Skip to main content

Worm.Win32.AutoItGen_8f0dd6d56f


mzpefinder_pcap_file.YR, WormAutoItGen.YR (Lavasoft MAS)Behaviour: Worm

The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.

Summary

MD5: 8f0dd6d56f6866b5ed1effe628d7c71b

SHA1: d0a873671d6d897aa0fad6b58a35ff6f3824d9e1

SHA256: e9fcdfee321934b560bdac6557438ca011de84e4583a12f23e73eea713b0906e

SSDeep: 24576:ExGDhqy1fkXC6jBNrrDT8oQWT5cgvzxP8SCUO:pNqrCQvFjrDCUO

Size: 1079328 bytes

File type: EXE

Platform: WIN32

Entropy: Packed

PEID: BorlandDelphi30, UPolyXv05_v6

Company: Uniblue Systems Limited

Created at: 2013-10-13 11:19:32

Analyzed on: Windows7Ada SP1 64-bit

Summary: Worm. A program that is primarily replicating on networks or removable drives.

Dynamic Analysis

Payload

No specific payload has been found.

Process activity

The Worm creates the following process(es):

aff_setup.exe:2808
thirdpartyinstaller.exe:1176
%original file name%.exe:2008
8f0dd6d56f6866b5ed1effe628d7c71b.tmp:2220
pm-standalone-setup.exe:2420
pm-standalone-setup.tmp:888
dd2a5f4929d14f419028f48e1839521d766015.exe:1632
OLBPre.exe:2904
pc-mechanic.exe:2708

The Worm injects its code into the following process(es):

pc-mechanic.exe:2024

Mutexes

The following mutexes were created/opened:No objects were found.

File activity

The process aff_setup.exe:2808 makes changes in the file system.


The Worm creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsl93B9.tmp\NSISdl.dll (30 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\UserGuide_1405.pdf (784 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\log.txt (347 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\aff.conf (491 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\dd2a5f4929d14f419028f48e1839521d766015.exe (91153 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsl93B9.tmp\nsRandom.dll (808 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Readme_1628.txt (784 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsl93B9.tmp\nsJSON.dll (15 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsw93A9.tmp (7291 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsl93B9.tmp\LogEx.dll (1597 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Settings_8198.dat (784 bytes)

The process thirdpartyinstaller.exe:1176 makes changes in the file system.


The Worm creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Uniblue\Offers\aff_setup.exe (176 bytes)
%Program Files% (x86)\Uniblue\PC-Mechanic\installer_mypcbackup.log (853 bytes)

The process %original file name%.exe:2008 makes changes in the file system.


The Worm creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\is-3OBPR.tmp\8f0dd6d56f6866b5ed1effe628d7c71b.tmp (50 bytes)

The process 8f0dd6d56f6866b5ed1effe628d7c71b.tmp:2220 makes changes in the file system.


The Worm creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\is-6FU40.tmp\InstallerExtensions.dll (715 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\is-6FU40.tmp\myPCBackup_dot_com_logo_245x53.bmp (39 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Uniblue\Offers\aff_setup.exe (41394 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\USU4CORO\aff_setup[1].exe (42672 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\is-6FU40.tmp\_isetup\_setup64.tmp (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\is-6FU40.tmp\uniblue_product_logo_50x50_white_background.bmp (7 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\is-6FU40.tmp\license.en.rtf (26 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\is-6FU40.tmp\printer.bmp (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\is-6FU40.tmp\checkmark_10x8.bmp (310 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\is-6FU40.tmp\banner_icon.bmp (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\SH2TVRCI\pcmechanicpm-standalone-setup[1].exe (5665064 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\is-6FU40.tmp\pm-standalone-setup.exe (5425549 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Setup Log 2015-04-15 #001.txt (23254 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\is-6FU40.tmp\windows8_with_innovation.bmp (601 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\is-6FU40.tmp\_isetup\_shfoldr.dll (47 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\is-6FU40.tmp\microsoft_partner.bmp (53 bytes)

The process pm-standalone-setup.exe:2420 makes changes in the file system.


The Worm creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\is-J194S.tmp\pm-standalone-setup.tmp (50 bytes)

The process pm-standalone-setup.tmp:888 makes changes in the file system.


The Worm creates and/or writes to the following file(s):

%Program Files% (x86)\Uniblue\PC-Mechanic\pc-mechanic.exe (291 bytes)
%Program Files% (x86)\Uniblue\PC-Mechanic\fonts\is-L5TB4.tmp (1281 bytes)
%Program Files% (x86)\Uniblue\PC-Mechanic\is-D42IV.tmp (20504 bytes)
%Program Files% (x86)\Uniblue\PC-Mechanic\is-VO3E7.tmp (35285 bytes)
%Program Files% (x86)\Uniblue\PC-Mechanic\is-LQCTJ.tmp (114305 bytes)
%Program Files% (x86)\Uniblue\PC-Mechanic\fonts\is-T38DQ.tmp (1281 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\is-EJ8OV.tmp (4 bytes)
%Program Files% (x86)\Uniblue\PC-Mechanic\is-4VGDV.tmp (197872 bytes)
%Program Files% (x86)\Uniblue\PC-Mechanic\fonts\is-8MILD.tmp (1281 bytes)
%Program Files% (x86)\Uniblue\PC-Mechanic\fonts\is-2BQ2S.tmp (1281 bytes)
%Program Files% (x86)\Uniblue\PC-Mechanic\Microsoft.VC90.CRT\is-81TR2.tmp (3361 bytes)
C:\Users\Public\Desktop\PC Mechanic.lnk (1 bytes)
%Program Files% (x86)\Uniblue\PC-Mechanic\Third-party Terms\is-C2PRA.tmp (13 bytes)
%Program Files% (x86)\Uniblue\PC-Mechanic\locale\fi\LC_MESSAGES\is-G88F5.tmp (601 bytes)
%Program Files% (x86)\Uniblue\PC-Mechanic\locale\it\LC_MESSAGES\is-MALHE.tmp (601 bytes)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Uniblue\PC Mechanic\PC Mechanic.lnk (1 bytes)
%Program Files% (x86)\Uniblue\PC-Mechanic\locale\de\LC_MESSAGES\is-KQQMD.tmp (601 bytes)
%Program Files% (x86)\Uniblue\PC-Mechanic\fonts\is-1EKH1.tmp (1281 bytes)
%Program Files% (x86)\Uniblue\PC-Mechanic\locale\da\LC_MESSAGES\is-65M8L.tmp (601 bytes)
%Program Files% (x86)\Uniblue\PC-Mechanic\locale\pt_BR\LC_MESSAGES\is-BQT7R.tmp (601 bytes)
%Program Files% (x86)\Uniblue\PC-Mechanic\locales\is-1MPBL.tmp (4 bytes)
%Program Files% (x86)\Uniblue\PC-Mechanic\fonts\is-3U8HG.tmp (1281 bytes)
%Program Files% (x86)\Uniblue\PC-Mechanic\locale\en\LC_MESSAGES\is-1HAGF.tmp (601 bytes)
%Program Files% (x86)\Uniblue\PC-Mechanic\is-8UFQG.tmp (75544 bytes)
%Program Files% (x86)\Uniblue\PC-Mechanic\Third-party Terms\is-TT2MJ.tmp (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Setup Log 2015-04-15 #002.txt (460554 bytes)
%Program Files% (x86)\Uniblue\PC-Mechanic\locale\es\LC_MESSAGES\is-KV1T1.tmp (601 bytes)
%Program Files% (x86)\Uniblue\PC-Mechanic\locale\no\LC_MESSAGES\is-03EBF.tmp (601 bytes)
%Program Files% (x86)\Uniblue\PC-Mechanic\fonts\is-BI3OR.tmp (1281 bytes)
%Program Files% (x86)\Uniblue\PC-Mechanic\unins000.msg (646 bytes)
%Program Files% (x86)\Uniblue\PC-Mechanic\Third-party Terms\is-I7C42.tmp (1 bytes)
%Program Files% (x86)\Uniblue\PC-Mechanic\locale\fr\LC_MESSAGES\is-K89A0.tmp (601 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\is-EJ8OV.tmp\license.en.rtf (26 bytes)
%Program Files% (x86)\Uniblue\PC-Mechanic\Microsoft.VC90.CRT\is-4O73U.tmp (4545 bytes)
%Program Files% (x86)\Uniblue\PC-Mechanic\Microsoft.VC90.CRT\is-1NT3A.tmp (524 bytes)
%Program Files% (x86)\Uniblue\PC-Mechanic\Third-party Terms\is-DG0QA.tmp (1 bytes)
%Program Files% (x86)\Uniblue\PC-Mechanic\locale\ru\LC_MESSAGES\is-0LHNU.tmp (601 bytes)
%Program Files% (x86)\Uniblue\PC-Mechanic\is-JJR23.tmp (601 bytes)
%Program Files% (x86)\Uniblue\PC-Mechanic\Third-party Terms\is-277QT.tmp (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\is-EJ8OV.tmp\windows8_with_innovation.bmp (601 bytes)
%Program Files% (x86)\Uniblue\PC-Mechanic\Third-party Terms\is-LQ5K1.tmp (11 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\PC-Mechanic.lnk (1 bytes)
%Program Files% (x86)\Uniblue\PC-Mechanic\unins000.dat (30302 bytes)
%Program Files% (x86)\Uniblue\PC-Mechanic\Third-party Terms\is-4UCCP.tmp (112 bytes)
%Program Files% (x86)\Uniblue\PC-Mechanic\Third-party Terms\is-NRGN6.tmp (1 bytes)
%Program Files% (x86)\Uniblue\PC-Mechanic\Third-party Terms\is-E9LUF.tmp (10 bytes)
%Program Files% (x86)\Uniblue\PC-Mechanic\locale\nl\LC_MESSAGES\is-N1UL8.tmp (601 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\is-EJ8OV.tmp\InstallerExtensions.dll (715 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\is-EJ8OV.tmp\_isetup\_setup64.tmp (6 bytes)
%Program Files% (x86)\Uniblue\PC-Mechanic\Third-party Terms\is-ETSB4.tmp (1 bytes)
%Program Files% (x86)\Uniblue\PC-Mechanic\Third-party Terms\is-73U4E.tmp (1 bytes)
%Program Files% (x86)\Uniblue\PC-Mechanic\locale\ja\LC_MESSAGES\is-4B2SS.tmp (601 bytes)
%Program Files% (x86)\Uniblue\PC-Mechanic\Third-party Terms\is-48U0H.tmp (1 bytes)
%Program Files% (x86)\Uniblue\PC-Mechanic\is-IGR6O.tmp (28498 bytes)
%Program Files% (x86)\Uniblue\PC-Mechanic\fonts\is-2B2SF.tmp (1281 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\is-EJ8OV.tmp\_isetup\_shfoldr.dll (47 bytes)
%Program Files% (x86)\Uniblue\PC-Mechanic\is-8GN06.tmp (601 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\is-EJ8OV.tmp\printer.bmp (1 bytes)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Uniblue\PC Mechanic\Uninstall PC Mechanic.lnk (1 bytes)
%Program Files% (x86)\Uniblue\PC-Mechanic\fonts\is-94UBV.tmp (1281 bytes)
%Program Files% (x86)\Uniblue\PC-Mechanic\locale\sv\LC_MESSAGES\is-RVIJM.tmp (601 bytes)

The process dd2a5f4929d14f419028f48e1839521d766015.exe:1632 makes changes in the file system.


The Worm creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsl9FE9.tmp\nsExec.dll (14 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsl9FE9.tmp\nsSCM.dll (13 bytes)
%Program Files% (x86)\OLBPre\it_IT.mo (1856 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsl9FE9.tmp\nsRandom.dll (808 bytes)
C:\Users\"%CurrentUserName%"\Desktop\MyPC Backup.lnk (1 bytes)
%Program Files% (x86)\OLBPre\uninst.exe (1026 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyPC Backup.lnk (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsw9FD9.tmp (54650 bytes)
%Program Files% (x86)\OLBPre\de_DE.mo (1856 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsl9FE9.tmp\AccessControl.dll (20 bytes)
%Program Files% (x86)\OLBPre\es_ES.mo (1856 bytes)
%Program Files% (x86)\OLBPre\OLBPre.exe.config (203 bytes)
%Program Files% (x86)\OLBPre\OLBPre.exe (35833 bytes)
%Program Files% (x86)\OLBPre\fr_FR.mo (1856 bytes)
%Program Files% (x86)\OLBPre\pt_PT.mo (1856 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsl9FE9.tmp\DotNetChecker.dll (1597 bytes)
%Program Files% (x86)\OLBPre\brand.jdat (17848 bytes)
%Program Files% (x86)\OLBPre\LinqBridge.dll (1856 bytes)

The process OLBPre.exe:2904 makes changes in the file system.


The Worm creates and/or writes to the following file(s):

%Program Files% (x86)\OLBPre\state.jdat (428 bytes)
%Program Files% (x86)\OLBPre\aff.jdat (140 bytes)

The process pc-mechanic.exe:2024 makes changes in the file system.


The Worm creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Roaming\Uniblue\PC-Mechanic\error.log (6914 bytes)

The process pc-mechanic.exe:2708 makes changes in the file system.


The Worm creates and/or writes to the following file(s):

%Program Files% (x86)\Uniblue\PC-Mechanic\icudt.dll (825 bytes)
C:\Windows\Tasks\PC-Mechanic Startup.job (684 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Uniblue\PC-Mechanic\settings.dat (15 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Uniblue\PC-Mechanic\error.log (6093 bytes)
%Program Files% (x86)\Uniblue\PC-Mechanic\libcef.dll (10562 bytes)
C:\Windows\Tasks\PC-Mechanic Maintenance.job (702 bytes)
C:\Windows\Tasks\PC-Mechanic Subscription.job (702 bytes)

Registry activity

The process 8f0dd6d56f6866b5ed1effe628d7c71b.tmp:2220 makes changes in the system registry.


The Worm creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies]
"CachePrefix" = "Cookie:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-ef-0d-5d]
"WpadDecision" = "0"

[HKLM\SOFTWARE\Wow6432Node\Uniblue\PC-Mechanic]
"InstallerBuiltWithOffers" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History]
"CachePrefix" = "Visited:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content]
"CachePrefix" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{EE1E4E39-627C-4D52-9D86-A515AB38A003}]
"WpadDecisionTime" = "A3 F7 D6 A7 26 77 D0 01"
"WpadDecisionReason" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-ef-0d-5d]
"WpadDecisionTime" = "A3 F7 D6 A7 26 77 D0 01"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 41 00 00 00 09 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{EE1E4E39-627C-4D52-9D86-A515AB38A003}]
"WpadDecision" = "0"
"WpadNetworkName" = "Network"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-ef-0d-5d]
"WpadDecisionReason" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Worm deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{EE1E4E39-627C-4D52-9D86-A515AB38A003}]
"WpadDetectedUrl"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"
"ProxyOverride"
"AutoDetect"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-ef-0d-5d]
"WpadDetectedUrl"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"

The process pm-standalone-setup.tmp:888 makes changes in the system registry.


