alterMW3 Client Decompiled + Analysis
Had some spare time and Decompiled aiwmw3 client in C#... got it errorless with halp of @jariz ... also did some analysis of network and registry that is being edited .. this is could help guys who want to build their little tools or learn some code or smd
Client Info:
http://a.content.alteriw.net/iw5m//iw5m-client/info.xml
HTTP Debug:
Scans
aIW Client Decompiled.zip -
https://www.virustotal.com/file/113e...is/1328737077/
Code:
Analysis Reason: Primary Analysis Subject
Filename: alterMW3.e.exe
MD5: 1dd78280faf6ba82d0c56d1089623721
SHA-1: a18dfe9985263fd1d2cea4e1f618eba237190b24
File Size: 456704 Bytes
Process-status
at analysis end: alive
Exit Code: 0
[=============================================================================]
Load-time Dlls
[=============================================================================]
Module Name: [ C:\WINDOWS\system32\ntdll.dll ],
Base Address: [0x7C900000 ], Size: [0x000AF000 ]
Module Name: [ C:\WINDOWS\system32\mscoree.dll ],
Base Address: [0x79000000 ], Size: [0x0004A000 ]
Module Name: [ C:\WINDOWS\system32\KERNEL32.dll ],
Base Address: [0x7C800000 ], Size: [0x000F6000 ]
Module Name: [ C:\WINDOWS\system32\ADVAPI32.dll ],
Base Address: [0x77DD0000 ], Size: [0x0009B000 ]
Module Name: [ C:\WINDOWS\system32\RPCRT4.dll ],
Base Address: [0x77E70000 ], Size: [0x00092000 ]
Module Name: [ C:\WINDOWS\system32\Secur32.dll ],
Base Address: [0x77FE0000 ], Size: [0x00011000 ]
Module Name: [ C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll ],
Base Address: [0x603B0000 ], Size: [0x00066000 ]
Module Name: [ C:\WINDOWS\system32\SHLWAPI.dll ],
Base Address: [0x77F60000 ], Size: [0x00076000 ]
Module Name: [ C:\WINDOWS\system32\GDI32.dll ],
Base Address: [0x77F10000 ], Size: [0x00049000 ]
Module Name: [ C:\WINDOWS\system32\USER32.dll ],
Base Address: [0x7E410000 ], Size: [0x00091000 ]
Module Name: [ C:\WINDOWS\system32\msvcrt.dll ],
Base Address: [0x77C10000 ], Size: [0x00058000 ]
Module Name: [ C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll ],
Base Address: [0x79E70000 ], Size: [0x0058F000 ]
Module Name: [ C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.1433_x-ww_5cf844d2\MSVCR80.dll ],
Base Address: [0x78130000 ], Size: [0x0009B000 ]
Module Name: [ C:\WINDOWS\system32\shell32.dll ],
Base Address: [0x7C9C0000 ], Size: [0x00817000 ]
Module Name: [ C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83\comctl32.dll ],
Base Address: [0x773D0000 ], Size: [0x00103000 ]
Module Name: [ C:\WINDOWS\system32\comctl32.dll ],
Base Address: [0x5D090000 ], Size: [0x0009A000 ]
Module Name: [ C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\mscorlib\642534209e13d16e93b80a628742d2ee\mscorlib.ni.dll ],
Base Address: [0x790C0000 ], Size: [0x00B36000 ]
Module Name: [ C:\WINDOWS\system32\ole32.dll ],
Base Address: [0x774E0000 ], Size: [0x0013D000 ]
Module Name: [ C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorjit.dll ],
Base Address: [0x79060000 ], Size: [0x00056000 ]
Module Name: [ C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\culture.dll ],
Base Address: [0x60340000 ], Size: [0x00008000 ]
Module Name: [ C:\WINDOWS\system32\rsaenh.dll ],
Base Address: [0x68000000 ], Size: [0x00036000 ]
Module Name: [ C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System\36dbfcf62e07d819b3de533898868ecf\System.ni.dll ],
Base Address: [0x7A440000 ], Size: [0x007EA000 ]
Module Name: [ C:\WINDOWS\assembly\GAC_MSIL\System.Xml.Linq\3.5.0.0__b77a5c561934e089\System.Xml.Linq.dll ],
Base Address: [0x6D990000 ], Size: [0x00026000 ]
Module Name: [ C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Xml\139ba31a8024c79b1e1e6af19b6908be\System.Xml.ni.dll ],
Base Address: [0x637A0000 ], Size: [0x00588000 ]
Module Name: [ C:\WINDOWS\system32\VERSION.dll ],
Base Address: [0x77C00000 ], Size: [0x00008000 ]
Module Name: [ C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Core\b4770b4e285d48c83f725266ceb02598\System.Core.ni.dll ],
Base Address: [0x6C190000 ], Size: [0x00244000 ]
Module Name: [ C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Configuration\6249efaeae79679f5d909d727b1efe47\System.Configuration.ni.dll ],
Base Address: [0x64890000 ], Size: [0x000FC000 ]
Module Name: [ C:\WINDOWS\system32\rasapi32.dll ],
Base Address: [0x76EE0000 ], Size: [0x0003C000 ]
Module Name: [ C:\WINDOWS\system32\rasman.dll ],
Base Address: [0x76E90000 ], Size: [0x00012000 ]
Module Name: [ C:\WINDOWS\system32\NETAPI32.dll ],
Base Address: [0x5B860000 ], Size: [0x00055000 ]
Module Name: [ C:\WINDOWS\system32\WS2_32.dll ],
Base Address: [0x71AB0000 ], Size: [0x00017000 ]
Module Name: [ C:\WINDOWS\system32\WS2HELP.dll ],
Base Address: [0x71AA0000 ], Size: [0x00008000 ]
Module Name: [ C:\WINDOWS\system32\TAPI32.dll ],
Base Address: [0x76EB0000 ], Size: [0x0002F000 ]
Module Name: [ C:\WINDOWS\system32\rtutils.dll ],
Base Address: [0x76E80000 ], Size: [0x0000E000 ]
Module Name: [ C:\WINDOWS\system32\WINMM.dll ],
Base Address: [0x76B40000 ], Size: [0x0002D000 ]
Module Name: [ C:\WINDOWS\system32\mswsock.dll ],
Base Address: [0x71A50000 ], Size: [0x0003F000 ]
Module Name: [ C:\WINDOWS\system32\hnetcfg.dll ],
Base Address: [0x662B0000 ], Size: [0x00058000 ]
Module Name: [ C:\WINDOWS\System32\wshtcpip.dll ],
Base Address: [0x71A90000 ], Size: [0x00008000 ]
Module Name: [ C:\WINDOWS\system32\msv1_0.dll ],
Base Address: [0x77C70000 ], Size: [0x00024000 ]
Module Name: [ C:\WINDOWS\system32\iphlpapi.dll ],
Base Address: [0x76D60000 ], Size: [0x00019000 ]
Module Name: [ C:\WINDOWS\system32\DNSAPI.dll ],
Base Address: [0x76F20000 ], Size: [0x00027000 ]
Module Name: [ C:\WINDOWS\System32\winrnr.dll ],
Base Address: [0x76FB0000 ], Size: [0x00008000 ]
Module Name: [ C:\WINDOWS\system32\WLDAP32.dll ],
Base Address: [0x76F60000 ], Size: [0x0002C000 ]
Module Name: [ C:\WINDOWS\system32\rasadhlp.dll ],
Base Address: [0x76FC0000 ], Size: [0x00006000 ]
Module Name: [ C:\WINDOWS\system32\CLBCATQ.DLL ],
Base Address: [0x76FD0000 ], Size: [0x0007F000 ]
Module Name: [ C:\WINDOWS\system32\COMRes.dll ],
Base Address: [0x77050000 ], Size: [0x000C5000 ]
Module Name: [ C:\WINDOWS\system32\OLEAUT32.dll ],
Base Address: [0x77120000 ], Size: [0x0008B000 ]
Module Name: [ C:\WINDOWS\system32\browseui.dll ],
