Remote Host Port Number 80 80 80 80 80 80 1234 PASS xxx

MODE NEW-[USA|00|P|54399] -ix
JOIN #!nn! test
NICK NEW-[USA|00|P|54399]

Invisible Users: 1
Operators: 1 operator(s) online
Channels: 7 channels formed
Clients: I have 2139 clients and 0 servers
Local users: Current local users: 2139 Max: 4923
Global users: Current global users: 2139 Max: 4923

Now talking in #!nn!
Topic On: [ #!nn! ] [ .m.s|.m.e foto 😉 http://www.facebook.gcfmv.org/photo_id.php?= ]
Topic By: [ Niggerbot ]

* The data identified by the following URLs was then requested from the remote web server:
o http://browseusers.myspace.com/Browse/Browse.aspx
o http://js.myspacecdn.com/modules/browse/static/js/browsebundle_kwg2eboy.js
o http://x.myspacecdn.com/modules/common/static/img/onlinenow2.gif
o http://x.myspacecdn.com/modules/splash/static/img/bgSheet.png
o http://x.myspacecdn.com/modules/splash/static/img/moduleBg.gif
o http://x.myspacecdn.com/Modules/Common/Static/img/cornersSheet3.png
o http://x.myspacecdn.com/modules/common/static/css/Sprites/globalNavRefreshSprite.png
o http://x.myspacecdn.com/modules/browse/static/img/btnicons_tiled.gif
o http://x.myspacecdn.com/modules/common/static/css/global_c4kr8f-5.css
o http://x.myspacecdn.com/modules/common/static/css/uploadcontrol_ioe1imsn.css
o http://x.myspacecdn.com/modules/browse/static/css/browse_qiz4yewv.css
o http://x.myspacecdn.com/modules/profilesdirectory/static/css/browsebyname_4vb3esmf.css
o http://x.myspacecdn.com/modules/common/static/img/spacer.gif
o http://googleads.g.doubleclick.net/pagead/test_domain.js
o http://pagead2.googlesyndication.com/pagead/show_ads.js
o http://pagead2.googlesyndication.com/pagead/render_ads.js

* The following ports were open in the system:

Port Protocol Process
1057 TCP jusched.exe (%Windir%jusched.exe)
1063 TCP jusched.exe (%Windir%jusched.exe)

Registry Modifications

* The newly created Registry Values are:
o [HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun]
+ Java developer Script Browse = “%Windir%jusched.exe”

so that jusched.exe runs every time Windows starts
o [HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionTerminal ServerInstallSoftwareMicrosoftWindowsCurrentVersionRun]
+ Java developer Script Browse = “%Windir%jusched.exe”

so that jusched.exe runs every time Windows starts
o [HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionRun]
+ Java developer Script Browse = “%Windir%jusched.exe”

so that jusched.exe runs every time Windows starts

Memory Modifications

* There was a new process created in the system:

Process Name Process Filename Main Module Size
jusched.exe %Windir%jusched.exe 3 141 632 bytes

* The following system service was modified:

Service Name Display Name New Status Service Filename
wuauserv Automatic Updates “Stopped” %System%svchost.exe -k netsvcs

File System Modifications

* The following file was created in the system:

# Filename(s) File Size File Hash
1 %Windir%jusched.exe
[file and pathname of the sample #1] 143 360 bytes MD5: 0x477378D764DC7AEBB69596CDD0267A61
SHA-1: 0x8744EAF60E23EE6DDAABF70AEBBF8988558A3D1D

Categories: Uncategorized