Win32.Sality.3_44a259bb3f – Adaware

Win32.Sality.3 (B) (Emsisoft), Win32.Sality.3 (AdAware), Virus.Win32.Sality.FD, Virus.Win32.Sality.2.FD, VirusSality.YR, GenericAutorunWorm.YR, GenericInjector.YR (Lavasoft MAS)Behaviour: Worm, Virus, WormAutorun

The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.

Summary

MD5: 44a259bb3fb54c4e18dc9be25dac54d9

SHA1: 9a2013df4c72f88ff8fbecf553809689e377073b

SHA256: 21ae92b0f8c35bd6a65c59299f7bfe8dcb58fc4c5ca94e5f76491f26758300b9

SSDeep: 12288:ZTHiFlkI9s6dRi7X4 C9rr5TLeqvkQCoSNOVt/B OLzlu8t:ZTHEkBORij4 yrrlL TOLfZuA

Size: 467776 bytes

File type: EXE

Platform: WIN32

Entropy: Packed

PEID: UPolyXv05_v6

Company: no certificate found

Created at: 2013-11-12 11:47:15

Analyzed on: WindowsXPESX SP3 32-bit

Summary: Worm. A program that is primarily replicating on networks or removable drives.

Dynamic Analysis

Payload

Behaviour	Description
WormAutorun	A worm can spread via removable drives. It writes its executable and creates "autorun.inf" scripts on all removable drives. The autorun script will execute the Worm's file once a user opens a drive's folder in Windows Explorer.

Process activity

The Worm creates the following process(es):

mscorsvw.exe:1912

The Worm injects its code into the following process(es):

%original file name%.exe:580
Explorer.EXE:840

Mutexes

The following mutexes were created/opened:No objects were found.

File activity

The process %original file name%.exe:580 makes changes in the file system.

The Worm creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\f[1].txt (3928 bytes)
%WinDir%\system.ini (72 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\winhqka.exe (741 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\market[1].js (329 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\fad58-8688a[2].css (21 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\gradientbg[1].png (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\eulastep-101727[1] (3470 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\fad58-8688a[1].css (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\f[1].txt (21610 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\CA0EWZZT.gif (35 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\pubads_impl_56[2].js (4051 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@softonic[2].txt (301 bytes)
C:\autorun.inf (245 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\dorothy[1].js (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\desktop.ini (67 bytes)
C:\jwqutd.pif (99 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\teamspeak-2-11[1].jpg (1281 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\sd_100861_41d97[1].jpg (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\sprite[1].png (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\eulastep-101727[1].htm (1275 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@softonic[1].txt (478 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\loading[1].gif (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\amzn_ads[1].js (1969 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\sd_101633_08ebf[1].jpg (261 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\5ca1e-31ef7[1].js (9052 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\CAHI7XHU.gif (35 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\CAW5UNGL.gif (35 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@rubiconproject[1].txt (246 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\universaldownloader-prefetch[1].htm (2888 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\CA9CT0X9.gif (35 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\cc92a7d66e[1].setToken (25 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\dorothy[2].js (23 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\f[2].txt (6943 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@sd.softonic[1].txt (17340 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\CASVJF64.gif (35 bytes)
%Program Files%\Common Files\Java\Java Update\jusched.exe (272 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\CAWPA9DU.gif (35 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\container[1].html (619 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\CA6DU5G9.gif (35 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\analytics[1].js (842 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\sd_101633_08ebf[1].jpg (261 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\container[1].htm (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\sd_100861_41d97[1].jpg (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\market[2].js (1668 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\bid[1].pl/21547/universaldownloader/campaign-100861,101633/eulastep-101727?sd_timestamp=1421668077&cb=3030167 (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\CA9KKN5H.gif (35 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\CAEFS5IF.gif (35 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\CAXCVYZN.gif (35 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@sd.softonic[2].txt (16395 bytes)
%Program Files%\Adobe\Reader 9.0\Reader\Reader_sl.exe (840 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\sd_icon_100861_8a4a3[1].png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\CAO7UL25.gif (35 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\market[1].js (945 bytes)
%Documents and Settings%\%current user%\Cookies\index.dat (31812 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\pubads_impl_56[1].js (2696 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\market[2].js (505 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\desktop.ini (67 bytes)

The Worm deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\f[1].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\winhqka.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\market[1].js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\CA9CT0X9.gif (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\fad58-8688a[1].css (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\CA6DU5G9.gif (0 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\MSHist012013041720130418\index.dat (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@softonic[2].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\dorothy[1].js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\CAWPA9DU.gif (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@softonic[1].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\pubads_impl_56[1].js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\CAHI7XHU.gif (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\CAW5UNGL.gif (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@sd.softonic[1].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\CASVJF64.gif (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\CA0EWZZT.gif (0 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\MSHist012013041720130418 (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\CA9KKN5H.gif (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\CAEFS5IF.gif (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\CAXCVYZN.gif (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@sd.softonic[2].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\CAO7UL25.gif (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\market[1].js (0 bytes)

Registry activity

The process mscorsvw.exe:1912 makes changes in the system registry.

The Worm creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\State]
"AccumulatedWaitIdleTime" = "2340000"

The process %original file name%.exe:580 makes changes in the system registry.

The Worm creates and/or sets the following values in system registry:

[HKCU\Software\Aas]
"a4_440" = "3154413240"
"a3_694" = "697136351"
"a2_348" = "2494853049"
"a2_349" = "2502017839"
"a2_346" = "2480518278"
"a2_347" = "2487685695"
"a2_344" = "2466183498"
"a2_345" = "2473352532"
"a2_342" = "2451833873"
"a2_343" = "2459000538"
"a2_340" = "2437499511"
"a2_341" = "2444668162"
"a2_180" = "1290437379"
"a2_181" = "1297604878"
"a2_182" = "1304773371"
"a2_183" = "1311957269"
"a2_184" = "1319123034"
"a2_185" = "1326289958"
"a2_186" = "1333448023"
"a2_187" = "1340623989"
"a2_188" = "1347791955"
"a2_189" = "1354958285"
"a4_444" = "3183089724"
"a3_789" = "1344615644"
"a3_788" = "1371246781"

[HKLM\SOFTWARE\Microsoft\Security Center]
"AntiVirusOverride" = "1"

[HKCU\Software\Aas]
"a2_749" = "1074705194"
"a2_742" = "1024517311"
"a2_743" = "1031687197"
"a2_740" = "1010188277"
"a2_741" = "1017353678"
"a2_746" = "1053202821"
"a2_747" = "1060371885"
"a2_744" = "1038853950"
"a2_745" = "1046020518"
"a1_503" = "3203445549"
"a1_502" = "3586644066"
"a1_501" = "1165341326"
"a1_500" = "952271791"
"a1_507" = "2107575107"
"a1_506" = "4240526194"
"a1_505" = "344497256"
"a1_504" = "2557906993"
"a1_509" = "2909015808"
"a1_508" = "1920508965"
"a3_659" = "412749722"
"a3_658" = "405760891"
"a4_844" = "1755770828"
"a1_946" = "3723415296"
"a3_78" = "542637991"
"a3_79" = "549622726"
"a3_72" = "533156193"
"a3_73" = "506656128"
"a3_70" = "485103791"
"a3_71" = "525712590"
"a3_76" = "561686245"
"a3_77" = "568613636"
"a3_74" = "513568291"
"a3_75" = "554631746"
"a3_259" = "1873798154"
"a3_258" = "1866220523"
"a1_435" = "3362389127"
"a1_434" = "3487850031"
"a1_433" = "140884812"
"a1_432" = "3550645707"
"a1_431" = "2632832790"
"a1_430" = "992111442"
"a3_251" = "1782710578"
"a3_250" = "1809280147"
"a3_253" = "1830771188"
"a3_252" = "1789764949"
"a3_255" = "1844811446"
"a3_254" = "1837822487"
"a3_257" = "1825746760"
"a3_256" = "1818692393"
"a3_784" = "1308623673"
"a3_783" = "1335193222"
"a3_782" = "1328269927"
"a3_781" = "1287147972"
"a1_636" = "1381737351"
"a3_321" = "2284435336"
"a3_320" = "2310935401"
"a3_323" = "2332478538"
"a3_322" = "2291869739"
"a3_325" = "2346910988"
"a3_324" = "2339397869"
"a3_327" = "2327338446"
"a3_326" = "2320415151"
"a3_329" = "2375379584"
"a3_328" = "2368468577"
"a3_971" = "2682835394"
"a1_729" = "1564272009"
"a1_728" = "157088385"
"a3_439" = "3130280062"
"a3_438" = "3123369951"
"a3_435" = "3101883130"
"a3_434" = "3094824539"
"a3_437" = "3149870012"
"a3_436" = "3142426397"
"a3_431" = "3106444646"
"a3_430" = "3065901255"
"a3_433" = "3087376952"
"a3_432" = "3113879961"
"a4_818" = "1569373682"
"a4_819" = "1576542803"
"a4_810" = "1512020714"
"a4_811" = "1519189835"
"a4_812" = "1526358956"
"a4_813" = "1533528077"
"a4_814" = "1540697198"
"a4_815" = "1547866319"
"a4_816" = "1555035440"
"a4_817" = "1562204561"
"a1_670" = "270131080"
"a2_748" = "1067539512"
"a1_593" = "408812775"
"a3_94" = "690598327"
"a3_95" = "698045910"
"a3_96" = "671534665"
"a3_97" = "678453992"
"a3_90" = "662052915"
"a3_91" = "669107282"
"a3_92" = "643004661"
"a3_93" = "649993492"
"a3_98" = "685967115"
"a3_99" = "726580138"
"a4_605" = "42350909"
"a4_604" = "35181788"
"a4_607" = "56689151"
"a4_606" = "49520030"
"a4_601" = "13674425"
"a4_600" = "6505304"
"a4_603" = "28012667"
"a4_602" = "20843546"
"a4_979" = "2723602163"
"a4_978" = "2716433042"
"a4_609" = "71027393"
"a4_608" = "63858272"
"a1_987" = "44921012"
"a1_986" = "618529064"
"a1_985" = "3752617603"
"a1_984" = "547875852"
"a1_983" = "1589479332"
"a1_982" = "2105366444"
"a1_981" = "1695451372"
"a1_980" = "226301451"
"a1_988" = "154290499"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Aas]
"a1_855" = "1607194658"
"a3_655" = "383827462"
"a1_857" = "2075057157"
"a1_856" = "658638902"
"a1_851" = "85773236"
"a1_850" = "1812152157"
"a1_853" = "3217758075"
"a3_654" = "376767975"
"a1_859" = "3945582609"
"a3_657" = "431879896"
"a4_779" = "1289777963"
"a4_778" = "1282608842"
"a3_929" = "2381983272"
"a3_656" = "424825529"

[HKLM\SOFTWARE\Microsoft\Security Center]
"FirewallOverride" = "1"

[HKCU\Software\Aas]
"a4_771" = "1232424995"
"a3_651" = "388835458"
"a4_773" = "1246763237"
"a4_772" = "1239594116"
"a4_775" = "1261101479"
"a4_774" = "1253932358"
"a4_777" = "1275439721"
"a3_650" = "348370019"
"a3_653" = "369779012"
"a3_652" = "395889957"
"a4_151" = "1082537271"
"a4_150" = "1075368150"
"a4_153" = "1096875513"
"a4_152" = "1089706392"
"a4_155" = "1111213755"
"a4_154" = "1104044634"
"a4_157" = "1125551997"
"a4_156" = "1118382876"
"a4_159" = "1139890239"
"a4_158" = "1132721118"
"a1_185" = "1666048836"
"a1_184" = "2849919471"
"a1_183" = "1724016904"
"a1_182" = "3896798122"
"a1_181" = "1119191244"
"a1_180" = "3753028350"
"a1_963" = "2017533883"
"a4_559" = "4007538639"
"a4_558" = "4000369518"
"a4_555" = "3978862155"
"a4_554" = "3971693034"
"a4_557" = "3993200397"
"a4_556" = "3986031276"
"a4_551" = "3950185671"
"a4_550" = "3943016550"
"a4_553" = "3964523913"
"a4_552" = "3957354792"
"a1_753" = "1912730350"
"a1_801" = "1499798942"
"a4_824" = "1612388408"
"a4_393" = "2817464553"
"a4_392" = "2810295432"
"a4_391" = "2803126311"
"a4_390" = "2795957190"
"a4_397" = "2846141037"
"a4_396" = "2838971916"
"a4_395" = "2831802795"
"a4_394" = "2824633674"
"a4_399" = "2860479279"
"a4_398" = "2853310158"
"a4_865" = "1906322369"
"a4_864" = "1899153248"
"a4_867" = "1920660611"
"a1_932" = "4241416193"
"a4_866" = "1913491490"
"a1_933" = "3068416990"
"a4_861" = "1877645885"
"a3_758" = "1122262303"
"a4_860" = "1870476764"
"a1_931" = "3869970430"
"a4_863" = "1891984127"
"a1_936" = "2544439570"
"a4_862" = "1884815006"
"a1_937" = "3944000599"
"a2_405" = "2903495587"
"a2_404" = "2896326727"
"a2_407" = "2917830636"
"a2_406" = "2910661220"
"a2_401" = "2874810856"
"a2_400" = "2867644759"
"a2_403" = "2889162155"
"a2_402" = "2881992629"
"a1_935" = "3550523125"
"a2_409" = "2932163262"
"a2_408" = "2924993443"
"a2_975" = "2694928131"
"a2_974" = "2687759463"
"a2_977" = "2709261182"
"a2_976" = "2702093521"
"a2_971" = "2666241569"
"a2_970" = "2659074157"
"a2_973" = "2680591009"
"a4_896" = "2128565120"
"a2_979" = "2723610140"
"a2_978" = "2716429717"
"a1_222" = "3014506422"
"a1_223" = "3560250667"
"a1_220" = "405349907"
"a1_221" = "3316466425"
"a1_226" = "1926015080"
"a1_227" = "2636614972"
"a1_224" = "2425377455"
"a1_225" = "339277055"
"a1_228" = "1682339030"
"a1_229" = "3281799115"
"a2_579" = "4150923292"
"a2_578" = "4143759149"
"a2_571" = "4093573484"
"a2_570" = "4086393488"
"a2_573" = "4107908232"
"a2_572" = "4100746614"
"a2_575" = "4122236235"
"a2_574" = "4115074374"
"a2_577" = "4136575506"
"a2_576" = "4129407576"
"a2_351" = "2516367760"
"a2_350" = "2509188028"
"a2_353" = "2530705086"
"a2_352" = "2523536371"
"a2_355" = "2545034530"
"a2_354" = "2537870189"
"a2_357" = "2559370726"
"a2_356" = "2552205230"
"a2_359" = "2573720786"
"a2_358" = "2566538942"
"a3_906" = "2183550307"
"a3_622" = "147491207"
"a2_193" = "1383642839"
"a2_192" = "1376473637"
"a2_191" = "1369307320"
"a2_190" = "1362127170"
"a2_197" = "1412309934"
"a2_196" = "1405142950"
"a2_195" = "1397973673"
"a2_194" = "1390807966"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Aas]
"a3_624" = "195544665"
"a2_199" = "1426659639"
"a2_198" = "1419493019"
"a3_625" = "168917752"
"a2_759" = "1146388517"
"a3_626" = "175906587"
"a2_755" = "1117722516"
"a2_754" = "1110553125"
"a2_757" = "1132054732"
"a3_627" = "183481274"
"a2_751" = "1089039743"
"a2_750" = "1081881961"
"a2_753" = "1103387017"
"a2_752" = "1096205187"
"a1_536" = "564890466"
"a1_537" = "298596931"
"a1_534" = "3661569389"
"a1_535" = "3114600806"
"a1_89" = "1440555415"
"a1_88" = "205345638"
"a1_530" = "181074571"
"a1_531" = "3222388877"
"a1_85" = "104152931"
"a1_84" = "1358504833"
"a1_87" = "879514700"
"a1_86" = "168707265"
"a1_81" = "827760877"
"a1_80" = "1987744609"
"a1_83" = "3167800654"
"a1_82" = "1265175629"
"a3_914" = "2274560123"
"a2_898" = "2142899981"
"a1_896" = "1090370388"
"a1_890" = "1982838148"
"a2_899" = "2150079107"
"a1_67" = "358558393"
"a1_66" = "1596004615"
"a1_65" = "2228310974"
"a3_133" = "970345548"
"a1_63" = "3992027018"
"a3_135" = "950830350"
"a3_136" = "991836577"
"a1_60" = "24072052"
"a3_138" = "1006335587"
"a3_139" = "979823234"
"a3_684" = "625694981"
"a1_438" = "3596461119"
"a3_682" = "577634371"
"a3_683" = "584688866"
"a1_69" = "630532476"
"a1_68" = "3714804415"
"a3_228" = "1617824845"
"a3_229" = "1624875244"
"a3_224" = "1588903625"
"a3_225" = "1629901672"
"a3_226" = "1636956043"
"a3_227" = "1610836010"
"a3_220" = "1593911669"
"a3_221" = "1600966036"
"a3_222" = "1608410679"
"a3_223" = "1581849174"
"a1_408" = "13124597"
"a1_409" = "97118112"
"a1_402" = "2107682715"
"a1_403" = "1446502007"
"a1_400" = "2559793498"
"a1_401" = "907428542"
"a1_406" = "1239149586"
"a1_407" = "1765747593"
"a1_404" = "1672078248"
"a1_405" = "2254146360"
"a2_823" = "1605217722"
"a2_822" = "1598050452"
"a2_821" = "1590862012"
"a3_354" = "2521277451"
"a3_355" = "2528204970"
"a3_356" = "2568813773"
"a3_357" = "2576322924"
"a3_350" = "2492225207"
"a3_351" = "2499791574"
"a3_352" = "2540269385"
"a3_353" = "2547254248"
"a2_827" = "1633903953"
"a1_628" = "2357852634"
"a3_358" = "2583246223"
"a3_359" = "2556735022"
"a1_854" = "3519215323"
"a2_826" = "1626719019"
"a2_825" = "1619552102"
"a1_718" = "1433086033"
"a1_719" = "1055643377"
"a1_716" = "451446686"
"a1_717" = "2699533587"
"a1_714" = "4210963605"
"a1_715" = "2757404245"
"a1_712" = "4208655873"
"a1_713" = "2890754784"
"a1_710" = "1330812879"
"a1_711" = "3977903202"
"a4_809" = "1504851593"
"a4_808" = "1497682472"
"a4_803" = "1461836867"
"a1_629" = "765298155"
"a4_801" = "1447498625"
"a4_800" = "1440329504"
"a4_807" = "1490513351"
"a4_806" = "1483344230"
"a4_805" = "1476175109"
"a4_804" = "1469005988"
"a4_37" = "265257477"
"a4_36" = "258088356"
"a4_35" = "250919235"
"a4_34" = "243750114"
"a4_33" = "236580993"
"a4_32" = "229411872"
"a4_31" = "222242751"
"a4_30" = "215073630"
"a4_144" = "1032353424"
"a4_39" = "279595719"
"a4_38" = "272426598"
"a3_915" = "2281614490"
"a4_843" = "1748601707"
"a3_142" = "1034864615"
"a4_946" = "2487021170"
"a4_947" = "2494190291"
"a4_944" = "2472682928"
"a4_945" = "2479852049"
"a4_942" = "2458344686"
"a4_943" = "2465513807"
"a4_940" = "2444006444"
"a4_941" = "2451175565"
"a4_948" = "2501359412"

[HKCU\Software\Aas\695404737]
"28676484" = "35"

[HKCU\Software\Aas]
"a4_498" = "3570222258"
"a4_499" = "3577391379"
"a4_494" = "3541545774"
"a4_495" = "3548714895"
"a4_496" = "3555884016"
"a4_497" = "3563053137"
"a4_490" = "3512869290"
"a4_491" = "3520038411"
"a4_492" = "3527207532"
"a4_493" = "3534376653"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012015011920150120]
"CachePath" = "%USERPROFILE%\Local Settings\History\History.IE5\MSHist012015011920150120\"

[HKCU\Software\Aas]
"a3_448" = "3194799081"
"a3_449" = "3202245640"
"a2_941" = "2451169290"
"a4_708" = "780770372"
"a4_709" = "787939493"
"a3_918" = "2303105535"
"a3_919" = "2310025758"
"a4_704" = "752093888"
"a4_705" = "759263009"
"a4_706" = "766432130"
"a4_707" = "773601251"

[HKLM\SOFTWARE\Microsoft\Security Center\Svc]
"UacDisableNotify" = "1"

[HKCU\Software\Aas]
"a4_701" = "730586525"
"a4_702" = "737755646"
"a4_703" = "744924767"
"a1_888" = "1412519510"
"a1_889" = "517626723"
"a1_886" = "1248348911"
"a1_887" = "1494461352"
"a1_884" = "3283735211"
"a1_885" = "41334507"
"a1_882" = "3361098993"
"a1_883" = "384410294"
"a1_880" = "1411365659"
"a1_881" = "1966738601"
"a4_124" = "888971004"
"a4_125" = "896140125"
"a4_126" = "903309246"
"a4_127" = "910478367"
"a4_120" = "860294520"
"a4_121" = "867463641"
"a4_122" = "874632762"
"a4_123" = "881801883"
"a4_128" = "917647488"
"a4_129" = "924816609"
"a2_593" = "4251292286"
"a3_444" = "3166269973"
"a3_445" = "3206813364"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKCU\Software\Aas]
"a1_831" = "717292194"
"a2_592" = "4244127221"
"a1_930" = "4164462101"
"a1_948" = "3713642093"
"a4_238" = "1706250798"
"a4_239" = "1713419919"
"a4_230" = "1648897830"
"a4_231" = "1656066951"
"a4_232" = "1663236072"
"a4_233" = "1670405193"
"a4_234" = "1677574314"
"a4_235" = "1684743435"
"a4_236" = "1691912556"
"a4_237" = "1699081677"
"a1_480" = "1218963422"
"a1_723" = "2106846285"
"a1_722" = "131817391"
"a1_721" = "1883291182"
"a1_720" = "3115081423"
"a1_768" = "2805261087"
"a1_727" = "95345854"
"a1_726" = "808788815"
"a2_643" = "314784988"
"a2_790" = "1368644300"
"a1_725" = "782283878"
"a2_642" = "307604946"
"a1_724" = "2283848938"
"a2_641" = "300447024"
"a2_640" = "293267607"
"a2_647" = "343452356"
"a2_646" = "336287324"
"a1_158" = "3522083438"
"a1_159" = "1780328067"
"a2_645" = "329120579"
"a1_150" = "2513558637"
"a1_151" = "3531435517"
"a1_152" = "904151116"
"a1_153" = "2014944437"
"a1_154" = "1790308836"
"a1_155" = "4056558605"
"a1_156" = "1286926926"
"a1_157" = "1856044478"
"a1_235" = "2255389406"
"a1_234" = "916326932"
"a1_237" = "1072840313"
"a1_236" = "1523833302"
"a1_231" = "941072705"
"a1_230" = "2001340994"
"a1_233" = "1865242215"
"a1_232" = "3312239932"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 16 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\Aas]
"a1_239" = "2436418240"
"a1_238" = "3180231162"
"a2_210" = "1505512949"
"a2_211" = "1512678929"
"a2_212" = "1519861203"
"a2_213" = "1527029578"
"a2_214" = "1534194687"
"a2_215" = "1541362925"
"a2_216" = "1548521993"
"a2_217" = "1555697594"
"a2_218" = "1562864909"
"a2_219" = "1570030200"
"a1_966" = "1229198010"
"a2_508" = "3641911711"
"a2_509" = "3649058396"
"a2_504" = "3613230946"
"a2_505" = "3620411554"
"a2_506" = "3627581197"
"a2_507" = "3634752808"
"a2_500" = "3584569179"
"a2_501" = "3591726762"
"a2_502" = "3598906651"
"a2_503" = "3606059077"
"a2_791" = "1375813035"
"a2_698" = "709078291"
"a2_699" = "716245636"
"a2_694" = "680396250"
"a2_695" = "687578196"
"a2_696" = "694732725"
"a2_697" = "701913222"
"a2_690" = "651726992"
"a2_691" = "658887705"
"a2_692" = "666062799"
"a2_693" = "673225028"
"a2_324" = "2322798202"
"a2_325" = "2329966288"
"a2_326" = "2337131241"
"a2_327" = "2344300229"
"a2_320" = "2294110867"
"a2_321" = "2301280846"
"a2_322" = "2308463189"
"a2_323" = "2315617508"
"a1_521" = "73775378"
"a1_520" = "3225287606"
"a1_523" = "2858190949"
"a1_522" = "413690267"
"a2_328" = "2351465297"
"a2_329" = "2358647311"
"a1_527" = "1269982402"
"a1_526" = "4053218385"
"a2_799" = "1433163554"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKCU\Software\Aas]
"a2_798" = "1425997227"
"a4_962" = "2601727106"
"a1_98" = "1073700933"
"a1_99" = "2941455322"
"a1_92" = "248010648"
"a1_93" = "2122564942"
"a1_90" = "1219232164"
"a1_91" = "3412361535"
"a1_96" = "3061872965"
"a1_97" = "2293963386"
"a1_94" = "2997040932"
"a1_95" = "336054593"
"a1_74" = "756404406"
"a1_75" = "2788921015"
"a1_76" = "1065972639"
"a1_77" = "2772272871"
"a1_70" = "2263858160"
"a1_71" = "4165310906"
"a1_72" = "1425414161"
"a1_73" = "3311343798"
"a3_699" = "733118194"
"a3_698" = "725670483"
"a3_129" = "907869896"
"a3_128" = "934369961"
"a1_78" = "3449121311"
"a1_79" = "2784370483"
"a3_239" = "1730403494"
"a3_238" = "1689270279"
"a3_237" = "1682343908"
"a3_236" = "1708909381"
"a3_235" = "1701334818"
"a3_234" = "1660856963"
"a3_233" = "1653814880"
"a3_232" = "1646370241"
"a3_231" = "1672935854"
"a3_230" = "1665877263"
"a1_419" = "3913240228"
"a1_418" = "1015478843"
"a3_953" = "2520368944"
"a1_415" = "299362671"
"a1_414" = "1994718106"
"a1_417" = "2684568660"
"a1_416" = "945864962"
"a1_411" = "191654604"
"a1_410" = "1695485156"
"a1_413" = "3001976872"
"a1_412" = "1456048135"
"a3_939" = "2419869154"
"a3_347" = "2504287570"
"a3_346" = "2463809843"
"a3_345" = "2456759440"
"a3_344" = "2482866289"
"a3_343" = "2475825118"
"a3_342" = "2468836287"
"a3_341" = "2427838236"
"a3_340" = "2420783869"
"a3_349" = "2485301780"
"a3_348" = "2511804917"
"a1_701" = "840123330"
"a1_700" = "3076509167"
"a1_703" = "607186206"
"a1_702" = "1597704496"
"a1_705" = "251214998"
"a1_704" = "470494661"
"a1_707" = "1106817424"
"a1_706" = "1887638588"
"a1_709" = "599619068"
"a1_708" = "2762527738"
"a2_360" = "2580889478"
"a4_838" = "1712756102"
"a2_361" = "2588056424"
"a4_836" = "1698417860"
"a4_837" = "1705586981"
"a4_834" = "1684079618"
"a4_835" = "1691248739"
"a4_832" = "1669741376"
"a2_362" = "2595220609"
"a4_830" = "1655403134"
"a4_831" = "1662572255"
"a4_24" = "172058904"
"a4_25" = "179228025"
"a4_26" = "186397146"
"a4_27" = "193566267"
"a4_20" = "143382420"
"a4_21" = "150551541"
"a4_22" = "157720662"
"a4_23" = "164889783"
"a4_951" = "2522866775"
"a2_364" = "2609553652"
"a4_953" = "2537205017"
"a4_952" = "2530035896"
"a4_28" = "200735388"
"a4_29" = "207904509"
"a4_957" = "2565881501"
"a2_365" = "2616723416"
"a2_366" = "2623901714"
"a2_367" = "2631070024"
"a1_743" = "174430646"
"a2_168" = "1204405518"
"a2_169" = "1211585224"
"a4_847" = "1777278191"
"a4_489" = "3505700169"
"a4_488" = "3498531048"
"a4_487" = "3491361927"
"a4_486" = "3484192806"
"a4_485" = "3477023685"
"a4_484" = "3469854564"
"a4_483" = "3462685443"
"a4_482" = "3455516322"
"a4_481" = "3448347201"
"a4_480" = "3441178080"
"a2_160" = "1147053909"
"a4_973" = "2680587437"
"a2_161" = "1154234678"
"a4_977" = "2709263921"
"a4_972" = "2673418316"
"a4_971" = "2666249195"
"a3_901" = "2147558220"
"a3_900" = "2174193453"
"a3_903" = "2162063374"
"a3_902" = "2154612719"
"a3_905" = "2209657024"
"a3_904" = "2202606753"
"a4_719" = "859630703"
"a4_718" = "852461582"
"a4_717" = "845292461"
"a4_716" = "838123340"
"a4_715" = "830954219"
"a4_714" = "823785098"
"a4_713" = "816615977"
"a4_712" = "809446856"
"a4_711" = "802277735"
"a4_710" = "795108614"
"a1_891" = "3264058026"
"a3_776" = "1251683361"
"a1_893" = "2513067016"
"a1_892" = "1628570083"
"a1_895" = "1889642159"
"a1_894" = "2321390599"
"a1_897" = "512525247"
"a3_777" = "1292288064"
"a1_899" = "1964372478"
"a1_898" = "1068855579"
"a4_974" = "2687756558"
"a3_774" = "1270749039"
"a4_137" = "982169577"
"a4_136" = "975000456"
"a4_135" = "967831335"
"a4_134" = "960662214"
"a4_133" = "953493093"
"a4_132" = "946323972"
"a4_131" = "939154851"
"a4_130" = "931985730"
"a3_772" = "1222762157"
"a4_139" = "996507819"
"a4_138" = "989338698"
"a4_975" = "2694925679"
"a3_770" = "1208254955"
"a3_771" = "1215707658"
"a2_455" = "3261952362"
"a1_617" = "647683303"

[HKCU\Software\Softonic\Universal Downloader]
"uuid" = "ED284C48-BEE8-43E5-ADF1-A8C43C9909D3"

[HKCU\Software\Aas]
"a4_229" = "1641728709"
"a4_228" = "1634559588"
"a4_223" = "1598713983"
"a4_222" = "1591544862"
"a4_221" = "1584375741"
"a4_220" = "1577206620"
"a4_227" = "1627390467"
"a4_226" = "1620221346"
"a4_225" = "1613052225"
"a4_224" = "1605883104"
"a1_615" = "3799022525"
"a2_459" = "3290621852"
"a3_678" = "548713167"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012015011920150120]
"CachePrefix" = ":2015011920150120:"

[HKCU\Software\Aas]
"a1_614" = "2738725622"
"a1_820" = "3543268578"
"a1_821" = "2149979468"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Aas]
"a1_822" = "1344896621"

"a1_149" = "259343148"
"a1_148" = "80761054"
"a1_143" = "3881493139"
"a1_142" = "1835305408"
"a1_141" = "2879624116"
"a1_140" = "3013979314"
"a1_147" = "3475947273"
"a1_146" = "579283099"
"a1_145" = "2698178853"
"a1_144" = "3678532585"
"a1_826" = "2314011974"
"a1_827" = "569020385"
"a2_203" = "1455329098"
"a2_202" = "1448159581"
"a2_201" = "1440991730"
"a2_200" = "1433825813"
"a2_207" = "1484012643"
"a2_206" = "1476844524"
"a2_205" = "1469675991"
"a2_204" = "1462495963"
"a2_209" = "1498344107"
"a2_208" = "1491178943"
"a2_519" = "3720780475"
"a2_518" = "3713613675"
"a2_517" = "3706430095"
"a2_516" = "3699265393"
"a2_515" = "3692099016"
"a2_514" = "3684933089"
"a2_513" = "3677765093"
"a2_512" = "3670596384"
"a2_511" = "3663413889"
"a2_510" = "3656247213"
"a2_689" = "644560770"
"a2_688" = "637391844"
"a2_687" = "630226931"
"a2_686" = "623043673"
"a2_685" = "615878488"
"a2_684" = "608709655"
"a2_683" = "601517604"
"a2_682" = "594366232"
"a2_681" = "587207166"
"a2_680" = "580027295"
"a2_337" = "2415985186"
"a2_336" = "2408819437"
"a2_335" = "2401651886"
"a2_334" = "2394482733"
"a2_333" = "2387313697"
"a2_332" = "2380148782"
"a2_331" = "2372984450"
"a2_330" = "2365816163"
"a1_554" = "3988121925"
"a1_555" = "3805544697"
"a1_556" = "45216727"
"a1_557" = "455842649"
"a3_242" = "1718323611"
"a1_551" = "1154714125"
"a2_339" = "2430333475"
"a2_338" = "2423165065"
"a4_673" = "529851137"
"a1_918" = "2894956672"
"a1_919" = "550442633"
"a3_243" = "1725243962"
"a1_852" = "419000986"
"a1_914" = "1606816783"
"a1_398" = "338918547"
"a1_399" = "2086880401"
"a4_679" = "572865863"
"a1_392" = "3179889972"
"a1_393" = "4252851773"
"a1_390" = "4045475992"
"a1_391" = "3684209506"
"a1_396" = "2274139441"
"a1_397" = "2013061653"
"a1_394" = "1561442719"
"a1_395" = "4159937021"
"a1_858" = "4137191621"
"a3_116" = "814879197"
"a3_117" = "821922428"
"a3_114" = "834001179"
"a3_115" = "807894458"
"a3_112" = "785940569"
"a3_113" = "826942712"
"a3_110" = "771902343"
"a3_111" = "778955814"
"a1_49" = "2035923604"
"a1_48" = "620542350"
"a3_554" = "3988280259"
"a3_118" = "862924447"
"a3_119" = "869974846"
"a3_202" = "1465015971"
"a3_203" = "1472066242"
"a3_200" = "1416954337"
"a3_201" = "1424013824"
"a3_206" = "1493543975"
"a3_207" = "1500987462"
"a3_204" = "1445500773"
"a3_205" = "1452936068"
"a1_197" = "2081863676"
"a3_759" = "1163391422"
"a3_208" = "1508041977"
"a3_209" = "1481480472"
"a3_592" = "4261104249"
"a3_593" = "4234604184"
"a3_590" = "4246617511"
"a3_591" = "4253667782"
"a3_596" = "4289649661"
"a3_597" = "4263017500"
"a3_594" = "4241589051"
"a3_595" = "4282591066"
"a3_598" = "4270526655"
"a3_599" = "4277581022"
"a4_848" = "1784447312"
"a3_578" = "4160735531"
"a3_579" = "4134104394"
"a4_770" = "1225255874"
"a3_570" = "4069660115"
"a3_571" = "4076703346"
"a3_572" = "4117701269"
"a3_573" = "4124755764"
"a3_574" = "4098128727"
"a3_575" = "4105641974"
"a3_576" = "4146245737"
"a3_577" = "4153169032"
"a1_774" = "154183291"
"a1_775" = "1094961918"
"a1_776" = "329627493"
"a1_777" = "3288455476"
"a1_191" = "1165667823"
"a1_771" = "2307139929"
"a1_772" = "2783317073"
"a1_773" = "1867192719"
"a1_953" = "719458370"
"a3_927" = "2367492374"
"a1_778" = "2920290707"
"a1_779" = "3990986978"
"a3_926" = "2326953207"
"a2_17" = "121876868"
"a2_16" = "114708990"
"a2_15" = "107542671"
"a2_14" = "100360141"
"a2_13" = "93193784"
"a2_12" = "86027631"
"a2_11" = "78860045"
"a2_10" = "71684041"
"a4_829" = "1648234013"
"a4_828" = "1641064892"
"a4_776" = "1268270600"
"a1_592" = "862837118"
"a2_19" = "136211058"
"a2_18" = "129045809"
"a4_11" = "78860331"
"a4_10" = "71691210"
"a4_13" = "93198573"
"a4_12" = "86029452"
"a4_15" = "107536815"
"a4_14" = "100367694"
"a4_17" = "121875057"
"a4_16" = "114705936"
"a4_19" = "136213299"
"a4_18" = "129044178"
"a4_926" = "2343638750"
"a4_927" = "2350807871"
"a1_878" = "1042384049"
"a4_921" = "2307793145"
"a4_922" = "2314962266"
"a1_595" = "1805848777"
"a1_596" = "3952274030"
"a4_987" = "2780955131"
"a1_597" = "3407296810"
"a1_608" = "1550060110"
"a1_609" = "886680944"
"a3_378" = "2693094675"
"a3_379" = "2700145074"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

