The investigation reveals a targeted intrusion against a research workstation containing classified Vibranium alloy R&D documents. The attacker compromised the primary user account (`tdungan`), deployed a custom HTTP-based implant named `a.exe` (internally called `httppump`), achieved lateral movement to at least three additional accounts (`RSydow`, `SRL-Helpdesk`, `vibranium`), and staged sensitive research documents for exfiltration. The campaign spanned from 2012-04-03 through 2012-04-07.
| Type | Indicator | MD5 |
|---|---|---|
| Malware | a.exe | — |
| Malware | pkxezy1tji98.exe | — |
Volatility 3 Framework 2.27.0 User rid lmhash nthash Administrator 500 e52cac67419a9a224a3b108f3fa6cb6d 8846f7eaee8fb117ad06bdd830b7586c Guest 501 aad3b435b51404eeaad3b435b51404ee 31d6cfe0d16ae931b73c59d7e0c089c0 HelpAssistant 1000 6c15d32653a857973a86a3e34ad907c8 084676eeeaa8763e5ccbaf6a6872b764 SUPPORT_388945a0 1002 aad3b435b51404eeaad3b435b51404ee b950ccbd754b5e31ebd80de2dcb660c1 SRL-Helpdesk 1004 aad3b435b51404eeaad3b435b51404ee 4c3f5e9fe4c8fc2f99d47cbb25d7d193 --- /mnt/tdungan/Program Files/Common Files/System /mnt/tdungan/WINDOWS/PCHealth/HelpCtr/System /mnt/tdungan/WINDOWS/system /mnt/tdungan/WINDOWS/system32/config/SAM /mnt/tdungan/WINDOWS/system32/config/system /mnt/tdungan/WINDOWS/repair/sam /mnt/tdungan/WINDOWS/repair/system --- 1056 lsass.exe C:\WINDOWS\system32\lsass.exe
/opt/volatility3/bin/vol -q -f /home/sansforensics/cases/tdungan/xp-tdungan-memory/xp-tdungan-memory-raw.001 windows.hashdump 2>/dev/nullfind /mnt/tdungan -iname 'SAM' -o -iname 'SYSTEM' -o -iname 'pwdump*' -o -iname 'fgdump*' -o -iname 'gsecdump*' -o -iname 'cachedump*' -o -iname 'wce.exe' -o -iname 'procdump*' 2>/dev/null/opt/volatility3/bin/vol -q -f /home/sansforensics/cases/tdungan/xp-tdungan-memory/xp-tdungan-memory-raw.001 windows.cmdline 2>/dev/null | grep -iE 'pwdump|fgdump|gsecdump|wce|sam|reg save|lsass|procdump|cachedump|secretsdump'Volatility 3 Framework 2.27.0 User rid lmhash nthash Administrator 500 e52cac67419a9a224a3b108f3fa6cb6d 8846f7eaee8fb117ad06bdd830b7586c Guest 501 aad3b435b51404eeaad3b435b51404ee 31d6cfe0d16ae931b73c59d7e0c089c0 HelpAssistant 1000 6c15d32653a857973a86a3e34ad907c8 084676eeeaa8763e5ccbaf6a6872b764 SUPPORT_388945a0 1002 aad3b435b51404eeaad3b435b51404ee b950ccbd754b5e31ebd80de2dcb660c1 SRL-Helpdesk 1004 aad3b435b51404eeaad3b435b51404ee 4c3f5e9fe4c8fc2f99d47cbb25d7d193 --- /mnt/tdungan/Program Files/Common Files/System /mnt/tdungan/WINDOWS/PCHealth/HelpCtr/System /mnt/tdungan/WINDOWS/system /mnt/tdungan/WINDOWS/system32/config/SAM /mnt/tdungan/WINDOWS/system32/config/system /mnt/tdungan/WINDOWS/repair/sam /mnt/tdungan/WINDOWS/repair/system --- 1056 lsass.exe C:\WINDOWS\system32\lsass.exe
/mnt/tdungan/Documents and Settings/RSydow/My Documents/website/STARK_Research_Labs.docx /mnt/tdungan/Documents and Settings/tdungan/Application Data/Microsoft/Office/Recent/Backstopped Accounts - R&D Costs Alloy Research.LNK /mnt/tdungan/Documents and Settings/tdungan/Application Data/Microsoft/Office/Recent/Credit-Card-Numbers-For-Research.LNK /mnt/tdungan/Documents and Settings/tdungan/Application Data/Microsoft/Office/Recent/Metal Alloy List Research.LNK /mnt/tdungan/Documents and Settings/tdungan/Application Data/Microsoft/Office/Recent/Research Project (2).LNK /mnt/tdungan/Documents and Settings/tdungan/Application Data/Microsoft/Office/Recent/Research Project.LNK /mnt/tdungan/Documents and Settings/tdungan/Application Data/Microsoft/Office/Recent/SUCCESS-TEST-VIBRANIUM-ALLOY-RESULTS.LNK /mnt/tdungan/Documents and Settings/tdungan/Application Data/Microsoft/Office/Recent/VIBRANIUM.LNK /mnt/tdungan/Documents and Settings/tdungan/Favorites/Links/STARK Research Labs.url /mnt/tdungan/Documents and Settings/tdungan/Local Settings/Temporary Internet Files/Content.IE5/GLAV89E7/stark-research-labs_com[1].htm /mnt/tdungan/Documents and Settings/tdungan/Local Settings/Temporary Internet Files/Content.Outlook/CNGZG4QC/Credit-Card-Numbers-For-Research.xlsx /mnt/tdungan/Documents and Settings/tdungan/My Documents/Alloy Research/Additional Information/Training_Research_Checklist.pdf /mnt/tdungan/Documents and Settings/tdungan/My Documents/Alloy Research/Detailed Vibranium R&D Documents/Metal Alloy List Research.xlsx /mnt/tdungan/Documents and Settings/tdungan/My Documents/Alloy Research/Detailed Vibranium R&D Documents/Researched Sub-Atomic Particles.xlsx /mnt/tdungan/Documents and Settings/tdungan/My Documents/Alloy Research/Detailed Vibranium R&D Documents/SUCCESS-TEST-PLAN-VIBRANIUM-ALLOY-RESULTS.docx /mnt/tdungan/Documents and Settings/tdungan/My Documents/Alloy Research/Detailed Vibranium R&D Documents/The Shield Background and Ongoing Research.docx /mnt/tdungan/Docume
find /mnt/tdungan -type f \( -iname '*vibranium*' -o -iname '*classified*' -o -iname '*research*' -o -iname '*alloy*' -o -iname '*R&D*' -o -iname '*secret*' -o -iname '*confidential*' \) 2>/dev/nullfind /mnt/tdungan -type d \( -iname '*vibranium*' -o -iname '*classified*' -o -iname '*research*' -o -iname '*staging*' -o -iname '*collect*' -o -iname '*exfil*' \) 2>/dev/nullfind /mnt/tdungan/Documents\ and\ Settings/tdungan/My\ Documents/Alloy\ Research -type f 2>/dev/null && find /mnt/tdungan/Documents\ and\ Settings/tdungan/My\ Documents/Backstopped\ Accounts\ -\ R\&D\ Costs\ Alloy\ Research -type f 2>/dev/null && find /mnt/tdungan/Documents\ and\ Settings/tdungan/My\ Documents/Dropbox -type f 2>/dev/null | head -40/mnt/tdungan/Documents and Settings/RSydow/My Documents/website/STARK_Research_Labs.docx /mnt/tdungan/Documents and Settings/tdungan/Application Data/Microsoft/Office/Recent/Backstopped Accounts - R&D Costs Alloy Research.LNK /mnt/tdungan/Documents and Settings/tdungan/Application Data/Microsoft/Office/Recent/Credit-Card-Numbers-For-Research.LNK /mnt/tdungan/Documents and Settings/tdungan/Application Data/Microsoft/Office/Recent/Metal Alloy List Research.LNK /mnt/tdungan/Documents and Settings/tdungan/Application Data/Microsoft/Office/Recent/Research Project (2).LNK /mnt/tdungan/Documents and Settings/tdungan/Application Data/Microsoft/Office/Recent/Research Project.LNK /mnt/tdungan/Documents and Settings/tdungan/Application Data/Microsoft/Office/Recent/SUCCESS-TEST-VIBRANIUM-ALLOY-RESULTS.LNK /mnt/tdungan/Documents and Settings/tdungan/Application Data/Microsoft/Office/Recent/VIBRANIUM.LNK /mnt/tdungan/Documents and Settings/tdungan/Favorites/Links/STARK Research Labs.url /mnt/tdungan/Documents and Settings/tdungan/Local Settings/Temporary Internet Files/Content.IE5/GLAV89E7/stark-research-labs_com[1].htm /mnt/tdungan/Documents and Settings/tdungan/Local Settings/Temporary Internet Files/Content.Outlook/CNGZG4QC/Credit-Card-Numbers-For-Research.xlsx /mnt/tdungan/Documents and Settings/tdungan/My Documents/Alloy Research/Additional Information/Training_Research_Checklist.pdf /mnt/tdungan/Documents and Settings/tdungan/My Documents/Alloy Research/Detailed Vibranium R&D Documents/Metal Alloy List Research.xlsx /mnt/tdungan/Documents and Settings/tdungan/My Documents/Alloy Research/Detailed Vibranium R&D Documents/Researched Sub-Atomic Particles.xlsx /mnt/tdungan/Documents and Settings/tdungan/My Documents/Alloy Research/Detailed Vibranium R&D Documents/SUCCESS-TEST-PLAN-VIBRANIUM-ALLOY-RESULTS.docx /mnt/tdungan/Documents and Settings/tdungan/My Documents/Alloy Research/Detailed Vibranium R&D Documents/The Shield Background and Ongoing Research.docx /mnt/tdungan/Documents and Settings/tdungan/My Documents/Alloy Research/Detailed Vibranium R&D Documents/VIBRANIUM.docx /mnt/tdungan/Documents and Settings/tdungan/My Documents/Alloy Research/Presentations/Alloy.ppt /mnt/tdungan/Documents and Settings/tdungan/My Documents/Alloy Research/R&D Documents/alloy-makes-hydrogen-water_purdue-univ.doc /mnt/tdungan/Documents and Settings/tdungan/My Documents/Alloy Research/R&D Documents/Copperalloyetc.doc /mnt/tdungan/Documents and Settings/tdungan/My Documents/Alloy Research/R&D Documents/PhD in Advanced Light Alloy Research revised final new branding.doc /mnt/tdungan/Documents and Settings/tdungan/My Documents/Alloy Research/R&D Documents/research.doc /mnt/tdungan/Documents and Settings/tdungan/My Documents/Alloy Research/R&D Documents/Thirty Years of Research in American Military Studies in China.doc /mnt/tdungan/Documents and Settings/tdungan/My Documents/Alloy Research/R&D Documents/UsefulAlloysResearch.doc /mnt/tdungan/Documents and Settings/tdungan/My Documents/Alloy Research/Spreadsheets/Non-GovernmentalResearch.xls /mnt/tdungan/Documents and Settings/tdungan/My Documents/Backstopped Accounts - R&D Costs Alloy Research/Credit-Card-Numbers-For-Research.xls /mnt/tdungan/Documents and Settings/tdungan/My Documents/Dropbox/STARK Research Labs.docx /mnt/tdungan/Documents and Settings/tdungan/My Documents/website/STARK_Research_Labs.docx /mnt/tdungan/Documents and Settings/tdungan/Recent/Backstopped Accounts - R&D Costs Alloy Research.lnk /mnt/tdungan/Documents and Settings/tdungan/Recent/Copy of Metal Alloy List Research.lnk /mnt/tdungan/Documents and Settings/tdungan/Recent/Credit-Card-Numbers-For-Research (2).lnk /mnt/tdungan/Documents and Settings/tdungan/Recent/Credit-Card-Numbers-For-Research.lnk /mnt/tdungan/Documents and Settings/tdungan/Recent/Metal Alloy List Research.lnk /mnt/tdungan/Documents and Settings/tdungan/Recent/Research Project.lnk /mnt/tdungan/Documents and Settings/tdungan/Recent/Researched Sub-Atomic Particles.lnk /mnt
File: /mnt/tdungan/Documents and Settings/RSydow/Local Settings/Temp/a.exe
Size: 9216 Blocks: 24 IO Block: 4096 regular file
Device: 7,10 Inode: 5366 Links: 1
Access: (0777/-rwxrwxrwx) Uid: ( 0/ root) Gid: ( 0/ root)
Access: 2012-04-05 06:03:19.073928200 +0000
Modify: 2012-04-04 12:23:14.079286900 +0000
Change: 2012-04-04 12:23:14.079286900 +0000
Birth: -
File: /mnt/tdungan/Documents and Settings/SRL-Helpdesk/Local Settings/Temp/a.exe
Size: 9216 Blocks: 24 IO Block: 4096 regular file
Device: 7,10 Inode: 7372 Links: 1
Access: (0777/-rwxrwxrwx) Uid: ( 0/ root) Gid: ( 0/ root)
Access: 2012-04-07 02:43:11.834171400 +0000
Modify: 2012-04-07 02:43:11.834171400 +0000
Change: 2012-04-07 02:43:11.834171400 +0000
Birth: -
File: /mnt/tdungan/Documents and Settings/tdungan/Local Settings/Temp/a.exe
Size: 9216 Blocks: 24 IO Block: 4096 regular file
Device: 7,10 Inode: 3108 Links: 1
Access: (0777/-rwxrwxrwx) Uid: ( 0/ root) Gid: ( 0/ root)
Access: 2012-04-05 05:36:30.597045400 +0000
Modify: 2012-04-04 14:01:32.805830700 +0000
Change: 2012-04-04 14:01:32.805830700 +0000
Birth: -
File: /mnt/tdungan/Documents and Settings/vibranium/Local Settings/Temp/a.exe
Size: 9216 Blocks: 24 IO Block: 4096 regular file
Device: 7,10 Inode: 7736 Links: 1
Access: (0777/-rwxrwxrwx) Uid: ( 0/ root) Gid: ( 0/ root)
Access: 2012-04-06 05:05:23.391954600 +0000
Modify: 2012-04-05 13:28:01.360678600 +0000
Change: 2012-04-05 13:28:01.360678600 +0000
Birth: -
---
!This program cannot be run in DOS mode.
RichO
.text
`.data
.reloc
SetUnhandledExceptionFilter
kernel32.dll
('8PW
700PP
```hhh
xppwpp
RSDS
c:\code\httppump\inner\objchk_wxp_x86\i386\i.pdb
Y_^[
URPQQh(
L$,3
UVWS
[_^]
SVWj
_^[]
8csm
8csm
_^[]
Y__^[
t?!E
v N+D$
UQPXY]Y[
WriteProcessMemory
GetCurrentProcess
GetProcAddress
LoadLibraryA
ExitThread
VirtualAlloc
ExitProcess
CloseHandle
Wa
find /mnt/tdungan/Documents\ and\ Settings -iname 'a.exe' 2>/dev/null | xargs -I{} stat {} 2>/dev/nullstrings /mnt/tdungan/Documents\ and\ Settings/RSydow/Local\ Settings/Temp/a.exe 2>/dev/null | head -80md5sum \
"/mnt/tdungan/Documents and Settings/RSydow/Local Settings/Temp/a.exe" \
"/mnt/tdungan/Documents and Settings/SRL-Helpdesk/Local Settings/Temp/a.exe" \
"/mnt/tdungan/Documents and Settings/tdungan/Local Settings/Temp/a.exe" \
"/mnt/tdungan/Documents and Settings/vibranium/Local Settings/Temp/a.exe" 2>/dev/nullFile: /mnt/tdungan/Documents and Settings/RSydow/Local Settings/Temp/a.exe
Size: 9216 Blocks: 24 IO Block: 4096 regular file
Device: 7,10 Inode: 5366 Links: 1
Access: (0777/-rwxrwxrwx) Uid: ( 0/ root) Gid: ( 0/ root)
Access: 2012-04-05 06:03:19.073928200 +0000
Modify: 2012-04-04 12:23:14.079286900 +0000
Change: 2012-04-04 12:23:14.079286900 +0000
Birth: -
File: /mnt/tdungan/Documents and Settings/SRL-Helpdesk/Local Settings/Temp/a.exe
Size: 9216 Blocks: 24 IO Block: 4096 regular file
Device: 7,10 Inode: 7372 Links: 1
Access: (0777/-rwxrwxrwx) Uid: ( 0/ root) Gid: ( 0/ root)
Access: 2012-04-07 02:43:11.834171400 +0000
Modify: 2012-04-07 02:43:11.834171400 +0000
Change: 2012-04-07 02:43:11.834171400 +0000
Birth: -
File: /mnt/tdungan/Documents and Settings/tdungan/Local Settings/Temp/a.exe
Size: 9216 Blocks: 24 IO Block: 4096 regular file
Device: 7,10 Inode: 3108 Links: 1
Access: (0777/-rwxrwxrwx) Uid: ( 0/ root) Gid: ( 0/ root)
Access: 2012-04-05 05:36:30.597045400 +0000
Modify: 2012-04-04 14:01:32.805830700 +0000
Change: 2012-04-04 14:01:32.805830700 +0000
Birth: -
File: /mnt/tdungan/Documents and Settings/vibranium/Local Settings/Temp/a.exe
Size: 9216 Blocks: 24 IO Block: 4096 regular file
Device: 7,10 Inode: 7736 Links: 1
Access: (0777/-rwxrwxrwx) Uid: ( 0/ root) Gid: ( 0/ root)
Access: 2012-04-06 05:05:23.391954600 +0000
Modify: 2012-04-05 13:28:01.360678600 +0000
Change: 2012-04-05 13:28:01.360678600 +0000
Birth: -
---
!This program cannot be run in DOS mode.
RichO
.text
`.data
.reloc
SetUnhandledExceptionFilter
kernel32.dll
('8PW
700PP
```hhh
xppwpp
RSDS
c:\code\httppump\inner\objchk_wxp_x86\i386\i.pdb
Y_^[
URPQQh(
L$,3
UVWS
[_^]
SVWj
_^[]
8csm
8csm
_^[]
Y__^[
t?!E
v N+D$
UQPXY]Y[
WriteProcessMemory
GetCurrentProcess
GetProcAddress
LoadLibraryA
ExitThread
VirtualAlloc
ExitProcess
CloseHandle
WaitForSingleObject
CreateThread
SetErrorMode
SetUnhandledExceptionFilter
KERNEL32.dll
__getmainargs
_cexit
_exit
_XcptFilter
exit
_initterm
_amsg_exit
__setusermatherr
__p__commode
__p__fmode
__set_app_type
msvcrt.dll
?terminate@@YAXXZ
_controlfp
InterlockedExchange
Sleep
InterlockedCompareExchange
RtlUnwind
GetModuleHandleA
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
UnhandledExceptionFilter
_oB&3! vK#Nr
V\3%
kU'9
HMXB
?Zd;
?/L[
S;uD
z?aUY
D?$?
