RedKit - Payload Memory Strings 20120112-4

jjjjjj
EPMQUR
UREP
REPMQ
jjjjh
\fXNgb
!This program cannot be run in DOS mode.
Rich
.text
`.rdata
@.data
.reloc
QVW3
jDj
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
time
strcpy
strchr
rand
srand
MessageBoxA
GetCursorPos
wsprintfA
InternetReadFile
InternetCloseHandle
InternetOpenUrlA
InternetOpenA
Sleep
ExitProcess
Process32Next
Process32First
CreateToolhelp32Snapshot
VirtualFree
CreateRemoteThread
WriteProcessMemory
VirtualAllocEx
VirtualAlloc
GetModuleHandleA
lstrcmpiA
OpenProcess
GetCurrentProcess
ExitThread
LoadLibraryExA
GetProcAddress
HeapAlloc
GetProcessHeap
GetTickCount
OpenMutexA
CreateMutexA
WinExec
CloseHandle
WriteFile
CreateFileA
lstrlenA
lstrcatA
GetTempFileNameA
GetTempPathA
lstrcpyA
DeleteFileA
CreateProcessA
GetComputerNameA
GetModuleFileNameA
0123456789abcdef
advapi32.dll
msvcrt.dll
user32.dll
wininet.dll
kernel32.dll
cmd.exe /c ping -n 1 -w 2000 192.168.123.254 > nul & del %s
SeDebugPrivilege
http://basement-gallery.com/h.htm
http://craportuense.com/i.htm
http://ouedknouz.com/c.htm
http://stevenyang.ca/p.htm
http://orderindiantoronto.com/k.htm
http://goediving.com/g.htm
http://ex9.com.br/t.htm
http://boersenkeller-frankfurt.de/w.htm
http://cash.taxi-soyuz.ru/l.htm
http://triathlonclub.sakura.ne.jp/o.htm
Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.0; Trident/5.0)
Xi3FVneIx
c:\documents and settings\USER\
v\setup.exe
WgvZZgv
Mgv
3b4c8192a3b83565bbb74665e969f800
1;2@2J2O2X2^2
3#3(33383A3G3l3w3
3;4E4O4j4r4w4
5)6=6S6i6w6
868@8U8b8n8
9(9<9F9h9n9
0 0$0(0,0004080<0@0D0H0L0P0T0X0\0`0d0h0l0p0t0x0|0