[HKCU\Software\Aas]
"a4_846" = "1770109070"
"a3_372" = "2683746013"
"a3_373" = "2657102716"
"a3_370" = "2669182491"
"a3_371" = "2676691642"
"a3_376" = "2712142929"
"a3_377" = "2686171376"
"a3_374" = "2664681375"
"a3_375" = "2705154110"
"a1_759" = "3899446746"
"a3_488" = "3515101889"
"a3_489" = "3522680672"
"a4_841" = "1734263465"
"a4_840" = "1727094344"
"a1_950" = "1561392809"
"a3_484" = "3486690637"
"a1_952" = "463480214"
"a2_925" = "2336468886"
"a1_954" = "3783550773"
"a1_955" = "3010105209"
"a1_956" = "4044319585"
"a3_485" = "3460055532"
"a1_958" = "909601999"
"a2_922" = "2314967061"
"a1_750" = "1736655078"
"a1_751" = "1603281620"
"a1_756" = "3250419206"
"a1_757" = "2173083275"
"a4_722" = "881138066"
"a4_723" = "888307187"
"a4_720" = "866799824"
"a1_661" = "3984261932"
"a4_726" = "909814550"
"a4_727" = "916983671"
"a4_724" = "895476308"
"a4_725" = "902645429"
"a4_728" = "924152792"
"a4_729" = "931321913"
"a3_978" = "2699694267"
"a3_979" = "2740303066"
"a3_127" = "927442486"
"a1_189" = "3547030694"
"a4_903" = "2178748967"
"a1_188" = "3458361734"
"a4_900" = "2157241604"
"a1_187" = "2064349799"
"a4_901" = "2164410725"
"a1_186" = "4268885801"
"a2_929" = "2365152792"
"a4_905" = "2193087209"
"a4_586" = "4201104906"
"a4_587" = "4208274027"
"a4_584" = "4186766664"
"a4_585" = "4193935785"
"a4_582" = "4172428422"
"a4_583" = "4179597543"
"a4_580" = "4158090180"
"a4_581" = "4165259301"
"a3_800" = "1423623433"
"a3_801" = "1464105384"
"a3_802" = "1471618507"
"a3_803" = "1445115498"
"a3_804" = "1452026509"
"a3_805" = "1459605292"
"a4_588" = "4215443148"
"a4_589" = "4222612269"
"a3_645" = "312377932"
"a4_909" = "2221763693"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced]
"Hidden" = "2"

[HKCU\Software\Aas]
"a4_966" = "2630403590"
"a4_218" = "1562868378"
"a4_219" = "1570037499"
"a4_216" = "1548530136"
"a4_217" = "1555699257"
"a4_214" = "1534191894"
"a4_215" = "1541361015"
"a4_212" = "1519853652"
"a4_213" = "1527022773"
"a4_210" = "1505515410"
"a4_211" = "1512684531"
"a4_458" = "3283457418"
"a4_459" = "3290626539"
"a4_108" = "774265068"
"a4_109" = "781434189"
"a1_843" = "12703964"
"a4_102" = "731250342"
"a4_103" = "738419463"
"a4_100" = "716912100"
"a4_101" = "724081221"
"a4_106" = "759926826"
"a4_107" = "767095947"
"a4_104" = "745588584"
"a4_105" = "752757705"
"a1_605" = "2278125709"
"a1_558" = "1976651041"
"a1_559" = "337686276"
"a1_606" = "4143255857"
"a3_925" = "2319505492"
"a1_178" = "149887163"
"a1_179" = "1501720584"
"a1_176" = "1139203045"
"a1_177" = "2467015571"
"a1_174" = "3288903637"
"a1_175" = "3191120657"
"a1_172" = "2540064626"
"a1_173" = "1665024763"
"a1_170" = "2982213127"
"a1_171" = "3568873107"
"a1_550" = "3656263491"
"a2_236" = "1691914423"
"a2_237" = "1699083352"
"a2_234" = "1677580652"
"a2_235" = "1684748717"
"a2_232" = "1663230485"
"a2_233" = "1670399134"
"a2_230" = "1648899385"
"a2_231" = "1656064864"
"a1_553" = "2249354298"
"a2_238" = "1706248395"
"a2_239" = "1713418057"
"a2_522" = "3742283741"
"a2_523" = "3749448684"
"a2_520" = "3727935357"
"a2_521" = "3735120150"
"a2_526" = "3770950372"
"a2_527" = "3778132096"
"a2_524" = "3756616355"
"a2_525" = "3763796185"
"a2_838" = "1712751281"
"a2_839" = "1719920567"
"a2_528" = "3785298850"
"a2_529" = "3792466422"
"a3_688" = "620670617"
"a1_626" = "550491419"
"a1_627" = "2548618390"
"a1_624" = "353980455"
"a1_549" = "2533829194"
"a1_548" = "622981373"
"a1_547" = "1764622614"
"a1_546" = "4243771484"
"a1_545" = "2869717832"
"a1_544" = "3720270462"
"a1_543" = "2955116545"
"a1_542" = "3512227315"
"a1_541" = "335244867"
"a1_540" = "1893290985"
"a2_658" = "422321140"
"a2_659" = "429488397"
"a2_308" = "2208098197"
"a2_309" = "2215250722"
"a2_302" = "2165077176"
"a2_303" = "2172246918"
"a2_300" = "2150728806"
"a2_301" = "2157913946"
"a2_306" = "2193741877"
"a2_307" = "2200904360"
"a2_304" = "2179409660"
"a2_305" = "2186578680"
"a2_786" = "1339959629"
"a2_787" = "1347128728"
"a2_784" = "1325626099"
"a2_785" = "1332793498"
"a2_782" = "1311291758"
"a2_783" = "1318463131"
"a2_780" = "1296941798"
"a2_781" = "1304109773"
"a2_788" = "1354293823"
"a2_789" = "1361476415"
"a1_389" = "549318107"
"a1_388" = "737723864"
"a1_385" = "3127769013"
"a1_384" = "2360557389"
"a1_387" = "1185165446"
"a1_386" = "3521310483"
"a1_381" = "1960122386"
"a1_380" = "2968464977"
"a1_383" = "2088552361"
"a1_382" = "3588319695"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKCU\Software\Aas]
"a1_58" = "2489977764"
"a1_59" = "179788263"
"a1_56" = "2402126980"
"a1_57" = "1260902225"
"a1_54" = "1377764143"
"a1_55" = "3988406687"
"a1_52" = "2124199322"
"a1_53" = "3895852867"
"a1_50" = "974197664"
"a1_51" = "2894962461"
"a3_215" = "1524377438"
"a3_214" = "1517454143"
"a3_217" = "1572437008"
"a3_216" = "1565514737"
"a3_211" = "1529532890"
"a3_210" = "1488928187"
"a3_213" = "1510469276"
"a3_212" = "1536445053"
"a1_616" = "348095252"
"a3_748" = "1050812741"
"a3_219" = "1553446098"
"a3_218" = "1545867443"
"a3_585" = "4177070976"
"a3_584" = "4170159969"
"a3_587" = "4225122370"
"a3_586" = "4217678883"
"a3_581" = "4182227468"
"a3_580" = "4141089261"
"a3_583" = "4162646734"
"a3_582" = "4189150895"
"a3_589" = "4205615364"
"a3_588" = "4198622437"
"a3_893" = "2090093684"
"a3_569" = "4062671280"
"a3_568" = "4088782097"
"a3_563" = "4052790138"
"a3_562" = "4045747931"
"a3_561" = "4005270200"
"a3_560" = "3997761049"
"a3_567" = "4081727742"
"a3_566" = "4040721503"
"a3_565" = "4033732668"
"a3_564" = "4026683293"
"a3_109" = "798021476"
"a3_108" = "790966981"
"a1_765" = "337964899"
"a1_764" = "3622222117"

"a1_762" = "2973735437"
"a1_761" = "1602621462"
"a3_724" = "878479485"
"a3_101" = "707522668"
"a3_100" = "733503437"
"a3_103" = "754977070"
"a3_102" = "714511503"
"a3_105" = "769475040"
"a3_104" = "762555713"
"a3_107" = "750493346"
"a3_106" = "742980099"
"a4_854" = "1827462038"
"a4_855" = "1834631159"
"a4_856" = "1841800280"
"a3_726" = "926531903"
"a4_850" = "1798785554"
"a4_851" = "1805954675"
"a4_852" = "1813123796"
"a4_853" = "1820292917"
"a3_721" = "890560280"
"a2_914" = "2257614709"
"a4_858" = "1856138522"
"a1_586" = "853610587"
"a1_789" = "3404293227"
"a3_720" = "849951481"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Aas]
"a3_898" = "2126083691"
"a3_723" = "904992730"
"a4_939" = "2436837323"
"a4_938" = "2429668202"
"a4_937" = "2422499081"
"a4_936" = "2415329960"
"a4_935" = "2408160839"
"a3_722" = "898003899"
"a4_933" = "2393822597"
"a4_932" = "2386653476"
"a4_931" = "2379484355"
"a4_930" = "2372315234"
"a3_955" = "2568364018"
"a1_788" = "2507578074"
"a1_619" = "1225887662"
"a1_618" = "691824502"
"a3_369" = "2628699640"
"a3_368" = "2621645145"
"a3_365" = "2600170596"
"a3_364" = "2592723909"
"a3_367" = "2647756070"
"a3_366" = "2640767111"
"a3_361" = "2604787424"
"a3_360" = "2564178497"
"a3_363" = "2585673634"
"a3_362" = "2611780355"
"a4_520" = "3727942920"
"a4_521" = "3735112041"
"a1_584" = "2387585939"
"a4_522" = "3742281162"
"a2_62" = "444485970"
"a4_523" = "3749450283"
"a2_63" = "451651368"
"a4_524" = "3756619404"
"a1_971" = "1333308978"
"a2_60" = "430151916"
"a4_525" = "3763788525"
"a1_943" = "3330817074"
"a1_942" = "3872288192"
"a1_941" = "2832542020"
"a2_61" = "437321146"
"a1_947" = "1365665869"
"a4_526" = "3770957646"
"a1_945" = "4140025422"
"a1_944" = "774602616"
"a2_66" = "473154095"
"a1_949" = "1157377422"
"a4_527" = "3778126767"
"a2_67" = "480337913"
"a2_64" = "458818671"
"a2_65" = "465984565"
"a4_735" = "974336639"
"a4_734" = "967167518"
"a4_737" = "988674881"
"a4_736" = "981505760"
"a4_731" = "945660155"
"a4_730" = "938491034"
"a4_733" = "959998397"
"a4_732" = "952829276"
"a4_739" = "1003013123"
"a4_738" = "995844002"
"a3_969" = "2668861696"
"a3_968" = "2627790049"
"a4_599" = "4294303479"
"a4_598" = "4287134358"
"a1_782" = "3407824530"
"a4_591" = "4236950511"
"a4_590" = "4229781390"
"a4_593" = "4251288753"
"a4_592" = "4244119632"
"a4_595" = "4265626995"
"a4_594" = "4258457874"
"a4_597" = "4279965237"
"a4_596" = "4272796116"
"a1_786" = "2100620279"
"a1_41" = "1340960735"
"a1_40" = "986688422"
"a1_43" = "3696863492"
"a3_819" = "1559971962"
"a1_42" = "2295151541"
"a3_813" = "1516544548"
"a1_45" = "2765510006"
"a3_811" = "1536136546"
"a3_810" = "1528623299"
"a3_817" = "1545483192"
"a3_816" = "1571594009"
"a3_815" = "1564605158"
"a1_44" = "1216098801"
"a1_47" = "37389310"
"a1_46" = "3137532983"
"a4_201" = "1440993321"
"a4_200" = "1433824200"
"a4_203" = "1455331563"
"a4_202" = "1448162442"
"a4_205" = "1469669805"
"a4_204" = "1462500684"
"a4_207" = "1484008047"
"a4_206" = "1476838926"
"a4_209" = "1498346289"
"a4_208" = "1491177168"
"a4_823" = "1605219287"
"a4_449" = "3218935329"
"a4_448" = "3211766208"
"a4_119" = "853125399"
"a4_118" = "845956278"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\Aas]
"a4_115" = "824448915"
"a4_114" = "817279794"
"a4_117" = "838787157"
"a4_116" = "831618036"
"a4_111" = "795772431"
"a4_110" = "788603310"
"a4_113" = "810110673"
"a4_112" = "802941552"
"a4_924" = "2329300508"
"a4_565" = "4050553365"
"a3_750" = "1098874375"
"a3_751" = "1105859238"
"a3_752" = "1079359193"
"a3_753" = "1086794616"
"a4_566" = "4057722486"
"a3_921" = "2290961104"
"a3_754" = "1127403419"
"a4_879" = "2006690063"
"a3_725" = "885927068"
"a3_755" = "1134321722"
"a3_756" = "1108280413"
"a1_783" = "2875452155"
"a3_757" = "1115339004"
"a1_959" = "4217331970"
"a2_907" = "2207429642"
"a1_161" = "3368685144"
"a1_160" = "2112783350"
"a1_163" = "3959676823"
"a1_162" = "3220501311"
"a1_165" = "3156633932"
"a1_164" = "676094218"
"a1_167" = "2531554958"
"a1_166" = "3724316730"
"a1_169" = "417882807"
"a1_168" = "2872552693"
"a3_727" = "933979486"
"a2_535" = "3835485595"
"a2_534" = "3828317136"
"a2_537" = "3849826290"
"a2_536" = "3842653525"
"a2_531" = "3806798189"
"a2_530" = "3799633045"
"a2_533" = "3821135852"
"a2_532" = "3813966587"
"a2_829" = "1648235286"
"a2_828" = "1641068203"
"a2_539" = "3864165142"
"a2_538" = "3856978913"
"a4_447" = "3204597087"
"a1_572" = "212284270"
"a1_573" = "2680144259"
"a1_570" = "1374001734"
"a1_571" = "2614912021"
"a1_576" = "1952894717"
"a1_577" = "2562479607"
"a1_574" = "3621482504"
"a1_575" = "1407598613"
"a1_578" = "3200996693"
"a1_579" = "3725983169"
"a2_649" = "357787346"
"a2_648" = "350621151"
"a2_319" = "2286946612"
"a2_318" = "2279777714"
"a2_315" = "2258279766"
"a2_314" = "2251096798"
"a2_317" = "2272612832"
"a2_316" = "2265447635"
"a2_311" = "2229596039"
"a2_310" = "2222429357"
"a2_313" = "2243931419"
"a2_312" = "2236763045"
"a2_229" = "1641736366"
"a2_228" = "1634565389"
"a2_221" = "1584378406"
"a2_220" = "1577212779"
"a2_223" = "1598712157"
"a2_222" = "1591548217"
"a2_225" = "1613046462"
"a2_224" = "1605878880"
"a2_227" = "1627396014"
"a2_226" = "1620213963"
"a1_370" = "3832467871"
"a1_371" = "1490931138"
"a1_372" = "3736613219"
"a1_373" = "262175007"
"a1_374" = "650015471"
"a1_375" = "2716629592"
"a1_376" = "3665370149"
"a1_377" = "417811228"
"a1_378" = "2894079203"
"a1_379" = "4264985383"
"a2_793" = "1390145430"
"a2_792" = "1382978946"
"a2_795" = "1404481479"
"a2_794" = "1397322766"
"a2_797" = "1418829560"
"a2_796" = "1411646529"
"a3_36" = "241268621"
"a3_37" = "248309804"
"a3_183" = "1328655230"
"a1_29" = "3160732807"
"a1_28" = "388163416"
"a1_590" = "521843123"
"a1_23" = "4177723916"
"a1_22" = "4209808514"
"a1_21" = "2881998396"
"a1_20" = "2886386725"
"a1_27" = "1356178931"
"a1_26" = "2471383188"
"a1_25" = "3401512759"
"a1_24" = "2472158293"
"a1_284" = "2959989193"
"a1_285" = "4073278783"
"a1_286" = "2168954177"
"a1_287" = "1079100173"
"a1_280" = "619814990"
"a1_281" = "3137450056"
"a1_282" = "3114512808"
"a1_283" = "435404933"
"a3_31" = "205278614"
"a1_288" = "1455469466"
"a1_289" = "2527931095"
"a3_778" = "1299211491"
"a3_779" = "1306728706"
"a2_903" = "2178746508"
"a1_591" = "2285152853"
"a3_32" = "212854281"
"a2_972" = "2673425579"
"a3_558" = "4017332551"
"a3_559" = "4024255974"
"a3_556" = "3969214597"
"a3_557" = "4009757988"
"a1_552" = "2854255951"
"a3_555" = "3962303586"
"a3_552" = "3940752129"
"a3_553" = "3981361056"
"a3_550" = "3926311503"
"a3_551" = "3933234926"
"a1_598" = "1792547808"
"a1_599" = "2075793324"
"a3_178" = "1292673371"
"a3_179" = "1300121082"
"a3_174" = "1264145351"
"a3_175" = "1271198822"
"a3_176" = "1245079705"
"a3_177" = "1252068664"
"a3_170" = "1235731011"
"a3_171" = "1209100002"
"a3_172" = "1216092933"
"a3_173" = "1223671716"
"a2_31" = "222234220"
"a2_30" = "215079233"
"a2_33" = "236580302"
"a2_32" = "229413713"
"a2_35" = "250916819"
"a2_34" = "243758149"
"a2_37" = "265263340"
"a2_36" = "258082039"
"a2_39" = "279604994"
"a2_38" = "272431211"
"a3_486" = "3467639311"
"a3_487" = "3508182702"
"a3_480" = "3424608201"
"a3_481" = "3431657576"
"a3_482" = "3438646411"
"a3_483" = "3479636266"
"a4_902" = "2171579846"
"a2_584" = "4186759481"
"a4_79" = "566360559"
"a4_78" = "559191438"
"a4_906" = "2200256330"
"a4_907" = "2207425451"
"a4_904" = "2185918088"
"a2_585" = "4193940734"
"a4_73" = "523345833"
"a4_72" = "516176712"
"a4_71" = "509007591"
"a4_70" = "501838470"
"a4_77" = "552022317"
"a4_76" = "544853196"
"a4_75" = "537684075"
"a4_74" = "530514954"
"a3_642" = "324456811"
"a3_390" = "2812641775"
"a3_391" = "2786540046"
"a3_392" = "2793594529"
"a3_393" = "2800513728"
"a3_394" = "2841581411"
"a3_395" = "2848623490"
"a3_396" = "2821991461"
"a3_397" = "2829566020"
"a3_398" = "2870043879"
"a3_399" = "2877036806"
"a1_529" = "2450563108"
"a1_625" = "2195481228"
"a1_622" = "2226211041"
"a1_623" = "3988759481"
"a1_620" = "739185907"
"a1_621" = "3622292087"
"a3_643" = "331380106"

[HKCU\Software\Aas\695404737]
"7169121" = "218"

[HKCU\Software\Aas]
"a3_958" = "2556348631"
"a3_959" = "2563272054"
"a1_528" = "2199692716"
"a2_588" = "4215445360"
"a3_950" = "2498827743"
"a3_951" = "2539425406"
"a3_956" = "2575413269"
"a3_957" = "2582860980"
"a3_954" = "2527820627"
"a2_589" = "4222610251"
"a1_976" = "3021008993"
"a1_977" = "67970847"
"a1_974" = "201025575"
"a1_975" = "2992833759"
"a1_972" = "4096195825"
"a1_973" = "326363267"
"a1_970" = "3660752920"
"a3_827" = "1616916338"
"a1_770" = "718399197"
"a1_978" = "3074237480"
"a1_979" = "4217154735"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKCU\Software\Aas]
"a4_199" = "1426655079"
"a3_505" = "3603458416"
"a3_504" = "3596547281"
"a2_363" = "2602387887"
"a3_507" = "3651577394"
"a3_506" = "3644525971"
"a3_501" = "3608550396"
"a3_500" = "3568002909"
"a3_503" = "3623047358"
"a3_502" = "3615603743"
"a4_821" = "1590881045"
"a4_698" = "709079162"
"a4_699" = "716248283"
"a4_820" = "1583711924"
"a4_692" = "666064436"
"a4_693" = "673233557"
"a4_690" = "651726194"
"a4_691" = "658895315"
"a4_696" = "694740920"
"a4_697" = "701910041"
"a4_694" = "680402678"
"a4_695" = "687571799"
"a4_822" = "1598050166"
"a3_828" = "1624490901"
"a3_829" = "1664967732"
"a3_826" = "1643547347"
"a4_825" = "1619557529"
"a3_824" = "1628992017"
"a3_825" = "1636505264"
"a3_822" = "1581458783"
"a3_823" = "1588517374"
"a3_820" = "1600580765"
"a3_821" = "1607565628"
"a2_900" = "2157246977"
"a1_746" = "594609535"
"a4_827" = "1633895771"
"a2_901" = "2164413002"
"a3_644" = "305393197"
"a4_826" = "1626726650"
"a2_902" = "2171581082"
"a4_274" = "1964339154"
"a4_275" = "1971508275"
"a4_276" = "1978677396"
"a4_277" = "1985846517"
"a4_270" = "1935662670"
"a4_271" = "1942831791"
"a4_272" = "1950000912"
"a4_273" = "1957170033"
"a2_904" = "2185915631"
"a4_278" = "1993015638"
"a4_279" = "2000184759"
"a2_905" = "2193081572"
"a2_906" = "2200249973"
"a4_478" = "3426839838"
"a4_479" = "3434008959"
"a4_476" = "3412501596"
"a4_477" = "3419670717"
"a4_474" = "3398163354"
"a4_475" = "3405332475"
"a4_472" = "3383825112"
"a4_473" = "3390994233"
"a4_470" = "3369486870"
"a4_471" = "3376655991"
"a4_308" = "2208089268"
"a4_309" = "2215258389"
"a4_300" = "2150736300"
"a4_301" = "2157905421"
"a4_302" = "2165074542"
"a4_303" = "2172243663"
"a4_304" = "2179412784"
"a4_305" = "2186581905"
"a4_306" = "2193751026"
"a4_307" = "2200920147"
"a1_114" = "2037238537"
"a1_115" = "213663434"
"a1_116" = "1201778138"
"a1_117" = "4275822091"
"a1_110" = "1539916646"
"a1_111" = "3447323200"
"a1_112" = "1777205285"
"a1_113" = "1627258764"
"a1_824" = "3165637482"
"a1_118" = "2266799027"
"a1_119" = "3885057152"
"a4_576" = "4129413696"
"a4_920" = "2300624024"
"a3_732" = "969437045"
"a2_498" = "3570229373"
"a2_499" = "3577393470"
"a2_492" = "3527209093"
"a2_493" = "3534378466"
"a2_490" = "3512876308"
"a2_491" = "3520041104"
"a2_496" = "3555877356"
"a2_497" = "3563045841"
"a2_494" = "3541544799"
"a2_495" = "3548712034"
"a2_816" = "1555034006"
"a2_817" = "1562199026"
"a2_814" = "1540698123"
"a2_815" = "1547864008"
"a2_812" = "1526365739"
"a3_740" = "1026900557"
"a2_810" = "1512015505"
"a2_811" = "1519180954"
"a3_733" = "943391636"
"a4_570" = "4086398970"
"a2_818" = "1569366881"
"a2_819" = "1576548534"
"a1_565" = "32506458"
"a1_564" = "752289734"
"a1_567" = "2685658760"
"a1_566" = "3255771082"
"a1_561" = "1653349965"
"a1_560" = "4178855417"
"a1_563" = "3030224109"
"a1_562" = "4101360092"
"a1_569" = "1649240517"
"a1_568" = "3675139869"
"a1_525" = "3469445813"
"a2_678" = "565690921"
"a2_679" = "572857506"
"a2_676" = "551356649"
"a2_677" = "558524660"
"a2_674" = "537022477"
"a2_675" = "544180481"
"a2_672" = "522674431"
"a2_673" = "529842220"
"a2_670" = "508338281"
"a2_671" = "515507296"
"a3_982" = "2728158783"
"a2_258" = "1849638597"
"a2_259" = "1856810520"
"a2_254" = "1820966388"
"a2_255" = "1828116821"
"a2_256" = "1835302870"
"a2_257" = "1842472426"
"a2_250" = "1792286301"
"a2_251" = "1799441148"
"a2_252" = "1806622199"
"a2_253" = "1813785562"
"a1_363" = "2453103781"
"a1_362" = "1385295460"
"a1_361" = "4163552633"
"a1_360" = "759994989"
"a1_367" = "300914258"
"a1_366" = "1775447826"
"a1_365" = "2034711539"
"a1_364" = "1746792389"
"a1_369" = "3675217828"
"a1_368" = "2424982081"
"a3_977" = "2692709400"
"a3_924" = "2346001461"
"a1_38" = "3071160392"
"a1_39" = "2968809850"
"a1_30" = "3047118704"
"a1_31" = "952923592"
"a1_32" = "2561318905"
"a1_33" = "4078212831"
"a1_34" = "1075063080"
"a1_35" = "341432340"
"a1_36" = "3671399384"
"a1_37" = "1554569278"
"a1_297" = "1546556471"
"a1_296" = "3581475484"
"a1_295" = "46719866"
"a1_294" = "1947270440"
"a1_293" = "1027506373"
"a1_292" = "2462927864"
"a1_291" = "2544593676"
"a1_290" = "1947915692"
"a1_299" = "2892777211"
"a1_298" = "937911892"
"a3_769" = "1234824520"
"a1_600" = "3324385557"
"a2_668" = "494009211"
"a1_601" = "4145895691"
"a3_761" = "1143737968"
"a3_760" = "1170380241"
"a3_763" = "1191790386"
"a4_286" = "2050368606"
"a3_765" = "1206362100"
"a1_602" = "3351726440"
"a3_767" = "1186780342"
"a3_766" = "1179725847"
"a2_108" = "774273900"
"a2_109" = "781427234"
"a4_878" = "1999520942"
"a1_603" = "3615246029"
"a2_100" = "716907184"
"a2_101" = "724075541"
"a2_102" = "731244154"
"a2_103" = "738425127"
"a2_104" = "745594447"
"a2_105" = "752758907"
"a2_106" = "759925321"
"a2_107" = "767094644"
"a3_541" = "3861793492"
"a3_540" = "3887912629"
"a3_543" = "3909387158"
"a3_542" = "3868847991"
"a3_545" = "3923892392"
"a3_544" = "3916833801"
"a3_547" = "3904770410"
"a3_546" = "3897785547"
"a3_549" = "3952815660"
"a3_548" = "3945379213"
"a1_607" = "2688765874"
"a1_589" = "1698630161"
"a1_588" = "2718998173"
"a3_169" = "1228156448"
"a3_168" = "1187689857"
"a3_167" = "1180635502"
"a3_166" = "1206680783"
"a3_165" = "1199757484"
"a3_164" = "1192698893"
"a3_163" = "1151697898"
"a3_162" = "1144713035"
"a3_161" = "1171213096"
"a3_160" = "1163777673"
"a1_749" = "4022506835"
"a1_748" = "3511064741"
"a2_28" = "200730395"
"a2_29" = "207912892"
"a2_26" = "186395040"
"a2_27" = "193574331"
"a2_24" = "172063760"
"a2_25" = "179228778"
"a2_22" = "157727115"
"a2_23" = "164898714"
"a2_20" = "143379007"
"a2_21" = "150548078"
"a4_68" = "487500228"
"a4_69" = "494669349"
"a4_917" = "2279116661"
"a4_916" = "2271947540"
"a4_911" = "2236101935"
"a4_910" = "2228932814"
"a4_913" = "2250440177"
"a4_912" = "2243271056"
"a4_60" = "430147260"
"a4_61" = "437316381"
"a4_62" = "444485502"
"a4_63" = "451654623"
"a4_64" = "458823744"
"a4_65" = "465992865"
"a4_66" = "473161986"
"a4_67" = "480331107"
"a4_833" = "1676910497"
"a4_959" = "2580219743"
"a2_758" = "1139221180"
"a2_7" = "50176052"
"a2_6" = "43022925"
"a2_5" = "35836201"
"a2_4" = "28685139"
"a2_3" = "21508340"
"a2_2" = "14341947"
"a2_1" = "7175798"
"a2_0" = "7015"
"a1_639" = "395932486"
"a1_638" = "92148943"
"a3_389" = "2805656908"
"a3_388" = "2765048109"
"a2_9" = "64528111"
"a2_8" = "57357824"
"a4_5" = "35845605"
"a4_4" = "28676484"
"a4_7" = "50183847"
"a4_6" = "43014726"
"a4_1" = "7169121"
"a4_0" = "0"
"a4_3" = "21507363"
"a4_2" = "14338242"
"a4_9" = "64522089"
"a4_8" = "57352968"
"a2_756" = "1124888791"
"a3_949" = "2491838908"
"a3_948" = "2484395293"
"a3_945" = "2462900280"
"a3_944" = "2455850905"
"a3_947" = "2510895354"
"a3_946" = "2503967835"
"a3_941" = "2467992228"
"a3_940" = "2427452933"
"a3_943" = "2482482022"
"a3_942" = "2474915527"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKCU\Software\Aas]
"a3_875" = "1961196962"
"a1_532" = "2590776543"
"a1_533" = "3172774734"
"a4_845" = "1762939949"
"a2_853" = "1820289598"
"a3_708" = "797636205"
"a4_923" = "2322131387"
"a3_970" = "2675785123"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "BB EB 89 9A 2E 75 D6 15 47 15 86 B2 CA E3 A7 56"

[HKCU\Software\Aas]
"a1_968" = "2336618645"
"a4_689" = "644557073"
"a4_688" = "637387952"
"a1_951" = "3726237165"
"a4_685" = "615880589"
"a4_684" = "608711468"
"a4_687" = "630218831"
"a4_686" = "623049710"
"a4_681" = "587204105"
"a4_680" = "580034984"
"a4_683" = "601542347"
"a4_682" = "594373226"
"a3_831" = "1645985014"
"a3_830" = "1671960663"
"a3_833" = "1659958664"
"a3_832" = "1652904297"
"a3_835" = "1707934282"
"a1_538" = "2081786879"
"a3_837" = "1688886028"
"a3_836" = "1681434349"
"a3_839" = "1736479694"
"a3_838" = "1729494959"
"a1_539" = "3898840705"
"a2_911" = "2236099502"
"a1_957" = "692717729"
"a4_267" = "1914155307"
"a4_266" = "1906986186"
"a4_265" = "1899817065"
"a4_264" = "1892647944"
"a4_263" = "1885478823"
"a4_262" = "1878309702"
"a4_261" = "1871140581"
"a4_260" = "1863971460"

[HKCU\Software\Aas\695404737]
"43014726" = "0A00687474703A2F2F63616465732E636F6D2E61722F696D616765732F6C6F676F2E67696600687474703A2F2F636576697A74762E636F6D2F696D616765732F6C6F676F2E67696600687474703A2F2F746861692D736B796C696768742E636F6D2F627574746F6E2E67696600687474703A2F2F636F726573646162616869612E636F6D2F696D616765732F6C6F676F2E67696600687474703A2F2F736D6F6B696E2D74722E636F6D2F6173736574732F696D616765732F6C6F676F2E67696600687474703A2F2F7777772E62756572676572666573742D6772616566656E626572672E64652F6C6F676F2E67696600687474703A2F2F77696E676D616B657273686F70652E7A612E706C2F696D616765732F627574746F6E2E67696600687474703A2F2F77656C6C73736D616C6C2E636F6D2F696D616765732F6C6F676F2E67696600687474703A2F2F7777772E75656873692E64652F6C6F676F2E67696600687474703A2F2F686F74656C697370622E686F702E72752F696D6167652F6C6F676F2E676966"

[HKCU\Software\Aas]
"a4_269" = "1928493549"
"a4_268" = "1921324428"
"a4_461" = "3304964781"
"a4_460" = "3297795660"
"a4_463" = "3319303023"
"a4_462" = "3312133902"
"a4_465" = "3333641265"
"a4_464" = "3326472144"
"a4_467" = "3347979507"
"a4_466" = "3340810386"
"a4_469" = "3362317749"
"a4_468" = "3355148628"
"a4_897" = "2135734241"
"a4_898" = "2142903362"
"a4_899" = "2150072483"
"a2_560" = "4014703379"
"a4_319" = "2286949599"
"a4_318" = "2279780478"
"a1_840" = "663813114"
"a4_313" = "2243934873"
"a4_312" = "2236765752"
"a4_311" = "2229596631"
"a4_310" = "2222427510"
"a4_317" = "2272611357"
"a4_316" = "2265442236"
"a4_315" = "2258273115"
"a4_314" = "2251103994"