The Worm creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1F88FC5D-4D46-448A-AF59-7061FFC6ABBF}_is1]
"Inno Setup: Icon Group" = "Uniblue\PC Mechanic"

[HKCR\pc-mechanic]
"URL Protocol" = ""

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1F88FC5D-4D46-448A-AF59-7061FFC6ABBF}_is1]
"NoModify" = "1"
"NoRepair" = "1"
"Inno Setup: Language" = "en"
"EstimatedSize" = "62107"
"InstallDate" = "20150415"
"Comments" = "Uninstall PC Mechanic"

[HKLM\SOFTWARE\Wow6432Node\Uniblue\PC-Mechanic]
"UnitID" = "4010"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1F88FC5D-4D46-448A-AF59-7061FFC6ABBF}_is1]
"MinorVersion" = "0"

[HKLM\SOFTWARE\Wow6432Node\Uniblue\PC-Mechanic]
"EcommercePlatform" = "cleverbridge"

[HKCR\pc-mechanic\DefaultIcon]
"(Default)" = "pc-mechanic.exe,1"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1F88FC5D-4D46-448A-AF59-7061FFC6ABBF}_is1]
"Inno Setup: Selected Tasks" = "desktopicon,quicklaunchicon"
"Inno Setup: User" = "%CurrentUserName%"
"Inno Setup: Deselected Tasks" = ""

[HKLM\SOFTWARE\Wow6432Node\Uniblue\PC-Mechanic]
"InstalledLocation" = "%Program Files% (x86)\Uniblue\PC-Mechanic\pc-mechanic.exe"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1F88FC5D-4D46-448A-AF59-7061FFC6ABBF}_is1]
"QuietUninstallString" = "%Program Files% (x86)\Uniblue\PC-Mechanic\unins000.exe /SILENT"
"DisplayVersion" = "1.0.5.0"
"URLUpdateInfo" = "http://uniblue.com/software/pcmechanicpm/updates/"
"UninstallString" = "%Program Files% (x86)\Uniblue\PC-Mechanic\unins000.exe"

[HKCR\pc-mechanic]
"(Default)" = "URL:PC-Mechanic Protocol"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1F88FC5D-4D46-448A-AF59-7061FFC6ABBF}_is1]
"MajorVersion" = "1"
"DisplayName" = "PC Mechanic"
"Publisher" = "Uniblue Systems Limited"
"HelpLink" = "http://www.uniblue.com/support/manuals/"

[HKLM\SOFTWARE\Wow6432Node\Uniblue\PC-Mechanic]
"InstallDate" = "2015-04-15"

[HKCR\pc-mechanic\shell\open\command]
"(Default)" = "%Program Files% (x86)\Uniblue\PC-Mechanic\pc-mechanic.exe --serial=%1"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1F88FC5D-4D46-448A-AF59-7061FFC6ABBF}_is1]
"Inno Setup: Setup Version" = "5.5.4 (u)"
"DisplayIcon" = "%Program Files% (x86)\Uniblue\PC-Mechanic\pc-mechanic.exe"
"InstallLocation" = "%Program Files% (x86)\Uniblue\PC-Mechanic\"

[HKLM\SOFTWARE\Wow6432Node\Uniblue\PC-Mechanic]
"PurchaseUrl" = "http://www.uniblue.com/cm/marimedia-an/pcmechanicpm/an_row_01/purchase/"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1F88FC5D-4D46-448A-AF59-7061FFC6ABBF}_is1]
"URLInfoAbout" = "http://www.uniblue.com/support/"

[HKLM\SOFTWARE\Wow6432Node\Uniblue\PC-Mechanic]
"lang" = "en"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1F88FC5D-4D46-448A-AF59-7061FFC6ABBF}_is1]
"Inno Setup: App Path" = "%Program Files% (x86)\Uniblue\PC-Mechanic"

The Worm deletes the following value(s) in system registry:

[HKCR\pc-mechanic]
"URL Protocol"

[HKCR\pc-mechanic\DefaultIcon]
"(Default)"

[HKCR\pc-mechanic]
"(Default)"

[HKCR\pc-mechanic\shell\open\command]
"(Default)"

[HKLM\SOFTWARE\Wow6432Node\Uniblue\PC-Mechanic]
"PurchaseUrl"
"InstalledLocation"

The process dd2a5f4929d14f419028f48e1839521d766015.exe:1632 makes changes in the system registry.


The Worm creates and/or sets the following values in system registry:

[HKLM\System\CurrentControlSet\Control\Session Manager]
"PendingFileRenameOperations" = "\??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\VMwareDnD\31ec1c24\PUPautoinsaller_v1.exe, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\VMwareDnD\31ec1c24\, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\VMwareDnD\6c88b866\python.dll, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\VMwareDnD\6c88b866\, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsl9FE9.tmp\nsSCM.dll,"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\OLBPre]
"DisplayVersion" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\OLBPre]
"DisplayName" = "MyPC Backup"
"DisplayIcon" = "%Program Files% (x86)\OLBPre\uninst.exe"
"Publisher" = "MyPC Backup"
"HelpLink" = "http://support.mypcbackup.com"
"URLInfoAbout" = "http://www.mypcbackup.com"
"UninstallString" = "%Program Files% (x86)\OLBPre\uninst.exe"

The Worm deletes the following value(s) in system registry:

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"
"IntranetName"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

The process pc-mechanic.exe:2024 makes changes in the system registry.


The Worm creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Wow6432Node\Uniblue\PC-Mechanic]
"IsRegistered" = "0"

To automatically run itself each time Windows is booted, the Worm adds the following link to its file to the system registry autorun key:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"VMware User Process" = "%Program Files%\VMware\VMware Tools\vmtoolsd.exe -n vmusr"

"VMware Tools" = "%Program Files%\VMware\VMware Tools\VMwareTray.exe"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"Adobe ARM" = "%Program Files% (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"

"Adobe Reader Speed Launcher" = "%Program Files% (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe"

"SunJavaUpdateSched" = "%Program Files% (x86)\Common Files\Java\Java Update\jusched.exe"

The process pc-mechanic.exe:2708 makes changes in the system registry.


The Worm creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Wow6432Node\Uniblue\PC-Mechanic]
"IsRegistered" = "0"

To automatically run itself each time Windows is booted, the Worm adds the following link to its file to the system registry autorun key:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"VMware User Process" = "%Program Files%\VMware\VMware Tools\vmtoolsd.exe -n vmusr"

"VMware Tools" = "%Program Files%\VMware\VMware Tools\VMwareTray.exe"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"Adobe ARM" = "%Program Files% (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"

"Adobe Reader Speed Launcher" = "%Program Files% (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe"

"SunJavaUpdateSched" = "%Program Files% (x86)\Common Files\Java\Java Update\jusched.exe"

Dropped PE files

MD5 File path
e5cc3997457cd365e43c19f0f9110148c:\Program Files (x86)\OLBPre\LinqBridge.dll
40208211ef9aa6fd25712f8f0850c9b2c:\Program Files (x86)\OLBPre\OLBPre.exe
660605e24b0cf1068bfbb4a4ec647652c:\Program Files (x86)\OLBPre\uninst.exe
2ae42712f67f30dfeb9b7ae8798e1c29c:\Program Files (x86)\Uniblue\PC-Mechanic\InstallerExtensions.dll
6de5c66e434a9c1729575763d891c6c2c:\Program Files (x86)\Uniblue\PC-Mechanic\Microsoft.VC90.CRT\msvcp90.dll
e7d91d008fe76423962b91c43c88e4ebc:\Program Files (x86)\Uniblue\PC-Mechanic\Microsoft.VC90.CRT\msvcr90.dll
5434e18b933e03f274d8da59fda4c676c:\Program Files (x86)\Uniblue\PC-Mechanic\icudt.dll
28888738b5521923a244fac763767db4c:\Program Files (x86)\Uniblue\PC-Mechanic\libcef.dll
a681d994fefa6865b181937c97688c96c:\Program Files (x86)\Uniblue\PC-Mechanic\pc-mechanic.exe
718355a4c81fdae7e890292ed04c0dacc:\Program Files (x86)\Uniblue\PC-Mechanic\thirdpartyinstaller.exe
5bf98032f3b5ac20ed8160d9a183baffc:\Program Files (x86)\Uniblue\PC-Mechanic\unins000.exe
6843e5f8e199b000decdb9ef0cb74b3fc:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\SH2TVRCI\pcmechanicpm-standalone-setup[1].exe
1880b2782d67fd2a085fb7d100dac569c:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\USU4CORO\aff_setup[1].exe
1880b2782d67fd2a085fb7d100dac569c:\Users\"%CurrentUserName%"\AppData\Local\Temp\Uniblue\Offers\aff_setup.exe
c40ba3b952382be22efdb2ce180b5233c:\Users\"%CurrentUserName%"\AppData\Local\Temp\dd2a5f4929d14f419028f48e1839521d766015.exe
2ae42712f67f30dfeb9b7ae8798e1c29c:\Users\"%CurrentUserName%"\AppData\Local\Temp\is-6FU40.tmp\InstallerExtensions.dll
526426126ae5d326d0a24706c77d8c5cc:\Users\"%CurrentUserName%"\AppData\Local\Temp\is-6FU40.tmp\_isetup\_setup64.tmp
92dc6ef532fbb4a5c3201469a5b5eb63c:\Users\"%CurrentUserName%"\AppData\Local\Temp\is-6FU40.tmp\_isetup\_shfoldr.dll
6843e5f8e199b000decdb9ef0cb74b3fc:\Users\"%CurrentUserName%"\AppData\Local\Temp\is-6FU40.tmp\pm-standalone-setup.exe
62efa7b730eb0523a026ea4325403b77c:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsl9FE9.tmp\nsSCM.dll

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

Removals

Remove it with Ad-Aware

  1. Click (here) to download and install Ad-Aware Free Antivirus.
  2. Update the definition files.
  3. Run a full scan of your computer.

Manual removal*

  1. Terminate malicious process(es) (How to End a Process With the Task Manager):

    aff_setup.exe:2808
    thirdpartyinstaller.exe:1176
    %original file name%.exe:2008
    8f0dd6d56f6866b5ed1effe628d7c71b.tmp:2220
    pm-standalone-setup.exe:2420
    pm-standalone-setup.tmp:888
    dd2a5f4929d14f419028f48e1839521d766015.exe:1632
    OLBPre.exe:2904
    pc-mechanic.exe:2708

  2. Delete the original Worm file.
  3. Delete or disinfect the following files created/modified by the Worm:

    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsl93B9.tmp\NSISdl.dll (30 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\UserGuide_1405.pdf (784 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\log.txt (347 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\aff.conf (491 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\dd2a5f4929d14f419028f48e1839521d766015.exe (91153 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsl93B9.tmp\nsRandom.dll (808 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Readme_1628.txt (784 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsl93B9.tmp\nsJSON.dll (15 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsw93A9.tmp (7291 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsl93B9.tmp\LogEx.dll (1597 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Settings_8198.dat (784 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Uniblue\Offers\aff_setup.exe (176 bytes)
    %Program Files% (x86)\Uniblue\PC-Mechanic\installer_mypcbackup.log (853 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\is-3OBPR.tmp\8f0dd6d56f6866b5ed1effe628d7c71b.tmp (50 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\is-6FU40.tmp\InstallerExtensions.dll (715 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\is-6FU40.tmp\myPCBackup_dot_com_logo_245x53.bmp (39 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\USU4CORO\aff_setup[1].exe (42672 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\is-6FU40.tmp\_isetup\_setup64.tmp (6 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\is-6FU40.tmp\uniblue_product_logo_50x50_white_background.bmp (7 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\is-6FU40.tmp\license.en.rtf (26 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\is-6FU40.tmp\printer.bmp (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\is-6FU40.tmp\checkmark_10x8.bmp (310 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\is-6FU40.tmp\banner_icon.bmp (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\SH2TVRCI\pcmechanicpm-standalone-setup[1].exe (5665064 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\is-6FU40.tmp\pm-standalone-setup.exe (5425549 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Setup Log 2015-04-15 #001.txt (23254 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\is-6FU40.tmp\windows8_with_innovation.bmp (601 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\is-6FU40.tmp\_isetup\_shfoldr.dll (47 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\is-6FU40.tmp\microsoft_partner.bmp (53 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\is-J194S.tmp\pm-standalone-setup.tmp (50 bytes)
    %Program Files% (x86)\Uniblue\PC-Mechanic\pc-mechanic.exe (291 bytes)
    %Program Files% (x86)\Uniblue\PC-Mechanic\fonts\is-L5TB4.tmp (1281 bytes)
    %Program Files% (x86)\Uniblue\PC-Mechanic\is-D42IV.tmp (20504 bytes)
    %Program Files% (x86)\Uniblue\PC-Mechanic\is-VO3E7.tmp (35285 bytes)
    %Program Files% (x86)\Uniblue\PC-Mechanic\is-LQCTJ.tmp (114305 bytes)
    %Program Files% (x86)\Uniblue\PC-Mechanic\fonts\is-T38DQ.tmp (1281 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\is-EJ8OV.tmp (4 bytes)
    %Program Files% (x86)\Uniblue\PC-Mechanic\is-4VGDV.tmp (197872 bytes)
    %Program Files% (x86)\Uniblue\PC-Mechanic\fonts\is-8MILD.tmp (1281 bytes)
    %Program Files% (x86)\Uniblue\PC-Mechanic\fonts\is-2BQ2S.tmp (1281 bytes)
    %Program Files% (x86)\Uniblue\PC-Mechanic\Microsoft.VC90.CRT\is-81TR2.tmp (3361 bytes)
    C:\Users\Public\Desktop\PC Mechanic.lnk (1 bytes)
    %Program Files% (x86)\Uniblue\PC-Mechanic\Third-party Terms\is-C2PRA.tmp (13 bytes)
    %Program Files% (x86)\Uniblue\PC-Mechanic\locale\fi\LC_MESSAGES\is-G88F5.tmp (601 bytes)
    %Program Files% (x86)\Uniblue\PC-Mechanic\locale\it\LC_MESSAGES\is-MALHE.tmp (601 bytes)
    C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Uniblue\PC Mechanic\PC Mechanic.lnk (1 bytes)
    %Program Files% (x86)\Uniblue\PC-Mechanic\locale\de\LC_MESSAGES\is-KQQMD.tmp (601 bytes)
    %Program Files% (x86)\Uniblue\PC-Mechanic\fonts\is-1EKH1.tmp (1281 bytes)
    %Program Files% (x86)\Uniblue\PC-Mechanic\locale\da\LC_MESSAGES\is-65M8L.tmp (601 bytes)
    %Program Files% (x86)\Uniblue\PC-Mechanic\locale\pt_BR\LC_MESSAGES\is-BQT7R.tmp (601 bytes)
    %Program Files% (x86)\Uniblue\PC-Mechanic\locales\is-1MPBL.tmp (4 bytes)
    %Program Files% (x86)\Uniblue\PC-Mechanic\fonts\is-3U8HG.tmp (1281 bytes)
    %Program Files% (x86)\Uniblue\PC-Mechanic\locale\en\LC_MESSAGES\is-1HAGF.tmp (601 bytes)
    %Program Files% (x86)\Uniblue\PC-Mechanic\is-8UFQG.tmp (75544 bytes)
    %Program Files% (x86)\Uniblue\PC-Mechanic\Third-party Terms\is-TT2MJ.tmp (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Setup Log 2015-04-15 #002.txt (460554 bytes)
    %Program Files% (x86)\Uniblue\PC-Mechanic\locale\es\LC_MESSAGES\is-KV1T1.tmp (601 bytes)
    %Program Files% (x86)\Uniblue\PC-Mechanic\locale\no\LC_MESSAGES\is-03EBF.tmp (601 bytes)
    %Program Files% (x86)\Uniblue\PC-Mechanic\fonts\is-BI3OR.tmp (1281 bytes)
    %Program Files% (x86)\Uniblue\PC-Mechanic\unins000.msg (646 bytes)
    %Program Files% (x86)\Uniblue\PC-Mechanic\Third-party Terms\is-I7C42.tmp (1 bytes)
    %Program Files% (x86)\Uniblue\PC-Mechanic\locale\fr\LC_MESSAGES\is-K89A0.tmp (601 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\is-EJ8OV.tmp\license.en.rtf (26 bytes)
    %Program Files% (x86)\Uniblue\PC-Mechanic\Microsoft.VC90.CRT\is-4O73U.tmp (4545 bytes)
    %Program Files% (x86)\Uniblue\PC-Mechanic\Microsoft.VC90.CRT\is-1NT3A.tmp (524 bytes)
    %Program Files% (x86)\Uniblue\PC-Mechanic\Third-party Terms\is-DG0QA.tmp (1 bytes)
    %Program Files% (x86)\Uniblue\PC-Mechanic\locale\ru\LC_MESSAGES\is-0LHNU.tmp (601 bytes)
    %Program Files% (x86)\Uniblue\PC-Mechanic\is-JJR23.tmp (601 bytes)
    %Program Files% (x86)\Uniblue\PC-Mechanic\Third-party Terms\is-277QT.tmp (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\is-EJ8OV.tmp\windows8_with_innovation.bmp (601 bytes)
    %Program Files% (x86)\Uniblue\PC-Mechanic\Third-party Terms\is-LQ5K1.tmp (11 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\PC-Mechanic.lnk (1 bytes)
    %Program Files% (x86)\Uniblue\PC-Mechanic\unins000.dat (30302 bytes)
    %Program Files% (x86)\Uniblue\PC-Mechanic\Third-party Terms\is-4UCCP.tmp (112 bytes)
    %Program Files% (x86)\Uniblue\PC-Mechanic\Third-party Terms\is-NRGN6.tmp (1 bytes)
    %Program Files% (x86)\Uniblue\PC-Mechanic\Third-party Terms\is-E9LUF.tmp (10 bytes)
    %Program Files% (x86)\Uniblue\PC-Mechanic\locale\nl\LC_MESSAGES\is-N1UL8.tmp (601 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\is-EJ8OV.tmp\InstallerExtensions.dll (715 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\is-EJ8OV.tmp\_isetup\_setup64.tmp (6 bytes)
    %Program Files% (x86)\Uniblue\PC-Mechanic\Third-party Terms\is-ETSB4.tmp (1 bytes)
    %Program Files% (x86)\Uniblue\PC-Mechanic\Third-party Terms\is-73U4E.tmp (1 bytes)
    %Program Files% (x86)\Uniblue\PC-Mechanic\locale\ja\LC_MESSAGES\is-4B2SS.tmp (601 bytes)
    %Program Files% (x86)\Uniblue\PC-Mechanic\Third-party Terms\is-48U0H.tmp (1 bytes)
    %Program Files% (x86)\Uniblue\PC-Mechanic\is-IGR6O.tmp (28498 bytes)
    %Program Files% (x86)\Uniblue\PC-Mechanic\fonts\is-2B2SF.tmp (1281 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\is-EJ8OV.tmp\_isetup\_shfoldr.dll (47 bytes)
    %Program Files% (x86)\Uniblue\PC-Mechanic\is-8GN06.tmp (601 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\is-EJ8OV.tmp\printer.bmp (1 bytes)
    C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Uniblue\PC Mechanic\Uninstall PC Mechanic.lnk (1 bytes)
    %Program Files% (x86)\Uniblue\PC-Mechanic\fonts\is-94UBV.tmp (1281 bytes)
    %Program Files% (x86)\Uniblue\PC-Mechanic\locale\sv\LC_MESSAGES\is-RVIJM.tmp (601 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsl9FE9.tmp\nsExec.dll (14 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsl9FE9.tmp\nsSCM.dll (13 bytes)
    %Program Files% (x86)\OLBPre\it_IT.mo (1856 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsl9FE9.tmp\nsRandom.dll (808 bytes)
    C:\Users\"%CurrentUserName%"\Desktop\MyPC Backup.lnk (1 bytes)
    %Program Files% (x86)\OLBPre\uninst.exe (1026 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyPC Backup.lnk (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsw9FD9.tmp (54650 bytes)
    %Program Files% (x86)\OLBPre\de_DE.mo (1856 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsl9FE9.tmp\AccessControl.dll (20 bytes)
    %Program Files% (x86)\OLBPre\es_ES.mo (1856 bytes)
    %Program Files% (x86)\OLBPre\OLBPre.exe.config (203 bytes)
    %Program Files% (x86)\OLBPre\fr_FR.mo (1856 bytes)
    %Program Files% (x86)\OLBPre\pt_PT.mo (1856 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsl9FE9.tmp\DotNetChecker.dll (1597 bytes)
    %Program Files% (x86)\OLBPre\brand.jdat (17848 bytes)
    %Program Files% (x86)\OLBPre\LinqBridge.dll (1856 bytes)
    %Program Files% (x86)\OLBPre\state.jdat (428 bytes)
    %Program Files% (x86)\OLBPre\aff.jdat (140 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Uniblue\PC-Mechanic\error.log (6914 bytes)
    %Program Files% (x86)\Uniblue\PC-Mechanic\icudt.dll (825 bytes)
    C:\Windows\Tasks\PC-Mechanic Startup.job (684 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Uniblue\PC-Mechanic\settings.dat (15 bytes)
    %Program Files% (x86)\Uniblue\PC-Mechanic\libcef.dll (10562 bytes)
    C:\Windows\Tasks\PC-Mechanic Maintenance.job (702 bytes)
    C:\Windows\Tasks\PC-Mechanic Subscription.job (702 bytes)

