
Windows Installer Patch
APPID\%s
APPID\%s
%s\DefaultIcon
%s\DefaultIcon
%s\CLSID
%s\CLSID
CLSID\%s
CLSID\%s
CLSID\%s\ProgId
CLSID\%s\ProgId
Msi.dll
Msi.dll
MsiRegMv.Exe
MsiRegMv.Exe
MsiExecCA32
MsiExecCA32
Software\Microsoft\Windows\CurrentVersion\Installer
Software\Microsoft\Windows\CurrentVersion\Installer
{lX-0000-0000-C000-000000000046}
{lX-0000-0000-C000-000000000046}
ISMIF32.DLL
ISMIF32.DLL
RICHED20.DLL
RICHED20.DLL
%d.d.%.4d.%d
%d.d.%.4d.%d
REINSTALL=ALL REINSTALLMODE=%s
REINSTALL=ALL REINSTALLMODE=%s
Error: %d. %s.
Error: %d. %s.
Software\Policies\Microsoft\Windows\Installer
Software\Policies\Microsoft\Windows\Installer
Failed to connect to server. Error: 0x%X
Failed to connect to server. Error: 0x%X
FDeleteRegTree: Unable to delete subkey: %s
FDeleteRegTree: Unable to delete subkey: %s
Interface\{lX-0000-0000-C000-000000000046}\NumMethods
Interface\{lX-0000-0000-C000-000000000046}\NumMethods
3.1.4000
3.1.4000
3.0.3790
3.0.3790
%d.%d.%d
%d.%d.%d
CLSID\{lX-0000-0000-C000-000000000046}\DllVersion
CLSID\{lX-0000-0000-C000-000000000046}\DllVersion
FIsKeyLocalSystemOrAdminOwned: Could not get owner security info.
FIsKeyLocalSystemOrAdminOwned: Could not get owner security info.
PurgeUserOwnedSubkeys: Could not open subkey: %s
PurgeUserOwnedSubkeys: Could not open subkey: %s
PurgeUserOwnedSubkeys: Could not enumerate subkeys.
PurgeUserOwnedSubkeys: Could not enumerate subkeys.
PurgeUserOwnedSubkeys: Could not delete SubKey tree.
PurgeUserOwnedSubkeys: Could not delete SubKey tree.
PurgeUserOwnedSubkeys: %s not owned by System or Admin. Deleting key subkeys.
PurgeUserOwnedSubkeys: %s not owned by System or Admin. Deleting key subkeys.
PurgeUserOwnedInstallerKeys: Could not delete tree.
PurgeUserOwnedInstallerKeys: Could not delete tree.
PurgeUserOwnedInstallerKeys: Key '%s' not owned by System or Admin. Deleting key subkeys.
PurgeUserOwnedInstallerKeys: Key '%s' not owned by System or Admin. Deleting key subkeys.
PurgeUserOwnedInstallerKeys: Could not open key '%s'
PurgeUserOwnedInstallerKeys: Could not open key '%s'
OpenProcessToken failed with %d
OpenProcessToken failed with %d
passive
passive
Software\Microsoft\Windows\CurrentVersion\Installer\RunOnceEntries
Software\Microsoft\Windows\CurrentVersion\Installer\RunOnceEntries
SetInstallerACLs: Could not create Secure Installer sub key.
SetInstallerACLs: Could not create Secure Installer sub key.
SetInstallerACLs: Could not delete Installer key tree.
SetInstallerACLs: Could not delete Installer key tree.
SetInstallerACLs: Installer key not owned by System or Admin. Deleting key subkeys and re-creating.
SetInstallerACLs: Installer key not owned by System or Admin. Deleting key subkeys and re-creating.
SetInstallerACLs: Could not create Installer key.
SetInstallerACLs: Could not create Installer key.
kernel32.dll
kernel32.dll
WINHTTP
WINHTTP
fusion.dll
fusion.dll
URLMON
URLMON
RPCRT4
RPCRT4
Windows
Windows
3.1.4001.5512
3.1.4001.5512
msiexec
msiexec
msiexec.exe
msiexec.exe
Windows Installer - Unicode
Windows Installer - Unicode
spoolsv.exe_1432_rwx_00970000_0000E000:
HTTP/1.1
HTTP/1.1
Software\Microsoft\Windows\CurrentVersion\Explorer\LowRegistry
Software\Microsoft\Windows\CurrentVersion\Explorer\LowRegistry
SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore
SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore
\user32.dll
\user32.dll
k.dll
k.dll
spoolsv.exe
spoolsv.exe
/message.php
/message.php
.co.cc
.co.cc
.co.cz
.co.cz
.info
.info
\updhlp.dat
\updhlp.dat