"a3_130" = "915379051"
"a1_923" = "851378031"
"a3_131" = "922302346"
"a3_132" = "962897965"
"a2_880" = "2013867464"
"a1_107" = "2852619007"
"a1_106" = "3501513624"
"a1_105" = "605852325"
"a1_104" = "728272944"
"a1_103" = "389288283"
"a1_102" = "1218040249"
"a1_101" = "2194006544"
"a1_100" = "1837785787"
"a3_134" = "943841519"
"a1_109" = "2302044692"
"a1_62" = "184865837"
"a1_61" = "1551017431"
"a3_137" = "998890944"
"a2_883" = "2035361526"
"a3_686" = "606179783"
"a2_489" = "3505695374"
"a2_488" = "3498525530"
"a3_687" = "613616230"
"a2_485" = "3477014760"
"a2_484" = "3469859802"
"a2_487" = "3491357256"
"a2_486" = "3484191774"
"a2_481" = "3448342354"
"a2_480" = "3441169861"
"a2_483" = "3462692564"
"a2_482" = "3455508163"
"a3_974" = "2704311079"
"a3_685" = "632749476"
"a3_975" = "2711758662"
"a2_882" = "2028195559"
"a3_976" = "2685262841"
"a2_809" = "1504843254"
"a2_808" = "1497681794"
"a4_721" = "873968945"
"a3_680" = "596757377"
"a2_801" = "1447506000"
"a2_800" = "1440321221"
"a2_803" = "1461830163"
"a3_681" = "570649632"
"a2_805" = "1476181848"
"a2_804" = "1469014745"
"a2_807" = "1490515112"
"a2_806" = "1483346758"
"a3_145" = "1022800088"
"a3_972" = "2656717413"
"a3_144" = "1015749817"
"a2_885" = "2049709162"
"a3_973" = "2663771780"
"a3_147" = "1070844314"
"a2_661" = "443824612"
"a2_660" = "436654649"
"a2_663" = "458157093"
"a3_146" = "1063277947"
"a2_665" = "472489582"
"a2_664" = "465323570"
"a2_667" = "486842169"
"a2_666" = "479659324"
"a2_669" = "501182702"
"a3_141" = "1027810116"
"a3_140" = "986812197"
"a2_881" = "2021025343"
"a3_143" = "1008236550"
"a2_249" = "1785116150"
"a2_248" = "1777932338"
"a2_247" = "1770781370"
"a2_246" = "1763602320"
"a2_245" = "1756433923"
"a2_244" = "1749268937"
"a2_243" = "1742098739"
"a2_242" = "1734918761"
"a2_241" = "1727748763"
"a2_240" = "1720597243"
"a1_356" = "1896011945"
"a1_357" = "3752393263"
"a1_354" = "164844632"
"a1_355" = "1498859325"
"a1_352" = "3274509951"
"a1_353" = "3070230679"
"a1_350" = "3897214882"
"a1_351" = "2268174945"
"a2_855" = "1834623760"
"a3_639" = "269411382"
"a1_358" = "3578688511"
"a1_359" = "1256659234"
"a3_638" = "295912343"
"a2_887" = "2064045691"
"a2_886" = "2056878373"
"a3_795" = "1387647762"
"a3_718" = "869065255"
"a3_719" = "843023942"
"a3_714" = "807050403"
"a3_715" = "813969602"
"a3_716" = "821548389"
"a3_717" = "862013828"
"a3_710" = "778506031"
"a3_711" = "785556302"
"a3_712" = "826034145"
"a3_713" = "833615872"
"a2_820" = "1583715595"
"a2_119" = "853128024"
"a2_118" = "845963001"
"a4_869" = "1934998853"
"a4_868" = "1927829732"
"a2_113" = "810111733"
"a2_112" = "802944707"
"a2_111" = "795778443"
"a2_110" = "788607629"
"a2_117" = "838794840"
"a2_116" = "831614716"
"a2_115" = "824443132"
"a2_114" = "817276036"
"a3_534" = "3844868223"
"a3_535" = "3852446878"
"a3_536" = "3825811761"
"a3_537" = "3832866128"
"a3_530" = "3816471291"
"a3_531" = "3823394586"
"a3_532" = "3797414845"
"a3_533" = "3804403676"
"a3_538" = "3840383475"
"a3_539" = "3880858130"
"a2_813" = "1533531260"
"a3_152" = "1106310065"
"a3_153" = "1080268752"
"a3_150" = "1092336383"
"a3_151" = "1099259678"
"a3_156" = "1135231285"
"a3_157" = "1108731220"
"a3_154" = "1087178867"
"a3_155" = "1127787666"
"a3_628" = "223959005"
"a3_629" = "231000188"
"a3_158" = "1115724279"
"a3_159" = "1123168790"
"a2_59" = "422985552"
"a2_58" = "415802479"
"a2_53" = "379966635"
"a2_52" = "372786147"
"a2_51" = "365618480"
"a2_50" = "358449405"
"a2_57" = "408633412"
"a2_56" = "401462579"
"a2_55" = "394300408"
"a2_54" = "387134999"
"a4_842" = "1741432586"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKCU\Software\Aas]
"a4_55" = "394301655"
"a4_54" = "387132534"
"a4_57" = "408639897"
"a4_56" = "401470776"
"a4_51" = "365625171"
"a4_50" = "358456050"
"a4_53" = "379963413"
"a4_52" = "372794292"
"a3_440" = "3171413137"
"a3_441" = "3178398000"
"a3_442" = "3185321299"
"a3_443" = "3159349746"
"a4_59" = "422978139"
"a4_58" = "415809018"
"a3_446" = "3214379735"
"a3_447" = "3187748726"
"a1_644" = "1580944549"
"a1_645" = "4286788305"
"a1_646" = "3894487929"
"a1_647" = "395890800"
"a1_640" = "216317392"
"a1_641" = "1213173212"
"a1_642" = "350618006"
"a1_643" = "2425924713"
"a1_648" = "1738244561"
"a1_649" = "2417207129"

[HKCU\Software\Aas\695404737]
"21507363" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Aas]
"a2_953" = "2537206049"
"a3_459" = "3307312066"
"a3_458" = "3266772899"
"a4_784" = "1325623568"
"a4_785" = "1332792689"
"a4_786" = "1339961810"
"a4_787" = "1347130931"
"a4_780" = "1296947084"
"a4_781" = "1304116205"
"a4_782" = "1311285326"
"a4_783" = "1318454447"
"a1_828" = "901247879"
"a1_829" = "1735753024"
"a4_788" = "1354300052"
"a3_451" = "3249847498"
"a4_670" = "508343774"
"a4_671" = "515512895"
"a4_672" = "522682016"
"a3_450" = "3242793131"
"a4_674" = "537020258"
"a4_675" = "544189379"
"a4_676" = "551358500"
"a4_677" = "558527621"
"a4_678" = "565696742"
"a1_604" = "485090178"
"a1_916" = "251759151"
"a1_917" = "440694475"
"a1_910" = "2682497691"
"a1_911" = "4039798421"
"a1_912" = "2463486413"
"a1_913" = "3567235882"
"a3_844" = "1772455397"
"a3_845" = "1746353668"
"a3_846" = "1753404071"
"a3_847" = "1760327366"
"a3_840" = "1743926369"
"a3_841" = "1717414016"
"a3_842" = "1724861731"
"a3_843" = "1765466434"
"a3_848" = "1801448313"
"a3_849" = "1808437144"
"a3_702" = "721038295"
"a4_874" = "1970844458"
"a1_654" = "1803232894"
"a4_961" = "2594557985"
"a4_414" = "2968016094"
"a4_415" = "2975185215"
"a4_416" = "2982354336"
"a4_417" = "2989523457"
"a4_410" = "2939339610"
"a4_411" = "2946508731"
"a4_412" = "2953677852"
"a4_413" = "2960846973"
"a4_418" = "2996692578"
"a4_419" = "3003861699"
"a3_806" = "1500078927"
"a3_807" = "1507067886"
"a1_138" = "2216929012"
"a1_139" = "3105224725"
"a3_907" = "2190592386"
"a1_132" = "700621747"
"a1_133" = "3772283615"
"a1_130" = "1740874634"
"a1_131" = "4205213175"
"a1_136" = "1220224474"
"a1_137" = "4264661335"
"a1_134" = "1148187767"
"a1_135" = "2293607062"
"a3_768" = "1227770153"
"a4_328" = "2351471688"
"a4_329" = "2358640809"
"a4_326" = "2337133446"
"a4_327" = "2344302567"
"a4_324" = "2322795204"
"a4_325" = "2329964325"
"a4_322" = "2308456962"
"a4_323" = "2315626083"
"a4_320" = "2294118720"
"a4_321" = "2301287841"
"a4_528" = "3785295888"
"a4_529" = "3792465009"
"a4_258" = "1849633218"
"a4_259" = "1856802339"
"a4_252" = "1806618492"
"a4_253" = "1813787613"
"a4_250" = "1792280250"
"a4_251" = "1799449371"
"a4_256" = "1835294976"
"a4_257" = "1842464097"
"a4_254" = "1820956734"
"a4_255" = "1828125855"
"a3_909" = "2238580292"
"a2_470" = "3369489447"
"a2_471" = "3376658263"
"a2_472" = "3383823204"
"a2_473" = "3390991474"
"a2_474" = "3398156389"
"a2_475" = "3405325040"
"a2_476" = "3412507511"
"a2_477" = "3419674187"
"a2_478" = "3426842365"
"a2_479" = "3434006155"
"a4_880" = "2013859184"
"a3_908" = "2231591461"
"a1_797" = "2544913479"
"a2_878" = "1999527629"
"a2_879" = "2006695108"
"a2_874" = "1970840591"
"a2_875" = "1978010819"
"a2_876" = "1985179168"
"a2_877" = "1992344525"
"a2_870" = "1942173728"
"a2_871" = "1949343740"
"a2_872" = "1956508450"
"a2_873" = "1963677673"
"a1_349" = "3980034024"
"a1_348" = "1055802098"
"a2_586" = "4201113476"
"a2_587" = "4208276212"
"a2_580" = "4158092162"
"a2_581" = "4165258634"
"a2_582" = "4172425613"
"a2_583" = "4179591946"
"a1_341" = "2989481578"
"a1_340" = "1807228569"
"a1_343" = "2760017197"
"a1_342" = "3905220426"
"a1_345" = "2514162378"
"a1_344" = "2178579514"
"a1_347" = "210318821"
"a1_346" = "836654764"
"a2_614" = "106878252"
"a2_615" = "114048146"
"a2_616" = "121212959"
"a2_617" = "128382306"
"a2_610" = "78198521"
"a2_611" = "85362981"
"a2_612" = "92525215"
"a2_613" = "99698226"
"a2_618" = "135546238"
"a2_619" = "142712986"
"a2_272" = "1950006056"
"a2_273" = "1957172508"
"a2_270" = "1935656121"

[HKLM\SOFTWARE\Microsoft\Security Center\Svc]
"UpdatesDisableNotify" = "1"

[HKCU\Software\Aas]
"a2_276" = "1978672218"
"a2_277" = "1985839440"
"a2_274" = "1964341433"
"a2_275" = "1971504005"
"a2_908" = "2214603741"
"a2_909" = "2221764690"
"a2_278" = "1993021905"
"a2_279" = "2000190050"
"a1_842" = "46824368"
"a2_298" = "2136406193"
"a2_299" = "2143591772"
"a1_841" = "181066971"
"a2_290" = "2079041589"
"a2_291" = "2086208068"
"a2_292" = "2093378367"
"a2_293" = "2100558776"
"a2_294" = "2107726595"
"a2_295" = "2114891893"
"a2_296" = "2122059384"
"a2_297" = "2129226335"
"a2_728" = "924149365"
"a2_729" = "931316131"
"a2_720" = "866797898"
"a2_721" = "873965833"
"a2_722" = "881134861"
"a2_723" = "888297058"
"a2_724" = "895482884"
"a2_725" = "902652799"
"a2_726" = "909817280"
"a2_727" = "916985585"
"a1_594" = "657095177"
"a4_450" = "3226104450"
"a3_791" = "1392659870"
"a3_709" = "804547212"
"a4_451" = "3233273571"
"a3_707" = "790584778"
"a3_706" = "749582763"
"a3_705" = "742524168"
"a3_704" = "769089769"
"a3_703" = "761646198"
"a4_452" = "3240442692"
"a3_701" = "713602996"
"a3_700" = "706548501"
"a4_890" = "2085550394"
"a4_891" = "2092719515"
"a4_892" = "2099888636"
"a4_453" = "3247611813"
"a4_894" = "2114226878"
"a4_895" = "2121395999"
"a2_128" = "917645779"
"a2_129" = "924814948"
"a2_126" = "903314980"
"a2_127" = "910483090"
"a2_124" = "888963650"
"a2_125" = "896145738"
"a2_122" = "874631072"
"a2_123" = "881796842"
"a2_120" = "860302639"
"a2_121" = "867456388"
"a3_35" = "267899754"
"a3_526" = "3787937127"
"a3_525" = "3780489412"
"a3_524" = "3739884709"
"a3_523" = "3732895746"
"a4_456" = "3269119176"
"a3_521" = "3751945024"
"a3_520" = "3744501537"
"a2_824" = "1612382811"
"a4_457" = "3276288297"
"a3_529" = "3809412696"
"a3_528" = "3768345145"
"a1_12" = "1273440466"
"a1_13" = "3467690165"
"a1_10" = "2011544983"
"a1_11" = "1351788054"
"a1_16" = "1019706992"
"a1_17" = "1239484647"
"a1_14" = "3567705379"
"a1_15" = "398461051"
"a1_18" = "2927604579"
"a1_19" = "1312098662"
"a3_149" = "1051199068"
"a3_148" = "1044210237"
"a2_896" = "2128560185"
"a2_48" = "344113899"
"a2_49" = "351283759"
"a1_846" = "1335416794"
"a2_40" = "286766813"
"a2_41" = "293932420"
"a2_42" = "301099865"
"a2_43" = "308264975"
"a2_44" = "315448203"
"a2_45" = "322616522"
"a2_46" = "329785209"
"a2_47" = "336939954"
"a2_897" = "2135728309"
"a4_42" = "301103082"
"a4_43" = "308272203"
"a4_40" = "286764840"
"a4_41" = "293933961"
"a4_46" = "329779566"
"a4_47" = "336948687"
"a4_44" = "315441324"
"a4_45" = "322610445"
"a3_453" = "3230791052"
"a3_452" = "3223736685"
"a4_48" = "344117808"
"a4_49" = "351286929"
"a3_457" = "3259718400"
"a3_456" = "3285821153"
"a3_455" = "3278766670"
"a3_454" = "3271781935"
"a1_657" = "2315477583"
"a1_656" = "1604285230"
"a1_655" = "2378562934"
"a1_632" = "3243512901"
"a1_653" = "3745316154"
"a1_652" = "1660781500"
"a1_651" = "715650325"
"a1_650" = "2532653206"
"a3_796" = "1428649909"
"a1_659" = "1695886318"
"a1_658" = "3695981580"
"a3_797" = "1435691988"
"a3_18" = "112354555"
"a3_19" = "152901914"
"a3_14" = "83367783"
"a3_15" = "124488582"
"a3_16" = "131411001"
"a3_17" = "104906840"
"a3_10" = "88506851"
"a3_11" = "95435266"
"a3_12" = "69459621"
"a3_13" = "76378820"
"a3_240" = "1737322713"
"a4_886" = "2056873910"
"a3_793" = "1406704208"
"a3_809" = "1488018592"
"a3_798" = "1442679927"
"a3_799" = "1416568982"
"a3_248" = "1761236945"
"a2_172" = "1233086283"
"a4_797" = "1418822141"
"a4_796" = "1411653020"
"a4_795" = "1404483899"
"a4_794" = "1397314778"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKCU\Software\Aas]
"a4_792" = "1382976536"
"a4_791" = "1375807415"
"a4_790" = "1368638294"
"a1_839" = "2716631898"
"a1_838" = "202075471"
"a4_799" = "1433160383"
"a4_798" = "1425991262"
"a4_663" = "458159927"
"a4_662" = "450990806"
"a4_661" = "443821685"
"a4_660" = "436652564"
"a4_667" = "486836411"
"a4_666" = "479667290"
"a4_665" = "472498169"
"a4_664" = "465329048"
"a1_907" = "3253833458"
"a1_906" = "2646191185"
"a4_669" = "501174653"
"a4_668" = "494005532"
"a1_903" = "3077957482"
"a1_902" = "1624889532"
"a1_901" = "126857787"
"a1_900" = "1037684297"
"a3_857" = "1865835152"
"a3_856" = "1824837233"
"a3_855" = "1817794014"
"a3_854" = "1844425151"
"a3_853" = "1836850460"
"a3_852" = "1829861629"
"a3_851" = "1789379674"
"a3_850" = "1781801019"
"a1_635" = "1690578889"
"a4_949" = "2508528533"
"a3_859" = "1846328146"
"a3_858" = "1872824115"
"a1_734" = "3496574546"
"a2_644" = "321950334"
"a4_976" = "2702094800"
"a4_454" = "3254780934"
"a1_524" = "1522310050"
"a4_407" = "2917832247"
"a4_406" = "2910663126"
"a4_405" = "2903494005"
"a4_404" = "2896324884"
"a4_403" = "2889155763"
"a4_402" = "2881986642"
"a4_401" = "2874817521"
"a4_400" = "2867648400"
"a1_825" = "604350372"
"a1_879" = "3814151576"
"a3_640" = "276404393"
"a4_409" = "2932170489"
"a4_408" = "2925001368"
"a3_641" = "283851976"
"a3_646" = "352855791"
"a3_647" = "360438542"
"a4_789" = "1361469173"
"a1_129" = "553995861"
"a1_128" = "1411400762"
"a1_125" = "1663194373"
"a1_124" = "3617682607"
"a1_127" = "709656640"
"a1_126" = "114417387"
"a1_121" = "4271784183"
"a1_120" = "4129343174"
"a1_123" = "248841297"
"a1_122" = "2401291398"
"a4_331" = "2372979051"
"a4_330" = "2365809930"
"a4_333" = "2387317293"
"a4_332" = "2380148172"
"a4_335" = "2401655535"
"a4_334" = "2394486414"
"a4_337" = "2415993777"
"a4_336" = "2408824656"
"a4_339" = "2430332019"
"a4_338" = "2423162898"
"a1_833" = "1870739987"
"a4_539" = "3864156219"
"a4_538" = "3856987098"
"a4_249" = "1785111129"
"a4_248" = "1777942008"
"a1_832" = "4096036126"
"a4_245" = "1756434645"
"a4_244" = "1749265524"
"a4_247" = "1770772887"
"a4_246" = "1763603766"
"a4_241" = "1727758161"
"a4_240" = "1720589040"
"a4_243" = "1742096403"
"a4_242" = "1734927282"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"

[HKCU\Software\Aas]
"a1_830" = "1795652302"
"a4_793" = "1390145657"
"a1_836" = "942204138"
"a1_835" = "3551925416"
"a1_754" = "1618616942"
"a1_834" = "1313425852"
"a1_634" = "3699127686"
"a2_463" = "3319307288"
"a2_462" = "3312139361"
"a2_461" = "3304969320"
"a2_460" = "3297789008"
"a2_467" = "3347972535"
"a2_466" = "3340807794"
"a2_465" = "3333638228"
"a2_464" = "3326474415"
"a2_469" = "3362322829"
"a2_468" = "3355156835"
"a1_934" = "3427103163"
"a4_802" = "1454667746"
"a4_872" = "1956506216"
"a2_869" = "1934992200"
"a2_868" = "1927825076"
"a2_867" = "1920658344"
"a2_866" = "1913488873"
"a2_865" = "1906324059"
"a2_864" = "1899159477"
"a2_863" = "1891990056"
"a1_791" = "1720714990"
"a2_861" = "1877653743"
"a2_860" = "1870473657"
"a2_597" = "4279959898"
"a2_596" = "4272793665"
"a2_595" = "4265635090"
"a2_594" = "4258461636"
"a1_338" = "3965517637"
"a1_339" = "2592435661"
"a2_591" = "4236944831"
"a2_590" = "4229778555"
"a1_334" = "1333684944"
"a1_335" = "663290322"
"a1_336" = "2450782596"
"a1_337" = "1903874573"
"a1_330" = "1071257431"
"a1_331" = "2165772978"
"a1_332" = "2208336822"
"a1_333" = "1176733560"
"a2_607" = "56695616"
"a2_606" = "49528499"
"a3_30" = "231909751"
"a2_604" = "35178594"
"a1_64" = "2710842702"
"a2_602" = "20852377"
"a2_601" = "13665384"
"a2_600" = "6511611"
"a4_875" = "1978013579"
"a2_609" = "71028942"
"a2_608" = "63864349"
"a2_265" = "1899819172"
"a2_264" = "1892656980"
"a2_267" = "1914153297"
"a2_266" = "1906987719"
"a2_261" = "1871137915"
"a2_260" = "1863970072"
"a2_263" = "1885471178"
"a2_262" = "1878303891"
"a2_919" = "2293450197"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Aas]
"a2_269" = "1928487994"
"a2_268" = "1921321948"
"a1_905" = "3402259253"
"a2_884" = "2042529035"
"a1_482" = "815312924"
"a1_483" = "3588633427"
"a2_289" = "2071873898"
"a2_288" = "2064710218"
"a1_486" = "1597201572"
"a1_487" = "1669583838"
"a1_484" = "3656632794"
"a1_485" = "3260753370"
"a2_283" = "2028857707"
"a2_282" = "2021691229"
"a2_281" = "2014517086"
"a2_280" = "2007357118"
"a2_287" = "2057546696"
"a2_286" = "2050371892"
"a2_285" = "2043193716"
"a2_284" = "2036038611"
"a2_739" = "1003016998"
"a2_738" = "995838101"
"a3_522" = "3725445091"
"a2_733" = "959990416"
"a2_732" = "952835903"
"a2_731" = "945666964"
"a2_730" = "938484426"
"a2_737" = "988668635"
"a2_736" = "981503707"
"a2_735" = "974333250"
"a2_734" = "967175124"
"a4_446" = "3197427966"
"a1_637" = "170879531"
"a3_912" = "2226582457"
"a1_240" = "1942991599"
"a1_241" = "2236470591"
"a1_242" = "2743580428"
"a1_243" = "3772886735"
"a1_244" = "312393678"
"a1_245" = "2892494441"
"a1_246" = "3097756779"
"a1_247" = "4109407018"
"a1_248" = "2260024745"
"a1_249" = "335331330"
"a3_738" = "978859403"
"a3_739" = "986426922"
"a4_445" = "3190258845"
"a2_131" = "939148206"
"a2_130" = "931980437"
"a2_133" = "953499024"
"a2_132" = "946333646"
"a2_135" = "967834159"
"a2_134" = "960666753"
"a2_137" = "982166610"
"a2_136" = "974996951"
"a2_139" = "996515196"
"a2_138" = "989331629"
"a4_889" = "2078381273"
"a4_888" = "2071212152"
"a2_79" = "566354127"
"a2_78" = "559189673"
"a3_916" = "2254979389"
"a3_288" = "2048100105"
"a3_289" = "2055027624"
"a3_184" = "1336102801"
"a3_917" = "2262558044"
"a3_282" = "2038692083"
"a3_283" = "2045680914"
"a3_280" = "1990631473"
"a3_281" = "2031109200"
"a3_286" = "2067091063"
"a3_287" = "2074141334"
"a3_284" = "2019045813"
"a3_285" = "2026624468"
"a3_606" = "66123703"
"a3_607" = "40004566"
"a3_604" = "52150005"
"a3_605" = "59069204"
"a3_602" = "4023859"
"a3_603" = "11016786"
"a3_600" = "23079281"
"a3_601" = "30657936"
"a4_700" = "723417404"
"a3_608" = "46992457"
"a3_609" = "87597288"
"a1_796" = "701304963"
"a1_583" = "2892195226"
"a1_794" = "1064157940"
"a1_795" = "1126538825"
"a1_792" = "2149924941"
"a1_793" = "3282504411"
"a1_790" = "1266224231"
"a1_582" = "151420635"
"a3_635" = "240424626"
"a3_911" = "2219532038"
"a1_581" = "458901743"
"a1_798" = "637648868"
"a1_799" = "1727609826"
"a1_580" = "3527135262"
"a3_198" = "1436076335"

[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DoNotAllowExceptions" = "0"

[HKCU\Software\Aas]
"a3_196" = "1388556397"
"a3_197" = "1429034124"
"a3_194" = "1407548331"
"a3_195" = "1380982730"
"a3_192" = "1393042153"
"a3_193" = "1400620808"
"a3_190" = "1345525207"
"a3_191" = "1352568438"
"a2_981" = "2737945350"
"a1_585" = "4010383627"
"a3_468" = "3338201981"
"a3_469" = "3379269532"
"a3_466" = "3324236475"
"a3_467" = "3331159770"
"a3_464" = "3343287801"
"a3_465" = "3350216216"
"a3_462" = "3295169831"
"a3_463" = "3302744390"
"a3_460" = "3314758757"
"a3_461" = "3321800836"
"a1_468" = "726579602"
"a1_469" = "4191197957"
"a3_518" = "3696916079"
"a3_519" = "3703958158"
"a1_460" = "941568610"
"a1_461" = "2666893338"
"a1_462" = "2126355803"
"a1_463" = "2462180153"
"a1_464" = "2907447218"
"a1_465" = "2541192952"
"a1_466" = "4010952585"
"a1_467" = "682746600"
"a3_29" = "224867540"
"a3_28" = "183865525"
"a1_668" = "92769618"
"a1_669" = "1888963009"
"a3_21" = "167399900"
"a3_20" = "159956413"
"a3_23" = "148336286"
"a3_22" = "140888703"
"a3_25" = "195929936"
"a3_24" = "188875569"
"a3_27" = "176880658"
"a3_26" = "169827315"
"a2_830" = "1655399722"
"a3_499" = "3560555322"
"a2_831" = "1662580641"
"a3_498" = "3587059355"
"a2_832" = "1669735125"
"a3_497" = "3579611768"
"a2_833" = "1676905555"
"a3_496" = "3539014105"
"a2_834" = "1684088045"
"a3_495" = "3532029350"
"a2_835" = "1691251978"
"a4_955" = "2551543259"
"a3_494" = "3524581639"
"a2_836" = "1698419151"
"a3_493" = "3551077604"
"a2_837" = "1705586018"
"a3_492" = "3544154181"
"a3_491" = "3503090722"
"a1_837" = "786431899"
"a3_527" = "3761424774"
"a3_490" = "3496037251"
"a3_775" = "1244236686"
"a4_915" = "2264778419"
"a3_868" = "1944793805"
"a3_869" = "1918293868"
"a4_914" = "2257609298"
"a3_862" = "1901368503"
"a3_863" = "1908803798"
"a3_860" = "1853775861"
"a3_861" = "1860825108"
"a3_866" = "1930361355"
"a3_867" = "1937350314"
"a3_864" = "1882303817"
"a3_865" = "1889747432"
"a1_806" = "2045722331"
"a1_807" = "3102083482"
"a1_804" = "2211265778"
"a1_805" = "1806282266"
"a1_802" = "2141128621"
"a1_803" = "243179775"
"a1_800" = "3141834897"

"a1_808" = "3041037166"
"a1_809" = "2587150388"
"a4_656" = "407976080"
"a4_657" = "415145201"
"a4_654" = "393637838"
"a4_655" = "400806959"
"a4_652" = "379299596"
"a4_653" = "386468717"
"a4_650" = "364961354"
"a4_651" = "372130475"
"a1_938" = "2646973494"
"a1_939" = "1179982231"
"a4_658" = "422314322"
"a4_659" = "429483443"
"a3_773" = "1263760076"
"a4_849" = "1791616433"
"a4_919" = "2293454903"
"a4_918" = "2286285782"
"a2_656" = "407973675"
"a1_875" = "742752320"
"a4_925" = "2336469629"
"a3_762" = "1151312531"
"a1_684" = "82620318"
"a4_438" = "3140074998"
"a4_439" = "3147244119"
"a1_874" = "38442900"
"a4_432" = "3097060272"
"a4_433" = "3104229393"
"a4_430" = "3082722030"
"a4_431" = "3089891151"
"a4_436" = "3125736756"
"a4_437" = "3132905877"
"a4_434" = "3111398514"
"a4_435" = "3118567635"
"a3_928" = "2374546825"
"a4_344" = "2466177624"
"a4_345" = "2473346745"
"a4_346" = "2480515866"
"a4_347" = "2487684987"
"a4_340" = "2437501140"
"a4_341" = "2444670261"
"a4_342" = "2451839382"
"a4_343" = "2459008503"
"a3_764" = "1198848853"
"a4_348" = "2494854108"
"a4_349" = "2502023229"
"a4_508" = "3641913468"
"a4_509" = "3649082589"
"a4_506" = "3627575226"
"a4_507" = "3634744347"
"a4_504" = "3613236984"
"a4_505" = "3620406105"
"a4_502" = "3598898742"
"a4_503" = "3606067863"
"a4_500" = "3584560500"
"a4_501" = "3591729621"
"a3_383" = "2729068342"
"a3_382" = "2721620631"
"a4_882" = "2028197426"
"a3_381" = "2748124788"
"a2_456" = "3269121488"
"a2_457" = "3276280406"
"a2_454" = "3254786433"
"a3_380" = "2741212629"
"a2_452" = "3240430071"
"a2_453" = "3247604122"
"a2_450" = "3226096047"
"a2_451" = "3233271588"
"a3_387" = "2757612682"
"a3_633" = "259938800"
"a2_458" = "3283455653"
"a3_386" = "2784112747"
"a3_385" = "2776670152"
"a4_881" = "2021028305"
"a3_384" = "2769681321"
"a1_735" = "2368830514"
"a2_852" = "1813120862"
"a1_730" = "2136551204"
"a2_850" = "1798793837"
"a2_851" = "1805945785"
"a2_856" = "1841805832"
"a2_857" = "1848978280"
"a2_854" = "1827458797"
"a1_731" = "84665930"
"a3_632" = "252486993"
"a2_858" = "1856139495"
"a2_859" = "1863305108"
"a1_732" = "1890804754"
"a1_733" = "3945027270"
"a1_329" = "1540858614"
"a1_328" = "3275214598"
"a1_327" = "2737166939"
"a1_326" = "2851577817"
"a1_325" = "3618718588"
"a1_324" = "249278598"
"a1_323" = "131719901"
"a1_322" = "2148445142"
"a1_321" = "1131451651"
"a1_320" = "1245475397"
"a2_650" = "364955498"
"a1_436" = "3766410976"
"a1_736" = "2912208357"
"a3_631" = "211878206"
"a1_737" = "2293535125"
"a2_652" = "379305031"
"a3_923" = "2339079058"
"a2_926" = "2343646953"
"a2_927" = "2350802287"
"a2_924" = "2329303943"
"a2_653" = "386473479"
"a4_887" = "2064043031"
"a2_923" = "2322136661"
"a2_920" = "2300617082"
"a2_921" = "2307799606"
"a2_654" = "393638957"
"a2_928" = "2357984397"
"a2_655" = "400805722"
"a1_908" = "2415064766"
"a3_630" = "204893343"
"a2_657" = "415138861"
"a3_922" = "2298015603"
"a1_495" = "147613693"
"a1_494" = "2493225079"
"a1_497" = "1179686809"
"a1_496" = "2752689486"
"a1_491" = "1201141853"
"a1_490" = "1562691350"
"a1_493" = "2042652387"
"a1_492" = "4058496304"
"a1_499" = "2452659279"
"a1_498" = "209467119"
"a3_637" = "288468852"
"a2_708" = "780763232"
"a2_709" = "787945780"
"a2_706" = "766431142"
"a2_707" = "773597493"
"a2_704" = "752096894"
"a2_705" = "759254788"
"a2_702" = "737761185"
"a2_703" = "744930672"
"a2_700" = "723405129"
"a2_701" = "730595050"
"a4_885" = "2049704789"
"a2_638" = "278924489"
"a2_639" = "286103512"
"a3_808" = "1481095169"
"a2_632" = "235918982"
"a2_633" = "243077470"
"a2_630" = "221591759"
"a2_631" = "228752960"
"a2_636" = "264600467"
"a2_637" = "271769374"
"a2_634" = "250249545"
"a2_635" = "257418244"
"a1_253" = "1097555955"
"a1_252" = "2162691277"
"a1_251" = "564204406"
"a1_250" = "1287827665"
"a1_257" = "3644352221"
"a1_256" = "2550978927"
"a1_255" = "2166532844"
"a1_254" = "985410404"
"a3_920" = "2284050097"
"a1_259" = "2949375349"
"a1_258" = "1555945598"
"a3_729" = "914469392"
"a3_728" = "907418097"
"a4_884" = "2042535668"
"a2_144" = "1032350032"
"a2_145" = "1039530472"
"a2_146" = "1046686315"
"a2_147" = "1053852402"
"a2_140" = "1003669025"
"a2_141" = "1010855192"
"a2_142" = "1018007118"
"a2_143" = "1025180883"
"a1_781" = "3482246449"
"a1_780" = "765036854"
"a2_68" = "487503435"
"a2_69" = "494671613"
"a2_148" = "1061035780"
"a2_149" = "1068200568"
"a1_787" = "169524586"
"a4_455" = "3261950055"
"a3_299" = "2126993250"
"a3_298" = "2119545539"
"a3_295" = "2131608046"
"a3_294" = "2091003215"
"a3_297" = "2146049696"
"a3_296" = "2139060737"
"a3_291" = "2103079018"
"a3_290" = "2062081995"
"a3_293" = "2083555628"
"a3_292" = "2110067853"
"a2_987" = "2780961356"
"a1_904" = "1525096901"
"a3_634" = "266990099"
"a3_619" = "159571106"
"a3_618" = "152516611"
"a3_611" = "68549034"
"a3_610" = "95044875"
"a3_613" = "82982508"
"a3_612" = "75537869"
"a3_615" = "131026734"
"a3_614" = "123579023"
"a3_617" = "111511520"
"a3_616" = "104522561"
"a3_181" = "1280611004"
"a3_180" = "1307180573"
"a3_34" = "260325067"
"a3_182" = "1288058591"
"a3_185" = "1309597744"
"a3_33" = "253401768"
"a3_187" = "1324038386"
"a3_186" = "1316586579"
"a3_189" = "1371566516"
"a3_188" = "1364647189"
"a3_38" = "289377359"
"a3_39" = "296296686"
"a3_471" = "3359687774"
"a3_470" = "3386187839"
"a3_473" = "3407682832"
"a3_472" = "3367139569"
"a3_475" = "3422180818"
"a3_474" = "3414733235"
"a3_477" = "3403113108"
"a4_282" = "2021692122"
"a3_479" = "3450714966"
"a3_478" = "3443656503"
"a1_479" = "278217316"
"a1_478" = "3009943371"
"a3_509" = "3632529140"
"a3_508" = "3624950357"
"a1_473" = "2035556"
"a1_472" = "1839593094"
"a1_471" = "1098139819"
"a1_470" = "1154869600"
"a1_477" = "3113791484"
"a1_476" = "1032617225"
"a1_475" = "1306629796"
"a1_474" = "4208653492"
"a4_533" = "3821141493"
"a1_679" = "2719434771"
"a1_678" = "573951831"
"a4_532" = "3813972372"
"a1_675" = "1626470423"
"a1_674" = "560083245"
"a1_677" = "2675115936"
"a1_676" = "2571526042"
"a1_671" = "1802277217"
"a4_531" = "3806803251"
"a1_673" = "2709404785"
"a1_672" = "4253244190"

[HKLM\SOFTWARE\Microsoft\Security Center]
"UacDisableNotify" = "1"

[HKCU\Software\Aas]
"a4_530" = "3799634130"
"a4_537" = "3849817977"
"a4_536" = "3842648856"
"a1_868" = "2753304154"
"a4_535" = "3835479735"
"a3_981" = "2721238428"
"a3_980" = "2747738493"
"a3_983" = "2769230430"
"a4_534" = "3828310614"
"a3_985" = "2783204112"
"a3_984" = "2776284913"
"a3_987" = "2764139474"
"a3_986" = "2757228467"
"a2_151" = "1082529602"
"a2_150" = "1075365681"
"a1_869" = "2359624479"
"a2_271" = "1942836550"
"a3_879" = "1989722918"
"a3_878" = "1982672519"
"a1_823" = "1485965561"
"a3_874" = "1954273539"
"a3_877" = "2009303652"
"a3_876" = "2001736133"
"a3_871" = "1966337070"
"a3_870" = "1925204879"
"a3_873" = "1946690784"
"a3_872" = "1973321793"
"a2_159" = "1139884592"
"a4_758" = "1139226422"
"a2_158" = "1132717549"
"a1_925" = "3539439804"
"a1_924" = "594340017"
"a1_927" = "2336042724"
"a1_926" = "2729014558"
"a1_921" = "1426758583"
"a1_920" = "1754325794"
"a3_787" = "1363737626"
"a1_922" = "2305883919"
"a3_80" = "590099577"
"a1_929" = "2802408806"
"a1_928" = "4020586382"
"a4_649" = "357792233"
"a4_648" = "350623112"
"a4_641" = "300439265"
"a4_640" = "293270144"
"a4_643" = "314777507"
"a4_642" = "307608386"
"a4_645" = "329115749"
"a4_644" = "321946628"
"a4_647" = "343453991"
"a4_646" = "336284870"
"a3_786" = "1323129851"
"a1_819" = "3115415069"
"a1_818" = "3608821303"
"a3_785" = "1316202328"
"a3_746" = "1069934723"
"a1_811" = "3329208582"
"a1_810" = "979669403"
"a1_813" = "3586269012"
"a1_812" = "791117481"
"a1_815" = "4190740426"
"a1_814" = "3915960349"
"a1_817" = "3994229444"
"a1_816" = "103642252"
"a4_963" = "2608896227"
"a4_429" = "3075552909"
"a4_428" = "3068383788"
"a4_425" = "3046876425"
"a4_424" = "3039707304"
"a4_427" = "3061214667"
"a4_426" = "3054045546"
"a4_421" = "3018199941"
"a4_420" = "3011030820"
"a4_423" = "3032538183"
"a4_422" = "3025369062"
"a3_743" = "1014841262"
"a3_745" = "1062892640"
"a3_742" = "1007917839"
"a4_967" = "2637572711"
"a3_741" = "1033955052"
"a2_802" = "1454663805"
"a4_357" = "2559376197"
"a4_356" = "2552207076"
"a4_355" = "2545037955"
"a4_354" = "2537868834"
"a4_353" = "2530699713"
"a4_352" = "2523530592"
"a4_351" = "2516361471"
"a4_350" = "2509192350"
"a3_747" = "1043369250"
"a4_359" = "2573714439"
"a4_358" = "2566545318"
"a4_511" = "3663420831"
"a4_510" = "3656251710"
"a4_513" = "3677759073"
"a4_512" = "3670589952"
"a4_515" = "3692097315"
"a4_514" = "3684928194"
"a4_517" = "3706435557"
"a4_516" = "3699266436"
"a4_519" = "3720773799"
"a4_518" = "3713604678"
"a3_744" = "1021891521"
"a3_749" = "1091421668"