U>c{
zc%C1
.:3q
-64OS
NKeb
---
c4b0458c04abdaa773348c2668212b45 /mnt/tdungan/Documents and Settings/RSydow/Local Settings/Temp/a.exe
c4b0458c04abdaa773348c2668212b45 /mnt/tdungan/Documents and Settings/SRL-Helpdesk/Local Settings/Temp/a.exe
c4b0458c04abdaa773348c2668212b45 /mnt/tdungan/Documents and Settings/tdungan/Local Settings/Temp/a.exe
c4b0458c04abdaa773348c2668212b45 /mnt/tdungan/Documents and Settings/vibranium/Local Settings/Temp/a.exe
/mnt/tdungan/Documents and Settings/RSydow/Local Settings/Temp/a.exe
/mnt/tdungan/Documents and Settings/SRL-Helpdesk/Local Settings/Temp/a.exe
/mnt/tdungan/Documents and Settings/tdungan/Local Settings/Temp/a.exe
/mnt/tdungan/Documents and Settings/vibranium/Local Settings/Temp/a.exe
---
!This program cannot be run in DOS mode.
RichO
.text
`.data
.reloc
SetUnhandledExceptionFilter
kernel32.dll
('8PW
700PP
```hhh
xppwpp
RSDS
c:\code\httppump\inner\objchk_wxp_x86\i386\i.pdb
Y_^[
URPQQh(
L$,3
UVWS
[_^]
SVWj
_^[]
8csm
8csm
_^[]
Y__^[
t?!E
v N+D$
UQPXY]Y[
WriteProcessMemory
GetCurrentProcess
GetProcAddress
LoadLibraryA
ExitThread
VirtualAlloc
ExitProcess
CloseHandle
WaitForSingleObject
CreateThread
SetErrorMode
SetUnhandledExceptionFilter
KERNEL32.dll
__getmainargs
_cexit
_exit
_XcptFilter
exit
_initterm
_amsg_exit
__setusermatherr
__p__commode
__p__fmode
__set_app_type
msvcrt.dll
?terminate@@YAXXZ
_controlfp
InterlockedExchange
Sleep
InterlockedCompareExchange
RtlUnwind
GetModuleHandleA
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
UnhandledExceptionFilter
_oB&3! vK#Nr
V\3%
kU'9
HMXB
?Zd;
?/L[
S;uD
z?aUY
D?$?
U>c{
zc%C1
.:3q
-64OS
NKeb
---
c:\code\httppump\inner\objchk_wxp_x86\i386\i.pdb
GetCurrentProcess
GetProcAddress
__getmainargs
GetModuleHandleA
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
find /mnt/tdungan -iname 'a.exe' 2>/dev/nullstrings "/mnt/tdungan/Documents and Settings/tdungan/Local Settings/Temp/a.exe" 2>/dev/null | head -80strings "/mnt/tdungan/Documents and Settings/RSydow/Local Settings/Temp/a.exe" 2>/dev/null | grep -iE '(http|https|ftp|socket|connect|send|recv|post|get|host|url|ip|beacon|upload|exfil|proxy|agent|Content|Mozilla|User-Agent|\.com|\.net|\.org|[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3})'/mnt/tdungan/Documents and Settings/RSydow/Local Settings/Temp/a.exe
/mnt/tdungan/Documents and Settings/SRL-Helpdesk/Local Settings/Temp/a.exe
/mnt/tdungan/Documents and Settings/tdungan/Local Settings/Temp/a.exe
/mnt/tdungan/Documents and Settings/vibranium/Local Settings/Temp/a.exe
---
!This program cannot be run in DOS mode.
RichO
.text
`.data
.reloc
SetUnhandledExceptionFilter
kernel32.dll
('8PW
700PP
```hhh
xppwpp
RSDS
c:\code\httppump\inner\objchk_wxp_x86\i386\i.pdb
Y_^[
URPQQh(
L$,3
UVWS
[_^]
SVWj
_^[]
8csm
8csm
_^[]
Y__^[
t?!E
v N+D$
UQPXY]Y[
WriteProcessMemory
GetCurrentProcess
GetProcAddress
LoadLibraryA
ExitThread
VirtualAlloc
ExitProcess
CloseHandle
WaitForSingleObject
CreateThread
SetErrorMode
SetUnhandledExceptionFilter
KERNEL32.dll
__getmainargs
_cexit
_exit
_XcptFilter
exit
_initterm
_amsg_exit
__setusermatherr
__p__commode
__p__fmode
__set_app_type
msvcrt.dll
?terminate@@YAXXZ
_controlfp
InterlockedExchange
Sleep
InterlockedCompareExchange
RtlUnwind
GetModuleHandleA
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
UnhandledExceptionFilter
_oB&3! vK#Nr
V\3%
kU'9
HMXB
?Zd;
?/L[
S;uD
z?aUY
D?$?
U>c{
zc%C1
.:3q
-64OS
NKeb
---
c:\code\httppump\inner\objchk_wxp_x86\i386\i.pdb
GetCurrentProcess
GetProcAddress
__getmainargs
GetModuleHandleA
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
!This program cannot be run in DOS mode.
RichO
.text
`.data
.reloc
SetUnhandledExceptionFilter
kernel32.dll
('8PW
700PP
```hhh
xppwpp
RSDS
c:\code\httppump\inner\objchk_wxp_x86\i386\i.pdb
Y_^[
URPQQh(
L$,3
UVWS
[_^]
SVWj
_^[]
8csm
8csm
_^[]
Y__^[
t?!E
v N+D$
UQPXY]Y[
WriteProcessMemory
GetCurrentProcess
GetProcAddress
LoadLibraryA
ExitThread
VirtualAlloc
ExitProcess
CloseHandle
WaitForSingleObject
CreateThread
SetErrorMode
SetUnhandledExceptionFilter
KERNEL32.dll
__getmainargs
_cexit
_exit
_XcptFilter
exit
_initterm
_amsg_exit
__setusermatherr
__p__commode
__p__fmode
__set_app_type
msvcrt.dll
?terminate@@YAXXZ
_controlfp
InterlockedExchange
Sleep
InterlockedCompareExchange
RtlUnwind
GetModuleHandleA
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
UnhandledExceptionFilter
_oB&3! vK#Nr
V\3%
kU'9
HMXB
?Zd;
?/L[
S;uD
z?aUY
D?$?
U>c{
zc%C1
.:3q
-64OS
NKeb
---
{
"memory_image": "/home/sansforensics/cases/tdungan/xp-tdungan-memory/xp-tdungan-memory-raw.001",
"plugin": "windows.malfind",
"row_count": 1942,
"output": "Volatility 3 Framework 2.27.0\nPID\tProcess\tStart VPN\tEnd VPN\tTag\tProtection\tCommitCharge\tPrivateMemory\tFile output\tNotes\tHexdump\tDisasm\n976\tcsrss.exe\t0x7f6f0000\t0x7f7effff\tVad \tPAGE_EXECUTE_READWRITE\t0\t0\tDisabled\tN/A\t\nc8 00 00 00 75 01 00 00 ff ee ff ee 08 70 00 00 ....u........p..\n08 00 00 00 00 fe 00 00 00 00 10 00 00 20 00 00 ............. ..\n00 02 00 00 00 20 00 00 8d 01 00 00 ff ef fd 7f ..... ..........\n03 00 08 06 00 00 00 00 00 00 00 00 00 00 00 00 ................\t\n0x7f6f0000:\tenter\t0, 0\n0x7f6f0004:\tjne\t0x7f6f0007\n0x7f6f0006:\tadd\tbyte ptr [eax], al\n1000\twinlogon.exe\t0x17550000\t0x17553fff\tVadS\tPAGE_EXECUTE_READWRITE\t4\t1\tDisabled\tN/A\t\n00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................\n00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................\n00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................\n0
strings '/mnt/tdungan/Documents and Settings/tdungan/Local Settings/Temp/a.exe' 2>/dev/null | head -80run_volatilityrun_volatility!This program cannot be run in DOS mode.
RichO
.text
`.data
.reloc
SetUnhandledExceptionFilter
kernel32.dll
('8PW
700PP
```hhh
xppwpp
RSDS
c:\code\httppump\inner\objchk_wxp_x86\i386\i.pdb
Y_^[
URPQQh(
L$,3
UVWS
[_^]
SVWj
_^[]
8csm
8csm
_^[]
Y__^[
t?!E
v N+D$
UQPXY]Y[
WriteProcessMemory
GetCurrentProcess
GetProcAddress
LoadLibraryA
ExitThread
VirtualAlloc
ExitProcess
CloseHandle
WaitForSingleObject
CreateThread
SetErrorMode
SetUnhandledExceptionFilter
KERNEL32.dll
__getmainargs
_cexit
_exit
_XcptFilter
exit
_initterm
_amsg_exit
__setusermatherr
__p__commode
__p__fmode
__set_app_type
msvcrt.dll
?terminate@@YAXXZ
_controlfp
InterlockedExchange
Sleep
InterlockedCompareExchange
RtlUnwind
GetModuleHandleA
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
UnhandledExceptionFilter
_oB&3! vK#Nr
V\3%
kU'9
HMXB
?Zd;
?/L[
S;uD
z?aUY
D?$?
U>c{
zc%C1
.:3q
-64OS
NKeb
---
{
"memory_image": "/home/sansforensics/cases/tdungan/xp-tdungan-memory/xp-tdungan-memory-raw.001",
"plugin": "windows.malfind",
"row_count": 1942,
"output": "Volatility 3 Framework 2.27.0\nPID\tProcess\tStart VPN\tEnd VPN\tTag\tProtection\tCommitCharge\tPrivateMemory\tFile output\tNotes\tHexdump\tDisasm\n976\tcsrss.exe\t0x7f6f0000\t0x7f7effff\tVad \tPAGE_EXECUTE_READWRITE\t0\t0\tDisabled\tN/A\t\nc8 00 00 00 75 01 00 00 ff ee ff ee 08 70 00 00 ....u........p..\n08 00 00 00 00 fe 00 00 00 00 10 00 00 20 00 00 ............. ..\n00 02 00 00 00 20 00 00 8d 01 00 00 ff ef fd 7f ..... ..........\n03 00 08 06 00 00 00 00 00 00 00 00 00 00 00 00 ................\t\n0x7f6f0000:\tenter\t0, 0\n0x7f6f0004:\tjne\t0x7f6f0007\n0x7f6f0006:\tadd\tbyte ptr [eax], al\n1000\twinlogon.exe\t0x17550000\t0x17553fff\tVadS\tPAGE_EXECUTE_READWRITE\t4\t1\tDisabled\tN/A\t\n00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................\n00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................\n00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................\n00 00 00 00 2a 00 2a 00 01 00 00 00 00 00 00 00 ....*.*.........\t\n0x17550000:\tadd\tbyte ptr [eax], al\n0x17550002:\tadd\tbyte ptr [eax], al\n0x17550004:\tadd\tbyte ptr [eax], al\n0x17550006:\tadd\tbyte ptr [eax], al\n0x17550008:\tadd\tbyte ptr [eax], al\n0x1755000a:\tadd\tbyte ptr [eax], al\n0x1755000c:\tadd\tbyte ptr [eax], al\n0x1755000e:\tadd\tbyte ptr [eax], al\n0x17550010:\tadd\tbyte ptr [eax], al\n0x17550012:\tadd\tbyte ptr [eax], al\n0x17550014:\tadd\tbyte ptr [eax], al\n0x17550016:\tadd\tbyte ptr [eax], al\n0x17550018:\tadd\tbyte ptr [eax], al\n0x1755001a:\tadd\tbyte ptr [eax], al\n0x1755001c:\tadd\tbyte ptr [eax], al\n0x1755001e:\tadd\tbyte ptr [eax], al\n0x17550020:\tadd\tbyte ptr [eax], al\n0x17550022:\tadd\tbyte ptr [eax], al\n0x17550024:\tadd\tbyte ptr [eax], al\n0x17550026:\tadd\tbyte ptr [eax], al\n0x17550028:\tadd\tbyte ptr [eax], al\n0x1755002a:\tadd\tbyte ptr [eax], al\n0x1755002c:\tadd\tbyte ptr [eax], al\n0x1755002e:\tadd\tbyte ptr [eax], al\n0x17550030:\tadd\tbyte ptr [eax], al\n0x17550032:\tadd\tbyte ptr [eax], al\n0x17550034:\tsub\tal, byte ptr [eax]\n0x17550036:\tsub\tal, byte ptr [eax]\n0x17550038:\tadd\tdword ptr [eax], eax\n0x1755003a:\tadd\tbyte ptr [eax], al\n0x1755003c:\tadd\tbyte ptr [eax], al\n0x1755003e:\tadd\tbyte ptr [eax], al\n1000\twinlogon.exe\t0x212f0000\t0x212f3fff\tVadS\tPAGE_EXECUTE_READWRITE\t4\t1\tDisabled\tN/A\t\n00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................\n00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................\n00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................\n00 00 00 00 23 00 23 00 01 00 00 00 00 00 00 00 ....#.#.........\t\n0x212f0000:\tadd\tbyte ptr [eax], al\n0x212f0002:\tadd\tbyte ptr [eax], al\n0x212f0004:\tadd\tbyte ptr [eax], al\n0x212f0006:\tadd\tbyte ptr [eax], al\n0x212f0008:\tadd\tbyte ptr [eax], al\n0x212f000a:\tadd\tbyte ptr [eax], al\n0x212f000c:\tadd\tbyte ptr [eax], al\n0x212f000e:\tadd\tbyte ptr [eax], al",
"truncated": true
}
---
{
"memory_image": "
!This program cannot be run in DOS mode.
RichO
.text
`.data
.reloc
SetUnhandledExceptionFilter
kernel32.dll
('8PW
700PP
```hhh
xppwpp
RSDS
c:\code\httppump\inner\objchk_wxp_x86\i386\i.pdb
Y_^[
URPQQh(
L$,3
UVWS
[_^]
SVWj
_^[]
8csm
8csm
_^[]
Y__^[
t?!E
v N+D$
UQPXY]Y[
WriteProcessMemory
GetCurrentProcess
GetProcAddress
LoadLibraryA
ExitThread
VirtualAlloc
ExitProcess
CloseHandle
WaitForSingleObject
CreateThread
SetErrorMode
SetUnhandledExceptionFilter
KERNEL32.dll
__getmainargs
_cexit
_exit
_XcptFilter
exit
_initterm
_amsg_exit
__setusermatherr
__p__commode
__p__fmode
__set_app_type
msvcrt.dll
?terminate@@YAXXZ
_controlfp
InterlockedExchange
Sleep
InterlockedCompareExchange
RtlUnwind
GetModuleHandleA
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
UnhandledExceptionFilter
_oB&3! vK#Nr
V\3%
kU'9
HMXB
?Zd;
?/L[
S;uD
z?aUY
D?$?
U>c{
zc%C1
.:3q
-64OS
NKeb
---
!This program cannot be run in DOS mode.
RichO
.text
`.data
.reloc
SetUnhandledExceptionFilter
kernel32.dll
('8PW
700PP
```hhh
xppwpp
RSDS
c:\code\httppump\inner\objchk_wxp_x86\i386\i.pdb
Y_^[
URPQQh(
L$,3
UVWS
[_^]
SVWj
_^[]
8csm
8csm
_^[]
Y__^[
t?!E
v N+D$
UQPXY]Y[
WriteProcessMemory
GetCurrentProcess
GetProcAddress
LoadLibraryA
ExitThread
VirtualAlloc
ExitProcess
CloseHandle
WaitForSingleObject
CreateThread
SetErrorMode
SetUnhandledExceptionFilter
KERNEL32.dll
__getmainargs
_cexit
_exit
_XcptFilter
exit
_initterm
_amsg_exit
__setusermatherr
__p__commode
__p__fmode
__set_app_type
msvcrt.dll
?terminate@@YAXXZ
_controlfp
InterlockedExchange
Sleep
InterlockedCompareExchange
RtlUnwind
GetModuleHandleA
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
UnhandledExceptionFilter
_oB&3! vK#Nr
V\3%
kU'9
HMXB
?Zd;
?/L[
S;uD
z?aUY
D?$?
U>c{
zc%C1
.:3q
-64OS
NKeb
---
c4b0458c04abdaa773348c2668212b45 /mnt/tdungan/Documents and Settings/RSydow/Local Settings/Temp/a.exe
c4b0458c04abdaa773348c2
strings '/mnt/tdungan/Documents and Settings/RSydow/Local Settings/Temp/a.exe' 2>/dev/null | head -80strings '/mnt/tdungan/Documents and Settings/tdungan/Local Settings/Temp/a.exe' 2>/dev/null | head -80md5sum '/mnt/tdungan/Documents and Settings/RSydow/Local Settings/Temp/a.exe' '/mnt/tdungan/Documents and Settings/SRL-Helpdesk/Local Settings/Temp/a.exe' '/mnt/tdungan/Documents and Settings/tdungan/Local Settings/Temp/a.exe' 2>/dev/null!This program cannot be run in DOS mode.
RichO
.text
`.data
.reloc
SetUnhandledExceptionFilter
kernel32.dll
('8PW
700PP
```hhh
xppwpp
RSDS
c:\code\httppump\inner\objchk_wxp_x86\i386\i.pdb
Y_^[
URPQQh(
L$,3
UVWS
[_^]
SVWj
_^[]
8csm
8csm
_^[]
Y__^[
t?!E
v N+D$
UQPXY]Y[
WriteProcessMemory
GetCurrentProcess
GetProcAddress
LoadLibraryA
ExitThread
VirtualAlloc
ExitProcess
CloseHandle
WaitForSingleObject
CreateThread
SetErrorMode
SetUnhandledExceptionFilter
KERNEL32.dll
__getmainargs
_cexit
_exit
_XcptFilter
exit
_initterm
_amsg_exit
__setusermatherr
__p__commode
__p__fmode
__set_app_type
msvcrt.dll
?terminate@@YAXXZ
_controlfp
InterlockedExchange
Sleep
InterlockedCompareExchange
RtlUnwind
GetModuleHandleA
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
UnhandledExceptionFilter
_oB&3! vK#Nr
V\3%
kU'9
HMXB
?Zd;
?/L[
S;uD
z?aUY
D?$?
U>c{
zc%C1
.:3q
-64OS
NKeb
---
!This program cannot be run in DOS mode.
