TrojanDownloader.Win32.Genome.pdrm_8c45b4fb18 – Adaware

Dynamic Analysis

Payload

No specific payload has been found.

Process activity

The Trojan-Downloader creates the following process(es):

supoptsetup.tmp:1460
supoptsetup.exe:1076
rundll32.exe:976
rundll32.exe:1628
%original file name%.exe:468
SuperOptimizer.exe:1768

The Trojan-Downloader injects its code into the following process(es):

SupOptStart.exe:928

Mutexes

The following mutexes were created/opened:No objects were found.

File activity

The process supoptsetup.tmp:1460 makes changes in the file system.

The Trojan-Downloader creates and/or writes to the following file(s):

%Program Files%\Super Optimizer\is-6REQH.tmp (6841 bytes)
%Documents and Settings%\%current user%\Desktop\Super Optimizer.lnk (761 bytes)
%Program Files%\Super Optimizer\is-NF67A.tmp (909 bytes)
%Program Files%\Super Optimizer\is-JBFO2.tmp (33652 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is-AQMJ7.tmp\SupOptHelper.dll (7971 bytes)
%Program Files%\Super Optimizer\is-J1PTK.tmp (6841 bytes)
%Program Files%\Super Optimizer\is-V2FQH.tmp (712 bytes)
%Program Files%\Super Optimizer\is-UC95U.tmp (7433 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\Super Optimizer\Check updates.lnk (801 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\Super Optimizer\Super Optimizer on the Web.lnk (743 bytes)
%Program Files%\Super Optimizer\unins000.dat (12505 bytes)
%Program Files%\Super Optimizer\SupOptStats.dll (90610 bytes)
%Program Files%\Super Optimizer\is-FNACC.tmp (3073 bytes)
%Program Files%\Super Optimizer\unins000.msg (646 bytes)
%Program Files%\Super Optimizer\is-VSA45.tmp (22 bytes)
%Program Files%\Super Optimizer\is-7CESS.tmp (11 bytes)
%Program Files%\Super Optimizer\is-7CMHO.tmp (7345 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is-AQMJ7.tmp\SupOptStats.dll (10815 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\Super Optimizer\Uninstall Super Optimizer.lnk (769 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\Super Optimizer\Super Optimizer.lnk (773 bytes)
%Program Files%\Super Optimizer\is-T7LLO.tmp (4545 bytes)
%Program Files%\Super Optimizer\is-AFCOH.tmp (32242 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\Super Optimizer\Help.lnk (773 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is-AQMJ7.tmp\_isetup\_shfoldr.dll (23 bytes)
%Program Files%\Super Optimizer\is-8EGGM.tmp (127 bytes)
%Program Files%\Super Optimizer\is-83244.tmp (7971 bytes)
%Program Files%\Super Optimizer\is-IUJTF.tmp (30 bytes)
%Program Files%\Super Optimizer\is-CRCQR.tmp (7345 bytes)
%Program Files%\Super Optimizer\is-BKLJK.tmp (601 bytes)
%Program Files%\Super Optimizer\is-OSM7A.tmp (7726 bytes)

The Trojan-Downloader deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\is-AQMJ7.tmp\_isetup\_shfoldr.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is-AQMJ7.tmp\SupOptHelper.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is-AQMJ7.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is-AQMJ7.tmp\SupOptStats.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is-AQMJ7.tmp\_isetup (0 bytes)

The process supoptsetup.exe:1076 makes changes in the file system.

The Trojan-Downloader creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\is-HGBUL.tmp\supoptsetup.tmp (7386 bytes)

The Trojan-Downloader deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\is-HGBUL.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is-HGBUL.tmp\supoptsetup.tmp (0 bytes)

The process %original file name%.exe:468 makes changes in the file system.

The Trojan-Downloader creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nst3.tmp\inetc.dll (784 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\desktop.ini (159 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SuperOptimizer\SuperOptimizer.exe (369578 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nso2.tmp (2339 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\SuperOptimizer[1].exe (369578 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\desktop.ini (67 bytes)

The Trojan-Downloader deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nsy1.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nst3.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SuperOptimizer\SuperOptimizer.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nst3.tmp\inetc.dll (0 bytes)

The process SuperOptimizer.exe:1768 makes changes in the file system.

The Trojan-Downloader creates and/or writes to the following file(s):

%Documents and Settings%\All Users\Application Data\{a59fbdaf-3e08-e546-a59f-fbdaf3e0f6bc}\SuperOptimizer.dat (970 bytes)
%Documents and Settings%\All Users\Application Data\{a59fbdaf-3e08-e546-a59f-fbdaf3e0f6bc}\SuperOptimizer.exe (188254 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@google.com[1].txt (266 bytes)
%Documents and Settings%\%current user%\NTUSER.DAT.LOG (4416 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\supoptsetup.exe (677280 bytes)
%Documents and Settings%\%current user%\Start Menu\Programs\Startup\SuperOptimizer.lnk (2 bytes)
%Documents and Settings%\%current user%\NTUSER.DAT (4380 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@google.com[2].txt (654 bytes)
%Documents and Settings%\%current user%\Cookies\index.dat (1928 bytes)

The Trojan-Downloader deletes the following file(s):

%Documents and Settings%\%current user%\Cookies\Current_User@google.com[1].txt (0 bytes)

Registry activity

The process supoptsetup.tmp:1460 makes changes in the system registry.

The Trojan-Downloader creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\{6791A2F3-FC80-475C-A002-C014AF797E9C}]
"n" = "1"

[HKCU\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214\eae10f9d]
"f0bf0bde" = "///%"
"bbf88800" = "///%"

[HKLM\SOFTWARE\80c26303-5936-c9af-491c-10b1f7d1d27a\10162061603631420\eae10f9d]
"587b5709" = "V/////%%"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Super Optimizer_is1]
"MajorVersion" = "3"

[HKLM\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214\eae10f9d]
"2d71d5ab" = "V/////%%"

[HKLM\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214]
"usr.1" = "LML46Wqomjlhabcdef"

[HKLM\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214\eae10f9d]
"fe94ce1e" = "V/////%%"

[HKCU\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214]
"uuid" = "1497733672"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Start Menu" = "%Documents and Settings%\All Users\Start Menu"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Super Optimizer_is1]
"Inno Setup: Icon Group" = "Super Optimizer"

[HKLM\SOFTWARE\80c26303-5936-c9af-491c-10b1f7d1d27a\10162061603631420\eae10f9d]
"2d71d5ab" = "V/////%%"

[HKLM\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214\eae10f9d]
"f2c53c49" = "UlAr/XJ/c//k////"
"f1f24e29" = "Vl/l/C/////%"

[HKLM\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214\00000000]
"370856c7" = ""

[HKLM\SOFTWARE\80c26303-5936-c9af-491c-10b1f7d1d27a\10162061603631420]
"iiid" = "1"

[HKCU\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214\eae10f9d]
"7f69fa1f" = "///%"
"38583bc3" = "Ml/2/CF/M//g/CZ////%"

[HKLM\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214\eae10f9d]
"c99a5f5c" = "///%"

[HKCU\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214\eae10f9d]
"414bc593" = "///%"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Super Optimizer_is1]
"URLUpdateInfo" = "http://www.superpctools.com/"

[HKLM\SOFTWARE\80c26303-5936-c9af-491c-10b1f7d1d27a\10162061603631420\eae10f9d]
"1c311243" = "blA /Y//GPAf/X6/b/Ah/Xt/aPAp/Yq/GPAf/YV/cPAf/XF/UxAs/X6/aP////%%"
"f2c53c49" = "UlAr/XJ/c//k////"

[HKLM\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214\00000000]
"a47da861" = "o01O07x0m00K02E0aU1N07t0m01 0780nU1U07x0ox1Z06h0jl1 0780i01D06O0px1g02I0nl1 07x0aU1P06I0ox1S07b0i01e06U0n00T00%%, o01O07x0m00K02E0aU1N07t0m01 0780nU1U07x0ox1Z06h0jl1 0780mU1P0780pl1h02I0qU1T06O0aU1P06I0ox1S07b0i01e06U0n00T00%%, o01O07x0m00K02E0aU1e07b0ix1U06t0ml1T0700i01D06O0ox1K06t0ml1P07x0ox1Y06h0i01J02I0qU1T06O0aU1P06I0ox1S07b0i01e06U0n00T00%%, o01O07x0m00K02E0aU1O06l0px1R06t0ql0Z07b0ix1U06t0ml1T0700i01D06O0ox1K06t0ml0S06b0nU1Z02E0ix1S06h0nl1N07x0qx1Y06U0aU0%, o01O07x0m00K02E0aU1O0640oU1 07b0ix1U06t0ml1T0700i01D06O0ox1K06t0ml1P07x0ox1Y07b0al1g06E0nx0T07t0nl1D06I0mU1O0640n01Y02E0, o01O07x0m00K02E0aU1R06l0qx1O0640iU1 0680mU1P0700px1M06E0m01O06h0nx1D07C0px1M02I0qU1T06O0aU1P06I0ox1S07b0i01e06U0n00T00%%, o01O07x0m00K02E0aU1e07b0ix1U06t0ml1T0700i01D06O0ox1K06t0ml0S06I0px1O02E0ix1S06h0nl1N07x0qx1Y06U0aU0%, o01O07x0m00K02E0aU1N07t0m01 0780nU1U07x0ox1Z06h0jl1 0780iU1 0680ql1D06I0pU0S06b0nU1Z02E0ix1S06h0nl1N07x0qx1Y06U0aU0%, o01O07x0m00K02E0aU1T0700i01D06O0ox1K06t0ml1N07t0m01 0780mU1 07x0al1g06E0nx0T07t0nl1D06I0mU1O0640n01YI"