  4. Delete the following value(s) in the autorun key (How to Work with System Registry):

    [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "VMware User Process" = "%Program Files%\VMware\VMware Tools\vmtoolsd.exe -n vmusr"

    [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "VMware Tools" = "%Program Files%\VMware\VMware Tools\VMwareTray.exe"

    [HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
    "Adobe ARM" = "%Program Files% (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"

    [HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
    "Adobe Reader Speed Launcher" = "%Program Files% (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe"

    [HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
    "SunJavaUpdateSched" = "%Program Files% (x86)\Common Files\Java\Java Update\jusched.exe"

  5. Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
  6. Reboot the computer.
*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

VersionInfo

Company Name: Uniblue Systems Limited
Product Name: PC Mechanic
Product Version: 1.0.5.0
Legal Copyright: Copyright (c) Uniblue Systems Limited
Legal Trademarks:
Original Filename:
Internal Name:
File Version: 1.0.5.0
File Description: PC Mechanic Setup
Comments: This installation was built with Inno Setup.
Language: Language Neutral

Company Name: Uniblue Systems LimitedProduct Name: PC Mechanic Product Version: 1.0.5.0Legal Copyright: Copyright (c) Uniblue Systems LimitedLegal Trademarks: Original Filename: Internal Name: File Version: 1.0.5.0File Description: PC Mechanic Setup Comments: This installation was built with Inno Setup.Language: Language Neutral

PE Sections

Name Virtual Address Virtual Size Raw Size Entropy Section MD5
.text409661740619524.430243a126e478661f20816f9d9285615f98e
.itext69632288430723.97317ba48b9b17b3dd8b92da3bd93f20ddb34
.data73728320835841.55702d7fd5f4b562d7961758f3d6a8c834fd0
.bss778242219600d41d8cd98f00b204e9800998ecf8427e
.idata102400353635843.4462593d91a2b90e60bd758fc0c4908856ae1
.tls106496800d41d8cd98f00b204e9800998ecf8427e
.rdata110592245120.141743dffc444ccc131c9dcee18db49ee6403
.rsrc1146882400002401283.693587e28261598c4cda6808201dd42c647ce

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:


Total found: 159
595f1fc6db9af2f5b74feffe71c7a123
07cb679acc810aa050cc2353509e5393
8643014e30fccffd0048979713cb7001
eb2d058ca6921e2c6d56f35f5502a4d4
e3b5bd3126a441609fa77f52a36ae298
6370fab243594f9a469c66fe6f14eeb3
b49995f511e0b27eba38a7e2b08de623
c0c14fd4f291d6001d09993c25e3825b
5906a85cd27be3d0508bc3f1ec5e62de
b153399713231db375646f1d0f00ab81
ed1a11d0c026c535c9400af0cc285c8d
a4db7fea7fc4bc8ddca8f616d1b44968
a31c60775ffa14da852aebac7b20b350
07c2c6d77dead8e72846174d8f034016
8be396cd92a8dcc0aa3cb8034507ee02
1f22d7f81ed540bd5af17738eadaf9d6
f56a7328f430b18efa42246422615699
eaee4be2373fe1db7128b7367bcab4ca
d4770d5ccb75c91c1909b13ef3fec96c
86fbfc957a5090937eae9aa34297c99e
6f31b53ed4d816e8a9c074763b4e39c6
0d198f08a94a52c1c7562b3d8b30764d
b7848c9100697f733bcb9c8a7ce39d71
0e3565470c38a5b53affaae2aca325e5
5fec4f59585289a6894b58ac06c594b8

Network Activity

URLs

URL IP
hxxp://tracking-uniblue-com-1314478381.eu-west-1.elb.amazonaws.com/v1/collect
hxxp://splitter-load-balancer-1436536024.us-east-1.elb.amazonaws.com/product/pm/1.0.5.0/pcmechanicpm-standalone-setup.exe
hxxp://d21bsqatndqkg8.cloudfront.net/product/pm/1.0.5.0/pcmechanicpm-standalone-setup.exe54.192.46.144
hxxp://backupgrid.jdibackup.netdna-cdn.com/aff_setup.exe
hxxp://splitter-load-balancer-1436536024.us-east-1.elb.amazonaws.com/pm/version.txt?from=1.0.5.0
hxxp://tracking-uniblue-com-1314478381.eu-west-1.elb.amazonaws.com/v1/track
hxxp://api.uniblue.net/v1/geo/country-code54.228.215.241
hxxp://s3-1-w.amazonaws.com/latest_updates/application.txt
hxxp://uniblue.com/api/v1/geo/country-code54.228.233.135
hxxp://track.backupgrid.net/?partner_id=1&hash=9bf5853a&tid=PC-Mechanic&dl=MyPCBackup_ppi_Setup.exe184.154.139.137
hxxp://track.mypcbackup.com/?partner_id=1&hash=9bf5853a&tid=PC-Mechanic&dl=MyPCBackup_ppi_Setup.exe184.154.139.131
hxxp://backupgrid.jdibackup.netdna-cdn.com/MyPCBackup_ppi_Setup.exe
hxxp://a1621.g.akamai.net/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?1f09e3a75e6cdb42
hxxp://a1363.dscg.akamai.net/pki/crl/products/microsoftrootcert.crl
hxxp://a1363.dscg.akamai.net/pki/crl/products/WinPCA.crl
hxxp://a1363.dscg.akamai.net/pki/crl/products/MicrosoftTimeStampPCA.crl
hxxp://a1363.dscg.akamai.net/pki/crl/products/MicCodSigPCA_08-31-2010.crl
hxxp://a1621.g.akamai.net/msdownload/update/v3/static/trustedr/en/authrootstl.cab?4379edd6935cb292
hxxp://e8218.ce.akamaiedge.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRIt2RJ89X++hEzqoBeQg8PymQ2UQQUANhaTCXBIuWLMe9tuvPMXynxDWECEGVSJuGyLhjhWQ8phawi51w=
hxxp://e8218.ce.akamaiedge.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSpuCE3aK3GivZPzGQJ6L5BRyZofwQUl9BrqCZwyKE/lB8ILcQ1m6ShHvICEAxNF3PJUX7iAOhAP2oGxcI=
hxxp://e6845.ce.akamaiedge.net/pca3.crl
hxxp://e8218.ce.akamaiedge.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ/xkCfyHfJr7GQ6M658NRZ4SHo/AQUCPVR6Pv+PT1kNnxoz1t4qN+5xTcCEGC2x6sSmevembHfY1acIZk=
hxxp://e8218.ce.akamaiedge.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSpuCE3aK3GivZPzGQJ6L5BRyZofwQUl9BrqCZwyKE/lB8ILcQ1m6ShHvICEGwkCSV07gf3g5QOsqmf+MY=
hxxp://e8218.ce.akamaiedge.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSpuCE3aK3GivZPzGQJ6L5BRyZofwQUl9BrqCZwyKE/lB8ILcQ1m6ShHvICEEES5jLHsYoCmjofrIA6uJ8=
hxxp://e8218.ce.akamaiedge.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS56bKHAoUD+Oyl+0LhPg9JxyQm4gQUf9Nlp8Ld7LvwMAnzQzn6Aq8zMTMCEFIA5aolVvwahu2WydRLM8c=
hxxp://e8218.ce.akamaiedge.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTSqZMG5M8TA9rdzkbCnNwuMAd5VgQUz5mp6nsm9EvJjo/X8AUm7+PSp50CEDi14wrtdPbNBdjyDxjokeI=
hxxp://e8218.ce.akamaiedge.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSpuCE3aK3GivZPzGQJ6L5BRyZofwQUl9BrqCZwyKE/lB8ILcQ1m6ShHvICEAKQll6RM0DNpmNM7zH3/Qc=
hxxp://e8218.ce.akamaiedge.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTEemCaVgs8Tuh2B9fGVE0pKKNyzgQUTF+nNhcF4oZhIkk5jLmo40rgOBoCEC6utoKGY/7ZdVX4/iTzOxo=
hxxp://e8218.ce.akamaiedge.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRODEXefhs/UZFum2o8YfzOFwceMwQUkz5j3yJ0BOBkhDHd2yOfDq+2TZMCEA89qsgV9niZmSI6gIO0S/U=
hxxp://ocsp.verisign.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSpuCE3aK3GivZPzGQJ6L5BRyZofwQUl9BrqCZwyKE/lB8ILcQ1m6ShHvICEGwkCSV07gf3g5QOsqmf+MY=23.51.123.27
hxxp://ocsp.verisign.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSpuCE3aK3GivZPzGQJ6L5BRyZofwQUl9BrqCZwyKE/lB8ILcQ1m6ShHvICEEES5jLHsYoCmjofrIA6uJ8=23.51.123.27
hxxp://pm.uniblue.com.s3.amazonaws.com/latest_updates/application.txt54.231.16.185
hxxp://tracking.uniblue.com/v1/collect54.247.176.17
hxxp://ocsp.verisign.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRODEXefhs/UZFum2o8YfzOFwceMwQUkz5j3yJ0BOBkhDHd2yOfDq+2TZMCEA89qsgV9niZmSI6gIO0S/U=23.51.123.27
hxxp://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?1f09e3a75e6cdb4287.245.216.25
hxxp://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl87.245.216.57
hxxp://www.uniblue.com/api/v1/geo/country-code54.228.233.135
hxxp://crl.microsoft.com/pki/crl/products/MicCodSigPCA_08-31-2010.crl87.245.216.57
hxxp://tracking.uniblue.com/v1/track54.247.176.17
hxxp://ocsp.verisign.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSpuCE3aK3GivZPzGQJ6L5BRyZofwQUl9BrqCZwyKE/lB8ILcQ1m6ShHvICEAxNF3PJUX7iAOhAP2oGxcI=23.51.123.27
hxxp://ocsp.verisign.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSpuCE3aK3GivZPzGQJ6L5BRyZofwQUl9BrqCZwyKE/lB8ILcQ1m6ShHvICEAKQll6RM0DNpmNM7zH3/Qc=23.51.123.27
hxxp://update.uniblue.com/pm/version.txt?from=1.0.5.054.243.120.72
hxxp://download.uniblue.com/product/pm/1.0.5.0/pcmechanicpm-standalone-setup.exe54.243.120.72
hxxp://crl.verisign.com/pca3.crl23.51.117.163
hxxp://cdn.backupgrid.net/MyPCBackup_ppi_Setup.exe94.31.29.237
hxxp://ocsp.verisign.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS56bKHAoUD+Oyl+0LhPg9JxyQm4gQUf9Nlp8Ld7LvwMAnzQzn6Aq8zMTMCEFIA5aolVvwahu2WydRLM8c=23.51.123.27
hxxp://crl.microsoft.com/pki/crl/products/WinPCA.crl87.245.216.57
hxxp://ocsp.verisign.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTSqZMG5M8TA9rdzkbCnNwuMAd5VgQUz5mp6nsm9EvJjo/X8AUm7+PSp50CEDi14wrtdPbNBdjyDxjokeI=23.51.123.27
hxxp://crl.microsoft.com/pki/crl/products/MicrosoftTimeStampPCA.crl87.245.216.57
hxxp://ocsp.verisign.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRIt2RJ89X++hEzqoBeQg8PymQ2UQQUANhaTCXBIuWLMe9tuvPMXynxDWECEGVSJuGyLhjhWQ8phawi51w=23.51.123.27
hxxp://ocsp.verisign.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ/xkCfyHfJr7GQ6M658NRZ4SHo/AQUCPVR6Pv+PT1kNnxoz1t4qN+5xTcCEGC2x6sSmevembHfY1acIZk=23.51.123.27
hxxp://ocsp.verisign.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTEemCaVgs8Tuh2B9fGVE0pKKNyzgQUTF+nNhcF4oZhIkk5jLmo40rgOBoCEC6utoKGY/7ZdVX4/iTzOxo=23.51.123.27
hxxp://cdn.backupgrid.net/aff_setup.exe94.31.29.237
hxxp://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?4379edd6935cb29287.245.216.25

