Gen:Variant.Adware.Mikey.11354 (B) (Emsisoft), Gen:Variant.Adware.Mikey.11354 (AdAware), Backdoor.Win32.PcClient.FD, Trojan.Win32.Delphi.FD, Trojan.Win32.Sasfis.FD, VirTool.Win32.DelfInject.FD (Lavasoft MAS)Behaviour: Trojan, Backdoor, VirTool, Adware
The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.
Summary
MD5: b8ec14ae193f750e13df846c44c9ea3d
SHA1: 153ddfae9b7cbb3261dfdaf4226eb9c6eb3a158f
SHA256: d7432ca9fc81d4ec677d0f8d12eef6bbfdb5d05c9084ebadfcc8564f73302b5d
SSDeep: 98304: ni3ASDZhmAPxD/HBFnISRcabKla HR69OiyKZU/3vKpeIL5r99ypZJr8vqn/DZb:DwvW5/HBFzbbz g9OBd3vg8zh8vW
Size: 5940848 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: UPolyXv05_v6
Company: Super PC Tools Ltd
Created at: 2015-04-17 13:24:56
Analyzed on: WindowsXP SP3 32-bit
Summary: Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).
Dynamic Analysis
Payload
No specific payload has been found.
Process activity
The Trojan creates the following process(es):
rundll32.exe:448
supoptsetup.tmp:532
%original file name%.exe:304
supoptsetup.exe:1236
The Trojan injects its code into the following process(es):
rundll32.exe:1584
SupOptStart.exe:1096
Mutexes
The following mutexes were created/opened:No objects were found.
File activity
The process supoptsetup.tmp:532 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
%Program Files%\Super Optimizer\is-97N4G.tmp (22 bytes)
%Program Files%\Super Optimizer\is-ARK8I.tmp (909 bytes)
%Program Files%\Super Optimizer\is-BC2BS.tmp (6841 bytes)
%Program Files%\Super Optimizer\is-RFL46.tmp (11 bytes)
%Program Files%\Super Optimizer\is-GMBBK.tmp (7345 bytes)
%Program Files%\Super Optimizer\is-6ULSR.tmp (6841 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is-8VAAG.tmp\_isetup\_shfoldr.dll (23 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is-8VAAG.tmp\SupOptHelper.dll (7971 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\Super Optimizer\Super Optimizer.lnk (773 bytes)
%Program Files%\Super Optimizer\is-NE3HB.tmp (601 bytes)
%Program Files%\Super Optimizer\is-0JU7K.tmp (7971 bytes)
%Program Files%\Super Optimizer\is-HMREF.tmp (30 bytes)
%Documents and Settings%\%current user%\Desktop\Super Optimizer.lnk (761 bytes)
%Program Files%\Super Optimizer\is-8JNS8.tmp (7345 bytes)
%Program Files%\Super Optimizer\is-NONQC.tmp (4545 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\Super Optimizer\Super Optimizer on the Web.lnk (743 bytes)
%Program Files%\Super Optimizer\unins000.dat (15297 bytes)
%Program Files%\Super Optimizer\SupOptStats.dll (107419 bytes)
%Program Files%\Super Optimizer\unins000.msg (646 bytes)
%Program Files%\Super Optimizer\is-QI7DF.tmp (712 bytes)
%Program Files%\Super Optimizer\is-0BAOP.tmp (32242 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\Super Optimizer\Uninstall Super Optimizer.lnk (769 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\Super Optimizer\Check updates.lnk (801 bytes)
%Program Files%\Super Optimizer\is-EFT90.tmp (3073 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\Super Optimizer\Help.lnk (773 bytes)
%Program Files%\Super Optimizer\is-OV5EC.tmp (7433 bytes)
%Program Files%\Super Optimizer\is-QCJ8L.tmp (33652 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is-8VAAG.tmp\SupOptStats.dll (12287 bytes)
%Program Files%\Super Optimizer\is-P4DTB.tmp (7726 bytes)
%Program Files%\Super Optimizer\is-218K9.tmp (127 bytes)
The Trojan deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\is-8VAAG.tmp\SupOptHelper.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is-8VAAG.tmp\SupOptStats.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is-8VAAG.tmp\_isetup (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is-8VAAG.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is-8VAAG.tmp\_isetup\_shfoldr.dll (0 bytes)
The process %original file name%.exe:304 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Cookies\Current_User@google.com[1].txt (270 bytes)
%Documents and Settings%\%current user%\NTUSER.DAT.LOG (7280 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\supoptsetup.exe (691004 bytes)
%Documents and Settings%\%current user%\NTUSER.DAT (7916 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@google.com[2].txt (658 bytes)
%Documents and Settings%\%current user%\Cookies\index.dat (1928 bytes)
%Documents and Settings%\%current user%\Start Menu\Programs\Startup\hqghumeaylnlf.lnk (2 bytes)
%Documents and Settings%\All Users\Application Data\{25d4c92b-01c4-5ff0-25d4-4c92b01c24ac}\hqghumeaylnlf.exe (193592 bytes)
%Documents and Settings%\All Users\Application Data\{25d4c92b-01c4-5ff0-25d4-4c92b01c24ac}\hqghumeaylnlf.dat (938 bytes)
The Trojan deletes the following file(s):
%Documents and Settings%\%current user%\Cookies\Current_User@google.com[1].txt (0 bytes)
The process supoptsetup.exe:1236 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\is-EU6O7.tmp\supoptsetup.tmp (7386 bytes)
The Trojan deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\is-EU6O7.tmp\supoptsetup.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is-EU6O7.tmp (0 bytes)
Registry activity
The process rundll32.exe:448 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "3B 14 D1 E1 F4 4D 43 58 39 A5 BD E7 A0 74 C3 BF"
The process rundll32.exe:1584 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKU\.DEFAULT\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214]
"iiid" = "1"
[HKU\.DEFAULT\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214\eae10f9d]
"7f69fa1f" = "///%"
"65114b36" = "VP/ ////"
"48bd1aff" = "V/////%%"
"c6c5dd44" = "V/////%%"
"a0743acc" = "N/////%%"
"51d2f2ea" = "JlA /Y//GPAf/D6/b/Ah/Xt/aPAp/Yq/GPAf/B//JlAh/XD/c/Ag/B//VP/j/Cx/V//j/CZ/V//h/CZ////%"
"27ddcf6f" = "///%"
"414bc593" = "///%"
"c5705860" = "Vx////%%"
"8b9e4cbc" = "V/////%%"
"587b5709" = "V/////%%"
"2d71d5ab" = "V/////%%"
"d94388d2" = "blA /Y//GPAf/X6/b/Ah/Xt/aPAp/Yq/GPAf/YV/cPAf/XF/UxAs/X6/aP////%%"
"f2c53c49" = "UlAr/XJ/c//k////"
"d1abcdb6" = "///%"
"6185d035" = "VP/h/CP/V//l////"
"0dc3ee96" = "/P////%%"
"1520c6f1" = "V/////%%"
"c99a5f5c" = "///%"
"c24899a6" = "VP/g/CV/Vl/1/CF////%"
"fe94ce1e" = "V/////%%"
"1c311243" = "blA /Y//GPAf/X6/b/Ah/Xt/aPAp/Yq/GPAf/YV/cPAf/XF/UxAs/X6/aP////%%"
"a2e3b941" = "///%"
"f6ad6fa6" = "V/////%%"
[HKU\.DEFAULT\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214\00000000]
"370856c7" = ""
[HKU\.DEFAULT\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214\eae10f9d]
"37b7a6d8" = "UlAr/XJ/c//k////"
[HKU\.DEFAULT\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214\00000000]
"493c7345" = "mU1P0700px1M06E0m01O06h0nx1D07C0px1M07b0al1D06I0pl1T00%%, mU1P0700px1M06E0m01O06h0nx1D07C0px1M07x0ox1Z06t0al1S06t0i00%"
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "F4 C6 C7 DB DA 19 0B A7 A7 C3 44 7C E4 94 55 88"
[HKU\.DEFAULT\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214\eae10f9d]
"0e93c3f3" = "///%"
[HKU\.DEFAULT\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214\00000000]
"a47da861" = "o01O07x0m00K02E0aU1N07t0m01 0780nU1U07x0ox1Z06h0jl1 0780i01D06O0px1g02I0nl1 07x0aU1P06I0ox1S07b0i01e06U0n00T00%%, o01O07x0m00K02E0aU1N07t0m01 0780nU1U07x0ox1Z06h0jl1 0780mU1P0780pl1h02I0qU1T06O0aU1P06I0ox1S07b0i01e06U0n00T00%%, o01O07x0m00K02E0aU1e07b0ix1U06t0ml1T0700i01D06O0ox1K06t0ml1P07x0ox1Y06h0i01J02I0qU1T06O0aU1P06I0ox1S07b0i01e06U0n00T00%%, o01O07x0m00K02E0aU1O06l0px1R06t0ql0Z07b0ix1U06t0ml1T0700i01D06O0ox1K06t0ml0S06b0nU1Z02E0ix1S06h0nl1N07x0qx1Y06U0aU0%, o01O07x0m00K02E0aU1O0640oU1 07b0ix1U06t0ml1T0700i01D06O0ox1K06t0ml1P07x0ox1Y07b0al1g06E0nx0T07t0nl1D06I0mU1O0640n01Y02E0, o01O07x0m00K02E0aU1R06l0qx1O0640iU1 0680mU1P0700px1M06E0m01O06h0nx1D07C0px1M02I0qU1T06O0aU1P06I0ox1S07b0i01e06U0n00T00%%, o01O07x0m00K02E0aU1e07b0ix1U06t0ml1T0700i01D06O0ox1K06t0ml0S06I0px1O02E0ix1S06h0nl1N07x0qx1Y06U0aU0%, o01O07x0m00K02E0aU1N07t0m01 0780nU1U07x0ox1Z06h0jl1 0780iU1 0680ql1D06I0pU0S06b0nU1Z02E0ix1S06h0nl1N07x0qx1Y06U0aU0%, o01O07x0m00K02E0aU1T0700i01D06O0ox1K06t0ml1N07t0m01 0780mU1 07x0al1g06E0nx0T07t0nl1D06I0mU1O0640n01Y"
[HKU\.DEFAULT\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214\eae10f9d]
"340d3099" = "/P////%%"
"0c230bcb" = "///%"
"f1f24e29" = "Vl/l/C/////%"
"38583bc3" = "Ml/2/CF/M//g/CZ////%"
"bbf88800" = "///%"
[HKU\.DEFAULT\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214\00000000]
"3efeb33e" = ""
[HKU\.DEFAULT\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214\eae10f9d]
"72758a5d" = "///%"
"2e22d94e" = "///%"
"f0bf0bde" = "///%"
"7367429f" = "///%"
"e8f9dcc7" = "UlAr/XJ/c//k////"
"a1dcff5b" = "V/////%%"
"e46c271e" = "///%"
"3c09c42b" = "///%"
"060df2cd" = "blA /Y//GPAf/X6/b/Ah/Xt/aPAp/Yq/GPAp/YP/UxAs/X6/aP////%%"
The process SupOptStart.exe:1096 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 2A 00 00 00 01 00 00 00 00 00 00 00"