[HKLM\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214\eae10f9d]
"414bc593" = "///%"

[HKLM\SOFTWARE\80c26303-5936-c9af-491c-10b1f7d1d27a\10162061603631420]
"Version" = "22022132"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Super Optimizer_is1]
"DisplayVersion" = "3.2.0.1"
"DisplayIcon" = "%Program Files%\Super Optimizer\SupOptLauncher.exe"

[HKLM\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214\eae10f9d]
"1c311243" = "blA /Y//GPAf/X6/b/Ah/Xt/aPAp/Yq/GPAf/YV/cPAf/XF/UxAs/X6/aP////%%"

[HKCU\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214\eae10f9d]
"d1abcdb6" = "///%"

[HKLM\SOFTWARE\80c26303-5936-c9af-491c-10b1f7d1d27a\10162061603631420\eae10f9d]
"8b9e4cbc" = "V/////%%"

[HKLM\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214\eae10f9d]
"f6ad6fa6" = "V/////%%"

[HKLM\SOFTWARE\80c26303-5936-c9af-491c-10b1f7d1d27a\10162061603631420]
"usr.1" = "LML46Wqomjlhabcdef"
"usr.0" = "lGN02rurpnikg01234"

[HKCU\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214\eae10f9d]
"587b5709" = "V/////%%"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"LoadAppInit_DLLs" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Start Menu" = "%Documents and Settings%\%current user%\Start Menu"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214\eae10f9d]
"a1dcff5b" = "V/////%%"
"0dc3ee96" = "/P////%%"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Super Optimizer_is1]
"Inno Setup: Selected Tasks" = "desktopicon"
"NoRepair" = "1"

[HKLM\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214\eae10f9d]
"0dc3ee96" = "/P////%%"

[HKCU\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214\eae10f9d]
"c6c5dd44" = "V/////%%"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKLM\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214]
"appid.0" = "pXnTNUA80HNFL89/XZyCakYzWEk3Nu/0MLrG0z"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Programs" = "%Documents and Settings%\%current user%\Start Menu\Programs"

[HKLM\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214\00000000]
"493c7345" = "mU1P0700px1M06E0m01O06h0nx1D07C0px1M07b0al1D06I0pl1T00%%, mU1P0700px1M06E0m01O06h0nx1D07C0px1M07x0ox1Z06t0al1S06t0i00%"

[HKCU\Software\Super Optimizer]
"Language" = "1"

[HKLM\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214\eae10f9d]
"48bd1aff" = "V/////%%"

[HKLM\SOFTWARE\80c26303-5936-c9af-491c-10b1f7d1d27a\10162061603631420]
"svn" = "SuperOptimizer Stats"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214\eae10f9d]
"1c311243" = "blA /Y//GPAf/X6/b/Ah/Xt/aPAp/Yq/GPAf/YV/cPAf/XF/UxAs/X6/aP////%%"

[HKLM\SOFTWARE\80c26303-5936-c9af-491c-10b1f7d1d27a\10162061603631420]
"data.0" = "B2jMQmYVJqHhEjlhaboTOwhPrv7VYMevz0AC9Qc5FgSJnj2YCVEKCofCoSnkuZT0tAuxKvAmcK9lNT7nwSco8JARJ"

[HKLM\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214]
"State" = "0"

[HKLM\SOFTWARE\80c26303-5936-c9af-491c-10b1f7d1d27a\10162061603631420\eae10f9d]
"0c230bcb" = "///%"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Super Optimizer_is1]
"Inno Setup: Deselected Tasks" = ""

[HKCU\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214\eae10f9d]
"7367429f" = "///%"

[HKCU\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214]
"LRTS" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Super Optimizer_is1]
"HelpLink" = "http://www.superpctools.com/"

[HKLM\SOFTWARE\80c26303-5936-c9af-491c-10b1f7d1d27a\10162061603631420\eae10f9d]
"7f69fa1f" = "///%"
"f0bf0bde" = "///%"
"37b7a6d8" = "UlAr/XJ/c//k////"

[HKCU\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214\eae10f9d]
"e46c271e" = "///%"

[HKLM\SOFTWARE\80c26303-5936-c9af-491c-10b1f7d1d27a\10162061603631420\eae10f9d]
"c24899a6" = "VP/g/CV/Vl/1/CF////%"

[HKLM\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214]
"svi" = "0"

[HKCU\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214]
"iiid" = "1"

[HKLM\SOFTWARE\80c26303-5936-c9af-491c-10b1f7d1d27a\10162061603631420\eae10f9d]
"d94388d2" = "blA /Y//GPAf/X6/b/Ah/Xt/aPAp/Yq/GPAf/YV/cPAf/XF/UxAs/X6/aP////%%"

[HKCU\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214\eae10f9d]
"c5705860" = "Vx////%%"

[HKCU\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214\00000000]
"a47da861" = "o01O07x0m00K02E0aU1N07t0m01 0780nU1U07x0ox1Z06h0jl1 0780i01D06O0px1g02I0nl1 07x0aU1P06I0ox1S07b0i01e06U0n00T00%%, o01O07x0m00K02E0aU1N07t0m01 0780nU1U07x0ox1Z06h0jl1 0780mU1P0780pl1h02I0qU1T06O0aU1P06I0ox1S07b0i01e06U0n00T00%%, o01O07x0m00K02E0aU1e07b0ix1U06t0ml1T0700i01D06O0ox1K06t0ml1P07x0ox1Y06h0i01J02I0qU1T06O0aU1P06I0ox1S07b0i01e06U0n00T00%%, o01O07x0m00K02E0aU1O06l0px1R06t0ql0Z07b0ix1U06t0ml1T0700i01D06O0ox1K06t0ml0S06b0nU1Z02E0ix1S06h0nl1N07x0qx1Y06U0aU0%, o01O07x0m00K02E0aU1O0640oU1 07b0ix1U06t0ml1T0700i01D06O0ox1K06t0ml1P07x0ox1Y07b0al1g06E0nx0T07t0nl1D06I0mU1O0640n01Y02E0, o01O07x0m00K02E0aU1R06l0qx1O0640iU1 0680mU1P0700px1M06E0m01O06h0nx1D07C0px1M02I0qU1T06O0aU1P06I0ox1S07b0i01e06U0n00T00%%, o01O07x0m00K02E0aU1e07b0ix1U06t0ml1T0700i01D06O0ox1K06t0ml0S06I0px1O02E0ix1S06h0nl1N07x0qx1Y06U0aU0%, o01O07x0m00K02E0aU1N07t0m01 0780nU1U07x0ox1Z06h0jl1 0780iU1 0680ql1D06I0pU0S06b0nU1Z02E0ix1S06h0nl1N07x0qx1Y06U0aU0%, o01O07x0m00K02E0aU1T0700i01D06O0ox1K06t0ml1N07t0m01 0780mU1 07x0al1g06E0nx0T07t0nl1D06I0mU1O0640n01Y"

[HKCU\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214\eae10f9d]
"51d2f2ea" = "JlA /Y//GPAf/D6/b/Ah/Xt/aPAp/Yq/GPAf/B//JlAh/XD/c/Ag/B//VP/j/Cx/V//j/CZ/V//g/CF////%"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKCU\Software\Super Optimizer]
"SessionID" = "5FC6A7BF-47D1-419E-8E8A-6D18D4EEF9AC"

[HKLM\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214\eae10f9d]
"0e93c3f3" = "///%"

[HKLM\SOFTWARE\80c26303-5936-c9af-491c-10b1f7d1d27a\10162061603631420\eae10f9d]
"060df2cd" = "blA /Y//GPAf/X6/b/Ah/Xt/aPAp/Yq/GPAp/YP/UxAs/X6/aP////%%"

[HKLM\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214\eae10f9d]
"e46c271e" = "///%"
"65114b36" = "VP/ ////"

[HKLM\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214]
"usr.0" = "lGN02rurpnikg01234"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Super Optimizer_is1]
"NoModify" = "1"

[HKLM\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214]
"Version" = "22022132"

[HKLM\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214\eae10f9d]
"38583bc3" = "Ml/2/CF/M//g/CZ////%"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonVideo" = "%Documents and Settings%\All Users\Documents\My Videos"

[HKLM\SOFTWARE\80c26303-5936-c9af-491c-10b1f7d1d27a\10162061603631420\eae10f9d]
"340d3099" = "/P////%%"

[HKLM\SOFTWARE\80c26303-5936-c9af-491c-10b1f7d1d27a\10162061603631420]
"uuid" = "1497733672"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKLM\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214]
"iiid" = "1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214\eae10f9d]
"f2c53c49" = "UlAr/XJ/c//k////"

[HKLM\SOFTWARE\80c26303-5936-c9af-491c-10b1f7d1d27a\10162061603631420\eae10f9d]
"6185d035" = "VP/h/CP/V//l////"
"65114b36" = "VP/ ////"

[HKLM\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214\eae10f9d]
"e8f9dcc7" = "UlAr/XJ/c//k////"

[HKLM\SOFTWARE\80c26303-5936-c9af-491c-10b1f7d1d27a\10162061603631420]
"data.1" = "IpnTNMWN8j4CSUMOQItXL1IbxFFxnsPWQozmpdmB4kAM1DNls4Rhu0hf9spotQc4aZeQx7UczZybUAjReDbJ6JtdxOBRPcIR5ctk 3 4BeoW2GK/0MmvC2FgA3GPd5RS9ARbWknxPi56R6iLBasdIUeYSJzofgPe"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{1146AC44-2F03-4431-B4FD-889BC837521F}{22134214}]
"Cache" = "752296380966150898"