RichO
.text
`.data
.reloc
SetUnhandledExceptionFilter
kernel32.dll
('8PW
700PP
```hhh
xppwpp
RSDS
c:\code\httppump\inner\objchk_wxp_x86\i386\i.pdb
Y_^[
URPQQh(
L$,3
UVWS
[_^]
SVWj
_^[]
8csm
8csm
_^[]
Y__^[
t?!E
v N+D$
UQPXY]Y[
WriteProcessMemory
GetCurrentProcess
GetProcAddress
LoadLibraryA
ExitThread
VirtualAlloc
ExitProcess
CloseHandle
WaitForSingleObject
CreateThread
SetErrorMode
SetUnhandledExceptionFilter
KERNEL32.dll
__getmainargs
_cexit
_exit
_XcptFilter
exit
_initterm
_amsg_exit
__setusermatherr
__p__commode
__p__fmode
__set_app_type
msvcrt.dll
?terminate@@YAXXZ
_controlfp
InterlockedExchange
Sleep
InterlockedCompareExchange
RtlUnwind
GetModuleHandleA
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
UnhandledExceptionFilter
_oB&3! vK#Nr
V\3%
kU'9
HMXB
?Zd;
?/L[
S;uD
z?aUY
D?$?
U>c{
zc%C1
.:3q
-64OS
NKeb
---
c4b0458c04abdaa773348c2668212b45 /mnt/tdungan/Documents and Settings/RSydow/Local Settings/Temp/a.exe
c4b0458c04abdaa773348c2668212b45 /mnt/tdungan/Documents and Settings/SRL-Helpdesk/Local Settings/Temp/a.exe
c4b0458c04abdaa773348c2668212b45 /mnt/tdungan/Documents and Settings/tdungan/Local Settings/Temp/a.exe
!This program cannot be run in DOS mode.
RichO
.text
`.data
.reloc
SetUnhandledExceptionFilter
kernel32.dll
('8PW
700PP
```hhh
xppwpp
RSDS
c:\code\httppump\inner\objchk_wxp_x86\i386\i.pdb
Y_^[
URPQQh(
L$,3
UVWS
[_^]
SVWj
_^[]
8csm
8csm
_^[]
Y__^[
t?!E
v N+D$
UQPXY]Y[
WriteProcessMemory
GetCurrentProcess
GetProcAddress
LoadLibraryA
ExitThread
VirtualAlloc
ExitProcess
CloseHandle
WaitForSingleObject
CreateThread
SetErrorMode
SetUnhandledExceptionFilter
KERNEL32.dll
__getmainargs
_cexit
_exit
_XcptFilter
exit
_initterm
_amsg_exit
__setusermatherr
__p__commode
__p__fmode
__set_app_type
msvcrt.dll
?terminate@@YAXXZ
_controlfp
InterlockedExchange
Sleep
InterlockedCompareExchange
RtlUnwind
GetModuleHandleA
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
UnhandledExceptionFilter
_oB&3! vK#Nr
V\3%
kU'9
HMXB
?Zd;
?/L[
S;uD
z?aUY
D?$?
U>c{
zc%C1
.:3q
-64OS
NKeb
1L2V2\2q2{2
2x3}3
494Y4_4l4y4
5*535N5X5k5u5z5
6!6@6H6Q6W6_6k6
7'7-7P7u7z7
:l;z;
<^<u<
< =C=P=\=d=l=x=
> >,>5>:>@>J>S>^>l>q>w>
>??H?
0$0(0
---
!This program cannot be run in DOS mode.
RichO
.text
`.data
.reloc
SetUnhandledExceptionFilter
kernel32.dll
('8PW
700PP
```hhh
xppwpp
RSDS
c:\code\httppump\inner\objchk_wxp_x86\i386\i.pdb
Y_^[
URPQQh(
L$,3
UVWS
[_^]
SVWj
_^[]
8csm
8csm
_^[]
Y__^[
t?!E
v N+D$
UQPXY]Y[
WriteProcessMemory
GetCurrentProcess
GetProcAddress
LoadLibraryA
ExitThread
VirtualAlloc
ExitProcess
CloseHandle
WaitForSingleObject
CreateThread
SetErrorMode
SetUnhandledExceptionFilter
KERNEL32.dll
__getmainargs
_cexit
_exit
_XcptFilter
exit
_initterm
_amsg_exit
__setusermatherr
__p__commode
__p__fmode
__set_app_type
msvcrt.dll
?terminate@@YAXXZ
_controlfp
InterlockedExchange
Sleep
InterlockedCompareExchange
RtlUnwind
GetModuleHandleA
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
UnhandledExceptionFilter
_oB&3! vK#Nr
V\3%
kU'9
HMXB
?Zd;
?/L[
S;uD
z?aUY
D?$?
U>c{
zc%C1
.:3q
-64O
strings '/mnt/tdungan/Documents and Settings/tdungan/Local Settings/Temp/a.exe' 2>/dev/nullstrings '/mnt/tdungan/Documents and Settings/RSydow/Local Settings/Temp/a.exe' 2>/dev/nullcompute_file_hash!This program cannot be run in DOS mode.
RichO
.text
`.data
.reloc
SetUnhandledExceptionFilter
kernel32.dll
('8PW
700PP
```hhh
xppwpp
RSDS
c:\code\httppump\inner\objchk_wxp_x86\i386\i.pdb
Y_^[
URPQQh(
L$,3
UVWS
[_^]
SVWj
_^[]
8csm
8csm
_^[]
Y__^[
t?!E
v N+D$
UQPXY]Y[
WriteProcessMemory
GetCurrentProcess
GetProcAddress
LoadLibraryA
ExitThread
VirtualAlloc
ExitProcess
CloseHandle
WaitForSingleObject
CreateThread
SetErrorMode
SetUnhandledExceptionFilter
KERNEL32.dll
__getmainargs
_cexit
_exit
_XcptFilter
exit
_initterm
_amsg_exit
__setusermatherr
__p__commode
__p__fmode
__set_app_type
msvcrt.dll
?terminate@@YAXXZ
_controlfp
InterlockedExchange
Sleep
InterlockedCompareExchange
RtlUnwind
GetModuleHandleA
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
UnhandledExceptionFilter
_oB&3! vK#Nr
V\3%
kU'9
HMXB
?Zd;
?/L[
S;uD
z?aUY
D?$?
U>c{
zc%C1
.:3q
-64OS
NKeb
1L2V2\2q2{2
2x3}3
494Y4_4l4y4
5*535N5X5k5u5z5
6!6@6H6Q6W6_6k6
7'7-7P7u7z7
:l;z;
<^<u<
< =C=P=\=d=l=x=
> >,>5>:>@>J>S>^>l>q>w>
>??H?
0$0(0
---
!This program cannot be run in DOS mode.
RichO
.text
`.data
.reloc
SetUnhandledExceptionFilter
kernel32.dll
('8PW
700PP
```hhh
xppwpp
RSDS
c:\code\httppump\inner\objchk_wxp_x86\i386\i.pdb
Y_^[
URPQQh(
L$,3
UVWS
[_^]
SVWj
_^[]
8csm
8csm
_^[]
Y__^[
t?!E
v N+D$
UQPXY]Y[
WriteProcessMemory
GetCurrentProcess
GetProcAddress
LoadLibraryA
ExitThread
VirtualAlloc
ExitProcess
CloseHandle
WaitForSingleObject
CreateThread
SetErrorMode
SetUnhandledExceptionFilter
KERNEL32.dll
__getmainargs
_cexit
_exit
_XcptFilter
exit
_initterm
_amsg_exit
__setusermatherr
__p__commode
__p__fmode
__set_app_type
msvcrt.dll
?terminate@@YAXXZ
_controlfp
InterlockedExchange
Sleep
InterlockedCompareExchange
RtlUnwind
GetModuleHandleA
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
UnhandledExceptionFilter
_oB&3! vK#Nr
V\3%
kU'9
HMXB
?Zd;
?/L[
S;uD
z?aUY
D?$?
U>c{
zc%C1
.:3q
-64OS
NKeb
1L2V2\2q2{2
2x3}3
494Y4_4l4y4
5*535N5X5k5u5z5
6!6@6H6Q6W6_6k6
7'7-7P7u7z7
:l;z;
<^<u<
< =C=P=\=d=l=x=
> >,>5>:>@>J>S>^>l>q>w>
>??H?
0$0(0
---
{
"file": "/mnt/tdungan/Documents and Settings/tdungan/Local Settings/Temp/a.exe",
"algorithm": "md5",
"hash": "c4b0458c04abdaa773348c2668212b45"
}
/mnt/tdungan/Documents and Settings /mnt/tdungan/Documents and Settings/All Users/Documents /mnt/tdungan/Documents and Settings/Default User/My Documents /mnt/tdungan/Documents and Settings/RSydow/My Documents /mnt/tdungan/Documents and Settings/SRL-Helpdesk/My Documents /mnt/tdungan/Documents and Settings/tdungan/Application Data/Mozilla/Firefox/Profiles/uimccx5n.default/minidumps /mnt/tdungan/Documents and Settings/tdungan/My Documents /mnt/tdungan/Documents and Settings/tdungan/My Documents/Alloy Research /mnt/tdungan/Documents and Settings/tdungan/My Documents/Alloy Research/Detailed Vibranium R&D Documents /mnt/tdungan/Documents and Settings/tdungan/My Documents/Alloy Research/R&D Documents /mnt/tdungan/Documents and Settings/tdungan/My Documents/Backstopped Accounts - R&D Costs Alloy Research /mnt/tdungan/Documents and Settings/tdungan/My Documents/Dropbox/Research /mnt/tdungan/Documents and Settings/vibranium /mnt/tdungan/Documents and Settings/vibranium/My Documents /mnt/tdungan/WINDOWS/system32/config/systemprofile/My Documents --- /mnt/tdungan/Documents and Settings/RSydow/Local Settings/Temporary Internet Files/Content.IE5/GLABKD23/wsus3setup[1].cab /mnt/tdungan/Documents and Settings/RSydow/Local Settings/Temporary Internet Files/Content.IE5/O52ZG5AZ/wuident[1].cab /mnt/tdungan/Documents and Settings/tdungan/Application Data/Sun/Java/AU/au.cab /mnt/tdungan/Documents and Settings/tdungan/Local Settings/Application Data/Adobe/Reader 9.1/Setup Files/Data1.cab /mnt/tdungan/Documents and Settings/tdungan/Local Settings/Application Data/Adobe/Reader 9.3/Setup Files/Reader9/Data1.cab /mnt/tdungan/Documents and Settings/tdungan/Local Settings/Temporary Internet Files/Content.IE5/GLABKD23/BuzzPlugin[1].zip /mnt/tdungan/Documents and Settings/tdungan/Local Settings/Temporary Internet Files/Content.IE5/GLABKD23/TimHeuer.Seesmic.Translate[1].zip /mnt/tdungan/Documents and Settings/tdungan/Local Settings/Temporary Internet Files/Content.IE5/GLABKD23/LegitCheckContro
find /mnt/tdungan -type d \( -iname '*stage*' -o -iname '*exfil*' -o -iname '*collect*' -o -iname '*dump*' -o -iname '*loot*' -o -iname '*vibranium*' -o -iname '*research*' -o -iname '*documents*' -o -iname '*archive*' \) 2>/dev/nullfind /mnt/tdungan -type f \( -iname '*.zip' -o -iname '*.rar' -o -iname '*.7z' -o -iname '*.tar' -o -iname '*.gz' -o -iname '*.cab' \) 2>/dev/null | head -40find "/mnt/tdungan/Documents and Settings/tdungan/My Documents/Alloy Research" "/mnt/tdungan/Documents and Settings/tdungan/My Documents/Backstopped Accounts - R&D Costs Alloy Research" "/mnt/tdungan/Documents and Settings/tdungan/My Documents/Dropbox/Research" "/mnt/tdungan/Documents and Settings/vibranium/My Documents" -type f 2>/dev/null | head -60/mnt/tdungan/Documents and Settings /mnt/tdungan/Documents and Settings/All Users/Documents /mnt/tdungan/Documents and Settings/Default User/My Documents /mnt/tdungan/Documents and Settings/RSydow/My Documents /mnt/tdungan/Documents and Settings/SRL-Helpdesk/My Documents /mnt/tdungan/Documents and Settings/tdungan/Application Data/Mozilla/Firefox/Profiles/uimccx5n.default/minidumps /mnt/tdungan/Documents and Settings/tdungan/My Documents /mnt/tdungan/Documents and Settings/tdungan/My Documents/Alloy Research /mnt/tdungan/Documents and Settings/tdungan/My Documents/Alloy Research/Detailed Vibranium R&D Documents /mnt/tdungan/Documents and Settings/tdungan/My Documents/Alloy Research/R&D Documents /mnt/tdungan/Documents and Settings/tdungan/My Documents/Backstopped Accounts - R&D Costs Alloy Research /mnt/tdungan/Documents and Settings/tdungan/My Documents/Dropbox/Research /mnt/tdungan/Documents and Settings/vibranium /mnt/tdungan/Documents and Settings/vibranium/My Documents /mnt/tdungan/WINDOWS/system32/config/systemprofile/My Documents --- /mnt/tdungan/Documents and Settings/RSydow/Local Settings/Temporary Internet Files/Content.IE5/GLABKD23/wsus3setup[1].cab /mnt/tdungan/Documents and Settings/RSydow/Local Settings/Temporary Internet Files/Content.IE5/O52ZG5AZ/wuident[1].cab /mnt/tdungan/Documents and Settings/tdungan/Application Data/Sun/Java/AU/au.cab /mnt/tdungan/Documents and Settings/tdungan/Local Settings/Application Data/Adobe/Reader 9.1/Setup Files/Data1.cab /mnt/tdungan/Documents and Settings/tdungan/Local Settings/Application Data/Adobe/Reader 9.3/Setup Files/Reader9/Data1.cab /mnt/tdungan/Documents and Settings/tdungan/Local Settings/Temporary Internet Files/Content.IE5/GLABKD23/BuzzPlugin[1].zip /mnt/tdungan/Documents and Settings/tdungan/Local Settings/Temporary Internet Files/Content.IE5/GLABKD23/TimHeuer.Seesmic.Translate[1].zip /mnt/tdungan/Documents and Settings/tdungan/Local Settings/Temporary Internet Files/Content.IE5/GLABKD23/LegitCheckControl[1].cab /mnt/tdungan/Documents and Settings/tdungan/Local Settings/Temporary Internet Files/Content.IE5/GLABKD23/BingMapsPlugin[1].zip /mnt/tdungan/Documents and Settings/tdungan/Local Settings/Temporary Internet Files/Content.IE5/GLABKD23/IsGdPlugin[1].zip /mnt/tdungan/Documents and Settings/tdungan/Local Settings/Temporary Internet Files/Content.IE5/GLAV89E7/LinkedInPlugin[1].zip /mnt/tdungan/Documents and Settings/tdungan/Local Settings/Temporary Internet Files/Content.IE5/GLAV89E7/TwitPicPlugin[1].zip /mnt/tdungan/Documents and Settings/tdungan/Local Settings/Temporary Internet Files/Content.IE5/GLAV89E7/TimHeuer.Seesmic.Foursquare.VenueFilter[1].zip /mnt/tdungan/Documents and Settings/tdungan/Local Settings/Temporary Internet Files/Content.IE5/GLAV89E7/TimHeuer.Seesmic.Twitlonger[1].zip /mnt/tdungan/Documents and Settings/tdungan/Local Settings/Temporary Internet Files/Content.IE5/KTI305MV/TimHeuer.Seesmic.PicturePreviewer[1].zip /mnt/tdungan/Documents and Settings/tdungan/Local Settings/Temporary Internet Files/Content.IE5/KTI305MV/Salesforce[1].zip /mnt/tdungan/Documents and Settings/tdungan/Local Settings/Temporary Internet Files/Content.IE5/KTI305MV/TweetPhotoPlugin[1].zip /mnt/tdungan/Documents and Settings/tdungan/Local Settings/Temporary Internet Files/Content.IE5/KTI305MV/FacebookPlugin[1].zip /mnt/tdungan/Documents and Settings/tdungan/Local Settings/Temporary Internet Files/Content.IE5/KTI305MV/BitLyPlugin[1].zip /mnt/tdungan/Documents and Settings/tdungan/Local Settings/Temporary Internet Files/Content.IE5/O52ZG5AZ/TimHeuer.Seesmic.Migre[1].zip /mnt/tdungan/Documents and Settings/tdungan/Local Settings/Temporary Internet Files/Content.IE5/O52ZG5AZ/TwitterPlugin[1].zip /mnt/tdungan/Documents and Settings/tdungan/Local Settings/Temporary Internet Files/Content.IE5/O52ZG5AZ/KloutPlugin[1].zip /mnt/tdungan/Documents and Settings/tdungan/Local Settings/Temporary Internet Files/Content.IE5/O52ZG5AZ/PingfmPlugin[1].zip /mnt/tdungan/Documents and Settings/t
3108 12 -rwxrwxrwx 1 root root 9216 Apr 4 2012 /mnt/tdungan/Documents\ and\ Settings/tdungan/Local\ Settings/Temp/a.exe
---
kernel32.dll
WriteProcessMemory
GetCurrentProcess
GetProcAddress
LoadLibraryA
VirtualAlloc
KERNEL32.dll
GetCurrentProcessId
GetSystemTimeAsFileTime
---
!This program cannot be run in DOS mode.
RichO
.text
`.data
.reloc
SetUnhandledExceptionFilter
kernel32.dll
('8PW
700PP
```hhh
xppwpp
RSDS
c:\code\httppump\inner\objchk_wxp_x86\i386\i.pdb
Y_^[
URPQQh(
L$,3
UVWS
[_^]
SVWj
_^[]
8csm
8csm
_^[]
Y__^[
t?!E
v N+D$
UQPXY]Y[
WriteProcessMemory
GetCurrentProcess
GetProcAddress
LoadLibraryA
ExitThread
VirtualAlloc
ExitProcess
CloseHandle
WaitForSingleObject
CreateThread
SetErrorMode
SetUnhandledExceptionFilter
KERNEL32.dll
__getmainargs
_cexit
_exit
_XcptFilter
exit
_initterm
_amsg_exit
__setusermatherr
__p__commode
__p__fmode
__set_app_type
msvcrt.dll
?terminate@@YAXXZ
_controlfp
InterlockedExchange
Sleep
InterlockedCompareExchange
RtlUnwind
GetModuleHandleA
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
UnhandledExceptionFilter
_oB&3! vK#Nr
V\3%
kU'9
HMXB
?Zd;
?/L[
S;uD
z?aUY
D?$?