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "E0 70 4F 57 63 C5 A4 93 FB D0 80 93 6E A2 FB 57"
[HKCU\Software\Super Optimizer]
"AppStart" = "0"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"
[HKCU\Software\Super Optimizer]
"InstallDate" = "56 0D 4C 5A B1 92 E4 40"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"
Proxy settings are disabled:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
The Trojan deletes the following value(s) in system registry:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"
The process supoptsetup.tmp:532 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKCU\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214\eae10f9d]
"f0bf0bde" = "///%"
"bbf88800" = "///%"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Super Optimizer_is1]
"MajorVersion" = "3"
[HKLM\SOFTWARE\baec5657-8322-5676-45d1-0440b8c442fe\10162061603631420\eae10f9d]
"d94388d2" = "blA /Y//GPAf/X6/b/Ah/Xt/aPAp/Yq/GPAf/YV/cPAf/XF/UxAs/X6/aP////%%"
[HKLM\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214]
"usr.1" = "6AN02rvqomjlhabcde"
[HKLM\SOFTWARE\baec5657-8322-5676-45d1-0440b8c442fe\10162061603631420\eae10f9d]
"0dc3ee96" = "/P////%%"
[HKLM\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214\eae10f9d]
"fe94ce1e" = "V/////%%"
[HKCU\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214]
"uuid" = "2692819837"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Start Menu" = "%Documents and Settings%\All Users\Start Menu"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Super Optimizer_is1]
"Inno Setup: Icon Group" = "Super Optimizer"
[HKLM\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214\eae10f9d]
"f2c53c49" = "UlAr/XJ/c//k////"
[HKLM\SOFTWARE\baec5657-8322-5676-45d1-0440b8c442fe\10162061603631420\eae10f9d]
"c5705860" = "Vx////%%"
[HKLM\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214\eae10f9d]
"f1f24e29" = "Vl/l/C/////%"
[HKLM\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214\00000000]
"370856c7" = ""
[HKCU\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214\eae10f9d]
"7f69fa1f" = "///%"
"38583bc3" = "Ml/2/CF/M//g/CZ////%"
[HKLM\SOFTWARE\baec5657-8322-5676-45d1-0440b8c442fe\10162061603631420\eae10f9d]
"340d3099" = "/P////%%"
[HKLM\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214\eae10f9d]
"c99a5f5c" = "///%"
[HKCU\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214\eae10f9d]
"414bc593" = "///%"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKLM\SOFTWARE\baec5657-8322-5676-45d1-0440b8c442fe\10162061603631420\eae10f9d]
"c24899a6" = "VP/g/CV/Vl/1/CF////%"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Super Optimizer_is1]
"URLUpdateInfo" = "http://www.superpctools.com/"
[HKLM\SOFTWARE\baec5657-8322-5676-45d1-0440b8c442fe\10162061603631420\eae10f9d]
"d1abcdb6" = "///%"
[HKCU\Software\Super Optimizer]
"UninstallURL" = "https://safecart.com/superpctools/.spo-special/purchase?sid=211001941-AU-094"
[HKLM\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214\00000000]
"a47da861" = "o01O07x0m00K02E0aU1N07t0m01 0780nU1U07x0ox1Z06h0jl1 0780i01D06O0px1g02I0nl1 07x0aU1P06I0ox1S07b0i01e06U0n00T00%%, o01O07x0m00K02E0aU1N07t0m01 0780nU1U07x0ox1Z06h0jl1 0780mU1P0780pl1h02I0qU1T06O0aU1P06I0ox1S07b0i01e06U0n00T00%%, o01O07x0m00K02E0aU1e07b0ix1U06t0ml1T0700i01D06O0ox1K06t0ml1P07x0ox1Y06h0i01J02I0qU1T06O0aU1P06I0ox1S07b0i01e06U0n00T00%%, o01O07x0m00K02E0aU1O06l0px1R06t0ql0Z07b0ix1U06t0ml1T0700i01D06O0ox1K06t0ml0S06b0nU1Z02E0ix1S06h0nl1N07x0qx1Y06U0aU0%, o01O07x0m00K02E0aU1O0640oU1 07b0ix1U06t0ml1T0700i01D06O0ox1K06t0ml1P07x0ox1Y07b0al1g06E0nx0T07t0nl1D06I0mU1O0640n01Y02E0, o01O07x0m00K02E0aU1R06l0qx1O0640iU1 0680mU1P0700px1M06E0m01O06h0nx1D07C0px1M02I0qU1T06O0aU1P06I0ox1S07b0i01e06U0n00T00%%, o01O07x0m00K02E0aU1e07b0ix1U06t0ml1T0700i01D06O0ox1K06t0ml0S06I0px1O02E0ix1S06h0nl1N07x0qx1Y06U0aU0%, o01O07x0m00K02E0aU1N07t0m01 0780nU1U07x0ox1Z06h0jl1 0780iU1 0680ql1D06I0pU0S06b0nU1Z02E0ix1S06h0nl1N07x0qx1Y06U0aU0%, o01O07x0m00K02E0aU1T0700i01D06O0ox1K06t0ml1N07t0m01 0780mU1 07x0al1g06E0nx0T07t0nl1D06I0mU1O0640n01Y"
[HKLM\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214\eae10f9d]
"414bc593" = "///%"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Super Optimizer_is1]
"DisplayVersion" = "3.2.0.1"
"DisplayIcon" = "%Program Files%\Super Optimizer\SupOptLauncher.exe"
[HKLM\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214\eae10f9d]
"1c311243" = "blA /Y//GPAf/X6/b/Ah/Xt/aPAp/Yq/GPAf/YV/cPAf/XF/UxAs/X6/aP////%%"
[HKCU\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214\eae10f9d]
"d1abcdb6" = "///%"
[HKLM\SOFTWARE\baec5657-8322-5676-45d1-0440b8c442fe\10162061603631420\00000000]
"493c7345" = "mU1P0700px1M06E0m01O06h0nx1D07C0px1M07b0al1D06I0pl1T00%%, mU1P0700px1M06E0m01O06h0nx1D07C0px1M07x0ox1Z06t0al1S06t0i00%"
[HKCU\Software\Super Optimizer]
"AdsBuyNowURL" = "http://supc30.superpctools.revenuewire.net/spu/register?221001941_F1757A4C-A825-43B9-9C51-76C193F75DA1"
[HKLM\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214\eae10f9d]
"f6ad6fa6" = "V/////%%"
[HKLM\SOFTWARE\{6791A2F3-FC80-475C-A002-C014AF797E9C}]
"n" = "1"
[HKLM\SOFTWARE\baec5657-8322-5676-45d1-0440b8c442fe\10162061603631420\eae10f9d]
"1c311243" = "blA /Y//GPAf/X6/b/Ah/Xt/aPAp/Yq/GPAf/YV/cPAf/XF/UxAs/X6/aP////%%"
[HKCU\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214\eae10f9d]
"587b5709" = "V/////%%"
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"LoadAppInit_DLLs" = "1"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Start Menu" = "%Documents and Settings%\%current user%\Start Menu"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"
[HKCU\Software\Super Optimizer]
"sc" = "http://gen.securedshopgate.com/?t=01&b=21&tid=211001941-AU-094_F1757A4C-A825-43B9-9C51-76C193F75DA1"
[HKCU\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214\eae10f9d]
"a1dcff5b" = "V/////%%"
"0dc3ee96" = "/P////%%"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Super Optimizer_is1]
"Inno Setup: Selected Tasks" = "desktopicon"
"NoRepair" = "1"
[HKLM\SOFTWARE\baec5657-8322-5676-45d1-0440b8c442fe\10162061603631420\eae10f9d]
"587b5709" = "V/////%%"
[HKLM\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214\eae10f9d]
"0dc3ee96" = "/P////%%"
[HKLM\SOFTWARE\baec5657-8322-5676-45d1-0440b8c442fe\10162061603631420\eae10f9d]
"e8f9dcc7" = "UlAr/XJ/c//k////"
[HKCU\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214\eae10f9d]
"c6c5dd44" = "V/////%%"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"
[HKLM\SOFTWARE\baec5657-8322-5676-45d1-0440b8c442fe\10162061603631420]
"Version" = "22022138"
[HKLM\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214]
"appid.0" = "7CnTNVC/4I8Tnsurpn7DLVozr3UlMtRexVPs1X"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Programs" = "%Documents and Settings%\%current user%\Start Menu\Programs"
[HKLM\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214\00000000]
"493c7345" = "mU1P0700px1M06E0m01O06h0nx1D07C0px1M07b0al1D06I0pl1T00%%, mU1P0700px1M06E0m01O06h0nx1D07C0px1M07x0ox1Z06t0al1S06t0i00%"
[HKCU\Software\Super Optimizer]
"Language" = "1"
[HKLM\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214\eae10f9d]
"48bd1aff" = "V/////%%"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"
[HKLM\SOFTWARE\baec5657-8322-5676-45d1-0440b8c442fe\10162061603631420\00000000]
"370856c7" = ""
[HKCU\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214\eae10f9d]
"1c311243" = "blA /Y//GPAf/X6/b/Ah/Xt/aPAp/Yq/GPAf/YV/cPAf/XF/UxAs/X6/aP////%%"
[HKLM\SOFTWARE\baec5657-8322-5676-45d1-0440b8c442fe\10162061603631420\eae10f9d]
"6185d035" = "VP/h/CP/V//l////"
[HKLM\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214]
"State" = "0"
[HKLM\SOFTWARE\baec5657-8322-5676-45d1-0440b8c442fe\10162061603631420\eae10f9d]
"65114b36" = "VP/ ////"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Super Optimizer_is1]
"Inno Setup: Deselected Tasks" = ""
[HKCU\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214\eae10f9d]
"7367429f" = "///%"
[HKCU\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214]
"LRTS" = "0"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Super Optimizer_is1]
"HelpLink" = "http://www.superpctools.com/"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"
[HKCU\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214\eae10f9d]
"e46c271e" = "///%"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"
[HKLM\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214]
"svi" = "0"
[HKCU\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214]
"iiid" = "1"
[HKCU\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214\eae10f9d]
"c5705860" = "Vx////%%"
[HKCU\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214\00000000]