Base Address: [0x75F80000 ], Size: [0x000FD000 ]
Module Name: [ C:\WINDOWS\system32\xpsp2res.dll ],
Base Address: [0x03360000 ], Size: [0x002C5000 ]
Module Name: [ C:\WINDOWS\system32\browselc.dll ],
Base Address: [0x71600000 ], Size: [0x00012000 ]
Module Name: [ C:\WINDOWS\system32\MSCTF.dll ],
Base Address: [0x74720000 ], Size: [0x0004C000 ]
Module Name: [ C:\WINDOWS\system32\UxTheme.dll ],
Base Address: [0x5AD70000 ], Size: [0x00038000 ]
[=============================================================================]
2.a) alterMW3.e.exe - Registry Activities
[=============================================================================]
[=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=]
Registry Values Modified:
[=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=]
Key: [ HKU\S-1-5-21-842925246-1425521274-308236825-500\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders ],
Value Name: [ AppData ], New Value: [ C:\Documents and Settings\Administrator\Application Data ]
Key: [ HKU\S-1-5-21-842925246-1425521274-308236825-500\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders ],
Value Name: [ Cache ], New Value: [ C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files ]
[=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=]
Monitored Registry Keys:
[=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=]
Key: [ HKLM\Software\Classes ],
Watch subtree: [ 1 ], Notify Filter: [ Key Change,Value Change ], 3 times
Key: [ HKLM\Software\Classes\CLSID ],
Watch subtree: [ 1 ], Notify Filter: [ Key Change,Value Change ], 2 times
Key: [ HKLM\Software\Microsoft\COM3 ],
Watch subtree: [ 1 ], Notify Filter: [ Key Change,Value Change ], 6 times
Key: [ HKLM\Software\Microsoft\Tracing\RASAPI32 ],
Watch subtree: [ 0 ], Notify Filter: [ Attributes Change,Value Change,Security Descriptor Change ], 2 times
Key: [ HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\NameSpace_Catalog5 ],
Watch subtree: [ 0 ], Notify Filter: [ Key Change ], 1 time
Key: [ HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9 ],
Watch subtree: [ 0 ], Notify Filter: [ Key Change ], 1 time
Key: [ HKU ],
Watch subtree: [ 1 ], Notify Filter: [ Key Change,Value Change ], 3 times
Key: [ HKU\S-1-5-21-842925246-1425521274-308236825-500\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections ],
Watch subtree: [ 1 ], Notify Filter: [ Value Change ], 1 time
[=============================================================================]
2.b) alterMW3.e.exe - File Activities
[=============================================================================]
[=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=]
Files Created:
[=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=]
File Name: [ C:\Program Files\Common Files\9C40EE6610F10C90725B49422C8BB406F5CACF92.cpart ]
File Name: [ C:\Program Files\Common Files\DBNetwork.Indigo.SxS.log ]
[=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=]
Files Read:
[=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=]
File Name: [ C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Config\machine.config ]
File Name: [ C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\config\machine.config ]
File Name: [ C:\WINDOWS\Registration\R00000000000b.clb ]
File Name: [ C:\WINDOWS\system32\rsaenh.dll ]
File Name: [ PIPE\ROUTER ]
File Name: [ PIPE\lsarpc ]
[=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=]
Files Modified:
[=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=]
File Name: [ C:\Program Files\Common Files\9C40EE6610F10C90725B49422C8BB406F5CACF92.cpart ]
File Name: [ C:\Program Files\Common Files\DBNetwork.Indigo.SxS.log ]
File Name: [ Ip ]
File Name: [ PIPE\ROUTER ]
File Name: [ PIPE\lsarpc ]
File Name: [ \Device\Afd\Endpoint ]
File Name: [ \Device\Ip ]
File Name: [ \Device\NetBT_Tcpip_{1AD45B38-4060-4F73-BB1E-A0439A2D97EB} ]
File Name: [ \Device\RasAcd ]
File Name: [ \Device\Tcp ]
[=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=]
File System Control Communication:
[=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=]
File: [ C:\Program Files\Common Files\ ], Control Code: [ 0x00090028 ], 1 time
File: [ PIPE\lsarpc ], Control Code: [ 0x0011C017 ], 7 times
File: [ PIPE\ROUTER ], Control Code: [ 0x0011C017 ], 3 times
[=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=]
Device Control Communication:
[=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=]
File: [ \Device\KsecDD ], Control Code: [ 0x00390008 ], 8 times
File: [ \Device\Afd\Endpoint ], Control Code: [ AFD_GET_INFO (0x0001207B) ], 2 times
File: [ \Device\Afd\Endpoint ], Control Code: [ AFD_SET_CONTEXT (0x00012047) ], 13 times
File: [ \Device\Afd\Endpoint ], Control Code: [ AFD_GET_TDI_HANDLES (0x00012037) ], 3 times
File: [ \Device\Afd\Endpoint ], Control Code: [ AFD_SET_INFO (0x0001203B) ], 4 times
File: [ \Device\Afd\Endpoint ], Control Code: [ AFD_EVENT_SELECT (0x00012087) ], 2 times
File: [ \Device\Tcp ], Control Code: [ 0x00120003 ], 72 times
File: [ \Device\Ip ], Control Code: [ 0x00120040 ], 10 times
File: [ \Device\Ip ], Control Code: [ 0x00120090 ], 4 times
File: [ \Device\NetBT_Tcpip_{1AD45B38-4060-4F73-BB1E-A0439A2D97EB} ], Control Code: [ 0x0021009A ], 4 times
File: [ \Device\RasAcd ], Control Code: [ 0x00F14014 ], 1 time
File: [ \Device\Afd\Endpoint ], Control Code: [ AFD_BIND (0x00012003) ], 1 time
File: [ \Device\Afd\Endpoint ], Control Code: [ AFD_CONNECT (0x00012007) ], 1 time
File: [ \Device\Afd\Endpoint ], Control Code: [ AFD_SEND (0x0001201F) ], 4 times
File: [ \Device\Afd\Endpoint ], Control Code: [ AFD_RECV (0x00012017) ], 95 times
File: [ \Device\Afd\Endpoint ], Control Code: [ AFD_SELECT (0x00012024) ], 3 times
[=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=]
Memory Mapped Files:
[=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=]
File Name: [ C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\culture.dll ]
File Name: [ C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorjit.dll ]
File Name: [ C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorrc.dll ]
File Name: [ C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll ]
File Name: [ C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll ]
File Name: [ C:\WINDOWS\System32\winrnr.dll ]