U>c{
zc%C1
.:3q
-64OS
NKeb
1L2V2\2q2{2
2x3}3
494Y4_4l4y4
5*535N5X5k5u5z5
6!6@6H6Q6W6_6k6
7'7-7P7u7z7
:l;z;
<^<u<
< =C=P=\=d=l=x=
> >,>5>:>@>J>S>^>l>q>w>
>??H?
0$0(0
find /mnt/tdungan/Documents\ and\ Settings/tdungan/Local\ Settings/Temp/ -iname 'a.exe' 2>/dev/null -lsstrings '/mnt/tdungan/Documents and Settings/tdungan/Local Settings/Temp/a.exe' 2>/dev/null | grep -iE 'GetCurrentProcess|GetProcAddress|LoadLibrary|KERNEL32|WriteProcessMemory|VirtualAlloc|NtQuery|SystemInfo|GetSystem|ComputerName|OsVersion|GetVersion|processor|cpuinfo|sysinfo|enumerate|GetDrive|GetDisk|GetVolume' | head -60strings '/mnt/tdungan/Documents and Settings/tdungan/Local Settings/Temp/a.exe' 2>/dev/null3108 12 -rwxrwxrwx 1 root root 9216 Apr 4 2012 /mnt/tdungan/Documents\ and\ Settings/tdungan/Local\ Settings/Temp/a.exe
---
kernel32.dll
WriteProcessMemory
GetCurrentProcess
GetProcAddress
LoadLibraryA
VirtualAlloc
KERNEL32.dll
GetCurrentProcessId
GetSystemTimeAsFileTime
---
!This program cannot be run in DOS mode.
RichO
.text
`.data
.reloc
SetUnhandledExceptionFilter
kernel32.dll
('8PW
700PP
```hhh
xppwpp
RSDS
c:\code\httppump\inner\objchk_wxp_x86\i386\i.pdb
Y_^[
URPQQh(
L$,3
UVWS
[_^]
SVWj
_^[]
8csm
8csm
_^[]
Y__^[
t?!E
v N+D$
UQPXY]Y[
WriteProcessMemory
GetCurrentProcess
GetProcAddress
LoadLibraryA
ExitThread
VirtualAlloc
ExitProcess
CloseHandle
WaitForSingleObject
CreateThread
SetErrorMode
SetUnhandledExceptionFilter
KERNEL32.dll
__getmainargs
_cexit
_exit
_XcptFilter
exit
_initterm
_amsg_exit
__setusermatherr
__p__commode
__p__fmode
__set_app_type
msvcrt.dll
?terminate@@YAXXZ
_controlfp
InterlockedExchange
Sleep
InterlockedCompareExchange
RtlUnwind
GetModuleHandleA
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
UnhandledExceptionFilter
_oB&3! vK#Nr
V\3%
kU'9
HMXB
?Zd;
?/L[
S;uD
z?aUY
D?$?
U>c{
zc%C1
.:3q
-64OS
NKeb
1L2V2\2q2{2
2x3}3
494Y4_4l4y4
5*535N5X5k5u5z5
6!6@6H6Q6W6_6k6
7'7-7P7u7z7
:l;z;
<^<u<
< =C=P=\=d=l=x=
> >,>5>:>@>J>S>^>l>q>w>
>??H?
0$0(0
/mnt/tdungan/Documents and Settings
/mnt/tdungan/Documents and Settings/All Users
/mnt/tdungan/Documents and Settings/Default User
/mnt/tdungan/Documents and Settings/LocalService
/mnt/tdungan/Documents and Settings/NetworkService
/mnt/tdungan/Documents and Settings/RSydow
/mnt/tdungan/Documents and Settings/SRL-Helpdesk
/mnt/tdungan/Documents and Settings/tdungan
/mnt/tdungan/Documents and Settings/vibranium
---
!This program cannot be run in DOS mode.
RichO
.text
`.data
.reloc
SetUnhandledExceptionFilter
kernel32.dll
('8PW
700PP
```hhh
xppwpp
RSDS
c:\code\httppump\inner\objchk_wxp_x86\i386\i.pdb
Y_^[
URPQQh(
L$,3
UVWS
[_^]
SVWj
_^[]
8csm
8csm
_^[]
Y__^[
t?!E
v N+D$
UQPXY]Y[
WriteProcessMemory
GetCurrentProcess
GetProcAddress
LoadLibraryA
ExitThread
VirtualAlloc
ExitProcess
CloseHandle
WaitForSingleObject
CreateThread
SetErrorMode
SetUnhandledExceptionFilter
KERNEL32.dll
__getmainargs
_cexit
_exit
_XcptFilter
exit
_initterm
_amsg_exit
__setusermatherr
__p__commode
__p__fmode
__set_app_type
msvcrt.dll
?terminate@@YAXXZ
_controlfp
InterlockedExchange
Sleep
InterlockedCompareExchange
RtlUnwind
GetModuleHandleA
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
UnhandledExceptionFilter
_oB&3! vK#Nr
V\3%
kU'9
HMXB
?Zd;
?/L[
S;uD
z?aUY
D?$?
U>c{
zc%C1
.:3q
-64OS
NKeb
---
ERROR: Command blocked — binary 'samdump2' not in forensic allowlist
find /mnt/tdungan/Documents\ and\ Settings -maxdepth 1 -type d 2>/dev/null | sortstrings /mnt/tdungan/Documents\ and\ Settings/RSydow/Local\ Settings/Temp/a.exe 2>/dev/null | head -80samdump2 /mnt/tdungan/WINDOWS/system32/config/SYSTEM /mnt/tdungan/WINDOWS/system32/config/SAM 2>/dev/null/mnt/tdungan/Documents and Settings
/mnt/tdungan/Documents and Settings/All Users
/mnt/tdungan/Documents and Settings/Default User
/mnt/tdungan/Documents and Settings/LocalService
/mnt/tdungan/Documents and Settings/NetworkService
/mnt/tdungan/Documents and Settings/RSydow
/mnt/tdungan/Documents and Settings/SRL-Helpdesk
/mnt/tdungan/Documents and Settings/tdungan
/mnt/tdungan/Documents and Settings/vibranium
---
!This program cannot be run in DOS mode.
RichO
.text
`.data
.reloc
SetUnhandledExceptionFilter
kernel32.dll
('8PW
700PP
```hhh
xppwpp
RSDS
c:\code\httppump\inner\objchk_wxp_x86\i386\i.pdb
Y_^[
URPQQh(
L$,3
UVWS
[_^]
SVWj
_^[]
8csm
8csm
_^[]
Y__^[
t?!E
v N+D$
UQPXY]Y[
WriteProcessMemory
GetCurrentProcess
GetProcAddress
LoadLibraryA
ExitThread
VirtualAlloc
ExitProcess
CloseHandle
WaitForSingleObject
CreateThread
SetErrorMode
SetUnhandledExceptionFilter
KERNEL32.dll
__getmainargs
_cexit
_exit
_XcptFilter
exit
_initterm
_amsg_exit
__setusermatherr
__p__commode
__p__fmode
__set_app_type
msvcrt.dll
?terminate@@YAXXZ
_controlfp
InterlockedExchange
Sleep
InterlockedCompareExchange
RtlUnwind
GetModuleHandleA
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
UnhandledExceptionFilter
_oB&3! vK#Nr
V\3%
kU'9
HMXB
?Zd;
?/L[
S;uD
z?aUY
D?$?
U>c{
zc%C1
.:3q
-64OS
NKeb
---
ERROR: Command blocked — binary 'samdump2' not in forensic allowlist
!This program cannot be run in DOS mode. Richc .text `.rdata @.data .rsrc @.reloc h0a@ h a@ uTVWh}#@ j hpx@ hHa@ t!Ht PPPPP hPa@ h8y@ Y;=h WhPa@ hta@ hla@ 5\`@ 5H`@ =H`@ h`y@ _^[] Y_^[ Y_^[ Y__^[ 9csm hTk@ h$k@ PPPPP <v*V ^SSSSS 8csm t?VSP Y[_^ PPPPP >"u& < tK< tG wf93t f90u f90u VVV+ @PSVV t*VV j@j ^V SWf9M j@j u,9E 5d`@ _^[] 5p`@ Y_^[] Fpt" Fh=p =d`@ URPQQh`B@ L$,3 UVWS [_^] SVWj _^[] 5H`@ hxo@ _^[] t'Ou woVW oV f o^0f of@f onPf ov`f o~pf FGIu X^_] FGIu v4;5 vL;5 9]$u --- 00000000: 4d5a 9000 0300 0000 0400 0000 ffff 0000 MZ.............. 00000010: b800 0000 0000 0000 4000 0000 0000 0000 ........@....... 00000020: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 00000030: 0000 0000 0000 0000 0000 0000 e000 0000 ................ 00000040: 0e1f ba0e 00b4 09cd 21b8 014c cd21 5468 ........!..L.!Th 00000050: 6973 2070 726f 6772 616d 2063 616e 6e6f is program canno 00000060: 7420 6265 2072 756e 2069 6e20 444f 5320 t be run in DOS 00000070: 6d6f 6465 2e0d 0d0a 2400 0000 0000 0000 mode....$....... 00000080: 27dc a5e2 63bd cbb1 63bd cbb1 63bd cbb1 '...c...c...c... 00000090: 0ccb 60b1 69bd cbb1 0ccb 55b1 6abd cbb1 ..`.i.....U.j... 000000a0: 0ccb 61b1 54bd cbb1 6ac5 58b1 60bd cbb1 ..a.T...j.X.`... 000000b0: 63bd cab1 22bd cbb1 0ccb 65b1 62bd cbb1 c...".....e.b... 000000c0: 0ccb 56b1 62bd cbb1 5269 6368 63bd cbb1 ..V.b...Richc... 000000d0: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 000000e0: 5045 0000 4c01 0500 fbb6 424f 0000 0000 PE..L.....BO.... 000000f0: 0000 0000 e000 0201 0b01 0a00 0046 0000 .............F.. 00000100: 0036 0000 0000 0000 5916 0000 0010 0000 .6......Y....... 00000110: 0060 0000 0000 4000 0010 0000 0002 0000 .`....@......... 00000120: 0500 0100 0000 0000 0500 0100 0000 0000 ................ 00000130: 00c0 0000 0004 0000 2be4 0000 0300 4081 ........+.....@. 00000140: 0000 1000 0010 0000 0000 1000 0010 0000 ................ 00000150: 0000 0000 1000 0000 0000 0000 0000 0000 ................ 00000160: 1c7a 0000 280
strings '/mnt/tdungan/Documents and Settings/tdungan/Local Settings/Temp/pkxezy1tji98.exe' 2>/dev/null | head -80xxd '/mnt/tdungan/Documents and Settings/tdungan/Local Settings/Temp/pkxezy1tji98.exe' 2>/dev/null | head -40strings '/mnt/tdungan/Documents and Settings/tdungan/Local Settings/Temp/pkxezy1tji98.exe' 2>/dev/null | grep -iE 'decode|decrypt|deobfuscate|xor|base64|unpack|decompress|shellcode|loader|inject|VirtualAlloc|CreateThread|WinExec|URLDownload|cmd|powershell|crypt|cipher|key|rc4|aes' | head -40!This program cannot be run in DOS mode. Richc .text `.rdata @.data .rsrc @.reloc h0a@ h a@ uTVWh}#@ j hpx@ hHa@ t!Ht PPPPP hPa@ h8y@ Y;=h WhPa@ hta@ hla@ 5\`@ 5H`@ =H`@ h`y@ _^[] Y_^[ Y_^[ Y__^[ 9csm hTk@ h$k@ PPPPP <v*V ^SSSSS 8csm t?VSP Y[_^ PPPPP >"u& < tK< tG wf93t f90u f90u VVV+ @PSVV t*VV j@j ^V SWf9M j@j u,9E 5d`@ _^[] 5p`@ Y_^[] Fpt" Fh=p =d`@ URPQQh`B@ L$,3 UVWS [_^] SVWj _^[] 5H`@ hxo@ _^[] t'Ou woVW oV f o^0f of@f onPf ov`f o~pf FGIu X^_] FGIu v4;5 vL;5 9]$u --- 00000000: 4d5a 9000 0300 0000 0400 0000 ffff 0000 MZ.............. 00000010: b800 0000 0000 0000 4000 0000 0000 0000 ........@....... 00000020: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 00000030: 0000 0000 0000 0000 0000 0000 e000 0000 ................ 00000040: 0e1f ba0e 00b4 09cd 21b8 014c cd21 5468 ........!..L.!Th 00000050: 6973 2070 726f 6772 616d 2063 616e 6e6f is program canno 00000060: 7420 6265 2072 756e 2069 6e20 444f 5320 t be run in DOS 00000070: 6d6f 6465 2e0d 0d0a 2400 0000 0000 0000 mode....$....... 00000080: 27dc a5e2 63bd cbb1 63bd cbb1 63bd cbb1 '...c...c...c... 00000090: 0ccb 60b1 69bd cbb1 0ccb 55b1 6abd cbb1 ..`.i.....U.j... 000000a0: 0ccb 61b1 54bd cbb1 6ac5 58b1 60bd cbb1 ..a.T...j.X.`... 000000b0: 63bd cab1 22bd cbb1 0ccb 65b1 62bd cbb1 c...".....e.b... 000000c0: 0ccb 56b1 62bd cbb1 5269 6368 63bd cbb1 ..V.b...Richc... 000000d0: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 000000e0: 5045 0000 4c01 0500 fbb6 424f 0000 0000 PE..L.....BO.... 000000f0: 0000 0000 e000 0201 0b01 0a00 0046 0000 .............F.. 00000100: 0036 0000 0000 0000 5916 0000 0010 0000 .6......Y....... 00000110: 0060 0000 0000 4000 0010 0000 0002 0000 .`....@......... 00000120: 0500 0100 0000 0000 0500 0100 0000 0000 ................ 00000130: 00c0 0000 0004 0000 2be4 0000 0300 4081 ........+.....@. 00000140: 0000 1000 0010 0000 0000 1000 0010 0000 ................ 00000150: 0000 0000 1000 0000 0000 0000 0000 0000 ................ 00000160: 1c7a 0000 2800 0000 00a0 0000 b401 0000 .z..(........... 00000170: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 00000180: 00b0 0000 b805 0000 0000 0000 0000 0000 ................ 00000190: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 000001a0: 0000 0000 0000 0000 0078 0000 4000 0000 .........x..@... 000001b0: 0000 0000 0000 0000 0060 0000 ec00 0000 .........`...... 000001c0: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 000001d0: 0000 0000 0000 0000 2e74 6578 7400 0000 .........text... 000001e0: 6245 0000 0010 0000 0046 0000 0004 0000 bE.......F...... 000001f0: 0000 0000 0000 0000 0000 0000 2000 0060 ............ ..` 00000200: 2e72 6461 7461 0000 781f 0000 0060 0000 .rdata..x....`.. 00000210: 0020 0000 004a 0000 0000 0000 0000 0000 . ...J.......... 00000220: 0000 0000 4000 0040 2e64 6174 6100 0000 ....@..@.data... 00000230: c418 0000 0080 0000 000c 0000 006a 0000 .............j.. 00000240: 0000 0000 0000 0000 0000 0000 4000 00c0 ............@... 00000250: 2e72 7372 6300 0000 b401 0000 00a0 0000 .rsrc........... 00000260: 0002 0000 0076 0000 0000 0000 0000 0000 .....v.......... 00000270: 0000 0000 4000 0040 2e72 656c 6f63 0000 ....@..@.reloc.. --- VirtualAlloc CreateThread DecodePointer
ERROR: Command blocked — binary 'size:%s' not in forensic allowlist --- SCCA --- -rwxrwxrwx 2 root root 6786 Apr 4 2012 /mnt/tdungan/WINDOWS/Prefetch/A.EXE-0F3A0E12.pf -rwxrwxrwx 2 root root 6794 Apr 4 2012 /mnt/tdungan/WINDOWS/Prefetch/A.EXE-0FBE37C1.pf -rwxrwxrwx 2 root root 6802 Apr 7 2012 /mnt/tdungan/WINDOWS/Prefetch/A.EXE-239305EA.pf -rwxrwxrwx 2 root root 6802 Apr 5 2012 /mnt/tdungan/WINDOWS/Prefetch/A.EXE-2E0C27A0.pf -rwxrwxrwx 2 root root 6792 Apr 3 2012 /mnt/tdungan/WINDOWS/Prefetch/PKXEZY1TJI98.EXE-0BCBF29B.pf
find /mnt/tdungan/WINDOWS/Prefetch -iname 'A.EXE*.pf' -o -iname 'PKXEZY*.pf' 2>/dev/null | xargs -I{} stat --format="%n | Size:%s | Modify:%y | Access:%x" {} 2>/dev/nullstrings /mnt/tdungan/WINDOWS/Prefetch/PKXEZY1TJI98.EXE-0BCBF29B.pf 2>/dev/null | head -60ls -la /mnt/tdungan/WINDOWS/Prefetch/A.EXE*.pf /mnt/tdungan/WINDOWS/Prefetch/PKXEZY*.pf 2>/dev/nullERROR: Command blocked — binary 'size:%s' not in forensic allowlist --- SCCA --- -rwxrwxrwx 2 root root 6786 Apr 4 2012 /mnt/tdungan/WINDOWS/Prefetch/A.EXE-0F3A0E12.pf -rwxrwxrwx 2 root root 6794 Apr 4 2012 /mnt/tdungan/WINDOWS/Prefetch/A.EXE-0FBE37C1.pf -rwxrwxrwx 2 root root 6802 Apr 7 2012 /mnt/tdungan/WINDOWS/Prefetch/A.EXE-239305EA.pf -rwxrwxrwx 2 root root 6802 Apr 5 2012 /mnt/tdungan/WINDOWS/Prefetch/A.EXE-2E0C27A0.pf -rwxrwxrwx 2 root root 6792 Apr 3 2012 /mnt/tdungan/WINDOWS/Prefetch/PKXEZY1TJI98.EXE-0BCBF29B.pf
strings /mnt/tdungan/WINDOWS/Prefetch/PKXEZY1TJI98.EXE-0BCBF29B.pf 2>/dev/null | head -80strings /mnt/tdungan/WINDOWS/Prefetch/A.EXE-0FBE37C1.pf 2>/dev/null | head -80find /mnt/tdungan -iname 'PKXEZY1TJI98.EXE' -o -iname 'A.EXE' 2>/dev/nullSCCA --- SCCA --- /mnt/tdungan/Documents and Settings/RSydow/Local Settings/Temp/a.exe /mnt/tdungan/Documents and Settings/SRL-Helpdesk/Local Settings/Temp/a.exe /mnt/tdungan/Documents and Settings/tdungan/Local Settings/Temp/a.exe /mnt/tdungan/Documents and Settings/tdungan/Local Settings/Temp/pkxezy1tji98.exe /mnt/tdungan/Documents and Settings/vibranium/Local Settings/Temp/a.exe
File: /mnt/tdungan/Documents and Settings/tdungan/Local Settings/Temp/pkxezy1tji98.exe Size: 32768 Blocks: 64 IO Block: 4096 regular file Device: 7,10 Inode: 3019 Links: 2 Access: (0777/-rwxrwxrwx) Uid: ( 0/ root) Gid: ( 0/ root) Access: 2012-04-05 05:36:36.766194900 +0000 Modify: 2012-04-03 00:33:15.614468000 +0000 Change: 2012-04-03 00:33:15.614468000 +0000 Birth: - /mnt/tdungan/Documents and Settings/tdungan/Local Settings/Temp/pkxezy1tji98.exe: PE32 executable (console) Intel 80386, for MS Windows, 5 sections --- !This program cannot be run in DOS mode. Richc .text `.rdata @.data .rsrc @.reloc h0a@ h a@ uTVWh}#@ j hpx@ hHa@ t!Ht PPPPP hPa@ h8y@ Y;=h WhPa@ hta@ hla@ 5\`@ 5H`@ =H`@ h`y@ _^[] Y_^[ Y_^[ Y__^[ 9csm hTk@ h$k@ PPPPP <v*V ^SSSSS 8csm t?VSP Y[_^ PPPPP >"u& < tK< tG wf93t f90u f90u VVV+ @PSVV t*VV j@j ^V SWf9M j@j u,9E 5d`@ _^[] 5p`@ Y_^[] Fpt" Fh=p =d`@ URPQQh`B@ L$,3 UVWS [_^] SVWj _^[] 5H`@ hxo@ _^[] t'Ou woVW oV f o^0f of@f onPf ov`f o~pf FGIu X^_] FGIu v4;5 vL;5 9]$u --- !This program cannot be run in DOS mode. KERNEL32.dll GetStartupInfoW
stat '/mnt/tdungan/Documents and Settings/tdungan/Local Settings/Temp/pkxezy1tji98.exe' 2>/dev/null && file '/mnt/tdungan/Documents and Settings/tdungan/Local Settings/Temp/pkxezy1tji98.exe' 2>/dev/nullstrings '/mnt/tdungan/Documents and Settings/tdungan/Local Settings/Temp/pkxezy1tji98.exe' 2>/dev/null | head -80strings '/mnt/tdungan/Documents and Settings/tdungan/Local Settings/Temp/pkxezy1tji98.exe' 2>/dev/null | grep -iE '(http|ftp|\.dll|CreateProcess|WinExec|ShellExec|Download|URLDownload|socket|connect|cmd|powershell|dropper|payload|inject|registry|run|startup)' | head -40File: /mnt/tdungan/Documents and Settings/tdungan/Local Settings/Temp/pkxezy1tji98.exe Size: 32768 Blocks: 64 IO Block: 4096 regular file Device: 7,10 Inode: 3019 Links: 2 Access: (0777/-rwxrwxrwx) Uid: ( 0/ root) Gid: ( 0/ root) Access: 2012-04-05 05:36:36.766194900 +0000 Modify: 2012-04-03 00:33:15.614468000 +0000 Change: 2012-04-03 00:33:15.614468000 +0000 Birth: - /mnt/tdungan/Documents and Settings/tdungan/Local Settings/Temp/pkxezy1tji98.exe: PE32 executable (console) Intel 80386, for MS Windows, 5 sections --- !This program cannot be run in DOS mode. Richc .text `.rdata @.data .rsrc @.reloc h0a@ h a@ uTVWh}#@ j hpx@ hHa@ t!Ht PPPPP hPa@ h8y@ Y;=h WhPa@ hta@ hla@ 5\`@ 5H`@ =H`@ h`y@ _^[] Y_^[ Y_^[ Y__^[ 9csm hTk@ h$k@ PPPPP <v*V ^SSSSS 8csm t?VSP Y[_^ PPPPP >"u& < tK< tG wf93t f90u f90u VVV+ @PSVV t*VV j@j ^V SWf9M j@j u,9E 5d`@ _^[] 5p`@ Y_^[] Fpt" Fh=p =d`@ URPQQh`B@ L$,3 UVWS [_^] SVWj _^[] 5H`@ hxo@ _^[] t'Ou woVW oV f o^0f of@f onPf ov`f o~pf FGIu X^_] FGIu v4;5 vL;5 9]$u --- !This program cannot be run in DOS mode. KERNEL32.dll GetStartupInfoW