"a47da861" = "o01O07x0m00K02E0aU1N07t0m01 0780nU1U07x0ox1Z06h0jl1 0780i01D06O0px1g02I0nl1 07x0aU1P06I0ox1S07b0i01e06U0n00T00%%, o01O07x0m00K02E0aU1N07t0m01 0780nU1U07x0ox1Z06h0jl1 0780mU1P0780pl1h02I0qU1T06O0aU1P06I0ox1S07b0i01e06U0n00T00%%, o01O07x0m00K02E0aU1e07b0ix1U06t0ml1T0700i01D06O0ox1K06t0ml1P07x0ox1Y06h0i01J02I0qU1T06O0aU1P06I0ox1S07b0i01e06U0n00T00%%, o01O07x0m00K02E0aU1O06l0px1R06t0ql0Z07b0ix1U06t0ml1T0700i01D06O0ox1K06t0ml0S06b0nU1Z02E0ix1S06h0nl1N07x0qx1Y06U0aU0%, o01O07x0m00K02E0aU1O0640oU1 07b0ix1U06t0ml1T0700i01D06O0ox1K06t0ml1P07x0ox1Y07b0al1g06E0nx0T07t0nl1D06I0mU1O0640n01Y02E0, o01O07x0m00K02E0aU1R06l0qx1O0640iU1 0680mU1P0700px1M06E0m01O06h0nx1D07C0px1M02I0qU1T06O0aU1P06I0ox1S07b0i01e06U0n00T00%%, o01O07x0m00K02E0aU1e07b0ix1U06t0ml1T0700i01D06O0ox1K06t0ml0S06I0px1O02E0ix1S06h0nl1N07x0qx1Y06U0aU0%, o01O07x0m00K02E0aU1N07t0m01 0780nU1U07x0ox1Z06h0jl1 0780iU1 0680ql1D06I0pU0S06b0nU1Z02E0ix1S06h0nl1N07x0qx1Y06U0aU0%, o01O07x0m00K02E0aU1T0700i01D06O0ox1K06t0ml1N07t0m01 0780mU1 07x0al1g06E0nx0T07t0nl1D06I0mU1O0640n01Y"
[HKCU\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214\eae10f9d]
"51d2f2ea" = "JlA /Y//GPAf/D6/b/Ah/Xt/aPAp/Yq/GPAf/B//JlAh/XD/c/Ag/B//VP/j/Cx/V//j/CZ/V//h/CZ////%"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"
[HKLM\SOFTWARE\baec5657-8322-5676-45d1-0440b8c442fe\10162061603631420\00000000]
"3efeb33e" = ""
[HKCU\Software\Super Optimizer]
"SessionID" = "F1757A4C-A825-43B9-9C51-76C193F75DA1"
[HKLM\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214\eae10f9d]
"0e93c3f3" = "///%"
[HKLM\SOFTWARE\baec5657-8322-5676-45d1-0440b8c442fe\10162061603631420\eae10f9d]
"c6c5dd44" = "V/////%%"
[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%Program Files%\Super Optimizer]
"SupOptStart.exe" = "Super Optimizer Launcher"
[HKLM\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214\eae10f9d]
"e46c271e" = "///%"
"65114b36" = "VP/ ////"
[HKLM\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214]
"usr.0" = "eP7srqqomjlhabcdef"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Super Optimizer_is1]
"NoModify" = "1"
[HKLM\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214]
"Version" = "22022138"
[HKLM\SOFTWARE\baec5657-8322-5676-45d1-0440b8c442fe\10162061603631420]
"usr.1" = "6AN02rvqomjlhabcde"
[HKLM\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214\eae10f9d]
"38583bc3" = "Ml/2/CF/M//g/CZ////%"
[HKCU\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}\_193c033b\eae10f9d]
"340d3099" = "///%"
[HKLM\SOFTWARE\baec5657-8322-5676-45d1-0440b8c442fe\10162061603631420\eae10f9d]
"2d71d5ab" = "V/////%%"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"
[HKLM\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214]
"iiid" = "1"
[HKCU\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214\eae10f9d]
"f2c53c49" = "UlAr/XJ/c//k////"
[HKCU\Software\Super Optimizer]
"Querry" = "http://bi.superpcdownload.net/t/i/sp?sid=211001941-AU-094&dt=%dt%&gid=F1757A4C-A825-43B9-9C51-76C193F75DA1&tz=%tz%&ln=%ln%&lc=%lc%&bis=%bis%&bief=%bief%&biefx=%biefx%&bif=%bif%&os=%os%&f=356631531"
[HKLM\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214\eae10f9d]
"e8f9dcc7" = "UlAr/XJ/c//k////"
[HKLM\SOFTWARE\baec5657-8322-5676-45d1-0440b8c442fe\10162061603631420\eae10f9d]
"0e93c3f3" = "///%"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{1146AC44-2F03-4431-B4FD-889BC837521F}{22134214}]
"Cache" = "2473861484607625814"
[HKLM\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214\eae10f9d]
"51d2f2ea" = "JlA /Y//GPAf/D6/b/Ah/Xt/aPAp/Yq/GPAf/B//JlAh/XD/c/Ag/B//VP/j/Cx/V//j/CZ/V//h/CZ////%"
[HKLM\SOFTWARE\baec5657-8322-5676-45d1-0440b8c442fe\10162061603631420\eae10f9d]
"37b7a6d8" = "UlAr/XJ/c//k////"
[HKLM\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214\eae10f9d]
"2e22d94e" = "///%"
[HKLM\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214]
"uuid" = "2692819837"
[HKLM\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214\eae10f9d]
"0c230bcb" = "///%"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"
[HKLM\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214\eae10f9d]
"c5705860" = "Vx////%%"
[HKCU\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214\eae10f9d]
"0c230bcb" = "///%"
[HKLM\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214\eae10f9d]
"72758a5d" = "///%"
[HKCU\Software\Super Optimizer]
"UseAds" = "1"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Super Optimizer_is1]
"Inno Setup: App Path" = "%Program Files%\Super Optimizer"
[HKCU\Software\Super Optimizer]
"Ir" = "1"
[HKLM\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214\eae10f9d]
"3c09c42b" = "///%"
[HKLM\SOFTWARE\baec5657-8322-5676-45d1-0440b8c442fe\10162061603631420\eae10f9d]
"7f69fa1f" = "///%"
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "A6 89 BC 47 09 8E 50 0B F8 87 A1 C0 74 AA F3 A3"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Super Optimizer_is1]
"QuietUninstallString" = "%Program Files%\Super Optimizer\unins000.exe /SILENT"
[HKCU\Software\Super Optimizer]
"BuyNowURL" = "http://gen.securedshopgate.com/?t=01&b=21&tid=211001941-AU-094_F1757A4C-A825-43B9-9C51-76C193F75DA1"
[HKLM\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214\eae10f9d]
"a2e3b941" = "///%"
[HKLM\SOFTWARE\baec5657-8322-5676-45d1-0440b8c442fe\10162061603631420]
"svi" = "0"
[HKLM\SOFTWARE\baec5657-8322-5676-45d1-0440b8c442fe\10162061603631420\eae10f9d]
"0c230bcb" = "///%"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214\00000000]
"493c7345" = "mU1P0700px1M06E0m01O06h0nx1D07C0px1M07b0al1D06I0pl1T00%%, mU1P0700px1M06E0m01O06h0nx1D07C0px1M07x0ox1Z06t0al1S06t0i00%"
[HKCU\Software\Super Optimizer]
"homepageurl" = "http://www.superpctools.com"
[HKCU\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214\eae10f9d]
"a2e3b941" = "///%"
[HKCU\Software\Super Optimizer]
"CBM" = "1"
[HKCU\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214\eae10f9d]
"27ddcf6f" = "///%"
[HKCU\Software\Super Optimizer]
"SupportURL" = "http://superpctools.com/support/"
[HKLM\SOFTWARE\baec5657-8322-5676-45d1-0440b8c442fe\10162061603631420\eae10f9d]
"a0743acc" = "N/////%%"
[HKLM\SOFTWARE\{3A7D3E19-1B79-4E4E-BD96-5467DA2C4EF0}]
"n" = "1"
[HKLM\SOFTWARE\baec5657-8322-5676-45d1-0440b8c442fe\10162061603631420]
"appid.0" = "7CnTNVC/4I8Tnsurpn7DLVozr3UlMtRexVPs1X"
[HKLM\SOFTWARE\baec5657-8322-5676-45d1-0440b8c442fe\10162061603631420\00000000]
"a47da861" = "o01O07x0m00K02E0aU1N07t0m01 0780nU1U07x0ox1Z06h0jl1 0780i01D06O0px1g02I0nl1 07x0aU1P06I0ox1S07b0i01e06U0n00T00%%, o01O07x0m00K02E0aU1N07t0m01 0780nU1U07x0ox1Z06h0jl1 0780mU1P0780pl1h02I0qU1T06O0aU1P06I0ox1S07b0i01e06U0n00T00%%, o01O07x0m00K02E0aU1e07b0ix1U06t0ml1T0700i01D06O0ox1K06t0ml1P07x0ox1Y06h0i01J02I0qU1T06O0aU1P06I0ox1S07b0i01e06U0n00T00%%, o01O07x0m00K02E0aU1O06l0px1R06t0ql0Z07b0ix1U06t0ml1T0700i01D06O0ox1K06t0ml0S06b0nU1Z02E0ix1S06h0nl1N07x0qx1Y06U0aU0%, o01O07x0m00K02E0aU1O0640oU1 07b0ix1U06t0ml1T0700i01D06O0ox1K06t0ml1P07x0ox1Y07b0al1g06E0nx0T07t0nl1D06I0mU1O0640n01Y02E0, o01O07x0m00K02E0aU1R06l0qx1O0640iU1 0680mU1P0700px1M06E0m01O06h0nx1D07C0px1M02I0qU1T06O0aU1P06I0ox1S07b0i01e06U0n00T00%%, o01O07x0m00K02E0aU1e07b0ix1U06t0ml1T0700i01D06O0ox1K06t0ml0S06I0px1O02E0ix1S06h0nl1N07x0qx1Y06U0aU0%, o01O07x0m00K02E0aU1N07t0m01 0780nU1U07x0ox1Z06h0jl1 0780iU1 0680ql1D06I0pU0S06b0nU1Z02E0ix1S06h0nl1N07x0qx1Y06U0aU0%, o01O07x0m00K02E0aU1T0700i01D06O0ox1K06t0ml1N07t0m01 0780mU1 07x0al1g06E0nx0T07t0nl1D06I0mU1O0640n01Y"
[HKCU\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214\eae10f9d]
"fe94ce1e" = "V/////%%"
[HKLM\SOFTWARE\baec5657-8322-5676-45d1-0440b8c442fe\10162061603631420\eae10f9d]
"c99a5f5c" = "///%"
[HKLM\SOFTWARE\baec5657-8322-5676-45d1-0440b8c442fe\10162061603631420]
"State" = "0"
[HKLM\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214\eae10f9d]
"060df2cd" = "blA /Y//GPAf/X6/b/Ah/Xt/aPAp/Yq/GPAp/YP/UxAs/X6/aP////%%"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
[HKLM\SOFTWARE\baec5657-8322-5676-45d1-0440b8c442fe\10162061603631420\eae10f9d]
"2e22d94e" = "///%"
[HKLM\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214\eae10f9d]
"6185d035" = "VP/h/CP/V//l////"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 29 00 00 00 01 00 00 00 00 00 00 00"
[HKCU\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214\eae10f9d]
"48bd1aff" = "V/////%%"
"1520c6f1" = "V/////%%"
[HKLM\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214\eae10f9d]
"587b5709" = "V/////%%"
[HKCU\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214\00000000]
"370856c7" = ""
[HKLM\SOFTWARE\baec5657-8322-5676-45d1-0440b8c442fe\10162061603631420]
"date" = "1431158424"
[HKCU\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214\eae10f9d]
"65114b36" = "VP/ ////"
[HKLM\SOFTWARE\baec5657-8322-5676-45d1-0440b8c442fe\10162061603631420\eae10f9d]
