ThreatExpert Report: Backdoor.Win32.Azbreg.k, Downloader.a!bwn, Mal/FakeAV-PE..

Visit ThreatExpert web site

Close Report

Submission Summary:

Submission details:

Submission received: 21 June 2012, 01:35:46
Processing time: 11 min 55 sec
Submitted sample:

File MD5: 0x222E551BE8E78796334293D8DEC54DD7
File SHA-1: 0x61BAD34D6FE627A6E92FF7B71374865CA08EA3C2
Filesize: 84,480 bytes
Alias:

Backdoor.Win32.Azbreg.k [Kaspersky Lab]
Downloader.a!bwn [McAfee]
Mal/FakeAV-PE [Sophos]
Trojan-Downloader.Win32.Obvod [Ikarus]

Summary of the findings:

What's been found	Severity Level
Produces outbound traffic.
Downloads/requests other files from Internet.
Contains characteristics of an identified security risk.

Technical Details:

Possible Security Risk

Attention! The following threat category was identified:

Threat Category	Description
	A malicious backdoor trojan that runs in the background and allows remote access to the compromised system

File System Modifications

The following files were created in the system:

#	Filename(s)	File Size	File Hash	Alias
1	%CommonAppData%\rM1sV4K2.exe [file and pathname of the sample #1]	84,480 bytes	MD5: 0x222E551BE8E78796334293D8DEC54DD7 SHA-1: 0x61BAD34D6FE627A6E92FF7B71374865CA08EA3C2	Backdoor.Win32.Azbreg.k [Kaspersky Lab] Downloader.a!bwn [McAfee] Mal/FakeAV-PE [Sophos] Trojan-Downloader.Win32.Obvod [Ikarus]
2	%Temp%\bV7cF1T8.dat	20 bytes	MD5: 0xC003E06EE3DAE3551D7B9267E4BBAD41 SHA-1: 0x0BD50145946A596EA21B6DF9335A8CAF258914E5	(not available)
3	%Temp%\qL4rU7J5.dat	240,177 bytes	MD5: 0x32D0160A32D5A01E3A2A64058780A76D SHA-1: 0xDA0600F6F0B27DE3E079160056DF9B629AC12FF9	(not available)
4	%Windir%\Tasks\At1.job	416 bytes	MD5: 0x3C36AE1D71EA0BEAEE7F13551ED86AEF SHA-1: 0xA47DF16BC398BE999BA3979216B31E36798F61E1	(not available)
5	%Windir%\Tasks\At10.job	416 bytes	MD5: 0xF9CFC31A0C0C109BC56559245D304F6E SHA-1: 0x68E09F29EF584D350DA6B6A9B529A750FFDDCBD5	(not available)
6	%Windir%\Tasks\At11.job	416 bytes	MD5: 0xE9E7DF3335C9670885060FA9674D1D1F SHA-1: 0x9B87F7CCD455B421F1431E87AD33992951491CC4	(not available)
7	%Windir%\Tasks\At12.job	416 bytes	MD5: 0x03728A43EF351B666B6FE0A4BBA13ECC SHA-1: 0x35FB333865DA2251B5C206FB43D63F7ADCA63A44	(not available)
8	%Windir%\Tasks\At13.job	416 bytes	MD5: 0xA69F63844D91E10D211B5AAEC2AEBB4C SHA-1: 0x22D6A6EA52D64B62AB9D56836473FBA96D86C3BD	(not available)
9	%Windir%\Tasks\At14.job	416 bytes	MD5: 0x4A178E11EADD8E976712E3BA1699AC11 SHA-1: 0x1564CE6A318431B145AC5DF80B7083054AE301D2	(not available)
10	%Windir%\Tasks\At15.job	416 bytes	MD5: 0xF188D0F23D45CEAD69071214B168220E SHA-1: 0xE264813CD6E6C7717E6F1C5FE08BDE16BC3CAA75	(not available)
11	%Windir%\Tasks\At16.job	416 bytes	MD5: 0x3DF4067F87B1C0F06421449FC27F8F4C SHA-1: 0x700DE1A86CAA7B010FC6FE769E42A7B407CC64AC	(not available)