/opt/volatility3/bin/vol -q -f /home/sansforensics/cases/tdungan/xp-tdungan-memory/xp-tdungan-memory-raw.001 windows.privileges.Privs 2>/dev/null | grep -iE 'sedebug|seimpersonate|enabled|present' | head -60/opt/volatility3/bin/vol -q -f /home/sansforensics/cases/tdungan/xp-tdungan-memory/xp-tdungan-memory-raw.001 windows.cmdline 2>/dev/null | head -80/opt/volatility3/bin/vol -q -f /home/sansforensics/cases/tdungan/xp-tdungan-memory/xp-tdungan-memory-raw.001 windows.privileges.Privs 2>/dev/null | grep -iE 'sedebug|seimpersonate' | grep -v '^4\s' | head -604 System 7 SeTcbPrivilege Present,Enabled,Default Act as part of the operating system 4 System 2 SeCreateTokenPrivilege Present Create a token object 4 System 9 SeTakeOwnershipPrivilege Present Take ownership of files/objects 4 System 15 SeCreatePagefilePrivilege Present,Enabled,Default Create a pagefile 4 System 4 SeLockMemoryPrivilege Present,Enabled,Default Lock pages in memory 4 System 3 SeAssignPrimaryTokenPrivilege Present Replace a process-level token 4 System 5 SeIncreaseQuotaPrivilege Present Increase quotas 4 System 14 SeIncreaseBasePriorityPrivilege Present,Enabled,Default Increase scheduling priority 4 System 16 SeCreatePermanentPrivilege Present,Enabled,Default Create permanent shared objects 4 System 20 SeDebugPrivilege Present,Enabled,Default Debug programs 4 System 21 SeAuditPrivilege Present,Enabled,Default Generate security audits 4 System 8 SeSecurityPrivilege Present Manage auditing and security log 4 System 22 SeSystemEnvironmentPrivilege Present Edit firmware environment values 4 System 23 SeChangeNotifyPrivilege Present,Enabled,Default Receive notifications of changes to files or directories 4 System 17 SeBackupPrivilege Present Backup files and directories 4 System 18 SeRestorePrivilege Present Restore files and directories 4 System 19 SeShutdownPrivilege Present Shut down the system 4 System 10 SeLoadDriverPrivilege Present Load and unload device drivers 4 System 13 SeProfileSingleProcessPrivilege Present,Enabled,Default Profile a single process 4 System 12 SeSystemtimePrivilege Present Change the system time 4 System 25 SeUndockPrivilege Present Remove computer from docking station 4 System 28 SeManageVolumePrivilege Present Manage the files on a volume 4 System 29 SeImpersonatePrivilege Present,Enabled,Default Impersonate a client after authentication 4 System 30 SeCreateGlobalPrivilege Present,Enabled,Default Create global objects 876 smss.exe 7 SeTcbPrivilege Present,Enabled,Default Act as part of the operating system 876 smss.exe 2 SeCreateTokenPrivilege Present Create a token object 876 smss.exe 9 SeTakeOwnershipPrivilege Present Take ownership of files/objects 876 smss.exe 15 SeCreatePagefilePrivilege Present,Enabled,Default Create a pagefile 876 smss.exe 4 SeLockMemoryPrivilege Present,Enabled,Default Lock pages in memory 876 smss.exe 3 SeAssignPrimaryTokenPrivilege Present Replace a process-level token 876 smss.exe 5 SeIncreaseQuotaPrivilege Present Increase quotas 876 smss.exe 14 SeIncreaseBasePriorityPrivilege Present,Enabled,Default Increase scheduling priority 876 smss.exe 16 SeCreatePermanentPrivilege Present,Enabled,Default Create permanent shared objects 876 smss.exe 20 SeDebugPrivilege Present,Enabled,Default Debug programs 876 smss.exe 21 SeAuditPrivilege Present,Enabled,Default Generate security audits 876 smss.exe 8 SeSecurityPrivilege Present Manage auditing and security log 876 smss.exe 22 SeSystemEnvironmentPrivilege Present Edit firmware environment values 876 smss.exe 23 SeChangeNotifyPrivilege Present,Enabled,Default Receive notifications of changes to files or directories 876 smss.exe 17 SeBackupPrivilege Present Backup files and directories 876 smss.exe 18 SeRestorePrivilege Present Restore files and directories 876 smss.exe 19 SeShutdownPrivilege Present Shut down the system 876 smss.exe 10 SeLoadDriverPrivilege Present Load and unload device drivers 876 smss.exe 13 SeProfileSingleProcessPrivilege Present,Enabled,Default Profile a single process 876 smss.exe 12 SeSystemtimePrivilege Present Change the system time 876 smss.exe 25 SeUndockPrivilege Present Remove computer from docking station 876 smss.exe 28 SeManageVolumePrivilege Present Manage the files on a volume 876 smss.exe 29 SeImpersonatePrivilege Present,Enabled,Default Impersonate a client after authentication 876 smss.exe 30 SeCreateGlobalPrivilege Present,Enabled,Default Create global objects 976 csrss.exe 7 SeTcbPrivilege Present,Enabled,Default Act as part of the operating system 976 csrss.exe 2 SeCreateTokenPr
find /mnt/tdungan -type f -iname "NTUSER.DAT" 2>/dev/nullrun_volatilitystrings -a "/mnt/tdungan/Documents and Settings/tdungan/NTUSER.DAT" 2>/dev/null | grep -i -A2 -B2 "currentversion.run"/mnt/tdungan/Documents and Settings/Default User/NTUSER.DAT
/mnt/tdungan/Documents and Settings/LocalService/NTUSER.DAT
/mnt/tdungan/Documents and Settings/NetworkService/NTUSER.DAT
/mnt/tdungan/Documents and Settings/RSydow/NTUSER.DAT
/mnt/tdungan/Documents and Settings/SRL-Helpdesk/NTUSER.DAT
/mnt/tdungan/Documents and Settings/tdungan/NTUSER.DAT
/mnt/tdungan/Documents and Settings/vibranium/NTUSER.DAT
/mnt/tdungan/WINDOWS/repair/ntuser.dat
---
{
"memory_image": "/home/sansforensics/cases/tdungan/xp-tdungan-memory/xp-tdungan-memory-raw.001",
"plugin": "windows.registry.printkey",
"row_count": 11,
"output": "Volatility 3 Framework 2.27.0\nLast Write Time\tHive Offset\tType\tKey\tName\tData\tVolatile\n-\t0xe1227008\tKey\t\\Device\\HarddiskVolume1\\Documents and Settings\\SRL-Helpdesk\\Local Settings\\Application Data\\Microsoft\\Windows\\UsrClass.dat\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\t-\t-\t-\n-\t0xe2086b60\tKey\t\\Device\\HarddiskVolume1\\Documents and Settings\\LocalService\\Local Settings\\Application Data\\Microsoft\\Windows\\UsrClass.dat\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\t-\t-\t-\n-\t0xe2058820\tKey\t\\Device\\HarddiskVolume1\\Documents and Settings\\NetworkService\\Local Settings\\Application Data\\Microsoft\\Windows\\UsrClass.dat\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\t-\t-\t-\n-\t0xe19efb60\tKey\t\\Device\\HarddiskVolume1\\WINDOWS\\system32\\config\\software\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\t-\t-\t-\n-\t0xe1cf89e0\tKey\t\\Device\\HarddiskVolume1\\WINDOWS\\system32\\config\\SAM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\t-\t-\t-\n-\t0xe19ef008\tKey\t\\Device\\HarddiskVolume1\\WINDOWS\\system32\\config\\SECURITY\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\t-\t-\t-\n-\t0xe17cc008\tKey\t[NONAME]\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\t-\t-\t-\n-\t0xe1035b60\tKey\t\\Device\\HarddiskVolume1\\WINDOWS\\system32\\config\\system\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\t-\t-\t-\n-\t0xe102e008\tKey\t[NONAME]\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\t-\t-\t-",
"truncated": false
}
---
STDERR:
find /mnt/tdungan -iname 'psexec*' -o -iname 'PSEXESVC*' 2>/dev/nullfind /mnt/tdungan/Windows/System32/winevt /mnt/tdungan/WINDOWS/System32/config -iname '*.evt' -o -iname '*.evtx' 2>/dev/null | head -20strings '/mnt/tdungan/WINDOWS/system32/config/SYSTEM' 2>/dev/null | grep -iE 'psexec|PSEXESVC' | head -30--- ---
/opt/volatility3/bin/vol -q -f /home/sansforensics/cases/tdungan/xp-tdungan-memory/xp-tdungan-memory-raw.001 windows.malfind 2>/dev/null | head -80/opt/volatility3/bin/vol -q -f /home/sansforensics/cases/tdungan/xp-tdungan-memory/xp-tdungan-memory-raw.001 windows.cmdline 2>/dev/null | head -80/opt/volatility3/bin/vol -q -f /home/sansforensics/cases/tdungan/xp-tdungan-memory/xp-tdungan-memory-raw.001 windows.dlllist 2>/dev/null | grep -iE "(temp|appdata|roaming|public|users|tmp|desktop|downloads|\.tmp|\.dat)" | head -40Volatility 3 Framework 2.27.0 PID Process Start VPN End VPN Tag Protection CommitCharge PrivateMemory File output Notes Hexdump Disasm 976 csrss.exe 0x7f6f0000 0x7f7effff Vad PAGE_EXECUTE_READWRITE 0 0 Disabled N/A c8 00 00 00 75 01 00 00 ff ee ff ee 08 70 00 00 ....u........p.. 08 00 00 00 00 fe 00 00 00 00 10 00 00 20 00 00 ............. .. 00 02 00 00 00 20 00 00 8d 01 00 00 ff ef fd 7f ..... .......... 03 00 08 06 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0x7f6f0000: enter 0, 0 0x7f6f0004: jne 0x7f6f0007 0x7f6f0006: add byte ptr [eax], al 1000 winlogon.exe 0x17550000 0x17553fff VadS PAGE_EXECUTE_READWRITE 4 1 Disabled N/A 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00 00 00 00 2a 00 2a 00 01 00 00 00 00 00 00 00 ....*.*......... 0x17550000: add byte ptr [eax], al 0x17550002: add byte ptr [eax], al 0x17550004: add byte ptr [eax], al 0x17550006: add byte ptr [eax], al 0x17550008: add byte ptr [eax], al 0x1755000a: add byte ptr [eax], al 0x1755000c: add byte ptr [eax], al 0x1755000e: add byte ptr [eax], al 0x17550010: add byte ptr [eax], al 0x17550012: add byte ptr [eax], al 0x17550014: add byte ptr [eax], al 0x17550016: add byte ptr [eax], al 0x17550018: add byte ptr [eax], al 0x1755001a: add byte ptr [eax], al 0x1755001c: add byte ptr [eax], al 0x1755001e: add byte ptr [eax], al 0x17550020: add byte ptr [eax], al 0x17550022: add byte ptr [eax], al 0x17550024: add byte ptr [eax], al 0x17550026: add byte ptr [eax], al 0x17550028: add byte ptr [eax], al 0x1755002a: add byte ptr [eax], al 0x1755002c: add byte ptr [eax], al 0x1755002e: add byte ptr [eax], al 0x17550030: add byte ptr [eax], al 0x17550032: add byte ptr [eax], al 0x17550034: sub al, byte ptr [eax] 0x17550036: sub al, byte ptr [eax] 0x17550038: add dword ptr [eax], eax 0x1755003a: add byte ptr [eax], al 0x1755003c: add byte ptr [eax], al 0x1755003e: add byte ptr [eax], al 1000 winlogon.exe 0x212f0000 0x212f3fff VadS PAGE_EXECUTE_READWRITE 4 1 Disabled N/A 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00 00 00 00 23 00 23 00 01 00 00 00 00 00 00 00 ....#.#......... 0x212f0000: add byte ptr [eax], al 0x212f0002: add byte ptr [eax], al 0x212f0004: add byte ptr [eax], al 0x212f0006: add byte ptr [eax], al 0x212f0008: add byte ptr [eax], al 0x212f000a: add byte ptr [eax], al 0x212f000c: add byte ptr [eax], al 0x212f000e: add byte ptr [eax], al 0x212f0010: add byte ptr [eax], al 0x212f0012: add byte ptr [eax], al 0x212f0014: add byte ptr [eax], al 0x212f0016: add byte ptr [eax], al 0x212f0018: add byte ptr [eax], al 0x212f001a: add byte ptr [eax], al 0x212f001c: add byte ptr [eax], al 0x212f001e: add byte ptr [eax], al 0x212f0020: add byte ptr [eax], al 0x212f0022: add byte ptr [eax], al 0x212f0024: add byte ptr [eax], al 0x212f0026: add byte ptr [eax], al 0x212f0028: add byte ptr [eax], al 0x212f002a: add byte ptr [eax], al 0x212f002c: add byte ptr [eax], al 0x212f002e: add byte ptr [eax], al 0x212f0030: add byte ptr [eax], al 0x212f0032: add byte ptr [eax], al --- Volatility 3 Framework 2.27.0 PID Process Args 4 System - 876 smss.exe \SystemRoot\System32\smss.exe 976 csrss.exe C:\WINDOWS\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,3072,512 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ProfileControl=Off MaxRequestThreads=16 1000 winlogon.exe winlogon.exe 1044 services.exe C:\WINDOWS\system32\services.exe 1056 lsass.exe C:\WINDOWS\system32\lsass.exe 1220 vmacthlp.exe "C:\Program Files\VMware\VMware Tools\vmacthlp.exe" 1236 svchost.exe C:\WINDOWS\system32\svchost -k DcomLaunch 1308 svchost.exe C:\WINDOWS\system32\svchost -k rpcss 1472 svc
/mnt/tdungan)The investigation reveals a targeted intrusion against a research workstation containing classified Vibranium alloy R&D documents. The attacker compromised the primary user account (tdungan), deployed a custom HTTP-based implant named a.exe (internally called httppump), achieved lateral movement to at least three additional accounts (RSydow, SRL-Helpdesk, vibranium), and staged sensitive research documents for exfiltration. The campaign spanned from 2012-04-03 through 2012-04-07.
pkxezy1tji98.exeThe file /mnt/tdungan/Documents and Settings/tdungan/Local Settings/Temp/pkxezy1tji98.exe is the earliest malicious executable recovered. Its MD5 is 7a0fcd15ee1c2d9d196ab6515adf2f87. The file is 32,768 bytes. Modify and Change timestamps are both 2012-04-03 00:33:15. Access timestamp is 2012-04-05 05:36:36, indicating it was accessed again two days after it was written. The inode has two hard links, indicating the file was linked elsewhere on the filesystem. Prefetch confirms execution: /mnt/tdungan/WINDOWS/Prefetch/PKXEZY1TJI98.EXE-0BCBF29B.pf has a Modify timestamp of 2012-04-03 00:33:27 — twelve seconds after the binary was written, confirming near-immediate execution on the night of April 3rd. The binary's string output shows PE structure characteristics consistent with a dropper or loader: it references WriteProcessMemory, VirtualAlloc, CreateThread, GetProcAddress, LoadLibraryA, and WaitForSingleObject — the canonical Windows API call set for shellcode injection or process hollowing. The internal structure includes what appears to be encoded or packed payload content (non-printable regions), consistent with a packed second-stage loader.
a.exe (httppump)The file /mnt/tdungan/Documents and Settings/tdungan/Local Settings/Temp/a.exe has MD5 c4b0458c04abdaa773348c2668212b45 and is 9,216 bytes. Modify and Change timestamps are 2012-04-04 14:01:32. Access timestamp is 2012-04-05 05:36:30. This binary contains the embedded PDB path c:\code\httppump\inner\objchk_wxp_x86\i386\i.pdb — a developer artifact proving the binary was compiled from a project named httppump, a custom tool not associated with any known commercial software. The binary imports WriteProcessMemory, GetCurrentProcess, VirtualAlloc, CreateThread, LoadLibraryA, GetProcAddress, CloseHandle, and WaitForSingleObject from KERNEL32.dll, confirming process injection capability. It also imports from msvcrt.dll including _initterm and _amsg_exit, indicating a compiled C/C++ binary built for Windows XP x86 (objchk_wxp_x86). The objchk directory name indicates this was built as a checked (debug) build, suggesting active development. Prefetch confirms execution from tdungan's Temp directory: /mnt/tdungan/WINDOWS/Prefetch/A.EXE-0FBE37C1.pf, Modify timestamp 2012-04-04 14:01:42 — ten seconds after the binary was written, again confirming near-immediate execution.
