Trojan.Win32.IEDummy_396bd4470d – Adaware

not-a-virus:HEUR:AdWare.Win32.SoftPulse.heur (Kaspersky), Trojan.Win32.IEDummy.FD, Trojan.Win32.Swrort.3.FD, mzpefinder_pcap_file.YR (Lavasoft MAS)Behaviour: Trojan, Adware

The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.

Summary

MD5: 396bd4470d5e0694ebd37ef578212ae0

SHA1: 171e97ce624c49844d2bc626405ddb5e435d053d

SHA256: 2e9a5eb29451b58afff81da8f510d9a031df31cb07cead07ae56fd1fe28c351e

SSDeep: 12288:As9eJNhvHIzi0SRHxmVUOXem8MXv4LnroIEf/bWjD5bCETr CAImjCcj04PYi1:As9eJTyil8UOX9xXv4von/KhbjTzAYg

Size: 692680 bytes

File type: EXE

Platform: WIN32

Entropy: Packed

PEID: UPolyXv05_v6

Company: no certificate found

Created at: 2015-12-30 11:08:49

Analyzed on: WindowsXP SP3 32-bit

Summary: Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).

Dynamic Analysis

Payload

No specific payload has been found.

Process activity

The Trojan creates the following process(es):

LTV2.exe:1328
LTV2.exe:912
mixvideoplayersetup.exe:224

The Trojan injects its code into the following process(es):

%original file name%.exe:272
MixVideoPlayer.exe:2548

Mutexes

The following mutexes were created/opened:No objects were found.

File activity

The process %original file name%.exe:272 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\style[1].css (114 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\desktop.ini (159 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\progress-level[1].png (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\MixVideoPlayerSetup[1].exe (1750362 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\loading-install[1].gif (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\i-download[1].png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\msjava[1].dll (465777 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\progress-bar[1].png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\style[1].css (11995 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\bullet-short[1].gif (54 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\desktop.ini (67 bytes)
%System%\wbem\Logs\wbemprox.log (225 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Setup Wizard\0d2b223b-a78d-4f28-97f9-a2022b7c8da0\mixvideoplayersetup.exe (1750362 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\MixVideoPlayerSetup[1].exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\dd49bd219cbd01f57c0247abd593edaec102a939928946cbd3305ab43ea5cab1b917e59fbda789e62c197bc3a2ad35431925a7e64db7be00[1].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\04a6907ac555a4db3bae8fe38443eddaf5b0b41c05f2b5fb3f09bbeb82d024c435ee728ae2c00f4d189177cd993b2b7a79a5c798dbfa0fdb[1].txt (0 bytes)

The process mixvideoplayersetup.exe:224 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Program Files%\MixVideoPlayer\Languages\ChineseT.ini (3 bytes)
%Program Files%\MixVideoPlayer\LTV2.exe (6 bytes)
%Program Files%\MixVideoPlayer\Controls\ifishplayer-icon2.ico (12536 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nst3.tmp\NSISdl.dll (14 bytes)
%Program Files%\MixVideoPlayer\Languages\Polish.ini (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nst3.tmp\SimpleSC.dll (1856 bytes)
%Program Files%\MixVideoPlayer\Languages\Swedish.ini (3 bytes)
%Program Files%\MixVideoPlayer\Languages\Ukrainian.ini (5 bytes)
%Program Files%\MixVideoPlayer\FrameworkControl.exe (14184 bytes)
%Program Files%\MixVideoPlayer\Languages\Lithuanian.ini (3 bytes)
%Program Files%\MixVideoPlayer\Microsoft.Win32.TaskScheduler.dll (8560 bytes)
%Program Files%\MixVideoPlayer\references\Newtonsoft.Json.dll (15536 bytes)
%Program Files%\MixVideoPlayer\policy.2.0.taglib-sharp.dll (3 bytes)
%Program Files%\MixVideoPlayer\Languages\Indonesian.ini (3 bytes)
%Program Files%\MixVideoPlayer\references\ffmpeg.exe (202301 bytes)
%Program Files%\MixVideoPlayer\Languages\Portuguese.ini (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nst3.tmp\AccessControl.dll (13 bytes)
%Program Files%\MixVideoPlayer\Languages\HaitianCreole.ini (3 bytes)
%Program Files%\MixVideoPlayer\Languages\Arabic.ini (4 bytes)
%Program Files%\MixVideoPlayer\Languages\Turkish.ini (3 bytes)
%Program Files%\MixVideoPlayer\Languages\Catalan.ini (3 bytes)
%Program Files%\MixVideoPlayer\Languages\ChineseS.ini (3 bytes)
%Program Files%\MixVideoPlayer\Languages\Hebrew.ini (4 bytes)
%Program Files%\MixVideoPlayer\Languages\Dutch.ini (3 bytes)
%Program Files%\MixVideoPlayer\dotNetFx40_Full_setup.exe (30344 bytes)
%Program Files%\MixVideoPlayer\mixvideoplayer.affcode (3 bytes)
%Program Files%\MixVideoPlayer\Windows\Thumbs.db (1856 bytes)
%Program Files%\MixVideoPlayer\Languages\Slovak.ini (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nst3.tmp\ZipDLL.dll (6360 bytes)
%Program Files%\MixVideoPlayer\Languages\Finnish.ini (3 bytes)
%Program Files%\MixVideoPlayer\icon.ico (12536 bytes)
%Program Files%\MixVideoPlayer\mixvideoplayer.uidnum (23 bytes)
%Program Files%\MixVideoPlayer\references\policy.2.0.taglib-sharp.dll (3 bytes)
%Program Files%\MixVideoPlayer\Languages\English.ini (3 bytes)
%Program Files%\MixVideoPlayer\Languages\Latvian.ini (3 bytes)
%Program Files%\MixVideoPlayer\policy.2.0.taglib-sharp.config (377 bytes)
%Program Files%\MixVideoPlayer\Languages\Thai.ini (5 bytes)
%Program Files%\MixVideoPlayer\references\extvideo.png (146 bytes)
%Program Files%\MixVideoPlayer\references\folder.png (472 bytes)
%Program Files%\MixVideoPlayer\BrowserWeb.exe (4992 bytes)
%Program Files%\MixVideoPlayer\references\extaudio.png (310 bytes)
%Program Files%\MixVideoPlayer\Languages\Spanish.ini (3 bytes)
%Program Files%\MixVideoPlayer\references\taglib-sharp.dll (15536 bytes)
%Program Files%\MixVideoPlayer\references\policy.2.0.taglib-sharp.config (377 bytes)
%Program Files%\MixVideoPlayer\references\Interop.SHDocVw.dll (5064 bytes)
%Program Files%\MixVideoPlayer\Languages\Russian.ini (5 bytes)
%Program Files%\MixVideoPlayer\taglib-sharp.dll (15536 bytes)
%Program Files%\MixVideoPlayer\mixUpdater.exe (13368 bytes)
%Program Files%\MixVideoPlayer\references\NDde.dll (3616 bytes)
%Program Files%\MixVideoPlayer\Snowplow.Tracker.dll (784 bytes)
%Program Files%\MixVideoPlayer\MixVideoPlayer.exe (83154 bytes)
%Program Files%\MixVideoPlayer\Languages\Slovenian.ini (3 bytes)
%Program Files%\MixVideoPlayer\DeleteTasks.exe (10 bytes)
%Program Files%\MixVideoPlayer\references\Thumbs.db (5 bytes)
%Program Files%\MixVideoPlayer\references\libreria.png (244 bytes)
%Program Files%\MixVideoPlayer\Languages\Norwegian.ini (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsd2.tmp (178105 bytes)
%Program Files%\MixVideoPlayer\Languages\Japanese.ini (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nst3.tmp\nsProcess.dll (4 bytes)
%Program Files%\MixVideoPlayer\Languages\Greek.ini (5 bytes)
%Program Files%\MixVideoPlayer\Languages\Danish.ini (3 bytes)
%Program Files%\MixVideoPlayer\Languages\Bulgarian.ini (5 bytes)
%Program Files%\MixVideoPlayer\Languages\Hindi.ini (6 bytes)
%Program Files%\MixVideoPlayer\Languages\German.ini (3 bytes)
%Program Files%\MixVideoPlayer\NLog.dll (14184 bytes)
%Program Files%\MixVideoPlayer\references\PhotoLoader.dll (784 bytes)
%Program Files%\MixVideoPlayer\Languages\Italian.ini (3 bytes)
%Program Files%\MixVideoPlayer\Languages\Korean.ini (3 bytes)
%Program Files%\MixVideoPlayer\PhotoLoader.dll (784 bytes)
%Program Files%\MixVideoPlayer\Languages\Czech.ini (3 bytes)
%Program Files%\MixVideoPlayer\Languages\Romanian.ini (3 bytes)
%Program Files%\MixVideoPlayer\Languages\Hungarian.ini (3 bytes)
%Program Files%\MixVideoPlayer\icon-uninstall.ico (3616 bytes)
%Program Files%\MixVideoPlayer\references\mixChecker.exe (27704 bytes)
%Program Files%\MixVideoPlayer\references\ffmpeg.zip (862334 bytes)
%Program Files%\MixVideoPlayer\Sider.dll (5064 bytes)
%Program Files%\MixVideoPlayer\LTVNetSdk.dll (15 bytes)
%Program Files%\MixVideoPlayer\Languages\French.ini (3 bytes)
%Program Files%\MixVideoPlayer\Languages\Vietnamese.ini (4 bytes)
%Program Files%\MixVideoPlayer\Controls\Thumbs.db (1552 bytes)
%Program Files%\MixVideoPlayer\Newtonsoft.Json.dll (16944 bytes)
%Program Files%\MixVideoPlayer\Languages\Estonian.ini (3 bytes)
%Program Files%\MixVideoPlayer\Windows\logopeq-icon.ico (9608 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nsy1.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nst3.tmp (0 bytes)

Registry activity

The process %original file name%.exe:272 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache]
"@xpsp3res.dll,-20001" = "Diagnose Connection Problems..."