12	%Windir%\Tasks\At17.job	416 bytes	MD5: 0x0EC44ED1233F591E92A0853BF6EDB934 SHA-1: 0x22BA0503DB825AB08D90C662AAEDCBCEB2A039B2	(not available)
13	%Windir%\Tasks\At18.job	416 bytes	MD5: 0x64AD0DF675E6A2794EB2B3B132E63CC0 SHA-1: 0xF1ADEC406BB4A91FE3B7D2F68239C300B1F175F6	(not available)
14	%Windir%\Tasks\At19.job	416 bytes	MD5: 0x4BDFEB64B1B7461B480CE595E180E480 SHA-1: 0xC25223588BEAE27B5C6D49C30C3ED18DCFD4A890	(not available)
15	%Windir%\Tasks\At2.job	416 bytes	MD5: 0x7C004CB7F2C98D0C560858CF91514A7A SHA-1: 0xC0F36F899DFB482D97D0C5C34307C73B13E29B06	(not available)
16	%Windir%\Tasks\At20.job	416 bytes	MD5: 0x4D1717E156C549AD6989FAD3D4A8FCC5 SHA-1: 0x9A36FF3FD9B8814068AE6CE23DDEE132B9AE1E76	(not available)
17	%Windir%\Tasks\At21.job	416 bytes	MD5: 0x0065C27980BE3A23D2FF9A7F4660CF2F SHA-1: 0x1F3CF8289FA15A31A8297D5C4A365A102BA4A968	(not available)
18	%Windir%\Tasks\At22.job	416 bytes	MD5: 0x56EA6E84CDC877D29DE831AEE5BE1CFF SHA-1: 0x190AE8583FC8EB618F6DC19A307B83440E6FFB14	(not available)
19	%Windir%\Tasks\At23.job	416 bytes	MD5: 0x49CF4B79FB1912450BCB4DB784147725 SHA-1: 0x6974EC70A34F16F73B9DDCD29ACAA7A0A797299A	(not available)
20	%Windir%\Tasks\At24.job	416 bytes	MD5: 0x26F4901AF068E6361D0E1EE9373E53E3 SHA-1: 0x7DAD5D8BB80EB196628B9E46581EF39C9AE4F9D6	(not available)
21	%Windir%\Tasks\At25.job	418 bytes	MD5: 0x4EE8464F96F1590DE57369CEC2D97430 SHA-1: 0x8B01E209AE124197EF68942503AAFD53C8D3F5F5	(not available)
22	%Windir%\Tasks\At26.job	418 bytes	MD5: 0xEC6C5CA1A3F08389BDB143D1DDF63BDC SHA-1: 0x762F1F7084E65827D98DED17505C4927AD357F4E	(not available)
23	%Windir%\Tasks\At27.job	418 bytes	MD5: 0xF56C3AFDDD3069351E5690B03A746EF0 SHA-1: 0xE1154B67C7C27F3A3B9F22870C6D217A313B2A75	(not available)
24	%Windir%\Tasks\At28.job	418 bytes	MD5: 0xFE4C40D8B7D1AFAA8FFD9772B99505EA SHA-1: 0x53E589C1E97B43775769D21B0E58C18C17FCE928	(not available)
25	%Windir%\Tasks\At29.job	418 bytes	MD5: 0x3DCD9B23A464F36CE4DF0ECDACD70085 SHA-1: 0x253369312846A401810D314236157C0F669F494C	(not available)
26	%Windir%\Tasks\At3.job	416 bytes	MD5: 0x95268BB197DC63DB9B7A38CD4B223B73 SHA-1: 0x91C2F0717DC55E8202CE85ADB022AD90CAFD53B1	(not available)
27	%Windir%\Tasks\At30.job	418 bytes	MD5: 0xE354D7EC2714FC0D543B0F619E54125B SHA-1: 0x5529385494A691FE3ADB539A8CCFFE62AE92E392	(not available)
28	%Windir%\Tasks\At31.job	418 bytes	MD5: 0x9FBB6988637B9725F2605F8DCD50194A SHA-1: 0x23657F2B7DCAAC6D8BB2C8A820199705A4A016C0	(not available)
29	%Windir%\Tasks\At32.job	418 bytes	MD5: 0xE6DD871B33AE9AF319DA2AE08900FA03 SHA-1: 0xA993B517BEFDD572381618693F6A11E9A40A99F9	(not available)
30	%Windir%\Tasks\At33.job	418 bytes	MD5: 0x7EB506284EACA103E125C6FF272517E8 SHA-1: 0x8991130083E67D808ABCD4D539219D88C4EE9087	(not available)
31	%Windir%\Tasks\At34.job	418 bytes	MD5: 0x8F5D1F4255613101F69F9E4B505F355C SHA-1: 0xCF67EE1AE91D2A8DA066A024D46D80DFDD879FB0	(not available)