The identical binary (same MD5 c4b0458c04abdaa773348c2668212b45) was deployed to three additional user accounts:
/mnt/tdungan/Documents and Settings/RSydow/Local Settings/Temp/a.exe — Modify 2012-04-04 12:23:14, Access 2012-04-05 06:03:19. Prefetch: /mnt/tdungan/WINDOWS/Prefetch/A.EXE-0F3A0E12.pf, Modify 2012-04-04 12:22:42./mnt/tdungan/Documents and Settings/vibranium/Local Settings/Temp/a.exe — Modify 2012-04-05 13:28:01, Access 2012-04-06 05:05:23. Prefetch: /mnt/tdungan/WINDOWS/Prefetch/A.EXE-2E0C27A0.pf, Modify 2012-04-05 13:28:11./mnt/tdungan/Documents and Settings/SRL-Helpdesk/Local Settings/Temp/a.exe — Modify and Access both 2012-04-07 02:43:11. Prefetch: /mnt/tdungan/WINDOWS/Prefetch/A.EXE-239305EA.pf, Modify 2012-04-07 02:41:33.Notably, RSydow's copy was written before tdungan's copy (12:23 vs 14:01 on April 4), suggesting the attacker moved laterally to RSydow first, then re-deployed to tdungan. The four distinct Prefetch hashes for A.EXE (differing hash suffixes indicate different execution paths/directories) confirm the binary was run from four separate user Temp directories.
qsonhs ASPX RequestsThe IE cache at /mnt/tdungan/Documents and Settings/tdungan/Local Settings/Temporary Internet Files/Content.IE5/GLABKD23/ and GLAV89E7/ contains ten cached copies of qsonhs[N].aspx (numbered 1 through 7 in GLABKD23, 1 through 3 in GLAV89E7). The filename qsonhs is a randomly-named ASPX endpoint, consistent with C2 polling over HTTP/HTTPS. This is directly corroborated by the PDB path in a.exe which identifies the implant as httppump — an HTTP-based communication pump. The cache also contains GRedirect[1].aspx and ShowMessage[1].aspx in the same directory, further suggesting server-side C2 infrastructure. The PHP/5.1.6 server header found in the index.dat cache confirms the C2 server was running PHP 5.1.6, and multiple cached .php files (v6[1].php, 3176_US[1].php, first_degree[1].php, st[1].php) corroborate active HTTP C2 polling sessions originating from the tdungan session.
vibranium AccountThe vibranium user account is a local account (confirmed present in the SAM hive strings alongside Administrator, SRL-Helpdesk) that accessed sensitive research documents stored in tdungan's profile. Three LNK files recovered from /mnt/tdungan/Documents and Settings/vibranium/Recent/ and /mnt/tdungan/Documents and Settings/vibranium/Application Data/Microsoft/Office/Recent/ prove document access:
/mnt/tdungan/Documents and Settings/vibranium/Recent/Detailed Vibranium R&D Documents.lnk — Modify 2012-04-04 16:59:30, Inode 7835. Strings within the LNK resolve the target as `C:\Documents and Settings\tdungan\My Documents\Alloy Research\Detailed Vibranium R&D DocumeFile: /mnt/tdungan/Documents and Settings/RSydow/Local Settings/Temp/a.exe Size: 9216 Blocks: 24 IO Block: 4096 regular file Device: 7,10 Inode: 5366 Links: 1 Access: (0777/-rwxrwxrwx) Uid: ( 0/ root) Gid: ( 0/ root) Access: 2012-04-05 06:03:19.073928200 +0000 Modify: 2012-04-04 12:23:14.079286900 +0000 Change: 2012-04-04 12:23:14.079286900 +0000 Birth: -
File: /mnt/tdungan/Documents and Settings/SRL-Helpdesk/Local Settings/Temp/a.exe Size: 9216 Blocks: 24 IO Block: 4096 regular file Device: 7,10 Inode: 7372 Links: 1 Access: (0777/-rwxrwxrwx) Uid: ( 0/ root) Gid: ( 0/ root) Access: 2012-04-07 02:43:11.834171400 +0000 Modify: 2012-04-07 02:43:11.834171400 +0000 Change: 2012-04-07 02:43:11.834171400 +0000 Birth: -
File: /mnt/tdungan/Documents and Settings/tdungan/Local Settings/Temp/a.exe Size: 9216 Blocks: 24 IO Block: 4096 regular file Device: 7,10 Inode: 3108 Links: 1 Access: (0777/-rwxrwxrwx) Uid: ( 0/ root) Gid: ( 0/ root) Access: 2012-04-05 05:36:30.597045400 +0000 Modify: 2012-04-04 14:01:32.805830700 +0000 Change: 2012-04-04 14:01:32.805830700 +0000 Birth: -
File: /mnt/tdungan/Documents and Settings/tdungan/Local Settings/Temp/pkxezy1tji98.exe Size: 32768 Blocks: 64 IO Block: 4096 regular file Device: 7,10 Inode: 3019 Links: 2 Access: (0777/-rwxrwxrwx) Uid: ( 0/ root) Gid: ( 0/ root) Access: 2012-04-05 05:36:36.766194900 +0000 Modify: 2012-04-03 00:33:15.614468000 +0000 Change: 2012-04-03 00:33:15.614468000 +0000 Birth: -
File: /mnt/tdungan/Documents and Settings/vibranium/Local Settings/Temp/a.exe Size: 9216 Blocks: 24 IO Block: 4096 regular file Device: 7,10 Inode: 7736 Links: 1 Access: (0777/-rwxrwxrwx) Uid: ( 0/ root) Gid: ( 0/ root) Access: 2012-04-06 05:05:23.391954600 +0000 Modify: 2012-04-05 13:28:01.360678600 +0000 Change: 2012-04-05 13:28:01.360678600 +0000 Birth: -
{
"file": "/mnt/tdungan/Documents and Settings/RSydow/Local Settings/Temp/a.exe",
"algorithm": "md5",
"hash": "c4b0458c04abdaa773348c2668212b45"
}
{
"file": "/mnt/tdungan/Documents and Settings/tdungan/Local Settings/Temp/a.exe",
"algorithm": "md5",
"hash": "c4b0458c04abdaa773348c2668212b45"
}
{
"file": "/mnt/tdungan/Documents and Settings/vibranium/Local Settings/Temp/a.exe",
"algorithm": "md5",
"hash": "c4b0458c04abdaa773348c2668212b45"
}
{
"file": "/mnt/tdungan/Documents and Settings/tdungan/Local Settings/Temp/pkxezy1tji98.exe",
"algorithm": "md5",
"hash": "7a0fcd15ee1c2d9d196ab6515adf2f87"
}
{
"file": "/mnt/tdungan/Documents and Settings/SRL-Helpdesk/Local Settings/Temp/a.exe",
"algorithm": "md5",
"hash": "c4b0458c04abdaa773348c2668212b45"
}
!This program cannot be run in DOS mode.
RichO
.text
`.data
.reloc
SetUnhandledExceptionFilter
kernel32.dll
('8PW
700PP
```hhh
xppwpp
RSDS
c:\code\httppump\inner\objchk_wxp_x86\i386\i.pdb
Y_^[
URPQQh(
L$,3
UVWS
[_^]
SVWj
_^[]
8csm
8csm
_^[]
Y__^[
t?!E
v N+D$
UQPXY]Y[
WriteProcessMemory
GetCurrentProcess
GetProcAddress
LoadLibraryA
ExitThread
VirtualAlloc
ExitProcess
CloseHandle
WaitForSingleObject
CreateThread
SetErrorMode
SetUnhandledExceptionFilter
KERNEL32.dll
__getmainargs
_cexit
_exit
_XcptFilter
exit
_initterm
_amsg_exit
__setusermatherr
__p__commode
__p__fmode
__set_app_type
msvcrt.dll
?terminate@@YAXXZ
_controlfp
InterlockedExchange
Sleep
InterlockedCompareExchange
RtlUnwind
GetModuleHandleA
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
UnhandledExceptionFilter
_oB&3! vK#Nr
V\3%
kU'9
HMXB
?Zd;
?/L[
S;uD
z?aUY
D?$?
U>c{
zc%C1
.:3q
-64OS
NKeb
!This program cannot be run in DOS mode. Richc .text `.rdata @.data .rsrc @.reloc h0a@ h a@ uTVWh}#@ j hpx@ hHa@ t!Ht PPPPP hPa@ h8y@ Y;=h WhPa@ hta@ hla@ 5\`@ 5H`@ =H`@ h`y@ _^[] Y_^[ Y_^[ Y__^[ 9csm hTk@ h$k@ PPPPP <v*V ^SSSSS 8csm t?VSP Y[_^ PPPPP >"u& < tK< tG wf93t f90u f90u VVV+ @PSVV t*VV j@j ^V SWf9M j@j u,9E 5d`@ _^[] 5p`@ Y_^[] Fpt" Fh=p =d`@ URPQQh`B@ L$,3 UVWS [_^] SVWj _^[] 5H`@ hxo@ _^[] t'Ou woVW oV f o^0f of@f onPf ov`f o~pf FGIu X^_] FGIu v4;5 vL;5 9]$u
/mnt/tdungan/WINDOWS/Prefetch/A.EXE-0F3A0E12.pf /mnt/tdungan/WINDOWS/Prefetch/A.EXE-0FBE37C1.pf /mnt/tdungan/WINDOWS/Prefetch/A.EXE-239305EA.pf /mnt/tdungan/WINDOWS/Prefetch/A.EXE-2E0C27A0.pf /mnt/tdungan/WINDOWS/Prefetch/PKXEZY1TJI98.EXE-0BCBF29B.pf
File: /mnt/tdungan/Documents and Settings/tdungan/Local Settings/Temp/ose00000.exe Size: 145184 Blocks: 288 IO Block: 4096 regular file Device: 7,10 Inode: 11722 Links: 1 Access: (0777/-rwxrwxrwx) Uid: ( 0/ root) Gid: ( 0/ root) Access: 2012-04-05 05:36:36.797431100 +0000 Modify: 2006-10-28 06:30:09.662000000 +0000 Change: 2006-10-28 06:30:09.662000000 +0000 Birth: - !This program cannot be run in DOS mode. Rich .text `.data .rsrc @.reloc -8R<3 [_8@ Shutting down, timed out after %d ticks 0FDIDestroy FDIIsCabinet FDICopy FDICreate 0Resource VerifyFile CRC failure. Actual: %S Expected: %S /WW. 0opened cache file: %S Writer ExecuteVerify CRC failure. Actual: %S Expected: %S completed cached file: %S %s%S%05d.%S --- logging level: %s --- none standard verbose debug Executable: %S v%d.%d.%d.%d Computer : %S === Logging started: %S === unknown === Logging stopped: %S === 0bad allocation 0CorExitProcess mscoree.dll runtime error TLOSS error SING error DOMAIN error R6034 An application has made an attempt to load the C runtime library incorrectly. Please contact the application's support team for more information. R6033
SCCA
SCCA
SCCA
SCCA LMEM
SCCA
File: /mnt/tdungan/WINDOWS/Prefetch/A.EXE-0F3A0E12.pf Size: 6786 Blocks: 16 IO Block: 4096 regular file Device: 7,10 Inode: 5369 Links: 2 Access: (0777/-rwxrwxrwx) Uid: ( 0/ root) Gid: ( 0/ root) Access: 2012-04-05 05:18:07.178280400 +0000 Modify: 2012-04-04 12:22:42.078535500 +0000 Change: 2012-04-04 12:22:42.078535500 +0000 Birth: - File: /mnt/tdungan/WINDOWS/Prefetch/A.EXE-0FBE37C1.pf Size: 6794 Blocks: 16 IO Block: 4096 regular file Device: 7,10 Inode: 3110 Links: 2 Access: (0777/-rwxrwxrwx) Uid: ( 0/ root) Gid: ( 0/ root) Access: 2012-04-05 05:18:07.209516600 +0000 Modify: 2012-04-04 14:01:42.868523900 +0000 Change: 2012-04-04 14:01:42.868523900 +0000 Birth: - File: /mnt/tdungan/WINDOWS/Prefetch/A.EXE-239305EA.pf Size: 6802 Blocks: 16 IO Block: 4096 regular file Device: 7,10 Inode: 7374 Links: 2 Access: (0777/-rwxrwxrwx) Uid: ( 0/ root) Gid: ( 0/ root) Access: 2012-04-07 02:41:33.375147400 +0000 Modify: 2012-04-07 02:41:33.375147400 +0000 Change: 2012-04-07 02:41:33.375147400 +0000 Birth: - File: /mnt/tdungan/WINDOWS/Prefetch/A.EXE-2E0C27A0.pf Size: 6802 Blocks: 16 IO Block: 4096 regular file Device: 7,10 Inode: 7759 Links: 2 Access: (0777/-rwxrwxrwx) Uid: ( 0/ root) Gid: ( 0/ root) Access: 2012-04-06 05:04:05.025627900 +0000 Modify: 2012-04-05 13:28:11.421311000 +0000 Change: 2012-04-05 13:28:11.421311000 +0000 Birth: - File: /mnt/tdungan/WINDOWS/Prefetch/PKXEZY1TJI98.EXE-0BCBF29B.pf Size: 6792 Blocks: 16 IO Block: 4096 regular file Device: 7,10 Inode: 3005 Links: 2 Access: (0777/-rwxrwxrwx) Uid: ( 0/ root) Gid: ( 0/ root) Access: 2012-04-05 05:18:12.472816300 +0000 Modify: 2012-04-03 00:33:27.287388800 +0000 Change: 2012-04-03 00:33:27.287388800 +0000 Birth: -
----------------------------------------
----------------------------------------
ERROR: Command blocked — redirection: write target '/dev/null;' resolves outside reports/ (resolved: /dev/null;)
ERROR: Command blocked — redirection: write target '/dev/null;' resolves outside reports/ (resolved: /dev/null;)
----------------------------------------
----------------------------------------
----------------------------------------
----------------------------------------
----------------------------------------
Administrators Administrator SRL-Helpdesk vibranium
----------------------------------------
----------------------------------------
----------------------------------------
----------------------------------------
/mnt/tdungan/WINDOWS/system32/config/software{5decb2f3-95d5-11e0-aa3f-005056c00008}.TM.blf
/mnt/tdungan/WINDOWS/system32/config/AppEvent.Evt
/mnt/tdungan/WINDOWS/system32/config/default
/mnt/tdungan/WINDOWS/system32/config/default.LOG
/mnt/tdungan/WINDOWS/system32/config/default.sav
/mnt/tdungan/WINDOWS/system32/config/Internet.evt
/mnt/tdungan/WINDOWS/system32/config/netlogon.ftl
/mnt/tdungan/WINDOWS/system32/config/ODiag.evt
/mnt/tdungan/WINDOWS/system32/config/OSession.evt
/mnt/tdungan/WINDOWS/system32/config/SAM
/mnt/tdungan/WINDOWS/system32/config/SAM.LOG
/mnt/tdungan/WINDOWS/system32/config/SecEvent.Evt
/mnt/tdungan/WINDOWS/system32/config/SECURITY
/mnt/tdungan/WINDOWS/system32/config/SECURITY.LOG
/mnt/tdungan/WINDOWS/system32/config/software
/mnt/tdungan/WINDOWS/system32/config/software.LOG
/mnt/tdungan/WINDOWS/system32/config/SOFTWARE.LOG1
/mnt/tdungan/WINDOWS/system32/config/SOFTWARE.LOG2
/mnt/tdungan/WINDOWS/system32/config/software.sav
/mnt/tdungan/WINDOWS/system32/config/software{5decb2f3-95d5-11e0-aa3f-005056c00008}.TMContainer00000000000000000001.regtrans-ms
/mnt/tdungan/WINDOWS/system32/config/AppEvent.Evt /mnt/tdungan/WINDOWS/system32/config/default /mnt/tdungan/WINDOWS/system32/config/Internet.evt /mnt/tdungan/WINDOWS/system32/config/netlogon.ftl /mnt/tdungan/WINDOWS/system32/config/ODiag.evt /mnt/tdungan/WINDOWS/system32/config/OSession.evt /mnt/tdungan/WINDOWS/system32/config/SAM /mnt/tdungan/WINDOWS/system32/config/SecEvent.Evt /mnt/tdungan/WINDOWS/system32/config/SECURITY /mnt/tdungan/WINDOWS/system32/config/software /mnt/tdungan/WINDOWS/system32/config/SysEvent.Evt /mnt/tdungan/WINDOWS/system32/config/system /mnt/tdungan/WINDOWS/system32/config/systemprofile/Application Data/desktop.ini /mnt/tdungan/WINDOWS/system32/config/systemprofile/Application Data/Microsoft/CryptnetUrlCache/Content/12236C41CDDF9E40BA5606CDF086B821 /mnt/tdungan/WINDOWS/system32/config/systemprofile/Application Data/Microsoft/CryptnetUrlCache/Content/2BF68F4714092295550497DD56F57004 /mnt/tdungan/WINDOWS/system32/config/systemprofile/Application Data/Microsoft/CryptnetUrlCache/Content/303572DF538EDD8B1D606185F1D559B8 /mnt/tdungan/WINDOWS/system32/config/systemprofile/Application Data/Microsoft/CryptnetUrlCache/Content/486CC6AFD08942336C61FCD401C4A1D1 /mnt/tdungan/WINDOWS/system32/config/systemprofile/Application Data/Microsoft/CryptnetUrlCache/Content/60E31627FDA0A46932B0E5948949F2A5 /mnt/tdungan/WINDOWS/system32/config/systemprofile/Application Data/Microsoft/CryptnetUrlCache/Content/74BFD122C0875EC75DBE5C6DB4C59019 /mnt/tdungan/WINDOWS/system32/config/systemprofile/Application Data/Microsoft/CryptnetUrlCache/Content/79841F8EF00FBA86D33CC5A47696F165
ERROR: Command blocked — redirection: write target '/dev/null;' resolves outside reports/ (resolved: /dev/null;)
----------------------------------------
----------------------------------------
----------------------------------------