"72758a5d" = "///%"
"1520c6f1" = "V/////%%"
[HKCU\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214\eae10f9d]
"d94388d2" = "blA /Y//GPAf/X6/b/Ah/Xt/aPAp/Yq/GPAf/YV/cPAf/XF/UxAs/X6/aP////%%"
"f1f24e29" = "Vl/l/C/////%"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Super Optimizer_is1]
"DisplayName" = "Super Optimizer v3.2"
[HKLM\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214\eae10f9d]
"c24899a6" = "VP/g/CV/Vl/1/CF////%"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonVideo" = "%Documents and Settings%\All Users\Documents\My Videos"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Super Optimizer_is1]
"Inno Setup: Setup Version" = "5.5.3 (u)"
[HKLM\SOFTWARE\baec5657-8322-5676-45d1-0440b8c442fe\10162061603631420\eae10f9d]
"414bc593" = "///%"
"f6ad6fa6" = "V/////%%"
"060df2cd" = "blA /Y//GPAf/X6/b/Ah/Xt/aPAp/Yq/GPAp/YP/UxAs/X6/aP////%%"
[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
[HKLM\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214]
"svpath" = "c:\Program Files\Super Optimizer\SupOptStats.dll"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"My Pictures" = "%Documents and Settings%\%current user%\My Documents\My Pictures"
[HKLM\SOFTWARE\baec5657-8322-5676-45d1-0440b8c442fe\10162061603631420\eae10f9d]
"38583bc3" = "Ml/2/CF/M//g/CZ////%"
[HKCU\Software\Super Optimizer]
"AdsHost" = "dl.superpcdownload.net"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Super Optimizer_is1]
"InstallDate" = "20150509"
[HKLM\SOFTWARE\baec5657-8322-5676-45d1-0440b8c442fe\10162061603631420\eae10f9d]
"f0bf0bde" = "///%"
[HKCU\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214\eae10f9d]
"0e93c3f3" = "///%"
[HKLM\SOFTWARE\baec5657-8322-5676-45d1-0440b8c442fe\10162061603631420\eae10f9d]
"bbf88800" = "///%"
[HKLM\SOFTWARE\baec5657-8322-5676-45d1-0440b8c442fe\10162061603631420]
"uuid" = "2692819837"
[HKLM\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214\eae10f9d]
"340d3099" = "/P////%%"
[HKCU\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214\00000000]
"3efeb33e" = ""
[HKLM\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214\eae10f9d]
"c6c5dd44" = "V/////%%"
[HKLM\SOFTWARE\baec5657-8322-5676-45d1-0440b8c442fe\10162061603631420\eae10f9d]
"a2e3b941" = "///%"
[HKLM\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214\eae10f9d]
"d94388d2" = "blA /Y//GPAf/X6/b/Ah/Xt/aPAp/Yq/GPAf/YV/cPAf/XF/UxAs/X6/aP////%%"
[HKLM\SOFTWARE\baec5657-8322-5676-45d1-0440b8c442fe\10162061603631420]
"svt" = "1431165630"
[HKLM\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214]
"data.1" = "jHIce4a4MGQE012345SBlHSH2t1n LucwUg3TDOTUACwAmrc72Q5OWrESPI72oUG3RqOC18xenzYnHZJUnJozXR8jyTfuG3rKz/6A9QLDc3ZkKmXBAZLFUppB1QO/hZ25cuhMu2gjq/K dq6K55uj3UMJNMEiwUU"
"data.0" = "g4J35TUP3EsFh2pniksVsMDhPppkPi07IvjmuN1MSr35sbWwASsXXlmwc1V29uSgg zjlIJY9YT0nOMVtDQpKkgG "
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Super Optimizer_is1]
"Publisher" = "Super PC Tools ltd"
[HKLM\SOFTWARE\baec5657-8322-5676-45d1-0440b8c442fe\10162061603631420]
"svx" = ""
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"
[HKCU\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214\eae10f9d]
"c24899a6" = "VP/g/CV/Vl/1/CF////%"
[HKLM\SOFTWARE\baec5657-8322-5676-45d1-0440b8c442fe\10162061603631420]
"iiid" = "1"
[HKLM\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214\eae10f9d]
"a1dcff5b" = "V/////%%"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Super Optimizer_is1]
"MinorVersion" = "2"
[HKLM\SOFTWARE\{6791A2F3-FC80-475C-A002-C014AF797E9C}]
"22134214" = "%Program Files%\Super Optimizer\SupOptStats.dll"
[HKLM\SOFTWARE\baec5657-8322-5676-45d1-0440b8c442fe\10162061603631420]
"svn" = "SuperOptimizer Stats"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Super Optimizer_is1]
"URLInfoAbout" = "http://www.superpctools.com/"
[HKLM\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214\eae10f9d]
"1520c6f1" = "V/////%%"
[HKLM\SOFTWARE\baec5657-8322-5676-45d1-0440b8c442fe\10162061603631420\eae10f9d]
"e46c271e" = "///%"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Super Optimizer_is1]
"Inno Setup: User" = "%CurrentUserName%"
[HKLM\SOFTWARE\baec5657-8322-5676-45d1-0440b8c442fe\10162061603631420\eae10f9d]
"f1f24e29" = "Vl/l/C/////%"
"a1dcff5b" = "V/////%%"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Super Optimizer_is1]
"UninstallString" = "%Program Files%\Super Optimizer\unins000.exe"
"Inno Setup: Language" = "en"
[HKCU\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214\eae10f9d]
"340d3099" = "/P////%%"
"060df2cd" = "blA /Y//GPAf/X6/b/Ah/Xt/aPAp/Yq/GPAp/YP/UxAs/X6/aP////%%"
"2e22d94e" = "///%"
[HKLM\SOFTWARE\baec5657-8322-5676-45d1-0440b8c442fe\10162061603631420]
"data.0" = "g4J35TUP3EsFh2pniksVsMDhPppkPi07IvjmuN1MSr35sbWwASsXXlmwc1V29uSgg zjlIJY9YT0nOMVtDQpKkgG "
[HKLM\SOFTWARE\baec5657-8322-5676-45d1-0440b8c442fe\10162061603631420\eae10f9d]
"3c09c42b" = "///%"
[HKCU\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214\eae10f9d]
"c99a5f5c" = "///%"
"e8f9dcc7" = "UlAr/XJ/c//k////"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Super Optimizer_is1]
"InstallLocation" = "%Program Files%\Super Optimizer\"
[HKLM\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214\eae10f9d]
"f0bf0bde" = "///%"
[HKCU\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214\eae10f9d]
"72758a5d" = "///%"
"8b9e4cbc" = "V/////%%"
[HKCU\Software\Super Optimizer]
"AdsDownloadURL" = "http://dl.superpcdownload.net/221001941/SuperUpdaterSetup.exe"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"
[HKLM\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214\eae10f9d]
"d1abcdb6" = "///%"
"27ddcf6f" = "///%"
[HKCU\Software\Super Optimizer]
"DelayedStart" = "5"
[HKCU\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214\eae10f9d]
"f6ad6fa6" = "V/////%%"
[HKLM\SOFTWARE\baec5657-8322-5676-45d1-0440b8c442fe\10162061603631420]
"Mode" = "4026531840"
[HKLM\SOFTWARE\baec5657-8322-5676-45d1-0440b8c442fe\10162061603631420\eae10f9d]
"f2c53c49" = "UlAr/XJ/c//k////"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"
"CommonMusic" = "%Documents and Settings%\All Users\Documents\My Music"
[HKLM\SOFTWARE\baec5657-8322-5676-45d1-0440b8c442fe\10162061603631420\eae10f9d]
"fe94ce1e" = "V/////%%"
[HKLM\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214\eae10f9d]
"a0743acc" = "N/////%%"
[HKCU\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214\eae10f9d]
"6185d035" = "VP/h/CP/V//l////"
[HKLM\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214\eae10f9d]
"37b7a6d8" = "UlAr/XJ/c//k////"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
[HKLM\SOFTWARE\baec5657-8322-5676-45d1-0440b8c442fe\10162061603631420]
"data.1" = "jHIce4a4MGQE012345SBlHSH2t1n LucwUg3TDOTUACwAmrc72Q5OWrESPI72oUG3RqOC18xenzYnHZJUnJozXR8jyTfuG3rKz/6A9QLDc3ZkKmXBAZLFUppB1QO/hZ25cuhMu2gjq/K dq6K55uj3UMJNMEiwUU"
[HKLM\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214\eae10f9d]
"8b9e4cbc" = "V/////%%"
"7f69fa1f" = "///%"
[HKLM\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214]
"Mode" = "4026531840"
[HKCU\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214]
"date" = "1431158424"
[HKLM\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214\eae10f9d]
"2d71d5ab" = "V/////%%"
[HKCU\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214\eae10f9d]
"a0743acc" = "N/////%%"
[HKLM\SOFTWARE\baec5657-8322-5676-45d1-0440b8c442fe\10162061603631420\eae10f9d]
"8b9e4cbc" = "V/////%%"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"
[HKLM\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214]
"svn" = "SuperOptimizer Stats"
[HKLM\SOFTWARE\baec5657-8322-5676-45d1-0440b8c442fe\10162061603631420]
"usr.0" = "eP7srqqomjlhabcdef"
"LRTS" = "0"
[HKCU\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214]
"Mode" = "4026531840"
[HKCU\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214\eae10f9d]
"dbaf3ce3" = "/P////%%"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
[HKLM\SOFTWARE\baec5657-8322-5676-45d1-0440b8c442fe\10162061603631420\eae10f9d]
"27ddcf6f" = "///%"
[HKCU\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214\eae10f9d]
"2d71d5ab" = "V/////%%"
[HKLM\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214\00000000]
"3efeb33e" = ""
[HKLM\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214]
"svx" = ""
"dlpath" = "c:\progra~1\supero~1\supopt~2.dll"
[HKLM\SOFTWARE\baec5657-8322-5676-45d1-0440b8c442fe\10162061603631420\eae10f9d]
"48bd1aff" = "V/////%%"
[HKCU\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214]
"usr.1" = "6AN02rvqomjlhabcde"
"usr.0" = "eP7srqqomjlhabcdef"
[HKCU\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214\eae10f9d]
"37b7a6d8" = "UlAr/XJ/c//k////"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonPictures" = "%Documents and Settings%\All Users\Documents\My Pictures"