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\DirectDraw\MostRecentApplication]
"Name" = "%original file name%.exe"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1B 00 00 00 01 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Microsoft\DirectDraw\MostRecentApplication]
"ID" = "1451466529"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "A7 D1 44 3B 04 0F FD A0 76 69 CA 9A AC 0F 61 1C"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%Documents and Settings%\%current user%\Local Settings\Application Data\Setup Wizard\0d2b223b-a78d-4f28-97f9-a2022b7c8da0]
"mixvideoplayersetup.exe" = "mixvideoplayersetup"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%Program Files%\Internet Explorer]
"iexplore.exe" = "Internet Explorer"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process LTV2.exe:1328 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "18 11 C9 11 5A 1B E5 1E 17 F9 B0 33 C9 5E EB 0D"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy\traceIdentifier]
"Guid" = "5f31090b-d990-4e91-b16d-46121d0255aa"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil\traceIdentifier]
"Guid" = "8aefce96-4618-42ff-a057-3536aa78233e"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy]
"Active" = "1"

[HKLM\System\CurrentControlSet\Services\Eventlog\Application\ESENT]
"CategoryMessageFile" = "%System%\ESENT.dll"
"EventMessageFile" = "%System%\ESENT.dll"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg\traceIdentifier]
"BitNames" = " Error Unusual Info Debug"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg]
"Active" = "1"

[HKLM\System\CurrentControlSet\Services\Eventlog\Application\ESENT]
"TypesSupported" = "7"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil]
"Active" = "1"
"ControlFlags" = "1"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil\traceIdentifier]
"BitNames" = " Error Unusual Info Debug"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy\traceIdentifier]
"BitNames" = " Error Unusual Info Debug"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy]
"LogSessionName" = "stdout"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil]
"LogSessionName" = "stdout"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg\traceIdentifier]
"Guid" = "5f31090b-d990-4e91-b16d-46121d0255aa"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg]
"ControlFlags" = "1"

[HKLM\System\CurrentControlSet\Services\Eventlog\Application\ESENT]
"CategoryCount" = "16"

[HKLM\SOFTWARE\Microsoft\ESENT\Process\LTV2\DEBUG]
"Trace Level" = ""

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg]
"LogSessionName" = "stdout"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy]
"ControlFlags" = "1"

The Trojan deletes the following value(s) in system registry:

[HKLM\SOFTWARE\Microsoft\ESENT\Process\LTV2\DEBUG]
"Trace Level"

The process LTV2.exe:912 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "EF 4B D7 DA D3 B7 0B F5 FC ED 4E C4 7C 4A F0 B0"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy\traceIdentifier]
"Guid" = "5f31090b-d990-4e91-b16d-46121d0255aa"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil\traceIdentifier]
"Guid" = "8aefce96-4618-42ff-a057-3536aa78233e"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy]
"Active" = "1"

[HKLM\System\CurrentControlSet\Services\Eventlog\Application\ESENT]
"CategoryMessageFile" = "%System%\ESENT.dll"
"EventMessageFile" = "%System%\ESENT.dll"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg\traceIdentifier]
"BitNames" = " Error Unusual Info Debug"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg]
"Active" = "1"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil]
"Active" = "1"
"ControlFlags" = "1"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil\traceIdentifier]
"BitNames" = " Error Unusual Info Debug"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy\traceIdentifier]
"BitNames" = " Error Unusual Info Debug"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy]
"LogSessionName" = "stdout"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil]
"LogSessionName" = "stdout"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg\traceIdentifier]
"Guid" = "5f31090b-d990-4e91-b16d-46121d0255aa"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg]
"ControlFlags" = "1"

[HKLM\System\CurrentControlSet\Services\Eventlog\Application\ESENT]
"CategoryCount" = "16"
"TypesSupported" = "7"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg]
"LogSessionName" = "stdout"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy]
"ControlFlags" = "1"

The process mixvideoplayersetup.exe:224 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKCR\Applications\MixVideoPlayer.exe\SupportedTypes]
".AAC" = ""
".mov" = ""
".MP3" = ""
".mp4" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

[HKCR\Applications\MixVideoPlayer.exe\SupportedTypes]
".3gp" = ""
".mpeg" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCR\Applications\MixVideoPlayer.exe]
"(Default)" = ""

[HKCR\Applications\MixVideoPlayer.exe\SupportedTypes]
".aif" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCR\Applications\MixVideoPlayer.exe\SupportedTypes]
".mpg" = ""

[HKCR\Applications\MixVideoPlayer.exe\shell\Play\command]
"(Default)" = "%Program Files%\MixVideoPlayer\MixVideoPlayer.exe /m %1"

[HKCR\Applications\MixVideoPlayer.exe\SupportedTypes]
".flv" = ""
".WAV" = ""

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "9D 7B B7 D9 E8 E0 04 5E FE 69 E3 A3 33 9E B9 AB"

[HKCR\Applications\MixVideoPlayer.exe\SupportedTypes]
".avi" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCR\Applications\MixVideoPlayer.exe\SupportedTypes]
".wma" = ""
".divx" = ""

[HKCR\Applications\MixVideoPlayer.exe]
"FriendlyAppName" = "MixVideoPlayer"

[HKCR\Applications\MixVideoPlayer.exe\SupportedTypes]
".mkv" = ""
".wmv" = ""

Dropped PE files

MD5	File path
9d9147395142b4e086f1119e67513b5d	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\Setup Wizard\0d2b223b-a78d-4f28-97f9-a2022b7c8da0\mixvideoplayersetup.exe
a5f8399a743ab7f9c88c645c35b1ebb5	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nst3.tmp\NSISdl.dll
d63975ce28f801f236c4aca5af726961	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nst3.tmp\SimpleSC.dll
faa7f034b38e729a983965c04cc70fc1	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nst3.tmp\nsProcess.dll
67986ec074b86590e110a76480f7da99	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\msjava[1].dll
9d9147395142b4e086f1119e67513b5d	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\MixVideoPlayerSetup[1].exe
c56aa0c915ded810350bb3873704a6e6	c:\Program Files\MixVideoPlayer\references\Interop.SHDocVw.dll
c1c7beb5231bb058c1a669a05b8701ca	c:\Program Files\MixVideoPlayer\references\NDde.dll
1232f5d749700a818908cc163befed18	c:\Program Files\MixVideoPlayer\references\Newtonsoft.Json.dll
ad26d090ecf26d18496c9e3f44a7141d	c:\Program Files\MixVideoPlayer\references\PhotoLoader.dll
2ce9d6746d60f3f3905dcf15c996a01d	c:\Program Files\MixVideoPlayer\references\mixChecker.exe
1910d297328aec93214fbc1cdab6b3cf	c:\Program Files\MixVideoPlayer\references\policy.2.0.taglib-sharp.dll
3fd25de85281f92de0d4e4a6b7bdb03e	c:\Program Files\MixVideoPlayer\references\taglib-sharp.dll

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

Removals

Remove it with Ad-Aware

Click (here) to download and install Ad-Aware Free Antivirus.
Update the definition files.
Run a full scan of your computer.