32	%Windir%\Tasks\At35.job	418 bytes	MD5: 0x161EEF1426C95DBE538845DCCF072B04 SHA-1: 0x880F8622BB91D153507E104AEF3D4BF28962EB32	(not available)
33	%Windir%\Tasks\At36.job	418 bytes	MD5: 0x507F59F9DF15D12D473646DC755E2403 SHA-1: 0x6D843660761C50D432F8DEF9C25448E047119CF3	(not available)
34	%Windir%\Tasks\At37.job	418 bytes	MD5: 0xFF9D0A4A96897B352692064460F9563F SHA-1: 0x3E86CE81994B92B3B80A3439CC942DEF6AAC3D43	(not available)
35	%Windir%\Tasks\At38.job	418 bytes	MD5: 0x38602CFE5FF31F52D247E35691374916 SHA-1: 0x137D8969F6BDE52E2981A5BC3F0F41BBE81C25F5	(not available)
36	%Windir%\Tasks\At39.job	418 bytes	MD5: 0xBCE49E22578AEC3F4412599B137FC0F4 SHA-1: 0x747F7D86AA147C1314DC90AC77C843F073DD0F1B	(not available)
37	%Windir%\Tasks\At4.job	416 bytes	MD5: 0xC6A6C9CF4157F18525952E793F31088B SHA-1: 0x3406A02CE51268144AA6BE0E14CCD3F28D0A485E	(not available)
38	%Windir%\Tasks\At40.job	418 bytes	MD5: 0x2CB97EB671B6754A8A041FA103106647 SHA-1: 0x3DAD2ADAEDF7DFA080DA8766B0801D3D462A7BBE	(not available)
39	%Windir%\Tasks\At41.job	418 bytes	MD5: 0xBCAE33AE6E5C56D63FB9A7074D61C9BD SHA-1: 0x7A11D91721F23DA48E3F8F0C38A9E34C0F9DCB61	(not available)
40	%Windir%\Tasks\At42.job	418 bytes	MD5: 0x447149ED2947E3A318AE9CCDFB9DD03D SHA-1: 0x0F774ECEC040368BF6CE01673EB8869C29FC5024	(not available)
41	%Windir%\Tasks\At43.job	418 bytes	MD5: 0x3DE86E42F4CE4397D401EC24A08BE62A SHA-1: 0x96B0EAAD0B9C1D7325B9E8321535401F88A472D3	(not available)
42	%Windir%\Tasks\At44.job	418 bytes	MD5: 0xD29086532E62FE94F8246B394F32BB6F SHA-1: 0x3C3DEE4274F118FE36BCB31042F30418D7E1E9BE	(not available)
43	%Windir%\Tasks\At45.job	418 bytes	MD5: 0xE4F737D0316C82C39050418546E8B128 SHA-1: 0xFA3C05DD2C73879B44E3F2A8E9392650B17FC9A7	(not available)
44	%Windir%\Tasks\At46.job	418 bytes	MD5: 0x8A221331318A969185C4B9886B0AF17C SHA-1: 0x9BC1840FE800A32E514B8D4FFB912DCEEA2CE058	(not available)
45	%Windir%\Tasks\At47.job	418 bytes	MD5: 0x0D9D76FAC330F72FC2CE7113AD15B0D9 SHA-1: 0x0B78BA3CA378ECBFBD7B8D7065604A6476835D2C	(not available)
46	%Windir%\Tasks\At48.job	418 bytes	MD5: 0xB9610E27A993F5FBAE5C08A66B55397F SHA-1: 0xB1C58AF8A365933A9CA7F7DB08E89E686323F93D	(not available)
47	%Windir%\Tasks\At5.job	416 bytes	MD5: 0xF6F43C153C876DF71485889F98CA5D93 SHA-1: 0x307CDD1890C2F82512A5E9FB635D8EDF5EDA0D6D	(not available)
48	%Windir%\Tasks\At6.job	416 bytes	MD5: 0x8D24A30BEC1A880729860F3D02B27881 SHA-1: 0xBCD31E8F26FF61325423672CD17855B2E83AFF30	(not available)
49	%Windir%\Tasks\At7.job	416 bytes	MD5: 0x7F4E5CC544C6DC415AF02C917A44BB4F SHA-1: 0x609A05019262790AFC8BA7E952A23B9667BD3F65	(not available)
50	%Windir%\Tasks\At8.job	416 bytes	MD5: 0x55322247159CC87282F2868BE9429AFF SHA-1: 0x0829E6C304E1F2D0A425591A56D642275EC6A062	(not available)
51	%Windir%\Tasks\At9.job	416 bytes	MD5: 0x39AE5FB613C1ED4354597B1EBAFF713C SHA-1: 0x7F1B1DABEED45CC7497E1DF6D96758E90B6B580F	(not available)