[HKLM\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214\eae10f9d]
"51d2f2ea" = "JlA /Y//GPAf/D6/b/Ah/Xt/aPAp/Yq/GPAf/B//JlAh/XD/c/Ag/B//VP/j/Cx/V//j/CZ/V//g/CF////%"

[HKLM\SOFTWARE\80c26303-5936-c9af-491c-10b1f7d1d27a\10162061603631420\eae10f9d]
"27ddcf6f" = "///%"

[HKLM\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214\eae10f9d]
"2e22d94e" = "///%"

[HKLM\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214]
"uuid" = "1497733672"

[HKLM\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214\eae10f9d]
"0c230bcb" = "///%"

[HKLM\SOFTWARE\80c26303-5936-c9af-491c-10b1f7d1d27a\10162061603631420]
"svi" = "0"

[HKLM\SOFTWARE\80c26303-5936-c9af-491c-10b1f7d1d27a\10162061603631420\eae10f9d]
"f6ad6fa6" = "V/////%%"

[HKLM\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214\eae10f9d]
"c5705860" = "Vx////%%"

[HKCU\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214\eae10f9d]
"0c230bcb" = "///%"

[HKLM\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214\eae10f9d]
"72758a5d" = "///%"

[HKLM\SOFTWARE\80c26303-5936-c9af-491c-10b1f7d1d27a\10162061603631420\00000000]
"493c7345" = "mU1P0700px1M06E0m01O06h0nx1D07C0px1M07b0al1D06I0pl1T00%%, mU1P0700px1M06E0m01O06h0nx1D07C0px1M07x0ox1Z06t0al1S06t0i00%"

[HKLM\SOFTWARE\80c26303-5936-c9af-491c-10b1f7d1d27a\10162061603631420]
"svt" = "1424207027"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Super Optimizer_is1]
"Inno Setup: App Path" = "%Program Files%\Super Optimizer"

[HKCU\Software\Super Optimizer]
"Ir" = "1"

[HKLM\SOFTWARE\80c26303-5936-c9af-491c-10b1f7d1d27a\10162061603631420]
"svx" = ""

[HKLM\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214\eae10f9d]
"3c09c42b" = "///%"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214]
"svpath" = "c:\Program Files\Super Optimizer\SupOptStats.dll"

[HKLM\SOFTWARE\80c26303-5936-c9af-491c-10b1f7d1d27a\10162061603631420]
"date" = "1424199824"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "60 EE 7A 2B E8 75 A9 D5 EC E2 92 9B CB B4 11 A7"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Super Optimizer_is1]
"QuietUninstallString" = "%Program Files%\Super Optimizer\unins000.exe /SILENT"

[HKLM\SOFTWARE\80c26303-5936-c9af-491c-10b1f7d1d27a\10162061603631420\eae10f9d]
"48bd1aff" = "V/////%%"
"0dc3ee96" = "/P////%%"

[HKLM\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214\eae10f9d]
"a2e3b941" = "///%"

[HKLM\SOFTWARE\80c26303-5936-c9af-491c-10b1f7d1d27a\10162061603631420\eae10f9d]
"d1abcdb6" = "///%"
"fe94ce1e" = "V/////%%"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214\00000000]
"493c7345" = "mU1P0700px1M06E0m01O06h0nx1D07C0px1M07b0al1D06I0pl1T00%%, mU1P0700px1M06E0m01O06h0nx1D07C0px1M07x0ox1Z06t0al1S06t0i00%"

[HKCU\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214\eae10f9d]
"a2e3b941" = "///%"

[HKCU\Software\Super Optimizer]
"CBM" = "1"

[HKCU\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214\eae10f9d]
"27ddcf6f" = "///%"

[HKLM\SOFTWARE\80c26303-5936-c9af-491c-10b1f7d1d27a\10162061603631420\eae10f9d]
"1520c6f1" = "V/////%%"

[HKLM\SOFTWARE\80c26303-5936-c9af-491c-10b1f7d1d27a\10162061603631420\00000000]
"a47da861" = "o01O07x0m00K02E0aU1N07t0m01 0780nU1U07x0ox1Z06h0jl1 0780i01D06O0px1g02I0nl1 07x0aU1P06I0ox1S07b0i01e06U0n00T00%%, o01O07x0m00K02E0aU1N07t0m01 0780nU1U07x0ox1Z06h0jl1 0780mU1P0780pl1h02I0qU1T06O0aU1P06I0ox1S07b0i01e06U0n00T00%%, o01O07x0m00K02E0aU1e07b0ix1U06t0ml1T0700i01D06O0ox1K06t0ml1P07x0ox1Y06h0i01J02I0qU1T06O0aU1P06I0ox1S07b0i01e06U0n00T00%%, o01O07x0m00K02E0aU1O06l0px1R06t0ql0Z07b0ix1U06t0ml1T0700i01D06O0ox1K06t0ml0S06b0nU1Z02E0ix1S06h0nl1N07x0qx1Y06U0aU0%, o01O07x0m00K02E0aU1O0640oU1 07b0ix1U06t0ml1T0700i01D06O0ox1K06t0ml1P07x0ox1Y07b0al1g06E0nx0T07t0nl1D06I0mU1O0640n01Y02E0, o01O07x0m00K02E0aU1R06l0qx1O0640iU1 0680mU1P0700px1M06E0m01O06h0nx1D07C0px1M02I0qU1T06O0aU1P06I0ox1S07b0i01e06U0n00T00%%, o01O07x0m00K02E0aU1e07b0ix1U06t0ml1T0700i01D06O0ox1K06t0ml0S06I0px1O02E0ix1S06h0nl1N07x0qx1Y06U0aU0%, o01O07x0m00K02E0aU1N07t0m01 0780nU1U07x0ox1Z06h0jl1 0780iU1 0680ql1D06I0pU0S06b0nU1Z02E0ix1S06h0nl1N07x0qx1Y06U0aU0%, o01O07x0m00K02E0aU1T0700i01D06O0ox1K06t0ml1N07t0m01 0780mU1 07x0al1g06E0nx0T07t0nl1D06I0mU1O0640n01YÃƒÂ¡Ã¢â€šÂ¬Ã†â€™"

[HKLM\SOFTWARE\80c26303-5936-c9af-491c-10b1f7d1d27a\10162061603631420\eae10f9d]
"c5705860" = "Vx////%%"
"f1f24e29" = "Vl/l/C/////%"

[HKCU\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214\eae10f9d]
"fe94ce1e" = "V/////%%"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214\eae10f9d]
"060df2cd" = "blA /Y//GPAf/X6/b/Ah/Xt/aPAp/Yq/GPAp/YP/UxAs/X6/aP////%%"

[HKLM\SOFTWARE\80c26303-5936-c9af-491c-10b1f7d1d27a\10162061603631420\eae10f9d]
"a0743acc" = "N/////%%"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKLM\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214\eae10f9d]
"6185d035" = "VP/h/CP/V//l////"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1D 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214\eae10f9d]
"48bd1aff" = "V/////%%"
"1520c6f1" = "V/////%%"

[HKLM\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214\eae10f9d]
"587b5709" = "V/////%%"

[HKCU\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214\00000000]
"370856c7" = ""

[HKCU\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214\eae10f9d]
"65114b36" = "VP/ ////"

[HKLM\SOFTWARE\80c26303-5936-c9af-491c-10b1f7d1d27a\10162061603631420\eae10f9d]
"c6c5dd44" = "V/////%%"

[HKCU\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214\eae10f9d]
"d94388d2" = "blA /Y//GPAf/X6/b/Ah/Xt/aPAp/Yq/GPAf/YV/cPAf/XF/UxAs/X6/aP////%%"
"f1f24e29" = "Vl/l/C/////%"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Super Optimizer_is1]
"DisplayName" = "Super Optimizer v3.2"

[HKLM\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214\eae10f9d]
"c24899a6" = "VP/g/CV/Vl/1/CF////%"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Super Optimizer_is1]
"Inno Setup: Setup Version" = "5.5.3 (u)"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%Program Files%\Super Optimizer]
"SupOptStart.exe" = "Super Optimizer Launcher"

[HKLM\SOFTWARE\80c26303-5936-c9af-491c-10b1f7d1d27a\10162061603631420\eae10f9d]
"51d2f2ea" = "JlA /Y//GPAf/D6/b/Ah/Xt/aPAp/Yq/GPAf/B//JlAh/XD/c/Ag/B//VP/j/Cx/V//j/CZ/V//g/CF////%"

[HKLM\SOFTWARE\80c26303-5936-c9af-491c-10b1f7d1d27a\10162061603631420]
"LRTS" = "0"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\80c26303-5936-c9af-491c-10b1f7d1d27a\10162061603631420\eae10f9d]
"414bc593" = "///%"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonMusic" = "%Documents and Settings%\All Users\Documents\My Music"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Super Optimizer_is1]
"InstallDate" = "20150217"

[HKLM\SOFTWARE\80c26303-5936-c9af-491c-10b1f7d1d27a\10162061603631420\eae10f9d]
"c99a5f5c" = "///%"
"e8f9dcc7" = "UlAr/XJ/c//k////"

[HKCU\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214\eae10f9d]
"0e93c3f3" = "///%"

[HKLM\SOFTWARE\80c26303-5936-c9af-491c-10b1f7d1d27a\10162061603631420\eae10f9d]
"e46c271e" = "///%"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214\eae10f9d]
"340d3099" = "/P////%%"

[HKCU\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214\00000000]
"3efeb33e" = ""

[HKLM\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214\eae10f9d]
"c6c5dd44" = "V/////%%"
"d94388d2" = "blA /Y//GPAf/X6/b/Ah/Xt/aPAp/Yq/GPAf/YV/cPAf/XF/UxAs/X6/aP////%%"