File Name: [ C:\WINDOWS\System32\wshtcpip.dll ]
File Name: [ C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.1433_x-ww_5cf844d2\MSVCR80.dll ]
File Name: [ C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83\comctl32.dll ]
File Name: [ C:\WINDOWS\WindowsShell.Manifest ]
File Name: [ C:\WINDOWS\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp ]
File Name: [ C:\WINDOWS\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp ]
File Name: [ C:\WINDOWS\assembly\GAC_MSIL\System.Xml.Linq\3.5.0.0__b77a5c561934e089\System.Xml.Linq.dll ]
File Name: [ C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Configuration\6249efaeae79679f5d909d727b1efe47\System.Configuration.ni.dll ]
File Name: [ C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Core\b4770b4e285d48c83f725266ceb02598\System.Core.ni.dll ]
File Name: [ C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Xml\139ba31a8024c79b1e1e6af19b6908be\System.Xml.ni.dll ]
File Name: [ C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System\36dbfcf62e07d819b3de533898868ecf\System.ni.dll ]
File Name: [ C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\mscorlib\642534209e13d16e93b80a628742d2ee\mscorlib.ni.dll ]
File Name: [ C:\WINDOWS\system32\CLBCATQ.DLL ]
File Name: [ C:\WINDOWS\system32\COMRes.dll ]
File Name: [ C:\WINDOWS\system32\DNSAPI.dll ]
File Name: [ C:\WINDOWS\system32\MSCTF.dll ]
File Name: [ C:\WINDOWS\system32\TAPI32.dll ]
File Name: [ C:\WINDOWS\system32\UxTheme.dll ]
File Name: [ C:\WINDOWS\system32\WINMM.dll ]
File Name: [ C:\WINDOWS\system32\WS2HELP.dll ]
File Name: [ C:\WINDOWS\system32\WS2_32.dll ]
File Name: [ C:\WINDOWS\system32\browselc.dll ]
File Name: [ C:\WINDOWS\system32\browseui.dll ]
File Name: [ C:\WINDOWS\system32\comctl32.dll ]
File Name: [ C:\WINDOWS\system32\crypt32.dll ]
File Name: [ C:\WINDOWS\system32\hnetcfg.dll ]
File Name: [ C:\WINDOWS\system32\imm32.dll ]
File Name: [ C:\WINDOWS\system32\iphlpapi.dll ]
File Name: [ C:\WINDOWS\system32\l_intl.nls ]
File Name: [ C:\WINDOWS\system32\mscoree.dll ]
File Name: [ C:\WINDOWS\system32\msv1_0.dll ]
File Name: [ C:\WINDOWS\system32\mswsock.dll ]
File Name: [ C:\WINDOWS\system32\rasadhlp.dll ]
File Name: [ C:\WINDOWS\system32\rasapi32.dll ]
File Name: [ C:\WINDOWS\system32\rasman.dll ]
File Name: [ C:\WINDOWS\system32\rpcss.dll ]
File Name: [ C:\WINDOWS\system32\rsaenh.dll ]
File Name: [ C:\WINDOWS\system32\rtutils.dll ]
File Name: [ C:\WINDOWS\system32\shell32.dll ]
File Name: [ C:\WINDOWS\system32\winlogon.exe ]
File Name: [ C:\WINDOWS\system32\xpsp2res.dll ]
File Name: [ C:\alterMW3.e.exe ]
[=============================================================================]
2.c) alterMW3.e.exe - Windows Service Activities
[=============================================================================]
[=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=]
Services Started:
[=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=]
Service: [ RASMAN ]
[=============================================================================]
2.d) alterMW3.e.exe - Network Activities
[=============================================================================]
[=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=]
DNS Queries:
[=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=]
Name: [ e.content.alteriw.net ], Query Type: [ DNS_TYPE_A ],
Query Result: [ 109.163.230.23 ], Successful: [ YES ], Protocol: [ udp ]
[=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=]
HTTP Conversations:
[=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=]
From ANUBIS:1029 to 109.163.230.23:80 - [ e.content.alteriw.net ]
Request: [ GET /iw5m//caches.xml ], Response: [ 200 "OK" ]
Request: [ GET /iw5m//iw5m-client/info.xml ], Response: [ 200 "OK" ]
Request: [ HEAD /iw5m//iw5m-client/iw5m.dll.lzma ], Response: [ 200 "OK" ]
Request: [ GET /iw5m//iw5m-client/iw5m.dll.lzma ], Response: [ 206 "Partial Content" ]
[=============================================================================]
2.e) alterMW3.e.exe - Other Activities
[=============================================================================]
[=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=]
Mutexes Created:
[=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=]
Mutex: [ CTF.Asm.MutexDefaultS-1-5-21-842925246-1425521274-308236825-500 ]
Mutex: [ CTF.Compart.MutexDefaultS-1-5-21-842925246-1425521274-308236825-500 ]
Mutex: [ CTF.LBES.MutexDefaultS-1-5-21-842925246-1425521274-308236825-500 ]
Mutex: [ CTF.Layouts.MutexDefaultS-1-5-21-842925246-1425521274-308236825-500 ]
Mutex: [ CTF.TMD.MutexDefaultS-1-5-21-842925246-1425521274-308236825-500 ]
Mutex: [ CTF.TimListCache.FMPDefaultS-1-5-21-842925246-1425521274-308236825-500MUTEX.DefaultS-1-5-21-842925246-1425521274-308236825-500 ]
Mutex: [ DBWinMutex ]
Mutex: [ Global\.net clr networking ]
Mutex: [ MSCTF.Shared.MUTEX.IFG ]
[=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=]
Windows SEH exceptions:
[=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=]
Description: [ Exception 0xe06d7363 at 0x7c812aeb ], 2 times
Description: [ Exception 0x40010006 at 0x7c812aeb ], 1 time
[#############################################################################]
3. services.exe
[#############################################################################]
[=============================================================================]
General information about this executable
[=============================================================================]
Analysis Reason: A service was started.
Filename: services.exe
MD5: 0e776ed5f7cc9f94299e70461b7b8185
SHA-1: cb5a33cec4c7b8ef4bd5dc8c241005b66b26cbbf
File Size: 108544 Bytes
Command Line: C:\WINDOWS\system32\services.exe
Process-status
at analysis end: alive
Exit Code: 0
[=============================================================================]
Load-time Dlls
[=============================================================================]
Module Name: [ C:\WINDOWS\system32\ntdll.dll ],
Base Address: [0x7C900000 ], Size: [0x000AF000 ]
Module Name: [ C:\WINDOWS\system32\kernel32.dll ],
Base Address: [0x7C800000 ], Size: [0x000F6000 ]
Module Name: [ C:\WINDOWS\system32\ADVAPI32.dll ],
Base Address: [0x77DD0000 ], Size: [0x0009B000 ]
Module Name: [ C:\WINDOWS\system32\RPCRT4.dll ],