Notes:

%CommonAppData% is a variable that refers to the file system directory containing application data for all users. A typical path is C:\Documents and Settings\All Users\Application Data.
%Temp% is a variable that refers to the temporary folder in the short path form. By default, this is C:\Documents and Settings\[UserName]\Local Settings\Temp\ (Windows NT/2000/XP).
%Windir% is a variable that refers to the Windows installation folder. By default, this is C:\Windows or C:\Winnt.

Memory Modifications

There was a new process created in the system:

Process Name	Process Filename	Main Module Size
[filename of the sample #1]	[file and pathname of the sample #1]	114,688 bytes

Registry Modifications

The newly created Registry Values are:

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Direct3D]

LRC = 0x000000D3
BLRC = 70 5C 9D 20 89 4F CD 01

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]

DisableScriptDebuggerIE = "yes"
Error Dlg Displayed On Every Error = "no"
NoProtectedModeBanner = 0x00000001

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3]

2500 = 0x00000003

Other details

There were registered attempts to establish connection with the remote hosts. The connection details are:

Remote Host	Port Number
192.221.113.105	80
204.0.5.42	80
208.66.66.71	80
216.34.207.177	80
50.17.225.137	80
50.19.134.115	80
64.208.138.109	80
64.208.138.218	80
64.94.107.35	80
66.135.202.211	80

The data identified by the following URLs was then requested from the remote web server:

http://ads.pubmatic.com/AdServer/js/syncuppixels.html?p=26826&s=27860
http://ads.pubmatic.com/AdServer/js/adtrack3f956a53dccff26daaaa1e5b25e1dfdf.js
http://ads.pubmatic.com/AdServer/js/cutildee6d705a5077f097c8c64e02d002b24.js
http://ads.pubmatic.com/AdServer/js/freq.html
http://ads.pubmatic.com/AdServer/js/syncuppixels.html?p=26826&s=27861
http://ads.pubmatic.com/AdServer/js/dppix.html?p=26826&s=27861&a=23118
http://ads.pubmatic.com/AdServer/js/adtrackJ96d70a01ff7d18e221e32fc459fa3166.js
http://ads.pubmatic.com/AdServer/js/showad.js
http://ads.pubmatic.com/AdServer/js/dppix.html?p=26826&s=27860&a=23115
http://uat-net.technoratimedia.com/00/63/76/adserv_17663.js?ad_size=728x90&referrer=&referrer=http%3A//ib.adnxs.com/bounce%3F%252Ftt%253Fid%253D826653&nsafe=general&reftype=adnetwork&disp=iframe&tmiv=1&tcb=0.8024391687799836
http://api.bizographics.com/v2/profile.redirect?api_key=1be3a6866fd64648a7b0c808e8551702&group_delimiter=,&industry_delimiter=,&functional_area_delimiter=,&callback_url=http://aud.pubmatic.com/AdServer/Artemis?dpid=7
http://pixel.invitemedia.com/pubmatic_sync?pubmatic_callback=http://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM5MCZ0bD0xMjk2MDA=&piggybackCookie=
http://ads.reduxmediagroup.com/tt?id=770816
http://ads.yieldads.com/tt?id=826653
http://pixel.quantserve.com/pixel/p-5aWVS_roA1dVM.gif?labels=Gaming
http://pixel.quantserve.com/pixel/p-cb6C0zFF7dWjI.gif
http://pixel.quantserve.com/pixel/p-b87YHM5GmIQE6.gif
http://aud.pubmatic.com/AdServer/Artemis?dpid=7&industry=business_services&location=texas
http://image4.pubmatic.com/AdServer/SPug
http://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM5MCZ0bD0xMjk2MDA%3D&piggybackCookie=6218ea8b-783a-44d3-b2ef-ced5e7c3cb77.
http://ad.yieldmanager.com/cms/v1?esig=1~17e68b1b86afcfd8436104fe567484ccc2161b0f&nwid=10000602235&sigv=1
http://ib.adnxs.com/ymapuid?xid=E0
http://ib.adnxs.com/tt?id=760218
http://ib.adnxs.com/tt?id=826653
http://ib.adnxs.com/tt?id=770816
http://ib.adnxs.com/tt?id=760215
http://ib.adnxs.com/bounce?%2Ftt%3Fid%3D826653
http://ib.adnxs.com/seg?add=289740&t=2
http://ib.adnxs.com/seg?add=328453&t=2
http://ib.adnxs.com/bounce?%2Ftt%3Fid%3D770816
http://ib.adnxs.com/pxj?bidder=55&action=SetAdMarketCookies(%22AA002%3d1340260662-3264751%7cMUID%3d2366f749c6b664310460f4cfc5b664a2%7cTOptOut%3d0%7cEANON%3dA%253d0%2526E%253dFFF%2526W%253d1%22);
http://ad-cdn.technoratimedia.com/00/63/76/uat_17663.js?ad_size=728x90&referrer=
http://b.scorecardresearch.com/beacon.js?c1=8&c2=6036211&c3=&c4=&c5=&c6=&c10=
http://b.scorecardresearch.com/p?c1=1&c2=6000006&c3=&c4=ts&c5=010000&c6=6666666&c10=&cA1=8&cA2=6000006&cA3=3845011&cA4=&cA5=757&cA6=6666666&cA10=&cv=1.7&cj=&rn=1340260654
http://d.agkn.com/iframe!t=1209!?che=54855&ent=092611&camid=032112&plaid=737669&adgid=4061
http://d.agkn.com/pixel/1701/!?che=7424860&camid=061512&plaid=14&attr=&uuid=4fe2c134fb0b0cb2
http://d.agkn.com/pixel/1697/!?uuid=c4185ef20b63baa134fded5332a5c061dde26dc0&che=01366602&camid=060812&plaid=1