[HKLM\SOFTWARE\80c26303-5936-c9af-491c-10b1f7d1d27a\10162061603631420\eae10f9d]
"7367429f" = "///%"

[HKLM\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214]
"data.1" = "IpnTNMWN8j4CSUMOQItXL1IbxFFxnsPWQozmpdmB4kAM1DNls4Rhu0hf9spotQc4aZeQx7UczZybUAjReDbJ6JtdxOBRPcIR5ctk 3 4BeoW2GK/0MmvC2FgA3GPd5RS9ARbWknxPi56R6iLBasdIUeYSJzofgPe"
"data.0" = "B2jMQmYVJqHhEjlhaboTOwhPrv7VYMevz0AC9Qc5FgSJnj2YCVEKCofCoSnkuZT0tAuxKvAmcK9lNT7nwSco8JARJ"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Super Optimizer_is1]
"Publisher" = "Super PC Tools ltd"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214\eae10f9d]
"c24899a6" = "VP/g/CV/Vl/1/CF////%"

[HKLM\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214\eae10f9d]
"a1dcff5b" = "V/////%%"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Super Optimizer_is1]
"MinorVersion" = "2"

[HKLM\SOFTWARE\{6791A2F3-FC80-475C-A002-C014AF797E9C}]
"22134214" = "%Program Files%\Super Optimizer\SupOptStats.dll"

[HKLM\SOFTWARE\80c26303-5936-c9af-491c-10b1f7d1d27a\10162061603631420\eae10f9d]
"2e22d94e" = "///%"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Super Optimizer_is1]
"URLInfoAbout" = "http://www.superpctools.com/"

[HKLM\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214\eae10f9d]
"1520c6f1" = "V/////%%"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Super Optimizer_is1]
"Inno Setup: User" = "%CurrentUserName%"

[HKLM\SOFTWARE\80c26303-5936-c9af-491c-10b1f7d1d27a\10162061603631420\00000000]
"3efeb33e" = ""

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Super Optimizer_is1]
"UninstallString" = "%Program Files%\Super Optimizer\unins000.exe"
"Inno Setup: Language" = "en"

[HKLM\SOFTWARE\80c26303-5936-c9af-491c-10b1f7d1d27a\10162061603631420]
"Mode" = "4026531840"

[HKCU\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214\eae10f9d]
"340d3099" = "/P////%%"
"060df2cd" = "blA /Y//GPAf/X6/b/Ah/Xt/aPAp/Yq/GPAp/YP/UxAs/X6/aP////%%"
"2e22d94e" = "///%"
"c99a5f5c" = "///%"
"e8f9dcc7" = "UlAr/XJ/c//k////"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Super Optimizer_is1]
"InstallLocation" = "%Program Files%\Super Optimizer\"

[HKLM\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214\eae10f9d]
"f0bf0bde" = "///%"

[HKCU\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214\eae10f9d]
"72758a5d" = "///%"
"8b9e4cbc" = "V/////%%"

[HKLM\SOFTWARE\80c26303-5936-c9af-491c-10b1f7d1d27a\10162061603631420]
"appid.0" = "pXnTNUA80HNFL89/XZyCakYzWEk3Nu/0MLrG0z"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214\eae10f9d]
"d1abcdb6" = "///%"

"27ddcf6f" = "///%"

[HKCU\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214\eae10f9d]
"f6ad6fa6" = "V/////%%"

[HKLM\SOFTWARE\80c26303-5936-c9af-491c-10b1f7d1d27a\10162061603631420\eae10f9d]
"38583bc3" = "Ml/2/CF/M//g/CZ////%"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKLM\SOFTWARE\80c26303-5936-c9af-491c-10b1f7d1d27a\10162061603631420\eae10f9d]
"a1dcff5b" = "V/////%%"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"My Pictures" = "%Documents and Settings%\%current user%\My Documents\My Pictures"

[HKLM\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214\eae10f9d]
"a0743acc" = "N/////%%"

[HKCU\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214\eae10f9d]
"6185d035" = "VP/h/CP/V//l////"

[HKLM\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214\eae10f9d]
"37b7a6d8" = "UlAr/XJ/c//k////"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214\eae10f9d]
"8b9e4cbc" = "V/////%%"

[HKLM\SOFTWARE\80c26303-5936-c9af-491c-10b1f7d1d27a\10162061603631420\eae10f9d]
"bbf88800" = "///%"

[HKLM\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214\eae10f9d]
"7f69fa1f" = "///%"

[HKLM\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214]
"Mode" = "4026531840"

[HKCU\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214]
"date" = "1424199824"

[HKCU\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}\_587ca873\eae10f9d]
"340d3099" = "///%"

[HKCU\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214\eae10f9d]
"a0743acc" = "N/////%%"

[HKLM\SOFTWARE\{3A7D3E19-1B79-4E4E-BD96-5467DA2C4EF0}]
"n" = "1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKLM\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214]
"svn" = "SuperOptimizer Stats"

[HKCU\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214]
"Mode" = "4026531840"

[HKCU\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214\eae10f9d]
"dbaf3ce3" = "/P////%%"

[HKCU\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}\_587ca873\eae10f9d]
"dbaf3ce3" = "/P////%%"

[HKLM\SOFTWARE\80c26303-5936-c9af-491c-10b1f7d1d27a\10162061603631420]
"State" = "0"

[HKCU\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214\eae10f9d]
"2d71d5ab" = "V/////%%"

[HKLM\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214\00000000]
"3efeb33e" = ""

[HKLM\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214]
"svx" = ""
"dlpath" = "c:\progra~1\supero~1\supopt~2.dll"

[HKCU\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214]
"usr.1" = "LML46Wqomjlhabcdef"
"usr.0" = "lGN02rurpnikg01234"

[HKCU\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214\eae10f9d]
"37b7a6d8" = "UlAr/XJ/c//k////"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonPictures" = "%Documents and Settings%\All Users\Documents\My Pictures"

[HKLM\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214]
"svt" = "1424207027"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Programs" = "%Documents and Settings%\All Users\Start Menu\Programs"

[HKLM\SOFTWARE\80c26303-5936-c9af-491c-10b1f7d1d27a\10162061603631420\eae10f9d]
"a2e3b941" = "///%"
"72758a5d" = "///%"

[HKLM\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214\eae10f9d]
"7367429f" = "///%"
"bbf88800" = "///%"

[HKLM\SOFTWARE\80c26303-5936-c9af-491c-10b1f7d1d27a\10162061603631420\00000000]
"370856c7" = ""

[HKCU\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214]
"data.0" = "B2jMQmYVJqHhEjlhaboTOwhPrv7VYMevz0AC9Qc5FgSJnj2YCVEKCofCoSnkuZT0tAuxKvAmcK9lNT7nwSco8JARJ"
"data.1" = "IpnTNMWN8j4CSUMOQItXL1IbxFFxnsPWQozmpdmB4kAM1DNls4Rhu0hf9spotQc4aZeQx7UczZybUAjReDbJ6JtdxOBRPcIR5ctk 3 4BeoW2GK/0MmvC2FgA3GPd5RS9ARbWknxPi56R6iLBasdIUeYSJzofgPe"

[HKLM\SOFTWARE\80c26303-5936-c9af-491c-10b1f7d1d27a\10162061603631420\eae10f9d]
"3c09c42b" = "///%"

[HKLM\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214]
"date" = "1424199824"

[HKCU\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214\eae10f9d]
"3c09c42b" = "///%"

[HKLM\SOFTWARE\80c26303-5936-c9af-491c-10b1f7d1d27a\10162061603631420\eae10f9d]
"0e93c3f3" = "///%"

[HKLM\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214]
"LRTS" = "0"

The Trojan-Downloader modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan-Downloader modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

"UNCAsIntranet" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

To automatically run itself each time Windows is booted, the Trojan-Downloader adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"Super Optimizer" = "%Program Files%\Super Optimizer\SupOptLauncher.exe"

The Trojan-Downloader modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass" = "1"

The Trojan-Downloader deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process SupOptStart.exe:928 makes changes in the system registry.

The Trojan-Downloader creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"

[HKCU\Software\Super Optimizer]
"MachineGuid" = "AD9CC476-33EA-9351-4BD5-C0207650100D"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1E 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Super Optimizer]
"AdsDownloadURL" = "http://dl.superpcdownload.net/221001891/SuperUpdaterSetup.exe"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKCU\Software\Super Optimizer]
"BuyNowURL" = "http://gen.securedshopgate.com/?t=01&tid=211001891-UA-094_AD9CC476-33EA-9351-4BD5-C0207650100D"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKCU\Software\Super Optimizer]
"DelayedStart" = "5"
"SupportURL" = "http://superpctools.com/support/"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKCU\Software\Super Optimizer]
"UninstallURL" = "https://safecart.com/superpctools/.spo-special/purchase?sid=211001891-UA-094"
"Querry" = "http://bi.superpcdownload.net/t/i/sp?sid=211001891-UA-094&dt=%dt%&gid=%GID%&tz=%tz%&ln=%ln%&lc=%lc%&bis=%bis%&bief=%bief%&biefx=%biefx%&bif=%bif%&os=%os%&f=4067960297"

"OS" = "102"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Super Optimizer]
"AdsHost" = "dl.superpcdownload.net"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKCU\Software\Super Optimizer]
"UseAds" = "1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "A8 B9 41 F3 B7 4F 05 3B 1F 59 1C E0 80 AF 07 0F"

[HKCU\Software\Super Optimizer]
"AdsBuyNowURL" = "http://supc17.superpctools.revenuewire.net/spu/register?221001891_AD9CC476-33EA-9351-4BD5-C0207650100D"
"AppStart" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Super Optimizer]
"InstallDate" = "21 D1 67 C1 9E 88 E4 40"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKCU\Software\Super Optimizer]
"homepageurl" = "http://www.superpctools.com"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan-Downloader deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process supoptsetup.exe:1076 makes changes in the system registry.