[HKCU\Software\Aas\695404737]
"50183847" = "6CB4F357E15540EBCF387CD502BE18BB83B2095EA6EE884B0D059449A5342D68E3B2D27FB714B9250509608EC3DEB7EEA20A33E26D97C5486AA270018FFA46A16EE0AF4EE22779AE1BD1BBA23B356C014518440564740352676BB249C23112961C700B388C12E7360016EE2DAFC09E2689A619CC82C6AA0421112571C15FFB27"

[HKCU\Software\Aas]
"a2_845" = "1762935566"
"a2_844" = "1755771557"
"a2_847" = "1777279974"
"a2_846" = "1770103225"
"a2_841" = "1734235582"
"a2_840" = "1727087911"
"a2_843" = "1748604349"
"a2_842" = "1741437274"
"a3_780" = "1280228773"
"a4_928" = "2357976992"
"a2_849" = "1791622647"
"a2_848" = "1784455103"
"a1_312" = "3819871366"
"a1_313" = "2786066666"
"a1_310" = "3040310021"
"a1_311" = "2927681890"
"a1_316" = "2846395282"
"a1_317" = "2851048304"
"a1_314" = "3528122027"
"a1_315" = "1004600672"
"a3_620" = "166490309"
"a1_318" = "3734636480"
"a1_319" = "1983360650"
"a4_929" = "2365146113"
"a4_982" = "2745109526"
"a2_449" = "3218937964"
"a2_448" = "3211757963"
"a3_621" = "140449124"
"a2_441" = "3161534247"
"a2_440" = "3154415999"
"a2_443" = "3175915884"
"a2_442" = "3168752445"
"a2_445" = "3190252478"
"a2_444" = "3183083755"
"a2_447" = "3204602964"
"a2_446" = "3197434905"
"a2_939" = "2436839468"
"a2_938" = "2429673184"
"a4_893" = "2107057757"
"a2_931" = "2379486943"
"a2_930" = "2372318900"
"a2_933" = "2393819338"
"a2_932" = "2386646254"
"a2_935" = "2408153891"
"a2_934" = "2400986519"
"a2_937" = "2422504878"
"a2_936" = "2415336696"
"a3_818" = "1552537563"
"a2_711" = "802280408"
"a2_710" = "795113485"
"a2_713" = "816612675"
"a2_712" = "809450247"
"a2_715" = "830948209"
"a2_714" = "823776679"
"a2_717" = "845283898"
"a2_716" = "838117002"
"a2_719" = "859632975"
"a2_718" = "852463669"
"a1_587" = "4067339710"
"a3_623" = "187965990"
"a2_629" = "214414490"
"a2_628" = "207234630"
"a2_625" = "185730622"
"a2_624" = "178555322"
"a2_627" = "200065727"
"a2_626" = "192894163"
"a2_621" = "157050854"
"a2_620" = "149882631"
"a2_623" = "171398812"
"a2_622" = "164230159"
"a1_266" = "111022338"
"a1_267" = "3448001145"
"a1_264" = "381936214"
"a1_265" = "3528663725"
"a1_262" = "3900622840"
"a1_263" = "2010963452"
"a1_260" = "2489818314"
"a1_261" = "202775387"
"a1_268" = "2682259513"
"a1_269" = "2491248933"
"a2_157" = "1125553938"
"a2_156" = "1118384998"
"a2_155" = "1111220092"
"a2_154" = "1104051287"
"a2_153" = "1096865843"
"a2_152" = "1089703823"
"a2_99" = "709742245"
"a2_98" = "702574728"
"a2_97" = "695408273"
"a2_96" = "688241775"
"a2_95" = "681059681"
"a2_94" = "673891006"
"a2_93" = "666719794"
"a2_92" = "659556167"
"a2_91" = "652392476"
"a2_90" = "645222588"
"a3_260" = "1847236781"
"a3_261" = "1854160076"
"a3_262" = "1861734767"
"a3_263" = "1902212494"
"a3_264" = "1909255713"
"a3_265" = "1883210304"
"a3_266" = "1890133731"
"a3_267" = "1930746626"
"a3_268" = "1938194341"
"a3_269" = "1945179076"
"a1_915" = "3870699722"
"a1_847" = "3320548042"
"a3_404" = "2913010493"
"a1_844" = "3124320206"
"a3_405" = "2886510428"
"a1_845" = "2335223057"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Aas]
"a2_862" = "1884809029"
"a4_983" = "2752278647"
"a1_961" = "2436978658"
"a3_668" = "477267765"
"a3_669" = "484195156"
"a1_960" = "3709616148"
"a3_664" = "448737713"
"a3_665" = "489346512"
"a3_666" = "496258675"
"a3_667" = "470278802"
"a3_660" = "453353533"
"a3_661" = "460801116"
"a3_662" = "467859711"
"a3_663" = "441294110"
"a3_43" = "324843106"
"a3_42" = "284237251"
"a3_41" = "277248416"
"a3_40" = "269796609"
"a3_47" = "353765350"
"a3_46" = "313221959"
"a3_45" = "305778468"
"a3_44" = "332278405"
"a1_965" = "2489849739"
"a3_49" = "368270520"
"a3_48" = "360822809"
"a1_964" = "2784722794"
"a4_99" = "709742979"
"a4_98" = "702573858"
"a3_406" = "2893962239"
"a3_407" = "2901015582"
"a3_400" = "2884615609"
"a3_401" = "2857980376"
"a3_402" = "2865023611"
"a3_403" = "2906025626"
"a4_91" = "652390011"
"a4_90" = "645220890"
"a4_93" = "666728253"
"a4_92" = "659559132"
"a4_95" = "681066495"
"a4_94" = "673897374"
"a4_97" = "695404737"
"a4_96" = "688235616"

[HKLM\SOFTWARE\Microsoft\Security Center\Svc]
"FirewallOverride" = "1"

[HKCU\Software\Aas]
"a1_448" = "2003452791"
"a1_449" = "1303049744"
"a1_446" = "1238044738"
"a3_408" = "2941554865"
"a1_444" = "3454396334"
"a1_445" = "3077017137"
"a1_442" = "3915032418"
"a1_443" = "2429165952"
"a1_440" = "943996141"
"a3_409" = "2949002448"
"a1_680" = "3041285910"
"a1_681" = "3847065471"
"a1_682" = "702873560"
"a1_683" = "2017415829"
"a2_561" = "4021871025"
"a1_685" = "1778508968"
"a1_686" = "2513697269"
"a1_687" = "1030797078"
"a1_688" = "3557789165"
"a1_689" = "3032221795"

"a3_834" = "1700949547"
"a3_988" = "2804681845"
"a1_767" = "372725481"
"a1_766" = "4200567118"
"a3_318" = "2262948439"
"a3_319" = "2303950582"
"a2_599" = "4294297656"
"a3_310" = "2239031135"
"a3_311" = "2246548478"
"a3_312" = "2219916305"
"a3_313" = "2226966704"
"a3_314" = "2267968723"
"a3_315" = "2275010930"
"a3_316" = "2248445333"
"a3_317" = "2255889972"
"a3_933" = "2410528684"
"a3_934" = "2384417743"
"a1_760" = "3613710918"
"a2_605" = "42345804"
"a3_935" = "2391471214"
"a3_476" = "3395669621"
"a1_447" = "2114957291"
"a2_603" = "28010347"
"a3_880" = "2030724953"
"a3_881" = "2037718008"
"a3_882" = "2044771355"
"a3_883" = "2018660538"
"a3_884" = "2025714909"
"a3_885" = "2066704764"
"a3_886" = "2073693599"
"a1_745" = "3270420727"
"a3_888" = "2054642257"
"a3_889" = "2061696752"
"a1_769" = "3284740514"
"a1_441" = "3508482003"
"a4_964" = "2616065348"
"a1_744" = "531890365"
"a4_988" = "2788124252"
"a4_857" = "1848969401"
"a4_638" = "278931902"
"a4_639" = "286101023"
"a4_634" = "250255418"
"a4_635" = "257424539"
"a4_636" = "264593660"
"a4_637" = "271762781"
"a4_630" = "221578934"
"a4_631" = "228748055"
"a4_632" = "235917176"
"a4_633" = "243086297"
"a2_913" = "2250434618"
"a1_747" = "4192727822"
"a2_912" = "2243279047"

"a2_651" = "372139467"
"a2_910" = "2228940953"
"a3_794" = "1380597491"

[HKCU\Software\Aas\695404737]
"35845605" = "392"

[HKCU\Software\Aas]
"a2_917" = "2279118185"
"a4_883" = "2035366547"
"a2_916" = "2271949513"
"a4_740" = "1010182244"
"a4_741" = "1017351365"
"a4_742" = "1024520486"
"a4_743" = "1031689607"
"a4_744" = "1038858728"
"a4_745" = "1046027849"
"a4_746" = "1053196970"
"a4_747" = "1060366091"
"a4_748" = "1067535212"
"a4_749" = "1074704333"
"a1_866" = "125715980"
"a1_867" = "233769529"
"a1_860" = "3968243808"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Aas]
"a1_862" = "1011691308"
"a4_859" = "1863307643"
"a4_182" = "1304780022"

[HKLM\SOFTWARE\Microsoft\Security Center]
"UpdatesDisableNotify" = "1"

[HKCU\Software\Aas]
"a4_180" = "1290441780"
"a4_181" = "1297610901"
"a4_186" = "1333456506"
"a4_187" = "1340625627"
"a4_184" = "1319118264"
"a4_185" = "1326287385"
"a4_188" = "1347794748"
"a4_189" = "1354963869"
"a1_741" = "1673045916"
"a2_918" = "2286283069"
"a4_168" = "1204412328"
"a1_194" = "2836346583"
"a1_195" = "1821925306"
"a4_160" = "1147059360"
"a4_161" = "1154228481"
"a4_162" = "1161397602"
"a4_163" = "1168566723"
"a4_164" = "1175735844"
"a4_165" = "1182904965"
"a4_166" = "1190074086"
"a4_167" = "1197243207"
"a4_296" = "2122059816"
"a4_297" = "2129228937"
"a4_294" = "2107721574"
"a4_295" = "2114890695"
"a4_292" = "2093383332"
"a4_293" = "2100552453"
"a4_290" = "2079045090"
"a4_291" = "2086214211"
"a4_142" = "1018015182"
"a3_952" = "2546868881"
"a4_568" = "4072060728"
"a4_569" = "4079229849"
"a4_298" = "2136398058"
"a4_299" = "2143567179"
"a2_598" = "4287129550"
"a1_192" = "280442480"
"a1_193" = "3416450193"
"a1_969" = "3321725286"
"a4_934" = "2400991718"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Aas]
"a3_790" = "1351657855"
"a4_958" = "2573050622"
"a1_742" = "3356220031"
"a4_368" = "2638236528"
"a4_369" = "2645405649"
"a4_362" = "2595221802"
"a4_363" = "2602390923"
"a4_360" = "2580883560"
"a4_361" = "2588052681"
"a4_366" = "2623898286"
"a4_367" = "2631067407"
"a4_364" = "2609560044"
"a4_365" = "2616729165"
"a1_305" = "2230354836"
"a1_304" = "3740212271"
"a1_307" = "628174094"
"a1_306" = "875251388"
"a1_301" = "4148314555"
"a1_300" = "1600133596"
"a1_303" = "3729187222"
"a1_302" = "2731034335"
"a3_792" = "1399711281"
"a1_309" = "2141754304"
"a1_308" = "247478898"
"a2_540" = "3871319680"
"a2_541" = "3878500711"
"a2_542" = "3885671803"
"a1_481" = "2306915864"
"a2_544" = "3900005035"
"a2_545" = "3907162520"
"a2_546" = "3914337625"
"a2_547" = "3921506299"
"a2_548" = "3928672355"
"a2_549" = "3935854680"
"a2_894" = "2114230257"
"a2_895" = "2121387716"
"a2_892" = "2099895535"
"a2_893" = "2107061210"
"a2_890" = "2085547143"
"a2_891" = "2092714948"
"a2_438" = "3140067025"
"a2_439" = "3147249612"
"a2_434" = "3111402469"
"a2_435" = "3118565705"
"a2_436" = "3125731983"
"a2_437" = "3132902620"
"a2_430" = "3082718761"
"a2_431" = "3089885733"
"a2_432" = "3097066026"
"a2_433" = "3104232631"
"a4_986" = "2773786010"
"a2_948" = "2501356571"
"a2_949" = "2508523071"
"a4_908" = "2214594572"
"a2_944" = "2472686263"
"a2_945" = "2479860720"
"a2_946" = "2487022284"
"a2_947" = "2494188529"
"a2_940" = "2443981387"
"a1_488" = "2682390149"
"a2_942" = "2458338107"
"a2_943" = "2465520290"
"a1_279" = "1935651083"
"a1_278" = "849036429"
"a1_489" = "3841684883"
"a1_271" = "3370829170"
"a1_270" = "1081057523"
"a1_273" = "3726631589"
"a1_272" = "1263535045"
"a1_275" = "2967339549"
"a1_274" = "214419085"
"a1_277" = "1179446956"
"a1_276" = "2988592622"
"a2_764" = "1182238881"
"a2_765" = "1189407629"
"a2_766" = "1196572824"
"a2_767" = "1203743096"
"a2_760" = "1153558308"
"a2_761" = "1160740473"
"a2_762" = "1167905084"
"a2_763" = "1175075652"
"a2_768" = "1210924709"
"a2_769" = "1218091206"
"a2_382" = "2738612793"
"a2_383" = "2745775840"
"a2_380" = "2724259296"
"a2_381" = "2731438871"
"a2_386" = "2767274350"
"a2_387" = "2774444176"
"a2_384" = "2752938096"
"a2_385" = "2760108962"
"a2_388" = "2781624868"
"a2_389" = "2788791114"
"a1_613" = "2760849028"
"a1_612" = "2249742229"
"a1_611" = "4277263933"
"a2_368" = "2638245562"
"a2_369" = "2645406414"
"a1_610" = "2650642588"
"a2_88" = "630888845"
"a2_89" = "638043752"
"a2_84" = "602207885"
"a2_85" = "609370691"
"a2_86" = "616538265"
"a2_87" = "623706461"
"a2_80" = "573522566"
"a2_81" = "580703258"
"a2_82" = "587873395"
"a2_83" = "595044724"
"a3_273" = "1974165848"
"a3_272" = "1966722361"
"a3_271" = "1926113414"
"a3_270" = "1918678119"
"a3_277" = "2002712284"
"a3_276" = "1962103485"
"a3_275" = "1954659866"
"a3_274" = "1947600379"
"a2_162" = "1161400527"
"a2_163" = "1168571996"
"a3_279" = "1983582110"
"a3_278" = "2009623423"
"a2_166" = "1190068560"
"a2_167" = "1197237342"
"a2_164" = "1175738421"
"a2_165" = "1182901511"
"a3_690" = "668723035"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Aas]
"a3_679" = "589715310"
"a1_666" = "3086481043"
"a3_677" = "541662892"
"a3_676" = "568228365"
"a3_675" = "560775658"
"a3_674" = "553725259"
"a3_673" = "513247528"
"a3_672" = "505681033"
"a3_671" = "532246550"
"a3_670" = "525328375"
"a3_50" = "341766363"
"a3_51" = "348755322"
"a3_52" = "389745053"
"a3_53" = "396796476"
"a3_54" = "370165343"
"a3_55" = "377748222"
"a3_56" = "384737041"
"a3_57" = "425210800"
"a3_58" = "432789459"
"a3_59" = "406145138"
"a3_417" = "3006523432"
"a3_416" = "2965403529"
"a3_415" = "2958480150"
"a3_414" = "2984984311"
"a3_413" = "2977536596"
"a3_412" = "2970543669"
"a3_411" = "2929937810"
"a3_410" = "2922490227"
"a3_419" = "2986877162"
"a3_418" = "3013512267"
"a1_451" = "1085254316"
"a1_450" = "2466095414"
"a1_453" = "2958022675"
"a1_452" = "2535312120"
"a1_455" = "2196288346"
"a1_454" = "1506674205"
"a1_457" = "2791275894"
"a1_456" = "1071586164"
"a1_459" = "1209984410"
"a1_458" = "3565546295"
"a1_693" = "3176184366"
"a1_692" = "1156189511"
"a1_691" = "565776225"
"a1_690" = "1826269644"
"a1_697" = "2210684331"
"a1_696" = "4243275720"
"a1_695" = "3133335595"
"a1_694" = "1306517389"
"a1_699" = "1275703970"
"a1_698" = "3181596360"
"a3_896" = "2145139113"
"a3_695" = "704178558"
"a1_962" = "2288962635"
"a3_309" = "2231976764"
"a3_308" = "2191503005"
"a3_303" = "2155521254"
"a3_302" = "2148466759"
"a3_301" = "2174512164"
"a3_300" = "2167589765"
"a3_307" = "2183924346"
"a3_306" = "2210566619"
"a3_305" = "2203581880"
"a3_304" = "2162448665"
"a4_86" = "616544406"
"a4_87" = "623713527"
"a4_84" = "602206164"
"a4_85" = "609375285"
"a4_82" = "587867922"
"a4_83" = "595037043"
"a4_80" = "573529680"
"a4_81" = "580698801"
"a3_887" = "2047190590"
"a3_730" = "921917107"
"a4_88" = "630882648"
"a4_89" = "638051769"
"a3_731" = "962513618"
"a4_954" = "2544374138"

[HKCU\Software\Aas\695404737]
"14338242" = "0"

[HKCU\Software\Aas]
"a3_913" = "2267125720"
"a3_736" = "998505673"
"a1_740" = "1899125561"
"a3_737" = "1005490536"
"a3_697" = "685057584"
"a3_892" = "2083171285"
"a3_891" = "2109683634"
"a3_890" = "2102235923"
"a3_897" = "2119163336"
"a3_734" = "950445111"
"a3_895" = "2138211638"
"a3_894" = "2131222679"
"a3_899" = "2166680202"
"a3_735" = "990926934"
"a3_696" = "678137233"
"a1_967" = "2220260816"
"a4_387" = "2774449827"
"a1_940" = "11233397"
"a1_752" = "1287001678"
"a4_629" = "214409813"
"a4_628" = "207240692"
"a4_627" = "200071571"
"a4_626" = "192902450"
"a4_625" = "185733329"
"a4_624" = "178564208"
"a4_623" = "171395087"
"a4_622" = "164225966"
"a4_621" = "157056845"
"a4_620" = "149887724"
"a2_75" = "537686347"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012015011920150120]
"CacheRepair" = "0"

[HKCU\Software\Aas]
"a2_74" = "530523545"
"a1_763" = "540288033"
"a2_77" = "552020161"
"a2_76" = "544855382"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"GlobalUserOffline" = "0"

[HKCU\Software\Aas]
"a2_71" = "509003044"
"a2_70" = "501831500"
"a4_753" = "1103380817"
"a4_752" = "1096211696"
"a4_751" = "1089042575"
"a4_750" = "1081873454"
"a4_757" = "1132057301"
"a2_73" = "523353230"
"a4_755" = "1117719059"
"a4_754" = "1110549938"
"a1_877" = "414572315"
"a1_876" = "843671122"
"a4_759" = "1146395543"
"a2_72" = "516173612"
"a1_873" = "3440390790"
"a1_872" = "2776605733"
"a1_871" = "3350730932"
"a1_870" = "338688664"
"a4_195" = "1397978595"
"a4_194" = "1390809474"
"a4_197" = "1412316837"
"a4_196" = "1405147716"
"a4_191" = "1369302111"
"a4_190" = "1362132990"
"a4_193" = "1383640353"
"a4_192" = "1376471232"

[HKLM\SOFTWARE\Microsoft\Security Center\Svc]
"FirewallDisableNotify" = "1"

[HKCU\Software\Aas]
"a4_198" = "1419485958"
"a1_909" = "3467218353"
"a4_179" = "1283272659"
"a4_178" = "1276103538"
"a4_173" = "1240257933"
"a4_172" = "1233088812"
"a4_171" = "1225919691"
"a4_170" = "1218750570"
"a4_177" = "1268934417"
"a4_176" = "1261765296"
"a4_175" = "1254596175"
"a4_174" = "1247427054"
"a4_577" = "4136582817"
"a3_123" = "898388146"
"a4_575" = "4122244575"
"a4_574" = "4115075454"
"a4_573" = "4107906333"
"a4_572" = "4100737212"
"a4_571" = "4093568091"
"a3_122" = "891468819"
"a4_970" = "2659080074"
"a3_121" = "850861040"
"a4_579" = "4150921059"
"a4_578" = "4143751938"
"a4_289" = "2071875969"
"a4_288" = "2064706848"
"a3_636" = "247859925"
"a3_120" = "843343697"
"a4_985" = "2766616889"
"a4_281" = "2014523001"
"a4_280" = "2007353880"
"a4_283" = "2028861243"
"a1_108" = "3931418661"
"a4_285" = "2043199485"
"a4_284" = "2036030364"
"a4_287" = "2057537727"
"a3_126" = "886312343"
"a3_125" = "879323508"
"a3_124" = "905966805"
"a4_965" = "2623234469"
"a3_691" = "642161658"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache]
"@xpsp3res.dll,-20001" = "Diagnose Connection Problems..."

[HKCU\Software\Aas]
"a3_967" = "2620735566"
"a4_379" = "2717096859"
"a4_378" = "2709927738"
"a3_966" = "2647370799"
"a4_375" = "2688420375"
"a4_374" = "2681251254"
"a4_377" = "2702758617"
"a4_376" = "2695589496"
"a4_371" = "2659743891"
"a4_370" = "2652574770"
"a4_373" = "2674082133"
"a4_372" = "2666913012"
"a3_964" = "2599327597"
"a3_963" = "2592338634"
"a3_962" = "2584764075"
"a4_756" = "1124888180"
"a3_961" = "2611395080"
"a1_755" = "2779367746"
"a1_437" = "1300325345"
"a3_960" = "2604335593"
"a2_553" = "3964532388"
"a2_552" = "3957352626"
"a2_551" = "3950187486"
"a2_550" = "3943021934"
"a2_557" = "3993191182"
"a2_556" = "3986037187"
"a2_555" = "3978855187"
"a2_554" = "3971689997"
"a2_889" = "2078379701"
"a2_888" = "2071203887"
"a2_559" = "4007540207"
"a2_558" = "4000376857"
"a4_980" = "2730771284"
"a4_981" = "2737940405"
"a2_429" = "3075551000"
"a2_428" = "3068382096"
"a2_427" = "3061216985"
"a2_426" = "3054048884"
"a2_425" = "3046868516"
"a2_424" = "3039713535"
"a2_423" = "3032532040"
"a2_422" = "3025365043"
"a2_421" = "3018207316"
"a2_420" = "3011033107"
"a1_758" = "3233759595"
"a2_565" = "4050528322"
"a4_984" = "2759447768"
"a2_959" = "2580224692"
"a2_958" = "2573055545"
"a2_957" = "2565875370"
"a2_956" = "2558707330"
"a2_955" = "2551538340"
"a2_954" = "2544382253"
"a1_785" = "2009955003"
"a2_952" = "2530039677"
"a2_951" = "2522873447"
"a2_950" = "2515691761"
"a1_208" = "2131883765"
"a1_209" = "4065736513"
"a1_204" = "2720007154"
"a1_205" = "1112691880"
"a1_206" = "2109311920"
"a1_207" = "849855864"
"a1_200" = "2822967709"
"a1_201" = "1218510599"
"a1_202" = "716111412"
"a1_203" = "2032762318"
"a2_777" = "1275431506"
"a2_776" = "1268273463"
"a2_775" = "1261108505"
"a2_774" = "1253926585"
"a2_773" = "1246756914"
"a2_772" = "1239589151"
"a2_771" = "1232421956"
"a2_770" = "1225258149"
"a2_779" = "1289776892"
"a2_778" = "1282611449"
"a2_395" = "2831808561"
"a2_394" = "2824628957"
"a2_397" = "2846143467"
"a2_396" = "2838977511"
"a2_391" = "2803135981"
"a2_390" = "2795961679"
"a2_393" = "2817460204"
"a2_392" = "2810290469"
"a2_399" = "2860478200"
"a2_398" = "2853318389"
"a2_568" = "4072057440"
"a2_569" = "4079226094"
"a2_379" = "2717090036"
"a2_378" = "2709925253"
"a2_373" = "2674088805"
"a2_372" = "2666906145"
"a2_371" = "2659741676"
"a2_370" = "2652583711"
"a2_377" = "2702756958"
"a2_376" = "2695581283"
"a2_375" = "2688422004"
"a2_374" = "2681257823"
"a3_246" = "1746738975"
"a3_247" = "1753789374"
"a3_244" = "1765852765"
"a3_245" = "1773304572"
"a2_179" = "1283274313"
"a2_178" = "1276105941"

[HKLM\SOFTWARE\Microsoft\Security Center]
"FirewallDisableNotify" = "1"

[HKCU\Software\Aas]
"a3_241" = "1744311672"
"a2_175" = "1254603653"
"a2_174" = "1247421363"
"a2_177" = "1268936994"
"a2_176" = "1261771655"
"a2_171" = "1225922080"
"a2_170" = "1218753943"
"a2_173" = "1240256161"
"a3_249" = "1801832560"
"a4_960" = "2587388864"
"a1_510" = "1346553486"
"a1_511" = "424871713"
"a1_512" = "1593648348"
"a1_513" = "478279730"
"a1_514" = "3419063676"
"a1_515" = "123049086"
"a1_516" = "2656812881"
"a1_517" = "2848522932"
"a1_518" = "3680477989"
"a1_519" = "2449179422"
"a3_648" = "367361953"
"a3_649" = "340792256"
"a3_69" = "478110732"
"a3_68" = "470664173"
"a3_65" = "449123976"
"a3_64" = "442135145"
"a3_67" = "497168202"
"a3_66" = "489720619"
"a3_61" = "454263092"
"a3_60" = "413199509"
"a3_63" = "468244982"
"a3_62" = "461186391"
"a1_784" = "1774879029"
"a3_514" = "3667976427"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKCU\Software\Aas]
"a2_543" = "3892824542"
"a1_424" = "3324325587"
"a1_425" = "939098807"
"a1_426" = "561638197"
"a1_427" = "1055436944"
"a1_420" = "4096181874"
"a1_421" = "2689638149"
"a1_422" = "1555697851"
"a1_423" = "221656113"
"a3_199" = "1409969486"
"a1_428" = "582741222"
"a1_429" = "1106802857"
"a3_515" = "3709043978"
"a3_693" = "690213052"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012015011920150120]
"CacheLimit" = "8192"

[HKCU\Software\Aas]
"a2_965" = "2623261970"
"a3_338" = "2439897659"
"a3_339" = "2446886490"
"a3_336" = "2391856505"
"a3_337" = "2432846232"
"a3_334" = "2411437223"
"a3_335" = "2384801990"
"a3_332" = "2363312101"
"a3_333" = "2403923972"
"a3_330" = "2348814115"
"a3_331" = "2356388674"
"a1_738" = "873627387"
"a1_739" = "3347331286"
"a3_428" = "3084957701"
"a3_429" = "3058850980"
"a3_422" = "3041926607"
"a3_423" = "3049502318"
"a3_420" = "2994455821"
"a3_421" = "3001383340"
"a3_426" = "3070911299"
"a3_427" = "3077900258"
"a3_424" = "3022858881"
"a3_425" = "3029913376"
"a1_864" = "226863950"
"a2_915" = "2264783316"
"a1_865" = "823902583"
"a4_870" = "1942167974"
"a4_873" = "1963675337"
"a1_861" = "3490327683"
"a1_863" = "4082146769"
"a3_87" = "607024862"
"a3_86" = "633131711"
"a3_85" = "626081308"
"a3_84" = "585598461"
"a3_83" = "578085210"
"a3_82" = "571034939"
"a3_81" = "597665944"
"a4_183" = "1311949143"
"a3_89" = "654610320"
"a3_88" = "614067057"
"a4_612" = "92534756"
"a4_613" = "99703877"
"a4_610" = "78196514"
"a4_611" = "85365635"
"a4_616" = "121211240"
"a4_617" = "128380361"
"a4_614" = "106872998"
"a4_615" = "114042119"
"a4_968" = "2644741832"
"a4_969" = "2651910953"
"a4_618" = "135549482"
"a4_619" = "142718603"

"a4_871" = "1949337095"
"a3_689" = "661144376"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKCU\Software\Aas]
"a3_812" = "1543047557"
"a3_692" = "649083933"
"a4_876" = "1985182700"
"a4_766" = "1196579390"
"a4_767" = "1203748511"
"a4_764" = "1182241148"
"a4_765" = "1189410269"
"a4_762" = "1167902906"
"a4_763" = "1175072027"
"a4_760" = "1153564664"
"a4_761" = "1160733785"
"a1_848" = "1286589711"
"a1_849" = "2246313997"
"a1_439" = "3497446046"
"a4_768" = "1210917632"
"a4_769" = "1218086753"
"a3_938" = "2446500163"
"a3_512" = "3687557161"
"a2_662" = "450987935"
"a3_513" = "3660926024"
"a3_930" = "2355479115"
"a3_931" = "2362926826"
"a3_932" = "2403474189"
"a3_814" = "1523992135"
"a4_877" = "1992351821"
"a3_510" = "3639513879"
"a3_936" = "2398382209"
"a3_937" = "2439449888"
"a3_511" = "3679991734"
"a3_516" = "3715971501"
"a3_517" = "3723025868"
"a1_198" = "733386680"
"a1_199" = "1230627390"
"a4_148" = "1061029908"
"a4_149" = "1068199029"
"a4_146" = "1046691666"
"a4_147" = "1053860787"
"a1_196" = "3341748621"
"a4_145" = "1039522545"
"a1_190" = "908033904"
"a4_143" = "1025184303"
"a4_140" = "1003676940"
"a4_141" = "1010846061"
"a2_983" = "2752272368"
"a3_910" = "2245638887"
"a4_548" = "3928678308"
"a4_549" = "3935847429"
"a4_542" = "3885663582"
"a4_543" = "3892832703"
"a4_540" = "3871325340"
"a4_541" = "3878494461"
"a4_546" = "3914340066"
"a4_547" = "3921509187"
"a4_544" = "3900001824"
"a4_545" = "3907170945"
"a4_839" = "1719925223"
"a1_662" = "1622896514"
"a1_663" = "200814178"
"a3_965" = "2639793036"
"a1_660" = "958784077"
"a4_380" = "2724265980"
"a4_381" = "2731435101"
"a4_382" = "2738604222"
"a4_383" = "2745773343"
"a4_384" = "2752942464"
"a4_385" = "2760111585"
"a4_386" = "2767280706"
"a4_169" = "1211581449"
"a4_388" = "2781618948"
"a4_389" = "2788788069"

"a1_667" = "2174499302"
"a1_664" = "2304878374"

[HKLM\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = "1"

[HKCU\Software\Aas]
"a1_665" = "1211862743"
"a1_0" = "4092103001"
"a1_1" = "3542201012"
"a1_2" = "4074786672"
"a1_3" = "2074005661"
"a1_4" = "3894258262"
"a1_5" = "2381088440"
"a1_6" = "102310160"
"a1_7" = "1358400507"
"a1_8" = "1887961564"
"a1_9" = "181482553"
"a2_566" = "4057724136"
"a2_567" = "4064888248"
"a2_564" = "4043387571"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system]
"EnableLUA" = "0"

[HKCU\Software\Aas]
"a2_562" = "4029040677"
"a2_563" = "4036220516"
"a3_8" = "40388897"
"a3_9" = "47967552"
"a3_6" = "59977839"
"a3_7" = "67032206"
"a3_4" = "11991981"
"a3_5" = "52535244"
"a3_2" = "31040235"
"a3_3" = "4933386"
"a3_0" = "17001001"
"a3_1" = "23989832"
"a2_412" = "2953680700"
"a2_413" = "2960845893"
"a2_410" = "2939346186"
"a2_411" = "2946514694"
"a2_416" = "2982349647"
"a2_417" = "2989531715"
"a2_414" = "2968011145"
"a2_415" = "2975182344"
"a2_418" = "2996697387"
"a2_419" = "3003866612"
"a2_962" = "2601723964"
"a2_963" = "2608892692"
"a2_960" = "2587393706"
"a2_961" = "2594556410"
"a2_966" = "2630409789"
"a2_967" = "2637577408"
"a2_964" = "2616059048"
"a4_950" = "2515697654"
"a1_631" = "2305835086"
"a2_968" = "2644748524"
"a2_969" = "2651907810"
"a4_564" = "4043384244"
"a1_219" = "1833392034"
"a1_218" = "3048295630"
"a1_217" = "1954670213"
"a1_216" = "1728477980"
"a1_215" = "1015481543"
"a1_214" = "2252051801"
"a1_213" = "644237536"
"a1_212" = "1018390415"
"a1_211" = "718200905"
"a1_210" = "2731424700"
"a2_988" = "2788127027"
"a4_567" = "4064891607"
"a1_630" = "3305581039"
"a2_980" = "2730777459"
"a4_560" = "4014707760"
"a2_982" = "2745118357"
"a4_956" = "2558712380"
"a2_984" = "2759445605"
"a2_985" = "2766613570"
"a2_986" = "2773781237"
"a4_561" = "4021876881"
"a4_562" = "4029046002"
"a4_563" = "4036215123"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012015011920150120]
"CacheOptions" = "11"

[HKCU\Software\Aas]
"a4_443" = "3175920603"
"a1_633" = "1487517847"
"a4_442" = "3168751482"
"a4_441" = "3161582361"

Adds a rule to the firewall Windows which allows any network activity:

[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\c:]
"%original file name%.exe" = "c:\%original file name%.exe:*:Enabled:ipsec"

A firewall is disabled:

[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = "0"

The Worm modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass" = "1"

Antivirus notifications are disabled:

[HKLM\SOFTWARE\Microsoft\Security Center]
"AntiVirusDisableNotify" = "1"

The Worm modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

Firewall notifications are disabled:

[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = "1"

The Worm modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

Antivirus notifications are disabled:

[HKLM\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusDisableNotify" = "1"

The Worm deletes the following registry key(s):

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012013041720130418]

The Worm deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

Dropped PE files

MD5	File path
18a9df4a7a61f785458a519ad7183725	c:\jwqutd.pif

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

A worm can spread via removable drives. It writes its executable and creates "autorun.inf" scripts on all removable drives. The autorun script will execute the Worm's file once a user opens a drive's folder in Windows Explorer.