Outbound traffic (potentially malicious)

There was an outbound traffic produced on port 80:

00000000 | 4745 5420 2F63 6F6E 7465 6E74 2F30 2F37 | GET /content/0/7
00000010 | 3131 2F31 3439 3339 382F 3836 3139 375F | 11/149398/86197_
00000020 | 5553 5F32 3031 325F 5132 5F4D 696C 6F5F | US_2012_Q2_Milo_
00000030 | 4C6F 6361 6C5F 3732 3878 3930 2E6A 733F | Local_728x90.js?
00000040 | 6D70 636B 3D72 6F76 6572 2E65 6261 792E | mpck=rover.ebay.
00000050 | 636F 6D25 3246 726F 7665 7225 3246 3125 | com%2Frover%2F1%
00000060 | 3246 3731 312D 3134 3933 3938 2D32 3537 | 2F711-149398-257
00000070 | 3037 2D31 3125 3246 3425 3346 7369 7465 | 07-11%2F4%3Fsite
00000080 | 6964 2533 4430 2532 366D 7074 2533 4431 | id%3D0%26mpt%3D1
00000090 | 3334 3032 3630 3634 3925 3236 5065 7266 | 340260649%26Perf
000000A0 | 5F54 7261 636B 6572 5F31 2533 442D 3125 | _Tracker_1%3D-1%
000000B0 | 3236 5065 7266 5F54 7261 636B 6572 5F32 | 26Perf_Tracker_2
000000C0 | 2533 4437 3630 3231 3825 3236 5065 7266 | %3D760218%26Perf
000000D0 | 5F54 7261 636B 6572 5F33 2533 4430 2E30 | _Tracker_3%3D0.0
000000E0 | 3130 3236 3525 3236 5065 7266 5F54 7261 | 10265%26Perf_Tra
000000F0 | 636B 6572 5F34 2533 4430 2532 3650 6572 | cker_4%3D0%26Per
00000100 | 665F 5472 6163 6B65 725F 3525 3344 7525 | f_Tracker_5%3Du%
00000110 | 3236 6578 745F 6964 2533 4437 3034 3136 | 26ext_id%3D70416
00000120 | 3130 3437 3233 3631 3237 3437 3833 2532 | 10472361274783%2
00000130 | 3650 6572 665F 5472 6163 6B65 725F 3625 | 6Perf_Tracker_6%
00000140 | 3344 3025 3236 5065 7266 5F54 7261 636B | 3D0%26Perf_Track
00000150 | 6572 5F37 2533 4430 2532 3650 6572 665F | er_7%3D0%26Perf_
00000160 | 5472 6163 6B65 725F 3825 3344 3025 3236 | Tracker_8%3D0%26
00000170 | 5065 7266 5F54 7261 636B 6572 5F31 3025 | Perf_Tracker_10%
00000180 | 3344 3232 3233 3432 2532 3650 6572 665F | 3D222342%26Perf_
00000190 | 5472 6163 6B65 725F 3925 3344 6874 7470 | Tracker_9%3Dhttp
000001A0 | 2532 3533 4125 3235 3246 2532 3532 4663 | %253A%252F%252Fc
000001B0 | 7261 7A79 7468 696E 6773 7061 7265 6E74 | razythingsparent
000001C0 | 7374 6578 742E 636F 6D25 3235 3246 2532 | stext.com%252F%2
000001D0 | 3661 6469 6425 3344 3434 3834 3732 2532 | 6adid%3D448472%2
000001E0 | 3666 6369 6425 3344 3434 3834 3632 2532 | 6fcid%3D448462%2
000001F0 | 3669 6E63 6E74 6C25 3344 3025 3236 6275 | 6incntl%3D0%26bu
00000200 | 636B 6574 2533 4431 3525 3236 6972 5F44 | cket%3D15%26ir_D
00000210 | 4150 5F49 3133 3125 3344 3425 3236 6972 | AP_I131%3D4%26ir
00000220 | 5F44 4150 5F49 3133 3225 3344 3125 3236 | _DAP_I132%3D1%26
00000230 | 6972 5F44 4150 5F49 3133 3325 3344 3064 | ir_DAP_I133%3D0d
00000240 | 6332 3933 3036 3133 3830 6134 3761 3035 | c293061380a47a05
00000250 | 3833 3039 3233 6664 3031 3437 3035 2532 | 830923fd014705%2