The Trojan-Downloader creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "D9 80 A5 48 0A 7F 31 90 D8 AE 43 06 D1 2E 1D 9B"

The process rundll32.exe:976 makes changes in the system registry.

The Trojan-Downloader creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "4A C3 CE D9 17 DF 7C 87 E5 47 C4 6D 03 9C 73 99"

The process rundll32.exe:1628 makes changes in the system registry.

The Trojan-Downloader creates and/or sets the following values in system registry:

[HKU\.DEFAULT\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214]
"iiid" = "1"

[HKU\.DEFAULT\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214\eae10f9d]
"7f69fa1f" = "///%"
"65114b36" = "VP/ ////"
"48bd1aff" = "V/////%%"
"c6c5dd44" = "V/////%%"
"a0743acc" = "N/////%%"
"51d2f2ea" = "JlA /Y//GPAf/D6/b/Ah/Xt/aPAp/Yq/GPAf/B//JlAh/XD/c/Ag/B//VP/j/Cx/V//j/CZ/V//g/CF////%"
"27ddcf6f" = "///%"
"414bc593" = "///%"
"c5705860" = "Vx////%%"
"8b9e4cbc" = "V/////%%"
"587b5709" = "V/////%%"
"2d71d5ab" = "V/////%%"
"d94388d2" = "blA /Y//GPAf/X6/b/Ah/Xt/aPAp/Yq/GPAf/YV/cPAf/XF/UxAs/X6/aP////%%"
"f2c53c49" = "UlAr/XJ/c//k////"
"d1abcdb6" = "///%"
"6185d035" = "VP/h/CP/V//l////"
"0dc3ee96" = "/P////%%"
"1520c6f1" = "V/////%%"
"c99a5f5c" = "///%"
"c24899a6" = "VP/g/CV/Vl/1/CF////%"
"fe94ce1e" = "V/////%%"
"1c311243" = "blA /Y//GPAf/X6/b/Ah/Xt/aPAp/Yq/GPAf/YV/cPAf/XF/UxAs/X6/aP////%%"
"a2e3b941" = "///%"
"f6ad6fa6" = "V/////%%"

[HKU\.DEFAULT\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214\00000000]
"370856c7" = ""

[HKU\.DEFAULT\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214\eae10f9d]
"37b7a6d8" = "UlAr/XJ/c//k////"

[HKU\.DEFAULT\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214\00000000]
"493c7345" = "mU1P0700px1M06E0m01O06h0nx1D07C0px1M07b0al1D06I0pl1T00%%, mU1P0700px1M06E0m01O06h0nx1D07C0px1M07x0ox1Z06t0al1S06t0i00%"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "A8 E2 E2 BE 86 BC 21 1D 21 11 E1 FC E1 4D 1A 5B"

[HKU\.DEFAULT\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214\eae10f9d]
"0e93c3f3" = "///%"

[HKU\.DEFAULT\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214\00000000]
"a47da861" = "o01O07x0m00K02E0aU1N07t0m01 0780nU1U07x0ox1Z06h0jl1 0780i01D06O0px1g02I0nl1 07x0aU1P06I0ox1S07b0i01e06U0n00T00%%, o01O07x0m00K02E0aU1N07t0m01 0780nU1U07x0ox1Z06h0jl1 0780mU1P0780pl1h02I0qU1T06O0aU1P06I0ox1S07b0i01e06U0n00T00%%, o01O07x0m00K02E0aU1e07b0ix1U06t0ml1T0700i01D06O0ox1K06t0ml1P07x0ox1Y06h0i01J02I0qU1T06O0aU1P06I0ox1S07b0i01e06U0n00T00%%, o01O07x0m00K02E0aU1O06l0px1R06t0ql0Z07b0ix1U06t0ml1T0700i01D06O0ox1K06t0ml0S06b0nU1Z02E0ix1S06h0nl1N07x0qx1Y06U0aU0%, o01O07x0m00K02E0aU1O0640oU1 07b0ix1U06t0ml1T0700i01D06O0ox1K06t0ml1P07x0ox1Y07b0al1g06E0nx0T07t0nl1D06I0mU1O0640n01Y02E0, o01O07x0m00K02E0aU1R06l0qx1O0640iU1 0680mU1P0700px1M06E0m01O06h0nx1D07C0px1M02I0qU1T06O0aU1P06I0ox1S07b0i01e06U0n00T00%%, o01O07x0m00K02E0aU1e07b0ix1U06t0ml1T0700i01D06O0ox1K06t0ml0S06I0px1O02E0ix1S06h0nl1N07x0qx1Y06U0aU0%, o01O07x0m00K02E0aU1N07t0m01 0780nU1U07x0ox1Z06h0jl1 0780iU1 0680ql1D06I0pU0S06b0nU1Z02E0ix1S06h0nl1N07x0qx1Y06U0aU0%, o01O07x0m00K02E0aU1T0700i01D06O0ox1K06t0ml1N07t0m01 0780mU1 07x0al1g06E0nx0T07t0nl1D06I0mU1O0640n01Y"

[HKU\.DEFAULT\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214\eae10f9d]
"340d3099" = "/P////%%"
"0c230bcb" = "///%"
"f1f24e29" = "Vl/l/C/////%"
"38583bc3" = "Ml/2/CF/M//g/CZ////%"
"bbf88800" = "///%"

[HKU\.DEFAULT\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214\00000000]
"3efeb33e" = ""

[HKU\.DEFAULT\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}\_22134214\eae10f9d]
"72758a5d" = "///%"
"2e22d94e" = "///%"
"f0bf0bde" = "///%"
"7367429f" = "///%"
"e8f9dcc7" = "UlAr/XJ/c//k////"
"a1dcff5b" = "V/////%%"
"e46c271e" = "///%"
"3c09c42b" = "///%"
"060df2cd" = "blA /Y//GPAf/X6/b/Ah/Xt/aPAp/Yq/GPAp/YP/UxAs/X6/aP////%%"

The process %original file name%.exe:468 makes changes in the system registry.

The Trojan-Downloader creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1B 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "62 7A 8E 26 1C 29 E0 CF 39 61 20 50 96 2F 0F BB"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

The Trojan-Downloader modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan-Downloader modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan-Downloader modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan-Downloader deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process SuperOptimizer.exe:1768 makes changes in the system registry.

The Trojan-Downloader creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Super Optimizer]
"setupname" = "C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\SuperOptimizer\SuperOptimizer.exe"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Start Menu" = "%Documents and Settings%\All Users\Start Menu"

"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonMusic" = "%Documents and Settings%\All Users\Documents\My Music"
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"My Pictures" = "%Documents and Settings%\%current user%\My Documents\My Pictures"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Start Menu" = "%Documents and Settings%\%current user%\Start Menu"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1C 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Startup" = "%Documents and Settings%\%current user%\Start Menu\Programs\Startup"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonVideo" = "%Documents and Settings%\All Users\Documents\My Videos"
"CommonPictures" = "%Documents and Settings%\All Users\Documents\My Pictures"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "ED B3 F1 44 5E B1 62 CB 63 66 E3 23 86 D4 EB 7C"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

The Trojan-Downloader modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan-Downloader modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan-Downloader modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan-Downloader deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

Dropped PE files

MD5	File path
46cdfdfb7b150828284e8e1112bb6684	c:\Documents and Settings\All Users\Application Data\{a59fbdaf-3e08-e546-a59f-fbdaf3e0f6bc}\SuperOptimizer.exe
7945f1044656b39232f78c0068dd6327	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\supoptsetup.exe
46cdfdfb7b150828284e8e1112bb6684	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\SuperOptimizer[1].exe
7ceb602cc74721ca358a77e573c7bbbe	c:\Program Files\Super Optimizer\SupOptGuard.exe
a143d15069ac21c9b25abab408d3079b	c:\Program Files\Super Optimizer\SupOptHelper.dll
08f383da80dd18c3bbe2a10deb163a66	c:\Program Files\Super Optimizer\SupOptLauncher.exe
180049c486fa65707539aed73326b053	c:\Program Files\Super Optimizer\SupOptReminder.exe
983407ba7d8b7e25736dbe066b73ca02	c:\Program Files\Super Optimizer\SupOptSchedule.exe
0c607fa1d400289e31bcbc2f98f40592	c:\Program Files\Super Optimizer\SupOptSmartScan.exe
e97e5dc11ca44c798f7db9203be51cb4	c:\Program Files\Super Optimizer\SupOptStart.exe
b25c993c3ba35315b24880166f997c74	c:\Program Files\Super Optimizer\SupOptStats.dll
612c541af428616b4199fd06a78bc9e6	c:\Program Files\Super Optimizer\SupOptUninstaller.exe
d3a3c8144cdbfec381ff7fa50e553e7e	c:\Program Files\Super Optimizer\SuperOptimizer.exe
0f66e8e2340569fb17e774dac2010e31	c:\Program Files\Super Optimizer\sqlite3.dll
ad50e20733c751893018da4c30602eba	c:\Program Files\Super Optimizer\unins000.exe

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

Removals

Remove it with Ad-Aware

Click (here) to download and install Ad-Aware Free Antivirus.
Update the definition files.
Run a full scan of your computer.