Base Address: [0x77E70000 ], Size: [0x00092000 ]
Module Name: [ C:\WINDOWS\system32\Secur32.dll ],
Base Address: [0x77FE0000 ], Size: [0x00011000 ]
Module Name: [ C:\WINDOWS\system32\msvcrt.dll ],
Base Address: [0x77C10000 ], Size: [0x00058000 ]
Module Name: [ C:\WINDOWS\system32\NCObjAPI.DLL ],
Base Address: [0x5F770000 ], Size: [0x0000C000 ]
Module Name: [ C:\WINDOWS\system32\MSVCP60.dll ],
Base Address: [0x76080000 ], Size: [0x00065000 ]
Module Name: [ C:\WINDOWS\system32\SCESRV.dll ],
Base Address: [0x7DBD0000 ], Size: [0x00051000 ]
Module Name: [ C:\WINDOWS\system32\AUTHZ.dll ],
Base Address: [0x776C0000 ], Size: [0x00012000 ]
Module Name: [ C:\WINDOWS\system32\USER32.dll ],
Base Address: [0x7E410000 ], Size: [0x00091000 ]
Module Name: [ C:\WINDOWS\system32\GDI32.dll ],
Base Address: [0x77F10000 ], Size: [0x00049000 ]
Module Name: [ C:\WINDOWS\system32\USERENV.dll ],
Base Address: [0x769C0000 ], Size: [0x000B4000 ]
Module Name: [ C:\WINDOWS\system32\umpnpmgr.dll ],
Base Address: [0x7DBA0000 ], Size: [0x00021000 ]
Module Name: [ C:\WINDOWS\system32\WINSTA.dll ],
Base Address: [0x76360000 ], Size: [0x00010000 ]
Module Name: [ C:\WINDOWS\system32\NETAPI32.dll ],
Base Address: [0x5B860000 ], Size: [0x00055000 ]
Module Name: [ C:\WINDOWS\system32\ShimEng.dll ],
Base Address: [0x5CB70000 ], Size: [0x00026000 ]
Module Name: [ C:\WINDOWS\AppPatch\AcAdProc.dll ],
Base Address: [0x47260000 ], Size: [0x0000F000 ]
Module Name: [ C:\WINDOWS\system32\Apphelp.dll ],
Base Address: [0x77B40000 ], Size: [0x00022000 ]
Module Name: [ C:\WINDOWS\system32\VERSION.dll ],
Base Address: [0x77C00000 ], Size: [0x00008000 ]
Module Name: [ C:\WINDOWS\system32\eventlog.dll ],
Base Address: [0x77B70000 ], Size: [0x00011000 ]
Module Name: [ C:\WINDOWS\system32\PSAPI.DLL ],
Base Address: [0x76BF0000 ], Size: [0x0000B000 ]
Module Name: [ C:\WINDOWS\system32\WS2_32.dll ],
Base Address: [0x71AB0000 ], Size: [0x00017000 ]
Module Name: [ C:\WINDOWS\system32\WS2HELP.dll ],
Base Address: [0x71AA0000 ], Size: [0x00008000 ]
Module Name: [ C:\WINDOWS\system32\wtsapi32.dll ],
Base Address: [0x76F50000 ], Size: [0x00008000 ]
[=============================================================================]
3.a) services.exe - Registry Activities
[=============================================================================]
[=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=]
Registry Keys Created:
[=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=]
Key: [ HKLM\System\CurrentControlSet\Enum\Root\LEGACY_TAPISRV\0000\Control ]
Key: [ HKLM\System\CurrentControlSet\Enum\Root\LEGACY_RASMAN\0000\Control ]
[=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=]
Registry Values Modified:
[=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=]
Key: [ HKLM\SYSTEM\CONTROLSET001\SERVICES\EVENTLOG\Application ],
Value Name: [ Sources ], New Value: [ 0x4d006900630072006f0073006f0066007400200048002e00330032003300 ]
Key: [ HKLM\System\CurrentControlSet\Enum\Root\LEGACY_RASMAN\0000\Control ],
Value Name: [ ActiveService ], New Value: [ RasMan ]
Key: [ HKLM\System\CurrentControlSet\Enum\Root\LEGACY_TAPISRV\0000\Control ],
Value Name: [ ActiveService ], New Value: [ TapiSrv ]
[=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=]
Registry Values Read:
[=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=]
Key: [ HKLM\SYSTEM\CONTROLSET001\CONTROL\COMPUTERNAME\ACTIVECOMPUTERNAME ],
Value Name: [ ComputerName ], Value: [ PC ], 4 times
Key: [ HKLM\SYSTEM\CONTROLSET001\ENUM\ACPI\PNP0303\4&2C5A7332&0 ],
Value Name: [ ClassGUID ], Value: [ {4D36E96B-E325-11CE-BFC1-08002BE10318} ], 1 time
Key: [ HKLM\SYSTEM\CONTROLSET001\ENUM\ACPI\PNP0400\4&2C5A7332&0 ],
Value Name: [ ClassGUID ], Value: [ {4D36E978-E325-11CE-BFC1-08002BE10318} ], 1 time
Key: [ HKLM\SYSTEM\CONTROLSET001\ENUM\ACPI\PNP0501\1 ],
Value Name: [ ClassGUID ], Value: [ {4D36E978-E325-11CE-BFC1-08002BE10318} ], 1 time
Key: [ HKLM\SYSTEM\CONTROLSET001\ENUM\ACPI\PNP0700\4&2C5A7332&0 ],
Value Name: [ ClassGUID ], Value: [ {4D36E969-E325-11CE-BFC1-08002BE10318} ], 1 time
Key: [ HKLM\SYSTEM\CONTROLSET001\ENUM\ACPI\PNP0A03\1 ],
Value Name: [ ClassGUID ], Value: [ {4D36E97D-E325-11CE-BFC1-08002BE10318} ], 1 time
Key: [ HKLM\SYSTEM\CONTROLSET001\ENUM\ACPI\PNP0F13\4&2C5A7332&0 ],
Value Name: [ ClassGUID ], Value: [ {4D36E96F-E325-11CE-BFC1-08002BE10318} ], 1 time
Key: [ HKLM\SYSTEM\CONTROLSET001\ENUM\ACPI_HAL\PNP0C08\0 ],
Value Name: [ ClassGUID ], Value: [ {4D36E97D-E325-11CE-BFC1-08002BE10318} ], 1 time
Key: [ HKLM\SYSTEM\CONTROLSET001\ENUM\DISPLAY\DEFAULT_MONITOR\4&2946A9FF&0&11223344&00&02 ],
Value Name: [ ClassGUID ], Value: [ {4D36E96E-E325-11CE-BFC1-08002BE10318} ], 1 time
Key: [ HKLM\SYSTEM\CONTROLSET001\ENUM\IDE\CDROMQEMU_QEMU_CD-ROM________________________0.9.____\4D51303030302033202020202020202020202020 ],
Value Name: [ ClassGUID ], Value: [ {4D36E965-E325-11CE-BFC1-08002BE10318} ], 1 time
Key: [ HKLM\SYSTEM\CONTROLSET001\ENUM\IDE\DISKQEMU_HARDDISK___________________________0.9.1___\4D51303030302031202020202020202020202020 ],
Value Name: [ ClassGUID ], Value: [ {4D36E967-E325-11CE-BFC1-08002BE10318} ], 1 time
Key: [ HKLM\SYSTEM\CONTROLSET001\ENUM\ISAPNP\READDATAPORT\0 ],
Value Name: [ ClassGUID ], Value: [ {4D36E97D-E325-11CE-BFC1-08002BE10318} ], 1 time
Key: [ HKLM\SYSTEM\CONTROLSET001\ENUM\LPTENUM\MICROSOFTRAWPORT\5&34A37E9F&0&LPT1 ],
Value Name: [ ClassGUID ], Value: [ {4D36E97D-E325-11CE-BFC1-08002BE10318} ], 1 time
Key: [ HKLM\SYSTEM\CONTROLSET001\ENUM\PCIIDE\IDECHANNEL\4&3DE75EA&0&0 ],
Value Name: [ ClassGUID ], Value: [ {4D36E96A-E325-11CE-BFC1-08002BE10318} ], 1 time
Key: [ HKLM\SYSTEM\CONTROLSET001\ENUM\PCIIDE\IDECHANNEL\4&3DE75EA&0&1 ],
Value Name: [ ClassGUID ], Value: [ {4D36E96A-E325-11CE-BFC1-08002BE10318} ], 1 time
Key: [ HKLM\SYSTEM\CONTROLSET001\ENUM\PCI\VEN_1013&DEV_00B8&SUBSYS_00000000&REV_00\3&13C0B0C5&0&10 ],
Value Name: [ ClassGUID ], Value: [ {4D36E968-E325-11CE-BFC1-08002BE10318} ], 1 time
Key: [ HKLM\SYSTEM\CONTROLSET001\ENUM\PCI\VEN_10EC&DEV_8029&SUBSYS_00000000&REV_00\3&13C0B0C5&0&18 ],
Value Name: [ ClassGUID ], Value: [ {4D36E972-E325-11CE-BFC1-08002BE10318} ], 2 times
Key: [ HKLM\SYSTEM\CONTROLSET001\ENUM\PCI\VEN_10EC&DEV_8029&SUBSYS_00000000&REV_00\3&13C0B0C5&0&18 ],