Removals

Remove it with Ad-Aware

Click (here) to download and install Ad-Aware Free Antivirus.
Update the definition files.
Run a full scan of your computer.

Manual removal*

Terminate malicious process(es) (How to End a Process With the Task Manager):
mscorsvw.exe:1912
Delete the original Worm file.
Delete or disinfect the following files created/modified by the Worm:
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\f[1].txt (3928 bytes)
%WinDir%\system.ini (72 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\winhqka.exe (741 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\market[1].js (329 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\fad58-8688a[2].css (21 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\gradientbg[1].png (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\eulastep-101727[1] (3470 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\fad58-8688a[1].css (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\f[1].txt (21610 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\CA0EWZZT.gif (35 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\pubads_impl_56[2].js (4051 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@softonic[2].txt (301 bytes)
C:\autorun.inf (245 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\dorothy[1].js (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\desktop.ini (67 bytes)
C:\jwqutd.pif (99 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\teamspeak-2-11[1].jpg (1281 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\sd_100861_41d97[1].jpg (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\sprite[1].png (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\eulastep-101727[1].htm (1275 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@softonic[1].txt (478 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\loading[1].gif (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\amzn_ads[1].js (1969 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\sd_101633_08ebf[1].jpg (261 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\5ca1e-31ef7[1].js (9052 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\CAHI7XHU.gif (35 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\CAW5UNGL.gif (35 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@rubiconproject[1].txt (246 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\universaldownloader-prefetch[1].htm (2888 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\CA9CT0X9.gif (35 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\cc92a7d66e[1].setToken (25 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\dorothy[2].js (23 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\f[2].txt (6943 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@sd.softonic[1].txt (17340 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\CASVJF64.gif (35 bytes)
%Program Files%\Common Files\Java\Java Update\jusched.exe (272 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\CAWPA9DU.gif (35 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\container[1].html (619 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\CA6DU5G9.gif (35 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\analytics[1].js (842 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\sd_101633_08ebf[1].jpg (261 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\container[1].htm (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\sd_100861_41d97[1].jpg (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\market[2].js (1668 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\bid[1].pl/21547/universaldownloader/campaign-100861,101633/eulastep-101727?sd_timestamp=1421668077&cb=3030167 (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\CA9KKN5H.gif (35 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\CAEFS5IF.gif (35 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\CAXCVYZN.gif (35 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@sd.softonic[2].txt (16395 bytes)
%Program Files%\Adobe\Reader 9.0\Reader\Reader_sl.exe (840 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\sd_icon_100861_8a4a3[1].png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\CAO7UL25.gif (35 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\market[1].js (945 bytes)
%Documents and Settings%\%current user%\Cookies\index.dat (31812 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\pubads_impl_56[1].js (2696 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\market[2].js (505 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\desktop.ini (67 bytes)
Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
Find and delete all copies of the worm's file together with "autorun.inf" scripts on removable drives.
Reboot the computer.

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

VersionInfo

Company Name: Softonic
Product Name: Softonic Downloader
Product Version: 1, 40, 1, 0
Legal Copyright: Copyright (C) 2013
Legal Trademarks:
Original Filename: SoftonicDownloader.exe
Internal Name: Softonic Downloader
File Version: 1, 40, 1, 0
File Description: Softonic Downloader
Comments:
Language: English (United States)

Company Name: Softonic Product Name: Softonic Downloader Product Version: 1, 40, 1, 0Legal Copyright: Copyright (C) 2013Legal Trademarks: Original Filename: SoftonicDownloader.exe Internal Name: Softonic Downloader File Version: 1, 40, 1, 0File Description: Softonic Downloader Comments: Language: English (United States)

PE Sections

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Section MD5
h70on7Kj	4096	1081344	0	0	d41d8cd98f00b204e9800998ecf8427e
XRLxieIn	1085440	360448	357376	5.54404	eb54b7f743ff6c9272221bdcb01561fd
.rsrc	1445888	81920	81920	5.35101	367a433e3c5e94315103725c616dff09

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Network Activity

URLs

URL	IP
hxxp://c.global-ssl.fastly.net/nr-476.min.js
hxxp://46.28.209.70/universaldownloader-track
hxxp://46.28.209.74/blank.gif?product=st_activity&event=prefetch:campaigns:selected&id_session=ED284C48-BEE8-43E5-ADF1-A8C43C9909D3t1421668077f21547&id_campaign=100861&id_campaign=101633&id_campaign=101727&ts=1421668078218
hxxp://74.125.228.201/r/collect?v=1&_v=j31&a=1415093474&t=pageview&_s=1&dl=http://sd.softonic.pl/21547/universaldownloader-prefetch&ul=en-us&de=utf-8&dt=Pobieranie i instalacja TeamSpeak 3&sd=32-bit&sr=1024x768&vp=650x450&je=0&fl=11.6 r602&_utma=176340583.1552066270.1421668072.1421668072.1421668072.1&_utmz=176340583.1421668072.1.1.utmcsr=(direct)\|utmccn=(direct)\|utmcmd=(none)&_utmht=1421668078343&_u=MQACAEAAI~&jid=726396425&cid=1552066270.1421668072&tid=UA-48247475-3&_r=1&z=561424862
hxxp://beacon.newrelic.com/1/cc92a7d66e?a=2337114&pl=1421668062968&v=476.c73f3a6&to=NQcAZUJXXUdWAEZdVwxNN0NZGVtAUwxRRxcLDAZUSBhDXEc=&ap=367&fe=15234&dc=8953&f=["err"]&jsonp=NREUM.setToken
hxxp://46.28.209.70/21547/universaldownloader/campaign-100861,101633/eulastep-101727?sd_timestamp=1421668077
hxxp://46.28.209.70/css/generated/fad58-8688a.css
hxxp://zdjecia.pl.sftcdn.net/pl/scrn/21000/21547/teamspeak-2-11.jpg	46.28.209.56
hxxp://screenshots.en.sftcdn.net/campaign/scrn/100000/100861/sd_100861_41d97.jpeg	46.28.209.52
hxxp://screenshots.en.sftcdn.net/campaign/scrn/100000/100861/sd_icon_100861_8a4a3.png	46.28.209.52
hxxp://screenshots.en.sftcdn.net/campaign/scrn/101000/101633/sd_101633_08ebf.jpeg	46.28.209.52
hxxp://46.28.209.70/shared/img/sd_client/gradientbg.png
hxxp://46.28.209.70/shared/img/sd_client/sprite.png
hxxp://d1ykf07e75w7ss.cloudfront.net/aax2/amzn_ads.js
hxxp://46.28.209.70/shared/img/sd_client/loading.gif
hxxp://aax-us-east.amazon-adsystem.com/e/dtb/bid?src=3177&u=http://sd.softonic.pl/21547/universaldownloader/campaign-100861,101633/eulastep-101727?sd_timestamp=1421668077&cb=3030167
hxxp://a1389.g.akamai.net/partner/scripts/rubicon/dorothy.js?pc=10496/44182
hxxp://anvil-perf-global.rubiconproject.net.akadns.net/a/api/market.js?&account_id=10496&site_id=44182&zone_id=191950&rtb_model=1&cb=oz_onValuationLoaded_191950_15&size_id=15
hxxp://anvil-perf-global.rubiconproject.net.akadns.net/a/api/market.js?&account_id=10496&site_id=44182&zone_id=191952&rtb_model=1&cb=oz_onValuationLoaded_191952_15&size_id=15
hxxp://74.125.228.201/analytics.js
hxxp://pagead46.l.doubleclick.net/tag/js/gpt.js
hxxp://74.125.228.201/__utm.gif?utmwv=5.4.6&utms=2&utmn=671250179&utmhn=sd.softonic.pl&utmcs=utf-8&utmsr=1024x768&utmvp=650x450&utmsc=32-bit&utmul=en-us&utmje=1&utmfl=11.6 r602&utmdt=Pobieranie i instalacja TeamSpeak 3&utmhid=1027184309&utmr=-&utmp=/21547/universaldownloader/campaign-100861,101633/eulastep-101727?sd_timestamp=1421668077&utmht=1421668083109&utmac=UA-48247475-1&utmcc=__utma=176340583.1552066270.1421668072.1421668072.1421668072.1;+__utmz=176340583.1421668072.1.1.utmcsr=(direct)\|utmccn=(direct)\|utmcmd=(none);&utmmt=1&utmu=qAAg~
hxxp://74.125.228.201/__utm.gif?utmwv=5.4.6&utms=3&utmn=1502296361&utmhn=sd.softonic.pl&utmcs=utf-8&utmsr=1024x768&utmvp=650x450&utmsc=32-bit&utmul=en-us&utmje=1&utmfl=11.6 r602&utmdt=Pobieranie i instalacja TeamSpeak 3&utmhid=1027184309&utmr=http://unknown_browser_unknown_version&utmp=/init_startup&utmht=1421668083328&utmac=UA-152357-4&utmcc=__utma=176340583.1552066270.1421668072.1421668072.1421668072.1;+__utmz=176340583.1421668072.1.1.utmcsr=(direct)\|utmccn=(direct)\|utmcmd=(none);&utmmt=1&utmu=qACgAAAAC~
hxxp://74.125.228.201/__utm.gif?utmwv=5.4.6&utms=4&utmn=498571742&utmhn=sd.softonic.pl&utmcs=utf-8&utmsr=1024x768&utmvp=650x450&utmsc=32-bit&utmul=en-us&utmje=1&utmfl=11.6 r602&utmdt=Pobieranie i instalacja TeamSpeak 3&utmhid=1027184309&utmr=http://unknown_browser_unknown_version&utmp=/start_api&utmht=1421668083374&utmac=UA-152357-4&utmcc=__utma=176340583.1552066270.1421668072.1421668072.1421668072.1;+__utmz=176340583.1421668072.1.1.utmcsr=(direct)\|utmccn=(direct)\|utmcmd=(none);&utmmt=1&utmu=qACgAAAAC~
hxxp://74.125.228.201/__utm.gif?utmwv=5.4.6&utms=5&utmn=432915247&utmhn=sd.softonic.pl&utmcs=utf-8&utmsr=1024x768&utmvp=650x450&utmsc=32-bit&utmul=en-us&utmje=1&utmfl=11.6 r602&utmdt=Pobieranie i instalacja TeamSpeak 3&utmhid=1027184309&utmr=http://unknown_browser_unknown_version&utmp=/legal_start&utmht=1421668083499&utmac=UA-152357-4&utmcc=__utma=176340583.1552066270.1421668072.1421668072.1421668072.1;+__utmz=176340583.1421668072.1.1.utmcsr=(direct)\|utmccn=(direct)\|utmcmd=(none);&utmmt=1&utmu=qACgAAAAC~
hxxp://74.125.228.201/__utm.gif?utmwv=5.4.6&utms=6&utmn=1822610648&utmhn=sd.softonic.pl&utmcs=utf-8&utmsr=1024x768&utmvp=650x450&utmsc=32-bit&utmul=en-us&utmje=1&utmfl=11.6 r602&utmdt=Pobieranie i instalacja TeamSpeak 3&utmhid=1027184309&utmr=http://unknown_browser_unknown_version&utmp=/legal_timestamp&utmht=1421668083546&utmac=UA-152357-4&utmcc=__utma=176340583.1552066270.1421668072.1421668072.1421668072.1;+__utmz=176340583.1421668072.1.1.utmcsr=(direct)\|utmccn=(direct)\|utmcmd=(none);&utmmt=1&utmu=qACgAAAAC~
hxxp://74.125.228.201/__utm.gif?utmwv=5.4.6&utms=7&utmn=260708331&utmhn=sd.softonic.pl&utmcs=utf-8&utmsr=1024x768&utmvp=650x450&utmsc=32-bit&utmul=en-us&utmje=1&utmfl=11.6 r602&utmdt=Pobieranie i instalacja TeamSpeak 3&utmhid=1027184309&utmr=http://unknown_browser_unknown_version&utmp=/C101727--setup_timestamp&utmht=1421668083593&utmac=UA-152357-4&utmcc=__utma=176340583.1552066270.1421668072.1421668072.1421668072.1;+__utmz=176340583.1421668072.1.1.utmcsr=(direct)\|utmccn=(direct)\|utmcmd=(none);&utmmt=1&utmu=qACgAAAAC~
hxxp://74.125.228.201/__utm.gif?utmwv=5.4.6&utms=8&utmn=1543877491&utmhn=sd.softonic.pl&utmcs=utf-8&utmsr=1024x768&utmvp=650x450&utmsc=32-bit&utmul=en-us&utmje=1&utmfl=11.6 r602&utmdt=Pobieranie i instalacja TeamSpeak 3&utmhid=1027184309&utmr=http://unknown_browser_unknown_version&utmp=/C101727--shown&utmht=1421668083656&utmac=UA-152357-4&utmcc=__utma=176340583.1552066270.1421668072.1421668072.1421668072.1;+__utmz=176340583.1421668072.1.1.utmcsr=(direct)\|utmccn=(direct)\|utmcmd=(none);&utmmt=1&utmu=qACgAAAAC~
hxxp://74.125.228.201/__utm.gif?utmwv=5.4.6&utms=9&utmn=385588187&utmhn=sd.softonic.pl&utmcs=utf-8&utmsr=1024x768&utmvp=650x450&utmsc=32-bit&utmul=en-us&utmje=1&utmfl=11.6 r602&utmdt=Pobieranie i instalacja TeamSpeak 3&utmhid=1027184309&utmr=http://unknown_browser_unknown_version&utmp=/recommendations&utmht=1421668083687&utmac=UA-152357-4&utmcc=__utma=176340583.1552066270.1421668072.1421668072.1421668072.1;+__utmz=176340583.1421668072.1.1.utmcsr=(direct)\|utmccn=(direct)\|utmcmd=(none);&utmmt=1&utmu=qACgAAAAC~
hxxp://74.125.228.201/__utm.gif?utmwv=5.4.6&utms=10&utmn=2121111889&utmhn=sd.softonic.pl&utmcs=utf-8&utmsr=1024x768&utmvp=650x450&utmsc=32-bit&utmul=en-us&utmje=1&utmfl=11.6 r602&utmdt=Pobieranie i instalacja TeamSpeak 3&utmhid=1027184309&utmr=http://unknown_browser_unknown_version&utmp=/C100861--load1&utmht=1421668083765&utmac=UA-152357-4&utmcc=__utma=176340583.1552066270.1421668072.1421668072.1421668072.1;+__utmz=176340583.1421668072.1.1.utmcsr=(direct)\|utmccn=(direct)\|utmcmd=(none);&utmmt=1&utmu=qACgAAAAC~
hxxp://74.125.228.201/__utm.gif?utmwv=5.4.6&utms=11&utmn=266052665&utmhn=sd.softonic.pl&utmcs=utf-8&utmsr=1024x768&utmvp=650x450&utmsc=32-bit&utmul=en-us&utmje=1&utmfl=11.6 r602&utmdt=Pobieranie i instalacja TeamSpeak 3&utmhid=1027184309&utmr=http://unknown_browser_unknown_version&utmp=/C101633--load2&utmht=1421668083812&utmac=UA-152357-4&utmcc=__utma=176340583.1552066270.1421668072.1421668072.1421668072.1;+__utmz=176340583.1421668072.1.1.utmcsr=(direct)\|utmccn=(direct)\|utmcmd=(none);&utmmt=1&utmu=qACgAAAAC~
hxxp://screenshots.en.sftcdn.net/campaign/scrn/100000/100861/sd_100861_41d97.jpeg?v=0.010570287798522315	46.28.209.52
hxxp://screenshots.en.sftcdn.net/campaign/scrn/101000/101633/sd_101633_08ebf.jpeg?v=0.12472576205380864	46.28.209.52
hxxp://74.125.228.201/collect?v=1&_v=j31&a=1027184309&t=pageview&_s=1&dl=http://sd.softonic.pl/21547/universaldownloader/campaign-100861,101633/eulastep-101727?sd_timestamp=1421668077&ul=en-us&de=utf-8&dt=Pobieranie i instalacja TeamSpeak 3&sd=32-bit&sr=1024x768&vp=780x550&je=0&fl=11.6 r602&_utma=176340583.1552066270.1421668072.1421668072.1421668072.1&_utmz=176340583.1421668072.1.1.utmcsr=(direct)\|utmccn=(direct)\|utmcmd=(none)&_utmht=1421668084468&_u=MACCAEAAI~&jid=&cid=1552066270.1421668072&tid=UA-48247475-3&z=1515662130
hxxp://pagead46.l.doubleclick.net/gpt/pubads_impl_56.js
hxxp://pagead46.l.doubleclick.net/pagead/show_companion_ad.js
hxxp://pagead-googlehosted.l.google.com/safeframe/1-0-1/html/container.html
hxxp://beacon.rubiconproject.net.akadns.net/beacon/p/rtp/valuation?&p=rubicon&pc=10496/44182&ptc=191952&api=valuation&as=dart-gpt&asz=300x250&asid=15&tier=5&cpm=0.14439&hit=2&type=rtb&co=ca&rnd=5057&rtc=1&rta=rtb.randomized.session&ruc=-99
hxxp://beacon.rubiconproject.net.akadns.net/beacon/p/rtp/valuation?&p=rubicon&pc=10496/44182&ptc=191950&api=valuation&as=dart-gpt&asz=300x250&asid=15&hit=1&co=ca&rnd=2947
hxxp://tpc.googlesyndication.com/safeframe/1-0-1/html/container.html	74.125.226.11
hxxp://tap-cdn.rubiconproject.com/partner/scripts/rubicon/dorothy.js?pc=10496/44182	69.31.116.65
hxxp://beacon-6.newrelic.com/1/cc92a7d66e?a=2337114&pl=1421668062968&v=476.c73f3a6&to=NQcAZUJXXUdWAEZdVwxNN0NZGVtAUwxRRxcLDAZUSBhDXEc=&ap=367&fe=15234&dc=8953&f=["err"]&jsonp=NREUM.setToken	50.31.164.172
hxxp://sd.softonic.pl/universaldownloader-track
hxxp://c.amazon-adsystem.com/aax2/amzn_ads.js	54.192.23.193
hxxp://www.google-analytics.com/__utm.gif?utmwv=5.4.6&utms=4&utmn=498571742&utmhn=sd.softonic.pl&utmcs=utf-8&utmsr=1024x768&utmvp=650x450&utmsc=32-bit&utmul=en-us&utmje=1&utmfl=11.6 r602&utmdt=Pobieranie i instalacja TeamSpeak 3&utmhid=1027184309&utmr=http://unknown_browser_unknown_version&utmp=/start_api&utmht=1421668083374&utmac=UA-152357-4&utmcc=__utma=176340583.1552066270.1421668072.1421668072.1421668072.1;+__utmz=176340583.1421668072.1.1.utmcsr=(direct)\|utmccn=(direct)\|utmcmd=(none);&utmmt=1&utmu=qACgAAAAC~
hxxp://js-agent.newrelic.com/nr-476.min.js	23.235.44.175
hxxp://static.sd.softonic.pl/css/generated/fad58-8688a.css
hxxp://www.google-analytics.com/__utm.gif?utmwv=5.4.6&utms=6&utmn=1822610648&utmhn=sd.softonic.pl&utmcs=utf-8&utmsr=1024x768&utmvp=650x450&utmsc=32-bit&utmul=en-us&utmje=1&utmfl=11.6 r602&utmdt=Pobieranie i instalacja TeamSpeak 3&utmhid=1027184309&utmr=http://unknown_browser_unknown_version&utmp=/legal_timestamp&utmht=1421668083546&utmac=UA-152357-4&utmcc=__utma=176340583.1552066270.1421668072.1421668072.1421668072.1;+__utmz=176340583.1421668072.1.1.utmcsr=(direct)\|utmccn=(direct)\|utmcmd=(none);&utmmt=1&utmu=qACgAAAAC~
hxxp://www.google-analytics.com/r/collect?v=1&_v=j31&a=1415093474&t=pageview&_s=1&dl=http://sd.softonic.pl/21547/universaldownloader-prefetch&ul=en-us&de=utf-8&dt=Pobieranie i instalacja TeamSpeak 3&sd=32-bit&sr=1024x768&vp=650x450&je=0&fl=11.6 r602&_utma=176340583.1552066270.1421668072.1421668072.1421668072.1&_utmz=176340583.1421668072.1.1.utmcsr=(direct)\|utmccn=(direct)\|utmcmd=(none)&_utmht=1421668078343&_u=MQACAEAAI~&jid=726396425&cid=1552066270.1421668072&tid=UA-48247475-3&_r=1&z=561424862
hxxp://www.google-analytics.com/analytics.js
hxxp://www.google-analytics.com/__utm.gif?utmwv=5.4.6&utms=10&utmn=2121111889&utmhn=sd.softonic.pl&utmcs=utf-8&utmsr=1024x768&utmvp=650x450&utmsc=32-bit&utmul=en-us&utmje=1&utmfl=11.6 r602&utmdt=Pobieranie i instalacja TeamSpeak 3&utmhid=1027184309&utmr=http://unknown_browser_unknown_version&utmp=/C100861--load1&utmht=1421668083765&utmac=UA-152357-4&utmcc=__utma=176340583.1552066270.1421668072.1421668072.1421668072.1;+__utmz=176340583.1421668072.1.1.utmcsr=(direct)\|utmccn=(direct)\|utmcmd=(none);&utmmt=1&utmu=qACgAAAAC~
hxxp://www.google-analytics.com/__utm.gif?utmwv=5.4.6&utms=2&utmn=671250179&utmhn=sd.softonic.pl&utmcs=utf-8&utmsr=1024x768&utmvp=650x450&utmsc=32-bit&utmul=en-us&utmje=1&utmfl=11.6 r602&utmdt=Pobieranie i instalacja TeamSpeak 3&utmhid=1027184309&utmr=-&utmp=/21547/universaldownloader/campaign-100861,101633/eulastep-101727?sd_timestamp=1421668077&utmht=1421668083109&utmac=UA-48247475-1&utmcc=__utma=176340583.1552066270.1421668072.1421668072.1421668072.1;+__utmz=176340583.1421668072.1.1.utmcsr=(direct)\|utmccn=(direct)\|utmcmd=(none);&utmmt=1&utmu=qAAg~
hxxp://aax.amazon-adsystem.com/e/dtb/bid?src=3177&u=http://sd.softonic.pl/21547/universaldownloader/campaign-100861,101633/eulastep-101727?sd_timestamp=1421668077&cb=3030167	176.32.103.187
hxxp://www.google-analytics.com/__utm.gif?utmwv=5.4.6&utms=9&utmn=385588187&utmhn=sd.softonic.pl&utmcs=utf-8&utmsr=1024x768&utmvp=650x450&utmsc=32-bit&utmul=en-us&utmje=1&utmfl=11.6 r602&utmdt=Pobieranie i instalacja TeamSpeak 3&utmhid=1027184309&utmr=http://unknown_browser_unknown_version&utmp=/recommendations&utmht=1421668083687&utmac=UA-152357-4&utmcc=__utma=176340583.1552066270.1421668072.1421668072.1421668072.1;+__utmz=176340583.1421668072.1.1.utmcsr=(direct)\|utmccn=(direct)\|utmcmd=(none);&utmmt=1&utmu=qACgAAAAC~
hxxp://www.google-analytics.com/collect?v=1&_v=j31&a=1027184309&t=pageview&_s=1&dl=http://sd.softonic.pl/21547/universaldownloader/campaign-100861,101633/eulastep-101727?sd_timestamp=1421668077&ul=en-us&de=utf-8&dt=Pobieranie i instalacja TeamSpeak 3&sd=32-bit&sr=1024x768&vp=780x550&je=0&fl=11.6 r602&_utma=176340583.1552066270.1421668072.1421668072.1421668072.1&_utmz=176340583.1421668072.1.1.utmcsr=(direct)\|utmccn=(direct)\|utmcmd=(none)&_utmht=1421668084468&_u=MACCAEAAI~&jid=&cid=1552066270.1421668072&tid=UA-48247475-3&z=1515662130
hxxp://www.google-analytics.com/__utm.gif?utmwv=5.4.6&utms=8&utmn=1543877491&utmhn=sd.softonic.pl&utmcs=utf-8&utmsr=1024x768&utmvp=650x450&utmsc=32-bit&utmul=en-us&utmje=1&utmfl=11.6 r602&utmdt=Pobieranie i instalacja TeamSpeak 3&utmhid=1027184309&utmr=http://unknown_browser_unknown_version&utmp=/C101727--shown&utmht=1421668083656&utmac=UA-152357-4&utmcc=__utma=176340583.1552066270.1421668072.1421668072.1421668072.1;+__utmz=176340583.1421668072.1.1.utmcsr=(direct)\|utmccn=(direct)\|utmcmd=(none);&utmmt=1&utmu=qACgAAAAC~
hxxp://www.googletagservices.com/tag/js/gpt.js	74.125.226.25
hxxp://pagead2.googlesyndication.com/pagead/show_companion_ad.js	74.125.226.26
hxxp://www.google-analytics.com/__utm.gif?utmwv=5.4.6&utms=3&utmn=1502296361&utmhn=sd.softonic.pl&utmcs=utf-8&utmsr=1024x768&utmvp=650x450&utmsc=32-bit&utmul=en-us&utmje=1&utmfl=11.6 r602&utmdt=Pobieranie i instalacja TeamSpeak 3&utmhid=1027184309&utmr=http://unknown_browser_unknown_version&utmp=/init_startup&utmht=1421668083328&utmac=UA-152357-4&utmcc=__utma=176340583.1552066270.1421668072.1421668072.1421668072.1;+__utmz=176340583.1421668072.1.1.utmcsr=(direct)\|utmccn=(direct)\|utmcmd=(none);&utmmt=1&utmu=qACgAAAAC~
hxxp://www.google-analytics.com/__utm.gif?utmwv=5.4.6&utms=5&utmn=432915247&utmhn=sd.softonic.pl&utmcs=utf-8&utmsr=1024x768&utmvp=650x450&utmsc=32-bit&utmul=en-us&utmje=1&utmfl=11.6 r602&utmdt=Pobieranie i instalacja TeamSpeak 3&utmhid=1027184309&utmr=http://unknown_browser_unknown_version&utmp=/legal_start&utmht=1421668083499&utmac=UA-152357-4&utmcc=__utma=176340583.1552066270.1421668072.1421668072.1421668072.1;+__utmz=176340583.1421668072.1.1.utmcsr=(direct)\|utmccn=(direct)\|utmcmd=(none);&utmmt=1&utmu=qACgAAAAC~
hxxp://static.sd.softonic.pl/shared/img/sd_client/loading.gif
hxxp://www.google-analytics.com/__utm.gif?utmwv=5.4.6&utms=7&utmn=260708331&utmhn=sd.softonic.pl&utmcs=utf-8&utmsr=1024x768&utmvp=650x450&utmsc=32-bit&utmul=en-us&utmje=1&utmfl=11.6 r602&utmdt=Pobieranie i instalacja TeamSpeak 3&utmhid=1027184309&utmr=http://unknown_browser_unknown_version&utmp=/C101727--setup_timestamp&utmht=1421668083593&utmac=UA-152357-4&utmcc=__utma=176340583.1552066270.1421668072.1421668072.1421668072.1;+__utmz=176340583.1421668072.1.1.utmcsr=(direct)\|utmccn=(direct)\|utmcmd=(none);&utmmt=1&utmu=qACgAAAAC~
hxxp://anvil.rubiconproject.com/a/api/market.js?&account_id=10496&site_id=44182&zone_id=191952&rtb_model=1&cb=oz_onValuationLoaded_191952_15&size_id=15	8.39.37.42
hxxp://www.google-analytics.com/__utm.gif?utmwv=5.4.6&utms=11&utmn=266052665&utmhn=sd.softonic.pl&utmcs=utf-8&utmsr=1024x768&utmvp=650x450&utmsc=32-bit&utmul=en-us&utmje=1&utmfl=11.6 r602&utmdt=Pobieranie i instalacja TeamSpeak 3&utmhid=1027184309&utmr=http://unknown_browser_unknown_version&utmp=/C101633--load2&utmht=1421668083812&utmac=UA-152357-4&utmcc=__utma=176340583.1552066270.1421668072.1421668072.1421668072.1;+__utmz=176340583.1421668072.1.1.utmcsr=(direct)\|utmccn=(direct)\|utmcmd=(none);&utmmt=1&utmu=qACgAAAAC~
hxxp://beacon.rubiconproject.com/beacon/p/rtp/valuation?&p=rubicon&pc=10496/44182&ptc=191950&api=valuation&as=dart-gpt&asz=300x250&asid=15&hit=1&co=ca&rnd=2947	8.39.37.23
hxxp://sd.softonic.pl/21547/universaldownloader/campaign-100861,101633/eulastep-101727?sd_timestamp=1421668077
hxxp://beacon.rubiconproject.com/beacon/p/rtp/valuation?&p=rubicon&pc=10496/44182&ptc=191952&api=valuation&as=dart-gpt&asz=300x250&asid=15&tier=5&cpm=0.14439&hit=2&type=rtb&co=ca&rnd=5057&rtc=1&rta=rtb.randomized.session&ruc=-99	8.39.37.23
hxxp://anvil.rubiconproject.com/a/api/market.js?&account_id=10496&site_id=44182&zone_id=191950&rtb_model=1&cb=oz_onValuationLoaded_191950_15&size_id=15	8.39.37.42
hxxp://partner.googleadservices.com/gpt/pubads_impl_56.js	74.125.226.25
hxxp://static.sd.softonic.pl/shared/img/sd_client/gradientbg.png
hxxp://static.sd.softonic.pl/shared/img/sd_client/sprite.png
bam.nr-data.net	50.31.164.165

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

GET /aax2/amzn_ads.js HTTP/1.1

Accept: */*

Referer: hXXp://sd.softonic.pl/21547/universaldownloader/campaign-100861,101633/eulastep-101727?sd_timestamp=1421668077

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: c.amazon-adsystem.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Type: application/x-javascript

Content-Length: 13053

Connection: keep-alive

Date: Wed, 07 Jan 2015 23:13:57 GMT

Cache-Control: public, max-age=3600

Last-Modified: Wed, 07 Jan 2015 23:08:19 GMT

ETag: "cd9ebc01a824fb79da4c52f2bc1b899f"

Accept-Ranges: bytes

Server: AmazonS3

Age: 1716

X-Cache: Hit from cloudfront

Via: 1.1 cc6ca0e3e6cb30bf44e25b4521fb51eb.cloudfront.net (CloudFront)

X-Amz-Cf-Id: mhLDp-REMPOxHnS4vR9r9CUN8oTQyE99_Nm2B7KoQlf04g2xCOfzNw==

<<< skipped >>>

GET /safeframe/1-0-1/html/container.html HTTP/1.1

Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*

Referer: hXXp://sd.softonic.pl/21547/universaldownloader/campaign-100861,101633/eulastep-101727?sd_timestamp=1421668077

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: tpc.googlesyndication.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Vary: Accept-Encoding

Content-Encoding: gzip

Content-Type: text/html

Last-Modified: Fri, 14 Nov 2014 14:57:36 GMT

Date: Tue, 13 Jan 2015 15:57:06 GMT

Expires: Wed, 13 Jan 2016 15:57:06 GMT

X-Content-Type-Options: nosniff

Server: sffe

Content-Length: 1786

X-XSS-Protection: 1; mode=block

Cache-Control: public, max-age=31536000

Age: 522161

Alternate-Protocol: 80:quic,p=0.02

......n....W{S.....Oa<\...;..i.qD...RJ...8IzG.......<h..~W....{.9sfxH...O..o..........1...x....Fc.h(.0....q.....cf..D.(a...%.....~.>.;..G..'.....$.Q. .kF...1.2;$ 9..>.......E.d..........t._#J2A.@..pN.1gb........\)#...{..#Z.Lx*R...iG.(.:..c...t5..K.....HX.......(...L.c.q..Grb......i...\dh..W.I...........<k.a...........L..nV`.../.>.V^.?.I.Z.*_..Y.1..&S....Hb]iA.l. ..w..|.\....O...<.77...A...y..E.&1..r.w{YoA...r5:p..i...n.....7..a.N..f.^..F.......I.,.R.r.Nc....;....!K..'...$....7x...ij[.rX.'#.b.-..........]......].[.........6..vw.e.}jb.:.....C:g.E3..Zk...HH.}..]b[.>...=%;.C.B.4...{ _.IW..4d.Y..F5.gOw......XV..x.%.H.J....`....!.L."\.^....g.:.~.a._.....v..r...f].s.g.[7.O..e!P....H.\..T..=H.D.....[...0....u.....j..a.?.P...8..............Wn/.r.<.>..wi.._>.z..#...TX.a..K ..w..^.. ..%.#gL...Th.,...`....7>{.R. ....}`'..J>..o......2Q..........m.....c..Se..|.7.."....O....Z.uK.o...w.....<^...G.'C.X .......D ).kUl......../,..jz.j..{C$.m)..|....;..~4Rm.?_q......O.hY.M......N..J..*......L....L......Q.s.c...g...X?..)}C.0.Z.......7..r.Z.d...N...A.^.......p...c&g..........d..X...ZMK[d.f.n..l...`.....^...C...L~..=I.%.:.x:........VGk.'.].3J..9.1.,..........v...n...e..-.....3..../........h.n..m._.....g4.&..v.JH..0 .......3.:sX"Kyx..by.....4T.....$as..^h........N..L_A6.C{........G..8(..*D..7........%...~.S..6U.....!8.s]..%.w .I.......*:.......|G...4W.(..c..T.6.B.a1...hs.<m.h...P.l@...8..B#..."5.Bp..`.m.*...9Ye.;I.........o .....'.`6.3.Q.>.....S-|Q.>..u.. .n.L.&]....\.d`..3..`....q*;.

<<< skipped >>>

GET /analytics.js HTTP/1.1

Accept: */*

Referer: hXXp://sd.softonic.pl/21547/universaldownloader/campaign-100861,101633/eulastep-101727?sd_timestamp=1421668077

Accept-Language: en-us

Accept-Encoding: gzip, deflate

If-Modified-Since: Thu, 13 Nov 2014 21:10:00 GMT; length=25393

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.google-analytics.com

Connection: Keep-Alive

HTTP/1.1 304 Not Modified

Date: Mon, 19 Jan 2015 15:46:35 GMT

Expires: Mon, 19 Jan 2015 17:46:35 GMT

Age: 4391

Server: GFE/2.0

Alternate-Protocol: 80:quic,p=0.02

....

GET /__utm.gif?utmwv=5.4.6&utms=3&utmn=1502296361&utmhn=sd.softonic.pl&utmcs=utf-8&utmsr=1024x768&utmvp=650x450&utmsc=32-bit&utmul=en-us&utmje=1&utmfl=11.6 r602&utmdt=Pobieranie i instalacja TeamSpeak 3&utmhid=1027184309&utmr=http://unknown_browser_unknown_version&utmp=/init_startup&utmht=1421668083328&utmac=UA-152357-4&utmcc=__utma=176340583.1552066270.1421668072.1421668072.1421668072.1;+__utmz=176340583.1421668072.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmmt=1&utmu=qACgAAAAC~ HTTP/1.1

Accept: */*

Referer: hXXp://sd.softonic.pl/21547/universaldownloader/campaign-100861,101633/eulastep-101727?sd_timestamp=1421668077

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.google-analytics.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Pragma: no-cache

Expires: Wed, 19 Apr 2000 11:43:00 GMT

Last-Modified: Wed, 21 Jan 2004 19:51:30 GMT

X-Content-Type-Options: nosniff

Content-Type: image/gif

Date: Wed, 14 Jan 2015 16:05:41 GMT

Server: Golfe2

Content-Length: 35

Cache-Control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate

Age: 435245

Alternate-Protocol: 80:quic,p=0.02

GIF89a.............,...........D..;....