[HKLM\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214]
"svt" = "1431165630"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Programs" = "%Documents and Settings%\All Users\Start Menu\Programs"
[HKLM\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214\eae10f9d]
"7367429f" = "///%"
[HKLM\SOFTWARE\baec5657-8322-5676-45d1-0440b8c442fe\10162061603631420\eae10f9d]
"51d2f2ea" = "JlA /Y//GPAf/D6/b/Ah/Xt/aPAp/Yq/GPAf/B//JlAh/XD/c/Ag/B//VP/j/Cx/V//j/CZ/V//h/CZ////%"
[HKLM\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214\eae10f9d]
"bbf88800" = "///%"
[HKCU\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214]
"data.0" = "g4J35TUP3EsFh2pniksVsMDhPppkPi07IvjmuN1MSr35sbWwASsXXlmwc1V29uSgg zjlIJY9YT0nOMVtDQpKkgG "
"data.1" = "jHIce4a4MGQE012345SBlHSH2t1n LucwUg3TDOTUACwAmrc72Q5OWrESPI72oUG3RqOC18xenzYnHZJUnJozXR8jyTfuG3rKz/6A9QLDc3ZkKmXBAZLFUppB1QO/hZ25cuhMu2gjq/K dq6K55uj3UMJNMEiwUU"
[HKCU\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}\_193c033b\eae10f9d]
"dbaf3ce3" = "/P////%%"
[HKLM\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214]
"date" = "1431158424"
[HKLM\SOFTWARE\baec5657-8322-5676-45d1-0440b8c442fe\10162061603631420\eae10f9d]
"7367429f" = "///%"
[HKCU\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214\eae10f9d]
"3c09c42b" = "///%"
[HKLM\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214]
"LRTS" = "0"
The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"
Proxy settings are disabled:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"Super Optimizer" = "%Program Files%\Super Optimizer\SupOptLauncher.exe"
The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"
The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:
"ProxyBypass" = "1"
The Trojan deletes the following value(s) in system registry:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"
The process %original file name%.exe:304 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Super Optimizer]
"setupname" = "c:\%original file name%.exe"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Start Menu" = "%Documents and Settings%\All Users\Start Menu"
"Common Documents" = "%Documents and Settings%\All Users\Documents"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonMusic" = "%Documents and Settings%\All Users\Documents\My Music"
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
"Desktop" = "%Documents and Settings%\%current user%\Desktop"
[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"My Pictures" = "%Documents and Settings%\%current user%\My Documents\My Pictures"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Start Menu" = "%Documents and Settings%\%current user%\Start Menu"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 28 00 00 00 01 00 00 00 00 00 00 00"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Startup" = "%Documents and Settings%\%current user%\Start Menu\Programs\Startup"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonVideo" = "%Documents and Settings%\All Users\Documents\My Videos"
"CommonPictures" = "%Documents and Settings%\All Users\Documents\My Pictures"
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "A1 FF 02 BB 8D AA A2 0F D9 3C 73 67 72 B8 A5 81"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"
The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"
The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:
"ProxyBypass" = "1"
Proxy settings are disabled:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"
The Trojan deletes the following value(s) in system registry:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"
The process supoptsetup.exe:1236 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "36 F8 7D F1 CD E7 C5 AE 5C 45 46 86 AD F2 38 70"
Dropped PE files
| MD5 | File path |
|---|---|
| db8f5267629eaca5f949b1a8be284ce7 | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\supoptsetup.exe |
| 65857ffaa6a654a0cb6e13f996727449 | c:\Program Files\Super Optimizer\SupOptGuard.exe |
| 48b844f844bcf1efcf0cb0d065249b8a | c:\Program Files\Super Optimizer\SupOptHelper.dll |
| 600dfaf49583594db504828bed51a3af | c:\Program Files\Super Optimizer\SupOptLauncher.exe |
| 61ce8181fc5ae117ef9408198340740a | c:\Program Files\Super Optimizer\SupOptReminder.exe |
| 66de4ca4b6b1441ec748250ea655edb5 | c:\Program Files\Super Optimizer\SupOptSchedule.exe |
| a10200274a1006a406580427e9c2c973 | c:\Program Files\Super Optimizer\SupOptSmartScan.exe |
| dcf99a01e8b4ef98e62fee0a4966165c | c:\Program Files\Super Optimizer\SupOptStart.exe |
| 7f7efd68c95f48250a58838e68dd07d5 | c:\Program Files\Super Optimizer\SupOptStats.dll |
| 1149f3d0ed2f9555bf961c2c93cc7352 | c:\Program Files\Super Optimizer\SupOptUninstaller.exe |
| 93b702144a5a4474146b6732e9585801 | c:\Program Files\Super Optimizer\SuperOptimizer.exe |
| 0f66e8e2340569fb17e774dac2010e31 | c:\Program Files\Super Optimizer\sqlite3.dll |
| f5be5a46f228832bd4d7f0520007bbe0 | c:\Program Files\Super Optimizer\unins000.exe |
HOSTS file anomalies
No changes have been detected.
Rootkit activity
No anomalies have been detected.
Propagation
Removals
Remove it with Ad-Aware
- Click (here) to download and install Ad-Aware Free Antivirus.
- Update the definition files.
- Run a full scan of your computer.
Manual removal*
- Terminate malicious process(es) (How to End a Process With the Task Manager):
rundll32.exe:448
supoptsetup.tmp:532
%original file name%.exe:304
supoptsetup.exe:1236 - Delete the original Trojan file.
- Delete or disinfect the following files created/modified by the Trojan:
%Program Files%\Super Optimizer\is-97N4G.tmp (22 bytes)
%Program Files%\Super Optimizer\is-ARK8I.tmp (909 bytes)
%Program Files%\Super Optimizer\is-BC2BS.tmp (6841 bytes)
%Program Files%\Super Optimizer\is-RFL46.tmp (11 bytes)
%Program Files%\Super Optimizer\is-GMBBK.tmp (7345 bytes)
%Program Files%\Super Optimizer\is-6ULSR.tmp (6841 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is-8VAAG.tmp\_isetup\_shfoldr.dll (23 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is-8VAAG.tmp\SupOptHelper.dll (7971 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\Super Optimizer\Super Optimizer.lnk (773 bytes)
%Program Files%\Super Optimizer\is-NE3HB.tmp (601 bytes)
%Program Files%\Super Optimizer\is-0JU7K.tmp (7971 bytes)
%Program Files%\Super Optimizer\is-HMREF.tmp (30 bytes)
%Documents and Settings%\%current user%\Desktop\Super Optimizer.lnk (761 bytes)
%Program Files%\Super Optimizer\is-8JNS8.tmp (7345 bytes)
%Program Files%\Super Optimizer\is-NONQC.tmp (4545 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\Super Optimizer\Super Optimizer on the Web.lnk (743 bytes)
%Program Files%\Super Optimizer\unins000.dat (15297 bytes)
%Program Files%\Super Optimizer\SupOptStats.dll (107419 bytes)
%Program Files%\Super Optimizer\unins000.msg (646 bytes)
%Program Files%\Super Optimizer\is-QI7DF.tmp (712 bytes)
%Program Files%\Super Optimizer\is-0BAOP.tmp (32242 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\Super Optimizer\Uninstall Super Optimizer.lnk (769 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\Super Optimizer\Check updates.lnk (801 bytes)
%Program Files%\Super Optimizer\is-EFT90.tmp (3073 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\Super Optimizer\Help.lnk (773 bytes)
%Program Files%\Super Optimizer\is-OV5EC.tmp (7433 bytes)
%Program Files%\Super Optimizer\is-QCJ8L.tmp (33652 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is-8VAAG.tmp\SupOptStats.dll (12287 bytes)
%Program Files%\Super Optimizer\is-P4DTB.tmp (7726 bytes)
%Program Files%\Super Optimizer\is-218K9.tmp (127 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@google.com[1].txt (270 bytes)
%Documents and Settings%\%current user%\NTUSER.DAT.LOG (7280 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\supoptsetup.exe (691004 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@google.com[2].txt (658 bytes)
%Documents and Settings%\%current user%\Cookies\index.dat (1928 bytes)
%Documents and Settings%\%current user%\Start Menu\Programs\Startup\hqghumeaylnlf.lnk (2 bytes)
%Documents and Settings%\All Users\Application Data\{25d4c92b-01c4-5ff0-25d4-4c92b01c24ac}\hqghumeaylnlf.exe (193592 bytes)
%Documents and Settings%\All Users\Application Data\{25d4c92b-01c4-5ff0-25d4-4c92b01c24ac}\hqghumeaylnlf.dat (938 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is-EU6O7.tmp\supoptsetup.tmp (7386 bytes) - Delete the following value(s) in the autorun key (How to Work with System Registry):
[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"Super Optimizer" = "%Program Files%\Super Optimizer\SupOptLauncher.exe" - Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
- Reboot the computer.