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

GET /?partner_id=1&hash=9bf5853a&tid=PC-Mechanic&dl=MyPCBackup_ppi_Setup.exe HTTP/1.0

Host: track.mypcbackup.com

User-Agent: NSISDL/1.2 (Mozilla)

Accept: */*

HTTP/1.1 301 Moved Permanently

Date: Wed, 15 Apr 2015 02:49:18 GMT

Server: Apache

Set-Cookie: SESSID=d9spekf2n5b71ug4pm2120ms25; path=/; domain=.mypcbackup.com

Expires: Thu, 19 Nov 1981 08:52:00 GMT

Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0

Pragma: no-cache

Set-Cookie: LC_CURRENCY=US; expires=Sat, 25-Apr-2015 02:49:18 GMT; path=/; domain=.mypcbackup.com

Set-Cookie: ?uva6aT*=US; expires=Sat, 25-Apr-2015 02:49:18 GMT; path=/; domain=.mypcbackup.com

Set-Cookie: LC_CURRENCY=US; expires=Sat, 25-Apr-2015 02:49:18 GMT; path=/; domain=.mypcbackup.com

Set-Cookie: ?uva6aT*=US; expires=Sat, 25-Apr-2015 02:49:18 GMT; path=/; domain=.mypcbackup.com

Set-Cookie: 748a7624422584634822bd3a2bf604ae=4cfceb115c4a698cc6e6dcfc4ed60f30; expires=Thu, 13-Aug-2015 02:49:18 GMT; path=/; domain=.mypcbackup.com

Set-Cookie: intc=1; expires=Thu, 16-Apr-2015 02:49:18 GMT; path=/; domain=.mypcbackup.com

P3P: CP="We do not have a P3P policy"

location: hXXp://cdn.backupgrid.net/MyPCBackup_ppi_Setup.exe

Set-Cookie: aff_id=67333; expires=Fri, 15-May-2015 05:59:59 GMT; path=/; domain=mypcbackup.com

Set-Cookie: hop_name=MaxiDisk1; expires=Fri, 15-May-2015 05:59:59 GMT; path=/; domain=mypcbackup.com

Set-Cookie: hop_id=97175; expires=Fri, 15-May-2015 05:59:59 GMT; path=/; domain=mypcbackup.com

Set-Cookie: hash=5e234192e97f23d956a71adc69f7cd0d; expires=Fri, 15-May-2015 05:59:59 GMT; path=/; domain=mypcbackup.com

Set-Cookie: tid=PC-Mechanic; expires=Fri, 15-May-2015 05:59:59 GMT; path=/; domain=mypcbackup.com

Set-Cookie: 9bf5853aunique=true; expires=Tue, 14-Jul-2015 02:49:18 GMT; path=/; domain=mypcbackup.com

Content-Length: 0

Connection: close

Content-Type: text/html; charset=UTF-8

<<< skipped >>>

GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBS56bKHAoUD+Oyl+0LhPg9JxyQm4gQUf9Nlp8Ld7LvwMAnzQzn6Aq8zMTMCEFIA5aolVvwahu2WydRLM8c= HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.verisign.com

HTTP/1.1 200 OK

Server: nginx/1.4.7

Content-Type: application/ocsp-response

Content-Length: 1762

content-transfer-encoding: binary

Cache-Control: max-age=366969, public, no-transform, must-revalidate

Last-Modified: Sun, 12 Apr 2015 08:45:09 GMT

Expires: Sun, 19 Apr 2015 08:45:09 GMT

Date: Wed, 15 Apr 2015 02:52:18 GMT

Connection: keep-alive

0..........0..... .....0......0...0......;O}a.!..u...au..eUNp..20150412084509Z0s0q0I0... ...................B.>.I.$&.....e......0..C9...313..R...%V.......K3.....20150412084509Z....20150419084509Z0...*.H..............>.3..7..M....._........b...A.......).:.!M..._...4<.,...r.g.y5...g.6.u...Z.2'.^?Ic1.t&.-..U...tc.loL....?x.. .G..GHw6....2...sB.i..4..(...I...1...E..5....bfO.`N....58..u;..n Zg(..............Z....|Iu...HC..S.9...|.K.)....csE.?.(.o..H^.z.o.=z..m`...M......X....0...0...0...........2...'U.BM...g.B0...*.H........0..1.0...U....US1.0...U....VeriSign, Inc.1.0...U....VeriSign Trust Network1:08..U...1(c) 2006 VeriSign, Inc. - For authorized use only1E0C..U...<VeriSign Class 3 Public Primary Certification Authority - G50...141202000000Z..151216235959Z0..1.0...U....US1.0...U....Symantec Corporation1.0...U....Symantec Trust Network1?0=..U...6Symantec Class 3 PCA - G5 OCSP Responder Certificate 30.."0...*.H.............0...............2&..PL...,..2....:..tH...`JG.%..*...s.c%...?t..J..0.q....~..k@X.l.i....0..kk..h.9"1.5?..s.....3[...u......]...R0..Z}....l..I.Y.....j\H.q...#.uw.4qz.#.J.....@2$"..$l.B.......D.ye..(..2.........@...... ...."... E..0M,..b{.^..s'....f.6.pr4.J........'j..........0...0...U.......0.0l..U. .e0c0a..`.H...E....0R0&.. .........hXXp://VVV.symauth.com/cps0(.. .......0...hXXp://VVV.symauth.com/rpa0...U.%..0... .......0...U...........0... .....0......0!..U....0...0.1.0...U....TGV-B-2760...U......;O}a.!..u...au..eUNp0...U.#..0.....e......0..C9...3130...*.H.............(.&..Dgr.Ve..#...5

<<< skipped >>>

GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTSqZMG5M8TA9rdzkbCnNwuMAd5VgQUz5mp6nsm9EvJjo/X8AUm7+PSp50CEDi14wrtdPbNBdjyDxjokeI= HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.verisign.com

HTTP/1.1 200 OK

Server: nginx/1.4.7

Content-Type: application/ocsp-response

Content-Length: 1725

content-transfer-encoding: binary

Cache-Control: max-age=547829, public, no-transform, must-revalidate

Last-Modified: Tue, 14 Apr 2015 11:00:03 GMT

Expires: Tue, 21 Apr 2015 11:00:03 GMT

Date: Wed, 15 Apr 2015 02:52:18 GMT

Connection: keep-alive

0..........0..... .....0......0...0......N$p...v....1.;..vn....20150414110003Z0s0q0I0... ...................F....0.yV......{&.K......&.......8....t..............20150414110003Z....20150421110003Z0...*.H...............P.'.-..(.c.tC~J.@m.,..r..T\n.6...H.T....r.Ht#........^.5.N.{...,...)....sf8........<.c..I.....a.....7LZ.c...N....8...........KI^...0V@<........}.bB,.....@e.;.f8"...z8.,d.......l.P.?.D.{.-.u..w.u.j2.^......k.......r...5e....0`..K.......T.. ......9..NET.C.....0...0...0............F...I]A(M..s@.0...*.H........0..1.0...U....US1.0...U....VeriSign, Inc.1.0...U....VeriSign Trust Network1;09..U...2Terms of use at hXXps://VVV.verisign.com/rpa (c)101.0,..U...%VeriSign Class 3 Code Signing 2010 CA0...150225000000Z..150526235959Z0..1.0...U....US1.0...U....VeriSign, Inc.1.0...U....VeriSign Trust Network1:08..U...1VeriSign Class 3 Code Signing 2010 OCSP Responder0.."0...*.H.............0.........q<...A...#......A...u..Lz.............o..D.vQ%..s.......f....e../jI.d.W.....|K;.j5...#.B%.]..~S.... .|;S.&.....N..`...5.....!D.p....M/.. ..;j...q..`6...2.Ck..BnLHvCZn%....,.w.Ooi..z'...\.Yx......b..L...5.o..o..{..}.........%e.....N..._i........*Bc....:yQg.........0...0...U....0.0....U. ...0..0....`.H...E....0..0(.. .........hXXps://VVV.verisign.com/CPS0b.. .......0V0...VeriSign, Inc.0.....=VeriSign's CPS incorp. by reference liab. ltd. (c)97 VeriSign0...U.%..0... .......0...U........0... .....0......0"..U....0...0.1.0...U....TGV-B-31830...*.H..............-..^.........f.P`...s.....8.....V.......... .... B.(@-)6.

<<< skipped >>>

GET /pki/crl/products/MicCodSigPCA_08-31-2010.crl HTTP/1.1

Cache-Control: max-age = 900

Connection: Keep-Alive

Accept: */*

If-Modified-Since: Tue, 01 Jul 2014 05:04:34 GMT

If-None-Match: "924558f3e994cf1:0"

User-Agent: Microsoft-CryptoAPI/6.1

Host: crl.microsoft.com

HTTP/1.1 200 OK

Content-Type: application/pkix-crl

Last-Modified: Tue, 14 Apr 2015 05:02:07 GMT

Accept-Ranges: bytes

ETag: "2711f7277076d01:0"

Server: Microsoft-IIS/8.5

VTag: 791500626200000000

P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI"

X-Powered-By: ASP.NET

Content-Length: 554

Cache-Control: max-age=900

Date: Wed, 15 Apr 2015 02:51:55 GMT

Connection: keep-alive

0..&0......0...*.H........0y1.0...U....US1.0...U....Washington1.0...U....Redmond1.0...U....Microsoft Corporation1#0!..U....Microsoft Code Signing PCA..150413163223Z..150713045223Z.a0_0...U.#..0..........X..7.3...L...0... .....7.........0...U......Z0... .....7......150712164223Z0...*.H.............WK....e.\.-.n......./......."]..E!.. //=...[....w... ..........#...[.l.J..f|..... .s......w...J._.......3.[..#.z....ko.I..Q{....e.nV......F..d}..rF\H.jlH]dQ.E....x......W............j....&L. 2.$.?...X?.#.(.....pK.v.......y..r....t......=.AW......K.G.gJD.b.HTTP/1.1 200 OK..Content-Type: application/pkix-crl..Last-Modified: Tue, 14 Apr 2015 05:02:07 GMT..Accept-Ranges: bytes..ETag: "2711f7277076d01:0"..Server: Microsoft-IIS/8.5..VTag: 791500626200000000..P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI"..X-Powered-By: ASP.NET..Content-Length: 554..Cache-Control: max-age=900..Date: Wed, 15 Apr 2015 02:51:55 GMT..Connection: keep-alive..0..&0......0...*.H........0y1.0...U....US1.0...U....Washington1.0...U....Redmond1.0...U....Microsoft Corporation1#0!..U....Microsoft Code Signing PCA..150413163223Z..150713045223Z.a0_0...U.#..0..........X..7.3...L...0... .....7.........0...U......Z0... .....7......150712164223Z0...*.H.............WK....e.\.-.n......./......."]..E!.. //=...[....w... ..........#...[.l.J..f|..... .s......w...J._.......3.[..#.z....ko.I..Q{....e.nV......F..d}..rF\H.jlH]dQ.E....x......W............j....&L. 2.$.?...X?.#.(.....pK.v.......y..r....t...

<<< skipped >>>

GET /msdownload/update/v3/static/trustedr/en/authrootstl.cab?4379edd6935cb292 HTTP/1.1

Connection: Keep-Alive

Accept: */*

If-Modified-Since: Wed, 12 Mar 2014 20:20:10 GMT

If-None-Match: "0b96c77303ecf1:0"

User-Agent: Microsoft-CryptoAPI/6.1

Host: ctldl.windowsupdate.com

HTTP/1.1 200 OK

Cache-Control: max-age=604800

Content-Type: application/octet-stream

Last-Modified: Tue, 24 Feb 2015 00:37:01 GMT

Accept-Ranges: bytes

ETag: "80b4d90ca4fd01:0"

Server: Microsoft-IIS/7.5

X-Powered-By: ASP.NET

Content-Length: 48151

Date: Wed, 15 Apr 2015 02:51:55 GMT

Connection: keep-alive

MSCF............,...................I......._.........WFr. .authroot.stl.J..:58..CK...8T.....c.5.}l.s..%D..[R.l...l7iTBWiA..*......D!K.....d....*s.....<..s.;.93..~....g.....Y.......q.....9........;..2..^....Y%,..,8......Wf.Q;s.....n&v<;.Wcs....AB..BD]].].p.....|.z$.......?..*../.."$... ..P.."..K9.P>.g.mt...q.yqT.......[...%wX.]..(";...*..x....;.gt...W..pH[.*.A.]..J.......<z'X..%..GV.7......2Z8q.OU?.Y=....%ln..A.P.....c=D...=h..Z..78G....].........Z...0.O..!.B(.0a....rv<..K.Z......[.PJ."6...(...p....ffV&6,........#.^^.y.....C.]...`U..;].....7.;..<\.2w|.`v.......v.|.xD.G.'..4z....1..A.5.h.. .p.@.@.#h..T;......z..Y*..)...Is..y....W..z..XP*LU..........4.q.....\...|.F.".[.l9.3.o....>,...y.K....&..B...^.cA#......q.976?.E..i...g...s.....K$&...(.[......J..a.z4......5,wk.....L.9..=.j..r........Z........U`..;....5.&.X..h<Uw.F.ifP...r....A=..N...._...R........`B.......re...X....U....a..._...XU.z..s..>lt.9..W..4..r.w...I...C....L.&..l.,...`.S.A#.P.d. ...?N.qUd....#....l......6v.F..<V...#..X...;-|...da...O#.....C.........3`..X....I.S'.>."*.X.z.V..0.........j.oO..xRnL.....X...q.[..[,XF..L.j....D..=..N..[....G7...l.Hi!.i.p@....,"..E.;...8f."....y.......<..........h.a.b..|....<f..8,....6...k..T".|:.....zm.........n..I..x.....1.=....q..I.6....;...O.....rf.1..H.a..|....zk..c.5.A&~o...R.......V...:..c...:....<Z....3..I1.B..%.9.3....:.X...Elk.3.b..>*../.{..O.=......7..}...._...@..F.p.7|iQ.....G...A..3...B...0A*@I.[.....4...\..?..R.c.(.8(..h..w.s.....X ........>r|...?._..%..O.d.,.....