GET /__utm.gif?utmwv=5.4.6&utms=5&utmn=432915247&utmhn=sd.softonic.pl&utmcs=utf-8&utmsr=1024x768&utmvp=650x450&utmsc=32-bit&utmul=en-us&utmje=1&utmfl=11.6 r602&utmdt=Pobieranie i instalacja TeamSpeak 3&utmhid=1027184309&utmr=http://unknown_browser_unknown_version&utmp=/legal_start&utmht=1421668083499&utmac=UA-152357-4&utmcc=__utma=176340583.1552066270.1421668072.1421668072.1421668072.1;+__utmz=176340583.1421668072.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmmt=1&utmu=qACgAAAAC~ HTTP/1.1

Accept: */*

Referer: hXXp://sd.softonic.pl/21547/universaldownloader/campaign-100861,101633/eulastep-101727?sd_timestamp=1421668077

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.google-analytics.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Pragma: no-cache

Expires: Wed, 19 Apr 2000 11:43:00 GMT

Last-Modified: Wed, 21 Jan 2004 19:51:30 GMT

X-Content-Type-Options: nosniff

Content-Type: image/gif

Date: Wed, 14 Jan 2015 16:05:41 GMT

Server: Golfe2

Content-Length: 35

Cache-Control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate

Age: 435245

Alternate-Protocol: 80:quic,p=0.02

GIF89a.............,...........D..;....

GET /__utm.gif?utmwv=5.4.6&utms=7&utmn=260708331&utmhn=sd.softonic.pl&utmcs=utf-8&utmsr=1024x768&utmvp=650x450&utmsc=32-bit&utmul=en-us&utmje=1&utmfl=11.6 r602&utmdt=Pobieranie i instalacja TeamSpeak 3&utmhid=1027184309&utmr=http://unknown_browser_unknown_version&utmp=/C101727--setup_timestamp&utmht=1421668083593&utmac=UA-152357-4&utmcc=__utma=176340583.1552066270.1421668072.1421668072.1421668072.1;+__utmz=176340583.1421668072.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmmt=1&utmu=qACgAAAAC~ HTTP/1.1

Accept: */*

Referer: hXXp://sd.softonic.pl/21547/universaldownloader/campaign-100861,101633/eulastep-101727?sd_timestamp=1421668077

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.google-analytics.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Pragma: no-cache

Expires: Wed, 19 Apr 2000 11:43:00 GMT

Last-Modified: Wed, 21 Jan 2004 19:51:30 GMT

X-Content-Type-Options: nosniff

Content-Type: image/gif

Date: Wed, 14 Jan 2015 16:05:41 GMT

Server: Golfe2

Content-Length: 35

Cache-Control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate

Age: 435245

Alternate-Protocol: 80:quic,p=0.02

GIF89a.............,...........D..;....

GET /__utm.gif?utmwv=5.4.6&utms=9&utmn=385588187&utmhn=sd.softonic.pl&utmcs=utf-8&utmsr=1024x768&utmvp=650x450&utmsc=32-bit&utmul=en-us&utmje=1&utmfl=11.6 r602&utmdt=Pobieranie i instalacja TeamSpeak 3&utmhid=1027184309&utmr=http://unknown_browser_unknown_version&utmp=/recommendations&utmht=1421668083687&utmac=UA-152357-4&utmcc=__utma=176340583.1552066270.1421668072.1421668072.1421668072.1;+__utmz=176340583.1421668072.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmmt=1&utmu=qACgAAAAC~ HTTP/1.1

Accept: */*

Referer: hXXp://sd.softonic.pl/21547/universaldownloader/campaign-100861,101633/eulastep-101727?sd_timestamp=1421668077

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.google-analytics.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Pragma: no-cache

Expires: Wed, 19 Apr 2000 11:43:00 GMT

Last-Modified: Wed, 21 Jan 2004 19:51:30 GMT

X-Content-Type-Options: nosniff

Content-Type: image/gif

Date: Wed, 14 Jan 2015 16:05:41 GMT

Server: Golfe2

Content-Length: 35

Cache-Control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate

Age: 435245

Alternate-Protocol: 80:quic,p=0.02

GIF89a.............,...........D..;....

GET /__utm.gif?utmwv=5.4.6&utms=11&utmn=266052665&utmhn=sd.softonic.pl&utmcs=utf-8&utmsr=1024x768&utmvp=650x450&utmsc=32-bit&utmul=en-us&utmje=1&utmfl=11.6 r602&utmdt=Pobieranie i instalacja TeamSpeak 3&utmhid=1027184309&utmr=http://unknown_browser_unknown_version&utmp=/C101633--load2&utmht=1421668083812&utmac=UA-152357-4&utmcc=__utma=176340583.1552066270.1421668072.1421668072.1421668072.1;+__utmz=176340583.1421668072.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmmt=1&utmu=qACgAAAAC~ HTTP/1.1

Accept: */*

Referer: hXXp://sd.softonic.pl/21547/universaldownloader/campaign-100861,101633/eulastep-101727?sd_timestamp=1421668077

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.google-analytics.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Pragma: no-cache

Expires: Wed, 19 Apr 2000 11:43:00 GMT

Last-Modified: Wed, 21 Jan 2004 19:51:30 GMT

X-Content-Type-Options: nosniff

Content-Type: image/gif

Date: Wed, 14 Jan 2015 16:05:41 GMT

Server: Golfe2

Content-Length: 35

Cache-Control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate

Age: 435246

Alternate-Protocol: 80:quic,p=0.02

GIF89a.............,...........D..;..

GET /gpt/pubads_impl_56.js HTTP/1.1

Accept: */*

Referer: hXXp://sd.softonic.pl/21547/universaldownloader/campaign-100861,101633/eulastep-101727?sd_timestamp=1421668077

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: partner.googleadservices.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Vary: Accept-Encoding

Content-Encoding: gzip

Content-Type: text/javascript

Last-Modified: Mon, 12 Jan 2015 20:02:58 GMT

Date: Tue, 13 Jan 2015 23:46:36 GMT

Expires: Wed, 13 Jan 2016 23:46:36 GMT

X-Content-Type-Options: nosniff

Server: sffe

Content-Length: 33962

X-XSS-Protection: 1; mode=block

Cache-Control: public, max-age=31536000

Age: 493991

Alternate-Protocol: 80:quic,p=0.02

......n.....i{...(......u...%giC..u.'q......U?.&.ZCR^b...3.. E%.y.}.i,...c0...b.....v..x.=f_.|0.X......q.H..W.a....}.b.... ....XY....x.lso...,........W(.....,......).uD[......yK..B......Hm..Y>.6...C....f..ch.:..=..4.F....$T.....Qw..riM.. N.E..9...|..k-.Q...qd....|<..M...y......T..<.C.......Y.....>.s..[.,NF.K[.m....Gj..U<..m.:]@..R....l.R7.r.....{.B^.-.t@...W,.....U?..*v%ti.*.X^.pF{.(.bWu...]..v$.....|.T.....S..s..Y..%....,[...b.]X.-.}...k...)..1..'O.....~..........5j..||k.f......;c.g.......;.....z.$Mg.M...P.'.Y.0.....9../..............w.j..4...\.-d.n..4..j...Z1cBV.vmBn}u^..q&ww..;.25T..&..7o.PMy>....Y...3..P...[.....%..Z...5..r.jZ.../^.m....h.....M.~...<_..7......v.....c/......ISk;....9..8........N... ~.;...JW..v..NXL.....o~.......vh.4..\0.".g..!.....Y...q.....;w..a......io.h8.....:.;.i.Vt.....b}.9t.]r?.....q.../...a..(:\...Ps.!...,.a.lH.....`D.-..<....y.R..x..{.U.$.2..}.'....#{....xcs..|....".g...h..N?.:h..O.<;........y....gue....|.c*>k,..O.}fY.........\....S..C.k90j...|.......w`...Z..K....O..gX._W.g..j....Y.j..y........u..oZ........W..b_....S...!.f...~s...w..?....b..8...>..>.~.....[....Xj.[...tn.bto./t......k.B.r.]X.9..L..5.&.../..4UC.0.y...c|..hxe.w...#..0....?...^o..N.aj....@...G..rD....p..jY......"...=...7v.Y..D..f..&.P.1.{.rV...0[.8}y............0....p.5.P.O>^.k.n..v...[?Y..........x....r.......y8..)...Y0.. ..]....\..Z..H...OTA\...........U..Vg12g1,.".o1..>.u..9 ..q..p..p...].r.......S.Z..-.C..=....c..Sz..cJ.)>.....M.)../.!.?..[?C.9%....ck?.......:...D#5q.b....

<<< skipped >>>

GET /partner/scripts/rubicon/dorothy.js?pc=10496/44182 HTTP/1.1

Accept: */*

Referer: hXXp://sd.softonic.pl/21547/universaldownloader/campaign-100861,101633/eulastep-101727?sd_timestamp=1421668077

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: tap-cdn.rubiconproject.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Apache-Coyote/1.1

Last-Modified: Mon, 19 Jan 2015 16:59:44 GMT

p3p: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

Content-Type: text/javascript;charset=UTF-8

Content-Encoding: gzip

Content-Length: 6376

Cache-Control: max-age=3600

Expires: Mon, 19 Jan 2015 17:59:44 GMT

Date: Mon, 19 Jan 2015 16:59:44 GMT

Connection: keep-alive

Vary: Accept-Encoding

............ko.......4.:b...-.......r.4..(.W.....D.$.Gd.....\>$'.....\.........v......n....W...F...;O.#........s.._..n.(...w..-E.\,....(.IB.;.A./...x.'...~...N..OICe..]qa.%............Q^."...i..i@b.R.....8...l..).......hhkD.....k...I}w.&iW..i.=<L.....-.0.\..R..0..}.L.R.~.,V.R.A:.....EJ..0n6&%.#3g.H.0..t.u..n&.=...<...u..b!..s'..........n....&.0.&.gR..d.qz3.....n...E.....@W.....(.~b.m../C...u.6[}..]..N.5..u...n.'..b.wU.~.wL?..l.;....Cm................t...Ug0.wc.8..V7....DE..vC2.I.K?...(2.u..2...t..".....6.....tA.d..~F...Y$ThN...y.u.9..a.xd..sO.2U.d......%N@........~.3hcI.[.g..b...a.u*....k../...;'Vz&.|kMT. UWeM)5.hK..G.....0......@...L*..9....<..s..mkA..tn..Mm...N..E.MT....][..8..OO....d)....q.p.......OIQ.-......M.Pm...{....:..$Z.i..k...V@.._V...7...Zk.."....)...|...W'..a@p.4J...........a..PWC....l..A.tZ...d.K.x...xl./.N..im....:;.h.>...L|./.....8..x.eOJ...0.....>...w.%...d...yaZ..l....<., ....f.X0.]..-.['5`..UG..!.3..."...zl.!.....g..p73e8.-u...........%sZAT...wj..B...f.Pl_D..uRw....".A....../B.#...>.........>3..LI*.&....I.....l.....=..........I.`A..P... ..,.k%$.L...Y.......G.~.8.....w........I.p\.8.....j......<....Y.$.4%...../......T..r_6....B..s..5zhS.p..2.^/.K/........}...=|f...;.hr..p.....i....u../C.......CT........H.r....I~..8M..'.....`..u.I......]=...........].4..v.. nAq.)......{.n>....V.sbG...o.Y1`.."..j.M[.WU1.lM,..Fd...."...xF..e)L..c....0.....rZd.2I....xO@...m..........^&..r......U...7.C|..s.g.........LSm.....9'.?..hZ.....E. .R/.W..lU...[.=.I."....8.N.D>'......Z..`q

<<< skipped >>>

GET /partner/scripts/rubicon/dorothy.js?pc=10496/44182 HTTP/1.1

Accept: */*

Referer: hXXp://sd.softonic.pl/21547/universaldownloader/campaign-100861,101633/eulastep-101727?sd_timestamp=1421668077

Accept-Language: en-us

Accept-Encoding: gzip, deflate

If-Modified-Since: Mon, 19 Jan 2015 16:59:44 GMT; length=23311

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: tap-cdn.rubiconproject.com

Connection: Keep-Alive

Cookie: ruid=553d828f54bd3801b86b26260f9033^1^1421686785^3094029862; rsid=D9mHUmzor4ROFe/ifUEExbIlZameizM4neDXJEmywTNFMJ/OUnD8SJxgKuNsi8Vv2dhLoBsVvXbJcuItcII2VJBP/a4zJzyPfMah/Yq/He8BD4By41q DGoIlkdnrg6ySvzkV9BuD6xR506DigXWmb2l

HTTP/1.1 304 Not Modified

Content-Type: text/javascript;charset=UTF-8

Last-Modified: Mon, 19 Jan 2015 16:59:44 GMT

Cache-Control: max-age=3600

Expires: Mon, 19 Jan 2015 17:59:45 GMT

Date: Mon, 19 Jan 2015 16:59:45 GMT

Connection: keep-alive

GET /tag/js/gpt.js HTTP/1.1

Accept: */*

Referer: hXXp://sd.softonic.pl/21547/universaldownloader/campaign-100861,101633/eulastep-101727?sd_timestamp=1421668077

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.googletagservices.com

Connection: Keep-Alive

HTTP/1.1 200 OK

P3P: policyref="hXXp://VVV.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"

Content-Type: text/javascript; charset=ISO-8859-1

ETag: 6991555325526566283

Date: Mon, 19 Jan 2015 16:21:02 GMT

Expires: Mon, 19 Jan 2015 17:21:02 GMT

X-Content-Type-Options: nosniff

Content-Disposition: attachment; filename="f.txt"

Server: cafe

Content-Length: 46464

X-XSS-Protection: 1; mode=block

Cache-Control: public, max-age=3600

Age: 2324

Alternate-Protocol: 80:quic,p=0.02

<<< skipped >>>

GET /beacon/p/rtp/valuation?&p=rubicon&pc=10496/44182&ptc=191952&api=valuation&as=dart-gpt&asz=300x250&asid=15&tier=5&cpm=0.14439&hit=2&type=rtb&co=ca&rnd=5057&rtc=1&rta=rtb.randomized.session&ruc=-99 HTTP/1.1

Accept: */*

Referer: hXXp://sd.softonic.pl/21547/universaldownloader/campaign-100861,101633/eulastep-101727?sd_timestamp=1421668077

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: beacon.rubiconproject.com

Connection: Keep-Alive

HTTP/1.1 204 No Content

Server: Apache-Coyote/1.1

Cache-Control: private, max-age=0, no-cache

Expires: 01 Jan 1970 10:00:00 GMT

Pragma: no-cache

Date: Mon, 19 Jan 2015 16:59:48 GMT

GET /1/cc92a7d66e?a=2337114&pl=1421668062968&v=476.c73f3a6&to=NQcAZUJXXUdWAEZdVwxNN0NZGVtAUwxRRxcLDAZUSBhDXEc=&ap=367&fe=15234&dc=8953&f=["err"]&jsonp=NREUM.setToken HTTP/1.1

Accept: */*

Referer: hXXp://sd.softonic.pl/21547/universaldownloader-prefetch

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: beacon-6.newrelic.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Set-Cookie: JSESSIONID=b27dd11bbb2d37e5;Path=/

Expires: Thu, 01 Jan 1970 00:00:00 GMT

Content-Type: text/javascript;charset=ISO-8859-1

Content-Length: 25

NREUM.setToken({'stn':1})..

GET /nr-476.min.js HTTP/1.1

Accept: */*

Referer: hXXp://sd.softonic.pl/21547/universaldownloader-prefetch

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: js-agent.newrelic.com

Connection: Keep-Alive

HTTP/1.1 200 OK

x-amz-id-2: 3ZCWv4gpoEhqHp/HTXWRmKm hY5J36mDrIS0iVZXKF mgxgbrQD30oaPVgq26fnc

x-amz-request-id: C43A0659FB2160D7

Cache-Control: public, max-age=315360000

Expires: Thu, 31 Dec 2037 23:55:55 GMT

Last-Modified: Tue, 30 Sep 2014 18:19:08 GMT

ETag: "d131658362c40cedda15546bb81e9644"

Content-Type: application/javascript

Server: AmazonS3

Content-Length: 18146

Accept-Ranges: bytes

Date: Mon, 19 Jan 2015 16:59:41 GMT

Via: 1.1 varnish

Age: 6570694

Connection: keep-alive

X-Served-By: cache-dfw1835-DFW

X-Cache: HIT

X-Cache-Hits: 779909

X-Timer: S1421686781.612711668,VS0,VE0

Vary: Accept-Encoding

<<< skipped >>>

GET /pl/scrn/21000/21547/teamspeak-2-11.jpg HTTP/1.1

Accept: */*

Referer: hXXp://sd.softonic.pl/21547/universaldownloader/campaign-100861,101633/eulastep-101727?sd_timestamp=1421668077

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: zdjecia.pl.sftcdn.net

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Apache

Last-Modified: Tue, 19 Jan 2010 15:53:32 GMT

Cache-Control: max-age=172800

Content-Type: image/jpeg

Content-Length: 15163

Accept-Ranges: bytes

Date: Mon, 19 Jan 2015 16:59:43 GMT

Connection: keep-alive

Age: 0

X-Served-By: screenshots

X-Cache: HIT

X-Cache-Hits: 245

Expires: Wed, 21 Jan 2015 16:59:43 GMT

.PNG........IHDR...d...d.....p..T....tEXtSoftware.Adobe ImageReadyq.e<..:.IDATx..}..$Wu.....qz.'.N...V(... ...E...#.g..y`,...g[~`....l@..$.%..UZi.v.qvf'..9wuW.;........,.............s....M..w.7.M...xs.........aiO;d2y..t`2J ..P) ...0.$0..`..x...|..vkc2.uY..&A....EK6.w..%.Y..j.]..(.-&c.@P.F}hf62....}...@4.....[a&...f...Q.Y.....P,..j.h,.........5. ..C6W...F(.d.E.."....hk.@<.....tX!.....z\...^;<..R.>......C.......s._..S.A....6b..LF|,..( .7....t"~9.....t&.C.....Z...t*.........P(....A..dRl6{..v.,.K......8.....\1,....8........f.j6..b.......d4..\."vz.R.K........i..-....n...j.u...@.Tvd....D.........6...w.LMh.xDK.R8.....Z..@..b......3.h....(6..N/.M..v.u..f.5.A{g.,...F.'...... v..|A....}..~....$.........t...#..........e......E.m...7.........C...\*.b'.}6..z<.i.A..r..A.Tto.R)kJ..C...;.....E..2....^. .t&..)%G6.Y3...G...r..e4Y..NOcg...k.m|...=...KY,..SQ....Y.a...1..1......z3.s..X,F...u........|.h.?....B6.g.^|.l6..&.x..`r...V....&8....<..20.%.f...f.c....L...Tl3.4(.. ..$..WL... ....#.f.:....z...... Vo....6_....3V.....9tkO.`y...H.... .X..M...j..'3_.....GF.G?.!.....6.j.xRk.o..=.-. :ibt..;...[.}3.I....T.*..\...e.!|<..1...@......m.....^z..m..5.......V{.\..Hf..M...:...3K...b.[.(.....G>.Hf.|..L.k.Q8:0...t...{v..c3...u..s..]....5..I...,.y..T..j.A6.......V..q.Q...........;...l.l..iCg[...v._..._6...j...Q 0P...Hk9o@&....H.o.G.u....@(.J.....J....tck.Zm.\.K#[.#\AW...G>.r.m.o5.ME...N...i../<.#.H..../...Cu.......j.f.k....fDl....:...|*p..}..C......a....:;....b..M...D...z.8I.B..oP.|..dr.-.p.q..../.\..............;

<<< skipped >>>

GET /r/collect?v=1&_v=j31&a=1415093474&t=pageview&_s=1&dl=http://sd.softonic.pl/21547/universaldownloader-prefetch&ul=en-us&de=utf-8&dt=Pobieranie i instalacja TeamSpeak 3&sd=32-bit&sr=1024x768&vp=650x450&je=0&fl=11.6 r602&_utma=176340583.1552066270.1421668072.1421668072.1421668072.1&_utmz=176340583.1421668072.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none)&_utmht=1421668078343&_u=MQACAEAAI~&jid=726396425&cid=1552066270.1421668072&tid=UA-48247475-3&_r=1&z=561424862 HTTP/1.1

Accept: */*

Referer: hXXp://sd.softonic.pl/21547/universaldownloader-prefetch

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.google-analytics.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Access-Control-Allow-Origin: *

Date: Mon, 19 Jan 2015 16:59:41 GMT

Pragma: no-cache

Expires: Fri, 01 Jan 1990 00:00:00 GMT

Cache-Control: no-cache, no-store, must-revalidate

Last-Modified: Sun, 17 May 1998 03:00:00 GMT

X-Content-Type-Options: nosniff

Content-Type: image/gif

Server: Golfe2

Content-Length: 35

Alternate-Protocol: 80:quic,p=0.02

GIF89a.............,...........D..;....

GET /__utm.gif?utmwv=5.4.6&utms=2&utmn=671250179&utmhn=sd.softonic.pl&utmcs=utf-8&utmsr=1024x768&utmvp=650x450&utmsc=32-bit&utmul=en-us&utmje=1&utmfl=11.6 r602&utmdt=Pobieranie i instalacja TeamSpeak 3&utmhid=1027184309&utmr=-&utmp=/21547/universaldownloader/campaign-100861,101633/eulastep-101727?sd_timestamp=1421668077&utmht=1421668083109&utmac=UA-48247475-1&utmcc=__utma=176340583.1552066270.1421668072.1421668072.1421668072.1;+__utmz=176340583.1421668072.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmmt=1&utmu=qAAg~ HTTP/1.1

Accept: */*

Referer: hXXp://sd.softonic.pl/21547/universaldownloader/campaign-100861,101633/eulastep-101727?sd_timestamp=1421668077

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.google-analytics.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Pragma: no-cache

Expires: Wed, 19 Apr 2000 11:43:00 GMT

Last-Modified: Wed, 21 Jan 2004 19:51:30 GMT

X-Content-Type-Options: nosniff

Content-Type: image/gif

Date: Wed, 14 Jan 2015 16:06:08 GMT

Server: Golfe2

Content-Length: 35

Cache-Control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate

Age: 435218

Alternate-Protocol: 80:quic,p=0.02

GIF89a.............,...........D..;....

GET /__utm.gif?utmwv=5.4.6&utms=4&utmn=498571742&utmhn=sd.softonic.pl&utmcs=utf-8&utmsr=1024x768&utmvp=650x450&utmsc=32-bit&utmul=en-us&utmje=1&utmfl=11.6 r602&utmdt=Pobieranie i instalacja TeamSpeak 3&utmhid=1027184309&utmr=http://unknown_browser_unknown_version&utmp=/start_api&utmht=1421668083374&utmac=UA-152357-4&utmcc=__utma=176340583.1552066270.1421668072.1421668072.1421668072.1;+__utmz=176340583.1421668072.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmmt=1&utmu=qACgAAAAC~ HTTP/1.1

Accept: */*

Referer: hXXp://sd.softonic.pl/21547/universaldownloader/campaign-100861,101633/eulastep-101727?sd_timestamp=1421668077

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.google-analytics.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Pragma: no-cache

Expires: Wed, 19 Apr 2000 11:43:00 GMT

Last-Modified: Wed, 21 Jan 2004 19:51:30 GMT

X-Content-Type-Options: nosniff

Content-Type: image/gif

Date: Wed, 14 Jan 2015 16:06:08 GMT

Server: Golfe2

Content-Length: 35

Cache-Control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate

Age: 435218

Alternate-Protocol: 80:quic,p=0.02

GIF89a.............,...........D..;....

GET /__utm.gif?utmwv=5.4.6&utms=6&utmn=1822610648&utmhn=sd.softonic.pl&utmcs=utf-8&utmsr=1024x768&utmvp=650x450&utmsc=32-bit&utmul=en-us&utmje=1&utmfl=11.6 r602&utmdt=Pobieranie i instalacja TeamSpeak 3&utmhid=1027184309&utmr=http://unknown_browser_unknown_version&utmp=/legal_timestamp&utmht=1421668083546&utmac=UA-152357-4&utmcc=__utma=176340583.1552066270.1421668072.1421668072.1421668072.1;+__utmz=176340583.1421668072.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmmt=1&utmu=qACgAAAAC~ HTTP/1.1

Accept: */*

Referer: hXXp://sd.softonic.pl/21547/universaldownloader/campaign-100861,101633/eulastep-101727?sd_timestamp=1421668077

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.google-analytics.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Pragma: no-cache

Expires: Wed, 19 Apr 2000 11:43:00 GMT

Last-Modified: Wed, 21 Jan 2004 19:51:30 GMT

X-Content-Type-Options: nosniff

Content-Type: image/gif

Date: Wed, 14 Jan 2015 16:06:08 GMT

Server: Golfe2

Content-Length: 35

Cache-Control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate

Age: 435218

Alternate-Protocol: 80:quic,p=0.02

GIF89a.............,...........D..;....

GET /__utm.gif?utmwv=5.4.6&utms=8&utmn=1543877491&utmhn=sd.softonic.pl&utmcs=utf-8&utmsr=1024x768&utmvp=650x450&utmsc=32-bit&utmul=en-us&utmje=1&utmfl=11.6 r602&utmdt=Pobieranie i instalacja TeamSpeak 3&utmhid=1027184309&utmr=http://unknown_browser_unknown_version&utmp=/C101727--shown&utmht=1421668083656&utmac=UA-152357-4&utmcc=__utma=176340583.1552066270.1421668072.1421668072.1421668072.1;+__utmz=176340583.1421668072.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmmt=1&utmu=qACgAAAAC~ HTTP/1.1

Accept: */*

Referer: hXXp://sd.softonic.pl/21547/universaldownloader/campaign-100861,101633/eulastep-101727?sd_timestamp=1421668077

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.google-analytics.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Pragma: no-cache

Expires: Wed, 19 Apr 2000 11:43:00 GMT

Last-Modified: Wed, 21 Jan 2004 19:51:30 GMT

X-Content-Type-Options: nosniff

Content-Type: image/gif

Date: Wed, 14 Jan 2015 16:06:08 GMT

Server: Golfe2

Content-Length: 35

Cache-Control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate

Age: 435218

Alternate-Protocol: 80:quic,p=0.02

GIF89a.............,...........D..;....

GET /__utm.gif?utmwv=5.4.6&utms=10&utmn=2121111889&utmhn=sd.softonic.pl&utmcs=utf-8&utmsr=1024x768&utmvp=650x450&utmsc=32-bit&utmul=en-us&utmje=1&utmfl=11.6 r602&utmdt=Pobieranie i instalacja TeamSpeak 3&utmhid=1027184309&utmr=http://unknown_browser_unknown_version&utmp=/C100861--load1&utmht=1421668083765&utmac=UA-152357-4&utmcc=__utma=176340583.1552066270.1421668072.1421668072.1421668072.1;+__utmz=176340583.1421668072.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmmt=1&utmu=qACgAAAAC~ HTTP/1.1

Accept: */*

Referer: hXXp://sd.softonic.pl/21547/universaldownloader/campaign-100861,101633/eulastep-101727?sd_timestamp=1421668077

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.google-analytics.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Pragma: no-cache

Expires: Wed, 19 Apr 2000 11:43:00 GMT

Last-Modified: Wed, 21 Jan 2004 19:51:30 GMT

X-Content-Type-Options: nosniff

Content-Type: image/gif

Date: Wed, 14 Jan 2015 16:06:08 GMT

Server: Golfe2

Content-Length: 35

Cache-Control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate

Age: 435219

Alternate-Protocol: 80:quic,p=0.02

GIF89a.............,...........D..;....

GET /collect?v=1&_v=j31&a=1027184309&t=pageview&_s=1&dl=http://sd.softonic.pl/21547/universaldownloader/campaign-100861,101633/eulastep-101727?sd_timestamp=1421668077&ul=en-us&de=utf-8&dt=Pobieranie i instalacja TeamSpeak 3&sd=32-bit&sr=1024x768&vp=780x550&je=0&fl=11.6 r602&_utma=176340583.1552066270.1421668072.1421668072.1421668072.1&_utmz=176340583.1421668072.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none)&_utmht=1421668084468&_u=MACCAEAAI~&jid=&cid=1552066270.1421668072&tid=UA-48247475-3&z=1515662130 HTTP/1.1

Accept: */*

Referer: hXXp://sd.softonic.pl/21547/universaldownloader/campaign-100861,101633/eulastep-101727?sd_timestamp=1421668077

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.google-analytics.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Pragma: no-cache

Expires: Mon, 07 Aug 1995 23:30:00 GMT

Access-Control-Allow-Origin: *

Last-Modified: Sun, 17 May 1998 03:00:00 GMT

X-Content-Type-Options: nosniff

Content-Type: image/gif

Date: Wed, 14 Jan 2015 16:05:42 GMT

Server: Golfe2

Content-Length: 35

Cache-Control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate

Age: 435245

Alternate-Protocol: 80:quic,p=0.02

GIF89a.............,...........D..;..

GET /pagead/show_companion_ad.js HTTP/1.1

Accept: */*

Referer: hXXp://sd.softonic.pl/21547/universaldownloader/campaign-100861,101633/eulastep-101727?sd_timestamp=1421668077

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: pagead2.googlesyndication.com

Connection: Keep-Alive

HTTP/1.1 200 OK

P3P: policyref="hXXp://VVV.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"

Content-Type: text/javascript; charset=UTF-8

ETag: 1436797345198880355

Date: Mon, 19 Jan 2015 16:22:31 GMT

Expires: Mon, 19 Jan 2015 17:22:31 GMT

X-Content-Type-Options: nosniff

Content-Disposition: attachment; filename="f.txt"

Content-Encoding: gzip

Server: cafe

Content-Length: 53257

X-XSS-Protection: 1; mode=block

Age: 2236

Cache-Control: public, max-age=3600

Alternate-Protocol: 80:quic,p=0.02

...........}i..=..{....u.........m.;.......>.....G..}.JR......v_.L...J.T.*...p6....P7.n.I.q.i..1.....x....dX....Ru.....T..2.xpl.......U4..lo>w.........V.Jp.x-o..O.s5.kX.VF`..G.....T...;....>....S.0,c5Iq..5.....].j.......X0_i...`A.{N..L.....z..)..T..:.1..=.nK....K.....~....c.C]..?.o...k@.`.o./j...d........feaN...Tr-...yle<.MGXge:jM'.a..9...E...-(}....m.Z...D......C`..6.].....O..k.....a.k.I*...,K....... jB...q...Z..k.0...N..wb.e{...../5..J.$.^[..((....`,....@..R...-.N......lD1...:..`...HiV&..../..l..I^....#Zc.....pE....?._.#@....j;.fu...g...;.G.....{......3........U>'L..cL{..m.9..........#.[...G....B..Nfa.r.K....U~..B....D.<...8".{.X.k...(#.`....m....q(...k...c......w'...........[...1..D...=8..9......6V[6.....0.ne<.z.p(...*~.. ];..3.*...|...2....`.r..9.k...g.......d.,C%..,/...&.p:.........1.o...d.MG.{.....D.Z..B.Z..]>.zv..o..goZ....z.........]..1:K.r....e].a:.F.3?v&Q.n0r..F ..c.X.................2..P..Us.....Y9.......Fe.D...j....:.......i...?.....v..b<....la...Eu.M.l..l.([.GC.C..\;S..O.~{@.T.P..L.{..Z.R..X.`.8L.....[..N..W.. ...{.....j.`.J...^.@SIx....{%a.....Z........\.d.Z{Q...........M8....b.s1'..S._.....R..D..F.A..Q.[.G3 .<@(W.a0.`s....N].;]..Y........B...Z3E..C.|.[...;.....o....5.Rtca.&N.........2..s...<.z..e...q...5....?9L[s...f.q.1n0U..`T7....~.F..o....7j.w..B..W.c.8r....XxF9......<,i.....A'......'...?..f.....~. ..dE.J....Z..HF..t..a..G...~..m....o.. .j...~...w..b...|^....[.i{..n.b..|].G....p..Sw].7=..Mq......1=&.!.....Ck....g....g..[w .$.S.9..J]..7...Td ....f.].oV..K...a

<<< skipped >>>

GET /campaign/scrn/100000/100861/sd_100861_41d97.jpeg HTTP/1.1

Accept: */*

Referer: hXXp://sd.softonic.pl/21547/universaldownloader/campaign-100861,101633/eulastep-101727?sd_timestamp=1421668077

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: screenshots.en.sftcdn.net

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Apache

Last-Modified: Mon, 24 Mar 2014 16:19:57 GMT

Cache-Control: max-age=172800

Content-Type: image/jpeg

Content-Length: 8968

Accept-Ranges: bytes

Date: Mon, 19 Jan 2015 16:59:43 GMT

Connection: keep-alive

Age: 0

X-Served-By: screenshots

X-Cache: HIT

X-Cache-Hits: 444

Expires: Wed, 21 Jan 2015 16:59:43 GMT

......JFIF.....H.H.....C....................................................................C.......................................................................j..............................................?.........................!.1..A.."2Qaq..#BR..38bt...$CS.(Dcr..................................4........................!1.A..Q."aq.....R..#2B................?..TF....v8..$...[j..2..:.B.*'..#...S]5......m.i...u..k.....U....zY...*.c&6#..G#=..`...h...5}..........Y...&H..p...0....@f.vn....UV....MK.D.T.L.q.............a.W....e.\...#QTh)d...g.. .....q..{h.s...h.....4.....4..........=4....Ac..B3{.h.Ta..S.Q#.9.\....?..*..B..u..k.w.;q..i.Kt\...N...B...s...........[.?....Y)$.....,.O .,p.....w...mQ...c[...'..mDm;....=.....>U.a9....J..;.../..E{QZ.n^......z...oQ.&~..>3...s.q....5..l...l..y...n.7......:.(...........9.d.!.........=..;n{...].5.]...d..?..$qB..eO/...$.9..T..jx.b.S...%.T.]..R.o.[....=N..YY...He.yd.....R@.... [....6]}f..F..5..K...B.i.M5@(.. ....1!....v..m/g.M.z.J..,.]........t...VK .x.h.c.jX?W$F.#....OQm...x/.W.,.*.a..h....Y.....S.d..;.c..b.......~...l.&....tX....n.F.Sr..T...X..*W.^..N2.......wh..;.........=^"T....\0v.W.........J..%.Ay...i.UB..UD.S%Z.Y...0..nT.=..,.Y\q.....h...V.B.J.....I..e.|.,J....|..\.......>`.`IN.K....5.&z...[..x..<..r.#..,~..$.\. .m...I4..6.%..eX.Q^.d.;...n..<..?.. ....d........>.%..U.8..Xc.Ia.........C..U....Zo..E...\..<.ReH:...jY..<0..F......,.;3a.n.... %....-L.uK.2!`......=3. m.$._...m.."...c....f.i!....p.>_?"....Rw,../.-..Z....I..%...Q....."`...9n..@...P

<<< skipped >>>

GET /campaign/scrn/101000/101633/sd_101633_08ebf.jpeg HTTP/1.1

Accept: */*

Referer: hXXp://sd.softonic.pl/21547/universaldownloader/campaign-100861,101633/eulastep-101727?sd_timestamp=1421668077

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: screenshots.en.sftcdn.net

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Apache

Last-Modified: Thu, 30 Oct 2014 23:27:53 GMT

Cache-Control: max-age=172800

Content-Type: image/jpeg

Content-Length: 261

Accept-Ranges: bytes

Date: Mon, 19 Jan 2015 16:59:43 GMT

Connection: keep-alive

Age: 0

X-Served-By: screenshots

X-Cache: HIT

X-Cache-Hits: 1318

Expires: Wed, 21 Jan 2015 16:59:43 GMT

......JFIF.....`.`......LEAD Technologies Inc. V1.01...C.......................................................................}...........................................................?..`...................................................................?......