00000260 | 3669 725F 4441 505F 4935 2533 4430 2532 | 6ir_DAP_I5%3D0%2
00000270 | 3669 725F 4441 505F 4936 2533 4430 2532 | 6ir_DAP_I6%3D0%2
00000280 | 3669 725F 4441 505F 4931 3239 2533 4425 | 6ir_DAP_I129%3D%
00000290 | 3236 6972 5F44 4150 5F49 3133 3025 3344 | 26ir_DAP_I130%3D
000002A0 | 2532 3669 725F 4441 505F 4931 3035 2533 | %26ir_DAP_I105%3
000002B0 | 4430 2532 3669 6D70 5F72 7672 5F69 6425 | D0%26imp_rvr_id%
000002C0 | 3344 3335 3631 3835 3130 3535 3835 2673 | 3D356185105585&s
000002D0 | 6974 6569 643D 3026 6D70 743D 3133 3430 | iteid=0&mpt=1340
000002E0 | 3236 3036 3439 2650 6572 665F 5472 6163 | 260649&Perf_Trac
000002F0 | 6B65 725F 313D 2D31 2650 6572 665F 5472 | ker_1=-1&Perf_Tr
00000300 | 6163 6B65 725F 323D 3736 3032 3138 2650 | acker_2=760218&P
00000310 | 6572 665F 5472 6163 6B65 725F 333D 302E | erf_Tracker_3=0.
00000320 | 3031 3032 3635 2650 6572 665F 5472 6163 | 010265&Perf_Trac
00000330 | 6B65 725F 343D 3026 5065 7266 5F54 7261 | ker_4=0&Perf_Tra
00000340 | 636B 6572 5F35 3D75 2665 7874 5F69 643D | cker_5=u&ext_id=
00000350 | 3730 3431 3631 3034 3732 3336 3132 3734 | 7041610472361274
00000360 | 3738 3326 5065 7266 5F54 7261 636B 6572 | 783&Perf_Tracker
00000370 | 5F36 3D30 2650 6572 665F 5472 6163 6B65 | _6=0&Perf_Tracke
00000380 | 725F 373D 3026 5065 7266 5F54 7261 636B | r_7=0&Perf_Track
00000390 | 6572 5F38 3D30 2650 6572 665F 5472 6163 | er_8=0&Perf_Trac
000003A0 | 6B65 725F 3130 3D32 3232 3334 3226 5065 | ker_10=222342&Pe
000003B0 | 7266 5F54 7261 636B 6572 5F39 3D68 7474 | rf_Tracker_9=htt
000003C0 | 7025 3341 2532 4625 3246 6372 617A 7974 | p%3A%2F%2Fcrazyt
000003D0 | 6869 6E67 7370 6172 656E 7473 7465 7874 | hingsparentstext
000003E0 | 2E63 6F6D 2532 4626 6164 6964 3D34 3438 | .com%2F&adid=448
000003F0 | 3437 3226 6663 6964 3D34 3438 3436 3226 | 472&fcid=448462&
00000400 | 696E 636E 746C 3D30 2662 7563 6B65 743D | incntl=0&bucket=
00000410 | 3135 2669 725F 4441 505F 4931 3331 3D34 | 15&ir_DAP_I131=4
00000420 | 2669 725F 4441 505F 4931 3332 3D31 2669 | &ir_DAP_I132=1&i
00000430 | 725F 4441 505F 4931 3333 3D30 6463 3239 | r_DAP_I133=0dc29
00000440 | 3330 3631 3338 3061 3437 6130 3538 3330 | 3061380a47a05830
00000450 | 3932 3366 6430 3134 3730 3526 6972 5F44 | 923fd014705&ir_D
00000460 | 4150 5F49 353D 3026 6972 5F44 4150 5F49 | AP_I5=0&ir_DAP_I
00000470 | 363D 3026 6972 5F44 4150 5F49 3132 393D | 6=0&ir_DAP_I129=
00000480 | 2669 725F 4441 505F 4931 3330 3D26 6972 | &ir_DAP_I130=&ir
00000490 | 5F44 4150 5F49 3130 353D 3026 696D 705F | _DAP_I105=0&imp_
000004A0 | 7276 725F 6964 3D33 3536 3138 3531 3035 | rvr_id=356185105
000004B0 | 3538 3526 6D70 7663 3D68 7474 7025 3341 | 585&mpvc=http%3A
000004C0 | 2532 4625 3246 6962 2E61 646E 7873 2E63 | %2F%2Fib.adnxs.c
000004D0 | 6F6D 2532 4663 6C69 636B 2533 4645 7664 | om%2Fclick%3FEvd