WaitToKillServiceTimeout dDSystemStartOptionsd Installed Services0 Default Service Service Service Service Service Servicef Service Service StartupDelay Service Service Service Service Service Service iServicei Service Service Service iServicei Service Service Service Service Service Service Service Service Service Service Service iServicei Service Service Service Service Service Start Service Service' Service Service Service Service Service Service iServicei
shellex ShellEx9 ShellEx1 ShellEx2 ShellNew ShellNew ShellNew ShellNew ShellNew ShellNew ShellEx ShellNew ShellNew ShellEx? ShellEx ShellEx6 ShellNew ShellNew ShellNew ShellNew ShellEx ShellNew ShellNew ShellNew ShellNew ShellEx4 ShellNew ShellNew ShellNew ShellNew ShellNew ShellNew ShellNew shell shellex shellex shell shellexN shellexP shell Run As Run As shell shell shell netshell.dll shell shell32.dll shell shell
EvtxECmd version 1.5.2.0 Author: Eric Zimmerman (saericzimmerman@gmail.com) https://github.com/EricZimmerman/evtx Command line: -f /mnt/tdungan/WINDOWS/system32/config/SecEvent.Evt --csv /tmp/evtx_out --csvf sec_evtx.csv CSV output will be saved to /tmp/evtx_out/sec_evtx.csv Maps loaded: 453 Processing /mnt/tdungan/WINDOWS/system32/config/SecEvent.Evt... /mnt/tdungan/WINDOWS/system32/config/SecEvent.Evt is not an evtx file! Message: Invalid signature! Expected 'ElfFile' Skipping... Processed 0 files in 0.7123 seconds
{
"evtx_dir": "/mnt/tdungan/WINDOWS/system32/config",
"format": "csv",
"output_path": "/home/sansforensics/adversa/reports/system32-hayabusa.csv",
"line_count": 0,
"output": "",
"truncated": false
}
/mnt/tdungan/Documents and Settings/tdungan/NTUSER.DAT
/mnt/tdungan/Documents and Settings/Default User/NTUSER.DAT /mnt/tdungan/Documents and Settings/LocalService/NTUSER.DAT /mnt/tdungan/Documents and Settings/NetworkService/NTUSER.DAT /mnt/tdungan/Documents and Settings/RSydow/NTUSER.DAT /mnt/tdungan/Documents and Settings/SRL-Helpdesk/NTUSER.DAT /mnt/tdungan/Documents and Settings/tdungan/NTUSER.DAT /mnt/tdungan/Documents and Settings/vibranium/NTUSER.DAT
----------------------------------------
----------------------------------------
----------------------------------------
----------------------------------------
----------------------------------------
SCRNSAVE.EXE(z y3ShowCmd mExePath ParseAutoexec CheckExeSignatures1 enShowCmd CmdMapping CmdMhbin ShowCmd ShowCmd ShowCmd ShowCmd ShowCmd msimn.exe msmsgs.exe "C:\PROGRA~1\WINDOW~2\wmplayer.exe"yer\w C:\PROGRA~1\WINDOW~2\wmplayer.exe:\Progr ShowCmd 2\Description.exe,X CmdBarData ShowCmde .exe CmdMapping CmdM ShowCmd ShowCmd @C:\WINDOWS\inf\unregmp2.exe,-4 ShowCmd ShowCmd ctfmon.exee @C:\WINDOWS\inf\unregmp2.exe,-4 @C:\WINDOWS\system32\tourstart.exe,-1 @C:\WINDOWS\system32\oobe\msoobe.exe,-2000 @C:\WINDOWS\system32\usmt\migwiz.exe,-202 @C:\WINDOWS\system32\restore\rstrui.exe,-2048 @C:\WINDOWS\system32\mshearts.exe,-413 @C:\WINDOWS\system32\spider.exe,-56 ShowCmd ShowCmd @explorer.exe,-7005
SCRNSAVE.EXE(z
mExePath
ParseAutoexec
OG"C:\PROGRA~1\WINDOW~2\wmplayer.exe"1212
C:\PROGRA~1\WINDOW~2\wmplayer.exe
"C:\Program Files\Windows Media Player\wmplayer.exe"
C:\Program Files\Windows Media Player\wmplayer.exe
{2559A1F0-21D7-11D4-BDAF-00C04F60B9F0} {000214E8-0000-0000-C000-000000000046} 0x401llExe
ShowCmdf
ShowCmd
ShowCmd
ShowCmd
ShowCmd
ctfmon.exe
CmdMapping
CmdM
ShowCmd
PsExec
@C:\Program Files\NetMeeting\conf.exe,-12345
@C:\WINDOWS\inf\unregmp2.exe,-9910
@C:\WINDOWS\system32\accwiz.exe,-16
@C:\WINDOWS\inf\unregmp2.exe,-9909
@C:\WINDOWS\inf\unregmp2.exe,-9905
@C:\WINDOWS\inf\unregmp2.exe,-9904
@C:\WINDOWS\System32\ntbackup.exe,-40
@C:\WINDOWS\inf\unregmp2.exe,-9918
C:\Program Files\Google\Update\GoogleUpdate.exe
@C:\Program Files\NetMeeting\conf.exe,-12346
@C:\WINDOWS\system32\notepad.exe,-469
@C:\WINDOWS\inf\unregmp2.exe,-9927
@C:\WINDOWS\system32\mshta.exe.mui,-6412
@C:\Program Files\NetMeeting\conf.exe,-12347
@C:\WINDOWS\inf\unregmp2.exe,-10003
@C:\WINDOWS\inf\unregmp2.exe,-10002
@C:\WINDOWS\inf\unregmp2.exe,-9907
@C:\WINDOWS\inf\unregmp2.exe,-9908
@C:\WINDOWS\inf\unregmp2.exe,-9911
@C:\WINDOWS\inf\unregmp2.exe,-9912
@C:\WINDOWS\inf\unregmp2.exe,-9915
@C:\WINDOWS\inf\unregmp2.exe,-9914
/mnt/tdungan/Documents and Settings/All Users/Desktop/Adobe Reader 9.lnk /mnt/tdungan/Documents and Settings/All Users/Desktop/Google Chrome.lnk /mnt/tdungan/Documents and Settings/All Users/Desktop/Mozilla Firefox.lnk /mnt/tdungan/Documents and Settings/All Users/Desktop/Paragon Partition Manager™ 11 Personal.lnk /mnt/tdungan/Documents and Settings/All Users/Desktop/QuickTime Player.lnk /mnt/tdungan/Documents and Settings/All Users/Desktop/Skype.lnk /mnt/tdungan/Documents and Settings/All Users/Start Menu/Programs/7-Zip/7-Zip File Manager.lnk /mnt/tdungan/Documents and Settings/All Users/Start Menu/Programs/7-Zip/7-Zip Help.lnk /mnt/tdungan/Documents and Settings/All Users/Start Menu/Programs/Accessories/Accessibility/Accessibility Wizard.lnk /mnt/tdungan/Documents and Settings/All Users/Start Menu/Programs/Accessories/Calculator.lnk /mnt/tdungan/Documents and Settings/All Users/Start Menu/Programs/Accessories/Communications/HyperTerminal.lnk /mnt/tdungan/Documents and Settings/All Users/Start Menu/Programs/Accessories/Communications/Network Connections.lnk /mnt/tdungan/Documents and Settings/All Users/Start Menu/Programs/Accessories/Communications/Network Setup Wizard.lnk /mnt/tdungan/Documents and Settings/All Users/Start Menu/Programs/Accessories/Communications/New Connection Wizard.lnk /mnt/tdungan/Documents and Settings/All Users/Start Menu/Programs/Accessories/Communications/Wireless Network Setup Wizard.lnk /mnt/tdungan/Documents and Settings/All Users/Start Menu/Programs/Accessories/Entertainment/Sound Recorder.lnk /mnt/tdungan/Documents and Settings/All Users/Start Menu/Programs/Accessories/Entertainment/Volume Control.lnk /mnt/tdungan/Documents and Settings/All Users/Start Menu/Programs/Accessories/Paint.lnk /mnt/tdungan/Documents and Settings/All Users/Start Menu/Programs/Accessories/Remote Desktop Connection.lnk /mnt/tdungan/Documents and Settings/All Users/Start Menu/Programs/Accessories/System Tools/Activate Windows.lnk /mnt/tdungan/Documents and Settings/All Users/Start Menu/Programs/Accessories/System Tools/Backup.lnk /mnt/tdungan/Documents and Settings/All Users/Start Menu/Programs/Accessories/System Tools/Character Map.lnk /mnt/tdungan/Documents and Settings/All Users/Start Menu/Programs/Accessories/System Tools/Disk Cleanup.lnk /mnt/tdungan/Documents and Settings/All Users/Start Menu/Programs/Accessories/System Tools/Disk Defragmenter.lnk /mnt/tdungan/Documents and Settings/All Users/Start Menu/Programs/Accessories/System Tools/Files and Settings Transfer Wizard.lnk /mnt/tdungan/Documents and Settings/All Users/Start Menu/Programs/Accessories/System Tools/Scheduled Tasks.lnk /mnt/tdungan/Documents and Settings/All Users/Start Menu/Programs/Accessories/System Tools/System Information.lnk /mnt/tdungan/Documents and Settings/All Users/Start Menu/Programs/Accessories/System Tools/System Restore.lnk /mnt/tdungan/Documents and Settings/All Users/Start Menu/Programs/Accessories/Windows Movie Maker.lnk /mnt/tdungan/Documents and Setti
PsExec @C:\WINDOWS\system32\mshta.exe.mui,-6412
/mnt/tdungan/Documents and Settings/vibranium/Application Data/Microsoft/Internet Explorer/Quick Launch/Launch Internet Explorer Browser.lnk /mnt/tdungan/Documents and Settings/vibranium/Application Data/Microsoft/Internet Explorer/Quick Launch/Microsoft Office Outlook.lnk /mnt/tdungan/Documents and Settings/vibranium/Application Data/Microsoft/Office/Recent/Detailed Vibranium R&D Documents.LNK /mnt/tdungan/Documents and Settings/vibranium/Application Data/Microsoft/Office/Recent/Dossier - Dr Myron MacLain.LNK /mnt/tdungan/Documents and Settings/vibranium/Application Data/Microsoft/Office/Recent/Metal Alloy List Research.LNK /mnt/tdungan/Documents and Settings/vibranium/Application Data/Microsoft/Office/Recent/SUCCESS-TEST-PLAN-VIBRANIUM-ALLOY-RESULTS.LNK /mnt/tdungan/Documents and Settings/vibranium/Application Data/Microsoft/Office/Recent/Templates.LNK /mnt/tdungan/Documents and Settings/vibranium/My Documents/My Music/Sample Music.lnk /mnt/tdungan/Documents and Settings/vibranium/My Documents/My Pictures/Sample Pictures.lnk /mnt/tdungan/Documents and Settings/vibranium/Recent/Detailed Vibranium R&D Documents.lnk /mnt/tdungan/Documents and Settings/vibranium/Recent/Dossier - Dr Myron MacLain.lnk /mnt/tdungan/Documents and Settings/vibranium/Recent/Metal Alloy List Research.lnk /mnt/tdungan/Documents and Settings/vibranium/Recent/SUCCESS-TEST-PLAN-VIBRANIUM-ALLOY-RESULTS.lnk /mnt/tdungan/Documents and Settings/vibranium/Start Menu/Programs/Accessories/Accessibility/Magnifier.lnk /mnt/tdungan/Documents and Settings/vibranium/Start Menu/Programs/Accessories/Accessibility/Narrator.lnk /mnt/tdungan/Documents and Settings/vibranium/Start Menu/Programs/Accessories/Accessibility/On-Screen Keyboard.lnk /mnt/tdungan/Documents and Settings/vibranium/Start Menu/Programs/Accessories/Accessibility/Utility Manager.lnk /mnt/tdungan/Documents and Settings/vibranium/Start Menu/Programs/Accessories/Address Book.lnk /mnt/tdungan/Documents and Settings/vibranium/Start Menu/Programs/Accessories/Command Prompt.lnk /mnt/tdungan/Documents and Settings/vibranium/Start Menu/Programs/Accessories/Entertainment/Windows Media Player.lnk
File: /mnt/tdungan/Documents and Settings/vibranium/Recent/Detailed Vibranium R&D Documents.lnk Size: 954 Blocks: 8 IO Block: 4096 regular file Device: 7,10 Inode: 7835 Links: 2 Access: (0777/-rwxrwxrwx) Uid: ( 0/ root) Gid: ( 0/ root) Access: 2012-04-05 05:39:51.383339000 +0000 Modify: 2012-04-04 16:59:30.867111600 +0000 Change: 2012-04-04 16:59:30.867111600 +0000 Birth: - File: /mnt/tdungan/Documents and Settings/vibranium/Recent/SUCCESS-TEST-PLAN-VIBRANIUM-ALLOY-RESULTS.lnk Size: 1429 Blocks: 8 IO Block: 4096 regular file Device: 7,10 Inode: 7763 Links: 2 Access: (0777/-rwxrwxrwx) Uid: ( 0/ root) Gid: ( 0/ root) Access: 2012-04-05 05:39:51.523901900 +0000 Modify: 2012-04-04 16:59:30.677430000 +0000 Change: 2012-04-04 16:59:30.677430000 +0000 Birth: - File: /mnt/tdungan/Documents and Settings/vibranium/Recent/Dossier - Dr Myron MacLain.lnk Size: 1354 Blocks: 8 IO Block: 4096 regular file Device: 7,10 Inode: 7929 Links: 2 Access: (0777/-rwxrwxrwx) Uid: ( 0/ root) Gid: ( 0/ root) Access: 2012-04-05 05:39:51.383339000 +0000 Modify: 2012-04-04 16:52:06.210919800 +0000 Change: 2012-04-04 16:52:06.210919800 +0000 Birth: -
/C:\ DOCUME~1 tdungan MYDOCU~1 ALLOYR~1 DETAIL~1 C:\Documents and Settings\tdungan\My Documents\Alloy Research\Detailed Vibranium R&D Documents wks-winxp32bit
/C:\ DOCUME~1 tdungan MYDOCU~1 ALLOYR~1 DETAIL~1 SUCCES~1.DOC C:\Documents and Settings\tdungan\My Documents\Alloy Research\Detailed Vibranium R&D Documents\SUCCESS-TEST-PLAN-VIBRANIUM-ALLOY-RESULTS.docx wks-winxp32bit
BzcTx /C:\ DOCUME~1 tdungan MYDOCU~1 ALLOYR~1 DETAIL~1 DOSSIE~1.DOC C:\Documents and Settings\tdungan\My Documents\Alloy Research\Detailed Vibranium R&D Documents\Dossier - Dr Myron MacLain.docx wks-winxp32bit
/mnt/tdungan/Documents and Settings/tdungan/My Documents/Alloy Research/Additional Information/psych_pubs_and_presents_2010.docx /mnt/tdungan/Documents and Settings/tdungan/My Documents/Alloy Research/Additional Information/AbolishDUWeaponryAug102005.doc /mnt/tdungan/Documents and Settings/tdungan/My Documents/Alloy Research/Additional Information/barlat papers.docx /mnt/tdungan/Documents and Settings/tdungan/My Documents/Alloy Research/Additional Information/CAPTAIN+AMERICA+Character+Card+Translation+Esp-Eng.doc /mnt/tdungan/Documents and Settings/tdungan/My Documents/Alloy Research/Additional Information/historyofpeters.ppt /mnt/tdungan/Documents and Settings/tdungan/My Documents/Alloy Research/Additional Information/matrestable.xls /mnt/tdungan/Documents and Settings/tdungan/My Documents/Alloy Research/Additional Information/perm2.xls /mnt/tdungan/Documents and Settings/tdungan/My Documents/Alloy Research/Additional Information/pic1_2007828144313.doc /mnt/tdungan/Documents and Settings/tdungan/My Documents/Alloy Research/Additional Information/Profile_MetalDusting9_06.pdf /mnt/tdungan/Documents and Settings/tdungan/My Documents/Alloy Research/Additional Information/StegmaierSupplementalData050516.xls /mnt/tdungan/Documents and Settings/tdungan/My Documents/Alloy Research/Additional Information/The Cold War and American Science.doc /mnt/tdungan/Documents and Settings/tdungan/My Documents/Alloy Research/Additional Information/The Jacks.doc /mnt/tdungan/Documents and Settings/tdungan/My Documents/Alloy Research/Additional Information/Training_Research_Checklist.pdf /mnt/tdungan/Documents and Settings/tdungan/My Documents/Alloy Research/Additional Information/War_games.doc /mnt/tdungan/Documents and Settings/tdungan/My Documents/Alloy Research/Detailed Vibranium R&D Documents/ADAMANTIUM-Background.docx /mnt/tdungan/Documents and Settings/tdungan/My Documents/Alloy Research/Detailed Vibranium R&D Documents/Dossier - Dr Myron MacLain.docx /mnt/tdungan/Documents and Settings/tdungan/My Documents/Alloy Research/Detailed Vibranium R&D Documents/Metal Alloy List Research.xlsx /mnt/tdungan/Documents and Settings/tdungan/My Documents/Alloy Research/Detailed Vibranium R&D Documents/Researched Sub-Atomic Particles.xlsx /mnt/tdungan/Documents and Settings/tdungan/My Documents/Alloy Research/Detailed Vibranium R&D Documents/SUCCESS-TEST-PLAN-VIBRANIUM-ALLOY-RESULTS.docx /mnt/tdungan/Documents and Settings/tdungan/My Documents/Alloy Research/Detailed Vibranium R&D Documents/The Shield Background and Ongoing Research.docx /mnt/tdungan/Documents and Settings/tdungan/My Documents/Alloy Research/Detailed Vibranium R&D Documents/Vibrainium(1).doc /mnt/tdungan/Documents and Settings/tdungan/My Documents/Alloy Research/Detailed Vibranium R&D Documents/Vibrainium.doc /mnt/tdungan/Documents and Settings/tdungan/My Documents/Alloy Research/Detailed Vibranium R&D Documents/VIBRANIUM.docx /mnt/tdungan/Documents and Settings/tdungan/My Documents/Alloy Research/Presentation