<<< skipped >>>

GET /pki/crl/products/microsoftrootcert.crl HTTP/1.1

Cache-Control: max-age = 900

Connection: Keep-Alive

Accept: */*

If-Modified-Since: Sat, 24 May 2014 05:04:51 GMT

If-None-Match: "96bfbfb1d77cf1:0"

User-Agent: Microsoft-CryptoAPI/6.1

Host: crl.microsoft.com

HTTP/1.1 200 OK

Content-Type: application/pkix-crl

Last-Modified: Tue, 24 Mar 2015 05:02:25 GMT

Accept-Ranges: bytes

ETag: "a1132b8ef65d01:0"

Server: Microsoft-IIS/8.0

VTag: 438176043100000000

P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI"

X-Powered-By: ASP.NET

Content-Length: 813

Cache-Control: max-age=900

Date: Wed, 15 Apr 2015 02:51:25 GMT

Connection: keep-alive

0..)0......0...*.H........0_1.0.....&...,d....com1.0.....&...,d....microsoft1-0 ..U...$Microsoft Root Certificate Authority..150323204828Z..150622090828Z0.0...a......../..100208014912Z._0]0...U.#..0......`@V'..%..*..S.Y..0... .....7.......0...U......)0... .....7......150621205828Z0...*.H.................k...#......w..^L1........r...B..gLX..G.. 4...6.e..^..s=... o..nz..`..z...5..5.01.........w..v...M...<.....,...}&I......].g...>.?.L.(.`....*^5J...y. ....`.y8Il.V\mS..p..V....>,....OR%.r0.)Po\j.C.kE...EGF.Z....gcP....d.6.edP...f.?.......&Y8.Z...".'.X.$g.TP....,.....{.wd.h...N7..^{.#...@[..U....{.*.~.d)... ...!...c.@Qy.C........}......?...j....?%..x.. -.%....qNX.B...7E4...-[...;Z....,..>x..K......r....-x..8.2)...W..M ....j..s.Y_....V6......e..............2..%....aq.U..!...r...b.>.'....3..........jT...H.=......

GET /pki/crl/products/WinPCA.crl HTTP/1.1

Cache-Control: max-age = 900

Connection: Keep-Alive

Accept: */*

If-Modified-Since: Wed, 07 May 2014 05:04:02 GMT

If-None-Match: "a413fc3b169cf1:0"

User-Agent: Microsoft-CryptoAPI/6.1

Host: crl.microsoft.com

HTTP/1.1 200 OK

Content-Type: application/pkix-crl

Last-Modified: Sat, 07 Mar 2015 06:01:44 GMT

Accept-Ranges: bytes

ETag: "dde36a309c58d01:0"

Server: Microsoft-IIS/8.0

VTag: 438569342300000000

P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI"

X-Powered-By: ASP.NET

Content-Length: 561

Cache-Control: max-age=900

Date: Wed, 15 Apr 2015 02:51:25 GMT

Connection: keep-alive

0..-0......0...*.H........0..1.0...U....US1.0...U....Washington1.0...U....Redmond1.0...U....Microsoft Corporation1 0)..U..."Microsoft Windows Verification PCA..150306223202Z..150605105201Z._0]0...U.#..0.......p............<.J0... .....7.......0...U......40... .....7......150604224201Z0...*.H.............4......n[.t........'....Dx.P3R.!3.|D.6vL.."k..9'....L..k......e.4......._..N..TJ......N.fP...H.....8...TJA...fGA.e...^"{../...H?..E.Y.U....h..0/.......d...6..K..V?QM...{..h.....{.3...v.....\~.7n..5..'..k.Ia.YL..LP.b....._7.V..%......z*$q..Y..f.b..L8<~..v.w....

GET /pki/crl/products/MicrosoftTimeStampPCA.crl HTTP/1.1

Cache-Control: max-age = 900

Connection: Keep-Alive

Accept: */*

If-Modified-Since: Mon, 05 May 2014 05:04:34 GMT

If-None-Match: "87fbb3811f68cf1:0"

User-Agent: Microsoft-CryptoAPI/6.1

Host: crl.microsoft.com

HTTP/1.1 200 OK

Content-Type: application/pkix-crl

Last-Modified: Thu, 05 Mar 2015 06:01:35 GMT

Accept-Ranges: bytes

ETag: "cf2633d6957d01:0"

Server: Microsoft-IIS/8.5

VTag: 438481415700000000

P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI"

X-Powered-By: ASP.NET

Content-Length: 550

Cache-Control: max-age=900

Date: Wed, 15 Apr 2015 02:51:25 GMT

Connection: keep-alive

0.."0......0...*.H........0w1.0...U....US1.0...U....Washington1.0...U....Redmond1.0...U....Microsoft Corporation1!0...U....Microsoft Time-Stamp PCA..150304221607Z..150603103607Z._0]0...U.#..0...#4..RFp..@.v.. ..5..0... .....7.......0...U......20... .....7......150602222607Z0...*.H.............Y..}y`....T.Z..`B<..I.N..O... E:....7......a..).........._|W5laoqi(..>t~.."...&`.._.7J...:..{bO_Kyi...R...!...B.s..I.c&j...(I\.S{._;@B...[i.e.[."...R` \...........M^k.=q[.V...9y..G.1o#k3<.W.......H.$>}...U...2qyd2|b.fB.....r....H.P...;....Q...b......5%.P.#..

GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSpuCE3aK3GivZPzGQJ6L5BRyZofwQUl9BrqCZwyKE/lB8ILcQ1m6ShHvICEAKQll6RM0DNpmNM7zH3/Qc= HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.verisign.com

HTTP/1.1 200 OK

Server: nginx/1.4.7

Content-Type: application/ocsp-response

Content-Length: 1790

content-transfer-encoding: binary

Cache-Control: max-age=551815, public, no-transform, must-revalidate

Last-Modified: Tue, 14 Apr 2015 12:05:24 GMT

Expires: Tue, 21 Apr 2015 12:05:24 GMT

Date: Wed, 15 Apr 2015 02:52:30 GMT

Connection: keep-alive

0..........0..... .....0......0...0......'.V.8.F.V....H....JW..20150414120524Z0s0q0I0... ..........!7h....O.d...AG&h.....k.&p..?...-.5..........^.3@..cL.1.......20150414120524Z....20150421120524Z0...*.H.............I....V.W.{..^>..#./.......%.....w..k8..........W........../P..............Y.?F/..'.g4v..D...Z..@4t.I.Y!.p(.~Rx.........P.....(.ftCy....?.....7 ..:..l....f..|]...K......S"h.{V1?..K.1..n.`.H.p .......,..1.........\..Vl...L.u.0......Y.).N.<.1........r.....Q.....#0...0...0..........r..?.*......y"..0...*.H........0..1.0...U....US1.0...U....VeriSign, Inc.1.0...U....VeriSign Trust Network1;09..U...2Terms of use at hXXps://VVV.verisign.com/rpa (c)09100...U...'VeriSign Class 3 Code Signing 2009-2 CA0...150226000000Z..150527235959Z0..1.0...U....US1.0...U....VeriSign, Inc.1.0...U....VeriSign Trust Network1;09..U...2Terms of use at hXXps://VVV.verisign.com/rpa (c)091<0:..U...3VeriSign Class 3 Code Signing 2009-2 OCSP Responder0.."0...*.H.............0.............m5*R........2....>...yU4..L.. ...........u..Hez..Pn.....d...nz(...V7.}^...d!RX...bl..[..a...L.. .~..Ij......%..%p.-...u..:..i..F*]...*....{NH..|0...gHX.Q.r....S..........._.9.(w...suC...N..s.....&."...:.C.Q.i~rl..<..krS..8.B..o].y..L.4...iB@..s.....mw.........0...0...U....0.0....U. ...0..0....`.H...E....0..0(.. .........hXXps://VVV.verisign.com/CPS0b.. .......0V0...VeriSign, Inc.0.....=VeriSign's CPS incorp. by reference liab. ltd. (c)97 VeriSign0...U.%..0... .......0...U........0... .....0......0"..U....0...0.1.0...U....TGV-B-32010...*.H

<<< skipped >>>

GET /aff_setup.exe HTTP/1.1

Accept: */*

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: cdn.backupgrid.net

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Wed, 15 Apr 2015 02:48:55 GMT

Content-Type: application/octet-stream

Transfer-Encoding: chunked

Connection: keep-alive

x-amz-id-2: anR9HUoOMrBxJsv8rYV6HyE1PYWBM5fKI67JOW9Tc8613XuTvoQEdNhdH4sYmkim9K/Xad7PP88=

x-amz-request-id: 9AEF7D8D6192CF39

Last-Modified: Wed, 15 Apr 2015 02:22:52 GMT

ETag: W/"1880b2782d67fd2a085fb7d100dac569"

Server: NetDNA-cache/2.2

X-Cache: HIT

Content-Encoding: gzip

500a..............{|T..?...0...$. ...........@&....2...1..3.$f.....8....k{l....4...z...b....$(*...........i.......L@O{....{?..'......Z.Y.m=..w..yV0..`DPUA..........F..[^.-.........&.................u..q..A..V.Z..vY..Uzg...d.....e.<&V...&..........o...J<'.}.z ..y.'..... D.......%.$a....J...f.(]. <......y.........zm...t.C...*D...8....*....2.=AA.K..A..."./...a...G..$.&.....Cx=....1.g...f5T.K.........U......,.L.<.z.Da*.&.......U..<.....`........4.m.Z$...............%.....`c.Y..o..H....2-J..b..Zdt..E.SU..f.x..D.@2\n%....c...(Z...._.9R...Z^)......OP&..P7 ..y_.r.>...R.S...f..:..C.../.....P..Y.}KK./.3C...JPc.....r..%..p....L.}.Q.aG.3T<.f,B7AG.1.Hwj.......UNWO........7...|r.*y..s..%...A..DiL..<]...M].f.C.p.@.....PLNWrV".QOk....s.TQxt.r3*y..(...N.ID..Ym.<z..EP.d...........P[.GY.7...K.........(./P..>J..B.I1.t.%...I..Fi....-G%k.2.i.G).....Pg{/.Y.D5....X....F..^.L)1...W.P.2....5|......J.i.^..[.*%g.X.*2.ep$........LSx.N1..)>.r.SP..Fy.@.]2....N...g....$jA9....."G...`.. }.l.....R.=.....8.5xT.Zj..7L..m x.....I.aF.i.(.....6.....|cH2..b...!}Q............R.HZ..!Hn.s..G.O(....c.v&7Sz(.}.C.!j.......&.....%...w..x.x....?...U..M.V:.s.......MGx..7..{_J....A#.hm.....c6.Ja..%.8...P.@..M..^..X".@..HY..O9......".....:.........V...:.i..F{Ql.".m./.3.% U...%]xd.....Sx..e.m.e..s...S.......i....4~..Y.VP.[c.#..4.....jX5.....2$...s.sT!DM.2....&O.....U..S_.T).QJ.*.).A..>..R:?N1...........`..............*2.WV..3..2..gv.}..`:zV...G.......WPQ..V.r.r.[.t.iPS5....[6hn.j...a....#..}.*d.o.[\D.[..n............T\}.....z7

<<< skipped >>>

GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTEemCaVgs8Tuh2B9fGVE0pKKNyzgQUTF+nNhcF4oZhIkk5jLmo40rgOBoCEC6utoKGY/7ZdVX4/iTzOxo= HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.verisign.com

HTTP/1.1 200 OK

Server: nginx/1.4.7

Content-Type: application/ocsp-response

Content-Length: 1552

content-transfer-encoding: binary

Cache-Control: max-age=552895, public, no-transform, must-revalidate

Last-Modified: Tue, 14 Apr 2015 12:25:08 GMT

Expires: Tue, 21 Apr 2015 12:25:08 GMT

Date: Wed, 15 Apr 2015 02:52:31 GMT

Connection: keep-alive

0..........0..... .....0......0...0........C...4N...@..6...v...20150414122508Z0s0q0I0... .........z`.V.<N.v...TM)(.r...L_.6....a"I9....J.8........c..uU..$.;.....20150414122508Z....20150421122508Z0...*.H.............nr.3...bK.....r.......e....A...tF..uTPG..5.....R.4..........U....>{.p.....g......Qz....G...r.....e.....$..Om.3.r....m...........h..Ra>F..P..z.........j..........U.Y.Cppv..B...V...Z.ka0.w.T.....l..*.....9.=n......p... ..o..../j....9V....J.t*....J.W*..B'.......50..10..-0..........y.P}~.EY....T]. 0...*.H........0..1.0...U....US1.0...U....VeriSign, Inc.1<0:..U...3Class 3 Public Primary Certification Authority - G21:08..U...1(c) 1998 VeriSign, Inc. - For authorized use only1.0...U....VeriSign Trust Network0...141202000000Z..151216235959Z0..1.0...U....US1.0...U....Symantec Corporation1.0...U....Symantec Trust Network1?0=..U...6Symantec Class 3 PCA - G2 OCSP Responder Certificate 30.."0...*.H.............0..........6..]......w';.r........I..c..4.... .........TyW......hd_.....!C.k......SE<?o.H.. .me.c..9N.&....e.^-..a.....i\:..*."..u...|....".Nf3.~.L...QW...p.....-]UV8U...J&.<./.G.....I...4.T....#I*.i.E0\..~q$.I.......X?G....f.t......v.l.U.Ld.I...B.....=...Sf...H.s.........0..0...U....0.0l..U. .e0c0a..`.H...E....0R0&.. .........hXXp://VVV.symauth.com/cps0(.. .......0...hXXp://VVV.symauth.com/rpa0...U.%..0... .......0...U........0... .....0......0!..U....0...0.1.0...U....TGV-B-2740...*.H............1.`...i.....H.C.i.9~.i..Z.r.*$..(./.ag9.....J.Q.~.`.$?b..C....<.h.........d&....3.kV.....f.

<<< skipped >>>

GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBRODEXefhs/UZFum2o8YfzOFwceMwQUkz5j3yJ0BOBkhDHd2yOfDq+2TZMCEA89qsgV9niZmSI6gIO0S/U= HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.verisign.com

HTTP/1.1 200 OK

Server: nginx/1.4.7

Content-Type: application/ocsp-response

Content-Length: 1725

content-transfer-encoding: binary

Cache-Control: max-age=601588, public, no-transform, must-revalidate

Last-Modified: Wed, 15 Apr 2015 01:55:09 GMT

Expires: Wed, 22 Apr 2015 01:55:09 GMT

Date: Wed, 15 Apr 2015 02:52:31 GMT

Connection: keep-alive

0..........0..... .....0......0...0......%bn.$..5.......?'4....20150415015509Z0s0q0I0... ........N.E.~.?Q.n.j<a.....3...>c."t..d.1..#....M....=....x..":...K.....20150415015509Z....20150422015509Z0...*.H...............ny.*..<biwZX.....V....$`*...Y.Hs.....?./k.7.....i...R.rW.FxvW6D...0}.-.a.......>....~NG.M...T....y.....Q..A3..........)....D.........j..'ox...q@.}.....9;d....6n.."....`#Su1V(.H......).EU%.eO..........h..)G.). .\:......R...T..Ip.=f.h6..]......../.....A.......0...0...0..........7.R.~|..r."....#0...*.H........0..1.0...U....US1.0...U....VeriSign, Inc.1.0...U....VeriSign Trust Network1;09..U...2Terms of use at hXXps://VVV.verisign.com/rpa (c)091.0,..U...%VeriSign Cla..