000004E0 | 592D 7441 4668 5438 3242 5449 3769 3936 | Y-tAFhT82BTI7i96
000004F0 | 4250 7741 4141 4343 7552 5F63 5F4E 6755 | BPwAAACCuR_c_NgU
00000500 | 794F 3476 6567 5438 5339 316A 3630 4157 | yO4vegT8S91j60AW
00000510 | 4650 352D 7477 364E 7130 3768 6849 7975 | FP5-tw6Nq07hhIyu
00000520 | 304D 414D 415A 4530 7077 654A 5041 4141 | 0MAMAZE0pweJPAAA
00000530 | 4141 4A71 5A43 7742 6841 7741 415A 4141 | AAJqZCwBhAwAAZAA
00000540 | 4141 4149 4141 4142 5F54 7873 4157 6B67 | AAAIAAAB_TxsAWkg
00000550 | 4341 4145 4141 4142 5655 3051 4156 564E | CAAEAAABVU0QAVVN
00000560 | 4541 4E67 4357 6742 4859 6741 4166 4355 | EANgCWgBHYgAAfCU
00000570 | 4141 5155 4341 5155 4141 4949 4157 7948 | AAQUCAQUAAIIAWyH
00000580 | 4B77 6741 4141 4141 2E25 3246 636E 6425 | KwgAAAAA.%2Fcnd%
00000590 | 3344 2532 3532 314B 6755 324B 6769 4779 | 3D%2521KgU2KgiGy
000005A0 | 5130 515F 3535 7447 4E71 5143 5341 4125 | Q0Q_55tGNqQCSAA%
000005B0 | 3246 7265 6665 7272 6572 2533 4468 7474 | 2Freferrer%3Dhtt
000005C0 | 7025 3235 3341 2532 3532 4625 3235 3246 | p%253A%252F%252F
000005D0 | 6372 617A 7974 6869 6E67 7370 6172 656E | crazythingsparen
000005E0 | 7473 7465 7874 2E63 6F6D 2532 3532 4625 | tstext.com%252F%
000005F0 | 3246 636C 6963 6B65 6E63 2533 4426 7265 | 2Fclickenc%3D&re
00000600 | 6664 6F6D 6169 6E3D 6962 2E61 646E 7873 | fdomain=ib.adnxs
00000610 | 2E63 6F6D 2667 656F 7A69 703D 3735 3231 | .com&geozip=7521
00000620 | 3926 6765 6F61 7265 6163 6F64 653D 3231 | 9&geoareacode=21
00000630 | 3426 6765 6F63 6F75 6E74 7279 3D75 7326 | 4&geocountry=us&
00000640 | 6765 6F73 7461 7465 3D74 6578 6173 2667 | geostate=texas&g
00000650 | 656F 6369 7479 3D64 616C 6C61 7326 6765 | eocity=dallas&ge
00000660 | 6F63 6F6E 7469 6E65 6E74 3D39 3726 6765 | ocontinent=97&ge
00000670 | 6F64 6D61 3D36 3233 2620 4854 5450 2F31 | odma=623& HTTP/1
00000680 | 2E31 0D0A 4163 6365 7074 3A20 2A2F 2A0D | .1..Accept: */*.
00000690 | 0A52 6566 6572 6572 3A20 6874 7470 3A2F | .Referer: http:/
000006A0 | 2F69 622E 6164 6E78 732E 636F 6D2F 7474 | /ib.adnxs.com/tt
000006B0 | 3F69 643D 3736 3032 3138 0D0A 4163 6365 | ?id=760218..Acce
000006C0 | 7074 2D4C 616E 6775 6167 653A 2065 6E2D | pt-Language: en-
000006D0 | 7573 0D0A 4163 6365 7074 2D45 6E63 6F64 | us..Accept-Encod
000006E0 | 696E 673A 2067 7A69 702C 2064 6566 6C61 | ing: gzip, defla
000006F0 | 7465 0D0A 5573 6572 2D41 6765 6E74 3A20 | te..User-Agent:
00000700 | 4D6F 7A69 6C6C 612F 342E 3020 2863 6F6D | Mozilla/4.0 (com
00000710 | 7061 7469 626C 653B 204D 5349 4520 362E | patible; MSIE 6.
00000720 | 303B 2057 696E 646F 7773 204E 5420 352E | 0; Windows NT 5.
00000730 | 313B 2053 5631 3B20 2E4E 4554 2043 4C52 | 1; SV1; .NET CLR
00000740 | 2032 2E30 2E35 3037 3237 290D 0A43 6F6E |  2.0.50727)..Con
00000750 | 6E65 6374 696F 6E3A 204B 6565 702D 416C | nection: Keep-Al