Manual removal*

Terminate malicious process(es) (How to End a Process With the Task Manager):
LTV2.exe:1328
LTV2.exe:912
mixvideoplayersetup.exe:224
Delete the original Trojan file.
Delete or disinfect the following files created/modified by the Trojan:
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\style[1].css (114 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\desktop.ini (159 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\progress-level[1].png (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\MixVideoPlayerSetup[1].exe (1750362 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\loading-install[1].gif (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\i-download[1].png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\msjava[1].dll (465777 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\progress-bar[1].png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\style[1].css (11995 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\bullet-short[1].gif (54 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\desktop.ini (67 bytes)
%System%\wbem\Logs\wbemprox.log (225 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Setup Wizard\0d2b223b-a78d-4f28-97f9-a2022b7c8da0\mixvideoplayersetup.exe (1750362 bytes)
%Program Files%\MixVideoPlayer\Languages\ChineseT.ini (3 bytes)
%Program Files%\MixVideoPlayer\LTV2.exe (6 bytes)
%Program Files%\MixVideoPlayer\Controls\ifishplayer-icon2.ico (12536 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nst3.tmp\NSISdl.dll (14 bytes)
%Program Files%\MixVideoPlayer\Languages\Polish.ini (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nst3.tmp\SimpleSC.dll (1856 bytes)
%Program Files%\MixVideoPlayer\Languages\Swedish.ini (3 bytes)
%Program Files%\MixVideoPlayer\Languages\Ukrainian.ini (5 bytes)
%Program Files%\MixVideoPlayer\FrameworkControl.exe (14184 bytes)
%Program Files%\MixVideoPlayer\Languages\Lithuanian.ini (3 bytes)
%Program Files%\MixVideoPlayer\Microsoft.Win32.TaskScheduler.dll (8560 bytes)
%Program Files%\MixVideoPlayer\references\Newtonsoft.Json.dll (15536 bytes)
%Program Files%\MixVideoPlayer\policy.2.0.taglib-sharp.dll (3 bytes)
%Program Files%\MixVideoPlayer\Languages\Indonesian.ini (3 bytes)
%Program Files%\MixVideoPlayer\references\ffmpeg.exe (202301 bytes)
%Program Files%\MixVideoPlayer\Languages\Portuguese.ini (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nst3.tmp\AccessControl.dll (13 bytes)
%Program Files%\MixVideoPlayer\Languages\HaitianCreole.ini (3 bytes)
%Program Files%\MixVideoPlayer\Languages\Arabic.ini (4 bytes)
%Program Files%\MixVideoPlayer\Languages\Turkish.ini (3 bytes)
%Program Files%\MixVideoPlayer\Languages\Catalan.ini (3 bytes)
%Program Files%\MixVideoPlayer\Languages\ChineseS.ini (3 bytes)
%Program Files%\MixVideoPlayer\Languages\Hebrew.ini (4 bytes)
%Program Files%\MixVideoPlayer\Languages\Dutch.ini (3 bytes)
%Program Files%\MixVideoPlayer\dotNetFx40_Full_setup.exe (30344 bytes)
%Program Files%\MixVideoPlayer\mixvideoplayer.affcode (3 bytes)
%Program Files%\MixVideoPlayer\Windows\Thumbs.db (1856 bytes)
%Program Files%\MixVideoPlayer\Languages\Slovak.ini (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nst3.tmp\ZipDLL.dll (6360 bytes)
%Program Files%\MixVideoPlayer\Languages\Finnish.ini (3 bytes)
%Program Files%\MixVideoPlayer\icon.ico (12536 bytes)
%Program Files%\MixVideoPlayer\mixvideoplayer.uidnum (23 bytes)
%Program Files%\MixVideoPlayer\references\policy.2.0.taglib-sharp.dll (3 bytes)
%Program Files%\MixVideoPlayer\Languages\English.ini (3 bytes)
%Program Files%\MixVideoPlayer\Languages\Latvian.ini (3 bytes)
%Program Files%\MixVideoPlayer\policy.2.0.taglib-sharp.config (377 bytes)
%Program Files%\MixVideoPlayer\Languages\Thai.ini (5 bytes)
%Program Files%\MixVideoPlayer\references\extvideo.png (146 bytes)
%Program Files%\MixVideoPlayer\references\folder.png (472 bytes)
%Program Files%\MixVideoPlayer\BrowserWeb.exe (4992 bytes)
%Program Files%\MixVideoPlayer\references\extaudio.png (310 bytes)
%Program Files%\MixVideoPlayer\Languages\Spanish.ini (3 bytes)
%Program Files%\MixVideoPlayer\references\taglib-sharp.dll (15536 bytes)
%Program Files%\MixVideoPlayer\references\policy.2.0.taglib-sharp.config (377 bytes)
%Program Files%\MixVideoPlayer\references\Interop.SHDocVw.dll (5064 bytes)
%Program Files%\MixVideoPlayer\Languages\Russian.ini (5 bytes)
%Program Files%\MixVideoPlayer\taglib-sharp.dll (15536 bytes)
%Program Files%\MixVideoPlayer\mixUpdater.exe (13368 bytes)
%Program Files%\MixVideoPlayer\references\NDde.dll (3616 bytes)
%Program Files%\MixVideoPlayer\Snowplow.Tracker.dll (784 bytes)
%Program Files%\MixVideoPlayer\MixVideoPlayer.exe (83154 bytes)
%Program Files%\MixVideoPlayer\Languages\Slovenian.ini (3 bytes)
%Program Files%\MixVideoPlayer\DeleteTasks.exe (10 bytes)
%Program Files%\MixVideoPlayer\references\Thumbs.db (5 bytes)
%Program Files%\MixVideoPlayer\references\libreria.png (244 bytes)
%Program Files%\MixVideoPlayer\Languages\Norwegian.ini (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsd2.tmp (178105 bytes)
%Program Files%\MixVideoPlayer\Languages\Japanese.ini (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nst3.tmp\nsProcess.dll (4 bytes)
%Program Files%\MixVideoPlayer\Languages\Greek.ini (5 bytes)
%Program Files%\MixVideoPlayer\Languages\Danish.ini (3 bytes)
%Program Files%\MixVideoPlayer\Languages\Bulgarian.ini (5 bytes)
%Program Files%\MixVideoPlayer\Languages\Hindi.ini (6 bytes)
%Program Files%\MixVideoPlayer\Languages\German.ini (3 bytes)
%Program Files%\MixVideoPlayer\NLog.dll (14184 bytes)
%Program Files%\MixVideoPlayer\references\PhotoLoader.dll (784 bytes)
%Program Files%\MixVideoPlayer\Languages\Italian.ini (3 bytes)
%Program Files%\MixVideoPlayer\Languages\Korean.ini (3 bytes)
%Program Files%\MixVideoPlayer\PhotoLoader.dll (784 bytes)
%Program Files%\MixVideoPlayer\Languages\Czech.ini (3 bytes)
%Program Files%\MixVideoPlayer\Languages\Romanian.ini (3 bytes)
%Program Files%\MixVideoPlayer\Languages\Hungarian.ini (3 bytes)
%Program Files%\MixVideoPlayer\icon-uninstall.ico (3616 bytes)
%Program Files%\MixVideoPlayer\references\mixChecker.exe (27704 bytes)
%Program Files%\MixVideoPlayer\references\ffmpeg.zip (862334 bytes)
%Program Files%\MixVideoPlayer\Sider.dll (5064 bytes)
%Program Files%\MixVideoPlayer\LTVNetSdk.dll (15 bytes)
%Program Files%\MixVideoPlayer\Languages\French.ini (3 bytes)
%Program Files%\MixVideoPlayer\Languages\Vietnamese.ini (4 bytes)
%Program Files%\MixVideoPlayer\Controls\Thumbs.db (1552 bytes)
%Program Files%\MixVideoPlayer\Newtonsoft.Json.dll (16944 bytes)
%Program Files%\MixVideoPlayer\Languages\Estonian.ini (3 bytes)
%Program Files%\MixVideoPlayer\Windows\logopeq-icon.ico (9608 bytes)
Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
Reboot the computer.

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

VersionInfo

No information is available.

PE Sections

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Section MD5
UPX0	4096	1077248	0	0	d41d8cd98f00b204e9800998ecf8427e
UPX1	1081344	651264	647680	5.48292	965601d460f04e6bb187e41bb33a764d
.rsrc	1732608	40960	37376	4.15399	b029648113a76b9b9074c82964026a14

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Total found: 295
2ebc77007317b3984401b2395ce3b045
69bbf6ba378cad4cf4cf094f5af6b122
202a147c91949bbbf55288beaae2ac36
223898169676d4f4e70d01ead1124683
f06e17e72aef96178cda1ccc7deed644
42a68511943dc378c005ca54bf06723b
b9db4f80a07c2269856225636c125d5d
d7b0f0f6e90269b731a0fe94145a8537
9da2cc631ee3e7d03f32b47310427634
87003c9a7bf843eafc36dac02daf376c
69d6b5ab710559371cbc48cdcbbc255f
bff89fe3a5cc571efbe296e60ebc4d0b
f914908774a7ececa6cec2c5e7bed74c
fa8076ba093eb87c310b5a4f732a1043
d08e34d9c9f8215195b49bc102e80511
a2019832037d56b4b06537532f96b68c
fd90aed79221c2df74aa1fd18b7ff801
8deb6be1ae61cce0f6250280e3f273ad
8bb75a0398b4d098221f2713f85fdbde
41e105e5d45e7ae62ced20e5f575934d
caeeb1aeb8294f1907c90033467e5f73
7a48b7344157d0c443722ac8478c8ff9
bb4f17cbdf697dc9ad1bfa3798ec0a91
94fa777dfc88672815b1462451c10640
730645be6ffce7d48401752e3e14efaa
77f890ff333f7363dd48e7e0c2f7ff3e

Network Activity

URLs

URL	IP
hxxp://api.youmagnos.com/	54.148.207.14
hxxp://static.youmagnos.com/d5/msjava.dll	52.32.70.45
hxxp://api.youmagnos.com/99337b01e9530b69b86fc1310859167cbcc79c09381bc88879fecbc51ff412bed8543ea82eecf9a6bd28bf7f8c115b7f28655687cc58f0d79110a91fe105cca827b5ea24c1b89ed9e8077f57a58a710fc6659e643e819a8ddcb3e46fa8cfe52769081b031bdc66cc	54.148.207.14
hxxp://api.youmagnos.com/04a6907ac555a4db3bae8fe38443eddaf5b0b41c05f2b5fb3f09bbeb82d024c435ee728ae2c00f4d189177cd993b2b7a79a5c798dbfa0fdb	54.148.207.14
hxxp://api.youmagnos.com/maxpower-static/templates/2014/09/8bc54d8e-3fdf-11e4-8f9b-06a3579b0dab/css/style.css	54.148.207.14
hxxp://api.youmagnos.com/__maxpower__/render_template/2014/09/8bc54d8e-3fdf-11e4-8f9b-06a3579b0dab?language_code=en	54.148.207.14
hxxp://api.youmagnos.com/maxpower-static/apps/34/68794/css/style.css	54.148.207.14
hxxp://api.youmagnos.com/__maxpower__/render_screen/2014/11/d1187d84-6a69-11e4-b052-06a3579b0dab/screen_variation=I_link	54.148.207.14
hxxp://api.youmagnos.com/maxpower-static/templates/2014/09/8bc54d8e-3fdf-11e4-8f9b-06a3579b0dab/css/images/i-download.png	54.148.207.14
hxxp://api.youmagnos.com/maxpower-static/templates/2014/09/8bc54d8e-3fdf-11e4-8f9b-06a3579b0dab/css/images/loading-install.gif	54.148.207.14
hxxp://staticrr.tgusrv.com/sdb/84/MixVideoPlayerSetup.exe
hxxp://api.youmagnos.com/maxpower-static/templates/2014/09/8bc54d8e-3fdf-11e4-8f9b-06a3579b0dab/css/images/progress-bar.png	54.148.207.14
hxxp://api.youmagnos.com/maxpower-static/templates/2014/09/8bc54d8e-3fdf-11e4-8f9b-06a3579b0dab/css/images/progress-level.png	54.148.207.14
hxxp://www.youmagnos.com/BesH3gE9/pop-up/	54.186.187.58
hxxp://www.youmagnos.com/lpresources/js/linkv2.js	54.186.187.58
hxxp://www.youmagnos.com/lpresources/js/ainj.js	54.186.187.58
hxxp://www.youmagnos.com/lpresources/js/dlStoragev1.js	54.186.187.58
hxxp://www.youmagnos.com/mh/53a811d55f1c1e744b000002/2307c835-660a-4bd8-a3df-031d9af89e85/53a811d55f1c1e744b000002/default/media/js/jquery-1.11.1.min.js	54.186.187.58
hxxp://n149adserv.com/js/show_ads.js	204.155.152.38
hxxp://api.youmagnos.com/dd49bd219cbd01f57c0247abd593edaec102a939928946cbd3305ab43ea5cab1b917e59fbda789e62c197bc3a2ad35431925a7e64db7be00	54.148.207.14
hxxp://api.youmagnos.com/__maxpower__/render_screen/2014/10/e8150ca4-4ae4-11e4-be98-06a3579b0dab/screen_variation=f_link	54.148.207.14
hxxp://api.youmagnos.com/maxpower-static/templates/2014/09/8bc54d8e-3fdf-11e4-8f9b-06a3579b0dab/css/images/bullet-short.gif	54.148.207.14
hxxp://staticrr.tgusrv.com/sdb/df/ffmpeg.zip
hxxp://staticrr.getmixvideo.com/sdb/84/MixVideoPlayerSetup.exe	52.25.133.123
hxxp://staticrr.mixvideoplayer.com/sdb/df/ffmpeg.zip	52.25.133.123
ssl.google-analytics.com	216.58.214.200