POST /v1/track HTTP/1.1

Accept-Encoding: identity

Content-Length: 111

Host: tracking.uniblue.com

Content-Type: application/json

Connection: close

User-Agent: Python-urllib/2.7

{"recipient": "uniblue.pm-1_0_5_0.web", "event": "prod.pm.mypcbackup_offer_install_completed", "client_id": ""}

HTTP/1.1 200 OK

Content-Type: application/json

Date: Wed, 15 Apr 2015 02:52:32 GMT

Server: ngx_openresty/1.2.6.6

Content-Length: 20

Connection: Close

{. "status": "OK".}..

GET /MyPCBackup_ppi_Setup.exe HTTP/1.0

Host: cdn.backupgrid.net

User-Agent: NSISDL/1.2 (Mozilla)

Accept: */*

HTTP/1.1 200 OK

Date: Wed, 15 Apr 2015 02:48:59 GMT

Content-Type: application/octet-stream

Content-Length: 1119486

Connection: close

x-amz-id-2: B2Z6KnHVyIRktoKQruR3484H8tUq eQY r8AbD5BtFthUxD2LTN49un8X3yTRASaK5dxCU0vrSc=

x-amz-request-id: B93EA96792185D31

Last-Modified: Tue, 14 Apr 2015 23:57:04 GMT

ETag: "c40ba3b952382be22efdb2ce180b5233"

Server: NetDNA-cache/2.2

X-Cache: HIT

MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......1p.:u..iu..iu..i...iw..iu..i...i...id..i!2.i...i...it..iRichu..i........PE..L...^..K.................b...........6............@..........................P.......................................................p...............................................................................................................text....a.......b.................. ..`.rdata...............f..............@..@.data................x..............@....ndata.......p...........................rsrc........p......................@..@........................................................................................................................................................................................................................................................................................................................................................................................U....\.}..t .}.F.E.u..H.....cB..H.P.u..u..u...T.@..B...SV.5.cB..E.WP.u...X.@..e...E..E.P.u...\.@..}..e....D.@........FR..VV..U... M.......M....3.....FQ.....NU..M..........VT..U.....FP..E...............E.P.M...H.@..E...E.P.E.P.u...`.@..u....E..9}...w....~X.te.v4..L.@....E.tU.}.j.W.E......E.......P.@..vXW..T.@..u..5X.@.W...E..E.h ...Pj.h.[B.W..d.@..u.W...u....E.P.u...h.@._^3.[.....L$..(cB...Si.....VW.T.....tO.q.3.;5,cB.sB..i......D.......t.G.....t...O..t .....u...3....3...F.....;5,cB.r._^[...U..QQ.U.SV..i....

<<< skipped >>>

GET /?partner_id=1&hash=9bf5853a&tid=PC-Mechanic&dl=MyPCBackup_ppi_Setup.exe HTTP/1.0

Host: track.backupgrid.net

User-Agent: NSISDL/1.2 (Mozilla)

Accept: */*

HTTP/1.1 301 Moved Permanently

Date: Wed, 15 Apr 2015 02:49:17 GMT

Server: Apache

Set-Cookie: SESSID=3esumcv6st2sv6bl836ot9ran6; path=/; domain=.backupgrid.net

Expires: Thu, 19 Nov 1981 08:52:00 GMT

Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0

Pragma: no-cache

Set-Cookie: LC_CURRENCY=US; expires=Sat, 25-Apr-2015 02:49:17 GMT; path=/; domain=.backupgrid.net

Set-Cookie: ?uva6aT*=US; expires=Sat, 25-Apr-2015 02:49:17 GMT; path=/; domain=.backupgrid.net

Set-Cookie: LC_CURRENCY=US; expires=Sat, 25-Apr-2015 02:49:17 GMT; path=/; domain=.backupgrid.net

Set-Cookie: ?uva6aT*=US; expires=Sat, 25-Apr-2015 02:49:17 GMT; path=/; domain=.backupgrid.net

location: hXXp://track.mypcbackup.com/?partner_id=1&hash=9bf5853a&tid=PC-Mechanic&dl=MyPCBackup_ppi_Setup.exe

Content-Length: 0

Content-Type: text/html; charset=UTF-8

POST /v1/track HTTP/1.1

Accept-Encoding: identity

Content-Length: 111

Host: tracking.uniblue.com

Content-Type: application/json

Connection: close

User-Agent: Python-urllib/2.7

{"recipient": "uniblue.pm-1_0_5_0.web", "event": "prod.pm.mypcbackup_offer_install_initiated", "client_id": ""}

HTTP/1.1 200 OK

Content-Type: application/json

Date: Wed, 15 Apr 2015 02:52:28 GMT

Server: ngx_openresty/1.2.6.6

Content-Length: 20

Connection: Close

{. "status": "OK".}..

GET /msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?1f09e3a75e6cdb42 HTTP/1.1

Connection: Keep-Alive

Accept: */*

If-Modified-Since: Thu, 05 Dec 2013 22:47:50 GMT

If-None-Match: "0af536cf2ce1:0"

User-Agent: Microsoft-CryptoAPI/6.1

Host: ctldl.windowsupdate.com

HTTP/1.1 200 OK

Cache-Control: max-age=86400

Content-Type: application/octet-stream

Last-Modified: Tue, 24 Mar 2015 16:17:41 GMT

Accept-Ranges: bytes

ETag: "804047d4e66d01:0"

Server: Microsoft-IIS/7.5

X-Powered-By: ASP.NET

Content-Length: 6384

Date: Wed, 15 Apr 2015 02:51:24 GMT

Connection: keep-alive

MSCF............,...................O........"........wFK. .disallowedcert.stl.j......"CK...8T...g...d.B..1.Z.N.Y.Vv..[..".B.ml..e....$[....DZ......=.../..>.....f..9.=g......{...Nr*.(...:(..H.l$..0(.E.P..I..a\d....$.. ."..Yj(...@Bs.-9....E..C\ ....7.....q..C.H.>...$D..G....@.H.4...DQ...F..vh.Uf>.A.........,......a.>p.3.Qx..u....... _.o. .D.9<..Y..-.H4W..Y......... .....}A6~.P*..V7....w.FS..:......5...P.r. ....8.J6.,.OK>%g.d..ozf"C.....N<qM.Y.Ez;.sh.C....LgM..p...pv.............|.>[..p.K..86.dJ.I..g./.}."6Y,.....j:@W_6.R.t..n....sW.|......E<.a..H.u..sC.......J?.-g........J.b.w....s.=..p..#..J.....W.....&....}%.cu ;...#.z.y....(."..a.5.... .../..o/..., .7...>.....Y..:#cF..../.....e...d.S....&...7>...A.%...r...t...(..s {...^...6.a..A...d..6.xA.....q.... ..lq.|.c..!)..\.....|.t..K...u...9j@.?.....R.......FA6._Sb..w.j........o......z..U.$..~.2.=.%..cE.j..-uew..]b..............A.8.Y..[..2..>......S1...|...x.}.P...f..3.J-..s.0...~...=h...4\.'..F.P.l.v"<."...\......2.@......5.r9....@..Z.Q5..c\.2|.... ...G.......2....!...._..i.`-2*...rq......}..e..B..Sp..c......l..-E..,..N....pI/f9..}.J...b.tg.(.Wl.`....3..9.j.R...z.tS......)*K0.m.sk7........._....m.p!.......f..8..I.u1.'5ro....q...........o..A...r..x....4...w..../..h.<pX=.u.r.djAb..W..\....&...,...... vK..[5....<..A=.qi.i.=.28K.............j...;.-X. ....u7L.U\wB.H.1..d.$.9B...0..4I..eJ|....V P.....R(.I...;".7A...L..X.&.A.Bmv.........b$i..R.P.9..{z..x.n.P......x.z:...<}.<}N.\H...$..p.}..;..\.].N....}.|q.G\Ho.j../IS1.,.B.

<<< skipped >>>

POST /v1/collect HTTP/1.1

Connection: Keep-Alive

Content-Type: application/json; Charset=UTF-8

Accept: */*

User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Content-Length: 141

Host: tracking.uniblue.com

{"recipient":"uniblue.pm-1_0_5_0.standalone","client_id":"","event":"prod.pm.third_party_offer_not_shown","buildtest_id":"","unit_id":"4010"}

HTTP/1.1 200 OK

Content-Type: application/json

Date: Wed, 15 Apr 2015 02:51:59 GMT

Server: ngx_openresty/1.2.6.6

Content-Length: 20

Connection: keep-alive

{. "status": "OK".}HTTP/1.1 200 OK..Content-Type: application/json..Date: Wed, 15 Apr 2015 02:51:59 GMT..Server: ngx_openresty/1.2.6.6..Content-Length: 20..Connection: keep-alive..{. "status": "OK".}....

POST /v1/collect HTTP/1.1

Connection: Keep-Alive

Content-Type: application/json; Charset=UTF-8

Accept: */*

User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Content-Length: 129

Host: tracking.uniblue.com

{"recipient":"uniblue.pm-1_0_5_0.standalone","client_id":"","event":"prod.pm.install_started","buildtest_id":"","unit_id":"4010"}

HTTP/1.1 200 OK

Content-Type: application/json

Date: Wed, 15 Apr 2015 02:52:01 GMT

Server: ngx_openresty/1.2.6.6

Content-Length: 20

Connection: keep-alive

{. "status": "OK".}HTTP/1.1 200 OK..Content-Type: application/json..Date: Wed, 15 Apr 2015 02:52:01 GMT..Server: ngx_openresty/1.2.6.6..Content-Length: 20..Connection: keep-alive..{. "status": "OK".}..

POST /v1/collect HTTP/1.1

Connection: Keep-Alive

Content-Type: application/json; Charset=UTF-8

Accept: */*

User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Content-Length: 130

Host: tracking.uniblue.com

{"recipient":"uniblue.pm-1_0_5_0.standalone","client_id":"","event":"prod.pm.install_launched","buildtest_id":"","unit_id":"4010"}

HTTP/1.1 200 OK

Content-Type: application/json

Date: Wed, 15 Apr 2015 02:52:17 GMT

Server: ngx_openresty/1.2.6.6

Content-Length: 20

Connection: keep-alive

{. "status": "OK".}HTTP/1.1 200 OK..Content-Type: application/json..Date: Wed, 15 Apr 2015 02:52:17 GMT..Server: ngx_openresty/1.2.6.6..Content-Length: 20..Connection: keep-alive..{. "status": "OK".}....

POST /v1/collect HTTP/1.1

Connection: Keep-Alive

Content-Type: application/json; Charset=UTF-8

Accept: */*

User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Content-Length: 131

Host: tracking.uniblue.com

{"recipient":"uniblue.pm-1_0_5_0.standalone","client_id":"","event":"prod.pm.install_completed","buildtest_id":"","unit_id":"4010"}

HTTP/1.1 200 OK

Content-Type: application/json

Date: Wed, 15 Apr 2015 02:52:25 GMT

Server: ngx_openresty/1.2.6.6

Content-Length: 20

Connection: keep-alive

{. "status": "OK".}HTTP/1.1 200 OK..Content-Type: application/json..Date: Wed, 15 Apr 2015 02:52:25 GMT..Server: ngx_openresty/1.2.6.6..Content-Length: 20..Connection: keep-alive..{. "status": "OK".}..

GET /pm/version.txt?from=1.0.5.0 HTTP/1.1

Accept-Encoding: identity

Host: update.uniblue.com

Connection: close

User-Agent: Python-urllib/2.7

HTTP/1.1 302 Found

Cache-Control: max-age=600

Content-Type: text/plain

Date: Wed, 15 Apr 2015 02:49:16 GMT

Location: hXXp://pm.uniblue.com.s3.amazonaws.com/latest_updates/application.txt

Server: openresty/1.5.8.1

Content-Length: 69

Connection: Close

hXXp://pm.uniblue.com.s3.amazonaws.com/latest_updates/application.txt..

POST /v1/collect HTTP/1.1

Connection: Keep-Alive

Content-Type: application/json; Charset=UTF-8

Accept: */*

User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Content-Length: 132

Host: tracking.uniblue.com

{"recipient":"uniblue.pm-1_0_5_0.web","client_id":"","event":"prod.pm.mypcbackup_offer_accepted","buildtest_id":"","unit_id":"4010"}

HTTP/1.1 200 OK

Content-Type: application/json

Date: Wed, 15 Apr 2015 02:51:20 GMT

Server: ngx_openresty/1.2.6.6

Content-Length: 20

Connection: keep-alive

{. "status": "OK".}HTTP/1.1 200 OK..Content-Type: application/json..Date: Wed, 15 Apr 2015 02:51:20 GMT..Server: ngx_openresty/1.2.6.6..Content-Length: 20..Connection: keep-alive..{. "status": "OK".}....

POST /v1/collect HTTP/1.1

Connection: Keep-Alive

Content-Type: application/json; Charset=UTF-8

Accept: */*

User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Content-Length: 143

Host: tracking.uniblue.com

{"recipient":"uniblue.pm-1_0_5_0.web","client_id":"","event":"prod.pm.third_party_offer_download_initiated","buildtest_id":"","unit_id":"4010"}

HTTP/1.1 200 OK

Content-Type: application/json

Date: Wed, 15 Apr 2015 02:52:09 GMT

Server: ngx_openresty/1.2.6.6

Content-Length: 20

Connection: keep-alive

{. "status": "OK".}HTTP/1.1 200 OK..Content-Type: application/json..Date: Wed, 15 Apr 2015 02:52:09 GMT..Server: ngx_openresty/1.2.6.6..Content-Length: 20..Connection: keep-alive..{. "status": "OK".}....

POST /v1/collect HTTP/1.1

Connection: Keep-Alive

Content-Type: application/json; Charset=UTF-8

Accept: */*

User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Content-Length: 132

Host: tracking.uniblue.com

{"recipient":"uniblue.pm-1_0_5_0.web","client_id":"","event":"prod.pm.mypcbackup_offer_included","buildtest_id":"","unit_id":"4010"}

HTTP/1.1 200 OK

Content-Type: application/json

Date: Wed, 15 Apr 2015 02:51:09 GMT

Server: ngx_openresty/1.2.6.6

Content-Length: 20

Connection: keep-alive

{. "status": "OK".}HTTP/1.1 200 OK..Content-Type: application/json..Date: Wed, 15 Apr 2015 02:51:09 GMT..Server: ngx_openresty/1.2.6.6..Content-Length: 20..Connection: keep-alive..{. "status": "OK".}....

POST /v1/collect HTTP/1.1

Connection: Keep-Alive

Content-Type: application/json; Charset=UTF-8

Accept: */*

User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Content-Length: 130

Host: tracking.uniblue.com

{"recipient":"uniblue.pm-1_0_5_0.web","client_id":"","event":"prod.pm.third_party_offer_shown","buildtest_id":"","unit_id":"4010"}

HTTP/1.1 200 OK

Content-Type: application/json

Date: Wed, 15 Apr 2015 02:51:15 GMT

Server: ngx_openresty/1.2.6.6

Content-Length: 20

Connection: keep-alive

{. "status": "OK".}HTTP/1.1 200 OK..Content-Type: application/json..Date: Wed, 15 Apr 2015 02:51:15 GMT..Server: ngx_openresty/1.2.6.6..Content-Length: 20..Connection: keep-alive..{. "status": "OK".}....

POST /v1/collect HTTP/1.1

Connection: Keep-Alive

Content-Type: application/json; Charset=UTF-8

Accept: */*

User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Content-Length: 133

Host: tracking.uniblue.com

{"recipient":"uniblue.pm-1_0_5_0.web","client_id":"","event":"prod.pm.third_party_offer_accepted","buildtest_id":"","unit_id":"4010"}

HTTP/1.1 200 OK

Content-Type: application/json

Date: Wed, 15 Apr 2015 02:51:20 GMT

Server: ngx_openresty/1.2.6.6

Content-Length: 20

Connection: keep-alive

{. "status": "OK".}HTTP/1.1 200 OK..Content-Type: application/json..Date: Wed, 15 Apr 2015 02:51:20 GMT..Server: ngx_openresty/1.2.6.6..Content-Length: 20..Connection: keep-alive..{. "status": "OK".}....