GET /campaign/scrn/101000/101633/sd_101633_08ebf.jpeg?v=0.12472576205380864 HTTP/1.1

Accept: */*

Referer: hXXp://sd.softonic.pl/21547/universaldownloader/campaign-100861,101633/eulastep-101727?sd_timestamp=1421668077

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: screenshots.en.sftcdn.net

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Apache

Last-Modified: Thu, 30 Oct 2014 23:27:53 GMT

Cache-Control: max-age=172800

Content-Type: image/jpeg

Content-Length: 261

Accept-Ranges: bytes

Date: Mon, 19 Jan 2015 16:59:47 GMT

Connection: keep-alive

Age: 0

X-Served-By: screenshots

X-Cache: MISS

X-Cache-Hits: 0

Expires: Wed, 21 Jan 2015 16:59:47 GMT

GET /shared/img/sd_client/sprite.png HTTP/1.1

Accept: */*

Referer: hXXp://sd.softonic.pl/21547/universaldownloader/campaign-100861,101633/eulastep-101727?sd_timestamp=1421668077

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: static.sd.softonic.pl

Connection: Keep-Alive

Cookie: __utma=176340583.1552066270.1421668072.1421668072.1421668072.1; __utmb=176340583.1.10.1421668072; __utmc=176340583; __utmz=176340583.1421668072.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); UACR_21547=false; UACA_21547=false; _FCpl=101727|1|1421668077.101633|1|1421668077.100861|1|1421668077; UD1_POSITION_21547=; NREUM=s=1421668078734&r=155687&p=0; _ga=GA1.2.1552066270.1421668072; _gat=1

HTTP/1.1 200 OK

Date: Mon, 19 Jan 2015 16:59:44 GMT

Server: Apache

Last-Modified: Thu, 29 May 2014 10:12:25 GMT

Accept-Ranges: bytes

Content-Length: 7892

Cache-Control: max-age=172800

Expires: Wed, 21 Jan 2015 16:59:44 GMT

Keep-Alive: timeout=3, max=10

Connection: Keep-Alive

Content-Type: image/png

.PNG........IHDR.......\.....ld......sBIT.....O.....PLTE...................................................................................................................................h.......................f.....n........Dw.I..............U..}..,...v..\. g...........x.a...R..............>....:n........M..].T*..:.....m....tV.....]........7....Q..P..O)....P.i...O..N..N..M....sJ..M..K..L..L..J..J..JJz...I..I..H..I..H..Istv..H..G..H..G..G..G..F..F.x.go...F..F..E..E..D..D..D..B..C/v...B:~4kid..A..A..@..A..>/g..m..p..i...<..=.z:.g.;b..z:.7@.6?[ZW.5>.u8.4<.s7.b..3;.1:.09{O$./8.p5..7.-6.[..m4&Q..,5. 3.k3(X..*2.)1.R..(0.'/.%,.T..f1.e1.&..$,.$,.%-.# .# ."*.#,."*.!)." .!(.!*.!). (..'. (..&. '.I...'..&..%..&..%..%..$..$.."..#..#..".."..!..!....9.899...................*................>.j.....tRNS.....................................................................................................................................................................................................................................................~T.....pHYs...........~.....tEXtSoftware.Adobe Fireworks CS6.......gIDATx...._[.^..'.LhC...4.t.K....H.w0......^.)w.i..T...q..w..bq..*U.2j]..hU...^.}).\.......,.@......._..!0.u>y....@.......eh\..fUHC....c.X;4.c..I...m..c...d.B.2...}. ..- ...A....,.:p51.4.Ig..:.}......r......WXw..........z. 3v..^.....2......5.Bw.;...M.......ffx..Ac.......jf...F53.K...y...^.(h..M].>....................y.o.:...m.-.2C....................(.Jro.P............wqo....7....<...7*.z......

<<< skipped >>>

GET /e/dtb/bid?src=3177&u=http://sd.softonic.pl/21547/universaldownloader/campaign-100861,101633/eulastep-101727?sd_timestamp=1421668077&cb=3030167 HTTP/1.1

Accept: */*

Referer: hXXp://sd.softonic.pl/21547/universaldownloader/campaign-100861,101633/eulastep-101727?sd_timestamp=1421668077

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: aax.amazon-adsystem.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Type: text/javascript;charset=UTF-8

Content-Length: 8

Date: Mon, 19 Jan 2015 16:59:43 GMT

Server: Server

void(0);..

GET /css/generated/fad58-8688a.css HTTP/1.1

Accept: */*

Referer: hXXp://sd.softonic.pl/21547/universaldownloader/campaign-100861,101633/eulastep-101727?sd_timestamp=1421668077

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: static.sd.softonic.pl

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Mon, 19 Jan 2015 16:59:43 GMT

Server: Apache

Last-Modified: Tue, 16 Dec 2014 09:23:38 GMT

Accept-Ranges: bytes

Cache-Control: max-age=2592000

Expires: Wed, 18 Feb 2015 16:59:43 GMT

Vary: Accept-Encoding

Content-Encoding: gzip

Content-Length: 5076

Keep-Alive: timeout=3, max=10

Connection: Keep-Alive

Content-Type: text/css

...........<k..Fr.. ..,|. ..........H. ......"[...I.......T...........DuWUWW.....H..v..s....6...C.o9Mi..N$/.......t[.......cUd..................0...Y.f].e....",.....qx...ix...yX74.W.)......0/.s.v.kG.J.:..U...s...;.].G\N.9..:..$............c.N...kGv.........(H......?.5I..k-....A|.i:.........aJ....0.....h..K$..i......{).....b..<s... 0.\\......*.v..r!"E~(...wW...O..]'q.........i....;.\R.C.n..wW..5!I..|9..,....%.[...N.Y.....Ku.......J..%:U.E....QZP......w.w.....FlY.a3...;n..m....{Y..,.e.OQ...'.r....>|....Gw...T7y.m..P...,^..A8......~....o.?...j:Rv.QYm{./....^..,....^....A._-.....U......N.@."....T_h./.g................L..\.M...b"...h{...r..a.~........_..;.G.:..K.}.."lI.F-m..y.... H|-.BAv.`2/.;H.o.<c..y..y...t.q...@....~....6.)....O!..J.......G.q\...]..iG.6...OI!............?.d.L.R...x.k.{\r6.w.R.?}.|J?......x..,.......v.%....S{......~.>......IS......A........A"7.p*}.{.;....2C...<.......N[..FOPK.......J~...............Mu....)...c.&.f..&|l.mZ.p(?..K::....?...I..S.....ZS..O..g.t..#.B.O.%WA...M8.......X.vsJ..*...t....[.....qIl..oZa...b.)....A..%..i.oM...&.7........a.ILq...H7.....Y.........Z./.>.H...q....q&.L..' ..6..f....^.-...0..E... Q.............c..Z...&(P..`q....1..{..@.j!.'i.......ca...Mu".5..%n0G]ub.U...g.........T...N..Q.X...(...F...z...d..... ..s.Vv...O...f...>.........'..8.A....2._..B.&L...F. A....x..|ibD....r.c[.tB..S...c..`...|..2.aLKI.....tk....8..g.>..).;1...1....p...$.C.!E.,.cb....z..o..(..m\L. "P`'.X.3r........h./=.F..S{Q...O..$....Nmu.B.%.....F....B......G.YsW#......!...~I..=..

<<< skipped >>>

GET /shared/img/sd_client/gradientbg.png HTTP/1.1

Accept: */*

Referer: hXXp://sd.softonic.pl/21547/universaldownloader/campaign-100861,101633/eulastep-101727?sd_timestamp=1421668077

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: static.sd.softonic.pl

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Mon, 19 Jan 2015 16:59:44 GMT

Server: Apache

Last-Modified: Thu, 27 Mar 2014 08:18:48 GMT

Accept-Ranges: bytes

Content-Length: 2958

Cache-Control: max-age=172800

Expires: Wed, 21 Jan 2015 16:59:44 GMT

Keep-Alive: timeout=3, max=9

Connection: Keep-Alive

Content-Type: image/png

.PNG........IHDR...)...........\.....tEXtSoftware.Adobe ImageReadyq.e<....PLTE............................................................................................................................................................O *E...4tRNS....................................................KW"e...HIDATx....v.9..Q{.%y......I.3.\...m..`..u.s1.s.D...Q,. ..`(..S....O.....SJ........8...=.LR.[.&......:.eJY..oI:./...$..BJ.#KS.sH2..%.{F..='..?HR./..6.X......)./R.. ..6.....F..g.[.I.<.l..2$...42.....S.....>..........h2..f..3.........<...X&r....T..gg.-...t.....em<b.V&.g.c....6E,.-..qF6. ...o.Q.$S...(./y...DD..w..:iQ .c....3.&.TcCT.t,UE.E..HP.R.s.......V.`...%...'6.`...g..UIf(..K....uF2..r......T.!..]fLWF..\lU$....=c:2#.`....<...E". .".. qU.7P.[..c.}.J.q.N.*..:g)%...!.. ..,.@x..0.m.8.........A..,9.:l....c....<...G.8...O......?.....5..'}.....TB..#.... Uxq..\..Y....1.P ..P.........Cda...g.....V'....G.:..uW..2.X......a2!.....L..2...mb...f:.i. z........S...u)d8dC.R..q.`..N.^.~.q.......].....U.....%..p1&..b5..K..q..h...D......0...b..?M`...ak..2}J.7....l..<........7\...g!.Jf.0k.......){.-[.f...M.. ..`.hY}..]....Z...z`.J.eb.........Vl..s...p.Zi.*..kd~..Q...l.@......(l.v.L%:..|.c....,..Tg.....I..7[.-#,.....j#...B.`..b.m`..[....g..<Gs......".5c.R.4QC.5.]...X......@.S..I...T.h.6.9MD....w.Xb..N....%0.m./....z{{~.y...........gz.zz.........??{..g~....D...............z._.......k.}...^?v..w.O..........t.x...~..x..}.......................................=..m...]Ew7...._....j_.j.....~.&....\7....~.....Pw..

<<< skipped >>>

GET /shared/img/sd_client/loading.gif HTTP/1.1

Accept: */*

Referer: hXXp://sd.softonic.pl/21547/universaldownloader/campaign-100861,101633/eulastep-101727?sd_timestamp=1421668077

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: static.sd.softonic.pl

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Mon, 19 Jan 2015 16:59:44 GMT

Server: Apache

Last-Modified: Thu, 27 Mar 2014 08:18:48 GMT

Accept-Ranges: bytes

Content-Length: 1553

Cache-Control: max-age=172800

Expires: Wed, 21 Jan 2015 16:59:44 GMT

Keep-Alive: timeout=3, max=8

Connection: Keep-Alive

Content-Type: image/gif

GIF89a........................................................................................................................................................................................................................................................................................................................................~..}..|..z..y..x..t..v..s..r..q..p..m..o..l..k..j..............!..NETSCAPE2.0.....!.....|.,............|..;\r....bvwz.....-lqK'......|.[p9.....4lE.....Nj#.....^g.....[c.....G_......[8..!..IV*..'..|#OP1......).. @JGB=93)...$3<9 ......!.....|.,..........y.|.|4RhjW:...)Vilortvd1.&]eA..&Lwt.N`..|<.-[;...|AX....NU....JQ....8M.....%I.....|8C ......<=%.........173/*&!....% '.....!.....|.,..........w.|.|-EY[L3..!GX[_cgjZ..LS6.Cmj..?M)..6r`."I0..Iu:3E...&xZ<A...zr9=.. 8....5!....*0....... *..........!$!................!.....|.,..........w.|.|$9IM@,...8GJOSWZM&..;A..:_]).1<...0dU|.7$..Aj4&3..mR,0..pi(...qk.)..&uX.$..Mw;|....{g.|.......|2....................!.....|.,..........z.|.|.(591#...'258=AE<...)-....-KI ..)...&PE|."...5W,......ZD...._X....c[....fL....Dk4|....9o\......'Jsl......zxa.....[;....!.....|.,..........x.|.|..$'#......"&*.2-......... 77.......=5|.....(C#......G6....LG....QJ...|U?....:Z,|...1_M.N'|.Be]&.fyxtrokV)..;YljS....!.....|.,..........w.|.|...........................$%........*&|......0......3)..95..=9[z...B1<wL./G#.ct8.)M>./mrF.7TL...]nkfc_ZH!.5O_[G....!.....|.,..........v.|.|........|.........1.......gz.|...|;wM.|...Xv'..!.lt..&"jr.|*'So../#5lD.#3.|

<<< skipped >>>

GET /a/api/market.js?&account_id=10496&site_id=44182&zone_id=191950&rtb_model=1&cb=oz_onValuationLoaded_191950_15&size_id=15 HTTP/1.1

Accept: */*

Referer: hXXp://sd.softonic.pl/21547/universaldownloader/campaign-100861,101633/eulastep-101727?sd_timestamp=1421668077

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: anvil.rubiconproject.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Mon, 19 Jan 2015 16:59:45 GMT

Server: RAS

Set-Cookie: ruid=553d828f54bd3801b86b26260f9033^1^1421686785^3094029862; Domain=.rubiconproject.com; Path=/; Expires=Sun, 19-Apr-2015 16:59:45 GMT; Max-Age=7776000

Set-Cookie: rsid=D9mHUmzor4ROFe/ifUEExbIlZameizM4neDXJEmywTNFMJ/OUnD8SJxgKuNsi8Vv2dhLoBsVvXbJcuItcII2VJBP/a4zJzyPfMah/Yq/He8BD4By41q DGoIlkdnrg6ySvzkV9BuD6xR506DigXWmb2l; Domain=.rubiconproject.com; Path=/

P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

Cache-Control: private, max-age=14400, must-revalidate

X-Rubicon: AE API

X-Revision: svnrevision: 104957

Keep-Alive: timeout=5, max=97

Connection: Keep-Alive

Transfer-Encoding: chunked

Content-Type: application/x-javascript

Content-Encoding: gzip

Vary: Accept-encoding

149............ePMk.1.....rR).[?.......CA.RJH...M.& .........d.....w..V.W:xg..'..sBv..ZD., ..{....2......G..f[W...M.=...........EM..t:.g...Y.........Fq._......=.]{.XL...Q....`0Q..C.M.tu.fYk5..H}L.F6.9.%.....]>..?.......]_.zwBi..Y>.g<.w...9..".-v...Jw....z."..R.....[..7...MG....(b..\....8...RM`.......yI,.Z.".....k.V.j.-.......F........0......

GET /a/api/market.js?&account_id=10496&site_id=44182&zone_id=191952&rtb_model=1&cb=oz_onValuationLoaded_191952_15&size_id=15 HTTP/1.1

Accept: */*

Referer: hXXp://sd.softonic.pl/21547/universaldownloader/campaign-100861,101633/eulastep-101727?sd_timestamp=1421668077

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: anvil.rubiconproject.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Mon, 19 Jan 2015 16:59:45 GMT

Server: RAS

P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

Cache-Control: private, max-age=14400, must-revalidate

X-Rubicon: AE API

X-Revision: svnrevision: 104957

Keep-Alive: timeout=5, max=63

Connection: Keep-Alive

Transfer-Encoding: chunked

Content-Type: application/x-javascript

Content-Encoding: gzip

Vary: Accept-encoding

798.............X[o.G.}..X.....W./A.J..".. U.......Y.-....w.._.=....O.Owo>.|...........~....^..ry.......{..n..^....?.~.....n@_.}......].}..y%....G ..o.]cS...".o.?...._o.no..%op6M...7W ^.^. V.x1..VAqQ.VY....b*V..:..^...RO}.rjkm...J..I..G6....J-..C6.S......nEj.U-..so/..d..a.!..iT.."...Jk.cj#......c-..%.p...0[d.}u..-`}../...O.@...=.^......C......[.<.. .JeH......kM. ...{.j..dU...)w....\.X.}Jul`3._.....l.X3w..d.............*.2Z&.9.0[....{......~.h>..aOY.)..\.0Rj......%G.S@lT..... ..Y....)E.ks.EJ.E...&....y^..52....@._%...5..0I........X.=8E...@0............ (.QW...u...5X.J..."...^...B......PG.< 5SC|6...E5./....0...k...(R..).v.*...9#.."Y.N]'.r..?.:o0M1.!.............`....2.".{..ArbF"........~.<9............"SCR.C6..b....u...,...L...VK.UE...l....[.....*Mv.k.Z.!D..[.B...xi[.i8QT"2 uG.iq.....( %..t.8..... 0|..J W..Xp..".f!Z..X^....B[t..<"=K..X.*...B.uAV...1.6..D.i....W...K..."......[.....#8............pRq.#.aIph#.m0.~....{...p?........mz.Qh.].v..y...tV.ye.t.[..\,%...n..c...J.\......OU...!.].R..A.@...R7....a).. 9.....%/...dJ..`0.'#4..."/...........d.w(..U...VT#.....|.p.........-..\14.Q<......#.P0..s....1......."..~..."./..T.F.....d..!.0$x......#w..q.......8....B0.OC.......]5.....E...Q...:...0.....<.6.w.eJ.J.i#.l.Xe...#..?...W.........g.}Q...C._:.iR........E.X.Q...pP$Vk-0A'...uY%.;z..sh...UE........J..(....8b..................w......j.O8.y=S..=.q.cD.3..E.....~.1..i..W.......F.........P.SWzG.d..-B.......Aa:."........L'.o.i..5{........=.`..(......g.l...._....l...3^bJ.|1.aL...o..U.....ZbwJAY.v.D_..~J.

<<< skipped >>>

GET /campaign/scrn/100000/100861/sd_icon_100861_8a4a3.png HTTP/1.1

Accept: */*

Referer: hXXp://sd.softonic.pl/21547/universaldownloader/campaign-100861,101633/eulastep-101727?sd_timestamp=1421668077

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: screenshots.en.sftcdn.net

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Apache

Last-Modified: Tue, 25 Mar 2014 08:34:17 GMT

Cache-Control: max-age=172800

Content-Type: image/png

Content-Length: 1191

Accept-Ranges: bytes

Date: Mon, 19 Jan 2015 16:59:43 GMT

Connection: keep-alive

Age: 0

X-Served-By: screenshots

X-Cache: HIT

X-Cache-Hits: 474

Expires: Wed, 21 Jan 2015 16:59:43 GMT

.PNG........IHDR..............w=.....bKGD..............pHYs...t...t..f.x....vpAg.........xL......IDATH..V.K.Q........[n...-....4...YXQ).. .E!A..P..>T.E...P...?D.Y...,.PD.e.Yd..:..c.).9xv.......y..y...$....!>>.111|LLL..QQQ...Fll,.###.H:.FB{.NJJ..._.IR......9#=.........f8l640..PY...|...r....(..........9xDD.W...R........8..G.....5^0.....V..V.a.XPQ^..Rt"b.'L.,..iR...j...W......W...........bOs.LF#.J%..i&C..PX4!KK.......0.6...f...ao:.m.A..>y."...D..s...]9/.`.H...`ge.\&Cxx8O.$.B....6r.C.v-..;.............O]........c...M..*.TG9/........q..................O...9.:.f....l49.....HT..99hu....N...ob>....n\......PI.i)......l..a...&.a.kk..#k......wc#.x.@........x......L .A.....4.|[.7.V.&..R4..^..R...eZ...|.v.....O..>6p-...v-....!S.T...h2..tj.....{V......>b..2..aF...........nGN..H..c..B........K..n....MR.Y**(@ws-'..........C.....N...!:_.....( -.N..D........T1 ... .........s;.&....... ....03.>...{3_&%. ....['..0y..A.......f.^mS..N9.ai!...E.'.-S.S..h.:....n...7T..f-.w....*.a..S..[..HK......Q=9....G.$.$...M....*!.5}cM.\N'.<B.........W|q....4.h.0....$~..[lJg...EF.X..|..G..#.#.....o...m...%tEXtdate:create.2014-03-25T09:34:13 01:00y..B...%tEXtdate:modify.2014-03-25T09:34:13 01:00........IEND.B`.....

<<< skipped >>>

GET /campaign/scrn/100000/100861/sd_100861_41d97.jpeg?v=0.010570287798522315 HTTP/1.1

Accept: */*

Referer: hXXp://sd.softonic.pl/21547/universaldownloader/campaign-100861,101633/eulastep-101727?sd_timestamp=1421668077

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: screenshots.en.sftcdn.net

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Apache

Last-Modified: Mon, 24 Mar 2014 16:19:57 GMT

Cache-Control: max-age=172800

Content-Type: image/jpeg

Content-Length: 8968

Accept-Ranges: bytes

Date: Mon, 19 Jan 2015 16:59:47 GMT

Connection: keep-alive

Age: 0

X-Served-By: screenshots

X-Cache: MISS

X-Cache-Hits: 0

Expires: Wed, 21 Jan 2015 16:59:47 GMT

<<< skipped >>>

POST /universaldownloader-track HTTP/1.1

md5_hash: eb12145e862292884137a3429d645032

Accept-Language: en-us

Referer: hXXp://sd.softonic.pl/21547/universaldownloader-prefetch

Accept: application/json, text/javascript, */*; q=0.01

Content-Type: application/x-www-form-urlencoded; charset=UTF-8

x-requested-with: XMLHttpRequest

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: sd.softonic.pl

Content-Length: 5820

Connection: Keep-Alive

Cache-Control: no-cache

id_session=ED284C48-BEE8-43E5-ADF1-A8C43C9909D3t1421668077f21547&id_machine=a8a67a25000000000000000c297ccd1f&id_user=ED284C48-BEE8-43E5-ADF1-A8C43C9909D3&id_file=21547&id_section=157&id_main_section=200&ab_test=&api_version=1.40.2&timestamp=1421668077&download_browser=unknown_browser&download_browser_version=unknown_version&client_timezone=2&test_track=false&flavour=&av_installed=&step=prefetch_events&events=[["special_conditions_evaluation",[{"campaign_id":"101727","campaign_priority":1,"campaign_reranked_priority":null,"special_condition_id":-3,"sp

HTTP/1.1 200 OK

Date: Mon, 19 Jan 2015 16:59:41 GMT

Server: Apache

Set-Cookie: sd_client_pl-admin=deleted; expires=Sun, 19-Jan-2014 16:59:40 GMT; path=/; domain=sd.softonic.com

Vary: Accept-Encoding

Content-Encoding: gzip

Content-Length: 35

Keep-Alive: timeout=3, max=10

Connection: Keep-Alive

Content-Type: application/json; charset=utf-8

...........V*.I,)-V.R..V.....l.........

GET /21547/universaldownloader/campaign-100861,101633/eulastep-101727?sd_timestamp=1421668077 HTTP/1.1

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: sd.softonic.pl

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Mon, 19 Jan 2015 16:59:42 GMT

Server: Apache

Set-Cookie: sd_client_pl-admin=deleted; expires=Sun, 19-Jan-2014 16:59:41 GMT; path=/; domain=sd.softonic.com

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Cache-control: max-age=0, must-revalidate

Pragma: no-cache

Vary: Accept-Encoding

Content-Encoding: gzip

Content-Length: 19811

Keep-Alive: timeout=3, max=9

Connection: Keep-Alive

Content-Type: text/html; charset=utf-8

.............v.X.(:.......2...H.z..[.:K.e[Rqm..$H...P.i)..N....j..oX..jt .#.K^.n..T.t..{nzeRhv.;............-...l.......%./.O.6....M.....].\()'>q. .\.....~F..........0X(.~.xrT....XY\..D......3/X..=...)..WWWy..b...e<..........mJL...Eh.6}y.....,.X...!...!..%.c........b........2...a.Q.....j.....^...6].v....WB....o]i..GZ4t]['~..^..@...-/T......:,v...Oq$..]._..f.:..0....x.)..*k.....u..}6....k.C._.l.fA.W...(..]..........cn..3..rs......w[>.. "......2.O..*.....s>.....m.5..........<0...1..... }'...h....jt-......K.......;pl...G~5.1..... .)/.......k..T.o.-r)............7..v..7..''[{.'.Xr..._.n...l. hY.`.......*;o..h.[4..I..=..J.*$!`i.c......YH...A.4.P...B'....D?>Y..\..-.g.KDG.....r6..h.n0.......|y......._(.........N.. ..M....l..0"du..*o..Y=...a.w2g...B)...EF..w...6......Rg......WY]5r_.&VD0.z....V../..M.V......g.........T.\.n>....m...].....z.......X.!o..Hi.1.x.......ss..q..y.. 0.,.....8....%.....&.k~.....}5..^e.5.....XM........\.......m*P...}.E.f_.?Y..x.."3G..u......`.........R@.....m..F.......@FO...<{......@.......4...;P.z..d.a..zNvZG...N..>....0.)dr1j....g.E...........@..y.....I.3..k.E........y...FA.:A....{...i..:r..MX-.,7.F3...bC.1.%jW...Tm...R-.S.Zwn. .\.1..N.G<..@N.g.?e.....d..D......t..kR.R=..ss3..!..,9./.=._..`\...4.^.d@D...Y..tQ0.._..%(.@em...-(ZR.QO9.hv...A........"n..E....9.... 8*....l....BK..g...8(M 8/..\....... ...}V.N.n.|..Vza$.....k.RGdu.ma..E....Quon.\......E...........W..$..\.(R....H....\.`.Z/.Vc$...9Y@G9....kiF.)....Z..37..:..n,._....j.97.E....4/Wo".$.....&.T..-.T...v.^...@..f

<<< skipped >>>

GET /beacon/p/rtp/valuation?&p=rubicon&pc=10496/44182&ptc=191950&api=valuation&as=dart-gpt&asz=300x250&asid=15&hit=1&co=ca&rnd=2947 HTTP/1.1

Accept: */*

Referer: hXXp://sd.softonic.pl/21547/universaldownloader/campaign-100861,101633/eulastep-101727?sd_timestamp=1421668077

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: beacon.rubiconproject.com

Connection: Keep-Alive

HTTP/1.1 204 No Content

Server: Apache-Coyote/1.1

Cache-Control: private, max-age=0, no-cache

Expires: 01 Jan 1970 10:00:00 GMT

Pragma: no-cache

Date: Mon, 19 Jan 2015 16:59:47 GMT

Map

The Worm connects to the servers at the folowing location(s):

Strings from Dumps

%original file name%.exe_580:

`.rsrc

j;j.htzR

j;j.hD}R

G><.tn>

II I!"II#$IIII%&'III(I)*I III,-.II/0123IIII4I5IIIIIII6IIIIII789:;II?@ABCDEFIIIIGIIIIH

88888888888888888

%u$Vj%

t.Gj:W

.tMHtJH

xSSSh

FTPjKS

FtPj;S

C.PjRV

j;j.hh

hTCP

%s:%d

WARNING: failed to save cookies in %s

About to connect() to %s%s port %d (#%d)

Connected to %s (%s) port %d (#%d)

malformed

:]://%[^

[^:]:%[^

Protocol %s not supported or disabled in libcurl

http_proxy

%5[^:@]:%5[^@]

%5[^:]:%5[^

:%5[^@]

Port number too large: %lu

%s://%s%s%s:%d%s%s

ftps

[%*39[0123456789abcdefABCDEF:.%]%c

Couldn't find host %s in the _netrc file; using defaults

PTF@example.com

Couldn't resolve host '%s'

Couldn't resolve proxy '%s'

User-Agent: %s

Connection #%d seems to be dead!

Connection (#%d) was killed to make room (holds %d)

Re-using existing connection! (#%ld) with host %s

%s://%s

Connection #%ld to host %s left intact

operation aborted by callback

HTTP/

ioctl callback returned error %d

the ioctl callback returned %d

seek callback returned error %d

The requested URL returned error: %d

HTTP/1.0 connection set to keep alive!

HTTP/1.1 proxy connection set close!

HTTP/1.0 proxy connection set to keep alive!

HTTP 1.0, assume close after body

HTTP =

HTTP/%d.%d =

No URL set!

[^?&/:]://%c

Violate RFC 2616/10.3.2 and switch from POST to GET

Disables POST, goes with %s

Issue another request to this URL: '%s'

Maximum (%d) redirects followed

Received problem %d in the chunky parser

HTTP server doesn't seem to support byte ranges. Cannot resume.

Rewinding stream by : %d bytes on url %s (size = %lld, maxdownload = %lld, bytecount = %lld, nread = %d)

Leftovers after chunking. Rewinding %d bytes

Operation timed out after %ld milliseconds with %lld bytes received

Operation timed out after %ld milliseconds with %lld out of %lld bytes received

unspecified error %d

%s cookie %s="%s" for domain %s, path %s, expire %d

#HttpOnly_

httponly

I99[^;

skipped cookie with bad tailmatch domain: %s

skipped cookie with illegal dotcount domain: %s

23[^;=]=I99[^;

%s%s%s

# Fatal libcurl error

# Netscape HTTP Cookie File

# hXXp://curl.haxx.se/rfc/cookie_spec.html

# This file was generated by libcurl! Edit at your own risk.

[%s %s %s]

Send failure: %s

Failed writing body (%d != %d)

bind failure: %s

Local port: %d

Bind to local port %d failed, trying next

couldn't find my own IP address (%s)

Bind local address to %s

Couldn't bind to '%s'

TCP_NODELAY set

Could not set TCP_NODELAY: %s

Failed to connect to %s: %s

Trying %s...

Resolving host timed out: %s

Could not resolve host: %s; %s

Could not resolve proxy: %s; %s

Could not resolve host: %s

gethostbyname(2) failed for %s:%d; %s

init_resolve_thread() failed for %s; %s

TFTP

set timeouts for state %d; Total %d, retry %d maxtry %d

tftp_rx: giving up waiting for block %d

Received unexpected DATA packet block %d

Timeout waiting for block %d ACK. Retries = %d

tftp_rx: internal error

tftp_tx: giving up waiting for block %d ack

Received ACK for block %d, expecting %d

tftp_tx: internal error

bind() failed; %s

tftp_send_first: internal error

%s%c%s%c

TFTP finished

Can't get the size of %s

Can't open %s for writing

Last-Modified: %s, d %s M d:d:d GMT

Couldn't open file %s

There are more than %d entries

LDAP remote: %s

LDAP local: ldap_simple_bind_s %s

LDAP local: Cannot connect to %s:%d

LDAP local: trying to establish %s connection

LDAP local: %s

LDAP local: LDAP Vendor = %s ; LDAP Version = %d

CLIENT libcurl 7.19.0

MATCH %s %s %s

DEFINE %s %s

insufficient winsock version to support telnet

WSAStartup failed (%d)

%s %d %d

%s %s %d

%s %s %s

%s IAC %d

%s IAC %s

Sending data failed (%d)

%d (unknown)

%s (unsupported)

%s IAC SB

Syntax error in telnet option: %s

Unknown telnet option %s

7[^= ]%*[ =]%5s

USER,%s

%c%c%c%c%s%c%c

%c%s%c%s

7[^,],7s

%c%c%c%c

FreeLibrary(wsock2) failed (%d)

WSACloseEvent failed (%d)

WSACreateEvent failed (%d)

failed to find WSAEnumNetworkEvents function (%d)

failed to find WSAEventSelect function (%d)

failed to find WSACloseEvent function (%d)

failed to find WSACreateEvent function (%d)

failed to load WS2_32.DLL (%d)

WS2_32.DLL

Excessive FTP response line length received, %zd bytes. Stripping

FTP response reading failed

FTP response aborted due to select/poll error: %d

FTP response timeout

Failed FTP upload:

RETR response: d

Connecting to %s (%s) port %d

Uploading to a URL without a file name!

FTPS not supported!

USER %s

socket(2) failed (%s)

PORT %d,%d,%d,%d,%d,%d

Telling server to connect to %d.%d.%d.%d:%d

Failed to resolve host name %s

getsockname() failed: %s

Connect data stream passively

REST %d

SIZE %s

STOR %s

APPE %s

Bad PASV/EPSV response: d

Can't resolve new host %s:%d

%d.%d.%d.%d

Skips %d.%d.%d.%d for data connection, uses %s instead

%d,%d,%d,%d,%d,%d

%c%c%c%u%c

Failed to do PORT

Got a d response code instead of the assumed 200

RETR %s

ftp server doesn't support SIZE

PBSZ %d

Access denied: d

ACCT %s

PASS %s

ACCT rejected by server: d

QUOT string not accepted: %s

TYPE %c

MDTM %s

ddd d:d:d GMT

dddddd

unsupported MDTM reply format

server did not report OK, got %d

Remembering we are in dir "%s"

CWD %s

Failed to MKD dir: d

MKD %s

QUOT command failed with d

Entry path is '%s'

PROT %c

unsupported parameter to CURLOPT_FTPSSLAUTH: %d

AUTH %s

Got a d ftp-server response when 220 was expected

%sAuthorization: Basic %s

%s:%s

Server auth using %s with user '%s'

Proxy auth using %s with user '%s'

Failed sending HTTP POST request

Content-Type: application/x-www-form-urlencoded

Internal HTTP POST error!

Failed sending HTTP request

If-Unmodified-Since: %s

Last-Modified: %s

If-Modified-Since: %s

%s, d %s M d:d:d GMT

%s%s=%s

%s %s%s HTTP/%s

%s%s%s%s%s%s%s%s%s%s%s

Content-Range: bytes %s/%lld

Content-Range: bytes %s%lld/%lld

Range: bytes=%s

;type=%c

ftps://

PTF://

Host: %s%s%s:%d

Host: %s%s%s

Accept-Encoding: %s

Referer: %s

Received HTTP code %d from proxy after CONNECT

%d bytes of chunk left

HTTP/1.%d %d

Read %d bytes of chunk, continue

CONNECT %s:%d HTTP/1.0

%s%s%s%s

Host: %s

Establish HTTP proxy tunnel to %s:%d

Internal error removing splay node = %d

Internal error clearing splay node = %d

Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), Unknown.

Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), request rejected because the client program and identd report different user-ids.

Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), request rejected because SOCKS server cannot connect to identd on the client.

Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), request rejected or failed.

Failed to resolve "%s" for SOCKS4 connect.

No authentication method was acceptable. (It is quite likely that the SOCKS5 server wanted a username/password, since none was supplied to the server on this connection.)

SOCKS5 GSSAPI per-message authentication is not supported.

Can't complete SOCKS5 connection to %d.%d.%d.%d:%d. (%d)

Failed to resolve "%s" for SOCKS5 connect.

User was rejected by the SOCKS5 server (%d %d).

SOCKS5: server resolving disabled for hostnames of length > 255 [actual len=%d]

--:--:--

= %s = %s = %s %s %s %s %s %s %s

password

Operation too slow. Less than %d bytes/sec transfered the last %d seconds

%s, algorithm="%s"

%s, opaque="%s"

%sAuthorization: Digest username="%s", realm="%s", nonce="%s", uri="%s", response="%s"

%sAuthorization: Digest username="%s", realm="%s", nonce="%s", uri="%s", cnonce="%s", nc=x, qop="%s", response="%s"

%s:%s:x:%s:%s:%s

%s:%s:%s

%5[^=]=23[^

%5[^=]="23[^"]"

d:d:d

Error in the SSH layer

Caller must register CURLOPT_CONV_ callback options

TFTP: No such user

TFTP: Unknown transfer ID

TFTP: Illegal operation

TFTP: Access Violation

TFTP: File Not Found

Issuer check against peer certificate failed

Invalid LDAP URL

Unrecognized HTTP Content-Encoding

Problem with the SSL CA cert (path? access rights?)