Value Name: [ DeviceDesc ], Value: [ Realtek RTL8029(AS)-based Ethernet Adapter (Generic) ], 2 times
Key: [ HKLM\SYSTEM\CONTROLSET001\ENUM\PCI\VEN_10EC&DEV_8029&SUBSYS_00000000&REV_00\3&13C0B0C5&0&18 ],
Value Name: [ Driver ], Value: [ {4D36E972-E325-11CE-BFC1-08002BE10318}\0001 ], 2 times
Key: [ HKLM\SYSTEM\CONTROLSET001\ENUM\PCI\VEN_10EC&DEV_8029&SUBSYS_11001AF4&REV_00\3&13C0B0C5&0&18 ],
Value Name: [ ClassGUID ], Value: [ {4D36E972-E325-11CE-BFC1-08002BE10318} ], 1 time
Key: [ HKLM\SYSTEM\CONTROLSET001\ENUM\PCI\VEN_10EC&DEV_8029&SUBSYS_11001AF4&REV_00\3&13C0B0C5&0&18 ],
Value Name: [ Driver ], Value: [ {4D36E972-E325-11CE-BFC1-08002BE10318}\0008 ], 2 times
Key: [ HKLM\SYSTEM\CONTROLSET001\ENUM\PCI\VEN_10EC&DEV_8029&SUBSYS_11001AF4&REV_00\3&13C0B0C5&0&18 ],
Value Name: [ FriendlyName ], Value: [ Realtek RTL8029(AS)-based Ethernet Adapter (Generic) #2 ], 2 times
Key: [ HKLM\SYSTEM\CONTROLSET001\ENUM\PCI\VEN_8086&DEV_1237&SUBSYS_00000000&REV_02\3&13C0B0C5&0&00 ],
Value Name: [ ClassGUID ], Value: [ {4D36E97D-E325-11CE-BFC1-08002BE10318} ], 1 time
Key: [ HKLM\SYSTEM\CONTROLSET001\ENUM\PCI\VEN_8086&DEV_7000&SUBSYS_00000000&REV_00\3&13C0B0C5&0&08 ],
Value Name: [ ClassGUID ], Value: [ {4D36E97D-E325-11CE-BFC1-08002BE10318} ], 1 time
Key: [ HKLM\SYSTEM\CONTROLSET001\ENUM\PCI\VEN_8086&DEV_7010&SUBSYS_00000000&REV_00\3&13C0B0C5&0&09 ],
Value Name: [ ClassGUID ], Value: [ {4D36E96A-E325-11CE-BFC1-08002BE10318} ], 1 time
Key: [ HKLM\SYSTEM\CONTROLSET001\ENUM\ROOT\ACPI_HAL\0000 ],
Value Name: [ ClassGUID ], Value: [ {4D36E966-E325-11CE-BFC1-08002BE10318} ], 1 time
Key: [ HKLM\SYSTEM\CONTROLSET001\ENUM\ROOT\DMIO\0000 ],
Value Name: [ ClassGUID ], Value: [ {4D36E97D-E325-11CE-BFC1-08002BE10318} ], 1 time
Key: [ HKLM\SYSTEM\CONTROLSET001\ENUM\ROOT\FTDISK\0000 ],
Value Name: [ ClassGUID ], Value: [ {4D36E97D-E325-11CE-BFC1-08002BE10318} ], 1 time
Key: [ HKLM\SYSTEM\CONTROLSET001\ENUM\ROOT\LEGACY_AFD\0000 ],
Value Name: [ ClassGUID ], Value: [ {8ECC055D-047F-11D1-A537-0000F8753ED1} ], 1 time
Key: [ HKLM\SYSTEM\CONTROLSET001\ENUM\ROOT\LEGACY_BEEP\0000 ],
Value Name: [ ClassGUID ], Value: [ {8ECC055D-047F-11D1-A537-0000F8753ED1} ], 1 time
Key: [ HKLM\SYSTEM\CONTROLSET001\ENUM\ROOT\LEGACY_DMBOOT\0000 ],
Value Name: [ ClassGUID ], Value: [ {8ECC055D-047F-11D1-A537-0000F8753ED1} ], 1 time
Key: [ HKLM\SYSTEM\CONTROLSET001\ENUM\ROOT\LEGACY_DMLOAD\0000 ],
Value Name: [ ClassGUID ], Value: [ {8ECC055D-047F-11D1-A537-0000F8753ED1} ], 1 time
Key: [ HKLM\SYSTEM\CONTROLSET001\ENUM\ROOT\LEGACY_FIPS\0000 ],
Value Name: [ ClassGUID ], Value: [ {8ECC055D-047F-11D1-A537-0000F8753ED1} ], 1 time
Key: [ HKLM\SYSTEM\CONTROLSET001\ENUM\ROOT\LEGACY_GPC\0000 ],
Value Name: [ ClassGUID ], Value: [ {8ECC055D-047F-11D1-A537-0000F8753ED1} ], 1 time
Key: [ HKLM\SYSTEM\CONTROLSET001\ENUM\ROOT\LEGACY_HTTP\0000 ],
Value Name: [ ClassGUID ], Value: [ {8ECC055D-047F-11D1-A537-0000F8753ED1} ], 1 time
Key: [ HKLM\SYSTEM\CONTROLSET001\ENUM\ROOT\LEGACY_IPNAT\0000 ],
Value Name: [ ClassGUID ], Value: [ {8ECC055D-047F-11D1-A537-0000F8753ED1} ], 1 time
Key: [ HKLM\SYSTEM\CONTROLSET001\ENUM\ROOT\LEGACY_IPSEC\0000 ],
Value Name: [ ClassGUID ], Value: [ {8ECC055D-047F-11D1-A537-0000F8753ED1} ], 1 time
Key: [ HKLM\SYSTEM\CONTROLSET001\ENUM\ROOT\LEGACY_KSECDD\0000 ],
Value Name: [ ClassGUID ], Value: [ {8ECC055D-047F-11D1-A537-0000F8753ED1} ], 1 time
Key: [ HKLM\SYSTEM\CONTROLSET001\ENUM\ROOT\LEGACY_MNMDD\0000 ],
Value Name: [ ClassGUID ], Value: [ {8ECC055D-047F-11D1-A537-0000F8753ED1} ], 1 time
Key: [ HKLM\SYSTEM\CONTROLSET001\ENUM\ROOT\LEGACY_MOUNTMGR\0000 ],
Value Name: [ ClassGUID ], Value: [ {8ECC055D-047F-11D1-A537-0000F8753ED1} ], 1 time
Key: [ HKLM\SYSTEM\CONTROLSET001\ENUM\ROOT\LEGACY_NDISTAPI\0000 ],
Value Name: [ ClassGUID ], Value: [ {8ECC055D-047F-11D1-A537-0000F8753ED1} ], 1 time
Key: [ HKLM\SYSTEM\CONTROLSET001\ENUM\ROOT\LEGACY_NDISUIO\0000 ],
Value Name: [ ClassGUID ], Value: [ {8ECC055D-047F-11D1-A537-0000F8753ED1} ], 1 time
Key: [ HKLM\SYSTEM\CONTROLSET001\ENUM\ROOT\LEGACY_NDIS\0000 ],
Value Name: [ ClassGUID ], Value: [ {8ECC055D-047F-11D1-A537-0000F8753ED1} ], 1 time
Key: [ HKLM\SYSTEM\CONTROLSET001\ENUM\ROOT\LEGACY_NDPROXY\0000 ],
Value Name: [ ClassGUID ], Value: [ {8ECC055D-047F-11D1-A537-0000F8753ED1} ], 1 time
Key: [ HKLM\SYSTEM\CONTROLSET001\ENUM\ROOT\LEGACY_NETBT\0000 ],
Value Name: [ ClassGUID ], Value: [ {8ECC055D-047F-11D1-A537-0000F8753ED1} ], 1 time
Key: [ HKLM\SYSTEM\CONTROLSET001\ENUM\ROOT\LEGACY_NULL\0000 ],
Value Name: [ ClassGUID ], Value: [ {8ECC055D-047F-11D1-A537-0000F8753ED1} ], 1 time
Key: [ HKLM\SYSTEM\CONTROLSET001\ENUM\ROOT\LEGACY_PARTMGR\0000 ],
Value Name: [ ClassGUID ], Value: [ {8ECC055D-047F-11D1-A537-0000F8753ED1} ], 1 time
Key: [ HKLM\SYSTEM\CONTROLSET001\ENUM\ROOT\LEGACY_PARVDM\0000 ],
Value Name: [ ClassGUID ], Value: [ {8ECC055D-047F-11D1-A537-0000F8753ED1} ], 1 time
Key: [ HKLM\SYSTEM\CONTROLSET001\ENUM\ROOT\LEGACY_RASACD\0000 ],
Value Name: [ ClassGUID ], Value: [ {8ECC055D-047F-11D1-A537-0000F8753ED1} ], 1 time
Key: [ HKLM\SYSTEM\CONTROLSET001\ENUM\ROOT\LEGACY_RDPCDD\0000 ],
Value Name: [ ClassGUID ], Value: [ {8ECC055D-047F-11D1-A537-0000F8753ED1} ], 1 time
Key: [ HKLM\SYSTEM\CONTROLSET001\ENUM\ROOT\LEGACY_TCPIP\0000 ],
Value Name: [ ClassGUID ], Value: [ {8ECC055D-047F-11D1-A537-0000F8753ED1} ], 1 time
Key: [ HKLM\SYSTEM\CONTROLSET001\ENUM\ROOT\LEGACY_VGASAVE\0000 ],
Value Name: [ ClassGUID ], Value: [ {8ECC055D-047F-11D1-A537-0000F8753ED1} ], 1 time
Key: [ HKLM\SYSTEM\CONTROLSET001\ENUM\ROOT\LEGACY_VOLSNAP\0000 ],
Value Name: [ ClassGUID ], Value: [ {8ECC055D-047F-11D1-A537-0000F8753ED1} ], 1 time
Key: [ HKLM\SYSTEM\CONTROLSET001\ENUM\ROOT\LEGACY_WANARP\0000 ],
Value Name: [ ClassGUID ], Value: [ {8ECC055D-047F-11D1-A537-0000F8753ED1} ], 1 time
Key: [ HKLM\SYSTEM\CONTROLSET001\ENUM\ROOT\MEDIA\MS_MMACM ],
Value Name: [ ClassGUID ], Value: [ {4D36E96C-E325-11CE-BFC1-08002BE10318} ], 1 time
Key: [ HKLM\SYSTEM\CONTROLSET001\ENUM\ROOT\MEDIA\MS_MMDRV ],
Value Name: [ ClassGUID ], Value: [ {4D36E96C-E325-11CE-BFC1-08002BE10318} ], 1 time
Key: [ HKLM\SYSTEM\CONTROLSET001\ENUM\ROOT\MEDIA\MS_MMMCI ],
Value Name: [ ClassGUID ], Value: [ {4D36E96C-E325-11CE-BFC1-08002BE10318} ], 1 time
Key: [ HKLM\SYSTEM\CONTROLSET001\ENUM\ROOT\MEDIA\MS_MMVCD ],