POST /v1/collect HTTP/1.1

Connection: Keep-Alive

Content-Type: application/json; Charset=UTF-8

Accept: */*

User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Content-Length: 142

Host: tracking.uniblue.com

{"recipient":"uniblue.pm-1_0_5_0.web","client_id":"","event":"prod.pm.install_standalone_download_started","buildtest_id":"","unit_id":"4010"}

HTTP/1.1 200 OK

Content-Type: application/json

Date: Wed, 15 Apr 2015 02:51:21 GMT

Server: ngx_openresty/1.2.6.6

Content-Length: 20

Connection: keep-alive

{. "status": "OK".}HTTP/1.1 200 OK..Content-Type: application/json..Date: Wed, 15 Apr 2015 02:51:21 GMT..Server: ngx_openresty/1.2.6.6..Content-Length: 20..Connection: keep-alive..{. "status": "OK".}....

POST /v1/collect HTTP/1.1

Connection: Keep-Alive

Content-Type: application/json; Charset=UTF-8

Accept: */*

User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Content-Length: 142

Host: tracking.uniblue.com

{"recipient":"uniblue.pm-1_0_5_0.web","client_id":"","event":"prod.pm.mypcbackup_offer_download_initiated","buildtest_id":"","unit_id":"4010"}

HTTP/1.1 200 OK

Content-Type: application/json

Date: Wed, 15 Apr 2015 02:52:09 GMT

Server: ngx_openresty/1.2.6.6

Content-Length: 20

Connection: keep-alive

{. "status": "OK".}HTTP/1.1 200 OK..Content-Type: application/json..Date: Wed, 15 Apr 2015 02:52:09 GMT..Server: ngx_openresty/1.2.6.6..Content-Length: 20..Connection: keep-alive..{. "status": "OK".}..

GET /api/v1/geo/country-code HTTP/1.1

Accept-Encoding: identity

Host: VVV.uniblue.com

Connection: close

User-Agent: Python-urllib/2.7

HTTP/1.1 200 OK

Cache-Control: max-age=7200

Content-Type: text/plain

Date: Wed, 15 Apr 2015 02:49:17 GMT

Server: ngx_openresty

Content-Length: 3

Connection: Close

UA...

GET /product/pm/1.0.5.0/pcmechanicpm-standalone-setup.exe HTTP/1.1

Accept: */*

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: download.uniblue.com

Connection: Keep-Alive

HTTP/1.1 302 Moved Temporarily

Content-Type: text/html

Date: Wed, 15 Apr 2015 02:48:26 GMT

Location: hXXp://d21bsqatndqkg8.cloudfront.net/product/pm/1.0.5.0/pcmechanicpm-standalone-setup.exe

Server: openresty/1.5.8.1

Content-Length: 166

Connection: keep-alive

<html>..<head><title>302 Found</title></head>..<body bgcolor="white">..<center><h1>302 Found</h1></center>..<hr><center>openresty/1.5.8.1</center>..</body>..</html>..HTTP/1.1 302 Moved Temporarily..Content-Type: text/html..Date: Wed, 15 Apr 2015 02:48:26 GMT..Location: hXXp://d21bsqatndqkg8.cloudfront.net/product/pm/1.0.5.0/pcmechanicpm-standalone-setup.exe..Server: openresty/1.5.8.1..Content-Length: 166..Connection: keep-alive..<html>..<head><title>302 Found</title></head>..<body bgcolor="white">..<center><h1>302 Found</h1></center>..<hr><center>openresty/1.5.8.1</center>..</body>..</html>....

GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSpuCE3aK3GivZPzGQJ6L5BRyZofwQUl9BrqCZwyKE/lB8ILcQ1m6ShHvICEGwkCSV07gf3g5QOsqmf+MY= HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.verisign.com

HTTP/1.1 200 OK

Server: nginx/1.4.7

Content-Type: application/ocsp-response

Content-Length: 1790

content-transfer-encoding: binary

Cache-Control: max-age=400136, public, no-transform, must-revalidate

Last-Modified: Sun, 12 Apr 2015 18:00:33 GMT

Expires: Sun, 19 Apr 2015 18:00:33 GMT

Date: Wed, 15 Apr 2015 02:52:13 GMT

Connection: keep-alive

0..........0..... .....0......0...0......'.V.8.F.V....H....JW..20150412180033Z0s0q0I0... ..........!7h....O.d...AG&h.....k.&p..?...-.5.......l$.%t...............20150412180033Z....20150419180033Z0...*.H.............i...h.Z.RiX ..=....~.L....... hHG..p.x.!.4.q...Lb...@...C.b....P.kX....].H....F..#...T...YaR.....t(...<.b<YF.E.3...o.Sh]...gL....4p.*..,O.d....px%.i..{...^.s.._.x.=..Q..q.."X.5..%:.......&&M]S...b-.`<.f..|....$..$.JJ..6....K.y.m...(.fH..>...A.e).Z_.L..O..1...#0...0...0..........r..?.*......y"..0...*.H........0..1.0...U....US1.0...U....VeriSign, Inc.1.0...U....VeriSign Trust Network1;09..U...2Terms of use at hXXps://VVV.verisign.com/rpa (c)09100...U...'VeriSign Class 3 Code Signing 2009-2 CA0...150226000000Z..150527235959Z0..1.0...U....US1.0...U....VeriSign, Inc.1.0...U....VeriSign Trust Network1;09..U...2Terms of use at hXXps://VVV.verisign.com/rpa (c)091<0:..U...3VeriSign Class 3 Code Signing 2009-2 OCSP Responder0.."0...*.H.............0.............m5*R........2....>...yU4..L.. ...........u..Hez..Pn.....d...nz(...V7.}^...d!RX...bl..[..a...L.. .~..Ij......%..%p.-...u..:..i..F*]...*....{NH..|0...gHX.Q.r....S..........._.9.(w...suC...N..s.....&."...:.C.Q.i~rl..<..krS..8.B..o].y..L.4...iB@..s.....mw.........0...0...U....0.0....U. ...0..0....`.H...E....0..0(.. .........hXXps://www.verisign.com/CPS0b.. .......0V0...VeriSign, Inc.0.....=VeriSign's CPS incorp. by reference liab. ltd. (c)97 VeriSign0...U.%..0... .......0...U........0... .....0......0"..U....0...0.1.0...U....TGV-B-32010

<<< skipped >>>

POST /v1/collect HTTP/1.1

Connection: Keep-Alive

Content-Type: application/json; Charset=UTF-8

Accept: */*

User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Content-Length: 123

Host: tracking.uniblue.com

{"recipient":"uniblue.pm-1_0_5_0.web","client_id":"","event":"prod.pm.install_launched","buildtest_id":"","unit_id":"4010"}

HTTP/1.1 200 OK

Content-Type: application/json

Date: Wed, 15 Apr 2015 02:51:39 GMT

Server: ngx_openresty

Content-Length: 20

Connection: keep-alive

{. "status": "OK".}HTTP/1.1 200 OK..Content-Type: application/json..Date: Wed, 15 Apr 2015 02:51:39 GMT..Server: ngx_openresty..Content-Length: 20..Connection: keep-alive..{. "status": "OK".}....

POST /v1/collect HTTP/1.1

Connection: Keep-Alive

Content-Type: application/json; Charset=UTF-8

Accept: */*

User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Content-Length: 129

Host: tracking.uniblue.com

{"recipient":"uniblue.pm-1_0_5_0.web","client_id":"","event":"prod.pm.mypcbackup_offer_shown","buildtest_id":"","unit_id":"4010"}

HTTP/1.1 200 OK

Content-Type: application/json

Date: Wed, 15 Apr 2015 02:51:45 GMT

Server: ngx_openresty

Content-Length: 20

Connection: keep-alive

{. "status": "OK".}HTTP/1.1 200 OK..Content-Type: application/json..Date: Wed, 15 Apr 2015 02:51:45 GMT..Server: ngx_openresty..Content-Length: 20..Connection: keep-alive..{. "status": "OK".}....

POST /v1/collect HTTP/1.1

Connection: Keep-Alive

Content-Type: application/json; Charset=UTF-8

Accept: */*

User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Content-Length: 122

Host: tracking.uniblue.com

{"recipient":"uniblue.pm-1_0_5_0.web","client_id":"","event":"prod.pm.install_started","buildtest_id":"","unit_id":"4010"}

HTTP/1.1 200 OK

Content-Type: application/json

Date: Wed, 15 Apr 2015 02:51:49 GMT

Server: ngx_openresty

Content-Length: 20

Connection: keep-alive

{. "status": "OK".}HTTP/1.1 200 OK..Content-Type: application/json..Date: Wed, 15 Apr 2015 02:51:49 GMT..Server: ngx_openresty..Content-Length: 20..Connection: keep-alive..{. "status": "OK".}....

POST /v1/collect HTTP/1.1

Connection: Keep-Alive

Content-Type: application/json; Charset=UTF-8

Accept: */*

User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Content-Length: 144

Host: tracking.uniblue.com

{"recipient":"uniblue.pm-1_0_5_0.web","client_id":"","event":"prod.pm.install_standalone_download_completed","buildtest_id":"","unit_id":"4010"}

HTTP/1.1 200 OK

Content-Type: application/json

Date: Wed, 15 Apr 2015 02:52:24 GMT

Server: ngx_openresty

Content-Length: 20

Connection: keep-alive

{. "status": "OK".}HTTP/1.1 200 OK..Content-Type: application/json..Date: Wed, 15 Apr 2015 02:52:24 GMT..Server: ngx_openresty..Content-Length: 20..Connection: keep-alive..{. "status": "OK".}....

GET /pca3.crl HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: crl.verisign.com

HTTP/1.1 200 OK

Server: Apache

ETag: "4313801b45e80b5b006d195679f28274:1427247615"

Last-Modified: Wed, 25 Mar 2015 01:40:15 GMT

Date: Wed, 15 Apr 2015 02:52:10 GMT

Content-Length: 933

Connection: keep-alive

Content-Type: application/pkix-crl

0...0...0...*.H........0_1.0...U....US1.0...U....VeriSign, Inc.1705..U....Class 3 Public Primary Certification Authority..150318000000Z..150630235959Z0..x0!...v....a_>..2......020924164823Z0!.....A.....{2..Y.#..140129175709Z0!...,.|.|...<...j ...080605174907Z0!...`y..q.......fh...020923171400Z0!...?A....a.nF`.P....020923171548Z0!............R.e.53..010207212458Z0!..!......Y...ISi....010706171411Z0!..$-..I{r....u<._...080403172226Z0!..&.."?..y..51}..1..010706172118Z0!..4....2....{W......080605175030Z0!..B....c............070411175910Z0!..H.Py...N....* ....010207212031Z0!..N....-.1Gq.@...C..040401175251Z0!..Y......w`G........070411175657Z0!..Z`..H.@B....Z.*q..080403172017Z0!..l....I...Y..] .c..010706171749Z0"......T=deQ...1u.]...010207212247Z0".....p..1..7<.....e..010207211822Z0...*.H..............aI...vc...*.d...i...MF..8.........._4h.. ..'mY%...Mt...6.FK.". ..h.G#.0.$ .?.x8)....T.pQB....Y......9.j...T.}.r.....z.......h.HTTP/1.1 200 OK..Server: Apache..ETag: "4313801b45e80b5b006d195679f28274:1427247615"..Last-Modified: Wed, 25 Mar 2015 01:40:15 GMT..Date: Wed, 15 Apr 2015 02:52:10 GMT..Content-Length: 933..Connection: keep-alive..Content-Type: application/pkix-crl..0...0...0...*.H........0_1.0...U....US1.0...U....VeriSign, Inc.1705..U....Class 3 Public Primary Certification Authority..150318000000Z..150630235959Z0..x0!...v....a_>..2......020924164823Z0!.....A.....{2..Y.#..140129175709Z0!...,.|.|...<...j ...080605174907Z0!...`y..q.......fh...020923171400Z0!...?A....a.nF`.P....020923171548Z0!....

<<< skipped >>>

GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBRIt2RJ89X++hEzqoBeQg8PymQ2UQQUANhaTCXBIuWLMe9tuvPMXynxDWECEGVSJuGyLhjhWQ8phawi51w= HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.verisign.com

HTTP/1.1 200 OK

Server: nginx/1.4.7

Content-Type: application/ocsp-response

Content-Length: 1453

content-transfer-encoding: binary

Cache-Control: max-age=347790, public, no-transform, must-revalidate

Last-Modified: Sun, 12 Apr 2015 03:24:51 GMT

Expires: Sun, 19 Apr 2015 03:24:51 GMT

Date: Wed, 15 Apr 2015 02:52:09 GMT

Connection: keep-alive

0..........0..... .....0......0...0......T3t.%..O.E..~..F.=....20150412032451Z0s0q0I0... ........H.dI.....3..^B...d6Q....ZL%."..1.m..._)..a..eR&.....Y.)..".\....20150412032451Z....20150419032451Z0...*.H.............fqZ.m..:.1..o.2.-......K..v....oAJu. /_#.$...X ..O..z........:F.I#$W.~.T|.f........Nt...P.=.`.i|..'.B....w.S..l.bp.;.W...@=.yCU./z&`....w.K5.}..........8..jq.6.....|..f..*...0c.#..A...[........v6../8...".u.3o.`.4.Q.0e... ...d.w..c.N. ..4..!........8..&y>.g....0...0...0..3......./...b.v..-....l}0...*.H........0_1.0...U....US1.0...U....VeriSign, Inc.1705..U....Class 3 Public Primary Certification Authority0...141202000000Z..151216235959Z0..1.0...U....US1.0...U....Symantec Corporation1.0...U....Symantec Trust Network1?0=..U...6Symantec Class 3 PCA - G1 OCSP Responder Certificate 30.."0...*.H.............0..........'......Y..x.3B1.7..Q..`..d.. ....s..t.$a.....j2R.{ ,*..c{.3.....H..3-; ).....0._...*..9M..V...... ...{m...-.......)..tR..{D....~...M...T..pS.p..^|o....S..v.).).....r.v.qo$......C.V!....@.h#qh...u1T.].G0.]E...=._...... ........TE...Sa.s4........r...3.............0..0...U....0.0l..U. .e0c0a..`.H...E....0R0&.. .........hXXp://VVV.symauth.com/cps0(.. .......0...hXXp://VVV.symauth.com/rpa0...U.%..0... .......0...U........0... .....0......0!..U....0...0.1.0...U....TGV-B-2730...*.H.............$..H......oU....Y!.z{*.V.M..u.._z..3>.. 0....3..m.....e.......a..D...........e..F6:.y.....di.......<y.Z.......x}..q.2....UZ1 :,....