/mnt/tdungan/Documents and Settings/vibranium/My Documents/desktop.ini /mnt/tdungan/Documents and Settings/vibranium/My Documents/My Music/Desktop.ini /mnt/tdungan/Documents and Settings/vibranium/My Documents/My Music/Sample Music.lnk /mnt/tdungan/Documents and Settings/vibranium/My Documents/My Pictures/Desktop.ini /mnt/tdungan/Documents and Settings/vibranium/My Documents/My Pictures/Sample Pictures.lnk
/mnt/tdungan/Documents and Settings/tdungan/Local Settings/Temporary Internet Files/Content.IE5/GLAV89E7/Firefox%20Setup%206.0[1].exe /mnt/tdungan/Documents and Settings/tdungan/Local Settings/Temporary Internet Files/Content.IE5/O52ZG5AZ/IE8-WindowsXP-x86-ENU[1].exe
/mnt/tdungan/Documents and Settings/tdungan/Local Settings/Temporary Internet Files/Content.IE5/GLABKD23/search[1].php /mnt/tdungan/Documents and Settings/tdungan/Local Settings/Temporary Internet Files/Content.IE5/GLABKD23/xd_proxy[1].php /mnt/tdungan/Documents and Settings/tdungan/Local Settings/Temporary Internet Files/Content.IE5/GLABKD23/first_degree[1].php /mnt/tdungan/Documents and Settings/tdungan/Local Settings/Temporary Internet Files/Content.IE5/GLABKD23/st[1].php /mnt/tdungan/Documents and Settings/tdungan/Local Settings/Temporary Internet Files/Content.IE5/GLABKD23/qsonhs[1].aspx /mnt/tdungan/Documents and Settings/tdungan/Local Settings/Temporary Internet Files/Content.IE5/GLABKD23/qsonhs[2].aspx /mnt/tdungan/Documents and Settings/tdungan/Local Settings/Temporary Internet Files/Content.IE5/GLABKD23/qsonhs[3].aspx /mnt/tdungan/Documents and Settings/tdungan/Local Settings/Temporary Internet Files/Content.IE5/GLABKD23/qsonhs[4].aspx /mnt/tdungan/Documents and Settings/tdungan/Local Settings/Temporary Internet Files/Content.IE5/GLABKD23/qsonhs[5].aspx /mnt/tdungan/Documents and Settings/tdungan/Local Settings/Temporary Internet Files/Content.IE5/GLABKD23/qsonhs[6].aspx /mnt/tdungan/Documents and Settings/tdungan/Local Settings/Temporary Internet Files/Content.IE5/GLABKD23/qsonhs[7].aspx /mnt/tdungan/Documents and Settings/tdungan/Local Settings/Temporary Internet Files/Content.IE5/GLABKD23/ShowMessage[1].aspx /mnt/tdungan/Documents and Settings/tdungan/Local Settings/Temporary Internet Files/Content.IE5/GLABKD23/v6[1].php /mnt/tdungan/Documents and Settings/tdungan/Local Settings/Temporary Internet Files/Content.IE5/GLABKD23/3176_US[1].php /mnt/tdungan/Documents and Settings/tdungan/Local Settings/Temporary Internet Files/Content.IE5/GLAV89E7/GRedirect[1].aspx /mnt/tdungan/Documents and Settings/tdungan/Local Settings/Temporary Internet Files/Content.IE5/GLAV89E7/Firefox%20Setup%206.0[1].exe /mnt/tdungan/Documents and Settings/tdungan/Local Settings/Temporary Internet Files/Content.IE5/GLAV89E7/qsonhs[1].aspx /mnt/tdungan/Documents and Settings/tdungan/Local Settings/Temporary Internet Files/Content.IE5/GLAV89E7/qsonhs[2].aspx /mnt/tdungan/Documents and Settings/tdungan/Local Settings/Temporary Internet Files/Content.IE5/GLAV89E7/qsonhs[3].aspx /mnt/tdungan/Documents and Settings/tdungan/Local Settings/Temporary Internet Files/Content.IE5/GLAV89E7/qsonhs[4].aspx
/mnt/tdungan/Documents and Settings/tdungan/Local Settings/History/desktop.ini /mnt/tdungan/Documents and Settings/tdungan/Local Settings/History/History.IE5/desktop.ini /mnt/tdungan/Documents and Settings/tdungan/Local Settings/History/History.IE5/index.dat /mnt/tdungan/Documents and Settings/tdungan/Local Settings/History/History.IE5/MSHist012012031220120319/index.dat /mnt/tdungan/Documents and Settings/tdungan/Local Settings/History/History.IE5/MSHist012012031920120326/index.dat /mnt/tdungan/Documents and Settings/tdungan/Local Settings/History/History.IE5/MSHist012012032620120402/index.dat /mnt/tdungan/Documents and Settings/tdungan/Local Settings/History/History.IE5/MSHist012012040220120403/index.dat /mnt/tdungan/Documents and Settings/tdungan/Local Settings/History/History.IE5/MSHist012012040320120404/index.dat
if(typeof sa_inst.apiCB == 'function') sa_inst.apiCB({"AS":{"Query":"du","FullResults":1,"Results":[{"Type":"VS","Suggests":[{"Txt":"du<strong>nhuang</strong> <strong>caves</strong>","Type":"IM","Sk":""},{"Txt":"du<strong>ct</strong> <strong>tape</strong> <strong>bandit</strong>","Type":"IM","Sk":"IM1"},{"Txt":"du<strong>nhuang</strong>","Type":"IM","Sk":"IM2"},{"Txt":"du<strong>bai</strong>","Type":"IM","Sk":"IM3"},{"Txt":"du<strong>ck</strong>","Type":"IM","Sk":"IM4"},{"Txt":"du<strong>lce</strong> <strong>maria</strong>","Type":"IM","Sk":"IM5"},{"Txt":"du<strong>a</strong> <strong>xe</strong> <strong>ban</strong> <strong>sung</strong>","Type":"IM","Sk":"IM6"},{"Txt":"du<strong>ck</strong> <strong>boat</strong> <strong>crash</strong>","Type":"IM","Sk":"IM7"}]}]}} /* pageview_candidate */);
Visited: tdungan@http://store.apple.com/1-800-MY-APPLE/WebObjects/ASRedirector.woa/wa/redirectQT/?country=US&language=en&productName=QuickTime7&operatingSystem=Windows&osVersion=05010300&qtVersion=07718000&cid=AOSA10000026883 Visited: tdungan@http://quicktimepro.apple.com/?country=US&language=en&productName=QuickTime7&operatingSystem=Windows&osVersion=05010300&qtVersion=07718000&cid=AOSA10000026883 Visited: tdungan@http://www.facebook.com/dialog/permissions.request Visited: tdungan@http://www.apple.com/quicktime/buy http://www.apple.com/favicon.ico Visited: TDungan@http://www.facebook.com/favicon.ico Visited: tdungan@https://www.facebook.com/connect/login_success.html?code=AQDu2EWHqdv8rZcscRnLBRRfgMot7vcgT5GCvBfdNU6R5Cx3fysmMixtuktYGRwCp77uG5IcrOGJNNRHlwHOx8G-o5BHpVUs5R57Cl-BQJ_cSyIy6OpYAJC4u1E8xTB6D2o1VS5axmb8mDkBxnGbYoVnxpOmRD6T2KKUsFdQldaAQ9uf6wInFYWPzTrKG6viLQY Visited: tdungan@http://www.apple.com/quicktime/extending http://www.apple.com/favicon.ico Visited: TDungan@http://www.facebook.com Visited: TDungan@http://www.bing.com/search?q=firefox&src=IE-SearchBox&FORM=IE8SRC&format=rss Visited: TDungan@http://www.firefox.com Visited: TDungan@http://www.bing.com/search?q=firefox&src=IE-SearchBox&FORM=IE8SRC http://www.bing.com/favicon.ico Visited: TDungan@http://www.mozilla.com/en-US/firefox/new http://www.mozilla.com/favicon.ico Visited: TDungan@http://www.mozilla.com/products/download.html?product=firefox-6.0&os=win&lang=en-US Visited: TDungan@http://www.bing.com/search?q=dum+dum+dungan&src=IE-SearchBox&FORM=IE8SRC&format=rss Visited: TDungan@http://marvel.com/downloads_and_extras Visited: TDungan@http://www.bing.com/search?q=chrome&src=IE-SearchBox&FORM=IE8SRC&format=rss Visited: TDungan@http://www.mozilla.com/en-US/products/download.html?product=firefox-6.0&os=win&lang=en-US http://www.mozilla.com/favicon.ico Visited: TDungan@http://www.bing.com/search?q=chrome&src=IE-SearchBox&FORM=IE8SRC http://www.bing.com/favicon.ico Visited: TDungan@http://www.google.com/chrome?hl=en&brand=CHFX&utm_campaign=en&utm_source=en-oa-na-us-bk-bng&utm_medium=oa http://www.google.com/favicon.ico Visited: TDungan@http://0.r.msn.com/?ld=4vLZQrTQy3wzW0s-93D2XiO56WGQNPG1Riu-aXjCgdeqSJVb2e17plK9ct1rBWypIt_zDmZVPof-4Ilci-7_6MnK60YRA8GotfEoiF3rMHuWTW9vg9jDZ4YVFSf9pYosr31m7Gy1wNoua6hmTKe88EkeCh8nDwEpp8jrypqGg20xMTOQ3RB_Hg5bI9U5NbWn9Uonojfgope6YcRWNwAyyCxPYDudoXnn1Ov5ocu38Z0XCoehDhvX78c0NWr8H8aaoiG7ztHv6zzLNLTFgUwJuFxOIN9Vuc7-dk8UmDg9S67I81VAlM1Dprqvz9LNpfH1cREvfirxAmY3M9CNeDt79IkUxfKf8n4qAm7GOInbtnkamKOETP9yMmAkc Visited: TDungan@http://www.google.com/chrome?hl=en&brand=CHFX&utm_campaign=en&utm_source=en-oa-na-us-bk-bng&utm_medium=oa http://www.google.com/favicon.ico Visited: TDungan@http://www.bing.com/images/search?q=dum+dum+dungan&FORM=BIFD http://www.bing.com/favicon.ico Visited: TDungan@http://marvel.com/wallpaper http://marvel.com/favicon.ico Visited: TDungan@http://mozilla.c3sl.ufpr.br/releases//firefox/releases/6.0/win32/en-US/Firefox%20Setup%206.0.exe Visited: T
/mnt/tdungan/Documents and Settings/tdungan/Local Settings/Temporary Internet Files/Content.IE5/index.dat
/mnt/tdungan/Documents and Settings/Default User/Cookies/index.dat /mnt/tdungan/Documents and Settings/Default User/IETldCache/index.dat /mnt/tdungan/Documents and Settings/Default User/Local Settings/History/History.IE5/index.dat /mnt/tdungan/Documents and Settings/Default User/Local Settings/Temporary Internet Files/Content.IE5/index.dat /mnt/tdungan/Documents and Settings/LocalService/Cookies/index.dat /mnt/tdungan/Documents and Settings/LocalService/IETldCache/index.dat /mnt/tdungan/Documents and Settings/LocalService/Local Settings/History/History.IE5/index.dat /mnt/tdungan/Documents and Settings/LocalService/Local Settings/Temporary Internet Files/Content.IE5/index.dat /mnt/tdungan/Documents and Settings/NetworkService/Cookies/index.dat /mnt/tdungan/Documents and Settings/NetworkService/IETldCache/index.dat
X-Powered-By: PHP/5.1.6 http://www.microsoft.com/downloads/details.aspx?FamilyId=049C9DBE-3B8E-4F30-8245-9E368D3CDB5A X-Powered-By: PHP/5.1.6 http://static.ak.fbcdn.net/rsrc.php/zk/r/LZ0Xo5BhCgI.css http://static.ak.fbcdn.net/rsrc.php/zS/r/bbJdm1uKaui.css http://b.static.ak.fbcdn.net/rsrc.php/zI/r/caqBMVrXfXc.css http://e.static.ak.fbcdn.net/rsrc.php/zN/r/67UAiXRCPCp.css http://b.static.ak.fbcdn.net/rsrc.php/zA/r/m5vC-jWmTKp.js http://e.static.ak.fbcdn.net/rsrc.php/zX/r/4PIot2bO7ET.jpg http://c.static.ak.fbcdn.net/rsrc.php/zf/r/hEY3FxDQu5L.png http://f.static.ak.fbcdn.net/rsrc.php/zb/r/GsNJNwuI-UM.gif http://d.static.ak.fbcdn.net/rsrc.php/zi/r/OBaVg52wtTZ.png http://b.static.ak.fbcdn.net/rsrc.php/zs/r/1HX6ENG455b.jpg http://e.static.ak.fbcdn.net/rsrc.php/z_/r/RDnrQQdvCeA.gif http://e.static.ak.fbcdn.net/rsrc.php/z7/r/u9PIFvXGGNt.js http://b.static.ak.fbcdn.net/rsrc.php/zu/r/l9C8kh5d9vH.js http://static.ak.fbcdn.net/rsrc.php/zj/r/jHFPq9ihU1z.js http://d.static.ak.fbcdn.net/rsrc.php/zD/r/HWL11JhzW9w.js http://c.microsoft.com/trans_pixel.aspx?tz=-6&ti=Internet%20Explorer%208%20Windows%207%20Security%20Features%20Malware%20Privacy&se=1&fi=1&fv=5.0&cnt=lan&ts=1289404931062&sr=800x600&bs=984x1254 http://download.microsoft.com/download/C/C/0/CC0BD555-33DD-411E-936B-73AC6F95AE11/IE8-WindowsXP-x86-ENU.exe IE8-WindowsXP-x86-ENU[1].exe http://www.microsoft.com/windows/internet-explorer/thank-you.aspx thank-you[1].aspx http://www.microsoft.com/windows/internet-explorer/thank-you.aspx http://www.microsoft.com/windows/internet-explorer/default.aspx http://c.microsoft.com/trans_pixel.aspx?tz=-6&ti=Internet%20Explorer%208%20download%20and%20installation%20instructions&fi=1&fv=5.0&cnt=lan&ts=1289404943734&sr=800x600&bs=984x1498 http://www.microsoft.com/downloads/en/details.aspx?FamilyId=049C9DBE-3B8E-4F30-8245-9E368D3CDB5A&displaylang=en details[1].aspx http://c.microsoft.com/trans_pixel.aspx?tz=-6&cs=1&ti=Download%20details%3A%20Windows%20XP%20Service%20Pack%202%20Network%20Installation%20Package%20for%20IT%20Professionals%20and%20Developers&se=1&fi=1&fv=5.0&cnt=lan&r=http%3A%2F%2Fwww.google.com%2Fsearch%3Fhl%3Den%26source%3Dhp%26q%3Ddownload%2Bxp%2Bservice%2Bpack%2B2%26aq%3Df%26aqi%3Dg8g-m2%26aql%3D%26oq%3D%26gs_rfai%3DCASOqTk_bTKrJJYHIzQSZ1tmjCwAAAKoEBU_Q4ENC&ts=1289405128000&sr=800x600&bs=934x1726&DCSext.dsplinkid=30-00-111SXX02957%3B30-00-111SXX02956%3B30-00-111SXX02958%3B46-bf41401e70fa465dae2ecf44dbf05297-112SXX04080%20%3B46-1d224714e2384e4586685166114010ca-112MXX03803%20%3B46-5A58B56F60B6441295B954D056D6F9F4-112SXX04013%20%3B46-46f72df1e46a4a5fa79109f07aaa1914-112MXX03833%20%3B40-00-111SXX02940%3B40-00-111SXX03017%3B40-00-111SXX03018%3B40-00-111SXX02938%3B40-00-111SXX02939%3B40-00-111SXX02942%3B40-00-111SXX02943%3B40-00-111SXX02941%3B46-049c9dbe3b8e4f3082459e368d3cdb5a-111SUS02857&DCSext.wt_target=en-US%3BGeneric%3BIE%206%3BWindows%20XP&WT.sp=_en_us_&DCSext.dsplc=en-us http://c.microsoft.com/trans_pixel.aspx?tz=-6&cs=1&ti=Download%20details%3A%20Windows%2
/mnt/tdungan/Documents and Settings/tdungan/Local Settings/Temporary Internet Files/Content.IE5/GLABKD23/qsonhs[1].aspx /mnt/tdungan/Documents and Settings/tdungan/Local Settings/Temporary Internet Files/Content.IE5/GLABKD23/qsonhs[2].aspx /mnt/tdungan/Documents and Settings/tdungan/Local Settings/Temporary Internet Files/Content.IE5/GLABKD23/qsonhs[3].aspx /mnt/tdungan/Documents and Settings/tdungan/Local Settings/Temporary Internet Files/Content.IE5/GLABKD23/qsonhs[4].aspx /mnt/tdungan/Documents and Settings/tdungan/Local Settings/Temporary Internet Files/Content.IE5/GLABKD23/qsonhs[5].aspx /mnt/tdungan/Documents and Settings/tdungan/Local Settings/Temporary Internet Files/Content.IE5/GLABKD23/qsonhs[6].aspx /mnt/tdungan/Documents and Settings/tdungan/Local Settings/Temporary Internet Files/Content.IE5/GLABKD23/qsonhs[7].aspx /mnt/tdungan/Documents and Settings/tdungan/Local Settings/Temporary Internet Files/Content.IE5/GLAV89E7/qsonhs[1].aspx /mnt/tdungan/Documents and Settings/tdungan/Local Settings/Temporary Internet Files/Content.IE5/GLAV89E7/qsonhs[2].aspx /mnt/tdungan/Documents and Settings/tdungan/Local Settings/Temporary Internet Files/Content.IE5/GLAV89E7/qsonhs[3].aspx
/mnt/tdungan/WINDOWS/system32/drivers/etc/hosts