Value Name: [ ClassGUID ], Value: [ {4D36E96C-E325-11CE-BFC1-08002BE10318} ], 1 time
Key: [ HKLM\SYSTEM\CONTROLSET001\ENUM\ROOT\MEDIA\MS_MMVID ],
Value Name: [ ClassGUID ], Value: [ {4D36E96C-E325-11CE-BFC1-08002BE10318} ], 1 time
Key: [ HKLM\SYSTEM\CONTROLSET001\ENUM\ROOT\MS_L2TPMINIPORT\0000 ],
Value Name: [ ClassGUID ], Value: [ {4D36E972-E325-11CE-BFC1-08002BE10318} ], 1 time
Key: [ HKLM\SYSTEM\CONTROLSET001\ENUM\ROOT\MS_NDISWANIP\0000 ],
Value Name: [ ClassGUID ], Value: [ {4D36E972-E325-11CE-BFC1-08002BE10318} ], 2 times
Key: [ HKLM\SYSTEM\CONTROLSET001\ENUM\ROOT\MS_NDISWANIP\0000 ],
Value Name: [ DeviceDesc ], Value: [ WAN Miniport (IP) ], 2 times
Key: [ HKLM\SYSTEM\CONTROLSET001\ENUM\ROOT\MS_NDISWANIP\0000 ],
Value Name: [ Driver ], Value: [ {4D36E972-E325-11CE-BFC1-08002BE10318}\0007 ], 2 times
Key: [ HKLM\SYSTEM\CONTROLSET001\ENUM\ROOT\MS_PPPOEMINIPORT\0000 ],
Value Name: [ ClassGUID ], Value: [ {4D36E972-E325-11CE-BFC1-08002BE10318} ], 1 time
Key: [ HKLM\SYSTEM\CONTROLSET001\ENUM\ROOT\MS_PPTPMINIPORT\0000 ],
Value Name: [ ClassGUID ], Value: [ {4D36E972-E325-11CE-BFC1-08002BE10318} ], 1 time
Key: [ HKLM\SYSTEM\CONTROLSET001\ENUM\ROOT\MS_PTIMINIPORT\0000 ],
Value Name: [ ClassGUID ], Value: [ {4D36E972-E325-11CE-BFC1-08002BE10318} ], 1 time
Key: [ HKLM\SYSTEM\CONTROLSET001\ENUM\ROOT\RDPDR\0000 ],
Value Name: [ ClassGUID ], Value: [ {4D36E97D-E325-11CE-BFC1-08002BE10318} ], 1 time
Key: [ HKLM\SYSTEM\CONTROLSET001\ENUM\ROOT\RDP_KBD\0000 ],
Value Name: [ ClassGUID ], Value: [ {4D36E97D-E325-11CE-BFC1-08002BE10318} ], 1 time
Key: [ HKLM\SYSTEM\CONTROLSET001\ENUM\ROOT\RDP_MOU\0000 ],
Value Name: [ ClassGUID ], Value: [ {4D36E97D-E325-11CE-BFC1-08002BE10318} ], 1 time
Key: [ HKLM\SYSTEM\CONTROLSET001\ENUM\ROOT\SYSTEM\0000 ],
Value Name: [ ClassGUID ], Value: [ {4D36E97D-E325-11CE-BFC1-08002BE10318} ], 1 time
Key: [ HKLM\SYSTEM\CONTROLSET001\ENUM\ROOT\SYSTEM\0001 ],
Value Name: [ ClassGUID ], Value: [ {4D36E97D-E325-11CE-BFC1-08002BE10318} ], 1 time
Key: [ HKLM\SYSTEM\CONTROLSET001\ENUM\ROOT\SYSTEM\0002 ],
Value Name: [ ClassGUID ], Value: [ {4D36E97D-E325-11CE-BFC1-08002BE10318} ], 1 time
Key: [ HKLM\SYSTEM\CONTROLSET001\ENUM\STORAGE\VOLUME\1&30A96598&0&SIGNATUREB15FB15FOFFSET7E00LENGTH13F291800 ],
Value Name: [ ClassGUID ], Value: [ {71A27CDD-812A-11D0-BEC7-08002BE2092F} ], 1 time
Key: [ HKLM\SYSTEM\CONTROLSET001\SERVICES\EVENTLOG ],
Value Name: [ ComputerName ], Value: [ PC ], 4 times
Key: [ HKLM\SYSTEM\CONTROLSET001\SERVICES\EVENTLOG\Application ],
Value Name: [ AutoBackupLogFiles ], Value: [ 0 ], 4 times
Key: [ HKLM\SYSTEM\CONTROLSET001\SERVICES\EVENTLOG\Application ],
Value Name: [ File ], Value: [ %SystemRoot%\system32\config\AppEvent.Evt ], 4 times
Key: [ HKLM\SYSTEM\CONTROLSET001\SERVICES\EVENTLOG\Application ],
Value Name: [ Maxsize ], Value: [ 524288 ], 4 times
Key: [ HKLM\SYSTEM\CONTROLSET001\SERVICES\EVENTLOG\Application ],
Value Name: [ RestrictGuestAccess ], Value: [ 1 ], 4 times
Key: [ HKLM\SYSTEM\CONTROLSET001\SERVICES\EVENTLOG\Application ],
Value Name: [ Retention ], Value: [ 604800 ], 4 times
Key: [ HKLM\SYSTEM\CONTROLSET001\SERVICES\EVENTLOG\Security ],
Value Name: [ File ], Value: [ %SystemRoot%\System32\config\SecEvent.Evt ], 4 times
Key: [ HKLM\SYSTEM\CONTROLSET001\SERVICES\EVENTLOG\Security ],
Value Name: [ Maxsize ], Value: [ 524288 ], 4 times
Key: [ HKLM\SYSTEM\CONTROLSET001\SERVICES\EVENTLOG\Security ],
Value Name: [ RestrictGuestAccess ], Value: [ 1 ], 4 times
Key: [ HKLM\SYSTEM\CONTROLSET001\SERVICES\EVENTLOG\Security ],
Value Name: [ Retention ], Value: [ 604800 ], 4 times
Key: [ HKLM\SYSTEM\CONTROLSET001\SERVICES\EVENTLOG\System ],
Value Name: [ File ], Value: [ %SystemRoot%\system32\config\SysEvent.Evt ], 4 times
Key: [ HKLM\SYSTEM\CONTROLSET001\SERVICES\EVENTLOG\System ],
Value Name: [ Maxsize ], Value: [ 524288 ], 4 times
Key: [ HKLM\SYSTEM\CONTROLSET001\SERVICES\EVENTLOG\System ],
Value Name: [ RestrictGuestAccess ], Value: [ 1 ], 4 times
Key: [ HKLM\SYSTEM\CONTROLSET001\SERVICES\EVENTLOG\System ],
Value Name: [ Retention ], Value: [ 604800 ], 4 times
Key: [ HKLM\SYSTEM\CONTROLSET001\SERVICES\PlugPlay ],
Value Name: [ PlugPlayServiceType ], Value: [ 3 ], 1 time
Key: [ HKLM\SYSTEM\CONTROLSET001\SERVICES\RasMan\Enum ],
Value Name: [ 0 ], Value: [ Root\LEGACY_RASMAN\0000 ], 3 times
Key: [ HKLM\SYSTEM\CONTROLSET001\SERVICES\RasMan\Enum ],
Value Name: [ Count ], Value: [ 1 ], 6 times
Key: [ HKLM\SYSTEM\CONTROLSET001\SERVICES\RpcSs\Enum ],
Value Name: [ 0 ], Value: [ Root\LEGACY_RPCSS\0000 ], 1 time
Key: [ HKLM\SYSTEM\CONTROLSET001\SERVICES\RpcSs\Enum ],
Value Name: [ Count ], Value: [ 1 ], 2 times
Key: [ HKLM\SYSTEM\CONTROLSET001\SERVICES\TapiSrv\Enum ],
Value Name: [ 0 ], Value: [ Root\LEGACY_TAPISRV\0000 ], 2 times
Key: [ HKLM\SYSTEM\CONTROLSET001\SERVICES\TapiSrv\Enum ],
Value Name: [ Count ], Value: [ 1 ], 4 times
Key: [ HKLM\System\CurrentControlSet\Services\PlugPlay ],
Value Name: [ ObjectName ], Value: [ LocalSystem ], 1 time
Key: [ HKLM\System\CurrentControlSet\Services\RasMan ],
Value Name: [ ImagePath ], Value: [ %SystemRoot%\system32\svchost.exe -k netsvcs ], 1 time
Key: [ HKLM\System\CurrentControlSet\Services\RasMan ],
Value Name: [ ObjectName ], Value: [ LocalSystem ], 2 times
Key: [ HKLM\System\CurrentControlSet\Services\RpcSs ],
Value Name: [ ObjectName ], Value: [ NT AUTHORITY\NetworkService ], 1 time
Key: [ HKLM\System\CurrentControlSet\Services\TapiSrv ],
Value Name: [ ImagePath ], Value: [ %SystemRoot%\System32\svchost.exe -k netsvcs ], 1 time
Key: [ HKLM\System\CurrentControlSet\Services\TapiSrv ],
Value Name: [ ObjectName ], Value: [ LocalSystem ], 2 times
[=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=]
Monitored Registry Keys:
[=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=]
Key: [ HKLM\SYSTEM\CONTROLSET001\SERVICES\EVENTLOG ],
Watch subtree: [ 1 ], Notify Filter: [ Key Change,Value Change ], 4 times
[=============================================================================]
3.b) services.exe - File Activities
[=============================================================================]
[=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=]
Files Read:
[=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=]
File Name: [ C:\ntsvcs, Flags: Named pipe ]