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

GET /maxpower-static/templates/2014/09/8bc54d8e-3fdf-11e4-8f9b-06a3579b0dab/css/images/i-download.png HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: api.youmagnos.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Accept-Ranges: bytes

Content-Type: image/png

Date: Fri, 26 Feb 2016 23:23:37 GMT

ETag: "54fdc5af-cfd"

Last-Modified: Mon, 09 Mar 2015 16:09:19 GMT

Server: nginx

Content-Length: 3325

Connection: keep-alive

.PNG........IHDR...*...*........[....tEXtSoftware.Adobe ImageReadyq.e<...$iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS6 (Macintosh)" xmpMM:InstanceID="xmp.iid:11EB63A0AE0011E4A9FEBA77EDE0B7A3" xmpMM:DocumentID="xmp.did:11EB63A1AE0011E4A9FEBA77EDE0B7A3"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:11EB639EAE0011E4A9FEBA77EDE0B7A3" stRef:documentID="xmp.did:11EB639FAE0011E4A9FEBA77EDE0B7A3"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>.......oIDATx..Y{l.G......l..qvb...WS......UTH..*.._.....BH...U.V!JKyH-.(.....M.".....)i.. .vI.4q...............q^........nvg.......L.......#r].z./.r/o.......8...C.z0.,.Z...6.>....}......V...k.......#{..3.p*..Rq...q.T...L..H....lh..D"..3X...s.X(...^4.3]...l...sW....x}.&xU{..)......l@.....;<. .........(.......L..].`..Y........~sxK..u...I8..Fd.......z3.l5...$?[....9]....6.......J..R..K..k4...7.....s...#..IrLQ.....|.(/....\.X..\U..uG...=........)P.k=...V/...d............fP.b!...'l. ......L.c...._y.h.....oJ.#....|..y..s~.lf.....m..$TZ.Jza...-|..,..H....1..9..[....{..F.93..B..n..U.....:..

<<< skipped >>>

GET /maxpower-static/templates/2014/09/8bc54d8e-3fdf-11e4-8f9b-06a3579b0dab/css/images/progress-level.png HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: api.youmagnos.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Accept-Ranges: bytes

Content-Type: image/png

Date: Fri, 26 Feb 2016 23:23:38 GMT

ETag: "54fdc5b5-10c6"

Last-Modified: Mon, 09 Mar 2015 16:09:25 GMT

Server: nginx

Content-Length: 4294

Connection: keep-alive

.PNG........IHDR...|.........L.......pHYs................OiCCPPhotoshop ICC profile..x..SgTS..=...BK...KoR.. RB....&*!..J.!...Q..EE...........Q,......!.........{.k........>...........H3Q5...B..........@..$p....d!s.#...~<< ".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<. ...*..x..<.$9E.[.-q.WW..(.I. .6a.a.@..y..2.4..............x.....6..._-...."bb.....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<......$.2].G......L......b...G.......".Ib.X*..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt.......o..(...h...w..?.G.%..fI.q..^D$.T..?....D..*.A....,.........`6.B$..B.B.d..r`)..B(....*`/.@.4.Qh..p...U..=p..a...(....A...a!...b.X#......!.H...$ ...Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6....h...>C.0....3.l0...B.8,..c.."......V.....c..w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9., .......3...!.[..b@q..S.(R.jJ....4..e.2AU..R...T.5.ZB...R.Q...4u.9...IK......h.h.i..t.....N..W...G.....w.......g(.....g.w...L......T071......oUX*.*|.....J.&..*/T.......U.U.T..^S}.FU3S......U..P.S.Sg.;...g.oT?.~Y...Y.L.OC.Q.._... .c..x,!k...u.5.&...|v*......=...9C3J3W.R..f?...q..tN..(...~....).)..4L.1e\k....X.H.Q.G..6......E.Y...A.J'\'Gg.....S.S.....M=:....k....Dw.n.....^..Lo..y....}/.T.m...G.X...$.....<.5qo<./...QC].@C.a.a......<..F.F..i.\.$.m.m..&.&!&KM.M..RM..).;L;L........5.=1.2.......

<<< skipped >>>

GET /__maxpower__/render_screen/2014/10/e8150ca4-4ae4-11e4-be98-06a3579b0dab/screen_variation=f_link HTTP/1.1

Accept: */*

Proxy-Authorization: Basic

User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.153 Safari/537.36

Host: api.youmagnos.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Accept-Ranges: bytes

Content-Language: en

Content-Type: text/html; charset=utf-8

Date: Fri, 26 Feb 2016 23:23:51 GMT

Server: nginx

Vary: Accept-Language

Content-Length: 600

Connection: keep-alive

.....<div class="finish">..<h1>........%mapp% Setup Wizard.......</h1>..<p style="margin-top: 15px; font-size: 13px;">You have succesfully installed the software below and they are ready to be used:</p>....<div class="items">...<ul>....<li class="check">%mapp%</li>......</ul>..</div>....<div class="clear"></div>....<p>Recommended offers:</p>......<div class="list-toolbars" id="alloffers">....<ul class="_FinishOffers">....</ul>...</div>...........<input id="_Bexit" class="_Bexit close absol" tabindex="2" type="submit" name="nombre" onclick='onExit()' value="Close">....</div>......

GET /maxpower-static/templates/2014/09/8bc54d8e-3fdf-11e4-8f9b-06a3579b0dab/css/images/bullet-short.gif HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: api.youmagnos.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Accept-Ranges: bytes

Content-Type: image/gif

Date: Fri, 26 Feb 2016 23:23:51 GMT

ETag: "54fdc5ab-36"

Last-Modified: Mon, 09 Mar 2015 16:09:15 GMT

Server: nginx

Content-Length: 54

Connection: keep-alive

GIF89a.............!.......,...................P..U..;HTTP/1.1 200 OK..Accept-Ranges: bytes..Content-Type: image/gif..Date: Fri, 26 Feb 2016 23:23:51 GMT..ETag: "54fdc5ab-36"..Last-Modified: Mon, 09 Mar 2015 16:09:15 GMT..Server: nginx..Content-Length: 54..Connection: keep-alive..GIF89a.............!.......,...................P..U..;..

GET /sdb/84/MixVideoPlayerSetup.exe HTTP/1.1

Accept: */*

Proxy-Authorization: Basic

User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.153 Safari/537.36

Host: staticrr.getmixvideo.com

Connection: Keep-Alive

Cache-Control: no-cache

HTTP/1.1 200 OK

Server: nginx

Date: Fri, 26 Feb 2016 23:23:38 GMT

Content-Type: application/octet-stream

Content-Length: 3733592

Last-Modified: Fri, 07 Aug 2015 10:28:15 GMT

Connection: keep-alive

ETag: "55c4883f-38f858"

Accept-Ranges: bytes

MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..iu..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i........................PE..L......K.................^..........^2.......p....@..........................`......p.9......................................t..........8.............8..............................................................p...............................text....].......^.................. ..`.rdata.......p.......b..............@..@.data....\...........v..............@....ndata...................................rsrc...8............z..............@..@........................................................................................................................................................................................................................................................................................................................................................................U....\.}..t .}.F.E.u..H......B..H.P.u..u..u...Hr@..B...SV.5..B..E.WP.u...Lr@..e...E..E.P.u...Pr@..}..e....Dp@........FR..VV..U... M.......M....3.....FQ.....NU..M..........VT..U.....FP..E...............E.P.M...Hp@..E...E.P.E.P.u...Tr@..u....E..9}...w....~X.te.v4..Lp@....E.tU.}.j.W.E......E.......Pp@..vXW..Tp@..u..5Xp@.W...E..E.h ...Pj.h..B.W..Xr@..u.W...u....E.P.u...\r@._^3.[.....L$....B...Si.....VW.T.....tO.q.3.;5..B.sB..i......D.......t.G.....t...O..t .....u...3....3...F.....;5..B.r._^[...U..QQ.U.SV..i....