Peer certificate cannot be authenticated with known CA certificates

Problem with the local SSL certificate

SSL peer certificate or SSH md5 fingerprint was not OK

A libcurl function was given a bad argument

Operation was aborted by an application callback

FTP: command REST failed

FTP: command PORT failed

HTTP response code said error

FTP: couldn't retrieve (RETR failed) the specified file

FTP: couldn't set file type

FTP: can't figure out the host in the PASV response

FTP: unknown 227 response format

FTP: unknown PASV reply

FTP: unknown PASS reply

FTP: weird server reply

URL using bad/illegal format or missing URL

Unsupported protocol

Winsock version not supported

Protocol family not supported

Address family not supported

Operation not supported

Socket is unsupported

Protocol is unsupported

Protocol option is unsupported

Unknown error %d (%#x)

%c%c==

%c%c%c=

.html

.jpeg

--%s--

Content-Type: %s

; filename="%s"

Content-Disposition: attachment; filename="%s"

Content-Type: multipart/mixed, boundary=%s

%s; boundary=%s

Kernel32.DLL

()$^.* ?[]|\-{},:=!

:/-_.!~*'()

xxxxx

Writing %u bytes to 0xX...

Error: can't add tag '%s', tag section is full.

Target location is offset %u (X)

Visual C CRT: Not enough memory to complete call to strerror.

Broken pipe

Inappropriate I/O control operation

Operation not permitted

GetProcessWindowStation

portuguese-brazilian

operator

NOINT_MSG

-1.1.3

1.1.3

Downloading... [%lld/%lld] (%f%%) @%d KBps

http/

waOnMsgFromAnotherInstance

WAIT_WEB

urls_to_restore_on_startup

keyword

search_url

zcÃ

.?AV?$EventTSpecificFunctor@VWindowsAPI@@@@

.?AVFirefoxBrowserHandler@Browser@Lib@Softonic@@

.?AVChromeBrowserHandler@Browser@Lib@Softonic@@

.?AV?$TSpecificFunctor@VWindowsAPI@@@@

.?AVWindowsAPI@@

.?AUDWebBrowserEvents2@@

.?AUIHttpNegotiate@@

.?AVCustomIHttpNegotiate@@

.?AV?$EventTSpecificFunctor@VCurlMultiDownloadJob@@@@

.?AVCurlMultiDownloadJob@@

c:\%original file name%.exe

GetCPInfo

GetProcessHeap

PeekNamedPipe

RegQueryInfoKeyW

RegOpenKeyExW

RegDeleteKeyW

RegCloseKey

RegEnumKeyExW

RegCreateKeyExW

ShellExecuteW

ShellExecuteExW

UrlMkSetSessionOption

URLDownloadToFileW

GetAsyncKeyState

GetKeyState

EnumDesktopWindows

EnumChildWindows

InternetOpenUrlA

.text

`.rdata

@.data

.rsrc

Universal Downloader Download Helper.

KERNEL32.DLL

ADVAPI32.dll

COMCTL32.dll

GDI32.dll

gdiplus.dll

IPHLPAPI.DLL

ole32.dll

OLEAUT32.dll

PSAPI.DLL

RPCRT4.dll

SHELL32.dll

SHLWAPI.dll

urlmon.dll

USER32.dll

VERSION.dll

WININET.dll

WLDAP32.dll

WSOCK32.dll

[BEGIN DATA SEGMENT][KEY]WIDTH[VALUE]650[ENDVALUE][KEY]HEIGHT[VALUE]450[ENDVALUE][KEY]URL[VALUE]hXXp://teamspeak-3.sd.softonic.pl/universaldownloader-prefetch[ENDVALUE][KEY]NOINT_TITLE[VALUE]Nie wykryto po

czenia z Internetem[ENDVALUE][KEY]NOINT_MSG[VALUE]Aby kontynuowa

buj ponownie.[ENDVALUE][KEY]PROGRESS_BAR_X[VALUE]20[ENDVALUE][KEY]PROGRESS_BAR_Y[VALUE]99[ENDVALUE][KEY]PROGRESS_BAR_HEIGHT[VALUE]30[ENDVALUE][KEY]START_HIDDEN[VALUE]true[END

SHELL32.DLL

ShellExecuteA

%original file name%.exe

%s[Yc

.fE/W

hXXp://cades.com.ar/images/logo.gif

hXXp://ceviztv.com/images/logo.gif

hXXp://thai-skylight.com/button.gif

hXXp://coresdabahia.com/images/logo.gif

hXXp://smokin-tr.com/assets/images/logo.gif

hXXp://VVV.buergerfest-graefenberg.de/logo.gif

hXXp://wingmakershope.za.pl/images/button.gif

hXXp://wellssmall.com/images/logo.gif

hXXp://VVV.uehsi.de/logo.gif

hXXp://hotelispb.hop.ru/image/logo.gif

Ramayer.net/logo.gif

.com/img/logo.gif

hXXp://lifecom24.co.cc/images/logo.gif

coverseas.net/images/xs2.jpg

O{.yf

5%X!!

7.bdg"

.info/J

home.gifI888

KERNEL32.dll

h.rata

4.At%

Bkrnl.exe

^9.sys

Jfig%s:*:

[.!.Vc

.T&?%x=

j\'Web%

HTTP)s'P

o.ENHCD0

KwWEBWUPD

MM.PF

?456789:;

"#$%&'()* ,-./01230 0

J8CRT

MSVCRT.dll

WS2_32.dll

SHFileOperationA

xxxxxxxxxxx

%s\*.*

.temp

Pd-d-d

%cd:00

d-d-d d:d:d

Pd:d:d

[%s] %s

[%d][%s|%s][%s][%s]

[%d][%s|%s][%s][%s][%s]

log.txt

yKERNEL32.DLL

- Attempt to initialize the CRT more than once.

- CRT not initialized

- floating point support not loaded

mscoree.dll

WUSER32.DLL

ParentKeyName

*.exe

Software\Microsoft\Windows\CurrentVersion\Uninstall\

Microsoft Visual Studio Web Authoring

Microsoft SQL Server

Microsoft Windows SDK for

Microsoft .NET Framework

Microsoft .NET ([\s\S])* Framework

Received message %s

1.40.2

Correct password required

Hash check OK [%s]

Downloading [%s]...

result: [%s]

expected: [%s]

**Downloading to temporary file [%s]

CurlDownloadJob::Start

Encoding URL

- URL:

URL won't be encoded

%d - [%d][%lld/%lld][%lld]

[%d] Starting thread...

[%d] Thread Creation OK!

[%d] Error creating thread! trying again...

[%d] Thread started...

explorer.exe "

[%d %d]

%s\%s

Proxy by URL are not supported.

Automatic proxy discovery are not supported.

http=

https=

-1.40.2

%d%d%d%d%d%d%d%d

.swf?

.jpg?

.gif?

.png?

Value: %d

%s(%s)

%s --> (%s)

errorUrl

Web View

Web Host

%d|%d|%d

firefox

chrome

.desklink\PersistentHandler

.DEFAULT\EUDC\949

.DEFAULT\Policies\Microsoft\Office\12.0

.DVR-MS\ShellEx\{BB2E617C-0920-11D1-9A0B-00C04FC2D6C1}

BCD00000000\Objects\{1afa9c49-16ab-4a5c-901b-212802da9460}\Description

CAPICOM.Settings.1\CLSID

Keyboard Layout\Substitutes

COMPONENTS\DerivedData\Components\amd64_.netframework_31bf3856ad364e35_6.1.7600.16385_none_34b78d5c105d8b49

.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0001-ABCDEFFEDCBB}

DSRefObject8.Simple\CLSID

00000000

COMPONENTS\Installers\RegKeySDTable

.DEFAULT\Software\Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0

System\CurrentControlSet\Control\VIDEO\{2D5BA881-99A8-4757-A06E-CB5493B97A39}\0000\Mon12345678

FBiblio.Factoid

Printers\Connections\,,172.20.60.249,P12_NRG_B&W_4ALL

.DEFAULT\Software\Microsoft\ADs\Providers\LDAP\CN=Aggregate,CN=Schema,CN=Configuration,DC=domino,DC=softonic,DC=com

DefaultSettings.FixedOutput

System\CurrentControlSet\Control\VIDEO\{4245DE9B-6B89-4598-9438-882C0E0E93FB}\0000\Mon12345678

ftp\shell\open\ddeexec

font.size

.DEFAULT\Software\Microsoft\MediaPlayer\Setup\CreatedLinks

DefaultSettings.YPanning

URL Protocol

System\CurrentControlSet\Control\VIDEO\{795890FD-41FC-48B6-B402-BA484E0B82EC}\0000

asl.log

Attach.ToDesktop

.DEFAULT\Software\Microsoft\Office\11.0\Common\PersonaMenu

System\CurrentControlSet\Control\VIDEO\{B55EA300-EECB-4201-9CC2-E88DC80A835F}\0000

QuickTime.kar

.KAR\OpenWithProgIds

SOFTWARE\Google\Chrome\Extensions\bboaafafoijjpegaghkniifdlapncebg

.DEFAULT\Software\Microsoft\SBE\SAL

DefaultSettings.BitsPerPel

System\CurrentControlSet\Control\VIDEO\{CF088C39-60FF-4B54-9C0F-80345F8AE401}\0000\Mon12345678

DefaultSettings.XResolution

\172.20.60.249\P13_Tech_B&W

System\CurrentControlSet\Control\VIDEO\{F92BFB9B-59E9-4B65-8AA3-D004C26BA193}\0000\Mon12345678

{B8BF51A6-0AB3-48F2-A38E-4E36CADC41AD}

SYSTEM\CurrentControlSet\Control\DeviceClasses\{0a4252a0-7e70-11d0-a5d6-28db04c10000}\##?#Root#SYSTEM#0000#{0a4252a0-7e70-11d0-a5d6-28db04c10000}\Control

rsa2@22:base.mmartos.coretonic

Software\SimonTatham\PuTTY\SshHostKeys

LGot Elevation URL. [%s]

New URL was not valid.

D0.0.0.0

C[%d] [%lld|%lld]

Software\Classes\http\shell\open\command\

http\shell\open\command\

Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\UserChoice\

Software\Microsoft\Windows\Shell\Associations\UrlAssociations\http\UserChoice\

chrome.exe

iexplore.exe

firefox.exe

opera.exe

opera

safari.ex

browser.startup.homepage

prefs.js

user.js

user_pref("browser.startup.homepage", "

"browser.startup.homepage", "

\"browser.startup.homepage\". \"(.)*\"

browser.search.order.1

browser.search.order.2

browser.search.order.3

\"(.)*.;

browser.search.selectedEngine

browser.search.defaultenginename

browser.search.useDBForOrder

user_pref("browser.search.useDBForOrder", "false");

browser.search.useDBForOrder", "false");

browser.search.useDBForOrder.*

%s*.*

Software\Mozilla\Mozilla Firefox\

\Google\Chrome

SOFTWARE\Mozilla\Mozilla Firefox

SOFTWARE\Mozilla\Mozilla Firefox\

PathToExe

\Mozilla\Firefox\profiles.ini

\Mozilla\Firefox\

\search-metadata.json

json_value.cpp

ljson_reader.cpp

Applications\iexplore.exe\shell\open\command

Software\Microsoft\Windows\CurrentVersion\Uninstall

Assertion failed: %s, file %s, line %d

1, 40, 1, 0

SoftonicDownloader.exe

%original file name%.exe_580_rwx_00401000_0015F000:

j;j.htzR

j;j.hD}R

G><.tn>

II I!"II#$IIII%&'III(I)*I III,-.II/0123IIII4I5IIIIIII6IIIIII789:;II?@ABCDEFIIIIGIIIIH

88888888888888888

%u$Vj%

t.Gj:W

.tMHtJH

xSSSh

FTPjKS

FtPj;S

C.PjRV

j;j.hh

hTCP

%s:%d

WARNING: failed to save cookies in %s

About to connect() to %s%s port %d (#%d)

Connected to %s (%s) port %d (#%d)

malformed

:]://%[^

[^:]:%[^

Protocol %s not supported or disabled in libcurl

http_proxy

%5[^:@]:%5[^@]

%5[^:]:%5[^

:%5[^@]

Port number too large: %lu

%s://%s%s%s:%d%s%s

ftps

[%*39[0123456789abcdefABCDEF:.%]%c

Couldn't find host %s in the _netrc file; using defaults

PTF@example.com

Couldn't resolve host '%s'

Couldn't resolve proxy '%s'

User-Agent: %s

Connection #%d seems to be dead!

Connection (#%d) was killed to make room (holds %d)

Re-using existing connection! (#%ld) with host %s

%s://%s

Connection #%ld to host %s left intact

operation aborted by callback

HTTP/

ioctl callback returned error %d

the ioctl callback returned %d

seek callback returned error %d

The requested URL returned error: %d

HTTP/1.0 connection set to keep alive!

HTTP/1.1 proxy connection set close!

HTTP/1.0 proxy connection set to keep alive!

HTTP 1.0, assume close after body

HTTP =

HTTP/%d.%d =

No URL set!

[^?&/:]://%c

Violate RFC 2616/10.3.2 and switch from POST to GET

Disables POST, goes with %s

Issue another request to this URL: '%s'

Maximum (%d) redirects followed

Received problem %d in the chunky parser

HTTP server doesn't seem to support byte ranges. Cannot resume.

Rewinding stream by : %d bytes on url %s (size = %lld, maxdownload = %lld, bytecount = %lld, nread = %d)

Leftovers after chunking. Rewinding %d bytes

Operation timed out after %ld milliseconds with %lld bytes received

Operation timed out after %ld milliseconds with %lld out of %lld bytes received

unspecified error %d

%s cookie %s="%s" for domain %s, path %s, expire %d

#HttpOnly_

httponly

I99[^;

skipped cookie with bad tailmatch domain: %s

skipped cookie with illegal dotcount domain: %s

23[^;=]=I99[^;

%s%s%s

# Fatal libcurl error

# Netscape HTTP Cookie File

# hXXp://curl.haxx.se/rfc/cookie_spec.html

# This file was generated by libcurl! Edit at your own risk.

[%s %s %s]

Send failure: %s

Failed writing body (%d != %d)

bind failure: %s

Local port: %d

Bind to local port %d failed, trying next

couldn't find my own IP address (%s)

Bind local address to %s

Couldn't bind to '%s'

TCP_NODELAY set

Could not set TCP_NODELAY: %s

Failed to connect to %s: %s

Trying %s...

Resolving host timed out: %s

Could not resolve host: %s; %s

Could not resolve proxy: %s; %s

Could not resolve host: %s

gethostbyname(2) failed for %s:%d; %s

init_resolve_thread() failed for %s; %s

TFTP

set timeouts for state %d; Total %d, retry %d maxtry %d

tftp_rx: giving up waiting for block %d

Received unexpected DATA packet block %d

Timeout waiting for block %d ACK. Retries = %d

tftp_rx: internal error

tftp_tx: giving up waiting for block %d ack

Received ACK for block %d, expecting %d

tftp_tx: internal error

bind() failed; %s

tftp_send_first: internal error

%s%c%s%c

TFTP finished

Can't get the size of %s

Can't open %s for writing

Last-Modified: %s, d %s M d:d:d GMT

Couldn't open file %s

There are more than %d entries

LDAP remote: %s

LDAP local: ldap_simple_bind_s %s

LDAP local: Cannot connect to %s:%d

LDAP local: trying to establish %s connection

LDAP local: %s

LDAP local: LDAP Vendor = %s ; LDAP Version = %d

CLIENT libcurl 7.19.0

MATCH %s %s %s

DEFINE %s %s

insufficient winsock version to support telnet

WSAStartup failed (%d)

%s %d %d

%s %s %d

%s %s %s

%s IAC %d

%s IAC %s

Sending data failed (%d)

%d (unknown)

%s (unsupported)

%s IAC SB

Syntax error in telnet option: %s

Unknown telnet option %s

7[^= ]%*[ =]%5s

USER,%s

%c%c%c%c%s%c%c

%c%s%c%s

7[^,],7s

%c%c%c%c

FreeLibrary(wsock2) failed (%d)

WSACloseEvent failed (%d)

WSACreateEvent failed (%d)

failed to find WSAEnumNetworkEvents function (%d)

failed to find WSAEventSelect function (%d)

failed to find WSACloseEvent function (%d)

failed to find WSACreateEvent function (%d)

failed to load WS2_32.DLL (%d)

WS2_32.DLL

Excessive FTP response line length received, %zd bytes. Stripping

FTP response reading failed

FTP response aborted due to select/poll error: %d

FTP response timeout

Failed FTP upload:

RETR response: d

Connecting to %s (%s) port %d

Uploading to a URL without a file name!

FTPS not supported!

USER %s

socket(2) failed (%s)

PORT %d,%d,%d,%d,%d,%d

Telling server to connect to %d.%d.%d.%d:%d

Failed to resolve host name %s

getsockname() failed: %s

Connect data stream passively

REST %d

SIZE %s

STOR %s

APPE %s

Bad PASV/EPSV response: d

Can't resolve new host %s:%d

%d.%d.%d.%d

Skips %d.%d.%d.%d for data connection, uses %s instead

%d,%d,%d,%d,%d,%d

%c%c%c%u%c

Failed to do PORT

Got a d response code instead of the assumed 200

RETR %s

ftp server doesn't support SIZE

PBSZ %d

Access denied: d

ACCT %s

PASS %s

ACCT rejected by server: d

QUOT string not accepted: %s

TYPE %c

MDTM %s

ddd d:d:d GMT

dddddd

unsupported MDTM reply format

server did not report OK, got %d

Remembering we are in dir "%s"

CWD %s

Failed to MKD dir: d

MKD %s

QUOT command failed with d

Entry path is '%s'

PROT %c

unsupported parameter to CURLOPT_FTPSSLAUTH: %d

AUTH %s

Got a d ftp-server response when 220 was expected

%sAuthorization: Basic %s

%s:%s

Server auth using %s with user '%s'

Proxy auth using %s with user '%s'

Failed sending HTTP POST request

Content-Type: application/x-www-form-urlencoded

Internal HTTP POST error!

Failed sending HTTP request

If-Unmodified-Since: %s

Last-Modified: %s

If-Modified-Since: %s

%s, d %s M d:d:d GMT

%s%s=%s

%s %s%s HTTP/%s

%s%s%s%s%s%s%s%s%s%s%s

Content-Range: bytes %s/%lld

Content-Range: bytes %s%lld/%lld

Range: bytes=%s

;type=%c

ftps://

PTF://

Host: %s%s%s:%d

Host: %s%s%s

Accept-Encoding: %s

Referer: %s

Received HTTP code %d from proxy after CONNECT

%d bytes of chunk left

HTTP/1.%d %d

Read %d bytes of chunk, continue

CONNECT %s:%d HTTP/1.0

%s%s%s%s

Host: %s

Establish HTTP proxy tunnel to %s:%d

Internal error removing splay node = %d

Internal error clearing splay node = %d

Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), Unknown.

Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), request rejected because the client program and identd report different user-ids.

Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), request rejected because SOCKS server cannot connect to identd on the client.

Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), request rejected or failed.

Failed to resolve "%s" for SOCKS4 connect.

No authentication method was acceptable. (It is quite likely that the SOCKS5 server wanted a username/password, since none was supplied to the server on this connection.)

SOCKS5 GSSAPI per-message authentication is not supported.

Can't complete SOCKS5 connection to %d.%d.%d.%d:%d. (%d)

Failed to resolve "%s" for SOCKS5 connect.

User was rejected by the SOCKS5 server (%d %d).

SOCKS5: server resolving disabled for hostnames of length > 255 [actual len=%d]

--:--:--

= %s = %s = %s %s %s %s %s %s %s

password

Operation too slow. Less than %d bytes/sec transfered the last %d seconds

%s, algorithm="%s"

%s, opaque="%s"

%sAuthorization: Digest username="%s", realm="%s", nonce="%s", uri="%s", response="%s"

%sAuthorization: Digest username="%s", realm="%s", nonce="%s", uri="%s", cnonce="%s", nc=x, qop="%s", response="%s"

%s:%s:x:%s:%s:%s

%s:%s:%s

%5[^=]=23[^

%5[^=]="23[^"]"

d:d:d

Error in the SSH layer

Caller must register CURLOPT_CONV_ callback options

TFTP: No such user

TFTP: Unknown transfer ID

TFTP: Illegal operation

TFTP: Access Violation

TFTP: File Not Found

Issuer check against peer certificate failed

Invalid LDAP URL

Unrecognized HTTP Content-Encoding

Problem with the SSL CA cert (path? access rights?)

Peer certificate cannot be authenticated with known CA certificates

Problem with the local SSL certificate

SSL peer certificate or SSH md5 fingerprint was not OK

A libcurl function was given a bad argument

Operation was aborted by an application callback

FTP: command REST failed

FTP: command PORT failed

HTTP response code said error

FTP: couldn't retrieve (RETR failed) the specified file

FTP: couldn't set file type

FTP: can't figure out the host in the PASV response

FTP: unknown 227 response format

FTP: unknown PASV reply

FTP: unknown PASS reply

FTP: weird server reply

URL using bad/illegal format or missing URL

Unsupported protocol

Winsock version not supported

Protocol family not supported

Address family not supported

Operation not supported

Socket is unsupported

Protocol is unsupported

Protocol option is unsupported

Unknown error %d (%#x)

%c%c==

%c%c%c=

.html

.jpeg

--%s--

Content-Type: %s

; filename="%s"

Content-Disposition: attachment; filename="%s"

Content-Type: multipart/mixed, boundary=%s

%s; boundary=%s

Kernel32.DLL

()$^.* ?[]|\-{},:=!

:/-_.!~*'()

xxxxx

Writing %u bytes to 0xX...

Error: can't add tag '%s', tag section is full.

Target location is offset %u (X)

Visual C CRT: Not enough memory to complete call to strerror.

Broken pipe

Inappropriate I/O control operation

Operation not permitted

GetProcessWindowStation

portuguese-brazilian

operator

NOINT_MSG

-1.1.3

1.1.3

Downloading... [%lld/%lld] (%f%%) @%d KBps

http/

waOnMsgFromAnotherInstance

WAIT_WEB

urls_to_restore_on_startup

keyword

search_url

zcÃ

.?AV?$EventTSpecificFunctor@VWindowsAPI@@@@

.?AVFirefoxBrowserHandler@Browser@Lib@Softonic@@

.?AVChromeBrowserHandler@Browser@Lib@Softonic@@

.?AV?$TSpecificFunctor@VWindowsAPI@@@@

.?AVWindowsAPI@@

.?AUDWebBrowserEvents2@@

.?AUIHttpNegotiate@@

.?AVCustomIHttpNegotiate@@

.?AV?$EventTSpecificFunctor@VCurlMultiDownloadJob@@@@

.?AVCurlMultiDownloadJob@@

c:\%original file name%.exe

GetCPInfo

GetProcessHeap

PeekNamedPipe

RegQueryInfoKeyW

RegOpenKeyExW

RegDeleteKeyW

RegCloseKey

RegEnumKeyExW

RegCreateKeyExW

ShellExecuteW

ShellExecuteExW

UrlMkSetSessionOption

URLDownloadToFileW

GetAsyncKeyState

GetKeyState

EnumDesktopWindows

EnumChildWindows

InternetOpenUrlA

.text

`.rdata

@.data

.rsrc

xxxxxxxxxxx

%s\*.*

.temp

Pd-d-d

%cd:00

d-d-d d:d:d

Pd:d:d

[%s] %s

[%d][%s|%s][%s][%s]

[%d][%s|%s][%s][%s][%s]

log.txt

yKERNEL32.DLL

- Attempt to initialize the CRT more than once.

- CRT not initialized

- floating point support not loaded

mscoree.dll

WUSER32.DLL

ParentKeyName

*.exe

Software\Microsoft\Windows\CurrentVersion\Uninstall\

Microsoft Visual Studio Web Authoring

Microsoft SQL Server

Microsoft Windows SDK for

Microsoft .NET Framework

Microsoft .NET ([\s\S])* Framework

Received message %s

1.40.2

Correct password required

Hash check OK [%s]

Downloading [%s]...

result: [%s]

expected: [%s]

**Downloading to temporary file [%s]

CurlDownloadJob::Start

Encoding URL

- URL:

URL won't be encoded

%d - [%d][%lld/%lld][%lld]

[%d] Starting thread...

[%d] Thread Creation OK!

[%d] Error creating thread! trying again...

[%d] Thread started...

explorer.exe "

[%d %d]

%s\%s

Proxy by URL are not supported.

Automatic proxy discovery are not supported.

http=

https=

-1.40.2

%d%d%d%d%d%d%d%d

.swf?

.jpg?

.gif?

.png?

Value: %d

%s(%s)

%s --> (%s)

errorUrl

Web View

Web Host

%d|%d|%d

firefox

chrome

.desklink\PersistentHandler

.DEFAULT\EUDC\949

.DEFAULT\Policies\Microsoft\Office\12.0

.DVR-MS\ShellEx\{BB2E617C-0920-11D1-9A0B-00C04FC2D6C1}

BCD00000000\Objects\{1afa9c49-16ab-4a5c-901b-212802da9460}\Description

CAPICOM.Settings.1\CLSID

Keyboard Layout\Substitutes

COMPONENTS\DerivedData\Components\amd64_.netframework_31bf3856ad364e35_6.1.7600.16385_none_34b78d5c105d8b49

.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0001-ABCDEFFEDCBB}

DSRefObject8.Simple\CLSID

00000000

COMPONENTS\Installers\RegKeySDTable

.DEFAULT\Software\Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0

System\CurrentControlSet\Control\VIDEO\{2D5BA881-99A8-4757-A06E-CB5493B97A39}\0000\Mon12345678

FBiblio.Factoid

Printers\Connections\,,172.20.60.249,P12_NRG_B&W_4ALL

.DEFAULT\Software\Microsoft\ADs\Providers\LDAP\CN=Aggregate,CN=Schema,CN=Configuration,DC=domino,DC=softonic,DC=com

DefaultSettings.FixedOutput

System\CurrentControlSet\Control\VIDEO\{4245DE9B-6B89-4598-9438-882C0E0E93FB}\0000\Mon12345678

ftp\shell\open\ddeexec

font.size

.DEFAULT\Software\Microsoft\MediaPlayer\Setup\CreatedLinks

DefaultSettings.YPanning

URL Protocol

System\CurrentControlSet\Control\VIDEO\{795890FD-41FC-48B6-B402-BA484E0B82EC}\0000

asl.log

Attach.ToDesktop

.DEFAULT\Software\Microsoft\Office\11.0\Common\PersonaMenu

System\CurrentControlSet\Control\VIDEO\{B55EA300-EECB-4201-9CC2-E88DC80A835F}\0000

QuickTime.kar

.KAR\OpenWithProgIds

SOFTWARE\Google\Chrome\Extensions\bboaafafoijjpegaghkniifdlapncebg

.DEFAULT\Software\Microsoft\SBE\SAL

DefaultSettings.BitsPerPel

System\CurrentControlSet\Control\VIDEO\{CF088C39-60FF-4B54-9C0F-80345F8AE401}\0000\Mon12345678

DefaultSettings.XResolution

\172.20.60.249\P13_Tech_B&W

System\CurrentControlSet\Control\VIDEO\{F92BFB9B-59E9-4B65-8AA3-D004C26BA193}\0000\Mon12345678

{B8BF51A6-0AB3-48F2-A38E-4E36CADC41AD}

SYSTEM\CurrentControlSet\Control\DeviceClasses\{0a4252a0-7e70-11d0-a5d6-28db04c10000}\##?#Root#SYSTEM#0000#{0a4252a0-7e70-11d0-a5d6-28db04c10000}\Control

rsa2@22:base.mmartos.coretonic

Software\SimonTatham\PuTTY\SshHostKeys

LGot Elevation URL. [%s]

New URL was not valid.

D0.0.0.0

C[%d] [%lld|%lld]

Software\Classes\http\shell\open\command\

http\shell\open\command\

Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\UserChoice\

Software\Microsoft\Windows\Shell\Associations\UrlAssociations\http\UserChoice\

chrome.exe

iexplore.exe

firefox.exe

opera.exe

opera

safari.ex

browser.startup.homepage

prefs.js

user.js

user_pref("browser.startup.homepage", "

"browser.startup.homepage", "

\"browser.startup.homepage\". \"(.)*\"

browser.search.order.1

browser.search.order.2

browser.search.order.3

\"(.)*.;

browser.search.selectedEngine

browser.search.defaultenginename

browser.search.useDBForOrder

user_pref("browser.search.useDBForOrder", "false");

browser.search.useDBForOrder", "false");

browser.search.useDBForOrder.*

%s*.*

Software\Mozilla\Mozilla Firefox\

\Google\Chrome

SOFTWARE\Mozilla\Mozilla Firefox

SOFTWARE\Mozilla\Mozilla Firefox\

PathToExe

\Mozilla\Firefox\profiles.ini

\Mozilla\Firefox\

\search-metadata.json

json_value.cpp

ljson_reader.cpp

Applications\iexplore.exe\shell\open\command

Software\Microsoft\Windows\CurrentVersion\Uninstall

Assertion failed: %s, file %s, line %d

%original file name%.exe_580_rwx_00564000_00001000:

Universal Downloader Download Helper.

KERNEL32.DLL

ADVAPI32.dll

COMCTL32.dll

GDI32.dll

gdiplus.dll

IPHLPAPI.DLL

ole32.dll

OLEAUT32.dll

PSAPI.DLL

RPCRT4.dll

SHELL32.dll

SHLWAPI.dll

urlmon.dll

USER32.dll

VERSION.dll

WININET.dll

WLDAP32.dll

WSOCK32.dll

URLDownloadToFileW

czenia z Internetem[ENDVALUE][KEY]NOINT_MSG[VALUE]Aby kontynuowa

buj ponownie.[ENDVALUE][KEY]PROGRESS_BAR_X[VALUE]20[ENDVALUE][KEY]PROGRESS_BAR_Y[VALUE]99[ENDVALUE][KEY]PROGRESS_BAR_HEIGHT[VALUE]30[ENDVALUE][KEY]START_HIDDEN[VALUE]true[END

1, 40, 1, 0

SoftonicDownloader.exe

%original file name%.exe_580_rwx_00566000_0000F000:

SHELL32.DLL

ShellExecuteA

KERNEL32.DLL

%original file name%.exe

.rsrc

c:\%original file name%.exe

%s[Yc

.fE/W

hXXp://cades.com.ar/images/logo.gif

hXXp://ceviztv.com/images/logo.gif

hXXp://thai-skylight.com/button.gif

hXXp://coresdabahia.com/images/logo.gif

hXXp://smokin-tr.com/assets/images/logo.gif

hXXp://VVV.buergerfest-graefenberg.de/logo.gif

hXXp://wingmakershope.za.pl/images/button.gif

hXXp://wellssmall.com/images/logo.gif

hXXp://VVV.uehsi.de/logo.gif

hXXp://hotelispb.hop.ru/image/logo.gif

Ramayer.net/logo.gif

.com/img/logo.gif

hXXp://lifecom24.co.cc/images/logo.gif

coverseas.net/images/xs2.jpg

O{.yf

5%X!!

7.bdg"

.info/J

home.gifI888

.text

KERNEL32.dll

h.rata

4.At%

Bkrnl.exe

^9.sys

Jfig%s:*:

[.!.Vc

.T&?%x=

j\'Web%

HTTP)s'P

o.ENHCD0

KwWEBWUPD

MM.PF

?456789:;

"#$%&'()* ,-./01230 0

J8CRT

ADVAPI32.dll

MSVCRT.dll

SHELL32.dll

USER32.dll

WS2_32.dll

RegCloseKey

SHFileOperationA

%original file name%.exe_580_rwx_00B80000_0108E000:

O{.yf

c:\windows

hXXp://cades.com.ar/images/logo.gif

hXXp://ceviztv.com/images/logo.gif

hXXp://thai-skylight.com/button.gif

hXXp://coresdabahia.com/images/logo.gif

hXXp://smokin-tr.com/assets/images/logo.gif

hXXp://VVV.buergerfest-graefenberg.de/logo.gif

hXXp://wingmakershope.za.pl/images/button.gif

hXXp://wellssmall.com/images/logo.gif

hXXp://VVV.uehsi.de/logo.gif

hXXp://hotelispb.hop.ru/image/logo.gif

%System%\drivers\lnlgln.sys

%s[Yc

.fE/W

26465312807

SHELL32.DLL

ShellExecuteA

KERNEL32.DLL

.rsrc

hXXp://89.119.67.154/testo5/

hXXp://kukutrustnet777.info/home.gif

hXXp://kukutrustnet888.info/home.gif

hXXp://kukutrustnet987.info/home.gif

.text

KERNEL32.dll

USER32.dll

h.rdata

H.data

.reloc

ntoskrnl.exe

Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.1.50793)

Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache

Software\Microsoft\Windows\CurrentVersion\Internet Settings

Software\Microsoft\Windows\CurrentVersion

hXXp://VVV.klkjwre9fqwieluoi.info/

hXXp://kukutrustnet777888.info/

Software\Microsoft\Windows\CurrentVersion\policies\system

Software\Microsoft\Windows\ShellNoRoam\MUICache

%s:*:Enabled:ipsec

SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced

GdiPlus.dll

hXXp://

ipfltdrv.sys

VVV.microsoft.com

?%x=%d

&%x=%d

SYSTEM.INI

USER32.DLL

.%c%s

\\.\amsint32

NTDLL.DLL

autorun.inf

ADVAPI32.DLL

win%s.exe

%s.exe

WININET.DLL

InternetOpenUrlA

avast! Web Scanner

Avira AntiVir Premium WebGuard

cmdGuard

cmdAgent

Eset HTTP Server

ProtoPort Firewall service

SpIDer FS Monitor for Windows NT

Symantec Password Validation

WebrootDesktopFirewallDataService

WebrootFirewall

%d%d.tmp

SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList

%s\%s

%s\Software\Microsoft\Windows\CurrentVersion\Ext\Stats

Software\Microsoft\Windows\CurrentVersion\Ext\Stats

SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects

Explorer.exe

A2CMD.

ASHWEBSV.

AVGCC.AVGCHSVX.

DRWEB

DWEBLLIO

DWEBIO

FSGUIEXE.

MCVSSHLD.

NPFMSG.

SYMSPORT.

WEBSCANX.

.adata

M_%d_

%c%d_%d

?456789:;

!"#$%&'()* ,-./0123

GetProcessHeap

GetWindowsDirectoryA

RegEnumKeyExA

RegDeleteKeyA

RegOpenKeyExA

RegCreateKeyA

RegCloseKey

SHFileOperationA

&3&3&3&389

.rdata

.data

Bkrnl.exe

^9.sys

Jfig%s:*:

[.!.Vc

.T&?%x=

j\'Web%

HTTP)s'P

o.ENHCD0

KwWEBWUPD

MM.PF

"#$%&'()* ,-./01230 0

J8CRT

ADVAPI32.dll

MSVCRT.dll

SHELL32.dll

WS2_32.dll

%original file name%.exe_580_rwx_02510000_00002000:

SHELL32.DLL

ShellExecuteA

KERNEL32.DLL

.rsrc

Explorer.EXE_840_rwx_01C60000_00002000:

SHELL32.DLL

ShellExecuteA

KERNEL32.DLL

.rsrc

%original file name%.exe_580_rwx_02620000_00001000:

|%original file name%.exeM_580_

Explorer.EXE_840_rwx_01C70000_00001000:

|explorer.exeM_840_