Static Analysis
VersionInfo
Company Name: Super PC Tools Ltd
Product Name: Super Optimizer v3.2
Product Version: 3.2.0.0
Legal Copyright: Super PC Tools Ltd
Legal Trademarks:
Original Filename: Super Optimizer
Internal Name: Super Optimizer
File Version: 3.2.0.0
File Description: Fix PC problems and optimize performance
Comments:
Language: German (Germany)
Company Name: Super PC Tools LtdProduct Name: Super Optimizer v3.2Product Version: 3.2.0.0Legal Copyright: Super PC Tools LtdLegal Trademarks: Original Filename: Super OptimizerInternal Name: Super OptimizerFile Version: 3.2.0.0File Description: Fix PC problems and optimize performanceComments: Language: German (Germany)
PE Sections
| Name | Virtual Address | Virtual Size | Raw Size | Entropy | Section MD5 |
|---|---|---|---|---|---|
| .text | 4096 | 147037 | 147456 | 4.5602 | 70233bc84a84b26db7d360ca1c45838f |
| .rdata | 151552 | 31986 | 32256 | 3.33653 | a81f51068b8d5f65e3db4685ba29be09 |
| .data | 184320 | 19428 | 7680 | 2.49007 | 92acd8add637b0cf82bb1012568e6f40 |
| .rsrc | 204800 | 5720808 | 5721088 | 5.52284 | 2dbb9f96e68e7d84f5d0e0d5720484da |
| .reloc | 5926912 | 25068 | 25088 | 1.97877 | 8ea8428afb7643fdd5038a849efa9f4c |
Dropped from:
Downloaded by:
Similar by SSDeep:
Similar by Lavasoft Polymorphic Checker:
Total found: 41
4336bd774f4075f87105303b1bfae60d
2e5829d6488955471fab88031cd91fbd
1a2eaf3f574792ebde90eb0fb8efaf43
6c803d49f9988f12979894df066a5f80
0fd0074d9f9c6514dd39105f8425303b
e712ff0049b00330c478595012f616ee
0978e34f49489331aad75d73d8e7380b
31d5694ae6c73f3c2dfd0a4b219ea742
300b0cb06be3cf61684328ad6fd90f74
da3b16a7e0bfc529b4134f268a4223f5
51d92304cfd123887e3d73375fd00092
dfcb5f12c03d63ca0fa24333b553716c
baea95647ef045c68115c41b73999d62
03f057a3609cde72960e28ba585341b5
67eb2ad868e11ddd5965df7e85fa51e7
781b15bce2508cbb079441ce6f3b1637
38dcd4a3cd8fc4489d10447d50c8e3d0
48378c18f29f71ad0b99308c1b97660b
0bde7d4d2aacaee21e59c764eaf454a1
6ce2a3e45ef967f83dd1d808839ee310
c0d0002188cf6b6745485b65aa3bf459
7daf01d07fff67dcf20140d39530a341
81a9adbc1ba7c794630747cc0a38974c
d14fc4ac20b32e3f87d24f9e16e576d1
4e2390010428c2add6ac06dceb98bdd9
Network Activity
URLs
| URL | IP |
|---|---|
| hxxp://isuperopt.com/inst?hid=6e7a0c36c05f265871d3419939db81981b7ce149&sid=F1757A4C-A825-43B9-9C51-76C193F75DA1&tr=211001941-AU-094&a=NA&adm=1&os=5.1&x64=0&sil=1&st=201504172&e=200 | 104.28.18.88 |
| hxxp://isuperopt.com/inst?sid=F1757A4C-A825-43B9-9C51-76C193F75DA1&st=0&e=210 | 104.28.18.88 |
| hxxp://superoptimizeit.com/install/ | 54.213.128.72 |
| hxxp://turner.map.fastly.net/ | |
| hxxp://superoptimizeit.com/get/?q=89oexG/JRMQk4BAztvOTSL2WTDBTla4B62qZ6lA0s/KU0GC4D3IhcN2wiuNAa7g57Hd8Xe5ufXRamMgnVk+3aghUkgyZrGg+1z+qleVbEu3HYZ0YdQcv/KeRjHV15gdR1aaJmn+Ln3leeZ0wdazaD2LNaICemQs8AXGQ7cr6ctHn3munEwKG+ec9nQqTq4hAWY6wvrI4W440nm7VyaGgve2k22AWkNjqHgZPBD28a1E6A1xVZKC7gyaL4OPcGWY23r8IxQG4KeUGzQPhLEMnCSB8VX8ItxaqBdDFlNio/nVS01OpIQjTFoqadBVBVFENMd5HTd7N4qwhpu/OasDQ2rXtRPOkbRH/cTvAJdVEW5VHIrL45rlPwkzqSFcUBx9aHYv/UnghOWoyR9fctjQP/GtnsJYLgHJd1bYWVpg+OqMllTiFg27w0ji2jXT/+A6m4wj0vKDH7eIaOJC7H3AaWwXuWfQiirr8g+EjuuCVZBYvsJ8PUryYVD4f/9NfVDvTT9THn0sQoerXwmY/zwy13b8yz5IeIUnou7xupYthecYcQGAOlh3muAyUHPHVvG7GpMUuO4bSJzBmc9rqo5bxlTq+sytHSt6/VcEJ2D6U6WoMch48KKom2gTBXRRGqeQSMUfv9By3HdI0CVnOwnNmStYINfPyVL45 | 54.213.128.72 |
| hxxp://isuperopt.com/inst?sid=F1757A4C-A825-43B9-9C51-76C193F75DA1&st=0&du=36046&e=400 | 104.28.18.88 |
| hxxp://bi.superpcdownload.net/t/i/sp?sid=211001941-AU-094&dt=1431176453&gid=F1757A4C-A825-43B9-9C51-76C193F75DA1&tz=2&ln=1&lc=0&bis=0&bief=0&biefx=0&bif=0&os=&f=356631531 | 198.20.86.29 |
| hxxp://edition.cnn.com/ | 23.235.43.73 |
IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)
Traffic
GET /get/?q=89oexG/JRMQk4BAztvOTSL2WTDBTla4B62qZ6lA0s/KU0GC4D3IhcN2wiuNAa7g57Hd8Xe5ufXRamMgnVk+3aghUkgyZrGg+1z+qleVbEu3HYZ0YdQcv/KeRjHV15gdR1aaJmn+Ln3leeZ0wdazaD2LNaICemQs8AXGQ7cr6ctHn3munEwKG+ec9nQqTq4hAWY6wvrI4W440nm7VyaGgve2k22AWkNjqHgZPBD28a1E6A1xVZKC7gyaL4OPcGWY23r8IxQG4KeUGzQPhLEMnCSB8VX8ItxaqBdDFlNio/nVS01OpIQjTFoqadBVBVFENMd5HTd7N4qwhpu/OasDQ2rXtRPOkbRH/cTvAJdVEW5VHIrL45rlPwkzqSFcUBx9aHYv/UnghOWoyR9fctjQP/GtnsJYLgHJd1bYWVpg+OqMllTiFg27w0ji2jXT/+A6m4wj0vKDH7eIaOJC7H3AaWwXuWfQiirr8g+EjuuCVZBYvsJ8PUryYVD4f/9NfVDvTT9THn0sQoerXwmY/zwy13b8yz5IeIUnou7xupYthecYcQGAOlh3muAyUHPHVvG7GpMUuO4bSJzBmc9rqo5bxlTq+sytHSt6/VcEJ2D6U6WoMch48KKom2gTBXRRGqeQSMUfv9By3HdI0CVnOwnNmStYINfPyVL45 HTTP/1.1
Accept: */*
User-Agent: win32
Host: superoptimizeit.com
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: ngx_openresty
Date: Sat, 09 May 2015 10:03:30 GMT
Content-Length: 0
Connection: close
GET /inst?hid=6e7a0c36c05f265871d3419939db81981b7ce149&sid=F1757A4C-A825-43B9-9C51-76C193F75DA1&tr=211001941-AU-094&a=NA&adm=1&os=5.1&x64=0&sil=1&st=201504172&e=200 HTTP/1.1
Content-Type: application/x-www-form-urlencoded
Accept: */*
User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
Host: isuperopt.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Date: Sat, 09 May 2015 10:00:11 GMT
Content-Type: text/plain
Content-Length: 0
Connection: keep-alive
Set-Cookie: __cfduid=d7d6a27749de61d83846278dd6abf82fd1431165611; expires=Sun, 08-May-16 10:00:11 GMT; path=/; domain=.isuperopt.com; HttpOnly
Server: cloudflare-nginx
CF-RAY: 1e3c8e4e4ab00afc-WAW
....
GET /inst?sid=F1757A4C-A825-43B9-9C51-76C193F75DA1&st=0&e=210 HTTP/1.1
Content-Type: application/x-www-form-urlencoded
Accept: */*
User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
Host: isuperopt.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Date: Sat, 09 May 2015 10:00:11 GMT
Content-Type: text/plain
Content-Length: 0
Connection: keep-alive
Set-Cookie: __cfduid=d7d6a27749de61d83846278dd6abf82fd1431165611; expires=Sun, 08-May-16 10:00:11 GMT; path=/; domain=.isuperopt.com; HttpOnly
Server: cloudflare-nginx
CF-RAY: 1e3c8e510b6a0afc-WAW
HTTP/1.1 200 OK..Date: Sat, 09 May 2015 10:00:11 GMT..Content-Type: text/plain..Content-Length: 0..Connection: keep-alive..Set-Cookie: __cfduid=d7d6a27749de61d83846278dd6abf82fd1431165611; expires=Sun, 08-May-16 10:00:11 GMT; path=/; domain=.isuperopt.com; HttpOnly..Server: cloudflare-nginx..CF-RAY: 1e3c8e510b6a0afc-WAW......
GET /inst?sid=F1757A4C-A825-43B9-9C51-76C193F75DA1&st=0&du=36046&e=400 HTTP/1.1
Content-Type: application/x-www-form-urlencoded
Accept: */*
User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
Host: isuperopt.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Date: Sat, 09 May 2015 10:00:47 GMT
Content-Type: text/plain
Content-Length: 0
Connection: keep-alive
Set-Cookie: __cfduid=da554e3e6f6466162ce2a2e269723defe1431165646; expires=Sun, 08-May-16 10:00:46 GMT; path=/; domain=.isuperopt.com; HttpOnly
Server: cloudflare-nginx
CF-RAY: 1e3c8f2bfd030afc-WAW
HTTP/1.1 200 OK..Date: Sat, 09 May 2015 10:00:47 GMT..Content-Type: text/plain..Content-Length: 0..Connection: keep-alive..Set-Cookie: __cfduid=da554e3e6f6466162ce2a2e269723defe1431165646; expires=Sun, 08-May-16 10:00:46 GMT; path=/; domain=.isuperopt.com; HttpOnly..Server: cloudflare-nginx..CF-RAY: 1e3c8f2bfd030afc-WAW..
HEAD / HTTP/1.1
Host: edition.cnn.com
Connection: close
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)
HTTP/1.1 200 OK
x-servedByHost: prd-10-60-168-40.nodes.56m.dmtio.net
Cache-Control: max-age=3600
X-XSS-Protection: 1; mode=block
Content-Security-Policy: default-src 'self' hXXp://*.cnn.com:* hXXps://*.cnn.com:* *.cnn.net:* *.turner.com:* *.ugdturner.com:* *.vgtf.net:*; script-src 'unsafe-inline' 'unsafe-eval' 'self' *; style-src 'unsafe-inline' 'self' *; frame-src 'self' *; object-src 'self' *; img-src 'self' *; media-src 'self' *; font-src 'self' *; connect-src 'self' *;
Content-Type: text/html; charset=utf-8
Via: 1.1 varnish
Content-Length: 272777
Accept-Ranges: bytes
Date: Sat, 09 May 2015 10:00:24 GMT
Via: 1.1 varnish
Age: 13
Connection: close
X-Served-By: cache-iad2141-IAD, cache-ams4135-AMS
X-Cache: HIT, HIT
X-Cache-Hits: 2, 3
X-Timer: S1431165624.749458,VS0,VE0
Vary: Accept-Encoding
Map
The Trojan connects to the servers at the folowing location(s):
Strings from Dumps
rundll32.exe_1584:
.text
.text
`.data
`.data
.rsrc
.rsrc
msvcrt.dll
msvcrt.dll
KERNEL32.dll
KERNEL32.dll
NTDLL.DLL
NTDLL.DLL
GDI32.dll
GDI32.dll
USER32.dll
USER32.dll
IMAGEHLP.dll
IMAGEHLP.dll
rundll32.pdb
rundll32.pdb
.....eZXnnnnnnnnnnnn3
.....eZXnnnnnnnnnnnn3
....eDXnnnnnnnnnnnn3
....eDXnnnnnnnnnnnn3
...eDXnnnnnnnnnnnn,
...eDXnnnnnnnnnnnn,
.eDXnnnnnnnnnnnn,
.eDXnnnnnnnnnnnn,
%Xnnnnnnnnnnnnnnn1
%Xnnnnnnnnnnnnnnn1
O3$dS7"%U9
O3$dS7"%U9
.manifest
.manifest
5.1.2600.5512 (xpsp.080413-2105)
5.1.2600.5512 (xpsp.080413-2105)
RUNDLL.EXE
RUNDLL.EXE
Windows
Windows
Operating System
Operating System
5.1.2600.5512
5.1.2600.5512
YThere is not enough memory to run the file %s.