<<< skipped >>>

GET /sdb/df/ffmpeg.zip HTTP/1.0

Host: staticrr.mixvideoplayer.com

User-Agent: NSISDL/1.2 (Mozilla)

Accept: */*

HTTP/1.1 200 OK

Server: nginx

Date: Fri, 26 Feb 2016 23:23:56 GMT

Content-Type: application/zip

Content-Length: 9764782

Last-Modified: Wed, 18 Nov 2015 16:20:05 GMT

Connection: close

ETag: "564ca535-94ffae"

Accept-Ranges: bytes

PK.........p;F=........X}.....ffmpeg.exe.].|T....\.HN/jR.D.z..F...&.0...F.. jT..X.F.`.#.qw... ..h......R.......j[D...E....E..;.....w.\....|4.............kol6%.L&3...M.U&...t......s..jZ1....R..p^...ff.........u.m..{. .'wd...7..{...M.....w.=..d.....d*S,..k......dKLQ..4.u.b.....w.v.!#..;.f*....n....6.V...7f ..Bde1,......WsX1_n.....V2.$.UwXY5..bC]w....6.......{.L15N.:.6.mx..:Q.}....I."}5.u.......&...).#xn.^,\....1..k..............3.= ....J..'.w...../MW.y......C..W.{..Y...< .....^................ ....[?..wON...S.:.....o xZ..i.....[....n..Zl...1..,....#.=..W}...i...k......%.3;.vE.>....o..K...>|.[]W...A....{.....~..~..K...$,-......'......&..eK&)...g..#So&J TS.j.Z1.YK/.e.5..uQ.1z.m..q}.4....u$=.l....w..t......=~...V......k...E..\...4........r.....6Q...2.y..U.|.iH.<)0...._.{.._Y....7E..#Pl.......>.u....".V.H..4....Lzxw..<.....Nm!].]^.P~.Vi.Fd._]i..l...fN0...h0S....*.....n./.=V.k...2|9wx.)6.'`'}....TI..].T..@.............S3u.$Z..k.3..X....S.......i..$-=$...Zh.><.{J..{~S.B.:7u&.\p^.u.f..gv.l...4.....M..V.A.V..2..HV}P}.._i<r..... .R....:P..{..7&n]....%..[...&..EK'.w....0..&.T..Ko.*......f.d...~.f~..2...Q.\{p.AMlV.Oki.z...e..D..........ya....'h%..f.[.R.....n4VK.....~..-..bn!..]...q9.!...T<l....g.(iGmrp.0.PN...7.r..4l.>{..E..?.'.....!s.JD....rX),..>.#8.....I.D=j..$.U.KQz.C....7..a5..N...s.f$......Q..j.....^..5p.>..! .I.U<..I.....~u,........I... ....4.&.4.MT?........... i.......1."........:... ..:.[6.o...jnno6.A.i..l..f.7..h!..^Cz.5e.3.....k......N._....I.o....$.....>...1...'..7.~.

<<< skipped >>>

GET /maxpower-static/templates/2014/09/8bc54d8e-3fdf-11e4-8f9b-06a3579b0dab/css/style.css HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: api.youmagnos.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Accept-Ranges: bytes

Content-Type: text/css

Date: Fri, 26 Feb 2016 23:23:36 GMT

ETag: "5506ab53-5454"

Last-Modified: Mon, 16 Mar 2015 10:07:15 GMT

Server: nginx

Content-Length: 21588

Connection: keep-alive

/* Template Win_Link */...article,aside,details,figcaption,figure,.footer,header,hgroup,menu,nav,section {..display:block;.}.p, h5, h4, h3, h2, h1, span, ul, li, form, input, textarea {..margin:0;..padding:0;.}.body {..margin:0 auto;..background-color:#f6f6f6;..width: 566px;..height: 458px;..color:#444;..font-family:Arial, Helvetica, sans-serif;..}.a {..color:#0066cc;.}..clear {..clear:both;..height:0px;..overflow:inherit;..display: none;.}..li {..list-style: none;.}./*********************//*********************//*********************//*********************//********./* estilo para poner los botones del box.html todos en display none */.._Bnext, .._Bexit, .._Bdecline, .._Bomit {../*display:none;*/.}./**************************************************/..container {..float: left;..width: 566px;..height: 459px;..border: 1px solid #ccc;..margin: 0 auto;.}.../*****************Template Win_Link*****************/......minimize {..float: right;..width: 45px;..position: relative;..margin-right: -45px;..right: 45px;..margin-top: 12px;..z-index: 9999;.}....minimize ul li {..display: inline;..float: left;.}...minimize .button-min {..color: #8b8b8b;..text-decoration: none;..border: none;..font-size: 17px;..float: left;..line-height: 12px;..font-weight: lighter;..cursor: pointer;..width: 12px;..}.../**************************************************/./* content */./**************************************************/.b {..font-weight: normal;.}..content {..width:90%;..height:353px;..position: relative;..margin: 0 auto;..borde

<<< skipped >>>

GET /__maxpower__/render_screen/2014/11/d1187d84-6a69-11e4-b052-06a3579b0dab/screen_variation=I_link HTTP/1.1

Accept: */*

Proxy-Authorization: Basic

User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.153 Safari/537.36

Host: api.youmagnos.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Accept-Ranges: bytes

Content-Language: en

Content-Type: text/html; charset=utf-8

Date: Fri, 26 Feb 2016 23:23:36 GMT

Server: nginx

Vary: Accept-Language

Content-Length: 953

Connection: keep-alive

....<div class="install">.. <h1>Installation Progress</h1>. . <p>This Download Manager will minimize to your system tray shortly to allow you to work on other items while your selections install. To restore this window, simply click on the icon in your system tray.</p>. . <div class="install-loading">. </div>. <div class="progress-bar">. <div class="_TotalProgressLevel progress-level" ></div> . </div>....<div class="clear" style="height:10px; display:block;"></div>. <div class="_ProgressInstallingText" style="display:none; text-align: center; margin-left: 45px; width: 422px;"><p>Installing ...</p></div>. . <div class="_ProgressText" style="display:none; margin-left: 33px;">. <p>Process: <span class="_ProgressTextDownloaded"></span> of <span class="_ProgressTextTotal"></span> (<span class="_ProgressTextPercentage"></span> %)</p>. </div>.. . .</div>.....

GET /maxpower-static/apps/34/68794/css/style.css HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: api.youmagnos.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Accept-Ranges: bytes

Content-Type: text/css

Date: Fri, 26 Feb 2016 23:23:36 GMT

ETag: "5506bcbe-72"

Last-Modified: Mon, 16 Mar 2015 11:21:34 GMT

Server: nginx

Content-Length: 114

Connection: keep-alive

/* mapp MixVideoPlayer */....welcome ul {...width:210px;..float: left; ..}...welcome ul li {..margin-top: 10px;.}....

GET /maxpower-static/templates/2014/09/8bc54d8e-3fdf-11e4-8f9b-06a3579b0dab/css/images/loading-install.gif HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: api.youmagnos.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Accept-Ranges: bytes

Content-Type: image/gif

Date: Fri, 26 Feb 2016 23:23:37 GMT

ETag: "54fdc5b0-1644"

Last-Modified: Mon, 09 Mar 2015 16:09:20 GMT

Server: nginx

Content-Length: 5700

Connection: keep-alive

GIF89a..........|~|...DFD......$"$dbd............424trt......\Z\..................LNLljl...<><.........LJL......,.,dfd............464|z|.....................................................................!..NETSCAPE2.0.....!.......,...........@.pHTA...rB..#....B*...@..$...u8.5....&.0.cX6..~-.ka..J0. ..*.'. B."*B... ,0..NB...0.".)%S.....q%.)!.&D.$..q....W..c.}D.....q$...../...q0......**.*..0...I..W&h..$.K.#.0.-.$..IL....L$*h.Z\.a.....T. q......-.....z.$<..D...L..H.g... ....1.Bn)....M..~*.M.......-....!.......,............|~|...DFD......,.,...dfd..................TVT......464...trt............|z|.........LNL......424...............\Z\......<:<...tvt..............................................................@.pH.QB... ..E....A*...CX.>;..P. -\P)....]YiW.._?..0..DJ..*..z.% .B%.-,g..#C#''.. . .S!.-.o.) .'.C..-.b...(b(.W.*I.*...o,....."".".o.........b....,I..J.nI#.".b....D.*...W........%g.NB#.\.x..@.=%..X`l....P..p....[....$...!D.x.g.$..F.S(fc.!(..$.a....&."I.C...W...!.......,............|~|...DBD......\^\..................TRTljl.........,.,...............LJL...trt............dfd$"$...............\Z\lnl.........424............LNL.................................................pH..&.........0#b)..J....>.....,b..B.A...G.*....TD.".T!.....{1./[1.""(g..$C$.-1./0.)S,.".Vb)..."N..Uo.0.*b..b$.I.,...oO......"."..1. ...........rD.o..J$..J....C....I# . ....g..1...1..J..!$.....x@.!....8|@q...-..8.`.Y.Q.2......7.s1..f...."LX/..'...@.... .!.......,............|~|...DFD......dbd$&$.........trt...424...