[=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=]
Files Modified:
[=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=]
File Name: [ C:\PIPE_EVENTROOT\CIMV2SCM EVENT PROVIDER, Flags: Named pipe ]
File Name: [ C:\WINDOWS\system32\config\SysEvent.Evt ]
File Name: [ C:\ntsvcs, Flags: Named pipe ]
[=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=]
File System Control Communication:
[=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=]
File: [ C:\net\NtControlPipe4, Flags: Named pipe ], Control Code: [ 0x0011C017 ], 2 times
File: [ C:\ntsvcs, Flags: Named pipe ], Control Code: [ 0x0011001C ], 4 times
http://a.content.alteriw.net/iw5m//iw5m-client/info.xml
HTTP Debug:
Code:
# Result Protocol Host URL Body Caching Content-Type Process Comments Custom 4 200 HTTP a.content.alteriw.net /iw5m//iw5m-client/iw5m.dll.lzma 0 application/octet-stream altermw3:2232 [#4] 5 206 HTTP a.content.alteriw.net /iw5m//iw5m-client/iw5m.dll.lzma 696.051 application/octet-stream altermw3:2232 [#5] 6 200 HTTP a.content.alteriw.net /iw5m//iw5m-client/iw5mp.exe.lzma 0 application/octet-stream altermw3:2232 [#6] 7 206 HTTP a.content.alteriw.net /iw5m//iw5m-client/iw5mp.exe.lzma 2.144.288 application/octet-stream altermw3:2232 [#7] 8 200 HTTP a.content.alteriw.net /iw5m//iw5m-client/libnp.dll.lzma 0 application/octet-stream altermw3:2232 [#8] 9 206 HTTP a.content.alteriw.net /iw5m//iw5m-client/libnp.dll.lzma 230.959 application/octet-stream altermw3:2232 [#9] 10 200 HTTP a.content.alteriw.net /iw5m//iw5m-client/steam_api.dll.lzma 0 application/octet-stream altermw3:2232 [#10] 11 206 HTTP a.content.alteriw.net /iw5m//iw5m-client/steam_api.dll.lzma 986 application/octet-stream altermw3:2232 [#11] 12 200 HTTP a.content.alteriw.net /iw5m//iw5m-client/zone/english/code_post_gfx.ff.lzma 0 application/octet-stream altermw3:2232 [#12] 13 206 HTTP a.content.alteriw.net /iw5m//iw5m-client/zone/english/code_post_gfx.ff.lzma 1.359.920 application/octet-stream altermw3:2232 [#13] 14 200 HTTP a.content.alteriw.net /iw5m//iw5m-client/zone/english/code_post_gfx_mp.ff.lzma 0 application/octet-stream altermw3:2232 [#14] 15 206 HTTP a.content.alteriw.net /iw5m//iw5m-client/zone/english/code_post_gfx_mp.ff.lzma 231.061 application/octet-stream altermw3:2232 [#15] 16 200 HTTP a.content.alteriw.net /iw5m//iw5m-client/zone/english/code_pre_gfx.ff.lzma 0 application/octet-stream altermw3:2232 [#16] 17 206 HTTP a.content.alteriw.net /iw5m//iw5m-client/zone/english/code_pre_gfx.ff.lzma 4.086 application/octet-stream altermw3:2232 [#17] 18 200 HTTP a.content.alteriw.net /iw5m//iw5m-client/zone/english/code_pre_gfx_mp.ff.lzma 0 application/octet-stream altermw3:2232 [#18] 19 206 HTTP a.content.alteriw.net /iw5m//iw5m-client/zone/english/code_pre_gfx_mp.ff.lzma 22.694 application/octet-stream altermw3:2232 [#19] 20 200 HTTP a.content.alteriw.net /iw5m//iw5m-client/zone/english/localized_code_post_gfx_mp.ff.lzma 0 application/octet-stream altermw3:2232 [#20] 21 206 HTTP a.content.alteriw.net /iw5m//iw5m-client/zone/english/localized_code_post_gfx_mp.ff.lzma 1.272.404 application/octet-stream altermw3:2232 [#21] 22 200 HTTP a.content.alteriw.net /iw5m//iw5m-client/zone/english/localized_code_pre_gfx_mp.ff.lzma 0 application/octet-stream altermw3:2232 [#22] 23 206 HTTP a.content.alteriw.net /iw5m//iw5m-client/zone/english/localized_code_pre_gfx_mp.ff.lzma 22.102 application/octet-stream altermw3:2232 [#23] 24 200 HTTP a.content.alteriw.net /iw5m//iw5m-client/zone/english/localized_ui_mp.ff.lzma 0 application/octet-stream altermw3:2232 [#24] 25 206 HTTP a.content.alteriw.net /iw5m//iw5m-client/zone/english/localized_ui_mp.ff.lzma 1.563.367 application/octet-stream altermw3:2232 [#25] 26 200 HTTP a.content.alteriw.net /iw5m//iw5m-client/zone/english/patch.ff.lzma 0 application/octet-stream altermw3:2232 [#26] 27 206 HTTP a.content.alteriw.net /iw5m//iw5m-client/zone/english/patch.ff.lzma 86.695 application/octet-stream altermw3:2232 [#27] 28 200 HTTP a.content.alteriw.net /iw5m//iw5m-client/zone/english/patch_hamburg.ff.lzma 0 application/octet-stream altermw3:2232 [#28] 29 206 HTTP a.content.alteriw.net /iw5m//iw5m-client/zone/english/patch_hamburg.ff.lzma 2.876 application/octet-stream altermw3:2232 [#29] 30 200 HTTP a.content.alteriw.net /iw5m//iw5m-client/zone/english/patch_hijack.ff.lzma 0 application/octet-stream altermw3:2232 [#30] 31 206 HTTP a.content.alteriw.net /iw5m//iw5m-client/zone/english/patch_hijack.ff.lzma 3.627 application/octet-stream altermw3:2232 [#31] 32 200 HTTP a.content.alteriw.net /iw5m//iw5m-client/zone/english/patch_innocent.ff.lzma 0 application/octet-stream altermw3:2232 [#32] 33 206 HTTP a.content.alteriw.net /iw5m//iw5m-client/zone/english/patch_innocent.ff.lzma 3.019 application/octet-stream altermw3:2232 [#33] 34 200 HTTP a.content.alteriw.net /iw5m//iw5m-client/zone/english/patch_london.ff.lzma 0 application/octet-stream altermw3:2232 [#34] 35 206 HTTP a.content.alteriw.net /iw5m//iw5m-client/zone/english/patch_london.ff.lzma 25.471 application/octet-stream altermw3:2232 [#35] 36 200 HTTP a.content.alteriw.net /iw5m//iw5m-client/zone/english/patch_mp.ff.lzma 0 application/octet-stream altermw3:2232 [#36] 37 206 HTTP a.content.alteriw.net /iw5m//iw5m-client/zone/english/patch_mp.ff.lzma 592.364 application/octet-stream altermw3:2232 [#37] 38 200 HTTP a.content.alteriw.net /iw5m//iw5m-client/zone/english/patch_mp_dome.ff.lzma 0 application/octet-stream altermw3:2232 [#38] 39 206 HTTP a.content.alteriw.net /iw5m//iw5m-client/zone/english/patch_mp_dome.ff.lzma 22.025 application/octet-stream altermw3:2232 [#39] 40 200 HTTP a.content.alteriw.net /iw5m//iw5m-client/zone/english/patch_mp_exchange.ff.lzma 0 application/octet-stream altermw3:2232 [#40] 41 206 HTTP a.content.alteriw.net /iw5m//iw5m-client/zone/english/patch_mp_exchange.ff.lzma 22.023 application/octet-stream altermw3:2232 [#41] 42 200 HTTP a.content.alteriw.net /iw5m//iw5m-client/zone/english/patch_mp_lambeth.ff.lzma 0 application/octet-stream altermw3:2232 [#42] 43 206 HTTP a.content.alteriw.net /iw5m//iw5m-client/zone/english/patch_mp_lambeth.ff.lzma 21.973 application/octet-stream altermw3:2232 [#43] 44 200 HTTP a.content.alteriw.net /iw5m//iw5m-client/zone/english/patch_mp_paris.ff.lzma 