YThere is not enough memory to run the file %s.
Please close other windows and try again.
Please close other windows and try again.
9The file %s or one of its components could not be opened.
9The file %s or one of its components could not be opened.
0The file %s or one of its components cannot run.
0The file %s or one of its components cannot run.
MThe file %s or one of its components requires a different version of Windows.
MThe file %s or one of its components requires a different version of Windows.
UThe file %s or one of its components cannot run in standard or enhanced mode Windows.3Another instance of the file %s is already running./An exception occurred while trying to run "%s"
UThe file %s or one of its components cannot run in standard or enhanced mode Windows.3Another instance of the file %s is already running./An exception occurred while trying to run "%s"
Error in %s
Error in %s
Missing entry:%s
Missing entry:%s
Error loading %s
Error loading %s
rundll32.exe_1584_rwx_10021000_00023000:
.fffff.
.fffff.
ÿf.
ÿf.
SupOptStart.exe_1096:
.idata
.idata
.rdata
.rdata
P.reloc
P.reloc
P.rsrc
P.rsrc
kernel32.dll
kernel32.dll
Windows
Windows
MSWHEEL_ROLLMSG
MSWHEEL_ROLLMSG
MSH_WHEELSUPPORT_MSG
MSH_WHEELSUPPORT_MSG
MSH_SCROLL_LINES_MSG
MSH_SCROLL_LINES_MSG
$*@@@*$@@@$ *@@* $@@($*)@-$*@@$-*@@$*-@@(*$)@-*$@@*-$@@*$-@@-* $@-$ *@* $-@$ *-@$ -*@*- $@($ *)(* $)
$*@@@*$@@@$ *@@* $@@($*)@-$*@@$-*@@$*-@@(*$)@-*$@@*-$@@*$-@@-* $@-$ *@* $-@$ *-@$ -*@*- $@($ *)(* $)
oleaut32.dll
oleaut32.dll
EVariantBadIndexError
EVariantBadIndexError
ssShift
ssShift
htKeyword
htKeyword
EInvalidOperation
EInvalidOperation
u%CNu
u%CNu
%s[%d]
%s[%d]
%s_%d
%s_%d
EInvalidGraphicOperation
EInvalidGraphicOperation
USER32.DLL
USER32.DLL
comctl32.dll
comctl32.dll
uxtheme.dll
uxtheme.dll
IE(AL("%s",4),"AL(\"%0:s\",3)","JK(\"%1:s\",\"%0:s\")")
IE(AL("%s",4),"AL(\"%0:s\",3)","JK(\"%1:s\",\"%0:s\")")
JumpID("","%s")
JumpID("","%s")
TKeyEvent
TKeyEvent
TKeyPressEvent
TKeyPressEvent
HelpKeyword
HelpKeyword
crSQLWait
crSQLWait
%s (%s)
%s (%s)
Uh#%C
Uh#%C
imm32.dll
imm32.dll
AutoHotkeys
AutoHotkeys
ssHotTrack
ssHotTrack
TWindowState
TWindowState
poProportional
poProportional
TWMKey
TWMKey
KeyPreview
KeyPreview
WindowState
WindowState
OnKeyDown$
OnKeyDown$
OnKeyPress
OnKeyPress
OnKeyUp
OnKeyUp
tagMSG
tagMSG
System\CurrentControlSet\Control\Keyboard Layouts\%.8x
System\CurrentControlSet\Control\Keyboard Layouts\%.8x
vcltest3.dll
vcltest3.dll
User32.dll
User32.dll
getservbyport
getservbyport
WSAAsyncGetServByPort
WSAAsyncGetServByPort
WSAJoinLeaf
WSAJoinLeaf
WS2_32.DLL
WS2_32.DLL
127.0.0.1
127.0.0.1
TIdSocketListWindows
TIdSocketListWindows
TIdStackWindowsU
TIdStackWindowsU
IdStackWindows
IdStackWindows
%s, %.2d %s %.4d %s %s
%s, %.2d %s %.4d %s %s
%s, %d %s %d %s %s
%s, %d %s %d %s %s
password
password
Password
Password
IdHTTPHeaderInfo
IdHTTPHeaderInfo
ProxyPassword
ProxyPassword
ProxyPort
ProxyPort
Mozilla/3.0 (compatible; Indy Library)
Mozilla/3.0 (compatible; Indy Library)
ftpTransfer
ftpTransfer
ftpReady
ftpReady
ftpAborted
ftpAborted
ClientPortMin
ClientPortMin
ClientPortMax
ClientPortMax
Port
Port
EIdCanNotBindPortInRange
EIdCanNotBindPortInRange
EIdInvalidPortRangeSVW
EIdInvalidPortRangeSVW
libeay32.dll
libeay32.dll
ssleay32.dll
ssleay32.dll
SSL_CTX_use_PrivateKey_file
SSL_CTX_use_PrivateKey_file
SSL_CTX_use_certificate_file
SSL_CTX_use_certificate_file
SSL_get_peer_certificate
SSL_get_peer_certificate
SSL_CTX_set_default_passwd_cb
SSL_CTX_set_default_passwd_cb
SSL_CTX_set_default_passwd_cb_userdata
SSL_CTX_set_default_passwd_cb_userdata
SSL_CTX_check_private_key
SSL_CTX_check_private_key
X509_STORE_CTX_get_current_cert
X509_STORE_CTX_get_current_cert
des_set_key
des_set_key
saUsernamePassword
saUsernamePassword
Password
Password
0.0.0.1
0.0.0.1
TIdTCPConnection
TIdTCPConnection
IdTCPConnection
IdTCPConnection
EIdTCPConnectionError
EIdTCPConnectionError
Uh;%F
Uh;%F
sslvrfFailIfNoPeerCert
sslvrfFailIfNoPeerCert
TPasswordEvent
TPasswordEvent
Certificate
Certificate
RootCertFile
RootCertFile
CertFile
CertFile
KeyFile
KeyFile
OnGetPasswordd;F
OnGetPasswordd;F
EIdOSSLLoadingRootCertError
EIdOSSLLoadingRootCertError
EIdOSSLLoadingCertError
EIdOSSLLoadingCertError
EIdOSSLLoadingKeyError
EIdOSSLLoadingKeyError
TIdTCPClient
TIdTCPClient
TIdTCPClient|cF
TIdTCPClient|cF
IdTCPClient
IdTCPClient
BoundPort
BoundPort
PortU
PortU
CommentURL
CommentURL
TIdHTTPMethod
TIdHTTPMethod
IdHTTP
IdHTTP
TIdHTTPOption
TIdHTTPOption
TIdHTTPOptions
TIdHTTPOptions
TIdHTTPProtocolVersion
TIdHTTPProtocolVersion
IdHTTP(
IdHTTP(
TIdHTTPOnHeadersAvailable
TIdHTTPOnHeadersAvailable
TIdHTTPOnRedirectEvent
TIdHTTPOnRedirectEvent
TIdHTTPResponse
TIdHTTPResponse
TIdHTTPResponse\
TIdHTTPResponse\
TIdHTTPRequest
TIdHTTPRequest
TIdHTTPProtocol(
TIdHTTPProtocol(
TIdCustomHTTP
TIdCustomHTTP
TIdCustomHTTP(
TIdCustomHTTP(
TIdHTTP
TIdHTTP
TIdHTTPX
TIdHTTPX
HTTPOptions$
HTTPOptions$
EIdHTTPProtocolException
EIdHTTPProtocolException
HTTPS
HTTPS
https
https
This request method is supported in HTTP 1.1
This request method is supported in HTTP 1.1
HTTP/1.0 200 OK
HTTP/1.0 200 OK
HTTP/
HTTP/
OnActionExecute
OnActionExecute
%s, ClassID: %s
%s, ClassID: %s
ole32.dll
ole32.dll
hXXp://gen.securedshopgate.com/?b=21
hXXp://gen.securedshopgate.com/?b=21
superupdater.exe
superupdater.exe
Super Updater\SuperUpdater.exe
Super Updater\SuperUpdater.exe
hXXp://VVV.superpctools.com
hXXp://VVV.superpctools.com
UninstallURL
UninstallURL
AdsDownloadURL
AdsDownloadURL
HomePageURL
HomePageURL
SupportURL
SupportURL
BuyNowURL
BuyNowURL
AdsBuyNowURL
AdsBuyNowURL
WelcomeURL
WelcomeURL
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Super Optimizer_is1
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Super Optimizer_is1
?456789:;
?456789:;
!"#$%&'()* ,-./0123
!"#$%&'()* ,-./0123
user32.dll
user32.dll
GetKeyboardType
GetKeyboardType
advapi32.dll
advapi32.dll
RegOpenKeyExA
RegOpenKeyExA
RegCloseKey
RegCloseKey
RegFlushKey
RegFlushKey
RegCreateKeyExA
RegCreateKeyExA
GetCPInfo
GetCPInfo
version.dll
version.dll
gdi32.dll
gdi32.dll
SetViewportOrgEx
SetViewportOrgEx
UnhookWindowsHookEx
UnhookWindowsHookEx
SetWindowsHookExA
SetWindowsHookExA
MsgWaitForMultipleObjects
MsgWaitForMultipleObjects
MapVirtualKeyA
MapVirtualKeyA
LoadKeyboardLayoutA
LoadKeyboardLayoutA
GetKeyboardState
GetKeyboardState
GetKeyboardLayoutList
GetKeyboardLayoutList
GetKeyboardLayout
GetKeyboardLayout
GetKeyState
GetKeyState
GetKeyNameTextA
GetKeyNameTextA
EnumWindows
EnumWindows
EnumThreadWindows
EnumThreadWindows
ActivateKeyboardLayout
ActivateKeyboardLayout
shell32.dll
shell32.dll
ShellExecuteA
ShellExecuteA
wininet.dll
wininet.dll
6!606@6`6
6!606@6`6
0 0$0(0,0
0 0$0(0,0
7"7&7*7.72767
7"7&7*7.72767
8,9094989
8,9094989
7 7$7(7,70747
7 7$7(7,70747
6"616;6@6{6
6"616;6@6{6
55v5
55v5
1C2i2x2w3%4U4d4
1C2i2x2w3%4U4d4
5%5S5{5
5%5S5{5
5 5$5(5,5054585
5 5$5(5,5054585
6 636\6`6
6 636\6`6
= =$=(=,=0=4=
= =$=(=,=0=4=
|||%UUU
|||%UUU
|||'}}};
|||'}}};
4|||){{{
4|||){{{
|||%}}}=
|||%}}}=
kzzz.yyy
kzzz.yyy
d|||ÿf
d|||ÿf
|||#}}}1|||@
|||#}}}1|||@
|||'}}}9
|||'}}}9
|||)}}}=
|||)}}}=
|||D|||%xxx
|||D|||%xxx
|||!}}}=
|||!}}}=
|||%}}}3
|||%}}}3
|||!}}}-
|||!}}}-
6}}} {{{
6}}} {{{
"|||#{{{
"|||#{{{
|||%}}}/
|||%}}}/
|||#}}}
|||#}}}
|||#|||)}}}/
|||#|||)}}}/
5}}}/|||)
5}}}/|||)
,}}}-}}}-}}}-}}}-}}}-}}}-
,}}}-}}}-}}}-}}}-}}}-}}}-
$|||!{{{
$|||!{{{
|||!|||'
|||!|||'
,}}}/}}}/}}}/}}}/
,}}}/}}}/}}}/}}}/
,|||'|||!