<<< skipped >>>

GET /maxpower-static/templates/2014/09/8bc54d8e-3fdf-11e4-8f9b-06a3579b0dab/css/images/progress-bar.png HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: api.youmagnos.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Accept-Ranges: bytes

Content-Type: image/png

Date: Fri, 26 Feb 2016 23:23:38 GMT

ETag: "54fdc5b3-cc6"

Last-Modified: Mon, 09 Mar 2015 16:09:23 GMT

Server: nginx

Content-Length: 3270

Connection: keep-alive

<<< skipped >>>

POST /dd49bd219cbd01f57c0247abd593edaec102a939928946cbd3305ab43ea5cab1b917e59fbda789e62c197bc3a2ad35431925a7e64db7be00 HTTP/1.1

User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.153 Safari/537.36 2 R:-842150449

Host: api.youmagnos.com

Content-Length: 3206

Cache-Control: no-cache

cdata=86394263D6DED7AD3ED013DFEF7E64F6137A208FB1ABB3F74C63F2DAA19383D3FD1D608CEFC8325742961BFA23E787C053B8D6AD3DD461FCB0B26CE7A08C38A5D6DB823BE60CB284611998991028BE38C4EF69891E674B1B8B220BFB20BAD163FFEDA11648DD04F847C1B242EC415E48225CBBD8B904AF067D156766B526CCBE7C5A0D883E951EA5AD000DEB02A60D93678FFFE2322BC8AD739A7AB9B51737C7420E905D5A95F94DF0E36F22BDC30673F04DB707C22DF0D5D841635DB31D53EBBDBE070CF7B3488AB5702A2C720EE2F0B6CA39E8F5945C12FDA6C21F9B53972EE45DAADA63FC4F22E95916F1DF5CD859A7830649E76B9662BB530BAD59640CCD13B87755FC7AD07069CE0A162AA31A7B289692B78245185EAB765BB84F428E815B6D246B87684BC23357BC5D86E4F13AAD1749B4F4F18AE536846D74B8434DD5E0F7D4741960CCC62CF23C961984FB2ADB7553BB90B9D7773EB33AF3D6764BC74B6C1883319BC806F0952443124BB506AB5957BF5C5DD000BE6D4024299617A31D6FEB7036F75BC6E4FBE4E8F834A7DDECC69F64096F8075CF35453EBCFD4598CE79DA937B31F8C61881854F05173F4E69A41CCF591668E48E067403D64715C2A81B0970F9ED4369DED8C44E9B119D9AC978ECA9C73BEB7BB9608978DFF636053CE4C2FB5330ECADA4FE49CF9E0399B3A4A79370B8761D953D0200AA5FDEB553EF439761F914CE0F73C6D287014A8DBA183DC35B51EF50BC7E13978AC7F6B7B40A9CD1C06E2C1BBB1B36C1C93619120F15AB75DAA92ECE6F5E2CDA96EB889B45064B63B7E9792FB731E1CBEE7578E8819A5E0

HTTP/1.1 200 OK

Content-Type: text/plain

Date: Fri, 26 Feb 2016 23:23:51 GMT

Server: nginx

Content-Length: 7

Connection: keep-alive

MAXTHX.HTTP/1.1 200 OK..Content-Type: text/plain..Date: Fri, 26 Feb 2016 23:23:51 GMT..Server: nginx..Content-Length: 7..Connection: keep-alive..MAXTHX...

GET / HTTP/1.1

Accept: */*

Proxy-Authorization: Basic

User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.153 Safari/537.36

Host: api.youmagnos.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Accept-Ranges: bytes

Content-Type: text/html

Date: Fri, 26 Feb 2016 23:23:28 GMT

ETag: "54521356-38"

Last-Modified: Thu, 30 Oct 2014 10:30:46 GMT

Server: nginx

Content-Length: 56

Connection: keep-alive

<html><head><title>ok</title></head><body></body></html>HTTP/1.1 200 OK..Accept-Ranges: bytes..Content-Type: text/html..Date: Fri, 26 Feb 2016 23:23:28 GMT..ETag: "54521356-38"..Last-Modified: Thu, 30 Oct 2014 10:30:46 GMT..Server: nginx..Content-Length: 56..Connection: keep-alive..<html><head><title>ok</title></head><body></body></html>....

GET /99337b01e9530b69b86fc1310859167cbcc79c09381bc88879fecbc51ff412bed8543ea82eecf9a6bd28bf7f8c115b7f28655687cc58f0d79110a91fe105cca827b5ea24c1b89ed9e8077f57a58a710fc6659e643e819a8ddcb3e46fa8cfe52769081b031bdc66cc HTTP/1.1

Accept: */*

Proxy-Authorization: Basic

User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.153 Safari/537.36

Host: api.youmagnos.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Type: text/html

Date: Fri, 26 Feb 2016 23:23:33 GMT

Server: nginx

transfer-encoding: chunked

Connection: keep-alive

2254..2999e6d26bcdc64abda3edffff580f8e944f63f28adc605eef8830d603d77ac830b8a5ea60125617197b59396f6eb1d274ebf813e1b8d4e1dcbcaa545aa145600decc0bc6fafc47fe1eb2ed7ff9c44e02f2a71bdaea8a03c28213a0cf469dea21bfa116fe3b933857bfa866acd67a7c72930d63465ed6eab1a448c05298a8e273ea1ec8a7f8b36b6834ec07dee9bf42e6f9f6071aa22967570fe0bbf478ceb49fab6165cc85e2aa7c9dd5a9776ee621d92656c587e39d2bdbc18f0fed6a91c5209c39e970c91b8f614494bb0b3981049a3b363ab562efe6478039d6baef135c8e4229f4bd36bdbc709f92425aba478d53719ac3934fee69be74cf31bebee1ec333dafaf2eab447d09a4d8070280c69d7f9b00b3c3f9df41dc36e0a2f9259a5771a585a620be2ae57eeb2f39923a61625f32fcec8f94cb69a05dd0eb7e3dd9b816c58d082242e3ec56aa26df4ce72eca72115775e9576e89f6ef0d43622ec017298c3df8b4bf65cb8fb1eda5d5029980790ee8b2a2dd40486c90ccf2c30d8a76b3c8f648e8e7e28ecba4fc0d3d4422450a565c86f069f4dbb8568e44e6781e2bd66c3174612d2553c1ce87f114b79e16b94feb4a3fce63d49557eff438cbba0beb1d7493e322ad7fc50934bc3827f3d28c705dfde9dab84c31d4f8e759418a87f5c0dc10b852b6c72f2e190d1f6154a109c8ef9df8c92f98bf2c74407bd765c47624eb8f97d7969f04a1f76d3abe502a2d1240cc089b1476db8be09345ccb6a52299b3bc4358a6ad301e102784e2616be6300163cd3f086c613b7472c00009771a3008e7cd1f82c3c9fdd2fa6503fd24813f1b21638be9f676d999ab4a45b839b458b9375986a106b5553030c8af319561b4859332d46e9352d1c4e36b1ad00a2c952e32f9034ae7abaa104c53cbd6ea1230258166933de62717e4425d4efe8922782d98818af8886a11e4b4c9f06491c78806d25bf11328f989046bd41a64ba369deafd18745e179cafa55ee8313bd36473ba0be771a5ccc6f4e9cf8bf1e96b86042c13f3882984844b9056b4485e9c230217d974b06d2a3fc79b2e047

<<< skipped >>>

POST /04a6907ac555a4db3bae8fe38443eddaf5b0b41c05f2b5fb3f09bbeb82d024c435ee728ae2c00f4d189177cd993b2b7a79a5c798dbfa0fdb HTTP/1.1

User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.153 Safari/537.36 1 R:-842150450

Host: api.youmagnos.com

Content-Length: 2694

Cache-Control: no-cache

cdata=86394263D6DED7AD3ED013DFEF7E64F6810202E9866DC605C250CECCD7CB22F9686417E27FE9F67D358BFE17ACB1D241180ECC39589A1933488922E01AA18B5990C77361D300FD3F93ED09E2CB744C97B804FC5436AE22A9F5722F00091BD760F326B044A545E60D1BB4F9DA4B46BE98F7C92C57C96391C6C81F9ED760A8FD39994D94783DD988EB9FCA7459B10617C9B5A204861E8213F8D51D66496FEC021B0DAA8D9F476E0F4648D0EBB749B52FEF4077F860665EDA542F822D6754FBB6748D4683F78403FD38600CA987324BB0D1001B6E9C594D56C301406A4E09C0F629C2F280B27F7D91B1CBE37A5004231949E349FEEA689EA90AD2B7B3A7EE6F7C9F88830C0AC5BD5867E90CF483582E713324790AFE334447DCB304716E585C3C2BEBF84306378B940F32613C41634C85B60D7480C3BE0CF797DDF28BBD7B8DB384C040B8AE22ADE53037EFDC4013ADE654B3D2F919F6A16DBF1EF3E12AC98881C3F4AB4DC29D708E27F1098FF6CBC18ABB4493E7B71B0EDBA6DFFBED27686B2C95991D2E1979F422CFF8CF45213A1F0D04930D75914EDEE103332BF7B28AE6224E056DD395A198F4C3A224A05036E2F96AEE82F1288604581EA0BF01F9D39B769ED4BBCA36C5D6F0CFDD83D7EE0DE6C3412812381B439980C8F720E095C11F7ECC51EC65221FEC8A7071450FEC5B6A25A175B539011DA3924FFE65D8997201B0BD2B78BEB96E9CE4135438CA6DCC057167649078EB7FDE138355064EC164222301DE3E2626848AA3E834A8F94361046319A0DA2C609699DE55C5589C0598EBB5B281124486B41429E66DA5EACBA1A2FB3D12FC2

HTTP/1.1 200 OK

Content-Type: text/plain

Date: Fri, 26 Feb 2016 23:23:36 GMT

Server: nginx

Content-Length: 7

Connection: keep-alive

MAXTHX.....