0 application/octet-stream altermw3:2232 [#44] 45 206 HTTP a.content.alteriw.net /iw5m//iw5m-client/zone/english/patch_mp_paris.ff.lzma 22.024 application/octet-stream altermw3:2232 [#45] 46 200 HTTP a.content.alteriw.net /iw5m//iw5m-client/zone/english/patch_mp_radar.ff.lzma 0 application/octet-stream altermw3:2232 [#46] 47 206 HTTP a.content.alteriw.net /iw5m//iw5m-client/zone/english/patch_mp_radar.ff.lzma 22.090 application/octet-stream altermw3:2232 [#47] 48 200 HTTP a.content.alteriw.net /iw5m//iw5m-client/zone/english/patch_mp_underground.ff.lzma 0 application/octet-stream altermw3:2232 [#48] 49 206 HTTP a.content.alteriw.net /iw5m//iw5m-client/zone/english/patch_mp_underground.ff.lzma 22.029 application/octet-stream altermw3:2232 [#49] 50 200 HTTP a.content.alteriw.net /iw5m//iw5m-client/zone/english/patch_mp_village.ff.lzma 0 application/octet-stream altermw3:2232 [#50] 51 206 HTTP a.content.alteriw.net /iw5m//iw5m-client/zone/english/patch_mp_village.ff.lzma 21.973 application/octet-stream altermw3:2232 [#51] 52 200 HTTP a.content.alteriw.net /iw5m//iw5m-client/zone/english/patch_paris_ac130.ff.lzma 0 application/octet-stream altermw3:2232 [#52] 53 206 HTTP a.content.alteriw.net /iw5m//iw5m-client/zone/english/patch_paris_ac130.ff.lzma 58.108 application/octet-stream altermw3:2232 [#53] 54 200 HTTP a.content.alteriw.net /iw5m//iw5m-client/zone/english/patch_prague_escape.ff.lzma 0 application/octet-stream altermw3:2232 [#54] 55 206 HTTP a.content.alteriw.net /iw5m//iw5m-client/zone/english/patch_prague_escape.ff.lzma 7.507 application/octet-stream altermw3:2232 [#55] 56 200 HTTP a.content.alteriw.net /iw5m//iw5m-client/zone/english/patch_so_ied_berlin.ff.lzma 0 application/octet-stream altermw3:2232 [#56] 57 206 HTTP a.content.alteriw.net /iw5m//iw5m-client/zone/english/patch_so_ied_berlin.ff.lzma 7.537 application/octet-stream altermw3:2232 [#57] 58 200 HTTP a.content.alteriw.net /iw5m//iw5m-client/zone/english/patch_so_littlebird_payback.ff.lzma 0 application/octet-stream altermw3:2232 [#58] 59 206 HTTP a.content.alteriw.net /iw5m//iw5m-client/zone/english/patch_so_littlebird_payback.ff.lzma 156 application/octet-stream altermw3:2232 [#59] 60 200 HTTP a.content.alteriw.net /iw5m//iw5m-client/zone/english/patch_so_survival_mp_bootleg.ff.lzma 0 application/octet-stream altermw3:2232 [#60] 61 206 HTTP a.content.alteriw.net /iw5m//iw5m-client/zone/english/patch_so_survival_mp_bootleg.ff.lzma 872 application/octet-stream altermw3:2232 [#61] 62 200 HTTP a.content.alteriw.net /iw5m//iw5m-client/zone/english/patch_so_survival_mp_dome.ff.lzma 0 application/octet-stream altermw3:2232 [#62] 63 206 HTTP a.content.alteriw.net /iw5m//iw5m-client/zone/english/patch_so_survival_mp_dome.ff.lzma 603 application/octet-stream altermw3:2232 [#63] 64 200 HTTP a.content.alteriw.net /iw5m//iw5m-client/zone/english/patch_so_survival_mp_village.ff.lzma 0 application/octet-stream altermw3:2232 [#64] 65 206 HTTP a.content.alteriw.net /iw5m//iw5m-client/zone/english/patch_so_survival_mp_village.ff.lzma 351 application/octet-stream altermw3:2232 [#65] 66 200 HTTP a.content.alteriw.net /iw5m//iw5m-client/zone/english/patch_so_zodiac2_ny_harbor.ff.lzma 0 application/octet-stream altermw3:2232 [#66] 67 206 HTTP a.content.alteriw.net /iw5m//iw5m-client/zone/english/patch_so_zodiac2_ny_harbor.ff.lzma 869 application/octet-stream altermw3:2232 [#67] 68 200 HTTP a.content.alteriw.net /iw5m//iw5m-client/zone/english/patch_specialops.ff.lzma 0 application/octet-stream altermw3:2232 [#68] 69 206 HTTP a.content.alteriw.net /iw5m//iw5m-client/zone/english/patch_specialops.ff.lzma 84.220 application/octet-stream altermw3:2232 [#69] 70 200 HTTP a.content.alteriw.net /iw5m//iw5m-client/zone/english/patch_sp_berlin.ff.lzma 0 application/octet-stream altermw3:2232 [#70] 71 206 HTTP a.content.alteriw.net /iw5m//iw5m-client/zone/english/patch_sp_berlin.ff.lzma 315 application/octet-stream altermw3:2232 [#71] 72 200 HTTP a.content.alteriw.net /iw5m//iw5m-client/zone/english/patch_sp_intro.ff.lzma 0 application/octet-stream altermw3:2232 [#72] 73 206 HTTP a.content.alteriw.net /iw5m//iw5m-client/zone/english/patch_sp_intro.ff.lzma 1.223 application/octet-stream altermw3:2232 [#73] 74 200 HTTP a.content.alteriw.net /iw5m//iw5m-client/zone/english/patch_sp_ny_harbor.ff.lzma 0 application/octet-stream altermw3:2232 [#74] 75 206 HTTP a.content.alteriw.net /iw5m//iw5m-client/zone/english/patch_sp_ny_harbor.ff.lzma 1.239 application/octet-stream altermw3:2232 [#75] 76 200 HTTP a.content.alteriw.net /iw5m//iw5m-client/zone/english/patch_sp_ny_manhattan.ff.lzma 0 application/octet-stream altermw3:2232 [#76] 77 206 HTTP a.content.alteriw.net /iw5m//iw5m-client/zone/english/patch_sp_ny_manhattan.ff.lzma 440 application/octet-stream altermw3:2232 [#77] 78 200 HTTP a.content.alteriw.net /iw5m//iw5m-client/zone/english/patch_sp_warlord.ff.lzma 0 application/octet-stream altermw3:2232 [#78] 79 206 HTTP a.content.alteriw.net /iw5m//iw5m-client/zone/english/patch_sp_warlord.ff.lzma 131.830 application/octet-stream altermw3:2232 [#79] 80 200 HTTP a.content.alteriw.net /iw5m//iw5m-client/zone/english/patch_survival.ff.lzma 0 application/octet-stream altermw3:2232 [#80] 81 206 HTTP a.content.alteriw.net /iw5m//iw5m-client/zone/english/patch_survival.ff.lzma 238.694 application/octet-stream altermw3:2232 [#81] 82 200 HTTP a.content.alteriw.net /iw5m//iw5m-client/zone/english/ui.ff.lzma 0 application/octet-stream altermw3:2232 [#82] 83 206 HTTP a.content.alteriw.net /iw5m//iw5m-client/zone/english/ui.ff.lzma 288.049 application/octet-stream altermw3:2232 [#83] 84 200 HTTP a.content.alteriw.net /iw5m//iw5m-client/zone/english/ui_mp.ff.lzma 0 application/octet-stream altermw3:2232 [#84] 85 206 HTTP a.content.alteriw.net /iw5m//iw5m-client/zone/english/ui_mp.ff.lzma 22.554 application/octet-stream altermw3:2232 [#85] 86 200 HTTP a.content.alteriw.net /iw5m//iw5m-client/main/iw_23.iwd.lzma 0 application/octet-stream altermw3:2232 [#86] 87 206 HTTP a.content.alteriw.net /iw5m//iw5m-client/main/iw_23.iwd.lzma 1.250.656 application/octet-stream altermw3:2232 [#87]
aIW Client Decompiled.zip -
https://www.virustotal.com/file/113e...is/1328737077/
Originally Posted by Anonymous..