,|||'|||!
/|||'{{{
/|||'{{{
.xxx${{{
.xxx${{{
9}}} {{{
9}}} {{{
|||%}}}5
|||%}}}5
5|||%uuu
5|||%uuu
|||#}}}3
|||#}}}3
|||'{{{:
|||'{{{:
|||)}}}?
|||)}}}?
|||'}}}=
|||'}}}=
|||'{{{>
|||'{{{>
|||)|||@
|||)|||@
Z}}};|||%sss
Z}}};|||%sss
.zzzE
.zzzE
|||'}}}?
|||'}}}?
[}}}1{{{
[}}}1{{{
|||!}}} }}}5
|||!}}} }}}5
(}}}3}}}=
(}}}3}}}=
$|||%yyy&yyy&uuu%xxx"www
$|||%yyy&yyy&uuu%xxx"www
0{{{8}}}?
0{{{8}}}?
|||!|||%|||)}}}/
|||!|||%|||)}}}/
,}}}1{{{6
,}}}1{{{6
9}}}5}}}1
9}}}5}}}1
,|||'|||#{{{
,|||'|||#{{{
.yyy*|||'|||#xxx rrr
.yyy*|||'|||#xxx rrr
|||!|||#
|||!|||#
&|||#|||!
&|||#|||!
*}}} }}}-}}}/}}}/
*}}} }}}-}}}/}}}/
2}}}3}}}3}}}3}}}3}}}3}}}3
2}}}3}}}3}}}3}}}3}}}3}}}3
0}}}/}}}/}}}-}}}
0}}}/}}}/}}}-}}}
(|||'|||%xxx"|||!{{{
(|||'|||%xxx"|||!{{{
|||!|||%
|||!|||%
(|||%|||!{{{
(|||%|||!{{{
4}}}7{{{6}}}5}}}5
4}}}7{{{6}}}5}}}5
|||#|||)
|||#|||)
(|||#{{{
(|||#{{{
,|||%{{{
,|||%{{{
|||!|||)
|||!|||)
*|||#{{{
*|||#{{{
/|||%{{{
/|||%{{{
3|||){{{
3|||){{{
5|||){{{
5|||){{{
6|||){{{
6|||){{{
"|||#|||!
"|||#|||!
4|||'{{{
4|||'{{{
1|||%{{{
1|||%{{{
2|||%{{{
2|||%{{{
5|||'{{{
5|||'{{{
7|||'{{{
7|||'{{{
:|||){{{
:|||){{{
|||){{{4
|||){{{4
.|||'|||!{{{
.|||'|||!{{{
|||%{{{
|||%{{{
/|||)|||#{{{
/|||)|||#{{{
zzz.xxx3
zzz.xxx3
*|||)|||'|||%|||!{{{
*|||)|||'|||%|||!{{{
6|||'|||!{{{
6|||'|||!{{{
|||!|||%|||)
|||!|||%|||)
|||#|||'
|||#|||'
(|||%|||#
(|||%|||#
"|||#|||#
"|||#|||#
$|||%|||%|||%|||%|||%|||%|||%|||%|||%|||%|||%|||%|||%|||%
$|||%|||%|||%|||%|||%|||%|||%|||%|||%|||%|||%|||%|||%|||%
$|||#|||#
$|||#|||#
KWindows
KWindows
UrlMon
UrlMon
0IdHTTPHeaderInfo
0IdHTTPHeaderInfo
IdTCPServer
IdTCPServer
IdTCPStream
IdTCPStream
Font.Charset
Font.Charset
Font.Color
Font.Color
Font.Height
Font.Height
Font.Name
Font.Name
Font.Style
Font.Style
Icon.Data
Icon.Data
Could not load certificate.#Could not load key, check password.
Could not load certificate.#Could not load key, check password.
SSL status: "%s"
SSL status: "%s"
OLE error %.8x.Method '%s' not supported by automation object/Variant does not reference an automation object7Dispatch methods do not support more than 64 parameters
OLE error %.8x.Method '%s' not supported by automation object/Variant does not reference an automation object7Dispatch methods do not support more than 64 parameters
Command not supported.
Command not supported.
Address type not supported.$Error accepting connection with SSL.
Address type not supported.$Error accepting connection with SSL.
Error creating SSL context. Could not load root certificate.
Error creating SSL context. Could not load root certificate.
Socket is not connected..Cannot send or receive after socket is closed.#Too many references, cannot splice.
Socket is not connected..Cannot send or receive after socket is closed.#Too many references, cannot splice.
Request rejected or failed.5Request rejected because SOCKS server cannot connect.QRequest rejected because the client program and identd report different user-ids.
Request rejected or failed.5Request rejected because SOCKS server cannot connect.QRequest rejected because the client program and identd report different user-ids.
Protocol not supported.
Protocol not supported.
Socket type not supported."Operation not supported on socket.
Socket type not supported."Operation not supported on socket.
Protocol family not supported.0Address family not supported by protocol family.
Protocol family not supported.0Address family not supported by protocol family.
Chunk StartedDThis authentication method is already registered with class name %s.
Chunk StartedDThis authentication method is already registered with class name %s.
%s is not a valid service.
%s is not a valid service.
Socket Error # %d
Socket Error # %d
%s is not a valid IP address.
%s is not a valid IP address.
Operation would block.
Operation would block.
Operation now in progress.
Operation now in progress.
Operation already in progress.
Operation already in progress.
Socket operation on non-socket.
Socket operation on non-socket.
No data to read.$Can not bind in port range (%d - %d)
No data to read.$Can not bind in port range (%d - %d)
Invalid Port Range (%d - %d)
Invalid Port Range (%d - %d)
Max line length exceeded.*Error on call Winsock2 library function %s&Error on loading Winsock2 library (%s)
Max line length exceeded.*Error on call Winsock2 library function %s&Error on loading Winsock2 library (%s)
Resolving hostname %s.
Resolving hostname %s.
Connecting to %s.
Connecting to %s.
No help keyword specified.
No help keyword specified.
Connection Closed Gracefully.;Could not bind socket. Address and port are already in use.4Failed attempting to retrieve time zone information.
Connection Closed Gracefully.;Could not bind socket. Address and port are already in use.4Failed attempting to retrieve time zone information.
File "%s" not found1Only one TIdAntiFreeze can exist per application."%d: Circular links are not allowed
File "%s" not found1Only one TIdAntiFreeze can exist per application."%d: Circular links are not allowed
No help found for %s#No context-sensitive help installed$No topic-based help system installed
No help found for %s#No context-sensitive help installed$No topic-based help system installed
Alt Clipboard does not support Icons/Menu '%s' is already being used by another form
Alt Clipboard does not support Icons/Menu '%s' is already being used by another form
Unsupported clipboard format
Unsupported clipboard format
Error creating window class Cannot focus a disabled or invisible window!Control '%s' has no parent window
Error creating window class Cannot focus a disabled or invisible window!Control '%s' has no parent window
List count out of bounds (%d)
List count out of bounds (%d)
List index out of bounds (%d) Out of memory while expanding memory stream
List index out of bounds (%d) Out of memory while expanding memory stream
Error reading %s%s%s: %s
Error reading %s%s%s: %s
Failed to get data for '%s'
Failed to get data for '%s'
Failed to set data for '%s'
Failed to set data for '%s'
Resource %s not found
Resource %s not found
%s.Seek not implemented$Operation not allowed on sorted list$%s not in a class registration group
%s.Seek not implemented$Operation not allowed on sorted list$%s not in a class registration group
Property %s does not exist
Property %s does not exist
Thread creation error: %s
Thread creation error: %s
Thread Error: %s (%d)
Thread Error: %s (%d)
*Can't write to a read-only resource streamECheckSynchronize called from thread $%x, which is NOT the main thread
*Can't write to a read-only resource streamECheckSynchronize called from thread $%x, which is NOT the main thread
Class %s not found
Class %s not found
A class named %s already exists%List does not allow duplicates ($0%x)#A component named %s already exists%String list does not allow duplicates
A class named %s already exists%List does not allow duplicates ($0%x)#A component named %s already exists%String list does not allow duplicates
Cannot create file "%s". %s
Cannot create file "%s". %s
Cannot open file "%s". %s
Cannot open file "%s". %s
Invalid stream format$''%s'' is not a valid component name
Invalid stream format$''%s'' is not a valid component name
Invalid data type for '%s' List capacity out of bounds (%d)
Invalid data type for '%s' List capacity out of bounds (%d)
Ancestor for '%s' not found
Ancestor for '%s' not found
Cannot assign a %s to a %s
Cannot assign a %s to a %s
Interface not supported
Interface not supported
%s (%s, line %d)
%s (%s, line %d)
Abstract Error?Access violation at address %p in module '%s'. %s of address %p
Abstract Error?Access violation at address %p in module '%s'. %s of address %p
System Error. Code: %d.
System Error. Code: %d.
Invalid variant operation%Invalid variant operation (%s%.8x)
Invalid variant operation%Invalid variant operation (%s%.8x)
%s5Could not convert variant of type (%s) into type (%s)=Overflow while converting variant of type (%s) into type (%s)
%s5Could not convert variant of type (%s) into type (%s)=Overflow while converting variant of type (%s) into type (%s)
Operation not supported
Operation not supported
External exception %x
External exception %x
Invalid pointer operation
Invalid pointer operation
Invalid class typecast0Access violation at address %p. %s of address %p
Invalid class typecast0Access violation at address %p. %s of address %p
Privileged instruction(Exception %s in module %s at %p.
Privileged instruction(Exception %s in module %s at %p.
Application Error1Format '%s' invalid or incompatible with argument
Application Error1Format '%s' invalid or incompatible with argument
No argument for format '%s'"Variant method calls not supported
No argument for format '%s'"Variant method calls not supported
!'%s' is not a valid integer value
!'%s' is not a valid integer value
I/O error %d
I/O error %d
Integer overflow Invalid floating point operation
Integer overflow Invalid floating point operation
3.2.0.0
3.2.0.0