GET /__maxpower__/render_template/2014/09/8bc54d8e-3fdf-11e4-8f9b-06a3579b0dab?language_code=en HTTP/1.1

Accept: */*

Proxy-Authorization: Basic

User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.153 Safari/537.36

Host: api.youmagnos.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Accept-Ranges: bytes

Content-Language: en

Content-Type: text/html; charset=utf-8

Date: Fri, 26 Feb 2016 23:23:36 GMT

Server: nginx

Vary: Accept-Language

Content-Length: 2152

Connection: keep-alive

...<div class="link-v2">.<div class="container">.. <div class="minimize">. <ul>. <li><span id="_Bminimize" onclick="minimizeWindow();" class="button-min">-</span></li>. <li><span id="_Bexit" onclick="onExit()" class="button-min">x</span></li>. </ul>.</div>..<div class="icon-image">.</div>..<div id="_frameContainer" class="content">.. ..</div>....<div class="buttons">.. . . <input id="_Bnext" class="_Bnext green right" buttonText="Next" tabindex="0" type="submit" value="Next" onclick='onAccept();'>. .. .. . <input id="_Bomit" class="_Bomit normal-close leftnowidth" tabindex="3" type="submit" name="nombre" value="Skip All" onclick='onOmit();'>. . . <input id="_Bdecline" class="_Bdecline normal-close leftnowidth" tabindex="1" type="submit" name="nombre" value="Decline" onclick='onDecline();'>. .. <div class="clear"></div>.</div>.. ..<div class="contact">. <div class="contact-in" style="height: 20px;">.. <ul>. <li><a target='_blank' class="first _TitPrivacy">Privacy Policy</a></li>. <li><a target='_blank' class="_TitSetup">Setup info</a></li>. <li><a target='_blank' class="_TitFree">Why is this free?</a></li>. <li>&l

<<< skipped >>>

GET /js/show_ads.js HTTP/1.1

Accept: */*

Referer: hXXp://VVV.youmagnos.com/BesH3gE9/pop-up/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: n149adserv.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Apache-Coyote/1.1

Cache-Control: max-age=3600

Accept-Ranges: bytes

Content-Type: application/javascript;charset=ISO-8859-1

Transfer-Encoding: chunked

Content-Encoding: gzip

Vary: Accept-Encoding

Date: Fri, 26 Feb 2016 23:23:39 GMT

Connection: close

a..............200...;ks.8... d..B.hINvr7dXZ.qv<.dfm'.:G..IHbB.Z..........|H..]].}.L6...../..,..Uz.....e....[.eQ...#.qr.....g.. .!n.Vw...m..,Y..X..!.4O..V.5...QT.8....u^.....M.AwQX,...G...V.l..OQ.^..*f.7...?I.y..(.a..<..D....8..e..k.6....s.."w.g[..D..<.}.|.5f...I.7~.:Ko.T7o.N."J.....`.....V0........(...X...h...G:aq...N.5.}zH.lFA.........S. ...<J........uX>u..... ......$.7g!..A..k\...Oc....g..R.c...r....-.k`.YR.g.A.<.vw..T..x..A.F............g!..t.b).{...9..-.9....rM..j6..Q...O."....<.._.t..-.o.y.m.\._..[$..@....8 .e.EZ....D.. ..200....... M.4..;.%...x......{..).?g.<up@!I...}9s..9...Fu...J.q|..T.....w.Oc..q..F".~..`....w..*..FW.W0.......H.;.......P[.Q..T..?D..j.."j..P..sWqTXR......[...^...;.j..3...........A1.I..S{.......lfQ..9........u.b.Raa.=.X0.9....#.)....#`..Y~....9q...Sx0...*Y.R.....(............#..[V.g5a..w`y5.P#.g2%U...... }.C.A-.P...:_Z\o./........h.......fj........-qF,.k....E..bw....W.,X.....{...7d.*.r..aawru.A5...L#..-^........q dkL........]....H....<.%.........>l...}..p]v ....n....3.&.5...6.G..... |..<../...@.?.....}k....f.....200...%......)AcT..[@.....5./..$.E"A..{.3._.zv!.N....Q.!....!...\..r....ufY......`//......3..l ..:{.<.......9.....8....}Q.JFmC.&.....@....W..9...<e!.3...G].."i...`t..H.......Y...:MJ...QP..i..1.?..I#c%......_W..~..T...w.D........J...=bCW#......A.'.4.[.b.&........_A.g`..h..AoIJ.b.3...............&....%.i.e.:M..O..&c....};....E5..f.. km-.....].g..?n.B` . ^..y..fs=........W....@..f.9>?G.`px....H).S.......&...Xgd..C..[...R..uF].^j.!7...0.0.m.

<<< skipped >>>

HEAD /sdb/84/MixVideoPlayerSetup.exe HTTP/1.1

User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.153 Safari/537.36

Host: staticrr.getmixvideo.com

Content-Length: 0

Cache-Control: no-cache

HTTP/1.1 200 OK

Server: nginx

Date: Fri, 26 Feb 2016 23:23:37 GMT

Content-Type: application/octet-stream

Content-Length: 3733592

Last-Modified: Fri, 07 Aug 2015 10:28:15 GMT

Connection: keep-alive

ETag: "55c4883f-38f858"

Accept-Ranges: bytes

GET /d5/msjava.dll HTTP/1.1

Accept: */*

Proxy-Authorization: Basic

User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.153 Safari/537.36

Host: static.youmagnos.com

Connection: Keep-Alive

Cache-Control: no-cache

HTTP/1.1 200 OK

Accept-Ranges: bytes

Content-Type: application/octet-stream

Date: Fri, 26 Feb 2016 23:23:29 GMT

ETag: "54ef0d1b-e5910"

Last-Modified: Thu, 26 Feb 2015 12:10:03 GMT

Server: nginx

Content-Length: 940304

Connection: keep-alive

MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....C8...........#...............................k................................m...............................`#..te...........................................................................................................................text............................... ..`.data...d"......."..................@....rsrc...............................@..@.reloc..............................@..B4.D8@...0[.8M..... 8W...4.D8a...4.D8l...6.D8y...5.D8............KERNEL32.dll.NTDLL.DLL.GDI32.dll.USER32.dll.ADVAPI32.dll.OLEAUT32.dll.ole32.dll......................................................................................................................................................................................................................................................................................................................................................... ...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

<<< skipped >>>

GET /BesH3gE9/pop-up/ HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.youmagnos.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Encoding: gzip

Content-Language: en

Content-Type: text/html

Date: Fri, 26 Feb 2016 23:23:38 GMT

Server: nginx

Set-Cookie: lpsl_BesH3gE9=7ceb757be6d50cd84aea77b461e53663 1456615418; Path=/; Expires=Sat, 27-Feb-16 23:23:38 GMT;Domain=VVV.youmagnos.com

Vary: Accept-Language

Content-Length: 1075

Connection: keep-alive

...........V.o.6.._..!.IN&...... s:l@....uH3...X.$.$e.-..{.d..]l f.0}.{.;.{...\.>....5..4Ao.....1.6!....\O..._&7o..4.D.L.*..M.y..Fx.T> d.Z9....=..A.5......v".P.xdx....$.......W../...0../B..D. ..9..b..,..VV...|L.\0...0I..$q..l9..G..<G..F.l.?A..;...gK......Q..\..E...H.}......s.i.....N..........".v........I..Y..i;..f...4..Y.....E.H..HQq.....%.n.NL7.S.J..._m..'..0..h...&.....u.8;h..2E..*..."^.x.3.2eO.........XC.........v.#...Nl[1.l.......!sd.......v|}5..5.T..=-.....T.....x...7u~r`^..B.[.K..PB.......<.01.dB...Y.nbM.B:.<7.%.....4..d.${C......U.a.C.Z.S...."..Y'!......\}.....t`.H.Gshl7V"V.YX.....h....M.........?............T....6K.`...L...k..nJ@'e.;.l....c..!......y...f..Du*5.......^.h..x..?.n...4.G..e...2}&..3k......Gu.>.m. %L.&...r..]...}.r...1.z.(.&l..M.i...ijT..{....y...WT.i.B..F0...<.?.....\$ .;..r.N.....{.fw."..n..DA...F..mu.;.....(..!Y....5..Aa".J.A.l...-yu...s..mB2.._.....O......B*./....6.<........p~..8..t....a.jy...,..z90.0;x?Y..D..j..@..s....../..j...#..`mEE.h..._....]......W.Io .....;..P..e....f .G.9.." ...4.B{..P).....Dx2...E!d^..x3.....zU...}C....1.]}.......

GET /lpresources/js/linkv2.js HTTP/1.1

Accept: */*

Referer: hXXp://VVV.youmagnos.com/BesH3gE9/pop-up/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.youmagnos.com

Connection: Keep-Alive

Cookie: lpsl_BesH3gE9=7ceb757be6d50cd84aea77b461e53663 1456615418

HTTP/1.1 200 OK

Accept-Ranges: bytes

Access-Control-Allow-Origin: *

Content-Encoding: gzip

Content-Type: application/javascript

Date: Fri, 26 Feb 2016 23:23:39 GMT

ETag: "180b8d-d84-4feef24b01140"

Last-Modified: Thu, 24 Jul 2014 11:56:13 GMT

Server: nginx

Vary: Accept-Encoding

Content-Length: 1358

Connection: keep-alive

...........WYo.8.~..`.ELV.|...q. M.........AIT,D...r....;$E.Ns 0,..|srf.Ty$."G.4..L...[&.T........B;.Q^......}..a...?.c.&h6.N..P...\.... 5.S..9......5.)..R..xQ.1Vb.......V.A........>:J..@yY.w)..:.[....w4.....Q.e..".\..!)..h.^......;..M......n....P.>....^ zBQ...Y.kq^e...L0.."...c...R..7Y..Jd..1pc....BO82.......l.r&"Z.....B!y..Z......i...?....9..5..gED.. .|T.=Qf.....\.V..O..C../x....M..l..z.."W.B.a..rh..,...'.?...?.L...c.N......5.A.."...u*..........?\..2W..q.......h..mb`Y.1...k..i.w.8K.;.3.,e.e......2T..FtS..K......7"..,*e.&.e.W.%v......=.L.....\.'.{......D9.U...s.-... ..JD..U.0pHqwV..;8Y5A....G.........T/.?~.w..A.aI...\i.}P.@k%<.G.7......%u2..0.....3.(.H%.......P?1x:n...=.:...m...v2..w.....Go..tj.(-7.K. =Y.4.>.........7.(.w.q ... i..Lt/.....W.....T...)..W.."Y...`..%..,...........tW..8.C.A2.,8(...j..../.B...x.S..u..X....f..=..U8......vLc. f...h@..A' E..A3.....t......-.yhZ)..6.`....o%.........'.Y...u...c..&....... .Q.9.....Vm.mW...h..W...C.w............'...r.(.t).j......L...9.j.Uc...QBa9 ..3gPJ.WJ.]xj..!M.<....U......_.....K!0...Ea..F...J=..`.6R.a..V..,cj . ..W..h.i........T....T_.l[.....i.u..VL.u.AE..CR..n...l......y..}...1..5.................O...`'.MW8c...|.. x...{.t..........}_...^..&...?[..9Y|...g.-..._.....h.G~.....i1...b.....&.:.j..9.g.]B]..}..K>......{.7.aNqtMWD.6.0g.......0..z...PghuR7..}..f.y./.p-.%T.n.......xN.j.[.Q......h}e.........