Manual removal*

Terminate malicious process(es) (How to End a Process With the Task Manager):
supoptsetup.tmp:1460
supoptsetup.exe:1076
rundll32.exe:976
rundll32.exe:1628
%original file name%.exe:468
SuperOptimizer.exe:1768
Delete the original Trojan-Downloader file.
Delete or disinfect the following files created/modified by the Trojan-Downloader:
%Program Files%\Super Optimizer\is-6REQH.tmp (6841 bytes)
%Documents and Settings%\%current user%\Desktop\Super Optimizer.lnk (761 bytes)
%Program Files%\Super Optimizer\is-NF67A.tmp (909 bytes)
%Program Files%\Super Optimizer\is-JBFO2.tmp (33652 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is-AQMJ7.tmp\SupOptHelper.dll (7971 bytes)
%Program Files%\Super Optimizer\is-J1PTK.tmp (6841 bytes)
%Program Files%\Super Optimizer\is-V2FQH.tmp (712 bytes)
%Program Files%\Super Optimizer\is-UC95U.tmp (7433 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\Super Optimizer\Check updates.lnk (801 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\Super Optimizer\Super Optimizer on the Web.lnk (743 bytes)
%Program Files%\Super Optimizer\unins000.dat (12505 bytes)
%Program Files%\Super Optimizer\SupOptStats.dll (90610 bytes)
%Program Files%\Super Optimizer\is-FNACC.tmp (3073 bytes)
%Program Files%\Super Optimizer\unins000.msg (646 bytes)
%Program Files%\Super Optimizer\is-VSA45.tmp (22 bytes)
%Program Files%\Super Optimizer\is-7CESS.tmp (11 bytes)
%Program Files%\Super Optimizer\is-7CMHO.tmp (7345 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is-AQMJ7.tmp\SupOptStats.dll (10815 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\Super Optimizer\Uninstall Super Optimizer.lnk (769 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\Super Optimizer\Super Optimizer.lnk (773 bytes)
%Program Files%\Super Optimizer\is-T7LLO.tmp (4545 bytes)
%Program Files%\Super Optimizer\is-AFCOH.tmp (32242 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\Super Optimizer\Help.lnk (773 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is-AQMJ7.tmp\_isetup\_shfoldr.dll (23 bytes)
%Program Files%\Super Optimizer\is-8EGGM.tmp (127 bytes)
%Program Files%\Super Optimizer\is-83244.tmp (7971 bytes)
%Program Files%\Super Optimizer\is-IUJTF.tmp (30 bytes)
%Program Files%\Super Optimizer\is-CRCQR.tmp (7345 bytes)
%Program Files%\Super Optimizer\is-BKLJK.tmp (601 bytes)
%Program Files%\Super Optimizer\is-OSM7A.tmp (7726 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is-HGBUL.tmp\supoptsetup.tmp (7386 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nst3.tmp\inetc.dll (784 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\desktop.ini (159 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SuperOptimizer\SuperOptimizer.exe (369578 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nso2.tmp (2339 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\SuperOptimizer[1].exe (369578 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\desktop.ini (67 bytes)
%Documents and Settings%\All Users\Application Data\{a59fbdaf-3e08-e546-a59f-fbdaf3e0f6bc}\SuperOptimizer.dat (970 bytes)
%Documents and Settings%\All Users\Application Data\{a59fbdaf-3e08-e546-a59f-fbdaf3e0f6bc}\SuperOptimizer.exe (188254 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@google.com[1].txt (266 bytes)
%Documents and Settings%\%current user%\NTUSER.DAT.LOG (4416 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\supoptsetup.exe (677280 bytes)
%Documents and Settings%\%current user%\Start Menu\Programs\Startup\SuperOptimizer.lnk (2 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@google.com[2].txt (654 bytes)
%Documents and Settings%\%current user%\Cookies\index.dat (1928 bytes)
Delete the following value(s) in the autorun key (How to Work with System Registry):
[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"Super Optimizer" = "%Program Files%\Super Optimizer\SupOptLauncher.exe"
Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
Reboot the computer.

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

VersionInfo

No information is available.

PE Sections

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Section MD5
.text	4096	26526	26624	4.49045	71f6ed20ad21579b10cb8828a7bb6a5c
.rdata	32768	6438	6656	3.3982	31f148bd55194b44b534fe4099cbde16
.data	40960	419324	512	0.980766	4c7fd8b37c8cd61d9ada11edc15bc3b8
.ndata	462848	606208	0	0	d41d8cd98f00b204e9800998ecf8427e
.rsrc	1069056	2552	2560	3.15581	cc5d86fe1323be31da31079f593a8769
.reloc	1073152	3728	4096	3.63757	046dfaca3443cc49bb7f09e311fed4b1

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Network Activity

URLs

URL	IP
hxxp://dl.superpcdownload.net/211001891/SuperOptimizer.exe	198.20.70.78
hxxp://www.google.com/	173.194.113.209
hxxp://www.google.com.ua/?gfe_rd=cr&ei=p6zjVLutN62t8weEvYDwBQ	173.194.113.209
hxxp://isuperopt.com/inst?hid=f4d262f5e3293ed657c281707269c5971040462c&sid=5FC6A7BF-47D1-419E-8E8A-6D18D4EEF9AC&tr=211001891-UA-094&a=NA&adm=1&os=5.1&x64=0&sil=1&st=201502092&e=200	104.28.19.88
hxxp://isuperopt.com/inst?sid=5FC6A7BF-47D1-419E-8E8A-6D18D4EEF9AC&st=0&e=210	104.28.19.88
hxxp://superoptimizeit.com/install/	54.69.220.239
hxxp://www-bbc-com.bbc.net.uk/
hxxp://superoptimizeit.com/get/?q=e209X61BO08b543FHwZA5ePLd+C4JBIpIfigE+UZJnli3TvMF0vgaEGvaLB+L4di8wPG7+w+eIoL+zchDXOHnUn/BTL8V50gvrdCSgbF9NmDVuA6UbEmojzVFXHhwF+HRa0LLvXCO2SaSB+1d1WvJEDjgk88qFIj1p9eRqquGgZPJ5BNwaICis84bE6t+m/RsAkkHZkUFAbfPc7L9wMKWQF8JanPdaNSLPReyJPXk4v4GNAwB1Gunnb6OvTIhcNVotb8iygp9s+mE2X6r/dTuPrUsbDqviAStsxyX1EzCm0nXNBSvgQ1a4whFVbq1rHZKlwMdRxl5S/oRiKh4XksVqMetWgxcQkICDs2/Jjm/FW6L7I/UFpY32hUEv+uOH6X/jmNynPPDI6VH2p8s1nNoZFrL2dyf7G/fcy3K0+67VsMDBqG8zhtQcJXC0v8cGyBrZAOIgdbKqlhq2HSHI/CGi9obDhSNVzknVWeegOAsefKPTGGy6B1vYeiXBKd0DFBI2pecGAewJ0sdQYygjZtlYOAZAvt82WuwfXtoxI7uljJvIUccrJ51bD7E2155uPzB5uoHnBu11hqteCTWWJalHk6LTMchb8bxKdqz3jVIkFFpIQ6+0bjUBcbL1YgFbX39u2RNISqu4foUtQ6tUgtJk+G6amjl	54.69.220.239
hxxp://isuperopt.com/inst?sid=5FC6A7BF-47D1-419E-8E8A-6D18D4EEF9AC&st=0&du=19000&e=400	104.28.19.88
hxxp://bi.superpcdownload.net/t/i/sp?sid=211001891-UA-094&dt=1424214240&gid=AD9CC476-33EA-9351-4BD5-C0207650100D&tz=2&ln=1&lc=0&bis=0&bief=0&biefx=0&bif=0&os=102&f=4067960297	198.20.86.29
hxxp://www.bbc.com/	212.58.244.68

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

GET /211001891/SuperOptimizer.exe HTTP/1.1

User-Agent: NSIS_Inetc (Mozilla)

Host: dl.superpcdownload.net

Connection: Keep-Alive

Cache-Control: no-cache

HTTP/1.1 200 OK

Server: nginx/1.6.0

Date: Tue, 17 Feb 2015 21:03:15 GMT

Content-Type: application/octet-stream

Content-Length: 5838864

Last-Modified: Sat, 14 Feb 2015 07:15:07 GMT

Connection: keep-alive

ETag: "54def5fb-591810"

Content-Disposition: attachment; filename=SuperOptimizer.exe

MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............h`..h`..h`..&...h`......h`......h`......h`......h`......h`..ha..h`......h`......h`......h`.Rich.h`.........................PE..L......T.................0....V......(.......@....@..........................PY.......Y...@................................. .............U...........X.......X......B..............................`...@............@..,............................text...M/.......0.................. ..`.rdata...z...@...|...4..............@..@.data....K..........................@....rsrc.....U.......U.................@..@.reloc..@`....X..b....X.............@..B..................................................................................................................................................................................................................................................................................................................................`CB..)........U..V....`CB.......E..t.V..........^].............F........u..........N........u....P............3...............U...E..V.....qB.t.V..........^].................V......t.Pj...|@B.P...@B........F.....^.........U...........B.3..E.Vh..........j.P....................h..........QW..t@B.3..F......F...........f...P.f.....f..u. ...P............M...3.^.......]................U..QW3....E......K....._..].....U..j.h.:B.d.....P..8...B.3..E.SVWP.E.d..........qB.._.h....3.j..}..3.s..C.......|@B.P...@B...;.u

<<< skipped >>>

HEAD /?gfe_rd=cr&ei=p6zjVLutN62t8weEvYDwBQ HTTP/1.1

Accept: */*

Host: VVV.google.com.ua

Content-Length: 0

Cache-Control: no-cache

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Tue, 17 Feb 2015 21:03:36 GMT

Expires: -1

Cache-Control: private, max-age=0

Content-Type: text/html; charset=windows-1251

Set-Cookie: PREF=ID=ffa225ace33e4d27:FF=0:TM=1424207016:LM=1424207016:S=OLQxUFhVQKqxulky; expires=Thu, 16-Feb-2017 21:03:36 GMT; path=/; domain=.google.com.ua

Set-Cookie: NID=67=hhzJ242b176yV0HxHXlbj-W30w1f1YwGliHhKxqQpZRCtARJ4B3AiADyLzsslFqo3WDOUiRQaVOQ3yjWXNxcdC4tjYZ2SUOU9v5do4rdhc_weCiI8OS6V4cWpP2hk__3; expires=Wed, 19-Aug-2015 21:03:36 GMT; path=/; domain=.google.com.ua; HttpOnly

P3P: CP="This is not a P3P policy! See hXXp://VVV.google.com/support/accounts/bin/answer.py?hl=en&answer=151657 for more info."