<<< skipped >>>

GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSpuCE3aK3GivZPzGQJ6L5BRyZofwQUl9BrqCZwyKE/lB8ILcQ1m6ShHvICEAxNF3PJUX7iAOhAP2oGxcI= HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.verisign.com

HTTP/1.1 200 OK

Server: nginx/1.4.7

Content-Type: application/ocsp-response

Content-Length: 1790

content-transfer-encoding: binary

Cache-Control: max-age=381927, public, no-transform, must-revalidate

Last-Modified: Sun, 12 Apr 2015 12:55:22 GMT

Expires: Sun, 19 Apr 2015 12:55:22 GMT

Date: Wed, 15 Apr 2015 02:52:10 GMT

Connection: keep-alive

0..........0..... .....0......0...0......'.V.8.F.V....H....JW..20150412125522Z0s0q0I0... ..........!7h....O.d...AG&h.....k.&p..?...-.5........M.s.Q~...@?j.......20150412125522Z....20150419125522Z0...*.H..............BU$.cve..io'...N..O.....X4...6.>...3...._.y....U...>{....~.9.6.M.I..^..X.K..'.........zM......<........E....4ob/.)*....G\.L;O..H.../......XG.L9....%*.%.0.yS......q...J4.....M...oU2.x.......e.!......E=....O..#.i..!."....L!..L:a....z.T.$.......O...U....7y.F...#0...0...0..........r..?.*......y"..0...*.H........0..1.0...U....US1.0...U....VeriSign, Inc.1.0...U....VeriSign Trust Network1;09..U...2Terms of use at hXXps://VVV.verisign.com/rpa (c)09100...U...'VeriSign Class 3 Code Signing 2009-2 CA0...150226000000Z..150527235959Z0..1.0...U....US1.0...U....VeriSign, Inc.1.0...U....VeriSign Trust Network1;09..U...2Terms of use at hXXps://VVV.verisign.com/rpa (c)091<0:..U...3VeriSign Class 3 Code Signing 2009-2 OCSP Responder0.."0...*.H.............0.............m5*R........2....>...yU4..L.. ...........u..Hez..Pn.....d...nz(...V7.}^...d!RX...bl..[..a...L.. .~..Ij......%..%p.-...u..:..i..F*]...*....{NH..|0...gHX.Q.r....S..........._.9.(w...suC...N..s.....&."...:.C.Q.i~rl..<..krS..8.B..o].y..L.4...iB@..s.....mw.........0...0...U....0.0....U. ...0..0....`.H...E....0..0(.. .........hXXps://VVV.verisign.com/CPS0b.. .......0V0...VeriSign, Inc.0.....=VeriSign's CPS incorp. by reference liab. ltd. (c)97 VeriSign0...U.%..0... .......0...U........0... .....0......0"..U....0...0.1.0...U....TGV-B-32010...

<<< skipped >>>

GET /api/v1/geo/country-code HTTP/1.1

Accept-Encoding: identity

Host: uniblue.com

Connection: close

User-Agent: Python-urllib/2.7

HTTP/1.1 301 Moved Permanently

Content-Type: text/html

Date: Wed, 15 Apr 2015 02:49:17 GMT

Location: hXXp://VVV.uniblue.com/api/v1/geo/country-code

Server: ngx_openresty

Content-Length: 178

Connection: Close

<html>..<head><title>301 Moved Permanently</title></head>..<body bgcolor="white">..<center><h1>301 Moved Permanently</h1></center>..<hr><center>nginx</center>..</body>..</html>....

GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSpuCE3aK3GivZPzGQJ6L5BRyZofwQUl9BrqCZwyKE/lB8ILcQ1m6ShHvICEEES5jLHsYoCmjofrIA6uJ8= HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.verisign.com

HTTP/1.1 200 OK

Server: nginx/1.4.7

Content-Type: application/ocsp-response

Content-Length: 1790

content-transfer-encoding: binary

Cache-Control: max-age=536559, public, no-transform, must-revalidate

Last-Modified: Tue, 14 Apr 2015 07:54:56 GMT

Expires: Tue, 21 Apr 2015 07:54:56 GMT

Date: Wed, 15 Apr 2015 02:52:17 GMT

Connection: keep-alive

0..........0..... .....0......0...0......'.V.8.F.V....H....JW..20150414075456Z0s0q0I0... ..........!7h....O.d...AG&h.....k.&p..?...-.5.......A..2.....:...:......20150414075456Z....20150421075456Z0...*.H..............@..F.V...>5...B.hdp.~..$9...d...Tx\.....<9i..m?...W..!.#.....b...4.e...:..3...6p.L.U...s.y.8.....(e.. ........,....-.C.........).6..qb..E..B.. .aJ....So.^.U...{.z.GD5..}0...z.M..'...i5...m.)L.qT....op....P|'S..7.......U.P..6.{jk..z.J..-.9d.."[...u05.WE}_....#0...0...0..........r..?.*......y"..0...*.H........0..1.0...U....US1.0...U....VeriSign, Inc.1.0...U....VeriSign Trust Network1;09..U...2Terms of use at hXXps://VVV.verisign.com/rpa (c)09100...U...'VeriSign Class 3 Code Signing 2009-2 CA0...150226000000Z..150527235959Z0..1.0...U....US1.0...U....VeriSign, Inc.1.0...U....VeriSign Trust Network1;09..U...2Terms of use at hXXps://VVV.verisign.com/rpa (c)091<0:..U...3VeriSign Class 3 Code Signing 2009-2 OCSP Responder0.."0...*.H.............0.............m5*R........2....>...yU4..L.. ...........u..Hez..Pn.....d...nz(...V7.}^...d!RX...bl..[..a...L.. .~..Ij......%..%p.-...u..:..i..F*]...*....{NH..|0...gHX.Q.r....S..........._.9.(w...suC...N..s.....&."...:.C.Q.i~rl..<..krS..8.B..o].y..L.4...iB@..s.....mw.........0...0...U....0.0....U. ...0..0....`.H...E....0..0(.. .........hXXps://VVV.verisign.com/CPS0b.. .......0V0...VeriSign, Inc.0.....=VeriSign's CPS incorp. by reference liab. ltd. (c)97 VeriSign0...U.%..0... .......0...U........0... .....0......0"..U....0...0.1.0...U....TGV-B-32010...*.H

<<< skipped >>>

GET /latest_updates/application.txt HTTP/1.1

Accept-Encoding: identity

Host: pm.uniblue.com.s3.amazonaws.com

Connection: close

User-Agent: Python-urllib/2.7

HTTP/1.1 200 OK

x-amz-id-2: SoJghxWLedS/9C4NrB7rOj0hzmQ7JK8P9h/Vqt2M51Pf4Fs8aGl3xt6XoK68r6U7aSuQtVdQzgQ=

x-amz-request-id: 3464D2CED7A40B3E

Date: Wed, 15 Apr 2015 02:49:18 GMT

Cache-Control: max-age=86400, public

Last-Modified: Tue, 24 Mar 2015 09:46:29 GMT

ETag: "7afc8227ca4783a30e4f834d1815a2fe"

Accept-Ranges: bytes

Content-Type: text/plain

Content-Length: 7

Server: AmazonS3

1.0.5.0..

GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ/xkCfyHfJr7GQ6M658NRZ4SHo/AQUCPVR6Pv+PT1kNnxoz1t4qN+5xTcCEGC2x6sSmevembHfY1acIZk= HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.verisign.com

HTTP/1.1 200 OK

Server: nginx/1.4.7

Content-Type: application/ocsp-response

Content-Length: 1697

content-transfer-encoding: binary

Cache-Control: max-age=566269, public, no-transform, must-revalidate

Last-Modified: Tue, 14 Apr 2015 16:10:00 GMT

Expires: Tue, 21 Apr 2015 16:10:00 GMT

Date: Wed, 15 Apr 2015 02:52:11 GMT

Connection: keep-alive

0..........0..... .....0......0...0...A0?1=0;..U...4VeriSign Class 3 Code Signing 2004 CA OCSP Responder..20150414161000Z0s0q0I0... ........?.@..w.........Y.!......Q...==d6|h.[x....7..`..........cV.!.....20150414161000Z....20150421161000Z0...*.H.............d.9. SV.a)Jt..5..\..qe.`8..C!yX.OY.~Y<...p.|.5*..U.p.:1....h....V. 3#`..&\.Z.o.DI{...rCJ.W.2.dS....YZS..y.......Lb..&........Y..6uc....s....U.Z.....J.V.]...W.$........$D..02&.L&L..F/P........|.a.?. SN..^.........hh.9........@..*P.8...M`......KX[....z...r......0...0...0..{.........[..I|.....Zm..0...*.H........0..1.0...U....US1.0...U....VeriSign, Inc.1.0...U....VeriSign Trust Network1;09..U...2Terms of use at hXXps://VVV.verisign.com/rpa (c)041.0,..U...%VeriSign Class 3 Code Signing 2004 CA0...140428000000Z..150729235959Z0?1=0;..U...4VeriSign Class 3 Code Signing 2004 CA OCSP Responder0.."0...*.H.............0.........Y....h..@..>.....%.-.....O...' y.........x..Gw.xF.....?..Z..u,.X.&..........3C..H.l.....f..;]s!.\"v...|....].@.....K7m2...N......-S.I......5n...G7. ..W....n..*..-f?EY.......UN...r...........-_.%..,P;b.....)(.P.4...,.%....<..6.....[r^X.EV..S...5#'Y.. .TD...........0...0...U.......0.0...U.%..0... .......0...U...........0... .....0......0f..U. ._0]0[..`.H...E....0L0#.. .........hXXps://d.symcb.com/cps0%.. .......0...hXXps://d.symcb.com/rpa0!..U....0...0.1.0...U....TGV-B-1080...U......"...?....`>q..i1o...0...U.#..0.....Q...==d6|h.[x....70...*.H.............B8@.$..wo......E.....P52"b*@'C\.y.(...n....h.f..7f.....v...pb<...]..|..........k

<<< skipped >>>

GET /v1/geo/country-code HTTP/1.1

Accept-Encoding: identity

Host: api.uniblue.net

Connection: close

User-Agent: Python-urllib/2.7

HTTP/1.1 302 Moved Temporarily

Content-Type: text/html

Date: Wed, 15 Apr 2015 02:52:40 GMT

Location: hXXp://uniblue.com/api/v1/geo/country-code

Server: nginx/1.1.19

Content-Length: 161

Connection: Close

<html>..<head><title>302 Found</title></head>..<body bgcolor="white">..<center><h1>302 Found</h1></center>..<hr><center>nginx/1.1.19</center>..</body>..</html>....

GET /product/pm/1.0.5.0/pcmechanicpm-standalone-setup.exe HTTP/1.1

Accept: */*

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Connection: Keep-Alive

Host: d21bsqatndqkg8.cloudfront.net

HTTP/1.1 200 OK

Content-Type: application/octet-stream

Content-Length: 18839984

Connection: keep-alive

Date: Wed, 18 Mar 2015 10:47:04 GMT

Cache-Control: max-age=86400, public

Last-Modified: Wed, 18 Mar 2015 10:32:55 GMT

ETag: "6843e5f8e199b000decdb9ef0cb74b3f"

Accept-Ranges: bytes

Server: AmazonS3

Age: 70625

X-Cache: Hit from cloudfront

Via: 1.1 3634ed11ef3267122afd0504d98e1154.cloudfront.net (CloudFront)

X-Amz-Cf-Id: zs_A_t7uG_wvmesVxe0Cn64uv7H25O7VX_HWxljXIFa4km12Jrc50w==

MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....WZR..................................... ....@..........................p...................@..................................................H`..h............................................................................................text...,........................... ..`.itext..D........................... ..`.data........ ......................@....bss.....V...0...........................idata..............................@....tls.....................................rdata..............................@..@.rsrc................ ..............@..@....................................@..@..................................................................................................................................................................@...AnsiChar............@...string(.@...AnsiString......@...............................@......... 9@.(9@..9@..9@..9@..9@..9@..9@.,8@.H8@..8@..TObject.%..A....%..A....%..A....%..A....%..A....%..A....%(.A....%..A....%$.A....%..A....%..A....%..A....%..A....%..A....%|.A....%x.A....%t.A....%p.A....%l.A....%h.A....% .A....%d.A....%`.A....%\.A....%..A....%..A....%..A....%X.A....%T.A....%..A....%..A....%..A....%P.A....%L.A....%H.A....%D.A....%@.A...S..........$D...T.J....D$,.t...\$0....D[..@..%<.A....%8.A....

<<< skipped >>>

Map

The Worm connects to the servers at the folowing location(s):

Strings from Dumps

pc-mechanic.exe_2024:

.text

.text

`.rdata

`.rdata

@.data

@.data

.rsrc

.rsrc

tCPV

tCPV

USER32.dll

USER32.dll

MSVCR90.dll

MSVCR90.dll

_amsg_exit

_amsg_exit

_acmdln

_acmdln

_crt_debugger_hook

_crt_debugger_hook

GetProcessHeap

GetProcessHeap

KERNEL32.dll

KERNEL32.dll

windows_exe

windows_exe

%s\%s

%s\%s

PYTHON27.DLL

PYTHON27.DLL

zlib.pyd

zlib.pyd

ZLIB.PYD

ZLIB.PYD

Not enough space for new sys.path

Not enough space for new sys.path

no mem for late sys.path

no mem for late sys.path

PY2EXE_VERBOSE

PY2EXE_VERBOSE

PyImport_ImportModule

PyImport_ImportModule

PyExc_ImportError

PyExc_ImportError

PyImport_AddModule

PyImport_AddModule

undefined symbol %s -> exit(-1)

undefined symbol %s -> exit(-1)

Importer which can load extension modules from memory

Importer which can load extension modules from memory

s#sss:import_module

s#sss:import_module

MemoryLoadLibrary failed loading %s

MemoryLoadLibrary failed loading %s

Could not find function %s

Could not find function %s

import_module

import_module

import_module(code, initfunc, dllname[, finder]) -> module

import_module(code, initfunc, dllname[, finder]) -> module

_memimporter

_memimporter

%Program Files% (x86)\Uniblue\PC-Mechanic\library.dat

%Program Files% (x86)\Uniblue\PC-Mechanic\library.dat

%Program Files% (x86)\Uniblue\PC-Mechanic\pc-mechanic.exe

%Program Files% (x86)\Uniblue\PC-Mechanic\pc-mechanic.exe

%Program Files% (x86)\Uniblue\PC-Mechanic

%Program Files% (x86)\Uniblue\PC-Mechanic

pc-mechanic.exe

pc-mechanic.exe

library.dat

library.dat

windows_exet

windows_exet

.logc

.logc

The logfile '%s' could not be opened:

The logfile '%s' could not be opened:

See the logfile '%s' for details(

See the logfile '%s' for details(

%Program Files% (x86)\Jenkins\jobs\PM\workspace\env\py_venv\lib\site-packages\py2exe-0.6.9-py2.7-win32.egg\py2exe\boot_common.pyR

%Program Files% (x86)\Jenkins\jobs\PM\workspace\env\py_venv\lib\site-packages\py2exe-0.6.9-py2.7-win32.egg\py2exe\boot_common.pyR

%Program Files% (x86)\Jenkins\jobs\PM\workspace\env\py_venv\lib\site-packages\py2exe-0.6.9-py2.7-win32.egg\py2exe\boot_common.pyt

%Program Files% (x86)\Jenkins\jobs\PM\workspace\env\py_venv\lib\site-packages\py2exe-0.6.9-py2.7-win32.egg\py2exe\boot_common.pyt

zipextimportert

zipextimportert

R$

R$

library.dats

library.dats

app.main(

app.main(

joint

joint

__import__t

__import__t

bootstrap_main.pyR$

bootstrap_main.pyR$

332222##

332222##

%%cxaax

%%cxaax

`>>>>=>`

`>>>>=>`

\4544545454545444

\4544545454545444

C.yLF

C.yLF

xmlns="hXXp://schemas.microsoft.com/SMI/2005/WindowsSettings">

xmlns="hXXp://schemas.microsoft.com/SMI/2005/WindowsSettings">

1.0.5.0

1.0.5.0

pc-mechanic.exe_2024_rwx_2530A000_000F5000:

-Vh}o

-Vh}o