<<< skipped >>>

GET /lpresources/js/ainj.js HTTP/1.1

Accept: */*

Referer: hXXp://VVV.youmagnos.com/BesH3gE9/pop-up/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.youmagnos.com

Connection: Keep-Alive

Cookie: lpsl_BesH3gE9=7ceb757be6d50cd84aea77b461e53663 1456615418

HTTP/1.1 200 OK

Accept-Ranges: bytes

Access-Control-Allow-Origin: *

Content-Encoding: gzip

Content-Type: application/javascript

Date: Fri, 26 Feb 2016 23:23:39 GMT

ETag: "28004c-0-4f9c38966d780"

Last-Modified: Mon, 19 May 2014 16:48:46 GMT

Server: nginx

Vary: Accept-Encoding

Content-Length: 20

Connection: keep-alive

........................

GET /lpresources/js/dlStoragev1.js HTTP/1.1

Accept: */*

Referer: hXXp://VVV.youmagnos.com/BesH3gE9/pop-up/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.youmagnos.com

Connection: Keep-Alive

Cookie: lpsl_BesH3gE9=7ceb757be6d50cd84aea77b461e53663 1456615418

HTTP/1.1 200 OK

Accept-Ranges: bytes

Access-Control-Allow-Origin: *

Content-Encoding: gzip

Content-Type: application/javascript

Date: Fri, 26 Feb 2016 23:23:39 GMT

ETag: "280057-1a57-50572ea11d0c0"

Last-Modified: Wed, 15 Oct 2014 09:39:55 GMT

Server: nginx

Vary: Accept-Encoding

Content-Length: 2010

Connection: keep-alive

...........X[o...~v~...H:q..X,...]d..]t/i.A..b.P.(.F.]..c....!.....p.......\...K.Y..P.......b..c.........\3 J..2o-e.*!.....Ur....S>..(..^....Z ...i..Z...Z.^.(b.}&.....O.$.:.:.....c{D........K.,.....WH.{C..}....2 n..Q..~[$p.1..C/<8.....EZ:_..'..@/.#...ud,K.T....J....i|....3=.....N.!.nY@g....~...~j..i..jj..m.D;l.94.h.$A..9..n.Vp?.X.O..&....".......mch....'L..[m...m...XfR......G9(.....BVq....\....G..1....V[.............%....H<...m..O.~.&...-...f...V..@.iV@....[.. .fZ8Ie...Z..%Zdy...s..@.T..B.2.~-..X?[O.Y.i{.K: L.....D......-......... .k.......r.6..... v.5X..l.O..F...9..-.O.....5^.L.i..<Ip..O.....~...,...>.2/...H.R .v..2....R*}:....X.......p2i..b..^.......tW.y...).'....H.......E.).Bx].......p.....9.c]...V....w..(. $D..uc..\.&OFv.2.>%.yf..!B.V4.)...~k..db...Z.......}.....&..^...{cGzV.V...yv:..^....vQ..`.@....f...ix........h*!-.l9L...1...@L...6{h./.HpF.).T......i.......3u.'...fK..j.OY.;!3 .N.'Fw1.....7..W..}"..n.ax[,y.%.. .......X%wf. .O...s...'...g7..9'y.V..y.\O..3...,.-....H.q..........AM..;..L.8B`.3.......X.J.0..m....)1..b-.w...j.!..oi...f..R'......-U]8.y. 0.*....0J..M...@.&.}..............IR<...G.J.)I...G.......l.....I.sU....I..}{8...."HQ.....- #..........Q.TL.%"^.h=..cX.r.7.{,......o#,.Ho...*.i...A..*...........2..mh{Ws.3.3.:..N.-...C#WV.[..I.c.J..`...{8....Dw.....x.................../.E_Cl7?....C<....a..Qg.V.p.....\.=.......w?.9.qno..%o....'..z..s(..)......p.v...}kw..*a.T.1...5.S.K]*......58....B..O$M.C.`.............a.h.q...0... jV.....C. IS.].......8_.l..h.....mP.6j....b.1...~.e...DV..

<<< skipped >>>

GET /mh/53a811d55f1c1e744b000002/2307c835-660a-4bd8-a3df-031d9af89e85/53a811d55f1c1e744b000002/default/media/js/jquery-1.11.1.min.js HTTP/1.1

Accept: */*

Referer: hXXp://VVV.youmagnos.com/BesH3gE9/pop-up/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.youmagnos.com

Connection: Keep-Alive

Cookie: lpsl_BesH3gE9=7ceb757be6d50cd84aea77b461e53663 1456615418

HTTP/1.1 200 OK

Accept-Ranges: bytes

Content-Type: application/javascript

Date: Fri, 26 Feb 2016 23:23:39 GMT

ETag: "53a84f60-1762a"

Last-Modified: Mon, 23 Jun 2014 16:01:36 GMT

Server: nginx

Content-Length: 95786

Connection: keep-alive

/*! jQuery v1.11.1 | (c) 2005, 2014 jQuery Foundation, Inc. | jquery.org/license */.!function(a,b){"object"==typeof module&&"object"==typeof module.exports?module.exports=a.document?b(a,!0):function(a){if(!a.document)throw new Error("jQuery requires a window with a document");return b(a)}:b(a)}("undefined"!=typeof window?window:this,function(a,b){var c=[],d=c.slice,e=c.concat,f=c.push,g=c.indexOf,h={},i=h.toString,j=h.hasOwnProperty,k={},l="1.11.1",m=function(a,b){return new m.fn.init(a,b)},n=/^[\s\uFEFF\xA0] |[\s\uFEFF\xA0] $/g,o=/^-ms-/,p=/-([\da-z])/gi,q=function(a,b){return b.toUpperCase()};m.fn=m.prototype={jquery:l,constructor:m,selector:"",length:0,toArray:function(){return d.call(this)},get:function(a){return null!=a?0>a?this[a this.length]:this[a]:d.call(this)},pushStack:function(a){var b=m.merge(this.constructor(),a);return b.prevObject=this,b.context=this.context,b},each:function(a,b){return m.each(this,a,b)},map:function(a){return this.pushStack(m.map(this,function(b,c){return a.call(b,c,b)}))},slice:function(){return this.pushStack(d.apply(this,arguments))},first:function(){return this.eq(0)},last:function(){return this.eq(-1)},eq:function(a){var b=this.length,c= a (0>a?b:0);return this.pushStack(c>=0&&b>c?[this[c]]:[])},end:function(){return this.prevObject||this.constructor(null)},push:f,sort:c.sort,splice:c.splice},m.extend=m.fn.extend=function(){var a,b,c,d,e,f,g=arguments[0]||{},h=1,i=arguments.length,j=!1;for("boolean"==typeof g&&(j=g,g=arguments[h]||{},h ),"object"==typeof g||m.

<<< skipped >>>

Map

The Trojan connects to the servers at the folowing location(s):

Strings from Dumps

%original file name%.exe_272:

`.rsrc

u%Shh

@t-9}

NSSh:

FV<.tn>

F$.xE

J!"#$J%J&'()*J ,JJJJJJJJ-J.JJ/0J1JJJJJJJJJJJJJJJJJJ23JJ4567JJ8JJJJJ9:;JJJJJ?JJJJJJJJ@JJJJJJAJJJJJBJJCJJJJJJJJJJJDEJJJJJJJFJGJJJJJJJJJJJJHJI

j-hd}T

j.hd}T

%Program Files% (x86)\Microsoft Visual Studio 9.0\VC\atlmfc\include\atlexcept.h

HARDWARE\DEVICEMAP\Scsi\Scsi Port 0\Scsi Bus 0\Target Id 0\Logical Unit Id 0

kernel32.dll

%System%\drivers\vmmouse.sys

%System%\drivers\vmhgfs.sys

%System%\drivers\VBoxMouse.sys

sbiedll.dll

%Program Files% (x86)\Microsoft Visual Studio 9.0\VC\include\xdebug

%Program Files% (x86)\Microsoft Visual Studio 9.0\VC\include\streambuf

SELECT * FROM Win32_BIOS WHERE Manufacturer LIKE '%XEN%')

%Program Files% (x86)\Microsoft Visual Studio 9.0\VC\atlmfc\include\cstringt.h

%Program Files% (x86)\Microsoft Visual Studio 9.0\VC\include\xlocale

%Program Files% (x86)\Microsoft Visual Studio 9.0\VC\include\xiosbase

Software\Microsoft\Windows\CurrentVersion\Uninstall

Software\Classes\ProcMon.Logfile.1\shell\open\command

IsWindowsServer

hXXps://ssl.google-analytics.com/collect?

IWX^^^^^gkmv"-88BDRXcgiu}$/:HOY]fsz 4IKTU_lo}&27>EMVefox#/6:?LV\]jp|"/35@@KSXgr "#2:=BOX_gly

%Program Files% (x86)\Microsoft Visual Studio 9.0\VC\include\xlocnum

JUUXXXXXZdqss},09DP

CDGIIIIIQ[bbdpux!)7>AJO^eggoqvww| .

LSXbbbbbfrxx&(7IQ`crt}-0:HNW

APRRRRRRWdr (58>DQUUW]hkz#4CLV]ap}&/2>JT]`hjjptx$&0>CKKX`dlx{(7FHRZ\_h

BHKXXXXXddgpq"1@LX[iosu}*-8DLPWelwx})3;GIQ^dn}%(2>AIMOZ]bnp}!&.8BDIPVWdq

NVW\\\\\fgu"&()6BFGPWZ`fjmx"",.4;EHWenqy*,6=GM\gnou&.;@HLTcrt}) :BCHSXbb

CPSYYYYY_l{,:DKMR_fsv!""*79?JV^_kpu$