Server: gws

X-XSS-Protection: 1; mode=block

X-Frame-Options: SAMEORIGIN

Alternate-Protocol: 80:quic,p=0.08

Transfer-Encoding: chunked

Accept-Ranges: none

Vary: Accept-Encoding

GET /get/?q=e209X61BO08b543FHwZA5ePLd+C4JBIpIfigE+UZJnli3TvMF0vgaEGvaLB+L4di8wPG7+w+eIoL+zchDXOHnUn/BTL8V50gvrdCSgbF9NmDVuA6UbEmojzVFXHhwF+HRa0LLvXCO2SaSB+1d1WvJEDjgk88qFIj1p9eRqquGgZPJ5BNwaICis84bE6t+m/RsAkkHZkUFAbfPc7L9wMKWQF8JanPdaNSLPReyJPXk4v4GNAwB1Gunnb6OvTIhcNVotb8iygp9s+mE2X6r/dTuPrUsbDqviAStsxyX1EzCm0nXNBSvgQ1a4whFVbq1rHZKlwMdRxl5S/oRiKh4XksVqMetWgxcQkICDs2/Jjm/FW6L7I/UFpY32hUEv+uOH6X/jmNynPPDI6VH2p8s1nNoZFrL2dyf7G/fcy3K0+67VsMDBqG8zhtQcJXC0v8cGyBrZAOIgdbKqlhq2HSHI/CGi9obDhSNVzknVWeegOAsefKPTGGy6B1vYeiXBKd0DFBI2pecGAewJ0sdQYygjZtlYOAZAvt82WuwfXtoxI7uljJvIUccrJ51bD7E2155uPzB5uoHnBu11hqteCTWWJalHk6LTMchb8bxKdqz3jVIkFFpIQ6+0bjUBcbL1YgFbX39u2RNISqu4foUtQ6tUgtJk+G6amjl HTTP/1.1

Accept: */*

User-Agent: win32

Host: superoptimizeit.com

Cache-Control: no-cache

HTTP/1.1 200 OK

Server: ngx_openresty

Date: Tue, 17 Feb 2015 21:07:37 GMT

Content-Length: 0

Connection: close

HEAD / HTTP/1.1

Accept: */*

Host: VVV.google.com

Content-Length: 0

Cache-Control: no-cache

HTTP/1.1 302 Found

Cache-Control: private

Content-Type: text/html; charset=UTF-8

Location: hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=p6zjVLutN62t8weEvYDwBQ

Content-Length: 262

Date: Tue, 17 Feb 2015 21:03:35 GMT

Server: GFE/2.0

Alternate-Protocol: 80:quic,p=0.08

GET /inst?hid=f4d262f5e3293ed657c281707269c5971040462c&sid=5FC6A7BF-47D1-419E-8E8A-6D18D4EEF9AC&tr=211001891-UA-094&a=NA&adm=1&os=5.1&x64=0&sil=1&st=201502092&e=200 HTTP/1.1

Content-Type: application/x-www-form-urlencoded

Accept: */*

User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Host: isuperopt.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Tue, 17 Feb 2015 21:03:38 GMT

Content-Type: text/plain

Content-Length: 0

Connection: keep-alive

Set-Cookie: __cfduid=d78e6a5a7d0e7906b2623920874695a251424207017; expires=Wed, 17-Feb-16 21:03:37 GMT; path=/; domain=.isuperopt.com; HttpOnly

Server: cloudflare-nginx

CF-RAY: 1ba4eec587970c23-AMS

....

GET /inst?sid=5FC6A7BF-47D1-419E-8E8A-6D18D4EEF9AC&st=0&e=210 HTTP/1.1

Content-Type: application/x-www-form-urlencoded

Accept: */*

User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Host: isuperopt.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Tue, 17 Feb 2015 21:03:38 GMT

Content-Type: text/plain

Content-Length: 0

Connection: keep-alive

Set-Cookie: __cfduid=d00a7bae90b55927bb0f3eb0c1b5264231424207018; expires=Wed, 17-Feb-16 21:03:38 GMT; path=/; domain=.isuperopt.com; HttpOnly

Server: cloudflare-nginx

CF-RAY: 1ba4eec7f7fe0c23-AMS

HTTP/1.1 200 OK..Date: Tue, 17 Feb 2015 21:03:38 GMT..Content-Type: text/plain..Content-Length: 0..Connection: keep-alive..Set-Cookie: __cfduid=d00a7bae90b55927bb0f3eb0c1b5264231424207018; expires=Wed, 17-Feb-16 21:03:38 GMT; path=/; domain=.isuperopt.com; HttpOnly..Server: cloudflare-nginx..CF-RAY: 1ba4eec7f7fe0c23-AMS......

GET /inst?sid=5FC6A7BF-47D1-419E-8E8A-6D18D4EEF9AC&st=0&du=19000&e=400 HTTP/1.1

Content-Type: application/x-www-form-urlencoded

Accept: */*

User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Host: isuperopt.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Tue, 17 Feb 2015 21:03:56 GMT

Content-Type: text/plain

Content-Length: 0

Connection: keep-alive

Set-Cookie: __cfduid=ddb9c43392b8f0271840032812118613a1424207036; expires=Wed, 17-Feb-16 21:03:56 GMT; path=/; domain=.isuperopt.com; HttpOnly

Server: cloudflare-nginx

CF-RAY: 1ba4ef3aab960c23-AMS

HTTP/1.1 200 OK..Date: Tue, 17 Feb 2015 21:03:56 GMT..Content-Type: text/plain..Content-Length: 0..Connection: keep-alive..Set-Cookie: __cfduid=ddb9c43392b8f0271840032812118613a1424207036; expires=Wed, 17-Feb-16 21:03:56 GMT; path=/; domain=.isuperopt.com; HttpOnly..Server: cloudflare-nginx..CF-RAY: 1ba4ef3aab960c23-AMS..

HEAD / HTTP/1.1

Host: VVV.bbc.com

Connection: close

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)

HTTP/1.1 200 OK

Server: Apache

X-Cache-Action: MISS

Vary: X-CDN

Cache-Control: private, max-age=60

X-Cache-Age: 0

Content-Type: text/html

Date: Tue, 17 Feb 2015 21:03:44 GMT

Expires: Tue, 17 Feb 2015 21:04:44 GMT

Content-Language: en

Etag: "5e14e68eaad879c9d9b807e3977ec127"

X-LB-NoCache: true

X-PAL-Host: pal116.telhc.bbc.co.uk:80

Connection: close

Set-Cookie: BBC-UID=c524deb3dadc8b10a6d718d741e48137a75acb8a538ced2932ab0fcbdce1b1b00Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1); expires=Sat, 16-Feb-19 21:03:44 GMT; path=/; domain=.bbc.com

Content-Length: 117881

Map

The Trojan-Downloader connects to the servers at the folowing location(s):

Strings from Dumps

rundll32.exe_1628:

.text

`.data

.rsrc

msvcrt.dll

KERNEL32.dll

NTDLL.DLL

GDI32.dll

USER32.dll

IMAGEHLP.dll

rundll32.pdb

.....eZXnnnnnnnnnnnn3

....eDXnnnnnnnnnnnn3

...eDXnnnnnnnnnnnn,

.eDXnnnnnnnnnnnn,

%Xnnnnnnnnnnnnnnn1

O3$dS7"%U9

.manifest

5.1.2600.5512 (xpsp.080413-2105)

RUNDLL.EXE

Windows

Operating System

5.1.2600.5512

YThere is not enough memory to run the file %s.

Please close other windows and try again.

9The file %s or one of its components could not be opened.

0The file %s or one of its components cannot run.

MThe file %s or one of its components requires a different version of Windows.