00000760 | 6976 650D 0A48 6F73 743A 2069 6D67 2E6D | ive..Host: img.m
00000770 | 6564 6961 706C 6578 2E63 6F6D 0D0A 0D0A | ediaplex.com....
00000000 | 305F 3133 3438 3033 3636 3539 3B20 7075 | 0_1348036659; pu
00000010 | 6266 7265 715F 3237 3836 313D 3B20 7075 | bfreq_27861=; pu
00000020 | 6274 696D 655F 3237 3836 313D 544D 430D | btime_27861=TMC.
00000030 | 0A0D 0A                                 | ...
00000000 | 3538 3232 3532 3239 3335 3332 3435 313B | 582252293532451;
00000010 | 2069 6375 3D43 6849 4978 3751 4445 416F |  icu=ChIIx7QDEAo
00000020 | 5941 5341 424B 4145 7772 6F4B 4C5F 7751 | YASABKAEwroKL_wQ
00000030 | 4B45 6769 4579 5163 5143 6867 4349 4149 | KEgiEyQcQChgCIAI
00000040 | 6F41 6A43 7767 6F76 5F42 416F 5343 4B76 | oAjCwgov_BAoSCKv
00000050 | 5F42 7841 4B47 4145 6741 5367 424D 4A36 | _BxAKGAEgASgBMJ6
00000060 | 4369 5F38 4545 4C43 4369 5F38 4547 414D | Ci_8EELCCi_8EGAM
00000070 | 2E3B 2061 6E6A 3D4B 6675 3D38 6647 3638 | .; anj=Kfu=8fG68
00000080 | 2543 7872 7829 3073 5D23 2532 4C5F 2778 | %Cxrx)0s]#%2L_'x
00000090 | 2553 4556 2F68 6E4A 5068 3446 5156 6752 | %SEV/hnJPh4FQVgR
000000A0 | 4161 564C 6B62 3130 4933 5353 5476 397A | AaVLkb10I3SSTv9z
000000B0 | 3929 4334 552B 2E34 2D21 7158 364D 7A23 | 9)C4U+.4-!qX6Mz#
000000C0 | 7545 5F4A 6C76 710D 0A0D 0A             | uE_Jlvq....
00000000 | 6266 7265 715F 3237 3836 303D 3B20 7075 | bfreq_27860=; pu
00000010 | 6274 696D 655F 3237 3836 303D 544D 433B | btime_27860=TMC;
00000020 | 2050 4D44 5453 4852 3D63 6174 3A3B 204B |  PMDTSHR=cat:; K
00000030 | 5254 4243 4F4F 4B49 455F 3830 3D31 3333 | RTBCOOKIE_80=133
00000040 | 362D 3632 3138 6561 3862 2D37 3833 612D | 6-6218ea8b-783a-
00000050 | 3434 6433 2D62 3265 662D 6365 6435 6537 | 44d3-b2ef-ced5e7
00000060 | 6333 6362 3737 2E3B 2050 5542 5245 5441 | c3cb77.; PUBRETA
00000070 | 5247 4554 3D33 3930 5F31 3334 3830 3336 | RGET=390_1348036
00000080 | 3635 393B 2050 4D41 543D 4354 2D31 0D0A | 659; PMAT=CT-1..
00000090 | 0D0A                                    | ..

All content ("Information") contained in this report is the copyrighted work of Threat Expert Ltd and its associated companies ("ThreatExpert") and may not be copied without the express permission of ThreatExpert.

The Information is provided on an "as is" basis. ThreatExpert disclaims all warranties, whether express or implied, to the maximum extent permitted by law, including the implied warranties that the Information is merchantable, of satisfactory quality, accurate, fit for a particular purpose or need, or non-infringing, unless such implied warranties are legally incapable of exclusion. Further, ThreatExpert does not warrant or make any representations regarding the use or the results of the use of the Information in terms of their correctness, accuracy, reliability, or otherwise.