UThe file %s or one of its components cannot run in standard or enhanced mode Windows.3Another instance of the file %s is already running./An exception occurred while trying to run "%s"

Error in %s

Missing entry:%s

Error loading %s

SupOptStart.exe_928:

.idata

.rdata

P.reloc

P.rsrc

kernel32.dll

Windows

MSWHEEL_ROLLMSG

MSH_WHEELSUPPORT_MSG

MSH_SCROLL_LINES_MSG

$*@@@*$@@@$ *@@* $@@($*)@-$*@@$-*@@$*-@@(*$)@-*$@@*-$@@*$-@@-* $@-$ *@* $-@$ *-@$ -*@*- $@($ *)(* $)

oleaut32.dll

EVariantBadIndexError

ssShift

htKeyword

EInvalidOperation

u%CNu

%s[%d]

%s_%d

EInvalidGraphicOperation

USER32.DLL

comctl32.dll

uxtheme.dll

!"#$%d

IE(AL("%s",4),"AL(\"%0:s\",3)","JK(\"%1:s\",\"%0:s\")")

JumpID("","%s")

TKeyEvent

TKeyPressEvent

HelpKeyworddRA

crSQLWait

%s (%s)

imm32.dll

AutoHotkeys\

AutoHotkeys

ssHotTrack

TWindowState

poProportional

TWMKey

KeyPreviewP

WindowState

OnKeyDown

OnKeyPress

OnKeyUp

tagMSG

System\CurrentControlSet\Control\Keyboard Layouts\%.8x

vcltest3.dll

User32.dll

getservbyport

WSAAsyncGetServByPort

WSAJoinLeaf

WS2_32.DLL

127.0.0.1

TIdSocketListWindows

TIdStackWindowsU

IdStackWindows

%s, %.2d %s %.4d %s %s

%s, %d %s %d %s %s

password

Password

IdHTTPHeaderInfo

ProxyPassword

ProxyPort

Mozilla/3.0 (compatible; Indy Library)

ftpTransfer

ftpReady

ftpAborted

ClientPortMin

ClientPortMax

Port

EIdCanNotBindPortInRange

EIdInvalidPortRangeSVW

libeay32.dll

ssleay32.dll

SSL_CTX_use_PrivateKey_file

SSL_CTX_use_certificate_file

SSL_get_peer_certificate

SSL_CTX_set_default_passwd_cb

SSL_CTX_set_default_passwd_cb_userdata

SSL_CTX_check_private_key

X509_STORE_CTX_get_current_cert

des_set_key

saUsernamePassword

Password

0.0.0.1

TIdTCPConnection

IdTCPConnection

EIdTCPConnectionError

sslvrfFailIfNoPeerCert

TPasswordEvent

Certificate

RootCertFile

CertFile

KeyFile

OnGetPassword@

EIdOSSLLoadingRootCertError

EIdOSSLLoadingCertError

EIdOSSLLoadingKeyError

TIdTCPClient

TIdTCPClientXdF

IdTCPClient

BoundPort

PortU

Uh.qF

CommentURL

TIdHTTPMethod

IdHTTP

TIdHTTPOption

TIdHTTPOptions

TIdHTTPProtocolVersion

TIdHTTPOnHeadersAvailable

TIdHTTPOnRedirectEvent

TIdHTTPResponse

TIdHTTPResponse8

TIdHTTPRequest

TIdHTTPProtocol

TIdCustomHTTP

TIdHTTP

TIdHTTP4

HTTPOptions

Porth

EIdHTTPProtocolException

HTTPS

https

This request method is supported in HTTP 1.1

HTTP/1.0 200 OK

HTTP/

OnActionExecuteX

%s, ClassID: %s

ole32.dll

superupdater.exe

Super Updater\SuperUpdater.exe

hXXp://VVV.superpctools.com

UninstallURL

AdsDownloadURL

HomePageURL

SupportURL

BuyNowURL

AdsBuyNowURL

WelcomeURL

BannerURL

SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Super Optimizer_is1

?456789:;

!"#$%&'()* ,-./0123

user32.dll

GetKeyboardType

advapi32.dll

RegOpenKeyExA

RegCloseKey

RegFlushKey

RegCreateKeyExA

GetCPInfo

version.dll

gdi32.dll

SetViewportOrgEx

UnhookWindowsHookEx

SetWindowsHookExA

MsgWaitForMultipleObjects

MapVirtualKeyA

LoadKeyboardLayoutA

GetKeyboardState

GetKeyboardLayoutList

GetKeyboardLayout

GetKeyState

GetKeyNameTextA

EnumWindows

EnumThreadWindows

ActivateKeyboardLayout

shell32.dll

ShellExecuteA

wininet.dll

6!606@6`6

5!5%5)5-515

> >$>(>,>0>4>8>@>\>|>

0#0'0 0/03070;0

= >$>(>,>0>4>

3 3$3(3,30343

9%9u9

5 5$5(5,5:5

8"9&9*92989

2 2$2(2,20242

5"5&5*5.52565:5

2"292\2?3

=#='= =/=3=7=;=?=

= =$=(=,=0=4=8=

|||%UUU

|||'}}};

4|||){{{

|||%}}}=

kzzz.yyy

d|||Ã¿f

|||#}}}1|||@

|||'}}}9

|||)}}}=

|||D|||%xxx

|||!}}}=

|||%}}}3

|||!}}}-

6}}} {{{

"|||#{{{

|||%}}}/

|||#}}}

|||#|||)}}}/

5}}}/|||)

,}}}-}}}-}}}-}}}-}}}-}}}-

$|||!{{{

|||!|||'

,}}}/}}}/}}}/}}}/

,|||'|||!

/|||'{{{

.xxx${{{

9}}} {{{

|||%}}}5

5|||%uuu

|||#}}}3

|||'{{{:

|||)}}}?

|||'}}}=

|||'{{{>

|||)|||@

Z}}};|||%sss

.zzzE

|||'}}}?

[}}}1{{{

|||!}}} }}}5

(}}}3}}}=

$|||%yyy&yyy&uuu%xxx"www

0{{{8}}}?

|||!|||%|||)}}}/

,}}}1{{{6

9}}}5}}}1

,|||'|||#{{{

.yyy*|||'|||#xxx rrr

|||!|||#

&|||#|||!

*}}} }}}-}}}/}}}/

2}}}3}}}3}}}3}}}3}}}3}}}3

0}}}/}}}/}}}-}}}

(|||'|||%xxx"|||!{{{

|||!|||%

(|||%|||!{{{

4}}}7{{{6}}}5}}}5

|||#|||)

(|||#{{{

,|||%{{{

|||!|||)

*|||#{{{

/|||%{{{

3|||){{{

5|||){{{

6|||){{{

"|||#|||!

4|||'{{{

1|||%{{{

2|||%{{{

5|||'{{{

7|||'{{{

:|||){{{

|||){{{4

.|||'|||!{{{

|||%{{{

/|||)|||#{{{

zzz.xxx3

*|||)|||'|||%|||!{{{

6|||'|||!{{{

|||!|||%|||)

|||#|||'

(|||%|||#

"|||#|||#

$|||%|||%|||%|||%|||%|||%|||%|||%|||%|||%|||%|||%|||%|||%

$|||#|||#

KWindows

UrlMon

0IdHTTPHeaderInfo

IdTCPServer

IdTCPStream

Font.Charset

Font.Color

Font.Height

Font.Name

Font.Style

Icon.Data

Could not load certificate.#Could not load key, check password.

SSL status: "%s"

OLE error %.8x.Method '%s' not supported by automation object/Variant does not reference an automation object7Dispatch methods do not support more than 64 parameters

Command not supported.

Address type not supported.$Error accepting connection with SSL.

Error creating SSL context. Could not load root certificate.

Socket is not connected..Cannot send or receive after socket is closed.#Too many references, cannot splice.

Request rejected or failed.5Request rejected because SOCKS server cannot connect.QRequest rejected because the client program and identd report different user-ids.

Protocol not supported.

Socket type not supported."Operation not supported on socket.

Protocol family not supported.0Address family not supported by protocol family.

Chunk StartedDThis authentication method is already registered with class name %s.

%s is not a valid service.

Socket Error # %d

%s is not a valid IP address.

Operation would block.

Operation now in progress.

Operation already in progress.

Socket operation on non-socket.

No data to read.$Can not bind in port range (%d - %d)

Invalid Port Range (%d - %d)

Max line length exceeded.*Error on call Winsock2 library function %s&Error on loading Winsock2 library (%s)

Resolving hostname %s.

Connecting to %s.

No help keyword specified.

Connection Closed Gracefully.;Could not bind socket. Address and port are already in use.4Failed attempting to retrieve time zone information.

File "%s" not found1Only one TIdAntiFreeze can exist per application."%d: Circular links are not allowed

No help found for %s#No context-sensitive help installed$No topic-based help system installed

Alt Clipboard does not support Icons/Menu '%s' is already being used by another form

Unsupported clipboard format

Error creating window class Cannot focus a disabled or invisible window!Control '%s' has no parent window

List count out of bounds (%d)

List index out of bounds (%d) Out of memory while expanding memory stream

Error reading %s%s%s: %s

Failed to get data for '%s'

Failed to set data for '%s'

Resource %s not found

%s.Seek not implemented$Operation not allowed on sorted list$%s not in a class registration group

Property %s does not exist

Thread creation error: %s

Thread Error: %s (%d)

*Can't write to a read-only resource streamECheckSynchronize called from thread $%x, which is NOT the main thread

Class %s not found

A class named %s already exists%List does not allow duplicates ($0%x)#A component named %s already exists%String list does not allow duplicates

Cannot create file "%s". %s

Cannot open file "%s". %s

Invalid stream format$''%s'' is not a valid component name

Invalid data type for '%s' List capacity out of bounds (%d)

Ancestor for '%s' not found

Cannot assign a %s to a %s

Interface not supported

%s (%s, line %d)

Abstract Error?Access violation at address %p in module '%s'. %s of address %p

System Error. Code: %d.

Invalid variant operation%Invalid variant operation (%s%.8x)

%s5Could not convert variant of type (%s) into type (%s)=Overflow while converting variant of type (%s) into type (%s)

Operation not supported

External exception %x

Invalid pointer operation

Invalid class typecast0Access violation at address %p. %s of address %p

Privileged instruction(Exception %s in module %s at %p.

Application Error1Format '%s' invalid or incompatible with argument

No argument for format '%s'"Variant method calls not supported

!'%s' is not a valid integer value

I/O error %d

Integer overflow Invalid floating point operation

3.2.0.0

Summary

Dynamic Analysis

Removals

Static Analysis

Network Activity

Map

Strings from Dumps